From: Sasha Levin Date: Wed, 29 Nov 2023 02:49:10 +0000 (-0500) Subject: Fixes for 6.6 X-Git-Tag: v5.15.141~45 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=16367a14b3546c439f1fa06e3b92795e175c7682;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/accel-ivpu-37xx-fix-hangs-related-to-mmio-reset.patch b/queue-6.6/accel-ivpu-37xx-fix-hangs-related-to-mmio-reset.patch new file mode 100644 index 00000000000..98c55b6360a --- /dev/null +++ b/queue-6.6/accel-ivpu-37xx-fix-hangs-related-to-mmio-reset.patch @@ -0,0 +1,113 @@ +From 3d2529dce749f241f43f2e87e5d7a9866ce8b72d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 12:10:04 +0100 +Subject: accel/ivpu/37xx: Fix hangs related to MMIO reset + +From: Jacek Lawrynowicz + +[ Upstream commit 3f7c0634926daf48cd2f6db6c1197a1047074088 ] + +There is no need to call MMIO reset using VPU_37XX_BUTTRESS_VPU_IP_RESET +register. IP will be reset by FLR or by entering d0i3. Also IP reset +during power_up is not needed as the VPU is already in reset. + +Removing MMIO reset improves stability as it a partial device reset +that is not safe in some corner cases. + +This change also brings back ivpu_boot_pwr_domain_disable() that +helps to properly power down VPU when it is hung by a buggy workload. + +Signed-off-by: Jacek Lawrynowicz +Fixes: 828d63042aec ("accel/ivpu: Don't enter d0i3 during FLR") +Reviewed-by: Jeffrey Hugo +Link: https://patchwork.freedesktop.org/patch/msgid/20231115111004.1304092-1-jacek.lawrynowicz@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/accel/ivpu/ivpu_hw_37xx.c | 46 +++++++++++++++---------------- + 1 file changed, 22 insertions(+), 24 deletions(-) + +diff --git a/drivers/accel/ivpu/ivpu_hw_37xx.c b/drivers/accel/ivpu/ivpu_hw_37xx.c +index cb9f0196e3ddf..b8010c07eec17 100644 +--- a/drivers/accel/ivpu/ivpu_hw_37xx.c ++++ b/drivers/accel/ivpu/ivpu_hw_37xx.c +@@ -536,6 +536,16 @@ static int ivpu_boot_pwr_domain_enable(struct ivpu_device *vdev) + return ret; + } + ++static int ivpu_boot_pwr_domain_disable(struct ivpu_device *vdev) ++{ ++ ivpu_boot_dpu_active_drive(vdev, false); ++ ivpu_boot_pwr_island_isolation_drive(vdev, true); ++ ivpu_boot_pwr_island_trickle_drive(vdev, false); ++ ivpu_boot_pwr_island_drive(vdev, false); ++ ++ return ivpu_boot_wait_for_pwr_island_status(vdev, 0x0); ++} ++ + static void ivpu_boot_no_snoop_enable(struct ivpu_device *vdev) + { + u32 val = REGV_RD32(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES); +@@ -634,25 +644,17 @@ static int ivpu_hw_37xx_info_init(struct ivpu_device *vdev) + + static int ivpu_hw_37xx_reset(struct ivpu_device *vdev) + { +- int ret; +- u32 val; +- +- if (IVPU_WA(punit_disabled)) +- return 0; ++ int ret = 0; + +- ret = REGB_POLL_FLD(VPU_37XX_BUTTRESS_VPU_IP_RESET, TRIGGER, 0, TIMEOUT_US); +- if (ret) { +- ivpu_err(vdev, "Timed out waiting for TRIGGER bit\n"); +- return ret; ++ if (ivpu_boot_pwr_domain_disable(vdev)) { ++ ivpu_err(vdev, "Failed to disable power domain\n"); ++ ret = -EIO; + } + +- val = REGB_RD32(VPU_37XX_BUTTRESS_VPU_IP_RESET); +- val = REG_SET_FLD(VPU_37XX_BUTTRESS_VPU_IP_RESET, TRIGGER, val); +- REGB_WR32(VPU_37XX_BUTTRESS_VPU_IP_RESET, val); +- +- ret = REGB_POLL_FLD(VPU_37XX_BUTTRESS_VPU_IP_RESET, TRIGGER, 0, TIMEOUT_US); +- if (ret) +- ivpu_err(vdev, "Timed out waiting for RESET completion\n"); ++ if (ivpu_pll_disable(vdev)) { ++ ivpu_err(vdev, "Failed to disable PLL\n"); ++ ret = -EIO; ++ } + + return ret; + } +@@ -685,10 +687,6 @@ static int ivpu_hw_37xx_power_up(struct ivpu_device *vdev) + { + int ret; + +- ret = ivpu_hw_37xx_reset(vdev); +- if (ret) +- ivpu_warn(vdev, "Failed to reset HW: %d\n", ret); +- + ret = ivpu_hw_37xx_d0i3_disable(vdev); + if (ret) + ivpu_warn(vdev, "Failed to disable D0I3: %d\n", ret); +@@ -756,11 +754,11 @@ static int ivpu_hw_37xx_power_down(struct ivpu_device *vdev) + { + int ret = 0; + +- if (!ivpu_hw_37xx_is_idle(vdev) && ivpu_hw_37xx_reset(vdev)) +- ivpu_err(vdev, "Failed to reset the VPU\n"); ++ if (!ivpu_hw_37xx_is_idle(vdev)) ++ ivpu_warn(vdev, "VPU not idle during power down\n"); + +- if (ivpu_pll_disable(vdev)) { +- ivpu_err(vdev, "Failed to disable PLL\n"); ++ if (ivpu_hw_37xx_reset(vdev)) { ++ ivpu_err(vdev, "Failed to reset VPU\n"); + ret = -EIO; + } + +-- +2.42.0 + diff --git a/queue-6.6/accel-ivpu-do-not-initialize-parameters-on-power-up.patch b/queue-6.6/accel-ivpu-do-not-initialize-parameters-on-power-up.patch new file mode 100644 index 00000000000..b2af4b2f7b1 --- /dev/null +++ b/queue-6.6/accel-ivpu-do-not-initialize-parameters-on-power-up.patch @@ -0,0 +1,78 @@ +From f2d446960c6e327be2c2c9ec6d18b67d93914e12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 12:45:00 +0200 +Subject: accel/ivpu: Do not initialize parameters on power up + +From: Stanislaw Gruszka + +[ Upstream commit f956bf2080862cfc97412e1eaa08689bc9838d20 ] + +Initialize HW specific parameters only once. We do not have to do this +on every power_up (performed during initialization and on resume). Move +corresponding code to ->info_init() + +Reviewed-by: Jeffrey Hugo +Signed-off-by: Stanislaw Gruszka +Link: https://patchwork.freedesktop.org/patch/msgid/20231020104501.697763-6-stanislaw.gruszka@linux.intel.com +Stable-dep-of: 3f7c0634926d ("accel/ivpu/37xx: Fix hangs related to MMIO reset") +Signed-off-by: Sasha Levin +--- + drivers/accel/ivpu/ivpu_hw_37xx.c | 8 ++++---- + drivers/accel/ivpu/ivpu_hw_40xx.c | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/accel/ivpu/ivpu_hw_37xx.c b/drivers/accel/ivpu/ivpu_hw_37xx.c +index 18be8b98e9a8b..cb9f0196e3ddf 100644 +--- a/drivers/accel/ivpu/ivpu_hw_37xx.c ++++ b/drivers/accel/ivpu/ivpu_hw_37xx.c +@@ -625,6 +625,10 @@ static int ivpu_hw_37xx_info_init(struct ivpu_device *vdev) + ivpu_hw_init_range(&hw->ranges.shave, 0x180000000, SZ_2G); + ivpu_hw_init_range(&hw->ranges.dma, 0x200000000, SZ_8G); + ++ ivpu_hw_read_platform(vdev); ++ ivpu_hw_wa_init(vdev); ++ ivpu_hw_timeouts_init(vdev); ++ + return 0; + } + +@@ -681,10 +685,6 @@ static int ivpu_hw_37xx_power_up(struct ivpu_device *vdev) + { + int ret; + +- ivpu_hw_read_platform(vdev); +- ivpu_hw_wa_init(vdev); +- ivpu_hw_timeouts_init(vdev); +- + ret = ivpu_hw_37xx_reset(vdev); + if (ret) + ivpu_warn(vdev, "Failed to reset HW: %d\n", ret); +diff --git a/drivers/accel/ivpu/ivpu_hw_40xx.c b/drivers/accel/ivpu/ivpu_hw_40xx.c +index 85171a408363f..7c3ff25232a2c 100644 +--- a/drivers/accel/ivpu/ivpu_hw_40xx.c ++++ b/drivers/accel/ivpu/ivpu_hw_40xx.c +@@ -728,6 +728,10 @@ static int ivpu_hw_40xx_info_init(struct ivpu_device *vdev) + ivpu_hw_init_range(&vdev->hw->ranges.shave, 0x80000000 + SZ_256M, SZ_2G - SZ_256M); + ivpu_hw_init_range(&vdev->hw->ranges.dma, 0x200000000, SZ_8G); + ++ ivpu_hw_read_platform(vdev); ++ ivpu_hw_wa_init(vdev); ++ ivpu_hw_timeouts_init(vdev); ++ + return 0; + } + +@@ -819,10 +823,6 @@ static int ivpu_hw_40xx_power_up(struct ivpu_device *vdev) + return ret; + } + +- ivpu_hw_read_platform(vdev); +- ivpu_hw_wa_init(vdev); +- ivpu_hw_timeouts_init(vdev); +- + ret = ivpu_hw_40xx_d0i3_disable(vdev); + if (ret) + ivpu_warn(vdev, "Failed to disable D0I3: %d\n", ret); +-- +2.42.0 + diff --git a/queue-6.6/afs-fix-afs_server_list-to-be-cleaned-up-with-rcu.patch b/queue-6.6/afs-fix-afs_server_list-to-be-cleaned-up-with-rcu.patch new file mode 100644 index 00000000000..5124802ad46 --- /dev/null +++ b/queue-6.6/afs-fix-afs_server_list-to-be-cleaned-up-with-rcu.patch @@ -0,0 +1,52 @@ +From f1b8d96049feea4753e7717fbeb38632d692c735 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Nov 2023 16:26:59 +0000 +Subject: afs: Fix afs_server_list to be cleaned up with RCU + +From: David Howells + +[ Upstream commit e6bace7313d61e31f2b16fa3d774fd8cb3cb869e ] + +afs_server_list is accessed with the rcu_read_lock() held from +volume->servers, so it needs to be cleaned up correctly. + +Fix this by using kfree_rcu() instead of kfree(). + +Fixes: 8a070a964877 ("afs: Detect cell aliases 1 - Cells with root volumes") +Signed-off-by: David Howells +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + fs/afs/internal.h | 1 + + fs/afs/server_list.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index da73b97e19a9a..5041eae64423a 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -553,6 +553,7 @@ struct afs_server_entry { + }; + + struct afs_server_list { ++ struct rcu_head rcu; + afs_volid_t vids[AFS_MAXTYPES]; /* Volume IDs */ + refcount_t usage; + unsigned char nr_servers; +diff --git a/fs/afs/server_list.c b/fs/afs/server_list.c +index ed9056703505f..b59896b1de0af 100644 +--- a/fs/afs/server_list.c ++++ b/fs/afs/server_list.c +@@ -17,7 +17,7 @@ void afs_put_serverlist(struct afs_net *net, struct afs_server_list *slist) + for (i = 0; i < slist->nr_servers; i++) + afs_unuse_server(net, slist->servers[i].server, + afs_server_trace_put_slist); +- kfree(slist); ++ kfree_rcu(slist, rcu); + } + } + +-- +2.42.0 + diff --git a/queue-6.6/afs-fix-file-locking-on-r-o-volumes-to-operate-in-lo.patch b/queue-6.6/afs-fix-file-locking-on-r-o-volumes-to-operate-in-lo.patch new file mode 100644 index 00000000000..0a1b2694220 --- /dev/null +++ b/queue-6.6/afs-fix-file-locking-on-r-o-volumes-to-operate-in-lo.patch @@ -0,0 +1,44 @@ +From 81b7f5c3bb372b82823691470104ee84b3fec504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Nov 2023 22:03:28 +0000 +Subject: afs: Fix file locking on R/O volumes to operate in local mode + +From: David Howells + +[ Upstream commit b590eb41be766c5a63acc7e8896a042f7a4e8293 ] + +AFS doesn't really do locking on R/O volumes as fileservers don't maintain +state with each other and thus a lock on a R/O volume file on one +fileserver will not be be visible to someone looking at the same file on +another fileserver. + +Further, the server may return an error if you try it. + +Fix this by doing what other AFS clients do and handle filelocking on R/O +volume files entirely within the client and don't touch the server. + +Fixes: 6c6c1d63c243 ("afs: Provide mount-time configurable byte-range file locking emulation") +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + fs/afs/super.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/afs/super.c b/fs/afs/super.c +index 95d713074dc81..e95fb4cb4fcd2 100644 +--- a/fs/afs/super.c ++++ b/fs/afs/super.c +@@ -407,6 +407,8 @@ static int afs_validate_fc(struct fs_context *fc) + return PTR_ERR(volume); + + ctx->volume = volume; ++ if (volume->type != AFSVL_RWVOL) ++ ctx->flock_mode = afs_flock_mode_local; + } + + return 0; +-- +2.42.0 + diff --git a/queue-6.6/afs-make-error-on-cell-lookup-failure-consistent-wit.patch b/queue-6.6/afs-make-error-on-cell-lookup-failure-consistent-wit.patch new file mode 100644 index 00000000000..998d135c91e --- /dev/null +++ b/queue-6.6/afs-make-error-on-cell-lookup-failure-consistent-wit.patch @@ -0,0 +1,49 @@ +From 64d061c2aef3f63e97b878915bac9bac97ef17b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 09:43:54 +0100 +Subject: afs: Make error on cell lookup failure consistent with OpenAFS + +From: David Howells + +[ Upstream commit 2a4ca1b4b77850544408595e2433f5d7811a9daa ] + +When kafs tries to look up a cell in the DNS or the local config, it will +translate a lookup failure into EDESTADDRREQ whereas OpenAFS translates it +into ENOENT. Applications such as West expect the latter behaviour and +fail if they see the former. + +This can be seen by trying to mount an unknown cell: + + # mount -t afs %example.com:cell.root /mnt + mount: /mnt: mount(2) system call failed: Destination address required. + +Fixes: 4d673da14533 ("afs: Support the AFS dynamic root") +Reported-by: Markus Suvanto +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216637 +Signed-off-by: David Howells +Reviewed-by: Jeffrey Altman +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + fs/afs/dynroot.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c +index 95bcbd7654d1b..8081d68004d05 100644 +--- a/fs/afs/dynroot.c ++++ b/fs/afs/dynroot.c +@@ -132,8 +132,8 @@ static int afs_probe_cell_name(struct dentry *dentry) + + ret = dns_query(net->net, "afsdb", name, len, "srv=1", + NULL, NULL, false); +- if (ret == -ENODATA) +- ret = -EDESTADDRREQ; ++ if (ret == -ENODATA || ret == -ENOKEY) ++ ret = -ENOENT; + return ret; + } + +-- +2.42.0 + diff --git a/queue-6.6/afs-return-enoent-if-no-cell-dns-record-can-be-found.patch b/queue-6.6/afs-return-enoent-if-no-cell-dns-record-can-be-found.patch new file mode 100644 index 00000000000..eced3f5ba2b --- /dev/null +++ b/queue-6.6/afs-return-enoent-if-no-cell-dns-record-can-be-found.patch @@ -0,0 +1,64 @@ +From 8f2f09217a6bd4a3845b9f61599e91df9c0beca9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Oct 2023 01:25:07 +0100 +Subject: afs: Return ENOENT if no cell DNS record can be found + +From: David Howells + +[ Upstream commit 0167236e7d66c5e1e85d902a6abc2529b7544539 ] + +Make AFS return error ENOENT if no cell SRV or AFSDB DNS record (or +cellservdb config file record) can be found rather than returning +EDESTADDRREQ. + +Also add cell name lookup info to the cursor dump. + +Fixes: d5c32c89b208 ("afs: Fix cell DNS lookup") +Reported-by: Markus Suvanto +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216637 +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + fs/afs/vl_rotate.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/afs/vl_rotate.c b/fs/afs/vl_rotate.c +index 488e58490b16e..eb415ce563600 100644 +--- a/fs/afs/vl_rotate.c ++++ b/fs/afs/vl_rotate.c +@@ -58,6 +58,12 @@ static bool afs_start_vl_iteration(struct afs_vl_cursor *vc) + } + + /* Status load is ordered after lookup counter load */ ++ if (cell->dns_status == DNS_LOOKUP_GOT_NOT_FOUND) { ++ pr_warn("No record of cell %s\n", cell->name); ++ vc->error = -ENOENT; ++ return false; ++ } ++ + if (cell->dns_source == DNS_RECORD_UNAVAILABLE) { + vc->error = -EDESTADDRREQ; + return false; +@@ -285,6 +291,7 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc) + */ + static void afs_vl_dump_edestaddrreq(const struct afs_vl_cursor *vc) + { ++ struct afs_cell *cell = vc->cell; + static int count; + int i; + +@@ -294,6 +301,9 @@ static void afs_vl_dump_edestaddrreq(const struct afs_vl_cursor *vc) + + rcu_read_lock(); + pr_notice("EDESTADDR occurred\n"); ++ pr_notice("CELL: %s err=%d\n", cell->name, cell->error); ++ pr_notice("DNS: src=%u st=%u lc=%x\n", ++ cell->dns_source, cell->dns_status, cell->dns_lookup_count); + pr_notice("VC: ut=%lx ix=%u ni=%hu fl=%hx err=%hd\n", + vc->untried, vc->index, vc->nr_iterations, vc->flags, vc->error); + +-- +2.42.0 + diff --git a/queue-6.6/alsa-hda-asus-um5302la-added-quirks-for-cs35l41-1043.patch b/queue-6.6/alsa-hda-asus-um5302la-added-quirks-for-cs35l41-1043.patch new file mode 100644 index 00000000000..45a022b679c --- /dev/null +++ b/queue-6.6/alsa-hda-asus-um5302la-added-quirks-for-cs35l41-1043.patch @@ -0,0 +1,71 @@ +From 57ec8d3559af52f2b9f5db92d1863517aa6d13fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Nov 2023 01:13:54 +0200 +Subject: ALSA: hda: ASUS UM5302LA: Added quirks for cs35L41/10431A83 on i2c + bus + +From: Vitalii Torshyn + +[ Upstream commit 6ae90e906aed727759b88eb2b000fcdc8fcd94a3 ] + +Proposed patch fixes initialization of CSC3551 on the UM5302LA laptop. +Patching DSDT table is not required since ASUS did added _DSD entry. +Nothing new introduced but reused work started by Stefan B. + +Currently there is no official firmware available for 10431A83 on +cirrus git unfortunately. +For testing used 104317f3 (which is also seems on i2c bus): + +$ cd /lib/firmware/cirrus/ && \ +for fw in $(find ./ -name '*104317f3*'); do newfw=$(echo $fw | sed 's/104317f3/10431a83/g'); echo echo "$fw -> $newfw"; ln -s $f $newfw; done + +With the patch applied to 6.6.0 and obviously symlinks to 104317F3 FW, +speakers works and to my susrprise they sound quite good and loud +without distortion. + +Probably confirmation from cirrus team is needed on firmware. + +Signed-off-by: Vitalii Torshyn +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218119 +Link: https://lore.kernel.org/r/CAHiQ-bCMPpCJ8eOYAaVVoqGkFixS1qTgSS4xfbZvL4oZV9LYew@mail.gmail.com +Signed-off-by: Takashi Iwai +Stable-dep-of: 61cbc08fdb04 ("ALSA: hda/realtek: Add quirks for ASUS 2024 Zenbooks") +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 14fc4191fe77f..60e99389bcdcd 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7366,6 +7366,7 @@ enum { + ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD, + ALC2XX_FIXUP_HEADSET_MIC, + ALC289_FIXUP_DELL_CS35L41_SPI_2, ++ ALC294_FIXUP_CS35L41_I2C_2, + }; + + /* A special fixup for Lenovo C940 and Yoga Duet 7; +@@ -9495,6 +9496,10 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC289_FIXUP_DUAL_SPK + }, ++ [ALC294_FIXUP_CS35L41_I2C_2] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cs35l41_fixup_i2c_two, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -9864,6 +9869,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B), + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), +-- +2.42.0 + diff --git a/queue-6.6/alsa-hda-realtek-add-quirks-for-asus-2024-zenbooks.patch b/queue-6.6/alsa-hda-realtek-add-quirks-for-asus-2024-zenbooks.patch new file mode 100644 index 00000000000..851079ce2e1 --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-add-quirks-for-asus-2024-zenbooks.patch @@ -0,0 +1,47 @@ +From 0999d791040ed4971b77aff97aa7136da977b517 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 16:21:15 +0000 +Subject: ALSA: hda/realtek: Add quirks for ASUS 2024 Zenbooks + +From: Stefan Binding + +[ Upstream commit 61cbc08fdb04fd445458b0f4cba7e6929afdfaef ] + +These ASUS Zenbook laptops use Realtek HDA codec combined with +2xCS35L41 Amplifiers using SPI or I2C with External Boost or +Internal Boost. + +Signed-off-by: Stefan Binding +Cc: +Link: https://lore.kernel.org/r/20231115162116.494968-2-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 60e99389bcdcd..87bc1d2f8a432 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9869,13 +9869,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B), + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1043, 0x1b93, "ASUS G614JVR/JIR", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1043, 0x1c03, "ASUS UM3406HA", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x1043, 0x1c33, "ASUS UX5304MA", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x1c43, "ASUS UX8406MA", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS), + SND_PCI_QUIRK(0x1043, 0x1c9f, "ASUS G614JI", ALC285_FIXUP_ASUS_HEADSET_MIC), +-- +2.42.0 + diff --git a/queue-6.6/amd-xgbe-handle-corner-case-during-sfp-hotplug.patch b/queue-6.6/amd-xgbe-handle-corner-case-during-sfp-hotplug.patch new file mode 100644 index 00000000000..ed8408ad62f --- /dev/null +++ b/queue-6.6/amd-xgbe-handle-corner-case-during-sfp-hotplug.patch @@ -0,0 +1,55 @@ +From e6f10e6abc5e70223662d7506dad74f85ea7a5f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 00:44:33 +0530 +Subject: amd-xgbe: handle corner-case during sfp hotplug + +From: Raju Rangoju + +[ Upstream commit 676ec53844cbdf2f47e68a076cdff7f0ec6cbe3f ] + +Force the mode change for SFI in Fixed PHY configurations. Fixed PHY +configurations needs PLL to be enabled while doing mode set. When the +SFP module isn't connected during boot, driver assumes AN is ON and +attempts auto-negotiation. However, if the connected SFP comes up in +Fixed PHY configuration the link will not come up as PLL isn't enabled +while the initial mode set command is issued. So, force the mode change +for SFI in Fixed PHY configuration to fix link issues. + +Fixes: e57f7a3feaef ("amd-xgbe: Prepare for working with more than one type of phy") +Acked-by: Shyam Sundar S K +Signed-off-by: Raju Rangoju +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 32d2c6fac6526..4a2dc705b5280 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1193,7 +1193,19 @@ static int xgbe_phy_config_fixed(struct xgbe_prv_data *pdata) + if (pdata->phy.duplex != DUPLEX_FULL) + return -EINVAL; + +- xgbe_set_mode(pdata, mode); ++ /* Force the mode change for SFI in Fixed PHY config. ++ * Fixed PHY configs needs PLL to be enabled while doing mode set. ++ * When the SFP module isn't connected during boot, driver assumes ++ * AN is ON and attempts autonegotiation. However, if the connected ++ * SFP comes up in Fixed PHY config, the link will not come up as ++ * PLL isn't enabled while the initial mode set command is issued. ++ * So, force the mode change for SFI in Fixed PHY configuration to ++ * fix link issues. ++ */ ++ if (mode == XGBE_MODE_SFI) ++ xgbe_change_mode(pdata, mode); ++ else ++ xgbe_set_mode(pdata, mode); + + return 0; + } +-- +2.42.0 + diff --git a/queue-6.6/amd-xgbe-handle-the-corner-case-during-tx-completion.patch b/queue-6.6/amd-xgbe-handle-the-corner-case-during-tx-completion.patch new file mode 100644 index 00000000000..52d31076cf4 --- /dev/null +++ b/queue-6.6/amd-xgbe-handle-the-corner-case-during-tx-completion.patch @@ -0,0 +1,61 @@ +From 673cf243dfe844083592183a3dc3f15d514b4472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 00:44:34 +0530 +Subject: amd-xgbe: handle the corner-case during tx completion + +From: Raju Rangoju + +[ Upstream commit 7121205d5330c6a3cb3379348886d47c77b78d06 ] + +The existing implementation uses software logic to accumulate tx +completions until the specified time (1ms) is met and then poll them. +However, there exists a tiny gap which leads to a race between +resetting and checking the tx_activate flag. Due to this the tx +completions are not reported to upper layer and tx queue timeout +kicks-in restarting the device. + +To address this, introduce a tx cleanup mechanism as part of the +periodic maintenance process. + +Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver") +Acked-by: Shyam Sundar S K +Signed-off-by: Raju Rangoju +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 614c0278419bc..6b73648b37793 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -682,10 +682,24 @@ static void xgbe_service(struct work_struct *work) + static void xgbe_service_timer(struct timer_list *t) + { + struct xgbe_prv_data *pdata = from_timer(pdata, t, service_timer); ++ struct xgbe_channel *channel; ++ unsigned int i; + + queue_work(pdata->dev_workqueue, &pdata->service_work); + + mod_timer(&pdata->service_timer, jiffies + HZ); ++ ++ if (!pdata->tx_usecs) ++ return; ++ ++ for (i = 0; i < pdata->channel_count; i++) { ++ channel = pdata->channel[i]; ++ if (!channel->tx_ring || channel->tx_timer_active) ++ break; ++ channel->tx_timer_active = 1; ++ mod_timer(&channel->tx_timer, ++ jiffies + usecs_to_jiffies(pdata->tx_usecs)); ++ } + } + + static void xgbe_init_timers(struct xgbe_prv_data *pdata) +-- +2.42.0 + diff --git a/queue-6.6/amd-xgbe-propagate-the-correct-speed-and-duplex-stat.patch b/queue-6.6/amd-xgbe-propagate-the-correct-speed-and-duplex-stat.patch new file mode 100644 index 00000000000..7fc105e5f8f --- /dev/null +++ b/queue-6.6/amd-xgbe-propagate-the-correct-speed-and-duplex-stat.patch @@ -0,0 +1,51 @@ +From 5bf82eabd5d340346af9fe0275a86fa57bf6bd67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 00:44:35 +0530 +Subject: amd-xgbe: propagate the correct speed and duplex status + +From: Raju Rangoju + +[ Upstream commit 7a2323ac24a50311f64a3a9b54ed5bef5821ecae ] + +xgbe_get_link_ksettings() does not propagate correct speed and duplex +information to ethtool during cable unplug. Due to which ethtool reports +incorrect values for speed and duplex. + +Address this by propagating correct information. + +Fixes: 7c12aa08779c ("amd-xgbe: Move the PHY support into amd-xgbe") +Acked-by: Shyam Sundar S K +Signed-off-by: Raju Rangoju +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c +index 6e83ff59172a3..32fab5e772462 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c +@@ -314,10 +314,15 @@ static int xgbe_get_link_ksettings(struct net_device *netdev, + + cmd->base.phy_address = pdata->phy.address; + +- cmd->base.autoneg = pdata->phy.autoneg; +- cmd->base.speed = pdata->phy.speed; +- cmd->base.duplex = pdata->phy.duplex; ++ if (netif_carrier_ok(netdev)) { ++ cmd->base.speed = pdata->phy.speed; ++ cmd->base.duplex = pdata->phy.duplex; ++ } else { ++ cmd->base.speed = SPEED_UNKNOWN; ++ cmd->base.duplex = DUPLEX_UNKNOWN; ++ } + ++ cmd->base.autoneg = pdata->phy.autoneg; + cmd->base.port = PORT_NONE; + + XGBE_LM_COPY(cmd, supported, lks, supported); +-- +2.42.0 + diff --git a/queue-6.6/arm-xen-fix-xen_vcpu_info-allocation-alignment.patch b/queue-6.6/arm-xen-fix-xen_vcpu_info-allocation-alignment.patch new file mode 100644 index 00000000000..3efd9ec4113 --- /dev/null +++ b/queue-6.6/arm-xen-fix-xen_vcpu_info-allocation-alignment.patch @@ -0,0 +1,47 @@ +From cae348ae427e66eb55372168773af4737efc8379 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 15:07:41 -0800 +Subject: arm/xen: fix xen_vcpu_info allocation alignment + +From: Stefano Stabellini + +[ Upstream commit 7bf9a6b46549852a37e6d07e52c601c3c706b562 ] + +xen_vcpu_info is a percpu area than needs to be mapped by Xen. +Currently, it could cross a page boundary resulting in Xen being unable +to map it: + +[ 0.567318] kernel BUG at arch/arm64/xen/../../arm/xen/enlighten.c:164! +[ 0.574002] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP + +Fix the issue by using __alloc_percpu and requesting alignment for the +memory allocation. + +Signed-off-by: Stefano Stabellini + +Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2311221501340.2053963@ubuntu-linux-20-04-desktop +Fixes: 24d5373dda7c ("arm/xen: Use alloc_percpu rather than __alloc_percpu") +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/arm/xen/enlighten.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c +index 9afdc4c4a5dc1..a395b6c0aae2a 100644 +--- a/arch/arm/xen/enlighten.c ++++ b/arch/arm/xen/enlighten.c +@@ -484,7 +484,8 @@ static int __init xen_guest_init(void) + * for secondary CPUs as they are brought up. + * For uniformity we use VCPUOP_register_vcpu_info even on cpu0. + */ +- xen_vcpu_info = alloc_percpu(struct vcpu_info); ++ xen_vcpu_info = __alloc_percpu(sizeof(struct vcpu_info), ++ 1 << fls(sizeof(struct vcpu_info) - 1)); + if (xen_vcpu_info == NULL) + return -ENOMEM; + +-- +2.42.0 + diff --git a/queue-6.6/arm64-mm-fix-rodata-on-when-config_rodata_full_defau.patch b/queue-6.6/arm64-mm-fix-rodata-on-when-config_rodata_full_defau.patch new file mode 100644 index 00000000000..26ce21b8c47 --- /dev/null +++ b/queue-6.6/arm64-mm-fix-rodata-on-when-config_rodata_full_defau.patch @@ -0,0 +1,92 @@ +From 86e5b48950104cf9304970b1c4adfcdce22740fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 13:14:22 +0000 +Subject: arm64: mm: Fix "rodata=on" when CONFIG_RODATA_FULL_DEFAULT_ENABLED=y + +From: Will Deacon + +[ Upstream commit acfa60dbe03802d6afd28401aa47801270e82021 ] + +When CONFIG_RODATA_FULL_DEFAULT_ENABLED=y, passing "rodata=on" on the +kernel command-line (rather than "rodata=full") should turn off the +"full" behaviour, leaving writable linear aliases of read-only kernel +memory. Unfortunately, the option has no effect in this situation and +the only way to disable the "rodata=full" behaviour is to disable rodata +protection entirely by passing "rodata=off". + +Fix this by parsing the "on" and "off" options in the arch code, +additionally enforcing that 'rodata_full' cannot be set without also +setting 'rodata_enabled', allowing us to simplify a couple of checks +in the process. + +Fixes: 2e8cff0a0eee ("arm64: fix rodata=full") +Cc: Ard Biesheuvel +Cc: Mark Rutland +Signed-off-by: Will Deacon +Reviewed-by: "Russell King (Oracle)" +Reviewed-by: Ard Biesheuvel +Link: https://lore.kernel.org/r/20231117131422.29663-1-will@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/setup.h | 17 +++++++++++++++-- + arch/arm64/mm/pageattr.c | 7 +++---- + 2 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/include/asm/setup.h b/arch/arm64/include/asm/setup.h +index f4af547ef54ca..2e4d7da74fb87 100644 +--- a/arch/arm64/include/asm/setup.h ++++ b/arch/arm64/include/asm/setup.h +@@ -21,9 +21,22 @@ static inline bool arch_parse_debug_rodata(char *arg) + extern bool rodata_enabled; + extern bool rodata_full; + +- if (arg && !strcmp(arg, "full")) { ++ if (!arg) ++ return false; ++ ++ if (!strcmp(arg, "full")) { ++ rodata_enabled = rodata_full = true; ++ return true; ++ } ++ ++ if (!strcmp(arg, "off")) { ++ rodata_enabled = rodata_full = false; ++ return true; ++ } ++ ++ if (!strcmp(arg, "on")) { + rodata_enabled = true; +- rodata_full = true; ++ rodata_full = false; + return true; + } + +diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c +index 8e2017ba5f1b1..924843f1f661b 100644 +--- a/arch/arm64/mm/pageattr.c ++++ b/arch/arm64/mm/pageattr.c +@@ -29,8 +29,8 @@ bool can_set_direct_map(void) + * + * KFENCE pool requires page-granular mapping if initialized late. + */ +- return (rodata_enabled && rodata_full) || debug_pagealloc_enabled() || +- arm64_kfence_can_set_direct_map(); ++ return rodata_full || debug_pagealloc_enabled() || ++ arm64_kfence_can_set_direct_map(); + } + + static int change_page_range(pte_t *ptep, unsigned long addr, void *data) +@@ -105,8 +105,7 @@ static int change_memory_common(unsigned long addr, int numpages, + * If we are manipulating read-only permissions, apply the same + * change to the linear mapping of the pages that back this VM area. + */ +- if (rodata_enabled && +- rodata_full && (pgprot_val(set_mask) == PTE_RDONLY || ++ if (rodata_full && (pgprot_val(set_mask) == PTE_RDONLY || + pgprot_val(clear_mask) == PTE_RDONLY)) { + for (i = 0; i < area->nr_pages; i++) { + __change_memory_common((u64)page_address(area->pages[i]), +-- +2.42.0 + diff --git a/queue-6.6/ata-pata_isapnp-add-missing-error-check-for-devm_iop.patch b/queue-6.6/ata-pata_isapnp-add-missing-error-check-for-devm_iop.patch new file mode 100644 index 00000000000..8d142e9be1b --- /dev/null +++ b/queue-6.6/ata-pata_isapnp-add-missing-error-check-for-devm_iop.patch @@ -0,0 +1,38 @@ +From 1bdd4d8ccf31add3e0629389c82b43fb66077eb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Oct 2023 04:00:07 +0000 +Subject: ata: pata_isapnp: Add missing error check for devm_ioport_map() + +From: Chen Ni + +[ Upstream commit a6925165ea82b7765269ddd8dcad57c731aa00de ] + +Add missing error return check for devm_ioport_map() and return the +error if this function call fails. + +Fixes: 0d5ff566779f ("libata: convert to iomap") +Signed-off-by: Chen Ni +Reviewed-by: Sergey Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_isapnp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c +index 25a63d043c8e1..0f77e04240661 100644 +--- a/drivers/ata/pata_isapnp.c ++++ b/drivers/ata/pata_isapnp.c +@@ -82,6 +82,9 @@ static int isapnp_init_one(struct pnp_dev *idev, const struct pnp_device_id *dev + if (pnp_port_valid(idev, 1)) { + ctl_addr = devm_ioport_map(&idev->dev, + pnp_port_start(idev, 1), 1); ++ if (!ctl_addr) ++ return -ENOMEM; ++ + ap->ioaddr.altstatus_addr = ctl_addr; + ap->ioaddr.ctl_addr = ctl_addr; + ap->ops = &isapnp_port_ops; +-- +2.42.0 + diff --git a/queue-6.6/blk-cgroup-avoid-to-warn-rcu_read_lock_held-in-blkg_.patch b/queue-6.6/blk-cgroup-avoid-to-warn-rcu_read_lock_held-in-blkg_.patch new file mode 100644 index 00000000000..86c0fc03e2b --- /dev/null +++ b/queue-6.6/blk-cgroup-avoid-to-warn-rcu_read_lock_held-in-blkg_.patch @@ -0,0 +1,42 @@ +From fdb6785afbafe8981477a5cda947e5f2cc941d85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 10:35:23 +0800 +Subject: blk-cgroup: avoid to warn !rcu_read_lock_held() in blkg_lookup() + +From: Ming Lei + +[ Upstream commit 35a99d6557cacbc177314735342f77a2dda41872 ] + +So far, all callers either holds spin lock or rcu read explicitly, and +most of the caller has added WARN_ON_ONCE(!rcu_read_lock_held()) or +lockdep_assert_held(&disk->queue->queue_lock). + +Remove WARN_ON_ONCE(!rcu_read_lock_held()) from blkg_lookup() for +killing the false positive warning from blkg_conf_prep(). + +Reported-by: Changhui Zhong +Fixes: 83462a6c971c ("blkcg: Drop unnecessary RCU read [un]locks from blkg_conf_prep/finish()") +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20231117023527.3188627-3-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.h | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h +index 624c03c8fe64e..fd482439afbc9 100644 +--- a/block/blk-cgroup.h ++++ b/block/blk-cgroup.h +@@ -249,8 +249,6 @@ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg, + { + struct blkcg_gq *blkg; + +- WARN_ON_ONCE(!rcu_read_lock_held()); +- + if (blkcg == &blkcg_root) + return q->root_blkg; + +-- +2.42.0 + diff --git a/queue-6.6/block-update-the-stable_writes-flag-in-bdev_add.patch b/queue-6.6/block-update-the-stable_writes-flag-in-bdev_add.patch new file mode 100644 index 00000000000..373ed0904cc --- /dev/null +++ b/queue-6.6/block-update-the-stable_writes-flag-in-bdev_add.patch @@ -0,0 +1,46 @@ +From ca407af96bf27eaed9cbd89ab4084fb3f243a793 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Oct 2023 16:10:18 +0200 +Subject: block: update the stable_writes flag in bdev_add + +From: Christoph Hellwig + +[ Upstream commit 1898efcdbed32bb1c67269c985a50bab0dbc9493 ] + +Propagate the per-queue stable_write flags into each bdev inode in bdev_add. +This makes sure devices that require stable writes have it set for I/O +on the block device node as well. + +Note that this doesn't cover the case of a flag changing on a live device +yet. We should handle that as well, but I plan to cover it as part of a +more general rework of how changing runtime paramters on block devices +works. + +Fixes: 1cb039f3dc16 ("bdi: replace BDI_CAP_STABLE_WRITES with a queue and a sb flag") +Reported-by: Ilya Dryomov +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20231025141020.192413-3-hch@lst.de +Tested-by: Ilya Dryomov +Reviewed-by: Darrick J. Wong +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + block/bdev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/bdev.c b/block/bdev.c +index f3b13aa1b7d42..04dba25b0019e 100644 +--- a/block/bdev.c ++++ b/block/bdev.c +@@ -425,6 +425,8 @@ void bdev_set_nr_sectors(struct block_device *bdev, sector_t sectors) + + void bdev_add(struct block_device *bdev, dev_t dev) + { ++ if (bdev_stable_writes(bdev)) ++ mapping_set_stable_writes(bdev->bd_inode->i_mapping); + bdev->bd_dev = dev; + bdev->bd_inode->i_rdev = dev; + bdev->bd_inode->i_ino = dev; +-- +2.42.0 + diff --git a/queue-6.6/bpf-fix-dev-s-rx-stats-for-bpf_redirect_peer-traffic.patch b/queue-6.6/bpf-fix-dev-s-rx-stats-for-bpf_redirect_peer-traffic.patch new file mode 100644 index 00000000000..9dbac602a68 --- /dev/null +++ b/queue-6.6/bpf-fix-dev-s-rx-stats-for-bpf_redirect_peer-traffic.patch @@ -0,0 +1,72 @@ +From aff8308229e5dc0dcfac6b14589ea28a885e802a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 01:42:17 +0100 +Subject: bpf: Fix dev's rx stats for bpf_redirect_peer traffic + +From: Peilin Ye + +[ Upstream commit 024ee930cb3c9ae49e4266aee89cfde0ebb407e1 ] + +Traffic redirected by bpf_redirect_peer() (used by recent CNIs like Cilium) +is not accounted for in the RX stats of supported devices (that is, veth +and netkit), confusing user space metrics collectors such as cAdvisor [0], +as reported by Youlun. + +Fix it by calling dev_sw_netstats_rx_add() in skb_do_redirect(), to update +RX traffic counters. Devices that support ndo_get_peer_dev _must_ use the +@tstats per-CPU counters (instead of @lstats, or @dstats). + +To make this more fool-proof, error out when ndo_get_peer_dev is set but +@tstats are not selected. + + [0] Specifically, the "container_network_receive_{byte,packet}s_total" + counters are affected. + +Fixes: 9aa1206e8f48 ("bpf: Add redirect_peer helper") +Reported-by: Youlun Zhang +Signed-off-by: Peilin Ye +Co-developed-by: Daniel Borkmann +Signed-off-by: Daniel Borkmann +Reviewed-by: Nikolay Aleksandrov +Link: https://lore.kernel.org/r/20231114004220.6495-6-daniel@iogearbox.net +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 8 ++++++++ + net/core/filter.c | 1 + + 2 files changed, 9 insertions(+) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 37444c8e22054..9bf90b2a75b6a 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -10054,6 +10054,14 @@ static int netdev_do_alloc_pcpu_stats(struct net_device *dev) + { + void __percpu *v; + ++ /* Drivers implementing ndo_get_peer_dev must support tstat ++ * accounting, so that skb_do_redirect() can bump the dev's ++ * RX stats upon network namespace switch. ++ */ ++ if (dev->netdev_ops->ndo_get_peer_dev && ++ dev->pcpu_stat_type != NETDEV_PCPU_STAT_TSTATS) ++ return -EOPNOTSUPP; ++ + switch (dev->pcpu_stat_type) { + case NETDEV_PCPU_STAT_NONE: + return 0; +diff --git a/net/core/filter.c b/net/core/filter.c +index a094694899c99..b149a165c405c 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2489,6 +2489,7 @@ int skb_do_redirect(struct sk_buff *skb) + net_eq(net, dev_net(dev)))) + goto out_drop; + skb->dev = dev; ++ dev_sw_netstats_rx_add(dev, skb->len); + return -EAGAIN; + } + return flags & BPF_F_NEIGH ? +-- +2.42.0 + diff --git a/queue-6.6/cifs-account-for-primary-channel-in-the-interface-li.patch b/queue-6.6/cifs-account-for-primary-channel-in-the-interface-li.patch new file mode 100644 index 00000000000..7ea4f6faa01 --- /dev/null +++ b/queue-6.6/cifs-account-for-primary-channel-in-the-interface-li.patch @@ -0,0 +1,118 @@ +From 912dde1a9be88e73c4a6848e3f904821d0f7be13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 11:14:58 +0000 +Subject: cifs: account for primary channel in the interface list + +From: Shyam Prasad N + +[ Upstream commit fa1d0508bdd4a68c5e40f85f635712af8c12f180 ] + +The refcounting of server interfaces should account +for the primary channel too. Although this is not +strictly necessary, doing so will account for the primary +channel in DebugData. + +Cc: stable@vger.kernel.org +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/sess.c | 28 ++++++++++++++++++++++++++++ + fs/smb/client/smb2ops.c | 6 ++++++ + 2 files changed, 34 insertions(+) + +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index 65545e65f1eb6..80050e36f0451 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -288,6 +288,7 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + struct cifs_server_iface *iface = NULL; + struct cifs_server_iface *old_iface = NULL; + struct cifs_server_iface *last_iface = NULL; ++ struct sockaddr_storage ss; + int rc = 0; + + spin_lock(&ses->chan_lock); +@@ -306,6 +307,10 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + } + spin_unlock(&ses->chan_lock); + ++ spin_lock(&server->srv_lock); ++ ss = server->dstaddr; ++ spin_unlock(&server->srv_lock); ++ + spin_lock(&ses->iface_lock); + if (!ses->iface_count) { + spin_unlock(&ses->iface_lock); +@@ -319,6 +324,16 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + + /* then look for a new one */ + list_for_each_entry(iface, &ses->iface_list, iface_head) { ++ if (!chan_index) { ++ /* if we're trying to get the updated iface for primary channel */ ++ if (!cifs_match_ipaddr((struct sockaddr *) &ss, ++ (struct sockaddr *) &iface->sockaddr)) ++ continue; ++ ++ kref_get(&iface->refcount); ++ break; ++ } ++ + /* do not mix rdma and non-rdma interfaces */ + if (iface->rdma_capable != server->rdma) + continue; +@@ -345,6 +360,13 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + cifs_dbg(FYI, "unable to find a suitable iface\n"); + } + ++ if (!chan_index && !iface) { ++ cifs_dbg(FYI, "unable to get the interface matching: %pIS\n", ++ &ss); ++ spin_unlock(&ses->iface_lock); ++ return 0; ++ } ++ + /* now drop the ref to the current iface */ + if (old_iface && iface) { + cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n", +@@ -367,6 +389,12 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + old_iface->weight_fulfilled--; + + kref_put(&old_iface->refcount, release_iface); ++ } else if (!chan_index) { ++ /* special case: update interface for primary channel */ ++ cifs_dbg(FYI, "referencing primary channel iface: %pIS\n", ++ &iface->sockaddr); ++ iface->num_channels++; ++ iface->weight_fulfilled++; + } else { + WARN_ON(!iface); + cifs_dbg(FYI, "adding new iface: %pIS\n", &iface->sockaddr); +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 4af0085239b74..0f8fa78cd47b1 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -756,6 +756,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ + unsigned int ret_data_len = 0; + struct network_interface_info_ioctl_rsp *out_buf = NULL; + struct cifs_ses *ses = tcon->ses; ++ struct TCP_Server_Info *pserver; + + /* do not query too frequently */ + if (ses->iface_last_update && +@@ -780,6 +781,11 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ + if (rc) + goto out; + ++ /* check if iface is still active */ ++ pserver = ses->chans[0].server; ++ if (pserver && !cifs_chan_is_iface_active(ses, pserver)) ++ cifs_chan_update_iface(ses, pserver); ++ + out: + kfree(out_buf); + return rc; +-- +2.42.0 + diff --git a/queue-6.6/cifs-distribute-channels-across-interfaces-based-on-.patch b/queue-6.6/cifs-distribute-channels-across-interfaces-based-on-.patch new file mode 100644 index 00000000000..eca14824194 --- /dev/null +++ b/queue-6.6/cifs-distribute-channels-across-interfaces-based-on-.patch @@ -0,0 +1,252 @@ +From 9460ccb7f3500ec5ad0c849d0c9eeb1d89265d9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Dec 2022 11:24:56 +0000 +Subject: cifs: distribute channels across interfaces based on speed + +From: Shyam Prasad N + +[ Upstream commit a6d8fb54a515f0546ffdb7870102b1238917e567 ] + +Today, if the server interfaces RSS capable, we simply +choose the fastest interface to setup a channel. This is not +a scalable approach, and does not make a lot of attempt to +distribute the connections. + +This change does a weighted distribution of channels across +all the available server interfaces, where the weight is +a function of the advertised interface speed. + +Also make sure that we don't mix rdma and non-rdma for channels. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Stable-dep-of: fa1d0508bdd4 ("cifs: account for primary channel in the interface list") +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifs_debug.c | 16 ++++++++ + fs/smb/client/cifsglob.h | 2 + + fs/smb/client/sess.c | 84 +++++++++++++++++++++++++++++++------- + 3 files changed, 88 insertions(+), 14 deletions(-) + +diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c +index 9a0ccd87468ea..16282ecfe17a7 100644 +--- a/fs/smb/client/cifs_debug.c ++++ b/fs/smb/client/cifs_debug.c +@@ -279,6 +279,8 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) + struct cifs_ses *ses; + struct cifs_tcon *tcon; + struct cifs_server_iface *iface; ++ size_t iface_weight = 0, iface_min_speed = 0; ++ struct cifs_server_iface *last_iface = NULL; + int c, i, j; + + seq_puts(m, +@@ -542,11 +544,25 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) + "\tLast updated: %lu seconds ago", + ses->iface_count, + (jiffies - ses->iface_last_update) / HZ); ++ ++ last_iface = list_last_entry(&ses->iface_list, ++ struct cifs_server_iface, ++ iface_head); ++ iface_min_speed = last_iface->speed; ++ + j = 0; + list_for_each_entry(iface, &ses->iface_list, + iface_head) { + seq_printf(m, "\n\t%d)", ++j); + cifs_dump_iface(m, iface); ++ ++ iface_weight = iface->speed / iface_min_speed; ++ seq_printf(m, "\t\tWeight (cur,total): (%zu,%zu)" ++ "\n\t\tAllocated channels: %u\n", ++ iface->weight_fulfilled, ++ iface_weight, ++ iface->num_channels); ++ + if (is_ses_using_iface(ses, iface)) + seq_puts(m, "\t\t[CONNECTED]\n"); + } +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index e55f49e278a2e..b8d1c19f67714 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -969,6 +969,8 @@ struct cifs_server_iface { + struct list_head iface_head; + struct kref refcount; + size_t speed; ++ size_t weight_fulfilled; ++ unsigned int num_channels; + unsigned int rdma_capable : 1; + unsigned int rss_capable : 1; + unsigned int is_active : 1; /* unset if non existent */ +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index 61cc7c415491e..65545e65f1eb6 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -164,7 +164,9 @@ int cifs_try_adding_channels(struct cifs_ses *ses) + int left; + int rc = 0; + int tries = 0; ++ size_t iface_weight = 0, iface_min_speed = 0; + struct cifs_server_iface *iface = NULL, *niface = NULL; ++ struct cifs_server_iface *last_iface = NULL; + + spin_lock(&ses->chan_lock); + +@@ -192,21 +194,11 @@ int cifs_try_adding_channels(struct cifs_ses *ses) + } + spin_unlock(&ses->chan_lock); + +- /* +- * Keep connecting to same, fastest, iface for all channels as +- * long as its RSS. Try next fastest one if not RSS or channel +- * creation fails. +- */ +- spin_lock(&ses->iface_lock); +- iface = list_first_entry(&ses->iface_list, struct cifs_server_iface, +- iface_head); +- spin_unlock(&ses->iface_lock); +- + while (left > 0) { + + tries++; + if (tries > 3*ses->chan_max) { +- cifs_dbg(FYI, "too many channel open attempts (%d channels left to open)\n", ++ cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n", + left); + break; + } +@@ -214,17 +206,35 @@ int cifs_try_adding_channels(struct cifs_ses *ses) + spin_lock(&ses->iface_lock); + if (!ses->iface_count) { + spin_unlock(&ses->iface_lock); ++ cifs_dbg(VFS, "server %s does not advertise interfaces\n", ++ ses->server->hostname); + break; + } + ++ if (!iface) ++ iface = list_first_entry(&ses->iface_list, struct cifs_server_iface, ++ iface_head); ++ last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface, ++ iface_head); ++ iface_min_speed = last_iface->speed; ++ + list_for_each_entry_safe_from(iface, niface, &ses->iface_list, + iface_head) { ++ /* do not mix rdma and non-rdma interfaces */ ++ if (iface->rdma_capable != ses->server->rdma) ++ continue; ++ + /* skip ifaces that are unusable */ + if (!iface->is_active || + (is_ses_using_iface(ses, iface) && +- !iface->rss_capable)) { ++ !iface->rss_capable)) ++ continue; ++ ++ /* check if we already allocated enough channels */ ++ iface_weight = iface->speed / iface_min_speed; ++ ++ if (iface->weight_fulfilled >= iface_weight) + continue; +- } + + /* take ref before unlock */ + kref_get(&iface->refcount); +@@ -241,10 +251,21 @@ int cifs_try_adding_channels(struct cifs_ses *ses) + continue; + } + +- cifs_dbg(FYI, "successfully opened new channel on iface:%pIS\n", ++ iface->num_channels++; ++ iface->weight_fulfilled++; ++ cifs_dbg(VFS, "successfully opened new channel on iface:%pIS\n", + &iface->sockaddr); + break; + } ++ ++ /* reached end of list. reset weight_fulfilled and start over */ ++ if (list_entry_is_head(iface, &ses->iface_list, iface_head)) { ++ list_for_each_entry(iface, &ses->iface_list, iface_head) ++ iface->weight_fulfilled = 0; ++ spin_unlock(&ses->iface_lock); ++ iface = NULL; ++ continue; ++ } + spin_unlock(&ses->iface_lock); + + left--; +@@ -263,8 +284,10 @@ int + cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + { + unsigned int chan_index; ++ size_t iface_weight = 0, iface_min_speed = 0; + struct cifs_server_iface *iface = NULL; + struct cifs_server_iface *old_iface = NULL; ++ struct cifs_server_iface *last_iface = NULL; + int rc = 0; + + spin_lock(&ses->chan_lock); +@@ -284,13 +307,34 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + spin_unlock(&ses->chan_lock); + + spin_lock(&ses->iface_lock); ++ if (!ses->iface_count) { ++ spin_unlock(&ses->iface_lock); ++ cifs_dbg(VFS, "server %s does not advertise interfaces\n", ses->server->hostname); ++ return 0; ++ } ++ ++ last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface, ++ iface_head); ++ iface_min_speed = last_iface->speed; ++ + /* then look for a new one */ + list_for_each_entry(iface, &ses->iface_list, iface_head) { ++ /* do not mix rdma and non-rdma interfaces */ ++ if (iface->rdma_capable != server->rdma) ++ continue; ++ + if (!iface->is_active || + (is_ses_using_iface(ses, iface) && + !iface->rss_capable)) { + continue; + } ++ ++ /* check if we already allocated enough channels */ ++ iface_weight = iface->speed / iface_min_speed; ++ ++ if (iface->weight_fulfilled >= iface_weight) ++ continue; ++ + kref_get(&iface->refcount); + break; + } +@@ -306,10 +350,22 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n", + &old_iface->sockaddr, + &iface->sockaddr); ++ ++ old_iface->num_channels--; ++ if (old_iface->weight_fulfilled) ++ old_iface->weight_fulfilled--; ++ iface->num_channels++; ++ iface->weight_fulfilled++; ++ + kref_put(&old_iface->refcount, release_iface); + } else if (old_iface) { + cifs_dbg(FYI, "releasing ref to iface: %pIS\n", + &old_iface->sockaddr); ++ ++ old_iface->num_channels--; ++ if (old_iface->weight_fulfilled) ++ old_iface->weight_fulfilled--; ++ + kref_put(&old_iface->refcount, release_iface); + } else { + WARN_ON(!iface); +-- +2.42.0 + diff --git a/queue-6.6/cifs-fix-leak-of-iface-for-primary-channel.patch b/queue-6.6/cifs-fix-leak-of-iface-for-primary-channel.patch new file mode 100644 index 00000000000..e1fd14cd3a9 --- /dev/null +++ b/queue-6.6/cifs-fix-leak-of-iface-for-primary-channel.patch @@ -0,0 +1,47 @@ +From 0192c8a0dba427258ee6128abffad105aa1a8d09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 04:54:12 +0000 +Subject: cifs: fix leak of iface for primary channel + +From: Shyam Prasad N + +[ Upstream commit 29954d5b1e0d67a4cd61c30c2201030c97e94b1e ] + +My last change in this area introduced a change which +accounted for primary channel in the interface ref count. +However, it did not reduce this ref count on deallocation +of the primary channel. i.e. during umount. + +Fixing this leak here, by dropping this ref count for +primary channel while freeing up the session. + +Fixes: fa1d0508bdd4 ("cifs: account for primary channel in the interface list") +Cc: stable@vger.kernel.org +Reported-by: Paulo Alcantara +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index a9632c060bceb..d517651d7bcea 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -2034,6 +2034,12 @@ void __cifs_put_smb_ses(struct cifs_ses *ses) + } + } + ++ /* we now account for primary channel in iface->refcount */ ++ if (ses->chans[0].iface) { ++ kref_put(&ses->chans[0].iface->refcount, release_iface); ++ ses->chans[0].server = NULL; ++ } ++ + sesInfoFree(ses); + cifs_put_tcp_session(server, 0); + } +-- +2.42.0 + diff --git a/queue-6.6/dm-delay-fix-a-race-between-delay_presuspend-and-del.patch b/queue-6.6/dm-delay-fix-a-race-between-delay_presuspend-and-del.patch new file mode 100644 index 00000000000..e096af9dee8 --- /dev/null +++ b/queue-6.6/dm-delay-fix-a-race-between-delay_presuspend-and-del.patch @@ -0,0 +1,97 @@ +From d153e17d9ead5f19f3a48488cf1f122dc3f5c2a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 18:21:14 +0100 +Subject: dm-delay: fix a race between delay_presuspend and delay_bio + +From: Mikulas Patocka + +[ Upstream commit 6fc45b6ed921dc00dfb264dc08c7d67ee63d2656 ] + +In delay_presuspend, we set the atomic variable may_delay and then stop +the timer and flush pending bios. The intention here is to prevent the +delay target from re-arming the timer again. + +However, this test is racy. Suppose that one thread goes to delay_bio, +sees that dc->may_delay is one and proceeds; now, another thread executes +delay_presuspend, it sets dc->may_delay to zero, deletes the timer and +flushes pending bios. Then, the first thread continues and adds the bio to +delayed->list despite the fact that dc->may_delay is false. + +Fix this bug by changing may_delay's type from atomic_t to bool and +only access it while holding the delayed_bios_lock mutex. Note that we +don't have to grab the mutex in delay_resume because there are no bios +in flight at this point. + +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-delay.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c +index efd510984e259..2d6b900e4353c 100644 +--- a/drivers/md/dm-delay.c ++++ b/drivers/md/dm-delay.c +@@ -33,7 +33,7 @@ struct delay_c { + struct work_struct flush_expired_bios; + struct list_head delayed_bios; + struct task_struct *worker; +- atomic_t may_delay; ++ bool may_delay; + + struct delay_class read; + struct delay_class write; +@@ -236,7 +236,7 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + ti->private = dc; + INIT_LIST_HEAD(&dc->delayed_bios); +- atomic_set(&dc->may_delay, 1); ++ dc->may_delay = true; + dc->argc = argc; + + ret = delay_class_ctr(ti, &dc->read, argv); +@@ -312,7 +312,7 @@ static int delay_bio(struct delay_c *dc, struct delay_class *c, struct bio *bio) + struct dm_delay_info *delayed; + unsigned long expires = 0; + +- if (!c->delay || !atomic_read(&dc->may_delay)) ++ if (!c->delay) + return DM_MAPIO_REMAPPED; + + delayed = dm_per_bio_data(bio, sizeof(struct dm_delay_info)); +@@ -321,6 +321,10 @@ static int delay_bio(struct delay_c *dc, struct delay_class *c, struct bio *bio) + delayed->expires = expires = jiffies + msecs_to_jiffies(c->delay); + + mutex_lock(&delayed_bios_lock); ++ if (unlikely(!dc->may_delay)) { ++ mutex_unlock(&delayed_bios_lock); ++ return DM_MAPIO_REMAPPED; ++ } + c->ops++; + list_add_tail(&delayed->list, &dc->delayed_bios); + mutex_unlock(&delayed_bios_lock); +@@ -337,7 +341,9 @@ static void delay_presuspend(struct dm_target *ti) + { + struct delay_c *dc = ti->private; + +- atomic_set(&dc->may_delay, 0); ++ mutex_lock(&delayed_bios_lock); ++ dc->may_delay = false; ++ mutex_unlock(&delayed_bios_lock); + + if (delay_is_fast(dc)) + flush_delayed_bios_fast(dc, true); +@@ -351,7 +357,7 @@ static void delay_resume(struct dm_target *ti) + { + struct delay_c *dc = ti->private; + +- atomic_set(&dc->may_delay, 1); ++ dc->may_delay = true; + } + + static int delay_map(struct dm_target *ti, struct bio *bio) +-- +2.42.0 + diff --git a/queue-6.6/dm-delay-for-short-delays-use-kthread-instead-of-tim.patch b/queue-6.6/dm-delay-for-short-delays-use-kthread-instead-of-tim.patch new file mode 100644 index 00000000000..7b64485fc31 --- /dev/null +++ b/queue-6.6/dm-delay-for-short-delays-use-kthread-instead-of-tim.patch @@ -0,0 +1,290 @@ +From 976fd593415e170a8ed5db68683b280d5876982d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 12:46:05 +0100 +Subject: dm delay: for short delays, use kthread instead of timers and wq + +From: Christian Loehle + +[ Upstream commit 70bbeb29fab09d6ea6cfe64109db60a97d84d739 ] + +DM delay's current design of using timers and wq to realize the delays +is insufficient for delays below ~50ms. + +This commit enhances the design to use a kthread to flush the expired +delays, trading some CPU time (in some cases) for better delay +accuracy and delays closer to what the user requested for smaller +delays. The new design is chosen as long as all the delays are below +50ms. + +Since bios can't be completed in interrupt context using a kthread +is probably the most reasonable way to approach this. + +Testing with +echo "0 2097152 zero" | dmsetup create dm-zeros +for i in $(seq 0 20); +do + echo "0 2097152 delay /dev/mapper/dm-zeros 0 $i" | dmsetup create dm-delay-${i}ms; +done + +Some performance numbers for comparison, on beaglebone black (single +core) CONFIG_HZ_1000=y: + +fio --name=1msread --rw=randread --bs=4k --runtime=60 --time_based \ + --filename=/dev/mapper/dm-delay-1ms +Theoretical maximum: 1000 IOPS +Previous: 250 IOPS +Kthread: 500 IOPS + +fio --name=10msread --rw=randread --bs=4k --runtime=60 --time_based \ + --filename=/dev/mapper/dm-delay-10ms +Theoretical maximum: 100 IOPS +Previous: 45 IOPS +Kthread: 50 IOPS + +fio --name=1mswrite --rw=randwrite --direct=1 --bs=4k --runtime=60 \ + --time_based --filename=/dev/mapper/dm-delay-1ms +Theoretical maximum: 1000 IOPS +Previous: 498 IOPS +Kthread: 1000 IOPS + +fio --name=10mswrite --rw=randwrite --direct=1 --bs=4k --runtime=60 \ + --time_based --filename=/dev/mapper/dm-delay-10ms +Theoretical maximum: 100 IOPS +Previous: 90 IOPS +Kthread: 100 IOPS + +(This one is just to prove the new design isn't impacting throughput, +not really about delays): +fio --name=10mswriteasync --rw=randwrite --direct=1 --bs=4k \ + --runtime=60 --time_based --filename=/dev/mapper/dm-delay-10ms \ + --numjobs=32 --iodepth=64 --ioengine=libaio --group_reporting +Previous: 13.3k IOPS +Kthread: 13.3k IOPS + +Signed-off-by: Christian Loehle +[Harshit: kthread_create error handling fix in delay_ctr] +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Mike Snitzer +Stable-dep-of: 6fc45b6ed921 ("dm-delay: fix a race between delay_presuspend and delay_bio") +Signed-off-by: Sasha Levin +--- + drivers/md/dm-delay.c | 103 ++++++++++++++++++++++++++++++++++++------ + 1 file changed, 88 insertions(+), 15 deletions(-) + +diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c +index 7433525e59856..efd510984e259 100644 +--- a/drivers/md/dm-delay.c ++++ b/drivers/md/dm-delay.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include + +@@ -31,6 +32,7 @@ struct delay_c { + struct workqueue_struct *kdelayd_wq; + struct work_struct flush_expired_bios; + struct list_head delayed_bios; ++ struct task_struct *worker; + atomic_t may_delay; + + struct delay_class read; +@@ -66,6 +68,44 @@ static void queue_timeout(struct delay_c *dc, unsigned long expires) + mutex_unlock(&dc->timer_lock); + } + ++static inline bool delay_is_fast(struct delay_c *dc) ++{ ++ return !!dc->worker; ++} ++ ++static void flush_delayed_bios_fast(struct delay_c *dc, bool flush_all) ++{ ++ struct dm_delay_info *delayed, *next; ++ ++ mutex_lock(&delayed_bios_lock); ++ list_for_each_entry_safe(delayed, next, &dc->delayed_bios, list) { ++ if (flush_all || time_after_eq(jiffies, delayed->expires)) { ++ struct bio *bio = dm_bio_from_per_bio_data(delayed, ++ sizeof(struct dm_delay_info)); ++ list_del(&delayed->list); ++ dm_submit_bio_remap(bio, NULL); ++ delayed->class->ops--; ++ } ++ } ++ mutex_unlock(&delayed_bios_lock); ++} ++ ++static int flush_worker_fn(void *data) ++{ ++ struct delay_c *dc = data; ++ ++ while (1) { ++ flush_delayed_bios_fast(dc, false); ++ if (unlikely(list_empty(&dc->delayed_bios))) { ++ set_current_state(TASK_INTERRUPTIBLE); ++ schedule(); ++ } else ++ cond_resched(); ++ } ++ ++ return 0; ++} ++ + static void flush_bios(struct bio *bio) + { + struct bio *n; +@@ -78,7 +118,7 @@ static void flush_bios(struct bio *bio) + } + } + +-static struct bio *flush_delayed_bios(struct delay_c *dc, int flush_all) ++static struct bio *flush_delayed_bios(struct delay_c *dc, bool flush_all) + { + struct dm_delay_info *delayed, *next; + unsigned long next_expires = 0; +@@ -115,7 +155,10 @@ static void flush_expired_bios(struct work_struct *work) + struct delay_c *dc; + + dc = container_of(work, struct delay_c, flush_expired_bios); +- flush_bios(flush_delayed_bios(dc, 0)); ++ if (delay_is_fast(dc)) ++ flush_delayed_bios_fast(dc, false); ++ else ++ flush_bios(flush_delayed_bios(dc, false)); + } + + static void delay_dtr(struct dm_target *ti) +@@ -131,8 +174,11 @@ static void delay_dtr(struct dm_target *ti) + dm_put_device(ti, dc->write.dev); + if (dc->flush.dev) + dm_put_device(ti, dc->flush.dev); ++ if (dc->worker) ++ kthread_stop(dc->worker); + +- mutex_destroy(&dc->timer_lock); ++ if (!delay_is_fast(dc)) ++ mutex_destroy(&dc->timer_lock); + + kfree(dc); + } +@@ -175,6 +221,7 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + struct delay_c *dc; + int ret; ++ unsigned int max_delay; + + if (argc != 3 && argc != 6 && argc != 9) { + ti->error = "Requires exactly 3, 6 or 9 arguments"; +@@ -188,16 +235,14 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv) + } + + ti->private = dc; +- timer_setup(&dc->delay_timer, handle_delayed_timer, 0); +- INIT_WORK(&dc->flush_expired_bios, flush_expired_bios); + INIT_LIST_HEAD(&dc->delayed_bios); +- mutex_init(&dc->timer_lock); + atomic_set(&dc->may_delay, 1); + dc->argc = argc; + + ret = delay_class_ctr(ti, &dc->read, argv); + if (ret) + goto bad; ++ max_delay = dc->read.delay; + + if (argc == 3) { + ret = delay_class_ctr(ti, &dc->write, argv); +@@ -206,6 +251,8 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv) + ret = delay_class_ctr(ti, &dc->flush, argv); + if (ret) + goto bad; ++ max_delay = max(max_delay, dc->write.delay); ++ max_delay = max(max_delay, dc->flush.delay); + goto out; + } + +@@ -216,19 +263,37 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv) + ret = delay_class_ctr(ti, &dc->flush, argv + 3); + if (ret) + goto bad; ++ max_delay = max(max_delay, dc->flush.delay); + goto out; + } + + ret = delay_class_ctr(ti, &dc->flush, argv + 6); + if (ret) + goto bad; ++ max_delay = max(max_delay, dc->flush.delay); + + out: +- dc->kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0); +- if (!dc->kdelayd_wq) { +- ret = -EINVAL; +- DMERR("Couldn't start kdelayd"); +- goto bad; ++ if (max_delay < 50) { ++ /* ++ * In case of small requested delays, use kthread instead of ++ * timers and workqueue to achieve better latency. ++ */ ++ dc->worker = kthread_create(&flush_worker_fn, dc, ++ "dm-delay-flush-worker"); ++ if (IS_ERR(dc->worker)) { ++ ret = PTR_ERR(dc->worker); ++ goto bad; ++ } ++ } else { ++ timer_setup(&dc->delay_timer, handle_delayed_timer, 0); ++ INIT_WORK(&dc->flush_expired_bios, flush_expired_bios); ++ mutex_init(&dc->timer_lock); ++ dc->kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0); ++ if (!dc->kdelayd_wq) { ++ ret = -EINVAL; ++ DMERR("Couldn't start kdelayd"); ++ goto bad; ++ } + } + + ti->num_flush_bios = 1; +@@ -260,7 +325,10 @@ static int delay_bio(struct delay_c *dc, struct delay_class *c, struct bio *bio) + list_add_tail(&delayed->list, &dc->delayed_bios); + mutex_unlock(&delayed_bios_lock); + +- queue_timeout(dc, expires); ++ if (delay_is_fast(dc)) ++ wake_up_process(dc->worker); ++ else ++ queue_timeout(dc, expires); + + return DM_MAPIO_SUBMITTED; + } +@@ -270,8 +338,13 @@ static void delay_presuspend(struct dm_target *ti) + struct delay_c *dc = ti->private; + + atomic_set(&dc->may_delay, 0); +- del_timer_sync(&dc->delay_timer); +- flush_bios(flush_delayed_bios(dc, 1)); ++ ++ if (delay_is_fast(dc)) ++ flush_delayed_bios_fast(dc, true); ++ else { ++ del_timer_sync(&dc->delay_timer); ++ flush_bios(flush_delayed_bios(dc, true)); ++ } + } + + static void delay_resume(struct dm_target *ti) +@@ -356,7 +429,7 @@ static int delay_iterate_devices(struct dm_target *ti, + + static struct target_type delay_target = { + .name = "delay", +- .version = {1, 3, 0}, ++ .version = {1, 4, 0}, + .features = DM_TARGET_PASSES_INTEGRITY, + .module = THIS_MODULE, + .ctr = delay_ctr, +-- +2.42.0 + diff --git a/queue-6.6/drm-i915-do-not-clean-gt-table-on-error-path.patch b/queue-6.6/drm-i915-do-not-clean-gt-table-on-error-path.patch new file mode 100644 index 00000000000..578192f90a7 --- /dev/null +++ b/queue-6.6/drm-i915-do-not-clean-gt-table-on-error-path.patch @@ -0,0 +1,100 @@ +From e51c0d98dc545636a121110f0809766333338375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 11:54:03 +0100 +Subject: drm/i915: do not clean GT table on error path + +From: Andrzej Hajda + +[ Upstream commit 0561794b6b642b84b879bf97061c4b4fa692839e ] + +The only task of intel_gt_release_all is to zero gt table. Calling +it on error path prevents intel_gt_driver_late_release_all (called from +i915_driver_late_release) to cleanup GTs, causing leakage. +After i915_driver_late_release GT array is not used anymore so +it does not need cleaning at all. + +Sample leak report: + +BUG i915_request (...): Objects remaining in i915_request on __kmem_cache_shutdown() +... +Object 0xffff888113420040 @offset=64 +Allocated in __i915_request_create+0x75/0x610 [i915] age=18339 cpu=1 pid=1454 + kmem_cache_alloc+0x25b/0x270 + __i915_request_create+0x75/0x610 [i915] + i915_request_create+0x109/0x290 [i915] + __engines_record_defaults+0xca/0x440 [i915] + intel_gt_init+0x275/0x430 [i915] + i915_gem_init+0x135/0x2c0 [i915] + i915_driver_probe+0x8d1/0xdc0 [i915] + +v2: removed whole intel_gt_release_all + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8489 +Fixes: bec68cc9ea42 ("drm/i915: Prepare for multiple GTs") +Signed-off-by: Andrzej Hajda +Reviewed-by: Tvrtko Ursulin +Reviewed-by: Nirmoy Das +Reviewed-by: Andi Shyti +Link: https://patchwork.freedesktop.org/patch/msgid/20231115-dont_clean_gt_on_error_path-v2-1-54250125470a@intel.com +(cherry picked from commit e899505533852bf1da133f2f4c9a9655ff77f7e5) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_gt.c | 11 ----------- + drivers/gpu/drm/i915/i915_driver.c | 4 +--- + 2 files changed, 1 insertion(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt.c b/drivers/gpu/drm/i915/gt/intel_gt.c +index 449f0b7fc8434..95631e8f39e7b 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt.c +@@ -967,8 +967,6 @@ int intel_gt_probe_all(struct drm_i915_private *i915) + + err: + i915_probe_error(i915, "Failed to initialize %s! (%d)\n", gtdef->name, ret); +- intel_gt_release_all(i915); +- + return ret; + } + +@@ -987,15 +985,6 @@ int intel_gt_tiles_init(struct drm_i915_private *i915) + return 0; + } + +-void intel_gt_release_all(struct drm_i915_private *i915) +-{ +- struct intel_gt *gt; +- unsigned int id; +- +- for_each_gt(gt, i915, id) +- i915->gt[id] = NULL; +-} +- + void intel_gt_info_print(const struct intel_gt_info *info, + struct drm_printer *p) + { +diff --git a/drivers/gpu/drm/i915/i915_driver.c b/drivers/gpu/drm/i915/i915_driver.c +index ec4d26b3c17cc..8dc5f85b7747b 100644 +--- a/drivers/gpu/drm/i915/i915_driver.c ++++ b/drivers/gpu/drm/i915/i915_driver.c +@@ -777,7 +777,7 @@ int i915_driver_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + ret = i915_driver_mmio_probe(i915); + if (ret < 0) +- goto out_tiles_cleanup; ++ goto out_runtime_pm_put; + + ret = i915_driver_hw_probe(i915); + if (ret < 0) +@@ -837,8 +837,6 @@ int i915_driver_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + i915_ggtt_driver_late_release(i915); + out_cleanup_mmio: + i915_driver_mmio_release(i915); +-out_tiles_cleanup: +- intel_gt_release_all(i915); + out_runtime_pm_put: + enable_rpm_wakeref_asserts(&i915->runtime_pm); + i915_driver_late_release(i915); +-- +2.42.0 + diff --git a/queue-6.6/drm-msm-dsi-use-the-correct-vreg_ctrl_1-value-for-4n.patch b/queue-6.6/drm-msm-dsi-use-the-correct-vreg_ctrl_1-value-for-4n.patch new file mode 100644 index 00000000000..2280067dab0 --- /dev/null +++ b/queue-6.6/drm-msm-dsi-use-the-correct-vreg_ctrl_1-value-for-4n.patch @@ -0,0 +1,39 @@ +From e93097b791b3cace8f7ca1787f32b0760838163f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Nov 2023 19:02:14 -0500 +Subject: drm/msm/dsi: use the correct VREG_CTRL_1 value for 4nm cphy + +From: Jonathan Marek + +[ Upstream commit b3e0f94d15700ac8e8c1c2355834f5d5c753c41d ] + +Use the same value as the downstream driver. This change is needed for CPHY +mode to work correctly. + +Fixes: 8b034e677111 ("drm/msm/dsi: add support for DSI-PHY on SM8550") +Signed-off-by: Jonathan Marek +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/566987/ +Link: https://lore.kernel.org/r/20231110000216.29979-1-jonathan@marek.ca +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +index 3b1ed02f644d2..89a6344bc8653 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +@@ -918,7 +918,7 @@ static int dsi_7nm_phy_enable(struct msm_dsi_phy *phy, + if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2)) { + if (phy->cphy_mode) { + vreg_ctrl_0 = 0x45; +- vreg_ctrl_1 = 0x45; ++ vreg_ctrl_1 = 0x41; + glbl_rescode_top_ctrl = 0x00; + glbl_rescode_bot_ctrl = 0x00; + } else { +-- +2.42.0 + diff --git a/queue-6.6/drm-panel-auo-b101uan08.3-fine-tune-the-panel-power-.patch b/queue-6.6/drm-panel-auo-b101uan08.3-fine-tune-the-panel-power-.patch new file mode 100644 index 00000000000..555434ba8ed --- /dev/null +++ b/queue-6.6/drm-panel-auo-b101uan08.3-fine-tune-the-panel-power-.patch @@ -0,0 +1,37 @@ +From d13886f7ec4754133ba25283c72b40369a7d3bc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 12:42:05 +0800 +Subject: drm/panel: auo,b101uan08.3: Fine tune the panel power sequence + +From: Xuxin Xiong + +[ Upstream commit 6965809e526917b73c8f9178173184dcf13cec4b ] + +For "auo,b101uan08.3" this panel, it is stipulated in the panel spec that +MIPI needs to keep the LP11 state before the lcm_reset pin is pulled high. + +Fixes: 56ad624b4cb5 ("drm/panel: support for auo, b101uan08.3 wuxga dsi video mode panel") +Signed-off-by: Xuxin Xiong +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20231114044205.613421-1-xuxinxiong@huaqin.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +index c9087f474cbc5..980b10244d4e6 100644 +--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c ++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +@@ -2049,6 +2049,7 @@ static const struct panel_desc auo_b101uan08_3_desc = { + .mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE | + MIPI_DSI_MODE_LPM, + .init_cmds = auo_b101uan08_3_init_cmd, ++ .lp11_before_reset = true, + }; + + static const struct drm_display_mode boe_tv105wum_nw0_default_mode = { +-- +2.42.0 + diff --git a/queue-6.6/drm-panel-boe-tv101wum-nl6-fine-tune-himax83102-j02-.patch b/queue-6.6/drm-panel-boe-tv101wum-nl6-fine-tune-himax83102-j02-.patch new file mode 100644 index 00000000000..1505b3463b7 --- /dev/null +++ b/queue-6.6/drm-panel-boe-tv101wum-nl6-fine-tune-himax83102-j02-.patch @@ -0,0 +1,57 @@ +From 56cd7337c65f6a0a7976db6950290ad8717a1409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 10:01:09 +0800 +Subject: drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and + HBP + +From: Cong Yang + +[ Upstream commit cea7008190ad65b4aaae6e94667a358d2c10a696 ] + +The refresh reported by modetest is 60.46Hz, and the actual measurement +is 60.01Hz, which is outside the expected tolerance. Adjust hporch and +pixel clock to fix it. After repair, modetest and actual measurement were +all 60.01Hz. + +Modetest refresh = Pixel CLK/ htotal* vtotal, but measurement frame rate +is HS->LP cycle time(Vblanking). Measured frame rate is not only affecte +by Htotal/Vtotal/pixel clock, also affected by Lane-num/PixelBit/LineTime +/DSI CLK. Assume that the DSI controller could not make the mode that we +requested(presumably it's PLL couldn't generate the exact pixel clock?). +If you use a different DSI controller, you may need to readjust these +parameters. Now this panel looks like it's only used by me on the MTK +platform, so let's change this set of parameters. + +Fixes: 1bc2ef065f13 ("drm/panel: Support for Starry-himax83102-j02 TDDI MIPI-DSI panel") +Signed-off-by: Cong Yang +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20231120020109.3216343-1-yangcong5@huaqin.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +index 980b10244d4e6..d76a8ca9c40f8 100644 +--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c ++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +@@ -2107,11 +2107,11 @@ static const struct panel_desc starry_qfh032011_53g_desc = { + }; + + static const struct drm_display_mode starry_himax83102_j02_default_mode = { +- .clock = 161600, ++ .clock = 162850, + .hdisplay = 1200, +- .hsync_start = 1200 + 40, +- .hsync_end = 1200 + 40 + 20, +- .htotal = 1200 + 40 + 20 + 40, ++ .hsync_start = 1200 + 50, ++ .hsync_end = 1200 + 50 + 20, ++ .htotal = 1200 + 50 + 20 + 50, + .vdisplay = 1920, + .vsync_start = 1920 + 116, + .vsync_end = 1920 + 116 + 8, +-- +2.42.0 + diff --git a/queue-6.6/drm-panel-simple-fix-innolux-g101ice-l01-bus-flags.patch b/queue-6.6/drm-panel-simple-fix-innolux-g101ice-l01-bus-flags.patch new file mode 100644 index 00000000000..f1089f49ad6 --- /dev/null +++ b/queue-6.6/drm-panel-simple-fix-innolux-g101ice-l01-bus-flags.patch @@ -0,0 +1,36 @@ +From 55bcabacdcd5d0f27aca076a31334fbc68c03dbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2023 00:33:15 +0200 +Subject: drm/panel: simple: Fix Innolux G101ICE-L01 bus flags + +From: Marek Vasut + +[ Upstream commit 06fc41b09cfbc02977acd9189473593a37d82d9b ] + +Add missing .bus_flags = DRM_BUS_FLAG_DE_HIGH to this panel description, +ones which match both the datasheet and the panel display_timing flags . + +Fixes: 1e29b840af9f ("drm/panel: simple: Add Innolux G101ICE-L01 panel") +Signed-off-by: Marek Vasut +Reviewed-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20231008223315.279215-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index dd7928d9570f7..944eb83ff25b7 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2349,6 +2349,7 @@ static const struct panel_desc innolux_g101ice_l01 = { + .disable = 200, + }, + .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, ++ .bus_flags = DRM_BUS_FLAG_DE_HIGH, + .connector_type = DRM_MODE_CONNECTOR_LVDS, + }; + +-- +2.42.0 + diff --git a/queue-6.6/drm-panel-simple-fix-innolux-g101ice-l01-timings.patch b/queue-6.6/drm-panel-simple-fix-innolux-g101ice-l01-timings.patch new file mode 100644 index 00000000000..46e5bd0966d --- /dev/null +++ b/queue-6.6/drm-panel-simple-fix-innolux-g101ice-l01-timings.patch @@ -0,0 +1,56 @@ +From a4f6d1531134a2e1da9be6b6cc204674e65995be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2023 00:32:56 +0200 +Subject: drm/panel: simple: Fix Innolux G101ICE-L01 timings + +From: Marek Vasut + +[ Upstream commit 3f9a91b6c00e655d27bd785dcda1742dbdc31bda ] + +The Innolux G101ICE-L01 datasheet [1] page 17 table +6.1 INPUT SIGNAL TIMING SPECIFICATIONS +indicates that maximum vertical blanking time is 40 lines. +Currently the driver uses 29 lines. + +Fix it, and since this panel is a DE panel, adjust the timings +to make them less hostile to controllers which cannot do 1 px +HSA/VSA, distribute the delays evenly between all three parts. + +[1] https://www.data-modul.com/sites/default/files/products/G101ICE-L01-C2-specification-12042389.pdf + +Fixes: 1e29b840af9f ("drm/panel: simple: Add Innolux G101ICE-L01 panel") +Signed-off-by: Marek Vasut +Reviewed-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20231008223256.279196-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 944eb83ff25b7..6e46e55d29a9a 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2326,13 +2326,13 @@ static const struct panel_desc innolux_g070y2_t02 = { + static const struct display_timing innolux_g101ice_l01_timing = { + .pixelclock = { 60400000, 71100000, 74700000 }, + .hactive = { 1280, 1280, 1280 }, +- .hfront_porch = { 41, 80, 100 }, +- .hback_porch = { 40, 79, 99 }, +- .hsync_len = { 1, 1, 1 }, ++ .hfront_porch = { 30, 60, 70 }, ++ .hback_porch = { 30, 60, 70 }, ++ .hsync_len = { 22, 40, 60 }, + .vactive = { 800, 800, 800 }, +- .vfront_porch = { 5, 11, 14 }, +- .vback_porch = { 4, 11, 14 }, +- .vsync_len = { 1, 1, 1 }, ++ .vfront_porch = { 3, 8, 14 }, ++ .vback_porch = { 3, 8, 14 }, ++ .vsync_len = { 4, 7, 12 }, + .flags = DISPLAY_FLAGS_DE_HIGH, + }; + +-- +2.42.0 + diff --git a/queue-6.6/drm-rockchip-vop-fix-color-for-rgb888-bgr888-format-.patch b/queue-6.6/drm-rockchip-vop-fix-color-for-rgb888-bgr888-format-.patch new file mode 100644 index 00000000000..5cc18005a86 --- /dev/null +++ b/queue-6.6/drm-rockchip-vop-fix-color-for-rgb888-bgr888-format-.patch @@ -0,0 +1,76 @@ +From 5946cc02d1d6c0a12c6f82eb0ae76b8be8f52009 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Oct 2023 19:14:58 +0000 +Subject: drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full + +From: Jonas Karlman + +[ Upstream commit bb0a05acd6121ff0e810b44fdc24dbdfaa46b642 ] + +Use of DRM_FORMAT_RGB888 and DRM_FORMAT_BGR888 on e.g. RK3288, RK3328 +and RK3399 result in wrong colors being displayed. + +The issue can be observed using modetest: + + modetest -s @:1920x1080-60@RG24 + modetest -s @:1920x1080-60@BG24 + +Vendor 4.4 kernel apply an inverted rb swap for these formats on VOP +full framework (IP version 3.x) compared to VOP little framework (2.x). + +Fix colors by applying different rb swap for VOP full framework (3.x) +and VOP little framework (2.x) similar to vendor 4.4 kernel. + +Fixes: 85a359f25388 ("drm/rockchip: Add BGR formats to VOP") +Signed-off-by: Jonas Karlman +Tested-by: Diederik de Haas +Reviewed-by: Christopher Obbard +Tested-by: Christopher Obbard +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20231026191500.2994225-1-jonas@kwiboo.se +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index 41cd12d5f2fa2..4b338cb89d32d 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -247,14 +247,22 @@ static inline void vop_cfg_done(struct vop *vop) + VOP_REG_SET(vop, common, cfg_done, 1); + } + +-static bool has_rb_swapped(uint32_t format) ++static bool has_rb_swapped(uint32_t version, uint32_t format) + { + switch (format) { + case DRM_FORMAT_XBGR8888: + case DRM_FORMAT_ABGR8888: +- case DRM_FORMAT_BGR888: + case DRM_FORMAT_BGR565: + return true; ++ /* ++ * full framework (IP version 3.x) only need rb swapped for RGB888 and ++ * little framework (IP version 2.x) only need rb swapped for BGR888, ++ * check for 3.x to also only rb swap BGR888 for unknown vop version ++ */ ++ case DRM_FORMAT_RGB888: ++ return VOP_MAJOR(version) == 3; ++ case DRM_FORMAT_BGR888: ++ return VOP_MAJOR(version) != 3; + default: + return false; + } +@@ -1013,7 +1021,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane, + VOP_WIN_SET(vop, win, dsp_info, dsp_info); + VOP_WIN_SET(vop, win, dsp_st, dsp_st); + +- rb_swap = has_rb_swapped(fb->format->format); ++ rb_swap = has_rb_swapped(vop->data->version, fb->format->format); + VOP_WIN_SET(vop, win, rb_swap, rb_swap); + + /* +-- +2.42.0 + diff --git a/queue-6.6/filemap-add-a-per-mapping-stable-writes-flag.patch b/queue-6.6/filemap-add-a-per-mapping-stable-writes-flag.patch new file mode 100644 index 00000000000..05e99cab166 --- /dev/null +++ b/queue-6.6/filemap-add-a-per-mapping-stable-writes-flag.patch @@ -0,0 +1,103 @@ +From b4db10b2ef45318dce624969e250e438b0190f2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Oct 2023 16:10:17 +0200 +Subject: filemap: add a per-mapping stable writes flag + +From: Christoph Hellwig + +[ Upstream commit 762321dab9a72760bf9aec48362f932717c9424d ] + +folio_wait_stable waits for writeback to finish before modifying the +contents of a folio again, e.g. to support check summing of the data +in the block integrity code. + +Currently this behavior is controlled by the SB_I_STABLE_WRITES flag +on the super_block, which means it is uniform for the entire file system. +This is wrong for the block device pseudofs which is shared by all +block devices, or file systems that can use multiple devices like XFS +witht the RT subvolume or btrfs (although btrfs currently reimplements +folio_wait_stable anyway). + +Add a per-address_space AS_STABLE_WRITES flag to control the behavior +in a more fine grained way. The existing SB_I_STABLE_WRITES is kept +to initialize AS_STABLE_WRITES to the existing default which covers +most cases. + +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20231025141020.192413-2-hch@lst.de +Tested-by: Ilya Dryomov +Reviewed-by: Matthew Wilcox (Oracle) +Reviewed-by: Darrick J. Wong +Signed-off-by: Christian Brauner +Stable-dep-of: 1898efcdbed3 ("block: update the stable_writes flag in bdev_add") +Signed-off-by: Sasha Levin +--- + fs/inode.c | 2 ++ + include/linux/pagemap.h | 17 +++++++++++++++++ + mm/page-writeback.c | 2 +- + 3 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/fs/inode.c b/fs/inode.c +index 84bc3c76e5ccb..ae1a6410b53d7 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -215,6 +215,8 @@ int inode_init_always(struct super_block *sb, struct inode *inode) + lockdep_set_class_and_name(&mapping->invalidate_lock, + &sb->s_type->invalidate_lock_key, + "mapping.invalidate_lock"); ++ if (sb->s_iflags & SB_I_STABLE_WRITES) ++ mapping_set_stable_writes(mapping); + inode->i_private = NULL; + inode->i_mapping = mapping; + INIT_HLIST_HEAD(&inode->i_dentry); /* buggered by rcu freeing */ +diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h +index 351c3b7f93a14..8c9608b217b00 100644 +--- a/include/linux/pagemap.h ++++ b/include/linux/pagemap.h +@@ -204,6 +204,8 @@ enum mapping_flags { + AS_NO_WRITEBACK_TAGS = 5, + AS_LARGE_FOLIO_SUPPORT = 6, + AS_RELEASE_ALWAYS, /* Call ->release_folio(), even if no private data */ ++ AS_STABLE_WRITES, /* must wait for writeback before modifying ++ folio contents */ + }; + + /** +@@ -289,6 +291,21 @@ static inline void mapping_clear_release_always(struct address_space *mapping) + clear_bit(AS_RELEASE_ALWAYS, &mapping->flags); + } + ++static inline bool mapping_stable_writes(const struct address_space *mapping) ++{ ++ return test_bit(AS_STABLE_WRITES, &mapping->flags); ++} ++ ++static inline void mapping_set_stable_writes(struct address_space *mapping) ++{ ++ set_bit(AS_STABLE_WRITES, &mapping->flags); ++} ++ ++static inline void mapping_clear_stable_writes(struct address_space *mapping) ++{ ++ clear_bit(AS_STABLE_WRITES, &mapping->flags); ++} ++ + static inline gfp_t mapping_gfp_mask(struct address_space * mapping) + { + return mapping->gfp_mask; +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index b8d3d7040a506..4656534b8f5cc 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -3110,7 +3110,7 @@ EXPORT_SYMBOL_GPL(folio_wait_writeback_killable); + */ + void folio_wait_stable(struct folio *folio) + { +- if (folio_inode(folio)->i_sb->s_iflags & SB_I_STABLE_WRITES) ++ if (mapping_stable_writes(folio_mapping(folio))) + folio_wait_writeback(folio); + } + EXPORT_SYMBOL_GPL(folio_wait_stable); +-- +2.42.0 + diff --git a/queue-6.6/fs-pass-at_getattr_nosec-flag-to-getattr-interface-f.patch b/queue-6.6/fs-pass-at_getattr_nosec-flag-to-getattr-interface-f.patch new file mode 100644 index 00000000000..316e6489f8b --- /dev/null +++ b/queue-6.6/fs-pass-at_getattr_nosec-flag-to-getattr-interface-f.patch @@ -0,0 +1,173 @@ +From a461e6d0c385d471366fe7fa9338dca6e175ead9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Oct 2023 08:57:33 -0400 +Subject: fs: Pass AT_GETATTR_NOSEC flag to getattr interface function + +From: Stefan Berger + +[ Upstream commit 8a924db2d7b5eb69ba08b1a0af46e9f1359a9bdf ] + +When vfs_getattr_nosec() calls a filesystem's getattr interface function +then the 'nosec' should propagate into this function so that +vfs_getattr_nosec() can again be called from the filesystem's gettattr +rather than vfs_getattr(). The latter would add unnecessary security +checks that the initial vfs_getattr_nosec() call wanted to avoid. +Therefore, introduce the getattr flag GETATTR_NOSEC and allow to pass +with the new getattr_flags parameter to the getattr interface function. +In overlayfs and ecryptfs use this flag to determine which one of the +two functions to call. + +In a recent code change introduced to IMA vfs_getattr_nosec() ended up +calling vfs_getattr() in overlayfs, which in turn called +security_inode_getattr() on an exiting process that did not have +current->fs set anymore, which then caused a kernel NULL pointer +dereference. With this change the call to security_inode_getattr() can +be avoided, thus avoiding the NULL pointer dereference. + +Reported-by: +Fixes: db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version") +Cc: Alexander Viro +Cc: +Cc: Miklos Szeredi +Cc: Amir Goldstein +Cc: Tyler Hicks +Cc: Mimi Zohar +Suggested-by: Christian Brauner +Co-developed-by: Amir Goldstein +Signed-off-by: Stefan Berger +Link: https://lore.kernel.org/r/20231002125733.1251467-1-stefanb@linux.vnet.ibm.com +Reviewed-by: Amir Goldstein +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/ecryptfs/inode.c | 12 ++++++++++-- + fs/overlayfs/inode.c | 10 +++++----- + fs/overlayfs/overlayfs.h | 8 ++++++++ + fs/stat.c | 6 +++++- + include/uapi/linux/fcntl.h | 3 +++ + 5 files changed, 31 insertions(+), 8 deletions(-) + +diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c +index 992d9c7e64ae6..5ab4b87888a79 100644 +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -998,6 +998,14 @@ static int ecryptfs_getattr_link(struct mnt_idmap *idmap, + return rc; + } + ++static int ecryptfs_do_getattr(const struct path *path, struct kstat *stat, ++ u32 request_mask, unsigned int flags) ++{ ++ if (flags & AT_GETATTR_NOSEC) ++ return vfs_getattr_nosec(path, stat, request_mask, flags); ++ return vfs_getattr(path, stat, request_mask, flags); ++} ++ + static int ecryptfs_getattr(struct mnt_idmap *idmap, + const struct path *path, struct kstat *stat, + u32 request_mask, unsigned int flags) +@@ -1006,8 +1014,8 @@ static int ecryptfs_getattr(struct mnt_idmap *idmap, + struct kstat lower_stat; + int rc; + +- rc = vfs_getattr(ecryptfs_dentry_to_lower_path(dentry), &lower_stat, +- request_mask, flags); ++ rc = ecryptfs_do_getattr(ecryptfs_dentry_to_lower_path(dentry), ++ &lower_stat, request_mask, flags); + if (!rc) { + fsstack_copy_attr_all(d_inode(dentry), + ecryptfs_inode_to_lower(d_inode(dentry))); +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index 83ef66644c213..fca29dba7b146 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -171,7 +171,7 @@ int ovl_getattr(struct mnt_idmap *idmap, const struct path *path, + + type = ovl_path_real(dentry, &realpath); + old_cred = ovl_override_creds(dentry->d_sb); +- err = vfs_getattr(&realpath, stat, request_mask, flags); ++ err = ovl_do_getattr(&realpath, stat, request_mask, flags); + if (err) + goto out; + +@@ -196,8 +196,8 @@ int ovl_getattr(struct mnt_idmap *idmap, const struct path *path, + (!is_dir ? STATX_NLINK : 0); + + ovl_path_lower(dentry, &realpath); +- err = vfs_getattr(&realpath, &lowerstat, +- lowermask, flags); ++ err = ovl_do_getattr(&realpath, &lowerstat, lowermask, ++ flags); + if (err) + goto out; + +@@ -249,8 +249,8 @@ int ovl_getattr(struct mnt_idmap *idmap, const struct path *path, + + ovl_path_lowerdata(dentry, &realpath); + if (realpath.dentry) { +- err = vfs_getattr(&realpath, &lowerdatastat, +- lowermask, flags); ++ err = ovl_do_getattr(&realpath, &lowerdatastat, ++ lowermask, flags); + if (err) + goto out; + } else { +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index 9817b2dcb132c..09ca82ed0f8ce 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -397,6 +397,14 @@ static inline bool ovl_open_flags_need_copy_up(int flags) + return ((OPEN_FMODE(flags) & FMODE_WRITE) || (flags & O_TRUNC)); + } + ++static inline int ovl_do_getattr(const struct path *path, struct kstat *stat, ++ u32 request_mask, unsigned int flags) ++{ ++ if (flags & AT_GETATTR_NOSEC) ++ return vfs_getattr_nosec(path, stat, request_mask, flags); ++ return vfs_getattr(path, stat, request_mask, flags); ++} ++ + /* util.c */ + int ovl_want_write(struct dentry *dentry); + void ovl_drop_write(struct dentry *dentry); +diff --git a/fs/stat.c b/fs/stat.c +index d43a5cc1bfa46..5375be5f97ccf 100644 +--- a/fs/stat.c ++++ b/fs/stat.c +@@ -133,7 +133,8 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat, + idmap = mnt_idmap(path->mnt); + if (inode->i_op->getattr) + return inode->i_op->getattr(idmap, path, stat, +- request_mask, query_flags); ++ request_mask, ++ query_flags | AT_GETATTR_NOSEC); + + generic_fillattr(idmap, request_mask, inode, stat); + return 0; +@@ -166,6 +167,9 @@ int vfs_getattr(const struct path *path, struct kstat *stat, + { + int retval; + ++ if (WARN_ON_ONCE(query_flags & AT_GETATTR_NOSEC)) ++ return -EPERM; ++ + retval = security_inode_getattr(path); + if (retval) + return retval; +diff --git a/include/uapi/linux/fcntl.h b/include/uapi/linux/fcntl.h +index 6c80f96049bd0..282e90aeb163c 100644 +--- a/include/uapi/linux/fcntl.h ++++ b/include/uapi/linux/fcntl.h +@@ -116,5 +116,8 @@ + #define AT_HANDLE_FID AT_REMOVEDIR /* file handle is needed to + compare object identity and may not + be usable to open_by_handle_at(2) */ ++#if defined(__KERNEL__) ++#define AT_GETATTR_NOSEC 0x80000000 ++#endif + + #endif /* _UAPI_LINUX_FCNTL_H */ +-- +2.42.0 + diff --git a/queue-6.6/hid-fix-hid-device-resource-race-between-hid-core-an.patch b/queue-6.6/hid-fix-hid-device-resource-race-between-hid-core-an.patch new file mode 100644 index 00000000000..def59fe2ee0 --- /dev/null +++ b/queue-6.6/hid-fix-hid-device-resource-race-between-hid-core-an.patch @@ -0,0 +1,152 @@ +From 5b31cd1ef0a61fa293418d1e254974fca0fc544f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Oct 2023 12:32:39 +0800 +Subject: HID: fix HID device resource race between HID core and debugging + support + +From: Charles Yi + +[ Upstream commit fc43e9c857b7aa55efba9398419b14d9e35dcc7d ] + +hid_debug_events_release releases resources bound to the HID device instance. +hid_device_release releases the underlying HID device instance potentially +before hid_debug_events_release has completed releasing debug resources bound +to the same HID device instance. + +Reference count to prevent the HID device instance from being torn down +preemptively when HID debugging support is used. When count reaches zero, +release core resources of HID device instance using hiddev_free. + +The crash: + +[ 120.728477][ T4396] kernel BUG at lib/list_debug.c:53! +[ 120.728505][ T4396] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP +[ 120.739806][ T4396] Modules linked in: bcmdhd dhd_static_buf 8822cu pcie_mhi r8168 +[ 120.747386][ T4396] CPU: 1 PID: 4396 Comm: hidt_bridge Not tainted 5.10.110 #257 +[ 120.754771][ T4396] Hardware name: Rockchip RK3588 EVB4 LP4 V10 Board (DT) +[ 120.761643][ T4396] pstate: 60400089 (nZCv daIf +PAN -UAO -TCO BTYPE=--) +[ 120.768338][ T4396] pc : __list_del_entry_valid+0x98/0xac +[ 120.773730][ T4396] lr : __list_del_entry_valid+0x98/0xac +[ 120.779120][ T4396] sp : ffffffc01e62bb60 +[ 120.783126][ T4396] x29: ffffffc01e62bb60 x28: ffffff818ce3a200 +[ 120.789126][ T4396] x27: 0000000000000009 x26: 0000000000980000 +[ 120.795126][ T4396] x25: ffffffc012431000 x24: ffffff802c6d4e00 +[ 120.801125][ T4396] x23: ffffff8005c66f00 x22: ffffffc01183b5b8 +[ 120.807125][ T4396] x21: ffffff819df2f100 x20: 0000000000000000 +[ 120.813124][ T4396] x19: ffffff802c3f0700 x18: ffffffc01d2cd058 +[ 120.819124][ T4396] x17: 0000000000000000 x16: 0000000000000000 +[ 120.825124][ T4396] x15: 0000000000000004 x14: 0000000000003fff +[ 120.831123][ T4396] x13: ffffffc012085588 x12: 0000000000000003 +[ 120.837123][ T4396] x11: 00000000ffffbfff x10: 0000000000000003 +[ 120.843123][ T4396] x9 : 455103d46b329300 x8 : 455103d46b329300 +[ 120.849124][ T4396] x7 : 74707572726f6320 x6 : ffffffc0124b8cb5 +[ 120.855124][ T4396] x5 : ffffffffffffffff x4 : 0000000000000000 +[ 120.861123][ T4396] x3 : ffffffc011cf4f90 x2 : ffffff81fee7b948 +[ 120.867122][ T4396] x1 : ffffffc011cf4f90 x0 : 0000000000000054 +[ 120.873122][ T4396] Call trace: +[ 120.876259][ T4396] __list_del_entry_valid+0x98/0xac +[ 120.881304][ T4396] hid_debug_events_release+0x48/0x12c +[ 120.886617][ T4396] full_proxy_release+0x50/0xbc +[ 120.891323][ T4396] __fput+0xdc/0x238 +[ 120.895075][ T4396] ____fput+0x14/0x24 +[ 120.898911][ T4396] task_work_run+0x90/0x148 +[ 120.903268][ T4396] do_exit+0x1bc/0x8a4 +[ 120.907193][ T4396] do_group_exit+0x8c/0xa4 +[ 120.911458][ T4396] get_signal+0x468/0x744 +[ 120.915643][ T4396] do_signal+0x84/0x280 +[ 120.919650][ T4396] do_notify_resume+0xd0/0x218 +[ 120.924262][ T4396] work_pending+0xc/0x3f0 + +[ Rahul Rameshbabu : rework changelog ] +Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping") +Signed-off-by: Charles Yi +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 12 ++++++++++-- + drivers/hid/hid-debug.c | 3 +++ + include/linux/hid.h | 3 +++ + 3 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 8992e3c1e7698..e0181218ad857 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -702,15 +702,22 @@ static void hid_close_report(struct hid_device *device) + * Free a device structure, all reports, and all fields. + */ + +-static void hid_device_release(struct device *dev) ++void hiddev_free(struct kref *ref) + { +- struct hid_device *hid = to_hid_device(dev); ++ struct hid_device *hid = container_of(ref, struct hid_device, ref); + + hid_close_report(hid); + kfree(hid->dev_rdesc); + kfree(hid); + } + ++static void hid_device_release(struct device *dev) ++{ ++ struct hid_device *hid = to_hid_device(dev); ++ ++ kref_put(&hid->ref, hiddev_free); ++} ++ + /* + * Fetch a report description item from the data stream. We support long + * items, though they are not used yet. +@@ -2846,6 +2853,7 @@ struct hid_device *hid_allocate_device(void) + spin_lock_init(&hdev->debug_list_lock); + sema_init(&hdev->driver_input_lock, 1); + mutex_init(&hdev->ll_open_lock); ++ kref_init(&hdev->ref); + + hid_bpf_device_init(hdev); + +diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c +index e7ef1ea107c9e..7dd83ec74f8a9 100644 +--- a/drivers/hid/hid-debug.c ++++ b/drivers/hid/hid-debug.c +@@ -1135,6 +1135,7 @@ static int hid_debug_events_open(struct inode *inode, struct file *file) + goto out; + } + list->hdev = (struct hid_device *) inode->i_private; ++ kref_get(&list->hdev->ref); + file->private_data = list; + mutex_init(&list->read_mutex); + +@@ -1227,6 +1228,8 @@ static int hid_debug_events_release(struct inode *inode, struct file *file) + list_del(&list->node); + spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags); + kfifo_free(&list->hid_debug_fifo); ++ ++ kref_put(&list->hdev->ref, hiddev_free); + kfree(list); + + return 0; +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 964ca1f15e3f6..3b08a29572298 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -679,6 +679,7 @@ struct hid_device { /* device report descriptor */ + struct list_head debug_list; + spinlock_t debug_list_lock; + wait_queue_head_t debug_wait; ++ struct kref ref; + + unsigned int id; /* system unique id */ + +@@ -687,6 +688,8 @@ struct hid_device { /* device report descriptor */ + #endif /* CONFIG_BPF */ + }; + ++void hiddev_free(struct kref *ref); ++ + #define to_hid_device(pdev) \ + container_of(pdev, struct hid_device, dev) + +-- +2.42.0 + diff --git a/queue-6.6/hv-hv_kvp_daemon-some-small-fixes-for-handling-nm-ke.patch b/queue-6.6/hv-hv_kvp_daemon-some-small-fixes-for-handling-nm-ke.patch new file mode 100644 index 00000000000..574601d5c90 --- /dev/null +++ b/queue-6.6/hv-hv_kvp_daemon-some-small-fixes-for-handling-nm-ke.patch @@ -0,0 +1,95 @@ +From fcdecde47aceb42a663855a3e47bb0e66f1e0c64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 19:01:22 +0530 +Subject: hv/hv_kvp_daemon: Some small fixes for handling NM keyfiles + +From: Ani Sinha + +[ Upstream commit c3803203bc5ec910a3eb06172cf6fb368e0e4390 ] + +Some small fixes: + - lets make sure we are not adding ipv4 addresses in ipv6 section in + keyfile and vice versa. + - ADDR_FAMILY_IPV6 is a bit in addr_family. Test that bit instead of + checking the whole value of addr_family. + - Some trivial fixes in hv_set_ifconfig.sh. + +These fixes are proposed after doing some internal testing at Red Hat. + +CC: Shradha Gupta +CC: Saurabh Sengar +Fixes: 42999c904612 ("hv/hv_kvp_daemon:Support for keyfile based connection profile") +Signed-off-by: Ani Sinha +Reviewed-by: Shradha Gupta +Signed-off-by: Wei Liu +Message-ID: <20231016133122.2419537-1-anisinha@redhat.com> +Signed-off-by: Sasha Levin +--- + tools/hv/hv_kvp_daemon.c | 20 ++++++++++++-------- + tools/hv/hv_set_ifconfig.sh | 4 ++-- + 2 files changed, 14 insertions(+), 10 deletions(-) + +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 264eeb9c46a9f..318e2dad27e04 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -1421,7 +1421,7 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val) + if (error) + goto setval_error; + +- if (new_val->addr_family == ADDR_FAMILY_IPV6) { ++ if (new_val->addr_family & ADDR_FAMILY_IPV6) { + error = fprintf(nmfile, "\n[ipv6]\n"); + if (error < 0) + goto setval_error; +@@ -1455,14 +1455,18 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val) + if (error < 0) + goto setval_error; + +- error = fprintf(nmfile, "gateway=%s\n", (char *)new_val->gate_way); +- if (error < 0) +- goto setval_error; +- +- error = fprintf(nmfile, "dns=%s\n", (char *)new_val->dns_addr); +- if (error < 0) +- goto setval_error; ++ /* we do not want ipv4 addresses in ipv6 section and vice versa */ ++ if (is_ipv6 != is_ipv4((char *)new_val->gate_way)) { ++ error = fprintf(nmfile, "gateway=%s\n", (char *)new_val->gate_way); ++ if (error < 0) ++ goto setval_error; ++ } + ++ if (is_ipv6 != is_ipv4((char *)new_val->dns_addr)) { ++ error = fprintf(nmfile, "dns=%s\n", (char *)new_val->dns_addr); ++ if (error < 0) ++ goto setval_error; ++ } + fclose(nmfile); + fclose(ifcfg_file); + +diff --git a/tools/hv/hv_set_ifconfig.sh b/tools/hv/hv_set_ifconfig.sh +index ae5a7a8249a20..440a91b35823b 100755 +--- a/tools/hv/hv_set_ifconfig.sh ++++ b/tools/hv/hv_set_ifconfig.sh +@@ -53,7 +53,7 @@ + # or "manual" if no boot-time protocol should be used) + # + # address1=ipaddr1/plen +-# address=ipaddr2/plen ++# address2=ipaddr2/plen + # + # gateway=gateway1;gateway2 + # +@@ -61,7 +61,7 @@ + # + # [ipv6] + # address1=ipaddr1/plen +-# address2=ipaddr1/plen ++# address2=ipaddr2/plen + # + # gateway=gateway1;gateway2 + # +-- +2.42.0 + diff --git a/queue-6.6/i40e-fix-adding-unsupported-cloud-filters.patch b/queue-6.6/i40e-fix-adding-unsupported-cloud-filters.patch new file mode 100644 index 00000000000..f7c88974e9a --- /dev/null +++ b/queue-6.6/i40e-fix-adding-unsupported-cloud-filters.patch @@ -0,0 +1,79 @@ +From 29f250e0cb372150d7390c1770fd5b344ef906d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 13:13:36 -0800 +Subject: i40e: Fix adding unsupported cloud filters + +From: Ivan Vecera + +[ Upstream commit 4e20655e503e3a478cd1682bf25e3202dd823da8 ] + +If a VF tries to add unsupported cloud filter through virtchnl +then i40e_add_del_cloud_filter(_big_buf) returns -ENOTSUPP but +this error code is stored in 'ret' instead of 'aq_ret' that +is used as error code sent back to VF. In this scenario where +one of the mentioned functions fails the value of 'aq_ret' +is zero so the VF will incorrectly receive a 'success'. + +Use 'aq_ret' to store return value and remove 'ret' local +variable. Additionally fix the issue when filter allocation +fails, in this case no notification is sent back to the VF. + +Fixes: e284fc280473 ("i40e: Add and delete cloud filter") +Reviewed-by: Simon Horman +Signed-off-by: Ivan Vecera +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20231121211338.3348677-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index d3d6415553ed6..4441b00297f47 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -3842,7 +3842,7 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg) + struct i40e_pf *pf = vf->pf; + struct i40e_vsi *vsi = NULL; + int aq_ret = 0; +- int i, ret; ++ int i; + + if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = -EINVAL; +@@ -3866,8 +3866,10 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg) + } + + cfilter = kzalloc(sizeof(*cfilter), GFP_KERNEL); +- if (!cfilter) +- return -ENOMEM; ++ if (!cfilter) { ++ aq_ret = -ENOMEM; ++ goto err_out; ++ } + + /* parse destination mac address */ + for (i = 0; i < ETH_ALEN; i++) +@@ -3915,13 +3917,13 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg) + + /* Adding cloud filter programmed as TC filter */ + if (tcf.dst_port) +- ret = i40e_add_del_cloud_filter_big_buf(vsi, cfilter, true); ++ aq_ret = i40e_add_del_cloud_filter_big_buf(vsi, cfilter, true); + else +- ret = i40e_add_del_cloud_filter(vsi, cfilter, true); +- if (ret) { ++ aq_ret = i40e_add_del_cloud_filter(vsi, cfilter, true); ++ if (aq_ret) { + dev_err(&pf->pdev->dev, + "VF %d: Failed to add cloud filter, err %pe aq_err %s\n", +- vf->vf_id, ERR_PTR(ret), ++ vf->vf_id, ERR_PTR(aq_ret), + i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status)); + goto err_free; + } +-- +2.42.0 + diff --git a/queue-6.6/ipv4-correct-silence-an-endian-warning-in-__ip_do_re.patch b/queue-6.6/ipv4-correct-silence-an-endian-warning-in-__ip_do_re.patch new file mode 100644 index 00000000000..cdbeaf13ecf --- /dev/null +++ b/queue-6.6/ipv4-correct-silence-an-endian-warning-in-__ip_do_re.patch @@ -0,0 +1,39 @@ +From e5559153b814936d5a323a84ff6dfb8cf5120df9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Nov 2023 22:17:59 +0800 +Subject: ipv4: Correct/silence an endian warning in __ip_do_redirect + +From: Kunwu Chan + +[ Upstream commit c0e2926266af3b5acf28df0a8fc6e4d90effe0bb ] + +net/ipv4/route.c:783:46: warning: incorrect type in argument 2 (different base types) +net/ipv4/route.c:783:46: expected unsigned int [usertype] key +net/ipv4/route.c:783:46: got restricted __be32 [usertype] new_gw + +Fixes: 969447f226b4 ("ipv4: use new_gw for redirect neigh lookup") +Suggested-by: Eric Dumazet +Signed-off-by: Kunwu Chan +Link: https://lore.kernel.org/r/20231119141759.420477-1-chentao@kylinos.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index b214b5a2e045f..3bad9aa066db3 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -780,7 +780,7 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow + goto reject_redirect; + } + +- n = __ipv4_neigh_lookup(rt->dst.dev, new_gw); ++ n = __ipv4_neigh_lookup(rt->dst.dev, (__force u32)new_gw); + if (!n) + n = neigh_create(&arp_tbl, &new_gw, rt->dst.dev); + if (!IS_ERR(n)) { +-- +2.42.0 + diff --git a/queue-6.6/irqchip-gic-v3-its-flush-its-tables-correctly-in-non.patch b/queue-6.6/irqchip-gic-v3-its-flush-its-tables-correctly-in-non.patch new file mode 100644 index 00000000000..a6e2fb56110 --- /dev/null +++ b/queue-6.6/irqchip-gic-v3-its-flush-its-tables-correctly-in-non.patch @@ -0,0 +1,77 @@ +From c8382b4999d563033e4443e3d9407942837cde0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 16:32:56 +0800 +Subject: irqchip/gic-v3-its: Flush ITS tables correctly in non-coherent GIC + designs + +From: Fang Xiang + +[ Upstream commit d3badb15613c14dd35d3495b1dde5c90fcd616dd ] + +In non-coherent GIC designs, the ITS tables must be flushed before writing +to the GITS_BASER registers, otherwise the ITS could read dirty tables, +which results in unpredictable behavior. + +Flush the tables right at the begin of its_setup_baser() to prevent that. + +[ tglx: Massage changelog ] + +Fixes: a8707f553884 ("irqchip/gic-v3: Add Rockchip 3588001 erratum workaround") +Suggested-by: Marc Zyngier +Signed-off-by: Fang Xiang +Signed-off-by: Thomas Gleixner +Reviewed-by: Marc Zyngier +Link: https://lore.kernel.org/r/20231030083256.4345-1-fangxiang3@xiaomi.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v3-its.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index a8c89df1a9978..9a7a74239eabb 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -2379,12 +2379,12 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, + break; + } + ++ if (!shr) ++ gic_flush_dcache_to_poc(base, PAGE_ORDER_TO_SIZE(order)); ++ + its_write_baser(its, baser, val); + tmp = baser->val; + +- if (its->flags & ITS_FLAGS_FORCE_NON_SHAREABLE) +- tmp &= ~GITS_BASER_SHAREABILITY_MASK; +- + if ((val ^ tmp) & GITS_BASER_SHAREABILITY_MASK) { + /* + * Shareability didn't stick. Just use +@@ -2394,10 +2394,9 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, + * non-cacheable as well. + */ + shr = tmp & GITS_BASER_SHAREABILITY_MASK; +- if (!shr) { ++ if (!shr) + cache = GITS_BASER_nC; +- gic_flush_dcache_to_poc(base, PAGE_ORDER_TO_SIZE(order)); +- } ++ + goto retry_baser; + } + +@@ -2609,6 +2608,11 @@ static int its_alloc_tables(struct its_node *its) + /* erratum 24313: ignore memory access type */ + cache = GITS_BASER_nCnB; + ++ if (its->flags & ITS_FLAGS_FORCE_NON_SHAREABLE) { ++ cache = GITS_BASER_nC; ++ shr = 0; ++ } ++ + for (i = 0; i < GITS_BASER_NR_REGS; i++) { + struct its_baser *baser = its->tables + i; + u64 val = its_read_baser(its, baser); +-- +2.42.0 + diff --git a/queue-6.6/libfs-getdents-should-return-0-after-reaching-eod.patch b/queue-6.6/libfs-getdents-should-return-0-after-reaching-eod.patch new file mode 100644 index 00000000000..707efeac06e --- /dev/null +++ b/queue-6.6/libfs-getdents-should-return-0-after-reaching-eod.patch @@ -0,0 +1,84 @@ +From b3f6a430f5d0109c3dbfd896a9af34a10561d69d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Nov 2023 18:56:17 -0500 +Subject: libfs: getdents() should return 0 after reaching EOD + +From: Chuck Lever + +[ Upstream commit 796432efab1e372d404e7a71cc6891a53f105051 ] + +The new directory offset helpers don't conform with the convention +of getdents() returning no more entries once a directory file +descriptor has reached the current end-of-directory. + +To address this, copy the logic from dcache_readdir() to mark the +open directory file descriptor once EOD has been reached. Seeking +resets the mark. + +Reported-by: Tavian Barnes +Closes: https://lore.kernel.org/linux-fsdevel/20231113180616.2831430-1-tavianator@tavianator.com/ +Fixes: 6faddda69f62 ("libfs: Add directory operations for stable offsets") +Signed-off-by: Chuck Lever +Link: https://lore.kernel.org/r/170043792492.4628.15646203084646716134.stgit@bazille.1015granger.net +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/libfs.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/fs/libfs.c b/fs/libfs.c +index 37f2d34ee090b..189447cf4acf5 100644 +--- a/fs/libfs.c ++++ b/fs/libfs.c +@@ -396,6 +396,8 @@ static loff_t offset_dir_llseek(struct file *file, loff_t offset, int whence) + return -EINVAL; + } + ++ /* In this case, ->private_data is protected by f_pos_lock */ ++ file->private_data = NULL; + return vfs_setpos(file, offset, U32_MAX); + } + +@@ -425,7 +427,7 @@ static bool offset_dir_emit(struct dir_context *ctx, struct dentry *dentry) + inode->i_ino, fs_umode_to_dtype(inode->i_mode)); + } + +-static void offset_iterate_dir(struct inode *inode, struct dir_context *ctx) ++static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx) + { + struct offset_ctx *so_ctx = inode->i_op->get_offset_ctx(inode); + XA_STATE(xas, &so_ctx->xa, ctx->pos); +@@ -434,7 +436,7 @@ static void offset_iterate_dir(struct inode *inode, struct dir_context *ctx) + while (true) { + dentry = offset_find_next(&xas); + if (!dentry) +- break; ++ return ERR_PTR(-ENOENT); + + if (!offset_dir_emit(ctx, dentry)) { + dput(dentry); +@@ -444,6 +446,7 @@ static void offset_iterate_dir(struct inode *inode, struct dir_context *ctx) + dput(dentry); + ctx->pos = xas.xa_index + 1; + } ++ return NULL; + } + + /** +@@ -476,7 +479,12 @@ static int offset_readdir(struct file *file, struct dir_context *ctx) + if (!dir_emit_dots(file, ctx)) + return 0; + +- offset_iterate_dir(d_inode(dir), ctx); ++ /* In this case, ->private_data is protected by f_pos_lock */ ++ if (ctx->pos == 2) ++ file->private_data = NULL; ++ else if (file->private_data == ERR_PTR(-ENOENT)) ++ return 0; ++ file->private_data = offset_iterate_dir(d_inode(dir), ctx); + return 0; + } + +-- +2.42.0 + diff --git a/queue-6.6/lockdep-fix-block-chain-corruption.patch b/queue-6.6/lockdep-fix-block-chain-corruption.patch new file mode 100644 index 00000000000..a49e893aa2c --- /dev/null +++ b/queue-6.6/lockdep-fix-block-chain-corruption.patch @@ -0,0 +1,52 @@ +From 024529b40a87485134171322306258ee65b6edae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 12:41:26 +0100 +Subject: lockdep: Fix block chain corruption + +From: Peter Zijlstra + +[ Upstream commit bca4104b00fec60be330cd32818dd5c70db3d469 ] + +Kent reported an occasional KASAN splat in lockdep. Mark then noted: + +> I suspect the dodgy access is to chain_block_buckets[-1], which hits the last 4 +> bytes of the redzone and gets (incorrectly/misleadingly) attributed to +> nr_large_chain_blocks. + +That would mean @size == 0, at which point size_to_bucket() returns -1 +and the above happens. + +alloc_chain_hlocks() has 'size - req', for the first with the +precondition 'size >= rq', which allows the 0. + +This code is trying to split a block, del_chain_block() takes what we +need, and add_chain_block() puts back the remainder, except in the +above case the remainder is 0 sized and things go sideways. + +Fixes: 810507fe6fd5 ("locking/lockdep: Reuse freed chain_hlocks entries") +Reported-by: Kent Overstreet +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Kent Overstreet +Link: https://lkml.kernel.org/r/20231121114126.GH8262@noisy.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + kernel/locking/lockdep.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index e85b5ad3e2069..151bd3de59363 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -3497,7 +3497,8 @@ static int alloc_chain_hlocks(int req) + size = chain_block_size(curr); + if (likely(size >= req)) { + del_chain_block(0, size, chain_block_next(curr)); +- add_chain_block(curr + req, size - req); ++ if (size > req) ++ add_chain_block(curr + req, size - req); + return curr; + } + } +-- +2.42.0 + diff --git a/queue-6.6/mm-add-a-no_inherit-flag-to-the-pr_set_mdwe-prctl.patch b/queue-6.6/mm-add-a-no_inherit-flag-to-the-pr_set_mdwe-prctl.patch new file mode 100644 index 00000000000..919b5482fb6 --- /dev/null +++ b/queue-6.6/mm-add-a-no_inherit-flag-to-the-pr_set_mdwe-prctl.patch @@ -0,0 +1,164 @@ +From 3d629981df89a3fd25d8e706fa521856436db76e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Aug 2023 17:08:57 +0200 +Subject: mm: add a NO_INHERIT flag to the PR_SET_MDWE prctl + +From: Florent Revest + +[ Upstream commit 24e41bf8a6b424c76c5902fb999e9eca61bdf83d ] + +This extends the current PR_SET_MDWE prctl arg with a bit to indicate that +the process doesn't want MDWE protection to propagate to children. + +To implement this no-inherit mode, the tag in current->mm->flags must be +absent from MMF_INIT_MASK. This means that the encoding for "MDWE but +without inherit" is different in the prctl than in the mm flags. This +leads to a bit of bit-mangling in the prctl implementation. + +Link: https://lkml.kernel.org/r/20230828150858.393570-6-revest@chromium.org +Signed-off-by: Florent Revest +Reviewed-by: Kees Cook +Reviewed-by: Catalin Marinas +Cc: Alexey Izbyshev +Cc: Anshuman Khandual +Cc: Ayush Jain +Cc: David Hildenbrand +Cc: Greg Thelen +Cc: Joey Gouly +Cc: KP Singh +Cc: Mark Brown +Cc: Michal Hocko +Cc: Peter Xu +Cc: Ryan Roberts +Cc: Szabolcs Nagy +Cc: Topi Miettinen +Signed-off-by: Andrew Morton +Stable-dep-of: 793838138c15 ("prctl: Disable prctl(PR_SET_MDWE) on parisc") +Signed-off-by: Sasha Levin +--- + include/linux/sched/coredump.h | 10 ++++++++++ + include/uapi/linux/prctl.h | 1 + + kernel/fork.c | 2 +- + kernel/sys.c | 32 ++++++++++++++++++++++++++------ + tools/include/uapi/linux/prctl.h | 1 + + 5 files changed, 39 insertions(+), 7 deletions(-) + +diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h +index 0ee96ea7a0e90..1b37fa8fc723d 100644 +--- a/include/linux/sched/coredump.h ++++ b/include/linux/sched/coredump.h +@@ -91,4 +91,14 @@ static inline int get_dumpable(struct mm_struct *mm) + MMF_DISABLE_THP_MASK | MMF_HAS_MDWE_MASK) + + #define MMF_VM_MERGE_ANY 29 ++#define MMF_HAS_MDWE_NO_INHERIT 30 ++ ++static inline unsigned long mmf_init_flags(unsigned long flags) ++{ ++ if (flags & (1UL << MMF_HAS_MDWE_NO_INHERIT)) ++ flags &= ~((1UL << MMF_HAS_MDWE) | ++ (1UL << MMF_HAS_MDWE_NO_INHERIT)); ++ return flags & MMF_INIT_MASK; ++} ++ + #endif /* _LINUX_SCHED_COREDUMP_H */ +diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h +index 9a85c69782bdd..370ed14b1ae09 100644 +--- a/include/uapi/linux/prctl.h ++++ b/include/uapi/linux/prctl.h +@@ -284,6 +284,7 @@ struct prctl_mm_map { + /* Memory deny write / execute */ + #define PR_SET_MDWE 65 + # define PR_MDWE_REFUSE_EXEC_GAIN (1UL << 0) ++# define PR_MDWE_NO_INHERIT (1UL << 1) + + #define PR_GET_MDWE 66 + +diff --git a/kernel/fork.c b/kernel/fork.c +index 3b6d20dfb9a85..177ce7438db6b 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1288,7 +1288,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, + hugetlb_count_init(mm); + + if (current->mm) { +- mm->flags = current->mm->flags & MMF_INIT_MASK; ++ mm->flags = mmf_init_flags(current->mm->flags); + mm->def_flags = current->mm->def_flags & VM_INIT_DEF_MASK; + } else { + mm->flags = default_dump_filter; +diff --git a/kernel/sys.c b/kernel/sys.c +index 2410e3999ebe5..4a8073c1b2558 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -2368,19 +2368,41 @@ static int prctl_set_vma(unsigned long opt, unsigned long start, + } + #endif /* CONFIG_ANON_VMA_NAME */ + ++static inline unsigned long get_current_mdwe(void) ++{ ++ unsigned long ret = 0; ++ ++ if (test_bit(MMF_HAS_MDWE, ¤t->mm->flags)) ++ ret |= PR_MDWE_REFUSE_EXEC_GAIN; ++ if (test_bit(MMF_HAS_MDWE_NO_INHERIT, ¤t->mm->flags)) ++ ret |= PR_MDWE_NO_INHERIT; ++ ++ return ret; ++} ++ + static inline int prctl_set_mdwe(unsigned long bits, unsigned long arg3, + unsigned long arg4, unsigned long arg5) + { ++ unsigned long current_bits; ++ + if (arg3 || arg4 || arg5) + return -EINVAL; + +- if (bits & ~(PR_MDWE_REFUSE_EXEC_GAIN)) ++ if (bits & ~(PR_MDWE_REFUSE_EXEC_GAIN | PR_MDWE_NO_INHERIT)) ++ return -EINVAL; ++ ++ /* NO_INHERIT only makes sense with REFUSE_EXEC_GAIN */ ++ if (bits & PR_MDWE_NO_INHERIT && !(bits & PR_MDWE_REFUSE_EXEC_GAIN)) + return -EINVAL; + ++ current_bits = get_current_mdwe(); ++ if (current_bits && current_bits != bits) ++ return -EPERM; /* Cannot unset the flags */ ++ ++ if (bits & PR_MDWE_NO_INHERIT) ++ set_bit(MMF_HAS_MDWE_NO_INHERIT, ¤t->mm->flags); + if (bits & PR_MDWE_REFUSE_EXEC_GAIN) + set_bit(MMF_HAS_MDWE, ¤t->mm->flags); +- else if (test_bit(MMF_HAS_MDWE, ¤t->mm->flags)) +- return -EPERM; /* Cannot unset the flag */ + + return 0; + } +@@ -2390,9 +2412,7 @@ static inline int prctl_get_mdwe(unsigned long arg2, unsigned long arg3, + { + if (arg2 || arg3 || arg4 || arg5) + return -EINVAL; +- +- return test_bit(MMF_HAS_MDWE, ¤t->mm->flags) ? +- PR_MDWE_REFUSE_EXEC_GAIN : 0; ++ return get_current_mdwe(); + } + + static int prctl_get_auxv(void __user *addr, unsigned long len) +diff --git a/tools/include/uapi/linux/prctl.h b/tools/include/uapi/linux/prctl.h +index 9a85c69782bdd..370ed14b1ae09 100644 +--- a/tools/include/uapi/linux/prctl.h ++++ b/tools/include/uapi/linux/prctl.h +@@ -284,6 +284,7 @@ struct prctl_mm_map { + /* Memory deny write / execute */ + #define PR_SET_MDWE 65 + # define PR_MDWE_REFUSE_EXEC_GAIN (1UL << 0) ++# define PR_MDWE_NO_INHERIT (1UL << 1) + + #define PR_GET_MDWE 66 + +-- +2.42.0 + diff --git a/queue-6.6/net-axienet-fix-check-for-partial-tx-checksum.patch b/queue-6.6/net-axienet-fix-check-for-partial-tx-checksum.patch new file mode 100644 index 00000000000..4ecb6aeeb14 --- /dev/null +++ b/queue-6.6/net-axienet-fix-check-for-partial-tx-checksum.patch @@ -0,0 +1,38 @@ +From 0a1655209962c06603e81ed092cc88a6a5f6df17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 16:42:17 -0800 +Subject: net: axienet: Fix check for partial TX checksum + +From: Samuel Holland + +[ Upstream commit fd0413bbf8b11f56e8aa842783b0deda0dfe2926 ] + +Due to a typo, the code checked the RX checksum feature in the TX path. + +Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") +Signed-off-by: Samuel Holland +Reviewed-by: Andrew Lunn +Reviewed-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/20231122004219.3504219-1-samuel.holland@sifive.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index b7ec4dafae90c..3297aff969c80 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -822,7 +822,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) + if (lp->features & XAE_FEATURE_FULL_TX_CSUM) { + /* Tx Full Checksum Offload Enabled */ + cur_p->app0 |= 2; +- } else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) { ++ } else if (lp->features & XAE_FEATURE_PARTIAL_TX_CSUM) { + csum_start_off = skb_transport_offset(skb); + csum_index_off = csum_start_off + skb->csum_offset; + /* Tx Partial Checksum Offload Enabled */ +-- +2.42.0 + diff --git a/queue-6.6/net-ipa-fix-one-gsi-register-field-width.patch b/queue-6.6/net-ipa-fix-one-gsi-register-field-width.patch new file mode 100644 index 00000000000..51770ed5a92 --- /dev/null +++ b/queue-6.6/net-ipa-fix-one-gsi-register-field-width.patch @@ -0,0 +1,37 @@ +From 7e24a5c7f6a7f954fb690b88fd2c44f0ac3fad6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 17:17:08 -0600 +Subject: net: ipa: fix one GSI register field width + +From: Alex Elder + +[ Upstream commit 37f0205538baf70beb57cdcb6c7d14aa13257926 ] + +The width of the R_LENGTH field of the EV_CH_E_CNTXT_1 GSI register +is 24 bits (not 20 bits) starting with IPA v5.0. Fix this. + +Fixes: faf0678ec8a0 ("net: ipa: add IPA v5.0 GSI register definitions") +Signed-off-by: Alex Elder +Link: https://lore.kernel.org/r/20231122231708.896632-1-elder@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/reg/gsi_reg-v5.0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ipa/reg/gsi_reg-v5.0.c b/drivers/net/ipa/reg/gsi_reg-v5.0.c +index d7b81a36d673b..145eb0bd096d6 100644 +--- a/drivers/net/ipa/reg/gsi_reg-v5.0.c ++++ b/drivers/net/ipa/reg/gsi_reg-v5.0.c +@@ -78,7 +78,7 @@ REG_STRIDE_FIELDS(EV_CH_E_CNTXT_0, ev_ch_e_cntxt_0, + 0x0001c000 + 0x12000 * GSI_EE_AP, 0x80); + + static const u32 reg_ev_ch_e_cntxt_1_fmask[] = { +- [R_LENGTH] = GENMASK(19, 0), ++ [R_LENGTH] = GENMASK(23, 0), + }; + + REG_STRIDE_FIELDS(EV_CH_E_CNTXT_1, ev_ch_e_cntxt_1, +-- +2.42.0 + diff --git a/queue-6.6/net-move-l-t-d-stats-allocation-to-core-and-convert-.patch b/queue-6.6/net-move-l-t-d-stats-allocation-to-core-and-convert-.patch new file mode 100644 index 00000000000..a17489ea6a1 --- /dev/null +++ b/queue-6.6/net-move-l-t-d-stats-allocation-to-core-and-convert-.patch @@ -0,0 +1,247 @@ +From b7794be436b4066b1f2034ce155fb216a002422f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 01:42:14 +0100 +Subject: net: Move {l,t,d}stats allocation to core and convert veth & vrf + +From: Daniel Borkmann + +[ Upstream commit 34d21de99cea9cb17967874313e5b0262527833c ] + +Move {l,t,d}stats allocation to the core and let netdevs pick the stats +type they need. That way the driver doesn't have to bother with error +handling (allocation failure checking, making sure free happens in the +right spot, etc) - all happening in the core. + +Co-developed-by: Jakub Kicinski +Signed-off-by: Jakub Kicinski +Signed-off-by: Daniel Borkmann +Reviewed-by: Nikolay Aleksandrov +Cc: David Ahern +Link: https://lore.kernel.org/r/20231114004220.6495-3-daniel@iogearbox.net +Signed-off-by: Martin KaFai Lau +Stable-dep-of: 024ee930cb3c ("bpf: Fix dev's rx stats for bpf_redirect_peer traffic") +Signed-off-by: Sasha Levin +--- + drivers/net/veth.c | 16 ++----------- + drivers/net/vrf.c | 14 +++-------- + include/linux/netdevice.h | 20 ++++++++++++---- + net/core/dev.c | 49 ++++++++++++++++++++++++++++++++++++++- + 4 files changed, 69 insertions(+), 30 deletions(-) + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 0deefd1573cf2..0ee5d1e0759fb 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -1499,25 +1499,12 @@ static void veth_free_queues(struct net_device *dev) + + static int veth_dev_init(struct net_device *dev) + { +- int err; +- +- dev->lstats = netdev_alloc_pcpu_stats(struct pcpu_lstats); +- if (!dev->lstats) +- return -ENOMEM; +- +- err = veth_alloc_queues(dev); +- if (err) { +- free_percpu(dev->lstats); +- return err; +- } +- +- return 0; ++ return veth_alloc_queues(dev); + } + + static void veth_dev_free(struct net_device *dev) + { + veth_free_queues(dev); +- free_percpu(dev->lstats); + } + + #ifdef CONFIG_NET_POLL_CONTROLLER +@@ -1789,6 +1776,7 @@ static void veth_setup(struct net_device *dev) + NETIF_F_HW_VLAN_STAG_RX); + dev->needs_free_netdev = true; + dev->priv_destructor = veth_dev_free; ++ dev->pcpu_stat_type = NETDEV_PCPU_STAT_LSTATS; + dev->max_mtu = ETH_MAX_MTU; + + dev->hw_features = VETH_FEATURES; +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 3654c8b344024..b90dccdc2d33c 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -1164,22 +1164,15 @@ static void vrf_dev_uninit(struct net_device *dev) + + vrf_rtable_release(dev, vrf); + vrf_rt6_release(dev, vrf); +- +- free_percpu(dev->dstats); +- dev->dstats = NULL; + } + + static int vrf_dev_init(struct net_device *dev) + { + struct net_vrf *vrf = netdev_priv(dev); + +- dev->dstats = netdev_alloc_pcpu_stats(struct pcpu_dstats); +- if (!dev->dstats) +- goto out_nomem; +- + /* create the default dst which points back to us */ + if (vrf_rtable_create(dev) != 0) +- goto out_stats; ++ goto out_nomem; + + if (vrf_rt6_create(dev) != 0) + goto out_rth; +@@ -1193,9 +1186,6 @@ static int vrf_dev_init(struct net_device *dev) + + out_rth: + vrf_rtable_release(dev, vrf); +-out_stats: +- free_percpu(dev->dstats); +- dev->dstats = NULL; + out_nomem: + return -ENOMEM; + } +@@ -1694,6 +1684,8 @@ static void vrf_setup(struct net_device *dev) + dev->min_mtu = IPV6_MIN_MTU; + dev->max_mtu = IP6_MAX_MTU; + dev->mtu = dev->max_mtu; ++ ++ dev->pcpu_stat_type = NETDEV_PCPU_STAT_DSTATS; + } + + static int vrf_validate(struct nlattr *tb[], struct nlattr *data[], +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index b76dc6fa4e772..b8e60a20416ba 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1774,6 +1774,13 @@ enum netdev_ml_priv_type { + ML_PRIV_CAN, + }; + ++enum netdev_stat_type { ++ NETDEV_PCPU_STAT_NONE, ++ NETDEV_PCPU_STAT_LSTATS, /* struct pcpu_lstats */ ++ NETDEV_PCPU_STAT_TSTATS, /* struct pcpu_sw_netstats */ ++ NETDEV_PCPU_STAT_DSTATS, /* struct pcpu_dstats */ ++}; ++ + /** + * struct net_device - The DEVICE structure. + * +@@ -1968,10 +1975,14 @@ enum netdev_ml_priv_type { + * + * @ml_priv: Mid-layer private + * @ml_priv_type: Mid-layer private type +- * @lstats: Loopback statistics +- * @tstats: Tunnel statistics +- * @dstats: Dummy statistics +- * @vstats: Virtual ethernet statistics ++ * ++ * @pcpu_stat_type: Type of device statistics which the core should ++ * allocate/free: none, lstats, tstats, dstats. none ++ * means the driver is handling statistics allocation/ ++ * freeing internally. ++ * @lstats: Loopback statistics: packets, bytes ++ * @tstats: Tunnel statistics: RX/TX packets, RX/TX bytes ++ * @dstats: Dummy statistics: RX/TX/drop packets, RX/TX bytes + * + * @garp_port: GARP + * @mrp_port: MRP +@@ -2328,6 +2339,7 @@ struct net_device { + void *ml_priv; + enum netdev_ml_priv_type ml_priv_type; + ++ enum netdev_stat_type pcpu_stat_type:8; + union { + struct pcpu_lstats __percpu *lstats; + struct pcpu_sw_netstats __percpu *tstats; +diff --git a/net/core/dev.c b/net/core/dev.c +index 9f3f8930c6914..37444c8e22054 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -10050,6 +10050,46 @@ void netif_tx_stop_all_queues(struct net_device *dev) + } + EXPORT_SYMBOL(netif_tx_stop_all_queues); + ++static int netdev_do_alloc_pcpu_stats(struct net_device *dev) ++{ ++ void __percpu *v; ++ ++ switch (dev->pcpu_stat_type) { ++ case NETDEV_PCPU_STAT_NONE: ++ return 0; ++ case NETDEV_PCPU_STAT_LSTATS: ++ v = dev->lstats = netdev_alloc_pcpu_stats(struct pcpu_lstats); ++ break; ++ case NETDEV_PCPU_STAT_TSTATS: ++ v = dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); ++ break; ++ case NETDEV_PCPU_STAT_DSTATS: ++ v = dev->dstats = netdev_alloc_pcpu_stats(struct pcpu_dstats); ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ return v ? 0 : -ENOMEM; ++} ++ ++static void netdev_do_free_pcpu_stats(struct net_device *dev) ++{ ++ switch (dev->pcpu_stat_type) { ++ case NETDEV_PCPU_STAT_NONE: ++ return; ++ case NETDEV_PCPU_STAT_LSTATS: ++ free_percpu(dev->lstats); ++ break; ++ case NETDEV_PCPU_STAT_TSTATS: ++ free_percpu(dev->tstats); ++ break; ++ case NETDEV_PCPU_STAT_DSTATS: ++ free_percpu(dev->dstats); ++ break; ++ } ++} ++ + /** + * register_netdevice() - register a network device + * @dev: device to register +@@ -10110,9 +10150,13 @@ int register_netdevice(struct net_device *dev) + goto err_uninit; + } + ++ ret = netdev_do_alloc_pcpu_stats(dev); ++ if (ret) ++ goto err_uninit; ++ + ret = dev_index_reserve(net, dev->ifindex); + if (ret < 0) +- goto err_uninit; ++ goto err_free_pcpu; + dev->ifindex = ret; + + /* Transfer changeable features to wanted_features and enable +@@ -10218,6 +10262,8 @@ int register_netdevice(struct net_device *dev) + call_netdevice_notifiers(NETDEV_PRE_UNINIT, dev); + err_ifindex_release: + dev_index_release(net, dev->ifindex); ++err_free_pcpu: ++ netdev_do_free_pcpu_stats(dev); + err_uninit: + if (dev->netdev_ops->ndo_uninit) + dev->netdev_ops->ndo_uninit(dev); +@@ -10470,6 +10516,7 @@ void netdev_run_todo(void) + WARN_ON(rcu_access_pointer(dev->ip_ptr)); + WARN_ON(rcu_access_pointer(dev->ip6_ptr)); + ++ netdev_do_free_pcpu_stats(dev); + if (dev->priv_destructor) + dev->priv_destructor(dev); + if (dev->needs_free_netdev) +-- +2.42.0 + diff --git a/queue-6.6/net-smc-avoid-data-corruption-caused-by-decline.patch b/queue-6.6/net-smc-avoid-data-corruption-caused-by-decline.patch new file mode 100644 index 00000000000..aebecec5ec3 --- /dev/null +++ b/queue-6.6/net-smc-avoid-data-corruption-caused-by-decline.patch @@ -0,0 +1,95 @@ +From 1acdfa6791a4732abbe9eade68cc148fd68444d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 10:37:05 +0800 +Subject: net/smc: avoid data corruption caused by decline +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: D. Wythe + +[ Upstream commit e6d71b437abc2f249e3b6a1ae1a7228e09c6e563 ] + +We found a data corruption issue during testing of SMC-R on Redis +applications. + +The benchmark has a low probability of reporting a strange error as +shown below. + +"Error: Protocol error, got "\xe2" as reply type byte" + +Finally, we found that the retrieved error data was as follows: + +0xE2 0xD4 0xC3 0xD9 0x04 0x00 0x2C 0x20 0xA6 0x56 0x00 0x16 0x3E 0x0C +0xCB 0x04 0x02 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00 +0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xE2 + +It is quite obvious that this is a SMC DECLINE message, which means that +the applications received SMC protocol message. +We found that this was caused by the following situations: + +client server + ¦ clc proposal + -------------> + ¦ clc accept + <------------- + ¦ clc confirm + -------------> +wait llc confirm + send llc confirm + ¦failed llc confirm + ¦ x------ +(after 2s)timeout + wait llc confirm rsp + +wait decline + +(after 1s) timeout + (after 2s) timeout + ¦ decline + --------------> + ¦ decline + <-------------- + +As a result, a decline message was sent in the implementation, and this +message was read from TCP by the already-fallback connection. + +This patch double the client timeout as 2x of the server value, +With this simple change, the Decline messages should never cross or +collide (during Confirm link timeout). + +This issue requires an immediate solution, since the protocol updates +involve a more long-term solution. + +Fixes: 0fb0b02bd6fd ("net/smc: adapt SMC client code to use the LLC flow") +Signed-off-by: D. Wythe +Reviewed-by: Wen Gu +Reviewed-by: Wenjia Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 4c047e0e1625e..741339ac94833 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -598,8 +598,12 @@ static int smcr_clnt_conf_first_link(struct smc_sock *smc) + struct smc_llc_qentry *qentry; + int rc; + +- /* receive CONFIRM LINK request from server over RoCE fabric */ +- qentry = smc_llc_wait(link->lgr, NULL, SMC_LLC_WAIT_TIME, ++ /* Receive CONFIRM LINK request from server over RoCE fabric. ++ * Increasing the client's timeout by twice as much as the server's ++ * timeout by default can temporarily avoid decline messages of ++ * both sides crossing or colliding ++ */ ++ qentry = smc_llc_wait(link->lgr, NULL, 2 * SMC_LLC_WAIT_TIME, + SMC_LLC_CONFIRM_LINK); + if (!qentry) { + struct smc_clc_msg_decline dclc; +-- +2.42.0 + diff --git a/queue-6.6/net-usb-ax88179_178a-fix-failed-operations-during-ax.patch b/queue-6.6/net-usb-ax88179_178a-fix-failed-operations-during-ax.patch new file mode 100644 index 00000000000..650c38e01c4 --- /dev/null +++ b/queue-6.6/net-usb-ax88179_178a-fix-failed-operations-during-ax.patch @@ -0,0 +1,66 @@ +From f5668f8c70739d1f99fb78758614a15786f5d375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 13:06:29 +0100 +Subject: net: usb: ax88179_178a: fix failed operations during ax88179_reset + +From: Jose Ignacio Tornos Martinez + +[ Upstream commit 0739af07d1d947af27c877f797cb82ceee702515 ] + +Using generic ASIX Electronics Corp. AX88179 Gigabit Ethernet device, +the following test cycle has been implemented: + - power on + - check logs + - shutdown + - after detecting the system shutdown, disconnect power + - after approximately 60 seconds of sleep, power is restored +Running some cycles, sometimes error logs like this appear: + kernel: ax88179_178a 2-9:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -19 + kernel: ax88179_178a 2-9:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -19 + ... +These failed operation are happening during ax88179_reset execution, so +the initialization could not be correct. + +In order to avoid this, we need to increase the delay after reset and +clock initial operations. By using these larger values, many cycles +have been run and no failed operations appear. + +It would be better to check some status register to verify when the +operation has finished, but I do not have found any available information +(neither in the public datasheets nor in the manufacturer's driver). The +only available information for the necessary delays is the maufacturer's +driver (original values) but the proposed values are not enough for the +tested devices. + +Fixes: e2ca90c276e1f ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver") +Reported-by: Herb Wei +Tested-by: Herb Wei +Signed-off-by: Jose Ignacio Tornos Martinez +Link: https://lore.kernel.org/r/20231120120642.54334-1-jtornosm@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ax88179_178a.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index aff39bf3161de..4ea0e155bb0d5 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1583,11 +1583,11 @@ static int ax88179_reset(struct usbnet *dev) + + *tmp16 = AX_PHYPWR_RSTCTL_IPRL; + ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16); +- msleep(200); ++ msleep(500); + + *tmp = AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS; + ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, tmp); +- msleep(100); ++ msleep(200); + + /* Ethernet PHY Auto Detach*/ + ax88179_auto_detach(dev); +-- +2.42.0 + diff --git a/queue-6.6/net-veth-fix-ethtool-stats-reporting.patch b/queue-6.6/net-veth-fix-ethtool-stats-reporting.patch new file mode 100644 index 00000000000..32b76b20bd5 --- /dev/null +++ b/queue-6.6/net-veth-fix-ethtool-stats-reporting.patch @@ -0,0 +1,48 @@ +From 10d9fdda8e10bb261caa216c0bf7d3dd15d052e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 20:08:44 +0100 +Subject: net: veth: fix ethtool stats reporting + +From: Lorenzo Bianconi + +[ Upstream commit 818ad9cc90d4a7165caaee7e32800c50d0564ec3 ] + +Fix a possible misalignment between page_pool stats and tx xdp_stats +reported in veth_get_ethtool_stats routine. +The issue can be reproduced configuring the veth pair with the +following tx/rx queues: + +$ip link add v0 numtxqueues 2 numrxqueues 4 type veth peer name v1 \ + numtxqueues 1 numrxqueues 1 + +and loading a simple XDP program on v0 that just returns XDP_PASS. +In this case on v0 the page_pool stats overwrites tx xdp_stats for queue 1. +Fix the issue incrementing pp_idx of dev->real_num_tx_queues * VETH_TQ_STATS_LEN +since we always report xdp_stats for all tx queues in ethtool. + +Fixes: 4fc418053ec7 ("net: veth: add page_pool stats") +Signed-off-by: Lorenzo Bianconi +Link: https://lore.kernel.org/r/c5b5d0485016836448453f12846c7c4ab75b094a.1700593593.git.lorenzo@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/veth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 0ee5d1e0759fb..af326b91506eb 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -236,8 +236,8 @@ static void veth_get_ethtool_stats(struct net_device *dev, + data[tx_idx + j] += *(u64 *)(base + offset); + } + } while (u64_stats_fetch_retry(&rq_stats->syncp, start)); +- pp_idx = tx_idx + VETH_TQ_STATS_LEN; + } ++ pp_idx = idx + dev->real_num_tx_queues * VETH_TQ_STATS_LEN; + + page_pool_stats: + veth_get_page_pool_stats(dev, &data[pp_idx]); +-- +2.42.0 + diff --git a/queue-6.6/net-vrf-move-dstats-structure-to-core.patch b/queue-6.6/net-vrf-move-dstats-structure-to-core.patch new file mode 100644 index 00000000000..20badd8d0aa --- /dev/null +++ b/queue-6.6/net-vrf-move-dstats-structure-to-core.patch @@ -0,0 +1,118 @@ +From 20a1036697ecc8e340a702b7699a4a1c9d791c01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 01:42:13 +0100 +Subject: net, vrf: Move dstats structure to core + +From: Daniel Borkmann + +[ Upstream commit 79e0c5be8c73a674c92bd4ba77b75f4f8c91d32e ] + +Just move struct pcpu_dstats out of the vrf into the core, and streamline +the field names slightly, so they better align with the {t,l}stats ones. + +No functional change otherwise. A conversion of the u64s to u64_stats_t +could be done at a separate point in future. This move is needed as we are +moving the {t,l,d}stats allocation/freeing to the core. + +Signed-off-by: Daniel Borkmann +Reviewed-by: Nikolay Aleksandrov +Cc: Jakub Kicinski +Cc: David Ahern +Link: https://lore.kernel.org/r/20231114004220.6495-2-daniel@iogearbox.net +Signed-off-by: Martin KaFai Lau +Stable-dep-of: 024ee930cb3c ("bpf: Fix dev's rx stats for bpf_redirect_peer traffic") +Signed-off-by: Sasha Levin +--- + drivers/net/vrf.c | 24 +++++++----------------- + include/linux/netdevice.h | 10 ++++++++++ + 2 files changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index a3408e4e1491b..3654c8b344024 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -121,22 +121,12 @@ struct net_vrf { + int ifindex; + }; + +-struct pcpu_dstats { +- u64 tx_pkts; +- u64 tx_bytes; +- u64 tx_drps; +- u64 rx_pkts; +- u64 rx_bytes; +- u64 rx_drps; +- struct u64_stats_sync syncp; +-}; +- + static void vrf_rx_stats(struct net_device *dev, int len) + { + struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats); + + u64_stats_update_begin(&dstats->syncp); +- dstats->rx_pkts++; ++ dstats->rx_packets++; + dstats->rx_bytes += len; + u64_stats_update_end(&dstats->syncp); + } +@@ -161,10 +151,10 @@ static void vrf_get_stats64(struct net_device *dev, + do { + start = u64_stats_fetch_begin(&dstats->syncp); + tbytes = dstats->tx_bytes; +- tpkts = dstats->tx_pkts; +- tdrops = dstats->tx_drps; ++ tpkts = dstats->tx_packets; ++ tdrops = dstats->tx_drops; + rbytes = dstats->rx_bytes; +- rpkts = dstats->rx_pkts; ++ rpkts = dstats->rx_packets; + } while (u64_stats_fetch_retry(&dstats->syncp, start)); + stats->tx_bytes += tbytes; + stats->tx_packets += tpkts; +@@ -421,7 +411,7 @@ static int vrf_local_xmit(struct sk_buff *skb, struct net_device *dev, + if (likely(__netif_rx(skb) == NET_RX_SUCCESS)) + vrf_rx_stats(dev, len); + else +- this_cpu_inc(dev->dstats->rx_drps); ++ this_cpu_inc(dev->dstats->rx_drops); + + return NETDEV_TX_OK; + } +@@ -616,11 +606,11 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev) + struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats); + + u64_stats_update_begin(&dstats->syncp); +- dstats->tx_pkts++; ++ dstats->tx_packets++; + dstats->tx_bytes += len; + u64_stats_update_end(&dstats->syncp); + } else { +- this_cpu_inc(dev->dstats->tx_drps); ++ this_cpu_inc(dev->dstats->tx_drops); + } + + return ret; +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index b646609f09c05..b76dc6fa4e772 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -2725,6 +2725,16 @@ struct pcpu_sw_netstats { + struct u64_stats_sync syncp; + } __aligned(4 * sizeof(u64)); + ++struct pcpu_dstats { ++ u64 rx_packets; ++ u64 rx_bytes; ++ u64 rx_drops; ++ u64 tx_packets; ++ u64 tx_bytes; ++ u64 tx_drops; ++ struct u64_stats_sync syncp; ++} __aligned(8 * sizeof(u64)); ++ + struct pcpu_lstats { + u64_stats_t packets; + u64_stats_t bytes; +-- +2.42.0 + diff --git a/queue-6.6/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch b/queue-6.6/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch new file mode 100644 index 00000000000..9bf1c3a7e6f --- /dev/null +++ b/queue-6.6/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch @@ -0,0 +1,79 @@ +From 54426c50064726039abccda5ce5fdcb2b7389d14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 18:11:08 +0800 +Subject: net: wangxun: fix kernel panic due to null pointer + +From: Jiawen Wu + +[ Upstream commit 8ba2c459668cfe2aaacc5ebcd35b4b9ef8643013 ] + +When the device uses a custom subsystem vendor ID, the function +wx_sw_init() returns before the memory of 'wx->mac_table' is allocated. +The null pointer will causes the kernel panic. + +Fixes: 79625f45ca73 ("net: wangxun: Move MAC address handling to libwx") +Signed-off-by: Jiawen Wu +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/wangxun/libwx/wx_hw.c | 8 +++++--- + drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 4 +--- + drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 4 +--- + 3 files changed, 7 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/wangxun/libwx/wx_hw.c b/drivers/net/ethernet/wangxun/libwx/wx_hw.c +index 85dc16faca544..52130df26aee5 100644 +--- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c ++++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c +@@ -1677,10 +1677,12 @@ int wx_sw_init(struct wx *wx) + wx->subsystem_device_id = pdev->subsystem_device; + } else { + err = wx_flash_read_dword(wx, 0xfffdc, &ssid); +- if (!err) +- wx->subsystem_device_id = swab16((u16)ssid); ++ if (err < 0) { ++ wx_err(wx, "read of internal subsystem device id failed\n"); ++ return err; ++ } + +- return err; ++ wx->subsystem_device_id = swab16((u16)ssid); + } + + wx->mac_table = kcalloc(wx->mac.num_rar_entries, +diff --git a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c +index 2b431db6085a6..a4d63d2f3c5bb 100644 +--- a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c ++++ b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c +@@ -121,10 +121,8 @@ static int ngbe_sw_init(struct wx *wx) + + /* PCI config space info */ + err = wx_sw_init(wx); +- if (err < 0) { +- wx_err(wx, "read of internal subsystem device id failed\n"); ++ if (err < 0) + return err; +- } + + /* mac type, phy type , oem type */ + ngbe_init_type_code(wx); +diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +index 5c3aed516ac20..d60c26ba0ba4c 100644 +--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c ++++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +@@ -362,10 +362,8 @@ static int txgbe_sw_init(struct wx *wx) + + /* PCI config space info */ + err = wx_sw_init(wx); +- if (err < 0) { +- wx_err(wx, "read of internal subsystem device id failed\n"); ++ if (err < 0) + return err; +- } + + txgbe_init_type_code(wx); + +-- +2.42.0 + diff --git a/queue-6.6/nvme-blank-out-authentication-fabrics-options-if-not.patch b/queue-6.6/nvme-blank-out-authentication-fabrics-options-if-not.patch new file mode 100644 index 00000000000..19d8644e6c2 --- /dev/null +++ b/queue-6.6/nvme-blank-out-authentication-fabrics-options-if-not.patch @@ -0,0 +1,43 @@ +From f5f013a0ccd06da22b24572a61f26880165036dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 13:14:35 +0100 +Subject: nvme: blank out authentication fabrics options if not configured + +From: Hannes Reinecke + +[ Upstream commit c7ca9757bda35ff9ce27ab42f2cb8b84d983e6ad ] + +If the config option NVME_HOST_AUTH is not selected we should not +accept the corresponding fabrics options. This allows userspace +to detect if NVMe authentication has been enabled for the kernel. + +Cc: Shin'ichiro Kawasaki +Fixes: f50fff73d620 ("nvme: implement In-Band authentication") +Signed-off-by: Hannes Reinecke +Tested-by: Shin'ichiro Kawasaki +Reviewed-by: Daniel Wagner +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fabrics.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 8175d49f29090..92ba315cfe19e 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -645,8 +645,10 @@ static const match_table_t opt_tokens = { + { NVMF_OPT_TOS, "tos=%d" }, + { NVMF_OPT_FAIL_FAST_TMO, "fast_io_fail_tmo=%d" }, + { NVMF_OPT_DISCOVERY, "discovery" }, ++#ifdef CONFIG_NVME_HOST_AUTH + { NVMF_OPT_DHCHAP_SECRET, "dhchap_secret=%s" }, + { NVMF_OPT_DHCHAP_CTRL_SECRET, "dhchap_ctrl_secret=%s" }, ++#endif + { NVMF_OPT_ERR, NULL } + }; + +-- +2.42.0 + diff --git a/queue-6.6/nvmet-nul-terminate-the-nqns-passed-in-the-connect-c.patch b/queue-6.6/nvmet-nul-terminate-the-nqns-passed-in-the-connect-c.patch new file mode 100644 index 00000000000..1f620c89f73 --- /dev/null +++ b/queue-6.6/nvmet-nul-terminate-the-nqns-passed-in-the-connect-c.patch @@ -0,0 +1,48 @@ +From 4c91b3234daa78c6b8e0f1024e5e73f402d1613f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 08:13:36 -0500 +Subject: nvmet: nul-terminate the NQNs passed in the connect command + +From: Christoph Hellwig + +[ Upstream commit 1c22e0295a5eb571c27b53c7371f95699ef705ff ] + +The host and subsystem NQNs are passed in the connect command payload and +interpreted as nul-terminated strings. Ensure they actually are +nul-terminated before using them. + +Fixes: a07b4970f464 "nvmet: add a generic NVMe target") +Reported-by: Alon Zahavi +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fabrics-cmd.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c +index 43b5bd8bb6a52..d8da840a1c0ed 100644 +--- a/drivers/nvme/target/fabrics-cmd.c ++++ b/drivers/nvme/target/fabrics-cmd.c +@@ -244,6 +244,8 @@ static void nvmet_execute_admin_connect(struct nvmet_req *req) + goto out; + } + ++ d->subsysnqn[NVMF_NQN_FIELD_LEN - 1] = '\0'; ++ d->hostnqn[NVMF_NQN_FIELD_LEN - 1] = '\0'; + status = nvmet_alloc_ctrl(d->subsysnqn, d->hostnqn, req, + le32_to_cpu(c->kato), &ctrl); + if (status) +@@ -313,6 +315,8 @@ static void nvmet_execute_io_connect(struct nvmet_req *req) + goto out; + } + ++ d->subsysnqn[NVMF_NQN_FIELD_LEN - 1] = '\0'; ++ d->hostnqn[NVMF_NQN_FIELD_LEN - 1] = '\0'; + ctrl = nvmet_ctrl_find_get(d->subsysnqn, d->hostnqn, + le16_to_cpu(d->cntlid), req); + if (!ctrl) { +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-pf-fix-memory-leak-during-interface-down.patch b/queue-6.6/octeontx2-pf-fix-memory-leak-during-interface-down.patch new file mode 100644 index 00000000000..d640056021b --- /dev/null +++ b/queue-6.6/octeontx2-pf-fix-memory-leak-during-interface-down.patch @@ -0,0 +1,37 @@ +From adee7a4eaea27f9068743ae0a0f3b89004bb3988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 16:10:18 +0530 +Subject: octeontx2-pf: Fix memory leak during interface down + +From: Suman Ghosh + +[ Upstream commit 5f228d7c8a539714c1e9b7e7534f76bb7979f268 ] + +During 'ifconfig down' one RSS memory was not getting freed. +This patch fixes the same. + +Fixes: 81a4362016e7 ("octeontx2-pf: Add RSS multi group support") +Signed-off-by: Suman Ghosh +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 91b99fd703616..ba95ac9132746 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1934,6 +1934,8 @@ int otx2_stop(struct net_device *netdev) + /* Clear RSS enable flag */ + rss = &pf->hw.rss_info; + rss->enable = false; ++ if (!netif_is_rxfh_configured(netdev)) ++ kfree(rss->rss_ctx[DEFAULT_RSS_CONTEXT_GROUP]); + + /* Cleanup Queue IRQ */ + vec = pci_irq_vector(pf->pdev, +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-pf-fix-ntuple-rule-creation-to-direct-pack.patch b/queue-6.6/octeontx2-pf-fix-ntuple-rule-creation-to-direct-pack.patch new file mode 100644 index 00000000000..aff3f954de1 --- /dev/null +++ b/queue-6.6/octeontx2-pf-fix-ntuple-rule-creation-to-direct-pack.patch @@ -0,0 +1,79 @@ +From c68e429cfc99fab06f12124c5038dfc20f693507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 22:26:24 +0530 +Subject: octeontx2-pf: Fix ntuple rule creation to direct packet to VF with + higher Rx queue than its PF + +From: Suman Ghosh + +[ Upstream commit 4aa1d8f89b10cdc25a231dabf808d8935e0b137a ] + +It is possible to add a ntuple rule which would like to direct packet to +a VF whose number of queues are greater/less than its PF's queue numbers. +For example a PF can have 2 Rx queues but a VF created on that PF can have +8 Rx queues. As of today, ntuple rule will reject rule because it is +checking the requested queue number against PF's number of Rx queues. +As a part of this fix if the action of a ntuple rule is to move a packet +to a VF's queue then the check is removed. Also, a debug information is +printed to aware user that it is user's responsibility to cross check if +the requested queue number on that VF is a valid one. + +Fixes: f0a1913f8a6f ("octeontx2-pf: Add support for ethtool ntuple filters") +Signed-off-by: Suman Ghosh +Reviewed-by: Wojciech Drewek +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20231121165624.3664182-1-sumang@marvell.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../marvell/octeontx2/nic/otx2_flows.c | 20 ++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +index 4762dbea64a12..97a71e9b85637 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +@@ -1088,6 +1088,7 @@ int otx2_add_flow(struct otx2_nic *pfvf, struct ethtool_rxnfc *nfc) + struct ethhdr *eth_hdr; + bool new = false; + int err = 0; ++ u64 vf_num; + u32 ring; + + if (!flow_cfg->max_flows) { +@@ -1100,7 +1101,21 @@ int otx2_add_flow(struct otx2_nic *pfvf, struct ethtool_rxnfc *nfc) + if (!(pfvf->flags & OTX2_FLAG_NTUPLE_SUPPORT)) + return -ENOMEM; + +- if (ring >= pfvf->hw.rx_queues && fsp->ring_cookie != RX_CLS_FLOW_DISC) ++ /* Number of queues on a VF can be greater or less than ++ * the PF's queue. Hence no need to check for the ++ * queue count. Hence no need to check queue count if PF ++ * is installing for its VF. Below is the expected vf_num value ++ * based on the ethtool commands. ++ * ++ * e.g. ++ * 1. ethtool -U ... action -1 ==> vf_num:255 ++ * 2. ethtool -U ... action ==> vf_num:0 ++ * 3. ethtool -U ... vf queue ==> ++ * vf_num:vf_idx+1 ++ */ ++ vf_num = ethtool_get_flow_spec_ring_vf(fsp->ring_cookie); ++ if (!is_otx2_vf(pfvf->pcifunc) && !vf_num && ++ ring >= pfvf->hw.rx_queues && fsp->ring_cookie != RX_CLS_FLOW_DISC) + return -EINVAL; + + if (fsp->location >= otx2_get_maxflows(flow_cfg)) +@@ -1182,6 +1197,9 @@ int otx2_add_flow(struct otx2_nic *pfvf, struct ethtool_rxnfc *nfc) + flow_cfg->nr_flows++; + } + ++ if (flow->is_vf) ++ netdev_info(pfvf->netdev, ++ "Make sure that VF's queue number is within its queue limit\n"); + return 0; + } + +-- +2.42.0 + diff --git a/queue-6.6/pm-tools-fix-sleepgraph-syntax-error.patch b/queue-6.6/pm-tools-fix-sleepgraph-syntax-error.patch new file mode 100644 index 00000000000..1c6e3ea2606 --- /dev/null +++ b/queue-6.6/pm-tools-fix-sleepgraph-syntax-error.patch @@ -0,0 +1,41 @@ +From b3ff9d3868868e4bf392a38acda8479ee55c0327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 11:47:51 -0500 +Subject: PM: tools: Fix sleepgraph syntax error + +From: David Woodhouse + +[ Upstream commit b85e2dab33ce467e8dcf1cb6c0c587132ff17f56 ] + +The sleepgraph tool currently fails: + + File "/usr/bin/sleepgraph", line 4155 + or re.match('psci: CPU(?P[0-9]*) killed.*', msg)): + ^ +SyntaxError: unmatched ')' + +Fixes: 34ea427e01ea ("PM: tools: sleepgraph: Recognize "CPU killed" messages") +Signed-off-by: David Woodhouse +Reviewed-by: Wolfram Sang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/power/pm-graph/sleepgraph.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/pm-graph/sleepgraph.py b/tools/power/pm-graph/sleepgraph.py +index 4a356a7067855..40ad221e88811 100755 +--- a/tools/power/pm-graph/sleepgraph.py ++++ b/tools/power/pm-graph/sleepgraph.py +@@ -4151,7 +4151,7 @@ def parseKernelLog(data): + elif(re.match('Enabling non-boot CPUs .*', msg)): + # start of first cpu resume + cpu_start = ktime +- elif(re.match('smpboot: CPU (?P[0-9]*) is now offline', msg)) \ ++ elif(re.match('smpboot: CPU (?P[0-9]*) is now offline', msg) \ + or re.match('psci: CPU(?P[0-9]*) killed.*', msg)): + # end of a cpu suspend, start of the next + m = re.match('smpboot: CPU (?P[0-9]*) is now offline', msg) +-- +2.42.0 + diff --git a/queue-6.6/prctl-disable-prctl-pr_set_mdwe-on-parisc.patch b/queue-6.6/prctl-disable-prctl-pr_set_mdwe-on-parisc.patch new file mode 100644 index 00000000000..3696d188670 --- /dev/null +++ b/queue-6.6/prctl-disable-prctl-pr_set_mdwe-on-parisc.patch @@ -0,0 +1,46 @@ +From dbeede36c6ac78eea6385fcaeae6be0e519ae74b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Nov 2023 19:33:35 +0100 +Subject: prctl: Disable prctl(PR_SET_MDWE) on parisc + +From: Helge Deller + +[ Upstream commit 793838138c157d4c49f4fb744b170747e3dabf58 ] + +systemd-254 tries to use prctl(PR_SET_MDWE) for it's MemoryDenyWriteExecute +functionality, but fails on parisc which still needs executable stacks in +certain combinations of gcc/glibc/kernel. + +Disable prctl(PR_SET_MDWE) by returning -EINVAL for now on parisc, until +userspace has catched up. + +Signed-off-by: Helge Deller +Co-developed-by: Linus Torvalds +Reported-by: Sam James +Closes: https://github.com/systemd/systemd/issues/29775 +Tested-by: Sam James +Link: https://lore.kernel.org/all/875y2jro9a.fsf@gentoo.org/ +Cc: # v6.3+ +Signed-off-by: Sasha Levin +--- + kernel/sys.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/kernel/sys.c b/kernel/sys.c +index 4a8073c1b2558..7a4ae6d5aecd5 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -2395,6 +2395,10 @@ static inline int prctl_set_mdwe(unsigned long bits, unsigned long arg3, + if (bits & PR_MDWE_NO_INHERIT && !(bits & PR_MDWE_REFUSE_EXEC_GAIN)) + return -EINVAL; + ++ /* PARISC cannot allow mdwe as it needs writable stacks */ ++ if (IS_ENABLED(CONFIG_PARISC)) ++ return -EINVAL; ++ + current_bits = get_current_mdwe(); + if (current_bits && current_bits != bits) + return -EPERM; /* Cannot unset the flags */ +-- +2.42.0 + diff --git a/queue-6.6/rxrpc-defer-the-response-to-a-ping-ack-until-we-ve-p.patch b/queue-6.6/rxrpc-defer-the-response-to-a-ping-ack-until-we-ve-p.patch new file mode 100644 index 00000000000..1b7d3deeaf7 --- /dev/null +++ b/queue-6.6/rxrpc-defer-the-response-to-a-ping-ack-until-we-ve-p.patch @@ -0,0 +1,120 @@ +From f452afced2bbcbbb668b94e7c417a743293a200c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 13:12:59 +0000 +Subject: rxrpc: Defer the response to a PING ACK until we've parsed it + +From: David Howells + +[ Upstream commit 1a01319feef7047aa2ba400ffa3e047776aa29ca ] + +Defer the generation of a PING RESPONSE ACK in response to a PING ACK until +we've parsed the PING ACK so that we pick up any changes to the packet +queue so that we can update ackinfo. + +This is also applied to an ACK generated in response to an ACK with the +REQUEST_ACK flag set. + +Note that whilst the problem was added in commit 248f219cb8bc, it didn't +really matter at that point because the ACK was proposed in softirq mode +and generated asynchronously later in process context, taking the latest +values at the time. But this fix is only needed since the move to parse +incoming packets in an I/O thread rather than in softirq and generate the +ACK at point of proposal (b0346843b1076b34a0278ff601f8f287535cb064). + +Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") +Signed-off-by: David Howells +cc: Marc Dionne +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: linux-afs@lists.infradead.org +cc: netdev@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/input.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index 3f9594d125192..92495e73b8699 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -814,14 +814,6 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + } + } + +- if (ack.reason == RXRPC_ACK_PING) { +- rxrpc_send_ACK(call, RXRPC_ACK_PING_RESPONSE, ack_serial, +- rxrpc_propose_ack_respond_to_ping); +- } else if (sp->hdr.flags & RXRPC_REQUEST_ACK) { +- rxrpc_send_ACK(call, RXRPC_ACK_REQUESTED, ack_serial, +- rxrpc_propose_ack_respond_to_ack); +- } +- + /* If we get an EXCEEDS_WINDOW ACK from the server, it probably + * indicates that the client address changed due to NAT. The server + * lost the call because it switched to a different peer. +@@ -832,7 +824,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + rxrpc_is_client_call(call)) { + rxrpc_set_call_completion(call, RXRPC_CALL_REMOTELY_ABORTED, + 0, -ENETRESET); +- return; ++ goto send_response; + } + + /* If we get an OUT_OF_SEQUENCE ACK from the server, that can also +@@ -846,7 +838,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + rxrpc_is_client_call(call)) { + rxrpc_set_call_completion(call, RXRPC_CALL_REMOTELY_ABORTED, + 0, -ENETRESET); +- return; ++ goto send_response; + } + + /* Discard any out-of-order or duplicate ACKs (outside lock). */ +@@ -854,7 +846,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial, + first_soft_ack, call->acks_first_seq, + prev_pkt, call->acks_prev_seq); +- return; ++ goto send_response; + } + + info.rxMTU = 0; +@@ -894,7 +886,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + case RXRPC_CALL_SERVER_AWAIT_ACK: + break; + default: +- return; ++ goto send_response; + } + + if (before(hard_ack, call->acks_hard_ack) || +@@ -906,7 +898,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + if (after(hard_ack, call->acks_hard_ack)) { + if (rxrpc_rotate_tx_window(call, hard_ack, &summary)) { + rxrpc_end_tx_phase(call, false, rxrpc_eproto_unexpected_ack); +- return; ++ goto send_response; + } + } + +@@ -924,6 +916,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + rxrpc_propose_ack_ping_for_lost_reply); + + rxrpc_congestion_management(call, skb, &summary, acked_serial); ++ ++send_response: ++ if (ack.reason == RXRPC_ACK_PING) ++ rxrpc_send_ACK(call, RXRPC_ACK_PING_RESPONSE, ack_serial, ++ rxrpc_propose_ack_respond_to_ping); ++ else if (sp->hdr.flags & RXRPC_REQUEST_ACK) ++ rxrpc_send_ACK(call, RXRPC_ACK_REQUESTED, ack_serial, ++ rxrpc_propose_ack_respond_to_ack); + } + + /* +-- +2.42.0 + diff --git a/queue-6.6/rxrpc-fix-rtt-determination-to-use-any-ack-as-a-sour.patch b/queue-6.6/rxrpc-fix-rtt-determination-to-use-any-ack-as-a-sour.patch new file mode 100644 index 00000000000..b3f9c55135f --- /dev/null +++ b/queue-6.6/rxrpc-fix-rtt-determination-to-use-any-ack-as-a-sour.patch @@ -0,0 +1,101 @@ +From 19f87b9a9f7a699ff223e7fae62752f51cf30cf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 13:12:58 +0000 +Subject: rxrpc: Fix RTT determination to use any ACK as a source + +From: David Howells + +[ Upstream commit 3798680f2fbbe0ca3ab6138b34e0d161c36497ee ] + +Fix RTT determination to be able to use any type of ACK as the response +from which RTT can be calculated provided its ack.serial is non-zero and +matches the serial number of an outgoing DATA or ACK packet. This +shouldn't be limited to REQUESTED-type ACKs as these can have other types +substituted for them for things like duplicate or out-of-order packets. + +Fixes: 4700c4d80b7b ("rxrpc: Fix loss of RTT samples due to interposed ACK") +Signed-off-by: David Howells +cc: Marc Dionne +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: linux-afs@lists.infradead.org +cc: netdev@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/trace/events/rxrpc.h | 2 +- + net/rxrpc/input.c | 35 ++++++++++++++++------------------- + 2 files changed, 17 insertions(+), 20 deletions(-) + +diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h +index 4c53a5ef6257b..f7e537f64db45 100644 +--- a/include/trace/events/rxrpc.h ++++ b/include/trace/events/rxrpc.h +@@ -328,7 +328,7 @@ + E_(rxrpc_rtt_tx_ping, "PING") + + #define rxrpc_rtt_rx_traces \ +- EM(rxrpc_rtt_rx_cancel, "CNCL") \ ++ EM(rxrpc_rtt_rx_other_ack, "OACK") \ + EM(rxrpc_rtt_rx_obsolete, "OBSL") \ + EM(rxrpc_rtt_rx_lost, "LOST") \ + EM(rxrpc_rtt_rx_ping_response, "PONG") \ +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index 030d64f282f37..3f9594d125192 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -643,12 +643,8 @@ static void rxrpc_complete_rtt_probe(struct rxrpc_call *call, + clear_bit(i + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail); + smp_mb(); /* Read data before setting avail bit */ + set_bit(i, &call->rtt_avail); +- if (type != rxrpc_rtt_rx_cancel) +- rxrpc_peer_add_rtt(call, type, i, acked_serial, ack_serial, +- sent_at, resp_time); +- else +- trace_rxrpc_rtt_rx(call, rxrpc_rtt_rx_cancel, i, +- orig_serial, acked_serial, 0, 0); ++ rxrpc_peer_add_rtt(call, type, i, acked_serial, ack_serial, ++ sent_at, resp_time); + matched = true; + } + +@@ -801,20 +797,21 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + summary.ack_reason, nr_acks); + rxrpc_inc_stat(call->rxnet, stat_rx_acks[ack.reason]); + +- switch (ack.reason) { +- case RXRPC_ACK_PING_RESPONSE: +- rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial, +- rxrpc_rtt_rx_ping_response); +- break; +- case RXRPC_ACK_REQUESTED: +- rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial, +- rxrpc_rtt_rx_requested_ack); +- break; +- default: +- if (acked_serial != 0) ++ if (acked_serial != 0) { ++ switch (ack.reason) { ++ case RXRPC_ACK_PING_RESPONSE: + rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial, +- rxrpc_rtt_rx_cancel); +- break; ++ rxrpc_rtt_rx_ping_response); ++ break; ++ case RXRPC_ACK_REQUESTED: ++ rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial, ++ rxrpc_rtt_rx_requested_ack); ++ break; ++ default: ++ rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial, ++ rxrpc_rtt_rx_other_ack); ++ break; ++ } + } + + if (ack.reason == RXRPC_ACK_PING) { +-- +2.42.0 + diff --git a/queue-6.6/s390-ipl-add-missing-ipl_type_eckd_dump-case-to-ipl_.patch b/queue-6.6/s390-ipl-add-missing-ipl_type_eckd_dump-case-to-ipl_.patch new file mode 100644 index 00000000000..f82d00f4095 --- /dev/null +++ b/queue-6.6/s390-ipl-add-missing-ipl_type_eckd_dump-case-to-ipl_.patch @@ -0,0 +1,38 @@ +From 4ad325ee5865048eaa479ab7b1db40d2bf99ced5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Nov 2023 18:18:52 +0100 +Subject: s390/ipl: add missing IPL_TYPE_ECKD_DUMP case to ipl_init() + +From: Mikhail Zaslonko + +[ Upstream commit 673752a839694133a328610fcbc54f3d59ae87f3 ] + +Add missing IPL_TYPE_ECKD_DUMP case to ipl_init() creating +ECKD ipl device attribute group similar to IPL_TYPE_ECKD case. +Commit e2d2a2968f2a ("s390/ipl: add eckd dump support") should +have had it from the beginning. + +Fixes: e2d2a2968f2a ("s390/ipl: add eckd dump support") +Signed-off-by: Mikhail Zaslonko +Reviewed-by: Sven Schnelle +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/ipl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index 05e51666db033..8d0b95c173129 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -666,6 +666,7 @@ static int __init ipl_init(void) + &ipl_ccw_attr_group_lpar); + break; + case IPL_TYPE_ECKD: ++ case IPL_TYPE_ECKD_DUMP: + rc = sysfs_create_group(&ipl_kset->kobj, &ipl_eckd_attr_group); + break; + case IPL_TYPE_FCP: +-- +2.42.0 + diff --git a/queue-6.6/s390-ism-ism-driver-implies-smc-protocol.patch b/queue-6.6/s390-ism-ism-driver-implies-smc-protocol.patch new file mode 100644 index 00000000000..5d18723f5d5 --- /dev/null +++ b/queue-6.6/s390-ism-ism-driver-implies-smc-protocol.patch @@ -0,0 +1,212 @@ +From 8bc7c9df4526c11935ed88fe5d09ee6bec588fe9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 16:59:58 +0100 +Subject: s390/ism: ism driver implies smc protocol + +From: Gerd Bayer + +[ Upstream commit d565fa4300d9ebd5ba3bbd259ce841f8dab609d6 ] + +Since commit a72178cfe855 ("net/smc: Fix dependency of SMC on ISM") +you can build the ism code without selecting the SMC network protocol. +That leaves some ism functions be reported as unused. Move these +functions under the conditional compile with CONFIG_SMC. + +Also codify the suggestion to also configure the SMC protocol in ism's +Kconfig - but with an "imply" rather than a "select" as SMC depends on +other config options and allow for a deliberate decision not to build +SMC. Also, mention that in ISM's help. + +Fixes: a72178cfe855 ("net/smc: Fix dependency of SMC on ISM") +Reported-by: Randy Dunlap +Closes: https://lore.kernel.org/netdev/afd142a2-1fa0-46b9-8b2d-7652d41d3ab8@infradead.org/ +Signed-off-by: Gerd Bayer +Reviewed-by: Wenjia Zhang +Reviewed-by: Simon Horman +Acked-by: Randy Dunlap +Tested-by: Randy Dunlap # build-tested +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/Kconfig | 3 +- + drivers/s390/net/ism_drv.c | 93 +++++++++++++++++++------------------- + 2 files changed, 48 insertions(+), 48 deletions(-) + +diff --git a/drivers/s390/net/Kconfig b/drivers/s390/net/Kconfig +index 4902d45e929ce..c61e6427384c3 100644 +--- a/drivers/s390/net/Kconfig ++++ b/drivers/s390/net/Kconfig +@@ -103,10 +103,11 @@ config CCWGROUP + config ISM + tristate "Support for ISM vPCI Adapter" + depends on PCI ++ imply SMC + default n + help + Select this option if you want to use the Internal Shared Memory +- vPCI Adapter. ++ vPCI Adapter. The adapter can be used with the SMC network protocol. + + To compile as a module choose M. The module name is ism. + If unsure, choose N. +diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c +index 6df7f377d2f90..81aabbfbbe2ca 100644 +--- a/drivers/s390/net/ism_drv.c ++++ b/drivers/s390/net/ism_drv.c +@@ -30,7 +30,6 @@ static const struct pci_device_id ism_device_table[] = { + MODULE_DEVICE_TABLE(pci, ism_device_table); + + static debug_info_t *ism_debug_info; +-static const struct smcd_ops ism_ops; + + #define NO_CLIENT 0xff /* must be >= MAX_CLIENTS */ + static struct ism_client *clients[MAX_CLIENTS]; /* use an array rather than */ +@@ -289,22 +288,6 @@ static int ism_read_local_gid(struct ism_dev *ism) + return ret; + } + +-static int ism_query_rgid(struct ism_dev *ism, u64 rgid, u32 vid_valid, +- u32 vid) +-{ +- union ism_query_rgid cmd; +- +- memset(&cmd, 0, sizeof(cmd)); +- cmd.request.hdr.cmd = ISM_QUERY_RGID; +- cmd.request.hdr.len = sizeof(cmd.request); +- +- cmd.request.rgid = rgid; +- cmd.request.vlan_valid = vid_valid; +- cmd.request.vlan_id = vid; +- +- return ism_cmd(ism, &cmd); +-} +- + static void ism_free_dmb(struct ism_dev *ism, struct ism_dmb *dmb) + { + clear_bit(dmb->sba_idx, ism->sba_bitmap); +@@ -429,23 +412,6 @@ static int ism_del_vlan_id(struct ism_dev *ism, u64 vlan_id) + return ism_cmd(ism, &cmd); + } + +-static int ism_signal_ieq(struct ism_dev *ism, u64 rgid, u32 trigger_irq, +- u32 event_code, u64 info) +-{ +- union ism_sig_ieq cmd; +- +- memset(&cmd, 0, sizeof(cmd)); +- cmd.request.hdr.cmd = ISM_SIGNAL_IEQ; +- cmd.request.hdr.len = sizeof(cmd.request); +- +- cmd.request.rgid = rgid; +- cmd.request.trigger_irq = trigger_irq; +- cmd.request.event_code = event_code; +- cmd.request.info = info; +- +- return ism_cmd(ism, &cmd); +-} +- + static unsigned int max_bytes(unsigned int start, unsigned int len, + unsigned int boundary) + { +@@ -503,14 +469,6 @@ u8 *ism_get_seid(void) + } + EXPORT_SYMBOL_GPL(ism_get_seid); + +-static u16 ism_get_chid(struct ism_dev *ism) +-{ +- if (!ism || !ism->pdev) +- return 0; +- +- return to_zpci(ism->pdev)->pchid; +-} +- + static void ism_handle_event(struct ism_dev *ism) + { + struct ism_event *entry; +@@ -569,11 +527,6 @@ static irqreturn_t ism_handle_irq(int irq, void *data) + return IRQ_HANDLED; + } + +-static u64 ism_get_local_gid(struct ism_dev *ism) +-{ +- return ism->local_gid; +-} +- + static int ism_dev_init(struct ism_dev *ism) + { + struct pci_dev *pdev = ism->pdev; +@@ -774,6 +727,22 @@ module_exit(ism_exit); + /*************************** SMC-D Implementation *****************************/ + + #if IS_ENABLED(CONFIG_SMC) ++static int ism_query_rgid(struct ism_dev *ism, u64 rgid, u32 vid_valid, ++ u32 vid) ++{ ++ union ism_query_rgid cmd; ++ ++ memset(&cmd, 0, sizeof(cmd)); ++ cmd.request.hdr.cmd = ISM_QUERY_RGID; ++ cmd.request.hdr.len = sizeof(cmd.request); ++ ++ cmd.request.rgid = rgid; ++ cmd.request.vlan_valid = vid_valid; ++ cmd.request.vlan_id = vid; ++ ++ return ism_cmd(ism, &cmd); ++} ++ + static int smcd_query_rgid(struct smcd_dev *smcd, u64 rgid, u32 vid_valid, + u32 vid) + { +@@ -811,6 +780,23 @@ static int smcd_reset_vlan_required(struct smcd_dev *smcd) + return ism_cmd_simple(smcd->priv, ISM_RESET_VLAN); + } + ++static int ism_signal_ieq(struct ism_dev *ism, u64 rgid, u32 trigger_irq, ++ u32 event_code, u64 info) ++{ ++ union ism_sig_ieq cmd; ++ ++ memset(&cmd, 0, sizeof(cmd)); ++ cmd.request.hdr.cmd = ISM_SIGNAL_IEQ; ++ cmd.request.hdr.len = sizeof(cmd.request); ++ ++ cmd.request.rgid = rgid; ++ cmd.request.trigger_irq = trigger_irq; ++ cmd.request.event_code = event_code; ++ cmd.request.info = info; ++ ++ return ism_cmd(ism, &cmd); ++} ++ + static int smcd_signal_ieq(struct smcd_dev *smcd, u64 rgid, u32 trigger_irq, + u32 event_code, u64 info) + { +@@ -830,11 +816,24 @@ static int smcd_supports_v2(void) + SYSTEM_EID.type[0] != '0'; + } + ++static u64 ism_get_local_gid(struct ism_dev *ism) ++{ ++ return ism->local_gid; ++} ++ + static u64 smcd_get_local_gid(struct smcd_dev *smcd) + { + return ism_get_local_gid(smcd->priv); + } + ++static u16 ism_get_chid(struct ism_dev *ism) ++{ ++ if (!ism || !ism->pdev) ++ return 0; ++ ++ return to_zpci(ism->pdev)->pchid; ++} ++ + static u16 smcd_get_chid(struct smcd_dev *smcd) + { + return ism_get_chid(smcd->priv); +-- +2.42.0 + diff --git a/queue-6.6/sched-eevdf-fix-vruntime-adjustment-on-reweight.patch b/queue-6.6/sched-eevdf-fix-vruntime-adjustment-on-reweight.patch new file mode 100644 index 00000000000..a4a9e396893 --- /dev/null +++ b/queue-6.6/sched-eevdf-fix-vruntime-adjustment-on-reweight.patch @@ -0,0 +1,230 @@ +From 6978a61cad8bf047e8e3262a46f36857fa2ca8ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Nov 2023 17:05:07 +0800 +Subject: sched/eevdf: Fix vruntime adjustment on reweight + +From: Abel Wu + +[ Upstream commit eab03c23c2a162085b13200d7942fc5a00b5ccc8 ] + +vruntime of the (on_rq && !0-lag) entity needs to be adjusted when +it gets re-weighted, and the calculations can be simplified based +on the fact that re-weight won't change the w-average of all the +entities. Please check the proofs in comments. + +But adjusting vruntime can also cause position change in RB-tree +hence require re-queue to fix up which might be costly. This might +be avoided by deferring adjustment to the time the entity actually +leaves tree (dequeue/pick), but that will negatively affect task +selection and probably not good enough either. + +Fixes: 147f3efaa241 ("sched/fair: Implement an EEVDF-like scheduling policy") +Signed-off-by: Abel Wu +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20231107090510.71322-2-wuyun.abel@bytedance.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 151 +++++++++++++++++++++++++++++++++++++------- + 1 file changed, 128 insertions(+), 23 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 1795f6fe991f3..0351320148177 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3626,41 +3626,140 @@ static inline void + dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) { } + #endif + ++static void reweight_eevdf(struct cfs_rq *cfs_rq, struct sched_entity *se, ++ unsigned long weight) ++{ ++ unsigned long old_weight = se->load.weight; ++ u64 avruntime = avg_vruntime(cfs_rq); ++ s64 vlag, vslice; ++ ++ /* ++ * VRUNTIME ++ * ======== ++ * ++ * COROLLARY #1: The virtual runtime of the entity needs to be ++ * adjusted if re-weight at !0-lag point. ++ * ++ * Proof: For contradiction assume this is not true, so we can ++ * re-weight without changing vruntime at !0-lag point. ++ * ++ * Weight VRuntime Avg-VRuntime ++ * before w v V ++ * after w' v' V' ++ * ++ * Since lag needs to be preserved through re-weight: ++ * ++ * lag = (V - v)*w = (V'- v')*w', where v = v' ++ * ==> V' = (V - v)*w/w' + v (1) ++ * ++ * Let W be the total weight of the entities before reweight, ++ * since V' is the new weighted average of entities: ++ * ++ * V' = (WV + w'v - wv) / (W + w' - w) (2) ++ * ++ * by using (1) & (2) we obtain: ++ * ++ * (WV + w'v - wv) / (W + w' - w) = (V - v)*w/w' + v ++ * ==> (WV-Wv+Wv+w'v-wv)/(W+w'-w) = (V - v)*w/w' + v ++ * ==> (WV - Wv)/(W + w' - w) + v = (V - v)*w/w' + v ++ * ==> (V - v)*W/(W + w' - w) = (V - v)*w/w' (3) ++ * ++ * Since we are doing at !0-lag point which means V != v, we ++ * can simplify (3): ++ * ++ * ==> W / (W + w' - w) = w / w' ++ * ==> Ww' = Ww + ww' - ww ++ * ==> W * (w' - w) = w * (w' - w) ++ * ==> W = w (re-weight indicates w' != w) ++ * ++ * So the cfs_rq contains only one entity, hence vruntime of ++ * the entity @v should always equal to the cfs_rq's weighted ++ * average vruntime @V, which means we will always re-weight ++ * at 0-lag point, thus breach assumption. Proof completed. ++ * ++ * ++ * COROLLARY #2: Re-weight does NOT affect weighted average ++ * vruntime of all the entities. ++ * ++ * Proof: According to corollary #1, Eq. (1) should be: ++ * ++ * (V - v)*w = (V' - v')*w' ++ * ==> v' = V' - (V - v)*w/w' (4) ++ * ++ * According to the weighted average formula, we have: ++ * ++ * V' = (WV - wv + w'v') / (W - w + w') ++ * = (WV - wv + w'(V' - (V - v)w/w')) / (W - w + w') ++ * = (WV - wv + w'V' - Vw + wv) / (W - w + w') ++ * = (WV + w'V' - Vw) / (W - w + w') ++ * ++ * ==> V'*(W - w + w') = WV + w'V' - Vw ++ * ==> V' * (W - w) = (W - w) * V (5) ++ * ++ * If the entity is the only one in the cfs_rq, then reweight ++ * always occurs at 0-lag point, so V won't change. Or else ++ * there are other entities, hence W != w, then Eq. (5) turns ++ * into V' = V. So V won't change in either case, proof done. ++ * ++ * ++ * So according to corollary #1 & #2, the effect of re-weight ++ * on vruntime should be: ++ * ++ * v' = V' - (V - v) * w / w' (4) ++ * = V - (V - v) * w / w' ++ * = V - vl * w / w' ++ * = V - vl' ++ */ ++ if (avruntime != se->vruntime) { ++ vlag = (s64)(avruntime - se->vruntime); ++ vlag = div_s64(vlag * old_weight, weight); ++ se->vruntime = avruntime - vlag; ++ } ++ ++ /* ++ * DEADLINE ++ * ======== ++ * ++ * When the weight changes, the virtual time slope changes and ++ * we should adjust the relative virtual deadline accordingly. ++ * ++ * d' = v' + (d - v)*w/w' ++ * = V' - (V - v)*w/w' + (d - v)*w/w' ++ * = V - (V - v)*w/w' + (d - v)*w/w' ++ * = V + (d - V)*w/w' ++ */ ++ vslice = (s64)(se->deadline - avruntime); ++ vslice = div_s64(vslice * old_weight, weight); ++ se->deadline = avruntime + vslice; ++} ++ + static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, + unsigned long weight) + { +- unsigned long old_weight = se->load.weight; ++ bool curr = cfs_rq->curr == se; + + if (se->on_rq) { + /* commit outstanding execution time */ +- if (cfs_rq->curr == se) ++ if (curr) + update_curr(cfs_rq); + else +- avg_vruntime_sub(cfs_rq, se); ++ __dequeue_entity(cfs_rq, se); + update_load_sub(&cfs_rq->load, se->load.weight); + } + dequeue_load_avg(cfs_rq, se); + +- update_load_set(&se->load, weight); +- + if (!se->on_rq) { + /* + * Because we keep se->vlag = V - v_i, while: lag_i = w_i*(V - v_i), + * we need to scale se->vlag when w_i changes. + */ +- se->vlag = div_s64(se->vlag * old_weight, weight); ++ se->vlag = div_s64(se->vlag * se->load.weight, weight); + } else { +- s64 deadline = se->deadline - se->vruntime; +- /* +- * When the weight changes, the virtual time slope changes and +- * we should adjust the relative virtual deadline accordingly. +- */ +- deadline = div_s64(deadline * old_weight, weight); +- se->deadline = se->vruntime + deadline; +- if (se != cfs_rq->curr) +- min_deadline_cb_propagate(&se->run_node, NULL); ++ reweight_eevdf(cfs_rq, se, weight); + } + ++ update_load_set(&se->load, weight); ++ + #ifdef CONFIG_SMP + do { + u32 divider = get_pelt_divider(&se->avg); +@@ -3672,8 +3771,17 @@ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, + enqueue_load_avg(cfs_rq, se); + if (se->on_rq) { + update_load_add(&cfs_rq->load, se->load.weight); +- if (cfs_rq->curr != se) +- avg_vruntime_add(cfs_rq, se); ++ if (!curr) { ++ /* ++ * The entity's vruntime has been adjusted, so let's check ++ * whether the rq-wide min_vruntime needs updated too. Since ++ * the calculations above require stable min_vruntime rather ++ * than up-to-date one, we do the update at the end of the ++ * reweight process. ++ */ ++ __enqueue_entity(cfs_rq, se); ++ update_min_vruntime(cfs_rq); ++ } + } + } + +@@ -3817,14 +3925,11 @@ static void update_cfs_group(struct sched_entity *se) + + #ifndef CONFIG_SMP + shares = READ_ONCE(gcfs_rq->tg->shares); +- +- if (likely(se->load.weight == shares)) +- return; + #else +- shares = calc_group_shares(gcfs_rq); ++ shares = calc_group_shares(gcfs_rq); + #endif +- +- reweight_entity(cfs_rq_of(se), se, shares); ++ if (unlikely(se->load.weight != shares)) ++ reweight_entity(cfs_rq_of(se), se, shares); + } + + #else /* CONFIG_FAIR_GROUP_SCHED */ +-- +2.42.0 + diff --git a/queue-6.6/sched-fair-fix-the-decision-for-load-balance.patch b/queue-6.6/sched-fair-fix-the-decision-for-load-balance.patch new file mode 100644 index 00000000000..c0cca51357e --- /dev/null +++ b/queue-6.6/sched-fair-fix-the-decision-for-load-balance.patch @@ -0,0 +1,61 @@ +From 5206e1ddba8d16a1a2d3e279b1af233dc7c3f1b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Oct 2023 14:38:22 +0100 +Subject: sched/fair: Fix the decision for load balance + +From: Keisuke Nishimura + +[ Upstream commit 6d7e4782bcf549221b4ccfffec2cf4d1a473f1a3 ] + +should_we_balance is called for the decision to do load-balancing. +When sched ticks invoke this function, only one CPU should return +true. However, in the current code, two CPUs can return true. The +following situation, where b means busy and i means idle, is an +example, because CPU 0 and CPU 2 return true. + + [0, 1] [2, 3] + b b i b + +This fix checks if there exists an idle CPU with busy sibling(s) +after looking for a CPU on an idle core. If some idle CPUs with busy +siblings are found, just the first one should do load-balancing. + +Fixes: b1bfeab9b002 ("sched/fair: Consider the idle state of the whole core for load balance") +Signed-off-by: Keisuke Nishimura +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Chen Yu +Reviewed-by: Shrikanth Hegde +Reviewed-by: Vincent Guittot +Link: https://lkml.kernel.org/r/20231031133821.1570861-1-keisuke.nishimura@inria.fr +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 0351320148177..fa9fff0f9620d 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11121,12 +11121,16 @@ static int should_we_balance(struct lb_env *env) + continue; + } + +- /* Are we the first idle CPU? */ ++ /* ++ * Are we the first idle core in a non-SMT domain or higher, ++ * or the first idle CPU in a SMT domain? ++ */ + return cpu == env->dst_cpu; + } + +- if (idle_smt == env->dst_cpu) +- return true; ++ /* Are we the first idle CPU with busy siblings? */ ++ if (idle_smt != -1) ++ return idle_smt == env->dst_cpu; + + /* Are we the first CPU of this group ? */ + return group_balance_cpu(sg) == env->dst_cpu; +-- +2.42.0 + diff --git a/queue-6.6/series b/queue-6.6/series new file mode 100644 index 00000000000..6b461b0c227 --- /dev/null +++ b/queue-6.6/series @@ -0,0 +1,63 @@ +irqchip-gic-v3-its-flush-its-tables-correctly-in-non.patch +hv-hv_kvp_daemon-some-small-fixes-for-handling-nm-ke.patch +sched-eevdf-fix-vruntime-adjustment-on-reweight.patch +sched-fair-fix-the-decision-for-load-balance.patch +drm-msm-dsi-use-the-correct-vreg_ctrl_1-value-for-4n.patch +s390-ism-ism-driver-implies-smc-protocol.patch +rxrpc-fix-rtt-determination-to-use-any-ack-as-a-sour.patch +rxrpc-defer-the-response-to-a-ping-ack-until-we-ve-p.patch +afs-fix-afs_server_list-to-be-cleaned-up-with-rcu.patch +afs-make-error-on-cell-lookup-failure-consistent-wit.patch +blk-cgroup-avoid-to-warn-rcu_read_lock_held-in-blkg_.patch +drm-panel-auo-b101uan08.3-fine-tune-the-panel-power-.patch +fs-pass-at_getattr_nosec-flag-to-getattr-interface-f.patch +drm-panel-simple-fix-innolux-g101ice-l01-bus-flags.patch +drm-panel-simple-fix-innolux-g101ice-l01-timings.patch +net-wangxun-fix-kernel-panic-due-to-null-pointer.patch +wireguard-use-dev_stats_inc.patch +octeontx2-pf-fix-memory-leak-during-interface-down.patch +ata-pata_isapnp-add-missing-error-check-for-devm_iop.patch +drm-i915-do-not-clean-gt-table-on-error-path.patch +filemap-add-a-per-mapping-stable-writes-flag.patch +block-update-the-stable_writes-flag-in-bdev_add.patch +libfs-getdents-should-return-0-after-reaching-eod.patch +drm-rockchip-vop-fix-color-for-rgb888-bgr888-format-.patch +pm-tools-fix-sleepgraph-syntax-error.patch +net-vrf-move-dstats-structure-to-core.patch +net-move-l-t-d-stats-allocation-to-core-and-convert-.patch +bpf-fix-dev-s-rx-stats-for-bpf_redirect_peer-traffic.patch +accel-ivpu-do-not-initialize-parameters-on-power-up.patch +accel-ivpu-37xx-fix-hangs-related-to-mmio-reset.patch +hid-fix-hid-device-resource-race-between-hid-core-an.patch +ipv4-correct-silence-an-endian-warning-in-__ip_do_re.patch +drm-panel-boe-tv101wum-nl6-fine-tune-himax83102-j02-.patch +net-usb-ax88179_178a-fix-failed-operations-during-ax.patch +net-smc-avoid-data-corruption-caused-by-decline.patch +s390-ipl-add-missing-ipl_type_eckd_dump-case-to-ipl_.patch +arm64-mm-fix-rodata-on-when-config_rodata_full_defau.patch +arm-xen-fix-xen_vcpu_info-allocation-alignment.patch +octeontx2-pf-fix-ntuple-rule-creation-to-direct-pack.patch +net-veth-fix-ethtool-stats-reporting.patch +amd-xgbe-handle-corner-case-during-sfp-hotplug.patch +amd-xgbe-handle-the-corner-case-during-tx-completion.patch +amd-xgbe-propagate-the-correct-speed-and-duplex-stat.patch +i40e-fix-adding-unsupported-cloud-filters.patch +vsock-test-fix-seqpacket-message-bounds-test.patch +net-axienet-fix-check-for-partial-tx-checksum.patch +net-ipa-fix-one-gsi-register-field-width.patch +afs-return-enoent-if-no-cell-dns-record-can-be-found.patch +afs-fix-file-locking-on-r-o-volumes-to-operate-in-lo.patch +nvme-blank-out-authentication-fabrics-options-if-not.patch +nvmet-nul-terminate-the-nqns-passed-in-the-connect-c.patch +usb-dwc3-qcom-fix-resource-leaks-on-probe-deferral.patch +usb-dwc3-qcom-fix-acpi-platform-device-leak.patch +lockdep-fix-block-chain-corruption.patch +mm-add-a-no_inherit-flag-to-the-pr_set_mdwe-prctl.patch +prctl-disable-prctl-pr_set_mdwe-on-parisc.patch +cifs-distribute-channels-across-interfaces-based-on-.patch +cifs-account-for-primary-channel-in-the-interface-li.patch +cifs-fix-leak-of-iface-for-primary-channel.patch +alsa-hda-asus-um5302la-added-quirks-for-cs35l41-1043.patch +alsa-hda-realtek-add-quirks-for-asus-2024-zenbooks.patch +dm-delay-for-short-delays-use-kthread-instead-of-tim.patch +dm-delay-fix-a-race-between-delay_presuspend-and-del.patch diff --git a/queue-6.6/usb-dwc3-qcom-fix-acpi-platform-device-leak.patch b/queue-6.6/usb-dwc3-qcom-fix-acpi-platform-device-leak.patch new file mode 100644 index 00000000000..d25280f7556 --- /dev/null +++ b/queue-6.6/usb-dwc3-qcom-fix-acpi-platform-device-leak.patch @@ -0,0 +1,119 @@ +From cd458c274613bd38bdb5f428d9eb33b6ab13a657 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 18:36:50 +0100 +Subject: USB: dwc3: qcom: fix ACPI platform device leak + +From: Johan Hovold + +[ Upstream commit 9cf87666fc6e08572341fe08ecd909935998fbbd ] + +Make sure to free the "urs" platform device, which is created for some +ACPI platforms, on probe errors and on driver unbind. + +Compile-tested only. + +Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot") +Cc: Shawn Guo +Signed-off-by: Johan Hovold +Acked-by: Andrew Halaney +Acked-by: Shawn Guo +Link: https://lore.kernel.org/r/20231117173650.21161-4-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 37 +++++++++++++++++++++++++++++------- + 1 file changed, 30 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 00c3021b43ce7..d6c81aa298b94 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -767,9 +767,9 @@ static int dwc3_qcom_of_register_core(struct platform_device *pdev) + return ret; + } + +-static struct platform_device * +-dwc3_qcom_create_urs_usb_platdev(struct device *dev) ++static struct platform_device *dwc3_qcom_create_urs_usb_platdev(struct device *dev) + { ++ struct platform_device *urs_usb = NULL; + struct fwnode_handle *fwh; + struct acpi_device *adev; + char name[8]; +@@ -789,9 +789,26 @@ dwc3_qcom_create_urs_usb_platdev(struct device *dev) + + adev = to_acpi_device_node(fwh); + if (!adev) +- return NULL; ++ goto err_put_handle; ++ ++ urs_usb = acpi_create_platform_device(adev, NULL); ++ if (IS_ERR_OR_NULL(urs_usb)) ++ goto err_put_handle; ++ ++ return urs_usb; + +- return acpi_create_platform_device(adev, NULL); ++err_put_handle: ++ fwnode_handle_put(fwh); ++ ++ return urs_usb; ++} ++ ++static void dwc3_qcom_destroy_urs_usb_platdev(struct platform_device *urs_usb) ++{ ++ struct fwnode_handle *fwh = urs_usb->dev.fwnode; ++ ++ platform_device_unregister(urs_usb); ++ fwnode_handle_put(fwh); + } + + static int dwc3_qcom_probe(struct platform_device *pdev) +@@ -875,13 +892,13 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + qcom->qscratch_base = devm_ioremap_resource(dev, parent_res); + if (IS_ERR(qcom->qscratch_base)) { + ret = PTR_ERR(qcom->qscratch_base); +- goto clk_disable; ++ goto free_urs; + } + + ret = dwc3_qcom_setup_irq(pdev); + if (ret) { + dev_err(dev, "failed to setup IRQs, err=%d\n", ret); +- goto clk_disable; ++ goto free_urs; + } + + /* +@@ -900,7 +917,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + + if (ret) { + dev_err(dev, "failed to register DWC3 Core, err=%d\n", ret); +- goto clk_disable; ++ goto free_urs; + } + + ret = dwc3_qcom_interconnect_init(qcom); +@@ -937,6 +954,9 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + else + platform_device_del(qcom->dwc3); + platform_device_put(qcom->dwc3); ++free_urs: ++ if (qcom->urs_usb) ++ dwc3_qcom_destroy_urs_usb_platdev(qcom->urs_usb); + clk_disable: + for (i = qcom->num_clocks - 1; i >= 0; i--) { + clk_disable_unprepare(qcom->clks[i]); +@@ -962,6 +982,9 @@ static void dwc3_qcom_remove(struct platform_device *pdev) + platform_device_del(qcom->dwc3); + platform_device_put(qcom->dwc3); + ++ if (qcom->urs_usb) ++ dwc3_qcom_destroy_urs_usb_platdev(qcom->urs_usb); ++ + for (i = qcom->num_clocks - 1; i >= 0; i--) { + clk_disable_unprepare(qcom->clks[i]); + clk_put(qcom->clks[i]); +-- +2.42.0 + diff --git a/queue-6.6/usb-dwc3-qcom-fix-resource-leaks-on-probe-deferral.patch b/queue-6.6/usb-dwc3-qcom-fix-resource-leaks-on-probe-deferral.patch new file mode 100644 index 00000000000..7d924c5737a --- /dev/null +++ b/queue-6.6/usb-dwc3-qcom-fix-resource-leaks-on-probe-deferral.patch @@ -0,0 +1,80 @@ +From 26c53cc37e1790d8164d08bedf8b05585fe60007 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 18:36:48 +0100 +Subject: USB: dwc3: qcom: fix resource leaks on probe deferral + +From: Johan Hovold + +[ Upstream commit 51392a1879ff06dc21b68aef4825f6ef68a7be42 ] + +The driver needs to deregister and free the newly allocated dwc3 core +platform device on ACPI probe errors (e.g. probe deferral) and on driver +unbind but instead it leaked those resources while erroneously dropping +a reference to the parent platform device which is still in use. + +For OF probing the driver takes a reference to the dwc3 core platform +device which has also always been leaked. + +Fix the broken ACPI tear down and make sure to drop the dwc3 core +reference for both OF and ACPI. + +Fixes: 8fd95da2cfb5 ("usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()") +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") +Cc: stable@vger.kernel.org # 4.18 +Cc: Christophe JAILLET +Cc: Lee Jones +Signed-off-by: Johan Hovold +Acked-by: Andrew Halaney +Link: https://lore.kernel.org/r/20231117173650.21161-2-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 9cf87666fc6e ("USB: dwc3: qcom: fix ACPI platform device leak") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 3de43df6bbe81..00c3021b43ce7 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -758,6 +758,7 @@ static int dwc3_qcom_of_register_core(struct platform_device *pdev) + if (!qcom->dwc3) { + ret = -ENODEV; + dev_err(dev, "failed to get dwc3 platform device\n"); ++ of_platform_depopulate(dev); + } + + node_put: +@@ -899,7 +900,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + + if (ret) { + dev_err(dev, "failed to register DWC3 Core, err=%d\n", ret); +- goto depopulate; ++ goto clk_disable; + } + + ret = dwc3_qcom_interconnect_init(qcom); +@@ -934,7 +935,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + if (np) + of_platform_depopulate(&pdev->dev); + else +- platform_device_put(pdev); ++ platform_device_del(qcom->dwc3); ++ platform_device_put(qcom->dwc3); + clk_disable: + for (i = qcom->num_clocks - 1; i >= 0; i--) { + clk_disable_unprepare(qcom->clks[i]); +@@ -957,7 +959,8 @@ static void dwc3_qcom_remove(struct platform_device *pdev) + if (np) + of_platform_depopulate(&pdev->dev); + else +- platform_device_put(pdev); ++ platform_device_del(qcom->dwc3); ++ platform_device_put(qcom->dwc3); + + for (i = qcom->num_clocks - 1; i >= 0; i--) { + clk_disable_unprepare(qcom->clks[i]); +-- +2.42.0 + diff --git a/queue-6.6/vsock-test-fix-seqpacket-message-bounds-test.patch b/queue-6.6/vsock-test-fix-seqpacket-message-bounds-test.patch new file mode 100644 index 00000000000..b6d189ed9d8 --- /dev/null +++ b/queue-6.6/vsock-test-fix-seqpacket-message-bounds-test.patch @@ -0,0 +1,99 @@ +From 81f2bdf9535157e73dd6e83fe61d8650c4242e89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 00:16:42 +0300 +Subject: vsock/test: fix SEQPACKET message bounds test + +From: Arseniy Krasnov + +[ Upstream commit f0863888f6cfef33e3117dccfe94fa78edf76be4 ] + +Tune message length calculation to make this test work on machines +where 'getpagesize()' returns >32KB. Now maximum message length is not +hardcoded (on machines above it was smaller than 'getpagesize()' return +value, thus we get negative value and test fails), but calculated at +runtime and always bigger than 'getpagesize()' result. Reproduced on +aarch64 with 64KB page size. + +Fixes: 5c338112e48a ("test/vsock: rework message bounds test") +Signed-off-by: Arseniy Krasnov +Reported-by: Bogdan Marcynkov +Reviewed-by: Stefano Garzarella +Link: https://lore.kernel.org/r/20231121211642.163474-1-avkrasnov@salutedevices.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/vsock/vsock_test.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c +index 90718c2fd4ea9..5dc7767039f6f 100644 +--- a/tools/testing/vsock/vsock_test.c ++++ b/tools/testing/vsock/vsock_test.c +@@ -392,11 +392,12 @@ static void test_stream_msg_peek_server(const struct test_opts *opts) + } + + #define SOCK_BUF_SIZE (2 * 1024 * 1024) +-#define MAX_MSG_SIZE (32 * 1024) ++#define MAX_MSG_PAGES 4 + + static void test_seqpacket_msg_bounds_client(const struct test_opts *opts) + { + unsigned long curr_hash; ++ size_t max_msg_size; + int page_size; + int msg_count; + int fd; +@@ -412,7 +413,8 @@ static void test_seqpacket_msg_bounds_client(const struct test_opts *opts) + + curr_hash = 0; + page_size = getpagesize(); +- msg_count = SOCK_BUF_SIZE / MAX_MSG_SIZE; ++ max_msg_size = MAX_MSG_PAGES * page_size; ++ msg_count = SOCK_BUF_SIZE / max_msg_size; + + for (int i = 0; i < msg_count; i++) { + ssize_t send_size; +@@ -423,7 +425,7 @@ static void test_seqpacket_msg_bounds_client(const struct test_opts *opts) + /* Use "small" buffers and "big" buffers. */ + if (i & 1) + buf_size = page_size + +- (rand() % (MAX_MSG_SIZE - page_size)); ++ (rand() % (max_msg_size - page_size)); + else + buf_size = 1 + (rand() % page_size); + +@@ -479,7 +481,6 @@ static void test_seqpacket_msg_bounds_server(const struct test_opts *opts) + unsigned long remote_hash; + unsigned long curr_hash; + int fd; +- char buf[MAX_MSG_SIZE]; + struct msghdr msg = {0}; + struct iovec iov = {0}; + +@@ -507,8 +508,13 @@ static void test_seqpacket_msg_bounds_server(const struct test_opts *opts) + control_writeln("SRVREADY"); + /* Wait, until peer sends whole data. */ + control_expectln("SENDDONE"); +- iov.iov_base = buf; +- iov.iov_len = sizeof(buf); ++ iov.iov_len = MAX_MSG_PAGES * getpagesize(); ++ iov.iov_base = malloc(iov.iov_len); ++ if (!iov.iov_base) { ++ perror("malloc"); ++ exit(EXIT_FAILURE); ++ } ++ + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + +@@ -533,6 +539,7 @@ static void test_seqpacket_msg_bounds_server(const struct test_opts *opts) + curr_hash += hash_djb2(msg.msg_iov[0].iov_base, recv_size); + } + ++ free(iov.iov_base); + close(fd); + remote_hash = control_readulong(); + +-- +2.42.0 + diff --git a/queue-6.6/wireguard-use-dev_stats_inc.patch b/queue-6.6/wireguard-use-dev_stats_inc.patch new file mode 100644 index 00000000000..a0003866bb6 --- /dev/null +++ b/queue-6.6/wireguard-use-dev_stats_inc.patch @@ -0,0 +1,121 @@ +From 51af7d22557e818f3eeb77aeb0d6da9eb38dab52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:17:33 +0000 +Subject: wireguard: use DEV_STATS_INC() + +From: Eric Dumazet + +[ Upstream commit 93da8d75a66568ba4bb5b14ad2833acd7304cd02 ] + +wg_xmit() can be called concurrently, KCSAN reported [1] +some device stats updates can be lost. + +Use DEV_STATS_INC() for this unlikely case. + +[1] +BUG: KCSAN: data-race in wg_xmit / wg_xmit + +read-write to 0xffff888104239160 of 8 bytes by task 1375 on cpu 0: +wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231 +__netdev_start_xmit include/linux/netdevice.h:4918 [inline] +netdev_start_xmit include/linux/netdevice.h:4932 [inline] +xmit_one net/core/dev.c:3543 [inline] +dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559 +... + +read-write to 0xffff888104239160 of 8 bytes by task 1378 on cpu 1: +wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231 +__netdev_start_xmit include/linux/netdevice.h:4918 [inline] +netdev_start_xmit include/linux/netdevice.h:4932 [inline] +xmit_one net/core/dev.c:3543 [inline] +dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559 +... + +v2: also change wg_packet_consume_data_done() (Hangbin Liu) + and wg_packet_purge_staged_packets() + +Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Jason A. Donenfeld +Cc: Hangbin Liu +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/device.c | 4 ++-- + drivers/net/wireguard/receive.c | 12 ++++++------ + drivers/net/wireguard/send.c | 3 ++- + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c +index 258dcc1039216..deb9636b0ecf8 100644 +--- a/drivers/net/wireguard/device.c ++++ b/drivers/net/wireguard/device.c +@@ -210,7 +210,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) + */ + while (skb_queue_len(&peer->staged_packet_queue) > MAX_STAGED_PACKETS) { + dev_kfree_skb(__skb_dequeue(&peer->staged_packet_queue)); +- ++dev->stats.tx_dropped; ++ DEV_STATS_INC(dev, tx_dropped); + } + skb_queue_splice_tail(&packets, &peer->staged_packet_queue); + spin_unlock_bh(&peer->staged_packet_queue.lock); +@@ -228,7 +228,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) + else if (skb->protocol == htons(ETH_P_IPV6)) + icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0); + err: +- ++dev->stats.tx_errors; ++ DEV_STATS_INC(dev, tx_errors); + kfree_skb(skb); + return ret; + } +diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c +index 0b3f0c8435509..a176653c88616 100644 +--- a/drivers/net/wireguard/receive.c ++++ b/drivers/net/wireguard/receive.c +@@ -416,20 +416,20 @@ static void wg_packet_consume_data_done(struct wg_peer *peer, + net_dbg_skb_ratelimited("%s: Packet has unallowed src IP (%pISc) from peer %llu (%pISpfsc)\n", + dev->name, skb, peer->internal_id, + &peer->endpoint.addr); +- ++dev->stats.rx_errors; +- ++dev->stats.rx_frame_errors; ++ DEV_STATS_INC(dev, rx_errors); ++ DEV_STATS_INC(dev, rx_frame_errors); + goto packet_processed; + dishonest_packet_type: + net_dbg_ratelimited("%s: Packet is neither ipv4 nor ipv6 from peer %llu (%pISpfsc)\n", + dev->name, peer->internal_id, &peer->endpoint.addr); +- ++dev->stats.rx_errors; +- ++dev->stats.rx_frame_errors; ++ DEV_STATS_INC(dev, rx_errors); ++ DEV_STATS_INC(dev, rx_frame_errors); + goto packet_processed; + dishonest_packet_size: + net_dbg_ratelimited("%s: Packet has incorrect size from peer %llu (%pISpfsc)\n", + dev->name, peer->internal_id, &peer->endpoint.addr); +- ++dev->stats.rx_errors; +- ++dev->stats.rx_length_errors; ++ DEV_STATS_INC(dev, rx_errors); ++ DEV_STATS_INC(dev, rx_length_errors); + goto packet_processed; + packet_processed: + dev_kfree_skb(skb); +diff --git a/drivers/net/wireguard/send.c b/drivers/net/wireguard/send.c +index 95c853b59e1da..0d48e0f4a1ba3 100644 +--- a/drivers/net/wireguard/send.c ++++ b/drivers/net/wireguard/send.c +@@ -333,7 +333,8 @@ static void wg_packet_create_data(struct wg_peer *peer, struct sk_buff *first) + void wg_packet_purge_staged_packets(struct wg_peer *peer) + { + spin_lock_bh(&peer->staged_packet_queue.lock); +- peer->device->dev->stats.tx_dropped += peer->staged_packet_queue.qlen; ++ DEV_STATS_ADD(peer->device->dev, tx_dropped, ++ peer->staged_packet_queue.qlen); + __skb_queue_purge(&peer->staged_packet_queue); + spin_unlock_bh(&peer->staged_packet_queue.lock); + } +-- +2.42.0 +