--- /dev/null
+From 38f4aa34a5f737ea8588dac320d884cc2e762c03 Mon Sep 17 00:00:00 2001
+From: Justin Klaassen <justin@tidylabs.net>
+Date: Tue, 25 Feb 2025 17:03:58 +0000
+Subject: arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S
+
+From: Justin Klaassen <justin@tidylabs.net>
+
+commit 38f4aa34a5f737ea8588dac320d884cc2e762c03 upstream.
+
+The u2phy1_host should always have the same status as usb_host1_ehci
+and usb_host1_ohci, otherwise the EHCI and OHCI drivers may be
+initialized for a disabled usb port.
+
+Per the NanoPi R4S schematic, the phy-supply for u2phy1_host is set to
+the vdd_5v regulator.
+
+Fixes: db792e9adbf8 ("rockchip: rk3399: Add support for FriendlyARM NanoPi R4S")
+Cc: stable@vger.kernel.org
+Signed-off-by: Justin Klaassen <justin@tidylabs.net>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Link: https://lore.kernel.org/r/20250225170420.3898-1-justin@tidylabs.net
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
+@@ -117,7 +117,7 @@
+ };
+
+ &u2phy1_host {
+- status = "disabled";
++ phy-supply = <&vdd_5v>;
+ };
+
+ &uart0 {
--- /dev/null
+From 3051a77a09dfe3022aa012071346937fdf059033 Mon Sep 17 00:00:00 2001
+From: Shravya KN <shravya.k-n@broadcom.com>
+Date: Fri, 22 Nov 2024 14:45:44 -0800
+Subject: bnxt_en: Fix receive ring space parameters when XDP is active
+
+From: Shravya KN <shravya.k-n@broadcom.com>
+
+commit 3051a77a09dfe3022aa012071346937fdf059033 upstream.
+
+The MTU setting at the time an XDP multi-buffer is attached
+determines whether the aggregation ring will be used and the
+rx_skb_func handler. This is done in bnxt_set_rx_skb_mode().
+
+If the MTU is later changed, the aggregation ring setting may need
+to be changed and it may become out-of-sync with the settings
+initially done in bnxt_set_rx_skb_mode(). This may result in
+random memory corruption and crashes as the HW may DMA data larger
+than the allocated buffer size, such as:
+
+BUG: kernel NULL pointer dereference, address: 00000000000003c0
+PGD 0 P4D 0
+Oops: 0000 [#1] PREEMPT SMP NOPTI
+CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1
+Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021
+RIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en]
+Code: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 <0f> b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f
+RSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202
+RAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff
+RDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380
+RBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf
+R10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980
+R13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990
+FS: 0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+PKRU: 55555554
+Call Trace:
+ <IRQ>
+ __bnxt_poll_work+0x1c2/0x3e0 [bnxt_en]
+
+To address the issue, we now call bnxt_set_rx_skb_mode() within
+bnxt_change_mtu() to properly set the AGG rings configuration and
+update rx_skb_func based on the new MTU value.
+Additionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of
+bnxt_set_rx_skb_mode() to make sure it gets set or cleared based on
+the current MTU.
+
+Fixes: 08450ea98ae9 ("bnxt_en: Fix max_mtu setting for multi-buf XDP")
+Co-developed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Shravya KN <shravya.k-n@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -3987,7 +3987,7 @@ int bnxt_set_rx_skb_mode(struct bnxt *bp
+ struct net_device *dev = bp->dev;
+
+ if (page_mode) {
+- bp->flags &= ~BNXT_FLAG_AGG_RINGS;
++ bp->flags &= ~(BNXT_FLAG_AGG_RINGS | BNXT_FLAG_NO_AGG_RINGS);
+ bp->flags |= BNXT_FLAG_RX_PAGE_MODE;
+
+ if (bp->xdp_prog->aux->xdp_has_frags)
+@@ -12796,6 +12796,14 @@ static int bnxt_change_mtu(struct net_de
+ bnxt_close_nic(bp, true, false);
+
+ dev->mtu = new_mtu;
++
++ /* MTU change may change the AGG ring settings if an XDP multi-buffer
++ * program is attached. We need to set the AGG rings settings and
++ * rx_skb_func accordingly.
++ */
++ if (READ_ONCE(bp->xdp_prog))
++ bnxt_set_rx_skb_mode(bp, true);
++
+ bnxt_set_ring_params(bp);
+
+ if (netif_running(dev))
--- /dev/null
+From e03418abde871314e1a3a550f4c8afb7b89cb273 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Mon, 29 Apr 2024 09:03:35 -0400
+Subject: btrfs: make sure that WRITTEN is set on all metadata blocks
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit e03418abde871314e1a3a550f4c8afb7b89cb273 upstream.
+
+We previously would call btrfs_check_leaf() if we had the check
+integrity code enabled, which meant that we could only run the extended
+leaf checks if we had WRITTEN set on the header flags.
+
+This leaves a gap in our checking, because we could end up with
+corruption on disk where WRITTEN isn't set on the leaf, and then the
+extended leaf checks don't get run which we rely on to validate all of
+the item pointers to make sure we don't access memory outside of the
+extent buffer.
+
+However, since 732fab95abe2 ("btrfs: check-integrity: remove
+CONFIG_BTRFS_FS_CHECK_INTEGRITY option") we no longer call
+btrfs_check_leaf() from btrfs_mark_buffer_dirty(), which means we only
+ever call it on blocks that are being written out, and thus have WRITTEN
+set, or that are being read in, which should have WRITTEN set.
+
+Add checks to make sure we have WRITTEN set appropriately, and then make
+sure __btrfs_check_leaf() always does the item checking. This will
+protect us from file systems that have been corrupted and no longer have
+WRITTEN set on some of the blocks.
+
+This was hit on a crafted image tweaking the WRITTEN bit and reported by
+KASAN as out-of-bound access in the eb accessors. The example is a dir
+item at the end of an eb.
+
+ [2.042] BTRFS warning (device loop1): bad eb member start: ptr 0x3fff start 30572544 member offset 16410 size 2
+ [2.040] general protection fault, probably for non-canonical address 0xe0009d1000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI
+ [2.537] KASAN: maybe wild-memory-access in range [0x0005088000000018-0x000508800000001f]
+ [2.729] CPU: 0 PID: 2587 Comm: mount Not tainted 6.8.2 #1
+ [2.729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+ [2.621] RIP: 0010:btrfs_get_16+0x34b/0x6d0
+ [2.621] RSP: 0018:ffff88810871fab8 EFLAGS: 00000206
+ [2.621] RAX: 0000a11000000003 RBX: ffff888104ff8720 RCX: ffff88811b2288c0
+ [2.621] RDX: dffffc0000000000 RSI: ffffffff81dd8aca RDI: ffff88810871f748
+ [2.621] RBP: 000000000000401a R08: 0000000000000001 R09: ffffed10210e3ee9
+ [2.621] R10: ffff88810871f74f R11: 205d323430333737 R12: 000000000000001a
+ [2.621] R13: 000508800000001a R14: 1ffff110210e3f5d R15: ffffffff850011e8
+ [2.621] FS: 00007f56ea275840(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000
+ [2.621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [2.621] CR2: 00007febd13b75c0 CR3: 000000010bb50000 CR4: 00000000000006f0
+ [2.621] Call Trace:
+ [2.621] <TASK>
+ [2.621] ? show_regs+0x74/0x80
+ [2.621] ? die_addr+0x46/0xc0
+ [2.621] ? exc_general_protection+0x161/0x2a0
+ [2.621] ? asm_exc_general_protection+0x26/0x30
+ [2.621] ? btrfs_get_16+0x33a/0x6d0
+ [2.621] ? btrfs_get_16+0x34b/0x6d0
+ [2.621] ? btrfs_get_16+0x33a/0x6d0
+ [2.621] ? __pfx_btrfs_get_16+0x10/0x10
+ [2.621] ? __pfx_mutex_unlock+0x10/0x10
+ [2.621] btrfs_match_dir_item_name+0x101/0x1a0
+ [2.621] btrfs_lookup_dir_item+0x1f3/0x280
+ [2.621] ? __pfx_btrfs_lookup_dir_item+0x10/0x10
+ [2.621] btrfs_get_tree+0xd25/0x1910
+
+Reported-by: lei lu <llfamsec@gmail.com>
+CC: stable@vger.kernel.org # 6.7+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ copy more details from report ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/tree-checker.c | 30 +++++++++++++++---------------
+ fs/btrfs/tree-checker.h | 1 +
+ 2 files changed, 16 insertions(+), 15 deletions(-)
+
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -1889,6 +1889,11 @@ enum btrfs_tree_block_status __btrfs_che
+ return BTRFS_TREE_BLOCK_INVALID_LEVEL;
+ }
+
++ if (unlikely(!btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_WRITTEN))) {
++ generic_err(leaf, 0, "invalid flag for leaf, WRITTEN not set");
++ return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET;
++ }
++
+ /*
+ * Extent buffers from a relocation tree have a owner field that
+ * corresponds to the subvolume tree they are based on. So just from an
+@@ -1950,6 +1955,7 @@ enum btrfs_tree_block_status __btrfs_che
+ for (slot = 0; slot < nritems; slot++) {
+ u32 item_end_expected;
+ u64 item_data_end;
++ enum btrfs_tree_block_status ret;
+
+ btrfs_item_key_to_cpu(leaf, &key, slot);
+
+@@ -2005,21 +2011,10 @@ enum btrfs_tree_block_status __btrfs_che
+ return BTRFS_TREE_BLOCK_INVALID_OFFSETS;
+ }
+
+- /*
+- * We only want to do this if WRITTEN is set, otherwise the leaf
+- * may be in some intermediate state and won't appear valid.
+- */
+- if (btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_WRITTEN)) {
+- enum btrfs_tree_block_status ret;
+-
+- /*
+- * Check if the item size and content meet other
+- * criteria
+- */
+- ret = check_leaf_item(leaf, &key, slot, &prev_key);
+- if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
+- return ret;
+- }
++ /* Check if the item size and content meet other criteria. */
++ ret = check_leaf_item(leaf, &key, slot, &prev_key);
++ if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
++ return ret;
+
+ prev_key.objectid = key.objectid;
+ prev_key.type = key.type;
+@@ -2049,6 +2044,11 @@ enum btrfs_tree_block_status __btrfs_che
+ int level = btrfs_header_level(node);
+ u64 bytenr;
+
++ if (unlikely(!btrfs_header_flag(node, BTRFS_HEADER_FLAG_WRITTEN))) {
++ generic_err(node, 0, "invalid flag for node, WRITTEN not set");
++ return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET;
++ }
++
+ if (unlikely(level <= 0 || level >= BTRFS_MAX_LEVEL)) {
+ generic_err(node, 0,
+ "invalid level for node, have %d expect [1, %d]",
+--- a/fs/btrfs/tree-checker.h
++++ b/fs/btrfs/tree-checker.h
+@@ -51,6 +51,7 @@ enum btrfs_tree_block_status {
+ BTRFS_TREE_BLOCK_INVALID_BLOCKPTR,
+ BTRFS_TREE_BLOCK_INVALID_ITEM,
+ BTRFS_TREE_BLOCK_INVALID_OWNER,
++ BTRFS_TREE_BLOCK_WRITTEN_NOT_SET,
+ };
+
+ /*
--- /dev/null
+From 4a1d3acd6ea86075e77fcc1188c3fc372833ba73 Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Tue, 20 Aug 2024 09:54:32 +0200
+Subject: netfilter: nft_counter: Use u64_stats_t for statistic.
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit 4a1d3acd6ea86075e77fcc1188c3fc372833ba73 upstream.
+
+The nft_counter uses two s64 counters for statistics. Those two are
+protected by a seqcount to ensure that the 64bit variable is always
+properly seen during updates even on 32bit architectures where the store
+is performed by two writes. A side effect is that the two counter (bytes
+and packet) are written and read together in the same window.
+
+This can be replaced with u64_stats_t. write_seqcount_begin()/ end() is
+replaced with u64_stats_update_begin()/ end() and behaves the same way
+as with seqcount_t on 32bit architectures. Additionally there is a
+preempt_disable on PREEMPT_RT to ensure that a reader does not preempt a
+writer.
+On 64bit architectures the macros are removed and the reads happen
+without any retries. This also means that the reader can observe one
+counter (bytes) from before the update and the other counter (packets)
+but that is okay since there is no requirement to have both counter from
+the same update window.
+
+Convert the statistic to u64_stats_t. There is one optimisation:
+nft_counter_do_init() and nft_counter_clone() allocate a new per-CPU
+counter and assign a value to it. During this assignment preemption is
+disabled which is not needed because the counter is not yet exposed to
+the system so there can not be another writer or reader. Therefore
+disabling preemption is omitted and raw_cpu_ptr() is used to obtain a
+pointer to a counter for the assignment.
+
+Cc: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nft_counter.c | 90 ++++++++++++++++++++++----------------------
+ 1 file changed, 46 insertions(+), 44 deletions(-)
+
+--- a/net/netfilter/nft_counter.c
++++ b/net/netfilter/nft_counter.c
+@@ -8,7 +8,7 @@
+ #include <linux/kernel.h>
+ #include <linux/init.h>
+ #include <linux/module.h>
+-#include <linux/seqlock.h>
++#include <linux/u64_stats_sync.h>
+ #include <linux/netlink.h>
+ #include <linux/netfilter.h>
+ #include <linux/netfilter/nf_tables.h>
+@@ -17,6 +17,11 @@
+ #include <net/netfilter/nf_tables_offload.h>
+
+ struct nft_counter {
++ u64_stats_t bytes;
++ u64_stats_t packets;
++};
++
++struct nft_counter_tot {
+ s64 bytes;
+ s64 packets;
+ };
+@@ -25,25 +30,24 @@ struct nft_counter_percpu_priv {
+ struct nft_counter __percpu *counter;
+ };
+
+-static DEFINE_PER_CPU(seqcount_t, nft_counter_seq);
++static DEFINE_PER_CPU(struct u64_stats_sync, nft_counter_sync);
+
+ static inline void nft_counter_do_eval(struct nft_counter_percpu_priv *priv,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
+ {
++ struct u64_stats_sync *nft_sync;
+ struct nft_counter *this_cpu;
+- seqcount_t *myseq;
+
+ local_bh_disable();
+ this_cpu = this_cpu_ptr(priv->counter);
+- myseq = this_cpu_ptr(&nft_counter_seq);
+-
+- write_seqcount_begin(myseq);
++ nft_sync = this_cpu_ptr(&nft_counter_sync);
+
+- this_cpu->bytes += pkt->skb->len;
+- this_cpu->packets++;
++ u64_stats_update_begin(nft_sync);
++ u64_stats_add(&this_cpu->bytes, pkt->skb->len);
++ u64_stats_inc(&this_cpu->packets);
++ u64_stats_update_end(nft_sync);
+
+- write_seqcount_end(myseq);
+ local_bh_enable();
+ }
+
+@@ -66,17 +70,16 @@ static int nft_counter_do_init(const str
+ if (cpu_stats == NULL)
+ return -ENOMEM;
+
+- preempt_disable();
+- this_cpu = this_cpu_ptr(cpu_stats);
++ this_cpu = raw_cpu_ptr(cpu_stats);
+ if (tb[NFTA_COUNTER_PACKETS]) {
+- this_cpu->packets =
+- be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
++ u64_stats_set(&this_cpu->packets,
++ be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])));
+ }
+ if (tb[NFTA_COUNTER_BYTES]) {
+- this_cpu->bytes =
+- be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
++ u64_stats_set(&this_cpu->bytes,
++ be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])));
+ }
+- preempt_enable();
++
+ priv->counter = cpu_stats;
+ return 0;
+ }
+@@ -104,40 +107,41 @@ static void nft_counter_obj_destroy(cons
+ }
+
+ static void nft_counter_reset(struct nft_counter_percpu_priv *priv,
+- struct nft_counter *total)
++ struct nft_counter_tot *total)
+ {
++ struct u64_stats_sync *nft_sync;
+ struct nft_counter *this_cpu;
+- seqcount_t *myseq;
+
+ local_bh_disable();
+ this_cpu = this_cpu_ptr(priv->counter);
+- myseq = this_cpu_ptr(&nft_counter_seq);
++ nft_sync = this_cpu_ptr(&nft_counter_sync);
++
++ u64_stats_update_begin(nft_sync);
++ u64_stats_add(&this_cpu->packets, -total->packets);
++ u64_stats_add(&this_cpu->bytes, -total->bytes);
++ u64_stats_update_end(nft_sync);
+
+- write_seqcount_begin(myseq);
+- this_cpu->packets -= total->packets;
+- this_cpu->bytes -= total->bytes;
+- write_seqcount_end(myseq);
+ local_bh_enable();
+ }
+
+ static void nft_counter_fetch(struct nft_counter_percpu_priv *priv,
+- struct nft_counter *total)
++ struct nft_counter_tot *total)
+ {
+ struct nft_counter *this_cpu;
+- const seqcount_t *myseq;
+ u64 bytes, packets;
+ unsigned int seq;
+ int cpu;
+
+ memset(total, 0, sizeof(*total));
+ for_each_possible_cpu(cpu) {
+- myseq = per_cpu_ptr(&nft_counter_seq, cpu);
++ struct u64_stats_sync *nft_sync = per_cpu_ptr(&nft_counter_sync, cpu);
++
+ this_cpu = per_cpu_ptr(priv->counter, cpu);
+ do {
+- seq = read_seqcount_begin(myseq);
+- bytes = this_cpu->bytes;
+- packets = this_cpu->packets;
+- } while (read_seqcount_retry(myseq, seq));
++ seq = u64_stats_fetch_begin(nft_sync);
++ bytes = u64_stats_read(&this_cpu->bytes);
++ packets = u64_stats_read(&this_cpu->packets);
++ } while (u64_stats_fetch_retry(nft_sync, seq));
+
+ total->bytes += bytes;
+ total->packets += packets;
+@@ -148,7 +152,7 @@ static int nft_counter_do_dump(struct sk
+ struct nft_counter_percpu_priv *priv,
+ bool reset)
+ {
+- struct nft_counter total;
++ struct nft_counter_tot total;
+
+ nft_counter_fetch(priv, &total);
+
+@@ -237,7 +241,7 @@ static int nft_counter_clone(struct nft_
+ struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst);
+ struct nft_counter __percpu *cpu_stats;
+ struct nft_counter *this_cpu;
+- struct nft_counter total;
++ struct nft_counter_tot total;
+
+ nft_counter_fetch(priv, &total);
+
+@@ -245,11 +249,9 @@ static int nft_counter_clone(struct nft_
+ if (cpu_stats == NULL)
+ return -ENOMEM;
+
+- preempt_disable();
+- this_cpu = this_cpu_ptr(cpu_stats);
+- this_cpu->packets = total.packets;
+- this_cpu->bytes = total.bytes;
+- preempt_enable();
++ this_cpu = raw_cpu_ptr(cpu_stats);
++ u64_stats_set(&this_cpu->packets, total.packets);
++ u64_stats_set(&this_cpu->bytes, total.bytes);
+
+ priv_clone->counter = cpu_stats;
+ return 0;
+@@ -267,17 +269,17 @@ static void nft_counter_offload_stats(st
+ const struct flow_stats *stats)
+ {
+ struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
++ struct u64_stats_sync *nft_sync;
+ struct nft_counter *this_cpu;
+- seqcount_t *myseq;
+
+ local_bh_disable();
+ this_cpu = this_cpu_ptr(priv->counter);
+- myseq = this_cpu_ptr(&nft_counter_seq);
++ nft_sync = this_cpu_ptr(&nft_counter_sync);
+
+- write_seqcount_begin(myseq);
+- this_cpu->packets += stats->pkts;
+- this_cpu->bytes += stats->bytes;
+- write_seqcount_end(myseq);
++ u64_stats_update_begin(nft_sync);
++ u64_stats_add(&this_cpu->packets, stats->pkts);
++ u64_stats_add(&this_cpu->bytes, stats->bytes);
++ u64_stats_update_end(nft_sync);
+ local_bh_enable();
+ }
+
+@@ -286,7 +288,7 @@ void nft_counter_init_seqcount(void)
+ int cpu;
+
+ for_each_possible_cpu(cpu)
+- seqcount_init(per_cpu_ptr(&nft_counter_seq, cpu));
++ u64_stats_init(per_cpu_ptr(&nft_counter_sync, cpu));
+ }
+
+ struct nft_expr_type nft_counter_type;
--- /dev/null
+From 76f970ce51c80f625eb6ddbb24e9cb51b977b598 Mon Sep 17 00:00:00 2001
+From: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Date: Fri, 14 Mar 2025 16:13:45 +0100
+Subject: Revert "sched/core: Reduce cost of sched_move_task when config autogroup"
+
+From: Dietmar Eggemann <dietmar.eggemann@arm.com>
+
+commit 76f970ce51c80f625eb6ddbb24e9cb51b977b598 upstream.
+
+This reverts commit eff6c8ce8d4d7faef75f66614dd20bb50595d261.
+
+Hazem reported a 30% drop in UnixBench spawn test with commit
+eff6c8ce8d4d ("sched/core: Reduce cost of sched_move_task when config
+autogroup") on a m6g.xlarge AWS EC2 instance with 4 vCPUs and 16 GiB RAM
+(aarch64) (single level MC sched domain):
+
+ https://lkml.kernel.org/r/20250205151026.13061-1-hagarhem@amazon.com
+
+There is an early bail from sched_move_task() if p->sched_task_group is
+equal to p's 'cpu cgroup' (sched_get_task_group()). E.g. both are
+pointing to taskgroup '/user.slice/user-1000.slice/session-1.scope'
+(Ubuntu '22.04.5 LTS').
+
+So in:
+
+ do_exit()
+
+ sched_autogroup_exit_task()
+
+ sched_move_task()
+
+ if sched_get_task_group(p) == p->sched_task_group
+ return
+
+ /* p is enqueued */
+ dequeue_task() \
+ sched_change_group() |
+ task_change_group_fair() |
+ detach_task_cfs_rq() | (1)
+ set_task_rq() |
+ attach_task_cfs_rq() |
+ enqueue_task() /
+
+(1) isn't called for p anymore.
+
+Turns out that the regression is related to sgs->group_util in
+group_is_overloaded() and group_has_capacity(). If (1) isn't called for
+all the 'spawn' tasks then sgs->group_util is ~900 and
+sgs->group_capacity = 1024 (single CPU sched domain) and this leads to
+group_is_overloaded() returning true (2) and group_has_capacity() false
+(3) much more often compared to the case when (1) is called.
+
+I.e. there are much more cases of 'group_is_overloaded' and
+'group_fully_busy' in WF_FORK wakeup sched_balance_find_dst_cpu() which
+then returns much more often a CPU != smp_processor_id() (5).
+
+This isn't good for these extremely short running tasks (FORK + EXIT)
+and also involves calling sched_balance_find_dst_group_cpu() unnecessary
+(single CPU sched domain).
+
+Instead if (1) is called for 'p->flags & PF_EXITING' then the path
+(4),(6) is taken much more often.
+
+ select_task_rq_fair(..., wake_flags = WF_FORK)
+
+ cpu = smp_processor_id()
+
+ new_cpu = sched_balance_find_dst_cpu(..., cpu, ...)
+
+ group = sched_balance_find_dst_group(..., cpu)
+
+ do {
+
+ update_sg_wakeup_stats()
+
+ sgs->group_type = group_classify()
+
+ if group_is_overloaded() (2)
+ return group_overloaded
+
+ if !group_has_capacity() (3)
+ return group_fully_busy
+
+ return group_has_spare (4)
+
+ } while group
+
+ if local_sgs.group_type > idlest_sgs.group_type
+ return idlest (5)
+
+ case group_has_spare:
+
+ if local_sgs.idle_cpus >= idlest_sgs.idle_cpus
+ return NULL (6)
+
+Unixbench Tests './Run -c 4 spawn' on:
+
+(a) VM AWS instance (m7gd.16xlarge) with v6.13 ('maxcpus=4 nr_cpus=4')
+ and Ubuntu 22.04.5 LTS (aarch64).
+
+ Shell & test run in '/user.slice/user-1000.slice/session-1.scope'.
+
+ w/o patch w/ patch
+ 21005 27120
+
+(b) i7-13700K with tip/sched/core ('nosmt maxcpus=8 nr_cpus=8') and
+ Ubuntu 22.04.5 LTS (x86_64).
+
+ Shell & test run in '/A'.
+
+ w/o patch w/ patch
+ 67675 88806
+
+CONFIG_SCHED_AUTOGROUP=y & /sys/proc/kernel/sched_autogroup_enabled equal
+0 or 1.
+
+Reported-by: Hazem Mohamed Abuelfotoh <abuehaze@amazon.com>
+Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: Hagar Hemdan <hagarhem@amazon.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/20250314151345.275739-1-dietmar.eggemann@arm.com
+[Hagar: clean revert of eff6c8ce8dd7 to make it work on 6.6]
+Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/core.c | 22 +++-------------------
+ 1 file changed, 3 insertions(+), 19 deletions(-)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -10494,7 +10494,7 @@ void sched_release_group(struct task_gro
+ spin_unlock_irqrestore(&task_group_lock, flags);
+ }
+
+-static struct task_group *sched_get_task_group(struct task_struct *tsk)
++static void sched_change_group(struct task_struct *tsk)
+ {
+ struct task_group *tg;
+
+@@ -10506,13 +10506,7 @@ static struct task_group *sched_get_task
+ tg = container_of(task_css_check(tsk, cpu_cgrp_id, true),
+ struct task_group, css);
+ tg = autogroup_task_group(tsk, tg);
+-
+- return tg;
+-}
+-
+-static void sched_change_group(struct task_struct *tsk, struct task_group *group)
+-{
+- tsk->sched_task_group = group;
++ tsk->sched_task_group = tg;
+
+ #ifdef CONFIG_FAIR_GROUP_SCHED
+ if (tsk->sched_class->task_change_group)
+@@ -10533,19 +10527,10 @@ void sched_move_task(struct task_struct
+ {
+ int queued, running, queue_flags =
+ DEQUEUE_SAVE | DEQUEUE_MOVE | DEQUEUE_NOCLOCK;
+- struct task_group *group;
+ struct rq_flags rf;
+ struct rq *rq;
+
+ rq = task_rq_lock(tsk, &rf);
+- /*
+- * Esp. with SCHED_AUTOGROUP enabled it is possible to get superfluous
+- * group changes.
+- */
+- group = sched_get_task_group(tsk);
+- if (group == tsk->sched_task_group)
+- goto unlock;
+-
+ update_rq_clock(rq);
+
+ running = task_current(rq, tsk);
+@@ -10556,7 +10541,7 @@ void sched_move_task(struct task_struct
+ if (running)
+ put_prev_task(rq, tsk);
+
+- sched_change_group(tsk, group);
++ sched_change_group(tsk);
+
+ if (queued)
+ enqueue_task(rq, tsk, queue_flags);
+@@ -10570,7 +10555,6 @@ void sched_move_task(struct task_struct
+ resched_curr(rq);
+ }
+
+-unlock:
+ task_rq_unlock(rq, tsk, &rf);
+ }
+
kvm-arm64-refactor-exit-handlers.patch
kvm-arm64-mark-some-header-functions-as-inline.patch
kvm-arm64-eagerly-switch-zcr_el-1-2.patch
+arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch
+revert-sched-core-reduce-cost-of-sched_move_task-when-config-autogroup.patch
+btrfs-make-sure-that-written-is-set-on-all-metadata-blocks.patch
+bnxt_en-fix-receive-ring-space-parameters-when-xdp-is-active.patch
+wifi-iwlwifi-support-bios-override-for-5g9-in-ca-also-in-lari-version-8.patch
+wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch
+netfilter-nft_counter-use-u64_stats_t-for-statistic.patch
--- /dev/null
+From 78f65fbf421a61894c14a1b91fe2fb4437b3fe5f Mon Sep 17 00:00:00 2001
+From: Benjamin Berg <benjamin.berg@intel.com>
+Date: Sun, 18 Feb 2024 19:51:47 +0200
+Subject: wifi: iwlwifi: mvm: ensure offloading TID queue exists
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+commit 78f65fbf421a61894c14a1b91fe2fb4437b3fe5f upstream.
+
+The resume code path assumes that the TX queue for the offloading TID
+has been configured. At resume time it then tries to sync the write
+pointer as it may have been updated by the firmware.
+
+In the unusual event that no packets have been send on TID 0, the queue
+will not have been allocated and this causes a crash. Fix this by
+ensuring the queue exist at suspend time.
+
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240218194912.6632e6dc7b35.Ie6e6a7488c9c7d4529f13d48f752b5439d8ac3c4@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 9 +++++++-
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 28 +++++++++++++++++++++++++++
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 3 +-
+ 3 files changed, 38 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -1293,7 +1293,9 @@ static int __iwl_mvm_suspend(struct ieee
+
+ mvm->net_detect = true;
+ } else {
+- struct iwl_wowlan_config_cmd wowlan_config_cmd = {};
++ struct iwl_wowlan_config_cmd wowlan_config_cmd = {
++ .offloading_tid = 0,
++ };
+
+ wowlan_config_cmd.sta_id = mvmvif->deflink.ap_sta_id;
+
+@@ -1305,6 +1307,11 @@ static int __iwl_mvm_suspend(struct ieee
+ goto out_noreset;
+ }
+
++ ret = iwl_mvm_sta_ensure_queue(
++ mvm, ap_sta->txq[wowlan_config_cmd.offloading_tid]);
++ if (ret)
++ goto out_noreset;
++
+ ret = iwl_mvm_get_wowlan_config(mvm, wowlan, &wowlan_config_cmd,
+ vif, mvmvif, ap_sta);
+ if (ret)
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -1501,6 +1501,34 @@ out_err:
+ return ret;
+ }
+
++int iwl_mvm_sta_ensure_queue(struct iwl_mvm *mvm,
++ struct ieee80211_txq *txq)
++{
++ struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
++ int ret = -EINVAL;
++
++ lockdep_assert_held(&mvm->mutex);
++
++ if (likely(test_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state)) ||
++ !txq->sta) {
++ return 0;
++ }
++
++ if (!iwl_mvm_sta_alloc_queue(mvm, txq->sta, txq->ac, txq->tid)) {
++ set_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state);
++ ret = 0;
++ }
++
++ local_bh_disable();
++ spin_lock(&mvm->add_stream_lock);
++ if (!list_empty(&mvmtxq->list))
++ list_del_init(&mvmtxq->list);
++ spin_unlock(&mvm->add_stream_lock);
++ local_bh_enable();
++
++ return ret;
++}
++
+ void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk)
+ {
+ struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm,
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
+ /*
+- * Copyright (C) 2012-2014, 2018-2022 Intel Corporation
++ * Copyright (C) 2012-2014, 2018-2024 Intel Corporation
+ * Copyright (C) 2013-2014 Intel Mobile Communications GmbH
+ * Copyright (C) 2015-2016 Intel Deutschland GmbH
+ */
+@@ -577,6 +577,7 @@ void iwl_mvm_modify_all_sta_disable_tx(s
+ bool disable);
+
+ void iwl_mvm_csa_client_absent(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
++int iwl_mvm_sta_ensure_queue(struct iwl_mvm *mvm, struct ieee80211_txq *txq);
+ void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk);
+ int iwl_mvm_add_pasn_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ struct iwl_mvm_int_sta *sta, u8 *addr, u32 cipher,
--- /dev/null
+From b1e8102a4048003097c7054cbc00bbda91a5ced7 Mon Sep 17 00:00:00 2001
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Date: Thu, 26 Dec 2024 17:44:49 +0200
+Subject: wifi: iwlwifi: support BIOS override for 5G9 in CA also in LARI version 8
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+commit b1e8102a4048003097c7054cbc00bbda91a5ced7 upstream.
+
+Commit 6b3e87cc0ca5 ("iwlwifi: Add support for LARI_CONFIG_CHANGE_CMD
+cmd v9")
+added a few bits to iwl_lari_config_change_cmd::oem_unii4_allow_bitmap
+if the FW has LARI version >= 9.
+But we also need to send those bits for version 8 if the FW is capable
+of this feature (indicated with capability bits)
+Add the FW capability bit, and set the additional bits in the cmd when
+the version is 8 and the FW capability bit is set.
+
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://patch.msgid.link/20241226174257.dc5836f84514.I1e38f94465a36731034c94b9811de10cb6ee5921@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/file.h | 4 ++
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 37 +++++++++++++++++++++++++--
+ 2 files changed, 38 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
+@@ -372,6 +372,8 @@ typedef unsigned int __bitwise iwl_ucode
+ * channels even when these are not enabled.
+ * @IWL_UCODE_TLV_CAPA_DUMP_COMPLETE_SUPPORT: Support for indicating dump collection
+ * complete to FW.
++ * @IWL_UCODE_TLV_CAPA_BIOS_OVERRIDE_5G9_FOR_CA: supports (de)activating 5G9
++ * for CA from BIOS.
+ *
+ * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
+ */
+@@ -468,7 +470,7 @@ enum iwl_ucode_tlv_capa {
+ IWL_UCODE_TLV_CAPA_OFFLOAD_BTM_SUPPORT = (__force iwl_ucode_tlv_capa_t)113,
+ IWL_UCODE_TLV_CAPA_STA_EXP_MFP_SUPPORT = (__force iwl_ucode_tlv_capa_t)114,
+ IWL_UCODE_TLV_CAPA_SNIFF_VALIDATE_SUPPORT = (__force iwl_ucode_tlv_capa_t)116,
+-
++ IWL_UCODE_TLV_CAPA_BIOS_OVERRIDE_5G9_FOR_CA = (__force iwl_ucode_tlv_capa_t)123,
+ #ifdef __CHECKER__
+ /* sparse says it cannot increment the previous enum member */
+ #define NUM_IWL_UCODE_TLV_CAPA 128
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -1195,11 +1195,30 @@ static u8 iwl_mvm_eval_dsm_rfi(struct iw
+ return DSM_VALUE_RFI_DISABLE;
+ }
+
++enum iwl_dsm_unii4_bitmap {
++ DSM_VALUE_UNII4_US_OVERRIDE_MSK = BIT(0),
++ DSM_VALUE_UNII4_US_EN_MSK = BIT(1),
++ DSM_VALUE_UNII4_ETSI_OVERRIDE_MSK = BIT(2),
++ DSM_VALUE_UNII4_ETSI_EN_MSK = BIT(3),
++ DSM_VALUE_UNII4_CANADA_OVERRIDE_MSK = BIT(4),
++ DSM_VALUE_UNII4_CANADA_EN_MSK = BIT(5),
++};
++
++#define DSM_UNII4_ALLOW_BITMAP (DSM_VALUE_UNII4_US_OVERRIDE_MSK |\
++ DSM_VALUE_UNII4_US_EN_MSK |\
++ DSM_VALUE_UNII4_ETSI_OVERRIDE_MSK |\
++ DSM_VALUE_UNII4_ETSI_EN_MSK |\
++ DSM_VALUE_UNII4_CANADA_OVERRIDE_MSK |\
++ DSM_VALUE_UNII4_CANADA_EN_MSK)
++
+ static void iwl_mvm_lari_cfg(struct iwl_mvm *mvm)
+ {
+ int ret;
+ u32 value;
+ struct iwl_lari_config_change_cmd_v6 cmd = {};
++ u8 cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw,
++ WIDE_ID(REGULATORY_AND_NVM_GROUP,
++ LARI_CONFIG_CHANGE), 1);
+
+ cmd.config_bitmap = iwl_acpi_get_lari_config_bitmap(&mvm->fwrt);
+
+@@ -1211,8 +1230,22 @@ static void iwl_mvm_lari_cfg(struct iwl_
+ ret = iwl_acpi_get_dsm_u32(mvm->fwrt.dev, 0,
+ DSM_FUNC_ENABLE_UNII4_CHAN,
+ &iwl_guid, &value);
+- if (!ret)
+- cmd.oem_unii4_allow_bitmap = cpu_to_le32(value);
++ if (!ret) {
++ u32 _value = cpu_to_le32(value);
++
++ _value &= DSM_UNII4_ALLOW_BITMAP;
++
++ /* Since version 9, bits 4 and 5 are supported
++ * regardless of this capability.
++ */
++ if (cmd_ver < 9 &&
++ !fw_has_capa(&mvm->fw->ucode_capa,
++ IWL_UCODE_TLV_CAPA_BIOS_OVERRIDE_5G9_FOR_CA))
++ _value &= ~(DSM_VALUE_UNII4_CANADA_OVERRIDE_MSK |
++ DSM_VALUE_UNII4_CANADA_EN_MSK);
++
++ cmd.oem_unii4_allow_bitmap = cpu_to_le32(_value);
++ }
+
+ ret = iwl_acpi_get_dsm_u32(mvm->fwrt.dev, 0,
+ DSM_FUNC_ACTIVATE_CHANNEL,
projects / thirdparty / kernel / stable-queue.git / commitdiff
