From: Greg Kroah-Hartman Date: Fri, 27 Sep 2024 08:02:11 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.1.112~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=08f69f3369712d6d98eef8929fcfc01fc3658abb;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: bnxt_en-cap-the-size-of-hwrm_port_phy_qcfg-forwarded-response.patch can-mcp251xfd-move-mcp251xfd_timestamp_start-stop-into-mcp251xfd_chip_start-stop.patch can-mcp251xfd-properly-indent-labels.patch gpiolib-cdev-ignore-reconfiguration-without-direction.patch netfilter-nf_tables-missing-iterator-type-in-lookup-walk.patch netfilter-nft_set_pipapo-walk-over-current-view-on-netlink-dump.patch nvme-pci-qdepth-1-quirk.patch revert-wifi-cfg80211-check-wiphy-mutex-is-held-for-wdev-mutex.patch x86-mm-switch-to-new-intel-cpu-model-defines.patch --- diff --git a/queue-6.6/bnxt_en-cap-the-size-of-hwrm_port_phy_qcfg-forwarded-response.patch b/queue-6.6/bnxt_en-cap-the-size-of-hwrm_port_phy_qcfg-forwarded-response.patch new file mode 100644 index 00000000000..42996a1d095 --- /dev/null +++ b/queue-6.6/bnxt_en-cap-the-size-of-hwrm_port_phy_qcfg-forwarded-response.patch @@ -0,0 +1,132 @@ +From 7d9df38c9c037ab84502ce7eeae9f1e1e7e72603 Mon Sep 17 00:00:00 2001 +From: Michael Chan +Date: Wed, 12 Jun 2024 16:17:36 -0700 +Subject: bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response + +From: Michael Chan + +commit 7d9df38c9c037ab84502ce7eeae9f1e1e7e72603 upstream. + +Firmware interface 1.10.2.118 has increased the size of +HWRM_PORT_PHY_QCFG response beyond the maximum size that can be +forwarded. When the VF's link state is not the default auto state, +the PF will need to forward the response back to the VF to indicate +the forced state. This regression may cause the VF to fail to +initialize. + +Fix it by capping the HWRM_PORT_PHY_QCFG response to the maximum +96 bytes. The SPEEDS2_SUPPORTED flag needs to be cleared because the +new speeds2 fields are beyond the legacy structure. Also modify +bnxt_hwrm_fwd_resp() to print a warning if the message size exceeds 96 +bytes to make this failure more obvious. + +Fixes: 84a911db8305 ("bnxt_en: Update firmware interface to 1.10.2.118") +Reviewed-by: Somnath Kotur +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Link: https://lore.kernel.org/r/20240612231736.57823-1-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +[Samasth: backport to 6.6.y] +Signed-off-by: Samasth Norway Ananda +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 51 ++++++++++++++++++++++++ + drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 12 ++++- + 2 files changed, 61 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1195,6 +1195,57 @@ struct bnxt_ntuple_filter { + #define BNXT_FLTR_UPDATE 1 + }; + ++/* Compat version of hwrm_port_phy_qcfg_output capped at 96 bytes. The ++ * first 95 bytes are identical to hwrm_port_phy_qcfg_output in bnxt_hsi.h. ++ * The last valid byte in the compat version is different. ++ */ ++struct hwrm_port_phy_qcfg_output_compat { ++ __le16 error_code; ++ __le16 req_type; ++ __le16 seq_id; ++ __le16 resp_len; ++ u8 link; ++ u8 active_fec_signal_mode; ++ __le16 link_speed; ++ u8 duplex_cfg; ++ u8 pause; ++ __le16 support_speeds; ++ __le16 force_link_speed; ++ u8 auto_mode; ++ u8 auto_pause; ++ __le16 auto_link_speed; ++ __le16 auto_link_speed_mask; ++ u8 wirespeed; ++ u8 lpbk; ++ u8 force_pause; ++ u8 module_status; ++ __le32 preemphasis; ++ u8 phy_maj; ++ u8 phy_min; ++ u8 phy_bld; ++ u8 phy_type; ++ u8 media_type; ++ u8 xcvr_pkg_type; ++ u8 eee_config_phy_addr; ++ u8 parallel_detect; ++ __le16 link_partner_adv_speeds; ++ u8 link_partner_adv_auto_mode; ++ u8 link_partner_adv_pause; ++ __le16 adv_eee_link_speed_mask; ++ __le16 link_partner_adv_eee_link_speed_mask; ++ __le32 xcvr_identifier_type_tx_lpi_timer; ++ __le16 fec_cfg; ++ u8 duplex_state; ++ u8 option_flags; ++ char phy_vendor_name[16]; ++ char phy_vendor_partnumber[16]; ++ __le16 support_pam4_speeds; ++ __le16 force_pam4_link_speed; ++ __le16 auto_pam4_link_speed_mask; ++ u8 link_partner_pam4_adv_speeds; ++ u8 valid; ++}; ++ + struct bnxt_link_info { + u8 phy_type; + u8 media_type; +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -942,8 +942,11 @@ static int bnxt_hwrm_fwd_resp(struct bnx + struct hwrm_fwd_resp_input *req; + int rc; + +- if (BNXT_FWD_RESP_SIZE_ERR(msg_size)) ++ if (BNXT_FWD_RESP_SIZE_ERR(msg_size)) { ++ netdev_warn_once(bp->dev, "HWRM fwd response too big (%d bytes)\n", ++ msg_size); + return -EINVAL; ++ } + + rc = hwrm_req_init(bp, req, HWRM_FWD_RESP); + if (!rc) { +@@ -1077,7 +1080,7 @@ static int bnxt_vf_set_link(struct bnxt + rc = bnxt_hwrm_exec_fwd_resp( + bp, vf, sizeof(struct hwrm_port_phy_qcfg_input)); + } else { +- struct hwrm_port_phy_qcfg_output phy_qcfg_resp = {0}; ++ struct hwrm_port_phy_qcfg_output_compat phy_qcfg_resp = {}; + struct hwrm_port_phy_qcfg_input *phy_qcfg_req; + + phy_qcfg_req = +@@ -1088,6 +1091,11 @@ static int bnxt_vf_set_link(struct bnxt + mutex_unlock(&bp->link_lock); + phy_qcfg_resp.resp_len = cpu_to_le16(sizeof(phy_qcfg_resp)); + phy_qcfg_resp.seq_id = phy_qcfg_req->seq_id; ++ /* New SPEEDS2 fields are beyond the legacy structure, so ++ * clear the SPEEDS2_SUPPORTED flag. ++ */ ++ phy_qcfg_resp.option_flags &= ++ ~PORT_PHY_QCAPS_RESP_FLAGS2_SPEEDS2_SUPPORTED; + phy_qcfg_resp.valid = 1; + + if (vf->flags & BNXT_VF_LINK_UP) { diff --git a/queue-6.6/can-mcp251xfd-move-mcp251xfd_timestamp_start-stop-into-mcp251xfd_chip_start-stop.patch b/queue-6.6/can-mcp251xfd-move-mcp251xfd_timestamp_start-stop-into-mcp251xfd_chip_start-stop.patch new file mode 100644 index 00000000000..a29c942265e --- /dev/null +++ b/queue-6.6/can-mcp251xfd-move-mcp251xfd_timestamp_start-stop-into-mcp251xfd_chip_start-stop.patch @@ -0,0 +1,106 @@ +From a7801540f325d104de5065850a003f1d9bdc6ad3 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Wed, 11 Jan 2023 12:10:04 +0100 +Subject: can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into mcp251xfd_chip_start/stop() + +From: Marc Kleine-Budde + +commit a7801540f325d104de5065850a003f1d9bdc6ad3 upstream. + +The mcp251xfd wakes up from Low Power or Sleep Mode when SPI activity +is detected. To avoid this, make sure that the timestamp worker is +stopped before shutting down the chip. + +Split the starting of the timestamp worker out of +mcp251xfd_timestamp_init() into the separate function +mcp251xfd_timestamp_start(). + +Call mcp251xfd_timestamp_init() before mcp251xfd_chip_start(), move +mcp251xfd_timestamp_start() to mcp251xfd_chip_start(). In this way, +mcp251xfd_timestamp_stop() can be called unconditionally by +mcp251xfd_chip_stop(). + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 8 +++++--- + drivers/net/can/spi/mcp251xfd/mcp251xfd-timestamp.c | 7 +++++-- + drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 1 + + 3 files changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +@@ -744,6 +744,7 @@ static void mcp251xfd_chip_stop(struct m + + mcp251xfd_chip_interrupts_disable(priv); + mcp251xfd_chip_rx_int_disable(priv); ++ mcp251xfd_timestamp_stop(priv); + mcp251xfd_chip_sleep(priv); + } + +@@ -763,6 +764,8 @@ static int mcp251xfd_chip_start(struct m + if (err) + goto out_chip_stop; + ++ mcp251xfd_timestamp_start(priv); ++ + err = mcp251xfd_set_bittiming(priv); + if (err) + goto out_chip_stop; +@@ -1610,11 +1613,12 @@ static int mcp251xfd_open(struct net_dev + if (err) + goto out_mcp251xfd_ring_free; + ++ mcp251xfd_timestamp_init(priv); ++ + err = mcp251xfd_chip_start(priv); + if (err) + goto out_transceiver_disable; + +- mcp251xfd_timestamp_init(priv); + clear_bit(MCP251XFD_FLAGS_DOWN, priv->flags); + can_rx_offload_enable(&priv->offload); + +@@ -1648,7 +1652,6 @@ out_destroy_workqueue: + out_can_rx_offload_disable: + can_rx_offload_disable(&priv->offload); + set_bit(MCP251XFD_FLAGS_DOWN, priv->flags); +- mcp251xfd_timestamp_stop(priv); + out_transceiver_disable: + mcp251xfd_transceiver_disable(priv); + out_mcp251xfd_ring_free: +@@ -1674,7 +1677,6 @@ static int mcp251xfd_stop(struct net_dev + free_irq(ndev->irq, priv); + destroy_workqueue(priv->wq); + can_rx_offload_disable(&priv->offload); +- mcp251xfd_timestamp_stop(priv); + mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED); + mcp251xfd_transceiver_disable(priv); + mcp251xfd_ring_free(priv); +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-timestamp.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-timestamp.c +@@ -48,9 +48,12 @@ void mcp251xfd_timestamp_init(struct mcp + cc->shift = 1; + cc->mult = clocksource_hz2mult(priv->can.clock.freq, cc->shift); + +- timecounter_init(&priv->tc, &priv->cc, ktime_get_real_ns()); +- + INIT_DELAYED_WORK(&priv->timestamp, mcp251xfd_timestamp_work); ++} ++ ++void mcp251xfd_timestamp_start(struct mcp251xfd_priv *priv) ++{ ++ timecounter_init(&priv->tc, &priv->cc, ktime_get_real_ns()); + schedule_delayed_work(&priv->timestamp, + MCP251XFD_TIMESTAMP_WORK_DELAY_SEC * HZ); + } +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +@@ -957,6 +957,7 @@ int mcp251xfd_ring_alloc(struct mcp251xf + int mcp251xfd_handle_rxif(struct mcp251xfd_priv *priv); + int mcp251xfd_handle_tefif(struct mcp251xfd_priv *priv); + void mcp251xfd_timestamp_init(struct mcp251xfd_priv *priv); ++void mcp251xfd_timestamp_start(struct mcp251xfd_priv *priv); + void mcp251xfd_timestamp_stop(struct mcp251xfd_priv *priv); + + void mcp251xfd_tx_obj_write_sync(struct work_struct *work); diff --git a/queue-6.6/can-mcp251xfd-properly-indent-labels.patch b/queue-6.6/can-mcp251xfd-properly-indent-labels.patch new file mode 100644 index 00000000000..e08053b5fe1 --- /dev/null +++ b/queue-6.6/can-mcp251xfd-properly-indent-labels.patch @@ -0,0 +1,145 @@ +From 51b2a721612236335ddec4f3fb5f59e72a204f3a Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Thu, 25 Apr 2024 10:14:45 +0200 +Subject: can: mcp251xfd: properly indent labels + +From: Marc Kleine-Budde + +commit 51b2a721612236335ddec4f3fb5f59e72a204f3a upstream. + +To fix the coding style, remove the whitespace in front of labels. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 34 +++++++++++------------ + drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c | 2 - + drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c | 2 - + drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c | 2 - + 4 files changed, 20 insertions(+), 20 deletions(-) + +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +@@ -791,7 +791,7 @@ static int mcp251xfd_chip_start(struct m + + return 0; + +- out_chip_stop: ++out_chip_stop: + mcp251xfd_dump(priv); + mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED); + +@@ -1576,7 +1576,7 @@ static irqreturn_t mcp251xfd_irq(int irq + handled = IRQ_HANDLED; + } while (1); + +- out_fail: ++out_fail: + can_rx_offload_threaded_irq_finish(&priv->offload); + + netdev_err(priv->ndev, "IRQ handler returned %d (intf=0x%08x).\n", +@@ -1641,22 +1641,22 @@ static int mcp251xfd_open(struct net_dev + + return 0; + +- out_free_irq: ++out_free_irq: + free_irq(spi->irq, priv); +- out_destroy_workqueue: ++out_destroy_workqueue: + destroy_workqueue(priv->wq); +- out_can_rx_offload_disable: ++out_can_rx_offload_disable: + can_rx_offload_disable(&priv->offload); + set_bit(MCP251XFD_FLAGS_DOWN, priv->flags); + mcp251xfd_timestamp_stop(priv); +- out_transceiver_disable: ++out_transceiver_disable: + mcp251xfd_transceiver_disable(priv); +- out_mcp251xfd_ring_free: ++out_mcp251xfd_ring_free: + mcp251xfd_ring_free(priv); +- out_pm_runtime_put: ++out_pm_runtime_put: + mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED); + pm_runtime_put(ndev->dev.parent); +- out_close_candev: ++out_close_candev: + close_candev(ndev); + + return err; +@@ -1820,9 +1820,9 @@ mcp251xfd_register_get_dev_id(const stru + *effective_speed_hz_slow = xfer[0].effective_speed_hz; + *effective_speed_hz_fast = xfer[1].effective_speed_hz; + +- out_kfree_buf_tx: ++out_kfree_buf_tx: + kfree(buf_tx); +- out_kfree_buf_rx: ++out_kfree_buf_rx: + kfree(buf_rx); + + return err; +@@ -1936,13 +1936,13 @@ static int mcp251xfd_register(struct mcp + + return 0; + +- out_unregister_candev: ++out_unregister_candev: + unregister_candev(ndev); +- out_chip_sleep: ++out_chip_sleep: + mcp251xfd_chip_sleep(priv); +- out_runtime_disable: ++out_runtime_disable: + pm_runtime_disable(ndev->dev.parent); +- out_runtime_put_noidle: ++out_runtime_put_noidle: + pm_runtime_put_noidle(ndev->dev.parent); + mcp251xfd_clks_and_vdd_disable(priv); + +@@ -2162,9 +2162,9 @@ static int mcp251xfd_probe(struct spi_de + + return 0; + +- out_can_rx_offload_del: ++out_can_rx_offload_del: + can_rx_offload_del(&priv->offload); +- out_free_candev: ++out_free_candev: + spi->max_speed_hz = priv->spi_max_speed_hz_orig; + + free_candev(ndev); +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c +@@ -94,7 +94,7 @@ static void mcp251xfd_dump_registers(con + kfree(buf); + } + +- out: ++out: + mcp251xfd_dump_header(iter, MCP251XFD_DUMP_OBJECT_TYPE_REG, reg); + } + +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c +@@ -397,7 +397,7 @@ mcp251xfd_regmap_crc_read(void *context, + + return err; + } +- out: ++out: + memcpy(val_buf, buf_rx->data, val_len); + + return 0; +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c +@@ -219,7 +219,7 @@ int mcp251xfd_handle_tefif(struct mcp251 + total_frame_len += frame_len; + } + +- out_netif_wake_queue: ++out_netif_wake_queue: + len = i; /* number of handled goods TEFs */ + if (len) { + struct mcp251xfd_tef_ring *ring = priv->tef; diff --git a/queue-6.6/gpiolib-cdev-ignore-reconfiguration-without-direction.patch b/queue-6.6/gpiolib-cdev-ignore-reconfiguration-without-direction.patch new file mode 100644 index 00000000000..d495efa0c2c --- /dev/null +++ b/queue-6.6/gpiolib-cdev-ignore-reconfiguration-without-direction.patch @@ -0,0 +1,68 @@ +From b440396387418fe2feaacd41ca16080e7a8bc9ad Mon Sep 17 00:00:00 2001 +From: Kent Gibson +Date: Wed, 26 Jun 2024 13:29:23 +0800 +Subject: gpiolib: cdev: Ignore reconfiguration without direction + +From: Kent Gibson + +commit b440396387418fe2feaacd41ca16080e7a8bc9ad upstream. + +linereq_set_config() behaves badly when direction is not set. +The configuration validation is borrowed from linereq_create(), where, +to verify the intent of the user, the direction must be set to in order to +effect a change to the electrical configuration of a line. But, when +applied to reconfiguration, that validation does not allow for the unset +direction case, making it possible to clear flags set previously without +specifying the line direction. + +Adding to the inconsistency, those changes are not immediately applied by +linereq_set_config(), but will take effect when the line value is next get +or set. + +For example, by requesting a configuration with no flags set, an output +line with GPIO_V2_LINE_FLAG_ACTIVE_LOW and GPIO_V2_LINE_FLAG_OPEN_DRAIN +set could have those flags cleared, inverting the sense of the line and +changing the line drive to push-pull on the next line value set. + +Skip the reconfiguration of lines for which the direction is not set, and +only reconfigure the lines for which direction is set. + +Fixes: a54756cb24ea ("gpiolib: cdev: support GPIO_V2_LINE_SET_CONFIG_IOCTL") +Signed-off-by: Kent Gibson +Link: https://lore.kernel.org/r/20240626052925.174272-3-warthog618@gmail.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpiolib-cdev.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/gpio/gpiolib-cdev.c ++++ b/drivers/gpio/gpiolib-cdev.c +@@ -1565,12 +1565,14 @@ static long linereq_set_config_unlocked( + line = &lr->lines[i]; + desc = lr->lines[i].desc; + flags = gpio_v2_line_config_flags(lc, i); +- gpio_v2_line_config_flags_to_desc_flags(flags, &desc->flags); +- edflags = flags & GPIO_V2_LINE_EDGE_DETECTOR_FLAGS; + /* +- * Lines have to be requested explicitly for input +- * or output, else the line will be treated "as is". ++ * Lines not explicitly reconfigured as input or output ++ * are left unchanged. + */ ++ if (!(flags & GPIO_V2_LINE_DIRECTION_FLAGS)) ++ continue; ++ gpio_v2_line_config_flags_to_desc_flags(flags, &desc->flags); ++ edflags = flags & GPIO_V2_LINE_EDGE_DETECTOR_FLAGS; + if (flags & GPIO_V2_LINE_FLAG_OUTPUT) { + int val = gpio_v2_line_config_output_value(lc, i); + +@@ -1578,7 +1580,7 @@ static long linereq_set_config_unlocked( + ret = gpiod_direction_output(desc, val); + if (ret) + return ret; +- } else if (flags & GPIO_V2_LINE_FLAG_INPUT) { ++ } else { + ret = gpiod_direction_input(desc); + if (ret) + return ret; diff --git a/queue-6.6/netfilter-nf_tables-missing-iterator-type-in-lookup-walk.patch b/queue-6.6/netfilter-nf_tables-missing-iterator-type-in-lookup-walk.patch new file mode 100644 index 00000000000..3211ba9b044 --- /dev/null +++ b/queue-6.6/netfilter-nf_tables-missing-iterator-type-in-lookup-walk.patch @@ -0,0 +1,45 @@ +From stable+bounces-76608-greg=kroah.com@vger.kernel.org Tue Sep 17 22:25:05 2024 +From: Pablo Neira Ayuso +Date: Tue, 17 Sep 2024 22:24:44 +0200 +Subject: netfilter: nf_tables: missing iterator type in lookup walk +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, sashal@kernel.org, stable@vger.kernel.org +Message-ID: <20240917202444.171526-3-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +commit efefd4f00c967d00ad7abe092554ffbb70c1a793 upstream. + +Add missing decorator type to lookup expression and tighten WARN_ON_ONCE +check in pipapo to spot earlier that this is unset. + +Fixes: 29b359cf6d95 ("netfilter: nft_set_pipapo: walk over current view on netlink dump") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nft_lookup.c | 1 + + net/netfilter/nft_set_pipapo.c | 3 ++- + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/net/netfilter/nft_lookup.c ++++ b/net/netfilter/nft_lookup.c +@@ -217,6 +217,7 @@ static int nft_lookup_validate(const str + return 0; + + iter.genmask = nft_genmask_next(ctx->net); ++ iter.type = NFT_ITER_UPDATE; + iter.skip = 0; + iter.count = 0; + iter.err = 0; +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -2041,7 +2041,8 @@ static void nft_pipapo_walk(const struct + const struct nft_pipapo_field *f; + int i, r; + +- WARN_ON_ONCE(iter->type == NFT_ITER_UNSPEC); ++ WARN_ON_ONCE(iter->type != NFT_ITER_READ && ++ iter->type != NFT_ITER_UPDATE); + + rcu_read_lock(); + if (iter->type == NFT_ITER_READ) diff --git a/queue-6.6/netfilter-nft_set_pipapo-walk-over-current-view-on-netlink-dump.patch b/queue-6.6/netfilter-nft_set_pipapo-walk-over-current-view-on-netlink-dump.patch new file mode 100644 index 00000000000..6813cbf8cde --- /dev/null +++ b/queue-6.6/netfilter-nft_set_pipapo-walk-over-current-view-on-netlink-dump.patch @@ -0,0 +1,114 @@ +From stable+bounces-76607-greg=kroah.com@vger.kernel.org Tue Sep 17 22:25:05 2024 +From: Pablo Neira Ayuso +Date: Tue, 17 Sep 2024 22:24:43 +0200 +Subject: netfilter: nft_set_pipapo: walk over current view on netlink dump +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, sashal@kernel.org, stable@vger.kernel.org +Message-ID: <20240917202444.171526-2-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +commit 29b359cf6d95fd60730533f7f10464e95bd17c73 upstream. + +The generation mask can be updated while netlink dump is in progress. +The pipapo set backend walk iterator cannot rely on it to infer what +view of the datastructure is to be used. Add notation to specify if user +wants to read/update the set. + +Based on patch from Florian Westphal. + +Fixes: 2b84e215f874 ("netfilter: nft_set_pipapo: .walk does not deal with generations") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_tables.h | 13 +++++++++++++ + net/netfilter/nf_tables_api.c | 5 +++++ + net/netfilter/nft_set_pipapo.c | 5 +++-- + 3 files changed, 21 insertions(+), 2 deletions(-) + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -297,9 +297,22 @@ struct nft_set_elem { + void *priv; + }; + ++/** ++ * enum nft_iter_type - nftables set iterator type ++ * ++ * @NFT_ITER_READ: read-only iteration over set elements ++ * @NFT_ITER_UPDATE: iteration under mutex to update set element state ++ */ ++enum nft_iter_type { ++ NFT_ITER_UNSPEC, ++ NFT_ITER_READ, ++ NFT_ITER_UPDATE, ++}; ++ + struct nft_set; + struct nft_set_iter { + u8 genmask; ++ enum nft_iter_type type:8; + unsigned int count; + unsigned int skip; + int err; +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -628,6 +628,7 @@ static void nft_map_deactivate(const str + { + struct nft_set_iter iter = { + .genmask = nft_genmask_next(ctx->net), ++ .type = NFT_ITER_UPDATE, + .fn = nft_mapelem_deactivate, + }; + +@@ -5392,6 +5393,7 @@ int nf_tables_bind_set(const struct nft_ + } + + iter.genmask = nft_genmask_next(ctx->net); ++ iter.type = NFT_ITER_UPDATE; + iter.skip = 0; + iter.count = 0; + iter.err = 0; +@@ -5467,6 +5469,7 @@ static void nft_map_activate(const struc + { + struct nft_set_iter iter = { + .genmask = nft_genmask_next(ctx->net), ++ .type = NFT_ITER_UPDATE, + .fn = nft_mapelem_activate, + }; + +@@ -5845,6 +5848,7 @@ static int nf_tables_dump_set(struct sk_ + args.skb = skb; + args.reset = reset; + args.iter.genmask = nft_genmask_cur(net); ++ args.iter.type = NFT_ITER_READ; + args.iter.skip = cb->args[0]; + args.iter.count = 0; + args.iter.err = 0; +@@ -7246,6 +7250,7 @@ static int nft_set_flush(struct nft_ctx + { + struct nft_set_iter iter = { + .genmask = genmask, ++ .type = NFT_ITER_UPDATE, + .fn = nft_setelem_flush, + }; + +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -2037,13 +2037,14 @@ static void nft_pipapo_walk(const struct + struct nft_set_iter *iter) + { + struct nft_pipapo *priv = nft_set_priv(set); +- struct net *net = read_pnet(&set->net); + const struct nft_pipapo_match *m; + const struct nft_pipapo_field *f; + int i, r; + ++ WARN_ON_ONCE(iter->type == NFT_ITER_UNSPEC); ++ + rcu_read_lock(); +- if (iter->genmask == nft_genmask_cur(net)) ++ if (iter->type == NFT_ITER_READ) + m = rcu_dereference(priv->match); + else + m = priv->clone; diff --git a/queue-6.6/nvme-pci-qdepth-1-quirk.patch b/queue-6.6/nvme-pci-qdepth-1-quirk.patch new file mode 100644 index 00000000000..d6919b90fcd --- /dev/null +++ b/queue-6.6/nvme-pci-qdepth-1-quirk.patch @@ -0,0 +1,84 @@ +From 83bdfcbdbe5d901c5fa432decf12e1725a840a56 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Wed, 11 Sep 2024 10:39:59 -0700 +Subject: nvme-pci: qdepth 1 quirk + +From: Keith Busch + +commit 83bdfcbdbe5d901c5fa432decf12e1725a840a56 upstream. + +Another device has been reported to be unreliable if we have more than +one outstanding command. In this new case, data corruption may occur. +Since we have two devices now needing this quirky behavior, make a +generic quirk flag. + +The same Apple quirk is clearly not "temporary", so update the comment +while moving it. + +Link: https://lore.kernel.org/linux-nvme/191d810a4e3.fcc6066c765804.973611676137075390@collabora.com/ +Reported-by: Robert Beckett +Reviewed-by: Christoph Hellwig hch@lst.de> +Signed-off-by: Keith Busch +Cc: "Gagniuc, Alexandru" +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/nvme.h | 5 +++++ + drivers/nvme/host/pci.c | 18 +++++++++--------- + 2 files changed, 14 insertions(+), 9 deletions(-) + +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -89,6 +89,11 @@ enum nvme_quirks { + NVME_QUIRK_NO_DEEPEST_PS = (1 << 5), + + /* ++ * Problems seen with concurrent commands ++ */ ++ NVME_QUIRK_QDEPTH_ONE = (1 << 6), ++ ++ /* + * Set MEDIUM priority on SQ creation + */ + NVME_QUIRK_MEDIUM_PRIO_SQ = (1 << 7), +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2526,15 +2526,8 @@ static int nvme_pci_enable(struct nvme_d + else + dev->io_sqes = NVME_NVM_IOSQES; + +- /* +- * Temporary fix for the Apple controller found in the MacBook8,1 and +- * some MacBook7,1 to avoid controller resets and data loss. +- */ +- if (pdev->vendor == PCI_VENDOR_ID_APPLE && pdev->device == 0x2001) { ++ if (dev->ctrl.quirks & NVME_QUIRK_QDEPTH_ONE) { + dev->q_depth = 2; +- dev_warn(dev->ctrl.device, "detected Apple NVMe controller, " +- "set queue depth=%u to work around controller resets\n", +- dev->q_depth); + } else if (pdev->vendor == PCI_VENDOR_ID_SAMSUNG && + (pdev->device == 0xa821 || pdev->device == 0xa822) && + NVME_CAP_MQES(dev->ctrl.cap) == 0) { +@@ -3399,6 +3392,8 @@ static const struct pci_device_id nvme_i + NVME_QUIRK_BOGUS_NID, }, + { PCI_VDEVICE(REDHAT, 0x0010), /* Qemu emulated controller */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, ++ { PCI_DEVICE(0x1217, 0x8760), /* O2 Micro 64GB Steam Deck */ ++ .driver_data = NVME_QUIRK_QDEPTH_ONE }, + { PCI_DEVICE(0x126f, 0x2262), /* Silicon Motion generic */ + .driver_data = NVME_QUIRK_NO_DEEPEST_PS | + NVME_QUIRK_BOGUS_NID, }, +@@ -3531,7 +3526,12 @@ static const struct pci_device_id nvme_i + { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0xcd02), + .driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001), +- .driver_data = NVME_QUIRK_SINGLE_VECTOR }, ++ /* ++ * Fix for the Apple controller found in the MacBook8,1 and ++ * some MacBook7,1 to avoid controller resets and data loss. ++ */ ++ .driver_data = NVME_QUIRK_SINGLE_VECTOR | ++ NVME_QUIRK_QDEPTH_ONE }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005), + .driver_data = NVME_QUIRK_SINGLE_VECTOR | diff --git a/queue-6.6/revert-wifi-cfg80211-check-wiphy-mutex-is-held-for-wdev-mutex.patch b/queue-6.6/revert-wifi-cfg80211-check-wiphy-mutex-is-held-for-wdev-mutex.patch new file mode 100644 index 00000000000..34a900e518d --- /dev/null +++ b/queue-6.6/revert-wifi-cfg80211-check-wiphy-mutex-is-held-for-wdev-mutex.patch @@ -0,0 +1,67 @@ +From pkshih@realtek.com Fri Sep 27 09:45:55 2024 +From: Ping-Ke Shih +Date: Thu, 26 Sep 2024 08:30:17 +0800 +Subject: Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex" +To: +Cc: , +Message-ID: <20240926003017.5427-1-pkshih@realtek.com> + +From: Ping-Ke Shih + +This reverts commit 268f84a827534c4e4c2540a4e29daa73359fc0a5 which is +commmit 1474bc87fe57deac726cc10203f73daa6c3212f7 upstream. + +The reverted commit is based on implementation of wiphy locking that isn't +planned to redo on a stable kernel, so revert it to avoid warning: + + WARNING: CPU: 0 PID: 9 at net/wireless/core.h:231 disconnect_work+0xb8/0x144 [cfg80211] + CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.6.51-00141-ga1649b6f8ed6 #7 + Hardware name: Freescale i.MX6 SoloX (Device Tree) + Workqueue: events disconnect_work [cfg80211] + unwind_backtrace from show_stack+0x10/0x14 + show_stack from dump_stack_lvl+0x58/0x70 + dump_stack_lvl from __warn+0x70/0x1c0 + __warn from warn_slowpath_fmt+0x16c/0x294 + warn_slowpath_fmt from disconnect_work+0xb8/0x144 [cfg80211] + disconnect_work [cfg80211] from process_one_work+0x204/0x620 + process_one_work from worker_thread+0x1b0/0x474 + worker_thread from kthread+0x10c/0x12c + kthread from ret_from_fork+0x14/0x24 + +Reported-by: petter@technux.se +Closes: https://lore.kernel.org/linux-wireless/9e98937d781c990615ef27ee0c858ff9@technux.se/T/#t +Cc: Johannes Berg +Signed-off-by: Ping-Ke Shih +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/core.h | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/net/wireless/core.h ++++ b/net/wireless/core.h +@@ -228,7 +228,6 @@ void cfg80211_register_wdev(struct cfg80 + static inline void wdev_lock(struct wireless_dev *wdev) + __acquires(wdev) + { +- lockdep_assert_held(&wdev->wiphy->mtx); + mutex_lock(&wdev->mtx); + __acquire(wdev->mtx); + } +@@ -236,16 +235,11 @@ static inline void wdev_lock(struct wire + static inline void wdev_unlock(struct wireless_dev *wdev) + __releases(wdev) + { +- lockdep_assert_held(&wdev->wiphy->mtx); + __release(wdev->mtx); + mutex_unlock(&wdev->mtx); + } + +-static inline void ASSERT_WDEV_LOCK(struct wireless_dev *wdev) +-{ +- lockdep_assert_held(&wdev->wiphy->mtx); +- lockdep_assert_held(&wdev->mtx); +-} ++#define ASSERT_WDEV_LOCK(wdev) lockdep_assert_held(&(wdev)->mtx) + + static inline bool cfg80211_has_monitors_only(struct cfg80211_registered_device *rdev) + { diff --git a/queue-6.6/series b/queue-6.6/series index abed7ce7d07..a5953968a98 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -42,3 +42,12 @@ drm-expand-max-drm-device-number-to-full-minorbits.patch powercap-intel_rapl-add-support-for-amd-family-1ah.patch netfilter-nft_socket-make-cgroupsv2-matching-work-with-namespaces.patch netfilter-nft_socket-fix-a-null-vs-is_err-bug-in-nft_socket_cgroup_subtree_level.patch +bnxt_en-cap-the-size-of-hwrm_port_phy_qcfg-forwarded-response.patch +netfilter-nft_set_pipapo-walk-over-current-view-on-netlink-dump.patch +netfilter-nf_tables-missing-iterator-type-in-lookup-walk.patch +revert-wifi-cfg80211-check-wiphy-mutex-is-held-for-wdev-mutex.patch +gpiolib-cdev-ignore-reconfiguration-without-direction.patch +nvme-pci-qdepth-1-quirk.patch +x86-mm-switch-to-new-intel-cpu-model-defines.patch +can-mcp251xfd-properly-indent-labels.patch +can-mcp251xfd-move-mcp251xfd_timestamp_start-stop-into-mcp251xfd_chip_start-stop.patch diff --git a/queue-6.6/x86-mm-switch-to-new-intel-cpu-model-defines.patch b/queue-6.6/x86-mm-switch-to-new-intel-cpu-model-defines.patch new file mode 100644 index 00000000000..53bdfa07a4b --- /dev/null +++ b/queue-6.6/x86-mm-switch-to-new-intel-cpu-model-defines.patch @@ -0,0 +1,55 @@ +From 2eda374e883ad297bd9fe575a16c1dc850346075 Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Wed, 24 Apr 2024 11:15:18 -0700 +Subject: x86/mm: Switch to new Intel CPU model defines + +From: Tony Luck + +commit 2eda374e883ad297bd9fe575a16c1dc850346075 upstream. + +New CPU #defines encode vendor and family as well as model. + +[ dhansen: vertically align 0's in invlpg_miss_ids[] ] + +Signed-off-by: Tony Luck +Signed-off-by: Dave Hansen +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/all/20240424181518.41946-1-tony.luck%40intel.com +[ Ricardo: I used the old match macro X86_MATCH_INTEL_FAM6_MODEL() + instead of X86_MATCH_VFM() as in the upstream commit. ] +Signed-off-by: Ricardo Neri +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/mm/init.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -261,21 +261,17 @@ static void __init probe_page_size_mask( + } + } + +-#define INTEL_MATCH(_model) { .vendor = X86_VENDOR_INTEL, \ +- .family = 6, \ +- .model = _model, \ +- } + /* + * INVLPG may not properly flush Global entries + * on these CPUs when PCIDs are enabled. + */ + static const struct x86_cpu_id invlpg_miss_ids[] = { +- INTEL_MATCH(INTEL_FAM6_ALDERLAKE ), +- INTEL_MATCH(INTEL_FAM6_ALDERLAKE_L ), +- INTEL_MATCH(INTEL_FAM6_ATOM_GRACEMONT ), +- INTEL_MATCH(INTEL_FAM6_RAPTORLAKE ), +- INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_P), +- INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_S), ++ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE, 0), ++ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, 0), ++ X86_MATCH_INTEL_FAM6_MODEL(ATOM_GRACEMONT, 0), ++ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, 0), ++ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, 0), ++ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, 0), + {} + }; +