From: Sasha Levin Date: Mon, 3 Jun 2024 11:42:11 +0000 (-0400) Subject: Fixes for 6.9 X-Git-Tag: v6.1.93~60 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2e58a80dc52480993372bca94b9673727d0e8103;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.9 Signed-off-by: Sasha Levin --- diff --git a/queue-6.9/af_unix-update-unix_sk-sk-oob_skb-under-sk_receive_q.patch b/queue-6.9/af_unix-update-unix_sk-sk-oob_skb-under-sk_receive_q.patch new file mode 100644 index 00000000000..2e6b30089c3 --- /dev/null +++ b/queue-6.9/af_unix-update-unix_sk-sk-oob_skb-under-sk_receive_q.patch @@ -0,0 +1,155 @@ +From 5906f2ce2c67eee55d8ab59e13de5dd77b4c6688 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 22:48:35 +0900 +Subject: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. + +From: Kuniyuki Iwashima + +[ Upstream commit 9841991a446c87f90f66f4b9fee6fe934c1336a2 ] + +Billy Jheng Bing-Jhong reported a race between __unix_gc() and +queue_oob(). + +__unix_gc() tries to garbage-collect close()d inflight sockets, +and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC +will drop the reference and set NULL to it locklessly. + +However, the peer socket still can send MSG_OOB message and +queue_oob() can update unix_sk(sk)->oob_skb concurrently, leading +NULL pointer dereference. [0] + +To fix the issue, let's update unix_sk(sk)->oob_skb under the +sk_receive_queue's lock and take it everywhere we touch oob_skb. + +Note that we defer kfree_skb() in manage_oob() to silence lockdep +false-positive (See [1]). + +[0]: +BUG: kernel NULL pointer dereference, address: 0000000000000008 + PF: supervisor write access in kernel mode + PF: error_code(0x0002) - not-present page +PGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0 +Oops: 0002 [#1] PREEMPT SMP PTI +CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +Workqueue: events delayed_fput +RIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847) +Code: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 <48> 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc +RSP: 0018:ffffc900001bfd48 EFLAGS: 00000002 +RAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9 +RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00 +RBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001 +R10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00 +R13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80 +FS: 0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0 +PKRU: 55555554 +Call Trace: + + unix_release_sock (net/unix/af_unix.c:654) + unix_release (net/unix/af_unix.c:1050) + __sock_release (net/socket.c:660) + sock_close (net/socket.c:1423) + __fput (fs/file_table.c:423) + delayed_fput (fs/file_table.c:444 (discriminator 3)) + process_one_work (kernel/workqueue.c:3259) + worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416) + kthread (kernel/kthread.c:388) + ret_from_fork (arch/x86/kernel/process.c:153) + ret_from_fork_asm (arch/x86/entry/entry_64.S:257) + +Modules linked in: +CR2: 0000000000000008 + +Link: https://lore.kernel.org/netdev/a00d3993-c461-43f2-be6d-07259c98509a@rbox.co/ [1] +Fixes: 1279f9d9dec2 ("af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.") +Reported-by: Billy Jheng Bing-Jhong +Signed-off-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20240516134835.8332-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/unix/af_unix.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index e94839d89b09d..9bc879f3e34e6 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2217,13 +2217,15 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other + maybe_add_creds(skb, sock, other); + skb_get(skb); + ++ scm_stat_add(other, skb); ++ ++ spin_lock(&other->sk_receive_queue.lock); + if (ousk->oob_skb) + consume_skb(ousk->oob_skb); +- + WRITE_ONCE(ousk->oob_skb, skb); ++ __skb_queue_tail(&other->sk_receive_queue, skb); ++ spin_unlock(&other->sk_receive_queue.lock); + +- scm_stat_add(other, skb); +- skb_queue_tail(&other->sk_receive_queue, skb); + sk_send_sigurg(other); + unix_state_unlock(other); + other->sk_data_ready(other); +@@ -2614,8 +2616,10 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state) + + mutex_lock(&u->iolock); + unix_state_lock(sk); ++ spin_lock(&sk->sk_receive_queue.lock); + + if (sock_flag(sk, SOCK_URGINLINE) || !u->oob_skb) { ++ spin_unlock(&sk->sk_receive_queue.lock); + unix_state_unlock(sk); + mutex_unlock(&u->iolock); + return -EINVAL; +@@ -2627,6 +2631,8 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state) + WRITE_ONCE(u->oob_skb, NULL); + else + skb_get(oob_skb); ++ ++ spin_unlock(&sk->sk_receive_queue.lock); + unix_state_unlock(sk); + + chunk = state->recv_actor(oob_skb, 0, chunk, state); +@@ -2655,6 +2661,10 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, + consume_skb(skb); + skb = NULL; + } else { ++ struct sk_buff *unlinked_skb = NULL; ++ ++ spin_lock(&sk->sk_receive_queue.lock); ++ + if (skb == u->oob_skb) { + if (copied) { + skb = NULL; +@@ -2666,13 +2676,19 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, + } else if (flags & MSG_PEEK) { + skb = NULL; + } else { +- skb_unlink(skb, &sk->sk_receive_queue); ++ __skb_unlink(skb, &sk->sk_receive_queue); + WRITE_ONCE(u->oob_skb, NULL); +- if (!WARN_ON_ONCE(skb_unref(skb))) +- kfree_skb(skb); ++ unlinked_skb = skb; + skb = skb_peek(&sk->sk_receive_queue); + } + } ++ ++ spin_unlock(&sk->sk_receive_queue.lock); ++ ++ if (unlinked_skb) { ++ WARN_ON_ONCE(skb_unref(unlinked_skb)); ++ kfree_skb(unlinked_skb); ++ } + } + return skb; + } +-- +2.43.0 + diff --git a/queue-6.9/alsa-hda-cs35l56-fix-lifetime-of-cs_dsp-instance.patch b/queue-6.9/alsa-hda-cs35l56-fix-lifetime-of-cs_dsp-instance.patch new file mode 100644 index 00000000000..28e47629d60 --- /dev/null +++ b/queue-6.9/alsa-hda-cs35l56-fix-lifetime-of-cs_dsp-instance.patch @@ -0,0 +1,75 @@ +From 4b5e46251d3de8bee17e5a49592430331adcf891 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 11:08:11 +0100 +Subject: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance + +From: Richard Fitzgerald + +[ Upstream commit d344873c4cbde249b7152d36a273bcc45864001e ] + +The cs_dsp instance is initialized in the driver probe() so it +should be freed in the driver remove(). Also fix a missing call +to cs_dsp_remove() in the error path of cs35l56_hda_common_probe(). + +The call to cs_dsp_remove() was being done in the component unbind +callback cs35l56_hda_unbind(). This meant that if the driver was +unbound and then re-bound it would be using an uninitialized cs_dsp +instance. + +It is best to initialize the cs_dsp instance in probe() so that it +can return an error if it fails. The component binding API doesn't +have any error handling so there's no way to handle a failure if +cs_dsp was initialized in the bind. + +Signed-off-by: Richard Fitzgerald +Fixes: 73cfbfa9caea ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L56 amplifier") +Link: https://lore.kernel.org/r/20240508100811.49514-1-rf@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l56_hda.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/sound/pci/hda/cs35l56_hda.c b/sound/pci/hda/cs35l56_hda.c +index 558c1f38fe971..11b0570ff56d4 100644 +--- a/sound/pci/hda/cs35l56_hda.c ++++ b/sound/pci/hda/cs35l56_hda.c +@@ -732,8 +732,6 @@ static void cs35l56_hda_unbind(struct device *dev, struct device *master, void * + if (cs35l56->base.fw_patched) + cs_dsp_power_down(&cs35l56->cs_dsp); + +- cs_dsp_remove(&cs35l56->cs_dsp); +- + if (comps[cs35l56->index].dev == dev) + memset(&comps[cs35l56->index], 0, sizeof(*comps)); + +@@ -1035,7 +1033,7 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int hid, int id) + ARRAY_SIZE(cs35l56_hda_dai_config)); + ret = cs35l56_force_sync_asp1_registers_from_cache(&cs35l56->base); + if (ret) +- goto err; ++ goto dsp_err; + + /* + * By default only enable one ASP1TXn, where n=amplifier index, +@@ -1061,6 +1059,8 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int hid, int id) + + pm_err: + pm_runtime_disable(cs35l56->base.dev); ++dsp_err: ++ cs_dsp_remove(&cs35l56->cs_dsp); + err: + gpiod_set_value_cansleep(cs35l56->base.reset_gpio, 0); + +@@ -1078,6 +1078,8 @@ void cs35l56_hda_remove(struct device *dev) + + component_del(cs35l56->base.dev, &cs35l56_hda_comp_ops); + ++ cs_dsp_remove(&cs35l56->cs_dsp); ++ + kfree(cs35l56->system_name); + pm_runtime_put_noidle(cs35l56->base.dev); + +-- +2.43.0 + diff --git a/queue-6.9/alsa-hda-cs_dsp_ctl-use-private_free-for-control-cle.patch b/queue-6.9/alsa-hda-cs_dsp_ctl-use-private_free-for-control-cle.patch new file mode 100644 index 00000000000..2bcf7e9a592 --- /dev/null +++ b/queue-6.9/alsa-hda-cs_dsp_ctl-use-private_free-for-control-cle.patch @@ -0,0 +1,146 @@ +From 64f955991f331f6bc178f3c6a9a22c84c494178e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 10:56:27 +0100 +Subject: ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup + +From: Richard Fitzgerald + +[ Upstream commit 172811e3a557d8681a5e2d0f871dc04a2d17eb13 ] + +Use the control private_free callback to free the associated data +block. This ensures that the memory won't leak, whatever way the +control gets destroyed. + +The original implementation didn't actually remove the ALSA +controls in hda_cs_dsp_control_remove(). It only freed the internal +tracking structure. This meant it was possible to remove/unload the +amp driver while leaving its ALSA controls still present in the +soundcard. Obviously attempting to access them could cause segfaults +or at least dereferencing stale pointers. + +Signed-off-by: Richard Fitzgerald +Fixes: 3233b978af23 ("ALSA: hda: hda_cs_dsp_ctl: Add Library to support CS_DSP ALSA controls") +Link: https://lore.kernel.org/r/20240508095627.44476-1-rf@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_cs_dsp_ctl.c | 47 ++++++++++++++++++++++------------ + 1 file changed, 31 insertions(+), 16 deletions(-) + +diff --git a/sound/pci/hda/hda_cs_dsp_ctl.c b/sound/pci/hda/hda_cs_dsp_ctl.c +index 463ca06036bfe..9db45d7c17e5f 100644 +--- a/sound/pci/hda/hda_cs_dsp_ctl.c ++++ b/sound/pci/hda/hda_cs_dsp_ctl.c +@@ -8,6 +8,7 @@ + + #include + #include ++#include + #include + #include + #include "hda_cs_dsp_ctl.h" +@@ -97,11 +98,23 @@ static unsigned int wmfw_convert_flags(unsigned int in) + return out; + } + +-static void hda_cs_dsp_add_kcontrol(struct hda_cs_dsp_coeff_ctl *ctl, const char *name) ++static void hda_cs_dsp_free_kcontrol(struct snd_kcontrol *kctl) + { ++ struct hda_cs_dsp_coeff_ctl *ctl = (struct hda_cs_dsp_coeff_ctl *)snd_kcontrol_chip(kctl); + struct cs_dsp_coeff_ctl *cs_ctl = ctl->cs_ctl; ++ ++ /* NULL priv to prevent a double-free in hda_cs_dsp_control_remove() */ ++ cs_ctl->priv = NULL; ++ kfree(ctl); ++} ++ ++static void hda_cs_dsp_add_kcontrol(struct cs_dsp_coeff_ctl *cs_ctl, ++ const struct hda_cs_dsp_ctl_info *info, ++ const char *name) ++{ + struct snd_kcontrol_new kcontrol = {0}; + struct snd_kcontrol *kctl; ++ struct hda_cs_dsp_coeff_ctl *ctl __free(kfree) = NULL; + int ret = 0; + + if (cs_ctl->len > ADSP_MAX_STD_CTRL_SIZE) { +@@ -110,6 +123,13 @@ static void hda_cs_dsp_add_kcontrol(struct hda_cs_dsp_coeff_ctl *ctl, const char + return; + } + ++ ctl = kzalloc(sizeof(*ctl), GFP_KERNEL); ++ if (!ctl) ++ return; ++ ++ ctl->cs_ctl = cs_ctl; ++ ctl->card = info->card; ++ + kcontrol.name = name; + kcontrol.info = hda_cs_dsp_coeff_info; + kcontrol.iface = SNDRV_CTL_ELEM_IFACE_MIXER; +@@ -117,20 +137,22 @@ static void hda_cs_dsp_add_kcontrol(struct hda_cs_dsp_coeff_ctl *ctl, const char + kcontrol.get = hda_cs_dsp_coeff_get; + kcontrol.put = hda_cs_dsp_coeff_put; + +- /* Save ctl inside private_data, ctl is owned by cs_dsp, +- * and will be freed when cs_dsp removes the control */ + kctl = snd_ctl_new1(&kcontrol, (void *)ctl); + if (!kctl) + return; + +- ret = snd_ctl_add(ctl->card, kctl); ++ kctl->private_free = hda_cs_dsp_free_kcontrol; ++ ctl->kctl = kctl; ++ ++ /* snd_ctl_add() calls our private_free on error, which will kfree(ctl) */ ++ cs_ctl->priv = no_free_ptr(ctl); ++ ret = snd_ctl_add(info->card, kctl); + if (ret) { + dev_err(cs_ctl->dsp->dev, "Failed to add KControl %s = %d\n", kcontrol.name, ret); + return; + } + + dev_dbg(cs_ctl->dsp->dev, "Added KControl: %s\n", kcontrol.name); +- ctl->kctl = kctl; + } + + static void hda_cs_dsp_control_add(struct cs_dsp_coeff_ctl *cs_ctl, +@@ -138,7 +160,6 @@ static void hda_cs_dsp_control_add(struct cs_dsp_coeff_ctl *cs_ctl, + { + struct cs_dsp *cs_dsp = cs_ctl->dsp; + char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN]; +- struct hda_cs_dsp_coeff_ctl *ctl; + const char *region_name; + int ret; + +@@ -163,15 +184,7 @@ static void hda_cs_dsp_control_add(struct cs_dsp_coeff_ctl *cs_ctl, + " %.*s", cs_ctl->subname_len - skip, cs_ctl->subname + skip); + } + +- ctl = kzalloc(sizeof(*ctl), GFP_KERNEL); +- if (!ctl) +- return; +- +- ctl->cs_ctl = cs_ctl; +- ctl->card = info->card; +- cs_ctl->priv = ctl; +- +- hda_cs_dsp_add_kcontrol(ctl, name); ++ hda_cs_dsp_add_kcontrol(cs_ctl, info, name); + } + + void hda_cs_dsp_add_controls(struct cs_dsp *dsp, const struct hda_cs_dsp_ctl_info *info) +@@ -203,7 +216,9 @@ void hda_cs_dsp_control_remove(struct cs_dsp_coeff_ctl *cs_ctl) + { + struct hda_cs_dsp_coeff_ctl *ctl = cs_ctl->priv; + +- kfree(ctl); ++ /* ctl and kctl may already have been removed by ALSA private_free */ ++ if (ctl && ctl->kctl) ++ snd_ctl_remove(ctl->card, ctl->kctl); + } + EXPORT_SYMBOL_NS_GPL(hda_cs_dsp_control_remove, SND_HDA_CS_DSP_CONTROLS); + +-- +2.43.0 + diff --git a/queue-6.9/alsa-hda-hda_component-initialize-shared-data-during.patch b/queue-6.9/alsa-hda-hda_component-initialize-shared-data-during.patch new file mode 100644 index 00000000000..a934861d266 --- /dev/null +++ b/queue-6.9/alsa-hda-hda_component-initialize-shared-data-during.patch @@ -0,0 +1,100 @@ +From 463c3476e925751693342b29f37df3c5b209e132 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 11:03:47 +0100 +Subject: ALSA: hda: hda_component: Initialize shared data during bind callback + +From: Richard Fitzgerald + +[ Upstream commit ec6f32bc924d1c00cbcd5672510758f7088f2513 ] + +Move the initialization of the shared struct hda_component array into +hda_component_manager_bind(). + +The purpose of the manager bind() callback is to allow it to perform +initialization before binding in the component drivers. This is the +correct place to initialize the shared data. + +The original implementation initialized the shared data in +hda_component_manager_init(). This is only done once during probe() +of the manager driver. So if the component binding was unbound and +then rebound, the shared data would not be re-initialized. + +Signed-off-by: Richard Fitzgerald +Fixes: fd895a74dc1d ("ALSA: hda: realtek: Move hda_component implementation to module") +Link: https://lore.kernel.org/r/20240508100347.47283-1-rf@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_component.c | 16 +++++++++++++++- + sound/pci/hda/hda_component.h | 7 ++----- + sound/pci/hda/patch_realtek.c | 2 +- + 3 files changed, 18 insertions(+), 7 deletions(-) + +diff --git a/sound/pci/hda/hda_component.c b/sound/pci/hda/hda_component.c +index cd299d7d84baf..d02589014a3fa 100644 +--- a/sound/pci/hda/hda_component.c ++++ b/sound/pci/hda/hda_component.c +@@ -123,6 +123,21 @@ static int hda_comp_match_dev_name(struct device *dev, void *data) + return !strcmp(d + n, tmp); + } + ++int hda_component_manager_bind(struct hda_codec *cdc, ++ struct hda_component *comps, int count) ++{ ++ int i; ++ ++ /* Init shared data */ ++ for (i = 0; i < count; ++i) { ++ memset(&comps[i], 0, sizeof(comps[i])); ++ comps[i].codec = cdc; ++ } ++ ++ return component_bind_all(hda_codec_dev(cdc), comps); ++} ++EXPORT_SYMBOL_NS_GPL(hda_component_manager_bind, SND_HDA_SCODEC_COMPONENT); ++ + int hda_component_manager_init(struct hda_codec *cdc, + struct hda_component *comps, int count, + const char *bus, const char *hid, +@@ -143,7 +158,6 @@ int hda_component_manager_init(struct hda_codec *cdc, + sm->hid = hid; + sm->match_str = match_str; + sm->index = i; +- comps[i].codec = cdc; + component_match_add(dev, &match, hda_comp_match_dev_name, sm); + } + +diff --git a/sound/pci/hda/hda_component.h b/sound/pci/hda/hda_component.h +index c80a66691b5d8..c70b3de68ab20 100644 +--- a/sound/pci/hda/hda_component.h ++++ b/sound/pci/hda/hda_component.h +@@ -75,11 +75,8 @@ int hda_component_manager_init(struct hda_codec *cdc, + void hda_component_manager_free(struct hda_codec *cdc, + const struct component_master_ops *ops); + +-static inline int hda_component_manager_bind(struct hda_codec *cdc, +- struct hda_component *comps) +-{ +- return component_bind_all(hda_codec_dev(cdc), comps); +-} ++int hda_component_manager_bind(struct hda_codec *cdc, ++ struct hda_component *comps, int count); + + static inline void hda_component_manager_unbind(struct hda_codec *cdc, + struct hda_component *comps) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3b8b4ab488a61..08598a4f1fa3f 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6793,7 +6793,7 @@ static int comp_bind(struct device *dev) + struct alc_spec *spec = cdc->spec; + int ret; + +- ret = hda_component_manager_bind(cdc, spec->comps); ++ ret = hda_component_manager_bind(cdc, spec->comps, ARRAY_SIZE(spec->comps)); + if (ret) + return ret; + +-- +2.43.0 + diff --git a/queue-6.9/alsa-hda-realtek-drop-doubly-quirk-entry-for-103c-8a.patch b/queue-6.9/alsa-hda-realtek-drop-doubly-quirk-entry-for-103c-8a.patch new file mode 100644 index 00000000000..372d1cd0f2b --- /dev/null +++ b/queue-6.9/alsa-hda-realtek-drop-doubly-quirk-entry-for-103c-8a.patch @@ -0,0 +1,38 @@ +From 53f89f093d799a716fe2a45c01e618ffb402818f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 08:40:08 +0200 +Subject: ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e + +From: Takashi Iwai + +[ Upstream commit d731b1ed15052580b7b2f40559021012d280f1d9 ] + +There are two quirk entries for SSID 103c:8a2e. Drop the latter one +that isn't applied in anyway. + +As both point to the same quirk action, there is no actual behavior +change. + +Fixes: aa8e3ef4fe53 ("ALSA: hda/realtek: Add quirks for various HP ENVY models") +Link: https://lore.kernel.org/r/20240513064010.17546-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 08598a4f1fa3f..d8caa2be63c8b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10103,7 +10103,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8a2c, "HP Envy 16", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8a2d, "HP Envy 16", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8a2e, "HP Envy 16", ALC287_FIXUP_CS35L41_I2C_2), +- SND_PCI_QUIRK(0x103c, 0x8a2e, "HP Envy 17", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8a30, "HP Envy 17", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8a31, "HP Envy 15", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8a6e, "HP EDNA 360", ALC287_FIXUP_CS35L41_I2C_4), +-- +2.43.0 + diff --git a/queue-6.9/arm64-asm-bug-add-.align-2-to-the-end-of-__bug_entry.patch b/queue-6.9/arm64-asm-bug-add-.align-2-to-the-end-of-__bug_entry.patch new file mode 100644 index 00000000000..e467c291446 --- /dev/null +++ b/queue-6.9/arm64-asm-bug-add-.align-2-to-the-end-of-__bug_entry.patch @@ -0,0 +1,160 @@ +From 18ad98c54e5a83f8bb79faeb70465d146950e01c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 21:34:37 +0800 +Subject: arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY + +From: Jiangfeng Xiao + +[ Upstream commit ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f ] + +When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes +to bug_table entries, and as a result the last entry in a bug table will +be ignored, potentially leading to an unexpected panic(). All prior +entries in the table will be handled correctly. + +The arm64 ABI requires that struct fields of up to 8 bytes are +naturally-aligned, with padding added within a struct such that struct +are suitably aligned within arrays. + +When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is: + + struct bug_entry { + signed int bug_addr_disp; // 4 bytes + signed int file_disp; // 4 bytes + unsigned short line; // 2 bytes + unsigned short flags; // 2 bytes + } + +... with 12 bytes total, requiring 4-byte alignment. + +When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is: + + struct bug_entry { + signed int bug_addr_disp; // 4 bytes + unsigned short flags; // 2 bytes + < implicit padding > // 2 bytes + } + +... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing +padding, requiring 4-byte alginment. + +When we create a bug_entry in assembly, we align the start of the entry +to 4 bytes, which implicitly handles padding for any prior entries. +However, we do not align the end of the entry, and so when +CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding +bytes. + +For the main kernel image this is not a problem as find_bug() doesn't +depend on the trailing padding bytes when searching for entries: + + for (bug = __start___bug_table; bug < __stop___bug_table; ++bug) + if (bugaddr == bug_addr(bug)) + return bug; + +However for modules, module_bug_finalize() depends on the trailing +bytes when calculating the number of entries: + + mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry); + +... and as the last bug_entry lacks the necessary padding bytes, this entry +will not be counted, e.g. in the case of a single entry: + + sechdrs[i].sh_size == 6 + sizeof(struct bug_entry) == 8; + + sechdrs[i].sh_size / sizeof(struct bug_entry) == 0; + +Consequently module_find_bug() will miss the last bug_entry when it does: + + for (i = 0; i < mod->num_bugs; ++i, ++bug) + if (bugaddr == bug_addr(bug)) + goto out; + +... which can lead to a kenrel panic due to an unhandled bug. + +This can be demonstrated with the following module: + + static int __init buginit(void) + { + WARN(1, "hello\n"); + return 0; + } + + static void __exit bugexit(void) + { + } + + module_init(buginit); + module_exit(bugexit); + MODULE_LICENSE("GPL"); + +... which will trigger a kernel panic when loaded: + + ------------[ cut here ]------------ + hello + Unexpected kernel BRK exception at EL1 + Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP + Modules linked in: hello(O+) + CPU: 0 PID: 50 Comm: insmod Tainted: G O 6.9.1 #8 + Hardware name: linux,dummy-virt (DT) + pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : buginit+0x18/0x1000 [hello] + lr : buginit+0x18/0x1000 [hello] + sp : ffff800080533ae0 + x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000 + x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58 + x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0 + x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006 + x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720 + x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312 + x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8 + x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000 + x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000 + x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0 + Call trace: + buginit+0x18/0x1000 [hello] + do_one_initcall+0x80/0x1c8 + do_init_module+0x60/0x218 + load_module+0x1ba4/0x1d70 + __do_sys_init_module+0x198/0x1d0 + __arm64_sys_init_module+0x1c/0x28 + invoke_syscall+0x48/0x114 + el0_svc_common.constprop.0+0x40/0xe0 + do_el0_svc+0x1c/0x28 + el0_svc+0x34/0xd8 + el0t_64_sync_handler+0x120/0x12c + el0t_64_sync+0x190/0x194 + Code: d0ffffe0 910003fd 91000000 9400000b (d4210000) + ---[ end trace 0000000000000000 ]--- + Kernel panic - not syncing: BRK handler: Fatal exception + +Fix this by always aligning the end of a bug_entry to 4 bytes, which is +correct regardless of CONFIG_DEBUG_BUGVERBOSE. + +Fixes: 9fb7410f955f ("arm64/BUG: Use BRK instruction for generic BUG traps") + +Signed-off-by: Yuanbin Xie +Signed-off-by: Jiangfeng Xiao +Reviewed-by: Mark Rutland +Link: https://lore.kernel.org/r/1716212077-43826-1-git-send-email-xiaojiangfeng@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/asm-bug.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/include/asm/asm-bug.h b/arch/arm64/include/asm/asm-bug.h +index c762038ba4009..6e73809f6492a 100644 +--- a/arch/arm64/include/asm/asm-bug.h ++++ b/arch/arm64/include/asm/asm-bug.h +@@ -28,6 +28,7 @@ + 14470: .long 14471f - .; \ + _BUGVERBOSE_LOCATION(__FILE__, __LINE__) \ + .short flags; \ ++ .align 2; \ + .popsection; \ + 14471: + #else +-- +2.43.0 + diff --git a/queue-6.9/asoc-amd-acp-fix-for-acp-platform-device-creation-fa.patch b/queue-6.9/asoc-amd-acp-fix-for-acp-platform-device-creation-fa.patch new file mode 100644 index 00000000000..06e6e8c9aa9 --- /dev/null +++ b/queue-6.9/asoc-amd-acp-fix-for-acp-platform-device-creation-fa.patch @@ -0,0 +1,272 @@ +From 171129d48dae659cd4a38fe633e1eaa7b94fc95d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 19:33:25 +0530 +Subject: ASoC: amd: acp: fix for acp platform device creation failure + +From: Vijendar Mukunda + +[ Upstream commit 09068d624c490c0e89f33f963c402f1859964467 ] + +ACP pin configuration varies based on acp version. +ACP PCI driver should read the ACP PIN config value and based on config +value, it has to create a platform device in below two conditions. +1) If ACP PDM configuration is selected from BIOS and ACP PDM controller +exists. +2) If ACP I2S configuration is selected from BIOS. + +Other than above scenarios, ACP PCI driver should skip the platform +device creation logic, i.e. ACP PCI driver probe sequence should never +fail if other acp pin configuration is selected. It should skip platform +device creation logic. + +check_acp_pdm() function was implemented for ACP6.x platforms to check +ACP PDM configuration. Previously, this code was safe guarded by +FLAG_AMD_LEGACY_ONLY_DMIC flag check. + +This implementation breaks audio use cases for Huawei Matebooks which are +based on ACP3.x varaint uses I2S configuration. +In current scenario, check_acp_pdm() function returns -ENODEV value +which results in ACP PCI driver probe failure without creating a platform +device even in case of valid ACP pin configuration. + +Implement check_acp_config() as a common function which invokes platform +specific acp pin configuration check functions for ACP3.x, ACP6.0 & ACP6.3 +& ACP7.0 variants and checks for ACP PDM controller. + +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218780 +Fixes: 4af565de9f8c ("ASoC: amd: acp: fix for acp pdm configuration check") +Signed-off-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20240502140340.4049021-1-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-legacy-common.c | 96 ++++++++++++++++++++++----- + sound/soc/amd/acp/acp-pci.c | 9 ++- + sound/soc/amd/acp/amd.h | 10 ++- + sound/soc/amd/acp/chip_offset_byte.h | 1 + + 4 files changed, 95 insertions(+), 21 deletions(-) + +diff --git a/sound/soc/amd/acp/acp-legacy-common.c b/sound/soc/amd/acp/acp-legacy-common.c +index b5aff3f230be5..3be7c6d55a6f8 100644 +--- a/sound/soc/amd/acp/acp-legacy-common.c ++++ b/sound/soc/amd/acp/acp-legacy-common.c +@@ -358,11 +358,25 @@ int smn_read(struct pci_dev *dev, u32 smn_addr) + } + EXPORT_SYMBOL_NS_GPL(smn_read, SND_SOC_ACP_COMMON); + +-int check_acp_pdm(struct pci_dev *pci, struct acp_chip_info *chip) ++static void check_acp3x_config(struct acp_chip_info *chip) + { +- struct acpi_device *pdm_dev; +- const union acpi_object *obj; +- u32 pdm_addr, val; ++ u32 val; ++ ++ val = readl(chip->base + ACP3X_PIN_CONFIG); ++ switch (val) { ++ case ACP_CONFIG_4: ++ chip->is_i2s_config = true; ++ chip->is_pdm_config = true; ++ break; ++ default: ++ chip->is_pdm_config = true; ++ break; ++ } ++} ++ ++static void check_acp6x_config(struct acp_chip_info *chip) ++{ ++ u32 val; + + val = readl(chip->base + ACP_PIN_CONFIG); + switch (val) { +@@ -371,42 +385,94 @@ int check_acp_pdm(struct pci_dev *pci, struct acp_chip_info *chip) + case ACP_CONFIG_6: + case ACP_CONFIG_7: + case ACP_CONFIG_8: +- case ACP_CONFIG_10: + case ACP_CONFIG_11: ++ case ACP_CONFIG_14: ++ chip->is_pdm_config = true; ++ break; ++ case ACP_CONFIG_9: ++ chip->is_i2s_config = true; ++ break; ++ case ACP_CONFIG_10: + case ACP_CONFIG_12: + case ACP_CONFIG_13: ++ chip->is_i2s_config = true; ++ chip->is_pdm_config = true; ++ break; ++ default: ++ break; ++ } ++} ++ ++static void check_acp70_config(struct acp_chip_info *chip) ++{ ++ u32 val; ++ ++ val = readl(chip->base + ACP_PIN_CONFIG); ++ switch (val) { ++ case ACP_CONFIG_4: ++ case ACP_CONFIG_5: ++ case ACP_CONFIG_6: ++ case ACP_CONFIG_7: ++ case ACP_CONFIG_8: ++ case ACP_CONFIG_11: + case ACP_CONFIG_14: ++ case ACP_CONFIG_17: ++ case ACP_CONFIG_18: ++ chip->is_pdm_config = true; ++ break; ++ case ACP_CONFIG_9: ++ chip->is_i2s_config = true; ++ break; ++ case ACP_CONFIG_10: ++ case ACP_CONFIG_12: ++ case ACP_CONFIG_13: ++ case ACP_CONFIG_19: ++ case ACP_CONFIG_20: ++ chip->is_i2s_config = true; ++ chip->is_pdm_config = true; + break; + default: +- return -EINVAL; ++ break; + } ++} ++ ++void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip) ++{ ++ struct acpi_device *pdm_dev; ++ const union acpi_object *obj; ++ u32 pdm_addr; + + switch (chip->acp_rev) { + case ACP3X_DEV: + pdm_addr = ACP_RENOIR_PDM_ADDR; ++ check_acp3x_config(chip); + break; + case ACP6X_DEV: + pdm_addr = ACP_REMBRANDT_PDM_ADDR; ++ check_acp6x_config(chip); + break; + case ACP63_DEV: + pdm_addr = ACP63_PDM_ADDR; ++ check_acp6x_config(chip); + break; + case ACP70_DEV: + pdm_addr = ACP70_PDM_ADDR; ++ check_acp70_config(chip); + break; + default: +- return -EINVAL; ++ break; + } + +- pdm_dev = acpi_find_child_device(ACPI_COMPANION(&pci->dev), pdm_addr, 0); +- if (pdm_dev) { +- if (!acpi_dev_get_property(pdm_dev, "acp-audio-device-type", +- ACPI_TYPE_INTEGER, &obj) && +- obj->integer.value == pdm_addr) +- return 0; ++ if (chip->is_pdm_config) { ++ pdm_dev = acpi_find_child_device(ACPI_COMPANION(&pci->dev), pdm_addr, 0); ++ if (pdm_dev) { ++ if (!acpi_dev_get_property(pdm_dev, "acp-audio-device-type", ++ ACPI_TYPE_INTEGER, &obj) && ++ obj->integer.value == pdm_addr) ++ chip->is_pdm_dev = true; ++ } + } +- return -ENODEV; + } +-EXPORT_SYMBOL_NS_GPL(check_acp_pdm, SND_SOC_ACP_COMMON); ++EXPORT_SYMBOL_NS_GPL(check_acp_config, SND_SOC_ACP_COMMON); + + MODULE_LICENSE("Dual BSD/GPL"); +diff --git a/sound/soc/amd/acp/acp-pci.c b/sound/soc/amd/acp/acp-pci.c +index 5f35b90eab8d3..ad320b29e87dc 100644 +--- a/sound/soc/amd/acp/acp-pci.c ++++ b/sound/soc/amd/acp/acp-pci.c +@@ -100,7 +100,6 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id + ret = -EINVAL; + goto release_regions; + } +- + dmic_dev = platform_device_register_data(dev, "dmic-codec", PLATFORM_DEVID_NONE, NULL, 0); + if (IS_ERR(dmic_dev)) { + dev_err(dev, "failed to create DMIC device\n"); +@@ -119,6 +118,10 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id + if (ret) + goto unregister_dmic_dev; + ++ check_acp_config(pci, chip); ++ if (!chip->is_pdm_dev && !chip->is_i2s_config) ++ goto skip_pdev_creation; ++ + res = devm_kcalloc(&pci->dev, num_res, sizeof(struct resource), GFP_KERNEL); + if (!res) { + ret = -ENOMEM; +@@ -136,10 +139,6 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id + } + } + +- ret = check_acp_pdm(pci, chip); +- if (ret < 0) +- goto skip_pdev_creation; +- + chip->flag = flag; + memset(&pdevinfo, 0, sizeof(pdevinfo)); + +diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h +index 5017e868f39b9..d75b4eb34de8d 100644 +--- a/sound/soc/amd/acp/amd.h ++++ b/sound/soc/amd/acp/amd.h +@@ -138,6 +138,9 @@ struct acp_chip_info { + void __iomem *base; /* ACP memory PCI base */ + struct platform_device *chip_pdev; + unsigned int flag; /* Distinguish b/w Legacy or Only PDM */ ++ bool is_pdm_dev; /* flag set to true when ACP PDM controller exists */ ++ bool is_pdm_config; /* flag set to true when PDM configuration is selected from BIOS */ ++ bool is_i2s_config; /* flag set to true when I2S configuration is selected from BIOS */ + }; + + struct acp_stream { +@@ -212,6 +215,11 @@ enum acp_config { + ACP_CONFIG_13, + ACP_CONFIG_14, + ACP_CONFIG_15, ++ ACP_CONFIG_16, ++ ACP_CONFIG_17, ++ ACP_CONFIG_18, ++ ACP_CONFIG_19, ++ ACP_CONFIG_20, + }; + + extern const struct snd_soc_dai_ops asoc_acp_cpu_dai_ops; +@@ -240,7 +248,7 @@ void restore_acp_pdm_params(struct snd_pcm_substream *substream, + int restore_acp_i2s_params(struct snd_pcm_substream *substream, + struct acp_dev_data *adata, struct acp_stream *stream); + +-int check_acp_pdm(struct pci_dev *pci, struct acp_chip_info *chip); ++void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip); + + static inline u64 acp_get_byte_count(struct acp_dev_data *adata, int dai_id, int direction) + { +diff --git a/sound/soc/amd/acp/chip_offset_byte.h b/sound/soc/amd/acp/chip_offset_byte.h +index cfd6c4d075944..18da734c0e9e7 100644 +--- a/sound/soc/amd/acp/chip_offset_byte.h ++++ b/sound/soc/amd/acp/chip_offset_byte.h +@@ -20,6 +20,7 @@ + #define ACP_SOFT_RESET 0x1000 + #define ACP_CONTROL 0x1004 + #define ACP_PIN_CONFIG 0x1440 ++#define ACP3X_PIN_CONFIG 0x1400 + + #define ACP_EXTERNAL_INTR_REG_ADDR(adata, offset, ctrl) \ + (adata->acp_base + adata->rsrc->irq_reg_offset + offset + (ctrl * 0x04)) +-- +2.43.0 + diff --git a/queue-6.9/asoc-mediatek-mt8192-fix-register-configuration-for-.patch b/queue-6.9/asoc-mediatek-mt8192-fix-register-configuration-for-.patch new file mode 100644 index 00000000000..89cfbcb0735 --- /dev/null +++ b/queue-6.9/asoc-mediatek-mt8192-fix-register-configuration-for-.patch @@ -0,0 +1,43 @@ +From 34bf40ff92e4e14f806ef23ef038268bbd57206f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 07:31:29 +0000 +Subject: ASoC: mediatek: mt8192: fix register configuration for tdm + +From: Hsin-Te Yuan + +[ Upstream commit a85ed162f0efcfdd664954414a05d1d560cc95dc ] + +For DSP_A, data is a BCK cycle behind LRCK trigger edge. For DSP_B, this +delay doesn't exist. Fix the delay configuration to match the standard. + +Fixes: 52fcd65414abfc ("ASoC: mediatek: mt8192: support tdm in platform driver") +Signed-off-by: Hsin-Te Yuan +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20240509-8192-tdm-v1-1-530b54645763@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8192/mt8192-dai-tdm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c b/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c +index 9ce06821c7d0f..49440db370af0 100644 +--- a/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c ++++ b/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c +@@ -566,10 +566,10 @@ static int mtk_dai_tdm_hw_params(struct snd_pcm_substream *substream, + tdm_con |= 1 << DELAY_DATA_SFT; + tdm_con |= get_tdm_lrck_width(format) << LRCK_TDM_WIDTH_SFT; + } else if (tdm_priv->tdm_out_mode == TDM_OUT_DSP_A) { +- tdm_con |= 0 << DELAY_DATA_SFT; ++ tdm_con |= 1 << DELAY_DATA_SFT; + tdm_con |= 0 << LRCK_TDM_WIDTH_SFT; + } else if (tdm_priv->tdm_out_mode == TDM_OUT_DSP_B) { +- tdm_con |= 1 << DELAY_DATA_SFT; ++ tdm_con |= 0 << DELAY_DATA_SFT; + tdm_con |= 0 << LRCK_TDM_WIDTH_SFT; + } + +-- +2.43.0 + diff --git a/queue-6.9/asoc-rt715-sdca-sdw-fix-wrong-complete-waiting-in-rt.patch b/queue-6.9/asoc-rt715-sdca-sdw-fix-wrong-complete-waiting-in-rt.patch new file mode 100644 index 00000000000..bb4ba92b7db --- /dev/null +++ b/queue-6.9/asoc-rt715-sdca-sdw-fix-wrong-complete-waiting-in-rt.patch @@ -0,0 +1,49 @@ +From 690b28db44a4539ebcd3803cbd43563e97fbb0a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 11:36:58 -0500 +Subject: ASoC: rt715-sdca-sdw: Fix wrong complete waiting in + rt715_dev_resume() + +From: Bard Liao + +[ Upstream commit c8bdf9e727acb6e1b37febf422ef1751e5a2c7d1 ] + +enumeration_complete will be completed when a peripheral is attached. +And initialization_complete will be completed when a peripheral is +initialized. rt715_dev_resume() should wait for initialization_complete +instead of enumeration_complete. + +the issue exists since commit 20d17057f0a8 ("ASoC: rt715-sdca: Add RT715 +sdca vendor-specific driver"), but the commit can only apply to +commit f892e66fcabc ("ASoC: rt-sdw*: add __func__ to all error logs"). + +Fixes: f892e66fcabc ("ASoC: rt-sdw*: add __func__ to all error logs") +Signed-off-by: Bard Liao +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20240509163658.68062-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt715-sdca-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt715-sdca-sdw.c b/sound/soc/codecs/rt715-sdca-sdw.c +index ee450126106f9..9a55e77af02fe 100644 +--- a/sound/soc/codecs/rt715-sdca-sdw.c ++++ b/sound/soc/codecs/rt715-sdca-sdw.c +@@ -234,10 +234,10 @@ static int __maybe_unused rt715_dev_resume(struct device *dev) + if (!slave->unattach_request) + goto regmap_sync; + +- time = wait_for_completion_timeout(&slave->enumeration_complete, ++ time = wait_for_completion_timeout(&slave->initialization_complete, + msecs_to_jiffies(RT715_PROBE_TIMEOUT)); + if (!time) { +- dev_err(&slave->dev, "%s: Enumeration not complete, timed out\n", __func__); ++ dev_err(&slave->dev, "%s: Initialization not complete, timed out\n", __func__); + sdw_show_ping_status(slave->bus, true); + + return -ETIMEDOUT; +-- +2.43.0 + diff --git a/queue-6.9/asoc-sof-debug-handle-cases-when-fw_lib_prefix-is-no.patch b/queue-6.9/asoc-sof-debug-handle-cases-when-fw_lib_prefix-is-no.patch new file mode 100644 index 00000000000..9854fa3b677 --- /dev/null +++ b/queue-6.9/asoc-sof-debug-handle-cases-when-fw_lib_prefix-is-no.patch @@ -0,0 +1,65 @@ +From 7ce60ced5dfc369980ed0c1cd86c2c53d95cb2e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 10:38:58 -0500 +Subject: ASoC: SOF: debug: Handle cases when fw_lib_prefix is not set, NULL + +From: Peter Ujfalusi + +[ Upstream commit b32487ca7b51ce430f15ec785269f11c25a6a560 ] + +The firmware libraries are not supported by IPC3, the fw_lib_path is not +a valid parameter and it is always NULL. +Do not create the debugfs file for IPC3 at all as it is not applicable. + +With IPC4 some vendors/platforms might not support loadable libraries and +the fw_lib_prefix is left to NULL to indicate this. +Handle such case with allocating "Not supported" string. + +Reviewed-by: Marc Herbert +Fixes: 17f4041244e6 ("ASoC: SOF: debug: show firmware/topology prefix/names") +Signed-off-by: Peter Ujfalusi +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20240426153902.39560-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/debug.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c +index 7275437ea8d8a..6481da31826dc 100644 +--- a/sound/soc/sof/debug.c ++++ b/sound/soc/sof/debug.c +@@ -345,8 +345,27 @@ int snd_sof_dbg_init(struct snd_sof_dev *sdev) + + debugfs_create_str("fw_path", 0444, fw_profile, + (char **)&plat_data->fw_filename_prefix); +- debugfs_create_str("fw_lib_path", 0444, fw_profile, +- (char **)&plat_data->fw_lib_prefix); ++ /* library path is not valid for IPC3 */ ++ if (plat_data->ipc_type != SOF_IPC_TYPE_3) { ++ /* ++ * fw_lib_prefix can be NULL if the vendor/platform does not ++ * support loadable libraries ++ */ ++ if (plat_data->fw_lib_prefix) { ++ debugfs_create_str("fw_lib_path", 0444, fw_profile, ++ (char **)&plat_data->fw_lib_prefix); ++ } else { ++ static char *fw_lib_path; ++ ++ fw_lib_path = devm_kasprintf(sdev->dev, GFP_KERNEL, ++ "Not supported"); ++ if (!fw_lib_path) ++ return -ENOMEM; ++ ++ debugfs_create_str("fw_lib_path", 0444, fw_profile, ++ (char **)&fw_lib_path); ++ } ++ } + debugfs_create_str("tplg_path", 0444, fw_profile, + (char **)&plat_data->tplg_filename_prefix); + debugfs_create_str("fw_name", 0444, fw_profile, +-- +2.43.0 + diff --git a/queue-6.9/asoc-tas2552-add-tx-path-for-capturing-audio-out-dat.patch b/queue-6.9/asoc-tas2552-add-tx-path-for-capturing-audio-out-dat.patch new file mode 100644 index 00000000000..335c9e6dcf5 --- /dev/null +++ b/queue-6.9/asoc-tas2552-add-tx-path-for-capturing-audio-out-dat.patch @@ -0,0 +1,76 @@ +From f8f50e8cb953033c01f485ce8a7e7e2beb1105ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 May 2024 11:35:15 +0800 +Subject: ASoC: tas2552: Add TX path for capturing AUDIO-OUT data + +From: Shenghao Ding + +[ Upstream commit 7078ac4fd179a68d0bab448004fcd357e7a45f8d ] + +TAS2552 is a Smartamp with I/V sense data, add TX path +to support capturing I/V data. + +Fixes: 38803ce7b53b ("ASoC: codecs: tas*: merge .digital_mute() into .mute_stream()") +Signed-off-by: Shenghao Ding +Link: https://msgid.link/r/20240518033515.866-1-shenghao-ding@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2552.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c +index 8c9dc318b0e82..c65a4219ecd6c 100644 +--- a/sound/soc/codecs/tas2552.c ++++ b/sound/soc/codecs/tas2552.c +@@ -2,7 +2,8 @@ + /* + * tas2552.c - ALSA SoC Texas Instruments TAS2552 Mono Audio Amplifier + * +- * Copyright (C) 2014 Texas Instruments Incorporated - https://www.ti.com ++ * Copyright (C) 2014 - 2024 Texas Instruments Incorporated - ++ * https://www.ti.com + * + * Author: Dan Murphy + */ +@@ -119,12 +120,14 @@ static const struct snd_soc_dapm_widget tas2552_dapm_widgets[] = + &tas2552_input_mux_control), + + SND_SOC_DAPM_AIF_IN("DAC IN", "DAC Playback", 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("ASI OUT", "DAC Capture", 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_DAC("DAC", NULL, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_OUT_DRV("ClassD", TAS2552_CFG_2, 7, 0, NULL, 0), + SND_SOC_DAPM_SUPPLY("PLL", TAS2552_CFG_2, 3, 0, NULL, 0), + SND_SOC_DAPM_POST("Post Event", tas2552_post_event), + +- SND_SOC_DAPM_OUTPUT("OUT") ++ SND_SOC_DAPM_OUTPUT("OUT"), ++ SND_SOC_DAPM_INPUT("DMIC") + }; + + static const struct snd_soc_dapm_route tas2552_audio_map[] = { +@@ -134,6 +137,7 @@ static const struct snd_soc_dapm_route tas2552_audio_map[] = { + {"ClassD", NULL, "Input selection"}, + {"OUT", NULL, "ClassD"}, + {"ClassD", NULL, "PLL"}, ++ {"ASI OUT", NULL, "DMIC"} + }; + + #ifdef CONFIG_PM +@@ -538,6 +542,13 @@ static struct snd_soc_dai_driver tas2552_dai[] = { + .rates = SNDRV_PCM_RATE_8000_192000, + .formats = TAS2552_FORMATS, + }, ++ .capture = { ++ .stream_name = "Capture", ++ .channels_min = 2, ++ .channels_max = 2, ++ .rates = SNDRV_PCM_RATE_8000_192000, ++ .formats = TAS2552_FORMATS, ++ }, + .ops = &tas2552_speaker_dai_ops, + }, + }; +-- +2.43.0 + diff --git a/queue-6.9/asoc-tas2781-fix-a-warning-reported-by-robot-kernel-.patch b/queue-6.9/asoc-tas2781-fix-a-warning-reported-by-robot-kernel-.patch new file mode 100644 index 00000000000..3e336ab779e --- /dev/null +++ b/queue-6.9/asoc-tas2781-fix-a-warning-reported-by-robot-kernel-.patch @@ -0,0 +1,50 @@ +From 4feffa26a7fa734df23d49a3242b48194ba5870b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 20:23:45 +0800 +Subject: ASoC: tas2781: Fix a warning reported by robot kernel test + +From: Shenghao Ding + +[ Upstream commit 1ae14f3520b1a0ad144610a3f592c81a3e81cd1b ] + +Fix a warning reported by robot kernel test that 'fw_entry' in function +'tas2781_load_calibration' is used uninitialized with compiler +sh4-linux-gcc (GCC) 13.2.0, an update of copyright and a correction of the +comments. + +Fixes: ef3bcde75d06 ("ASoc: tas2781: Add tas2781 driver") +Signed-off-by: Shenghao Ding +Link: https://lore.kernel.org/r/20240505122346.1326-1-shenghao-ding@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2781-fmwlib.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/tas2781-fmwlib.c b/sound/soc/codecs/tas2781-fmwlib.c +index 45760fe195237..a6be81adcb839 100644 +--- a/sound/soc/codecs/tas2781-fmwlib.c ++++ b/sound/soc/codecs/tas2781-fmwlib.c +@@ -1,8 +1,8 @@ + // SPDX-License-Identifier: GPL-2.0 + // +-// tasdevice-fmw.c -- TASDEVICE firmware support ++// tas2781-fmwlib.c -- TASDEVICE firmware support + // +-// Copyright 2023 Texas Instruments, Inc. ++// Copyright 2023 - 2024 Texas Instruments, Inc. + // + // Author: Shenghao Ding + +@@ -1878,7 +1878,7 @@ int tas2781_load_calibration(void *context, char *file_name, + { + struct tasdevice_priv *tas_priv = (struct tasdevice_priv *)context; + struct tasdevice *tasdev = &(tas_priv->tasdevice[i]); +- const struct firmware *fw_entry; ++ const struct firmware *fw_entry = NULL; + struct tasdevice_fw *tas_fmw; + struct firmware fmw; + int offset = 0; +-- +2.43.0 + diff --git a/queue-6.9/asoc-tas2781-fix-wrong-loading-calibrated-data-seque.patch b/queue-6.9/asoc-tas2781-fix-wrong-loading-calibrated-data-seque.patch new file mode 100644 index 00000000000..2a68b57252c --- /dev/null +++ b/queue-6.9/asoc-tas2781-fix-wrong-loading-calibrated-data-seque.patch @@ -0,0 +1,222 @@ +From 7ad7244bb60b9781dfc3175e7b26b74009fd9d7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 May 2024 22:15:46 +0800 +Subject: ASoC: tas2781: Fix wrong loading calibrated data sequence + +From: Shenghao Ding + +[ Upstream commit b195acf5266d2dee4067f89345c3e6b88d925311 ] + +Calibrated data will be set to default after loading DSP config params, +which will cause speaker protection work abnormally. Reload calibrated +data after loading DSP config params. Remove declaration of unused API +which load calibrated data in wrong sequence, changed the copyright year +and correct file name in license +header. + +Fixes: ef3bcde75d06 ("ASoC: tas2781: Add tas2781 driver") +Signed-off-by: Shenghao Ding +Link: https://msgid.link/r/20240518141546.1742-1-shenghao-ding@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/tas2781-dsp.h | 7 +- + sound/soc/codecs/tas2781-fmwlib.c | 103 ++++++++---------------------- + sound/soc/codecs/tas2781-i2c.c | 4 +- + 3 files changed, 32 insertions(+), 82 deletions(-) + +diff --git a/include/sound/tas2781-dsp.h b/include/sound/tas2781-dsp.h +index ea9af2726a53f..7fba7ea26a4b0 100644 +--- a/include/sound/tas2781-dsp.h ++++ b/include/sound/tas2781-dsp.h +@@ -2,7 +2,7 @@ + // + // ALSA SoC Texas Instruments TAS2781 Audio Smart Amplifier + // +-// Copyright (C) 2022 - 2023 Texas Instruments Incorporated ++// Copyright (C) 2022 - 2024 Texas Instruments Incorporated + // https://www.ti.com + // + // The TAS2781 driver implements a flexible and configurable +@@ -13,8 +13,8 @@ + // Author: Kevin Lu + // + +-#ifndef __TASDEVICE_DSP_H__ +-#define __TASDEVICE_DSP_H__ ++#ifndef __TAS2781_DSP_H__ ++#define __TAS2781_DSP_H__ + + #define MAIN_ALL_DEVICES 0x0d + #define MAIN_DEVICE_A 0x01 +@@ -180,7 +180,6 @@ void tasdevice_calbin_remove(void *context); + int tasdevice_select_tuningprm_cfg(void *context, int prm, + int cfg_no, int rca_conf_no); + int tasdevice_prmg_load(void *context, int prm_no); +-int tasdevice_prmg_calibdata_load(void *context, int prm_no); + void tasdevice_tuning_switch(void *context, int state); + int tas2781_load_calibration(void *context, char *file_name, + unsigned short i); +diff --git a/sound/soc/codecs/tas2781-fmwlib.c b/sound/soc/codecs/tas2781-fmwlib.c +index a6be81adcb839..265a8ca25cbbe 100644 +--- a/sound/soc/codecs/tas2781-fmwlib.c ++++ b/sound/soc/codecs/tas2781-fmwlib.c +@@ -2151,6 +2151,24 @@ static int tasdevice_load_data(struct tasdevice_priv *tas_priv, + return ret; + } + ++static void tasdev_load_calibrated_data(struct tasdevice_priv *priv, int i) ++{ ++ struct tasdevice_calibration *cal; ++ struct tasdevice_fw *cal_fmw; ++ ++ cal_fmw = priv->tasdevice[i].cali_data_fmw; ++ ++ /* No calibrated data for current devices, playback will go ahead. */ ++ if (!cal_fmw) ++ return; ++ ++ cal = cal_fmw->calibrations; ++ if (cal) ++ return; ++ ++ load_calib_data(priv, &cal->dev_data); ++} ++ + int tasdevice_select_tuningprm_cfg(void *context, int prm_no, + int cfg_no, int rca_conf_no) + { +@@ -2210,21 +2228,9 @@ int tasdevice_select_tuningprm_cfg(void *context, int prm_no, + for (i = 0; i < tas_priv->ndev; i++) { + if (tas_priv->tasdevice[i].is_loaderr == true) + continue; +- else if (tas_priv->tasdevice[i].is_loaderr == false +- && tas_priv->tasdevice[i].is_loading == true) { +- struct tasdevice_fw *cal_fmw = +- tas_priv->tasdevice[i].cali_data_fmw; +- +- if (cal_fmw) { +- struct tasdevice_calibration +- *cal = cal_fmw->calibrations; +- +- if (cal) +- load_calib_data(tas_priv, +- &(cal->dev_data)); +- } ++ if (tas_priv->tasdevice[i].is_loaderr == false && ++ tas_priv->tasdevice[i].is_loading == true) + tas_priv->tasdevice[i].cur_prog = prm_no; +- } + } + } + +@@ -2245,11 +2251,15 @@ int tasdevice_select_tuningprm_cfg(void *context, int prm_no, + tasdevice_load_data(tas_priv, &(conf->dev_data)); + for (i = 0; i < tas_priv->ndev; i++) { + if (tas_priv->tasdevice[i].is_loaderr == true) { +- status |= 1 << (i + 4); ++ status |= BIT(i + 4); + continue; +- } else if (tas_priv->tasdevice[i].is_loaderr == false +- && tas_priv->tasdevice[i].is_loading == true) ++ } ++ ++ if (tas_priv->tasdevice[i].is_loaderr == false && ++ tas_priv->tasdevice[i].is_loading == true) { ++ tasdev_load_calibrated_data(tas_priv, i); + tas_priv->tasdevice[i].cur_conf = cfg_no; ++ } + } + } else + dev_dbg(tas_priv->dev, "%s: Unneeded loading dsp conf %d\n", +@@ -2308,65 +2318,6 @@ int tasdevice_prmg_load(void *context, int prm_no) + } + EXPORT_SYMBOL_NS_GPL(tasdevice_prmg_load, SND_SOC_TAS2781_FMWLIB); + +-int tasdevice_prmg_calibdata_load(void *context, int prm_no) +-{ +- struct tasdevice_priv *tas_priv = (struct tasdevice_priv *) context; +- struct tasdevice_fw *tas_fmw = tas_priv->fmw; +- struct tasdevice_prog *program; +- int prog_status = 0; +- int i; +- +- if (!tas_fmw) { +- dev_err(tas_priv->dev, "%s: Firmware is NULL\n", __func__); +- goto out; +- } +- +- if (prm_no >= tas_fmw->nr_programs) { +- dev_err(tas_priv->dev, +- "%s: prm(%d) is not in range of Programs %u\n", +- __func__, prm_no, tas_fmw->nr_programs); +- goto out; +- } +- +- for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) { +- if (prm_no >= 0 && tas_priv->tasdevice[i].cur_prog != prm_no) { +- tas_priv->tasdevice[i].cur_conf = -1; +- tas_priv->tasdevice[i].is_loading = true; +- prog_status++; +- } +- tas_priv->tasdevice[i].is_loaderr = false; +- } +- +- if (prog_status) { +- program = &(tas_fmw->programs[prm_no]); +- tasdevice_load_data(tas_priv, &(program->dev_data)); +- for (i = 0; i < tas_priv->ndev; i++) { +- if (tas_priv->tasdevice[i].is_loaderr == true) +- continue; +- else if (tas_priv->tasdevice[i].is_loaderr == false +- && tas_priv->tasdevice[i].is_loading == true) { +- struct tasdevice_fw *cal_fmw = +- tas_priv->tasdevice[i].cali_data_fmw; +- +- if (cal_fmw) { +- struct tasdevice_calibration *cal = +- cal_fmw->calibrations; +- +- if (cal) +- load_calib_data(tas_priv, +- &(cal->dev_data)); +- } +- tas_priv->tasdevice[i].cur_prog = prm_no; +- } +- } +- } +- +-out: +- return prog_status; +-} +-EXPORT_SYMBOL_NS_GPL(tasdevice_prmg_calibdata_load, +- SND_SOC_TAS2781_FMWLIB); +- + void tasdevice_tuning_switch(void *context, int state) + { + struct tasdevice_priv *tas_priv = (struct tasdevice_priv *) context; +diff --git a/sound/soc/codecs/tas2781-i2c.c b/sound/soc/codecs/tas2781-i2c.c +index b5abff230e437..9350972dfefe7 100644 +--- a/sound/soc/codecs/tas2781-i2c.c ++++ b/sound/soc/codecs/tas2781-i2c.c +@@ -2,7 +2,7 @@ + // + // ALSA SoC Texas Instruments TAS2563/TAS2781 Audio Smart Amplifier + // +-// Copyright (C) 2022 - 2023 Texas Instruments Incorporated ++// Copyright (C) 2022 - 2024 Texas Instruments Incorporated + // https://www.ti.com + // + // The TAS2563/TAS2781 driver implements a flexible and configurable +@@ -414,7 +414,7 @@ static void tasdevice_fw_ready(const struct firmware *fmw, + __func__, tas_priv->cal_binaryname[i]); + } + +- tasdevice_prmg_calibdata_load(tas_priv, 0); ++ tasdevice_prmg_load(tas_priv, 0); + tas_priv->cur_prog = 0; + out: + if (tas_priv->fw_state == TASDEVICE_DSP_FW_FAIL) { +-- +2.43.0 + diff --git a/queue-6.9/blk-cgroup-fix-list-corruption-from-reorder-of-write.patch b/queue-6.9/blk-cgroup-fix-list-corruption-from-reorder-of-write.patch new file mode 100644 index 00000000000..fdad9dde826 --- /dev/null +++ b/queue-6.9/blk-cgroup-fix-list-corruption-from-reorder-of-write.patch @@ -0,0 +1,54 @@ +From cee3eacfaee9d33c8217d304af5db8e257ac71d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 09:31:57 +0800 +Subject: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued + +From: Ming Lei + +[ Upstream commit d0aac2363549e12cc79b8e285f13d5a9f42fd08e ] + +__blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start +is being executed. + +If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in +the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one +stat instance being added in blk_cgroup_bio_start(), then the local +list in __blkcg_rstat_flush() could be corrupted. + +Fix the issue by adding one barrier. + +Cc: Tejun Heo +Cc: Waiman Long +Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20240515013157.443672-3-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 86752b1652b5b..b36ba1d40ba1d 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -1036,6 +1036,16 @@ static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu) + struct blkg_iostat cur; + unsigned int seq; + ++ /* ++ * Order assignment of `next_bisc` from `bisc->lnode.next` in ++ * llist_for_each_entry_safe and clearing `bisc->lqueued` for ++ * avoiding to assign `next_bisc` with new next pointer added ++ * in blk_cgroup_bio_start() in case of re-ordering. ++ * ++ * The pair barrier is implied in llist_add() in blk_cgroup_bio_start(). ++ */ ++ smp_mb(); ++ + WRITE_ONCE(bisc->lqueued, false); + + /* fetch the current per-cpu values */ +-- +2.43.0 + diff --git a/queue-6.9/blk-cgroup-fix-list-corruption-from-resetting-io-sta.patch b/queue-6.9/blk-cgroup-fix-list-corruption-from-resetting-io-sta.patch new file mode 100644 index 00000000000..922beb79af3 --- /dev/null +++ b/queue-6.9/blk-cgroup-fix-list-corruption-from-resetting-io-sta.patch @@ -0,0 +1,121 @@ +From 1a53ae824a982f67bd452ba85f1348f4dc194596 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 09:31:56 +0800 +Subject: blk-cgroup: fix list corruption from resetting io stat + +From: Ming Lei + +[ Upstream commit 6da6680632792709cecf2b006f2fe3ca7857e791 ] + +Since commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()"), +each iostat instance is added to blkcg percpu list, so blkcg_reset_stats() +can't reset the stat instance by memset(), otherwise the llist may be +corrupted. + +Fix the issue by only resetting the counter part. + +Cc: Tejun Heo +Cc: Waiman Long +Cc: Jay Shin +Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") +Signed-off-by: Ming Lei +Acked-by: Tejun Heo +Reviewed-by: Waiman Long +Link: https://lore.kernel.org/r/20240515013157.443672-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 58 ++++++++++++++++++++++++++++------------------ + 1 file changed, 35 insertions(+), 23 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 059467086b131..86752b1652b5b 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -619,12 +619,45 @@ static void blkg_destroy_all(struct gendisk *disk) + spin_unlock_irq(&q->queue_lock); + } + ++static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src) ++{ ++ int i; ++ ++ for (i = 0; i < BLKG_IOSTAT_NR; i++) { ++ dst->bytes[i] = src->bytes[i]; ++ dst->ios[i] = src->ios[i]; ++ } ++} ++ ++static void __blkg_clear_stat(struct blkg_iostat_set *bis) ++{ ++ struct blkg_iostat cur = {0}; ++ unsigned long flags; ++ ++ flags = u64_stats_update_begin_irqsave(&bis->sync); ++ blkg_iostat_set(&bis->cur, &cur); ++ blkg_iostat_set(&bis->last, &cur); ++ u64_stats_update_end_irqrestore(&bis->sync, flags); ++} ++ ++static void blkg_clear_stat(struct blkcg_gq *blkg) ++{ ++ int cpu; ++ ++ for_each_possible_cpu(cpu) { ++ struct blkg_iostat_set *s = per_cpu_ptr(blkg->iostat_cpu, cpu); ++ ++ __blkg_clear_stat(s); ++ } ++ __blkg_clear_stat(&blkg->iostat); ++} ++ + static int blkcg_reset_stats(struct cgroup_subsys_state *css, + struct cftype *cftype, u64 val) + { + struct blkcg *blkcg = css_to_blkcg(css); + struct blkcg_gq *blkg; +- int i, cpu; ++ int i; + + mutex_lock(&blkcg_pol_mutex); + spin_lock_irq(&blkcg->lock); +@@ -635,18 +668,7 @@ static int blkcg_reset_stats(struct cgroup_subsys_state *css, + * anyway. If you get hit by a race, retry. + */ + hlist_for_each_entry(blkg, &blkcg->blkg_list, blkcg_node) { +- for_each_possible_cpu(cpu) { +- struct blkg_iostat_set *bis = +- per_cpu_ptr(blkg->iostat_cpu, cpu); +- memset(bis, 0, sizeof(*bis)); +- +- /* Re-initialize the cleared blkg_iostat_set */ +- u64_stats_init(&bis->sync); +- bis->blkg = blkg; +- } +- memset(&blkg->iostat, 0, sizeof(blkg->iostat)); +- u64_stats_init(&blkg->iostat.sync); +- ++ blkg_clear_stat(blkg); + for (i = 0; i < BLKCG_MAX_POLS; i++) { + struct blkcg_policy *pol = blkcg_policy[i]; + +@@ -949,16 +971,6 @@ void blkg_conf_exit(struct blkg_conf_ctx *ctx) + } + EXPORT_SYMBOL_GPL(blkg_conf_exit); + +-static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src) +-{ +- int i; +- +- for (i = 0; i < BLKG_IOSTAT_NR; i++) { +- dst->bytes[i] = src->bytes[i]; +- dst->ios[i] = src->ios[i]; +- } +-} +- + static void blkg_iostat_add(struct blkg_iostat *dst, struct blkg_iostat *src) + { + int i; +-- +2.43.0 + diff --git a/queue-6.9/blk-cgroup-properly-propagate-the-iostat-update-up-t.patch b/queue-6.9/blk-cgroup-properly-propagate-the-iostat-update-up-t.patch new file mode 100644 index 00000000000..6b1e39d5828 --- /dev/null +++ b/queue-6.9/blk-cgroup-properly-propagate-the-iostat-update-up-t.patch @@ -0,0 +1,87 @@ +From 6415e4f1c13eb923cadcf26684d5659427e63df6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 10:30:59 -0400 +Subject: blk-cgroup: Properly propagate the iostat update up the hierarchy + +From: Waiman Long + +[ Upstream commit 9d230c09964e6e18c8f6e4f0d41ee90eef45ec1c ] + +During a cgroup_rstat_flush() call, the lowest level of nodes are flushed +first before their parents. Since commit 3b8cc6298724 ("blk-cgroup: +Optimize blkcg_rstat_flush()"), iostat propagation was still done to +the parent. Grandparent, however, may not get the iostat update if the +parent has no blkg_iostat_set queued in its lhead lockless list. + +Fix this iostat propagation problem by queuing the parent's global +blkg->iostat into one of its percpu lockless lists to make sure that +the delta will always be propagated up to the grandparent and so on +toward the root blkcg. + +Note that successive calls to __blkcg_rstat_flush() are serialized by +the cgroup_rstat_lock. So no special barrier is used in the reading +and writing of blkg->iostat.lqueued. + +Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") +Reported-by: Dan Schatzberg +Closes: https://lore.kernel.org/lkml/ZkO6l%2FODzadSgdhC@dschatzberg-fedora-PF3DHTBV/ +Signed-off-by: Waiman Long +Reviewed-by: Ming Lei +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20240515143059.276677-1-longman@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index b36ba1d40ba1d..96af8224992e6 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -323,6 +323,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct gendisk *disk, + blkg->q = disk->queue; + INIT_LIST_HEAD(&blkg->q_node); + blkg->blkcg = blkcg; ++ blkg->iostat.blkg = blkg; + #ifdef CONFIG_BLK_CGROUP_PUNT_BIO + spin_lock_init(&blkg->async_bio_lock); + bio_list_init(&blkg->async_bios); +@@ -1047,6 +1048,8 @@ static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu) + smp_mb(); + + WRITE_ONCE(bisc->lqueued, false); ++ if (bisc == &blkg->iostat) ++ goto propagate_up; /* propagate up to parent only */ + + /* fetch the current per-cpu values */ + do { +@@ -1056,10 +1059,24 @@ static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu) + + blkcg_iostat_update(blkg, &cur, &bisc->last); + ++propagate_up: + /* propagate global delta to parent (unless that's root) */ +- if (parent && parent->parent) ++ if (parent && parent->parent) { + blkcg_iostat_update(parent, &blkg->iostat.cur, + &blkg->iostat.last); ++ /* ++ * Queue parent->iostat to its blkcg's lockless ++ * list to propagate up to the grandparent if the ++ * iostat hasn't been queued yet. ++ */ ++ if (!parent->iostat.lqueued) { ++ struct llist_head *plhead; ++ ++ plhead = per_cpu_ptr(parent->blkcg->lhead, cpu); ++ llist_add(&parent->iostat.lnode, plhead); ++ parent->iostat.lqueued = true; ++ } ++ } + } + raw_spin_unlock_irqrestore(&blkg_stat_lock, flags); + out: +-- +2.43.0 + diff --git a/queue-6.9/bluetooth-iso-handle-pa-sync-when-no-biginfo-reports.patch b/queue-6.9/bluetooth-iso-handle-pa-sync-when-no-biginfo-reports.patch new file mode 100644 index 00000000000..2ff030dc5fa --- /dev/null +++ b/queue-6.9/bluetooth-iso-handle-pa-sync-when-no-biginfo-reports.patch @@ -0,0 +1,372 @@ +From a1e714682448fb8e4ec3e90912a6accd36ce2a98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 14:39:31 +0300 +Subject: Bluetooth: ISO: Handle PA sync when no BIGInfo reports are generated + +From: Iulia Tanasescu + +[ Upstream commit d356c924e7a3adbea1e3e4ff4e098bcd9b99a82d ] + +In case of a Broadcast Source that has PA enabled but no active BIG, +a Broadcast Sink needs to establish PA sync and parse BASE from PA +reports. + +This commit moves the allocation of a PA sync hcon from the BIGInfo +advertising report event to the PA sync established event. After the +first complete PA report, the hcon is notified to the ISO layer. A +child socket is allocated and enqueued in the parent's accept queue. + +BIGInfo reports also need to be processed, to extract the encryption +field and inform userspace. After the first BIGInfo report is received, +the PA sync hcon is notified again to the ISO layer. Since a socket will +be found this time, the socket state will transition to BT_CONNECTED and +the userspace will be woken up using sk_state_change. + +Signed-off-by: Iulia Tanasescu +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: a5b862c6a221 ("Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 3 +- + net/bluetooth/hci_event.c | 58 +++++++++++--------- + net/bluetooth/iso.c | 94 ++++++++++++++------------------ + 3 files changed, 74 insertions(+), 81 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 5277c6d5134ca..970101184cf10 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1335,8 +1335,7 @@ hci_conn_hash_lookup_pa_sync_handle(struct hci_dev *hdev, __u16 sync_handle) + rcu_read_lock(); + + list_for_each_entry_rcu(c, &h->list, list) { +- if (c->type != ISO_LINK || +- !test_bit(HCI_CONN_PA_SYNC, &c->flags)) ++ if (c->type != ISO_LINK) + continue; + + if (c->sync_handle == sync_handle) { +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index cce73749f2dce..5449c6c086aa4 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -1,7 +1,7 @@ + /* + BlueZ - Bluetooth protocol stack for Linux + Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. +- Copyright 2023 NXP ++ Copyright 2023-2024 NXP + + Written 2000,2001 by Maxim Krasnyansky + +@@ -6359,14 +6359,16 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data, + if (!(flags & HCI_PROTO_DEFER)) + goto unlock; + +- if (ev->status) { +- /* Add connection to indicate the failed PA sync event */ +- pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY, +- HCI_ROLE_SLAVE); ++ /* Add connection to indicate PA sync event */ ++ pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY, ++ HCI_ROLE_SLAVE); + +- if (!pa_sync) +- goto unlock; ++ if (!pa_sync) ++ goto unlock; + ++ pa_sync->sync_handle = le16_to_cpu(ev->handle); ++ ++ if (ev->status) { + set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags); + + /* Notify iso layer */ +@@ -6383,6 +6385,7 @@ static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data, + struct hci_ev_le_per_adv_report *ev = data; + int mask = hdev->link_mode; + __u8 flags = 0; ++ struct hci_conn *pa_sync; + + bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle)); + +@@ -6390,8 +6393,28 @@ static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data, + + mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags); + if (!(mask & HCI_LM_ACCEPT)) +- hci_le_pa_term_sync(hdev, ev->sync_handle); ++ goto unlock; + ++ if (!(flags & HCI_PROTO_DEFER)) ++ goto unlock; ++ ++ pa_sync = hci_conn_hash_lookup_pa_sync_handle ++ (hdev, ++ le16_to_cpu(ev->sync_handle)); ++ ++ if (!pa_sync) ++ goto unlock; ++ ++ if (ev->data_status == LE_PA_DATA_COMPLETE && ++ !test_and_set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags)) { ++ /* Notify iso layer */ ++ hci_connect_cfm(pa_sync, 0); ++ ++ /* Notify MGMT layer */ ++ mgmt_device_connected(hdev, pa_sync, NULL, 0); ++ } ++ ++unlock: + hci_dev_unlock(hdev); + } + +@@ -6926,10 +6949,8 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data, + hci_dev_lock(hdev); + + mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags); +- if (!(mask & HCI_LM_ACCEPT)) { +- hci_le_pa_term_sync(hdev, ev->sync_handle); ++ if (!(mask & HCI_LM_ACCEPT)) + goto unlock; +- } + + if (!(flags & HCI_PROTO_DEFER)) + goto unlock; +@@ -6938,24 +6959,11 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data, + (hdev, + le16_to_cpu(ev->sync_handle)); + +- if (pa_sync) +- goto unlock; +- +- /* Add connection to indicate the PA sync event */ +- pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY, +- HCI_ROLE_SLAVE); +- + if (IS_ERR(pa_sync)) + goto unlock; + +- pa_sync->sync_handle = le16_to_cpu(ev->sync_handle); +- set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags); +- + /* Notify iso layer */ +- hci_connect_cfm(pa_sync, 0x00); +- +- /* Notify MGMT layer */ +- mgmt_device_connected(hdev, pa_sync, NULL, 0); ++ hci_connect_cfm(pa_sync, 0); + + unlock: + hci_dev_unlock(hdev); +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 6cb41f9d174e2..00c0d8413c638 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -54,7 +54,6 @@ static void iso_sock_kill(struct sock *sk); + enum { + BT_SK_BIG_SYNC, + BT_SK_PA_SYNC, +- BT_SK_PA_SYNC_TERM, + }; + + struct iso_pinfo { +@@ -81,6 +80,7 @@ static bool check_ucast_qos(struct bt_iso_qos *qos); + static bool check_bcast_qos(struct bt_iso_qos *qos); + static bool iso_match_sid(struct sock *sk, void *data); + static bool iso_match_sync_handle(struct sock *sk, void *data); ++static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data); + static void iso_sock_disconn(struct sock *sk); + + typedef bool (*iso_sock_match_t)(struct sock *sk, void *data); +@@ -197,21 +197,10 @@ static void iso_chan_del(struct sock *sk, int err) + sock_set_flag(sk, SOCK_ZAPPED); + } + +-static bool iso_match_conn_sync_handle(struct sock *sk, void *data) +-{ +- struct hci_conn *hcon = data; +- +- if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) +- return false; +- +- return hcon->sync_handle == iso_pi(sk)->sync_handle; +-} +- + static void iso_conn_del(struct hci_conn *hcon, int err) + { + struct iso_conn *conn = hcon->iso_data; + struct sock *sk; +- struct sock *parent; + + if (!conn) + return; +@@ -227,26 +216,6 @@ static void iso_conn_del(struct hci_conn *hcon, int err) + + if (sk) { + lock_sock(sk); +- +- /* While a PA sync hcon is in the process of closing, +- * mark parent socket with a flag, so that any residual +- * BIGInfo adv reports that arrive before PA sync is +- * terminated are not processed anymore. +- */ +- if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) { +- parent = iso_get_sock(&hcon->src, +- &hcon->dst, +- BT_LISTEN, +- iso_match_conn_sync_handle, +- hcon); +- +- if (parent) { +- set_bit(BT_SK_PA_SYNC_TERM, +- &iso_pi(parent)->flags); +- sock_put(parent); +- } +- } +- + iso_sock_clear_timer(sk); + iso_chan_del(sk, err); + release_sock(sk); +@@ -860,6 +829,7 @@ static struct sock *iso_sock_alloc(struct net *net, struct socket *sock, + iso_pi(sk)->src_type = BDADDR_LE_PUBLIC; + + iso_pi(sk)->qos = default_qos; ++ iso_pi(sk)->sync_handle = -1; + + bt_sock_link(&iso_sk_list, sk); + return sk; +@@ -907,7 +877,6 @@ static int iso_sock_bind_bc(struct socket *sock, struct sockaddr *addr, + return -EINVAL; + + iso_pi(sk)->dst_type = sa->iso_bc->bc_bdaddr_type; +- iso_pi(sk)->sync_handle = -1; + + if (sa->iso_bc->bc_sid > 0x0f) + return -EINVAL; +@@ -984,7 +953,8 @@ static int iso_sock_bind(struct socket *sock, struct sockaddr *addr, + /* Allow the user to bind a PA sync socket to a number + * of BISes to sync to. + */ +- if (sk->sk_state == BT_CONNECT2 && ++ if ((sk->sk_state == BT_CONNECT2 || ++ sk->sk_state == BT_CONNECTED) && + test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) { + err = iso_sock_bind_pa_sk(sk, sa, addr_len); + goto done; +@@ -1396,6 +1366,16 @@ static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg, + } + release_sock(sk); + return 0; ++ case BT_CONNECTED: ++ if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) { ++ iso_conn_big_sync(sk); ++ sk->sk_state = BT_LISTEN; ++ release_sock(sk); ++ return 0; ++ } ++ ++ release_sock(sk); ++ break; + case BT_CONNECT: + release_sock(sk); + return iso_connect_cis(sk); +@@ -1541,7 +1521,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, + + case BT_ISO_QOS: + if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && +- sk->sk_state != BT_CONNECT2) { ++ sk->sk_state != BT_CONNECT2 && ++ (!test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags) || ++ sk->sk_state != BT_CONNECTED)) { + err = -EINVAL; + break; + } +@@ -1762,7 +1744,7 @@ static void iso_conn_ready(struct iso_conn *conn) + struct sock *sk = conn->sk; + struct hci_ev_le_big_sync_estabilished *ev = NULL; + struct hci_ev_le_pa_sync_established *ev2 = NULL; +- struct hci_evt_le_big_info_adv_report *ev3 = NULL; ++ struct hci_ev_le_per_adv_report *ev3 = NULL; + struct hci_conn *hcon; + + BT_DBG("conn %p", conn); +@@ -1799,12 +1781,12 @@ static void iso_conn_ready(struct iso_conn *conn) + iso_match_sid, ev2); + } else if (test_bit(HCI_CONN_PA_SYNC, &hcon->flags)) { + ev3 = hci_recv_event_data(hcon->hdev, +- HCI_EVT_LE_BIG_INFO_ADV_REPORT); ++ HCI_EV_LE_PER_ADV_REPORT); + if (ev3) + parent = iso_get_sock(&hcon->src, + &hcon->dst, + BT_LISTEN, +- iso_match_sync_handle, ++ iso_match_sync_handle_pa_report, + ev3); + } + +@@ -1847,7 +1829,6 @@ static void iso_conn_ready(struct iso_conn *conn) + + if (ev3) { + iso_pi(sk)->qos = iso_pi(parent)->qos; +- iso_pi(sk)->qos.bcast.encryption = ev3->encryption; + hcon->iso_qos = iso_pi(sk)->qos; + iso_pi(sk)->bc_num_bis = iso_pi(parent)->bc_num_bis; + memcpy(iso_pi(sk)->bc_bis, iso_pi(parent)->bc_bis, ISO_MAX_NUM_BIS); +@@ -1941,26 +1922,29 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) + + ev2 = hci_recv_event_data(hdev, HCI_EVT_LE_BIG_INFO_ADV_REPORT); + if (ev2) { +- /* Try to get PA sync listening socket, if it exists */ +- sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_LISTEN, +- iso_match_pa_sync_flag, NULL); +- +- if (!sk) { +- sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_LISTEN, +- iso_match_sync_handle, ev2); +- +- /* If PA Sync is in process of terminating, +- * do not handle any more BIGInfo adv reports. +- */ +- +- if (sk && test_bit(BT_SK_PA_SYNC_TERM, +- &iso_pi(sk)->flags)) +- return 0; ++ /* Check if BIGInfo report has already been handled */ ++ sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_CONNECTED, ++ iso_match_sync_handle, ev2); ++ if (sk) { ++ sock_put(sk); ++ sk = NULL; ++ goto done; + } + ++ /* Try to get PA sync socket, if it exists */ ++ sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_CONNECT2, ++ iso_match_sync_handle, ev2); ++ if (!sk) ++ sk = iso_get_sock(&hdev->bdaddr, bdaddr, ++ BT_LISTEN, ++ iso_match_sync_handle, ++ ev2); ++ + if (sk) { + int err; + ++ iso_pi(sk)->qos.bcast.encryption = ev2->encryption; ++ + if (ev2->num_bis < iso_pi(sk)->bc_num_bis) + iso_pi(sk)->bc_num_bis = ev2->num_bis; + +@@ -1979,6 +1963,8 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) + } + } + } ++ ++ goto done; + } + + ev3 = hci_recv_event_data(hdev, HCI_EV_LE_PER_ADV_REPORT); +-- +2.43.0 + diff --git a/queue-6.9/bluetooth-l2cap-fix-div-by-zero-in-l2cap_le_flowctl_.patch b/queue-6.9/bluetooth-l2cap-fix-div-by-zero-in-l2cap_le_flowctl_.patch new file mode 100644 index 00000000000..7aac74ba4c4 --- /dev/null +++ b/queue-6.9/bluetooth-l2cap-fix-div-by-zero-in-l2cap_le_flowctl_.patch @@ -0,0 +1,81 @@ +From e56296a2e86601288f1c8d10c48c432ccef6379c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 15:23:29 -0400 +Subject: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() + +From: Sungwoo Kim + +[ Upstream commit a5b862c6a221459d54e494e88965b48dcfa6cc44 ] + +l2cap_le_flowctl_init() can cause both div-by-zero and an integer +overflow since hdev->le_mtu may not fall in the valid range. + +Move MTU from hci_dev to hci_conn to validate MTU and stop the connection +process earlier if MTU is invalid. +Also, add a missing validation in read_buffer_size() and make it return +an error value if the validation fails. +Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a +kzalloc failure and invalid MTU value. + +divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI +CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +Workqueue: hci0 hci_rx_work +RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 +Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c +89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d +b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 +RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 +RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 +RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f +RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa +R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 +R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 +FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 +PKRU: 55555554 +Call Trace: + + l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] + l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] + l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] + l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 + l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 + hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] + hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 + process_one_work kernel/workqueue.c:3254 [inline] + process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 + worker_thread+0x926/0xe70 kernel/workqueue.c:3416 + kthread+0x2e3/0x380 kernel/kthread.c:388 + ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + +Modules linked in: +---[ end trace 0000000000000000 ]--- + +Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") +Suggested-by: Luiz Augusto von Dentz +Signed-off-by: Sungwoo Kim +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 5449c6c086aa4..1ed734a7fb313 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -6363,7 +6363,7 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data, + pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY, + HCI_ROLE_SLAVE); + +- if (!pa_sync) ++ if (IS_ERR(pa_sync)) + goto unlock; + + pa_sync->sync_handle = le16_to_cpu(ev->handle); +-- +2.43.0 + diff --git a/queue-6.9/cifs-fix-missing-set-of-remote_i_size.patch b/queue-6.9/cifs-fix-missing-set-of-remote_i_size.patch new file mode 100644 index 00000000000..2a95e34de2b --- /dev/null +++ b/queue-6.9/cifs-fix-missing-set-of-remote_i_size.patch @@ -0,0 +1,92 @@ +From 4d3524084eb210492fd44245a9e2662c0dac42f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 15:23:36 +0100 +Subject: cifs: Fix missing set of remote_i_size + +From: David Howells + +[ Upstream commit 93a43155127fec0f8cc942d63b76668c2f8f69fa ] + +Occasionally, the generic/001 xfstest will fail indicating corruption in +one of the copy chains when run on cifs against a server that supports +FSCTL_DUPLICATE_EXTENTS_TO_FILE (eg. Samba with a share on btrfs). The +problem is that the remote_i_size value isn't updated by cifs_setsize() +when called by smb2_duplicate_extents(), but i_size *is*. + +This may cause cifs_remap_file_range() to then skip the bit after calling +->duplicate_extents() that sets sizes. + +Fix this by calling netfs_resize_file() in smb2_duplicate_extents() before +calling cifs_setsize() to set i_size. + +This means we don't then need to call netfs_resize_file() upon return from +->duplicate_extents(), but we also fix the test to compare against the pre-dup +inode size. + +[Note that this goes back before the addition of remote_i_size with the +netfs_inode struct. It should probably have been setting cifsi->server_eof +previously.] + +Fixes: cfc63fc8126a ("smb3: fix cached file size problems in duplicate extents (reflink)") +Signed-off-by: David Howells +cc: Steve French +cc: Paulo Alcantara +cc: Shyam Prasad N +cc: Rohith Surabattula +cc: Jeff Layton +cc: linux-cifs@vger.kernel.org +cc: netfs@lists.linux.dev +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsfs.c | 6 +++--- + fs/smb/client/smb2ops.c | 1 + + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c +index c8449f43856c5..4fb21affe4e11 100644 +--- a/fs/smb/client/cifsfs.c ++++ b/fs/smb/client/cifsfs.c +@@ -1277,7 +1277,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, + struct cifsFileInfo *smb_file_src = src_file->private_data; + struct cifsFileInfo *smb_file_target = dst_file->private_data; + struct cifs_tcon *target_tcon, *src_tcon; +- unsigned long long destend, fstart, fend, new_size; ++ unsigned long long destend, fstart, fend, old_size, new_size; + unsigned int xid; + int rc; + +@@ -1344,6 +1344,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, + goto unlock; + if (fend > target_cifsi->netfs.zero_point) + target_cifsi->netfs.zero_point = fend + 1; ++ old_size = target_cifsi->netfs.remote_i_size; + + /* Discard all the folios that overlap the destination region. */ + cifs_dbg(FYI, "about to discard pages %llx-%llx\n", fstart, fend); +@@ -1356,9 +1357,8 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, + if (target_tcon->ses->server->ops->duplicate_extents) { + rc = target_tcon->ses->server->ops->duplicate_extents(xid, + smb_file_src, smb_file_target, off, len, destoff); +- if (rc == 0 && new_size > i_size_read(target_inode)) { ++ if (rc == 0 && new_size > old_size) { + truncate_setsize(target_inode, new_size); +- netfs_resize_file(&target_cifsi->netfs, new_size, true); + fscache_resize_cookie(cifs_inode_cookie(target_inode), + new_size); + } +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 28f0b7d19d534..6fea0aed43461 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -2028,6 +2028,7 @@ smb2_duplicate_extents(const unsigned int xid, + * size will be queried on next revalidate, but it is important + * to make sure that file's cached size is updated immediately + */ ++ netfs_resize_file(netfs_inode(inode), dest_off + len, true); + cifs_setsize(inode, dest_off + len); + } + rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, +-- +2.43.0 + diff --git a/queue-6.9/cifs-set-zero_point-in-the-copy_file_range-and-remap.patch b/queue-6.9/cifs-set-zero_point-in-the-copy_file_range-and-remap.patch new file mode 100644 index 00000000000..b89ee2e6404 --- /dev/null +++ b/queue-6.9/cifs-set-zero_point-in-the-copy_file_range-and-remap.patch @@ -0,0 +1,62 @@ +From 859ffc3a28cefa3e3cbe81edea67e7ffc25d7684 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 16:26:44 +0000 +Subject: cifs: Set zero_point in the copy_file_range() and remap_file_range() + +From: David Howells + +[ Upstream commit 3758c485f6c9124d8ad76b88382004cbc28a0892 ] + +Set zero_point in the copy_file_range() and remap_file_range() +implementations so that we don't skip reading data modified on a +server-side copy. + +Signed-off-by: David Howells +cc: Steve French +cc: Shyam Prasad N +cc: Rohith Surabattula +cc: Jeff Layton +cc: linux-cifs@vger.kernel.org +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +cc: linux-mm@kvack.org +Stable-dep-of: 93a43155127f ("cifs: Fix missing set of remote_i_size") +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c +index 39277c37185ca..c8449f43856c5 100644 +--- a/fs/smb/client/cifsfs.c ++++ b/fs/smb/client/cifsfs.c +@@ -1342,6 +1342,8 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, + rc = cifs_flush_folio(target_inode, destend, &fstart, &fend, false); + if (rc) + goto unlock; ++ if (fend > target_cifsi->netfs.zero_point) ++ target_cifsi->netfs.zero_point = fend + 1; + + /* Discard all the folios that overlap the destination region. */ + cifs_dbg(FYI, "about to discard pages %llx-%llx\n", fstart, fend); +@@ -1360,6 +1362,8 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, + fscache_resize_cookie(cifs_inode_cookie(target_inode), + new_size); + } ++ if (rc == 0 && new_size > target_cifsi->netfs.zero_point) ++ target_cifsi->netfs.zero_point = new_size; + } + + /* force revalidate of size and timestamps of target file now +@@ -1451,6 +1455,8 @@ ssize_t cifs_file_copychunk_range(unsigned int xid, + rc = cifs_flush_folio(target_inode, destend, &fstart, &fend, false); + if (rc) + goto unlock; ++ if (fend > target_cifsi->netfs.zero_point) ++ target_cifsi->netfs.zero_point = fend + 1; + + /* Discard all the folios that overlap the destination region. */ + truncate_inode_pages_range(&target_inode->i_data, fstart, fend); +-- +2.43.0 + diff --git a/queue-6.9/cxl-region-fix-cxlr_pmem-leaks.patch b/queue-6.9/cxl-region-fix-cxlr_pmem-leaks.patch new file mode 100644 index 00000000000..713779f0cf8 --- /dev/null +++ b/queue-6.9/cxl-region-fix-cxlr_pmem-leaks.patch @@ -0,0 +1,38 @@ +From 092f2ac56ead21fc42c9efb5103e65ce5eb02d2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2024 11:07:48 +0800 +Subject: cxl/region: Fix cxlr_pmem leaks + +From: Li Zhijian + +[ Upstream commit 1c987cf22d6b65ade46145c03eef13f0e3e81d83 ] + +Before this error path, cxlr_pmem pointed to a kzalloc() memory, free +it to avoid this memory leaking. + +Fixes: f17b558d6663 ("cxl/pmem: Refactor nvdimm device registration, delete the workqueue") +Signed-off-by: Li Zhijian +Reviewed-by: Dan Williams +Reviewed-by: Jonathan Cameron +Link: https://lore.kernel.org/r/20240428030748.318985-1-lizhijian@fujitsu.com +Signed-off-by: Dave Jiang +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/region.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c +index 5c186e0a39b96..812b2948b6c65 100644 +--- a/drivers/cxl/core/region.c ++++ b/drivers/cxl/core/region.c +@@ -2719,6 +2719,7 @@ static struct cxl_pmem_region *cxl_pmem_region_alloc(struct cxl_region *cxlr) + if (i == 0) { + cxl_nvb = cxl_find_nvdimm_bridge(cxlmd); + if (!cxl_nvb) { ++ kfree(cxlr_pmem); + cxlr_pmem = ERR_PTR(-ENODEV); + goto out; + } +-- +2.43.0 + diff --git a/queue-6.9/cxl-trace-correct-dpa-field-masks-for-general_media-.patch b/queue-6.9/cxl-trace-correct-dpa-field-masks-for-general_media-.patch new file mode 100644 index 00000000000..34a38bf86f0 --- /dev/null +++ b/queue-6.9/cxl-trace-correct-dpa-field-masks-for-general_media-.patch @@ -0,0 +1,55 @@ +From b0106a661b0694f2f7c44f5a4c441807038c8841 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 10:28:03 -0700 +Subject: cxl/trace: Correct DPA field masks for general_media & dram events + +From: Alison Schofield + +[ Upstream commit 2042d11cb57b7e0cbda7910e5ff80e9e8bf0ae17 ] + +The length of Physical Address in General Media and DRAM event +records is 64-bit, so the field mask for extracting the DPA should +be 64-bit also, otherwise the trace event reports DPA's with the +upper 32 bits of a DPA address masked off. If users do DPA-to-HPA +translations this could lead to incorrect page retirement decisions. + +Use GENMASK_ULL() for CXL_DPA_MASK to get all the DPA address bits. + +Tidy up CXL_DPA_FLAGS_MASK by using GENMASK() to only mask the exact +flag bits. + +These bits are defined as part of the event record physical address +descriptions of General Media and DRAM events in CXL Spec 3.1 +Section 8.2.9.2 Events. + +Fixes: d54a531a430b ("cxl/mem: Trace General Media Event Record") +Co-developed-by: Shiyang Ruan +Signed-off-by: Shiyang Ruan +Signed-off-by: Alison Schofield +Reviewed-by: Ira Weiny +Reviewed-by: Jonathan Cameron +Link: https://lore.kernel.org/r/2867fc43c57720a4a15a3179431829b8dbd2dc16.1714496730.git.alison.schofield@intel.com +Signed-off-by: Dave Jiang +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/trace.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/cxl/core/trace.h b/drivers/cxl/core/trace.h +index e5f13260fc524..7c5cd069f10cc 100644 +--- a/drivers/cxl/core/trace.h ++++ b/drivers/cxl/core/trace.h +@@ -253,8 +253,8 @@ TRACE_EVENT(cxl_generic_event, + * DRAM Event Record + * CXL rev 3.0 section 8.2.9.2.1.2; Table 8-44 + */ +-#define CXL_DPA_FLAGS_MASK 0x3F +-#define CXL_DPA_MASK (~CXL_DPA_FLAGS_MASK) ++#define CXL_DPA_FLAGS_MASK GENMASK(1, 0) ++#define CXL_DPA_MASK GENMASK_ULL(63, 6) + + #define CXL_DPA_VOLATILE BIT(0) + #define CXL_DPA_NOT_REPAIRABLE BIT(1) +-- +2.43.0 + diff --git a/queue-6.9/drivers-xen-improve-the-late-xenstore-init-protocol.patch b/queue-6.9/drivers-xen-improve-the-late-xenstore-init-protocol.patch new file mode 100644 index 00000000000..27c5badb42e --- /dev/null +++ b/queue-6.9/drivers-xen-improve-the-late-xenstore-init-protocol.patch @@ -0,0 +1,123 @@ +From 2113ee507518885eee1646561f5bd22c2c8a45fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 09:15:16 +0800 +Subject: drivers/xen: Improve the late XenStore init protocol + +From: Henry Wang + +[ Upstream commit a3607581cd49c17128a486a526a36a97bafcb2bb ] + +Currently, the late XenStore init protocol is only triggered properly +for the case that HVM_PARAM_STORE_PFN is ~0ULL (invalid). For the +case that XenStore interface is allocated but not ready (the connection +status is not XENSTORE_CONNECTED), Linux should also wait until the +XenStore is set up properly. + +Introduce a macro to describe the XenStore interface is ready, use +it in xenbus_probe_initcall() to select the code path of doing the +late XenStore init protocol or not. Since now we have more than one +condition for XenStore late init, rework the check in xenbus_probe() +for the free_irq(). + +Take the opportunity to enhance the check of the allocated XenStore +interface can be properly mapped, and return error early if the +memremap() fails. + +Fixes: 5b3353949e89 ("xen: add support for initializing xenstore later as HVM domain") +Signed-off-by: Henry Wang +Signed-off-by: Michal Orzel +Reviewed-by: Stefano Stabellini +Link: https://lore.kernel.org/r/20240517011516.1451087-1-xin.wang2@amd.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_probe.c | 36 ++++++++++++++++++++----------- + 1 file changed, 23 insertions(+), 13 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c +index 3205e5d724c8c..1a9ded0cddcb0 100644 +--- a/drivers/xen/xenbus/xenbus_probe.c ++++ b/drivers/xen/xenbus/xenbus_probe.c +@@ -65,13 +65,17 @@ + #include "xenbus.h" + + +-static int xs_init_irq; ++static int xs_init_irq = -1; + int xen_store_evtchn; + EXPORT_SYMBOL_GPL(xen_store_evtchn); + + struct xenstore_domain_interface *xen_store_interface; + EXPORT_SYMBOL_GPL(xen_store_interface); + ++#define XS_INTERFACE_READY \ ++ ((xen_store_interface != NULL) && \ ++ (xen_store_interface->connection == XENSTORE_CONNECTED)) ++ + enum xenstore_init xen_store_domain_type; + EXPORT_SYMBOL_GPL(xen_store_domain_type); + +@@ -751,19 +755,19 @@ static void xenbus_probe(void) + { + xenstored_ready = 1; + +- if (!xen_store_interface) { ++ if (!xen_store_interface) + xen_store_interface = memremap(xen_store_gfn << XEN_PAGE_SHIFT, + XEN_PAGE_SIZE, MEMREMAP_WB); +- /* +- * Now it is safe to free the IRQ used for xenstore late +- * initialization. No need to unbind: it is about to be +- * bound again from xb_init_comms. Note that calling +- * unbind_from_irqhandler now would result in xen_evtchn_close() +- * being called and the event channel not being enabled again +- * afterwards, resulting in missed event notifications. +- */ ++ /* ++ * Now it is safe to free the IRQ used for xenstore late ++ * initialization. No need to unbind: it is about to be ++ * bound again from xb_init_comms. Note that calling ++ * unbind_from_irqhandler now would result in xen_evtchn_close() ++ * being called and the event channel not being enabled again ++ * afterwards, resulting in missed event notifications. ++ */ ++ if (xs_init_irq >= 0) + free_irq(xs_init_irq, &xb_waitq); +- } + + /* + * In the HVM case, xenbus_init() deferred its call to +@@ -822,7 +826,7 @@ static int __init xenbus_probe_initcall(void) + if (xen_store_domain_type == XS_PV || + (xen_store_domain_type == XS_HVM && + !xs_hvm_defer_init_for_callback() && +- xen_store_interface != NULL)) ++ XS_INTERFACE_READY)) + xenbus_probe(); + + /* +@@ -831,7 +835,7 @@ static int __init xenbus_probe_initcall(void) + * started, then probe. It will be triggered when communication + * starts happening, by waiting on xb_waitq. + */ +- if (xen_store_domain_type == XS_LOCAL || xen_store_interface == NULL) { ++ if (xen_store_domain_type == XS_LOCAL || !XS_INTERFACE_READY) { + struct task_struct *probe_task; + + probe_task = kthread_run(xenbus_probe_thread, NULL, +@@ -1014,6 +1018,12 @@ static int __init xenbus_init(void) + xen_store_interface = + memremap(xen_store_gfn << XEN_PAGE_SHIFT, + XEN_PAGE_SIZE, MEMREMAP_WB); ++ if (!xen_store_interface) { ++ pr_err("%s: cannot map HVM_PARAM_STORE_PFN=%llx\n", ++ __func__, v); ++ err = -EINVAL; ++ goto out_error; ++ } + if (xen_store_interface->connection != XENSTORE_CONNECTED) + wait = true; + } +-- +2.43.0 + diff --git a/queue-6.9/drm-amdgpu-fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch b/queue-6.9/drm-amdgpu-fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch new file mode 100644 index 00000000000..d801bb081fe --- /dev/null +++ b/queue-6.9/drm-amdgpu-fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch @@ -0,0 +1,81 @@ +From 369bb24905e71127f827facbae8af8707fe936bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 11:22:32 +0530 +Subject: drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ + cp_compute_microcode() and rlc_microcode() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit acce6479e30f73ab0872e93a75aed1fb791d04ec ] + +The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating +about potential truncation of output when using the snprintf function. +The issue was due to the size of the buffer 'ucode_prefix' being too +small to accommodate the maximum possible length of the string being +written into it. + +The string being written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin", +where %s is replaced by the value of 'chip_name'. The length of this +string without the %s is 16 characters. The warning message indicated +that 'chip_name' could be up to 29 characters long, resulting in a total +of 45 characters, which exceeds the buffer size of 30 characters. + +To resolve this issue, the size of the 'ucode_prefix' buffer has been +reduced from 30 to 15. This ensures that the maximum possible length of +the string being written into the buffer will not exceed its size, thus +preventing potential buffer overflow and truncation issues. + +Fixes the below with gcc W=1: +drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’: +drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] + 379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name); + | ^~ +...... + 439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix); + | ~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30 + 379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] + 413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name); + | ^~ +...... + 443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix); + | ~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30 + 413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: 86301129698b ("drm/amdgpu: split gc v9_4_3 functionality from gc v9_0") +Cc: Hawking Zhang +Cc: Christian König +Cc: Alex Deucher +Cc: Lijo Lazar +Signed-off-by: Srinivasan Shanmugam +Suggested-by: Lijo Lazar +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +index f4d48d6d7e777..d89d6829f1df4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +@@ -431,7 +431,7 @@ static int gfx_v9_4_3_init_cp_compute_microcode(struct amdgpu_device *adev, + + static int gfx_v9_4_3_init_microcode(struct amdgpu_device *adev) + { +- char ucode_prefix[30]; ++ char ucode_prefix[15]; + int r; + + amdgpu_ucode_ip_version_decode(adev, GC_HWIP, ucode_prefix, sizeof(ucode_prefix)); +-- +2.43.0 + diff --git a/queue-6.9/drm-amdgpu-init-microcode-chip-name-from-ip-versions.patch b/queue-6.9/drm-amdgpu-init-microcode-chip-name-from-ip-versions.patch new file mode 100644 index 00000000000..ab49f756961 --- /dev/null +++ b/queue-6.9/drm-amdgpu-init-microcode-chip-name-from-ip-versions.patch @@ -0,0 +1,49 @@ +From 999ef4a3ce01680f8fd93badcfc04c25f5e06599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 17:57:52 +0800 +Subject: drm/amdgpu: init microcode chip name from ip versions + +From: Le Ma + +[ Upstream commit 92ed1e9cd5f6cc4f8c9a9ba6c4d2d2bbc6221296 ] + +To adapt to different gc versions in gfx_v9_4_3.c file. + +Signed-off-by: Le Ma +Reviewed-by: Hawking Zhang +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Stable-dep-of: acce6479e30f ("drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +index b53c8fd4e8cf3..f4d48d6d7e777 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +@@ -431,16 +431,16 @@ static int gfx_v9_4_3_init_cp_compute_microcode(struct amdgpu_device *adev, + + static int gfx_v9_4_3_init_microcode(struct amdgpu_device *adev) + { +- const char *chip_name; ++ char ucode_prefix[30]; + int r; + +- chip_name = "gc_9_4_3"; ++ amdgpu_ucode_ip_version_decode(adev, GC_HWIP, ucode_prefix, sizeof(ucode_prefix)); + +- r = gfx_v9_4_3_init_rlc_microcode(adev, chip_name); ++ r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix); + if (r) + return r; + +- r = gfx_v9_4_3_init_cp_compute_microcode(adev, chip_name); ++ r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix); + if (r) + return r; + +-- +2.43.0 + diff --git a/queue-6.9/drm-bridge-imx-fix-unmet-depenency-for-phy_fsl_samsu.patch b/queue-6.9/drm-bridge-imx-fix-unmet-depenency-for-phy_fsl_samsu.patch new file mode 100644 index 00000000000..a4c2d090b74 --- /dev/null +++ b/queue-6.9/drm-bridge-imx-fix-unmet-depenency-for-phy_fsl_samsu.patch @@ -0,0 +1,47 @@ +From 0fbbbb2d0a114c8f416133355cbd88bcc03907a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 05:33:52 -0500 +Subject: drm/bridge: imx: Fix unmet depenency for PHY_FSL_SAMSUNG_HDMI_PHY + +From: Adam Ford + +[ Upstream commit cbdbd9ca718e6efbc77b97ddf0b19b0cd46ac36c ] + +When enabling i.MX8MP DWC HDMI driver, it automatically selects +PHY_FSL_SAMSUNG_HDMI_PHY, since it wont' work without the phy. +This may cause some Kconfig warnings during various build tests. +Fix this by implying the phy instead of selecting the phy. + +To prevent this from happening with the DRM_IMX8MP_HDMI_PVI, also +imply it instead of selecting it. + +Fixes: 1f36d634670d ("drm/bridge: imx: add bridge wrapper driver for i.MX8MP DWC HDMI") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202404190103.lLm8LtuP-lkp@intel.com/ +Signed-off-by: Adam Ford +Reviewed-by: Laurent Pinchart +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240422103352.8886-1-aford173@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/imx/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/imx/Kconfig b/drivers/gpu/drm/bridge/imx/Kconfig +index 7687ed652df5b..13142a6b85905 100644 +--- a/drivers/gpu/drm/bridge/imx/Kconfig ++++ b/drivers/gpu/drm/bridge/imx/Kconfig +@@ -8,8 +8,8 @@ config DRM_IMX8MP_DW_HDMI_BRIDGE + depends on COMMON_CLK + depends on DRM_DW_HDMI + depends on OF +- select DRM_IMX8MP_HDMI_PVI +- select PHY_FSL_SAMSUNG_HDMI_PHY ++ imply DRM_IMX8MP_HDMI_PVI ++ imply PHY_FSL_SAMSUNG_HDMI_PHY + help + Choose this to enable support for the internal HDMI encoder found + on the i.MX8MP SoC. +-- +2.43.0 + diff --git a/queue-6.9/drm-bridge-tc358775-fix-support-for-jeida-18-and-jei.patch b/queue-6.9/drm-bridge-tc358775-fix-support-for-jeida-18-and-jei.patch new file mode 100644 index 00000000000..db6eca0e4b4 --- /dev/null +++ b/queue-6.9/drm-bridge-tc358775-fix-support-for-jeida-18-and-jei.patch @@ -0,0 +1,75 @@ +From e9f89dd99f4862b05ac79f2f95d36bfd942927b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Feb 2024 08:19:33 +0200 +Subject: drm/bridge: tc358775: fix support for jeida-18 and jeida-24 + +From: Michael Walle + +[ Upstream commit 30ea09a182cb37c4921b9d477ed18107befe6d78 ] + +The bridge always uses 24bpp internally. Therefore, for jeida-18 +mapping we need to discard the lowest two bits for each channel and thus +starting with LV_[RGB]2. jeida-24 has the same mapping but uses four +lanes instead of three, with the forth pair transmitting the lowest two +bits of each channel. Thus, the mapping between jeida-18 and jeida-24 +is actually the same, except that one channel is turned off (by +selecting the RGB666 format in VPCTRL). + +While at it, remove the bogus comment about the hardware default because +the default is overwritten in any case. + +Tested with a jeida-18 display (Evervision VGG644804). + +Fixes: b26975593b17 ("display/drm/bridge: TC358775 DSI/LVDS driver") +Signed-off-by: Michael Walle +Signed-off-by: Tony Lindgren +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240225062008.33191-5-tony@atomide.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358775.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358775.c b/drivers/gpu/drm/bridge/tc358775.c +index fea4f00a20f83..c737670631929 100644 +--- a/drivers/gpu/drm/bridge/tc358775.c ++++ b/drivers/gpu/drm/bridge/tc358775.c +@@ -454,10 +454,6 @@ static void tc_bridge_enable(struct drm_bridge *bridge) + dev_dbg(tc->dev, "bus_formats %04x bpc %d\n", + connector->display_info.bus_formats[0], + tc->bpc); +- /* +- * Default hardware register settings of tc358775 configured +- * with MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA jeida-24 format +- */ + if (connector->display_info.bus_formats[0] == + MEDIA_BUS_FMT_RGB888_1X7X4_SPWG) { + /* VESA-24 */ +@@ -468,14 +464,15 @@ static void tc_bridge_enable(struct drm_bridge *bridge) + d2l_write(tc->i2c, LV_MX1619, LV_MX(LVI_B6, LVI_B7, LVI_B1, LVI_B2)); + d2l_write(tc->i2c, LV_MX2023, LV_MX(LVI_B3, LVI_B4, LVI_B5, LVI_L0)); + d2l_write(tc->i2c, LV_MX2427, LV_MX(LVI_HS, LVI_VS, LVI_DE, LVI_R6)); +- } else { /* MEDIA_BUS_FMT_RGB666_1X7X3_SPWG - JEIDA-18 */ +- d2l_write(tc->i2c, LV_MX0003, LV_MX(LVI_R0, LVI_R1, LVI_R2, LVI_R3)); +- d2l_write(tc->i2c, LV_MX0407, LV_MX(LVI_R4, LVI_L0, LVI_R5, LVI_G0)); +- d2l_write(tc->i2c, LV_MX0811, LV_MX(LVI_G1, LVI_G2, LVI_L0, LVI_L0)); +- d2l_write(tc->i2c, LV_MX1215, LV_MX(LVI_G3, LVI_G4, LVI_G5, LVI_B0)); +- d2l_write(tc->i2c, LV_MX1619, LV_MX(LVI_L0, LVI_L0, LVI_B1, LVI_B2)); +- d2l_write(tc->i2c, LV_MX2023, LV_MX(LVI_B3, LVI_B4, LVI_B5, LVI_L0)); +- d2l_write(tc->i2c, LV_MX2427, LV_MX(LVI_HS, LVI_VS, LVI_DE, LVI_L0)); ++ } else { ++ /* JEIDA-18 and JEIDA-24 */ ++ d2l_write(tc->i2c, LV_MX0003, LV_MX(LVI_R2, LVI_R3, LVI_R4, LVI_R5)); ++ d2l_write(tc->i2c, LV_MX0407, LV_MX(LVI_R6, LVI_R1, LVI_R7, LVI_G2)); ++ d2l_write(tc->i2c, LV_MX0811, LV_MX(LVI_G3, LVI_G4, LVI_G0, LVI_G1)); ++ d2l_write(tc->i2c, LV_MX1215, LV_MX(LVI_G5, LVI_G6, LVI_G7, LVI_B2)); ++ d2l_write(tc->i2c, LV_MX1619, LV_MX(LVI_B0, LVI_B1, LVI_B3, LVI_B4)); ++ d2l_write(tc->i2c, LV_MX2023, LV_MX(LVI_B5, LVI_B6, LVI_B7, LVI_L0)); ++ d2l_write(tc->i2c, LV_MX2427, LV_MX(LVI_HS, LVI_VS, LVI_DE, LVI_R0)); + } + + d2l_write(tc->i2c, VFUEN, VFUEN_EN); +-- +2.43.0 + diff --git a/queue-6.9/drm-make-drivers-depends-on-drm_dw_hdmi.patch b/queue-6.9/drm-make-drivers-depends-on-drm_dw_hdmi.patch new file mode 100644 index 00000000000..f743c68b78d --- /dev/null +++ b/queue-6.9/drm-make-drivers-depends-on-drm_dw_hdmi.patch @@ -0,0 +1,150 @@ +From 10f7eec459ab8deab2f552948d11b32e40420f93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 11:57:02 +0100 +Subject: drm: Make drivers depends on DRM_DW_HDMI + +From: Maxime Ripard + +[ Upstream commit c0e0f139354c01e0213204e4a96e7076e5a3e396 ] + +DRM_DW_HDMI has a number of dependencies that might not be enabled. +However, drivers were used to selecting it while not enforcing the +DRM_DW_HDMI dependencies. + +This could result in Kconfig warnings (and further build breakages) such +as: + + Kconfig warnings: (for reference only) + WARNING: unmet direct dependencies detected for DRM_DW_HDMI + Depends on [n]: HAS_IOMEM [=y] && DRM [=m] && DRM_BRIDGE [=y] && DRM_DISPLAY_HELPER [=n] + Selected by [m]: + - DRM_SUN8I_DW_HDMI [=m] && HAS_IOMEM [=y] && DRM_SUN4I [=m] + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202403262127.kZkttfNz-lkp@intel.com/ +Acked-by: Jani Nikula +Link: https://lore.kernel.org/r/20240327-kms-kconfig-helpers-v3-7-eafee11b84b3@kernel.org +Signed-off-by: Maxime Ripard +Stable-dep-of: cbdbd9ca718e ("drm/bridge: imx: Fix unmet depenency for PHY_FSL_SAMSUNG_HDMI_PHY") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/imx/Kconfig | 4 ++-- + drivers/gpu/drm/imx/ipuv3/Kconfig | 5 +++-- + drivers/gpu/drm/ingenic/Kconfig | 2 +- + drivers/gpu/drm/meson/Kconfig | 2 +- + drivers/gpu/drm/renesas/rcar-du/Kconfig | 2 +- + drivers/gpu/drm/rockchip/Kconfig | 2 +- + drivers/gpu/drm/sun4i/Kconfig | 2 +- + 7 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/imx/Kconfig b/drivers/gpu/drm/bridge/imx/Kconfig +index 5965e8027529a..7687ed652df5b 100644 +--- a/drivers/gpu/drm/bridge/imx/Kconfig ++++ b/drivers/gpu/drm/bridge/imx/Kconfig +@@ -5,9 +5,9 @@ config DRM_IMX_LDB_HELPER + + config DRM_IMX8MP_DW_HDMI_BRIDGE + tristate "Freescale i.MX8MP HDMI-TX bridge support" +- depends on OF + depends on COMMON_CLK +- select DRM_DW_HDMI ++ depends on DRM_DW_HDMI ++ depends on OF + select DRM_IMX8MP_HDMI_PVI + select PHY_FSL_SAMSUNG_HDMI_PHY + help +diff --git a/drivers/gpu/drm/imx/ipuv3/Kconfig b/drivers/gpu/drm/imx/ipuv3/Kconfig +index bacf0655ebaf3..5d810ac02171d 100644 +--- a/drivers/gpu/drm/imx/ipuv3/Kconfig ++++ b/drivers/gpu/drm/imx/ipuv3/Kconfig +@@ -35,7 +35,8 @@ config DRM_IMX_LDB + + config DRM_IMX_HDMI + tristate "Freescale i.MX DRM HDMI" +- select DRM_DW_HDMI +- depends on DRM_IMX && OF ++ depends on DRM_DW_HDMI ++ depends on DRM_IMX ++ depends on OF + help + Choose this if you want to use HDMI on i.MX6. +diff --git a/drivers/gpu/drm/ingenic/Kconfig b/drivers/gpu/drm/ingenic/Kconfig +index 3db117c5edd91..23effeb2ac721 100644 +--- a/drivers/gpu/drm/ingenic/Kconfig ++++ b/drivers/gpu/drm/ingenic/Kconfig +@@ -27,8 +27,8 @@ config DRM_INGENIC_IPU + + config DRM_INGENIC_DW_HDMI + tristate "Ingenic specific support for Synopsys DW HDMI" ++ depends on DRM_DW_HDMI + depends on MACH_JZ4780 +- select DRM_DW_HDMI + help + Choose this option to enable Synopsys DesignWare HDMI based driver. + If you want to enable HDMI on Ingenic JZ4780 based SoC, you should +diff --git a/drivers/gpu/drm/meson/Kconfig b/drivers/gpu/drm/meson/Kconfig +index 615fdd0ce41b4..5520b9e3f0107 100644 +--- a/drivers/gpu/drm/meson/Kconfig ++++ b/drivers/gpu/drm/meson/Kconfig +@@ -13,9 +13,9 @@ config DRM_MESON + + config DRM_MESON_DW_HDMI + tristate "HDMI Synopsys Controller support for Amlogic Meson Display" ++ depends on DRM_DW_HDMI + depends on DRM_MESON + default y if DRM_MESON +- select DRM_DW_HDMI + imply DRM_DW_HDMI_I2S_AUDIO + + config DRM_MESON_DW_MIPI_DSI +diff --git a/drivers/gpu/drm/renesas/rcar-du/Kconfig b/drivers/gpu/drm/renesas/rcar-du/Kconfig +index 53c356aed5d52..2dc739db2ba33 100644 +--- a/drivers/gpu/drm/renesas/rcar-du/Kconfig ++++ b/drivers/gpu/drm/renesas/rcar-du/Kconfig +@@ -25,8 +25,8 @@ config DRM_RCAR_CMM + config DRM_RCAR_DW_HDMI + tristate "R-Car Gen3 and RZ/G2 DU HDMI Encoder Support" + depends on DRM && OF ++ depends on DRM_DW_HDMI + depends on DRM_RCAR_DU || COMPILE_TEST +- select DRM_DW_HDMI + help + Enable support for R-Car Gen3 or RZ/G2 internal HDMI encoder. + +diff --git a/drivers/gpu/drm/rockchip/Kconfig b/drivers/gpu/drm/rockchip/Kconfig +index 1bf3e2829cd07..0d5260e10f272 100644 +--- a/drivers/gpu/drm/rockchip/Kconfig ++++ b/drivers/gpu/drm/rockchip/Kconfig +@@ -7,7 +7,6 @@ config DRM_ROCKCHIP + select DRM_PANEL + select VIDEOMODE_HELPERS + select DRM_ANALOGIX_DP if ROCKCHIP_ANALOGIX_DP +- select DRM_DW_HDMI if ROCKCHIP_DW_HDMI + select DRM_DW_MIPI_DSI if ROCKCHIP_DW_MIPI_DSI + select GENERIC_PHY if ROCKCHIP_DW_MIPI_DSI + select GENERIC_PHY_MIPI_DPHY if ROCKCHIP_DW_MIPI_DSI +@@ -57,6 +56,7 @@ config ROCKCHIP_CDN_DP + + config ROCKCHIP_DW_HDMI + bool "Rockchip specific extensions for Synopsys DW HDMI" ++ depends on DRM_DW_HDMI + help + This selects support for Rockchip SoC specific extensions + for the Synopsys DesignWare HDMI driver. If you want to +diff --git a/drivers/gpu/drm/sun4i/Kconfig b/drivers/gpu/drm/sun4i/Kconfig +index 4741d9f6544c2..5b19c7cb7b7eb 100644 +--- a/drivers/gpu/drm/sun4i/Kconfig ++++ b/drivers/gpu/drm/sun4i/Kconfig +@@ -57,8 +57,8 @@ config DRM_SUN6I_DSI + config DRM_SUN8I_DW_HDMI + tristate "Support for Allwinner version of DesignWare HDMI" + depends on DRM_SUN4I ++ depends on DRM_DW_HDMI + default DRM_SUN4I +- select DRM_DW_HDMI + help + Choose this option if you have an Allwinner SoC with the + DesignWare HDMI controller. SoCs that support HDMI and +-- +2.43.0 + diff --git a/queue-6.9/drm-mediatek-dp-fix-mtk_dp_aux_transfer-return-value.patch b/queue-6.9/drm-mediatek-dp-fix-mtk_dp_aux_transfer-return-value.patch new file mode 100644 index 00000000000..0595914ee7e --- /dev/null +++ b/queue-6.9/drm-mediatek-dp-fix-mtk_dp_aux_transfer-return-value.patch @@ -0,0 +1,43 @@ +From a6aaf4078c2e9cb21372e92ae2435ef7e68a0068 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 10:38:19 +0000 +Subject: drm/mediatek: dp: Fix mtk_dp_aux_transfer return value + +From: Wojciech Macek + +[ Upstream commit 8431fff9e0f3fc1c5844cf99a73b49b63ceed481 ] + +In case there is no DP device attached to the port the +transfer function should return IO error, similar to what +other drivers do. +In case EAGAIN is returned then any read from /dev/drm_dp_aux +device ends up in an infinite loop as the upper layers +constantly repeats the transfer request. + +Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver") +Signed-off-by: Wojciech Macek +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240417103819.990512-1-wmacek@chromium.org/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c +index 0ba72102636aa..536366956447a 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dp.c ++++ b/drivers/gpu/drm/mediatek/mtk_dp.c +@@ -2104,7 +2104,7 @@ static ssize_t mtk_dp_aux_transfer(struct drm_dp_aux *mtk_aux, + + if (mtk_dp->bridge.type != DRM_MODE_CONNECTOR_eDP && + !mtk_dp->train_info.cable_plugged_in) { +- ret = -EAGAIN; ++ ret = -EIO; + goto err; + } + +-- +2.43.0 + diff --git a/queue-6.9/drm-meson-gate-px_clk-when-setting-rate.patch b/queue-6.9/drm-meson-gate-px_clk-when-setting-rate.patch new file mode 100644 index 00000000000..d32743ac8f1 --- /dev/null +++ b/queue-6.9/drm-meson-gate-px_clk-when-setting-rate.patch @@ -0,0 +1,51 @@ +From e170816e09a8fbab83058787efa939ebb3d89560 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 09:46:35 +0200 +Subject: drm/meson: gate px_clk when setting rate + +From: Neil Armstrong + +[ Upstream commit 5c9837374ecf55a1fa3b7622d365a0456960270f ] + +Disable the px_clk when setting the rate to recover a fully +configured and correctly reset VCLK clock tree after the rate +is set. + +Fixes: 77d9e1e6b846 ("drm/meson: add support for MIPI-DSI transceiver") +Reviewed-by: Nicolas Belin +Link: https://lore.kernel.org/r/20240403-amlogic-v6-4-upstream-dsi-ccf-vim3-v12-4-99ecdfdc87fc@linaro.org +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240403-amlogic-v6-4-upstream-dsi-ccf-vim3-v12-4-99ecdfdc87fc@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_dw_mipi_dsi.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c b/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c +index a6bc1bdb3d0d8..a10cff3ca1fef 100644 +--- a/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c ++++ b/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c +@@ -95,6 +95,7 @@ static int dw_mipi_dsi_phy_init(void *priv_data) + return ret; + } + ++ clk_disable_unprepare(mipi_dsi->px_clk); + ret = clk_set_rate(mipi_dsi->px_clk, mipi_dsi->mode->clock * 1000); + + if (ret) { +@@ -103,6 +104,12 @@ static int dw_mipi_dsi_phy_init(void *priv_data) + return ret; + } + ++ ret = clk_prepare_enable(mipi_dsi->px_clk); ++ if (ret) { ++ dev_err(mipi_dsi->dev, "Failed to enable DSI Pixel clock (ret %d)\n", ret); ++ return ret; ++ } ++ + switch (mipi_dsi->dsi_device->format) { + case MIPI_DSI_FMT_RGB888: + dpi_data_format = DPI_COLOR_24BIT; +-- +2.43.0 + diff --git a/queue-6.9/drm-msm-a6xx-avoid-a-nullptr-dereference-when-speedb.patch b/queue-6.9/drm-msm-a6xx-avoid-a-nullptr-dereference-when-speedb.patch new file mode 100644 index 00000000000..e5dd98157e1 --- /dev/null +++ b/queue-6.9/drm-msm-a6xx-avoid-a-nullptr-dereference-when-speedb.patch @@ -0,0 +1,49 @@ +From e9c4c5241a6df810096f933eb223c731628f2d33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 10:53:25 +0200 +Subject: drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails + +From: Konrad Dybcio + +[ Upstream commit 46d4efcccc688cbacdd70a238bedca510acaa8e4 ] + +Calling a6xx_destroy() before adreno_gpu_init() leads to a null pointer +dereference on: + +msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL); + +as gpu->pdev is only assigned in: + +a6xx_gpu_init() +|_ adreno_gpu_init + |_ msm_gpu_init() + +Instead of relying on handwavy null checks down the cleanup chain, +explicitly de-allocate the LLC data and free a6xx_gpu instead. + +Fixes: 76efc2453d0e ("drm/msm/gpu: Fix crash during system suspend after unbind") +Signed-off-by: Konrad Dybcio +Patchwork: https://patchwork.freedesktop.org/patch/588919/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +index 441dfebb36386..7b72327df7f3f 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +@@ -3062,7 +3062,8 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev) + + ret = a6xx_set_supported_hw(&pdev->dev, config->info); + if (ret) { +- a6xx_destroy(&(a6xx_gpu->base.base)); ++ a6xx_llc_slices_destroy(a6xx_gpu); ++ kfree(a6xx_gpu); + return ERR_PTR(ret); + } + +-- +2.43.0 + diff --git a/queue-6.9/drm-msm-adreno-fix-cp-cycles-stat-retrieval-on-a7xx.patch b/queue-6.9/drm-msm-adreno-fix-cp-cycles-stat-retrieval-on-a7xx.patch new file mode 100644 index 00000000000..6f86c5d0251 --- /dev/null +++ b/queue-6.9/drm-msm-adreno-fix-cp-cycles-stat-retrieval-on-a7xx.patch @@ -0,0 +1,47 @@ +From f515b0742cbe9f36946ab53719dc7cc06bd0a7ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 14:57:00 +0200 +Subject: drm/msm/adreno: fix CP cycles stat retrieval on a7xx + +From: Zan Dobersek + +[ Upstream commit 328660262df89ab64031059909d763f7a8af9570 ] + +a7xx_submit() should use the a7xx variant of the RBBM_PERFCTR_CP register +for retrieving the CP cycles value before and after the submitted command +stream execution. + +Signed-off-by: Zan Dobersek +Fixes: af66706accdf ("drm/msm/a6xx: Add skeleton A7xx support") +Patchwork: https://patchwork.freedesktop.org/patch/588445/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +index cf0b1de1c0712..441dfebb36386 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +@@ -284,7 +284,7 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit) + + a6xx_set_pagetable(a6xx_gpu, ring, submit->queue->ctx); + +- get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP(0), ++ get_stats_counter(ring, REG_A7XX_RBBM_PERFCTR_CP(0), + rbmemptr_stats(ring, index, cpcycles_start)); + get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER, + rbmemptr_stats(ring, index, alwayson_start)); +@@ -330,7 +330,7 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit) + OUT_PKT7(ring, CP_SET_MARKER, 1); + OUT_RING(ring, 0x00e); /* IB1LIST end */ + +- get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP(0), ++ get_stats_counter(ring, REG_A7XX_RBBM_PERFCTR_CP(0), + rbmemptr_stats(ring, index, cpcycles_end)); + get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER, + rbmemptr_stats(ring, index, alwayson_end)); +-- +2.43.0 + diff --git a/queue-6.9/drm-msm-dpu-add-callback-function-pointer-check-befo.patch b/queue-6.9/drm-msm-dpu-add-callback-function-pointer-check-befo.patch new file mode 100644 index 00000000000..509dde207da --- /dev/null +++ b/queue-6.9/drm-msm-dpu-add-callback-function-pointer-check-befo.patch @@ -0,0 +1,46 @@ +From a2cc71e1d0194b83712d75b96d8650f6f7065c54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 11:55:23 +0300 +Subject: drm/msm/dpu: Add callback function pointer check before its call + +From: Aleksandr Mishin + +[ Upstream commit 530f272053a5e72243a9cb07bb1296af6c346002 ] + +In dpu_core_irq_callback_handler() callback function pointer is compared to NULL, +but then callback function is unconditionally called by this pointer. +Fix this bug by adding conditional return. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: c929ac60b3ed ("drm/msm/dpu: allow just single IRQ callback") +Signed-off-by: Aleksandr Mishin +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/588237/ +Link: https://lore.kernel.org/r/20240408085523.12231-1-amishin@t-argos.ru +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c +index 6a0a74832fb64..b85881aab0478 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c +@@ -223,9 +223,11 @@ static void dpu_core_irq_callback_handler(struct dpu_kms *dpu_kms, unsigned int + + VERB("IRQ=[%d, %d]\n", DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx)); + +- if (!irq_entry->cb) ++ if (!irq_entry->cb) { + DRM_ERROR("no registered cb, IRQ=[%d, %d]\n", + DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx)); ++ return; ++ } + + atomic_inc(&irq_entry->count); + +-- +2.43.0 + diff --git a/queue-6.9/drm-msm-dpu-allow-configuring-multiple-active-dsc-bl.patch b/queue-6.9/drm-msm-dpu-allow-configuring-multiple-active-dsc-bl.patch new file mode 100644 index 00000000000..258b5a2b0f3 --- /dev/null +++ b/queue-6.9/drm-msm-dpu-allow-configuring-multiple-active-dsc-bl.patch @@ -0,0 +1,83 @@ +From 34af238370dbf2754832003c9b868e24552c9c3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 01:57:44 +0200 +Subject: drm/msm/dpu: Allow configuring multiple active DSC blocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marijn Suijten + +[ Upstream commit ca97fa419dfe62a384fdea8b33553c4d6afe034e ] + +Just like the active interface and writeback block in ctl_intf_cfg_v1(), +and later the rest of the blocks in followup active-CTL fixes or +reworks, multiple calls to this function should enable additional DSC +blocks instead of overwriting the blocks that are enabled. + +This pattern is observed in an active-CTL scenario since DPU 5.0.0 where +for example bonded-DSI uses a single CTL to drive multiple INTFs, and +each encoder calls this function individually with the INTF (hence the +pre-existing update instead of overwrite of this bitmask) and DSC blocks +it wishes to be enabled, and expects them to be OR'd into the bitmask. + +The reverse already exists in reset_intf_cfg_v1() where only specified +DSC blocks are removed out of the CTL_DSC_ACTIVE bitmask (same for all +other blocks and ACTIVE bitmasks), leaving the rest enabled. + +Fixes: 77f6da90487c ("drm/msm/disp/dpu1: Add DSC support in hw_ctl") +Signed-off-by: Marijn Suijten +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/589902/ +Link: https://lore.kernel.org/r/20240417-drm-msm-initial-dualpipe-dsc-fixes-v1-4-78ae3ee9a697@somainline.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +index a06f69d0b257d..2e50049f2f850 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +@@ -545,6 +545,7 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx, + { + struct dpu_hw_blk_reg_map *c = &ctx->hw; + u32 intf_active = 0; ++ u32 dsc_active = 0; + u32 wb_active = 0; + u32 mode_sel = 0; + +@@ -560,6 +561,7 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx, + + intf_active = DPU_REG_READ(c, CTL_INTF_ACTIVE); + wb_active = DPU_REG_READ(c, CTL_WB_ACTIVE); ++ dsc_active = DPU_REG_READ(c, CTL_DSC_ACTIVE); + + if (cfg->intf) + intf_active |= BIT(cfg->intf - INTF_0); +@@ -567,17 +569,18 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx, + if (cfg->wb) + wb_active |= BIT(cfg->wb - WB_0); + ++ if (cfg->dsc) ++ dsc_active |= cfg->dsc; ++ + DPU_REG_WRITE(c, CTL_TOP, mode_sel); + DPU_REG_WRITE(c, CTL_INTF_ACTIVE, intf_active); + DPU_REG_WRITE(c, CTL_WB_ACTIVE, wb_active); ++ DPU_REG_WRITE(c, CTL_DSC_ACTIVE, dsc_active); + + if (cfg->merge_3d) + DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE, + BIT(cfg->merge_3d - MERGE_3D_0)); + +- if (cfg->dsc) +- DPU_REG_WRITE(c, CTL_DSC_ACTIVE, cfg->dsc); +- + if (cfg->cdm) + DPU_REG_WRITE(c, CTL_CDM_ACTIVE, cfg->cdm); + } +-- +2.43.0 + diff --git a/queue-6.9/drm-msm-dpu-always-flush-the-slave-intf-on-the-ctl.patch b/queue-6.9/drm-msm-dpu-always-flush-the-slave-intf-on-the-ctl.patch new file mode 100644 index 00000000000..6d251167ee7 --- /dev/null +++ b/queue-6.9/drm-msm-dpu-always-flush-the-slave-intf-on-the-ctl.patch @@ -0,0 +1,49 @@ +From 9994c310e0639c31b828a1901c14dbd044ef42c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 01:57:43 +0200 +Subject: drm/msm/dpu: Always flush the slave INTF on the CTL + +From: Marijn Suijten + +[ Upstream commit 2b938c3ab0a69ec6ea587bbf6fc2aec3db4a8736 ] + +As we can clearly see in a downstream kernel [1], flushing the slave INTF +is skipped /only if/ the PPSPLIT topology is active. + +However, when DPU was originally submitted to mainline PPSPLIT was no +longer part of it (seems to have been ripped out before submission), but +this clause was incorrectly ported from the original SDE driver. Given +that there is no support for PPSPLIT (currently), flushing the slave +INTF should /never/ be skipped (as the `if (ppsplit && !master) goto +skip;` clause downstream never becomes true). + +[1]: https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-drivers/-/blob/display-kernel.lnx.5.4.r1-rel/msm/sde/sde_encoder_phys_cmd.c?ref_type=heads#L1131-1139 + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Marijn Suijten +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/589901/ +Link: https://lore.kernel.org/r/20240417-drm-msm-initial-dualpipe-dsc-fixes-v1-3-78ae3ee9a697@somainline.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +index fc1d5736d7fcc..489be1c0c7046 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +@@ -448,9 +448,6 @@ static void dpu_encoder_phys_cmd_enable_helper( + + _dpu_encoder_phys_cmd_pingpong_config(phys_enc); + +- if (!dpu_encoder_phys_cmd_is_master(phys_enc)) +- return; +- + ctl = phys_enc->hw_ctl; + ctl->ops.update_pending_flush_intf(ctl, phys_enc->hw_intf->idx); + } +-- +2.43.0 + diff --git a/queue-6.9/drm-msm-dsi-print-dual-dsi-adjusted-pclk-instead-of-.patch b/queue-6.9/drm-msm-dsi-print-dual-dsi-adjusted-pclk-instead-of-.patch new file mode 100644 index 00000000000..0e34f5a4566 --- /dev/null +++ b/queue-6.9/drm-msm-dsi-print-dual-dsi-adjusted-pclk-instead-of-.patch @@ -0,0 +1,60 @@ +From 10f233478d75ec71bc6e6f52e5686211f77472ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 01:57:41 +0200 +Subject: drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode + pclk + +From: Marijn Suijten + +[ Upstream commit f12e0e12524a34bf145f7b80122e653ffe3d130a ] + +When dual-DSI (bonded DSI) was added in commit ed9976a09b48 +("drm/msm/dsi: adjust dsi timing for dual dsi mode") some DBG() prints +were not updated, leading to print the original mode->clock rather +than the adjusted (typically the mode clock divided by two, though more +recently also adjusted for DSC compression) msm_host->pixel_clk_rate +which is passed to clk_set_rate() just below. Fix that by printing the +actual pixel_clk_rate that is being set. + +Fixes: ed9976a09b48 ("drm/msm/dsi: adjust dsi timing for dual dsi mode") +Signed-off-by: Marijn Suijten +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/589896/ +Link: https://lore.kernel.org/r/20240417-drm-msm-initial-dualpipe-dsc-fixes-v1-1-78ae3ee9a697@somainline.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index 9d86a6aca6f2a..c80be74cf10b5 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -356,8 +356,8 @@ int dsi_link_clk_set_rate_6g(struct msm_dsi_host *msm_host) + { + int ret; + +- DBG("Set clk rates: pclk=%d, byteclk=%lu", +- msm_host->mode->clock, msm_host->byte_clk_rate); ++ DBG("Set clk rates: pclk=%lu, byteclk=%lu", ++ msm_host->pixel_clk_rate, msm_host->byte_clk_rate); + + ret = dev_pm_opp_set_rate(&msm_host->pdev->dev, + msm_host->byte_clk_rate); +@@ -430,9 +430,9 @@ int dsi_link_clk_set_rate_v2(struct msm_dsi_host *msm_host) + { + int ret; + +- DBG("Set clk rates: pclk=%d, byteclk=%lu, esc_clk=%lu, dsi_src_clk=%lu", +- msm_host->mode->clock, msm_host->byte_clk_rate, +- msm_host->esc_clk_rate, msm_host->src_clk_rate); ++ DBG("Set clk rates: pclk=%lu, byteclk=%lu, esc_clk=%lu, dsi_src_clk=%lu", ++ msm_host->pixel_clk_rate, msm_host->byte_clk_rate, ++ msm_host->esc_clk_rate, msm_host->src_clk_rate); + + ret = clk_set_rate(msm_host->byte_clk, msm_host->byte_clk_rate); + if (ret) { +-- +2.43.0 + diff --git a/queue-6.9/drm-nouveau-use-tile_mode-and-pte_kind-for-vm_bind-b.patch b/queue-6.9/drm-nouveau-use-tile_mode-and-pte_kind-for-vm_bind-b.patch new file mode 100644 index 00000000000..23e7d68a645 --- /dev/null +++ b/queue-6.9/drm-nouveau-use-tile_mode-and-pte_kind-for-vm_bind-b.patch @@ -0,0 +1,128 @@ +From 60ec8f132c5e23c789751d558fea423451bb01f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 23:43:52 +0300 +Subject: drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations + +From: Mohamed Ahmed + +[ Upstream commit 959314c438caf1b62d787f02d54a193efda38880 ] + +Allow PTE kind and tile mode on BO create with VM_BIND, and add a +GETPARAM to indicate this change. This is needed to support modifiers in +NVK and ensure correctness when dealing with the nouveau GL driver. + +The userspace modifiers implementation this is for can be found here: +https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/24795 + +Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") +Signed-off-by: Mohamed Ahmed +Reviewed-by: Faith Ekstrand +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240509204352.7597-1-mohamedahmedegypt2001@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_abi16.c | 3 ++ + drivers/gpu/drm/nouveau/nouveau_bo.c | 44 +++++++++++-------------- + include/uapi/drm/nouveau_drm.h | 7 ++++ + 3 files changed, 29 insertions(+), 25 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c +index 80f74ee0fc786..47e53e17b4e58 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c ++++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c +@@ -272,6 +272,9 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS) + getparam->value = (u64)ttm_resource_manager_usage(vram_mgr); + break; + } ++ case NOUVEAU_GETPARAM_HAS_VMA_TILEMODE: ++ getparam->value = 1; ++ break; + default: + NV_PRINTK(dbg, cli, "unknown parameter %lld\n", getparam->param); + return -EINVAL; +diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c +index db8cbf6151129..186add400ea5f 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -241,28 +241,28 @@ nouveau_bo_alloc(struct nouveau_cli *cli, u64 *size, int *align, u32 domain, + } + + nvbo->contig = !(tile_flags & NOUVEAU_GEM_TILE_NONCONTIG); +- if (!nouveau_cli_uvmm(cli) || internal) { +- /* for BO noVM allocs, don't assign kinds */ +- if (cli->device.info.family >= NV_DEVICE_INFO_V0_FERMI) { +- nvbo->kind = (tile_flags & 0x0000ff00) >> 8; +- if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) { +- kfree(nvbo); +- return ERR_PTR(-EINVAL); +- } + +- nvbo->comp = mmu->kind[nvbo->kind] != nvbo->kind; +- } else if (cli->device.info.family >= NV_DEVICE_INFO_V0_TESLA) { +- nvbo->kind = (tile_flags & 0x00007f00) >> 8; +- nvbo->comp = (tile_flags & 0x00030000) >> 16; +- if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) { +- kfree(nvbo); +- return ERR_PTR(-EINVAL); +- } +- } else { +- nvbo->zeta = (tile_flags & 0x00000007); ++ if (cli->device.info.family >= NV_DEVICE_INFO_V0_FERMI) { ++ nvbo->kind = (tile_flags & 0x0000ff00) >> 8; ++ if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) { ++ kfree(nvbo); ++ return ERR_PTR(-EINVAL); ++ } ++ ++ nvbo->comp = mmu->kind[nvbo->kind] != nvbo->kind; ++ } else if (cli->device.info.family >= NV_DEVICE_INFO_V0_TESLA) { ++ nvbo->kind = (tile_flags & 0x00007f00) >> 8; ++ nvbo->comp = (tile_flags & 0x00030000) >> 16; ++ if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) { ++ kfree(nvbo); ++ return ERR_PTR(-EINVAL); + } +- nvbo->mode = tile_mode; ++ } else { ++ nvbo->zeta = (tile_flags & 0x00000007); ++ } ++ nvbo->mode = tile_mode; + ++ if (!nouveau_cli_uvmm(cli) || internal) { + /* Determine the desirable target GPU page size for the buffer. */ + for (i = 0; i < vmm->page_nr; i++) { + /* Because we cannot currently allow VMM maps to fail +@@ -304,12 +304,6 @@ nouveau_bo_alloc(struct nouveau_cli *cli, u64 *size, int *align, u32 domain, + } + nvbo->page = vmm->page[pi].shift; + } else { +- /* reject other tile flags when in VM mode. */ +- if (tile_mode) +- return ERR_PTR(-EINVAL); +- if (tile_flags & ~NOUVEAU_GEM_TILE_NONCONTIG) +- return ERR_PTR(-EINVAL); +- + /* Determine the desirable target GPU page size for the buffer. */ + for (i = 0; i < vmm->page_nr; i++) { + /* Because we cannot currently allow VMM maps to fail +diff --git a/include/uapi/drm/nouveau_drm.h b/include/uapi/drm/nouveau_drm.h +index cd84227f1b42f..5402f77ee8594 100644 +--- a/include/uapi/drm/nouveau_drm.h ++++ b/include/uapi/drm/nouveau_drm.h +@@ -68,6 +68,13 @@ extern "C" { + */ + #define NOUVEAU_GETPARAM_VRAM_USED 19 + ++/* ++ * NOUVEAU_GETPARAM_HAS_VMA_TILEMODE ++ * ++ * Query whether tile mode and PTE kind are accepted with VM allocs or not. ++ */ ++#define NOUVEAU_GETPARAM_HAS_VMA_TILEMODE 20 ++ + struct drm_nouveau_getparam { + __u64 param; + __u64 value; +-- +2.43.0 + diff --git a/queue-6.9/drm-zynqmp_dpsub-always-register-bridge.patch b/queue-6.9/drm-zynqmp_dpsub-always-register-bridge.patch new file mode 100644 index 00000000000..35583c4a680 --- /dev/null +++ b/queue-6.9/drm-zynqmp_dpsub-always-register-bridge.patch @@ -0,0 +1,97 @@ +From d6817dc61b3b6a1e4f098b25109e7f2ecaaf0ee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 15:47:41 -0500 +Subject: drm: zynqmp_dpsub: Always register bridge + +From: Sean Anderson + +[ Upstream commit be3f3042391d061cfca2bd22630e0d101acea5fc ] + +We must always register the DRM bridge, since zynqmp_dp_hpd_work_func +calls drm_bridge_hpd_notify, which in turn expects hpd_mutex to be +initialized. We do this before zynqmp_dpsub_drm_init since that calls +drm_bridge_attach. This fixes the following lockdep warning: + +[ 19.217084] ------------[ cut here ]------------ +[ 19.227530] DEBUG_LOCKS_WARN_ON(lock->magic != lock) +[ 19.227768] WARNING: CPU: 0 PID: 140 at kernel/locking/mutex.c:582 __mutex_lock+0x4bc/0x550 +[ 19.241696] Modules linked in: +[ 19.244937] CPU: 0 PID: 140 Comm: kworker/0:4 Not tainted 6.6.20+ #96 +[ 19.252046] Hardware name: xlnx,zynqmp (DT) +[ 19.256421] Workqueue: events zynqmp_dp_hpd_work_func +[ 19.261795] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 19.269104] pc : __mutex_lock+0x4bc/0x550 +[ 19.273364] lr : __mutex_lock+0x4bc/0x550 +[ 19.277592] sp : ffffffc085c5bbe0 +[ 19.281066] x29: ffffffc085c5bbe0 x28: 0000000000000000 x27: ffffff88009417f8 +[ 19.288624] x26: ffffff8800941788 x25: ffffff8800020008 x24: ffffffc082aa3000 +[ 19.296227] x23: ffffffc080d90e3c x22: 0000000000000002 x21: 0000000000000000 +[ 19.303744] x20: 0000000000000000 x19: ffffff88002f5210 x18: 0000000000000000 +[ 19.311295] x17: 6c707369642e3030 x16: 3030613464662072 x15: 0720072007200720 +[ 19.318922] x14: 0000000000000000 x13: 284e4f5f4e524157 x12: 0000000000000001 +[ 19.326442] x11: 0001ffc085c5b940 x10: 0001ff88003f388b x9 : 0001ff88003f3888 +[ 19.334003] x8 : 0001ff88003f3888 x7 : 0000000000000000 x6 : 0000000000000000 +[ 19.341537] x5 : 0000000000000000 x4 : 0000000000001668 x3 : 0000000000000000 +[ 19.349054] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff88003f3880 +[ 19.356581] Call trace: +[ 19.359160] __mutex_lock+0x4bc/0x550 +[ 19.363032] mutex_lock_nested+0x24/0x30 +[ 19.367187] drm_bridge_hpd_notify+0x2c/0x6c +[ 19.371698] zynqmp_dp_hpd_work_func+0x44/0x54 +[ 19.376364] process_one_work+0x3ac/0x988 +[ 19.380660] worker_thread+0x398/0x694 +[ 19.384736] kthread+0x1bc/0x1c0 +[ 19.388241] ret_from_fork+0x10/0x20 +[ 19.392031] irq event stamp: 183 +[ 19.395450] hardirqs last enabled at (183): [] finish_task_switch.isra.0+0xa8/0x2d4 +[ 19.405140] hardirqs last disabled at (182): [] __schedule+0x714/0xd04 +[ 19.413612] softirqs last enabled at (114): [] srcu_invoke_callbacks+0x158/0x23c +[ 19.423128] softirqs last disabled at (110): [] srcu_invoke_callbacks+0x158/0x23c +[ 19.432614] ---[ end trace 0000000000000000 ]--- + +Fixes: eb2d64bfcc17 ("drm: xlnx: zynqmp_dpsub: Report HPD through the bridge") +Signed-off-by: Sean Anderson +Reviewed-by: Laurent Pinchart +Reviewed-by: Tomi Valkeinen +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20240308204741.3631919-1-sean.anderson@linux.dev +(cherry picked from commit 61ba791c4a7a09a370c45b70a81b8c7d4cf6b2ae) +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +index 88eb33acd5f0d..face8d6b2a6fb 100644 +--- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c ++++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +@@ -256,12 +256,12 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev) + if (ret) + goto err_dp; + ++ drm_bridge_add(dpsub->bridge); ++ + if (dpsub->dma_enabled) { + ret = zynqmp_dpsub_drm_init(dpsub); + if (ret) + goto err_disp; +- } else { +- drm_bridge_add(dpsub->bridge); + } + + dev_info(&pdev->dev, "ZynqMP DisplayPort Subsystem driver probed"); +@@ -288,9 +288,8 @@ static void zynqmp_dpsub_remove(struct platform_device *pdev) + + if (dpsub->drm) + zynqmp_dpsub_drm_cleanup(dpsub); +- else +- drm_bridge_remove(dpsub->bridge); + ++ drm_bridge_remove(dpsub->bridge); + zynqmp_disp_remove(dpsub); + zynqmp_dp_remove(dpsub); + +-- +2.43.0 + diff --git a/queue-6.9/fs-ntfs3-check-folio-pointer-for-null.patch b/queue-6.9/fs-ntfs3-check-folio-pointer-for-null.patch new file mode 100644 index 00000000000..01c18fc5033 --- /dev/null +++ b/queue-6.9/fs-ntfs3-check-folio-pointer-for-null.patch @@ -0,0 +1,50 @@ +From 1f76d6d2d2ece612c75ce8e90d7a15b1c56b6fde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 09:54:34 +0300 +Subject: fs/ntfs3: Check 'folio' pointer for NULL + +From: Konstantin Komarov + +[ Upstream commit 1cd6c96219c429ebcfa8e79a865277376c563803 ] + +It can be NULL if bmap is called. + +Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/inode.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index ba5a39a2f957d..90d4e9a9859e4 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -577,13 +577,18 @@ static noinline int ntfs_get_block_vbo(struct inode *inode, u64 vbo, + clear_buffer_uptodate(bh); + + if (is_resident(ni)) { +- ni_lock(ni); +- err = attr_data_read_resident(ni, &folio->page); +- ni_unlock(ni); +- +- if (!err) +- set_buffer_uptodate(bh); ++ bh->b_blocknr = RESIDENT_LCN; + bh->b_size = block_size; ++ if (!folio) { ++ err = 0; ++ } else { ++ ni_lock(ni); ++ err = attr_data_read_resident(ni, &folio->page); ++ ni_unlock(ni); ++ ++ if (!err) ++ set_buffer_uptodate(bh); ++ } + return err; + } + +-- +2.43.0 + diff --git a/queue-6.9/fs-ntfs3-use-64-bit-variable-to-avoid-32-bit-overflo.patch b/queue-6.9/fs-ntfs3-use-64-bit-variable-to-avoid-32-bit-overflo.patch new file mode 100644 index 00000000000..c72c6123c2b --- /dev/null +++ b/queue-6.9/fs-ntfs3-use-64-bit-variable-to-avoid-32-bit-overflo.patch @@ -0,0 +1,36 @@ +From 8803e3950264583e5b724736038648a8aedfe1ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 09:45:09 +0300 +Subject: fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow + +From: Konstantin Komarov + +[ Upstream commit e931f6b630ffb22d66caab202a52aa8cbb10c649 ] + +For example, in the expression: + vbo = 2 * vbo + skip + +Fixes: b46acd6a6a627 ("fs/ntfs3: Add NTFS journal") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 855519713bf79..4085fe30bf481 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -1184,7 +1184,8 @@ static int read_log_page(struct ntfs_log *log, u32 vbo, + static int log_read_rst(struct ntfs_log *log, bool first, + struct restart_info *info) + { +- u32 skip, vbo; ++ u32 skip; ++ u64 vbo; + struct RESTART_HDR *r_page = NULL; + + /* Determine which restart area we are looking for. */ +-- +2.43.0 + diff --git a/queue-6.9/fs-ntfs3-use-variable-length-array-instead-of-fixed-.patch b/queue-6.9/fs-ntfs3-use-variable-length-array-instead-of-fixed-.patch new file mode 100644 index 00000000000..03e60da2ddd --- /dev/null +++ b/queue-6.9/fs-ntfs3-use-variable-length-array-instead-of-fixed-.patch @@ -0,0 +1,38 @@ +From 2d75630d4d5c4099b5242fd80c6404a957b62824 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 09:43:58 +0300 +Subject: fs/ntfs3: Use variable length array instead of fixed size + +From: Konstantin Komarov + +[ Upstream commit 1997cdc3e727526aa5d84b32f7cbb3f56459b7ef ] + +Should fix smatch warning: + ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256) + +Fixes: 4534a70b7056f ("fs/ntfs3: Add headers and misc files") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202401091421.3RJ24Mn3-lkp@intel.com/ +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/ntfs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h +index 9c7478150a035..3d6143c7abc03 100644 +--- a/fs/ntfs3/ntfs.h ++++ b/fs/ntfs3/ntfs.h +@@ -59,7 +59,7 @@ struct GUID { + struct cpu_str { + u8 len; + u8 unused; +- u16 name[10]; ++ u16 name[]; + }; + + struct le_str { +-- +2.43.0 + diff --git a/queue-6.9/i3c-master-svc-change-enxio-to-eagain-when-ibi-occur.patch b/queue-6.9/i3c-master-svc-change-enxio-to-eagain-when-ibi-occur.patch new file mode 100644 index 00000000000..d75c593a750 --- /dev/null +++ b/queue-6.9/i3c-master-svc-change-enxio-to-eagain-when-ibi-occur.patch @@ -0,0 +1,42 @@ +From e8179c548167c3b1dc8d32a3a2254407d41759ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 12:40:08 -0400 +Subject: i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start + frame + +From: Frank Li + +[ Upstream commit 7f3d633b460be5553a65a247def5426d16805e72 ] + +svc_i3c_master_xfer() returns error ENXIO if an In-Band Interrupt (IBI) +occurs when the host starts the frame. + +Change error code to EAGAIN to inform the client driver that this +situation has occurred and to try again sometime later. + +Fixes: 5e5e3c92e748 ("i3c: master: svc: fix wrong data return when IBI happen during start frame") +Signed-off-by: Frank Li +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/r/20240506164009.21375-2-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 5ee4db68988e2..a2298ab460a37 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -1080,7 +1080,7 @@ static int svc_i3c_master_xfer(struct svc_i3c_master *master, + * and yield the above events handler. + */ + if (SVC_I3C_MSTATUS_IBIWON(reg)) { +- ret = -ENXIO; ++ ret = -EAGAIN; + *actual_len = 0; + goto emit_stop; + } +-- +2.43.0 + diff --git a/queue-6.9/ice-interpret-.set_channels-input-differently.patch b/queue-6.9/ice-interpret-.set_channels-input-differently.patch new file mode 100644 index 00000000000..215a368470e --- /dev/null +++ b/queue-6.9/ice-interpret-.set_channels-input-differently.patch @@ -0,0 +1,90 @@ +From 3649c0398131430be99b7ed070c84a376d5790fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 12:39:53 -0700 +Subject: ice: Interpret .set_channels() input differently + +From: Larysa Zaremba + +[ Upstream commit 05d6f442f31f901d27dbc64fd504a8ec7d5013de ] + +A bug occurs because a safety check guarding AF_XDP-related queues in +ethnl_set_channels(), does not trigger. This happens, because kernel and +ice driver interpret the ethtool command differently. + +How the bug occurs: +1. ethtool -l -> combined: 40 +2. Attach AF_XDP to queue 30 +3. ethtool -L rx 15 tx 15 + combined number is not specified, so command becomes {rx_count = 15, + tx_count = 15, combined_count = 40}. +4. ethnl_set_channels checks, if there are any AF_XDP of queues from the + new (combined_count + rx_count) to the old one, so from 55 to 40, check + does not trigger. +5. ice interprets `rx 15 tx 15` as 15 combined channels and deletes the + queue that AF_XDP is attached to. + +Interpret the command in a way that is more consistent with ethtool +manual [0] (--show-channels and --set-channels). + +Considering that in the ice driver only the difference between RX and TX +queues forms dedicated channels, change the correct way to set number of +channels to: + +ethtool -L combined 10 /* For symmetric queues */ +ethtool -L combined 8 tx 2 rx 0 /* For asymmetric queues */ + +[0] https://man7.org/linux/man-pages/man8/ethtool.8.html + +Fixes: 87324e747fde ("ice: Implement ethtool ops for channels") +Reviewed-by: Michal Swiatkowski +Signed-off-by: Larysa Zaremba +Tested-by: Chandan Kumar Rout +Tested-by: Pucha Himasekhar Reddy +Acked-by: Maciej Fijalkowski +Signed-off-by: Jacob Keller +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ethtool.c | 19 ++----------------- + 1 file changed, 2 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index 78b833b3e1d7e..62c8205fcebae 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -3593,7 +3593,6 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch) + struct ice_pf *pf = vsi->back; + int new_rx = 0, new_tx = 0; + bool locked = false; +- u32 curr_combined; + int ret = 0; + + /* do not support changing channels in Safe Mode */ +@@ -3615,22 +3614,8 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch) + return -EOPNOTSUPP; + } + +- curr_combined = ice_get_combined_cnt(vsi); +- +- /* these checks are for cases where user didn't specify a particular +- * value on cmd line but we get non-zero value anyway via +- * get_channels(); look at ethtool.c in ethtool repository (the user +- * space part), particularly, do_schannels() routine +- */ +- if (ch->rx_count == vsi->num_rxq - curr_combined) +- ch->rx_count = 0; +- if (ch->tx_count == vsi->num_txq - curr_combined) +- ch->tx_count = 0; +- if (ch->combined_count == curr_combined) +- ch->combined_count = 0; +- +- if (!(ch->combined_count || (ch->rx_count && ch->tx_count))) { +- netdev_err(dev, "Please specify at least 1 Rx and 1 Tx channel\n"); ++ if (ch->rx_count && ch->tx_count) { ++ netdev_err(dev, "Dedicated RX or TX channels cannot be used simultaneously\n"); + return -EINVAL; + } + +-- +2.43.0 + diff --git a/queue-6.9/idpf-interpret-.set_channels-input-differently.patch b/queue-6.9/idpf-interpret-.set_channels-input-differently.patch new file mode 100644 index 00000000000..b0786dde413 --- /dev/null +++ b/queue-6.9/idpf-interpret-.set_channels-input-differently.patch @@ -0,0 +1,106 @@ +From b604219c8401ed394f79ec500c17d4b1119cdab4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 12:39:54 -0700 +Subject: idpf: Interpret .set_channels() input differently + +From: Larysa Zaremba + +[ Upstream commit 5e7695e0219bf6acb96081af3ba0ca08b1829656 ] + +Unlike ice, idpf does not check, if user has requested at least 1 combined +channel. Instead, it relies on a check in the core code. Unfortunately, the +check does not trigger for us because of the hacky .set_channels() +interpretation logic that is not consistent with the core code. + +This naturally leads to user being able to trigger a crash with an invalid +input. This is how: + +1. ethtool -l -> combined: 40 +2. ethtool -L rx 0 tx 0 + combined number is not specified, so command becomes {rx_count = 0, + tx_count = 0, combined_count = 40}. +3. ethnl_set_channels checks, if there is at least 1 RX and 1 TX channel, + comparing (combined_count + rx_count) and (combined_count + tx_count) + to zero. Obviously, (40 + 0) is greater than zero, so the core code + deems the input OK. +4. idpf interprets `rx 0 tx 0` as 0 channels and tries to proceed with such + configuration. + +The issue has to be solved fundamentally, as current logic is also known to +cause AF_XDP problems in ice [0]. + +Interpret the command in a way that is more consistent with ethtool +manual [1] (--show-channels and --set-channels) and new ice logic. + +Considering that in the idpf driver only the difference between RX and TX +queues forms dedicated channels, change the correct way to set number of +channels to: + +ethtool -L combined 10 /* For symmetric queues */ +ethtool -L combined 8 tx 2 rx 0 /* For asymmetric queues */ + +[0] https://lore.kernel.org/netdev/20240418095857.2827-1-larysa.zaremba@intel.com/ +[1] https://man7.org/linux/man-pages/man8/ethtool.8.html + +Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks") +Reviewed-by: Przemek Kitszel +Reviewed-by: Igor Bagnucki +Signed-off-by: Larysa Zaremba +Tested-by: Krishneil Singh +Reviewed-by: Simon Horman +Signed-off-by: Jacob Keller +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/idpf/idpf_ethtool.c | 21 ++++++------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c +index 6972d728431cb..1885ba618981d 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c +@@ -222,14 +222,19 @@ static int idpf_set_channels(struct net_device *netdev, + struct ethtool_channels *ch) + { + struct idpf_vport_config *vport_config; +- u16 combined, num_txq, num_rxq; + unsigned int num_req_tx_q; + unsigned int num_req_rx_q; + struct idpf_vport *vport; ++ u16 num_txq, num_rxq; + struct device *dev; + int err = 0; + u16 idx; + ++ if (ch->rx_count && ch->tx_count) { ++ netdev_err(netdev, "Dedicated RX or TX channels cannot be used simultaneously\n"); ++ return -EINVAL; ++ } ++ + idpf_vport_ctrl_lock(netdev); + vport = idpf_netdev_to_vport(netdev); + +@@ -239,20 +244,6 @@ static int idpf_set_channels(struct net_device *netdev, + num_txq = vport_config->user_config.num_req_tx_qs; + num_rxq = vport_config->user_config.num_req_rx_qs; + +- combined = min(num_txq, num_rxq); +- +- /* these checks are for cases where user didn't specify a particular +- * value on cmd line but we get non-zero value anyway via +- * get_channels(); look at ethtool.c in ethtool repository (the user +- * space part), particularly, do_schannels() routine +- */ +- if (ch->combined_count == combined) +- ch->combined_count = 0; +- if (ch->combined_count && ch->rx_count == num_rxq - combined) +- ch->rx_count = 0; +- if (ch->combined_count && ch->tx_count == num_txq - combined) +- ch->tx_count = 0; +- + num_req_tx_q = ch->combined_count + ch->tx_count; + num_req_rx_q = ch->combined_count + ch->rx_count; + +-- +2.43.0 + diff --git a/queue-6.9/input-cyapa-add-missing-input-core-locking-to-suspen.patch b/queue-6.9/input-cyapa-add-missing-input-core-locking-to-suspen.patch new file mode 100644 index 00000000000..498c0100144 --- /dev/null +++ b/queue-6.9/input-cyapa-add-missing-input-core-locking-to-suspen.patch @@ -0,0 +1,126 @@ +From ea9ea060dfa9b8d4bf5e79a6a1933a0d69760eb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2023 14:10:18 +0200 +Subject: Input: cyapa - add missing input core locking to suspend/resume + functions + +From: Marek Szyprowski + +[ Upstream commit 7b4e0b39182cf5e677c1fc092a3ec40e621c25b6 ] + +Grab input->mutex during suspend/resume functions like it is done in +other input drivers. This fixes the following warning during system +suspend/resume cycle on Samsung Exynos5250-based Snow Chromebook: + +------------[ cut here ]------------ +WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c +Modules linked in: ... +CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109 +Hardware name: Samsung Exynos (Flattened Device Tree) +Workqueue: events_unbound async_run_entry_fn + unwind_backtrace from show_stack+0x10/0x14 + show_stack from dump_stack_lvl+0x58/0x70 + dump_stack_lvl from __warn+0x1a8/0x1cc + __warn from warn_slowpath_fmt+0x18c/0x1b4 + warn_slowpath_fmt from input_device_enabled+0x68/0x6c + input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc + cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c + cyapa_reinitialize from cyapa_resume+0x48/0x98 + cyapa_resume from dpm_run_callback+0x90/0x298 + dpm_run_callback from device_resume+0xb4/0x258 + device_resume from async_resume+0x20/0x64 + async_resume from async_run_entry_fn+0x40/0x15c + async_run_entry_fn from process_scheduled_works+0xbc/0x6a8 + process_scheduled_works from worker_thread+0x188/0x454 + worker_thread from kthread+0x108/0x140 + kthread from ret_from_fork+0x14/0x28 +Exception stack(0xf1625fb0 to 0xf1625ff8) +... +---[ end trace 0000000000000000 ]--- +... +------------[ cut here ]------------ +WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c +Modules linked in: ... +CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109 +Hardware name: Samsung Exynos (Flattened Device Tree) +Workqueue: events_unbound async_run_entry_fn + unwind_backtrace from show_stack+0x10/0x14 + show_stack from dump_stack_lvl+0x58/0x70 + dump_stack_lvl from __warn+0x1a8/0x1cc + __warn from warn_slowpath_fmt+0x18c/0x1b4 + warn_slowpath_fmt from input_device_enabled+0x68/0x6c + input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc + cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c + cyapa_reinitialize from cyapa_resume+0x48/0x98 + cyapa_resume from dpm_run_callback+0x90/0x298 + dpm_run_callback from device_resume+0xb4/0x258 + device_resume from async_resume+0x20/0x64 + async_resume from async_run_entry_fn+0x40/0x15c + async_run_entry_fn from process_scheduled_works+0xbc/0x6a8 + process_scheduled_works from worker_thread+0x188/0x454 + worker_thread from kthread+0x108/0x140 + kthread from ret_from_fork+0x14/0x28 +Exception stack(0xf1625fb0 to 0xf1625ff8) +... +---[ end trace 0000000000000000 ]--- + +Fixes: d69f0a43c677 ("Input: use input_device_enabled()") +Signed-off-by: Marek Szyprowski +Reviewed-by: Andrzej Pietrasiewicz +Link: https://lore.kernel.org/r/20231009121018.1075318-1-m.szyprowski@samsung.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/cyapa.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/mouse/cyapa.c b/drivers/input/mouse/cyapa.c +index 5979deabe23d1..256f757a13267 100644 +--- a/drivers/input/mouse/cyapa.c ++++ b/drivers/input/mouse/cyapa.c +@@ -1347,10 +1347,16 @@ static int cyapa_suspend(struct device *dev) + u8 power_mode; + int error; + +- error = mutex_lock_interruptible(&cyapa->state_sync_lock); ++ error = mutex_lock_interruptible(&cyapa->input->mutex); + if (error) + return error; + ++ error = mutex_lock_interruptible(&cyapa->state_sync_lock); ++ if (error) { ++ mutex_unlock(&cyapa->input->mutex); ++ return error; ++ } ++ + /* + * Runtime PM is enable only when device is in operational mode and + * users in use, so need check it before disable it to +@@ -1385,6 +1391,8 @@ static int cyapa_suspend(struct device *dev) + cyapa->irq_wake = (enable_irq_wake(client->irq) == 0); + + mutex_unlock(&cyapa->state_sync_lock); ++ mutex_unlock(&cyapa->input->mutex); ++ + return 0; + } + +@@ -1394,6 +1402,7 @@ static int cyapa_resume(struct device *dev) + struct cyapa *cyapa = i2c_get_clientdata(client); + int error; + ++ mutex_lock(&cyapa->input->mutex); + mutex_lock(&cyapa->state_sync_lock); + + if (device_may_wakeup(dev) && cyapa->irq_wake) { +@@ -1412,6 +1421,7 @@ static int cyapa_resume(struct device *dev) + enable_irq(client->irq); + + mutex_unlock(&cyapa->state_sync_lock); ++ mutex_unlock(&cyapa->input->mutex); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.9/input-ims-pcu-fix-printf-string-overflow.patch b/queue-6.9/input-ims-pcu-fix-printf-string-overflow.patch new file mode 100644 index 00000000000..c20d643e377 --- /dev/null +++ b/queue-6.9/input-ims-pcu-fix-printf-string-overflow.patch @@ -0,0 +1,43 @@ +From 22b19cf206f4fa7b5cd61e855aec544f589139f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 13:28:56 -0700 +Subject: Input: ims-pcu - fix printf string overflow + +From: Arnd Bergmann + +[ Upstream commit bf32bceedd0453c70d9d022e2e29f98e446d7161 ] + +clang warns about a string overflow in this driver + +drivers/input/misc/ims-pcu.c:1802:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation] +drivers/input/misc/ims-pcu.c:1814:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation] + +Make the buffer a little longer to ensure it always fits. + +Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240326223825.4084412-7-arnd@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/ims-pcu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c +index 6e8cc28debd97..80d16c92a08b3 100644 +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -42,8 +42,8 @@ struct ims_pcu_backlight { + #define IMS_PCU_PART_NUMBER_LEN 15 + #define IMS_PCU_SERIAL_NUMBER_LEN 8 + #define IMS_PCU_DOM_LEN 8 +-#define IMS_PCU_FW_VERSION_LEN (9 + 1) +-#define IMS_PCU_BL_VERSION_LEN (9 + 1) ++#define IMS_PCU_FW_VERSION_LEN 16 ++#define IMS_PCU_BL_VERSION_LEN 16 + #define IMS_PCU_BL_RESET_REASON_LEN (2 + 1) + + #define IMS_PCU_PCU_B_DEVICE_ID 5 +-- +2.43.0 + diff --git a/queue-6.9/input-ioc3kbd-add-device-table.patch b/queue-6.9/input-ioc3kbd-add-device-table.patch new file mode 100644 index 00000000000..a3000375dee --- /dev/null +++ b/queue-6.9/input-ioc3kbd-add-device-table.patch @@ -0,0 +1,45 @@ +From 82350f77d502ec4bf727d52133c1db36cde011e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 12:46:14 -0700 +Subject: Input: ioc3kbd - add device table + +From: Karel Balej + +[ Upstream commit d40e9edcf3eb925c259df9f9dd7319a4fcbc675b ] + +Without the device table the driver will not auto-load when compiled as +a module. + +Fixes: 273db8f03509 ("Input: add IOC3 serio driver") +Signed-off-by: Karel Balej +Link: https://lore.kernel.org/r/20240313115832.8052-1-balejk@matfyz.cz +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/ioc3kbd.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/input/serio/ioc3kbd.c b/drivers/input/serio/ioc3kbd.c +index 50552dc7b4f5e..676b0bda3d720 100644 +--- a/drivers/input/serio/ioc3kbd.c ++++ b/drivers/input/serio/ioc3kbd.c +@@ -200,9 +200,16 @@ static void ioc3kbd_remove(struct platform_device *pdev) + serio_unregister_port(d->aux); + } + ++static const struct platform_device_id ioc3kbd_id_table[] = { ++ { "ioc3-kbd", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(platform, ioc3kbd_id_table); ++ + static struct platform_driver ioc3kbd_driver = { + .probe = ioc3kbd_probe, + .remove_new = ioc3kbd_remove, ++ .id_table = ioc3kbd_id_table, + .driver = { + .name = "ioc3-kbd", + }, +-- +2.43.0 + diff --git a/queue-6.9/input-pm8xxx-vibrator-correct-vib_max_levels-calcula.patch b/queue-6.9/input-pm8xxx-vibrator-correct-vib_max_levels-calcula.patch new file mode 100644 index 00000000000..9cd3f68c058 --- /dev/null +++ b/queue-6.9/input-pm8xxx-vibrator-correct-vib_max_levels-calcula.patch @@ -0,0 +1,55 @@ +From 650fe296b8ad0f12855e5ab4fd4e7c9afd3ef27a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 16:03:40 -0700 +Subject: Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation + +From: Fenglin Wu + +[ Upstream commit 48c0687a322d54ac7e7a685c0b6db78d78f593af ] + +The output voltage is inclusive hence the max level calculation is +off-by-one-step. Correct it. + +iWhile we are at it also add a define for the step size instead of +using the magic value. + +Fixes: 11205bb63e5c ("Input: add support for pm8xxx based vibrator driver") +Signed-off-by: Fenglin Wu +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240412-pm8xxx-vibrator-new-design-v10-1-0ec0ad133866@quicinc.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/pm8xxx-vibrator.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/input/misc/pm8xxx-vibrator.c b/drivers/input/misc/pm8xxx-vibrator.c +index 5c288fe7accf1..79f478d3a9b37 100644 +--- a/drivers/input/misc/pm8xxx-vibrator.c ++++ b/drivers/input/misc/pm8xxx-vibrator.c +@@ -13,7 +13,8 @@ + + #define VIB_MAX_LEVEL_mV (3100) + #define VIB_MIN_LEVEL_mV (1200) +-#define VIB_MAX_LEVELS (VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV) ++#define VIB_PER_STEP_mV (100) ++#define VIB_MAX_LEVELS (VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV + VIB_PER_STEP_mV) + + #define MAX_FF_SPEED 0xff + +@@ -117,10 +118,10 @@ static void pm8xxx_work_handler(struct work_struct *work) + vib->active = true; + vib->level = ((VIB_MAX_LEVELS * vib->speed) / MAX_FF_SPEED) + + VIB_MIN_LEVEL_mV; +- vib->level /= 100; ++ vib->level /= VIB_PER_STEP_mV; + } else { + vib->active = false; +- vib->level = VIB_MIN_LEVEL_mV / 100; ++ vib->level = VIB_MIN_LEVEL_mV / VIB_PER_STEP_mV; + } + + pm8xxx_vib_set(vib, vib->active); +-- +2.43.0 + diff --git a/queue-6.9/ipv6-sr-fix-memleak-in-seg6_hmac_init_algo.patch b/queue-6.9/ipv6-sr-fix-memleak-in-seg6_hmac_init_algo.patch new file mode 100644 index 00000000000..d207afe2f34 --- /dev/null +++ b/queue-6.9/ipv6-sr-fix-memleak-in-seg6_hmac_init_algo.patch @@ -0,0 +1,125 @@ +From 20bc565bc9964e7be35d8eb077790a2bd4668f05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 08:54:35 +0800 +Subject: ipv6: sr: fix memleak in seg6_hmac_init_algo + +From: Hangbin Liu + +[ Upstream commit efb9f4f19f8e37fde43dfecebc80292d179f56c6 ] + +seg6_hmac_init_algo returns without cleaning up the previous allocations +if one fails, so it's going to leak all that memory and the crypto tfms. + +Update seg6_hmac_exit to only free the memory when allocated, so we can +reuse the code directly. + +Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") +Reported-by: Sabrina Dubroca +Closes: https://lore.kernel.org/netdev/Zj3bh-gE7eT6V6aH@hog/ +Signed-off-by: Hangbin Liu +Reviewed-by: Simon Horman +Reviewed-by: Sabrina Dubroca +Link: https://lore.kernel.org/r/20240517005435.2600277-1-liuhangbin@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6_hmac.c | 42 ++++++++++++++++++++++++++++-------------- + 1 file changed, 28 insertions(+), 14 deletions(-) + +diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c +index 861e0366f549d..bbf5b84a70fca 100644 +--- a/net/ipv6/seg6_hmac.c ++++ b/net/ipv6/seg6_hmac.c +@@ -356,6 +356,7 @@ static int seg6_hmac_init_algo(void) + struct crypto_shash *tfm; + struct shash_desc *shash; + int i, alg_count, cpu; ++ int ret = -ENOMEM; + + alg_count = ARRAY_SIZE(hmac_algos); + +@@ -366,12 +367,14 @@ static int seg6_hmac_init_algo(void) + algo = &hmac_algos[i]; + algo->tfms = alloc_percpu(struct crypto_shash *); + if (!algo->tfms) +- return -ENOMEM; ++ goto error_out; + + for_each_possible_cpu(cpu) { + tfm = crypto_alloc_shash(algo->name, 0, 0); +- if (IS_ERR(tfm)) +- return PTR_ERR(tfm); ++ if (IS_ERR(tfm)) { ++ ret = PTR_ERR(tfm); ++ goto error_out; ++ } + p_tfm = per_cpu_ptr(algo->tfms, cpu); + *p_tfm = tfm; + } +@@ -383,18 +386,22 @@ static int seg6_hmac_init_algo(void) + + algo->shashs = alloc_percpu(struct shash_desc *); + if (!algo->shashs) +- return -ENOMEM; ++ goto error_out; + + for_each_possible_cpu(cpu) { + shash = kzalloc_node(shsize, GFP_KERNEL, + cpu_to_node(cpu)); + if (!shash) +- return -ENOMEM; ++ goto error_out; + *per_cpu_ptr(algo->shashs, cpu) = shash; + } + } + + return 0; ++ ++error_out: ++ seg6_hmac_exit(); ++ return ret; + } + + int __init seg6_hmac_init(void) +@@ -412,22 +419,29 @@ int __net_init seg6_hmac_net_init(struct net *net) + void seg6_hmac_exit(void) + { + struct seg6_hmac_algo *algo = NULL; ++ struct crypto_shash *tfm; ++ struct shash_desc *shash; + int i, alg_count, cpu; + + alg_count = ARRAY_SIZE(hmac_algos); + for (i = 0; i < alg_count; i++) { + algo = &hmac_algos[i]; +- for_each_possible_cpu(cpu) { +- struct crypto_shash *tfm; +- struct shash_desc *shash; + +- shash = *per_cpu_ptr(algo->shashs, cpu); +- kfree(shash); +- tfm = *per_cpu_ptr(algo->tfms, cpu); +- crypto_free_shash(tfm); ++ if (algo->shashs) { ++ for_each_possible_cpu(cpu) { ++ shash = *per_cpu_ptr(algo->shashs, cpu); ++ kfree(shash); ++ } ++ free_percpu(algo->shashs); ++ } ++ ++ if (algo->tfms) { ++ for_each_possible_cpu(cpu) { ++ tfm = *per_cpu_ptr(algo->tfms, cpu); ++ crypto_free_shash(tfm); ++ } ++ free_percpu(algo->tfms); + } +- free_percpu(algo->tfms); +- free_percpu(algo->shashs); + } + } + EXPORT_SYMBOL(seg6_hmac_exit); +-- +2.43.0 + diff --git a/queue-6.9/ipv6-sr-fix-missing-sk_buff-release-in-seg6_input_co.patch b/queue-6.9/ipv6-sr-fix-missing-sk_buff-release-in-seg6_input_co.patch new file mode 100644 index 00000000000..a0c0ef0f63a --- /dev/null +++ b/queue-6.9/ipv6-sr-fix-missing-sk_buff-release-in-seg6_input_co.patch @@ -0,0 +1,76 @@ +From 88658814d941b03db4cefde20f1e91b8173b0438 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 18:45:41 +0200 +Subject: ipv6: sr: fix missing sk_buff release in seg6_input_core + +From: Andrea Mayer + +[ Upstream commit 5447f9708d9e4c17a647b16a9cb29e9e02820bd9 ] + +The seg6_input() function is responsible for adding the SRH into a +packet, delegating the operation to the seg6_input_core(). This function +uses the skb_cow_head() to ensure that there is sufficient headroom in +the sk_buff for accommodating the link-layer header. +In the event that the skb_cow_header() function fails, the +seg6_input_core() catches the error but it does not release the sk_buff, +which will result in a memory leak. + +This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due +to headroom too small after SRH push") and persists even after commit +7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), +where the entire seg6_input() code was refactored to deal with netfilter +hooks. + +The proposed patch addresses the identified memory leak by requiring the +seg6_input_core() function to release the sk_buff in the event that +skb_cow_head() fails. + +Fixes: af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") +Signed-off-by: Andrea Mayer +Reviewed-by: Simon Horman +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6_iptunnel.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c +index 03b877ff45588..a75df2ec8db0d 100644 +--- a/net/ipv6/seg6_iptunnel.c ++++ b/net/ipv6/seg6_iptunnel.c +@@ -459,10 +459,8 @@ static int seg6_input_core(struct net *net, struct sock *sk, + int err; + + err = seg6_do_srh(skb); +- if (unlikely(err)) { +- kfree_skb(skb); +- return err; +- } ++ if (unlikely(err)) ++ goto drop; + + slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); + +@@ -486,7 +484,7 @@ static int seg6_input_core(struct net *net, struct sock *sk, + + err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); + if (unlikely(err)) +- return err; ++ goto drop; + + if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) + return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, +@@ -494,6 +492,9 @@ static int seg6_input_core(struct net *net, struct sock *sk, + skb_dst(skb)->dev, seg6_input_finish); + + return seg6_input_finish(dev_net(skb->dev), NULL, skb); ++drop: ++ kfree_skb(skb); ++ return err; + } + + static int seg6_input_nf(struct sk_buff *skb) +-- +2.43.0 + diff --git a/queue-6.9/kasan-fortify-properly-rename-memintrinsics.patch b/queue-6.9/kasan-fortify-properly-rename-memintrinsics.patch new file mode 100644 index 00000000000..7afce0a3e2d --- /dev/null +++ b/queue-6.9/kasan-fortify-properly-rename-memintrinsics.patch @@ -0,0 +1,93 @@ +From 56be57a16bda3b79cacddfa9b867ca2c87d2189f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 15:01:18 +0200 +Subject: kasan, fortify: properly rename memintrinsics + +From: Andrey Konovalov + +[ Upstream commit 2e577732e8d28b9183df701fb90cb7943aa4ed16 ] + +After commit 69d4c0d32186 ("entry, kasan, x86: Disallow overriding mem*() +functions") and the follow-up fixes, with CONFIG_FORTIFY_SOURCE enabled, +even though the compiler instruments meminstrinsics by generating calls to +__asan/__hwasan_ prefixed functions, FORTIFY_SOURCE still uses +uninstrumented memset/memmove/memcpy as the underlying functions. + +As a result, KASAN cannot detect bad accesses in memset/memmove/memcpy. +This also makes KASAN tests corrupt kernel memory and cause crashes. + +To fix this, use __asan_/__hwasan_memset/memmove/memcpy as the underlying +functions whenever appropriate. Do this only for the instrumented code +(as indicated by __SANITIZE_ADDRESS__). + +Link: https://lkml.kernel.org/r/20240517130118.759301-1-andrey.konovalov@linux.dev +Fixes: 69d4c0d32186 ("entry, kasan, x86: Disallow overriding mem*() functions") +Fixes: 51287dcb00cc ("kasan: emit different calls for instrumentable memintrinsics") +Fixes: 36be5cba99f6 ("kasan: treat meminstrinsic as builtins in uninstrumented files") +Signed-off-by: Andrey Konovalov +Reported-by: Erhard Furtner +Reported-by: Nico Pache +Closes: https://lore.kernel.org/all/20240501144156.17e65021@outsider.home/ +Reviewed-by: Marco Elver +Tested-by: Nico Pache +Acked-by: Nico Pache +Cc: Alexander Potapenko +Cc: Andrey Ryabinin +Cc: Daniel Axtens +Cc: Dmitry Vyukov +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/linux/fortify-string.h | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h +index 6eaa190d0083c..9754f97e71e52 100644 +--- a/include/linux/fortify-string.h ++++ b/include/linux/fortify-string.h +@@ -71,17 +71,30 @@ void __write_overflow_field(size_t avail, size_t wanted) __compiletime_warning(" + __ret; \ + }) + +-#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) ++#if defined(__SANITIZE_ADDRESS__) ++ ++#if !defined(CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX) && !defined(CONFIG_GENERIC_ENTRY) ++extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset); ++extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove); ++extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy); ++#elif defined(CONFIG_KASAN_GENERIC) ++extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(__asan_memset); ++extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(__asan_memmove); ++extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(__asan_memcpy); ++#else /* CONFIG_KASAN_SW_TAGS */ ++extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(__hwasan_memset); ++extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(__hwasan_memmove); ++extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(__hwasan_memcpy); ++#endif ++ + extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr); + extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp); +-extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy); +-extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove); +-extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset); + extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat); + extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy); + extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen); + extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat); + extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy); ++ + #else + + #if defined(__SANITIZE_MEMORY__) +@@ -106,6 +119,7 @@ extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) + #define __underlying_strlen __builtin_strlen + #define __underlying_strncat __builtin_strncat + #define __underlying_strncpy __builtin_strncpy ++ + #endif + + /** +-- +2.43.0 + diff --git a/queue-6.9/kvm-arm64-destroy-mpidr_data-for-late-vcpu-creation.patch b/queue-6.9/kvm-arm64-destroy-mpidr_data-for-late-vcpu-creation.patch new file mode 100644 index 00000000000..9fc5b9017ab --- /dev/null +++ b/queue-6.9/kvm-arm64-destroy-mpidr_data-for-late-vcpu-creation.patch @@ -0,0 +1,139 @@ +From cf65939b3977db8089903ebd8479c1a9dcd0d110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 07:19:52 +0000 +Subject: KVM: arm64: Destroy mpidr_data for 'late' vCPU creation + +From: Oliver Upton + +[ Upstream commit ce5d2448eb8fe83aed331db53a08612286a137dd ] + +A particularly annoying userspace could create a vCPU after KVM has +computed mpidr_data for the VM, either by racing against VGIC +initialization or having a userspace irqchip. + +In any case, this means mpidr_data no longer fully describes the VM, and +attempts to find the new vCPU with kvm_mpidr_to_vcpu() will fail. The +fix is to discard mpidr_data altogether, as it is only a performance +optimization and not required for correctness. In all likelihood KVM +will recompute the mappings when KVM_RUN is called on the new vCPU. + +Note that reads of mpidr_data are not guarded by a lock; promote to RCU +to cope with the possibility of mpidr_data being invalidated at runtime. + +Fixes: 54a8006d0b49 ("KVM: arm64: Fast-track kvm_mpidr_to_vcpu() when mpidr_data is available") +Signed-off-by: Oliver Upton +Link: https://lore.kernel.org/r/20240508071952.2035422-1-oliver.upton@linux.dev +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/arm.c | 50 ++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 41 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c +index c4a0a35e02c72..6cda738a41577 100644 +--- a/arch/arm64/kvm/arm.c ++++ b/arch/arm64/kvm/arm.c +@@ -195,6 +195,23 @@ void kvm_arch_create_vm_debugfs(struct kvm *kvm) + kvm_sys_regs_create_debugfs(kvm); + } + ++static void kvm_destroy_mpidr_data(struct kvm *kvm) ++{ ++ struct kvm_mpidr_data *data; ++ ++ mutex_lock(&kvm->arch.config_lock); ++ ++ data = rcu_dereference_protected(kvm->arch.mpidr_data, ++ lockdep_is_held(&kvm->arch.config_lock)); ++ if (data) { ++ rcu_assign_pointer(kvm->arch.mpidr_data, NULL); ++ synchronize_rcu(); ++ kfree(data); ++ } ++ ++ mutex_unlock(&kvm->arch.config_lock); ++} ++ + /** + * kvm_arch_destroy_vm - destroy the VM data structure + * @kvm: pointer to the KVM struct +@@ -209,7 +226,8 @@ void kvm_arch_destroy_vm(struct kvm *kvm) + if (is_protected_kvm_enabled()) + pkvm_destroy_hyp_vm(kvm); + +- kfree(kvm->arch.mpidr_data); ++ kvm_destroy_mpidr_data(kvm); ++ + kfree(kvm->arch.sysreg_masks); + kvm_destroy_vcpus(kvm); + +@@ -395,6 +413,13 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) + + vcpu->arch.hw_mmu = &vcpu->kvm->arch.mmu; + ++ /* ++ * This vCPU may have been created after mpidr_data was initialized. ++ * Throw out the pre-computed mappings if that is the case which forces ++ * KVM to fall back to iteratively searching the vCPUs. ++ */ ++ kvm_destroy_mpidr_data(vcpu->kvm); ++ + err = kvm_vgic_vcpu_init(vcpu); + if (err) + return err; +@@ -594,7 +619,8 @@ static void kvm_init_mpidr_data(struct kvm *kvm) + + mutex_lock(&kvm->arch.config_lock); + +- if (kvm->arch.mpidr_data || atomic_read(&kvm->online_vcpus) == 1) ++ if (rcu_access_pointer(kvm->arch.mpidr_data) || ++ atomic_read(&kvm->online_vcpus) == 1) + goto out; + + kvm_for_each_vcpu(c, vcpu, kvm) { +@@ -631,7 +657,7 @@ static void kvm_init_mpidr_data(struct kvm *kvm) + data->cmpidr_to_idx[index] = c; + } + +- kvm->arch.mpidr_data = data; ++ rcu_assign_pointer(kvm->arch.mpidr_data, data); + out: + mutex_unlock(&kvm->arch.config_lock); + } +@@ -2470,21 +2496,27 @@ static int __init init_hyp_mode(void) + + struct kvm_vcpu *kvm_mpidr_to_vcpu(struct kvm *kvm, unsigned long mpidr) + { +- struct kvm_vcpu *vcpu; ++ struct kvm_vcpu *vcpu = NULL; ++ struct kvm_mpidr_data *data; + unsigned long i; + + mpidr &= MPIDR_HWID_BITMASK; + +- if (kvm->arch.mpidr_data) { +- u16 idx = kvm_mpidr_index(kvm->arch.mpidr_data, mpidr); ++ rcu_read_lock(); ++ data = rcu_dereference(kvm->arch.mpidr_data); + +- vcpu = kvm_get_vcpu(kvm, +- kvm->arch.mpidr_data->cmpidr_to_idx[idx]); ++ if (data) { ++ u16 idx = kvm_mpidr_index(data, mpidr); ++ ++ vcpu = kvm_get_vcpu(kvm, data->cmpidr_to_idx[idx]); + if (mpidr != kvm_vcpu_get_mpidr_aff(vcpu)) + vcpu = NULL; ++ } + ++ rcu_read_unlock(); ++ ++ if (vcpu) + return vcpu; +- } + + kvm_for_each_vcpu(i, vcpu, kvm) { + if (mpidr == kvm_vcpu_get_mpidr_aff(vcpu)) +-- +2.43.0 + diff --git a/queue-6.9/kvm-ppc-book3s-hv-nestedv2-cancel-pending-dec-except.patch b/queue-6.9/kvm-ppc-book3s-hv-nestedv2-cancel-pending-dec-except.patch new file mode 100644 index 00000000000..0927b27fa7c --- /dev/null +++ b/queue-6.9/kvm-ppc-book3s-hv-nestedv2-cancel-pending-dec-except.patch @@ -0,0 +1,60 @@ +From de21af66569dbd3311a9943b5794124e4a2e1dbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 09:27:29 +0530 +Subject: KVM: PPC: Book3S HV nestedv2: Cancel pending DEC exception + +From: Vaibhav Jain + +[ Upstream commit 7be6ce7043b4cf293c8826a48fd9f56931cef2cf ] + +This reverts commit 180c6b072bf3 ("KVM: PPC: Book3S HV nestedv2: Do not +cancel pending decrementer exception") [1] which prevented canceling a +pending HDEC exception for nestedv2 KVM guests. It was done to avoid +overhead of a H_GUEST_GET_STATE hcall to read the 'DEC expiry TB' register +which was higher compared to handling extra decrementer exceptions. + +However recent benchmarks indicate that overhead of not handling 'DECR' +expiry for Nested KVM Guest(L2) is higher and results in much larger exits +to Pseries Host(L1) as indicated by the Unixbench-arithoh bench[2] + +Metric | Current upstream | Revert [1] | Difference % +======================================================================== +arithoh-count (10) | 3244831634 | 3403089673 | +04.88% +kvm_hv:kvm_guest_exit | 513558 | 152441 | -70.32% +probe:kvmppc_gsb_recv | 28060 | 28110 | +00.18% + +N=1 + +As indicated by the data above that reverting [1] results in substantial +reduction in number of L2->L1 exits with only slight increase in number of +H_GUEST_GET_STATE hcalls to read the value of 'DEC expiry TB'. This results +in an overall ~4% improvement of arithoh[2] throughput. + +[1] commit 180c6b072bf3 ("KVM: PPC: Book3S HV nestedv2: Do not cancel pending decrementer exception") +[2] https://github.com/kdlucas/byte-unixbench/ + +Fixes: 180c6b072bf3 ("KVM: PPC: Book3S HV nestedv2: Do not cancel pending decrementer exception") +Signed-off-by: Vaibhav Jain +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240415035731.103097-1-vaibhav@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index 8e86eb577eb8e..692a7c6f5fd91 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -4857,7 +4857,7 @@ int kvmhv_run_single_vcpu(struct kvm_vcpu *vcpu, u64 time_limit, + * entering a nested guest in which case the decrementer is now owned + * by L2 and the L1 decrementer is provided in hdec_expires + */ +- if (!kvmhv_is_nestedv2() && kvmppc_core_pending_dec(vcpu) && ++ if (kvmppc_core_pending_dec(vcpu) && + ((tb < kvmppc_dec_expires_host_tb(vcpu)) || + (trap == BOOK3S_INTERRUPT_SYSCALL && + kvmppc_get_gpr(vcpu, 3) == H_ENTER_NESTED))) +-- +2.43.0 + diff --git a/queue-6.9/kvm-ppc-book3s-hv-nestedv2-fix-an-error-handling-pat.patch b/queue-6.9/kvm-ppc-book3s-hv-nestedv2-fix-an-error-handling-pat.patch new file mode 100644 index 00000000000..cd080b5fc9e --- /dev/null +++ b/queue-6.9/kvm-ppc-book3s-hv-nestedv2-fix-an-error-handling-pat.patch @@ -0,0 +1,44 @@ +From 1349bb92701a73280c8dddb28bd05cfdb94aaebd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 12:34:25 +0100 +Subject: KVM: PPC: Book3S HV nestedv2: Fix an error handling path in + gs_msg_ops_kvmhv_nestedv2_config_fill_info() + +From: Christophe JAILLET + +[ Upstream commit b52e8cd3f835869370f8540f1bc804a47a47f02b ] + +The return value of kvmppc_gse_put_buff_info() is not assigned to 'rc' and +'rc' is uninitialized at this point. +So the error handling can not work. + +Assign the expected value to 'rc' to fix the issue. + +Fixes: 19d31c5f1157 ("KVM: PPC: Add support for nestedv2 guests") +Signed-off-by: Christophe JAILLET +Reviewed-by: Vaibhav Jain +Signed-off-by: Michael Ellerman +Link: https://msgid.link/a7ed4cc12e0a0bbd97fac44fe6c222d1c393ec95.1706441651.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv_nestedv2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kvm/book3s_hv_nestedv2.c b/arch/powerpc/kvm/book3s_hv_nestedv2.c +index 8e6f5355f08b5..1091f7a83b255 100644 +--- a/arch/powerpc/kvm/book3s_hv_nestedv2.c ++++ b/arch/powerpc/kvm/book3s_hv_nestedv2.c +@@ -71,8 +71,8 @@ gs_msg_ops_kvmhv_nestedv2_config_fill_info(struct kvmppc_gs_buff *gsb, + } + + if (kvmppc_gsm_includes(gsm, KVMPPC_GSID_RUN_OUTPUT)) { +- kvmppc_gse_put_buff_info(gsb, KVMPPC_GSID_RUN_OUTPUT, +- cfg->vcpu_run_output_cfg); ++ rc = kvmppc_gse_put_buff_info(gsb, KVMPPC_GSID_RUN_OUTPUT, ++ cfg->vcpu_run_output_cfg); + if (rc < 0) + return rc; + } +-- +2.43.0 + diff --git a/queue-6.9/media-cec-cec-adap-always-cancel-work-in-cec_transmi.patch b/queue-6.9/media-cec-cec-adap-always-cancel-work-in-cec_transmi.patch new file mode 100644 index 00000000000..e79eb8307ca --- /dev/null +++ b/queue-6.9/media-cec-cec-adap-always-cancel-work-in-cec_transmi.patch @@ -0,0 +1,39 @@ +From dc3c623621ccbe0d4a8d4a39dfbc9476cd86dbde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 12:24:38 +0000 +Subject: media: cec: cec-adap: always cancel work in cec_transmit_msg_fh + +From: Hans Verkuil + +[ Upstream commit 9fe2816816a3c765dff3b88af5b5c3d9bbb911ce ] + +Do not check for !data->completed, just always call +cancel_delayed_work_sync(). This fixes a small race condition. + +Signed-off-by: Hans Verkuil +Reported-by: Yang, Chenyuan +Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/ +Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/core/cec-adap.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c +index 559a172ebc6cb..6fc7de744ee9a 100644 +--- a/drivers/media/cec/core/cec-adap.c ++++ b/drivers/media/cec/core/cec-adap.c +@@ -936,8 +936,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, + */ + mutex_unlock(&adap->lock); + wait_for_completion_killable(&data->c); +- if (!data->completed) +- cancel_delayed_work_sync(&data->work); ++ cancel_delayed_work_sync(&data->work); + mutex_lock(&adap->lock); + + /* Cancel the transmit if it was interrupted */ +-- +2.43.0 + diff --git a/queue-6.9/media-cec-cec-api-add-locking-in-cec_release.patch b/queue-6.9/media-cec-cec-api-add-locking-in-cec_release.patch new file mode 100644 index 00000000000..edabb12eef2 --- /dev/null +++ b/queue-6.9/media-cec-cec-api-add-locking-in-cec_release.patch @@ -0,0 +1,46 @@ +From 8ad3d95c7480045545d5b2345d29cc9cdf7769a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 12:25:55 +0000 +Subject: media: cec: cec-api: add locking in cec_release() + +From: Hans Verkuil + +[ Upstream commit 42bcaacae924bf18ae387c3f78c202df0b739292 ] + +When cec_release() uses fh->msgs it has to take fh->lock, +otherwise the list can get corrupted. + +Signed-off-by: Hans Verkuil +Reported-by: Yang, Chenyuan +Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/ +Fixes: ca684386e6e2 ("[media] cec: add HDMI CEC framework (api)") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/core/cec-api.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c +index 67dc79ef17050..d64bb716f9c68 100644 +--- a/drivers/media/cec/core/cec-api.c ++++ b/drivers/media/cec/core/cec-api.c +@@ -664,6 +664,8 @@ static int cec_release(struct inode *inode, struct file *filp) + list_del_init(&data->xfer_list); + } + mutex_unlock(&adap->lock); ++ ++ mutex_lock(&fh->lock); + while (!list_empty(&fh->msgs)) { + struct cec_msg_entry *entry = + list_first_entry(&fh->msgs, struct cec_msg_entry, list); +@@ -681,6 +683,7 @@ static int cec_release(struct inode *inode, struct file *filp) + kfree(entry); + } + } ++ mutex_unlock(&fh->lock); + kfree(fh); + + cec_put_device(devnode); +-- +2.43.0 + diff --git a/queue-6.9/media-cec-core-avoid-confusing-transmit-timed-out-me.patch b/queue-6.9/media-cec-core-avoid-confusing-transmit-timed-out-me.patch new file mode 100644 index 00000000000..cbf97ffecfa --- /dev/null +++ b/queue-6.9/media-cec-core-avoid-confusing-transmit-timed-out-me.patch @@ -0,0 +1,73 @@ +From d1dd53353a2f2358b9ea1868875984006ad88990 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 11:13:47 +0100 +Subject: media: cec: core: avoid confusing "transmit timed out" message + +From: Hans Verkuil + +[ Upstream commit cbe499977bc36fedae89f0a0d7deb4ccde9798fe ] + +If, when waiting for a transmit to finish, the wait is interrupted, +then you might get a "transmit timed out" message, even though the +transmit was interrupted and did not actually time out. + +Set transmit_in_progress_aborted to true if the +wait_for_completion_killable() call was interrupted and ensure +that the transmit is properly marked as ABORTED. + +Signed-off-by: Hans Verkuil +Reported-by: Yang, Chenyuan +Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/ +Fixes: 590a8e564c6e ("media: cec: abort if the current transmit was canceled") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/core/cec-adap.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c +index a493cbce24567..da09834990b87 100644 +--- a/drivers/media/cec/core/cec-adap.c ++++ b/drivers/media/cec/core/cec-adap.c +@@ -490,6 +490,15 @@ int cec_thread_func(void *_adap) + goto unlock; + } + ++ if (adap->transmit_in_progress && ++ adap->transmit_in_progress_aborted) { ++ if (adap->transmitting) ++ cec_data_cancel(adap->transmitting, ++ CEC_TX_STATUS_ABORTED, 0); ++ adap->transmit_in_progress = false; ++ adap->transmit_in_progress_aborted = false; ++ goto unlock; ++ } + if (adap->transmit_in_progress && timeout) { + /* + * If we timeout, then log that. Normally this does +@@ -771,6 +780,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, + { + struct cec_data *data; + bool is_raw = msg_is_raw(msg); ++ int err; + + if (adap->devnode.unregistered) + return -ENODEV; +@@ -935,10 +945,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, + * Release the lock and wait, retake the lock afterwards. + */ + mutex_unlock(&adap->lock); +- wait_for_completion_killable(&data->c); ++ err = wait_for_completion_killable(&data->c); + cancel_delayed_work_sync(&data->work); + mutex_lock(&adap->lock); + ++ if (err) ++ adap->transmit_in_progress_aborted = true; ++ + /* Cancel the transmit if it was interrupted */ + if (!data->completed) { + if (data->msg.tx_status & CEC_TX_STATUS_OK) +-- +2.43.0 + diff --git a/queue-6.9/media-cec-core-avoid-recursive-cec_claim_log_addrs.patch b/queue-6.9/media-cec-core-avoid-recursive-cec_claim_log_addrs.patch new file mode 100644 index 00000000000..4ab00d91983 --- /dev/null +++ b/queue-6.9/media-cec-core-avoid-recursive-cec_claim_log_addrs.patch @@ -0,0 +1,81 @@ +From 3049317cf9df070585b2853da4438025ec41b6c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 16:17:33 +0000 +Subject: media: cec: core: avoid recursive cec_claim_log_addrs + +From: Hans Verkuil + +[ Upstream commit 47c82aac10a6954d68f29f10d9758d016e8e5af1 ] + +Keep track if cec_claim_log_addrs() is running, and return -EBUSY +if it is when calling CEC_ADAP_S_LOG_ADDRS. + +This prevents a case where cec_claim_log_addrs() could be called +while it was still in progress. + +Signed-off-by: Hans Verkuil +Reported-by: Yang, Chenyuan +Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/ +Fixes: ca684386e6e2 ("[media] cec: add HDMI CEC framework (api)") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/core/cec-adap.c | 6 +++++- + drivers/media/cec/core/cec-api.c | 2 +- + include/media/cec.h | 1 + + 3 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c +index 6fc7de744ee9a..a493cbce24567 100644 +--- a/drivers/media/cec/core/cec-adap.c ++++ b/drivers/media/cec/core/cec-adap.c +@@ -1574,9 +1574,12 @@ static int cec_config_thread_func(void *arg) + */ + static void cec_claim_log_addrs(struct cec_adapter *adap, bool block) + { +- if (WARN_ON(adap->is_configuring || adap->is_configured)) ++ if (WARN_ON(adap->is_claiming_log_addrs || ++ adap->is_configuring || adap->is_configured)) + return; + ++ adap->is_claiming_log_addrs = true; ++ + init_completion(&adap->config_completion); + + /* Ready to kick off the thread */ +@@ -1591,6 +1594,7 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block) + wait_for_completion(&adap->config_completion); + mutex_lock(&adap->lock); + } ++ adap->is_claiming_log_addrs = false; + } + + /* +diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c +index d64bb716f9c68..3ef9153443044 100644 +--- a/drivers/media/cec/core/cec-api.c ++++ b/drivers/media/cec/core/cec-api.c +@@ -178,7 +178,7 @@ static long cec_adap_s_log_addrs(struct cec_adapter *adap, struct cec_fh *fh, + CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU | + CEC_LOG_ADDRS_FL_CDC_ONLY; + mutex_lock(&adap->lock); +- if (!adap->is_configuring && ++ if (!adap->is_claiming_log_addrs && !adap->is_configuring && + (!log_addrs.num_log_addrs || !adap->is_configured) && + !cec_is_busy(adap, fh)) { + err = __cec_s_log_addrs(adap, &log_addrs, block); +diff --git a/include/media/cec.h b/include/media/cec.h +index 10c9cf6058b7e..cc3fcd0496c36 100644 +--- a/include/media/cec.h ++++ b/include/media/cec.h +@@ -258,6 +258,7 @@ struct cec_adapter { + u16 phys_addr; + bool needs_hpd; + bool is_enabled; ++ bool is_claiming_log_addrs; + bool is_configuring; + bool must_reconfigure; + bool is_configured; +-- +2.43.0 + diff --git a/queue-6.9/media-flexcop-usb-fix-sanity-check-of-bnumendpoints.patch b/queue-6.9/media-flexcop-usb-fix-sanity-check-of-bnumendpoints.patch new file mode 100644 index 00000000000..912085f6f4e --- /dev/null +++ b/queue-6.9/media-flexcop-usb-fix-sanity-check-of-bnumendpoints.patch @@ -0,0 +1,40 @@ +From 8e7042565e79aae96d196498038a07a86d0fd93e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 06:50:24 +0100 +Subject: media: flexcop-usb: fix sanity check of bNumEndpoints + +From: Dongliang Mu + +[ Upstream commit f62dc8f6bf82d1b307fc37d8d22cc79f67856c2f ] + +Commit d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type +") adds a sanity check for endpoint[1], but fails to modify the sanity +check of bNumEndpoints. + +Fix this by modifying the sanity check of bNumEndpoints to 2. + +Link: https://lore.kernel.org/linux-media/20220602055027.849014-1-dzm91@hust.edu.cn +Fixes: d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type") +Signed-off-by: Dongliang Mu +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/b2c2/flexcop-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c +index 790787f0eba84..bcb24d8964981 100644 +--- a/drivers/media/usb/b2c2/flexcop-usb.c ++++ b/drivers/media/usb/b2c2/flexcop-usb.c +@@ -515,7 +515,7 @@ static int flexcop_usb_init(struct flexcop_usb *fc_usb) + + alt = fc_usb->uintf->cur_altsetting; + +- if (alt->desc.bNumEndpoints < 1) ++ if (alt->desc.bNumEndpoints < 2) + return -ENODEV; + if (!usb_endpoint_is_isoc_in(&alt->endpoint[0].desc)) + return -ENODEV; +-- +2.43.0 + diff --git a/queue-6.9/media-mediatek-vcodec-fix-possible-unbalanced-pm-cou.patch b/queue-6.9/media-mediatek-vcodec-fix-possible-unbalanced-pm-cou.patch new file mode 100644 index 00000000000..b15216389bb --- /dev/null +++ b/queue-6.9/media-mediatek-vcodec-fix-possible-unbalanced-pm-cou.patch @@ -0,0 +1,88 @@ +From 0b139e49670f140610c3efdf888e0ced3c782b01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 13:32:40 +0200 +Subject: media: mediatek: vcodec: fix possible unbalanced PM counter + +From: Eugen Hristev + +[ Upstream commit c28d4921a1e3ce0a0374b7e9d68593be8802c42a ] + +It is possible that mtk_vcodec_enc_pw_on fails, and in that scenario +the PM counter is not incremented, and subsequent call to +mtk_vcodec_enc_pw_off decrements the counter, leading to a PM imbalance. +Fix by bailing out of venc_if_encode in the case when mtk_vcodec_enc_pw_on +fails. + +Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver") +Signed-off-by: Eugen Hristev +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Andrzej Pietrasiewicz +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c | 4 +++- + .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h | 2 +- + drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c | 5 ++++- + 3 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c +index a22b7dfc656e1..1a2b14a3e219c 100644 +--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c ++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c +@@ -58,13 +58,15 @@ int mtk_vcodec_init_enc_clk(struct mtk_vcodec_enc_dev *mtkdev) + return 0; + } + +-void mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm) ++int mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm) + { + int ret; + + ret = pm_runtime_resume_and_get(pm->dev); + if (ret) + dev_err(pm->dev, "pm_runtime_resume_and_get fail: %d", ret); ++ ++ return ret; + } + + void mtk_vcodec_enc_pw_off(struct mtk_vcodec_pm *pm) +diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h +index 157ea08ba9e36..2e28f25e36cc4 100644 +--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h ++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h +@@ -10,7 +10,7 @@ + #include "mtk_vcodec_enc_drv.h" + + int mtk_vcodec_init_enc_clk(struct mtk_vcodec_enc_dev *dev); +-void mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm); ++int mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm); + void mtk_vcodec_enc_pw_off(struct mtk_vcodec_pm *pm); + void mtk_vcodec_enc_clock_on(struct mtk_vcodec_pm *pm); + void mtk_vcodec_enc_clock_off(struct mtk_vcodec_pm *pm); +diff --git a/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c b/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c +index c402a686f3cb2..e83747b8d69ab 100644 +--- a/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c ++++ b/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c +@@ -64,7 +64,9 @@ int venc_if_encode(struct mtk_vcodec_enc_ctx *ctx, + ctx->dev->curr_ctx = ctx; + spin_unlock_irqrestore(&ctx->dev->irqlock, flags); + +- mtk_vcodec_enc_pw_on(&ctx->dev->pm); ++ ret = mtk_vcodec_enc_pw_on(&ctx->dev->pm); ++ if (ret) ++ goto venc_if_encode_pw_on_err; + mtk_vcodec_enc_clock_on(&ctx->dev->pm); + ret = ctx->enc_if->encode(ctx->drv_handle, opt, frm_buf, + bs_buf, result); +@@ -75,6 +77,7 @@ int venc_if_encode(struct mtk_vcodec_enc_ctx *ctx, + ctx->dev->curr_ctx = NULL; + spin_unlock_irqrestore(&ctx->dev->irqlock, flags); + ++venc_if_encode_pw_on_err: + mtk_venc_unlock(ctx); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.9/media-ov2680-allow-probing-if-link-frequencies-is-ab.patch b/queue-6.9/media-ov2680-allow-probing-if-link-frequencies-is-ab.patch new file mode 100644 index 00000000000..39e4cb45f55 --- /dev/null +++ b/queue-6.9/media-ov2680-allow-probing-if-link-frequencies-is-ab.patch @@ -0,0 +1,64 @@ +From f14ea54f764b8bd0e36d44bfdff5e7371894e754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 19:44:13 -0300 +Subject: media: ov2680: Allow probing if link-frequencies is absent + +From: Fabio Estevam + +[ Upstream commit fd2e66abd729dae5809dbb41c6c52a6931cfa6bb ] + +Since commit 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint +property verification") the ov2680 no longer probes on a imx7s-warp7: + +ov2680 1-0036: error -EINVAL: supported link freq 330000000 not found +ov2680 1-0036: probe with driver ov2680 failed with error -22 + +As the 'link-frequencies' property is not mandatory, allow the probe +to succeed by skipping the link-frequency verification when the +property is absent. + +Cc: stable@vger.kernel.org +Fixes: 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint property verification") +Signed-off-by: Fabio Estevam +Reviewed-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Stable-dep-of: 24034af644fc ("media: ov2680: Do not fail if data-lanes property is absent") +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 3e3b7c2b492cf..a857763c7984c 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -1123,18 +1123,23 @@ static int ov2680_parse_dt(struct ov2680_dev *sensor) + goto out_free_bus_cfg; + } + ++ if (!bus_cfg.nr_of_link_frequencies) { ++ dev_warn(dev, "Consider passing 'link-frequencies' in DT\n"); ++ goto skip_link_freq_validation; ++ } ++ + for (i = 0; i < bus_cfg.nr_of_link_frequencies; i++) + if (bus_cfg.link_frequencies[i] == sensor->link_freq[0]) + break; + +- if (bus_cfg.nr_of_link_frequencies == 0 || +- bus_cfg.nr_of_link_frequencies == i) { ++ if (bus_cfg.nr_of_link_frequencies == i) { + ret = dev_err_probe(dev, -EINVAL, + "supported link freq %lld not found\n", + sensor->link_freq[0]); + goto out_free_bus_cfg; + } + ++skip_link_freq_validation: + ret = 0; + out_free_bus_cfg: + v4l2_fwnode_endpoint_free(&bus_cfg); +-- +2.43.0 + diff --git a/queue-6.9/media-ov2680-clear-the-ret-variable-on-success.patch b/queue-6.9/media-ov2680-clear-the-ret-variable-on-success.patch new file mode 100644 index 00000000000..77859db72bb --- /dev/null +++ b/queue-6.9/media-ov2680-clear-the-ret-variable-on-success.patch @@ -0,0 +1,62 @@ +From 7276613f092218c18b5b865d0b6bf9cae8c99395 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 19:44:12 -0300 +Subject: media: ov2680: Clear the 'ret' variable on success + +From: Fabio Estevam + +[ Upstream commit 49a9bad83b4ab5dac1d7aba2615c77978bcf3984 ] + +Since commit 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint +property verification") even when the correct 'link-frequencies' +property is passed in the devicetree, the driver fails to probe: + +ov2680 1-0036: probe with driver ov2680 failed with error -22 + +The reason is that the variable 'ret' may contain the -EINVAL value +from a previous assignment: + +ret = fwnode_property_read_u32(dev_fwnode(dev), "clock-frequency", + &rate); + +Fix the problem by clearing 'ret' on the successful path. + +Tested on imx7s-warp board with the following devicetree: + +port { + ov2680_to_mipi: endpoint { + remote-endpoint = <&mipi_from_sensor>; + clock-lanes = <0>; + data-lanes = <1>; + link-frequencies = /bits/ 64 <330000000>; + }; +}; + +Cc: stable@vger.kernel.org +Fixes: 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint property verification") +Suggested-by: Hans de Goede +Signed-off-by: Fabio Estevam +Reviewed-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Stable-dep-of: 24034af644fc ("media: ov2680: Do not fail if data-lanes property is absent") +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 39d321e2b7f98..3e3b7c2b492cf 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -1135,6 +1135,7 @@ static int ov2680_parse_dt(struct ov2680_dev *sensor) + goto out_free_bus_cfg; + } + ++ ret = 0; + out_free_bus_cfg: + v4l2_fwnode_endpoint_free(&bus_cfg); + return ret; +-- +2.43.0 + diff --git a/queue-6.9/media-ov2680-do-not-fail-if-data-lanes-property-is-a.patch b/queue-6.9/media-ov2680-do-not-fail-if-data-lanes-property-is-a.patch new file mode 100644 index 00000000000..360c1dc8cd7 --- /dev/null +++ b/queue-6.9/media-ov2680-do-not-fail-if-data-lanes-property-is-a.patch @@ -0,0 +1,50 @@ +From 5c3c00c1af308abad4dfc0703870656bcf864ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Apr 2024 18:09:06 -0300 +Subject: media: ov2680: Do not fail if data-lanes property is absent + +From: Fabio Estevam + +[ Upstream commit 24034af644fc01126bec9850346a06ef1450181f ] + +Since commit 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint +property verification") the ov2680 driver no longer probes when the +'data-lanes' property is absent. + +The OV2680 sensor has only one data lane, so there is no need for +describing it the devicetree. + +Remove the unnecessary data-lanes property check. + +Suggested-by: Sakari Ailus +Fixes: 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint property verification") +Signed-off-by: Fabio Estevam +Reviewed-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index a857763c7984c..4577a8977c85a 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -1116,13 +1116,6 @@ static int ov2680_parse_dt(struct ov2680_dev *sensor) + sensor->pixel_rate = sensor->link_freq[0] * 2; + do_div(sensor->pixel_rate, 10); + +- /* Verify bus cfg */ +- if (bus_cfg.bus.mipi_csi2.num_data_lanes != 1) { +- ret = dev_err_probe(dev, -EINVAL, +- "only a 1-lane CSI2 config is supported"); +- goto out_free_bus_cfg; +- } +- + if (!bus_cfg.nr_of_link_frequencies) { + dev_warn(dev, "Consider passing 'link-frequencies' in DT\n"); + goto skip_link_freq_validation; +-- +2.43.0 + diff --git a/queue-6.9/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch b/queue-6.9/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch new file mode 100644 index 00000000000..0b59d55ba70 --- /dev/null +++ b/queue-6.9/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch @@ -0,0 +1,84 @@ +From 6b4a6577e602cdcfebdd3b62c196e134f48643ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 12:32:44 +0300 +Subject: media: stk1160: fix bounds checking in stk1160_copy_video() + +From: Dan Carpenter + +[ Upstream commit faa4364bef2ec0060de381ff028d1d836600a381 ] + +The subtract in this condition is reversed. The ->length is the length +of the buffer. The ->bytesused is how many bytes we have copied thus +far. When the condition is reversed that means the result of the +subtraction is always negative but since it's unsigned then the result +is a very high positive value. That means the overflow check is never +true. + +Additionally, the ->bytesused doesn't actually work for this purpose +because we're not writing to "buf->mem + buf->bytesused". Instead, the +math to calculate the destination where we are writing is a bit +involved. You calculate the number of full lines already written, +multiply by two, skip a line if necessary so that we start on an odd +numbered line, and add the offset into the line. + +To fix this buffer overflow, just take the actual destination where we +are writing, if the offset is already out of bounds print an error and +return. Otherwise, write up to buf->length bytes. + +Fixes: 9cb2173e6ea8 ("[media] media: Add stk1160 new driver (easycap replacement)") +Signed-off-by: Dan Carpenter +Reviewed-by: Ricardo Ribalda +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/stk1160/stk1160-video.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/usb/stk1160/stk1160-video.c b/drivers/media/usb/stk1160/stk1160-video.c +index 366f0e4a5dc0d..e79c45db60ab5 100644 +--- a/drivers/media/usb/stk1160/stk1160-video.c ++++ b/drivers/media/usb/stk1160/stk1160-video.c +@@ -99,7 +99,7 @@ void stk1160_buffer_done(struct stk1160 *dev) + static inline + void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len) + { +- int linesdone, lineoff, lencopy; ++ int linesdone, lineoff, lencopy, offset; + int bytesperline = dev->width * 2; + struct stk1160_buffer *buf = dev->isoc_ctl.buf; + u8 *dst = buf->mem; +@@ -139,8 +139,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len) + * Check if we have enough space left in the buffer. + * In that case, we force loop exit after copy. + */ +- if (lencopy > buf->bytesused - buf->length) { +- lencopy = buf->bytesused - buf->length; ++ offset = dst - (u8 *)buf->mem; ++ if (offset > buf->length) { ++ dev_warn_ratelimited(dev->dev, "out of bounds offset\n"); ++ return; ++ } ++ if (lencopy > buf->length - offset) { ++ lencopy = buf->length - offset; + remain = lencopy; + } + +@@ -182,8 +187,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len) + * Check if we have enough space left in the buffer. + * In that case, we force loop exit after copy. + */ +- if (lencopy > buf->bytesused - buf->length) { +- lencopy = buf->bytesused - buf->length; ++ offset = dst - (u8 *)buf->mem; ++ if (offset > buf->length) { ++ dev_warn_ratelimited(dev->dev, "offset out of bounds\n"); ++ return; ++ } ++ if (lencopy > buf->length - offset) { ++ lencopy = buf->length - offset; + remain = lencopy; + } + +-- +2.43.0 + diff --git a/queue-6.9/media-sunxi-a83-mips-csi2-also-select-generic_phy.patch b/queue-6.9/media-sunxi-a83-mips-csi2-also-select-generic_phy.patch new file mode 100644 index 00000000000..f3bafb44d92 --- /dev/null +++ b/queue-6.9/media-sunxi-a83-mips-csi2-also-select-generic_phy.patch @@ -0,0 +1,44 @@ +From 67ec6f21f19953434630addf7f73c4f9c4c2a723 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Sep 2023 05:04:38 +0100 +Subject: media: sunxi: a83-mips-csi2: also select GENERIC_PHY + +From: Randy Dunlap + +[ Upstream commit 8237026159cb6760ad22e28d57b9a1c53b612d3a ] + +When selecting GENERIC_PHY_MIPI_DPHY, also select GENERIC_PHY to +prevent kconfig warnings: + +WARNING: unmet direct dependencies detected for GENERIC_PHY_MIPI_DPHY + Depends on [n]: GENERIC_PHY [=n] + Selected by [y]: + - VIDEO_SUN8I_A83T_MIPI_CSI2 [=y] && MEDIA_SUPPORT [=y] && MEDIA_PLATFORM_SUPPORT [=y] && MEDIA_PLATFORM_DRIVERS [=y] && V4L_PLATFORM_DRIVERS [=y] && VIDEO_DEV [=y] && (ARCH_SUNXI || COMPILE_TEST [=y]) && PM [=y] && COMMON_CLK [=y] && RESET_CONTROLLER [=y] + +Fixes: 94d7fd9692b5 ("media: sunxi: Depend on GENERIC_PHY_MIPI_DPHY") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/ZQ/WS8HC1A3F0Qn8@rli9-mobl +Link: https://lore.kernel.org/linux-media/20230927040438.5589-1-rdunlap@infradead.org + +Signed-off-by: Randy Dunlap +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig b/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig +index 47a8c0fb7eb9f..99c401e653bc4 100644 +--- a/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig ++++ b/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig +@@ -8,6 +8,7 @@ config VIDEO_SUN8I_A83T_MIPI_CSI2 + select VIDEO_V4L2_SUBDEV_API + select V4L2_FWNODE + select REGMAP_MMIO ++ select GENERIC_PHY + select GENERIC_PHY_MIPI_DPHY + help + Support for the Allwinner A83T MIPI CSI-2 controller and D-PHY. +-- +2.43.0 + diff --git a/queue-6.9/media-ti-j721e-csi2rx-fix-races-while-restarting-dma.patch b/queue-6.9/media-ti-j721e-csi2rx-fix-races-while-restarting-dma.patch new file mode 100644 index 00000000000..2fa3168f969 --- /dev/null +++ b/queue-6.9/media-ti-j721e-csi2rx-fix-races-while-restarting-dma.patch @@ -0,0 +1,50 @@ +From c97b49292d3ab726118155f207bd446f45eb3e98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 13:53:02 +0530 +Subject: media: ti: j721e-csi2rx: Fix races while restarting DMA + +From: Jai Luthra + +[ Upstream commit ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b ] + +After the frame is submitted to DMA, it may happen that the submitted +list is not updated soon enough, and the DMA callback is triggered +before that. + +This can lead to kernel crashes, so move everything in a single +lock/unlock section to prevent such races. + +Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E") +Signed-off-by: Jai Luthra +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c +index 6da83d0cffaae..22442fce76078 100644 +--- a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c ++++ b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c +@@ -786,15 +786,14 @@ static void ti_csi2rx_buffer_queue(struct vb2_buffer *vb) + dev_warn(csi->dev, + "Failed to drain DMA. Next frame might be bogus\n"); + ++ spin_lock_irqsave(&dma->lock, flags); + ret = ti_csi2rx_start_dma(csi, buf); + if (ret) { +- dev_err(csi->dev, "Failed to start DMA: %d\n", ret); +- spin_lock_irqsave(&dma->lock, flags); + vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + dma->state = TI_CSI2RX_DMA_IDLE; + spin_unlock_irqrestore(&dma->lock, flags); ++ dev_err(csi->dev, "Failed to start DMA: %d\n", ret); + } else { +- spin_lock_irqsave(&dma->lock, flags); + list_add_tail(&buf->list, &dma->submitted); + spin_unlock_irqrestore(&dma->lock, flags); + } +-- +2.43.0 + diff --git a/queue-6.9/media-v4l-don-t-turn-on-privacy-led-if-streamon-fail.patch b/queue-6.9/media-v4l-don-t-turn-on-privacy-led-if-streamon-fail.patch new file mode 100644 index 00000000000..5bb8e3dbd62 --- /dev/null +++ b/queue-6.9/media-v4l-don-t-turn-on-privacy-led-if-streamon-fail.patch @@ -0,0 +1,68 @@ +From dba00bd8bc2ed164c36972b843934a45e554f2c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 12:58:44 +0300 +Subject: media: v4l: Don't turn on privacy LED if streamon fails + +From: Sakari Ailus + +[ Upstream commit f2bf6cd8f44781349620e30a0af8987fe9af008f ] + +Turn on the privacy LED only if streamon succeeds. This can be done after +enabling streaming on the sensor. + +Fixes: b6e10ff6c23d ("media: v4l2-core: Make the v4l2-core code enable/disable the privacy LED if present") +Signed-off-by: Sakari Ailus +Reviewed-by: Hans de Goede +Reviewed-by: Tomi Valkeinen +Reviewed-by: Umang Jain +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-subdev.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c +index 45836f0a2b0a7..19d20871afefa 100644 +--- a/drivers/media/v4l2-core/v4l2-subdev.c ++++ b/drivers/media/v4l2-core/v4l2-subdev.c +@@ -412,15 +412,6 @@ static int call_s_stream(struct v4l2_subdev *sd, int enable) + if (WARN_ON(!!sd->enabled_streams == !!enable)) + return 0; + +-#if IS_REACHABLE(CONFIG_LEDS_CLASS) +- if (!IS_ERR_OR_NULL(sd->privacy_led)) { +- if (enable) +- led_set_brightness(sd->privacy_led, +- sd->privacy_led->max_brightness); +- else +- led_set_brightness(sd->privacy_led, 0); +- } +-#endif + ret = sd->ops->video->s_stream(sd, enable); + + if (!enable && ret < 0) { +@@ -428,9 +419,20 @@ static int call_s_stream(struct v4l2_subdev *sd, int enable) + ret = 0; + } + +- if (!ret) ++ if (!ret) { + sd->enabled_streams = enable ? BIT(0) : 0; + ++#if IS_REACHABLE(CONFIG_LEDS_CLASS) ++ if (!IS_ERR_OR_NULL(sd->privacy_led)) { ++ if (enable) ++ led_set_brightness(sd->privacy_led, ++ sd->privacy_led->max_brightness); ++ else ++ led_set_brightness(sd->privacy_led, 0); ++ } ++#endif ++ } ++ + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.9/mmc-sdhci_am654-add-itapdlysel-in-sdhci_j721e_4bit_s.patch b/queue-6.9/mmc-sdhci_am654-add-itapdlysel-in-sdhci_j721e_4bit_s.patch new file mode 100644 index 00000000000..9dfd9ceff8f --- /dev/null +++ b/queue-6.9/mmc-sdhci_am654-add-itapdlysel-in-sdhci_j721e_4bit_s.patch @@ -0,0 +1,60 @@ +From 8cf3135b7c1cd0747aa3516c83bdcfe4ca7e4555 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 17:38:36 -0500 +Subject: mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock + +From: Judith Mendez + +[ Upstream commit 9dff65bb5e09903c27d9cff947dff4d22b6ea6a1 ] + +Add ITAPDLYSEL to sdhci_j721e_4bit_set_clock function. +This allows to set the correct ITAPDLY for timings that +do not carry out tuning. + +Fixes: 1accbced1c32 ("mmc: sdhci_am654: Add Support for 4 bit IP on J721E") +Signed-off-by: Judith Mendez +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240320223837.959900-7-jm@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_am654.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c +index 888bfda0ebc0e..884d1b53180d7 100644 +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -320,6 +320,7 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host, + unsigned char timing = host->mmc->ios.timing; + u32 otap_del_sel; + u32 itap_del_ena; ++ u32 itap_del_sel; + u32 mask, val; + + /* Setup DLL Output TAP delay */ +@@ -329,13 +330,18 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host, + val = (0x1 << OTAPDLYENA_SHIFT) | + (otap_del_sel << OTAPDLYSEL_SHIFT); + ++ /* Setup Input TAP delay */ + itap_del_ena = sdhci_am654->itap_del_ena[timing]; ++ itap_del_sel = sdhci_am654->itap_del_sel[timing]; + +- mask |= ITAPDLYENA_MASK; +- val |= (itap_del_ena << ITAPDLYENA_SHIFT); ++ mask |= ITAPDLYENA_MASK | ITAPDLYSEL_MASK; ++ val |= (itap_del_ena << ITAPDLYENA_SHIFT) | ++ (itap_del_sel << ITAPDLYSEL_SHIFT); + ++ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK, ++ 1 << ITAPCHGWIN_SHIFT); + regmap_update_bits(sdhci_am654->base, PHY_CTRL4, mask, val); +- ++ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK, 0); + regmap_update_bits(sdhci_am654->base, PHY_CTRL5, CLKBUFSEL_MASK, + sdhci_am654->clkbuf_sel); + +-- +2.43.0 + diff --git a/queue-6.9/mmc-sdhci_am654-add-otap-itap-delay-enable.patch b/queue-6.9/mmc-sdhci_am654-add-otap-itap-delay-enable.patch new file mode 100644 index 00000000000..ac8b956a914 --- /dev/null +++ b/queue-6.9/mmc-sdhci_am654-add-otap-itap-delay-enable.patch @@ -0,0 +1,168 @@ +From 2d4f25026309b89327fc78ff3bc1695f0eff5bbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 17:38:33 -0500 +Subject: mmc: sdhci_am654: Add OTAP/ITAP delay enable + +From: Judith Mendez + +[ Upstream commit 387c1bf7dce0dfea02080c8bdb066b5209e92155 ] + +Currently the OTAP/ITAP delay enable functionality is incorrect in +the am654_set_clock function. The OTAP delay is not enabled when +timing < SDR25 bus speed mode. The ITAP delay is not enabled for +timings that do not carry out tuning. + +Add this OTAP/ITAP delay functionality according to the datasheet +[1] OTAPDLYENA and ITAPDLYENA for MMC0. + +[1] https://www.ti.com/lit/ds/symlink/am62p.pdf + +Fixes: 8ee5fc0e0b3b ("mmc: sdhci_am654: Update OTAPDLY writes") +Signed-off-by: Judith Mendez +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240320223837.959900-4-jm@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_am654.c | 40 ++++++++++++++++++++++------------ + 1 file changed, 26 insertions(+), 14 deletions(-) + +diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c +index cfb614d0b42b4..888bfda0ebc0e 100644 +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -143,6 +143,7 @@ struct sdhci_am654_data { + struct regmap *base; + int otap_del_sel[ARRAY_SIZE(td)]; + int itap_del_sel[ARRAY_SIZE(td)]; ++ u32 itap_del_ena[ARRAY_SIZE(td)]; + int clkbuf_sel; + int trm_icp; + int drv_strength; +@@ -239,11 +240,13 @@ static void sdhci_am654_setup_dll(struct sdhci_host *host, unsigned int clock) + } + + static void sdhci_am654_write_itapdly(struct sdhci_am654_data *sdhci_am654, +- u32 itapdly) ++ u32 itapdly, u32 enable) + { + /* Set ITAPCHGWIN before writing to ITAPDLY */ + regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK, + 1 << ITAPCHGWIN_SHIFT); ++ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYENA_MASK, ++ enable << ITAPDLYENA_SHIFT); + regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYSEL_MASK, + itapdly << ITAPDLYSEL_SHIFT); + regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK, 0); +@@ -260,8 +263,8 @@ static void sdhci_am654_setup_delay_chain(struct sdhci_am654_data *sdhci_am654, + mask = SELDLYTXCLK_MASK | SELDLYRXCLK_MASK; + regmap_update_bits(sdhci_am654->base, PHY_CTRL5, mask, val); + +- sdhci_am654_write_itapdly(sdhci_am654, +- sdhci_am654->itap_del_sel[timing]); ++ sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing], ++ sdhci_am654->itap_del_ena[timing]); + } + + static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock) +@@ -270,7 +273,6 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock) + struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); + unsigned char timing = host->mmc->ios.timing; + u32 otap_del_sel; +- u32 otap_del_ena; + u32 mask, val; + + regmap_update_bits(sdhci_am654->base, PHY_CTRL1, ENDLL_MASK, 0); +@@ -279,10 +281,9 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock) + + /* Setup DLL Output TAP delay */ + otap_del_sel = sdhci_am654->otap_del_sel[timing]; +- otap_del_ena = (timing > MMC_TIMING_UHS_SDR25) ? 1 : 0; + + mask = OTAPDLYENA_MASK | OTAPDLYSEL_MASK; +- val = (otap_del_ena << OTAPDLYENA_SHIFT) | ++ val = (0x1 << OTAPDLYENA_SHIFT) | + (otap_del_sel << OTAPDLYSEL_SHIFT); + + /* Write to STRBSEL for HS400 speed mode */ +@@ -300,7 +301,8 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock) + if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) { + sdhci_am654_setup_dll(host, clock); + sdhci_am654->dll_enable = true; +- sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing]); ++ sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing], ++ sdhci_am654->itap_del_ena[timing]); + } else { + sdhci_am654_setup_delay_chain(sdhci_am654, timing); + sdhci_am654->dll_enable = false; +@@ -317,6 +319,7 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host, + struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); + unsigned char timing = host->mmc->ios.timing; + u32 otap_del_sel; ++ u32 itap_del_ena; + u32 mask, val; + + /* Setup DLL Output TAP delay */ +@@ -325,6 +328,12 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host, + mask = OTAPDLYENA_MASK | OTAPDLYSEL_MASK; + val = (0x1 << OTAPDLYENA_SHIFT) | + (otap_del_sel << OTAPDLYSEL_SHIFT); ++ ++ itap_del_ena = sdhci_am654->itap_del_ena[timing]; ++ ++ mask |= ITAPDLYENA_MASK; ++ val |= (itap_del_ena << ITAPDLYENA_SHIFT); ++ + regmap_update_bits(sdhci_am654->base, PHY_CTRL4, mask, val); + + regmap_update_bits(sdhci_am654->base, PHY_CTRL5, CLKBUFSEL_MASK, +@@ -478,6 +487,7 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host, + { + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); ++ unsigned char timing = host->mmc->ios.timing; + struct window fail_window[ITAPDLY_LENGTH]; + u8 curr_pass, itap; + u8 fail_index = 0; +@@ -486,11 +496,10 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host, + memset(fail_window, 0, sizeof(fail_window)); + + /* Enable ITAPDLY */ +- regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYENA_MASK, +- 1 << ITAPDLYENA_SHIFT); ++ sdhci_am654->itap_del_ena[timing] = 0x1; + + for (itap = 0; itap < ITAPDLY_LENGTH; itap++) { +- sdhci_am654_write_itapdly(sdhci_am654, itap); ++ sdhci_am654_write_itapdly(sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]); + + curr_pass = !mmc_send_tuning(host->mmc, opcode, NULL); + +@@ -514,7 +523,7 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host, + itap = sdhci_am654_calculate_itap(host, fail_window, fail_index, + sdhci_am654->dll_enable); + +- sdhci_am654_write_itapdly(sdhci_am654, itap); ++ sdhci_am654_write_itapdly(sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]); + + return 0; + } +@@ -663,9 +672,12 @@ static int sdhci_am654_get_otap_delay(struct sdhci_host *host, + host->mmc->caps2 &= ~td[i].capability; + } + +- if (td[i].itap_binding) +- device_property_read_u32(dev, td[i].itap_binding, +- &sdhci_am654->itap_del_sel[i]); ++ if (td[i].itap_binding) { ++ ret = device_property_read_u32(dev, td[i].itap_binding, ++ &sdhci_am654->itap_del_sel[i]); ++ if (!ret) ++ sdhci_am654->itap_del_ena[i] = 0x1; ++ } + } + + return 0; +-- +2.43.0 + diff --git a/queue-6.9/mmc-sdhci_am654-add-tuning-algorithm-for-delay-chain.patch b/queue-6.9/mmc-sdhci_am654-add-tuning-algorithm-for-delay-chain.patch new file mode 100644 index 00000000000..15fadb84ed3 --- /dev/null +++ b/queue-6.9/mmc-sdhci_am654-add-tuning-algorithm-for-delay-chain.patch @@ -0,0 +1,195 @@ +From 07b377ae62aa29812e3ff30a01f52907afe60310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 17:38:31 -0500 +Subject: mmc: sdhci_am654: Add tuning algorithm for delay chain + +From: Judith Mendez + +[ Upstream commit 6231d99dd4119312ad41abf9383e18fec66cbe4b ] + +Currently the sdhci_am654 driver only supports one tuning +algorithm which should be used only when DLL is enabled. The +ITAPDLY is selected from the largest passing window and the +buffer is viewed as a circular buffer. + +The new algorithm should be used when the delay chain +is enabled. The ITAPDLY is selected from the largest passing +window and the buffer is not viewed as a circular buffer. + +This implementation is based off of the following paper: [1]. + +Also add support for multiple failing windows. + +[1] https://www.ti.com/lit/an/spract9/spract9.pdf + +Fixes: 13ebeae68ac9 ("mmc: sdhci_am654: Add support for software tuning") +Signed-off-by: Judith Mendez +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240320223837.959900-2-jm@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_am654.c | 112 +++++++++++++++++++++++++++------ + 1 file changed, 92 insertions(+), 20 deletions(-) + +diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c +index d659c59422e1e..d8c9821b0b663 100644 +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -149,10 +149,17 @@ struct sdhci_am654_data { + int strb_sel; + u32 flags; + u32 quirks; ++ bool dll_enable; + + #define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0) + }; + ++struct window { ++ u8 start; ++ u8 end; ++ u8 length; ++}; ++ + struct sdhci_am654_driver_data { + const struct sdhci_pltfm_data *pdata; + u32 flags; +@@ -290,10 +297,13 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock) + + regmap_update_bits(sdhci_am654->base, PHY_CTRL4, mask, val); + +- if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) ++ if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) { + sdhci_am654_setup_dll(host, clock); +- else ++ sdhci_am654->dll_enable = true; ++ } else { + sdhci_am654_setup_delay_chain(sdhci_am654, timing); ++ sdhci_am654->dll_enable = false; ++ } + + regmap_update_bits(sdhci_am654->base, PHY_CTRL5, CLKBUFSEL_MASK, + sdhci_am654->clkbuf_sel); +@@ -408,39 +418,101 @@ static u32 sdhci_am654_cqhci_irq(struct sdhci_host *host, u32 intmask) + return 0; + } + +-#define ITAP_MAX 32 ++#define ITAPDLY_LENGTH 32 ++#define ITAPDLY_LAST_INDEX (ITAPDLY_LENGTH - 1) ++ ++static u32 sdhci_am654_calculate_itap(struct sdhci_host *host, struct window ++ *fail_window, u8 num_fails, bool circular_buffer) ++{ ++ u8 itap = 0, start_fail = 0, end_fail = 0, pass_length = 0; ++ u8 first_fail_start = 0, last_fail_end = 0; ++ struct device *dev = mmc_dev(host->mmc); ++ struct window pass_window = {0, 0, 0}; ++ int prev_fail_end = -1; ++ u8 i; ++ ++ if (!num_fails) ++ return ITAPDLY_LAST_INDEX >> 1; ++ ++ if (fail_window->length == ITAPDLY_LENGTH) { ++ dev_err(dev, "No passing ITAPDLY, return 0\n"); ++ return 0; ++ } ++ ++ first_fail_start = fail_window->start; ++ last_fail_end = fail_window[num_fails - 1].end; ++ ++ for (i = 0; i < num_fails; i++) { ++ start_fail = fail_window[i].start; ++ end_fail = fail_window[i].end; ++ pass_length = start_fail - (prev_fail_end + 1); ++ ++ if (pass_length > pass_window.length) { ++ pass_window.start = prev_fail_end + 1; ++ pass_window.length = pass_length; ++ } ++ prev_fail_end = end_fail; ++ } ++ ++ if (!circular_buffer) ++ pass_length = ITAPDLY_LAST_INDEX - last_fail_end; ++ else ++ pass_length = ITAPDLY_LAST_INDEX - last_fail_end + first_fail_start; ++ ++ if (pass_length > pass_window.length) { ++ pass_window.start = last_fail_end + 1; ++ pass_window.length = pass_length; ++ } ++ ++ if (!circular_buffer) ++ itap = pass_window.start + (pass_window.length >> 1); ++ else ++ itap = (pass_window.start + (pass_window.length >> 1)) % ITAPDLY_LENGTH; ++ ++ return (itap > ITAPDLY_LAST_INDEX) ? ITAPDLY_LAST_INDEX >> 1 : itap; ++} ++ + static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host, + u32 opcode) + { + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); +- int cur_val, prev_val = 1, fail_len = 0, pass_window = 0, pass_len; +- u32 itap; ++ struct window fail_window[ITAPDLY_LENGTH]; ++ u8 curr_pass, itap; ++ u8 fail_index = 0; ++ u8 prev_pass = 1; ++ ++ memset(fail_window, 0, sizeof(fail_window)); + + /* Enable ITAPDLY */ + regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYENA_MASK, + 1 << ITAPDLYENA_SHIFT); + +- for (itap = 0; itap < ITAP_MAX; itap++) { ++ for (itap = 0; itap < ITAPDLY_LENGTH; itap++) { + sdhci_am654_write_itapdly(sdhci_am654, itap); + +- cur_val = !mmc_send_tuning(host->mmc, opcode, NULL); +- if (cur_val && !prev_val) +- pass_window = itap; ++ curr_pass = !mmc_send_tuning(host->mmc, opcode, NULL); + +- if (!cur_val) +- fail_len++; ++ if (!curr_pass && prev_pass) ++ fail_window[fail_index].start = itap; + +- prev_val = cur_val; ++ if (!curr_pass) { ++ fail_window[fail_index].end = itap; ++ fail_window[fail_index].length++; ++ } ++ ++ if (curr_pass && !prev_pass) ++ fail_index++; ++ ++ prev_pass = curr_pass; + } +- /* +- * Having determined the length of the failing window and start of +- * the passing window calculate the length of the passing window and +- * set the final value halfway through it considering the range as a +- * circular buffer +- */ +- pass_len = ITAP_MAX - fail_len; +- itap = (pass_window + (pass_len >> 1)) % ITAP_MAX; ++ ++ if (fail_window[fail_index].length != 0) ++ fail_index++; ++ ++ itap = sdhci_am654_calculate_itap(host, fail_window, fail_index, ++ sdhci_am654->dll_enable); ++ + sdhci_am654_write_itapdly(sdhci_am654, itap); + + return 0; +-- +2.43.0 + diff --git a/queue-6.9/mmc-sdhci_am654-fix-itapdly-for-hs400-timing.patch b/queue-6.9/mmc-sdhci_am654-fix-itapdly-for-hs400-timing.patch new file mode 100644 index 00000000000..fd4907d8056 --- /dev/null +++ b/queue-6.9/mmc-sdhci_am654-fix-itapdly-for-hs400-timing.patch @@ -0,0 +1,59 @@ +From 96f446ac66d47f3be8640d89fd6cbac328ac9ff6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 17:38:37 -0500 +Subject: mmc: sdhci_am654: Fix ITAPDLY for HS400 timing + +From: Judith Mendez + +[ Upstream commit d3182932bb070e7518411fd165e023f82afd7d25 ] + +While STRB is currently used for DATA and CRC responses, the CMD +responses from the device to the host still require ITAPDLY for +HS400 timing. + +Currently what is stored for HS400 is the ITAPDLY from High Speed +mode which is incorrect. The ITAPDLY for HS400 speed mode should +be the same as ITAPDLY as HS200 timing after tuning is executed. +Add the functionality to save ITAPDLY from HS200 tuning and save +as HS400 ITAPDLY. + +Fixes: a161c45f2979 ("mmc: sdhci_am654: Enable DLL only for some speed modes") +Signed-off-by: Judith Mendez +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240320223837.959900-8-jm@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_am654.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c +index 884d1b53180d7..562034af653eb 100644 +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -301,6 +301,12 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock) + if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) { + sdhci_am654_setup_dll(host, clock); + sdhci_am654->dll_enable = true; ++ ++ if (timing == MMC_TIMING_MMC_HS400) { ++ sdhci_am654->itap_del_ena[timing] = 0x1; ++ sdhci_am654->itap_del_sel[timing] = sdhci_am654->itap_del_sel[timing - 1]; ++ } ++ + sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing], + sdhci_am654->itap_del_ena[timing]); + } else { +@@ -531,6 +537,9 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host, + + sdhci_am654_write_itapdly(sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]); + ++ /* Save ITAPDLY */ ++ sdhci_am654->itap_del_sel[timing] = itap; ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.9/mmc-sdhci_am654-write-itapdly-for-ddr52-timing.patch b/queue-6.9/mmc-sdhci_am654-write-itapdly-for-ddr52-timing.patch new file mode 100644 index 00000000000..682f8d7cefb --- /dev/null +++ b/queue-6.9/mmc-sdhci_am654-write-itapdly-for-ddr52-timing.patch @@ -0,0 +1,39 @@ +From 024383fc1e105eb6eb830831f9de9eb7333b09f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 17:38:32 -0500 +Subject: mmc: sdhci_am654: Write ITAPDLY for DDR52 timing + +From: Judith Mendez + +[ Upstream commit d465234493bb6ad1b9c10a0c9ef9881b8d85081a ] + +For DDR52 timing, DLL is enabled but tuning is not carried +out, therefore the ITAPDLY value in PHY CTRL 4 register is +not correct. Fix this by writing ITAPDLY after enabling DLL. + +Fixes: a161c45f2979 ("mmc: sdhci_am654: Enable DLL only for some speed modes") +Signed-off-by: Judith Mendez +Reviewed-by: Andrew Davis +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240320223837.959900-3-jm@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_am654.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c +index d8c9821b0b663..cfb614d0b42b4 100644 +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -300,6 +300,7 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock) + if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) { + sdhci_am654_setup_dll(host, clock); + sdhci_am654->dll_enable = true; ++ sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing]); + } else { + sdhci_am654_setup_delay_chain(sdhci_am654, timing); + sdhci_am654->dll_enable = false; +-- +2.43.0 + diff --git a/queue-6.9/net-always-descend-into-dsa-folder-with-config_net_d.patch b/queue-6.9/net-always-descend-into-dsa-folder-with-config_net_d.patch new file mode 100644 index 00000000000..a7be25841e3 --- /dev/null +++ b/queue-6.9/net-always-descend-into-dsa-folder-with-config_net_d.patch @@ -0,0 +1,58 @@ +From cfb6df106d0327749bf28313dca59061bd36d927 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 09:56:30 -0700 +Subject: net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled + +From: Florian Fainelli + +[ Upstream commit b1fa60ec252fba39130107074becd12d0b3f83ec ] + +Stephen reported that he was unable to get the dsa_loop driver to get +probed, and the reason ended up being because he had CONFIG_FIXED_PHY=y +in his kernel configuration. As Masahiro explained it: + + "obj-m += dsa/" means everything under dsa/ must be modular. + + If there is a built-in object under dsa/ with CONFIG_NET_DSA=m, + you cannot do "obj-$(CONFIG_NET_DSA) += dsa/". + + You need to change it back to "obj-y += dsa/". + +This was the case here whereby CONFIG_NET_DSA=m, and so the +obj-$(CONFIG_FIXED_PHY) += dsa_loop_bdinfo.o rule is not executed and +the DSA loop mdio_board info structure is not registered with the +kernel, and eventually the device is simply not found. + +To preserve the intention of the original commit of limiting the amount +of folder descending, conditionally descend into drivers/net/dsa when +CONFIG_NET_DSA is enabled. + +Fixes: 227d72063fcc ("dsa: simplify Kconfig symbols and dependencies") +Reported-by: Stephen Langstaff +Signed-off-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Reviewed-by: Alexander Lobakin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/Makefile | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/Makefile b/drivers/net/Makefile +index 7cab36f94782e..db55ffdb5792d 100644 +--- a/drivers/net/Makefile ++++ b/drivers/net/Makefile +@@ -48,7 +48,9 @@ obj-$(CONFIG_MHI_NET) += mhi_net.o + obj-$(CONFIG_ARCNET) += arcnet/ + obj-$(CONFIG_CAIF) += caif/ + obj-$(CONFIG_CAN) += can/ +-obj-$(CONFIG_NET_DSA) += dsa/ ++ifdef CONFIG_NET_DSA ++obj-y += dsa/ ++endif + obj-$(CONFIG_ETHERNET) += ethernet/ + obj-$(CONFIG_FDDI) += fddi/ + obj-$(CONFIG_HIPPI) += hippi/ +-- +2.43.0 + diff --git a/queue-6.9/net-fec-avoid-lock-evasion-when-reading-pps_enable.patch b/queue-6.9/net-fec-avoid-lock-evasion-when-reading-pps_enable.patch new file mode 100644 index 00000000000..44182398130 --- /dev/null +++ b/queue-6.9/net-fec-avoid-lock-evasion-when-reading-pps_enable.patch @@ -0,0 +1,62 @@ +From cbfbc85091213edb1da4710aad07b23408219fbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 10:38:00 +0800 +Subject: net: fec: avoid lock evasion when reading pps_enable + +From: Wei Fang + +[ Upstream commit 3b1c92f8e5371700fada307cc8fd2c51fa7bc8c1 ] + +The assignment of pps_enable is protected by tmreg_lock, but the read +operation of pps_enable is not. So the Coverity tool reports a lock +evasion warning which may cause data race to occur when running in a +multithread environment. Although this issue is almost impossible to +occur, we'd better fix it, at least it seems more logically reasonable, +and it also prevents Coverity from continuing to issue warnings. + +Fixes: 278d24047891 ("net: fec: ptp: Enable PPS output based on ptp clock") +Signed-off-by: Wei Fang +Link: https://lore.kernel.org/r/20240521023800.17102-1-wei.fang@nxp.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_ptp.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c +index 181d9bfbee220..e32f6724f5681 100644 +--- a/drivers/net/ethernet/freescale/fec_ptp.c ++++ b/drivers/net/ethernet/freescale/fec_ptp.c +@@ -104,14 +104,13 @@ static int fec_ptp_enable_pps(struct fec_enet_private *fep, uint enable) + struct timespec64 ts; + u64 ns; + +- if (fep->pps_enable == enable) +- return 0; +- +- fep->pps_channel = DEFAULT_PPS_CHANNEL; +- fep->reload_period = PPS_OUPUT_RELOAD_PERIOD; +- + spin_lock_irqsave(&fep->tmreg_lock, flags); + ++ if (fep->pps_enable == enable) { ++ spin_unlock_irqrestore(&fep->tmreg_lock, flags); ++ return 0; ++ } ++ + if (enable) { + /* clear capture or output compare interrupt status if have. + */ +@@ -532,6 +531,9 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp, + int ret = 0; + + if (rq->type == PTP_CLK_REQ_PPS) { ++ fep->pps_channel = DEFAULT_PPS_CHANNEL; ++ fep->reload_period = PPS_OUPUT_RELOAD_PERIOD; ++ + ret = fec_ptp_enable_pps(fep, on); + + return ret; +-- +2.43.0 + diff --git a/queue-6.9/net-lan966x-remove-ptp-traps-in-case-the-ptp-is-not-.patch b/queue-6.9/net-lan966x-remove-ptp-traps-in-case-the-ptp-is-not-.patch new file mode 100644 index 00000000000..f2f57d7d79f --- /dev/null +++ b/queue-6.9/net-lan966x-remove-ptp-traps-in-case-the-ptp-is-not-.patch @@ -0,0 +1,52 @@ +From cec5099bef575fbff139511e24c071c79c05fb60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 15:58:08 +0200 +Subject: net: lan966x: Remove ptp traps in case the ptp is not enabled. + +From: Horatiu Vultur + +[ Upstream commit eda40be3a5ff3fdce513d2bcfeaca8cc16cf962a ] + +Lan966x is adding ptp traps to redirect the ptp frames to the CPU such +that the HW will not forward these frames anywhere. The issue is that in +case ptp is not enabled and the timestamping source is et to +HWTSTAMP_SOURCE_NETDEV then these traps would not be removed on the +error path. +Fix this by removing the traps in this case as they are not needed. + +Fixes: 54e1ed69c40a ("net: lan966x: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()") +Suggested-by: Vladimir Oltean +Reviewed-by: Vladimir Oltean +Signed-off-by: Horatiu Vultur +Link: https://lore.kernel.org/r/20240517135808.3025435-1-horatiu.vultur@microchip.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/lan966x/lan966x_main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c +index 61d88207eed42..6695ed661ef83 100644 +--- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c ++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c +@@ -474,14 +474,14 @@ static int lan966x_port_hwtstamp_set(struct net_device *dev, + cfg->source != HWTSTAMP_SOURCE_PHYLIB) + return -EOPNOTSUPP; + ++ if (cfg->source == HWTSTAMP_SOURCE_NETDEV && !port->lan966x->ptp) ++ return -EOPNOTSUPP; ++ + err = lan966x_ptp_setup_traps(port, cfg); + if (err) + return err; + + if (cfg->source == HWTSTAMP_SOURCE_NETDEV) { +- if (!port->lan966x->ptp) +- return -EOPNOTSUPP; +- + err = lan966x_ptp_hwtstamp_set(port, cfg, extack); + if (err) { + lan966x_ptp_del_traps(port); +-- +2.43.0 + diff --git a/queue-6.9/net-relax-socket-state-check-at-accept-time.patch b/queue-6.9/net-relax-socket-state-check-at-accept-time.patch new file mode 100644 index 00000000000..efc87c62acd --- /dev/null +++ b/queue-6.9/net-relax-socket-state-check-at-accept-time.patch @@ -0,0 +1,88 @@ +From d619197e09a2267d7066e20ad7a24d3582366607 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 16:01:00 +0200 +Subject: net: relax socket state check at accept time. + +From: Paolo Abeni + +[ Upstream commit 26afda78cda3da974fd4c287962c169e9462c495 ] + +Christoph reported the following splat: + +WARNING: CPU: 1 PID: 772 at net/ipv4/af_inet.c:761 __inet_accept+0x1f4/0x4a0 +Modules linked in: +CPU: 1 PID: 772 Comm: syz-executor510 Not tainted 6.9.0-rc7-g7da7119fe22b #56 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 +RIP: 0010:__inet_accept+0x1f4/0x4a0 net/ipv4/af_inet.c:759 +Code: 04 38 84 c0 0f 85 87 00 00 00 41 c7 04 24 03 00 00 00 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 ec b7 da fd <0f> 0b e9 7f fe ff ff e8 e0 b7 da fd 0f 0b e9 fe fe ff ff 89 d9 80 +RSP: 0018:ffffc90000c2fc58 EFLAGS: 00010293 +RAX: ffffffff836bdd14 RBX: 0000000000000000 RCX: ffff888104668000 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +RBP: dffffc0000000000 R08: ffffffff836bdb89 R09: fffff52000185f64 +R10: dffffc0000000000 R11: fffff52000185f64 R12: dffffc0000000000 +R13: 1ffff92000185f98 R14: ffff88810754d880 R15: ffff8881007b7800 +FS: 000000001c772880(0000) GS:ffff88811b280000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fb9fcf2e178 CR3: 00000001045d2002 CR4: 0000000000770ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + + inet_accept+0x138/0x1d0 net/ipv4/af_inet.c:786 + do_accept+0x435/0x620 net/socket.c:1929 + __sys_accept4_file net/socket.c:1969 [inline] + __sys_accept4+0x9b/0x110 net/socket.c:1999 + __do_sys_accept net/socket.c:2016 [inline] + __se_sys_accept net/socket.c:2013 [inline] + __x64_sys_accept+0x7d/0x90 net/socket.c:2013 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x58/0x100 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x76/0x7e +RIP: 0033:0x4315f9 +Code: fd ff 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab b4 fd ff c3 66 2e 0f 1f 84 00 00 00 00 +RSP: 002b:00007ffdb26d9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002b +RAX: ffffffffffffffda RBX: 0000000000400300 RCX: 00000000004315f9 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 +RBP: 00000000006e1018 R08: 0000000000400300 R09: 0000000000400300 +R10: 0000000000400300 R11: 0000000000000246 R12: 0000000000000000 +R13: 000000000040cdf0 R14: 000000000040ce80 R15: 0000000000000055 + + +The reproducer invokes shutdown() before entering the listener status. +After commit 94062790aedb ("tcp: defer shutdown(SEND_SHUTDOWN) for +TCP_SYN_RECV sockets"), the above causes the child to reach the accept +syscall in FIN_WAIT1 status. + +Eric noted we can relax the existing assertion in __inet_accept() + +Reported-by: Christoph Paasch +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/490 +Suggested-by: Eric Dumazet +Fixes: 94062790aedb ("tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets") +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/23ab880a44d8cfd967e84de8b93dbf48848e3d8c.1716299669.git.pabeni@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/af_inet.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index fafb123f798be..c6bebca49591f 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -758,7 +758,9 @@ void __inet_accept(struct socket *sock, struct socket *newsock, struct sock *new + sock_rps_record_flow(newsk); + WARN_ON(!((1 << newsk->sk_state) & + (TCPF_ESTABLISHED | TCPF_SYN_RECV | +- TCPF_CLOSE_WAIT | TCPF_CLOSE))); ++ TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | ++ TCPF_CLOSING | TCPF_CLOSE_WAIT | ++ TCPF_CLOSE))); + + if (test_bit(SOCK_SUPPORT_ZC, &sock->flags)) + set_bit(SOCK_SUPPORT_ZC, &newsock->flags); +-- +2.43.0 + diff --git a/queue-6.9/netfs-fix-setting-of-bdp_async-from-iocb-flags.patch b/queue-6.9/netfs-fix-setting-of-bdp_async-from-iocb-flags.patch new file mode 100644 index 00000000000..49281cc5f3a --- /dev/null +++ b/queue-6.9/netfs-fix-setting-of-bdp_async-from-iocb-flags.patch @@ -0,0 +1,57 @@ +From 3efb206ecfbcd4a666c8f36bc616073abf469406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 16:49:46 +0100 +Subject: netfs: Fix setting of BDP_ASYNC from iocb flags + +From: David Howells + +[ Upstream commit c596bea1452ddf172ec9b588e4597228e9a1f4d5 ] + +Fix netfs_perform_write() to set BDP_ASYNC if IOCB_NOWAIT is set rather +than if IOCB_SYNC is not set. It reflects asynchronicity in the sense of +not waiting rather than synchronicity in the sense of not returning until +the op is complete. + +Without this, generic/590 fails on cifs in strict caching mode with a +complaint that one of the writes fails with EAGAIN. The test can be +distilled down to: + + mount -t cifs /my/share /mnt -ostuff + xfs_io -i -c 'falloc 0 8191M -c fsync -f /mnt/file + xfs_io -i -c 'pwrite -b 1M -W 0 8191M' /mnt/file + +Fixes: c38f4e96e605 ("netfs: Provide func to copy data to pagecache for buffered write") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/316306.1716306586@warthog.procyon.org.uk +Reviewed-by: Jens Axboe +cc: Jeff Layton +cc: Enzo Matsumiya +cc: Jens Axboe +cc: Matthew Wilcox +cc: netfs@lists.linux.dev +cc: v9fs@lists.linux.dev +cc: linux-afs@lists.infradead.org +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/buffered_write.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c +index 267b622d923b1..912ad0a1df021 100644 +--- a/fs/netfs/buffered_write.c ++++ b/fs/netfs/buffered_write.c +@@ -163,7 +163,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter, + struct folio *folio; + enum netfs_how_to_modify howto; + enum netfs_folio_trace trace; +- unsigned int bdp_flags = (iocb->ki_flags & IOCB_SYNC) ? 0: BDP_ASYNC; ++ unsigned int bdp_flags = (iocb->ki_flags & IOCB_NOWAIT) ? BDP_ASYNC : 0; + ssize_t written = 0, ret, ret2; + loff_t i_size, pos = iocb->ki_pos, from, to; + size_t max_chunk = PAGE_SIZE << MAX_PAGECACHE_ORDER; +-- +2.43.0 + diff --git a/queue-6.9/nfc-nci-fix-handling-of-zero-length-payload-packets-.patch b/queue-6.9/nfc-nci-fix-handling-of-zero-length-payload-packets-.patch new file mode 100644 index 00000000000..b592bae27a2 --- /dev/null +++ b/queue-6.9/nfc-nci-fix-handling-of-zero-length-payload-packets-.patch @@ -0,0 +1,42 @@ +From 65e195fd994538a4ab726d872b22dc020b560679 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 00:34:42 +0900 +Subject: nfc: nci: Fix handling of zero-length payload packets in + nci_rx_work() + +From: Ryosuke Yasuoka + +[ Upstream commit 6671e352497ca4bb07a96c48e03907065ff77d8a ] + +When nci_rx_work() receives a zero-length payload packet, it should not +discard the packet and exit the loop. Instead, it should continue +processing subsequent packets. + +Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet") +Signed-off-by: Ryosuke Yasuoka +Reviewed-by: Simon Horman +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20240521153444.535399-1-ryasuoka@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/nfc/nci/core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index 7a9897fbf4f41..f456a5911e7d1 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -1531,8 +1531,7 @@ static void nci_rx_work(struct work_struct *work) + + if (!nci_valid_size(skb)) { + kfree_skb(skb); +- kcov_remote_stop(); +- break; ++ continue; + } + + /* Process frame */ +-- +2.43.0 + diff --git a/queue-6.9/nfc-nci-fix-uninit-value-in-nci_rx_work.patch b/queue-6.9/nfc-nci-fix-uninit-value-in-nci_rx_work.patch new file mode 100644 index 00000000000..8cfc518be8d --- /dev/null +++ b/queue-6.9/nfc-nci-fix-uninit-value-in-nci_rx_work.patch @@ -0,0 +1,63 @@ +From 4715cddb7d482aad44f4d78c78ffb5902f999841 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 May 2024 18:43:03 +0900 +Subject: nfc: nci: Fix uninit-value in nci_rx_work + +From: Ryosuke Yasuoka + +[ Upstream commit e4a87abf588536d1cdfb128595e6e680af5cf3ed ] + +syzbot reported the following uninit-value access issue [1] + +nci_rx_work() parses received packet from ndev->rx_q. It should be +validated header size, payload size and total packet size before +processing the packet. If an invalid packet is detected, it should be +silently discarded. + +Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet") +Reported-and-tested-by: syzbot+d7b4dc6cd50410152534@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=d7b4dc6cd50410152534 [1] +Signed-off-by: Ryosuke Yasuoka +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/nci/core.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index b133dc55304ce..7a9897fbf4f41 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -1463,6 +1463,19 @@ int nci_core_ntf_packet(struct nci_dev *ndev, __u16 opcode, + ndev->ops->n_core_ops); + } + ++static bool nci_valid_size(struct sk_buff *skb) ++{ ++ BUILD_BUG_ON(NCI_CTRL_HDR_SIZE != NCI_DATA_HDR_SIZE); ++ unsigned int hdr_size = NCI_CTRL_HDR_SIZE; ++ ++ if (skb->len < hdr_size || ++ !nci_plen(skb->data) || ++ skb->len < hdr_size + nci_plen(skb->data)) { ++ return false; ++ } ++ return true; ++} ++ + /* ---- NCI TX Data worker thread ---- */ + + static void nci_tx_work(struct work_struct *work) +@@ -1516,7 +1529,7 @@ static void nci_rx_work(struct work_struct *work) + nfc_send_to_raw_sock(ndev->nfc_dev, skb, + RAW_PAYLOAD_NCI, NFC_DIRECTION_RX); + +- if (!nci_plen(skb->data)) { ++ if (!nci_valid_size(skb)) { + kfree_skb(skb); + kcov_remote_stop(); + break; +-- +2.43.0 + diff --git a/queue-6.9/nfs-keep-server-info-for-remounts.patch b/queue-6.9/nfs-keep-server-info-for-remounts.patch new file mode 100644 index 00000000000..7180c0fe07d --- /dev/null +++ b/queue-6.9/nfs-keep-server-info-for-remounts.patch @@ -0,0 +1,55 @@ +From 4b2a4ed7490a9fe4a30fdda0b8a6849bd571ebde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Apr 2024 19:01:09 +0200 +Subject: nfs: keep server info for remounts + +From: Martin Kaiser + +[ Upstream commit b322bf9e983addedff0894c55e92d58f4d16d92a ] + +With newer kernels that use fs_context for nfs mounts, remounts fail with +-EINVAL. + +$ mount -t nfs -o nolock 10.0.0.1:/tmp/test /mnt/test/ +$ mount -t nfs -o remount /mnt/test/ +mount: mounting 10.0.0.1:/tmp/test on /mnt/test failed: Invalid argument + +For remounts, the nfs server address and port are populated by +nfs_init_fs_context and later overwritten with 0x00 bytes by +nfs23_parse_monolithic. The remount then fails as the server address is +invalid. + +Fix this by not overwriting nfs server info in nfs23_parse_monolithic if +we're doing a remount. + +Fixes: f2aedb713c28 ("NFS: Add fs_context support.") +Signed-off-by: Martin Kaiser +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/fs_context.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c +index d0a0956f8a134..cac1157be2c29 100644 +--- a/fs/nfs/fs_context.c ++++ b/fs/nfs/fs_context.c +@@ -1112,9 +1112,12 @@ static int nfs23_parse_monolithic(struct fs_context *fc, + ctx->acdirmax = data->acdirmax; + ctx->need_mount = false; + +- memcpy(sap, &data->addr, sizeof(data->addr)); +- ctx->nfs_server.addrlen = sizeof(data->addr); +- ctx->nfs_server.port = ntohs(data->addr.sin_port); ++ if (!is_remount_fc(fc)) { ++ memcpy(sap, &data->addr, sizeof(data->addr)); ++ ctx->nfs_server.addrlen = sizeof(data->addr); ++ ctx->nfs_server.port = ntohs(data->addr.sin_port); ++ } ++ + if (sap->ss_family != AF_INET || + !nfs_verify_server_address(sap)) + goto out_no_address; +-- +2.43.0 + diff --git a/queue-6.9/nfsv4-fixup-smatch-warning-for-ambiguous-return.patch b/queue-6.9/nfsv4-fixup-smatch-warning-for-ambiguous-return.patch new file mode 100644 index 00000000000..0b4642add7c --- /dev/null +++ b/queue-6.9/nfsv4-fixup-smatch-warning-for-ambiguous-return.patch @@ -0,0 +1,67 @@ +From f644244f86a77cf78484fdc6dc6d7290a6653483 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 14:49:29 -0400 +Subject: NFSv4: Fixup smatch warning for ambiguous return + +From: Benjamin Coddington + +[ Upstream commit 37ffe06537af3e3ec212e7cbe941046fce0a822f ] + +Dan Carpenter reports smatch warning for nfs4_try_migration() when a memory +allocation failure results in a zero return value. In this case, a +transient allocation failure error will likely be retried the next time the +server responds with NFS4ERR_MOVED. + +We can fixup the smatch warning with a small refactor: attempt all three +allocations before testing and returning on a failure. + +Reported-by: Dan Carpenter +Fixes: c3ed222745d9 ("NFSv4: Fix free of uninitialized nfs4_label on referral lookup.") +Signed-off-by: Benjamin Coddington +Reviewed-by: Dan Carpenter +Reviewed-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4state.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 662e86ea3a2dd..5b452411e8fdf 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -2116,6 +2116,7 @@ static int nfs4_try_migration(struct nfs_server *server, const struct cred *cred + { + struct nfs_client *clp = server->nfs_client; + struct nfs4_fs_locations *locations = NULL; ++ struct nfs_fattr *fattr; + struct inode *inode; + struct page *page; + int status, result; +@@ -2125,19 +2126,16 @@ static int nfs4_try_migration(struct nfs_server *server, const struct cred *cred + (unsigned long long)server->fsid.minor, + clp->cl_hostname); + +- result = 0; + page = alloc_page(GFP_KERNEL); + locations = kmalloc(sizeof(struct nfs4_fs_locations), GFP_KERNEL); +- if (page == NULL || locations == NULL) { +- dprintk("<-- %s: no memory\n", __func__); +- goto out; +- } +- locations->fattr = nfs_alloc_fattr(); +- if (locations->fattr == NULL) { ++ fattr = nfs_alloc_fattr(); ++ if (page == NULL || locations == NULL || fattr == NULL) { + dprintk("<-- %s: no memory\n", __func__); ++ result = 0; + goto out; + } + ++ locations->fattr = fattr; + inode = d_inode(server->super->s_root); + result = nfs4_proc_get_locations(server, NFS_FH(inode), locations, + page, cred); +-- +2.43.0 + diff --git a/queue-6.9/nilfs2-make-superblock-data-array-index-computation-.patch b/queue-6.9/nilfs2-make-superblock-data-array-index-computation-.patch new file mode 100644 index 00000000000..41b61c1a8f1 --- /dev/null +++ b/queue-6.9/nilfs2-make-superblock-data-array-index-computation-.patch @@ -0,0 +1,73 @@ +From 5ca468e18e9074ae6ba779845a555fd869fffac1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 17:00:19 +0900 +Subject: nilfs2: make superblock data array index computation sparse friendly + +From: Ryusuke Konishi + +[ Upstream commit 91d743a9c8299de1fc1b47428d8bb4c85face00f ] + +Upon running sparse, "warning: dubious: x & !y" is output at an array +index calculation within nilfs_load_super_block(). + +The calculation is not wrong, but to eliminate the sparse warning, replace +it with an equivalent calculation. + +Also, add a comment to make it easier to understand what the unintuitive +array index calculation is doing and whether it's correct. + +Link: https://lkml.kernel.org/r/20240430080019.4242-3-konishi.ryusuke@gmail.com +Fixes: e339ad31f599 ("nilfs2: introduce secondary super block") +Signed-off-by: Ryusuke Konishi +Cc: Bart Van Assche +Cc: Jens Axboe +Cc: kernel test robot +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/the_nilfs.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c +index 2ae2c1bbf6d17..adbc6e87471ab 100644 +--- a/fs/nilfs2/the_nilfs.c ++++ b/fs/nilfs2/the_nilfs.c +@@ -592,7 +592,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs, + struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct buffer_head **sbh = nilfs->ns_sbh; + u64 sb2off, devsize = bdev_nr_bytes(nilfs->ns_bdev); +- int valid[2], swp = 0; ++ int valid[2], swp = 0, older; + + if (devsize < NILFS_SEG_MIN_BLOCKS * NILFS_MIN_BLOCK_SIZE + 4096) { + nilfs_err(sb, "device size too small"); +@@ -648,9 +648,25 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs, + if (swp) + nilfs_swap_super_block(nilfs); + ++ /* ++ * Calculate the array index of the older superblock data. ++ * If one has been dropped, set index 0 pointing to the remaining one, ++ * otherwise set index 1 pointing to the old one (including if both ++ * are the same). ++ * ++ * Divided case valid[0] valid[1] swp -> older ++ * ------------------------------------------------------------- ++ * Both SBs are invalid 0 0 N/A (Error) ++ * SB1 is invalid 0 1 1 0 ++ * SB2 is invalid 1 0 0 0 ++ * SB2 is newer 1 1 1 0 ++ * SB2 is older or the same 1 1 0 1 ++ */ ++ older = valid[1] ^ swp; ++ + nilfs->ns_sbwcount = 0; + nilfs->ns_sbwtime = le64_to_cpu(sbp[0]->s_wtime); +- nilfs->ns_prot_seq = le64_to_cpu(sbp[valid[1] & !swp]->s_last_seq); ++ nilfs->ns_prot_seq = le64_to_cpu(sbp[older]->s_last_seq); + *sbpp = sbp[0]; + return 0; + } +-- +2.43.0 + diff --git a/queue-6.9/null_blk-fix-null-ptr-dereference-while-configuring-.patch b/queue-6.9/null_blk-fix-null-ptr-dereference-while-configuring-.patch new file mode 100644 index 00000000000..ea12f86a2cb --- /dev/null +++ b/queue-6.9/null_blk-fix-null-ptr-dereference-while-configuring-.patch @@ -0,0 +1,176 @@ +From b46da34ecca05ed47090549b0a6dbd92116ea34b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 23:39:34 +0800 +Subject: null_blk: fix null-ptr-dereference while configuring 'power' and + 'submit_queues' + +From: Yu Kuai + +[ Upstream commit a2db328b0839312c169eb42746ec46fc1ab53ed2 ] + +Writing 'power' and 'submit_queues' concurrently will trigger kernel +panic: + +Test script: + +modprobe null_blk nr_devices=0 +mkdir -p /sys/kernel/config/nullb/nullb0 +while true; do echo 1 > submit_queues; echo 4 > submit_queues; done & +while true; do echo 1 > power; echo 0 > power; done + +Test result: + +BUG: kernel NULL pointer dereference, address: 0000000000000148 +Oops: 0000 [#1] PREEMPT SMP +RIP: 0010:__lock_acquire+0x41d/0x28f0 +Call Trace: + + lock_acquire+0x121/0x450 + down_write+0x5f/0x1d0 + simple_recursive_removal+0x12f/0x5c0 + blk_mq_debugfs_unregister_hctxs+0x7c/0x100 + blk_mq_update_nr_hw_queues+0x4a3/0x720 + nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] + nullb_device_submit_queues_store+0x79/0xf0 [null_blk] + configfs_write_iter+0x119/0x1e0 + vfs_write+0x326/0x730 + ksys_write+0x74/0x150 + +This is because del_gendisk() can concurrent with +blk_mq_update_nr_hw_queues(): + +nullb_device_power_store nullb_apply_submit_queues + null_del_dev + del_gendisk + nullb_update_nr_hw_queues + if (!dev->nullb) + // still set while gendisk is deleted + return 0 + blk_mq_update_nr_hw_queues + dev->nullb = NULL + +Fix this problem by resuing the global mutex to protect +nullb_device_power_store() and nullb_update_nr_hw_queues() from configfs. + +Fixes: 45919fbfe1c4 ("null_blk: Enable modifying 'submit_queues' after an instance has been configured") +Reported-and-tested-by: Yi Zhang +Closes: https://lore.kernel.org/all/CAHj4cs9LgsHLnjg8z06LQ3Pr5cax-+Ps+xT7AP7TPnEjStuwZA@mail.gmail.com/ +Signed-off-by: Yu Kuai +Reviewed-by: Zhu Yanjun +Link: https://lore.kernel.org/r/20240523153934.1937851-1-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 40 +++++++++++++++++++++++------------ + 1 file changed, 26 insertions(+), 14 deletions(-) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 14ffda1ffe6c3..3b3fd093b0044 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -404,13 +404,25 @@ static int nullb_update_nr_hw_queues(struct nullb_device *dev, + static int nullb_apply_submit_queues(struct nullb_device *dev, + unsigned int submit_queues) + { +- return nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues); ++ int ret; ++ ++ mutex_lock(&lock); ++ ret = nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues); ++ mutex_unlock(&lock); ++ ++ return ret; + } + + static int nullb_apply_poll_queues(struct nullb_device *dev, + unsigned int poll_queues) + { +- return nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues); ++ int ret; ++ ++ mutex_lock(&lock); ++ ret = nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues); ++ mutex_unlock(&lock); ++ ++ return ret; + } + + NULLB_DEVICE_ATTR(size, ulong, NULL); +@@ -457,28 +469,31 @@ static ssize_t nullb_device_power_store(struct config_item *item, + if (ret < 0) + return ret; + ++ ret = count; ++ mutex_lock(&lock); + if (!dev->power && newp) { + if (test_and_set_bit(NULLB_DEV_FL_UP, &dev->flags)) +- return count; ++ goto out; ++ + ret = null_add_dev(dev); + if (ret) { + clear_bit(NULLB_DEV_FL_UP, &dev->flags); +- return ret; ++ goto out; + } + + set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags); + dev->power = newp; + } else if (dev->power && !newp) { + if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) { +- mutex_lock(&lock); + dev->power = newp; + null_del_dev(dev->nullb); +- mutex_unlock(&lock); + } + clear_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags); + } + +- return count; ++out: ++ mutex_unlock(&lock); ++ return ret; + } + + CONFIGFS_ATTR(nullb_device_, power); +@@ -1918,15 +1933,12 @@ static int null_add_dev(struct nullb_device *dev) + nullb->q->queuedata = nullb; + blk_queue_flag_set(QUEUE_FLAG_NONROT, nullb->q); + +- mutex_lock(&lock); + rv = ida_alloc(&nullb_indexes, GFP_KERNEL); +- if (rv < 0) { +- mutex_unlock(&lock); ++ if (rv < 0) + goto out_cleanup_disk; +- } ++ + nullb->index = rv; + dev->index = rv; +- mutex_unlock(&lock); + + if (config_item_name(&dev->group.cg_item)) { + /* Use configfs dir name as the device name */ +@@ -1955,9 +1967,7 @@ static int null_add_dev(struct nullb_device *dev) + if (rv) + goto out_ida_free; + +- mutex_lock(&lock); + list_add_tail(&nullb->list, &nullb_list); +- mutex_unlock(&lock); + + pr_info("disk %s created\n", nullb->disk_name); + +@@ -2006,7 +2016,9 @@ static int null_create_dev(void) + if (!dev) + return -ENOMEM; + ++ mutex_lock(&lock); + ret = null_add_dev(dev); ++ mutex_unlock(&lock); + if (ret) { + null_free_dev(dev); + return ret; +-- +2.43.0 + diff --git a/queue-6.9/null_blk-fix-the-warning-modpost-missing-module_desc.patch b/queue-6.9/null_blk-fix-the-warning-modpost-missing-module_desc.patch new file mode 100644 index 00000000000..1ad2a5f19d1 --- /dev/null +++ b/queue-6.9/null_blk-fix-the-warning-modpost-missing-module_desc.patch @@ -0,0 +1,34 @@ +From 9b760a024c38abeae81894b4c96985e2c88581ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 09:55:38 +0200 +Subject: null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() + +From: Zhu Yanjun + +[ Upstream commit 9e6727f824edcdb8fdd3e6e8a0862eb49546e1cd ] + +No functional changes intended. + +Fixes: f2298c0403b0 ("null_blk: multi queue aware block test driver") +Signed-off-by: Zhu Yanjun +Reviewed-by: Chaitanya Kulkarni +Link: https://lore.kernel.org/r/20240506075538.6064-1-yanjun.zhu@linux.dev +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index eed63f95e89d0..14ffda1ffe6c3 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -2121,4 +2121,5 @@ module_init(null_init); + module_exit(null_exit); + + MODULE_AUTHOR("Jens Axboe "); ++MODULE_DESCRIPTION("multi queue aware block test driver"); + MODULE_LICENSE("GPL"); +-- +2.43.0 + diff --git a/queue-6.9/openvswitch-set-the-skbuff-pkt_type-for-proper-pmtud.patch b/queue-6.9/openvswitch-set-the-skbuff-pkt_type-for-proper-pmtud.patch new file mode 100644 index 00000000000..b0a086e044f --- /dev/null +++ b/queue-6.9/openvswitch-set-the-skbuff-pkt_type-for-proper-pmtud.patch @@ -0,0 +1,101 @@ +From bbaaf07a481fb1662146a7e026c19554504eaab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 16:09:41 -0400 +Subject: openvswitch: Set the skbuff pkt_type for proper pmtud support. + +From: Aaron Conole + +[ Upstream commit 30a92c9e3d6b073932762bef2ac66f4ee784c657 ] + +Open vSwitch is originally intended to switch at layer 2, only dealing with +Ethernet frames. With the introduction of l3 tunnels support, it crossed +into the realm of needing to care a bit about some routing details when +making forwarding decisions. If an oversized packet would need to be +fragmented during this forwarding decision, there is a chance for pmtu +to get involved and generate a routing exception. This is gated by the +skbuff->pkt_type field. + +When a flow is already loaded into the openvswitch module this field is +set up and transitioned properly as a packet moves from one port to +another. In the case that a packet execute is invoked after a flow is +newly installed this field is not properly initialized. This causes the +pmtud mechanism to omit sending the required exception messages across +the tunnel boundary and a second attempt needs to be made to make sure +that the routing exception is properly setup. To fix this, we set the +outgoing packet's pkt_type to PACKET_OUTGOING, since it can only get +to the openvswitch module via a port device or packet command. + +Even for bridge ports as users, the pkt_type needs to be reset when +doing the transmit as the packet is truly outgoing and routing needs +to get involved post packet transformations, in the case of +VXLAN/GENEVE/udp-tunnel packets. In general, the pkt_type on output +gets ignored, since we go straight to the driver, but in the case of +tunnel ports they go through IP routing layer. + +This issue is periodically encountered in complex setups, such as large +openshift deployments, where multiple sets of tunnel traversal occurs. +A way to recreate this is with the ovn-heater project that can setup +a networking environment which mimics such large deployments. We need +larger environments for this because we need to ensure that flow +misses occur. In these environment, without this patch, we can see: + + ./ovn_cluster.sh start + podman exec ovn-chassis-1 ip r a 170.168.0.5/32 dev eth1 mtu 1200 + podman exec ovn-chassis-1 ip netns exec sw01p1 ip r flush cache + podman exec ovn-chassis-1 ip netns exec sw01p1 \ + ping 21.0.0.3 -M do -s 1300 -c2 + PING 21.0.0.3 (21.0.0.3) 1300(1328) bytes of data. + From 21.0.0.3 icmp_seq=2 Frag needed and DF set (mtu = 1142) + + --- 21.0.0.3 ping statistics --- + ... + +Using tcpdump, we can also see the expected ICMP FRAG_NEEDED message is not +sent into the server. + +With this patch, setting the pkt_type, we see the following: + + podman exec ovn-chassis-1 ip netns exec sw01p1 \ + ping 21.0.0.3 -M do -s 1300 -c2 + PING 21.0.0.3 (21.0.0.3) 1300(1328) bytes of data. + From 21.0.0.3 icmp_seq=1 Frag needed and DF set (mtu = 1222) + ping: local error: message too long, mtu=1222 + + --- 21.0.0.3 ping statistics --- + ... + +In this case, the first ping request receives the FRAG_NEEDED message and +a local routing exception is created. + +Tested-by: Jaime Caamano +Reported-at: https://issues.redhat.com/browse/FDP-164 +Fixes: 58264848a5a7 ("openvswitch: Add vxlan tunneling support.") +Signed-off-by: Aaron Conole +Acked-by: Eelco Chaudron +Link: https://lore.kernel.org/r/20240516200941.16152-1-aconole@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/openvswitch/actions.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index 6fcd7e2ca81fe..9642255808247 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -936,6 +936,12 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port, + pskb_trim(skb, ovs_mac_header_len(key)); + } + ++ /* Need to set the pkt_type to involve the routing layer. The ++ * packet movement through the OVS datapath doesn't generally ++ * use routing, but this is needed for tunnel cases. ++ */ ++ skb->pkt_type = PACKET_OUTGOING; ++ + if (likely(!mru || + (skb->len <= mru + vport->dev->hard_header_len))) { + ovs_vport_send(vport, skb, ovs_key_mac_proto(key)); +-- +2.43.0 + diff --git a/queue-6.9/perf-arm-dmc620-fix-lockdep-assert-in-event_init.patch b/queue-6.9/perf-arm-dmc620-fix-lockdep-assert-in-event_init.patch new file mode 100644 index 00000000000..3e8f098ab42 --- /dev/null +++ b/queue-6.9/perf-arm-dmc620-fix-lockdep-assert-in-event_init.patch @@ -0,0 +1,61 @@ +From c1f4d91f42f2068809b118f9bc9f97ed30db6ec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 11:00:50 -0700 +Subject: perf/arm-dmc620: Fix lockdep assert in ->event_init() + +From: Namhyung Kim + +[ Upstream commit a4c5a457c6107dfe9dc65a104af1634811396bac ] + +for_each_sibling_event() checks leader's ctx but it doesn't have the ctx +yet if it's the leader. Like in perf_event_validate_size(), we should +skip checking siblings in that case. + +Acked-by: Mark Rutland +Fixes: f3c0eba28704 ("perf: Add a few assertions") +Reported-by: Greg Thelen +Cc: Robin Murphy +Cc: Tuan Phan +Signed-off-by: Namhyung Kim +Reviewed-by: Robin Murphy +Link: https://lore.kernel.org/r/20240514180050.182454-1-namhyung@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_dmc620_pmu.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/perf/arm_dmc620_pmu.c b/drivers/perf/arm_dmc620_pmu.c +index 8a81be2dd5ecf..88c17c1d6d499 100644 +--- a/drivers/perf/arm_dmc620_pmu.c ++++ b/drivers/perf/arm_dmc620_pmu.c +@@ -542,12 +542,16 @@ static int dmc620_pmu_event_init(struct perf_event *event) + if (event->cpu < 0) + return -EINVAL; + ++ hwc->idx = -1; ++ ++ if (event->group_leader == event) ++ return 0; ++ + /* + * We can't atomically disable all HW counters so only one event allowed, + * although software events are acceptable. + */ +- if (event->group_leader != event && +- !is_software_event(event->group_leader)) ++ if (!is_software_event(event->group_leader)) + return -EINVAL; + + for_each_sibling_event(sibling, event->group_leader) { +@@ -556,7 +560,6 @@ static int dmc620_pmu_event_init(struct perf_event *event) + return -EINVAL; + } + +- hwc->idx = -1; + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.9/phy-qcom-qmp-combo-fix-sm8650-voltage-swing-table.patch b/queue-6.9/phy-qcom-qmp-combo-fix-sm8650-voltage-swing-table.patch new file mode 100644 index 00000000000..3087b63919e --- /dev/null +++ b/queue-6.9/phy-qcom-qmp-combo-fix-sm8650-voltage-swing-table.patch @@ -0,0 +1,107 @@ +From 6ed19f589553c0fdd205e36126dbcaaa7c16bf2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 16:22:36 +0100 +Subject: phy: qcom: qmp-combo: fix sm8650 voltage swing table + +From: Neil Armstrong + +[ Upstream commit f320268fcebcbab02631d2070fa19ad4856a5a5e ] + +The QMP USB3/DP PHY found in the SM8650 SoC requires a slightly +different Voltage Swing table for HBR/RBR link speeds. + +Add a new hbr/rbr voltage switch table named "v6" used in a new +sm8650 qmp_phy_cfg struct replacing the sm8550 fallback used for +the sm8650 compatible. + +Fixes: 80c1afe8c5fe ("phy: qcom: qmp-combo: add QMP USB3/DP PHY tables for SM8650") +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20240226-topic-sm8650-upstream-combo-phy-swing-update-v1-1-08707ebca92a@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 54 ++++++++++++++++++++++- + 1 file changed, 53 insertions(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +index c21cdb8dbfe74..acc2b5b9ea255 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +@@ -1382,6 +1382,13 @@ static const u8 qmp_dp_v5_voltage_swing_hbr_rbr[4][4] = { + { 0x3f, 0xff, 0xff, 0xff } + }; + ++static const u8 qmp_dp_v6_voltage_swing_hbr_rbr[4][4] = { ++ { 0x27, 0x2f, 0x36, 0x3f }, ++ { 0x31, 0x3e, 0x3f, 0xff }, ++ { 0x36, 0x3f, 0xff, 0xff }, ++ { 0x3f, 0xff, 0xff, 0xff } ++}; ++ + static const u8 qmp_dp_v6_pre_emphasis_hbr_rbr[4][4] = { + { 0x20, 0x2d, 0x34, 0x3a }, + { 0x20, 0x2e, 0x35, 0xff }, +@@ -2001,6 +2008,51 @@ static const struct qmp_phy_cfg sm8550_usb3dpphy_cfg = { + .num_vregs = ARRAY_SIZE(qmp_phy_vreg_l), + }; + ++static const struct qmp_phy_cfg sm8650_usb3dpphy_cfg = { ++ .offsets = &qmp_combo_offsets_v3, ++ ++ .serdes_tbl = sm8550_usb3_serdes_tbl, ++ .serdes_tbl_num = ARRAY_SIZE(sm8550_usb3_serdes_tbl), ++ .tx_tbl = sm8550_usb3_tx_tbl, ++ .tx_tbl_num = ARRAY_SIZE(sm8550_usb3_tx_tbl), ++ .rx_tbl = sm8550_usb3_rx_tbl, ++ .rx_tbl_num = ARRAY_SIZE(sm8550_usb3_rx_tbl), ++ .pcs_tbl = sm8550_usb3_pcs_tbl, ++ .pcs_tbl_num = ARRAY_SIZE(sm8550_usb3_pcs_tbl), ++ .pcs_usb_tbl = sm8550_usb3_pcs_usb_tbl, ++ .pcs_usb_tbl_num = ARRAY_SIZE(sm8550_usb3_pcs_usb_tbl), ++ ++ .dp_serdes_tbl = qmp_v6_dp_serdes_tbl, ++ .dp_serdes_tbl_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl), ++ .dp_tx_tbl = qmp_v6_dp_tx_tbl, ++ .dp_tx_tbl_num = ARRAY_SIZE(qmp_v6_dp_tx_tbl), ++ ++ .serdes_tbl_rbr = qmp_v6_dp_serdes_tbl_rbr, ++ .serdes_tbl_rbr_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_rbr), ++ .serdes_tbl_hbr = qmp_v6_dp_serdes_tbl_hbr, ++ .serdes_tbl_hbr_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr), ++ .serdes_tbl_hbr2 = qmp_v6_dp_serdes_tbl_hbr2, ++ .serdes_tbl_hbr2_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr2), ++ .serdes_tbl_hbr3 = qmp_v6_dp_serdes_tbl_hbr3, ++ .serdes_tbl_hbr3_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr3), ++ ++ .swing_hbr_rbr = &qmp_dp_v6_voltage_swing_hbr_rbr, ++ .pre_emphasis_hbr_rbr = &qmp_dp_v6_pre_emphasis_hbr_rbr, ++ .swing_hbr3_hbr2 = &qmp_dp_v5_voltage_swing_hbr3_hbr2, ++ .pre_emphasis_hbr3_hbr2 = &qmp_dp_v5_pre_emphasis_hbr3_hbr2, ++ ++ .dp_aux_init = qmp_v4_dp_aux_init, ++ .configure_dp_tx = qmp_v4_configure_dp_tx, ++ .configure_dp_phy = qmp_v4_configure_dp_phy, ++ .calibrate_dp_phy = qmp_v4_calibrate_dp_phy, ++ ++ .regs = qmp_v6_usb3phy_regs_layout, ++ .reset_list = msm8996_usb3phy_reset_l, ++ .num_resets = ARRAY_SIZE(msm8996_usb3phy_reset_l), ++ .vreg_list = qmp_phy_vreg_l, ++ .num_vregs = ARRAY_SIZE(qmp_phy_vreg_l), ++}; ++ + static int qmp_combo_dp_serdes_init(struct qmp_combo *qmp) + { + const struct qmp_phy_cfg *cfg = qmp->cfg; +@@ -3631,7 +3683,7 @@ static const struct of_device_id qmp_combo_of_match_table[] = { + }, + { + .compatible = "qcom,sm8650-qmp-usb3-dp-phy", +- .data = &sm8550_usb3dpphy_cfg, ++ .data = &sm8650_usb3dpphy_cfg, + }, + { + .compatible = "qcom,x1e80100-qmp-usb3-dp-phy", +-- +2.43.0 + diff --git a/queue-6.9/platform-x86-thinkpad_acpi-take-hotkey_mutex-during-.patch b/queue-6.9/platform-x86-thinkpad_acpi-take-hotkey_mutex-during-.patch new file mode 100644 index 00000000000..cf6fee99bc9 --- /dev/null +++ b/queue-6.9/platform-x86-thinkpad_acpi-take-hotkey_mutex-during-.patch @@ -0,0 +1,61 @@ +From ce3f61af123a77847360a41f2a18bd36140e6458 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 14:28:11 +0200 +Subject: platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit e397c564298c2e91aea3887990da8e8eddb65277 ] + +hotkey_exit() already takes the mutex around the hotkey_poll_stop_sync() +call, but not around the other calls. + +commit 38831eaf7d4c ("platform/x86: thinkpad_acpi: use lockdep +annotations") has added lockdep_assert_held() checks to various hotkey +functions. + +These lockdep_assert_held() checks fail causing WARN() backtraces in +dmesg due to missing locking in hotkey_exit(), fix this. + +Fixes: 38831eaf7d4c ("platform/x86: thinkpad_acpi: use lockdep annotations") +Tested-by: Mark Pearson +Signed-off-by: Hans de Goede +Reviewed-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240424122834.19801-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 82429e59999da..87a4a381bd988 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -3044,10 +3044,9 @@ static void tpacpi_send_radiosw_update(void) + + static void hotkey_exit(void) + { +-#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL + mutex_lock(&hotkey_mutex); ++#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL + hotkey_poll_stop_sync(); +- mutex_unlock(&hotkey_mutex); + #endif + dbg_printk(TPACPI_DBG_EXIT | TPACPI_DBG_HKEY, + "restoring original HKEY status and mask\n"); +@@ -3057,6 +3056,8 @@ static void hotkey_exit(void) + hotkey_mask_set(hotkey_orig_mask)) | + hotkey_status_set(false)) != 0) + pr_err("failed to restore hot key mask to BIOS defaults\n"); ++ ++ mutex_unlock(&hotkey_mutex); + } + + static void __init hotkey_unmap(const unsigned int scancode) +-- +2.43.0 + diff --git a/queue-6.9/pnfs-filelayout-fixup-pnfs-allocation-modes.patch b/queue-6.9/pnfs-filelayout-fixup-pnfs-allocation-modes.patch new file mode 100644 index 00000000000..514b65092f7 --- /dev/null +++ b/queue-6.9/pnfs-filelayout-fixup-pnfs-allocation-modes.patch @@ -0,0 +1,45 @@ +From 2721d713319eee0f86b0151c8aaf7c29be3d2dd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 11:15:45 -0400 +Subject: pNFS/filelayout: fixup pNfs allocation modes + +From: Olga Kornievskaia + +[ Upstream commit 3ebcb24646f8c5bfad2866892d3f3cff05514452 ] + +Change left over allocation flags. + +Fixes: a245832aaa99 ("pNFS/files: Ensure pNFS allocation modes are consistent with nfsiod") +Signed-off-by: Olga Kornievskaia +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/filelayout/filelayout.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c +index ce8f8934bca51..569ae4ec60845 100644 +--- a/fs/nfs/filelayout/filelayout.c ++++ b/fs/nfs/filelayout/filelayout.c +@@ -883,7 +883,7 @@ filelayout_pg_init_read(struct nfs_pageio_descriptor *pgio, + NFS4_MAX_UINT64, + IOMODE_READ, + false, +- GFP_KERNEL); ++ nfs_io_gfp_mask()); + if (IS_ERR(pgio->pg_lseg)) { + pgio->pg_error = PTR_ERR(pgio->pg_lseg); + pgio->pg_lseg = NULL; +@@ -907,7 +907,7 @@ filelayout_pg_init_write(struct nfs_pageio_descriptor *pgio, + NFS4_MAX_UINT64, + IOMODE_RW, + false, +- GFP_NOFS); ++ nfs_io_gfp_mask()); + if (IS_ERR(pgio->pg_lseg)) { + pgio->pg_error = PTR_ERR(pgio->pg_lseg); + pgio->pg_lseg = NULL; +-- +2.43.0 + diff --git a/queue-6.9/powerpc-bpf-32-fix-failing-test_bpf-tests.patch b/queue-6.9/powerpc-bpf-32-fix-failing-test_bpf-tests.patch new file mode 100644 index 00000000000..082caa8f6f9 --- /dev/null +++ b/queue-6.9/powerpc-bpf-32-fix-failing-test_bpf-tests.patch @@ -0,0 +1,355 @@ +From 28548456db4fbaa7a100d51dc4f7646e9e78d770 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 16:36:23 +0100 +Subject: powerpc/bpf/32: Fix failing test_bpf tests + +From: Christophe Leroy + +[ Upstream commit 8ecf3c1dab1c675721d3d0255556abe2306fa340 ] + +Recent additions in BPF like cpu v4 instructions, test_bpf module +exhibits the following failures: + + test_bpf: #82 ALU_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) + test_bpf: #83 ALU_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) + test_bpf: #84 ALU64_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) + test_bpf: #85 ALU64_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) + test_bpf: #86 ALU64_MOVSX | BPF_W jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) + + test_bpf: #165 ALU_SDIV_X: -6 / 2 = -3 jited:1 ret 2147483645 != -3 (0x7ffffffd != 0xfffffffd)FAIL (1 times) + test_bpf: #166 ALU_SDIV_K: -6 / 2 = -3 jited:1 ret 2147483645 != -3 (0x7ffffffd != 0xfffffffd)FAIL (1 times) + + test_bpf: #169 ALU_SMOD_X: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times) + test_bpf: #170 ALU_SMOD_K: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times) + + test_bpf: #172 ALU64_SMOD_K: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times) + + test_bpf: #313 BSWAP 16: 0x0123456789abcdef -> 0xefcd + eBPF filter opcode 00d7 (@2) unsupported + jited:0 301 PASS + test_bpf: #314 BSWAP 32: 0x0123456789abcdef -> 0xefcdab89 + eBPF filter opcode 00d7 (@2) unsupported + jited:0 555 PASS + test_bpf: #315 BSWAP 64: 0x0123456789abcdef -> 0x67452301 + eBPF filter opcode 00d7 (@2) unsupported + jited:0 268 PASS + test_bpf: #316 BSWAP 64: 0x0123456789abcdef >> 32 -> 0xefcdab89 + eBPF filter opcode 00d7 (@2) unsupported + jited:0 269 PASS + test_bpf: #317 BSWAP 16: 0xfedcba9876543210 -> 0x1032 + eBPF filter opcode 00d7 (@2) unsupported + jited:0 460 PASS + test_bpf: #318 BSWAP 32: 0xfedcba9876543210 -> 0x10325476 + eBPF filter opcode 00d7 (@2) unsupported + jited:0 320 PASS + test_bpf: #319 BSWAP 64: 0xfedcba9876543210 -> 0x98badcfe + eBPF filter opcode 00d7 (@2) unsupported + jited:0 222 PASS + test_bpf: #320 BSWAP 64: 0xfedcba9876543210 >> 32 -> 0x10325476 + eBPF filter opcode 00d7 (@2) unsupported + jited:0 273 PASS + + test_bpf: #344 BPF_LDX_MEMSX | BPF_B + eBPF filter opcode 0091 (@5) unsupported + jited:0 432 PASS + test_bpf: #345 BPF_LDX_MEMSX | BPF_H + eBPF filter opcode 0089 (@5) unsupported + jited:0 381 PASS + test_bpf: #346 BPF_LDX_MEMSX | BPF_W + eBPF filter opcode 0081 (@5) unsupported + jited:0 505 PASS + + test_bpf: #490 JMP32_JA: Unconditional jump: if (true) return 1 + eBPF filter opcode 0006 (@1) unsupported + jited:0 261 PASS + + test_bpf: Summary: 1040 PASSED, 10 FAILED, [924/1038 JIT'ed] + +Fix them by adding missing processing. + +Fixes: daabb2b098e0 ("bpf/tests: add tests for cpuv4 instructions") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/91de862dda99d170697eb79ffb478678af7e0b27.1709652689.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/ppc-opcode.h | 4 + + arch/powerpc/net/bpf_jit_comp32.c | 137 ++++++++++++++++++++------ + 2 files changed, 110 insertions(+), 31 deletions(-) + +diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h +index 005601243dda4..076ae60b4a55d 100644 +--- a/arch/powerpc/include/asm/ppc-opcode.h ++++ b/arch/powerpc/include/asm/ppc-opcode.h +@@ -510,6 +510,7 @@ + #define PPC_RAW_STB(r, base, i) (0x98000000 | ___PPC_RS(r) | ___PPC_RA(base) | IMM_L(i)) + #define PPC_RAW_LBZ(r, base, i) (0x88000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i)) + #define PPC_RAW_LDX(r, base, b) (0x7c00002a | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b)) ++#define PPC_RAW_LHA(r, base, i) (0xa8000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i)) + #define PPC_RAW_LHZ(r, base, i) (0xa0000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i)) + #define PPC_RAW_LHBRX(r, base, b) (0x7c00062c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b)) + #define PPC_RAW_LWBRX(r, base, b) (0x7c00042c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b)) +@@ -532,6 +533,7 @@ + #define PPC_RAW_MULW(d, a, b) (0x7c0001d6 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b)) + #define PPC_RAW_MULHWU(d, a, b) (0x7c000016 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b)) + #define PPC_RAW_MULI(d, a, i) (0x1c000000 | ___PPC_RT(d) | ___PPC_RA(a) | IMM_L(i)) ++#define PPC_RAW_DIVW(d, a, b) (0x7c0003d6 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b)) + #define PPC_RAW_DIVWU(d, a, b) (0x7c000396 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b)) + #define PPC_RAW_DIVDU(d, a, b) (0x7c000392 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b)) + #define PPC_RAW_DIVDE(t, a, b) (0x7c000352 | ___PPC_RT(t) | ___PPC_RA(a) | ___PPC_RB(b)) +@@ -550,6 +552,8 @@ + #define PPC_RAW_XOR(d, a, b) (0x7c000278 | ___PPC_RA(d) | ___PPC_RS(a) | ___PPC_RB(b)) + #define PPC_RAW_XORI(d, a, i) (0x68000000 | ___PPC_RA(d) | ___PPC_RS(a) | IMM_L(i)) + #define PPC_RAW_XORIS(d, a, i) (0x6c000000 | ___PPC_RA(d) | ___PPC_RS(a) | IMM_L(i)) ++#define PPC_RAW_EXTSB(d, a) (0x7c000774 | ___PPC_RA(d) | ___PPC_RS(a)) ++#define PPC_RAW_EXTSH(d, a) (0x7c000734 | ___PPC_RA(d) | ___PPC_RS(a)) + #define PPC_RAW_EXTSW(d, a) (0x7c0007b4 | ___PPC_RA(d) | ___PPC_RS(a)) + #define PPC_RAW_SLW(d, a, s) (0x7c000030 | ___PPC_RA(d) | ___PPC_RS(a) | ___PPC_RB(s)) + #define PPC_RAW_SLD(d, a, s) (0x7c000036 | ___PPC_RA(d) | ___PPC_RS(a) | ___PPC_RB(s)) +diff --git a/arch/powerpc/net/bpf_jit_comp32.c b/arch/powerpc/net/bpf_jit_comp32.c +index 2f39c50ca729e..43b97032a91c0 100644 +--- a/arch/powerpc/net/bpf_jit_comp32.c ++++ b/arch/powerpc/net/bpf_jit_comp32.c +@@ -450,10 +450,16 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + } + break; + case BPF_ALU | BPF_DIV | BPF_X: /* (u32) dst /= (u32) src */ +- EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, src_reg)); ++ if (off) ++ EMIT(PPC_RAW_DIVW(dst_reg, src2_reg, src_reg)); ++ else ++ EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, src_reg)); + break; + case BPF_ALU | BPF_MOD | BPF_X: /* (u32) dst %= (u32) src */ +- EMIT(PPC_RAW_DIVWU(_R0, src2_reg, src_reg)); ++ if (off) ++ EMIT(PPC_RAW_DIVW(_R0, src2_reg, src_reg)); ++ else ++ EMIT(PPC_RAW_DIVWU(_R0, src2_reg, src_reg)); + EMIT(PPC_RAW_MULW(_R0, src_reg, _R0)); + EMIT(PPC_RAW_SUB(dst_reg, src2_reg, _R0)); + break; +@@ -467,10 +473,16 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + if (imm == 1) { + EMIT(PPC_RAW_MR(dst_reg, src2_reg)); + } else if (is_power_of_2((u32)imm)) { +- EMIT(PPC_RAW_SRWI(dst_reg, src2_reg, ilog2(imm))); ++ if (off) ++ EMIT(PPC_RAW_SRAWI(dst_reg, src2_reg, ilog2(imm))); ++ else ++ EMIT(PPC_RAW_SRWI(dst_reg, src2_reg, ilog2(imm))); + } else { + PPC_LI32(_R0, imm); +- EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, _R0)); ++ if (off) ++ EMIT(PPC_RAW_DIVW(dst_reg, src2_reg, _R0)); ++ else ++ EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, _R0)); + } + break; + case BPF_ALU | BPF_MOD | BPF_K: /* (u32) dst %= (u32) imm */ +@@ -480,11 +492,19 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + if (!is_power_of_2((u32)imm)) { + bpf_set_seen_register(ctx, tmp_reg); + PPC_LI32(tmp_reg, imm); +- EMIT(PPC_RAW_DIVWU(_R0, src2_reg, tmp_reg)); ++ if (off) ++ EMIT(PPC_RAW_DIVW(_R0, src2_reg, tmp_reg)); ++ else ++ EMIT(PPC_RAW_DIVWU(_R0, src2_reg, tmp_reg)); + EMIT(PPC_RAW_MULW(_R0, tmp_reg, _R0)); + EMIT(PPC_RAW_SUB(dst_reg, src2_reg, _R0)); + } else if (imm == 1) { + EMIT(PPC_RAW_LI(dst_reg, 0)); ++ } else if (off) { ++ EMIT(PPC_RAW_SRAWI(_R0, src2_reg, ilog2(imm))); ++ EMIT(PPC_RAW_ADDZE(_R0, _R0)); ++ EMIT(PPC_RAW_SLWI(_R0, _R0, ilog2(imm))); ++ EMIT(PPC_RAW_SUB(dst_reg, src2_reg, _R0)); + } else { + imm = ilog2((u32)imm); + EMIT(PPC_RAW_RLWINM(dst_reg, src2_reg, 0, 32 - imm, 31)); +@@ -497,11 +517,21 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + imm = -imm; + if (!is_power_of_2(imm)) + return -EOPNOTSUPP; +- if (imm == 1) ++ if (imm == 1) { + EMIT(PPC_RAW_LI(dst_reg, 0)); +- else ++ EMIT(PPC_RAW_LI(dst_reg_h, 0)); ++ } else if (off) { ++ EMIT(PPC_RAW_SRAWI(dst_reg_h, src2_reg_h, 31)); ++ EMIT(PPC_RAW_XOR(dst_reg, src2_reg, dst_reg_h)); ++ EMIT(PPC_RAW_SUBFC(dst_reg, dst_reg_h, dst_reg)); ++ EMIT(PPC_RAW_RLWINM(dst_reg, dst_reg, 0, 32 - ilog2(imm), 31)); ++ EMIT(PPC_RAW_XOR(dst_reg, dst_reg, dst_reg_h)); ++ EMIT(PPC_RAW_SUBFC(dst_reg, dst_reg_h, dst_reg)); ++ EMIT(PPC_RAW_SUBFE(dst_reg_h, dst_reg_h, dst_reg_h)); ++ } else { + EMIT(PPC_RAW_RLWINM(dst_reg, src2_reg, 0, 32 - ilog2(imm), 31)); +- EMIT(PPC_RAW_LI(dst_reg_h, 0)); ++ EMIT(PPC_RAW_LI(dst_reg_h, 0)); ++ } + break; + case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */ + if (!imm) +@@ -727,15 +757,30 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + * MOV + */ + case BPF_ALU64 | BPF_MOV | BPF_X: /* dst = src */ +- if (dst_reg == src_reg) +- break; +- EMIT(PPC_RAW_MR(dst_reg, src_reg)); +- EMIT(PPC_RAW_MR(dst_reg_h, src_reg_h)); ++ if (off == 8) { ++ EMIT(PPC_RAW_EXTSB(dst_reg, src_reg)); ++ EMIT(PPC_RAW_SRAWI(dst_reg_h, dst_reg, 31)); ++ } else if (off == 16) { ++ EMIT(PPC_RAW_EXTSH(dst_reg, src_reg)); ++ EMIT(PPC_RAW_SRAWI(dst_reg_h, dst_reg, 31)); ++ } else if (off == 32 && dst_reg == src_reg) { ++ EMIT(PPC_RAW_SRAWI(dst_reg_h, src_reg, 31)); ++ } else if (off == 32) { ++ EMIT(PPC_RAW_MR(dst_reg, src_reg)); ++ EMIT(PPC_RAW_SRAWI(dst_reg_h, src_reg, 31)); ++ } else if (dst_reg != src_reg) { ++ EMIT(PPC_RAW_MR(dst_reg, src_reg)); ++ EMIT(PPC_RAW_MR(dst_reg_h, src_reg_h)); ++ } + break; + case BPF_ALU | BPF_MOV | BPF_X: /* (u32) dst = src */ + /* special mov32 for zext */ + if (imm == 1) + EMIT(PPC_RAW_LI(dst_reg_h, 0)); ++ else if (off == 8) ++ EMIT(PPC_RAW_EXTSB(dst_reg, src_reg)); ++ else if (off == 16) ++ EMIT(PPC_RAW_EXTSH(dst_reg, src_reg)); + else if (dst_reg != src_reg) + EMIT(PPC_RAW_MR(dst_reg, src_reg)); + break; +@@ -751,6 +796,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + * BPF_FROM_BE/LE + */ + case BPF_ALU | BPF_END | BPF_FROM_LE: ++ case BPF_ALU64 | BPF_END | BPF_FROM_LE: + switch (imm) { + case 16: + /* Copy 16 bits to upper part */ +@@ -785,6 +831,8 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + EMIT(PPC_RAW_MR(dst_reg_h, tmp_reg)); + break; + } ++ if (BPF_CLASS(code) == BPF_ALU64 && imm != 64) ++ EMIT(PPC_RAW_LI(dst_reg_h, 0)); + break; + case BPF_ALU | BPF_END | BPF_FROM_BE: + switch (imm) { +@@ -918,11 +966,17 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + * BPF_LDX + */ + case BPF_LDX | BPF_MEM | BPF_B: /* dst = *(u8 *)(ul) (src + off) */ ++ case BPF_LDX | BPF_MEMSX | BPF_B: + case BPF_LDX | BPF_PROBE_MEM | BPF_B: ++ case BPF_LDX | BPF_PROBE_MEMSX | BPF_B: + case BPF_LDX | BPF_MEM | BPF_H: /* dst = *(u16 *)(ul) (src + off) */ ++ case BPF_LDX | BPF_MEMSX | BPF_H: + case BPF_LDX | BPF_PROBE_MEM | BPF_H: ++ case BPF_LDX | BPF_PROBE_MEMSX | BPF_H: + case BPF_LDX | BPF_MEM | BPF_W: /* dst = *(u32 *)(ul) (src + off) */ ++ case BPF_LDX | BPF_MEMSX | BPF_W: + case BPF_LDX | BPF_PROBE_MEM | BPF_W: ++ case BPF_LDX | BPF_PROBE_MEMSX | BPF_W: + case BPF_LDX | BPF_MEM | BPF_DW: /* dst = *(u64 *)(ul) (src + off) */ + case BPF_LDX | BPF_PROBE_MEM | BPF_DW: + /* +@@ -931,7 +985,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + * load only if addr is kernel address (see is_kernel_addr()), otherwise + * set dst_reg=0 and move on. + */ +- if (BPF_MODE(code) == BPF_PROBE_MEM) { ++ if (BPF_MODE(code) == BPF_PROBE_MEM || BPF_MODE(code) == BPF_PROBE_MEMSX) { + PPC_LI32(_R0, TASK_SIZE - off); + EMIT(PPC_RAW_CMPLW(src_reg, _R0)); + PPC_BCC_SHORT(COND_GT, (ctx->idx + 4) * 4); +@@ -953,30 +1007,48 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + * as there are two load instructions for dst_reg_h & dst_reg + * respectively. + */ +- if (size == BPF_DW) ++ if (size == BPF_DW || ++ (size == BPF_B && BPF_MODE(code) == BPF_PROBE_MEMSX)) + PPC_JMP((ctx->idx + 3) * 4); + else + PPC_JMP((ctx->idx + 2) * 4); + } + +- switch (size) { +- case BPF_B: +- EMIT(PPC_RAW_LBZ(dst_reg, src_reg, off)); +- break; +- case BPF_H: +- EMIT(PPC_RAW_LHZ(dst_reg, src_reg, off)); +- break; +- case BPF_W: +- EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off)); +- break; +- case BPF_DW: +- EMIT(PPC_RAW_LWZ(dst_reg_h, src_reg, off)); +- EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off + 4)); +- break; +- } ++ if (BPF_MODE(code) == BPF_MEMSX || BPF_MODE(code) == BPF_PROBE_MEMSX) { ++ switch (size) { ++ case BPF_B: ++ EMIT(PPC_RAW_LBZ(dst_reg, src_reg, off)); ++ EMIT(PPC_RAW_EXTSB(dst_reg, dst_reg)); ++ break; ++ case BPF_H: ++ EMIT(PPC_RAW_LHA(dst_reg, src_reg, off)); ++ break; ++ case BPF_W: ++ EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off)); ++ break; ++ } ++ if (!fp->aux->verifier_zext) ++ EMIT(PPC_RAW_SRAWI(dst_reg_h, dst_reg, 31)); + +- if (size != BPF_DW && !fp->aux->verifier_zext) +- EMIT(PPC_RAW_LI(dst_reg_h, 0)); ++ } else { ++ switch (size) { ++ case BPF_B: ++ EMIT(PPC_RAW_LBZ(dst_reg, src_reg, off)); ++ break; ++ case BPF_H: ++ EMIT(PPC_RAW_LHZ(dst_reg, src_reg, off)); ++ break; ++ case BPF_W: ++ EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off)); ++ break; ++ case BPF_DW: ++ EMIT(PPC_RAW_LWZ(dst_reg_h, src_reg, off)); ++ EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off + 4)); ++ break; ++ } ++ if (size != BPF_DW && !fp->aux->verifier_zext) ++ EMIT(PPC_RAW_LI(dst_reg_h, 0)); ++ } + + if (BPF_MODE(code) == BPF_PROBE_MEM) { + int insn_idx = ctx->idx - 1; +@@ -1068,6 +1140,9 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code + case BPF_JMP | BPF_JA: + PPC_JMP(addrs[i + 1 + off]); + break; ++ case BPF_JMP32 | BPF_JA: ++ PPC_JMP(addrs[i + 1 + imm]); ++ break; + + case BPF_JMP | BPF_JGT | BPF_K: + case BPF_JMP | BPF_JGT | BPF_X: +-- +2.43.0 + diff --git a/queue-6.9/powerpc-pseries-add-failure-related-checks-for-h_get.patch b/queue-6.9/powerpc-pseries-add-failure-related-checks-for-h_get.patch new file mode 100644 index 00000000000..adb9e417710 --- /dev/null +++ b/queue-6.9/powerpc-pseries-add-failure-related-checks-for-h_get.patch @@ -0,0 +1,86 @@ +From 46c1de2f6bdefceed8268f6db9920239341ec56e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 14:50:47 +0530 +Subject: powerpc/pseries: Add failure related checks for h_get_mpp and + h_get_ppp + +From: Shrikanth Hegde + +[ Upstream commit 6d4341638516bf97b9a34947e0bd95035a8230a5 ] + +Couple of Minor fixes: + +- hcall return values are long. Fix that for h_get_mpp, h_get_ppp and +parse_ppp_data + +- If hcall fails, values set should be at-least zero. It shouldn't be +uninitialized values. Fix that for h_get_mpp and h_get_ppp + +Signed-off-by: Shrikanth Hegde +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240412092047.455483-3-sshegde@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/hvcall.h | 2 +- + arch/powerpc/platforms/pseries/lpar.c | 6 +++--- + arch/powerpc/platforms/pseries/lparcfg.c | 6 +++--- + 3 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h +index a41e542ba94dd..51172625fa3a5 100644 +--- a/arch/powerpc/include/asm/hvcall.h ++++ b/arch/powerpc/include/asm/hvcall.h +@@ -570,7 +570,7 @@ struct hvcall_mpp_data { + unsigned long backing_mem; + }; + +-int h_get_mpp(struct hvcall_mpp_data *); ++long h_get_mpp(struct hvcall_mpp_data *mpp_data); + + struct hvcall_mpp_x_data { + unsigned long coalesced_bytes; +diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c +index 4e9916bb03d71..c1d8bee8f7018 100644 +--- a/arch/powerpc/platforms/pseries/lpar.c ++++ b/arch/powerpc/platforms/pseries/lpar.c +@@ -1886,10 +1886,10 @@ notrace void __trace_hcall_exit(long opcode, long retval, unsigned long *retbuf) + * h_get_mpp + * H_GET_MPP hcall returns info in 7 parms + */ +-int h_get_mpp(struct hvcall_mpp_data *mpp_data) ++long h_get_mpp(struct hvcall_mpp_data *mpp_data) + { +- int rc; +- unsigned long retbuf[PLPAR_HCALL9_BUFSIZE]; ++ unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0}; ++ long rc; + + rc = plpar_hcall9(H_GET_MPP, retbuf); + +diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c +index f73c4d1c26af9..fb0189af2dea1 100644 +--- a/arch/powerpc/platforms/pseries/lparcfg.c ++++ b/arch/powerpc/platforms/pseries/lparcfg.c +@@ -113,8 +113,8 @@ struct hvcall_ppp_data { + */ + static unsigned int h_get_ppp(struct hvcall_ppp_data *ppp_data) + { +- unsigned long rc; +- unsigned long retbuf[PLPAR_HCALL9_BUFSIZE]; ++ unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0}; ++ long rc; + + rc = plpar_hcall9(H_GET_PPP, retbuf); + +@@ -193,7 +193,7 @@ static void parse_ppp_data(struct seq_file *m) + struct hvcall_ppp_data ppp_data; + struct device_node *root; + const __be32 *perf_level; +- int rc; ++ long rc; + + rc = h_get_ppp(&ppp_data); + if (rc) +-- +2.43.0 + diff --git a/queue-6.9/printk-fix-log_cpu_max_buf_shift-when-base_small-is-.patch b/queue-6.9/printk-fix-log_cpu_max_buf_shift-when-base_small-is-.patch new file mode 100644 index 00000000000..003da7e15d3 --- /dev/null +++ b/queue-6.9/printk-fix-log_cpu_max_buf_shift-when-base_small-is-.patch @@ -0,0 +1,73 @@ +From 082294625325fa6eaccb4b56f8f7eb2b1013f21f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 10:03:41 +0200 +Subject: printk: Fix LOG_CPU_MAX_BUF_SHIFT when BASE_SMALL is enabled + +From: Yoann Congal + +[ Upstream commit 320bf43190514be5c00e11f47ec2160dd3993844 ] + +LOG_CPU_MAX_BUF_SHIFT default value depends on BASE_SMALL: + config LOG_CPU_MAX_BUF_SHIFT + default 12 if !BASE_SMALL + default 0 if BASE_SMALL +But, BASE_SMALL is a config of type int and "!BASE_SMALL" is always +evaluated to true whatever is the value of BASE_SMALL. + +This patch fixes this by using the correct conditional operator for int +type : BASE_SMALL != 0. + +Note: This changes CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 to +CONFIG_LOG_CPU_MAX_BUF_SHIFT=0 for BASE_SMALL defconfigs, but that will +not be a big impact due to this code in kernel/printk/printk.c: + /* by default this will only continue through for large > 64 CPUs */ + if (cpu_extra <= __LOG_BUF_LEN / 2) + return; +Systems using CONFIG_BASE_SMALL and having 64+ CPUs should be quite +rare. + +John Ogness (printk reviewer) wrote: +> For printk this will mean that BASE_SMALL systems were probably +> previously allocating/using the dynamic ringbuffer and now they will +> just continue to use the static ringbuffer. Which is fine and saves +> memory (as it should). + +Petr Mladek (printk maintainer) wrote: +> More precisely, it allocated the buffer dynamically when the sum +> of per-CPU-extra space exceeded half of the default static ring +> buffer. This happened for systems with more than 64 CPUs with +> the default config values. + +Reported-by: Geert Uytterhoeven +Closes: https://lore.kernel.org/all/CAMuHMdWm6u1wX7efZQf=2XUAHascps76YQac6rdnQGhc8nop_Q@mail.gmail.com/ +Reported-by: Vegard Nossum +Closes: https://lore.kernel.org/all/f6856be8-54b7-0fa0-1d17-39632bf29ada@oracle.com/ +Fixes: 4e244c10eab3 ("kconfig: remove unneeded symbol_empty variable") +Reviewed-by: Petr Mladek +Reviewed-by: Masahiro Yamada +Signed-off-by: Yoann Congal +Link: https://lore.kernel.org/r/20240505080343.1471198-2-yoann.congal@smile.fr +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + init/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/init/Kconfig b/init/Kconfig +index 664bedb9a71fb..459f44ef7cc94 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -743,8 +743,8 @@ config LOG_CPU_MAX_BUF_SHIFT + int "CPU kernel log buffer size contribution (13 => 8 KB, 17 => 128KB)" + depends on SMP + range 0 21 +- default 12 if !BASE_SMALL +- default 0 if BASE_SMALL ++ default 0 if BASE_SMALL != 0 ++ default 12 + depends on PRINTK + help + This option allows to increase the default ring buffer size +-- +2.43.0 + diff --git a/queue-6.9/regulator-bd71828-don-t-overwrite-runtime-voltages.patch b/queue-6.9/regulator-bd71828-don-t-overwrite-runtime-voltages.patch new file mode 100644 index 00000000000..01a5f7e98c9 --- /dev/null +++ b/queue-6.9/regulator-bd71828-don-t-overwrite-runtime-voltages.patch @@ -0,0 +1,186 @@ +From 4361c28ee4cb8e6dfe5d2a4566e0688712d948d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 11:54:41 +0300 +Subject: regulator: bd71828: Don't overwrite runtime voltages + +From: Matti Vaittinen + +[ Upstream commit 0f9f7c63c415e287cd57b5c98be61eb320dedcfc ] + +Some of the regulators on the BD71828 have common voltage setting for +RUN/SUSPEND/IDLE/LPSR states. The enable control can be set for each +state though. + +The driver allows setting the voltage values for these states via +device-tree. As a side effect, setting the voltages for +SUSPEND/IDLE/LPSR will also change the RUN level voltage which is not +desired and can break the system. + +The comment in code reflects this behaviour, but it is likely to not +make people any happier. The right thing to do is to allow setting the +enable/disable state at SUSPEND/IDLE/LPSR via device-tree, but to +disallow setting state specific voltages for those regulators. + +BUCK1 is a bit different. It only shares the SUSPEND and LPSR state +voltages. The former behaviour of allowing to silently overwrite the +SUSPEND state voltage by LPSR state voltage is also changed here so that +the SUSPEND voltage is prioritized over LPSR voltage. + +Prevent setting PMIC state specific voltages for regulators which do not +support it. + +Signed-off-by: Matti Vaittinen +Fixes: 522498f8cb8c ("regulator: bd71828: Basic support for ROHM bd71828 PMIC regulators") +Link: https://msgid.link/r/e1883ae1e3ae5668f1030455d4750923561f3d68.1715848512.git.mazziesaccount@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/bd71828-regulator.c | 58 +-------------------------- + 1 file changed, 2 insertions(+), 56 deletions(-) + +diff --git a/drivers/regulator/bd71828-regulator.c b/drivers/regulator/bd71828-regulator.c +index 08d4ee369287e..dd871ffe979c3 100644 +--- a/drivers/regulator/bd71828-regulator.c ++++ b/drivers/regulator/bd71828-regulator.c +@@ -206,14 +206,11 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + .suspend_reg = BD71828_REG_BUCK1_SUSP_VOLT, + .suspend_mask = BD71828_MASK_BUCK1267_VOLT, + .suspend_on_mask = BD71828_MASK_SUSP_EN, +- .lpsr_on_mask = BD71828_MASK_LPSR_EN, + /* + * LPSR voltage is same as SUSPEND voltage. Allow +- * setting it so that regulator can be set enabled at +- * LPSR state ++ * only enabling/disabling regulator for LPSR state + */ +- .lpsr_reg = BD71828_REG_BUCK1_SUSP_VOLT, +- .lpsr_mask = BD71828_MASK_BUCK1267_VOLT, ++ .lpsr_on_mask = BD71828_MASK_LPSR_EN, + }, + .reg_inits = buck1_inits, + .reg_init_amnt = ARRAY_SIZE(buck1_inits), +@@ -288,13 +285,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + ROHM_DVS_LEVEL_SUSPEND | + ROHM_DVS_LEVEL_LPSR, + .run_reg = BD71828_REG_BUCK3_VOLT, +- .idle_reg = BD71828_REG_BUCK3_VOLT, +- .suspend_reg = BD71828_REG_BUCK3_VOLT, +- .lpsr_reg = BD71828_REG_BUCK3_VOLT, + .run_mask = BD71828_MASK_BUCK3_VOLT, +- .idle_mask = BD71828_MASK_BUCK3_VOLT, +- .suspend_mask = BD71828_MASK_BUCK3_VOLT, +- .lpsr_mask = BD71828_MASK_BUCK3_VOLT, + .idle_on_mask = BD71828_MASK_IDLE_EN, + .suspend_on_mask = BD71828_MASK_SUSP_EN, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, +@@ -329,13 +320,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + ROHM_DVS_LEVEL_SUSPEND | + ROHM_DVS_LEVEL_LPSR, + .run_reg = BD71828_REG_BUCK4_VOLT, +- .idle_reg = BD71828_REG_BUCK4_VOLT, +- .suspend_reg = BD71828_REG_BUCK4_VOLT, +- .lpsr_reg = BD71828_REG_BUCK4_VOLT, + .run_mask = BD71828_MASK_BUCK4_VOLT, +- .idle_mask = BD71828_MASK_BUCK4_VOLT, +- .suspend_mask = BD71828_MASK_BUCK4_VOLT, +- .lpsr_mask = BD71828_MASK_BUCK4_VOLT, + .idle_on_mask = BD71828_MASK_IDLE_EN, + .suspend_on_mask = BD71828_MASK_SUSP_EN, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, +@@ -370,13 +355,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + ROHM_DVS_LEVEL_SUSPEND | + ROHM_DVS_LEVEL_LPSR, + .run_reg = BD71828_REG_BUCK5_VOLT, +- .idle_reg = BD71828_REG_BUCK5_VOLT, +- .suspend_reg = BD71828_REG_BUCK5_VOLT, +- .lpsr_reg = BD71828_REG_BUCK5_VOLT, + .run_mask = BD71828_MASK_BUCK5_VOLT, +- .idle_mask = BD71828_MASK_BUCK5_VOLT, +- .suspend_mask = BD71828_MASK_BUCK5_VOLT, +- .lpsr_mask = BD71828_MASK_BUCK5_VOLT, + .idle_on_mask = BD71828_MASK_IDLE_EN, + .suspend_on_mask = BD71828_MASK_SUSP_EN, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, +@@ -493,13 +472,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + ROHM_DVS_LEVEL_SUSPEND | + ROHM_DVS_LEVEL_LPSR, + .run_reg = BD71828_REG_LDO1_VOLT, +- .idle_reg = BD71828_REG_LDO1_VOLT, +- .suspend_reg = BD71828_REG_LDO1_VOLT, +- .lpsr_reg = BD71828_REG_LDO1_VOLT, + .run_mask = BD71828_MASK_LDO_VOLT, +- .idle_mask = BD71828_MASK_LDO_VOLT, +- .suspend_mask = BD71828_MASK_LDO_VOLT, +- .lpsr_mask = BD71828_MASK_LDO_VOLT, + .idle_on_mask = BD71828_MASK_IDLE_EN, + .suspend_on_mask = BD71828_MASK_SUSP_EN, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, +@@ -533,13 +506,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + ROHM_DVS_LEVEL_SUSPEND | + ROHM_DVS_LEVEL_LPSR, + .run_reg = BD71828_REG_LDO2_VOLT, +- .idle_reg = BD71828_REG_LDO2_VOLT, +- .suspend_reg = BD71828_REG_LDO2_VOLT, +- .lpsr_reg = BD71828_REG_LDO2_VOLT, + .run_mask = BD71828_MASK_LDO_VOLT, +- .idle_mask = BD71828_MASK_LDO_VOLT, +- .suspend_mask = BD71828_MASK_LDO_VOLT, +- .lpsr_mask = BD71828_MASK_LDO_VOLT, + .idle_on_mask = BD71828_MASK_IDLE_EN, + .suspend_on_mask = BD71828_MASK_SUSP_EN, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, +@@ -573,13 +540,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + ROHM_DVS_LEVEL_SUSPEND | + ROHM_DVS_LEVEL_LPSR, + .run_reg = BD71828_REG_LDO3_VOLT, +- .idle_reg = BD71828_REG_LDO3_VOLT, +- .suspend_reg = BD71828_REG_LDO3_VOLT, +- .lpsr_reg = BD71828_REG_LDO3_VOLT, + .run_mask = BD71828_MASK_LDO_VOLT, +- .idle_mask = BD71828_MASK_LDO_VOLT, +- .suspend_mask = BD71828_MASK_LDO_VOLT, +- .lpsr_mask = BD71828_MASK_LDO_VOLT, + .idle_on_mask = BD71828_MASK_IDLE_EN, + .suspend_on_mask = BD71828_MASK_SUSP_EN, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, +@@ -614,13 +575,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + ROHM_DVS_LEVEL_SUSPEND | + ROHM_DVS_LEVEL_LPSR, + .run_reg = BD71828_REG_LDO4_VOLT, +- .idle_reg = BD71828_REG_LDO4_VOLT, +- .suspend_reg = BD71828_REG_LDO4_VOLT, +- .lpsr_reg = BD71828_REG_LDO4_VOLT, + .run_mask = BD71828_MASK_LDO_VOLT, +- .idle_mask = BD71828_MASK_LDO_VOLT, +- .suspend_mask = BD71828_MASK_LDO_VOLT, +- .lpsr_mask = BD71828_MASK_LDO_VOLT, + .idle_on_mask = BD71828_MASK_IDLE_EN, + .suspend_on_mask = BD71828_MASK_SUSP_EN, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, +@@ -655,13 +610,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + ROHM_DVS_LEVEL_SUSPEND | + ROHM_DVS_LEVEL_LPSR, + .run_reg = BD71828_REG_LDO5_VOLT, +- .idle_reg = BD71828_REG_LDO5_VOLT, +- .suspend_reg = BD71828_REG_LDO5_VOLT, +- .lpsr_reg = BD71828_REG_LDO5_VOLT, + .run_mask = BD71828_MASK_LDO_VOLT, +- .idle_mask = BD71828_MASK_LDO_VOLT, +- .suspend_mask = BD71828_MASK_LDO_VOLT, +- .lpsr_mask = BD71828_MASK_LDO_VOLT, + .idle_on_mask = BD71828_MASK_IDLE_EN, + .suspend_on_mask = BD71828_MASK_SUSP_EN, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, +@@ -720,9 +669,6 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { + .suspend_reg = BD71828_REG_LDO7_VOLT, + .lpsr_reg = BD71828_REG_LDO7_VOLT, + .run_mask = BD71828_MASK_LDO_VOLT, +- .idle_mask = BD71828_MASK_LDO_VOLT, +- .suspend_mask = BD71828_MASK_LDO_VOLT, +- .lpsr_mask = BD71828_MASK_LDO_VOLT, + .idle_on_mask = BD71828_MASK_IDLE_EN, + .suspend_on_mask = BD71828_MASK_SUSP_EN, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, +-- +2.43.0 + diff --git a/queue-6.9/regulator-pickable-ranges-don-t-always-cache-vsel.patch b/queue-6.9/regulator-pickable-ranges-don-t-always-cache-vsel.patch new file mode 100644 index 00000000000..127e72e252d --- /dev/null +++ b/queue-6.9/regulator-pickable-ranges-don-t-always-cache-vsel.patch @@ -0,0 +1,114 @@ +From ea9cea061dee215d0640f6491dd24e175b9e4f03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 15:31:33 +0300 +Subject: regulator: pickable ranges: don't always cache vsel + +From: Matti Vaittinen + +[ Upstream commit f4f4276f985a5aac7b310a4ed040b47e275e7591 ] + +Some PMICs treat the vsel_reg same as apply-bit. Eg, when voltage range +is changed, the new voltage setting is not taking effect until the vsel +register is written. + +Add a flag 'range_applied_by_vsel' to the regulator desc to indicate this +behaviour and to force the vsel value to be written to hardware if range +was changed, even if the old selector was same as the new one. + +Signed-off-by: Matti Vaittinen +Link: https://msgid.link/r/ZktCpcGZdgHWuN_L@fedora +Signed-off-by: Mark Brown +Stable-dep-of: 1ace99d7c7c4 ("regulator: tps6287x: Force writing VSEL bit") +Signed-off-by: Sasha Levin +--- + drivers/regulator/helpers.c | 43 ++++++++++++++++++++++---------- + include/linux/regulator/driver.h | 3 +++ + 2 files changed, 33 insertions(+), 13 deletions(-) + +diff --git a/drivers/regulator/helpers.c b/drivers/regulator/helpers.c +index d492683365532..6e1ace660b8cf 100644 +--- a/drivers/regulator/helpers.c ++++ b/drivers/regulator/helpers.c +@@ -161,6 +161,32 @@ int regulator_get_voltage_sel_pickable_regmap(struct regulator_dev *rdev) + } + EXPORT_SYMBOL_GPL(regulator_get_voltage_sel_pickable_regmap); + ++static int write_separate_vsel_and_range(struct regulator_dev *rdev, ++ unsigned int sel, unsigned int range) ++{ ++ bool range_updated; ++ int ret; ++ ++ ret = regmap_update_bits_base(rdev->regmap, rdev->desc->vsel_range_reg, ++ rdev->desc->vsel_range_mask, ++ range, &range_updated, false, false); ++ if (ret) ++ return ret; ++ ++ /* ++ * Some PMICs treat the vsel_reg same as apply-bit. Force it to be ++ * written if the range changed, even if the old selector was same as ++ * the new one ++ */ ++ if (rdev->desc->range_applied_by_vsel && range_updated) ++ return regmap_write_bits(rdev->regmap, ++ rdev->desc->vsel_reg, ++ rdev->desc->vsel_mask, sel); ++ ++ return regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg, ++ rdev->desc->vsel_mask, sel); ++} ++ + /** + * regulator_set_voltage_sel_pickable_regmap - pickable range set_voltage_sel + * +@@ -199,21 +225,12 @@ int regulator_set_voltage_sel_pickable_regmap(struct regulator_dev *rdev, + range = rdev->desc->linear_range_selectors_bitfield[i]; + range <<= ffs(rdev->desc->vsel_range_mask) - 1; + +- if (rdev->desc->vsel_reg == rdev->desc->vsel_range_reg) { +- ret = regmap_update_bits(rdev->regmap, +- rdev->desc->vsel_reg, ++ if (rdev->desc->vsel_reg == rdev->desc->vsel_range_reg) ++ ret = regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg, + rdev->desc->vsel_range_mask | + rdev->desc->vsel_mask, sel | range); +- } else { +- ret = regmap_update_bits(rdev->regmap, +- rdev->desc->vsel_range_reg, +- rdev->desc->vsel_range_mask, range); +- if (ret) +- return ret; +- +- ret = regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg, +- rdev->desc->vsel_mask, sel); +- } ++ else ++ ret = write_separate_vsel_and_range(rdev, sel, range); + + if (ret) + return ret; +diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h +index 22a07c0900a41..f230a472ccd35 100644 +--- a/include/linux/regulator/driver.h ++++ b/include/linux/regulator/driver.h +@@ -299,6 +299,8 @@ enum regulator_type { + * @vsel_range_reg: Register for range selector when using pickable ranges + * and ``regulator_map_*_voltage_*_pickable`` functions. + * @vsel_range_mask: Mask for register bitfield used for range selector ++ * @range_applied_by_vsel: A flag to indicate that changes to vsel_range_reg ++ * are only effective after vsel_reg is written + * @vsel_reg: Register for selector when using ``regulator_map_*_voltage_*`` + * @vsel_mask: Mask for register bitfield used for selector + * @vsel_step: Specify the resolution of selector stepping when setting +@@ -389,6 +391,7 @@ struct regulator_desc { + + unsigned int vsel_range_reg; + unsigned int vsel_range_mask; ++ bool range_applied_by_vsel; + unsigned int vsel_reg; + unsigned int vsel_mask; + unsigned int vsel_step; +-- +2.43.0 + diff --git a/queue-6.9/regulator-tps6287x-force-writing-vsel-bit.patch b/queue-6.9/regulator-tps6287x-force-writing-vsel-bit.patch new file mode 100644 index 00000000000..851a87c7bfc --- /dev/null +++ b/queue-6.9/regulator-tps6287x-force-writing-vsel-bit.patch @@ -0,0 +1,64 @@ +From 934231040bd602388f6023345621f75fb0b1bcfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 15:36:55 +0300 +Subject: regulator: tps6287x: Force writing VSEL bit + +From: Matti Vaittinen + +[ Upstream commit 1ace99d7c7c4c801c0660246f741ff846a9b8e3c ] + +The data-sheet for TPS6287x-Q1 +https://www.ti.com/lit/ds/symlink/tps62873-q1.pdf +states at chapter 9.3.6.1 Output Voltage Range: + +"Note that every change to the VRANGE[1:0] bits must be followed by a +write to the VSET register, even if the value of the VSET[7:0] bits does +not change." + +The current implementation of the driver uses the +regulator_set_voltage_sel_pickable_regmap() helper which further uses +regmap_update_bits() to write the VSET-register. The +regmap_update_bits() will not access the hardware if the new register +value is same as old. It is worth noting that this is true also when the +register is marked volatile, which I can't say is wrong because +'read-mnodify-write'-cycle with a volatile register is in any case +something user should carefully consider. + +The 'range_applied_by_vsel'-flag in regulator desc was added to force +the vsel register upodates by using regmap_write_bits(). This variant +will always unconditionally write the bits to the hardware. + +It is worth noting that the vsel is now forced to be written to the +hardware, whether the range was changed or not. This may cause a +performance drop if users are wrtiting same voltage value repeteadly. + +It would be possible to read the range register to determine if it was +changed, but this would be a performance issue for users who don't use +reg cache for vsel. + +Always write the VSET register to the hardware regardless the cache. + +Signed-off-by: Matti Vaittinen +Fixes: 7b0518fbf2be ("regulator: Add support for TI TPS6287x regulators") +Link: https://msgid.link/r/ZktD50C5twF1EuKu@fedora +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/tps6287x-regulator.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/tps6287x-regulator.c b/drivers/regulator/tps6287x-regulator.c +index 9b7c3d77789e3..3c9d79e003e4b 100644 +--- a/drivers/regulator/tps6287x-regulator.c ++++ b/drivers/regulator/tps6287x-regulator.c +@@ -115,6 +115,7 @@ static struct regulator_desc tps6287x_reg = { + .vsel_mask = 0xFF, + .vsel_range_reg = TPS6287X_CTRL2, + .vsel_range_mask = TPS6287X_CTRL2_VRANGE, ++ .range_applied_by_vsel = true, + .ramp_reg = TPS6287X_CTRL1, + .ramp_mask = TPS6287X_CTRL1_VRAMP, + .ramp_delay_table = tps6287x_ramp_table, +-- +2.43.0 + diff --git a/queue-6.9/regulator-tps6594-regulator-correct-multi-phase-conf.patch b/queue-6.9/regulator-tps6594-regulator-correct-multi-phase-conf.patch new file mode 100644 index 00000000000..7eca04bb5e0 --- /dev/null +++ b/queue-6.9/regulator-tps6594-regulator-correct-multi-phase-conf.patch @@ -0,0 +1,72 @@ +From 89c3fbb7f93f30e6b2a33c8f006282bd739f36cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 15:17:58 +0530 +Subject: regulator: tps6594-regulator: Correct multi-phase configuration + +From: Neha Malcom Francis + +[ Upstream commit 74b38cd77d3eb63c6d0ad9cf2ae59812ae54d3ee ] + +According to the TPS6594 PMIC Manual (linked) 8.3.2.1.4 Multi-Phase BUCK +Regulator Configurations section, the PMIC ignores all the other bucks' +except the primary buck's regulator registers. This is BUCK1 for +configurations BUCK12, BUCK123 and BUCK1234 while it is BUCK3 for +BUCK34. Correct the registers mapped for these configurations +accordingly. + +Fixes: f17ccc5deb4d ("regulator: tps6594-regulator: Add driver for TI TPS6594 regulators") +Link: https://www.ti.com/lit/gpn/tps6594-q1 +Signed-off-by: Neha Malcom Francis +Link: https://msgid.link/r/20240521094758.2190331-1-n-francis@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/tps6594-regulator.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/regulator/tps6594-regulator.c b/drivers/regulator/tps6594-regulator.c +index b7f0c87797577..5fad61785e72f 100644 +--- a/drivers/regulator/tps6594-regulator.c ++++ b/drivers/regulator/tps6594-regulator.c +@@ -287,30 +287,30 @@ static struct tps6594_regulator_irq_type *tps6594_ldos_irq_types[] = { + static const struct regulator_desc multi_regs[] = { + TPS6594_REGULATOR("BUCK12", "buck12", TPS6594_BUCK_1, + REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET, +- TPS6594_REG_BUCKX_VOUT_1(1), ++ TPS6594_REG_BUCKX_VOUT_1(0), + TPS6594_MASK_BUCKS_VSET, +- TPS6594_REG_BUCKX_CTRL(1), ++ TPS6594_REG_BUCKX_CTRL(0), + TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges, + 4, 4000, 0, NULL, 0, 0), + TPS6594_REGULATOR("BUCK34", "buck34", TPS6594_BUCK_3, + REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET, +- TPS6594_REG_BUCKX_VOUT_1(3), ++ TPS6594_REG_BUCKX_VOUT_1(2), + TPS6594_MASK_BUCKS_VSET, +- TPS6594_REG_BUCKX_CTRL(3), ++ TPS6594_REG_BUCKX_CTRL(2), + TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges, + 4, 0, 0, NULL, 0, 0), + TPS6594_REGULATOR("BUCK123", "buck123", TPS6594_BUCK_1, + REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET, +- TPS6594_REG_BUCKX_VOUT_1(1), ++ TPS6594_REG_BUCKX_VOUT_1(0), + TPS6594_MASK_BUCKS_VSET, +- TPS6594_REG_BUCKX_CTRL(1), ++ TPS6594_REG_BUCKX_CTRL(0), + TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges, + 4, 4000, 0, NULL, 0, 0), + TPS6594_REGULATOR("BUCK1234", "buck1234", TPS6594_BUCK_1, + REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET, +- TPS6594_REG_BUCKX_VOUT_1(1), ++ TPS6594_REG_BUCKX_VOUT_1(0), + TPS6594_MASK_BUCKS_VSET, +- TPS6594_REG_BUCKX_CTRL(1), ++ TPS6594_REG_BUCKX_CTRL(0), + TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges, + 4, 4000, 0, NULL, 0, 0), + }; +-- +2.43.0 + diff --git a/queue-6.9/revert-drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch b/queue-6.9/revert-drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch new file mode 100644 index 00000000000..8ac8f005c65 --- /dev/null +++ b/queue-6.9/revert-drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch @@ -0,0 +1,82 @@ +From 5caf943083eb135a6efc7eee8748ff91b9fbecc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 14:22:59 +0200 +Subject: Revert "drm/bridge: ti-sn65dsi83: Fix enable error path" + +From: Luca Ceresoli + +[ Upstream commit ad81feb5b6f1f5461641706376dcf7a9914ed2e7 ] + +This reverts commit 8a91b29f1f50ce7742cdbe5cf11d17f128511f3f. + +The regulator_disable() added by the original commit solves one kind of +regulator imbalance but adds another one as it allows the regulator to be +disabled one more time than it is enabled in the following scenario: + + 1. Start video pipeline -> sn65dsi83_atomic_pre_enable -> regulator_enable + 2. PLL lock fails -> regulator_disable + 3. Stop video pipeline -> sn65dsi83_atomic_disable -> regulator_disable + +The reason is clear from the code flow, which looks like this (after +removing unrelated code): + + static void sn65dsi83_atomic_pre_enable() + { + regulator_enable(ctx->vcc); + + if (PLL failed locking) { + regulator_disable(ctx->vcc); <---- added by patch being reverted + return; + } + } + + static void sn65dsi83_atomic_disable() + { + regulator_disable(ctx->vcc); + } + +The use case for introducing the additional regulator_disable() was +removing the module for debugging (see link below for the discussion). If +the module is removed after a .atomic_pre_enable, i.e. with an active +pipeline from the DRM point of view, .atomic_disable is not called and thus +the regulator would not be disabled. + +According to the discussion however there is no actual use case for +removing the module with an active pipeline, except for +debugging/development. + +On the other hand, the occurrence of a PLL lock failure is possible due to +any physical reason (e.g. a temporary hardware failure for electrical +reasons) so handling it gracefully should be supported. As there is no way +for .atomic[_pre]_enable to report an error to the core, the only clean way +to support it is calling regulator_disabled() only in .atomic_disable, +unconditionally, as it was before. + +Link: https://lore.kernel.org/all/15244220.uLZWGnKmhe@steina-w/ +Fixes: 8a91b29f1f50 ("drm/bridge: ti-sn65dsi83: Fix enable error path") +Reviewed-by: Alexander Stein +Signed-off-by: Luca Ceresoli +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240426122259.46808-1-luca.ceresoli@bootlin.com +(cherry picked from commit 2940ee03b23281071620dda1d790cd644dabd394) +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +index 4814b7b6d1fd1..57a7ed13f9965 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +@@ -478,7 +478,6 @@ static void sn65dsi83_atomic_pre_enable(struct drm_bridge *bridge, + dev_err(ctx->dev, "failed to lock PLL, ret=%i\n", ret); + /* On failure, disable PLL again and exit. */ + regmap_write(ctx->regmap, REG_RC_PLL_EN, 0x00); +- regulator_disable(ctx->vcc); + return; + } + +-- +2.43.0 + diff --git a/queue-6.9/revert-ixgbe-manual-an-37-for-troublesome-link-partn.patch b/queue-6.9/revert-ixgbe-manual-an-37-for-troublesome-link-partn.patch new file mode 100644 index 00000000000..65ad6159dc2 --- /dev/null +++ b/queue-6.9/revert-ixgbe-manual-an-37-for-troublesome-link-partn.patch @@ -0,0 +1,148 @@ +From 51de264d9dc1728aae4946b43519a50845d3727e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 17:21:27 -0700 +Subject: Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 + SFI" + +From: Jacob Keller + +[ Upstream commit b35b1c0b4e166a427395deaf61e3140495dfcb89 ] + +This reverts commit 565736048bd5f9888990569993c6b6bfdf6dcb6d. + +According to the commit, it implements a manual AN-37 for some +"troublesome" Juniper MX5 switches. This appears to be a workaround for a +particular switch. + +It has been reported that this causes a severe breakage for other switches, +including a Cisco 3560CX-12PD-S. + +The code appears to be a workaround for a specific switch which fails to +link in SFI mode. It expects to see AN-37 auto negotiation in order to +link. The Cisco switch is not expecting AN-37 auto negotiation. When the +device starts the manual AN-37, the Cisco switch decides that the port is +confused and stops attempting to link with it. This persists until a power +cycle. A simple driver unload and reload does not resolve the issue, even +if loading with a version of the driver which lacks this workaround. + +The authors of the workaround commit have not responded with +clarifications, and the result of the workaround is complete failure to +connect with other switches. + +This appears to be a case where the driver can either "correctly" link with +the Juniper MX5 switch, at the cost of bricking the link with the Cisco +switch, or it can behave properly for the Cisco switch, but fail to link +with the Junipir MX5 switch. I do not know enough about the standards +involved to clearly determine whether either switch is at fault or behaving +incorrectly. Nor do I know whether there exists some alternative fix which +corrects behavior with both switches. + +Revert the workaround for the Juniper switch. + +Fixes: 565736048bd5 ("ixgbe: Manual AN-37 for troublesome link partners for X550 SFI") +Link: https://lore.kernel.org/netdev/cbe874db-9ac9-42b8-afa0-88ea910e1e99@intel.com/T/ +Link: https://forum.proxmox.com/threads/intel-x553-sfp-ixgbe-no-go-on-pve8.135129/#post-612291 +Signed-off-by: Jacob Keller +Cc: Jeff Daly +Cc: kernel.org-fo5k2w@ycharbi.fr +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240520-net-2024-05-20-revert-silicom-switch-workaround-v1-1-50f80f261c94@intel.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 3 - + drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 56 +------------------ + 2 files changed, 3 insertions(+), 56 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h +index ed440dd0c4f9f..84fb6b8de2a12 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h +@@ -3676,9 +3676,7 @@ struct ixgbe_info { + #define IXGBE_KRM_LINK_S1(P) ((P) ? 0x8200 : 0x4200) + #define IXGBE_KRM_LINK_CTRL_1(P) ((P) ? 0x820C : 0x420C) + #define IXGBE_KRM_AN_CNTL_1(P) ((P) ? 0x822C : 0x422C) +-#define IXGBE_KRM_AN_CNTL_4(P) ((P) ? 0x8238 : 0x4238) + #define IXGBE_KRM_AN_CNTL_8(P) ((P) ? 0x8248 : 0x4248) +-#define IXGBE_KRM_PCS_KX_AN(P) ((P) ? 0x9918 : 0x5918) + #define IXGBE_KRM_SGMII_CTRL(P) ((P) ? 0x82A0 : 0x42A0) + #define IXGBE_KRM_LP_BASE_PAGE_HIGH(P) ((P) ? 0x836C : 0x436C) + #define IXGBE_KRM_DSP_TXFFE_STATE_4(P) ((P) ? 0x8634 : 0x4634) +@@ -3688,7 +3686,6 @@ struct ixgbe_info { + #define IXGBE_KRM_PMD_FLX_MASK_ST20(P) ((P) ? 0x9054 : 0x5054) + #define IXGBE_KRM_TX_COEFF_CTRL_1(P) ((P) ? 0x9520 : 0x5520) + #define IXGBE_KRM_RX_ANA_CTL(P) ((P) ? 0x9A00 : 0x5A00) +-#define IXGBE_KRM_FLX_TMRS_CTRL_ST31(P) ((P) ? 0x9180 : 0x5180) + + #define IXGBE_KRM_PMD_FLX_MASK_ST20_SFI_10G_DA ~(0x3 << 20) + #define IXGBE_KRM_PMD_FLX_MASK_ST20_SFI_10G_SR BIT(20) +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c +index 2decb0710b6e3..a5f6449344450 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c +@@ -1722,59 +1722,9 @@ static int ixgbe_setup_sfi_x550a(struct ixgbe_hw *hw, ixgbe_link_speed *speed) + return -EINVAL; + } + +- (void)mac->ops.write_iosf_sb_reg(hw, +- IXGBE_KRM_PMD_FLX_MASK_ST20(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val); +- +- /* change mode enforcement rules to hybrid */ +- (void)mac->ops.read_iosf_sb_reg(hw, +- IXGBE_KRM_FLX_TMRS_CTRL_ST31(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val); +- reg_val |= 0x0400; +- +- (void)mac->ops.write_iosf_sb_reg(hw, +- IXGBE_KRM_FLX_TMRS_CTRL_ST31(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val); +- +- /* manually control the config */ +- (void)mac->ops.read_iosf_sb_reg(hw, +- IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val); +- reg_val |= 0x20002240; +- +- (void)mac->ops.write_iosf_sb_reg(hw, +- IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val); +- +- /* move the AN base page values */ +- (void)mac->ops.read_iosf_sb_reg(hw, +- IXGBE_KRM_PCS_KX_AN(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val); +- reg_val |= 0x1; +- +- (void)mac->ops.write_iosf_sb_reg(hw, +- IXGBE_KRM_PCS_KX_AN(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val); +- +- /* set the AN37 over CB mode */ +- (void)mac->ops.read_iosf_sb_reg(hw, +- IXGBE_KRM_AN_CNTL_4(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val); +- reg_val |= 0x20000000; +- +- (void)mac->ops.write_iosf_sb_reg(hw, +- IXGBE_KRM_AN_CNTL_4(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val); +- +- /* restart AN manually */ +- (void)mac->ops.read_iosf_sb_reg(hw, +- IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val); +- reg_val |= IXGBE_KRM_LINK_CTRL_1_TETH_AN_RESTART; +- +- (void)mac->ops.write_iosf_sb_reg(hw, +- IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id), +- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val); ++ status = mac->ops.write_iosf_sb_reg(hw, ++ IXGBE_KRM_PMD_FLX_MASK_ST20(hw->bus.lan_id), ++ IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val); + + /* Toggle port SW reset by AN reset. */ + status = ixgbe_restart_an_internal_phy_x550em(hw); +-- +2.43.0 + diff --git a/queue-6.9/riscv-cpufeature-fix-extension-subset-checking.patch b/queue-6.9/riscv-cpufeature-fix-extension-subset-checking.patch new file mode 100644 index 00000000000..7908115511e --- /dev/null +++ b/queue-6.9/riscv-cpufeature-fix-extension-subset-checking.patch @@ -0,0 +1,41 @@ +From f46dfe2491b5836426909f0f20c64d47453f4e85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 21:50:51 -0700 +Subject: riscv: cpufeature: Fix extension subset checking + +From: Charlie Jenkins + +[ Upstream commit e67e98ee8952c7d5ce986d1dc6f8221ab8674afa ] + +This loop is supposed to check if ext->subset_ext_ids[j] is valid, rather +than if ext->subset_ext_ids[i] is valid, before setting the extension +id ext->subset_ext_ids[j] in isainfo->isa. + +Signed-off-by: Charlie Jenkins +Reviewed-by: Conor Dooley +Reviewed-by: Alexandre Ghiti +Reviewed-by: Andrew Jones +Fixes: 0d8295ed975b ("riscv: add ISA extension parsing for scalar crypto") +Link: https://lore.kernel.org/r/20240502-cpufeature_fixes-v4-2-b3d1a088722d@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/cpufeature.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c +index 13d4fc0d1817e..5ef48cb20ee11 100644 +--- a/arch/riscv/kernel/cpufeature.c ++++ b/arch/riscv/kernel/cpufeature.c +@@ -603,7 +603,7 @@ static int __init riscv_fill_hwcap_from_ext_list(unsigned long *isa2hwcap) + + if (ext->subset_ext_size) { + for (int j = 0; j < ext->subset_ext_size; j++) { +- if (riscv_isa_extension_check(ext->subset_ext_ids[i])) ++ if (riscv_isa_extension_check(ext->subset_ext_ids[j])) + set_bit(ext->subset_ext_ids[j], isainfo->isa); + } + } +-- +2.43.0 + diff --git a/queue-6.9/riscv-cpufeature-fix-thead-vector-hwcap-removal.patch b/queue-6.9/riscv-cpufeature-fix-thead-vector-hwcap-removal.patch new file mode 100644 index 00000000000..e3f325f016f --- /dev/null +++ b/queue-6.9/riscv-cpufeature-fix-thead-vector-hwcap-removal.patch @@ -0,0 +1,136 @@ +From 8f35c8ac2e98e4479305d74aa44cbd43df7d0a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 21:50:50 -0700 +Subject: riscv: cpufeature: Fix thead vector hwcap removal + +From: Charlie Jenkins + +[ Upstream commit e482eab4d1eb31031eff2b6afb71776483101979 ] + +The riscv_cpuinfo struct that contains mvendorid and marchid is not +populated until all harts are booted which happens after the DT parsing. +Use the mvendorid/marchid from the boot hart to determine if the DT +contains an invalid V. + +Fixes: d82f32202e0d ("RISC-V: Ignore V from the riscv,isa DT property on older T-Head CPUs") +Signed-off-by: Charlie Jenkins +Reviewed-by: Conor Dooley +Reviewed-by: Guo Ren +Link: https://lore.kernel.org/r/20240502-cpufeature_fixes-v4-1-b3d1a088722d@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/sbi.h | 2 ++ + arch/riscv/kernel/cpu.c | 40 ++++++++++++++++++++++++++++++---- + arch/riscv/kernel/cpufeature.c | 8 +++++-- + 3 files changed, 44 insertions(+), 6 deletions(-) + +diff --git a/arch/riscv/include/asm/sbi.h b/arch/riscv/include/asm/sbi.h +index 6e68f8dff76bc..0fab508a65b3c 100644 +--- a/arch/riscv/include/asm/sbi.h ++++ b/arch/riscv/include/asm/sbi.h +@@ -370,6 +370,8 @@ static inline int sbi_remote_fence_i(const struct cpumask *cpu_mask) { return -1 + static inline void sbi_init(void) {} + #endif /* CONFIG_RISCV_SBI */ + ++unsigned long riscv_get_mvendorid(void); ++unsigned long riscv_get_marchid(void); + unsigned long riscv_cached_mvendorid(unsigned int cpu_id); + unsigned long riscv_cached_marchid(unsigned int cpu_id); + unsigned long riscv_cached_mimpid(unsigned int cpu_id); +diff --git a/arch/riscv/kernel/cpu.c b/arch/riscv/kernel/cpu.c +index d11d6320fb0d2..c1f3655238fd2 100644 +--- a/arch/riscv/kernel/cpu.c ++++ b/arch/riscv/kernel/cpu.c +@@ -139,6 +139,34 @@ int riscv_of_parent_hartid(struct device_node *node, unsigned long *hartid) + return -1; + } + ++unsigned long __init riscv_get_marchid(void) ++{ ++ struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo); ++ ++#if IS_ENABLED(CONFIG_RISCV_SBI) ++ ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid(); ++#elif IS_ENABLED(CONFIG_RISCV_M_MODE) ++ ci->marchid = csr_read(CSR_MARCHID); ++#else ++ ci->marchid = 0; ++#endif ++ return ci->marchid; ++} ++ ++unsigned long __init riscv_get_mvendorid(void) ++{ ++ struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo); ++ ++#if IS_ENABLED(CONFIG_RISCV_SBI) ++ ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid(); ++#elif IS_ENABLED(CONFIG_RISCV_M_MODE) ++ ci->mvendorid = csr_read(CSR_MVENDORID); ++#else ++ ci->mvendorid = 0; ++#endif ++ return ci->mvendorid; ++} ++ + DEFINE_PER_CPU(struct riscv_cpuinfo, riscv_cpuinfo); + + unsigned long riscv_cached_mvendorid(unsigned int cpu_id) +@@ -170,12 +198,16 @@ static int riscv_cpuinfo_starting(unsigned int cpu) + struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo); + + #if IS_ENABLED(CONFIG_RISCV_SBI) +- ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid(); +- ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid(); ++ if (!ci->mvendorid) ++ ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid(); ++ if (!ci->marchid) ++ ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid(); + ci->mimpid = sbi_spec_is_0_1() ? 0 : sbi_get_mimpid(); + #elif IS_ENABLED(CONFIG_RISCV_M_MODE) +- ci->mvendorid = csr_read(CSR_MVENDORID); +- ci->marchid = csr_read(CSR_MARCHID); ++ if (!ci->mvendorid) ++ ci->mvendorid = csr_read(CSR_MVENDORID); ++ if (!ci->marchid) ++ ci->marchid = csr_read(CSR_MARCHID); + ci->mimpid = csr_read(CSR_MIMPID); + #else + ci->mvendorid = 0; +diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c +index 3ed2359eae353..13d4fc0d1817e 100644 +--- a/arch/riscv/kernel/cpufeature.c ++++ b/arch/riscv/kernel/cpufeature.c +@@ -490,6 +490,8 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap) + struct acpi_table_header *rhct; + acpi_status status; + unsigned int cpu; ++ u64 boot_vendorid; ++ u64 boot_archid; + + if (!acpi_disabled) { + status = acpi_get_table(ACPI_SIG_RHCT, 0, &rhct); +@@ -497,6 +499,9 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap) + return; + } + ++ boot_vendorid = riscv_get_mvendorid(); ++ boot_archid = riscv_get_marchid(); ++ + for_each_possible_cpu(cpu) { + struct riscv_isainfo *isainfo = &hart_isa[cpu]; + unsigned long this_hwcap = 0; +@@ -544,8 +549,7 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap) + * CPU cores with the ratified spec will contain non-zero + * marchid. + */ +- if (acpi_disabled && riscv_cached_mvendorid(cpu) == THEAD_VENDOR_ID && +- riscv_cached_marchid(cpu) == 0x0) { ++ if (acpi_disabled && boot_vendorid == THEAD_VENDOR_ID && boot_archid == 0x0) { + this_hwcap &= ~isa2hwcap[RISCV_ISA_EXT_v]; + clear_bit(RISCV_ISA_EXT_v, isainfo->isa); + } +-- +2.43.0 + diff --git a/queue-6.9/riscv-selftests-add-hwprobe-binaries-to-.gitignore.patch b/queue-6.9/riscv-selftests-add-hwprobe-binaries-to-.gitignore.patch new file mode 100644 index 00000000000..0e91ea735bf --- /dev/null +++ b/queue-6.9/riscv-selftests-add-hwprobe-binaries-to-.gitignore.patch @@ -0,0 +1,36 @@ +From 6df70f2b0360de3e410b14f157148400a1caffaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 12:58:03 -0700 +Subject: riscv: selftests: Add hwprobe binaries to .gitignore + +From: Charlie Jenkins + +[ Upstream commit f8ea6ab92748e69216b44b07ea7213cb02070dba ] + +The cbo and which-cpu hwprobe selftests leave their artifacts in the +kernel tree and end up being tracked by git. Add the binaries to the +hwprobe selftest .gitignore so this no longer happens. + +Signed-off-by: Charlie Jenkins +Fixes: a29e2a48afe3 ("RISC-V: selftests: Add CBO tests") +Fixes: ef7d6abb2cf5 ("RISC-V: selftests: Add which-cpus hwprobe test") +Reviewed-by: Muhammad Usama Anjum +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20240425-gitignore_hwprobe_artifacts-v1-1-dfc5a20da469@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/riscv/hwprobe/.gitignore | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/riscv/hwprobe/.gitignore b/tools/testing/selftests/riscv/hwprobe/.gitignore +index 8113dc3bdd03a..6e384e80ea1a8 100644 +--- a/tools/testing/selftests/riscv/hwprobe/.gitignore ++++ b/tools/testing/selftests/riscv/hwprobe/.gitignore +@@ -1 +1,3 @@ + hwprobe ++cbo ++which-cpus +-- +2.43.0 + diff --git a/queue-6.9/riscv-stacktrace-fixed-walk_stackframe.patch b/queue-6.9/riscv-stacktrace-fixed-walk_stackframe.patch new file mode 100644 index 00000000000..c9a31ae763e --- /dev/null +++ b/queue-6.9/riscv-stacktrace-fixed-walk_stackframe.patch @@ -0,0 +1,132 @@ +From 40102264201527df644fe49cfaf0ea7cef66d881 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 22:13:13 +0300 +Subject: riscv: stacktrace: fixed walk_stackframe() + +From: Matthew Bystrin + +[ Upstream commit a2a4d4a6a0bf5eba66f8b0b32502cc20d82715a0 ] + +If the load access fault occures in a leaf function (with +CONFIG_FRAME_POINTER=y), when wrong stack trace will be displayed: + +[] regmap_mmio_read32le+0xe/0x1c +---[ end trace 0000000000000000 ]--- + +Registers dump: + ra 0xffffffff80485758 + sp 0xffffffc80200b9a0 + fp 0xffffffc80200b9b0 + pc 0xffffffff804853ba + +Stack dump: + 0xffffffc80200b9a0: 0xffffffc80200b9e0 0xffffffc80200b9e0 + 0xffffffc80200b9b0: 0xffffffff8116d7e8 0x0000000000000100 + 0xffffffc80200b9c0: 0xffffffd8055b9400 0xffffffd8055b9400 + 0xffffffc80200b9d0: 0xffffffc80200b9f0 0xffffffff8047c526 + 0xffffffc80200b9e0: 0xffffffc80200ba30 0xffffffff8047fe9a + +The assembler dump of the function preambula: + add sp,sp,-16 + sd s0,8(sp) + add s0,sp,16 + +In the fist stack frame, where ra is not stored on the stack we can +observe: + + 0(sp) 8(sp) + .---------------------------------------------. + sp->| frame->fp | frame->ra (saved fp) | + |---------------------------------------------| + fp->| .... | .... | + |---------------------------------------------| + | | | + +and in the code check is performed: + if (regs && (regs->epc == pc) && (frame->fp & 0x7)) + +I see no reason to check frame->fp value at all, because it is can be +uninitialized value on the stack. A better way is to check frame->ra to +be an address on the stack. After the stacktrace shows as expect: + +[] regmap_mmio_read32le+0xe/0x1c +[] regmap_mmio_read+0x24/0x52 +[] _regmap_bus_reg_read+0x1a/0x22 +[] _regmap_read+0x5c/0xea +[] _regmap_update_bits+0x76/0xc0 +... +---[ end trace 0000000000000000 ]--- +As pointed by Samuel Holland it is incorrect to remove check of the stackframe +entirely. + +Changes since v2 [2]: + - Add accidentally forgotten curly brace + +Changes since v1 [1]: + - Instead of just dropping frame->fp check, replace it with validation of + frame->ra, which should be a stack address. + - Move frame pointer validation into the separate function. + +[1] https://lore.kernel.org/linux-riscv/20240426072701.6463-1-dev.mbstr@gmail.com/ +[2] https://lore.kernel.org/linux-riscv/20240521131314.48895-1-dev.mbstr@gmail.com/ + +Fixes: f766f77a74f5 ("riscv/stacktrace: Fix stack output without ra on the stack top") +Signed-off-by: Matthew Bystrin +Reviewed-by: Samuel Holland +Link: https://lore.kernel.org/r/20240521191727.62012-1-dev.mbstr@gmail.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/stacktrace.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c +index 64a9c093aef93..528ec7cc9a622 100644 +--- a/arch/riscv/kernel/stacktrace.c ++++ b/arch/riscv/kernel/stacktrace.c +@@ -18,6 +18,16 @@ + + extern asmlinkage void ret_from_exception(void); + ++static inline int fp_is_valid(unsigned long fp, unsigned long sp) ++{ ++ unsigned long low, high; ++ ++ low = sp + sizeof(struct stackframe); ++ high = ALIGN(sp, THREAD_SIZE); ++ ++ return !(fp < low || fp > high || fp & 0x07); ++} ++ + void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, + bool (*fn)(void *, unsigned long), void *arg) + { +@@ -41,21 +51,19 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, + } + + for (;;) { +- unsigned long low, high; + struct stackframe *frame; + + if (unlikely(!__kernel_text_address(pc) || (level++ >= 0 && !fn(arg, pc)))) + break; + +- /* Validate frame pointer */ +- low = sp + sizeof(struct stackframe); +- high = ALIGN(sp, THREAD_SIZE); +- if (unlikely(fp < low || fp > high || fp & 0x7)) ++ if (unlikely(!fp_is_valid(fp, sp))) + break; ++ + /* Unwind stack frame */ + frame = (struct stackframe *)fp - 1; + sp = fp; +- if (regs && (regs->epc == pc) && (frame->fp & 0x7)) { ++ if (regs && (regs->epc == pc) && fp_is_valid(frame->ra, sp)) { ++ /* We hit function where ra is not saved on the stack */ + fp = frame->ra; + pc = regs->ra; + } else { +-- +2.43.0 + diff --git a/queue-6.9/rpcrdma-fix-handling-for-rdma_cm_event_device_remova.patch b/queue-6.9/rpcrdma-fix-handling-for-rdma_cm_event_device_remova.patch new file mode 100644 index 00000000000..f2c68570a70 --- /dev/null +++ b/queue-6.9/rpcrdma-fix-handling-for-rdma_cm_event_device_remova.patch @@ -0,0 +1,51 @@ +From f90a90cf16b68dd7a6f4b3bcce9d2f51e2a2a39c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 12:37:59 +0300 +Subject: rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL + +From: Dan Aloni + +[ Upstream commit 4836da219781ec510c4c0303df901aa643507a7a ] + +Under the scenario of IB device bonding, when bringing down one of the +ports, or all ports, we saw xprtrdma entering a non-recoverable state +where it is not even possible to complete the disconnect and shut it +down the mount, requiring a reboot. Following debug, we saw that +transport connect never ended after receiving the +RDMA_CM_EVENT_DEVICE_REMOVAL callback. + +The DEVICE_REMOVAL callback is irrespective of whether the CM_ID is +connected, and ESTABLISHED may not have happened. So need to work with +each of these states accordingly. + +Fixes: 2acc5cae2923 ('xprtrdma: Prevent dereferencing r_xprt->rx_ep after it is freed') +Cc: Sagi Grimberg +Signed-off-by: Dan Aloni +Reviewed-by: Sagi Grimberg +Reviewed-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/verbs.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 4f8d7efa469f0..432557a553e7e 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -244,7 +244,11 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) + case RDMA_CM_EVENT_DEVICE_REMOVAL: + pr_info("rpcrdma: removing device %s for %pISpc\n", + ep->re_id->device->name, sap); +- fallthrough; ++ switch (xchg(&ep->re_connect_status, -ENODEV)) { ++ case 0: goto wake_connect_worker; ++ case 1: goto disconnected; ++ } ++ return 0; + case RDMA_CM_EVENT_ADDR_CHANGE: + ep->re_connect_status = -ENODEV; + goto disconnected; +-- +2.43.0 + diff --git a/queue-6.9/rv-update-rv_en-dis-able_monitor-doc-to-match-kernel.patch b/queue-6.9/rv-update-rv_en-dis-able_monitor-doc-to-match-kernel.patch new file mode 100644 index 00000000000..d3947688df7 --- /dev/null +++ b/queue-6.9/rv-update-rv_en-dis-able_monitor-doc-to-match-kernel.patch @@ -0,0 +1,45 @@ +From a168af5d8bf23e4dc13a8fb4aaab8a428735c272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 13:42:39 +0800 +Subject: rv: Update rv_en(dis)able_monitor doc to match kernel-doc + +From: Yang Li + +[ Upstream commit 1e8b7b3dbb3103d577a586ca72bc329f7b67120b ] + +The patch updates the function documentation comment for +rv_en(dis)able_monitor to adhere to the kernel-doc specification. + +Link: https://lore.kernel.org/linux-trace-kernel/20240520054239.61784-1-yang.lee@linux.alibaba.com + +Fixes: 102227b970a15 ("rv: Add Runtime Verification (RV) interface") +Signed-off-by: Yang Li +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/rv/rv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c +index 2f68e93fff0bc..df0745a42a3f3 100644 +--- a/kernel/trace/rv/rv.c ++++ b/kernel/trace/rv/rv.c +@@ -245,6 +245,7 @@ static int __rv_disable_monitor(struct rv_monitor_def *mdef, bool sync) + + /** + * rv_disable_monitor - disable a given runtime monitor ++ * @mdef: Pointer to the monitor definition structure. + * + * Returns 0 on success. + */ +@@ -256,6 +257,7 @@ int rv_disable_monitor(struct rv_monitor_def *mdef) + + /** + * rv_enable_monitor - enable a given runtime monitor ++ * @mdef: Pointer to the monitor definition structure. + * + * Returns 0 on success, error otherwise. + */ +-- +2.43.0 + diff --git a/queue-6.9/selftests-forwarding-change-inappropriate-log_test_s.patch b/queue-6.9/selftests-forwarding-change-inappropriate-log_test_s.patch new file mode 100644 index 00000000000..e0ed32bf705 --- /dev/null +++ b/queue-6.9/selftests-forwarding-change-inappropriate-log_test_s.patch @@ -0,0 +1,132 @@ +From 370d8a2b0c9f80b3be5a61dd8def22f45a166af1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 17:54:34 +0100 +Subject: selftests: forwarding: Change inappropriate log_test_skip() calls + +From: Petr Machata + +[ Upstream commit 677f394956e808c709c18b92bd01d19f14a96dd5 ] + +The SKIP return should be used for cases where tooling of the machine under +test is lacking. For cases where HW is lacking, the appropriate outcome is +XFAIL. + +This is the case with ethtool_rmon and mlxsw_lib. For these, introduce a +new helper, log_test_xfail(). + +Do the same for router_mpath_nh_lib. Note that it will be fixed using a +more reusable way in a following patch. + +For the two resource_scale selftests, the log should simply not be written, +because there is no problem. + +Cc: Tobias Waldekranz +Signed-off-by: Petr Machata +Link: https://lore.kernel.org/r/3d668d8fb6fa0d9eeb47ce6d9e54114348c7c179.1711464583.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: ea63ac142925 ("selftests/net: use tc rule to filter the na packet") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh | 2 +- + .../drivers/net/mlxsw/spectrum-2/resource_scale.sh | 1 - + .../drivers/net/mlxsw/spectrum/resource_scale.sh | 1 - + tools/testing/selftests/net/forwarding/ethtool_rmon.sh | 4 ++-- + tools/testing/selftests/net/forwarding/lib.sh | 9 +++++++++ + .../selftests/net/forwarding/router_mpath_nh_lib.sh | 2 +- + 6 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh b/tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh +index 6369927e9c378..48395cfd4f958 100644 +--- a/tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh ++++ b/tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh +@@ -42,7 +42,7 @@ __mlxsw_only_on_spectrum() + local src=$1; shift + + if ! mlxsw_on_spectrum "$rev"; then +- log_test_skip $src:$caller "(Spectrum-$rev only)" ++ log_test_xfail $src:$caller "(Spectrum-$rev only)" + return 1 + fi + } +diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/resource_scale.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/resource_scale.sh +index a88d8a8c85f2e..899b6892603fd 100755 +--- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/resource_scale.sh ++++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/resource_scale.sh +@@ -47,7 +47,6 @@ for current_test in ${TESTS:-$ALL_TESTS}; do + RET=0 + target=$(${current_test}_get_target "$should_fail") + if ((target == 0)); then +- log_test_skip "'$current_test' should_fail=$should_fail test" + continue + fi + +diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh +index f981c957f0975..482ebb744ebad 100755 +--- a/tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh ++++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh +@@ -52,7 +52,6 @@ for current_test in ${TESTS:-$ALL_TESTS}; do + RET=0 + target=$(${current_test}_get_target "$should_fail") + if ((target == 0)); then +- log_test_skip "'$current_test' [$profile] should_fail=$should_fail test" + continue + fi + ${current_test}_setup_prepare +diff --git a/tools/testing/selftests/net/forwarding/ethtool_rmon.sh b/tools/testing/selftests/net/forwarding/ethtool_rmon.sh +index 41a34a61f7632..e78776db850f1 100755 +--- a/tools/testing/selftests/net/forwarding/ethtool_rmon.sh ++++ b/tools/testing/selftests/net/forwarding/ethtool_rmon.sh +@@ -78,7 +78,7 @@ rmon_histogram() + + for if in $iface $neigh; do + if ! ensure_mtu $if ${bucket[0]}; then +- log_test_skip "$if does not support the required MTU for $step" ++ log_test_xfail "$if does not support the required MTU for $step" + return + fi + done +@@ -93,7 +93,7 @@ rmon_histogram() + jq -r ".[0].rmon[\"${set}-pktsNtoM\"][]|[.low, .high]|@tsv" 2>/dev/null) + + if [ $nbuckets -eq 0 ]; then +- log_test_skip "$iface does not support $set histogram counters" ++ log_test_xfail "$iface does not support $set histogram counters" + return + fi + } +diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh +index e579c2e0c462a..9042fe92ca465 100644 +--- a/tools/testing/selftests/net/forwarding/lib.sh ++++ b/tools/testing/selftests/net/forwarding/lib.sh +@@ -429,6 +429,15 @@ log_test_skip() + return 0 + } + ++log_test_xfail() ++{ ++ local test_name=$1 ++ local opt_str=$2 ++ ++ printf "TEST: %-60s [XFAIL]\n" "$test_name $opt_str" ++ return 0 ++} ++ + log_info() + { + local msg=$1 +diff --git a/tools/testing/selftests/net/forwarding/router_mpath_nh_lib.sh b/tools/testing/selftests/net/forwarding/router_mpath_nh_lib.sh +index 7e7d62161c345..b2d2c6cecc01e 100644 +--- a/tools/testing/selftests/net/forwarding/router_mpath_nh_lib.sh ++++ b/tools/testing/selftests/net/forwarding/router_mpath_nh_lib.sh +@@ -69,7 +69,7 @@ nh_stats_test_dispatch_swhw() + nh_stats_do_test "HW $what" "$nh1_id" "$nh2_id" "$group_id" \ + nh_stats_get_hw "${mz[@]}" + elif [[ $kind == veth ]]; then +- log_test_skip "HW stats not offloaded on veth topology" ++ log_test_xfail "HW stats not offloaded on veth topology" + fi + } + +-- +2.43.0 + diff --git a/queue-6.9/selftests-forwarding-convert-log_test-to-recognize-r.patch b/queue-6.9/selftests-forwarding-convert-log_test-to-recognize-r.patch new file mode 100644 index 00000000000..6bd9d3b1ecb --- /dev/null +++ b/queue-6.9/selftests-forwarding-convert-log_test-to-recognize-r.patch @@ -0,0 +1,177 @@ +From ba56fcd84e7ef1bae4a840f32c365e72fc5ef9c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 17:54:37 +0100 +Subject: selftests: forwarding: Convert log_test() to recognize RET values + +From: Petr Machata + +[ Upstream commit a923af1ceee744c187d1c08a0d7dc9e8ab7ca482 ] + +In a previous patch, the interpretation of RET value was changed to mean +the kselftest framework constant with the test outcome: $ksft_pass, +$ksft_xfail, etc. + +Update log_test() to recognize the various possible RET values. + +Then have EXIT_STATUS track the RET value of the current test. This differs +subtly from the way RET tracks the value: while for RET we want to +recognize XFAIL as a separate status, for purposes of exit code, we want to +to conflate XFAIL and PASS, because they both communicate non-failure. Thus +add a new helper, ksft_exit_status_merge(). + +With this log_test_skip() and log_test_xfail() can be reexpressed as thin +wrappers around log_test. + +Signed-off-by: Petr Machata +Link: https://lore.kernel.org/r/e5f807cb5476ab795fd14ac74da53a731a9fc432.1711464583.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: ea63ac142925 ("selftests/net: use tc rule to filter the na packet") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/lib.sh | 92 ++++++++++++++----- + tools/testing/selftests/net/lib.sh | 9 ++ + 2 files changed, 77 insertions(+), 24 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh +index 258d2082aa991..99ab42319e3e3 100644 +--- a/tools/testing/selftests/net/forwarding/lib.sh ++++ b/tools/testing/selftests/net/forwarding/lib.sh +@@ -400,6 +400,62 @@ check_err_fail() + fi + } + ++log_test_result() ++{ ++ local test_name=$1; shift ++ local opt_str=$1; shift ++ local result=$1; shift ++ local retmsg=$1; shift ++ ++ printf "TEST: %-60s [%s]\n" "$test_name $opt_str" "$result" ++ if [[ $retmsg ]]; then ++ printf "\t%s\n" "$retmsg" ++ fi ++} ++ ++pause_on_fail() ++{ ++ if [[ $PAUSE_ON_FAIL == yes ]]; then ++ echo "Hit enter to continue, 'q' to quit" ++ read a ++ [[ $a == q ]] && exit 1 ++ fi ++} ++ ++handle_test_result_pass() ++{ ++ local test_name=$1; shift ++ local opt_str=$1; shift ++ ++ log_test_result "$test_name" "$opt_str" " OK " ++} ++ ++handle_test_result_fail() ++{ ++ local test_name=$1; shift ++ local opt_str=$1; shift ++ ++ log_test_result "$test_name" "$opt_str" FAIL "$retmsg" ++ pause_on_fail ++} ++ ++handle_test_result_xfail() ++{ ++ local test_name=$1; shift ++ local opt_str=$1; shift ++ ++ log_test_result "$test_name" "$opt_str" XFAIL "$retmsg" ++ pause_on_fail ++} ++ ++handle_test_result_skip() ++{ ++ local test_name=$1; shift ++ local opt_str=$1; shift ++ ++ log_test_result "$test_name" "$opt_str" SKIP "$retmsg" ++} ++ + log_test() + { + local test_name=$1 +@@ -409,40 +465,28 @@ log_test() + opt_str="($opt_str)" + fi + +- if [[ $RET -ne 0 ]]; then +- EXIT_STATUS=1 +- printf "TEST: %-60s [FAIL]\n" "$test_name $opt_str" +- if [[ ! -z "$retmsg" ]]; then +- printf "\t%s\n" "$retmsg" +- fi +- if [ "${PAUSE_ON_FAIL}" = "yes" ]; then +- echo "Hit enter to continue, 'q' to quit" +- read a +- [ "$a" = "q" ] && exit 1 +- fi +- return 1 ++ if ((RET == ksft_pass)); then ++ handle_test_result_pass "$test_name" "$opt_str" ++ elif ((RET == ksft_xfail)); then ++ handle_test_result_xfail "$test_name" "$opt_str" ++ elif ((RET == ksft_skip)); then ++ handle_test_result_skip "$test_name" "$opt_str" ++ else ++ handle_test_result_fail "$test_name" "$opt_str" + fi + +- printf "TEST: %-60s [ OK ]\n" "$test_name $opt_str" +- return 0 ++ EXIT_STATUS=$(ksft_exit_status_merge $EXIT_STATUS $RET) ++ return $RET + } + + log_test_skip() + { +- local test_name=$1 +- local opt_str=$2 +- +- printf "TEST: %-60s [SKIP]\n" "$test_name $opt_str" +- return 0 ++ RET=$ksft_skip retmsg= log_test "$@" + } + + log_test_xfail() + { +- local test_name=$1 +- local opt_str=$2 +- +- printf "TEST: %-60s [XFAIL]\n" "$test_name $opt_str" +- return 0 ++ RET=$ksft_xfail retmsg= log_test "$@" + } + + log_info() +diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh +index b0bbde83b8461..e826ec1cc9d88 100644 +--- a/tools/testing/selftests/net/lib.sh ++++ b/tools/testing/selftests/net/lib.sh +@@ -44,6 +44,15 @@ ksft_status_merge() + $ksft_pass $ksft_xfail $ksft_skip $ksft_fail + } + ++ksft_exit_status_merge() ++{ ++ local a=$1; shift ++ local b=$1; shift ++ ++ __ksft_status_merge "$a" "$b" \ ++ $ksft_xfail $ksft_pass $ksft_skip $ksft_fail ++} ++ + busywait() + { + local timeout=$1; shift +-- +2.43.0 + diff --git a/queue-6.9/selftests-forwarding-have-ret-track-kselftest-framew.patch b/queue-6.9/selftests-forwarding-have-ret-track-kselftest-framew.patch new file mode 100644 index 00000000000..f3b12c1fa01 --- /dev/null +++ b/queue-6.9/selftests-forwarding-have-ret-track-kselftest-framew.patch @@ -0,0 +1,134 @@ +From 217adc45fd16d1cc6ef3997d033e2423cd0f073a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 17:54:36 +0100 +Subject: selftests: forwarding: Have RET track kselftest framework constants + +From: Petr Machata + +[ Upstream commit 596c8819cb78c047acc0cab03a863a9983a3cc62 ] + +The variable RET keeps track of whether the test under execution has so far +failed or not. Currently it works in binary fashion: zero means everything +is fine, non-zero means something failed. log_test() then uses the value to +given a human-readable message. + +In order to allow log_test() to report skips and xfails, the semantics of +RET need to be more fine-grained. Therefore have RET value be one of +kselftest framework constants: $ksft_fail, $ksft_xfail, etc. + +The current logic in check_err() is such that first non-zero value of RET +trumps all those that follow. But that is not right when RET has more +fine-grained value semantics. Different outcomes have different weights. + +The results of PASS and XFAIL are mostly the same: they both communicate a +test that did not go wrong. SKIP communicates lack of tooling, which the +user should go and try to fix, and as such should not be overridden by the +passes. So far, the higher-numbered statuses can be considered weightier. +But FAIL should be the weightiest. + +Add a helper, ksft_status_merge(), which merges two statuses in a way that +respects the above conditions. Express it in a generic manner, because exit +status merge is subtly different, and we want to reuse the same logic. + +Use the new helper when setting RET in check_err(). + +Re-express check_fail() in terms of check_err() to avoid duplication. + +Signed-off-by: Petr Machata +Link: https://lore.kernel.org/r/7dfff51cc925c7a3ac879b9050a0d6a327c8d21f.1711464583.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: ea63ac142925 ("selftests/net: use tc rule to filter the na packet") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/lib.sh | 21 ++++++++----- + tools/testing/selftests/net/lib.sh | 30 +++++++++++++++++++ + 2 files changed, 44 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh +index 9042fe92ca465..258d2082aa991 100644 +--- a/tools/testing/selftests/net/forwarding/lib.sh ++++ b/tools/testing/selftests/net/forwarding/lib.sh +@@ -358,14 +358,24 @@ EXIT_STATUS=0 + # Per-test return value. Clear at the beginning of each test. + RET=0 + ++ret_set_ksft_status() ++{ ++ local ksft_status=$1; shift ++ local msg=$1; shift ++ ++ RET=$(ksft_status_merge $RET $ksft_status) ++ if (( $? )); then ++ retmsg=$msg ++ fi ++} ++ + check_err() + { + local err=$1 + local msg=$2 + +- if [[ $RET -eq 0 && $err -ne 0 ]]; then +- RET=$err +- retmsg=$msg ++ if ((err)); then ++ ret_set_ksft_status $ksft_fail "$msg" + fi + } + +@@ -374,10 +384,7 @@ check_fail() + local err=$1 + local msg=$2 + +- if [[ $RET -eq 0 && $err -eq 0 ]]; then +- RET=1 +- retmsg=$msg +- fi ++ check_err $((!err)) "$msg" + } + + check_err_fail() +diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh +index 56a9454b7ba35..b0bbde83b8461 100644 +--- a/tools/testing/selftests/net/lib.sh ++++ b/tools/testing/selftests/net/lib.sh +@@ -14,6 +14,36 @@ NS_LIST="" + + ############################################################################## + # Helpers ++ ++__ksft_status_merge() ++{ ++ local a=$1; shift ++ local b=$1; shift ++ local -A weights ++ local weight=0 ++ ++ for i in "$@"; do ++ weights[$i]=$((weight++)) ++ done ++ ++ if [[ ${weights[$a]} > ${weights[$b]} ]]; then ++ echo "$a" ++ return 0 ++ else ++ echo "$b" ++ return 1 ++ fi ++} ++ ++ksft_status_merge() ++{ ++ local a=$1; shift ++ local b=$1; shift ++ ++ __ksft_status_merge "$a" "$b" \ ++ $ksft_pass $ksft_xfail $ksft_skip $ksft_fail ++} ++ + busywait() + { + local timeout=$1; shift +-- +2.43.0 + diff --git a/queue-6.9/selftests-net-kill-smcrouted-in-the-cleanup-logic-in.patch b/queue-6.9/selftests-net-kill-smcrouted-in-the-cleanup-logic-in.patch new file mode 100644 index 00000000000..2fc36d88fcc --- /dev/null +++ b/queue-6.9/selftests-net-kill-smcrouted-in-the-cleanup-logic-in.patch @@ -0,0 +1,60 @@ +From 1aca908efe3c3f0102d5a8b38f695d64b27723a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 May 2024 13:20:52 +0000 +Subject: selftests: net: kill smcrouted in the cleanup logic in amt.sh + +From: Taehee Yoo + +[ Upstream commit cc563e749810f5636451d4b833fbd689899ecdb9 ] + +The amt.sh requires smcrouted for multicasting routing. +So, it starts smcrouted before forwarding tests. +It must be stopped after all tests, but it isn't. + +To fix this issue, it kills smcrouted in the cleanup logic. + +Fixes: c08e8baea78e ("selftests: add amt interface selftest script") +Signed-off-by: Taehee Yoo +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/amt.sh | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/amt.sh b/tools/testing/selftests/net/amt.sh +index 5175a42cbe8a2..7e7ed6c558da9 100755 +--- a/tools/testing/selftests/net/amt.sh ++++ b/tools/testing/selftests/net/amt.sh +@@ -77,6 +77,7 @@ readonly LISTENER=$(mktemp -u listener-XXXXXXXX) + readonly GATEWAY=$(mktemp -u gateway-XXXXXXXX) + readonly RELAY=$(mktemp -u relay-XXXXXXXX) + readonly SOURCE=$(mktemp -u source-XXXXXXXX) ++readonly SMCROUTEDIR="$(mktemp -d)" + ERR=4 + err=0 + +@@ -85,6 +86,11 @@ exit_cleanup() + for ns in "$@"; do + ip netns delete "${ns}" 2>/dev/null || true + done ++ if [ -f "$SMCROUTEDIR/amt.pid" ]; then ++ smcpid=$(< $SMCROUTEDIR/amt.pid) ++ kill $smcpid ++ fi ++ rm -rf $SMCROUTEDIR + + exit $ERR + } +@@ -167,7 +173,7 @@ setup_iptables() + + setup_mcast_routing() + { +- ip netns exec "${RELAY}" smcrouted ++ ip netns exec "${RELAY}" smcrouted -P $SMCROUTEDIR/amt.pid + ip netns exec "${RELAY}" smcroutectl a relay_src \ + 172.17.0.2 239.0.0.1 amtr + ip netns exec "${RELAY}" smcroutectl a relay_src \ +-- +2.43.0 + diff --git a/queue-6.9/selftests-net-unify-code-of-busywait-and-slowwait.patch b/queue-6.9/selftests-net-unify-code-of-busywait-and-slowwait.patch new file mode 100644 index 00000000000..01f5f000ed4 --- /dev/null +++ b/queue-6.9/selftests-net-unify-code-of-busywait-and-slowwait.patch @@ -0,0 +1,107 @@ +From 75bd45a8c0aae4135f16fe583b739eaffd14e74d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 19:03:04 +0200 +Subject: selftests: net: Unify code of busywait() and slowwait() + +From: Petr Machata + +[ Upstream commit a4022a332f437ae5b10921d66058ce98a2db2c20 ] + +Bodies of busywait() and slowwait() functions are almost identical. Extract +the common code into a helper, loopy_wait, and convert busywait() and +slowwait() into trivial wrappers. + +Moreover, the fact that slowwait() uses seconds for units is really not +intuitive, and the comment does not help much. Instead make the unit part +of the name of the argument to further clarify what units are expected. + +Cc: Hangbin Liu +Signed-off-by: Petr Machata +Reviewed-by: Benjamin Poirier +Reviewed-by: Hangbin Liu +Signed-off-by: Paolo Abeni +Stable-dep-of: ea63ac142925 ("selftests/net: use tc rule to filter the na packet") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/lib.sh | 22 ++----------------- + tools/testing/selftests/net/lib.sh | 16 +++++++++++--- + 2 files changed, 15 insertions(+), 23 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh +index 99ab42319e3e3..01322758255f7 100644 +--- a/tools/testing/selftests/net/forwarding/lib.sh ++++ b/tools/testing/selftests/net/forwarding/lib.sh +@@ -41,27 +41,9 @@ source "$net_forwarding_dir/../lib.sh" + # timeout in seconds + slowwait() + { +- local timeout=$1; shift +- +- local start_time="$(date -u +%s)" +- while true +- do +- local out +- out=$("$@") +- local ret=$? +- if ((!ret)); then +- echo -n "$out" +- return 0 +- fi ++ local timeout_sec=$1; shift + +- local current_time="$(date -u +%s)" +- if ((current_time - start_time > timeout)); then +- echo -n "$out" +- return 1 +- fi +- +- sleep 0.1 +- done ++ loopy_wait "sleep 0.1" "$((timeout_sec * 1000))" "$@" + } + + ############################################################################## +diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh +index e826ec1cc9d88..308c3b0bcf210 100644 +--- a/tools/testing/selftests/net/lib.sh ++++ b/tools/testing/selftests/net/lib.sh +@@ -53,9 +53,10 @@ ksft_exit_status_merge() + $ksft_xfail $ksft_pass $ksft_skip $ksft_fail + } + +-busywait() ++loopy_wait() + { +- local timeout=$1; shift ++ local sleep_cmd=$1; shift ++ local timeout_ms=$1; shift + + local start_time="$(date -u +%s%3N)" + while true +@@ -69,13 +70,22 @@ busywait() + fi + + local current_time="$(date -u +%s%3N)" +- if ((current_time - start_time > timeout)); then ++ if ((current_time - start_time > timeout_ms)); then + echo -n "$out" + return 1 + fi ++ ++ $sleep_cmd + done + } + ++busywait() ++{ ++ local timeout_ms=$1; shift ++ ++ loopy_wait : "$timeout_ms" "$@" ++} ++ + cleanup_ns() + { + local ns="" +-- +2.43.0 + diff --git a/queue-6.9/selftests-net-use-tc-rule-to-filter-the-na-packet.patch b/queue-6.9/selftests-net-use-tc-rule-to-filter-the-na-packet.patch new file mode 100644 index 00000000000..c6a988b9fe0 --- /dev/null +++ b/queue-6.9/selftests-net-use-tc-rule-to-filter-the-na-packet.patch @@ -0,0 +1,289 @@ +From fc53c0927087f0452e0d9073f80fd50c4af6005e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 09:03:27 +0800 +Subject: selftests/net: use tc rule to filter the na packet + +From: Hangbin Liu + +[ Upstream commit ea63ac14292564eefc7dffe868ed354ff9ed6f4b ] + +Test arp_ndisc_untracked_subnets use tcpdump to filter the unsolicited +and untracked na messages. It set -e before calling tcpdump. But if +tcpdump filters 0 packet, it will return none zero, and cause the script +to exit. + +Instead of using slow tcpdump to capture packets, let's using tc rule +to filter out the na message. + +At the same time, fix function setup_v6 which only needs one parameter. +Move all the related helpers from forwarding lib.sh to net lib.sh. + +Fixes: 0ea7b0a454ca ("selftests: net: arp_ndisc_untracked_subnets: test for arp_accept and accept_untracked_na") +Signed-off-by: Hangbin Liu +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240517010327.2631319-1-liuhangbin@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/arp_ndisc_untracked_subnets.sh | 53 ++++++----------- + tools/testing/selftests/net/forwarding/lib.sh | 58 ------------------- + tools/testing/selftests/net/lib.sh | 58 +++++++++++++++++++ + 3 files changed, 75 insertions(+), 94 deletions(-) + +diff --git a/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh b/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh +index a40c0e9bd023c..eef5cbf6eecca 100755 +--- a/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh ++++ b/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh +@@ -73,25 +73,19 @@ setup_v6() { + # namespaces. veth0 is veth-router, veth1 is veth-host. + # first, set up the inteface's link to the namespace + # then, set the interface "up" +- ip -6 -netns ${ROUTER_NS_V6} link add name ${ROUTER_INTF} \ +- type veth peer name ${HOST_INTF} +- +- ip -6 -netns ${ROUTER_NS_V6} link set dev ${ROUTER_INTF} up +- ip -6 -netns ${ROUTER_NS_V6} link set dev ${HOST_INTF} netns \ +- ${HOST_NS_V6} ++ ip -n ${ROUTER_NS_V6} link add name ${ROUTER_INTF} \ ++ type veth peer name ${HOST_INTF} netns ${HOST_NS_V6} + +- ip -6 -netns ${HOST_NS_V6} link set dev ${HOST_INTF} up +- ip -6 -netns ${ROUTER_NS_V6} addr add \ +- ${ROUTER_ADDR_V6}/${PREFIX_WIDTH_V6} dev ${ROUTER_INTF} nodad ++ # Add tc rule to filter out host na message ++ tc -n ${ROUTER_NS_V6} qdisc add dev ${ROUTER_INTF} clsact ++ tc -n ${ROUTER_NS_V6} filter add dev ${ROUTER_INTF} \ ++ ingress protocol ipv6 pref 1 handle 101 \ ++ flower src_ip ${HOST_ADDR_V6} ip_proto icmpv6 type 136 skip_hw action pass + + HOST_CONF=net.ipv6.conf.${HOST_INTF} + ip netns exec ${HOST_NS_V6} sysctl -qw ${HOST_CONF}.ndisc_notify=1 + ip netns exec ${HOST_NS_V6} sysctl -qw ${HOST_CONF}.disable_ipv6=0 +- ip -6 -netns ${HOST_NS_V6} addr add ${HOST_ADDR_V6}/${PREFIX_WIDTH_V6} \ +- dev ${HOST_INTF} +- + ROUTER_CONF=net.ipv6.conf.${ROUTER_INTF} +- + ip netns exec ${ROUTER_NS_V6} sysctl -w \ + ${ROUTER_CONF}.forwarding=1 >/dev/null 2>&1 + ip netns exec ${ROUTER_NS_V6} sysctl -w \ +@@ -99,6 +93,13 @@ setup_v6() { + ip netns exec ${ROUTER_NS_V6} sysctl -w \ + ${ROUTER_CONF}.accept_untracked_na=${accept_untracked_na} \ + >/dev/null 2>&1 ++ ++ ip -n ${ROUTER_NS_V6} link set dev ${ROUTER_INTF} up ++ ip -n ${HOST_NS_V6} link set dev ${HOST_INTF} up ++ ip -n ${ROUTER_NS_V6} addr add ${ROUTER_ADDR_V6}/${PREFIX_WIDTH_V6} \ ++ dev ${ROUTER_INTF} nodad ++ ip -n ${HOST_NS_V6} addr add ${HOST_ADDR_V6}/${PREFIX_WIDTH_V6} \ ++ dev ${HOST_INTF} + set +e + } + +@@ -162,26 +163,6 @@ arp_test_gratuitous_combinations() { + arp_test_gratuitous 2 1 + } + +-cleanup_tcpdump() { +- set -e +- [[ ! -z ${tcpdump_stdout} ]] && rm -f ${tcpdump_stdout} +- [[ ! -z ${tcpdump_stderr} ]] && rm -f ${tcpdump_stderr} +- tcpdump_stdout= +- tcpdump_stderr= +- set +e +-} +- +-start_tcpdump() { +- set -e +- tcpdump_stdout=`mktemp` +- tcpdump_stderr=`mktemp` +- ip netns exec ${ROUTER_NS_V6} timeout 15s \ +- tcpdump --immediate-mode -tpni ${ROUTER_INTF} -c 1 \ +- "icmp6 && icmp6[0] == 136 && src ${HOST_ADDR_V6}" \ +- > ${tcpdump_stdout} 2> /dev/null +- set +e +-} +- + verify_ndisc() { + local accept_untracked_na=$1 + local same_subnet=$2 +@@ -222,8 +203,9 @@ ndisc_test_untracked_advertisements() { + HOST_ADDR_V6=2001:db8:abcd:0012::3 + fi + fi +- setup_v6 $1 $2 +- start_tcpdump ++ setup_v6 $1 ++ slowwait_for_counter 15 1 \ ++ tc_rule_handle_stats_get "dev ${ROUTER_INTF} ingress" 101 ".packets" "-n ${ROUTER_NS_V6}" + + if verify_ndisc $1 $2; then + printf " TEST: %-60s [ OK ]\n" "${test_msg[*]}" +@@ -231,7 +213,6 @@ ndisc_test_untracked_advertisements() { + printf " TEST: %-60s [FAIL]\n" "${test_msg[*]}" + fi + +- cleanup_tcpdump + cleanup_v6 + set +e + } +diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh +index 01322758255f7..e78f11140edd8 100644 +--- a/tools/testing/selftests/net/forwarding/lib.sh ++++ b/tools/testing/selftests/net/forwarding/lib.sh +@@ -38,14 +38,6 @@ fi + + source "$net_forwarding_dir/../lib.sh" + +-# timeout in seconds +-slowwait() +-{ +- local timeout_sec=$1; shift +- +- loopy_wait "sleep 0.1" "$((timeout_sec * 1000))" "$@" +-} +- + ############################################################################## + # Sanity checks + +@@ -529,33 +521,6 @@ wait_for_trap() + "$@" | grep -q trap + } + +-until_counter_is() +-{ +- local expr=$1; shift +- local current=$("$@") +- +- echo $((current)) +- ((current $expr)) +-} +- +-busywait_for_counter() +-{ +- local timeout=$1; shift +- local delta=$1; shift +- +- local base=$("$@") +- busywait "$timeout" until_counter_is ">= $((base + delta))" "$@" +-} +- +-slowwait_for_counter() +-{ +- local timeout=$1; shift +- local delta=$1; shift +- +- local base=$("$@") +- slowwait "$timeout" until_counter_is ">= $((base + delta))" "$@" +-} +- + setup_wait_dev() + { + local dev=$1; shift +@@ -861,29 +826,6 @@ link_stats_rx_errors_get() + link_stats_get $1 rx errors + } + +-tc_rule_stats_get() +-{ +- local dev=$1; shift +- local pref=$1; shift +- local dir=$1; shift +- local selector=${1:-.packets}; shift +- +- tc -j -s filter show dev $dev ${dir:-ingress} pref $pref \ +- | jq ".[1].options.actions[].stats$selector" +-} +- +-tc_rule_handle_stats_get() +-{ +- local id=$1; shift +- local handle=$1; shift +- local selector=${1:-.packets}; shift +- local netns=${1:-""}; shift +- +- tc $netns -j -s filter show $id \ +- | jq ".[] | select(.options.handle == $handle) | \ +- .options.actions[0].stats$selector" +-} +- + ethtool_stats_get() + { + local dev=$1; shift +diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh +index 308c3b0bcf210..fb640fb9e8d32 100644 +--- a/tools/testing/selftests/net/lib.sh ++++ b/tools/testing/selftests/net/lib.sh +@@ -86,6 +86,41 @@ busywait() + loopy_wait : "$timeout_ms" "$@" + } + ++# timeout in seconds ++slowwait() ++{ ++ local timeout_sec=$1; shift ++ ++ loopy_wait "sleep 0.1" "$((timeout_sec * 1000))" "$@" ++} ++ ++until_counter_is() ++{ ++ local expr=$1; shift ++ local current=$("$@") ++ ++ echo $((current)) ++ ((current $expr)) ++} ++ ++busywait_for_counter() ++{ ++ local timeout=$1; shift ++ local delta=$1; shift ++ ++ local base=$("$@") ++ busywait "$timeout" until_counter_is ">= $((base + delta))" "$@" ++} ++ ++slowwait_for_counter() ++{ ++ local timeout=$1; shift ++ local delta=$1; shift ++ ++ local base=$("$@") ++ slowwait "$timeout" until_counter_is ">= $((base + delta))" "$@" ++} ++ + cleanup_ns() + { + local ns="" +@@ -145,3 +180,26 @@ setup_ns() + done + NS_LIST="$NS_LIST $ns_list" + } ++ ++tc_rule_stats_get() ++{ ++ local dev=$1; shift ++ local pref=$1; shift ++ local dir=$1; shift ++ local selector=${1:-.packets}; shift ++ ++ tc -j -s filter show dev $dev ${dir:-ingress} pref $pref \ ++ | jq ".[1].options.actions[].stats$selector" ++} ++ ++tc_rule_handle_stats_get() ++{ ++ local id=$1; shift ++ local handle=$1; shift ++ local selector=${1:-.packets}; shift ++ local netns=${1:-""}; shift ++ ++ tc $netns -j -s filter show $id \ ++ | jq ".[] | select(.options.handle == $handle) | \ ++ .options.actions[0].stats$selector" ++} +-- +2.43.0 + diff --git a/queue-6.9/selftests-powerpc-dexcr-add-no-pie-to-hashchk-tests.patch b/queue-6.9/selftests-powerpc-dexcr-add-no-pie-to-hashchk-tests.patch new file mode 100644 index 00000000000..01c23e87fcc --- /dev/null +++ b/queue-6.9/selftests-powerpc-dexcr-add-no-pie-to-hashchk-tests.patch @@ -0,0 +1,41 @@ +From d6b02f56f55bee650ec8e5efa5b15bb170c609e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 21:23:17 +1000 +Subject: selftests/powerpc/dexcr: Add -no-pie to hashchk tests + +From: Benjamin Gray + +[ Upstream commit d7228a58d9438d6f219dc7f33eab0d1980b3bd2f ] + +The hashchk tests want to verify that the hash key is changed over exec. +It does so by calculating hashes at the same address across an exec. +This is made simpler by disabling PIE functionality, so we can +re-execute ourselves and be using the same addresses in the child. + +While -fno-pie is already added, -no-pie is also required. + +Fixes: bdb07f35a52f ("selftests/powerpc/dexcr: Add hashst/hashchk test") +Signed-off-by: Benjamin Gray +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240417112325.728010-2-bgray@linux.ibm.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/dexcr/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/powerpc/dexcr/Makefile b/tools/testing/selftests/powerpc/dexcr/Makefile +index 76210f2bcec3c..829ad075b4a44 100644 +--- a/tools/testing/selftests/powerpc/dexcr/Makefile ++++ b/tools/testing/selftests/powerpc/dexcr/Makefile +@@ -3,7 +3,7 @@ TEST_GEN_FILES := lsdexcr + + include ../../lib.mk + +-$(OUTPUT)/hashchk_test: CFLAGS += -fno-pie $(call cc-option,-mno-rop-protect) ++$(OUTPUT)/hashchk_test: CFLAGS += -fno-pie -no-pie $(call cc-option,-mno-rop-protect) + + $(TEST_GEN_PROGS): ../harness.c ../utils.c ./dexcr.c + $(TEST_GEN_FILES): ../utils.c ./dexcr.c +-- +2.43.0 + diff --git a/queue-6.9/series b/queue-6.9/series index 7cebbf114ac..64ad140a8c7 100644 --- a/queue-6.9/series +++ b/queue-6.9/series @@ -143,3 +143,139 @@ ocfs2-correctly-use-ocfs2_find_next_zero_bit.patch selftests-harness-use-1024-in-place-of-line_max.patch mailbox-mtk-cmdq-fix-pm_runtime_get_sync-warning-in-.patch gpiolib-acpi-fix-failed-in-acpi_gpiochip_find-by-add.patch +input-ims-pcu-fix-printf-string-overflow.patch +input-ioc3kbd-add-device-table.patch +mmc-sdhci_am654-add-tuning-algorithm-for-delay-chain.patch +mmc-sdhci_am654-write-itapdly-for-ddr52-timing.patch +mmc-sdhci_am654-add-otap-itap-delay-enable.patch +mmc-sdhci_am654-add-itapdlysel-in-sdhci_j721e_4bit_s.patch +mmc-sdhci_am654-fix-itapdly-for-hs400-timing.patch +x86-percpu-unify-arch_raw_cpu_ptr-defines.patch +x86-percpu-use-__force-to-cast-from-__percpu-address.patch +phy-qcom-qmp-combo-fix-sm8650-voltage-swing-table.patch +input-pm8xxx-vibrator-correct-vib_max_levels-calcula.patch +media-ti-j721e-csi2rx-fix-races-while-restarting-dma.patch +media-v4l-don-t-turn-on-privacy-led-if-streamon-fail.patch +media-ov2680-clear-the-ret-variable-on-success.patch +media-ov2680-allow-probing-if-link-frequencies-is-ab.patch +media-ov2680-do-not-fail-if-data-lanes-property-is-a.patch +drm-msm-dsi-print-dual-dsi-adjusted-pclk-instead-of-.patch +drm-msm-dpu-always-flush-the-slave-intf-on-the-ctl.patch +drm-msm-dpu-allow-configuring-multiple-active-dsc-bl.patch +drm-mediatek-dp-fix-mtk_dp_aux_transfer-return-value.patch +drm-meson-gate-px_clk-when-setting-rate.patch +um-fix-return-value-in-ubd_init.patch +um-add-winch-to-winch_handlers-before-registering-wi.patch +um-vector-fix-bpfflash-parameter-evaluation.patch +fs-ntfs3-check-folio-pointer-for-null.patch +fs-ntfs3-use-64-bit-variable-to-avoid-32-bit-overflo.patch +fs-ntfs3-use-variable-length-array-instead-of-fixed-.patch +drm-msm-dpu-add-callback-function-pointer-check-befo.patch +drm-bridge-tc358775-fix-support-for-jeida-18-and-jei.patch +media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch +drm-make-drivers-depends-on-drm_dw_hdmi.patch +drm-bridge-imx-fix-unmet-depenency-for-phy_fsl_samsu.patch +string_kunit-add-test-cases-for-str-cmp-functions.patch +string-prepare-to-merge-strscpy_kunit.c-into-string_.patch +string-prepare-to-merge-strcat-kunit-tests-into-stri.patch +input-cyapa-add-missing-input-core-locking-to-suspen.patch +drm-amdgpu-init-microcode-chip-name-from-ip-versions.patch +drm-amdgpu-fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch +media-mediatek-vcodec-fix-possible-unbalanced-pm-cou.patch +tools-arch-x86-intel_sdsi-fix-maximum-meter-bundle-l.patch +tools-arch-x86-intel_sdsi-fix-meter_show-display.patch +tools-arch-x86-intel_sdsi-fix-meter_certificate-deco.patch +platform-x86-thinkpad_acpi-take-hotkey_mutex-during-.patch +media-flexcop-usb-fix-sanity-check-of-bnumendpoints.patch +powerpc-pseries-add-failure-related-checks-for-h_get.patch +asoc-sof-debug-handle-cases-when-fw_lib_prefix-is-no.patch +um-fix-the-wmissing-prototypes-warning-for-__switch_.patch +um-fix-the-wmissing-prototypes-warning-for-get_threa.patch +um-fix-the-declaration-of-kasan_map_memory.patch +cxl-trace-correct-dpa-field-masks-for-general_media-.patch +cxl-region-fix-cxlr_pmem-leaks.patch +media-sunxi-a83-mips-csi2-also-select-generic_phy.patch +media-cec-cec-adap-always-cancel-work-in-cec_transmi.patch +media-cec-cec-api-add-locking-in-cec_release.patch +media-cec-core-avoid-recursive-cec_claim_log_addrs.patch +media-cec-core-avoid-confusing-transmit-timed-out-me.patch +revert-drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch +drm-zynqmp_dpsub-always-register-bridge.patch +asoc-amd-acp-fix-for-acp-platform-device-creation-fa.patch +selftests-powerpc-dexcr-add-no-pie-to-hashchk-tests.patch +drm-msm-adreno-fix-cp-cycles-stat-retrieval-on-a7xx.patch +drm-msm-a6xx-avoid-a-nullptr-dereference-when-speedb.patch +asoc-tas2781-fix-a-warning-reported-by-robot-kernel-.patch +null_blk-fix-the-warning-modpost-missing-module_desc.patch +printk-fix-log_cpu_max_buf_shift-when-base_small-is-.patch +powerpc-bpf-32-fix-failing-test_bpf-tests.patch +kvm-ppc-book3s-hv-nestedv2-cancel-pending-dec-except.patch +kvm-ppc-book3s-hv-nestedv2-fix-an-error-handling-pat.patch +kvm-arm64-destroy-mpidr_data-for-late-vcpu-creation.patch +nilfs2-make-superblock-data-array-index-computation-.patch +alsa-hda-cs_dsp_ctl-use-private_free-for-control-cle.patch +alsa-hda-hda_component-initialize-shared-data-during.patch +alsa-hda-cs35l56-fix-lifetime-of-cs_dsp-instance.patch +asoc-mediatek-mt8192-fix-register-configuration-for-.patch +asoc-rt715-sdca-sdw-fix-wrong-complete-waiting-in-rt.patch +alsa-hda-realtek-drop-doubly-quirk-entry-for-103c-8a.patch +drm-nouveau-use-tile_mode-and-pte_kind-for-vm_bind-b.patch +bluetooth-iso-handle-pa-sync-when-no-biginfo-reports.patch +bluetooth-l2cap-fix-div-by-zero-in-l2cap_le_flowctl_.patch +blk-cgroup-fix-list-corruption-from-resetting-io-sta.patch +blk-cgroup-fix-list-corruption-from-reorder-of-write.patch +blk-cgroup-properly-propagate-the-iostat-update-up-t.patch +regulator-bd71828-don-t-overwrite-runtime-voltages.patch +xen-x86-add-extra-pages-to-unpopulated-alloc-if-avai.patch +perf-arm-dmc620-fix-lockdep-assert-in-event_init.patch +ubsan-restore-dependency-on-arch_has_ubsan.patch +x86-kconfig-select-arch_want_frame_pointers-again-wh.patch +net-always-descend-into-dsa-folder-with-config_net_d.patch +ipv6-sr-fix-missing-sk_buff-release-in-seg6_input_co.patch +selftests-net-kill-smcrouted-in-the-cleanup-logic-in.patch +nfc-nci-fix-uninit-value-in-nci_rx_work.patch +asoc-tas2552-add-tx-path-for-capturing-audio-out-dat.patch +asoc-tas2781-fix-wrong-loading-calibrated-data-seque.patch +nfsv4-fixup-smatch-warning-for-ambiguous-return.patch +nfs-keep-server-info-for-remounts.patch +sunrpc-fix-nfsacl-rpc-retry-on-soft-mount.patch +rpcrdma-fix-handling-for-rdma_cm_event_device_remova.patch +regulator-pickable-ranges-don-t-always-cache-vsel.patch +regulator-tps6287x-force-writing-vsel-bit.patch +af_unix-update-unix_sk-sk-oob_skb-under-sk_receive_q.patch +ipv6-sr-fix-memleak-in-seg6_hmac_init_algo.patch +selftests-forwarding-change-inappropriate-log_test_s.patch +selftests-forwarding-have-ret-track-kselftest-framew.patch +selftests-forwarding-convert-log_test-to-recognize-r.patch +selftests-net-unify-code-of-busywait-and-slowwait.patch +selftests-net-use-tc-rule-to-filter-the-na-packet.patch +regulator-tps6594-regulator-correct-multi-phase-conf.patch +tcp-fix-shift-out-of-bounds-in-dctcp_update_alpha.patch +pnfs-filelayout-fixup-pnfs-allocation-modes.patch +openvswitch-set-the-skbuff-pkt_type-for-proper-pmtud.patch +arm64-asm-bug-add-.align-2-to-the-end-of-__bug_entry.patch +rv-update-rv_en-dis-able_monitor-doc-to-match-kernel.patch +net-lan966x-remove-ptp-traps-in-case-the-ptp-is-not-.patch +virtio_balloon-give-the-balloon-its-own-wakeup-sourc.patch +virtio-delete-vq-in-vp_find_vqs_msix-when-request_ir.patch +riscv-cpufeature-fix-thead-vector-hwcap-removal.patch +riscv-cpufeature-fix-extension-subset-checking.patch +i3c-master-svc-change-enxio-to-eagain-when-ibi-occur.patch +riscv-stacktrace-fixed-walk_stackframe.patch +riscv-selftests-add-hwprobe-binaries-to-.gitignore.patch +revert-ixgbe-manual-an-37-for-troublesome-link-partn.patch +net-fec-avoid-lock-evasion-when-reading-pps_enable.patch +tls-fix-missing-memory-barrier-in-tls_init.patch +tcp-remove-64-kbyte-limit-for-initial-tp-rcv_wnd-val.patch +net-relax-socket-state-check-at-accept-time.patch +nfc-nci-fix-handling-of-zero-length-payload-packets-.patch +drivers-xen-improve-the-late-xenstore-init-protocol.patch +ice-interpret-.set_channels-input-differently.patch +idpf-interpret-.set_channels-input-differently.patch +null_blk-fix-null-ptr-dereference-while-configuring-.patch +netfs-fix-setting-of-bdp_async-from-iocb-flags.patch +kasan-fortify-properly-rename-memintrinsics.patch +cifs-set-zero_point-in-the-copy_file_range-and-remap.patch +cifs-fix-missing-set-of-remote_i_size.patch +tracing-probes-fix-error-check-in-parse_btf_field.patch +tpm_tis_spi-account-for-spi-header-when-allocating-t.patch diff --git a/queue-6.9/string-prepare-to-merge-strcat-kunit-tests-into-stri.patch b/queue-6.9/string-prepare-to-merge-strcat-kunit-tests-into-stri.patch new file mode 100644 index 00000000000..f0146902f0a --- /dev/null +++ b/queue-6.9/string-prepare-to-merge-strcat-kunit-tests-into-stri.patch @@ -0,0 +1,69 @@ +From d95f5c07c4fdf467ae32a8587c5bd0d71c277a9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 07:01:52 -0700 +Subject: string: Prepare to merge strcat KUnit tests into string_kunit.c + +From: Kees Cook + +[ Upstream commit 6e4ef1429f3be236e145c6115b539acdbd2e299c ] + +The test naming convention differs between string_kunit.c and +strcat_kunit.c. Move "test" to the beginning of the function name. + +Reviewed-by: Andy Shevchenko +Tested-by: Ivan Orlov +Link: https://lore.kernel.org/r/20240419140155.3028912-3-keescook@chromium.org +Signed-off-by: Kees Cook +Stable-dep-of: 5bb288c4abc2 ("scsi: mptfusion: Avoid possible run-time warning with long manufacturer strings") +Signed-off-by: Sasha Levin +--- + lib/strcat_kunit.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/lib/strcat_kunit.c b/lib/strcat_kunit.c +index e21be95514afa..ca09f7f0e6a26 100644 +--- a/lib/strcat_kunit.c ++++ b/lib/strcat_kunit.c +@@ -10,7 +10,7 @@ + + static volatile int unconst; + +-static void strcat_test(struct kunit *test) ++static void test_strcat(struct kunit *test) + { + char dest[8]; + +@@ -29,7 +29,7 @@ static void strcat_test(struct kunit *test) + KUNIT_EXPECT_STREQ(test, dest, "fourAB"); + } + +-static void strncat_test(struct kunit *test) ++static void test_strncat(struct kunit *test) + { + char dest[8]; + +@@ -56,7 +56,7 @@ static void strncat_test(struct kunit *test) + KUNIT_EXPECT_STREQ(test, dest, "fourAB"); + } + +-static void strlcat_test(struct kunit *test) ++static void test_strlcat(struct kunit *test) + { + char dest[8] = ""; + int len = sizeof(dest) + unconst; +@@ -88,9 +88,9 @@ static void strlcat_test(struct kunit *test) + } + + static struct kunit_case strcat_test_cases[] = { +- KUNIT_CASE(strcat_test), +- KUNIT_CASE(strncat_test), +- KUNIT_CASE(strlcat_test), ++ KUNIT_CASE(test_strcat), ++ KUNIT_CASE(test_strncat), ++ KUNIT_CASE(test_strlcat), + {} + }; + +-- +2.43.0 + diff --git a/queue-6.9/string-prepare-to-merge-strscpy_kunit.c-into-string_.patch b/queue-6.9/string-prepare-to-merge-strscpy_kunit.c-into-string_.patch new file mode 100644 index 00000000000..4d2ee14384f --- /dev/null +++ b/queue-6.9/string-prepare-to-merge-strscpy_kunit.c-into-string_.patch @@ -0,0 +1,127 @@ +From 996fbf410a035c8897a29deefe0829813408d5dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 07:01:50 -0700 +Subject: string: Prepare to merge strscpy_kunit.c into string_kunit.c + +From: Kees Cook + +[ Upstream commit b03442f761aae4bbb093a281ad2205bc346188f5 ] + +In preparation for moving the strscpy_kunit.c tests into string_kunit.c, +rename "tc" to "strscpy_check" for better readability. + +Reviewed-by: Andy Shevchenko +Tested-by: Ivan Orlov +Link: https://lore.kernel.org/r/20240419140155.3028912-1-keescook@chromium.org +Signed-off-by: Kees Cook +Stable-dep-of: 5bb288c4abc2 ("scsi: mptfusion: Avoid possible run-time warning with long manufacturer strings") +Signed-off-by: Sasha Levin +--- + lib/strscpy_kunit.c | 51 +++++++++++++++++++++++---------------------- + 1 file changed, 26 insertions(+), 25 deletions(-) + +diff --git a/lib/strscpy_kunit.c b/lib/strscpy_kunit.c +index a6b6344354ed5..b6d1d93a88832 100644 +--- a/lib/strscpy_kunit.c ++++ b/lib/strscpy_kunit.c +@@ -8,22 +8,23 @@ + #include + #include + +-/* +- * tc() - Run a specific test case. ++/** ++ * strscpy_check() - Run a specific test case. ++ * @test: KUnit test context pointer + * @src: Source string, argument to strscpy_pad() + * @count: Size of destination buffer, argument to strscpy_pad() + * @expected: Expected return value from call to strscpy_pad() +- * @terminator: 1 if there should be a terminating null byte 0 otherwise. + * @chars: Number of characters from the src string expected to be + * written to the dst buffer. ++ * @terminator: 1 if there should be a terminating null byte 0 otherwise. + * @pad: Number of pad characters expected (in the tail of dst buffer). + * (@pad does not include the null terminator byte.) + * + * Calls strscpy_pad() and verifies the return value and state of the + * destination buffer after the call returns. + */ +-static void tc(struct kunit *test, char *src, int count, int expected, +- int chars, int terminator, int pad) ++static void strscpy_check(struct kunit *test, char *src, int count, ++ int expected, int chars, int terminator, int pad) + { + int nr_bytes_poison; + int max_expected; +@@ -79,12 +80,12 @@ static void tc(struct kunit *test, char *src, int count, int expected, + } + } + +-static void strscpy_test(struct kunit *test) ++static void test_strscpy(struct kunit *test) + { + char dest[8]; + + /* +- * tc() uses a destination buffer of size 6 and needs at ++ * strscpy_check() uses a destination buffer of size 6 and needs at + * least 2 characters spare (one for null and one to check for + * overflow). This means we should only call tc() with + * strings up to a maximum of 4 characters long and 'count' +@@ -92,27 +93,27 @@ static void strscpy_test(struct kunit *test) + * the buffer size in tc(). + */ + +- /* tc(test, src, count, expected, chars, terminator, pad) */ +- tc(test, "a", 0, -E2BIG, 0, 0, 0); +- tc(test, "", 0, -E2BIG, 0, 0, 0); ++ /* strscpy_check(test, src, count, expected, chars, terminator, pad) */ ++ strscpy_check(test, "a", 0, -E2BIG, 0, 0, 0); ++ strscpy_check(test, "", 0, -E2BIG, 0, 0, 0); + +- tc(test, "a", 1, -E2BIG, 0, 1, 0); +- tc(test, "", 1, 0, 0, 1, 0); ++ strscpy_check(test, "a", 1, -E2BIG, 0, 1, 0); ++ strscpy_check(test, "", 1, 0, 0, 1, 0); + +- tc(test, "ab", 2, -E2BIG, 1, 1, 0); +- tc(test, "a", 2, 1, 1, 1, 0); +- tc(test, "", 2, 0, 0, 1, 1); ++ strscpy_check(test, "ab", 2, -E2BIG, 1, 1, 0); ++ strscpy_check(test, "a", 2, 1, 1, 1, 0); ++ strscpy_check(test, "", 2, 0, 0, 1, 1); + +- tc(test, "abc", 3, -E2BIG, 2, 1, 0); +- tc(test, "ab", 3, 2, 2, 1, 0); +- tc(test, "a", 3, 1, 1, 1, 1); +- tc(test, "", 3, 0, 0, 1, 2); ++ strscpy_check(test, "abc", 3, -E2BIG, 2, 1, 0); ++ strscpy_check(test, "ab", 3, 2, 2, 1, 0); ++ strscpy_check(test, "a", 3, 1, 1, 1, 1); ++ strscpy_check(test, "", 3, 0, 0, 1, 2); + +- tc(test, "abcd", 4, -E2BIG, 3, 1, 0); +- tc(test, "abc", 4, 3, 3, 1, 0); +- tc(test, "ab", 4, 2, 2, 1, 1); +- tc(test, "a", 4, 1, 1, 1, 2); +- tc(test, "", 4, 0, 0, 1, 3); ++ strscpy_check(test, "abcd", 4, -E2BIG, 3, 1, 0); ++ strscpy_check(test, "abc", 4, 3, 3, 1, 0); ++ strscpy_check(test, "ab", 4, 2, 2, 1, 1); ++ strscpy_check(test, "a", 4, 1, 1, 1, 2); ++ strscpy_check(test, "", 4, 0, 0, 1, 3); + + /* Compile-time-known source strings. */ + KUNIT_EXPECT_EQ(test, strscpy(dest, "", ARRAY_SIZE(dest)), 0); +@@ -127,7 +128,7 @@ static void strscpy_test(struct kunit *test) + } + + static struct kunit_case strscpy_test_cases[] = { +- KUNIT_CASE(strscpy_test), ++ KUNIT_CASE(test_strscpy), + {} + }; + +-- +2.43.0 + diff --git a/queue-6.9/string_kunit-add-test-cases-for-str-cmp-functions.patch b/queue-6.9/string_kunit-add-test-cases-for-str-cmp-functions.patch new file mode 100644 index 00000000000..d674de4d035 --- /dev/null +++ b/queue-6.9/string_kunit-add-test-cases-for-str-cmp-functions.patch @@ -0,0 +1,221 @@ +From c3b2bf825a15a665fe3d6f3a43d8a5e80bafa9b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 00:30:33 +0100 +Subject: string_kunit: Add test cases for str*cmp functions + +From: Ivan Orlov + +[ Upstream commit 9259a4721699947ceb397037991c0e4acc496b21 ] + +Currently, str*cmp functions (strcmp, strncmp, strcasecmp and +strncasecmp) are not covered with tests. Extend the `string_kunit.c` +test by adding the test cases for them. + +This patch adds 8 more test cases: + +1) strcmp test +2) strcmp test on long strings (2048 chars) +3) strncmp test +4) strncmp test on long strings (2048 chars) +5) strcasecmp test +6) strcasecmp test on long strings +7) strncasecmp test +8) strncasecmp test on long strings + +These test cases aim at covering as many edge cases as possible, +including the tests on empty strings, situations when the different +symbol is placed at the end of one of the strings, etc. + +Signed-off-by: Ivan Orlov +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240417233033.717596-1-ivan.orlov0322@gmail.com +Signed-off-by: Kees Cook +Stable-dep-of: 5bb288c4abc2 ("scsi: mptfusion: Avoid possible run-time warning with long manufacturer strings") +Signed-off-by: Sasha Levin +--- + lib/string_kunit.c | 155 +++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 155 insertions(+) + +diff --git a/lib/string_kunit.c b/lib/string_kunit.c +index eabf025cf77c9..dd19bd7748aa2 100644 +--- a/lib/string_kunit.c ++++ b/lib/string_kunit.c +@@ -11,6 +11,12 @@ + #include + #include + ++#define STRCMP_LARGE_BUF_LEN 2048 ++#define STRCMP_CHANGE_POINT 1337 ++#define STRCMP_TEST_EXPECT_EQUAL(test, fn, ...) KUNIT_EXPECT_EQ(test, fn(__VA_ARGS__), 0) ++#define STRCMP_TEST_EXPECT_LOWER(test, fn, ...) KUNIT_EXPECT_LT(test, fn(__VA_ARGS__), 0) ++#define STRCMP_TEST_EXPECT_GREATER(test, fn, ...) KUNIT_EXPECT_GT(test, fn(__VA_ARGS__), 0) ++ + static void test_memset16(struct kunit *test) + { + unsigned i, j, k; +@@ -179,6 +185,147 @@ static void test_strspn(struct kunit *test) + } + } + ++static char strcmp_buffer1[STRCMP_LARGE_BUF_LEN]; ++static char strcmp_buffer2[STRCMP_LARGE_BUF_LEN]; ++ ++static void strcmp_fill_buffers(char fill1, char fill2) ++{ ++ memset(strcmp_buffer1, fill1, STRCMP_LARGE_BUF_LEN); ++ memset(strcmp_buffer2, fill2, STRCMP_LARGE_BUF_LEN); ++ strcmp_buffer1[STRCMP_LARGE_BUF_LEN - 1] = 0; ++ strcmp_buffer2[STRCMP_LARGE_BUF_LEN - 1] = 0; ++} ++ ++static void test_strcmp(struct kunit *test) ++{ ++ /* Equal strings */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strcmp, "Hello, Kernel!", "Hello, Kernel!"); ++ /* First string is lexicographically less than the second */ ++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, "Hello, KUnit!", "Hello, Kernel!"); ++ /* First string is lexicographically larger than the second */ ++ STRCMP_TEST_EXPECT_GREATER(test, strcmp, "Hello, Kernel!", "Hello, KUnit!"); ++ /* Empty string is always lexicographically less than any non-empty string */ ++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, "", "Non-empty string"); ++ /* Two empty strings should be equal */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strcmp, "", ""); ++ /* Compare two strings which have only one char difference */ ++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, "Abacaba", "Abadaba"); ++ /* Compare two strings which have the same prefix*/ ++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, "Just a string", "Just a string and something else"); ++} ++ ++static void test_strcmp_long_strings(struct kunit *test) ++{ ++ strcmp_fill_buffers('B', 'B'); ++ STRCMP_TEST_EXPECT_EQUAL(test, strcmp, strcmp_buffer1, strcmp_buffer2); ++ ++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'A'; ++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, strcmp_buffer1, strcmp_buffer2); ++ ++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'C'; ++ STRCMP_TEST_EXPECT_GREATER(test, strcmp, strcmp_buffer1, strcmp_buffer2); ++} ++ ++static void test_strncmp(struct kunit *test) ++{ ++ /* Equal strings */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, "Hello, KUnit!", "Hello, KUnit!", 13); ++ /* First string is lexicographically less than the second */ ++ STRCMP_TEST_EXPECT_LOWER(test, strncmp, "Hello, KUnit!", "Hello, Kernel!", 13); ++ /* Result is always 'equal' when count = 0 */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, "Hello, Kernel!", "Hello, KUnit!", 0); ++ /* Strings with common prefix are equal if count = length of prefix */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, "Abacaba", "Abadaba", 3); ++ /* Strings with common prefix are not equal when count = length of prefix + 1 */ ++ STRCMP_TEST_EXPECT_LOWER(test, strncmp, "Abacaba", "Abadaba", 4); ++ /* If one string is a prefix of another, the shorter string is lexicographically smaller */ ++ STRCMP_TEST_EXPECT_LOWER(test, strncmp, "Just a string", "Just a string and something else", ++ strlen("Just a string and something else")); ++ /* ++ * If one string is a prefix of another, and we check first length ++ * of prefix chars, the result is 'equal' ++ */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, "Just a string", "Just a string and something else", ++ strlen("Just a string")); ++} ++ ++static void test_strncmp_long_strings(struct kunit *test) ++{ ++ strcmp_fill_buffers('B', 'B'); ++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN); ++ ++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'A'; ++ STRCMP_TEST_EXPECT_LOWER(test, strncmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN); ++ ++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'C'; ++ STRCMP_TEST_EXPECT_GREATER(test, strncmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN); ++ /* the strings are equal up to STRCMP_CHANGE_POINT */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_CHANGE_POINT); ++ STRCMP_TEST_EXPECT_GREATER(test, strncmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_CHANGE_POINT + 1); ++} ++ ++static void test_strcasecmp(struct kunit *test) ++{ ++ /* Same strings in different case should be equal */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strcasecmp, "Hello, Kernel!", "HeLLO, KErNeL!"); ++ /* Empty strings should be equal */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strcasecmp, "", ""); ++ /* Despite ascii code for 'a' is larger than ascii code for 'B', 'a' < 'B' */ ++ STRCMP_TEST_EXPECT_LOWER(test, strcasecmp, "a", "B"); ++ STRCMP_TEST_EXPECT_GREATER(test, strcasecmp, "B", "a"); ++ /* Special symbols and numbers should be processed correctly */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strcasecmp, "-+**.1230ghTTT~^", "-+**.1230Ghttt~^"); ++} ++ ++static void test_strcasecmp_long_strings(struct kunit *test) ++{ ++ strcmp_fill_buffers('b', 'B'); ++ STRCMP_TEST_EXPECT_EQUAL(test, strcasecmp, strcmp_buffer1, strcmp_buffer2); ++ ++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'a'; ++ STRCMP_TEST_EXPECT_LOWER(test, strcasecmp, strcmp_buffer1, strcmp_buffer2); ++ ++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'C'; ++ STRCMP_TEST_EXPECT_GREATER(test, strcasecmp, strcmp_buffer1, strcmp_buffer2); ++} ++ ++static void test_strncasecmp(struct kunit *test) ++{ ++ /* Same strings in different case should be equal */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, "AbAcAbA", "Abacaba", strlen("Abacaba")); ++ /* strncasecmp should check 'count' chars only */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, "AbaCaBa", "abaCaDa", 5); ++ STRCMP_TEST_EXPECT_LOWER(test, strncasecmp, "a", "B", 1); ++ STRCMP_TEST_EXPECT_GREATER(test, strncasecmp, "B", "a", 1); ++ /* Result is always 'equal' when count = 0 */ ++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, "Abacaba", "Not abacaba", 0); ++} ++ ++static void test_strncasecmp_long_strings(struct kunit *test) ++{ ++ strcmp_fill_buffers('b', 'B'); ++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN); ++ ++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'a'; ++ STRCMP_TEST_EXPECT_LOWER(test, strncasecmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN); ++ ++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'C'; ++ STRCMP_TEST_EXPECT_GREATER(test, strncasecmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN); ++ ++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_CHANGE_POINT); ++ STRCMP_TEST_EXPECT_GREATER(test, strncasecmp, strcmp_buffer1, ++ strcmp_buffer2, STRCMP_CHANGE_POINT + 1); ++} ++ + static struct kunit_case string_test_cases[] = { + KUNIT_CASE(test_memset16), + KUNIT_CASE(test_memset32), +@@ -186,6 +333,14 @@ static struct kunit_case string_test_cases[] = { + KUNIT_CASE(test_strchr), + KUNIT_CASE(test_strnchr), + KUNIT_CASE(test_strspn), ++ KUNIT_CASE(test_strcmp), ++ KUNIT_CASE(test_strcmp_long_strings), ++ KUNIT_CASE(test_strncmp), ++ KUNIT_CASE(test_strncmp_long_strings), ++ KUNIT_CASE(test_strcasecmp), ++ KUNIT_CASE(test_strcasecmp_long_strings), ++ KUNIT_CASE(test_strncasecmp), ++ KUNIT_CASE(test_strncasecmp_long_strings), + {} + }; + +-- +2.43.0 + diff --git a/queue-6.9/sunrpc-fix-nfsacl-rpc-retry-on-soft-mount.patch b/queue-6.9/sunrpc-fix-nfsacl-rpc-retry-on-soft-mount.patch new file mode 100644 index 00000000000..cf037c02cfb --- /dev/null +++ b/queue-6.9/sunrpc-fix-nfsacl-rpc-retry-on-soft-mount.patch @@ -0,0 +1,55 @@ +From 32dc832323c04d9c1501f407989bd9d70a261d8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 13:49:38 +0300 +Subject: sunrpc: fix NFSACL RPC retry on soft mount + +From: Dan Aloni + +[ Upstream commit 0dc9f430027b8bd9073fdafdfcdeb1a073ab5594 ] + +It used to be quite awhile ago since 1b63a75180c6 ('SUNRPC: Refactor +rpc_clone_client()'), in 2012, that `cl_timeout` was copied in so that +all mount parameters propagate to NFSACL clients. However since that +change, if mount options as follows are given: + + soft,timeo=50,retrans=16,vers=3 + +The resultant NFSACL client receives: + + cl_softrtry: 1 + cl_timeout: to_initval=60000, to_maxval=60000, to_increment=0, to_retries=2, to_exponential=0 + +These values lead to NFSACL operations not being retried under the +condition of transient network outages with soft mount. Instead, getacl +call fails after 60 seconds with EIO. + +The simple fix is to pass the existing client's `cl_timeout` as the new +client timeout. + +Cc: Chuck Lever +Cc: Benjamin Coddington +Link: https://lore.kernel.org/all/20231105154857.ryakhmgaptq3hb6b@gmail.com/T/ +Fixes: 1b63a75180c6 ('SUNRPC: Refactor rpc_clone_client()') +Signed-off-by: Dan Aloni +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/clnt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 28f3749f6dc6c..59b2fbd88e5eb 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1071,6 +1071,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old, + .authflavor = old->cl_auth->au_flavor, + .cred = old->cl_cred, + .stats = old->cl_stats, ++ .timeout = old->cl_timeout, + }; + struct rpc_clnt *clnt; + int err; +-- +2.43.0 + diff --git a/queue-6.9/tcp-fix-shift-out-of-bounds-in-dctcp_update_alpha.patch b/queue-6.9/tcp-fix-shift-out-of-bounds-in-dctcp_update_alpha.patch new file mode 100644 index 00000000000..daf8f37c0dc --- /dev/null +++ b/queue-6.9/tcp-fix-shift-out-of-bounds-in-dctcp_update_alpha.patch @@ -0,0 +1,125 @@ +From 7f5bf2f0194552ce5821098c1a7e68b3a93b3e7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 18:16:26 +0900 +Subject: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). + +From: Kuniyuki Iwashima + +[ Upstream commit 3ebc46ca8675de6378e3f8f40768e180bb8afa66 ] + +In dctcp_update_alpha(), we use a module parameter dctcp_shift_g +as follows: + + alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g); + ... + delivered_ce <<= (10 - dctcp_shift_g); + +It seems syzkaller started fuzzing module parameters and triggered +shift-out-of-bounds [0] by setting 100 to dctcp_shift_g: + + memcpy((void*)0x20000080, + "/sys/module/tcp_dctcp/parameters/dctcp_shift_g\000", 47); + res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul, + /*flags=*/2ul, /*mode=*/0ul); + memcpy((void*)0x20000000, "100\000", 4); + syscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul); + +Let's limit the max value of dctcp_shift_g by param_set_uint_minmax(). + +With this patch: + + # echo 10 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g + # cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g + 10 + # echo 11 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g + -bash: echo: write error: Invalid argument + +[0]: +UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12 +shift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int') +CPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +1.13.0-1ubuntu1.1 04/01/2014 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114 + ubsan_epilogue lib/ubsan.c:231 [inline] + __ubsan_handle_shift_out_of_bounds+0x346/0x3a0 lib/ubsan.c:468 + dctcp_update_alpha+0x540/0x570 net/ipv4/tcp_dctcp.c:143 + tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline] + tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:3948 + tcp_rcv_state_process+0x57a/0x2290 net/ipv4/tcp_input.c:6711 + tcp_v4_do_rcv+0x764/0xc40 net/ipv4/tcp_ipv4.c:1937 + sk_backlog_rcv include/net/sock.h:1106 [inline] + __release_sock+0x20f/0x350 net/core/sock.c:2983 + release_sock+0x61/0x1f0 net/core/sock.c:3549 + mptcp_subflow_shutdown+0x3d0/0x620 net/mptcp/protocol.c:2907 + mptcp_check_send_data_fin+0x225/0x410 net/mptcp/protocol.c:2976 + __mptcp_close+0x238/0xad0 net/mptcp/protocol.c:3072 + mptcp_close+0x2a/0x1a0 net/mptcp/protocol.c:3127 + inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437 + __sock_release net/socket.c:659 [inline] + sock_close+0xc0/0x240 net/socket.c:1421 + __fput+0x41b/0x890 fs/file_table.c:422 + task_work_run+0x23b/0x300 kernel/task_work.c:180 + exit_task_work include/linux/task_work.h:38 [inline] + do_exit+0x9c8/0x2540 kernel/exit.c:878 + do_group_exit+0x201/0x2b0 kernel/exit.c:1027 + __do_sys_exit_group kernel/exit.c:1038 [inline] + __se_sys_exit_group kernel/exit.c:1036 [inline] + __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xe4/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x67/0x6f +RIP: 0033:0x7f6c2b5005b6 +Code: Unable to access opcode bytes at 0x7f6c2b50058c. +RSP: 002b:00007ffe883eb948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 +RAX: ffffffffffffffda RBX: 00007f6c2b5862f0 RCX: 00007f6c2b5005b6 +RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 +RBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffffc0 +R10: 0000000000000006 R11: 0000000000000246 R12: 00007f6c2b5862f0 +R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 + + +Reported-by: syzkaller +Reported-by: Yue Sun +Reported-by: xingwei lee +Closes: https://lore.kernel.org/netdev/CAEkJfYNJM=cw-8x7_Vmj1J6uYVCWMbbvD=EFmDPVBGpTsqOxEA@mail.gmail.com/ +Fixes: e3118e8359bb ("net: tcp: add DCTCP congestion control algorithm") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240517091626.32772-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_dctcp.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c +index e33fbe4933e42..b004280855f87 100644 +--- a/net/ipv4/tcp_dctcp.c ++++ b/net/ipv4/tcp_dctcp.c +@@ -58,7 +58,18 @@ struct dctcp { + }; + + static unsigned int dctcp_shift_g __read_mostly = 4; /* g = 1/2^4 */ +-module_param(dctcp_shift_g, uint, 0644); ++ ++static int dctcp_shift_g_set(const char *val, const struct kernel_param *kp) ++{ ++ return param_set_uint_minmax(val, kp, 0, 10); ++} ++ ++static const struct kernel_param_ops dctcp_shift_g_ops = { ++ .set = dctcp_shift_g_set, ++ .get = param_get_uint, ++}; ++ ++module_param_cb(dctcp_shift_g, &dctcp_shift_g_ops, &dctcp_shift_g, 0644); + MODULE_PARM_DESC(dctcp_shift_g, "parameter g for updating dctcp_alpha"); + + static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA; +-- +2.43.0 + diff --git a/queue-6.9/tcp-remove-64-kbyte-limit-for-initial-tp-rcv_wnd-val.patch b/queue-6.9/tcp-remove-64-kbyte-limit-for-initial-tp-rcv_wnd-val.patch new file mode 100644 index 00000000000..09a3d50cb85 --- /dev/null +++ b/queue-6.9/tcp-remove-64-kbyte-limit-for-initial-tp-rcv_wnd-val.patch @@ -0,0 +1,76 @@ +From 60a7bcc7a2afccc4f028031313d60907cbba4321 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 21:42:20 +0800 +Subject: tcp: remove 64 KByte limit for initial tp->rcv_wnd value + +From: Jason Xing + +[ Upstream commit 378979e94e953c2070acb4f0e0c98d29260bd09d ] + +Recently, we had some servers upgraded to the latest kernel and noticed +the indicator from the user side showed worse results than before. It is +caused by the limitation of tp->rcv_wnd. + +In 2018 commit a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin +to around 64KB") limited the initial value of tp->rcv_wnd to 65535, most +CDN teams would not benefit from this change because they cannot have a +large window to receive a big packet, which will be slowed down especially +in long RTT. Small rcv_wnd means slow transfer speed, to some extent. It's +the side effect for the latency/time-sensitive users. + +To avoid future confusion, current change doesn't affect the initial +receive window on the wire in a SYN or SYN+ACK packet which are set within +65535 bytes according to RFC 7323 also due to the limit in +__tcp_transmit_skb(): + + th->window = htons(min(tp->rcv_wnd, 65535U)); + +In one word, __tcp_transmit_skb() already ensures that constraint is +respected, no matter how large tp->rcv_wnd is. The change doesn't violate +RFC. + +Let me provide one example if with or without the patch: +Before: +client --- SYN: rwindow=65535 ---> server +client <--- SYN+ACK: rwindow=65535 ---- server +client --- ACK: rwindow=65536 ---> server +Note: for the last ACK, the calculation is 512 << 7. + +After: +client --- SYN: rwindow=65535 ---> server +client <--- SYN+ACK: rwindow=65535 ---- server +client --- ACK: rwindow=175232 ---> server +Note: I use the following command to make it work: +ip route change default via [ip] dev eth0 metric 100 initrwnd 120 +For the last ACK, the calculation is 1369 << 7. + +When we apply such a patch, having a large rcv_wnd if the user tweak this +knob can help transfer data more rapidly and save some rtts. + +Fixes: a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin to around 64KB") +Signed-off-by: Jason Xing +Reviewed-by: Eric Dumazet +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20240521134220.12510-1-kerneljasonxing@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 02caeb7bcf634..16ef24a37c498 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -229,7 +229,7 @@ void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss, + if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)) + (*rcv_wnd) = min(space, MAX_TCP_WINDOW); + else +- (*rcv_wnd) = min_t(u32, space, U16_MAX); ++ (*rcv_wnd) = space; + + if (init_rcv_wnd) + *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss); +-- +2.43.0 + diff --git a/queue-6.9/tls-fix-missing-memory-barrier-in-tls_init.patch b/queue-6.9/tls-fix-missing-memory-barrier-in-tls_init.patch new file mode 100644 index 00000000000..109dd735de6 --- /dev/null +++ b/queue-6.9/tls-fix-missing-memory-barrier-in-tls_init.patch @@ -0,0 +1,73 @@ +From 03064f30334e5d3b585f8b33d748d8d43dbdccef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 19:34:38 +0900 +Subject: tls: fix missing memory barrier in tls_init + +From: Dae R. Jeong + +[ Upstream commit 91e61dd7a0af660408e87372d8330ceb218be302 ] + +In tls_init(), a write memory barrier is missing, and store-store +reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. + +CPU0 CPU1 +----- ----- +// In tls_init() +// In tls_ctx_create() +ctx = kzalloc() +ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1) + +// In update_sk_prot() +WRITE_ONCE(sk->sk_prot, tls_prots) -(2) + + // In sock_common_setsockopt() + READ_ONCE(sk->sk_prot)->setsockopt() + + // In tls_{setsockopt,getsockopt}() + ctx->sk_proto->setsockopt() -(3) + +In the above scenario, when (1) and (2) are reordered, (3) can observe +the NULL value of ctx->sk_proto, causing NULL dereference. + +To fix it, we rely on rcu_assign_pointer() which implies the release +barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is +initialized, we can ensure that ctx->sk_proto are visible when +changing sk->sk_prot. + +Fixes: d5bee7374b68 ("net/tls: Annotate access to sk_prot with READ_ONCE/WRITE_ONCE") +Signed-off-by: Yewon Choi +Signed-off-by: Dae R. Jeong +Link: https://lore.kernel.org/netdev/ZU4OJG56g2V9z_H7@dragonet/T/ +Link: https://lore.kernel.org/r/Zkx4vjSFp0mfpjQ2@libra05 +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index b4674f03d71a9..90b7f253d3632 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -816,9 +816,17 @@ struct tls_context *tls_ctx_create(struct sock *sk) + return NULL; + + mutex_init(&ctx->tx_lock); +- rcu_assign_pointer(icsk->icsk_ulp_data, ctx); + ctx->sk_proto = READ_ONCE(sk->sk_prot); + ctx->sk = sk; ++ /* Release semantic of rcu_assign_pointer() ensures that ++ * ctx->sk_proto is visible before changing sk->sk_prot in ++ * update_sk_prot(), and prevents reading uninitialized value in ++ * tls_{getsockopt, setsockopt}. Note that we do not need a ++ * read barrier in tls_{getsockopt,setsockopt} as there is an ++ * address dependency between sk->sk_proto->{getsockopt,setsockopt} ++ * and ctx->sk_proto. ++ */ ++ rcu_assign_pointer(icsk->icsk_ulp_data, ctx); + return ctx; + } + +-- +2.43.0 + diff --git a/queue-6.9/tools-arch-x86-intel_sdsi-fix-maximum-meter-bundle-l.patch b/queue-6.9/tools-arch-x86-intel_sdsi-fix-maximum-meter-bundle-l.patch new file mode 100644 index 00000000000..d434f05a6f7 --- /dev/null +++ b/queue-6.9/tools-arch-x86-intel_sdsi-fix-maximum-meter-bundle-l.patch @@ -0,0 +1,67 @@ +From ed38350d85d25239ba9e115b65001622826530ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 19:58:52 -0700 +Subject: tools/arch/x86/intel_sdsi: Fix maximum meter bundle length +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David E. Box + +[ Upstream commit a66f962f67ebbbdf7c82c6652180930c0169cf13 ] + +The maximum number of bundles in the meter certificate was set to 8 which +is much less than the maximum. Instead, since the bundles appear at the end +of the file, set it based on the remaining file size from the bundle start +position. + +Fixes: 7fdc03a7370f ("tools/arch/x86: intel_sdsi: Add support for reading meter certificates") +Signed-off-by: David E. Box +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240411025856.2782476-6-david.e.box@linux.intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + tools/arch/x86/intel_sdsi/intel_sdsi.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/tools/arch/x86/intel_sdsi/intel_sdsi.c b/tools/arch/x86/intel_sdsi/intel_sdsi.c +index 2cd92761f1714..7eaffcbff788c 100644 +--- a/tools/arch/x86/intel_sdsi/intel_sdsi.c ++++ b/tools/arch/x86/intel_sdsi/intel_sdsi.c +@@ -43,7 +43,6 @@ + #define METER_CERT_MAX_SIZE 4096 + #define STATE_MAX_NUM_LICENSES 16 + #define STATE_MAX_NUM_IN_BUNDLE (uint32_t)8 +-#define METER_MAX_NUM_BUNDLES 8 + + #define __round_mask(x, y) ((__typeof__(x))((y) - 1)) + #define round_up(x, y) ((((x) - 1) | __round_mask(x, y)) + 1) +@@ -167,6 +166,11 @@ struct bundle_encoding_counter { + uint32_t encoding; + uint32_t counter; + }; ++#define METER_BUNDLE_SIZE sizeof(struct bundle_encoding_counter) ++#define BUNDLE_COUNT(length) ((length) / METER_BUNDLE_SIZE) ++#define METER_MAX_NUM_BUNDLES \ ++ ((METER_CERT_MAX_SIZE - sizeof(struct meter_certificate)) / \ ++ sizeof(struct bundle_encoding_counter)) + + struct sdsi_dev { + struct sdsi_regs regs; +@@ -386,9 +390,9 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s) + return -1; + } + +- if (mc->bundle_length > METER_MAX_NUM_BUNDLES * 8) { +- fprintf(stderr, "More than %d bundles: %d\n", +- METER_MAX_NUM_BUNDLES, mc->bundle_length / 8); ++ if (mc->bundle_length > METER_MAX_NUM_BUNDLES * METER_BUNDLE_SIZE) { ++ fprintf(stderr, "More than %ld bundles: actual %ld\n", ++ METER_MAX_NUM_BUNDLES, BUNDLE_COUNT(mc->bundle_length)); + return -1; + } + +-- +2.43.0 + diff --git a/queue-6.9/tools-arch-x86-intel_sdsi-fix-meter_certificate-deco.patch b/queue-6.9/tools-arch-x86-intel_sdsi-fix-meter_certificate-deco.patch new file mode 100644 index 00000000000..f338cd0ceb1 --- /dev/null +++ b/queue-6.9/tools-arch-x86-intel_sdsi-fix-meter_certificate-deco.patch @@ -0,0 +1,61 @@ +From d39b5765aad126262a8a18554321780f2ea6ed7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 19:58:54 -0700 +Subject: tools/arch/x86/intel_sdsi: Fix meter_certificate decoding +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David E. Box + +[ Upstream commit 09d70ded6c566fd00886be32c26d0b2004ef239c ] + +Fix errors in the calculation of the start position of the counters and in +the display loop. While here, use a #define for the bundle count and size. + +Fixes: 7fdc03a7370f ("tools/arch/x86: intel_sdsi: Add support for reading meter certificates") +Signed-off-by: David E. Box +Reviewed-by: Kuppuswamy Sathyanarayanan +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240411025856.2782476-8-david.e.box@linux.intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + tools/arch/x86/intel_sdsi/intel_sdsi.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/tools/arch/x86/intel_sdsi/intel_sdsi.c b/tools/arch/x86/intel_sdsi/intel_sdsi.c +index ae29214da1029..ba2a6b6645ae8 100644 +--- a/tools/arch/x86/intel_sdsi/intel_sdsi.c ++++ b/tools/arch/x86/intel_sdsi/intel_sdsi.c +@@ -394,7 +394,7 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s) + printf("MMRC encoding: %.4s\n", name); + + printf("MMRC counter: %d\n", mc->mmrc_counter); +- if (mc->bundle_length % 8) { ++ if (mc->bundle_length % METER_BUNDLE_SIZE) { + fprintf(stderr, "Invalid bundle length\n"); + return -1; + } +@@ -405,15 +405,16 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s) + return -1; + } + +- bec = (void *)(mc) + sizeof(mc); ++ bec = (struct bundle_encoding_counter *)(mc + 1); + + printf("Number of Feature Counters: %ld\n", BUNDLE_COUNT(mc->bundle_length)); +- while (count++ < mc->bundle_length / 8) { ++ while (count < BUNDLE_COUNT(mc->bundle_length)) { + char feature[5]; + + feature[4] = '\0'; + get_feature(bec[count].encoding, feature); + printf(" %s: %d\n", feature, bec[count].counter); ++ ++count; + } + + return 0; +-- +2.43.0 + diff --git a/queue-6.9/tools-arch-x86-intel_sdsi-fix-meter_show-display.patch b/queue-6.9/tools-arch-x86-intel_sdsi-fix-meter_show-display.patch new file mode 100644 index 00000000000..59dd3e2f2cc --- /dev/null +++ b/queue-6.9/tools-arch-x86-intel_sdsi-fix-meter_show-display.patch @@ -0,0 +1,93 @@ +From a04170938ebc3e230e0248c278425d56bd3ed257 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 19:58:53 -0700 +Subject: tools/arch/x86/intel_sdsi: Fix meter_show display +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David E. Box + +[ Upstream commit 76f2bc17428c890754d11aa6aea14b332ba130c5 ] + +Fixes sdsi_meter_cert_show() to correctly decode and display the meter +certificate output. Adds and displays a missing version field, displays the +ASCII name of the signature, and fixes the print alignment. + +Fixes: 7fdc03a7370f ("tools/arch/x86: intel_sdsi: Add support for reading meter certificates") +Signed-off-by: David E. Box +Reviewed-by: Kuppuswamy Sathyanarayanan +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240411025856.2782476-7-david.e.box@linux.intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + tools/arch/x86/intel_sdsi/intel_sdsi.c | 29 +++++++++++++++++--------- + 1 file changed, 19 insertions(+), 10 deletions(-) + +diff --git a/tools/arch/x86/intel_sdsi/intel_sdsi.c b/tools/arch/x86/intel_sdsi/intel_sdsi.c +index 7eaffcbff788c..ae29214da1029 100644 +--- a/tools/arch/x86/intel_sdsi/intel_sdsi.c ++++ b/tools/arch/x86/intel_sdsi/intel_sdsi.c +@@ -153,11 +153,12 @@ struct bundle_encoding { + }; + + struct meter_certificate { +- uint32_t block_signature; +- uint32_t counter_unit; ++ uint32_t signature; ++ uint32_t version; + uint64_t ppin; ++ uint32_t counter_unit; + uint32_t bundle_length; +- uint32_t reserved; ++ uint64_t reserved; + uint32_t mmrc_encoding; + uint32_t mmrc_counter; + }; +@@ -338,6 +339,7 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s) + uint32_t count = 0; + FILE *cert_ptr; + int ret, size; ++ char name[4]; + + ret = sdsi_update_registers(s); + if (ret) +@@ -379,12 +381,19 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s) + printf("\n"); + printf("Meter certificate for device %s\n", s->dev_name); + printf("\n"); +- printf("Block Signature: 0x%x\n", mc->block_signature); +- printf("Count Unit: %dms\n", mc->counter_unit); +- printf("PPIN: 0x%lx\n", mc->ppin); +- printf("Feature Bundle Length: %d\n", mc->bundle_length); +- printf("MMRC encoding: %d\n", mc->mmrc_encoding); +- printf("MMRC counter: %d\n", mc->mmrc_counter); ++ ++ get_feature(mc->signature, name); ++ printf("Signature: %.4s\n", name); ++ ++ printf("Version: %d\n", mc->version); ++ printf("Count Unit: %dms\n", mc->counter_unit); ++ printf("PPIN: 0x%lx\n", mc->ppin); ++ printf("Feature Bundle Length: %d\n", mc->bundle_length); ++ ++ get_feature(mc->mmrc_encoding, name); ++ printf("MMRC encoding: %.4s\n", name); ++ ++ printf("MMRC counter: %d\n", mc->mmrc_counter); + if (mc->bundle_length % 8) { + fprintf(stderr, "Invalid bundle length\n"); + return -1; +@@ -398,7 +407,7 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s) + + bec = (void *)(mc) + sizeof(mc); + +- printf("Number of Feature Counters: %d\n", mc->bundle_length / 8); ++ printf("Number of Feature Counters: %ld\n", BUNDLE_COUNT(mc->bundle_length)); + while (count++ < mc->bundle_length / 8) { + char feature[5]; + +-- +2.43.0 + diff --git a/queue-6.9/tpm_tis_spi-account-for-spi-header-when-allocating-t.patch b/queue-6.9/tpm_tis_spi-account-for-spi-header-when-allocating-t.patch new file mode 100644 index 00000000000..7b3959f4956 --- /dev/null +++ b/queue-6.9/tpm_tis_spi-account-for-spi-header-when-allocating-t.patch @@ -0,0 +1,53 @@ +From cfe71aa3d4babf30fb467c45b31309bdd13bbd60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 15:06:40 +0300 +Subject: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer + buffer + +From: Matthew R. Ochs + +[ Upstream commit 195aba96b854dd664768f382cd1db375d8181f88 ] + +The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the +maximum transfer length and the size of the transfer buffer. As such, it +does not account for the 4 bytes of header that prepends the SPI data +frame. This can result in out-of-bounds accesses and was confirmed with +KASAN. + +Introduce SPI_HDRSIZE to account for the header and use to allocate the +transfer buffer. + +Fixes: a86a42ac2bd6 ("tpm_tis_spi: Add hardware wait polling") +Signed-off-by: Matthew R. Ochs +Tested-by: Carol Soto +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_spi_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/tpm/tpm_tis_spi_main.c b/drivers/char/tpm/tpm_tis_spi_main.c +index 3f9eaf27b41b8..c9eca24bbad47 100644 +--- a/drivers/char/tpm/tpm_tis_spi_main.c ++++ b/drivers/char/tpm/tpm_tis_spi_main.c +@@ -37,6 +37,7 @@ + #include "tpm_tis_spi.h" + + #define MAX_SPI_FRAMESIZE 64 ++#define SPI_HDRSIZE 4 + + /* + * TCG SPI flow control is documented in section 6.4 of the spec[1]. In short, +@@ -247,7 +248,7 @@ static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr, + int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy, + int irq, const struct tpm_tis_phy_ops *phy_ops) + { +- phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL); ++ phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL); + if (!phy->iobuf) + return -ENOMEM; + +-- +2.43.0 + diff --git a/queue-6.9/tracing-probes-fix-error-check-in-parse_btf_field.patch b/queue-6.9/tracing-probes-fix-error-check-in-parse_btf_field.patch new file mode 100644 index 00000000000..75cd61c716f --- /dev/null +++ b/queue-6.9/tracing-probes-fix-error-check-in-parse_btf_field.patch @@ -0,0 +1,45 @@ +From a79bc93d66201215774c9c98be203233eb57d1ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 11:43:52 +0200 +Subject: tracing/probes: fix error check in parse_btf_field() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Carlos López + +[ Upstream commit e569eb34970281438e2b48a3ef11c87459fcfbcb ] + +btf_find_struct_member() might return NULL or an error via the +ERR_PTR() macro. However, its caller in parse_btf_field() only checks +for the NULL condition. Fix this by using IS_ERR() and returning the +error up the stack. + +Link: https://lore.kernel.org/all/20240527094351.15687-1-clopez@suse.de/ + +Fixes: c440adfbe3025 ("tracing/probes: Support BTF based data structure field access") +Signed-off-by: Carlos López +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_probe.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c +index 42bc0f3622263..1a7e7cf944938 100644 +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -553,6 +553,10 @@ static int parse_btf_field(char *fieldname, const struct btf_type *type, + anon_offs = 0; + field = btf_find_struct_member(ctx->btf, type, fieldname, + &anon_offs); ++ if (IS_ERR(field)) { ++ trace_probe_log_err(ctx->offset, BAD_BTF_TID); ++ return PTR_ERR(field); ++ } + if (!field) { + trace_probe_log_err(ctx->offset, NO_BTF_FIELD); + return -ENOENT; +-- +2.43.0 + diff --git a/queue-6.9/ubsan-restore-dependency-on-arch_has_ubsan.patch b/queue-6.9/ubsan-restore-dependency-on-arch_has_ubsan.patch new file mode 100644 index 00000000000..9ec0a031aec --- /dev/null +++ b/queue-6.9/ubsan-restore-dependency-on-arch_has_ubsan.patch @@ -0,0 +1,38 @@ +From f6171c217cb107bf59794997674d736847819da5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 16:37:48 -0700 +Subject: ubsan: Restore dependency on ARCH_HAS_UBSAN + +From: Kees Cook + +[ Upstream commit 890a64810d59b1a58ed26efc28cfd821fc068e84 ] + +While removing CONFIG_UBSAN_SANITIZE_ALL, ARCH_HAS_UBSAN wasn't correctly +depended on. Restore this, as we do not want to attempt UBSAN builds +unless it's actually been tested on a given architecture. + +Reported-by: Masahiro Yamada +Closes: https://lore.kernel.org/all/20240514095427.541201-1-masahiroy@kernel.org +Fixes: 918327e9b7ff ("ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL") +Link: https://lore.kernel.org/r/20240514233747.work.441-kees@kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + lib/Kconfig.ubsan | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan +index e81e1ac4a919b..bdda600f8dfbe 100644 +--- a/lib/Kconfig.ubsan ++++ b/lib/Kconfig.ubsan +@@ -4,6 +4,7 @@ config ARCH_HAS_UBSAN + + menuconfig UBSAN + bool "Undefined behaviour sanity checker" ++ depends on ARCH_HAS_UBSAN + help + This option enables the Undefined Behaviour sanity checker. + Compile-time instrumentation is used to detect various undefined +-- +2.43.0 + diff --git a/queue-6.9/um-add-winch-to-winch_handlers-before-registering-wi.patch b/queue-6.9/um-add-winch-to-winch_handlers-before-registering-wi.patch new file mode 100644 index 00000000000..43b810edda0 --- /dev/null +++ b/queue-6.9/um-add-winch-to-winch_handlers-before-registering-wi.patch @@ -0,0 +1,68 @@ +From 7c71168ba1f93c6ea2c111e2e5a16073d7624dc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 11:49:26 +0100 +Subject: um: Add winch to winch_handlers before registering winch IRQ + +From: Roberto Sassu + +[ Upstream commit a0fbbd36c156b9f7b2276871d499c9943dfe5101 ] + +Registering a winch IRQ is racy, an interrupt may occur before the winch is +added to the winch_handlers list. + +If that happens, register_winch_irq() adds to that list a winch that is +scheduled to be (or has already been) freed, causing a panic later in +winch_cleanup(). + +Avoid the race by adding the winch to the winch_handlers list before +registering the IRQ, and rolling back if um_request_irq() fails. + +Fixes: 42a359e31a0e ("uml: SIGIO support cleanup") +Signed-off-by: Roberto Sassu +Reviewed-by: Johannes Berg +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/line.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c +index ffc5cb92fa367..d82bc3fdb86e7 100644 +--- a/arch/um/drivers/line.c ++++ b/arch/um/drivers/line.c +@@ -676,24 +676,26 @@ void register_winch_irq(int fd, int tty_fd, int pid, struct tty_port *port, + goto cleanup; + } + +- *winch = ((struct winch) { .list = LIST_HEAD_INIT(winch->list), +- .fd = fd, ++ *winch = ((struct winch) { .fd = fd, + .tty_fd = tty_fd, + .pid = pid, + .port = port, + .stack = stack }); + ++ spin_lock(&winch_handler_lock); ++ list_add(&winch->list, &winch_handlers); ++ spin_unlock(&winch_handler_lock); ++ + if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt, + IRQF_SHARED, "winch", winch) < 0) { + printk(KERN_ERR "register_winch_irq - failed to register " + "IRQ\n"); ++ spin_lock(&winch_handler_lock); ++ list_del(&winch->list); ++ spin_unlock(&winch_handler_lock); + goto out_free; + } + +- spin_lock(&winch_handler_lock); +- list_add(&winch->list, &winch_handlers); +- spin_unlock(&winch_handler_lock); +- + return; + + out_free: +-- +2.43.0 + diff --git a/queue-6.9/um-fix-return-value-in-ubd_init.patch b/queue-6.9/um-fix-return-value-in-ubd_init.patch new file mode 100644 index 00000000000..7ff5f3e309b --- /dev/null +++ b/queue-6.9/um-fix-return-value-in-ubd_init.patch @@ -0,0 +1,46 @@ +From d7bb0d1a7ccc2149a1bb8c9d4643629859f8cc65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 17:12:59 +0800 +Subject: um: Fix return value in ubd_init() + +From: Duoming Zhou + +[ Upstream commit 31a5990ed253a66712d7ddc29c92d297a991fdf2 ] + +When kmalloc_array() fails to allocate memory, the ubd_init() +should return -ENOMEM instead of -1. So, fix it. + +Fixes: f88f0bdfc32f ("um: UBD Improvements") +Signed-off-by: Duoming Zhou +Reviewed-by: Johannes Berg +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ubd_kern.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c +index 63fc062add708..ef805eaa9e013 100644 +--- a/arch/um/drivers/ubd_kern.c ++++ b/arch/um/drivers/ubd_kern.c +@@ -1092,7 +1092,7 @@ static int __init ubd_init(void) + + if (irq_req_buffer == NULL) { + printk(KERN_ERR "Failed to initialize ubd buffering\n"); +- return -1; ++ return -ENOMEM; + } + io_req_buffer = kmalloc_array(UBD_REQ_BUFFER_SIZE, + sizeof(struct io_thread_req *), +@@ -1103,7 +1103,7 @@ static int __init ubd_init(void) + + if (io_req_buffer == NULL) { + printk(KERN_ERR "Failed to initialize ubd buffering\n"); +- return -1; ++ return -ENOMEM; + } + platform_driver_register(&ubd_driver); + mutex_lock(&ubd_lock); +-- +2.43.0 + diff --git a/queue-6.9/um-fix-the-declaration-of-kasan_map_memory.patch b/queue-6.9/um-fix-the-declaration-of-kasan_map_memory.patch new file mode 100644 index 00000000000..bf02a0ec785 --- /dev/null +++ b/queue-6.9/um-fix-the-declaration-of-kasan_map_memory.patch @@ -0,0 +1,61 @@ +From 98fc981981fa1fecd845db4634caccc8343a07b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 20:58:55 +0800 +Subject: um: Fix the declaration of kasan_map_memory + +From: Tiwei Bie + +[ Upstream commit 6a85e34c4d07d2ec0c153067baff338ac0db55ca ] + +Make it match its definition (size_t vs unsigned long). And declare +it in a shared header to fix the -Wmissing-prototypes warning, as it +is defined in the user code and called in the kernel code. + +Fixes: 5b301409e8bc ("UML: add support for KASAN under x86_64") +Signed-off-by: Tiwei Bie +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/include/asm/kasan.h | 1 - + arch/um/include/shared/kern_util.h | 2 ++ + arch/um/os-Linux/mem.c | 1 + + 3 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/um/include/asm/kasan.h b/arch/um/include/asm/kasan.h +index 0d6547f4ec85c..f97bb1f7b8514 100644 +--- a/arch/um/include/asm/kasan.h ++++ b/arch/um/include/asm/kasan.h +@@ -24,7 +24,6 @@ + + #ifdef CONFIG_KASAN + void kasan_init(void); +-void kasan_map_memory(void *start, unsigned long len); + extern int kasan_um_is_ready; + + #ifdef CONFIG_STATIC_LINK +diff --git a/arch/um/include/shared/kern_util.h b/arch/um/include/shared/kern_util.h +index 789b83013f355..af8cdfc75897e 100644 +--- a/arch/um/include/shared/kern_util.h ++++ b/arch/um/include/shared/kern_util.h +@@ -66,4 +66,6 @@ extern void fatal_sigsegv(void) __attribute__ ((noreturn)); + + void um_idle_sleep(void); + ++void kasan_map_memory(void *start, size_t len); ++ + #endif +diff --git a/arch/um/os-Linux/mem.c b/arch/um/os-Linux/mem.c +index 8530b2e086049..c6c9495b14321 100644 +--- a/arch/um/os-Linux/mem.c ++++ b/arch/um/os-Linux/mem.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + + /* +-- +2.43.0 + diff --git a/queue-6.9/um-fix-the-wmissing-prototypes-warning-for-__switch_.patch b/queue-6.9/um-fix-the-wmissing-prototypes-warning-for-__switch_.patch new file mode 100644 index 00000000000..38192bf70a0 --- /dev/null +++ b/queue-6.9/um-fix-the-wmissing-prototypes-warning-for-__switch_.patch @@ -0,0 +1,48 @@ +From f7f7a5642cb5fa38ec7bf3b2fce43a9cacca36d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 20:58:53 +0800 +Subject: um: Fix the -Wmissing-prototypes warning for __switch_mm + +From: Tiwei Bie + +[ Upstream commit 2cbade17b18c0f0fd9963f26c9fc9b057eb1cb3a ] + +The __switch_mm function is defined in the user code, and is called +by the kernel code. It should be declared in a shared header. + +Fixes: 4dc706c2f292 ("um: take um_mmu.h to asm/mmu.h, clean asm/mmu_context.h a bit") +Signed-off-by: Tiwei Bie +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/include/asm/mmu.h | 2 -- + arch/um/include/shared/skas/mm_id.h | 2 ++ + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/um/include/asm/mmu.h b/arch/um/include/asm/mmu.h +index a7555e43ed14a..f2923c767bb9a 100644 +--- a/arch/um/include/asm/mmu.h ++++ b/arch/um/include/asm/mmu.h +@@ -14,8 +14,6 @@ typedef struct mm_context { + struct uml_arch_mm_context arch; + } mm_context_t; + +-extern void __switch_mm(struct mm_id * mm_idp); +- + /* Avoid tangled inclusion with asm/ldt.h */ + extern long init_new_ldt(struct mm_context *to_mm, struct mm_context *from_mm); + extern void free_ldt(struct mm_context *mm); +diff --git a/arch/um/include/shared/skas/mm_id.h b/arch/um/include/shared/skas/mm_id.h +index e82e203f5f419..92dbf727e3842 100644 +--- a/arch/um/include/shared/skas/mm_id.h ++++ b/arch/um/include/shared/skas/mm_id.h +@@ -15,4 +15,6 @@ struct mm_id { + int kill; + }; + ++void __switch_mm(struct mm_id *mm_idp); ++ + #endif +-- +2.43.0 + diff --git a/queue-6.9/um-fix-the-wmissing-prototypes-warning-for-get_threa.patch b/queue-6.9/um-fix-the-wmissing-prototypes-warning-for-get_threa.patch new file mode 100644 index 00000000000..3133c743743 --- /dev/null +++ b/queue-6.9/um-fix-the-wmissing-prototypes-warning-for-get_threa.patch @@ -0,0 +1,54 @@ +From 65953c0a00030863924da3e2361c09afeff13615 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 20:58:54 +0800 +Subject: um: Fix the -Wmissing-prototypes warning for get_thread_reg + +From: Tiwei Bie + +[ Upstream commit 3144013e48f4f6e5127223c4ebc488016815dedb ] + +The get_thread_reg function is defined in the user code, and is +called by the kernel code. It should be declared in a shared header. + +Fixes: dbba7f704aa0 ("um: stop polluting the namespace with registers.h contents") +Signed-off-by: Tiwei Bie +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/include/asm/processor-generic.h | 1 - + arch/x86/um/shared/sysdep/archsetjmp.h | 7 +++++++ + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/um/include/asm/processor-generic.h b/arch/um/include/asm/processor-generic.h +index 6c3779541845b..5a7c05275aa74 100644 +--- a/arch/um/include/asm/processor-generic.h ++++ b/arch/um/include/asm/processor-generic.h +@@ -94,7 +94,6 @@ extern struct cpuinfo_um boot_cpu_data; + #define current_cpu_data boot_cpu_data + #define cache_line_size() (boot_cpu_data.cache_alignment) + +-extern unsigned long get_thread_reg(int reg, jmp_buf *buf); + #define KSTK_REG(tsk, reg) get_thread_reg(reg, &tsk->thread.switch_buf) + extern unsigned long __get_wchan(struct task_struct *p); + +diff --git a/arch/x86/um/shared/sysdep/archsetjmp.h b/arch/x86/um/shared/sysdep/archsetjmp.h +index 166cedbab9266..8c81d1a604a94 100644 +--- a/arch/x86/um/shared/sysdep/archsetjmp.h ++++ b/arch/x86/um/shared/sysdep/archsetjmp.h +@@ -1,6 +1,13 @@ + /* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef __X86_UM_SYSDEP_ARCHSETJMP_H ++#define __X86_UM_SYSDEP_ARCHSETJMP_H ++ + #ifdef __i386__ + #include "archsetjmp_32.h" + #else + #include "archsetjmp_64.h" + #endif ++ ++unsigned long get_thread_reg(int reg, jmp_buf *buf); ++ ++#endif /* __X86_UM_SYSDEP_ARCHSETJMP_H */ +-- +2.43.0 + diff --git a/queue-6.9/um-vector-fix-bpfflash-parameter-evaluation.patch b/queue-6.9/um-vector-fix-bpfflash-parameter-evaluation.patch new file mode 100644 index 00000000000..c3894e1c6ef --- /dev/null +++ b/queue-6.9/um-vector-fix-bpfflash-parameter-evaluation.patch @@ -0,0 +1,37 @@ +From a1f94a2d02bbd326bd1230e8a1625971ec5cfce2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 10:06:36 +0100 +Subject: um: vector: fix bpfflash parameter evaluation + +From: Johannes Berg + +[ Upstream commit 584ed2f76ff5fe360d87a04d17b6520c7999e06b ] + +With W=1 the build complains about a pointer compared to +zero, clearly the result should've been compared. + +Fixes: 9807019a62dc ("um: Loadable BPF "Firmware" for vector drivers") +Signed-off-by: Johannes Berg +Reviewed-by: Tiwei Bie +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/vector_kern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c +index dc2feae789cbb..63e5f108a6b95 100644 +--- a/arch/um/drivers/vector_kern.c ++++ b/arch/um/drivers/vector_kern.c +@@ -141,7 +141,7 @@ static bool get_bpf_flash(struct arglist *def) + + if (allow != NULL) { + if (kstrtoul(allow, 10, &result) == 0) +- return (allow > 0); ++ return result > 0; + } + return false; + } +-- +2.43.0 + diff --git a/queue-6.9/virtio-delete-vq-in-vp_find_vqs_msix-when-request_ir.patch b/queue-6.9/virtio-delete-vq-in-vp_find_vqs_msix-when-request_ir.patch new file mode 100644 index 00000000000..283263073c2 --- /dev/null +++ b/queue-6.9/virtio-delete-vq-in-vp_find_vqs_msix-when-request_ir.patch @@ -0,0 +1,94 @@ +From f3a11e00d66baff04adc100b7bc1f9b722987065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 17:08:45 +0200 +Subject: virtio: delete vq in vp_find_vqs_msix() when request_irq() fails + +From: Jiri Pirko + +[ Upstream commit 89875151fccdd024d571aa884ea97a0128b968b6 ] + +When request_irq() fails, error path calls vp_del_vqs(). There, as vq is +present in the list, free_irq() is called for the same vector. That +causes following splat: + +[ 0.414355] Trying to free already-free IRQ 27 +[ 0.414403] WARNING: CPU: 1 PID: 1 at kernel/irq/manage.c:1899 free_irq+0x1a1/0x2d0 +[ 0.414510] Modules linked in: +[ 0.414540] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc4+ #27 +[ 0.414540] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 +[ 0.414540] RIP: 0010:free_irq+0x1a1/0x2d0 +[ 0.414540] Code: 1e 00 48 83 c4 08 48 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 90 8b 74 24 04 48 c7 c7 98 80 6c b1 e8 00 c9 f7 ff 90 <0f> 0b 90 90 48 89 ee 4c 89 ef e8 e0 20 b8 00 49 8b 47 40 48 8b 40 +[ 0.414540] RSP: 0000:ffffb71480013ae0 EFLAGS: 00010086 +[ 0.414540] RAX: 0000000000000000 RBX: ffffa099c2722000 RCX: 0000000000000000 +[ 0.414540] RDX: 0000000000000000 RSI: ffffb71480013998 RDI: 0000000000000001 +[ 0.414540] RBP: 0000000000000246 R08: 00000000ffffdfff R09: 0000000000000001 +[ 0.414540] R10: 00000000ffffdfff R11: ffffffffb18729c0 R12: ffffa099c1c91760 +[ 0.414540] R13: ffffa099c1c916a4 R14: ffffa099c1d2f200 R15: ffffa099c1c91600 +[ 0.414540] FS: 0000000000000000(0000) GS:ffffa099fec40000(0000) knlGS:0000000000000000 +[ 0.414540] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 0.414540] CR2: 0000000000000000 CR3: 0000000008e3e001 CR4: 0000000000370ef0 +[ 0.414540] Call Trace: +[ 0.414540] +[ 0.414540] ? __warn+0x80/0x120 +[ 0.414540] ? free_irq+0x1a1/0x2d0 +[ 0.414540] ? report_bug+0x164/0x190 +[ 0.414540] ? handle_bug+0x3b/0x70 +[ 0.414540] ? exc_invalid_op+0x17/0x70 +[ 0.414540] ? asm_exc_invalid_op+0x1a/0x20 +[ 0.414540] ? free_irq+0x1a1/0x2d0 +[ 0.414540] vp_del_vqs+0xc1/0x220 +[ 0.414540] vp_find_vqs_msix+0x305/0x470 +[ 0.414540] vp_find_vqs+0x3e/0x1a0 +[ 0.414540] vp_modern_find_vqs+0x1b/0x70 +[ 0.414540] init_vqs+0x387/0x600 +[ 0.414540] virtnet_probe+0x50a/0xc80 +[ 0.414540] virtio_dev_probe+0x1e0/0x2b0 +[ 0.414540] really_probe+0xc0/0x2c0 +[ 0.414540] ? __pfx___driver_attach+0x10/0x10 +[ 0.414540] __driver_probe_device+0x73/0x120 +[ 0.414540] driver_probe_device+0x1f/0xe0 +[ 0.414540] __driver_attach+0x88/0x180 +[ 0.414540] bus_for_each_dev+0x85/0xd0 +[ 0.414540] bus_add_driver+0xec/0x1f0 +[ 0.414540] driver_register+0x59/0x100 +[ 0.414540] ? __pfx_virtio_net_driver_init+0x10/0x10 +[ 0.414540] virtio_net_driver_init+0x90/0xb0 +[ 0.414540] do_one_initcall+0x58/0x230 +[ 0.414540] kernel_init_freeable+0x1a3/0x2d0 +[ 0.414540] ? __pfx_kernel_init+0x10/0x10 +[ 0.414540] kernel_init+0x1a/0x1c0 +[ 0.414540] ret_from_fork+0x31/0x50 +[ 0.414540] ? __pfx_kernel_init+0x10/0x10 +[ 0.414540] ret_from_fork_asm+0x1a/0x30 +[ 0.414540] + +Fix this by calling deleting the current vq when request_irq() fails. + +Fixes: 0b0f9dc52ed0 ("Revert "virtio_pci: use shared interrupts for virtqueues"") +Signed-off-by: Jiri Pirko +Message-Id: <20240426150845.3999481-1-jiri@resnulli.us> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_pci_common.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c +index b655fccaf7733..584af7816532b 100644 +--- a/drivers/virtio/virtio_pci_common.c ++++ b/drivers/virtio/virtio_pci_common.c +@@ -348,8 +348,10 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned int nvqs, + vring_interrupt, 0, + vp_dev->msix_names[msix_vec], + vqs[i]); +- if (err) ++ if (err) { ++ vp_del_vq(vqs[i]); + goto error_find; ++ } + } + return 0; + +-- +2.43.0 + diff --git a/queue-6.9/virtio_balloon-give-the-balloon-its-own-wakeup-sourc.patch b/queue-6.9/virtio_balloon-give-the-balloon-its-own-wakeup-sourc.patch new file mode 100644 index 00000000000..662f3f76804 --- /dev/null +++ b/queue-6.9/virtio_balloon-give-the-balloon-its-own-wakeup-sourc.patch @@ -0,0 +1,74 @@ +From 30859bfc8a841eac49882a8fdec2c45d139f02c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 10:24:44 +0900 +Subject: virtio_balloon: Give the balloon its own wakeup source + +From: David Stevens + +[ Upstream commit 810d831bbbf3cbd86e5aa91c8485b4d35186144d ] + +Wakeup sources don't support nesting multiple events, so sharing a +single object between multiple drivers can result in one driver +overriding the wakeup event processing period specified by another +driver. Have the virtio balloon driver use the wakeup source of the +device it is bound to rather than the wakeup source of the parent +device, to avoid conflicts with the transport layer. + +Note that although the virtio balloon's virtio_device itself isn't what +actually wakes up the device, it is responsible for processing wakeup +events. In the same way that EPOLLWAKEUP uses a dedicated wakeup_source +to prevent suspend when userspace is processing wakeup events, a +dedicated wakeup_source is necessary when processing wakeup events in a +higher layer in the kernel. + +Fixes: b12fbc3f787e ("virtio_balloon: stay awake while adjusting balloon") +Signed-off-by: David Stevens +Acked-by: David Hildenbrand +Message-Id: <20240321012445.1593685-2-stevensd@google.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_balloon.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c +index 1f5b3dd31fcfc..89bc8da80519f 100644 +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -450,7 +450,7 @@ static void start_update_balloon_size(struct virtio_balloon *vb) + vb->adjustment_signal_pending = true; + if (!vb->adjustment_in_progress) { + vb->adjustment_in_progress = true; +- pm_stay_awake(vb->vdev->dev.parent); ++ pm_stay_awake(&vb->vdev->dev); + } + spin_unlock_irqrestore(&vb->adjustment_lock, flags); + +@@ -462,7 +462,7 @@ static void end_update_balloon_size(struct virtio_balloon *vb) + spin_lock_irq(&vb->adjustment_lock); + if (!vb->adjustment_signal_pending && vb->adjustment_in_progress) { + vb->adjustment_in_progress = false; +- pm_relax(vb->vdev->dev.parent); ++ pm_relax(&vb->vdev->dev); + } + spin_unlock_irq(&vb->adjustment_lock); + } +@@ -1029,6 +1029,15 @@ static int virtballoon_probe(struct virtio_device *vdev) + + spin_lock_init(&vb->adjustment_lock); + ++ /* ++ * The virtio balloon itself can't wake up the device, but it is ++ * responsible for processing wakeup events passed up from the transport ++ * layer. Wakeup sources don't support nesting/chaining calls, so we use ++ * our own wakeup source to ensure wakeup events are properly handled ++ * without trampling on the transport layer's wakeup source. ++ */ ++ device_set_wakeup_capable(&vb->vdev->dev, true); ++ + virtio_device_ready(vdev); + + if (towards_target(vb)) +-- +2.43.0 + diff --git a/queue-6.9/x86-kconfig-select-arch_want_frame_pointers-again-wh.patch b/queue-6.9/x86-kconfig-select-arch_want_frame_pointers-again-wh.patch new file mode 100644 index 00000000000..ab2a8355faf --- /dev/null +++ b/queue-6.9/x86-kconfig-select-arch_want_frame_pointers-again-wh.patch @@ -0,0 +1,63 @@ +From 292c8b045edbc06f8effd570e9f6ae3b0cc960b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Feb 2024 21:20:03 +0900 +Subject: x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when + UNWINDER_FRAME_POINTER=y + +From: Masahiro Yamada + +[ Upstream commit 66ee3636eddcc82ab82b539d08b85fb5ac1dff9b ] + +It took me some time to understand the purpose of the tricky code at +the end of arch/x86/Kconfig.debug. + +Without it, the following would be shown: + + WARNING: unmet direct dependencies detected for FRAME_POINTER + +because + + 81d387190039 ("x86/kconfig: Consolidate unwinders into multiple choice selection") + +removed 'select ARCH_WANT_FRAME_POINTERS'. + +The correct and more straightforward approach should have been to move +it where 'select FRAME_POINTER' is located. + +Several architectures properly handle the conditional selection of +ARCH_WANT_FRAME_POINTERS. For example, 'config UNWINDER_FRAME_POINTER' +in arch/arm/Kconfig.debug. + +Fixes: 81d387190039 ("x86/kconfig: Consolidate unwinders into multiple choice selection") +Signed-off-by: Masahiro Yamada +Signed-off-by: Borislav Petkov (AMD) +Acked-by: Josh Poimboeuf +Link: https://lore.kernel.org/r/20240204122003.53795-1-masahiroy@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig.debug | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug +index c5d614d28a759..74777a97e394a 100644 +--- a/arch/x86/Kconfig.debug ++++ b/arch/x86/Kconfig.debug +@@ -248,6 +248,7 @@ config UNWINDER_ORC + + config UNWINDER_FRAME_POINTER + bool "Frame pointer unwinder" ++ select ARCH_WANT_FRAME_POINTERS + select FRAME_POINTER + help + This option enables the frame pointer unwinder for unwinding kernel +@@ -271,7 +272,3 @@ config UNWINDER_GUESS + overhead. + + endchoice +- +-config FRAME_POINTER +- depends on !UNWINDER_ORC && !UNWINDER_GUESS +- bool +-- +2.43.0 + diff --git a/queue-6.9/x86-percpu-unify-arch_raw_cpu_ptr-defines.patch b/queue-6.9/x86-percpu-unify-arch_raw_cpu_ptr-defines.patch new file mode 100644 index 00000000000..1d7718da286 --- /dev/null +++ b/queue-6.9/x86-percpu-unify-arch_raw_cpu_ptr-defines.patch @@ -0,0 +1,115 @@ +From 55b57071fb9f11886ca11a85d5ead04ed570b038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 11:27:14 +0100 +Subject: x86/percpu: Unify arch_raw_cpu_ptr() defines + +From: Uros Bizjak + +[ Upstream commit 4e5b0e8003df05983b6dabcdde7ff447d53b49d7 ] + +When building a 32-bit vDSO for a 64-bit kernel, games are played with +CONFIG_X86_64. {this,raw}_cpu_read_8() macros are conditionally defined +on CONFIG_X86_64 and when CONFIG_X86_64 is undefined in fake_32bit_build.h +various build failures in generic percpu header files can happen. To make +things worse, the build of 32-bit vDSO for a 64-bit kernel grew dependency +on arch_raw_cpu_ptr() macro and the build fails if arch_raw_cpu_ptr() +macro is not defined. + +To mitigate these issues, x86 carefully defines arch_raw_cpu_ptr() to +avoid any dependency on raw_cpu_read_8() and thus CONFIG_X86_64. W/o +segment register support, the definition uses size-agnostic MOV asm +mnemonic and hopes that _ptr argument won't ever be 64-bit size on +32-bit targets (although newer GCCs warn for this situation with +"unsupported size for integer register"), and w/ segment register +support the definition uses size-agnostic __raw_cpu_read() macro. + +Fortunately, raw_cpu_read() is not used in 32-bit vDSO for a 64-bit kernel. +However, we can't simply omit the definition of arch_raw_cpu_read(), +since the build will fail when building vdso/vdso32/vclock_gettime.o. + +The patch defines arch_raw_cpu_ptr to BUILD_BUG() when BUILD_VDSO32_64 +macro is defined. This way, we are sure that arch_raw_cpu_ptr() won't +actually be used in 32-bit VDSO for a 64-bit kernel, but it is still +defined to prevent build failure. + +Finally, we can unify arch_raw_cpu_ptr() between builds w/ and w/o +x86 segment register support, substituting two tricky macro definitions +with a straightforward implementation. + +There is no size difference and no difference in number of this_cpu_off +accesses between patched and unpatched kernel when the kernel is built +either w/ and w/o segment register support. + +Signed-off-by: Uros Bizjak +Signed-off-by: Ingo Molnar +Cc: Andy Lutomirski +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20240322102730.209141-1-ubizjak@gmail.com +Stable-dep-of: a55c1fdad5f6 ("x86/percpu: Use __force to cast from __percpu address space") +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/percpu.h | 42 +++++++++++++++-------------------- + 1 file changed, 18 insertions(+), 24 deletions(-) + +diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h +index b77bbb67e77b0..dbfde44d88a31 100644 +--- a/arch/x86/include/asm/percpu.h ++++ b/arch/x86/include/asm/percpu.h +@@ -59,36 +59,30 @@ + #define __force_percpu_prefix "%%"__stringify(__percpu_seg)":" + #define __my_cpu_offset this_cpu_read(this_cpu_off) + +-#ifdef CONFIG_USE_X86_SEG_SUPPORT +-/* +- * Efficient implementation for cases in which the compiler supports +- * named address spaces. Allows the compiler to perform additional +- * optimizations that can save more instructions. +- */ +-#define arch_raw_cpu_ptr(ptr) \ +-({ \ +- unsigned long tcp_ptr__; \ +- tcp_ptr__ = __raw_cpu_read(, this_cpu_off); \ +- \ +- tcp_ptr__ += (__force unsigned long)(ptr); \ +- (typeof(*(ptr)) __kernel __force *)tcp_ptr__; \ +-}) +-#else /* CONFIG_USE_X86_SEG_SUPPORT */ ++#ifdef CONFIG_X86_64 ++#define __raw_my_cpu_offset raw_cpu_read_8(this_cpu_off); ++#else ++#define __raw_my_cpu_offset raw_cpu_read_4(this_cpu_off); ++#endif ++ + /* + * Compared to the generic __my_cpu_offset version, the following + * saves one instruction and avoids clobbering a temp register. ++ * ++ * arch_raw_cpu_ptr should not be used in 32-bit VDSO for a 64-bit ++ * kernel, because games are played with CONFIG_X86_64 there and ++ * sizeof(this_cpu_off) becames 4. + */ +-#define arch_raw_cpu_ptr(ptr) \ ++#ifndef BUILD_VDSO32_64 ++#define arch_raw_cpu_ptr(_ptr) \ + ({ \ +- unsigned long tcp_ptr__; \ +- asm ("mov " __percpu_arg(1) ", %0" \ +- : "=r" (tcp_ptr__) \ +- : "m" (__my_cpu_var(this_cpu_off))); \ +- \ +- tcp_ptr__ += (unsigned long)(ptr); \ +- (typeof(*(ptr)) __kernel __force *)tcp_ptr__; \ ++ unsigned long tcp_ptr__ = __raw_my_cpu_offset; \ ++ tcp_ptr__ += (unsigned long)(_ptr); \ ++ (typeof(*(_ptr)) __kernel __force *)tcp_ptr__; \ + }) +-#endif /* CONFIG_USE_X86_SEG_SUPPORT */ ++#else ++#define arch_raw_cpu_ptr(_ptr) ({ BUILD_BUG(); (typeof(_ptr))0; }) ++#endif + + #define PER_CPU_VAR(var) %__percpu_seg:(var)__percpu_rel + +-- +2.43.0 + diff --git a/queue-6.9/x86-percpu-use-__force-to-cast-from-__percpu-address.patch b/queue-6.9/x86-percpu-use-__force-to-cast-from-__percpu-address.patch new file mode 100644 index 00000000000..4ac9ba3ca9b --- /dev/null +++ b/queue-6.9/x86-percpu-use-__force-to-cast-from-__percpu-address.patch @@ -0,0 +1,50 @@ +From 630d104c20f3075b584bc06fbe66b71c0b94877e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 19:50:38 +0200 +Subject: x86/percpu: Use __force to cast from __percpu address space + +From: Uros Bizjak + +[ Upstream commit a55c1fdad5f61b4bfe42319694b23671a758cb28 ] + +Fix Sparse warning when casting from __percpu address space by using +__force in the cast. x86 named address spaces are not considered to +be subspaces of the generic (flat) address space, so explicit casts +are required to convert pointers between these address spaces and the +generic address space (the application should cast to uintptr_t and +apply the segment base offset). The cast to uintptr_t removes +__percpu address space tag and Sparse reports: + + warning: cast removes address space '__percpu' of expression + +Use __force to inform Sparse that the cast is intentional. + +Fixes: 9a462b9eafa6 ("x86/percpu: Use compiler segment prefix qualifier") +Reported-by: Charlemagne Lasse +Signed-off-by: Uros Bizjak +Signed-off-by: Ingo Molnar +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20240402175058.52649-1-ubizjak@gmail.com + +Closes: https://lore.kernel.org/lkml/CAFGhKbzev7W4aHwhFPWwMZQEHenVgZUj7=aunFieVqZg3mt14A@mail.gmail.com/ +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/percpu.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h +index dbfde44d88a31..ce5111cec36e2 100644 +--- a/arch/x86/include/asm/percpu.h ++++ b/arch/x86/include/asm/percpu.h +@@ -77,7 +77,7 @@ + #define arch_raw_cpu_ptr(_ptr) \ + ({ \ + unsigned long tcp_ptr__ = __raw_my_cpu_offset; \ +- tcp_ptr__ += (unsigned long)(_ptr); \ ++ tcp_ptr__ += (__force unsigned long)(_ptr); \ + (typeof(*(_ptr)) __kernel __force *)tcp_ptr__; \ + }) + #else +-- +2.43.0 + diff --git a/queue-6.9/xen-x86-add-extra-pages-to-unpopulated-alloc-if-avai.patch b/queue-6.9/xen-x86-add-extra-pages-to-unpopulated-alloc-if-avai.patch new file mode 100644 index 00000000000..bce85ba5915 --- /dev/null +++ b/queue-6.9/xen-x86-add-extra-pages-to-unpopulated-alloc-if-avai.patch @@ -0,0 +1,87 @@ +From 7f5dbc6f3aa98836265951bdd24e37a979810a6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 17:50:53 +0200 +Subject: xen/x86: add extra pages to unpopulated-alloc if available +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roger Pau Monne + +[ Upstream commit a6aa4eb994ee9ced905743817c5de8451d26b911 ] + +Commit 262fc47ac174 ('xen/balloon: don't use PV mode extra memory for zone +device allocations') removed the addition of the extra memory ranges to the +unpopulated range allocator, using those only for the balloon driver. + +This forces the unpopulated allocator to attach hotplug ranges even when spare +memory (as part of the extra memory ranges) is available. Furthermore, on PVH +domains it defeats the purpose of commit 38620fc4e893 ('x86/xen: attempt to +inflate the memory balloon on PVH'), as extra memory ranges would only be +used to map foreign memory if the kernel is built without XEN_UNPOPULATED_ALLOC +support. + +Fix this by adding a helpers that adds the extra memory ranges to the list of +unpopulated pages, and zeroes the ranges so they are not also consumed by the +balloon driver. + +This should have been part of 38620fc4e893, hence the fixes tag. + +Note the current logic relies on unpopulated_init() (and hence +arch_xen_unpopulated_init()) always being called ahead of balloon_init(), so +that the extra memory regions are consumed by arch_xen_unpopulated_init(). + +Fixes: 38620fc4e893 ('x86/xen: attempt to inflate the memory balloon on PVH') +Signed-off-by: Roger Pau Monné +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240429155053.72509-1-roger.pau@citrix.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/enlighten.c | 33 +++++++++++++++++++++++++++++++++ + 1 file changed, 33 insertions(+) + +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index a01ca255b0c64..b88722dfc4f86 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -382,3 +382,36 @@ void __init xen_add_extra_mem(unsigned long start_pfn, unsigned long n_pfns) + + memblock_reserve(PFN_PHYS(start_pfn), PFN_PHYS(n_pfns)); + } ++ ++#ifdef CONFIG_XEN_UNPOPULATED_ALLOC ++int __init arch_xen_unpopulated_init(struct resource **res) ++{ ++ unsigned int i; ++ ++ if (!xen_domain()) ++ return -ENODEV; ++ ++ /* Must be set strictly before calling xen_free_unpopulated_pages(). */ ++ *res = &iomem_resource; ++ ++ /* ++ * Initialize with pages from the extra memory regions (see ++ * arch/x86/xen/setup.c). ++ */ ++ for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) { ++ unsigned int j; ++ ++ for (j = 0; j < xen_extra_mem[i].n_pfns; j++) { ++ struct page *pg = ++ pfn_to_page(xen_extra_mem[i].start_pfn + j); ++ ++ xen_free_unpopulated_pages(1, &pg); ++ } ++ ++ /* Zero so region is not also added to the balloon driver. */ ++ xen_extra_mem[i].n_pfns = 0; ++ } ++ ++ return 0; ++} ++#endif +-- +2.43.0 +