From: Sasha Levin Date: Sun, 20 Apr 2025 14:59:54 +0000 (-0400) Subject: Fixes for 6.14 X-Git-Tag: v6.1.135~147 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=021021293df66f56489e587592fe087f179d1080;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.14 Signed-off-by: Sasha Levin --- diff --git a/queue-6.14/alsa-hda-cirrus_scodec_test-don-t-select-dependencie.patch b/queue-6.14/alsa-hda-cirrus_scodec_test-don-t-select-dependencie.patch new file mode 100644 index 0000000000..3c1e6dc82f --- /dev/null +++ b/queue-6.14/alsa-hda-cirrus_scodec_test-don-t-select-dependencie.patch @@ -0,0 +1,42 @@ +From 9ed1d589828fc585fe3c472877e24b3725ba45a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 12:45:20 +0100 +Subject: ALSA: hda/cirrus_scodec_test: Don't select dependencies + +From: Richard Fitzgerald + +[ Upstream commit e9c7fa025dc6125eb47993515d45da0cd02a263c ] + +Depend on SND_HDA_CIRRUS_SCODEC and GPIOLIB instead of selecting them. + +KUNIT_ALL_TESTS should only build tests that have satisfied dependencies +and test components that are already being built. It must not cause +other stuff to be added to the build. + +Fixes: 2144833e7b41 ("ALSA: hda: cirrus_scodec: Add KUnit test") +Signed-off-by: Richard Fitzgerald +Link: https://patch.msgid.link/20250409114520.914079-1-rf@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/Kconfig | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig +index 84ebf19f28836..ddbbfd5b274f5 100644 +--- a/sound/pci/hda/Kconfig ++++ b/sound/pci/hda/Kconfig +@@ -96,9 +96,7 @@ config SND_HDA_CIRRUS_SCODEC + + config SND_HDA_CIRRUS_SCODEC_KUNIT_TEST + tristate "KUnit test for Cirrus side-codec library" if !KUNIT_ALL_TESTS +- select SND_HDA_CIRRUS_SCODEC +- select GPIOLIB +- depends on KUNIT ++ depends on SND_HDA_CIRRUS_SCODEC && GPIOLIB && KUNIT + default KUNIT_ALL_TESTS + help + This builds KUnit tests for the cirrus side-codec library. +-- +2.39.5 + diff --git a/queue-6.14/alsa-hda-realtek-fixed-asus-platform-headset-mic-iss.patch b/queue-6.14/alsa-hda-realtek-fixed-asus-platform-headset-mic-iss.patch new file mode 100644 index 0000000000..8e20b2f0ba --- /dev/null +++ b/queue-6.14/alsa-hda-realtek-fixed-asus-platform-headset-mic-iss.patch @@ -0,0 +1,81 @@ +From 94f761a5c4e62ea3f09be75dffe947553c1c1388 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 15:09:08 +0800 +Subject: ALSA: hda/realtek - Fixed ASUS platform headset Mic issue + +From: Kailang Yang + +[ Upstream commit b5458fcabd96ce29adbf7225c1741ecdfff70a91 ] + +ASUS platform Headset Mic was disable by default. +Assigned verb table for Mic pin will enable it. + +Fixes: 7ab61d0a9a35 ("ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA") +Fixes: c86dd79a7c33 ("ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA") +Signed-off-by: Kailang Yang +Link: https://lore.kernel.org/0fe3421a6850461fb0b7012cb28ef71d@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 8e482f6ecafea..356df48c97309 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7924,6 +7924,7 @@ enum { + ALC233_FIXUP_MEDION_MTL_SPK, + ALC294_FIXUP_BASS_SPEAKER_15, + ALC283_FIXUP_DELL_HP_RESUME, ++ ALC294_FIXUP_ASUS_CS35L41_SPI_2, + }; + + /* A special fixup for Lenovo C940 and Yoga Duet 7; +@@ -10278,6 +10279,12 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc283_fixup_dell_hp_resume, + }, ++ [ALC294_FIXUP_ASUS_CS35L41_SPI_2] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cs35l41_fixup_spi_two, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC, ++ }, + }; + + static const struct hda_quirk alc269_fixup_tbl[] = { +@@ -10763,7 +10770,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x12a3, "Asus N7691ZM", ALC269_FIXUP_ASUS_N7601ZM), + SND_PCI_QUIRK(0x1043, 0x12af, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2), +- SND_PCI_QUIRK(0x1043, 0x12b4, "ASUS B3405CCA / P3405CCA", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x12b4, "ASUS B3405CCA / P3405CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE), +@@ -10853,14 +10860,14 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1fb3, "ASUS ROG Flow Z13 GZ302EA", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x3011, "ASUS B5605CVA", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), +- SND_PCI_QUIRK(0x1043, 0x3061, "ASUS B3405CCA", ALC245_FIXUP_CS35L41_SPI_2), +- SND_PCI_QUIRK(0x1043, 0x3071, "ASUS B5405CCA", ALC245_FIXUP_CS35L41_SPI_2), +- SND_PCI_QUIRK(0x1043, 0x30c1, "ASUS B3605CCA / P3605CCA", ALC245_FIXUP_CS35L41_SPI_2), +- SND_PCI_QUIRK(0x1043, 0x30d1, "ASUS B5405CCA", ALC245_FIXUP_CS35L41_SPI_2), +- SND_PCI_QUIRK(0x1043, 0x30e1, "ASUS B5605CCA", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3061, "ASUS B3405CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3071, "ASUS B5405CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x30c1, "ASUS B3605CCA / P3605CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x30d1, "ASUS B5405CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x30e1, "ASUS B5605CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x31d0, "ASUS Zen AIO 27 Z272SD_A272SD", ALC274_FIXUP_ASUS_ZEN_AIO_27), +- SND_PCI_QUIRK(0x1043, 0x31e1, "ASUS B5605CCA", ALC245_FIXUP_CS35L41_SPI_2), +- SND_PCI_QUIRK(0x1043, 0x31f1, "ASUS B3605CCA", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x31e1, "ASUS B5605CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x31f1, "ASUS B3605CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS), + SND_PCI_QUIRK(0x1043, 0x3a30, "ASUS G814JVR/JIR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS), + SND_PCI_QUIRK(0x1043, 0x3a40, "ASUS G814JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS), +-- +2.39.5 + diff --git a/queue-6.14/asoc-cs42l43-reset-clamp-override-on-jack-removal.patch b/queue-6.14/asoc-cs42l43-reset-clamp-override-on-jack-removal.patch new file mode 100644 index 0000000000..e105862ce5 --- /dev/null +++ b/queue-6.14/asoc-cs42l43-reset-clamp-override-on-jack-removal.patch @@ -0,0 +1,39 @@ +From 6c8b21f8739fcb0181b5c8196bb72f9afe9be8b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 13:07:17 +0100 +Subject: ASoC: cs42l43: Reset clamp override on jack removal + +From: Charles Keepax + +[ Upstream commit 5fc7d2b5cab47f2ac712f689140b1fed978fb91c ] + +Some of the manually selected jack configurations will disable the +headphone clamp override. Restore this on jack removal, such that +the state is consistent for a new insert. + +Fixes: fc918cbe874e ("ASoC: cs42l43: Add support for the cs42l43") +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20250409120717.1294528-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l43-jack.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c +index ac19a572fe70c..20e6ab6f0d4ad 100644 +--- a/sound/soc/codecs/cs42l43-jack.c ++++ b/sound/soc/codecs/cs42l43-jack.c +@@ -702,6 +702,9 @@ static void cs42l43_clear_jack(struct cs42l43_codec *priv) + CS42L43_PGA_WIDESWING_MODE_EN_MASK, 0); + regmap_update_bits(cs42l43->regmap, CS42L43_STEREO_MIC_CTRL, + CS42L43_JACK_STEREO_CONFIG_MASK, 0); ++ regmap_update_bits(cs42l43->regmap, CS42L43_STEREO_MIC_CLAMP_CTRL, ++ CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_MASK, ++ CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_MASK); + regmap_update_bits(cs42l43->regmap, CS42L43_HS2, + CS42L43_HSDET_MODE_MASK | CS42L43_HSDET_MANUAL_MODE_MASK, + 0x2 << CS42L43_HSDET_MODE_SHIFT); +-- +2.39.5 + diff --git a/queue-6.14/asoc-dwc-always-enable-disable-i2s-irqs.patch b/queue-6.14/asoc-dwc-always-enable-disable-i2s-irqs.patch new file mode 100644 index 0000000000..0c3b4c7674 --- /dev/null +++ b/queue-6.14/asoc-dwc-always-enable-disable-i2s-irqs.patch @@ -0,0 +1,62 @@ +From 07b3f7ff48bc865e26c1b3056fe0ef6992d974a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Mar 2025 09:08:54 -0400 +Subject: ASoC: dwc: always enable/disable i2s irqs + +From: Brady Norander + +[ Upstream commit 2b727b3f8a04fe52f55316ccb8792cfd9b2dd05d ] + +Commit a42e988 ("ASoC: dwc: add DMA handshake control") changed the +behavior of the driver to not enable or disable i2s irqs if using DMA. This +breaks platforms such as AMD ACP. Audio playback appears to work but no +audio can be heard. Revert to the old behavior by always enabling and +disabling i2s irqs while keeping DMA handshake control. + +Fixes: a42e988b626 ("ASoC: dwc: add DMA handshake control") +Signed-off-by: Brady Norander +Link: https://patch.msgid.link/20250330130852.37881-3-bradynorander@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/dwc/dwc-i2s.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c +index 57b789d7fbedd..5b4f20dbf7bba 100644 +--- a/sound/soc/dwc/dwc-i2s.c ++++ b/sound/soc/dwc/dwc-i2s.c +@@ -199,12 +199,10 @@ static void i2s_start(struct dw_i2s_dev *dev, + else + i2s_write_reg(dev->i2s_base, IRER, 1); + +- /* I2S needs to enable IRQ to make a handshake with DMAC on the JH7110 SoC */ +- if (dev->use_pio || dev->is_jh7110) +- i2s_enable_irqs(dev, substream->stream, config->chan_nr); +- else ++ if (!(dev->use_pio || dev->is_jh7110)) + i2s_enable_dma(dev, substream->stream); + ++ i2s_enable_irqs(dev, substream->stream, config->chan_nr); + i2s_write_reg(dev->i2s_base, CER, 1); + } + +@@ -218,11 +216,12 @@ static void i2s_stop(struct dw_i2s_dev *dev, + else + i2s_write_reg(dev->i2s_base, IRER, 0); + +- if (dev->use_pio || dev->is_jh7110) +- i2s_disable_irqs(dev, substream->stream, 8); +- else ++ if (!(dev->use_pio || dev->is_jh7110)) + i2s_disable_dma(dev, substream->stream); + ++ i2s_disable_irqs(dev, substream->stream, 8); ++ ++ + if (!dev->active) { + i2s_write_reg(dev->i2s_base, CER, 0); + i2s_write_reg(dev->i2s_base, IER, 0); +-- +2.39.5 + diff --git a/queue-6.14/asoc-intel-avs-fix-null-ptr-deref-in-avs_component_p.patch b/queue-6.14/asoc-intel-avs-fix-null-ptr-deref-in-avs_component_p.patch new file mode 100644 index 0000000000..f6a8499965 --- /dev/null +++ b/queue-6.14/asoc-intel-avs-fix-null-ptr-deref-in-avs_component_p.patch @@ -0,0 +1,41 @@ +From 83322e57198b46269e14f183a745f297f95e78e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 22:14:11 +0800 +Subject: ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() + +From: Henry Martin + +[ Upstream commit 95f723cf141b95e3b3a5b92cf2ea98a863fe7275 ] + +devm_kasprintf() returns NULL when memory allocation fails. Currently, +avs_component_probe() does not check for this case, which results in a +NULL pointer dereference. + +Fixes: 739c031110da ("ASoC: Intel: avs: Provide support for fallback topology") +Reviewed-by: Cezary Rojewski +Reviewed-by: Ethan Carter Edwards +Signed-off-by: Henry Martin +Link: https://patch.msgid.link/20250402141411.44972-1-bsdhenrymartin@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/pcm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c +index 4bfbcb5a5ae8a..f7dd17849e97b 100644 +--- a/sound/soc/intel/avs/pcm.c ++++ b/sound/soc/intel/avs/pcm.c +@@ -927,7 +927,8 @@ static int avs_component_probe(struct snd_soc_component *component) + else + mach->tplg_filename = devm_kasprintf(adev->dev, GFP_KERNEL, + "hda-generic-tplg.bin"); +- ++ if (!mach->tplg_filename) ++ return -ENOMEM; + filename = kasprintf(GFP_KERNEL, "%s/%s", component->driver->topology_name_prefix, + mach->tplg_filename); + if (!filename) +-- +2.39.5 + diff --git a/queue-6.14/ata-libata-sata-save-all-fields-from-sense-data-desc.patch b/queue-6.14/ata-libata-sata-save-all-fields-from-sense-data-desc.patch new file mode 100644 index 0000000000..7d1340ba53 --- /dev/null +++ b/queue-6.14/ata-libata-sata-save-all-fields-from-sense-data-desc.patch @@ -0,0 +1,80 @@ +From 1048a3552ff2207e196eb3076475fcc9b75bdefd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 09:30:15 +0200 +Subject: ata: libata-sata: Save all fields from sense data descriptor + +From: Niklas Cassel + +[ Upstream commit 399eab7f92fb73ffe621294a2d6bec8fc9f3b36b ] + +When filling the taskfile result for a successful NCQ command, we use +the SDB FIS from the FIS Receive Area, see e.g. ahci_qc_ncq_fill_rtf(). + +However, the SDB FIS only has fields STATUS and ERROR. + +For a successful NCQ command that has sense data, we will have a +successful sense data descriptor, in the Sense Data for Successful NCQ +Commands log. + +Since we have access to additional taskfile result fields, fill in these +additional fields in qc->result_tf. + +This matches how for failing/aborted NCQ commands, we will use e.g. +ahci_qc_fill_rtf() to fill in some fields, but then for the command that +actually caused the NCQ error, we will use ata_eh_read_log_10h(), which +provides additional fields, saving additional fields/overriding the +qc->result_tf that was fetched using ahci_qc_fill_rtf(). + +Fixes: 18bd7718b5c4 ("scsi: ata: libata: Handle completion of CDL commands using policy 0xD") +Signed-off-by: Niklas Cassel +Reviewed-by: Igor Pylypiv +Reviewed-by: Hannes Reinecke +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-sata.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/ata/libata-sata.c b/drivers/ata/libata-sata.c +index ba300cc0a3a32..2e4463d3a3561 100644 +--- a/drivers/ata/libata-sata.c ++++ b/drivers/ata/libata-sata.c +@@ -1510,6 +1510,8 @@ int ata_eh_get_ncq_success_sense(struct ata_link *link) + unsigned int err_mask, tag; + u8 *sense, sk = 0, asc = 0, ascq = 0; + u64 sense_valid, val; ++ u16 extended_sense; ++ bool aux_icc_valid; + int ret = 0; + + err_mask = ata_read_log_page(dev, ATA_LOG_SENSE_NCQ, 0, buf, 2); +@@ -1529,6 +1531,8 @@ int ata_eh_get_ncq_success_sense(struct ata_link *link) + + sense_valid = (u64)buf[8] | ((u64)buf[9] << 8) | + ((u64)buf[10] << 16) | ((u64)buf[11] << 24); ++ extended_sense = get_unaligned_le16(&buf[14]); ++ aux_icc_valid = extended_sense & BIT(15); + + ata_qc_for_each_raw(ap, qc, tag) { + if (!(qc->flags & ATA_QCFLAG_EH) || +@@ -1556,6 +1560,17 @@ int ata_eh_get_ncq_success_sense(struct ata_link *link) + continue; + } + ++ qc->result_tf.nsect = sense[6]; ++ qc->result_tf.hob_nsect = sense[7]; ++ qc->result_tf.lbal = sense[8]; ++ qc->result_tf.lbam = sense[9]; ++ qc->result_tf.lbah = sense[10]; ++ qc->result_tf.hob_lbal = sense[11]; ++ qc->result_tf.hob_lbam = sense[12]; ++ qc->result_tf.hob_lbah = sense[13]; ++ if (aux_icc_valid) ++ qc->result_tf.auxiliary = get_unaligned_le32(&sense[16]); ++ + /* Set sense without also setting scsicmd->result */ + scsi_build_sense_buffer(dev->flags & ATA_DFLAG_D_SENSE, + qc->scsicmd->sense_buffer, sk, +-- +2.39.5 + diff --git a/queue-6.14/block-fix-resource-leak-in-blk_register_queue-error-.patch b/queue-6.14/block-fix-resource-leak-in-blk_register_queue-error-.patch new file mode 100644 index 0000000000..a603fa09e8 --- /dev/null +++ b/queue-6.14/block-fix-resource-leak-in-blk_register_queue-error-.patch @@ -0,0 +1,43 @@ +From 978324b1c8d9d318c054433508854f81c6723ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Apr 2025 17:25:54 +0800 +Subject: block: fix resource leak in blk_register_queue() error path + +From: Zheng Qixing + +[ Upstream commit 40f2eb9b531475dd01b683fdaf61ca3cfd03a51e ] + +When registering a queue fails after blk_mq_sysfs_register() is +successful but the function later encounters an error, we need +to clean up the blk_mq_sysfs resources. + +Add the missing blk_mq_sysfs_unregister() call in the error path +to properly clean up these resources and prevent a memory leak. + +Fixes: 320ae51feed5 ("blk-mq: new multi-queue block IO queueing mechanism") +Signed-off-by: Zheng Qixing +Reviewed-by: Christoph Hellwig +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20250412092554.475218-1-zhengqixing@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-sysfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 6f548a4376aa4..7802186849074 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -824,6 +824,8 @@ int blk_register_queue(struct gendisk *disk) + out_debugfs_remove: + blk_debugfs_remove(disk); + mutex_unlock(&q->sysfs_lock); ++ if (queue_is_mq(q)) ++ blk_mq_sysfs_unregister(disk); + out_put_queue_kobj: + kobject_put(&disk->queue_kobj); + return ret; +-- +2.39.5 + diff --git a/queue-6.14/bluetooth-btrtl-prevent-potential-null-dereference.patch b/queue-6.14/bluetooth-btrtl-prevent-potential-null-dereference.patch new file mode 100644 index 0000000000..9937f27028 --- /dev/null +++ b/queue-6.14/bluetooth-btrtl-prevent-potential-null-dereference.patch @@ -0,0 +1,42 @@ +From 7b09d44eadb4f8196a06f04f672f6069720c59ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 14:01:41 +0300 +Subject: Bluetooth: btrtl: Prevent potential NULL dereference + +From: Dan Carpenter + +[ Upstream commit 324dddea321078a6eeb535c2bff5257be74c9799 ] + +The btrtl_initialize() function checks that rtl_load_file() either +had an error or it loaded a zero length file. However, if it loaded +a zero length file then the error code is not set correctly. It +results in an error pointer vs NULL bug, followed by a NULL pointer +dereference. This was detected by Smatch: + +drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR' + +Fixes: 26503ad25de8 ("Bluetooth: btrtl: split the device initialization into smaller parts") +Signed-off-by: Dan Carpenter +Reviewed-by: Hans de Goede +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btrtl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c +index d3eba0d4a57d3..7838c89e529e0 100644 +--- a/drivers/bluetooth/btrtl.c ++++ b/drivers/bluetooth/btrtl.c +@@ -1215,6 +1215,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + rtl_dev_err(hdev, "mandatory config file %s not found", + btrtl_dev->ic_info->cfg_name); + ret = btrtl_dev->cfg_len; ++ if (!ret) ++ ret = -EINVAL; + goto err_free; + } + } +-- +2.39.5 + diff --git a/queue-6.14/bluetooth-hci_event-fix-sending-mgmt_ev_device_found.patch b/queue-6.14/bluetooth-hci_event-fix-sending-mgmt_ev_device_found.patch new file mode 100644 index 0000000000..bfb30a02c3 --- /dev/null +++ b/queue-6.14/bluetooth-hci_event-fix-sending-mgmt_ev_device_found.patch @@ -0,0 +1,50 @@ +From 4b447aa3681a2c3f246085efbadb600271579439 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 13:02:08 -0400 +Subject: Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid + address + +From: Luiz Augusto von Dentz + +[ Upstream commit eb73b5a9157221f405b4fe32751da84ee46b7a25 ] + +This fixes sending MGMT_EV_DEVICE_FOUND for invalid address +(00:00:00:00:00:00) which is a regression introduced by +a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report") +since in the attempt to skip storing data for extended advertisement it +actually made the code to skip the entire if statement supposed to send +MGMT_EV_DEVICE_FOUND without attempting to use the last_addr_adv which +is garanteed to be invalid for extended advertisement since we never +store anything on it. + +Link: https://github.com/bluez/bluez/issues/1157 +Link: https://github.com/bluez/bluez/issues/1149#issuecomment-2767215658 +Fixes: a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index e2bfbcee06a80..20d3cdcb14f6c 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -6153,11 +6153,12 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, + * event or send an immediate device found event if the data + * should not be stored for later. + */ +- if (!ext_adv && !has_pending_adv_report(hdev)) { ++ if (!has_pending_adv_report(hdev)) { + /* If the report will trigger a SCAN_REQ store it for + * later merging. + */ +- if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) { ++ if (!ext_adv && (type == LE_ADV_IND || ++ type == LE_ADV_SCAN_IND)) { + store_pending_adv_report(hdev, bdaddr, bdaddr_type, + rssi, flags, data, len); + return; +-- +2.39.5 + diff --git a/queue-6.14/bluetooth-l2cap-check-encryption-key-size-on-incomin.patch b/queue-6.14/bluetooth-l2cap-check-encryption-key-size-on-incomin.patch new file mode 100644 index 0000000000..e459596f84 --- /dev/null +++ b/queue-6.14/bluetooth-l2cap-check-encryption-key-size-on-incomin.patch @@ -0,0 +1,81 @@ +From fdcd74edabddc38e338d4feba1ae9877d908aa5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 10:53:06 +0200 +Subject: Bluetooth: l2cap: Check encryption key size on incoming connection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frédéric Danis + +[ Upstream commit 522e9ed157e3c21b4dd623c79967f72c21e45b78 ] + +This is required for passing GAP/SEC/SEM/BI-04-C PTS test case: + Security Mode 4 Level 4, Responder - Invalid Encryption Key Size + - 128 bit + +This tests the security key with size from 1 to 15 bytes while the +Security Mode 4 Level 4 requests 16 bytes key size. + +Currently PTS fails with the following logs: +- expected:Connection Response: + Code: [3 (0x03)] Code + Identifier: (lt)WildCard: Exists(gt) + Length: [8 (0x0008)] + Destination CID: (lt)WildCard: Exists(gt) + Source CID: [64 (0x0040)] + Result: [3 (0x0003)] Connection refused - Security block + Status: (lt)WildCard: Exists(gt), +but received:Connection Response: + Code: [3 (0x03)] Code + Identifier: [1 (0x01)] + Length: [8 (0x0008)] + Destination CID: [64 (0x0040)] + Source CID: [64 (0x0040)] + Result: [0 (0x0000)] Connection Successful + Status: [0 (0x0000)] No further information available + +And HCI logs: +< HCI Command: Read Encrypti.. (0x05|0x0008) plen 2 + Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) +> HCI Event: Command Complete (0x0e) plen 7 + Read Encryption Key Size (0x05|0x0008) ncmd 1 + Status: Success (0x00) + Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) + Key size: 7 +> ACL Data RX: Handle 14 flags 0x02 dlen 12 + L2CAP: Connection Request (0x02) ident 1 len 4 + PSM: 4097 (0x1001) + Source CID: 64 +< ACL Data TX: Handle 14 flags 0x00 dlen 16 + L2CAP: Connection Response (0x03) ident 1 len 8 + Destination CID: 64 + Source CID: 64 + Result: Connection successful (0x0000) + Status: No further information available (0x0000) + +Fixes: 288c06973daa ("Bluetooth: Enforce key size of 16 bytes on FIPS level") +Signed-off-by: Frédéric Danis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index c27ea70f71e1e..499e38ed639e6 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -3956,7 +3956,8 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, + + /* Check if the ACL is secure enough (if not SDP) */ + if (psm != cpu_to_le16(L2CAP_PSM_SDP) && +- !hci_conn_check_link_mode(conn->hcon)) { ++ (!hci_conn_check_link_mode(conn->hcon) || ++ !l2cap_check_enc_key_size(conn->hcon))) { + conn->disc_reason = HCI_ERROR_AUTH_FAILURE; + result = L2CAP_CR_SEC_BLOCK; + goto response; +-- +2.39.5 + diff --git a/queue-6.14/bluetooth-qca-fix-nv-variant-for-one-of-wcn3950-socs.patch b/queue-6.14/bluetooth-qca-fix-nv-variant-for-one-of-wcn3950-socs.patch new file mode 100644 index 0000000000..321139feb8 --- /dev/null +++ b/queue-6.14/bluetooth-qca-fix-nv-variant-for-one-of-wcn3950-socs.patch @@ -0,0 +1,39 @@ +From 01f80788ede99950303b7913a65e815e0a4fff24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 18:04:03 +0300 +Subject: Bluetooth: qca: fix NV variant for one of WCN3950 SoCs + +From: Dmitry Baryshkov + +[ Upstream commit e92900c9803fb35ad6cf599cb268b8ddd9f91940 ] + +The QCA_WCN3950_SOC_ID_S should be using qca/cmnv13s.bin, rather than +qca/cmnv13u.bin file. Correct the variant suffix to be used for this SoC +ID. + +Fixes: d5712c511cb3 ("Bluetooth: qca: add WCN3950 support") +Reported-by: Wojciech Slenska +Closes: https://github.com/qualcomm-linux/meta-qcom/pull/817#discussion_r2022866431 +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btqca.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c +index 3d6778b95e005..edefb9dc76aa1 100644 +--- a/drivers/bluetooth/btqca.c ++++ b/drivers/bluetooth/btqca.c +@@ -889,7 +889,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, + if (le32_to_cpu(ver.soc_id) == QCA_WCN3950_SOC_ID_T) + variant = "t"; + else if (le32_to_cpu(ver.soc_id) == QCA_WCN3950_SOC_ID_S) +- variant = "u"; ++ variant = "s"; + + snprintf(config.fwname, sizeof(config.fwname), + "qca/cmnv%02x%s.bin", rom_ver, variant); +-- +2.39.5 + diff --git a/queue-6.14/can-rockchip_canfd-fix-broken-quirks-checks.patch b/queue-6.14/can-rockchip_canfd-fix-broken-quirks-checks.patch new file mode 100644 index 0000000000..20f4addc14 --- /dev/null +++ b/queue-6.14/can-rockchip_canfd-fix-broken-quirks-checks.patch @@ -0,0 +1,48 @@ +From 40168e4a7f118b21d866e34ac73bc75fa48b0a5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 19:44:16 +0800 +Subject: can: rockchip_canfd: fix broken quirks checks + +From: Weizhao Ouyang + +[ Upstream commit 6315d93541f8a5f77c5ef5c4f25233e66d189603 ] + +First get the devtype_data then check quirks. + +Fixes: bbdffb341498 ("can: rockchip_canfd: add quirk for broken CAN-FD support") +Signed-off-by: Weizhao Ouyang +Reviewed-by: Vincent Mailhol +Link: https://patch.msgid.link/20250324114416.10160-1-o451686892@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rockchip/rockchip_canfd-core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/rockchip/rockchip_canfd-core.c b/drivers/net/can/rockchip/rockchip_canfd-core.c +index 46201c126703c..7107a37da36c7 100644 +--- a/drivers/net/can/rockchip/rockchip_canfd-core.c ++++ b/drivers/net/can/rockchip/rockchip_canfd-core.c +@@ -902,15 +902,16 @@ static int rkcanfd_probe(struct platform_device *pdev) + priv->can.data_bittiming_const = &rkcanfd_data_bittiming_const; + priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK | + CAN_CTRLMODE_BERR_REPORTING; +- if (!(priv->devtype_data.quirks & RKCANFD_QUIRK_CANFD_BROKEN)) +- priv->can.ctrlmode_supported |= CAN_CTRLMODE_FD; + priv->can.do_set_mode = rkcanfd_set_mode; + priv->can.do_get_berr_counter = rkcanfd_get_berr_counter; + priv->ndev = ndev; + + match = device_get_match_data(&pdev->dev); +- if (match) ++ if (match) { + priv->devtype_data = *(struct rkcanfd_devtype_data *)match; ++ if (!(priv->devtype_data.quirks & RKCANFD_QUIRK_CANFD_BROKEN)) ++ priv->can.ctrlmode_supported |= CAN_CTRLMODE_FD; ++ } + + err = can_rx_offload_add_manual(ndev, &priv->offload, + RKCANFD_NAPI_WEIGHT); +-- +2.39.5 + diff --git a/queue-6.14/cpufreq-sched-fix-the-usage-of-cpufreq_need_update_l.patch b/queue-6.14/cpufreq-sched-fix-the-usage-of-cpufreq_need_update_l.patch new file mode 100644 index 0000000000..330c148c17 --- /dev/null +++ b/queue-6.14/cpufreq-sched-fix-the-usage-of-cpufreq_need_update_l.patch @@ -0,0 +1,78 @@ +From 1e945f81b0d76e2f20c4975b86c473c62bed319c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 11:58:08 +0200 +Subject: cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS + +From: Rafael J. Wysocki + +[ Upstream commit cfde542df7dd51d26cf667f4af497878ddffd85a ] + +Commit 8e461a1cb43d ("cpufreq: schedutil: Fix superfluous updates caused +by need_freq_update") modified sugov_should_update_freq() to set the +need_freq_update flag only for drivers with CPUFREQ_NEED_UPDATE_LIMITS +set, but that flag generally needs to be set when the policy limits +change because the driver callback may need to be invoked for the new +limits to take effect. + +However, if the return value of cpufreq_driver_resolve_freq() after +applying the new limits is still equal to the previously selected +frequency, the driver callback needs to be invoked only in the case +when CPUFREQ_NEED_UPDATE_LIMITS is set (which means that the driver +specifically wants its callback to be invoked every time the policy +limits change). + +Update the code accordingly to avoid missing policy limits changes for +drivers without CPUFREQ_NEED_UPDATE_LIMITS. + +Fixes: 8e461a1cb43d ("cpufreq: schedutil: Fix superfluous updates caused by need_freq_update") +Closes: https://lore.kernel.org/lkml/Z_Tlc6Qs-tYpxWYb@linaro.org/ +Reported-by: Stephan Gerhold +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Christian Loehle +Link: https://patch.msgid.link/3010358.e9J7NaK4W3@rjwysocki.net +Signed-off-by: Sasha Levin +--- + kernel/sched/cpufreq_schedutil.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index 1a19d69b91ed3..b713ce0a57020 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -83,7 +83,7 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) + + if (unlikely(sg_policy->limits_changed)) { + sg_policy->limits_changed = false; +- sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS); ++ sg_policy->need_freq_update = true; + return true; + } + +@@ -95,10 +95,22 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) + static bool sugov_update_next_freq(struct sugov_policy *sg_policy, u64 time, + unsigned int next_freq) + { +- if (sg_policy->need_freq_update) ++ if (sg_policy->need_freq_update) { + sg_policy->need_freq_update = false; +- else if (sg_policy->next_freq == next_freq) ++ /* ++ * The policy limits have changed, but if the return value of ++ * cpufreq_driver_resolve_freq() after applying the new limits ++ * is still equal to the previously selected frequency, the ++ * driver callback need not be invoked unless the driver ++ * specifically wants that to happen on every update of the ++ * policy limits. ++ */ ++ if (sg_policy->next_freq == next_freq && ++ !cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS)) ++ return false; ++ } else if (sg_policy->next_freq == next_freq) { + return false; ++ } + + sg_policy->next_freq = next_freq; + sg_policy->last_freq_update_time = time; +-- +2.39.5 + diff --git a/queue-6.14/crypto-tegra-fix-iv-usage-for-aes-ecb.patch b/queue-6.14/crypto-tegra-fix-iv-usage-for-aes-ecb.patch new file mode 100644 index 0000000000..e59e238281 --- /dev/null +++ b/queue-6.14/crypto-tegra-fix-iv-usage-for-aes-ecb.patch @@ -0,0 +1,50 @@ +From f687cd02ee4a5e7a4df78b78747290e6eb4cbda5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 20:21:10 +0530 +Subject: crypto: tegra - Fix IV usage for AES ECB + +From: Akhil R + +[ Upstream commit 1ddaff40c08abb926be5ba713c5efc412d0836c5 ] + +Modifying the crypto_request turns out to be not the right way to handle +the stale value issue with the IV. Though the IV is not used for AES ECB, +it eventually get used in algorithms like LRW in the next step after +AES ECB encryption/decryption. Setting req->iv to NULL breaks the +implementation of such algorithms. Hence modify only the local reqctx +to check for IV. + +Fixes: bde558220866 ("crypto: tegra - Set IV to NULL explicitly for AES ECB") +Signed-off-by: Akhil R +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/tegra/tegra-se-aes.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c +index ca9d0cca1f748..0e07d0523291a 100644 +--- a/drivers/crypto/tegra/tegra-se-aes.c ++++ b/drivers/crypto/tegra/tegra-se-aes.c +@@ -269,7 +269,7 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq) + unsigned int cmdlen, key1_id, key2_id; + int ret; + +- rctx->iv = (u32 *)req->iv; ++ rctx->iv = (ctx->alg == SE_ALG_ECB) ? NULL : (u32 *)req->iv; + rctx->len = req->cryptlen; + key1_id = ctx->key1_id; + key2_id = ctx->key2_id; +@@ -498,9 +498,6 @@ static int tegra_aes_crypt(struct skcipher_request *req, bool encrypt) + if (!req->cryptlen) + return 0; + +- if (ctx->alg == SE_ALG_ECB) +- req->iv = NULL; +- + rctx->encrypt = encrypt; + + return crypto_transfer_skcipher_request_to_engine(ctx->se->engine, req); +-- +2.39.5 + diff --git a/queue-6.14/cxgb4-fix-memory-leak-in-cxgb4_init_ethtool_filters-.patch b/queue-6.14/cxgb4-fix-memory-leak-in-cxgb4_init_ethtool_filters-.patch new file mode 100644 index 0000000000..881744f079 --- /dev/null +++ b/queue-6.14/cxgb4-fix-memory-leak-in-cxgb4_init_ethtool_filters-.patch @@ -0,0 +1,43 @@ +From a327c063f1134f236accd35a9605ddf5a73075ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 22:36:46 +0530 +Subject: cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path + +From: Abdun Nihaal + +[ Upstream commit 00ffb3724ce743578163f5ade2884374554ca021 ] + +In the for loop used to allocate the loc_array and bmap for each port, a +memory leak is possible when the allocation for loc_array succeeds, +but the allocation for bmap fails. This is because when the control flow +goes to the label free_eth_finfo, only the allocations starting from +(i-1)th iteration are freed. + +Fix that by freeing the loc_array in the bmap allocation error path. + +Fixes: d915c299f1da ("cxgb4: add skeleton for ethtool n-tuple filters") +Signed-off-by: Abdun Nihaal +Reviewed-by: Simon Horman +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250414170649.89156-1-abdun.nihaal@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c +index 7f3f5afa864f4..1546c3db08f09 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c +@@ -2270,6 +2270,7 @@ int cxgb4_init_ethtool_filters(struct adapter *adap) + eth_filter->port[i].bmap = bitmap_zalloc(nentries, GFP_KERNEL); + if (!eth_filter->port[i].bmap) { + ret = -ENOMEM; ++ kvfree(eth_filter->port[i].loc_array); + goto free_eth_finfo; + } + } +-- +2.39.5 + diff --git a/queue-6.14/dt-bindings-soc-fsl-fsl-ls1028a-reset-fix-maintainer.patch b/queue-6.14/dt-bindings-soc-fsl-fsl-ls1028a-reset-fix-maintainer.patch new file mode 100644 index 0000000000..8d669bdee4 --- /dev/null +++ b/queue-6.14/dt-bindings-soc-fsl-fsl-ls1028a-reset-fix-maintainer.patch @@ -0,0 +1,42 @@ +From b2bf5c2181dbc57922f8320344083b48aa45fed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 18:11:12 +0200 +Subject: dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry + +From: Geert Uytterhoeven + +[ Upstream commit d5f49921707cc73376ad6cf8410218b438fcd233 ] + +make dt_binding_check: + + Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml: maintainers:0: 'Frank Li' does not match '@' + from schema $id: http://devicetree.org/meta-schemas/base.yaml# + +Fix this by adding Frank's email address. + +Fixes: 9ca5a7d9d2e05de6 ("dt-bindings: soc: fsl: Add fsl,ls1028a-reset for reset syscon node") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/185e1e06692dc5b08abcde2d3dd137c78e979d08.1744301283.git.geert+renesas@glider.be +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml b/Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml +index 31295be910130..234089b5954dd 100644 +--- a/Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml ++++ b/Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml +@@ -7,7 +7,7 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# + title: Freescale Layerscape Reset Registers Module + + maintainers: +- - Frank Li ++ - Frank Li + + description: + Reset Module includes chip reset, service processor control and Reset Control +-- +2.39.5 + diff --git a/queue-6.14/eth-bnxt-fix-missing-ring-index-trim-on-error-path.patch b/queue-6.14/eth-bnxt-fix-missing-ring-index-trim-on-error-path.patch new file mode 100644 index 0000000000..46fe5a9bdc --- /dev/null +++ b/queue-6.14/eth-bnxt-fix-missing-ring-index-trim-on-error-path.patch @@ -0,0 +1,47 @@ +From 66ae143642ba6d6c703a7293b6fdc661b85c10ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 07:32:10 -0700 +Subject: eth: bnxt: fix missing ring index trim on error path + +From: Jakub Kicinski + +[ Upstream commit 12f2d033fae957d84c2c0ce604d2a077e61fa2c0 ] + +Commit under Fixes converted tx_prod to be free running but missed +masking it on the Tx error path. This crashes on error conditions, +for example when DMA mapping fails. + +Fixes: 6d1add95536b ("bnxt_en: Modify TX ring indexing logic.") +Reviewed-by: Michael Chan +Link: https://patch.msgid.link/20250414143210.458625-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 2cd79b59cf002..1b39574e3fa22 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -783,7 +783,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + dev_kfree_skb_any(skb); + tx_kick_pending: + if (BNXT_TX_PTP_IS_SET(lflags)) { +- txr->tx_buf_ring[txr->tx_prod].is_ts_pkt = 0; ++ txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].is_ts_pkt = 0; + atomic64_inc(&bp->ptp_cfg->stats.ts_err); + if (!(bp->fw_cap & BNXT_FW_CAP_TX_TS_CMP)) + /* set SKB to err so PTP worker will clean up */ +@@ -791,7 +791,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + } + if (txr->kick_pending) + bnxt_txr_db_kick(bp, txr, txr->tx_prod); +- txr->tx_buf_ring[txr->tx_prod].skb = NULL; ++ txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].skb = NULL; + dev_core_stats_tx_dropped_inc(dev); + return NETDEV_TX_OK; + } +-- +2.39.5 + diff --git a/queue-6.14/ethtool-cmis_cdb-use-correct-rpl-size-in-ethtool_cmi.patch b/queue-6.14/ethtool-cmis_cdb-use-correct-rpl-size-in-ethtool_cmi.patch new file mode 100644 index 0000000000..010eb03937 --- /dev/null +++ b/queue-6.14/ethtool-cmis_cdb-use-correct-rpl-size-in-ethtool_cmi.patch @@ -0,0 +1,71 @@ +From 4e8116494dce0defe712ad4bc166efff0ae5587a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 10:33:12 -0700 +Subject: ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() + +From: Damodharam Ammepalli + +[ Upstream commit f3fdd4fba16c74697d8bc730b82fb7c1eff7fab3 ] + +rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct +size of rpl is sizeof(*rpl) which should be just 1 byte. Using the +pointer size instead can cause stack corruption: + +Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 +CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 +Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 +Workqueue: events module_flash_fw_work +Call Trace: + + panic+0x339/0x360 + ? ethtool_cmis_wait_for_cond+0xf4/0x100 + ? __pfx_status_success+0x10/0x10 + ? __pfx_status_fail+0x10/0x10 + __stack_chk_fail+0x10/0x10 + ethtool_cmis_wait_for_cond+0xf4/0x100 + ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 + ? __pfx_status_fail+0x10/0x10 + cmis_cdb_module_features_get+0x6d/0xd0 + ethtool_cmis_cdb_init+0x8a/0xd0 + ethtool_cmis_fw_update+0x46/0x1d0 + module_flash_fw_work+0x17/0xa0 + process_one_work+0x179/0x390 + worker_thread+0x239/0x340 + ? __pfx_worker_thread+0x10/0x10 + kthread+0xcc/0x100 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x2d/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1a/0x30 + + +Fixes: a39c84d79625 ("ethtool: cmis_cdb: Add a layer for supporting CDB commands") +Reviewed-by: Andy Gospodarek +Reviewed-by: Simon Horman +Reviewed-by: Ido Schimmel +Signed-off-by: Damodharam Ammepalli +Signed-off-by: Michael Chan +Link: https://patch.msgid.link/20250409173312.733012-1-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ethtool/cmis_cdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ethtool/cmis_cdb.c b/net/ethtool/cmis_cdb.c +index 0e2691ccb0df3..3057576bc81e3 100644 +--- a/net/ethtool/cmis_cdb.c ++++ b/net/ethtool/cmis_cdb.c +@@ -351,7 +351,7 @@ ethtool_cmis_module_poll(struct net_device *dev, + struct netlink_ext_ack extack = {}; + int err; + +- ethtool_cmis_page_init(&page_data, 0, offset, sizeof(rpl)); ++ ethtool_cmis_page_init(&page_data, 0, offset, sizeof(*rpl)); + page_data.data = (u8 *)rpl; + + err = ops->get_module_eeprom_by_page(dev, &page_data, &extack); +-- +2.39.5 + diff --git a/queue-6.14/firmware-cs_dsp-test_bin_error-fix-uninitialized-dat.patch b/queue-6.14/firmware-cs_dsp-test_bin_error-fix-uninitialized-dat.patch new file mode 100644 index 0000000000..391f1af6f1 --- /dev/null +++ b/queue-6.14/firmware-cs_dsp-test_bin_error-fix-uninitialized-dat.patch @@ -0,0 +1,125 @@ +From 725e67620e4551f6c2b2aeccfdc3220827838fda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 14:21:29 +0100 +Subject: firmware: cs_dsp: test_bin_error: Fix uninitialized data used as fw + version + +From: Richard Fitzgerald + +[ Upstream commit 285b2c74cf9982e873ef82a2cb1328d9e9406f65 ] + +Call cs_dsp_mock_xm_header_get_fw_version() to get the firmware version +from the dummy XM header data in cs_dsp_bin_err_test_common_init(). + +Make the same change to cs_dsp_bin_test_common_init() and remove the +cs_dsp_mock_xm_header_get_fw_version_from_regmap() function. + +The code in cs_dsp_test_bin.c was correctly calling +cs_dsp_mock_xm_header_get_fw_version_from_regmap() to fetch the fw version +from a dummy header it wrote to XM registers. However in +cs_dsp_test_bin_error.c the test doesn't stuff a dummy header into XM, it +populates it the normal way using a wmfw file. It should have called +cs_dsp_mock_xm_header_get_fw_version() to get the data from its blob +buffer, but was calling cs_dsp_mock_xm_header_get_fw_version_from_regmap(). +As nothing had been written to the registers this returned the value of +uninitialized data. + +The only other use of cs_dsp_mock_xm_header_get_fw_version_from_regmap() +was cs_dsp_test_bin.c, but it doesn't need to use it. It already has a +blob buffer containing the dummy XM header so it can use +cs_dsp_mock_xm_header_get_fw_version() to read from that. + +Fixes: cd8c058499b6 ("firmware: cs_dsp: Add KUnit testing of bin error cases") +Signed-off-by: Richard Fitzgerald +Link: https://patch.msgid.link/20250410132129.1312541-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../cirrus/test/cs_dsp_mock_mem_maps.c | 30 ------------------- + .../firmware/cirrus/test/cs_dsp_test_bin.c | 2 +- + .../cirrus/test/cs_dsp_test_bin_error.c | 2 +- + .../linux/firmware/cirrus/cs_dsp_test_utils.h | 1 - + 4 files changed, 2 insertions(+), 33 deletions(-) + +diff --git a/drivers/firmware/cirrus/test/cs_dsp_mock_mem_maps.c b/drivers/firmware/cirrus/test/cs_dsp_mock_mem_maps.c +index 161272e47bdab..73412bcef50c5 100644 +--- a/drivers/firmware/cirrus/test/cs_dsp_mock_mem_maps.c ++++ b/drivers/firmware/cirrus/test/cs_dsp_mock_mem_maps.c +@@ -461,36 +461,6 @@ unsigned int cs_dsp_mock_xm_header_get_alg_base_in_words(struct cs_dsp_test *pri + } + EXPORT_SYMBOL_NS_GPL(cs_dsp_mock_xm_header_get_alg_base_in_words, "FW_CS_DSP_KUNIT_TEST_UTILS"); + +-/** +- * cs_dsp_mock_xm_header_get_fw_version_from_regmap() - Firmware version. +- * +- * @priv: Pointer to struct cs_dsp_test. +- * +- * Return: Firmware version word value. +- */ +-unsigned int cs_dsp_mock_xm_header_get_fw_version_from_regmap(struct cs_dsp_test *priv) +-{ +- unsigned int xm = cs_dsp_mock_base_addr_for_mem(priv, WMFW_ADSP2_XM); +- union { +- struct wmfw_id_hdr adsp2; +- struct wmfw_v3_id_hdr halo; +- } hdr; +- +- switch (priv->dsp->type) { +- case WMFW_ADSP2: +- regmap_raw_read(priv->dsp->regmap, xm, &hdr.adsp2, sizeof(hdr.adsp2)); +- return be32_to_cpu(hdr.adsp2.ver); +- case WMFW_HALO: +- regmap_raw_read(priv->dsp->regmap, xm, &hdr.halo, sizeof(hdr.halo)); +- return be32_to_cpu(hdr.halo.ver); +- default: +- KUNIT_FAIL(priv->test, NULL); +- return 0; +- } +-} +-EXPORT_SYMBOL_NS_GPL(cs_dsp_mock_xm_header_get_fw_version_from_regmap, +- "FW_CS_DSP_KUNIT_TEST_UTILS"); +- + /** + * cs_dsp_mock_xm_header_get_fw_version() - Firmware version. + * +diff --git a/drivers/firmware/cirrus/test/cs_dsp_test_bin.c b/drivers/firmware/cirrus/test/cs_dsp_test_bin.c +index 1e161bbc5b4a4..163b7faecff46 100644 +--- a/drivers/firmware/cirrus/test/cs_dsp_test_bin.c ++++ b/drivers/firmware/cirrus/test/cs_dsp_test_bin.c +@@ -2198,7 +2198,7 @@ static int cs_dsp_bin_test_common_init(struct kunit *test, struct cs_dsp *dsp) + + priv->local->bin_builder = + cs_dsp_mock_bin_init(priv, 1, +- cs_dsp_mock_xm_header_get_fw_version_from_regmap(priv)); ++ cs_dsp_mock_xm_header_get_fw_version(xm_hdr)); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->local->bin_builder); + + /* We must provide a dummy wmfw to load */ +diff --git a/drivers/firmware/cirrus/test/cs_dsp_test_bin_error.c b/drivers/firmware/cirrus/test/cs_dsp_test_bin_error.c +index 5dcf62f19fafd..10761d8ff1f2e 100644 +--- a/drivers/firmware/cirrus/test/cs_dsp_test_bin_error.c ++++ b/drivers/firmware/cirrus/test/cs_dsp_test_bin_error.c +@@ -451,7 +451,7 @@ static int cs_dsp_bin_err_test_common_init(struct kunit *test, struct cs_dsp *ds + + local->bin_builder = + cs_dsp_mock_bin_init(priv, 1, +- cs_dsp_mock_xm_header_get_fw_version_from_regmap(priv)); ++ cs_dsp_mock_xm_header_get_fw_version(local->xm_header)); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, local->bin_builder); + + /* Init cs_dsp */ +diff --git a/include/linux/firmware/cirrus/cs_dsp_test_utils.h b/include/linux/firmware/cirrus/cs_dsp_test_utils.h +index 4f87a908ab4f6..ecd821ed8064f 100644 +--- a/include/linux/firmware/cirrus/cs_dsp_test_utils.h ++++ b/include/linux/firmware/cirrus/cs_dsp_test_utils.h +@@ -104,7 +104,6 @@ unsigned int cs_dsp_mock_num_dsp_words_to_num_packed_regs(unsigned int num_dsp_w + unsigned int cs_dsp_mock_xm_header_get_alg_base_in_words(struct cs_dsp_test *priv, + unsigned int alg_id, + int mem_type); +-unsigned int cs_dsp_mock_xm_header_get_fw_version_from_regmap(struct cs_dsp_test *priv); + unsigned int cs_dsp_mock_xm_header_get_fw_version(struct cs_dsp_mock_xm_header *header); + void cs_dsp_mock_xm_header_drop_from_regmap_cache(struct cs_dsp_test *priv); + int cs_dsp_mock_xm_header_write_to_regmap(struct cs_dsp_mock_xm_header *header); +-- +2.39.5 + diff --git a/queue-6.14/igc-add-lock-preventing-multiple-simultaneous-ptm-tr.patch b/queue-6.14/igc-add-lock-preventing-multiple-simultaneous-ptm-tr.patch new file mode 100644 index 0000000000..8481eea7e9 --- /dev/null +++ b/queue-6.14/igc-add-lock-preventing-multiple-simultaneous-ptm-tr.patch @@ -0,0 +1,145 @@ +From 5fc497ec6eb3f928c5f8258417bf42ddbd71b2a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 16:35:34 -0700 +Subject: igc: add lock preventing multiple simultaneous PTM transactions + +From: Christopher S M Hall + +[ Upstream commit 1a931c4f5e6862e61a4b130cb76b422e1415f644 ] + +Add a mutex around the PTM transaction to prevent multiple transactors + +Multiple processes try to initiate a PTM transaction, one or all may +fail. This can be reproduced by running two instances of the +following: + +$ sudo phc2sys -O 0 -i tsn0 -m + +PHC2SYS exits with: + +"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction + fails + +Note: Normally two instance of PHC2SYS will not run, but one process + should not break another. + +Fixes: a90ec8483732 ("igc: Add support for PTP getcrosststamp()") +Signed-off-by: Christopher S M Hall +Reviewed-by: Corinna Vinschen +Signed-off-by: Jacob Keller +Tested-by: Mor Bar-Gabay +Acked-by: Vinicius Costa Gomes +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc.h | 1 + + drivers/net/ethernet/intel/igc/igc_ptp.c | 20 ++++++++++++++++++-- + 2 files changed, 19 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h +index c35cc5cb11856..2f265c0959c7a 100644 +--- a/drivers/net/ethernet/intel/igc/igc.h ++++ b/drivers/net/ethernet/intel/igc/igc.h +@@ -319,6 +319,7 @@ struct igc_adapter { + struct timespec64 prev_ptp_time; /* Pre-reset PTP clock */ + ktime_t ptp_reset_start; /* Reset time in clock mono */ + struct system_time_snapshot snapshot; ++ struct mutex ptm_lock; /* Only allow one PTM transaction at a time */ + + char fw_version[32]; + +diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c +index 343205bffc355..612ed26a29c5d 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ptp.c ++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c +@@ -974,6 +974,7 @@ static void igc_ptm_log_error(struct igc_adapter *adapter, u32 ptm_stat) + } + } + ++/* The PTM lock: adapter->ptm_lock must be held when calling igc_ptm_trigger() */ + static void igc_ptm_trigger(struct igc_hw *hw) + { + u32 ctrl; +@@ -990,6 +991,7 @@ static void igc_ptm_trigger(struct igc_hw *hw) + wrfl(); + } + ++/* The PTM lock: adapter->ptm_lock must be held when calling igc_ptm_reset() */ + static void igc_ptm_reset(struct igc_hw *hw) + { + u32 ctrl; +@@ -1068,9 +1070,16 @@ static int igc_ptp_getcrosststamp(struct ptp_clock_info *ptp, + { + struct igc_adapter *adapter = container_of(ptp, struct igc_adapter, + ptp_caps); ++ int ret; + +- return get_device_system_crosststamp(igc_phc_get_syncdevicetime, +- adapter, &adapter->snapshot, cts); ++ /* This blocks until any in progress PTM transactions complete */ ++ mutex_lock(&adapter->ptm_lock); ++ ++ ret = get_device_system_crosststamp(igc_phc_get_syncdevicetime, ++ adapter, &adapter->snapshot, cts); ++ mutex_unlock(&adapter->ptm_lock); ++ ++ return ret; + } + + static int igc_ptp_getcyclesx64(struct ptp_clock_info *ptp, +@@ -1169,6 +1178,7 @@ void igc_ptp_init(struct igc_adapter *adapter) + spin_lock_init(&adapter->ptp_tx_lock); + spin_lock_init(&adapter->free_timer_lock); + spin_lock_init(&adapter->tmreg_lock); ++ mutex_init(&adapter->ptm_lock); + + adapter->tstamp_config.rx_filter = HWTSTAMP_FILTER_NONE; + adapter->tstamp_config.tx_type = HWTSTAMP_TX_OFF; +@@ -1181,6 +1191,7 @@ void igc_ptp_init(struct igc_adapter *adapter) + if (IS_ERR(adapter->ptp_clock)) { + adapter->ptp_clock = NULL; + netdev_err(netdev, "ptp_clock_register failed\n"); ++ mutex_destroy(&adapter->ptm_lock); + } else if (adapter->ptp_clock) { + netdev_info(netdev, "PHC added\n"); + adapter->ptp_flags |= IGC_PTP_ENABLED; +@@ -1210,10 +1221,12 @@ static void igc_ptm_stop(struct igc_adapter *adapter) + struct igc_hw *hw = &adapter->hw; + u32 ctrl; + ++ mutex_lock(&adapter->ptm_lock); + ctrl = rd32(IGC_PTM_CTRL); + ctrl &= ~IGC_PTM_CTRL_EN; + + wr32(IGC_PTM_CTRL, ctrl); ++ mutex_unlock(&adapter->ptm_lock); + } + + /** +@@ -1255,6 +1268,7 @@ void igc_ptp_stop(struct igc_adapter *adapter) + netdev_info(adapter->netdev, "PHC removed\n"); + adapter->ptp_flags &= ~IGC_PTP_ENABLED; + } ++ mutex_destroy(&adapter->ptm_lock); + } + + /** +@@ -1294,6 +1308,7 @@ void igc_ptp_reset(struct igc_adapter *adapter) + if (!igc_is_crosststamp_supported(adapter)) + break; + ++ mutex_lock(&adapter->ptm_lock); + wr32(IGC_PCIE_DIG_DELAY, IGC_PCIE_DIG_DELAY_DEFAULT); + wr32(IGC_PCIE_PHY_DELAY, IGC_PCIE_PHY_DELAY_DEFAULT); + +@@ -1317,6 +1332,7 @@ void igc_ptp_reset(struct igc_adapter *adapter) + netdev_err(adapter->netdev, "Timeout reading IGC_PTM_STAT register\n"); + + igc_ptm_reset(hw); ++ mutex_unlock(&adapter->ptm_lock); + break; + default: + /* No work to do. */ +-- +2.39.5 + diff --git a/queue-6.14/igc-cleanup-ptp-module-if-probe-fails.patch b/queue-6.14/igc-cleanup-ptp-module-if-probe-fails.patch new file mode 100644 index 0000000000..1d72801033 --- /dev/null +++ b/queue-6.14/igc-cleanup-ptp-module-if-probe-fails.patch @@ -0,0 +1,39 @@ +From afae6702d0a0545721aedaa1466b4e86b4bbb85c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 16:35:33 -0700 +Subject: igc: cleanup PTP module if probe fails + +From: Christopher S M Hall + +[ Upstream commit 1f025759ba394dd53e434d2668cb0597886d9b69 ] + +Make sure that the PTP module is cleaned up if the igc_probe() fails by +calling igc_ptp_stop() on exit. + +Fixes: d89f88419f99 ("igc: Add skeletal frame for Intel(R) 2.5G Ethernet Controller support") +Signed-off-by: Christopher S M Hall +Reviewed-by: Corinna Vinschen +Signed-off-by: Jacob Keller +Tested-by: Mor Bar-Gabay +Acked-by: Vinicius Costa Gomes +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index daf2a24ead037..80831c57f7509 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -7230,6 +7230,7 @@ static int igc_probe(struct pci_dev *pdev, + + err_register: + igc_release_hw_control(adapter); ++ igc_ptp_stop(adapter); + err_eeprom: + if (!igc_check_reset_block(hw)) + igc_reset_phy(hw); +-- +2.39.5 + diff --git a/queue-6.14/igc-fix-ptm-cycle-trigger-logic.patch b/queue-6.14/igc-fix-ptm-cycle-trigger-logic.patch new file mode 100644 index 0000000000..d4fb2cfc97 --- /dev/null +++ b/queue-6.14/igc-fix-ptm-cycle-trigger-logic.patch @@ -0,0 +1,198 @@ +From b0097ec1c4c35cf0c3c3091a9b05a8e9a8a489a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 16:35:29 -0700 +Subject: igc: fix PTM cycle trigger logic + +From: Christopher S M Hall + +[ Upstream commit 8e404ad95d2c10c261e2ef6992c7c12dde03df0e ] + +Writing to clear the PTM status 'valid' bit while the PTM cycle is +triggered results in unreliable PTM operation. To fix this, clear the +PTM 'trigger' and status after each PTM transaction. + +The issue can be reproduced with the following: + +$ sudo phc2sys -R 1000 -O 0 -i tsn0 -m + +Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to +quickly reproduce the issue. + +PHC2SYS exits with: + +"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction + fails + +This patch also fixes a hang in igc_probe() when loading the igc +driver in the kdump kernel on systems supporting PTM. + +The igc driver running in the base kernel enables PTM trigger in +igc_probe(). Therefore the driver is always in PTM trigger mode, +except in brief periods when manually triggering a PTM cycle. + +When a crash occurs, the NIC is reset while PTM trigger is enabled. +Due to a hardware problem, the NIC is subsequently in a bad busmaster +state and doesn't handle register reads/writes. When running +igc_probe() in the kdump kernel, the first register access to a NIC +register hangs driver probing and ultimately breaks kdump. + +With this patch, igc has PTM trigger disabled most of the time, +and the trigger is only enabled for very brief (10 - 100 us) periods +when manually triggering a PTM cycle. Chances that a crash occurs +during a PTM trigger are not 0, but extremely reduced. + +Fixes: a90ec8483732 ("igc: Add support for PTP getcrosststamp()") +Reviewed-by: Michal Swiatkowski +Tested-by: Mor Bar-Gabay +Tested-by: Avigail Dahan +Signed-off-by: Christopher S M Hall +Reviewed-by: Corinna Vinschen +Signed-off-by: Jacob Keller +Tested-by: Corinna Vinschen +Acked-by: Vinicius Costa Gomes +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_defines.h | 1 + + drivers/net/ethernet/intel/igc/igc_ptp.c | 70 ++++++++++++-------- + 2 files changed, 42 insertions(+), 29 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_defines.h b/drivers/net/ethernet/intel/igc/igc_defines.h +index 8e449904aa7db..2ff292f5f63be 100644 +--- a/drivers/net/ethernet/intel/igc/igc_defines.h ++++ b/drivers/net/ethernet/intel/igc/igc_defines.h +@@ -593,6 +593,7 @@ + #define IGC_PTM_STAT_T4M1_OVFL BIT(3) /* T4 minus T1 overflow */ + #define IGC_PTM_STAT_ADJUST_1ST BIT(4) /* 1588 timer adjusted during 1st PTM cycle */ + #define IGC_PTM_STAT_ADJUST_CYC BIT(5) /* 1588 timer adjusted during non-1st PTM cycle */ ++#define IGC_PTM_STAT_ALL GENMASK(5, 0) /* Used to clear all status */ + + /* PCIe PTM Cycle Control */ + #define IGC_PTM_CYCLE_CTRL_CYC_TIME(msec) ((msec) & 0x3ff) /* PTM Cycle Time (msec) */ +diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c +index 946edbad43022..c640e346342be 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ptp.c ++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c +@@ -974,13 +974,40 @@ static void igc_ptm_log_error(struct igc_adapter *adapter, u32 ptm_stat) + } + } + ++static void igc_ptm_trigger(struct igc_hw *hw) ++{ ++ u32 ctrl; ++ ++ /* To "manually" start the PTM cycle we need to set the ++ * trigger (TRIG) bit ++ */ ++ ctrl = rd32(IGC_PTM_CTRL); ++ ctrl |= IGC_PTM_CTRL_TRIG; ++ wr32(IGC_PTM_CTRL, ctrl); ++ /* Perform flush after write to CTRL register otherwise ++ * transaction may not start ++ */ ++ wrfl(); ++} ++ ++static void igc_ptm_reset(struct igc_hw *hw) ++{ ++ u32 ctrl; ++ ++ ctrl = rd32(IGC_PTM_CTRL); ++ ctrl &= ~IGC_PTM_CTRL_TRIG; ++ wr32(IGC_PTM_CTRL, ctrl); ++ /* Write to clear all status */ ++ wr32(IGC_PTM_STAT, IGC_PTM_STAT_ALL); ++} ++ + static int igc_phc_get_syncdevicetime(ktime_t *device, + struct system_counterval_t *system, + void *ctx) + { +- u32 stat, t2_curr_h, t2_curr_l, ctrl; + struct igc_adapter *adapter = ctx; + struct igc_hw *hw = &adapter->hw; ++ u32 stat, t2_curr_h, t2_curr_l; + int err, count = 100; + ktime_t t1, t2_curr; + +@@ -994,25 +1021,13 @@ static int igc_phc_get_syncdevicetime(ktime_t *device, + * are transitory. Repeating the process returns valid + * data eventually. + */ +- +- /* To "manually" start the PTM cycle we need to clear and +- * then set again the TRIG bit. +- */ +- ctrl = rd32(IGC_PTM_CTRL); +- ctrl &= ~IGC_PTM_CTRL_TRIG; +- wr32(IGC_PTM_CTRL, ctrl); +- ctrl |= IGC_PTM_CTRL_TRIG; +- wr32(IGC_PTM_CTRL, ctrl); +- +- /* The cycle only starts "for real" when software notifies +- * that it has read the registers, this is done by setting +- * VALID bit. +- */ +- wr32(IGC_PTM_STAT, IGC_PTM_STAT_VALID); ++ igc_ptm_trigger(hw); + + err = readx_poll_timeout(rd32, IGC_PTM_STAT, stat, + stat, IGC_PTM_STAT_SLEEP, + IGC_PTM_STAT_TIMEOUT); ++ igc_ptm_reset(hw); ++ + if (err < 0) { + netdev_err(adapter->netdev, "Timeout reading IGC_PTM_STAT register\n"); + return err; +@@ -1021,15 +1036,7 @@ static int igc_phc_get_syncdevicetime(ktime_t *device, + if ((stat & IGC_PTM_STAT_VALID) == IGC_PTM_STAT_VALID) + break; + +- if (stat & ~IGC_PTM_STAT_VALID) { +- /* An error occurred, log it. */ +- igc_ptm_log_error(adapter, stat); +- /* The STAT register is write-1-to-clear (W1C), +- * so write the previous error status to clear it. +- */ +- wr32(IGC_PTM_STAT, stat); +- continue; +- } ++ igc_ptm_log_error(adapter, stat); + } while (--count); + + if (!count) { +@@ -1255,7 +1262,7 @@ void igc_ptp_stop(struct igc_adapter *adapter) + void igc_ptp_reset(struct igc_adapter *adapter) + { + struct igc_hw *hw = &adapter->hw; +- u32 cycle_ctrl, ctrl; ++ u32 cycle_ctrl, ctrl, stat; + unsigned long flags; + u32 timadj; + +@@ -1290,14 +1297,19 @@ void igc_ptp_reset(struct igc_adapter *adapter) + ctrl = IGC_PTM_CTRL_EN | + IGC_PTM_CTRL_START_NOW | + IGC_PTM_CTRL_SHRT_CYC(IGC_PTM_SHORT_CYC_DEFAULT) | +- IGC_PTM_CTRL_PTM_TO(IGC_PTM_TIMEOUT_DEFAULT) | +- IGC_PTM_CTRL_TRIG; ++ IGC_PTM_CTRL_PTM_TO(IGC_PTM_TIMEOUT_DEFAULT); + + wr32(IGC_PTM_CTRL, ctrl); + + /* Force the first cycle to run. */ +- wr32(IGC_PTM_STAT, IGC_PTM_STAT_VALID); ++ igc_ptm_trigger(hw); ++ ++ if (readx_poll_timeout_atomic(rd32, IGC_PTM_STAT, stat, ++ stat, IGC_PTM_STAT_SLEEP, ++ IGC_PTM_STAT_TIMEOUT)) ++ netdev_err(adapter->netdev, "Timeout reading IGC_PTM_STAT register\n"); + ++ igc_ptm_reset(hw); + break; + default: + /* No work to do. */ +-- +2.39.5 + diff --git a/queue-6.14/igc-handle-the-igc_ptp_enabled-flag-correctly.patch b/queue-6.14/igc-handle-the-igc_ptp_enabled-flag-correctly.patch new file mode 100644 index 0000000000..abb98ee281 --- /dev/null +++ b/queue-6.14/igc-handle-the-igc_ptp_enabled-flag-correctly.patch @@ -0,0 +1,55 @@ +From f970d82d31c344edfed0601c1378a1edefc2c998 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 16:35:32 -0700 +Subject: igc: handle the IGC_PTP_ENABLED flag correctly + +From: Christopher S M Hall + +[ Upstream commit 26a3910afd111f7c1a96dace6dc02f3225063896 ] + +All functions in igc_ptp.c called from igc_main.c should check the +IGC_PTP_ENABLED flag. Adding check for this flag to stop and reset +functions. + +Fixes: 5f2958052c58 ("igc: Add basic skeleton for PTP") +Signed-off-by: Christopher S M Hall +Reviewed-by: Corinna Vinschen +Signed-off-by: Jacob Keller +Tested-by: Mor Bar-Gabay +Acked-by: Vinicius Costa Gomes +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ptp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c +index 516abe7405dee..343205bffc355 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ptp.c ++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c +@@ -1244,8 +1244,12 @@ void igc_ptp_suspend(struct igc_adapter *adapter) + **/ + void igc_ptp_stop(struct igc_adapter *adapter) + { ++ if (!(adapter->ptp_flags & IGC_PTP_ENABLED)) ++ return; ++ + igc_ptp_suspend(adapter); + ++ adapter->ptp_flags &= ~IGC_PTP_ENABLED; + if (adapter->ptp_clock) { + ptp_clock_unregister(adapter->ptp_clock); + netdev_info(adapter->netdev, "PHC removed\n"); +@@ -1266,6 +1270,9 @@ void igc_ptp_reset(struct igc_adapter *adapter) + unsigned long flags; + u32 timadj; + ++ if (!(adapter->ptp_flags & IGC_PTP_ENABLED)) ++ return; ++ + /* reset the tstamp_config */ + igc_ptp_set_timestamp_mode(adapter, &adapter->tstamp_config); + +-- +2.39.5 + diff --git a/queue-6.14/igc-increase-wait-time-before-retrying-ptm.patch b/queue-6.14/igc-increase-wait-time-before-retrying-ptm.patch new file mode 100644 index 0000000000..c861e7edc2 --- /dev/null +++ b/queue-6.14/igc-increase-wait-time-before-retrying-ptm.patch @@ -0,0 +1,76 @@ +From 2c63ee97677f5094880e4f62cb76923f4314cd63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 16:35:30 -0700 +Subject: igc: increase wait time before retrying PTM + +From: Christopher S M Hall + +[ Upstream commit 714cd033da6fea4cf54a11b3cfd070afde3f31df ] + +The i225/i226 hardware retries if it receives an inappropriate response +from the upstream device. If the device retries too quickly, the root +port does not respond. + +The wait between attempts was reduced from 10us to 1us in commit +6b8aa753a9f9 ("igc: Decrease PTM short interval from 10 us to 1 us"), which +said: + + With the 10us interval, we were seeing PTM transactions take around + 12us. Hardware team suggested this interval could be lowered to 1us + which was confirmed with PCIe sniffer. With the 1us interval, PTM + dialogs took around 2us. + +While a 1us short cycle time was thought to be theoretically sufficient, it +turns out in practice it is not quite long enough. It is unclear if the +problem is in the root port or an issue in i225/i226. + +Increase the wait from 1us to 4us. Increasing to 2us appeared to work in +practice on the setups we have available. A value of 4us was chosen due to +the limited hardware available for testing, with a goal of ensuring we wait +long enough without overly penalizing the response time when unnecessary. + +The issue can be reproduced with the following: + +$ sudo phc2sys -R 1000 -O 0 -i tsn0 -m + +Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to +quickly reproduce the issue. + +PHC2SYS exits with: + +"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction + fails + +Fixes: 6b8aa753a9f9 ("igc: Decrease PTM short interval from 10 us to 1 us") +Reviewed-by: Michal Swiatkowski +Tested-by: Mor Bar-Gabay +Tested-by: Avigail Dahan +Signed-off-by: Christopher S M Hall +Reviewed-by: Corinna Vinschen +Signed-off-by: Jacob Keller +Acked-by: Vinicius Costa Gomes +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_defines.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_defines.h b/drivers/net/ethernet/intel/igc/igc_defines.h +index 2ff292f5f63be..d19325b0e6e0b 100644 +--- a/drivers/net/ethernet/intel/igc/igc_defines.h ++++ b/drivers/net/ethernet/intel/igc/igc_defines.h +@@ -574,7 +574,10 @@ + #define IGC_PTM_CTRL_SHRT_CYC(usec) (((usec) & 0x3f) << 2) + #define IGC_PTM_CTRL_PTM_TO(usec) (((usec) & 0xff) << 8) + +-#define IGC_PTM_SHORT_CYC_DEFAULT 1 /* Default short cycle interval */ ++/* A short cycle time of 1us theoretically should work, but appears to be too ++ * short in practice. ++ */ ++#define IGC_PTM_SHORT_CYC_DEFAULT 4 /* Default short cycle interval */ + #define IGC_PTM_CYC_TIME_DEFAULT 5 /* Default PTM cycle time */ + #define IGC_PTM_TIMEOUT_DEFAULT 255 /* Default timeout for PTM errors */ + +-- +2.39.5 + diff --git a/queue-6.14/igc-move-ktime-snapshot-into-ptm-retry-loop.patch b/queue-6.14/igc-move-ktime-snapshot-into-ptm-retry-loop.patch new file mode 100644 index 0000000000..e988b3f034 --- /dev/null +++ b/queue-6.14/igc-move-ktime-snapshot-into-ptm-retry-loop.patch @@ -0,0 +1,59 @@ +From eb139b4147e8971084402c57db62170e67c33f79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 16:35:31 -0700 +Subject: igc: move ktime snapshot into PTM retry loop + +From: Christopher S M Hall + +[ Upstream commit cd7f7328d691937102732f39f97ead35b15bf803 ] + +Move ktime_get_snapshot() into the loop. If a retry does occur, a more +recent snapshot will result in a more accurate cross-timestamp. + +Fixes: a90ec8483732 ("igc: Add support for PTP getcrosststamp()") +Reviewed-by: Michal Swiatkowski +Tested-by: Mor Bar-Gabay +Tested-by: Avigail Dahan +Signed-off-by: Christopher S M Hall +Reviewed-by: Corinna Vinschen +Signed-off-by: Jacob Keller +Acked-by: Vinicius Costa Gomes +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ptp.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c +index c640e346342be..516abe7405dee 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ptp.c ++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c +@@ -1011,16 +1011,16 @@ static int igc_phc_get_syncdevicetime(ktime_t *device, + int err, count = 100; + ktime_t t1, t2_curr; + +- /* Get a snapshot of system clocks to use as historic value. */ +- ktime_get_snapshot(&adapter->snapshot); +- ++ /* Doing this in a loop because in the event of a ++ * badly timed (ha!) system clock adjustment, we may ++ * get PTM errors from the PCI root, but these errors ++ * are transitory. Repeating the process returns valid ++ * data eventually. ++ */ + do { +- /* Doing this in a loop because in the event of a +- * badly timed (ha!) system clock adjustment, we may +- * get PTM errors from the PCI root, but these errors +- * are transitory. Repeating the process returns valid +- * data eventually. +- */ ++ /* Get a snapshot of system clocks to use as historic value. */ ++ ktime_get_snapshot(&adapter->snapshot); ++ + igc_ptm_trigger(hw); + + err = readx_poll_timeout(rd32, IGC_PTM_STAT, stat, +-- +2.39.5 + diff --git a/queue-6.14/ipv6-add-exception-routes-to-gc-list-in-rt6_insert_e.patch b/queue-6.14/ipv6-add-exception-routes-to-gc-list-in-rt6_insert_e.patch new file mode 100644 index 0000000000..66029ef958 --- /dev/null +++ b/queue-6.14/ipv6-add-exception-routes-to-gc-list-in-rt6_insert_e.patch @@ -0,0 +1,48 @@ +From ecbd000681dec9d49adc8996864d2b5f81804f81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 13:46:17 -0400 +Subject: ipv6: add exception routes to GC list in rt6_insert_exception + +From: Xin Long + +[ Upstream commit cfe82469a00f0c0983bf4652de3a2972637dfc56 ] + +Commit 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list +of routes.") introduced a separated list for managing route expiration via +the GC timer. + +However, it missed adding exception routes (created by ip6_rt_update_pmtu() +and rt6_do_redirect()) to this GC list. As a result, these exceptions were +never considered for expiration and removal, leading to stale entries +persisting in the routing table. + +This patch fixes the issue by calling fib6_add_gc_list() in +rt6_insert_exception(), ensuring that exception routes are properly tracked +and garbage collected when expired. + +Fixes: 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.") +Reported-by: Jianlin Shi +Signed-off-by: Xin Long +Reviewed-by: David Ahern +Link: https://patch.msgid.link/837e7506ffb63f47faa2b05d9b85481aad28e1a4.1744134377.git.lucien.xin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 08cee62e789e1..21eca985a1fd1 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1771,6 +1771,7 @@ static int rt6_insert_exception(struct rt6_info *nrt, + if (!err) { + spin_lock_bh(&f6i->fib6_table->tb6_lock); + fib6_update_sernum(net, f6i); ++ fib6_add_gc_list(f6i); + spin_unlock_bh(&f6i->fib6_table->tb6_lock); + fib6_force_start_gc(net); + } +-- +2.39.5 + diff --git a/queue-6.14/kunit-qemu_configs-sh-respect-kunit-cmdline.patch b/queue-6.14/kunit-qemu_configs-sh-respect-kunit-cmdline.patch new file mode 100644 index 0000000000..8d48709476 --- /dev/null +++ b/queue-6.14/kunit-qemu_configs-sh-respect-kunit-cmdline.patch @@ -0,0 +1,48 @@ +From 89fe886fba5e24170b54e4a75c853dbf2ce4acbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 10:58:03 +0200 +Subject: kunit: qemu_configs: SH: Respect kunit cmdline +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit b26c1a85f3fc3cc749380ff94199377fc2d0c203 ] + +The default SH kunit configuration sets CONFIG_CMDLINE_OVERWRITE which +completely disregards the cmdline passed from the bootloader/QEMU in favor +of the builtin CONFIG_CMDLINE. +However the kunit tool needs to pass arguments to the in-kernel kunit core, +for filters and other runtime parameters. + +Enable CONFIG_CMDLINE_EXTEND instead, so kunit arguments are respected. + +Link: https://lore.kernel.org/r/20250407-kunit-sh-v1-1-f5432a54cf2f@linutronix.de +Fixes: 8110a3cab05e ("kunit: tool: Add support for SH under QEMU") +Signed-off-by: Thomas Weißschuh +Reviewed-by: David Gow +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/kunit/qemu_configs/sh.py | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/kunit/qemu_configs/sh.py b/tools/testing/kunit/qemu_configs/sh.py +index 78a474a5b95f3..f00cb89fdef6a 100644 +--- a/tools/testing/kunit/qemu_configs/sh.py ++++ b/tools/testing/kunit/qemu_configs/sh.py +@@ -7,7 +7,9 @@ CONFIG_CPU_SUBTYPE_SH7751R=y + CONFIG_MEMORY_START=0x0c000000 + CONFIG_SH_RTS7751R2D=y + CONFIG_RTS7751R2D_PLUS=y +-CONFIG_SERIAL_SH_SCI=y''', ++CONFIG_SERIAL_SH_SCI=y ++CONFIG_CMDLINE_EXTEND=y ++''', + qemu_arch='sh4', + kernel_path='arch/sh/boot/zImage', + kernel_command_line='console=ttySC1', +-- +2.39.5 + diff --git a/queue-6.14/loop-aio-inherit-the-ioprio-of-original-request.patch b/queue-6.14/loop-aio-inherit-the-ioprio-of-original-request.patch new file mode 100644 index 0000000000..a93077b8fd --- /dev/null +++ b/queue-6.14/loop-aio-inherit-the-ioprio-of-original-request.patch @@ -0,0 +1,40 @@ +From 83669483d7cfed25b4172a788583572d8489ac88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 11:01:59 +0800 +Subject: loop: aio inherit the ioprio of original request + +From: Yunlong Xing + +[ Upstream commit 1fdb8188c3d505452b40cdb365b1bb32be533a8e ] + +Set cmd->iocb.ki_ioprio to the ioprio of loop device's request. +The purpose is to inherit the original request ioprio in the aio +flow. + +Signed-off-by: Yunlong Xing +Signed-off-by: Zhiguo Niu +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20250414030159.501180-1-yunlong.xing@unisoc.com +Signed-off-by: Jens Axboe +Stable-dep-of: f2fed441c69b ("loop: stop using vfs_iter_{read,write} for buffered I/O") +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index c05fe27a96b64..1a4dbd4116069 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -471,7 +471,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, + cmd->iocb.ki_filp = file; + cmd->iocb.ki_complete = lo_rw_aio_complete; + cmd->iocb.ki_flags = IOCB_DIRECT; +- cmd->iocb.ki_ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, 0); ++ cmd->iocb.ki_ioprio = req_get_ioprio(rq); + + if (rw == ITER_SOURCE) + ret = file->f_op->write_iter(&cmd->iocb, &iter); +-- +2.39.5 + diff --git a/queue-6.14/loop-stop-using-vfs_iter_-read-write-for-buffered-i-.patch b/queue-6.14/loop-stop-using-vfs_iter_-read-write-for-buffered-i-.patch new file mode 100644 index 0000000000..297f3c0263 --- /dev/null +++ b/queue-6.14/loop-stop-using-vfs_iter_-read-write-for-buffered-i-.patch @@ -0,0 +1,220 @@ +From c76edaa0f1ae94dae61d892776d6900147da218e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 15:09:40 +0200 +Subject: loop: stop using vfs_iter_{read,write} for buffered I/O + +From: Christoph Hellwig + +[ Upstream commit f2fed441c69b9237760840a45a004730ff324faf ] + +vfs_iter_{read,write} always perform direct I/O when the file has the +O_DIRECT flag set, which breaks disabling direct I/O using the +LOOP_SET_STATUS / LOOP_SET_STATUS64 ioctls. + +This was recenly reported as a regression, but as far as I can tell +was only uncovered by better checking for block sizes and has been +around since the direct I/O support was added. + +Fix this by using the existing aio code that calls the raw read/write +iter methods instead. Note that despite the comments there is no need +for block drivers to ever call flush_dcache_page themselves, and the +call is a left-over from prehistoric times. + +Fixes: ab1cb278bc70 ("block: loop: introduce ioctl command of LOOP_SET_DIRECT_IO") +Reported-by: Darrick J. Wong +Signed-off-by: Christoph Hellwig +Reviewed-by: Ming Lei +Tested-by: Darrick J. Wong +Link: https://lore.kernel.org/r/20250409130940.3685677-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 112 +++++++------------------------------------ + 1 file changed, 17 insertions(+), 95 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 1a4dbd4116069..08ba8f0c5ba12 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -235,72 +235,6 @@ static void loop_set_size(struct loop_device *lo, loff_t size) + kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE); + } + +-static int lo_write_bvec(struct file *file, struct bio_vec *bvec, loff_t *ppos) +-{ +- struct iov_iter i; +- ssize_t bw; +- +- iov_iter_bvec(&i, ITER_SOURCE, bvec, 1, bvec->bv_len); +- +- bw = vfs_iter_write(file, &i, ppos, 0); +- +- if (likely(bw == bvec->bv_len)) +- return 0; +- +- printk_ratelimited(KERN_ERR +- "loop: Write error at byte offset %llu, length %i.\n", +- (unsigned long long)*ppos, bvec->bv_len); +- if (bw >= 0) +- bw = -EIO; +- return bw; +-} +- +-static int lo_write_simple(struct loop_device *lo, struct request *rq, +- loff_t pos) +-{ +- struct bio_vec bvec; +- struct req_iterator iter; +- int ret = 0; +- +- rq_for_each_segment(bvec, rq, iter) { +- ret = lo_write_bvec(lo->lo_backing_file, &bvec, &pos); +- if (ret < 0) +- break; +- cond_resched(); +- } +- +- return ret; +-} +- +-static int lo_read_simple(struct loop_device *lo, struct request *rq, +- loff_t pos) +-{ +- struct bio_vec bvec; +- struct req_iterator iter; +- struct iov_iter i; +- ssize_t len; +- +- rq_for_each_segment(bvec, rq, iter) { +- iov_iter_bvec(&i, ITER_DEST, &bvec, 1, bvec.bv_len); +- len = vfs_iter_read(lo->lo_backing_file, &i, &pos, 0); +- if (len < 0) +- return len; +- +- flush_dcache_page(bvec.bv_page); +- +- if (len != bvec.bv_len) { +- struct bio *bio; +- +- __rq_for_each_bio(bio, rq) +- zero_fill_bio(bio); +- break; +- } +- cond_resched(); +- } +- +- return 0; +-} +- + static void loop_clear_limits(struct loop_device *lo, int mode) + { + struct queue_limits lim = queue_limits_start_update(lo->lo_queue); +@@ -366,7 +300,7 @@ static void lo_complete_rq(struct request *rq) + struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq); + blk_status_t ret = BLK_STS_OK; + +- if (!cmd->use_aio || cmd->ret < 0 || cmd->ret == blk_rq_bytes(rq) || ++ if (cmd->ret < 0 || cmd->ret == blk_rq_bytes(rq) || + req_op(rq) != REQ_OP_READ) { + if (cmd->ret < 0) + ret = errno_to_blk_status(cmd->ret); +@@ -382,14 +316,13 @@ static void lo_complete_rq(struct request *rq) + cmd->ret = 0; + blk_mq_requeue_request(rq, true); + } else { +- if (cmd->use_aio) { +- struct bio *bio = rq->bio; ++ struct bio *bio = rq->bio; + +- while (bio) { +- zero_fill_bio(bio); +- bio = bio->bi_next; +- } ++ while (bio) { ++ zero_fill_bio(bio); ++ bio = bio->bi_next; + } ++ + ret = BLK_STS_IOERR; + end_io: + blk_mq_end_request(rq, ret); +@@ -469,9 +402,14 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, + + cmd->iocb.ki_pos = pos; + cmd->iocb.ki_filp = file; +- cmd->iocb.ki_complete = lo_rw_aio_complete; +- cmd->iocb.ki_flags = IOCB_DIRECT; + cmd->iocb.ki_ioprio = req_get_ioprio(rq); ++ if (cmd->use_aio) { ++ cmd->iocb.ki_complete = lo_rw_aio_complete; ++ cmd->iocb.ki_flags = IOCB_DIRECT; ++ } else { ++ cmd->iocb.ki_complete = NULL; ++ cmd->iocb.ki_flags = 0; ++ } + + if (rw == ITER_SOURCE) + ret = file->f_op->write_iter(&cmd->iocb, &iter); +@@ -482,7 +420,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, + + if (ret != -EIOCBQUEUED) + lo_rw_aio_complete(&cmd->iocb, ret); +- return 0; ++ return -EIOCBQUEUED; + } + + static int do_req_filebacked(struct loop_device *lo, struct request *rq) +@@ -490,15 +428,6 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq) + struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq); + loff_t pos = ((loff_t) blk_rq_pos(rq) << 9) + lo->lo_offset; + +- /* +- * lo_write_simple and lo_read_simple should have been covered +- * by io submit style function like lo_rw_aio(), one blocker +- * is that lo_read_simple() need to call flush_dcache_page after +- * the page is written from kernel, and it isn't easy to handle +- * this in io submit style function which submits all segments +- * of the req at one time. And direct read IO doesn't need to +- * run flush_dcache_page(). +- */ + switch (req_op(rq)) { + case REQ_OP_FLUSH: + return lo_req_flush(lo, rq); +@@ -514,15 +443,9 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq) + case REQ_OP_DISCARD: + return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE); + case REQ_OP_WRITE: +- if (cmd->use_aio) +- return lo_rw_aio(lo, cmd, pos, ITER_SOURCE); +- else +- return lo_write_simple(lo, rq, pos); ++ return lo_rw_aio(lo, cmd, pos, ITER_SOURCE); + case REQ_OP_READ: +- if (cmd->use_aio) +- return lo_rw_aio(lo, cmd, pos, ITER_DEST); +- else +- return lo_read_simple(lo, rq, pos); ++ return lo_rw_aio(lo, cmd, pos, ITER_DEST); + default: + WARN_ON_ONCE(1); + return -EIO; +@@ -1907,7 +1830,6 @@ static void loop_handle_cmd(struct loop_cmd *cmd) + struct loop_device *lo = rq->q->queuedata; + int ret = 0; + struct mem_cgroup *old_memcg = NULL; +- const bool use_aio = cmd->use_aio; + + if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY)) { + ret = -EIO; +@@ -1937,7 +1859,7 @@ static void loop_handle_cmd(struct loop_cmd *cmd) + } + failed: + /* complete non-aio request */ +- if (!use_aio || ret) { ++ if (ret != -EIOCBQUEUED) { + if (ret == -EOPNOTSUPP) + cmd->ret = ret; + else +-- +2.39.5 + diff --git a/queue-6.14/md-md-bitmap-fix-stats-collection-for-external-bitma.patch b/queue-6.14/md-md-bitmap-fix-stats-collection-for-external-bitma.patch new file mode 100644 index 0000000000..1d6507bbd7 --- /dev/null +++ b/queue-6.14/md-md-bitmap-fix-stats-collection-for-external-bitma.patch @@ -0,0 +1,49 @@ +From c955a3ffd8fd8066004e76ffbd0c5dde5a7b2688 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Apr 2025 09:53:22 +0800 +Subject: md/md-bitmap: fix stats collection for external bitmaps + +From: Zheng Qixing + +[ Upstream commit 6ec1f0239485028445d213d91cfee5242f3211ba ] + +The bitmap_get_stats() function incorrectly returns -ENOENT for external +bitmaps. + +Remove the external bitmap check as the statistics should be available +regardless of bitmap storage location. + +Return -EINVAL only for invalid bitmap with no storage (neither in +superblock nor in external file). + +Note: "bitmap_info.external" here refers to a bitmap stored in a separate +file (bitmap_file), not to external metadata. + +Fixes: 8d28d0ddb986 ("md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime") +Signed-off-by: Zheng Qixing +Link: https://lore.kernel.org/linux-raid/20250403015322.2873369-1-zhengqixing@huaweicloud.com +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 9ae6cc8e30cbd..27409d05f0532 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2355,9 +2355,8 @@ static int bitmap_get_stats(void *data, struct md_bitmap_stats *stats) + + if (!bitmap) + return -ENOENT; +- if (bitmap->mddev->bitmap_info.external) +- return -ENOENT; +- if (!bitmap->storage.sb_page) /* no superblock */ ++ if (!bitmap->mddev->bitmap_info.external && ++ !bitmap->storage.sb_page) + return -EINVAL; + sb = kmap_local_page(bitmap->storage.sb_page); + stats->sync_size = le64_to_cpu(sb->sync_size); +-- +2.39.5 + diff --git a/queue-6.14/md-raid10-fix-missing-discard-io-accounting.patch b/queue-6.14/md-raid10-fix-missing-discard-io-accounting.patch new file mode 100644 index 0000000000..a366d5d43e --- /dev/null +++ b/queue-6.14/md-raid10-fix-missing-discard-io-accounting.patch @@ -0,0 +1,47 @@ +From d53537cd3847a4ae7fa7367de590bc8c2e562201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Mar 2025 09:57:46 +0800 +Subject: md/raid10: fix missing discard IO accounting + +From: Yu Kuai + +[ Upstream commit d05af90d6218e9c8f1c2026990c3f53c1b41bfb0 ] + +md_account_bio() is not called from raid10_handle_discard(), now that we +handle bitmap inside md_account_bio(), also fix missing +bitmap_startwrite for discard. + +Test whole disk discard for 20G raid10: + +Before: +Device d/s dMB/s drqm/s %drqm d_await dareq-sz +md0 48.00 16.00 0.00 0.00 5.42 341.33 + +After: +Device d/s dMB/s drqm/s %drqm d_await dareq-sz +md0 68.00 20462.00 0.00 0.00 2.65 308133.65 + +Link: https://lore.kernel.org/linux-raid/20250325015746.3195035-1-yukuai1@huaweicloud.com +Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting") +Signed-off-by: Yu Kuai +Acked-by: Coly Li +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index af010b64be63b..76a75925b7138 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1734,6 +1734,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio) + * The discard bio returns only first r10bio finishes + */ + if (first_copy) { ++ md_account_bio(mddev, &bio); + r10_bio->master_bio = bio; + set_bit(R10BIO_Discard, &r10_bio->state); + first_copy = false; +-- +2.39.5 + diff --git a/queue-6.14/mlxbf-bootctl-use-sysfs_emit_at-in-secure_boot_fuse_.patch b/queue-6.14/mlxbf-bootctl-use-sysfs_emit_at-in-secure_boot_fuse_.patch new file mode 100644 index 0000000000..eecfda49e4 --- /dev/null +++ b/queue-6.14/mlxbf-bootctl-use-sysfs_emit_at-in-secure_boot_fuse_.patch @@ -0,0 +1,51 @@ +From c2c486d2408343bfe7f4df077d27fe508a0eb6ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 13:25:58 +0000 +Subject: mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Thompson + +[ Upstream commit b129005ddfc0e6daf04a6d3b928a9e474f9b3918 ] + +A warning is seen when running the latest kernel on a BlueField SOC: +[251.512704] ------------[ cut here ]------------ +[251.512711] invalid sysfs_emit: buf:0000000003aa32ae +[251.512720] WARNING: CPU: 1 PID: 705264 at fs/sysfs/file.c:767 sysfs_emit+0xac/0xc8 + +The warning is triggered because the mlxbf-bootctl driver invokes +"sysfs_emit()" with a buffer pointer that is not aligned to the +start of the page. The driver should instead use "sysfs_emit_at()" +to support non-zero offsets into the destination buffer. + +Fixes: 9886f575de5a ("platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf()") +Signed-off-by: David Thompson +Link: https://lore.kernel.org/r/20250407132558.2418719-1-davthompson@nvidia.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-bootctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-bootctl.c b/drivers/platform/mellanox/mlxbf-bootctl.c +index 9cae07348d5eb..49d4394e9f8a3 100644 +--- a/drivers/platform/mellanox/mlxbf-bootctl.c ++++ b/drivers/platform/mellanox/mlxbf-bootctl.c +@@ -332,9 +332,9 @@ static ssize_t secure_boot_fuse_state_show(struct device *dev, + else + status = valid ? "Invalid" : "Free"; + } +- buf_len += sysfs_emit(buf + buf_len, "%d:%s ", key, status); ++ buf_len += sysfs_emit_at(buf, buf_len, "%d:%s ", key, status); + } +- buf_len += sysfs_emit(buf + buf_len, "\n"); ++ buf_len += sysfs_emit_at(buf, buf_len, "\n"); + + return buf_len; + } +-- +2.39.5 + diff --git a/queue-6.14/net-b53-enable-bpdu-reception-for-management-port.patch b/queue-6.14/net-b53-enable-bpdu-reception-for-management-port.patch new file mode 100644 index 0000000000..bb0430413c --- /dev/null +++ b/queue-6.14/net-b53-enable-bpdu-reception-for-management-port.patch @@ -0,0 +1,53 @@ +From 4929b4affe772ed343c8c1220b20dee06ac1cc93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 22:04:34 +0200 +Subject: net: b53: enable BPDU reception for management port + +From: Jonas Gorski + +[ Upstream commit 36355ddfe8955f226a88a543ed354b9f6b84cd70 ] + +For STP to work, receiving BPDUs is essential, but the appropriate bit +was never set. Without GC_RX_BPDU_EN, the switch chip will filter all +BPDUs, even if an appropriate PVID VLAN was setup. + +Fixes: ff39c2d68679 ("net: dsa: b53: Add bridge support") +Signed-off-by: Jonas Gorski +Link: https://patch.msgid.link/20250414200434.194422-1-jonas.gorski@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/b53/b53_common.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index 79dc77835681c..3b49e87e8ef72 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -737,6 +737,15 @@ static void b53_enable_mib(struct b53_device *dev) + b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc); + } + ++static void b53_enable_stp(struct b53_device *dev) ++{ ++ u8 gc; ++ ++ b53_read8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, &gc); ++ gc |= GC_RX_BPDU_EN; ++ b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc); ++} ++ + static u16 b53_default_pvid(struct b53_device *dev) + { + if (is5325(dev) || is5365(dev)) +@@ -876,6 +885,7 @@ static int b53_switch_reset(struct b53_device *dev) + } + + b53_enable_mib(dev); ++ b53_enable_stp(dev); + + return b53_flush_arl(dev, FAST_AGE_STATIC); + } +-- +2.39.5 + diff --git a/queue-6.14/net-bridge-switchdev-do-not-notify-new-brentries-as-.patch b/queue-6.14/net-bridge-switchdev-do-not-notify-new-brentries-as-.patch new file mode 100644 index 0000000000..10fde7b846 --- /dev/null +++ b/queue-6.14/net-bridge-switchdev-do-not-notify-new-brentries-as-.patch @@ -0,0 +1,92 @@ +From 012b2fb3c05dbc3e4e661778c988214787ea23f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 22:00:20 +0200 +Subject: net: bridge: switchdev: do not notify new brentries as changed + +From: Jonas Gorski + +[ Upstream commit eb25de13bd9cf025413a04f25e715d0e99847e30 ] + +When adding a bridge vlan that is pvid or untagged after the vlan has +already been added to any other switchdev backed port, the vlan change +will be propagated as changed, since the flags change. + +This causes the vlan to not be added to the hardware for DSA switches, +since the DSA handler ignores any vlans for the CPU or DSA ports that +are changed. + +E.g. the following order of operations would work: + +$ ip link add swbridge type bridge vlan_filtering 1 vlan_default_pvid 0 +$ ip link set lan1 master swbridge +$ bridge vlan add dev swbridge vid 1 pvid untagged self +$ bridge vlan add dev lan1 vid 1 pvid untagged + +but this order would break: + +$ ip link add swbridge type bridge vlan_filtering 1 vlan_default_pvid 0 +$ ip link set lan1 master swbridge +$ bridge vlan add dev lan1 vid 1 pvid untagged +$ bridge vlan add dev swbridge vid 1 pvid untagged self + +Additionally, the vlan on the bridge itself would become undeletable: + +$ bridge vlan +port vlan-id +lan1 1 PVID Egress Untagged +swbridge 1 PVID Egress Untagged +$ bridge vlan del dev swbridge vid 1 self +$ bridge vlan +port vlan-id +lan1 1 PVID Egress Untagged +swbridge 1 Egress Untagged + +since the vlan was never added to DSA's vlan list, so deleting it will +cause an error, causing the bridge code to not remove it. + +Fix this by checking if flags changed only for vlans that are already +brentry and pass changed as false for those that become brentries, as +these are a new vlan (member) from the switchdev point of view. + +Since *changed is set to true for becomes_brentry = true regardless of +would_change's value, this will not change any rtnetlink notification +delivery, just the value passed on to switchdev in vlan->changed. + +Fixes: 8d23a54f5bee ("net: bridge: switchdev: differentiate new VLANs from changed ones") +Reviewed-by: Vladimir Oltean +Signed-off-by: Jonas Gorski +Reviewed-by: Ido Schimmel +Acked-by: Nikolay Aleksandrov +Link: https://patch.msgid.link/20250414200020.192715-1-jonas.gorski@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index d9a69ec9affe5..939a3aa78d5c4 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -715,8 +715,8 @@ static int br_vlan_add_existing(struct net_bridge *br, + u16 flags, bool *changed, + struct netlink_ext_ack *extack) + { +- bool would_change = __vlan_flags_would_change(vlan, flags); + bool becomes_brentry = false; ++ bool would_change = false; + int err; + + if (!br_vlan_is_brentry(vlan)) { +@@ -725,6 +725,8 @@ static int br_vlan_add_existing(struct net_bridge *br, + return -EINVAL; + + becomes_brentry = true; ++ } else { ++ would_change = __vlan_flags_would_change(vlan, flags); + } + + /* Master VLANs that aren't brentries weren't notified before, +-- +2.39.5 + diff --git a/queue-6.14/net-dsa-avoid-refcount-warnings-when-ds-ops-tag_8021.patch b/queue-6.14/net-dsa-avoid-refcount-warnings-when-ds-ops-tag_8021.patch new file mode 100644 index 0000000000..8a162b261f --- /dev/null +++ b/queue-6.14/net-dsa-avoid-refcount-warnings-when-ds-ops-tag_8021.patch @@ -0,0 +1,40 @@ +From 875d4daaea02cc246b0e2f12a272ae331daa7cd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 00:30:20 +0300 +Subject: net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() + fails + +From: Vladimir Oltean + +[ Upstream commit 514eff7b0aa1c5eb645ddbb8676ef3e2d88a8b99 ] + +This is very similar to the problem and solution from commit +232deb3f9567 ("net: dsa: avoid refcount warnings when +->port_{fdb,mdb}_del returns error"), except for the +dsa_port_do_tag_8021q_vlan_del() operation. + +Fixes: c64b9c05045a ("net: dsa: tag_8021q: add proper cross-chip notifier support") +Signed-off-by: Vladimir Oltean +Link: https://patch.msgid.link/20250414213020.2959021-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/dsa/tag_8021q.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/dsa/tag_8021q.c b/net/dsa/tag_8021q.c +index 3ee53e28ec2e9..53e03fd8071b4 100644 +--- a/net/dsa/tag_8021q.c ++++ b/net/dsa/tag_8021q.c +@@ -197,7 +197,7 @@ static int dsa_port_do_tag_8021q_vlan_del(struct dsa_port *dp, u16 vid) + + err = ds->ops->tag_8021q_vlan_del(ds, port, vid); + if (err) { +- refcount_inc(&v->refcount); ++ refcount_set(&v->refcount, 1); + return err; + } + +-- +2.39.5 + diff --git a/queue-6.14/net-dsa-clean-up-fdb-mdb-vlan-entries-on-unbind.patch b/queue-6.14/net-dsa-clean-up-fdb-mdb-vlan-entries-on-unbind.patch new file mode 100644 index 0000000000..a5b1954afd --- /dev/null +++ b/queue-6.14/net-dsa-clean-up-fdb-mdb-vlan-entries-on-unbind.patch @@ -0,0 +1,117 @@ +From 1ae63ab5b9f005905336a7d3fca92440e61d5da7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 00:29:30 +0300 +Subject: net: dsa: clean up FDB, MDB, VLAN entries on unbind + +From: Vladimir Oltean + +[ Upstream commit 7afb5fb42d4950f33af2732b8147c552659f79b7 ] + +As explained in many places such as commit b117e1e8a86d ("net: dsa: +delete dsa_legacy_fdb_add and dsa_legacy_fdb_del"), DSA is written given +the assumption that higher layers have balanced additions/deletions. +As such, it only makes sense to be extremely vocal when those +assumptions are violated and the driver unbinds with entries still +present. + +But Ido Schimmel points out a very simple situation where that is wrong: +https://lore.kernel.org/netdev/ZDazSM5UsPPjQuKr@shredder/ +(also briefly discussed by me in the aforementioned commit). + +Basically, while the bridge bypass operations are not something that DSA +explicitly documents, and for the majority of DSA drivers this API +simply causes them to go to promiscuous mode, that isn't the case for +all drivers. Some have the necessary requirements for bridge bypass +operations to do something useful - see dsa_switch_supports_uc_filtering(). + +Although in tools/testing/selftests/net/forwarding/local_termination.sh, +we made an effort to popularize better mechanisms to manage address +filters on DSA interfaces from user space - namely macvlan for unicast, +and setsockopt(IP_ADD_MEMBERSHIP) - through mtools - for multicast, the +fact is that 'bridge fdb add ... self static local' also exists as +kernel UAPI, and might be useful to someone, even if only for a quick +hack. + +It seems counter-productive to block that path by implementing shim +.ndo_fdb_add and .ndo_fdb_del operations which just return -EOPNOTSUPP +in order to prevent the ndo_dflt_fdb_add() and ndo_dflt_fdb_del() from +running, although we could do that. + +Accepting that cleanup is necessary seems to be the only option. +Especially since we appear to be coming back at this from a different +angle as well. Russell King is noticing that the WARN_ON() triggers even +for VLANs: +https://lore.kernel.org/netdev/Z_li8Bj8bD4-BYKQ@shell.armlinux.org.uk/ + +What happens in the bug report above is that dsa_port_do_vlan_del() fails, +then the VLAN entry lingers on, and then we warn on unbind and leak it. + +This is not a straight revert of the blamed commit, but we now add an +informational print to the kernel log (to still have a way to see +that bugs exist), and some extra comments gathered from past years' +experience, to justify the logic. + +Fixes: 0832cd9f1f02 ("net: dsa: warn if port lists aren't empty in dsa_port_teardown") +Signed-off-by: Vladimir Oltean +Link: https://patch.msgid.link/20250414212930.2956310-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/dsa/dsa.c | 38 +++++++++++++++++++++++++++++++++++--- + 1 file changed, 35 insertions(+), 3 deletions(-) + +diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c +index e827775baf2ee..e7e32956070aa 100644 +--- a/net/dsa/dsa.c ++++ b/net/dsa/dsa.c +@@ -1478,12 +1478,44 @@ static int dsa_switch_parse(struct dsa_switch *ds, struct dsa_chip_data *cd) + + static void dsa_switch_release_ports(struct dsa_switch *ds) + { ++ struct dsa_mac_addr *a, *tmp; + struct dsa_port *dp, *next; ++ struct dsa_vlan *v, *n; + + dsa_switch_for_each_port_safe(dp, next, ds) { +- WARN_ON(!list_empty(&dp->fdbs)); +- WARN_ON(!list_empty(&dp->mdbs)); +- WARN_ON(!list_empty(&dp->vlans)); ++ /* These are either entries that upper layers lost track of ++ * (probably due to bugs), or installed through interfaces ++ * where one does not necessarily have to remove them, like ++ * ndo_dflt_fdb_add(). ++ */ ++ list_for_each_entry_safe(a, tmp, &dp->fdbs, list) { ++ dev_info(ds->dev, ++ "Cleaning up unicast address %pM vid %u from port %d\n", ++ a->addr, a->vid, dp->index); ++ list_del(&a->list); ++ kfree(a); ++ } ++ ++ list_for_each_entry_safe(a, tmp, &dp->mdbs, list) { ++ dev_info(ds->dev, ++ "Cleaning up multicast address %pM vid %u from port %d\n", ++ a->addr, a->vid, dp->index); ++ list_del(&a->list); ++ kfree(a); ++ } ++ ++ /* These are entries that upper layers have lost track of, ++ * probably due to bugs, but also due to dsa_port_do_vlan_del() ++ * having failed and the VLAN entry still lingering on. ++ */ ++ list_for_each_entry_safe(v, n, &dp->vlans, list) { ++ dev_info(ds->dev, ++ "Cleaning up vid %u from port %d\n", ++ v->vid, dp->index); ++ list_del(&v->list); ++ kfree(v); ++ } ++ + list_del(&dp->list); + kfree(dp); + } +-- +2.39.5 + diff --git a/queue-6.14/net-dsa-free-routing-table-on-probe-failure.patch b/queue-6.14/net-dsa-free-routing-table-on-probe-failure.patch new file mode 100644 index 0000000000..448a8c8e58 --- /dev/null +++ b/queue-6.14/net-dsa-free-routing-table-on-probe-failure.patch @@ -0,0 +1,157 @@ +From 68e7e79f71cd8651a93adf34732d34e2ffc181a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 00:30:01 +0300 +Subject: net: dsa: free routing table on probe failure + +From: Vladimir Oltean + +[ Upstream commit 8bf108d7161ffc6880ad13a0cc109de3cf631727 ] + +If complete = true in dsa_tree_setup(), it means that we are the last +switch of the tree which is successfully probing, and we should be +setting up all switches from our probe path. + +After "complete" becomes true, dsa_tree_setup_cpu_ports() or any +subsequent function may fail. If that happens, the entire tree setup is +in limbo: the first N-1 switches have successfully finished probing +(doing nothing but having allocated persistent memory in the tree's +dst->ports, and maybe dst->rtable), and switch N failed to probe, ending +the tree setup process before anything is tangible from the user's PoV. + +If switch N fails to probe, its memory (ports) will be freed and removed +from dst->ports. However, the dst->rtable elements pointing to its ports, +as created by dsa_link_touch(), will remain there, and will lead to +use-after-free if dereferenced. + +If dsa_tree_setup_switches() returns -EPROBE_DEFER, which is entirely +possible because that is where ds->ops->setup() is, we get a kasan +report like this: + +================================================================== +BUG: KASAN: slab-use-after-free in mv88e6xxx_setup_upstream_port+0x240/0x568 +Read of size 8 at addr ffff000004f56020 by task kworker/u8:3/42 + +Call trace: + __asan_report_load8_noabort+0x20/0x30 + mv88e6xxx_setup_upstream_port+0x240/0x568 + mv88e6xxx_setup+0xebc/0x1eb0 + dsa_register_switch+0x1af4/0x2ae0 + mv88e6xxx_register_switch+0x1b8/0x2a8 + mv88e6xxx_probe+0xc4c/0xf60 + mdio_probe+0x78/0xb8 + really_probe+0x2b8/0x5a8 + __driver_probe_device+0x164/0x298 + driver_probe_device+0x78/0x258 + __device_attach_driver+0x274/0x350 + +Allocated by task 42: + __kasan_kmalloc+0x84/0xa0 + __kmalloc_cache_noprof+0x298/0x490 + dsa_switch_touch_ports+0x174/0x3d8 + dsa_register_switch+0x800/0x2ae0 + mv88e6xxx_register_switch+0x1b8/0x2a8 + mv88e6xxx_probe+0xc4c/0xf60 + mdio_probe+0x78/0xb8 + really_probe+0x2b8/0x5a8 + __driver_probe_device+0x164/0x298 + driver_probe_device+0x78/0x258 + __device_attach_driver+0x274/0x350 + +Freed by task 42: + __kasan_slab_free+0x48/0x68 + kfree+0x138/0x418 + dsa_register_switch+0x2694/0x2ae0 + mv88e6xxx_register_switch+0x1b8/0x2a8 + mv88e6xxx_probe+0xc4c/0xf60 + mdio_probe+0x78/0xb8 + really_probe+0x2b8/0x5a8 + __driver_probe_device+0x164/0x298 + driver_probe_device+0x78/0x258 + __device_attach_driver+0x274/0x350 + +The simplest way to fix the bug is to delete the routing table in its +entirety. dsa_tree_setup_routing_table() has no problem in regenerating +it even if we deleted links between ports other than those of switch N, +because dsa_link_touch() first checks whether the port pair already +exists in dst->rtable, allocating if not. + +The deletion of the routing table in its entirety already exists in +dsa_tree_teardown(), so refactor that into a function that can also be +called from the tree setup error path. + +In my analysis of the commit to blame, it is the one which added +dsa_link elements to dst->rtable. Prior to that, each switch had its own +ds->rtable which is freed when the switch fails to probe. But the tree +is potentially persistent memory. + +Fixes: c5f51765a1f6 ("net: dsa: list DSA links in the fabric") +Signed-off-by: Vladimir Oltean +Link: https://patch.msgid.link/20250414213001.2957964-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/dsa/dsa.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c +index e7e32956070aa..436a7e1b412ad 100644 +--- a/net/dsa/dsa.c ++++ b/net/dsa/dsa.c +@@ -862,6 +862,16 @@ static void dsa_tree_teardown_lags(struct dsa_switch_tree *dst) + kfree(dst->lags); + } + ++static void dsa_tree_teardown_routing_table(struct dsa_switch_tree *dst) ++{ ++ struct dsa_link *dl, *next; ++ ++ list_for_each_entry_safe(dl, next, &dst->rtable, list) { ++ list_del(&dl->list); ++ kfree(dl); ++ } ++} ++ + static int dsa_tree_setup(struct dsa_switch_tree *dst) + { + bool complete; +@@ -879,7 +889,7 @@ static int dsa_tree_setup(struct dsa_switch_tree *dst) + + err = dsa_tree_setup_cpu_ports(dst); + if (err) +- return err; ++ goto teardown_rtable; + + err = dsa_tree_setup_switches(dst); + if (err) +@@ -911,14 +921,14 @@ static int dsa_tree_setup(struct dsa_switch_tree *dst) + dsa_tree_teardown_switches(dst); + teardown_cpu_ports: + dsa_tree_teardown_cpu_ports(dst); ++teardown_rtable: ++ dsa_tree_teardown_routing_table(dst); + + return err; + } + + static void dsa_tree_teardown(struct dsa_switch_tree *dst) + { +- struct dsa_link *dl, *next; +- + if (!dst->setup) + return; + +@@ -932,10 +942,7 @@ static void dsa_tree_teardown(struct dsa_switch_tree *dst) + + dsa_tree_teardown_cpu_ports(dst); + +- list_for_each_entry_safe(dl, next, &dst->rtable, list) { +- list_del(&dl->list); +- kfree(dl); +- } ++ dsa_tree_teardown_routing_table(dst); + + pr_info("DSA: tree %d torn down\n", dst->index); + +-- +2.39.5 + diff --git a/queue-6.14/net-dsa-mv88e6xxx-avoid-unregistering-devlink-region.patch b/queue-6.14/net-dsa-mv88e6xxx-avoid-unregistering-devlink-region.patch new file mode 100644 index 0000000000..42ff5d383d --- /dev/null +++ b/queue-6.14/net-dsa-mv88e6xxx-avoid-unregistering-devlink-region.patch @@ -0,0 +1,56 @@ +From dcb4e5ba519d366271bace56d0a82b21d7f1f37f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 00:28:50 +0300 +Subject: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were + never registered + +From: Vladimir Oltean + +[ Upstream commit c84f6ce918a9e6f4996597cbc62536bbf2247c96 ] + +Russell King reports that a system with mv88e6xxx dereferences a NULL +pointer when unbinding this driver: +https://lore.kernel.org/netdev/Z_lRkMlTJ1KQ0kVX@shell.armlinux.org.uk/ + +The crash seems to be in devlink_region_destroy(), which is not NULL +tolerant but is given a NULL devlink global region pointer. + +At least on some chips, some devlink regions are conditionally registered +since the blamed commit, see mv88e6xxx_setup_devlink_regions_global(): + + if (cond && !cond(chip)) + continue; + +These are MV88E6XXX_REGION_STU and MV88E6XXX_REGION_PVT. If the chip +does not have an STU or PVT, it should crash like this. + +To fix the issue, avoid unregistering those regions which are NULL, i.e. +were skipped at mv88e6xxx_setup_devlink_regions_global() time. + +Fixes: 836021a2d0e0 ("net: dsa: mv88e6xxx: Export cross-chip PVT as devlink region") +Tested-by: Russell King (Oracle) +Signed-off-by: Vladimir Oltean +Link: https://patch.msgid.link/20250414212850.2953957-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/devlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/devlink.c b/drivers/net/dsa/mv88e6xxx/devlink.c +index 795c8df7b6a74..195460a0a0d41 100644 +--- a/drivers/net/dsa/mv88e6xxx/devlink.c ++++ b/drivers/net/dsa/mv88e6xxx/devlink.c +@@ -736,7 +736,8 @@ void mv88e6xxx_teardown_devlink_regions_global(struct dsa_switch *ds) + int i; + + for (i = 0; i < ARRAY_SIZE(mv88e6xxx_regions); i++) +- dsa_devlink_region_destroy(chip->regions[i]); ++ if (chip->regions[i]) ++ dsa_devlink_region_destroy(chip->regions[i]); + } + + void mv88e6xxx_teardown_devlink_regions_port(struct dsa_switch *ds, int port) +-- +2.39.5 + diff --git a/queue-6.14/net-dsa-mv88e6xxx-fix-enoent-when-deleting-vlans-and.patch b/queue-6.14/net-dsa-mv88e6xxx-fix-enoent-when-deleting-vlans-and.patch new file mode 100644 index 0000000000..a57729227d --- /dev/null +++ b/queue-6.14/net-dsa-mv88e6xxx-fix-enoent-when-deleting-vlans-and.patch @@ -0,0 +1,94 @@ +From 5a439c13e1c89a4125cdb071d833cce11f3e32e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 00:29:13 +0300 +Subject: net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is + unsupported + +From: Vladimir Oltean + +[ Upstream commit ea08dfc35f83cfc73493c52f63ae4f2e29edfe8d ] + +Russell King reports that on the ZII dev rev B, deleting a bridge VLAN +from a user port fails with -ENOENT: +https://lore.kernel.org/netdev/Z_lQXNP0s5-IiJzd@shell.armlinux.org.uk/ + +This comes from mv88e6xxx_port_vlan_leave() -> mv88e6xxx_mst_put(), +which tries to find an MST entry in &chip->msts associated with the SID, +but fails and returns -ENOENT as such. + +But we know that this chip does not support MST at all, so that is not +surprising. The question is why does the guard in mv88e6xxx_mst_put() +not exit early: + + if (!sid) + return 0; + +And the answer seems to be simple: the sid comes from vlan.sid which +supposedly was previously populated by mv88e6xxx_vtu_get(). +But some chip->info->ops->vtu_getnext() implementations do not populate +vlan.sid, for example see mv88e6185_g1_vtu_getnext(). In that case, +later in mv88e6xxx_port_vlan_leave() we are using a garbage sid which is +just residual stack memory. + +Testing for sid == 0 covers all cases of a non-bridge VLAN or a bridge +VLAN mapped to the default MSTI. For some chips, SID 0 is valid and +installed by mv88e6xxx_stu_setup(). A chip which does not support the +STU would implicitly only support mapping all VLANs to the default MSTI, +so although SID 0 is not valid, it would be sufficient, if we were to +zero-initialize the vlan structure, to fix the bug, due to the +coincidence that a test for vlan.sid == 0 already exists and leads to +the same (correct) behavior. + +Another option which would be sufficient would be to add a test for +mv88e6xxx_has_stu() inside mv88e6xxx_mst_put(), symmetric to the one +which already exists in mv88e6xxx_mst_get(). But that placement means +the caller will have to dereference vlan.sid, which means it will access +uninitialized memory, which is not nice even if it ignores it later. + +So we end up making both modifications, in order to not rely just on the +sid == 0 coincidence, but also to avoid having uninitialized structure +fields which might get temporarily accessed. + +Fixes: acaf4d2e36b3 ("net: dsa: mv88e6xxx: MST Offloading") +Signed-off-by: Vladimir Oltean +Link: https://patch.msgid.link/20250414212913.2955253-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 29a89ab4b7894..08db846cda8de 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -1852,6 +1852,8 @@ static int mv88e6xxx_vtu_get(struct mv88e6xxx_chip *chip, u16 vid, + if (!chip->info->ops->vtu_getnext) + return -EOPNOTSUPP; + ++ memset(entry, 0, sizeof(*entry)); ++ + entry->vid = vid ? vid - 1 : mv88e6xxx_max_vid(chip); + entry->valid = false; + +@@ -1960,7 +1962,16 @@ static int mv88e6xxx_mst_put(struct mv88e6xxx_chip *chip, u8 sid) + struct mv88e6xxx_mst *mst, *tmp; + int err; + +- if (!sid) ++ /* If the SID is zero, it is for a VLAN mapped to the default MSTI, ++ * and mv88e6xxx_stu_setup() made sure it is always present, and thus, ++ * should not be removed here. ++ * ++ * If the chip lacks STU support, numerically the "sid" variable will ++ * happen to also be zero, but we don't want to rely on that fact, so ++ * we explicitly test that first. In that case, there is also nothing ++ * to do here. ++ */ ++ if (!mv88e6xxx_has_stu(chip) || !sid) + return 0; + + list_for_each_entry_safe(mst, tmp, &chip->msts, node) { +-- +2.39.5 + diff --git a/queue-6.14/net-ethernet-mtk_eth_soc-correct-the-max-weight-of-t.patch b/queue-6.14/net-ethernet-mtk_eth_soc-correct-the-max-weight-of-t.patch new file mode 100644 index 0000000000..a47f2ceb5f --- /dev/null +++ b/queue-6.14/net-ethernet-mtk_eth_soc-correct-the-max-weight-of-t.patch @@ -0,0 +1,48 @@ +From d6b13d30a4b2e2935fb30ed4919b4540375d218c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Apr 2025 01:51:07 +0100 +Subject: net: ethernet: mtk_eth_soc: correct the max weight of the queue limit + for 100Mbps + +From: Bo-Cun Chen + +[ Upstream commit 6b02eb372c6776c9abb8bc81cf63f96039c24664 ] + +Without this patch, the maximum weight of the queue limit will be +incorrect when linked at 100Mbps due to an apparent typo. + +Fixes: f63959c7eec31 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues") +Signed-off-by: Bo-Cun Chen +Signed-off-by: Daniel Golle +Link: https://patch.msgid.link/74111ba0bdb13743313999ed467ce564e8189006.1744764277.git.daniel@makrotopia.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 7988de05e4ecd..6a34ad6483a14 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -734,7 +734,7 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx, + case SPEED_100: + val |= MTK_QTX_SCH_MAX_RATE_EN | + FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 103) | +- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 3); ++ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 3) | + FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1); + break; + case SPEED_1000: +@@ -757,7 +757,7 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx, + case SPEED_100: + val |= MTK_QTX_SCH_MAX_RATE_EN | + FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) | +- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5); ++ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5) | + FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1); + break; + case SPEED_1000: +-- +2.39.5 + diff --git a/queue-6.14/net-ethernet-mtk_eth_soc-reapply-mdc-divider-on-rese.patch b/queue-6.14/net-ethernet-mtk_eth_soc-reapply-mdc-divider-on-rese.patch new file mode 100644 index 0000000000..e6cb4a1a68 --- /dev/null +++ b/queue-6.14/net-ethernet-mtk_eth_soc-reapply-mdc-divider-on-rese.patch @@ -0,0 +1,105 @@ +From 59539ce6615b49f7a2afd2ad0f2d4d8356d8d8a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Apr 2025 01:50:46 +0100 +Subject: net: ethernet: mtk_eth_soc: reapply mdc divider on reset + +From: Bo-Cun Chen + +[ Upstream commit 6bc2b6c6f16d8e60de518d26da1bc6bc436cf71d ] + +In the current method, the MDC divider was reset to the default setting +of 2.5MHz after the NETSYS SER. Therefore, we need to reapply the MDC +divider configuration function in mtk_hw_init() after reset. + +Fixes: c0a440031d431 ("net: ethernet: mtk_eth_soc: set MDIO bus clock frequency") +Signed-off-by: Bo-Cun Chen +Signed-off-by: Daniel Golle +Link: https://patch.msgid.link/8ab7381447e6cdcb317d5b5a6ddd90a1734efcb0.1744764277.git.daniel@makrotopia.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 39 +++++++++++++-------- + drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 + + 2 files changed, 25 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 53485142938c4..7988de05e4ecd 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -823,9 +823,25 @@ static const struct phylink_mac_ops mtk_phylink_ops = { + .mac_link_up = mtk_mac_link_up, + }; + ++static void mtk_mdio_config(struct mtk_eth *eth) ++{ ++ u32 val; ++ ++ /* Configure MDC Divider */ ++ val = FIELD_PREP(PPSC_MDC_CFG, eth->mdc_divider); ++ ++ /* Configure MDC Turbo Mode */ ++ if (mtk_is_netsys_v3_or_greater(eth)) ++ mtk_m32(eth, 0, MISC_MDC_TURBO, MTK_MAC_MISC_V3); ++ else ++ val |= PPSC_MDC_TURBO; ++ ++ mtk_m32(eth, PPSC_MDC_CFG, val, MTK_PPSC); ++} ++ + static int mtk_mdio_init(struct mtk_eth *eth) + { +- unsigned int max_clk = 2500000, divider; ++ unsigned int max_clk = 2500000; + struct device_node *mii_np; + int ret; + u32 val; +@@ -865,20 +881,9 @@ static int mtk_mdio_init(struct mtk_eth *eth) + } + max_clk = val; + } +- divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63); +- +- /* Configure MDC Turbo Mode */ +- if (mtk_is_netsys_v3_or_greater(eth)) +- mtk_m32(eth, 0, MISC_MDC_TURBO, MTK_MAC_MISC_V3); +- +- /* Configure MDC Divider */ +- val = FIELD_PREP(PPSC_MDC_CFG, divider); +- if (!mtk_is_netsys_v3_or_greater(eth)) +- val |= PPSC_MDC_TURBO; +- mtk_m32(eth, PPSC_MDC_CFG, val, MTK_PPSC); +- +- dev_dbg(eth->dev, "MDC is running on %d Hz\n", MDC_MAX_FREQ / divider); +- ++ eth->mdc_divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63); ++ mtk_mdio_config(eth); ++ dev_dbg(eth->dev, "MDC is running on %d Hz\n", MDC_MAX_FREQ / eth->mdc_divider); + ret = of_mdiobus_register(eth->mii_bus, mii_np); + + err_put_node: +@@ -3928,6 +3933,10 @@ static int mtk_hw_init(struct mtk_eth *eth, bool reset) + else + mtk_hw_reset(eth); + ++ /* No MT7628/88 support yet */ ++ if (reset && !MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628)) ++ mtk_mdio_config(eth); ++ + if (mtk_is_netsys_v3_or_greater(eth)) { + /* Set FE to PDMAv2 if necessary */ + val = mtk_r32(eth, MTK_FE_GLO_MISC); +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h +index 0d5225f1d3eef..8d7b6818d8601 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h +@@ -1260,6 +1260,7 @@ struct mtk_eth { + struct clk *clks[MTK_CLK_MAX]; + + struct mii_bus *mii_bus; ++ unsigned int mdc_divider; + struct work_struct pending_work; + unsigned long state; + +-- +2.39.5 + diff --git a/queue-6.14/net-ethernet-mtk_eth_soc-revise-qdma-packet-schedule.patch b/queue-6.14/net-ethernet-mtk_eth_soc-revise-qdma-packet-schedule.patch new file mode 100644 index 0000000000..261224bf8f --- /dev/null +++ b/queue-6.14/net-ethernet-mtk_eth_soc-revise-qdma-packet-schedule.patch @@ -0,0 +1,50 @@ +From 43b1bfa111787d85d9d2a7e7cddcd0f497d1c19a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Apr 2025 01:51:25 +0100 +Subject: net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings + +From: Bo-Cun Chen + +[ Upstream commit 1b66124135f5f8640bd540fadda4b20cdd23114b ] + +The QDMA packet scheduler suffers from a performance issue. +Fix this by picking up changes from MediaTek's SDK which change to use +Token Bucket instead of Leaky Bucket and fix the SPEED_1000 configuration. + +Fixes: 160d3a9b1929 ("net: ethernet: mtk_eth_soc: introduce MTK_NETSYS_V2 support") +Signed-off-by: Bo-Cun Chen +Signed-off-by: Daniel Golle +Link: https://patch.msgid.link/18040f60f9e2f5855036b75b28c4332a2d2ebdd8.1744764277.git.daniel@makrotopia.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 6a34ad6483a14..0cd1ecacfd29f 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -762,8 +762,8 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx, + break; + case SPEED_1000: + val |= MTK_QTX_SCH_MAX_RATE_EN | +- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 10) | +- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5) | ++ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) | ++ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 6) | + FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 10); + break; + default: +@@ -3274,7 +3274,7 @@ static int mtk_start_dma(struct mtk_eth *eth) + if (mtk_is_netsys_v2_or_greater(eth)) + val |= MTK_MUTLI_CNT | MTK_RESV_BUF | + MTK_WCOMP_EN | MTK_DMAD_WR_WDONE | +- MTK_CHK_DDONE_EN | MTK_LEAKY_BUCKET_EN; ++ MTK_CHK_DDONE_EN; + else + val |= MTK_RX_BT_32DWORDS; + mtk_w32(eth, val, reg_map->qdma.glo_cfg); +-- +2.39.5 + diff --git a/queue-6.14/net-ethernet-ti-am65-cpsw-fix-port_np-reference-coun.patch b/queue-6.14/net-ethernet-ti-am65-cpsw-fix-port_np-reference-coun.patch new file mode 100644 index 0000000000..9e5276e04f --- /dev/null +++ b/queue-6.14/net-ethernet-ti-am65-cpsw-fix-port_np-reference-coun.patch @@ -0,0 +1,73 @@ +From d90e91813a785c381d44a7073aad14c8914f21ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 10:39:42 +0200 +Subject: net: ethernet: ti: am65-cpsw: fix port_np reference counting + +From: Michael Walle + +[ Upstream commit 903d2b9f9efc5b3339d74015fcfc0d9fff276c4c ] + +A reference to the device tree node is stored in a private struct, thus +the reference count has to be incremented. Also, decrement the count on +device removal and in the error path. + +Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") +Signed-off-by: Michael Walle +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250414083942.4015060-1-mwalle@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index bef734c6e5c2b..afe8127fd32be 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2756,7 +2756,7 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common) + of_property_read_bool(port_np, "ti,mac-only"); + + /* get phy/link info */ +- port->slave.port_np = port_np; ++ port->slave.port_np = of_node_get(port_np); + ret = of_get_phy_mode(port_np, &port->slave.phy_if); + if (ret) { + dev_err(dev, "%pOF read phy-mode err %d\n", +@@ -2810,6 +2810,17 @@ static void am65_cpsw_nuss_phylink_cleanup(struct am65_cpsw_common *common) + } + } + ++static void am65_cpsw_remove_dt(struct am65_cpsw_common *common) ++{ ++ struct am65_cpsw_port *port; ++ int i; ++ ++ for (i = 0; i < common->port_num; i++) { ++ port = &common->ports[i]; ++ of_node_put(port->slave.port_np); ++ } ++} ++ + static int + am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx) + { +@@ -3708,6 +3719,7 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev) + am65_cpsw_nuss_cleanup_ndev(common); + am65_cpsw_nuss_phylink_cleanup(common); + am65_cpts_release(common->cpts); ++ am65_cpsw_remove_dt(common); + err_of_clear: + if (common->mdio_dev) + of_platform_device_destroy(common->mdio_dev, NULL); +@@ -3747,6 +3759,7 @@ static void am65_cpsw_nuss_remove(struct platform_device *pdev) + am65_cpsw_nuss_phylink_cleanup(common); + am65_cpts_release(common->cpts); + am65_cpsw_disable_serdes_phy(common); ++ am65_cpsw_remove_dt(common); + + if (common->mdio_dev) + of_platform_device_destroy(common->mdio_dev, NULL); +-- +2.39.5 + diff --git a/queue-6.14/net-hibmcge-fix-incorrect-multicast-filtering-issue.patch b/queue-6.14/net-hibmcge-fix-incorrect-multicast-filtering-issue.patch new file mode 100644 index 0000000000..0c9160d5ba --- /dev/null +++ b/queue-6.14/net-hibmcge-fix-incorrect-multicast-filtering-issue.patch @@ -0,0 +1,57 @@ +From 46c011ae0792035685c0b675f7706a6ba86e4b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 10:13:22 +0800 +Subject: net: hibmcge: fix incorrect multicast filtering issue + +From: Jijie Shao + +[ Upstream commit 9afaaa54e3eb9b64fc07c06741897800e98ac253 ] + +The driver does not support multicast filtering, +the mask must be set to 0xFFFFFFFF. Otherwise, +incorrect filtering occurs. + +This patch fixes this problem. + +Fixes: 37b367d60d0f ("net: hibmcge: Add unicast frame filter supported in this module") +Signed-off-by: Jijie Shao +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250410021327.590362-3-shaojijie@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c | 4 ++++ + drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h | 2 ++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c +index 169e6a0bac496..56089849753dc 100644 +--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c ++++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c +@@ -224,6 +224,10 @@ void hbg_hw_set_mac_filter_enable(struct hbg_priv *priv, u32 enable) + { + hbg_reg_write_field(priv, HBG_REG_REC_FILT_CTRL_ADDR, + HBG_REG_REC_FILT_CTRL_UC_MATCH_EN_B, enable); ++ ++ /* only uc filter is supported, so set all bits of mc mask reg to 1 */ ++ hbg_reg_write64(priv, HBG_REG_STATION_ADDR_LOW_MSK_0, U64_MAX); ++ hbg_reg_write64(priv, HBG_REG_STATION_ADDR_LOW_MSK_1, U64_MAX); + } + + void hbg_hw_set_pause_enable(struct hbg_priv *priv, u32 tx_en, u32 rx_en) +diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h b/drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h +index e7bc5435d51ba..c254f4036329f 100644 +--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h ++++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h +@@ -82,6 +82,8 @@ + #define HBG_REG_STATION_ADDR_HIGH_4_ADDR (HBG_REG_SGMII_BASE + 0x0224) + #define HBG_REG_STATION_ADDR_LOW_5_ADDR (HBG_REG_SGMII_BASE + 0x0228) + #define HBG_REG_STATION_ADDR_HIGH_5_ADDR (HBG_REG_SGMII_BASE + 0x022C) ++#define HBG_REG_STATION_ADDR_LOW_MSK_0 (HBG_REG_SGMII_BASE + 0x0230) ++#define HBG_REG_STATION_ADDR_LOW_MSK_1 (HBG_REG_SGMII_BASE + 0x0238) + + /* PCU */ + #define HBG_REG_TX_FIFO_THRSLD_ADDR (HBG_REG_SGMII_BASE + 0x0420) +-- +2.39.5 + diff --git a/queue-6.14/net-hibmcge-fix-incorrect-pause-frame-statistics-iss.patch b/queue-6.14/net-hibmcge-fix-incorrect-pause-frame-statistics-iss.patch new file mode 100644 index 0000000000..d51190d1e4 --- /dev/null +++ b/queue-6.14/net-hibmcge-fix-incorrect-pause-frame-statistics-iss.patch @@ -0,0 +1,83 @@ +From 812d7b3a22d70b94ac78966000c3188778405d5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 10:13:21 +0800 +Subject: net: hibmcge: fix incorrect pause frame statistics issue + +From: Jijie Shao + +[ Upstream commit 5b04080cd6028f0737bbbd0c5b462d226cff9052 ] + +The driver supports pause frames, +but does not pass pause frames based on rx pause enable configuration, +resulting in incorrect pause frame statistics. + +like this: +mz eno3 '01 80 c2 00 00 01 00 18 2d 04 00 9c 88 08 00 01 ff ff' \ + -p 64 -c 100 + +ethtool -S enp132s0f2 | grep -v ": 0" +NIC statistics: + rx_octets_total_filt_cnt: 6800 + rx_filt_pkt_cnt: 100 + +The rx pause frames are filtered by the MAC hardware. + +This patch configures pass pause frames based on the +rx puase enable status to ensure that +rx pause frames are not filtered. + +mz eno3 '01 80 c2 00 00 01 00 18 2d 04 00 9c 88 08 00 01 ff ff' \ + -p 64 -c 100 + +ethtool --include-statistics -a enp132s0f2 +Pause parameters for enp132s0f2: +Autonegotiate: on +RX: on +TX: on +RX negotiated: on +TX negotiated: on +Statistics: + tx_pause_frames: 0 + rx_pause_frames: 100 + +Fixes: 3a03763f3876 ("net: hibmcge: Add pauseparam supported in this module") +Signed-off-by: Jijie Shao +Reviewed-by: Michal Swiatkowski +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250410021327.590362-2-shaojijie@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c | 3 +++ + drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c +index e7798f2136450..169e6a0bac496 100644 +--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c ++++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c +@@ -232,6 +232,9 @@ void hbg_hw_set_pause_enable(struct hbg_priv *priv, u32 tx_en, u32 rx_en) + HBG_REG_PAUSE_ENABLE_TX_B, tx_en); + hbg_reg_write_field(priv, HBG_REG_PAUSE_ENABLE_ADDR, + HBG_REG_PAUSE_ENABLE_RX_B, rx_en); ++ ++ hbg_reg_write_field(priv, HBG_REG_REC_FILT_CTRL_ADDR, ++ HBG_REG_REC_FILT_CTRL_PAUSE_FRM_PASS_B, rx_en); + } + + void hbg_hw_get_pause_enable(struct hbg_priv *priv, u32 *tx_en, u32 *rx_en) +diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h b/drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h +index f12efc12f3c54..e7bc5435d51ba 100644 +--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h ++++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h +@@ -60,6 +60,7 @@ + #define HBG_REG_TRANSMIT_CTRL_AN_EN_B BIT(5) + #define HBG_REG_REC_FILT_CTRL_ADDR (HBG_REG_SGMII_BASE + 0x0064) + #define HBG_REG_REC_FILT_CTRL_UC_MATCH_EN_B BIT(0) ++#define HBG_REG_REC_FILT_CTRL_PAUSE_FRM_PASS_B BIT(4) + #define HBG_REG_LINE_LOOP_BACK_ADDR (HBG_REG_SGMII_BASE + 0x01A8) + #define HBG_REG_CF_CRC_STRIP_ADDR (HBG_REG_SGMII_BASE + 0x01B0) + #define HBG_REG_CF_CRC_STRIP_B BIT(0) +-- +2.39.5 + diff --git a/queue-6.14/net-hibmcge-fix-not-restore-rx-pause-mac-addr-after-.patch b/queue-6.14/net-hibmcge-fix-not-restore-rx-pause-mac-addr-after-.patch new file mode 100644 index 0000000000..a1dd99b752 --- /dev/null +++ b/queue-6.14/net-hibmcge-fix-not-restore-rx-pause-mac-addr-after-.patch @@ -0,0 +1,63 @@ +From d3a7a5f4751ad8cedf3cf10d95707126c2f88c96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 10:13:26 +0800 +Subject: net: hibmcge: fix not restore rx pause mac addr after reset issue + +From: Jijie Shao + +[ Upstream commit ae6c1dce3244e31011ee65f89fc2484f3cf6cf85 ] + +The MAC hardware supports receiving two types of +pause frames from link partner. +One is a pause frame with a destination address +of 01:80:C2:00:00:01. +The other is a pause frame whose destination address +is the address of the hibmcge driver. + +01:80:C2:00:00:01 is supported by default. + +In .ndo_set_mac_address(), the hibmcge driver calls +.hbg_hw_set_rx_pause_mac_addr() to set its mac address as the +destination address of the rx puase frame. +Therefore, pause frames with two types of MAC addresses can be received. + +Currently, the rx pause addr does not restored after reset. +As a result, pause frames whose destination address is +the hibmcge driver address cannot be correctly received. + +This patch restores the configuration by calling +.hbg_hw_set_rx_pause_mac_addr() after reset is complete. + +Fixes: 3f5a61f6d504 ("net: hibmcge: Add reset supported in this module") +Signed-off-by: Jijie Shao +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250410021327.590362-7-shaojijie@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c +index 4d1f4a33391a8..5e288db06d6f6 100644 +--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c ++++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c +@@ -26,12 +26,15 @@ static void hbg_restore_mac_table(struct hbg_priv *priv) + + static void hbg_restore_user_def_settings(struct hbg_priv *priv) + { ++ /* The index of host mac is always 0. */ ++ u64 rx_pause_addr = ether_addr_to_u64(priv->filter.mac_table[0].addr); + struct ethtool_pauseparam *pause_param = &priv->user_def.pause_param; + + hbg_restore_mac_table(priv); + hbg_hw_set_mtu(priv, priv->netdev->mtu); + hbg_hw_set_pause_enable(priv, pause_param->tx_pause, + pause_param->rx_pause); ++ hbg_hw_set_rx_pause_mac_addr(priv, rx_pause_addr); + } + + int hbg_rebuild(struct hbg_priv *priv) +-- +2.39.5 + diff --git a/queue-6.14/net-hibmcge-fix-wrong-mtu-log-issue.patch b/queue-6.14/net-hibmcge-fix-wrong-mtu-log-issue.patch new file mode 100644 index 0000000000..a6e707da25 --- /dev/null +++ b/queue-6.14/net-hibmcge-fix-wrong-mtu-log-issue.patch @@ -0,0 +1,51 @@ +From 11265c8551c6d48f7fa8e319ae45490ef5f22272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 10:13:24 +0800 +Subject: net: hibmcge: fix wrong mtu log issue + +From: Jijie Shao + +[ Upstream commit 4e4ac53335de54bcb9d26842df0998cfd8fcaf90 ] + +A dbg log is generated when the driver modifies the MTU, +which is expected to trace the change of the MTU. + +However, the log is recorded after WRITE_ONCE(). +At this time, netdev->mtu has been changed to the new value. +As a result, netdev->mtu is the same as new_mtu. + +This patch modifies the log location and records logs before WRITE_ONCE(). + +Fixes: ff4edac6e9bd ("net: hibmcge: Implement some .ndo functions") +Signed-off-by: Jijie Shao +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250410021327.590362-5-shaojijie@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c +index bb0f25ac97600..4d20679b2543a 100644 +--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c ++++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c +@@ -198,12 +198,12 @@ static int hbg_net_change_mtu(struct net_device *netdev, int new_mtu) + if (netif_running(netdev)) + return -EBUSY; + +- hbg_hw_set_mtu(priv, new_mtu); +- WRITE_ONCE(netdev->mtu, new_mtu); +- + dev_dbg(&priv->pdev->dev, + "change mtu from %u to %u\n", netdev->mtu, new_mtu); + ++ hbg_hw_set_mtu(priv, new_mtu); ++ WRITE_ONCE(netdev->mtu, new_mtu); ++ + return 0; + } + +-- +2.39.5 + diff --git a/queue-6.14/net-mctp-set-sock_rcu_free.patch b/queue-6.14/net-mctp-set-sock_rcu_free.patch new file mode 100644 index 0000000000..282466abbb --- /dev/null +++ b/queue-6.14/net-mctp-set-sock_rcu_free.patch @@ -0,0 +1,38 @@ +From 39d009b0fbf7537d53a99adeabf0acf8ebf98dde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 11:53:19 +0800 +Subject: net: mctp: Set SOCK_RCU_FREE + +From: Matt Johnston + +[ Upstream commit 52024cd6ec71a6ca934d0cc12452bd8d49850679 ] + +Bind lookup runs under RCU, so ensure that a socket doesn't go away in +the middle of a lookup. + +Fixes: 833ef3b91de6 ("mctp: Populate socket implementation") +Signed-off-by: Matt Johnston +Link: https://patch.msgid.link/20250410-mctp-rcu-sock-v1-1-872de9fdc877@codeconstruct.com.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mctp/af_mctp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c +index f6de136008f6f..57850d4dac5db 100644 +--- a/net/mctp/af_mctp.c ++++ b/net/mctp/af_mctp.c +@@ -630,6 +630,9 @@ static int mctp_sk_hash(struct sock *sk) + { + struct net *net = sock_net(sk); + ++ /* Bind lookup runs under RCU, remain live during that. */ ++ sock_set_flag(sk, SOCK_RCU_FREE); ++ + mutex_lock(&net->mctp.bind_lock); + sk_add_node_rcu(sk, &net->mctp.binds); + mutex_unlock(&net->mctp.bind_lock); +-- +2.39.5 + diff --git a/queue-6.14/net-ngbe-fix-memory-leak-in-ngbe_probe-error-path.patch b/queue-6.14/net-ngbe-fix-memory-leak-in-ngbe_probe-error-path.patch new file mode 100644 index 0000000000..824f373b74 --- /dev/null +++ b/queue-6.14/net-ngbe-fix-memory-leak-in-ngbe_probe-error-path.patch @@ -0,0 +1,53 @@ +From 3df8d2ea21e21375809fe52822a18f37d440eb2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Apr 2025 21:19:24 +0530 +Subject: net: ngbe: fix memory leak in ngbe_probe() error path + +From: Abdun Nihaal + +[ Upstream commit 88fa80021b77732bc98f73fb69d69c7cc37b9f0d ] + +When ngbe_sw_init() is called, memory is allocated for wx->rss_key +in wx_init_rss_key(). However, in ngbe_probe() function, the subsequent +error paths after ngbe_sw_init() don't free the rss_key. Fix that by +freeing it in error path along with wx->mac_table. + +Also change the label to which execution jumps when ngbe_sw_init() +fails, because otherwise, it could lead to a double free for rss_key, +when the mac_table allocation fails in wx_sw_init(). + +Fixes: 02338c484ab6 ("net: ngbe: Initialize sw info and register netdev") +Signed-off-by: Abdun Nihaal +Reviewed-by: Kory Maincent +Reviewed-by: Jiawen Wu +Link: https://patch.msgid.link/20250412154927.25908-1-abdun.nihaal@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c +index 53aeae2f884b0..1be2a5cc4a83c 100644 +--- a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c ++++ b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c +@@ -607,7 +607,7 @@ static int ngbe_probe(struct pci_dev *pdev, + /* setup the private structure */ + err = ngbe_sw_init(wx); + if (err) +- goto err_free_mac_table; ++ goto err_pci_release_regions; + + /* check if flash load is done after hw power up */ + err = wx_check_flash_load(wx, NGBE_SPI_ILDR_STATUS_PERST); +@@ -701,6 +701,7 @@ static int ngbe_probe(struct pci_dev *pdev, + err_clear_interrupt_scheme: + wx_clear_interrupt_scheme(wx); + err_free_mac_table: ++ kfree(wx->rss_key); + kfree(wx->mac_table); + err_pci_release_regions: + pci_release_selected_regions(pdev, +-- +2.39.5 + diff --git a/queue-6.14/net-openvswitch-fix-nested-key-length-validation-in-.patch b/queue-6.14/net-openvswitch-fix-nested-key-length-validation-in-.patch new file mode 100644 index 0000000000..a01be50c3d --- /dev/null +++ b/queue-6.14/net-openvswitch-fix-nested-key-length-validation-in-.patch @@ -0,0 +1,44 @@ +From e93c14417bfc996ba67c4fc55a02d5d03234338f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Apr 2025 12:40:18 +0200 +Subject: net: openvswitch: fix nested key length validation in the set() + action + +From: Ilya Maximets + +[ Upstream commit 65d91192aa66f05710cfddf6a14b5a25ee554dba ] + +It's not safe to access nla_len(ovs_key) if the data is smaller than +the netlink header. Check that the attribute is OK first. + +Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") +Reported-by: syzbot+b07a9da40df1576b8048@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b07a9da40df1576b8048 +Tested-by: syzbot+b07a9da40df1576b8048@syzkaller.appspotmail.com +Signed-off-by: Ilya Maximets +Reviewed-by: Eelco Chaudron +Acked-by: Aaron Conole +Link: https://patch.msgid.link/20250412104052.2073688-1-i.maximets@ovn.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/openvswitch/flow_netlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index 95e0dd14dc1a3..518be23e48ea9 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -2876,7 +2876,8 @@ static int validate_set(const struct nlattr *a, + size_t key_len; + + /* There can be only one key in a action */ +- if (nla_total_size(nla_len(ovs_key)) != nla_len(a)) ++ if (!nla_ok(ovs_key, nla_len(a)) || ++ nla_total_size(nla_len(ovs_key)) != nla_len(a)) + return -EINVAL; + + key_len = nla_len(ovs_key); +-- +2.39.5 + diff --git a/queue-6.14/net-ti-icss-iep-add-phase-offset-configuration-for-p.patch b/queue-6.14/net-ti-icss-iep-add-phase-offset-configuration-for-p.patch new file mode 100644 index 0000000000..6bb04241d0 --- /dev/null +++ b/queue-6.14/net-ti-icss-iep-add-phase-offset-configuration-for-p.patch @@ -0,0 +1,98 @@ +From 33df32a8b5da2f1e0fad8e63fe29045f4b35a0b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Mar 2025 16:27:53 +0530 +Subject: net: ti: icss-iep: Add phase offset configuration for perout signal + +From: Meghana Malladi + +[ Upstream commit 220cb1be647a7ca4e60241405c66f8f612c9b046 ] + +icss_iep_perout_enable_hw() is a common function for generating +both pps and perout signals. When enabling pps, the application needs +to only pass enable/disable argument, whereas for perout it supports +different flags to configure the signal. + +In case the app passes a valid phase offset value, the signal should +start toggling after that phase offset, else start immediately or +as soon as possible. ICSS_IEP_SYNC_START_REG register take number of +clock cycles to wait before starting the signal after activation time. +Set appropriate value to this register to support phase offset. + +Signed-off-by: Meghana Malladi +Reviewed-by: Jacob Keller +Reviewed-by: Kory Maincent +Link: https://patch.msgid.link/20250304105753.1552159-3-m-malladi@ti.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 7349c9e99793 ("net: ti: icss-iep: Fix possible NULL pointer dereference for perout request") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/icssg/icss_iep.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c +index 2981c19c48b18..b4a34c57b7b48 100644 +--- a/drivers/net/ethernet/ti/icssg/icss_iep.c ++++ b/drivers/net/ethernet/ti/icssg/icss_iep.c +@@ -407,6 +407,7 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + struct ptp_perout_request *req, int on) + { + struct timespec64 ts; ++ u64 ns_start; + u64 ns_width; + int ret; + u64 cmp; +@@ -416,6 +417,14 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + ts.tv_nsec = req->on.nsec; + ns_width = timespec64_to_ns(&ts); + ++ if (req->flags & PTP_PEROUT_PHASE) { ++ ts.tv_sec = req->phase.sec; ++ ts.tv_nsec = req->phase.nsec; ++ ns_start = timespec64_to_ns(&ts); ++ } else { ++ ns_start = 0; ++ } ++ + if (iep->ops && iep->ops->perout_enable) { + ret = iep->ops->perout_enable(iep->clockops_data, req, on, &cmp); + if (ret) +@@ -430,7 +439,8 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, + div_u64(ns_width, iep->def_inc)); + regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0); +- regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, 0); ++ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, ++ div_u64(ns_start, iep->def_inc)); + regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */ + /* Enable CMP 1 */ + regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, +@@ -457,6 +467,8 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + + regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, + div_u64(ns_width, iep->def_inc)); ++ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, ++ div_u64(ns_start, iep->def_inc)); + /* Enable Sync in single shot mode */ + regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, + IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN); +@@ -487,7 +499,8 @@ static int icss_iep_perout_enable(struct icss_iep *iep, + int ret = 0; + + /* Reject requests with unsupported flags */ +- if (req->flags & ~PTP_PEROUT_DUTY_CYCLE) ++ if (req->flags & ~(PTP_PEROUT_DUTY_CYCLE | ++ PTP_PEROUT_PHASE)) + return -EOPNOTSUPP; + + mutex_lock(&iep->ptp_clk_mutex); +@@ -588,6 +601,7 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on) + if (on) { + ns = icss_iep_gettime(iep, NULL); + ts = ns_to_timespec64(ns); ++ rq.perout.flags = 0; + rq.perout.period.sec = 1; + rq.perout.period.nsec = 0; + rq.perout.start.sec = ts.tv_sec + 2; +-- +2.39.5 + diff --git a/queue-6.14/net-ti-icss-iep-add-pwidth-configuration-for-perout-.patch b/queue-6.14/net-ti-icss-iep-add-pwidth-configuration-for-perout-.patch new file mode 100644 index 0000000000..1bc604f7e6 --- /dev/null +++ b/queue-6.14/net-ti-icss-iep-add-pwidth-configuration-for-perout-.patch @@ -0,0 +1,123 @@ +From 336c117023f48e6005abfcb7b81115d9291c1cbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Mar 2025 16:27:52 +0530 +Subject: net: ti: icss-iep: Add pwidth configuration for perout signal + +From: Meghana Malladi + +[ Upstream commit e5b456a14215e3c0e84844c2926861b972e03632 ] + +icss_iep_perout_enable_hw() is a common function for generating +both pps and perout signals. When enabling pps, the application needs +to only pass enable/disable argument, whereas for perout it supports +different flags to configure the signal. + +But icss_iep_perout_enable_hw() function is missing to hook the +configuration params passed by the app, causing perout to behave +same a pps (except being able to configure the period). As duty cycle +is also one feature which can configured for perout, incorporate this +in the function to get the expected signal. + +Signed-off-by: Meghana Malladi +Reviewed-by: Jacob Keller +Reviewed-by: Kory Maincent +Link: https://patch.msgid.link/20250304105753.1552159-2-m-malladi@ti.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 7349c9e99793 ("net: ti: icss-iep: Fix possible NULL pointer dereference for perout request") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/icssg/icss_iep.c | 47 ++++++++++++++++++++++-- + 1 file changed, 44 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c +index d59c1744840af..2981c19c48b18 100644 +--- a/drivers/net/ethernet/ti/icssg/icss_iep.c ++++ b/drivers/net/ethernet/ti/icssg/icss_iep.c +@@ -406,9 +406,16 @@ static void icss_iep_update_to_next_boundary(struct icss_iep *iep, u64 start_ns) + static int icss_iep_perout_enable_hw(struct icss_iep *iep, + struct ptp_perout_request *req, int on) + { ++ struct timespec64 ts; ++ u64 ns_width; + int ret; + u64 cmp; + ++ /* Calculate width of the signal for PPS/PEROUT handling */ ++ ts.tv_sec = req->on.sec; ++ ts.tv_nsec = req->on.nsec; ++ ns_width = timespec64_to_ns(&ts); ++ + if (iep->ops && iep->ops->perout_enable) { + ret = iep->ops->perout_enable(iep->clockops_data, req, on, &cmp); + if (ret) +@@ -419,8 +426,9 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + regmap_write(iep->map, ICSS_IEP_CMP1_REG0, lower_32_bits(cmp)); + if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) + regmap_write(iep->map, ICSS_IEP_CMP1_REG1, upper_32_bits(cmp)); +- /* Configure SYNC, 1ms pulse width */ +- regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, 1000000); ++ /* Configure SYNC, based on req on width */ ++ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, ++ div_u64(ns_width, iep->def_inc)); + regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0); + regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, 0); + regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */ +@@ -447,6 +455,8 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + + req->period.nsec; + icss_iep_update_to_next_boundary(iep, start_ns); + ++ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, ++ div_u64(ns_width, iep->def_inc)); + /* Enable Sync in single shot mode */ + regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, + IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN); +@@ -474,7 +484,36 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + static int icss_iep_perout_enable(struct icss_iep *iep, + struct ptp_perout_request *req, int on) + { +- return -EOPNOTSUPP; ++ int ret = 0; ++ ++ /* Reject requests with unsupported flags */ ++ if (req->flags & ~PTP_PEROUT_DUTY_CYCLE) ++ return -EOPNOTSUPP; ++ ++ mutex_lock(&iep->ptp_clk_mutex); ++ ++ if (iep->pps_enabled) { ++ ret = -EBUSY; ++ goto exit; ++ } ++ ++ if (iep->perout_enabled == !!on) ++ goto exit; ++ ++ /* Set default "on" time (1ms) for the signal if not passed by the app */ ++ if (!(req->flags & PTP_PEROUT_DUTY_CYCLE)) { ++ req->on.sec = 0; ++ req->on.nsec = NSEC_PER_MSEC; ++ } ++ ++ ret = icss_iep_perout_enable_hw(iep, req, on); ++ if (!ret) ++ iep->perout_enabled = !!on; ++ ++exit: ++ mutex_unlock(&iep->ptp_clk_mutex); ++ ++ return ret; + } + + static void icss_iep_cap_cmp_work(struct work_struct *work) +@@ -553,6 +592,8 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on) + rq.perout.period.nsec = 0; + rq.perout.start.sec = ts.tv_sec + 2; + rq.perout.start.nsec = 0; ++ rq.perout.on.sec = 0; ++ rq.perout.on.nsec = NSEC_PER_MSEC; + ret = icss_iep_perout_enable_hw(iep, &rq.perout, on); + } else { + ret = icss_iep_perout_enable_hw(iep, &rq.perout, on); +-- +2.39.5 + diff --git a/queue-6.14/net-ti-icss-iep-fix-possible-null-pointer-dereferenc.patch b/queue-6.14/net-ti-icss-iep-fix-possible-null-pointer-dereferenc.patch new file mode 100644 index 0000000000..6c7952be18 --- /dev/null +++ b/queue-6.14/net-ti-icss-iep-fix-possible-null-pointer-dereferenc.patch @@ -0,0 +1,193 @@ +From 57e71e6d5db21a439e83fab58a158f748adceea1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 14:35:43 +0530 +Subject: net: ti: icss-iep: Fix possible NULL pointer dereference for perout + request + +From: Meghana Malladi + +[ Upstream commit 7349c9e9979333abfce42da5f9025598083b59c9 ] + +The ICSS IEP driver tracks perout and pps enable state with flags. +Currently when disabling pps and perout signals during icss_iep_exit(), +results in NULL pointer dereference for perout. + +To fix the null pointer dereference issue, the icss_iep_perout_enable_hw +function can be modified to directly clear the IEP CMP registers when +disabling PPS or PEROUT, without referencing the ptp_perout_request +structure, as its contents are irrelevant in this case. + +Fixes: 9b115361248d ("net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/7b1c7c36-363a-4085-b26c-4f210bee1df6@stanley.mountain/ +Signed-off-by: Meghana Malladi +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250415090543.717991-4-m-malladi@ti.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/icssg/icss_iep.c | 121 +++++++++++------------ + 1 file changed, 58 insertions(+), 63 deletions(-) + +diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c +index b4a34c57b7b48..2a1c43316f462 100644 +--- a/drivers/net/ethernet/ti/icssg/icss_iep.c ++++ b/drivers/net/ethernet/ti/icssg/icss_iep.c +@@ -412,6 +412,22 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + int ret; + u64 cmp; + ++ if (!on) { ++ /* Disable CMP 1 */ ++ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, ++ IEP_CMP_CFG_CMP_EN(1), 0); ++ ++ /* clear CMP regs */ ++ regmap_write(iep->map, ICSS_IEP_CMP1_REG0, 0); ++ if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) ++ regmap_write(iep->map, ICSS_IEP_CMP1_REG1, 0); ++ ++ /* Disable sync */ ++ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); ++ ++ return 0; ++ } ++ + /* Calculate width of the signal for PPS/PEROUT handling */ + ts.tv_sec = req->on.sec; + ts.tv_nsec = req->on.nsec; +@@ -430,64 +446,39 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + if (ret) + return ret; + +- if (on) { +- /* Configure CMP */ +- regmap_write(iep->map, ICSS_IEP_CMP1_REG0, lower_32_bits(cmp)); +- if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) +- regmap_write(iep->map, ICSS_IEP_CMP1_REG1, upper_32_bits(cmp)); +- /* Configure SYNC, based on req on width */ +- regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, +- div_u64(ns_width, iep->def_inc)); +- regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0); +- regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, +- div_u64(ns_start, iep->def_inc)); +- regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */ +- /* Enable CMP 1 */ +- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, +- IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1)); +- } else { +- /* Disable CMP 1 */ +- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, +- IEP_CMP_CFG_CMP_EN(1), 0); +- +- /* clear regs */ +- regmap_write(iep->map, ICSS_IEP_CMP1_REG0, 0); +- if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) +- regmap_write(iep->map, ICSS_IEP_CMP1_REG1, 0); +- } ++ /* Configure CMP */ ++ regmap_write(iep->map, ICSS_IEP_CMP1_REG0, lower_32_bits(cmp)); ++ if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) ++ regmap_write(iep->map, ICSS_IEP_CMP1_REG1, upper_32_bits(cmp)); ++ /* Configure SYNC, based on req on width */ ++ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, ++ div_u64(ns_width, iep->def_inc)); ++ regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0); ++ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, ++ div_u64(ns_start, iep->def_inc)); ++ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */ ++ /* Enable CMP 1 */ ++ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, ++ IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1)); + } else { +- if (on) { +- u64 start_ns; +- +- iep->period = ((u64)req->period.sec * NSEC_PER_SEC) + +- req->period.nsec; +- start_ns = ((u64)req->period.sec * NSEC_PER_SEC) +- + req->period.nsec; +- icss_iep_update_to_next_boundary(iep, start_ns); +- +- regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, +- div_u64(ns_width, iep->def_inc)); +- regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, +- div_u64(ns_start, iep->def_inc)); +- /* Enable Sync in single shot mode */ +- regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, +- IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN); +- /* Enable CMP 1 */ +- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, +- IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1)); +- } else { +- /* Disable CMP 1 */ +- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, +- IEP_CMP_CFG_CMP_EN(1), 0); +- +- /* clear CMP regs */ +- regmap_write(iep->map, ICSS_IEP_CMP1_REG0, 0); +- if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) +- regmap_write(iep->map, ICSS_IEP_CMP1_REG1, 0); +- +- /* Disable sync */ +- regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); +- } ++ u64 start_ns; ++ ++ iep->period = ((u64)req->period.sec * NSEC_PER_SEC) + ++ req->period.nsec; ++ start_ns = ((u64)req->period.sec * NSEC_PER_SEC) ++ + req->period.nsec; ++ icss_iep_update_to_next_boundary(iep, start_ns); ++ ++ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, ++ div_u64(ns_width, iep->def_inc)); ++ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, ++ div_u64(ns_start, iep->def_inc)); ++ /* Enable Sync in single shot mode */ ++ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, ++ IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN); ++ /* Enable CMP 1 */ ++ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, ++ IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1)); + } + + return 0; +@@ -498,11 +489,21 @@ static int icss_iep_perout_enable(struct icss_iep *iep, + { + int ret = 0; + ++ if (!on) ++ goto disable; ++ + /* Reject requests with unsupported flags */ + if (req->flags & ~(PTP_PEROUT_DUTY_CYCLE | + PTP_PEROUT_PHASE)) + return -EOPNOTSUPP; + ++ /* Set default "on" time (1ms) for the signal if not passed by the app */ ++ if (!(req->flags & PTP_PEROUT_DUTY_CYCLE)) { ++ req->on.sec = 0; ++ req->on.nsec = NSEC_PER_MSEC; ++ } ++ ++disable: + mutex_lock(&iep->ptp_clk_mutex); + + if (iep->pps_enabled) { +@@ -513,12 +514,6 @@ static int icss_iep_perout_enable(struct icss_iep *iep, + if (iep->perout_enabled == !!on) + goto exit; + +- /* Set default "on" time (1ms) for the signal if not passed by the app */ +- if (!(req->flags & PTP_PEROUT_DUTY_CYCLE)) { +- req->on.sec = 0; +- req->on.nsec = NSEC_PER_MSEC; +- } +- + ret = icss_iep_perout_enable_hw(iep, req, on); + if (!ret) + iep->perout_enabled = !!on; +-- +2.39.5 + diff --git a/queue-6.14/net-txgbe-fix-memory-leak-in-txgbe_probe-error-path.patch b/queue-6.14/net-txgbe-fix-memory-leak-in-txgbe_probe-error-path.patch new file mode 100644 index 0000000000..f22c27477e --- /dev/null +++ b/queue-6.14/net-txgbe-fix-memory-leak-in-txgbe_probe-error-path.patch @@ -0,0 +1,54 @@ +From c7ca96cc739cccdcc7755c3d9b4eab57a0bf4d62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 08:59:09 +0530 +Subject: net: txgbe: fix memory leak in txgbe_probe() error path + +From: Abdun Nihaal + +[ Upstream commit b2727326d0a53709380aa147018085d71a6d4843 ] + +When txgbe_sw_init() is called, memory is allocated for wx->rss_key +in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent +error paths after txgbe_sw_init() don't free the rss_key. Fix that by +freeing it in error path along with wx->mac_table. + +Also change the label to which execution jumps when txgbe_sw_init() +fails, because otherwise, it could lead to a double free for rss_key, +when the mac_table allocation fails in wx_sw_init(). + +Fixes: 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number") +Reported-by: Jiawen Wu +Signed-off-by: Abdun Nihaal +Reviewed-by: Jiawen Wu +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250415032910.13139-1-abdun.nihaal@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +index f774502680364..7e352837184fa 100644 +--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c ++++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +@@ -559,7 +559,7 @@ static int txgbe_probe(struct pci_dev *pdev, + /* setup the private structure */ + err = txgbe_sw_init(wx); + if (err) +- goto err_free_mac_table; ++ goto err_pci_release_regions; + + /* check if flash load is done after hw power up */ + err = wx_check_flash_load(wx, TXGBE_SPI_ILDR_STATUS_PERST); +@@ -717,6 +717,7 @@ static int txgbe_probe(struct pci_dev *pdev, + wx_clear_interrupt_scheme(wx); + wx_control_hw(wx, false); + err_free_mac_table: ++ kfree(wx->rss_key); + kfree(wx->mac_table); + err_pci_release_regions: + pci_release_selected_regions(pdev, +-- +2.39.5 + diff --git a/queue-6.14/netfilter-conntrack-fix-erronous-removal-of-offload-.patch b/queue-6.14/netfilter-conntrack-fix-erronous-removal-of-offload-.patch new file mode 100644 index 0000000000..86d16115a9 --- /dev/null +++ b/queue-6.14/netfilter-conntrack-fix-erronous-removal-of-offload-.patch @@ -0,0 +1,77 @@ +From 1e1080c87b335552ff286e05528217870c3f95e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 15:53:48 +0200 +Subject: netfilter: conntrack: fix erronous removal of offload bit + +From: Florian Westphal + +[ Upstream commit d2d31ea8cd80b9830cdab624e94f9d41178fc99d ] + +The blamed commit exposes a possible issue with flow_offload_teardown(): +We might remove the offload bit of a conntrack entry that has been +offloaded again. + +1. conntrack entry c1 is offloaded via flow f1 (f1->ct == c1). +2. f1 times out and is pushed back to slowpath, c1 offload bit is + removed. Due to bug, f1 is not unlinked from rhashtable right away. +3. a new packet arrives for the flow and re-offload is triggered, i.e. + f2->ct == c1. This is because lookup in flowtable skip entries with + teardown bit set. +4. Next flowtable gc cycle finds f1 again +5. flow_offload_teardown() is called again for f1 and c1 offload bit is + removed again, even though we have f2 referencing the same entry. + +This is harmless, but clearly not correct. +Fix the bug that exposes this: set 'teardown = true' to have the gc +callback unlink the flowtable entry from the table right away instead of +the unintentional defer to the next round. + +Also prevent flow_offload_teardown() from fixing up the ct state more than +once: We could also be called from the data path or a notifier, not only +from the flowtable gc callback. + +NF_FLOW_TEARDOWN can never be unset, so we can use it as synchronization +point: if we observe did not see a 0 -> 1 transition, then another CPU +is already doing the ct state fixups for us. + +Fixes: 03428ca5cee9 ("netfilter: conntrack: rework offload nf_conn timeout extension logic") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_core.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 9d8361526f82a..9441ac3d8c1a2 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -383,8 +383,8 @@ static void flow_offload_del(struct nf_flowtable *flow_table, + void flow_offload_teardown(struct flow_offload *flow) + { + clear_bit(IPS_OFFLOAD_BIT, &flow->ct->status); +- set_bit(NF_FLOW_TEARDOWN, &flow->flags); +- flow_offload_fixup_ct(flow); ++ if (!test_and_set_bit(NF_FLOW_TEARDOWN, &flow->flags)) ++ flow_offload_fixup_ct(flow); + } + EXPORT_SYMBOL_GPL(flow_offload_teardown); + +@@ -558,10 +558,12 @@ static void nf_flow_offload_gc_step(struct nf_flowtable *flow_table, + + if (nf_flow_has_expired(flow) || + nf_ct_is_dying(flow->ct) || +- nf_flow_custom_gc(flow_table, flow)) ++ nf_flow_custom_gc(flow_table, flow)) { + flow_offload_teardown(flow); +- else if (!teardown) ++ teardown = true; ++ } else if (!teardown) { + nf_flow_table_extend_ct_timeout(flow->ct); ++ } + + if (teardown) { + if (test_bit(NF_FLOW_HW, &flow->flags)) { +-- +2.39.5 + diff --git a/queue-6.14/netlink-specs-ovs_vport-align-with-c-codegen-capabil.patch b/queue-6.14/netlink-specs-ovs_vport-align-with-c-codegen-capabil.patch new file mode 100644 index 0000000000..ebc88b8a90 --- /dev/null +++ b/queue-6.14/netlink-specs-ovs_vport-align-with-c-codegen-capabil.patch @@ -0,0 +1,69 @@ +From 14f538b051a13b3ffdf2425aacaf5afe37888b2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 07:55:41 -0700 +Subject: netlink: specs: ovs_vport: align with C codegen capabilities + +From: Jakub Kicinski + +[ Upstream commit 747fb8413aaa36e4c988d45c4fe20d4c2b0778cd ] + +We started generating C code for OvS a while back, but actually +C codegen only supports fixed headers specified at the family +level right now (schema also allows specifying them per op). +ovs_flow and ovs_datapath already specify the fixed header +at the family level but ovs_vport does it per op. +Move the property, all ops use the same header. + +This ensures YNL C sees the correct hdr_len: + + const struct ynl_family ynl_ovs_vport_family = { + .name = "ovs_vport", + - .hdr_len = sizeof(struct genlmsghdr), + + .hdr_len = sizeof(struct genlmsghdr) + sizeof(struct ovs_header), + }; + +Fixes: 7c59c9c8f202 ("tools: ynl: generate code for ovs families") +Link: https://patch.msgid.link/20250409145541.580674-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/netlink/specs/ovs_vport.yaml | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/Documentation/netlink/specs/ovs_vport.yaml b/Documentation/netlink/specs/ovs_vport.yaml +index 86ba9ac2a5210..b538bb99ee9b5 100644 +--- a/Documentation/netlink/specs/ovs_vport.yaml ++++ b/Documentation/netlink/specs/ovs_vport.yaml +@@ -123,12 +123,12 @@ attribute-sets: + + operations: + name-prefix: ovs-vport-cmd- ++ fixed-header: ovs-header + list: + - + name: new + doc: Create a new OVS vport + attribute-set: vport +- fixed-header: ovs-header + do: + request: + attributes: +@@ -141,7 +141,6 @@ operations: + name: del + doc: Delete existing OVS vport from a data path + attribute-set: vport +- fixed-header: ovs-header + do: + request: + attributes: +@@ -152,7 +151,6 @@ operations: + name: get + doc: Get / dump OVS vport configuration and state + attribute-set: vport +- fixed-header: ovs-header + do: &vport-get-op + request: + attributes: +-- +2.39.5 + diff --git a/queue-6.14/netlink-specs-rt-link-add-an-attr-layer-around-alt-i.patch b/queue-6.14/netlink-specs-rt-link-add-an-attr-layer-around-alt-i.patch new file mode 100644 index 0000000000..ceb06b9fef --- /dev/null +++ b/queue-6.14/netlink-specs-rt-link-add-an-attr-layer-around-alt-i.patch @@ -0,0 +1,65 @@ +From 6b60e5812d5815a275034476fb2121a49c6a4525 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 14:18:48 -0700 +Subject: netlink: specs: rt-link: add an attr layer around alt-ifname + +From: Jakub Kicinski + +[ Upstream commit acf4da17deada7f8b120e051aa6c9cac40dbd83b ] + +alt-ifname attr is directly placed in requests (as an alternative +to ifname) but in responses its wrapped up in IFLA_PROP_LIST +and only there is may be multi-attr. See rtnl_fill_prop_list(). + +Fixes: b2f63d904e72 ("doc/netlink: Add spec for rt link messages") +Reviewed-by: Donald Hunter +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250414211851.602096-6-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/netlink/specs/rt_link.yaml | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/Documentation/netlink/specs/rt_link.yaml b/Documentation/netlink/specs/rt_link.yaml +index 0d492500c7e57..1eab6aeaa2193 100644 +--- a/Documentation/netlink/specs/rt_link.yaml ++++ b/Documentation/netlink/specs/rt_link.yaml +@@ -1101,11 +1101,10 @@ attribute-sets: + - + name: prop-list + type: nest +- nested-attributes: link-attrs ++ nested-attributes: prop-list-link-attrs + - + name: alt-ifname + type: string +- multi-attr: true + - + name: perm-address + type: binary +@@ -1148,6 +1147,13 @@ attribute-sets: + name: max-pacing-offload-horizon + type: uint + doc: EDT offload horizon supported by the device (in nsec). ++ - ++ name: prop-list-link-attrs ++ subset-of: link-attrs ++ attributes: ++ - ++ name: alt-ifname ++ multi-attr: true + - + name: af-spec-attrs + attributes: +@@ -2434,7 +2440,6 @@ operations: + - min-mtu + - max-mtu + - prop-list +- - alt-ifname + - perm-address + - proto-down-reason + - parent-dev-name +-- +2.39.5 + diff --git a/queue-6.14/netlink-specs-rt-link-adjust-mctp-attribute-naming.patch b/queue-6.14/netlink-specs-rt-link-adjust-mctp-attribute-naming.patch new file mode 100644 index 0000000000..84b3efd966 --- /dev/null +++ b/queue-6.14/netlink-specs-rt-link-adjust-mctp-attribute-naming.patch @@ -0,0 +1,53 @@ +From f6bc1c59f2784c027b237000ca1ffff2ae9f2d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 14:18:50 -0700 +Subject: netlink: specs: rt-link: adjust mctp attribute naming + +From: Jakub Kicinski + +[ Upstream commit beb3c5ad8829b52057f48a776a9d9558b98c157f ] + +MCTP attribute naming is inconsistent. In C we have: + IFLA_MCTP_NET, + IFLA_MCTP_PHYS_BINDING, + ^^^^ + +but in YAML: + - mctp-net + - phys-binding + ^ + no "mctp" + +It's unclear whether the "mctp" part of the name is supposed +to be a prefix or part of attribute name. Make it a prefix, +seems cleaner, even tho technically phys-binding was added later. + +Fixes: b2f63d904e72 ("doc/netlink: Add spec for rt link messages") +Reviewed-by: Donald Hunter +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250414211851.602096-8-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/netlink/specs/rt_link.yaml | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/Documentation/netlink/specs/rt_link.yaml b/Documentation/netlink/specs/rt_link.yaml +index 9f0ca05df0b98..78d3bec72f0e7 100644 +--- a/Documentation/netlink/specs/rt_link.yaml ++++ b/Documentation/netlink/specs/rt_link.yaml +@@ -2166,9 +2166,10 @@ attribute-sets: + type: u32 + - + name: mctp-attrs ++ name-prefix: ifla-mctp- + attributes: + - +- name: mctp-net ++ name: net + type: u32 + - + name: phys-binding +-- +2.39.5 + diff --git a/queue-6.14/netlink-specs-rt-neigh-prefix-struct-nfmsg-members-w.patch b/queue-6.14/netlink-specs-rt-neigh-prefix-struct-nfmsg-members-w.patch new file mode 100644 index 0000000000..bbef0f760e --- /dev/null +++ b/queue-6.14/netlink-specs-rt-neigh-prefix-struct-nfmsg-members-w.patch @@ -0,0 +1,63 @@ +From e42dca804cb626000c6d9f057d697607f4004584 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 14:18:51 -0700 +Subject: netlink: specs: rt-neigh: prefix struct nfmsg members with ndm + +From: Jakub Kicinski + +[ Upstream commit e31f86ee4b9ccb844baf2131da8e5d4d6f23aa1d ] + +Attach ndm- to all members of struct nfmsg. We could possibly +use name-prefix just for C, but I don't think we have any precedent +for using name-prefix on structs, and other rtnetlink sub-specs +give full names for fixed header struct members. + +Fixes: bc515ed06652 ("netlink: specs: Add a spec for neighbor tables in rtnetlink") +Reviewed-by: Donald Hunter +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250414211851.602096-9-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/netlink/specs/rt_neigh.yaml | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/Documentation/netlink/specs/rt_neigh.yaml b/Documentation/netlink/specs/rt_neigh.yaml +index a1e137a16abd5..a843caa72259e 100644 +--- a/Documentation/netlink/specs/rt_neigh.yaml ++++ b/Documentation/netlink/specs/rt_neigh.yaml +@@ -13,25 +13,25 @@ definitions: + type: struct + members: + - +- name: family ++ name: ndm-family + type: u8 + - +- name: pad ++ name: ndm-pad + type: pad + len: 3 + - +- name: ifindex ++ name: ndm-ifindex + type: s32 + - +- name: state ++ name: ndm-state + type: u16 + enum: nud-state + - +- name: flags ++ name: ndm-flags + type: u8 + enum: ntf-flags + - +- name: type ++ name: ndm-type + type: u8 + enum: rtm-type + - +-- +2.39.5 + diff --git a/queue-6.14/netlink-specs-rtnetlink-attribute-naming-corrections.patch b/queue-6.14/netlink-specs-rtnetlink-attribute-naming-corrections.patch new file mode 100644 index 0000000000..d91a737799 --- /dev/null +++ b/queue-6.14/netlink-specs-rtnetlink-attribute-naming-corrections.patch @@ -0,0 +1,72 @@ +From 3e6124ee01414b02e2a4fe5b1f3364fc2e944e7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 14:18:49 -0700 +Subject: netlink: specs: rtnetlink: attribute naming corrections + +From: Jakub Kicinski + +[ Upstream commit 540201c0ef7e8e7b169f68a238ade931a81a31a6 ] + +Some attribute names diverge in very minor ways from the C names. +These are most likely typos, and they prevent the C codegen from +working. + +Fixes: bc515ed06652 ("netlink: specs: Add a spec for neighbor tables in rtnetlink") +Fixes: b2f63d904e72 ("doc/netlink: Add spec for rt link messages") +Reviewed-by: Donald Hunter +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250414211851.602096-7-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/netlink/specs/rt_link.yaml | 6 +++--- + Documentation/netlink/specs/rt_neigh.yaml | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/Documentation/netlink/specs/rt_link.yaml b/Documentation/netlink/specs/rt_link.yaml +index 1eab6aeaa2193..9f0ca05df0b98 100644 +--- a/Documentation/netlink/specs/rt_link.yaml ++++ b/Documentation/netlink/specs/rt_link.yaml +@@ -1576,7 +1576,7 @@ attribute-sets: + name: nf-call-iptables + type: u8 + - +- name: nf-call-ip6-tables ++ name: nf-call-ip6tables + type: u8 + - + name: nf-call-arptables +@@ -2064,7 +2064,7 @@ attribute-sets: + name: id + type: u16 + - +- name: flag ++ name: flags + type: binary + struct: ifla-vlan-flags + - +@@ -2152,7 +2152,7 @@ attribute-sets: + type: binary + struct: ifla-cacheinfo + - +- name: icmp6-stats ++ name: icmp6stats + type: binary + struct: ifla-icmp6-stats + - +diff --git a/Documentation/netlink/specs/rt_neigh.yaml b/Documentation/netlink/specs/rt_neigh.yaml +index e670b6dc07be4..a1e137a16abd5 100644 +--- a/Documentation/netlink/specs/rt_neigh.yaml ++++ b/Documentation/netlink/specs/rt_neigh.yaml +@@ -189,7 +189,7 @@ attribute-sets: + type: binary + display-hint: ipv4 + - +- name: lladr ++ name: lladdr + type: binary + display-hint: mac + - +-- +2.39.5 + diff --git a/queue-6.14/nvmet-pci-epf-always-fully-initialize-completion-ent.patch b/queue-6.14/nvmet-pci-epf-always-fully-initialize-completion-ent.patch new file mode 100644 index 0000000000..95c4fbf683 --- /dev/null +++ b/queue-6.14/nvmet-pci-epf-always-fully-initialize-completion-ent.patch @@ -0,0 +1,100 @@ +From d5e998487255b1719a82e7f10f14090fd7f06134 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 10:42:09 +0900 +Subject: nvmet: pci-epf: always fully initialize completion entries + +From: Damien Le Moal + +[ Upstream commit ffe0398c7d6a38af0584d4668d3762b7a97e2275 ] + +For a command that is normally processed through the command request +execute() function, the completion entry for the command is initialized +by __nvmet_req_complete() and nvmet_pci_epf_cq_work() only needs to set +the status field and the phase of the completion entry before posting +the entry to the completion queue. + +However, for commands that are failed due to an internal error (e.g. the +command data buffer allocation fails), the command request execute() +function is not called and __nvmet_req_complete() is never executed for +the command, leaving the command completion entry uninitialized. For +such command failed before calling req->execute(), the host ends up +seeing completion entries with an invalid submission queue ID and +command ID. + +Avoid such issue by always fully initilizing a command completion entry +in nvmet_pci_epf_cq_work(), setting the entry submission queue head, ID +and command ID. + +Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver") +Signed-off-by: Damien Le Moal +Reviewed-by: Niklas Cassel +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/pci-epf.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/target/pci-epf.c b/drivers/nvme/target/pci-epf.c +index 99563648c318f..70855bb9823af 100644 +--- a/drivers/nvme/target/pci-epf.c ++++ b/drivers/nvme/target/pci-epf.c +@@ -1655,16 +1655,17 @@ static int nvmet_pci_epf_process_sq(struct nvmet_pci_epf_ctrl *ctrl, + { + struct nvmet_pci_epf_iod *iod; + int ret, n = 0; ++ u16 head = sq->head; + + sq->tail = nvmet_pci_epf_bar_read32(ctrl, sq->db); +- while (sq->head != sq->tail && (!ctrl->sq_ab || n < ctrl->sq_ab)) { ++ while (head != sq->tail && (!ctrl->sq_ab || n < ctrl->sq_ab)) { + iod = nvmet_pci_epf_alloc_iod(sq); + if (!iod) + break; + + /* Get the NVMe command submitted by the host. */ + ret = nvmet_pci_epf_transfer(ctrl, &iod->cmd, +- sq->pci_addr + sq->head * sq->qes, ++ sq->pci_addr + head * sq->qes, + sq->qes, DMA_FROM_DEVICE); + if (ret) { + /* Not much we can do... */ +@@ -1673,12 +1674,13 @@ static int nvmet_pci_epf_process_sq(struct nvmet_pci_epf_ctrl *ctrl, + } + + dev_dbg(ctrl->dev, "SQ[%u]: head %u, tail %u, command %s\n", +- sq->qid, sq->head, sq->tail, ++ sq->qid, head, sq->tail, + nvmet_pci_epf_iod_name(iod)); + +- sq->head++; +- if (sq->head == sq->depth) +- sq->head = 0; ++ head++; ++ if (head == sq->depth) ++ head = 0; ++ WRITE_ONCE(sq->head, head); + n++; + + queue_work_on(WORK_CPU_UNBOUND, sq->iod_wq, &iod->work); +@@ -1772,8 +1774,17 @@ static void nvmet_pci_epf_cq_work(struct work_struct *work) + if (!iod) + break; + +- /* Post the IOD completion entry. */ ++ /* ++ * Post the IOD completion entry. If the IOD request was ++ * executed (req->execute() called), the CQE is already ++ * initialized. However, the IOD may have been failed before ++ * that, leaving the CQE not properly initialized. So always ++ * initialize it here. ++ */ + cqe = &iod->cqe; ++ cqe->sq_head = cpu_to_le16(READ_ONCE(iod->sq->head)); ++ cqe->sq_id = cpu_to_le16(iod->sq->qid); ++ cqe->command_id = iod->cmd.common.command_id; + cqe->status = cpu_to_le16((iod->status << 1) | cq->phase); + + dev_dbg(ctrl->dev, +-- +2.39.5 + diff --git a/queue-6.14/nvmet-pci-epf-clear-cc-and-csts-when-disabling-the-c.patch b/queue-6.14/nvmet-pci-epf-clear-cc-and-csts-when-disabling-the-c.patch new file mode 100644 index 0000000000..36a9d3662e --- /dev/null +++ b/queue-6.14/nvmet-pci-epf-clear-cc-and-csts-when-disabling-the-c.patch @@ -0,0 +1,151 @@ +From eb2d3d5db054fffe5ec1db129110b3a5f1aec5a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 10:42:10 +0900 +Subject: nvmet: pci-epf: clear CC and CSTS when disabling the controller + +From: Damien Le Moal + +[ Upstream commit f8e01fa93f3e4fc255d240cfa0c045ce0b5c97ea ] + +When a host shuts down the controller when shutting down but does so +without first disabling the controller, the enable bit remains set in +the controller configuration register. When the host restarts and +attempts to enable the controller again, the +nvmet_pci_epf_poll_cc_work() function is unable to detect the change +from 0 to 1 of the enable bit, and thus the controller is not enabled +again, which result in a device scan timeout on the host. This problem +also occurs if the host shuts down uncleanly or if the PCIe link goes +down: as the CC.EN value is not reset, the controller is not enabled +again when the host restarts. + +Fix this by introducing the function nvmet_pci_epf_clear_ctrl_config() +to clear the CC and CSTS registers of the controller when the PCIe link +is lost (nvmet_pci_epf_stop_ctrl() function), or when starting the +controller fails (nvmet_pci_epf_enable_ctrl() fails). Also use this +function in nvmet_pci_epf_init_bar() to simplify the initialization of +the CC and CSTS registers. + +Furthermore, modify the function nvmet_pci_epf_disable_ctrl() to clear +the CC.EN bit and write this updated value to the BAR register when the +controller is shutdown by the host, to ensure that upon restart, we can +detect the host setting CC.EN. + +Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver") +Signed-off-by: Damien Le Moal +Reviewed-by: Niklas Cassel +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/pci-epf.c | 49 +++++++++++++++++++++++------------ + 1 file changed, 32 insertions(+), 17 deletions(-) + +diff --git a/drivers/nvme/target/pci-epf.c b/drivers/nvme/target/pci-epf.c +index 70855bb9823af..5c4c4c1f535d4 100644 +--- a/drivers/nvme/target/pci-epf.c ++++ b/drivers/nvme/target/pci-epf.c +@@ -1825,6 +1825,21 @@ static void nvmet_pci_epf_cq_work(struct work_struct *work) + NVMET_PCI_EPF_CQ_RETRY_INTERVAL); + } + ++static void nvmet_pci_epf_clear_ctrl_config(struct nvmet_pci_epf_ctrl *ctrl) ++{ ++ struct nvmet_ctrl *tctrl = ctrl->tctrl; ++ ++ /* Initialize controller status. */ ++ tctrl->csts = 0; ++ ctrl->csts = 0; ++ nvmet_pci_epf_bar_write32(ctrl, NVME_REG_CSTS, ctrl->csts); ++ ++ /* Initialize controller configuration and start polling. */ ++ tctrl->cc = 0; ++ ctrl->cc = 0; ++ nvmet_pci_epf_bar_write32(ctrl, NVME_REG_CC, ctrl->cc); ++} ++ + static int nvmet_pci_epf_enable_ctrl(struct nvmet_pci_epf_ctrl *ctrl) + { + u64 pci_addr, asq, acq; +@@ -1890,18 +1905,20 @@ static int nvmet_pci_epf_enable_ctrl(struct nvmet_pci_epf_ctrl *ctrl) + return 0; + + err: +- ctrl->csts = 0; ++ nvmet_pci_epf_clear_ctrl_config(ctrl); + return -EINVAL; + } + +-static void nvmet_pci_epf_disable_ctrl(struct nvmet_pci_epf_ctrl *ctrl) ++static void nvmet_pci_epf_disable_ctrl(struct nvmet_pci_epf_ctrl *ctrl, ++ bool shutdown) + { + int qid; + + if (!ctrl->enabled) + return; + +- dev_info(ctrl->dev, "Disabling controller\n"); ++ dev_info(ctrl->dev, "%s controller\n", ++ shutdown ? "Shutting down" : "Disabling"); + + ctrl->enabled = false; + cancel_delayed_work_sync(&ctrl->poll_sqs); +@@ -1918,6 +1935,11 @@ static void nvmet_pci_epf_disable_ctrl(struct nvmet_pci_epf_ctrl *ctrl) + nvmet_pci_epf_delete_cq(ctrl->tctrl, 0); + + ctrl->csts &= ~NVME_CSTS_RDY; ++ if (shutdown) { ++ ctrl->csts |= NVME_CSTS_SHST_CMPLT; ++ ctrl->cc &= ~NVME_CC_ENABLE; ++ nvmet_pci_epf_bar_write32(ctrl, NVME_REG_CC, ctrl->cc); ++ } + } + + static void nvmet_pci_epf_poll_cc_work(struct work_struct *work) +@@ -1944,12 +1966,10 @@ static void nvmet_pci_epf_poll_cc_work(struct work_struct *work) + } + + if (!nvmet_cc_en(new_cc) && nvmet_cc_en(old_cc)) +- nvmet_pci_epf_disable_ctrl(ctrl); ++ nvmet_pci_epf_disable_ctrl(ctrl, false); + +- if (nvmet_cc_shn(new_cc) && !nvmet_cc_shn(old_cc)) { +- nvmet_pci_epf_disable_ctrl(ctrl); +- ctrl->csts |= NVME_CSTS_SHST_CMPLT; +- } ++ if (nvmet_cc_shn(new_cc) && !nvmet_cc_shn(old_cc)) ++ nvmet_pci_epf_disable_ctrl(ctrl, true); + + if (!nvmet_cc_shn(new_cc) && nvmet_cc_shn(old_cc)) + ctrl->csts &= ~NVME_CSTS_SHST_CMPLT; +@@ -1988,16 +2008,10 @@ static void nvmet_pci_epf_init_bar(struct nvmet_pci_epf_ctrl *ctrl) + /* Clear Controller Memory Buffer Supported (CMBS). */ + ctrl->cap &= ~(0x1ULL << 57); + +- /* Controller configuration. */ +- ctrl->cc = tctrl->cc & (~NVME_CC_ENABLE); +- +- /* Controller status. */ +- ctrl->csts = ctrl->tctrl->csts; +- + nvmet_pci_epf_bar_write64(ctrl, NVME_REG_CAP, ctrl->cap); + nvmet_pci_epf_bar_write32(ctrl, NVME_REG_VS, tctrl->subsys->ver); +- nvmet_pci_epf_bar_write32(ctrl, NVME_REG_CSTS, ctrl->csts); +- nvmet_pci_epf_bar_write32(ctrl, NVME_REG_CC, ctrl->cc); ++ ++ nvmet_pci_epf_clear_ctrl_config(ctrl); + } + + static int nvmet_pci_epf_create_ctrl(struct nvmet_pci_epf *nvme_epf, +@@ -2102,7 +2116,8 @@ static void nvmet_pci_epf_stop_ctrl(struct nvmet_pci_epf_ctrl *ctrl) + { + cancel_delayed_work_sync(&ctrl->poll_cc); + +- nvmet_pci_epf_disable_ctrl(ctrl); ++ nvmet_pci_epf_disable_ctrl(ctrl, false); ++ nvmet_pci_epf_clear_ctrl_config(ctrl); + } + + static void nvmet_pci_epf_destroy_ctrl(struct nvmet_pci_epf_ctrl *ctrl) +-- +2.39.5 + diff --git a/queue-6.14/octeontx2-pf-handle-otx2_mbox_get_rsp-errors.patch b/queue-6.14/octeontx2-pf-handle-otx2_mbox_get_rsp-errors.patch new file mode 100644 index 0000000000..98e816064d --- /dev/null +++ b/queue-6.14/octeontx2-pf-handle-otx2_mbox_get_rsp-errors.patch @@ -0,0 +1,40 @@ +From 09e0abc9016724e2bf714cc300b4592fc7531628 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Apr 2025 13:33:27 -0500 +Subject: octeontx2-pf: handle otx2_mbox_get_rsp errors + +From: Chenyuan Yang + +[ Upstream commit 688abe1027d00b7d4b2ce2d8764a2ae5ec6d250b ] + +Adding error pointer check after calling otx2_mbox_get_rsp(). + +This is similar to the commit bd3110bc102a +("octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c"). + +Signed-off-by: Chenyuan Yang +Fixes: 6c40ca957fe5 ("octeontx2-pf: Adds TC offload support") +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/20250412183327.3550970-1-chenyuan0y@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/rep.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c +index 04e08e06f30ff..7153a71dfc860 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c +@@ -67,6 +67,8 @@ static int rvu_rep_mcam_flow_init(struct rep_dev *rep) + + rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp + (&priv->mbox.mbox, 0, &req->hdr); ++ if (IS_ERR(rsp)) ++ goto exit; + + for (ent = 0; ent < rsp->count; ent++) + rep->flow_cfg->flow_ent[ent + allocated] = rsp->entry_list[ent]; +-- +2.39.5 + diff --git a/queue-6.14/ovl-remove-unused-forward-declaration.patch b/queue-6.14/ovl-remove-unused-forward-declaration.patch new file mode 100644 index 0000000000..fbd11443fa --- /dev/null +++ b/queue-6.14/ovl-remove-unused-forward-declaration.patch @@ -0,0 +1,38 @@ +From 7757c8a8f37cee115ae137ebd9ac32c3eadbf7e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Feb 2025 13:07:55 +0100 +Subject: ovl: remove unused forward declaration + +From: Giuseppe Scrivano + +[ Upstream commit a6eb9a4a69cc360b930dad9dc8513f8fd9b3577f ] + +The ovl_get_verity_xattr() function was never added, only its declaration. + +Signed-off-by: Giuseppe Scrivano +Fixes: 184996e92e86 ("ovl: Validate verity xattr when resolving lowerdata") +Reviewed-by: Amir Goldstein +Reviewed-by: Alexander Larsson +Reviewed-by: Christian Brauner +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/overlayfs/overlayfs.h | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index 0021e20250202..be86d2ed71d65 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -540,8 +540,6 @@ int ovl_set_metacopy_xattr(struct ovl_fs *ofs, struct dentry *d, + bool ovl_is_metacopy_dentry(struct dentry *dentry); + char *ovl_get_redirect_xattr(struct ovl_fs *ofs, const struct path *path, int padding); + int ovl_ensure_verity_loaded(struct path *path); +-int ovl_get_verity_xattr(struct ovl_fs *ofs, const struct path *path, +- u8 *digest_buf, int *buf_length); + int ovl_validate_verity(struct ovl_fs *ofs, + struct path *metapath, + struct path *datapath); +-- +2.39.5 + diff --git a/queue-6.14/pds_core-fix-memory-leak-in-pdsc_debugfs_add_qcq.patch b/queue-6.14/pds_core-fix-memory-leak-in-pdsc_debugfs_add_qcq.patch new file mode 100644 index 0000000000..0f506cc2b9 --- /dev/null +++ b/queue-6.14/pds_core-fix-memory-leak-in-pdsc_debugfs_add_qcq.patch @@ -0,0 +1,43 @@ +From 8fdff5d051d41e759e1ec4693b5f014311ca3fec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 11:14:48 +0530 +Subject: pds_core: fix memory leak in pdsc_debugfs_add_qcq() + +From: Abdun Nihaal + +[ Upstream commit 8b82f656826c741d032490b089a5638c33f2c91d ] + +The memory allocated for intr_ctrl_regset, which is passed to +debugfs_create_regset32() may not be cleaned up when the driver is +removed. Fix that by using device managed allocation for it. + +Fixes: 45d76f492938 ("pds_core: set up device and adminq") +Signed-off-by: Abdun Nihaal +Reviewed-by: Michal Swiatkowski +Reviewed-by: Shannon Nelson +Link: https://patch.msgid.link/20250409054450.48606-1-abdun.nihaal@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/pds_core/debugfs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/amd/pds_core/debugfs.c b/drivers/net/ethernet/amd/pds_core/debugfs.c +index ac37a4e738ae7..04c5e3abd8d70 100644 +--- a/drivers/net/ethernet/amd/pds_core/debugfs.c ++++ b/drivers/net/ethernet/amd/pds_core/debugfs.c +@@ -154,8 +154,9 @@ void pdsc_debugfs_add_qcq(struct pdsc *pdsc, struct pdsc_qcq *qcq) + debugfs_create_u32("index", 0400, intr_dentry, &intr->index); + debugfs_create_u32("vector", 0400, intr_dentry, &intr->vector); + +- intr_ctrl_regset = kzalloc(sizeof(*intr_ctrl_regset), +- GFP_KERNEL); ++ intr_ctrl_regset = devm_kzalloc(pdsc->dev, ++ sizeof(*intr_ctrl_regset), ++ GFP_KERNEL); + if (!intr_ctrl_regset) + return; + intr_ctrl_regset->regs = intr_ctrl_regs; +-- +2.39.5 + diff --git a/queue-6.14/perf-tools-remove-evsel__handle_error_quirks.patch b/queue-6.14/perf-tools-remove-evsel__handle_error_quirks.patch new file mode 100644 index 0000000000..50b0f18e3c --- /dev/null +++ b/queue-6.14/perf-tools-remove-evsel__handle_error_quirks.patch @@ -0,0 +1,108 @@ +From 1758cd7dd1fd3c6744aeb3f1c6e2dcb2b86965b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 18:02:52 -0700 +Subject: perf tools: Remove evsel__handle_error_quirks() + +From: Namhyung Kim + +[ Upstream commit 2b70702917337a8d6d07f03eed961e0119091647 ] + +The evsel__handle_error_quirks() is to fixup invalid event attributes on +some architecture based on the error code. Currently it's only used for +AMD to disable precise_ip not to use IBS which has more restrictions. + +But the commit c33aea446bf555ab changed call evsel__precise_ip_fallback +for any errors so there's no difference with the above function. To +make matter worse, it caused a problem with branch stack on Zen3. + +The IBS doesn't support branch stack so it should use a regular core +PMU event. The default event is set precise_max and it starts with 3. +And evsel__precise_ip_fallback() tries with it and reduces the level one +by one. At last it tries with 0 but it also failed on Zen3 since the +branch stack is not supported for the cycles event. + +At this point, evsel__precise_ip_fallback() restores the original +precise_ip value (3) in the hope that it can succeed with other modifier +(like exclude_kernel). Then evsel__handle_error_quirks() see it has +precise_ip != 0 and make it retry with 0. This created an infinite +loop. + +Before: + + $ perf record -b -vv |& grep removing + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + removing precise_ip on AMD + ... + +After: + + $ perf record -b true + Error: + Failure to open event 'cycles:P' on PMU 'cpu' which will be removed. + Invalid event (cycles:P) in per-thread mode, enable system wide with '-a'. + Error: + Failure to open any events for recording. + +Fixes: c33aea446bf555ab ("perf tools: Fix precise_ip fallback logic") +Tested-by: Chun-Tse Shao +Cc: Ravi Bangoria +Link: https://lore.kernel.org/r/20250410010252.402221-1-namhyung@kernel.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/evsel.c | 22 ---------------------- + 1 file changed, 22 deletions(-) + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 9cd78cdee6282..c99eb9ff17ed6 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -2556,25 +2556,6 @@ static bool evsel__detect_missing_features(struct evsel *evsel, struct perf_cpu + return false; + } + +-static bool evsel__handle_error_quirks(struct evsel *evsel, int error) +-{ +- /* +- * AMD core PMU tries to forward events with precise_ip to IBS PMU +- * implicitly. But IBS PMU has more restrictions so it can fail with +- * supported event attributes. Let's forward it back to the core PMU +- * by clearing precise_ip only if it's from precise_max (:P). +- */ +- if ((error == -EINVAL || error == -ENOENT) && x86__is_amd_cpu() && +- evsel->core.attr.precise_ip && evsel->precise_max) { +- evsel->core.attr.precise_ip = 0; +- pr_debug2_peo("removing precise_ip on AMD\n"); +- display_attr(&evsel->core.attr); +- return true; +- } +- +- return false; +-} +- + static int evsel__open_cpu(struct evsel *evsel, struct perf_cpu_map *cpus, + struct perf_thread_map *threads, + int start_cpu_map_idx, int end_cpu_map_idx) +@@ -2720,9 +2701,6 @@ static int evsel__open_cpu(struct evsel *evsel, struct perf_cpu_map *cpus, + if (evsel__precise_ip_fallback(evsel)) + goto retry_open; + +- if (evsel__handle_error_quirks(evsel, err)) +- goto retry_open; +- + out_close: + if (err) + threads->err_thread = thread; +-- +2.39.5 + diff --git a/queue-6.14/ptp-ocp-fix-start-time-alignment-in-ptp_ocp_signal_s.patch b/queue-6.14/ptp-ocp-fix-start-time-alignment-in-ptp_ocp_signal_s.patch new file mode 100644 index 0000000000..1c36886893 --- /dev/null +++ b/queue-6.14/ptp-ocp-fix-start-time-alignment-in-ptp_ocp_signal_s.patch @@ -0,0 +1,41 @@ +From e82cf3ca7df8fec06c059e8f4cf5576cfd1e4c14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 08:31:31 +0300 +Subject: ptp: ocp: fix start time alignment in ptp_ocp_signal_set + +From: Sagi Maimon + +[ Upstream commit 2a5970d5aaff8f3e33ce3bfaa403ae88c40de40d ] + +In ptp_ocp_signal_set, the start time for periodic signals is not +aligned to the next period boundary. The current code rounds up the +start time and divides by the period but fails to multiply back by +the period, causing misaligned signal starts. Fix this by multiplying +the rounded-up value by the period to ensure the start time is the +closest next period. + +Fixes: 4bd46bb037f8e ("ptp: ocp: Use DIV64_U64_ROUND_UP for rounding.") +Signed-off-by: Sagi Maimon +Reviewed-by: Vadim Fedorenko +Link: https://patch.msgid.link/20250415053131.129413-1-maimon.sagi@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_ocp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c +index 4a87af0980d69..4b7344e1816e4 100644 +--- a/drivers/ptp/ptp_ocp.c ++++ b/drivers/ptp/ptp_ocp.c +@@ -2067,6 +2067,7 @@ ptp_ocp_signal_set(struct ptp_ocp *bp, int gen, struct ptp_ocp_signal *s) + if (!s->start) { + /* roundup() does not work on 32-bit systems */ + s->start = DIV64_U64_ROUND_UP(start_ns, s->period); ++ s->start *= s->period; + s->start = ktime_add(s->start, s->phase); + } + +-- +2.39.5 + diff --git a/queue-6.14/rdma-bnxt_re-fix-budget-handling-of-notification-que.patch b/queue-6.14/rdma-bnxt_re-fix-budget-handling-of-notification-que.patch new file mode 100644 index 0000000000..c7ee1bcf10 --- /dev/null +++ b/queue-6.14/rdma-bnxt_re-fix-budget-handling-of-notification-que.patch @@ -0,0 +1,65 @@ +From 01fcf7867d0a268e6e8e5bf5fdce41aaceab0b86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 09:39:35 +0530 +Subject: RDMA/bnxt_re: Fix budget handling of notification queue + +From: Kashyap Desai + +[ Upstream commit 6b395d31146a3fae775823ea8570a37b922f6685 ] + +The cited commit in Fixes tag introduced a bug which can cause hang +of completion queue processing because of notification queue budget +goes to zero. + +Found while doing nfs over rdma mount and umount. +Below message is noticed because of the existing bug. + +kernel: cm_destroy_id_wait_timeout: cm_id=00000000ff6c6cc6 timed out. state 11 -> 0, refcnt=1 + +Fix to handle this issue - +Driver will not change nq->budget upon create and destroy of cq and srq +rdma resources. + +Fixes: cb97b377a135 ("RDMA/bnxt_re: Refurbish CQ to NQ hash calculation") +Link: https://patch.msgid.link/r/20250324040935.90182-1-kalesh-anakkur.purayil@broadcom.com +Signed-off-by: Kashyap Desai +Signed-off-by: Kalesh AP +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 6f5db32082dd7..cb9b820c613d6 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1784,8 +1784,6 @@ int bnxt_re_destroy_srq(struct ib_srq *ib_srq, struct ib_udata *udata) + bnxt_qplib_destroy_srq(&rdev->qplib_res, qplib_srq); + ib_umem_release(srq->umem); + atomic_dec(&rdev->stats.res.srq_count); +- if (nq) +- nq->budget--; + return 0; + } + +@@ -1907,8 +1905,6 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, + goto fail; + } + } +- if (nq) +- nq->budget++; + active_srqs = atomic_inc_return(&rdev->stats.res.srq_count); + if (active_srqs > rdev->stats.res.srq_watermark) + rdev->stats.res.srq_watermark = active_srqs; +@@ -3078,7 +3074,6 @@ int bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + ib_umem_release(cq->umem); + + atomic_dec(&rdev->stats.res.cq_count); +- nq->budget--; + kfree(cq->cql); + return 0; + } +-- +2.39.5 + diff --git a/queue-6.14/rdma-bnxt_re-remove-unusable-nq-variable.patch b/queue-6.14/rdma-bnxt_re-remove-unusable-nq-variable.patch new file mode 100644 index 0000000000..c9a4f0d3f1 --- /dev/null +++ b/queue-6.14/rdma-bnxt_re-remove-unusable-nq-variable.patch @@ -0,0 +1,67 @@ +From 6e8eb5c38c84cb465d443aa98fdf4f21b3cdb06b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 15:32:20 +0300 +Subject: RDMA/bnxt_re: Remove unusable nq variable + +From: Leon Romanovsky + +[ Upstream commit ffc59e32c67e599cc473d6427a4aa584399d5b3c ] + +Remove nq variable from bnxt_re_create_srq() and bnxt_re_destroy_srq() +as it generates the following compilation warnings: + +>> drivers/infiniband/hw/bnxt_re/ib_verbs.c:1777:24: warning: variable +'nq' set but not used [-Wunused-but-set-variable] + 1777 | struct bnxt_qplib_nq *nq = NULL; + | ^ + drivers/infiniband/hw/bnxt_re/ib_verbs.c:1828:24: warning: variable +'nq' set but not used [-Wunused-but-set-variable] + 1828 | struct bnxt_qplib_nq *nq = NULL; + | ^ + 2 warnings generated. + +Fixes: 6b395d31146a ("RDMA/bnxt_re: Fix budget handling of notification queue") +Link: https://patch.msgid.link/r/8a4343e217d7d1c0a5a786b785c4ac57cb72a2a0.1744288299.git.leonro@nvidia.com +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202504091055.CzgXnk4C-lkp@intel.com/ +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index cb9b820c613d6..02b21d484677e 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1773,10 +1773,7 @@ int bnxt_re_destroy_srq(struct ib_srq *ib_srq, struct ib_udata *udata) + ib_srq); + struct bnxt_re_dev *rdev = srq->rdev; + struct bnxt_qplib_srq *qplib_srq = &srq->qplib_srq; +- struct bnxt_qplib_nq *nq = NULL; + +- if (qplib_srq->cq) +- nq = qplib_srq->cq->nq; + if (rdev->chip_ctx->modes.toggle_bits & BNXT_QPLIB_SRQ_TOGGLE_BIT) { + free_page((unsigned long)srq->uctx_srq_page); + hash_del(&srq->hash_entry); +@@ -1824,7 +1821,6 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, + struct ib_udata *udata) + { + struct bnxt_qplib_dev_attr *dev_attr; +- struct bnxt_qplib_nq *nq = NULL; + struct bnxt_re_ucontext *uctx; + struct bnxt_re_dev *rdev; + struct bnxt_re_srq *srq; +@@ -1870,7 +1866,6 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, + srq->qplib_srq.eventq_hw_ring_id = rdev->nqr->nq[0].ring_id; + srq->qplib_srq.sg_info.pgsize = PAGE_SIZE; + srq->qplib_srq.sg_info.pgshft = PAGE_SHIFT; +- nq = &rdev->nqr->nq[0]; + + if (udata) { + rc = bnxt_re_init_user_srq(rdev, pd, srq, udata); +-- +2.39.5 + diff --git a/queue-6.14/rdma-core-silence-oversized-kvmalloc-warning.patch b/queue-6.14/rdma-core-silence-oversized-kvmalloc-warning.patch new file mode 100644 index 0000000000..b22daf2a7c --- /dev/null +++ b/queue-6.14/rdma-core-silence-oversized-kvmalloc-warning.patch @@ -0,0 +1,73 @@ +From 9d15827086e95057abbd8946722380b6b5dce75a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 14:42:21 +0200 +Subject: RDMA/core: Silence oversized kvmalloc() warning + +From: Shay Drory + +[ Upstream commit 9a0e6f15029e1a8a21e40f06fd05aa52b7f063de ] + +syzkaller triggered an oversized kvmalloc() warning. +Silence it by adding __GFP_NOWARN. + +syzkaller log: + WARNING: CPU: 7 PID: 518 at mm/util.c:665 __kvmalloc_node_noprof+0x175/0x180 + CPU: 7 UID: 0 PID: 518 Comm: c_repro Not tainted 6.11.0-rc6+ #6 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + RIP: 0010:__kvmalloc_node_noprof+0x175/0x180 + RSP: 0018:ffffc90001e67c10 EFLAGS: 00010246 + RAX: 0000000000000100 RBX: 0000000000000400 RCX: ffffffff8149d46b + RDX: 0000000000000000 RSI: ffff8881030fae80 RDI: 0000000000000002 + RBP: 000000712c800000 R08: 0000000000000100 R09: 0000000000000000 + R10: ffffc90001e67c10 R11: 0030ae0601000000 R12: 0000000000000000 + R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000 + FS: 00007fde79159740(0000) GS:ffff88813bdc0000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000020000180 CR3: 0000000105eb4005 CR4: 00000000003706b0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + ib_umem_odp_get+0x1f6/0x390 + mlx5_ib_reg_user_mr+0x1e8/0x450 + ib_uverbs_reg_mr+0x28b/0x440 + ib_uverbs_write+0x7d3/0xa30 + vfs_write+0x1ac/0x6c0 + ksys_write+0x134/0x170 + ? __sanitizer_cov_trace_pc+0x1c/0x50 + do_syscall_64+0x50/0x110 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: 37824952dc8f ("RDMA/odp: Use kvcalloc for the dma_list and page_list") +Signed-off-by: Shay Drory +Link: https://patch.msgid.link/c6cb92379de668be94894f49c2cfa40e73f94d56.1742388096.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/umem_odp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c +index e9fa22d31c233..c48ef60830205 100644 +--- a/drivers/infiniband/core/umem_odp.c ++++ b/drivers/infiniband/core/umem_odp.c +@@ -76,12 +76,14 @@ static inline int ib_init_umem_odp(struct ib_umem_odp *umem_odp, + + npfns = (end - start) >> PAGE_SHIFT; + umem_odp->pfn_list = kvcalloc( +- npfns, sizeof(*umem_odp->pfn_list), GFP_KERNEL); ++ npfns, sizeof(*umem_odp->pfn_list), ++ GFP_KERNEL | __GFP_NOWARN); + if (!umem_odp->pfn_list) + return -ENOMEM; + + umem_odp->dma_list = kvcalloc( +- ndmas, sizeof(*umem_odp->dma_list), GFP_KERNEL); ++ ndmas, sizeof(*umem_odp->dma_list), ++ GFP_KERNEL | __GFP_NOWARN); + if (!umem_odp->dma_list) { + ret = -ENOMEM; + goto out_pfn_list; +-- +2.39.5 + diff --git a/queue-6.14/rdma-hns-fix-wrong-maximum-dma-segment-size.patch b/queue-6.14/rdma-hns-fix-wrong-maximum-dma-segment-size.patch new file mode 100644 index 0000000000..b45e247141 --- /dev/null +++ b/queue-6.14/rdma-hns-fix-wrong-maximum-dma-segment-size.patch @@ -0,0 +1,37 @@ +From bc06e3301230799cb3f2f217a15b0dae9fbfeab7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Mar 2025 19:47:24 +0800 +Subject: RDMA/hns: Fix wrong maximum DMA segment size + +From: Chengchang Tang + +[ Upstream commit 9beb2c91fb86e0be70a5833c6730441fa3c9efa8 ] + +Set maximum DMA segment size to 2G instead of UINT_MAX due to HW limit. + +Fixes: e0477b34d9d1 ("RDMA: Explicitly pass in the dma_device to ib_register_device") +Link: https://patch.msgid.link/r/20250327114724.3454268-3-huangjunxian6@hisilicon.com +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index cf89a8db4f64c..8d0b63d4b50a6 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -763,7 +763,7 @@ static int hns_roce_register_device(struct hns_roce_dev *hr_dev) + if (ret) + return ret; + } +- dma_set_max_seg_size(dev, UINT_MAX); ++ dma_set_max_seg_size(dev, SZ_2G); + ret = ib_register_device(ib_dev, "hns_%d", dev); + if (ret) { + dev_err(dev, "ib_register_device failed!\n"); +-- +2.39.5 + diff --git a/queue-6.14/rdma-usnic-fix-passing-zero-to-ptr_err-in-usnic_ib_p.patch b/queue-6.14/rdma-usnic-fix-passing-zero-to-ptr_err-in-usnic_ib_p.patch new file mode 100644 index 0000000000..7913fde5d0 --- /dev/null +++ b/queue-6.14/rdma-usnic-fix-passing-zero-to-ptr_err-in-usnic_ib_p.patch @@ -0,0 +1,68 @@ +From 7590fe30130a98aec8e35bed3ede5a4201d2a2f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 20:31:32 +0800 +Subject: RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() + +From: Yue Haibing + +[ Upstream commit 95ba3850fed03e01b422ab5d7943aeba130c9723 ] + +drivers/infiniband/hw/usnic/usnic_ib_main.c:590 + usnic_ib_pci_probe() warn: passing zero to 'PTR_ERR' + +Make usnic_ib_device_add() return NULL on fail path, also remove +useless NULL check for usnic_ib_discover_pf() + +Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver") +Link: https://patch.msgid.link/r/20250324123132.2392077-1-yuehaibing@huawei.com +Signed-off-by: Yue Haibing +Reviewed-by: Zhu Yanjun +Reviewed-by: Jason Gunthorpe +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/usnic/usnic_ib_main.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/usnic/usnic_ib_main.c b/drivers/infiniband/hw/usnic/usnic_ib_main.c +index 4ddcd5860e0fa..11eca39b73a93 100644 +--- a/drivers/infiniband/hw/usnic/usnic_ib_main.c ++++ b/drivers/infiniband/hw/usnic/usnic_ib_main.c +@@ -397,7 +397,7 @@ static void *usnic_ib_device_add(struct pci_dev *dev) + if (!us_ibdev) { + usnic_err("Device %s context alloc failed\n", + netdev_name(pci_get_drvdata(dev))); +- return ERR_PTR(-EFAULT); ++ return NULL; + } + + us_ibdev->ufdev = usnic_fwd_dev_alloc(dev); +@@ -517,8 +517,8 @@ static struct usnic_ib_dev *usnic_ib_discover_pf(struct usnic_vnic *vnic) + } + + us_ibdev = usnic_ib_device_add(parent_pci); +- if (IS_ERR_OR_NULL(us_ibdev)) { +- us_ibdev = us_ibdev ? us_ibdev : ERR_PTR(-EFAULT); ++ if (!us_ibdev) { ++ us_ibdev = ERR_PTR(-EFAULT); + goto out; + } + +@@ -586,10 +586,10 @@ static int usnic_ib_pci_probe(struct pci_dev *pdev, + } + + pf = usnic_ib_discover_pf(vf->vnic); +- if (IS_ERR_OR_NULL(pf)) { +- usnic_err("Failed to discover pf of vnic %s with err%ld\n", +- pci_name(pdev), PTR_ERR(pf)); +- err = pf ? PTR_ERR(pf) : -EFAULT; ++ if (IS_ERR(pf)) { ++ err = PTR_ERR(pf); ++ usnic_err("Failed to discover pf of vnic %s with err%d\n", ++ pci_name(pdev), err); + goto out_clean_vnic; + } + +-- +2.39.5 + diff --git a/queue-6.14/revert-wifi-mac80211-update-skb-s-control-block-key-.patch b/queue-6.14/revert-wifi-mac80211-update-skb-s-control-block-key-.patch new file mode 100644 index 0000000000..2d95646f7e --- /dev/null +++ b/queue-6.14/revert-wifi-mac80211-update-skb-s-control-block-key-.patch @@ -0,0 +1,41 @@ +From df1e03482054f4139443648396c4138744b78889 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 16:13:34 +0200 +Subject: Revert "wifi: mac80211: Update skb's control block key in + ieee80211_tx_dequeue()" + +From: Johannes Berg + +[ Upstream commit 0937cb5f345c79d702b4d0d744e2a2529b551cb2 ] + +This reverts commit a104042e2bf6528199adb6ca901efe7b60c2c27f. + +Since the original bug seems to have been around for years, +but a new issue was report with the fix, revert the fix for +now. We have a couple of weeks to figure it out for this +release, if needed. + +Reported-by: Bert Karwatzki +Closes: https://lore.kernel.org/linux-wireless/20250410215527.3001-1-spasswolf@web.de +Fixes: a104042e2bf6 ("wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()") +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/tx.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 0c6214f12ea39..a24636bda6793 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -3893,7 +3893,6 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, + * The key can be removed while the packet was queued, so need to call + * this here to get the current key. + */ +- info->control.hw_key = NULL; + r = ieee80211_tx_h_select_key(&tx); + if (r != TX_CONTINUE) { + ieee80211_free_txskb(&local->hw, skb); +-- +2.39.5 + diff --git a/queue-6.14/riscv-kgdb-do-not-inline-arch_kgdb_breakpoint.patch b/queue-6.14/riscv-kgdb-do-not-inline-arch_kgdb_breakpoint.patch new file mode 100644 index 0000000000..600bbc03c0 --- /dev/null +++ b/queue-6.14/riscv-kgdb-do-not-inline-arch_kgdb_breakpoint.patch @@ -0,0 +1,80 @@ +From c61630eb25ccdcfe58150b3a94ac2934081fa274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 15:32:21 +0800 +Subject: riscv: KGDB: Do not inline arch_kgdb_breakpoint() + +From: WangYuli + +[ Upstream commit 3af4bec9c1db3f003be4d5ae09b6a737e4be1612 ] + +The arch_kgdb_breakpoint() function defines the kgdb_compiled_break +symbol using inline assembly. + +There's a potential issue where the compiler might inline +arch_kgdb_breakpoint(), which would then define the kgdb_compiled_break +symbol multiple times, leading to fail to link vmlinux.o. + +This isn't merely a potential compilation problem. The intent here +is to determine the global symbol address of kgdb_compiled_break, +and if this function is inlined multiple times, it would logically +be a grave error. + +Link: https://lore.kernel.org/all/4b4187c1-77e5-44b7-885f-d6826723dd9a@sifive.com/ +Link: https://lore.kernel.org/all/5b0adf9b-2b22-43fe-ab74-68df94115b9a@ghiti.fr/ +Link: https://lore.kernel.org/all/23693e7f-4fff-40f3-a437-e06d827278a5@ghiti.fr/ +Fixes: fe89bd2be866 ("riscv: Add KGDB support") +Co-developed-by: Huacai Chen +Signed-off-by: Huacai Chen +Signed-off-by: WangYuli +Link: https://lore.kernel.org/r/F22359AFB6FF9FD8+20250411073222.56820-1-wangyuli@uniontech.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/kgdb.h | 9 +-------- + arch/riscv/kernel/kgdb.c | 8 ++++++++ + 2 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/arch/riscv/include/asm/kgdb.h b/arch/riscv/include/asm/kgdb.h +index 46677daf708bd..cc11c4544cffd 100644 +--- a/arch/riscv/include/asm/kgdb.h ++++ b/arch/riscv/include/asm/kgdb.h +@@ -19,16 +19,9 @@ + + #ifndef __ASSEMBLY__ + ++void arch_kgdb_breakpoint(void); + extern unsigned long kgdb_compiled_break; + +-static inline void arch_kgdb_breakpoint(void) +-{ +- asm(".global kgdb_compiled_break\n" +- ".option norvc\n" +- "kgdb_compiled_break: ebreak\n" +- ".option rvc\n"); +-} +- + #endif /* !__ASSEMBLY__ */ + + #define DBG_REG_ZERO "zero" +diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c +index 2e0266ae6bd72..5d1ce8dacaf58 100644 +--- a/arch/riscv/kernel/kgdb.c ++++ b/arch/riscv/kernel/kgdb.c +@@ -254,6 +254,14 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc) + regs->epc = pc; + } + ++noinline void arch_kgdb_breakpoint(void) ++{ ++ asm(".global kgdb_compiled_break\n" ++ ".option norvc\n" ++ "kgdb_compiled_break: ebreak\n" ++ ".option rvc\n"); ++} ++ + void kgdb_arch_handle_qxfer_pkt(char *remcom_in_buffer, + char *remcom_out_buffer) + { +-- +2.39.5 + diff --git a/queue-6.14/riscv-kgdb-remove-.option-norvc-.option-rvc-for-kgdb.patch b/queue-6.14/riscv-kgdb-remove-.option-norvc-.option-rvc-for-kgdb.patch new file mode 100644 index 0000000000..43a3b1961b --- /dev/null +++ b/queue-6.14/riscv-kgdb-remove-.option-norvc-.option-rvc-for-kgdb.patch @@ -0,0 +1,64 @@ +From 7874434fd0227829bd5596437f9b54afbe6c1378 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 15:32:22 +0800 +Subject: riscv: KGDB: Remove ".option norvc/.option rvc" for + kgdb_compiled_break + +From: WangYuli + +[ Upstream commit 550c2aa787d1b06efcb11de1877354502a1237f2 ] + +[ Quoting Samuel Holland: ] + + This is a separate issue, but using ".option rvc" here is a bug. + It will unconditionally enable the C extension for the rest of + the file, even if the kernel is being built with CONFIG_RISCV_ISA_C=n. + +[ Quoting Palmer Dabbelt: ] + + We're just looking at the address of kgdb_compiled_break, so it's + fine if it ends up as a c.ebreak. + +[ Quoting Alexandre Ghiti: ] + + .option norvc is used to prevent the assembler from using compressed + instructions, but it's generally used when we need to ensure the + size of the instructions that are used, which is not the case here + as noted by Palmer since we only care about the address. So yes + it will work fine with C enabled :) + +So let's just remove them all. + +Link: https://lore.kernel.org/all/4b4187c1-77e5-44b7-885f-d6826723dd9a@sifive.com/ +Link: https://lore.kernel.org/all/mhng-69513841-5068-441d-be8f-2aeebdc56a08@palmer-ri-x1c9a/ +Link: https://lore.kernel.org/all/23693e7f-4fff-40f3-a437-e06d827278a5@ghiti.fr/ +Fixes: fe89bd2be866 ("riscv: Add KGDB support") +Cc: Samuel Holland +Cc: Palmer Dabbelt +Cc: Alexandre Ghiti +Signed-off-by: WangYuli +Link: https://lore.kernel.org/r/8B431C6A4626225C+20250411073222.56820-2-wangyuli@uniontech.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/kgdb.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c +index 5d1ce8dacaf58..9f3db3503dabd 100644 +--- a/arch/riscv/kernel/kgdb.c ++++ b/arch/riscv/kernel/kgdb.c +@@ -257,9 +257,7 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc) + noinline void arch_kgdb_breakpoint(void) + { + asm(".global kgdb_compiled_break\n" +- ".option norvc\n" +- "kgdb_compiled_break: ebreak\n" +- ".option rvc\n"); ++ "kgdb_compiled_break: ebreak\n"); + } + + void kgdb_arch_handle_qxfer_pkt(char *remcom_in_buffer, +-- +2.39.5 + diff --git a/queue-6.14/riscv-module-allocate-plt-entries-for-r_riscv_plt32.patch b/queue-6.14/riscv-module-allocate-plt-entries-for-r_riscv_plt32.patch new file mode 100644 index 0000000000..477e208d9b --- /dev/null +++ b/queue-6.14/riscv-module-allocate-plt-entries-for-r_riscv_plt32.patch @@ -0,0 +1,53 @@ +From 920b4c0cf1a64ff3692d5746cf12bb37eda692e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 10:14:50 -0700 +Subject: riscv: module: Allocate PLT entries for R_RISCV_PLT32 + +From: Samuel Holland + +[ Upstream commit 1ee1313f4722e6d67c6e9447ee81d24d6e3ff4ad ] + +apply_r_riscv_plt32_rela() may need to emit a PLT entry for the +referenced symbol, so there must be space allocated in the PLT. + +Fixes: 8fd6c5142395 ("riscv: Add remaining module relocations") +Signed-off-by: Samuel Holland +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20250409171526.862481-2-samuel.holland@sifive.com +Signed-off-by: Alexandre Ghiti +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/module-sections.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/arch/riscv/kernel/module-sections.c b/arch/riscv/kernel/module-sections.c +index e264e59e596e8..91d0b355ceeff 100644 +--- a/arch/riscv/kernel/module-sections.c ++++ b/arch/riscv/kernel/module-sections.c +@@ -73,16 +73,17 @@ static bool duplicate_rela(const Elf_Rela *rela, int idx) + static void count_max_entries(Elf_Rela *relas, int num, + unsigned int *plts, unsigned int *gots) + { +- unsigned int type, i; +- +- for (i = 0; i < num; i++) { +- type = ELF_RISCV_R_TYPE(relas[i].r_info); +- if (type == R_RISCV_CALL_PLT) { ++ for (int i = 0; i < num; i++) { ++ switch (ELF_R_TYPE(relas[i].r_info)) { ++ case R_RISCV_CALL_PLT: ++ case R_RISCV_PLT32: + if (!duplicate_rela(relas, i)) + (*plts)++; +- } else if (type == R_RISCV_GOT_HI20) { ++ break; ++ case R_RISCV_GOT_HI20: + if (!duplicate_rela(relas, i)) + (*gots)++; ++ break; + } + } + } +-- +2.39.5 + diff --git a/queue-6.14/riscv-module-fix-out-of-bounds-relocation-access.patch b/queue-6.14/riscv-module-fix-out-of-bounds-relocation-access.patch new file mode 100644 index 0000000000..954ca7c133 --- /dev/null +++ b/queue-6.14/riscv-module-fix-out-of-bounds-relocation-access.patch @@ -0,0 +1,40 @@ +From ca503dbfb51a5ed79c8baa5879f15c971a84f767 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 10:14:49 -0700 +Subject: riscv: module: Fix out-of-bounds relocation access + +From: Samuel Holland + +[ Upstream commit 0b4cce68efb93e31a8e51795d696df6e379cb41c ] + +The current code allows rel[j] to access one element past the end of the +relocation section. Simplify to num_relocations which is equivalent to +the existing size expression. + +Fixes: 080c4324fa5e ("riscv: optimize ELF relocation function in riscv") +Signed-off-by: Samuel Holland +Reviewed-by: Maxim Kochetkov +Reviewed-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20250409171526.862481-1-samuel.holland@sifive.com +Signed-off-by: Alexandre Ghiti +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/module.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c +index 0ae34d79b87bd..7f6147c18033b 100644 +--- a/arch/riscv/kernel/module.c ++++ b/arch/riscv/kernel/module.c +@@ -860,7 +860,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, + } + + j++; +- if (j > sechdrs[relsec].sh_size / sizeof(*rel)) ++ if (j == num_relocations) + j = 0; + + } while (j_idx != j); +-- +2.39.5 + diff --git a/queue-6.14/riscv-properly-export-reserved-regions-in-proc-iomem.patch b/queue-6.14/riscv-properly-export-reserved-regions-in-proc-iomem.patch new file mode 100644 index 0000000000..236a701c72 --- /dev/null +++ b/queue-6.14/riscv-properly-export-reserved-regions-in-proc-iomem.patch @@ -0,0 +1,120 @@ +From 2e92f7507fd7b194d20b566ca11573cede698d55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 20:21:27 +0200 +Subject: riscv: Properly export reserved regions in /proc/iomem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit e94eb7ea6f206e229791761a5fdf9389f8dbd183 ] + +The /proc/iomem represents the kernel's memory map. Regions marked +with "Reserved" tells the user that the range should not be tampered +with. Kexec-tools, when using the older kexec_load syscall relies on +the "Reserved" regions to build the memory segments, that will be the +target of the new kexec'd kernel. + +The RISC-V port tries to expose all reserved regions to userland, but +some regions were not properly exposed: Regions that resided in both +the "regular" and reserved memory block, e.g. the EFI Memory Map. A +missing entry could result in reserved memory being overwritten. + +It turns out, that arm64, and loongarch had a similar issue a while +back: + + commit d91680e687f4 ("arm64: Fix /proc/iomem for reserved but not memory regions") + commit 50d7ba36b916 ("arm64: export memblock_reserve()d regions via /proc/iomem") + +Similar to the other ports, resolve the issue by splitting the regions +in an arch initcall, since we need a working allocator. + +Fixes: ffe0e5261268 ("RISC-V: Improve init_resources()") +Signed-off-by: Björn Töpel +Reviewed-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20250409182129.634415-1-bjorn@kernel.org +Signed-off-by: Alexandre Ghiti +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/setup.c | 36 +++++++++++++++++++++++++++++++++++- + 1 file changed, 35 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c +index 4fe45daa6281e..b7d0bd4c0a81a 100644 +--- a/arch/riscv/kernel/setup.c ++++ b/arch/riscv/kernel/setup.c +@@ -66,6 +66,9 @@ static struct resource bss_res = { .name = "Kernel bss", }; + static struct resource elfcorehdr_res = { .name = "ELF Core hdr", }; + #endif + ++static int num_standard_resources; ++static struct resource *standard_resources; ++ + static int __init add_resource(struct resource *parent, + struct resource *res) + { +@@ -139,7 +142,7 @@ static void __init init_resources(void) + struct resource *res = NULL; + struct resource *mem_res = NULL; + size_t mem_res_sz = 0; +- int num_resources = 0, res_idx = 0; ++ int num_resources = 0, res_idx = 0, non_resv_res = 0; + int ret = 0; + + /* + 1 as memblock_alloc() might increase memblock.reserved.cnt */ +@@ -193,6 +196,7 @@ static void __init init_resources(void) + /* Add /memory regions to the resource tree */ + for_each_mem_region(region) { + res = &mem_res[res_idx--]; ++ non_resv_res++; + + if (unlikely(memblock_is_nomap(region))) { + res->name = "Reserved"; +@@ -210,6 +214,9 @@ static void __init init_resources(void) + goto error; + } + ++ num_standard_resources = non_resv_res; ++ standard_resources = &mem_res[res_idx + 1]; ++ + /* Clean-up any unused pre-allocated resources */ + if (res_idx >= 0) + memblock_free(mem_res, (res_idx + 1) * sizeof(*mem_res)); +@@ -221,6 +228,33 @@ static void __init init_resources(void) + memblock_free(mem_res, mem_res_sz); + } + ++static int __init reserve_memblock_reserved_regions(void) ++{ ++ u64 i, j; ++ ++ for (i = 0; i < num_standard_resources; i++) { ++ struct resource *mem = &standard_resources[i]; ++ phys_addr_t r_start, r_end, mem_size = resource_size(mem); ++ ++ if (!memblock_is_region_reserved(mem->start, mem_size)) ++ continue; ++ ++ for_each_reserved_mem_range(j, &r_start, &r_end) { ++ resource_size_t start, end; ++ ++ start = max(PFN_PHYS(PFN_DOWN(r_start)), mem->start); ++ end = min(PFN_PHYS(PFN_UP(r_end)) - 1, mem->end); ++ ++ if (start > mem->end || end < mem->start) ++ continue; ++ ++ reserve_region_with_split(mem, start, end, "Reserved"); ++ } ++ } ++ ++ return 0; ++} ++arch_initcall(reserve_memblock_reserved_regions); + + static void __init parse_dtb(void) + { +-- +2.39.5 + diff --git a/queue-6.14/riscv-use-kvmalloc_array-on-relocation_hashtable.patch b/queue-6.14/riscv-use-kvmalloc_array-on-relocation_hashtable.patch new file mode 100644 index 0000000000..5b5a24cfac --- /dev/null +++ b/queue-6.14/riscv-use-kvmalloc_array-on-relocation_hashtable.patch @@ -0,0 +1,56 @@ +From 16aa4c7d73bdbe9a634b0461c9d658e13850ef50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 01:14:26 -0700 +Subject: riscv: Use kvmalloc_array on relocation_hashtable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Will Pierce + +[ Upstream commit 8578b2f7e1fb79d4b92b62fbbe913548bb363654 ] + +The number of relocations may be a huge value that is unallocatable +by kmalloc. Use kvmalloc instead so that it does not fail. + +Fixes: 8fd6c5142395 ("riscv: Add remaining module relocations") +Suggested-by: Clément Léger +Reviewed-by: Alexandre Ghiti +Signed-off-by: Will Pierce +Link: https://lore.kernel.org/r/20250402081426.5197-1-wgpierce17@gmail.com +Signed-off-by: Alexandre Ghiti +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/module.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c +index 47d0ebeec93c2..0ae34d79b87bd 100644 +--- a/arch/riscv/kernel/module.c ++++ b/arch/riscv/kernel/module.c +@@ -648,7 +648,7 @@ process_accumulated_relocations(struct module *me, + kfree(bucket_iter); + } + +- kfree(*relocation_hashtable); ++ kvfree(*relocation_hashtable); + } + + static int add_relocation_to_accumulate(struct module *me, int type, +@@ -752,9 +752,10 @@ initialize_relocation_hashtable(unsigned int num_relocations, + + hashtable_size <<= should_double_size; + +- *relocation_hashtable = kmalloc_array(hashtable_size, +- sizeof(**relocation_hashtable), +- GFP_KERNEL); ++ /* Number of relocations may be large, so kvmalloc it */ ++ *relocation_hashtable = kvmalloc_array(hashtable_size, ++ sizeof(**relocation_hashtable), ++ GFP_KERNEL); + if (!*relocation_hashtable) + return 0; + +-- +2.39.5 + diff --git a/queue-6.14/scsi-hisi_sas-enable-force-phy-when-sata-disk-direct.patch b/queue-6.14/scsi-hisi_sas-enable-force-phy-when-sata-disk-direct.patch new file mode 100644 index 0000000000..c7b89b3fce --- /dev/null +++ b/queue-6.14/scsi-hisi_sas-enable-force-phy-when-sata-disk-direct.patch @@ -0,0 +1,102 @@ +From def9221e527151f1f2797df4d01a41e26b607354 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 17:51:34 +0800 +Subject: scsi: hisi_sas: Enable force phy when SATA disk directly connected + +From: Xingui Yang + +[ Upstream commit 8aa580cd92843b60d4d6331f3b0a9e8409bb70eb ] + +when a SATA disk is directly connected the SAS controller determines the +disk to which I/Os are delivered based on the port ID in the DQ entry. + +When many phys are disconnected and reconnect, the port ID of phys were +changed and used by other link, resulting in I/O being sent to incorrect +disk. Data inconsistency on the SATA disk may occur during I/O retries +using the old port ID. So enable force phy, then force the command to be +executed in a certain phy, and if the actual phy ID of the port does not +match the phy configured in the command, the chip will stop delivering the +I/O to disk. + +Fixes: ce60689e12dd ("scsi: hisi_sas: add v3 code to send ATA frame") +Signed-off-by: Xingui Yang +Link: https://lore.kernel.org/r/20250312095135.3048379-2-yangxingui@huawei.com +Reviewed-by: Yihang Li +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 9 +++++++-- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 14 ++++++++++++-- + 2 files changed, 19 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +index 6e7f99fcc8247..3af991cad07eb 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +@@ -2501,6 +2501,7 @@ static void prep_ata_v2_hw(struct hisi_hba *hisi_hba, + struct hisi_sas_port *port = to_hisi_sas_port(sas_port); + struct sas_ata_task *ata_task = &task->ata_task; + struct sas_tmf_task *tmf = slot->tmf; ++ int phy_id; + u8 *buf_cmd; + int has_data = 0, hdr_tag = 0; + u32 dw0, dw1 = 0, dw2 = 0; +@@ -2508,10 +2509,14 @@ static void prep_ata_v2_hw(struct hisi_hba *hisi_hba, + /* create header */ + /* dw0 */ + dw0 = port->id << CMD_HDR_PORT_OFF; +- if (parent_dev && dev_is_expander(parent_dev->dev_type)) ++ if (parent_dev && dev_is_expander(parent_dev->dev_type)) { + dw0 |= 3 << CMD_HDR_CMD_OFF; +- else ++ } else { ++ phy_id = device->phy->identify.phy_identifier; ++ dw0 |= (1U << phy_id) << CMD_HDR_PHY_ID_OFF; ++ dw0 |= CMD_HDR_FORCE_PHY_MSK; + dw0 |= 4 << CMD_HDR_CMD_OFF; ++ } + + if (tmf && ata_task->force_phy) { + dw0 |= CMD_HDR_FORCE_PHY_MSK; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 095bbf80c34ef..6a0656f3b596c 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -359,6 +359,10 @@ + #define CMD_HDR_RESP_REPORT_MSK (0x1 << CMD_HDR_RESP_REPORT_OFF) + #define CMD_HDR_TLR_CTRL_OFF 6 + #define CMD_HDR_TLR_CTRL_MSK (0x3 << CMD_HDR_TLR_CTRL_OFF) ++#define CMD_HDR_PHY_ID_OFF 8 ++#define CMD_HDR_PHY_ID_MSK (0x1ff << CMD_HDR_PHY_ID_OFF) ++#define CMD_HDR_FORCE_PHY_OFF 17 ++#define CMD_HDR_FORCE_PHY_MSK (0x1U << CMD_HDR_FORCE_PHY_OFF) + #define CMD_HDR_PORT_OFF 18 + #define CMD_HDR_PORT_MSK (0xf << CMD_HDR_PORT_OFF) + #define CMD_HDR_PRIORITY_OFF 27 +@@ -1429,15 +1433,21 @@ static void prep_ata_v3_hw(struct hisi_hba *hisi_hba, + struct hisi_sas_cmd_hdr *hdr = slot->cmd_hdr; + struct asd_sas_port *sas_port = device->port; + struct hisi_sas_port *port = to_hisi_sas_port(sas_port); ++ int phy_id; + u8 *buf_cmd; + int has_data = 0, hdr_tag = 0; + u32 dw1 = 0, dw2 = 0; + + hdr->dw0 = cpu_to_le32(port->id << CMD_HDR_PORT_OFF); +- if (parent_dev && dev_is_expander(parent_dev->dev_type)) ++ if (parent_dev && dev_is_expander(parent_dev->dev_type)) { + hdr->dw0 |= cpu_to_le32(3 << CMD_HDR_CMD_OFF); +- else ++ } else { ++ phy_id = device->phy->identify.phy_identifier; ++ hdr->dw0 |= cpu_to_le32((1U << phy_id) ++ << CMD_HDR_PHY_ID_OFF); ++ hdr->dw0 |= CMD_HDR_FORCE_PHY_MSK; + hdr->dw0 |= cpu_to_le32(4U << CMD_HDR_CMD_OFF); ++ } + + switch (task->data_dir) { + case DMA_TO_DEVICE: +-- +2.39.5 + diff --git a/queue-6.14/scsi-iscsi-fix-missing-scsi_host_put-in-error-path.patch b/queue-6.14/scsi-iscsi-fix-missing-scsi_host_put-in-error-path.patch new file mode 100644 index 0000000000..11ed92daa4 --- /dev/null +++ b/queue-6.14/scsi-iscsi-fix-missing-scsi_host_put-in-error-path.patch @@ -0,0 +1,47 @@ +From 459b4476bb948e02275935050b6ad73e4e2b0907 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Mar 2025 17:43:43 +0800 +Subject: scsi: iscsi: Fix missing scsi_host_put() in error path + +From: Miaoqian Lin + +[ Upstream commit 72eea84a1092b50a10eeecfeba4b28ac9f1312ab ] + +Add goto to ensure scsi_host_put() is called in all error paths of +iscsi_set_host_param() function. This fixes a potential memory leak when +strlen() check fails. + +Fixes: ce51c8170084 ("scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20250318094344.91776-1-linmq006@gmail.com +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 9c347c64c315f..0b8c91bf793fc 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -3182,11 +3182,14 @@ iscsi_set_host_param(struct iscsi_transport *transport, + } + + /* see similar check in iscsi_if_set_param() */ +- if (strlen(data) > ev->u.set_host_param.len) +- return -EINVAL; ++ if (strlen(data) > ev->u.set_host_param.len) { ++ err = -EINVAL; ++ goto out; ++ } + + err = transport->set_host_param(shost, ev->u.set_host_param.param, + data, ev->u.set_host_param.len); ++out: + scsi_host_put(shost); + return err; + } +-- +2.39.5 + diff --git a/queue-6.14/scsi-smartpqi-use-is_kdump_kernel-to-check-for-kdump.patch b/queue-6.14/scsi-smartpqi-use-is_kdump_kernel-to-check-for-kdump.patch new file mode 100644 index 0000000000..ef923b483a --- /dev/null +++ b/queue-6.14/scsi-smartpqi-use-is_kdump_kernel-to-check-for-kdump.patch @@ -0,0 +1,98 @@ +From 727acfdc935d2e355464f7aa51eb180c16bc7cf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Mar 2025 23:33:19 +0100 +Subject: scsi: smartpqi: Use is_kdump_kernel() to check for kdump + +From: Martin Wilck + +[ Upstream commit a2d5a0072235a69749ceb04c1a26dc75df66a31a ] + +The smartpqi driver checks the reset_devices variable to determine +whether special adjustments need to be made for kdump. This has the +effect that after a regular kexec reboot, some driver parameters such as +max_transfer_size are much lower than usual. More importantly, kexec +reboot tests have revealed memory corruption caused by the driver log +being written to system memory after a kexec. + +Fix this by testing is_kdump_kernel() rather than reset_devices where +appropriate. + +Fixes: 058311b72f54 ("scsi: smartpqi: Add fw log to kdump") +Signed-off-by: Martin Wilck +Link: https://lore.kernel.org/r/20250321223319.109250-1-mwilck@suse.com +Cc: Randy Wright +Acked-by: Don Brace +Tested-by: Don Brace +Reviewed-by: Lee Duncan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 0da7be40c9258..e790b5d4e3c70 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -5246,7 +5247,7 @@ static void pqi_calculate_io_resources(struct pqi_ctrl_info *ctrl_info) + ctrl_info->error_buffer_length = + ctrl_info->max_io_slots * PQI_ERROR_BUFFER_ELEMENT_LENGTH; + +- if (reset_devices) ++ if (is_kdump_kernel()) + max_transfer_size = min(ctrl_info->max_transfer_size, + PQI_MAX_TRANSFER_SIZE_KDUMP); + else +@@ -5275,7 +5276,7 @@ static void pqi_calculate_queue_resources(struct pqi_ctrl_info *ctrl_info) + u16 num_elements_per_iq; + u16 num_elements_per_oq; + +- if (reset_devices) { ++ if (is_kdump_kernel()) { + num_queue_groups = 1; + } else { + int num_cpus; +@@ -8288,12 +8289,12 @@ static int pqi_ctrl_init(struct pqi_ctrl_info *ctrl_info) + u32 product_id; + + if (reset_devices) { +- if (pqi_is_fw_triage_supported(ctrl_info)) { ++ if (is_kdump_kernel() && pqi_is_fw_triage_supported(ctrl_info)) { + rc = sis_wait_for_fw_triage_completion(ctrl_info); + if (rc) + return rc; + } +- if (sis_is_ctrl_logging_supported(ctrl_info)) { ++ if (is_kdump_kernel() && sis_is_ctrl_logging_supported(ctrl_info)) { + sis_notify_kdump(ctrl_info); + rc = sis_wait_for_ctrl_logging_completion(ctrl_info); + if (rc) +@@ -8344,7 +8345,7 @@ static int pqi_ctrl_init(struct pqi_ctrl_info *ctrl_info) + ctrl_info->product_id = (u8)product_id; + ctrl_info->product_revision = (u8)(product_id >> 8); + +- if (reset_devices) { ++ if (is_kdump_kernel()) { + if (ctrl_info->max_outstanding_requests > + PQI_MAX_OUTSTANDING_REQUESTS_KDUMP) + ctrl_info->max_outstanding_requests = +@@ -8480,7 +8481,7 @@ static int pqi_ctrl_init(struct pqi_ctrl_info *ctrl_info) + if (rc) + return rc; + +- if (ctrl_info->ctrl_logging_supported && !reset_devices) { ++ if (ctrl_info->ctrl_logging_supported && !is_kdump_kernel()) { + pqi_host_setup_buffer(ctrl_info, &ctrl_info->ctrl_log_memory, PQI_CTRL_LOG_TOTAL_SIZE, PQI_CTRL_LOG_MIN_SIZE); + pqi_host_memory_update(ctrl_info, &ctrl_info->ctrl_log_memory, PQI_VENDOR_GENERAL_CTRL_LOG_MEMORY_UPDATE); + } +-- +2.39.5 + diff --git a/queue-6.14/selftests-mincore-fix-tmpfs-mincore-test-failure.patch b/queue-6.14/selftests-mincore-fix-tmpfs-mincore-test-failure.patch new file mode 100644 index 0000000000..b57214eaef --- /dev/null +++ b/queue-6.14/selftests-mincore-fix-tmpfs-mincore-test-failure.patch @@ -0,0 +1,95 @@ +From eb1b62213c3192958227ae07d791bad7c050b807 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 19:31:35 +0800 +Subject: selftests: mincore: fix tmpfs mincore test failure + +From: Baolin Wang + +[ Upstream commit 8c583e538aa681ecb293d5606054de70f44b5558 ] + +When running mincore test cases, I encountered the following failures: + +" +mincore_selftest.c:359:check_tmpfs_mmap:Expected ra_pages (511) == 0 (0) +mincore_selftest.c:360:check_tmpfs_mmap:Read-ahead pages found in memory +check_tmpfs_mmap: Test terminated by assertion + FAIL global.check_tmpfs_mmap +not ok 5 global.check_tmpfs_mmap +FAILED: 4 / 5 tests passed +" + +The reason for the test case failure is that my system automatically enabled +tmpfs large folio allocation by adding the 'transparent_hugepage_tmpfs=always' +cmdline. However, the test case still expects the tmpfs mounted on /dev/shm to +allocate small folios, which leads to assertion failures when verifying readahead +pages. + +As discussed with David, there's no reason to continue checking the readahead +logic for tmpfs. Drop it to fix this issue. + +Link: https://lkml.kernel.org/r/9a00856cc6a8b4e46f4ab8b1af11ce5fc1a31851.1744025467.git.baolin.wang@linux.alibaba.com +Fixes: d635ccdb435c ("mm: shmem: add a kernel command line to change the default huge policy for tmpfs") +Signed-off-by: Baolin Wang +Acked-by: Zi Yan +Acked-by: David Hildenbrand +Cc: Barry Song <21cnbao@gmail.com> +Cc: Hugh Dickins +Cc: Matthew Wilcox (Oracle) +Cc: Ryan Roberts +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + .../testing/selftests/mincore/mincore_selftest.c | 16 ++-------------- + 1 file changed, 2 insertions(+), 14 deletions(-) + +diff --git a/tools/testing/selftests/mincore/mincore_selftest.c b/tools/testing/selftests/mincore/mincore_selftest.c +index e949a43a61450..0fd4b00bd345b 100644 +--- a/tools/testing/selftests/mincore/mincore_selftest.c ++++ b/tools/testing/selftests/mincore/mincore_selftest.c +@@ -286,8 +286,7 @@ TEST(check_file_mmap) + + /* + * Test mincore() behavior on a page backed by a tmpfs file. This test +- * performs the same steps as the previous one. However, we don't expect +- * any readahead in this case. ++ * performs the same steps as the previous one. + */ + TEST(check_tmpfs_mmap) + { +@@ -298,7 +297,6 @@ TEST(check_tmpfs_mmap) + int page_size; + int fd; + int i; +- int ra_pages = 0; + + page_size = sysconf(_SC_PAGESIZE); + vec_size = FILE_SIZE / page_size; +@@ -341,8 +339,7 @@ TEST(check_tmpfs_mmap) + } + + /* +- * Touch a page in the middle of the mapping. We expect only +- * that page to be fetched into memory. ++ * Touch a page in the middle of the mapping. + */ + addr[FILE_SIZE / 2] = 1; + retval = mincore(addr, FILE_SIZE, vec); +@@ -351,15 +348,6 @@ TEST(check_tmpfs_mmap) + TH_LOG("Page not found in memory after use"); + } + +- i = FILE_SIZE / 2 / page_size + 1; +- while (i < vec_size && vec[i]) { +- ra_pages++; +- i++; +- } +- ASSERT_EQ(ra_pages, 0) { +- TH_LOG("Read-ahead pages found in memory"); +- } +- + munmap(addr, FILE_SIZE); + close(fd); + free(vec); +-- +2.39.5 + diff --git a/queue-6.14/series b/queue-6.14/series new file mode 100644 index 0000000000..5ead7f0923 --- /dev/null +++ b/queue-6.14/series @@ -0,0 +1,95 @@ +scsi-hisi_sas-enable-force-phy-when-sata-disk-direct.patch +wifi-at76c50x-fix-use-after-free-access-in-at76_disc.patch +wifi-mac80211-update-skb-s-control-block-key-in-ieee.patch +wifi-mac80211-purge-vif-txq-in-ieee80211_do_stop.patch +wifi-brcmfmac-fix-memory-leak-in-brcmf_get_module_pa.patch +wifi-wl1251-fix-memory-leak-in-wl1251_tx_work.patch +scsi-iscsi-fix-missing-scsi_host_put-in-error-path.patch +scsi-smartpqi-use-is_kdump_kernel-to-check-for-kdump.patch +md-raid10-fix-missing-discard-io-accounting.patch +md-md-bitmap-fix-stats-collection-for-external-bitma.patch +asoc-dwc-always-enable-disable-i2s-irqs.patch +asoc-intel-avs-fix-null-ptr-deref-in-avs_component_p.patch +crypto-tegra-fix-iv-usage-for-aes-ecb.patch +ovl-remove-unused-forward-declaration.patch +rdma-bnxt_re-fix-budget-handling-of-notification-que.patch +rdma-usnic-fix-passing-zero-to-ptr_err-in-usnic_ib_p.patch +rdma-hns-fix-wrong-maximum-dma-segment-size.patch +alsa-hda-cirrus_scodec_test-don-t-select-dependencie.patch +alsa-hda-realtek-fixed-asus-platform-headset-mic-iss.patch +asoc-cs42l43-reset-clamp-override-on-jack-removal.patch +rdma-core-silence-oversized-kvmalloc-warning.patch +firmware-cs_dsp-test_bin_error-fix-uninitialized-dat.patch +bluetooth-hci_event-fix-sending-mgmt_ev_device_found.patch +bluetooth-btrtl-prevent-potential-null-dereference.patch +bluetooth-qca-fix-nv-variant-for-one-of-wcn3950-socs.patch +bluetooth-l2cap-check-encryption-key-size-on-incomin.patch +rdma-bnxt_re-remove-unusable-nq-variable.patch +ipv6-add-exception-routes-to-gc-list-in-rt6_insert_e.patch +xen-fix-multicall-debug-feature.patch +mlxbf-bootctl-use-sysfs_emit_at-in-secure_boot_fuse_.patch +wifi-iwlwifi-pcie-set-state-to-no-fw-before-reset-ha.patch +revert-wifi-mac80211-update-skb-s-control-block-key-.patch +igc-fix-ptm-cycle-trigger-logic.patch +igc-increase-wait-time-before-retrying-ptm.patch +igc-move-ktime-snapshot-into-ptm-retry-loop.patch +igc-handle-the-igc_ptp_enabled-flag-correctly.patch +igc-cleanup-ptp-module-if-probe-fails.patch +igc-add-lock-preventing-multiple-simultaneous-ptm-tr.patch +perf-tools-remove-evsel__handle_error_quirks.patch +dt-bindings-soc-fsl-fsl-ls1028a-reset-fix-maintainer.patch +smc-fix-lockdep-false-positive-for-ipproto_smc.patch +test-suite-use-zu-to-print-size_t.patch +selftests-mincore-fix-tmpfs-mincore-test-failure.patch +pds_core-fix-memory-leak-in-pdsc_debugfs_add_qcq.patch +ethtool-cmis_cdb-use-correct-rpl-size-in-ethtool_cmi.patch +net-mctp-set-sock_rcu_free.patch +net-hibmcge-fix-incorrect-pause-frame-statistics-iss.patch +net-hibmcge-fix-incorrect-multicast-filtering-issue.patch +net-hibmcge-fix-wrong-mtu-log-issue.patch +net-hibmcge-fix-not-restore-rx-pause-mac-addr-after-.patch +block-fix-resource-leak-in-blk_register_queue-error-.patch +netlink-specs-ovs_vport-align-with-c-codegen-capabil.patch +net-openvswitch-fix-nested-key-length-validation-in-.patch +can-rockchip_canfd-fix-broken-quirks-checks.patch +net-ngbe-fix-memory-leak-in-ngbe_probe-error-path.patch +octeontx2-pf-handle-otx2_mbox_get_rsp-errors.patch +net-ethernet-ti-am65-cpsw-fix-port_np-reference-coun.patch +eth-bnxt-fix-missing-ring-index-trim-on-error-path.patch +loop-aio-inherit-the-ioprio-of-original-request.patch +loop-stop-using-vfs_iter_-read-write-for-buffered-i-.patch +nvmet-pci-epf-always-fully-initialize-completion-ent.patch +nvmet-pci-epf-clear-cc-and-csts-when-disabling-the-c.patch +ata-libata-sata-save-all-fields-from-sense-data-desc.patch +cxgb4-fix-memory-leak-in-cxgb4_init_ethtool_filters-.patch +tools-ynl-gen-individually-free-previous-values-on-d.patch +tools-ynl-gen-make-sure-we-validate-subtype-of-array.patch +netlink-specs-rt-link-add-an-attr-layer-around-alt-i.patch +netlink-specs-rtnetlink-attribute-naming-corrections.patch +netlink-specs-rt-link-adjust-mctp-attribute-naming.patch +netlink-specs-rt-neigh-prefix-struct-nfmsg-members-w.patch +net-b53-enable-bpdu-reception-for-management-port.patch +net-bridge-switchdev-do-not-notify-new-brentries-as-.patch +net-txgbe-fix-memory-leak-in-txgbe_probe-error-path.patch +net-dsa-mv88e6xxx-avoid-unregistering-devlink-region.patch +net-dsa-mv88e6xxx-fix-enoent-when-deleting-vlans-and.patch +net-dsa-clean-up-fdb-mdb-vlan-entries-on-unbind.patch +net-dsa-free-routing-table-on-probe-failure.patch +net-dsa-avoid-refcount-warnings-when-ds-ops-tag_8021.patch +ptp-ocp-fix-start-time-alignment-in-ptp_ocp_signal_s.patch +netfilter-conntrack-fix-erronous-removal-of-offload-.patch +net-ti-icss-iep-add-pwidth-configuration-for-perout-.patch +net-ti-icss-iep-add-phase-offset-configuration-for-p.patch +net-ti-icss-iep-fix-possible-null-pointer-dereferenc.patch +net-ethernet-mtk_eth_soc-reapply-mdc-divider-on-rese.patch +net-ethernet-mtk_eth_soc-correct-the-max-weight-of-t.patch +net-ethernet-mtk_eth_soc-revise-qdma-packet-schedule.patch +riscv-use-kvmalloc_array-on-relocation_hashtable.patch +riscv-properly-export-reserved-regions-in-proc-iomem.patch +riscv-module-fix-out-of-bounds-relocation-access.patch +riscv-module-allocate-plt-entries-for-r_riscv_plt32.patch +kunit-qemu_configs-sh-respect-kunit-cmdline.patch +thermal-intel-int340x-fix-panther-lake-dlvr-support.patch +riscv-kgdb-do-not-inline-arch_kgdb_breakpoint.patch +riscv-kgdb-remove-.option-norvc-.option-rvc-for-kgdb.patch +cpufreq-sched-fix-the-usage-of-cpufreq_need_update_l.patch diff --git a/queue-6.14/smc-fix-lockdep-false-positive-for-ipproto_smc.patch b/queue-6.14/smc-fix-lockdep-false-positive-for-ipproto_smc.patch new file mode 100644 index 0000000000..ab43e3cb61 --- /dev/null +++ b/queue-6.14/smc-fix-lockdep-false-positive-for-ipproto_smc.patch @@ -0,0 +1,230 @@ +From 6ff070305ca96875b131da465b48ca04bc099f80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 10:03:17 -0700 +Subject: smc: Fix lockdep false-positive for IPPROTO_SMC. + +From: Kuniyuki Iwashima + +[ Upstream commit 752e2217d789be2c6a6ac66554b981cd71cd9f31 ] + +SMC consists of two sockets: smc_sock and kernel TCP socket. + +Currently, there are two ways of creating the sockets, and syzbot reported +a lockdep splat [0] for the newer way introduced by commit d25a92ccae6b +("net/smc: Introduce IPPROTO_SMC"). + + socket(AF_SMC , SOCK_STREAM, SMCPROTO_SMC or SMCPROTO_SMC6) + socket(AF_INET or AF_INET6, SOCK_STREAM, IPPROTO_SMC) + +When a socket is allocated, sock_lock_init() sets a lockdep lock class to +sk->sk_lock.slock based on its protocol family. In the IPPROTO_SMC case, +AF_INET or AF_INET6 lock class is assigned to smc_sock. + +The repro sets IPV6_JOIN_ANYCAST for IPv6 UDP and SMC socket and exercises +smc_switch_to_fallback() for IPPROTO_SMC. + + 1. smc_switch_to_fallback() is called under lock_sock() and holds + smc->clcsock_release_lock. + + sk_lock-AF_INET6 -> &smc->clcsock_release_lock + (sk_lock-AF_SMC) + + 2. Setting IPV6_JOIN_ANYCAST to SMC holds smc->clcsock_release_lock + and calls setsockopt() for the kernel TCP socket, which holds RTNL + and the kernel socket's lock_sock(). + + &smc->clcsock_release_lock -> rtnl_mutex (-> k-sk_lock-AF_INET6) + + 3. Setting IPV6_JOIN_ANYCAST to UDP holds RTNL and lock_sock(). + + rtnl_mutex -> sk_lock-AF_INET6 + +Then, lockdep detects a false-positive circular locking, + + .-> sk_lock-AF_INET6 -> &smc->clcsock_release_lock -> rtnl_mutex -. + `-----------------------------------------------------------------' + +but IPPROTO_SMC should have the same locking rule as AF_SMC. + + sk_lock-AF_SMC -> &smc->clcsock_release_lock -> rtnl_mutex -> k-sk_lock-AF_INET6 + +Let's set the same lock class for smc_sock. + +Given AF_SMC uses the same lock class for SMCPROTO_SMC and SMCPROTO_SMC6, +we do not need to separate the class for AF_INET and AF_INET6. + +[0]: +WARNING: possible circular locking dependency detected +6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 Not tainted + +syz.4.1528/11571 is trying to acquire lock: +ffffffff8fef8de8 (rtnl_mutex){+.+.}-{4:4}, at: ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220 + +but task is already holding lock: +ffff888027f596a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_clcsock_release+0x75/0xe0 net/smc/smc_close.c:30 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + + -> #2 (&smc->clcsock_release_lock){+.+.}-{4:4}: + __mutex_lock_common kernel/locking/mutex.c:585 [inline] + __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730 + smc_switch_to_fallback+0x2d/0xa00 net/smc/af_smc.c:903 + smc_sendmsg+0x13d/0x520 net/smc/af_smc.c:2781 + sock_sendmsg_nosec net/socket.c:718 [inline] + __sock_sendmsg net/socket.c:733 [inline] + ____sys_sendmsg+0xaaf/0xc90 net/socket.c:2573 + ___sys_sendmsg+0x135/0x1e0 net/socket.c:2627 + __sys_sendmsg+0x16e/0x220 net/socket.c:2659 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #1 (sk_lock-AF_INET6){+.+.}-{0:0}: + lock_sock_nested+0x3a/0xf0 net/core/sock.c:3645 + lock_sock include/net/sock.h:1624 [inline] + sockopt_lock_sock net/core/sock.c:1133 [inline] + sockopt_lock_sock+0x54/0x70 net/core/sock.c:1124 + do_ipv6_setsockopt+0x2160/0x4520 net/ipv6/ipv6_sockglue.c:567 + ipv6_setsockopt+0xcb/0x170 net/ipv6/ipv6_sockglue.c:993 + udpv6_setsockopt+0x7d/0xd0 net/ipv6/udp.c:1850 + do_sock_setsockopt+0x222/0x480 net/socket.c:2303 + __sys_setsockopt+0x1a0/0x230 net/socket.c:2328 + __do_sys_setsockopt net/socket.c:2334 [inline] + __se_sys_setsockopt net/socket.c:2331 [inline] + __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2331 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #0 (rtnl_mutex){+.+.}-{4:4}: + check_prev_add kernel/locking/lockdep.c:3163 [inline] + check_prevs_add kernel/locking/lockdep.c:3282 [inline] + validate_chain kernel/locking/lockdep.c:3906 [inline] + __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228 + lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851 + __mutex_lock_common kernel/locking/mutex.c:585 [inline] + __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730 + ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220 + inet6_release+0x47/0x70 net/ipv6/af_inet6.c:485 + __sock_release net/socket.c:647 [inline] + sock_release+0x8e/0x1d0 net/socket.c:675 + smc_clcsock_release+0xb7/0xe0 net/smc/smc_close.c:34 + __smc_release+0x5c2/0x880 net/smc/af_smc.c:301 + smc_release+0x1fc/0x5f0 net/smc/af_smc.c:344 + __sock_release+0xb0/0x270 net/socket.c:647 + sock_close+0x1c/0x30 net/socket.c:1398 + __fput+0x3ff/0xb70 fs/file_table.c:464 + task_work_run+0x14e/0x250 kernel/task_work.c:227 + resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] + exit_to_user_mode_loop kernel/entry/common.c:114 [inline] + exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] + __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] + syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218 + do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +other info that might help us debug this: + +Chain exists of: + rtnl_mutex --> sk_lock-AF_INET6 --> &smc->clcsock_release_lock + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&smc->clcsock_release_lock); + lock(sk_lock-AF_INET6); + lock(&smc->clcsock_release_lock); + lock(rtnl_mutex); + + *** DEADLOCK *** + +2 locks held by syz.4.1528/11571: + #0: ffff888077e88208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:877 [inline] + #0: ffff888077e88208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646 + #1: ffff888027f596a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_clcsock_release+0x75/0xe0 net/smc/smc_close.c:30 + +stack backtrace: +CPU: 0 UID: 0 PID: 11571 Comm: syz.4.1528 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 + print_circular_bug+0x490/0x760 kernel/locking/lockdep.c:2076 + check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2208 + check_prev_add kernel/locking/lockdep.c:3163 [inline] + check_prevs_add kernel/locking/lockdep.c:3282 [inline] + validate_chain kernel/locking/lockdep.c:3906 [inline] + __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228 + lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851 + __mutex_lock_common kernel/locking/mutex.c:585 [inline] + __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730 + ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220 + inet6_release+0x47/0x70 net/ipv6/af_inet6.c:485 + __sock_release net/socket.c:647 [inline] + sock_release+0x8e/0x1d0 net/socket.c:675 + smc_clcsock_release+0xb7/0xe0 net/smc/smc_close.c:34 + __smc_release+0x5c2/0x880 net/smc/af_smc.c:301 + smc_release+0x1fc/0x5f0 net/smc/af_smc.c:344 + __sock_release+0xb0/0x270 net/socket.c:647 + sock_close+0x1c/0x30 net/socket.c:1398 + __fput+0x3ff/0xb70 fs/file_table.c:464 + task_work_run+0x14e/0x250 kernel/task_work.c:227 + resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] + exit_to_user_mode_loop kernel/entry/common.c:114 [inline] + exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] + __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] + syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218 + do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7f8b4b38d169 +Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffe4efd22d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 +RAX: 0000000000000000 RBX: 00000000000b14a3 RCX: 00007f8b4b38d169 +RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 +RBP: 00007f8b4b5a7ba0 R08: 0000000000000001 R09: 000000114efd25cf +R10: 00007f8b4b200000 R11: 0000000000000246 R12: 00007f8b4b5a5fac +R13: 00007f8b4b5a5fa0 R14: ffffffffffffffff R15: 00007ffe4efd23f0 + + +Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC") +Reported-by: syzbot+be6f4b383534d88989f7@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=be6f4b383534d88989f7 +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Wenjia Zhang +Link: https://patch.msgid.link/20250407170332.26959-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 3e6cb35baf25a..3760131f14845 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -362,6 +362,9 @@ static void smc_destruct(struct sock *sk) + return; + } + ++static struct lock_class_key smc_key; ++static struct lock_class_key smc_slock_key; ++ + void smc_sk_init(struct net *net, struct sock *sk, int protocol) + { + struct smc_sock *smc = smc_sk(sk); +@@ -375,6 +378,8 @@ void smc_sk_init(struct net *net, struct sock *sk, int protocol) + INIT_WORK(&smc->connect_work, smc_connect_work); + INIT_DELAYED_WORK(&smc->conn.tx_work, smc_tx_work); + INIT_LIST_HEAD(&smc->accept_q); ++ sock_lock_init_class_and_name(sk, "slock-AF_SMC", &smc_slock_key, ++ "sk_lock-AF_SMC", &smc_key); + spin_lock_init(&smc->accept_q_lock); + spin_lock_init(&smc->conn.send_lock); + sk->sk_prot->hash(sk); +-- +2.39.5 + diff --git a/queue-6.14/test-suite-use-zu-to-print-size_t.patch b/queue-6.14/test-suite-use-zu-to-print-size_t.patch new file mode 100644 index 0000000000..1b859084c2 --- /dev/null +++ b/queue-6.14/test-suite-use-zu-to-print-size_t.patch @@ -0,0 +1,47 @@ +From bbc5a1957d9469898e5e08cda95f8da08fe64133 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 20:33:11 -0400 +Subject: test suite: use %zu to print size_t + +From: Matthew Wilcox (Oracle) + +[ Upstream commit a30951d09c33c899f0e4aca80eb87fad5f10ecfa ] + +On 32-bit, we can't use %lu to print a size_t variable and gcc warns us +about it. Shame it doesn't warn about it on 64-bit. + +Link: https://lkml.kernel.org/r/20250403003311.359917-1-Liam.Howlett@oracle.com +Fixes: cc86e0c2f306 ("radix tree test suite: add support for slab bulk APIs") +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Liam R. Howlett +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/shared/linux.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/shared/linux.c b/tools/testing/shared/linux.c +index 66dbb362385f3..0f97fb0d19e19 100644 +--- a/tools/testing/shared/linux.c ++++ b/tools/testing/shared/linux.c +@@ -150,7 +150,7 @@ void kmem_cache_free(struct kmem_cache *cachep, void *objp) + void kmem_cache_free_bulk(struct kmem_cache *cachep, size_t size, void **list) + { + if (kmalloc_verbose) +- pr_debug("Bulk free %p[0-%lu]\n", list, size - 1); ++ pr_debug("Bulk free %p[0-%zu]\n", list, size - 1); + + pthread_mutex_lock(&cachep->lock); + for (int i = 0; i < size; i++) +@@ -168,7 +168,7 @@ int kmem_cache_alloc_bulk(struct kmem_cache *cachep, gfp_t gfp, size_t size, + size_t i; + + if (kmalloc_verbose) +- pr_debug("Bulk alloc %lu\n", size); ++ pr_debug("Bulk alloc %zu\n", size); + + pthread_mutex_lock(&cachep->lock); + if (cachep->nr_objs >= size) { +-- +2.39.5 + diff --git a/queue-6.14/thermal-intel-int340x-fix-panther-lake-dlvr-support.patch b/queue-6.14/thermal-intel-int340x-fix-panther-lake-dlvr-support.patch new file mode 100644 index 0000000000..71a6c9d840 --- /dev/null +++ b/queue-6.14/thermal-intel-int340x-fix-panther-lake-dlvr-support.patch @@ -0,0 +1,113 @@ +From 71544b618f86ebda36b08c345b9948a30b2f8cb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 04:54:38 -0700 +Subject: thermal: intel: int340x: Fix Panther Lake DLVR support + +From: Srinivas Pandruvada + +[ Upstream commit 00c5ff5e9a55dca2e7ca29af4e5f8708731faf11 ] + +Panther Lake uses the same DLVR register offsets as Lunar Lake, but the +driver uses the default register offsets table for it by mistake. + +Move the selection of register offsets table from the actual attribute +read/write callbacks to proc_thermal_rfim_add() and make it handle +Panther Lake the same way as Lunar Lake. This way it is clean and in +the future such issues can be avoided. + +Fixes: e50eeababa94 ("thermal: intel: int340x: Panther Lake DLVR support") +Signed-off-by: Srinivas Pandruvada +Link: https://patch.msgid.link/20250411115438.594114-1-srinivas.pandruvada@linux.intel.com +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + .../int340x_thermal/processor_thermal_rfim.c | 33 ++++++++++--------- + 1 file changed, 17 insertions(+), 16 deletions(-) + +diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +index dad63f2d5f90f..3a028b78d9afc 100644 +--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c ++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +@@ -166,15 +166,18 @@ static const struct mmio_reg adl_dvfs_mmio_regs[] = { + { 0, 0x5A40, 1, 0x1, 0}, /* rfi_disable */ + }; + ++static const struct mapping_table *dlvr_mapping; ++static const struct mmio_reg *dlvr_mmio_regs_table; ++ + #define RFIM_SHOW(suffix, table)\ + static ssize_t suffix##_show(struct device *dev,\ + struct device_attribute *attr,\ + char *buf)\ + {\ +- const struct mapping_table *mapping = NULL;\ ++ const struct mmio_reg *mmio_regs = dlvr_mmio_regs_table;\ ++ const struct mapping_table *mapping = dlvr_mapping;\ + struct proc_thermal_device *proc_priv;\ + struct pci_dev *pdev = to_pci_dev(dev);\ +- const struct mmio_reg *mmio_regs;\ + const char **match_strs;\ + int ret, err;\ + u32 reg_val;\ +@@ -186,12 +189,6 @@ static ssize_t suffix##_show(struct device *dev,\ + mmio_regs = adl_dvfs_mmio_regs;\ + } else if (table == 2) { \ + match_strs = (const char **)dlvr_strings;\ +- if (pdev->device == PCI_DEVICE_ID_INTEL_LNLM_THERMAL) {\ +- mmio_regs = lnl_dlvr_mmio_regs;\ +- mapping = lnl_dlvr_mapping;\ +- } else {\ +- mmio_regs = dlvr_mmio_regs;\ +- } \ + } else {\ + match_strs = (const char **)fivr_strings;\ + mmio_regs = tgl_fivr_mmio_regs;\ +@@ -214,12 +211,12 @@ static ssize_t suffix##_store(struct device *dev,\ + struct device_attribute *attr,\ + const char *buf, size_t count)\ + {\ +- const struct mapping_table *mapping = NULL;\ ++ const struct mmio_reg *mmio_regs = dlvr_mmio_regs_table;\ ++ const struct mapping_table *mapping = dlvr_mapping;\ + struct proc_thermal_device *proc_priv;\ + struct pci_dev *pdev = to_pci_dev(dev);\ + unsigned int input;\ + const char **match_strs;\ +- const struct mmio_reg *mmio_regs;\ + int ret, err;\ + u32 reg_val;\ + u32 mask;\ +@@ -230,12 +227,6 @@ static ssize_t suffix##_store(struct device *dev,\ + mmio_regs = adl_dvfs_mmio_regs;\ + } else if (table == 2) { \ + match_strs = (const char **)dlvr_strings;\ +- if (pdev->device == PCI_DEVICE_ID_INTEL_LNLM_THERMAL) {\ +- mmio_regs = lnl_dlvr_mmio_regs;\ +- mapping = lnl_dlvr_mapping;\ +- } else {\ +- mmio_regs = dlvr_mmio_regs;\ +- } \ + } else {\ + match_strs = (const char **)fivr_strings;\ + mmio_regs = tgl_fivr_mmio_regs;\ +@@ -448,6 +439,16 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc + } + + if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DLVR) { ++ switch (pdev->device) { ++ case PCI_DEVICE_ID_INTEL_LNLM_THERMAL: ++ case PCI_DEVICE_ID_INTEL_PTL_THERMAL: ++ dlvr_mmio_regs_table = lnl_dlvr_mmio_regs; ++ dlvr_mapping = lnl_dlvr_mapping; ++ break; ++ default: ++ dlvr_mmio_regs_table = dlvr_mmio_regs; ++ break; ++ } + ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group); + if (ret) + return ret; +-- +2.39.5 + diff --git a/queue-6.14/tools-ynl-gen-individually-free-previous-values-on-d.patch b/queue-6.14/tools-ynl-gen-individually-free-previous-values-on-d.patch new file mode 100644 index 0000000000..ca1170181b --- /dev/null +++ b/queue-6.14/tools-ynl-gen-individually-free-previous-values-on-d.patch @@ -0,0 +1,203 @@ +From 6abb31e231b2e22e26349d0aa7b351841a506690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 14:18:46 -0700 +Subject: tools: ynl-gen: individually free previous values on double set + +From: Jakub Kicinski + +[ Upstream commit ce6cb8113c842b94e77364b247c4f85c7b34e0c2 ] + +When user calls request_attrA_set() multiple times (for the same +attribute), and attrA is of type which allocates memory - +we try to free the previously associated values. For array +types (including multi-attr) we have only freed the array, +but the array may have contained pointers. + +Refactor the code generation for free attr and reuse the generated +lines in setters to flush out the previous state. Since setters +are static inlines in the header we need to add forward declarations +for the free helpers of pure nested structs. Track which types get +used by arrays and include the right forwad declarations. + +At least ethtool string set and bit set would not be freed without +this. Tho, admittedly, overriding already set attribute twice is likely +a very very rare thing to do. + +Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink") +Reviewed-by: Donald Hunter +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250414211851.602096-4-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/net/ynl/pyynl/ynl_gen_c.py | 62 +++++++++++++++++++++++--------- + 1 file changed, 45 insertions(+), 17 deletions(-) + +diff --git a/tools/net/ynl/pyynl/ynl_gen_c.py b/tools/net/ynl/pyynl/ynl_gen_c.py +index c2eabc90dce8c..9c9a62a93afe7 100755 +--- a/tools/net/ynl/pyynl/ynl_gen_c.py ++++ b/tools/net/ynl/pyynl/ynl_gen_c.py +@@ -157,9 +157,15 @@ class Type(SpecAttr): + def free_needs_iter(self): + return False + +- def free(self, ri, var, ref): ++ def _free_lines(self, ri, var, ref): + if self.is_multi_val() or self.presence_type() == 'len': +- ri.cw.p(f'free({var}->{ref}{self.c_name});') ++ return [f'free({var}->{ref}{self.c_name});'] ++ return [] ++ ++ def free(self, ri, var, ref): ++ lines = self._free_lines(ri, var, ref) ++ for line in lines: ++ ri.cw.p(line) + + def arg_member(self, ri): + member = self._complex_member_type(ri) +@@ -258,6 +264,10 @@ class Type(SpecAttr): + var = "req" + member = f"{var}->{'.'.join(ref)}" + ++ local_vars = [] ++ if self.free_needs_iter(): ++ local_vars += ['unsigned int i;'] ++ + code = [] + presence = '' + for i in range(0, len(ref)): +@@ -267,6 +277,10 @@ class Type(SpecAttr): + if i == len(ref) - 1 and self.presence_type() != 'bit': + continue + code.append(presence + ' = 1;') ++ ref_path = '.'.join(ref[:-1]) ++ if ref_path: ++ ref_path += '.' ++ code += self._free_lines(ri, var, ref_path) + code += self._setter_lines(ri, member, presence) + + func_name = f"{op_prefix(ri, direction, deref=deref)}_set_{'_'.join(ref)}" +@@ -274,7 +288,8 @@ class Type(SpecAttr): + alloc = bool([x for x in code if 'alloc(' in x]) + if free and not alloc: + func_name = '__' + func_name +- ri.cw.write_func('static inline void', func_name, body=code, ++ ri.cw.write_func('static inline void', func_name, local_vars=local_vars, ++ body=code, + args=[f'{type_name(ri, direction, deref=deref)} *{var}'] + self.arg_member(ri)) + + +@@ -477,8 +492,7 @@ class TypeString(Type): + ['unsigned int len;'] + + def _setter_lines(self, ri, member, presence): +- return [f"free({member});", +- f"{presence}_len = strlen({self.c_name});", ++ return [f"{presence}_len = strlen({self.c_name});", + f"{member} = malloc({presence}_len + 1);", + f'memcpy({member}, {self.c_name}, {presence}_len);', + f'{member}[{presence}_len] = 0;'] +@@ -531,8 +545,7 @@ class TypeBinary(Type): + ['unsigned int len;'] + + def _setter_lines(self, ri, member, presence): +- return [f"free({member});", +- f"{presence}_len = len;", ++ return [f"{presence}_len = len;", + f"{member} = malloc({presence}_len);", + f'memcpy({member}, {self.c_name}, {presence}_len);'] + +@@ -569,12 +582,14 @@ class TypeNest(Type): + def _complex_member_type(self, ri): + return self.nested_struct_type + +- def free(self, ri, var, ref): ++ def _free_lines(self, ri, var, ref): ++ lines = [] + at = '&' + if self.is_recursive_for_op(ri): + at = '' +- ri.cw.p(f'if ({var}->{ref}{self.c_name})') +- ri.cw.p(f'{self.nested_render_name}_free({at}{var}->{ref}{self.c_name});') ++ lines += [f'if ({var}->{ref}{self.c_name})'] ++ lines += [f'{self.nested_render_name}_free({at}{var}->{ref}{self.c_name});'] ++ return lines + + def _attr_typol(self): + return f'.type = YNL_PT_NEST, .nest = &{self.nested_render_name}_nest, ' +@@ -627,15 +642,19 @@ class TypeMultiAttr(Type): + def free_needs_iter(self): + return 'type' not in self.attr or self.attr['type'] == 'nest' + +- def free(self, ri, var, ref): ++ def _free_lines(self, ri, var, ref): ++ lines = [] + if self.attr['type'] in scalars: +- ri.cw.p(f"free({var}->{ref}{self.c_name});") ++ lines += [f"free({var}->{ref}{self.c_name});"] + elif 'type' not in self.attr or self.attr['type'] == 'nest': +- ri.cw.p(f"for (i = 0; i < {var}->{ref}n_{self.c_name}; i++)") +- ri.cw.p(f'{self.nested_render_name}_free(&{var}->{ref}{self.c_name}[i]);') +- ri.cw.p(f"free({var}->{ref}{self.c_name});") ++ lines += [ ++ f"for (i = 0; i < {var}->{ref}n_{self.c_name}; i++)", ++ f'{self.nested_render_name}_free(&{var}->{ref}{self.c_name}[i]);', ++ f"free({var}->{ref}{self.c_name});", ++ ] + else: + raise Exception(f"Free of MultiAttr sub-type {self.attr['type']} not supported yet") ++ return lines + + def _attr_policy(self, policy): + return self.base_type._attr_policy(policy) +@@ -661,8 +680,7 @@ class TypeMultiAttr(Type): + def _setter_lines(self, ri, member, presence): + # For multi-attr we have a count, not presence, hack up the presence + presence = presence[:-(len('_present.') + len(self.c_name))] + "n_" + self.c_name +- return [f"free({member});", +- f"{member} = {self.c_name};", ++ return [f"{member} = {self.c_name};", + f"{presence} = n_{self.c_name};"] + + +@@ -747,6 +765,7 @@ class Struct: + self.request = False + self.reply = False + self.recursive = False ++ self.in_multi_val = False # used by a MultiAttr or and legacy arrays + + self.attr_list = [] + self.attrs = dict() +@@ -1114,6 +1133,10 @@ class Family(SpecFamily): + if attr in rs_members['reply']: + self.pure_nested_structs[nested].reply = True + ++ if spec.is_multi_val(): ++ child = self.pure_nested_structs.get(nested) ++ child.in_multi_val = True ++ + self._sort_pure_types() + + # Propagate the request / reply / recursive +@@ -1128,6 +1151,8 @@ class Family(SpecFamily): + struct.child_nests.update(child.child_nests) + child.request |= struct.request + child.reply |= struct.reply ++ if spec.is_multi_val(): ++ child.in_multi_val = True + if attr_set in struct.child_nests: + struct.recursive = True + +@@ -2921,6 +2946,9 @@ def main(): + for attr_set, struct in parsed.pure_nested_structs.items(): + ri = RenderInfo(cw, parsed, args.mode, "", "", attr_set) + print_type_full(ri, struct) ++ if struct.request and struct.in_multi_val: ++ free_rsp_nested_prototype(ri) ++ cw.nl() + + for op_name, op in parsed.ops.items(): + cw.p(f"/* ============== {op.enum_name} ============== */") +-- +2.39.5 + diff --git a/queue-6.14/tools-ynl-gen-make-sure-we-validate-subtype-of-array.patch b/queue-6.14/tools-ynl-gen-make-sure-we-validate-subtype-of-array.patch new file mode 100644 index 0000000000..f0d84f3873 --- /dev/null +++ b/queue-6.14/tools-ynl-gen-make-sure-we-validate-subtype-of-array.patch @@ -0,0 +1,45 @@ +From c136cc6535a7454c9e1a66fc0c934aae20134cbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 14:18:47 -0700 +Subject: tools: ynl-gen: make sure we validate subtype of array-nest + +From: Jakub Kicinski + +[ Upstream commit 57e7dedf2b8c72caa6f04b9e08b19e4f370562fa ] + +ArrayNest AKA indexed-array support currently skips inner type +validation. We count the attributes and then we parse them, +make sure we call validate, too. Otherwise buggy / unexpected +kernel response may lead to crashes. + +Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink") +Reviewed-by: Donald Hunter +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250414211851.602096-5-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/net/ynl/pyynl/ynl_gen_c.py | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/net/ynl/pyynl/ynl_gen_c.py b/tools/net/ynl/pyynl/ynl_gen_c.py +index 9c9a62a93afe7..f36af0e1da78e 100755 +--- a/tools/net/ynl/pyynl/ynl_gen_c.py ++++ b/tools/net/ynl/pyynl/ynl_gen_c.py +@@ -706,8 +706,11 @@ class TypeArrayNest(Type): + def _attr_get(self, ri, var): + local_vars = ['const struct nlattr *attr2;'] + get_lines = [f'attr_{self.c_name} = attr;', +- 'ynl_attr_for_each_nested(attr2, attr)', +- f'\t{var}->n_{self.c_name}++;'] ++ 'ynl_attr_for_each_nested(attr2, attr) {', ++ '\tif (ynl_attr_validate(yarg, attr2))', ++ '\t\treturn YNL_PARSE_CB_ERROR;', ++ f'\t{var}->n_{self.c_name}++;', ++ '}'] + return get_lines, None, local_vars + + +-- +2.39.5 + diff --git a/queue-6.14/wifi-at76c50x-fix-use-after-free-access-in-at76_disc.patch b/queue-6.14/wifi-at76c50x-fix-use-after-free-access-in-at76_disc.patch new file mode 100644 index 0000000000..d646715bf9 --- /dev/null +++ b/queue-6.14/wifi-at76c50x-fix-use-after-free-access-in-at76_disc.patch @@ -0,0 +1,39 @@ +From 5a4bd20f39aec7de591dcd2d0e0c7c5bc1f0858a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Mar 2025 16:01:10 +0530 +Subject: wifi: at76c50x: fix use after free access in at76_disconnect + +From: Abdun Nihaal + +[ Upstream commit 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ] + +The memory pointed to by priv is freed at the end of at76_delete_device +function (using ieee80211_free_hw). But the code then accesses the udev +field of the freed object to put the USB device. This may also lead to a +memory leak of the usb device. Fix this by using udev from interface. + +Fixes: 29e20aa6c6af ("at76c50x-usb: fix use after free on failure path in at76_probe()") +Signed-off-by: Abdun Nihaal +Link: https://patch.msgid.link/20250330103110.44080-1-abdun.nihaal@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c +index 504e05ea30f29..97ea7ab0f4910 100644 +--- a/drivers/net/wireless/atmel/at76c50x-usb.c ++++ b/drivers/net/wireless/atmel/at76c50x-usb.c +@@ -2552,7 +2552,7 @@ static void at76_disconnect(struct usb_interface *interface) + + wiphy_info(priv->hw->wiphy, "disconnecting\n"); + at76_delete_device(priv); +- usb_put_dev(priv->udev); ++ usb_put_dev(interface_to_usbdev(interface)); + dev_info(&interface->dev, "disconnected\n"); + } + +-- +2.39.5 + diff --git a/queue-6.14/wifi-brcmfmac-fix-memory-leak-in-brcmf_get_module_pa.patch b/queue-6.14/wifi-brcmfmac-fix-memory-leak-in-brcmf_get_module_pa.patch new file mode 100644 index 0000000000..dbd0b32d86 --- /dev/null +++ b/queue-6.14/wifi-brcmfmac-fix-memory-leak-in-brcmf_get_module_pa.patch @@ -0,0 +1,41 @@ +From 0479def99ccd22b67ef33a17ebdbae708bfb8ca5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Mar 2025 16:04:24 +0530 +Subject: wifi: brcmfmac: fix memory leak in brcmf_get_module_param + +From: Abdun Nihaal + +[ Upstream commit 9e935c0fe3f806ff700a804c00832f0f340b6061 ] + +The memory allocated for settings is not freed when brcmf_of_probe +fails. Fix that by freeing settings before returning in error path. + +Fixes: 0ff0843310b7 ("wifi: brcmfmac: Add optional lpo clock enable support") +Signed-off-by: Abdun Nihaal +Acked-by: Arend van Spriel +Link: https://patch.msgid.link/20250330103425.44197-1-abdun.nihaal@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +index cfcf01eb0daa5..f26e4679e4ff0 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +@@ -561,8 +561,10 @@ struct brcmf_mp_device *brcmf_get_module_param(struct device *dev, + if (!found) { + /* No platform data for this device, try OF and DMI data */ + brcmf_dmi_probe(settings, chip, chiprev); +- if (brcmf_of_probe(dev, bus_type, settings) == -EPROBE_DEFER) ++ if (brcmf_of_probe(dev, bus_type, settings) == -EPROBE_DEFER) { ++ kfree(settings); + return ERR_PTR(-EPROBE_DEFER); ++ } + brcmf_acpi_probe(dev, bus_type, settings); + } + return settings; +-- +2.39.5 + diff --git a/queue-6.14/wifi-iwlwifi-pcie-set-state-to-no-fw-before-reset-ha.patch b/queue-6.14/wifi-iwlwifi-pcie-set-state-to-no-fw-before-reset-ha.patch new file mode 100644 index 0000000000..1c679cf9f5 --- /dev/null +++ b/queue-6.14/wifi-iwlwifi-pcie-set-state-to-no-fw-before-reset-ha.patch @@ -0,0 +1,60 @@ +From 53f231eff8ff7d7981f14212f3bfd5e5634c8833 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 10:40:54 +0200 +Subject: wifi: iwlwifi: pcie: set state to no-FW before reset handshake + +From: Johannes Berg + +[ Upstream commit 5f05c14e7c198415abe936514a6905f8b545b63b ] + +The reset handshake attempts to kill the firmware, and it'll go +into a pretty much dead state once we do that. However, if it +times out, then we'll attempt to dump the firmware to be able +to see why it didn't respond. During this dump, we cannot treat +it as if it was still running, since we just tried to kill it, +otherwise dumping will attempt to send a DBGC stop command. As +this command will time out, we'll go into a reset loop. + +For now, fix this by setting the trans->state to say firmware +isn't running before doing the reset handshake. In the longer +term, we should clean up the way this state is handled. + +It's not entirely clear but it seems likely that this issue was +introduced by my rework of the error handling, prior to that it +would've been synchronous at that point and (I think) not have +attempted to reset since it was already doing down. + +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219967 +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219968 +Fixes: 7391b2a4f7db ("wifi: iwlwifi: rework firmware error handling") +Reviewed-by: Miriam Rachel Korenblit +Link: https://patch.msgid.link/20250411104054.63aa4f56894d.Ife70cfe997db03f0d07fdef2b164695739a05a63@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c +index 793514a1852a3..e37fa5ae97f64 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c +@@ -147,8 +147,14 @@ static void _iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans) + return; + + if (trans->state >= IWL_TRANS_FW_STARTED && +- trans_pcie->fw_reset_handshake) ++ trans_pcie->fw_reset_handshake) { ++ /* ++ * Reset handshake can dump firmware on timeout, but that ++ * should assume that the firmware is already dead. ++ */ ++ trans->state = IWL_TRANS_NO_FW; + iwl_trans_pcie_fw_reset_handshake(trans); ++ } + + trans_pcie->is_down = true; + +-- +2.39.5 + diff --git a/queue-6.14/wifi-mac80211-purge-vif-txq-in-ieee80211_do_stop.patch b/queue-6.14/wifi-mac80211-purge-vif-txq-in-ieee80211_do_stop.patch new file mode 100644 index 0000000000..ca5ad71862 --- /dev/null +++ b/queue-6.14/wifi-mac80211-purge-vif-txq-in-ieee80211_do_stop.patch @@ -0,0 +1,117 @@ +From 6179a7d9a01b2c938f9f18c06d166afbbbe7a34e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 17:28:21 +0100 +Subject: wifi: mac80211: Purge vif txq in ieee80211_do_stop() + +From: Remi Pommarel + +[ Upstream commit 378677eb8f44621ecc9ce659f7af61e5baa94d81 ] + +After ieee80211_do_stop() SKB from vif's txq could still be processed. +Indeed another concurrent vif schedule_and_wake_txq call could cause +those packets to be dequeued (see ieee80211_handle_wake_tx_queue()) +without checking the sdata current state. + +Because vif.drv_priv is now cleared in this function, this could lead to +driver crash. + +For example in ath12k, ahvif is store in vif.drv_priv. Thus if +ath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif->ah can be +NULL, leading the ath12k_warn(ahvif->ah,...) call in this function to +trigger the NULL deref below. + + Unable to handle kernel paging request at virtual address dfffffc000000001 + KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] + batman_adv: bat0: Interface deactivated: brbh1337 + Mem abort info: + ESR = 0x0000000096000004 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x04: level 0 translation fault + Data abort info: + ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + [dfffffc000000001] address between user and kernel address ranges + Internal error: Oops: 0000000096000004 [#1] SMP + CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114 + Hardware name: HW (DT) + pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] + lr : ath12k_mac_op_tx+0x174/0x29b8 [ath12k] + sp : ffffffc086ace450 + x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4 + x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e + x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0 + x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958 + x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8 + x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03 + x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40 + x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0 + x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001 + x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008 + Call trace: + ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P) + ieee80211_handle_wake_tx_queue+0x16c/0x260 + ieee80211_queue_skb+0xeec/0x1d20 + ieee80211_tx+0x200/0x2c8 + ieee80211_xmit+0x22c/0x338 + __ieee80211_subif_start_xmit+0x7e8/0xc60 + ieee80211_subif_start_xmit+0xc4/0xee0 + __ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0 + ieee80211_subif_start_xmit_8023+0x124/0x488 + dev_hard_start_xmit+0x160/0x5a8 + __dev_queue_xmit+0x6f8/0x3120 + br_dev_queue_push_xmit+0x120/0x4a8 + __br_forward+0xe4/0x2b0 + deliver_clone+0x5c/0xd0 + br_flood+0x398/0x580 + br_dev_xmit+0x454/0x9f8 + dev_hard_start_xmit+0x160/0x5a8 + __dev_queue_xmit+0x6f8/0x3120 + ip6_finish_output2+0xc28/0x1b60 + __ip6_finish_output+0x38c/0x638 + ip6_output+0x1b4/0x338 + ip6_local_out+0x7c/0xa8 + ip6_send_skb+0x7c/0x1b0 + ip6_push_pending_frames+0x94/0xd0 + rawv6_sendmsg+0x1a98/0x2898 + inet_sendmsg+0x94/0xe0 + __sys_sendto+0x1e4/0x308 + __arm64_sys_sendto+0xc4/0x140 + do_el0_svc+0x110/0x280 + el0_svc+0x20/0x60 + el0t_64_sync_handler+0x104/0x138 + el0t_64_sync+0x154/0x158 + +To avoid that, empty vif's txq at ieee80211_do_stop() so no packet could +be dequeued after ieee80211_do_stop() (new packets cannot be queued +because SDATA_STATE_RUNNING is cleared at this point). + +Fixes: ba8c3d6f16a1 ("mac80211: add an intermediate software queue implementation") +Signed-off-by: Remi Pommarel +Link: https://patch.msgid.link/ff7849e268562456274213c0476e09481a48f489.1742833382.git.repk@triplefau.lt +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/iface.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index 459fc391a4d93..d299bdbca6b3b 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -660,6 +660,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do + if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) + ieee80211_txq_remove_vlan(local, sdata); + ++ if (sdata->vif.txq) ++ ieee80211_txq_purge(sdata->local, to_txq_info(sdata->vif.txq)); ++ + sdata->bss = NULL; + + if (local->open_count == 0) +-- +2.39.5 + diff --git a/queue-6.14/wifi-mac80211-update-skb-s-control-block-key-in-ieee.patch b/queue-6.14/wifi-mac80211-update-skb-s-control-block-key-in-ieee.patch new file mode 100644 index 0000000000..6d9aa79b2a --- /dev/null +++ b/queue-6.14/wifi-mac80211-update-skb-s-control-block-key-in-ieee.patch @@ -0,0 +1,100 @@ +From 9209089b629b7c29ae393cded89e77c169f18dfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 17:28:20 +0100 +Subject: wifi: mac80211: Update skb's control block key in + ieee80211_tx_dequeue() + +From: Remi Pommarel + +[ Upstream commit a104042e2bf6528199adb6ca901efe7b60c2c27f ] + +The ieee80211 skb control block key (set when skb was queued) could have +been removed before ieee80211_tx_dequeue() call. ieee80211_tx_dequeue() +already called ieee80211_tx_h_select_key() to get the current key, but +the latter do not update the key in skb control block in case it is +NULL. Because some drivers actually use this key in their TX callbacks +(e.g. ath1{1,2}k_mac_op_tx()) this could lead to the use after free +below: + + BUG: KASAN: slab-use-after-free in ath11k_mac_op_tx+0x590/0x61c + Read of size 4 at addr ffffff803083c248 by task kworker/u16:4/1440 + + CPU: 3 UID: 0 PID: 1440 Comm: kworker/u16:4 Not tainted 6.13.0-ge128f627f404 #2 + Hardware name: HW (DT) + Workqueue: bat_events batadv_send_outstanding_bcast_packet + Call trace: + show_stack+0x14/0x1c (C) + dump_stack_lvl+0x58/0x74 + print_report+0x164/0x4c0 + kasan_report+0xac/0xe8 + __asan_report_load4_noabort+0x1c/0x24 + ath11k_mac_op_tx+0x590/0x61c + ieee80211_handle_wake_tx_queue+0x12c/0x1c8 + ieee80211_queue_skb+0xdcc/0x1b4c + ieee80211_tx+0x1ec/0x2bc + ieee80211_xmit+0x224/0x324 + __ieee80211_subif_start_xmit+0x85c/0xcf8 + ieee80211_subif_start_xmit+0xc0/0xec4 + dev_hard_start_xmit+0xf4/0x28c + __dev_queue_xmit+0x6ac/0x318c + batadv_send_skb_packet+0x38c/0x4b0 + batadv_send_outstanding_bcast_packet+0x110/0x328 + process_one_work+0x578/0xc10 + worker_thread+0x4bc/0xc7c + kthread+0x2f8/0x380 + ret_from_fork+0x10/0x20 + + Allocated by task 1906: + kasan_save_stack+0x28/0x4c + kasan_save_track+0x1c/0x40 + kasan_save_alloc_info+0x3c/0x4c + __kasan_kmalloc+0xac/0xb0 + __kmalloc_noprof+0x1b4/0x380 + ieee80211_key_alloc+0x3c/0xb64 + ieee80211_add_key+0x1b4/0x71c + nl80211_new_key+0x2b4/0x5d8 + genl_family_rcv_msg_doit+0x198/0x240 + <...> + + Freed by task 1494: + kasan_save_stack+0x28/0x4c + kasan_save_track+0x1c/0x40 + kasan_save_free_info+0x48/0x94 + __kasan_slab_free+0x48/0x60 + kfree+0xc8/0x31c + kfree_sensitive+0x70/0x80 + ieee80211_key_free_common+0x10c/0x174 + ieee80211_free_keys+0x188/0x46c + ieee80211_stop_mesh+0x70/0x2cc + ieee80211_leave_mesh+0x1c/0x60 + cfg80211_leave_mesh+0xe0/0x280 + cfg80211_leave+0x1e0/0x244 + <...> + +Reset SKB control block key before calling ieee80211_tx_h_select_key() +to avoid that. + +Fixes: bb42f2d13ffc ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue") +Signed-off-by: Remi Pommarel +Link: https://patch.msgid.link/06aa507b853ca385ceded81c18b0a6dd0f081bc8.1742833382.git.repk@triplefau.lt +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/tx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index a24636bda6793..0c6214f12ea39 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -3893,6 +3893,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, + * The key can be removed while the packet was queued, so need to call + * this here to get the current key. + */ ++ info->control.hw_key = NULL; + r = ieee80211_tx_h_select_key(&tx); + if (r != TX_CONTINUE) { + ieee80211_free_txskb(&local->hw, skb); +-- +2.39.5 + diff --git a/queue-6.14/wifi-wl1251-fix-memory-leak-in-wl1251_tx_work.patch b/queue-6.14/wifi-wl1251-fix-memory-leak-in-wl1251_tx_work.patch new file mode 100644 index 0000000000..8c75f0cd66 --- /dev/null +++ b/queue-6.14/wifi-wl1251-fix-memory-leak-in-wl1251_tx_work.patch @@ -0,0 +1,41 @@ +From ab0a19c86c8625bf1e8a5b531b483a3d8c958489 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Mar 2025 16:15:32 +0530 +Subject: wifi: wl1251: fix memory leak in wl1251_tx_work + +From: Abdun Nihaal + +[ Upstream commit a0f0dc96de03ffeefc2a177b7f8acde565cb77f4 ] + +The skb dequeued from tx_queue is lost when wl1251_ps_elp_wakeup fails +with a -ETIMEDOUT error. Fix that by queueing the skb back to tx_queue. + +Fixes: c5483b719363 ("wl12xx: check if elp wakeup failed") +Signed-off-by: Abdun Nihaal +Reviewed-by: Michael Nemanov +Link: https://patch.msgid.link/20250330104532.44935-1-abdun.nihaal@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ti/wl1251/tx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ti/wl1251/tx.c b/drivers/net/wireless/ti/wl1251/tx.c +index 474b603c121cb..adb4840b04893 100644 +--- a/drivers/net/wireless/ti/wl1251/tx.c ++++ b/drivers/net/wireless/ti/wl1251/tx.c +@@ -342,8 +342,10 @@ void wl1251_tx_work(struct work_struct *work) + while ((skb = skb_dequeue(&wl->tx_queue))) { + if (!woken_up) { + ret = wl1251_ps_elp_wakeup(wl); +- if (ret < 0) ++ if (ret < 0) { ++ skb_queue_head(&wl->tx_queue, skb); + goto out; ++ } + woken_up = true; + } + +-- +2.39.5 + diff --git a/queue-6.14/xen-fix-multicall-debug-feature.patch b/queue-6.14/xen-fix-multicall-debug-feature.patch new file mode 100644 index 0000000000..7198a5aea1 --- /dev/null +++ b/queue-6.14/xen-fix-multicall-debug-feature.patch @@ -0,0 +1,138 @@ +From 23b8b92018e7d8e5d8e3e95e702d1ce7d1e0b888 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Mar 2025 20:06:02 +0100 +Subject: xen: fix multicall debug feature + +From: Juergen Gross + +[ Upstream commit 715ad3e0ec2b13c27335749f27a5c9f0c0e84064 ] + +Initializing a percpu variable with the address of a struct tagged as +.initdata is breaking the build with CONFIG_SECTION_MISMATCH_WARN_ONLY +not set to "y". + +Fix that by using an access function instead returning the .initdata +struct address if the percpu space of the struct hasn't been +allocated yet. + +Fixes: 368990a7fe30 ("xen: fix multicall debug data referencing") +Reported-by: Borislav Petkov +Reviewed-by: Boris Ostrovsky +Acked-by: "Borislav Petkov (AMD)" +Tested-by: "Borislav Petkov (AMD)" +Signed-off-by: Juergen Gross +Message-ID: <20250327190602.26015-1-jgross@suse.com> +Signed-off-by: Sasha Levin +--- + arch/x86/xen/multicalls.c | 26 ++++++++++++++------------ + arch/x86/xen/smp_pv.c | 1 - + arch/x86/xen/xen-ops.h | 3 --- + 3 files changed, 14 insertions(+), 16 deletions(-) + +diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c +index 10c660fae8b30..7237d56a9d3f0 100644 +--- a/arch/x86/xen/multicalls.c ++++ b/arch/x86/xen/multicalls.c +@@ -54,14 +54,20 @@ struct mc_debug_data { + + static DEFINE_PER_CPU(struct mc_buffer, mc_buffer); + static struct mc_debug_data mc_debug_data_early __initdata; +-static DEFINE_PER_CPU(struct mc_debug_data *, mc_debug_data) = +- &mc_debug_data_early; + static struct mc_debug_data __percpu *mc_debug_data_ptr; + DEFINE_PER_CPU(unsigned long, xen_mc_irq_flags); + + static struct static_key mc_debug __ro_after_init; + static bool mc_debug_enabled __initdata; + ++static struct mc_debug_data * __ref get_mc_debug(void) ++{ ++ if (!mc_debug_data_ptr) ++ return &mc_debug_data_early; ++ ++ return this_cpu_ptr(mc_debug_data_ptr); ++} ++ + static int __init xen_parse_mc_debug(char *arg) + { + mc_debug_enabled = true; +@@ -71,20 +77,16 @@ static int __init xen_parse_mc_debug(char *arg) + } + early_param("xen_mc_debug", xen_parse_mc_debug); + +-void mc_percpu_init(unsigned int cpu) +-{ +- per_cpu(mc_debug_data, cpu) = per_cpu_ptr(mc_debug_data_ptr, cpu); +-} +- + static int __init mc_debug_enable(void) + { + unsigned long flags; ++ struct mc_debug_data __percpu *mcdb; + + if (!mc_debug_enabled) + return 0; + +- mc_debug_data_ptr = alloc_percpu(struct mc_debug_data); +- if (!mc_debug_data_ptr) { ++ mcdb = alloc_percpu(struct mc_debug_data); ++ if (!mcdb) { + pr_err("xen_mc_debug inactive\n"); + static_key_slow_dec(&mc_debug); + return -ENOMEM; +@@ -93,7 +95,7 @@ static int __init mc_debug_enable(void) + /* Be careful when switching to percpu debug data. */ + local_irq_save(flags); + xen_mc_flush(); +- mc_percpu_init(0); ++ mc_debug_data_ptr = mcdb; + local_irq_restore(flags); + + pr_info("xen_mc_debug active\n"); +@@ -155,7 +157,7 @@ void xen_mc_flush(void) + trace_xen_mc_flush(b->mcidx, b->argidx, b->cbidx); + + if (static_key_false(&mc_debug)) { +- mcdb = __this_cpu_read(mc_debug_data); ++ mcdb = get_mc_debug(); + memcpy(mcdb->entries, b->entries, + b->mcidx * sizeof(struct multicall_entry)); + } +@@ -235,7 +237,7 @@ struct multicall_space __xen_mc_entry(size_t args) + + ret.mc = &b->entries[b->mcidx]; + if (static_key_false(&mc_debug)) { +- struct mc_debug_data *mcdb = __this_cpu_read(mc_debug_data); ++ struct mc_debug_data *mcdb = get_mc_debug(); + + mcdb->caller[b->mcidx] = __builtin_return_address(0); + mcdb->argsz[b->mcidx] = args; +diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c +index 6863d3da7decf..7ea57f728b89d 100644 +--- a/arch/x86/xen/smp_pv.c ++++ b/arch/x86/xen/smp_pv.c +@@ -305,7 +305,6 @@ static int xen_pv_kick_ap(unsigned int cpu, struct task_struct *idle) + return rc; + + xen_pmu_init(cpu); +- mc_percpu_init(cpu); + + /* + * Why is this a BUG? If the hypercall fails then everything can be +diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h +index 63c13a2ccf556..25e318ef27d6b 100644 +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -261,9 +261,6 @@ void xen_mc_callback(void (*fn)(void *), void *data); + */ + struct multicall_space xen_mc_extend_args(unsigned long op, size_t arg_size); + +-/* Do percpu data initialization for multicalls. */ +-void mc_percpu_init(unsigned int cpu); +- + extern bool is_xen_pmu; + + irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id); +-- +2.39.5 +