From e755687f9aef581ae049218936f0b30a44de19ef Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 24 Mar 2024 14:11:42 -0400 Subject: [PATCH] Fixes for 6.7 Signed-off-by: Sasha Levin --- ...om-bcmbca-bcm4908-drop-invalid-switc.patch | 44 ++ ...2s-tdm-fix-inaccurate-sampling-rates.patch | 581 +++++++++++++++ ...xx-don-t-strip-remove-function-when-.patch | 60 ++ .../bpf-report-rcu-qs-in-cpumap-kthread.patch | 55 ++ ...-the-correct-variable-in-mhi_ep_regi.patch | 39 + ...copying-to-iter-at-eof-on-sync-reads.patch | 73 ++ ...xilinx_hwicap-fix-null-vs-is_err-bug.patch | 40 + ...set-skip_power_up-in-etm4_init_arch_.patch | 59 ++ ...sue-where-a-source-device-s-helpers-.patch | 120 +++ ...policy-boost-behavior-on-socs-using-.patch | 99 +++ ...e-device-lock-during-netns-dismantle.patch | 105 +++ ...king-device-lock-in-pre_doit-operati.patch | 159 ++++ ...he-use-of-private-flags-in-post_doit.patch | 62 ++ ...devlink-parallel-commands-processing.patch | 63 ++ .../devlink-fix-port-new-reply-cmd-type.patch | 46 ++ ...move-private-netlink-flags-to-c-file.patch | 55 ++ ...gn-the-outgoing-bio-in-integrity_rec.patch | 79 ++ ...-a-memory-leak-when-rechecking-the-d.patch | 47 ++ queue-6.7/dm-io-support-io-priority.patch | 386 ++++++++++ .../drm-amdgpu-add-mmhub-3.3.1-support.patch | 49 ++ ...drop-setting-buffer-funcs-in-sdma442.patch | 81 +++ ...mmhub-client-id-out-of-bounds-access.patch | 47 ++ ...drm_fixp2int_round-making-it-add-0.5.patch | 51 ++ ...-uninit-value-access-in-hsr_get_node.patch | 98 +++ .../hsr-handle-failures-in-module-init.patch | 61 ++ ...tt-move-type-check-to-the-beginning-.patch | 55 ++ .../iio-gts-helper-fix-division-loop.patch | 56 ++ ...sure-mprls0025pa-fix-off-by-one-enum.patch | 52 ++ ...ring-don-t-save-restore-iowait-state.patch | 54 ++ ...x-poll_remove-stalled-req-completion.patch | 48 ++ ...ease-of-pinned-pages-when-__io_uaddr.patch | 88 +++ ...ding-packets-from-raw-sockets-via-ip.patch | 44 ++ ...nite-loop-when-expanding-a-macro-at-.patch | 47 ++ ...t-access-to-a-freed-page-in-page_poo.patch | 89 +++ ...ix-handling-of-all-link-local-frames.patch | 142 ++++ ...ix-link-local-frames-that-ingress-vl.patch | 182 +++++ ...revent-possible-incorrect-xtal-frequ.patch | 178 +++++ ...et-mtk_eth_soc-fix-ppe-hanging-issue.patch | 70 ++ ..._eth_soc-clear-mac_mcr_force_link-on.patch | 60 ++ ...read_poll_timeout-argument-type-in-g.patch | 53 ++ ...rt-rcu-qs-on-threaded-napi-repolling.patch | 87 +++ ...-proper-tca_taprio_tc_entry_index-ch.patch | 87 +++ ...ix-clk_name-exceed-max_dev_id-limits.patch | 41 ++ ...do-not-manipulate-gro-when-using-xdp.patch | 85 +++ ...les-do-not-compare-internal-table-fl.patch | 34 + ...les-fix-a-memory-leak-in-nf_tables_u.patch | 71 ++ ...t_pipapo-release-elements-in-clone-o.patch | 54 ++ ...p-don-t-check-devinit-disable-on-gsp.patch | 39 + ...e-bo-resource-bus-info-after-an-evic.patch | 43 ++ ...ction-fail-due-to-reserved-tag-alloc.patch | 78 ++ ...-matching-wake_up-api-variant-in-cgx.patch | 39 + ...use-separate-handlers-for-interrupts.patch | 69 ++ ...-the-mbox-up-or-down-message-via-reg.patch | 684 ++++++++++++++++++ ...d-up-messages-to-vf-only-when-vf-is-.patch | 39 + ...-default-max_active-works-instead-of.patch | 52 ++ ...t-till-detach_resources-msg-is-compl.patch | 54 ++ ...te-data-races-around-ignore_outgoing.patch | 105 +++ ...per-to-report-consolidated-flavor-qs.patch | 76 ++ ...quire-release-ordering-in-acquire-re.patch | 51 ++ ...after-free-of-net-in-reqsk_timer_han.patch | 155 ++++ ...-fix-incorrect-type-assignment-retur.patch | 44 ++ ...-fix-incorrect-type-in-assignment-fo.patch | 56 ++ ...ilation-error-with-fast_gup-and-rv32.patch | 42 ++ ...call-wrapper-for-word-size-arguments.patch | 126 ++++ ...ck-online-cpus-for-emulated-accesses.patch | 39 + ...t-irq_domain-instead-of-depending-on.patch | 59 ++ ...e-fix-average-steal-time-calculation.patch | 64 ++ ...ding-fix-ping-failure-due-to-short-t.patch | 87 +++ ...-don-t-remove-gpio-device-on-suspend.patch | 49 ++ ...ix-syntax-error-in-irq-error-message.patch | 40 + queue-6.7/series | 92 +++ ...-fsl-dpio-fix-kcalloc-argument-order.patch | 47 ++ ...id-potential-use-after-free-in-probe.patch | 74 ++ ...off-by-one-in-mx51-cpu-mode-burst-le.patch | 45 ++ ...ix-null-pointer-access-in-interrupt-.patch | 61 ++ ...fix-get_channel_from_mode-failure-pa.patch | 54 ++ ...syn_recv-handling-in-inet_twsk_purge.patch | 116 +++ ...fcnt-handling-in-__inet_hash_connect.patch | 92 +++ ...mediatek-lvts_thermal-fix-a-memory-l.patch | 43 ++ ...-drivers-qoriq-fix-getting-tmu-range.patch | 80 ++ ...ng-fix-tx_empty-to-return-tiocser_te.patch | 45 ++ ...t-fix-20-vs-0x20-typo-in-escsiignore.patch | 45 ++ ...72-use-irqflags-in-the-call-to-net22.patch | 47 ++ .../usb-phy-generic-get-the-vbus-supply.patch | 43 ++ .../vdpa-mlx5-allow-cvq-size-changes.patch | 83 +++ queue-6.7/vdpa_sim-reset-must-not-run.patch | 52 ++ ...x-unmap-leak-for-indirect-desc-table.patch | 74 ++ ...mxnet3-fix-missing-reserved-tailroom.patch | 62 ++ ...e-annotate-data-race-around-receivin.patch | 86 +++ ...er-cpu-initial-stack-for-vtl-context.patch | 102 +++ ...ment-refcnt-only-if-event-channel-is.patch | 115 +++ ...-warn-when-unbinding-an-event-channe.patch | 62 ++ ...-encapsulation-only-in-offload-modes.patch | 41 ++ 93 files changed, 7887 insertions(+) create mode 100644 queue-6.7/arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switc.patch create mode 100644 queue-6.7/asoc-rockchip-i2s-tdm-fix-inaccurate-sampling-rates.patch create mode 100644 queue-6.7/asoc-tlv320adc3xxx-don-t-strip-remove-function-when-.patch create mode 100644 queue-6.7/bpf-report-rcu-qs-in-cpumap-kthread.patch create mode 100644 queue-6.7/bus-mhi-ep-check-the-correct-variable-in-mhi_ep_regi.patch create mode 100644 queue-6.7/ceph-stop-copying-to-iter-at-eof-on-sync-reads.patch create mode 100644 queue-6.7/char-xilinx_hwicap-fix-null-vs-is_err-bug.patch create mode 100644 queue-6.7/coresight-etm4x-set-skip_power_up-in-etm4_init_arch_.patch create mode 100644 queue-6.7/coresight-fix-issue-where-a-source-device-s-helpers-.patch create mode 100644 queue-6.7/cpufreq-fix-per-policy-boost-behavior-on-socs-using-.patch create mode 100644 queue-6.7/devlink-acquire-device-lock-during-netns-dismantle.patch create mode 100644 queue-6.7/devlink-allow-taking-device-lock-in-pre_doit-operati.patch create mode 100644 queue-6.7/devlink-enable-the-use-of-private-flags-in-post_doit.patch create mode 100644 queue-6.7/devlink-fix-devlink-parallel-commands-processing.patch create mode 100644 queue-6.7/devlink-fix-port-new-reply-cmd-type.patch create mode 100644 queue-6.7/devlink-move-private-netlink-flags-to-c-file.patch create mode 100644 queue-6.7/dm-integrity-align-the-outgoing-bio-in-integrity_rec.patch create mode 100644 queue-6.7/dm-integrity-fix-a-memory-leak-when-rechecking-the-d.patch create mode 100644 queue-6.7/dm-io-support-io-priority.patch create mode 100644 queue-6.7/drm-amdgpu-add-mmhub-3.3.1-support.patch create mode 100644 queue-6.7/drm-amdgpu-drop-setting-buffer-funcs-in-sdma442.patch create mode 100644 queue-6.7/drm-amdgpu-fix-mmhub-client-id-out-of-bounds-access.patch create mode 100644 queue-6.7/drm-fix-drm_fixp2int_round-making-it-add-0.5.patch create mode 100644 queue-6.7/hsr-fix-uninit-value-access-in-hsr_get_node.patch create mode 100644 queue-6.7/hsr-handle-failures-in-module-init.patch create mode 100644 queue-6.7/hwtracing-hisi_ptt-move-type-check-to-the-beginning-.patch create mode 100644 queue-6.7/iio-gts-helper-fix-division-loop.patch create mode 100644 queue-6.7/iio-pressure-mprls0025pa-fix-off-by-one-enum.patch create mode 100644 queue-6.7/io_uring-don-t-save-restore-iowait-state.patch create mode 100644 queue-6.7/io_uring-fix-poll_remove-stalled-req-completion.patch create mode 100644 queue-6.7/io_uring-fix-release-of-pinned-pages-when-__io_uaddr.patch create mode 100644 queue-6.7/ipv4-raw-fix-sending-packets-from-raw-sockets-via-ip.patch create mode 100644 queue-6.7/kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch create mode 100644 queue-6.7/net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch create mode 100644 queue-6.7/net-dsa-mt7530-fix-handling-of-all-link-local-frames.patch create mode 100644 queue-6.7/net-dsa-mt7530-fix-link-local-frames-that-ingress-vl.patch create mode 100644 queue-6.7/net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch create mode 100644 queue-6.7/net-ethernet-mtk_eth_soc-fix-ppe-hanging-issue.patch create mode 100644 queue-6.7/net-mediatek-mtk_eth_soc-clear-mac_mcr_force_link-on.patch create mode 100644 queue-6.7/net-phy-fix-phy_read_poll_timeout-argument-type-in-g.patch create mode 100644 queue-6.7/net-report-rcu-qs-on-threaded-napi-repolling.patch create mode 100644 queue-6.7/net-sched-taprio-proper-tca_taprio_tc_entry_index-ch.patch create mode 100644 queue-6.7/net-txgbe-fix-clk_name-exceed-max_dev_id-limits.patch create mode 100644 queue-6.7/net-veth-do-not-manipulate-gro-when-using-xdp.patch create mode 100644 queue-6.7/netfilter-nf_tables-do-not-compare-internal-table-fl.patch create mode 100644 queue-6.7/netfilter-nf_tables-fix-a-memory-leak-in-nf_tables_u.patch create mode 100644 queue-6.7/netfilter-nft_set_pipapo-release-elements-in-clone-o.patch create mode 100644 queue-6.7/nouveau-gsp-don-t-check-devinit-disable-on-gsp.patch create mode 100644 queue-6.7/nouveau-reset-the-bo-resource-bus-info-after-an-evic.patch create mode 100644 queue-6.7/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch create mode 100644 queue-6.7/octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch create mode 100644 queue-6.7/octeontx2-af-use-separate-handlers-for-interrupts.patch create mode 100644 queue-6.7/octeontx2-detect-the-mbox-up-or-down-message-via-reg.patch create mode 100644 queue-6.7/octeontx2-pf-send-up-messages-to-vf-only-when-vf-is-.patch create mode 100644 queue-6.7/octeontx2-pf-use-default-max_active-works-instead-of.patch create mode 100644 queue-6.7/octeontx2-pf-wait-till-detach_resources-msg-is-compl.patch create mode 100644 queue-6.7/packet-annotate-data-races-around-ignore_outgoing.patch create mode 100644 queue-6.7/rcu-add-a-helper-to-report-consolidated-flavor-qs.patch create mode 100644 queue-6.7/rds-introduce-acquire-release-ordering-in-acquire-re.patch create mode 100644 queue-6.7/rds-tcp-fix-use-after-free-of-net-in-reqsk_timer_han.patch create mode 100644 queue-6.7/remoteproc-stm32-fix-incorrect-type-assignment-retur.patch create mode 100644 queue-6.7/remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch create mode 100644 queue-6.7/riscv-fix-compilation-error-with-fast_gup-and-rv32.patch create mode 100644 queue-6.7/riscv-fix-syscall-wrapper-for-word-size-arguments.patch create mode 100644 queue-6.7/riscv-only-check-online-cpus-for-emulated-accesses.patch create mode 100644 queue-6.7/rtc-mt6397-select-irq_domain-instead-of-depending-on.patch create mode 100644 queue-6.7/s390-vtime-fix-average-steal-time-calculation.patch create mode 100644 queue-6.7/selftests-forwarding-fix-ping-failure-due-to-short-t.patch create mode 100644 queue-6.7/serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch create mode 100644 queue-6.7/serial-max310x-fix-syntax-error-in-irq-error-message.patch create mode 100644 queue-6.7/soc-fsl-dpio-fix-kcalloc-argument-order.patch create mode 100644 queue-6.7/spi-lpspi-avoid-potential-use-after-free-in-probe.patch create mode 100644 queue-6.7/spi-spi-imx-fix-off-by-one-in-mx51-cpu-mode-burst-le.patch create mode 100644 queue-6.7/spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch create mode 100644 queue-6.7/staging-greybus-fix-get_channel_from_mode-failure-pa.patch create mode 100644 queue-6.7/tcp-fix-new_syn_recv-handling-in-inet_twsk_purge.patch create mode 100644 queue-6.7/tcp-fix-refcnt-handling-in-__inet_hash_connect.patch create mode 100644 queue-6.7/thermal-drivers-mediatek-lvts_thermal-fix-a-memory-l.patch create mode 100644 queue-6.7/thermal-drivers-qoriq-fix-getting-tmu-range.patch create mode 100644 queue-6.7/tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch create mode 100644 queue-6.7/tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch create mode 100644 queue-6.7/usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch create mode 100644 queue-6.7/usb-phy-generic-get-the-vbus-supply.patch create mode 100644 queue-6.7/vdpa-mlx5-allow-cvq-size-changes.patch create mode 100644 queue-6.7/vdpa_sim-reset-must-not-run.patch create mode 100644 queue-6.7/virtio-packed-fix-unmap-leak-for-indirect-desc-table.patch create mode 100644 queue-6.7/vmxnet3-fix-missing-reserved-tailroom.patch create mode 100644 queue-6.7/wireguard-receive-annotate-data-race-around-receivin.patch create mode 100644 queue-6.7/x86-hyperv-use-per-cpu-initial-stack-for-vtl-context.patch create mode 100644 queue-6.7/xen-events-increment-refcnt-only-if-event-channel-is.patch create mode 100644 queue-6.7/xen-evtchn-avoid-warn-when-unbinding-an-event-channe.patch create mode 100644 queue-6.7/xfrm-allow-udp-encapsulation-only-in-offload-modes.patch diff --git a/queue-6.7/arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switc.patch b/queue-6.7/arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switc.patch new file mode 100644 index 00000000000..a2719fe7926 --- /dev/null +++ b/queue-6.7/arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switc.patch @@ -0,0 +1,44 @@ +From d2bd0c1704a4557da50ab6066bc64f037c9c93b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jan 2024 12:56:36 +0100 +Subject: arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 27058b95fbb784406ea4c40b20caa3f04937140c ] + +Ethernet switch does not have addressable subnodes. + +This fixes: +arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dtb: ethernet-switch@0: '#address-cells', '#size-cells' do not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/net/dsa/brcm,sf2.yaml# + +Fixes: 527a3ac9bdf8 ("arm64: dts: broadcom: bcm4908: describe internal switch") +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240111115636.12095-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +index 2f124b027bbf0..aadfa0ae05252 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +@@ -227,9 +227,6 @@ + brcm,num-gphy = <5>; + brcm,num-rgmii-ports = <2>; + +- #address-cells = <1>; +- #size-cells = <0>; +- + ports: ports { + #address-cells = <1>; + #size-cells = <0>; +-- +2.43.0 + diff --git a/queue-6.7/asoc-rockchip-i2s-tdm-fix-inaccurate-sampling-rates.patch b/queue-6.7/asoc-rockchip-i2s-tdm-fix-inaccurate-sampling-rates.patch new file mode 100644 index 00000000000..6f440033e35 --- /dev/null +++ b/queue-6.7/asoc-rockchip-i2s-tdm-fix-inaccurate-sampling-rates.patch @@ -0,0 +1,581 @@ +From 94f0cf20c6879fd3c508dee8286f6b3b1e79cac8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 15:36:28 +0100 +Subject: ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates + +From: Luca Ceresoli + +[ Upstream commit 9e2ab4b18ebd46813fc3459207335af4d368e323 ] + +The sample rates set by the rockchip_i2s_tdm driver in master mode are +inaccurate up to 5% in several cases, due to the driver logic to configure +clocks and a nasty interaction with the Common Clock Framework. + +To understand what happens, here is the relevant section of the clock tree +(slightly simplified), along with the names used in the driver: + + vpll0 _OR_ vpll1 "mclk_root" + clk_i2s2_8ch_tx_src "mclk_parent" + clk_i2s2_8ch_tx_mux + clk_i2s2_8ch_tx "mclk" or "mclk_tx" + +This is what happens when playing back e.g. at 192 kHz using +audio-graph-card (when recording the same applies, only s/tx/rx/): + + 0. at probe, rockchip_i2s_tdm_set_sysclk() stores the passed frequency in + i2s_tdm->mclk_tx_freq (*) which is 50176000, and that is never modified + afterwards + + 1. when playback is started, rockchip_i2s_tdm_hw_params() is called and + does the following two calls + + 2. rockchip_i2s_tdm_calibrate_mclk(): + + 2a. selects mclk_root0 (vpll0) as a parent for mclk_parent + (mclk_tx_src), which is OK because the vpll0 rate is a good for + 192000 (and sumbultiple) rates + + 2b. sets the mclk_root frequency based on ppm calibration computations + + 2c. sets mclk_tx_src to 49152000 (= 256 * 192000), which is also OK as + it is a multiple of the required bit clock + + 3. rockchip_i2s_tdm_set_mclk() + + 3a. calls clk_set_rate() to set the rate of mclk_tx (clk_i2s2_8ch_tx) + to the value of i2s_tdm->mclk_tx_freq (*), i.e. 50176000 which is + not a multiple of the sampling frequency -- this is not OK + + 3a1. clk_set_rate() reacts by reparenting clk_i2s2_8ch_tx_src to + vpll1 -- this is not OK because the default vpll1 rate can be + divided to get 44.1 kHz and related rates, not 192 kHz + +The result is that the driver does a lot of ad-hoc decisions about clocks +and ends up in using the wrong parent at an unoptimal rate. + +Step 0 is one part of the problem: unless the card driver calls set_sysclk +at each stream start, whatever rate is set in mclk_tx_freq during boot will +be taken and used until reboot. Moreover the driver does not care if its +value is not a multiple of any audio frequency. + +Another part of the problem is that the whole reparenting and clock rate +setting logic is conflicting with the CCF algorithms to achieve largely the +same goal: selecting the best parent and setting the closest clock +rate. And it turns out that only calling once clk_set_rate() on +clk_i2s2_8ch_tx picks the correct vpll and sets the correct rate. + +The fix is based on removing the custom logic in the driver to select the +parent and set the various clocks, and just let the Clock Framework do it +all. As a side effect, the set_sysclk() op becomes useless because we now +let the CCF compute the appropriate value for the sampling rate. It also +implies that the whole calibration logic is now dead code and so it is +removed along with the "PCM Clock Compensation in PPM" kcontrol, which has +always been broken anyway. The handling of the 4 optional clocks also +becomes dead code and is removed. + +The actual rates have been tested playing 30 seconds of audio at various +sampling rates before and after this change using sox: + + time play -r -n synth 30 sine 950 gain -3 + +The time reported in the table below is the 'real' value reported by the +'time' command in the above command line. + + rate before after + --------- ------ ------ + 8000 Hz 30.60s 30.63s + 11025 Hz 30.45s 30.51s + 16000 Hz 30.47s 30.50s + 22050 Hz 30.78s 30.41s + 32000 Hz 31.02s 30.43s + 44100 Hz 30.78s 30.41s + 48000 Hz 29.81s 30.45s + 88200 Hz 30.78s 30.41s + 96000 Hz 29.79s 30.42s + 176400 Hz 27.40s 30.41s + 192000 Hz 29.79s 30.42s + +While the tests are running the clock tree confirms that: + + * without the patch, vpll1 is always used and clk_i2s2_8ch_tx always + produces 50176000 Hz, which cannot be divided for most audio rates + except the slowest ones, generating inaccurate rates + * with the patch: + - for 192000 Hz vpll0 is used + - for 176400 Hz vpll1 is used + - clk_i2s2_8ch_tx always produces (256 * ) Hz + +Tested on the RK3308 using the internal audio codec. + +Fixes: 081068fd6414 ("ASoC: rockchip: add support for i2s-tdm controller") +Signed-off-by: Luca Ceresoli +Link: https://msgid.link/r/20240305-rk3308-audio-codec-v4-1-312acdbe628f@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/rockchip/rockchip_i2s_tdm.c | 352 +------------------------- + 1 file changed, 6 insertions(+), 346 deletions(-) + +diff --git a/sound/soc/rockchip/rockchip_i2s_tdm.c b/sound/soc/rockchip/rockchip_i2s_tdm.c +index 860e66ec85e8a..9fa020ef7eab9 100644 +--- a/sound/soc/rockchip/rockchip_i2s_tdm.c ++++ b/sound/soc/rockchip/rockchip_i2s_tdm.c +@@ -25,8 +25,6 @@ + #define DEFAULT_MCLK_FS 256 + #define CH_GRP_MAX 4 /* The max channel 8 / 2 */ + #define MULTIPLEX_CH_MAX 10 +-#define CLK_PPM_MIN -1000 +-#define CLK_PPM_MAX 1000 + + #define TRCM_TXRX 0 + #define TRCM_TX 1 +@@ -53,20 +51,6 @@ struct rk_i2s_tdm_dev { + struct clk *hclk; + struct clk *mclk_tx; + struct clk *mclk_rx; +- /* The mclk_tx_src is parent of mclk_tx */ +- struct clk *mclk_tx_src; +- /* The mclk_rx_src is parent of mclk_rx */ +- struct clk *mclk_rx_src; +- /* +- * The mclk_root0 and mclk_root1 are root parent and supplies for +- * the different FS. +- * +- * e.g: +- * mclk_root0 is VPLL0, used for FS=48000Hz +- * mclk_root1 is VPLL1, used for FS=44100Hz +- */ +- struct clk *mclk_root0; +- struct clk *mclk_root1; + struct regmap *regmap; + struct regmap *grf; + struct snd_dmaengine_dai_dma_data capture_dma_data; +@@ -76,19 +60,11 @@ struct rk_i2s_tdm_dev { + const struct rk_i2s_soc_data *soc_data; + bool is_master_mode; + bool io_multiplex; +- bool mclk_calibrate; + bool tdm_mode; +- unsigned int mclk_rx_freq; +- unsigned int mclk_tx_freq; +- unsigned int mclk_root0_freq; +- unsigned int mclk_root1_freq; +- unsigned int mclk_root0_initial_freq; +- unsigned int mclk_root1_initial_freq; + unsigned int frame_width; + unsigned int clk_trcm; + unsigned int i2s_sdis[CH_GRP_MAX]; + unsigned int i2s_sdos[CH_GRP_MAX]; +- int clk_ppm; + int refcount; + spinlock_t lock; /* xfer lock */ + bool has_playback; +@@ -114,12 +90,6 @@ static void i2s_tdm_disable_unprepare_mclk(struct rk_i2s_tdm_dev *i2s_tdm) + { + clk_disable_unprepare(i2s_tdm->mclk_tx); + clk_disable_unprepare(i2s_tdm->mclk_rx); +- if (i2s_tdm->mclk_calibrate) { +- clk_disable_unprepare(i2s_tdm->mclk_tx_src); +- clk_disable_unprepare(i2s_tdm->mclk_rx_src); +- clk_disable_unprepare(i2s_tdm->mclk_root0); +- clk_disable_unprepare(i2s_tdm->mclk_root1); +- } + } + + /** +@@ -142,29 +112,9 @@ static int i2s_tdm_prepare_enable_mclk(struct rk_i2s_tdm_dev *i2s_tdm) + ret = clk_prepare_enable(i2s_tdm->mclk_rx); + if (ret) + goto err_mclk_rx; +- if (i2s_tdm->mclk_calibrate) { +- ret = clk_prepare_enable(i2s_tdm->mclk_tx_src); +- if (ret) +- goto err_mclk_rx; +- ret = clk_prepare_enable(i2s_tdm->mclk_rx_src); +- if (ret) +- goto err_mclk_rx_src; +- ret = clk_prepare_enable(i2s_tdm->mclk_root0); +- if (ret) +- goto err_mclk_root0; +- ret = clk_prepare_enable(i2s_tdm->mclk_root1); +- if (ret) +- goto err_mclk_root1; +- } + + return 0; + +-err_mclk_root1: +- clk_disable_unprepare(i2s_tdm->mclk_root0); +-err_mclk_root0: +- clk_disable_unprepare(i2s_tdm->mclk_rx_src); +-err_mclk_rx_src: +- clk_disable_unprepare(i2s_tdm->mclk_tx_src); + err_mclk_rx: + clk_disable_unprepare(i2s_tdm->mclk_tx); + err_mclk_tx: +@@ -564,159 +514,6 @@ static void rockchip_i2s_tdm_xfer_resume(struct snd_pcm_substream *substream, + I2S_XFER_RXS_START); + } + +-static int rockchip_i2s_tdm_clk_set_rate(struct rk_i2s_tdm_dev *i2s_tdm, +- struct clk *clk, unsigned long rate, +- int ppm) +-{ +- unsigned long rate_target; +- int delta, ret; +- +- if (ppm == i2s_tdm->clk_ppm) +- return 0; +- +- if (ppm < 0) +- delta = -1; +- else +- delta = 1; +- +- delta *= (int)div64_u64((u64)rate * (u64)abs(ppm) + 500000, +- 1000000); +- +- rate_target = rate + delta; +- +- if (!rate_target) +- return -EINVAL; +- +- ret = clk_set_rate(clk, rate_target); +- if (ret) +- return ret; +- +- i2s_tdm->clk_ppm = ppm; +- +- return 0; +-} +- +-static int rockchip_i2s_tdm_calibrate_mclk(struct rk_i2s_tdm_dev *i2s_tdm, +- struct snd_pcm_substream *substream, +- unsigned int lrck_freq) +-{ +- struct clk *mclk_root; +- struct clk *mclk_parent; +- unsigned int mclk_root_freq; +- unsigned int mclk_root_initial_freq; +- unsigned int mclk_parent_freq; +- unsigned int div, delta; +- u64 ppm; +- int ret; +- +- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) +- mclk_parent = i2s_tdm->mclk_tx_src; +- else +- mclk_parent = i2s_tdm->mclk_rx_src; +- +- switch (lrck_freq) { +- case 8000: +- case 16000: +- case 24000: +- case 32000: +- case 48000: +- case 64000: +- case 96000: +- case 192000: +- mclk_root = i2s_tdm->mclk_root0; +- mclk_root_freq = i2s_tdm->mclk_root0_freq; +- mclk_root_initial_freq = i2s_tdm->mclk_root0_initial_freq; +- mclk_parent_freq = DEFAULT_MCLK_FS * 192000; +- break; +- case 11025: +- case 22050: +- case 44100: +- case 88200: +- case 176400: +- mclk_root = i2s_tdm->mclk_root1; +- mclk_root_freq = i2s_tdm->mclk_root1_freq; +- mclk_root_initial_freq = i2s_tdm->mclk_root1_initial_freq; +- mclk_parent_freq = DEFAULT_MCLK_FS * 176400; +- break; +- default: +- dev_err(i2s_tdm->dev, "Invalid LRCK frequency: %u Hz\n", +- lrck_freq); +- return -EINVAL; +- } +- +- ret = clk_set_parent(mclk_parent, mclk_root); +- if (ret) +- return ret; +- +- ret = rockchip_i2s_tdm_clk_set_rate(i2s_tdm, mclk_root, +- mclk_root_freq, 0); +- if (ret) +- return ret; +- +- delta = abs(mclk_root_freq % mclk_parent_freq - mclk_parent_freq); +- ppm = div64_u64((uint64_t)delta * 1000000, (uint64_t)mclk_root_freq); +- +- if (ppm) { +- div = DIV_ROUND_CLOSEST(mclk_root_initial_freq, mclk_parent_freq); +- if (!div) +- return -EINVAL; +- +- mclk_root_freq = mclk_parent_freq * round_up(div, 2); +- +- ret = clk_set_rate(mclk_root, mclk_root_freq); +- if (ret) +- return ret; +- +- i2s_tdm->mclk_root0_freq = clk_get_rate(i2s_tdm->mclk_root0); +- i2s_tdm->mclk_root1_freq = clk_get_rate(i2s_tdm->mclk_root1); +- } +- +- return clk_set_rate(mclk_parent, mclk_parent_freq); +-} +- +-static int rockchip_i2s_tdm_set_mclk(struct rk_i2s_tdm_dev *i2s_tdm, +- struct snd_pcm_substream *substream, +- struct clk **mclk) +-{ +- unsigned int mclk_freq; +- int ret; +- +- if (i2s_tdm->clk_trcm) { +- if (i2s_tdm->mclk_tx_freq != i2s_tdm->mclk_rx_freq) { +- dev_err(i2s_tdm->dev, +- "clk_trcm, tx: %d and rx: %d should be the same\n", +- i2s_tdm->mclk_tx_freq, +- i2s_tdm->mclk_rx_freq); +- return -EINVAL; +- } +- +- ret = clk_set_rate(i2s_tdm->mclk_tx, i2s_tdm->mclk_tx_freq); +- if (ret) +- return ret; +- +- ret = clk_set_rate(i2s_tdm->mclk_rx, i2s_tdm->mclk_rx_freq); +- if (ret) +- return ret; +- +- /* mclk_rx is also ok. */ +- *mclk = i2s_tdm->mclk_tx; +- } else { +- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { +- *mclk = i2s_tdm->mclk_tx; +- mclk_freq = i2s_tdm->mclk_tx_freq; +- } else { +- *mclk = i2s_tdm->mclk_rx; +- mclk_freq = i2s_tdm->mclk_rx_freq; +- } +- +- ret = clk_set_rate(*mclk, mclk_freq); +- if (ret) +- return ret; +- } +- +- return 0; +-} +- + static int rockchip_i2s_ch_to_io(unsigned int ch, bool substream_capture) + { + if (substream_capture) { +@@ -853,19 +650,17 @@ static int rockchip_i2s_tdm_hw_params(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { + struct rk_i2s_tdm_dev *i2s_tdm = to_info(dai); +- struct clk *mclk; +- int ret = 0; + unsigned int val = 0; + unsigned int mclk_rate, bclk_rate, div_bclk = 4, div_lrck = 64; ++ int err; + + if (i2s_tdm->is_master_mode) { +- if (i2s_tdm->mclk_calibrate) +- rockchip_i2s_tdm_calibrate_mclk(i2s_tdm, substream, +- params_rate(params)); ++ struct clk *mclk = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ? ++ i2s_tdm->mclk_tx : i2s_tdm->mclk_rx; + +- ret = rockchip_i2s_tdm_set_mclk(i2s_tdm, substream, &mclk); +- if (ret) +- return ret; ++ err = clk_set_rate(mclk, DEFAULT_MCLK_FS * params_rate(params)); ++ if (err) ++ return err; + + mclk_rate = clk_get_rate(mclk); + bclk_rate = i2s_tdm->frame_width * params_rate(params); +@@ -973,96 +768,6 @@ static int rockchip_i2s_tdm_trigger(struct snd_pcm_substream *substream, + return 0; + } + +-static int rockchip_i2s_tdm_set_sysclk(struct snd_soc_dai *cpu_dai, int stream, +- unsigned int freq, int dir) +-{ +- struct rk_i2s_tdm_dev *i2s_tdm = to_info(cpu_dai); +- +- /* Put set mclk rate into rockchip_i2s_tdm_set_mclk() */ +- if (i2s_tdm->clk_trcm) { +- i2s_tdm->mclk_tx_freq = freq; +- i2s_tdm->mclk_rx_freq = freq; +- } else { +- if (stream == SNDRV_PCM_STREAM_PLAYBACK) +- i2s_tdm->mclk_tx_freq = freq; +- else +- i2s_tdm->mclk_rx_freq = freq; +- } +- +- dev_dbg(i2s_tdm->dev, "The target mclk_%s freq is: %d\n", +- stream ? "rx" : "tx", freq); +- +- return 0; +-} +- +-static int rockchip_i2s_tdm_clk_compensation_info(struct snd_kcontrol *kcontrol, +- struct snd_ctl_elem_info *uinfo) +-{ +- uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; +- uinfo->count = 1; +- uinfo->value.integer.min = CLK_PPM_MIN; +- uinfo->value.integer.max = CLK_PPM_MAX; +- uinfo->value.integer.step = 1; +- +- return 0; +-} +- +-static int rockchip_i2s_tdm_clk_compensation_get(struct snd_kcontrol *kcontrol, +- struct snd_ctl_elem_value *ucontrol) +-{ +- struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol); +- struct rk_i2s_tdm_dev *i2s_tdm = snd_soc_dai_get_drvdata(dai); +- +- ucontrol->value.integer.value[0] = i2s_tdm->clk_ppm; +- +- return 0; +-} +- +-static int rockchip_i2s_tdm_clk_compensation_put(struct snd_kcontrol *kcontrol, +- struct snd_ctl_elem_value *ucontrol) +-{ +- struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol); +- struct rk_i2s_tdm_dev *i2s_tdm = snd_soc_dai_get_drvdata(dai); +- int ret = 0, ppm = 0; +- int changed = 0; +- unsigned long old_rate; +- +- if (ucontrol->value.integer.value[0] < CLK_PPM_MIN || +- ucontrol->value.integer.value[0] > CLK_PPM_MAX) +- return -EINVAL; +- +- ppm = ucontrol->value.integer.value[0]; +- +- old_rate = clk_get_rate(i2s_tdm->mclk_root0); +- ret = rockchip_i2s_tdm_clk_set_rate(i2s_tdm, i2s_tdm->mclk_root0, +- i2s_tdm->mclk_root0_freq, ppm); +- if (ret) +- return ret; +- if (old_rate != clk_get_rate(i2s_tdm->mclk_root0)) +- changed = 1; +- +- if (clk_is_match(i2s_tdm->mclk_root0, i2s_tdm->mclk_root1)) +- return changed; +- +- old_rate = clk_get_rate(i2s_tdm->mclk_root1); +- ret = rockchip_i2s_tdm_clk_set_rate(i2s_tdm, i2s_tdm->mclk_root1, +- i2s_tdm->mclk_root1_freq, ppm); +- if (ret) +- return ret; +- if (old_rate != clk_get_rate(i2s_tdm->mclk_root1)) +- changed = 1; +- +- return changed; +-} +- +-static struct snd_kcontrol_new rockchip_i2s_tdm_compensation_control = { +- .iface = SNDRV_CTL_ELEM_IFACE_PCM, +- .name = "PCM Clock Compensation in PPM", +- .info = rockchip_i2s_tdm_clk_compensation_info, +- .get = rockchip_i2s_tdm_clk_compensation_get, +- .put = rockchip_i2s_tdm_clk_compensation_put, +-}; +- + static int rockchip_i2s_tdm_dai_probe(struct snd_soc_dai *dai) + { + struct rk_i2s_tdm_dev *i2s_tdm = snd_soc_dai_get_drvdata(dai); +@@ -1072,9 +777,6 @@ static int rockchip_i2s_tdm_dai_probe(struct snd_soc_dai *dai) + if (i2s_tdm->has_playback) + snd_soc_dai_dma_data_set_playback(dai, &i2s_tdm->playback_dma_data); + +- if (i2s_tdm->mclk_calibrate) +- snd_soc_add_dai_controls(dai, &rockchip_i2s_tdm_compensation_control, 1); +- + return 0; + } + +@@ -1115,7 +817,6 @@ static const struct snd_soc_dai_ops rockchip_i2s_tdm_dai_ops = { + .probe = rockchip_i2s_tdm_dai_probe, + .hw_params = rockchip_i2s_tdm_hw_params, + .set_bclk_ratio = rockchip_i2s_tdm_set_bclk_ratio, +- .set_sysclk = rockchip_i2s_tdm_set_sysclk, + .set_fmt = rockchip_i2s_tdm_set_fmt, + .set_tdm_slot = rockchip_dai_tdm_slot, + .trigger = rockchip_i2s_tdm_trigger, +@@ -1444,35 +1145,6 @@ static void rockchip_i2s_tdm_path_config(struct rk_i2s_tdm_dev *i2s_tdm, + rockchip_i2s_tdm_tx_path_config(i2s_tdm, num); + } + +-static int rockchip_i2s_tdm_get_calibrate_mclks(struct rk_i2s_tdm_dev *i2s_tdm) +-{ +- int num_mclks = 0; +- +- i2s_tdm->mclk_tx_src = devm_clk_get(i2s_tdm->dev, "mclk_tx_src"); +- if (!IS_ERR(i2s_tdm->mclk_tx_src)) +- num_mclks++; +- +- i2s_tdm->mclk_rx_src = devm_clk_get(i2s_tdm->dev, "mclk_rx_src"); +- if (!IS_ERR(i2s_tdm->mclk_rx_src)) +- num_mclks++; +- +- i2s_tdm->mclk_root0 = devm_clk_get(i2s_tdm->dev, "mclk_root0"); +- if (!IS_ERR(i2s_tdm->mclk_root0)) +- num_mclks++; +- +- i2s_tdm->mclk_root1 = devm_clk_get(i2s_tdm->dev, "mclk_root1"); +- if (!IS_ERR(i2s_tdm->mclk_root1)) +- num_mclks++; +- +- if (num_mclks < 4 && num_mclks != 0) +- return -ENOENT; +- +- if (num_mclks == 4) +- i2s_tdm->mclk_calibrate = 1; +- +- return 0; +-} +- + static int rockchip_i2s_tdm_path_prepare(struct rk_i2s_tdm_dev *i2s_tdm, + struct device_node *np, + bool is_rx_path) +@@ -1610,11 +1282,6 @@ static int rockchip_i2s_tdm_probe(struct platform_device *pdev) + i2s_tdm->io_multiplex = + of_property_read_bool(node, "rockchip,io-multiplex"); + +- ret = rockchip_i2s_tdm_get_calibrate_mclks(i2s_tdm); +- if (ret) +- return dev_err_probe(i2s_tdm->dev, ret, +- "mclk-calibrate clocks missing"); +- + regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res); + if (IS_ERR(regs)) { + return dev_err_probe(i2s_tdm->dev, PTR_ERR(regs), +@@ -1667,13 +1334,6 @@ static int rockchip_i2s_tdm_probe(struct platform_device *pdev) + goto err_disable_hclk; + } + +- if (i2s_tdm->mclk_calibrate) { +- i2s_tdm->mclk_root0_initial_freq = clk_get_rate(i2s_tdm->mclk_root0); +- i2s_tdm->mclk_root1_initial_freq = clk_get_rate(i2s_tdm->mclk_root1); +- i2s_tdm->mclk_root0_freq = i2s_tdm->mclk_root0_initial_freq; +- i2s_tdm->mclk_root1_freq = i2s_tdm->mclk_root1_initial_freq; +- } +- + pm_runtime_enable(&pdev->dev); + + regmap_update_bits(i2s_tdm->regmap, I2S_DMACR, I2S_DMACR_TDL_MASK, +-- +2.43.0 + diff --git a/queue-6.7/asoc-tlv320adc3xxx-don-t-strip-remove-function-when-.patch b/queue-6.7/asoc-tlv320adc3xxx-don-t-strip-remove-function-when-.patch new file mode 100644 index 00000000000..28f380c377e --- /dev/null +++ b/queue-6.7/asoc-tlv320adc3xxx-don-t-strip-remove-function-when-.patch @@ -0,0 +1,60 @@ +From f36515118e0603ce0e8a86f14358f56e6f7444b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Mar 2024 15:38:51 +0100 +Subject: ASoC: tlv320adc3xxx: Don't strip remove function when driver is + builtin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit f31e0d0c2cad23e0cc48731634f85bb2d8707790 ] + +Using __exit for the remove function results in the remove callback +being discarded with SND_SOC_TLV320ADC3XXX=y. When such a device gets +unbound (e.g. using sysfs or hotplug), the driver is just removed +without the cleanup being performed. This results in resource leaks. Fix +it by compiling in the remove callback unconditionally. + +This also fixes a W=1 modpost warning: + + WARNING: modpost: sound/soc/codecs/snd-soc-tlv320adc3xxx: section mismatch in reference: adc3xxx_i2c_driver+0x10 (section: .data) -> adc3xxx_i2c_remove (section: .exit.text) + +(which only happens with SND_SOC_TLV320ADC3XXX=m). + +Fixes: e9a3b57efd28 ("ASoC: codec: tlv320adc3xxx: New codec driver") +Signed-off-by: Uwe Kleine-König +Reviewed-by: Geert Uytterhoeven +Link: https://msgid.link/r/20240310143852.397212-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320adc3xxx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tlv320adc3xxx.c b/sound/soc/codecs/tlv320adc3xxx.c +index 420bbf588efea..e100cc9f5c192 100644 +--- a/sound/soc/codecs/tlv320adc3xxx.c ++++ b/sound/soc/codecs/tlv320adc3xxx.c +@@ -1429,7 +1429,7 @@ static int adc3xxx_i2c_probe(struct i2c_client *i2c) + return ret; + } + +-static void __exit adc3xxx_i2c_remove(struct i2c_client *client) ++static void adc3xxx_i2c_remove(struct i2c_client *client) + { + struct adc3xxx *adc3xxx = i2c_get_clientdata(client); + +@@ -1452,7 +1452,7 @@ static struct i2c_driver adc3xxx_i2c_driver = { + .of_match_table = tlv320adc3xxx_of_match, + }, + .probe = adc3xxx_i2c_probe, +- .remove = __exit_p(adc3xxx_i2c_remove), ++ .remove = adc3xxx_i2c_remove, + .id_table = adc3xxx_i2c_id, + }; + +-- +2.43.0 + diff --git a/queue-6.7/bpf-report-rcu-qs-in-cpumap-kthread.patch b/queue-6.7/bpf-report-rcu-qs-in-cpumap-kthread.patch new file mode 100644 index 00000000000..f53dfc0a757 --- /dev/null +++ b/queue-6.7/bpf-report-rcu-qs-in-cpumap-kthread.patch @@ -0,0 +1,55 @@ +From 5674ef862e974cc67733a35f1c3bcdd99f251b66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 13:44:40 -0700 +Subject: bpf: report RCU QS in cpumap kthread + +From: Yan Zhai + +[ Upstream commit 00bf63122459e87193ee7f1bc6161c83a525569f ] + +When there are heavy load, cpumap kernel threads can be busy polling +packets from redirect queues and block out RCU tasks from reaching +quiescent states. It is insufficient to just call cond_resched() in such +context. Periodically raise a consolidated RCU QS before cond_resched +fixes the problem. + +Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP") +Reviewed-by: Jesper Dangaard Brouer +Signed-off-by: Yan Zhai +Acked-by: Paul E. McKenney +Acked-by: Jesper Dangaard Brouer +Link: https://lore.kernel.org/r/c17b9f1517e19d813da3ede5ed33ee18496bb5d8.1710877680.git.yan@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + kernel/bpf/cpumap.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c +index ef82ffc90cbe9..8f1d390bcbdeb 100644 +--- a/kernel/bpf/cpumap.c ++++ b/kernel/bpf/cpumap.c +@@ -262,6 +262,7 @@ static int cpu_map_bpf_prog_run(struct bpf_cpu_map_entry *rcpu, void **frames, + static int cpu_map_kthread_run(void *data) + { + struct bpf_cpu_map_entry *rcpu = data; ++ unsigned long last_qs = jiffies; + + complete(&rcpu->kthread_running); + set_current_state(TASK_INTERRUPTIBLE); +@@ -287,10 +288,12 @@ static int cpu_map_kthread_run(void *data) + if (__ptr_ring_empty(rcpu->queue)) { + schedule(); + sched = 1; ++ last_qs = jiffies; + } else { + __set_current_state(TASK_RUNNING); + } + } else { ++ rcu_softirq_qs_periodic(last_qs); + sched = cond_resched(); + } + +-- +2.43.0 + diff --git a/queue-6.7/bus-mhi-ep-check-the-correct-variable-in-mhi_ep_regi.patch b/queue-6.7/bus-mhi-ep-check-the-correct-variable-in-mhi_ep_regi.patch new file mode 100644 index 00000000000..dcaf99c39fc --- /dev/null +++ b/queue-6.7/bus-mhi-ep-check-the-correct-variable-in-mhi_ep_regi.patch @@ -0,0 +1,39 @@ +From e5681b7f8828030c840c073c563d502515e861da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 09:20:19 +0300 +Subject: bus: mhi: ep: check the correct variable in + mhi_ep_register_controller() + +From: Dan Carpenter + +[ Upstream commit 27711860c54ccb5e80719df684f49f0bf3f8fb51 ] + +There is a copy and paste bug here so it checks "ev_ring_el_cache" instead +of "ring_item_cache". + +Fixes: 62210a26cd4f ("bus: mhi: ep: Use slab allocator where applicable") +Signed-off-by: Dan Carpenter +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/bebcd822-d465-45da-adae-5435ec93e6d4@moroto.mountain +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/bus/mhi/ep/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c +index 582d5c166a75e..934cdbca08e44 100644 +--- a/drivers/bus/mhi/ep/main.c ++++ b/drivers/bus/mhi/ep/main.c +@@ -1427,7 +1427,7 @@ int mhi_ep_register_controller(struct mhi_ep_cntrl *mhi_cntrl, + mhi_cntrl->ring_item_cache = kmem_cache_create("mhi_ep_ring_item", + sizeof(struct mhi_ep_ring_item), 0, + 0, NULL); +- if (!mhi_cntrl->ev_ring_el_cache) { ++ if (!mhi_cntrl->ring_item_cache) { + ret = -ENOMEM; + goto err_destroy_tre_buf_cache; + } +-- +2.43.0 + diff --git a/queue-6.7/ceph-stop-copying-to-iter-at-eof-on-sync-reads.patch b/queue-6.7/ceph-stop-copying-to-iter-at-eof-on-sync-reads.patch new file mode 100644 index 00000000000..62591a2e3f2 --- /dev/null +++ b/queue-6.7/ceph-stop-copying-to-iter-at-eof-on-sync-reads.patch @@ -0,0 +1,73 @@ +From cefad518b3b2ca99d291019af2dfc3e17a349549 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 09:16:12 +0800 +Subject: ceph: stop copying to iter at EOF on sync reads + +From: Xiubo Li + +[ Upstream commit 1065da21e5df9d843d2c5165d5d576be000142a6 ] + +If EOF is encountered, ceph_sync_read() return value is adjusted down +according to i_size, but the "to" iter is advanced by the actual number +of bytes read. Then, when retrying, the remainder of the range may be +skipped incorrectly. + +Ensure that the "to" iter is advanced only until EOF. + +[ idryomov: changelog ] + +Fixes: c3d8e0b5de48 ("ceph: return the real size read when it hits EOF") +Reported-by: Frank Hsiao +Signed-off-by: Xiubo Li +Reviewed-by: Ilya Dryomov +Tested-by: Frank Hsiao +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/file.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 3b5aae29e9447..523debc6f23e0 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -1135,7 +1135,12 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos, + } + + idx = 0; +- left = ret > 0 ? ret : 0; ++ if (ret <= 0) ++ left = 0; ++ else if (off + ret > i_size) ++ left = i_size - off; ++ else ++ left = ret; + while (left > 0) { + size_t plen, copied; + +@@ -1164,15 +1169,13 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos, + } + + if (ret > 0) { +- if (off > *ki_pos) { +- if (off >= i_size) { +- *retry_op = CHECK_EOF; +- ret = i_size - *ki_pos; +- *ki_pos = i_size; +- } else { +- ret = off - *ki_pos; +- *ki_pos = off; +- } ++ if (off >= i_size) { ++ *retry_op = CHECK_EOF; ++ ret = i_size - *ki_pos; ++ *ki_pos = i_size; ++ } else { ++ ret = off - *ki_pos; ++ *ki_pos = off; + } + + if (last_objver) +-- +2.43.0 + diff --git a/queue-6.7/char-xilinx_hwicap-fix-null-vs-is_err-bug.patch b/queue-6.7/char-xilinx_hwicap-fix-null-vs-is_err-bug.patch new file mode 100644 index 00000000000..2799c65b963 --- /dev/null +++ b/queue-6.7/char-xilinx_hwicap-fix-null-vs-is_err-bug.patch @@ -0,0 +1,40 @@ +From 50dc6d016e1c287317e4f95a31e8c593ff79e2a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 12:02:31 +0300 +Subject: char: xilinx_hwicap: Fix NULL vs IS_ERR() bug + +From: Dan Carpenter + +[ Upstream commit 316459ba4051fd91237171fdca88920128a646f1 ] + +The devm_platform_ioremap_resource() function returns error pointers. +It never returns NULL. Update the check accordingly. + +Fixes: 672371832193 ("char: xilinx_hwicap: Modernize driver probe") +Signed-off-by: Dan Carpenter +Acked-by: Michal Simek +Link: https://lore.kernel.org/r/ef647a9c-b1b7-4338-9bc0-28165ec2a367@moroto.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/xilinx_hwicap/xilinx_hwicap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.c b/drivers/char/xilinx_hwicap/xilinx_hwicap.c +index 019cf6079cecd..6d2eadefd9dc9 100644 +--- a/drivers/char/xilinx_hwicap/xilinx_hwicap.c ++++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.c +@@ -639,8 +639,8 @@ static int hwicap_setup(struct platform_device *pdev, int id, + dev_set_drvdata(dev, (void *)drvdata); + + drvdata->base_address = devm_platform_ioremap_resource(pdev, 0); +- if (!drvdata->base_address) { +- retval = -ENODEV; ++ if (IS_ERR(drvdata->base_address)) { ++ retval = PTR_ERR(drvdata->base_address); + goto failed; + } + +-- +2.43.0 + diff --git a/queue-6.7/coresight-etm4x-set-skip_power_up-in-etm4_init_arch_.patch b/queue-6.7/coresight-etm4x-set-skip_power_up-in-etm4_init_arch_.patch new file mode 100644 index 00000000000..e0f81a63bd4 --- /dev/null +++ b/queue-6.7/coresight-etm4x-set-skip_power_up-in-etm4_init_arch_.patch @@ -0,0 +1,59 @@ +From 3d6280ae10ec7a0b5a8a7e41d22eb87d656ce418 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 02:54:19 -0800 +Subject: coresight: etm4x: Set skip_power_up in etm4_init_arch_data function + +From: Mao Jinlong + +[ Upstream commit 1bbe0a247e5d72f723daeecf41596bfa99e199f1 ] + +skip_power_up is used in etm4_init_arch_data when set lpoverride. So +need to set the value of it before calling using it. + +Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") +Signed-off-by: Mao Jinlong +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20240131105423.9519-1-quic_jinlmao@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 34aee59dd1473..18c4544f60454 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -1160,6 +1160,7 @@ static void etm4_init_arch_data(void *info) + struct etm4_init_arg *init_arg = info; + struct etmv4_drvdata *drvdata; + struct csdev_access *csa; ++ struct device *dev = init_arg->dev; + int i; + + drvdata = dev_get_drvdata(init_arg->dev); +@@ -1173,6 +1174,10 @@ static void etm4_init_arch_data(void *info) + if (!etm4_init_csdev_access(drvdata, csa)) + return; + ++ if (!csa->io_mem || ++ fwnode_property_present(dev_fwnode(dev), "qcom,skip-power-up")) ++ drvdata->skip_power_up = true; ++ + /* Detect the support for OS Lock before we actually use it */ + etm_detect_os_lock(drvdata, csa); + +@@ -1998,11 +2003,6 @@ static int etm4_add_coresight_dev(struct etm4_init_arg *init_arg) + if (!drvdata->arch) + return -EINVAL; + +- /* TRCPDCR is not accessible with system instructions. */ +- if (!desc.access.io_mem || +- fwnode_property_present(dev_fwnode(dev), "qcom,skip-power-up")) +- drvdata->skip_power_up = true; +- + major = ETM_ARCH_MAJOR_VERSION(drvdata->arch); + minor = ETM_ARCH_MINOR_VERSION(drvdata->arch); + +-- +2.43.0 + diff --git a/queue-6.7/coresight-fix-issue-where-a-source-device-s-helpers-.patch b/queue-6.7/coresight-fix-issue-where-a-source-device-s-helpers-.patch new file mode 100644 index 00000000000..a4ed6377cbe --- /dev/null +++ b/queue-6.7/coresight-fix-issue-where-a-source-device-s-helpers-.patch @@ -0,0 +1,120 @@ +From 14c3d6b0430825e702378003271c0a4814cddb11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 15:40:32 +0000 +Subject: coresight: Fix issue where a source device's helpers aren't disabled + +From: James Clark + +[ Upstream commit f68bbe4dcfa303164922bc331d2e8d38ed2d4f23 ] + +The linked commit reverts the change that accidentally used some sysfs +enable/disable functions from Perf which broke the refcounting, but it +also removes the fact that the sysfs disable function disabled the +helpers. + +Add a new wrapper function that does both which is used by both Perf and +sysfs, and label the sysfs disable function appropriately. The naming of +all of the functions will be tidied up later to avoid this happening +again. + +Fixes: 287e82cf69aa ("coresight: Fix crash when Perf and sysfs modes are used concurrently") +Signed-off-by: James Clark +Link: https://lore.kernel.org/r/20240129154050.569566-2-james.clark@arm.com +Signed-off-by: Suzuki K Poulose +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 30 ++++++++++++++----- + .../hwtracing/coresight/coresight-etm-perf.c | 2 +- + drivers/hwtracing/coresight/coresight-priv.h | 2 +- + 3 files changed, 25 insertions(+), 9 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index 9fabe00a40d6a..4b80026db1ab6 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -441,8 +441,26 @@ static void coresight_disable_helpers(struct coresight_device *csdev) + } + } + ++/* ++ * Helper function to call source_ops(csdev)->disable and also disable the ++ * helpers. ++ * ++ * There is an imbalance between coresight_enable_path() and ++ * coresight_disable_path(). Enabling also enables the source's helpers as part ++ * of the path, but disabling always skips the first item in the path (which is ++ * the source), so sources and their helpers don't get disabled as part of that ++ * function and we need the extra step here. ++ */ ++void coresight_disable_source(struct coresight_device *csdev, void *data) ++{ ++ if (source_ops(csdev)->disable) ++ source_ops(csdev)->disable(csdev, data); ++ coresight_disable_helpers(csdev); ++} ++EXPORT_SYMBOL_GPL(coresight_disable_source); ++ + /** +- * coresight_disable_source - Drop the reference count by 1 and disable ++ * coresight_disable_source_sysfs - Drop the reference count by 1 and disable + * the device if there are no users left. + * + * @csdev: The coresight device to disable +@@ -451,17 +469,15 @@ static void coresight_disable_helpers(struct coresight_device *csdev) + * + * Returns true if the device has been disabled. + */ +-bool coresight_disable_source(struct coresight_device *csdev, void *data) ++static bool coresight_disable_source_sysfs(struct coresight_device *csdev, ++ void *data) + { + if (atomic_dec_return(&csdev->refcnt) == 0) { +- if (source_ops(csdev)->disable) +- source_ops(csdev)->disable(csdev, data); +- coresight_disable_helpers(csdev); ++ coresight_disable_source(csdev, data); + csdev->enable = false; + } + return !csdev->enable; + } +-EXPORT_SYMBOL_GPL(coresight_disable_source); + + /* + * coresight_disable_path_from : Disable components in the given path beyond +@@ -1202,7 +1218,7 @@ void coresight_disable(struct coresight_device *csdev) + if (ret) + goto out; + +- if (!csdev->enable || !coresight_disable_source(csdev, NULL)) ++ if (!csdev->enable || !coresight_disable_source_sysfs(csdev, NULL)) + goto out; + + switch (csdev->subtype.source_subtype) { +diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c +index 89e8ed214ea49..58b32b399fac2 100644 +--- a/drivers/hwtracing/coresight/coresight-etm-perf.c ++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c +@@ -587,7 +587,7 @@ static void etm_event_stop(struct perf_event *event, int mode) + return; + + /* stop tracer */ +- source_ops(csdev)->disable(csdev, event); ++ coresight_disable_source(csdev, event); + + /* tell the core */ + event->hw.state = PERF_HES_STOPPED; +diff --git a/drivers/hwtracing/coresight/coresight-priv.h b/drivers/hwtracing/coresight/coresight-priv.h +index 767076e079701..30c051055e54b 100644 +--- a/drivers/hwtracing/coresight/coresight-priv.h ++++ b/drivers/hwtracing/coresight/coresight-priv.h +@@ -233,6 +233,6 @@ void coresight_set_percpu_sink(int cpu, struct coresight_device *csdev); + struct coresight_device *coresight_get_percpu_sink(int cpu); + int coresight_enable_source(struct coresight_device *csdev, enum cs_mode mode, + void *data); +-bool coresight_disable_source(struct coresight_device *csdev, void *data); ++void coresight_disable_source(struct coresight_device *csdev, void *data); + + #endif +-- +2.43.0 + diff --git a/queue-6.7/cpufreq-fix-per-policy-boost-behavior-on-socs-using-.patch b/queue-6.7/cpufreq-fix-per-policy-boost-behavior-on-socs-using-.patch new file mode 100644 index 00000000000..95404599381 --- /dev/null +++ b/queue-6.7/cpufreq-fix-per-policy-boost-behavior-on-socs-using-.patch @@ -0,0 +1,99 @@ +From fcc2cfeb1a17e80e301edf27a2e01a7763f9f31d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 16:07:23 +0530 +Subject: cpufreq: Fix per-policy boost behavior on SoCs using + cpufreq_boost_set_sw() + +From: Sibi Sankar + +[ Upstream commit f37a4d6b4a2c77414e8b9d25dd5ee31537ce9b00 ] + +In the existing code, per-policy flags don't have any impact i.e. +if cpufreq_driver boost is enabled and boost is disabled for one or +more of the policies, the cpufreq driver will behave as if boost is +enabled. + +Fix this by incorporating per-policy boost flag in the policy->max +computation used in cpufreq_frequency_table_cpuinfo and setting the +default per-policy boost to mirror the cpufreq_driver boost flag. + +Fixes: 218a06a79d9a ("cpufreq: Support per-policy performance boost") +Reported-by: Dietmar Eggemann +Reviewed-by: Viresh Kumar +Reviewed-by: Dhruva Gole +Signed-off-by: Sibi Sankar +Tested-by:Yipeng Zou +Reviewed-by: Yipeng Zou +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 18 ++++++++++++------ + drivers/cpufreq/freq_table.c | 2 +- + 2 files changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 934d35f570b7a..5104f853a923e 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -644,14 +644,16 @@ static ssize_t store_local_boost(struct cpufreq_policy *policy, + if (policy->boost_enabled == enable) + return count; + ++ policy->boost_enabled = enable; ++ + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + +- if (ret) ++ if (ret) { ++ policy->boost_enabled = !policy->boost_enabled; + return ret; +- +- policy->boost_enabled = enable; ++ } + + return count; + } +@@ -1419,6 +1421,9 @@ static int cpufreq_online(unsigned int cpu) + goto out_free_policy; + } + ++ /* Let the per-policy boost flag mirror the cpufreq_driver boost during init */ ++ policy->boost_enabled = cpufreq_boost_enabled() && policy_has_boost_freq(policy); ++ + /* + * The initialization has succeeded and the policy is online. + * If there is a problem with its frequency table, take it +@@ -2755,11 +2760,12 @@ int cpufreq_boost_trigger_state(int state) + + cpus_read_lock(); + for_each_active_policy(policy) { ++ policy->boost_enabled = state; + ret = cpufreq_driver->set_boost(policy, state); +- if (ret) ++ if (ret) { ++ policy->boost_enabled = !policy->boost_enabled; + goto err_reset_state; +- +- policy->boost_enabled = state; ++ } + } + cpus_read_unlock(); + +diff --git a/drivers/cpufreq/freq_table.c b/drivers/cpufreq/freq_table.c +index c4d4643b6ca65..c17dc51a5a022 100644 +--- a/drivers/cpufreq/freq_table.c ++++ b/drivers/cpufreq/freq_table.c +@@ -40,7 +40,7 @@ int cpufreq_frequency_table_cpuinfo(struct cpufreq_policy *policy, + cpufreq_for_each_valid_entry(pos, table) { + freq = pos->frequency; + +- if (!cpufreq_boost_enabled() ++ if ((!cpufreq_boost_enabled() || !policy->boost_enabled) + && (pos->flags & CPUFREQ_BOOST_FREQ)) + continue; + +-- +2.43.0 + diff --git a/queue-6.7/devlink-acquire-device-lock-during-netns-dismantle.patch b/queue-6.7/devlink-acquire-device-lock-during-netns-dismantle.patch new file mode 100644 index 00000000000..281213601d1 --- /dev/null +++ b/queue-6.7/devlink-acquire-device-lock-during-netns-dismantle.patch @@ -0,0 +1,105 @@ +From 42977d0045f912ee36c861c7e36539626871356e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 13:17:11 +0100 +Subject: devlink: Acquire device lock during netns dismantle + +From: Ido Schimmel + +[ Upstream commit e21c52d7814f5768f05224e773644629fe124af2 ] + +Device drivers register with devlink from their probe routines (under +the device lock) by acquiring the devlink instance lock and calling +devl_register(). + +Drivers that support a devlink reload usually implement the +reload_{down, up}() operations in a similar fashion to their remove and +probe routines, respectively. + +However, while the remove and probe routines are invoked with the device +lock held, the reload operations are only invoked with the devlink +instance lock held. It is therefore impossible for drivers to acquire +the device lock from their reload operations, as this would result in +lock inversion. + +The motivating use case for invoking the reload operations with the +device lock held is in mlxsw which needs to trigger a PCI reset as part +of the reload. The driver cannot call pci_reset_function() as this +function acquires the device lock. Instead, it needs to call +__pci_reset_function_locked which expects the device lock to be held. + +To that end, adjust devlink to always acquire the device lock before the +devlink instance lock when performing a reload. + +For now, only do that when reload is triggered as part of netns +dismantle. Subsequent patches will handle the case where reload is +explicitly triggered by user space. + +Signed-off-by: Ido Schimmel +Reviewed-by: Jiri Pirko +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Stable-dep-of: d7d75124965a ("devlink: Fix devlink parallel commands processing") +Signed-off-by: Sasha Levin +--- + net/devlink/core.c | 4 ++-- + net/devlink/devl_internal.h | 15 +++++++++++++++ + 2 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/net/devlink/core.c b/net/devlink/core.c +index bc3d265fe2d6e..7f0b093208d75 100644 +--- a/net/devlink/core.c ++++ b/net/devlink/core.c +@@ -503,14 +503,14 @@ static void __net_exit devlink_pernet_pre_exit(struct net *net) + * all devlink instances from this namespace into init_net. + */ + devlinks_xa_for_each_registered_get(net, index, devlink) { +- devl_lock(devlink); ++ devl_dev_lock(devlink, true); + err = 0; + if (devl_is_registered(devlink)) + err = devlink_reload(devlink, &init_net, + DEVLINK_RELOAD_ACTION_DRIVER_REINIT, + DEVLINK_RELOAD_LIMIT_UNSPEC, + &actions_performed, NULL); +- devl_unlock(devlink); ++ devl_dev_unlock(devlink, true); + devlink_put(devlink); + if (err && err != -EOPNOTSUPP) + pr_warn("Failed to reload devlink instance into init_net\n"); +diff --git a/net/devlink/devl_internal.h b/net/devlink/devl_internal.h +index 2a9b263300a4b..178abaf74a107 100644 +--- a/net/devlink/devl_internal.h ++++ b/net/devlink/devl_internal.h +@@ -3,6 +3,7 @@ + * Copyright (c) 2016 Jiri Pirko + */ + ++#include + #include + #include + #include +@@ -96,6 +97,20 @@ static inline bool devl_is_registered(struct devlink *devlink) + return xa_get_mark(&devlinks, devlink->index, DEVLINK_REGISTERED); + } + ++static inline void devl_dev_lock(struct devlink *devlink, bool dev_lock) ++{ ++ if (dev_lock) ++ device_lock(devlink->dev); ++ devl_lock(devlink); ++} ++ ++static inline void devl_dev_unlock(struct devlink *devlink, bool dev_lock) ++{ ++ devl_unlock(devlink); ++ if (dev_lock) ++ device_unlock(devlink->dev); ++} ++ + typedef void devlink_rel_notify_cb_t(struct devlink *devlink, u32 obj_index); + typedef void devlink_rel_cleanup_cb_t(struct devlink *devlink, u32 obj_index, + u32 rel_index); +-- +2.43.0 + diff --git a/queue-6.7/devlink-allow-taking-device-lock-in-pre_doit-operati.patch b/queue-6.7/devlink-allow-taking-device-lock-in-pre_doit-operati.patch new file mode 100644 index 00000000000..00df69100da --- /dev/null +++ b/queue-6.7/devlink-allow-taking-device-lock-in-pre_doit-operati.patch @@ -0,0 +1,159 @@ +From 81d50fe88182faf05f761dd0d628423b6ae1b89d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 13:17:13 +0100 +Subject: devlink: Allow taking device lock in pre_doit operations + +From: Ido Schimmel + +[ Upstream commit d32c38256db30a2d55b849e2c77342bc70d58c6e ] + +Introduce a new private flag ('DEVLINK_NL_FLAG_NEED_DEV_LOCK') to allow +netlink commands to specify that they need to acquire the device lock in +their pre_doit operation and release it in their post_doit operation. + +The reload command will use this flag in the subsequent patch. + +No functional changes intended. + +Signed-off-by: Ido Schimmel +Reviewed-by: Jiri Pirko +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Stable-dep-of: d7d75124965a ("devlink: Fix devlink parallel commands processing") +Signed-off-by: Sasha Levin +--- + net/devlink/devl_internal.h | 3 ++- + net/devlink/health.c | 3 ++- + net/devlink/netlink.c | 19 ++++++++++++------- + net/devlink/region.c | 3 ++- + 4 files changed, 18 insertions(+), 10 deletions(-) + +diff --git a/net/devlink/devl_internal.h b/net/devlink/devl_internal.h +index 178abaf74a107..5ea2e2012e930 100644 +--- a/net/devlink/devl_internal.h ++++ b/net/devlink/devl_internal.h +@@ -152,7 +152,8 @@ typedef int devlink_nl_dump_one_func_t(struct sk_buff *msg, + int flags); + + struct devlink * +-devlink_get_from_attrs_lock(struct net *net, struct nlattr **attrs); ++devlink_get_from_attrs_lock(struct net *net, struct nlattr **attrs, ++ bool dev_lock); + + int devlink_nl_dumpit(struct sk_buff *msg, struct netlink_callback *cb, + devlink_nl_dump_one_func_t *dump_one); +diff --git a/net/devlink/health.c b/net/devlink/health.c +index 695df61f8ac2a..71ae121dc739d 100644 +--- a/net/devlink/health.c ++++ b/net/devlink/health.c +@@ -1151,7 +1151,8 @@ devlink_health_reporter_get_from_cb_lock(struct netlink_callback *cb) + struct nlattr **attrs = info->attrs; + struct devlink *devlink; + +- devlink = devlink_get_from_attrs_lock(sock_net(cb->skb->sk), attrs); ++ devlink = devlink_get_from_attrs_lock(sock_net(cb->skb->sk), attrs, ++ false); + if (IS_ERR(devlink)) + return NULL; + +diff --git a/net/devlink/netlink.c b/net/devlink/netlink.c +index 5bb6624f3288e..86f12531bf998 100644 +--- a/net/devlink/netlink.c ++++ b/net/devlink/netlink.c +@@ -11,6 +11,7 @@ + + #define DEVLINK_NL_FLAG_NEED_PORT BIT(0) + #define DEVLINK_NL_FLAG_NEED_DEVLINK_OR_PORT BIT(1) ++#define DEVLINK_NL_FLAG_NEED_DEV_LOCK BIT(2) + + static const struct genl_multicast_group devlink_nl_mcgrps[] = { + [DEVLINK_MCGRP_CONFIG] = { .name = DEVLINK_GENL_MCGRP_CONFIG_NAME }, +@@ -64,7 +65,8 @@ int devlink_nl_msg_reply_and_new(struct sk_buff **msg, struct genl_info *info) + } + + struct devlink * +-devlink_get_from_attrs_lock(struct net *net, struct nlattr **attrs) ++devlink_get_from_attrs_lock(struct net *net, struct nlattr **attrs, ++ bool dev_lock) + { + struct devlink *devlink; + unsigned long index; +@@ -78,12 +80,12 @@ devlink_get_from_attrs_lock(struct net *net, struct nlattr **attrs) + devname = nla_data(attrs[DEVLINK_ATTR_DEV_NAME]); + + devlinks_xa_for_each_registered_get(net, index, devlink) { +- devl_lock(devlink); ++ devl_dev_lock(devlink, dev_lock); + if (devl_is_registered(devlink) && + strcmp(devlink->dev->bus->name, busname) == 0 && + strcmp(dev_name(devlink->dev), devname) == 0) + return devlink; +- devl_unlock(devlink); ++ devl_dev_unlock(devlink, dev_lock); + devlink_put(devlink); + } + +@@ -93,11 +95,13 @@ devlink_get_from_attrs_lock(struct net *net, struct nlattr **attrs) + static int __devlink_nl_pre_doit(struct sk_buff *skb, struct genl_info *info, + u8 flags) + { ++ bool dev_lock = flags & DEVLINK_NL_FLAG_NEED_DEV_LOCK; + struct devlink_port *devlink_port; + struct devlink *devlink; + int err; + +- devlink = devlink_get_from_attrs_lock(genl_info_net(info), info->attrs); ++ devlink = devlink_get_from_attrs_lock(genl_info_net(info), info->attrs, ++ dev_lock); + if (IS_ERR(devlink)) + return PTR_ERR(devlink); + +@@ -117,7 +121,7 @@ static int __devlink_nl_pre_doit(struct sk_buff *skb, struct genl_info *info, + return 0; + + unlock: +- devl_unlock(devlink); ++ devl_dev_unlock(devlink, dev_lock); + devlink_put(devlink); + return err; + } +@@ -144,10 +148,11 @@ int devlink_nl_pre_doit_port_optional(const struct genl_split_ops *ops, + static void __devlink_nl_post_doit(struct sk_buff *skb, struct genl_info *info, + u8 flags) + { ++ bool dev_lock = flags & DEVLINK_NL_FLAG_NEED_DEV_LOCK; + struct devlink *devlink; + + devlink = info->user_ptr[0]; +- devl_unlock(devlink); ++ devl_dev_unlock(devlink, dev_lock); + devlink_put(devlink); + } + +@@ -165,7 +170,7 @@ static int devlink_nl_inst_single_dumpit(struct sk_buff *msg, + struct devlink *devlink; + int err; + +- devlink = devlink_get_from_attrs_lock(sock_net(msg->sk), attrs); ++ devlink = devlink_get_from_attrs_lock(sock_net(msg->sk), attrs, false); + if (IS_ERR(devlink)) + return PTR_ERR(devlink); + err = dump_one(msg, devlink, cb, flags | NLM_F_DUMP_FILTERED); +diff --git a/net/devlink/region.c b/net/devlink/region.c +index 0aab7b82d6780..e3bab458db940 100644 +--- a/net/devlink/region.c ++++ b/net/devlink/region.c +@@ -883,7 +883,8 @@ int devlink_nl_region_read_dumpit(struct sk_buff *skb, + + start_offset = state->start_offset; + +- devlink = devlink_get_from_attrs_lock(sock_net(cb->skb->sk), attrs); ++ devlink = devlink_get_from_attrs_lock(sock_net(cb->skb->sk), attrs, ++ false); + if (IS_ERR(devlink)) + return PTR_ERR(devlink); + +-- +2.43.0 + diff --git a/queue-6.7/devlink-enable-the-use-of-private-flags-in-post_doit.patch b/queue-6.7/devlink-enable-the-use-of-private-flags-in-post_doit.patch new file mode 100644 index 00000000000..5e842d83bb9 --- /dev/null +++ b/queue-6.7/devlink-enable-the-use-of-private-flags-in-post_doit.patch @@ -0,0 +1,62 @@ +From 2180c86ff74821b6c9ab155cd77de108e4eec8f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 13:17:12 +0100 +Subject: devlink: Enable the use of private flags in post_doit operations + +From: Ido Schimmel + +[ Upstream commit c8d0a7d6152bec970552786b77626f4b4c562f4d ] + +Currently, private flags (e.g., 'DEVLINK_NL_FLAG_NEED_PORT') are only +used in pre_doit operations, but a subsequent patch will need to +conditionally lock and unlock the device lock in pre and post doit +operations, respectively. + +As a preparation, enable the use of private flags in post_doit +operations in a similar fashion to how it is done for pre_doit +operations. + +No functional changes intended. + +Signed-off-by: Ido Schimmel +Reviewed-by: Jiri Pirko +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Stable-dep-of: d7d75124965a ("devlink: Fix devlink parallel commands processing") +Signed-off-by: Sasha Levin +--- + net/devlink/netlink.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/net/devlink/netlink.c b/net/devlink/netlink.c +index 7350138c8bb44..5bb6624f3288e 100644 +--- a/net/devlink/netlink.c ++++ b/net/devlink/netlink.c +@@ -141,8 +141,8 @@ int devlink_nl_pre_doit_port_optional(const struct genl_split_ops *ops, + return __devlink_nl_pre_doit(skb, info, DEVLINK_NL_FLAG_NEED_DEVLINK_OR_PORT); + } + +-void devlink_nl_post_doit(const struct genl_split_ops *ops, +- struct sk_buff *skb, struct genl_info *info) ++static void __devlink_nl_post_doit(struct sk_buff *skb, struct genl_info *info, ++ u8 flags) + { + struct devlink *devlink; + +@@ -151,6 +151,12 @@ void devlink_nl_post_doit(const struct genl_split_ops *ops, + devlink_put(devlink); + } + ++void devlink_nl_post_doit(const struct genl_split_ops *ops, ++ struct sk_buff *skb, struct genl_info *info) ++{ ++ __devlink_nl_post_doit(skb, info, 0); ++} ++ + static int devlink_nl_inst_single_dumpit(struct sk_buff *msg, + struct netlink_callback *cb, int flags, + devlink_nl_dump_one_func_t *dump_one, +-- +2.43.0 + diff --git a/queue-6.7/devlink-fix-devlink-parallel-commands-processing.patch b/queue-6.7/devlink-fix-devlink-parallel-commands-processing.patch new file mode 100644 index 00000000000..1216a458612 --- /dev/null +++ b/queue-6.7/devlink-fix-devlink-parallel-commands-processing.patch @@ -0,0 +1,63 @@ +From 8145849a45a47b8fb34e7eec43c44b1f48789f62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 12:52:38 +0200 +Subject: devlink: Fix devlink parallel commands processing + +From: Shay Drory + +[ Upstream commit d7d75124965aee23e5e4421d78376545cf070b0a ] + +Commit 870c7ad4a52b ("devlink: protect devlink->dev by the instance +lock") added devlink instance locking inside a loop that iterates over +all the registered devlink instances on the machine in the pre-doit +phase. This can lead to serialization of devlink commands over +different devlink instances. + +For example: While the first devlink instance is executing firmware +flash, all commands to other devlink instances on the machine are +forced to wait until the first devlink finishes. + +Therefore, in the pre-doit phase, take the devlink instance lock only +for the devlink instance the command is targeting. Devlink layer is +taking a reference on the devlink instance, ensuring the devlink->dev +pointer is valid. This reference taking was introduced by commit +a380687200e0 ("devlink: take device reference for devlink object"). +Without this commit, it would not be safe to access devlink->dev +lockless. + +Fixes: 870c7ad4a52b ("devlink: protect devlink->dev by the instance lock") +Signed-off-by: Shay Drory +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/devlink/netlink.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/net/devlink/netlink.c b/net/devlink/netlink.c +index 86f12531bf998..0f41fded6a6d7 100644 +--- a/net/devlink/netlink.c ++++ b/net/devlink/netlink.c +@@ -80,12 +80,13 @@ devlink_get_from_attrs_lock(struct net *net, struct nlattr **attrs, + devname = nla_data(attrs[DEVLINK_ATTR_DEV_NAME]); + + devlinks_xa_for_each_registered_get(net, index, devlink) { +- devl_dev_lock(devlink, dev_lock); +- if (devl_is_registered(devlink) && +- strcmp(devlink->dev->bus->name, busname) == 0 && +- strcmp(dev_name(devlink->dev), devname) == 0) +- return devlink; +- devl_dev_unlock(devlink, dev_lock); ++ if (strcmp(devlink->dev->bus->name, busname) == 0 && ++ strcmp(dev_name(devlink->dev), devname) == 0) { ++ devl_dev_lock(devlink, dev_lock); ++ if (devl_is_registered(devlink)) ++ return devlink; ++ devl_dev_unlock(devlink, dev_lock); ++ } + devlink_put(devlink); + } + +-- +2.43.0 + diff --git a/queue-6.7/devlink-fix-port-new-reply-cmd-type.patch b/queue-6.7/devlink-fix-port-new-reply-cmd-type.patch new file mode 100644 index 00000000000..2a196283a59 --- /dev/null +++ b/queue-6.7/devlink-fix-port-new-reply-cmd-type.patch @@ -0,0 +1,46 @@ +From 9b79c6865219ace9d8db4e92e9673dfcf5d3d436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 10:19:08 +0100 +Subject: devlink: fix port new reply cmd type + +From: Jiri Pirko + +[ Upstream commit 78a2f5e6c15d8dcbd6495bb9635c7cb89235dfc5 ] + +Due to a c&p error, port new reply fills-up cmd with wrong value, +any other existing port command replies and notifications. + +Fix it by filling cmd with value DEVLINK_CMD_PORT_NEW. + +Skimmed through devlink userspace implementations, none of them cares +about this cmd value. + +Reported-by: Chenyuan Yang +Closes: https://lore.kernel.org/all/ZfZcDxGV3tSy4qsV@cy-server/ +Fixes: cd76dcd68d96 ("devlink: Support add and delete devlink port") +Signed-off-by: Jiri Pirko +Reviewed-by: Parav Pandit +Reviewed-by: Kalesh AP +Link: https://lore.kernel.org/r/20240318091908.2736542-1-jiri@resnulli.us +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/devlink/port.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/devlink/port.c b/net/devlink/port.c +index d39ee6053cc7b..2b3c2b1a3eb37 100644 +--- a/net/devlink/port.c ++++ b/net/devlink/port.c +@@ -887,7 +887,7 @@ int devlink_nl_port_new_doit(struct sk_buff *skb, struct genl_info *info) + err = -ENOMEM; + goto err_out_port_del; + } +- err = devlink_nl_port_fill(msg, devlink_port, DEVLINK_CMD_NEW, ++ err = devlink_nl_port_fill(msg, devlink_port, DEVLINK_CMD_PORT_NEW, + info->snd_portid, info->snd_seq, 0, NULL); + if (WARN_ON_ONCE(err)) + goto err_out_msg_free; +-- +2.43.0 + diff --git a/queue-6.7/devlink-move-private-netlink-flags-to-c-file.patch b/queue-6.7/devlink-move-private-netlink-flags-to-c-file.patch new file mode 100644 index 00000000000..4e6ce69b48f --- /dev/null +++ b/queue-6.7/devlink-move-private-netlink-flags-to-c-file.patch @@ -0,0 +1,55 @@ +From cc5e1865ea042f5c0b7be6bceef786f639a545d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 13:17:10 +0100 +Subject: devlink: Move private netlink flags to C file + +From: Ido Schimmel + +[ Upstream commit 526dd6d7877b80b1f56d87156b65b8227c69d59f ] + +The flags are not used outside of the C file so move them there. + +Suggested-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Reviewed-by: Jiri Pirko +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Stable-dep-of: d7d75124965a ("devlink: Fix devlink parallel commands processing") +Signed-off-by: Sasha Levin +--- + net/devlink/devl_internal.h | 3 --- + net/devlink/netlink.c | 3 +++ + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/devlink/devl_internal.h b/net/devlink/devl_internal.h +index 183dbe3807ab3..2a9b263300a4b 100644 +--- a/net/devlink/devl_internal.h ++++ b/net/devlink/devl_internal.h +@@ -111,9 +111,6 @@ int devlink_rel_devlink_handle_put(struct sk_buff *msg, struct devlink *devlink, + bool *msg_updated); + + /* Netlink */ +-#define DEVLINK_NL_FLAG_NEED_PORT BIT(0) +-#define DEVLINK_NL_FLAG_NEED_DEVLINK_OR_PORT BIT(1) +- + enum devlink_multicast_groups { + DEVLINK_MCGRP_CONFIG, + }; +diff --git a/net/devlink/netlink.c b/net/devlink/netlink.c +index d0b90ebc8b152..7350138c8bb44 100644 +--- a/net/devlink/netlink.c ++++ b/net/devlink/netlink.c +@@ -9,6 +9,9 @@ + + #include "devl_internal.h" + ++#define DEVLINK_NL_FLAG_NEED_PORT BIT(0) ++#define DEVLINK_NL_FLAG_NEED_DEVLINK_OR_PORT BIT(1) ++ + static const struct genl_multicast_group devlink_nl_mcgrps[] = { + [DEVLINK_MCGRP_CONFIG] = { .name = DEVLINK_GENL_MCGRP_CONFIG_NAME }, + }; +-- +2.43.0 + diff --git a/queue-6.7/dm-integrity-align-the-outgoing-bio-in-integrity_rec.patch b/queue-6.7/dm-integrity-align-the-outgoing-bio-in-integrity_rec.patch new file mode 100644 index 00000000000..172c9fbd506 --- /dev/null +++ b/queue-6.7/dm-integrity-align-the-outgoing-bio-in-integrity_rec.patch @@ -0,0 +1,79 @@ +From 7e3c6ec5da50c9692f2d17c57db6576e2cb7f3d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 17:48:45 +0100 +Subject: dm-integrity: align the outgoing bio in integrity_recheck + +From: Mikulas Patocka + +[ Upstream commit b4d78cfeb30476239cf08f4f40afc095c173d6e3 ] + +It is possible to set up dm-integrity with smaller sector size than +the logical sector size of the underlying device. In this situation, +dm-integrity guarantees that the outgoing bios have the same alignment as +incoming bios (so, if you create a filesystem with 4k block size, +dm-integrity would send 4k-aligned bios to the underlying device). + +This guarantee was broken when integrity_recheck was implemented. +integrity_recheck sends bio that is aligned to ic->sectors_per_block. So +if we set up integrity with 512-byte sector size on a device with logical +block size 4k, we would be sending unaligned bio. This triggered a bug in +one of our internal tests. + +This commit fixes it by determining the actual alignment of the +incoming bio and then makes sure that the outgoing bio in +integrity_recheck has the same alignment. + +Fixes: c88f5e553fe3 ("dm-integrity: recheck the integrity tag after a failure") +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index ec8df735077fe..2cc30b9ab232a 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -1699,7 +1699,6 @@ static noinline void integrity_recheck(struct dm_integrity_io *dio, char *checks + struct bio_vec bv; + sector_t sector, logical_sector, area, offset; + struct page *page; +- void *buffer; + + get_area_and_offset(ic, dio->range.logical_sector, &area, &offset); + dio->metadata_block = get_metadata_sector_and_offset(ic, area, offset, +@@ -1708,13 +1707,14 @@ static noinline void integrity_recheck(struct dm_integrity_io *dio, char *checks + logical_sector = dio->range.logical_sector; + + page = mempool_alloc(&ic->recheck_pool, GFP_NOIO); +- buffer = page_to_virt(page); + + __bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) { + unsigned pos = 0; + + do { ++ sector_t alignment; + char *mem; ++ char *buffer = page_to_virt(page); + int r; + struct dm_io_request io_req; + struct dm_io_region io_loc; +@@ -1727,6 +1727,14 @@ static noinline void integrity_recheck(struct dm_integrity_io *dio, char *checks + io_loc.sector = sector; + io_loc.count = ic->sectors_per_block; + ++ /* Align the bio to logical block size */ ++ alignment = dio->range.logical_sector | bio_sectors(bio) | (PAGE_SIZE >> SECTOR_SHIFT); ++ alignment &= -alignment; ++ io_loc.sector = round_down(io_loc.sector, alignment); ++ io_loc.count += sector - io_loc.sector; ++ buffer += (sector - io_loc.sector) << SECTOR_SHIFT; ++ io_loc.count = round_up(io_loc.count, alignment); ++ + r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) { + dio->bi_status = errno_to_blk_status(r); +-- +2.43.0 + diff --git a/queue-6.7/dm-integrity-fix-a-memory-leak-when-rechecking-the-d.patch b/queue-6.7/dm-integrity-fix-a-memory-leak-when-rechecking-the-d.patch new file mode 100644 index 00000000000..8fa8bdf13d5 --- /dev/null +++ b/queue-6.7/dm-integrity-fix-a-memory-leak-when-rechecking-the-d.patch @@ -0,0 +1,47 @@ +From 22554ed2b958dd9fec6ba88da1a3f976d03373cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 18:35:06 +0100 +Subject: dm-integrity: fix a memory leak when rechecking the data + +From: Mikulas Patocka + +[ Upstream commit 55e565c42dce81a4e49c13262d5bc4eb4c2e588a ] + +Memory for the "checksums" pointer will leak if the data is rechecked +after checksum failure (because the associated kfree won't happen due +to 'goto skip_io'). + +Fix this by freeing the checksums memory before recheck, and just use +the "checksum_onstack" memory for storing checksum during recheck. + +Fixes: c88f5e553fe3 ("dm-integrity: recheck the integrity tag after a failure") +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index e8e8fc33d3440..cc834c8423bcf 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -1848,12 +1848,12 @@ static void integrity_metadata(struct work_struct *w) + r = dm_integrity_rw_tag(ic, checksums, &dio->metadata_block, &dio->metadata_offset, + checksums_ptr - checksums, dio->op == REQ_OP_READ ? TAG_CMP : TAG_WRITE); + if (unlikely(r)) { ++ if (likely(checksums != checksums_onstack)) ++ kfree(checksums); + if (r > 0) { +- integrity_recheck(dio, checksums); ++ integrity_recheck(dio, checksums_onstack); + goto skip_io; + } +- if (likely(checksums != checksums_onstack)) +- kfree(checksums); + goto error; + } + +-- +2.43.0 + diff --git a/queue-6.7/dm-io-support-io-priority.patch b/queue-6.7/dm-io-support-io-priority.patch new file mode 100644 index 00000000000..e2683714df8 --- /dev/null +++ b/queue-6.7/dm-io-support-io-priority.patch @@ -0,0 +1,386 @@ +From a1fa63eef9da3f5a5e4ee3d8b8000e0641492784 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 13:35:53 +0800 +Subject: dm io: Support IO priority + +From: Hongyu Jin + +[ Upstream commit 6e5f0f6383b4896c7e9b943d84b136149d0f45e9 ] + +Some IO will dispatch from kworker with different io_context settings +than the submitting task, we may need to specify a priority to avoid +losing priority. + +Add IO priority parameter to dm_io() and update all callers. + +Co-developed-by: Yibin Ding +Signed-off-by: Yibin Ding +Signed-off-by: Hongyu Jin +Reviewed-by: Eric Biggers +Reviewed-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Stable-dep-of: b4d78cfeb304 ("dm-integrity: align the outgoing bio in integrity_recheck") +Signed-off-by: Sasha Levin +--- + drivers/md/dm-bufio.c | 6 +++--- + drivers/md/dm-integrity.c | 12 ++++++------ + drivers/md/dm-io.c | 23 +++++++++++++---------- + drivers/md/dm-kcopyd.c | 4 ++-- + drivers/md/dm-log.c | 4 ++-- + drivers/md/dm-raid1.c | 6 +++--- + drivers/md/dm-snap-persistent.c | 4 ++-- + drivers/md/dm-verity-target.c | 2 +- + drivers/md/dm-writecache.c | 8 ++++---- + include/linux/dm-io.h | 3 ++- + 10 files changed, 38 insertions(+), 34 deletions(-) + +diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c +index f03d7dba270c5..4f2808ef387f6 100644 +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -1315,7 +1315,7 @@ static void use_dmio(struct dm_buffer *b, enum req_op op, sector_t sector, + io_req.mem.ptr.vma = (char *)b->data + offset; + } + +- r = dm_io(&io_req, 1, ®ion, NULL); ++ r = dm_io(&io_req, 1, ®ion, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) + b->end_io(b, errno_to_blk_status(r)); + } +@@ -2167,7 +2167,7 @@ int dm_bufio_issue_flush(struct dm_bufio_client *c) + if (WARN_ON_ONCE(dm_bufio_in_request())) + return -EINVAL; + +- return dm_io(&io_req, 1, &io_reg, NULL); ++ return dm_io(&io_req, 1, &io_reg, NULL, IOPRIO_DEFAULT); + } + EXPORT_SYMBOL_GPL(dm_bufio_issue_flush); + +@@ -2191,7 +2191,7 @@ int dm_bufio_issue_discard(struct dm_bufio_client *c, sector_t block, sector_t c + if (WARN_ON_ONCE(dm_bufio_in_request())) + return -EINVAL; /* discards are optional */ + +- return dm_io(&io_req, 1, &io_reg, NULL); ++ return dm_io(&io_req, 1, &io_reg, NULL, IOPRIO_DEFAULT); + } + EXPORT_SYMBOL_GPL(dm_bufio_issue_discard); + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index cc834c8423bcf..ec8df735077fe 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -555,7 +555,7 @@ static int sync_rw_sb(struct dm_integrity_c *ic, blk_opf_t opf) + } + } + +- r = dm_io(&io_req, 1, &io_loc, NULL); ++ r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) + return r; + +@@ -1073,7 +1073,7 @@ static void rw_journal_sectors(struct dm_integrity_c *ic, blk_opf_t opf, + io_loc.sector = ic->start + SB_SECTORS + sector; + io_loc.count = n_sectors; + +- r = dm_io(&io_req, 1, &io_loc, NULL); ++ r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) { + dm_integrity_io_error(ic, (opf & REQ_OP_MASK) == REQ_OP_READ ? + "reading journal" : "writing journal", r); +@@ -1190,7 +1190,7 @@ static void copy_from_journal(struct dm_integrity_c *ic, unsigned int section, u + io_loc.sector = target; + io_loc.count = n_sectors; + +- r = dm_io(&io_req, 1, &io_loc, NULL); ++ r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) { + WARN_ONCE(1, "asynchronous dm_io failed: %d", r); + fn(-1UL, data); +@@ -1519,7 +1519,7 @@ static void dm_integrity_flush_buffers(struct dm_integrity_c *ic, bool flush_dat + fr.io_reg.count = 0, + fr.ic = ic; + init_completion(&fr.comp); +- r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL); ++ r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL, IOPRIO_DEFAULT); + BUG_ON(r); + } + +@@ -1727,7 +1727,7 @@ static noinline void integrity_recheck(struct dm_integrity_io *dio, char *checks + io_loc.sector = sector; + io_loc.count = ic->sectors_per_block; + +- r = dm_io(&io_req, 1, &io_loc, NULL); ++ r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) { + dio->bi_status = errno_to_blk_status(r); + goto free_ret; +@@ -2806,7 +2806,7 @@ static void integrity_recalc(struct work_struct *w) + io_loc.sector = get_data_sector(ic, area, offset); + io_loc.count = n_sectors; + +- r = dm_io(&io_req, 1, &io_loc, NULL); ++ r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) { + dm_integrity_io_error(ic, "reading data", r); + goto err; +diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c +index f053ce2458147..7409490259d1d 100644 +--- a/drivers/md/dm-io.c ++++ b/drivers/md/dm-io.c +@@ -305,7 +305,7 @@ static void km_dp_init(struct dpages *dp, void *data) + */ + static void do_region(const blk_opf_t opf, unsigned int region, + struct dm_io_region *where, struct dpages *dp, +- struct io *io) ++ struct io *io, unsigned short ioprio) + { + struct bio *bio; + struct page *page; +@@ -354,6 +354,7 @@ static void do_region(const blk_opf_t opf, unsigned int region, + &io->client->bios); + bio->bi_iter.bi_sector = where->sector + (where->count - remaining); + bio->bi_end_io = endio; ++ bio->bi_ioprio = ioprio; + store_io_and_region_in_bio(bio, io, region); + + if (op == REQ_OP_DISCARD || op == REQ_OP_WRITE_ZEROES) { +@@ -383,7 +384,7 @@ static void do_region(const blk_opf_t opf, unsigned int region, + + static void dispatch_io(blk_opf_t opf, unsigned int num_regions, + struct dm_io_region *where, struct dpages *dp, +- struct io *io, int sync) ++ struct io *io, int sync, unsigned short ioprio) + { + int i; + struct dpages old_pages = *dp; +@@ -400,7 +401,7 @@ static void dispatch_io(blk_opf_t opf, unsigned int num_regions, + for (i = 0; i < num_regions; i++) { + *dp = old_pages; + if (where[i].count || (opf & REQ_PREFLUSH)) +- do_region(opf, i, where + i, dp, io); ++ do_region(opf, i, where + i, dp, io, ioprio); + } + + /* +@@ -425,7 +426,7 @@ static void sync_io_complete(unsigned long error, void *context) + + static int sync_io(struct dm_io_client *client, unsigned int num_regions, + struct dm_io_region *where, blk_opf_t opf, struct dpages *dp, +- unsigned long *error_bits) ++ unsigned long *error_bits, unsigned short ioprio) + { + struct io *io; + struct sync_io sio; +@@ -447,7 +448,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions, + io->vma_invalidate_address = dp->vma_invalidate_address; + io->vma_invalidate_size = dp->vma_invalidate_size; + +- dispatch_io(opf, num_regions, where, dp, io, 1); ++ dispatch_io(opf, num_regions, where, dp, io, 1, ioprio); + + wait_for_completion_io(&sio.wait); + +@@ -459,7 +460,8 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions, + + static int async_io(struct dm_io_client *client, unsigned int num_regions, + struct dm_io_region *where, blk_opf_t opf, +- struct dpages *dp, io_notify_fn fn, void *context) ++ struct dpages *dp, io_notify_fn fn, void *context, ++ unsigned short ioprio) + { + struct io *io; + +@@ -479,7 +481,7 @@ static int async_io(struct dm_io_client *client, unsigned int num_regions, + io->vma_invalidate_address = dp->vma_invalidate_address; + io->vma_invalidate_size = dp->vma_invalidate_size; + +- dispatch_io(opf, num_regions, where, dp, io, 0); ++ dispatch_io(opf, num_regions, where, dp, io, 0, ioprio); + return 0; + } + +@@ -521,7 +523,8 @@ static int dp_init(struct dm_io_request *io_req, struct dpages *dp, + } + + int dm_io(struct dm_io_request *io_req, unsigned int num_regions, +- struct dm_io_region *where, unsigned long *sync_error_bits) ++ struct dm_io_region *where, unsigned long *sync_error_bits, ++ unsigned short ioprio) + { + int r; + struct dpages dp; +@@ -532,11 +535,11 @@ int dm_io(struct dm_io_request *io_req, unsigned int num_regions, + + if (!io_req->notify.fn) + return sync_io(io_req->client, num_regions, where, +- io_req->bi_opf, &dp, sync_error_bits); ++ io_req->bi_opf, &dp, sync_error_bits, ioprio); + + return async_io(io_req->client, num_regions, where, + io_req->bi_opf, &dp, io_req->notify.fn, +- io_req->notify.context); ++ io_req->notify.context, ioprio); + } + EXPORT_SYMBOL(dm_io); + +diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c +index d01807c50f20b..79c65c9ad5fa8 100644 +--- a/drivers/md/dm-kcopyd.c ++++ b/drivers/md/dm-kcopyd.c +@@ -578,9 +578,9 @@ static int run_io_job(struct kcopyd_job *job) + io_job_start(job->kc->throttle); + + if (job->op == REQ_OP_READ) +- r = dm_io(&io_req, 1, &job->source, NULL); ++ r = dm_io(&io_req, 1, &job->source, NULL, IOPRIO_DEFAULT); + else +- r = dm_io(&io_req, job->num_dests, job->dests, NULL); ++ r = dm_io(&io_req, job->num_dests, job->dests, NULL, IOPRIO_DEFAULT); + + return r; + } +diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c +index f9f84236dfcd7..f7f9c2100937b 100644 +--- a/drivers/md/dm-log.c ++++ b/drivers/md/dm-log.c +@@ -300,7 +300,7 @@ static int rw_header(struct log_c *lc, enum req_op op) + { + lc->io_req.bi_opf = op; + +- return dm_io(&lc->io_req, 1, &lc->header_location, NULL); ++ return dm_io(&lc->io_req, 1, &lc->header_location, NULL, IOPRIO_DEFAULT); + } + + static int flush_header(struct log_c *lc) +@@ -313,7 +313,7 @@ static int flush_header(struct log_c *lc) + + lc->io_req.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH; + +- return dm_io(&lc->io_req, 1, &null_location, NULL); ++ return dm_io(&lc->io_req, 1, &null_location, NULL, IOPRIO_DEFAULT); + } + + static int read_header(struct log_c *log) +diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c +index ddcb2bc4a6179..9511dae5b556a 100644 +--- a/drivers/md/dm-raid1.c ++++ b/drivers/md/dm-raid1.c +@@ -278,7 +278,7 @@ static int mirror_flush(struct dm_target *ti) + } + + error_bits = -1; +- dm_io(&io_req, ms->nr_mirrors, io, &error_bits); ++ dm_io(&io_req, ms->nr_mirrors, io, &error_bits, IOPRIO_DEFAULT); + if (unlikely(error_bits != 0)) { + for (i = 0; i < ms->nr_mirrors; i++) + if (test_bit(i, &error_bits)) +@@ -554,7 +554,7 @@ static void read_async_bio(struct mirror *m, struct bio *bio) + + map_region(&io, m, bio); + bio_set_m(bio, m); +- BUG_ON(dm_io(&io_req, 1, &io, NULL)); ++ BUG_ON(dm_io(&io_req, 1, &io, NULL, IOPRIO_DEFAULT)); + } + + static inline int region_in_sync(struct mirror_set *ms, region_t region, +@@ -681,7 +681,7 @@ static void do_write(struct mirror_set *ms, struct bio *bio) + */ + bio_set_m(bio, get_default_mirror(ms)); + +- BUG_ON(dm_io(&io_req, ms->nr_mirrors, io, NULL)); ++ BUG_ON(dm_io(&io_req, ms->nr_mirrors, io, NULL, IOPRIO_DEFAULT)); + } + + static void do_writes(struct mirror_set *ms, struct bio_list *writes) +diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c +index 15649921f2a9b..568d10842b1f4 100644 +--- a/drivers/md/dm-snap-persistent.c ++++ b/drivers/md/dm-snap-persistent.c +@@ -223,7 +223,7 @@ static void do_metadata(struct work_struct *work) + { + struct mdata_req *req = container_of(work, struct mdata_req, work); + +- req->result = dm_io(req->io_req, 1, req->where, NULL); ++ req->result = dm_io(req->io_req, 1, req->where, NULL, IOPRIO_DEFAULT); + } + + /* +@@ -247,7 +247,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, blk_opf_t opf, + struct mdata_req req; + + if (!metadata) +- return dm_io(&io_req, 1, &where, NULL); ++ return dm_io(&io_req, 1, &where, NULL, IOPRIO_DEFAULT); + + req.where = &where; + req.io_req = &io_req; +diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c +index 7b620b187da90..49e4a35d70196 100644 +--- a/drivers/md/dm-verity-target.c ++++ b/drivers/md/dm-verity-target.c +@@ -511,7 +511,7 @@ static noinline int verity_recheck(struct dm_verity *v, struct dm_verity_io *io, + io_loc.bdev = v->data_dev->bdev; + io_loc.sector = cur_block << (v->data_dev_block_bits - SECTOR_SHIFT); + io_loc.count = 1 << (v->data_dev_block_bits - SECTOR_SHIFT); +- r = dm_io(&io_req, 1, &io_loc, NULL); ++ r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) + goto free_ret; + +diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c +index 074cb785eafc1..6a4279bfb1e77 100644 +--- a/drivers/md/dm-writecache.c ++++ b/drivers/md/dm-writecache.c +@@ -531,7 +531,7 @@ static void ssd_commit_flushed(struct dm_writecache *wc, bool wait_for_ios) + req.notify.context = &endio; + + /* writing via async dm-io (implied by notify.fn above) won't return an error */ +- (void) dm_io(&req, 1, ®ion, NULL); ++ (void) dm_io(&req, 1, ®ion, NULL, IOPRIO_DEFAULT); + i = j; + } + +@@ -568,7 +568,7 @@ static void ssd_commit_superblock(struct dm_writecache *wc) + req.notify.fn = NULL; + req.notify.context = NULL; + +- r = dm_io(&req, 1, ®ion, NULL); ++ r = dm_io(&req, 1, ®ion, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) + writecache_error(wc, r, "error writing superblock"); + } +@@ -596,7 +596,7 @@ static void writecache_disk_flush(struct dm_writecache *wc, struct dm_dev *dev) + req.client = wc->dm_io; + req.notify.fn = NULL; + +- r = dm_io(&req, 1, ®ion, NULL); ++ r = dm_io(&req, 1, ®ion, NULL, IOPRIO_DEFAULT); + if (unlikely(r)) + writecache_error(wc, r, "error flushing metadata: %d", r); + } +@@ -990,7 +990,7 @@ static int writecache_read_metadata(struct dm_writecache *wc, sector_t n_sectors + req.client = wc->dm_io; + req.notify.fn = NULL; + +- return dm_io(&req, 1, ®ion, NULL); ++ return dm_io(&req, 1, ®ion, NULL, IOPRIO_DEFAULT); + } + + static void writecache_resume(struct dm_target *ti) +diff --git a/include/linux/dm-io.h b/include/linux/dm-io.h +index 7595142f3fc57..7b2968612b7e6 100644 +--- a/include/linux/dm-io.h ++++ b/include/linux/dm-io.h +@@ -80,7 +80,8 @@ void dm_io_client_destroy(struct dm_io_client *client); + * error occurred doing io to the corresponding region. + */ + int dm_io(struct dm_io_request *io_req, unsigned int num_regions, +- struct dm_io_region *region, unsigned int long *sync_error_bits); ++ struct dm_io_region *region, unsigned int long *sync_error_bits, ++ unsigned short ioprio); + + #endif /* __KERNEL__ */ + #endif /* _LINUX_DM_IO_H */ +-- +2.43.0 + diff --git a/queue-6.7/drm-amdgpu-add-mmhub-3.3.1-support.patch b/queue-6.7/drm-amdgpu-add-mmhub-3.3.1-support.patch new file mode 100644 index 00000000000..00ec7cfaab8 --- /dev/null +++ b/queue-6.7/drm-amdgpu-add-mmhub-3.3.1-support.patch @@ -0,0 +1,49 @@ +From 35bccf1f379bc23a3accc850f81e7f4a0e22ef08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 10:39:48 +0800 +Subject: drm/amdgpu: add MMHUB 3.3.1 support + +From: Yifan Zhang + +[ Upstream commit 31e0a586f3385134bcad00d8194eb0728cb1a17d ] + +This patch to add MMHUB 3.3.1 support. + +v2: squash in fault info fix (Alex) + +Signed-off-by: Yifan Zhang +Signed-off-by: Alex Deucher +Stable-dep-of: 6540ff6482c1 ("drm/amdgpu: fix mmhub client id out-of-bounds access") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 1 + + drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c +index c9c653cfc765b..3f1692194b7ad 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c +@@ -570,6 +570,7 @@ static void gmc_v11_0_set_mmhub_funcs(struct amdgpu_device *adev) + adev->mmhub.funcs = &mmhub_v3_0_2_funcs; + break; + case IP_VERSION(3, 3, 0): ++ case IP_VERSION(3, 3, 1): + adev->mmhub.funcs = &mmhub_v3_3_funcs; + break; + default: +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c +index dc4812ecc98d6..b3961968c10c4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c +@@ -98,6 +98,7 @@ mmhub_v3_3_print_l2_protection_fault_status(struct amdgpu_device *adev, + + switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) { + case IP_VERSION(3, 3, 0): ++ case IP_VERSION(3, 3, 1): + mmhub_cid = mmhub_client_ids_v3_3[cid][rw]; + break; + default: +-- +2.43.0 + diff --git a/queue-6.7/drm-amdgpu-drop-setting-buffer-funcs-in-sdma442.patch b/queue-6.7/drm-amdgpu-drop-setting-buffer-funcs-in-sdma442.patch new file mode 100644 index 00000000000..96d2a709889 --- /dev/null +++ b/queue-6.7/drm-amdgpu-drop-setting-buffer-funcs-in-sdma442.patch @@ -0,0 +1,81 @@ +From 372379e8bfcc6cc85aa71f30274f0ec5ce568175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 16:55:39 +0800 +Subject: drm/amdgpu: drop setting buffer funcs in sdma442 + +From: Le Ma + +[ Upstream commit ad550dbe8ae4ba833371a018265c1c3ae88559f0 ] + +To fix the entity rq NULL issue. This setting has been moved +to upper level. + +Fixes: b70438004a14 ("drm/amdgpu: move buffer funcs setting up a level") +Signed-off-by: Le Ma +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 23 +---------------------- + 1 file changed, 1 insertion(+), 22 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c +index 0f24af6f28102..8eed9a73d0355 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c +@@ -429,16 +429,11 @@ static void sdma_v4_4_2_inst_gfx_stop(struct amdgpu_device *adev, + struct amdgpu_ring *sdma[AMDGPU_MAX_SDMA_INSTANCES]; + u32 doorbell_offset, doorbell; + u32 rb_cntl, ib_cntl; +- int i, unset = 0; ++ int i; + + for_each_inst(i, inst_mask) { + sdma[i] = &adev->sdma.instance[i].ring; + +- if ((adev->mman.buffer_funcs_ring == sdma[i]) && unset != 1) { +- amdgpu_ttm_set_buffer_funcs_status(adev, false); +- unset = 1; +- } +- + rb_cntl = RREG32_SDMA(i, regSDMA_GFX_RB_CNTL); + rb_cntl = REG_SET_FIELD(rb_cntl, SDMA_GFX_RB_CNTL, RB_ENABLE, 0); + WREG32_SDMA(i, regSDMA_GFX_RB_CNTL, rb_cntl); +@@ -485,20 +480,10 @@ static void sdma_v4_4_2_inst_rlc_stop(struct amdgpu_device *adev, + static void sdma_v4_4_2_inst_page_stop(struct amdgpu_device *adev, + uint32_t inst_mask) + { +- struct amdgpu_ring *sdma[AMDGPU_MAX_SDMA_INSTANCES]; + u32 rb_cntl, ib_cntl; + int i; +- bool unset = false; + + for_each_inst(i, inst_mask) { +- sdma[i] = &adev->sdma.instance[i].page; +- +- if ((adev->mman.buffer_funcs_ring == sdma[i]) && +- (!unset)) { +- amdgpu_ttm_set_buffer_funcs_status(adev, false); +- unset = true; +- } +- + rb_cntl = RREG32_SDMA(i, regSDMA_PAGE_RB_CNTL); + rb_cntl = REG_SET_FIELD(rb_cntl, SDMA_PAGE_RB_CNTL, + RB_ENABLE, 0); +@@ -948,13 +933,7 @@ static int sdma_v4_4_2_inst_start(struct amdgpu_device *adev, + r = amdgpu_ring_test_helper(page); + if (r) + return r; +- +- if (adev->mman.buffer_funcs_ring == page) +- amdgpu_ttm_set_buffer_funcs_status(adev, true); + } +- +- if (adev->mman.buffer_funcs_ring == ring) +- amdgpu_ttm_set_buffer_funcs_status(adev, true); + } + + return r; +-- +2.43.0 + diff --git a/queue-6.7/drm-amdgpu-fix-mmhub-client-id-out-of-bounds-access.patch b/queue-6.7/drm-amdgpu-fix-mmhub-client-id-out-of-bounds-access.patch new file mode 100644 index 00000000000..ff3887dcf23 --- /dev/null +++ b/queue-6.7/drm-amdgpu-fix-mmhub-client-id-out-of-bounds-access.patch @@ -0,0 +1,47 @@ +From 531ce73b1b7f1e99c218f3908f2ff89d359c457f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 12:42:49 +0800 +Subject: drm/amdgpu: fix mmhub client id out-of-bounds access + +From: Lang Yu + +[ Upstream commit 6540ff6482c1a5a6890ae44b23d0852ba1986d9e ] + +Properly handle cid 0x140. + +Fixes: aba2be41470a ("drm/amdgpu: add mmhub 3.3.0 support") +Signed-off-by: Lang Yu +Reviewed-by: Yifan Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c +index b3961968c10c4..238ea40c24500 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c +@@ -99,16 +99,15 @@ mmhub_v3_3_print_l2_protection_fault_status(struct amdgpu_device *adev, + switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) { + case IP_VERSION(3, 3, 0): + case IP_VERSION(3, 3, 1): +- mmhub_cid = mmhub_client_ids_v3_3[cid][rw]; ++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_3) ? ++ mmhub_client_ids_v3_3[cid][rw] : ++ cid == 0x140 ? "UMSCH" : NULL; + break; + default: + mmhub_cid = NULL; + break; + } + +- if (!mmhub_cid && cid == 0x140) +- mmhub_cid = "UMSCH"; +- + dev_err(adev->dev, "\t Faulty UTCL2 client ID: %s (0x%x)\n", + mmhub_cid ? mmhub_cid : "unknown", cid); + dev_err(adev->dev, "\t MORE_FAULTS: 0x%lx\n", +-- +2.43.0 + diff --git a/queue-6.7/drm-fix-drm_fixp2int_round-making-it-add-0.5.patch b/queue-6.7/drm-fix-drm_fixp2int_round-making-it-add-0.5.patch new file mode 100644 index 00000000000..6b7c86a60ab --- /dev/null +++ b/queue-6.7/drm-fix-drm_fixp2int_round-making-it-add-0.5.patch @@ -0,0 +1,51 @@ +From 99f7c61cd33cc41ee78d12039b603457ac315731 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Mar 2024 13:25:20 -0300 +Subject: drm: Fix drm_fixp2int_round() making it add 0.5 + +From: Arthur Grillo + +[ Upstream commit 807f96abdf14c80f534c78f2d854c2590963345c ] + +As well noted by Pekka[1], the rounding of drm_fixp2int_round is wrong. +To round a number, you need to add 0.5 to the number and floor that, +drm_fixp2int_round() is adding 0.0000076. Make it add 0.5. + +[1]: https://lore.kernel.org/all/20240301135327.22efe0dd.pekka.paalanen@collabora.com/ + +Fixes: 8b25320887d7 ("drm: Add fixed-point helper to get rounded integer values") +Suggested-by: Pekka Paalanen +Reviewed-by: Harry Wentland +Reviewed-by: Melissa Wen +Signed-off-by: Arthur Grillo +Signed-off-by: Melissa Wen +Link: https://patchwork.freedesktop.org/patch/msgid/20240316-drm_fixed-v2-1-c1bc2665b5ed@riseup.net +Signed-off-by: Sasha Levin +--- + include/drm/drm_fixed.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h +index 0c9f917a4d4be..81572d32db0c2 100644 +--- a/include/drm/drm_fixed.h ++++ b/include/drm/drm_fixed.h +@@ -71,7 +71,6 @@ static inline u32 dfixed_div(fixed20_12 A, fixed20_12 B) + } + + #define DRM_FIXED_POINT 32 +-#define DRM_FIXED_POINT_HALF 16 + #define DRM_FIXED_ONE (1ULL << DRM_FIXED_POINT) + #define DRM_FIXED_DECIMAL_MASK (DRM_FIXED_ONE - 1) + #define DRM_FIXED_DIGITS_MASK (~DRM_FIXED_DECIMAL_MASK) +@@ -90,7 +89,7 @@ static inline int drm_fixp2int(s64 a) + + static inline int drm_fixp2int_round(s64 a) + { +- return drm_fixp2int(a + (1 << (DRM_FIXED_POINT_HALF - 1))); ++ return drm_fixp2int(a + DRM_FIXED_ONE / 2); + } + + static inline int drm_fixp2int_ceil(s64 a) +-- +2.43.0 + diff --git a/queue-6.7/hsr-fix-uninit-value-access-in-hsr_get_node.patch b/queue-6.7/hsr-fix-uninit-value-access-in-hsr_get_node.patch new file mode 100644 index 00000000000..9bded5e80f5 --- /dev/null +++ b/queue-6.7/hsr-fix-uninit-value-access-in-hsr_get_node.patch @@ -0,0 +1,98 @@ +From 67e13161306c9496fa4af660e495fbbcf6988e83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 00:27:19 +0900 +Subject: hsr: Fix uninit-value access in hsr_get_node() + +From: Shigeru Yoshida + +[ Upstream commit ddbec99f58571301679addbc022256970ca3eac6 ] + +KMSAN reported the following uninit-value access issue [1]: + +===================================================== +BUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 + hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 + fill_frame_info net/hsr/hsr_forward.c:577 [inline] + hsr_forward_skb+0xe12/0x30e0 net/hsr/hsr_forward.c:615 + hsr_dev_xmit+0x1a1/0x270 net/hsr/hsr_device.c:223 + __netdev_start_xmit include/linux/netdevice.h:4940 [inline] + netdev_start_xmit include/linux/netdevice.h:4954 [inline] + xmit_one net/core/dev.c:3548 [inline] + dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 + __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 + dev_queue_xmit include/linux/netdevice.h:3134 [inline] + packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 + packet_snd net/packet/af_packet.c:3087 [inline] + packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + __sys_sendto+0x735/0xa10 net/socket.c:2191 + __do_sys_sendto net/socket.c:2203 [inline] + __se_sys_sendto net/socket.c:2199 [inline] + __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Uninit was created at: + slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 + slab_alloc_node mm/slub.c:3478 [inline] + kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 + kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 + __alloc_skb+0x318/0x740 net/core/skbuff.c:651 + alloc_skb include/linux/skbuff.h:1286 [inline] + alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 + sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787 + packet_alloc_skb net/packet/af_packet.c:2936 [inline] + packet_snd net/packet/af_packet.c:3030 [inline] + packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + __sys_sendto+0x735/0xa10 net/socket.c:2191 + __do_sys_sendto net/socket.c:2203 [inline] + __se_sys_sendto net/socket.c:2199 [inline] + __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +CPU: 1 PID: 5033 Comm: syz-executor334 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 +===================================================== + +If the packet type ID field in the Ethernet header is either ETH_P_PRP or +ETH_P_HSR, but it is not followed by an HSR tag, hsr_get_skb_sequence_nr() +reads an invalid value as a sequence number. This causes the above issue. + +This patch fixes the issue by returning NULL if the Ethernet header is not +followed by an HSR tag. + +Fixes: f266a683a480 ("net/hsr: Better frame dispatch") +Reported-and-tested-by: syzbot+2ef3a8ce8e91b5a50098@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=2ef3a8ce8e91b5a50098 [1] +Signed-off-by: Shigeru Yoshida +Link: https://lore.kernel.org/r/20240312152719.724530-1-syoshida@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/hsr/hsr_framereg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index 6d14d935ee828..26329db09210b 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -228,6 +228,10 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct list_head *node_db, + */ + if (ethhdr->h_proto == htons(ETH_P_PRP) || + ethhdr->h_proto == htons(ETH_P_HSR)) { ++ /* Check if skb contains hsr_ethhdr */ ++ if (skb->mac_len < sizeof(struct hsr_ethhdr)) ++ return NULL; ++ + /* Use the existing sequence_nr from the tag as starting point + * for filtering duplicate frames. + */ +-- +2.43.0 + diff --git a/queue-6.7/hsr-handle-failures-in-module-init.patch b/queue-6.7/hsr-handle-failures-in-module-init.patch new file mode 100644 index 00000000000..019d89031a9 --- /dev/null +++ b/queue-6.7/hsr-handle-failures-in-module-init.patch @@ -0,0 +1,61 @@ +From 2e70fa438eb0d9e1b8ded5a78e80264b6d9f6cc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 13:04:52 +0100 +Subject: hsr: Handle failures in module init + +From: Felix Maurer + +[ Upstream commit 3cf28cd492308e5f63ed00b29ea03ca016264376 ] + +A failure during registration of the netdev notifier was not handled at +all. A failure during netlink initialization did not unregister the netdev +notifier. + +Handle failures of netdev notifier registration and netlink initialization. +Both functions should only return negative values on failure and thereby +lead to the hsr module not being loaded. + +Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") +Signed-off-by: Felix Maurer +Reviewed-by: Shigeru Yoshida +Reviewed-by: Breno Leitao +Link: https://lore.kernel.org/r/3ce097c15e3f7ace98fc7fd9bcbf299f092e63d1.1710504184.git.fmaurer@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/hsr/hsr_main.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c +index b099c31501509..257b50124cee5 100644 +--- a/net/hsr/hsr_main.c ++++ b/net/hsr/hsr_main.c +@@ -148,14 +148,21 @@ static struct notifier_block hsr_nb = { + + static int __init hsr_init(void) + { +- int res; ++ int err; + + BUILD_BUG_ON(sizeof(struct hsr_tag) != HSR_HLEN); + +- register_netdevice_notifier(&hsr_nb); +- res = hsr_netlink_init(); ++ err = register_netdevice_notifier(&hsr_nb); ++ if (err) ++ return err; ++ ++ err = hsr_netlink_init(); ++ if (err) { ++ unregister_netdevice_notifier(&hsr_nb); ++ return err; ++ } + +- return res; ++ return 0; + } + + static void __exit hsr_exit(void) +-- +2.43.0 + diff --git a/queue-6.7/hwtracing-hisi_ptt-move-type-check-to-the-beginning-.patch b/queue-6.7/hwtracing-hisi_ptt-move-type-check-to-the-beginning-.patch new file mode 100644 index 00000000000..1e2b739aa27 --- /dev/null +++ b/queue-6.7/hwtracing-hisi_ptt-move-type-check-to-the-beginning-.patch @@ -0,0 +1,55 @@ +From 477e96a75b852908b002475aa3f62062fe089b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 12:19:06 +0000 +Subject: hwtracing: hisi_ptt: Move type check to the beginning of + hisi_ptt_pmu_event_init() + +From: Yang Jihong + +[ Upstream commit 06226d120a28f146abd3637799958a4dc4dbb7a1 ] + +When perf_init_event() calls perf_try_init_event() to init pmu driver, +searches for the next pmu driver only when the return value is -ENOENT. +Therefore, hisi_ptt_pmu_event_init() needs to check the type at the +beginning of the function. +Otherwise, in the case of perf-task mode, perf_try_init_event() returns +-EOPNOTSUPP and skips subsequent pmu drivers, causes perf_init_event() to +fail. + +Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device") +Signed-off-by: Yang Jihong +Reviewed-by: Yicong Yang +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20240108121906.3514820-1-yangjihong1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/ptt/hisi_ptt.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c +index a991ecb7515a3..24a1f7797aeb6 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.c ++++ b/drivers/hwtracing/ptt/hisi_ptt.c +@@ -995,6 +995,9 @@ static int hisi_ptt_pmu_event_init(struct perf_event *event) + int ret; + u32 val; + ++ if (event->attr.type != hisi_ptt->hisi_ptt_pmu.type) ++ return -ENOENT; ++ + if (event->cpu < 0) { + dev_dbg(event->pmu->dev, "Per-task mode not supported\n"); + return -EOPNOTSUPP; +@@ -1003,9 +1006,6 @@ static int hisi_ptt_pmu_event_init(struct perf_event *event) + if (event->attach_state & PERF_ATTACH_TASK) + return -EOPNOTSUPP; + +- if (event->attr.type != hisi_ptt->hisi_ptt_pmu.type) +- return -ENOENT; +- + ret = hisi_ptt_trace_valid_filter(hisi_ptt, event->attr.config); + if (ret < 0) + return ret; +-- +2.43.0 + diff --git a/queue-6.7/iio-gts-helper-fix-division-loop.patch b/queue-6.7/iio-gts-helper-fix-division-loop.patch new file mode 100644 index 00000000000..a00366b46b7 --- /dev/null +++ b/queue-6.7/iio-gts-helper-fix-division-loop.patch @@ -0,0 +1,56 @@ +From 91c884c97656721cc16fb727f8a32a53d6e8c765 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 13:20:09 +0200 +Subject: iio: gts-helper: Fix division loop + +From: Matti Vaittinen + +[ Upstream commit bb76cc45dcdfcd962a5994b8fe19ab74fc6c3c3a ] + +The loop based 64bit division may run for a long time when dividend is a +lot bigger than the divider. Replace the division loop by the +div64_u64() which implementation may be significantly faster. + +Tested-by: Subhajit Ghosh +Signed-off-by: Matti Vaittinen +Fixes: 38416c28e168 ("iio: light: Add gain-time-scale helpers") +Link: https://lore.kernel.org/r/Zcn-6e-0-nh2WcfU@drtxq0yyyyyyyyyyyyyby-3.rev.dnainternet.fi +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/industrialio-gts-helper.c | 15 +-------------- + 1 file changed, 1 insertion(+), 14 deletions(-) + +diff --git a/drivers/iio/industrialio-gts-helper.c b/drivers/iio/industrialio-gts-helper.c +index 7653261d2dc2b..b51eb6cb766f3 100644 +--- a/drivers/iio/industrialio-gts-helper.c ++++ b/drivers/iio/industrialio-gts-helper.c +@@ -34,24 +34,11 @@ + static int iio_gts_get_gain(const u64 max, const u64 scale) + { + u64 full = max; +- int tmp = 1; + + if (scale > full || !scale) + return -EINVAL; + +- if (U64_MAX - full < scale) { +- /* Risk of overflow */ +- if (full - scale < scale) +- return 1; +- +- full -= scale; +- tmp++; +- } +- +- while (full > scale * (u64)tmp) +- tmp++; +- +- return tmp; ++ return div64_u64(full, scale); + } + + /** +-- +2.43.0 + diff --git a/queue-6.7/iio-pressure-mprls0025pa-fix-off-by-one-enum.patch b/queue-6.7/iio-pressure-mprls0025pa-fix-off-by-one-enum.patch new file mode 100644 index 00000000000..bb26da24bf6 --- /dev/null +++ b/queue-6.7/iio-pressure-mprls0025pa-fix-off-by-one-enum.patch @@ -0,0 +1,52 @@ +From 998e794b0126e301d5736284eb711806c120a3a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Dec 2023 11:24:32 +0200 +Subject: iio: pressure: mprls0025pa fix off-by-one enum + +From: Petre Rodan + +[ Upstream commit 9e65506ca9c7ff716c8441a33417820ad61d3a16 ] + +Fix off-by-one error in transfer-function property. +The honeywell,transfer-function property takes values between 1-3 so +make sure the proper enum gets used. + +Fixes: 713337d9143ed ("iio: pressure: Honeywell mprls0025pa pressure sensor") +Co-developed-by: Andreas Klinger +Signed-off-by: Andreas Klinger +Signed-off-by: Petre Rodan +Link: https://lore.kernel.org/r/20231229092445.30180-5-petre.rodan@subdimension.ro +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/mprls0025pa.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/pressure/mprls0025pa.c b/drivers/iio/pressure/mprls0025pa.c +index 30fb2de368210..e3f0de020a40c 100644 +--- a/drivers/iio/pressure/mprls0025pa.c ++++ b/drivers/iio/pressure/mprls0025pa.c +@@ -323,6 +323,7 @@ static int mpr_probe(struct i2c_client *client) + struct iio_dev *indio_dev; + struct device *dev = &client->dev; + s64 scale, offset; ++ u32 func; + + if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_READ_BYTE)) + return dev_err_probe(dev, -EOPNOTSUPP, +@@ -362,10 +363,11 @@ static int mpr_probe(struct i2c_client *client) + return dev_err_probe(dev, ret, + "honeywell,pmax-pascal could not be read\n"); + ret = device_property_read_u32(dev, +- "honeywell,transfer-function", &data->function); ++ "honeywell,transfer-function", &func); + if (ret) + return dev_err_probe(dev, ret, + "honeywell,transfer-function could not be read\n"); ++ data->function = func - 1; + if (data->function > MPR_FUNCTION_C) + return dev_err_probe(dev, -EINVAL, + "honeywell,transfer-function %d invalid\n", +-- +2.43.0 + diff --git a/queue-6.7/io_uring-don-t-save-restore-iowait-state.patch b/queue-6.7/io_uring-don-t-save-restore-iowait-state.patch new file mode 100644 index 00000000000..3d5e2443143 --- /dev/null +++ b/queue-6.7/io_uring-don-t-save-restore-iowait-state.patch @@ -0,0 +1,54 @@ +From 7fd7ed79aa48bf5ff7c192266f74fed9417005e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 13:30:43 -0600 +Subject: io_uring: don't save/restore iowait state + +From: Jens Axboe + +[ Upstream commit 6f0974eccbf78baead1735722c4f1ee3eb9422cd ] + +This kind of state is per-syscall, and since we're doing the waiting off +entering the io_uring_enter(2) syscall, there's no way that iowait can +already be set for this case. Simplify it by setting it if we need to, +and always clearing it to 0 when done. + +Fixes: 7b72d661f1f2 ("io_uring: gate iowait schedule on having pending requests") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index b658ba6703cc2..205dad9603733 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2508,7 +2508,7 @@ static bool current_pending_io(void) + static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx, + struct io_wait_queue *iowq) + { +- int io_wait, ret; ++ int ret; + + if (unlikely(READ_ONCE(ctx->check_cq))) + return 1; +@@ -2526,7 +2526,6 @@ static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx, + * can take into account that the task is waiting for IO - turns out + * to be important for low QD IO. + */ +- io_wait = current->in_iowait; + if (current_pending_io()) + current->in_iowait = 1; + ret = 0; +@@ -2534,7 +2533,7 @@ static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx, + schedule(); + else if (!schedule_hrtimeout(&iowq->timeout, HRTIMER_MODE_ABS)) + ret = -ETIME; +- current->in_iowait = io_wait; ++ current->in_iowait = 0; + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.7/io_uring-fix-poll_remove-stalled-req-completion.patch b/queue-6.7/io_uring-fix-poll_remove-stalled-req-completion.patch new file mode 100644 index 00000000000..9f126ddaf42 --- /dev/null +++ b/queue-6.7/io_uring-fix-poll_remove-stalled-req-completion.patch @@ -0,0 +1,48 @@ +From 2fd93ccd20a23678a717782a0b0dc3c794b81892 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 15:29:51 +0000 +Subject: io_uring: fix poll_remove stalled req completion + +From: Pavel Begunkov + +[ Upstream commit 5e3afe580a9f5ca173a6bd55ffe10948796ef7e5 ] + +Taking the ctx lock is not enough to use the deferred request completion +infrastructure, it'll get queued into the list but no one would expect +it there, so it will sit there until next io_submit_flush_completions(). +It's hard to care about the cancellation path, so complete it via tw. + +Fixes: ef7dfac51d8ed ("io_uring/poll: serialize poll linked timer start with poll removal") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/c446740bc16858f8a2a8dcdce899812f21d15f23.1710514702.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/poll.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/io_uring/poll.c b/io_uring/poll.c +index 7513afc7b702e..58b7556f621eb 100644 +--- a/io_uring/poll.c ++++ b/io_uring/poll.c +@@ -995,7 +995,6 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags) + struct io_hash_bucket *bucket; + struct io_kiocb *preq; + int ret2, ret = 0; +- struct io_tw_state ts = { .locked = true }; + + io_ring_submit_lock(ctx, issue_flags); + preq = io_poll_find(ctx, true, &cd, &ctx->cancel_table, &bucket); +@@ -1044,7 +1043,8 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags) + + req_set_fail(preq); + io_req_set_res(preq, -ECANCELED, 0); +- io_req_task_complete(preq, &ts); ++ preq->io_task_work.func = io_req_task_complete; ++ io_req_task_work_add(preq); + out: + io_ring_submit_unlock(ctx, issue_flags); + if (ret < 0) { +-- +2.43.0 + diff --git a/queue-6.7/io_uring-fix-release-of-pinned-pages-when-__io_uaddr.patch b/queue-6.7/io_uring-fix-release-of-pinned-pages-when-__io_uaddr.patch new file mode 100644 index 00000000000..73f0ba137b1 --- /dev/null +++ b/queue-6.7/io_uring-fix-release-of-pinned-pages-when-__io_uaddr.patch @@ -0,0 +1,88 @@ +From 222107f9c0975f5fd773f00db237ce30b752ba74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 17:39:12 -0400 +Subject: io_uring: Fix release of pinned pages when __io_uaddr_map fails + +From: Gabriel Krisman Bertazi + +[ Upstream commit 67d1189d1095d471ed7fa426c7e384a7140a5dd7 ] + +Looking at the error path of __io_uaddr_map, if we fail after pinning +the pages for any reasons, ret will be set to -EINVAL and the error +handler won't properly release the pinned pages. + +I didn't manage to trigger it without forcing a failure, but it can +happen in real life when memory is heavily fragmented. + +Signed-off-by: Gabriel Krisman Bertazi +Fixes: 223ef4743164 ("io_uring: don't allow IORING_SETUP_NO_MMAP rings on highmem pages") +Link: https://lore.kernel.org/r/20240313213912.1920-1-krisman@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index 205dad9603733..45d6e440bdc04 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2683,7 +2683,7 @@ static void *__io_uaddr_map(struct page ***pages, unsigned short *npages, + struct page **page_array; + unsigned int nr_pages; + void *page_addr; +- int ret, i; ++ int ret, i, pinned; + + *npages = 0; + +@@ -2697,12 +2697,12 @@ static void *__io_uaddr_map(struct page ***pages, unsigned short *npages, + if (!page_array) + return ERR_PTR(-ENOMEM); + +- ret = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM, +- page_array); +- if (ret != nr_pages) { +-err: +- io_pages_free(&page_array, ret > 0 ? ret : 0); +- return ret < 0 ? ERR_PTR(ret) : ERR_PTR(-EFAULT); ++ ++ pinned = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM, ++ page_array); ++ if (pinned != nr_pages) { ++ ret = (pinned < 0) ? pinned : -EFAULT; ++ goto free_pages; + } + + page_addr = page_address(page_array[0]); +@@ -2716,7 +2716,7 @@ static void *__io_uaddr_map(struct page ***pages, unsigned short *npages, + * didn't support this feature. + */ + if (PageHighMem(page_array[i])) +- goto err; ++ goto free_pages; + + /* + * No support for discontig pages for now, should either be a +@@ -2725,13 +2725,17 @@ static void *__io_uaddr_map(struct page ***pages, unsigned short *npages, + * just fail them with EINVAL. + */ + if (page_address(page_array[i]) != page_addr) +- goto err; ++ goto free_pages; + page_addr += PAGE_SIZE; + } + + *pages = page_array; + *npages = nr_pages; + return page_to_virt(page_array[0]); ++ ++free_pages: ++ io_pages_free(&page_array, pinned > 0 ? pinned : 0); ++ return ERR_PTR(ret); + } + + static void *io_rings_map(struct io_ring_ctx *ctx, unsigned long uaddr, +-- +2.43.0 + diff --git a/queue-6.7/ipv4-raw-fix-sending-packets-from-raw-sockets-via-ip.patch b/queue-6.7/ipv4-raw-fix-sending-packets-from-raw-sockets-via-ip.patch new file mode 100644 index 00000000000..3895d125d22 --- /dev/null +++ b/queue-6.7/ipv4-raw-fix-sending-packets-from-raw-sockets-via-ip.patch @@ -0,0 +1,44 @@ +From 4e5d56e502a75cefefe9f798172144383a8e73d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 15:35:40 +0100 +Subject: ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels + +From: Tobias Brunner + +[ Upstream commit c9b3b81716c5b92132a6c1d4ac3c48a7b44082ab ] + +Since the referenced commit, the xfrm_inner_extract_output() function +uses the protocol field to determine the address family. So not setting +it for IPv4 raw sockets meant that such packets couldn't be tunneled via +IPsec anymore. + +IPv6 raw sockets are not affected as they already set the protocol since +9c9c9ad5fae7 ("ipv6: set skb->protocol on tcp, raw and ip6_append_data +genereated skbs"). + +Fixes: f4796398f21b ("xfrm: Remove inner/outer modes from output path") +Signed-off-by: Tobias Brunner +Reviewed-by: David Ahern +Reviewed-by: Nicolas Dichtel +Link: https://lore.kernel.org/r/c5d9a947-eb19-4164-ac99-468ea814ce20@strongswan.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/raw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c +index aea89326c6979..288f1846b3518 100644 +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -350,6 +350,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4, + goto error; + skb_reserve(skb, hlen); + ++ skb->protocol = htons(ETH_P_IP); + skb->priority = READ_ONCE(sk->sk_priority); + skb->mark = sockc->mark; + skb->tstamp = sockc->transmit_time; +-- +2.43.0 + diff --git a/queue-6.7/kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch b/queue-6.7/kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch new file mode 100644 index 00000000000..571f9e360a1 --- /dev/null +++ b/queue-6.7/kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch @@ -0,0 +1,47 @@ +From a6d37ede2bc58d67248d1bb5b721ded73e106420 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Feb 2024 00:57:59 +0900 +Subject: kconfig: fix infinite loop when expanding a macro at the end of file + +From: Masahiro Yamada + +[ Upstream commit af8bbce92044dc58e4cc039ab94ee5d470a621f5 ] + +A macro placed at the end of a file with no newline causes an infinite +loop. + +[Test Kconfig] + $(info,hello) + \ No newline at end of file + +I realized that flex-provided input() returns 0 instead of EOF when it +reaches the end of a file. + +Fixes: 104daea149c4 ("kconfig: reference environment variables directly and remove 'option env='") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/lexer.l | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/scripts/kconfig/lexer.l b/scripts/kconfig/lexer.l +index cc386e4436834..2c2b3e6f248ca 100644 +--- a/scripts/kconfig/lexer.l ++++ b/scripts/kconfig/lexer.l +@@ -302,8 +302,11 @@ static char *expand_token(const char *in, size_t n) + new_string(); + append_string(in, n); + +- /* get the whole line because we do not know the end of token. */ +- while ((c = input()) != EOF) { ++ /* ++ * get the whole line because we do not know the end of token. ++ * input() returns 0 (not EOF!) when it reachs the end of file. ++ */ ++ while ((c = input()) != 0) { + if (c == '\n') { + unput(c); + break; +-- +2.43.0 + diff --git a/queue-6.7/net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch b/queue-6.7/net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch new file mode 100644 index 00000000000..ecfdb459c79 --- /dev/null +++ b/queue-6.7/net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch @@ -0,0 +1,89 @@ +From c9fb97a9d172dbd13226648eebccceaba2b57a4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 15:55:35 -0500 +Subject: net/bnx2x: Prevent access to a freed page in page_pool + +From: Thinh Tran + +[ Upstream commit d27e2da94a42655861ca4baea30c8cd65546f25d ] + +Fix race condition leading to system crash during EEH error handling + +During EEH error recovery, the bnx2x driver's transmit timeout logic +could cause a race condition when handling reset tasks. The +bnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(), +which ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload() +SGEs are freed using bnx2x_free_rx_sge_range(). However, this could +overlap with the EEH driver's attempt to reset the device using +bnx2x_io_slot_reset(), which also tries to free SGEs. This race +condition can result in system crashes due to accessing freed memory +locations in bnx2x_free_rx_sge() + +799 static inline void bnx2x_free_rx_sge(struct bnx2x *bp, +800 struct bnx2x_fastpath *fp, u16 index) +801 { +802 struct sw_rx_page *sw_buf = &fp->rx_page_ring[index]; +803 struct page *page = sw_buf->page; +.... +where sw_buf was set to NULL after the call to dma_unmap_page() +by the preceding thread. + + EEH: Beginning: 'slot_reset' + PCI 0011:01:00.0#10000: EEH: Invoking bnx2x->slot_reset() + bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing... + bnx2x 0011:01:00.0: enabling device (0140 -> 0142) + bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --> driver unload + Kernel attempted to read user page (0) - exploit attempt? (uid: 0) + BUG: Kernel NULL pointer dereference on read at 0x00000000 + Faulting instruction address: 0xc0080000025065fc + Oops: Kernel access of bad area, sig: 11 [#1] + ..... + Call Trace: + [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable) + [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0 + [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550 + [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60 + [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170 + [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0 + [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 + +To solve this issue, we need to verify page pool allocations before +freeing. + +Fixes: 4cace675d687 ("bnx2x: Alloc 4k fragment for each rx ring buffer element") +Signed-off-by: Thinh Tran +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20240315205535.1321-1-thinhtr@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +index d8b1824c334d3..0bc1367fd6492 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +@@ -1002,9 +1002,6 @@ static inline void bnx2x_set_fw_mac_addr(__le16 *fw_hi, __le16 *fw_mid, + static inline void bnx2x_free_rx_mem_pool(struct bnx2x *bp, + struct bnx2x_alloc_pool *pool) + { +- if (!pool->page) +- return; +- + put_page(pool->page); + + pool->page = NULL; +@@ -1015,6 +1012,9 @@ static inline void bnx2x_free_rx_sge_range(struct bnx2x *bp, + { + int i; + ++ if (!fp->page_pool.page) ++ return; ++ + if (fp->mode == TPA_MODE_DISABLED) + return; + +-- +2.43.0 + diff --git a/queue-6.7/net-dsa-mt7530-fix-handling-of-all-link-local-frames.patch b/queue-6.7/net-dsa-mt7530-fix-handling-of-all-link-local-frames.patch new file mode 100644 index 00000000000..2338a28a024 --- /dev/null +++ b/queue-6.7/net-dsa-mt7530-fix-handling-of-all-link-local-frames.patch @@ -0,0 +1,142 @@ +From 57cb0182de51caa8e70952f1b34fcb6df3b80820 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 12:33:42 +0300 +Subject: net: dsa: mt7530: fix handling of all link-local frames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 69ddba9d170bdaee1dc0eb4ced38d7e4bb7b92af ] + +Currently, the MT753X switches treat frames with :01-0D and :0F MAC DAs as +regular multicast frames, therefore flooding them to user ports. + +On page 205, section "8.6.3 Frame filtering" of the active standard, IEEE +Std 802.1Q™-2022, it is stated that frames with 01:80:C2:00:00:00-0F as MAC +DA must only be propagated to C-VLAN and MAC Bridge components. That means +VLAN-aware and VLAN-unaware bridges. On the switch designs with CPU ports, +these frames are supposed to be processed by the CPU (software). So we make +the switch only forward them to the CPU port. And if received from a CPU +port, forward to a single port. The software is responsible of making the +switch conform to the latter by setting a single port as destination port +on the special tag. + +This switch intellectual property cannot conform to this part of the +standard fully. Whilst the REV_UN frame tag covers the remaining :04-0D and +:0F MAC DAs, it also includes :22-FF which the scope of propagation is not +supposed to be restricted for these MAC DAs. + +Set frames with :01-03 MAC DAs to be trapped to the CPU port(s). Add a +comment for the remaining MAC DAs. + +Note that the ingress port must have a PVID assigned to it for the switch +to forward untagged frames. A PVID is set by default on VLAN-aware and +VLAN-unaware ports. However, when the network interface that pertains to +the ingress port is attached to a vlan_filtering enabled bridge, the user +can remove the PVID assignment from it which would prevent the link-local +frames from being trapped to the CPU port. I am yet to see a way to forward +link-local frames while preventing other untagged frames from being +forwarded too. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Signed-off-by: Arınç ÜNAL +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 37 +++++++++++++++++++++++++++++++++---- + drivers/net/dsa/mt7530.h | 13 +++++++++++++ + 2 files changed, 46 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index f5b2535307652..e6b8bf6035565 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -998,6 +998,21 @@ static void mt7530_setup_port5(struct dsa_switch *ds, phy_interface_t interface) + mutex_unlock(&priv->reg_mutex); + } + ++/* On page 205, section "8.6.3 Frame filtering" of the active standard, IEEE Std ++ * 802.1Q™-2022, it is stated that frames with 01:80:C2:00:00:00-0F as MAC DA ++ * must only be propagated to C-VLAN and MAC Bridge components. That means ++ * VLAN-aware and VLAN-unaware bridges. On the switch designs with CPU ports, ++ * these frames are supposed to be processed by the CPU (software). So we make ++ * the switch only forward them to the CPU port. And if received from a CPU ++ * port, forward to a single port. The software is responsible of making the ++ * switch conform to the latter by setting a single port as destination port on ++ * the special tag. ++ * ++ * This switch intellectual property cannot conform to this part of the standard ++ * fully. Whilst the REV_UN frame tag covers the remaining :04-0D and :0F MAC ++ * DAs, it also includes :22-FF which the scope of propagation is not supposed ++ * to be restricted for these MAC DAs. ++ */ + static void + mt753x_trap_frames(struct mt7530_priv *priv) + { +@@ -1012,13 +1027,27 @@ mt753x_trap_frames(struct mt7530_priv *priv) + MT753X_BPDU_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | + MT753X_BPDU_CPU_ONLY); + +- /* Trap LLDP frames with :0E MAC DA to the CPU port(s) and egress them +- * VLAN-untagged. ++ /* Trap frames with :01 and :02 MAC DAs to the CPU port(s) and egress ++ * them VLAN-untagged. ++ */ ++ mt7530_rmw(priv, MT753X_RGAC1, MT753X_R02_EG_TAG_MASK | ++ MT753X_R02_PORT_FW_MASK | MT753X_R01_EG_TAG_MASK | ++ MT753X_R01_PORT_FW_MASK, ++ MT753X_R02_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | ++ MT753X_R02_PORT_FW(MT753X_BPDU_CPU_ONLY) | ++ MT753X_R01_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | ++ MT753X_BPDU_CPU_ONLY); ++ ++ /* Trap frames with :03 and :0E MAC DAs to the CPU port(s) and egress ++ * them VLAN-untagged. + */ + mt7530_rmw(priv, MT753X_RGAC2, MT753X_R0E_EG_TAG_MASK | +- MT753X_R0E_PORT_FW_MASK, ++ MT753X_R0E_PORT_FW_MASK | MT753X_R03_EG_TAG_MASK | ++ MT753X_R03_PORT_FW_MASK, + MT753X_R0E_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | +- MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY)); ++ MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY) | ++ MT753X_R03_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | ++ MT753X_BPDU_CPU_ONLY); + } + + static int +diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h +index cef2af3f24d58..75bc9043c8c0a 100644 +--- a/drivers/net/dsa/mt7530.h ++++ b/drivers/net/dsa/mt7530.h +@@ -73,12 +73,25 @@ enum mt753x_id { + #define MT753X_BPDU_EG_TAG(x) FIELD_PREP(MT753X_BPDU_EG_TAG_MASK, x) + #define MT753X_BPDU_PORT_FW_MASK GENMASK(2, 0) + ++/* Register for :01 and :02 MAC DA frame control */ ++#define MT753X_RGAC1 0x28 ++#define MT753X_R02_EG_TAG_MASK GENMASK(24, 22) ++#define MT753X_R02_EG_TAG(x) FIELD_PREP(MT753X_R02_EG_TAG_MASK, x) ++#define MT753X_R02_PORT_FW_MASK GENMASK(18, 16) ++#define MT753X_R02_PORT_FW(x) FIELD_PREP(MT753X_R02_PORT_FW_MASK, x) ++#define MT753X_R01_EG_TAG_MASK GENMASK(8, 6) ++#define MT753X_R01_EG_TAG(x) FIELD_PREP(MT753X_R01_EG_TAG_MASK, x) ++#define MT753X_R01_PORT_FW_MASK GENMASK(2, 0) ++ + /* Register for :03 and :0E MAC DA frame control */ + #define MT753X_RGAC2 0x2c + #define MT753X_R0E_EG_TAG_MASK GENMASK(24, 22) + #define MT753X_R0E_EG_TAG(x) FIELD_PREP(MT753X_R0E_EG_TAG_MASK, x) + #define MT753X_R0E_PORT_FW_MASK GENMASK(18, 16) + #define MT753X_R0E_PORT_FW(x) FIELD_PREP(MT753X_R0E_PORT_FW_MASK, x) ++#define MT753X_R03_EG_TAG_MASK GENMASK(8, 6) ++#define MT753X_R03_EG_TAG(x) FIELD_PREP(MT753X_R03_EG_TAG_MASK, x) ++#define MT753X_R03_PORT_FW_MASK GENMASK(2, 0) + + enum mt753x_bpdu_port_fw { + MT753X_BPDU_FOLLOW_MFC, +-- +2.43.0 + diff --git a/queue-6.7/net-dsa-mt7530-fix-link-local-frames-that-ingress-vl.patch b/queue-6.7/net-dsa-mt7530-fix-link-local-frames-that-ingress-vl.patch new file mode 100644 index 00000000000..5d21f9d3e76 --- /dev/null +++ b/queue-6.7/net-dsa-mt7530-fix-link-local-frames-that-ingress-vl.patch @@ -0,0 +1,182 @@ +From f131a282d7a793d9d7631c879ee6271ba90854c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 12:33:41 +0300 +Subject: net: dsa: mt7530: fix link-local frames that ingress vlan filtering + ports +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit e8bf353577f382c7066c661fed41b2adc0fc7c40 ] + +Whether VLAN-aware or not, on every VID VLAN table entry that has the CPU +port as a member of it, frames are set to egress the CPU port with the VLAN +tag stacked. This is so that VLAN tags can be appended after hardware +special tag (called DSA tag in the context of Linux drivers). + +For user ports on a VLAN-unaware bridge, frame ingressing the user port +egresses CPU port with only the special tag. + +For user ports on a VLAN-aware bridge, frame ingressing the user port +egresses CPU port with the special tag and the VLAN tag. + +This causes issues with link-local frames, specifically BPDUs, because the +software expects to receive them VLAN-untagged. + +There are two options to make link-local frames egress untagged. Setting +CONSISTENT or UNTAGGED on the EG_TAG bits on the relevant register. +CONSISTENT means frames egress exactly as they ingress. That means +egressing with the VLAN tag they had at ingress or egressing untagged if +they ingressed untagged. Although link-local frames are not supposed to be +transmitted VLAN-tagged, if they are done so, when egressing through a CPU +port, the special tag field will be broken. + +BPDU egresses CPU port with VLAN tag egressing stacked, received on +software: + +00:01:25.104821 AF Unknown (382365846), length 106: + | STAG | | VLAN | + 0x0000: 0000 6c27 614d 4143 0001 0000 8100 0001 ..l'aMAC........ + 0x0010: 0026 4242 0300 0000 0000 0000 6c27 614d .&BB........l'aM + 0x0020: 4143 0000 0000 0000 6c27 614d 4143 0000 AC......l'aMAC.. + 0x0030: 0000 1400 0200 0f00 0000 0000 0000 0000 ................ + +BPDU egresses CPU port with VLAN tag egressing untagged, received on +software: + +00:23:56.628708 AF Unknown (25215488), length 64: + | STAG | + 0x0000: 0000 6c27 614d 4143 0001 0000 0026 4242 ..l'aMAC.....&BB + 0x0010: 0300 0000 0000 0000 6c27 614d 4143 0000 ........l'aMAC.. + 0x0020: 0000 0000 6c27 614d 4143 0000 0000 1400 ....l'aMAC...... + 0x0030: 0200 0f00 0000 0000 0000 0000 ............ + +BPDU egresses CPU port with VLAN tag egressing tagged, received on +software: + +00:01:34.311963 AF Unknown (25215488), length 64: + | Mess | + 0x0000: 0000 6c27 614d 4143 0001 0001 0026 4242 ..l'aMAC.....&BB + 0x0010: 0300 0000 0000 0000 6c27 614d 4143 0000 ........l'aMAC.. + 0x0020: 0000 0000 6c27 614d 4143 0000 0000 1400 ....l'aMAC...... + 0x0030: 0200 0f00 0000 0000 0000 0000 ............ + +To prevent confusing the software, force the frame to egress UNTAGGED +instead of CONSISTENT. This way, frames can't possibly be received TAGGED +by software which would have the special tag field broken. + +VLAN Tag Egress Procedure + + For all frames, one of these options set the earliest in this order will + apply to the frame: + + - EG_TAG in certain registers for certain frames. + This will apply to frame with matching MAC DA or EtherType. + + - EG_TAG in the address table. + This will apply to frame at its incoming port. + + - EG_TAG in the PVC register. + This will apply to frame at its incoming port. + + - EG_CON and [EG_TAG per port] in the VLAN table. + This will apply to frame at its outgoing port. + + - EG_TAG in the PCR register. + This will apply to frame at its outgoing port. + + EG_TAG in certain registers for certain frames: + + PPPoE Discovery_ARP/RARP: PPP_EG_TAG and ARP_EG_TAG in the APC register. + IGMP_MLD: IGMP_EG_TAG and MLD_EG_TAG in the IMC register. + BPDU and PAE: BPDU_EG_TAG and PAE_EG_TAG in the BPC register. + REV_01 and REV_02: R01_EG_TAG and R02_EG_TAG in the RGAC1 register. + REV_03 and REV_0E: R03_EG_TAG and R0E_EG_TAG in the RGAC2 register. + REV_10 and REV_20: R10_EG_TAG and R20_EG_TAG in the RGAC3 register. + REV_21 and REV_UN: R21_EG_TAG and RUN_EG_TAG in the RGAC4 register. + +With this change, it can be observed that a bridge interface with stp_state +and vlan_filtering enabled will properly block ports now. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Signed-off-by: Arınç ÜNAL +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 23 +++++++++++++++-------- + drivers/net/dsa/mt7530.h | 9 ++++++++- + 2 files changed, 23 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 940ca59585568..f5b2535307652 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -1001,16 +1001,23 @@ static void mt7530_setup_port5(struct dsa_switch *ds, phy_interface_t interface) + static void + mt753x_trap_frames(struct mt7530_priv *priv) + { +- /* Trap BPDUs to the CPU port(s) */ +- mt7530_rmw(priv, MT753X_BPC, MT753X_BPDU_PORT_FW_MASK, ++ /* Trap 802.1X PAE frames and BPDUs to the CPU port(s) and egress them ++ * VLAN-untagged. ++ */ ++ mt7530_rmw(priv, MT753X_BPC, MT753X_PAE_EG_TAG_MASK | ++ MT753X_PAE_PORT_FW_MASK | MT753X_BPDU_EG_TAG_MASK | ++ MT753X_BPDU_PORT_FW_MASK, ++ MT753X_PAE_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | ++ MT753X_PAE_PORT_FW(MT753X_BPDU_CPU_ONLY) | ++ MT753X_BPDU_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | + MT753X_BPDU_CPU_ONLY); + +- /* Trap 802.1X PAE frames to the CPU port(s) */ +- mt7530_rmw(priv, MT753X_BPC, MT753X_PAE_PORT_FW_MASK, +- MT753X_PAE_PORT_FW(MT753X_BPDU_CPU_ONLY)); +- +- /* Trap LLDP frames with :0E MAC DA to the CPU port(s) */ +- mt7530_rmw(priv, MT753X_RGAC2, MT753X_R0E_PORT_FW_MASK, ++ /* Trap LLDP frames with :0E MAC DA to the CPU port(s) and egress them ++ * VLAN-untagged. ++ */ ++ mt7530_rmw(priv, MT753X_RGAC2, MT753X_R0E_EG_TAG_MASK | ++ MT753X_R0E_PORT_FW_MASK, ++ MT753X_R0E_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | + MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY)); + } + +diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h +index 17e42d30fff4b..cef2af3f24d58 100644 +--- a/drivers/net/dsa/mt7530.h ++++ b/drivers/net/dsa/mt7530.h +@@ -65,12 +65,18 @@ enum mt753x_id { + + /* Registers for BPDU and PAE frame control*/ + #define MT753X_BPC 0x24 +-#define MT753X_BPDU_PORT_FW_MASK GENMASK(2, 0) ++#define MT753X_PAE_EG_TAG_MASK GENMASK(24, 22) ++#define MT753X_PAE_EG_TAG(x) FIELD_PREP(MT753X_PAE_EG_TAG_MASK, x) + #define MT753X_PAE_PORT_FW_MASK GENMASK(18, 16) + #define MT753X_PAE_PORT_FW(x) FIELD_PREP(MT753X_PAE_PORT_FW_MASK, x) ++#define MT753X_BPDU_EG_TAG_MASK GENMASK(8, 6) ++#define MT753X_BPDU_EG_TAG(x) FIELD_PREP(MT753X_BPDU_EG_TAG_MASK, x) ++#define MT753X_BPDU_PORT_FW_MASK GENMASK(2, 0) + + /* Register for :03 and :0E MAC DA frame control */ + #define MT753X_RGAC2 0x2c ++#define MT753X_R0E_EG_TAG_MASK GENMASK(24, 22) ++#define MT753X_R0E_EG_TAG(x) FIELD_PREP(MT753X_R0E_EG_TAG_MASK, x) + #define MT753X_R0E_PORT_FW_MASK GENMASK(18, 16) + #define MT753X_R0E_PORT_FW(x) FIELD_PREP(MT753X_R0E_PORT_FW_MASK, x) + +@@ -253,6 +259,7 @@ enum mt7530_port_mode { + enum mt7530_vlan_port_eg_tag { + MT7530_VLAN_EG_DISABLED = 0, + MT7530_VLAN_EG_CONSISTENT = 1, ++ MT7530_VLAN_EG_UNTAGGED = 4, + }; + + enum mt7530_vlan_port_attr { +-- +2.43.0 + diff --git a/queue-6.7/net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch b/queue-6.7/net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch new file mode 100644 index 00000000000..5be8e28002a --- /dev/null +++ b/queue-6.7/net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch @@ -0,0 +1,178 @@ +From 0c959b205893fd5b95adf986ed9749db1e869ba7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 12:28:35 +0300 +Subject: net: dsa: mt7530: prevent possible incorrect XTAL frequency selection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit f490c492e946d8ffbe65ad4efc66de3c5ede30a4 ] + +On MT7530, the HT_XTAL_FSEL field of the HWTRAP register stores a 2-bit +value that represents the frequency of the crystal oscillator connected to +the switch IC. The field is populated by the state of the ESW_P4_LED_0 and +ESW_P4_LED_0 pins, which is done right after reset is deasserted. + + ESW_P4_LED_0 ESW_P3_LED_0 Frequency + ----------------------------------------- + 0 0 Reserved + 0 1 20MHz + 1 0 40MHz + 1 1 25MHz + +On MT7531, the XTAL25 bit of the STRAP register stores this. The LAN0LED0 +pin is used to populate the bit. 25MHz when the pin is high, 40MHz when +it's low. + +These pins are also used with LEDs, therefore, their state can be set to +something other than the bootstrapping configuration. For example, a link +may be established on port 3 before the DSA subdriver takes control of the +switch which would set ESW_P3_LED_0 to high. + +Currently on mt7530_setup() and mt7531_setup(), 1000 - 1100 usec delay is +described between reset assertion and deassertion. Some switch ICs in real +life conditions cannot always have these pins set back to the bootstrapping +configuration before reset deassertion in this amount of delay. This causes +wrong crystal frequency to be selected which puts the switch in a +nonfunctional state after reset deassertion. + +The tests below are conducted on an MT7530 with a 40MHz crystal oscillator +by Justin Swartz. + +With a cable from an active peer connected to port 3 before reset, an +incorrect crystal frequency (0b11 = 25MHz) is selected: + + [1] [3] [5] + : : : + _____________________________ __________________ +ESW_P4_LED_0 |_______| + _____________________________ +ESW_P3_LED_0 |__________________________ + + : : : : + : : [4]...: + : : + [2]................: + +[1] Reset is asserted. +[2] Period of 1000 - 1100 usec. +[3] Reset is deasserted. +[4] Period of 315 usec. HWTRAP register is populated with incorrect + XTAL frequency. +[5] Signals reflect the bootstrapped configuration. + +Increase the delay between reset_control_assert() and +reset_control_deassert(), and gpiod_set_value_cansleep(priv->reset, 0) and +gpiod_set_value_cansleep(priv->reset, 1) to 5000 - 5100 usec. This amount +ensures a higher possibility that the switch IC will have these pins back +to the bootstrapping configuration before reset deassertion. + +With a cable from an active peer connected to port 3 before reset, the +correct crystal frequency (0b10 = 40MHz) is selected: + + [1] [2-1] [3] [5] + : : : : + _____________________________ __________________ +ESW_P4_LED_0 |_______| + ___________________ _______ +ESW_P3_LED_0 |_________| |__________________ + + : : : : : + : [2-2]...: [4]...: + [2]................: + +[1] Reset is asserted. +[2] Period of 5000 - 5100 usec. +[2-1] ESW_P3_LED_0 goes low. +[2-2] Remaining period of 5000 - 5100 usec. +[3] Reset is deasserted. +[4] Period of 310 usec. HWTRAP register is populated with bootstrapped + XTAL frequency. +[5] Signals reflect the bootstrapped configuration. + +ESW_P3_LED_0 low period before reset deassertion: + + 5000 usec + - 5100 usec + TEST RESET HOLD + # (usec) + --------------------- + 1 5410 + 2 5440 + 3 4375 + 4 5490 + 5 5475 + 6 4335 + 7 4370 + 8 5435 + 9 4205 + 10 4335 + 11 3750 + 12 3170 + 13 4395 + 14 4375 + 15 3515 + 16 4335 + 17 4220 + 18 4175 + 19 4175 + 20 4350 + + Min 3170 + Max 5490 + + Median 4342.500 + Avg 4466.500 + +Revert commit 2920dd92b980 ("net: dsa: mt7530: disable LEDs before reset"). +Changing the state of pins via reset assertion is simpler and more +efficient than doing so by setting the LED controller off. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Fixes: c288575f7810 ("net: dsa: mt7530: Add the support of MT7531 switch") +Co-developed-by: Justin Swartz +Signed-off-by: Justin Swartz +Signed-off-by: Arınç ÜNAL +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 2333f6383b542..940ca59585568 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -2243,11 +2243,11 @@ mt7530_setup(struct dsa_switch *ds) + */ + if (priv->mcm) { + reset_control_assert(priv->rstc); +- usleep_range(1000, 1100); ++ usleep_range(5000, 5100); + reset_control_deassert(priv->rstc); + } else { + gpiod_set_value_cansleep(priv->reset, 0); +- usleep_range(1000, 1100); ++ usleep_range(5000, 5100); + gpiod_set_value_cansleep(priv->reset, 1); + } + +@@ -2449,11 +2449,11 @@ mt7531_setup(struct dsa_switch *ds) + */ + if (priv->mcm) { + reset_control_assert(priv->rstc); +- usleep_range(1000, 1100); ++ usleep_range(5000, 5100); + reset_control_deassert(priv->rstc); + } else { + gpiod_set_value_cansleep(priv->reset, 0); +- usleep_range(1000, 1100); ++ usleep_range(5000, 5100); + gpiod_set_value_cansleep(priv->reset, 1); + } + +-- +2.43.0 + diff --git a/queue-6.7/net-ethernet-mtk_eth_soc-fix-ppe-hanging-issue.patch b/queue-6.7/net-ethernet-mtk_eth_soc-fix-ppe-hanging-issue.patch new file mode 100644 index 00000000000..e60d7cd5234 --- /dev/null +++ b/queue-6.7/net-ethernet-mtk_eth_soc-fix-ppe-hanging-issue.patch @@ -0,0 +1,70 @@ +From e8a222f5317c66db7faeee611292550b8ddce31e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 22:50:40 +0000 +Subject: net: ethernet: mtk_eth_soc: fix PPE hanging issue + +From: Daniel Golle + +[ Upstream commit ea80e3ed09ab2c2b75724faf5484721753e92c31 ] + +A patch to resolve an issue was found in MediaTek's GPL-licensed SDK: +In the mtk_ppe_stop() function, the PPE scan mode is not disabled before +disabling the PPE. This can potentially lead to a hang during the process +of disabling the PPE. + +Without this patch, the PPE may experience a hang during the reboot test. + +Link: https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/b40da332dfe763932a82f9f62a4709457a15dd6c +Fixes: ba37b7caf1ed ("net: ethernet: mtk_eth_soc: add support for initializing the PPE") +Suggested-by: Bc-bocun Chen +Signed-off-by: Daniel Golle +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_ppe.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c +index b2a5d9c3733d4..6ce0db3a1a920 100644 +--- a/drivers/net/ethernet/mediatek/mtk_ppe.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c +@@ -994,7 +994,7 @@ void mtk_ppe_start(struct mtk_ppe *ppe) + MTK_PPE_KEEPALIVE_DISABLE) | + FIELD_PREP(MTK_PPE_TB_CFG_HASH_MODE, 1) | + FIELD_PREP(MTK_PPE_TB_CFG_SCAN_MODE, +- MTK_PPE_SCAN_MODE_KEEPALIVE_AGE) | ++ MTK_PPE_SCAN_MODE_CHECK_AGE) | + FIELD_PREP(MTK_PPE_TB_CFG_ENTRY_NUM, + MTK_PPE_ENTRIES_SHIFT); + if (mtk_is_netsys_v2_or_greater(ppe->eth)) +@@ -1090,17 +1090,21 @@ int mtk_ppe_stop(struct mtk_ppe *ppe) + + mtk_ppe_cache_enable(ppe, false); + +- /* disable offload engine */ +- ppe_clear(ppe, MTK_PPE_GLO_CFG, MTK_PPE_GLO_CFG_EN); +- ppe_w32(ppe, MTK_PPE_FLOW_CFG, 0); +- + /* disable aging */ + val = MTK_PPE_TB_CFG_AGE_NON_L4 | + MTK_PPE_TB_CFG_AGE_UNBIND | + MTK_PPE_TB_CFG_AGE_TCP | + MTK_PPE_TB_CFG_AGE_UDP | +- MTK_PPE_TB_CFG_AGE_TCP_FIN; ++ MTK_PPE_TB_CFG_AGE_TCP_FIN | ++ MTK_PPE_TB_CFG_SCAN_MODE; + ppe_clear(ppe, MTK_PPE_TB_CFG, val); + +- return mtk_ppe_wait_busy(ppe); ++ if (mtk_ppe_wait_busy(ppe)) ++ return -ETIMEDOUT; ++ ++ /* disable offload engine */ ++ ppe_clear(ppe, MTK_PPE_GLO_CFG, MTK_PPE_GLO_CFG_EN); ++ ppe_w32(ppe, MTK_PPE_FLOW_CFG, 0); ++ ++ return 0; + } +-- +2.43.0 + diff --git a/queue-6.7/net-mediatek-mtk_eth_soc-clear-mac_mcr_force_link-on.patch b/queue-6.7/net-mediatek-mtk_eth_soc-clear-mac_mcr_force_link-on.patch new file mode 100644 index 00000000000..a3e5c9552f9 --- /dev/null +++ b/queue-6.7/net-mediatek-mtk_eth_soc-clear-mac_mcr_force_link-on.patch @@ -0,0 +1,60 @@ +From 3906b8be14f41e5a0c82b0bdbadd73a7e9070d5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 22:50:18 +0000 +Subject: net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is + up + +From: Daniel Golle + +[ Upstream commit f1b85ef15a99f06ed48871ce933d591127d2dcc0 ] + +Clearing bit MAC_MCR_FORCE_LINK which forces the link down too early +can result in MAC ending up in a broken/blocked state. + +Fix this by handling this bit in the .mac_link_up and .mac_link_down +calls instead of in .mac_finish. + +Fixes: b8fc9f30821e ("net: ethernet: mediatek: Add basic PHYLINK support") +Suggested-by: Mason-cw Chang +Signed-off-by: Daniel Golle +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index d2c039f830195..a1231203ecf3d 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -677,8 +677,7 @@ static int mtk_mac_finish(struct phylink_config *config, unsigned int mode, + mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id)); + mcr_new = mcr_cur; + mcr_new |= MAC_MCR_IPG_CFG | MAC_MCR_FORCE_MODE | +- MAC_MCR_BACKOFF_EN | MAC_MCR_BACKPR_EN | MAC_MCR_FORCE_LINK | +- MAC_MCR_RX_FIFO_CLR_DIS; ++ MAC_MCR_BACKOFF_EN | MAC_MCR_BACKPR_EN | MAC_MCR_RX_FIFO_CLR_DIS; + + /* Only update control register when needed! */ + if (mcr_new != mcr_cur) +@@ -694,7 +693,7 @@ static void mtk_mac_link_down(struct phylink_config *config, unsigned int mode, + phylink_config); + u32 mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id)); + +- mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN); ++ mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN | MAC_MCR_FORCE_LINK); + mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id)); + } + +@@ -803,7 +802,7 @@ static void mtk_mac_link_up(struct phylink_config *config, + if (rx_pause) + mcr |= MAC_MCR_FORCE_RX_FC; + +- mcr |= MAC_MCR_TX_EN | MAC_MCR_RX_EN; ++ mcr |= MAC_MCR_TX_EN | MAC_MCR_RX_EN | MAC_MCR_FORCE_LINK; + mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id)); + } + +-- +2.43.0 + diff --git a/queue-6.7/net-phy-fix-phy_read_poll_timeout-argument-type-in-g.patch b/queue-6.7/net-phy-fix-phy_read_poll_timeout-argument-type-in-g.patch new file mode 100644 index 00000000000..fccee5932e1 --- /dev/null +++ b/queue-6.7/net-phy-fix-phy_read_poll_timeout-argument-type-in-g.patch @@ -0,0 +1,53 @@ +From 9510040d319c9175baf190184a6102769a1de6cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 20:50:52 +0300 +Subject: net: phy: fix phy_read_poll_timeout argument type in genphy_loopback + +From: Nikita Kiryushin + +[ Upstream commit 32fa4366cc4da1c97b725a0066adf43c6b298f37 ] + +read_poll_timeout inside phy_read_poll_timeout can set val negative +in some cases (for example, __mdiobus_read inside phy_read can return +-EOPNOTSUPP). + +Supposedly, commit 4ec732951702 ("net: phylib: fix phy_read*_poll_timeout()") +should fix problems with wrong-signed vals, but I do not see how +as val is sent to phy_read as is and __val = phy_read (not val) +is checked for sign. + +Change val type for signed to allow better error handling as done in other +phy_read_poll_timeout callers. This will not fix any error handling +by itself, but allows, for example, to modify cond with appropriate +sign check or check resulting val separately. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 014068dcb5b1 ("net: phy: genphy_loopback: add link speed configuration") +Signed-off-by: Nikita Kiryushin +Reviewed-by: Russell King (Oracle) +Link: https://lore.kernel.org/r/20240315175052.8049-1-kiryushin@ancud.ru +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_device.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index bbc459f97b7b0..813b753e21dec 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -2701,8 +2701,8 @@ EXPORT_SYMBOL(genphy_resume); + int genphy_loopback(struct phy_device *phydev, bool enable) + { + if (enable) { +- u16 val, ctl = BMCR_LOOPBACK; +- int ret; ++ u16 ctl = BMCR_LOOPBACK; ++ int ret, val; + + ctl |= mii_bmcr_encode_fixed(phydev->speed, phydev->duplex); + +-- +2.43.0 + diff --git a/queue-6.7/net-report-rcu-qs-on-threaded-napi-repolling.patch b/queue-6.7/net-report-rcu-qs-on-threaded-napi-repolling.patch new file mode 100644 index 00000000000..ad62377b653 --- /dev/null +++ b/queue-6.7/net-report-rcu-qs-on-threaded-napi-repolling.patch @@ -0,0 +1,87 @@ +From ed5a5c028d40b5288344859e4b5faebf35f396a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 13:44:37 -0700 +Subject: net: report RCU QS on threaded NAPI repolling + +From: Yan Zhai + +[ Upstream commit d6dbbb11247c71203785a2c9da474c36f4b19eae ] + +NAPI threads can keep polling packets under load. Currently it is only +calling cond_resched() before repolling, but it is not sufficient to +clear out the holdout of RCU tasks, which prevent BPF tracing programs +from detaching for long period. This can be reproduced easily with +following set up: + +ip netns add test1 +ip netns add test2 + +ip -n test1 link add veth1 type veth peer name veth2 netns test2 + +ip -n test1 link set veth1 up +ip -n test1 link set lo up +ip -n test2 link set veth2 up +ip -n test2 link set lo up + +ip -n test1 addr add 192.168.1.2/31 dev veth1 +ip -n test1 addr add 1.1.1.1/32 dev lo +ip -n test2 addr add 192.168.1.3/31 dev veth2 +ip -n test2 addr add 2.2.2.2/31 dev lo + +ip -n test1 route add default via 192.168.1.3 +ip -n test2 route add default via 192.168.1.2 + +for i in `seq 10 210`; do + for j in `seq 10 210`; do + ip netns exec test2 iptables -I INPUT -s 3.3.$i.$j -p udp --dport 5201 + done +done + +ip netns exec test2 ethtool -K veth2 gro on +ip netns exec test2 bash -c 'echo 1 > /sys/class/net/veth2/threaded' +ip netns exec test1 ethtool -K veth1 tso off + +Then run an iperf3 client/server and a bpftrace script can trigger it: + +ip netns exec test2 iperf3 -s -B 2.2.2.2 >/dev/null& +ip netns exec test1 iperf3 -c 2.2.2.2 -B 1.1.1.1 -u -l 1500 -b 3g -t 100 >/dev/null& +bpftrace -e 'kfunc:__napi_poll{@=count();} interval:s:1{exit();}' + +Report RCU quiescent states periodically will resolve the issue. + +Fixes: 29863d41bb6e ("net: implement threaded-able napi poll loop support") +Reviewed-by: Jesper Dangaard Brouer +Signed-off-by: Yan Zhai +Acked-by: Paul E. McKenney +Acked-by: Jesper Dangaard Brouer +Link: https://lore.kernel.org/r/4c3b0d3f32d3b18949d75b18e5e1d9f13a24f025.1710877680.git.yan@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/dev.c b/net/core/dev.c +index ae898594690f7..e3c06ccf21d03 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -6668,6 +6668,8 @@ static int napi_threaded_poll(void *data) + void *have; + + while (!napi_thread_wait(napi)) { ++ unsigned long last_qs = jiffies; ++ + for (;;) { + bool repoll = false; + +@@ -6692,6 +6694,7 @@ static int napi_threaded_poll(void *data) + if (!repoll) + break; + ++ rcu_softirq_qs_periodic(last_qs); + cond_resched(); + } + } +-- +2.43.0 + diff --git a/queue-6.7/net-sched-taprio-proper-tca_taprio_tc_entry_index-ch.patch b/queue-6.7/net-sched-taprio-proper-tca_taprio_tc_entry_index-ch.patch new file mode 100644 index 00000000000..b2261092a55 --- /dev/null +++ b/queue-6.7/net-sched-taprio-proper-tca_taprio_tc_entry_index-ch.patch @@ -0,0 +1,87 @@ +From 6142372e2c12b482092d9b1b94388ce55cd84e8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 20:46:28 +0000 +Subject: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check + +From: Eric Dumazet + +[ Upstream commit 343041b59b7810f9cdca371f445dd43b35c740b1 ] + +taprio_parse_tc_entry() is not correctly checking +TCA_TAPRIO_TC_ENTRY_INDEX attribute: + + int tc; // Signed value + + tc = nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]); + if (tc >= TC_QOPT_MAX_QUEUE) { + NL_SET_ERR_MSG_MOD(extack, "TC entry index out of range"); + return -ERANGE; + } + +syzbot reported that it could fed arbitary negative values: + +UBSAN: shift-out-of-bounds in net/sched/sch_taprio.c:1722:18 +shift exponent -2147418108 is negative +CPU: 0 PID: 5066 Comm: syz-executor367 Not tainted 6.8.0-rc7-syzkaller-00136-gc8a5c731fd12 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 + ubsan_epilogue lib/ubsan.c:217 [inline] + __ubsan_handle_shift_out_of_bounds+0x3c7/0x420 lib/ubsan.c:386 + taprio_parse_tc_entry net/sched/sch_taprio.c:1722 [inline] + taprio_parse_tc_entries net/sched/sch_taprio.c:1768 [inline] + taprio_change+0xb87/0x57d0 net/sched/sch_taprio.c:1877 + taprio_init+0x9da/0xc80 net/sched/sch_taprio.c:2134 + qdisc_create+0x9d4/0x1190 net/sched/sch_api.c:1355 + tc_modify_qdisc+0xa26/0x1e40 net/sched/sch_api.c:1776 + rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6617 + netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 + netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] + netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 + netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x221/0x270 net/socket.c:745 + ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 + ___sys_sendmsg net/socket.c:2638 [inline] + __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 + do_syscall_64+0xf9/0x240 + entry_SYSCALL_64_after_hwframe+0x6f/0x77 +RIP: 0033:0x7f1b2dea3759 +Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffd4de452f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 00007f1b2def0390 RCX: 00007f1b2dea3759 +RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004 +RBP: 0000000000000003 R08: 0000555500000000 R09: 0000555500000000 +R10: 0000555500000000 R11: 0000000000000246 R12: 00007ffd4de45340 +R13: 00007ffd4de45310 R14: 0000000000000001 R15: 00007ffd4de45340 + +Fixes: a54fc09e4cba ("net/sched: taprio: allow user input of per-tc max SDU") +Reported-and-tested-by: syzbot+a340daa06412d6028918@syzkaller.appspotmail.com +Signed-off-by: Eric Dumazet +Cc: Vladimir Oltean +Reviewed-by: Michal Kubiak +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_taprio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index 31a8252bd09c9..ad99409c6325e 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1008,7 +1008,8 @@ static const struct nla_policy entry_policy[TCA_TAPRIO_SCHED_ENTRY_MAX + 1] = { + }; + + static const struct nla_policy taprio_tc_policy[TCA_TAPRIO_TC_ENTRY_MAX + 1] = { +- [TCA_TAPRIO_TC_ENTRY_INDEX] = { .type = NLA_U32 }, ++ [TCA_TAPRIO_TC_ENTRY_INDEX] = NLA_POLICY_MAX(NLA_U32, ++ TC_QOPT_MAX_QUEUE), + [TCA_TAPRIO_TC_ENTRY_MAX_SDU] = { .type = NLA_U32 }, + [TCA_TAPRIO_TC_ENTRY_FP] = NLA_POLICY_RANGE(NLA_U32, + TC_FP_EXPRESS, +-- +2.43.0 + diff --git a/queue-6.7/net-txgbe-fix-clk_name-exceed-max_dev_id-limits.patch b/queue-6.7/net-txgbe-fix-clk_name-exceed-max_dev_id-limits.patch new file mode 100644 index 00000000000..9e5eca3edcb --- /dev/null +++ b/queue-6.7/net-txgbe-fix-clk_name-exceed-max_dev_id-limits.patch @@ -0,0 +1,41 @@ +From a8b3a36b2456e2478d5c4193b99c808ae208706c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 16:06:34 +0800 +Subject: net: txgbe: fix clk_name exceed MAX_DEV_ID limits + +From: Duanqiang Wen + +[ Upstream commit e30cef001da259e8df354b813015d0e5acc08740 ] + +txgbe register clk which name is i2c_designware.pci_dev_id(), +clk_name will be stored in clk_lookup_alloc. If PCIe bus number +is larger than 0x39, clk_name size will be larger than 20 bytes. +It exceeds clk_lookup_alloc MAX_DEV_ID limits. So the driver +shortened clk_name. + +Fixes: b63f20485e43 ("net: txgbe: Register fixed rate clock") +Signed-off-by: Duanqiang Wen +Reviewed-by: Michal Kubiak +Link: https://lore.kernel.org/r/20240313080634.459523-1-duanqiangwen@net-swift.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +index b6c06adb86560..b95187a0847f7 100644 +--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c ++++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +@@ -551,7 +551,7 @@ static int txgbe_clock_register(struct txgbe *txgbe) + char clk_name[32]; + struct clk *clk; + +- snprintf(clk_name, sizeof(clk_name), "i2c_designware.%d", ++ snprintf(clk_name, sizeof(clk_name), "i2c_dw.%d", + pci_dev_id(pdev)); + + clk = clk_register_fixed_rate(NULL, clk_name, NULL, 0, 156250000); +-- +2.43.0 + diff --git a/queue-6.7/net-veth-do-not-manipulate-gro-when-using-xdp.patch b/queue-6.7/net-veth-do-not-manipulate-gro-when-using-xdp.patch new file mode 100644 index 00000000000..4750f3e661b --- /dev/null +++ b/queue-6.7/net-veth-do-not-manipulate-gro-when-using-xdp.patch @@ -0,0 +1,85 @@ +From 5f4aefe233b6b2553fab7dfdfd441c026a04377a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 19:37:58 +0100 +Subject: net: veth: do not manipulate GRO when using XDP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ignat Korchagin + +[ Upstream commit d7db7775ea2e31502d46427f5efd385afc4ff1eb ] + +Commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP") tried to fix +the fact that GRO was not possible without XDP, because veth did not use NAPI +without XDP. However, it also introduced the behaviour that GRO is always +enabled, when XDP is enabled. + +While it might be desired for most cases, it is confusing for the user at best +as the GRO flag suddenly changes, when an XDP program is attached. It also +introduces some complexities in state management as was partially addressed in +commit fe9f801355f0 ("net: veth: clear GRO when clearing XDP even when down"). + +But the biggest problem is that it is not possible to disable GRO at all, when +an XDP program is attached, which might be needed for some use cases. + +Fix this by not touching the GRO flag on XDP enable/disable as the code already +supports switching to NAPI if either GRO or XDP is requested. + +Link: https://lore.kernel.org/lkml/20240311124015.38106-1-ignat@cloudflare.com/ +Fixes: d3256efd8e8b ("veth: allow enabling NAPI even without XDP") +Fixes: fe9f801355f0 ("net: veth: clear GRO when clearing XDP even when down") +Signed-off-by: Ignat Korchagin +Reviewed-by: Toke Høiland-Jørgensen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/veth.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index a2e80278eb2f9..2f3fd287378fd 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -1533,8 +1533,6 @@ static netdev_features_t veth_fix_features(struct net_device *dev, + if (peer_priv->_xdp_prog) + features &= ~NETIF_F_GSO_SOFTWARE; + } +- if (priv->_xdp_prog) +- features |= NETIF_F_GRO; + + return features; + } +@@ -1638,14 +1636,6 @@ static int veth_xdp_set(struct net_device *dev, struct bpf_prog *prog, + } + + if (!old_prog) { +- if (!veth_gro_requested(dev)) { +- /* user-space did not require GRO, but adding +- * XDP is supposed to get GRO working +- */ +- dev->features |= NETIF_F_GRO; +- netdev_features_change(dev); +- } +- + peer->hw_features &= ~NETIF_F_GSO_SOFTWARE; + peer->max_mtu = max_mtu; + } +@@ -1661,14 +1651,6 @@ static int veth_xdp_set(struct net_device *dev, struct bpf_prog *prog, + if (dev->flags & IFF_UP) + veth_disable_xdp(dev); + +- /* if user-space did not require GRO, since adding XDP +- * enabled it, clear it now +- */ +- if (!veth_gro_requested(dev)) { +- dev->features &= ~NETIF_F_GRO; +- netdev_features_change(dev); +- } +- + if (peer) { + peer->hw_features |= NETIF_F_GSO_SOFTWARE; + peer->max_mtu = ETH_MAX_MTU; +-- +2.43.0 + diff --git a/queue-6.7/netfilter-nf_tables-do-not-compare-internal-table-fl.patch b/queue-6.7/netfilter-nf_tables-do-not-compare-internal-table-fl.patch new file mode 100644 index 00000000000..bbc90f9d3dc --- /dev/null +++ b/queue-6.7/netfilter-nf_tables-do-not-compare-internal-table-fl.patch @@ -0,0 +1,34 @@ +From 7185fcac142a2b1e55bd01429621e311c5b5ae28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 18:51:38 +0100 +Subject: netfilter: nf_tables: do not compare internal table flags on updates + +From: Pablo Neira Ayuso + +[ Upstream commit 4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139 ] + +Restore skipping transaction if table update does not modify flags. + +Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 79e088e6f103e..85d9e1394330c 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1211,7 +1211,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) + if (flags & ~NFT_TABLE_F_MASK) + return -EOPNOTSUPP; + +- if (flags == ctx->table->flags) ++ if (flags == (ctx->table->flags & NFT_TABLE_F_MASK)) + return 0; + + if ((nft_table_has_owner(ctx->table) && +-- +2.43.0 + diff --git a/queue-6.7/netfilter-nf_tables-fix-a-memory-leak-in-nf_tables_u.patch b/queue-6.7/netfilter-nf_tables-fix-a-memory-leak-in-nf_tables_u.patch new file mode 100644 index 00000000000..94a6e0deae6 --- /dev/null +++ b/queue-6.7/netfilter-nf_tables-fix-a-memory-leak-in-nf_tables_u.patch @@ -0,0 +1,71 @@ +From 1bdbe5896a4f224847d9b732cf8ce2b4f94654f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 01:24:02 +0800 +Subject: netfilter: nf_tables: Fix a memory leak in nf_tables_updchain + +From: Quan Tian + +[ Upstream commit 7eaf837a4eb5f74561e2486972e7f5184b613f6e ] + +If nft_netdev_register_hooks() fails, the memory associated with +nft_stats is not freed, causing a memory leak. + +This patch fixes it by moving nft_stats_alloc() down after +nft_netdev_register_hooks() succeeds. + +Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") +Signed-off-by: Quan Tian +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 85d9e1394330c..0130c2782cdc7 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2619,19 +2619,6 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, + } + } + +- if (nla[NFTA_CHAIN_COUNTERS]) { +- if (!nft_is_base_chain(chain)) { +- err = -EOPNOTSUPP; +- goto err_hooks; +- } +- +- stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); +- if (IS_ERR(stats)) { +- err = PTR_ERR(stats); +- goto err_hooks; +- } +- } +- + if (!(table->flags & NFT_TABLE_F_DORMANT) && + nft_is_base_chain(chain) && + !list_empty(&hook.list)) { +@@ -2646,6 +2633,20 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, + } + + unregister = true; ++ ++ if (nla[NFTA_CHAIN_COUNTERS]) { ++ if (!nft_is_base_chain(chain)) { ++ err = -EOPNOTSUPP; ++ goto err_hooks; ++ } ++ ++ stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); ++ if (IS_ERR(stats)) { ++ err = PTR_ERR(stats); ++ goto err_hooks; ++ } ++ } ++ + err = -ENOMEM; + trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN, + sizeof(struct nft_trans_chain)); +-- +2.43.0 + diff --git a/queue-6.7/netfilter-nft_set_pipapo-release-elements-in-clone-o.patch b/queue-6.7/netfilter-nft_set_pipapo-release-elements-in-clone-o.patch new file mode 100644 index 00000000000..eb3fa219566 --- /dev/null +++ b/queue-6.7/netfilter-nft_set_pipapo-release-elements-in-clone-o.patch @@ -0,0 +1,54 @@ +From 5637b31ec434fe811684d51fcd7fb000b27e6a3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Mar 2024 10:02:41 +0100 +Subject: netfilter: nft_set_pipapo: release elements in clone only from + destroy path + +From: Pablo Neira Ayuso + +[ Upstream commit b0e256f3dd2ba6532f37c5c22e07cb07a36031ee ] + +Clone already always provides a current view of the lookup table, use it +to destroy the set, otherwise it is possible to destroy elements twice. + +This fix requires: + + 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol") + +which came after: + + 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path"). + +Fixes: 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_pipapo.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c +index 3089c4ca8fff3..abf659cb2d91f 100644 +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -2244,8 +2244,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, + if (m) { + rcu_barrier(); + +- nft_set_pipapo_match_destroy(ctx, set, m); +- + for_each_possible_cpu(cpu) + pipapo_free_scratch(m, cpu); + free_percpu(m->scratch); +@@ -2257,8 +2255,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, + if (priv->clone) { + m = priv->clone; + +- if (priv->dirty) +- nft_set_pipapo_match_destroy(ctx, set, m); ++ nft_set_pipapo_match_destroy(ctx, set, m); + + for_each_possible_cpu(cpu) + pipapo_free_scratch(priv->clone, cpu); +-- +2.43.0 + diff --git a/queue-6.7/nouveau-gsp-don-t-check-devinit-disable-on-gsp.patch b/queue-6.7/nouveau-gsp-don-t-check-devinit-disable-on-gsp.patch new file mode 100644 index 00000000000..27b7a0c3684 --- /dev/null +++ b/queue-6.7/nouveau-gsp-don-t-check-devinit-disable-on-gsp.patch @@ -0,0 +1,39 @@ +From fe5679596a2c5043ee0f526c94d76237f7841ca3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 11:45:21 +1000 +Subject: nouveau/gsp: don't check devinit disable on GSP. + +From: Dave Airlie + +[ Upstream commit 5d4e8ae6e57b025802aadf55a4775c55cceb75f1 ] + +GSP should be handling this and I can see no evidence in opengpu +driver that this register should be touched. + +Fixed acceleration on 2080 Ti GPUs. + +Fixes: 15740541e8f0 ("drm/nouveau/devinit/tu102-: prepare for GSP-RM") + +Signed-off-by: Dave Airlie +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240314014521.2695233-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c +index 666eb93b1742c..11b4c9c274a1a 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c +@@ -41,7 +41,6 @@ r535_devinit_new(const struct nvkm_devinit_func *hw, + + rm->dtor = r535_devinit_dtor; + rm->post = hw->post; +- rm->disable = hw->disable; + + ret = nv50_devinit_new_(rm, device, type, inst, pdevinit); + if (ret) +-- +2.43.0 + diff --git a/queue-6.7/nouveau-reset-the-bo-resource-bus-info-after-an-evic.patch b/queue-6.7/nouveau-reset-the-bo-resource-bus-info-after-an-evic.patch new file mode 100644 index 00000000000..6086785e231 --- /dev/null +++ b/queue-6.7/nouveau-reset-the-bo-resource-bus-info-after-an-evic.patch @@ -0,0 +1,43 @@ +From 61f68e4ead0d2fc3f126b6499b8baaa5488bc865 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 17:20:37 +1000 +Subject: nouveau: reset the bo resource bus info after an eviction +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dave Airlie + +[ Upstream commit f35c9af45ea7a4b1115b193d84858b14d13517fc ] + +Later attempts to refault the bo won't happen and the whole +GPU does to lunch. I think Christian's refactoring of this +code out to the driver broke this not very well tested path. + +Fixes: 141b15e59175 ("drm/nouveau: move io_reserve_lru handling into the driver v5") +Cc: Christian König +Signed-off-by: Dave Airlie +Acked-by: Christian König +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240311072037.287905-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_bo.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c +index 280d1d9a559ba..254d6c9ef2023 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -1255,6 +1255,8 @@ nouveau_ttm_io_mem_reserve(struct ttm_device *bdev, struct ttm_resource *reg) + drm_vma_node_unmap(&nvbo->bo.base.vma_node, + bdev->dev_mapping); + nouveau_ttm_io_mem_free_locked(drm, nvbo->bo.resource); ++ nvbo->bo.resource->bus.offset = 0; ++ nvbo->bo.resource->bus.addr = NULL; + goto retry; + } + +-- +2.43.0 + diff --git a/queue-6.7/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch b/queue-6.7/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch new file mode 100644 index 00000000000..99432644e6a --- /dev/null +++ b/queue-6.7/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch @@ -0,0 +1,78 @@ +From 522c8c0e24bb7a165f9fbd9ef8478554f830106e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 10:09:27 +0800 +Subject: nvme: fix reconnection fail due to reserved tag allocation + +From: Chunguang Xu + +[ Upstream commit de105068fead55ed5c07ade75e9c8e7f86a00d1d ] + +We found a issue on production environment while using NVMe over RDMA, +admin_q reconnect failed forever while remote target and network is ok. +After dig into it, we found it may caused by a ABBA deadlock due to tag +allocation. In my case, the tag was hold by a keep alive request +waiting inside admin_q, as we quiesced admin_q while reset ctrl, so the +request maked as idle and will not process before reset success. As +fabric_q shares tagset with admin_q, while reconnect remote target, we +need a tag for connect command, but the only one reserved tag was held +by keep alive command which waiting inside admin_q. As a result, we +failed to reconnect admin_q forever. In order to fix this issue, I +think we should keep two reserved tags for admin queue. + +Fixes: ed01fee283a0 ("nvme-fabrics: only reserve a single tag") +Signed-off-by: Chunguang Xu +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 6 ++++-- + drivers/nvme/host/fabrics.h | 7 ------- + 2 files changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 86149275ccb8e..771eac141298c 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4272,7 +4272,8 @@ int nvme_alloc_admin_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, + set->ops = ops; + set->queue_depth = NVME_AQ_MQ_TAG_DEPTH; + if (ctrl->ops->flags & NVME_F_FABRICS) +- set->reserved_tags = NVMF_RESERVED_TAGS; ++ /* Reserved for fabric connect and keep alive */ ++ set->reserved_tags = 2; + set->numa_node = ctrl->numa_node; + set->flags = BLK_MQ_F_NO_SCHED; + if (ctrl->ops->flags & NVME_F_BLOCKING) +@@ -4341,7 +4342,8 @@ int nvme_alloc_io_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, + if (ctrl->quirks & NVME_QUIRK_SHARED_TAGS) + set->reserved_tags = NVME_AQ_DEPTH; + else if (ctrl->ops->flags & NVME_F_FABRICS) +- set->reserved_tags = NVMF_RESERVED_TAGS; ++ /* Reserved for fabric connect */ ++ set->reserved_tags = 1; + set->numa_node = ctrl->numa_node; + set->flags = BLK_MQ_F_SHOULD_MERGE; + if (ctrl->ops->flags & NVME_F_BLOCKING) +diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h +index fbaee5a7be196..e4acccc315bd9 100644 +--- a/drivers/nvme/host/fabrics.h ++++ b/drivers/nvme/host/fabrics.h +@@ -18,13 +18,6 @@ + /* default is -1: the fail fast mechanism is disabled */ + #define NVMF_DEF_FAIL_FAST_TMO -1 + +-/* +- * Reserved one command for internal usage. This command is used for sending +- * the connect command, as well as for the keep alive command on the admin +- * queue once live. +- */ +-#define NVMF_RESERVED_TAGS 1 +- + /* + * Define a host as seen by the target. We allocate one at boot, but also + * allow the override it when creating controllers. This is both to provide +-- +2.43.0 + diff --git a/queue-6.7/octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch b/queue-6.7/octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch new file mode 100644 index 00000000000..38df3b280b6 --- /dev/null +++ b/queue-6.7/octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch @@ -0,0 +1,39 @@ +From e5bf5dd45f65e2be202be27f3cd5a57e9fccce7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 12:36:22 +0530 +Subject: octeontx2-af: Use matching wake_up API variant in CGX command + interface + +From: Linu Cherian + +[ Upstream commit e642921dfeed1e15e73f78f2c3b6746f72b6deb2 ] + +Use wake_up API instead of wake_up_interruptible, since +wait_event_timeout API is used for waiting on command completion. + +Fixes: 1463f382f58d ("octeontx2-af: Add support for CGX link management") +Signed-off-by: Linu Cherian +Signed-off-by: Sunil Goutham +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index 6c70c84986904..3c0f55b3e48ea 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -1338,7 +1338,7 @@ static irqreturn_t cgx_fwi_event_handler(int irq, void *data) + + /* Release thread waiting for completion */ + lmac->cmd_pend = false; +- wake_up_interruptible(&lmac->wq_cmd_cmplt); ++ wake_up(&lmac->wq_cmd_cmplt); + break; + case CGX_EVT_ASYNC: + if (cgx_event_is_linkevent(event)) +-- +2.43.0 + diff --git a/queue-6.7/octeontx2-af-use-separate-handlers-for-interrupts.patch b/queue-6.7/octeontx2-af-use-separate-handlers-for-interrupts.patch new file mode 100644 index 00000000000..971774a0906 --- /dev/null +++ b/queue-6.7/octeontx2-af-use-separate-handlers-for-interrupts.patch @@ -0,0 +1,69 @@ +From ee789e2ae7614b4b8ed056d7ea6d9901da25ed43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 14:59:58 +0530 +Subject: octeontx2-af: Use separate handlers for interrupts + +From: Subbaraya Sundeep + +[ Upstream commit 50e60de381c342008c0956fd762e1c26408f372c ] + +For PF to AF interrupt vector and VF to AF vector same +interrupt handler is registered which is causing race condition. +When two interrupts are raised to two CPUs at same time +then two cores serve same event corrupting the data. + +Fixes: 7304ac4567bc ("octeontx2-af: Add mailbox IRQ and msg handlers") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index d82aa6f12f114..32645aefd5934 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -2528,10 +2528,9 @@ static void rvu_queue_work(struct mbox_wq_info *mw, int first, + } + } + +-static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq) ++static irqreturn_t rvu_mbox_pf_intr_handler(int irq, void *rvu_irq) + { + struct rvu *rvu = (struct rvu *)rvu_irq; +- int vfs = rvu->vfs; + u64 intr; + + intr = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_PFAF_MBOX_INT); +@@ -2545,6 +2544,18 @@ static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq) + + rvu_queue_work(&rvu->afpf_wq_info, 0, rvu->hw->total_pfs, intr); + ++ return IRQ_HANDLED; ++} ++ ++static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq) ++{ ++ struct rvu *rvu = (struct rvu *)rvu_irq; ++ int vfs = rvu->vfs; ++ u64 intr; ++ ++ /* Sync with mbox memory region */ ++ rmb(); ++ + /* Handle VF interrupts */ + if (vfs > 64) { + intr = rvupf_read64(rvu, RVU_PF_VFPF_MBOX_INTX(1)); +@@ -2882,7 +2893,7 @@ static int rvu_register_interrupts(struct rvu *rvu) + /* Register mailbox interrupt handler */ + sprintf(&rvu->irq_name[RVU_AF_INT_VEC_MBOX * NAME_SIZE], "RVUAF Mbox"); + ret = request_irq(pci_irq_vector(rvu->pdev, RVU_AF_INT_VEC_MBOX), +- rvu_mbox_intr_handler, 0, ++ rvu_mbox_pf_intr_handler, 0, + &rvu->irq_name[RVU_AF_INT_VEC_MBOX * NAME_SIZE], rvu); + if (ret) { + dev_err(rvu->dev, +-- +2.43.0 + diff --git a/queue-6.7/octeontx2-detect-the-mbox-up-or-down-message-via-reg.patch b/queue-6.7/octeontx2-detect-the-mbox-up-or-down-message-via-reg.patch new file mode 100644 index 00000000000..32a2efc769e --- /dev/null +++ b/queue-6.7/octeontx2-detect-the-mbox-up-or-down-message-via-reg.patch @@ -0,0 +1,684 @@ +From 5877a429f12ee7ab988703e666e9504ba99b8f54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 14:59:54 +0530 +Subject: octeontx2: Detect the mbox up or down message via register + +From: Subbaraya Sundeep + +[ Upstream commit a88e0f936ba9a301c78f6eacfd38737d003c130b ] + +A single line of interrupt is used to receive up notifications +and down reply messages from AF to PF (similarly from PF to its VF). +PF acts as bridge and forwards VF messages to AF and sends respsones +back from AF to VF. When an async event like link event is received +by up message when PF is in middle of forwarding VF message then +mailbox errors occur because PF state machine is corrupted. +Since VF is a separate driver or VF driver can be in a VM it is +not possible to serialize from the start of communication at VF. +Hence to differentiate between type of messages at PF this patch makes +sender to set mbox data register with distinct values for up and down +messages. Sender also checks whether previous interrupt is received +before triggering current interrupt by waiting for mailbox data register +to become zero. + +Fixes: 5a6d7c9daef3 ("octeontx2-pf: Mailbox communication with AF") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/mbox.c | 43 ++++++- + .../net/ethernet/marvell/octeontx2/af/mbox.h | 6 + + .../marvell/octeontx2/af/mcs_rvu_if.c | 17 ++- + .../net/ethernet/marvell/octeontx2/af/rvu.c | 14 ++- + .../net/ethernet/marvell/octeontx2/af/rvu.h | 2 + + .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 20 ++-- + .../marvell/octeontx2/nic/otx2_common.h | 2 +- + .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 113 ++++++++++++------ + .../ethernet/marvell/octeontx2/nic/otx2_vf.c | 71 ++++++----- + 9 files changed, 205 insertions(+), 83 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.c b/drivers/net/ethernet/marvell/octeontx2/af/mbox.c +index 9690ac01f02c8..7d741e3ba8c51 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.c +@@ -214,11 +214,12 @@ int otx2_mbox_busy_poll_for_rsp(struct otx2_mbox *mbox, int devid) + } + EXPORT_SYMBOL(otx2_mbox_busy_poll_for_rsp); + +-void otx2_mbox_msg_send(struct otx2_mbox *mbox, int devid) ++static void otx2_mbox_msg_send_data(struct otx2_mbox *mbox, int devid, u64 data) + { + struct otx2_mbox_dev *mdev = &mbox->dev[devid]; + struct mbox_hdr *tx_hdr, *rx_hdr; + void *hw_mbase = mdev->hwbase; ++ u64 intr_val; + + tx_hdr = hw_mbase + mbox->tx_start; + rx_hdr = hw_mbase + mbox->rx_start; +@@ -254,14 +255,52 @@ void otx2_mbox_msg_send(struct otx2_mbox *mbox, int devid) + + spin_unlock(&mdev->mbox_lock); + ++ /* Check if interrupt pending */ ++ intr_val = readq((void __iomem *)mbox->reg_base + ++ (mbox->trigger | (devid << mbox->tr_shift))); ++ ++ intr_val |= data; + /* The interrupt should be fired after num_msgs is written + * to the shared memory + */ +- writeq(1, (void __iomem *)mbox->reg_base + ++ writeq(intr_val, (void __iomem *)mbox->reg_base + + (mbox->trigger | (devid << mbox->tr_shift))); + } ++ ++void otx2_mbox_msg_send(struct otx2_mbox *mbox, int devid) ++{ ++ otx2_mbox_msg_send_data(mbox, devid, MBOX_DOWN_MSG); ++} + EXPORT_SYMBOL(otx2_mbox_msg_send); + ++void otx2_mbox_msg_send_up(struct otx2_mbox *mbox, int devid) ++{ ++ otx2_mbox_msg_send_data(mbox, devid, MBOX_UP_MSG); ++} ++EXPORT_SYMBOL(otx2_mbox_msg_send_up); ++ ++bool otx2_mbox_wait_for_zero(struct otx2_mbox *mbox, int devid) ++{ ++ u64 data; ++ ++ data = readq((void __iomem *)mbox->reg_base + ++ (mbox->trigger | (devid << mbox->tr_shift))); ++ ++ /* If data is non-zero wait for ~1ms and return to caller ++ * whether data has changed to zero or not after the wait. ++ */ ++ if (!data) ++ return true; ++ ++ usleep_range(950, 1000); ++ ++ data = readq((void __iomem *)mbox->reg_base + ++ (mbox->trigger | (devid << mbox->tr_shift))); ++ ++ return data == 0; ++} ++EXPORT_SYMBOL(otx2_mbox_wait_for_zero); ++ + struct mbox_msghdr *otx2_mbox_alloc_msg_rsp(struct otx2_mbox *mbox, int devid, + int size, int size_rsp) + { +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +index 5df42634ceb84..bd4b9661ee373 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +@@ -16,6 +16,9 @@ + + #define MBOX_SIZE SZ_64K + ++#define MBOX_DOWN_MSG 1 ++#define MBOX_UP_MSG 2 ++ + /* AF/PF: PF initiated, PF/VF VF initiated */ + #define MBOX_DOWN_RX_START 0 + #define MBOX_DOWN_RX_SIZE (46 * SZ_1K) +@@ -101,6 +104,7 @@ int otx2_mbox_regions_init(struct otx2_mbox *mbox, void __force **hwbase, + struct pci_dev *pdev, void __force *reg_base, + int direction, int ndevs, unsigned long *bmap); + void otx2_mbox_msg_send(struct otx2_mbox *mbox, int devid); ++void otx2_mbox_msg_send_up(struct otx2_mbox *mbox, int devid); + int otx2_mbox_wait_for_rsp(struct otx2_mbox *mbox, int devid); + int otx2_mbox_busy_poll_for_rsp(struct otx2_mbox *mbox, int devid); + struct mbox_msghdr *otx2_mbox_alloc_msg_rsp(struct otx2_mbox *mbox, int devid, +@@ -118,6 +122,8 @@ static inline struct mbox_msghdr *otx2_mbox_alloc_msg(struct otx2_mbox *mbox, + return otx2_mbox_alloc_msg_rsp(mbox, devid, size, 0); + } + ++bool otx2_mbox_wait_for_zero(struct otx2_mbox *mbox, int devid); ++ + /* Mailbox message types */ + #define MBOX_MSG_MASK 0xFFFF + #define MBOX_MSG_INVALID 0xFFFE +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c +index dfd23580e3b8e..d39d86e694ccf 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c +@@ -121,13 +121,17 @@ int mcs_add_intr_wq_entry(struct mcs *mcs, struct mcs_intr_event *event) + static int mcs_notify_pfvf(struct mcs_intr_event *event, struct rvu *rvu) + { + struct mcs_intr_info *req; +- int err, pf; ++ int pf; + + pf = rvu_get_pf(event->pcifunc); + ++ mutex_lock(&rvu->mbox_lock); ++ + req = otx2_mbox_alloc_msg_mcs_intr_notify(rvu, pf); +- if (!req) ++ if (!req) { ++ mutex_unlock(&rvu->mbox_lock); + return -ENOMEM; ++ } + + req->mcs_id = event->mcs_id; + req->intr_mask = event->intr_mask; +@@ -135,10 +139,11 @@ static int mcs_notify_pfvf(struct mcs_intr_event *event, struct rvu *rvu) + req->hdr.pcifunc = event->pcifunc; + req->lmac_id = event->lmac_id; + +- otx2_mbox_msg_send(&rvu->afpf_wq_info.mbox_up, pf); +- err = otx2_mbox_wait_for_rsp(&rvu->afpf_wq_info.mbox_up, pf); +- if (err) +- dev_warn(rvu->dev, "MCS notification to pf %d failed\n", pf); ++ otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, pf); ++ ++ otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, pf); ++ ++ mutex_unlock(&rvu->mbox_lock); + + return 0; + } +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index 731bb82b577c2..d82aa6f12f114 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -2114,7 +2114,7 @@ MBOX_MESSAGES + } + } + +-static void __rvu_mbox_handler(struct rvu_work *mwork, int type) ++static void __rvu_mbox_handler(struct rvu_work *mwork, int type, bool poll) + { + struct rvu *rvu = mwork->rvu; + int offset, err, id, devid; +@@ -2181,6 +2181,9 @@ static void __rvu_mbox_handler(struct rvu_work *mwork, int type) + } + mw->mbox_wrk[devid].num_msgs = 0; + ++ if (poll) ++ otx2_mbox_wait_for_zero(mbox, devid); ++ + /* Send mbox responses to VF/PF */ + otx2_mbox_msg_send(mbox, devid); + } +@@ -2188,15 +2191,18 @@ static void __rvu_mbox_handler(struct rvu_work *mwork, int type) + static inline void rvu_afpf_mbox_handler(struct work_struct *work) + { + struct rvu_work *mwork = container_of(work, struct rvu_work, work); ++ struct rvu *rvu = mwork->rvu; + +- __rvu_mbox_handler(mwork, TYPE_AFPF); ++ mutex_lock(&rvu->mbox_lock); ++ __rvu_mbox_handler(mwork, TYPE_AFPF, true); ++ mutex_unlock(&rvu->mbox_lock); + } + + static inline void rvu_afvf_mbox_handler(struct work_struct *work) + { + struct rvu_work *mwork = container_of(work, struct rvu_work, work); + +- __rvu_mbox_handler(mwork, TYPE_AFVF); ++ __rvu_mbox_handler(mwork, TYPE_AFVF, false); + } + + static void __rvu_mbox_up_handler(struct rvu_work *mwork, int type) +@@ -2371,6 +2377,8 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw, + } + } + ++ mutex_init(&rvu->mbox_lock); ++ + mbox_regions = kcalloc(num, sizeof(void *), GFP_KERNEL); + if (!mbox_regions) { + err = -ENOMEM; +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index 8802961b8889f..185c296eaaf0d 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -551,6 +551,8 @@ struct rvu { + spinlock_t mcs_intrq_lock; + /* CPT interrupt lock */ + spinlock_t cpt_intr_lock; ++ ++ struct mutex mbox_lock; /* Serialize mbox up and down msgs */ + }; + + static inline void rvu_write64(struct rvu *rvu, u64 block, u64 offset, u64 val) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 38acdc7a73bbe..72e060cf6b618 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -232,7 +232,7 @@ static void cgx_notify_pfs(struct cgx_link_event *event, struct rvu *rvu) + struct cgx_link_user_info *linfo; + struct cgx_link_info_msg *msg; + unsigned long pfmap; +- int err, pfid; ++ int pfid; + + linfo = &event->link_uinfo; + pfmap = cgxlmac_to_pfmap(rvu, event->cgx_id, event->lmac_id); +@@ -255,16 +255,22 @@ static void cgx_notify_pfs(struct cgx_link_event *event, struct rvu *rvu) + continue; + } + ++ mutex_lock(&rvu->mbox_lock); ++ + /* Send mbox message to PF */ + msg = otx2_mbox_alloc_msg_cgx_link_event(rvu, pfid); +- if (!msg) ++ if (!msg) { ++ mutex_unlock(&rvu->mbox_lock); + continue; ++ } ++ + msg->link_info = *linfo; +- otx2_mbox_msg_send(&rvu->afpf_wq_info.mbox_up, pfid); +- err = otx2_mbox_wait_for_rsp(&rvu->afpf_wq_info.mbox_up, pfid); +- if (err) +- dev_warn(rvu->dev, "notification to pf %d failed\n", +- pfid); ++ ++ otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, pfid); ++ ++ otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, pfid); ++ ++ mutex_unlock(&rvu->mbox_lock); + } while (pfmap); + } + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +index 06910307085ef..7e16a341ec588 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +@@ -815,7 +815,7 @@ static inline int otx2_sync_mbox_up_msg(struct mbox *mbox, int devid) + + if (!otx2_mbox_nonempty(&mbox->mbox_up, devid)) + return 0; +- otx2_mbox_msg_send(&mbox->mbox_up, devid); ++ otx2_mbox_msg_send_up(&mbox->mbox_up, devid); + err = otx2_mbox_wait_for_rsp(&mbox->mbox_up, devid); + if (err) + return err; +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index e5fe67e738655..3c8841b35d0f7 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -292,8 +292,8 @@ static int otx2_pf_flr_init(struct otx2_nic *pf, int num_vfs) + return 0; + } + +-static void otx2_queue_work(struct mbox *mw, struct workqueue_struct *mbox_wq, +- int first, int mdevs, u64 intr, int type) ++static void otx2_queue_vf_work(struct mbox *mw, struct workqueue_struct *mbox_wq, ++ int first, int mdevs, u64 intr) + { + struct otx2_mbox_dev *mdev; + struct otx2_mbox *mbox; +@@ -307,40 +307,26 @@ static void otx2_queue_work(struct mbox *mw, struct workqueue_struct *mbox_wq, + + mbox = &mw->mbox; + mdev = &mbox->dev[i]; +- if (type == TYPE_PFAF) +- otx2_sync_mbox_bbuf(mbox, i); + hdr = mdev->mbase + mbox->rx_start; + /* The hdr->num_msgs is set to zero immediately in the interrupt +- * handler to ensure that it holds a correct value next time +- * when the interrupt handler is called. +- * pf->mbox.num_msgs holds the data for use in pfaf_mbox_handler +- * pf>mbox.up_num_msgs holds the data for use in +- * pfaf_mbox_up_handler. ++ * handler to ensure that it holds a correct value next time ++ * when the interrupt handler is called. pf->mw[i].num_msgs ++ * holds the data for use in otx2_pfvf_mbox_handler and ++ * pf->mw[i].up_num_msgs holds the data for use in ++ * otx2_pfvf_mbox_up_handler. + */ + if (hdr->num_msgs) { + mw[i].num_msgs = hdr->num_msgs; + hdr->num_msgs = 0; +- if (type == TYPE_PFAF) +- memset(mbox->hwbase + mbox->rx_start, 0, +- ALIGN(sizeof(struct mbox_hdr), +- sizeof(u64))); +- + queue_work(mbox_wq, &mw[i].mbox_wrk); + } + + mbox = &mw->mbox_up; + mdev = &mbox->dev[i]; +- if (type == TYPE_PFAF) +- otx2_sync_mbox_bbuf(mbox, i); + hdr = mdev->mbase + mbox->rx_start; + if (hdr->num_msgs) { + mw[i].up_num_msgs = hdr->num_msgs; + hdr->num_msgs = 0; +- if (type == TYPE_PFAF) +- memset(mbox->hwbase + mbox->rx_start, 0, +- ALIGN(sizeof(struct mbox_hdr), +- sizeof(u64))); +- + queue_work(mbox_wq, &mw[i].mbox_up_wrk); + } + } +@@ -356,8 +342,10 @@ static void otx2_forward_msg_pfvf(struct otx2_mbox_dev *mdev, + /* Msgs are already copied, trigger VF's mbox irq */ + smp_wmb(); + ++ otx2_mbox_wait_for_zero(pfvf_mbox, devid); ++ + offset = pfvf_mbox->trigger | (devid << pfvf_mbox->tr_shift); +- writeq(1, (void __iomem *)pfvf_mbox->reg_base + offset); ++ writeq(MBOX_DOWN_MSG, (void __iomem *)pfvf_mbox->reg_base + offset); + + /* Restore VF's mbox bounce buffer region address */ + src_mdev->mbase = bbuf_base; +@@ -547,7 +535,7 @@ static void otx2_pfvf_mbox_up_handler(struct work_struct *work) + end: + offset = mbox->rx_start + msg->next_msgoff; + if (mdev->msgs_acked == (vf_mbox->up_num_msgs - 1)) +- __otx2_mbox_reset(mbox, 0); ++ __otx2_mbox_reset(mbox, vf_idx); + mdev->msgs_acked++; + } + } +@@ -564,8 +552,7 @@ static irqreturn_t otx2_pfvf_mbox_intr_handler(int irq, void *pf_irq) + if (vfs > 64) { + intr = otx2_read64(pf, RVU_PF_VFPF_MBOX_INTX(1)); + otx2_write64(pf, RVU_PF_VFPF_MBOX_INTX(1), intr); +- otx2_queue_work(mbox, pf->mbox_pfvf_wq, 64, vfs, intr, +- TYPE_PFVF); ++ otx2_queue_vf_work(mbox, pf->mbox_pfvf_wq, 64, vfs, intr); + if (intr) + trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr); + vfs = 64; +@@ -574,7 +561,7 @@ static irqreturn_t otx2_pfvf_mbox_intr_handler(int irq, void *pf_irq) + intr = otx2_read64(pf, RVU_PF_VFPF_MBOX_INTX(0)); + otx2_write64(pf, RVU_PF_VFPF_MBOX_INTX(0), intr); + +- otx2_queue_work(mbox, pf->mbox_pfvf_wq, 0, vfs, intr, TYPE_PFVF); ++ otx2_queue_vf_work(mbox, pf->mbox_pfvf_wq, 0, vfs, intr); + + if (intr) + trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr); +@@ -821,20 +808,22 @@ static void otx2_pfaf_mbox_handler(struct work_struct *work) + struct mbox *af_mbox; + struct otx2_nic *pf; + int offset, id; ++ u16 num_msgs; + + af_mbox = container_of(work, struct mbox, mbox_wrk); + mbox = &af_mbox->mbox; + mdev = &mbox->dev[0]; + rsp_hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); ++ num_msgs = rsp_hdr->num_msgs; + + offset = mbox->rx_start + ALIGN(sizeof(*rsp_hdr), MBOX_MSG_ALIGN); + pf = af_mbox->pfvf; + +- for (id = 0; id < af_mbox->num_msgs; id++) { ++ for (id = 0; id < num_msgs; id++) { + msg = (struct mbox_msghdr *)(mdev->mbase + offset); + otx2_process_pfaf_mbox_msg(pf, msg); + offset = mbox->rx_start + msg->next_msgoff; +- if (mdev->msgs_acked == (af_mbox->num_msgs - 1)) ++ if (mdev->msgs_acked == (num_msgs - 1)) + __otx2_mbox_reset(mbox, 0); + mdev->msgs_acked++; + } +@@ -945,12 +934,14 @@ static void otx2_pfaf_mbox_up_handler(struct work_struct *work) + int offset, id, devid = 0; + struct mbox_hdr *rsp_hdr; + struct mbox_msghdr *msg; ++ u16 num_msgs; + + rsp_hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); ++ num_msgs = rsp_hdr->num_msgs; + + offset = mbox->rx_start + ALIGN(sizeof(*rsp_hdr), MBOX_MSG_ALIGN); + +- for (id = 0; id < af_mbox->up_num_msgs; id++) { ++ for (id = 0; id < num_msgs; id++) { + msg = (struct mbox_msghdr *)(mdev->mbase + offset); + + devid = msg->pcifunc & RVU_PFVF_FUNC_MASK; +@@ -959,10 +950,11 @@ static void otx2_pfaf_mbox_up_handler(struct work_struct *work) + otx2_process_mbox_msg_up(pf, msg); + offset = mbox->rx_start + msg->next_msgoff; + } +- if (devid) { ++ /* Forward to VF iff VFs are really present */ ++ if (devid && pci_num_vf(pf->pdev)) { + otx2_forward_vf_mbox_msgs(pf, &pf->mbox.mbox_up, + MBOX_DIR_PFVF_UP, devid - 1, +- af_mbox->up_num_msgs); ++ num_msgs); + return; + } + +@@ -972,16 +964,49 @@ static void otx2_pfaf_mbox_up_handler(struct work_struct *work) + static irqreturn_t otx2_pfaf_mbox_intr_handler(int irq, void *pf_irq) + { + struct otx2_nic *pf = (struct otx2_nic *)pf_irq; +- struct mbox *mbox; ++ struct mbox *mw = &pf->mbox; ++ struct otx2_mbox_dev *mdev; ++ struct otx2_mbox *mbox; ++ struct mbox_hdr *hdr; ++ u64 mbox_data; + + /* Clear the IRQ */ + otx2_write64(pf, RVU_PF_INT, BIT_ULL(0)); + +- mbox = &pf->mbox; + +- trace_otx2_msg_interrupt(mbox->mbox.pdev, "AF to PF", BIT_ULL(0)); ++ mbox_data = otx2_read64(pf, RVU_PF_PFAF_MBOX0); ++ ++ if (mbox_data & MBOX_UP_MSG) { ++ mbox_data &= ~MBOX_UP_MSG; ++ otx2_write64(pf, RVU_PF_PFAF_MBOX0, mbox_data); ++ ++ mbox = &mw->mbox_up; ++ mdev = &mbox->dev[0]; ++ otx2_sync_mbox_bbuf(mbox, 0); ++ ++ hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); ++ if (hdr->num_msgs) ++ queue_work(pf->mbox_wq, &mw->mbox_up_wrk); ++ ++ trace_otx2_msg_interrupt(pf->pdev, "UP message from AF to PF", ++ BIT_ULL(0)); ++ } ++ ++ if (mbox_data & MBOX_DOWN_MSG) { ++ mbox_data &= ~MBOX_DOWN_MSG; ++ otx2_write64(pf, RVU_PF_PFAF_MBOX0, mbox_data); ++ ++ mbox = &mw->mbox; ++ mdev = &mbox->dev[0]; ++ otx2_sync_mbox_bbuf(mbox, 0); ++ ++ hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); ++ if (hdr->num_msgs) ++ queue_work(pf->mbox_wq, &mw->mbox_wrk); + +- otx2_queue_work(mbox, pf->mbox_wq, 0, 1, 1, TYPE_PFAF); ++ trace_otx2_msg_interrupt(pf->pdev, "DOWN reply from AF to PF", ++ BIT_ULL(0)); ++ } + + return IRQ_HANDLED; + } +@@ -3087,6 +3112,7 @@ static void otx2_vf_link_event_task(struct work_struct *work) + struct otx2_vf_config *config; + struct cgx_link_info_msg *req; + struct mbox_msghdr *msghdr; ++ struct delayed_work *dwork; + struct otx2_nic *pf; + int vf_idx; + +@@ -3095,10 +3121,21 @@ static void otx2_vf_link_event_task(struct work_struct *work) + vf_idx = config - config->pf->vf_configs; + pf = config->pf; + ++ mutex_lock(&pf->mbox.lock); ++ ++ dwork = &config->link_event_work; ++ ++ if (!otx2_mbox_wait_for_zero(&pf->mbox_pfvf[0].mbox_up, vf_idx)) { ++ schedule_delayed_work(dwork, msecs_to_jiffies(100)); ++ mutex_unlock(&pf->mbox.lock); ++ return; ++ } ++ + msghdr = otx2_mbox_alloc_msg_rsp(&pf->mbox_pfvf[0].mbox_up, vf_idx, + sizeof(*req), sizeof(struct msg_rsp)); + if (!msghdr) { + dev_err(pf->dev, "Failed to create VF%d link event\n", vf_idx); ++ mutex_unlock(&pf->mbox.lock); + return; + } + +@@ -3107,7 +3144,11 @@ static void otx2_vf_link_event_task(struct work_struct *work) + req->hdr.sig = OTX2_MBOX_REQ_SIG; + memcpy(&req->link_info, &pf->linfo, sizeof(req->link_info)); + +- otx2_sync_mbox_up_msg(&pf->mbox_pfvf[0], vf_idx); ++ otx2_mbox_wait_for_zero(&pf->mbox_pfvf[0].mbox_up, vf_idx); ++ ++ otx2_mbox_msg_send_up(&pf->mbox_pfvf[0].mbox_up, vf_idx); ++ ++ mutex_unlock(&pf->mbox.lock); + } + + static int otx2_sriov_enable(struct pci_dev *pdev, int numvfs) +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +index 35e06048356f4..ced456cec8baf 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +@@ -89,16 +89,20 @@ static void otx2vf_vfaf_mbox_handler(struct work_struct *work) + struct otx2_mbox *mbox; + struct mbox *af_mbox; + int offset, id; ++ u16 num_msgs; + + af_mbox = container_of(work, struct mbox, mbox_wrk); + mbox = &af_mbox->mbox; + mdev = &mbox->dev[0]; + rsp_hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); +- if (af_mbox->num_msgs == 0) ++ num_msgs = rsp_hdr->num_msgs; ++ ++ if (num_msgs == 0) + return; ++ + offset = mbox->rx_start + ALIGN(sizeof(*rsp_hdr), MBOX_MSG_ALIGN); + +- for (id = 0; id < af_mbox->num_msgs; id++) { ++ for (id = 0; id < num_msgs; id++) { + msg = (struct mbox_msghdr *)(mdev->mbase + offset); + otx2vf_process_vfaf_mbox_msg(af_mbox->pfvf, msg); + offset = mbox->rx_start + msg->next_msgoff; +@@ -151,6 +155,7 @@ static void otx2vf_vfaf_mbox_up_handler(struct work_struct *work) + struct mbox *vf_mbox; + struct otx2_nic *vf; + int offset, id; ++ u16 num_msgs; + + vf_mbox = container_of(work, struct mbox, mbox_up_wrk); + vf = vf_mbox->pfvf; +@@ -158,12 +163,14 @@ static void otx2vf_vfaf_mbox_up_handler(struct work_struct *work) + mdev = &mbox->dev[0]; + + rsp_hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); +- if (vf_mbox->up_num_msgs == 0) ++ num_msgs = rsp_hdr->num_msgs; ++ ++ if (num_msgs == 0) + return; + + offset = mbox->rx_start + ALIGN(sizeof(*rsp_hdr), MBOX_MSG_ALIGN); + +- for (id = 0; id < vf_mbox->up_num_msgs; id++) { ++ for (id = 0; id < num_msgs; id++) { + msg = (struct mbox_msghdr *)(mdev->mbase + offset); + otx2vf_process_mbox_msg_up(vf, msg); + offset = mbox->rx_start + msg->next_msgoff; +@@ -178,40 +185,48 @@ static irqreturn_t otx2vf_vfaf_mbox_intr_handler(int irq, void *vf_irq) + struct otx2_mbox_dev *mdev; + struct otx2_mbox *mbox; + struct mbox_hdr *hdr; ++ u64 mbox_data; + + /* Clear the IRQ */ + otx2_write64(vf, RVU_VF_INT, BIT_ULL(0)); + ++ mbox_data = otx2_read64(vf, RVU_VF_VFPF_MBOX0); ++ + /* Read latest mbox data */ + smp_rmb(); + +- /* Check for PF => VF response messages */ +- mbox = &vf->mbox.mbox; +- mdev = &mbox->dev[0]; +- otx2_sync_mbox_bbuf(mbox, 0); ++ if (mbox_data & MBOX_DOWN_MSG) { ++ mbox_data &= ~MBOX_DOWN_MSG; ++ otx2_write64(vf, RVU_VF_VFPF_MBOX0, mbox_data); ++ ++ /* Check for PF => VF response messages */ ++ mbox = &vf->mbox.mbox; ++ mdev = &mbox->dev[0]; ++ otx2_sync_mbox_bbuf(mbox, 0); + +- trace_otx2_msg_interrupt(mbox->pdev, "PF to VF", BIT_ULL(0)); ++ hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); ++ if (hdr->num_msgs) ++ queue_work(vf->mbox_wq, &vf->mbox.mbox_wrk); + +- hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); +- if (hdr->num_msgs) { +- vf->mbox.num_msgs = hdr->num_msgs; +- hdr->num_msgs = 0; +- memset(mbox->hwbase + mbox->rx_start, 0, +- ALIGN(sizeof(struct mbox_hdr), sizeof(u64))); +- queue_work(vf->mbox_wq, &vf->mbox.mbox_wrk); ++ trace_otx2_msg_interrupt(mbox->pdev, "DOWN reply from PF to VF", ++ BIT_ULL(0)); + } +- /* Check for PF => VF notification messages */ +- mbox = &vf->mbox.mbox_up; +- mdev = &mbox->dev[0]; +- otx2_sync_mbox_bbuf(mbox, 0); +- +- hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); +- if (hdr->num_msgs) { +- vf->mbox.up_num_msgs = hdr->num_msgs; +- hdr->num_msgs = 0; +- memset(mbox->hwbase + mbox->rx_start, 0, +- ALIGN(sizeof(struct mbox_hdr), sizeof(u64))); +- queue_work(vf->mbox_wq, &vf->mbox.mbox_up_wrk); ++ ++ if (mbox_data & MBOX_UP_MSG) { ++ mbox_data &= ~MBOX_UP_MSG; ++ otx2_write64(vf, RVU_VF_VFPF_MBOX0, mbox_data); ++ ++ /* Check for PF => VF notification messages */ ++ mbox = &vf->mbox.mbox_up; ++ mdev = &mbox->dev[0]; ++ otx2_sync_mbox_bbuf(mbox, 0); ++ ++ hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start); ++ if (hdr->num_msgs) ++ queue_work(vf->mbox_wq, &vf->mbox.mbox_up_wrk); ++ ++ trace_otx2_msg_interrupt(mbox->pdev, "UP message from PF to VF", ++ BIT_ULL(0)); + } + + return IRQ_HANDLED; +-- +2.43.0 + diff --git a/queue-6.7/octeontx2-pf-send-up-messages-to-vf-only-when-vf-is-.patch b/queue-6.7/octeontx2-pf-send-up-messages-to-vf-only-when-vf-is-.patch new file mode 100644 index 00000000000..a493e4385b9 --- /dev/null +++ b/queue-6.7/octeontx2-pf-send-up-messages-to-vf-only-when-vf-is-.patch @@ -0,0 +1,39 @@ +From 2acabce883725289eee4cbf43b8b5fa791d0d769 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 14:59:57 +0530 +Subject: octeontx2-pf: Send UP messages to VF only when VF is up. + +From: Subbaraya Sundeep + +[ Upstream commit dfcf6355f53b1796cf7fd50a4f27b18ee6a3497a ] + +When PF sending link status messages to VF, it is possible +that by the time link_event_task work function is executed +VF might have brought down. Hence before sending VF link +status message check whether VF is up to receive it. + +Fixes: ad513ed938c9 ("octeontx2-vf: Link event notification support") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index f85d38fab3211..b40bd0e467514 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -3122,6 +3122,9 @@ static void otx2_vf_link_event_task(struct work_struct *work) + vf_idx = config - config->pf->vf_configs; + pf = config->pf; + ++ if (config->intf_down) ++ return; ++ + mutex_lock(&pf->mbox.lock); + + dwork = &config->link_event_work; +-- +2.43.0 + diff --git a/queue-6.7/octeontx2-pf-use-default-max_active-works-instead-of.patch b/queue-6.7/octeontx2-pf-use-default-max_active-works-instead-of.patch new file mode 100644 index 00000000000..de1a53b3e30 --- /dev/null +++ b/queue-6.7/octeontx2-pf-use-default-max_active-works-instead-of.patch @@ -0,0 +1,52 @@ +From 0511d5c3593727c8f9679e7873deb7cd70dced69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 14:59:56 +0530 +Subject: octeontx2-pf: Use default max_active works instead of one + +From: Subbaraya Sundeep + +[ Upstream commit 7558ce0d974ced1dc07edc1197f750fe28c52e57 ] + +Only one execution context for the workqueue used for PF and +VFs mailbox communication is incorrect since multiple works are +queued simultaneously by all the VFs and PF link UP messages. +Hence use default number of execution contexts by passing zero +as max_active to alloc_workqueue function. With this fix in place, +modify UP messages also to wait until completion. + +Fixes: d424b6c02415 ("octeontx2-pf: Enable SRIOV and added VF mbox handling") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 3c8841b35d0f7..f85d38fab3211 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -584,8 +584,9 @@ static int otx2_pfvf_mbox_init(struct otx2_nic *pf, int numvfs) + if (!pf->mbox_pfvf) + return -ENOMEM; + +- pf->mbox_pfvf_wq = alloc_ordered_workqueue("otx2_pfvf_mailbox", +- WQ_HIGHPRI | WQ_MEM_RECLAIM); ++ pf->mbox_pfvf_wq = alloc_workqueue("otx2_pfvf_mailbox", ++ WQ_UNBOUND | WQ_HIGHPRI | ++ WQ_MEM_RECLAIM, 0); + if (!pf->mbox_pfvf_wq) + return -ENOMEM; + +@@ -3146,7 +3147,7 @@ static void otx2_vf_link_event_task(struct work_struct *work) + + otx2_mbox_wait_for_zero(&pf->mbox_pfvf[0].mbox_up, vf_idx); + +- otx2_mbox_msg_send_up(&pf->mbox_pfvf[0].mbox_up, vf_idx); ++ otx2_sync_mbox_up_msg(&pf->mbox_pfvf[0], vf_idx); + + mutex_unlock(&pf->mbox.lock); + } +-- +2.43.0 + diff --git a/queue-6.7/octeontx2-pf-wait-till-detach_resources-msg-is-compl.patch b/queue-6.7/octeontx2-pf-wait-till-detach_resources-msg-is-compl.patch new file mode 100644 index 00000000000..b5c2a80a73b --- /dev/null +++ b/queue-6.7/octeontx2-pf-wait-till-detach_resources-msg-is-compl.patch @@ -0,0 +1,54 @@ +From 2fe968b3a3e0a43dd4852767aec7c9e59af60e13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 14:59:55 +0530 +Subject: octeontx2-pf: Wait till detach_resources msg is complete + +From: Subbaraya Sundeep + +[ Upstream commit cbf2f24939a5dafce6de4dd4422e543ce8f610cf ] + +During VF driver remove, a message is sent to detach VF +resources to PF but VF is not waiting until message is +complete. Also mailbox interrupts need to be turned off +after the detach resource message is complete. This patch +fixes that problem. + +Fixes: 05fcc9e08955 ("octeontx2-pf: Attach NIX and NPA block LFs") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 2 +- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index 02d0b707aea5b..a85ac039d779b 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -1592,7 +1592,7 @@ int otx2_detach_resources(struct mbox *mbox) + detach->partial = false; + + /* Send detach request to AF */ +- otx2_mbox_msg_send(&mbox->mbox, 0); ++ otx2_sync_mbox_msg(mbox); + mutex_unlock(&mbox->lock); + return 0; + } +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +index ced456cec8baf..cf0aa16d75407 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +@@ -775,8 +775,8 @@ static void otx2vf_remove(struct pci_dev *pdev) + otx2_mcam_flow_del(vf); + otx2_shutdown_tc(vf); + otx2_shutdown_qos(vf); +- otx2vf_disable_mbox_intr(vf); + otx2_detach_resources(&vf->mbox); ++ otx2vf_disable_mbox_intr(vf); + free_percpu(vf->hw.lmt_info); + if (test_bit(CN10K_LMTST, &vf->hw.cap_flag)) + qmem_free(vf->dev, vf->dync_lmt); +-- +2.43.0 + diff --git a/queue-6.7/packet-annotate-data-races-around-ignore_outgoing.patch b/queue-6.7/packet-annotate-data-races-around-ignore_outgoing.patch new file mode 100644 index 00000000000..87e9b1a685f --- /dev/null +++ b/queue-6.7/packet-annotate-data-races-around-ignore_outgoing.patch @@ -0,0 +1,105 @@ +From d95175c36aec532626d328e18a181d16e3dd0cc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 14:18:16 +0000 +Subject: packet: annotate data-races around ignore_outgoing + +From: Eric Dumazet + +[ Upstream commit 6ebfad33161afacb3e1e59ed1c2feefef70f9f97 ] + +ignore_outgoing is read locklessly from dev_queue_xmit_nit() +and packet_getsockopt() + +Add appropriate READ_ONCE()/WRITE_ONCE() annotations. + +syzbot reported: + +BUG: KCSAN: data-race in dev_queue_xmit_nit / packet_setsockopt + +write to 0xffff888107804542 of 1 bytes by task 22618 on cpu 0: + packet_setsockopt+0xd83/0xfd0 net/packet/af_packet.c:4003 + do_sock_setsockopt net/socket.c:2311 [inline] + __sys_setsockopt+0x1d8/0x250 net/socket.c:2334 + __do_sys_setsockopt net/socket.c:2343 [inline] + __se_sys_setsockopt net/socket.c:2340 [inline] + __x64_sys_setsockopt+0x66/0x80 net/socket.c:2340 + do_syscall_64+0xd3/0x1d0 + entry_SYSCALL_64_after_hwframe+0x6d/0x75 + +read to 0xffff888107804542 of 1 bytes by task 27 on cpu 1: + dev_queue_xmit_nit+0x82/0x620 net/core/dev.c:2248 + xmit_one net/core/dev.c:3527 [inline] + dev_hard_start_xmit+0xcc/0x3f0 net/core/dev.c:3547 + __dev_queue_xmit+0xf24/0x1dd0 net/core/dev.c:4335 + dev_queue_xmit include/linux/netdevice.h:3091 [inline] + batadv_send_skb_packet+0x264/0x300 net/batman-adv/send.c:108 + batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127 + batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline] + batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] + batadv_iv_send_outstanding_bat_ogm_packet+0x3f0/0x4b0 net/batman-adv/bat_iv_ogm.c:1700 + process_one_work kernel/workqueue.c:3254 [inline] + process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335 + worker_thread+0x526/0x730 kernel/workqueue.c:3416 + kthread+0x1d1/0x210 kernel/kthread.c:388 + ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 27 Comm: kworker/u8:1 Tainted: G W 6.8.0-syzkaller-08073-g480e035fc4c7 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 +Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet + +Fixes: fa788d986a3a ("packet: add sockopt to ignore outgoing packets") +Reported-by: syzbot+c669c1136495a2e7c31f@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/CANn89i+Z7MfbkBLOv=p7KZ7=K1rKHO4P1OL5LYDCtBiyqsa9oQ@mail.gmail.com/T/#t +Signed-off-by: Eric Dumazet +Cc: Willem de Bruijn +Reviewed-by: Willem de Bruijn +Reviewed-by: Jason Xing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 2 +- + net/packet/af_packet.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index add22ca0dff95..ae898594690f7 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2262,7 +2262,7 @@ void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev) + rcu_read_lock(); + again: + list_for_each_entry_rcu(ptype, ptype_list, list) { +- if (ptype->ignore_outgoing) ++ if (READ_ONCE(ptype->ignore_outgoing)) + continue; + + /* Never send packets back to the socket +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 7adf48549a3b7..f017d7d33da39 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -4004,7 +4004,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + if (val < 0 || val > 1) + return -EINVAL; + +- po->prot_hook.ignore_outgoing = !!val; ++ WRITE_ONCE(po->prot_hook.ignore_outgoing, !!val); + return 0; + } + case PACKET_TX_HAS_OFF: +@@ -4135,7 +4135,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + 0); + break; + case PACKET_IGNORE_OUTGOING: +- val = po->prot_hook.ignore_outgoing; ++ val = READ_ONCE(po->prot_hook.ignore_outgoing); + break; + case PACKET_ROLLOVER_STATS: + if (!po->rollover) +-- +2.43.0 + diff --git a/queue-6.7/rcu-add-a-helper-to-report-consolidated-flavor-qs.patch b/queue-6.7/rcu-add-a-helper-to-report-consolidated-flavor-qs.patch new file mode 100644 index 00000000000..4a6e268662e --- /dev/null +++ b/queue-6.7/rcu-add-a-helper-to-report-consolidated-flavor-qs.patch @@ -0,0 +1,76 @@ +From e91a8d380d23d519df8a75844455b6b2c91f37d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 13:44:34 -0700 +Subject: rcu: add a helper to report consolidated flavor QS + +From: Yan Zhai + +[ Upstream commit 1a77557d48cff187a169c2aec01c0dd78a5e7e50 ] + +When under heavy load, network processing can run CPU-bound for many +tens of seconds. Even in preemptible kernels (non-RT kernel), this can +block RCU Tasks grace periods, which can cause trace-event removal to +take more than a minute, which is unacceptably long. + +This commit therefore creates a new helper function that passes through +both RCU and RCU-Tasks quiescent states every 100 milliseconds. This +hard-coded value suffices for current workloads. + +Suggested-by: Paul E. McKenney +Reviewed-by: Jesper Dangaard Brouer +Signed-off-by: Yan Zhai +Reviewed-by: Paul E. McKenney +Acked-by: Jesper Dangaard Brouer +Link: https://lore.kernel.org/r/90431d46ee112d2b0af04dbfe936faaca11810a5.1710877680.git.yan@cloudflare.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: d6dbbb11247c ("net: report RCU QS on threaded NAPI repolling") +Signed-off-by: Sasha Levin +--- + include/linux/rcupdate.h | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h +index 31d523c4e0893..e1bb04e578d8a 100644 +--- a/include/linux/rcupdate.h ++++ b/include/linux/rcupdate.h +@@ -250,6 +250,37 @@ do { \ + cond_resched(); \ + } while (0) + ++/** ++ * rcu_softirq_qs_periodic - Report RCU and RCU-Tasks quiescent states ++ * @old_ts: jiffies at start of processing. ++ * ++ * This helper is for long-running softirq handlers, such as NAPI threads in ++ * networking. The caller should initialize the variable passed in as @old_ts ++ * at the beginning of the softirq handler. When invoked frequently, this macro ++ * will invoke rcu_softirq_qs() every 100 milliseconds thereafter, which will ++ * provide both RCU and RCU-Tasks quiescent states. Note that this macro ++ * modifies its old_ts argument. ++ * ++ * Because regions of code that have disabled softirq act as RCU read-side ++ * critical sections, this macro should be invoked with softirq (and ++ * preemption) enabled. ++ * ++ * The macro is not needed when CONFIG_PREEMPT_RT is defined. RT kernels would ++ * have more chance to invoke schedule() calls and provide necessary quiescent ++ * states. As a contrast, calling cond_resched() only won't achieve the same ++ * effect because cond_resched() does not provide RCU-Tasks quiescent states. ++ */ ++#define rcu_softirq_qs_periodic(old_ts) \ ++do { \ ++ if (!IS_ENABLED(CONFIG_PREEMPT_RT) && \ ++ time_after(jiffies, (old_ts) + HZ / 10)) { \ ++ preempt_disable(); \ ++ rcu_softirq_qs(); \ ++ preempt_enable(); \ ++ (old_ts) = jiffies; \ ++ } \ ++} while (0) ++ + /* + * Infrastructure to implement the synchronize_() primitives in + * TREE_RCU and rcu_barrier_() primitives in TINY_RCU. +-- +2.43.0 + diff --git a/queue-6.7/rds-introduce-acquire-release-ordering-in-acquire-re.patch b/queue-6.7/rds-introduce-acquire-release-ordering-in-acquire-re.patch new file mode 100644 index 00000000000..10452d5a5ab --- /dev/null +++ b/queue-6.7/rds-introduce-acquire-release-ordering-in-acquire-re.patch @@ -0,0 +1,51 @@ +From fd158cbdf6977c845933c2c3e6674f0fb20c6117 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 18:28:38 +0900 +Subject: rds: introduce acquire/release ordering in acquire/release_in_xmit() + +From: Yewon Choi + +[ Upstream commit 1422f28826d2a0c11e5240b3e951c9e214d8656e ] + +acquire/release_in_xmit() work as bit lock in rds_send_xmit(), so they +are expected to ensure acquire/release memory ordering semantics. +However, test_and_set_bit/clear_bit() don't imply such semantics, on +top of this, following smp_mb__after_atomic() does not guarantee release +ordering (memory barrier actually should be placed before clear_bit()). + +Instead, we use clear_bit_unlock/test_and_set_bit_lock() here. + +Fixes: 0f4b1c7e89e6 ("rds: fix rds_send_xmit() serialization") +Fixes: 1f9ecd7eacfd ("RDS: Pass rds_conn_path to rds_send_xmit()") +Signed-off-by: Yewon Choi +Reviewed-by: Michal Kubiak +Link: https://lore.kernel.org/r/ZfQUxnNTO9AJmzwc@libra05 +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/rds/send.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/net/rds/send.c b/net/rds/send.c +index 2899def23865f..09a2801106549 100644 +--- a/net/rds/send.c ++++ b/net/rds/send.c +@@ -103,13 +103,12 @@ EXPORT_SYMBOL_GPL(rds_send_path_reset); + + static int acquire_in_xmit(struct rds_conn_path *cp) + { +- return test_and_set_bit(RDS_IN_XMIT, &cp->cp_flags) == 0; ++ return test_and_set_bit_lock(RDS_IN_XMIT, &cp->cp_flags) == 0; + } + + static void release_in_xmit(struct rds_conn_path *cp) + { +- clear_bit(RDS_IN_XMIT, &cp->cp_flags); +- smp_mb__after_atomic(); ++ clear_bit_unlock(RDS_IN_XMIT, &cp->cp_flags); + /* + * We don't use wait_on_bit()/wake_up_bit() because our waking is in a + * hot path and finding waiters is very rare. We don't want to walk +-- +2.43.0 + diff --git a/queue-6.7/rds-tcp-fix-use-after-free-of-net-in-reqsk_timer_han.patch b/queue-6.7/rds-tcp-fix-use-after-free-of-net-in-reqsk_timer_han.patch new file mode 100644 index 00000000000..7c2d016592c --- /dev/null +++ b/queue-6.7/rds-tcp-fix-use-after-free-of-net-in-reqsk_timer_han.patch @@ -0,0 +1,155 @@ +From 9258af0e74dc9690ed7e20cd9f35f4bfbdf977ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 12:01:22 -0800 +Subject: rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2a750d6a5b365265dbda33330a6188547ddb5c24 ] + +syzkaller reported a warning of netns tracker [0] followed by KASAN +splat [1] and another ref tracker warning [1]. + +syzkaller could not find a repro, but in the log, the only suspicious +sequence was as follows: + + 18:26:22 executing program 1: + r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) + ... + connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4001, 0x0, @loopback}, 0x1c) (async) + +The notable thing here is 0x4001 in connect(), which is RDS_TCP_PORT. + +So, the scenario would be: + + 1. unshare(CLONE_NEWNET) creates a per netns tcp listener in + rds_tcp_listen_init(). + 2. syz-executor connect()s to it and creates a reqsk. + 3. syz-executor exit()s immediately. + 4. netns is dismantled. [0] + 5. reqsk timer is fired, and UAF happens while freeing reqsk. [1] + 6. listener is freed after RCU grace period. [2] + +Basically, reqsk assumes that the listener guarantees netns safety +until all reqsk timers are expired by holding the listener's refcount. +However, this was not the case for kernel sockets. + +Commit 740ea3c4a0b2 ("tcp: Clean up kernel listener's reqsk in +inet_twsk_purge()") fixed this issue only for per-netns ehash. + +Let's apply the same fix for the global ehash. + +[0]: +ref_tracker: net notrefcnt@0000000065449cc3 has 1/1 users at + sk_alloc (./include/net/net_namespace.h:337 net/core/sock.c:2146) + inet6_create (net/ipv6/af_inet6.c:192 net/ipv6/af_inet6.c:119) + __sock_create (net/socket.c:1572) + rds_tcp_listen_init (net/rds/tcp_listen.c:279) + rds_tcp_init_net (net/rds/tcp.c:577) + ops_init (net/core/net_namespace.c:137) + setup_net (net/core/net_namespace.c:340) + copy_net_ns (net/core/net_namespace.c:497) + create_new_namespaces (kernel/nsproxy.c:110) + unshare_nsproxy_namespaces (kernel/nsproxy.c:228 (discriminator 4)) + ksys_unshare (kernel/fork.c:3429) + __x64_sys_unshare (kernel/fork.c:3496) + do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) +... +WARNING: CPU: 0 PID: 27 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179) + +[1]: +BUG: KASAN: slab-use-after-free in inet_csk_reqsk_queue_drop (./include/net/inet_hashtables.h:180 net/ipv4/inet_connection_sock.c:952 net/ipv4/inet_connection_sock.c:966) +Read of size 8 at addr ffff88801b370400 by task swapper/0/0 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +Call Trace: + + dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1)) + print_report (mm/kasan/report.c:378 mm/kasan/report.c:488) + kasan_report (mm/kasan/report.c:603) + inet_csk_reqsk_queue_drop (./include/net/inet_hashtables.h:180 net/ipv4/inet_connection_sock.c:952 net/ipv4/inet_connection_sock.c:966) + reqsk_timer_handler (net/ipv4/inet_connection_sock.c:979 net/ipv4/inet_connection_sock.c:1092) + call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701) + __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2038) + run_timer_softirq (kernel/time/timer.c:2053) + __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554) + irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632 kernel/softirq.c:644) + sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1076 (discriminator 14)) + + +Allocated by task 258 on cpu 0 at 83.612050s: + kasan_save_stack (mm/kasan/common.c:48) + kasan_save_track (mm/kasan/common.c:68) + __kasan_slab_alloc (mm/kasan/common.c:343) + kmem_cache_alloc (mm/slub.c:3813 mm/slub.c:3860 mm/slub.c:3867) + copy_net_ns (./include/linux/slab.h:701 net/core/net_namespace.c:421 net/core/net_namespace.c:480) + create_new_namespaces (kernel/nsproxy.c:110) + unshare_nsproxy_namespaces (kernel/nsproxy.c:228 (discriminator 4)) + ksys_unshare (kernel/fork.c:3429) + __x64_sys_unshare (kernel/fork.c:3496) + do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) + +Freed by task 27 on cpu 0 at 329.158864s: + kasan_save_stack (mm/kasan/common.c:48) + kasan_save_track (mm/kasan/common.c:68) + kasan_save_free_info (mm/kasan/generic.c:643) + __kasan_slab_free (mm/kasan/common.c:265) + kmem_cache_free (mm/slub.c:4299 mm/slub.c:4363) + cleanup_net (net/core/net_namespace.c:456 net/core/net_namespace.c:446 net/core/net_namespace.c:639) + process_one_work (kernel/workqueue.c:2638) + worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787) + kthread (kernel/kthread.c:388) + ret_from_fork (arch/x86/kernel/process.c:153) + ret_from_fork_asm (arch/x86/entry/entry_64.S:250) + +The buggy address belongs to the object at ffff88801b370000 + which belongs to the cache net_namespace of size 4352 +The buggy address is located 1024 bytes inside of + freed 4352-byte region [ffff88801b370000, ffff88801b371100) + +[2]: +WARNING: CPU: 0 PID: 95 at lib/ref_tracker.c:228 ref_tracker_free (lib/ref_tracker.c:228 (discriminator 1)) +Modules linked in: +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +RIP: 0010:ref_tracker_free (lib/ref_tracker.c:228 (discriminator 1)) +... +Call Trace: + + __sk_destruct (./include/net/net_namespace.h:353 net/core/sock.c:2204) + rcu_core (./arch/x86/include/asm/preempt.h:26 kernel/rcu/tree.c:2165 kernel/rcu/tree.c:2433) + __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554) + irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632 kernel/softirq.c:644) + sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1076 (discriminator 14)) + + +Reported-by: syzkaller +Suggested-by: Eric Dumazet +Fixes: 467fa15356ac ("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240308200122.64357-3-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_minisocks.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 9e85f2a0bddd4..0ecc7311dc6ce 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -398,10 +398,6 @@ void tcp_twsk_purge(struct list_head *net_exit_list, int family) + /* Even if tw_refcount == 1, we must clean up kernel reqsk */ + inet_twsk_purge(net->ipv4.tcp_death_row.hashinfo, family); + } else if (!purged_once) { +- /* The last refcount is decremented in tcp_sk_exit_batch() */ +- if (refcount_read(&net->ipv4.tcp_death_row.tw_refcount) == 1) +- continue; +- + inet_twsk_purge(&tcp_hashinfo, family); + purged_once = true; + } +-- +2.43.0 + diff --git a/queue-6.7/remoteproc-stm32-fix-incorrect-type-assignment-retur.patch b/queue-6.7/remoteproc-stm32-fix-incorrect-type-assignment-retur.patch new file mode 100644 index 00000000000..dad216ea953 --- /dev/null +++ b/queue-6.7/remoteproc-stm32-fix-incorrect-type-assignment-retur.patch @@ -0,0 +1,44 @@ +From 9f1779baa3ed1206bdaa501225f0c51be149463c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 14:53:12 +0100 +Subject: remoteproc: stm32: Fix incorrect type assignment returned by + stm32_rproc_get_loaded_rsc_tablef + +From: Arnaud Pouliquen + +[ Upstream commit c77b35ce66af25bdd6fde60b62e35b9b316ea5c2 ] + +The sparse tool complains about the remove of the _iomem attribute. + +stm32_rproc.c:660:17: warning: cast removes address space '__iomem' of expression + +Add '__force' to explicitly specify that the cast is intentional. +This conversion is necessary to cast to addresses pointer, +which are then managed by the remoteproc core as a pointer to a +resource_table structure. + +Fixes: 8a471396d21c ("remoteproc: stm32: Move resource table setup to rproc_ops") +Signed-off-by: Arnaud Pouliquen +Link: https://lore.kernel.org/r/20240117135312.3381936-3-arnaud.pouliquen@foss.st.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/stm32_rproc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c +index 2c28635219ebf..10b442c6f6323 100644 +--- a/drivers/remoteproc/stm32_rproc.c ++++ b/drivers/remoteproc/stm32_rproc.c +@@ -657,7 +657,7 @@ stm32_rproc_get_loaded_rsc_table(struct rproc *rproc, size_t *table_sz) + * entire area by overwriting it with the initial values stored in rproc->clean_table. + */ + *table_sz = RSC_TBL_SIZE; +- return (struct resource_table *)ddata->rsc_va; ++ return (__force struct resource_table *)ddata->rsc_va; + } + + static const struct rproc_ops st_rproc_ops = { +-- +2.43.0 + diff --git a/queue-6.7/remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch b/queue-6.7/remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch new file mode 100644 index 00000000000..6be97ff8bdb --- /dev/null +++ b/queue-6.7/remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch @@ -0,0 +1,56 @@ +From 82b3274f6ecb9ddb941c453813bbe716b9153638 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 14:53:11 +0100 +Subject: remoteproc: stm32: Fix incorrect type in assignment for va + +From: Arnaud Pouliquen + +[ Upstream commit 32381bbccba4c21145c571701f8f7fb1d9b3a92e ] + +The sparse tool complains about the attribute conversion between +a _iomem void * and a void *: + +stm32_rproc.c:122:12: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *va @@ got void [noderef] __iomem * @@ +stm32_rproc.c:122:12: sparse: expected void *va +stm32_rproc.c:122:12: sparse: got void [noderef] __iomem * + +Add '__force' to explicitly specify that the cast is intentional. +This conversion is necessary to cast to virtual addresses pointer,used, +by the remoteproc core. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312150052.HCiNKlqB-lkp@intel.com/ +Fixes: 13140de09cc2 ("remoteproc: stm32: add an ST stm32_rproc driver") +Signed-off-by: Arnaud Pouliquen +Link: https://lore.kernel.org/r/20240117135312.3381936-2-arnaud.pouliquen@foss.st.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/stm32_rproc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c +index 4f469f0bcf8b2..2c28635219ebf 100644 +--- a/drivers/remoteproc/stm32_rproc.c ++++ b/drivers/remoteproc/stm32_rproc.c +@@ -120,7 +120,7 @@ static int stm32_rproc_mem_alloc(struct rproc *rproc, + void *va; + + dev_dbg(dev, "map memory: %pad+%zx\n", &mem->dma, mem->len); +- va = ioremap_wc(mem->dma, mem->len); ++ va = (__force void *)ioremap_wc(mem->dma, mem->len); + if (IS_ERR_OR_NULL(va)) { + dev_err(dev, "Unable to map memory region: %pad+0x%zx\n", + &mem->dma, mem->len); +@@ -137,7 +137,7 @@ static int stm32_rproc_mem_release(struct rproc *rproc, + struct rproc_mem_entry *mem) + { + dev_dbg(rproc->dev.parent, "unmap memory: %pa\n", &mem->dma); +- iounmap(mem->va); ++ iounmap((__force __iomem void *)mem->va); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.7/riscv-fix-compilation-error-with-fast_gup-and-rv32.patch b/queue-6.7/riscv-fix-compilation-error-with-fast_gup-and-rv32.patch new file mode 100644 index 00000000000..0caa6b6929e --- /dev/null +++ b/queue-6.7/riscv-fix-compilation-error-with-fast_gup-and-rv32.patch @@ -0,0 +1,42 @@ +From 8bf2be500f7559f69099b5cab8651ab2d71e93be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 09:02:47 +0100 +Subject: riscv: Fix compilation error with FAST_GUP and rv32 + +From: Alexandre Ghiti + +[ Upstream commit 2bb7e0c49302feec1c2f777bbfe8726169986ed8 ] + +By surrounding the definition of pte_leaf_size() with a ifdef napot as +it should have been. + +Fixes: e0fe5ab4192c ("riscv: Fix pte_leaf_size() for NAPOT") +Signed-off-by: Alexandre Ghiti +Reviewed-by: Randy Dunlap +Tested-by: Randy Dunlap # build-tested +Link: https://lore.kernel.org/r/20240304080247.387710-1-alexghiti@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/pgtable.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h +index 76b131e7bbcad..a66845e31abad 100644 +--- a/arch/riscv/include/asm/pgtable.h ++++ b/arch/riscv/include/asm/pgtable.h +@@ -439,9 +439,11 @@ static inline pte_t pte_mkhuge(pte_t pte) + return pte; + } + ++#ifdef CONFIG_RISCV_ISA_SVNAPOT + #define pte_leaf_size(pte) (pte_napot(pte) ? \ + napot_cont_size(napot_cont_order(pte)) :\ + PAGE_SIZE) ++#endif + + #ifdef CONFIG_NUMA_BALANCING + /* +-- +2.43.0 + diff --git a/queue-6.7/riscv-fix-syscall-wrapper-for-word-size-arguments.patch b/queue-6.7/riscv-fix-syscall-wrapper-for-word-size-arguments.patch new file mode 100644 index 00000000000..d6e1ba50b12 --- /dev/null +++ b/queue-6.7/riscv-fix-syscall-wrapper-for-word-size-arguments.patch @@ -0,0 +1,126 @@ +From 793aeac1c9174dce5a1dc22c8ea70324b497342c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 19:31:44 +0000 +Subject: riscv: Fix syscall wrapper for >word-size arguments + +From: Sami Tolvanen + +[ Upstream commit a9ad73295cc1e3af0253eee7d08943b2419444c4 ] + +The current syscall wrapper macros break 64-bit arguments on +rv32 because they only guarantee the first N input registers are +passed to syscalls that accept N arguments. According to the +calling convention, values twice the word size reside in register +pairs and as a result, syscall arguments don't always have a +direct register mapping on rv32. + +Instead of using `__MAP(x,__SC_LONG,__VA_ARGS__)` to declare the +type of the `__se(_compat)_sys_*` functions on rv32, change the +function declarations to accept `ulong` arguments and alias them +to the actual syscall implementations, similarly to the existing +macros in include/linux/syscalls.h. This matches previous +behavior and ensures registers are passed to syscalls as-is, no +matter which argument types they expect. + +Fixes: 08d0ce30e0e4 ("riscv: Implement syscall wrappers") +Reported-by: Khem Raj +Signed-off-by: Sami Tolvanen +Link: https://lore.kernel.org/r/20240311193143.2981310-2-samitolvanen@google.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/syscall_wrapper.h | 53 +++++++++++++++++------- + 1 file changed, 39 insertions(+), 14 deletions(-) + +diff --git a/arch/riscv/include/asm/syscall_wrapper.h b/arch/riscv/include/asm/syscall_wrapper.h +index eeec04b7dae67..980094c2e9761 100644 +--- a/arch/riscv/include/asm/syscall_wrapper.h ++++ b/arch/riscv/include/asm/syscall_wrapper.h +@@ -12,25 +12,51 @@ + + asmlinkage long __riscv_sys_ni_syscall(const struct pt_regs *); + +-#define SC_RISCV_REGS_TO_ARGS(x, ...) \ +- __MAP(x,__SC_ARGS \ +- ,,regs->orig_a0,,regs->a1,,regs->a2 \ ++#ifdef CONFIG_64BIT ++ ++#define __SYSCALL_SE_DEFINEx(x, prefix, name, ...) \ ++ static long __se_##prefix##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \ ++ static long __se_##prefix##name(__MAP(x,__SC_LONG,__VA_ARGS__)) ++ ++#define SC_RISCV_REGS_TO_ARGS(x, ...) \ ++ __MAP(x,__SC_ARGS \ ++ ,,regs->orig_a0,,regs->a1,,regs->a2 \ + ,,regs->a3,,regs->a4,,regs->a5,,regs->a6) + ++#else ++/* ++ * Use type aliasing to ensure registers a0-a6 are correctly passed to the syscall ++ * implementation when >word-size arguments are used. ++ */ ++#define __SYSCALL_SE_DEFINEx(x, prefix, name, ...) \ ++ __diag_push(); \ ++ __diag_ignore(GCC, 8, "-Wattribute-alias", \ ++ "Type aliasing is used to sanitize syscall arguments"); \ ++ static long __se_##prefix##name(ulong, ulong, ulong, ulong, ulong, ulong, \ ++ ulong) \ ++ __attribute__((alias(__stringify(___se_##prefix##name)))); \ ++ __diag_pop(); \ ++ static long noinline ___se_##prefix##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \ ++ static long ___se_##prefix##name(__MAP(x,__SC_LONG,__VA_ARGS__)) ++ ++#define SC_RISCV_REGS_TO_ARGS(x, ...) \ ++ regs->orig_a0,regs->a1,regs->a2,regs->a3,regs->a4,regs->a5,regs->a6 ++ ++#endif /* CONFIG_64BIT */ ++ + #ifdef CONFIG_COMPAT + + #define COMPAT_SYSCALL_DEFINEx(x, name, ...) \ + asmlinkage long __riscv_compat_sys##name(const struct pt_regs *regs); \ + ALLOW_ERROR_INJECTION(__riscv_compat_sys##name, ERRNO); \ +- static long __se_compat_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \ + static inline long __do_compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)); \ +- asmlinkage long __riscv_compat_sys##name(const struct pt_regs *regs) \ ++ __SYSCALL_SE_DEFINEx(x, compat_sys, name, __VA_ARGS__) \ + { \ +- return __se_compat_sys##name(SC_RISCV_REGS_TO_ARGS(x,__VA_ARGS__)); \ ++ return __do_compat_sys##name(__MAP(x,__SC_DELOUSE,__VA_ARGS__)); \ + } \ +- static long __se_compat_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ ++ asmlinkage long __riscv_compat_sys##name(const struct pt_regs *regs) \ + { \ +- return __do_compat_sys##name(__MAP(x,__SC_DELOUSE,__VA_ARGS__)); \ ++ return __se_compat_sys##name(SC_RISCV_REGS_TO_ARGS(x,__VA_ARGS__)); \ + } \ + static inline long __do_compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) + +@@ -51,19 +77,18 @@ asmlinkage long __riscv_sys_ni_syscall(const struct pt_regs *); + #define __SYSCALL_DEFINEx(x, name, ...) \ + asmlinkage long __riscv_sys##name(const struct pt_regs *regs); \ + ALLOW_ERROR_INJECTION(__riscv_sys##name, ERRNO); \ +- static long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \ + static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)); \ +- asmlinkage long __riscv_sys##name(const struct pt_regs *regs) \ +- { \ +- return __se_sys##name(SC_RISCV_REGS_TO_ARGS(x,__VA_ARGS__)); \ +- } \ +- static long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ ++ __SYSCALL_SE_DEFINEx(x, sys, name, __VA_ARGS__) \ + { \ + long ret = __do_sys##name(__MAP(x,__SC_CAST,__VA_ARGS__)); \ + __MAP(x,__SC_TEST,__VA_ARGS__); \ + __PROTECT(x, ret,__MAP(x,__SC_ARGS,__VA_ARGS__)); \ + return ret; \ + } \ ++ asmlinkage long __riscv_sys##name(const struct pt_regs *regs) \ ++ { \ ++ return __se_sys##name(SC_RISCV_REGS_TO_ARGS(x,__VA_ARGS__)); \ ++ } \ + static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) + + #define SYSCALL_DEFINE0(sname) \ +-- +2.43.0 + diff --git a/queue-6.7/riscv-only-check-online-cpus-for-emulated-accesses.patch b/queue-6.7/riscv-only-check-online-cpus-for-emulated-accesses.patch new file mode 100644 index 00000000000..537797217a4 --- /dev/null +++ b/queue-6.7/riscv-only-check-online-cpus-for-emulated-accesses.patch @@ -0,0 +1,39 @@ +From 4ba3b1046e823b56e41c76a3a77f6c473da8b140 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 10:25:56 -0800 +Subject: riscv: Only check online cpus for emulated accesses + +From: Charlie Jenkins + +[ Upstream commit 313130c62cf1fc410ac8730b291fd4fde582d032 ] + +The unaligned access checker only sets valid values for online cpus. +Check for these values on online cpus rather than on present cpus. + +Signed-off-by: Charlie Jenkins +Reviewed-by: Conor Dooley +Fixes: 71c54b3d169d ("riscv: report misaligned accesses emulation to hwprobe") +Tested-by: Samuel Holland +Link: https://lore.kernel.org/r/20240308-disable_misaligned_probe_config-v9-2-a388770ba0ce@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/traps_misaligned.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/traps_misaligned.c b/arch/riscv/kernel/traps_misaligned.c +index 5255f8134aeff..1ed769c87ae44 100644 +--- a/arch/riscv/kernel/traps_misaligned.c ++++ b/arch/riscv/kernel/traps_misaligned.c +@@ -632,7 +632,7 @@ void unaligned_emulation_finish(void) + * accesses emulated since tasks requesting such control can run on any + * CPU. + */ +- for_each_present_cpu(cpu) { ++ for_each_online_cpu(cpu) { + if (per_cpu(misaligned_access_speed, cpu) != + RISCV_HWPROBE_MISALIGNED_EMULATED) { + return; +-- +2.43.0 + diff --git a/queue-6.7/rtc-mt6397-select-irq_domain-instead-of-depending-on.patch b/queue-6.7/rtc-mt6397-select-irq_domain-instead-of-depending-on.patch new file mode 100644 index 00000000000..e7c25e17795 --- /dev/null +++ b/queue-6.7/rtc-mt6397-select-irq_domain-instead-of-depending-on.patch @@ -0,0 +1,59 @@ +From b9e111cd22c5f3181855c55b0841bfe7fcfcadfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 21:02:58 -0800 +Subject: rtc: mt6397: select IRQ_DOMAIN instead of depending on it + +From: Randy Dunlap + +[ Upstream commit 544c42f798e1651dcb04fb0395219bf0f1c2607e ] + +IRQ_DOMAIN is a hidden (not user visible) symbol. Users cannot set +it directly thru "make *config", so drivers should select it instead +of depending on it if they need it. +Relying on it being set for a dependency is risky. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on" for IRQ_DOMAIN to +"select" for RTC_DRV_MT6397. + +Fixes: 04d3ba70a3c9 ("rtc: mt6397: add IRQ domain dependency") +Cc: Arnd Bergmann +Cc: Eddie Huang +Cc: Sean Wang +Cc: Matthias Brugger +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-mediatek@lists.infradead.org +Cc: Alessandro Zummo +Cc: Alexandre Belloni +Cc: linux-rtc@vger.kernel.org +Cc: Marc Zyngier +Cc: Philipp Zabel +Cc: Peter Rosin +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Randy Dunlap +Link: https://lore.kernel.org/r/20240213050258.6167-1-rdunlap@infradead.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig +index 3814e0845e772..b1e1d277d4593 100644 +--- a/drivers/rtc/Kconfig ++++ b/drivers/rtc/Kconfig +@@ -1832,7 +1832,8 @@ config RTC_DRV_MT2712 + + config RTC_DRV_MT6397 + tristate "MediaTek PMIC based RTC" +- depends on MFD_MT6397 || (COMPILE_TEST && IRQ_DOMAIN) ++ depends on MFD_MT6397 || COMPILE_TEST ++ select IRQ_DOMAIN + help + This selects the MediaTek(R) RTC driver. RTC is part of MediaTek + MT6397 PMIC. You should enable MT6397 PMIC MFD before select +-- +2.43.0 + diff --git a/queue-6.7/s390-vtime-fix-average-steal-time-calculation.patch b/queue-6.7/s390-vtime-fix-average-steal-time-calculation.patch new file mode 100644 index 00000000000..4733911bb5a --- /dev/null +++ b/queue-6.7/s390-vtime-fix-average-steal-time-calculation.patch @@ -0,0 +1,64 @@ +From 009628e823b469fbcb43e7b54b0361d74cfe0805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 12:31:52 +0100 +Subject: s390/vtime: fix average steal time calculation + +From: Mete Durlu + +[ Upstream commit 367c50f78451d3bd7ad70bc5c89f9ba6dec46ca9 ] + +Current average steal timer calculation produces volatile and inflated +values. The only user of this value is KVM so far and it uses that to +decide whether or not to yield the vCPU which is seeing steal time. +KVM compares average steal timer to a threshold and if the threshold +is past then it does not allow CPU polling and yields it to host, else +it keeps the CPU by polling. +Since KVM's steal time threshold is very low by default (%10) it most +likely is not effected much by the bloated average steal timer values +because the operating region is pretty small. However there might be +new users in the future who might rely on this number. Fix average +steal timer calculation by changing the formula from: + + avg_steal_timer = avg_steal_timer / 2 + steal_timer; + +to the following: + + avg_steal_timer = (avg_steal_timer + steal_timer) / 2; + +This ensures that avg_steal_timer is actually a naive average of steal +timer values. It now closely follows steal timer values but of course +in a smoother manner. + +Fixes: 152e9b8676c6 ("s390/vtime: steal time exponential moving average") +Signed-off-by: Mete Durlu +Acked-by: Heiko Carstens +Acked-by: Christian Borntraeger +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vtime.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c +index e0a88dcaf5cb7..24a18e5ef6e8e 100644 +--- a/arch/s390/kernel/vtime.c ++++ b/arch/s390/kernel/vtime.c +@@ -210,13 +210,13 @@ void vtime_flush(struct task_struct *tsk) + virt_timer_expire(); + + steal = S390_lowcore.steal_timer; +- avg_steal = S390_lowcore.avg_steal_timer / 2; ++ avg_steal = S390_lowcore.avg_steal_timer; + if ((s64) steal > 0) { + S390_lowcore.steal_timer = 0; + account_steal_time(cputime_to_nsecs(steal)); + avg_steal += steal; + } +- S390_lowcore.avg_steal_timer = avg_steal; ++ S390_lowcore.avg_steal_timer = avg_steal / 2; + } + + static u64 vtime_delta(void) +-- +2.43.0 + diff --git a/queue-6.7/selftests-forwarding-fix-ping-failure-due-to-short-t.patch b/queue-6.7/selftests-forwarding-fix-ping-failure-due-to-short-t.patch new file mode 100644 index 00000000000..d1b06a86b80 --- /dev/null +++ b/queue-6.7/selftests-forwarding-fix-ping-failure-due-to-short-t.patch @@ -0,0 +1,87 @@ +From b5e1a8eea610c0b67bf18f2ce96e42e9e3e9a9fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 08:57:17 +0200 +Subject: selftests: forwarding: Fix ping failure due to short timeout + +From: Ido Schimmel + +[ Upstream commit e4137851d4863a9bdc6aabc613bcb46c06d91e64 ] + +The tests send 100 pings in 0.1 second intervals and force a timeout of +11 seconds, which is borderline (especially on debug kernels), resulting +in random failures in netdev CI [1]. + +Fix by increasing the timeout to 20 seconds. It should not prolong the +test unless something is wrong, in which case the test will rightfully +fail. + +[1] + # selftests: net/forwarding: vxlan_bridge_1d_port_8472_ipv6.sh + # INFO: Running tests with UDP port 8472 + # TEST: ping: local->local [ OK ] + # TEST: ping: local->remote 1 [FAIL] + # Ping failed + [...] + +Fixes: b07e9957f220 ("selftests: forwarding: Add VxLAN tests with a VLAN-unaware bridge for IPv6") +Fixes: 728b35259e28 ("selftests: forwarding: Add VxLAN tests with a VLAN-aware bridge for IPv6") +Reported-by: Paolo Abeni +Closes: https://lore.kernel.org/netdev/24a7051fdcd1f156c3704bca39e4b3c41dfc7c4b.camel@redhat.com/ +Signed-off-by: Ido Schimmel +Reviewed-by: Hangbin Liu +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20240320065717.4145325-1-idosch@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh | 4 ++-- + .../testing/selftests/net/forwarding/vxlan_bridge_1q_ipv6.sh | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh +index ac97f07e5ce82..bd3f7d492af2b 100755 +--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh ++++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh +@@ -354,7 +354,7 @@ __ping_ipv4() + + # Send 100 packets and verify that at least 100 packets hit the rule, + # to overcome ARP noise. +- PING_COUNT=100 PING_TIMEOUT=11 ping_do $dev $dst_ip ++ PING_COUNT=100 PING_TIMEOUT=20 ping_do $dev $dst_ip + check_err $? "Ping failed" + + tc_check_at_least_x_packets "dev $rp1 egress" 101 10 100 +@@ -410,7 +410,7 @@ __ping_ipv6() + + # Send 100 packets and verify that at least 100 packets hit the rule, + # to overcome neighbor discovery noise. +- PING_COUNT=100 PING_TIMEOUT=11 ping6_do $dev $dst_ip ++ PING_COUNT=100 PING_TIMEOUT=20 ping6_do $dev $dst_ip + check_err $? "Ping failed" + + tc_check_at_least_x_packets "dev $rp1 egress" 101 100 +diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1q_ipv6.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1q_ipv6.sh +index d880df89bc8bd..e83fde79f40d0 100755 +--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1q_ipv6.sh ++++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1q_ipv6.sh +@@ -457,7 +457,7 @@ __ping_ipv4() + + # Send 100 packets and verify that at least 100 packets hit the rule, + # to overcome ARP noise. +- PING_COUNT=100 PING_TIMEOUT=11 ping_do $dev $dst_ip ++ PING_COUNT=100 PING_TIMEOUT=20 ping_do $dev $dst_ip + check_err $? "Ping failed" + + tc_check_at_least_x_packets "dev $rp1 egress" 101 10 100 +@@ -522,7 +522,7 @@ __ping_ipv6() + + # Send 100 packets and verify that at least 100 packets hit the rule, + # to overcome neighbor discovery noise. +- PING_COUNT=100 PING_TIMEOUT=11 ping6_do $dev $dst_ip ++ PING_COUNT=100 PING_TIMEOUT=20 ping6_do $dev $dst_ip + check_err $? "Ping failed" + + tc_check_at_least_x_packets "dev $rp1 egress" 101 100 +-- +2.43.0 + diff --git a/queue-6.7/serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch b/queue-6.7/serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch new file mode 100644 index 00000000000..c2437ed2ad7 --- /dev/null +++ b/queue-6.7/serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch @@ -0,0 +1,49 @@ +From 3260dc5d01a46e89304ae1fdb97719912faea342 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 17:04:57 +0200 +Subject: serial: 8250_exar: Don't remove GPIO device on suspend + +From: Andy Shevchenko + +[ Upstream commit 73b5a5c00be39e23b194bad10e1ea8bb73eee176 ] + +It seems a copy&paste mistake that suspend callback removes the GPIO +device. There is no counterpart of this action, means once suspended +there is no more GPIO device available untile full unbind-bind cycle +is performed. Remove suspicious GPIO device removal in suspend. + +Fixes: d0aeaa83f0b0 ("serial: exar: split out the exar code from 8250_pci") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240219150627.2101198-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_exar.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index 23366f868ae3a..dab94835b6f5f 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -753,6 +753,7 @@ static void exar_pci_remove(struct pci_dev *pcidev) + for (i = 0; i < priv->nr; i++) + serial8250_unregister_port(priv->line[i]); + ++ /* Ensure that every init quirk is properly torn down */ + if (priv->board->exit) + priv->board->exit(pcidev); + } +@@ -767,10 +768,6 @@ static int __maybe_unused exar_suspend(struct device *dev) + if (priv->line[i] >= 0) + serial8250_suspend_port(priv->line[i]); + +- /* Ensure that every init quirk is properly torn down */ +- if (priv->board->exit) +- priv->board->exit(pcidev); +- + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.7/serial-max310x-fix-syntax-error-in-irq-error-message.patch b/queue-6.7/serial-max310x-fix-syntax-error-in-irq-error-message.patch new file mode 100644 index 00000000000..231c4c68f97 --- /dev/null +++ b/queue-6.7/serial-max310x-fix-syntax-error-in-irq-error-message.patch @@ -0,0 +1,40 @@ +From 36685645c5fb9b672e84094445e9555e816f77da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 10:22:01 -0500 +Subject: serial: max310x: fix syntax error in IRQ error message + +From: Hugo Villeneuve + +[ Upstream commit 8ede8c6f474255b2213cccd7997b993272a8e2f9 ] + +Replace g with q. + +Helpful when grepping thru source code or logs for +"request" keyword. + +Fixes: f65444187a66 ("serial: New serial driver MAX310X") +Reviewed-by: Andy Shevchenko +Signed-off-by: Hugo Villeneuve +Link: https://lore.kernel.org/r/20240118152213.2644269-6-hugo@hugovil.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 07f7b48bad13d..5aff179bf2978 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1461,7 +1461,7 @@ static int max310x_probe(struct device *dev, const struct max310x_devtype *devty + if (!ret) + return 0; + +- dev_err(dev, "Unable to reguest IRQ %i\n", irq); ++ dev_err(dev, "Unable to request IRQ %i\n", irq); + + out_uart: + for (i = 0; i < devtype->nr; i++) { +-- +2.43.0 + diff --git a/queue-6.7/series b/queue-6.7/series index 90f202bb892..e3bad62f8de 100644 --- a/queue-6.7/series +++ b/queue-6.7/series @@ -616,3 +616,95 @@ bcachefs-fix-btree_iter_filter_snapshots-on-inodes-btree.patch comedi-comedi_8255-correct-error-in-subdevice-initialization.patch comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch mei-gsc_proxy-match-component-when-gsc-is-on-different-bus.patch +remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch +remoteproc-stm32-fix-incorrect-type-assignment-retur.patch +iio-pressure-mprls0025pa-fix-off-by-one-enum.patch +usb-phy-generic-get-the-vbus-supply.patch +tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch +serial-max310x-fix-syntax-error-in-irq-error-message.patch +tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch +arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switc.patch +coresight-fix-issue-where-a-source-device-s-helpers-.patch +coresight-etm4x-set-skip_power_up-in-etm4_init_arch_.patch +kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch +iio-gts-helper-fix-division-loop.patch +bus-mhi-ep-check-the-correct-variable-in-mhi_ep_regi.patch +hwtracing-hisi_ptt-move-type-check-to-the-beginning-.patch +rtc-mt6397-select-irq_domain-instead-of-depending-on.patch +serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch +staging-greybus-fix-get_channel_from_mode-failure-pa.patch +usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch +char-xilinx_hwicap-fix-null-vs-is_err-bug.patch +x86-hyperv-use-per-cpu-initial-stack-for-vtl-context.patch +asoc-tlv320adc3xxx-don-t-strip-remove-function-when-.patch +thermal-drivers-mediatek-lvts_thermal-fix-a-memory-l.patch +thermal-drivers-qoriq-fix-getting-tmu-range.patch +io_uring-don-t-save-restore-iowait-state.patch +spi-lpspi-avoid-potential-use-after-free-in-probe.patch +asoc-rockchip-i2s-tdm-fix-inaccurate-sampling-rates.patch +nouveau-reset-the-bo-resource-bus-info-after-an-evic.patch +tcp-fix-new_syn_recv-handling-in-inet_twsk_purge.patch +rds-tcp-fix-use-after-free-of-net-in-reqsk_timer_han.patch +octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch +s390-vtime-fix-average-steal-time-calculation.patch +net-sched-taprio-proper-tca_taprio_tc_entry_index-ch.patch +devlink-move-private-netlink-flags-to-c-file.patch +devlink-acquire-device-lock-during-netns-dismantle.patch +devlink-enable-the-use-of-private-flags-in-post_doit.patch +devlink-allow-taking-device-lock-in-pre_doit-operati.patch +devlink-fix-devlink-parallel-commands-processing.patch +riscv-only-check-online-cpus-for-emulated-accesses.patch +soc-fsl-dpio-fix-kcalloc-argument-order.patch +cpufreq-fix-per-policy-boost-behavior-on-socs-using-.patch +io_uring-fix-release-of-pinned-pages-when-__io_uaddr.patch +tcp-fix-refcnt-handling-in-__inet_hash_connect.patch +vmxnet3-fix-missing-reserved-tailroom.patch +hsr-fix-uninit-value-access-in-hsr_get_node.patch +net-txgbe-fix-clk_name-exceed-max_dev_id-limits.patch +nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch +net-mediatek-mtk_eth_soc-clear-mac_mcr_force_link-on.patch +net-ethernet-mtk_eth_soc-fix-ppe-hanging-issue.patch +io_uring-fix-poll_remove-stalled-req-completion.patch +riscv-fix-compilation-error-with-fast_gup-and-rv32.patch +xen-evtchn-avoid-warn-when-unbinding-an-event-channe.patch +xen-events-increment-refcnt-only-if-event-channel-is.patch +packet-annotate-data-races-around-ignore_outgoing.patch +xfrm-allow-udp-encapsulation-only-in-offload-modes.patch +net-veth-do-not-manipulate-gro-when-using-xdp.patch +net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch +spi-spi-imx-fix-off-by-one-in-mx51-cpu-mode-burst-le.patch +drm-fix-drm_fixp2int_round-making-it-add-0.5.patch +vdpa_sim-reset-must-not-run.patch +vdpa-mlx5-allow-cvq-size-changes.patch +virtio-packed-fix-unmap-leak-for-indirect-desc-table.patch +wireguard-receive-annotate-data-race-around-receivin.patch +rds-introduce-acquire-release-ordering-in-acquire-re.patch +hsr-handle-failures-in-module-init.patch +ipv4-raw-fix-sending-packets-from-raw-sockets-via-ip.patch +nouveau-gsp-don-t-check-devinit-disable-on-gsp.patch +ceph-stop-copying-to-iter-at-eof-on-sync-reads.patch +net-phy-fix-phy_read_poll_timeout-argument-type-in-g.patch +dm-integrity-fix-a-memory-leak-when-rechecking-the-d.patch +net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch +devlink-fix-port-new-reply-cmd-type.patch +octeontx2-detect-the-mbox-up-or-down-message-via-reg.patch +octeontx2-pf-wait-till-detach_resources-msg-is-compl.patch +octeontx2-pf-use-default-max_active-works-instead-of.patch +octeontx2-pf-send-up-messages-to-vf-only-when-vf-is-.patch +octeontx2-af-use-separate-handlers-for-interrupts.patch +drm-amdgpu-add-mmhub-3.3.1-support.patch +drm-amdgpu-fix-mmhub-client-id-out-of-bounds-access.patch +drm-amdgpu-drop-setting-buffer-funcs-in-sdma442.patch +riscv-fix-syscall-wrapper-for-word-size-arguments.patch +netfilter-nft_set_pipapo-release-elements-in-clone-o.patch +netfilter-nf_tables-do-not-compare-internal-table-fl.patch +rcu-add-a-helper-to-report-consolidated-flavor-qs.patch +net-report-rcu-qs-on-threaded-napi-repolling.patch +bpf-report-rcu-qs-in-cpumap-kthread.patch +net-dsa-mt7530-fix-link-local-frames-that-ingress-vl.patch +net-dsa-mt7530-fix-handling-of-all-link-local-frames.patch +netfilter-nf_tables-fix-a-memory-leak-in-nf_tables_u.patch +spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch +selftests-forwarding-fix-ping-failure-due-to-short-t.patch +dm-io-support-io-priority.patch +dm-integrity-align-the-outgoing-bio-in-integrity_rec.patch diff --git a/queue-6.7/soc-fsl-dpio-fix-kcalloc-argument-order.patch b/queue-6.7/soc-fsl-dpio-fix-kcalloc-argument-order.patch new file mode 100644 index 00000000000..358947cf934 --- /dev/null +++ b/queue-6.7/soc-fsl-dpio-fix-kcalloc-argument-order.patch @@ -0,0 +1,47 @@ +From 946fdb1bc7975a75b6da602881a6ea0034e69cb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 20:34:36 +0100 +Subject: soc: fsl: dpio: fix kcalloc() argument order + +From: Arnd Bergmann + +[ Upstream commit 72ebb41b88f9d7c10c5e159e0507074af0a22fe2 ] + +A previous bugfix added a call to kcalloc(), which starting in gcc-14 +causes a harmless warning about the argument order: + +drivers/soc/fsl/dpio/dpio-service.c: In function 'dpaa2_io_service_enqueue_multiple_desc_fq': +drivers/soc/fsl/dpio/dpio-service.c:526:29: error: 'kcalloc' sizes specified with 'sizeof' in the earlier argument and not in the later argument [-Werror=calloc-transposed-args] + 526 | ed = kcalloc(sizeof(struct qbman_eq_desc), 32, GFP_KERNEL); + | ^~~~~~ +drivers/soc/fsl/dpio/dpio-service.c:526:29: note: earlier argument should specify number of elements, later size of each element + +Since the two are only multiplied, the order does not change the +behavior, so just fix it now to shut up the compiler warning. + +Dmity independently came up with the same fix. + +Fixes: 5c4a5999b245 ("soc: fsl: dpio: avoid stack usage warning") +Reported-by: Dmitry Antipov +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/dpio/dpio-service.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/fsl/dpio/dpio-service.c b/drivers/soc/fsl/dpio/dpio-service.c +index 1d2b27e3ea63f..b811446e0fa55 100644 +--- a/drivers/soc/fsl/dpio/dpio-service.c ++++ b/drivers/soc/fsl/dpio/dpio-service.c +@@ -523,7 +523,7 @@ int dpaa2_io_service_enqueue_multiple_desc_fq(struct dpaa2_io *d, + struct qbman_eq_desc *ed; + int i, ret; + +- ed = kcalloc(sizeof(struct qbman_eq_desc), 32, GFP_KERNEL); ++ ed = kcalloc(32, sizeof(struct qbman_eq_desc), GFP_KERNEL); + if (!ed) + return -ENOMEM; + +-- +2.43.0 + diff --git a/queue-6.7/spi-lpspi-avoid-potential-use-after-free-in-probe.patch b/queue-6.7/spi-lpspi-avoid-potential-use-after-free-in-probe.patch new file mode 100644 index 00000000000..fb5e509b742 --- /dev/null +++ b/queue-6.7/spi-lpspi-avoid-potential-use-after-free-in-probe.patch @@ -0,0 +1,74 @@ +From df1895d7cd923de98c3619540d4646a3a25a549c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 12:20:48 +0100 +Subject: spi: lpspi: Avoid potential use-after-free in probe() + +From: Alexander Sverdlin + +[ Upstream commit 2ae0ab0143fcc06190713ed81a6486ed0ad3c861 ] + +fsl_lpspi_probe() is allocating/disposing memory manually with +spi_alloc_host()/spi_alloc_target(), but uses +devm_spi_register_controller(). In case of error after the latter call the +memory will be explicitly freed in the probe function by +spi_controller_put() call, but used afterwards by "devm" management outside +probe() (spi_unregister_controller() <- devm_spi_unregister() below). + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070 +... +Call trace: + kernfs_find_ns + kernfs_find_and_get_ns + sysfs_remove_group + sysfs_remove_groups + device_remove_attrs + device_del + spi_unregister_controller + devm_spi_unregister + release_nodes + devres_release_all + really_probe + driver_probe_device + __device_attach_driver + bus_for_each_drv + __device_attach + device_initial_probe + bus_probe_device + deferred_probe_work_func + process_one_work + worker_thread + kthread + ret_from_fork + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Alexander Sverdlin +Link: https://msgid.link/r/20240312112050.2503643-1-alexander.sverdlin@siemens.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 11991eb126364..079035db7dd85 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -830,11 +830,11 @@ static int fsl_lpspi_probe(struct platform_device *pdev) + + is_target = of_property_read_bool((&pdev->dev)->of_node, "spi-slave"); + if (is_target) +- controller = spi_alloc_target(&pdev->dev, +- sizeof(struct fsl_lpspi_data)); ++ controller = devm_spi_alloc_target(&pdev->dev, ++ sizeof(struct fsl_lpspi_data)); + else +- controller = spi_alloc_host(&pdev->dev, +- sizeof(struct fsl_lpspi_data)); ++ controller = devm_spi_alloc_host(&pdev->dev, ++ sizeof(struct fsl_lpspi_data)); + + if (!controller) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.7/spi-spi-imx-fix-off-by-one-in-mx51-cpu-mode-burst-le.patch b/queue-6.7/spi-spi-imx-fix-off-by-one-in-mx51-cpu-mode-burst-le.patch new file mode 100644 index 00000000000..95c5b849fea --- /dev/null +++ b/queue-6.7/spi-spi-imx-fix-off-by-one-in-mx51-cpu-mode-burst-le.patch @@ -0,0 +1,45 @@ +From 8c8b028b36f36e1adde58f7089a599f0dcbbe88d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 17:50:52 +0000 +Subject: spi: spi-imx: fix off-by-one in mx51 CPU mode burst length + +From: Adam Butcher + +[ Upstream commit cf6d79a0f5769b5f4d9579ddaf88d2c30b03b873 ] + +c712c05e46c8 ("spi: imx: fix the burst length at DMA mode and CPU mode") +corrects three cases of setting the ECSPI burst length but erroneously +leaves the in-range CPU case one bit to big (in that field a value of +0 means 1 bit). The effect was that transmissions that should have been +8-bit bytes appeared as 9-bit causing failed communication with SPI +devices. + +Link: https://lore.kernel.org/all/20240201105451.507005-1-carlos.song@nxp.com/ +Link: https://lore.kernel.org/all/20240204091912.36488-1-carlos.song@nxp.com/ +Fixes: c712c05e46c8 ("spi: imx: fix the burst length at DMA mode and CPU mode") +Signed-off-by: Adam Butcher +Link: https://msgid.link/r/20240318175119.3334-1-adam@jessamine.co.uk +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index e2d3e3ec13789..0e479c5406217 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -668,8 +668,8 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx, + ctrl |= (MX51_ECSPI_CTRL_MAX_BURST * BITS_PER_BYTE - 1) + << MX51_ECSPI_CTRL_BL_OFFSET; + else +- ctrl |= spi_imx->count / DIV_ROUND_UP(spi_imx->bits_per_word, +- BITS_PER_BYTE) * spi_imx->bits_per_word ++ ctrl |= (spi_imx->count / DIV_ROUND_UP(spi_imx->bits_per_word, ++ BITS_PER_BYTE) * spi_imx->bits_per_word - 1) + << MX51_ECSPI_CTRL_BL_OFFSET; + } + } +-- +2.43.0 + diff --git a/queue-6.7/spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch b/queue-6.7/spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch new file mode 100644 index 00000000000..fad73825b0b --- /dev/null +++ b/queue-6.7/spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch @@ -0,0 +1,61 @@ +From 13a150e057c4a5ed95fcb67373ca54cd65d470c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 15:08:57 +0800 +Subject: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler + +From: Fei Shao + +[ Upstream commit a20ad45008a7c82f1184dc6dee280096009ece55 ] + +The TX buffer in spi_transfer can be a NULL pointer, so the interrupt +handler may end up writing to the invalid memory and cause crashes. + +Add a check to trans->tx_buf before using it. + +Fixes: 1ce24864bff4 ("spi: mediatek: Only do dma for 4-byte aligned buffers") +Signed-off-by: Fei Shao +Reviewed-by: AngeloGioacchino Del Regno +Link: https://msgid.link/r/20240321070942.1587146-2-fshao@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mt65xx.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c +index 8d5d170d49cc4..109dac2e69df2 100644 +--- a/drivers/spi/spi-mt65xx.c ++++ b/drivers/spi/spi-mt65xx.c +@@ -787,17 +787,19 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id) + mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len); + mtk_spi_setup_packet(host); + +- cnt = mdata->xfer_len / 4; +- iowrite32_rep(mdata->base + SPI_TX_DATA_REG, +- trans->tx_buf + mdata->num_xfered, cnt); ++ if (trans->tx_buf) { ++ cnt = mdata->xfer_len / 4; ++ iowrite32_rep(mdata->base + SPI_TX_DATA_REG, ++ trans->tx_buf + mdata->num_xfered, cnt); + +- remainder = mdata->xfer_len % 4; +- if (remainder > 0) { +- reg_val = 0; +- memcpy(®_val, +- trans->tx_buf + (cnt * 4) + mdata->num_xfered, +- remainder); +- writel(reg_val, mdata->base + SPI_TX_DATA_REG); ++ remainder = mdata->xfer_len % 4; ++ if (remainder > 0) { ++ reg_val = 0; ++ memcpy(®_val, ++ trans->tx_buf + (cnt * 4) + mdata->num_xfered, ++ remainder); ++ writel(reg_val, mdata->base + SPI_TX_DATA_REG); ++ } + } + + mtk_spi_enable_transfer(host); +-- +2.43.0 + diff --git a/queue-6.7/staging-greybus-fix-get_channel_from_mode-failure-pa.patch b/queue-6.7/staging-greybus-fix-get_channel_from_mode-failure-pa.patch new file mode 100644 index 00000000000..d2fdc4a9f85 --- /dev/null +++ b/queue-6.7/staging-greybus-fix-get_channel_from_mode-failure-pa.patch @@ -0,0 +1,54 @@ +From f26afca31bbdc69158c850748b873d1bb3d85258 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 10:04:48 +0300 +Subject: staging: greybus: fix get_channel_from_mode() failure path + +From: Dan Carpenter + +[ Upstream commit 34164202a5827f60a203ca9acaf2d9f7d432aac8 ] + +The get_channel_from_mode() function is supposed to return the channel +which matches the mode. But it has a bug where if it doesn't find a +matching channel then it returns the last channel. It should return +NULL instead. + +Also remove an unnecessary NULL check on "channel". + +Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") +Signed-off-by: Dan Carpenter +Reviewed-by: Rui Miguel Silva +Reviewed-by: Alex Elder +Link: https://lore.kernel.org/r/379c0cb4-39e0-4293-8a18-c7b1298e5420@moroto.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/light.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c +index 87d36948c6106..c6bd86a5335ab 100644 +--- a/drivers/staging/greybus/light.c ++++ b/drivers/staging/greybus/light.c +@@ -100,15 +100,15 @@ static struct led_classdev *get_channel_cdev(struct gb_channel *channel) + static struct gb_channel *get_channel_from_mode(struct gb_light *light, + u32 mode) + { +- struct gb_channel *channel = NULL; ++ struct gb_channel *channel; + int i; + + for (i = 0; i < light->channels_count; i++) { + channel = &light->channels[i]; +- if (channel && channel->mode == mode) +- break; ++ if (channel->mode == mode) ++ return channel; + } +- return channel; ++ return NULL; + } + + static int __gb_lights_flash_intensity_set(struct gb_channel *channel, +-- +2.43.0 + diff --git a/queue-6.7/tcp-fix-new_syn_recv-handling-in-inet_twsk_purge.patch b/queue-6.7/tcp-fix-new_syn_recv-handling-in-inet_twsk_purge.patch new file mode 100644 index 00000000000..828c2fa09c3 --- /dev/null +++ b/queue-6.7/tcp-fix-new_syn_recv-handling-in-inet_twsk_purge.patch @@ -0,0 +1,116 @@ +From 75480540c5bb9a2409b6d9ee0bcc43da2b8f8cb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 12:01:21 -0800 +Subject: tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() + +From: Eric Dumazet + +[ Upstream commit 1c4e97dd2d3c9a3e84f7e26346aa39bc426d3249 ] + +inet_twsk_purge() uses rcu to find TIME_WAIT and NEW_SYN_RECV +objects to purge. + +These objects use SLAB_TYPESAFE_BY_RCU semantic and need special +care. We need to use refcount_inc_not_zero(&sk->sk_refcnt). + +Reuse the existing correct logic I wrote for TIME_WAIT, +because both structures have common locations for +sk_state, sk_family, and netns pointer. + +If after the refcount_inc_not_zero() the object fields longer match +the keys, use sock_gen_put(sk) to release the refcount. + +Then we can call inet_twsk_deschedule_put() for TIME_WAIT, +inet_csk_reqsk_queue_drop_and_put() for NEW_SYN_RECV sockets, +with BH disabled. + +Then we need to restart the loop because we had drop rcu_read_lock(). + +Fixes: 740ea3c4a0b2 ("tcp: Clean up kernel listener's reqsk in inet_twsk_purge()") +Link: https://lore.kernel.org/netdev/CANn89iLvFuuihCtt9PME2uS1WJATnf5fKjDToa1WzVnRzHnPfg@mail.gmail.com/T/#u +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240308200122.64357-2-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_timewait_sock.c | 41 ++++++++++++++++------------------- + 1 file changed, 19 insertions(+), 22 deletions(-) + +diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c +index dd37a5bf68811..757ae3a4e2f1a 100644 +--- a/net/ipv4/inet_timewait_sock.c ++++ b/net/ipv4/inet_timewait_sock.c +@@ -278,12 +278,12 @@ void __inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo, bool rearm) + } + EXPORT_SYMBOL_GPL(__inet_twsk_schedule); + ++/* Remove all non full sockets (TIME_WAIT and NEW_SYN_RECV) for dead netns */ + void inet_twsk_purge(struct inet_hashinfo *hashinfo, int family) + { +- struct inet_timewait_sock *tw; +- struct sock *sk; + struct hlist_nulls_node *node; + unsigned int slot; ++ struct sock *sk; + + for (slot = 0; slot <= hashinfo->ehash_mask; slot++) { + struct inet_ehash_bucket *head = &hashinfo->ehash[slot]; +@@ -292,38 +292,35 @@ void inet_twsk_purge(struct inet_hashinfo *hashinfo, int family) + rcu_read_lock(); + restart: + sk_nulls_for_each_rcu(sk, node, &head->chain) { +- if (sk->sk_state != TCP_TIME_WAIT) { +- /* A kernel listener socket might not hold refcnt for net, +- * so reqsk_timer_handler() could be fired after net is +- * freed. Userspace listener and reqsk never exist here. +- */ +- if (unlikely(sk->sk_state == TCP_NEW_SYN_RECV && +- hashinfo->pernet)) { +- struct request_sock *req = inet_reqsk(sk); +- +- inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, req); +- } ++ int state = inet_sk_state_load(sk); + ++ if ((1 << state) & ~(TCPF_TIME_WAIT | ++ TCPF_NEW_SYN_RECV)) + continue; +- } + +- tw = inet_twsk(sk); +- if ((tw->tw_family != family) || +- refcount_read(&twsk_net(tw)->ns.count)) ++ if (sk->sk_family != family || ++ refcount_read(&sock_net(sk)->ns.count)) + continue; + +- if (unlikely(!refcount_inc_not_zero(&tw->tw_refcnt))) ++ if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt))) + continue; + +- if (unlikely((tw->tw_family != family) || +- refcount_read(&twsk_net(tw)->ns.count))) { +- inet_twsk_put(tw); ++ if (unlikely(sk->sk_family != family || ++ refcount_read(&sock_net(sk)->ns.count))) { ++ sock_gen_put(sk); + goto restart; + } + + rcu_read_unlock(); + local_bh_disable(); +- inet_twsk_deschedule_put(tw); ++ if (state == TCP_TIME_WAIT) { ++ inet_twsk_deschedule_put(inet_twsk(sk)); ++ } else { ++ struct request_sock *req = inet_reqsk(sk); ++ ++ inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, ++ req); ++ } + local_bh_enable(); + goto restart_rcu; + } +-- +2.43.0 + diff --git a/queue-6.7/tcp-fix-refcnt-handling-in-__inet_hash_connect.patch b/queue-6.7/tcp-fix-refcnt-handling-in-__inet_hash_connect.patch new file mode 100644 index 00000000000..fb33f878e8e --- /dev/null +++ b/queue-6.7/tcp-fix-refcnt-handling-in-__inet_hash_connect.patch @@ -0,0 +1,92 @@ +From 685b2fa9231cf9418bf33e7105f4d8ab4abb99e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 12:16:23 -0800 +Subject: tcp: Fix refcnt handling in __inet_hash_connect(). + +From: Kuniyuki Iwashima + +[ Upstream commit 04d9d1fc428ac9f581d55118d67e0cb546701feb ] + +syzbot reported a warning in sk_nulls_del_node_init_rcu(). + +The commit 66b60b0c8c4a ("dccp/tcp: Unhash sk from ehash for tb2 alloc +failure after check_estalblished().") tried to fix an issue that an +unconnected socket occupies an ehash entry when bhash2 allocation fails. + +In such a case, we need to revert changes done by check_established(), +which does not hold refcnt when inserting socket into ehash. + +So, to revert the change, we need to __sk_nulls_add_node_rcu() instead +of sk_nulls_add_node_rcu(). + +Otherwise, sock_put() will cause refcnt underflow and leak the socket. + +[0]: +WARNING: CPU: 0 PID: 23948 at include/net/sock.h:799 sk_nulls_del_node_init_rcu+0x166/0x1a0 include/net/sock.h:799 +Modules linked in: +CPU: 0 PID: 23948 Comm: syz-executor.2 Not tainted 6.8.0-rc6-syzkaller-00159-gc055fc00c07b #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 +RIP: 0010:sk_nulls_del_node_init_rcu+0x166/0x1a0 include/net/sock.h:799 +Code: e8 7f 71 c6 f7 83 fb 02 7c 25 e8 35 6d c6 f7 4d 85 f6 0f 95 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 1b 6d c6 f7 90 <0f> 0b 90 eb b2 e8 10 6d c6 f7 4c 89 e7 be 04 00 00 00 e8 63 e7 d2 +RSP: 0018:ffffc900032d7848 EFLAGS: 00010246 +RAX: ffffffff89cd0035 RBX: 0000000000000001 RCX: 0000000000040000 +RDX: ffffc90004de1000 RSI: 000000000003ffff RDI: 0000000000040000 +RBP: 1ffff1100439ac26 R08: ffffffff89ccffe3 R09: 1ffff1100439ac28 +R10: dffffc0000000000 R11: ffffed100439ac29 R12: ffff888021cd6140 +R13: dffffc0000000000 R14: ffff88802a9bf5c0 R15: ffff888021cd6130 +FS: 00007f3b823f16c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f3b823f0ff8 CR3: 000000004674a000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + __inet_hash_connect+0x140f/0x20b0 net/ipv4/inet_hashtables.c:1139 + dccp_v6_connect+0xcb9/0x1480 net/dccp/ipv6.c:956 + __inet_stream_connect+0x262/0xf30 net/ipv4/af_inet.c:678 + inet_stream_connect+0x65/0xa0 net/ipv4/af_inet.c:749 + __sys_connect_file net/socket.c:2048 [inline] + __sys_connect+0x2df/0x310 net/socket.c:2065 + __do_sys_connect net/socket.c:2075 [inline] + __se_sys_connect net/socket.c:2072 [inline] + __x64_sys_connect+0x7a/0x90 net/socket.c:2072 + do_syscall_64+0xf9/0x240 + entry_SYSCALL_64_after_hwframe+0x6f/0x77 +RIP: 0033:0x7f3b8167dda9 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f3b823f10c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a +RAX: ffffffffffffffda RBX: 00007f3b817abf80 RCX: 00007f3b8167dda9 +RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003 +RBP: 00007f3b823f1120 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 +R13: 000000000000000b R14: 00007f3b817abf80 R15: 00007ffd3beb57b8 + + +Reported-by: syzbot+12c506c1aae251e70449@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=12c506c1aae251e70449 +Fixes: 66b60b0c8c4a ("dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240308201623.65448-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_hashtables.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 9456bf9e2705b..7967ff7e02f79 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -1137,7 +1137,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, + sock_prot_inuse_add(net, sk->sk_prot, -1); + + spin_lock(lock); +- sk_nulls_del_node_init_rcu(sk); ++ __sk_nulls_del_node_init_rcu(sk); + spin_unlock(lock); + + sk->sk_hash = 0; +-- +2.43.0 + diff --git a/queue-6.7/thermal-drivers-mediatek-lvts_thermal-fix-a-memory-l.patch b/queue-6.7/thermal-drivers-mediatek-lvts_thermal-fix-a-memory-l.patch new file mode 100644 index 00000000000..64568e804e1 --- /dev/null +++ b/queue-6.7/thermal-drivers-mediatek-lvts_thermal-fix-a-memory-l.patch @@ -0,0 +1,43 @@ +From 33be4f66b6dd7185c80685b75157d9e6c3ecbe94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 09:38:10 +0100 +Subject: thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error + handling path + +From: Christophe JAILLET + +[ Upstream commit ca93bf607a44c1f009283dac4af7df0d9ae5e357 ] + +If devm_krealloc() fails, then 'efuse' is leaking. +So free it to avoid a leak. + +Fixes: f5f633b18234 ("thermal/drivers/mediatek: Add the Low Voltage Thermal Sensor driver") +Signed-off-by: Christophe JAILLET +Reviewed-by: Matthias Brugger +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/481d345233862d58c3c305855a93d0dbc2bbae7e.1706431063.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/thermal/mediatek/lvts_thermal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/mediatek/lvts_thermal.c b/drivers/thermal/mediatek/lvts_thermal.c +index 98d9c80bd4c62..fd4bd650c77a6 100644 +--- a/drivers/thermal/mediatek/lvts_thermal.c ++++ b/drivers/thermal/mediatek/lvts_thermal.c +@@ -719,8 +719,10 @@ static int lvts_calibration_read(struct device *dev, struct lvts_domain *lvts_td + + lvts_td->calib = devm_krealloc(dev, lvts_td->calib, + lvts_td->calib_len + len, GFP_KERNEL); +- if (!lvts_td->calib) ++ if (!lvts_td->calib) { ++ kfree(efuse); + return -ENOMEM; ++ } + + memcpy(lvts_td->calib + lvts_td->calib_len, efuse, len); + +-- +2.43.0 + diff --git a/queue-6.7/thermal-drivers-qoriq-fix-getting-tmu-range.patch b/queue-6.7/thermal-drivers-qoriq-fix-getting-tmu-range.patch new file mode 100644 index 00000000000..14ea30311bf --- /dev/null +++ b/queue-6.7/thermal-drivers-qoriq-fix-getting-tmu-range.patch @@ -0,0 +1,80 @@ +From 579b0c500286d3c19286997969cd05ad968ac8cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 08:36:57 +0800 +Subject: thermal/drivers/qoriq: Fix getting tmu range + +From: Peng Fan + +[ Upstream commit 4d0642074c67ed9928e9d68734ace439aa06e403 ] + +TMU Version 1 has 4 TTRCRs, while TMU Version >=2 has 16 TTRCRs. +So limit the len to 4 will report "invalid range data" for i.MX93. + +This patch drop the local array with allocated ttrcr array and +able to support larger tmu ranges. + +Fixes: f12d60c81fce ("thermal/drivers/qoriq: Support version 2.1") +Tested-by: Sascha Hauer +Signed-off-by: Peng Fan +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20240226003657.3012880-1-peng.fan@oss.nxp.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qoriq_thermal.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/qoriq_thermal.c b/drivers/thermal/qoriq_thermal.c +index ccc2eea7f9f54..404f01cca4dab 100644 +--- a/drivers/thermal/qoriq_thermal.c ++++ b/drivers/thermal/qoriq_thermal.c +@@ -57,6 +57,9 @@ + #define REGS_TTRnCR(n) (0xf10 + 4 * (n)) /* Temperature Range n + * Control Register + */ ++#define NUM_TTRCR_V1 4 ++#define NUM_TTRCR_MAX 16 ++ + #define REGS_IPBRR(n) (0xbf8 + 4 * (n)) /* IP Block Revision + * Register n + */ +@@ -71,6 +74,7 @@ struct qoriq_sensor { + + struct qoriq_tmu_data { + int ver; ++ u32 ttrcr[NUM_TTRCR_MAX]; + struct regmap *regmap; + struct clk *clk; + struct qoriq_sensor sensor[SITES_MAX]; +@@ -182,17 +186,17 @@ static int qoriq_tmu_calibration(struct device *dev, + struct qoriq_tmu_data *data) + { + int i, val, len; +- u32 range[4]; + const u32 *calibration; + struct device_node *np = dev->of_node; + + len = of_property_count_u32_elems(np, "fsl,tmu-range"); +- if (len < 0 || len > 4) { ++ if (len < 0 || (data->ver == TMU_VER1 && len > NUM_TTRCR_V1) || ++ (data->ver > TMU_VER1 && len > NUM_TTRCR_MAX)) { + dev_err(dev, "invalid range data.\n"); + return len; + } + +- val = of_property_read_u32_array(np, "fsl,tmu-range", range, len); ++ val = of_property_read_u32_array(np, "fsl,tmu-range", data->ttrcr, len); + if (val != 0) { + dev_err(dev, "failed to read range data.\n"); + return val; +@@ -200,7 +204,7 @@ static int qoriq_tmu_calibration(struct device *dev, + + /* Init temperature range registers */ + for (i = 0; i < len; i++) +- regmap_write(data->regmap, REGS_TTRnCR(i), range[i]); ++ regmap_write(data->regmap, REGS_TTRnCR(i), data->ttrcr[i]); + + calibration = of_get_property(np, "fsl,tmu-calibration", &len); + if (calibration == NULL || len % 8) { +-- +2.43.0 + diff --git a/queue-6.7/tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch b/queue-6.7/tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch new file mode 100644 index 00000000000..5652d45d2eb --- /dev/null +++ b/queue-6.7/tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch @@ -0,0 +1,45 @@ +From 5130199136ed494bf695241dd046209a2a9227d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 10:45:08 +0000 +Subject: tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT + +From: Tudor Ambarus + +[ Upstream commit 314c2b399288f0058a8c5b6683292cbde5f1531b ] + +The core expects for tx_empty() either TIOCSER_TEMT when the tx is +empty or 0 otherwise. s3c24xx_serial_txempty_nofifo() might return +0x4, and at least uart_get_lsr_info() tries to clear exactly +TIOCSER_TEMT (BIT(1)). Fix tx_empty() to return TIOCSER_TEMT. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Tudor Ambarus +Reviewed-by: Sam Protsenko +Link: https://lore.kernel.org/r/20240119104526.1221243-2-tudor.ambarus@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/samsung_tty.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/samsung_tty.c b/drivers/tty/serial/samsung_tty.c +index 3bd552841cd28..06d140c9f56cf 100644 +--- a/drivers/tty/serial/samsung_tty.c ++++ b/drivers/tty/serial/samsung_tty.c +@@ -987,11 +987,10 @@ static unsigned int s3c24xx_serial_tx_empty(struct uart_port *port) + if ((ufstat & info->tx_fifomask) != 0 || + (ufstat & info->tx_fifofull)) + return 0; +- +- return 1; ++ return TIOCSER_TEMT; + } + +- return s3c24xx_serial_txempty_nofifo(port); ++ return s3c24xx_serial_txempty_nofifo(port) ? TIOCSER_TEMT : 0; + } + + /* no modem control lines */ +-- +2.43.0 + diff --git a/queue-6.7/tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch b/queue-6.7/tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch new file mode 100644 index 00000000000..9ec45df23cb --- /dev/null +++ b/queue-6.7/tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch @@ -0,0 +1,45 @@ +From 702e7b073143113f2c1994da495fccf1d3c5a20c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 12:03:17 +0100 +Subject: tty: vt: fix 20 vs 0x20 typo in EScsiignore + +From: Jiri Slaby (SUSE) + +[ Upstream commit 0e6a92f67c8a94707f7bb27ac29e2bdf3e7c167d ] + +The if (c >= 20 && c <= 0x3f) test added in commit 7a99565f8732 is +wrong. 20 is DC4 in ascii and it makes no sense to consider that as the +bottom limit. Instead, it should be 0x20 as in the other test in +the commit above. This is supposed to NOT change anything as we handle +interesting 20-0x20 asciis far before this if. + +So for sakeness, change to 0x20 (which is SPACE). + +Signed-off-by: "Jiri Slaby (SUSE)" +Fixes: 7a99565f8732 ("vt: ignore csi sequences with intermediate characters.") +Cc: Martin Hostettler +Link: https://lore.kernel.org/all/ZaP45QY2WEsDqoxg@neutronstar.dyndns.org/ +Tested-by: Helge Deller # parisc STI console +Link: https://lore.kernel.org/r/20240122110401.7289-4-jirislaby@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/vt/vt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 156efda7c80d6..6617d3a8e84c9 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -2469,7 +2469,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) + } + return; + case EScsiignore: +- if (c >= 20 && c <= 0x3f) ++ if (c >= 0x20 && c <= 0x3f) + return; + vc->vc_state = ESnormal; + return; +-- +2.43.0 + diff --git a/queue-6.7/usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch b/queue-6.7/usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch new file mode 100644 index 00000000000..e5fadf926b4 --- /dev/null +++ b/queue-6.7/usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch @@ -0,0 +1,47 @@ +From d2505cc7fb5df3d42b54cb0b4e74e3dcdd0012e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 18:17:34 +0000 +Subject: usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Colin Ian King + +[ Upstream commit 600556809f04eb3bbccd05218215dcd7b285a9a9 ] + +Currently the variable irqflags is being set but is not being used, +it appears it should be used in the call to net2272_probe_fin +rather than IRQF_TRIGGER_LOW being used. Kudos to Uwe Kleine-König +for suggesting the fix. + +Cleans up clang scan build warning: +drivers/usb/gadget/udc/net2272.c:2610:15: warning: variable 'irqflags' +set but not used [-Wunused-but-set-variable] + +Fixes: ceb80363b2ec ("USB: net2272: driver for PLX NET2272 USB device controller") +Signed-off-by: Colin Ian King +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20240307181734.2034407-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/net2272.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c +index 12e76bb62c209..19bbc38f3d35d 100644 +--- a/drivers/usb/gadget/udc/net2272.c ++++ b/drivers/usb/gadget/udc/net2272.c +@@ -2650,7 +2650,7 @@ net2272_plat_probe(struct platform_device *pdev) + goto err_req; + } + +- ret = net2272_probe_fin(dev, IRQF_TRIGGER_LOW); ++ ret = net2272_probe_fin(dev, irqflags); + if (ret) + goto err_io; + +-- +2.43.0 + diff --git a/queue-6.7/usb-phy-generic-get-the-vbus-supply.patch b/queue-6.7/usb-phy-generic-get-the-vbus-supply.patch new file mode 100644 index 00000000000..5079e12a2aa --- /dev/null +++ b/queue-6.7/usb-phy-generic-get-the-vbus-supply.patch @@ -0,0 +1,43 @@ +From 14e4a42ec750f33584cf8aacdcc2f50278363a64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 17:51:09 -0500 +Subject: usb: phy: generic: Get the vbus supply + +From: Sean Anderson + +[ Upstream commit 75fd6485cccef269ac9eb3b71cf56753341195ef ] + +While support for working with a vbus was added, the regulator was never +actually gotten (despite what was documented). Fix this by actually +getting the supply from the device tree. + +Fixes: 7acc9973e3c4 ("usb: phy: generic: add vbus support") +Signed-off-by: Sean Anderson +Link: https://lore.kernel.org/r/20240123225111.1629405-3-sean.anderson@seco.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-generic.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c +index 770081b828a42..b855d291dfe6b 100644 +--- a/drivers/usb/phy/phy-generic.c ++++ b/drivers/usb/phy/phy-generic.c +@@ -268,6 +268,13 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_generic *nop) + return dev_err_probe(dev, PTR_ERR(nop->vbus_draw), + "could not get vbus regulator\n"); + ++ nop->vbus_draw = devm_regulator_get_exclusive(dev, "vbus"); ++ if (PTR_ERR(nop->vbus_draw) == -ENODEV) ++ nop->vbus_draw = NULL; ++ if (IS_ERR(nop->vbus_draw)) ++ return dev_err_probe(dev, PTR_ERR(nop->vbus_draw), ++ "could not get vbus regulator\n"); ++ + nop->dev = dev; + nop->phy.dev = nop->dev; + nop->phy.label = "nop-xceiv"; +-- +2.43.0 + diff --git a/queue-6.7/vdpa-mlx5-allow-cvq-size-changes.patch b/queue-6.7/vdpa-mlx5-allow-cvq-size-changes.patch new file mode 100644 index 00000000000..ec73c43f817 --- /dev/null +++ b/queue-6.7/vdpa-mlx5-allow-cvq-size-changes.patch @@ -0,0 +1,83 @@ +From 67d9a9fcb5e323e8d1757eb98170708436c0af97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 09:25:02 -0500 +Subject: vdpa/mlx5: Allow CVQ size changes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonah Palmer + +[ Upstream commit 749a4016839270163efc36ecddddd01de491a16b ] + +The MLX driver was not updating its control virtqueue size at set_vq_num +and instead always initialized to MLX5_CVQ_MAX_ENT (16) at +setup_cvq_vring. + +Qemu would try to set the size to 64 by default, however, because the +CVQ size always was initialized to 16, an error would be thrown when +sending >16 control messages (as used-ring entry 17 is initialized to 0). +For example, starting a guest with x-svq=on and then executing the +following command would produce the error below: + + # for i in {1..20}; do ifconfig eth0 hw ether XX:xx:XX:xx:XX:XX; done + + qemu-system-x86_64: Insufficient written data (0) + [ 435.331223] virtio_net virtio0: Failed to set mac address by vq command. + SIOCSIFHWADDR: Invalid argument + +Acked-by: Dragos Tatulea +Acked-by: Eugenio Pérez +Signed-off-by: Jonah Palmer +Message-Id: <20240216142502.78095-1-jonah.palmer@oracle.com> +Signed-off-by: Michael S. Tsirkin +Tested-by: Lei Yang +Fixes: 5262912ef3cf ("vdpa/mlx5: Add support for control VQ and MAC setting") +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index 26ba7da6b4106..7795d2b7fcd1c 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -145,8 +145,6 @@ static void teardown_driver(struct mlx5_vdpa_net *ndev); + + static bool mlx5_vdpa_debug; + +-#define MLX5_CVQ_MAX_ENT 16 +- + #define MLX5_LOG_VIO_FLAG(_feature) \ + do { \ + if (features & BIT_ULL(_feature)) \ +@@ -2147,9 +2145,16 @@ static void mlx5_vdpa_set_vq_num(struct vdpa_device *vdev, u16 idx, u32 num) + struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev); + struct mlx5_vdpa_virtqueue *mvq; + +- if (!is_index_valid(mvdev, idx) || is_ctrl_vq_idx(mvdev, idx)) ++ if (!is_index_valid(mvdev, idx)) + return; + ++ if (is_ctrl_vq_idx(mvdev, idx)) { ++ struct mlx5_control_vq *cvq = &mvdev->cvq; ++ ++ cvq->vring.vring.num = num; ++ return; ++ } ++ + mvq = &ndev->vqs[idx]; + mvq->num_ent = num; + } +@@ -2819,7 +2824,7 @@ static int setup_cvq_vring(struct mlx5_vdpa_dev *mvdev) + u16 idx = cvq->vring.last_avail_idx; + + err = vringh_init_iotlb(&cvq->vring, mvdev->actual_features, +- MLX5_CVQ_MAX_ENT, false, ++ cvq->vring.vring.num, false, + (struct vring_desc *)(uintptr_t)cvq->desc_addr, + (struct vring_avail *)(uintptr_t)cvq->driver_addr, + (struct vring_used *)(uintptr_t)cvq->device_addr); +-- +2.43.0 + diff --git a/queue-6.7/vdpa_sim-reset-must-not-run.patch b/queue-6.7/vdpa_sim-reset-must-not-run.patch new file mode 100644 index 00000000000..bac4126d7f5 --- /dev/null +++ b/queue-6.7/vdpa_sim-reset-must-not-run.patch @@ -0,0 +1,52 @@ +From dca36972ec3782412b98ec21a70d3668b9192cd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 14:30:07 -0800 +Subject: vdpa_sim: reset must not run +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steve Sistare + +[ Upstream commit 9588e7fc511f9c55b9835f14916e90ab940061b7 ] + +vdpasim_do_reset sets running to true, which is wrong, as it allows +vdpasim_kick_vq to post work requests before the device has been +configured. To fix, do not set running until VIRTIO_CONFIG_S_DRIVER_OK +is set. + +Fixes: 0c89e2a3a9d0 ("vdpa_sim: Implement suspend vdpa op") +Signed-off-by: Steve Sistare +Reviewed-by: Eugenio Pérez +Acked-by: Jason Wang +Message-Id: <1707517807-137331-1-git-send-email-steven.sistare@oracle.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vdpa/vdpa_sim/vdpa_sim.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c +index be2925d0d2836..18584ce70bf07 100644 +--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c ++++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c +@@ -160,7 +160,7 @@ static void vdpasim_do_reset(struct vdpasim *vdpasim, u32 flags) + } + } + +- vdpasim->running = true; ++ vdpasim->running = false; + spin_unlock(&vdpasim->iommu_lock); + + vdpasim->features = 0; +@@ -483,6 +483,7 @@ static void vdpasim_set_status(struct vdpa_device *vdpa, u8 status) + + mutex_lock(&vdpasim->mutex); + vdpasim->status = status; ++ vdpasim->running = (status & VIRTIO_CONFIG_S_DRIVER_OK) != 0; + mutex_unlock(&vdpasim->mutex); + } + +-- +2.43.0 + diff --git a/queue-6.7/virtio-packed-fix-unmap-leak-for-indirect-desc-table.patch b/queue-6.7/virtio-packed-fix-unmap-leak-for-indirect-desc-table.patch new file mode 100644 index 00000000000..7f62bc7c262 --- /dev/null +++ b/queue-6.7/virtio-packed-fix-unmap-leak-for-indirect-desc-table.patch @@ -0,0 +1,74 @@ +From 4c99157e3edfd738f038c62d357a5f20023f7cbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 15:18:33 +0800 +Subject: virtio: packed: fix unmap leak for indirect desc table + +From: Xuan Zhuo + +[ Upstream commit d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd ] + +When use_dma_api and premapped are true, then the do_unmap is false. + +Because the do_unmap is false, vring_unmap_extra_packed is not called by +detach_buf_packed. + + if (unlikely(vq->do_unmap)) { + curr = id; + for (i = 0; i < state->num; i++) { + vring_unmap_extra_packed(vq, + &vq->packed.desc_extra[curr]); + curr = vq->packed.desc_extra[curr].next; + } + } + +So the indirect desc table is not unmapped. This causes the unmap leak. + +So here, we check vq->use_dma_api instead. Synchronously, dma info is +updated based on use_dma_api judgment + +This bug does not occur, because no driver use the premapped with +indirect. + +Fixes: b319940f83c2 ("virtio_ring: skip unmap for premapped") +Signed-off-by: Xuan Zhuo +Message-Id: <20240223071833.26095-1-xuanzhuo@linux.alibaba.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 49299b1f9ec74..6f7e5010a6735 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1340,7 +1340,7 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq, + sizeof(struct vring_packed_desc)); + vq->packed.vring.desc[head].id = cpu_to_le16(id); + +- if (vq->do_unmap) { ++ if (vq->use_dma_api) { + vq->packed.desc_extra[id].addr = addr; + vq->packed.desc_extra[id].len = total_sg * + sizeof(struct vring_packed_desc); +@@ -1481,7 +1481,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, + desc[i].len = cpu_to_le32(sg->length); + desc[i].id = cpu_to_le16(id); + +- if (unlikely(vq->do_unmap)) { ++ if (unlikely(vq->use_dma_api)) { + vq->packed.desc_extra[curr].addr = addr; + vq->packed.desc_extra[curr].len = sg->length; + vq->packed.desc_extra[curr].flags = +@@ -1615,7 +1615,7 @@ static void detach_buf_packed(struct vring_virtqueue *vq, + vq->free_head = id; + vq->vq.num_free += state->num; + +- if (unlikely(vq->do_unmap)) { ++ if (unlikely(vq->use_dma_api)) { + curr = id; + for (i = 0; i < state->num; i++) { + vring_unmap_extra_packed(vq, +-- +2.43.0 + diff --git a/queue-6.7/vmxnet3-fix-missing-reserved-tailroom.patch b/queue-6.7/vmxnet3-fix-missing-reserved-tailroom.patch new file mode 100644 index 00000000000..e3060a4b74f --- /dev/null +++ b/queue-6.7/vmxnet3-fix-missing-reserved-tailroom.patch @@ -0,0 +1,62 @@ +From 7ceb1358c68d4dfe9c801289690385d2923c7f92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Mar 2024 20:31:47 +0200 +Subject: vmxnet3: Fix missing reserved tailroom + +From: William Tu + +[ Upstream commit e127ce7699c1e05279ee5ee61f00893e7bfa9671 ] + +Use rbi->len instead of rcd->len for non-dataring packet. + +Found issue: + XDP_WARN: xdp_update_frame_from_buff(line:278): Driver BUG: missing reserved tailroom + WARNING: CPU: 0 PID: 0 at net/core/xdp.c:586 xdp_warn+0xf/0x20 + CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W O 6.5.1 #1 + RIP: 0010:xdp_warn+0xf/0x20 + ... + ? xdp_warn+0xf/0x20 + xdp_do_redirect+0x15f/0x1c0 + vmxnet3_run_xdp+0x17a/0x400 [vmxnet3] + vmxnet3_process_xdp+0xe4/0x760 [vmxnet3] + ? vmxnet3_tq_tx_complete.isra.0+0x21e/0x2c0 [vmxnet3] + vmxnet3_rq_rx_complete+0x7ad/0x1120 [vmxnet3] + vmxnet3_poll_rx_only+0x2d/0xa0 [vmxnet3] + __napi_poll+0x20/0x180 + net_rx_action+0x177/0x390 + +Reported-by: Martin Zaharinov +Tested-by: Martin Zaharinov +Link: https://lore.kernel.org/netdev/74BF3CC8-2A3A-44FF-98C2-1E20F110A92E@gmail.com/ +Fixes: 54f00cce1178 ("vmxnet3: Add XDP support.") +Signed-off-by: William Tu +Link: https://lore.kernel.org/r/20240309183147.28222-1-witu@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/vmxnet3/vmxnet3_xdp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/vmxnet3/vmxnet3_xdp.c b/drivers/net/vmxnet3/vmxnet3_xdp.c +index 80ddaff759d47..a6c787454a1ae 100644 +--- a/drivers/net/vmxnet3/vmxnet3_xdp.c ++++ b/drivers/net/vmxnet3/vmxnet3_xdp.c +@@ -382,12 +382,12 @@ vmxnet3_process_xdp(struct vmxnet3_adapter *adapter, + page = rbi->page; + dma_sync_single_for_cpu(&adapter->pdev->dev, + page_pool_get_dma_addr(page) + +- rq->page_pool->p.offset, rcd->len, ++ rq->page_pool->p.offset, rbi->len, + page_pool_get_dma_dir(rq->page_pool)); + +- xdp_init_buff(&xdp, rbi->len, &rq->xdp_rxq); ++ xdp_init_buff(&xdp, PAGE_SIZE, &rq->xdp_rxq); + xdp_prepare_buff(&xdp, page_address(page), rq->page_pool->p.offset, +- rcd->len, false); ++ rbi->len, false); + xdp_buff_clear_frags_flag(&xdp); + + xdp_prog = rcu_dereference(rq->adapter->xdp_bpf_prog); +-- +2.43.0 + diff --git a/queue-6.7/wireguard-receive-annotate-data-race-around-receivin.patch b/queue-6.7/wireguard-receive-annotate-data-race-around-receivin.patch new file mode 100644 index 00000000000..9ddf5d06ab1 --- /dev/null +++ b/queue-6.7/wireguard-receive-annotate-data-race-around-receivin.patch @@ -0,0 +1,86 @@ +From 98db0a37e49970bfecc78319d6af43f871ef9996 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 16:49:06 -0600 +Subject: wireguard: receive: annotate data-race around + receiving_counter.counter + +From: Nikita Zhandarovich + +[ Upstream commit bba045dc4d996d03dce6fe45726e78a1a1f6d4c3 ] + +Syzkaller with KCSAN identified a data-race issue when accessing +keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE() +annotations to mark the data race as intentional. + + BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll + + write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0: + counter_validate drivers/net/wireguard/receive.c:321 [inline] + wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461 + __napi_poll+0x60/0x3b0 net/core/dev.c:6536 + napi_poll net/core/dev.c:6605 [inline] + net_rx_action+0x32b/0x750 net/core/dev.c:6738 + __do_softirq+0xc4/0x279 kernel/softirq.c:553 + do_softirq+0x5e/0x90 kernel/softirq.c:454 + __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 + __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] + _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 + spin_unlock_bh include/linux/spinlock.h:396 [inline] + ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] + wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499 + process_one_work kernel/workqueue.c:2633 [inline] + ... + + read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1: + decrypt_packet drivers/net/wireguard/receive.c:252 [inline] + wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501 + process_one_work kernel/workqueue.c:2633 [inline] + process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706 + worker_thread+0x525/0x730 kernel/workqueue.c:2787 + ... + +Fixes: a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter") +Reported-by: syzbot+d1de830e4ecdaac83d89@syzkaller.appspotmail.com +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Jiri Pirko +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/receive.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c +index a176653c88616..db01ec03bda00 100644 +--- a/drivers/net/wireguard/receive.c ++++ b/drivers/net/wireguard/receive.c +@@ -251,7 +251,7 @@ static bool decrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair) + + if (unlikely(!READ_ONCE(keypair->receiving.is_valid) || + wg_birthdate_has_expired(keypair->receiving.birthdate, REJECT_AFTER_TIME) || +- keypair->receiving_counter.counter >= REJECT_AFTER_MESSAGES)) { ++ READ_ONCE(keypair->receiving_counter.counter) >= REJECT_AFTER_MESSAGES)) { + WRITE_ONCE(keypair->receiving.is_valid, false); + return false; + } +@@ -318,7 +318,7 @@ static bool counter_validate(struct noise_replay_counter *counter, u64 their_cou + for (i = 1; i <= top; ++i) + counter->backtrack[(i + index_current) & + ((COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1)] = 0; +- counter->counter = their_counter; ++ WRITE_ONCE(counter->counter, their_counter); + } + + index &= (COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1; +@@ -463,7 +463,7 @@ int wg_packet_rx_poll(struct napi_struct *napi, int budget) + net_dbg_ratelimited("%s: Packet has invalid nonce %llu (max %llu)\n", + peer->device->dev->name, + PACKET_CB(skb)->nonce, +- keypair->receiving_counter.counter); ++ READ_ONCE(keypair->receiving_counter.counter)); + goto next; + } + +-- +2.43.0 + diff --git a/queue-6.7/x86-hyperv-use-per-cpu-initial-stack-for-vtl-context.patch b/queue-6.7/x86-hyperv-use-per-cpu-initial-stack-for-vtl-context.patch new file mode 100644 index 00000000000..b874386ac5b --- /dev/null +++ b/queue-6.7/x86-hyperv-use-per-cpu-initial-stack-for-vtl-context.patch @@ -0,0 +1,102 @@ +From 4f1393b6fe8a9f1bb9ccc1b994e36a060b647aec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Mar 2024 00:01:36 -0800 +Subject: x86/hyperv: Use per cpu initial stack for vtl context + +From: Saurabh Sengar + +[ Upstream commit 2b4b90e053a29057fb05ba81acce26bddce8d404 ] + +Currently, the secondary CPUs in Hyper-V VTL context lack support for +parallel startup. Therefore, relying on the single initial_stack fetched +from the current task structure suffices for all vCPUs. + +However, common initial_stack risks stack corruption when parallel startup +is enabled. In order to facilitate parallel startup, use the initial_stack +from the per CPU idle thread instead of the current task. + +Fixes: 3be1bc2fe9d2 ("x86/hyperv: VTL support for Hyper-V") +Signed-off-by: Saurabh Sengar +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/1709452896-13342-1-git-send-email-ssengar@linux.microsoft.com +Signed-off-by: Wei Liu +Message-ID: <1709452896-13342-1-git-send-email-ssengar@linux.microsoft.com> +Signed-off-by: Sasha Levin +--- + arch/x86/hyperv/hv_vtl.c | 19 +++++++++++++++---- + drivers/hv/Kconfig | 1 + + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/hyperv/hv_vtl.c b/arch/x86/hyperv/hv_vtl.c +index cf1b78cb2d043..c8062975a5316 100644 +--- a/arch/x86/hyperv/hv_vtl.c ++++ b/arch/x86/hyperv/hv_vtl.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include <../kernel/smpboot.h> + + extern struct boot_params boot_params; + static struct real_mode_header hv_vtl_real_mode_header; +@@ -64,7 +65,7 @@ static void hv_vtl_ap_entry(void) + ((secondary_startup_64_fn)secondary_startup_64)(&boot_params, &boot_params); + } + +-static int hv_vtl_bringup_vcpu(u32 target_vp_index, u64 eip_ignored) ++static int hv_vtl_bringup_vcpu(u32 target_vp_index, int cpu, u64 eip_ignored) + { + u64 status; + int ret = 0; +@@ -78,7 +79,9 @@ static int hv_vtl_bringup_vcpu(u32 target_vp_index, u64 eip_ignored) + struct ldttss_desc *ldt; + struct desc_struct *gdt; + +- u64 rsp = current->thread.sp; ++ struct task_struct *idle = idle_thread_get(cpu); ++ u64 rsp = (unsigned long)idle->thread.sp; ++ + u64 rip = (u64)&hv_vtl_ap_entry; + + native_store_gdt(&gdt_ptr); +@@ -205,7 +208,15 @@ static int hv_vtl_apicid_to_vp_id(u32 apic_id) + + static int hv_vtl_wakeup_secondary_cpu(u32 apicid, unsigned long start_eip) + { +- int vp_id; ++ int vp_id, cpu; ++ ++ /* Find the logical CPU for the APIC ID */ ++ for_each_present_cpu(cpu) { ++ if (arch_match_cpu_phys_id(cpu, apicid)) ++ break; ++ } ++ if (cpu >= nr_cpu_ids) ++ return -EINVAL; + + pr_debug("Bringing up CPU with APIC ID %d in VTL2...\n", apicid); + vp_id = hv_vtl_apicid_to_vp_id(apicid); +@@ -219,7 +230,7 @@ static int hv_vtl_wakeup_secondary_cpu(u32 apicid, unsigned long start_eip) + return -EINVAL; + } + +- return hv_vtl_bringup_vcpu(vp_id, start_eip); ++ return hv_vtl_bringup_vcpu(vp_id, cpu, start_eip); + } + + int __init hv_vtl_early_init(void) +diff --git a/drivers/hv/Kconfig b/drivers/hv/Kconfig +index 00242107d62e0..862c47b191afe 100644 +--- a/drivers/hv/Kconfig ++++ b/drivers/hv/Kconfig +@@ -16,6 +16,7 @@ config HYPERV + config HYPERV_VTL_MODE + bool "Enable Linux to boot in VTL context" + depends on X86_64 && HYPERV ++ depends on SMP + default n + help + Virtual Secure Mode (VSM) is a set of hypervisor capabilities and +-- +2.43.0 + diff --git a/queue-6.7/xen-events-increment-refcnt-only-if-event-channel-is.patch b/queue-6.7/xen-events-increment-refcnt-only-if-event-channel-is.patch new file mode 100644 index 00000000000..0ca1149ecfe --- /dev/null +++ b/queue-6.7/xen-events-increment-refcnt-only-if-event-channel-is.patch @@ -0,0 +1,115 @@ +From 38eed8a8626cee5643ab57062bc53dda32ee5dc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 08:14:09 +0100 +Subject: xen/events: increment refcnt only if event channel is refcounted + +From: Juergen Gross + +[ Upstream commit d277f9d82802223f242cd9b60c988cfdda1d6be0 ] + +In bind_evtchn_to_irq_chip() don't increment the refcnt of the event +channel blindly. In case the event channel is NOT refcounted, issue a +warning instead. + +Add an additional safety net by doing the refcnt increment only if the +caller has specified IRQF_SHARED in the irqflags parameter. + +Fixes: 9e90e58c11b7 ("xen: evtchn: Allow shared registration of IRQ handers") +Signed-off-by: Juergen Gross +Reviewed-by: Oleksandr Tyshchenko +Link: https://lore.kernel.org/r/20240313071409.25913-3-jgross@suse.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/events/events_base.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 3b9f080109d7e..27553673e46bc 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -1190,7 +1190,7 @@ int xen_pirq_from_irq(unsigned irq) + EXPORT_SYMBOL_GPL(xen_pirq_from_irq); + + static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip, +- struct xenbus_device *dev) ++ struct xenbus_device *dev, bool shared) + { + int ret = -ENOMEM; + struct irq_info *info; +@@ -1224,7 +1224,8 @@ static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip, + */ + bind_evtchn_to_cpu(info, 0, false); + } else if (!WARN_ON(info->type != IRQT_EVTCHN)) { +- info->refcnt++; ++ if (shared && !WARN_ON(info->refcnt < 0)) ++ info->refcnt++; + } + + ret = info->irq; +@@ -1237,13 +1238,13 @@ static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip, + + int bind_evtchn_to_irq(evtchn_port_t evtchn) + { +- return bind_evtchn_to_irq_chip(evtchn, &xen_dynamic_chip, NULL); ++ return bind_evtchn_to_irq_chip(evtchn, &xen_dynamic_chip, NULL, false); + } + EXPORT_SYMBOL_GPL(bind_evtchn_to_irq); + + int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn) + { +- return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip, NULL); ++ return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip, NULL, false); + } + EXPORT_SYMBOL_GPL(bind_evtchn_to_irq_lateeoi); + +@@ -1295,7 +1296,8 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu) + + static int bind_interdomain_evtchn_to_irq_chip(struct xenbus_device *dev, + evtchn_port_t remote_port, +- struct irq_chip *chip) ++ struct irq_chip *chip, ++ bool shared) + { + struct evtchn_bind_interdomain bind_interdomain; + int err; +@@ -1307,14 +1309,14 @@ static int bind_interdomain_evtchn_to_irq_chip(struct xenbus_device *dev, + &bind_interdomain); + + return err ? : bind_evtchn_to_irq_chip(bind_interdomain.local_port, +- chip, dev); ++ chip, dev, shared); + } + + int bind_interdomain_evtchn_to_irq_lateeoi(struct xenbus_device *dev, + evtchn_port_t remote_port) + { + return bind_interdomain_evtchn_to_irq_chip(dev, remote_port, +- &xen_lateeoi_chip); ++ &xen_lateeoi_chip, false); + } + EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi); + +@@ -1430,7 +1432,8 @@ static int bind_evtchn_to_irqhandler_chip(evtchn_port_t evtchn, + { + int irq, retval; + +- irq = bind_evtchn_to_irq_chip(evtchn, chip, NULL); ++ irq = bind_evtchn_to_irq_chip(evtchn, chip, NULL, ++ irqflags & IRQF_SHARED); + if (irq < 0) + return irq; + retval = request_irq(irq, handler, irqflags, devname, dev_id); +@@ -1471,7 +1474,8 @@ static int bind_interdomain_evtchn_to_irqhandler_chip( + { + int irq, retval; + +- irq = bind_interdomain_evtchn_to_irq_chip(dev, remote_port, chip); ++ irq = bind_interdomain_evtchn_to_irq_chip(dev, remote_port, chip, ++ irqflags & IRQF_SHARED); + if (irq < 0) + return irq; + +-- +2.43.0 + diff --git a/queue-6.7/xen-evtchn-avoid-warn-when-unbinding-an-event-channe.patch b/queue-6.7/xen-evtchn-avoid-warn-when-unbinding-an-event-channe.patch new file mode 100644 index 00000000000..d8cf456e1db --- /dev/null +++ b/queue-6.7/xen-evtchn-avoid-warn-when-unbinding-an-event-channe.patch @@ -0,0 +1,62 @@ +From 244b0a107e33ac2e71a3c6e390668718812b671c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 08:14:08 +0100 +Subject: xen/evtchn: avoid WARN() when unbinding an event channel + +From: Juergen Gross + +[ Upstream commit 51c23bd691c0f1fb95b29731c356c6fd69925d17 ] + +When unbinding a user event channel, the related handler might be +called a last time in case the kernel was built with +CONFIG_DEBUG_SHIRQ. This might cause a WARN() in the handler. + +Avoid that by adding an "unbinding" flag to struct user_event which +will short circuit the handler. + +Fixes: 9e90e58c11b7 ("xen: evtchn: Allow shared registration of IRQ handers") +Reported-by: Demi Marie Obenour +Tested-by: Demi Marie Obenour +Signed-off-by: Juergen Gross +Reviewed-by: Oleksandr Tyshchenko +Link: https://lore.kernel.org/r/20240313071409.25913-2-jgross@suse.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/evtchn.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c +index 59717628ca42b..f6a2216c2c870 100644 +--- a/drivers/xen/evtchn.c ++++ b/drivers/xen/evtchn.c +@@ -85,6 +85,7 @@ struct user_evtchn { + struct per_user_data *user; + evtchn_port_t port; + bool enabled; ++ bool unbinding; + }; + + static void evtchn_free_ring(evtchn_port_t *ring) +@@ -164,6 +165,10 @@ static irqreturn_t evtchn_interrupt(int irq, void *data) + struct per_user_data *u = evtchn->user; + unsigned int prod, cons; + ++ /* Handler might be called when tearing down the IRQ. */ ++ if (evtchn->unbinding) ++ return IRQ_HANDLED; ++ + WARN(!evtchn->enabled, + "Interrupt for port %u, but apparently not enabled; per-user %p\n", + evtchn->port, u); +@@ -421,6 +426,7 @@ static void evtchn_unbind_from_user(struct per_user_data *u, + + BUG_ON(irq < 0); + ++ evtchn->unbinding = true; + unbind_from_irqhandler(irq, evtchn); + + del_evtchn(u, evtchn); +-- +2.43.0 + diff --git a/queue-6.7/xfrm-allow-udp-encapsulation-only-in-offload-modes.patch b/queue-6.7/xfrm-allow-udp-encapsulation-only-in-offload-modes.patch new file mode 100644 index 00000000000..e6fc3c6d1ad --- /dev/null +++ b/queue-6.7/xfrm-allow-udp-encapsulation-only-in-offload-modes.patch @@ -0,0 +1,41 @@ +From 16d409bf38d062b5cccd8b9cb63fc91026e232f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 13:55:22 +0200 +Subject: xfrm: Allow UDP encapsulation only in offload modes + +From: Leon Romanovsky + +[ Upstream commit 773bb766ca4a05bf363203030b72b10088869224 ] + +The missing check of x->encap caused to the situation where GSO packets +were created with UDP encapsulation. + +As a solution return the encap check for non-offloaded SA. + +Fixes: 983a73da1f99 ("xfrm: Pass UDP encapsulation in TX packet offload") +Closes: https://lore.kernel.org/all/a650221ae500f0c7cf496c61c96c1b103dcb6f67.camel@redhat.com +Reported-by: Paolo Abeni +Signed-off-by: Leon Romanovsky +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c +index 653e51ae39648..6346690d5c699 100644 +--- a/net/xfrm/xfrm_device.c ++++ b/net/xfrm/xfrm_device.c +@@ -407,7 +407,8 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) + struct xfrm_dst *xdst = (struct xfrm_dst *)dst; + struct net_device *dev = x->xso.dev; + +- if (!x->type_offload) ++ if (!x->type_offload || ++ (x->xso.type == XFRM_DEV_OFFLOAD_UNSPECIFIED && x->encap)) + return false; + + if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET || +-- +2.43.0 + -- 2.47.2