From: Sasha Levin Date: Sun, 26 May 2024 17:04:00 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v6.9.3~17 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6df9204ef12464b05546f5a7fe8822b74ce21fab;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/acpi-disable-wstringop-truncation.patch b/queue-6.6/acpi-disable-wstringop-truncation.patch new file mode 100644 index 00000000000..7c1dba6d9af --- /dev/null +++ b/queue-6.6/acpi-disable-wstringop-truncation.patch @@ -0,0 +1,48 @@ +From 24a878cb73975f2e6bafcefa42616f03a8698a06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 16:00:55 +0200 +Subject: ACPI: disable -Wstringop-truncation + +From: Arnd Bergmann + +[ Upstream commit a3403d304708f60565582d60af4316289d0316a0 ] + +gcc -Wstringop-truncation warns about copying a string that results in a +missing nul termination: + +drivers/acpi/acpica/tbfind.c: In function 'acpi_tb_find_table': +drivers/acpi/acpica/tbfind.c:60:9: error: 'strncpy' specified bound 6 equals destination size [-Werror=stringop-truncation] + 60 | strncpy(header.oem_id, oem_id, ACPI_OEM_ID_SIZE); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/acpi/acpica/tbfind.c:61:9: error: 'strncpy' specified bound 8 equals destination size [-Werror=stringop-truncation] + 61 | strncpy(header.oem_table_id, oem_table_id, ACPI_OEM_TABLE_ID_SIZE); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The code works as intended, and the warning could be addressed by using +a memcpy(), but turning the warning off for this file works equally well +and may be easier to merge. + +Fixes: 47c08729bf1c ("ACPICA: Fix for LoadTable operator, input strings") +Link: https://lore.kernel.org/lkml/CAJZ5v0hoUfv54KW7y4223Mn9E7D4xvR7whRFNLTBqCZMUxT50Q@mail.gmail.com/#t +Signed-off-by: Arnd Bergmann +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile +index 30f3fc13c29d1..8d18af396de92 100644 +--- a/drivers/acpi/acpica/Makefile ++++ b/drivers/acpi/acpica/Makefile +@@ -5,6 +5,7 @@ + + ccflags-y := -D_LINUX -DBUILDING_ACPICA + ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT ++CFLAGS_tbfind.o += $(call cc-disable-warning, stringop-truncation) + + # use acpi.o to put all files here into acpi.o modparam namespace + obj-y += acpi.o +-- +2.43.0 + diff --git a/queue-6.6/acpi-fix-generic-initiator-affinity-_osc-bit.patch b/queue-6.6/acpi-fix-generic-initiator-affinity-_osc-bit.patch new file mode 100644 index 00000000000..c2b8fe89ca5 --- /dev/null +++ b/queue-6.6/acpi-fix-generic-initiator-affinity-_osc-bit.patch @@ -0,0 +1,40 @@ +From 10dd9f739b3d78aebcdcaab7454cfd7ff4137f79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Mar 2024 21:13:09 +0100 +Subject: ACPI: Fix Generic Initiator Affinity _OSC bit + +From: Armin Wolf + +[ Upstream commit d0d4f1474e36b195eaad477373127ae621334c01 ] + +The ACPI spec says bit 17 should be used to indicate support +for Generic Initiator Affinity Structure in SRAT, but we currently +set bit 13 ("Interrupt ResourceSource support"). + +Fix this by actually setting bit 17 when evaluating _OSC. + +Fixes: 01aabca2fd54 ("ACPI: Let ACPI know we support Generic Initiator Affinity Structures") +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/linux/acpi.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index afd94c9b8b8af..1b76d2f83eac6 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -571,8 +571,8 @@ acpi_status acpi_run_osc(acpi_handle handle, struct acpi_osc_context *context); + #define OSC_SB_PCLPI_SUPPORT 0x00000080 + #define OSC_SB_OSLPI_SUPPORT 0x00000100 + #define OSC_SB_CPC_DIVERSE_HIGH_SUPPORT 0x00001000 +-#define OSC_SB_GENERIC_INITIATOR_SUPPORT 0x00002000 + #define OSC_SB_CPC_FLEXIBLE_ADR_SPACE 0x00004000 ++#define OSC_SB_GENERIC_INITIATOR_SUPPORT 0x00020000 + #define OSC_SB_NATIVE_USB4_SUPPORT 0x00040000 + #define OSC_SB_PRM_SUPPORT 0x00200000 + #define OSC_SB_FFH_OPR_SUPPORT 0x00400000 +-- +2.43.0 + diff --git a/queue-6.6/acpi-lpss-advertise-number-of-chip-selects-via-prope.patch b/queue-6.6/acpi-lpss-advertise-number-of-chip-selects-via-prope.patch new file mode 100644 index 00000000000..94625fa3362 --- /dev/null +++ b/queue-6.6/acpi-lpss-advertise-number-of-chip-selects-via-prope.patch @@ -0,0 +1,35 @@ +From 17684d6d6f1432f7653a90767930a097763829f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 15:06:58 +0300 +Subject: ACPI: LPSS: Advertise number of chip selects via property + +From: Andy Shevchenko + +[ Upstream commit 07b73ee599428b41d0240f2f7b31b524eba07dd0 ] + +Advertise number of chip selects via property for Intel Braswell. + +Fixes: 620c803f42de ("ACPI: LPSS: Provide an SSP type to the driver") +Signed-off-by: Andy Shevchenko +Reviewed-by: Kuppuswamy Sathyanarayanan +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_lpss.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index a052e0ab19e4c..98a2ab3b68442 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -333,6 +333,7 @@ static const struct lpss_device_desc bsw_i2c_dev_desc = { + + static const struct property_entry bsw_spi_properties[] = { + PROPERTY_ENTRY_U32("intel,spi-pxa2xx-type", LPSS_BSW_SSP), ++ PROPERTY_ENTRY_U32("num-cs", 2), + { } + }; + +-- +2.43.0 + diff --git a/queue-6.6/af_packet-do-not-call-packet_read_pending-from-tpack.patch b/queue-6.6/af_packet-do-not-call-packet_read_pending-from-tpack.patch new file mode 100644 index 00000000000..782a680cd66 --- /dev/null +++ b/queue-6.6/af_packet-do-not-call-packet_read_pending-from-tpack.patch @@ -0,0 +1,49 @@ +From 2db500cd3b5fffc28eac4020d3cbd42cf5f30256 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 16:33:58 +0000 +Subject: af_packet: do not call packet_read_pending() from + tpacket_destruct_skb() + +From: Eric Dumazet + +[ Upstream commit 581073f626e387d3e7eed55c48c8495584ead7ba ] + +trafgen performance considerably sank on hosts with many cores +after the blamed commit. + +packet_read_pending() is very expensive, and calling it +in af_packet fast path defeats Daniel intent in commit +b013840810c2 ("packet: use percpu mmap tx frame pending refcount") + +tpacket_destruct_skb() makes room for one packet, we can immediately +wakeup a producer, no need to completely drain the tx ring. + +Fixes: 89ed5b519004 ("af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET") +Signed-off-by: Eric Dumazet +Cc: Neil Horman +Cc: Daniel Borkmann +Reviewed-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20240515163358.4105915-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index f017d7d33da39..ff1ddf544e179 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2528,8 +2528,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb) + ts = __packet_set_timestamp(po, ph, skb); + __packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts); + +- if (!packet_read_pending(&po->tx_ring)) +- complete(&po->skb_completion); ++ complete(&po->skb_completion); + } + + sock_wfree(skb); +-- +2.43.0 + diff --git a/queue-6.6/af_unix-fix-data-races-in-unix_release_sock-unix_str.patch b/queue-6.6/af_unix-fix-data-races-in-unix_release_sock-unix_str.patch new file mode 100644 index 00000000000..79d4f2b6158 --- /dev/null +++ b/queue-6.6/af_unix-fix-data-races-in-unix_release_sock-unix_str.patch @@ -0,0 +1,76 @@ +From 1f3fa520d2a22dc043d627179585dbfef6053e40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 01:14:46 -0700 +Subject: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg + +From: Breno Leitao + +[ Upstream commit 540bf24fba16b88c1b3b9353927204b4f1074e25 ] + +A data-race condition has been identified in af_unix. In one data path, +the write function unix_release_sock() atomically writes to +sk->sk_shutdown using WRITE_ONCE. However, on the reader side, +unix_stream_sendmsg() does not read it atomically. Consequently, this +issue is causing the following KCSAN splat to occur: + + BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg + + write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28: + unix_release_sock (net/unix/af_unix.c:640) + unix_release (net/unix/af_unix.c:1050) + sock_close (net/socket.c:659 net/socket.c:1421) + __fput (fs/file_table.c:422) + __fput_sync (fs/file_table.c:508) + __se_sys_close (fs/open.c:1559 fs/open.c:1541) + __x64_sys_close (fs/open.c:1541) + x64_sys_call (arch/x86/entry/syscall_64.c:33) + do_syscall_64 (arch/x86/entry/common.c:?) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) + + read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14: + unix_stream_sendmsg (net/unix/af_unix.c:2273) + __sock_sendmsg (net/socket.c:730 net/socket.c:745) + ____sys_sendmsg (net/socket.c:2584) + __sys_sendmmsg (net/socket.c:2638 net/socket.c:2724) + __x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750) + x64_sys_call (arch/x86/entry/syscall_64.c:33) + do_syscall_64 (arch/x86/entry/common.c:?) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) + + value changed: 0x01 -> 0x03 + +The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7"). + +Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.") +addressed a comparable issue in the past regarding sk->sk_shutdown. +However, it overlooked resolving this particular data path. +This patch only offending unix_stream_sendmsg() function, since the +other reads seem to be protected by unix_state_lock() as discussed in +Link: https://lore.kernel.org/all/20240508173324.53565-1-kuniyu@amazon.com/ + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Breno Leitao +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20240509081459.2807828-1-leitao@debian.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/unix/af_unix.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 6eab35a5e2f3b..aaa4d7878b5de 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2199,7 +2199,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, + goto out_err; + } + +- if (sk->sk_shutdown & SEND_SHUTDOWN) ++ if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN) + goto pipe_err; + + while (sent < len) { +-- +2.43.0 + diff --git a/queue-6.6/alsa-emu10k1-make-e-mu-fpga-writes-potentially-more-.patch b/queue-6.6/alsa-emu10k1-make-e-mu-fpga-writes-potentially-more-.patch new file mode 100644 index 00000000000..5480bdb502a --- /dev/null +++ b/queue-6.6/alsa-emu10k1-make-e-mu-fpga-writes-potentially-more-.patch @@ -0,0 +1,40 @@ +From 4bf983d5ac7c3fd8ac18932290f120e2f0012cd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2024 11:37:16 +0200 +Subject: ALSA: emu10k1: make E-MU FPGA writes potentially more reliable + +From: Oswald Buddenhagen + +[ Upstream commit 15c7e87aa88f0ab2d51c2e2123b127a6d693ca21 ] + +We did not delay after the second strobe signal, so another immediately +following access could potentially corrupt the written value. + +This is a purely speculative fix with no supporting evidence, but after +taking out the spinlocks around the writes, it seems plausible that a +modern processor could be actually too fast. Also, it's just cleaner to +be consistent. + +Signed-off-by: Oswald Buddenhagen +Signed-off-by: Takashi Iwai +Message-ID: <20240428093716.3198666-7-oswald.buddenhagen@gmx.de> +Signed-off-by: Sasha Levin +--- + sound/pci/emu10k1/io.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/emu10k1/io.c b/sound/pci/emu10k1/io.c +index 74df2330015f6..5cb8acf5b158c 100644 +--- a/sound/pci/emu10k1/io.c ++++ b/sound/pci/emu10k1/io.c +@@ -285,6 +285,7 @@ static void snd_emu1010_fpga_write_locked(struct snd_emu10k1 *emu, u32 reg, u32 + outw(value, emu->port + A_GPIO); + udelay(10); + outw(value | 0x80 , emu->port + A_GPIO); /* High bit clocks the value into the fpga. */ ++ udelay(10); + } + + void snd_emu1010_fpga_write(struct snd_emu10k1 *emu, u32 reg, u32 value) +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-cs35l56-exit-cache-only-after-cs35l56_wait_.patch b/queue-6.6/alsa-hda-cs35l56-exit-cache-only-after-cs35l56_wait_.patch new file mode 100644 index 00000000000..50995097351 --- /dev/null +++ b/queue-6.6/alsa-hda-cs35l56-exit-cache-only-after-cs35l56_wait_.patch @@ -0,0 +1,51 @@ +From fbaae9bed7f5f63081ea65d7bc9c789ccacc170e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 11:18:01 +0100 +Subject: ALSA: hda: cs35l56: Exit cache-only after + cs35l56_wait_for_firmware_boot() + +From: Richard Fitzgerald + +[ Upstream commit 73580ec607dfe125b140ed30c7c0a074db78c558 ] + +Adds calls to disable regmap cache-only after a successful return from +cs35l56_wait_for_firmware_boot(). + +This is to prepare for a change in the shared ASoC module that will +leave regmap in cache-only mode after cs35l56_system_reset(). This is +to prevent register accesses going to the hardware while it is +rebooting. + +Signed-off-by: Richard Fitzgerald +Link: https://msgid.link/r/20240408101803.43183-3-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l56_hda.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/cs35l56_hda.c b/sound/pci/hda/cs35l56_hda.c +index 27848d6469636..05b1412868fc0 100644 +--- a/sound/pci/hda/cs35l56_hda.c ++++ b/sound/pci/hda/cs35l56_hda.c +@@ -603,6 +603,8 @@ static int cs35l56_hda_fw_load(struct cs35l56_hda *cs35l56) + ret = cs35l56_wait_for_firmware_boot(&cs35l56->base); + if (ret) + goto err_powered_up; ++ ++ regcache_cache_only(cs35l56->base.regmap, false); + } + + /* Disable auto-hibernate so that runtime_pm has control */ +@@ -942,6 +944,8 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int id) + if (ret) + goto err; + ++ regcache_cache_only(cs35l56->base.regmap, false); ++ + ret = cs35l56_set_patch(&cs35l56->base); + if (ret) + goto err; +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-intel-dsp-config-harden-i2c-i2s-codec-detec.patch b/queue-6.6/alsa-hda-intel-dsp-config-harden-i2c-i2s-codec-detec.patch new file mode 100644 index 00000000000..a130aec86aa --- /dev/null +++ b/queue-6.6/alsa-hda-intel-dsp-config-harden-i2c-i2s-codec-detec.patch @@ -0,0 +1,84 @@ +From 3f312e3aaf433280a3ad21d5e0d92f358bec130d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 10:28:18 -0500 +Subject: ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit 79ac4c1443eaec0d09355307043a9149287f23c1 ] + +The SOF driver is selected whenever specific I2C/I2S HIDs are reported +as 'present' in the ACPI DSDT. In some cases, an HID is reported but +the hardware does not actually rely on I2C/I2S. This false positive +leads to an invalid selection of the SOF driver and as a result an +invalid topology is loaded. + +This patch hardens the detection with a check that the NHLT table is +consistent with the report of an I2S-based codec in DSDT. This table +should expose at least one SSP endpoint configured for an I2S-codec +connection. + +Tested on Huawei Matebook D14 (NBLB-WAX9N) using an HDaudio codec with +an invalid ES8336 ACPI HID reported: + +[ 7.858249] snd_hda_intel 0000:00:1f.3: DSP detected with PCI class/subclass/prog-if info 0x040380 +[ 7.858312] snd_hda_intel 0000:00:1f.3: snd_intel_dsp_find_config: no valid SSP found for HID ESSX8336, skipped + +Reported-by: Mauro Carvalho Chehab +Tested-by: Mauro Carvalho Chehab +Closes: https://github.com/thesofproject/linux/issues/4934 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Péter Ujfalusi +Message-ID: <20240426152818.38443-1-pierre-louis.bossart@linux.intel.com> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/intel-dsp-config.c | 27 +++++++++++++++++++++++++-- + 1 file changed, 25 insertions(+), 2 deletions(-) + +diff --git a/sound/hda/intel-dsp-config.c b/sound/hda/intel-dsp-config.c +index 6a384b922e4fa..d1f6cdcf1866e 100644 +--- a/sound/hda/intel-dsp-config.c ++++ b/sound/hda/intel-dsp-config.c +@@ -557,9 +557,32 @@ static const struct config_entry *snd_intel_dsp_find_config + if (table->codec_hid) { + int i; + +- for (i = 0; i < table->codec_hid->num_codecs; i++) +- if (acpi_dev_present(table->codec_hid->codecs[i], NULL, -1)) ++ for (i = 0; i < table->codec_hid->num_codecs; i++) { ++ struct nhlt_acpi_table *nhlt; ++ bool ssp_found = false; ++ ++ if (!acpi_dev_present(table->codec_hid->codecs[i], NULL, -1)) ++ continue; ++ ++ nhlt = intel_nhlt_init(&pci->dev); ++ if (!nhlt) { ++ dev_warn(&pci->dev, "%s: NHLT table not found, skipped HID %s\n", ++ __func__, table->codec_hid->codecs[i]); ++ continue; ++ } ++ ++ if (intel_nhlt_has_endpoint_type(nhlt, NHLT_LINK_SSP) && ++ intel_nhlt_ssp_endpoint_mask(nhlt, NHLT_DEVICE_I2S)) ++ ssp_found = true; ++ ++ intel_nhlt_free(nhlt); ++ ++ if (ssp_found) + break; ++ ++ dev_warn(&pci->dev, "%s: no valid SSP found for HID %s, skipped\n", ++ __func__, table->codec_hid->codecs[i]); ++ } + if (i == table->codec_hid->num_codecs) + continue; + } +-- +2.43.0 + diff --git a/queue-6.6/arm-configs-sunxi-enable-drm_dw_hdmi.patch b/queue-6.6/arm-configs-sunxi-enable-drm_dw_hdmi.patch new file mode 100644 index 00000000000..c7873629ec5 --- /dev/null +++ b/queue-6.6/arm-configs-sunxi-enable-drm_dw_hdmi.patch @@ -0,0 +1,41 @@ +From e9368f8b9ccb13bdcb1528623a6508d2dc7ea5f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 12:56:23 +0200 +Subject: ARM: configs: sunxi: Enable DRM_DW_HDMI + +From: Maxime Ripard + +[ Upstream commit deff401b14e2d832b25b55862ad6c73378fe034e ] + +Commit 4fc8cb47fcfd ("drm/display: Move HDMI helpers into display-helper +module") turned the DRM_DW_HDMI dependency of DRM_SUN8I_DW_HDMI into a +depends on which ended up disabling the driver in the defconfig. Make +sure it's still enabled. + +Fixes: 4fc8cb47fcfd ("drm/display: Move HDMI helpers into display-helper module") +Reported-by: Mark Brown +Reported-by: Alexander Stein +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20240403-fix-dw-hdmi-kconfig-v1-5-afbc4a835c38@kernel.org +Signed-off-by: Jernej Skrabec +Signed-off-by: Sasha Levin +--- + arch/arm/configs/sunxi_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig +index bddc82f789421..a83d29fed1756 100644 +--- a/arch/arm/configs/sunxi_defconfig ++++ b/arch/arm/configs/sunxi_defconfig +@@ -110,6 +110,7 @@ CONFIG_DRM_PANEL_LVDS=y + CONFIG_DRM_PANEL_SIMPLE=y + CONFIG_DRM_PANEL_EDP=y + CONFIG_DRM_SIMPLE_BRIDGE=y ++CONFIG_DRM_DW_HDMI=y + CONFIG_DRM_LIMA=y + CONFIG_FB_SIMPLE=y + CONFIG_BACKLIGHT_CLASS_DEVICE=y +-- +2.43.0 + diff --git a/queue-6.6/asoc-acp-support-microphone-from-device-acer-315-24p.patch b/queue-6.6/asoc-acp-support-microphone-from-device-acer-315-24p.patch new file mode 100644 index 00000000000..ce0b7af6c37 --- /dev/null +++ b/queue-6.6/asoc-acp-support-microphone-from-device-acer-315-24p.patch @@ -0,0 +1,40 @@ +From 3740911c07376aba85b45e4fc86a8329588f90d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 18:24:54 +0300 +Subject: ASoC: acp: Support microphone from device Acer 315-24p + +From: end.to.start + +[ Upstream commit 4b9a474c7c820391c0913d64431ae9e1f52a5143 ] + +This patch adds microphone detection for the Acer 315-24p, after which a microphone appears on the device and starts working + +Signed-off-by: end.to.start +Link: https://msgid.link/r/20240408152454.45532-1-end.to.start@mail.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 69c68d8e7a6b5..1760b5d42460a 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -430,6 +430,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "MRID6"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "MDC"), ++ DMI_MATCH(DMI_BOARD_NAME, "Herbag_MDU"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/asoc-cs35l41-update-dsp1rx5-6-sources-for-dsp-config.patch b/queue-6.6/asoc-cs35l41-update-dsp1rx5-6-sources-for-dsp-config.patch new file mode 100644 index 00000000000..43a9a481c28 --- /dev/null +++ b/queue-6.6/asoc-cs35l41-update-dsp1rx5-6-sources-for-dsp-config.patch @@ -0,0 +1,77 @@ +From 4e866f1b1615c25b8713102c5cf18582f86e622b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 15:26:48 +0100 +Subject: ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config + +From: Stefan Binding + +[ Upstream commit eefb831d2e4dd58d58002a2ef75ff989e073230d ] + +Currently, all ASoC systems are set to use VPMON for DSP1RX5_SRC, +however, this is required only for internal boost systems. +External boost systems require VBSTMON instead of VPMON to be the +input to DSP1RX5_SRC. +Shared Boost Active acts like Internal boost (requires VPMON). +Shared Boost Passive acts like External boost (requires VBSTMON) +All systems require DSP1RX6_SRC to be set to VBSTMON. + +Signed-off-by: Stefan Binding +Reviewed-by: Richard Fitzgerald +Link: https://msgid.link/r/20240411142648.650921-1-sbinding@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l41.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/cs35l41.c b/sound/soc/codecs/cs35l41.c +index 5456e6bfa242f..bc541293089f0 100644 +--- a/sound/soc/codecs/cs35l41.c ++++ b/sound/soc/codecs/cs35l41.c +@@ -1095,6 +1095,7 @@ static int cs35l41_handle_pdata(struct device *dev, struct cs35l41_hw_cfg *hw_cf + static int cs35l41_dsp_init(struct cs35l41_private *cs35l41) + { + struct wm_adsp *dsp; ++ uint32_t dsp1rx5_src; + int ret; + + dsp = &cs35l41->dsp; +@@ -1114,16 +1115,29 @@ static int cs35l41_dsp_init(struct cs35l41_private *cs35l41) + return ret; + } + +- ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX5_SRC, +- CS35L41_INPUT_SRC_VPMON); ++ switch (cs35l41->hw_cfg.bst_type) { ++ case CS35L41_INT_BOOST: ++ case CS35L41_SHD_BOOST_ACTV: ++ dsp1rx5_src = CS35L41_INPUT_SRC_VPMON; ++ break; ++ case CS35L41_EXT_BOOST: ++ case CS35L41_SHD_BOOST_PASS: ++ dsp1rx5_src = CS35L41_INPUT_SRC_VBSTMON; ++ break; ++ default: ++ dev_err(cs35l41->dev, "wm_halo_init failed - Invalid Boost Type: %d\n", ++ cs35l41->hw_cfg.bst_type); ++ goto err_dsp; ++ } ++ ++ ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX5_SRC, dsp1rx5_src); + if (ret < 0) { +- dev_err(cs35l41->dev, "Write INPUT_SRC_VPMON failed: %d\n", ret); ++ dev_err(cs35l41->dev, "Write DSP1RX5_SRC: %d failed: %d\n", dsp1rx5_src, ret); + goto err_dsp; + } +- ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX6_SRC, +- CS35L41_INPUT_SRC_CLASSH); ++ ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX6_SRC, CS35L41_INPUT_SRC_VBSTMON); + if (ret < 0) { +- dev_err(cs35l41->dev, "Write INPUT_SRC_CLASSH failed: %d\n", ret); ++ dev_err(cs35l41->dev, "Write CS35L41_INPUT_SRC_VBSTMON failed: %d\n", ret); + goto err_dsp; + } + ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX7_SRC, +-- +2.43.0 + diff --git a/queue-6.6/asoc-da7219-aad-fix-usage-of-device_get_named_child_.patch b/queue-6.6/asoc-da7219-aad-fix-usage-of-device_get_named_child_.patch new file mode 100644 index 00000000000..1430097cda1 --- /dev/null +++ b/queue-6.6/asoc-da7219-aad-fix-usage-of-device_get_named_child_.patch @@ -0,0 +1,55 @@ +From 800b6d0c3bf00849d798db0d04ffc8e4c470e9b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 10:30:33 -0500 +Subject: ASoC: da7219-aad: fix usage of device_get_named_child_node() + +From: Pierre-Louis Bossart + +[ Upstream commit e8a6a5ad73acbafd98e8fd3f0cbf6e379771bb76 ] + +The documentation for device_get_named_child_node() mentions this +important point: + +" +The caller is responsible for calling fwnode_handle_put() on the +returned fwnode pointer. +" + +Add fwnode_handle_put() to avoid a leaked reference. + +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20240426153033.38500-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index 8537c96307a97..9b0c470181706 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -671,8 +671,10 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev) + return NULL; + + aad_pdata = devm_kzalloc(dev, sizeof(*aad_pdata), GFP_KERNEL); +- if (!aad_pdata) ++ if (!aad_pdata) { ++ fwnode_handle_put(aad_np); + return NULL; ++ } + + aad_pdata->irq = i2c->irq; + +@@ -753,6 +755,8 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev) + else + aad_pdata->adc_1bit_rpt = DA7219_AAD_ADC_1BIT_RPT_1; + ++ fwnode_handle_put(aad_np); ++ + return aad_pdata; + } + +-- +2.43.0 + diff --git a/queue-6.6/asoc-dt-bindings-rt5645-add-cbj-sleeve-gpio-property.patch b/queue-6.6/asoc-dt-bindings-rt5645-add-cbj-sleeve-gpio-property.patch new file mode 100644 index 00000000000..d092c7af5f9 --- /dev/null +++ b/queue-6.6/asoc-dt-bindings-rt5645-add-cbj-sleeve-gpio-property.patch @@ -0,0 +1,48 @@ +From 0cd751725f376f17710b9415f43fdcf24a2ec4ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 17:10:57 +0800 +Subject: ASoC: dt-bindings: rt5645: add cbj sleeve gpio property + +From: Derek Fang + +[ Upstream commit 306b38e3fa727d22454a148a364123709e356600 ] + +Add an optional gpio property to control external CBJ circuits +to avoid some electric noise caused by sleeve/ring2 contacts floating. + +Signed-off-by: Derek Fang + +Link: https://msgid.link/r/20240408091057.14165-2-derek.fang@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/sound/rt5645.txt | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/Documentation/devicetree/bindings/sound/rt5645.txt b/Documentation/devicetree/bindings/sound/rt5645.txt +index 41a62fd2ae1ff..c1fa379f5f3ea 100644 +--- a/Documentation/devicetree/bindings/sound/rt5645.txt ++++ b/Documentation/devicetree/bindings/sound/rt5645.txt +@@ -20,6 +20,11 @@ Optional properties: + a GPIO spec for the external headphone detect pin. If jd-mode = 0, + we will get the JD status by getting the value of hp-detect-gpios. + ++- cbj-sleeve-gpios: ++ a GPIO spec to control the external combo jack circuit to tie the sleeve/ring2 ++ contacts to the ground or floating. It could avoid some electric noise from the ++ active speaker jacks. ++ + - realtek,in2-differential + Boolean. Indicate MIC2 input are differential, rather than single-ended. + +@@ -68,6 +73,7 @@ codec: rt5650@1a { + compatible = "realtek,rt5650"; + reg = <0x1a>; + hp-detect-gpios = <&gpio 19 0>; ++ cbj-sleeve-gpios = <&gpio 20 0>; + interrupt-parent = <&gpio>; + interrupts = <7 IRQ_TYPE_EDGE_FALLING>; + realtek,dmic-en = "true"; +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-avs-fix-asrc-module-initialization.patch b/queue-6.6/asoc-intel-avs-fix-asrc-module-initialization.patch new file mode 100644 index 00000000000..9cabbbd19ba --- /dev/null +++ b/queue-6.6/asoc-intel-avs-fix-asrc-module-initialization.patch @@ -0,0 +1,36 @@ +From f87f9e94dc892795b1fb7ebc4f6dc927184973af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 11:09:21 +0200 +Subject: ASoC: Intel: avs: Fix ASRC module initialization + +From: Cezary Rojewski + +[ Upstream commit 9d2e26f31c7cc3fa495c423af9b4902ec0dc7be3 ] + +The ASRC module configuration consists of several reserved fields. Zero +them out when initializing the module to avoid sending invalid data. + +Fixes: 274d79e51875 ("ASoC: Intel: avs: Configure modules according to their type") +Signed-off-by: Cezary Rojewski +Link: https://msgid.link/r/20240405090929.1184068-6-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/path.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/intel/avs/path.c b/sound/soc/intel/avs/path.c +index adbe23a47847b..a4b9e209f2230 100644 +--- a/sound/soc/intel/avs/path.c ++++ b/sound/soc/intel/avs/path.c +@@ -368,6 +368,7 @@ static int avs_asrc_create(struct avs_dev *adev, struct avs_path_module *mod) + struct avs_tplg_module *t = mod->template; + struct avs_asrc_cfg cfg; + ++ memset(&cfg, 0, sizeof(cfg)); + cfg.base.cpc = t->cfg_base->cpc; + cfg.base.ibs = t->cfg_base->ibs; + cfg.base.obs = t->cfg_base->obs; +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-avs-fix-potential-integer-overflow.patch b/queue-6.6/asoc-intel-avs-fix-potential-integer-overflow.patch new file mode 100644 index 00000000000..112ca49a281 --- /dev/null +++ b/queue-6.6/asoc-intel-avs-fix-potential-integer-overflow.patch @@ -0,0 +1,41 @@ +From a4c4e07617039d35dca8e4b33804ec5f0e7800b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 11:09:23 +0200 +Subject: ASoC: Intel: avs: Fix potential integer overflow + +From: Cezary Rojewski + +[ Upstream commit c7e832cabe635df47c2bf6df7801e97bf3045b1e ] + +While stream_tag for CLDMA on SKL-based platforms is always 1, function +hda_cldma_setup() uses AZX_SD_CTL_STRM() macro which does: + stream_tag << 20 + +what combined with stream_tag type of 'unsigned int' generates a +potential overflow issue. Update the field type to fix that. + +Fixes: 45864e49a05a ("ASoC: Intel: avs: Implement CLDMA transfer") +Signed-off-by: Cezary Rojewski +Link: https://msgid.link/r/20240405090929.1184068-8-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/cldma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/avs/cldma.c b/sound/soc/intel/avs/cldma.c +index d7a9390b5e483..585579840b646 100644 +--- a/sound/soc/intel/avs/cldma.c ++++ b/sound/soc/intel/avs/cldma.c +@@ -35,7 +35,7 @@ struct hda_cldma { + + unsigned int buffer_size; + unsigned int num_periods; +- unsigned int stream_tag; ++ unsigned char stream_tag; + void __iomem *sd_addr; + + struct snd_dma_buffer dmab_data; +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-avs-ssm4567-do-not-ignore-route-checks.patch b/queue-6.6/asoc-intel-avs-ssm4567-do-not-ignore-route-checks.patch new file mode 100644 index 00000000000..23545d7b3c4 --- /dev/null +++ b/queue-6.6/asoc-intel-avs-ssm4567-do-not-ignore-route-checks.patch @@ -0,0 +1,36 @@ +From 16edc681706eaf48e08661a609b5c394ef36bf20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 10:05:00 +0100 +Subject: ASoC: Intel: avs: ssm4567: Do not ignore route checks + +From: Cezary Rojewski + +[ Upstream commit e6719d48ba6329536c459dcee5a571e535687094 ] + +A copy-paste from intel/boards/skl_nau88l25_ssm4567.c made the avs's +equivalent disable route checks as well. Such behavior is not desired. + +Fixes: 69ea14efe99b ("ASoC: Intel: avs: Add ssm4567 machine board") +Signed-off-by: Cezary Rojewski +Link: https://msgid.link/r/20240308090502.2136760-4-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/boards/ssm4567.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/intel/avs/boards/ssm4567.c b/sound/soc/intel/avs/boards/ssm4567.c +index 7324869d61327..7db1b89b0d9e9 100644 +--- a/sound/soc/intel/avs/boards/ssm4567.c ++++ b/sound/soc/intel/avs/boards/ssm4567.c +@@ -166,7 +166,6 @@ static int avs_ssm4567_probe(struct platform_device *pdev) + card->dapm_routes = card_base_routes; + card->num_dapm_routes = ARRAY_SIZE(card_base_routes); + card->fully_routed = true; +- card->disable_route_checks = true; + + ret = snd_soc_fixup_dai_links_platform_name(card, pname); + if (ret) +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-avs-test-result-of-avs_get_module_entry.patch b/queue-6.6/asoc-intel-avs-test-result-of-avs_get_module_entry.patch new file mode 100644 index 00000000000..f05c1f792e7 --- /dev/null +++ b/queue-6.6/asoc-intel-avs-test-result-of-avs_get_module_entry.patch @@ -0,0 +1,59 @@ +From 624945a690795993f15eaff5b5301a53d77fa349 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 11:09:24 +0200 +Subject: ASoC: Intel: avs: Test result of avs_get_module_entry() + +From: Cezary Rojewski + +[ Upstream commit 41bf4525fadb3d8df3860420d6ac9025c51a3bac ] + +While PROBE_MOD_UUID is always part of the base AudioDSP firmware +manifest, from maintenance point of view it is better to check the +result. + +Fixes: dab8d000e25c ("ASoC: Intel: avs: Add data probing requests") +Signed-off-by: Cezary Rojewski +Link: https://msgid.link/r/20240405090929.1184068-9-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/probes.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/avs/probes.c b/sound/soc/intel/avs/probes.c +index 4cab8c6c45766..341773ec49072 100644 +--- a/sound/soc/intel/avs/probes.c ++++ b/sound/soc/intel/avs/probes.c +@@ -19,8 +19,11 @@ static int avs_dsp_init_probe(struct avs_dev *adev, union avs_connector_node_id + struct avs_probe_cfg cfg = {{0}}; + struct avs_module_entry mentry; + u8 dummy; ++ int ret; + +- avs_get_module_entry(adev, &AVS_PROBE_MOD_UUID, &mentry); ++ ret = avs_get_module_entry(adev, &AVS_PROBE_MOD_UUID, &mentry); ++ if (ret) ++ return ret; + + /* + * Probe module uses no cycles, audio data format and input and output +@@ -39,11 +42,12 @@ static int avs_dsp_init_probe(struct avs_dev *adev, union avs_connector_node_id + static void avs_dsp_delete_probe(struct avs_dev *adev) + { + struct avs_module_entry mentry; ++ int ret; + +- avs_get_module_entry(adev, &AVS_PROBE_MOD_UUID, &mentry); +- +- /* There is only ever one probe module instance. */ +- avs_dsp_delete_module(adev, mentry.module_id, 0, INVALID_PIPELINE_ID, 0); ++ ret = avs_get_module_entry(adev, &AVS_PROBE_MOD_UUID, &mentry); ++ if (!ret) ++ /* There is only ever one probe module instance. */ ++ avs_dsp_delete_module(adev, mentry.module_id, 0, INVALID_PIPELINE_ID, 0); + } + + static inline struct hdac_ext_stream *avs_compr_get_host_stream(struct snd_compr_stream *cstream) +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-bytcr_rt5640-apply-asus-t100ta-quirk-to-a.patch b/queue-6.6/asoc-intel-bytcr_rt5640-apply-asus-t100ta-quirk-to-a.patch new file mode 100644 index 00000000000..96bdbe34192 --- /dev/null +++ b/queue-6.6/asoc-intel-bytcr_rt5640-apply-asus-t100ta-quirk-to-a.patch @@ -0,0 +1,71 @@ +From 4b70acbee4ed6c65e829bc7e7e798b5a1e5ac0bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Apr 2024 21:15:59 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM + too + +From: Hans de Goede + +[ Upstream commit e50729d742ec364895f1c389c32315984a987aa5 ] + +The Asus T100TA quirk has been using an exact match on a product-name of +"T100TA" but there are also T100TAM variants with a slightly higher +clocked CPU and a metal backside which need the same quirk. + +Sort the existing T100TA (stereo speakers) below the more specific +T100TAF (mono speaker) quirk and switch from exact matching to +substring matching so that the T100TA quirk will also match on +the T100TAM models. + +Signed-off-by: Hans de Goede +Link: https://msgid.link/r/20240407191559.21596-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index e609249cc38d5..651408c6f399d 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -636,28 +636,30 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_USE_AMCR0F28), + }, + { ++ /* Asus T100TAF, unlike other T100TA* models this one has a mono speaker */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TAF"), + }, + .driver_data = (void *)(BYT_RT5640_IN1_MAP | + BYT_RT5640_JD_SRC_JD2_IN4N | + BYT_RT5640_OVCD_TH_2000UA | + BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF2 | + BYT_RT5640_MCLK_EN), + }, + { ++ /* Asus T100TA and T100TAM, must come after T100TAF (mono spk) match */ + .matches = { +- DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TAF"), ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "T100TA"), + }, + .driver_data = (void *)(BYT_RT5640_IN1_MAP | + BYT_RT5640_JD_SRC_JD2_IN4N | + BYT_RT5640_OVCD_TH_2000UA | + BYT_RT5640_OVCD_SF_0P75 | +- BYT_RT5640_MONO_SPEAKER | +- BYT_RT5640_DIFF_MIC | +- BYT_RT5640_SSP0_AIF2 | + BYT_RT5640_MCLK_EN), + }, + { +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-common-add-acpi-matching-tables-for-arrow.patch b/queue-6.6/asoc-intel-common-add-acpi-matching-tables-for-arrow.patch new file mode 100644 index 00000000000..531f486438c --- /dev/null +++ b/queue-6.6/asoc-intel-common-add-acpi-matching-tables-for-arrow.patch @@ -0,0 +1,119 @@ +From ff7296e7c5de4f5a1917fab0c002e52d8cf05597 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Sep 2023 16:06:35 +0800 +Subject: ASoC: Intel: common: add ACPI matching tables for Arrow Lake + +From: Arun T + +[ Upstream commit 24af0d7c0f9f49a243b77e607e3f4a4737386b59 ] + +Initial support for ARL w/ RT711 + +Signed-off-by: Arun T +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20230915080635.1619942-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Stable-dep-of: 1f1b820dc3c6 ("ASoC: SOF: Intel: mtl: Correct rom_status_reg") +Signed-off-by: Sasha Levin +--- + include/sound/soc-acpi-intel-match.h | 2 + + sound/soc/intel/common/Makefile | 1 + + .../intel/common/soc-acpi-intel-arl-match.c | 51 +++++++++++++++++++ + 3 files changed, 54 insertions(+) + create mode 100644 sound/soc/intel/common/soc-acpi-intel-arl-match.c + +diff --git a/include/sound/soc-acpi-intel-match.h b/include/sound/soc-acpi-intel-match.h +index e49b97d9e3ff2..845e7608ac375 100644 +--- a/include/sound/soc-acpi-intel-match.h ++++ b/include/sound/soc-acpi-intel-match.h +@@ -32,6 +32,7 @@ extern struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_lnl_machines[]; ++extern struct snd_soc_acpi_mach snd_soc_acpi_intel_arl_machines[]; + + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_cnl_sdw_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_cfl_sdw_machines[]; +@@ -42,6 +43,7 @@ extern struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_sdw_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_sdw_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_sdw_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_lnl_sdw_machines[]; ++extern struct snd_soc_acpi_mach snd_soc_acpi_intel_arl_sdw_machines[]; + + /* + * generic table used for HDA codec-based platforms, possibly with +diff --git a/sound/soc/intel/common/Makefile b/sound/soc/intel/common/Makefile +index 07aa37dd90e99..f7370e5b4e9e4 100644 +--- a/sound/soc/intel/common/Makefile ++++ b/sound/soc/intel/common/Makefile +@@ -10,6 +10,7 @@ snd-soc-acpi-intel-match-objs := soc-acpi-intel-byt-match.o soc-acpi-intel-cht-m + soc-acpi-intel-tgl-match.o soc-acpi-intel-ehl-match.o \ + soc-acpi-intel-jsl-match.o soc-acpi-intel-adl-match.o \ + soc-acpi-intel-rpl-match.o soc-acpi-intel-mtl-match.o \ ++ soc-acpi-intel-arl-match.o \ + soc-acpi-intel-lnl-match.o \ + soc-acpi-intel-hda-match.o \ + soc-acpi-intel-sdw-mockup-match.o +diff --git a/sound/soc/intel/common/soc-acpi-intel-arl-match.c b/sound/soc/intel/common/soc-acpi-intel-arl-match.c +new file mode 100644 +index 0000000000000..e52797aae6e65 +--- /dev/null ++++ b/sound/soc/intel/common/soc-acpi-intel-arl-match.c +@@ -0,0 +1,51 @@ ++// SPDX-License-Identifier: GPL-2.0-only ++/* ++ * soc-apci-intel-arl-match.c - tables and support for ARL ACPI enumeration. ++ * ++ * Copyright (c) 2023 Intel Corporation. ++ */ ++ ++#include ++#include ++ ++static const struct snd_soc_acpi_endpoint single_endpoint = { ++ .num = 0, ++ .aggregated = 0, ++ .group_position = 0, ++ .group_id = 0, ++}; ++ ++static const struct snd_soc_acpi_adr_device rt711_0_adr[] = { ++ { ++ .adr = 0x000020025D071100ull, ++ .num_endpoints = 1, ++ .endpoints = &single_endpoint, ++ .name_prefix = "rt711" ++ } ++}; ++ ++static const struct snd_soc_acpi_link_adr arl_rvp[] = { ++ { ++ .mask = BIT(0), ++ .num_adr = ARRAY_SIZE(rt711_0_adr), ++ .adr_d = rt711_0_adr, ++ }, ++ {} ++}; ++ ++struct snd_soc_acpi_mach snd_soc_acpi_intel_arl_machines[] = { ++ {}, ++}; ++EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_arl_machines); ++ ++/* this table is used when there is no I2S codec present */ ++struct snd_soc_acpi_mach snd_soc_acpi_intel_arl_sdw_machines[] = { ++ { ++ .link_mask = 0x1, /* link0 required */ ++ .links = arl_rvp, ++ .drv_name = "sof_sdw", ++ .sof_tplg_filename = "sof-arl-rt711.tplg", ++ }, ++ {}, ++}; ++EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_arl_sdw_machines); +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-disable-route-checks-for-skylake-boards.patch b/queue-6.6/asoc-intel-disable-route-checks-for-skylake-boards.patch new file mode 100644 index 00000000000..44de713735d --- /dev/null +++ b/queue-6.6/asoc-intel-disable-route-checks-for-skylake-boards.patch @@ -0,0 +1,209 @@ +From 3bac9043cd5e0be99aadce838fa2efef36918f12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 10:04:58 +0100 +Subject: ASoC: Intel: Disable route checks for Skylake boards + +From: Cezary Rojewski + +[ Upstream commit 0cb3b7fd530b8c107443218ce6db5cb6e7b5dbe1 ] + +Topology files that are propagated to the world and utilized by the +skylake-driver carry shortcomings in their SectionGraphs. + +Since commit daa480bde6b3 ("ASoC: soc-core: tidyup for +snd_soc_dapm_add_routes()") route checks are no longer permissive. Probe +failures for Intel boards have been partially addressed by commit +a22ae72b86a4 ("ASoC: soc-core: disable route checks for legacy devices") +and its follow up but only skl_nau88l25_ssm4567.c is patched. Fix the +problem for the rest of the boards. + +Link: https://lore.kernel.org/all/20200309192744.18380-1-pierre-louis.bossart@linux.intel.com/ +Fixes: daa480bde6b3 ("ASoC: soc-core: tidyup for snd_soc_dapm_add_routes()") +Signed-off-by: Cezary Rojewski +Link: https://msgid.link/r/20240308090502.2136760-2-cezary.rojewski@intel.com +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bxt_da7219_max98357a.c | 1 + + sound/soc/intel/boards/bxt_rt298.c | 1 + + sound/soc/intel/boards/glk_rt5682_max98357a.c | 2 ++ + sound/soc/intel/boards/kbl_da7219_max98357a.c | 1 + + sound/soc/intel/boards/kbl_da7219_max98927.c | 4 ++++ + sound/soc/intel/boards/kbl_rt5660.c | 1 + + sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 ++ + sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 1 + + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 ++ + sound/soc/intel/boards/skl_nau88l25_max98357a.c | 1 + + sound/soc/intel/boards/skl_rt286.c | 1 + + 11 files changed, 17 insertions(+) + +diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c +index cbfff466c5c86..b6e6601b30c21 100644 +--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c ++++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c +@@ -768,6 +768,7 @@ static struct snd_soc_card broxton_audio_card = { + .dapm_routes = audio_map, + .num_dapm_routes = ARRAY_SIZE(audio_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = bxt_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c +index bf89fe80423d0..4275c40e8114d 100644 +--- a/sound/soc/intel/boards/bxt_rt298.c ++++ b/sound/soc/intel/boards/bxt_rt298.c +@@ -574,6 +574,7 @@ static struct snd_soc_card broxton_rt298 = { + .dapm_routes = broxton_rt298_map, + .num_dapm_routes = ARRAY_SIZE(broxton_rt298_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = bxt_card_late_probe, + + }; +diff --git a/sound/soc/intel/boards/glk_rt5682_max98357a.c b/sound/soc/intel/boards/glk_rt5682_max98357a.c +index cf0f89db3e204..0f9bbb970b230 100644 +--- a/sound/soc/intel/boards/glk_rt5682_max98357a.c ++++ b/sound/soc/intel/boards/glk_rt5682_max98357a.c +@@ -649,6 +649,8 @@ static int geminilake_audio_probe(struct platform_device *pdev) + card = &glk_audio_card_rt5682_m98357a; + card->dev = &pdev->dev; + snd_soc_card_set_drvdata(card, ctx); ++ if (!snd_soc_acpi_sof_parent(&pdev->dev)) ++ card->disable_route_checks = true; + + /* override platform name, if required */ + mach = pdev->dev.platform_data; +diff --git a/sound/soc/intel/boards/kbl_da7219_max98357a.c b/sound/soc/intel/boards/kbl_da7219_max98357a.c +index 97149513076f9..a7868e5735bcb 100644 +--- a/sound/soc/intel/boards/kbl_da7219_max98357a.c ++++ b/sound/soc/intel/boards/kbl_da7219_max98357a.c +@@ -639,6 +639,7 @@ static struct snd_soc_card kabylake_audio_card_da7219_m98357a = { + .dapm_routes = kabylake_map, + .num_dapm_routes = ARRAY_SIZE(kabylake_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/kbl_da7219_max98927.c b/sound/soc/intel/boards/kbl_da7219_max98927.c +index a1f8234c77bd2..2e75070eb9216 100644 +--- a/sound/soc/intel/boards/kbl_da7219_max98927.c ++++ b/sound/soc/intel/boards/kbl_da7219_max98927.c +@@ -1036,6 +1036,7 @@ static struct snd_soc_card kbl_audio_card_da7219_m98927 = { + .codec_conf = max98927_codec_conf, + .num_configs = ARRAY_SIZE(max98927_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +@@ -1054,6 +1055,7 @@ static struct snd_soc_card kbl_audio_card_max98927 = { + .codec_conf = max98927_codec_conf, + .num_configs = ARRAY_SIZE(max98927_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +@@ -1071,6 +1073,7 @@ static struct snd_soc_card kbl_audio_card_da7219_m98373 = { + .codec_conf = max98373_codec_conf, + .num_configs = ARRAY_SIZE(max98373_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +@@ -1088,6 +1091,7 @@ static struct snd_soc_card kbl_audio_card_max98373 = { + .codec_conf = max98373_codec_conf, + .num_configs = ARRAY_SIZE(max98373_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/kbl_rt5660.c b/sound/soc/intel/boards/kbl_rt5660.c +index 2c7a547f63c90..358d606228121 100644 +--- a/sound/soc/intel/boards/kbl_rt5660.c ++++ b/sound/soc/intel/boards/kbl_rt5660.c +@@ -518,6 +518,7 @@ static struct snd_soc_card kabylake_audio_card_rt5660 = { + .dapm_routes = kabylake_rt5660_map, + .num_dapm_routes = ARRAY_SIZE(kabylake_rt5660_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/kbl_rt5663_max98927.c b/sound/soc/intel/boards/kbl_rt5663_max98927.c +index 2d4224c5b1520..d110ebd10bca2 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_max98927.c +@@ -966,6 +966,7 @@ static struct snd_soc_card kabylake_audio_card_rt5663_m98927 = { + .codec_conf = max98927_codec_conf, + .num_configs = ARRAY_SIZE(max98927_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +@@ -982,6 +983,7 @@ static struct snd_soc_card kabylake_audio_card_rt5663 = { + .dapm_routes = kabylake_5663_map, + .num_dapm_routes = ARRAY_SIZE(kabylake_5663_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index 2c79fca57b19e..a15d2c30b6c46 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -791,6 +791,7 @@ static struct snd_soc_card kabylake_audio_card = { + .codec_conf = max98927_codec_conf, + .num_configs = ARRAY_SIZE(max98927_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c +index 70c806cc5b2ee..da6079c61f88d 100644 +--- a/sound/soc/intel/boards/skl_hda_dsp_generic.c ++++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c +@@ -227,6 +227,8 @@ static int skl_hda_audio_probe(struct platform_device *pdev) + ctx->common_hdmi_codec_drv = mach->mach_params.common_hdmi_codec_drv; + + hda_soc_card.dev = &pdev->dev; ++ if (!snd_soc_acpi_sof_parent(&pdev->dev)) ++ hda_soc_card.disable_route_checks = true; + + if (mach->mach_params.dmic_num > 0) { + snprintf(hda_soc_components, sizeof(hda_soc_components), +diff --git a/sound/soc/intel/boards/skl_nau88l25_max98357a.c b/sound/soc/intel/boards/skl_nau88l25_max98357a.c +index e13a5a4d8f7e9..2d424e3e2abd8 100644 +--- a/sound/soc/intel/boards/skl_nau88l25_max98357a.c ++++ b/sound/soc/intel/boards/skl_nau88l25_max98357a.c +@@ -654,6 +654,7 @@ static struct snd_soc_card skylake_audio_card = { + .dapm_routes = skylake_map, + .num_dapm_routes = ARRAY_SIZE(skylake_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = skylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/skl_rt286.c b/sound/soc/intel/boards/skl_rt286.c +index 4f3d655e2bfa8..0a4795a94a768 100644 +--- a/sound/soc/intel/boards/skl_rt286.c ++++ b/sound/soc/intel/boards/skl_rt286.c +@@ -523,6 +523,7 @@ static struct snd_soc_card skylake_rt286 = { + .dapm_routes = skylake_rt286_map, + .num_dapm_routes = ARRAY_SIZE(skylake_rt286_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = skylake_card_late_probe, + }; + +-- +2.43.0 + diff --git a/queue-6.6/asoc-kirkwood-fix-potential-null-dereference.patch b/queue-6.6/asoc-kirkwood-fix-potential-null-dereference.patch new file mode 100644 index 00000000000..d435ec83fec --- /dev/null +++ b/queue-6.6/asoc-kirkwood-fix-potential-null-dereference.patch @@ -0,0 +1,41 @@ +From 326ffcd94e50990be24aa889c7e89589dbe9770b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 20:33:37 +0300 +Subject: ASoC: kirkwood: Fix potential NULL dereference + +From: Aleksandr Mishin + +[ Upstream commit ea60ab95723f5738e7737b56dda95e6feefa5b50 ] + +In kirkwood_dma_hw_params() mv_mbus_dram_info() returns NULL if +CONFIG_PLAT_ORION macro is not defined. +Fix this bug by adding NULL check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bb6a40fc5a83 ("ASoC: kirkwood: Fix reference to PCM buffer address") +Signed-off-by: Aleksandr Mishin +Link: https://msgid.link/r/20240328173337.21406-1-amishin@t-argos.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/kirkwood/kirkwood-dma.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c +index 640cebd2983e2..16d2c9acc33a6 100644 +--- a/sound/soc/kirkwood/kirkwood-dma.c ++++ b/sound/soc/kirkwood/kirkwood-dma.c +@@ -182,6 +182,9 @@ static int kirkwood_dma_hw_params(struct snd_soc_component *component, + const struct mbus_dram_target_info *dram = mv_mbus_dram_info(); + unsigned long addr = substream->runtime->dma_addr; + ++ if (!dram) ++ return 0; ++ + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) + kirkwood_dma_conf_mbus_windows(priv->io, + KIRKWOOD_PLAYBACK_WIN, addr, dram); +-- +2.43.0 + diff --git a/queue-6.6/asoc-mediatek-assign-dummy-when-codec-not-specified-.patch b/queue-6.6/asoc-mediatek-assign-dummy-when-codec-not-specified-.patch new file mode 100644 index 00000000000..3278d71a2df --- /dev/null +++ b/queue-6.6/asoc-mediatek-assign-dummy-when-codec-not-specified-.patch @@ -0,0 +1,45 @@ +From bc1be03ad8a2e3ceabbcc10d7f20f01410b991cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 12:01:29 +0100 +Subject: ASoC: mediatek: Assign dummy when codec not specified for a DAI link + +From: AngeloGioacchino Del Regno + +[ Upstream commit 5f39231888c63f0a7708abc86b51b847476379d8 ] + +MediaTek sound card drivers are checking whether a DAI link is present +and used on a board to assign the correct parameters and this is done +by checking the codec DAI names at probe time. + +If no real codec is present, assign the dummy codec to the DAI link +to avoid NULL pointer during string comparison. + +Fixes: 4302187d955f ("ASoC: mediatek: common: add soundcard driver common code") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://msgid.link/r/20240313110147.1267793-5-angelogioacchino.delregno@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/common/mtk-soundcard-driver.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/mediatek/common/mtk-soundcard-driver.c b/sound/soc/mediatek/common/mtk-soundcard-driver.c +index a58e1e3674dec..000a086a8cf44 100644 +--- a/sound/soc/mediatek/common/mtk-soundcard-driver.c ++++ b/sound/soc/mediatek/common/mtk-soundcard-driver.c +@@ -22,7 +22,11 @@ static int set_card_codec_info(struct snd_soc_card *card, + + codec_node = of_get_child_by_name(sub_node, "codec"); + if (!codec_node) { +- dev_dbg(dev, "%s no specified codec\n", dai_link->name); ++ dev_dbg(dev, "%s no specified codec: setting dummy.\n", dai_link->name); ++ ++ dai_link->codecs = &snd_soc_dummy_dlc; ++ dai_link->num_codecs = 1; ++ dai_link->dynamic = 1; + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt5645-fix-the-electric-noise-due-to-the-cbj-co.patch b/queue-6.6/asoc-rt5645-fix-the-electric-noise-due-to-the-cbj-co.patch new file mode 100644 index 00000000000..2785bb25b03 --- /dev/null +++ b/queue-6.6/asoc-rt5645-fix-the-electric-noise-due-to-the-cbj-co.patch @@ -0,0 +1,105 @@ +From 8565fbb4bfb3030972eaf8db09baf49db1c4a449 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 17:10:56 +0800 +Subject: ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating + +From: Derek Fang + +[ Upstream commit 103abab975087e1f01b76fcb54c91dbb65dbc249 ] + +The codec leaves tie combo jack's sleeve/ring2 to floating status +default. It would cause electric noise while connecting the active +speaker jack during boot or shutdown. +This patch requests a gpio to control the additional jack circuit +to tie the contacts to the ground or floating. + +Signed-off-by: Derek Fang + +Link: https://msgid.link/r/20240408091057.14165-1-derek.fang@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index e0da151508309..b69f6afa0ae40 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -441,6 +441,7 @@ struct rt5645_priv { + struct regmap *regmap; + struct i2c_client *i2c; + struct gpio_desc *gpiod_hp_det; ++ struct gpio_desc *gpiod_cbj_sleeve; + struct snd_soc_jack *hp_jack; + struct snd_soc_jack *mic_jack; + struct snd_soc_jack *btn_jack; +@@ -3183,6 +3184,9 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + regmap_update_bits(rt5645->regmap, RT5645_IN1_CTRL2, + RT5645_CBJ_MN_JD, 0); + ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 1); ++ + msleep(600); + regmap_read(rt5645->regmap, RT5645_IN1_CTRL3, &val); + val &= 0x7; +@@ -3199,6 +3203,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + snd_soc_dapm_disable_pin(dapm, "Mic Det Power"); + snd_soc_dapm_sync(dapm); + rt5645->jack_type = SND_JACK_HEADPHONE; ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0); + } + if (rt5645->pdata.level_trigger_irq) + regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2, +@@ -3226,6 +3232,9 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + if (rt5645->pdata.level_trigger_irq) + regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2, + RT5645_JD_1_1_MASK, RT5645_JD_1_1_INV); ++ ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0); + } + + return rt5645->jack_type; +@@ -3958,6 +3967,16 @@ static int rt5645_i2c_probe(struct i2c_client *i2c) + return ret; + } + ++ rt5645->gpiod_cbj_sleeve = devm_gpiod_get_optional(&i2c->dev, "cbj-sleeve", ++ GPIOD_OUT_LOW); ++ ++ if (IS_ERR(rt5645->gpiod_cbj_sleeve)) { ++ ret = PTR_ERR(rt5645->gpiod_cbj_sleeve); ++ dev_info(&i2c->dev, "failed to initialize gpiod, ret=%d\n", ret); ++ if (ret != -ENOENT) ++ return ret; ++ } ++ + for (i = 0; i < ARRAY_SIZE(rt5645->supplies); i++) + rt5645->supplies[i].supply = rt5645_supply_names[i]; + +@@ -4205,6 +4224,9 @@ static void rt5645_i2c_remove(struct i2c_client *i2c) + cancel_delayed_work_sync(&rt5645->jack_detect_work); + cancel_delayed_work_sync(&rt5645->rcclock_work); + ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0); ++ + regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies); + } + +@@ -4220,6 +4242,9 @@ static void rt5645_i2c_shutdown(struct i2c_client *i2c) + 0); + msleep(20); + regmap_write(rt5645->regmap, RT5645_RESET, 0); ++ ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0); + } + + static int __maybe_unused rt5645_sys_suspend(struct device *dev) +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt715-add-vendor-clear-control-register.patch b/queue-6.6/asoc-rt715-add-vendor-clear-control-register.patch new file mode 100644 index 00000000000..9781be985e0 --- /dev/null +++ b/queue-6.6/asoc-rt715-add-vendor-clear-control-register.patch @@ -0,0 +1,38 @@ +From 44530bc00fbd9fd762883a3aff0c86d2e4dcb8e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 06:27:23 +0000 +Subject: ASoC: rt715: add vendor clear control register + +From: Jack Yu + +[ Upstream commit cebfbc89ae2552dbb58cd9b8206a5c8e0e6301e9 ] + +Add vendor clear control register in readable register's +callback function. This prevents an access failure reported +in Intel CI tests. + +Signed-off-by: Jack Yu +Closes: https://github.com/thesofproject/linux/issues/4860 +Tested-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/6a103ce9134d49d8b3941172c87a7bd4@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt715-sdw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/rt715-sdw.c b/sound/soc/codecs/rt715-sdw.c +index 21f37babd148a..376585f5a8dd8 100644 +--- a/sound/soc/codecs/rt715-sdw.c ++++ b/sound/soc/codecs/rt715-sdw.c +@@ -111,6 +111,7 @@ static bool rt715_readable_register(struct device *dev, unsigned int reg) + case 0x839d: + case 0x83a7: + case 0x83a9: ++ case 0x752001: + case 0x752039: + return true; + default: +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt715-sdca-volume-step-modification.patch b/queue-6.6/asoc-rt715-sdca-volume-step-modification.patch new file mode 100644 index 00000000000..5ef56d77a81 --- /dev/null +++ b/queue-6.6/asoc-rt715-sdca-volume-step-modification.patch @@ -0,0 +1,61 @@ +From d683a24c061a025fb14f51ef75556b56de3c6bf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 06:59:35 +0000 +Subject: ASoC: rt715-sdca: volume step modification + +From: Jack Yu + +[ Upstream commit bda16500dd0b05e2e047093b36cbe0873c95aeae ] + +Volume step (dB/step) modification to fix format error +which shown in amixer control. + +Signed-off-by: Jack Yu +Link: https://lore.kernel.org/r/b1f546ad16dc4c7abb7daa7396e8345c@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt715-sdca.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/codecs/rt715-sdca.c b/sound/soc/codecs/rt715-sdca.c +index 9fa96fd83d4aa..84f1dc453e971 100644 +--- a/sound/soc/codecs/rt715-sdca.c ++++ b/sound/soc/codecs/rt715-sdca.c +@@ -316,7 +316,7 @@ static int rt715_sdca_set_amp_gain_8ch_get(struct snd_kcontrol *kcontrol, + return 0; + } + +-static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -17625, 375, 0); ++static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -1725, 75, 0); + static const DECLARE_TLV_DB_SCALE(mic_vol_tlv, 0, 1000, 0); + + static int rt715_sdca_get_volsw(struct snd_kcontrol *kcontrol, +@@ -477,7 +477,7 @@ static const struct snd_kcontrol_new rt715_sdca_snd_controls[] = { + RT715_SDCA_FU_VOL_CTRL, CH_01), + SDW_SDCA_CTL(FUN_MIC_ARRAY, RT715_SDCA_FU_ADC7_27_VOL, + RT715_SDCA_FU_VOL_CTRL, CH_02), +- 0x2f, 0x7f, 0, ++ 0x2f, 0x3f, 0, + rt715_sdca_set_amp_gain_get, rt715_sdca_set_amp_gain_put, + in_vol_tlv), + RT715_SDCA_EXT_TLV("FU02 Capture Volume", +@@ -485,13 +485,13 @@ static const struct snd_kcontrol_new rt715_sdca_snd_controls[] = { + RT715_SDCA_FU_VOL_CTRL, CH_01), + rt715_sdca_set_amp_gain_4ch_get, + rt715_sdca_set_amp_gain_4ch_put, +- in_vol_tlv, 4, 0x7f), ++ in_vol_tlv, 4, 0x3f), + RT715_SDCA_EXT_TLV("FU06 Capture Volume", + SDW_SDCA_CTL(FUN_MIC_ARRAY, RT715_SDCA_FU_ADC10_11_VOL, + RT715_SDCA_FU_VOL_CTRL, CH_01), + rt715_sdca_set_amp_gain_4ch_get, + rt715_sdca_set_amp_gain_4ch_put, +- in_vol_tlv, 4, 0x7f), ++ in_vol_tlv, 4, 0x3f), + /* MIC Boost Control */ + RT715_SDCA_BOOST_EXT_TLV("FU0E Boost", + SDW_SDCA_CTL(FUN_MIC_ARRAY, RT715_SDCA_FU_DMIC_GAIN_EN, +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt722-sdca-add-headset-microphone-vrefo-setting.patch b/queue-6.6/asoc-rt722-sdca-add-headset-microphone-vrefo-setting.patch new file mode 100644 index 00000000000..38d3a46dfa2 --- /dev/null +++ b/queue-6.6/asoc-rt722-sdca-add-headset-microphone-vrefo-setting.patch @@ -0,0 +1,96 @@ +From 45b561c10b79e83ba4be0f3b9ff6c31212cc6a96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 06:47:34 +0000 +Subject: ASoC: rt722-sdca: add headset microphone vrefo setting + +From: Jack Yu + +[ Upstream commit 140e0762ca055d1aa84b17847cde5d9e47f56f76 ] + +Add vrefo settings to fix jd and headset mic recording issue. + +Signed-off-by: Jack Yu +Link: https://msgid.link/r/727219ed45d3485ba8f4646700aaa8a8@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt722-sdca.c | 25 +++++++++++++++++++------ + sound/soc/codecs/rt722-sdca.h | 3 +++ + 2 files changed, 22 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/rt722-sdca.c b/sound/soc/codecs/rt722-sdca.c +index 4338cdb3a7917..9ff607984ea19 100644 +--- a/sound/soc/codecs/rt722-sdca.c ++++ b/sound/soc/codecs/rt722-sdca.c +@@ -1438,9 +1438,12 @@ static void rt722_sdca_jack_preset(struct rt722_sdca_priv *rt722) + int loop_check, chk_cnt = 100, ret; + unsigned int calib_status = 0; + +- /* Read eFuse */ +- rt722_sdca_index_write(rt722, RT722_VENDOR_SPK_EFUSE, RT722_DC_CALIB_CTRL, +- 0x4808); ++ /* Config analog bias */ ++ rt722_sdca_index_write(rt722, RT722_VENDOR_REG, RT722_ANALOG_BIAS_CTL3, ++ 0xa081); ++ /* GE related settings */ ++ rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_GE_RELATED_CTL2, ++ 0xa009); + /* Button A, B, C, D bypass mode */ + rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_UMP_HID_CTL4, + 0xcf00); +@@ -1474,9 +1477,6 @@ static void rt722_sdca_jack_preset(struct rt722_sdca_priv *rt722) + if ((calib_status & 0x0040) == 0x0) + break; + } +- /* Release HP-JD, EN_CBJ_TIE_GL/R open, en_osw gating auto done bit */ +- rt722_sdca_index_write(rt722, RT722_VENDOR_REG, RT722_DIGITAL_MISC_CTRL4, +- 0x0010); + /* Set ADC09 power entity floating control */ + rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_ADC0A_08_PDE_FLOAT_CTL, + 0x2a12); +@@ -1489,8 +1489,21 @@ static void rt722_sdca_jack_preset(struct rt722_sdca_priv *rt722) + /* Set DAC03 and HP power entity floating control */ + rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_DAC03_HP_PDE_FLOAT_CTL, + 0x4040); ++ rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_ENT_FLOAT_CTRL_1, ++ 0x4141); ++ rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_FLOAT_CTRL_1, ++ 0x0101); + /* Fine tune PDE40 latency */ + regmap_write(rt722->regmap, 0x2f58, 0x07); ++ regmap_write(rt722->regmap, 0x2f03, 0x06); ++ /* MIC VRefo */ ++ rt722_sdca_index_update_bits(rt722, RT722_VENDOR_REG, ++ RT722_COMBO_JACK_AUTO_CTL1, 0x0200, 0x0200); ++ rt722_sdca_index_update_bits(rt722, RT722_VENDOR_REG, ++ RT722_VREFO_GAT, 0x4000, 0x4000); ++ /* Release HP-JD, EN_CBJ_TIE_GL/R open, en_osw gating auto done bit */ ++ rt722_sdca_index_write(rt722, RT722_VENDOR_REG, RT722_DIGITAL_MISC_CTRL4, ++ 0x0010); + } + + int rt722_sdca_io_init(struct device *dev, struct sdw_slave *slave) +diff --git a/sound/soc/codecs/rt722-sdca.h b/sound/soc/codecs/rt722-sdca.h +index 44af8901352eb..2464361a7958c 100644 +--- a/sound/soc/codecs/rt722-sdca.h ++++ b/sound/soc/codecs/rt722-sdca.h +@@ -69,6 +69,7 @@ struct rt722_sdca_dmic_kctrl_priv { + #define RT722_COMBO_JACK_AUTO_CTL2 0x46 + #define RT722_COMBO_JACK_AUTO_CTL3 0x47 + #define RT722_DIGITAL_MISC_CTRL4 0x4a ++#define RT722_VREFO_GAT 0x63 + #define RT722_FSM_CTL 0x67 + #define RT722_SDCA_INTR_REC 0x82 + #define RT722_SW_CONFIG1 0x8a +@@ -127,6 +128,8 @@ struct rt722_sdca_dmic_kctrl_priv { + #define RT722_UMP_HID_CTL6 0x66 + #define RT722_UMP_HID_CTL7 0x67 + #define RT722_UMP_HID_CTL8 0x68 ++#define RT722_FLOAT_CTRL_1 0x70 ++#define RT722_ENT_FLOAT_CTRL_1 0x76 + + /* Parameter & Verb control 01 (0x1a)(NID:20h) */ + #define RT722_HIDDEN_REG_SW_RESET (0x1 << 14) +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt722-sdca-modify-channel-number-to-support-4-c.patch b/queue-6.6/asoc-rt722-sdca-modify-channel-number-to-support-4-c.patch new file mode 100644 index 00000000000..34c6754bd08 --- /dev/null +++ b/queue-6.6/asoc-rt722-sdca-modify-channel-number-to-support-4-c.patch @@ -0,0 +1,36 @@ +From 6035479dfcffd6d5adf9f359c0933cd11cd0df8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 06:47:43 +0000 +Subject: ASoC: rt722-sdca: modify channel number to support 4 channels + +From: Jack Yu + +[ Upstream commit cb9946971d7cb717b726710e1a9fa4ded00b9135 ] + +Channel numbers of dmic supports 4 channels, modify channels_max +regarding to this issue. + +Signed-off-by: Jack Yu +Link: https://msgid.link/r/6a9b1d1fb2ea4f04b2157799f04053b1@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt722-sdca.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt722-sdca.c b/sound/soc/codecs/rt722-sdca.c +index 0e1c65a20392a..4338cdb3a7917 100644 +--- a/sound/soc/codecs/rt722-sdca.c ++++ b/sound/soc/codecs/rt722-sdca.c +@@ -1329,7 +1329,7 @@ static struct snd_soc_dai_driver rt722_sdca_dai[] = { + .capture = { + .stream_name = "DP6 DMic Capture", + .channels_min = 1, +- .channels_max = 2, ++ .channels_max = 4, + .rates = RT722_STEREO_RATES, + .formats = RT722_FORMATS, + }, +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-intel-lnl-correct-rom_status_reg.patch b/queue-6.6/asoc-sof-intel-lnl-correct-rom_status_reg.patch new file mode 100644 index 00000000000..d77b6e618d9 --- /dev/null +++ b/queue-6.6/asoc-sof-intel-lnl-correct-rom_status_reg.patch @@ -0,0 +1,79 @@ +From 5fbe983eae34360f59ff1dbca5604a4203e94d0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 13:52:06 +0300 +Subject: ASoC: SOF: Intel: lnl: Correct rom_status_reg + +From: Peter Ujfalusi + +[ Upstream commit b852574c671a9983dd51c81582c8c5085f3dc382 ] + +ACE2 architecture changed the place where the ROM updates the status code +from the shared SRAM window (and HFFLGP1QW0 in ACE1) to HFDSC register for +the status and HFDEC (HFDSC + 4) for the error code. + +The rom_status_reg is not used on LNL because it was wrongly assigned based +on older platform convention (SRAM window) and it was giving inconsistent +readings. + +Add new header file for lnl specific register definitions. + +Fixes: 64a63d9914a5 ("ASoC: SOF: Intel: LNL: Add support for Lunarlake platform") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Rander Wang +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Liam Girdwood +Link: https://msgid.link/r/20240403105210.17949-4-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/lnl.c | 3 ++- + sound/soc/sof/intel/lnl.h | 15 +++++++++++++++ + 2 files changed, 17 insertions(+), 1 deletion(-) + create mode 100644 sound/soc/sof/intel/lnl.h + +diff --git a/sound/soc/sof/intel/lnl.c b/sound/soc/sof/intel/lnl.c +index db94b45e53af8..822f857723208 100644 +--- a/sound/soc/sof/intel/lnl.c ++++ b/sound/soc/sof/intel/lnl.c +@@ -16,6 +16,7 @@ + #include "hda-ipc.h" + #include "../sof-audio.h" + #include "mtl.h" ++#include "lnl.h" + #include + + /* LunarLake ops */ +@@ -172,7 +173,7 @@ const struct sof_intel_dsp_desc lnl_chip_info = { + .ipc_ack = MTL_DSP_REG_HFIPCXIDA, + .ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE, + .ipc_ctl = MTL_DSP_REG_HFIPCXCTL, +- .rom_status_reg = MTL_DSP_ROM_STS, ++ .rom_status_reg = LNL_DSP_REG_HFDSC, + .rom_init_timeout = 300, + .ssp_count = MTL_SSP_COUNT, + .d0i3_offset = MTL_HDA_VS_D0I3C, +diff --git a/sound/soc/sof/intel/lnl.h b/sound/soc/sof/intel/lnl.h +new file mode 100644 +index 0000000000000..4f4734fe7e089 +--- /dev/null ++++ b/sound/soc/sof/intel/lnl.h +@@ -0,0 +1,15 @@ ++/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause) */ ++/* ++ * This file is provided under a dual BSD/GPLv2 license. When using or ++ * redistributing this file, you may do so under either license. ++ * ++ * Copyright(c) 2024 Intel Corporation. All rights reserved. ++ */ ++ ++#ifndef __SOF_INTEL_LNL_H ++#define __SOF_INTEL_LNL_H ++ ++#define LNL_DSP_REG_HFDSC 0x160200 /* DSP core0 status */ ++#define LNL_DSP_REG_HFDEC 0x160204 /* DSP core0 error */ ++ ++#endif /* __SOF_INTEL_LNL_H */ +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-intel-mtl-call-dsp-dump-when-boot-retry-fai.patch b/queue-6.6/asoc-sof-intel-mtl-call-dsp-dump-when-boot-retry-fai.patch new file mode 100644 index 00000000000..872c4628826 --- /dev/null +++ b/queue-6.6/asoc-sof-intel-mtl-call-dsp-dump-when-boot-retry-fai.patch @@ -0,0 +1,64 @@ +From 5a3a20cdf5df7d7dde1f320c515f0196f9b06fbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 12:52:35 +0200 +Subject: ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yong Zhi + +[ Upstream commit d5070d0c10326e09276c34568b9a19fb9a727b6e ] + +Call snd_sof_dsp_dbg_dump() with the same flags/dump_msg +as used in function hda_loader.c/cl_dsp_init(). + +Reviewed-by: Péter Ujfalusi +Signed-off-by: Yong Zhi +Signed-off-by: Pierre-Louis Bossart +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20231127105235.30071-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Stable-dep-of: 26187f44aabd ("ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed") +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/mtl.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c +index 834eb31cd9332..19709588aa5c2 100644 +--- a/sound/soc/sof/intel/mtl.c ++++ b/sound/soc/sof/intel/mtl.c +@@ -437,7 +437,8 @@ int mtl_dsp_cl_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot) + struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata; + const struct sof_intel_dsp_desc *chip = hda->desc; + unsigned int status; +- u32 ipc_hdr; ++ u32 ipc_hdr, flags; ++ char *dump_msg; + int ret; + + /* step 1: purge FW request */ +@@ -490,8 +491,18 @@ int mtl_dsp_cl_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot) + return 0; + + err: +- snd_sof_dsp_dbg_dump(sdev, "MTL DSP init fail", 0); ++ flags = SOF_DBG_DUMP_PCI | SOF_DBG_DUMP_MBOX | SOF_DBG_DUMP_OPTIONAL; ++ ++ /* after max boot attempts make sure that the dump is printed */ ++ if (hda->boot_iteration == HDA_FW_BOOT_ATTEMPTS) ++ flags &= ~SOF_DBG_DUMP_OPTIONAL; ++ ++ dump_msg = kasprintf(GFP_KERNEL, "Boot iteration failed: %d/%d", ++ hda->boot_iteration, HDA_FW_BOOT_ATTEMPTS); ++ snd_sof_dsp_dbg_dump(sdev, dump_msg, flags); + mtl_dsp_core_power_down(sdev, SOF_DSP_PRIMARY_CORE); ++ ++ kfree(dump_msg); + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-intel-mtl-correct-rom_status_reg.patch b/queue-6.6/asoc-sof-intel-mtl-correct-rom_status_reg.patch new file mode 100644 index 00000000000..67f7c83e7ae --- /dev/null +++ b/queue-6.6/asoc-sof-intel-mtl-correct-rom_status_reg.patch @@ -0,0 +1,71 @@ +From fc0f9f4941042bbfff837b9bdfa16da422548407 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 13:52:05 +0300 +Subject: ASoC: SOF: Intel: mtl: Correct rom_status_reg + +From: Peter Ujfalusi + +[ Upstream commit 1f1b820dc3c65b6883da3130ba3b8624dcbf87db ] + +ACE1 architecture changed the place where the ROM updates the status code +from the shared SRAM window to HFFLGP1QW0 register for the status and +HFFLGP1QW0 + 4 for the error code. + +The rom_status_reg is not used on MTL because it was wrongly assigned based +on older platform convention (SRAM window) and it was giving inconsistent +readings. + +Fixes: 064520e8aeaa ("ASoC: SOF: Intel: Add support for MeteorLake (MTL)") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Rander Wang +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Liam Girdwood +Link: https://msgid.link/r/20240403105210.17949-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/mtl.c | 4 ++-- + sound/soc/sof/intel/mtl.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c +index e45a6cef63916..834eb31cd9332 100644 +--- a/sound/soc/sof/intel/mtl.c ++++ b/sound/soc/sof/intel/mtl.c +@@ -725,7 +725,7 @@ const struct sof_intel_dsp_desc mtl_chip_info = { + .ipc_ack = MTL_DSP_REG_HFIPCXIDA, + .ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE, + .ipc_ctl = MTL_DSP_REG_HFIPCXCTL, +- .rom_status_reg = MTL_DSP_ROM_STS, ++ .rom_status_reg = MTL_DSP_REG_HFFLGPXQWY, + .rom_init_timeout = 300, + .ssp_count = MTL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, +@@ -753,7 +753,7 @@ const struct sof_intel_dsp_desc arl_s_chip_info = { + .ipc_ack = MTL_DSP_REG_HFIPCXIDA, + .ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE, + .ipc_ctl = MTL_DSP_REG_HFIPCXCTL, +- .rom_status_reg = MTL_DSP_ROM_STS, ++ .rom_status_reg = MTL_DSP_REG_HFFLGPXQWY, + .rom_init_timeout = 300, + .ssp_count = MTL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, +diff --git a/sound/soc/sof/intel/mtl.h b/sound/soc/sof/intel/mtl.h +index 95696b3d7c4cf..fab28d5f68915 100644 +--- a/sound/soc/sof/intel/mtl.h ++++ b/sound/soc/sof/intel/mtl.h +@@ -76,8 +76,8 @@ + #define MTL_DSP_ROM_STS MTL_SRAM_WINDOW_OFFSET(0) /* ROM status */ + #define MTL_DSP_ROM_ERROR (MTL_SRAM_WINDOW_OFFSET(0) + 0x4) /* ROM error code */ + +-#define MTL_DSP_REG_HFFLGPXQWY 0x163200 /* ROM debug status */ +-#define MTL_DSP_REG_HFFLGPXQWY_ERROR 0x163204 /* ROM debug error code */ ++#define MTL_DSP_REG_HFFLGPXQWY 0x163200 /* DSP core0 status */ ++#define MTL_DSP_REG_HFFLGPXQWY_ERROR 0x163204 /* DSP core0 error */ + #define MTL_DSP_REG_HfIMRIS1 0x162088 + #define MTL_DSP_REG_HfIMRIS1_IU_MASK BIT(0) + +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-intel-mtl-disable-interrupts-when-firmware-.patch b/queue-6.6/asoc-sof-intel-mtl-disable-interrupts-when-firmware-.patch new file mode 100644 index 00000000000..63445964546 --- /dev/null +++ b/queue-6.6/asoc-sof-intel-mtl-disable-interrupts-when-firmware-.patch @@ -0,0 +1,40 @@ +From 6d99adc728d9f367d83c27c8c6a00d4dcc5db018 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 13:52:07 +0300 +Subject: ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed + +From: Peter Ujfalusi + +[ Upstream commit 26187f44aabdf3df7609b7c78724a059c230a2ad ] + +In case of error during the firmware boot we need to disable the interrupts +which were enabled as part of the boot sequence. + +Fixes: 064520e8aeaa ("ASoC: SOF: Intel: Add support for MeteorLake (MTL)") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Rander Wang +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Liam Girdwood +Link: https://msgid.link/r/20240403105210.17949-5-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/mtl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c +index 19709588aa5c2..e3ecd48ccc4da 100644 +--- a/sound/soc/sof/intel/mtl.c ++++ b/sound/soc/sof/intel/mtl.c +@@ -500,6 +500,7 @@ int mtl_dsp_cl_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot) + dump_msg = kasprintf(GFP_KERNEL, "Boot iteration failed: %d/%d", + hda->boot_iteration, HDA_FW_BOOT_ATTEMPTS); + snd_sof_dsp_dbg_dump(sdev, dump_msg, flags); ++ mtl_enable_interrupts(sdev, false); + mtl_dsp_core_power_down(sdev, SOF_DSP_PRIMARY_CORE); + + kfree(dump_msg); +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-intel-mtl-implement-firmware-boot-state-che.patch b/queue-6.6/asoc-sof-intel-mtl-implement-firmware-boot-state-che.patch new file mode 100644 index 00000000000..79acfb11ee9 --- /dev/null +++ b/queue-6.6/asoc-sof-intel-mtl-implement-firmware-boot-state-che.patch @@ -0,0 +1,88 @@ +From 9ca7fc269800e6c5667433b6aa73c9ba8723efed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 13:52:08 +0300 +Subject: ASoC: SOF: Intel: mtl: Implement firmware boot state check + +From: Peter Ujfalusi + +[ Upstream commit 6b1c1c47e76f0161bda2b1ac2e86a219fe70244f ] + +With the corrected rom_status_reg values we can now add a check for target +boot status for firmware booting. +With the check now we can identify failed firmware boots (IMR boots) and +we can use the fallback to purge boot the DSP. + +Fixes: 064520e8aeaa ("ASoC: SOF: Intel: Add support for MeteorLake (MTL)") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Rander Wang +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Liam Girdwood +Link: https://msgid.link/r/20240403105210.17949-6-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/mtl.c | 37 ++++++++++++++++++++++++++++++++----- + 1 file changed, 32 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c +index e3ecd48ccc4da..7d7a017c2e1f7 100644 +--- a/sound/soc/sof/intel/mtl.c ++++ b/sound/soc/sof/intel/mtl.c +@@ -436,7 +436,7 @@ int mtl_dsp_cl_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot) + { + struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata; + const struct sof_intel_dsp_desc *chip = hda->desc; +- unsigned int status; ++ unsigned int status, target_status; + u32 ipc_hdr, flags; + char *dump_msg; + int ret; +@@ -482,13 +482,40 @@ int mtl_dsp_cl_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot) + + mtl_enable_ipc_interrupts(sdev); + ++ if (chip->rom_status_reg == MTL_DSP_ROM_STS) { ++ /* ++ * Workaround: when the ROM status register is pointing to ++ * the SRAM window (MTL_DSP_ROM_STS) the platform cannot catch ++ * ROM_INIT_DONE because of a very short timing window. ++ * Follow the recommendations and skip target state waiting. ++ */ ++ return 0; ++ } ++ + /* +- * ACE workaround: don't wait for ROM INIT. +- * The platform cannot catch ROM_INIT_DONE because of a very short +- * timing window. Follow the recommendations and skip this part. ++ * step 7: ++ * - Cold/Full boot: wait for ROM init to proceed to download the firmware ++ * - IMR boot: wait for ROM firmware entered (firmware booted up from IMR) + */ ++ if (imr_boot) ++ target_status = FSR_STATE_FW_ENTERED; ++ else ++ target_status = FSR_STATE_INIT_DONE; + +- return 0; ++ ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, ++ chip->rom_status_reg, status, ++ (FSR_TO_STATE_CODE(status) == target_status), ++ HDA_DSP_REG_POLL_INTERVAL_US, ++ chip->rom_init_timeout * ++ USEC_PER_MSEC); ++ ++ if (!ret) ++ return 0; ++ ++ if (hda->boot_iteration == HDA_FW_BOOT_ATTEMPTS) ++ dev_err(sdev->dev, ++ "%s: timeout with rom_status_reg (%#x) read\n", ++ __func__, chip->rom_status_reg); + + err: + flags = SOF_DBG_DUMP_PCI | SOF_DBG_DUMP_MBOX | SOF_DBG_DUMP_OPTIONAL; +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-intel-pci-mtl-fix-arl-s-definitions.patch b/queue-6.6/asoc-sof-intel-pci-mtl-fix-arl-s-definitions.patch new file mode 100644 index 00000000000..b303ae6c26b --- /dev/null +++ b/queue-6.6/asoc-sof-intel-pci-mtl-fix-arl-s-definitions.patch @@ -0,0 +1,130 @@ +From 060a663b4ad91b37f83b0027085fe13a0deb4cf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 15:27:09 -0600 +Subject: ASoC: SOF: Intel: pci-mtl: fix ARL-S definitions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit a00be6dc9bb80796244196033aa5eb258b6af47a ] + +The initial copy/paste from MTL was incorrect, the hardware is +different and requires different descriptors along with a dedicated +firmware binary. + +Fixes: 3851831f529e ("ASoC: SOF: Intel: pci-mtl: use ARL specific firmware definitions") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Reviewed-by: Kai Vehmanen +Acked-by: Mark Brown +Link: https://lore.kernel.org/r/20231204212710.185976-5-pierre-louis.bossart@linux.intel.com +Signed-off-by: Takashi Iwai +Stable-dep-of: 1f1b820dc3c6 ("ASoC: SOF: Intel: mtl: Correct rom_status_reg") +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda.h | 1 + + sound/soc/sof/intel/mtl.c | 28 ++++++++++++++++++++++++++++ + sound/soc/sof/intel/pci-mtl.c | 12 ++++++------ + 3 files changed, 35 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/sof/intel/hda.h b/sound/soc/sof/intel/hda.h +index 5c517ec57d4a2..0f0cfd0f85a3f 100644 +--- a/sound/soc/sof/intel/hda.h ++++ b/sound/soc/sof/intel/hda.h +@@ -876,6 +876,7 @@ extern const struct sof_intel_dsp_desc ehl_chip_info; + extern const struct sof_intel_dsp_desc jsl_chip_info; + extern const struct sof_intel_dsp_desc adls_chip_info; + extern const struct sof_intel_dsp_desc mtl_chip_info; ++extern const struct sof_intel_dsp_desc arl_s_chip_info; + extern const struct sof_intel_dsp_desc lnl_chip_info; + + /* Probes support */ +diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c +index f9412517eaf29..e45a6cef63916 100644 +--- a/sound/soc/sof/intel/mtl.c ++++ b/sound/soc/sof/intel/mtl.c +@@ -743,3 +743,31 @@ const struct sof_intel_dsp_desc mtl_chip_info = { + .hw_ip_version = SOF_INTEL_ACE_1_0, + }; + EXPORT_SYMBOL_NS(mtl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); ++ ++const struct sof_intel_dsp_desc arl_s_chip_info = { ++ .cores_num = 2, ++ .init_core_mask = BIT(0), ++ .host_managed_cores_mask = BIT(0), ++ .ipc_req = MTL_DSP_REG_HFIPCXIDR, ++ .ipc_req_mask = MTL_DSP_REG_HFIPCXIDR_BUSY, ++ .ipc_ack = MTL_DSP_REG_HFIPCXIDA, ++ .ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE, ++ .ipc_ctl = MTL_DSP_REG_HFIPCXCTL, ++ .rom_status_reg = MTL_DSP_ROM_STS, ++ .rom_init_timeout = 300, ++ .ssp_count = MTL_SSP_COUNT, ++ .ssp_base_offset = CNL_SSP_BASE_OFFSET, ++ .sdw_shim_base = SDW_SHIM_BASE_ACE, ++ .sdw_alh_base = SDW_ALH_BASE_ACE, ++ .d0i3_offset = MTL_HDA_VS_D0I3C, ++ .read_sdw_lcount = hda_sdw_check_lcount_common, ++ .enable_sdw_irq = mtl_enable_sdw_irq, ++ .check_sdw_irq = mtl_dsp_check_sdw_irq, ++ .check_sdw_wakeen_irq = hda_sdw_check_wakeen_irq_common, ++ .check_ipc_irq = mtl_dsp_check_ipc_irq, ++ .cl_init = mtl_dsp_cl_init, ++ .power_down_dsp = mtl_power_down_dsp, ++ .disable_interrupts = mtl_dsp_disable_interrupts, ++ .hw_ip_version = SOF_INTEL_ACE_1_0, ++}; ++EXPORT_SYMBOL_NS(arl_s_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); +diff --git a/sound/soc/sof/intel/pci-mtl.c b/sound/soc/sof/intel/pci-mtl.c +index 42a8b85d0f4a9..7d00e469f58ce 100644 +--- a/sound/soc/sof/intel/pci-mtl.c ++++ b/sound/soc/sof/intel/pci-mtl.c +@@ -50,7 +50,7 @@ static const struct sof_dev_desc mtl_desc = { + .ops_free = hda_ops_free, + }; + +-static const struct sof_dev_desc arl_desc = { ++static const struct sof_dev_desc arl_s_desc = { + .use_acpi_target_states = true, + .machines = snd_soc_acpi_intel_arl_machines, + .alt_machines = snd_soc_acpi_intel_arl_sdw_machines, +@@ -58,21 +58,21 @@ static const struct sof_dev_desc arl_desc = { + .resindex_pcicfg_base = -1, + .resindex_imr_base = -1, + .irqindex_host_ipc = -1, +- .chip_info = &mtl_chip_info, ++ .chip_info = &arl_s_chip_info, + .ipc_supported_mask = BIT(SOF_IPC_TYPE_4), + .ipc_default = SOF_IPC_TYPE_4, + .dspless_mode_supported = true, /* Only supported for HDaudio */ + .default_fw_path = { +- [SOF_IPC_TYPE_4] = "intel/sof-ipc4/arl", ++ [SOF_IPC_TYPE_4] = "intel/sof-ipc4/arl-s", + }, + .default_lib_path = { +- [SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/arl", ++ [SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/arl-s", + }, + .default_tplg_path = { + [SOF_IPC_TYPE_4] = "intel/sof-ace-tplg", + }, + .default_fw_filename = { +- [SOF_IPC_TYPE_4] = "sof-arl.ri", ++ [SOF_IPC_TYPE_4] = "sof-arl-s.ri", + }, + .nocodec_tplg_filename = "sof-arl-nocodec.tplg", + .ops = &sof_mtl_ops, +@@ -83,7 +83,7 @@ static const struct sof_dev_desc arl_desc = { + /* PCI IDs */ + static const struct pci_device_id sof_pci_ids[] = { + { PCI_DEVICE_DATA(INTEL, HDA_MTL, &mtl_desc) }, +- { PCI_DEVICE_DATA(INTEL, HDA_ARL_S, &arl_desc) }, ++ { PCI_DEVICE_DATA(INTEL, HDA_ARL_S, &arl_s_desc) }, + { 0, } + }; + MODULE_DEVICE_TABLE(pci, sof_pci_ids); +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-intel-pci-mtl-use-arl-specific-firmware-def.patch b/queue-6.6/asoc-sof-intel-pci-mtl-use-arl-specific-firmware-def.patch new file mode 100644 index 00000000000..d2925b6c165 --- /dev/null +++ b/queue-6.6/asoc-sof-intel-pci-mtl-use-arl-specific-firmware-def.patch @@ -0,0 +1,71 @@ +From 7dafd3d429777cf88645c849a7414ce7b3aebf6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 15:18:47 -0400 +Subject: ASoC: SOF: Intel: pci-mtl: use ARL specific firmware definitions + +From: Arun T + +[ Upstream commit 3851831f529ec3d7b2c7708b2579bfc00d43733c ] + +Split out firmware definitions for Intel Arrow Lake platforms. + +Reviewed-by: Kai Vehmanen +Reviewed-by: Ranjani Sridharan +Signed-off-by: Arun T +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20231012191850.147140-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Stable-dep-of: 1f1b820dc3c6 ("ASoC: SOF: Intel: mtl: Correct rom_status_reg") +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/pci-mtl.c | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/sound/soc/sof/intel/pci-mtl.c b/sound/soc/sof/intel/pci-mtl.c +index 7868b0827e844..42a8b85d0f4a9 100644 +--- a/sound/soc/sof/intel/pci-mtl.c ++++ b/sound/soc/sof/intel/pci-mtl.c +@@ -50,9 +50,40 @@ static const struct sof_dev_desc mtl_desc = { + .ops_free = hda_ops_free, + }; + ++static const struct sof_dev_desc arl_desc = { ++ .use_acpi_target_states = true, ++ .machines = snd_soc_acpi_intel_arl_machines, ++ .alt_machines = snd_soc_acpi_intel_arl_sdw_machines, ++ .resindex_lpe_base = 0, ++ .resindex_pcicfg_base = -1, ++ .resindex_imr_base = -1, ++ .irqindex_host_ipc = -1, ++ .chip_info = &mtl_chip_info, ++ .ipc_supported_mask = BIT(SOF_IPC_TYPE_4), ++ .ipc_default = SOF_IPC_TYPE_4, ++ .dspless_mode_supported = true, /* Only supported for HDaudio */ ++ .default_fw_path = { ++ [SOF_IPC_TYPE_4] = "intel/sof-ipc4/arl", ++ }, ++ .default_lib_path = { ++ [SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/arl", ++ }, ++ .default_tplg_path = { ++ [SOF_IPC_TYPE_4] = "intel/sof-ace-tplg", ++ }, ++ .default_fw_filename = { ++ [SOF_IPC_TYPE_4] = "sof-arl.ri", ++ }, ++ .nocodec_tplg_filename = "sof-arl-nocodec.tplg", ++ .ops = &sof_mtl_ops, ++ .ops_init = sof_mtl_ops_init, ++ .ops_free = hda_ops_free, ++}; ++ + /* PCI IDs */ + static const struct pci_device_id sof_pci_ids[] = { + { PCI_DEVICE_DATA(INTEL, HDA_MTL, &mtl_desc) }, ++ { PCI_DEVICE_DATA(INTEL, HDA_ARL_S, &arl_desc) }, + { 0, } + }; + MODULE_DEVICE_TABLE(pci, sof_pci_ids); +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-pcm-restrict-dsp-d0i3-during-s0ix-to-ipc3.patch b/queue-6.6/asoc-sof-pcm-restrict-dsp-d0i3-during-s0ix-to-ipc3.patch new file mode 100644 index 00000000000..c954a071c1d --- /dev/null +++ b/queue-6.6/asoc-sof-pcm-restrict-dsp-d0i3-during-s0ix-to-ipc3.patch @@ -0,0 +1,84 @@ +From e65b70fd5a64378b3806a0d46384e5e4a5e1299d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 14:41:46 -0500 +Subject: ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3 + +From: Ranjani Sridharan + +[ Upstream commit 90a2353080eedec855d63f6aadfda14104ee9b06 ] + +Introduce a new field in struct sof_ipc_pcm_ops that can be used to +restrict DSP D0i3 during S0ix suspend to IPC3. With IPC4, all streams +must be stopped before S0ix suspend. + +Reviewed-by: Uday M Bhat +Reviewed-by: Bard Liao +Signed-off-by: Ranjani Sridharan +Signed-off-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20240408194147.28919-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc3-pcm.c | 1 + + sound/soc/sof/pcm.c | 13 ++++++------- + sound/soc/sof/sof-audio.h | 2 ++ + 3 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/sof/ipc3-pcm.c b/sound/soc/sof/ipc3-pcm.c +index cb58ee8c158a5..720bd9bd2667a 100644 +--- a/sound/soc/sof/ipc3-pcm.c ++++ b/sound/soc/sof/ipc3-pcm.c +@@ -398,4 +398,5 @@ const struct sof_ipc_pcm_ops ipc3_pcm_ops = { + .trigger = sof_ipc3_pcm_trigger, + .dai_link_fixup = sof_ipc3_pcm_dai_link_fixup, + .reset_hw_params_during_stop = true, ++ .d0i3_supported_in_s0ix = true, + }; +diff --git a/sound/soc/sof/pcm.c b/sound/soc/sof/pcm.c +index d778717cab10b..8e602e42afee2 100644 +--- a/sound/soc/sof/pcm.c ++++ b/sound/soc/sof/pcm.c +@@ -325,14 +325,13 @@ static int sof_pcm_trigger(struct snd_soc_component *component, + ipc_first = true; + break; + case SNDRV_PCM_TRIGGER_SUSPEND: +- if (sdev->system_suspend_target == SOF_SUSPEND_S0IX && ++ /* ++ * If DSP D0I3 is allowed during S0iX, set the suspend_ignored flag for ++ * D0I3-compatible streams to keep the firmware pipeline running ++ */ ++ if (pcm_ops && pcm_ops->d0i3_supported_in_s0ix && ++ sdev->system_suspend_target == SOF_SUSPEND_S0IX && + spcm->stream[substream->stream].d0i3_compatible) { +- /* +- * trap the event, not sending trigger stop to +- * prevent the FW pipelines from being stopped, +- * and mark the flag to ignore the upcoming DAPM +- * PM events. +- */ + spcm->stream[substream->stream].suspend_ignored = true; + return 0; + } +diff --git a/sound/soc/sof/sof-audio.h b/sound/soc/sof/sof-audio.h +index a6d6bcd00ceec..3606595a7500c 100644 +--- a/sound/soc/sof/sof-audio.h ++++ b/sound/soc/sof/sof-audio.h +@@ -113,6 +113,7 @@ struct snd_sof_dai_config_data { + * triggers. The FW keeps the host DMA running in this case and + * therefore the host must do the same and should stop the DMA during + * hw_free. ++ * @d0i3_supported_in_s0ix: Allow DSP D0I3 during S0iX + */ + struct sof_ipc_pcm_ops { + int (*hw_params)(struct snd_soc_component *component, struct snd_pcm_substream *substream, +@@ -129,6 +130,7 @@ struct sof_ipc_pcm_ops { + bool reset_hw_params_during_stop; + bool ipc_first_on_start; + bool platform_stop_during_hw_free; ++ bool d0i3_supported_in_s0ix; + }; + + /** +-- +2.43.0 + diff --git a/queue-6.6/asoc-tracing-export-snd_soc_dapm_dir_out-to-its-valu.patch b/queue-6.6/asoc-tracing-export-snd_soc_dapm_dir_out-to-its-valu.patch new file mode 100644 index 00000000000..d7d1ee4b153 --- /dev/null +++ b/queue-6.6/asoc-tracing-export-snd_soc_dapm_dir_out-to-its-valu.patch @@ -0,0 +1,48 @@ +From 060c471a23fd51ce33e9836f162056a3b0b31555 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 00:03:03 -0400 +Subject: ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value + +From: Steven Rostedt + +[ Upstream commit 58300f8d6a48e58d1843199be743f819e2791ea3 ] + +The string SND_SOC_DAPM_DIR_OUT is printed in the snd_soc_dapm_path trace +event instead of its value: + + (((REC->path_dir) == SND_SOC_DAPM_DIR_OUT) ? "->" : "<-") + +User space cannot parse this, as it has no idea what SND_SOC_DAPM_DIR_OUT +is. Use TRACE_DEFINE_ENUM() to convert it to its value: + + (((REC->path_dir) == 1) ? "->" : "<-") + +So that user space tools, such as perf and trace-cmd, can parse it +correctly. + +Reported-by: Luca Ceresoli +Fixes: 6e588a0d839b5 ("ASoC: dapm: Consolidate path trace events") +Signed-off-by: Steven Rostedt (Google) +Link: https://lore.kernel.org/r/20240416000303.04670cdf@rorschach.local.home +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/trace/events/asoc.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/trace/events/asoc.h b/include/trace/events/asoc.h +index 4d8ef71090af1..97a434d021356 100644 +--- a/include/trace/events/asoc.h ++++ b/include/trace/events/asoc.h +@@ -12,6 +12,8 @@ + #define DAPM_DIRECT "(direct)" + #define DAPM_ARROW(dir) (((dir) == SND_SOC_DAPM_DIR_OUT) ? "->" : "<-") + ++TRACE_DEFINE_ENUM(SND_SOC_DAPM_DIR_OUT); ++ + struct snd_soc_jack; + struct snd_soc_card; + struct snd_soc_dapm_widget; +-- +2.43.0 + diff --git a/queue-6.6/ax25-fix-reference-count-leak-issue-of-net_device.patch b/queue-6.6/ax25-fix-reference-count-leak-issue-of-net_device.patch new file mode 100644 index 00000000000..ccb0a1924a6 --- /dev/null +++ b/queue-6.6/ax25-fix-reference-count-leak-issue-of-net_device.patch @@ -0,0 +1,53 @@ +From 751b09b9c67d060e866374d71166369a2c534751 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 17:37:02 +0800 +Subject: ax25: Fix reference count leak issue of net_device + +From: Duoming Zhou + +[ Upstream commit 36e56b1b002bb26440403053f19f9e1a8bc075b2 ] + +There is a reference count leak issue of the object "net_device" in +ax25_dev_device_down(). When the ax25 device is shutting down, the +ax25_dev_device_down() drops the reference count of net_device one +or zero times depending on if we goto unlock_put or not, which will +cause memory leak. + +In order to solve the above issue, decrease the reference count of +net_device after dev->ax25_ptr is set to null. + +Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") +Suggested-by: Dan Carpenter +Signed-off-by: Duoming Zhou +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/7ce3b23a40d9084657ba1125432f0ecc380cbc80.1715247018.git.duoming@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ax25/ax25_dev.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c +index 52ccc37d5687a..c9d55b99a7a57 100644 +--- a/net/ax25/ax25_dev.c ++++ b/net/ax25/ax25_dev.c +@@ -118,15 +118,10 @@ void ax25_dev_device_down(struct net_device *dev) + list_for_each_entry(s, &ax25_dev_list, list) { + if (s == ax25_dev) { + list_del(&s->list); +- goto unlock_put; ++ break; + } + } +- dev->ax25_ptr = NULL; +- spin_unlock_bh(&ax25_dev_lock); +- ax25_dev_put(ax25_dev); +- return; + +-unlock_put: + dev->ax25_ptr = NULL; + spin_unlock_bh(&ax25_dev_lock); + netdev_put(dev, &ax25_dev->dev_tracker); +-- +2.43.0 + diff --git a/queue-6.6/ax25-fix-reference-count-leak-issues-of-ax25_dev.patch b/queue-6.6/ax25-fix-reference-count-leak-issues-of-ax25_dev.patch new file mode 100644 index 00000000000..6cccdc436ac --- /dev/null +++ b/queue-6.6/ax25-fix-reference-count-leak-issues-of-ax25_dev.patch @@ -0,0 +1,74 @@ +From f12bf43834e885c3403c372ed307b3b0d703deb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 17:36:47 +0800 +Subject: ax25: Fix reference count leak issues of ax25_dev + +From: Duoming Zhou + +[ Upstream commit b505e0319852b08a3a716b64620168eab21f4ced ] + +The ax25_addr_ax25dev() and ax25_dev_device_down() exist a reference +count leak issue of the object "ax25_dev". + +Memory leak issue in ax25_addr_ax25dev(): + +The reference count of the object "ax25_dev" can be increased multiple +times in ax25_addr_ax25dev(). This will cause a memory leak. + +Memory leak issues in ax25_dev_device_down(): + +The reference count of ax25_dev is set to 1 in ax25_dev_device_up() and +then increase the reference count when ax25_dev is added to ax25_dev_list. +As a result, the reference count of ax25_dev is 2. But when the device is +shutting down. The ax25_dev_device_down() drops the reference count once +or twice depending on if we goto unlock_put or not, which will cause +memory leak. + +As for the issue of ax25_addr_ax25dev(), it is impossible for one pointer +to be on a list twice. So add a break in ax25_addr_ax25dev(). As for the +issue of ax25_dev_device_down(), increase the reference count of ax25_dev +once in ax25_dev_device_up() and decrease the reference count of ax25_dev +after it is removed from the ax25_dev_list. + +Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") +Suggested-by: Dan Carpenter +Signed-off-by: Duoming Zhou +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/361bbf2a4b091e120006279ec3b382d73c4a0c17.1715247018.git.duoming@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ax25/ax25_dev.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c +index f16ee5c09d07a..52ccc37d5687a 100644 +--- a/net/ax25/ax25_dev.c ++++ b/net/ax25/ax25_dev.c +@@ -39,6 +39,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr) + if (ax25cmp(addr, (const ax25_address *)ax25_dev->dev->dev_addr) == 0) { + res = ax25_dev; + ax25_dev_hold(ax25_dev); ++ break; + } + spin_unlock_bh(&ax25_dev_lock); + +@@ -88,7 +89,6 @@ void ax25_dev_device_up(struct net_device *dev) + list_add(&ax25_dev->list, &ax25_dev_list); + dev->ax25_ptr = ax25_dev; + spin_unlock_bh(&ax25_dev_lock); +- ax25_dev_hold(ax25_dev); + + ax25_register_dev_sysctl(ax25_dev); + } +@@ -129,7 +129,6 @@ void ax25_dev_device_down(struct net_device *dev) + unlock_put: + dev->ax25_ptr = NULL; + spin_unlock_bh(&ax25_dev_lock); +- ax25_dev_put(ax25_dev); + netdev_put(dev, &ax25_dev->dev_tracker); + ax25_dev_put(ax25_dev); + } +-- +2.43.0 + diff --git a/queue-6.6/ax25-use-kernel-universal-linked-list-to-implement-a.patch b/queue-6.6/ax25-use-kernel-universal-linked-list-to-implement-a.patch new file mode 100644 index 00000000000..16c8c5ea482 --- /dev/null +++ b/queue-6.6/ax25-use-kernel-universal-linked-list-to-implement-a.patch @@ -0,0 +1,163 @@ +From 7bfd826f87b78462a5764d0d3b030a4ee40673f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 17:36:33 +0800 +Subject: ax25: Use kernel universal linked list to implement ax25_dev_list + +From: Duoming Zhou + +[ Upstream commit a7d6e36b9ad052926ba2ecba3a59d8bb67dabcb4 ] + +The origin ax25_dev_list implements its own single linked list, +which is complicated and error-prone. For example, when deleting +the node of ax25_dev_list in ax25_dev_device_down(), we have to +operate on the head node and other nodes separately. + +This patch uses kernel universal linked list to replace original +ax25_dev_list, which make the operation of ax25_dev_list easier. + +We should do "dev->ax25_ptr = ax25_dev;" and "dev->ax25_ptr = NULL;" +while holding the spinlock, otherwise the ax25_dev_device_up() and +ax25_dev_device_down() could race. + +Suggested-by: Dan Carpenter +Signed-off-by: Duoming Zhou +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/85bba3af651ca0e1a519da8d0d715b949891171c.1715247018.git.duoming@zju.edu.cn +Signed-off-by: Jakub Kicinski +Stable-dep-of: b505e0319852 ("ax25: Fix reference count leak issues of ax25_dev") +Signed-off-by: Sasha Levin +--- + include/net/ax25.h | 3 +-- + net/ax25/ax25_dev.c | 40 +++++++++++++++------------------------- + 2 files changed, 16 insertions(+), 27 deletions(-) + +diff --git a/include/net/ax25.h b/include/net/ax25.h +index 0d939e5aee4ec..c2a85fd3f5ea4 100644 +--- a/include/net/ax25.h ++++ b/include/net/ax25.h +@@ -216,7 +216,7 @@ typedef struct { + struct ctl_table; + + typedef struct ax25_dev { +- struct ax25_dev *next; ++ struct list_head list; + + struct net_device *dev; + netdevice_tracker dev_tracker; +@@ -330,7 +330,6 @@ int ax25_addr_size(const ax25_digi *); + void ax25_digi_invert(const ax25_digi *, ax25_digi *); + + /* ax25_dev.c */ +-extern ax25_dev *ax25_dev_list; + extern spinlock_t ax25_dev_lock; + + #if IS_ENABLED(CONFIG_AX25) +diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c +index 282ec581c0720..f16ee5c09d07a 100644 +--- a/net/ax25/ax25_dev.c ++++ b/net/ax25/ax25_dev.c +@@ -22,11 +22,12 @@ + #include + #include + #include ++#include + #include + #include + #include + +-ax25_dev *ax25_dev_list; ++static LIST_HEAD(ax25_dev_list); + DEFINE_SPINLOCK(ax25_dev_lock); + + ax25_dev *ax25_addr_ax25dev(ax25_address *addr) +@@ -34,7 +35,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr) + ax25_dev *ax25_dev, *res = NULL; + + spin_lock_bh(&ax25_dev_lock); +- for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next) ++ list_for_each_entry(ax25_dev, &ax25_dev_list, list) + if (ax25cmp(addr, (const ax25_address *)ax25_dev->dev->dev_addr) == 0) { + res = ax25_dev; + ax25_dev_hold(ax25_dev); +@@ -59,7 +60,6 @@ void ax25_dev_device_up(struct net_device *dev) + } + + refcount_set(&ax25_dev->refcount, 1); +- dev->ax25_ptr = ax25_dev; + ax25_dev->dev = dev; + netdev_hold(dev, &ax25_dev->dev_tracker, GFP_KERNEL); + ax25_dev->forward = NULL; +@@ -85,8 +85,8 @@ void ax25_dev_device_up(struct net_device *dev) + #endif + + spin_lock_bh(&ax25_dev_lock); +- ax25_dev->next = ax25_dev_list; +- ax25_dev_list = ax25_dev; ++ list_add(&ax25_dev->list, &ax25_dev_list); ++ dev->ax25_ptr = ax25_dev; + spin_unlock_bh(&ax25_dev_lock); + ax25_dev_hold(ax25_dev); + +@@ -111,32 +111,25 @@ void ax25_dev_device_down(struct net_device *dev) + /* + * Remove any packet forwarding that points to this device. + */ +- for (s = ax25_dev_list; s != NULL; s = s->next) ++ list_for_each_entry(s, &ax25_dev_list, list) + if (s->forward == dev) + s->forward = NULL; + +- if ((s = ax25_dev_list) == ax25_dev) { +- ax25_dev_list = s->next; +- goto unlock_put; +- } +- +- while (s != NULL && s->next != NULL) { +- if (s->next == ax25_dev) { +- s->next = ax25_dev->next; ++ list_for_each_entry(s, &ax25_dev_list, list) { ++ if (s == ax25_dev) { ++ list_del(&s->list); + goto unlock_put; + } +- +- s = s->next; + } +- spin_unlock_bh(&ax25_dev_lock); + dev->ax25_ptr = NULL; ++ spin_unlock_bh(&ax25_dev_lock); + ax25_dev_put(ax25_dev); + return; + + unlock_put: ++ dev->ax25_ptr = NULL; + spin_unlock_bh(&ax25_dev_lock); + ax25_dev_put(ax25_dev); +- dev->ax25_ptr = NULL; + netdev_put(dev, &ax25_dev->dev_tracker); + ax25_dev_put(ax25_dev); + } +@@ -200,16 +193,13 @@ struct net_device *ax25_fwd_dev(struct net_device *dev) + */ + void __exit ax25_dev_free(void) + { +- ax25_dev *s, *ax25_dev; ++ ax25_dev *s, *n; + + spin_lock_bh(&ax25_dev_lock); +- ax25_dev = ax25_dev_list; +- while (ax25_dev != NULL) { +- s = ax25_dev; +- netdev_put(ax25_dev->dev, &ax25_dev->dev_tracker); +- ax25_dev = ax25_dev->next; ++ list_for_each_entry_safe(s, n, &ax25_dev_list, list) { ++ netdev_put(s->dev, &s->dev_tracker); ++ list_del(&s->list); + kfree(s); + } +- ax25_dev_list = NULL; + spin_unlock_bh(&ax25_dev_lock); + } +-- +2.43.0 + diff --git a/queue-6.6/bitops-add-missing-prototype-check.patch b/queue-6.6/bitops-add-missing-prototype-check.patch new file mode 100644 index 00000000000..61bdecfc5e5 --- /dev/null +++ b/queue-6.6/bitops-add-missing-prototype-check.patch @@ -0,0 +1,40 @@ +From 6b0e80ca73c68b801828a9b8b121a06d02a74b38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 16:23:41 +0100 +Subject: bitops: add missing prototype check + +From: Alexander Lobakin + +[ Upstream commit 72cc1980a0ef3ccad0d539e7dace63d0d7d432a4 ] + +Commit 8238b4579866 ("wait_on_bit: add an acquire memory barrier") added +a new bitop, test_bit_acquire(), with proper wrapping in order to try to +optimize it at compile-time, but missed the list of bitops used for +checking their prototypes a bit below. +The functions added have consistent prototypes, so that no more changes +are required and no functional changes take place. + +Fixes: 8238b4579866 ("wait_on_bit: add an acquire memory barrier") +Reviewed-by: Przemek Kitszel +Signed-off-by: Alexander Lobakin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/bitops.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/bitops.h b/include/linux/bitops.h +index 2ba557e067fe6..f7f5a783da2aa 100644 +--- a/include/linux/bitops.h ++++ b/include/linux/bitops.h +@@ -80,6 +80,7 @@ __check_bitop_pr(__test_and_set_bit); + __check_bitop_pr(__test_and_clear_bit); + __check_bitop_pr(__test_and_change_bit); + __check_bitop_pr(test_bit); ++__check_bitop_pr(test_bit_acquire); + + #undef __check_bitop_pr + +-- +2.43.0 + diff --git a/queue-6.6/block-fix-and-simplify-blkdevparts-cmdline-parsing.patch b/queue-6.6/block-fix-and-simplify-blkdevparts-cmdline-parsing.patch new file mode 100644 index 00000000000..9dc343f3c13 --- /dev/null +++ b/queue-6.6/block-fix-and-simplify-blkdevparts-cmdline-parsing.patch @@ -0,0 +1,208 @@ +From c506240652a3aba0ec4041babed316fe1de8f7e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Apr 2024 16:39:52 +0900 +Subject: block: fix and simplify blkdevparts= cmdline parsing + +From: INAGAKI Hiroshi + +[ Upstream commit bc2e07dfd2c49aaa4b52302cf7b55cf94e025f79 ] + +Fix the cmdline parsing of the "blkdevparts=" parameter using strsep(), +which makes the code simpler. + +Before commit 146afeb235cc ("block: use strscpy() to instead of +strncpy()"), we used a strncpy() to copy a block device name and partition +names. The commit simply replaced a strncpy() and NULL termination with +a strscpy(). It did not update calculations of length passed to strscpy(). +While the length passed to strncpy() is just a length of valid characters +without NULL termination ('\0'), strscpy() takes it as a length of the +destination buffer, including a NULL termination. + +Since the source buffer is not necessarily NULL terminated, the current +code copies "length - 1" characters and puts a NULL character in the +destination buffer. It replaces the last character with NULL and breaks +the parsing. + +As an example, that buffer will be passed to parse_parts() and breaks +parsing sub-partitions due to the missing ')' at the end, like the +following. + +example (Check Point V-80 & OpenWrt): + +- Linux Kernel 6.6 + + [ 0.000000] Kernel command line: console=ttyS0,115200 earlycon=uart8250,mmio32,0xf0512000 crashkernel=30M mvpp2x.queue_mode=1 blkdevparts=mmcblk1:48M@10M(kernel-1),1M(dtb-1),720M(rootfs-1),48M(kernel-2),1M(dtb-2),720M(rootfs-2),300M(default_sw),650M(logs),1M(preset_cfg),1M(adsl),-(storage) maxcpus=4 + ... + [ 0.884016] mmc1: new HS200 MMC card at address 0001 + [ 0.889951] mmcblk1: mmc1:0001 004GA0 3.69 GiB + [ 0.895043] cmdline partition format is invalid. + [ 0.895704] mmcblk1: p1 + [ 0.903447] mmcblk1boot0: mmc1:0001 004GA0 2.00 MiB + [ 0.908667] mmcblk1boot1: mmc1:0001 004GA0 2.00 MiB + [ 0.913765] mmcblk1rpmb: mmc1:0001 004GA0 512 KiB, chardev (248:0) + + 1. "48M@10M(kernel-1),..." is passed to strscpy() with length=17 + from parse_parts() + 2. strscpy() returns -E2BIG and the destination buffer has + "48M@10M(kernel-1\0" + 3. "48M@10M(kernel-1\0" is passed to parse_subpart() + 4. parse_subpart() fails to find ')' when parsing a partition name, + and returns error + +- Linux Kernel 6.1 + + [ 0.000000] Kernel command line: console=ttyS0,115200 earlycon=uart8250,mmio32,0xf0512000 crashkernel=30M mvpp2x.queue_mode=1 blkdevparts=mmcblk1:48M@10M(kernel-1),1M(dtb-1),720M(rootfs-1),48M(kernel-2),1M(dtb-2),720M(rootfs-2),300M(default_sw),650M(logs),1M(preset_cfg),1M(adsl),-(storage) maxcpus=4 + ... + [ 0.953142] mmc1: new HS200 MMC card at address 0001 + [ 0.959114] mmcblk1: mmc1:0001 004GA0 3.69 GiB + [ 0.964259] mmcblk1: p1(kernel-1) p2(dtb-1) p3(rootfs-1) p4(kernel-2) p5(dtb-2) 6(rootfs-2) p7(default_sw) p8(logs) p9(preset_cfg) p10(adsl) p11(storage) + [ 0.979174] mmcblk1boot0: mmc1:0001 004GA0 2.00 MiB + [ 0.984674] mmcblk1boot1: mmc1:0001 004GA0 2.00 MiB + [ 0.989926] mmcblk1rpmb: mmc1:0001 004GA0 512 KiB, chardev (248:0 + +By the way, strscpy() takes a length of destination buffer and it is +often confusing when copying characters with a specified length. Using +strsep() helps to separate the string by the specified character. Then, +we can use strscpy() naturally with the size of the destination buffer. + +Separating the string on the fly is also useful to omit the redundant +string copy, reducing memory usage and improve the code readability. + +Fixes: 146afeb235cc ("block: use strscpy() to instead of strncpy()") +Suggested-by: Naohiro Aota +Signed-off-by: INAGAKI Hiroshi +Reviewed-by: Daniel Golle +Link: https://lore.kernel.org/r/20240421074005.565-1-musashino.open@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/partitions/cmdline.c | 49 ++++++++++---------------------------- + 1 file changed, 12 insertions(+), 37 deletions(-) + +diff --git a/block/partitions/cmdline.c b/block/partitions/cmdline.c +index c03bc105e5753..152c85df92b20 100644 +--- a/block/partitions/cmdline.c ++++ b/block/partitions/cmdline.c +@@ -70,8 +70,8 @@ static int parse_subpart(struct cmdline_subpart **subpart, char *partdef) + } + + if (*partdef == '(') { +- int length; +- char *next = strchr(++partdef, ')'); ++ partdef++; ++ char *next = strsep(&partdef, ")"); + + if (!next) { + pr_warn("cmdline partition format is invalid."); +@@ -79,11 +79,7 @@ static int parse_subpart(struct cmdline_subpart **subpart, char *partdef) + goto fail; + } + +- length = min_t(int, next - partdef, +- sizeof(new_subpart->name) - 1); +- strscpy(new_subpart->name, partdef, length); +- +- partdef = ++next; ++ strscpy(new_subpart->name, next, sizeof(new_subpart->name)); + } else + new_subpart->name[0] = '\0'; + +@@ -117,14 +113,12 @@ static void free_subpart(struct cmdline_parts *parts) + } + } + +-static int parse_parts(struct cmdline_parts **parts, const char *bdevdef) ++static int parse_parts(struct cmdline_parts **parts, char *bdevdef) + { + int ret = -EINVAL; + char *next; +- int length; + struct cmdline_subpart **next_subpart; + struct cmdline_parts *newparts; +- char buf[BDEVNAME_SIZE + 32 + 4]; + + *parts = NULL; + +@@ -132,28 +126,19 @@ static int parse_parts(struct cmdline_parts **parts, const char *bdevdef) + if (!newparts) + return -ENOMEM; + +- next = strchr(bdevdef, ':'); ++ next = strsep(&bdevdef, ":"); + if (!next) { + pr_warn("cmdline partition has no block device."); + goto fail; + } + +- length = min_t(int, next - bdevdef, sizeof(newparts->name) - 1); +- strscpy(newparts->name, bdevdef, length); ++ strscpy(newparts->name, next, sizeof(newparts->name)); + newparts->nr_subparts = 0; + + next_subpart = &newparts->subpart; + +- while (next && *(++next)) { +- bdevdef = next; +- next = strchr(bdevdef, ','); +- +- length = (!next) ? (sizeof(buf) - 1) : +- min_t(int, next - bdevdef, sizeof(buf) - 1); +- +- strscpy(buf, bdevdef, length); +- +- ret = parse_subpart(next_subpart, buf); ++ while ((next = strsep(&bdevdef, ","))) { ++ ret = parse_subpart(next_subpart, next); + if (ret) + goto fail; + +@@ -199,24 +184,17 @@ static int cmdline_parts_parse(struct cmdline_parts **parts, + + *parts = NULL; + +- next = pbuf = buf = kstrdup(cmdline, GFP_KERNEL); ++ pbuf = buf = kstrdup(cmdline, GFP_KERNEL); + if (!buf) + return -ENOMEM; + + next_parts = parts; + +- while (next && *pbuf) { +- next = strchr(pbuf, ';'); +- if (next) +- *next = '\0'; +- +- ret = parse_parts(next_parts, pbuf); ++ while ((next = strsep(&pbuf, ";"))) { ++ ret = parse_parts(next_parts, next); + if (ret) + goto fail; + +- if (next) +- pbuf = ++next; +- + next_parts = &(*next_parts)->next_parts; + } + +@@ -250,7 +228,6 @@ static struct cmdline_parts *bdev_parts; + static int add_part(int slot, struct cmdline_subpart *subpart, + struct parsed_partitions *state) + { +- int label_min; + struct partition_meta_info *info; + char tmp[sizeof(info->volname) + 4]; + +@@ -262,9 +239,7 @@ static int add_part(int slot, struct cmdline_subpart *subpart, + + info = &state->parts[slot].info; + +- label_min = min_t(int, sizeof(info->volname) - 1, +- sizeof(subpart->name)); +- strscpy(info->volname, subpart->name, label_min); ++ strscpy(info->volname, subpart->name, sizeof(info->volname)); + + snprintf(tmp, sizeof(tmp), "(%s)", info->volname); + strlcat(state->pp_buf, tmp, PAGE_SIZE); +-- +2.43.0 + diff --git a/queue-6.6/block-refine-the-eof-check-in-blkdev_iomap_begin.patch b/queue-6.6/block-refine-the-eof-check-in-blkdev_iomap_begin.patch new file mode 100644 index 00000000000..09794dedd72 --- /dev/null +++ b/queue-6.6/block-refine-the-eof-check-in-blkdev_iomap_begin.patch @@ -0,0 +1,43 @@ +From 3b61b08a4ea76aeb9d5626a079089ed24f643ce6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 10:10:42 +0200 +Subject: block: refine the EOF check in blkdev_iomap_begin + +From: Christoph Hellwig + +[ Upstream commit 0c12028aec837f5a002009bbf68d179d506510e8 ] + +blkdev_iomap_begin rounds down the offset to the logical block size +before stashing it in iomap->offset and checking that it still is +inside the inode size. + +Check the i_size check to the raw pos value so that we don't try a +zero size write if iter->pos is unaligned. + +Fixes: 487c607df790 ("block: use iomap for writes to block devices") +Reported-by: syzbot+0a3683a0a6fecf909244@syzkaller.appspotmail.com +Signed-off-by: Christoph Hellwig +Tested-by: syzbot+0a3683a0a6fecf909244@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20240503081042.2078062-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/fops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/fops.c b/block/fops.c +index 73e42742543f6..1df187b306792 100644 +--- a/block/fops.c ++++ b/block/fops.c +@@ -387,7 +387,7 @@ static int blkdev_iomap_begin(struct inode *inode, loff_t offset, loff_t length, + + iomap->bdev = bdev; + iomap->offset = ALIGN_DOWN(offset, bdev_logical_block_size(bdev)); +- if (iomap->offset >= isize) ++ if (offset >= isize) + return -EIO; + iomap->type = IOMAP_MAPPED; + iomap->addr = iomap->offset; +-- +2.43.0 + diff --git a/queue-6.6/block-support-to-account-io_ticks-precisely.patch b/queue-6.6/block-support-to-account-io_ticks-precisely.patch new file mode 100644 index 00000000000..8795bef27bd --- /dev/null +++ b/queue-6.6/block-support-to-account-io_ticks-precisely.patch @@ -0,0 +1,152 @@ +From 61644276c0ea74bd3d523afff2f74971306ef6ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 20:37:16 +0800 +Subject: block: support to account io_ticks precisely + +From: Yu Kuai + +[ Upstream commit 99dc422335d8b2bd4d105797241d3e715bae90e9 ] + +Currently, io_ticks is accounted based on sampling, specifically +update_io_ticks() will always account io_ticks by 1 jiffies from +bdev_start_io_acct()/blk_account_io_start(), and the result can be +inaccurate, for example(HZ is 250): + +Test script: +fio -filename=/dev/sda -bs=4k -rw=write -direct=1 -name=test -thinktime=4ms + +Test result: util is about 90%, while the disk is really idle. + +This behaviour is introduced by commit 5b18b5a73760 ("block: delete +part_round_stats and switch to less precise counting"), however, there +was a key point that is missed that this patch also improve performance +a lot: + +Before the commit: +part_round_stats: + if (part->stamp != now) + stats |= 1; + + part_in_flight() + -> there can be lots of task here in 1 jiffies. + part_round_stats_single() + __part_stat_add() + part->stamp = now; + +After the commit: +update_io_ticks: + stamp = part->bd_stamp; + if (time_after(now, stamp)) + if (try_cmpxchg()) + __part_stat_add() + -> only one task can reach here in 1 jiffies. + +Hence in order to account io_ticks precisely, we only need to know if +there are IO inflight at most once in one jiffies. Noted that for +rq-based device, iterating tags should not be used here because +'tags->lock' is grabbed in blk_mq_find_and_get_req(), hence +part_stat_lock_inc/dec() and part_in_flight() is used to trace inflight. +The additional overhead is quite little: + + - per cpu add/dec for each IO for rq-based device; + - per cpu sum for each jiffies; + +And it's verified by null-blk that there are no performance degration +under heavy IO pressure. + +Fixes: 5b18b5a73760 ("block: delete part_round_stats and switch to less precise counting") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20240509123717.3223892-2-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 9 +++++---- + block/blk-merge.c | 2 ++ + block/blk-mq.c | 4 ++++ + block/blk.h | 1 + + block/genhd.c | 2 +- + 5 files changed, 13 insertions(+), 5 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index a3726d8cf8738..bf058cea9016a 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -950,10 +950,11 @@ void update_io_ticks(struct block_device *part, unsigned long now, bool end) + unsigned long stamp; + again: + stamp = READ_ONCE(part->bd_stamp); +- if (unlikely(time_after(now, stamp))) { +- if (likely(try_cmpxchg(&part->bd_stamp, &stamp, now))) +- __part_stat_add(part, io_ticks, end ? now - stamp : 1); +- } ++ if (unlikely(time_after(now, stamp)) && ++ likely(try_cmpxchg(&part->bd_stamp, &stamp, now)) && ++ (end || part_in_flight(part))) ++ __part_stat_add(part, io_ticks, now - stamp); ++ + if (part->bd_partno) { + part = bdev_whole(part); + goto again; +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 65e75efa9bd36..07bf758c523a9 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -783,6 +783,8 @@ static void blk_account_io_merge_request(struct request *req) + if (blk_do_io_stat(req)) { + part_stat_lock(); + part_stat_inc(req->part, merges[op_stat_group(req_op(req))]); ++ part_stat_local_dec(req->part, ++ in_flight[op_is_write(req_op(req))]); + part_stat_unlock(); + } + } +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 257b0addd47e5..4c91889affa7c 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -994,6 +994,8 @@ static inline void blk_account_io_done(struct request *req, u64 now) + update_io_ticks(req->part, jiffies, true); + part_stat_inc(req->part, ios[sgrp]); + part_stat_add(req->part, nsecs[sgrp], now - req->start_time_ns); ++ part_stat_local_dec(req->part, ++ in_flight[op_is_write(req_op(req))]); + part_stat_unlock(); + } + } +@@ -1016,6 +1018,8 @@ static inline void blk_account_io_start(struct request *req) + + part_stat_lock(); + update_io_ticks(req->part, jiffies, false); ++ part_stat_local_inc(req->part, ++ in_flight[op_is_write(req_op(req))]); + part_stat_unlock(); + } + } +diff --git a/block/blk.h b/block/blk.h +index 08a358bc0919e..67915b04b3c17 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -344,6 +344,7 @@ static inline bool blk_do_io_stat(struct request *rq) + } + + void update_io_ticks(struct block_device *part, unsigned long now, bool end); ++unsigned int part_in_flight(struct block_device *part); + + static inline void req_set_nomerge(struct request_queue *q, struct request *req) + { +diff --git a/block/genhd.c b/block/genhd.c +index 2ef1e08d70ecd..33b1ebf6ef82d 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -118,7 +118,7 @@ static void part_stat_read_all(struct block_device *part, + } + } + +-static unsigned int part_in_flight(struct block_device *part) ++unsigned int part_in_flight(struct block_device *part) + { + unsigned int inflight = 0; + int cpu; +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-compute-le-flow-credits-based-on-recvbuf-s.patch b/queue-6.6/bluetooth-compute-le-flow-credits-based-on-recvbuf-s.patch new file mode 100644 index 00000000000..0154c58beb0 --- /dev/null +++ b/queue-6.6/bluetooth-compute-le-flow-credits-based-on-recvbuf-s.patch @@ -0,0 +1,388 @@ +From 5732ffa4ea63306a00a1781d181ded10a061cb1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 12:08:58 +0200 +Subject: Bluetooth: compute LE flow credits based on recvbuf space + +From: Sebastian Urban + +[ Upstream commit ce60b9231b66710b6ee24042ded26efee120ecfc ] + +Previously LE flow credits were returned to the +sender even if the socket's receive buffer was +full. This meant that no back-pressure +was applied to the sender, thus it continued to +send data, resulting in data loss without any +error being reported. Furthermore, the amount +of credits was essentially fixed to a small +amount, leading to reduced performance. + +This is fixed by computing the number of returned +LE flow credits based on the estimated available +space in the receive buffer of an L2CAP socket. +Consequently, if the receive buffer is full, no +credits are returned until the buffer is read and +thus cleared by user-space. + +Since the computation of available receive buffer +space can only be performed approximately (due to +sk_buff overhead) and the receive buffer size may +be changed by user-space after flow credits have +been sent, superfluous received data is temporary +stored within l2cap_pinfo. This is necessary +because Bluetooth LE provides no retransmission +mechanism once the data has been acked by the +physical layer. + +If receive buffer space estimation is not possible +at the moment, we fall back to providing credits +for one full packet as before. This is currently +the case during connection setup, when MPS is not +yet available. + +Fixes: b1c325c23d75 ("Bluetooth: Implement returning of LE L2CAP credits") +Signed-off-by: Sebastian Urban +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/l2cap.h | 11 ++++- + net/bluetooth/l2cap_core.c | 56 ++++++++++++++++++--- + net/bluetooth/l2cap_sock.c | 91 ++++++++++++++++++++++++++++------- + 3 files changed, 132 insertions(+), 26 deletions(-) + +diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h +index 92d7197f9a563..d2a1154121d0d 100644 +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -548,6 +548,9 @@ struct l2cap_chan { + __u16 tx_credits; + __u16 rx_credits; + ++ /* estimated available receive buffer space or -1 if unknown */ ++ ssize_t rx_avail; ++ + __u8 tx_state; + __u8 rx_state; + +@@ -682,10 +685,15 @@ struct l2cap_user { + /* ----- L2CAP socket info ----- */ + #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk) + ++struct l2cap_rx_busy { ++ struct list_head list; ++ struct sk_buff *skb; ++}; ++ + struct l2cap_pinfo { + struct bt_sock bt; + struct l2cap_chan *chan; +- struct sk_buff *rx_busy_skb; ++ struct list_head rx_busy; + }; + + enum { +@@ -943,6 +951,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, + int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu); + int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len); + void l2cap_chan_busy(struct l2cap_chan *chan, int busy); ++void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail); + int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator); + void l2cap_chan_set_defaults(struct l2cap_chan *chan); + int l2cap_ertm_init(struct l2cap_chan *chan); +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index ab5d0204086fb..a754cf2c8ca8c 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -457,6 +457,9 @@ struct l2cap_chan *l2cap_chan_create(void) + /* Set default lock nesting level */ + atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL); + ++ /* Available receive buffer space is initially unknown */ ++ chan->rx_avail = -1; ++ + write_lock(&chan_list_lock); + list_add(&chan->global_l, &chan_list); + write_unlock(&chan_list_lock); +@@ -538,6 +541,28 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan) + } + EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults); + ++static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan) ++{ ++ size_t sdu_len = chan->sdu ? chan->sdu->len : 0; ++ ++ if (chan->mps == 0) ++ return 0; ++ ++ /* If we don't know the available space in the receiver buffer, give ++ * enough credits for a full packet. ++ */ ++ if (chan->rx_avail == -1) ++ return (chan->imtu / chan->mps) + 1; ++ ++ /* If we know how much space is available in the receive buffer, give ++ * out as many credits as would fill the buffer. ++ */ ++ if (chan->rx_avail <= sdu_len) ++ return 0; ++ ++ return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps); ++} ++ + static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits) + { + chan->sdu = NULL; +@@ -546,8 +571,7 @@ static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits) + chan->tx_credits = tx_credits; + /* Derive MPS from connection MTU to stop HCI fragmentation */ + chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE); +- /* Give enough credits for a full packet */ +- chan->rx_credits = (chan->imtu / chan->mps) + 1; ++ chan->rx_credits = l2cap_le_rx_credits(chan); + + skb_queue_head_init(&chan->tx_q); + } +@@ -559,7 +583,7 @@ static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits) + /* L2CAP implementations shall support a minimum MPS of 64 octets */ + if (chan->mps < L2CAP_ECRED_MIN_MPS) { + chan->mps = L2CAP_ECRED_MIN_MPS; +- chan->rx_credits = (chan->imtu / chan->mps) + 1; ++ chan->rx_credits = l2cap_le_rx_credits(chan); + } + } + +@@ -6513,9 +6537,7 @@ static void l2cap_chan_le_send_credits(struct l2cap_chan *chan) + { + struct l2cap_conn *conn = chan->conn; + struct l2cap_le_credits pkt; +- u16 return_credits; +- +- return_credits = (chan->imtu / chan->mps) + 1; ++ u16 return_credits = l2cap_le_rx_credits(chan); + + if (chan->rx_credits >= return_credits) + return; +@@ -6534,6 +6556,19 @@ static void l2cap_chan_le_send_credits(struct l2cap_chan *chan) + l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt); + } + ++void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail) ++{ ++ if (chan->rx_avail == rx_avail) ++ return; ++ ++ BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail); ++ ++ chan->rx_avail = rx_avail; ++ ++ if (chan->state == BT_CONNECTED) ++ l2cap_chan_le_send_credits(chan); ++} ++ + static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb) + { + int err; +@@ -6543,6 +6578,12 @@ static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb) + /* Wait recv to confirm reception before updating the credits */ + err = chan->ops->recv(chan, skb); + ++ if (err < 0 && chan->rx_avail != -1) { ++ BT_ERR("Queueing received LE L2CAP data failed"); ++ l2cap_send_disconn_req(chan, ECONNRESET); ++ return err; ++ } ++ + /* Update credits whenever an SDU is received */ + l2cap_chan_le_send_credits(chan); + +@@ -6565,7 +6606,8 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) + } + + chan->rx_credits--; +- BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits); ++ BT_DBG("chan %p: rx_credits %u -> %u", ++ chan, chan->rx_credits + 1, chan->rx_credits); + + /* Update if remote had run out of credits, this should only happens + * if the remote is not using the entire MPS. +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index d647bd15d5009..97d0a0f5829a6 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1142,6 +1142,34 @@ static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg, + return err; + } + ++static void l2cap_publish_rx_avail(struct l2cap_chan *chan) ++{ ++ struct sock *sk = chan->data; ++ ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc); ++ int expected_skbs, skb_overhead; ++ ++ if (avail <= 0) { ++ l2cap_chan_rx_avail(chan, 0); ++ return; ++ } ++ ++ if (!chan->mps) { ++ l2cap_chan_rx_avail(chan, -1); ++ return; ++ } ++ ++ /* Correct available memory by estimated sk_buff overhead. ++ * This is significant due to small transfer sizes. However, accept ++ * at least one full packet if receive space is non-zero. ++ */ ++ expected_skbs = DIV_ROUND_UP(avail, chan->mps); ++ skb_overhead = expected_skbs * sizeof(struct sk_buff); ++ if (skb_overhead < avail) ++ l2cap_chan_rx_avail(chan, avail - skb_overhead); ++ else ++ l2cap_chan_rx_avail(chan, -1); ++} ++ + static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, + size_t len, int flags) + { +@@ -1178,28 +1206,33 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, + else + err = bt_sock_recvmsg(sock, msg, len, flags); + +- if (pi->chan->mode != L2CAP_MODE_ERTM) ++ if (pi->chan->mode != L2CAP_MODE_ERTM && ++ pi->chan->mode != L2CAP_MODE_LE_FLOWCTL && ++ pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL) + return err; + +- /* Attempt to put pending rx data in the socket buffer */ +- + lock_sock(sk); + +- if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state)) +- goto done; ++ l2cap_publish_rx_avail(pi->chan); + +- if (pi->rx_busy_skb) { +- if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb)) +- pi->rx_busy_skb = NULL; +- else ++ /* Attempt to put pending rx data in the socket buffer */ ++ while (!list_empty(&pi->rx_busy)) { ++ struct l2cap_rx_busy *rx_busy = ++ list_first_entry(&pi->rx_busy, ++ struct l2cap_rx_busy, ++ list); ++ if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0) + goto done; ++ list_del(&rx_busy->list); ++ kfree(rx_busy); + } + + /* Restore data flow when half of the receive buffer is + * available. This avoids resending large numbers of + * frames. + */ +- if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1) ++ if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) && ++ atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1) + l2cap_chan_busy(pi->chan, 0); + + done: +@@ -1460,17 +1493,20 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) + static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) + { + struct sock *sk = chan->data; ++ struct l2cap_pinfo *pi = l2cap_pi(sk); + int err; + + lock_sock(sk); + +- if (l2cap_pi(sk)->rx_busy_skb) { ++ if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) { + err = -ENOMEM; + goto done; + } + + if (chan->mode != L2CAP_MODE_ERTM && +- chan->mode != L2CAP_MODE_STREAMING) { ++ chan->mode != L2CAP_MODE_STREAMING && ++ chan->mode != L2CAP_MODE_LE_FLOWCTL && ++ chan->mode != L2CAP_MODE_EXT_FLOWCTL) { + /* Even if no filter is attached, we could potentially + * get errors from security modules, etc. + */ +@@ -1481,7 +1517,9 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) + + err = __sock_queue_rcv_skb(sk, skb); + +- /* For ERTM, handle one skb that doesn't fit into the recv ++ l2cap_publish_rx_avail(chan); ++ ++ /* For ERTM and LE, handle a skb that doesn't fit into the recv + * buffer. This is important to do because the data frames + * have already been acked, so the skb cannot be discarded. + * +@@ -1490,8 +1528,18 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) + * acked and reassembled until there is buffer space + * available. + */ +- if (err < 0 && chan->mode == L2CAP_MODE_ERTM) { +- l2cap_pi(sk)->rx_busy_skb = skb; ++ if (err < 0 && ++ (chan->mode == L2CAP_MODE_ERTM || ++ chan->mode == L2CAP_MODE_LE_FLOWCTL || ++ chan->mode == L2CAP_MODE_EXT_FLOWCTL)) { ++ struct l2cap_rx_busy *rx_busy = ++ kmalloc(sizeof(*rx_busy), GFP_KERNEL); ++ if (!rx_busy) { ++ err = -ENOMEM; ++ goto done; ++ } ++ rx_busy->skb = skb; ++ list_add_tail(&rx_busy->list, &pi->rx_busy); + l2cap_chan_busy(chan, 1); + err = 0; + } +@@ -1717,6 +1765,8 @@ static const struct l2cap_ops l2cap_chan_ops = { + + static void l2cap_sock_destruct(struct sock *sk) + { ++ struct l2cap_rx_busy *rx_busy, *next; ++ + BT_DBG("sk %p", sk); + + if (l2cap_pi(sk)->chan) { +@@ -1724,9 +1774,10 @@ static void l2cap_sock_destruct(struct sock *sk) + l2cap_chan_put(l2cap_pi(sk)->chan); + } + +- if (l2cap_pi(sk)->rx_busy_skb) { +- kfree_skb(l2cap_pi(sk)->rx_busy_skb); +- l2cap_pi(sk)->rx_busy_skb = NULL; ++ list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) { ++ kfree_skb(rx_busy->skb); ++ list_del(&rx_busy->list); ++ kfree(rx_busy); + } + + skb_queue_purge(&sk->sk_receive_queue); +@@ -1810,6 +1861,8 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent) + + chan->data = sk; + chan->ops = &l2cap_chan_ops; ++ ++ l2cap_publish_rx_avail(chan); + } + + static struct proto l2cap_proto = { +@@ -1831,6 +1884,8 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, + sk->sk_destruct = l2cap_sock_destruct; + sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT; + ++ INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy); ++ + chan = l2cap_chan_create(); + if (!chan) { + sk_free(sk); +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-hci-remove-hci_amp-support.patch b/queue-6.6/bluetooth-hci-remove-hci_amp-support.patch new file mode 100644 index 00000000000..ba489747b02 --- /dev/null +++ b/queue-6.6/bluetooth-hci-remove-hci_amp-support.patch @@ -0,0 +1,1398 @@ +From 370d8bdc770e9cf17f6e991042e6a9824716171f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 18:33:52 -0400 +Subject: Bluetooth: HCI: Remove HCI_AMP support + +From: Luiz Augusto von Dentz + +[ Upstream commit 84a4bb6548a29326564f0e659fb8064503ecc1c7 ] + +Since BT_HS has been remove HCI_AMP controllers no longer has any use so +remove it along with the capability of creating AMP controllers. + +Since we no longer need to differentiate between AMP and Primary +controllers, as only HCI_PRIMARY is left, this also remove +hdev->dev_type altogether. + +Fixes: e7b02296fb40 ("Bluetooth: Remove BT_HS") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmrvl_main.c | 9 -- + drivers/bluetooth/btrsi.c | 1 - + drivers/bluetooth/btsdio.c | 8 -- + drivers/bluetooth/btusb.c | 5 -- + drivers/bluetooth/hci_bcm4377.c | 1 - + drivers/bluetooth/hci_ldisc.c | 6 -- + drivers/bluetooth/hci_serdev.c | 5 -- + drivers/bluetooth/hci_uart.h | 1 - + drivers/bluetooth/hci_vhci.c | 10 +-- + drivers/bluetooth/virtio_bt.c | 2 - + include/net/bluetooth/hci.h | 114 ------------------------ + include/net/bluetooth/hci_core.h | 46 +--------- + include/uapi/linux/virtio_bt.h | 1 - + net/bluetooth/hci_conn.c | 3 +- + net/bluetooth/hci_core.c | 132 +++------------------------ + net/bluetooth/hci_event.c | 147 ------------------------------- + net/bluetooth/hci_sock.c | 5 +- + net/bluetooth/hci_sync.c | 112 +---------------------- + net/bluetooth/l2cap_core.c | 21 +---- + net/bluetooth/mgmt.c | 84 ++++++------------ + 20 files changed, 49 insertions(+), 664 deletions(-) + +diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c +index 9658b33c824a7..18f34998a1204 100644 +--- a/drivers/bluetooth/btmrvl_main.c ++++ b/drivers/bluetooth/btmrvl_main.c +@@ -121,13 +121,6 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb) + ((event->data[2] == MODULE_BROUGHT_UP) || + (event->data[2] == MODULE_ALREADY_UP)) ? + "Bring-up succeed" : "Bring-up failed"); +- +- if (event->length > 3 && event->data[3]) +- priv->btmrvl_dev.dev_type = HCI_AMP; +- else +- priv->btmrvl_dev.dev_type = HCI_PRIMARY; +- +- BT_DBG("dev_type: %d", priv->btmrvl_dev.dev_type); + } else if (priv->btmrvl_dev.sendcmdflag && + event->data[1] == MODULE_SHUTDOWN_REQ) { + BT_DBG("EVENT:%s", (event->data[2]) ? +@@ -686,8 +679,6 @@ int btmrvl_register_hdev(struct btmrvl_private *priv) + hdev->wakeup = btmrvl_wakeup; + SET_HCIDEV_DEV(hdev, &card->func->dev); + +- hdev->dev_type = priv->btmrvl_dev.dev_type; +- + ret = hci_register_dev(hdev); + if (ret < 0) { + BT_ERR("Can not register HCI device"); +diff --git a/drivers/bluetooth/btrsi.c b/drivers/bluetooth/btrsi.c +index 634cf8f5ed2db..0c91d7635ac39 100644 +--- a/drivers/bluetooth/btrsi.c ++++ b/drivers/bluetooth/btrsi.c +@@ -134,7 +134,6 @@ static int rsi_hci_attach(void *priv, struct rsi_proto_ops *ops) + hdev->bus = HCI_USB; + + hci_set_drvdata(hdev, h_adapter); +- hdev->dev_type = HCI_PRIMARY; + hdev->open = rsi_hci_open; + hdev->close = rsi_hci_close; + hdev->flush = rsi_hci_flush; +diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c +index f19d31ee37ea8..fdcfe9c50313e 100644 +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -32,9 +32,6 @@ static const struct sdio_device_id btsdio_table[] = { + /* Generic Bluetooth Type-B SDIO device */ + { SDIO_DEVICE_CLASS(SDIO_CLASS_BT_B) }, + +- /* Generic Bluetooth AMP controller */ +- { SDIO_DEVICE_CLASS(SDIO_CLASS_BT_AMP) }, +- + { } /* Terminating entry */ + }; + +@@ -319,11 +316,6 @@ static int btsdio_probe(struct sdio_func *func, + hdev->bus = HCI_SDIO; + hci_set_drvdata(hdev, data); + +- if (id->class == SDIO_CLASS_BT_AMP) +- hdev->dev_type = HCI_AMP; +- else +- hdev->dev_type = HCI_PRIMARY; +- + data->hdev = hdev; + + SET_HCIDEV_DEV(hdev, &func->dev); +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index d178e1464bfd2..7c271f55a9b49 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -4308,11 +4308,6 @@ static int btusb_probe(struct usb_interface *intf, + hdev->bus = HCI_USB; + hci_set_drvdata(hdev, data); + +- if (id->driver_info & BTUSB_AMP) +- hdev->dev_type = HCI_AMP; +- else +- hdev->dev_type = HCI_PRIMARY; +- + data->hdev = hdev; + + SET_HCIDEV_DEV(hdev, &intf->dev); +diff --git a/drivers/bluetooth/hci_bcm4377.c b/drivers/bluetooth/hci_bcm4377.c +index 9a7243d5db71f..0c2f15235b4cd 100644 +--- a/drivers/bluetooth/hci_bcm4377.c ++++ b/drivers/bluetooth/hci_bcm4377.c +@@ -2361,7 +2361,6 @@ static int bcm4377_probe(struct pci_dev *pdev, const struct pci_device_id *id) + bcm4377->hdev = hdev; + + hdev->bus = HCI_PCI; +- hdev->dev_type = HCI_PRIMARY; + hdev->open = bcm4377_hci_open; + hdev->close = bcm4377_hci_close; + hdev->send = bcm4377_hci_send_frame; +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c +index a26367e9fb197..17a2f158a0dfa 100644 +--- a/drivers/bluetooth/hci_ldisc.c ++++ b/drivers/bluetooth/hci_ldisc.c +@@ -667,11 +667,6 @@ static int hci_uart_register_dev(struct hci_uart *hu) + if (!test_bit(HCI_UART_RESET_ON_INIT, &hu->hdev_flags)) + set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); + +- if (test_bit(HCI_UART_CREATE_AMP, &hu->hdev_flags)) +- hdev->dev_type = HCI_AMP; +- else +- hdev->dev_type = HCI_PRIMARY; +- + /* Only call open() for the protocol after hdev is fully initialized as + * open() (or a timer/workqueue it starts) may attempt to reference it. + */ +@@ -722,7 +717,6 @@ static int hci_uart_set_flags(struct hci_uart *hu, unsigned long flags) + { + unsigned long valid_flags = BIT(HCI_UART_RAW_DEVICE) | + BIT(HCI_UART_RESET_ON_INIT) | +- BIT(HCI_UART_CREATE_AMP) | + BIT(HCI_UART_INIT_PENDING) | + BIT(HCI_UART_EXT_CONFIG) | + BIT(HCI_UART_VND_DETECT); +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index 611a11fbb2f3a..1165831570e3c 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -366,11 +366,6 @@ int hci_uart_register_device_priv(struct hci_uart *hu, + if (test_bit(HCI_UART_EXT_CONFIG, &hu->hdev_flags)) + set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); + +- if (test_bit(HCI_UART_CREATE_AMP, &hu->hdev_flags)) +- hdev->dev_type = HCI_AMP; +- else +- hdev->dev_type = HCI_PRIMARY; +- + if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags)) + return 0; + +diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h +index 68c8c7e95d64d..00bf7ae82c5b7 100644 +--- a/drivers/bluetooth/hci_uart.h ++++ b/drivers/bluetooth/hci_uart.h +@@ -37,7 +37,6 @@ + + #define HCI_UART_RAW_DEVICE 0 + #define HCI_UART_RESET_ON_INIT 1 +-#define HCI_UART_CREATE_AMP 2 + #define HCI_UART_INIT_PENDING 3 + #define HCI_UART_EXT_CONFIG 4 + #define HCI_UART_VND_DETECT 5 +diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c +index 572d68d52965f..28750a40f0ed5 100644 +--- a/drivers/bluetooth/hci_vhci.c ++++ b/drivers/bluetooth/hci_vhci.c +@@ -384,17 +384,10 @@ static int __vhci_create_device(struct vhci_data *data, __u8 opcode) + { + struct hci_dev *hdev; + struct sk_buff *skb; +- __u8 dev_type; + + if (data->hdev) + return -EBADFD; + +- /* bits 0-1 are dev_type (Primary or AMP) */ +- dev_type = opcode & 0x03; +- +- if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP) +- return -EINVAL; +- + /* bits 2-5 are reserved (must be zero) */ + if (opcode & 0x3c) + return -EINVAL; +@@ -412,7 +405,6 @@ static int __vhci_create_device(struct vhci_data *data, __u8 opcode) + data->hdev = hdev; + + hdev->bus = HCI_VIRTUAL; +- hdev->dev_type = dev_type; + hci_set_drvdata(hdev, data); + + hdev->open = vhci_open_dev; +@@ -634,7 +626,7 @@ static void vhci_open_timeout(struct work_struct *work) + struct vhci_data *data = container_of(work, struct vhci_data, + open_timeout.work); + +- vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY); ++ vhci_create_device(data, 0x00); + } + + static int vhci_open(struct inode *inode, struct file *file) +diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c +index 2ac70b560c46d..18208e152a367 100644 +--- a/drivers/bluetooth/virtio_bt.c ++++ b/drivers/bluetooth/virtio_bt.c +@@ -274,7 +274,6 @@ static int virtbt_probe(struct virtio_device *vdev) + + switch (type) { + case VIRTIO_BT_CONFIG_TYPE_PRIMARY: +- case VIRTIO_BT_CONFIG_TYPE_AMP: + break; + default: + return -EINVAL; +@@ -303,7 +302,6 @@ static int virtbt_probe(struct virtio_device *vdev) + vbt->hdev = hdev; + + hdev->bus = HCI_VIRTIO; +- hdev->dev_type = type; + hci_set_drvdata(hdev, vbt); + + hdev->open = virtbt_open; +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index 7367ef7e92f52..d2a280a42f3b8 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -33,9 +33,6 @@ + #define HCI_MAX_FRAME_SIZE (HCI_MAX_ACL_SIZE + 4) + + #define HCI_LINK_KEY_SIZE 16 +-#define HCI_AMP_LINK_KEY_SIZE (2 * HCI_LINK_KEY_SIZE) +- +-#define HCI_MAX_AMP_ASSOC_SIZE 672 + + #define HCI_MAX_CPB_DATA_SIZE 252 + +@@ -71,26 +68,6 @@ + #define HCI_SMD 9 + #define HCI_VIRTIO 10 + +-/* HCI controller types */ +-#define HCI_PRIMARY 0x00 +-#define HCI_AMP 0x01 +- +-/* First BR/EDR Controller shall have ID = 0 */ +-#define AMP_ID_BREDR 0x00 +- +-/* AMP controller types */ +-#define AMP_TYPE_BREDR 0x00 +-#define AMP_TYPE_80211 0x01 +- +-/* AMP controller status */ +-#define AMP_STATUS_POWERED_DOWN 0x00 +-#define AMP_STATUS_BLUETOOTH_ONLY 0x01 +-#define AMP_STATUS_NO_CAPACITY 0x02 +-#define AMP_STATUS_LOW_CAPACITY 0x03 +-#define AMP_STATUS_MEDIUM_CAPACITY 0x04 +-#define AMP_STATUS_HIGH_CAPACITY 0x05 +-#define AMP_STATUS_FULL_CAPACITY 0x06 +- + /* HCI device quirks */ + enum { + /* When this quirk is set, the HCI Reset command is send when +@@ -526,7 +503,6 @@ enum { + #define ESCO_LINK 0x02 + /* Low Energy links do not have defined link type. Use invented one */ + #define LE_LINK 0x80 +-#define AMP_LINK 0x81 + #define ISO_LINK 0x82 + #define INVALID_LINK 0xff + +@@ -940,56 +916,6 @@ struct hci_cp_io_capability_neg_reply { + __u8 reason; + } __packed; + +-#define HCI_OP_CREATE_PHY_LINK 0x0435 +-struct hci_cp_create_phy_link { +- __u8 phy_handle; +- __u8 key_len; +- __u8 key_type; +- __u8 key[HCI_AMP_LINK_KEY_SIZE]; +-} __packed; +- +-#define HCI_OP_ACCEPT_PHY_LINK 0x0436 +-struct hci_cp_accept_phy_link { +- __u8 phy_handle; +- __u8 key_len; +- __u8 key_type; +- __u8 key[HCI_AMP_LINK_KEY_SIZE]; +-} __packed; +- +-#define HCI_OP_DISCONN_PHY_LINK 0x0437 +-struct hci_cp_disconn_phy_link { +- __u8 phy_handle; +- __u8 reason; +-} __packed; +- +-struct ext_flow_spec { +- __u8 id; +- __u8 stype; +- __le16 msdu; +- __le32 sdu_itime; +- __le32 acc_lat; +- __le32 flush_to; +-} __packed; +- +-#define HCI_OP_CREATE_LOGICAL_LINK 0x0438 +-#define HCI_OP_ACCEPT_LOGICAL_LINK 0x0439 +-struct hci_cp_create_accept_logical_link { +- __u8 phy_handle; +- struct ext_flow_spec tx_flow_spec; +- struct ext_flow_spec rx_flow_spec; +-} __packed; +- +-#define HCI_OP_DISCONN_LOGICAL_LINK 0x043a +-struct hci_cp_disconn_logical_link { +- __le16 log_handle; +-} __packed; +- +-#define HCI_OP_LOGICAL_LINK_CANCEL 0x043b +-struct hci_cp_logical_link_cancel { +- __u8 phy_handle; +- __u8 flow_spec_id; +-} __packed; +- + #define HCI_OP_ENHANCED_SETUP_SYNC_CONN 0x043d + struct hci_coding_format { + __u8 id; +@@ -1611,46 +1537,6 @@ struct hci_rp_read_enc_key_size { + __u8 key_size; + } __packed; + +-#define HCI_OP_READ_LOCAL_AMP_INFO 0x1409 +-struct hci_rp_read_local_amp_info { +- __u8 status; +- __u8 amp_status; +- __le32 total_bw; +- __le32 max_bw; +- __le32 min_latency; +- __le32 max_pdu; +- __u8 amp_type; +- __le16 pal_cap; +- __le16 max_assoc_size; +- __le32 max_flush_to; +- __le32 be_flush_to; +-} __packed; +- +-#define HCI_OP_READ_LOCAL_AMP_ASSOC 0x140a +-struct hci_cp_read_local_amp_assoc { +- __u8 phy_handle; +- __le16 len_so_far; +- __le16 max_len; +-} __packed; +-struct hci_rp_read_local_amp_assoc { +- __u8 status; +- __u8 phy_handle; +- __le16 rem_len; +- __u8 frag[]; +-} __packed; +- +-#define HCI_OP_WRITE_REMOTE_AMP_ASSOC 0x140b +-struct hci_cp_write_remote_amp_assoc { +- __u8 phy_handle; +- __le16 len_so_far; +- __le16 rem_len; +- __u8 frag[]; +-} __packed; +-struct hci_rp_write_remote_amp_assoc { +- __u8 status; +- __u8 phy_handle; +-} __packed; +- + #define HCI_OP_GET_MWS_TRANSPORT_CONFIG 0x140c + + #define HCI_OP_ENABLE_DUT_MODE 0x1803 +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index b5b0a1e1bba02..f786d2d62fa5e 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -126,7 +126,6 @@ enum suspended_state { + struct hci_conn_hash { + struct list_head list; + unsigned int acl_num; +- unsigned int amp_num; + unsigned int sco_num; + unsigned int iso_num; + unsigned int le_num; +@@ -341,14 +340,6 @@ struct adv_monitor { + /* Default authenticated payload timeout 30s */ + #define DEFAULT_AUTH_PAYLOAD_TIMEOUT 0x0bb8 + +-struct amp_assoc { +- __u16 len; +- __u16 offset; +- __u16 rem_len; +- __u16 len_so_far; +- __u8 data[HCI_MAX_AMP_ASSOC_SIZE]; +-}; +- + #define HCI_MAX_PAGES 3 + + struct hci_dev { +@@ -361,7 +352,6 @@ struct hci_dev { + unsigned long flags; + __u16 id; + __u8 bus; +- __u8 dev_type; + bdaddr_t bdaddr; + bdaddr_t setup_addr; + bdaddr_t public_addr; +@@ -467,21 +457,6 @@ struct hci_dev { + __u16 sniff_min_interval; + __u16 sniff_max_interval; + +- __u8 amp_status; +- __u32 amp_total_bw; +- __u32 amp_max_bw; +- __u32 amp_min_latency; +- __u32 amp_max_pdu; +- __u8 amp_type; +- __u16 amp_pal_cap; +- __u16 amp_assoc_size; +- __u32 amp_max_flush_to; +- __u32 amp_be_flush_to; +- +- struct amp_assoc loc_assoc; +- +- __u8 flow_ctl_mode; +- + unsigned int auto_accept_delay; + + unsigned long quirks; +@@ -501,11 +476,6 @@ struct hci_dev { + unsigned int le_pkts; + unsigned int iso_pkts; + +- __u16 block_len; +- __u16 block_mtu; +- __u16 num_blocks; +- __u16 block_cnt; +- + unsigned long acl_last_tx; + unsigned long sco_last_tx; + unsigned long le_last_tx; +@@ -776,7 +746,6 @@ struct hci_conn { + void *l2cap_data; + void *sco_data; + void *iso_data; +- struct amp_mgr *amp_mgr; + + struct list_head link_list; + struct hci_conn *parent; +@@ -803,7 +772,6 @@ struct hci_chan { + struct sk_buff_head data_q; + unsigned int sent; + __u8 state; +- bool amp; + }; + + struct hci_conn_params { +@@ -1012,9 +980,6 @@ static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c) + case ACL_LINK: + h->acl_num++; + break; +- case AMP_LINK: +- h->amp_num++; +- break; + case LE_LINK: + h->le_num++; + if (c->role == HCI_ROLE_SLAVE) +@@ -1041,9 +1006,6 @@ static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c) + case ACL_LINK: + h->acl_num--; + break; +- case AMP_LINK: +- h->amp_num--; +- break; + case LE_LINK: + h->le_num--; + if (c->role == HCI_ROLE_SLAVE) +@@ -1065,8 +1027,6 @@ static inline unsigned int hci_conn_num(struct hci_dev *hdev, __u8 type) + switch (type) { + case ACL_LINK: + return h->acl_num; +- case AMP_LINK: +- return h->amp_num; + case LE_LINK: + return h->le_num; + case SCO_LINK: +@@ -1083,7 +1043,7 @@ static inline unsigned int hci_conn_count(struct hci_dev *hdev) + { + struct hci_conn_hash *c = &hdev->conn_hash; + +- return c->acl_num + c->amp_num + c->sco_num + c->le_num + c->iso_num; ++ return c->acl_num + c->sco_num + c->le_num + c->iso_num; + } + + static inline __u8 hci_conn_lookup_type(struct hci_dev *hdev, __u16 handle) +@@ -1569,10 +1529,6 @@ static inline void hci_conn_drop(struct hci_conn *conn) + } + break; + +- case AMP_LINK: +- timeo = conn->disc_timeout; +- break; +- + default: + timeo = 0; + break; +diff --git a/include/uapi/linux/virtio_bt.h b/include/uapi/linux/virtio_bt.h +index af798f4c96804..3cc7d633456b6 100644 +--- a/include/uapi/linux/virtio_bt.h ++++ b/include/uapi/linux/virtio_bt.h +@@ -13,7 +13,6 @@ + + enum virtio_bt_config_type { + VIRTIO_BT_CONFIG_TYPE_PRIMARY = 0, +- VIRTIO_BT_CONFIG_TYPE_AMP = 1, + }; + + enum virtio_bt_config_vendor { +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 707c7710d84ec..163b56a68bb04 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1200,8 +1200,7 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type) + + list_for_each_entry(d, &hci_dev_list, list) { + if (!test_bit(HCI_UP, &d->flags) || +- hci_dev_test_flag(d, HCI_USER_CHANNEL) || +- d->dev_type != HCI_PRIMARY) ++ hci_dev_test_flag(d, HCI_USER_CHANNEL)) + continue; + + /* Simple routing: +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 101ea9137dfef..3817d6369f0cc 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -395,11 +395,6 @@ int hci_inquiry(void __user *arg) + goto done; + } + +- if (hdev->dev_type != HCI_PRIMARY) { +- err = -EOPNOTSUPP; +- goto done; +- } +- + if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { + err = -EOPNOTSUPP; + goto done; +@@ -752,11 +747,6 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg) + goto done; + } + +- if (hdev->dev_type != HCI_PRIMARY) { +- err = -EOPNOTSUPP; +- goto done; +- } +- + if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { + err = -EOPNOTSUPP; + goto done; +@@ -910,7 +900,7 @@ int hci_get_dev_info(void __user *arg) + + strscpy(di.name, hdev->name, sizeof(di.name)); + di.bdaddr = hdev->bdaddr; +- di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4); ++ di.type = (hdev->bus & 0x0f); + di.flags = flags; + di.pkt_type = hdev->pkt_type; + if (lmp_bredr_capable(hdev)) { +@@ -995,8 +985,7 @@ static void hci_power_on(struct work_struct *work) + */ + if (hci_dev_test_flag(hdev, HCI_RFKILLED) || + hci_dev_test_flag(hdev, HCI_UNCONFIGURED) || +- (hdev->dev_type == HCI_PRIMARY && +- !bacmp(&hdev->bdaddr, BDADDR_ANY) && ++ (!bacmp(&hdev->bdaddr, BDADDR_ANY) && + !bacmp(&hdev->static_addr, BDADDR_ANY))) { + hci_dev_clear_flag(hdev, HCI_AUTO_OFF); + hci_dev_do_close(hdev); +@@ -2604,21 +2593,7 @@ int hci_register_dev(struct hci_dev *hdev) + if (!hdev->open || !hdev->close || !hdev->send) + return -EINVAL; + +- /* Do not allow HCI_AMP devices to register at index 0, +- * so the index can be used as the AMP controller ID. +- */ +- switch (hdev->dev_type) { +- case HCI_PRIMARY: +- id = ida_alloc_max(&hci_index_ida, HCI_MAX_ID - 1, GFP_KERNEL); +- break; +- case HCI_AMP: +- id = ida_alloc_range(&hci_index_ida, 1, HCI_MAX_ID - 1, +- GFP_KERNEL); +- break; +- default: +- return -EINVAL; +- } +- ++ id = ida_alloc_max(&hci_index_ida, HCI_MAX_ID - 1, GFP_KERNEL); + if (id < 0) + return id; + +@@ -2670,12 +2645,10 @@ int hci_register_dev(struct hci_dev *hdev) + hci_dev_set_flag(hdev, HCI_SETUP); + hci_dev_set_flag(hdev, HCI_AUTO_OFF); + +- if (hdev->dev_type == HCI_PRIMARY) { +- /* Assume BR/EDR support until proven otherwise (such as +- * through reading supported features during init. +- */ +- hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); +- } ++ /* Assume BR/EDR support until proven otherwise (such as ++ * through reading supported features during init. ++ */ ++ hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); + + write_lock(&hci_dev_list_lock); + list_add(&hdev->list, &hci_dev_list); +@@ -3211,17 +3184,7 @@ static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue, + + hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT; + +- switch (hdev->dev_type) { +- case HCI_PRIMARY: +- hci_add_acl_hdr(skb, conn->handle, flags); +- break; +- case HCI_AMP: +- hci_add_acl_hdr(skb, chan->handle, flags); +- break; +- default: +- bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type); +- return; +- } ++ hci_add_acl_hdr(skb, conn->handle, flags); + + list = skb_shinfo(skb)->frag_list; + if (!list) { +@@ -3381,9 +3344,6 @@ static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote) + case ACL_LINK: + cnt = hdev->acl_cnt; + break; +- case AMP_LINK: +- cnt = hdev->block_cnt; +- break; + case SCO_LINK: + case ESCO_LINK: + cnt = hdev->sco_cnt; +@@ -3581,12 +3541,6 @@ static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type) + + } + +-static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb) +-{ +- /* Calculate count of blocks used by this packet */ +- return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len); +-} +- + static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type) + { + unsigned long last_tx; +@@ -3700,81 +3654,15 @@ static void hci_sched_acl_pkt(struct hci_dev *hdev) + hci_prio_recalculate(hdev, ACL_LINK); + } + +-static void hci_sched_acl_blk(struct hci_dev *hdev) +-{ +- unsigned int cnt = hdev->block_cnt; +- struct hci_chan *chan; +- struct sk_buff *skb; +- int quote; +- u8 type; +- +- BT_DBG("%s", hdev->name); +- +- if (hdev->dev_type == HCI_AMP) +- type = AMP_LINK; +- else +- type = ACL_LINK; +- +- __check_timeout(hdev, cnt, type); +- +- while (hdev->block_cnt > 0 && +- (chan = hci_chan_sent(hdev, type, "e))) { +- u32 priority = (skb_peek(&chan->data_q))->priority; +- while (quote > 0 && (skb = skb_peek(&chan->data_q))) { +- int blocks; +- +- BT_DBG("chan %p skb %p len %d priority %u", chan, skb, +- skb->len, skb->priority); +- +- /* Stop if priority has changed */ +- if (skb->priority < priority) +- break; +- +- skb = skb_dequeue(&chan->data_q); +- +- blocks = __get_blocks(hdev, skb); +- if (blocks > hdev->block_cnt) +- return; +- +- hci_conn_enter_active_mode(chan->conn, +- bt_cb(skb)->force_active); +- +- hci_send_frame(hdev, skb); +- hdev->acl_last_tx = jiffies; +- +- hdev->block_cnt -= blocks; +- quote -= blocks; +- +- chan->sent += blocks; +- chan->conn->sent += blocks; +- } +- } +- +- if (cnt != hdev->block_cnt) +- hci_prio_recalculate(hdev, type); +-} +- + static void hci_sched_acl(struct hci_dev *hdev) + { + BT_DBG("%s", hdev->name); + + /* No ACL link over BR/EDR controller */ +- if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY) +- return; +- +- /* No AMP link over AMP controller */ +- if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP) ++ if (!hci_conn_num(hdev, ACL_LINK)) + return; + +- switch (hdev->flow_ctl_mode) { +- case HCI_FLOW_CTL_MODE_PACKET_BASED: +- hci_sched_acl_pkt(hdev); +- break; +- +- case HCI_FLOW_CTL_MODE_BLOCK_BASED: +- hci_sched_acl_blk(hdev); +- break; +- } ++ hci_sched_acl_pkt(hdev); + } + + static void hci_sched_le(struct hci_dev *hdev) +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index d357ec131aa5a..6ce4f812503f4 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -917,21 +917,6 @@ static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data, + return rp->status; + } + +-static u8 hci_cc_read_flow_control_mode(struct hci_dev *hdev, void *data, +- struct sk_buff *skb) +-{ +- struct hci_rp_read_flow_control_mode *rp = data; +- +- bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); +- +- if (rp->status) +- return rp->status; +- +- hdev->flow_ctl_mode = rp->mode; +- +- return rp->status; +-} +- + static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data, + struct sk_buff *skb) + { +@@ -1075,28 +1060,6 @@ static u8 hci_cc_write_page_scan_type(struct hci_dev *hdev, void *data, + return rp->status; + } + +-static u8 hci_cc_read_data_block_size(struct hci_dev *hdev, void *data, +- struct sk_buff *skb) +-{ +- struct hci_rp_read_data_block_size *rp = data; +- +- bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); +- +- if (rp->status) +- return rp->status; +- +- hdev->block_mtu = __le16_to_cpu(rp->max_acl_len); +- hdev->block_len = __le16_to_cpu(rp->block_len); +- hdev->num_blocks = __le16_to_cpu(rp->num_blocks); +- +- hdev->block_cnt = hdev->num_blocks; +- +- BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu, +- hdev->block_cnt, hdev->block_len); +- +- return rp->status; +-} +- + static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data, + struct sk_buff *skb) + { +@@ -1131,30 +1094,6 @@ static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data, + return rp->status; + } + +-static u8 hci_cc_read_local_amp_info(struct hci_dev *hdev, void *data, +- struct sk_buff *skb) +-{ +- struct hci_rp_read_local_amp_info *rp = data; +- +- bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); +- +- if (rp->status) +- return rp->status; +- +- hdev->amp_status = rp->amp_status; +- hdev->amp_total_bw = __le32_to_cpu(rp->total_bw); +- hdev->amp_max_bw = __le32_to_cpu(rp->max_bw); +- hdev->amp_min_latency = __le32_to_cpu(rp->min_latency); +- hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu); +- hdev->amp_type = rp->amp_type; +- hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap); +- hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size); +- hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to); +- hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to); +- +- return rp->status; +-} +- + static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data, + struct sk_buff *skb) + { +@@ -4134,12 +4073,6 @@ static const struct hci_cc { + HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type, + sizeof(struct hci_rp_read_page_scan_type)), + HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type), +- HCI_CC(HCI_OP_READ_DATA_BLOCK_SIZE, hci_cc_read_data_block_size, +- sizeof(struct hci_rp_read_data_block_size)), +- HCI_CC(HCI_OP_READ_FLOW_CONTROL_MODE, hci_cc_read_flow_control_mode, +- sizeof(struct hci_rp_read_flow_control_mode)), +- HCI_CC(HCI_OP_READ_LOCAL_AMP_INFO, hci_cc_read_local_amp_info, +- sizeof(struct hci_rp_read_local_amp_info)), + HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock, + sizeof(struct hci_rp_read_clock)), + HCI_CC(HCI_OP_READ_ENC_KEY_SIZE, hci_cc_read_enc_key_size, +@@ -4474,11 +4407,6 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data, + flex_array_size(ev, handles, ev->num))) + return; + +- if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) { +- bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode); +- return; +- } +- + bt_dev_dbg(hdev, "num %d", ev->num); + + for (i = 0; i < ev->num; i++) { +@@ -4546,78 +4474,6 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data, + queue_work(hdev->workqueue, &hdev->tx_work); + } + +-static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev, +- __u16 handle) +-{ +- struct hci_chan *chan; +- +- switch (hdev->dev_type) { +- case HCI_PRIMARY: +- return hci_conn_hash_lookup_handle(hdev, handle); +- case HCI_AMP: +- chan = hci_chan_lookup_handle(hdev, handle); +- if (chan) +- return chan->conn; +- break; +- default: +- bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type); +- break; +- } +- +- return NULL; +-} +- +-static void hci_num_comp_blocks_evt(struct hci_dev *hdev, void *data, +- struct sk_buff *skb) +-{ +- struct hci_ev_num_comp_blocks *ev = data; +- int i; +- +- if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_BLOCKS, +- flex_array_size(ev, handles, ev->num_hndl))) +- return; +- +- if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) { +- bt_dev_err(hdev, "wrong event for mode %d", +- hdev->flow_ctl_mode); +- return; +- } +- +- bt_dev_dbg(hdev, "num_blocks %d num_hndl %d", ev->num_blocks, +- ev->num_hndl); +- +- for (i = 0; i < ev->num_hndl; i++) { +- struct hci_comp_blocks_info *info = &ev->handles[i]; +- struct hci_conn *conn = NULL; +- __u16 handle, block_count; +- +- handle = __le16_to_cpu(info->handle); +- block_count = __le16_to_cpu(info->blocks); +- +- conn = __hci_conn_lookup_handle(hdev, handle); +- if (!conn) +- continue; +- +- conn->sent -= block_count; +- +- switch (conn->type) { +- case ACL_LINK: +- case AMP_LINK: +- hdev->block_cnt += block_count; +- if (hdev->block_cnt > hdev->num_blocks) +- hdev->block_cnt = hdev->num_blocks; +- break; +- +- default: +- bt_dev_err(hdev, "unknown type %d conn %p", +- conn->type, conn); +- break; +- } +- } +- +- queue_work(hdev->workqueue, &hdev->tx_work); +-} +- + static void hci_mode_change_evt(struct hci_dev *hdev, void *data, + struct sk_buff *skb) + { +@@ -7531,9 +7387,6 @@ static const struct hci_ev { + /* [0x3e = HCI_EV_LE_META] */ + HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt, + sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE), +- /* [0x48 = HCI_EV_NUM_COMP_BLOCKS] */ +- HCI_EV(HCI_EV_NUM_COMP_BLOCKS, hci_num_comp_blocks_evt, +- sizeof(struct hci_ev_num_comp_blocks)), + /* [0xff = HCI_EV_VENDOR] */ + HCI_EV_VL(HCI_EV_VENDOR, msft_vendor_evt, 0, HCI_MAX_EVENT_SIZE), + }; +diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c +index 4ee1b976678b2..3d904ca92e9e8 100644 +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -485,7 +485,7 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event) + return NULL; + + ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE); +- ni->type = hdev->dev_type; ++ ni->type = 0x00; /* Old hdev->dev_type */ + ni->bus = hdev->bus; + bacpy(&ni->bdaddr, &hdev->bdaddr); + memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name, +@@ -1007,9 +1007,6 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, + if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) + return -EOPNOTSUPP; + +- if (hdev->dev_type != HCI_PRIMARY) +- return -EOPNOTSUPP; +- + switch (cmd) { + case HCISETRAW: + if (!capable(CAP_NET_ADMIN)) +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 40f5324e1e66f..d7ca5bd8ba3b0 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -3440,10 +3440,6 @@ static int hci_unconf_init_sync(struct hci_dev *hdev) + /* Read Local Supported Features. */ + static int hci_read_local_features_sync(struct hci_dev *hdev) + { +- /* Not all AMP controllers support this command */ +- if (hdev->dev_type == HCI_AMP && !(hdev->commands[14] & 0x20)) +- return 0; +- + return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_FEATURES, + 0, NULL, HCI_CMD_TIMEOUT); + } +@@ -3478,51 +3474,6 @@ static int hci_read_local_cmds_sync(struct hci_dev *hdev) + return 0; + } + +-/* Read Local AMP Info */ +-static int hci_read_local_amp_info_sync(struct hci_dev *hdev) +-{ +- return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_AMP_INFO, +- 0, NULL, HCI_CMD_TIMEOUT); +-} +- +-/* Read Data Blk size */ +-static int hci_read_data_block_size_sync(struct hci_dev *hdev) +-{ +- return __hci_cmd_sync_status(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, +- 0, NULL, HCI_CMD_TIMEOUT); +-} +- +-/* Read Flow Control Mode */ +-static int hci_read_flow_control_mode_sync(struct hci_dev *hdev) +-{ +- return __hci_cmd_sync_status(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, +- 0, NULL, HCI_CMD_TIMEOUT); +-} +- +-/* Read Location Data */ +-static int hci_read_location_data_sync(struct hci_dev *hdev) +-{ +- return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCATION_DATA, +- 0, NULL, HCI_CMD_TIMEOUT); +-} +- +-/* AMP Controller init stage 1 command sequence */ +-static const struct hci_init_stage amp_init1[] = { +- /* HCI_OP_READ_LOCAL_VERSION */ +- HCI_INIT(hci_read_local_version_sync), +- /* HCI_OP_READ_LOCAL_COMMANDS */ +- HCI_INIT(hci_read_local_cmds_sync), +- /* HCI_OP_READ_LOCAL_AMP_INFO */ +- HCI_INIT(hci_read_local_amp_info_sync), +- /* HCI_OP_READ_DATA_BLOCK_SIZE */ +- HCI_INIT(hci_read_data_block_size_sync), +- /* HCI_OP_READ_FLOW_CONTROL_MODE */ +- HCI_INIT(hci_read_flow_control_mode_sync), +- /* HCI_OP_READ_LOCATION_DATA */ +- HCI_INIT(hci_read_location_data_sync), +- {} +-}; +- + static int hci_init1_sync(struct hci_dev *hdev) + { + int err; +@@ -3536,28 +3487,9 @@ static int hci_init1_sync(struct hci_dev *hdev) + return err; + } + +- switch (hdev->dev_type) { +- case HCI_PRIMARY: +- hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED; +- return hci_init_stage_sync(hdev, br_init1); +- case HCI_AMP: +- hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED; +- return hci_init_stage_sync(hdev, amp_init1); +- default: +- bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type); +- break; +- } +- +- return 0; ++ return hci_init_stage_sync(hdev, br_init1); + } + +-/* AMP Controller init stage 2 command sequence */ +-static const struct hci_init_stage amp_init2[] = { +- /* HCI_OP_READ_LOCAL_FEATURES */ +- HCI_INIT(hci_read_local_features_sync), +- {} +-}; +- + /* Read Buffer Size (ACL mtu, max pkt, etc.) */ + static int hci_read_buffer_size_sync(struct hci_dev *hdev) + { +@@ -3815,9 +3747,6 @@ static int hci_init2_sync(struct hci_dev *hdev) + + bt_dev_dbg(hdev, ""); + +- if (hdev->dev_type == HCI_AMP) +- return hci_init_stage_sync(hdev, amp_init2); +- + err = hci_init_stage_sync(hdev, hci_init2); + if (err) + return err; +@@ -4655,13 +4584,6 @@ static int hci_init_sync(struct hci_dev *hdev) + if (err < 0) + return err; + +- /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode +- * BR/EDR/LE type controllers. AMP controllers only need the +- * first two stages of init. +- */ +- if (hdev->dev_type != HCI_PRIMARY) +- return 0; +- + err = hci_init3_sync(hdev); + if (err < 0) + return err; +@@ -4890,12 +4812,8 @@ int hci_dev_open_sync(struct hci_dev *hdev) + * In case of user channel usage, it is not important + * if a public address or static random address is + * available. +- * +- * This check is only valid for BR/EDR controllers +- * since AMP controllers do not have an address. + */ + if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && +- hdev->dev_type == HCI_PRIMARY && + !bacmp(&hdev->bdaddr, BDADDR_ANY) && + !bacmp(&hdev->static_addr, BDADDR_ANY)) { + ret = -EADDRNOTAVAIL; +@@ -4930,8 +4848,7 @@ int hci_dev_open_sync(struct hci_dev *hdev) + !hci_dev_test_flag(hdev, HCI_CONFIG) && + !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && + !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && +- hci_dev_test_flag(hdev, HCI_MGMT) && +- hdev->dev_type == HCI_PRIMARY) { ++ hci_dev_test_flag(hdev, HCI_MGMT)) { + ret = hci_powered_update_sync(hdev); + mgmt_power_on(hdev, ret); + } +@@ -5077,8 +4994,7 @@ int hci_dev_close_sync(struct hci_dev *hdev) + + auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF); + +- if (!auto_off && hdev->dev_type == HCI_PRIMARY && +- !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && ++ if (!auto_off && !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && + hci_dev_test_flag(hdev, HCI_MGMT)) + __mgmt_power_off(hdev); + +@@ -5140,9 +5056,6 @@ int hci_dev_close_sync(struct hci_dev *hdev) + hdev->flags &= BIT(HCI_RAW); + hci_dev_clear_volatile_flags(hdev); + +- /* Controller radio is available but is currently powered down */ +- hdev->amp_status = AMP_STATUS_POWERED_DOWN; +- + memset(hdev->eir, 0, sizeof(hdev->eir)); + memset(hdev->dev_class, 0, sizeof(hdev->dev_class)); + bacpy(&hdev->random_addr, BDADDR_ANY); +@@ -5179,8 +5092,7 @@ static int hci_power_on_sync(struct hci_dev *hdev) + */ + if (hci_dev_test_flag(hdev, HCI_RFKILLED) || + hci_dev_test_flag(hdev, HCI_UNCONFIGURED) || +- (hdev->dev_type == HCI_PRIMARY && +- !bacmp(&hdev->bdaddr, BDADDR_ANY) && ++ (!bacmp(&hdev->bdaddr, BDADDR_ANY) && + !bacmp(&hdev->static_addr, BDADDR_ANY))) { + hci_dev_clear_flag(hdev, HCI_AUTO_OFF); + hci_dev_close_sync(hdev); +@@ -5283,27 +5195,11 @@ int hci_stop_discovery_sync(struct hci_dev *hdev) + return 0; + } + +-static int hci_disconnect_phy_link_sync(struct hci_dev *hdev, u16 handle, +- u8 reason) +-{ +- struct hci_cp_disconn_phy_link cp; +- +- memset(&cp, 0, sizeof(cp)); +- cp.phy_handle = HCI_PHY_HANDLE(handle); +- cp.reason = reason; +- +- return __hci_cmd_sync_status(hdev, HCI_OP_DISCONN_PHY_LINK, +- sizeof(cp), &cp, HCI_CMD_TIMEOUT); +-} +- + static int hci_disconnect_sync(struct hci_dev *hdev, struct hci_conn *conn, + u8 reason) + { + struct hci_cp_disconnect cp; + +- if (conn->type == AMP_LINK) +- return hci_disconnect_phy_link_sync(hdev, conn->handle, reason); +- + if (test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) { + /* This is a BIS connection, hci_conn_del will + * do the necessary cleanup. +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index a754cf2c8ca8c..37210567fbfbe 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -3930,7 +3930,7 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, + } + + static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, +- u8 *data, u8 rsp_code, u8 amp_id) ++ u8 *data, u8 rsp_code) + { + struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; + struct l2cap_conn_rsp rsp; +@@ -4009,17 +4009,8 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, + status = L2CAP_CS_AUTHOR_PEND; + chan->ops->defer(chan); + } else { +- /* Force pending result for AMP controllers. +- * The connection will succeed after the +- * physical link is up. +- */ +- if (amp_id == AMP_ID_BREDR) { +- l2cap_state_change(chan, BT_CONFIG); +- result = L2CAP_CR_SUCCESS; +- } else { +- l2cap_state_change(chan, BT_CONNECT2); +- result = L2CAP_CR_PEND; +- } ++ l2cap_state_change(chan, BT_CONNECT2); ++ result = L2CAP_CR_PEND; + status = L2CAP_CS_NO_INFO; + } + } else { +@@ -4084,7 +4075,7 @@ static int l2cap_connect_req(struct l2cap_conn *conn, + mgmt_device_connected(hdev, hcon, NULL, 0); + hci_dev_unlock(hdev); + +- l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0); ++ l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP); + return 0; + } + +@@ -7497,10 +7488,6 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + struct l2cap_conn *conn = hcon->l2cap_data; + int len; + +- /* For AMP controller do not create l2cap conn */ +- if (!conn && hcon->hdev->dev_type != HCI_PRIMARY) +- goto drop; +- + if (!conn) + conn = l2cap_conn_add(hcon); + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index ac693e64f1f9f..0ca6593a029c0 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -443,8 +443,7 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, + + count = 0; + list_for_each_entry(d, &hci_dev_list, list) { +- if (d->dev_type == HCI_PRIMARY && +- !hci_dev_test_flag(d, HCI_UNCONFIGURED)) ++ if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) + count++; + } + +@@ -468,8 +467,7 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, + if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) + continue; + +- if (d->dev_type == HCI_PRIMARY && +- !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { ++ if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { + rp->index[count++] = cpu_to_le16(d->id); + bt_dev_dbg(hdev, "Added hci%u", d->id); + } +@@ -503,8 +501,7 @@ static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, + + count = 0; + list_for_each_entry(d, &hci_dev_list, list) { +- if (d->dev_type == HCI_PRIMARY && +- hci_dev_test_flag(d, HCI_UNCONFIGURED)) ++ if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) + count++; + } + +@@ -528,8 +525,7 @@ static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, + if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) + continue; + +- if (d->dev_type == HCI_PRIMARY && +- hci_dev_test_flag(d, HCI_UNCONFIGURED)) { ++ if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { + rp->index[count++] = cpu_to_le16(d->id); + bt_dev_dbg(hdev, "Added hci%u", d->id); + } +@@ -561,10 +557,8 @@ static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, + read_lock(&hci_dev_list_lock); + + count = 0; +- list_for_each_entry(d, &hci_dev_list, list) { +- if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) +- count++; +- } ++ list_for_each_entry(d, &hci_dev_list, list) ++ count++; + + rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); + if (!rp) { +@@ -585,16 +579,10 @@ static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, + if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) + continue; + +- if (d->dev_type == HCI_PRIMARY) { +- if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) +- rp->entry[count].type = 0x01; +- else +- rp->entry[count].type = 0x00; +- } else if (d->dev_type == HCI_AMP) { +- rp->entry[count].type = 0x02; +- } else { +- continue; +- } ++ if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) ++ rp->entry[count].type = 0x01; ++ else ++ rp->entry[count].type = 0x00; + + rp->entry[count].bus = d->bus; + rp->entry[count++].index = cpu_to_le16(d->id); +@@ -9324,23 +9312,14 @@ void mgmt_index_added(struct hci_dev *hdev) + if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) + return; + +- switch (hdev->dev_type) { +- case HCI_PRIMARY: +- if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { +- mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, +- NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); +- ev.type = 0x01; +- } else { +- mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, +- HCI_MGMT_INDEX_EVENTS); +- ev.type = 0x00; +- } +- break; +- case HCI_AMP: +- ev.type = 0x02; +- break; +- default: +- return; ++ if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { ++ mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, ++ HCI_MGMT_UNCONF_INDEX_EVENTS); ++ ev.type = 0x01; ++ } else { ++ mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, ++ HCI_MGMT_INDEX_EVENTS); ++ ev.type = 0x00; + } + + ev.bus = hdev->bus; +@@ -9357,25 +9336,16 @@ void mgmt_index_removed(struct hci_dev *hdev) + if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) + return; + +- switch (hdev->dev_type) { +- case HCI_PRIMARY: +- mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); ++ mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); + +- if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { +- mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, +- NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); +- ev.type = 0x01; +- } else { +- mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, +- HCI_MGMT_INDEX_EVENTS); +- ev.type = 0x00; +- } +- break; +- case HCI_AMP: +- ev.type = 0x02; +- break; +- default: +- return; ++ if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { ++ mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, ++ HCI_MGMT_UNCONF_INDEX_EVENTS); ++ ev.type = 0x01; ++ } else { ++ mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, ++ HCI_MGMT_INDEX_EVENTS); ++ ev.type = 0x00; + } + + ev.bus = hdev->bus; +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-hci_event-remove-code-to-removed-config_bt.patch b/queue-6.6/bluetooth-hci_event-remove-code-to-removed-config_bt.patch new file mode 100644 index 00000000000..9a135688d6c --- /dev/null +++ b/queue-6.6/bluetooth-hci_event-remove-code-to-removed-config_bt.patch @@ -0,0 +1,206 @@ +From 265bd085c16330140129388172bdf649a4762e66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 14:42:11 +0100 +Subject: Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS + +From: Lukas Bulwahn + +[ Upstream commit f4b0c2b4cd78b75acde56c2ee5aa732b6fb2a6a9 ] + +Commit cec9f3c5561d ("Bluetooth: Remove BT_HS") removes config BT_HS, but +misses two "ifdef BT_HS" blocks in hci_event.c. + +Remove this dead code from this removed config option. + +Signed-off-by: Lukas Bulwahn +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 84a4bb6548a2 ("Bluetooth: HCI: Remove HCI_AMP support") +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 163 -------------------------------------- + 1 file changed, 163 deletions(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 361e2c68a51a1..d357ec131aa5a 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5710,150 +5710,6 @@ static void hci_remote_oob_data_request_evt(struct hci_dev *hdev, void *edata, + hci_dev_unlock(hdev); + } + +-#if IS_ENABLED(CONFIG_BT_HS) +-static void hci_chan_selected_evt(struct hci_dev *hdev, void *data, +- struct sk_buff *skb) +-{ +- struct hci_ev_channel_selected *ev = data; +- struct hci_conn *hcon; +- +- bt_dev_dbg(hdev, "handle 0x%2.2x", ev->phy_handle); +- +- hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); +- if (!hcon) +- return; +- +- amp_read_loc_assoc_final_data(hdev, hcon); +-} +- +-static void hci_phy_link_complete_evt(struct hci_dev *hdev, void *data, +- struct sk_buff *skb) +-{ +- struct hci_ev_phy_link_complete *ev = data; +- struct hci_conn *hcon, *bredr_hcon; +- +- bt_dev_dbg(hdev, "handle 0x%2.2x status 0x%2.2x", ev->phy_handle, +- ev->status); +- +- hci_dev_lock(hdev); +- +- hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); +- if (!hcon) +- goto unlock; +- +- if (!hcon->amp_mgr) +- goto unlock; +- +- if (ev->status) { +- hci_conn_del(hcon); +- goto unlock; +- } +- +- bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon; +- +- hcon->state = BT_CONNECTED; +- bacpy(&hcon->dst, &bredr_hcon->dst); +- +- hci_conn_hold(hcon); +- hcon->disc_timeout = HCI_DISCONN_TIMEOUT; +- hci_conn_drop(hcon); +- +- hci_debugfs_create_conn(hcon); +- hci_conn_add_sysfs(hcon); +- +- amp_physical_cfm(bredr_hcon, hcon); +- +-unlock: +- hci_dev_unlock(hdev); +-} +- +-static void hci_loglink_complete_evt(struct hci_dev *hdev, void *data, +- struct sk_buff *skb) +-{ +- struct hci_ev_logical_link_complete *ev = data; +- struct hci_conn *hcon; +- struct hci_chan *hchan; +- struct amp_mgr *mgr; +- +- bt_dev_dbg(hdev, "log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x", +- le16_to_cpu(ev->handle), ev->phy_handle, ev->status); +- +- hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); +- if (!hcon) +- return; +- +- /* Create AMP hchan */ +- hchan = hci_chan_create(hcon); +- if (!hchan) +- return; +- +- hchan->handle = le16_to_cpu(ev->handle); +- hchan->amp = true; +- +- BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan); +- +- mgr = hcon->amp_mgr; +- if (mgr && mgr->bredr_chan) { +- struct l2cap_chan *bredr_chan = mgr->bredr_chan; +- +- l2cap_chan_lock(bredr_chan); +- +- bredr_chan->conn->mtu = hdev->block_mtu; +- l2cap_logical_cfm(bredr_chan, hchan, 0); +- hci_conn_hold(hcon); +- +- l2cap_chan_unlock(bredr_chan); +- } +-} +- +-static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, void *data, +- struct sk_buff *skb) +-{ +- struct hci_ev_disconn_logical_link_complete *ev = data; +- struct hci_chan *hchan; +- +- bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x", +- le16_to_cpu(ev->handle), ev->status); +- +- if (ev->status) +- return; +- +- hci_dev_lock(hdev); +- +- hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle)); +- if (!hchan || !hchan->amp) +- goto unlock; +- +- amp_destroy_logical_link(hchan, ev->reason); +- +-unlock: +- hci_dev_unlock(hdev); +-} +- +-static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, void *data, +- struct sk_buff *skb) +-{ +- struct hci_ev_disconn_phy_link_complete *ev = data; +- struct hci_conn *hcon; +- +- bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); +- +- if (ev->status) +- return; +- +- hci_dev_lock(hdev); +- +- hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); +- if (hcon && hcon->type == AMP_LINK) { +- hcon->state = BT_CLOSED; +- hci_disconn_cfm(hcon, ev->reason); +- hci_conn_del(hcon); +- } +- +- hci_dev_unlock(hdev); +-} +-#endif +- + static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr, + u8 bdaddr_type, bdaddr_t *local_rpa) + { +@@ -7675,25 +7531,6 @@ static const struct hci_ev { + /* [0x3e = HCI_EV_LE_META] */ + HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt, + sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE), +-#if IS_ENABLED(CONFIG_BT_HS) +- /* [0x40 = HCI_EV_PHY_LINK_COMPLETE] */ +- HCI_EV(HCI_EV_PHY_LINK_COMPLETE, hci_phy_link_complete_evt, +- sizeof(struct hci_ev_phy_link_complete)), +- /* [0x41 = HCI_EV_CHANNEL_SELECTED] */ +- HCI_EV(HCI_EV_CHANNEL_SELECTED, hci_chan_selected_evt, +- sizeof(struct hci_ev_channel_selected)), +- /* [0x42 = HCI_EV_DISCONN_PHY_LINK_COMPLETE] */ +- HCI_EV(HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE, +- hci_disconn_loglink_complete_evt, +- sizeof(struct hci_ev_disconn_logical_link_complete)), +- /* [0x45 = HCI_EV_LOGICAL_LINK_COMPLETE] */ +- HCI_EV(HCI_EV_LOGICAL_LINK_COMPLETE, hci_loglink_complete_evt, +- sizeof(struct hci_ev_logical_link_complete)), +- /* [0x46 = HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE] */ +- HCI_EV(HCI_EV_DISCONN_PHY_LINK_COMPLETE, +- hci_disconn_phylink_complete_evt, +- sizeof(struct hci_ev_disconn_phy_link_complete)), +-#endif + /* [0x48 = HCI_EV_NUM_COMP_BLOCKS] */ + HCI_EV(HCI_EV_NUM_COMP_BLOCKS, hci_num_comp_blocks_evt, + sizeof(struct hci_ev_num_comp_blocks)), +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-iso-fix-bis-cleanup.patch b/queue-6.6/bluetooth-iso-fix-bis-cleanup.patch new file mode 100644 index 00000000000..d6a71fc23ad --- /dev/null +++ b/queue-6.6/bluetooth-iso-fix-bis-cleanup.patch @@ -0,0 +1,122 @@ +From cf48ae409184dd51e4a5d7807a298c8341281257 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Sep 2023 16:59:54 +0300 +Subject: Bluetooth: ISO: Fix BIS cleanup + +From: Iulia Tanasescu + +[ Upstream commit a254b90c9aac3d3d938a07e019773e35a977451b ] + +This fixes the master BIS cleanup procedure - as opposed to CIS cleanup, +no HCI disconnect command should be issued. A master BIS should only be +terminated by disabling periodic and extended advertising, and terminating +the BIG. + +In case of a Broadcast Receiver, all BIS and PA connections can be +cleaned up by calling hci_conn_failed, since it contains all function +calls that are necessary for successful cleanup. + +Signed-off-by: Iulia Tanasescu +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 84a4bb6548a2 ("Bluetooth: HCI: Remove HCI_AMP support") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_sync.h | 2 ++ + net/bluetooth/hci_conn.c | 7 +++++++ + net/bluetooth/hci_sync.c | 28 ++++++++++++---------------- + 3 files changed, 21 insertions(+), 16 deletions(-) + +diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h +index 268145efbe4cb..e2582c2425449 100644 +--- a/include/net/bluetooth/hci_sync.h ++++ b/include/net/bluetooth/hci_sync.h +@@ -80,6 +80,8 @@ int hci_start_per_adv_sync(struct hci_dev *hdev, u8 instance, u8 data_len, + u8 *data, u32 flags, u16 min_interval, + u16 max_interval, u16 sync_interval); + ++int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance); ++ + int hci_remove_advertising_sync(struct hci_dev *hdev, struct sock *sk, + u8 instance, bool force); + int hci_disable_advertising_sync(struct hci_dev *hdev); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index aea7f06c107eb..707c7710d84ec 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -759,6 +759,7 @@ static int terminate_big_sync(struct hci_dev *hdev, void *data) + + bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis); + ++ hci_disable_per_advertising_sync(hdev, d->bis); + hci_remove_ext_adv_instance_sync(hdev, d->bis, NULL); + + /* Only terminate BIG if it has been created */ +@@ -1279,6 +1280,12 @@ void hci_conn_failed(struct hci_conn *conn, u8 status) + break; + } + ++ /* In case of BIG/PA sync failed, clear conn flags so that ++ * the conns will be correctly cleaned up by ISO layer ++ */ ++ test_and_clear_bit(HCI_CONN_BIG_SYNC_FAILED, &conn->flags); ++ test_and_clear_bit(HCI_CONN_PA_SYNC_FAILED, &conn->flags); ++ + conn->state = BT_CLOSED; + hci_connect_cfm(conn, status); + hci_conn_del(conn); +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 1bc58b324b73e..40f5324e1e66f 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -1321,7 +1321,7 @@ int hci_start_ext_adv_sync(struct hci_dev *hdev, u8 instance) + return hci_enable_ext_advertising_sync(hdev, instance); + } + +-static int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance) ++int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance) + { + struct hci_cp_le_set_per_adv_enable cp; + struct adv_info *adv = NULL; +@@ -5304,6 +5304,17 @@ static int hci_disconnect_sync(struct hci_dev *hdev, struct hci_conn *conn, + if (conn->type == AMP_LINK) + return hci_disconnect_phy_link_sync(hdev, conn->handle, reason); + ++ if (test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) { ++ /* This is a BIS connection, hci_conn_del will ++ * do the necessary cleanup. ++ */ ++ hci_dev_lock(hdev); ++ hci_conn_failed(conn, reason); ++ hci_dev_unlock(hdev); ++ ++ return 0; ++ } ++ + memset(&cp, 0, sizeof(cp)); + cp.handle = cpu_to_le16(conn->handle); + cp.reason = reason; +@@ -5456,21 +5467,6 @@ int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason) + err = hci_reject_conn_sync(hdev, conn, reason); + break; + case BT_OPEN: +- hci_dev_lock(hdev); +- +- /* Cleanup bis or pa sync connections */ +- if (test_and_clear_bit(HCI_CONN_BIG_SYNC_FAILED, &conn->flags) || +- test_and_clear_bit(HCI_CONN_PA_SYNC_FAILED, &conn->flags)) { +- hci_conn_failed(conn, reason); +- } else if (test_bit(HCI_CONN_PA_SYNC, &conn->flags) || +- test_bit(HCI_CONN_BIG_SYNC, &conn->flags)) { +- conn->state = BT_CLOSED; +- hci_disconn_cfm(conn, reason); +- hci_conn_del(conn); +- } +- +- hci_dev_unlock(hdev); +- return 0; + case BT_BOUND: + break; + default: +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-qca-fix-error-code-in-qca_read_fw_build_in.patch b/queue-6.6/bluetooth-qca-fix-error-code-in-qca_read_fw_build_in.patch new file mode 100644 index 00000000000..ab276e3d43a --- /dev/null +++ b/queue-6.6/bluetooth-qca-fix-error-code-in-qca_read_fw_build_in.patch @@ -0,0 +1,39 @@ +From b990a796f582e1963792e5d10c31eea5766835ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 14:25:43 +0300 +Subject: Bluetooth: qca: Fix error code in qca_read_fw_build_info() + +From: Dan Carpenter + +[ Upstream commit a189f0ee6685457528db7a36ded3085e5d13ddc3 ] + +Return -ENOMEM on allocation failure. Don't return success. + +Fixes: cda0d6a198e2 ("Bluetooth: qca: fix info leak when fetching fw build id") +Signed-off-by: Dan Carpenter +Reviewed-by: Johan Hovold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btqca.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c +index 638074992c829..35fb26cbf2294 100644 +--- a/drivers/bluetooth/btqca.c ++++ b/drivers/bluetooth/btqca.c +@@ -148,8 +148,10 @@ static int qca_read_fw_build_info(struct hci_dev *hdev) + } + + build_label = kstrndup(&edl->data[1], build_lbl_len, GFP_KERNEL); +- if (!build_label) ++ if (!build_label) { ++ err = -ENOMEM; + goto out; ++ } + + hci_set_fw_info(hdev, "%s", build_label); + +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-remove-usage-of-the-deprecated-ida_simple_.patch b/queue-6.6/bluetooth-remove-usage-of-the-deprecated-ida_simple_.patch new file mode 100644 index 00000000000..56210fffa20 --- /dev/null +++ b/queue-6.6/bluetooth-remove-usage-of-the-deprecated-ida_simple_.patch @@ -0,0 +1,85 @@ +From 2fa23308abd78feddea7c51b091bf4d7660da220 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 21:12:19 +0100 +Subject: Bluetooth: Remove usage of the deprecated ida_simple_xx() API + +From: Christophe JAILLET + +[ Upstream commit 9c16d0c8d93e3d2a95c5ed927b061f244db75579 ] + +ida_alloc() and ida_free() should be preferred to the deprecated +ida_simple_get() and ida_simple_remove(). + +Note that the upper limit of ida_simple_get() is exclusive, but the one of +ida_alloc_max() is inclusive. So a -1 has been added when needed. + +Signed-off-by: Christophe JAILLET +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 84a4bb6548a2 ("Bluetooth: HCI: Remove HCI_AMP support") +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 9 +++++---- + net/bluetooth/hci_sock.c | 4 ++-- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index befe645d3f9bf..101ea9137dfef 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -2609,10 +2609,11 @@ int hci_register_dev(struct hci_dev *hdev) + */ + switch (hdev->dev_type) { + case HCI_PRIMARY: +- id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL); ++ id = ida_alloc_max(&hci_index_ida, HCI_MAX_ID - 1, GFP_KERNEL); + break; + case HCI_AMP: +- id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL); ++ id = ida_alloc_range(&hci_index_ida, 1, HCI_MAX_ID - 1, ++ GFP_KERNEL); + break; + default: + return -EINVAL; +@@ -2711,7 +2712,7 @@ int hci_register_dev(struct hci_dev *hdev) + destroy_workqueue(hdev->workqueue); + destroy_workqueue(hdev->req_workqueue); + err: +- ida_simple_remove(&hci_index_ida, hdev->id); ++ ida_free(&hci_index_ida, hdev->id); + + return error; + } +@@ -2793,7 +2794,7 @@ void hci_release_dev(struct hci_dev *hdev) + hci_dev_unlock(hdev); + + ida_destroy(&hdev->unset_handle_ida); +- ida_simple_remove(&hci_index_ida, hdev->id); ++ ida_free(&hci_index_ida, hdev->id); + kfree_skb(hdev->sent_cmd); + kfree_skb(hdev->req_skb); + kfree_skb(hdev->recv_event); +diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c +index 3e7cd330d731a..4ee1b976678b2 100644 +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -101,7 +101,7 @@ static bool hci_sock_gen_cookie(struct sock *sk) + int id = hci_pi(sk)->cookie; + + if (!id) { +- id = ida_simple_get(&sock_cookie_ida, 1, 0, GFP_KERNEL); ++ id = ida_alloc_min(&sock_cookie_ida, 1, GFP_KERNEL); + if (id < 0) + id = 0xffffffff; + +@@ -119,7 +119,7 @@ static void hci_sock_free_cookie(struct sock *sk) + + if (id) { + hci_pi(sk)->cookie = 0xffffffff; +- ida_simple_remove(&sock_cookie_ida, id); ++ ida_free(&sock_cookie_ida, id); + } + } + +-- +2.43.0 + diff --git a/queue-6.6/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch b/queue-6.6/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch new file mode 100644 index 00000000000..1578c508de3 --- /dev/null +++ b/queue-6.6/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch @@ -0,0 +1,122 @@ +From 0b03417805ca21e443a6748e67d6443550127e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 12:39:28 +0200 +Subject: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq + +From: Michal Schmidt + +[ Upstream commit 78cfd17142ef70599d6409cbd709d94b3da58659 ] + +Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called +with hwq_attr->aux_depth != 0 and hwq_attr->aux_stride == 0. +In that case, "roundup_pow_of_two(hwq_attr->aux_stride)" gets called. +roundup_pow_of_two is documented as undefined for 0. + +Fix it in the one caller that had this combination. + +The undefined behavior was detected by UBSAN: + UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 + shift exponent 64 is too large for 64-bit type 'long unsigned int' + CPU: 24 PID: 1075 Comm: (udev-worker) Not tainted 6.9.0-rc6+ #4 + Hardware name: Abacus electric, s.r.o. - servis@abacus.cz Super Server/H12SSW-iN, BIOS 2.7 10/25/2023 + Call Trace: + + dump_stack_lvl+0x5d/0x80 + ubsan_epilogue+0x5/0x30 + __ubsan_handle_shift_out_of_bounds.cold+0x61/0xec + __roundup_pow_of_two+0x25/0x35 [bnxt_re] + bnxt_qplib_alloc_init_hwq+0xa1/0x470 [bnxt_re] + bnxt_qplib_create_qp+0x19e/0x840 [bnxt_re] + bnxt_re_create_qp+0x9b1/0xcd0 [bnxt_re] + ? srso_alias_return_thunk+0x5/0xfbef5 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? __kmalloc+0x1b6/0x4f0 + ? create_qp.part.0+0x128/0x1c0 [ib_core] + ? __pfx_bnxt_re_create_qp+0x10/0x10 [bnxt_re] + create_qp.part.0+0x128/0x1c0 [ib_core] + ib_create_qp_kernel+0x50/0xd0 [ib_core] + create_mad_qp+0x8e/0xe0 [ib_core] + ? __pfx_qp_event_handler+0x10/0x10 [ib_core] + ib_mad_init_device+0x2be/0x680 [ib_core] + add_client_context+0x10d/0x1a0 [ib_core] + enable_device_and_get+0xe0/0x1d0 [ib_core] + ib_register_device+0x53c/0x630 [ib_core] + ? srso_alias_return_thunk+0x5/0xfbef5 + bnxt_re_probe+0xbd8/0xe50 [bnxt_re] + ? __pfx_bnxt_re_probe+0x10/0x10 [bnxt_re] + auxiliary_bus_probe+0x49/0x80 + ? driver_sysfs_add+0x57/0xc0 + really_probe+0xde/0x340 + ? pm_runtime_barrier+0x54/0x90 + ? __pfx___driver_attach+0x10/0x10 + __driver_probe_device+0x78/0x110 + driver_probe_device+0x1f/0xa0 + __driver_attach+0xba/0x1c0 + bus_for_each_dev+0x8f/0xe0 + bus_add_driver+0x146/0x220 + driver_register+0x72/0xd0 + __auxiliary_driver_register+0x6e/0xd0 + ? __pfx_bnxt_re_mod_init+0x10/0x10 [bnxt_re] + bnxt_re_mod_init+0x3e/0xff0 [bnxt_re] + ? __pfx_bnxt_re_mod_init+0x10/0x10 [bnxt_re] + do_one_initcall+0x5b/0x310 + do_init_module+0x90/0x250 + init_module_from_file+0x86/0xc0 + idempotent_init_module+0x121/0x2b0 + __x64_sys_finit_module+0x5e/0xb0 + do_syscall_64+0x82/0x160 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? syscall_exit_to_user_mode_prepare+0x149/0x170 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? syscall_exit_to_user_mode+0x75/0x230 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? do_syscall_64+0x8e/0x160 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? __count_memcg_events+0x69/0x100 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? count_memcg_events.constprop.0+0x1a/0x30 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? handle_mm_fault+0x1f0/0x300 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? do_user_addr_fault+0x34e/0x640 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? srso_alias_return_thunk+0x5/0xfbef5 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + RIP: 0033:0x7f4e5132821d + Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e3 db 0c 00 f7 d8 64 89 01 48 + RSP: 002b:00007ffca9c906a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 + RAX: ffffffffffffffda RBX: 0000563ec8a8f130 RCX: 00007f4e5132821d + RDX: 0000000000000000 RSI: 00007f4e518fa07d RDI: 000000000000003b + RBP: 00007ffca9c90760 R08: 00007f4e513f6b20 R09: 00007ffca9c906f0 + R10: 0000563ec8a8faa0 R11: 0000000000000246 R12: 00007f4e518fa07d + R13: 0000000000020000 R14: 0000563ec8409e90 R15: 0000563ec8a8fa60 + + ---[ end trace ]--- + +Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") +Signed-off-by: Michal Schmidt +Link: https://lore.kernel.org/r/20240507103929.30003-1-mschmidt@redhat.com +Acked-by: Selvin Xavier +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index b99451b3c10fc..3b28878f62062 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -1010,7 +1010,8 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + hwq_attr.stride = sizeof(struct sq_sge); + hwq_attr.depth = bnxt_qplib_get_depth(sq); + hwq_attr.aux_stride = psn_sz; +- hwq_attr.aux_depth = bnxt_qplib_set_sq_size(sq, qp->wqe_mode); ++ hwq_attr.aux_depth = psn_sz ? bnxt_qplib_set_sq_size(sq, qp->wqe_mode) ++ : 0; + /* Update msn tbl size */ + if (BNXT_RE_HW_RETX(qp->dev_cap_flags) && psn_sz) { + hwq_attr.aux_depth = roundup_pow_of_two(bnxt_qplib_set_sq_size(sq, qp->wqe_mode)); +-- +2.43.0 + diff --git a/queue-6.6/bpf-add-bpf_prog_type_cgroup_skb-attach-type-enforce.patch b/queue-6.6/bpf-add-bpf_prog_type_cgroup_skb-attach-type-enforce.patch new file mode 100644 index 00000000000..2d6149eb025 --- /dev/null +++ b/queue-6.6/bpf-add-bpf_prog_type_cgroup_skb-attach-type-enforce.patch @@ -0,0 +1,50 @@ +From e619ebfbacf987ec7cb6631f65eb8e918d93db83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 16:16:18 -0700 +Subject: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in + BPF_LINK_CREATE + +From: Stanislav Fomichev + +[ Upstream commit 543576ec15b17c0c93301ac8297333c7b6e84ac7 ] + +bpf_prog_attach uses attach_type_to_prog_type to enforce proper +attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses +bpf_prog_get and relies on bpf_prog_attach_check_attach_type +to properly verify prog_type <> attach_type association. + +Add missing attach_type enforcement for the link_create case. +Otherwise, it's currently possible to attach cgroup_skb prog +types to other cgroup hooks. + +Fixes: af6eea57437a ("bpf: Implement bpf_link-based cgroup BPF program attachment") +Link: https://lore.kernel.org/bpf/0000000000004792a90615a1dde0@google.com/ +Reported-by: syzbot+838346b979830606c854@syzkaller.appspotmail.com +Signed-off-by: Stanislav Fomichev +Acked-by: Eduard Zingerman +Link: https://lore.kernel.org/r/20240426231621.2716876-2-sdf@google.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/syscall.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 4902a7487f076..e886157a9efbb 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -3809,6 +3809,11 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog, + * check permissions at attach time. + */ + return -EPERM; ++ ++ ptype = attach_type_to_prog_type(attach_type); ++ if (prog->type != ptype) ++ return -EINVAL; ++ + return prog->enforce_expected_attach_type && + prog->expected_attach_type != attach_type ? + -EINVAL : 0; +-- +2.43.0 + diff --git a/queue-6.6/bpf-fix-verifier-assumptions-about-socket-sk.patch b/queue-6.6/bpf-fix-verifier-assumptions-about-socket-sk.patch new file mode 100644 index 00000000000..50f7c141b41 --- /dev/null +++ b/queue-6.6/bpf-fix-verifier-assumptions-about-socket-sk.patch @@ -0,0 +1,220 @@ +From 33e59d97cced13c77e5eb6f4bd48f6c61178ebf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 17:25:44 -0700 +Subject: bpf: Fix verifier assumptions about socket->sk + +From: Alexei Starovoitov + +[ Upstream commit 0db63c0b86e981a1e97d2596d64ceceba1a5470e ] + +The verifier assumes that 'sk' field in 'struct socket' is valid +and non-NULL when 'socket' pointer itself is trusted and non-NULL. +That may not be the case when socket was just created and +passed to LSM socket_accept hook. +Fix this verifier assumption and adjust tests. + +Reported-by: Liam Wisehart +Acked-by: Kumar Kartikeya Dwivedi +Fixes: 6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier.") +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/r/20240427002544.68803-1-alexei.starovoitov@gmail.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 23 +++++++++++++++---- + .../bpf/progs/bench_local_storage_create.c | 5 ++-- + .../selftests/bpf/progs/local_storage.c | 20 ++++++++-------- + .../testing/selftests/bpf/progs/lsm_cgroup.c | 8 +++++-- + 4 files changed, 38 insertions(+), 18 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 105fa54a492ab..1385d01a21e4f 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -2539,6 +2539,8 @@ static void mark_btf_ld_reg(struct bpf_verifier_env *env, + regs[regno].type = PTR_TO_BTF_ID | flag; + regs[regno].btf = btf; + regs[regno].btf_id = btf_id; ++ if (type_may_be_null(flag)) ++ regs[regno].id = ++env->id_gen; + } + + #define DEF_NOT_SUBREG (0) +@@ -5373,8 +5375,6 @@ static int check_map_kptr_access(struct bpf_verifier_env *env, u32 regno, + rcu_safe_kptr(kptr_field) && in_rcu_cs(env) ? + PTR_MAYBE_NULL | MEM_RCU : + PTR_MAYBE_NULL | PTR_UNTRUSTED); +- /* For mark_ptr_or_null_reg */ +- val_reg->id = ++env->id_gen; + } else if (class == BPF_STX) { + val_reg = reg_state(env, value_regno); + if (!register_is_null(val_reg) && +@@ -5684,7 +5684,8 @@ static bool is_trusted_reg(const struct bpf_reg_state *reg) + return true; + + /* Types listed in the reg2btf_ids are always trusted */ +- if (reg2btf_ids[base_type(reg->type)]) ++ if (reg2btf_ids[base_type(reg->type)] && ++ !bpf_type_has_unsafe_modifiers(reg->type)) + return true; + + /* If a register is not referenced, it is trusted if it has the +@@ -6263,6 +6264,7 @@ static int bpf_map_direct_read(struct bpf_map *map, int off, int size, u64 *val, + #define BTF_TYPE_SAFE_RCU(__type) __PASTE(__type, __safe_rcu) + #define BTF_TYPE_SAFE_RCU_OR_NULL(__type) __PASTE(__type, __safe_rcu_or_null) + #define BTF_TYPE_SAFE_TRUSTED(__type) __PASTE(__type, __safe_trusted) ++#define BTF_TYPE_SAFE_TRUSTED_OR_NULL(__type) __PASTE(__type, __safe_trusted_or_null) + + /* + * Allow list few fields as RCU trusted or full trusted. +@@ -6326,7 +6328,7 @@ BTF_TYPE_SAFE_TRUSTED(struct dentry) { + struct inode *d_inode; + }; + +-BTF_TYPE_SAFE_TRUSTED(struct socket) { ++BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct socket) { + struct sock *sk; + }; + +@@ -6361,11 +6363,20 @@ static bool type_is_trusted(struct bpf_verifier_env *env, + BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct linux_binprm)); + BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct file)); + BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct dentry)); +- BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct socket)); + + return btf_nested_type_is_trusted(&env->log, reg, field_name, btf_id, "__safe_trusted"); + } + ++static bool type_is_trusted_or_null(struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg, ++ const char *field_name, u32 btf_id) ++{ ++ BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct socket)); ++ ++ return btf_nested_type_is_trusted(&env->log, reg, field_name, btf_id, ++ "__safe_trusted_or_null"); ++} ++ + static int check_ptr_to_btf_access(struct bpf_verifier_env *env, + struct bpf_reg_state *regs, + int regno, int off, int size, +@@ -6474,6 +6485,8 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env, + */ + if (type_is_trusted(env, reg, field_name, btf_id)) { + flag |= PTR_TRUSTED; ++ } else if (type_is_trusted_or_null(env, reg, field_name, btf_id)) { ++ flag |= PTR_TRUSTED | PTR_MAYBE_NULL; + } else if (in_rcu_cs(env) && !type_may_be_null(reg->type)) { + if (type_is_rcu(env, reg, field_name, btf_id)) { + /* ignore __rcu tag and mark it MEM_RCU */ +diff --git a/tools/testing/selftests/bpf/progs/bench_local_storage_create.c b/tools/testing/selftests/bpf/progs/bench_local_storage_create.c +index e4bfbba6c1936..c8ec0d0368e4a 100644 +--- a/tools/testing/selftests/bpf/progs/bench_local_storage_create.c ++++ b/tools/testing/selftests/bpf/progs/bench_local_storage_create.c +@@ -61,14 +61,15 @@ SEC("lsm.s/socket_post_create") + int BPF_PROG(socket_post_create, struct socket *sock, int family, int type, + int protocol, int kern) + { ++ struct sock *sk = sock->sk; + struct storage *stg; + __u32 pid; + + pid = bpf_get_current_pid_tgid() >> 32; +- if (pid != bench_pid) ++ if (pid != bench_pid || !sk) + return 0; + +- stg = bpf_sk_storage_get(&sk_storage_map, sock->sk, NULL, ++ stg = bpf_sk_storage_get(&sk_storage_map, sk, NULL, + BPF_LOCAL_STORAGE_GET_F_CREATE); + + if (stg) +diff --git a/tools/testing/selftests/bpf/progs/local_storage.c b/tools/testing/selftests/bpf/progs/local_storage.c +index bc8ea56671a16..3bf75f4ea690a 100644 +--- a/tools/testing/selftests/bpf/progs/local_storage.c ++++ b/tools/testing/selftests/bpf/progs/local_storage.c +@@ -140,11 +140,12 @@ int BPF_PROG(socket_bind, struct socket *sock, struct sockaddr *address, + { + __u32 pid = bpf_get_current_pid_tgid() >> 32; + struct local_storage *storage; ++ struct sock *sk = sock->sk; + +- if (pid != monitored_pid) ++ if (pid != monitored_pid || !sk) + return 0; + +- storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0, 0); ++ storage = bpf_sk_storage_get(&sk_storage_map, sk, 0, 0); + if (!storage) + return 0; + +@@ -155,24 +156,24 @@ int BPF_PROG(socket_bind, struct socket *sock, struct sockaddr *address, + /* This tests that we can associate multiple elements + * with the local storage. + */ +- storage = bpf_sk_storage_get(&sk_storage_map2, sock->sk, 0, ++ storage = bpf_sk_storage_get(&sk_storage_map2, sk, 0, + BPF_LOCAL_STORAGE_GET_F_CREATE); + if (!storage) + return 0; + +- if (bpf_sk_storage_delete(&sk_storage_map2, sock->sk)) ++ if (bpf_sk_storage_delete(&sk_storage_map2, sk)) + return 0; + +- storage = bpf_sk_storage_get(&sk_storage_map2, sock->sk, 0, ++ storage = bpf_sk_storage_get(&sk_storage_map2, sk, 0, + BPF_LOCAL_STORAGE_GET_F_CREATE); + if (!storage) + return 0; + +- if (bpf_sk_storage_delete(&sk_storage_map, sock->sk)) ++ if (bpf_sk_storage_delete(&sk_storage_map, sk)) + return 0; + + /* Ensure that the sk_storage_map is disconnected from the storage. */ +- if (!sock->sk->sk_bpf_storage || sock->sk->sk_bpf_storage->smap) ++ if (!sk->sk_bpf_storage || sk->sk_bpf_storage->smap) + return 0; + + sk_storage_result = 0; +@@ -185,11 +186,12 @@ int BPF_PROG(socket_post_create, struct socket *sock, int family, int type, + { + __u32 pid = bpf_get_current_pid_tgid() >> 32; + struct local_storage *storage; ++ struct sock *sk = sock->sk; + +- if (pid != monitored_pid) ++ if (pid != monitored_pid || !sk) + return 0; + +- storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0, ++ storage = bpf_sk_storage_get(&sk_storage_map, sk, 0, + BPF_LOCAL_STORAGE_GET_F_CREATE); + if (!storage) + return 0; +diff --git a/tools/testing/selftests/bpf/progs/lsm_cgroup.c b/tools/testing/selftests/bpf/progs/lsm_cgroup.c +index 02c11d16b692a..d7598538aa2da 100644 +--- a/tools/testing/selftests/bpf/progs/lsm_cgroup.c ++++ b/tools/testing/selftests/bpf/progs/lsm_cgroup.c +@@ -103,11 +103,15 @@ static __always_inline int real_bind(struct socket *sock, + int addrlen) + { + struct sockaddr_ll sa = {}; ++ struct sock *sk = sock->sk; + +- if (sock->sk->__sk_common.skc_family != AF_PACKET) ++ if (!sk) ++ return 1; ++ ++ if (sk->__sk_common.skc_family != AF_PACKET) + return 1; + +- if (sock->sk->sk_kern_sock) ++ if (sk->sk_kern_sock) + return 1; + + bpf_probe_read_kernel(&sa, sizeof(sa), address); +-- +2.43.0 + diff --git a/queue-6.6/bpf-pack-struct-bpf_fib_lookup.patch b/queue-6.6/bpf-pack-struct-bpf_fib_lookup.patch new file mode 100644 index 00000000000..6a538fa2b55 --- /dev/null +++ b/queue-6.6/bpf-pack-struct-bpf_fib_lookup.patch @@ -0,0 +1,74 @@ +From 1bde2d73771c6e8f15081334d971bfe5353c860b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 14:33:03 +0200 +Subject: bpf: Pack struct bpf_fib_lookup + +From: Anton Protopopov + +[ Upstream commit f91717007217d975aa975ddabd91ae1a107b9bff ] + +The struct bpf_fib_lookup is supposed to be of size 64. A recent commit +59b418c7063d ("bpf: Add a check for struct bpf_fib_lookup size") added +a static assertion to check this property so that future changes to the +structure will not accidentally break this assumption. + +As it immediately turned out, on some 32-bit arm systems, when AEABI=n, +the total size of the structure was equal to 68, see [1]. This happened +because the bpf_fib_lookup structure contains a union of two 16-bit +fields: + + union { + __u16 tot_len; + __u16 mtu_result; + }; + +which was supposed to compile to a 16-bit-aligned 16-bit field. On the +aforementioned setups it was instead both aligned and padded to 32-bits. + +Declare this inner union as __attribute__((packed, aligned(2))) such +that it always is of size 2 and is aligned to 16 bits. + + [1] https://lore.kernel.org/all/CA+G9fYtsoP51f-oP_Sp5MOq-Ffv8La2RztNpwvE6+R1VtFiLrw@mail.gmail.com/#t + +Reported-by: Naresh Kamboju +Fixes: e1850ea9bd9e ("bpf: bpf_fib_lookup return MTU value as output when looked up") +Signed-off-by: Anton Protopopov +Signed-off-by: Andrii Nakryiko +Reviewed-by: Alexander Lobakin +Acked-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20240403123303.1452184-1-aspsk@isovalent.com +Signed-off-by: Sasha Levin +--- + include/uapi/linux/bpf.h | 2 +- + tools/include/uapi/linux/bpf.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index 366df8a1a5fc8..fb09fd1767f28 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -6994,7 +6994,7 @@ struct bpf_fib_lookup { + + /* output: MTU value */ + __u16 mtu_result; +- }; ++ } __attribute__((packed, aligned(2))); + /* input: L3 device index for lookup + * output: device index from FIB lookup + */ +diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h +index 366df8a1a5fc8..fb09fd1767f28 100644 +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -6994,7 +6994,7 @@ struct bpf_fib_lookup { + + /* output: MTU value */ + __u16 mtu_result; +- }; ++ } __attribute__((packed, aligned(2))); + /* input: L3 device index for lookup + * output: device index from FIB lookup + */ +-- +2.43.0 + diff --git a/queue-6.6/bpf-prevent-r10-register-from-being-marked-as-precis.patch b/queue-6.6/bpf-prevent-r10-register-from-being-marked-as-precis.patch new file mode 100644 index 00000000000..dd1de102bab --- /dev/null +++ b/queue-6.6/bpf-prevent-r10-register-from-being-marked-as-precis.patch @@ -0,0 +1,58 @@ +From 5bc15d125b3e33860b93081839001f45908724ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 14:45:35 -0700 +Subject: bpf: prevent r10 register from being marked as precise + +From: Andrii Nakryiko + +[ Upstream commit 1f2a74b41ea8b902687eb97c4e7e3f558801865b ] + +r10 is a special register that is not under BPF program's control and is +always effectively precise. The rest of precision logic assumes that +only r0-r9 SCALAR registers are marked as precise, so prevent r10 from +being marked precise. + +This can happen due to signed cast instruction allowing to do something +like `r0 = (s8)r10;`, which later, if r0 needs to be precise, would lead +to an attempt to mark r10 as precise. + +Prevent this with an extra check during instruction backtracking. + +Fixes: 8100928c8814 ("bpf: Support new sign-extension mov insns") +Reported-by: syzbot+148110ee7cf72f39f33e@syzkaller.appspotmail.com +Signed-off-by: Andrii Nakryiko +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20240404214536.3551295-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 818bac019d0d3..105fa54a492ab 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -3679,7 +3679,8 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, + * sreg needs precision before this insn + */ + bt_clear_reg(bt, dreg); +- bt_set_reg(bt, sreg); ++ if (sreg != BPF_REG_FP) ++ bt_set_reg(bt, sreg); + } else { + /* dreg = K + * dreg needs precision after this insn. +@@ -3695,7 +3696,8 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, + * both dreg and sreg need precision + * before this insn + */ +- bt_set_reg(bt, sreg); ++ if (sreg != BPF_REG_FP) ++ bt_set_reg(bt, sreg); + } /* else dreg += K + * dreg still needs precision before this insn + */ +-- +2.43.0 + diff --git a/queue-6.6/bpf-x86-fix-probe_mem-runtime-load-check.patch b/queue-6.6/bpf-x86-fix-probe_mem-runtime-load-check.patch new file mode 100644 index 00000000000..6143fad04e2 --- /dev/null +++ b/queue-6.6/bpf-x86-fix-probe_mem-runtime-load-check.patch @@ -0,0 +1,166 @@ +From 0b8ac3dfa821c8d56c8217a84ae2abde3ed3f330 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 10:02:09 +0000 +Subject: bpf, x86: Fix PROBE_MEM runtime load check + +From: Puranjay Mohan + +[ Upstream commit b599d7d26d6ad1fc9975218574bc2ca6d0293cfd ] + +When a load is marked PROBE_MEM - e.g. due to PTR_UNTRUSTED access - the +address being loaded from is not necessarily valid. The BPF jit sets up +exception handlers for each such load which catch page faults and 0 out +the destination register. + +If the address for the load is outside kernel address space, the load +will escape the exception handling and crash the kernel. To prevent this +from happening, the emits some instruction to verify that addr is > end +of userspace addresses. + +x86 has a legacy vsyscall ABI where a page at address 0xffffffffff600000 +is mapped with user accessible permissions. The addresses in this page +are considered userspace addresses by the fault handler. Therefore, a +BPF program accessing this page will crash the kernel. + +This patch fixes the runtime checks to also check that the PROBE_MEM +address is below VSYSCALL_ADDR. + +Example BPF program: + + SEC("fentry/tcp_v4_connect") + int BPF_PROG(fentry_tcp_v4_connect, struct sock *sk) + { + *(volatile unsigned long *)&sk->sk_tsq_flags; + return 0; + } + +BPF Assembly: + + 0: (79) r1 = *(u64 *)(r1 +0) + 1: (79) r1 = *(u64 *)(r1 +344) + 2: (b7) r0 = 0 + 3: (95) exit + + x86-64 JIT + ========== + + BEFORE AFTER + ------ ----- + + 0: nopl 0x0(%rax,%rax,1) 0: nopl 0x0(%rax,%rax,1) + 5: xchg %ax,%ax 5: xchg %ax,%ax + 7: push %rbp 7: push %rbp + 8: mov %rsp,%rbp 8: mov %rsp,%rbp + b: mov 0x0(%rdi),%rdi b: mov 0x0(%rdi),%rdi +------------------------------------------------------------------------------- + f: movabs $0x100000000000000,%r11 f: movabs $0xffffffffff600000,%r10 +19: add $0x2a0,%rdi 19: mov %rdi,%r11 +20: cmp %r11,%rdi 1c: add $0x2a0,%r11 +23: jae 0x0000000000000029 23: sub %r10,%r11 +25: xor %edi,%edi 26: movabs $0x100000000a00000,%r10 +27: jmp 0x000000000000002d 30: cmp %r10,%r11 +29: mov 0x0(%rdi),%rdi 33: ja 0x0000000000000039 +--------------------------------\ 35: xor %edi,%edi +2d: xor %eax,%eax \ 37: jmp 0x0000000000000040 +2f: leave \ 39: mov 0x2a0(%rdi),%rdi +30: ret \-------------------------------------------- + 40: xor %eax,%eax + 42: leave + 43: ret + +Signed-off-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20240424100210.11982-3-puranjay@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/x86/net/bpf_jit_comp.c | 57 ++++++++++++++++--------------------- + 1 file changed, 25 insertions(+), 32 deletions(-) + +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index a6a4d3ca8ddc6..878a4c6dd7565 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -1458,36 +1458,41 @@ st: if (is_imm8(insn->off)) + if (BPF_MODE(insn->code) == BPF_PROBE_MEM || + BPF_MODE(insn->code) == BPF_PROBE_MEMSX) { + /* Conservatively check that src_reg + insn->off is a kernel address: +- * src_reg + insn->off >= TASK_SIZE_MAX + PAGE_SIZE +- * src_reg is used as scratch for src_reg += insn->off and restored +- * after emit_ldx if necessary ++ * src_reg + insn->off > TASK_SIZE_MAX + PAGE_SIZE ++ * and ++ * src_reg + insn->off < VSYSCALL_ADDR + */ + +- u64 limit = TASK_SIZE_MAX + PAGE_SIZE; ++ u64 limit = TASK_SIZE_MAX + PAGE_SIZE - VSYSCALL_ADDR; + u8 *end_of_jmp; + +- /* At end of these emitted checks, insn->off will have been added +- * to src_reg, so no need to do relative load with insn->off offset +- */ +- insn_off = 0; ++ /* movabsq r10, VSYSCALL_ADDR */ ++ emit_mov_imm64(&prog, BPF_REG_AX, (long)VSYSCALL_ADDR >> 32, ++ (u32)(long)VSYSCALL_ADDR); + +- /* movabsq r11, limit */ +- EMIT2(add_1mod(0x48, AUX_REG), add_1reg(0xB8, AUX_REG)); +- EMIT((u32)limit, 4); +- EMIT(limit >> 32, 4); ++ /* mov src_reg, r11 */ ++ EMIT_mov(AUX_REG, src_reg); + + if (insn->off) { +- /* add src_reg, insn->off */ +- maybe_emit_1mod(&prog, src_reg, true); +- EMIT2_off32(0x81, add_1reg(0xC0, src_reg), insn->off); ++ /* add r11, insn->off */ ++ maybe_emit_1mod(&prog, AUX_REG, true); ++ EMIT2_off32(0x81, add_1reg(0xC0, AUX_REG), insn->off); + } + +- /* cmp src_reg, r11 */ +- maybe_emit_mod(&prog, src_reg, AUX_REG, true); +- EMIT2(0x39, add_2reg(0xC0, src_reg, AUX_REG)); ++ /* sub r11, r10 */ ++ maybe_emit_mod(&prog, AUX_REG, BPF_REG_AX, true); ++ EMIT2(0x29, add_2reg(0xC0, AUX_REG, BPF_REG_AX)); ++ ++ /* movabsq r10, limit */ ++ emit_mov_imm64(&prog, BPF_REG_AX, (long)limit >> 32, ++ (u32)(long)limit); ++ ++ /* cmp r10, r11 */ ++ maybe_emit_mod(&prog, AUX_REG, BPF_REG_AX, true); ++ EMIT2(0x39, add_2reg(0xC0, AUX_REG, BPF_REG_AX)); + +- /* if unsigned '>=', goto load */ +- EMIT2(X86_JAE, 0); ++ /* if unsigned '>', goto load */ ++ EMIT2(X86_JA, 0); + end_of_jmp = prog; + + /* xor dst_reg, dst_reg */ +@@ -1513,18 +1518,6 @@ st: if (is_imm8(insn->off)) + /* populate jmp_offset for JMP above */ + start_of_ldx[-1] = prog - start_of_ldx; + +- if (insn->off && src_reg != dst_reg) { +- /* sub src_reg, insn->off +- * Restore src_reg after "add src_reg, insn->off" in prev +- * if statement. But if src_reg == dst_reg, emit_ldx +- * above already clobbered src_reg, so no need to restore. +- * If add src_reg, insn->off was unnecessary, no need to +- * restore either. +- */ +- maybe_emit_1mod(&prog, src_reg, true); +- EMIT2_off32(0x81, add_1reg(0xE8, src_reg), insn->off); +- } +- + if (!bpf_prog->aux->extable) + break; + +-- +2.43.0 + diff --git a/queue-6.6/bpftool-fix-missing-pids-during-link-show.patch b/queue-6.6/bpftool-fix-missing-pids-during-link-show.patch new file mode 100644 index 00000000000..a3ca74d6e25 --- /dev/null +++ b/queue-6.6/bpftool-fix-missing-pids-during-link-show.patch @@ -0,0 +1,89 @@ +From 3d92f49ccce1bda576d57014d4b3d801531c2658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 19:32:49 -0700 +Subject: bpftool: Fix missing pids during link show + +From: Yonghong Song + +[ Upstream commit fe879bb42f8a6513ed18e9d22efb99cb35590201 ] + +Current 'bpftool link' command does not show pids, e.g., + $ tools/build/bpftool/bpftool link + ... + 4: tracing prog 23 + prog_type lsm attach_type lsm_mac + target_obj_id 1 target_btf_id 31320 + +Hack the following change to enable normal libbpf debug output, + --- a/tools/bpf/bpftool/pids.c + +++ b/tools/bpf/bpftool/pids.c + @@ -121,9 +121,9 @@ int build_obj_refs_table(struct hashmap **map, enum bpf_obj_type type) + /* we don't want output polluted with libbpf errors if bpf_iter is not + * supported + */ + - default_print = libbpf_set_print(libbpf_print_none); + + /* default_print = libbpf_set_print(libbpf_print_none); */ + err = pid_iter_bpf__load(skel); + - libbpf_set_print(default_print); + + /* libbpf_set_print(default_print); */ + +Rerun the above bpftool command: + $ tools/build/bpftool/bpftool link + libbpf: prog 'iter': BPF program load failed: Permission denied + libbpf: prog 'iter': -- BEGIN PROG LOAD LOG -- + 0: R1=ctx() R10=fp0 + ; struct task_struct *task = ctx->task; @ pid_iter.bpf.c:69 + 0: (79) r6 = *(u64 *)(r1 +8) ; R1=ctx() R6_w=ptr_or_null_task_struct(id=1) + ; struct file *file = ctx->file; @ pid_iter.bpf.c:68 + ... + ; struct bpf_link *link = (struct bpf_link *) file->private_data; @ pid_iter.bpf.c:103 + 80: (79) r3 = *(u64 *)(r8 +432) ; R3_w=scalar() R8=ptr_file() + ; if (link->type == bpf_core_enum_value(enum bpf_link_type___local, @ pid_iter.bpf.c:105 + 81: (61) r1 = *(u32 *)(r3 +12) + R3 invalid mem access 'scalar' + processed 39 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 2 + -- END PROG LOAD LOG -- + libbpf: prog 'iter': failed to load: -13 + ... + +The 'file->private_data' returns a 'void' type and this caused subsequent 'link->type' +(insn #81) failed in verification. + +To fix the issue, restore the previous BPF_CORE_READ so old kernels can also work. +With this patch, the 'bpftool link' runs successfully with 'pids'. + $ tools/build/bpftool/bpftool link + ... + 4: tracing prog 23 + prog_type lsm attach_type lsm_mac + target_obj_id 1 target_btf_id 31320 + pids systemd(1) + +Fixes: 44ba7b30e84f ("bpftool: Use a local copy of BPF_LINK_TYPE_PERF_EVENT in pid_iter.bpf.c") +Signed-off-by: Yonghong Song +Signed-off-by: Andrii Nakryiko +Tested-by: Quentin Monnet +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20240312023249.3776718-1-yonghong.song@linux.dev +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c +index 26004f0c5a6ae..7bdbcac3cf628 100644 +--- a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c ++++ b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c +@@ -102,8 +102,8 @@ int iter(struct bpf_iter__task_file *ctx) + BPF_LINK_TYPE_PERF_EVENT___local)) { + struct bpf_link *link = (struct bpf_link *) file->private_data; + +- if (link->type == bpf_core_enum_value(enum bpf_link_type___local, +- BPF_LINK_TYPE_PERF_EVENT___local)) { ++ if (BPF_CORE_READ(link, type) == bpf_core_enum_value(enum bpf_link_type___local, ++ BPF_LINK_TYPE_PERF_EVENT___local)) { + e.has_bpf_cookie = true; + e.bpf_cookie = get_bpf_cookie(link); + } +-- +2.43.0 + diff --git a/queue-6.6/bpftool-mount-bpffs-on-provided-dir-instead-of-paren.patch b/queue-6.6/bpftool-mount-bpffs-on-provided-dir-instead-of-paren.patch new file mode 100644 index 00000000000..b802abe5615 --- /dev/null +++ b/queue-6.6/bpftool-mount-bpffs-on-provided-dir-instead-of-paren.patch @@ -0,0 +1,264 @@ +From 18e88897bd094987962584ede786a3293778cbba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 00:52:19 +0530 +Subject: bpftool: Mount bpffs on provided dir instead of parent dir + +From: Sahil Siddiq + +[ Upstream commit 478a535ae54ad3831371904d93b5dfc403222e17 ] + +When pinning programs/objects under PATH (eg: during "bpftool prog +loadall") the bpffs is mounted on the parent dir of PATH in the +following situations: +- the given dir exists but it is not bpffs. +- the given dir doesn't exist and the parent dir is not bpffs. + +Mounting on the parent dir can also have the unintentional side- +effect of hiding other files located under the parent dir. + +If the given dir exists but is not bpffs, then the bpffs should +be mounted on the given dir and not its parent dir. + +Similarly, if the given dir doesn't exist and its parent dir is not +bpffs, then the given dir should be created and the bpffs should be +mounted on this new dir. + +Fixes: 2a36c26fe3b8 ("bpftool: Support bpffs mountpoint as pin path for prog loadall") +Signed-off-by: Sahil Siddiq +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/2da44d24-74ae-a564-1764-afccf395eeec@isovalent.com/T/#t +Link: https://lore.kernel.org/bpf/20240404192219.52373-1-icegambit91@gmail.com + +Closes: https://github.com/libbpf/bpftool/issues/100 + +Changes since v1: + - Split "mount_bpffs_for_pin" into two functions. + This is done to improve maintainability and readability. + +Changes since v2: +- mount_bpffs_for_pin: rename to "create_and_mount_bpffs_dir". +- mount_bpffs_given_file: rename to "mount_bpffs_given_file". +- create_and_mount_bpffs_dir: + - introduce "dir_exists" boolean. + - remove new dir if "mnt_fs" fails. +- improve error handling and error messages. + +Changes since v3: +- Rectify function name. +- Improve error messages and formatting. +- mount_bpffs_for_file: + - Check if dir exists before block_mount check. + +Changes since v4: +- Use strdup instead of strcpy. +- create_and_mount_bpffs_dir: + - Use S_IRWXU instead of 0700. +- Improve error handling and formatting. + +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/common.c | 96 +++++++++++++++++++++++++++++----- + tools/bpf/bpftool/iter.c | 2 +- + tools/bpf/bpftool/main.h | 3 +- + tools/bpf/bpftool/prog.c | 5 +- + tools/bpf/bpftool/struct_ops.c | 2 +- + 5 files changed, 92 insertions(+), 16 deletions(-) + +diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c +index cc6e6aae2447d..958e92acca8e2 100644 +--- a/tools/bpf/bpftool/common.c ++++ b/tools/bpf/bpftool/common.c +@@ -244,29 +244,101 @@ int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type) + return fd; + } + +-int mount_bpffs_for_pin(const char *name, bool is_dir) ++int create_and_mount_bpffs_dir(const char *dir_name) + { + char err_str[ERR_MAX_LEN]; +- char *file; +- char *dir; ++ bool dir_exists; + int err = 0; + +- if (is_dir && is_bpffs(name)) ++ if (is_bpffs(dir_name)) + return err; + +- file = malloc(strlen(name) + 1); +- if (!file) { ++ dir_exists = access(dir_name, F_OK) == 0; ++ ++ if (!dir_exists) { ++ char *temp_name; ++ char *parent_name; ++ ++ temp_name = strdup(dir_name); ++ if (!temp_name) { ++ p_err("mem alloc failed"); ++ return -1; ++ } ++ ++ parent_name = dirname(temp_name); ++ ++ if (is_bpffs(parent_name)) { ++ /* nothing to do if already mounted */ ++ free(temp_name); ++ return err; ++ } ++ ++ if (access(parent_name, F_OK) == -1) { ++ p_err("can't create dir '%s' to pin BPF object: parent dir '%s' doesn't exist", ++ dir_name, parent_name); ++ free(temp_name); ++ return -1; ++ } ++ ++ free(temp_name); ++ } ++ ++ if (block_mount) { ++ p_err("no BPF file system found, not mounting it due to --nomount option"); ++ return -1; ++ } ++ ++ if (!dir_exists) { ++ err = mkdir(dir_name, S_IRWXU); ++ if (err) { ++ p_err("failed to create dir '%s': %s", dir_name, strerror(errno)); ++ return err; ++ } ++ } ++ ++ err = mnt_fs(dir_name, "bpf", err_str, ERR_MAX_LEN); ++ if (err) { ++ err_str[ERR_MAX_LEN - 1] = '\0'; ++ p_err("can't mount BPF file system on given dir '%s': %s", ++ dir_name, err_str); ++ ++ if (!dir_exists) ++ rmdir(dir_name); ++ } ++ ++ return err; ++} ++ ++int mount_bpffs_for_file(const char *file_name) ++{ ++ char err_str[ERR_MAX_LEN]; ++ char *temp_name; ++ char *dir; ++ int err = 0; ++ ++ if (access(file_name, F_OK) != -1) { ++ p_err("can't pin BPF object: path '%s' already exists", file_name); ++ return -1; ++ } ++ ++ temp_name = strdup(file_name); ++ if (!temp_name) { + p_err("mem alloc failed"); + return -1; + } + +- strcpy(file, name); +- dir = dirname(file); ++ dir = dirname(temp_name); + + if (is_bpffs(dir)) + /* nothing to do if already mounted */ + goto out_free; + ++ if (access(dir, F_OK) == -1) { ++ p_err("can't pin BPF object: dir '%s' doesn't exist", dir); ++ err = -1; ++ goto out_free; ++ } ++ + if (block_mount) { + p_err("no BPF file system found, not mounting it due to --nomount option"); + err = -1; +@@ -276,12 +348,12 @@ int mount_bpffs_for_pin(const char *name, bool is_dir) + err = mnt_fs(dir, "bpf", err_str, ERR_MAX_LEN); + if (err) { + err_str[ERR_MAX_LEN - 1] = '\0'; +- p_err("can't mount BPF file system to pin the object (%s): %s", +- name, err_str); ++ p_err("can't mount BPF file system to pin the object '%s': %s", ++ file_name, err_str); + } + + out_free: +- free(file); ++ free(temp_name); + return err; + } + +@@ -289,7 +361,7 @@ int do_pin_fd(int fd, const char *name) + { + int err; + +- err = mount_bpffs_for_pin(name, false); ++ err = mount_bpffs_for_file(name); + if (err) + return err; + +diff --git a/tools/bpf/bpftool/iter.c b/tools/bpf/bpftool/iter.c +index 6b0e5202ca7a9..5c39c2ed36a2b 100644 +--- a/tools/bpf/bpftool/iter.c ++++ b/tools/bpf/bpftool/iter.c +@@ -76,7 +76,7 @@ static int do_pin(int argc, char **argv) + goto close_obj; + } + +- err = mount_bpffs_for_pin(path, false); ++ err = mount_bpffs_for_file(path); + if (err) + goto close_link; + +diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h +index b8bb08d10dec9..9eb764fe4cc8b 100644 +--- a/tools/bpf/bpftool/main.h ++++ b/tools/bpf/bpftool/main.h +@@ -142,7 +142,8 @@ const char *get_fd_type_name(enum bpf_obj_type type); + char *get_fdinfo(int fd, const char *key); + int open_obj_pinned(const char *path, bool quiet); + int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type); +-int mount_bpffs_for_pin(const char *name, bool is_dir); ++int mount_bpffs_for_file(const char *file_name); ++int create_and_mount_bpffs_dir(const char *dir_name); + int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(int *, char ***)); + int do_pin_fd(int fd, const char *name); + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index f186f1cee465b..086b93939ce93 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -1774,7 +1774,10 @@ static int load_with_options(int argc, char **argv, bool first_prog_only) + goto err_close_obj; + } + +- err = mount_bpffs_for_pin(pinfile, !first_prog_only); ++ if (first_prog_only) ++ err = mount_bpffs_for_file(pinfile); ++ else ++ err = create_and_mount_bpffs_dir(pinfile); + if (err) + goto err_close_obj; + +diff --git a/tools/bpf/bpftool/struct_ops.c b/tools/bpf/bpftool/struct_ops.c +index 3ebc9fe91e0e1..d110c6ad8175c 100644 +--- a/tools/bpf/bpftool/struct_ops.c ++++ b/tools/bpf/bpftool/struct_ops.c +@@ -509,7 +509,7 @@ static int do_register(int argc, char **argv) + if (argc == 1) + linkdir = GET_ARG(); + +- if (linkdir && mount_bpffs_for_pin(linkdir, true)) { ++ if (linkdir && create_and_mount_bpffs_dir(linkdir)) { + p_err("can't mount bpffs for pinning"); + return -1; + } +-- +2.43.0 + diff --git a/queue-6.6/clk-mediatek-mt8365-mm-fix-dpi0-parent.patch b/queue-6.6/clk-mediatek-mt8365-mm-fix-dpi0-parent.patch new file mode 100644 index 00000000000..710f3184843 --- /dev/null +++ b/queue-6.6/clk-mediatek-mt8365-mm-fix-dpi0-parent.patch @@ -0,0 +1,52 @@ +From c81842efafbb0166a57de38d5af8ffbc873ad824 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 16:17:00 +0200 +Subject: clk: mediatek: mt8365-mm: fix DPI0 parent + +From: Alexandre Mergnat + +[ Upstream commit 4c0c087772d7e29bc2489ddb068d5167140bfc38 ] + +To have a working display through DPI, a workaround has been +implemented downstream to add "mm_dpi0_dpi0" and "dpi0_sel" to +the DPI node. Shortly, that add an extra clock. + +It seems consistent to have the "dpi0_sel" as parent. +Additionnaly, "vpll_dpix" isn't used/managed. + +Then, set the "mm_dpi0_dpi0" parent clock to "dpi0_sel". + +The new clock tree is: + +clk26m + lvdspll + lvdspll_X (2, 4, 8, 16) + dpi0_sel + mm_dpi0_dpi0 + +Fixes: d46adccb7966 ("clk: mediatek: add driver for MT8365 SoC") +Signed-off-by: Alexandre Mergnat +Link: https://lore.kernel.org/r/20231023-display-support-v3-12-53388f3ed34b@baylibre.com +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8365-mm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/mediatek/clk-mt8365-mm.c b/drivers/clk/mediatek/clk-mt8365-mm.c +index 01a2ef8f594ef..3f62ec7507336 100644 +--- a/drivers/clk/mediatek/clk-mt8365-mm.c ++++ b/drivers/clk/mediatek/clk-mt8365-mm.c +@@ -53,7 +53,7 @@ static const struct mtk_gate mm_clks[] = { + GATE_MM0(CLK_MM_MM_DSI0, "mm_dsi0", "mm_sel", 17), + GATE_MM0(CLK_MM_MM_DISP_RDMA1, "mm_disp_rdma1", "mm_sel", 18), + GATE_MM0(CLK_MM_MM_MDP_RDMA1, "mm_mdp_rdma1", "mm_sel", 19), +- GATE_MM0(CLK_MM_DPI0_DPI0, "mm_dpi0_dpi0", "vpll_dpix", 20), ++ GATE_MM0(CLK_MM_DPI0_DPI0, "mm_dpi0_dpi0", "dpi0_sel", 20), + GATE_MM0(CLK_MM_MM_FAKE, "mm_fake", "mm_sel", 21), + GATE_MM0(CLK_MM_MM_SMI_COMMON, "mm_smi_common", "mm_sel", 22), + GATE_MM0(CLK_MM_MM_SMI_LARB0, "mm_smi_larb0", "mm_sel", 23), +-- +2.43.0 + diff --git a/queue-6.6/clk-mediatek-pllfh-don-t-log-error-for-missing-fhctl.patch b/queue-6.6/clk-mediatek-pllfh-don-t-log-error-for-missing-fhctl.patch new file mode 100644 index 00000000000..ca5fc19a8ee --- /dev/null +++ b/queue-6.6/clk-mediatek-pllfh-don-t-log-error-for-missing-fhctl.patch @@ -0,0 +1,52 @@ +From 5e73207ffd21d935419a3a364faed83c8283eb19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 15:29:56 -0500 +Subject: clk: mediatek: pllfh: Don't log error for missing fhctl node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit bb7b3c8e7180f36de75cdea200ab7127f93f58cc ] + +Support for fhctl clocks in apmixedsys was introduced at a later point +and to this moment only one mt6795 based platform has a fhctl DT node +present. Therefore the fhctl support in apmixedsys should be seen as +optional and not cause an error when it is missing. + +Change the message's log level to warning. The warning level is chosen +so that it will still alert the fact that fhctl support might be +unintentionally missing, but without implying that this is necessarily +an issue. + +Even if the FHCTL DT nodes are added to all current platforms moving +forward, since those changes won't be backported, this ensures stable +kernel releases won't have live with this error. + +Fixes: d7964de8a8ea ("clk: mediatek: Add new clock driver to handle FHCTL hardware") +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20240308-mtk-fhctl-no-node-error-v1-1-51e446eb149a@collabora.com +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-pllfh.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/mediatek/clk-pllfh.c b/drivers/clk/mediatek/clk-pllfh.c +index 3a2b3f90be25d..094ec8a26d668 100644 +--- a/drivers/clk/mediatek/clk-pllfh.c ++++ b/drivers/clk/mediatek/clk-pllfh.c +@@ -68,7 +68,7 @@ void fhctl_parse_dt(const u8 *compatible_node, struct mtk_pllfh_data *pllfhs, + + node = of_find_compatible_node(NULL, NULL, compatible_node); + if (!node) { +- pr_err("cannot find \"%s\"\n", compatible_node); ++ pr_warn("cannot find \"%s\"\n", compatible_node); + return; + } + +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-clk-alpha-pll-remove-invalid-stromer-regist.patch b/queue-6.6/clk-qcom-clk-alpha-pll-remove-invalid-stromer-regist.patch new file mode 100644 index 00000000000..9371c3c74cc --- /dev/null +++ b/queue-6.6/clk-qcom-clk-alpha-pll-remove-invalid-stromer-regist.patch @@ -0,0 +1,51 @@ +From 8c9b8fe7b348d75e6e0547ac6420d49506904285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 19:45:19 +0100 +Subject: clk: qcom: clk-alpha-pll: remove invalid Stromer register offset + +From: Gabor Juhos + +[ Upstream commit 4f2bc4acbb1916b8cd2ce4bb3ba7b1cd7cb705fa ] + +The offset of the CONFIG_CTL_U register defined for the Stromer +PLL is wrong. It is not aligned on a 4 bytes boundary which might +causes errors in regmap operations. + +Maybe the intention behind of using the 0xff value was to indicate +that the register is not implemented in the PLL, but this is not +verified anywhere in the code. Moreover, this value is not used +even in other register offset arrays despite that those PLLs also +have unimplemented registers. + +Additionally, on the Stromer PLLs the current code only touches +the CONFIG_CTL_U register if the result of pll_has_64bit_config() +is true which condition is not affected by the change. + +Due to the reasons above, simply remove the CONFIG_CTL_U entry +from the Stromer specific array. + +Fixes: e47a4f55f240 ("clk: qcom: clk-alpha-pll: Add support for Stromer PLLs") +Signed-off-by: Gabor Juhos +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240311-alpha-pll-stromer-cleanup-v1-1-f7c0c5607cca@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-alpha-pll.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c +index 892f2efc1c32c..82420e81da35b 100644 +--- a/drivers/clk/qcom/clk-alpha-pll.c ++++ b/drivers/clk/qcom/clk-alpha-pll.c +@@ -212,7 +212,6 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { + [PLL_OFF_USER_CTL] = 0x18, + [PLL_OFF_USER_CTL_U] = 0x1c, + [PLL_OFF_CONFIG_CTL] = 0x20, +- [PLL_OFF_CONFIG_CTL_U] = 0xff, + [PLL_OFF_TEST_CTL] = 0x30, + [PLL_OFF_TEST_CTL_U] = 0x34, + [PLL_OFF_STATUS] = 0x28, +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-dispcc-sm6350-fix-displayport-clocks.patch b/queue-6.6/clk-qcom-dispcc-sm6350-fix-displayport-clocks.patch new file mode 100644 index 00000000000..1118119c837 --- /dev/null +++ b/queue-6.6/clk-qcom-dispcc-sm6350-fix-displayport-clocks.patch @@ -0,0 +1,65 @@ +From ded634b9098f338fe7765e00aeeff0cd3ff7cb5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 04:39:30 +0300 +Subject: clk: qcom: dispcc-sm6350: fix DisplayPort clocks + +From: Dmitry Baryshkov + +[ Upstream commit 1113501cfb46d5c0eb960f0a8a9f6c0f91dc6fb6 ] + +On SM6350 DisplayPort link clocks use frequency tables inherited from +the vendor kernel, it is not applicable in the upstream kernel. Drop +frequency tables and use clk_byte2_ops for those clocks. + +This fixes frequency selection in the OPP core (which otherwise attempts +to use invalid 810 KHz as DP link rate), also fixing the following +message: +msm-dp-display ae90000.displayport-controller: _opp_config_clk_single: failed to set clock rate: -22 + +Fixes: 837519775f1d ("clk: qcom: Add display clock controller driver for SM6350") +Reviewed-by: Neil Armstrong +Tested-by: Luca Weiss +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240424-dispcc-dp-clocks-v2-2-b44038f3fa96@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sm6350.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-sm6350.c b/drivers/clk/qcom/dispcc-sm6350.c +index ea6f54ed846ec..441f042f5ea45 100644 +--- a/drivers/clk/qcom/dispcc-sm6350.c ++++ b/drivers/clk/qcom/dispcc-sm6350.c +@@ -221,26 +221,17 @@ static struct clk_rcg2 disp_cc_mdss_dp_crypto_clk_src = { + }, + }; + +-static const struct freq_tbl ftbl_disp_cc_mdss_dp_link_clk_src[] = { +- F(162000, P_DP_PHY_PLL_LINK_CLK, 1, 0, 0), +- F(270000, P_DP_PHY_PLL_LINK_CLK, 1, 0, 0), +- F(540000, P_DP_PHY_PLL_LINK_CLK, 1, 0, 0), +- F(810000, P_DP_PHY_PLL_LINK_CLK, 1, 0, 0), +- { } +-}; +- + static struct clk_rcg2 disp_cc_mdss_dp_link_clk_src = { + .cmd_rcgr = 0x10f8, + .mnd_width = 0, + .hid_width = 5, + .parent_map = disp_cc_parent_map_0, +- .freq_tbl = ftbl_disp_cc_mdss_dp_link_clk_src, + .clkr.hw.init = &(struct clk_init_data){ + .name = "disp_cc_mdss_dp_link_clk_src", + .parent_data = disp_cc_parent_data_0, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT | CLK_GET_RATE_NOCACHE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_byte2_ops, + }, + }; + +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-dispcc-sm8450-fix-displayport-clocks.patch b/queue-6.6/clk-qcom-dispcc-sm8450-fix-displayport-clocks.patch new file mode 100644 index 00000000000..7abdd328259 --- /dev/null +++ b/queue-6.6/clk-qcom-dispcc-sm8450-fix-displayport-clocks.patch @@ -0,0 +1,109 @@ +From 10623d707e358ce3fff7b01028c10163ebc45198 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 04:39:29 +0300 +Subject: clk: qcom: dispcc-sm8450: fix DisplayPort clocks + +From: Dmitry Baryshkov + +[ Upstream commit e801038a02ce1e8c652a0b668dd233a4ee48aeb7 ] + +On SM8450 DisplayPort link clocks use frequency tables inherited from +the vendor kernel, it is not applicable in the upstream kernel. Drop +frequency tables and use clk_byte2_ops for those clocks. + +This fixes frequency selection in the OPP core (which otherwise attempts +to use invalid 810 KHz as DP link rate), also fixing the following +message: +msm-dp-display ae90000.displayport-controller: _opp_config_clk_single: failed to set clock rate: -22 + +Fixes: 16fb89f92ec4 ("clk: qcom: Add support for Display Clock Controller on SM8450") +Reviewed-by: Neil Armstrong +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240424-dispcc-dp-clocks-v2-1-b44038f3fa96@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sm8450.c | 20 ++++---------------- + 1 file changed, 4 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-sm8450.c b/drivers/clk/qcom/dispcc-sm8450.c +index 2c4aecd75186b..239cc726c7e29 100644 +--- a/drivers/clk/qcom/dispcc-sm8450.c ++++ b/drivers/clk/qcom/dispcc-sm8450.c +@@ -309,26 +309,17 @@ static struct clk_rcg2 disp_cc_mdss_dptx0_aux_clk_src = { + }, + }; + +-static const struct freq_tbl ftbl_disp_cc_mdss_dptx0_link_clk_src[] = { +- F(162000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0), +- F(270000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0), +- F(540000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0), +- F(810000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0), +- { } +-}; +- + static struct clk_rcg2 disp_cc_mdss_dptx0_link_clk_src = { + .cmd_rcgr = 0x819c, + .mnd_width = 0, + .hid_width = 5, + .parent_map = disp_cc_parent_map_3, +- .freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src, + .clkr.hw.init = &(struct clk_init_data) { + .name = "disp_cc_mdss_dptx0_link_clk_src", + .parent_data = disp_cc_parent_data_3, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_3), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_byte2_ops, + }, + }; + +@@ -382,13 +373,12 @@ static struct clk_rcg2 disp_cc_mdss_dptx1_link_clk_src = { + .mnd_width = 0, + .hid_width = 5, + .parent_map = disp_cc_parent_map_3, +- .freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src, + .clkr.hw.init = &(struct clk_init_data) { + .name = "disp_cc_mdss_dptx1_link_clk_src", + .parent_data = disp_cc_parent_data_3, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_3), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_byte2_ops, + }, + }; + +@@ -442,13 +432,12 @@ static struct clk_rcg2 disp_cc_mdss_dptx2_link_clk_src = { + .mnd_width = 0, + .hid_width = 5, + .parent_map = disp_cc_parent_map_3, +- .freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src, + .clkr.hw.init = &(struct clk_init_data) { + .name = "disp_cc_mdss_dptx2_link_clk_src", + .parent_data = disp_cc_parent_data_3, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_3), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_byte2_ops, + }, + }; + +@@ -502,13 +491,12 @@ static struct clk_rcg2 disp_cc_mdss_dptx3_link_clk_src = { + .mnd_width = 0, + .hid_width = 5, + .parent_map = disp_cc_parent_map_3, +- .freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src, + .clkr.hw.init = &(struct clk_init_data) { + .name = "disp_cc_mdss_dptx3_link_clk_src", + .parent_data = disp_cc_parent_data_3, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_3), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_byte2_ops, + }, + }; + +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-dispcc-sm8550-fix-displayport-clocks.patch b/queue-6.6/clk-qcom-dispcc-sm8550-fix-displayport-clocks.patch new file mode 100644 index 00000000000..e619db9181d --- /dev/null +++ b/queue-6.6/clk-qcom-dispcc-sm8550-fix-displayport-clocks.patch @@ -0,0 +1,110 @@ +From 0cdfcb8eb27d3acaf4f70b5b7fd8376fbe5999fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 04:39:31 +0300 +Subject: clk: qcom: dispcc-sm8550: fix DisplayPort clocks + +From: Dmitry Baryshkov + +[ Upstream commit e90b5139da8465a15c3820b4b67ca9468dce93b4 ] + +On SM8550 DisplayPort link clocks use frequency tables inherited from +the vendor kernel, it is not applicable in the upstream kernel. Drop +frequency tables and use clk_byte2_ops for those clocks. + +This fixes frequency selection in the OPP core (which otherwise attempts +to use invalid 810 KHz as DP link rate), also fixing the following +message: +msm-dp-display ae90000.displayport-controller: _opp_config_clk_single: failed to set clock rate: -22 + +Fixes: 90114ca11476 ("clk: qcom: add SM8550 DISPCC driver") +Reviewed-by: Neil Armstrong +Tested-by: Neil Armstrong # on SM8550-HDK +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240424-dispcc-dp-clocks-v2-3-b44038f3fa96@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sm8550.c | 20 ++++---------------- + 1 file changed, 4 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-sm8550.c b/drivers/clk/qcom/dispcc-sm8550.c +index 0b8f0904b339b..b9edeb2a221dc 100644 +--- a/drivers/clk/qcom/dispcc-sm8550.c ++++ b/drivers/clk/qcom/dispcc-sm8550.c +@@ -345,26 +345,17 @@ static struct clk_rcg2 disp_cc_mdss_dptx0_aux_clk_src = { + }, + }; + +-static const struct freq_tbl ftbl_disp_cc_mdss_dptx0_link_clk_src[] = { +- F(162000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0), +- F(270000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0), +- F(540000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0), +- F(810000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0), +- { } +-}; +- + static struct clk_rcg2 disp_cc_mdss_dptx0_link_clk_src = { + .cmd_rcgr = 0x8170, + .mnd_width = 0, + .hid_width = 5, + .parent_map = disp_cc_parent_map_7, +- .freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src, + .clkr.hw.init = &(struct clk_init_data) { + .name = "disp_cc_mdss_dptx0_link_clk_src", + .parent_data = disp_cc_parent_data_7, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_7), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_byte2_ops, + }, + }; + +@@ -418,13 +409,12 @@ static struct clk_rcg2 disp_cc_mdss_dptx1_link_clk_src = { + .mnd_width = 0, + .hid_width = 5, + .parent_map = disp_cc_parent_map_3, +- .freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src, + .clkr.hw.init = &(struct clk_init_data) { + .name = "disp_cc_mdss_dptx1_link_clk_src", + .parent_data = disp_cc_parent_data_3, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_3), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_byte2_ops, + }, + }; + +@@ -478,13 +468,12 @@ static struct clk_rcg2 disp_cc_mdss_dptx2_link_clk_src = { + .mnd_width = 0, + .hid_width = 5, + .parent_map = disp_cc_parent_map_3, +- .freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src, + .clkr.hw.init = &(struct clk_init_data) { + .name = "disp_cc_mdss_dptx2_link_clk_src", + .parent_data = disp_cc_parent_data_3, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_3), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_byte2_ops, + }, + }; + +@@ -538,13 +527,12 @@ static struct clk_rcg2 disp_cc_mdss_dptx3_link_clk_src = { + .mnd_width = 0, + .hid_width = 5, + .parent_map = disp_cc_parent_map_3, +- .freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src, + .clkr.hw.init = &(struct clk_init_data) { + .name = "disp_cc_mdss_dptx3_link_clk_src", + .parent_data = disp_cc_parent_data_3, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_3), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_byte2_ops, + }, + }; + +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-mmcc-msm8998-fix-venus-clock-issue.patch b/queue-6.6/clk-qcom-mmcc-msm8998-fix-venus-clock-issue.patch new file mode 100644 index 00000000000..1c485b119b8 --- /dev/null +++ b/queue-6.6/clk-qcom-mmcc-msm8998-fix-venus-clock-issue.patch @@ -0,0 +1,114 @@ +From 1397001c88becad3680700900a1b64d1a55710e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 17:07:07 +0200 +Subject: clk: qcom: mmcc-msm8998: fix venus clock issue + +From: Marc Gonzalez + +[ Upstream commit e20ae5ae9f0c843aded4f06f3d1cab7384789e92 ] + +Right now, msm8998 video decoder (venus) is non-functional: + +$ time mpv --hwdec=v4l2m2m-copy --vd-lavc-software-fallback=no --vo=null --no-audio --untimed --length=30 --quiet demo-480.webm + (+) Video --vid=1 (*) (vp9 854x480 29.970fps) + Audio --aid=1 --alang=eng (*) (opus 2ch 48000Hz) +[ffmpeg/video] vp9_v4l2m2m: output VIDIOC_REQBUFS failed: Connection timed out +[ffmpeg/video] vp9_v4l2m2m: no v4l2 output context's buffers +[ffmpeg/video] vp9_v4l2m2m: can't configure decoder +Could not open codec. +Software decoding fallback is disabled. +Exiting... (Quit) + +Bryan O'Donoghue suggested the proper fix: +- Set required register offsets in venus GDSC structs. +- Set HW_CTRL flag. + +$ time mpv --hwdec=v4l2m2m-copy --vd-lavc-software-fallback=no --vo=null --no-audio --untimed --length=30 --quiet demo-480.webm + (+) Video --vid=1 (*) (vp9 854x480 29.970fps) + Audio --aid=1 --alang=eng (*) (opus 2ch 48000Hz) +[ffmpeg/video] vp9_v4l2m2m: VIDIOC_G_FMT ioctl +[ffmpeg/video] vp9_v4l2m2m: VIDIOC_G_FMT ioctl +... +Using hardware decoding (v4l2m2m-copy). +VO: [null] 854x480 nv12 +Exiting... (End of file) +real 0m3.315s +user 0m1.277s +sys 0m0.453s + +NOTES: + +GDSC = Globally Distributed Switch Controller + +Use same code as mmcc-msm8996 with: +s/venus_gdsc/video_top_gdsc/ +s/venus_core0_gdsc/video_subcore0_gdsc/ +s/venus_core1_gdsc/video_subcore1_gdsc/ + +https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/blob/caf_migration/kernel.lnx.4.4.r38-rel/include/dt-bindings/clock/msm-clocks-hwio-8996.h +https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/blob/caf_migration/kernel.lnx.4.4.r38-rel/include/dt-bindings/clock/msm-clocks-hwio-8998.h + +0x1024 = MMSS_VIDEO GDSCR (undocumented) +0x1028 = MMSS_VIDEO_CORE_CBCR +0x1030 = MMSS_VIDEO_AHB_CBCR +0x1034 = MMSS_VIDEO_AXI_CBCR +0x1038 = MMSS_VIDEO_MAXI_CBCR +0x1040 = MMSS_VIDEO_SUBCORE0 GDSCR (undocumented) +0x1044 = MMSS_VIDEO_SUBCORE1 GDSCR (undocumented) +0x1048 = MMSS_VIDEO_SUBCORE0_CBCR +0x104c = MMSS_VIDEO_SUBCORE1_CBCR + +Fixes: d14b15b5931c2b ("clk: qcom: Add MSM8998 Multimedia Clock Controller (MMCC) driver") +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Marc Gonzalez +Reviewed-by: Jeffrey Hugo +Link: https://lore.kernel.org/r/ff4e2e34-a677-4c39-8c29-83655c5512ae@freebox.fr +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8998.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/clk/qcom/mmcc-msm8998.c b/drivers/clk/qcom/mmcc-msm8998.c +index 1180e48c687ac..275fb3b71ede4 100644 +--- a/drivers/clk/qcom/mmcc-msm8998.c ++++ b/drivers/clk/qcom/mmcc-msm8998.c +@@ -2535,6 +2535,8 @@ static struct clk_branch vmem_ahb_clk = { + + static struct gdsc video_top_gdsc = { + .gdscr = 0x1024, ++ .cxcs = (unsigned int []){ 0x1028, 0x1034, 0x1038 }, ++ .cxc_count = 3, + .pd = { + .name = "video_top", + }, +@@ -2543,20 +2545,26 @@ static struct gdsc video_top_gdsc = { + + static struct gdsc video_subcore0_gdsc = { + .gdscr = 0x1040, ++ .cxcs = (unsigned int []){ 0x1048 }, ++ .cxc_count = 1, + .pd = { + .name = "video_subcore0", + }, + .parent = &video_top_gdsc.pd, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = HW_CTRL, + }; + + static struct gdsc video_subcore1_gdsc = { + .gdscr = 0x1044, ++ .cxcs = (unsigned int []){ 0x104c }, ++ .cxc_count = 1, + .pd = { + .name = "video_subcore1", + }, + .parent = &video_top_gdsc.pd, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = HW_CTRL, + }; + + static struct gdsc mdss_gdsc = { +-- +2.43.0 + diff --git a/queue-6.6/clk-renesas-r8a779a0-fix-canfd-parent-clock.patch b/queue-6.6/clk-renesas-r8a779a0-fix-canfd-parent-clock.patch new file mode 100644 index 00000000000..bdf164a62ea --- /dev/null +++ b/queue-6.6/clk-renesas-r8a779a0-fix-canfd-parent-clock.patch @@ -0,0 +1,40 @@ +From 82b0e608d5574cb1f0fbde617aeb96c644608ab4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 17:00:51 +0200 +Subject: clk: renesas: r8a779a0: Fix CANFD parent clock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 3b23118bdbd898dc2f4de8f549d598d492c42ba8 ] + +According to Figure 52A.1 ("RS-CANFD Module Block Diagram (in classical +CAN mode)") in the R-Car V3U Series User’s Manual Rev. 0.5, the parent +clock for the CANFD peripheral module clock is the S3D2 clock. + +Fixes: 9b621b6adff53346 ("clk: renesas: r8a779a0: Add CANFD module clock") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/aef9300f44c9141b1465343f91c5cc7303249b6e.1713279523.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r8a779a0-cpg-mssr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/renesas/r8a779a0-cpg-mssr.c b/drivers/clk/renesas/r8a779a0-cpg-mssr.c +index 4c2872f45387f..ff3f85e906fe1 100644 +--- a/drivers/clk/renesas/r8a779a0-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a779a0-cpg-mssr.c +@@ -139,7 +139,7 @@ static const struct mssr_mod_clk r8a779a0_mod_clks[] __initconst = { + DEF_MOD("avb3", 214, R8A779A0_CLK_S3D2), + DEF_MOD("avb4", 215, R8A779A0_CLK_S3D2), + DEF_MOD("avb5", 216, R8A779A0_CLK_S3D2), +- DEF_MOD("canfd0", 328, R8A779A0_CLK_CANFD), ++ DEF_MOD("canfd0", 328, R8A779A0_CLK_S3D2), + DEF_MOD("csi40", 331, R8A779A0_CLK_CSI0), + DEF_MOD("csi41", 400, R8A779A0_CLK_CSI0), + DEF_MOD("csi42", 401, R8A779A0_CLK_CSI0), +-- +2.43.0 + diff --git a/queue-6.6/clk-renesas-r9a07g043-add-clock-and-reset-entry-for-.patch b/queue-6.6/clk-renesas-r9a07g043-add-clock-and-reset-entry-for-.patch new file mode 100644 index 00000000000..eee685dae66 --- /dev/null +++ b/queue-6.6/clk-renesas-r9a07g043-add-clock-and-reset-entry-for-.patch @@ -0,0 +1,59 @@ +From 5e5fef219950590142a3a70c95d60e6bc32589ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 21:09:52 +0100 +Subject: clk: renesas: r9a07g043: Add clock and reset entry for PLIC + +From: Lad Prabhakar + +[ Upstream commit 44019387fce230beda35b83da3a2c9fc5787704e ] + +Add the missing clock and reset entry for PLIC. Also add +R9A07G043_NCEPLIC_ACLK to the critical clocks list. + +Fixes: 95d48d270305ad2c ("clk: renesas: r9a07g043: Add support for RZ/Five SoC") +Signed-off-by: Lad Prabhakar +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240403200952.633084-1-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r9a07g043-cpg.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/clk/renesas/r9a07g043-cpg.c b/drivers/clk/renesas/r9a07g043-cpg.c +index 1a7a6d60aca44..6c6bc79b2e9ce 100644 +--- a/drivers/clk/renesas/r9a07g043-cpg.c ++++ b/drivers/clk/renesas/r9a07g043-cpg.c +@@ -250,6 +250,10 @@ static struct rzg2l_mod_clk r9a07g043_mod_clks[] = { + 0x5a8, 1), + DEF_MOD("tsu_pclk", R9A07G043_TSU_PCLK, R9A07G043_CLK_TSU, + 0x5ac, 0), ++#ifdef CONFIG_RISCV ++ DEF_MOD("nceplic_aclk", R9A07G043_NCEPLIC_ACLK, R9A07G043_CLK_P1, ++ 0x608, 0), ++#endif + }; + + static struct rzg2l_reset r9a07g043_resets[] = { +@@ -303,6 +307,10 @@ static struct rzg2l_reset r9a07g043_resets[] = { + DEF_RST(R9A07G043_ADC_PRESETN, 0x8a8, 0), + DEF_RST(R9A07G043_ADC_ADRST_N, 0x8a8, 1), + DEF_RST(R9A07G043_TSU_PRESETN, 0x8ac, 0), ++#ifdef CONFIG_RISCV ++ DEF_RST(R9A07G043_NCEPLIC_ARESETN, 0x908, 0), ++#endif ++ + }; + + static const unsigned int r9a07g043_crit_mod_clks[] __initconst = { +@@ -312,6 +320,7 @@ static const unsigned int r9a07g043_crit_mod_clks[] __initconst = { + #endif + #ifdef CONFIG_RISCV + MOD_CLK_BASE + R9A07G043_IAX45_CLK, ++ MOD_CLK_BASE + R9A07G043_NCEPLIC_ACLK, + #endif + MOD_CLK_BASE + R9A07G043_DMAC_ACLK, + }; +-- +2.43.0 + diff --git a/queue-6.6/clk-rs9-fix-wrong-default-value-for-clock-amplitude.patch b/queue-6.6/clk-rs9-fix-wrong-default-value-for-clock-amplitude.patch new file mode 100644 index 00000000000..6e354b8cb2d --- /dev/null +++ b/queue-6.6/clk-rs9-fix-wrong-default-value-for-clock-amplitude.patch @@ -0,0 +1,72 @@ +From 1f3c3d9b2e246ab5bf78c1a13ad75548607f49ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 16:03:48 +0200 +Subject: clk: rs9: fix wrong default value for clock amplitude + +From: Catalin Popescu + +[ Upstream commit 1758c68c81b8b881818fcebaaeb91055362a82f8 ] + +According to 9FGV0241, 9FGV0441 & 9FGV0841 datasheets, the default +value for the clock amplitude is 0.8V, while the driver assumes 0.7V. + +Additionally, define constants for default values for both clock +amplitude and spread spectrum and use them. + +Fixes: 892e0ddea1aa ("clk: rs9: Add Renesas 9-series PCIe clock generator driver") +Signed-off-by: Catalin Popescu +Reviewed-by: Marek Vasut +Link: https://lore.kernel.org/r/20240415140348.2887619-1-catalin.popescu@leica-geosystems.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-renesas-pcie.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c +index 3b6ad2307a41f..b00c38469cfad 100644 +--- a/drivers/clk/clk-renesas-pcie.c ++++ b/drivers/clk/clk-renesas-pcie.c +@@ -24,10 +24,12 @@ + #define RS9_REG_SS_AMP_0V7 0x1 + #define RS9_REG_SS_AMP_0V8 0x2 + #define RS9_REG_SS_AMP_0V9 0x3 ++#define RS9_REG_SS_AMP_DEFAULT RS9_REG_SS_AMP_0V8 + #define RS9_REG_SS_AMP_MASK 0x3 + #define RS9_REG_SS_SSC_100 0 + #define RS9_REG_SS_SSC_M025 (1 << 3) + #define RS9_REG_SS_SSC_M050 (3 << 3) ++#define RS9_REG_SS_SSC_DEFAULT RS9_REG_SS_SSC_100 + #define RS9_REG_SS_SSC_MASK (3 << 3) + #define RS9_REG_SS_SSC_LOCK BIT(5) + #define RS9_REG_SR 0x2 +@@ -211,8 +213,8 @@ static int rs9_get_common_config(struct rs9_driver_data *rs9) + int ret; + + /* Set defaults */ +- rs9->pll_amplitude = RS9_REG_SS_AMP_0V7; +- rs9->pll_ssc = RS9_REG_SS_SSC_100; ++ rs9->pll_amplitude = RS9_REG_SS_AMP_DEFAULT; ++ rs9->pll_ssc = RS9_REG_SS_SSC_DEFAULT; + + /* Output clock amplitude */ + ret = of_property_read_u32(np, "renesas,out-amplitude-microvolt", +@@ -253,13 +255,13 @@ static void rs9_update_config(struct rs9_driver_data *rs9) + int i; + + /* If amplitude is non-default, update it. */ +- if (rs9->pll_amplitude != RS9_REG_SS_AMP_0V7) { ++ if (rs9->pll_amplitude != RS9_REG_SS_AMP_DEFAULT) { + regmap_update_bits(rs9->regmap, RS9_REG_SS, RS9_REG_SS_AMP_MASK, + rs9->pll_amplitude); + } + + /* If SSC is non-default, update it. */ +- if (rs9->pll_ssc != RS9_REG_SS_SSC_100) { ++ if (rs9->pll_ssc != RS9_REG_SS_SSC_DEFAULT) { + regmap_update_bits(rs9->regmap, RS9_REG_SS, RS9_REG_SS_SSC_MASK, + rs9->pll_ssc); + } +-- +2.43.0 + diff --git a/queue-6.6/clk-samsung-exynosautov9-fix-wrong-pll-clock-id-valu.patch b/queue-6.6/clk-samsung-exynosautov9-fix-wrong-pll-clock-id-valu.patch new file mode 100644 index 00000000000..529e4d59b4c --- /dev/null +++ b/queue-6.6/clk-samsung-exynosautov9-fix-wrong-pll-clock-id-valu.patch @@ -0,0 +1,47 @@ +From e8ef9be997973d701949519585960ca3fde629a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 18:10:00 +0900 +Subject: clk: samsung: exynosautov9: fix wrong pll clock id value + +From: Jaewon Kim + +[ Upstream commit 04ee3a0b44e3d18cf6b0c712d14b98624877fd26 ] + +All PLL id values of CMU_TOP were incorrectly set to FOUT_SHARED0_PLL. +It modified to the correct PLL clock id value. + +Fixes: 6587c62f69dc ("clk: samsung: add top clock support for Exynos Auto v9 SoC") +Signed-off-by: Jaewon Kim +Reviewed-by: Sam Protsenko +Link: https://lore.kernel.org/r/20240328091000.17660-1-jaewon02.kim@samsung.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-exynosautov9.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/samsung/clk-exynosautov9.c b/drivers/clk/samsung/clk-exynosautov9.c +index e9c06eb93e666..f04bacacab2cb 100644 +--- a/drivers/clk/samsung/clk-exynosautov9.c ++++ b/drivers/clk/samsung/clk-exynosautov9.c +@@ -352,13 +352,13 @@ static const struct samsung_pll_clock top_pll_clks[] __initconst = { + /* CMU_TOP_PURECLKCOMP */ + PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared0_pll", "oscclk", + PLL_LOCKTIME_PLL_SHARED0, PLL_CON3_PLL_SHARED0, NULL), +- PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared1_pll", "oscclk", ++ PLL(pll_0822x, FOUT_SHARED1_PLL, "fout_shared1_pll", "oscclk", + PLL_LOCKTIME_PLL_SHARED1, PLL_CON3_PLL_SHARED1, NULL), +- PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared2_pll", "oscclk", ++ PLL(pll_0822x, FOUT_SHARED2_PLL, "fout_shared2_pll", "oscclk", + PLL_LOCKTIME_PLL_SHARED2, PLL_CON3_PLL_SHARED2, NULL), +- PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared3_pll", "oscclk", ++ PLL(pll_0822x, FOUT_SHARED3_PLL, "fout_shared3_pll", "oscclk", + PLL_LOCKTIME_PLL_SHARED3, PLL_CON3_PLL_SHARED3, NULL), +- PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared4_pll", "oscclk", ++ PLL(pll_0822x, FOUT_SHARED4_PLL, "fout_shared4_pll", "oscclk", + PLL_LOCKTIME_PLL_SHARED4, PLL_CON3_PLL_SHARED4, NULL), + }; + +-- +2.43.0 + diff --git a/queue-6.6/cppc_cpufreq-fix-possible-null-pointer-dereference.patch b/queue-6.6/cppc_cpufreq-fix-possible-null-pointer-dereference.patch new file mode 100644 index 00000000000..86912460893 --- /dev/null +++ b/queue-6.6/cppc_cpufreq-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,65 @@ +From 07ea04d72c8fba5b6690c781e90012a6746ecf19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 12:35:36 +0300 +Subject: cppc_cpufreq: Fix possible null pointer dereference + +From: Aleksandr Mishin + +[ Upstream commit cf7de25878a1f4508c69dc9f6819c21ba177dbfe ] + +cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from +different places with various parameters. So cpufreq_cpu_get() can return +null as 'policy' in some circumstances. +Fix this bug by adding null return check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: a28b2bfc099c ("cppc_cpufreq: replace per-cpu data array with a list") +Signed-off-by: Aleksandr Mishin +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cppc_cpufreq.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c +index fe08ca419b3dc..1ba3943be8a3d 100644 +--- a/drivers/cpufreq/cppc_cpufreq.c ++++ b/drivers/cpufreq/cppc_cpufreq.c +@@ -844,10 +844,15 @@ static unsigned int cppc_cpufreq_get_rate(unsigned int cpu) + { + struct cppc_perf_fb_ctrs fb_ctrs_t0 = {0}, fb_ctrs_t1 = {0}; + struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); +- struct cppc_cpudata *cpu_data = policy->driver_data; ++ struct cppc_cpudata *cpu_data; + u64 delivered_perf; + int ret; + ++ if (!policy) ++ return -ENODEV; ++ ++ cpu_data = policy->driver_data; ++ + cpufreq_cpu_put(policy); + + ret = cppc_get_perf_ctrs(cpu, &fb_ctrs_t0); +@@ -927,10 +932,15 @@ static struct cpufreq_driver cppc_cpufreq_driver = { + static unsigned int hisi_cppc_cpufreq_get_rate(unsigned int cpu) + { + struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); +- struct cppc_cpudata *cpu_data = policy->driver_data; ++ struct cppc_cpudata *cpu_data; + u64 desired_perf; + int ret; + ++ if (!policy) ++ return -ENODEV; ++ ++ cpu_data = policy->driver_data; ++ + cpufreq_cpu_put(policy); + + ret = cppc_get_desired_perf(cpu, &desired_perf); +-- +2.43.0 + diff --git a/queue-6.6/cpu-ignore-mitigations-kernel-parameter-if-cpu_mitig.patch b/queue-6.6/cpu-ignore-mitigations-kernel-parameter-if-cpu_mitig.patch new file mode 100644 index 00000000000..b2e79329bb4 --- /dev/null +++ b/queue-6.6/cpu-ignore-mitigations-kernel-parameter-if-cpu_mitig.patch @@ -0,0 +1,136 @@ +From bc4051ae60975a834befedb8ae1501cda8428503 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 17:05:55 -0700 +Subject: cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n + +From: Sean Christopherson + +[ Upstream commit ce0abef6a1d540acef85068e0e82bdf1fbeeb0e9 ] + +Explicitly disallow enabling mitigations at runtime for kernels that were +built with CONFIG_CPU_MITIGATIONS=n, as some architectures may omit code +entirely if mitigations are disabled at compile time. + +E.g. on x86, a large pile of Kconfigs are buried behind CPU_MITIGATIONS, +and trying to provide sane behavior for retroactively enabling mitigations +is extremely difficult, bordering on impossible. E.g. page table isolation +and call depth tracking require build-time support, BHI mitigations will +still be off without additional kernel parameters, etc. + + [ bp: Touchups. ] + +Signed-off-by: Sean Christopherson +Signed-off-by: Borislav Petkov (AMD) +Acked-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20240420000556.2645001-3-seanjc@google.com +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/kernel-parameters.txt | 3 +++ + arch/x86/Kconfig | 8 ++++++-- + include/linux/cpu.h | 11 +++++++++++ + kernel/cpu.c | 14 ++++++++++---- + 4 files changed, 30 insertions(+), 6 deletions(-) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 66dfc348043d6..8d2f9ed3f1076 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -3323,6 +3323,9 @@ + arch-independent options, each of which is an + aggregation of existing arch-specific options. + ++ Note, "mitigations" is supported if and only if the ++ kernel was built with CPU_MITIGATIONS=y. ++ + off + Disable all optional CPU mitigations. This + improves system performance, but it may also +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index be9248e5cb71b..82d12c93feabe 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -2428,9 +2428,13 @@ menuconfig CPU_MITIGATIONS + help + Say Y here to enable options which enable mitigations for hardware + vulnerabilities (usually related to speculative execution). ++ Mitigations can be disabled or restricted to SMT systems at runtime ++ via the "mitigations" kernel parameter. + +- If you say N, all mitigations will be disabled. You really +- should know what you are doing to say so. ++ If you say N, all mitigations will be disabled. This CANNOT be ++ overridden at runtime. ++ ++ Say 'Y', unless you really know what you are doing. + + if CPU_MITIGATIONS + +diff --git a/include/linux/cpu.h b/include/linux/cpu.h +index e990c180282e7..a7d91a167a8b6 100644 +--- a/include/linux/cpu.h ++++ b/include/linux/cpu.h +@@ -214,7 +214,18 @@ void cpuhp_report_idle_dead(void); + static inline void cpuhp_report_idle_dead(void) { } + #endif /* #ifdef CONFIG_HOTPLUG_CPU */ + ++#ifdef CONFIG_CPU_MITIGATIONS + extern bool cpu_mitigations_off(void); + extern bool cpu_mitigations_auto_nosmt(void); ++#else ++static inline bool cpu_mitigations_off(void) ++{ ++ return true; ++} ++static inline bool cpu_mitigations_auto_nosmt(void) ++{ ++ return false; ++} ++#endif + + #endif /* _LINUX_CPU_H_ */ +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 2dd2fd300e916..4f453226fcf48 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -3197,6 +3197,7 @@ void __init boot_cpu_hotplug_init(void) + this_cpu_write(cpuhp_state.target, CPUHP_ONLINE); + } + ++#ifdef CONFIG_CPU_MITIGATIONS + /* + * These are used for a global "mitigations=" cmdline option for toggling + * optional CPU mitigations. +@@ -3207,9 +3208,7 @@ enum cpu_mitigations { + CPU_MITIGATIONS_AUTO_NOSMT, + }; + +-static enum cpu_mitigations cpu_mitigations __ro_after_init = +- IS_ENABLED(CONFIG_CPU_MITIGATIONS) ? CPU_MITIGATIONS_AUTO : +- CPU_MITIGATIONS_OFF; ++static enum cpu_mitigations cpu_mitigations __ro_after_init = CPU_MITIGATIONS_AUTO; + + static int __init mitigations_parse_cmdline(char *arg) + { +@@ -3225,7 +3224,6 @@ static int __init mitigations_parse_cmdline(char *arg) + + return 0; + } +-early_param("mitigations", mitigations_parse_cmdline); + + /* mitigations=off */ + bool cpu_mitigations_off(void) +@@ -3240,3 +3238,11 @@ bool cpu_mitigations_auto_nosmt(void) + return cpu_mitigations == CPU_MITIGATIONS_AUTO_NOSMT; + } + EXPORT_SYMBOL_GPL(cpu_mitigations_auto_nosmt); ++#else ++static int __init mitigations_parse_cmdline(char *arg) ++{ ++ pr_crit("Kernel compiled without mitigations, ignoring 'mitigations'; system may still be vulnerable\n"); ++ return 0; ++} ++#endif ++early_param("mitigations", mitigations_parse_cmdline); +-- +2.43.0 + diff --git a/queue-6.6/cpufreq-brcmstb-avs-cpufreq-iso-c90-forbids-mixed-de.patch b/queue-6.6/cpufreq-brcmstb-avs-cpufreq-iso-c90-forbids-mixed-de.patch new file mode 100644 index 00000000000..b52ab52ec7e --- /dev/null +++ b/queue-6.6/cpufreq-brcmstb-avs-cpufreq-iso-c90-forbids-mixed-de.patch @@ -0,0 +1,44 @@ +From bf3618c289261964f58e5ec65af9940ab8382eea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 15:02:20 +1000 +Subject: cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations + +From: Portia Stephens + +[ Upstream commit fa7bd98f3c8b33fb68c6b2bc69cff32b63db69f8 ] + +There is a compile warning because a NULL pointer check was added before +a struct was declared. This moves the NULL pointer check to after the +struct is declared and moves the struct assignment to after the NULL +pointer check. + +Fixes: f661017e6d32 ("cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value") +Signed-off-by: Portia Stephens +Acked-by: Florian Fainelli +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/brcmstb-avs-cpufreq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c +index 1a1857b0a6f48..ea8438550b490 100644 +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -481,9 +481,12 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv) + static unsigned int brcm_avs_cpufreq_get(unsigned int cpu) + { + struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); ++ struct private_data *priv; ++ + if (!policy) + return 0; +- struct private_data *priv = policy->driver_data; ++ ++ priv = policy->driver_data; + + cpufreq_cpu_put(policy); + +-- +2.43.0 + diff --git a/queue-6.6/cpufreq-exit-callback-is-optional.patch b/queue-6.6/cpufreq-exit-callback-is-optional.patch new file mode 100644 index 00000000000..2905cc6af2a --- /dev/null +++ b/queue-6.6/cpufreq-exit-callback-is-optional.patch @@ -0,0 +1,58 @@ +From ccf589c479fe2963ee00e4707264ce46ac3522d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 11:19:20 +0530 +Subject: cpufreq: exit() callback is optional + +From: Viresh Kumar + +[ Upstream commit b8f85833c05730d631576008daaa34096bc7f3ce ] + +The exit() callback is optional and shouldn't be called without checking +a valid pointer first. + +Also, we must clear freq_table pointer even if the exit() callback isn't +present. + +Signed-off-by: Viresh Kumar +Fixes: 91a12e91dc39 ("cpufreq: Allow light-weight tear down and bring up of CPUs") +Fixes: f339f3541701 ("cpufreq: Rearrange locking in cpufreq_remove_dev()") +Reported-by: Lizhe +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 9177265d73b47..06e0294a17a8d 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1670,10 +1670,13 @@ static void __cpufreq_offline(unsigned int cpu, struct cpufreq_policy *policy) + */ + if (cpufreq_driver->offline) { + cpufreq_driver->offline(policy); +- } else if (cpufreq_driver->exit) { +- cpufreq_driver->exit(policy); +- policy->freq_table = NULL; ++ return; + } ++ ++ if (cpufreq_driver->exit) ++ cpufreq_driver->exit(policy); ++ ++ policy->freq_table = NULL; + } + + static int cpufreq_offline(unsigned int cpu) +@@ -1731,7 +1734,7 @@ static void cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif) + } + + /* We did light-weight exit earlier, do full tear down now */ +- if (cpufreq_driver->offline) ++ if (cpufreq_driver->offline && cpufreq_driver->exit) + cpufreq_driver->exit(policy); + + up_write(&policy->rwsem); +-- +2.43.0 + diff --git a/queue-6.6/crypto-bcm-fix-pointer-arithmetic.patch b/queue-6.6/crypto-bcm-fix-pointer-arithmetic.patch new file mode 100644 index 00000000000..7a0396c25ac --- /dev/null +++ b/queue-6.6/crypto-bcm-fix-pointer-arithmetic.patch @@ -0,0 +1,40 @@ +From 5c50adaa557e61d2d8886bfbf768000ce30983cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 23:59:15 +0300 +Subject: crypto: bcm - Fix pointer arithmetic + +From: Aleksandr Mishin + +[ Upstream commit 2b3460cbf454c6b03d7429e9ffc4fe09322eb1a9 ] + +In spu2_dump_omd() value of ptr is increased by ciph_key_len +instead of hash_iv_len which could lead to going beyond the +buffer boundaries. +Fix this bug by changing ciph_key_len to hash_iv_len. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") +Signed-off-by: Aleksandr Mishin +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/bcm/spu2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/bcm/spu2.c b/drivers/crypto/bcm/spu2.c +index 07989bb8c220a..3fdc64b5a65e7 100644 +--- a/drivers/crypto/bcm/spu2.c ++++ b/drivers/crypto/bcm/spu2.c +@@ -495,7 +495,7 @@ static void spu2_dump_omd(u8 *omd, u16 hash_key_len, u16 ciph_key_len, + if (hash_iv_len) { + packet_log(" Hash IV Length %u bytes\n", hash_iv_len); + packet_dump(" hash IV: ", ptr, hash_iv_len); +- ptr += ciph_key_len; ++ ptr += hash_iv_len; + } + + if (ciph_iv_len) { +-- +2.43.0 + diff --git a/queue-6.6/crypto-ccp-drop-platform-ifdef-checks.patch b/queue-6.6/crypto-ccp-drop-platform-ifdef-checks.patch new file mode 100644 index 00000000000..8092ccf3362 --- /dev/null +++ b/queue-6.6/crypto-ccp-drop-platform-ifdef-checks.patch @@ -0,0 +1,94 @@ +From 8cc805190aafe450c95c38182892d89ba113b9eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 10:06:42 +0200 +Subject: crypto: ccp - drop platform ifdef checks + +From: Arnd Bergmann + +[ Upstream commit 42c2d7d02977ef09d434b1f5b354f5bc6c1027ab ] + +When both ACPI and OF are disabled, the dev_vdata variable is unused: + +drivers/crypto/ccp/sp-platform.c:33:34: error: unused variable 'dev_vdata' [-Werror,-Wunused-const-variable] + +This is not a useful configuration, and there is not much point in saving +a few bytes when only one of the two is enabled, so just remove all +these ifdef checks and rely on of_match_node() and acpi_match_device() +returning NULL when these subsystems are disabled. + +Fixes: 6c5063434098 ("crypto: ccp - Add ACPI support") +Signed-off-by: Arnd Bergmann +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sp-platform.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/ccp/sp-platform.c b/drivers/crypto/ccp/sp-platform.c +index 7d79a8744f9a6..c43ad7e1acf7e 100644 +--- a/drivers/crypto/ccp/sp-platform.c ++++ b/drivers/crypto/ccp/sp-platform.c +@@ -39,44 +39,38 @@ static const struct sp_dev_vdata dev_vdata[] = { + }, + }; + +-#ifdef CONFIG_ACPI + static const struct acpi_device_id sp_acpi_match[] = { + { "AMDI0C00", (kernel_ulong_t)&dev_vdata[0] }, + { }, + }; + MODULE_DEVICE_TABLE(acpi, sp_acpi_match); +-#endif + +-#ifdef CONFIG_OF + static const struct of_device_id sp_of_match[] = { + { .compatible = "amd,ccp-seattle-v1a", + .data = (const void *)&dev_vdata[0] }, + { }, + }; + MODULE_DEVICE_TABLE(of, sp_of_match); +-#endif + + static struct sp_dev_vdata *sp_get_of_version(struct platform_device *pdev) + { +-#ifdef CONFIG_OF + const struct of_device_id *match; + + match = of_match_node(sp_of_match, pdev->dev.of_node); + if (match && match->data) + return (struct sp_dev_vdata *)match->data; +-#endif ++ + return NULL; + } + + static struct sp_dev_vdata *sp_get_acpi_version(struct platform_device *pdev) + { +-#ifdef CONFIG_ACPI + const struct acpi_device_id *match; + + match = acpi_match_device(sp_acpi_match, &pdev->dev); + if (match && match->driver_data) + return (struct sp_dev_vdata *)match->driver_data; +-#endif ++ + return NULL; + } + +@@ -214,12 +208,8 @@ static int sp_platform_resume(struct platform_device *pdev) + static struct platform_driver sp_platform_driver = { + .driver = { + .name = "ccp", +-#ifdef CONFIG_ACPI + .acpi_match_table = sp_acpi_match, +-#endif +-#ifdef CONFIG_OF + .of_match_table = sp_of_match, +-#endif + }, + .probe = sp_platform_probe, + .remove = sp_platform_remove, +-- +2.43.0 + diff --git a/queue-6.6/crypto-qat-specify-firmware-files-for-402xx.patch b/queue-6.6/crypto-qat-specify-firmware-files-for-402xx.patch new file mode 100644 index 00000000000..9518759428f --- /dev/null +++ b/queue-6.6/crypto-qat-specify-firmware-files-for-402xx.patch @@ -0,0 +1,43 @@ +From 3c8404f6555e7f85e7d985d9c9337653cbf425d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 15:13:17 +0100 +Subject: crypto: qat - specify firmware files for 402xx + +From: Giovanni Cabiddu + +[ Upstream commit a3dc1f2b6b932a13f139d3be3c765155542c1070 ] + +The 4xxx driver can probe 4xxx and 402xx devices. However, the driver +only specifies the firmware images required for 4xxx. +This might result in external tools missing these binaries, if required, +in the initramfs. + +Specify the firmware image used by 402xx with the MODULE_FIRMWARE() +macros in the 4xxx driver. + +Fixes: a3e8c919b993 ("crypto: qat - add support for 402xx devices") +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Damian Muszynski +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/qat/qat_4xxx/adf_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/crypto/intel/qat/qat_4xxx/adf_drv.c b/drivers/crypto/intel/qat/qat_4xxx/adf_drv.c +index 90f5c1ca7b8d8..f6f9e20f74b54 100644 +--- a/drivers/crypto/intel/qat/qat_4xxx/adf_drv.c ++++ b/drivers/crypto/intel/qat/qat_4xxx/adf_drv.c +@@ -463,7 +463,9 @@ module_pci_driver(adf_driver); + MODULE_LICENSE("Dual BSD/GPL"); + MODULE_AUTHOR("Intel"); + MODULE_FIRMWARE(ADF_4XXX_FW); ++MODULE_FIRMWARE(ADF_402XX_FW); + MODULE_FIRMWARE(ADF_4XXX_MMP); ++MODULE_FIRMWARE(ADF_402XX_MMP); + MODULE_DESCRIPTION("Intel(R) QuickAssist Technology"); + MODULE_VERSION(ADF_DRV_VERSION); + MODULE_SOFTDEP("pre: crypto-intel_qat"); +-- +2.43.0 + diff --git a/queue-6.6/crypto-x86-nh-avx2-add-missing-vzeroupper.patch b/queue-6.6/crypto-x86-nh-avx2-add-missing-vzeroupper.patch new file mode 100644 index 00000000000..5322fa0872d --- /dev/null +++ b/queue-6.6/crypto-x86-nh-avx2-add-missing-vzeroupper.patch @@ -0,0 +1,36 @@ +From 0b6096e2db9b82eadb804ba47bb5610db6712e9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 20:26:08 -0400 +Subject: crypto: x86/nh-avx2 - add missing vzeroupper + +From: Eric Biggers + +[ Upstream commit 4ad096cca942959871d8ff73826d30f81f856f6e ] + +Since nh_avx2() uses ymm registers, execute vzeroupper before returning +from it. This is necessary to avoid reducing the performance of SSE +code. + +Fixes: 0f961f9f670e ("crypto: x86/nhpoly1305 - add AVX2 accelerated NHPoly1305") +Signed-off-by: Eric Biggers +Acked-by: Tim Chen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/x86/crypto/nh-avx2-x86_64.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/crypto/nh-avx2-x86_64.S b/arch/x86/crypto/nh-avx2-x86_64.S +index ef73a3ab87263..791386d9a83aa 100644 +--- a/arch/x86/crypto/nh-avx2-x86_64.S ++++ b/arch/x86/crypto/nh-avx2-x86_64.S +@@ -154,5 +154,6 @@ SYM_TYPED_FUNC_START(nh_avx2) + vpaddq T1, T0, T0 + vpaddq T4, T0, T0 + vmovdqu T0, (HASH) ++ vzeroupper + RET + SYM_FUNC_END(nh_avx2) +-- +2.43.0 + diff --git a/queue-6.6/crypto-x86-sha256-avx2-add-missing-vzeroupper.patch b/queue-6.6/crypto-x86-sha256-avx2-add-missing-vzeroupper.patch new file mode 100644 index 00000000000..dc6cc167ff6 --- /dev/null +++ b/queue-6.6/crypto-x86-sha256-avx2-add-missing-vzeroupper.patch @@ -0,0 +1,37 @@ +From 6b65931059801c4d152a40e32a041d4376f1d7ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 20:26:09 -0400 +Subject: crypto: x86/sha256-avx2 - add missing vzeroupper + +From: Eric Biggers + +[ Upstream commit 57ce8a4e162599cf9adafef1f29763160a8e5564 ] + +Since sha256_transform_rorx() uses ymm registers, execute vzeroupper +before returning from it. This is necessary to avoid reducing the +performance of SSE code. + +Fixes: d34a460092d8 ("crypto: sha256 - Optimized sha256 x86_64 routine using AVX2's RORX instructions") +Signed-off-by: Eric Biggers +Acked-by: Tim Chen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/x86/crypto/sha256-avx2-asm.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/crypto/sha256-avx2-asm.S b/arch/x86/crypto/sha256-avx2-asm.S +index 9918212faf914..0ffb072be9561 100644 +--- a/arch/x86/crypto/sha256-avx2-asm.S ++++ b/arch/x86/crypto/sha256-avx2-asm.S +@@ -716,6 +716,7 @@ SYM_TYPED_FUNC_START(sha256_transform_rorx) + popq %r13 + popq %r12 + popq %rbx ++ vzeroupper + RET + SYM_FUNC_END(sha256_transform_rorx) + +-- +2.43.0 + diff --git a/queue-6.6/crypto-x86-sha512-avx2-add-missing-vzeroupper.patch b/queue-6.6/crypto-x86-sha512-avx2-add-missing-vzeroupper.patch new file mode 100644 index 00000000000..0b190849627 --- /dev/null +++ b/queue-6.6/crypto-x86-sha512-avx2-add-missing-vzeroupper.patch @@ -0,0 +1,37 @@ +From eb2b5e60c6bd1388c41e93de5b52e9fb0905a223 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 20:26:10 -0400 +Subject: crypto: x86/sha512-avx2 - add missing vzeroupper + +From: Eric Biggers + +[ Upstream commit 6a24fdfe1edbafacdacd53516654d99068f20eec ] + +Since sha512_transform_rorx() uses ymm registers, execute vzeroupper +before returning from it. This is necessary to avoid reducing the +performance of SSE code. + +Fixes: e01d69cb0195 ("crypto: sha512 - Optimized SHA512 x86_64 assembly routine using AVX instructions.") +Signed-off-by: Eric Biggers +Acked-by: Tim Chen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/x86/crypto/sha512-avx2-asm.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/crypto/sha512-avx2-asm.S b/arch/x86/crypto/sha512-avx2-asm.S +index f08496cd68708..24973f42c43ff 100644 +--- a/arch/x86/crypto/sha512-avx2-asm.S ++++ b/arch/x86/crypto/sha512-avx2-asm.S +@@ -680,6 +680,7 @@ SYM_TYPED_FUNC_START(sha512_transform_rorx) + pop %r12 + pop %rbx + ++ vzeroupper + RET + SYM_FUNC_END(sha512_transform_rorx) + +-- +2.43.0 + diff --git a/queue-6.6/dev_printk-add-and-use-dev_no_printk.patch b/queue-6.6/dev_printk-add-and-use-dev_no_printk.patch new file mode 100644 index 00000000000..c93f578e204 --- /dev/null +++ b/queue-6.6/dev_printk-add-and-use-dev_no_printk.patch @@ -0,0 +1,98 @@ +From 6635a501863bd048ba67f6d0e62bcbb9ad9eb418 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 15:00:03 +0100 +Subject: dev_printk: Add and use dev_no_printk() + +From: Geert Uytterhoeven + +[ Upstream commit c26ec799042a3888935d59b599f33e41efedf5f8 ] + +When printk-indexing is enabled, each dev_printk() invocation emits a +pi_entry structure. This is even true when the dev_printk() is +protected by an always-false check, as is typically the case for debug +messages: while the actual code to print the message is optimized out by +the compiler, the pi_entry structure is still emitted. + +Avoid emitting pi_entry structures for unavailable dev_printk() kernel +messages by: + 1. Introducing a dev_no_printk() helper, mimicked after the existing + no_printk() helper, which calls _dev_printk() instead of + dev_printk(), + 2. Replacing all "if (0) dev_printk(...)" constructs by calls to the + new helper. + +This reduces the size of an arm64 defconfig kernel with +CONFIG_PRINTK_INDEX=y by 957 KiB. + +Fixes: ad7d61f159db7397 ("printk: index: Add indexing support to dev_printk") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Andy Shevchenko +Reviewed-by: Xiubo Li +Reviewed-by: Chris Down +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/8583d54f1687c801c6cda8edddf2cf0344c6e883.1709127473.git.geert+renesas@glider.be +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + include/linux/dev_printk.h | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +diff --git a/include/linux/dev_printk.h b/include/linux/dev_printk.h +index 6bfe70decc9fb..ae80a303c216b 100644 +--- a/include/linux/dev_printk.h ++++ b/include/linux/dev_printk.h +@@ -129,6 +129,16 @@ void _dev_info(const struct device *dev, const char *fmt, ...) + _dev_printk(level, dev, fmt, ##__VA_ARGS__); \ + }) + ++/* ++ * Dummy dev_printk for disabled debugging statements to use whilst maintaining ++ * gcc's format checking. ++ */ ++#define dev_no_printk(level, dev, fmt, ...) \ ++ ({ \ ++ if (0) \ ++ _dev_printk(level, dev, fmt, ##__VA_ARGS__); \ ++ }) ++ + /* + * #defines for all the dev_ macros to prefix with whatever + * possible use of #define dev_fmt(fmt) ... +@@ -158,10 +168,7 @@ void _dev_info(const struct device *dev, const char *fmt, ...) + dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__) + #else + #define dev_dbg(dev, fmt, ...) \ +-({ \ +- if (0) \ +- dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__); \ +-}) ++ dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__) + #endif + + #ifdef CONFIG_PRINTK +@@ -247,20 +254,14 @@ do { \ + } while (0) + #else + #define dev_dbg_ratelimited(dev, fmt, ...) \ +-do { \ +- if (0) \ +- dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__); \ +-} while (0) ++ dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__) + #endif + + #ifdef VERBOSE_DEBUG + #define dev_vdbg dev_dbg + #else + #define dev_vdbg(dev, fmt, ...) \ +-({ \ +- if (0) \ +- dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__); \ +-}) ++ dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__) + #endif + + /* +-- +2.43.0 + diff --git a/queue-6.6/dlm-fix-user-space-lock-decision-to-copy-lvb.patch b/queue-6.6/dlm-fix-user-space-lock-decision-to-copy-lvb.patch new file mode 100644 index 00000000000..60f1409d1be --- /dev/null +++ b/queue-6.6/dlm-fix-user-space-lock-decision-to-copy-lvb.patch @@ -0,0 +1,143 @@ +From cb3f168729a818b95bac6a73ec5f4854627a0df4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 11:48:33 -0400 +Subject: dlm: fix user space lock decision to copy lvb + +From: Alexander Aring + +[ Upstream commit ad191e0eeebf64a60ca2d16ca01a223d2b1dd25e ] + +This patch fixes the copy lvb decision for user space lock requests. +Checking dlm_lvb_operations is done earlier, where granted/requested +lock modes are available to use in the matrix. + +The decision had been moved to the wrong location, where granted mode +and requested mode where the same, which causes the dlm_lvb_operations +matix to produce the wrong copy decision. For PW or EX requests, the +caller could get invalid lvb data. + +Fixes: 61bed0baa4db ("fs: dlm: use a non-static queue for callbacks") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/ast.c | 14 ++++++++++++++ + fs/dlm/dlm_internal.h | 1 + + fs/dlm/user.c | 15 ++------------- + 3 files changed, 17 insertions(+), 13 deletions(-) + +diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c +index 1f2f70a1b824e..decedc4ee15f6 100644 +--- a/fs/dlm/ast.c ++++ b/fs/dlm/ast.c +@@ -12,6 +12,7 @@ + #include + + #include "dlm_internal.h" ++#include "lvb_table.h" + #include "memory.h" + #include "lock.h" + #include "user.h" +@@ -42,6 +43,7 @@ int dlm_enqueue_lkb_callback(struct dlm_lkb *lkb, uint32_t flags, int mode, + struct dlm_ls *ls = lkb->lkb_resource->res_ls; + int rv = DLM_ENQUEUE_CALLBACK_SUCCESS; + struct dlm_callback *cb; ++ int copy_lvb = 0; + int prev_mode; + + if (flags & DLM_CB_BAST) { +@@ -73,6 +75,17 @@ int dlm_enqueue_lkb_callback(struct dlm_lkb *lkb, uint32_t flags, int mode, + goto out; + } + } ++ } else if (flags & DLM_CB_CAST) { ++ if (test_bit(DLM_DFL_USER_BIT, &lkb->lkb_dflags)) { ++ if (lkb->lkb_last_cast) ++ prev_mode = lkb->lkb_last_cb->mode; ++ else ++ prev_mode = -1; ++ ++ if (!status && lkb->lkb_lksb->sb_lvbptr && ++ dlm_lvb_operations[prev_mode + 1][mode + 1]) ++ copy_lvb = 1; ++ } + } + + cb = dlm_allocate_cb(); +@@ -85,6 +98,7 @@ int dlm_enqueue_lkb_callback(struct dlm_lkb *lkb, uint32_t flags, int mode, + cb->mode = mode; + cb->sb_status = status; + cb->sb_flags = (sbflags & 0x000000FF); ++ cb->copy_lvb = copy_lvb; + kref_init(&cb->ref); + if (!test_and_set_bit(DLM_IFL_CB_PENDING_BIT, &lkb->lkb_iflags)) + rv = DLM_ENQUEUE_CALLBACK_NEED_SCHED; +diff --git a/fs/dlm/dlm_internal.h b/fs/dlm/dlm_internal.h +index dfc444dad3298..511d0b984f580 100644 +--- a/fs/dlm/dlm_internal.h ++++ b/fs/dlm/dlm_internal.h +@@ -222,6 +222,7 @@ struct dlm_callback { + int sb_status; /* copy to lksb status */ + uint8_t sb_flags; /* copy to lksb flags */ + int8_t mode; /* rq mode of bast, gr mode of cast */ ++ int copy_lvb; + + struct list_head list; + struct kref ref; +diff --git a/fs/dlm/user.c b/fs/dlm/user.c +index 9f9b68448830e..12a483deeef5e 100644 +--- a/fs/dlm/user.c ++++ b/fs/dlm/user.c +@@ -21,7 +21,6 @@ + #include "dlm_internal.h" + #include "lockspace.h" + #include "lock.h" +-#include "lvb_table.h" + #include "user.h" + #include "ast.h" + #include "config.h" +@@ -806,8 +805,7 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count, + struct dlm_lkb *lkb; + DECLARE_WAITQUEUE(wait, current); + struct dlm_callback *cb; +- int rv, ret, copy_lvb = 0; +- int old_mode, new_mode; ++ int rv, ret; + + if (count == sizeof(struct dlm_device_version)) { + rv = copy_version_to_user(buf, count); +@@ -864,9 +862,6 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count, + + lkb = list_first_entry(&proc->asts, struct dlm_lkb, lkb_cb_list); + +- /* rem_lkb_callback sets a new lkb_last_cast */ +- old_mode = lkb->lkb_last_cast->mode; +- + rv = dlm_dequeue_lkb_callback(lkb, &cb); + switch (rv) { + case DLM_DEQUEUE_CALLBACK_EMPTY: +@@ -895,12 +890,6 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count, + if (cb->flags & DLM_CB_BAST) { + trace_dlm_bast(lkb->lkb_resource->res_ls, lkb, cb->mode); + } else if (cb->flags & DLM_CB_CAST) { +- new_mode = cb->mode; +- +- if (!cb->sb_status && lkb->lkb_lksb->sb_lvbptr && +- dlm_lvb_operations[old_mode + 1][new_mode + 1]) +- copy_lvb = 1; +- + lkb->lkb_lksb->sb_status = cb->sb_status; + lkb->lkb_lksb->sb_flags = cb->sb_flags; + trace_dlm_ast(lkb->lkb_resource->res_ls, lkb); +@@ -908,7 +897,7 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count, + + ret = copy_result_to_user(lkb->lkb_ua, + test_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags), +- cb->flags, cb->mode, copy_lvb, buf, count); ++ cb->flags, cb->mode, cb->copy_lvb, buf, count); + + kref_put(&cb->ref, dlm_release_callback); + +-- +2.43.0 + diff --git a/queue-6.6/drivers-perf-hisi-hns3-actually-use-devm_add_action_.patch b/queue-6.6/drivers-perf-hisi-hns3-actually-use-devm_add_action_.patch new file mode 100644 index 00000000000..7cb0823af17 --- /dev/null +++ b/queue-6.6/drivers-perf-hisi-hns3-actually-use-devm_add_action_.patch @@ -0,0 +1,43 @@ +From 5fd3a69d0c0bc6768810f0a9998ddced2ec8ecab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 20:46:27 +0800 +Subject: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() + +From: Hao Chen + +[ Upstream commit 582c1aeee0a9e73010cf1c4cef338709860deeb0 ] + +pci_alloc_irq_vectors() allocates an irq vector. When devm_add_action() +fails, the irq vector is not freed, which leads to a memory leak. + +Replace the devm_add_action with devm_add_action_or_reset to ensure +the irq vector can be destroyed when it fails. + +Fixes: 66637ab137b4 ("drivers/perf: hisi: add driver for HNS3 PMU") +Signed-off-by: Hao Chen +Signed-off-by: Junhao He +Reviewed-by: Jijie Shao +Acked-by: Jonathan Cameron +Link: https://lore.kernel.org/r/20240425124627.13764-4-hejunhao3@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/hisilicon/hns3_pmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/hisilicon/hns3_pmu.c b/drivers/perf/hisilicon/hns3_pmu.c +index cbdd53b0a0342..60062eaa342aa 100644 +--- a/drivers/perf/hisilicon/hns3_pmu.c ++++ b/drivers/perf/hisilicon/hns3_pmu.c +@@ -1527,7 +1527,7 @@ static int hns3_pmu_irq_register(struct pci_dev *pdev, + return ret; + } + +- ret = devm_add_action(&pdev->dev, hns3_pmu_free_irq, pdev); ++ ret = devm_add_action_or_reset(&pdev->dev, hns3_pmu_free_irq, pdev); + if (ret) { + pci_err(pdev, "failed to add free irq action, ret = %d.\n", ret); + return ret; +-- +2.43.0 + diff --git a/queue-6.6/drivers-perf-hisi-hns3-fix-out-of-bound-access-when-.patch b/queue-6.6/drivers-perf-hisi-hns3-fix-out-of-bound-access-when-.patch new file mode 100644 index 00000000000..6c8dceb844b --- /dev/null +++ b/queue-6.6/drivers-perf-hisi-hns3-fix-out-of-bound-access-when-.patch @@ -0,0 +1,70 @@ +From 1f9e60353af828bf5106ed149b0f5e313fdbfca2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 20:46:26 +0800 +Subject: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event + group + +From: Junhao He + +[ Upstream commit 81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e ] + +The perf tool allows users to create event groups through following +cmd [1], but the driver does not check whether the array index is out +of bounds when writing data to the event_group array. If the number of +events in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the +memory write overflow of event_group array occurs. + +Add array index check to fix the possible array out of bounds violation, +and return directly when write new events are written to array bounds. + +There are 9 different events in an event_group. +[1] perf stat -e '{pmu/event1/, ... ,pmu/event9/} + +Fixes: 66637ab137b4 ("drivers/perf: hisi: add driver for HNS3 PMU") +Signed-off-by: Junhao He +Signed-off-by: Hao Chen +Acked-by: Jonathan Cameron +Reviewed-by: Jijie Shao +Link: https://lore.kernel.org/r/20240425124627.13764-3-hejunhao3@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/hisilicon/hns3_pmu.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/hisilicon/hns3_pmu.c b/drivers/perf/hisilicon/hns3_pmu.c +index 16869bf5bf4cc..cbdd53b0a0342 100644 +--- a/drivers/perf/hisilicon/hns3_pmu.c ++++ b/drivers/perf/hisilicon/hns3_pmu.c +@@ -1085,15 +1085,27 @@ static bool hns3_pmu_validate_event_group(struct perf_event *event) + return false; + + for (num = 0; num < counters; num++) { ++ /* ++ * If we find a related event, then it's a valid group ++ * since we don't need to allocate a new counter for it. ++ */ + if (hns3_pmu_cmp_event(event_group[num], sibling)) + break; + } + ++ /* ++ * Otherwise it's a new event but if there's no available counter, ++ * fail the check since we cannot schedule all the events in ++ * the group simultaneously. ++ */ ++ if (num == HNS3_PMU_MAX_HW_EVENTS) ++ return false; ++ + if (num == counters) + event_group[counters++] = sibling; + } + +- return counters <= HNS3_PMU_MAX_HW_EVENTS; ++ return true; + } + + static u32 hns3_pmu_get_filter_condition(struct perf_event *event) +-- +2.43.0 + diff --git a/queue-6.6/drivers-perf-hisi_pcie-fix-out-of-bound-access-when-.patch b/queue-6.6/drivers-perf-hisi_pcie-fix-out-of-bound-access-when-.patch new file mode 100644 index 00000000000..274613896a8 --- /dev/null +++ b/queue-6.6/drivers-perf-hisi_pcie-fix-out-of-bound-access-when-.patch @@ -0,0 +1,69 @@ +From 6105c5da5ed9ff778983d4fdb02b73793e574b16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 20:46:25 +0800 +Subject: drivers/perf: hisi_pcie: Fix out-of-bound access when valid event + group + +From: Junhao He + +[ Upstream commit 77fce82678ea5fd51442e62febec2004f79e041b ] + +The perf tool allows users to create event groups through following +cmd [1], but the driver does not check whether the array index is out of +bounds when writing data to the event_group array. If the number of events +in an event_group is greater than HISI_PCIE_MAX_COUNTERS, the memory write +overflow of event_group array occurs. + +Add array index check to fix the possible array out of bounds violation, +and return directly when write new events are written to array bounds. + +There are 9 different events in an event_group. +[1] perf stat -e '{pmu/event1/, ... ,pmu/event9/}' + +Fixes: 8404b0fbc7fb ("drivers/perf: hisi: Add driver for HiSilicon PCIe PMU") +Signed-off-by: Junhao He +Reviewed-by: Jijie Shao +Acked-by: Jonathan Cameron +Link: https://lore.kernel.org/r/20240425124627.13764-2-hejunhao3@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/hisilicon/hisi_pcie_pmu.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c +index 051efffc44c82..430ca15373fe2 100644 +--- a/drivers/perf/hisilicon/hisi_pcie_pmu.c ++++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c +@@ -337,15 +337,27 @@ static bool hisi_pcie_pmu_validate_event_group(struct perf_event *event) + return false; + + for (num = 0; num < counters; num++) { ++ /* ++ * If we find a related event, then it's a valid group ++ * since we don't need to allocate a new counter for it. ++ */ + if (hisi_pcie_pmu_cmp_event(event_group[num], sibling)) + break; + } + ++ /* ++ * Otherwise it's a new event but if there's no available counter, ++ * fail the check since we cannot schedule all the events in ++ * the group simultaneously. ++ */ ++ if (num == HISI_PCIE_MAX_COUNTERS) ++ return false; ++ + if (num == counters) + event_group[counters++] = sibling; + } + +- return counters <= HISI_PCIE_MAX_COUNTERS; ++ return true; + } + + static int hisi_pcie_pmu_event_init(struct perf_event *event) +-- +2.43.0 + diff --git a/queue-6.6/drivers-virt-acrn-fix-pfnmap-pte-checks-in-acrn_vm_r.patch b/queue-6.6/drivers-virt-acrn-fix-pfnmap-pte-checks-in-acrn_vm_r.patch new file mode 100644 index 00000000000..94ebeed70ec --- /dev/null +++ b/queue-6.6/drivers-virt-acrn-fix-pfnmap-pte-checks-in-acrn_vm_r.patch @@ -0,0 +1,195 @@ +From 3245a7dad4fffd245500ed115d91c65d8ef69cc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 17:55:25 +0200 +Subject: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() + +From: David Hildenbrand + +[ Upstream commit 3d6586008f7b638f91f3332602592caa8b00b559 ] + +Patch series "mm: follow_pte() improvements and acrn follow_pte() fixes". + +Patch #1 fixes a bunch of issues I spotted in the acrn driver. It +compiles, that's all I know. I'll appreciate some review and testing from +acrn folks. + +Patch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding +more sanity checks, and improving the documentation. Gave it a quick test +on x86-64 using VM_PAT that ends up using follow_pte(). + +This patch (of 3): + +We currently miss handling various cases, resulting in a dangerous +follow_pte() (previously follow_pfn()) usage. + +(1) We're not checking PTE write permissions. + +Maybe we should simply always require pte_write() like we do for +pin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let's check for +ACRN_MEM_ACCESS_WRITE for now. + +(2) We're not rejecting refcounted pages. + +As we are not using MMU notifiers, messing with refcounted pages is +dangerous and can result in use-after-free. Let's make sure to reject them. + +(3) We are only looking at the first PTE of a bigger range. + +We only lookup a single PTE, but memmap->len may span a larger area. +Let's loop over all involved PTEs and make sure the PFN range is +actually contiguous. Reject everything else: it couldn't have worked +either way, and rather made use access PFNs we shouldn't be accessing. + +Link: https://lkml.kernel.org/r/20240410155527.474777-1-david@redhat.com +Link: https://lkml.kernel.org/r/20240410155527.474777-2-david@redhat.com +Fixes: 8a6e85f75a83 ("virt: acrn: obtain pa from VMA with PFNMAP flag") +Signed-off-by: David Hildenbrand +Cc: Alex Williamson +Cc: Christoph Hellwig +Cc: Fei Li +Cc: Gerald Schaefer +Cc: Heiko Carstens +Cc: Ingo Molnar +Cc: Paolo Bonzini +Cc: Yonghua Huang +Cc: Sean Christopherson +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/virt/acrn/mm.c | 63 +++++++++++++++++++++++++++++++----------- + 1 file changed, 47 insertions(+), 16 deletions(-) + +diff --git a/drivers/virt/acrn/mm.c b/drivers/virt/acrn/mm.c +index ffc1d1136f765..8ef49d7be453c 100644 +--- a/drivers/virt/acrn/mm.c ++++ b/drivers/virt/acrn/mm.c +@@ -155,23 +155,29 @@ int acrn_vm_memseg_unmap(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + { + struct vm_memory_region_batch *regions_info; +- int nr_pages, i = 0, order, nr_regions = 0; ++ int nr_pages, i, order, nr_regions = 0; + struct vm_memory_mapping *region_mapping; + struct vm_memory_region_op *vm_region; + struct page **pages = NULL, *page; + void *remap_vaddr; + int ret, pinned; + u64 user_vm_pa; +- unsigned long pfn; + struct vm_area_struct *vma; + + if (!vm || !memmap) + return -EINVAL; + ++ /* Get the page number of the map region */ ++ nr_pages = memmap->len >> PAGE_SHIFT; ++ if (!nr_pages) ++ return -EINVAL; ++ + mmap_read_lock(current->mm); + vma = vma_lookup(current->mm, memmap->vma_base); + if (vma && ((vma->vm_flags & VM_PFNMAP) != 0)) { ++ unsigned long start_pfn, cur_pfn; + spinlock_t *ptl; ++ bool writable; + pte_t *ptep; + + if ((memmap->vma_base + memmap->len) > vma->vm_end) { +@@ -179,25 +185,53 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + return -EINVAL; + } + +- ret = follow_pte(vma->vm_mm, memmap->vma_base, &ptep, &ptl); +- if (ret < 0) { +- mmap_read_unlock(current->mm); ++ for (i = 0; i < nr_pages; i++) { ++ ret = follow_pte(vma->vm_mm, ++ memmap->vma_base + i * PAGE_SIZE, ++ &ptep, &ptl); ++ if (ret) ++ break; ++ ++ cur_pfn = pte_pfn(ptep_get(ptep)); ++ if (i == 0) ++ start_pfn = cur_pfn; ++ writable = !!pte_write(ptep_get(ptep)); ++ pte_unmap_unlock(ptep, ptl); ++ ++ /* Disallow write access if the PTE is not writable. */ ++ if (!writable && ++ (memmap->attr & ACRN_MEM_ACCESS_WRITE)) { ++ ret = -EFAULT; ++ break; ++ } ++ ++ /* Disallow refcounted pages. */ ++ if (pfn_valid(cur_pfn) && ++ !PageReserved(pfn_to_page(cur_pfn))) { ++ ret = -EFAULT; ++ break; ++ } ++ ++ /* Disallow non-contiguous ranges. */ ++ if (cur_pfn != start_pfn + i) { ++ ret = -EINVAL; ++ break; ++ } ++ } ++ mmap_read_unlock(current->mm); ++ ++ if (ret) { + dev_dbg(acrn_dev.this_device, + "Failed to lookup PFN at VMA:%pK.\n", (void *)memmap->vma_base); + return ret; + } +- pfn = pte_pfn(ptep_get(ptep)); +- pte_unmap_unlock(ptep, ptl); +- mmap_read_unlock(current->mm); + + return acrn_mm_region_add(vm, memmap->user_vm_pa, +- PFN_PHYS(pfn), memmap->len, ++ PFN_PHYS(start_pfn), memmap->len, + ACRN_MEM_TYPE_WB, memmap->attr); + } + mmap_read_unlock(current->mm); + +- /* Get the page number of the map region */ +- nr_pages = memmap->len >> PAGE_SHIFT; + pages = vzalloc(array_size(nr_pages, sizeof(*pages))); + if (!pages) + return -ENOMEM; +@@ -241,12 +275,11 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + mutex_unlock(&vm->regions_mapping_lock); + + /* Calculate count of vm_memory_region_op */ +- while (i < nr_pages) { ++ for (i = 0; i < nr_pages; i += 1 << order) { + page = pages[i]; + VM_BUG_ON_PAGE(PageTail(page), page); + order = compound_order(page); + nr_regions++; +- i += 1 << order; + } + + /* Prepare the vm_memory_region_batch */ +@@ -263,8 +296,7 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + regions_info->regions_num = nr_regions; + regions_info->regions_gpa = virt_to_phys(vm_region); + user_vm_pa = memmap->user_vm_pa; +- i = 0; +- while (i < nr_pages) { ++ for (i = 0; i < nr_pages; i += 1 << order) { + u32 region_size; + + page = pages[i]; +@@ -280,7 +312,6 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + + vm_region++; + user_vm_pa += region_size; +- i += 1 << order; + } + + /* Inform the ACRN Hypervisor to set up EPT mappings */ +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-add-dtbclk-access-to-dcn315.patch b/queue-6.6/drm-amd-display-add-dtbclk-access-to-dcn315.patch new file mode 100644 index 00000000000..8afd24715f3 --- /dev/null +++ b/queue-6.6/drm-amd-display-add-dtbclk-access-to-dcn315.patch @@ -0,0 +1,55 @@ +From a139b8d4eea1baecb9da9764c2ea7a7ad4e9263a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 21:07:46 -0400 +Subject: drm/amd/display: Add dtbclk access to dcn315 + +From: Swapnil Patel + +[ Upstream commit a01b64f31d65bdc917d1afb4cec9915beb6931be ] + +[Why & How] + +Currently DCN315 clk manager is missing code to enable/disable dtbclk. +Because of this, "optimized_required" flag is constantly set +and this prevents FreeSync from engaging for certain high bandwidth +display Modes which require DTBCLK. + +Reviewed-by: Dmytro Laktyushkin +Acked-by: Aurabindo Pillai +Signed-off-by: Swapnil Patel +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +index 8776055bbeaae..d4d3f58a613f7 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +@@ -145,6 +145,10 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, + */ + clk_mgr_base->clks.zstate_support = new_clocks->zstate_support; + if (safe_to_lower) { ++ if (clk_mgr_base->clks.dtbclk_en && !new_clocks->dtbclk_en) { ++ dcn315_smu_set_dtbclk(clk_mgr, false); ++ clk_mgr_base->clks.dtbclk_en = new_clocks->dtbclk_en; ++ } + /* check that we're not already in lower */ + if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_LOW_POWER) { + display_count = dcn315_get_active_display_cnt_wa(dc, context); +@@ -160,6 +164,10 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, + } + } + } else { ++ if (!clk_mgr_base->clks.dtbclk_en && new_clocks->dtbclk_en) { ++ dcn315_smu_set_dtbclk(clk_mgr, true); ++ clk_mgr_base->clks.dtbclk_en = new_clocks->dtbclk_en; ++ } + /* check that we're not already in D0 */ + if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_MISSION_MODE) { + union display_idle_optimization_u idle_info = { 0 }; +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-add-vco-speed-parameter-for-dcn31-fp.patch b/queue-6.6/drm-amd-display-add-vco-speed-parameter-for-dcn31-fp.patch new file mode 100644 index 00000000000..31f8c3713e9 --- /dev/null +++ b/queue-6.6/drm-amd-display-add-vco-speed-parameter-for-dcn31-fp.patch @@ -0,0 +1,43 @@ +From 8f0a31907665436d2ebf4e13b57ae83916803952 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 11:19:03 -0600 +Subject: drm/amd/display: Add VCO speed parameter for DCN31 FPU + +From: Rodrigo Siqueira + +[ Upstream commit 0e62103bdcbc88281e16add299a946fb3bd02fbe ] + +Add VCO speed parameters in the bounding box array. + +Acked-by: Wayne Lin +Signed-off-by: Rodrigo Siqueira +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c +index deb6d162a2d5c..7307b7b8d8ad7 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c +@@ -291,6 +291,7 @@ static struct _vcs_dpi_soc_bounding_box_st dcn3_15_soc = { + .do_urgent_latency_adjustment = false, + .urgent_latency_adjustment_fabric_clock_component_us = 0, + .urgent_latency_adjustment_fabric_clock_reference_mhz = 0, ++ .dispclk_dppclk_vco_speed_mhz = 2400.0, + .num_chans = 4, + .dummy_pstate_latency_us = 10.0 + }; +@@ -438,6 +439,7 @@ static struct _vcs_dpi_soc_bounding_box_st dcn3_16_soc = { + .do_urgent_latency_adjustment = false, + .urgent_latency_adjustment_fabric_clock_component_us = 0, + .urgent_latency_adjustment_fabric_clock_reference_mhz = 0, ++ .dispclk_dppclk_vco_speed_mhz = 2500.0, + }; + + void dcn31_zero_pipe_dcc_fraction(display_e2e_pipe_params_st *pipes, +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-allocate-zero-bw-after-bw-alloc-enab.patch b/queue-6.6/drm-amd-display-allocate-zero-bw-after-bw-alloc-enab.patch new file mode 100644 index 00000000000..928f9ccdeaf --- /dev/null +++ b/queue-6.6/drm-amd-display-allocate-zero-bw-after-bw-alloc-enab.patch @@ -0,0 +1,62 @@ +From e04256562c092db775e948f681a7dadd8afa9d23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 10:46:35 -0400 +Subject: drm/amd/display: Allocate zero bw after bw alloc enable + +From: Meenakshikumar Somasundaram + +[ Upstream commit 46fe9cb1a9e62f4e6229f48ae303ef8e6c1fdc64 ] + +[Why] +During DP tunnel creation, CM preallocates BW and reduces +estimated BW of other DPIA. CM release preallocation only +when allocation is complete. Display mode validation logic +validates timings based on bw available per host router. +In multi display setup, this causes bw allocation failure +when allocation greater than estimated bw. + +[How] +Do zero alloc to make the CM to release preallocation and +update estimated BW correctly for all DPIAs per host router. + +Reviewed-by: PeiChen Huang +Acked-by: Aurabindo Pillai +Signed-off-by: Meenakshikumar Somasundaram +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/link/protocols/link_dp_dpia_bw.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c +index 5491b707cec88..5a965c26bf209 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c +@@ -270,7 +270,7 @@ static void set_usb4_req_bw_req(struct dc_link *link, int req_bw) + + /* Error check whether requested and allocated are equal */ + req_bw = requested_bw * (Kbps_TO_Gbps / link->dpia_bw_alloc_config.bw_granularity); +- if (req_bw == link->dpia_bw_alloc_config.allocated_bw) { ++ if (req_bw && (req_bw == link->dpia_bw_alloc_config.allocated_bw)) { + DC_LOG_ERROR("%s: Request bw equals to allocated bw for link(%d)\n", + __func__, link->link_index); + } +@@ -341,6 +341,14 @@ bool link_dp_dpia_set_dptx_usb4_bw_alloc_support(struct dc_link *link) + ret = true; + init_usb4_bw_struct(link); + link->dpia_bw_alloc_config.bw_alloc_enabled = true; ++ ++ /* ++ * During DP tunnel creation, CM preallocates BW and reduces estimated BW of other ++ * DPIA. CM release preallocation only when allocation is complete. Do zero alloc ++ * to make the CM to release preallocation and update estimated BW correctly for ++ * all DPIAs per host router ++ */ ++ link_dp_dpia_allocate_usb4_bandwidth_for_stream(link, 0); + } + } + +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-disable-seamless-boot-on-128b-132b-e.patch b/queue-6.6/drm-amd-display-disable-seamless-boot-on-128b-132b-e.patch new file mode 100644 index 00000000000..67e466db290 --- /dev/null +++ b/queue-6.6/drm-amd-display-disable-seamless-boot-on-128b-132b-e.patch @@ -0,0 +1,43 @@ +From 55bae345938092f0ad8ef9bcccc9be3e6f222b47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 16:59:36 -0400 +Subject: drm/amd/display: Disable seamless boot on 128b/132b encoding + +From: Sung Joon Kim + +[ Upstream commit 6f0c228ed9184287031a66b46a79e5a3d2e73a86 ] + +[why] +preOS will not support display mode programming and link training +for UHBR rates. + +[how] +If we detect a sink that's UHBR capable, disable seamless boot + +Reviewed-by: Anthony Koo +Acked-by: Wayne Lin +Signed-off-by: Sung Joon Kim +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 46b10ff8f6d41..72db370e2f21f 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -1710,6 +1710,9 @@ bool dc_validate_boot_timing(const struct dc *dc, + return false; + } + ++ if (link->dpcd_caps.channel_coding_cap.bits.DP_128b_132b_SUPPORTED) ++ return false; ++ + if (dc->link_srv->edp_is_ilr_optimization_required(link, crtc_timing)) { + DC_LOG_EVENT_LINK_TRAINING("Seamless boot disabled to optimize eDP link rate\n"); + return false; +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-fix-dc-mode-screen-flickering-on-dcn.patch b/queue-6.6/drm-amd-display-fix-dc-mode-screen-flickering-on-dcn.patch new file mode 100644 index 00000000000..c89f8441666 --- /dev/null +++ b/queue-6.6/drm-amd-display-fix-dc-mode-screen-flickering-on-dcn.patch @@ -0,0 +1,61 @@ +From 22792893efc5e7c916bf56f1702e3d4eba40c141 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 17:17:04 -0400 +Subject: drm/amd/display: Fix DC mode screen flickering on DCN321 + +From: Leo Ma + +[ Upstream commit ce649bd2d834db83ecc2756a362c9a1ec61658a5 ] + +[Why && How] +Screen flickering saw on 4K@60 eDP with high refresh rate external +monitor when booting up in DC mode. DC Mode Capping is disabled +which caused wrong UCLK being used. + +Reviewed-by: Alvin Lee +Acked-by: Wayne Lin +Signed-off-by: Leo Ma +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c +index e9345f6554dbc..2428a4763b85f 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c +@@ -547,8 +547,12 @@ static void dcn32_update_clocks(struct clk_mgr *clk_mgr_base, + * since we calculate mode support based on softmax being the max UCLK + * frequency. + */ +- dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK, +- dc->clk_mgr->bw_params->dc_mode_softmax_memclk); ++ if (dc->debug.disable_dc_mode_overwrite) { ++ dcn30_smu_set_hard_max_by_freq(clk_mgr, PPCLK_UCLK, dc->clk_mgr->bw_params->max_memclk_mhz); ++ dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK, dc->clk_mgr->bw_params->max_memclk_mhz); ++ } else ++ dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK, ++ dc->clk_mgr->bw_params->dc_mode_softmax_memclk); + } else { + dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK, dc->clk_mgr->bw_params->max_memclk_mhz); + } +@@ -581,8 +585,13 @@ static void dcn32_update_clocks(struct clk_mgr *clk_mgr_base, + /* set UCLK to requested value if P-State switching is supported, or to re-enable P-State switching */ + if (clk_mgr_base->clks.p_state_change_support && + (update_uclk || !clk_mgr_base->clks.prev_p_state_change_support) && +- !dc->work_arounds.clock_update_disable_mask.uclk) ++ !dc->work_arounds.clock_update_disable_mask.uclk) { ++ if (dc->clk_mgr->dc_mode_softmax_enabled && dc->debug.disable_dc_mode_overwrite) ++ dcn30_smu_set_hard_max_by_freq(clk_mgr, PPCLK_UCLK, ++ max((int)dc->clk_mgr->bw_params->dc_mode_softmax_memclk, khz_to_mhz_ceil(clk_mgr_base->clks.dramclk_khz))); ++ + dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK, khz_to_mhz_ceil(clk_mgr_base->clks.dramclk_khz)); ++ } + + if (clk_mgr_base->clks.num_ways != new_clocks->num_ways && + clk_mgr_base->clks.num_ways > new_clocks->num_ways) { +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-fix-potential-index-out-of-bounds-in.patch b/queue-6.6/drm-amd-display-fix-potential-index-out-of-bounds-in.patch new file mode 100644 index 00000000000..b16da79e2cf --- /dev/null +++ b/queue-6.6/drm-amd-display-fix-potential-index-out-of-bounds-in.patch @@ -0,0 +1,58 @@ +From 904c45d31b77a1f3f5463da3b449f0aa85673526 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 18:38:08 +0530 +Subject: drm/amd/display: Fix potential index out of bounds in color + transformation function + +From: Srinivasan Shanmugam + +[ Upstream commit 63ae548f1054a0b71678d0349c7dc9628ddd42ca ] + +Fixes index out of bounds issue in the color transformation function. +The issue could occur when the index 'i' exceeds the number of transfer +function points (TRANSFER_FUNC_POINTS). + +The fix adds a check to ensure 'i' is within bounds before accessing the +transfer function points. If 'i' is out of bounds, an error message is +logged and the function returns false to indicate an error. + +Reported by smatch: +drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max +drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max +drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max + +Fixes: b629596072e5 ("drm/amd/display: Build unity lut for shaper") +Cc: Vitaly Prosyak +Cc: Charlene Liu +Cc: Harry Wentland +Cc: Rodrigo Siqueira +Cc: Roman Li +Cc: Aurabindo Pillai +Cc: Tom Chung +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Tom Chung +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +index 3538973bd0c6c..c0372aa4ec838 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +@@ -382,6 +382,11 @@ bool cm_helper_translate_curve_to_hw_format(struct dc_context *ctx, + i += increment) { + if (j == hw_points - 1) + break; ++ if (i >= TRANSFER_FUNC_POINTS) { ++ DC_LOG_ERROR("Index out of bounds: i=%d, TRANSFER_FUNC_POINTS=%d\n", ++ i, TRANSFER_FUNC_POINTS); ++ return false; ++ } + rgb_resulted[j].red = output_tf->tf_pts.red[i]; + rgb_resulted[j].green = output_tf->tf_pts.green[i]; + rgb_resulted[j].blue = output_tf->tf_pts.blue[i]; +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-set-color_mgmt_changed-to-true-on-un.patch b/queue-6.6/drm-amd-display-set-color_mgmt_changed-to-true-on-un.patch new file mode 100644 index 00000000000..b48c3034b8d --- /dev/null +++ b/queue-6.6/drm-amd-display-set-color_mgmt_changed-to-true-on-un.patch @@ -0,0 +1,37 @@ +From 1160926f8667877f5a46ee04ab112aa816541f00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Nov 2023 04:21:55 +0000 +Subject: drm/amd/display: Set color_mgmt_changed to true on unsuspend + +From: Joshua Ashton + +[ Upstream commit 2eb9dd497a698dc384c0dd3e0311d541eb2e13dd ] + +Otherwise we can end up with a frame on unsuspend where color management +is not applied when userspace has not committed themselves. + +Fixes re-applying color management on Steam Deck/Gamescope on S3 resume. + +Signed-off-by: Joshua Ashton +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 98dd07e3726af..7ed6bb61fe0ad 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2956,6 +2956,7 @@ static int dm_resume(void *handle) + dc_stream_release(dm_new_crtc_state->stream); + dm_new_crtc_state->stream = NULL; + } ++ dm_new_crtc_state->base.color_mgmt_changed = true; + } + + for_each_new_plane_in_state(dm->cached_state, plane, new_plane_state, i) { +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-pm-restore-config-space-after-reset.patch b/queue-6.6/drm-amd-pm-restore-config-space-after-reset.patch new file mode 100644 index 00000000000..982c8f8981f --- /dev/null +++ b/queue-6.6/drm-amd-pm-restore-config-space-after-reset.patch @@ -0,0 +1,73 @@ +From ae5a488257aac48f1767dd433f86e86923538b55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 13:11:14 +0530 +Subject: drm/amd/pm: Restore config space after reset + +From: Lijo Lazar + +[ Upstream commit 30d1cda8ce31ab49051ff7159280c542a738b23d ] + +During mode-2 reset, pci config space registers are affected at device +side. However, certain platforms have switches which assign virtual BAR +addresses and returns the same even after device is reset. This +affects pci_restore_state() as it doesn't issue another config write, if +the value read is same as the saved value. + +Add a workaround to write saved config space values from driver side. +Presently, these switches are in platforms with SMU v13.0.6 SOCs, hence +restrict the workaround only to those. + +Signed-off-by: Lijo Lazar +Reviewed-by: Asad Kamal +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 25 +++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +index 6a28f8d5bff7d..be4b7b64f8785 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +@@ -2039,6 +2039,17 @@ static ssize_t smu_v13_0_6_get_gpu_metrics(struct smu_context *smu, void **table + return sizeof(struct gpu_metrics_v1_3); + } + ++static void smu_v13_0_6_restore_pci_config(struct smu_context *smu) ++{ ++ struct amdgpu_device *adev = smu->adev; ++ int i; ++ ++ for (i = 0; i < 16; i++) ++ pci_write_config_dword(adev->pdev, i * 4, ++ adev->pdev->saved_config_space[i]); ++ pci_restore_msi_state(adev->pdev); ++} ++ + static int smu_v13_0_6_mode2_reset(struct smu_context *smu) + { + int ret = 0, index; +@@ -2060,6 +2071,20 @@ static int smu_v13_0_6_mode2_reset(struct smu_context *smu) + /* Restore the config space saved during init */ + amdgpu_device_load_pci_state(adev->pdev); + ++ /* Certain platforms have switches which assign virtual BAR values to ++ * devices. OS uses the virtual BAR values and device behind the switch ++ * is assgined another BAR value. When device's config space registers ++ * are queried, switch returns the virtual BAR values. When mode-2 reset ++ * is performed, switch is unaware of it, and will continue to return ++ * the same virtual values to the OS.This affects ++ * pci_restore_config_space() API as it doesn't write the value saved if ++ * the current value read from config space is the same as what is ++ * saved. As a workaround, make sure the config space is restored ++ * always. ++ */ ++ if (!(adev->flags & AMD_IS_APU)) ++ smu_v13_0_6_restore_pci_config(smu); ++ + dev_dbg(smu->adev->dev, "wait for reset ack\n"); + do { + ret = smu_cmn_wait_for_response(smu); +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-fix-the-ring-buffer-size-for-queue-vm-flu.patch b/queue-6.6/drm-amdgpu-fix-the-ring-buffer-size-for-queue-vm-flu.patch new file mode 100644 index 00000000000..d1453735d50 --- /dev/null +++ b/queue-6.6/drm-amdgpu-fix-the-ring-buffer-size-for-queue-vm-flu.patch @@ -0,0 +1,94 @@ +From 275641d511e36d767dce672e6fb7937de8000c6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 15:33:34 +0800 +Subject: drm/amdgpu: Fix the ring buffer size for queue VM flush +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Prike Liang + +[ Upstream commit fe93b0927bc58cb1d64230f45744e527d9d8482c ] + +Here are the corrections needed for the queue ring buffer size +calculation for the following cases: +- Remove the KIQ VM flush ring usage. +- Add the invalidate TLBs packet for gfx10 and gfx11 queue. +- There's no VM flush and PFP sync, so remove the gfx9 real + ring and compute ring buffer usage. + +Signed-off-by: Prike Liang +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 +-- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 3 +-- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 -- + 3 files changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 495eb4cad0e1a..3560a3f2c848e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -9157,7 +9157,7 @@ static const struct amdgpu_ring_funcs gfx_v10_0_ring_funcs_gfx = { + 7 + /* PIPELINE_SYNC */ + SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 + + SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 + +- 2 + /* VM_FLUSH */ ++ 4 + /* VM_FLUSH */ + 8 + /* FENCE for VM_FLUSH */ + 20 + /* GDS switch */ + 4 + /* double SWITCH_BUFFER, +@@ -9248,7 +9248,6 @@ static const struct amdgpu_ring_funcs gfx_v10_0_ring_funcs_kiq = { + 7 + /* gfx_v10_0_ring_emit_pipeline_sync */ + SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 + + SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 + +- 2 + /* gfx_v10_0_ring_emit_vm_flush */ + 8 + 8 + 8, /* gfx_v10_0_ring_emit_fence_kiq x3 for user fence, vm fence */ + .emit_ib_size = 7, /* gfx_v10_0_ring_emit_ib_compute */ + .emit_ib = gfx_v10_0_ring_emit_ib_compute, +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index c9058d58c95a7..daab4c7a073ac 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -6102,7 +6102,7 @@ static const struct amdgpu_ring_funcs gfx_v11_0_ring_funcs_gfx = { + 7 + /* PIPELINE_SYNC */ + SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 + + SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 + +- 2 + /* VM_FLUSH */ ++ 4 + /* VM_FLUSH */ + 8 + /* FENCE for VM_FLUSH */ + 20 + /* GDS switch */ + 5 + /* COND_EXEC */ +@@ -6187,7 +6187,6 @@ static const struct amdgpu_ring_funcs gfx_v11_0_ring_funcs_kiq = { + 7 + /* gfx_v11_0_ring_emit_pipeline_sync */ + SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 + + SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 + +- 2 + /* gfx_v11_0_ring_emit_vm_flush */ + 8 + 8 + 8, /* gfx_v11_0_ring_emit_fence_kiq x3 for user fence, vm fence */ + .emit_ib_size = 7, /* gfx_v11_0_ring_emit_ib_compute */ + .emit_ib = gfx_v11_0_ring_emit_ib_compute, +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index d7d15b618c374..8168836a08d2e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -6988,7 +6988,6 @@ static const struct amdgpu_ring_funcs gfx_v9_0_ring_funcs_compute = { + 7 + /* gfx_v9_0_ring_emit_pipeline_sync */ + SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 + + SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 + +- 2 + /* gfx_v9_0_ring_emit_vm_flush */ + 8 + 8 + 8 + /* gfx_v9_0_ring_emit_fence x3 for user fence, vm fence */ + 7 + /* gfx_v9_0_emit_mem_sync */ + 5 + /* gfx_v9_0_emit_wave_limit for updating mmSPI_WCL_PIPE_PERCENT_GFX register */ +@@ -7026,7 +7025,6 @@ static const struct amdgpu_ring_funcs gfx_v9_0_ring_funcs_kiq = { + 7 + /* gfx_v9_0_ring_emit_pipeline_sync */ + SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 + + SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 + +- 2 + /* gfx_v9_0_ring_emit_vm_flush */ + 8 + 8 + 8, /* gfx_v9_0_ring_emit_fence_kiq x3 for user fence, vm fence */ + .emit_ib_size = 7, /* gfx_v9_0_ring_emit_ib_compute */ + .emit_fence = gfx_v9_0_ring_emit_fence_kiq, +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-fix-vram-memory-accounting.patch b/queue-6.6/drm-amdgpu-fix-vram-memory-accounting.patch new file mode 100644 index 00000000000..ee13eab67ec --- /dev/null +++ b/queue-6.6/drm-amdgpu-fix-vram-memory-accounting.patch @@ -0,0 +1,37 @@ +From cbcd1d72cde1e939cc8dd7d7a31056b49333b4a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 14:40:37 -0400 +Subject: drm/amdgpu: Fix VRAM memory accounting + +From: Mukul Joshi + +[ Upstream commit f06446ef23216090d1ee8ede1a7d7ae430c22dcc ] + +Subtract the VRAM pinned memory when checking for available memory +in amdgpu_amdkfd_reserve_mem_limit function since that memory is not +available for use. + +Signed-off-by: Mukul Joshi +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index 15c5a2533ba60..704567885c7a4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -213,7 +213,7 @@ int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev, + (kfd_mem_limit.ttm_mem_used + ttm_mem_needed > + kfd_mem_limit.max_ttm_mem_limit) || + (adev && xcp_id >= 0 && adev->kfd.vram_used[xcp_id] + vram_needed > +- vram_size - reserved_for_pt)) { ++ vram_size - reserved_for_pt - atomic64_read(&adev->vram_pin_size))) { + ret = -ENOMEM; + goto release; + } +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-mes-fix-use-after-free-issue.patch b/queue-6.6/drm-amdgpu-mes-fix-use-after-free-issue.patch new file mode 100644 index 00000000000..3849cb787fa --- /dev/null +++ b/queue-6.6/drm-amdgpu-mes-fix-use-after-free-issue.patch @@ -0,0 +1,41 @@ +From ea019815f3ca1ea576bbb0d0a70e0e4e0b0390f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 16:22:54 +0800 +Subject: drm/amdgpu/mes: fix use-after-free issue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jack Xiao + +[ Upstream commit 948255282074d9367e01908b3f5dcf8c10fc9c3d ] + +Delete fence fallback timer to fix the ramdom +use-after-free issue. + +v2: move to amdgpu_mes.c + +Signed-off-by: Jack Xiao +Acked-by: Lijo Lazar +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c +index 15c67fa404ff9..c5c55e132af21 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c +@@ -1098,6 +1098,7 @@ void amdgpu_mes_remove_ring(struct amdgpu_device *adev, + return; + + amdgpu_mes_remove_hw_queue(adev, ring->hw_queue_id); ++ del_timer_sync(&ring->fence_drv.fallback_timer); + amdgpu_ring_fini(ring); + kfree(ring); + } +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-update-bo-eviction-priorities.patch b/queue-6.6/drm-amdgpu-update-bo-eviction-priorities.patch new file mode 100644 index 00000000000..cd08c1426e3 --- /dev/null +++ b/queue-6.6/drm-amdgpu-update-bo-eviction-priorities.patch @@ -0,0 +1,44 @@ +From 49858c12c939eecf8f53e49a5de2b1f5a222230e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 13:56:42 -0400 +Subject: drm/amdgpu: Update BO eviction priorities +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Kuehling + +[ Upstream commit b0b13d532105e0e682d95214933bb8483a063184 ] + +Make SVM BOs more likely to get evicted than other BOs. These BOs +opportunistically use available VRAM, but can fall back relatively +seamlessly to system memory. It also avoids SVM migrations evicting +other, more important BOs as they will evict other SVM allocations +first. + +Signed-off-by: Felix Kuehling +Acked-by: Mukul Joshi +Tested-by: Mukul Joshi +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index a348d320575e0..4e9ae52ef9fdb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -613,6 +613,8 @@ int amdgpu_bo_create(struct amdgpu_device *adev, + else + amdgpu_bo_placement_from_domain(bo, bp->domain); + if (bp->type == ttm_bo_type_kernel) ++ bo->tbo.priority = 2; ++ else if (!(bp->flags & AMDGPU_GEM_CREATE_DISCARDABLE)) + bo->tbo.priority = 1; + + if (!bp->destroy) +-- +2.43.0 + diff --git a/queue-6.6/drm-amdkfd-add-vram-accounting-for-svm-migration.patch b/queue-6.6/drm-amdkfd-add-vram-accounting-for-svm-migration.patch new file mode 100644 index 00000000000..b4c6b58eb14 --- /dev/null +++ b/queue-6.6/drm-amdkfd-add-vram-accounting-for-svm-migration.patch @@ -0,0 +1,76 @@ +From 454cc73aaaa6a160dd2fe3cf4323ba1126ab27d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 15:13:58 -0400 +Subject: drm/amdkfd: Add VRAM accounting for SVM migration + +From: Mukul Joshi + +[ Upstream commit 1e214f7faaf5d842754cd5cfcd76308bfedab3b5 ] + +Do VRAM accounting when doing migrations to vram to make sure +there is enough available VRAM and migrating to VRAM doesn't evict +other possible non-unified memory BOs. If migrating to VRAM fails, +driver can fall back to using system memory seamlessly. + +Signed-off-by: Mukul Joshi +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 16 +++++++++++++++- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- + 2 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index 659313648b200..3263b5fa182d2 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -516,10 +516,19 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + start = prange->start << PAGE_SHIFT; + end = (prange->last + 1) << PAGE_SHIFT; + ++ r = amdgpu_amdkfd_reserve_mem_limit(node->adev, ++ prange->npages * PAGE_SIZE, ++ KFD_IOC_ALLOC_MEM_FLAGS_VRAM, ++ node->xcp ? node->xcp->id : 0); ++ if (r) { ++ dev_dbg(node->adev->dev, "failed to reserve VRAM, r: %ld\n", r); ++ return -ENOSPC; ++ } ++ + r = svm_range_vram_node_new(node, prange, true); + if (r) { + dev_dbg(node->adev->dev, "fail %ld to alloc vram\n", r); +- return r; ++ goto out; + } + ttm_res_offset = prange->offset << PAGE_SHIFT; + +@@ -549,6 +558,11 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + svm_range_vram_node_free(prange); + } + ++out: ++ amdgpu_amdkfd_unreserve_mem_limit(node->adev, ++ prange->npages * PAGE_SIZE, ++ KFD_IOC_ALLOC_MEM_FLAGS_VRAM, ++ node->xcp ? node->xcp->id : 0); + return r < 0 ? r : 0; + } + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 87e9ca65e58e0..ce76d45549984 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -3416,7 +3416,7 @@ svm_range_trigger_migration(struct mm_struct *mm, struct svm_range *prange, + r = svm_migrate_to_vram(prange, best_loc, mm, KFD_MIGRATE_TRIGGER_PREFETCH); + *migrated = !r; + +- return r; ++ return 0; + } + + int svm_range_schedule_evict_svm_bo(struct amdgpu_amdkfd_fence *fence) +-- +2.43.0 + diff --git a/queue-6.6/drm-amdkfd-flush-the-process-wq-before-creating-a-kf.patch b/queue-6.6/drm-amdkfd-flush-the-process-wq-before-creating-a-kf.patch new file mode 100644 index 00000000000..03a811a82d6 --- /dev/null +++ b/queue-6.6/drm-amdkfd-flush-the-process-wq-before-creating-a-kf.patch @@ -0,0 +1,61 @@ +From 43c710c045e58c7672035140123c1fb72e2bcf43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 14:14:13 +0100 +Subject: drm/amdkfd: Flush the process wq before creating a kfd_process + +From: Lancelot SIX + +[ Upstream commit f5b9053398e70a0c10aa9cb4dd5910ab6bc457c5 ] + +There is a race condition when re-creating a kfd_process for a process. +This has been observed when a process under the debugger executes +exec(3). In this scenario: +- The process executes exec. + - This will eventually release the process's mm, which will cause the + kfd_process object associated with the process to be freed + (kfd_process_free_notifier decrements the reference count to the + kfd_process to 0). This causes kfd_process_ref_release to enqueue + kfd_process_wq_release to the kfd_process_wq. +- The debugger receives the PTRACE_EVENT_EXEC notification, and tries to + re-enable AMDGPU traps (KFD_IOC_DBG_TRAP_ENABLE). + - When handling this request, KFD tries to re-create a kfd_process. + This eventually calls kfd_create_process and kobject_init_and_add. + +At this point the call to kobject_init_and_add can fail because the +old kfd_process.kobj has not been freed yet by kfd_process_wq_release. + +This patch proposes to avoid this race by making sure to drain +kfd_process_wq before creating a new kfd_process object. This way, we +know that any cleanup task is done executing when we reach +kobject_init_and_add. + +Signed-off-by: Lancelot SIX +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index 7a1a574106fac..d98e45aec76b4 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -828,6 +828,14 @@ struct kfd_process *kfd_create_process(struct task_struct *thread) + if (process) { + pr_debug("Process already found\n"); + } else { ++ /* If the process just called exec(3), it is possible that the ++ * cleanup of the kfd_process (following the release of the mm ++ * of the old process image) is still in the cleanup work queue. ++ * Make sure to drain any job before trying to recreate any ++ * resource for this process. ++ */ ++ flush_workqueue(kfd_process_wq); ++ + process = create_process(thread); + if (IS_ERR(process)) + goto out; +-- +2.43.0 + diff --git a/queue-6.6/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch b/queue-6.6/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch new file mode 100644 index 00000000000..cb266e081af --- /dev/null +++ b/queue-6.6/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch @@ -0,0 +1,42 @@ +From 24e9ab2606f8fd2a936e827856743450561f6c72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Apr 2024 14:30:53 +0800 +Subject: drm/arm/malidp: fix a possible null pointer dereference + +From: Huai-Yuan Liu + +[ Upstream commit a1f95aede6285dba6dd036d907196f35ae3a11ea ] + +In malidp_mw_connector_reset, new memory is allocated with kzalloc, but +no check is performed. In order to prevent null pointer dereferencing, +ensure that mw_state is checked before calling +__drm_atomic_helper_connector_reset. + +Fixes: 8cbc5caf36ef ("drm: mali-dp: Add writeback connector") +Signed-off-by: Huai-Yuan Liu +Signed-off-by: Liviu Dudau +Link: https://patchwork.freedesktop.org/patch/msgid/20240407063053.5481-1-qq810974084@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/arm/malidp_mw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/arm/malidp_mw.c b/drivers/gpu/drm/arm/malidp_mw.c +index 626709bec6f5f..2577f0cef8fcd 100644 +--- a/drivers/gpu/drm/arm/malidp_mw.c ++++ b/drivers/gpu/drm/arm/malidp_mw.c +@@ -72,7 +72,10 @@ static void malidp_mw_connector_reset(struct drm_connector *connector) + __drm_atomic_helper_connector_destroy_state(connector->state); + + kfree(connector->state); +- __drm_atomic_helper_connector_reset(connector, &mw_state->base); ++ connector->state = NULL; ++ ++ if (mw_state) ++ __drm_atomic_helper_connector_reset(connector, &mw_state->base); + } + + static enum drm_connector_status +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-anx7625-don-t-log-an-error-when-dsi-host-.patch b/queue-6.6/drm-bridge-anx7625-don-t-log-an-error-when-dsi-host-.patch new file mode 100644 index 00000000000..3424c11ec74 --- /dev/null +++ b/queue-6.6/drm-bridge-anx7625-don-t-log-an-error-when-dsi-host-.patch @@ -0,0 +1,49 @@ +From 3f5e80006ab6d099e94e52214c1b5fd0454b8925 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:29 -0400 +Subject: drm/bridge: anx7625: Don't log an error when DSI host can't be found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit ef4a9204d594fe959cdbc7418273caf4001535c8 ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: 269332997a16 ("drm/bridge: anx7625: Return -EPROBE_DEFER if the dsi host was not found") +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Neil Armstrong +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-1-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 29d91493b101a..4ee5614a26236 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2076,10 +2076,8 @@ static int anx7625_setup_dsi_device(struct anx7625_data *ctx) + }; + + host = of_find_mipi_dsi_host_by_node(ctx->pdata.mipi_host_node); +- if (!host) { +- DRM_DEV_ERROR(dev, "fail to find dsi host.\n"); +- return -EPROBE_DEFER; +- } ++ if (!host) ++ return dev_err_probe(dev, -EPROBE_DEFER, "fail to find dsi host.\n"); + + dsi = devm_mipi_dsi_device_register_full(dev, host, &info); + if (IS_ERR(dsi)) { +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-anx7625-update-audio-status-while-detecti.patch b/queue-6.6/drm-bridge-anx7625-update-audio-status-while-detecti.patch new file mode 100644 index 00000000000..fab0e16e200 --- /dev/null +++ b/queue-6.6/drm-bridge-anx7625-update-audio-status-while-detecti.patch @@ -0,0 +1,54 @@ +From 099046317101b7414459cb2588ff173f51d390c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 07:21:35 +0000 +Subject: drm/bridge: anx7625: Update audio status while detecting + +From: Hsin-Te Yuan + +[ Upstream commit a665b4e60369867cddf50f37f16169a3e2f434ad ] + +Previously, the audio status was not updated during detection, leading +to a persistent audio despite hot plugging events. To resolve this +issue, update the audio status during detection. + +Fixes: 566fef1226c1 ("drm/bridge: anx7625: add HDMI audio function") +Signed-off-by: Hsin-Te Yuan +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240416-anx7625-v3-1-f916ae31bdd7@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 4ee5614a26236..c1191ef5e8e67 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2479,15 +2479,22 @@ static void anx7625_bridge_atomic_disable(struct drm_bridge *bridge, + mutex_unlock(&ctx->aux_lock); + } + ++static void ++anx7625_audio_update_connector_status(struct anx7625_data *ctx, ++ enum drm_connector_status status); ++ + static enum drm_connector_status + anx7625_bridge_detect(struct drm_bridge *bridge) + { + struct anx7625_data *ctx = bridge_to_anx7625(bridge); + struct device *dev = ctx->dev; ++ enum drm_connector_status status; + + DRM_DEV_DEBUG_DRIVER(dev, "drm bridge detect\n"); + +- return anx7625_sink_detect(ctx); ++ status = anx7625_sink_detect(ctx); ++ anx7625_audio_update_connector_status(ctx, status); ++ return status; + } + + static struct edid *anx7625_bridge_get_edid(struct drm_bridge *bridge, +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-cdns-mhdp8546-fix-possible-null-pointer-d.patch b/queue-6.6/drm-bridge-cdns-mhdp8546-fix-possible-null-pointer-d.patch new file mode 100644 index 00000000000..685196dc5ac --- /dev/null +++ b/queue-6.6/drm-bridge-cdns-mhdp8546-fix-possible-null-pointer-d.patch @@ -0,0 +1,43 @@ +From 75d3dcf7b1335bb0d2a3f9a6fecf34c3604678fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 15:58:10 +0300 +Subject: drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference + +From: Aleksandr Mishin + +[ Upstream commit 935a92a1c400285545198ca2800a4c6c519c650a ] + +In cdns_mhdp_atomic_enable(), the return value of drm_mode_duplicate() is +assigned to mhdp_state->current_mode, and there is a dereference of it in +drm_mode_set_name(), which will lead to a NULL pointer dereference on +failure of drm_mode_duplicate(). + +Fix this bug add a check of mhdp_state->current_mode. + +Fixes: fb43aa0acdfd ("drm: bridge: Add support for Cadence MHDP8546 DPI/DP bridge") +Signed-off-by: Aleksandr Mishin +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240408125810.21899-1-amishin@t-argos.ru +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +index 6af565ac307ae..858f5b6508491 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +@@ -2057,6 +2057,9 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, + mhdp_state = to_cdns_mhdp_bridge_state(new_state); + + mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); ++ if (!mhdp_state->current_mode) ++ return; ++ + drm_mode_set_name(mhdp_state->current_mode); + + dev_dbg(mhdp->dev, "%s: Enabling mode %s\n", __func__, mode->name); +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-dpc3433-don-t-log-an-error-when-dsi-host-.patch b/queue-6.6/drm-bridge-dpc3433-don-t-log-an-error-when-dsi-host-.patch new file mode 100644 index 00000000000..1eaafd332c0 --- /dev/null +++ b/queue-6.6/drm-bridge-dpc3433-don-t-log-an-error-when-dsi-host-.patch @@ -0,0 +1,80 @@ +From 13dbff9f1de81f21fee142645689c81216de85c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:35 -0400 +Subject: drm/bridge: dpc3433: Don't log an error when DSI host can't be found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 24f4f575214de776539d346b99b8717bffa8ebba ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Also move the "failed to attach" error message so that it's only printed +when the devm_mipi_dsi_attach() call fails. + +Fixes: 6352cd451ddb ("drm: bridge: Add TI DLPC3433 DSI to DMD bridge") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-7-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-dlpc3433.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ti-dlpc3433.c b/drivers/gpu/drm/bridge/ti-dlpc3433.c +index b65632ec7e7da..3f933ba294682 100644 +--- a/drivers/gpu/drm/bridge/ti-dlpc3433.c ++++ b/drivers/gpu/drm/bridge/ti-dlpc3433.c +@@ -319,12 +319,11 @@ static int dlpc_host_attach(struct dlpc *dlpc) + .channel = 0, + .node = NULL, + }; ++ int ret; + + host = of_find_mipi_dsi_host_by_node(dlpc->host_node); +- if (!host) { +- DRM_DEV_ERROR(dev, "failed to find dsi host\n"); +- return -EPROBE_DEFER; +- } ++ if (!host) ++ return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n"); + + dlpc->dsi = mipi_dsi_device_register_full(host, &info); + if (IS_ERR(dlpc->dsi)) { +@@ -336,7 +335,11 @@ static int dlpc_host_attach(struct dlpc *dlpc) + dlpc->dsi->format = MIPI_DSI_FMT_RGB565; + dlpc->dsi->lanes = dlpc->dsi_lanes; + +- return devm_mipi_dsi_attach(dev, dlpc->dsi); ++ ret = devm_mipi_dsi_attach(dev, dlpc->dsi); ++ if (ret) ++ DRM_DEV_ERROR(dev, "failed to attach dsi host\n"); ++ ++ return ret; + } + + static int dlpc3433_probe(struct i2c_client *client) +@@ -367,10 +370,8 @@ static int dlpc3433_probe(struct i2c_client *client) + drm_bridge_add(&dlpc->bridge); + + ret = dlpc_host_attach(dlpc); +- if (ret) { +- DRM_DEV_ERROR(dev, "failed to attach dsi host\n"); ++ if (ret) + goto err_remove_bridge; +- } + + return 0; + +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-fix-improper-bridge-init-order-with-pre_e.patch b/queue-6.6/drm-bridge-fix-improper-bridge-init-order-with-pre_e.patch new file mode 100644 index 00000000000..3d6e62a0c95 --- /dev/null +++ b/queue-6.6/drm-bridge-fix-improper-bridge-init-order-with-pre_e.patch @@ -0,0 +1,154 @@ +From 610f108bb4f6b904a615cb15c5c2c68e9f5f8ad4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 22:37:51 +0530 +Subject: drm/bridge: Fix improper bridge init order with pre_enable_prev_first + +From: Jagan Teki + +[ Upstream commit e18aeeda0b6905c333df5a0566b99f5c84426098 ] + +For a given bridge pipeline if any bridge sets pre_enable_prev_first +flag then the pre_enable for the previous bridge will be called before +pre_enable of this bridge and opposite is done for post_disable. + +These are the potential bridge flags to alter bridge init order in order +to satisfy the MIPI DSI host and downstream panel or bridge to function. +However the existing pre_enable_prev_first logic with associated bridge +ordering has broken for both pre_enable and post_disable calls. + +[pre_enable] + +The altered bridge ordering has failed if two consecutive bridges on a +given pipeline enables the pre_enable_prev_first flag. + +Example: +- Panel +- Bridge 1 +- Bridge 2 pre_enable_prev_first +- Bridge 3 +- Bridge 4 pre_enable_prev_first +- Bridge 5 pre_enable_prev_first +- Bridge 6 +- Encoder + +In this example, Bridge 4 and Bridge 5 have pre_enable_prev_first. + +The logic looks for a bridge which enabled pre_enable_prev_first flag +on each iteration and assigned the previou bridge to limit pointer +if the bridge doesn't enable pre_enable_prev_first flags. + +If control found Bridge 2 is pre_enable_prev_first then the iteration +looks for Bridge 3 and found it is not pre_enable_prev_first and assigns +it's previous Bridge 4 to limit pointer and calls pre_enable of Bridge 3 +and Bridge 2 and assign iter pointer with limit which is Bridge 4. + +Here is the actual problem, for the next iteration control look for +Bridge 5 instead of Bridge 4 has iter pointer in previous iteration +moved to Bridge 4 so this iteration skips the Bridge 4. The iteration +found Bridge 6 doesn't pre_enable_prev_first flags so the limit assigned +to Encoder. From next iteration Encoder skips as it is the last bridge +for reverse order pipeline. + +So, the resulting pre_enable bridge order would be, +- Panel, Bridge 1, Bridge 3, Bridge 2, Bridge 6, Bridge 5. + +This patch fixes this by assigning limit to next pointer instead of +previous bridge since the iteration always looks for bridge that does +NOT request prev so assigning next makes sure the last bridge on a +given iteration what exactly the limit bridge is. + +So, the resulting pre_enable bridge order with fix would be, +- Panel, Bridge 1, Bridge 3, Bridge 2, Bridge 6, Bridge 5, Bridge 4, + Encoder. + +[post_disable] + +The altered bridge ordering has failed if two consecutive bridges on a +given pipeline enables the pre_enable_prev_first flag. + +Example: +- Panel +- Bridge 1 +- Bridge 2 pre_enable_prev_first +- Bridge 3 +- Bridge 4 pre_enable_prev_first +- Bridge 5 pre_enable_prev_first +- Bridge 6 +- Encoder + +In this example Bridge 5 and Bridge 4 have pre_enable_prev_first. + +The logic looks for a bridge which enabled pre_enable_prev_first flags +on each iteration and assigned the previou bridge to next and next to +limit pointer if the bridge does enable pre_enable_prev_first flag. + +If control starts from Bridge 6 then it found next Bridge 5 is +pre_enable_prev_first and immediately the next assigned to previous +Bridge 6 and limit assignments to next Bridge 6 and call post_enable +of Bridge 6 even though the next consecutive Bridge 5 is enabled with +pre_enable_prev_first. This clearly misses the logic to find the state +of next conducive bridge as everytime the next and limit assigns +previous bridge if given bridge enabled pre_enable_prev_first. + +So, the resulting post_disable bridge order would be, +- Encoder, Bridge 6, Bridge 5, Bridge 4, Bridge 3, Bridge 2, Bridge 1, + Panel. + +This patch fixes this by assigning next with previou bridge only if the +bridge doesn't enable pre_enable_prev_first flag and the next further +assign it to limit. This way we can find the bridge that NOT requested +prev to disable last. + +So, the resulting pre_enable bridge order with fix would be, +- Encoder, Bridge 4, Bridge 5, Bridge 6, Bridge 2, Bridge 3, Bridge 1, + Panel. + +Validated the bridge init ordering by incorporating dummy bridges in +the sun6i-mipi-dsi pipeline + +Fixes: 4fb912e5e190 ("drm/bridge: Introduce pre_enable_prev_first to alter bridge init order") +Signed-off-by: Jagan Teki +Tested-by: Michael Trimarchi +Reviewed-by: Dave Stevenson +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230328170752.1102347-1-jagan@amarulasolutions.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_bridge.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c +index 67354afbd7168..62d8a291c49c7 100644 +--- a/drivers/gpu/drm/drm_bridge.c ++++ b/drivers/gpu/drm/drm_bridge.c +@@ -687,11 +687,17 @@ void drm_atomic_bridge_chain_post_disable(struct drm_bridge *bridge, + */ + list_for_each_entry_from(next, &encoder->bridge_chain, + chain_node) { +- if (next->pre_enable_prev_first) { ++ if (!next->pre_enable_prev_first) { + next = list_prev_entry(next, chain_node); + limit = next; + break; + } ++ ++ if (list_is_last(&next->chain_node, ++ &encoder->bridge_chain)) { ++ limit = next; ++ break; ++ } + } + + /* Call these bridges in reverse order */ +@@ -774,7 +780,7 @@ void drm_atomic_bridge_chain_pre_enable(struct drm_bridge *bridge, + /* Found first bridge that does NOT + * request prev to be enabled first + */ +- limit = list_prev_entry(next, chain_node); ++ limit = next; + break; + } + } +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-icn6211-don-t-log-an-error-when-dsi-host-.patch b/queue-6.6/drm-bridge-icn6211-don-t-log-an-error-when-dsi-host-.patch new file mode 100644 index 00000000000..f19b2fab927 --- /dev/null +++ b/queue-6.6/drm-bridge-icn6211-don-t-log-an-error-when-dsi-host-.patch @@ -0,0 +1,49 @@ +From 81588cdab5087a54262ee20955ecf49852db8edb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:30 -0400 +Subject: drm/bridge: icn6211: Don't log an error when DSI host can't be found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 275fafe58faa7fdb10fa245412696ecef676aac5 ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: 8dde6f7452a1 ("drm: bridge: icn6211: Add I2C configuration support") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-2-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/chipone-icn6211.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/chipone-icn6211.c b/drivers/gpu/drm/bridge/chipone-icn6211.c +index d205e755e524a..5e295f86f2a73 100644 +--- a/drivers/gpu/drm/bridge/chipone-icn6211.c ++++ b/drivers/gpu/drm/bridge/chipone-icn6211.c +@@ -563,10 +563,8 @@ static int chipone_dsi_host_attach(struct chipone *icn) + + host = of_find_mipi_dsi_host_by_node(host_node); + of_node_put(host_node); +- if (!host) { +- dev_err(dev, "failed to find dsi host\n"); +- return -EPROBE_DEFER; +- } ++ if (!host) ++ return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n"); + + dsi = mipi_dsi_device_register_full(host, &info); + if (IS_ERR(dsi)) { +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-lt8912b-don-t-log-an-error-when-dsi-host-.patch b/queue-6.6/drm-bridge-lt8912b-don-t-log-an-error-when-dsi-host-.patch new file mode 100644 index 00000000000..e475f011fa5 --- /dev/null +++ b/queue-6.6/drm-bridge-lt8912b-don-t-log-an-error-when-dsi-host-.patch @@ -0,0 +1,49 @@ +From 918263b65a1dace611149f633f9ccb82009bf1fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:31 -0400 +Subject: drm/bridge: lt8912b: Don't log an error when DSI host can't be found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit b3b4695ff47c4964d4ccb930890c9ffd8e455e20 ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-3-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt8912b.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c +index e5839c89a355a..0efcbc73f2a43 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c ++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c +@@ -483,10 +483,8 @@ static int lt8912_attach_dsi(struct lt8912 *lt) + }; + + host = of_find_mipi_dsi_host_by_node(lt->host_node); +- if (!host) { +- dev_err(dev, "failed to find dsi host\n"); +- return -EPROBE_DEFER; +- } ++ if (!host) ++ return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n"); + + dsi = devm_mipi_dsi_device_register_full(dev, host, &info); + if (IS_ERR(dsi)) { +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-lt9611-don-t-log-an-error-when-dsi-host-c.patch b/queue-6.6/drm-bridge-lt9611-don-t-log-an-error-when-dsi-host-c.patch new file mode 100644 index 00000000000..857e19b9b0a --- /dev/null +++ b/queue-6.6/drm-bridge-lt9611-don-t-log-an-error-when-dsi-host-c.patch @@ -0,0 +1,50 @@ +From b0c1a8f2f3923e3f16822cfffa63f3255cd2f5e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:32 -0400 +Subject: drm/bridge: lt9611: Don't log an error when DSI host can't be found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit cd0a2c6a081ff67007323725b9ff07d9934b1ed8 ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-4-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 9663601ce0981..89bdd938757e1 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -760,10 +760,8 @@ static struct mipi_dsi_device *lt9611_attach_dsi(struct lt9611 *lt9611, + int ret; + + host = of_find_mipi_dsi_host_by_node(dsi_node); +- if (!host) { +- dev_err(lt9611->dev, "failed to find dsi host\n"); +- return ERR_PTR(-EPROBE_DEFER); +- } ++ if (!host) ++ return ERR_PTR(dev_err_probe(lt9611->dev, -EPROBE_DEFER, "failed to find dsi host\n")); + + dsi = devm_mipi_dsi_device_register_full(dev, host, &info); + if (IS_ERR(dsi)) { +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-lt9611uxc-don-t-log-an-error-when-dsi-hos.patch b/queue-6.6/drm-bridge-lt9611uxc-don-t-log-an-error-when-dsi-hos.patch new file mode 100644 index 00000000000..4bebe55a22f --- /dev/null +++ b/queue-6.6/drm-bridge-lt9611uxc-don-t-log-an-error-when-dsi-hos.patch @@ -0,0 +1,51 @@ +From 630ce5528425493fa1a5b40ff63169d3c5267a68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:33 -0400 +Subject: drm/bridge: lt9611uxc: Don't log an error when DSI host can't be + found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 6d9e877cde7e9b516a9a99751b8222c87557436d ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: 0cbbd5b1a012 ("drm: bridge: add support for lontium LT9611UXC bridge") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-5-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9611uxc.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611uxc.c b/drivers/gpu/drm/bridge/lontium-lt9611uxc.c +index 6f33bb0dd32aa..c41ffd0bc0494 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611uxc.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611uxc.c +@@ -265,10 +265,8 @@ static struct mipi_dsi_device *lt9611uxc_attach_dsi(struct lt9611uxc *lt9611uxc, + int ret; + + host = of_find_mipi_dsi_host_by_node(dsi_node); +- if (!host) { +- dev_err(dev, "failed to find dsi host\n"); +- return ERR_PTR(-EPROBE_DEFER); +- } ++ if (!host) ++ return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n")); + + dsi = devm_mipi_dsi_device_register_full(dev, host, &info); + if (IS_ERR(dsi)) { +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-tc358775-don-t-log-an-error-when-dsi-host.patch b/queue-6.6/drm-bridge-tc358775-don-t-log-an-error-when-dsi-host.patch new file mode 100644 index 00000000000..bda2bb1b34b --- /dev/null +++ b/queue-6.6/drm-bridge-tc358775-don-t-log-an-error-when-dsi-host.patch @@ -0,0 +1,49 @@ +From cd7a17ea0a138823298b88425eef54f6052d520f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:34 -0400 +Subject: drm/bridge: tc358775: Don't log an error when DSI host can't be found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 272377aa0e3dddeec3f568c8bb9d12c7a79d8ef5 ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: b26975593b17 ("display/drm/bridge: TC358775 DSI/LVDS driver") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-6-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358775.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358775.c b/drivers/gpu/drm/bridge/tc358775.c +index 90a89d70d8328..fea4f00a20f83 100644 +--- a/drivers/gpu/drm/bridge/tc358775.c ++++ b/drivers/gpu/drm/bridge/tc358775.c +@@ -610,10 +610,8 @@ static int tc_attach_host(struct tc_data *tc) + }; + + host = of_find_mipi_dsi_host_by_node(tc->host_node); +- if (!host) { +- dev_err(dev, "failed to find dsi host\n"); +- return -EPROBE_DEFER; +- } ++ if (!host) ++ return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n"); + + dsi = devm_mipi_dsi_device_register_full(dev, host, &info); + if (IS_ERR(dsi)) { +-- +2.43.0 + diff --git a/queue-6.6/drm-ci-add-subset-1-gfx-to-lava_tags-and-adjust-shar.patch b/queue-6.6/drm-ci-add-subset-1-gfx-to-lava_tags-and-adjust-shar.patch new file mode 100644 index 00000000000..cdacba5f5a6 --- /dev/null +++ b/queue-6.6/drm-ci-add-subset-1-gfx-to-lava_tags-and-adjust-shar.patch @@ -0,0 +1,170 @@ +From f9607fae81d7ee3a2d7ebbd3f11cac31190fdb9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 21:45:21 -0300 +Subject: drm/ci: add subset-1-gfx to LAVA_TAGS and adjust shards + +From: Helen Koike + +[ Upstream commit 68a3f17732d1d72be958576b6ce0e6c29686a40b ] + +The Collabora Lava farm added a tag called `subset-1-gfx` to half of +devices the graphics community use. + +Lets use this tag so we don't occupy all the resources. + +This is particular important because Mesa3D shares the resources with +DRM-CI and use them to do pre-merge tests, so it can block developers +from getting their patches merged. + +Signed-off-by: Helen Koike +Reviewed-by: David Heidelberg +Link: https://lore.kernel.org/r/20231024004525.169002-7-helen.koike@collabora.com +Signed-off-by: Maxime Ripard +Stable-dep-of: a2c71b711e7e ("drm/ci: update device type for volteer devices") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ci/gitlab-ci.yml | 2 +- + drivers/gpu/drm/ci/test.yml | 23 ++++++++++++++--------- + 2 files changed, 15 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/ci/gitlab-ci.yml b/drivers/gpu/drm/ci/gitlab-ci.yml +index 452b9c2532ae5..3694924367480 100644 +--- a/drivers/gpu/drm/ci/gitlab-ci.yml ++++ b/drivers/gpu/drm/ci/gitlab-ci.yml +@@ -26,7 +26,7 @@ variables: + JOB_ARTIFACTS_BASE: ${PIPELINE_ARTIFACTS_BASE}/${CI_JOB_ID} + # default kernel for rootfs before injecting the current kernel tree + KERNEL_IMAGE_BASE: https://${S3_HOST}/mesa-lava/gfx-ci/linux/v6.4.12-for-mesa-ci-f6b4ad45f48d +- ++ LAVA_TAGS: subset-1-gfx + LAVA_JOB_PRIORITY: 30 + + default: +diff --git a/drivers/gpu/drm/ci/test.yml b/drivers/gpu/drm/ci/test.yml +index e5b7d309ca186..7b5c5fe121d9d 100644 +--- a/drivers/gpu/drm/ci/test.yml ++++ b/drivers/gpu/drm/ci/test.yml +@@ -86,7 +86,7 @@ msm:sc7180: + extends: + - .lava-igt:arm64 + stage: msm +- parallel: 2 ++ parallel: 4 + variables: + DRIVER_NAME: msm + DEVICE_TYPE: sc7180-trogdor-lazor-limozeen +@@ -158,7 +158,7 @@ rockchip:rk3399: + extends: + - .lava-igt:arm64 + stage: rockchip +- parallel: 3 ++ parallel: 2 + variables: + DRIVER_NAME: rockchip + DEVICE_TYPE: rk3399-gru-kevin +@@ -181,7 +181,7 @@ rockchip:rk3399: + i915:apl: + extends: + - .i915 +- parallel: 12 ++ parallel: 3 + variables: + DEVICE_TYPE: asus-C523NA-A20057-coral + GPU_VERSION: apl +@@ -190,7 +190,7 @@ i915:apl: + i915:glk: + extends: + - .i915 +- parallel: 5 ++ parallel: 2 + variables: + DEVICE_TYPE: hp-x360-12b-ca0010nr-n4020-octopus + GPU_VERSION: glk +@@ -199,7 +199,7 @@ i915:glk: + i915:amly: + extends: + - .i915 +- parallel: 8 ++ parallel: 2 + variables: + DEVICE_TYPE: asus-C433TA-AJ0005-rammus + GPU_VERSION: amly +@@ -208,7 +208,7 @@ i915:amly: + i915:kbl: + extends: + - .i915 +- parallel: 5 ++ parallel: 3 + variables: + DEVICE_TYPE: hp-x360-14-G1-sona + GPU_VERSION: kbl +@@ -217,7 +217,7 @@ i915:kbl: + i915:whl: + extends: + - .i915 +- parallel: 8 ++ parallel: 2 + variables: + DEVICE_TYPE: dell-latitude-5400-8665U-sarien + GPU_VERSION: whl +@@ -226,7 +226,7 @@ i915:whl: + i915:cml: + extends: + - .i915 +- parallel: 6 ++ parallel: 2 + variables: + DEVICE_TYPE: asus-C436FA-Flip-hatch + GPU_VERSION: cml +@@ -235,7 +235,7 @@ i915:cml: + i915:tgl: + extends: + - .i915 +- parallel: 6 ++ parallel: 8 + variables: + DEVICE_TYPE: asus-cx9400-volteer + GPU_VERSION: tgl +@@ -254,6 +254,7 @@ i915:tgl: + amdgpu:stoney: + extends: + - .amdgpu ++ parallel: 2 + variables: + DEVICE_TYPE: hp-11A-G6-EE-grunt + GPU_VERSION: stoney +@@ -272,6 +273,7 @@ amdgpu:stoney: + mediatek:mt8173: + extends: + - .mediatek ++ parallel: 4 + variables: + DEVICE_TYPE: mt8173-elm-hana + GPU_VERSION: mt8173 +@@ -283,6 +285,7 @@ mediatek:mt8173: + mediatek:mt8183: + extends: + - .mediatek ++ parallel: 3 + variables: + DEVICE_TYPE: mt8183-kukui-jacuzzi-juniper-sku16 + GPU_VERSION: mt8183 +@@ -292,6 +295,7 @@ mediatek:mt8183: + .mediatek:mt8192: + extends: + - .mediatek ++ parallel: 3 + variables: + DEVICE_TYPE: mt8192-asurada-spherion-r0 + GPU_VERSION: mt8192 +@@ -310,6 +314,7 @@ mediatek:mt8183: + meson:g12b: + extends: + - .meson ++ parallel: 3 + variables: + DEVICE_TYPE: meson-g12b-a311d-khadas-vim3 + GPU_VERSION: g12b +-- +2.43.0 + diff --git a/queue-6.6/drm-ci-update-device-type-for-volteer-devices.patch b/queue-6.6/drm-ci-update-device-type-for-volteer-devices.patch new file mode 100644 index 00000000000..37a475098ad --- /dev/null +++ b/queue-6.6/drm-ci-update-device-type-for-volteer-devices.patch @@ -0,0 +1,52 @@ +From c3b8ca56a8ca84140db883d5b0fe5236ba9d56eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 07:48:41 +0530 +Subject: drm/ci: update device type for volteer devices + +From: Vignesh Raman + +[ Upstream commit a2c71b711e7efc6478976233768bdbc3386e6dce ] + +Volteer devices in the collabora lab are categorized under the +asus-cx9400-volteer device type. The majority of these units +has an Intel Core i5-1130G7 CPU, while some of them have a +Intel Core i7-1160G7 CPU instead. So due to this difference, +new device type template is added for the Intel Core i5-1130G7 +and i7-1160G7 variants of the Acer Chromebook Spin 514 (CP514-2H) +volteer Chromebooks. So update the same in drm-ci. + +https://gitlab.collabora.com/lava/lava/-/merge_requests/149 + +Fixes: 0119c894ab0d ("drm: Add initial ci/ subdirectory") +Reviewed-by: David Heidelberg +Signed-off-by: Vignesh Raman +Acked-by: Helen Koike +Signed-off-by: Helen Koike +Link: https://patchwork.freedesktop.org/patch/msgid/20240307021841.100561-1-vignesh.raman@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ci/test.yml | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/ci/test.yml b/drivers/gpu/drm/ci/test.yml +index 7b5c5fe121d9d..6f81dc10865b5 100644 +--- a/drivers/gpu/drm/ci/test.yml ++++ b/drivers/gpu/drm/ci/test.yml +@@ -235,11 +235,11 @@ i915:cml: + i915:tgl: + extends: + - .i915 +- parallel: 8 ++ parallel: 5 + variables: +- DEVICE_TYPE: asus-cx9400-volteer ++ DEVICE_TYPE: acer-cp514-2h-1130g7-volteer + GPU_VERSION: tgl +- RUNNER_TAG: mesa-ci-x86-64-lava-asus-cx9400-volteer ++ RUNNER_TAG: mesa-ci-x86-64-lava-acer-cp514-2h-1130g7-volteer + + .amdgpu: + extends: +-- +2.43.0 + diff --git a/queue-6.6/drm-ci-uprev-mesa-version-fix-container-build-crosvm.patch b/queue-6.6/drm-ci-uprev-mesa-version-fix-container-build-crosvm.patch new file mode 100644 index 00000000000..99fdbe56205 --- /dev/null +++ b/queue-6.6/drm-ci-uprev-mesa-version-fix-container-build-crosvm.patch @@ -0,0 +1,131 @@ +From 9a0de288da225d26ff6b271967bc96198785d720 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 21:45:16 -0300 +Subject: drm/ci: uprev mesa version: fix container build & crosvm + +From: Helen Koike + +[ Upstream commit 1887de00867d7a700babefc9647ccb9e0d11ee56 ] + +When building containers, some rust packages were installed without +locking the dependencies version, which got updated and started giving +errors like: + +error: failed to compile `bindgen-cli v0.62.0`, intermediate artifacts can be found at `/tmp/cargo-installkNKRwf` +Caused by: + package `rustix v0.38.13` cannot be built because it requires rustc 1.63 or newer, while the currently active rustc version is 1.60.0 + +A patch to Mesa was added fixing this error, so update it. + +Also, commit in linux kernel 6.6 rc3 broke booting in crosvm. +Mesa has upreved crosvm to fix this issue. + +Signed-off-by: Helen Koike +[crosvm mesa update] +Co-Developed-by: Vignesh Raman +Signed-off-by: Vignesh Raman +[v1 container build uprev] +Tested-by: Jessica Zhang +Acked-by: Jessica Zhang +Reviewed-by: David Heidelberg +Link: https://lore.kernel.org/r/20231024004525.169002-2-helen.koike@collabora.com +Signed-off-by: Maxime Ripard +Stable-dep-of: a2c71b711e7e ("drm/ci: update device type for volteer devices") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ci/build.yml | 1 + + drivers/gpu/drm/ci/gitlab-ci.yml | 20 +++++++++++++++++++- + drivers/gpu/drm/ci/image-tags.yml | 2 +- + drivers/gpu/drm/ci/lava-submit.sh | 2 +- + 4 files changed, 22 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/ci/build.yml b/drivers/gpu/drm/ci/build.yml +index e6503f1c5927b..17ab38304885c 100644 +--- a/drivers/gpu/drm/ci/build.yml ++++ b/drivers/gpu/drm/ci/build.yml +@@ -1,6 +1,7 @@ + .build: + extends: + - .build-rules ++ - .container+build-rules + stage: build + artifacts: + paths: +diff --git a/drivers/gpu/drm/ci/gitlab-ci.yml b/drivers/gpu/drm/ci/gitlab-ci.yml +index 2c4df53f5dfe3..452b9c2532ae5 100644 +--- a/drivers/gpu/drm/ci/gitlab-ci.yml ++++ b/drivers/gpu/drm/ci/gitlab-ci.yml +@@ -1,6 +1,6 @@ + variables: + DRM_CI_PROJECT_PATH: &drm-ci-project-path mesa/mesa +- DRM_CI_COMMIT_SHA: &drm-ci-commit-sha 0dc961645c4f0241f8512cb0ec3ad59635842072 ++ DRM_CI_COMMIT_SHA: &drm-ci-commit-sha edfbf74df1d4d6ce54ffe24566108be0e1a98c3d + + UPSTREAM_REPO: git://anongit.freedesktop.org/drm/drm + TARGET_BRANCH: drm-next +@@ -24,6 +24,8 @@ variables: + PIPELINE_ARTIFACTS_BASE: ${S3_HOST}/artifacts/${CI_PROJECT_PATH}/${CI_PIPELINE_ID} + # per-job artifact storage on MinIO + JOB_ARTIFACTS_BASE: ${PIPELINE_ARTIFACTS_BASE}/${CI_JOB_ID} ++ # default kernel for rootfs before injecting the current kernel tree ++ KERNEL_IMAGE_BASE: https://${S3_HOST}/mesa-lava/gfx-ci/linux/v6.4.12-for-mesa-ci-f6b4ad45f48d + + LAVA_JOB_PRIORITY: 30 + +@@ -86,6 +88,17 @@ include: + - '/.gitlab-ci/container/gitlab-ci.yml' + - '/.gitlab-ci/test/gitlab-ci.yml' + - '/.gitlab-ci/lava/lava-gitlab-ci.yml' ++ - '/src/microsoft/ci/gitlab-ci-inc.yml' ++ - '/src/gallium/drivers/zink/ci/gitlab-ci-inc.yml' ++ - '/src/gallium/drivers/crocus/ci/gitlab-ci-inc.yml' ++ - '/src/gallium/drivers/softpipe/ci/gitlab-ci-inc.yml' ++ - '/src/gallium/drivers/llvmpipe/ci/gitlab-ci-inc.yml' ++ - '/src/gallium/drivers/virgl/ci/gitlab-ci-inc.yml' ++ - '/src/gallium/drivers/nouveau/ci/gitlab-ci-inc.yml' ++ - '/src/gallium/frontends/lavapipe/ci/gitlab-ci-inc.yml' ++ - '/src/intel/ci/gitlab-ci-inc.yml' ++ - '/src/freedreno/ci/gitlab-ci-inc.yml' ++ - '/src/amd/ci/gitlab-ci-inc.yml' + - drivers/gpu/drm/ci/image-tags.yml + - drivers/gpu/drm/ci/container.yml + - drivers/gpu/drm/ci/static-checks.yml +@@ -154,6 +167,11 @@ stages: + # Run automatically once all dependency jobs have passed + - when: on_success + ++# When to automatically run the CI for container jobs ++.container+build-rules: ++ rules: ++ - !reference [.no_scheduled_pipelines-rules, rules] ++ - when: manual + + .ci-deqp-artifacts: + artifacts: +diff --git a/drivers/gpu/drm/ci/image-tags.yml b/drivers/gpu/drm/ci/image-tags.yml +index f051b6c547c53..157d987149f07 100644 +--- a/drivers/gpu/drm/ci/image-tags.yml ++++ b/drivers/gpu/drm/ci/image-tags.yml +@@ -1,5 +1,5 @@ + variables: +- CONTAINER_TAG: "2023-08-10-mesa-uprev" ++ CONTAINER_TAG: "2023-10-11-mesa-uprev" + DEBIAN_X86_64_BUILD_BASE_IMAGE: "debian/x86_64_build-base" + DEBIAN_BASE_TAG: "${CONTAINER_TAG}" + +diff --git a/drivers/gpu/drm/ci/lava-submit.sh b/drivers/gpu/drm/ci/lava-submit.sh +index 0c4456b21b0fc..379f26ea87cc0 100755 +--- a/drivers/gpu/drm/ci/lava-submit.sh ++++ b/drivers/gpu/drm/ci/lava-submit.sh +@@ -22,7 +22,7 @@ cp "$SCRIPTS_DIR"/setup-test-env.sh results/job-rootfs-overlay/ + + # Prepare env vars for upload. + section_start variables "Variables passed through:" +-KERNEL_IMAGE_BASE_URL="https://${BASE_SYSTEM_HOST_PATH}" \ ++KERNEL_IMAGE_BASE="https://${BASE_SYSTEM_HOST_PATH}" \ + artifacts/ci-common/generate-env.sh | tee results/job-rootfs-overlay/set-job-env-vars.sh + section_end variables + +-- +2.43.0 + diff --git a/queue-6.6/drm-dp-don-t-attempt-aux-transfers-when-edp-panels-a.patch b/queue-6.6/drm-dp-don-t-attempt-aux-transfers-when-edp-panels-a.patch new file mode 100644 index 00000000000..401ea8f0bab --- /dev/null +++ b/queue-6.6/drm-dp-don-t-attempt-aux-transfers-when-edp-panels-a.patch @@ -0,0 +1,180 @@ +From a85082eafed0f5269a0eb8ad8b6ac50bece6ac64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 14:11:16 -0800 +Subject: drm/dp: Don't attempt AUX transfers when eDP panels are not powered + +From: Douglas Anderson + +[ Upstream commit 8df1ddb5bf11ab820ad991e164dab82c0960add9 ] + +If an eDP panel is not powered on then any attempts to talk to it over +the DP AUX channel will timeout. Unfortunately these attempts may be +quite slow. Userspace can initiate these attempts either via a +/dev/drm_dp_auxN device or via the created i2c device. + +Making the DP AUX drivers timeout faster is a difficult proposition. +In theory we could just poll the panel's HPD line in the AUX transfer +function and immediately return an error there. However, this is +easier said than done. For one thing, there's no hard requirement to +hook the HPD line up for eDP panels and it's OK to just delay a fixed +amount. For another thing, the HPD line may not be fast to probe. On +parade-ps8640 we need to wait for the bridge chip's firmware to boot +before we can get the HPD line and this is a slow process. + +The fact that the transfers are taking so long to timeout is causing +real problems. The open source fwupd daemon sometimes scans DP busses +looking for devices whose firmware need updating. If it happens to +scan while a panel is turned off this scan can take a long time. The +fwupd daemon could try to be smarter and only scan when eDP panels are +turned on, but we can also improve the behavior in the kernel. + +Let's let eDP panels drivers specify that a panel is turned off and +then modify the common AUX transfer code not to attempt a transfer in +this case. + +Tested-by: Steev Klimaszewski +Reviewed-by: Hsin-Yi Wang +Tested-by: Eizan Miyamoto +Acked-by: Neil Armstrong +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20240202141109.1.I24277520ac754ea538c9b14578edc94e1df11b48@changeid +Stable-dep-of: 5e842d55bad7 ("drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_helper.c | 35 +++++++++++++++++++ + drivers/gpu/drm/panel/panel-edp.c | 3 ++ + .../gpu/drm/panel/panel-samsung-atna33xc20.c | 2 ++ + include/drm/display/drm_dp_helper.h | 6 ++++ + 4 files changed, 46 insertions(+) + +diff --git a/drivers/gpu/drm/display/drm_dp_helper.c b/drivers/gpu/drm/display/drm_dp_helper.c +index e6a78fd32380a..851f0baf94600 100644 +--- a/drivers/gpu/drm/display/drm_dp_helper.c ++++ b/drivers/gpu/drm/display/drm_dp_helper.c +@@ -532,6 +532,15 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, + + mutex_lock(&aux->hw_mutex); + ++ /* ++ * If the device attached to the aux bus is powered down then there's ++ * no reason to attempt a transfer. Error out immediately. ++ */ ++ if (aux->powered_down) { ++ ret = -EBUSY; ++ goto unlock; ++ } ++ + /* + * The specification doesn't give any recommendation on how often to + * retry native transactions. We used to retry 7 times like for +@@ -599,6 +608,29 @@ int drm_dp_dpcd_probe(struct drm_dp_aux *aux, unsigned int offset) + } + EXPORT_SYMBOL(drm_dp_dpcd_probe); + ++/** ++ * drm_dp_dpcd_set_powered() - Set whether the DP device is powered ++ * @aux: DisplayPort AUX channel; for convenience it's OK to pass NULL here ++ * and the function will be a no-op. ++ * @powered: true if powered; false if not ++ * ++ * If the endpoint device on the DP AUX bus is known to be powered down ++ * then this function can be called to make future transfers fail immediately ++ * instead of needing to time out. ++ * ++ * If this function is never called then a device defaults to being powered. ++ */ ++void drm_dp_dpcd_set_powered(struct drm_dp_aux *aux, bool powered) ++{ ++ if (!aux) ++ return; ++ ++ mutex_lock(&aux->hw_mutex); ++ aux->powered_down = !powered; ++ mutex_unlock(&aux->hw_mutex); ++} ++EXPORT_SYMBOL(drm_dp_dpcd_set_powered); ++ + /** + * drm_dp_dpcd_read() - read a series of bytes from the DPCD + * @aux: DisplayPort AUX channel (SST or MST) +@@ -1855,6 +1887,9 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, + struct drm_dp_aux_msg msg; + int err = 0; + ++ if (aux->powered_down) ++ return -EBUSY; ++ + dp_aux_i2c_transfer_size = clamp(dp_aux_i2c_transfer_size, 1, DP_AUX_MAX_PAYLOAD_BYTES); + + memset(&msg, 0, sizeof(msg)); +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 70feee7876114..94fe2f3836a9a 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -397,6 +397,7 @@ static int panel_edp_suspend(struct device *dev) + { + struct panel_edp *p = dev_get_drvdata(dev); + ++ drm_dp_dpcd_set_powered(p->aux, false); + gpiod_set_value_cansleep(p->enable_gpio, 0); + regulator_disable(p->supply); + p->unprepared_time = ktime_get_boottime(); +@@ -453,6 +454,7 @@ static int panel_edp_prepare_once(struct panel_edp *p) + } + + gpiod_set_value_cansleep(p->enable_gpio, 1); ++ drm_dp_dpcd_set_powered(p->aux, true); + + delay = p->desc->delay.hpd_reliable; + if (p->no_hpd) +@@ -489,6 +491,7 @@ static int panel_edp_prepare_once(struct panel_edp *p) + return 0; + + error: ++ drm_dp_dpcd_set_powered(p->aux, false); + gpiod_set_value_cansleep(p->enable_gpio, 0); + regulator_disable(p->supply); + p->unprepared_time = ktime_get_boottime(); +diff --git a/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c b/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c +index 5703f4712d96e..76c2a8f6718c8 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c ++++ b/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c +@@ -72,6 +72,7 @@ static int atana33xc20_suspend(struct device *dev) + if (p->el3_was_on) + atana33xc20_wait(p->el_on3_off_time, 150); + ++ drm_dp_dpcd_set_powered(p->aux, false); + ret = regulator_disable(p->supply); + if (ret) + return ret; +@@ -93,6 +94,7 @@ static int atana33xc20_resume(struct device *dev) + ret = regulator_enable(p->supply); + if (ret) + return ret; ++ drm_dp_dpcd_set_powered(p->aux, true); + p->powered_on_time = ktime_get_boottime(); + + if (p->no_hpd) { +diff --git a/include/drm/display/drm_dp_helper.h b/include/drm/display/drm_dp_helper.h +index 86f24a759268a..65d76f9e84305 100644 +--- a/include/drm/display/drm_dp_helper.h ++++ b/include/drm/display/drm_dp_helper.h +@@ -449,9 +449,15 @@ struct drm_dp_aux { + * @is_remote: Is this AUX CH actually using sideband messaging. + */ + bool is_remote; ++ ++ /** ++ * @powered_down: If true then the remote endpoint is powered down. ++ */ ++ bool powered_down; + }; + + int drm_dp_dpcd_probe(struct drm_dp_aux *aux, unsigned int offset); ++void drm_dp_dpcd_set_powered(struct drm_dp_aux *aux, bool powered); + ssize_t drm_dp_dpcd_read(struct drm_dp_aux *aux, unsigned int offset, + void *buffer, size_t size); + ssize_t drm_dp_dpcd_write(struct drm_dp_aux *aux, unsigned int offset, +-- +2.43.0 + diff --git a/queue-6.6/drm-edid-parse-topology-block-for-all-dispid-structu.patch b/queue-6.6/drm-edid-parse-topology-block-for-all-dispid-structu.patch new file mode 100644 index 00000000000..98d7d97557f --- /dev/null +++ b/queue-6.6/drm-edid-parse-topology-block-for-all-dispid-structu.patch @@ -0,0 +1,83 @@ +From 4a806e68343a5f5ac4522e6f190e96473d6bbc2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 21:01:39 +0300 +Subject: drm/edid: Parse topology block for all DispID structure v1.x +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit e0a200ab4b72afd581bd6f82fc1ef510a4fb5478 ] + +DisplayID spec v1.3 revision history notes do claim that +the toplogy block was added in v1.3 so requiring structure +v1.2 would seem correct, but there is at least one EDID in +edid.tv with a topology block and structure v1.0. And +there are also EDIDs with DisplayID structure v1.3 which +seems to be totally incorrect as DisplayID spec v1.3 lists +structure v1.2 as the only legal value. + +Unfortunately I couldn't find copies of DisplayID spec +v1.0-v1.2 anywhere (even on vesa.org), so I'll have to +go on empirical evidence alone. + +We used to parse the topology block on all v1.x +structures until the check for structure v2.0 was added. +Let's go back to doing that as the evidence does suggest +that there are DisplayIDs in the wild that would miss +out on the topology stuff otherwise. + +Also toss out DISPLAY_ID_STRUCTURE_VER_12 entirely as +it doesn't appear we can really use it for anything. + +I *think* we could technically skip all the structure +version checks as the block tags shouldn't conflict +between v2.0 and v1.x. But no harm in having a bit of +extra sanity checks I guess. + +So far I'm not aware of any user reported regressions +from overly strict check, but I do know that it broke +igt/kms_tiled_display's fake DisplayID as that one +gets generated with structure v1.0. + +Cc: Jani Nikula +Cc: Dmitry Osipenko +Fixes: c5a486af9df7 ("drm/edid: parse Tiled Display Topology Data Block for DisplayID 2.0") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20240410180139.21352-1-ville.syrjala@linux.intel.com +Acked-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_edid.c | 2 +- + include/drm/drm_displayid.h | 1 - + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index a491280ca48c8..ee3fab115c4b5 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -7321,7 +7321,7 @@ static void drm_parse_tiled_block(struct drm_connector *connector, + static bool displayid_is_tiled_block(const struct displayid_iter *iter, + const struct displayid_block *block) + { +- return (displayid_version(iter) == DISPLAY_ID_STRUCTURE_VER_12 && ++ return (displayid_version(iter) < DISPLAY_ID_STRUCTURE_VER_20 && + block->tag == DATA_BLOCK_TILED_DISPLAY) || + (displayid_version(iter) == DISPLAY_ID_STRUCTURE_VER_20 && + block->tag == DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY); +diff --git a/include/drm/drm_displayid.h b/include/drm/drm_displayid.h +index 566497eeb3b81..bc1f6b378195f 100644 +--- a/include/drm/drm_displayid.h ++++ b/include/drm/drm_displayid.h +@@ -30,7 +30,6 @@ struct drm_edid; + #define VESA_IEEE_OUI 0x3a0292 + + /* DisplayID Structure versions */ +-#define DISPLAY_ID_STRUCTURE_VER_12 0x12 + #define DISPLAY_ID_STRUCTURE_VER_20 0x20 + + /* DisplayID Structure v1r2 Data Blocks */ +-- +2.43.0 + diff --git a/queue-6.6/drm-etnaviv-fix-tx-clock-gating-on-some-gc7000-varia.patch b/queue-6.6/drm-etnaviv-fix-tx-clock-gating-on-some-gc7000-varia.patch new file mode 100644 index 00000000000..a2ee0081e2d --- /dev/null +++ b/queue-6.6/drm-etnaviv-fix-tx-clock-gating-on-some-gc7000-varia.patch @@ -0,0 +1,43 @@ +From a2eb0f7ea95a1ba8da3bf00d9c471575b398ae0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 07:32:07 -0500 +Subject: drm/etnaviv: fix tx clock gating on some GC7000 variants + +From: Derek Foreman + +[ Upstream commit d7a5c9de99b3a9a43dce49f2084eb69b5f6a9752 ] + +commit 4bce244272513 ("drm/etnaviv: disable tx clock gating for GC7000 +rev6203") accidentally applied the fix for i.MX8MN errata ERR050226 to +GC2000 instead of GC7000, failing to disable tx clock gating for GC7000 +rev 0x6023 as intended. + +Additional clean-up further propagated this issue, partially breaking +the clock gating fixes added for GC7000 rev 6202 in commit 432f51e7deeda +("drm/etnaviv: add clock gating workaround for GC7000 r6202"). + +Signed-off-by: Derek Foreman +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +index 9276756e1397d..371e1f2733f6f 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +@@ -632,8 +632,8 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu) + /* Disable TX clock gating on affected core revisions. */ + if (etnaviv_is_model_rev(gpu, GC4000, 0x5222) || + etnaviv_is_model_rev(gpu, GC2000, 0x5108) || +- etnaviv_is_model_rev(gpu, GC2000, 0x6202) || +- etnaviv_is_model_rev(gpu, GC2000, 0x6203)) ++ etnaviv_is_model_rev(gpu, GC7000, 0x6202) || ++ etnaviv_is_model_rev(gpu, GC7000, 0x6203)) + pmc |= VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_TX; + + /* Disable SE and RA clock gating on affected core revisions. */ +-- +2.43.0 + diff --git a/queue-6.6/drm-lcdif-do-not-disable-clocks-on-already-suspended.patch b/queue-6.6/drm-lcdif-do-not-disable-clocks-on-already-suspended.patch new file mode 100644 index 00000000000..3c498860cff --- /dev/null +++ b/queue-6.6/drm-lcdif-do-not-disable-clocks-on-already-suspended.patch @@ -0,0 +1,61 @@ +From c6db6b1b47f1edc0e0cb0ab47e7b6feceaa76083 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 09:26:27 +0100 +Subject: drm/lcdif: Do not disable clocks on already suspended hardware + +From: Marek Vasut + +[ Upstream commit 172695f145fb4798ab605e8a73f6e87711930124 ] + +In case the LCDIF is enabled in DT but unused, the clocks used by the +LCDIF are not enabled. Those clocks may even have a use count of 0 in +case there are no other users of those clocks. This can happen e.g. in +case the LCDIF drives HDMI bridge which has no panel plugged into the +HDMI connector. + +Do not attempt to disable clocks in the suspend callback and re-enable +clocks in the resume callback unless the LCDIF is enabled and was in +use before the system entered suspend, otherwise the driver might end +up trying to disable clocks which are already disabled with use count +0, and would trigger a warning from clock core about this condition. + +Note that the lcdif_rpm_suspend() and lcdif_rpm_resume() functions +internally perform the clocks disable and enable operations and act +as runtime PM hooks too. + +Reviewed-by: Liu Ying +Fixes: 9db35bb349a0 ("drm: lcdif: Add support for i.MX8MP LCDIF variant") +Signed-off-by: Marek Vasut +Link: https://patchwork.freedesktop.org/patch/msgid/20240226082644.32603-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mxsfb/lcdif_drv.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mxsfb/lcdif_drv.c b/drivers/gpu/drm/mxsfb/lcdif_drv.c +index 18de2f17e2491..6494e82707569 100644 +--- a/drivers/gpu/drm/mxsfb/lcdif_drv.c ++++ b/drivers/gpu/drm/mxsfb/lcdif_drv.c +@@ -340,6 +340,9 @@ static int __maybe_unused lcdif_suspend(struct device *dev) + if (ret) + return ret; + ++ if (pm_runtime_suspended(dev)) ++ return 0; ++ + return lcdif_rpm_suspend(dev); + } + +@@ -347,7 +350,8 @@ static int __maybe_unused lcdif_resume(struct device *dev) + { + struct drm_device *drm = dev_get_drvdata(dev); + +- lcdif_rpm_resume(dev); ++ if (!pm_runtime_suspended(dev)) ++ lcdif_rpm_resume(dev); + + return drm_mode_config_helper_resume(drm); + } +-- +2.43.0 + diff --git a/queue-6.6/drm-mediatek-add-0-size-check-to-mtk_drm_gem_obj.patch b/queue-6.6/drm-mediatek-add-0-size-check-to-mtk_drm_gem_obj.patch new file mode 100644 index 00000000000..5bd960d934d --- /dev/null +++ b/queue-6.6/drm-mediatek-add-0-size-check-to-mtk_drm_gem_obj.patch @@ -0,0 +1,44 @@ +From 914d16b590b2b2572795f4a03cfb624e27e94109 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 13:00:51 -0500 +Subject: drm/mediatek: Add 0 size check to mtk_drm_gem_obj + +From: Justin Green + +[ Upstream commit 1e4350095e8ab2577ee05f8c3b044e661b5af9a0 ] + +Add a check to mtk_drm_gem_init if we attempt to allocate a GEM object +of 0 bytes. Currently, no such check exists and the kernel will panic if +a userspace application attempts to allocate a 0x0 GBM buffer. + +Tested by attempting to allocate a 0x0 GBM buffer on an MT8188 and +verifying that we now return EINVAL. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Justin Green +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240307180051.4104425-1-greenjustin@chromium.org/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index 4f2e3feabc0f8..1bf229615b018 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -38,6 +38,9 @@ static struct mtk_drm_gem_obj *mtk_drm_gem_init(struct drm_device *dev, + + size = round_up(size, PAGE_SIZE); + ++ if (size == 0) ++ return ERR_PTR(-EINVAL); ++ + mtk_gem_obj = kzalloc(sizeof(*mtk_gem_obj), GFP_KERNEL); + if (!mtk_gem_obj) + return ERR_PTR(-ENOMEM); +-- +2.43.0 + diff --git a/queue-6.6/drm-meson-vclk-fix-calculation-of-59.94-fractional-r.patch b/queue-6.6/drm-meson-vclk-fix-calculation-of-59.94-fractional-r.patch new file mode 100644 index 00000000000..253b271fd18 --- /dev/null +++ b/queue-6.6/drm-meson-vclk-fix-calculation-of-59.94-fractional-r.patch @@ -0,0 +1,65 @@ +From 55fbedffc1d256109da188330ee2014d64984765 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 23:07:04 +0000 +Subject: drm/meson: vclk: fix calculation of 59.94 fractional rates + +From: Christian Hewitt + +[ Upstream commit bfbc68e4d8695497f858a45a142665e22a512ea3 ] + +Playing 4K media with 59.94 fractional rate (typically VP9) causes the screen to lose +sync with the following error reported in the system log: + +[ 89.610280] Fatal Error, invalid HDMI vclk freq 593406 + +Modetest shows the following: + +3840x2160 59.94 3840 4016 4104 4400 2160 2168 2178 2250 593407 flags: xxxx, xxxx, +drm calculated value -------------------------------------^ + +Change the fractional rate calculation to stop DIV_ROUND_CLOSEST rounding down which +results in vclk freq failing to match correctly. + +Fixes: e5fab2ec9ca4 ("drm/meson: vclk: add support for YUV420 setup") +Signed-off-by: Christian Hewitt +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20240109230704.4120561-1-christianshewitt@gmail.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240109230704.4120561-1-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_vclk.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c +index 2a82119eb58ed..2a942dc6a6dc2 100644 +--- a/drivers/gpu/drm/meson/meson_vclk.c ++++ b/drivers/gpu/drm/meson/meson_vclk.c +@@ -790,13 +790,13 @@ meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, + FREQ_1000_1001(params[i].pixel_freq)); + DRM_DEBUG_DRIVER("i = %d phy_freq = %d alt = %d\n", + i, params[i].phy_freq, +- FREQ_1000_1001(params[i].phy_freq/10)*10); ++ FREQ_1000_1001(params[i].phy_freq/1000)*1000); + /* Match strict frequency */ + if (phy_freq == params[i].phy_freq && + vclk_freq == params[i].vclk_freq) + return MODE_OK; + /* Match 1000/1001 variant */ +- if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/10)*10) && ++ if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/1000)*1000) && + vclk_freq == FREQ_1000_1001(params[i].vclk_freq)) + return MODE_OK; + } +@@ -1070,7 +1070,7 @@ void meson_vclk_setup(struct meson_drm *priv, unsigned int target, + + for (freq = 0 ; params[freq].pixel_freq ; ++freq) { + if ((phy_freq == params[freq].phy_freq || +- phy_freq == FREQ_1000_1001(params[freq].phy_freq/10)*10) && ++ phy_freq == FREQ_1000_1001(params[freq].phy_freq/1000)*1000) && + (vclk_freq == params[freq].vclk_freq || + vclk_freq == FREQ_1000_1001(params[freq].vclk_freq))) { + if (vclk_freq != params[freq].vclk_freq) +-- +2.43.0 + diff --git a/queue-6.6/drm-mipi-dsi-use-correct-return-type-for-the-dsc-fun.patch b/queue-6.6/drm-mipi-dsi-use-correct-return-type-for-the-dsc-fun.patch new file mode 100644 index 00000000000..7b9193eb2b0 --- /dev/null +++ b/queue-6.6/drm-mipi-dsi-use-correct-return-type-for-the-dsc-fun.patch @@ -0,0 +1,69 @@ +From fe08e3d13f988e2a8eef395b11877ba89c6f7181 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 02:53:51 +0300 +Subject: drm/mipi-dsi: use correct return type for the DSC functions + +From: Dmitry Baryshkov + +[ Upstream commit de1c705c50326acaceaf1f02bc5bf6f267c572bd ] + +The functions mipi_dsi_compression_mode() and +mipi_dsi_picture_parameter_set() return 0-or-error rather than a buffer +size. Follow example of other similar MIPI DSI functions and use int +return type instead of size_t. + +Fixes: f4dea1aaa9a1 ("drm/dsi: add helpers for DSI compression mode and PPS packets") +Reviewed-by: Marijn Suijten +Reviewed-by: Jessica Zhang +Signed-off-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20240408-lg-sw43408-panel-v5-2-4e092da22991@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_mipi_dsi.c | 6 +++--- + include/drm/drm_mipi_dsi.h | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index 843a6dbda93a0..52a93149363b4 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -654,7 +654,7 @@ EXPORT_SYMBOL(mipi_dsi_set_maximum_return_packet_size); + * + * Return: 0 on success or a negative error code on failure. + */ +-ssize_t mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable) ++int mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable) + { + /* Note: Needs updating for non-default PPS or algorithm */ + u8 tx[2] = { enable << 0, 0 }; +@@ -679,8 +679,8 @@ EXPORT_SYMBOL(mipi_dsi_compression_mode); + * + * Return: 0 on success or a negative error code on failure. + */ +-ssize_t mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi, +- const struct drm_dsc_picture_parameter_set *pps) ++int mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi, ++ const struct drm_dsc_picture_parameter_set *pps) + { + struct mipi_dsi_msg msg = { + .channel = dsi->channel, +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index c0aec0d4d664e..3011d33eccbd2 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -241,9 +241,9 @@ int mipi_dsi_shutdown_peripheral(struct mipi_dsi_device *dsi); + int mipi_dsi_turn_on_peripheral(struct mipi_dsi_device *dsi); + int mipi_dsi_set_maximum_return_packet_size(struct mipi_dsi_device *dsi, + u16 value); +-ssize_t mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable); +-ssize_t mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi, +- const struct drm_dsc_picture_parameter_set *pps); ++int mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable); ++int mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi, ++ const struct drm_dsc_picture_parameter_set *pps); + + ssize_t mipi_dsi_generic_write(struct mipi_dsi_device *dsi, const void *payload, + size_t size); +-- +2.43.0 + diff --git a/queue-6.6/drm-msm-dp-allow-voltage-swing-pre-emphasis-of-3.patch b/queue-6.6/drm-msm-dp-allow-voltage-swing-pre-emphasis-of-3.patch new file mode 100644 index 00000000000..e2034de0e3b --- /dev/null +++ b/queue-6.6/drm-msm-dp-allow-voltage-swing-pre-emphasis-of-3.patch @@ -0,0 +1,138 @@ +From 626f87f39fb1ddf0141b846e21faae3130afa109 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Feb 2024 15:47:25 +0200 +Subject: drm/msm/dp: allow voltage swing / pre emphasis of 3 + +From: Dmitry Baryshkov + +[ Upstream commit 22578178e5dd6d3aa4490879df8b6c2977d980be ] + +Both dp_link_adjust_levels() and dp_ctrl_update_vx_px() limit swing and +pre-emphasis to 2, while the real maximum value for the sum of the +voltage swing and pre-emphasis is 3. Fix the DP code to remove this +limitation. + +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Kuogee Hsieh +Tested-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/577006/ +Link: https://lore.kernel.org/r/20240203-dp-swing-3-v1-1-6545e1706196@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_ctrl.c | 6 +++--- + drivers/gpu/drm/msm/dp/dp_link.c | 22 +++++++++++----------- + drivers/gpu/drm/msm/dp/dp_link.h | 14 +------------- + 3 files changed, 15 insertions(+), 27 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c +index fb588fde298a2..780e9747be1fb 100644 +--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c ++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c +@@ -1019,14 +1019,14 @@ static int dp_ctrl_update_vx_px(struct dp_ctrl_private *ctrl) + if (ret) + return ret; + +- if (voltage_swing_level >= DP_TRAIN_VOLTAGE_SWING_MAX) { ++ if (voltage_swing_level >= DP_TRAIN_LEVEL_MAX) { + drm_dbg_dp(ctrl->drm_dev, + "max. voltage swing level reached %d\n", + voltage_swing_level); + max_level_reached |= DP_TRAIN_MAX_SWING_REACHED; + } + +- if (pre_emphasis_level >= DP_TRAIN_PRE_EMPHASIS_MAX) { ++ if (pre_emphasis_level >= DP_TRAIN_LEVEL_MAX) { + drm_dbg_dp(ctrl->drm_dev, + "max. pre-emphasis level reached %d\n", + pre_emphasis_level); +@@ -1117,7 +1117,7 @@ static int dp_ctrl_link_train_1(struct dp_ctrl_private *ctrl, + } + + if (ctrl->link->phy_params.v_level >= +- DP_TRAIN_VOLTAGE_SWING_MAX) { ++ DP_TRAIN_LEVEL_MAX) { + DRM_ERROR_RATELIMITED("max v_level reached\n"); + return -EAGAIN; + } +diff --git a/drivers/gpu/drm/msm/dp/dp_link.c b/drivers/gpu/drm/msm/dp/dp_link.c +index 25950171caf3e..a198af7b2d449 100644 +--- a/drivers/gpu/drm/msm/dp/dp_link.c ++++ b/drivers/gpu/drm/msm/dp/dp_link.c +@@ -1141,6 +1141,7 @@ int dp_link_get_colorimetry_config(struct dp_link *dp_link) + int dp_link_adjust_levels(struct dp_link *dp_link, u8 *link_status) + { + int i; ++ u8 max_p_level; + int v_max = 0, p_max = 0; + struct dp_link_private *link; + +@@ -1172,30 +1173,29 @@ int dp_link_adjust_levels(struct dp_link *dp_link, u8 *link_status) + * Adjust the voltage swing and pre-emphasis level combination to within + * the allowable range. + */ +- if (dp_link->phy_params.v_level > DP_TRAIN_VOLTAGE_SWING_MAX) { ++ if (dp_link->phy_params.v_level > DP_TRAIN_LEVEL_MAX) { + drm_dbg_dp(link->drm_dev, + "Requested vSwingLevel=%d, change to %d\n", + dp_link->phy_params.v_level, +- DP_TRAIN_VOLTAGE_SWING_MAX); +- dp_link->phy_params.v_level = DP_TRAIN_VOLTAGE_SWING_MAX; ++ DP_TRAIN_LEVEL_MAX); ++ dp_link->phy_params.v_level = DP_TRAIN_LEVEL_MAX; + } + +- if (dp_link->phy_params.p_level > DP_TRAIN_PRE_EMPHASIS_MAX) { ++ if (dp_link->phy_params.p_level > DP_TRAIN_LEVEL_MAX) { + drm_dbg_dp(link->drm_dev, + "Requested preEmphasisLevel=%d, change to %d\n", + dp_link->phy_params.p_level, +- DP_TRAIN_PRE_EMPHASIS_MAX); +- dp_link->phy_params.p_level = DP_TRAIN_PRE_EMPHASIS_MAX; ++ DP_TRAIN_LEVEL_MAX); ++ dp_link->phy_params.p_level = DP_TRAIN_LEVEL_MAX; + } + +- if ((dp_link->phy_params.p_level > DP_TRAIN_PRE_EMPHASIS_LVL_1) +- && (dp_link->phy_params.v_level == +- DP_TRAIN_VOLTAGE_SWING_LVL_2)) { ++ max_p_level = DP_TRAIN_LEVEL_MAX - dp_link->phy_params.v_level; ++ if (dp_link->phy_params.p_level > max_p_level) { + drm_dbg_dp(link->drm_dev, + "Requested preEmphasisLevel=%d, change to %d\n", + dp_link->phy_params.p_level, +- DP_TRAIN_PRE_EMPHASIS_LVL_1); +- dp_link->phy_params.p_level = DP_TRAIN_PRE_EMPHASIS_LVL_1; ++ max_p_level); ++ dp_link->phy_params.p_level = max_p_level; + } + + drm_dbg_dp(link->drm_dev, "adjusted: v_level=%d, p_level=%d\n", +diff --git a/drivers/gpu/drm/msm/dp/dp_link.h b/drivers/gpu/drm/msm/dp/dp_link.h +index 9dd4dd9265304..79c3a02b8dacd 100644 +--- a/drivers/gpu/drm/msm/dp/dp_link.h ++++ b/drivers/gpu/drm/msm/dp/dp_link.h +@@ -19,19 +19,7 @@ struct dp_link_info { + unsigned long capabilities; + }; + +-enum dp_link_voltage_level { +- DP_TRAIN_VOLTAGE_SWING_LVL_0 = 0, +- DP_TRAIN_VOLTAGE_SWING_LVL_1 = 1, +- DP_TRAIN_VOLTAGE_SWING_LVL_2 = 2, +- DP_TRAIN_VOLTAGE_SWING_MAX = DP_TRAIN_VOLTAGE_SWING_LVL_2, +-}; +- +-enum dp_link_preemaphasis_level { +- DP_TRAIN_PRE_EMPHASIS_LVL_0 = 0, +- DP_TRAIN_PRE_EMPHASIS_LVL_1 = 1, +- DP_TRAIN_PRE_EMPHASIS_LVL_2 = 2, +- DP_TRAIN_PRE_EMPHASIS_MAX = DP_TRAIN_PRE_EMPHASIS_LVL_2, +-}; ++#define DP_TRAIN_LEVEL_MAX 3 + + struct dp_link_test_video { + u32 test_video_pattern; +-- +2.43.0 + diff --git a/queue-6.6/drm-msm-dp-avoid-a-long-timeout-for-aux-transfer-if-.patch b/queue-6.6/drm-msm-dp-avoid-a-long-timeout-for-aux-transfer-if-.patch new file mode 100644 index 00000000000..778bf7244b1 --- /dev/null +++ b/queue-6.6/drm-msm-dp-avoid-a-long-timeout-for-aux-transfer-if-.patch @@ -0,0 +1,133 @@ +From 7d097ae7bd55974fff9741d1466d9fbd4163eba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 14:36:29 -0700 +Subject: drm/msm/dp: Avoid a long timeout for AUX transfer if nothing + connected + +From: Douglas Anderson + +[ Upstream commit 5d1a7493343cc00d9019880b686e4e0a0f649531 ] + +As documented in the description of the transfer() function of +"struct drm_dp_aux", the transfer() function can be called at any time +regardless of the state of the DP port. Specifically if the kernel has +the DP AUX character device enabled and userspace accesses +"/dev/drm_dp_auxN" directly then the AUX transfer function will be +called regardless of whether a DP device is connected. + +For eDP panels we have a special rule where we wait (with a 5 second +timeout) for HPD to go high. This rule was important before all panels +drivers were converted to call wait_hpd_asserted() and actually can be +removed in a future commit. + +For external DP devices we never checked for HPD. That means that +trying to access the DP AUX character device (AKA `hexdump -C +/dev/drm_dp_auxN`) would very, very slowly timeout. Specifically on my +system: + $ time hexdump -C /dev/drm_dp_aux0 + hexdump: /dev/drm_dp_aux0: Connection timed out + real 0m8.200s +We want access to the drm_dp_auxN character device to fail faster than +8 seconds when no DP cable is plugged in. + +Let's add a test to make transfers fail right away if a device isn't +plugged in. Rather than testing the HPD line directly, we have the +dp_display module tell us when AUX transfers should be enabled so we +can handle cases where HPD is signaled out of band like with Type C. + +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Signed-off-by: Douglas Anderson +Reviewed-by: Guenter Roeck +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/583127/ +Link: https://lore.kernel.org/r/20240315143621.v2.1.I16aff881c9fe82b5e0fc06ca312da017aa7b5b3e@changeid +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_aux.c | 20 ++++++++++++++++++++ + drivers/gpu/drm/msm/dp/dp_aux.h | 1 + + drivers/gpu/drm/msm/dp/dp_display.c | 4 ++++ + 3 files changed, 25 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dp/dp_aux.c b/drivers/gpu/drm/msm/dp/dp_aux.c +index 8e3b677f35e64..559809a5cbcfb 100644 +--- a/drivers/gpu/drm/msm/dp/dp_aux.c ++++ b/drivers/gpu/drm/msm/dp/dp_aux.c +@@ -35,6 +35,7 @@ struct dp_aux_private { + bool no_send_stop; + bool initted; + bool is_edp; ++ bool enable_xfers; + u32 offset; + u32 segment; + +@@ -297,6 +298,17 @@ static ssize_t dp_aux_transfer(struct drm_dp_aux *dp_aux, + goto exit; + } + ++ /* ++ * If we're using DP and an external display isn't connected then the ++ * transfer won't succeed. Return right away. If we don't do this we ++ * can end up with long timeouts if someone tries to access the DP AUX ++ * character device when no DP device is connected. ++ */ ++ if (!aux->is_edp && !aux->enable_xfers) { ++ ret = -ENXIO; ++ goto exit; ++ } ++ + /* + * For eDP it's important to give a reasonably long wait here for HPD + * to be asserted. This is because the panel driver may have _just_ +@@ -428,6 +440,14 @@ irqreturn_t dp_aux_isr(struct drm_dp_aux *dp_aux) + return IRQ_HANDLED; + } + ++void dp_aux_enable_xfers(struct drm_dp_aux *dp_aux, bool enabled) ++{ ++ struct dp_aux_private *aux; ++ ++ aux = container_of(dp_aux, struct dp_aux_private, dp_aux); ++ aux->enable_xfers = enabled; ++} ++ + void dp_aux_reconfig(struct drm_dp_aux *dp_aux) + { + struct dp_aux_private *aux; +diff --git a/drivers/gpu/drm/msm/dp/dp_aux.h b/drivers/gpu/drm/msm/dp/dp_aux.h +index 511305da4f66d..f3052cb43306b 100644 +--- a/drivers/gpu/drm/msm/dp/dp_aux.h ++++ b/drivers/gpu/drm/msm/dp/dp_aux.h +@@ -12,6 +12,7 @@ + int dp_aux_register(struct drm_dp_aux *dp_aux); + void dp_aux_unregister(struct drm_dp_aux *dp_aux); + irqreturn_t dp_aux_isr(struct drm_dp_aux *dp_aux); ++void dp_aux_enable_xfers(struct drm_dp_aux *dp_aux, bool enabled); + void dp_aux_init(struct drm_dp_aux *dp_aux); + void dp_aux_deinit(struct drm_dp_aux *dp_aux); + void dp_aux_reconfig(struct drm_dp_aux *dp_aux); +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index eec5768aac727..ed77c957eceba 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -586,6 +586,8 @@ static int dp_hpd_plug_handle(struct dp_display_private *dp, u32 data) + u32 state; + int ret; + ++ dp_aux_enable_xfers(dp->aux, true); ++ + mutex_lock(&dp->event_mutex); + + state = dp->hpd_state; +@@ -642,6 +644,8 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data) + { + u32 state; + ++ dp_aux_enable_xfers(dp->aux, false); ++ + mutex_lock(&dp->event_mutex); + + state = dp->hpd_state; +-- +2.43.0 + diff --git a/queue-6.6/drm-omapdrm-fix-console-by-implementing-fb_dirty.patch b/queue-6.6/drm-omapdrm-fix-console-by-implementing-fb_dirty.patch new file mode 100644 index 00000000000..8bc444d927c --- /dev/null +++ b/queue-6.6/drm-omapdrm-fix-console-by-implementing-fb_dirty.patch @@ -0,0 +1,54 @@ +From 8baffee51b251e94adcfe20351e8b566e27ea7b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 08:35:31 +0200 +Subject: drm/omapdrm: Fix console by implementing fb_dirty + +From: Tony Lindgren + +[ Upstream commit 632bac50544c0929ced9eed41e7d04c08adecbb0 ] + +The framebuffer console stopped updating with commit f231af498c29 +("drm/fb-helper: Disconnect damage worker from update logic"). + +Let's fix the issue by implementing fb_dirty similar to what was done +with commit 039a72ce7e57 ("drm/i915/fbdev: Implement fb_dirty for intel +custom fb helper"). + +Fixes: f231af498c29 ("drm/fb-helper: Disconnect damage worker from update logic") +Reviewed-by: Thomas Zimmermann +Signed-off-by: Tony Lindgren +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20240228063540.4444-2-tony@atomide.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/omap_fbdev.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c +index 6b08b137af1ad..7c5af3de1e727 100644 +--- a/drivers/gpu/drm/omapdrm/omap_fbdev.c ++++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c +@@ -238,8 +238,20 @@ static int omap_fbdev_create(struct drm_fb_helper *helper, + return ret; + } + ++static int omap_fbdev_dirty(struct drm_fb_helper *helper, struct drm_clip_rect *clip) ++{ ++ if (!(clip->x1 < clip->x2 && clip->y1 < clip->y2)) ++ return 0; ++ ++ if (helper->fb->funcs->dirty) ++ return helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, clip, 1); ++ ++ return 0; ++} ++ + static const struct drm_fb_helper_funcs omap_fb_helper_funcs = { + .fb_probe = omap_fbdev_create, ++ .fb_dirty = omap_fbdev_dirty, + }; + + static struct drm_fb_helper *get_fb(struct fb_info *fbi) +-- +2.43.0 + diff --git a/queue-6.6/drm-omapdrm-fix-console-with-deferred-ops.patch b/queue-6.6/drm-omapdrm-fix-console-with-deferred-ops.patch new file mode 100644 index 00000000000..7f27f33b760 --- /dev/null +++ b/queue-6.6/drm-omapdrm-fix-console-with-deferred-ops.patch @@ -0,0 +1,156 @@ +From 9d33385d2d1dec12d5a4ff1d366abbb20d6235c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 08:35:32 +0200 +Subject: drm/omapdrm: Fix console with deferred ops + +From: Tony Lindgren + +[ Upstream commit 01c0cce88c5480cc2505b79330246ef12eda938f ] + +Commit 95da53d63dcf ("drm/omapdrm: Use regular fbdev I/O helpers") +stopped console from updating for command mode displays because there is +no damage handling in fb_sys_write() unlike we had earlier in +drm_fb_helper_sys_write(). + +Let's fix the issue by adding FB_GEN_DEFAULT_DEFERRED_DMAMEM_OPS and +FB_DMAMEM_HELPERS_DEFERRED as suggested by Thomas. We cannot use the +FB_DEFAULT_DEFERRED_OPS as fb_deferred_io_mmap() won't work properly +for write-combine. + +Fixes: 95da53d63dcf ("drm/omapdrm: Use regular fbdev I/O helpers") +Suggested-by: Thomas Zimmermann +Reviewed-by: Thomas Zimmermann +Signed-off-by: Tony Lindgren +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20240228063540.4444-3-tony@atomide.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/Kconfig | 2 +- + drivers/gpu/drm/omapdrm/omap_fbdev.c | 28 ++++++++++++++++++++++------ + drivers/video/fbdev/core/Kconfig | 6 ++++++ + include/linux/fb.h | 4 ++++ + 4 files changed, 33 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/omapdrm/Kconfig b/drivers/gpu/drm/omapdrm/Kconfig +index b715301ec79f6..6c49270cb290a 100644 +--- a/drivers/gpu/drm/omapdrm/Kconfig ++++ b/drivers/gpu/drm/omapdrm/Kconfig +@@ -4,7 +4,7 @@ config DRM_OMAP + depends on DRM && OF + depends on ARCH_OMAP2PLUS + select DRM_KMS_HELPER +- select FB_DMAMEM_HELPERS if DRM_FBDEV_EMULATION ++ select FB_DMAMEM_HELPERS_DEFERRED if DRM_FBDEV_EMULATION + select VIDEOMODE_HELPERS + select HDMI + default n +diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c +index 7c5af3de1e727..523be34682caf 100644 +--- a/drivers/gpu/drm/omapdrm/omap_fbdev.c ++++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c +@@ -51,6 +51,10 @@ static void pan_worker(struct work_struct *work) + omap_gem_roll(bo, fbi->var.yoffset * npages); + } + ++FB_GEN_DEFAULT_DEFERRED_DMAMEM_OPS(omap_fbdev, ++ drm_fb_helper_damage_range, ++ drm_fb_helper_damage_area) ++ + static int omap_fbdev_pan_display(struct fb_var_screeninfo *var, + struct fb_info *fbi) + { +@@ -78,11 +82,9 @@ static int omap_fbdev_pan_display(struct fb_var_screeninfo *var, + + static int omap_fbdev_fb_mmap(struct fb_info *info, struct vm_area_struct *vma) + { +- struct drm_fb_helper *helper = info->par; +- struct drm_framebuffer *fb = helper->fb; +- struct drm_gem_object *bo = drm_gem_fb_get_obj(fb, 0); ++ vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags)); + +- return drm_gem_mmap_obj(bo, omap_gem_mmap_size(bo), vma); ++ return fb_deferred_io_mmap(info, vma); + } + + static void omap_fbdev_fb_destroy(struct fb_info *info) +@@ -94,6 +96,7 @@ static void omap_fbdev_fb_destroy(struct fb_info *info) + + DBG(); + ++ fb_deferred_io_cleanup(info); + drm_fb_helper_fini(helper); + + omap_gem_unpin(bo); +@@ -104,15 +107,19 @@ static void omap_fbdev_fb_destroy(struct fb_info *info) + kfree(fbdev); + } + ++/* ++ * For now, we cannot use FB_DEFAULT_DEFERRED_OPS and fb_deferred_io_mmap() ++ * because we use write-combine. ++ */ + static const struct fb_ops omap_fb_ops = { + .owner = THIS_MODULE, +- __FB_DEFAULT_DMAMEM_OPS_RDWR, ++ __FB_DEFAULT_DEFERRED_OPS_RDWR(omap_fbdev), + .fb_check_var = drm_fb_helper_check_var, + .fb_set_par = drm_fb_helper_set_par, + .fb_setcmap = drm_fb_helper_setcmap, + .fb_blank = drm_fb_helper_blank, + .fb_pan_display = omap_fbdev_pan_display, +- __FB_DEFAULT_DMAMEM_OPS_DRAW, ++ __FB_DEFAULT_DEFERRED_OPS_DRAW(omap_fbdev), + .fb_ioctl = drm_fb_helper_ioctl, + .fb_mmap = omap_fbdev_fb_mmap, + .fb_destroy = omap_fbdev_fb_destroy, +@@ -213,6 +220,15 @@ static int omap_fbdev_create(struct drm_fb_helper *helper, + fbi->fix.smem_start = dma_addr; + fbi->fix.smem_len = bo->size; + ++ /* deferred I/O */ ++ helper->fbdefio.delay = HZ / 20; ++ helper->fbdefio.deferred_io = drm_fb_helper_deferred_io; ++ ++ fbi->fbdefio = &helper->fbdefio; ++ ret = fb_deferred_io_init(fbi); ++ if (ret) ++ goto fail; ++ + /* if we have DMM, then we can use it for scrolling by just + * shuffling pages around in DMM rather than doing sw blit. + */ +diff --git a/drivers/video/fbdev/core/Kconfig b/drivers/video/fbdev/core/Kconfig +index 56f721ebcff05..acb19045d3046 100644 +--- a/drivers/video/fbdev/core/Kconfig ++++ b/drivers/video/fbdev/core/Kconfig +@@ -145,6 +145,12 @@ config FB_DMAMEM_HELPERS + select FB_SYS_FOPS + select FB_SYS_IMAGEBLIT + ++config FB_DMAMEM_HELPERS_DEFERRED ++ bool ++ depends on FB_CORE ++ select FB_DEFERRED_IO ++ select FB_DMAMEM_HELPERS ++ + config FB_IOMEM_FOPS + tristate + depends on FB_CORE +diff --git a/include/linux/fb.h b/include/linux/fb.h +index c14576458228a..322b4d20afa55 100644 +--- a/include/linux/fb.h ++++ b/include/linux/fb.h +@@ -690,6 +690,10 @@ extern int fb_deferred_io_fsync(struct file *file, loff_t start, + __FB_GEN_DEFAULT_DEFERRED_OPS_RDWR(__prefix, __damage_range, sys) \ + __FB_GEN_DEFAULT_DEFERRED_OPS_DRAW(__prefix, __damage_area, sys) + ++#define FB_GEN_DEFAULT_DEFERRED_DMAMEM_OPS(__prefix, __damage_range, __damage_area) \ ++ __FB_GEN_DEFAULT_DEFERRED_OPS_RDWR(__prefix, __damage_range, sys) \ ++ __FB_GEN_DEFAULT_DEFERRED_OPS_DRAW(__prefix, __damage_area, sys) ++ + /* + * Initializes struct fb_ops for deferred I/O. + */ +-- +2.43.0 + diff --git a/queue-6.6/drm-panel-atna33xc20-fix-unbalanced-regulator-in-the.patch b/queue-6.6/drm-panel-atna33xc20-fix-unbalanced-regulator-in-the.patch new file mode 100644 index 00000000000..ccb1ea9e02a --- /dev/null +++ b/queue-6.6/drm-panel-atna33xc20-fix-unbalanced-regulator-in-the.patch @@ -0,0 +1,74 @@ +From e34f766fe9373a96292eb794219509ce3f058ff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 14:12:14 -0700 +Subject: drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD + doesn't assert + +From: Douglas Anderson + +[ Upstream commit 5e842d55bad7794823a50f24fd645b58f2ef93ab ] + +When the atna33xc20 driver was first written the resume code never +returned an error. If there was a problem waiting for HPD it just +printed a warning and moved on. This changed in response to review +feedback [1] on a future patch but I accidentally didn't account for +rolling back the regulator enable in the error cases. Do so now. + +[1] https://lore.kernel.org/all/5f3cf3a6-1cc2-63e4-f76b-4ee686764705@linaro.org/ + +Fixes: 3b5765df375c ("drm/panel: atna33xc20: Take advantage of wait_hpd_asserted() in struct drm_dp_aux") +Acked-by: Jessica Zhang +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20240313-homestarpanel-regulator-v1-1-b8e3a336da12@chromium.org +Signed-off-by: Sasha Levin +--- + .../gpu/drm/panel/panel-samsung-atna33xc20.c | 22 +++++++++++-------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c b/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c +index 76c2a8f6718c8..9c336c71562b9 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c ++++ b/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c +@@ -109,19 +109,17 @@ static int atana33xc20_resume(struct device *dev) + if (hpd_asserted < 0) + ret = hpd_asserted; + +- if (ret) ++ if (ret) { + dev_warn(dev, "Error waiting for HPD GPIO: %d\n", ret); +- +- return ret; +- } +- +- if (p->aux->wait_hpd_asserted) { ++ goto error; ++ } ++ } else if (p->aux->wait_hpd_asserted) { + ret = p->aux->wait_hpd_asserted(p->aux, HPD_MAX_US); + +- if (ret) ++ if (ret) { + dev_warn(dev, "Controller error waiting for HPD: %d\n", ret); +- +- return ret; ++ goto error; ++ } + } + + /* +@@ -133,6 +131,12 @@ static int atana33xc20_resume(struct device *dev) + * right times. + */ + return 0; ++ ++error: ++ drm_dp_dpcd_set_powered(p->aux, false); ++ regulator_disable(p->supply); ++ ++ return ret; + } + + static int atana33xc20_disable(struct drm_panel *panel) +-- +2.43.0 + diff --git a/queue-6.6/drm-panel-novatek-nt35950-don-t-log-an-error-when-ds.patch b/queue-6.6/drm-panel-novatek-nt35950-don-t-log-an-error-when-ds.patch new file mode 100644 index 00000000000..aaba80cfef1 --- /dev/null +++ b/queue-6.6/drm-panel-novatek-nt35950-don-t-log-an-error-when-ds.patch @@ -0,0 +1,49 @@ +From f2dc95a7352761836c3200a94d66bf69e1b180bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:36 -0400 +Subject: drm/panel: novatek-nt35950: Don't log an error when DSI host can't be + found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 5ff5505b9a2d827cae3f95dceba258c963138175 ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: 623a3531e9cf ("drm/panel: Add driver for Novatek NT35950 DSI DriverIC panels") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-8-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt35950.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35950.c b/drivers/gpu/drm/panel/panel-novatek-nt35950.c +index 412ca84d05811..4be5013330ec2 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35950.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35950.c +@@ -565,10 +565,8 @@ static int nt35950_probe(struct mipi_dsi_device *dsi) + } + dsi_r_host = of_find_mipi_dsi_host_by_node(dsi_r); + of_node_put(dsi_r); +- if (!dsi_r_host) { +- dev_err(dev, "Cannot get secondary DSI host\n"); +- return -EPROBE_DEFER; +- } ++ if (!dsi_r_host) ++ return dev_err_probe(dev, -EPROBE_DEFER, "Cannot get secondary DSI host\n"); + + nt->dsi[1] = mipi_dsi_device_register_full(dsi_r_host, info); + if (!nt->dsi[1]) { +-- +2.43.0 + diff --git a/queue-6.6/drm-panel-simple-add-missing-innolux-g121x1-l03-form.patch b/queue-6.6/drm-panel-simple-add-missing-innolux-g121x1-l03-form.patch new file mode 100644 index 00000000000..c6e95ccb553 --- /dev/null +++ b/queue-6.6/drm-panel-simple-add-missing-innolux-g121x1-l03-form.patch @@ -0,0 +1,50 @@ +From e45904446143f588785d2f98f69928df0131bf63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 11:27:36 +0100 +Subject: drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, + connector + +From: Marek Vasut + +[ Upstream commit 11ac72d033b9f577e8ba0c7a41d1c312bb232593 ] + +The .bpc = 6 implies .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG , +add the missing bus_format. Add missing connector type and bus_flags +as well. + +Documentation [1] 1.4 GENERAL SPECIFICATI0NS indicates this panel is +capable of both RGB 18bit/24bit panel, the current configuration uses +18bit mode, .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG , .bpc = 6. + +Support for the 24bit mode would require another entry in panel-simple +with .bus_format = MEDIA_BUS_FMT_RGB666_1X7X4_SPWG and .bpc = 8, which +is out of scope of this fix. + +[1] https://www.distec.de/fileadmin/pdf/produkte/TFT-Displays/Innolux/G121X1-L03_Datasheet.pdf + +Fixes: f8fa17ba812b ("drm/panel: simple: Add support for Innolux G121X1-L03") +Signed-off-by: Marek Vasut +Acked-by: Jessica Zhang +Link: https://patchwork.freedesktop.org/patch/msgid/20240328102746.17868-2-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 51f838befb321..e8d12ec8dbec1 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2407,6 +2407,9 @@ static const struct panel_desc innolux_g121x1_l03 = { + .unprepare = 200, + .disable = 400, + }, ++ .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, ++ .bus_flags = DRM_BUS_FLAG_DE_HIGH, ++ .connector_type = DRM_MODE_CONNECTOR_LVDS, + }; + + static const struct display_timing innolux_g156hce_l01_timings = { +-- +2.43.0 + diff --git a/queue-6.6/drm-rockchip-vop2-do-not-divide-height-twice-for-yuv.patch b/queue-6.6/drm-rockchip-vop2-do-not-divide-height-twice-for-yuv.patch new file mode 100644 index 00000000000..db9139bbe47 --- /dev/null +++ b/queue-6.6/drm-rockchip-vop2-do-not-divide-height-twice-for-yuv.patch @@ -0,0 +1,83 @@ +From d6138d96f4eb70384082d273af516558d7e8e1d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Apr 2024 14:27:06 -0400 +Subject: drm/rockchip: vop2: Do not divide height twice for YUV + +From: Detlev Casanova + +[ Upstream commit e80c219f52861e756181d7f88b0d341116daac2b ] + +For the cbcr format, gt2 and gt4 are computed again after src_h has been +divided by vsub. + +As src_h as already been divided by 2 before, introduce cbcr_src_h and +cbcr_src_w to keep a copy of those values to be used for cbcr gt2 and +gt4 computation. + +This fixes yuv planes being unaligned vertically when down scaling to +1080 pixels from 2160. + +Signed-off-by: Detlev Casanova +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Acked-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20240414182706.655270-1-detlev.casanova@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 22 +++++++++++--------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index c306806aa3dea..c5ec4169616de 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -609,6 +609,8 @@ static void vop2_setup_scale(struct vop2 *vop2, const struct vop2_win *win, + const struct drm_format_info *info; + u16 hor_scl_mode, ver_scl_mode; + u16 hscl_filter_mode, vscl_filter_mode; ++ uint16_t cbcr_src_w = src_w; ++ uint16_t cbcr_src_h = src_h; + u8 gt2 = 0; + u8 gt4 = 0; + u32 val; +@@ -666,27 +668,27 @@ static void vop2_setup_scale(struct vop2 *vop2, const struct vop2_win *win, + vop2_win_write(win, VOP2_WIN_YRGB_VSCL_FILTER_MODE, vscl_filter_mode); + + if (info->is_yuv) { +- src_w /= info->hsub; +- src_h /= info->vsub; ++ cbcr_src_w /= info->hsub; ++ cbcr_src_h /= info->vsub; + + gt4 = 0; + gt2 = 0; + +- if (src_h >= (4 * dst_h)) { ++ if (cbcr_src_h >= (4 * dst_h)) { + gt4 = 1; +- src_h >>= 2; +- } else if (src_h >= (2 * dst_h)) { ++ cbcr_src_h >>= 2; ++ } else if (cbcr_src_h >= (2 * dst_h)) { + gt2 = 1; +- src_h >>= 1; ++ cbcr_src_h >>= 1; + } + +- hor_scl_mode = scl_get_scl_mode(src_w, dst_w); +- ver_scl_mode = scl_get_scl_mode(src_h, dst_h); ++ hor_scl_mode = scl_get_scl_mode(cbcr_src_w, dst_w); ++ ver_scl_mode = scl_get_scl_mode(cbcr_src_h, dst_h); + +- val = vop2_scale_factor(src_w, dst_w); ++ val = vop2_scale_factor(cbcr_src_w, dst_w); + vop2_win_write(win, VOP2_WIN_SCALE_CBCR_X, val); + +- val = vop2_scale_factor(src_h, dst_h); ++ val = vop2_scale_factor(cbcr_src_h, dst_h); + vop2_win_write(win, VOP2_WIN_SCALE_CBCR_Y, val); + + vop2_win_write(win, VOP2_WIN_VSD_CBCR_GT4, gt4); +-- +2.43.0 + diff --git a/queue-6.6/drm-vc4-fix-possible-null-pointer-dereference.patch b/queue-6.6/drm-vc4-fix-possible-null-pointer-dereference.patch new file mode 100644 index 00000000000..4f5f08dbbac --- /dev/null +++ b/queue-6.6/drm-vc4-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,39 @@ +From 61368e4f2a1852d12c77752a5912e51d18c5cd52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 10:56:22 +0300 +Subject: drm: vc4: Fix possible null pointer dereference + +From: Aleksandr Mishin + +[ Upstream commit c534b63bede6cb987c2946ed4d0b0013a52c5ba7 ] + +In vc4_hdmi_audio_init() of_get_address() may return +NULL which is later dereferenced. Fix this bug by adding NULL check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bb7d78568814 ("drm/vc4: Add HDMI audio support") +Signed-off-by: Aleksandr Mishin +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240409075622.11783-1-amishin@t-argos.ru +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 4626fe9aac563..643754fa6a8ad 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -2729,6 +2729,8 @@ static int vc4_hdmi_audio_init(struct vc4_hdmi *vc4_hdmi) + index = 1; + + addr = of_get_address(dev->of_node, index, NULL, NULL); ++ if (!addr) ++ return -EINVAL; + + vc4_hdmi->audio.dma_data.addr = be32_to_cpup(addr) + mai_data->offset; + vc4_hdmi->audio.dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +-- +2.43.0 + diff --git a/queue-6.6/dt-bindings-rockchip-grf-add-missing-type-to-pcie-ph.patch b/queue-6.6/dt-bindings-rockchip-grf-add-missing-type-to-pcie-ph.patch new file mode 100644 index 00000000000..a18b791e1dc --- /dev/null +++ b/queue-6.6/dt-bindings-rockchip-grf-add-missing-type-to-pcie-ph.patch @@ -0,0 +1,37 @@ +From 043d2c96aaa95d13b939b96b397994d5561ad3d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 15:49:58 -0500 +Subject: dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node + +From: Rob Herring + +[ Upstream commit d41201c90f825f19a46afbfb502f22f612d8ccc4 ] + +'pcie-phy' is missing any type. Add 'type: object' to indicate it's a +node. + +Signed-off-by: Rob Herring +Reviewed-by: Heiko Stuebner +Acked-by: Conor Dooley +Link: https://lore.kernel.org/r/20240401204959.1698106-1-robh@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/soc/rockchip/grf.yaml | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Documentation/devicetree/bindings/soc/rockchip/grf.yaml b/Documentation/devicetree/bindings/soc/rockchip/grf.yaml +index e4fa6a07b4fa2..be6ffec2b0749 100644 +--- a/Documentation/devicetree/bindings/soc/rockchip/grf.yaml ++++ b/Documentation/devicetree/bindings/soc/rockchip/grf.yaml +@@ -163,6 +163,7 @@ allOf: + unevaluatedProperties: false + + pcie-phy: ++ type: object + description: + Documentation/devicetree/bindings/phy/rockchip-pcie-phy.txt + +-- +2.43.0 + diff --git a/queue-6.6/dt-bindings-thermal-loongson-ls2k-thermal-add-loongs.patch b/queue-6.6/dt-bindings-thermal-loongson-ls2k-thermal-add-loongs.patch new file mode 100644 index 00000000000..7fddbb73750 --- /dev/null +++ b/queue-6.6/dt-bindings-thermal-loongson-ls2k-thermal-add-loongs.patch @@ -0,0 +1,40 @@ +From 5a49a50e577304c1433b6eaad19c6c068b6cb238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 09:59:01 +0800 +Subject: dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 + compatible + +From: Binbin Zhou + +[ Upstream commit 25c7d8472f6e90390931e93f59135478af3e5d86 ] + +The thermal on the Loongson-2K0500 shares the design with the +Loongson-2K1000. Define corresponding compatible string, having the +loongson,ls2k1000-thermal as a fallback. + +Signed-off-by: Binbin Zhou +Acked-by: Rob Herring +Acked-by: Huacai Chen +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/26524a63abd2d032e4c45efe6ce3fedb46841768.1713837379.git.zhoubinbin@loongson.cn +Stable-dep-of: c8c435368577 ("dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible definition") +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/thermal/loongson,ls2k-thermal.yaml | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml b/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml +index b634f57cd011d..9748a479dcd4d 100644 +--- a/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml ++++ b/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml +@@ -20,6 +20,7 @@ properties: + - loongson,ls2k1000-thermal + - items: + - enum: ++ - loongson,ls2k0500-thermal + - loongson,ls2k2000-thermal + - const: loongson,ls2k1000-thermal + +-- +2.43.0 + diff --git a/queue-6.6/dt-bindings-thermal-loongson-ls2k-thermal-fix-bindin.patch b/queue-6.6/dt-bindings-thermal-loongson-ls2k-thermal-fix-bindin.patch new file mode 100644 index 00000000000..2334f1db46c --- /dev/null +++ b/queue-6.6/dt-bindings-thermal-loongson-ls2k-thermal-fix-bindin.patch @@ -0,0 +1,70 @@ +From fcfe9f5c5f105a377b19ae38de726d6960622e16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 17:57:44 +0800 +Subject: dt-bindings: thermal: loongson,ls2k-thermal: Fix binding check issues + +From: Binbin Zhou + +[ Upstream commit 88071e31e994ee23356674e0c5461b25e2a95cdc ] + +Add the missing 'thermal-sensor-cells' property which is required for +every thermal sensor as it's used when using phandles. +And add the thermal-sensor.yaml reference. + +In fact, it was a careless mistake when submitting the driver that +caused it to not work properly. So the fix is necessary, although it +will result in the ABI break. + +Fixes: 72684d99a854 ("thermal: dt-bindings: add loongson-2 thermal") +Cc: Yinbo Zhu +Signed-off-by: Binbin Zhou +Reviewed-by: Conor Dooley +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/6d69362632271ab0af9a5fbfa3bc46a0894f1d54.1700817227.git.zhoubinbin@loongson.cn +Stable-dep-of: c8c435368577 ("dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible definition") +Signed-off-by: Sasha Levin +--- + .../bindings/thermal/loongson,ls2k-thermal.yaml | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml b/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml +index 7538469997f9e..b634f57cd011d 100644 +--- a/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml ++++ b/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml +@@ -10,6 +10,9 @@ maintainers: + - zhanghongchen + - Yinbo Zhu + ++allOf: ++ - $ref: /schemas/thermal/thermal-sensor.yaml# ++ + properties: + compatible: + oneOf: +@@ -26,12 +29,16 @@ properties: + interrupts: + maxItems: 1 + ++ '#thermal-sensor-cells': ++ const: 1 ++ + required: + - compatible + - reg + - interrupts ++ - '#thermal-sensor-cells' + +-additionalProperties: false ++unevaluatedProperties: false + + examples: + - | +@@ -41,4 +48,5 @@ examples: + reg = <0x1fe01500 0x30>; + interrupt-parent = <&liointc0>; + interrupts = <7 IRQ_TYPE_LEVEL_LOW>; ++ #thermal-sensor-cells = <1>; + }; +-- +2.43.0 + diff --git a/queue-6.6/dt-bindings-thermal-loongson-ls2k-thermal-fix-incorr.patch b/queue-6.6/dt-bindings-thermal-loongson-ls2k-thermal-fix-incorr.patch new file mode 100644 index 00000000000..6fb50a590a3 --- /dev/null +++ b/queue-6.6/dt-bindings-thermal-loongson-ls2k-thermal-fix-incorr.patch @@ -0,0 +1,83 @@ +From 434e488c3e4ced7138601b8915d6c5261fa1884e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 09:59:02 +0800 +Subject: dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible + definition + +From: Binbin Zhou + +[ Upstream commit c8c4353685778e75e186103411e9d01a4a3f2b90 ] + +The temperature output register of the Loongson-2K2000 is defined in the +chip configuration domain, which is different from the Loongson-2K1000, +so it can't be fallbacked. + +We need to use two groups of registers to describe it: the first group +is the high and low temperature threshold setting register; the second +group is the temperature output register. + +It is true that this fix will cause ABI corruption, but it is necessary +otherwise the Loongson-2K2000 temperature sensor will not work properly. + +Fixes: 72684d99a854 ("thermal: dt-bindings: add loongson-2 thermal") +Cc: Yinbo Zhu +Signed-off-by: Binbin Zhou +Reviewed-by: Krzysztof Kozlowski +Acked-by: Huacai Chen +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/5198999d679f1a1c3457385acb9fadfc85da1f1e.1713837379.git.zhoubinbin@loongson.cn +Signed-off-by: Sasha Levin +--- + .../thermal/loongson,ls2k-thermal.yaml | 23 +++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml b/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml +index 9748a479dcd4d..ca81c8afba79c 100644 +--- a/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml ++++ b/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml +@@ -18,14 +18,15 @@ properties: + oneOf: + - enum: + - loongson,ls2k1000-thermal ++ - loongson,ls2k2000-thermal + - items: + - enum: + - loongson,ls2k0500-thermal +- - loongson,ls2k2000-thermal + - const: loongson,ls2k1000-thermal + + reg: +- maxItems: 1 ++ minItems: 1 ++ maxItems: 2 + + interrupts: + maxItems: 1 +@@ -39,6 +40,24 @@ required: + - interrupts + - '#thermal-sensor-cells' + ++if: ++ properties: ++ compatible: ++ contains: ++ enum: ++ - loongson,ls2k2000-thermal ++ ++then: ++ properties: ++ reg: ++ minItems: 2 ++ maxItems: 2 ++ ++else: ++ properties: ++ reg: ++ maxItems: 1 ++ + unevaluatedProperties: false + + examples: +-- +2.43.0 + diff --git a/queue-6.6/ecryptfs-fix-buffer-size-for-tag-66-packet.patch b/queue-6.6/ecryptfs-fix-buffer-size-for-tag-66-packet.patch new file mode 100644 index 00000000000..0f91b9d0455 --- /dev/null +++ b/queue-6.6/ecryptfs-fix-buffer-size-for-tag-66-packet.patch @@ -0,0 +1,116 @@ +From ede85e270a129307dff40879792d1d556e17be09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Mar 2024 07:46:00 -0700 +Subject: ecryptfs: Fix buffer size for tag 66 packet + +From: Brian Kubisiak + +[ Upstream commit 85a6a1aff08ec9f5b929d345d066e2830e8818e5 ] + +The 'TAG 66 Packet Format' description is missing the cipher code and +checksum fields that are packed into the message packet. As a result, +the buffer allocated for the packet is 3 bytes too small and +write_tag_66_packet() will write up to 3 bytes past the end of the +buffer. + +Fix this by increasing the size of the allocation so the whole packet +will always fit in the buffer. + +This fixes the below kasan slab-out-of-bounds bug: + + BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0 + Write of size 1 at addr ffff88800afbb2a5 by task touch/181 + + CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014 + Call Trace: + + dump_stack_lvl+0x4c/0x70 + print_report+0xc5/0x610 + ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 + ? kasan_complete_mode_report_info+0x44/0x210 + ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 + kasan_report+0xc2/0x110 + ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 + __asan_store1+0x62/0x80 + ecryptfs_generate_key_packet_set+0x7d6/0xde0 + ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10 + ? __alloc_pages+0x2e2/0x540 + ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d] + ? dentry_open+0x8f/0xd0 + ecryptfs_write_metadata+0x30a/0x550 + ? __pfx_ecryptfs_write_metadata+0x10/0x10 + ? ecryptfs_get_lower_file+0x6b/0x190 + ecryptfs_initialize_file+0x77/0x150 + ecryptfs_create+0x1c2/0x2f0 + path_openat+0x17cf/0x1ba0 + ? __pfx_path_openat+0x10/0x10 + do_filp_open+0x15e/0x290 + ? __pfx_do_filp_open+0x10/0x10 + ? __kasan_check_write+0x18/0x30 + ? _raw_spin_lock+0x86/0xf0 + ? __pfx__raw_spin_lock+0x10/0x10 + ? __kasan_check_write+0x18/0x30 + ? alloc_fd+0xf4/0x330 + do_sys_openat2+0x122/0x160 + ? __pfx_do_sys_openat2+0x10/0x10 + __x64_sys_openat+0xef/0x170 + ? __pfx___x64_sys_openat+0x10/0x10 + do_syscall_64+0x60/0xd0 + entry_SYSCALL_64_after_hwframe+0x6e/0xd8 + RIP: 0033:0x7f00a703fd67 + Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f + RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 + RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67 + RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c + RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000 + R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941 + R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040 + + + Allocated by task 181: + kasan_save_stack+0x2f/0x60 + kasan_set_track+0x29/0x40 + kasan_save_alloc_info+0x25/0x40 + __kasan_kmalloc+0xc5/0xd0 + __kmalloc+0x66/0x160 + ecryptfs_generate_key_packet_set+0x6d2/0xde0 + ecryptfs_write_metadata+0x30a/0x550 + ecryptfs_initialize_file+0x77/0x150 + ecryptfs_create+0x1c2/0x2f0 + path_openat+0x17cf/0x1ba0 + do_filp_open+0x15e/0x290 + do_sys_openat2+0x122/0x160 + __x64_sys_openat+0xef/0x170 + do_syscall_64+0x60/0xd0 + entry_SYSCALL_64_after_hwframe+0x6e/0xd8 + +Fixes: dddfa461fc89 ("[PATCH] eCryptfs: Public key; packet management") +Signed-off-by: Brian Kubisiak +Link: https://lore.kernel.org/r/5j2q56p6qkhezva6b2yuqfrsurmvrrqtxxzrnp3wqu7xrz22i7@hoecdztoplbl +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/ecryptfs/keystore.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c +index 3fe41964c0d8d..7f9f68c00ef63 100644 +--- a/fs/ecryptfs/keystore.c ++++ b/fs/ecryptfs/keystore.c +@@ -300,9 +300,11 @@ write_tag_66_packet(char *signature, u8 cipher_code, + * | Key Identifier Size | 1 or 2 bytes | + * | Key Identifier | arbitrary | + * | File Encryption Key Size | 1 or 2 bytes | ++ * | Cipher Code | 1 byte | + * | File Encryption Key | arbitrary | ++ * | Checksum | 2 bytes | + */ +- data_len = (5 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size); ++ data_len = (8 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size); + *packet = kmalloc(data_len, GFP_KERNEL); + message = *packet; + if (!message) { +-- +2.43.0 + diff --git a/queue-6.6/enetc-avoid-truncating-error-message.patch b/queue-6.6/enetc-avoid-truncating-error-message.patch new file mode 100644 index 00000000000..2052fb43f1b --- /dev/null +++ b/queue-6.6/enetc-avoid-truncating-error-message.patch @@ -0,0 +1,41 @@ +From dc128adbaa0caf58e249e544caac5157619e818d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 23:38:01 +0100 +Subject: enetc: avoid truncating error message + +From: Arnd Bergmann + +[ Upstream commit 9046d581ed586f3c715357638ca12c0e84402002 ] + +As clang points out, the error message in enetc_setup_xdp_prog() +still does not fit in the buffer and will be truncated: + +drivers/net/ethernet/freescale/enetc/enetc.c:2771:3: error: 'snprintf' will always be truncated; specified size is 80, but format string expands to at least 87 [-Werror,-Wformat-truncation] + +Replace it with an even shorter message that should fit. + +Fixes: f968c56417f0 ("net: enetc: shorten enetc_setup_xdp_prog() error message to fit NETLINK_MAX_FMTMSG_LEN") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240326223825.4084412-3-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c +index b92e3aa7cd041..0f5a4ec505ddb 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc.c +@@ -2769,7 +2769,7 @@ static int enetc_setup_xdp_prog(struct net_device *ndev, struct bpf_prog *prog, + if (priv->min_num_stack_tx_queues + num_xdp_tx_queues > + priv->num_tx_rings) { + NL_SET_ERR_MSG_FMT_MOD(extack, +- "Reserving %d XDP TXQs does not leave a minimum of %d for stack (total %d)", ++ "Reserving %d XDP TXQs leaves under %d for stack (total %d)", + num_xdp_tx_queues, + priv->min_num_stack_tx_queues, + priv->num_tx_rings); +-- +2.43.0 + diff --git a/queue-6.6/epoll-be-better-about-file-lifetimes.patch b/queue-6.6/epoll-be-better-about-file-lifetimes.patch new file mode 100644 index 00000000000..6d086d40db4 --- /dev/null +++ b/queue-6.6/epoll-be-better-about-file-lifetimes.patch @@ -0,0 +1,94 @@ +From d7121b2023956a919cf517a6a5f4ca54fa002c05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 13:36:09 -0700 +Subject: epoll: be better about file lifetimes + +From: Linus Torvalds + +[ Upstream commit 4efaa5acf0a1d2b5947f98abb3acf8bfd966422b ] + +epoll can call out to vfs_poll() with a file pointer that may race with +the last 'fput()'. That would make f_count go down to zero, and while +the ep->mtx locking means that the resulting file pointer tear-down will +be blocked until the poll returns, it means that f_count is already +dead, and any use of it won't actually get a reference to the file any +more: it's dead regardless. + +Make sure we have a valid ref on the file pointer before we call down to +vfs_poll() from the epoll routines. + +Link: https://lore.kernel.org/lkml/0000000000002d631f0615918f1e@google.com/ +Reported-by: syzbot+045b454ab35fd82a35fb@syzkaller.appspotmail.com +Reviewed-by: Jens Axboe +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/eventpoll.c | 38 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 37 insertions(+), 1 deletion(-) + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 1d9a71a0c4c16..0ed73bc7d4652 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -876,6 +876,34 @@ static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int dep + return res; + } + ++/* ++ * The ffd.file pointer may be in the process of being torn down due to ++ * being closed, but we may not have finished eventpoll_release() yet. ++ * ++ * Normally, even with the atomic_long_inc_not_zero, the file may have ++ * been free'd and then gotten re-allocated to something else (since ++ * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). ++ * ++ * But for epoll, users hold the ep->mtx mutex, and as such any file in ++ * the process of being free'd will block in eventpoll_release_file() ++ * and thus the underlying file allocation will not be free'd, and the ++ * file re-use cannot happen. ++ * ++ * For the same reason we can avoid a rcu_read_lock() around the ++ * operation - 'ffd.file' cannot go away even if the refcount has ++ * reached zero (but we must still not call out to ->poll() functions ++ * etc). ++ */ ++static struct file *epi_fget(const struct epitem *epi) ++{ ++ struct file *file; ++ ++ file = epi->ffd.file; ++ if (!atomic_long_inc_not_zero(&file->f_count)) ++ file = NULL; ++ return file; ++} ++ + /* + * Differs from ep_eventpoll_poll() in that internal callers already have + * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested() +@@ -884,14 +912,22 @@ static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int dep + static __poll_t ep_item_poll(const struct epitem *epi, poll_table *pt, + int depth) + { +- struct file *file = epi->ffd.file; ++ struct file *file = epi_fget(epi); + __poll_t res; + ++ /* ++ * We could return EPOLLERR | EPOLLHUP or something, but let's ++ * treat this more as "file doesn't exist, poll didn't happen". ++ */ ++ if (!file) ++ return 0; ++ + pt->_key = epi->event.events; + if (!is_file_epoll(file)) + res = vfs_poll(file, pt); + else + res = __ep_eventpoll_poll(file, pt, depth); ++ fput(file); + return res & epi->event.events; + } + +-- +2.43.0 + diff --git a/queue-6.6/eth-sungem-remove-.ndo_poll_controller-to-avoid-dead.patch b/queue-6.6/eth-sungem-remove-.ndo_poll_controller-to-avoid-dead.patch new file mode 100644 index 00000000000..86a95b10a0c --- /dev/null +++ b/queue-6.6/eth-sungem-remove-.ndo_poll_controller-to-avoid-dead.patch @@ -0,0 +1,67 @@ +From 4dce52a07d5af70865b617ca63284c2a24e26a2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 06:45:04 -0700 +Subject: eth: sungem: remove .ndo_poll_controller to avoid deadlocks + +From: Jakub Kicinski + +[ Upstream commit ac0a230f719b02432d8c7eba7615ebd691da86f4 ] + +Erhard reports netpoll warnings from sungem: + + netpoll_send_skb_on_dev(): eth0 enabled interrupts in poll (gem_start_xmit+0x0/0x398) + WARNING: CPU: 1 PID: 1 at net/core/netpoll.c:370 netpoll_send_skb+0x1fc/0x20c + +gem_poll_controller() disables interrupts, which may sleep. +We can't sleep in netpoll, it has interrupts disabled completely. +Strangely, gem_poll_controller() doesn't even poll the completions, +and instead acts as if an interrupt has fired so it just schedules +NAPI and exits. None of this has been necessary for years, since +netpoll invokes NAPI directly. + +Fixes: fe09bb619096 ("sungem: Spring cleaning and GRO support") +Reported-and-tested-by: Erhard Furtner +Link: https://lore.kernel.org/all/20240428125306.2c3080ef@legion +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240508134504.3560956-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sun/sungem.c | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c +index 9bd1df8308d24..d3a2fbb14140e 100644 +--- a/drivers/net/ethernet/sun/sungem.c ++++ b/drivers/net/ethernet/sun/sungem.c +@@ -949,17 +949,6 @@ static irqreturn_t gem_interrupt(int irq, void *dev_id) + return IRQ_HANDLED; + } + +-#ifdef CONFIG_NET_POLL_CONTROLLER +-static void gem_poll_controller(struct net_device *dev) +-{ +- struct gem *gp = netdev_priv(dev); +- +- disable_irq(gp->pdev->irq); +- gem_interrupt(gp->pdev->irq, dev); +- enable_irq(gp->pdev->irq); +-} +-#endif +- + static void gem_tx_timeout(struct net_device *dev, unsigned int txqueue) + { + struct gem *gp = netdev_priv(dev); +@@ -2839,9 +2828,6 @@ static const struct net_device_ops gem_netdev_ops = { + .ndo_change_mtu = gem_change_mtu, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_mac_address = gem_set_mac_address, +-#ifdef CONFIG_NET_POLL_CONTROLLER +- .ndo_poll_controller = gem_poll_controller, +-#endif + }; + + static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) +-- +2.43.0 + diff --git a/queue-6.6/ext4-avoid-excessive-credit-estimate-in-ext4_tmpfile.patch b/queue-6.6/ext4-avoid-excessive-credit-estimate-in-ext4_tmpfile.patch new file mode 100644 index 00000000000..e5adaff31b1 --- /dev/null +++ b/queue-6.6/ext4-avoid-excessive-credit-estimate-in-ext4_tmpfile.patch @@ -0,0 +1,52 @@ +From cb839779568509b327edb9a80e953450137ac909 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 12:53:20 +0100 +Subject: ext4: avoid excessive credit estimate in ext4_tmpfile() + +From: Jan Kara + +[ Upstream commit 35a1f12f0ca857fee1d7a04ef52cbd5f1f84de13 ] + +A user with minimum journal size (1024 blocks these days) complained +about the following error triggered by generic/697 test in +ext4_tmpfile(): + +run fstests generic/697 at 2024-02-28 05:34:46 +JBD2: vfstest wants too many credits credits:260 rsv_credits:0 max:256 +EXT4-fs error (device loop0) in __ext4_new_inode:1083: error 28 + +Indeed the credit estimate in ext4_tmpfile() is huge. +EXT4_MAXQUOTAS_INIT_BLOCKS() is 219, then 10 credits from ext4_tmpfile() +itself and then ext4_xattr_credits_for_new_inode() adds more credits +needed for security attributes and ACLs. Now the +EXT4_MAXQUOTAS_INIT_BLOCKS() is in fact unnecessary because we've +already initialized quotas with dquot_init() shortly before and so +EXT4_MAXQUOTAS_TRANS_BLOCKS() is enough (which boils down to 3 credits). + +Fixes: af51a2ac36d1 ("ext4: ->tmpfile() support") +Signed-off-by: Jan Kara +Tested-by: Luis Henriques +Tested-by: Disha Goel +Link: https://lore.kernel.org/r/20240307115320.28949-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/namei.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index bbda587f76b85..a2ee882e5ebb0 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2901,7 +2901,7 @@ static int ext4_tmpfile(struct mnt_idmap *idmap, struct inode *dir, + inode = ext4_new_inode_start_handle(idmap, dir, mode, + NULL, 0, NULL, + EXT4_HT_DIR, +- EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) + ++ EXT4_MAXQUOTAS_TRANS_BLOCKS(dir->i_sb) + + 4 + EXT4_XATTR_TRANS_BLOCKS); + handle = ext4_journal_current_handle(); + err = PTR_ERR(inode); +-- +2.43.0 + diff --git a/queue-6.6/ext4-fix-potential-unnitialized-variable.patch b/queue-6.6/ext4-fix-potential-unnitialized-variable.patch new file mode 100644 index 00000000000..ceeb4b8c885 --- /dev/null +++ b/queue-6.6/ext4-fix-potential-unnitialized-variable.patch @@ -0,0 +1,40 @@ +From 6629f1d3185298bdcb907bf3d04917a0ef9eff8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 21:10:40 +0300 +Subject: ext4: fix potential unnitialized variable + +From: Dan Carpenter + +[ Upstream commit 3f4830abd236d0428e50451e1ecb62e14c365e9b ] + +Smatch complains "err" can be uninitialized in the caller. + + fs/ext4/indirect.c:349 ext4_alloc_branch() + error: uninitialized symbol 'err'. + +Set the error to zero on the success path. + +Fixes: 8016e29f4362 ("ext4: fast commit recovery path") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/363a4673-0fb8-4adf-b4fb-90a499077276@moroto.mountain +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index a8a3ea2fd690f..aadfeb0f5b7f3 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -6144,6 +6144,7 @@ ext4_mb_new_blocks_simple(struct ext4_allocation_request *ar, int *errp) + ext4_mb_mark_bb(sb, block, 1, 1); + ar->len = 1; + ++ *errp = 0; + return block; + } + +-- +2.43.0 + diff --git a/queue-6.6/ext4-remove-the-redundant-folio_wait_stable.patch b/queue-6.6/ext4-remove-the-redundant-folio_wait_stable.patch new file mode 100644 index 00000000000..111d7be0cf7 --- /dev/null +++ b/queue-6.6/ext4-remove-the-redundant-folio_wait_stable.patch @@ -0,0 +1,42 @@ +From 277e71d139887f7cd06e2bd963b9eacacb809a90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 10:30:05 +0800 +Subject: ext4: remove the redundant folio_wait_stable() + +From: Zhang Yi + +[ Upstream commit df0b5afc62f3368d657a8fe4a8d393ac481474c2 ] + +__filemap_get_folio() with FGP_WRITEBEGIN parameter has already wait +for stable folio, so remove the redundant folio_wait_stable() in +ext4_da_write_begin(), it was left over from the commit cc883236b792 +("ext4: drop unnecessary journal handle in delalloc write") that +removed the retry getting page logic. + +Fixes: cc883236b792 ("ext4: drop unnecessary journal handle in delalloc write") +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240419023005.2719050-1-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/inode.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index d7732320431ac..abb49f6c6ff45 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -2895,9 +2895,6 @@ static int ext4_da_write_begin(struct file *file, struct address_space *mapping, + if (IS_ERR(folio)) + return PTR_ERR(folio); + +- /* In case writeback began while the folio was unlocked */ +- folio_wait_stable(folio); +- + #ifdef CONFIG_FS_ENCRYPTION + ret = ext4_block_write_begin(folio, pos, len, ext4_da_get_block_prep); + #else +-- +2.43.0 + diff --git a/queue-6.6/fbdev-provide-i-o-memory-helpers-as-module.patch b/queue-6.6/fbdev-provide-i-o-memory-helpers-as-module.patch new file mode 100644 index 00000000000..84a6c083f2d --- /dev/null +++ b/queue-6.6/fbdev-provide-i-o-memory-helpers-as-module.patch @@ -0,0 +1,90 @@ +From 99212bfb9dab61754666951b276b9e1759654f4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Sep 2023 09:26:34 +0200 +Subject: fbdev: Provide I/O-memory helpers as module + +From: Thomas Zimmermann + +[ Upstream commit 6b180f66c0dd6266eeb2f74b59ee79a9f14fe430 ] + +Provide helpers for accessing I/O memory in a helper module. The fbdev +core uses these helpers, so select the module unconditionally for fbdev. +Drivers will later be able to select the module individually and the +helpers will become optional. + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20230927074722.6197-2-tzimmermann@suse.de +Stable-dep-of: 01c0cce88c54 ("drm/omapdrm: Fix console with deferred ops") +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/Kconfig | 6 ++++++ + drivers/video/fbdev/core/Makefile | 3 ++- + drivers/video/fbdev/core/fb_io_fops.c | 3 +++ + 3 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/core/Kconfig b/drivers/video/fbdev/core/Kconfig +index 5ac1b06375311..56f721ebcff05 100644 +--- a/drivers/video/fbdev/core/Kconfig ++++ b/drivers/video/fbdev/core/Kconfig +@@ -4,6 +4,7 @@ + # + + config FB_CORE ++ select FB_IOMEM_FOPS + select VIDEO_CMDLINE + tristate + +@@ -144,12 +145,17 @@ config FB_DMAMEM_HELPERS + select FB_SYS_FOPS + select FB_SYS_IMAGEBLIT + ++config FB_IOMEM_FOPS ++ tristate ++ depends on FB_CORE ++ + config FB_IOMEM_HELPERS + bool + depends on FB_CORE + select FB_CFB_COPYAREA + select FB_CFB_FILLRECT + select FB_CFB_IMAGEBLIT ++ select FB_IOMEM_FOPS + + config FB_SYSMEM_HELPERS + bool +diff --git a/drivers/video/fbdev/core/Makefile b/drivers/video/fbdev/core/Makefile +index edfde2948e5c8..d165055ec3fc5 100644 +--- a/drivers/video/fbdev/core/Makefile ++++ b/drivers/video/fbdev/core/Makefile +@@ -3,7 +3,7 @@ obj-$(CONFIG_FB_NOTIFY) += fb_notify.o + obj-$(CONFIG_FB_CORE) += fb.o + fb-y := fb_info.o \ + fbmem.o fbcmap.o \ +- modedb.o fbcvt.o fb_cmdline.o fb_io_fops.o ++ modedb.o fbcvt.o fb_cmdline.o + ifdef CONFIG_FB + fb-y += fb_backlight.o fbmon.o + endif +@@ -26,6 +26,7 @@ endif + obj-$(CONFIG_FB_CFB_FILLRECT) += cfbfillrect.o + obj-$(CONFIG_FB_CFB_COPYAREA) += cfbcopyarea.o + obj-$(CONFIG_FB_CFB_IMAGEBLIT) += cfbimgblt.o ++obj-$(CONFIG_FB_IOMEM_FOPS) += fb_io_fops.o + obj-$(CONFIG_FB_SYS_FILLRECT) += sysfillrect.o + obj-$(CONFIG_FB_SYS_COPYAREA) += syscopyarea.o + obj-$(CONFIG_FB_SYS_IMAGEBLIT) += sysimgblt.o +diff --git a/drivers/video/fbdev/core/fb_io_fops.c b/drivers/video/fbdev/core/fb_io_fops.c +index 5985e5e1b040c..871b829521af3 100644 +--- a/drivers/video/fbdev/core/fb_io_fops.c ++++ b/drivers/video/fbdev/core/fb_io_fops.c +@@ -131,3 +131,6 @@ ssize_t fb_io_write(struct fb_info *info, const char __user *buf, size_t count, + return (cnt) ? cnt : err; + } + EXPORT_SYMBOL(fb_io_write); ++ ++MODULE_DESCRIPTION("Fbdev helpers for framebuffers in I/O memory"); ++MODULE_LICENSE("GPL"); +-- +2.43.0 + diff --git a/queue-6.6/fbdev-sh7760fb-allow-modular-build.patch b/queue-6.6/fbdev-sh7760fb-allow-modular-build.patch new file mode 100644 index 00000000000..fbd395eb564 --- /dev/null +++ b/queue-6.6/fbdev-sh7760fb-allow-modular-build.patch @@ -0,0 +1,50 @@ +From e1345e6e3a5cd545ab22bbc07f8afe1979e2d15e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 21:39:38 -0800 +Subject: fbdev: sh7760fb: allow modular build + +From: Randy Dunlap + +[ Upstream commit 51084f89d687e14d96278241e5200cde4b0985c7 ] + +There is no reason to prohibit sh7760fb from being built as a +loadable module as suggested by Geert, so change the config symbol +from bool to tristate to allow that and change the FB dependency as +needed. + +Fixes: f75f71b2c418 ("fbdev/sh7760fb: Depend on FB=y") +Suggested-by: Geert Uytterhoeven +Signed-off-by: Randy Dunlap +Cc: Thomas Zimmermann +Cc: Javier Martinez Canillas +Cc: John Paul Adrian Glaubitz +Cc: Sam Ravnborg +Cc: Helge Deller +Cc: linux-fbdev@vger.kernel.org +Cc: dri-devel@lists.freedesktop.org +Acked-by: John Paul Adrian Glaubitz +Acked-by: Javier Martinez Canillas +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig +index c29754b65c0ec..325298573e120 100644 +--- a/drivers/video/fbdev/Kconfig ++++ b/drivers/video/fbdev/Kconfig +@@ -1761,8 +1761,8 @@ config FB_COBALT + depends on FB && MIPS_COBALT + + config FB_SH7760 +- bool "SH7760/SH7763/SH7720/SH7721 LCDC support" +- depends on FB=y && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \ ++ tristate "SH7760/SH7763/SH7720/SH7721 LCDC support" ++ depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \ + || CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721) + select FB_IOMEM_HELPERS + help +-- +2.43.0 + diff --git a/queue-6.6/fbdev-shmobile-fix-snprintf-truncation.patch b/queue-6.6/fbdev-shmobile-fix-snprintf-truncation.patch new file mode 100644 index 00000000000..be8166610a5 --- /dev/null +++ b/queue-6.6/fbdev-shmobile-fix-snprintf-truncation.patch @@ -0,0 +1,40 @@ +From c4d6afa0f3f5157ddbc0d15b3c38dfbb99d8a2a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 23:38:00 +0100 +Subject: fbdev: shmobile: fix snprintf truncation + +From: Arnd Bergmann + +[ Upstream commit 26c8cfb9d1e4b252336d23dd5127a8cbed414a32 ] + +The name of the overlay does not fit into the fixed-length field: + +drivers/video/fbdev/sh_mobile_lcdcfb.c:1577:2: error: 'snprintf' will always be truncated; specified size is 16, but format string expands to at least 25 + +Make it short enough by changing the string. + +Fixes: c5deac3c9b22 ("fbdev: sh_mobile_lcdc: Implement overlays support") +Signed-off-by: Arnd Bergmann +Reviewed-by: Laurent Pinchart +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sh_mobile_lcdcfb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c +index 1364dafaadb1d..2a4794ec19473 100644 +--- a/drivers/video/fbdev/sh_mobile_lcdcfb.c ++++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c +@@ -1575,7 +1575,7 @@ sh_mobile_lcdc_overlay_fb_init(struct sh_mobile_lcdc_overlay *ovl) + */ + info->fix = sh_mobile_lcdc_overlay_fix; + snprintf(info->fix.id, sizeof(info->fix.id), +- "SH Mobile LCDC Overlay %u", ovl->index); ++ "SHMobile ovl %u", ovl->index); + info->fix.smem_start = ovl->dma_handle; + info->fix.smem_len = ovl->fb_size; + info->fix.line_length = ovl->pitch; +-- +2.43.0 + diff --git a/queue-6.6/fbdev-sisfb-hide-unused-variables.patch b/queue-6.6/fbdev-sisfb-hide-unused-variables.patch new file mode 100644 index 00000000000..b97f630d99e --- /dev/null +++ b/queue-6.6/fbdev-sisfb-hide-unused-variables.patch @@ -0,0 +1,68 @@ +From b57ee8c0f83a6254b146bd93e6da39ae47f46b69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 10:06:31 +0200 +Subject: fbdev: sisfb: hide unused variables + +From: Arnd Bergmann + +[ Upstream commit 688cf598665851b9e8cb5083ff1d208ce43d10ff ] + +Building with W=1 shows that a couple of variables in this driver are only +used in certain configurations: + +drivers/video/fbdev/sis/init301.c:239:28: error: 'SiS_Part2CLVX_6' defined but not used [-Werror=unused-const-variable=] + 239 | static const unsigned char SiS_Part2CLVX_6[] = { /* 1080i */ + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:230:28: error: 'SiS_Part2CLVX_5' defined but not used [-Werror=unused-const-variable=] + 230 | static const unsigned char SiS_Part2CLVX_5[] = { /* 750p */ + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:211:28: error: 'SiS_Part2CLVX_4' defined but not used [-Werror=unused-const-variable=] + 211 | static const unsigned char SiS_Part2CLVX_4[] = { /* PAL */ + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:192:28: error: 'SiS_Part2CLVX_3' defined but not used [-Werror=unused-const-variable=] + 192 | static const unsigned char SiS_Part2CLVX_3[] = { /* NTSC, 525i, 525p */ + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:184:28: error: 'SiS_Part2CLVX_2' defined but not used [-Werror=unused-const-variable=] + 184 | static const unsigned char SiS_Part2CLVX_2[] = { + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:176:28: error: 'SiS_Part2CLVX_1' defined but not used [-Werror=unused-const-variable=] + 176 | static const unsigned char SiS_Part2CLVX_1[] = { + | ^~~~~~~~~~~~~~~ + +This started showing up after the definitions were moved into the +source file from the header, which was not flagged by the compiler. +Move the definition into the appropriate #ifdef block that already +exists next to them. + +Fixes: 5908986ef348 ("video: fbdev: sis: avoid mismatched prototypes") +Signed-off-by: Arnd Bergmann +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sis/init301.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/sis/init301.c b/drivers/video/fbdev/sis/init301.c +index a8fb41f1a2580..09329072004f4 100644 +--- a/drivers/video/fbdev/sis/init301.c ++++ b/drivers/video/fbdev/sis/init301.c +@@ -172,7 +172,7 @@ static const unsigned char SiS_HiTVGroup3_2[] = { + }; + + /* 301C / 302ELV extended Part2 TV registers (4 tap scaler) */ +- ++#ifdef CONFIG_FB_SIS_315 + static const unsigned char SiS_Part2CLVX_1[] = { + 0x00,0x00, + 0x00,0x20,0x00,0x00,0x7F,0x20,0x02,0x7F,0x7D,0x20,0x04,0x7F,0x7D,0x1F,0x06,0x7E, +@@ -245,7 +245,6 @@ static const unsigned char SiS_Part2CLVX_6[] = { /* 1080i */ + 0xFF,0xFF, + }; + +-#ifdef CONFIG_FB_SIS_315 + /* 661 et al LCD data structure (2.03.00) */ + static const unsigned char SiS_LCDStruct661[] = { + /* 1024x768 */ +-- +2.43.0 + diff --git a/queue-6.6/firmware-qcom-scm-fix-__scm-and-waitq-completion-var.patch b/queue-6.6/firmware-qcom-scm-fix-__scm-and-waitq-completion-var.patch new file mode 100644 index 00000000000..ba43b0486a0 --- /dev/null +++ b/queue-6.6/firmware-qcom-scm-fix-__scm-and-waitq-completion-var.patch @@ -0,0 +1,70 @@ +From 39c305c8fc24ea1c3f1fce1ca2e8c1e1ab2336c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 20:54:02 +0530 +Subject: firmware: qcom: scm: Fix __scm and waitq completion variable + initialization + +From: Mukesh Ojha + +[ Upstream commit 2e4955167ec5c04534cebea9e8273a907e7a75e1 ] + +It is possible qcom_scm_is_available() gives wrong indication that +if __scm is initialized while __scm->dev is not and similar issue +is also possible with __scm->waitq_comp. + +Fix this appropriately by the use of release barrier and read barrier +that will make sure if __scm is initialized so, is all of its field +variable. + +Fixes: d0f6fa7ba2d6 ("firmware: qcom: scm: Convert SCM to platform driver") +Fixes: 6bf325992236 ("firmware: qcom: scm: Add wait-queue handling logic") +Signed-off-by: Mukesh Ojha +Link: https://lore.kernel.org/r/1711034642-22860-4-git-send-email-quic_mojha@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index 69831f1d91e3f..ff7c155239e31 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -1333,7 +1333,7 @@ static int qcom_scm_find_dload_address(struct device *dev, u64 *addr) + */ + bool qcom_scm_is_available(void) + { +- return !!__scm; ++ return !!READ_ONCE(__scm); + } + EXPORT_SYMBOL_GPL(qcom_scm_is_available); + +@@ -1414,10 +1414,12 @@ static int qcom_scm_probe(struct platform_device *pdev) + if (!scm) + return -ENOMEM; + ++ scm->dev = &pdev->dev; + ret = qcom_scm_find_dload_address(&pdev->dev, &scm->dload_mode_addr); + if (ret < 0) + return ret; + ++ init_completion(&scm->waitq_comp); + mutex_init(&scm->scm_bw_lock); + + scm->path = devm_of_icc_get(&pdev->dev, NULL); +@@ -1449,10 +1451,8 @@ static int qcom_scm_probe(struct platform_device *pdev) + if (ret) + return ret; + +- __scm = scm; +- __scm->dev = &pdev->dev; +- +- init_completion(&__scm->waitq_comp); ++ /* Let all above stores be available after this */ ++ smp_store_release(&__scm, scm); + + irq = platform_get_irq_optional(pdev, 0); + if (irq < 0) { +-- +2.43.0 + diff --git a/queue-6.6/firmware-raspberrypi-use-correct-device-for-dma-mapp.patch b/queue-6.6/firmware-raspberrypi-use-correct-device-for-dma-mapp.patch new file mode 100644 index 00000000000..fc3c1a27491 --- /dev/null +++ b/queue-6.6/firmware-raspberrypi-use-correct-device-for-dma-mapp.patch @@ -0,0 +1,65 @@ +From e68c819ea64c8843ef1cc8aa77653c4e2a082fce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 21:58:06 +0200 +Subject: firmware: raspberrypi: Use correct device for DMA mappings + +From: Laurent Pinchart + +[ Upstream commit df518a0ae1b982a4dcf2235464016c0c4576a34d ] + +The buffer used to transfer data over the mailbox interface is mapped +using the client's device. This is incorrect, as the device performing +the DMA transfer is the mailbox itself. Fix it by using the mailbox +controller device instead. + +This requires including the mailbox_controller.h header to dereference +the mbox_chan and mbox_controller structures. The header is not meant to +be included by clients. This could be fixed by extending the client API +with a function to access the controller's device. + +Fixes: 4e3d60656a72 ("ARM: bcm2835: Add the Raspberry Pi firmware driver") +Signed-off-by: Laurent Pinchart +Reviewed-by: Stefan Wahren +Tested-by: Ivan T. Ivanov +Link: https://lore.kernel.org/r/20240326195807.15163-3-laurent.pinchart@ideasonboard.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + drivers/firmware/raspberrypi.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c +index f66efaa5196d9..428ae54d3196c 100644 +--- a/drivers/firmware/raspberrypi.c ++++ b/drivers/firmware/raspberrypi.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -97,8 +98,8 @@ int rpi_firmware_property_list(struct rpi_firmware *fw, + if (size & 3) + return -EINVAL; + +- buf = dma_alloc_coherent(fw->cl.dev, PAGE_ALIGN(size), &bus_addr, +- GFP_ATOMIC); ++ buf = dma_alloc_coherent(fw->chan->mbox->dev, PAGE_ALIGN(size), ++ &bus_addr, GFP_ATOMIC); + if (!buf) + return -ENOMEM; + +@@ -126,7 +127,7 @@ int rpi_firmware_property_list(struct rpi_firmware *fw, + ret = -EINVAL; + } + +- dma_free_coherent(fw->cl.dev, PAGE_ALIGN(size), buf, bus_addr); ++ dma_free_coherent(fw->chan->mbox->dev, PAGE_ALIGN(size), buf, bus_addr); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/fpga-dfl-pci-add-pci-subdevice-id-for-intel-d5005-ca.patch b/queue-6.6/fpga-dfl-pci-add-pci-subdevice-id-for-intel-d5005-ca.patch new file mode 100644 index 00000000000..ff6a28879fb --- /dev/null +++ b/queue-6.6/fpga-dfl-pci-add-pci-subdevice-id-for-intel-d5005-ca.patch @@ -0,0 +1,51 @@ +From 8d2039e33d8a64687014de11daef7b06e3a7473b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 19:02:57 -0400 +Subject: fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card + +From: Peter Colberg + +[ Upstream commit bb1dbeceb1c20cfd81271e1bd69892ebd1ee38e0 ] + +Add PCI subdevice ID for the Intel D5005 Stratix 10 FPGA card as +used with the Open FPGA Stack (OFS) FPGA Interface Manager (FIM). + +Unlike the Intel D5005 PAC FIM which exposed a separate PCI device ID, +the OFS FIM reuses the same device ID for all DFL-based FPGA cards +and differentiates on the subdevice ID. The subdevice ID values were +chosen as the numeric part of the FPGA card names in hexadecimal. + +Signed-off-by: Peter Colberg +Reviewed-by: Matthew Gerlach +Acked-by: Xu Yilun +Link: https://lore.kernel.org/r/20240422230257.1959-1-peter.colberg@intel.com +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +--- + drivers/fpga/dfl-pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/fpga/dfl-pci.c b/drivers/fpga/dfl-pci.c +index 98b8fd16183e4..80cac3a5f9767 100644 +--- a/drivers/fpga/dfl-pci.c ++++ b/drivers/fpga/dfl-pci.c +@@ -78,6 +78,7 @@ static void cci_pci_free_irq(struct pci_dev *pcidev) + #define PCIE_DEVICE_ID_SILICOM_PAC_N5011 0x1001 + #define PCIE_DEVICE_ID_INTEL_DFL 0xbcce + /* PCI Subdevice ID for PCIE_DEVICE_ID_INTEL_DFL */ ++#define PCIE_SUBDEVICE_ID_INTEL_D5005 0x138d + #define PCIE_SUBDEVICE_ID_INTEL_N6000 0x1770 + #define PCIE_SUBDEVICE_ID_INTEL_N6001 0x1771 + #define PCIE_SUBDEVICE_ID_INTEL_C6100 0x17d4 +@@ -101,6 +102,8 @@ static struct pci_device_id cci_pcie_id_tbl[] = { + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_PAC_D5005_VF),}, + {PCI_DEVICE(PCI_VENDOR_ID_SILICOM_DENMARK, PCIE_DEVICE_ID_SILICOM_PAC_N5010),}, + {PCI_DEVICE(PCI_VENDOR_ID_SILICOM_DENMARK, PCIE_DEVICE_ID_SILICOM_PAC_N5011),}, ++ {PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_DFL, ++ PCI_VENDOR_ID_INTEL, PCIE_SUBDEVICE_ID_INTEL_D5005),}, + {PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_DFL, + PCI_VENDOR_ID_INTEL, PCIE_SUBDEVICE_ID_INTEL_N6000),}, + {PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_DFL_VF, +-- +2.43.0 + diff --git a/queue-6.6/gfs2-convert-gfs2_internal_read-to-folios.patch b/queue-6.6/gfs2-convert-gfs2_internal_read-to-folios.patch new file mode 100644 index 00000000000..9ae82abb5cf --- /dev/null +++ b/queue-6.6/gfs2-convert-gfs2_internal_read-to-folios.patch @@ -0,0 +1,89 @@ +From 48006f1d660477cf058f7a100f84ac627dd1a215 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 20:53:14 +0200 +Subject: gfs2: Convert gfs2_internal_read to folios + +From: Andreas Gruenbacher + +[ Upstream commit be7f6a6b0bca708999eef4f8e9f2b128c73b9e17 ] + +Change gfs2_internal_read() to use folios. Convert sizes to size_t. + +Signed-off-by: Andreas Gruenbacher +Stable-dep-of: d98779e68772 ("gfs2: Fix potential glock use-after-free on unmount") +Signed-off-by: Sasha Levin +--- + fs/gfs2/aops.c | 34 ++++++++++++++++------------------ + fs/gfs2/inode.h | 4 ++-- + 2 files changed, 18 insertions(+), 20 deletions(-) + +diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c +index c26d48355cc27..48dc35caa60b4 100644 +--- a/fs/gfs2/aops.c ++++ b/fs/gfs2/aops.c +@@ -479,31 +479,29 @@ static int gfs2_read_folio(struct file *file, struct folio *folio) + * + */ + +-int gfs2_internal_read(struct gfs2_inode *ip, char *buf, loff_t *pos, +- unsigned size) ++ssize_t gfs2_internal_read(struct gfs2_inode *ip, char *buf, loff_t *pos, ++ size_t size) + { + struct address_space *mapping = ip->i_inode.i_mapping; + unsigned long index = *pos >> PAGE_SHIFT; +- unsigned offset = *pos & (PAGE_SIZE - 1); +- unsigned copied = 0; +- unsigned amt; +- struct page *page; ++ size_t copied = 0; + + do { +- page = read_cache_page(mapping, index, gfs2_read_folio, NULL); +- if (IS_ERR(page)) { +- if (PTR_ERR(page) == -EINTR) ++ size_t offset, chunk; ++ struct folio *folio; ++ ++ folio = read_cache_folio(mapping, index, gfs2_read_folio, NULL); ++ if (IS_ERR(folio)) { ++ if (PTR_ERR(folio) == -EINTR) + continue; +- return PTR_ERR(page); ++ return PTR_ERR(folio); + } +- amt = size - copied; +- if (offset + size > PAGE_SIZE) +- amt = PAGE_SIZE - offset; +- memcpy_from_page(buf + copied, page, offset, amt); +- put_page(page); +- copied += amt; +- index++; +- offset = 0; ++ offset = *pos + copied - folio_pos(folio); ++ chunk = min(size - copied, folio_size(folio) - offset); ++ memcpy_from_folio(buf + copied, folio, offset, chunk); ++ index = folio_next_index(folio); ++ folio_put(folio); ++ copied += chunk; + } while(copied < size); + (*pos) += size; + return size; +diff --git a/fs/gfs2/inode.h b/fs/gfs2/inode.h +index c8c5814e7295d..75e662949f04d 100644 +--- a/fs/gfs2/inode.h ++++ b/fs/gfs2/inode.h +@@ -13,8 +13,8 @@ + #include "util.h" + + bool gfs2_release_folio(struct folio *folio, gfp_t gfp_mask); +-extern int gfs2_internal_read(struct gfs2_inode *ip, +- char *buf, loff_t *pos, unsigned size); ++extern ssize_t gfs2_internal_read(struct gfs2_inode *ip, ++ char *buf, loff_t *pos, size_t size); + extern void gfs2_set_aops(struct inode *inode); + + static inline int gfs2_is_stuffed(const struct gfs2_inode *ip) +-- +2.43.0 + diff --git a/queue-6.6/gfs2-do_xmote-fixes.patch b/queue-6.6/gfs2-do_xmote-fixes.patch new file mode 100644 index 00000000000..1c3b8d7a21b --- /dev/null +++ b/queue-6.6/gfs2-do_xmote-fixes.patch @@ -0,0 +1,128 @@ +From 665e9792edd34e17fa045a903379023f02f7b21e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 11:23:04 +0200 +Subject: gfs2: do_xmote fixes + +From: Andreas Gruenbacher + +[ Upstream commit 9947a06d29c0a30da88cdc6376ca5fd87083e130 ] + +Function do_xmote() is called with the glock spinlock held. Commit +86934198eefa added a 'goto skip_inval' statement at the beginning of the +function to further below where the glock spinlock is expected not to be +held anymore. Then it added code there that requires the glock spinlock +to be held. This doesn't make sense; fix this up by dropping and +retaking the spinlock where needed. + +In addition, when ->lm_lock() returned an error, do_xmote() didn't fail +the locking operation, and simply left the glock hanging; fix that as +well. (This is a much older error.) + +Fixes: 86934198eefa ("gfs2: Clear flags when withdraw prevents xmote") +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 44 +++++++++++++++++++++++++------------------- + 1 file changed, 25 insertions(+), 19 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 009a6a6312c2f..685e3ef9e9008 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -696,6 +696,7 @@ __acquires(&gl->gl_lockref.lock) + { + const struct gfs2_glock_operations *glops = gl->gl_ops; + struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; ++ struct lm_lockstruct *ls = &sdp->sd_lockstruct; + unsigned int lck_flags = (unsigned int)(gh ? gh->gh_flags : 0); + int ret; + +@@ -724,6 +725,9 @@ __acquires(&gl->gl_lockref.lock) + (gl->gl_state == LM_ST_EXCLUSIVE) || + (lck_flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB))) + clear_bit(GLF_BLOCKING, &gl->gl_flags); ++ if (!glops->go_inval && !glops->go_sync) ++ goto skip_inval; ++ + spin_unlock(&gl->gl_lockref.lock); + if (glops->go_sync) { + ret = glops->go_sync(gl); +@@ -736,6 +740,7 @@ __acquires(&gl->gl_lockref.lock) + fs_err(sdp, "Error %d syncing glock \n", ret); + gfs2_dump_glock(NULL, gl, true); + } ++ spin_lock(&gl->gl_lockref.lock); + goto skip_inval; + } + } +@@ -756,9 +761,10 @@ __acquires(&gl->gl_lockref.lock) + glops->go_inval(gl, target == LM_ST_DEFERRED ? 0 : DIO_METADATA); + clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags); + } ++ spin_lock(&gl->gl_lockref.lock); + + skip_inval: +- gfs2_glock_hold(gl); ++ gl->gl_lockref.count++; + /* + * Check for an error encountered since we called go_sync and go_inval. + * If so, we can't withdraw from the glock code because the withdraw +@@ -800,37 +806,37 @@ __acquires(&gl->gl_lockref.lock) + */ + clear_bit(GLF_LOCK, &gl->gl_flags); + clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags); +- gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD); +- goto out; ++ __gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD); ++ return; + } else { + clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags); + } + } + +- if (sdp->sd_lockstruct.ls_ops->lm_lock) { +- struct lm_lockstruct *ls = &sdp->sd_lockstruct; ++ if (ls->ls_ops->lm_lock) { ++ spin_unlock(&gl->gl_lockref.lock); ++ ret = ls->ls_ops->lm_lock(gl, target, lck_flags); ++ spin_lock(&gl->gl_lockref.lock); + +- /* lock_dlm */ +- ret = sdp->sd_lockstruct.ls_ops->lm_lock(gl, target, lck_flags); + if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED && + target == LM_ST_UNLOCKED && + test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) { +- spin_lock(&gl->gl_lockref.lock); +- finish_xmote(gl, target); +- __gfs2_glock_queue_work(gl, 0); +- spin_unlock(&gl->gl_lockref.lock); ++ /* ++ * The lockspace has been released and the lock has ++ * been unlocked implicitly. ++ */ + } else if (ret) { + fs_err(sdp, "lm_lock ret %d\n", ret); +- GLOCK_BUG_ON(gl, !gfs2_withdrawing_or_withdrawn(sdp)); ++ target = gl->gl_state | LM_OUT_ERROR; ++ } else { ++ /* The operation will be completed asynchronously. */ ++ return; + } +- } else { /* lock_nolock */ +- spin_lock(&gl->gl_lockref.lock); +- finish_xmote(gl, target); +- __gfs2_glock_queue_work(gl, 0); +- spin_unlock(&gl->gl_lockref.lock); + } +-out: +- spin_lock(&gl->gl_lockref.lock); ++ ++ /* Complete the operation now. */ ++ finish_xmote(gl, target); ++ __gfs2_glock_queue_work(gl, 0); + } + + /** +-- +2.43.0 + diff --git a/queue-6.6/gfs2-don-t-forget-to-complete-delayed-withdraw.patch b/queue-6.6/gfs2-don-t-forget-to-complete-delayed-withdraw.patch new file mode 100644 index 00000000000..f7814a5374d --- /dev/null +++ b/queue-6.6/gfs2-don-t-forget-to-complete-delayed-withdraw.patch @@ -0,0 +1,39 @@ +From 5746731d7f9663cf5ac1366785929628c931e82b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 11:49:44 +0100 +Subject: gfs2: Don't forget to complete delayed withdraw + +From: Andreas Gruenbacher + +[ Upstream commit b01189333ee91c1ae6cd96dfd1e3a3c2e69202f0 ] + +Commit fffe9bee14b0 ("gfs2: Delay withdraw from atomic context") +switched from gfs2_withdraw() to gfs2_withdraw_delayed() in +gfs2_ail_error(), but failed to then check if a delayed withdraw had +occurred. Fix that by adding the missing check in __gfs2_ail_flush(), +where the spin locks are already dropped and a withdraw is possible. + +Fixes: fffe9bee14b0 ("gfs2: Delay withdraw from atomic context") +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/glops.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c +index f41ca89d216bc..3c6f508383fe2 100644 +--- a/fs/gfs2/glops.c ++++ b/fs/gfs2/glops.c +@@ -82,6 +82,9 @@ static void __gfs2_ail_flush(struct gfs2_glock *gl, bool fsync, + GLOCK_BUG_ON(gl, !fsync && atomic_read(&gl->gl_ail_count)); + spin_unlock(&sdp->sd_ail_lock); + gfs2_log_unlock(sdp); ++ ++ if (gfs2_withdrawing(sdp)) ++ gfs2_withdraw(sdp); + } + + +-- +2.43.0 + diff --git a/queue-6.6/gfs2-finish_xmote-cleanup.patch b/queue-6.6/gfs2-finish_xmote-cleanup.patch new file mode 100644 index 00000000000..398c9e6a63f --- /dev/null +++ b/queue-6.6/gfs2-finish_xmote-cleanup.patch @@ -0,0 +1,108 @@ +From b951d4bbd8faed4a6159cfc4d4055c422be6df12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 19:16:58 +0200 +Subject: gfs2: finish_xmote cleanup + +From: Andreas Gruenbacher + +[ Upstream commit 1cd28e15864054f3c48baee9eecda1c0441c48ac ] + +Currently, function finish_xmote() takes and releases the glock +spinlock. However, all of its callers immediately take that spinlock +again, so it makes more sense to take the spin lock before calling +finish_xmote() already. + +With that, thaw_glock() is the only place that sets the GLF_HAVE_REPLY +flag outside of the glock spinlock, but it also takes that spinlock +immediately thereafter. Change that to set the bit when the spinlock is +already held. This allows to switch from test_and_clear_bit() to +test_bit() and clear_bit() in glock_work_func(). + +Signed-off-by: Andreas Gruenbacher +Stable-dep-of: 9947a06d29c0 ("gfs2: do_xmote fixes") +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 7af12c8fb577d..009a6a6312c2f 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -600,7 +600,6 @@ static void finish_xmote(struct gfs2_glock *gl, unsigned int ret) + struct gfs2_holder *gh; + unsigned state = ret & LM_OUT_ST_MASK; + +- spin_lock(&gl->gl_lockref.lock); + trace_gfs2_glock_state_change(gl, state); + state_change(gl, state); + gh = find_first_waiter(gl); +@@ -648,7 +647,6 @@ static void finish_xmote(struct gfs2_glock *gl, unsigned int ret) + gl->gl_target, state); + GLOCK_BUG_ON(gl, 1); + } +- spin_unlock(&gl->gl_lockref.lock); + return; + } + +@@ -671,7 +669,6 @@ static void finish_xmote(struct gfs2_glock *gl, unsigned int ret) + } + out: + clear_bit(GLF_LOCK, &gl->gl_flags); +- spin_unlock(&gl->gl_lockref.lock); + } + + static bool is_system_glock(struct gfs2_glock *gl) +@@ -818,15 +815,19 @@ __acquires(&gl->gl_lockref.lock) + if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED && + target == LM_ST_UNLOCKED && + test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) { ++ spin_lock(&gl->gl_lockref.lock); + finish_xmote(gl, target); +- gfs2_glock_queue_work(gl, 0); ++ __gfs2_glock_queue_work(gl, 0); ++ spin_unlock(&gl->gl_lockref.lock); + } else if (ret) { + fs_err(sdp, "lm_lock ret %d\n", ret); + GLOCK_BUG_ON(gl, !gfs2_withdrawing_or_withdrawn(sdp)); + } + } else { /* lock_nolock */ ++ spin_lock(&gl->gl_lockref.lock); + finish_xmote(gl, target); +- gfs2_glock_queue_work(gl, 0); ++ __gfs2_glock_queue_work(gl, 0); ++ spin_unlock(&gl->gl_lockref.lock); + } + out: + spin_lock(&gl->gl_lockref.lock); +@@ -1082,11 +1083,12 @@ static void glock_work_func(struct work_struct *work) + struct gfs2_glock *gl = container_of(work, struct gfs2_glock, gl_work.work); + unsigned int drop_refs = 1; + +- if (test_and_clear_bit(GLF_REPLY_PENDING, &gl->gl_flags)) { ++ spin_lock(&gl->gl_lockref.lock); ++ if (test_bit(GLF_REPLY_PENDING, &gl->gl_flags)) { ++ clear_bit(GLF_REPLY_PENDING, &gl->gl_flags); + finish_xmote(gl, gl->gl_reply); + drop_refs++; + } +- spin_lock(&gl->gl_lockref.lock); + if (test_bit(GLF_PENDING_DEMOTE, &gl->gl_flags) && + gl->gl_state != LM_ST_UNLOCKED && + gl->gl_demote_state != LM_ST_EXCLUSIVE) { +@@ -2144,8 +2146,11 @@ static void thaw_glock(struct gfs2_glock *gl) + return; + if (!lockref_get_not_dead(&gl->gl_lockref)) + return; ++ ++ spin_lock(&gl->gl_lockref.lock); + set_bit(GLF_REPLY_PENDING, &gl->gl_flags); +- gfs2_glock_queue_work(gl, 0); ++ __gfs2_glock_queue_work(gl, 0); ++ spin_unlock(&gl->gl_lockref.lock); + } + + /** +-- +2.43.0 + diff --git a/queue-6.6/gfs2-fix-ignore-unlock-failures-after-withdraw.patch b/queue-6.6/gfs2-fix-ignore-unlock-failures-after-withdraw.patch new file mode 100644 index 00000000000..ab9fea8c4e4 --- /dev/null +++ b/queue-6.6/gfs2-fix-ignore-unlock-failures-after-withdraw.patch @@ -0,0 +1,63 @@ +From a3c6b7bd370418fa6a42f552f701e3fe66171a03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 13:47:51 +0200 +Subject: gfs2: Fix "ignore unlock failures after withdraw" + +From: Andreas Gruenbacher + +[ Upstream commit 5d9231111966b6c5a65016d58dcbeab91055bc91 ] + +Commit 3e11e53041502 tries to suppress dlm_lock() lock conversion errors +that occur when the lockspace has already been released. + +It does that by setting and checking the SDF_SKIP_DLM_UNLOCK flag. This +conflicts with the intended meaning of the SDF_SKIP_DLM_UNLOCK flag, so +check whether the lockspace is still allocated instead. + +(Given the current DLM API, checking for this kind of error after the +fact seems easier that than to make sure that the lockspace is still +allocated before calling dlm_lock(). Changing the DLM API so that users +maintain the lockspace references themselves would be an option.) + +Fixes: 3e11e53041502 ("GFS2: ignore unlock failures after withdraw") +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 4 +++- + fs/gfs2/util.c | 1 - + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 4a280be229a65..207b7c23bc0f3 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -785,11 +785,13 @@ __acquires(&gl->gl_lockref.lock) + } + + if (sdp->sd_lockstruct.ls_ops->lm_lock) { ++ struct lm_lockstruct *ls = &sdp->sd_lockstruct; ++ + /* lock_dlm */ + ret = sdp->sd_lockstruct.ls_ops->lm_lock(gl, target, lck_flags); + if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED && + target == LM_ST_UNLOCKED && +- test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags)) { ++ test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) { + finish_xmote(gl, target); + gfs2_glock_queue_work(gl, 0); + } else if (ret) { +diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c +index da29fafb62728..d424691bd3f8a 100644 +--- a/fs/gfs2/util.c ++++ b/fs/gfs2/util.c +@@ -350,7 +350,6 @@ int gfs2_withdraw(struct gfs2_sbd *sdp) + fs_err(sdp, "telling LM to unmount\n"); + lm->lm_unmount(sdp); + } +- set_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags); + fs_err(sdp, "File system withdrawn\n"); + dump_stack(); + clear_bit(SDF_WITHDRAW_IN_PROG, &sdp->sd_flags); +-- +2.43.0 + diff --git a/queue-6.6/gfs2-fix-potential-glock-use-after-free-on-unmount.patch b/queue-6.6/gfs2-fix-potential-glock-use-after-free-on-unmount.patch new file mode 100644 index 00000000000..3bb3c398bac --- /dev/null +++ b/queue-6.6/gfs2-fix-potential-glock-use-after-free-on-unmount.patch @@ -0,0 +1,227 @@ +From 3620b7d1e7c5bf09088d0f6ac8d230e343165979 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 04:50:18 +0200 +Subject: gfs2: Fix potential glock use-after-free on unmount + +From: Andreas Gruenbacher + +[ Upstream commit d98779e687726d8f8860f1c54b5687eec5f63a73 ] + +When a DLM lockspace is released and there ares still locks in that +lockspace, DLM will unlock those locks automatically. Commit +fb6791d100d1b started exploiting this behavior to speed up filesystem +unmount: gfs2 would simply free glocks it didn't want to unlock and then +release the lockspace. This didn't take the bast callbacks for +asynchronous lock contention notifications into account, which remain +active until until a lock is unlocked or its lockspace is released. + +To prevent those callbacks from accessing deallocated objects, put the +glocks that should not be unlocked on the sd_dead_glocks list, release +the lockspace, and only then free those glocks. + +As an additional measure, ignore unexpected ast and bast callbacks if +the receiving glock is dead. + +Fixes: fb6791d100d1b ("GFS2: skip dlm_unlock calls in unmount") +Signed-off-by: Andreas Gruenbacher +Cc: David Teigland +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 35 ++++++++++++++++++++++++++++++++--- + fs/gfs2/glock.h | 1 + + fs/gfs2/incore.h | 1 + + fs/gfs2/lock_dlm.c | 32 ++++++++++++++++++++++---------- + fs/gfs2/ops_fstype.c | 1 + + fs/gfs2/super.c | 3 --- + 6 files changed, 57 insertions(+), 16 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index a2a1935e2eede..c195244d21dfd 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -166,18 +166,45 @@ static bool glock_blocked_by_withdraw(struct gfs2_glock *gl) + return true; + } + +-void gfs2_glock_free(struct gfs2_glock *gl) ++static void __gfs2_glock_free(struct gfs2_glock *gl) + { +- struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; +- + rhashtable_remove_fast(&gl_hash_table, &gl->gl_node, ht_parms); + smp_mb(); + wake_up_glock(gl); + call_rcu(&gl->gl_rcu, gfs2_glock_dealloc); ++} ++ ++void gfs2_glock_free(struct gfs2_glock *gl) { ++ struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; ++ ++ __gfs2_glock_free(gl); + if (atomic_dec_and_test(&sdp->sd_glock_disposal)) + wake_up(&sdp->sd_kill_wait); + } + ++void gfs2_glock_free_later(struct gfs2_glock *gl) { ++ struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; ++ ++ spin_lock(&lru_lock); ++ list_add(&gl->gl_lru, &sdp->sd_dead_glocks); ++ spin_unlock(&lru_lock); ++ if (atomic_dec_and_test(&sdp->sd_glock_disposal)) ++ wake_up(&sdp->sd_kill_wait); ++} ++ ++static void gfs2_free_dead_glocks(struct gfs2_sbd *sdp) ++{ ++ struct list_head *list = &sdp->sd_dead_glocks; ++ ++ while(!list_empty(list)) { ++ struct gfs2_glock *gl; ++ ++ gl = list_first_entry(list, struct gfs2_glock, gl_lru); ++ list_del_init(&gl->gl_lru); ++ __gfs2_glock_free(gl); ++ } ++} ++ + /** + * gfs2_glock_hold() - increment reference count on glock + * @gl: The glock to hold +@@ -2194,6 +2221,8 @@ void gfs2_gl_hash_clear(struct gfs2_sbd *sdp) + wait_event_timeout(sdp->sd_kill_wait, + atomic_read(&sdp->sd_glock_disposal) == 0, + HZ * 600); ++ gfs2_lm_unmount(sdp); ++ gfs2_free_dead_glocks(sdp); + glock_hash_walk(dump_glock_func, sdp); + } + +diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h +index 7a11d5d4de496..f7ee9ca948eee 100644 +--- a/fs/gfs2/glock.h ++++ b/fs/gfs2/glock.h +@@ -266,6 +266,7 @@ void gfs2_gl_dq_holders(struct gfs2_sbd *sdp); + void gfs2_glock_thaw(struct gfs2_sbd *sdp); + void gfs2_glock_add_to_lru(struct gfs2_glock *gl); + void gfs2_glock_free(struct gfs2_glock *gl); ++void gfs2_glock_free_later(struct gfs2_glock *gl); + + int __init gfs2_glock_init(void); + void gfs2_glock_exit(void); +diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h +index 95a334d64da2a..60abd7050c998 100644 +--- a/fs/gfs2/incore.h ++++ b/fs/gfs2/incore.h +@@ -838,6 +838,7 @@ struct gfs2_sbd { + /* For quiescing the filesystem */ + struct gfs2_holder sd_freeze_gh; + struct mutex sd_freeze_mutex; ++ struct list_head sd_dead_glocks; + + char sd_fsname[GFS2_FSNAME_LEN + 3 * sizeof(int) + 2]; + char sd_table_name[GFS2_FSNAME_LEN]; +diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c +index 59ab18c798890..0bde45fb49630 100644 +--- a/fs/gfs2/lock_dlm.c ++++ b/fs/gfs2/lock_dlm.c +@@ -121,6 +121,11 @@ static void gdlm_ast(void *arg) + struct gfs2_glock *gl = arg; + unsigned ret = gl->gl_state; + ++ /* If the glock is dead, we only react to a dlm_unlock() reply. */ ++ if (__lockref_is_dead(&gl->gl_lockref) && ++ gl->gl_lksb.sb_status != -DLM_EUNLOCK) ++ return; ++ + gfs2_update_reply_times(gl); + BUG_ON(gl->gl_lksb.sb_flags & DLM_SBF_DEMOTED); + +@@ -171,6 +176,9 @@ static void gdlm_bast(void *arg, int mode) + { + struct gfs2_glock *gl = arg; + ++ if (__lockref_is_dead(&gl->gl_lockref)) ++ return; ++ + switch (mode) { + case DLM_LOCK_EX: + gfs2_glock_cb(gl, LM_ST_UNLOCKED); +@@ -291,8 +299,12 @@ static void gdlm_put_lock(struct gfs2_glock *gl) + struct lm_lockstruct *ls = &sdp->sd_lockstruct; + int error; + +- if (gl->gl_lksb.sb_lkid == 0) +- goto out_free; ++ BUG_ON(!__lockref_is_dead(&gl->gl_lockref)); ++ ++ if (gl->gl_lksb.sb_lkid == 0) { ++ gfs2_glock_free(gl); ++ return; ++ } + + clear_bit(GLF_BLOCKING, &gl->gl_flags); + gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT); +@@ -300,13 +312,17 @@ static void gdlm_put_lock(struct gfs2_glock *gl) + gfs2_update_request_times(gl); + + /* don't want to call dlm if we've unmounted the lock protocol */ +- if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) +- goto out_free; ++ if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) { ++ gfs2_glock_free(gl); ++ return; ++ } + /* don't want to skip dlm_unlock writing the lvb when lock has one */ + + if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) && +- !gl->gl_lksb.sb_lvbptr) +- goto out_free; ++ !gl->gl_lksb.sb_lvbptr) { ++ gfs2_glock_free_later(gl); ++ return; ++ } + + again: + error = dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_VALBLK, +@@ -321,10 +337,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl) + gl->gl_name.ln_type, + (unsigned long long)gl->gl_name.ln_number, error); + } +- return; +- +-out_free: +- gfs2_glock_free(gl); + } + + static void gdlm_cancel(struct gfs2_glock *gl) +diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c +index 547e279f5f9e6..fc7bc1e59748f 100644 +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -136,6 +136,7 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb) + atomic_set(&sdp->sd_log_in_flight, 0); + init_waitqueue_head(&sdp->sd_log_flush_wait); + mutex_init(&sdp->sd_freeze_mutex); ++ INIT_LIST_HEAD(&sdp->sd_dead_glocks); + + return sdp; + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index ab095198b627f..2b47a4119591f 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -646,10 +646,7 @@ static void gfs2_put_super(struct super_block *sb) + gfs2_gl_hash_clear(sdp); + truncate_inode_pages_final(&sdp->sd_aspace); + gfs2_delete_debugfs_file(sdp); +- /* Unmount the locking protocol */ +- gfs2_lm_unmount(sdp); + +- /* At this point, we're through participating in the lockspace */ + gfs2_sys_fs_del(sdp); + free_sbd(sdp); + } +-- +2.43.0 + diff --git a/queue-6.6/gfs2-get-rid-of-gfs2_alloc_blocks-generation-paramet.patch b/queue-6.6/gfs2-get-rid-of-gfs2_alloc_blocks-generation-paramet.patch new file mode 100644 index 00000000000..41a350633f0 --- /dev/null +++ b/queue-6.6/gfs2-get-rid-of-gfs2_alloc_blocks-generation-paramet.patch @@ -0,0 +1,156 @@ +From a05441cee2181d3665ade782255ccfc682e43e2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Oct 2023 00:40:07 +0200 +Subject: gfs2: Get rid of gfs2_alloc_blocks generation parameter + +From: Andreas Gruenbacher + +[ Upstream commit 4c7b3f7fb7c8c66d669d107e717f9de41ef81e92 ] + +Get rid of the generation parameter of gfs2_alloc_blocks(): we only ever +set the generation of the current inode while creating it, so do so +directly. + +Signed-off-by: Andreas Gruenbacher +Stable-dep-of: d98779e68772 ("gfs2: Fix potential glock use-after-free on unmount") +Signed-off-by: Sasha Levin +--- + fs/gfs2/bmap.c | 4 ++-- + fs/gfs2/dir.c | 2 +- + fs/gfs2/inode.c | 2 +- + fs/gfs2/rgrp.c | 12 +++++++----- + fs/gfs2/rgrp.h | 2 +- + fs/gfs2/xattr.c | 6 +++--- + 6 files changed, 15 insertions(+), 13 deletions(-) + +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 2b578615607e4..7ed276a8f599d 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -106,7 +106,7 @@ static int __gfs2_unstuff_inode(struct gfs2_inode *ip, struct page *page) + and write it out to disk */ + + unsigned int n = 1; +- error = gfs2_alloc_blocks(ip, &block, &n, 0, NULL); ++ error = gfs2_alloc_blocks(ip, &block, &n, 0); + if (error) + goto out_brelse; + if (isdir) { +@@ -702,7 +702,7 @@ static int __gfs2_iomap_alloc(struct inode *inode, struct iomap *iomap, + i = mp->mp_aheight; + do { + n = blks - alloced; +- ret = gfs2_alloc_blocks(ip, &bn, &n, 0, NULL); ++ ret = gfs2_alloc_blocks(ip, &bn, &n, 0); + if (ret) + goto out; + alloced += n; +diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c +index 1a2afa88f8bea..3a2a10d6d43d1 100644 +--- a/fs/gfs2/dir.c ++++ b/fs/gfs2/dir.c +@@ -868,7 +868,7 @@ static struct gfs2_leaf *new_leaf(struct inode *inode, struct buffer_head **pbh, + struct gfs2_dirent *dent; + struct timespec64 tv = current_time(inode); + +- error = gfs2_alloc_blocks(ip, &bn, &n, 0, NULL); ++ error = gfs2_alloc_blocks(ip, &bn, &n, 0); + if (error) + return NULL; + bh = gfs2_meta_new(ip->i_gl, bn); +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 4e63fbb63151c..587e5bf885c1b 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -417,7 +417,7 @@ static int alloc_dinode(struct gfs2_inode *ip, u32 flags, unsigned *dblocks) + if (error) + goto out_ipreserv; + +- error = gfs2_alloc_blocks(ip, &ip->i_no_addr, dblocks, 1, &ip->i_generation); ++ error = gfs2_alloc_blocks(ip, &ip->i_no_addr, dblocks, 1); + if (error) + goto out_trans_end; + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 307b952a41f8f..396d0f4a259d5 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -2411,13 +2411,12 @@ static void gfs2_set_alloc_start(struct gfs2_rbm *rbm, + * @bn: Used to return the starting block number + * @nblocks: requested number of blocks/extent length (value/result) + * @dinode: 1 if we're allocating a dinode block, else 0 +- * @generation: the generation number of the inode + * + * Returns: 0 or error + */ + + int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *nblocks, +- bool dinode, u64 *generation) ++ bool dinode) + { + struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode); + struct buffer_head *dibh; +@@ -2477,10 +2476,13 @@ int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *nblocks, + rbm.rgd->rd_free -= *nblocks; + spin_unlock(&rbm.rgd->rd_rsspin); + if (dinode) { ++ u64 generation; ++ + rbm.rgd->rd_dinodes++; +- *generation = rbm.rgd->rd_igeneration++; +- if (*generation == 0) +- *generation = rbm.rgd->rd_igeneration++; ++ generation = rbm.rgd->rd_igeneration++; ++ if (generation == 0) ++ generation = rbm.rgd->rd_igeneration++; ++ ip->i_generation = generation; + } + + gfs2_trans_add_meta(rbm.rgd->rd_gl, rbm.rgd->rd_bits[0].bi_bh); +diff --git a/fs/gfs2/rgrp.h b/fs/gfs2/rgrp.h +index 00b30cf893af2..507c914f039b0 100644 +--- a/fs/gfs2/rgrp.h ++++ b/fs/gfs2/rgrp.h +@@ -42,7 +42,7 @@ extern int gfs2_inplace_reserve(struct gfs2_inode *ip, + extern void gfs2_inplace_release(struct gfs2_inode *ip); + + extern int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *n, +- bool dinode, u64 *generation); ++ bool dinode); + + extern void gfs2_rs_deltree(struct gfs2_blkreserv *rs); + extern void gfs2_rs_delete(struct gfs2_inode *ip); +diff --git a/fs/gfs2/xattr.c b/fs/gfs2/xattr.c +index 4fea70c0fe3d1..2117011c8c577 100644 +--- a/fs/gfs2/xattr.c ++++ b/fs/gfs2/xattr.c +@@ -639,7 +639,7 @@ static int ea_alloc_blk(struct gfs2_inode *ip, struct buffer_head **bhp) + u64 block; + int error; + +- error = gfs2_alloc_blocks(ip, &block, &n, 0, NULL); ++ error = gfs2_alloc_blocks(ip, &block, &n, 0); + if (error) + return error; + gfs2_trans_remove_revoke(sdp, block, 1); +@@ -701,7 +701,7 @@ static int ea_write(struct gfs2_inode *ip, struct gfs2_ea_header *ea, + int mh_size = sizeof(struct gfs2_meta_header); + unsigned int n = 1; + +- error = gfs2_alloc_blocks(ip, &block, &n, 0, NULL); ++ error = gfs2_alloc_blocks(ip, &block, &n, 0); + if (error) + return error; + gfs2_trans_remove_revoke(sdp, block, 1); +@@ -1002,7 +1002,7 @@ static int ea_set_block(struct gfs2_inode *ip, struct gfs2_ea_request *er, + } else { + u64 blk; + unsigned int n = 1; +- error = gfs2_alloc_blocks(ip, &blk, &n, 0, NULL); ++ error = gfs2_alloc_blocks(ip, &blk, &n, 0); + if (error) + return error; + gfs2_trans_remove_revoke(sdp, blk, 1); +-- +2.43.0 + diff --git a/queue-6.6/gfs2-mark-withdraws-as-unlikely.patch b/queue-6.6/gfs2-mark-withdraws-as-unlikely.patch new file mode 100644 index 00000000000..5e352919e9b --- /dev/null +++ b/queue-6.6/gfs2-mark-withdraws-as-unlikely.patch @@ -0,0 +1,181 @@ +From a83ae761a24ee9234c2b6d4671faa4ec31d04bf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 17:05:26 +0100 +Subject: gfs2: Mark withdraws as unlikely + +From: Andreas Gruenbacher + +[ Upstream commit 015af1af44003fff797f8632e940824c07d282bf ] + +Mark the gfs2_withdrawn(), gfs2_withdrawing(), and +gfs2_withdraw_in_prog() inline functions as likely to return %false. +This allows to get rid of likely() and unlikely() annotations at the +call sites of those functions. + +Signed-off-by: Andreas Gruenbacher +Stable-dep-of: 9947a06d29c0 ("gfs2: do_xmote fixes") +Signed-off-by: Sasha Levin +--- + fs/gfs2/aops.c | 2 +- + fs/gfs2/file.c | 2 +- + fs/gfs2/glock.c | 4 ++-- + fs/gfs2/meta_io.c | 6 +++--- + fs/gfs2/ops_fstype.c | 2 +- + fs/gfs2/super.c | 2 +- + fs/gfs2/trans.c | 2 +- + fs/gfs2/util.h | 10 +++++----- + 8 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c +index 48dc35caa60b4..b8404ce301b3c 100644 +--- a/fs/gfs2/aops.c ++++ b/fs/gfs2/aops.c +@@ -464,7 +464,7 @@ static int gfs2_read_folio(struct file *file, struct folio *folio) + error = mpage_read_folio(folio, gfs2_block_map); + } + +- if (unlikely(gfs2_withdrawn(sdp))) ++ if (gfs2_withdrawn(sdp)) + return -EIO; + + return error; +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index f2700477a3001..1dc7fe805d2f1 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -1436,7 +1436,7 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl) + + if (!(fl->fl_flags & FL_POSIX)) + return -ENOLCK; +- if (unlikely(gfs2_withdrawn(sdp))) { ++ if (gfs2_withdrawn(sdp)) { + if (fl->fl_type == F_UNLCK) + locks_lock_file_wait(file, fl); + return -EIO; +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index c195244d21dfd..42de9db983a8b 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -156,7 +156,7 @@ static bool glock_blocked_by_withdraw(struct gfs2_glock *gl) + { + struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; + +- if (likely(!gfs2_withdrawn(sdp))) ++ if (!gfs2_withdrawn(sdp)) + return false; + if (gl->gl_ops->go_flags & GLOF_NONDISK) + return false; +@@ -783,7 +783,7 @@ __acquires(&gl->gl_lockref.lock) + * gfs2_gl_hash_clear calls clear_glock) and recovery is complete + * then it's okay to tell dlm to unlock it. + */ +- if (unlikely(sdp->sd_log_error && !gfs2_withdrawn(sdp))) ++ if (unlikely(sdp->sd_log_error) && !gfs2_withdrawn(sdp)) + gfs2_withdraw_delayed(sdp); + if (glock_blocked_by_withdraw(gl) && + (target != LM_ST_UNLOCKED || +diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c +index 924361fa510b1..50c2ecbba7ca7 100644 +--- a/fs/gfs2/meta_io.c ++++ b/fs/gfs2/meta_io.c +@@ -257,7 +257,7 @@ int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags, + struct buffer_head *bh, *bhs[2]; + int num = 0; + +- if (unlikely(gfs2_withdrawn(sdp)) && !gfs2_withdraw_in_prog(sdp)) { ++ if (gfs2_withdrawn(sdp) && !gfs2_withdraw_in_prog(sdp)) { + *bhp = NULL; + return -EIO; + } +@@ -315,7 +315,7 @@ int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags, + + int gfs2_meta_wait(struct gfs2_sbd *sdp, struct buffer_head *bh) + { +- if (unlikely(gfs2_withdrawn(sdp)) && !gfs2_withdraw_in_prog(sdp)) ++ if (gfs2_withdrawn(sdp) && !gfs2_withdraw_in_prog(sdp)) + return -EIO; + + wait_on_buffer(bh); +@@ -326,7 +326,7 @@ int gfs2_meta_wait(struct gfs2_sbd *sdp, struct buffer_head *bh) + gfs2_io_error_bh_wd(sdp, bh); + return -EIO; + } +- if (unlikely(gfs2_withdrawn(sdp)) && !gfs2_withdraw_in_prog(sdp)) ++ if (gfs2_withdrawn(sdp) && !gfs2_withdraw_in_prog(sdp)) + return -EIO; + + return 0; +diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c +index fc7bc1e59748f..be7df57bd5c86 100644 +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -1075,7 +1075,7 @@ static int gfs2_lm_mount(struct gfs2_sbd *sdp, int silent) + void gfs2_lm_unmount(struct gfs2_sbd *sdp) + { + const struct lm_lockops *lm = sdp->sd_lockstruct.ls_ops; +- if (likely(!gfs2_withdrawn(sdp)) && lm->lm_unmount) ++ if (!gfs2_withdrawn(sdp) && lm->lm_unmount) + lm->lm_unmount(sdp); + } + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 2b47a4119591f..1afcca5292d55 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -499,7 +499,7 @@ static void gfs2_dirty_inode(struct inode *inode, int flags) + return; + } + +- if (unlikely(gfs2_withdrawn(sdp))) ++ if (gfs2_withdrawn(sdp)) + return; + if (!gfs2_glock_is_locked_by_me(ip->i_gl)) { + ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh); +diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c +index 7e835be7032d0..1487fbb62d842 100644 +--- a/fs/gfs2/trans.c ++++ b/fs/gfs2/trans.c +@@ -268,7 +268,7 @@ void gfs2_trans_add_meta(struct gfs2_glock *gl, struct buffer_head *bh) + (unsigned long long)bd->bd_bh->b_blocknr); + BUG(); + } +- if (unlikely(gfs2_withdrawn(sdp))) { ++ if (gfs2_withdrawn(sdp)) { + fs_info(sdp, "GFS2:adding buf while withdrawn! 0x%llx\n", + (unsigned long long)bd->bd_bh->b_blocknr); + goto out_unlock; +diff --git a/fs/gfs2/util.h b/fs/gfs2/util.h +index 11c9d59b68896..76acf0b398149 100644 +--- a/fs/gfs2/util.h ++++ b/fs/gfs2/util.h +@@ -203,8 +203,8 @@ static inline void gfs2_withdraw_delayed(struct gfs2_sbd *sdp) + */ + static inline bool gfs2_withdrawn(struct gfs2_sbd *sdp) + { +- return test_bit(SDF_WITHDRAWN, &sdp->sd_flags) || +- test_bit(SDF_WITHDRAWING, &sdp->sd_flags); ++ return unlikely(test_bit(SDF_WITHDRAWN, &sdp->sd_flags) || ++ test_bit(SDF_WITHDRAWING, &sdp->sd_flags)); + } + + /** +@@ -213,13 +213,13 @@ static inline bool gfs2_withdrawn(struct gfs2_sbd *sdp) + */ + static inline bool gfs2_withdrawing(struct gfs2_sbd *sdp) + { +- return test_bit(SDF_WITHDRAWING, &sdp->sd_flags) && +- !test_bit(SDF_WITHDRAWN, &sdp->sd_flags); ++ return unlikely(test_bit(SDF_WITHDRAWING, &sdp->sd_flags) && ++ !test_bit(SDF_WITHDRAWN, &sdp->sd_flags)); + } + + static inline bool gfs2_withdraw_in_prog(struct gfs2_sbd *sdp) + { +- return test_bit(SDF_WITHDRAW_IN_PROG, &sdp->sd_flags); ++ return unlikely(test_bit(SDF_WITHDRAW_IN_PROG, &sdp->sd_flags)); + } + + #define gfs2_tune_get(sdp, field) \ +-- +2.43.0 + diff --git a/queue-6.6/gfs2-no-longer-use-extern-in-function-declarations.patch b/queue-6.6/gfs2-no-longer-use-extern-in-function-declarations.patch new file mode 100644 index 00000000000..41c938c5aab --- /dev/null +++ b/queue-6.6/gfs2-no-longer-use-extern-in-function-declarations.patch @@ -0,0 +1,925 @@ +From 7d5a038e7ecb00ecbcccab78f41a409de47fd307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2023 18:49:31 +0200 +Subject: gfs2: No longer use 'extern' in function declarations + +From: Andreas Gruenbacher + +[ Upstream commit 0b2355fe91ac3756a9e29c8b833ba33f9affb520 ] + +For non-static function declarations, external linkage is implied and +the 'extern' keyword isn't needed. Some static checkers complain about +the overuse of 'extern', so clean up all the function declarations. + +In addition, remove 'extern' from the definition of +free_local_statfs_inodes(); it isn't needed there, either. + +Signed-off-by: Andreas Gruenbacher +Stable-dep-of: d98779e68772 ("gfs2: Fix potential glock use-after-free on unmount") +Signed-off-by: Sasha Levin +--- + fs/gfs2/acl.h | 8 ++-- + fs/gfs2/aops.h | 6 +-- + fs/gfs2/bmap.h | 38 ++++++++--------- + fs/gfs2/dir.h | 38 ++++++++--------- + fs/gfs2/glock.h | 100 ++++++++++++++++++++++----------------------- + fs/gfs2/glops.h | 4 +- + fs/gfs2/incore.h | 2 +- + fs/gfs2/inode.h | 52 +++++++++++------------ + fs/gfs2/log.h | 46 ++++++++++----------- + fs/gfs2/lops.h | 22 +++++----- + fs/gfs2/meta_io.h | 20 ++++----- + fs/gfs2/quota.h | 35 ++++++++-------- + fs/gfs2/recovery.h | 18 ++++---- + fs/gfs2/rgrp.h | 85 +++++++++++++++++++------------------- + fs/gfs2/super.c | 6 +-- + fs/gfs2/super.h | 50 +++++++++++------------ + fs/gfs2/trans.h | 24 +++++------ + fs/gfs2/util.h | 8 ++-- + fs/gfs2/xattr.h | 12 +++--- + 19 files changed, 289 insertions(+), 285 deletions(-) + +diff --git a/fs/gfs2/acl.h b/fs/gfs2/acl.h +index d4deb2b199595..82f5b09c04e66 100644 +--- a/fs/gfs2/acl.h ++++ b/fs/gfs2/acl.h +@@ -11,9 +11,9 @@ + + #define GFS2_ACL_MAX_ENTRIES(sdp) ((300 << (sdp)->sd_sb.sb_bsize_shift) >> 12) + +-extern struct posix_acl *gfs2_get_acl(struct inode *inode, int type, bool rcu); +-extern int __gfs2_set_acl(struct inode *inode, struct posix_acl *acl, int type); +-extern int gfs2_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, +- struct posix_acl *acl, int type); ++struct posix_acl *gfs2_get_acl(struct inode *inode, int type, bool rcu); ++int __gfs2_set_acl(struct inode *inode, struct posix_acl *acl, int type); ++int gfs2_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, ++ struct posix_acl *acl, int type); + + #endif /* __ACL_DOT_H__ */ +diff --git a/fs/gfs2/aops.h b/fs/gfs2/aops.h +index f08322ef41cfd..a10c4334d2489 100644 +--- a/fs/gfs2/aops.h ++++ b/fs/gfs2/aops.h +@@ -8,8 +8,8 @@ + + #include "incore.h" + +-extern void adjust_fs_space(struct inode *inode); +-extern void gfs2_trans_add_databufs(struct gfs2_inode *ip, struct folio *folio, +- size_t from, size_t len); ++void adjust_fs_space(struct inode *inode); ++void gfs2_trans_add_databufs(struct gfs2_inode *ip, struct folio *folio, ++ size_t from, size_t len); + + #endif /* __AOPS_DOT_H__ */ +diff --git a/fs/gfs2/bmap.h b/fs/gfs2/bmap.h +index e5b7d17131ed3..4e8b1e8ebdf39 100644 +--- a/fs/gfs2/bmap.h ++++ b/fs/gfs2/bmap.h +@@ -46,24 +46,24 @@ static inline void gfs2_write_calc_reserv(const struct gfs2_inode *ip, + extern const struct iomap_ops gfs2_iomap_ops; + extern const struct iomap_writeback_ops gfs2_writeback_ops; + +-extern int gfs2_unstuff_dinode(struct gfs2_inode *ip); +-extern int gfs2_block_map(struct inode *inode, sector_t lblock, +- struct buffer_head *bh, int create); +-extern int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, +- struct iomap *iomap); +-extern int gfs2_iomap_alloc(struct inode *inode, loff_t pos, loff_t length, +- struct iomap *iomap); +-extern int gfs2_get_extent(struct inode *inode, u64 lblock, u64 *dblock, +- unsigned int *extlen); +-extern int gfs2_alloc_extent(struct inode *inode, u64 lblock, u64 *dblock, +- unsigned *extlen, bool *new); +-extern int gfs2_setattr_size(struct inode *inode, u64 size); +-extern int gfs2_truncatei_resume(struct gfs2_inode *ip); +-extern int gfs2_file_dealloc(struct gfs2_inode *ip); +-extern int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset, +- unsigned int len); +-extern int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd); +-extern void gfs2_free_journal_extents(struct gfs2_jdesc *jd); +-extern int __gfs2_punch_hole(struct file *file, loff_t offset, loff_t length); ++int gfs2_unstuff_dinode(struct gfs2_inode *ip); ++int gfs2_block_map(struct inode *inode, sector_t lblock, ++ struct buffer_head *bh, int create); ++int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, ++ struct iomap *iomap); ++int gfs2_iomap_alloc(struct inode *inode, loff_t pos, loff_t length, ++ struct iomap *iomap); ++int gfs2_get_extent(struct inode *inode, u64 lblock, u64 *dblock, ++ unsigned int *extlen); ++int gfs2_alloc_extent(struct inode *inode, u64 lblock, u64 *dblock, ++ unsigned *extlen, bool *new); ++int gfs2_setattr_size(struct inode *inode, u64 size); ++int gfs2_truncatei_resume(struct gfs2_inode *ip); ++int gfs2_file_dealloc(struct gfs2_inode *ip); ++int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset, ++ unsigned int len); ++int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd); ++void gfs2_free_journal_extents(struct gfs2_jdesc *jd); ++int __gfs2_punch_hole(struct file *file, loff_t offset, loff_t length); + + #endif /* __BMAP_DOT_H__ */ +diff --git a/fs/gfs2/dir.h b/fs/gfs2/dir.h +index 5b76480c17c9e..25a857c78b538 100644 +--- a/fs/gfs2/dir.h ++++ b/fs/gfs2/dir.h +@@ -23,32 +23,32 @@ struct gfs2_diradd { + int save_loc; + }; + +-extern struct inode *gfs2_dir_search(struct inode *dir, +- const struct qstr *filename, +- bool fail_on_exist); +-extern int gfs2_dir_check(struct inode *dir, const struct qstr *filename, +- const struct gfs2_inode *ip); +-extern int gfs2_dir_add(struct inode *inode, const struct qstr *filename, +- const struct gfs2_inode *ip, struct gfs2_diradd *da); ++struct inode *gfs2_dir_search(struct inode *dir, ++ const struct qstr *filename, ++ bool fail_on_exist); ++int gfs2_dir_check(struct inode *dir, const struct qstr *filename, ++ const struct gfs2_inode *ip); ++int gfs2_dir_add(struct inode *inode, const struct qstr *filename, ++ const struct gfs2_inode *ip, struct gfs2_diradd *da); + static inline void gfs2_dir_no_add(struct gfs2_diradd *da) + { + brelse(da->bh); + da->bh = NULL; + } +-extern int gfs2_dir_del(struct gfs2_inode *dip, const struct dentry *dentry); +-extern int gfs2_dir_read(struct inode *inode, struct dir_context *ctx, +- struct file_ra_state *f_ra); +-extern int gfs2_dir_mvino(struct gfs2_inode *dip, const struct qstr *filename, +- const struct gfs2_inode *nip, unsigned int new_type); ++int gfs2_dir_del(struct gfs2_inode *dip, const struct dentry *dentry); ++int gfs2_dir_read(struct inode *inode, struct dir_context *ctx, ++ struct file_ra_state *f_ra); ++int gfs2_dir_mvino(struct gfs2_inode *dip, const struct qstr *filename, ++ const struct gfs2_inode *nip, unsigned int new_type); + +-extern int gfs2_dir_exhash_dealloc(struct gfs2_inode *dip); ++int gfs2_dir_exhash_dealloc(struct gfs2_inode *dip); + +-extern int gfs2_diradd_alloc_required(struct inode *dir, +- const struct qstr *filename, +- struct gfs2_diradd *da); +-extern int gfs2_dir_get_new_buffer(struct gfs2_inode *ip, u64 block, +- struct buffer_head **bhp); +-extern void gfs2_dir_hash_inval(struct gfs2_inode *ip); ++int gfs2_diradd_alloc_required(struct inode *dir, ++ const struct qstr *filename, ++ struct gfs2_diradd *da); ++int gfs2_dir_get_new_buffer(struct gfs2_inode *ip, u64 block, ++ struct buffer_head **bhp); ++void gfs2_dir_hash_inval(struct gfs2_inode *ip); + + static inline u32 gfs2_disk_hash(const char *data, int len) + { +diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h +index c8685ca7d2a26..7a11d5d4de496 100644 +--- a/fs/gfs2/glock.h ++++ b/fs/gfs2/glock.h +@@ -181,40 +181,40 @@ static inline struct address_space *gfs2_glock2aspace(struct gfs2_glock *gl) + return NULL; + } + +-extern int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number, +- const struct gfs2_glock_operations *glops, +- int create, struct gfs2_glock **glp); +-extern struct gfs2_glock *gfs2_glock_hold(struct gfs2_glock *gl); +-extern void gfs2_glock_put(struct gfs2_glock *gl); +-extern void gfs2_glock_queue_put(struct gfs2_glock *gl); +- +-extern void __gfs2_holder_init(struct gfs2_glock *gl, unsigned int state, +- u16 flags, struct gfs2_holder *gh, +- unsigned long ip); ++int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number, ++ const struct gfs2_glock_operations *glops, ++ int create, struct gfs2_glock **glp); ++struct gfs2_glock *gfs2_glock_hold(struct gfs2_glock *gl); ++void gfs2_glock_put(struct gfs2_glock *gl); ++void gfs2_glock_queue_put(struct gfs2_glock *gl); ++ ++void __gfs2_holder_init(struct gfs2_glock *gl, unsigned int state, ++ u16 flags, struct gfs2_holder *gh, ++ unsigned long ip); + static inline void gfs2_holder_init(struct gfs2_glock *gl, unsigned int state, + u16 flags, struct gfs2_holder *gh) { + __gfs2_holder_init(gl, state, flags, gh, _RET_IP_); + } + +-extern void gfs2_holder_reinit(unsigned int state, u16 flags, +- struct gfs2_holder *gh); +-extern void gfs2_holder_uninit(struct gfs2_holder *gh); +-extern int gfs2_glock_nq(struct gfs2_holder *gh); +-extern int gfs2_glock_poll(struct gfs2_holder *gh); +-extern int gfs2_instantiate(struct gfs2_holder *gh); +-extern int gfs2_glock_holder_ready(struct gfs2_holder *gh); +-extern int gfs2_glock_wait(struct gfs2_holder *gh); +-extern int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs); +-extern void gfs2_glock_dq(struct gfs2_holder *gh); +-extern void gfs2_glock_dq_wait(struct gfs2_holder *gh); +-extern void gfs2_glock_dq_uninit(struct gfs2_holder *gh); +-extern int gfs2_glock_nq_num(struct gfs2_sbd *sdp, u64 number, +- const struct gfs2_glock_operations *glops, +- unsigned int state, u16 flags, +- struct gfs2_holder *gh); +-extern int gfs2_glock_nq_m(unsigned int num_gh, struct gfs2_holder *ghs); +-extern void gfs2_glock_dq_m(unsigned int num_gh, struct gfs2_holder *ghs); +-extern void gfs2_dump_glock(struct seq_file *seq, struct gfs2_glock *gl, ++void gfs2_holder_reinit(unsigned int state, u16 flags, ++ struct gfs2_holder *gh); ++void gfs2_holder_uninit(struct gfs2_holder *gh); ++int gfs2_glock_nq(struct gfs2_holder *gh); ++int gfs2_glock_poll(struct gfs2_holder *gh); ++int gfs2_instantiate(struct gfs2_holder *gh); ++int gfs2_glock_holder_ready(struct gfs2_holder *gh); ++int gfs2_glock_wait(struct gfs2_holder *gh); ++int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs); ++void gfs2_glock_dq(struct gfs2_holder *gh); ++void gfs2_glock_dq_wait(struct gfs2_holder *gh); ++void gfs2_glock_dq_uninit(struct gfs2_holder *gh); ++int gfs2_glock_nq_num(struct gfs2_sbd *sdp, u64 number, ++ const struct gfs2_glock_operations *glops, ++ unsigned int state, u16 flags, ++ struct gfs2_holder *gh); ++int gfs2_glock_nq_m(unsigned int num_gh, struct gfs2_holder *ghs); ++void gfs2_glock_dq_m(unsigned int num_gh, struct gfs2_holder *ghs); ++void gfs2_dump_glock(struct seq_file *seq, struct gfs2_glock *gl, + bool fsid); + #define GLOCK_BUG_ON(gl,x) do { if (unlikely(x)) { \ + gfs2_dump_glock(NULL, gl, true); \ +@@ -228,7 +228,7 @@ extern void gfs2_dump_glock(struct seq_file *seq, struct gfs2_glock *gl, + gfs2_assert_withdraw((gl)->gl_name.ln_sbd, (x)); } } \ + while (0) + +-extern __printf(2, 3) ++__printf(2, 3) + void gfs2_print_dbg(struct seq_file *seq, const char *fmt, ...); + + /** +@@ -256,27 +256,27 @@ static inline int gfs2_glock_nq_init(struct gfs2_glock *gl, + return error; + } + +-extern void gfs2_glock_cb(struct gfs2_glock *gl, unsigned int state); +-extern void gfs2_glock_complete(struct gfs2_glock *gl, int ret); +-extern bool gfs2_queue_try_to_evict(struct gfs2_glock *gl); +-extern void gfs2_cancel_delete_work(struct gfs2_glock *gl); +-extern void gfs2_flush_delete_work(struct gfs2_sbd *sdp); +-extern void gfs2_gl_hash_clear(struct gfs2_sbd *sdp); +-extern void gfs2_gl_dq_holders(struct gfs2_sbd *sdp); +-extern void gfs2_glock_thaw(struct gfs2_sbd *sdp); +-extern void gfs2_glock_add_to_lru(struct gfs2_glock *gl); +-extern void gfs2_glock_free(struct gfs2_glock *gl); ++void gfs2_glock_cb(struct gfs2_glock *gl, unsigned int state); ++void gfs2_glock_complete(struct gfs2_glock *gl, int ret); ++bool gfs2_queue_try_to_evict(struct gfs2_glock *gl); ++void gfs2_cancel_delete_work(struct gfs2_glock *gl); ++void gfs2_flush_delete_work(struct gfs2_sbd *sdp); ++void gfs2_gl_hash_clear(struct gfs2_sbd *sdp); ++void gfs2_gl_dq_holders(struct gfs2_sbd *sdp); ++void gfs2_glock_thaw(struct gfs2_sbd *sdp); ++void gfs2_glock_add_to_lru(struct gfs2_glock *gl); ++void gfs2_glock_free(struct gfs2_glock *gl); + +-extern int __init gfs2_glock_init(void); +-extern void gfs2_glock_exit(void); ++int __init gfs2_glock_init(void); ++void gfs2_glock_exit(void); + +-extern void gfs2_create_debugfs_file(struct gfs2_sbd *sdp); +-extern void gfs2_delete_debugfs_file(struct gfs2_sbd *sdp); +-extern void gfs2_register_debugfs(void); +-extern void gfs2_unregister_debugfs(void); ++void gfs2_create_debugfs_file(struct gfs2_sbd *sdp); ++void gfs2_delete_debugfs_file(struct gfs2_sbd *sdp); ++void gfs2_register_debugfs(void); ++void gfs2_unregister_debugfs(void); + +-extern void glock_set_object(struct gfs2_glock *gl, void *object); +-extern void glock_clear_object(struct gfs2_glock *gl, void *object); ++void glock_set_object(struct gfs2_glock *gl, void *object); ++void glock_clear_object(struct gfs2_glock *gl, void *object); + + extern const struct lm_lockops gfs2_dlm_ops; + +@@ -295,7 +295,7 @@ static inline bool gfs2_holder_queued(struct gfs2_holder *gh) + return !list_empty(&gh->gh_list); + } + +-extern void gfs2_inode_remember_delete(struct gfs2_glock *gl, u64 generation); +-extern bool gfs2_inode_already_deleted(struct gfs2_glock *gl, u64 generation); ++void gfs2_inode_remember_delete(struct gfs2_glock *gl, u64 generation); ++bool gfs2_inode_already_deleted(struct gfs2_glock *gl, u64 generation); + + #endif /* __GLOCK_DOT_H__ */ +diff --git a/fs/gfs2/glops.h b/fs/gfs2/glops.h +index 695898afcaf1f..9341423798df8 100644 +--- a/fs/gfs2/glops.h ++++ b/fs/gfs2/glops.h +@@ -22,7 +22,7 @@ extern const struct gfs2_glock_operations gfs2_quota_glops; + extern const struct gfs2_glock_operations gfs2_journal_glops; + extern const struct gfs2_glock_operations *gfs2_glops_list[]; + +-extern int gfs2_inode_metasync(struct gfs2_glock *gl); +-extern void gfs2_ail_flush(struct gfs2_glock *gl, bool fsync); ++int gfs2_inode_metasync(struct gfs2_glock *gl); ++void gfs2_ail_flush(struct gfs2_glock *gl, bool fsync); + + #endif /* __GLOPS_DOT_H__ */ +diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h +index a8c95c5293c6c..95a334d64da2a 100644 +--- a/fs/gfs2/incore.h ++++ b/fs/gfs2/incore.h +@@ -863,7 +863,7 @@ static inline void gfs2_sbstats_inc(const struct gfs2_glock *gl, int which) + preempt_enable(); + } + +-extern struct gfs2_rgrpd *gfs2_glock2rgrp(struct gfs2_glock *gl); ++struct gfs2_rgrpd *gfs2_glock2rgrp(struct gfs2_glock *gl); + + static inline unsigned gfs2_max_stuffed_size(const struct gfs2_inode *ip) + { +diff --git a/fs/gfs2/inode.h b/fs/gfs2/inode.h +index 1b291b58d4d23..ce70cf26b497d 100644 +--- a/fs/gfs2/inode.h ++++ b/fs/gfs2/inode.h +@@ -13,9 +13,9 @@ + #include "util.h" + + bool gfs2_release_folio(struct folio *folio, gfp_t gfp_mask); +-extern ssize_t gfs2_internal_read(struct gfs2_inode *ip, +- char *buf, loff_t *pos, size_t size); +-extern void gfs2_set_aops(struct inode *inode); ++ssize_t gfs2_internal_read(struct gfs2_inode *ip, ++ char *buf, loff_t *pos, size_t size); ++void gfs2_set_aops(struct inode *inode); + + static inline int gfs2_is_stuffed(const struct gfs2_inode *ip) + { +@@ -88,33 +88,33 @@ static inline int gfs2_check_internal_file_size(struct inode *inode, + return -EIO; + } + +-extern struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned type, +- u64 no_addr, u64 no_formal_ino, +- unsigned int blktype); +-extern struct inode *gfs2_lookup_by_inum(struct gfs2_sbd *sdp, u64 no_addr, +- u64 no_formal_ino, +- unsigned int blktype); +- +-extern int gfs2_inode_refresh(struct gfs2_inode *ip); +- +-extern struct inode *gfs2_lookupi(struct inode *dir, const struct qstr *name, +- int is_root); +-extern int gfs2_permission(struct mnt_idmap *idmap, +- struct inode *inode, int mask); +-extern struct inode *gfs2_lookup_meta(struct inode *dip, const char *name); +-extern void gfs2_dinode_out(const struct gfs2_inode *ip, void *buf); +-extern int gfs2_open_common(struct inode *inode, struct file *file); +-extern loff_t gfs2_seek_data(struct file *file, loff_t offset); +-extern loff_t gfs2_seek_hole(struct file *file, loff_t offset); ++struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned type, ++ u64 no_addr, u64 no_formal_ino, ++ unsigned int blktype); ++struct inode *gfs2_lookup_by_inum(struct gfs2_sbd *sdp, u64 no_addr, ++ u64 no_formal_ino, ++ unsigned int blktype); ++ ++int gfs2_inode_refresh(struct gfs2_inode *ip); ++ ++struct inode *gfs2_lookupi(struct inode *dir, const struct qstr *name, ++ int is_root); ++int gfs2_permission(struct mnt_idmap *idmap, ++ struct inode *inode, int mask); ++struct inode *gfs2_lookup_meta(struct inode *dip, const char *name); ++void gfs2_dinode_out(const struct gfs2_inode *ip, void *buf); ++int gfs2_open_common(struct inode *inode, struct file *file); ++loff_t gfs2_seek_data(struct file *file, loff_t offset); ++loff_t gfs2_seek_hole(struct file *file, loff_t offset); + + extern const struct file_operations gfs2_file_fops_nolock; + extern const struct file_operations gfs2_dir_fops_nolock; + +-extern int gfs2_fileattr_get(struct dentry *dentry, struct fileattr *fa); +-extern int gfs2_fileattr_set(struct mnt_idmap *idmap, +- struct dentry *dentry, struct fileattr *fa); +-extern void gfs2_set_inode_flags(struct inode *inode); +- ++int gfs2_fileattr_get(struct dentry *dentry, struct fileattr *fa); ++int gfs2_fileattr_set(struct mnt_idmap *idmap, ++ struct dentry *dentry, struct fileattr *fa); ++void gfs2_set_inode_flags(struct inode *inode); ++ + #ifdef CONFIG_GFS2_FS_LOCKING_DLM + extern const struct file_operations gfs2_file_fops; + extern const struct file_operations gfs2_dir_fops; +diff --git a/fs/gfs2/log.h b/fs/gfs2/log.h +index 653cffcbf8694..c27b05099c1e4 100644 +--- a/fs/gfs2/log.h ++++ b/fs/gfs2/log.h +@@ -70,29 +70,29 @@ static inline void gfs2_ordered_add_inode(struct gfs2_inode *ip) + } + } + +-extern void gfs2_ordered_del_inode(struct gfs2_inode *ip); +-extern unsigned int gfs2_struct2blk(struct gfs2_sbd *sdp, unsigned int nstruct); +-extern void gfs2_remove_from_ail(struct gfs2_bufdata *bd); +-extern bool gfs2_log_is_empty(struct gfs2_sbd *sdp); +-extern void gfs2_log_release_revokes(struct gfs2_sbd *sdp, unsigned int revokes); +-extern void gfs2_log_release(struct gfs2_sbd *sdp, unsigned int blks); +-extern bool gfs2_log_try_reserve(struct gfs2_sbd *sdp, struct gfs2_trans *tr, +- unsigned int *extra_revokes); +-extern void gfs2_log_reserve(struct gfs2_sbd *sdp, struct gfs2_trans *tr, +- unsigned int *extra_revokes); +-extern void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd, +- u64 seq, u32 tail, u32 lblock, u32 flags, +- blk_opf_t op_flags); +-extern void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, +- u32 type); +-extern void gfs2_log_commit(struct gfs2_sbd *sdp, struct gfs2_trans *trans); +-extern void gfs2_ail1_flush(struct gfs2_sbd *sdp, struct writeback_control *wbc); +-extern void log_flush_wait(struct gfs2_sbd *sdp); ++void gfs2_ordered_del_inode(struct gfs2_inode *ip); ++unsigned int gfs2_struct2blk(struct gfs2_sbd *sdp, unsigned int nstruct); ++void gfs2_remove_from_ail(struct gfs2_bufdata *bd); ++bool gfs2_log_is_empty(struct gfs2_sbd *sdp); ++void gfs2_log_release_revokes(struct gfs2_sbd *sdp, unsigned int revokes); ++void gfs2_log_release(struct gfs2_sbd *sdp, unsigned int blks); ++bool gfs2_log_try_reserve(struct gfs2_sbd *sdp, struct gfs2_trans *tr, ++ unsigned int *extra_revokes); ++void gfs2_log_reserve(struct gfs2_sbd *sdp, struct gfs2_trans *tr, ++ unsigned int *extra_revokes); ++void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd, ++ u64 seq, u32 tail, u32 lblock, u32 flags, ++ blk_opf_t op_flags); ++void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, ++ u32 type); ++void gfs2_log_commit(struct gfs2_sbd *sdp, struct gfs2_trans *trans); ++void gfs2_ail1_flush(struct gfs2_sbd *sdp, struct writeback_control *wbc); ++void log_flush_wait(struct gfs2_sbd *sdp); + +-extern int gfs2_logd(void *data); +-extern void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd); +-extern void gfs2_glock_remove_revoke(struct gfs2_glock *gl); +-extern void gfs2_flush_revokes(struct gfs2_sbd *sdp); +-extern void gfs2_ail_drain(struct gfs2_sbd *sdp); ++int gfs2_logd(void *data); ++void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd); ++void gfs2_glock_remove_revoke(struct gfs2_glock *gl); ++void gfs2_flush_revokes(struct gfs2_sbd *sdp); ++void gfs2_ail_drain(struct gfs2_sbd *sdp); + + #endif /* __LOG_DOT_H__ */ +diff --git a/fs/gfs2/lops.h b/fs/gfs2/lops.h +index 1412ffba1d444..07890c7b145d8 100644 +--- a/fs/gfs2/lops.h ++++ b/fs/gfs2/lops.h +@@ -11,16 +11,18 @@ + #include "incore.h" + + extern const struct gfs2_log_operations *gfs2_log_ops[]; +-extern void gfs2_log_incr_head(struct gfs2_sbd *sdp); +-extern u64 gfs2_log_bmap(struct gfs2_jdesc *jd, unsigned int lbn); +-extern void gfs2_log_write(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd, +- struct page *page, unsigned size, unsigned offset, +- u64 blkno); +-extern void gfs2_log_submit_bio(struct bio **biop, blk_opf_t opf); +-extern void gfs2_pin(struct gfs2_sbd *sdp, struct buffer_head *bh); +-extern int gfs2_find_jhead(struct gfs2_jdesc *jd, +- struct gfs2_log_header_host *head, bool keep_cache); +-extern void gfs2_drain_revokes(struct gfs2_sbd *sdp); ++ ++void gfs2_log_incr_head(struct gfs2_sbd *sdp); ++u64 gfs2_log_bmap(struct gfs2_jdesc *jd, unsigned int lbn); ++void gfs2_log_write(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd, ++ struct page *page, unsigned size, unsigned offset, ++ u64 blkno); ++void gfs2_log_submit_bio(struct bio **biop, blk_opf_t opf); ++void gfs2_pin(struct gfs2_sbd *sdp, struct buffer_head *bh); ++int gfs2_find_jhead(struct gfs2_jdesc *jd, ++ struct gfs2_log_header_host *head, bool keep_cache); ++void gfs2_drain_revokes(struct gfs2_sbd *sdp); ++ + static inline unsigned int buf_limit(struct gfs2_sbd *sdp) + { + return sdp->sd_ldptrs; +diff --git a/fs/gfs2/meta_io.h b/fs/gfs2/meta_io.h +index d0a58cdd433a9..831d988c2ceb7 100644 +--- a/fs/gfs2/meta_io.h ++++ b/fs/gfs2/meta_io.h +@@ -50,21 +50,21 @@ static inline struct gfs2_sbd *gfs2_mapping2sbd(struct address_space *mapping) + return inode->i_sb->s_fs_info; + } + +-extern struct buffer_head *gfs2_meta_new(struct gfs2_glock *gl, u64 blkno); +-extern int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags, +- int rahead, struct buffer_head **bhp); +-extern int gfs2_meta_wait(struct gfs2_sbd *sdp, struct buffer_head *bh); +-extern struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, +- int create); ++struct buffer_head *gfs2_meta_new(struct gfs2_glock *gl, u64 blkno); ++int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags, ++ int rahead, struct buffer_head **bhp); ++int gfs2_meta_wait(struct gfs2_sbd *sdp, struct buffer_head *bh); ++struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, ++ int create); + enum { + REMOVE_JDATA = 0, + REMOVE_META = 1, + }; + +-extern void gfs2_remove_from_journal(struct buffer_head *bh, int meta); +-extern void gfs2_journal_wipe(struct gfs2_inode *ip, u64 bstart, u32 blen); +-extern int gfs2_meta_buffer(struct gfs2_inode *ip, u32 mtype, u64 num, +- struct buffer_head **bhp); ++void gfs2_remove_from_journal(struct buffer_head *bh, int meta); ++void gfs2_journal_wipe(struct gfs2_inode *ip, u64 bstart, u32 blen); ++int gfs2_meta_buffer(struct gfs2_inode *ip, u32 mtype, u64 num, ++ struct buffer_head **bhp); + + static inline int gfs2_meta_inode_buffer(struct gfs2_inode *ip, + struct buffer_head **bhp) +diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h +index 1429945215a03..e4a2fdb552cd7 100644 +--- a/fs/gfs2/quota.h ++++ b/fs/gfs2/quota.h +@@ -15,27 +15,27 @@ struct gfs2_sbd; + #define NO_UID_QUOTA_CHANGE INVALID_UID + #define NO_GID_QUOTA_CHANGE INVALID_GID + +-extern int gfs2_qa_get(struct gfs2_inode *ip); +-extern void gfs2_qa_put(struct gfs2_inode *ip); +-extern int gfs2_quota_hold(struct gfs2_inode *ip, kuid_t uid, kgid_t gid); +-extern void gfs2_quota_unhold(struct gfs2_inode *ip); ++int gfs2_qa_get(struct gfs2_inode *ip); ++void gfs2_qa_put(struct gfs2_inode *ip); ++int gfs2_quota_hold(struct gfs2_inode *ip, kuid_t uid, kgid_t gid); ++void gfs2_quota_unhold(struct gfs2_inode *ip); + +-extern int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid); +-extern void gfs2_quota_unlock(struct gfs2_inode *ip); ++int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid); ++void gfs2_quota_unlock(struct gfs2_inode *ip); + +-extern int gfs2_quota_check(struct gfs2_inode *ip, kuid_t uid, kgid_t gid, +- struct gfs2_alloc_parms *ap); +-extern void gfs2_quota_change(struct gfs2_inode *ip, s64 change, +- kuid_t uid, kgid_t gid); ++int gfs2_quota_check(struct gfs2_inode *ip, kuid_t uid, kgid_t gid, ++ struct gfs2_alloc_parms *ap); ++void gfs2_quota_change(struct gfs2_inode *ip, s64 change, ++ kuid_t uid, kgid_t gid); + +-extern int gfs2_quota_sync(struct super_block *sb, int type); +-extern int gfs2_quota_refresh(struct gfs2_sbd *sdp, struct kqid qid); ++int gfs2_quota_sync(struct super_block *sb, int type); ++int gfs2_quota_refresh(struct gfs2_sbd *sdp, struct kqid qid); + +-extern int gfs2_quota_init(struct gfs2_sbd *sdp); +-extern void gfs2_quota_cleanup(struct gfs2_sbd *sdp); +-extern int gfs2_quotad(void *data); ++int gfs2_quota_init(struct gfs2_sbd *sdp); ++void gfs2_quota_cleanup(struct gfs2_sbd *sdp); ++int gfs2_quotad(void *data); + +-extern void gfs2_wake_up_statfs(struct gfs2_sbd *sdp); ++void gfs2_wake_up_statfs(struct gfs2_sbd *sdp); + + static inline int gfs2_quota_lock_check(struct gfs2_inode *ip, + struct gfs2_alloc_parms *ap) +@@ -62,6 +62,7 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip, + extern const struct quotactl_ops gfs2_quotactl_ops; + extern struct shrinker gfs2_qd_shrinker; + extern struct list_lru gfs2_qd_lru; +-extern void __init gfs2_quota_hash_init(void); ++ ++void __init gfs2_quota_hash_init(void); + + #endif /* __QUOTA_DOT_H__ */ +diff --git a/fs/gfs2/recovery.h b/fs/gfs2/recovery.h +index 7a0c9d0b7503f..6a0fd42e1120f 100644 +--- a/fs/gfs2/recovery.h ++++ b/fs/gfs2/recovery.h +@@ -17,18 +17,18 @@ static inline void gfs2_replay_incr_blk(struct gfs2_jdesc *jd, u32 *blk) + *blk = 0; + } + +-extern int gfs2_replay_read_block(struct gfs2_jdesc *jd, unsigned int blk, ++int gfs2_replay_read_block(struct gfs2_jdesc *jd, unsigned int blk, + struct buffer_head **bh); + +-extern int gfs2_revoke_add(struct gfs2_jdesc *jd, u64 blkno, unsigned int where); +-extern int gfs2_revoke_check(struct gfs2_jdesc *jd, u64 blkno, unsigned int where); +-extern void gfs2_revoke_clean(struct gfs2_jdesc *jd); ++int gfs2_revoke_add(struct gfs2_jdesc *jd, u64 blkno, unsigned int where); ++int gfs2_revoke_check(struct gfs2_jdesc *jd, u64 blkno, unsigned int where); ++void gfs2_revoke_clean(struct gfs2_jdesc *jd); + +-extern int gfs2_recover_journal(struct gfs2_jdesc *gfs2_jd, bool wait); +-extern void gfs2_recover_func(struct work_struct *work); +-extern int __get_log_header(struct gfs2_sbd *sdp, +- const struct gfs2_log_header *lh, unsigned int blkno, +- struct gfs2_log_header_host *head); ++int gfs2_recover_journal(struct gfs2_jdesc *gfs2_jd, bool wait); ++void gfs2_recover_func(struct work_struct *work); ++int __get_log_header(struct gfs2_sbd *sdp, ++ const struct gfs2_log_header *lh, unsigned int blkno, ++ struct gfs2_log_header_host *head); + + #endif /* __RECOVERY_DOT_H__ */ + +diff --git a/fs/gfs2/rgrp.h b/fs/gfs2/rgrp.h +index 507c914f039b0..8d20e99385db4 100644 +--- a/fs/gfs2/rgrp.h ++++ b/fs/gfs2/rgrp.h +@@ -22,38 +22,38 @@ struct gfs2_rgrpd; + struct gfs2_sbd; + struct gfs2_holder; + +-extern void gfs2_rgrp_verify(struct gfs2_rgrpd *rgd); ++void gfs2_rgrp_verify(struct gfs2_rgrpd *rgd); + +-extern struct gfs2_rgrpd *gfs2_blk2rgrpd(struct gfs2_sbd *sdp, u64 blk, bool exact); +-extern struct gfs2_rgrpd *gfs2_rgrpd_get_first(struct gfs2_sbd *sdp); +-extern struct gfs2_rgrpd *gfs2_rgrpd_get_next(struct gfs2_rgrpd *rgd); ++struct gfs2_rgrpd *gfs2_blk2rgrpd(struct gfs2_sbd *sdp, u64 blk, bool exact); ++struct gfs2_rgrpd *gfs2_rgrpd_get_first(struct gfs2_sbd *sdp); ++struct gfs2_rgrpd *gfs2_rgrpd_get_next(struct gfs2_rgrpd *rgd); + +-extern void gfs2_clear_rgrpd(struct gfs2_sbd *sdp); +-extern int gfs2_rindex_update(struct gfs2_sbd *sdp); +-extern void gfs2_free_clones(struct gfs2_rgrpd *rgd); +-extern int gfs2_rgrp_go_instantiate(struct gfs2_glock *gl); +-extern void gfs2_rgrp_brelse(struct gfs2_rgrpd *rgd); ++void gfs2_clear_rgrpd(struct gfs2_sbd *sdp); ++int gfs2_rindex_update(struct gfs2_sbd *sdp); ++void gfs2_free_clones(struct gfs2_rgrpd *rgd); ++int gfs2_rgrp_go_instantiate(struct gfs2_glock *gl); ++void gfs2_rgrp_brelse(struct gfs2_rgrpd *rgd); + +-extern struct gfs2_alloc *gfs2_alloc_get(struct gfs2_inode *ip); ++struct gfs2_alloc *gfs2_alloc_get(struct gfs2_inode *ip); + + #define GFS2_AF_ORLOV 1 +-extern int gfs2_inplace_reserve(struct gfs2_inode *ip, +- struct gfs2_alloc_parms *ap); +-extern void gfs2_inplace_release(struct gfs2_inode *ip); +- +-extern int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *n, +- bool dinode); +- +-extern void gfs2_rs_deltree(struct gfs2_blkreserv *rs); +-extern void gfs2_rs_delete(struct gfs2_inode *ip); +-extern void __gfs2_free_blocks(struct gfs2_inode *ip, struct gfs2_rgrpd *rgd, +- u64 bstart, u32 blen, int meta); +-extern void gfs2_free_meta(struct gfs2_inode *ip, struct gfs2_rgrpd *rgd, +- u64 bstart, u32 blen); +-extern void gfs2_free_di(struct gfs2_rgrpd *rgd, struct gfs2_inode *ip); +-extern void gfs2_unlink_di(struct inode *inode); +-extern int gfs2_check_blk_type(struct gfs2_sbd *sdp, u64 no_addr, +- unsigned int type); ++int gfs2_inplace_reserve(struct gfs2_inode *ip, ++ struct gfs2_alloc_parms *ap); ++void gfs2_inplace_release(struct gfs2_inode *ip); ++ ++int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *n, ++ bool dinode); ++ ++void gfs2_rs_deltree(struct gfs2_blkreserv *rs); ++void gfs2_rs_delete(struct gfs2_inode *ip); ++void __gfs2_free_blocks(struct gfs2_inode *ip, struct gfs2_rgrpd *rgd, ++ u64 bstart, u32 blen, int meta); ++void gfs2_free_meta(struct gfs2_inode *ip, struct gfs2_rgrpd *rgd, ++ u64 bstart, u32 blen); ++void gfs2_free_di(struct gfs2_rgrpd *rgd, struct gfs2_inode *ip); ++void gfs2_unlink_di(struct inode *inode); ++int gfs2_check_blk_type(struct gfs2_sbd *sdp, u64 no_addr, ++ unsigned int type); + + struct gfs2_rgrp_list { + unsigned int rl_rgrps; +@@ -62,18 +62,19 @@ struct gfs2_rgrp_list { + struct gfs2_holder *rl_ghs; + }; + +-extern void gfs2_rlist_add(struct gfs2_inode *ip, struct gfs2_rgrp_list *rlist, +- u64 block); +-extern void gfs2_rlist_alloc(struct gfs2_rgrp_list *rlist, +- unsigned int state, u16 flags); +-extern void gfs2_rlist_free(struct gfs2_rgrp_list *rlist); +-extern u64 gfs2_ri_total(struct gfs2_sbd *sdp); +-extern void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, +- const char *fs_id_buf); +-extern int gfs2_rgrp_send_discards(struct gfs2_sbd *sdp, u64 offset, +- struct buffer_head *bh, +- const struct gfs2_bitmap *bi, unsigned minlen, u64 *ptrimmed); +-extern int gfs2_fitrim(struct file *filp, void __user *argp); ++void gfs2_rlist_add(struct gfs2_inode *ip, struct gfs2_rgrp_list *rlist, ++ u64 block); ++void gfs2_rlist_alloc(struct gfs2_rgrp_list *rlist, ++ unsigned int state, u16 flags); ++void gfs2_rlist_free(struct gfs2_rgrp_list *rlist); ++u64 gfs2_ri_total(struct gfs2_sbd *sdp); ++void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, ++ const char *fs_id_buf); ++int gfs2_rgrp_send_discards(struct gfs2_sbd *sdp, u64 offset, ++ struct buffer_head *bh, ++ const struct gfs2_bitmap *bi, unsigned minlen, ++ u64 *ptrimmed); ++int gfs2_fitrim(struct file *filp, void __user *argp); + + /* This is how to tell if a reservation is in the rgrp tree: */ + static inline bool gfs2_rs_active(const struct gfs2_blkreserv *rs) +@@ -88,9 +89,9 @@ static inline int rgrp_contains_block(struct gfs2_rgrpd *rgd, u64 block) + return first <= block && block < last; + } + +-extern void check_and_update_goal(struct gfs2_inode *ip); ++void check_and_update_goal(struct gfs2_inode *ip); + +-extern void rgrp_lock_local(struct gfs2_rgrpd *rgd); +-extern void rgrp_unlock_local(struct gfs2_rgrpd *rgd); ++void rgrp_lock_local(struct gfs2_rgrpd *rgd); ++void rgrp_unlock_local(struct gfs2_rgrpd *rgd); + + #endif /* __RGRP_DOT_H__ */ +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 5f4ebe279aaae..ab095198b627f 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -1578,7 +1578,7 @@ static void gfs2_free_inode(struct inode *inode) + kmem_cache_free(gfs2_inode_cachep, GFS2_I(inode)); + } + +-extern void free_local_statfs_inodes(struct gfs2_sbd *sdp) ++void free_local_statfs_inodes(struct gfs2_sbd *sdp) + { + struct local_statfs_inode *lsi, *safe; + +@@ -1593,8 +1593,8 @@ extern void free_local_statfs_inodes(struct gfs2_sbd *sdp) + } + } + +-extern struct inode *find_local_statfs_inode(struct gfs2_sbd *sdp, +- unsigned int index) ++struct inode *find_local_statfs_inode(struct gfs2_sbd *sdp, ++ unsigned int index) + { + struct local_statfs_inode *lsi; + +diff --git a/fs/gfs2/super.h b/fs/gfs2/super.h +index ab9c83106932d..e1f7ef9264468 100644 +--- a/fs/gfs2/super.h ++++ b/fs/gfs2/super.h +@@ -15,7 +15,7 @@ + #define GFS2_FS_FORMAT_MIN (1801) + #define GFS2_FS_FORMAT_MAX (1802) + +-extern void gfs2_lm_unmount(struct gfs2_sbd *sdp); ++void gfs2_lm_unmount(struct gfs2_sbd *sdp); + + static inline unsigned int gfs2_jindex_size(struct gfs2_sbd *sdp) + { +@@ -26,33 +26,33 @@ static inline unsigned int gfs2_jindex_size(struct gfs2_sbd *sdp) + return x; + } + +-extern void gfs2_jindex_free(struct gfs2_sbd *sdp); ++void gfs2_jindex_free(struct gfs2_sbd *sdp); + +-extern struct gfs2_jdesc *gfs2_jdesc_find(struct gfs2_sbd *sdp, unsigned int jid); +-extern int gfs2_jdesc_check(struct gfs2_jdesc *jd); +-extern int gfs2_lookup_in_master_dir(struct gfs2_sbd *sdp, char *filename, +- struct gfs2_inode **ipp); ++struct gfs2_jdesc *gfs2_jdesc_find(struct gfs2_sbd *sdp, unsigned int jid); ++int gfs2_jdesc_check(struct gfs2_jdesc *jd); ++int gfs2_lookup_in_master_dir(struct gfs2_sbd *sdp, char *filename, ++ struct gfs2_inode **ipp); + +-extern int gfs2_make_fs_rw(struct gfs2_sbd *sdp); +-extern void gfs2_make_fs_ro(struct gfs2_sbd *sdp); +-extern void gfs2_online_uevent(struct gfs2_sbd *sdp); +-extern void gfs2_destroy_threads(struct gfs2_sbd *sdp); +-extern int gfs2_statfs_init(struct gfs2_sbd *sdp); +-extern void gfs2_statfs_change(struct gfs2_sbd *sdp, s64 total, s64 free, +- s64 dinodes); +-extern void gfs2_statfs_change_in(struct gfs2_statfs_change_host *sc, +- const void *buf); +-extern void gfs2_statfs_change_out(const struct gfs2_statfs_change_host *sc, +- void *buf); +-extern void update_statfs(struct gfs2_sbd *sdp, struct buffer_head *m_bh); +-extern int gfs2_statfs_sync(struct super_block *sb, int type); +-extern void gfs2_freeze_func(struct work_struct *work); +-extern void gfs2_thaw_freeze_initiator(struct super_block *sb); ++int gfs2_make_fs_rw(struct gfs2_sbd *sdp); ++void gfs2_make_fs_ro(struct gfs2_sbd *sdp); ++void gfs2_online_uevent(struct gfs2_sbd *sdp); ++void gfs2_destroy_threads(struct gfs2_sbd *sdp); ++int gfs2_statfs_init(struct gfs2_sbd *sdp); ++void gfs2_statfs_change(struct gfs2_sbd *sdp, s64 total, s64 free, ++ s64 dinodes); ++void gfs2_statfs_change_in(struct gfs2_statfs_change_host *sc, ++ const void *buf); ++void gfs2_statfs_change_out(const struct gfs2_statfs_change_host *sc, ++ void *buf); ++void update_statfs(struct gfs2_sbd *sdp, struct buffer_head *m_bh); ++int gfs2_statfs_sync(struct super_block *sb, int type); ++void gfs2_freeze_func(struct work_struct *work); ++void gfs2_thaw_freeze_initiator(struct super_block *sb); + +-extern void free_local_statfs_inodes(struct gfs2_sbd *sdp); +-extern struct inode *find_local_statfs_inode(struct gfs2_sbd *sdp, +- unsigned int index); +-extern void free_sbd(struct gfs2_sbd *sdp); ++void free_local_statfs_inodes(struct gfs2_sbd *sdp); ++struct inode *find_local_statfs_inode(struct gfs2_sbd *sdp, ++ unsigned int index); ++void free_sbd(struct gfs2_sbd *sdp); + + extern struct file_system_type gfs2_fs_type; + extern struct file_system_type gfs2meta_fs_type; +diff --git a/fs/gfs2/trans.h b/fs/gfs2/trans.h +index c76ad9a4c75a9..f8ce5302280d3 100644 +--- a/fs/gfs2/trans.h ++++ b/fs/gfs2/trans.h +@@ -34,17 +34,17 @@ static inline unsigned int gfs2_rg_blocks(const struct gfs2_inode *ip, unsigned + return rgd->rd_length; + } + +-extern int __gfs2_trans_begin(struct gfs2_trans *tr, struct gfs2_sbd *sdp, +- unsigned int blocks, unsigned int revokes, +- unsigned long ip); +-extern int gfs2_trans_begin(struct gfs2_sbd *sdp, unsigned int blocks, +- unsigned int revokes); +- +-extern void gfs2_trans_end(struct gfs2_sbd *sdp); +-extern void gfs2_trans_add_data(struct gfs2_glock *gl, struct buffer_head *bh); +-extern void gfs2_trans_add_meta(struct gfs2_glock *gl, struct buffer_head *bh); +-extern void gfs2_trans_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd); +-extern void gfs2_trans_remove_revoke(struct gfs2_sbd *sdp, u64 blkno, unsigned int len); +-extern void gfs2_trans_free(struct gfs2_sbd *sdp, struct gfs2_trans *tr); ++int __gfs2_trans_begin(struct gfs2_trans *tr, struct gfs2_sbd *sdp, ++ unsigned int blocks, unsigned int revokes, ++ unsigned long ip); ++int gfs2_trans_begin(struct gfs2_sbd *sdp, unsigned int blocks, ++ unsigned int revokes); ++ ++void gfs2_trans_end(struct gfs2_sbd *sdp); ++void gfs2_trans_add_data(struct gfs2_glock *gl, struct buffer_head *bh); ++void gfs2_trans_add_meta(struct gfs2_glock *gl, struct buffer_head *bh); ++void gfs2_trans_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd); ++void gfs2_trans_remove_revoke(struct gfs2_sbd *sdp, u64 blkno, unsigned int len); ++void gfs2_trans_free(struct gfs2_sbd *sdp, struct gfs2_trans *tr); + + #endif /* __TRANS_DOT_H__ */ +diff --git a/fs/gfs2/util.h b/fs/gfs2/util.h +index cdb839529175d..11c9d59b68896 100644 +--- a/fs/gfs2/util.h ++++ b/fs/gfs2/util.h +@@ -147,10 +147,10 @@ static inline void gfs2_metatype_set(struct buffer_head *bh, u16 type, + int gfs2_io_error_i(struct gfs2_sbd *sdp, const char *function, + char *file, unsigned int line); + +-extern int check_journal_clean(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd, +- bool verbose); +-extern int gfs2_freeze_lock_shared(struct gfs2_sbd *sdp); +-extern void gfs2_freeze_unlock(struct gfs2_holder *freeze_gh); ++int check_journal_clean(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd, ++ bool verbose); ++int gfs2_freeze_lock_shared(struct gfs2_sbd *sdp); ++void gfs2_freeze_unlock(struct gfs2_holder *freeze_gh); + + #define gfs2_io_error(sdp) \ + gfs2_io_error_i((sdp), __func__, __FILE__, __LINE__) +diff --git a/fs/gfs2/xattr.h b/fs/gfs2/xattr.h +index 2aed9d7d483d5..eb12eb7e37c19 100644 +--- a/fs/gfs2/xattr.h ++++ b/fs/gfs2/xattr.h +@@ -50,14 +50,14 @@ struct gfs2_ea_location { + struct gfs2_ea_header *el_prev; + }; + +-extern int __gfs2_xattr_set(struct inode *inode, const char *name, +- const void *value, size_t size, +- int flags, int type); +-extern ssize_t gfs2_listxattr(struct dentry *dentry, char *buffer, size_t size); +-extern int gfs2_ea_dealloc(struct gfs2_inode *ip); ++int __gfs2_xattr_set(struct inode *inode, const char *name, ++ const void *value, size_t size, ++ int flags, int type); ++ssize_t gfs2_listxattr(struct dentry *dentry, char *buffer, size_t size); ++int gfs2_ea_dealloc(struct gfs2_inode *ip); + + /* Exported to acl.c */ + +-extern int gfs2_xattr_acl_get(struct gfs2_inode *ip, const char *name, char **data); ++int gfs2_xattr_acl_get(struct gfs2_inode *ip, const char *name, char **data); + + #endif /* __EATTR_DOT_H__ */ +-- +2.43.0 + diff --git a/queue-6.6/gfs2-remove-ill-placed-consistency-check.patch b/queue-6.6/gfs2-remove-ill-placed-consistency-check.patch new file mode 100644 index 00000000000..67bfad666de --- /dev/null +++ b/queue-6.6/gfs2-remove-ill-placed-consistency-check.patch @@ -0,0 +1,37 @@ +From 1dac2d33508075fdd879dbd2a92d58c4e1a4062a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 04:24:56 +0200 +Subject: gfs2: Remove ill-placed consistency check + +From: Andreas Gruenbacher + +[ Upstream commit 59f60005797b4018d7b46620037e0c53d690795e ] + +This consistency check was originally added by commit 9287c6452d2b1 +("gfs2: Fix occasional glock use-after-free"). It is ill-placed in +gfs2_glock_free() because if it holds there, it must equally hold in +__gfs2_glock_put() already. Either way, the check doesn't seem +necessary anymore. + +Signed-off-by: Andreas Gruenbacher +Stable-dep-of: d98779e68772 ("gfs2: Fix potential glock use-after-free on unmount") +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 207b7c23bc0f3..a2a1935e2eede 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -170,7 +170,6 @@ void gfs2_glock_free(struct gfs2_glock *gl) + { + struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; + +- gfs2_glock_assert_withdraw(gl, atomic_read(&gl->gl_revokes) == 0); + rhashtable_remove_fast(&gl_hash_table, &gl->gl_node, ht_parms); + smp_mb(); + wake_up_glock(gl); +-- +2.43.0 + diff --git a/queue-6.6/gfs2-rename-gfs2_lookup_-simple-meta.patch b/queue-6.6/gfs2-rename-gfs2_lookup_-simple-meta.patch new file mode 100644 index 00000000000..d85fe8a738a --- /dev/null +++ b/queue-6.6/gfs2-rename-gfs2_lookup_-simple-meta.patch @@ -0,0 +1,143 @@ +From f79658b151f788149d08f863210356ad446fbadc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 22:23:43 +0200 +Subject: gfs2: Rename gfs2_lookup_{ simple => meta } + +From: Andreas Gruenbacher + +[ Upstream commit 062fb903895a035ed382a0d3f9b9d459b2718217 ] + +Function gfs2_lookup_simple() is used for looking up inodes in the +metadata directory tree, so rename it to gfs2_lookup_meta() to closer +match its purpose. Clean the function up a little on the way. + +Signed-off-by: Andreas Gruenbacher +Stable-dep-of: d98779e68772 ("gfs2: Fix potential glock use-after-free on unmount") +Signed-off-by: Sasha Levin +--- + fs/gfs2/inode.c | 13 +++++++------ + fs/gfs2/inode.h | 2 +- + fs/gfs2/ops_fstype.c | 16 ++++++++-------- + 3 files changed, 16 insertions(+), 15 deletions(-) + +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 587e5bf885c1b..3de0d8ab42eaf 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -265,17 +265,18 @@ struct inode *gfs2_lookup_by_inum(struct gfs2_sbd *sdp, u64 no_addr, + } + + +-struct inode *gfs2_lookup_simple(struct inode *dip, const char *name) ++/** ++ * gfs2_lookup_meta - Look up an inode in a metadata directory ++ * @dip: The directory ++ * @name: The name of the inode ++ */ ++struct inode *gfs2_lookup_meta(struct inode *dip, const char *name) + { + struct qstr qstr; + struct inode *inode; ++ + gfs2_str2qstr(&qstr, name); + inode = gfs2_lookupi(dip, &qstr, 1); +- /* gfs2_lookupi has inconsistent callers: vfs +- * related routines expect NULL for no entry found, +- * gfs2_lookup_simple callers expect ENOENT +- * and do not check for NULL. +- */ + if (IS_ERR_OR_NULL(inode)) + return inode ? inode : ERR_PTR(-ENOENT); + +diff --git a/fs/gfs2/inode.h b/fs/gfs2/inode.h +index 75e662949f04d..1b291b58d4d23 100644 +--- a/fs/gfs2/inode.h ++++ b/fs/gfs2/inode.h +@@ -101,7 +101,7 @@ extern struct inode *gfs2_lookupi(struct inode *dir, const struct qstr *name, + int is_root); + extern int gfs2_permission(struct mnt_idmap *idmap, + struct inode *inode, int mask); +-extern struct inode *gfs2_lookup_simple(struct inode *dip, const char *name); ++extern struct inode *gfs2_lookup_meta(struct inode *dip, const char *name); + extern void gfs2_dinode_out(const struct gfs2_inode *ip, void *buf); + extern int gfs2_open_common(struct inode *inode, struct file *file); + extern loff_t gfs2_seek_data(struct file *file, loff_t offset); +diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c +index dd64140ae6d7b..547e279f5f9e6 100644 +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -648,7 +648,7 @@ static int init_statfs(struct gfs2_sbd *sdp) + struct gfs2_jdesc *jd; + struct gfs2_inode *ip; + +- sdp->sd_statfs_inode = gfs2_lookup_simple(master, "statfs"); ++ sdp->sd_statfs_inode = gfs2_lookup_meta(master, "statfs"); + if (IS_ERR(sdp->sd_statfs_inode)) { + error = PTR_ERR(sdp->sd_statfs_inode); + fs_err(sdp, "can't read in statfs inode: %d\n", error); +@@ -657,7 +657,7 @@ static int init_statfs(struct gfs2_sbd *sdp) + if (sdp->sd_args.ar_spectator) + goto out; + +- pn = gfs2_lookup_simple(master, "per_node"); ++ pn = gfs2_lookup_meta(master, "per_node"); + if (IS_ERR(pn)) { + error = PTR_ERR(pn); + fs_err(sdp, "can't find per_node directory: %d\n", error); +@@ -674,7 +674,7 @@ static int init_statfs(struct gfs2_sbd *sdp) + goto free_local; + } + sprintf(buf, "statfs_change%u", jd->jd_jid); +- lsi->si_sc_inode = gfs2_lookup_simple(pn, buf); ++ lsi->si_sc_inode = gfs2_lookup_meta(pn, buf); + if (IS_ERR(lsi->si_sc_inode)) { + error = PTR_ERR(lsi->si_sc_inode); + fs_err(sdp, "can't find local \"sc\" file#%u: %d\n", +@@ -739,7 +739,7 @@ static int init_journal(struct gfs2_sbd *sdp, int undo) + if (undo) + goto fail_statfs; + +- sdp->sd_jindex = gfs2_lookup_simple(master, "jindex"); ++ sdp->sd_jindex = gfs2_lookup_meta(master, "jindex"); + if (IS_ERR(sdp->sd_jindex)) { + fs_err(sdp, "can't lookup journal index: %d\n", error); + return PTR_ERR(sdp->sd_jindex); +@@ -888,7 +888,7 @@ static int init_inodes(struct gfs2_sbd *sdp, int undo) + goto fail; + + /* Read in the resource index inode */ +- sdp->sd_rindex = gfs2_lookup_simple(master, "rindex"); ++ sdp->sd_rindex = gfs2_lookup_meta(master, "rindex"); + if (IS_ERR(sdp->sd_rindex)) { + error = PTR_ERR(sdp->sd_rindex); + fs_err(sdp, "can't get resource index inode: %d\n", error); +@@ -897,7 +897,7 @@ static int init_inodes(struct gfs2_sbd *sdp, int undo) + sdp->sd_rindex_uptodate = 0; + + /* Read in the quota inode */ +- sdp->sd_quota_inode = gfs2_lookup_simple(master, "quota"); ++ sdp->sd_quota_inode = gfs2_lookup_meta(master, "quota"); + if (IS_ERR(sdp->sd_quota_inode)) { + error = PTR_ERR(sdp->sd_quota_inode); + fs_err(sdp, "can't get quota file inode: %d\n", error); +@@ -941,7 +941,7 @@ static int init_per_node(struct gfs2_sbd *sdp, int undo) + if (undo) + goto fail_qc_gh; + +- pn = gfs2_lookup_simple(master, "per_node"); ++ pn = gfs2_lookup_meta(master, "per_node"); + if (IS_ERR(pn)) { + error = PTR_ERR(pn); + fs_err(sdp, "can't find per_node directory: %d\n", error); +@@ -949,7 +949,7 @@ static int init_per_node(struct gfs2_sbd *sdp, int undo) + } + + sprintf(buf, "quota_change%u", sdp->sd_jdesc->jd_jid); +- sdp->sd_qc_inode = gfs2_lookup_simple(pn, buf); ++ sdp->sd_qc_inode = gfs2_lookup_meta(pn, buf); + if (IS_ERR(sdp->sd_qc_inode)) { + error = PTR_ERR(sdp->sd_qc_inode); + fs_err(sdp, "can't find local \"qc\" file: %d\n", error); +-- +2.43.0 + diff --git a/queue-6.6/gfs2-rename-gfs2_withdrawn-to-gfs2_withdrawing_or_wi.patch b/queue-6.6/gfs2-rename-gfs2_withdrawn-to-gfs2_withdrawing_or_wi.patch new file mode 100644 index 00000000000..d50d1dd8747 --- /dev/null +++ b/queue-6.6/gfs2-rename-gfs2_withdrawn-to-gfs2_withdrawing_or_wi.patch @@ -0,0 +1,457 @@ +From 5934171fa8bff1478161ac8795e2dedc884516a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 17:16:29 +0100 +Subject: gfs2: Rename gfs2_withdrawn to gfs2_withdrawing_or_withdrawn + +From: Andreas Gruenbacher + +[ Upstream commit 4d927b03a68846e4e791ccde6b4c274df02f11e9 ] + +This function checks whether the filesystem has been been marked to be +withdrawn eventually or has been withdrawn already. Rename this +function to avoid confusing code like checking for gfs2_withdrawing() +when gfs2_withdrawn() has already returned true. + +Signed-off-by: Andreas Gruenbacher +Stable-dep-of: 9947a06d29c0 ("gfs2: do_xmote fixes") +Signed-off-by: Sasha Levin +--- + fs/gfs2/aops.c | 2 +- + fs/gfs2/file.c | 2 +- + fs/gfs2/glock.c | 8 ++++---- + fs/gfs2/glops.c | 2 +- + fs/gfs2/lock_dlm.c | 8 ++++---- + fs/gfs2/log.c | 21 +++++++++++---------- + fs/gfs2/meta_io.c | 9 ++++++--- + fs/gfs2/ops_fstype.c | 2 +- + fs/gfs2/quota.c | 8 ++++---- + fs/gfs2/recovery.c | 2 +- + fs/gfs2/super.c | 10 +++++----- + fs/gfs2/sys.c | 2 +- + fs/gfs2/trans.c | 2 +- + fs/gfs2/util.c | 4 ++-- + fs/gfs2/util.h | 5 +++-- + 15 files changed, 46 insertions(+), 41 deletions(-) + +diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c +index b8404ce301b3c..6097db9a7ebf3 100644 +--- a/fs/gfs2/aops.c ++++ b/fs/gfs2/aops.c +@@ -464,7 +464,7 @@ static int gfs2_read_folio(struct file *file, struct folio *folio) + error = mpage_read_folio(folio, gfs2_block_map); + } + +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + return -EIO; + + return error; +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index 1dc7fe805d2f1..9296e0e282bcd 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -1436,7 +1436,7 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl) + + if (!(fl->fl_flags & FL_POSIX)) + return -ENOLCK; +- if (gfs2_withdrawn(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp)) { + if (fl->fl_type == F_UNLCK) + locks_lock_file_wait(file, fl); + return -EIO; +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 42de9db983a8b..7af12c8fb577d 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -156,7 +156,7 @@ static bool glock_blocked_by_withdraw(struct gfs2_glock *gl) + { + struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; + +- if (!gfs2_withdrawn(sdp)) ++ if (!gfs2_withdrawing_or_withdrawn(sdp)) + return false; + if (gl->gl_ops->go_flags & GLOF_NONDISK) + return false; +@@ -304,7 +304,7 @@ static void __gfs2_glock_put(struct gfs2_glock *gl) + GLOCK_BUG_ON(gl, !list_empty(&gl->gl_holders)); + if (mapping) { + truncate_inode_pages_final(mapping); +- if (!gfs2_withdrawn(sdp)) ++ if (!gfs2_withdrawing_or_withdrawn(sdp)) + GLOCK_BUG_ON(gl, !mapping_empty(mapping)); + } + trace_gfs2_glock_put(gl); +@@ -783,7 +783,7 @@ __acquires(&gl->gl_lockref.lock) + * gfs2_gl_hash_clear calls clear_glock) and recovery is complete + * then it's okay to tell dlm to unlock it. + */ +- if (unlikely(sdp->sd_log_error) && !gfs2_withdrawn(sdp)) ++ if (unlikely(sdp->sd_log_error) && !gfs2_withdrawing_or_withdrawn(sdp)) + gfs2_withdraw_delayed(sdp); + if (glock_blocked_by_withdraw(gl) && + (target != LM_ST_UNLOCKED || +@@ -822,7 +822,7 @@ __acquires(&gl->gl_lockref.lock) + gfs2_glock_queue_work(gl, 0); + } else if (ret) { + fs_err(sdp, "lm_lock ret %d\n", ret); +- GLOCK_BUG_ON(gl, !gfs2_withdrawn(sdp)); ++ GLOCK_BUG_ON(gl, !gfs2_withdrawing_or_withdrawn(sdp)); + } + } else { /* lock_nolock */ + finish_xmote(gl, target); +diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c +index 3c6f508383fe2..1c854d4e2d491 100644 +--- a/fs/gfs2/glops.c ++++ b/fs/gfs2/glops.c +@@ -177,7 +177,7 @@ static int gfs2_rgrp_metasync(struct gfs2_glock *gl) + + filemap_fdatawrite_range(metamapping, start, end); + error = filemap_fdatawait_range(metamapping, start, end); +- WARN_ON_ONCE(error && !gfs2_withdrawn(sdp)); ++ WARN_ON_ONCE(error && !gfs2_withdrawing_or_withdrawn(sdp)); + mapping_set_error(metamapping, error); + if (error) + gfs2_io_error(sdp); +diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c +index 0bde45fb49630..e028e55e67d95 100644 +--- a/fs/gfs2/lock_dlm.c ++++ b/fs/gfs2/lock_dlm.c +@@ -1134,7 +1134,7 @@ static void gdlm_recover_prep(void *arg) + struct gfs2_sbd *sdp = arg; + struct lm_lockstruct *ls = &sdp->sd_lockstruct; + +- if (gfs2_withdrawn(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp)) { + fs_err(sdp, "recover_prep ignored due to withdraw.\n"); + return; + } +@@ -1160,7 +1160,7 @@ static void gdlm_recover_slot(void *arg, struct dlm_slot *slot) + struct lm_lockstruct *ls = &sdp->sd_lockstruct; + int jid = slot->slot - 1; + +- if (gfs2_withdrawn(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp)) { + fs_err(sdp, "recover_slot jid %d ignored due to withdraw.\n", + jid); + return; +@@ -1189,7 +1189,7 @@ static void gdlm_recover_done(void *arg, struct dlm_slot *slots, int num_slots, + struct gfs2_sbd *sdp = arg; + struct lm_lockstruct *ls = &sdp->sd_lockstruct; + +- if (gfs2_withdrawn(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp)) { + fs_err(sdp, "recover_done ignored due to withdraw.\n"); + return; + } +@@ -1220,7 +1220,7 @@ static void gdlm_recovery_result(struct gfs2_sbd *sdp, unsigned int jid, + { + struct lm_lockstruct *ls = &sdp->sd_lockstruct; + +- if (gfs2_withdrawn(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp)) { + fs_err(sdp, "recovery_result jid %d ignored due to withdraw.\n", + jid); + return; +diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c +index e5271ae87d1c4..88bc9b1b22650 100644 +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -126,7 +126,7 @@ __acquires(&sdp->sd_ail_lock) + } + } + +- if (gfs2_withdrawn(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp)) { + gfs2_remove_from_ail(bd); + continue; + } +@@ -841,7 +841,7 @@ void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd, + struct super_block *sb = sdp->sd_vfs; + u64 dblock; + +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + return; + + page = mempool_alloc(gfs2_page_pool, GFP_NOIO); +@@ -1047,7 +1047,8 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) + * Do this check while holding the log_flush_lock to prevent new + * buffers from being added to the ail via gfs2_pin() + */ +- if (gfs2_withdrawn(sdp) || !test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)) ++ if (gfs2_withdrawing_or_withdrawn(sdp) || ++ !test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)) + goto out; + + /* Log might have been flushed while we waited for the flush lock */ +@@ -1096,13 +1097,13 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) + goto out_withdraw; + + gfs2_ordered_write(sdp); +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + goto out_withdraw; + lops_before_commit(sdp, tr); +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + goto out_withdraw; + gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE); +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + goto out_withdraw; + + if (sdp->sd_log_head != sdp->sd_log_flush_head) { +@@ -1110,7 +1111,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) + } else if (sdp->sd_log_tail != sdp->sd_log_flush_tail && !sdp->sd_log_idle) { + log_write_header(sdp, flags); + } +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + goto out_withdraw; + lops_after_commit(sdp, tr); + +@@ -1128,7 +1129,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) + if (!(flags & GFS2_LOG_HEAD_FLUSH_NORMAL)) { + if (!sdp->sd_log_idle) { + empty_ail1_list(sdp); +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + goto out_withdraw; + log_write_header(sdp, flags); + } +@@ -1298,7 +1299,7 @@ int gfs2_logd(void *data) + unsigned long t = 1; + + while (!kthread_should_stop()) { +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + break; + + /* Check for errors writing to the journal */ +@@ -1337,7 +1338,7 @@ int gfs2_logd(void *data) + gfs2_ail_flush_reqd(sdp) || + gfs2_jrnl_flush_reqd(sdp) || + sdp->sd_log_error || +- gfs2_withdrawn(sdp) || ++ gfs2_withdrawing_or_withdrawn(sdp) || + kthread_should_stop(), + t); + } +diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c +index 50c2ecbba7ca7..1f42eae112fb8 100644 +--- a/fs/gfs2/meta_io.c ++++ b/fs/gfs2/meta_io.c +@@ -257,7 +257,8 @@ int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags, + struct buffer_head *bh, *bhs[2]; + int num = 0; + +- if (gfs2_withdrawn(sdp) && !gfs2_withdraw_in_prog(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp) && ++ !gfs2_withdraw_in_prog(sdp)) { + *bhp = NULL; + return -EIO; + } +@@ -315,7 +316,8 @@ int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags, + + int gfs2_meta_wait(struct gfs2_sbd *sdp, struct buffer_head *bh) + { +- if (gfs2_withdrawn(sdp) && !gfs2_withdraw_in_prog(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp) && ++ !gfs2_withdraw_in_prog(sdp)) + return -EIO; + + wait_on_buffer(bh); +@@ -326,7 +328,8 @@ int gfs2_meta_wait(struct gfs2_sbd *sdp, struct buffer_head *bh) + gfs2_io_error_bh_wd(sdp, bh); + return -EIO; + } +- if (gfs2_withdrawn(sdp) && !gfs2_withdraw_in_prog(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp) && ++ !gfs2_withdraw_in_prog(sdp)) + return -EIO; + + return 0; +diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c +index be7df57bd5c86..5d51bc58a9a03 100644 +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -1075,7 +1075,7 @@ static int gfs2_lm_mount(struct gfs2_sbd *sdp, int silent) + void gfs2_lm_unmount(struct gfs2_sbd *sdp) + { + const struct lm_lockops *lm = sdp->sd_lockstruct.ls_ops; +- if (!gfs2_withdrawn(sdp) && lm->lm_unmount) ++ if (!gfs2_withdrawing_or_withdrawn(sdp) && lm->lm_unmount) + lm->lm_unmount(sdp); + } + +diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c +index f689847bab40f..892b1c44de531 100644 +--- a/fs/gfs2/quota.c ++++ b/fs/gfs2/quota.c +@@ -128,7 +128,7 @@ static void gfs2_qd_dispose(struct gfs2_quota_data *qd) + hlist_bl_del_rcu(&qd->qd_hlist); + spin_unlock_bucket(qd->qd_hash); + +- if (!gfs2_withdrawn(sdp)) { ++ if (!gfs2_withdrawing_or_withdrawn(sdp)) { + gfs2_assert_warn(sdp, !qd->qd_change); + gfs2_assert_warn(sdp, !qd->qd_slot_ref); + gfs2_assert_warn(sdp, !qd->qd_bh_count); +@@ -1528,7 +1528,7 @@ static void quotad_error(struct gfs2_sbd *sdp, const char *msg, int error) + { + if (error == 0 || error == -EROFS) + return; +- if (!gfs2_withdrawn(sdp)) { ++ if (!gfs2_withdrawing_or_withdrawn(sdp)) { + if (!cmpxchg(&sdp->sd_log_error, 0, error)) + fs_err(sdp, "gfs2_quotad: %s error %d\n", msg, error); + wake_up(&sdp->sd_logd_waitq); +@@ -1572,7 +1572,7 @@ int gfs2_quotad(void *data) + unsigned long t = 0; + + while (!kthread_should_stop()) { +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + break; + + /* Update the master statfs file */ +@@ -1596,7 +1596,7 @@ int gfs2_quotad(void *data) + + t = wait_event_interruptible_timeout(sdp->sd_quota_wait, + sdp->sd_statfs_force_sync || +- gfs2_withdrawn(sdp) || ++ gfs2_withdrawing_or_withdrawn(sdp) || + kthread_should_stop(), + t); + +diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c +index 5aae02669a409..f4fe7039f725b 100644 +--- a/fs/gfs2/recovery.c ++++ b/fs/gfs2/recovery.c +@@ -411,7 +411,7 @@ void gfs2_recover_func(struct work_struct *work) + int error = 0; + int jlocked = 0; + +- if (gfs2_withdrawn(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp)) { + fs_err(sdp, "jid=%u: Recovery not attempted due to withdraw.\n", + jd->jd_jid); + goto fail; +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 1afcca5292d55..2e1d1eca4d14a 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -134,7 +134,7 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) + int error; + + j_gl->gl_ops->go_inval(j_gl, DIO_METADATA); +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + return -EIO; + + error = gfs2_find_jhead(sdp->sd_jdesc, &head, false); +@@ -153,7 +153,7 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) + gfs2_log_pointers_init(sdp, head.lh_blkno); + + error = gfs2_quota_init(sdp); +- if (!error && gfs2_withdrawn(sdp)) ++ if (!error && gfs2_withdrawing_or_withdrawn(sdp)) + error = -EIO; + if (!error) + set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); +@@ -499,7 +499,7 @@ static void gfs2_dirty_inode(struct inode *inode, int flags) + return; + } + +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + return; + if (!gfs2_glock_is_locked_by_me(ip->i_gl)) { + ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh); +@@ -605,7 +605,7 @@ static void gfs2_put_super(struct super_block *sb) + if (!sb_rdonly(sb)) + gfs2_make_fs_ro(sdp); + else { +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + gfs2_destroy_threads(sdp); + + gfs2_quota_cleanup(sdp); +@@ -682,7 +682,7 @@ static int gfs2_freeze_locally(struct gfs2_sbd *sdp) + if (test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)) { + gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_FREEZE | + GFS2_LFC_FREEZE_GO_SYNC); +- if (gfs2_withdrawn(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp)) { + error = thaw_super(sb, FREEZE_HOLDER_USERSPACE); + if (error) + return error; +diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c +index 60a0206890c54..250f340cb44d6 100644 +--- a/fs/gfs2/sys.c ++++ b/fs/gfs2/sys.c +@@ -193,7 +193,7 @@ static ssize_t freeze_store(struct gfs2_sbd *sdp, const char *buf, size_t len) + + static ssize_t withdraw_show(struct gfs2_sbd *sdp, char *buf) + { +- unsigned int b = gfs2_withdrawn(sdp); ++ unsigned int b = gfs2_withdrawing_or_withdrawn(sdp); + return snprintf(buf, PAGE_SIZE, "%u\n", b); + } + +diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c +index 1487fbb62d842..192213c7359af 100644 +--- a/fs/gfs2/trans.c ++++ b/fs/gfs2/trans.c +@@ -268,7 +268,7 @@ void gfs2_trans_add_meta(struct gfs2_glock *gl, struct buffer_head *bh) + (unsigned long long)bd->bd_bh->b_blocknr); + BUG(); + } +- if (gfs2_withdrawn(sdp)) { ++ if (gfs2_withdrawing_or_withdrawn(sdp)) { + fs_info(sdp, "GFS2:adding buf while withdrawn! 0x%llx\n", + (unsigned long long)bd->bd_bh->b_blocknr); + goto out_unlock; +diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c +index d424691bd3f8a..fc3ecb180ac53 100644 +--- a/fs/gfs2/util.c ++++ b/fs/gfs2/util.c +@@ -371,7 +371,7 @@ void gfs2_assert_withdraw_i(struct gfs2_sbd *sdp, char *assertion, + const char *function, char *file, unsigned int line, + bool delayed) + { +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + return; + + fs_err(sdp, +@@ -547,7 +547,7 @@ void gfs2_io_error_bh_i(struct gfs2_sbd *sdp, struct buffer_head *bh, + const char *function, char *file, unsigned int line, + bool withdraw) + { +- if (gfs2_withdrawn(sdp)) ++ if (gfs2_withdrawing_or_withdrawn(sdp)) + return; + + fs_err(sdp, "fatal: I/O error\n" +diff --git a/fs/gfs2/util.h b/fs/gfs2/util.h +index 76acf0b398149..ba071998461fd 100644 +--- a/fs/gfs2/util.h ++++ b/fs/gfs2/util.h +@@ -198,10 +198,11 @@ static inline void gfs2_withdraw_delayed(struct gfs2_sbd *sdp) + } + + /** +- * gfs2_withdrawn - test whether the file system is withdrawing or withdrawn ++ * gfs2_withdrawing_or_withdrawn - test whether the file system is withdrawing ++ * or withdrawn + * @sdp: the superblock + */ +-static inline bool gfs2_withdrawn(struct gfs2_sbd *sdp) ++static inline bool gfs2_withdrawing_or_withdrawn(struct gfs2_sbd *sdp) + { + return unlikely(test_bit(SDF_WITHDRAWN, &sdp->sd_flags) || + test_bit(SDF_WITHDRAWING, &sdp->sd_flags)); +-- +2.43.0 + diff --git a/queue-6.6/hid-amd_sfh-handle-no-sensors-in-pm-operations.patch b/queue-6.6/hid-amd_sfh-handle-no-sensors-in-pm-operations.patch new file mode 100644 index 00000000000..aff1b0c835f --- /dev/null +++ b/queue-6.6/hid-amd_sfh-handle-no-sensors-in-pm-operations.patch @@ -0,0 +1,52 @@ +From 139fa52bb085b1eaf0783591c80aa0dfb2efd4d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 12:40:44 +0530 +Subject: HID: amd_sfh: Handle "no sensors" in PM operations + +From: Basavaraj Natikar + +[ Upstream commit 077e3e3bc84a51891e732507bbbd9acf6e0e4c8b ] + +Resume or suspend each sensor device based on the num_hid_devices. +Therefore, add a check to handle the special case where no sensors are +present. + +Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c +index e9c6413af24a0..862ca8d072326 100644 +--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c ++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c +@@ -210,6 +210,11 @@ static void amd_sfh_resume(struct amd_mp2_dev *mp2) + struct amd_mp2_sensor_info info; + int i, status; + ++ if (!cl_data->is_any_sensor_enabled) { ++ amd_sfh_clear_intr(mp2); ++ return; ++ } ++ + for (i = 0; i < cl_data->num_hid_devices; i++) { + if (cl_data->sensor_sts[i] == SENSOR_DISABLED) { + info.sensor_idx = cl_data->sensor_idx[i]; +@@ -235,6 +240,11 @@ static void amd_sfh_suspend(struct amd_mp2_dev *mp2) + struct amdtp_cl_data *cl_data = mp2->cl_data; + int i, status; + ++ if (!cl_data->is_any_sensor_enabled) { ++ amd_sfh_clear_intr(mp2); ++ return; ++ } ++ + for (i = 0; i < cl_data->num_hid_devices; i++) { + if (cl_data->sensor_idx[i] != HPD_IDX && + cl_data->sensor_sts[i] == SENSOR_ENABLED) { +-- +2.43.0 + diff --git a/queue-6.6/hid-intel-ish-hid-ipc-add-check-for-pci_alloc_irq_ve.patch b/queue-6.6/hid-intel-ish-hid-ipc-add-check-for-pci_alloc_irq_ve.patch new file mode 100644 index 00000000000..2327e4f8c07 --- /dev/null +++ b/queue-6.6/hid-intel-ish-hid-ipc-add-check-for-pci_alloc_irq_ve.patch @@ -0,0 +1,41 @@ +From 0fdb1d155a5b7845e780edab54f22ed9d731b717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 16:54:22 +0800 +Subject: HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors + +From: Chen Ni + +[ Upstream commit 6baa4524027fd64d7ca524e1717c88c91a354b93 ] + +Add a check for the return value of pci_alloc_irq_vectors() and return +error if it fails. + +[jkosina@suse.com: reworded changelog based on Srinivas' suggestion] +Fixes: 74fbc7d371d9 ("HID: intel-ish-hid: add MSI interrupt support") +Signed-off-by: Chen Ni +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c +index 710fda5f19e1c..916d427163ca2 100644 +--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c ++++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c +@@ -216,6 +216,11 @@ static int ish_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + /* request and enable interrupt */ + ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES); ++ if (ret < 0) { ++ dev_err(dev, "ISH: Failed to allocate IRQ vectors\n"); ++ return ret; ++ } ++ + if (!pdev->msi_enabled && !pdev->msix_enabled) + irq_flag = IRQF_SHARED; + +-- +2.43.0 + diff --git a/queue-6.6/hid-mcp-2221-cancel-delayed_work-only-when-config_ii.patch b/queue-6.6/hid-mcp-2221-cancel-delayed_work-only-when-config_ii.patch new file mode 100644 index 00000000000..7272aa87339 --- /dev/null +++ b/queue-6.6/hid-mcp-2221-cancel-delayed_work-only-when-config_ii.patch @@ -0,0 +1,40 @@ +From 8f4f72b0017813af547b22c5391330b3d07ac508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 14:14:06 +0200 +Subject: HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled + +From: Abdelrahman Morsy + +[ Upstream commit 3cba9cfcc1520a2307a29f6fab887bcfc121c417 ] + +If the device is unplugged and CONFIG_IIO is not supported, this will +result in a warning message at kernel/workqueue. + +Only cancel delayed work in mcp2221_remove(), when CONFIG_IIO is enabled. + +Signed-off-by: Abdelrahman Morsy +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-mcp2221.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c +index aef0785c91cc2..c5bfca8ac5e6e 100644 +--- a/drivers/hid/hid-mcp2221.c ++++ b/drivers/hid/hid-mcp2221.c +@@ -922,9 +922,11 @@ static void mcp2221_hid_unregister(void *ptr) + /* This is needed to be sure hid_hw_stop() isn't called twice by the subsystem */ + static void mcp2221_remove(struct hid_device *hdev) + { ++#if IS_REACHABLE(CONFIG_IIO) + struct mcp2221 *mcp = hid_get_drvdata(hdev); + + cancel_delayed_work_sync(&mcp->init_work); ++#endif + } + + #if IS_REACHABLE(CONFIG_IIO) +-- +2.43.0 + diff --git a/queue-6.6/ib-mlx5-use-__iowrite64_copy-for-write-combining-sto.patch b/queue-6.6/ib-mlx5-use-__iowrite64_copy-for-write-combining-sto.patch new file mode 100644 index 00000000000..8650170f115 --- /dev/null +++ b/queue-6.6/ib-mlx5-use-__iowrite64_copy-for-write-combining-sto.patch @@ -0,0 +1,83 @@ +From 21cfa1defe61d9325d8db6efd0afd1b83372439d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 13:46:19 -0300 +Subject: IB/mlx5: Use __iowrite64_copy() for write combining stores + +From: Jason Gunthorpe + +[ Upstream commit ef302283ddfceaba2657923af3f90fd58e6dff06 ] + +mlx5 has a built in self-test at driver startup to evaluate if the +platform supports write combining to generate a 64 byte PCIe TLP or +not. This has proven necessary because a lot of common scenarios end up +with broken write combining (especially inside virtual machines) and there +is other way to learn this information. + +This self test has been consistently failing on new ARM64 CPU +designs (specifically with NVIDIA Grace's implementation of Neoverse +V2). The C loop around writeq() generates some pretty terrible ARM64 +assembly, but historically this has worked on a lot of existing ARM64 CPUs +till now. + +We see it succeed about 1 time in 10,000 on the worst effected +systems. The CPU architects speculate that the load instructions +interspersed with the stores makes the WC buffers statistically flush too +often and thus the generation of large TLPs becomes infrequent. This makes +the boot up test unreliable in that it indicates no write-combining, +however userspace would be fine since it uses a ST4 instruction. + +Further, S390 has similar issues where only the special zpci_memcpy_toio() +will actually generate large TLPs, and the open coded loop does not +trigger it at all. + +Fix both ARM64 and S390 by switching to __iowrite64_copy() which now +provides architecture specific variants that have a high change of +generating a large TLP with write combining. x86 continues to use a +similar writeq loop in the generate __iowrite64_copy(). + +Fixes: 11f552e21755 ("IB/mlx5: Test write combining support") +Link: https://lore.kernel.org/r/6-v3-1893cd8b9369+1925-mlx5_arm_wc_jgg@nvidia.com +Tested-by: Niklas Schnelle +Acked-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mem.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c +index 96ffbbaf0a73d..5a22be14d958f 100644 +--- a/drivers/infiniband/hw/mlx5/mem.c ++++ b/drivers/infiniband/hw/mlx5/mem.c +@@ -30,6 +30,7 @@ + * SOFTWARE. + */ + ++#include + #include + #include "mlx5_ib.h" + #include +@@ -108,7 +109,6 @@ static int post_send_nop(struct mlx5_ib_dev *dev, struct ib_qp *ibqp, u64 wr_id, + __be32 mmio_wqe[16] = {}; + unsigned long flags; + unsigned int idx; +- int i; + + if (unlikely(dev->mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)) + return -EIO; +@@ -148,10 +148,8 @@ static int post_send_nop(struct mlx5_ib_dev *dev, struct ib_qp *ibqp, u64 wr_id, + * we hit doorbell + */ + wmb(); +- for (i = 0; i < 8; i++) +- mlx5_write64(&mmio_wqe[i * 2], +- bf->bfreg->map + bf->offset + i * 8); +- io_stop_wc(); ++ __iowrite64_copy(bf->bfreg->map + bf->offset, mmio_wqe, ++ sizeof(mmio_wqe) / 8); + + bf->offset ^= bf->buf_size; + +-- +2.43.0 + diff --git a/queue-6.6/input-xpad-add-support-for-asus-rog-raikiri.patch b/queue-6.6/input-xpad-add-support-for-asus-rog-raikiri.patch new file mode 100644 index 00000000000..c7f1b98d004 --- /dev/null +++ b/queue-6.6/input-xpad-add-support-for-asus-rog-raikiri.patch @@ -0,0 +1,42 @@ +From b5a6e8da95198f970ae44645f1c75357f0db9e87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 20:53:45 -0700 +Subject: Input: xpad - add support for ASUS ROG RAIKIRI + +From: Vicki Pfau + +[ Upstream commit be81415a32ef6d8a8a85529fcfac03d05b3e757d ] + +Add the VID/PID for ASUS ROG RAIKIRI to xpad_device and the VID to xpad_table + +Signed-off-by: Vicki Pfau +Link: https://lore.kernel.org/r/20240404035345.159643-1-vi@endrift.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 9206253422016..cd97a7a9f812d 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -207,6 +207,7 @@ static const struct xpad_device { + { 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 }, + { 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 }, + { 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 }, ++ { 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", 0, XTYPE_XBOXONE }, + { 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX }, + { 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX }, + { 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX }, +@@ -482,6 +483,7 @@ static const struct usb_device_id xpad_table[] = { + { USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */ + XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */ + XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz Gamepad */ ++ XPAD_XBOXONE_VENDOR(0x0b05), /* ASUS controllers */ + XPAD_XBOX360_VENDOR(0x0c12), /* Zeroplus X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x0e6f), /* 0x0e6f Xbox 360 controllers */ + XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f Xbox One controllers */ +-- +2.43.0 + diff --git a/queue-6.6/io-wq-write-next_work-before-dropping-acct_lock.patch b/queue-6.6/io-wq-write-next_work-before-dropping-acct_lock.patch new file mode 100644 index 00000000000..e8111f1b7f4 --- /dev/null +++ b/queue-6.6/io-wq-write-next_work-before-dropping-acct_lock.patch @@ -0,0 +1,76 @@ +From d081bd376b39336e837aa3b30e5f7856560a392b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 22:10:53 -0400 +Subject: io-wq: write next_work before dropping acct_lock + +From: Gabriel Krisman Bertazi + +[ Upstream commit 068c27e32e51e94e4a9eb30ae85f4097a3602980 ] + +Commit 361aee450c6e ("io-wq: add intermediate work step between pending +list and active work") closed a race between a cancellation and the work +being removed from the wq for execution. To ensure the request is +always reachable by the cancellation, we need to move it within the wq +lock, which also synchronizes the cancellation. But commit +42abc95f05bf ("io-wq: decouple work_list protection from the big +wqe->lock") replaced the wq lock here and accidentally reintroduced the +race by releasing the acct_lock too early. + +In other words: + + worker | cancellation +work = io_get_next_work() | +raw_spin_unlock(&acct->lock); | + | + | io_acct_cancel_pending_work + | io_wq_worker_cancel() +worker->next_work = work + +Using acct_lock is still enough since we synchronize on it on +io_acct_cancel_pending_work. + +Fixes: 42abc95f05bf ("io-wq: decouple work_list protection from the big wqe->lock") +Signed-off-by: Gabriel Krisman Bertazi +Link: https://lore.kernel.org/r/20240416021054.3940-2-krisman@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io-wq.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c +index 522196dfb0ff5..318ed067dbf64 100644 +--- a/io_uring/io-wq.c ++++ b/io_uring/io-wq.c +@@ -564,10 +564,7 @@ static void io_worker_handle_work(struct io_wq_acct *acct, + * clear the stalled flag. + */ + work = io_get_next_work(acct, worker); +- raw_spin_unlock(&acct->lock); + if (work) { +- __io_worker_busy(wq, worker); +- + /* + * Make sure cancelation can find this, even before + * it becomes the active work. That avoids a window +@@ -578,9 +575,15 @@ static void io_worker_handle_work(struct io_wq_acct *acct, + raw_spin_lock(&worker->lock); + worker->next_work = work; + raw_spin_unlock(&worker->lock); +- } else { +- break; + } ++ ++ raw_spin_unlock(&acct->lock); ++ ++ if (!work) ++ break; ++ ++ __io_worker_busy(wq, worker); ++ + io_assign_current_work(worker, work); + __set_current_state(TASK_RUNNING); + +-- +2.43.0 + diff --git a/queue-6.6/io_uring-use-the-right-type-for-work_llist-empty-che.patch b/queue-6.6/io_uring-use-the-right-type-for-work_llist-empty-che.patch new file mode 100644 index 00000000000..f75aa8cac63 --- /dev/null +++ b/queue-6.6/io_uring-use-the-right-type-for-work_llist-empty-che.patch @@ -0,0 +1,37 @@ +From 6bd8c2729eec41c5f4bffe7499deb14a53118631 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 18:53:33 -0600 +Subject: io_uring: use the right type for work_llist empty check + +From: Jens Axboe + +[ Upstream commit 22537c9f79417fed70b352d54d01d2586fee9521 ] + +io_task_work_pending() uses wq_list_empty() on ctx->work_llist, but it's +not an io_wq_work_list, it's a struct llist_head. They both have +->first as head-of-list, and it turns out the checks are identical. But +be proper and use the right helper. + +Fixes: dac6a0eae793 ("io_uring: ensure iopoll runs local task work as well") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h +index 411c883b37a95..19ac1b2f1ea45 100644 +--- a/io_uring/io_uring.h ++++ b/io_uring/io_uring.h +@@ -304,7 +304,7 @@ static inline int io_run_task_work(void) + + static inline bool io_task_work_pending(struct io_ring_ctx *ctx) + { +- return task_work_pending(current) || !wq_list_empty(&ctx->work_llist); ++ return task_work_pending(current) || !llist_empty(&ctx->work_llist); + } + + static inline void io_tw_lock(struct io_ring_ctx *ctx, struct io_tw_state *ts) +-- +2.43.0 + diff --git a/queue-6.6/iommu-undo-pasid-attachment-only-for-the-devices-tha.patch b/queue-6.6/iommu-undo-pasid-attachment-only-for-the-devices-tha.patch new file mode 100644 index 00000000000..479e7b1d62a --- /dev/null +++ b/queue-6.6/iommu-undo-pasid-attachment-only-for-the-devices-tha.patch @@ -0,0 +1,86 @@ +From 7a4893e8601835b165a2edd26c7dbf9bf062ea6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 05:29:57 -0700 +Subject: iommu: Undo pasid attachment only for the devices that have succeeded + +From: Yi Liu + +[ Upstream commit b025dea63cded0d82bccd591fa105d39efc6435d ] + +There is no error handling now in __iommu_set_group_pasid(), it relies on +its caller to loop all the devices to undo the pasid attachment. This is +not self-contained and has drawbacks. It would result in unnecessary +remove_dev_pasid() calls on the devices that have not been attached to the +new domain. But the remove_dev_pasid() callback would get the new domain +from the group->pasid_array. So for such devices, the iommu driver won't +find the attachment under the domain, hence unable to do cleanup. This may +not be a real problem today. But it depends on the implementation of the +underlying iommu driver. e.g. the intel iommu driver would warn for such +devices. Such warnings are unnecessary. + +To solve the above problem, it is necessary to handle the error within +__iommu_set_group_pasid(). It only loops the devices that have attached +to the new domain, and undo it. + +Fixes: 16603704559c ("iommu: Add attach/detach_dev_pasid iommu interfaces") +Suggested-by: Jason Gunthorpe +Reviewed-by: Jason Gunthorpe +Reviewed-by: Kevin Tian +Signed-off-by: Yi Liu +Reviewed-by: Lu Baolu +Link: https://lore.kernel.org/r/20240328122958.83332-2-yi.l.liu@intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 3a67e636287a7..3f1029c0825e9 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -3369,15 +3369,26 @@ EXPORT_SYMBOL_GPL(iommu_group_dma_owner_claimed); + static int __iommu_set_group_pasid(struct iommu_domain *domain, + struct iommu_group *group, ioasid_t pasid) + { +- struct group_device *device; +- int ret = 0; ++ struct group_device *device, *last_gdev; ++ int ret; + + for_each_group_device(group, device) { + ret = domain->ops->set_dev_pasid(domain, device->dev, pasid); + if (ret) +- break; ++ goto err_revert; + } + ++ return 0; ++ ++err_revert: ++ last_gdev = device; ++ for_each_group_device(group, device) { ++ const struct iommu_ops *ops = dev_iommu_ops(device->dev); ++ ++ if (device == last_gdev) ++ break; ++ ops->remove_dev_pasid(device->dev, pasid); ++ } + return ret; + } + +@@ -3423,10 +3434,8 @@ int iommu_attach_device_pasid(struct iommu_domain *domain, + } + + ret = __iommu_set_group_pasid(domain, group, pasid); +- if (ret) { +- __iommu_remove_group_pasid(group, pasid); ++ if (ret) + xa_erase(&group->pasid_array, pasid); +- } + out_unlock: + mutex_unlock(&group->mutex); + iommu_group_put(group); +-- +2.43.0 + diff --git a/queue-6.6/ipv6-sr-add-missing-seg6_local_exit.patch b/queue-6.6/ipv6-sr-add-missing-seg6_local_exit.patch new file mode 100644 index 00000000000..ead3406812b --- /dev/null +++ b/queue-6.6/ipv6-sr-add-missing-seg6_local_exit.patch @@ -0,0 +1,38 @@ +From 711f94450f89a1333d879d612a43042b7c10e411 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 21:18:10 +0800 +Subject: ipv6: sr: add missing seg6_local_exit + +From: Hangbin Liu + +[ Upstream commit 3321687e321307629c71b664225b861ebf3e5753 ] + +Currently, we only call seg6_local_exit() in seg6_init() if +seg6_local_init() failed. But forgot to call it in seg6_exit(). + +Fixes: d1df6fd8a1d2 ("ipv6: sr: define core operations for seg6local lightweight tunnel") +Signed-off-by: Hangbin Liu +Reviewed-by: Sabrina Dubroca +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20240509131812.1662197-2-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index 35508abd76f43..5423f1f2aa626 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -564,6 +564,7 @@ void seg6_exit(void) + seg6_hmac_exit(); + #endif + #ifdef CONFIG_IPV6_SEG6_LWTUNNEL ++ seg6_local_exit(); + seg6_iptunnel_exit(); + #endif + unregister_pernet_subsys(&ip6_segments_ops); +-- +2.43.0 + diff --git a/queue-6.6/ipv6-sr-fix-incorrect-unregister-order.patch b/queue-6.6/ipv6-sr-fix-incorrect-unregister-order.patch new file mode 100644 index 00000000000..d04f8c728a4 --- /dev/null +++ b/queue-6.6/ipv6-sr-fix-incorrect-unregister-order.patch @@ -0,0 +1,39 @@ +From 3e95e564f790a5e1507f0f25989e2df8c1512cab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 21:18:11 +0800 +Subject: ipv6: sr: fix incorrect unregister order + +From: Hangbin Liu + +[ Upstream commit 6e370a771d2985107e82d0f6174381c1acb49c20 ] + +Commit 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and +null-ptr-deref") changed the register order in seg6_init(). But the +unregister order in seg6_exit() is not updated. + +Fixes: 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref") +Signed-off-by: Hangbin Liu +Reviewed-by: Sabrina Dubroca +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20240509131812.1662197-3-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index 5423f1f2aa626..c4ef96c8fdaca 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -567,6 +567,6 @@ void seg6_exit(void) + seg6_local_exit(); + seg6_iptunnel_exit(); + #endif +- unregister_pernet_subsys(&ip6_segments_ops); + genl_unregister_family(&seg6_genl_family); ++ unregister_pernet_subsys(&ip6_segments_ops); + } +-- +2.43.0 + diff --git a/queue-6.6/ipv6-sr-fix-invalid-unregister-error-path.patch b/queue-6.6/ipv6-sr-fix-invalid-unregister-error-path.patch new file mode 100644 index 00000000000..38c69af86de --- /dev/null +++ b/queue-6.6/ipv6-sr-fix-invalid-unregister-error-path.patch @@ -0,0 +1,46 @@ +From ffdc4b1b124b0552cb68d5f6ee10af1f63443de9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 21:18:12 +0800 +Subject: ipv6: sr: fix invalid unregister error path + +From: Hangbin Liu + +[ Upstream commit 160e9d2752181fcf18c662e74022d77d3164cd45 ] + +The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL +is not defined. In that case if seg6_hmac_init() fails, the +genl_unregister_family() isn't called. + +This issue exist since commit 46738b1317e1 ("ipv6: sr: add option to control +lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible +use-after-free and null-ptr-deref") replaced unregister_pernet_subsys() +with genl_unregister_family() in this error path. + +Fixes: 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support") +Reported-by: Guillaume Nault +Signed-off-by: Hangbin Liu +Reviewed-by: Sabrina Dubroca +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20240509131812.1662197-4-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index c4ef96c8fdaca..a31521e270f78 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -551,6 +551,8 @@ int __init seg6_init(void) + #endif + #ifdef CONFIG_IPV6_SEG6_LWTUNNEL + out_unregister_genl: ++#endif ++#if IS_ENABLED(CONFIG_IPV6_SEG6_LWTUNNEL) || IS_ENABLED(CONFIG_IPV6_SEG6_HMAC) + genl_unregister_family(&seg6_genl_family); + #endif + out_unregister_pernet: +-- +2.43.0 + diff --git a/queue-6.6/irqchip-alpine-msi-fix-off-by-one-in-allocation-erro.patch b/queue-6.6/irqchip-alpine-msi-fix-off-by-one-in-allocation-erro.patch new file mode 100644 index 00000000000..59d6c0373c5 --- /dev/null +++ b/queue-6.6/irqchip-alpine-msi-fix-off-by-one-in-allocation-erro.patch @@ -0,0 +1,40 @@ +From d83f9e0797c7bddd298d22e4417e15c6bf11d5cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 22:23:05 +0800 +Subject: irqchip/alpine-msi: Fix off-by-one in allocation error path + +From: Zenghui Yu + +[ Upstream commit ff3669a71afa06208de58d6bea1cc49d5e3fcbd1 ] + +When alpine_msix_gic_domain_alloc() fails, there is an off-by-one in the +number of interrupts to be freed. + +Fix it by passing the number of successfully allocated interrupts, instead +of the relative index of the last allocated one. + +Fixes: 3841245e8498 ("irqchip/alpine-msi: Fix freeing of interrupts on allocation error path") +Signed-off-by: Zenghui Yu +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20240327142305.1048-1-yuzenghui@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-alpine-msi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c +index 9c8b1349ee17b..a1430ab60a8a3 100644 +--- a/drivers/irqchip/irq-alpine-msi.c ++++ b/drivers/irqchip/irq-alpine-msi.c +@@ -165,7 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain, + return 0; + + err_sgi: +- irq_domain_free_irqs_parent(domain, virq, i - 1); ++ irq_domain_free_irqs_parent(domain, virq, i); + alpine_msix_free_sgi(priv, sgi, nr_irqs); + return err; + } +-- +2.43.0 + diff --git a/queue-6.6/irqchip-loongson-pch-msi-fix-off-by-one-on-allocatio.patch b/queue-6.6/irqchip-loongson-pch-msi-fix-off-by-one-on-allocatio.patch new file mode 100644 index 00000000000..ccef311c572 --- /dev/null +++ b/queue-6.6/irqchip-loongson-pch-msi-fix-off-by-one-on-allocatio.patch @@ -0,0 +1,41 @@ +From 3988e882677a9bfcb4a952b24a5f878347b27575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 22:23:34 +0800 +Subject: irqchip/loongson-pch-msi: Fix off-by-one on allocation error path + +From: Zenghui Yu + +[ Upstream commit b327708798809328f21da8dc14cc8883d1e8a4b3 ] + +When pch_msi_parent_domain_alloc() returns an error, there is an off-by-one +in the number of interrupts to be freed. + +Fix it by passing the number of successfully allocated interrupts, instead of the +relative index of the last allocated one. + +Fixes: 632dcc2c75ef ("irqchip: Add Loongson PCH MSI controller") +Signed-off-by: Zenghui Yu +Signed-off-by: Thomas Gleixner +Reviewed-by: Jiaxun Yang +Link: https://lore.kernel.org/r/20240327142334.1098-1-yuzenghui@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-loongson-pch-msi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-loongson-pch-msi.c b/drivers/irqchip/irq-loongson-pch-msi.c +index 6e1e1f011bb29..dd4d699170f4e 100644 +--- a/drivers/irqchip/irq-loongson-pch-msi.c ++++ b/drivers/irqchip/irq-loongson-pch-msi.c +@@ -136,7 +136,7 @@ static int pch_msi_middle_domain_alloc(struct irq_domain *domain, + + err_hwirq: + pch_msi_free_hwirq(priv, hwirq, nr_irqs); +- irq_domain_free_irqs_parent(domain, virq, i - 1); ++ irq_domain_free_irqs_parent(domain, virq, i); + + return err; + } +-- +2.43.0 + diff --git a/queue-6.6/jffs2-prevent-xattr-node-from-overflowing-the-eraseb.patch b/queue-6.6/jffs2-prevent-xattr-node-from-overflowing-the-eraseb.patch new file mode 100644 index 00000000000..08f76fd5781 --- /dev/null +++ b/queue-6.6/jffs2-prevent-xattr-node-from-overflowing-the-eraseb.patch @@ -0,0 +1,81 @@ +From aadeaadfccf5bae44bb748b9b644fc8742289a94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 18:53:54 +0300 +Subject: jffs2: prevent xattr node from overflowing the eraseblock + +From: Ilya Denisyev + +[ Upstream commit c6854e5a267c28300ff045480b5a7ee7f6f1d913 ] + +Add a check to make sure that the requested xattr node size is no larger +than the eraseblock minus the cleanmarker. + +Unlike the usual inode nodes, the xattr nodes aren't split into parts +and spread across multiple eraseblocks, which means that a xattr node +must not occupy more than one eraseblock. If the requested xattr value is +too large, the xattr node can spill onto the next eraseblock, overwriting +the nodes and causing errors such as: + +jffs2: argh. node added in wrong place at 0x0000b050(2) +jffs2: nextblock 0x0000a000, expected at 0000b00c +jffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050, +read=0xfc892c93, calc=0x000000 +jffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed +at 0x01e00c. {848f,2fc4,0fef511f,59a3d171} +jffs2: Node at 0x0000000c with length 0x00001044 would run over the +end of the erase block +jffs2: Perhaps the file system was created with the wrong erase size? +jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found +at 0x00000010: 0x1044 instead + +This breaks the filesystem and can lead to KASAN crashes such as: + +BUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0 +Read of size 4 at addr ffff88802c31e914 by task repro/830 +CPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), +BIOS Arch Linux 1.16.3-1-1 04/01/2014 +Call Trace: + + dump_stack_lvl+0xc6/0x120 + print_report+0xc4/0x620 + ? __virt_addr_valid+0x308/0x5b0 + kasan_report+0xc1/0xf0 + ? jffs2_sum_add_kvec+0x125e/0x15d0 + ? jffs2_sum_add_kvec+0x125e/0x15d0 + jffs2_sum_add_kvec+0x125e/0x15d0 + jffs2_flash_direct_writev+0xa8/0xd0 + jffs2_flash_writev+0x9c9/0xef0 + ? __x64_sys_setxattr+0xc4/0x160 + ? do_syscall_64+0x69/0x140 + ? entry_SYSCALL_64_after_hwframe+0x76/0x7e + [...] + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: aa98d7cf59b5 ("[JFFS2][XATTR] XATTR support on JFFS2 (version. 5)") +Signed-off-by: Ilya Denisyev +Link: https://lore.kernel.org/r/20240412155357.237803-1-dev@elkcl.ru +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/jffs2/xattr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c +index 3b6bdc9a49e1b..23c1f6a120f0c 100644 +--- a/fs/jffs2/xattr.c ++++ b/fs/jffs2/xattr.c +@@ -1110,6 +1110,9 @@ int do_jffs2_setxattr(struct inode *inode, int xprefix, const char *xname, + return rc; + + request = PAD(sizeof(struct jffs2_raw_xattr) + strlen(xname) + 1 + size); ++ if (request > c->sector_size - c->cleanmarker_size) ++ return -ERANGE; ++ + rc = jffs2_reserve_space(c, request, &length, + ALLOC_NORMAL, JFFS2_SUMMARY_XATTR_SIZE); + if (rc) { +-- +2.43.0 + diff --git a/queue-6.6/kernel-numa.c-move-logging-out-of-numa.h.patch b/queue-6.6/kernel-numa.c-move-logging-out-of-numa.h.patch new file mode 100644 index 00000000000..0459fffb3b7 --- /dev/null +++ b/queue-6.6/kernel-numa.c-move-logging-out-of-numa.h.patch @@ -0,0 +1,121 @@ +From 5d4b3d480f62e846b21347c9d0d17eedc706c45a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 13:27:00 -0500 +Subject: kernel/numa.c: Move logging out of numa.h + +From: Kent Overstreet + +[ Upstream commit d7a73e3f089204aee3393687e23fd45a22657b08 ] + +Moving these stub functions to a .c file means we can kill a sched.h +dependency on printk.h. + +Signed-off-by: Kent Overstreet +Stable-dep-of: f9f67e5adc8d ("x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks()") +Signed-off-by: Sasha Levin +--- + include/linux/numa.h | 19 ++++++------------- + kernel/Makefile | 1 + + kernel/numa.c | 26 ++++++++++++++++++++++++++ + 3 files changed, 33 insertions(+), 13 deletions(-) + create mode 100644 kernel/numa.c + +diff --git a/include/linux/numa.h b/include/linux/numa.h +index a904861de8000..915033a757315 100644 +--- a/include/linux/numa.h ++++ b/include/linux/numa.h +@@ -1,6 +1,7 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + #ifndef _LINUX_NUMA_H + #define _LINUX_NUMA_H ++#include + #include + + #ifdef CONFIG_NODES_SHIFT +@@ -22,34 +23,26 @@ + #endif + + #ifdef CONFIG_NUMA +-#include + #include + + /* Generic implementation available */ + int numa_nearest_node(int node, unsigned int state); + + #ifndef memory_add_physaddr_to_nid +-static inline int memory_add_physaddr_to_nid(u64 start) +-{ +- pr_info_once("Unknown online node for memory at 0x%llx, assuming node 0\n", +- start); +- return 0; +-} ++int memory_add_physaddr_to_nid(u64 start); + #endif ++ + #ifndef phys_to_target_node +-static inline int phys_to_target_node(u64 start) +-{ +- pr_info_once("Unknown target node for memory at 0x%llx, assuming node 0\n", +- start); +- return 0; +-} ++int phys_to_target_node(u64 start); + #endif ++ + #ifndef numa_fill_memblks + static inline int __init numa_fill_memblks(u64 start, u64 end) + { + return NUMA_NO_MEMBLK; + } + #endif ++ + #else /* !CONFIG_NUMA */ + static inline int numa_nearest_node(int node, unsigned int state) + { +diff --git a/kernel/Makefile b/kernel/Makefile +index 3947122d618bf..ce105a5558fcf 100644 +--- a/kernel/Makefile ++++ b/kernel/Makefile +@@ -114,6 +114,7 @@ obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o + obj-$(CONFIG_HAVE_STATIC_CALL) += static_call.o + obj-$(CONFIG_HAVE_STATIC_CALL_INLINE) += static_call_inline.o + obj-$(CONFIG_CFI_CLANG) += cfi.o ++obj-$(CONFIG_NUMA) += numa.o + + obj-$(CONFIG_PERF_EVENTS) += events/ + +diff --git a/kernel/numa.c b/kernel/numa.c +new file mode 100644 +index 0000000000000..67ca6b8585c06 +--- /dev/null ++++ b/kernel/numa.c +@@ -0,0 +1,26 @@ ++// SPDX-License-Identifier: GPL-2.0-or-later ++ ++#include ++#include ++ ++/* Stub functions: */ ++ ++#ifndef memory_add_physaddr_to_nid ++int memory_add_physaddr_to_nid(u64 start) ++{ ++ pr_info_once("Unknown online node for memory at 0x%llx, assuming node 0\n", ++ start); ++ return 0; ++} ++EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid); ++#endif ++ ++#ifndef phys_to_target_node ++int phys_to_target_node(u64 start) ++{ ++ pr_info_once("Unknown target node for memory at 0x%llx, assuming node 0\n", ++ start); ++ return 0; ++} ++EXPORT_SYMBOL_GPL(phys_to_target_node); ++#endif +-- +2.43.0 + diff --git a/queue-6.6/ksmbd-fix-uninitialized-symbol-share-in-smb2_tree_co.patch b/queue-6.6/ksmbd-fix-uninitialized-symbol-share-in-smb2_tree_co.patch new file mode 100644 index 00000000000..40fe3f3df24 --- /dev/null +++ b/queue-6.6/ksmbd-fix-uninitialized-symbol-share-in-smb2_tree_co.patch @@ -0,0 +1,46 @@ +From 35474a8a2b6a5f07611c9d69e36c642a5bb77f84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 16:57:01 +0900 +Subject: ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect() + +From: Namjae Jeon + +[ Upstream commit bc642d7bfdac3bfd838a1cd6651955ae2eb8535a ] + +Fix uninitialized symbol 'share' in smb2_tree_connect(). + +Fixes: e9d8c2f95ab8 ("ksmbd: add continuous availability share parameter") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 1e536ae277618..6a15c5d64f415 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1926,7 +1926,7 @@ int smb2_tree_connect(struct ksmbd_work *work) + struct ksmbd_session *sess = work->sess; + char *treename = NULL, *name = NULL; + struct ksmbd_tree_conn_status status; +- struct ksmbd_share_config *share; ++ struct ksmbd_share_config *share = NULL; + int rc = -EINVAL; + + WORK_BUFFERS(work, req, rsp); +@@ -1988,7 +1988,7 @@ int smb2_tree_connect(struct ksmbd_work *work) + write_unlock(&sess->tree_conns_lock); + rsp->StructureSize = cpu_to_le16(16); + out_err1: +- if (server_conf.flags & KSMBD_GLOBAL_FLAG_DURABLE_HANDLE && ++ if (server_conf.flags & KSMBD_GLOBAL_FLAG_DURABLE_HANDLE && share && + test_share_config_flag(share, + KSMBD_SHARE_FLAG_CONTINUOUS_AVAILABILITY)) + rsp->Capabilities = SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY; +-- +2.43.0 + diff --git a/queue-6.6/kunit-fix-kthread-reference.patch b/queue-6.6/kunit-fix-kthread-reference.patch new file mode 100644 index 00000000000..6b2138d3143 --- /dev/null +++ b/queue-6.6/kunit-fix-kthread-reference.patch @@ -0,0 +1,70 @@ +From bedf87676312e5eee477bb9eda21e49544e28b29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 09:46:20 +0200 +Subject: kunit: Fix kthread reference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit f8aa1b98ce40184521ed95ec26cc115a255183b2 ] + +There is a race condition when a kthread finishes after the deadline and +before the call to kthread_stop(), which may lead to use after free. + +Cc: Brendan Higgins +Cc: Shuah Khan +Reviewed-by: Kees Cook +Fixes: adf505457032 ("kunit: fix UAF when run kfence test case test_gfpzero") +Reviewed-by: David Gow +Reviewed-by: Rae Moar +Signed-off-by: Mickaël Salaün +Link: https://lore.kernel.org/r/20240408074625.65017-3-mic@digikod.net +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + lib/kunit/try-catch.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c +index f7825991d576a..d9d1df28cc52e 100644 +--- a/lib/kunit/try-catch.c ++++ b/lib/kunit/try-catch.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include "try-catch-impl.h" + +@@ -65,13 +66,14 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) + try_catch->context = context; + try_catch->try_completion = &try_completion; + try_catch->try_result = 0; +- task_struct = kthread_run(kunit_generic_run_threadfn_adapter, +- try_catch, +- "kunit_try_catch_thread"); ++ task_struct = kthread_create(kunit_generic_run_threadfn_adapter, ++ try_catch, "kunit_try_catch_thread"); + if (IS_ERR(task_struct)) { + try_catch->catch(try_catch->context); + return; + } ++ get_task_struct(task_struct); ++ wake_up_process(task_struct); + + time_remaining = wait_for_completion_timeout(&try_completion, + kunit_test_timeout()); +@@ -81,6 +83,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) + kthread_stop(task_struct); + } + ++ put_task_struct(task_struct); + exit_code = try_catch->try_result; + + if (!exit_code) +-- +2.43.0 + diff --git a/queue-6.6/kunit-fortify-fix-mismatched-kvalloc-vfree-usage.patch b/queue-6.6/kunit-fortify-fix-mismatched-kvalloc-vfree-usage.patch new file mode 100644 index 00000000000..91bc3d9c9f7 --- /dev/null +++ b/queue-6.6/kunit-fortify-fix-mismatched-kvalloc-vfree-usage.patch @@ -0,0 +1,64 @@ +From a449174f771ce19c688e70c967800a26dac9b559 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 16:06:22 -0700 +Subject: kunit/fortify: Fix mismatched kvalloc()/vfree() usage + +From: Kees Cook + +[ Upstream commit 998b18072ceb0613629c256b409f4d299829c7ec ] + +The kv*() family of tests were accidentally freeing with vfree() instead +of kvfree(). Use kvfree() instead. + +Fixes: 9124a2640148 ("kunit/fortify: Validate __alloc_size attribute results") +Link: https://lore.kernel.org/r/20240425230619.work.299-kees@kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + lib/fortify_kunit.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/lib/fortify_kunit.c b/lib/fortify_kunit.c +index c8c33cbaae9ec..24f8d6fda2b3b 100644 +--- a/lib/fortify_kunit.c ++++ b/lib/fortify_kunit.c +@@ -228,28 +228,28 @@ DEFINE_ALLOC_SIZE_TEST_PAIR(vmalloc) + \ + checker((expected_pages) * PAGE_SIZE, \ + kvmalloc((alloc_pages) * PAGE_SIZE, gfp), \ +- vfree(p)); \ ++ kvfree(p)); \ + checker((expected_pages) * PAGE_SIZE, \ + kvmalloc_node((alloc_pages) * PAGE_SIZE, gfp, NUMA_NO_NODE), \ +- vfree(p)); \ ++ kvfree(p)); \ + checker((expected_pages) * PAGE_SIZE, \ + kvzalloc((alloc_pages) * PAGE_SIZE, gfp), \ +- vfree(p)); \ ++ kvfree(p)); \ + checker((expected_pages) * PAGE_SIZE, \ + kvzalloc_node((alloc_pages) * PAGE_SIZE, gfp, NUMA_NO_NODE), \ +- vfree(p)); \ ++ kvfree(p)); \ + checker((expected_pages) * PAGE_SIZE, \ + kvcalloc(1, (alloc_pages) * PAGE_SIZE, gfp), \ +- vfree(p)); \ ++ kvfree(p)); \ + checker((expected_pages) * PAGE_SIZE, \ + kvcalloc((alloc_pages) * PAGE_SIZE, 1, gfp), \ +- vfree(p)); \ ++ kvfree(p)); \ + checker((expected_pages) * PAGE_SIZE, \ + kvmalloc_array(1, (alloc_pages) * PAGE_SIZE, gfp), \ +- vfree(p)); \ ++ kvfree(p)); \ + checker((expected_pages) * PAGE_SIZE, \ + kvmalloc_array((alloc_pages) * PAGE_SIZE, 1, gfp), \ +- vfree(p)); \ ++ kvfree(p)); \ + \ + prev_size = (expected_pages) * PAGE_SIZE; \ + orig = kvmalloc(prev_size, gfp); \ +-- +2.43.0 + diff --git a/queue-6.6/kvm-selftests-add-test-for-uaccesses-to-non-existent.patch b/queue-6.6/kvm-selftests-add-test-for-uaccesses-to-non-existent.patch new file mode 100644 index 00000000000..d16919ef2ba --- /dev/null +++ b/queue-6.6/kvm-selftests-add-test-for-uaccesses-to-non-existent.patch @@ -0,0 +1,102 @@ +From d4e4c55fe447dc99e88b15d3124c3e915cc6bcd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 17:39:59 +0000 +Subject: KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF + +From: Oliver Upton + +[ Upstream commit 160933e330f4c5a13931d725a4d952a4b9aefa71 ] + +Assert that accesses to a non-existent vgic-v2 CPU interface +consistently fail across the various KVM device attr ioctls. This also +serves as a regression test for a bug wherein KVM hits a NULL +dereference when the CPUID specified in the ioctl is invalid. + +Note that there is no need to print the observed errno, as TEST_ASSERT() +will take care of it. + +Reviewed-by: Marc Zyngier +Link: https://lore.kernel.org/r/20240424173959.3776798-3-oliver.upton@linux.dev +Signed-off-by: Oliver Upton +Signed-off-by: Sasha Levin +--- + .../testing/selftests/kvm/aarch64/vgic_init.c | 49 +++++++++++++++++++ + 1 file changed, 49 insertions(+) + +diff --git a/tools/testing/selftests/kvm/aarch64/vgic_init.c b/tools/testing/selftests/kvm/aarch64/vgic_init.c +index eef816b80993f..ca917c71ff602 100644 +--- a/tools/testing/selftests/kvm/aarch64/vgic_init.c ++++ b/tools/testing/selftests/kvm/aarch64/vgic_init.c +@@ -84,6 +84,18 @@ static struct vm_gic vm_gic_create_with_vcpus(uint32_t gic_dev_type, + return v; + } + ++static struct vm_gic vm_gic_create_barebones(uint32_t gic_dev_type) ++{ ++ struct vm_gic v; ++ ++ v.gic_dev_type = gic_dev_type; ++ v.vm = vm_create_barebones(); ++ v.gic_fd = kvm_create_device(v.vm, gic_dev_type); ++ ++ return v; ++} ++ ++ + static void vm_gic_destroy(struct vm_gic *v) + { + close(v->gic_fd); +@@ -357,6 +369,40 @@ static void test_vcpus_then_vgic(uint32_t gic_dev_type) + vm_gic_destroy(&v); + } + ++#define KVM_VGIC_V2_ATTR(offset, cpu) \ ++ (FIELD_PREP(KVM_DEV_ARM_VGIC_OFFSET_MASK, offset) | \ ++ FIELD_PREP(KVM_DEV_ARM_VGIC_CPUID_MASK, cpu)) ++ ++#define GIC_CPU_CTRL 0x00 ++ ++static void test_v2_uaccess_cpuif_no_vcpus(void) ++{ ++ struct vm_gic v; ++ u64 val = 0; ++ int ret; ++ ++ v = vm_gic_create_barebones(KVM_DEV_TYPE_ARM_VGIC_V2); ++ subtest_dist_rdist(&v); ++ ++ ret = __kvm_has_device_attr(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS, ++ KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0)); ++ TEST_ASSERT(ret && errno == EINVAL, ++ "accessed non-existent CPU interface, want errno: %i", ++ EINVAL); ++ ret = __kvm_device_attr_get(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS, ++ KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0), &val); ++ TEST_ASSERT(ret && errno == EINVAL, ++ "accessed non-existent CPU interface, want errno: %i", ++ EINVAL); ++ ret = __kvm_device_attr_set(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS, ++ KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0), &val); ++ TEST_ASSERT(ret && errno == EINVAL, ++ "accessed non-existent CPU interface, want errno: %i", ++ EINVAL); ++ ++ vm_gic_destroy(&v); ++} ++ + static void test_v3_new_redist_regions(void) + { + struct kvm_vcpu *vcpus[NR_VCPUS]; +@@ -675,6 +721,9 @@ void run_tests(uint32_t gic_dev_type) + test_vcpus_then_vgic(gic_dev_type); + test_vgic_then_vcpus(gic_dev_type); + ++ if (VGIC_DEV_IS_V2(gic_dev_type)) ++ test_v2_uaccess_cpuif_no_vcpus(); ++ + if (VGIC_DEV_IS_V3(gic_dev_type)) { + test_v3_new_redist_regions(); + test_v3_typer_accesses(); +-- +2.43.0 + diff --git a/queue-6.6/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch b/queue-6.6/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch new file mode 100644 index 00000000000..5a3bae68cd3 --- /dev/null +++ b/queue-6.6/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch @@ -0,0 +1,62 @@ +From 3a56e3e4d19b627ea596c95e6a590243c717deb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 08:59:05 +0800 +Subject: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duoming Zhou + +[ Upstream commit c2af060d1c18beaec56351cf9c9bcbbc5af341a3 ] + +The kcalloc() in dmirror_device_evict_chunk() will return null if the +physical memory has run out. As a result, if src_pfns or dst_pfns is +dereferenced, the null pointer dereference bug will happen. + +Moreover, the device is going away. If the kcalloc() fails, the pages +mapping a chunk could not be evicted. So add a __GFP_NOFAIL flag in +kcalloc(). + +Finally, as there is no need to have physically contiguous memory, Switch +kcalloc() to kvcalloc() in order to avoid failing allocations. + +Link: https://lkml.kernel.org/r/20240312005905.9939-1-duoming@zju.edu.cn +Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM") +Signed-off-by: Duoming Zhou +Cc: Jérôme Glisse +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + lib/test_hmm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/lib/test_hmm.c b/lib/test_hmm.c +index 717dcb8301273..b823ba7cb6a15 100644 +--- a/lib/test_hmm.c ++++ b/lib/test_hmm.c +@@ -1226,8 +1226,8 @@ static void dmirror_device_evict_chunk(struct dmirror_chunk *chunk) + unsigned long *src_pfns; + unsigned long *dst_pfns; + +- src_pfns = kcalloc(npages, sizeof(*src_pfns), GFP_KERNEL); +- dst_pfns = kcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL); ++ src_pfns = kvcalloc(npages, sizeof(*src_pfns), GFP_KERNEL | __GFP_NOFAIL); ++ dst_pfns = kvcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL | __GFP_NOFAIL); + + migrate_device_range(src_pfns, start_pfn, npages); + for (i = 0; i < npages; i++) { +@@ -1250,8 +1250,8 @@ static void dmirror_device_evict_chunk(struct dmirror_chunk *chunk) + } + migrate_device_pages(src_pfns, dst_pfns, npages); + migrate_device_finalize(src_pfns, dst_pfns, npages); +- kfree(src_pfns); +- kfree(dst_pfns); ++ kvfree(src_pfns); ++ kvfree(dst_pfns); + } + + /* Removes free pages from the free list so they can't be re-allocated */ +-- +2.43.0 + diff --git a/queue-6.6/libbpf-fix-error-message-in-attach_kprobe_multi.patch b/queue-6.6/libbpf-fix-error-message-in-attach_kprobe_multi.patch new file mode 100644 index 00000000000..b6ac1d4b226 --- /dev/null +++ b/queue-6.6/libbpf-fix-error-message-in-attach_kprobe_multi.patch @@ -0,0 +1,37 @@ +From 53dbd71eee8afe2d925addd54e8ff19e232fe129 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 09:55:41 +0200 +Subject: libbpf: Fix error message in attach_kprobe_multi + +From: Jiri Olsa + +[ Upstream commit 7c13ef16e87ac2e44d16c0468b1191bceb06f95c ] + +We just failed to retrieve pattern, so we need to print spec instead. + +Fixes: ddc6b04989eb ("libbpf: Add bpf_program__attach_kprobe_multi_opts function") +Reported-by: Andrii Nakryiko +Signed-off-by: Jiri Olsa +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20240502075541.1425761-2-jolsa@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index e238e6b824393..de35b9a21dad7 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -10985,7 +10985,7 @@ static int attach_kprobe_multi(const struct bpf_program *prog, long cookie, stru + + n = sscanf(spec, "%m[a-zA-Z0-9_.*?]", &pattern); + if (n < 1) { +- pr_warn("kprobe multi pattern is invalid: %s\n", pattern); ++ pr_warn("kprobe multi pattern is invalid: %s\n", spec); + return -EINVAL; + } + +-- +2.43.0 + diff --git a/queue-6.6/lkdtm-disable-cfi-checking-for-perms-functions.patch b/queue-6.6/lkdtm-disable-cfi-checking-for-perms-functions.patch new file mode 100644 index 00000000000..796ca18f2c4 --- /dev/null +++ b/queue-6.6/lkdtm-disable-cfi-checking-for-perms-functions.patch @@ -0,0 +1,59 @@ +From f9ffb01edbe64b8368ac9b8b7923113cc784f004 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 16:49:57 -0700 +Subject: lkdtm: Disable CFI checking for perms functions + +From: Kees Cook + +[ Upstream commit fb28a8862dc4b5bf8e44578338f35d9c6c68339d ] + +The EXEC_RODATA test plays a lot of tricks to live in the .rodata section, +and once again ran into objtool's (completely reasonable) assumptions +that executable code should live in an executable section. However, this +manifested only under CONFIG_CFI_CLANG=y, as one of the .cfi_sites was +pointing into the .rodata section. + +Since we're testing non-CFI execution properties in perms.c (and +rodata.c), we can disable CFI for the involved functions, and remove the +CFI arguments from rodata.c entirely. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202308301532.d7acf63e-oliver.sang@intel.com +Fixes: 6342a20efbd8 ("objtool: Add elf_create_section_pair()") +Link: https://lore.kernel.org/r/20240430234953.work.760-kees@kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + drivers/misc/lkdtm/Makefile | 2 +- + drivers/misc/lkdtm/perms.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile +index 95ef971b5e1cb..b28701138b4bc 100644 +--- a/drivers/misc/lkdtm/Makefile ++++ b/drivers/misc/lkdtm/Makefile +@@ -19,7 +19,7 @@ KASAN_SANITIZE_rodata.o := n + KCSAN_SANITIZE_rodata.o := n + KCOV_INSTRUMENT_rodata.o := n + OBJECT_FILES_NON_STANDARD_rodata.o := y +-CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LTO) $(RETHUNK_CFLAGS) ++CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LTO) $(RETHUNK_CFLAGS) $(CC_FLAGS_CFI) + + OBJCOPYFLAGS := + OBJCOPYFLAGS_rodata_objcopy.o := \ +diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c +index b93404d656509..5b861dbff27e9 100644 +--- a/drivers/misc/lkdtm/perms.c ++++ b/drivers/misc/lkdtm/perms.c +@@ -61,7 +61,7 @@ static void *setup_function_descriptor(func_desc_t *fdesc, void *dst) + return fdesc; + } + +-static noinline void execute_location(void *dst, bool write) ++static noinline __nocfi void execute_location(void *dst, bool write) + { + void (*func)(void); + func_desc_t fdesc; +-- +2.43.0 + diff --git a/queue-6.6/locking-atomic-x86-correct-the-definition-of-__arch_.patch b/queue-6.6/locking-atomic-x86-correct-the-definition-of-__arch_.patch new file mode 100644 index 00000000000..8dc02ecb276 --- /dev/null +++ b/queue-6.6/locking-atomic-x86-correct-the-definition-of-__arch_.patch @@ -0,0 +1,40 @@ +From ce8416a4f72d527804b4719f4696073867ab1791 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 11:13:56 +0200 +Subject: locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() + +From: Uros Bizjak + +[ Upstream commit 929ad065ba2967be238dfdc0895b79fda62c7f16 ] + +Correct the definition of __arch_try_cmpxchg128(), introduced by: + + b23e139d0b66 ("arch: Introduce arch_{,try_}_cmpxchg128{,_local}()") + +Fixes: b23e139d0b66 ("arch: Introduce arch_{,try_}_cmpxchg128{,_local}()") +Signed-off-by: Uros Bizjak +Signed-off-by: Ingo Molnar +Cc: Linus Torvalds +Cc: "H. Peter Anvin" +Link: https://lore.kernel.org/r/20240408091547.90111-2-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/cmpxchg_64.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h +index 44b08b53ab32f..c1d6cd58f8094 100644 +--- a/arch/x86/include/asm/cmpxchg_64.h ++++ b/arch/x86/include/asm/cmpxchg_64.h +@@ -62,7 +62,7 @@ static __always_inline u128 arch_cmpxchg128_local(volatile u128 *ptr, u128 old, + asm volatile(_lock "cmpxchg16b %[ptr]" \ + CC_SET(e) \ + : CC_OUT(e) (ret), \ +- [ptr] "+m" (*ptr), \ ++ [ptr] "+m" (*(_ptr)), \ + "+a" (o.low), "+d" (o.high) \ + : "b" (n.low), "c" (n.high) \ + : "memory"); \ +-- +2.43.0 + diff --git a/queue-6.6/loongarch-lately-init-pmu-after-smp-is-online.patch b/queue-6.6/loongarch-lately-init-pmu-after-smp-is-online.patch new file mode 100644 index 00000000000..d87f4d64d49 --- /dev/null +++ b/queue-6.6/loongarch-lately-init-pmu-after-smp-is-online.patch @@ -0,0 +1,40 @@ +From 9eaaef128d5898ce44a550d05aed2b28aa8f515c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 22:17:52 +0800 +Subject: LoongArch: Lately init pmu after smp is online + +From: Bibo Mao + +[ Upstream commit f3334ebb8a2a1841c2824594dd992e66de19deb2 ] + +There is an smp function call named reset_counters() to init PMU +registers of every CPU in PMU initialization state. It requires that all +CPUs are online. However there is an early_initcall() wrapper for the +PMU init funciton init_hw_perf_events(), so that pmu init funciton is +called in do_pre_smp_initcalls() which before function smp_init(). +Function reset_counters() cannot work on other CPUs since they haven't +boot up still. + +Here replace the wrapper early_initcall() with pure_initcall(), so that +the PMU init function is called after every cpu is online. + +Signed-off-by: Bibo Mao +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/perf_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/kernel/perf_event.c b/arch/loongarch/kernel/perf_event.c +index 0491bf453cd49..cac7cba81b65f 100644 +--- a/arch/loongarch/kernel/perf_event.c ++++ b/arch/loongarch/kernel/perf_event.c +@@ -884,4 +884,4 @@ static int __init init_hw_perf_events(void) + + return 0; + } +-early_initcall(init_hw_perf_events); ++pure_initcall(init_hw_perf_events); +-- +2.43.0 + diff --git a/queue-6.6/m68k-fix-spinlock-race-in-kernel-thread-creation.patch b/queue-6.6/m68k-fix-spinlock-race-in-kernel-thread-creation.patch new file mode 100644 index 00000000000..6fdf0b2ca7f --- /dev/null +++ b/queue-6.6/m68k-fix-spinlock-race-in-kernel-thread-creation.patch @@ -0,0 +1,77 @@ +From f46166a7d08c77b1f5c195ce3aaeaddbbcdfcbad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 15:36:31 +1200 +Subject: m68k: Fix spinlock race in kernel thread creation + +From: Michael Schmitz + +[ Upstream commit da89ce46f02470ef08f0f580755d14d547da59ed ] + +Context switching does take care to retain the correct lock owner across +the switch from 'prev' to 'next' tasks. This does rely on interrupts +remaining disabled for the entire duration of the switch. + +This condition is guaranteed for normal process creation and context +switching between already running processes, because both 'prev' and +'next' already have interrupts disabled in their saved copies of the +status register. + +The situation is different for newly created kernel threads. The status +register is set to PS_S in copy_thread(), which does leave the IPL at 0. +Upon restoring the 'next' thread's status register in switch_to() aka +resume(), interrupts then become enabled prematurely. resume() then +returns via ret_from_kernel_thread() and schedule_tail() where run queue +lock is released (see finish_task_switch() and finish_lock_switch()). + +A timer interrupt calling scheduler_tick() before the lock is released +in finish_task_switch() will find the lock already taken, with the +current task as lock owner. This causes a spinlock recursion warning as +reported by Guenter Roeck. + +As far as I can ascertain, this race has been opened in commit +533e6903bea0 ("m68k: split ret_from_fork(), simplify kernel_thread()") +but I haven't done a detailed study of kernel history so it may well +predate that commit. + +Interrupts cannot be disabled in the saved status register copy for +kernel threads (init will complain about interrupts disabled when +finally starting user space). Disable interrupts temporarily when +switching the tasks' register sets in resume(). + +Note that a simple oriw 0x700,%sr after restoring sr is not enough here +- this leaves enough of a race for the 'spinlock recursion' warning to +still be observed. + +Tested on ARAnyM and qemu (Quadra 800 emulation). + +Fixes: 533e6903bea0 ("m68k: split ret_from_fork(), simplify kernel_thread()") +Reported-by: Guenter Roeck +Closes: https://lore.kernel.org/all/07811b26-677c-4d05-aeb4-996cd880b789@roeck-us.net +Signed-off-by: Michael Schmitz +Tested-by: Guenter Roeck +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240411033631.16335-1-schmitzmic@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/kernel/entry.S | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S +index 4dd2fd7acba9e..2e1e9ad4f98ca 100644 +--- a/arch/m68k/kernel/entry.S ++++ b/arch/m68k/kernel/entry.S +@@ -433,7 +433,9 @@ resume: + movec %a0,%dfc + + /* restore status register */ +- movew %a1@(TASK_THREAD+THREAD_SR),%sr ++ movew %a1@(TASK_THREAD+THREAD_SR),%d0 ++ oriw #0x0700,%d0 ++ movew %d0,%sr + + rts + +-- +2.43.0 + diff --git a/queue-6.6/m68k-mac-fix-reboot-hang-on-mac-iici.patch b/queue-6.6/m68k-mac-fix-reboot-hang-on-mac-iici.patch new file mode 100644 index 00000000000..6cafc6d02c0 --- /dev/null +++ b/queue-6.6/m68k-mac-fix-reboot-hang-on-mac-iici.patch @@ -0,0 +1,99 @@ +From a9c3e782a522c20217304c98aa86d153d0198cdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 14:31:12 +1000 +Subject: m68k: mac: Fix reboot hang on Mac IIci + +From: Finn Thain + +[ Upstream commit 265a3b322df9a973ff1fc63da70af456ab6ae1d6 ] + +Calling mac_reset() on a Mac IIci does reset the system, but what +follows is a POST failure that requires a manual reset to resolve. +Avoid that by using the 68030 asm implementation instead of the C +implementation. + +Apparently the SE/30 has a similar problem as it has used the asm +implementation since before git. This patch extends that solution to +other systems with a similar ROM. + +After this patch, the only systems still using the C implementation are +68040 systems where adb_type is either MAC_ADB_IOP or MAC_ADB_II. This +implies a 1 MiB Quadra ROM. + +This now includes the Quadra 900/950, which previously fell through to +the "should never get here" catch-all. + +Reported-and-tested-by: Stan Johnson +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Finn Thain +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/480ebd1249d229c6dc1f3f1c6d599b8505483fd8.1714797072.git.fthain@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/mac/misc.c | 36 ++++++++++++++++++------------------ + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/arch/m68k/mac/misc.c b/arch/m68k/mac/misc.c +index c7cb29f0ff016..29e06f46ab511 100644 +--- a/arch/m68k/mac/misc.c ++++ b/arch/m68k/mac/misc.c +@@ -451,30 +451,18 @@ void mac_poweroff(void) + + void mac_reset(void) + { +- if (macintosh_config->adb_type == MAC_ADB_II && +- macintosh_config->ident != MAC_MODEL_SE30) { +- /* need ROMBASE in booter */ +- /* indeed, plus need to MAP THE ROM !! */ +- +- if (mac_bi_data.rombase == 0) +- mac_bi_data.rombase = 0x40800000; +- +- /* works on some */ +- rom_reset = (void *) (mac_bi_data.rombase + 0xa); +- +- local_irq_disable(); +- rom_reset(); + #ifdef CONFIG_ADB_CUDA +- } else if (macintosh_config->adb_type == MAC_ADB_EGRET || +- macintosh_config->adb_type == MAC_ADB_CUDA) { ++ if (macintosh_config->adb_type == MAC_ADB_EGRET || ++ macintosh_config->adb_type == MAC_ADB_CUDA) { + cuda_restart(); ++ } else + #endif + #ifdef CONFIG_ADB_PMU +- } else if (macintosh_config->adb_type == MAC_ADB_PB2) { ++ if (macintosh_config->adb_type == MAC_ADB_PB2) { + pmu_restart(); ++ } else + #endif +- } else if (CPU_IS_030) { +- ++ if (CPU_IS_030) { + /* 030-specific reset routine. The idea is general, but the + * specific registers to reset are '030-specific. Until I + * have a non-030 machine, I can't test anything else. +@@ -522,6 +510,18 @@ void mac_reset(void) + "jmp %/a0@\n\t" /* jump to the reset vector */ + ".chip 68k" + : : "r" (offset), "a" (rombase) : "a0"); ++ } else { ++ /* need ROMBASE in booter */ ++ /* indeed, plus need to MAP THE ROM !! */ ++ ++ if (mac_bi_data.rombase == 0) ++ mac_bi_data.rombase = 0x40800000; ++ ++ /* works on some */ ++ rom_reset = (void *)(mac_bi_data.rombase + 0xa); ++ ++ local_irq_disable(); ++ rom_reset(); + } + + /* should never get here */ +-- +2.43.0 + diff --git a/queue-6.6/macintosh-via-macii-fix-bug-sleeping-function-called.patch b/queue-6.6/macintosh-via-macii-fix-bug-sleeping-function-called.patch new file mode 100644 index 00000000000..5d715479a7d --- /dev/null +++ b/queue-6.6/macintosh-via-macii-fix-bug-sleeping-function-called.patch @@ -0,0 +1,59 @@ +From 53ab72f2672892dd89f563b1d0be98b941ae0766 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 13:53:41 +1100 +Subject: macintosh/via-macii: Fix "BUG: sleeping function called from invalid + context" + +From: Finn Thain + +[ Upstream commit d301a71c76ee4c384b4e03cdc320a55f5cf1df05 ] + +The via-macii ADB driver calls request_irq() after disabling hard +interrupts. But disabling interrupts isn't necessary here because the +VIA shift register interrupt was masked during VIA1 initialization. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Finn Thain +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/419fcc09d0e563b425c419053d02236b044d86b0.1710298421.git.fthain@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/macintosh/via-macii.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/macintosh/via-macii.c b/drivers/macintosh/via-macii.c +index db9270da5b8e9..b6ddf1d47cb4e 100644 +--- a/drivers/macintosh/via-macii.c ++++ b/drivers/macintosh/via-macii.c +@@ -140,24 +140,19 @@ static int macii_probe(void) + /* Initialize the driver */ + static int macii_init(void) + { +- unsigned long flags; + int err; + +- local_irq_save(flags); +- + err = macii_init_via(); + if (err) +- goto out; ++ return err; + + err = request_irq(IRQ_MAC_ADB, macii_interrupt, 0, "ADB", + macii_interrupt); + if (err) +- goto out; ++ return err; + + macii_state = idle; +-out: +- local_irq_restore(flags); +- return err; ++ return 0; + } + + /* initialize the hardware */ +-- +2.43.0 + diff --git a/queue-6.6/md-fix-resync-softlockup-when-bitmap-size-is-less-th.patch b/queue-6.6/md-fix-resync-softlockup-when-bitmap-size-is-less-th.patch new file mode 100644 index 00000000000..5458964f621 --- /dev/null +++ b/queue-6.6/md-fix-resync-softlockup-when-bitmap-size-is-less-th.patch @@ -0,0 +1,93 @@ +From 1019d9c0a4bc702f37f7d89875e9fd97140c9311 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 14:58:24 +0800 +Subject: md: fix resync softlockup when bitmap size is less than array size + +From: Yu Kuai + +[ Upstream commit f0e729af2eb6bee9eb58c4df1087f14ebaefe26b ] + +Is is reported that for dm-raid10, lvextend + lvchange --syncaction will +trigger following softlockup: + +kernel:watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [mdX_resync:6976] +CPU: 7 PID: 3588 Comm: mdX_resync Kdump: loaded Not tainted 6.9.0-rc4-next-20240419 #1 +RIP: 0010:_raw_spin_unlock_irq+0x13/0x30 +Call Trace: + + md_bitmap_start_sync+0x6b/0xf0 + raid10_sync_request+0x25c/0x1b40 [raid10] + md_do_sync+0x64b/0x1020 + md_thread+0xa7/0x170 + kthread+0xcf/0x100 + ret_from_fork+0x30/0x50 + ret_from_fork_asm+0x1a/0x30 + +And the detailed process is as follows: + +md_do_sync + j = mddev->resync_min + while (j < max_sectors) + sectors = raid10_sync_request(mddev, j, &skipped) + if (!md_bitmap_start_sync(..., &sync_blocks)) + // md_bitmap_start_sync set sync_blocks to 0 + return sync_blocks + sectors_skippe; + // sectors = 0; + j += sectors; + // j never change + +Root cause is that commit 301867b1c168 ("md/raid10: check +slab-out-of-bounds in md_bitmap_get_counter") return early from +md_bitmap_get_counter(), without setting returned blocks. + +Fix this problem by always set returned blocks from +md_bitmap_get_counter"(), as it used to be. + +Noted that this patch just fix the softlockup problem in kernel, the +case that bitmap size doesn't match array size still need to be fixed. + +Fixes: 301867b1c168 ("md/raid10: check slab-out-of-bounds in md_bitmap_get_counter") +Reported-and-tested-by: Nigel Croxon +Closes: https://lore.kernel.org/all/71ba5272-ab07-43ba-8232-d2da642acb4e@redhat.com/ +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20240422065824.2516-1-yukuai1@huaweicloud.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 42d4c38ba54d5..d9235ee7dcc46 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -1427,7 +1427,7 @@ __acquires(bitmap->lock) + sector_t chunk = offset >> bitmap->chunkshift; + unsigned long page = chunk >> PAGE_COUNTER_SHIFT; + unsigned long pageoff = (chunk & PAGE_COUNTER_MASK) << COUNTER_BYTE_SHIFT; +- sector_t csize; ++ sector_t csize = ((sector_t)1) << bitmap->chunkshift; + int err; + + if (page >= bitmap->pages) { +@@ -1436,6 +1436,7 @@ __acquires(bitmap->lock) + * End-of-device while looking for a whole page or + * user set a huge number to sysfs bitmap_set_bits. + */ ++ *blocks = csize - (offset & (csize - 1)); + return NULL; + } + err = md_bitmap_checkpage(bitmap, page, create, 0); +@@ -1444,8 +1445,7 @@ __acquires(bitmap->lock) + bitmap->bp[page].map == NULL) + csize = ((sector_t)1) << (bitmap->chunkshift + + PAGE_COUNTER_SHIFT); +- else +- csize = ((sector_t)1) << bitmap->chunkshift; ++ + *blocks = csize - (offset & (csize - 1)); + + if (err < 0) +-- +2.43.0 + diff --git a/queue-6.6/media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch b/queue-6.6/media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..f06ac9f9f9b --- /dev/null +++ b/queue-6.6/media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch @@ -0,0 +1,52 @@ +From 0a3d33504d6c7b478bd1ce4438e2b08fdc104043 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 16:13:00 +0100 +Subject: media: atomisp: ssh_css: Fix a null-pointer dereference in + load_video_binaries + +From: Zhipeng Lu + +[ Upstream commit 3b621e9e9e148c0928ab109ac3d4b81487469acb ] + +The allocation failure of mycs->yuv_scaler_binary in load_video_binaries() +is followed with a dereference of mycs->yuv_scaler_binary after the +following call chain: + +sh_css_pipe_load_binaries() + |-> load_video_binaries(mycs->yuv_scaler_binary == NULL) + | + |-> sh_css_pipe_unload_binaries() + |-> unload_video_binaries() + +In unload_video_binaries(), it calls to ia_css_binary_unload with argument +&pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the +same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer +dereference is triggered. + +Link: https://lore.kernel.org/r/20240118151303.3828292-1-alexious@zju.edu.cn + +Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") +Signed-off-by: Zhipeng Lu +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/sh_css.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c +index 4b3fa6d93fe0a..d8a1d4a58db6a 100644 +--- a/drivers/staging/media/atomisp/pci/sh_css.c ++++ b/drivers/staging/media/atomisp/pci/sh_css.c +@@ -4737,6 +4737,7 @@ static int load_video_binaries(struct ia_css_pipe *pipe) + sizeof(struct ia_css_binary), + GFP_KERNEL); + if (!mycs->yuv_scaler_binary) { ++ mycs->num_yuv_scaler = 0; + err = -ENOMEM; + return err; + } +-- +2.43.0 + diff --git a/queue-6.6/media-cadence-csi2rx-configure-dphy-before-starting-.patch b/queue-6.6/media-cadence-csi2rx-configure-dphy-before-starting-.patch new file mode 100644 index 00000000000..0db07951d8a --- /dev/null +++ b/queue-6.6/media-cadence-csi2rx-configure-dphy-before-starting-.patch @@ -0,0 +1,91 @@ +From ad1143b943ca9e5fdf7fdbc9aa0a923856955dda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 13:53:01 +0530 +Subject: media: cadence: csi2rx: configure DPHY before starting source stream + +From: Pratyush Yadav + +[ Upstream commit fd64dda48f7e3f67ada1e1fe47e784ab350da72e ] + +When the source device is operating above 1.5 Gbps per lane, it needs to +send the Skew Calibration Sequence before sending any HS data. If the +DPHY is initialized after the source stream is started, then it might +miss the sequence and not be able to receive data properly. Move the +start of source subdev to the end of the sequence to make sure +everything is ready to receive data before the source starts streaming. + +Signed-off-by: Pratyush Yadav +Fixes: 3295cf1241d3 ("media: cadence: Add support for external dphy") +Tested-by: Julien Massot +Tested-by: Changhuang Liang +Reviewed-by: Julien Massot +Reviewed-by: Changhuang Liang +Signed-off-by: Jai Luthra +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/cadence/cdns-csi2rx.c | 26 +++++++++++--------- + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/drivers/media/platform/cadence/cdns-csi2rx.c b/drivers/media/platform/cadence/cdns-csi2rx.c +index f2ce458ebb1df..2d803cf31e9d1 100644 +--- a/drivers/media/platform/cadence/cdns-csi2rx.c ++++ b/drivers/media/platform/cadence/cdns-csi2rx.c +@@ -164,10 +164,6 @@ static int csi2rx_start(struct csi2rx_priv *csi2rx) + + writel(reg, csi2rx->base + CSI2RX_STATIC_CFG_REG); + +- ret = v4l2_subdev_call(csi2rx->source_subdev, video, s_stream, true); +- if (ret) +- goto err_disable_pclk; +- + /* Enable DPHY clk and data lanes. */ + if (csi2rx->dphy) { + reg = CSI2RX_DPHY_CL_EN | CSI2RX_DPHY_CL_RST; +@@ -177,6 +173,13 @@ static int csi2rx_start(struct csi2rx_priv *csi2rx) + } + + writel(reg, csi2rx->base + CSI2RX_DPHY_LANE_CTRL_REG); ++ ++ ret = csi2rx_configure_ext_dphy(csi2rx); ++ if (ret) { ++ dev_err(csi2rx->dev, ++ "Failed to configure external DPHY: %d\n", ret); ++ goto err_disable_pclk; ++ } + } + + /* +@@ -213,14 +216,9 @@ static int csi2rx_start(struct csi2rx_priv *csi2rx) + + reset_control_deassert(csi2rx->sys_rst); + +- if (csi2rx->dphy) { +- ret = csi2rx_configure_ext_dphy(csi2rx); +- if (ret) { +- dev_err(csi2rx->dev, +- "Failed to configure external DPHY: %d\n", ret); +- goto err_disable_sysclk; +- } +- } ++ ret = v4l2_subdev_call(csi2rx->source_subdev, video, s_stream, true); ++ if (ret) ++ goto err_disable_sysclk; + + clk_disable_unprepare(csi2rx->p_clk); + +@@ -234,6 +232,10 @@ static int csi2rx_start(struct csi2rx_priv *csi2rx) + clk_disable_unprepare(csi2rx->pixel_clk[i - 1]); + } + ++ if (csi2rx->dphy) { ++ writel(0, csi2rx->base + CSI2RX_DPHY_LANE_CTRL_REG); ++ phy_power_off(csi2rx->dphy); ++ } + err_disable_pclk: + clk_disable_unprepare(csi2rx->p_clk); + +-- +2.43.0 + diff --git a/queue-6.6/media-dt-bindings-ovti-ov2680-fix-the-power-supply-n.patch b/queue-6.6/media-dt-bindings-ovti-ov2680-fix-the-power-supply-n.patch new file mode 100644 index 00000000000..2f1152eb5c9 --- /dev/null +++ b/queue-6.6/media-dt-bindings-ovti-ov2680-fix-the-power-supply-n.patch @@ -0,0 +1,77 @@ +From 7910df1ce8d031bd3e6bb9c6310f595b0f38620e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 14:40:27 -0300 +Subject: media: dt-bindings: ovti,ov2680: Fix the power supply names + +From: Fabio Estevam + +[ Upstream commit e2f6ea61b6f3e4ebbb7dff857eea6220c18cd17b ] + +The original .txt bindings had the OV2680 power supply names correct, +but the transition from .txt to yaml spelled them incorrectly. + +Fix the OV2680 power supply names as the original .txt bindings +as these are the names used by the OV2680 driver and in devicetree. + +Fixes: 57226cd8c8bf ("media: dt-bindings: ov2680: convert bindings to yaml") +Signed-off-by: Fabio Estevam +Reviewed-by: Rob Herring +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../bindings/media/i2c/ovti,ov2680.yaml | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml b/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml +index cf456f8d9ddcb..c87677f5e2a25 100644 +--- a/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml ++++ b/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml +@@ -37,15 +37,15 @@ properties: + active low. + maxItems: 1 + +- dovdd-supply: ++ DOVDD-supply: + description: + Definition of the regulator used as interface power supply. + +- avdd-supply: ++ AVDD-supply: + description: + Definition of the regulator used as analog power supply. + +- dvdd-supply: ++ DVDD-supply: + description: + Definition of the regulator used as digital power supply. + +@@ -59,9 +59,9 @@ required: + - reg + - clocks + - clock-names +- - dovdd-supply +- - avdd-supply +- - dvdd-supply ++ - DOVDD-supply ++ - AVDD-supply ++ - DVDD-supply + - reset-gpios + - port + +@@ -82,9 +82,9 @@ examples: + clock-names = "xvclk"; + reset-gpios = <&gpio1 3 GPIO_ACTIVE_LOW>; + +- dovdd-supply = <&sw2_reg>; +- dvdd-supply = <&sw2_reg>; +- avdd-supply = <®_peri_3p15v>; ++ DOVDD-supply = <&sw2_reg>; ++ DVDD-supply = <&sw2_reg>; ++ AVDD-supply = <®_peri_3p15v>; + + port { + ov2680_to_mipi: endpoint { +-- +2.43.0 + diff --git a/queue-6.6/media-i2c-et8ek8-don-t-strip-remove-function-when-dr.patch b/queue-6.6/media-i2c-et8ek8-don-t-strip-remove-function-when-dr.patch new file mode 100644 index 00000000000..aa8f00dd157 --- /dev/null +++ b/queue-6.6/media-i2c-et8ek8-don-t-strip-remove-function-when-dr.patch @@ -0,0 +1,57 @@ +From 2b1d5a26196516d83934242bc25784df5ba03274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Mar 2024 17:00:44 +0100 +Subject: media: i2c: et8ek8: Don't strip remove function when driver is + builtin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 545b215736c5c4b354e182d99c578a472ac9bfce ] + +Using __exit for the remove function results in the remove callback +being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets +unbound (e.g. using sysfs or hotplug), the driver is just removed +without the cleanup being performed. This results in resource leaks. Fix +it by compiling in the remove callback unconditionally. + +This also fixes a W=1 modpost warning: + + WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) + +Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/et8ek8/et8ek8_driver.c b/drivers/media/i2c/et8ek8/et8ek8_driver.c +index d6fc843f9368e..0d6f0f8506f76 100644 +--- a/drivers/media/i2c/et8ek8/et8ek8_driver.c ++++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c +@@ -1460,7 +1460,7 @@ static int et8ek8_probe(struct i2c_client *client) + return ret; + } + +-static void __exit et8ek8_remove(struct i2c_client *client) ++static void et8ek8_remove(struct i2c_client *client) + { + struct v4l2_subdev *subdev = i2c_get_clientdata(client); + struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev); +@@ -1502,7 +1502,7 @@ static struct i2c_driver et8ek8_i2c_driver = { + .of_match_table = et8ek8_of_table, + }, + .probe = et8ek8_probe, +- .remove = __exit_p(et8ek8_remove), ++ .remove = et8ek8_remove, + .id_table = et8ek8_id_table, + }; + +-- +2.43.0 + diff --git a/queue-6.6/media-ipu3-cio2-request-irq-earlier.patch b/queue-6.6/media-ipu3-cio2-request-irq-earlier.patch new file mode 100644 index 00000000000..b9790b16e72 --- /dev/null +++ b/queue-6.6/media-ipu3-cio2-request-irq-earlier.patch @@ -0,0 +1,52 @@ +From e595053ca0e33f7dd0f5a3303efa91eaef9a4b90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 16:01:20 +0200 +Subject: media: ipu3-cio2: Request IRQ earlier + +From: Sakari Ailus + +[ Upstream commit a069f79bfa6ec1ea0744981ea8425c8a25322579 ] + +Call devm_request_irq() before registering the async notifier, as otherwise +it would be possible to use the device before the interrupts could be +delivered to the driver. + +Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu3/ipu3-cio2.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +index 5dd69a251b6a9..423842d2a5b2b 100644 +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +@@ -1803,11 +1803,6 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + + v4l2_async_nf_init(&cio2->notifier, &cio2->v4l2_dev); + +- /* Register notifier for subdevices we care */ +- r = cio2_parse_firmware(cio2); +- if (r) +- goto fail_clean_notifier; +- + r = devm_request_irq(dev, pci_dev->irq, cio2_irq, IRQF_SHARED, + CIO2_NAME, cio2); + if (r) { +@@ -1815,6 +1810,11 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + goto fail_clean_notifier; + } + ++ /* Register notifier for subdevices we care */ ++ r = cio2_parse_firmware(cio2); ++ if (r) ++ goto fail_clean_notifier; ++ + pm_runtime_put_noidle(dev); + pm_runtime_allow(dev); + +-- +2.43.0 + diff --git a/queue-6.6/media-ngene-add-dvb_ca_en50221_init-return-value-che.patch b/queue-6.6/media-ngene-add-dvb_ca_en50221_init-return-value-che.patch new file mode 100644 index 00000000000..6ed0a2459af --- /dev/null +++ b/queue-6.6/media-ngene-add-dvb_ca_en50221_init-return-value-che.patch @@ -0,0 +1,40 @@ +From 948fa18b6128aa8e34846fefdd99479ffe53f79b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 14:15:53 +0300 +Subject: media: ngene: Add dvb_ca_en50221_init return value check + +From: Aleksandr Burakov + +[ Upstream commit 9bb1fd7eddcab2d28cfc11eb20f1029154dac718 ] + +The return value of dvb_ca_en50221_init() is not checked here that may +cause undefined behavior in case of nonzero value return. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 25aee3debe04 ("[media] Rename media/dvb as media/pci") +Signed-off-by: Aleksandr Burakov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ngene/ngene-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/ngene/ngene-core.c b/drivers/media/pci/ngene/ngene-core.c +index 7481f553f9595..24ec576dc3bff 100644 +--- a/drivers/media/pci/ngene/ngene-core.c ++++ b/drivers/media/pci/ngene/ngene-core.c +@@ -1488,7 +1488,9 @@ static int init_channel(struct ngene_channel *chan) + } + + if (dev->ci.en && (io & NGENE_IO_TSOUT)) { +- dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1); ++ ret = dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1); ++ if (ret != 0) ++ goto err; + set_transfer(chan, 1); + chan->dev->channel[2].DataFormatFlags = DF_SWAP32; + set_transfer(&chan->dev->channel[2], 1); +-- +2.43.0 + diff --git a/queue-6.6/media-radio-shark2-avoid-led_names-truncations.patch b/queue-6.6/media-radio-shark2-avoid-led_names-truncations.patch new file mode 100644 index 00000000000..63add11fa48 --- /dev/null +++ b/queue-6.6/media-radio-shark2-avoid-led_names-truncations.patch @@ -0,0 +1,40 @@ +From 0e7b6aa55f8e015bf7af9b8d983e9d61606d5eae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 14:50:24 +0000 +Subject: media: radio-shark2: Avoid led_names truncations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ricardo Ribalda + +[ Upstream commit 1820e16a3019b6258e6009d34432946a6ddd0a90 ] + +Increase the size of led_names so it can fit any valid v4l2 device name. + +Fixes: +drivers/media/radio/radio-shark2.c:197:17: warning: ‘%s’ directive output may be truncated writing up to 35 bytes into a region of size 32 [-Wformat-truncation=] + +Signed-off-by: Ricardo Ribalda +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/radio/radio-shark2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c +index f1c5c0a6a335c..e3e6aa87fe081 100644 +--- a/drivers/media/radio/radio-shark2.c ++++ b/drivers/media/radio/radio-shark2.c +@@ -62,7 +62,7 @@ struct shark_device { + #ifdef SHARK_USE_LEDS + struct work_struct led_work; + struct led_classdev leds[NO_LEDS]; +- char led_names[NO_LEDS][32]; ++ char led_names[NO_LEDS][64]; + atomic_t brightness[NO_LEDS]; + unsigned long brightness_new; + #endif +-- +2.43.0 + diff --git a/queue-6.6/media-rcar-vin-work-around-wenum-compare-conditional.patch b/queue-6.6/media-rcar-vin-work-around-wenum-compare-conditional.patch new file mode 100644 index 00000000000..477982f6a32 --- /dev/null +++ b/queue-6.6/media-rcar-vin-work-around-wenum-compare-conditional.patch @@ -0,0 +1,47 @@ +From 4992f82b8d7e4bea596417eaa559017aa327756b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 14:33:46 +0100 +Subject: media: rcar-vin: work around -Wenum-compare-conditional warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 1a742c6010d136cb6c441a0f1dd2bfbfae3c4df2 ] + +clang-19 warns about mixing two enum types here: + +drivers/media/platform/renesas/rcar-vin/rcar-vin.h:296:12: error: conditional expression between different enumeration types ('enum rvin_csi_id' and 'enum rvin_isp_id') [-Werror,-Wenum-compare-conditional] +drivers/media/platform/renesas/rcar-vin/rcar-core.c:216:18: error: conditional expression between different enumeration types ('enum rvin_csi_id' and 'enum rvin_isp_id') [-Werror,-Wenum-compare-conditional] +drivers/media/platform/renesas/rcar-vin/rcar-vin.h:296:12: error: conditional expression between different enumeration types ('enum rvin_csi_id' and 'enum rvin_isp_id') [-Werror,-Wenum-compare-conditional] +drivers/media/platform/renesas/rcar-vin/rcar-vin.h:296:12: error: conditional expression between different enumeration types ('enum rvin_csi_id' and 'enum rvin_isp_id') [-Werror,-Wenum-compare-conditional] + +This one is intentional, and there is already a cast to work around another +warning, so address this by adding another cast. + +Fixes: 406bb586dec0 ("media: rcar-vin: Add r8a779a0 support") +Signed-off-by: Arnd Bergmann +Reviewed-by: Niklas Söderlund +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/rcar-vin/rcar-vin.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/renesas/rcar-vin/rcar-vin.h b/drivers/media/platform/renesas/rcar-vin/rcar-vin.h +index 792336dada447..997a66318a293 100644 +--- a/drivers/media/platform/renesas/rcar-vin/rcar-vin.h ++++ b/drivers/media/platform/renesas/rcar-vin/rcar-vin.h +@@ -59,7 +59,7 @@ enum rvin_isp_id { + + #define RVIN_REMOTES_MAX \ + (((unsigned int)RVIN_CSI_MAX) > ((unsigned int)RVIN_ISP_MAX) ? \ +- RVIN_CSI_MAX : RVIN_ISP_MAX) ++ (unsigned int)RVIN_CSI_MAX : (unsigned int)RVIN_ISP_MAX) + + /** + * enum rvin_dma_state - DMA states +-- +2.43.0 + diff --git a/queue-6.6/media-uvcvideo-add-quirk-for-logitech-rally-bar.patch b/queue-6.6/media-uvcvideo-add-quirk-for-logitech-rally-bar.patch new file mode 100644 index 00000000000..d3908f658c3 --- /dev/null +++ b/queue-6.6/media-uvcvideo-add-quirk-for-logitech-rally-bar.patch @@ -0,0 +1,106 @@ +From 320c216b9b9a35036f7bc314080bea10d39cf080 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 18:00:49 +0000 +Subject: media: uvcvideo: Add quirk for Logitech Rally Bar + +From: Ricardo Ribalda + +[ Upstream commit 07731053d11f7647d5d8bc23caac997a4d562dfe ] + +Logitech Rally Bar devices, despite behaving as UVC cameras, have a +different power management system that the other cameras from Logitech. + +USB_QUIRK_RESET_RESUME is applied to all the UVC cameras from Logitech +at the usb core. Unfortunately, USB_QUIRK_RESET_RESUME causes undesired +USB disconnects in the Rally Bar that make them completely unusable. + +There is an open discussion about if we should fix this in the core or +add a quirk in the UVC driver. In order to enable this hardware, let's +land this patch first, and we can revert it later if there is a +different conclusion. + +Fixes: e387ef5c47dd ("usb: Add USB_QUIRK_RESET_RESUME for all Logitech UVC webcams") +Acked-by: Greg Kroah-Hartman +Reviewed-by: Devinder Khroad +Reviewed-by: Sergey Senozhatsky +Reviewed-by: Laurent Pinchart +Signed-off-by: Ricardo Ribalda +Link: https://lore.kernel.org/r/20240404-rallybar-v6-1-6d67bb6b69af@chromium.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 31 ++++++++++++++++++++++++++++++ + drivers/media/usb/uvc/uvcvideo.h | 1 + + 2 files changed, 32 insertions(+) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index bbd90123a4e76..91a41aa3ced24 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -2232,6 +2233,9 @@ static int uvc_probe(struct usb_interface *intf, + goto error; + } + ++ if (dev->quirks & UVC_QUIRK_NO_RESET_RESUME) ++ udev->quirks &= ~USB_QUIRK_RESET_RESUME; ++ + uvc_dbg(dev, PROBE, "UVC device initialized\n"); + usb_enable_autosuspend(udev); + return 0; +@@ -2574,6 +2578,33 @@ static const struct usb_device_id uvc_ids[] = { + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_RESTORE_CTRLS_ON_INIT) }, ++ /* Logitech Rally Bar Huddle */ ++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = 0x046d, ++ .idProduct = 0x087c, ++ .bInterfaceClass = USB_CLASS_VIDEO, ++ .bInterfaceSubClass = 1, ++ .bInterfaceProtocol = 0, ++ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_NO_RESET_RESUME) }, ++ /* Logitech Rally Bar */ ++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = 0x046d, ++ .idProduct = 0x089b, ++ .bInterfaceClass = USB_CLASS_VIDEO, ++ .bInterfaceSubClass = 1, ++ .bInterfaceProtocol = 0, ++ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_NO_RESET_RESUME) }, ++ /* Logitech Rally Bar Mini */ ++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = 0x046d, ++ .idProduct = 0x08d3, ++ .bInterfaceClass = USB_CLASS_VIDEO, ++ .bInterfaceSubClass = 1, ++ .bInterfaceProtocol = 0, ++ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_NO_RESET_RESUME) }, + /* Chicony CNF7129 (Asus EEE 100HE) */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index 6fb0a78b1b009..88218693f6f0b 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -73,6 +73,7 @@ + #define UVC_QUIRK_FORCE_Y8 0x00000800 + #define UVC_QUIRK_FORCE_BPP 0x00001000 + #define UVC_QUIRK_WAKE_AUTOSUSPEND 0x00002000 ++#define UVC_QUIRK_NO_RESET_RESUME 0x00004000 + + /* Format flags */ + #define UVC_FMT_FLAG_COMPRESSED 0x00000001 +-- +2.43.0 + diff --git a/queue-6.6/media-v4l2-subdev-fix-stream-handling-for-crop-api.patch b/queue-6.6/media-v4l2-subdev-fix-stream-handling-for-crop-api.patch new file mode 100644 index 00000000000..b7b1fa09624 --- /dev/null +++ b/queue-6.6/media-v4l2-subdev-fix-stream-handling-for-crop-api.patch @@ -0,0 +1,47 @@ +From 0e5e816d4a72dac78436fc3864044d7e9a6f634a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 02:37:25 +0300 +Subject: media: v4l2-subdev: Fix stream handling for crop API + +From: Laurent Pinchart + +[ Upstream commit 34d7bf1c8e59f5fbf438ee32c96389ebe41ca2e8 ] + +When support for streams was added to the V4L2 subdev API, the +v4l2_subdev_crop structure was extended with a stream field, but the +field was not handled in the core code that translates the +VIDIOC_SUBDEV_[GS]_CROP ioctls to the selection API. Fix it. + +Fixes: 2f91e10ee6fd ("media: subdev: add stream based configuration") +Signed-off-by: Laurent Pinchart +Reviewed-by: Tomi Valkeinen +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-subdev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c +index 31752c06d1f0c..ee159b4341abc 100644 +--- a/drivers/media/v4l2-core/v4l2-subdev.c ++++ b/drivers/media/v4l2-core/v4l2-subdev.c +@@ -664,6 +664,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg, + memset(&sel, 0, sizeof(sel)); + sel.which = crop->which; + sel.pad = crop->pad; ++ sel.stream = crop->stream; + sel.target = V4L2_SEL_TGT_CROP; + + rval = v4l2_subdev_call( +@@ -688,6 +689,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg, + memset(&sel, 0, sizeof(sel)); + sel.which = crop->which; + sel.pad = crop->pad; ++ sel.stream = crop->stream; + sel.target = V4L2_SEL_TGT_CROP; + sel.r = crop->rect; + +-- +2.43.0 + diff --git a/queue-6.6/mlx5-avoid-truncating-error-message.patch b/queue-6.6/mlx5-avoid-truncating-error-message.patch new file mode 100644 index 00000000000..aa20cacb48a --- /dev/null +++ b/queue-6.6/mlx5-avoid-truncating-error-message.patch @@ -0,0 +1,41 @@ +From 650fb4f2c14f312730a82a87648b1f01b42ffab8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 23:38:03 +0100 +Subject: mlx5: avoid truncating error message + +From: Arnd Bergmann + +[ Upstream commit b324a960354b872431d25959ad384ab66a7116ec ] + +clang warns that one error message is too long for its destination buffer: + +drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c:1876:4: error: 'snprintf' will always be truncated; specified size is 80, but format string expands to at least 94 [-Werror,-Wformat-truncation-non-kprintf] + +Reword it to be a bit shorter so it always fits. + +Fixes: 70f0302b3f20 ("net/mlx5: Bridge, implement mdb offload") +Signed-off-by: Arnd Bergmann +Reviewed-by: Subbaraya Sundeep +Link: https://lore.kernel.org/r/20240326223825.4084412-5-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c +index 1b9bc32efd6fa..c5ea1d1d2b035 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c +@@ -1874,7 +1874,7 @@ int mlx5_esw_bridge_port_mdb_add(struct net_device *dev, u16 vport_num, u16 esw_ + "Failed to lookup bridge port vlan metadata to create MDB (MAC=%pM,vid=%u,vport=%u)\n", + addr, vid, vport_num); + NL_SET_ERR_MSG_FMT_MOD(extack, +- "Failed to lookup bridge port vlan metadata to create MDB (MAC=%pM,vid=%u,vport=%u)\n", ++ "Failed to lookup vlan metadata for MDB (MAC=%pM,vid=%u,vport=%u)\n", + addr, vid, vport_num); + return -EINVAL; + } +-- +2.43.0 + diff --git a/queue-6.6/mlx5-stop-warning-for-64kb-pages.patch b/queue-6.6/mlx5-stop-warning-for-64kb-pages.patch new file mode 100644 index 00000000000..3f9dd8aeb3b --- /dev/null +++ b/queue-6.6/mlx5-stop-warning-for-64kb-pages.patch @@ -0,0 +1,57 @@ +From c78d78e5a3ce4ddd3015d97ceb2845311cdfcd9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 15:30:46 +0100 +Subject: mlx5: stop warning for 64KB pages + +From: Arnd Bergmann + +[ Upstream commit a5535e5336943b33689f558199366102387b7bbf ] + +When building with 64KB pages, clang points out that xsk->chunk_size +can never be PAGE_SIZE: + +drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c:19:22: error: result of comparison of constant 65536 with expression of type 'u16' (aka 'unsigned short') is always false [-Werror,-Wtautological-constant-out-of-range-compare] + if (xsk->chunk_size > PAGE_SIZE || + ~~~~~~~~~~~~~~~ ^ ~~~~~~~~~ + +In older versions of this code, using PAGE_SIZE was the only +possibility, so this would have never worked on 64KB page kernels, +but the patch apparently did not address this case completely. + +As Maxim Mikityanskiy suggested, 64KB chunks are really not all that +useful, so just shut up the warning by adding a cast. + +Fixes: 282c0c798f8e ("net/mlx5e: Allow XSK frames smaller than a page") +Link: https://lore.kernel.org/netdev/20211013150232.2942146-1-arnd@kernel.org/ +Link: https://lore.kernel.org/lkml/a7b27541-0ebb-4f2d-bd06-270a4d404613@app.fastmail.com/ +Signed-off-by: Arnd Bergmann +Acked-by: Maxim Mikityanskiy +Reviewed-by: Justin Stitt +Reviewed-by: Tariq Toukan +Link: https://lore.kernel.org/r/20240328143051.1069575-9-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +index 36826b5824847..78739fe138ca4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +@@ -28,8 +28,10 @@ bool mlx5e_validate_xsk_param(struct mlx5e_params *params, + struct mlx5e_xsk_param *xsk, + struct mlx5_core_dev *mdev) + { +- /* AF_XDP doesn't support frames larger than PAGE_SIZE. */ +- if (xsk->chunk_size > PAGE_SIZE || xsk->chunk_size < MLX5E_MIN_XSK_CHUNK_SIZE) { ++ /* AF_XDP doesn't support frames larger than PAGE_SIZE, ++ * and xsk->chunk_size is limited to 65535 bytes. ++ */ ++ if ((size_t)xsk->chunk_size > PAGE_SIZE || xsk->chunk_size < MLX5E_MIN_XSK_CHUNK_SIZE) { + mlx5_core_err(mdev, "XSK chunk size %u out of bounds [%u, %lu]\n", xsk->chunk_size, + MLX5E_MIN_XSK_CHUNK_SIZE, PAGE_SIZE); + return false; +-- +2.43.0 + diff --git a/queue-6.6/mm-slub-kunit-use-inverted-data-to-corrupt-kmem-cach.patch b/queue-6.6/mm-slub-kunit-use-inverted-data-to-corrupt-kmem-cach.patch new file mode 100644 index 00000000000..2b44decd177 --- /dev/null +++ b/queue-6.6/mm-slub-kunit-use-inverted-data-to-corrupt-kmem-cach.patch @@ -0,0 +1,69 @@ +From 480687eb1d67acf05d9f03234d2b5147457356c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 06:38:39 -0700 +Subject: mm/slub, kunit: Use inverted data to corrupt kmem cache + +From: Guenter Roeck + +[ Upstream commit b1080c667b3b2c8c38a7fa83ca5567124887abae ] + +Two failure patterns are seen randomly when running slub_kunit tests with +CONFIG_SLAB_FREELIST_RANDOM and CONFIG_SLAB_FREELIST_HARDENED enabled. + +Pattern 1: + # test_clobber_zone: pass:1 fail:0 skip:0 total:1 + ok 1 test_clobber_zone + # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72 + Expected 3 == slab_errors, but + slab_errors == 0 (0x0) + # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:84 + Expected 2 == slab_errors, but + slab_errors == 0 (0x0) + # test_next_pointer: pass:0 fail:1 skip:0 total:1 + not ok 2 test_next_pointer + +In this case, test_next_pointer() overwrites p[s->offset], but the data +at p[s->offset] is already 0x12. + +Pattern 2: + ok 1 test_clobber_zone + # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72 + Expected 3 == slab_errors, but + slab_errors == 2 (0x2) + # test_next_pointer: pass:0 fail:1 skip:0 total:1 + not ok 2 test_next_pointer + +In this case, p[s->offset] has a value other than 0x12, but one of the +expected failures is nevertheless missing. + +Invert data instead of writing a fixed value to corrupt the cache data +structures to fix the problem. + +Fixes: 1f9f78b1b376 ("mm/slub, kunit: add a KUnit test for SLUB debugging functionality") +Cc: Oliver Glitta +Cc: Vlastimil Babka +CC: Daniel Latypov +Cc: Marco Elver +Signed-off-by: Guenter Roeck +Signed-off-by: Vlastimil Babka +Signed-off-by: Sasha Levin +--- + lib/slub_kunit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c +index d4a3730b08fa7..4ce9604388069 100644 +--- a/lib/slub_kunit.c ++++ b/lib/slub_kunit.c +@@ -55,7 +55,7 @@ static void test_next_pointer(struct kunit *test) + + ptr_addr = (unsigned long *)(p + s->offset); + tmp = *ptr_addr; +- p[s->offset] = 0x12; ++ p[s->offset] = ~p[s->offset]; + + /* + * Expecting three errors. +-- +2.43.0 + diff --git a/queue-6.6/mm-userfaultfd-do-not-place-zeropages-when-zeropages.patch b/queue-6.6/mm-userfaultfd-do-not-place-zeropages-when-zeropages.patch new file mode 100644 index 00000000000..5473895b4d9 --- /dev/null +++ b/queue-6.6/mm-userfaultfd-do-not-place-zeropages-when-zeropages.patch @@ -0,0 +1,95 @@ +From 42614db04b0887cc37067d9462b31d3373f19839 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 18:14:40 +0200 +Subject: mm/userfaultfd: Do not place zeropages when zeropages are disallowed + +From: David Hildenbrand + +[ Upstream commit 90a7592da14951bd21f74a53246ba30955a648aa ] + +s390x must disable shared zeropages for processes running VMs, because +the VMs could end up making use of "storage keys" or protected +virtualization, which are incompatible with shared zeropages. + +Yet, with userfaultfd it is possible to insert shared zeropages into +such processes. Let's fallback to simply allocating a fresh zeroed +anonymous folio and insert that instead. + +mm_forbids_zeropage() was introduced in commit 593befa6ab74 ("mm: introduce +mm_forbids_zeropage function"), briefly before userfaultfd went +upstream. + +Note that we don't want to fail the UFFDIO_ZEROPAGE request like we do +for hugetlb, it would be rather unexpected. Further, we also +cannot really indicated "not supported" to user space ahead of time: it +could be that the MM disallows zeropages after userfaultfd was already +registered. + +[ agordeev: Fixed checkpatch complaints ] + +Fixes: c1a4de99fada ("userfaultfd: mcopy_atomic|mfill_zeropage: UFFDIO_COPY|UFFDIO_ZEROPAGE preparation") +Reviewed-by: Peter Xu +Link: https://lore.kernel.org/r/20240411161441.910170-2-david@redhat.com +Signed-off-by: David Hildenbrand +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + mm/userfaultfd.c | 35 +++++++++++++++++++++++++++++++++++ + 1 file changed, 35 insertions(+) + +diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c +index cd5ad448ac2f0..e76faba102797 100644 +--- a/mm/userfaultfd.c ++++ b/mm/userfaultfd.c +@@ -213,6 +213,38 @@ static int mfill_atomic_pte_copy(pmd_t *dst_pmd, + goto out; + } + ++static int mfill_atomic_pte_zeroed_folio(pmd_t *dst_pmd, ++ struct vm_area_struct *dst_vma, ++ unsigned long dst_addr) ++{ ++ struct folio *folio; ++ int ret = -ENOMEM; ++ ++ folio = vma_alloc_zeroed_movable_folio(dst_vma, dst_addr); ++ if (!folio) ++ return ret; ++ ++ if (mem_cgroup_charge(folio, dst_vma->vm_mm, GFP_KERNEL)) ++ goto out_put; ++ ++ /* ++ * The memory barrier inside __folio_mark_uptodate makes sure that ++ * zeroing out the folio become visible before mapping the page ++ * using set_pte_at(). See do_anonymous_page(). ++ */ ++ __folio_mark_uptodate(folio); ++ ++ ret = mfill_atomic_install_pte(dst_pmd, dst_vma, dst_addr, ++ &folio->page, true, 0); ++ if (ret) ++ goto out_put; ++ ++ return 0; ++out_put: ++ folio_put(folio); ++ return ret; ++} ++ + static int mfill_atomic_pte_zeropage(pmd_t *dst_pmd, + struct vm_area_struct *dst_vma, + unsigned long dst_addr) +@@ -221,6 +253,9 @@ static int mfill_atomic_pte_zeropage(pmd_t *dst_pmd, + spinlock_t *ptl; + int ret; + ++ if (mm_forbids_zeropage(dst_vma->vm_mm)) ++ return mfill_atomic_pte_zeroed_folio(dst_pmd, dst_vma, dst_addr); ++ + _dst_pte = pte_mkspecial(pfn_pte(my_zero_pfn(dst_addr), + dst_vma->vm_page_prot)); + ret = -EAGAIN; +-- +2.43.0 + diff --git a/queue-6.6/modules-drop-the-.export_symbol-section-from-the-fin.patch b/queue-6.6/modules-drop-the-.export_symbol-section-from-the-fin.patch new file mode 100644 index 00000000000..dbc032d246f --- /dev/null +++ b/queue-6.6/modules-drop-the-.export_symbol-section-from-the-fin.patch @@ -0,0 +1,35 @@ +From 52f8769ef0c6f855ec9caddba181cda0c2a0c4ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 13:35:30 +0800 +Subject: modules: Drop the .export_symbol section from the final modules + +From: Wang Yao + +[ Upstream commit 8fe51b45c5645c259f759479c374648e9dfeaa03 ] + +Commit ddb5cdbafaaa ("kbuild: generate KSYMTAB entries by modpost") +forget drop the .export_symbol section from the final modules. + +Fixes: ddb5cdbafaaa ("kbuild: generate KSYMTAB entries by modpost") +Signed-off-by: Wang Yao +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/module.lds.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/scripts/module.lds.S b/scripts/module.lds.S +index bf5bcf2836d81..89ff01a22634f 100644 +--- a/scripts/module.lds.S ++++ b/scripts/module.lds.S +@@ -13,6 +13,7 @@ SECTIONS { + /DISCARD/ : { + *(.discard) + *(.discard.*) ++ *(.export_symbol) + } + + __ksymtab 0 : { *(SORT(___ksymtab+*)) } +-- +2.43.0 + diff --git a/queue-6.6/mptcp-so_keepalive-fix-getsockopt-support.patch b/queue-6.6/mptcp-so_keepalive-fix-getsockopt-support.patch new file mode 100644 index 00000000000..f3d458333da --- /dev/null +++ b/queue-6.6/mptcp-so_keepalive-fix-getsockopt-support.patch @@ -0,0 +1,53 @@ +From 2b159fa98f0638d3a7f2d497ea9846d9672c9c96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 18:13:25 -0700 +Subject: mptcp: SO_KEEPALIVE: fix getsockopt support + +From: Matthieu Baerts (NGI0) + +[ Upstream commit a65198136eaa15b74ee0abf73f12ef83d469a334 ] + +SO_KEEPALIVE support has to be set on each subflow: on each TCP socket, +where sk_prot->keepalive is defined. Technically, nothing has to be done +on the MPTCP socket. That's why mptcp_sol_socket_sync_intval() was +called instead of mptcp_sol_socket_intval(). + +Except that when nothing is done on the MPTCP socket, the +getsockopt(SO_KEEPALIVE), handled in net/core/sock.c:sk_getsockopt(), +will not know if SO_KEEPALIVE has been set on the different subflows or +not. + +The fix is simple: simply call mptcp_sol_socket_intval() which will end +up calling net/core/sock.c:sk_setsockopt() where the SOCK_KEEPOPEN flag +will be set, the one used in sk_getsockopt(). + +So now, getsockopt(SO_KEEPALIVE) on an MPTCP socket will return the same +value as the one previously set with setsockopt(SO_KEEPALIVE). + +Fixes: 1b3e7ede1365 ("mptcp: setsockopt: handle SO_KEEPALIVE and SO_PRIORITY") +Acked-by: Paolo Abeni +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Mat Martineau +Link: https://lore.kernel.org/r/20240514011335.176158-2-martineau@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/sockopt.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c +index 116e3008231bd..1afa8245f27c0 100644 +--- a/net/mptcp/sockopt.c ++++ b/net/mptcp/sockopt.c +@@ -181,8 +181,6 @@ static int mptcp_setsockopt_sol_socket_int(struct mptcp_sock *msk, int optname, + + switch (optname) { + case SO_KEEPALIVE: +- mptcp_sol_socket_sync_intval(msk, optname, val); +- return 0; + case SO_DEBUG: + case SO_MARK: + case SO_PRIORITY: +-- +2.43.0 + diff --git a/queue-6.6/mtd-core-report-error-if-first-mtd_otp_size-call-fai.patch b/queue-6.6/mtd-core-report-error-if-first-mtd_otp_size-call-fai.patch new file mode 100644 index 00000000000..b73354385da --- /dev/null +++ b/queue-6.6/mtd-core-report-error-if-first-mtd_otp_size-call-fai.patch @@ -0,0 +1,44 @@ +From c3f3ea31a131078d0dab48b2eeef8466cd24c519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 19:34:24 +0200 +Subject: mtd: core: Report error if first mtd_otp_size() call fails in + mtd_otp_nvmem_add() + +From: Aapo Vienamo + +[ Upstream commit d44f0bbbd8d182debcce88bda55b05269f3d33d6 ] + +Jump to the error reporting code in mtd_otp_nvmem_add() if the +mtd_otp_size() call fails. Without this fix, the error is not logged. + +Signed-off-by: Aapo Vienamo +Reviewed-by: Mika Westerberg +Reviewed-by: Michael Walle +Fixes: 4b361cfa8624 ("mtd: core: add OTP nvmem provider support") +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20240313173425.1325790-2-aapo.vienamo@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdcore.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c +index 5c32208b17a1d..97ca2a897f1d4 100644 +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -955,8 +955,10 @@ static int mtd_otp_nvmem_add(struct mtd_info *mtd) + + if (mtd->_get_user_prot_info && mtd->_read_user_prot_reg) { + size = mtd_otp_size(mtd, true); +- if (size < 0) +- return size; ++ if (size < 0) { ++ err = size; ++ goto err; ++ } + + if (size > 0) { + nvmem = mtd_otp_nvmem_register(mtd, "user-otp", size, +-- +2.43.0 + diff --git a/queue-6.6/mtd-rawnand-hynix-fixed-typo.patch b/queue-6.6/mtd-rawnand-hynix-fixed-typo.patch new file mode 100644 index 00000000000..d18a7f73ca7 --- /dev/null +++ b/queue-6.6/mtd-rawnand-hynix-fixed-typo.patch @@ -0,0 +1,43 @@ +From bd77077aa4267493cf0bf8c0e44664c77a84aa88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 13:27:20 +0300 +Subject: mtd: rawnand: hynix: fixed typo + +From: Maxim Korotkov + +[ Upstream commit 6819db94e1cd3ce24a432f3616cd563ed0c4eaba ] + +The function hynix_nand_rr_init() should probably return an error code. +Judging by the usage, it seems that the return code is passed up +the call stack. +Right now, it always returns 0 and the function hynix_nand_cleanup() +in hynix_nand_init() has never been called. + +Found by RASU JSC and Linux Verification Center (linuxtesting.org) + +Fixes: 626994e07480 ("mtd: nand: hynix: Add read-retry support for 1x nm MLC NANDs") + +Signed-off-by: Maxim Korotkov +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20240313102721.1991299-1-korotkov.maxim.s@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/nand_hynix.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/nand_hynix.c b/drivers/mtd/nand/raw/nand_hynix.c +index 39076735a3fbb..9695f07b5eb26 100644 +--- a/drivers/mtd/nand/raw/nand_hynix.c ++++ b/drivers/mtd/nand/raw/nand_hynix.c +@@ -402,7 +402,7 @@ static int hynix_nand_rr_init(struct nand_chip *chip) + if (ret) + pr_warn("failed to initialize read-retry infrastructure"); + +- return 0; ++ return ret; + } + + static void hynix_nand_extract_oobsize(struct nand_chip *chip, +-- +2.43.0 + diff --git a/queue-6.6/net-bridge-mst-fix-vlan-use-after-free.patch b/queue-6.6/net-bridge-mst-fix-vlan-use-after-free.patch new file mode 100644 index 00000000000..69398f5ff67 --- /dev/null +++ b/queue-6.6/net-bridge-mst-fix-vlan-use-after-free.patch @@ -0,0 +1,123 @@ +From cd92a91bb3452c218d65a52775c7985ca805e4fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 14:06:27 +0300 +Subject: net: bridge: mst: fix vlan use-after-free + +From: Nikolay Aleksandrov + +[ Upstream commit 3a7c1661ae1383364cd6092d851f5e5da64d476b ] + +syzbot reported a suspicious rcu usage[1] in bridge's mst code. While +fixing it I noticed that nothing prevents a vlan to be freed while +walking the list from the same path (br forward delay timer). Fix the rcu +usage and also make sure we are not accessing freed memory by making +br_mst_vlan_set_state use rcu read lock. + +[1] + WARNING: suspicious RCU usage + 6.9.0-rc6-syzkaller #0 Not tainted + ----------------------------- + net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage! + ... + stack backtrace: + CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 + Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 + lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 + nbp_vlan_group net/bridge/br_private.h:1599 [inline] + br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 + br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 + br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 + call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 + expire_timers kernel/time/timer.c:1844 [inline] + __run_timers kernel/time/timer.c:2418 [inline] + __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 + run_timer_base kernel/time/timer.c:2438 [inline] + run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 + __do_softirq+0x2c6/0x980 kernel/softirq.c:554 + invoke_softirq kernel/softirq.c:428 [inline] + __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 + irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 + instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] + sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 + + + asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 + RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 + Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 + RSP: 0018:ffffc90013657100 EFLAGS: 00000206 + RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 + RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 + RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 + R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 + R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246 + +Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") +Reported-by: syzbot+fa04eb8a56fd923fc5d8@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=fa04eb8a56fd923fc5d8 +Signed-off-by: Nikolay Aleksandrov +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_mst.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c +index ee680adcee179..3c66141d34d62 100644 +--- a/net/bridge/br_mst.c ++++ b/net/bridge/br_mst.c +@@ -78,7 +78,7 @@ static void br_mst_vlan_set_state(struct net_bridge_port *p, struct net_bridge_v + { + struct net_bridge_vlan_group *vg = nbp_vlan_group(p); + +- if (v->state == state) ++ if (br_vlan_get_state(v) == state) + return; + + br_vlan_set_state(v, state); +@@ -100,11 +100,12 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, + }; + struct net_bridge_vlan_group *vg; + struct net_bridge_vlan *v; +- int err; ++ int err = 0; + ++ rcu_read_lock(); + vg = nbp_vlan_group(p); + if (!vg) +- return 0; ++ goto out; + + /* MSTI 0 (CST) state changes are notified via the regular + * SWITCHDEV_ATTR_ID_PORT_STP_STATE. +@@ -112,17 +113,20 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, + if (msti) { + err = switchdev_port_attr_set(p->dev, &attr, extack); + if (err && err != -EOPNOTSUPP) +- return err; ++ goto out; + } + +- list_for_each_entry(v, &vg->vlan_list, vlist) { ++ err = 0; ++ list_for_each_entry_rcu(v, &vg->vlan_list, vlist) { + if (v->brvlan->msti != msti) + continue; + + br_mst_vlan_set_state(p, v, state); + } + +- return 0; ++out: ++ rcu_read_unlock(); ++ return err; + } + + static void br_mst_vlan_sync_state(struct net_bridge_vlan *pv, u16 msti) +-- +2.43.0 + diff --git a/queue-6.6/net-bridge-xmit-make-sure-we-have-at-least-eth-heade.patch b/queue-6.6/net-bridge-xmit-make-sure-we-have-at-least-eth-heade.patch new file mode 100644 index 00000000000..bb04e3219eb --- /dev/null +++ b/queue-6.6/net-bridge-xmit-make-sure-we-have-at-least-eth-heade.patch @@ -0,0 +1,90 @@ +From 85f55d7d5d0e798a790810c9501800216f3f3e30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 13:34:19 +0300 +Subject: net: bridge: xmit: make sure we have at least eth header len bytes + +From: Nikolay Aleksandrov + +[ Upstream commit 8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc ] + +syzbot triggered an uninit value[1] error in bridge device's xmit path +by sending a short (less than ETH_HLEN bytes) skb. To fix it check if +we can actually pull that amount instead of assuming. + +Tested with dropwatch: + drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3) + origin: software + timestamp: Mon May 13 11:31:53 2024 778214037 nsec + protocol: 0x88a8 + length: 2 + original length: 2 + drop reason: PKT_TOO_SMALL + +[1] +BUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65 + br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65 + __netdev_start_xmit include/linux/netdevice.h:4903 [inline] + netdev_start_xmit include/linux/netdevice.h:4917 [inline] + xmit_one net/core/dev.c:3531 [inline] + dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 + __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341 + dev_queue_xmit include/linux/netdevice.h:3091 [inline] + __bpf_tx_skb net/core/filter.c:2136 [inline] + __bpf_redirect_common net/core/filter.c:2180 [inline] + __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187 + ____bpf_clone_redirect net/core/filter.c:2460 [inline] + bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432 + ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997 + __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238 + bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] + __bpf_prog_run include/linux/filter.h:657 [inline] + bpf_prog_run include/linux/filter.h:664 [inline] + bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425 + bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058 + bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269 + __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678 + __do_sys_bpf kernel/bpf/syscall.c:5767 [inline] + __se_sys_bpf kernel/bpf/syscall.c:5765 [inline] + __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765 + x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40 +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_device.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c +index 9a5ea06236bd7..42d4c3727bf76 100644 +--- a/net/bridge/br_device.c ++++ b/net/bridge/br_device.c +@@ -27,6 +27,7 @@ EXPORT_SYMBOL_GPL(nf_br_ops); + /* net device transmit always called with BH disabled */ + netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) + { ++ enum skb_drop_reason reason = pskb_may_pull_reason(skb, ETH_HLEN); + struct net_bridge_mcast_port *pmctx_null = NULL; + struct net_bridge *br = netdev_priv(dev); + struct net_bridge_mcast *brmctx = &br->multicast_ctx; +@@ -38,6 +39,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) + const unsigned char *dest; + u16 vid = 0; + ++ if (unlikely(reason != SKB_NOT_DROPPED_YET)) { ++ kfree_skb_reason(skb, reason); ++ return NETDEV_TX_OK; ++ } ++ + memset(skb->cb, 0, sizeof(struct br_input_skb_cb)); + br_tc_skb_miss_set(skb, false); + +-- +2.43.0 + diff --git a/queue-6.6/net-dsa-mv88e6xxx-add-support-for-model-specific-pre.patch b/queue-6.6/net-dsa-mv88e6xxx-add-support-for-model-specific-pre.patch new file mode 100644 index 00000000000..b56526c5191 --- /dev/null +++ b/queue-6.6/net-dsa-mv88e6xxx-add-support-for-model-specific-pre.patch @@ -0,0 +1,234 @@ +From 6da623dedd878513ca66109a848f8d05bea7777d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 09:47:48 +0200 +Subject: net: dsa: mv88e6xxx: Add support for model-specific pre- and + post-reset handlers + +From: Matthias Schiffer + +[ Upstream commit 0fdd27b9d6d7c60bd319d3497ad797934bab13cb ] + +Instead of calling mv88e6xxx_g2_eeprom_wait() directly from +mv88e6xxx_hardware_reset(), add configurable pre- and post-reset hard +reset handlers. Initially, the handlers are set to +mv88e6xxx_g2_eeprom_wait() for all families that have get/set_eeprom() +to match the existing behavior. No functional change intended (except +for additional error messages on failure). + +Fixes: 6ccf50d4d474 ("net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 50 +++++++++++++++++++++++++++++--- + drivers/net/dsa/mv88e6xxx/chip.h | 6 ++++ + 2 files changed, 52 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index e5bac87941f61..a2aec16abb8fc 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3021,6 +3021,7 @@ static int mv88e6xxx_software_reset(struct mv88e6xxx_chip *chip) + static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip) + { + struct gpio_desc *gpiod = chip->reset; ++ int err; + + /* If there is a GPIO connected to the reset pin, toggle it */ + if (gpiod) { +@@ -3029,17 +3030,26 @@ static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip) + * mid-byte, causing the first EEPROM read after the reset + * from the wrong location resulting in the switch booting + * to wrong mode and inoperable. ++ * For this reason, switch families with EEPROM support ++ * generally wait for EEPROM loads to complete as their pre- ++ * and post-reset handlers. + */ +- if (chip->info->ops->get_eeprom) +- mv88e6xxx_g2_eeprom_wait(chip); ++ if (chip->info->ops->hardware_reset_pre) { ++ err = chip->info->ops->hardware_reset_pre(chip); ++ if (err) ++ dev_err(chip->dev, "pre-reset error: %d\n", err); ++ } + + gpiod_set_value_cansleep(gpiod, 1); + usleep_range(10000, 20000); + gpiod_set_value_cansleep(gpiod, 0); + usleep_range(10000, 20000); + +- if (chip->info->ops->get_eeprom) +- mv88e6xxx_g2_eeprom_wait(chip); ++ if (chip->info->ops->hardware_reset_post) { ++ err = chip->info->ops->hardware_reset_post(chip); ++ if (err) ++ dev_err(chip->dev, "post-reset error: %d\n", err); ++ } + } + } + +@@ -4266,6 +4276,8 @@ static const struct mv88e6xxx_ops mv88e6141_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4456,6 +4468,8 @@ static const struct mv88e6xxx_ops mv88e6172_ops = { + .watchdog_ops = &mv88e6097_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4556,6 +4570,8 @@ static const struct mv88e6xxx_ops mv88e6176_ops = { + .watchdog_ops = &mv88e6097_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4650,6 +4666,8 @@ static const struct mv88e6xxx_ops mv88e6190_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4708,6 +4726,8 @@ static const struct mv88e6xxx_ops mv88e6190x_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4764,6 +4784,8 @@ static const struct mv88e6xxx_ops mv88e6191_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4823,6 +4845,8 @@ static const struct mv88e6xxx_ops mv88e6240_ops = { + .watchdog_ops = &mv88e6097_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4876,6 +4900,8 @@ static const struct mv88e6xxx_ops mv88e6250_ops = { + .watchdog_ops = &mv88e6250_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6250_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +@@ -4923,6 +4949,8 @@ static const struct mv88e6xxx_ops mv88e6290_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4982,6 +5010,8 @@ static const struct mv88e6xxx_ops mv88e6320_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +@@ -5028,6 +5058,8 @@ static const struct mv88e6xxx_ops mv88e6321_ops = { + .set_egress_port = mv88e6095_g1_set_egress_port, + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +@@ -5078,6 +5110,8 @@ static const struct mv88e6xxx_ops mv88e6341_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -5233,6 +5267,8 @@ static const struct mv88e6xxx_ops mv88e6352_ops = { + .watchdog_ops = &mv88e6097_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -5295,6 +5331,8 @@ static const struct mv88e6xxx_ops mv88e6390_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -5357,6 +5395,8 @@ static const struct mv88e6xxx_ops mv88e6390x_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -5422,6 +5462,8 @@ static const struct mv88e6xxx_ops mv88e6393x_ops = { + .watchdog_ops = &mv88e6393x_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6393x_port_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h +index c54d305a1d831..f48a3c0ac7f96 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.h ++++ b/drivers/net/dsa/mv88e6xxx/chip.h +@@ -476,6 +476,12 @@ struct mv88e6xxx_ops { + int (*ppu_enable)(struct mv88e6xxx_chip *chip); + int (*ppu_disable)(struct mv88e6xxx_chip *chip); + ++ /* Additional handlers to run before and after hard reset, to make sure ++ * that the switch and EEPROM are in a good state. ++ */ ++ int (*hardware_reset_pre)(struct mv88e6xxx_chip *chip); ++ int (*hardware_reset_post)(struct mv88e6xxx_chip *chip); ++ + /* Switch Software Reset */ + int (*reset)(struct mv88e6xxx_chip *chip); + +-- +2.43.0 + diff --git a/queue-6.6/net-dsa-mv88e6xxx-avoid-eeprom-timeout-without-eepro.patch b/queue-6.6/net-dsa-mv88e6xxx-avoid-eeprom-timeout-without-eepro.patch new file mode 100644 index 00000000000..9a31d7c209a --- /dev/null +++ b/queue-6.6/net-dsa-mv88e6xxx-avoid-eeprom-timeout-without-eepro.patch @@ -0,0 +1,173 @@ +From bed7e22fcafec0a26010202d43cf2f5d818730c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 09:47:49 +0200 +Subject: net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on + 88E6250-family switches + +From: Matthias Schiffer + +[ Upstream commit e44894e2aa4eb311ceda134de8b6f51ff979211b ] + +88E6250-family switches have the quirk that the EEPROM Running flag can +get stuck at 1 when no EEPROM is connected, causing +mv88e6xxx_g2_eeprom_wait() to time out. We still want to wait for the +EEPROM however, to avoid interrupting a transfer and leaving the EEPROM +in an invalid state. + +The condition to wait for recommended by the hardware spec is the EEInt +flag, however this flag is cleared on read, so before the hardware reset, +is may have been cleared already even though the EEPROM has been read +successfully. + +For this reason, we revive the mv88e6xxx_g1_wait_eeprom_done() function +that was removed in commit 6ccf50d4d474 +("net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent") in a +slightly refactored form, and introduce a new +mv88e6xxx_g1_wait_eeprom_done_prereset() that additionally handles this +case by triggering another EEPROM reload that can be waited on. + +On other switch models without this quirk, mv88e6xxx_g2_eeprom_wait() is +kept, as it avoids the additional reload. + +Fixes: 6ccf50d4d474 ("net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 4 +- + drivers/net/dsa/mv88e6xxx/global1.c | 89 +++++++++++++++++++++++++++++ + drivers/net/dsa/mv88e6xxx/global1.h | 2 + + 3 files changed, 93 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index a2aec16abb8fc..9571e1b1e59ef 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -4900,8 +4900,8 @@ static const struct mv88e6xxx_ops mv88e6250_ops = { + .watchdog_ops = &mv88e6250_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, +- .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, +- .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_pre = mv88e6250_g1_wait_eeprom_done_prereset, ++ .hardware_reset_post = mv88e6xxx_g1_wait_eeprom_done, + .reset = mv88e6250_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c +index 174c773b38c2b..7ef0f4426ad71 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.c ++++ b/drivers/net/dsa/mv88e6xxx/global1.c +@@ -75,6 +75,95 @@ static int mv88e6xxx_g1_wait_init_ready(struct mv88e6xxx_chip *chip) + return mv88e6xxx_g1_wait_bit(chip, MV88E6XXX_G1_STS, bit, 1); + } + ++static int mv88e6250_g1_eeprom_reload(struct mv88e6xxx_chip *chip) ++{ ++ /* MV88E6185_G1_CTL1_RELOAD_EEPROM is also valid for 88E6250 */ ++ int bit = __bf_shf(MV88E6185_G1_CTL1_RELOAD_EEPROM); ++ u16 val; ++ int err; ++ ++ err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &val); ++ if (err) ++ return err; ++ ++ val |= MV88E6185_G1_CTL1_RELOAD_EEPROM; ++ ++ err = mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, val); ++ if (err) ++ return err; ++ ++ return mv88e6xxx_g1_wait_bit(chip, MV88E6XXX_G1_CTL1, bit, 0); ++} ++ ++/* Returns 0 when done, -EBUSY when waiting, other negative codes on error */ ++static int mv88e6xxx_g1_is_eeprom_done(struct mv88e6xxx_chip *chip) ++{ ++ u16 val; ++ int err; ++ ++ err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, &val); ++ if (err < 0) { ++ dev_err(chip->dev, "Error reading status"); ++ return err; ++ } ++ ++ /* If the switch is still resetting, it may not ++ * respond on the bus, and so MDIO read returns ++ * 0xffff. Differentiate between that, and waiting for ++ * the EEPROM to be done by bit 0 being set. ++ */ ++ if (val == 0xffff || !(val & BIT(MV88E6XXX_G1_STS_IRQ_EEPROM_DONE))) ++ return -EBUSY; ++ ++ return 0; ++} ++ ++/* As the EEInt (EEPROM done) flag clears on read if the status register, this ++ * function must be called directly after a hard reset or EEPROM ReLoad request, ++ * or the done condition may have been missed ++ */ ++int mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip) ++{ ++ const unsigned long timeout = jiffies + 1 * HZ; ++ int ret; ++ ++ /* Wait up to 1 second for the switch to finish reading the ++ * EEPROM. ++ */ ++ while (time_before(jiffies, timeout)) { ++ ret = mv88e6xxx_g1_is_eeprom_done(chip); ++ if (ret != -EBUSY) ++ return ret; ++ } ++ ++ dev_err(chip->dev, "Timeout waiting for EEPROM done"); ++ return -ETIMEDOUT; ++} ++ ++int mv88e6250_g1_wait_eeprom_done_prereset(struct mv88e6xxx_chip *chip) ++{ ++ int ret; ++ ++ ret = mv88e6xxx_g1_is_eeprom_done(chip); ++ if (ret != -EBUSY) ++ return ret; ++ ++ /* Pre-reset, we don't know the state of the switch - when ++ * mv88e6xxx_g1_is_eeprom_done() returns -EBUSY, that may be because ++ * the switch is actually busy reading the EEPROM, or because ++ * MV88E6XXX_G1_STS_IRQ_EEPROM_DONE has been cleared by an unrelated ++ * status register read already. ++ * ++ * To account for the latter case, trigger another EEPROM reload for ++ * another chance at seeing the done flag. ++ */ ++ ret = mv88e6250_g1_eeprom_reload(chip); ++ if (ret) ++ return ret; ++ ++ return mv88e6xxx_g1_wait_eeprom_done(chip); ++} ++ + /* Offset 0x01: Switch MAC Address Register Bytes 0 & 1 + * Offset 0x02: Switch MAC Address Register Bytes 2 & 3 + * Offset 0x03: Switch MAC Address Register Bytes 4 & 5 +diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h +index 1095261f5b490..3dbb7a1b8fe11 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.h ++++ b/drivers/net/dsa/mv88e6xxx/global1.h +@@ -282,6 +282,8 @@ int mv88e6xxx_g1_set_switch_mac(struct mv88e6xxx_chip *chip, u8 *addr); + int mv88e6185_g1_reset(struct mv88e6xxx_chip *chip); + int mv88e6352_g1_reset(struct mv88e6xxx_chip *chip); + int mv88e6250_g1_reset(struct mv88e6xxx_chip *chip); ++int mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip); ++int mv88e6250_g1_wait_eeprom_done_prereset(struct mv88e6xxx_chip *chip); + + int mv88e6185_g1_ppu_enable(struct mv88e6xxx_chip *chip); + int mv88e6185_g1_ppu_disable(struct mv88e6xxx_chip *chip); +-- +2.43.0 + diff --git a/queue-6.6/net-ethernet-cortina-locking-fixes.patch b/queue-6.6/net-ethernet-cortina-locking-fixes.patch new file mode 100644 index 00000000000..bbe9299e7c3 --- /dev/null +++ b/queue-6.6/net-ethernet-cortina-locking-fixes.patch @@ -0,0 +1,86 @@ +From 0e07c85d4d9b1bc57453f9add5a4d296b96ee751 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 09:44:54 +0200 +Subject: net: ethernet: cortina: Locking fixes + +From: Linus Walleij + +[ Upstream commit 812552808f7ff71133fc59768cdc253c5b8ca1bf ] + +This fixes a probably long standing problem in the Cortina +Gemini ethernet driver: there are some paths in the code +where the IRQ registers are written without taking the proper +locks. + +Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") +Signed-off-by: Linus Walleij +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240509-gemini-ethernet-locking-v1-1-afd00a528b95@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cortina/gemini.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index 636949737d72f..f69d974a23a1f 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -1108,10 +1108,13 @@ static void gmac_tx_irq_enable(struct net_device *netdev, + { + struct gemini_ethernet_port *port = netdev_priv(netdev); + struct gemini_ethernet *geth = port->geth; ++ unsigned long flags; + u32 val, mask; + + netdev_dbg(netdev, "%s device %d\n", __func__, netdev->dev_id); + ++ spin_lock_irqsave(&geth->irq_lock, flags); ++ + mask = GMAC0_IRQ0_TXQ0_INTS << (6 * netdev->dev_id + txq); + + if (en) +@@ -1120,6 +1123,8 @@ static void gmac_tx_irq_enable(struct net_device *netdev, + val = readl(geth->base + GLOBAL_INTERRUPT_ENABLE_0_REG); + val = en ? val | mask : val & ~mask; + writel(val, geth->base + GLOBAL_INTERRUPT_ENABLE_0_REG); ++ ++ spin_unlock_irqrestore(&geth->irq_lock, flags); + } + + static void gmac_tx_irq(struct net_device *netdev, unsigned int txq_num) +@@ -1426,15 +1431,19 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget) + union gmac_rxdesc_3 word3; + struct page *page = NULL; + unsigned int page_offs; ++ unsigned long flags; + unsigned short r, w; + union dma_rwptr rw; + dma_addr_t mapping; + int frag_nr = 0; + ++ spin_lock_irqsave(&geth->irq_lock, flags); + rw.bits32 = readl(ptr_reg); + /* Reset interrupt as all packages until here are taken into account */ + writel(DEFAULT_Q0_INT_BIT << netdev->dev_id, + geth->base + GLOBAL_INTERRUPT_STATUS_1_REG); ++ spin_unlock_irqrestore(&geth->irq_lock, flags); ++ + r = rw.bits.rptr; + w = rw.bits.wptr; + +@@ -1737,10 +1746,9 @@ static irqreturn_t gmac_irq(int irq, void *data) + gmac_update_hw_stats(netdev); + + if (val & (GMAC0_RX_OVERRUN_INT_BIT << (netdev->dev_id * 8))) { ++ spin_lock(&geth->irq_lock); + writel(GMAC0_RXDERR_INT_BIT << (netdev->dev_id * 8), + geth->base + GLOBAL_INTERRUPT_STATUS_4_REG); +- +- spin_lock(&geth->irq_lock); + u64_stats_update_begin(&port->ir_stats_syncp); + ++port->stats.rx_fifo_errors; + u64_stats_update_end(&port->ir_stats_syncp); +-- +2.43.0 + diff --git a/queue-6.6/net-fec-remove-.ndo_poll_controller-to-avoid-deadloc.patch b/queue-6.6/net-fec-remove-.ndo_poll_controller-to-avoid-deadloc.patch new file mode 100644 index 00000000000..2a33c01880d --- /dev/null +++ b/queue-6.6/net-fec-remove-.ndo_poll_controller-to-avoid-deadloc.patch @@ -0,0 +1,75 @@ +From d293d08ce6840b767e34e9e604de692fa2cb3a88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 May 2024 14:20:09 +0800 +Subject: net: fec: remove .ndo_poll_controller to avoid deadlocks + +From: Wei Fang + +[ Upstream commit c2e0c58b25a0a0c37ec643255558c5af4450c9f5 ] + +There is a deadlock issue found in sungem driver, please refer to the +commit ac0a230f719b ("eth: sungem: remove .ndo_poll_controller to avoid +deadlocks"). The root cause of the issue is that netpoll is in atomic +context and disable_irq() is called by .ndo_poll_controller interface +of sungem driver, however, disable_irq() might sleep. After analyzing +the implementation of fec_poll_controller(), the fec driver should have +the same issue. Due to the fec driver uses NAPI for TX completions, the +.ndo_poll_controller is unnecessary to be implemented in the fec driver, +so fec_poll_controller() can be safely removed. + +Fixes: 7f5c6addcdc0 ("net/fec: add poll controller function for fec nic") +Signed-off-by: Wei Fang +Link: https://lore.kernel.org/r/20240511062009.652918-1-wei.fang@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 26 ----------------------- + 1 file changed, 26 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 7ca8cd78d5574..ca50472479f6d 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3657,29 +3657,6 @@ fec_set_mac_address(struct net_device *ndev, void *p) + return 0; + } + +-#ifdef CONFIG_NET_POLL_CONTROLLER +-/** +- * fec_poll_controller - FEC Poll controller function +- * @dev: The FEC network adapter +- * +- * Polled functionality used by netconsole and others in non interrupt mode +- * +- */ +-static void fec_poll_controller(struct net_device *dev) +-{ +- int i; +- struct fec_enet_private *fep = netdev_priv(dev); +- +- for (i = 0; i < FEC_IRQ_NUM; i++) { +- if (fep->irq[i] > 0) { +- disable_irq(fep->irq[i]); +- fec_enet_interrupt(fep->irq[i], dev); +- enable_irq(fep->irq[i]); +- } +- } +-} +-#endif +- + static inline void fec_enet_set_netdev_features(struct net_device *netdev, + netdev_features_t features) + { +@@ -3986,9 +3963,6 @@ static const struct net_device_ops fec_netdev_ops = { + .ndo_tx_timeout = fec_timeout, + .ndo_set_mac_address = fec_set_mac_address, + .ndo_eth_ioctl = phy_do_ioctl_running, +-#ifdef CONFIG_NET_POLL_CONTROLLER +- .ndo_poll_controller = fec_poll_controller, +-#endif + .ndo_set_features = fec_set_features, + .ndo_bpf = fec_enet_bpf, + .ndo_xdp_xmit = fec_enet_xdp_xmit, +-- +2.43.0 + diff --git a/queue-6.6/net-give-more-chances-to-rcu-in-netdev_wait_allrefs_.patch b/queue-6.6/net-give-more-chances-to-rcu-in-netdev_wait_allrefs_.patch new file mode 100644 index 00000000000..63591600729 --- /dev/null +++ b/queue-6.6/net-give-more-chances-to-rcu-in-netdev_wait_allrefs_.patch @@ -0,0 +1,54 @@ +From e6c1710045fa880a53df0d001b18aa629dc5954d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 06:42:22 +0000 +Subject: net: give more chances to rcu in netdev_wait_allrefs_any() + +From: Eric Dumazet + +[ Upstream commit cd42ba1c8ac9deb9032add6adf491110e7442040 ] + +This came while reviewing commit c4e86b4363ac ("net: add two more +call_rcu_hurry()"). + +Paolo asked if adding one synchronize_rcu() would help. + +While synchronize_rcu() does not help, making sure to call +rcu_barrier() before msleep(wait) is definitely helping +to make sure lazy call_rcu() are completed. + +Instead of waiting ~100 seconds in my tests, the ref_tracker +splats occurs one time only, and netdev_wait_allrefs_any() +latency is reduced to the strict minimum. + +Ideally we should audit our call_rcu() users to make sure +no refcount (or cascading call_rcu()) is held too long, +because rcu_barrier() is quite expensive. + +Fixes: 0e4be9e57e8c ("net: use exponential backoff in netdev_wait_allrefs") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/all/28bbf698-befb-42f6-b561-851c67f464aa@kernel.org/T/#m76d73ed6b03cd930778ac4d20a777f22a08d6824 +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 1f6c8945f2eca..5a5bd339f11eb 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -10430,8 +10430,9 @@ static struct net_device *netdev_wait_allrefs_any(struct list_head *list) + rebroadcast_time = jiffies; + } + ++ rcu_barrier(); ++ + if (!wait) { +- rcu_barrier(); + wait = WAIT_REFS_MIN_MSECS; + } else { + msleep(wait); +-- +2.43.0 + diff --git a/queue-6.6/net-ipv6-fix-wrong-start-position-when-receive-hop-b.patch b/queue-6.6/net-ipv6-fix-wrong-start-position-when-receive-hop-b.patch new file mode 100644 index 00000000000..33f10d507bd --- /dev/null +++ b/queue-6.6/net-ipv6-fix-wrong-start-position-when-receive-hop-b.patch @@ -0,0 +1,41 @@ +From 7ed7ab54f9a4c8d5132c63a27e7b959d9eb97e4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:19:17 +0800 +Subject: net: ipv6: fix wrong start position when receive hop-by-hop fragment + +From: gaoxingwang + +[ Upstream commit 1cd354fe1e4864eeaff62f66ee513080ec946f20 ] + +In IPv6, ipv6_rcv_core will parse the hop-by-hop type extension header and increase skb->transport_header by one extension header length. +But if there are more other extension headers like fragment header at this time, the skb->transport_header points to the second extension header, +not the transport layer header or the first extension header. + +This will result in the start and nexthdrp variable not pointing to the same position in ipv6frag_thdr_trunced, +and ipv6_skip_exthdr returning incorrect offset and frag_off.Sometimes,the length of the last sharded packet is smaller than the calculated incorrect offset, resulting in packet loss. +We can use network header to offset and calculate the correct position to solve this problem. + +Fixes: 9d9e937b1c8b (ipv6/netfilter: Discard first fragment not including all headers) +Signed-off-by: Gao Xingwang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/reassembly.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c +index 5ebc47da1000c..2af98edef87ee 100644 +--- a/net/ipv6/reassembly.c ++++ b/net/ipv6/reassembly.c +@@ -369,7 +369,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) + * the source of the fragment, with the Pointer field set to zero. + */ + nexthdr = hdr->nexthdr; +- if (ipv6frag_thdr_truncated(skb, skb_transport_offset(skb), &nexthdr)) { ++ if (ipv6frag_thdr_truncated(skb, skb_network_offset(skb) + sizeof(struct ipv6hdr), &nexthdr)) { + __IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev), + IPSTATS_MIB_INHDRERRORS); + icmpv6_param_prob(skb, ICMPV6_HDR_INCOMP, 0); +-- +2.43.0 + diff --git a/queue-6.6/net-micrel-fix-receiving-the-timestamp-in-the-frame-.patch b/queue-6.6/net-micrel-fix-receiving-the-timestamp-in-the-frame-.patch new file mode 100644 index 00000000000..a2cebfb20a0 --- /dev/null +++ b/queue-6.6/net-micrel-fix-receiving-the-timestamp-in-the-frame-.patch @@ -0,0 +1,44 @@ +From 307b8fa0fb5bc07086f7ecaa78fcd7d8dc5d9518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 21:21:57 +0200 +Subject: net: micrel: Fix receiving the timestamp in the frame for lan8841 + +From: Horatiu Vultur + +[ Upstream commit aea27a92a41dae14843f92c79e9e42d8f570105c ] + +The blamed commit started to use the ptp workqueue to get the second +part of the timestamp. And when the port was set down, then this +workqueue is stopped. But if the config option NETWORK_PHY_TIMESTAMPING +is not enabled, then the ptp_clock is not initialized so then it would +crash when it would try to access the delayed work. +So then basically by setting up and then down the port, it would crash. +The fix consists in checking if the ptp_clock is initialized and only +then cancel the delayed work. + +Fixes: cc7554954848 ("net: micrel: Change to receive timestamp in the frame for lan8841") +Signed-off-by: Horatiu Vultur +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/micrel.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index cbd98ea4a84af..538a5f59d7a73 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -4612,7 +4612,8 @@ static int lan8841_suspend(struct phy_device *phydev) + struct kszphy_priv *priv = phydev->priv; + struct kszphy_ptp_priv *ptp_priv = &priv->ptp_priv; + +- ptp_cancel_worker_sync(ptp_priv->ptp_clock); ++ if (ptp_priv->ptp_clock) ++ ptp_cancel_worker_sync(ptp_priv->ptp_clock); + + return genphy_suspend(phydev); + } +-- +2.43.0 + diff --git a/queue-6.6/net-mlx5-add-a-timeout-to-acquire-the-command-queue-.patch b/queue-6.6/net-mlx5-add-a-timeout-to-acquire-the-command-queue-.patch new file mode 100644 index 00000000000..c07c41c77da --- /dev/null +++ b/queue-6.6/net-mlx5-add-a-timeout-to-acquire-the-command-queue-.patch @@ -0,0 +1,156 @@ +From f35ab19a686f59f0dbdc749b9cf3d4e6c2a2ea58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 14:29:50 +0300 +Subject: net/mlx5: Add a timeout to acquire the command queue semaphore + +From: Akiva Goldberger + +[ Upstream commit 485d65e1357123a697c591a5aeb773994b247ad7 ] + +Prevent forced completion handling on an entry that has not yet been +assigned an index, causing an out of bounds access on idx = -22. +Instead of waiting indefinitely for the sem, blocking flow now waits for +index to be allocated or a sem acquisition timeout before beginning the +timer for FW completion. + +Kernel log example: +mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion + +Fixes: 8e715cd613a1 ("net/mlx5: Set command entry semaphore up once got index free") +Signed-off-by: Akiva Goldberger +Reviewed-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Link: https://lore.kernel.org/r/20240509112951.590184-5-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 41 +++++++++++++++---- + include/linux/mlx5/driver.h | 1 + + 2 files changed, 33 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 55efb932ab2cf..3072f1c6c0ff7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -967,19 +967,32 @@ static void cmd_work_handler(struct work_struct *work) + bool poll_cmd = ent->polling; + struct mlx5_cmd_layout *lay; + struct mlx5_core_dev *dev; +- unsigned long cb_timeout; +- struct semaphore *sem; ++ unsigned long timeout; + unsigned long flags; + int alloc_ret; + int cmd_mode; + ++ complete(&ent->handling); ++ + dev = container_of(cmd, struct mlx5_core_dev, cmd); +- cb_timeout = msecs_to_jiffies(mlx5_tout_ms(dev, CMD)); ++ timeout = msecs_to_jiffies(mlx5_tout_ms(dev, CMD)); + +- complete(&ent->handling); +- sem = ent->page_queue ? &cmd->vars.pages_sem : &cmd->vars.sem; +- down(sem); + if (!ent->page_queue) { ++ if (down_timeout(&cmd->vars.sem, timeout)) { ++ mlx5_core_warn(dev, "%s(0x%x) timed out while waiting for a slot.\n", ++ mlx5_command_str(ent->op), ent->op); ++ if (ent->callback) { ++ ent->callback(-EBUSY, ent->context); ++ mlx5_free_cmd_msg(dev, ent->out); ++ free_msg(dev, ent->in); ++ cmd_ent_put(ent); ++ } else { ++ ent->ret = -EBUSY; ++ complete(&ent->done); ++ } ++ complete(&ent->slotted); ++ return; ++ } + alloc_ret = cmd_alloc_index(cmd, ent); + if (alloc_ret < 0) { + mlx5_core_err_rl(dev, "failed to allocate command entry\n"); +@@ -992,10 +1005,11 @@ static void cmd_work_handler(struct work_struct *work) + ent->ret = -EAGAIN; + complete(&ent->done); + } +- up(sem); ++ up(&cmd->vars.sem); + return; + } + } else { ++ down(&cmd->vars.pages_sem); + ent->idx = cmd->vars.max_reg_cmds; + spin_lock_irqsave(&cmd->alloc_lock, flags); + clear_bit(ent->idx, &cmd->vars.bitmask); +@@ -1003,6 +1017,8 @@ static void cmd_work_handler(struct work_struct *work) + spin_unlock_irqrestore(&cmd->alloc_lock, flags); + } + ++ complete(&ent->slotted); ++ + lay = get_inst(cmd, ent->idx); + ent->lay = lay; + memset(lay, 0, sizeof(*lay)); +@@ -1021,7 +1037,7 @@ static void cmd_work_handler(struct work_struct *work) + ent->ts1 = ktime_get_ns(); + cmd_mode = cmd->mode; + +- if (ent->callback && schedule_delayed_work(&ent->cb_timeout_work, cb_timeout)) ++ if (ent->callback && schedule_delayed_work(&ent->cb_timeout_work, timeout)) + cmd_ent_get(ent); + set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state); + +@@ -1141,6 +1157,9 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent) + ent->ret = -ECANCELED; + goto out_err; + } ++ ++ wait_for_completion(&ent->slotted); ++ + if (cmd->mode == CMD_MODE_POLLING || ent->polling) + wait_for_completion(&ent->done); + else if (!wait_for_completion_timeout(&ent->done, timeout)) +@@ -1155,6 +1174,9 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent) + } else if (err == -ECANCELED) { + mlx5_core_warn(dev, "%s(0x%x) canceled on out of queue timeout.\n", + mlx5_command_str(ent->op), ent->op); ++ } else if (err == -EBUSY) { ++ mlx5_core_warn(dev, "%s(0x%x) timeout while waiting for command semaphore.\n", ++ mlx5_command_str(ent->op), ent->op); + } + mlx5_core_dbg(dev, "err %d, delivery status %s(%d)\n", + err, deliv_status_to_str(ent->status), ent->status); +@@ -1206,6 +1228,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, + ent->polling = force_polling; + + init_completion(&ent->handling); ++ init_completion(&ent->slotted); + if (!callback) + init_completion(&ent->done); + +@@ -1223,7 +1246,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, + return 0; /* mlx5_cmd_comp_handler() will put(ent) */ + + err = wait_func(dev, ent); +- if (err == -ETIMEDOUT || err == -ECANCELED) ++ if (err == -ETIMEDOUT || err == -ECANCELED || err == -EBUSY) + goto out_free; + + ds = ent->ts2 - ent->ts1; +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index 5ca4e085d8133..ffb98bc43b2db 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -852,6 +852,7 @@ struct mlx5_cmd_work_ent { + void *context; + int idx; + struct completion handling; ++ struct completion slotted; + struct completion done; + struct mlx5_cmd *cmd; + struct work_struct work; +-- +2.43.0 + diff --git a/queue-6.6/net-mlx5-discard-command-completions-in-internal-err.patch b/queue-6.6/net-mlx5-discard-command-completions-in-internal-err.patch new file mode 100644 index 00000000000..f5ab77e0221 --- /dev/null +++ b/queue-6.6/net-mlx5-discard-command-completions-in-internal-err.patch @@ -0,0 +1,75 @@ +From e6bbee705aa078c7904d2faa1a1bd348d1cf978a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 14:29:51 +0300 +Subject: net/mlx5: Discard command completions in internal error + +From: Akiva Goldberger + +[ Upstream commit db9b31aa9bc56ff0d15b78f7e827d61c4a096e40 ] + +Fix use after free when FW completion arrives while device is in +internal error state. Avoid calling completion handler in this case, +since the device will flush the command interface and trigger all +completions manually. + +Kernel log: +------------[ cut here ]------------ +refcount_t: underflow; use-after-free. +... +RIP: 0010:refcount_warn_saturate+0xd8/0xe0 +... +Call Trace: + +? __warn+0x79/0x120 +? refcount_warn_saturate+0xd8/0xe0 +? report_bug+0x17c/0x190 +? handle_bug+0x3c/0x60 +? exc_invalid_op+0x14/0x70 +? asm_exc_invalid_op+0x16/0x20 +? refcount_warn_saturate+0xd8/0xe0 +cmd_ent_put+0x13b/0x160 [mlx5_core] +mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] +cmd_comp_notifier+0x1f/0x30 [mlx5_core] +notifier_call_chain+0x35/0xb0 +atomic_notifier_call_chain+0x16/0x20 +mlx5_eq_async_int+0xf6/0x290 [mlx5_core] +notifier_call_chain+0x35/0xb0 +atomic_notifier_call_chain+0x16/0x20 +irq_int_handler+0x19/0x30 [mlx5_core] +__handle_irq_event_percpu+0x4b/0x160 +handle_irq_event+0x2e/0x80 +handle_edge_irq+0x98/0x230 +__common_interrupt+0x3b/0xa0 +common_interrupt+0x7b/0xa0 + + +asm_common_interrupt+0x22/0x40 + +Fixes: 51d138c2610a ("net/mlx5: Fix health error state handling") +Signed-off-by: Akiva Goldberger +Reviewed-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Link: https://lore.kernel.org/r/20240509112951.590184-6-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 3072f1c6c0ff7..48dc4ae87af09 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -1632,6 +1632,9 @@ static int cmd_comp_notifier(struct notifier_block *nb, + dev = container_of(cmd, struct mlx5_core_dev, cmd); + eqe = data; + ++ if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) ++ return NOTIFY_DONE; ++ + mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector), false); + + return NOTIFY_OK; +-- +2.43.0 + diff --git a/queue-6.6/net-mlx5-enable-4-ports-multiport-e-switch.patch b/queue-6.6/net-mlx5-enable-4-ports-multiport-e-switch.patch new file mode 100644 index 00000000000..7c6ffb6eea7 --- /dev/null +++ b/queue-6.6/net-mlx5-enable-4-ports-multiport-e-switch.patch @@ -0,0 +1,72 @@ +From d0dc1ca97ba6aba426a77486315630e61b9870f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 20:25:00 +0300 +Subject: net/mlx5: Enable 4 ports multiport E-switch + +From: Shay Drory + +[ Upstream commit e738e355045237ee8802cb2b31a8ed6f4b7ac534 ] + +enable_mpesw() assumed only 2 ports are available, fix this by removing +that assumption and looping through the existing lag ports to enable multi-port +E-switch for cards with more than 2 ports. + +Signed-off-by: Shay Drory +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Stable-dep-of: 0f06228d4a2d ("net/mlx5: Reload only IB representors upon lag disable/enable") +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/lag/mpesw.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c +index 4bf15391525c5..0857eebf4f07b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c +@@ -65,12 +65,12 @@ static int mlx5_mpesw_metadata_set(struct mlx5_lag *ldev) + return err; + } + +-#define MLX5_LAG_MPESW_OFFLOADS_SUPPORTED_PORTS 2 ++#define MLX5_LAG_MPESW_OFFLOADS_SUPPORTED_PORTS 4 + static int enable_mpesw(struct mlx5_lag *ldev) + { + struct mlx5_core_dev *dev0 = ldev->pf[MLX5_LAG_P1].dev; +- struct mlx5_core_dev *dev1 = ldev->pf[MLX5_LAG_P2].dev; + int err; ++ int i; + + if (ldev->mode != MLX5_LAG_MODE_NONE) + return -EINVAL; +@@ -98,11 +98,11 @@ static int enable_mpesw(struct mlx5_lag *ldev) + + dev0->priv.flags &= ~MLX5_PRIV_FLAGS_DISABLE_IB_ADEV; + mlx5_rescan_drivers_locked(dev0); +- err = mlx5_eswitch_reload_reps(dev0->priv.eswitch); +- if (!err) +- err = mlx5_eswitch_reload_reps(dev1->priv.eswitch); +- if (err) +- goto err_rescan_drivers; ++ for (i = 0; i < ldev->ports; i++) { ++ err = mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch); ++ if (err) ++ goto err_rescan_drivers; ++ } + + return 0; + +@@ -112,8 +112,8 @@ static int enable_mpesw(struct mlx5_lag *ldev) + mlx5_deactivate_lag(ldev); + err_add_devices: + mlx5_lag_add_devices(ldev); +- mlx5_eswitch_reload_reps(dev0->priv.eswitch); +- mlx5_eswitch_reload_reps(dev1->priv.eswitch); ++ for (i = 0; i < ldev->ports; i++) ++ mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch); + mlx5_mpesw_metadata_cleanup(ldev); + return err; + } +-- +2.43.0 + diff --git a/queue-6.6/net-mlx5-reload-only-ib-representors-upon-lag-disabl.patch b/queue-6.6/net-mlx5-reload-only-ib-representors-upon-lag-disabl.patch new file mode 100644 index 00000000000..b661e5ef89e --- /dev/null +++ b/queue-6.6/net-mlx5-reload-only-ib-representors-upon-lag-disabl.patch @@ -0,0 +1,222 @@ +From 80e7f097e03fdf2921e2e3d875ca15bb25a24423 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 14:29:49 +0300 +Subject: net/mlx5: Reload only IB representors upon lag disable/enable + +From: Maher Sanalla + +[ Upstream commit 0f06228d4a2dcc1fca5b3ddb0eefa09c05b102c4 ] + +On lag disable, the bond IB device along with all of its +representors are destroyed, and then the slaves' representors get reloaded. + +In case the slave IB representor load fails, the eswitch error flow +unloads all representors, including ethernet representors, where the +netdevs get detached and removed from lag bond. Such flow is inaccurate +as the lag driver is not responsible for loading/unloading ethernet +representors. Furthermore, the flow described above begins by holding +lag lock to prevent bond changes during disable flow. However, when +reaching the ethernet representors detachment from lag, the lag lock is +required again, triggering the following deadlock: + +Call trace: +__switch_to+0xf4/0x148 +__schedule+0x2c8/0x7d0 +schedule+0x50/0xe0 +schedule_preempt_disabled+0x18/0x28 +__mutex_lock.isra.13+0x2b8/0x570 +__mutex_lock_slowpath+0x1c/0x28 +mutex_lock+0x4c/0x68 +mlx5_lag_remove_netdev+0x3c/0x1a0 [mlx5_core] +mlx5e_uplink_rep_disable+0x70/0xa0 [mlx5_core] +mlx5e_detach_netdev+0x6c/0xb0 [mlx5_core] +mlx5e_netdev_change_profile+0x44/0x138 [mlx5_core] +mlx5e_netdev_attach_nic_profile+0x28/0x38 [mlx5_core] +mlx5e_vport_rep_unload+0x184/0x1b8 [mlx5_core] +mlx5_esw_offloads_rep_load+0xd8/0xe0 [mlx5_core] +mlx5_eswitch_reload_reps+0x74/0xd0 [mlx5_core] +mlx5_disable_lag+0x130/0x138 [mlx5_core] +mlx5_lag_disable_change+0x6c/0x70 [mlx5_core] // hold ldev->lock +mlx5_devlink_eswitch_mode_set+0xc0/0x410 [mlx5_core] +devlink_nl_cmd_eswitch_set_doit+0xdc/0x180 +genl_family_rcv_msg_doit.isra.17+0xe8/0x138 +genl_rcv_msg+0xe4/0x220 +netlink_rcv_skb+0x44/0x108 +genl_rcv+0x40/0x58 +netlink_unicast+0x198/0x268 +netlink_sendmsg+0x1d4/0x418 +sock_sendmsg+0x54/0x60 +__sys_sendto+0xf4/0x120 +__arm64_sys_sendto+0x30/0x40 +el0_svc_common+0x8c/0x120 +do_el0_svc+0x30/0xa0 +el0_svc+0x20/0x30 +el0_sync_handler+0x90/0xb8 +el0_sync+0x160/0x180 + +Thus, upon lag enable/disable, load and unload only the IB representors +of the slaves preventing the deadlock mentioned above. + +While at it, refactor the mlx5_esw_offloads_rep_load() function to have +a static helper method for its internal logic, in symmetry with the +representor unload design. + +Fixes: 598fe77df855 ("net/mlx5: Lag, Create shared FDB when in switchdev mode") +Co-developed-by: Mark Bloch +Signed-off-by: Mark Bloch +Signed-off-by: Maher Sanalla +Signed-off-by: Tariq Toukan +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240509112951.590184-4-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/eswitch.h | 4 +-- + .../mellanox/mlx5/core/eswitch_offloads.c | 28 ++++++++++++------- + .../net/ethernet/mellanox/mlx5/core/lag/lag.c | 6 ++-- + .../ethernet/mellanox/mlx5/core/lag/mpesw.c | 4 +-- + 4 files changed, 25 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +index b4eb17141edf3..9b771b572593b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +@@ -840,7 +840,7 @@ int mlx5_eswitch_offloads_single_fdb_add_one(struct mlx5_eswitch *master_esw, + struct mlx5_eswitch *slave_esw, int max_slaves); + void mlx5_eswitch_offloads_single_fdb_del_one(struct mlx5_eswitch *master_esw, + struct mlx5_eswitch *slave_esw); +-int mlx5_eswitch_reload_reps(struct mlx5_eswitch *esw); ++int mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw); + + bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev); + void mlx5_eswitch_unblock_encap(struct mlx5_core_dev *dev); +@@ -932,7 +932,7 @@ mlx5_eswitch_offloads_single_fdb_del_one(struct mlx5_eswitch *master_esw, + static inline int mlx5_eswitch_get_npeers(struct mlx5_eswitch *esw) { return 0; } + + static inline int +-mlx5_eswitch_reload_reps(struct mlx5_eswitch *esw) ++mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw) + { + return 0; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index e3cce110e52fd..58529d1a98b37 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -2501,6 +2501,16 @@ void esw_offloads_cleanup(struct mlx5_eswitch *esw) + esw_offloads_cleanup_reps(esw); + } + ++static int __esw_offloads_load_rep(struct mlx5_eswitch *esw, ++ struct mlx5_eswitch_rep *rep, u8 rep_type) ++{ ++ if (atomic_cmpxchg(&rep->rep_data[rep_type].state, ++ REP_REGISTERED, REP_LOADED) == REP_REGISTERED) ++ return esw->offloads.rep_ops[rep_type]->load(esw->dev, rep); ++ ++ return 0; ++} ++ + static void __esw_offloads_unload_rep(struct mlx5_eswitch *esw, + struct mlx5_eswitch_rep *rep, u8 rep_type) + { +@@ -2525,13 +2535,11 @@ static int mlx5_esw_offloads_rep_load(struct mlx5_eswitch *esw, u16 vport_num) + int err; + + rep = mlx5_eswitch_get_rep(esw, vport_num); +- for (rep_type = 0; rep_type < NUM_REP_TYPES; rep_type++) +- if (atomic_cmpxchg(&rep->rep_data[rep_type].state, +- REP_REGISTERED, REP_LOADED) == REP_REGISTERED) { +- err = esw->offloads.rep_ops[rep_type]->load(esw->dev, rep); +- if (err) +- goto err_reps; +- } ++ for (rep_type = 0; rep_type < NUM_REP_TYPES; rep_type++) { ++ err = __esw_offloads_load_rep(esw, rep, rep_type); ++ if (err) ++ goto err_reps; ++ } + + return 0; + +@@ -3276,7 +3284,7 @@ static void esw_destroy_offloads_acl_tables(struct mlx5_eswitch *esw) + esw_vport_destroy_offloads_acl_tables(esw, vport); + } + +-int mlx5_eswitch_reload_reps(struct mlx5_eswitch *esw) ++int mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw) + { + struct mlx5_eswitch_rep *rep; + unsigned long i; +@@ -3289,13 +3297,13 @@ int mlx5_eswitch_reload_reps(struct mlx5_eswitch *esw) + if (atomic_read(&rep->rep_data[REP_ETH].state) != REP_LOADED) + return 0; + +- ret = mlx5_esw_offloads_rep_load(esw, MLX5_VPORT_UPLINK); ++ ret = __esw_offloads_load_rep(esw, rep, REP_IB); + if (ret) + return ret; + + mlx5_esw_for_each_rep(esw, i, rep) { + if (atomic_read(&rep->rep_data[REP_ETH].state) == REP_LOADED) +- mlx5_esw_offloads_rep_load(esw, rep->vport); ++ __esw_offloads_load_rep(esw, rep, REP_IB); + } + + return 0; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +index e51cac1e1811e..9b05061a759cc 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +@@ -814,7 +814,7 @@ void mlx5_disable_lag(struct mlx5_lag *ldev) + if (shared_fdb) + for (i = 0; i < ldev->ports; i++) + if (!(ldev->pf[i].dev->priv.flags & MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV)) +- mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch); ++ mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch); + } + + static bool mlx5_shared_fdb_supported(struct mlx5_lag *ldev) +@@ -922,7 +922,7 @@ static void mlx5_do_bond(struct mlx5_lag *ldev) + mlx5_rescan_drivers_locked(dev0); + + for (i = 0; i < ldev->ports; i++) { +- err = mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch); ++ err = mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch); + if (err) + break; + } +@@ -933,7 +933,7 @@ static void mlx5_do_bond(struct mlx5_lag *ldev) + mlx5_deactivate_lag(ldev); + mlx5_lag_add_devices(ldev); + for (i = 0; i < ldev->ports; i++) +- mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch); ++ mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch); + mlx5_core_err(dev0, "Failed to enable lag\n"); + return; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c +index 0857eebf4f07b..6b0413a3987ce 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c +@@ -99,7 +99,7 @@ static int enable_mpesw(struct mlx5_lag *ldev) + dev0->priv.flags &= ~MLX5_PRIV_FLAGS_DISABLE_IB_ADEV; + mlx5_rescan_drivers_locked(dev0); + for (i = 0; i < ldev->ports; i++) { +- err = mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch); ++ err = mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch); + if (err) + goto err_rescan_drivers; + } +@@ -113,7 +113,7 @@ static int enable_mpesw(struct mlx5_lag *ldev) + err_add_devices: + mlx5_lag_add_devices(ldev); + for (i = 0; i < ldev->ports; i++) +- mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch); ++ mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch); + mlx5_mpesw_metadata_cleanup(ldev); + return err; + } +-- +2.43.0 + diff --git a/queue-6.6/net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch b/queue-6.6/net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch new file mode 100644 index 00000000000..0aad7d4eba1 --- /dev/null +++ b/queue-6.6/net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch @@ -0,0 +1,86 @@ +From a6689921a16633fb7533398e9ccac083306002cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 11:38:05 +0200 +Subject: net: openvswitch: fix overwriting ct original tuple for ICMPv6 + +From: Ilya Maximets + +[ Upstream commit 7c988176b6c16c516474f6fceebe0f055af5eb56 ] + +OVS_PACKET_CMD_EXECUTE has 3 main attributes: + - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. + - OVS_PACKET_ATTR_PACKET - Binary packet content. + - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet. + +OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure +with the metadata like conntrack state, input port, recirculation id, +etc. Then the packet itself gets parsed to populate the rest of the +keys from the packet headers. + +Whenever the packet parsing code starts parsing the ICMPv6 header, it +first zeroes out fields in the key corresponding to Neighbor Discovery +information even if it is not an ND packet. + +It is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares +the space between 'nd' and 'ct_orig' that holds the original tuple +conntrack metadata parsed from the OVS_PACKET_ATTR_KEY. + +ND packets should not normally have conntrack state, so it's fine to +share the space, but normal ICMPv6 Echo packets or maybe other types of +ICMPv6 can have the state attached and it should not be overwritten. + +The issue results in all but the last 4 bytes of the destination +address being wiped from the original conntrack tuple leading to +incorrect packet matching and potentially executing wrong actions +in case this packet recirculates within the datapath or goes back +to userspace. + +ND fields should not be accessed in non-ND packets, so not clearing +them should be fine. Executing memset() only for actual ND packets to +avoid the issue. + +Initializing the whole thing before parsing is needed because ND packet +may not contain all the options. + +The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't +affect packets entering OVS datapath from network interfaces, because +in this case CT metadata is populated from skb after the packet is +already parsed. + +Fixes: 9dd7f8907c37 ("openvswitch: Add original direction conntrack tuple to sw_flow_key.") +Reported-by: Antonin Bas +Closes: https://github.com/openvswitch/ovs-issues/issues/327 +Signed-off-by: Ilya Maximets +Acked-by: Aaron Conole +Acked-by: Eelco Chaudron +Link: https://lore.kernel.org/r/20240509094228.1035477-1-i.maximets@ovn.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/openvswitch/flow.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c +index 33b21a0c05481..8a848ce72e291 100644 +--- a/net/openvswitch/flow.c ++++ b/net/openvswitch/flow.c +@@ -561,7 +561,6 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key, + */ + key->tp.src = htons(icmp->icmp6_type); + key->tp.dst = htons(icmp->icmp6_code); +- memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); + + if (icmp->icmp6_code == 0 && + (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION || +@@ -570,6 +569,8 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key, + struct nd_msg *nd; + int offset; + ++ memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); ++ + /* In order to process neighbor discovery options, we need the + * entire packet. + */ +-- +2.43.0 + diff --git a/queue-6.6/net-qrtr-ns-fix-module-refcnt.patch b/queue-6.6/net-qrtr-ns-fix-module-refcnt.patch new file mode 100644 index 00000000000..bbf1cf4491e --- /dev/null +++ b/queue-6.6/net-qrtr-ns-fix-module-refcnt.patch @@ -0,0 +1,83 @@ +From 382930e0e8531c3f4681d51ed0dafb879b36508a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 10:31:46 -0700 +Subject: net: qrtr: ns: Fix module refcnt + +From: Chris Lew + +[ Upstream commit fd76e5ccc48f9f54eb44909dd7c0b924005f1582 ] + +The qrtr protocol core logic and the qrtr nameservice are combined into +a single module. Neither the core logic or nameservice provide much +functionality by themselves; combining the two into a single module also +prevents any possible issues that may stem from client modules loading +inbetween qrtr and the ns. + +Creating a socket takes two references to the module that owns the +socket protocol. Since the ns needs to create the control socket, this +creates a scenario where there are always two references to the qrtr +module. This prevents the execution of 'rmmod' for qrtr. + +To resolve this, forcefully put the module refcount for the socket +opened by the nameservice. + +Fixes: a365023a76f2 ("net: qrtr: combine nameservice into main module") +Reported-by: Jeffrey Hugo +Tested-by: Jeffrey Hugo +Signed-off-by: Chris Lew +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Jeffrey Hugo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/ns.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c +index abb0c70ffc8b0..654a3cc0d3479 100644 +--- a/net/qrtr/ns.c ++++ b/net/qrtr/ns.c +@@ -725,6 +725,24 @@ int qrtr_ns_init(void) + if (ret < 0) + goto err_wq; + ++ /* As the qrtr ns socket owner and creator is the same module, we have ++ * to decrease the qrtr module reference count to guarantee that it ++ * remains zero after the ns socket is created, otherwise, executing ++ * "rmmod" command is unable to make the qrtr module deleted after the ++ * qrtr module is inserted successfully. ++ * ++ * However, the reference count is increased twice in ++ * sock_create_kern(): one is to increase the reference count of owner ++ * of qrtr socket's proto_ops struct; another is to increment the ++ * reference count of owner of qrtr proto struct. Therefore, we must ++ * decrement the module reference count twice to ensure that it keeps ++ * zero after server's listening socket is created. Of course, we ++ * must bump the module reference count twice as well before the socket ++ * is closed. ++ */ ++ module_put(qrtr_ns.sock->ops->owner); ++ module_put(qrtr_ns.sock->sk->sk_prot_creator->owner); ++ + return 0; + + err_wq: +@@ -739,6 +757,15 @@ void qrtr_ns_remove(void) + { + cancel_work_sync(&qrtr_ns.work); + destroy_workqueue(qrtr_ns.workqueue); ++ ++ /* sock_release() expects the two references that were put during ++ * qrtr_ns_init(). This function is only called during module remove, ++ * so try_stop_module() has already set the refcnt to 0. Use ++ * __module_get() instead of try_module_get() to successfully take two ++ * references. ++ */ ++ __module_get(qrtr_ns.sock->ops->owner); ++ __module_get(qrtr_ns.sock->sk->sk_prot_creator->owner); + sock_release(qrtr_ns.sock); + } + EXPORT_SYMBOL_GPL(qrtr_ns_remove); +-- +2.43.0 + diff --git a/queue-6.6/net-usb-qmi_wwan-add-telit-fn920c04-compositions.patch b/queue-6.6/net-usb-qmi_wwan-add-telit-fn920c04-compositions.patch new file mode 100644 index 00000000000..ea2e739186e --- /dev/null +++ b/queue-6.6/net-usb-qmi_wwan-add-telit-fn920c04-compositions.patch @@ -0,0 +1,108 @@ +From b676af5b2bd380b8701d3a5ac26035f38f5f6bed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 13:12:07 +0200 +Subject: net: usb: qmi_wwan: add Telit FN920C04 compositions + +From: Daniele Palmas + +[ Upstream commit 0b8fe5bd73249dc20be2e88a12041f8920797b59 ] + +Add the following Telit FN920C04 compositions: + +0x10a0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag) +T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a0 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=92c4c4d8 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10a4: rmnet + tty (AT) + tty (AT) + tty (diag) +T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a4 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=92c4c4d8 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10a9: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb +T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a9 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=92c4c4d8 +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Daniele Palmas +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index edc34402e787f..a5469cf5cf670 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1368,6 +1368,9 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ +-- +2.43.0 + diff --git a/queue-6.6/net-usb-smsc95xx-stop-lying-about-skb-truesize.patch b/queue-6.6/net-usb-smsc95xx-stop-lying-about-skb-truesize.patch new file mode 100644 index 00000000000..0d3ecc9ac5f --- /dev/null +++ b/queue-6.6/net-usb-smsc95xx-stop-lying-about-skb-truesize.patch @@ -0,0 +1,87 @@ +From 5fdb278a1502f85be08086ae6684300007a43f9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 08:33:13 +0000 +Subject: net: usb: smsc95xx: stop lying about skb->truesize + +From: Eric Dumazet + +[ Upstream commit d50729f1d60bca822ef6d9c1a5fb28d486bd7593 ] + +Some usb drivers try to set small skb->truesize and break +core networking stacks. + +In this patch, I removed one of the skb->truesize override. + +I also replaced one skb_clone() by an allocation of a fresh +and small skb, to get minimally sized skbs, like we did +in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize +in rx path") and 4ce62d5b2f7a ("net: usb: ax88179_178a: +stop lying about skb->truesize") + +v3: also fix a sparse error ( https://lore.kernel.org/oe-kbuild-all/202405091310.KvncIecx-lkp@intel.com/ ) +v2: leave the skb_trim() game because smsc95xx_rx_csum_offload() + needs the csum part. (Jakub) + While we are it, use get_unaligned() in smsc95xx_rx_csum_offload(). + +Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver") +Signed-off-by: Eric Dumazet +Cc: Steve Glendinning +Cc: UNGLinuxDriver@microchip.com +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240509083313.2113832-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 2fa46baa589e5..cbea246664795 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1810,9 +1810,11 @@ static int smsc95xx_reset_resume(struct usb_interface *intf) + + static void smsc95xx_rx_csum_offload(struct sk_buff *skb) + { +- skb->csum = *(u16 *)(skb_tail_pointer(skb) - 2); ++ u16 *csum_ptr = (u16 *)(skb_tail_pointer(skb) - 2); ++ ++ skb->csum = (__force __wsum)get_unaligned(csum_ptr); + skb->ip_summed = CHECKSUM_COMPLETE; +- skb_trim(skb, skb->len - 2); ++ skb_trim(skb, skb->len - 2); /* remove csum */ + } + + static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) +@@ -1870,25 +1872,22 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + if (dev->net->features & NETIF_F_RXCSUM) + smsc95xx_rx_csum_offload(skb); + skb_trim(skb, skb->len - 4); /* remove fcs */ +- skb->truesize = size + sizeof(struct sk_buff); + + return 1; + } + +- ax_skb = skb_clone(skb, GFP_ATOMIC); ++ ax_skb = netdev_alloc_skb_ip_align(dev->net, size); + if (unlikely(!ax_skb)) { + netdev_warn(dev->net, "Error allocating skb\n"); + return 0; + } + +- ax_skb->len = size; +- ax_skb->data = packet; +- skb_set_tail_pointer(ax_skb, size); ++ skb_put(ax_skb, size); ++ memcpy(ax_skb->data, packet, size); + + if (dev->net->features & NETIF_F_RXCSUM) + smsc95xx_rx_csum_offload(ax_skb); + skb_trim(ax_skb, ax_skb->len - 4); /* remove fcs */ +- ax_skb->truesize = size + sizeof(struct sk_buff); + + usbnet_skb_return(dev, ax_skb); + } +-- +2.43.0 + diff --git a/queue-6.6/net-usb-sr9700-stop-lying-about-skb-truesize.patch b/queue-6.6/net-usb-sr9700-stop-lying-about-skb-truesize.patch new file mode 100644 index 00000000000..fc88966026e --- /dev/null +++ b/queue-6.6/net-usb-sr9700-stop-lying-about-skb-truesize.patch @@ -0,0 +1,59 @@ +From 6e45610b7b9168273fc5b2f06a73f2b819af6ff1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 14:39:39 +0000 +Subject: net: usb: sr9700: stop lying about skb->truesize + +From: Eric Dumazet + +[ Upstream commit 05417aa9c0c038da2464a0c504b9d4f99814a23b ] + +Some usb drivers set small skb->truesize and break +core networking stacks. + +In this patch, I removed one of the skb->truesize override. + +I also replaced one skb_clone() by an allocation of a fresh +and small skb, to get minimally sized skbs, like we did +in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize +in rx path") and 4ce62d5b2f7a ("net: usb: ax88179_178a: +stop lying about skb->truesize") + +Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240506143939.3673865-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/sr9700.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 3164451e1010c..0a662e42ed965 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -421,19 +421,15 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + skb_pull(skb, 3); + skb->len = len; + skb_set_tail_pointer(skb, len); +- skb->truesize = len + sizeof(struct sk_buff); + return 2; + } + +- /* skb_clone is used for address align */ +- sr_skb = skb_clone(skb, GFP_ATOMIC); ++ sr_skb = netdev_alloc_skb_ip_align(dev->net, len); + if (!sr_skb) + return 0; + +- sr_skb->len = len; +- sr_skb->data = skb->data + 3; +- skb_set_tail_pointer(sr_skb, len); +- sr_skb->truesize = len + sizeof(struct sk_buff); ++ skb_put(sr_skb, len); ++ memcpy(sr_skb->data, skb->data + 3, len); + usbnet_skb_return(dev, sr_skb); + + skb_pull(skb, len + SR_RX_OVERHEAD); +-- +2.43.0 + diff --git a/queue-6.6/net-wangxun-fix-to-change-rx-features.patch b/queue-6.6/net-wangxun-fix-to-change-rx-features.patch new file mode 100644 index 00000000000..7c1b063b8cd --- /dev/null +++ b/queue-6.6/net-wangxun-fix-to-change-rx-features.patch @@ -0,0 +1,47 @@ +From 7947bd848ab69f4249f7484b38c57ba5e9cc5859 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:51:38 +0800 +Subject: net: wangxun: fix to change Rx features + +From: Jiawen Wu + +[ Upstream commit 68067f065ee730c7c67b361c3c81808d25d5a90b ] + +Fix the issue where some Rx features cannot be changed. + +When using ethtool -K to turn off rx offload, it returns error and +displays "Could not change any device features". And netdev->features +is not assigned a new value to actually configure the hardware. + +Fixes: 6dbedcffcf54 ("net: libwx: Implement xx_set_features ops") +Signed-off-by: Jiawen Wu +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/wangxun/libwx/wx_lib.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c +index be434c833c69c..e9310d9ca67c9 100644 +--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c ++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c +@@ -2646,12 +2646,14 @@ int wx_set_features(struct net_device *netdev, netdev_features_t features) + else + wr32m(wx, WX_RDB_RA_CTL, WX_RDB_RA_CTL_RSS_EN, 0); + ++ netdev->features = features; ++ + if (changed & + (NETIF_F_HW_VLAN_CTAG_RX | + NETIF_F_HW_VLAN_STAG_RX)) + wx_set_rx_mode(netdev); + +- return 1; ++ return 0; + } + EXPORT_SYMBOL(wx_set_features); + +-- +2.43.0 + diff --git a/queue-6.6/netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch b/queue-6.6/netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch new file mode 100644 index 00000000000..8883db7fb61 --- /dev/null +++ b/queue-6.6/netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch @@ -0,0 +1,192 @@ +From 805ffe9c059b3a05684d146f5c14c2253715712d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 14:29:34 +0000 +Subject: netrom: fix possible dead-lock in nr_rt_ioctl() + +From: Eric Dumazet + +[ Upstream commit e03e7f20ebf7e1611d40d1fdc1bde900fd3335f6 ] + +syzbot loves netrom, and found a possible deadlock in nr_rt_ioctl [1] + +Make sure we always acquire nr_node_list_lock before nr_node_lock(nr_node) + +[1] +WARNING: possible circular locking dependency detected +6.9.0-rc7-syzkaller-02147-g654de42f3fc6 #0 Not tainted +------------------------------------------------------ +syz-executor350/5129 is trying to acquire lock: + ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] + ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_node_lock include/net/netrom.h:152 [inline] + ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:464 [inline] + ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697 + +but task is already holding lock: + ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] + ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline] + ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_rt_ioctl+0x10a/0x1090 net/netrom/nr_route.c:697 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (nr_node_list_lock){+...}-{2:2}: + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] + _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 + spin_lock_bh include/linux/spinlock.h:356 [inline] + nr_remove_node net/netrom/nr_route.c:299 [inline] + nr_del_node+0x4b4/0x820 net/netrom/nr_route.c:355 + nr_rt_ioctl+0xa95/0x1090 net/netrom/nr_route.c:683 + sock_do_ioctl+0x158/0x460 net/socket.c:1222 + sock_ioctl+0x629/0x8e0 net/socket.c:1341 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:904 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +-> #0 (&nr_node->node_lock){+...}-{2:2}: + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] + _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 + spin_lock_bh include/linux/spinlock.h:356 [inline] + nr_node_lock include/net/netrom.h:152 [inline] + nr_dec_obs net/netrom/nr_route.c:464 [inline] + nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697 + sock_do_ioctl+0x158/0x460 net/socket.c:1222 + sock_ioctl+0x629/0x8e0 net/socket.c:1341 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:904 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(nr_node_list_lock); + lock(&nr_node->node_lock); + lock(nr_node_list_lock); + lock(&nr_node->node_lock); + + *** DEADLOCK *** + +1 lock held by syz-executor350/5129: + #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] + #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline] + #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_rt_ioctl+0x10a/0x1090 net/netrom/nr_route.c:697 + +stack backtrace: +CPU: 0 PID: 5129 Comm: syz-executor350 Not tainted 6.9.0-rc7-syzkaller-02147-g654de42f3fc6 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 + check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] + _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 + spin_lock_bh include/linux/spinlock.h:356 [inline] + nr_node_lock include/net/netrom.h:152 [inline] + nr_dec_obs net/netrom/nr_route.c:464 [inline] + nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697 + sock_do_ioctl+0x158/0x460 net/socket.c:1222 + sock_ioctl+0x629/0x8e0 net/socket.c:1341 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:904 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240515142934.3708038-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netrom/nr_route.c | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c +index 70480869ad1c5..bd2b17b219ae9 100644 +--- a/net/netrom/nr_route.c ++++ b/net/netrom/nr_route.c +@@ -285,22 +285,14 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic, + return 0; + } + +-static inline void __nr_remove_node(struct nr_node *nr_node) ++static void nr_remove_node_locked(struct nr_node *nr_node) + { ++ lockdep_assert_held(&nr_node_list_lock); ++ + hlist_del_init(&nr_node->node_node); + nr_node_put(nr_node); + } + +-#define nr_remove_node_locked(__node) \ +- __nr_remove_node(__node) +- +-static void nr_remove_node(struct nr_node *nr_node) +-{ +- spin_lock_bh(&nr_node_list_lock); +- __nr_remove_node(nr_node); +- spin_unlock_bh(&nr_node_list_lock); +-} +- + static inline void __nr_remove_neigh(struct nr_neigh *nr_neigh) + { + hlist_del_init(&nr_neigh->neigh_node); +@@ -339,6 +331,7 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n + return -EINVAL; + } + ++ spin_lock_bh(&nr_node_list_lock); + nr_node_lock(nr_node); + for (i = 0; i < nr_node->count; i++) { + if (nr_node->routes[i].neighbour == nr_neigh) { +@@ -352,7 +345,7 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n + nr_node->count--; + + if (nr_node->count == 0) { +- nr_remove_node(nr_node); ++ nr_remove_node_locked(nr_node); + } else { + switch (i) { + case 0: +@@ -367,12 +360,14 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n + nr_node_put(nr_node); + } + nr_node_unlock(nr_node); ++ spin_unlock_bh(&nr_node_list_lock); + + return 0; + } + } + nr_neigh_put(nr_neigh); + nr_node_unlock(nr_node); ++ spin_unlock_bh(&nr_node_list_lock); + nr_node_put(nr_node); + + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.6/nilfs2-fix-out-of-range-warning.patch b/queue-6.6/nilfs2-fix-out-of-range-warning.patch new file mode 100644 index 00000000000..563d079567e --- /dev/null +++ b/queue-6.6/nilfs2-fix-out-of-range-warning.patch @@ -0,0 +1,45 @@ +From 8b7d2fc0616791b8bdd8559df314bd4d87dadbbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 15:30:44 +0100 +Subject: nilfs2: fix out-of-range warning + +From: Arnd Bergmann + +[ Upstream commit c473bcdd80d4ab2ae79a7a509a6712818366e32a ] + +clang-14 points out that v_size is always smaller than a 64KB +page size if that is configured by the CPU architecture: + +fs/nilfs2/ioctl.c:63:19: error: result of comparison of constant 65536 with expression of type '__u16' (aka 'unsigned short') is always false [-Werror,-Wtautological-constant-out-of-range-compare] + if (argv->v_size > PAGE_SIZE) + ~~~~~~~~~~~~ ^ ~~~~~~~~~ + +This is ok, so just shut up that warning with a cast. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240328143051.1069575-7-arnd@kernel.org +Fixes: 3358b4aaa84f ("nilfs2: fix problems of memory allocation in ioctl") +Acked-by: Ryusuke Konishi +Reviewed-by: Justin Stitt +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/nilfs2/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c +index 40ffade49f389..53022bfe0b72d 100644 +--- a/fs/nilfs2/ioctl.c ++++ b/fs/nilfs2/ioctl.c +@@ -60,7 +60,7 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs, + if (argv->v_nmembs == 0) + return 0; + +- if (argv->v_size > PAGE_SIZE) ++ if ((size_t)argv->v_size > PAGE_SIZE) + return -EINVAL; + + /* +-- +2.43.0 + diff --git a/queue-6.6/nilfs2-make-superblock-data-array-index-computation-.patch b/queue-6.6/nilfs2-make-superblock-data-array-index-computation-.patch new file mode 100644 index 00000000000..4b53a01c56f --- /dev/null +++ b/queue-6.6/nilfs2-make-superblock-data-array-index-computation-.patch @@ -0,0 +1,73 @@ +From 967063a06ff3dbf6a830b20ac88a12b782ef4548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 17:00:19 +0900 +Subject: nilfs2: make superblock data array index computation sparse friendly + +From: Ryusuke Konishi + +[ Upstream commit 91d743a9c8299de1fc1b47428d8bb4c85face00f ] + +Upon running sparse, "warning: dubious: x & !y" is output at an array +index calculation within nilfs_load_super_block(). + +The calculation is not wrong, but to eliminate the sparse warning, replace +it with an equivalent calculation. + +Also, add a comment to make it easier to understand what the unintuitive +array index calculation is doing and whether it's correct. + +Link: https://lkml.kernel.org/r/20240430080019.4242-3-konishi.ryusuke@gmail.com +Fixes: e339ad31f599 ("nilfs2: introduce secondary super block") +Signed-off-by: Ryusuke Konishi +Cc: Bart Van Assche +Cc: Jens Axboe +Cc: kernel test robot +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/the_nilfs.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c +index 71400496ed365..3e3c1d32da180 100644 +--- a/fs/nilfs2/the_nilfs.c ++++ b/fs/nilfs2/the_nilfs.c +@@ -592,7 +592,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs, + struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct buffer_head **sbh = nilfs->ns_sbh; + u64 sb2off, devsize = bdev_nr_bytes(nilfs->ns_bdev); +- int valid[2], swp = 0; ++ int valid[2], swp = 0, older; + + if (devsize < NILFS_SEG_MIN_BLOCKS * NILFS_MIN_BLOCK_SIZE + 4096) { + nilfs_err(sb, "device size too small"); +@@ -648,9 +648,25 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs, + if (swp) + nilfs_swap_super_block(nilfs); + ++ /* ++ * Calculate the array index of the older superblock data. ++ * If one has been dropped, set index 0 pointing to the remaining one, ++ * otherwise set index 1 pointing to the old one (including if both ++ * are the same). ++ * ++ * Divided case valid[0] valid[1] swp -> older ++ * ------------------------------------------------------------- ++ * Both SBs are invalid 0 0 N/A (Error) ++ * SB1 is invalid 0 1 1 0 ++ * SB2 is invalid 1 0 0 0 ++ * SB2 is newer 1 1 1 0 ++ * SB2 is older or the same 1 1 0 1 ++ */ ++ older = valid[1] ^ swp; ++ + nilfs->ns_sbwcount = 0; + nilfs->ns_sbwtime = le64_to_cpu(sbp[0]->s_wtime); +- nilfs->ns_prot_seq = le64_to_cpu(sbp[valid[1] & !swp]->s_last_seq); ++ nilfs->ns_prot_seq = le64_to_cpu(sbp[older]->s_last_seq); + *sbpp = sbp[0]; + return 0; + } +-- +2.43.0 + diff --git a/queue-6.6/null_blk-fix-missing-mutex_destroy-at-module-removal.patch b/queue-6.6/null_blk-fix-missing-mutex_destroy-at-module-removal.patch new file mode 100644 index 00000000000..4646bdd42a4 --- /dev/null +++ b/queue-6.6/null_blk-fix-missing-mutex_destroy-at-module-removal.patch @@ -0,0 +1,37 @@ +From 81bbf55f883fbcfeb6cd49d10d70722ea731ae01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 19:16:35 +0200 +Subject: null_blk: Fix missing mutex_destroy() at module removal + +From: Zhu Yanjun + +[ Upstream commit 07d1b99825f40f9c0d93e6b99d79a08d0717bac1 ] + +When a mutex lock is not used any more, the function mutex_destroy +should be called to mark the mutex lock uninitialized. + +Fixes: f2298c0403b0 ("null_blk: multi queue aware block test driver") +Signed-off-by: Zhu Yanjun +Link: https://lore.kernel.org/r/20240425171635.4227-1-yanjun.zhu@linux.dev +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 9544746de1683..cc4dcb951fd24 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -2352,6 +2352,8 @@ static void __exit null_exit(void) + + if (g_queue_mode == NULL_Q_MQ && shared_tags) + blk_mq_free_tag_set(&tag_set); ++ ++ mutex_destroy(&lock); + } + + module_init(null_init); +-- +2.43.0 + diff --git a/queue-6.6/nvme-cancel-pending-i-o-if-nvme-controller-is-in-ter.patch b/queue-6.6/nvme-cancel-pending-i-o-if-nvme-controller-is-in-ter.patch new file mode 100644 index 00000000000..ffc154c68f9 --- /dev/null +++ b/queue-6.6/nvme-cancel-pending-i-o-if-nvme-controller-is-in-ter.patch @@ -0,0 +1,126 @@ +From bdf867c62a35b78febd5ba03c79825f7f21f07a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 19:33:00 +0530 +Subject: nvme: cancel pending I/O if nvme controller is in terminal state + +From: Nilay Shroff + +[ Upstream commit 25bb3534ee21e39eb9301c4edd7182eb83cb0d07 ] + +While I/O is running, if the pci bus error occurs then +in-flight I/O can not complete. Worst, if at this time, +user (logically) hot-unplug the nvme disk then the +nvme_remove() code path can't forward progress until +in-flight I/O is cancelled. So these sequence of events +may potentially hang hot-unplug code path indefinitely. +This patch helps cancel the pending/in-flight I/O from the +nvme request timeout handler in case the nvme controller +is in the terminal (DEAD/DELETING/DELETING_NOIO) state and +that helps nvme_remove() code path forward progress and +finish successfully. + +Link: https://lore.kernel.org/all/199be893-5dfa-41e5-b6f2-40ac90ebccc4@linux.ibm.com/ +Signed-off-by: Nilay Shroff +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 21 --------------------- + drivers/nvme/host/nvme.h | 21 +++++++++++++++++++++ + drivers/nvme/host/pci.c | 8 +++++++- + 3 files changed, 28 insertions(+), 22 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 2db71e222fa7d..35eaa5c6c0c15 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -587,27 +587,6 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + } + EXPORT_SYMBOL_GPL(nvme_change_ctrl_state); + +-/* +- * Returns true for sink states that can't ever transition back to live. +- */ +-static bool nvme_state_terminal(struct nvme_ctrl *ctrl) +-{ +- switch (nvme_ctrl_state(ctrl)) { +- case NVME_CTRL_NEW: +- case NVME_CTRL_LIVE: +- case NVME_CTRL_RESETTING: +- case NVME_CTRL_CONNECTING: +- return false; +- case NVME_CTRL_DELETING: +- case NVME_CTRL_DELETING_NOIO: +- case NVME_CTRL_DEAD: +- return true; +- default: +- WARN_ONCE(1, "Unhandled ctrl state:%d", ctrl->state); +- return true; +- } +-} +- + /* + * Waits for the controller state to be resetting, or returns false if it is + * not possible to ever transition to that state. +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 176e372a5a796..2c510c4e21c66 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -740,6 +740,27 @@ static inline bool nvme_is_aen_req(u16 qid, __u16 command_id) + nvme_tag_from_cid(command_id) >= NVME_AQ_BLK_MQ_DEPTH; + } + ++/* ++ * Returns true for sink states that can't ever transition back to live. ++ */ ++static inline bool nvme_state_terminal(struct nvme_ctrl *ctrl) ++{ ++ switch (nvme_ctrl_state(ctrl)) { ++ case NVME_CTRL_NEW: ++ case NVME_CTRL_LIVE: ++ case NVME_CTRL_RESETTING: ++ case NVME_CTRL_CONNECTING: ++ return false; ++ case NVME_CTRL_DELETING: ++ case NVME_CTRL_DELETING_NOIO: ++ case NVME_CTRL_DEAD: ++ return true; ++ default: ++ WARN_ONCE(1, "Unhandled ctrl state:%d", ctrl->state); ++ return true; ++ } ++} ++ + void nvme_complete_rq(struct request *req); + void nvme_complete_batch_req(struct request *req); + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index e47172bd84efe..8d5ed4cb35d96 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1286,6 +1286,9 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req) + struct nvme_command cmd = { }; + u32 csts = readl(dev->bar + NVME_REG_CSTS); + ++ if (nvme_state_terminal(&dev->ctrl)) ++ goto disable; ++ + /* If PCI error recovery process is happening, we cannot reset or + * the recovery mechanism will surely fail. + */ +@@ -1388,8 +1391,11 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req) + return BLK_EH_RESET_TIMER; + + disable: +- if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING)) ++ if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING)) { ++ if (nvme_state_terminal(&dev->ctrl)) ++ nvme_dev_disable(dev, true); + return BLK_EH_DONE; ++ } + + nvme_dev_disable(dev, false); + if (nvme_try_sched_reset(&dev->ctrl)) +-- +2.43.0 + diff --git a/queue-6.6/nvme-find-numa-distance-only-if-controller-has-valid.patch b/queue-6.6/nvme-find-numa-distance-only-if-controller-has-valid.patch new file mode 100644 index 00000000000..7ee57bfcb10 --- /dev/null +++ b/queue-6.6/nvme-find-numa-distance-only-if-controller-has-valid.patch @@ -0,0 +1,47 @@ +From 2446e73f0047c6152c96f32371e3905c06fbef41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 13:49:23 +0530 +Subject: nvme: find numa distance only if controller has valid numa id + +From: Nilay Shroff + +[ Upstream commit 863fe60ed27f2c85172654a63c5b827e72c8b2e6 ] + +On system where native nvme multipath is configured and iopolicy +is set to numa but the nvme controller numa node id is undefined +or -1 (NUMA_NO_NODE) then avoid calculating node distance for +finding optimal io path. In such case we may access numa distance +table with invalid index and that may potentially refer to incorrect +memory. So this patch ensures that if the nvme controller numa node +id is -1 then instead of calculating node distance for finding optimal +io path, we set the numa node distance of such controller to default 10 +(LOCAL_DISTANCE). + +Link: https://lore.kernel.org/all/20240413090614.678353-1-nilay@linux.ibm.com/ +Signed-off-by: Nilay Shroff +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 0a88d7bdc5e37..b39553b8378b5 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -246,7 +246,8 @@ static struct nvme_ns *__nvme_find_path(struct nvme_ns_head *head, int node) + if (nvme_path_is_disabled(ns)) + continue; + +- if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_NUMA) ++ if (ns->ctrl->numa_node != NUMA_NO_NODE && ++ READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_NUMA) + distance = node_distance(node, ns->ctrl->numa_node); + else + distance = LOCAL_DISTANCE; +-- +2.43.0 + diff --git a/queue-6.6/nvmet-auth-replace-pr_debug-with-pr_err-to-report-an.patch b/queue-6.6/nvmet-auth-replace-pr_debug-with-pr_err-to-report-an.patch new file mode 100644 index 00000000000..80944214a31 --- /dev/null +++ b/queue-6.6/nvmet-auth-replace-pr_debug-with-pr_err-to-report-an.patch @@ -0,0 +1,41 @@ +From 4008a0d9aafa04bb938382fd843b92f1ef478c68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 11:48:42 +0200 +Subject: nvmet-auth: replace pr_debug() with pr_err() to report an error. + +From: Maurizio Lombardi + +[ Upstream commit 445f9119e70368ccc964575c2a6d3176966a9d65 ] + +In nvmet_auth_host_hash(), if a mismatch is detected in the hash length +the kernel should print an error. + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/auth.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c +index 1f7d492c4dc26..e900525b78665 100644 +--- a/drivers/nvme/target/auth.c ++++ b/drivers/nvme/target/auth.c +@@ -284,9 +284,9 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, + } + + if (shash_len != crypto_shash_digestsize(shash_tfm)) { +- pr_debug("%s: hash len mismatch (len %d digest %d)\n", +- __func__, shash_len, +- crypto_shash_digestsize(shash_tfm)); ++ pr_err("%s: hash len mismatch (len %d digest %d)\n", ++ __func__, shash_len, ++ crypto_shash_digestsize(shash_tfm)); + ret = -EINVAL; + goto out_free_tfm; + } +-- +2.43.0 + diff --git a/queue-6.6/nvmet-auth-return-the-error-code-to-the-nvmet_auth_h.patch b/queue-6.6/nvmet-auth-return-the-error-code-to-the-nvmet_auth_h.patch new file mode 100644 index 00000000000..366c51df356 --- /dev/null +++ b/queue-6.6/nvmet-auth-return-the-error-code-to-the-nvmet_auth_h.patch @@ -0,0 +1,38 @@ +From 36324086bacd90ea5c7e340980fcdf6225ba2a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 11:48:41 +0200 +Subject: nvmet-auth: return the error code to the nvmet_auth_host_hash() + callers + +From: Maurizio Lombardi + +[ Upstream commit 46b8f9f74f6d500871985e22eb19560b21f3bc81 ] + +If the nvmet_auth_host_hash() function fails, the error code should +be returned to its callers. + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/auth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c +index 4dcddcf95279b..1f7d492c4dc26 100644 +--- a/drivers/nvme/target/auth.c ++++ b/drivers/nvme/target/auth.c +@@ -368,7 +368,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, + kfree_sensitive(host_response); + out_free_tfm: + crypto_free_shash(shash_tfm); +- return 0; ++ return ret; + } + + int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response, +-- +2.43.0 + diff --git a/queue-6.6/nvmet-fix-nvme-status-code-when-namespace-is-disable.patch b/queue-6.6/nvmet-fix-nvme-status-code-when-namespace-is-disable.patch new file mode 100644 index 00000000000..45c58a0d9a7 --- /dev/null +++ b/queue-6.6/nvmet-fix-nvme-status-code-when-namespace-is-disable.patch @@ -0,0 +1,94 @@ +From 577ef0ac5d137749da5071425586a59cbea80304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2024 12:25:40 +0300 +Subject: nvmet: fix nvme status code when namespace is disabled + +From: Sagi Grimberg + +[ Upstream commit 505363957fad35f7aed9a2b0d8dad73451a80fb5 ] + +If the user disabled a nvmet namespace, it is removed from the subsystem +namespaces list. When nvmet processes a command directed to an nsid that +was disabled, it cannot differentiate between a nsid that is disabled +vs. a non-existent namespace, and resorts to return NVME_SC_INVALID_NS +with the dnr bit set. + +This translates to a non-retryable status for the host, which translates +to a user error. We should expect disabled namespaces to not cause an +I/O error in a multipath environment. + +Address this by searching a configfs item for the namespace nvmet failed +to find, and if we found one, conclude that the namespace is disabled +(perhaps temporarily). Return NVME_SC_INTERNAL_PATH_ERROR in this case +and keep DNR bit cleared. + +Reported-by: Jirong Feng +Tested-by: Jirong Feng +Signed-off-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/configfs.c | 13 +++++++++++++ + drivers/nvme/target/core.c | 5 ++++- + drivers/nvme/target/nvmet.h | 1 + + 3 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index 01b2a3d1a5e6c..3670a1103863b 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -616,6 +616,19 @@ static struct configfs_attribute *nvmet_ns_attrs[] = { + NULL, + }; + ++bool nvmet_subsys_nsid_exists(struct nvmet_subsys *subsys, u32 nsid) ++{ ++ struct config_item *ns_item; ++ char name[4] = {}; ++ ++ if (sprintf(name, "%u", nsid) <= 0) ++ return false; ++ mutex_lock(&subsys->namespaces_group.cg_subsys->su_mutex); ++ ns_item = config_group_find_item(&subsys->namespaces_group, name); ++ mutex_unlock(&subsys->namespaces_group.cg_subsys->su_mutex); ++ return ns_item != NULL; ++} ++ + static void nvmet_ns_release(struct config_item *item) + { + struct nvmet_ns *ns = to_nvmet_ns(item); +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 3935165048e74..ce7e945cb4f7e 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -425,10 +425,13 @@ void nvmet_stop_keep_alive_timer(struct nvmet_ctrl *ctrl) + u16 nvmet_req_find_ns(struct nvmet_req *req) + { + u32 nsid = le32_to_cpu(req->cmd->common.nsid); ++ struct nvmet_subsys *subsys = nvmet_req_subsys(req); + +- req->ns = xa_load(&nvmet_req_subsys(req)->namespaces, nsid); ++ req->ns = xa_load(&subsys->namespaces, nsid); + if (unlikely(!req->ns)) { + req->error_loc = offsetof(struct nvme_common_command, nsid); ++ if (nvmet_subsys_nsid_exists(subsys, nsid)) ++ return NVME_SC_INTERNAL_PATH_ERROR; + return NVME_SC_INVALID_NS | NVME_SC_DNR; + } + +diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h +index 8cfd60f3b5648..15b00ed7be16a 100644 +--- a/drivers/nvme/target/nvmet.h ++++ b/drivers/nvme/target/nvmet.h +@@ -530,6 +530,7 @@ void nvmet_subsys_disc_changed(struct nvmet_subsys *subsys, + struct nvmet_host *host); + void nvmet_add_async_event(struct nvmet_ctrl *ctrl, u8 event_type, + u8 event_info, u8 log_page); ++bool nvmet_subsys_nsid_exists(struct nvmet_subsys *subsys, u32 nsid); + + #define NVMET_QUEUE_SIZE 1024 + #define NVMET_NR_QUEUES 128 +-- +2.43.0 + diff --git a/queue-6.6/nvmet-prevent-sprintf-overflow-in-nvmet_subsys_nsid_.patch b/queue-6.6/nvmet-prevent-sprintf-overflow-in-nvmet_subsys_nsid_.patch new file mode 100644 index 00000000000..a56a33825f2 --- /dev/null +++ b/queue-6.6/nvmet-prevent-sprintf-overflow-in-nvmet_subsys_nsid_.patch @@ -0,0 +1,49 @@ +From 875f0954230eecfcb7a93f0ddd41936b8a34b843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 10:43:04 +0300 +Subject: nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists() + +From: Dan Carpenter + +[ Upstream commit d15dcd0f1a4753b57e66c64c8dc2a9779ff96aab ] + +The nsid value is a u32 that comes from nvmet_req_find_ns(). It's +endian data and we're on an error path and both of those raise red +flags. So let's make this safer. + +1) Make the buffer large enough for any u32. +2) Remove the unnecessary initialization. +3) Use snprintf() instead of sprintf() for even more safety. +4) The sprintf() function returns the number of bytes printed, not + counting the NUL terminator. It is impossible for the return value to + be <= 0 so delete that. + +Fixes: 505363957fad ("nvmet: fix nvme status code when namespace is disabled") +Signed-off-by: Dan Carpenter +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/configfs.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index 3670a1103863b..f999e18e4561d 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -619,10 +619,9 @@ static struct configfs_attribute *nvmet_ns_attrs[] = { + bool nvmet_subsys_nsid_exists(struct nvmet_subsys *subsys, u32 nsid) + { + struct config_item *ns_item; +- char name[4] = {}; ++ char name[12]; + +- if (sprintf(name, "%u", nsid) <= 0) +- return false; ++ snprintf(name, sizeof(name), "%u", nsid); + mutex_lock(&subsys->namespaces_group.cg_subsys->su_mutex); + ns_item = config_group_find_item(&subsys->namespaces_group, name); + mutex_unlock(&subsys->namespaces_group.cg_subsys->su_mutex); +-- +2.43.0 + diff --git a/queue-6.6/nvmet-tcp-fix-possible-memory-leak-when-tearing-down.patch b/queue-6.6/nvmet-tcp-fix-possible-memory-leak-when-tearing-down.patch new file mode 100644 index 00000000000..69b77ef8f6a --- /dev/null +++ b/queue-6.6/nvmet-tcp-fix-possible-memory-leak-when-tearing-down.patch @@ -0,0 +1,65 @@ +From ddba8dc6c30096e7ea0958638454860fe205f17a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2024 11:49:49 +0300 +Subject: nvmet-tcp: fix possible memory leak when tearing down a controller + +From: Sagi Grimberg + +[ Upstream commit 6825bdde44340c5a9121f6d6fa25cc885bd9e821 ] + +When we teardown the controller, we wait for pending I/Os to complete +(sq->ref on all queues to drop to zero) and then we go over the commands, +and free their command buffers in case they are still fetching data from +the host (e.g. processing nvme writes) and have yet to take a reference +on the sq. + +However, we may miss the case where commands have failed before executing +and are queued for sending a response, but will never occur because the +queue socket is already down. In this case we may miss deallocating command +buffers. + +Solve this by freeing all commands buffers as nvmet_tcp_free_cmd_buffers is +idempotent anyways. + +Reported-by: Yi Zhang +Tested-by: Yi Zhang +Signed-off-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 8e5d547aa16cb..3d302815c6f36 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -324,6 +324,7 @@ static int nvmet_tcp_check_ddgst(struct nvmet_tcp_queue *queue, void *pdu) + return 0; + } + ++/* If cmd buffers are NULL, no operation is performed */ + static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd) + { + kfree(cmd->iov); +@@ -1476,13 +1477,9 @@ static void nvmet_tcp_free_cmd_data_in_buffers(struct nvmet_tcp_queue *queue) + struct nvmet_tcp_cmd *cmd = queue->cmds; + int i; + +- for (i = 0; i < queue->nr_cmds; i++, cmd++) { +- if (nvmet_tcp_need_data_in(cmd)) +- nvmet_tcp_free_cmd_buffers(cmd); +- } +- +- if (!queue->nr_cmds && nvmet_tcp_need_data_in(&queue->connect)) +- nvmet_tcp_free_cmd_buffers(&queue->connect); ++ for (i = 0; i < queue->nr_cmds; i++, cmd++) ++ nvmet_tcp_free_cmd_buffers(cmd); ++ nvmet_tcp_free_cmd_buffers(&queue->connect); + } + + static void nvmet_tcp_release_queue_work(struct work_struct *w) +-- +2.43.0 + diff --git a/queue-6.6/of-module-add-buffer-overflow-check-in-of_modalias.patch b/queue-6.6/of-module-add-buffer-overflow-check-in-of_modalias.patch new file mode 100644 index 00000000000..2b1dd7589b2 --- /dev/null +++ b/queue-6.6/of-module-add-buffer-overflow-check-in-of_modalias.patch @@ -0,0 +1,50 @@ +From cb007f0345ea19a67fca4794b9cae04e88260efe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Apr 2024 11:51:39 +0300 +Subject: of: module: add buffer overflow check in of_modalias() + +From: Sergey Shtylyov + +[ Upstream commit cf7385cb26ac4f0ee6c7385960525ad534323252 ] + +In of_modalias(), if the buffer happens to be too small even for the 1st +snprintf() call, the len parameter will become negative and str parameter +(if not NULL initially) will point beyond the buffer's end. Add the buffer +overflow check after the 1st snprintf() call and fix such check after the +strlen() call (accounting for the terminating NUL char). + +Fixes: bc575064d688 ("of/device: use of_property_for_each_string to parse compatible strings") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/bbfc6be0-c687-62b6-d015-5141b93f313e@omp.ru +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/module.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/of/module.c b/drivers/of/module.c +index f58e624953a20..780fd82a7ecc5 100644 +--- a/drivers/of/module.c ++++ b/drivers/of/module.c +@@ -29,14 +29,15 @@ ssize_t of_modalias(const struct device_node *np, char *str, ssize_t len) + csize = snprintf(str, len, "of:N%pOFn%c%s", np, 'T', + of_node_get_device_type(np)); + tsize = csize; ++ if (csize >= len) ++ csize = len > 0 ? len - 1 : 0; + len -= csize; +- if (str) +- str += csize; ++ str += csize; + + of_property_for_each_string(np, "compatible", p, compat) { + csize = strlen(compat) + 1; + tsize += csize; +- if (csize > len) ++ if (csize >= len) + continue; + + csize = snprintf(str, len, "C%s", compat); +-- +2.43.0 + diff --git a/queue-6.6/openpromfs-finish-conversion-to-the-new-mount-api.patch b/queue-6.6/openpromfs-finish-conversion-to-the-new-mount-api.patch new file mode 100644 index 00000000000..772fd19f368 --- /dev/null +++ b/queue-6.6/openpromfs-finish-conversion-to-the-new-mount-api.patch @@ -0,0 +1,58 @@ +From eafcce070ed0f891ceb785ae4df9d6f163034d8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 16:33:11 -0600 +Subject: openpromfs: finish conversion to the new mount API + +From: Eric Sandeen + +[ Upstream commit 8f27829974b025d4df2e78894105d75e3bf349f0 ] + +The original mount API conversion inexplicably left out the change +from ->remount_fs to ->reconfigure; do that now. + +Fixes: 7ab2fa7693c3 ("vfs: Convert openpromfs to use the new mount API") +Signed-off-by: Eric Sandeen +Link: https://lore.kernel.org/r/90b968aa-c979-420f-ba37-5acc3391b28f@redhat.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/openpromfs/inode.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/openpromfs/inode.c b/fs/openpromfs/inode.c +index b2457cb97fa00..e62e809a55265 100644 +--- a/fs/openpromfs/inode.c ++++ b/fs/openpromfs/inode.c +@@ -355,10 +355,10 @@ static struct inode *openprom_iget(struct super_block *sb, ino_t ino) + return inode; + } + +-static int openprom_remount(struct super_block *sb, int *flags, char *data) ++static int openpromfs_reconfigure(struct fs_context *fc) + { +- sync_filesystem(sb); +- *flags |= SB_NOATIME; ++ sync_filesystem(fc->root->d_sb); ++ fc->sb_flags |= SB_NOATIME; + return 0; + } + +@@ -366,7 +366,6 @@ static const struct super_operations openprom_sops = { + .alloc_inode = openprom_alloc_inode, + .free_inode = openprom_free_inode, + .statfs = simple_statfs, +- .remount_fs = openprom_remount, + }; + + static int openprom_fill_super(struct super_block *s, struct fs_context *fc) +@@ -415,6 +414,7 @@ static int openpromfs_get_tree(struct fs_context *fc) + + static const struct fs_context_operations openpromfs_context_ops = { + .get_tree = openpromfs_get_tree, ++ .reconfigure = openpromfs_reconfigure, + }; + + static int openpromfs_init_fs_context(struct fs_context *fc) +-- +2.43.0 + diff --git a/queue-6.6/openrisc-traps-don-t-send-signals-to-kernel-mode-thr.patch b/queue-6.6/openrisc-traps-don-t-send-signals-to-kernel-mode-thr.patch new file mode 100644 index 00000000000..d855af0d8cb --- /dev/null +++ b/queue-6.6/openrisc-traps-don-t-send-signals-to-kernel-mode-thr.patch @@ -0,0 +1,91 @@ +From 5cc9993726b50386f563cb874e93f42e979f5fce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Mar 2024 14:42:49 +0000 +Subject: openrisc: traps: Don't send signals to kernel mode threads + +From: Stafford Horne + +[ Upstream commit c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f ] + +OpenRISC exception handling sends signals to user processes on floating +point exceptions and trap instructions (for debugging) among others. +There is a bug where the trap handling logic may send signals to kernel +threads, we should not send these signals to kernel threads, if that +happens we treat it as an error. + +This patch adds conditions to die if the kernel receives these +exceptions in kernel mode code. + +Fixes: 27267655c531 ("openrisc: Support floating point user api") +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/kernel/traps.c | 48 ++++++++++++++++++++++-------------- + 1 file changed, 29 insertions(+), 19 deletions(-) + +diff --git a/arch/openrisc/kernel/traps.c b/arch/openrisc/kernel/traps.c +index 9370888c9a7e3..90554a5558fbc 100644 +--- a/arch/openrisc/kernel/traps.c ++++ b/arch/openrisc/kernel/traps.c +@@ -180,29 +180,39 @@ asmlinkage void unhandled_exception(struct pt_regs *regs, int ea, int vector) + + asmlinkage void do_fpe_trap(struct pt_regs *regs, unsigned long address) + { +- int code = FPE_FLTUNK; +- unsigned long fpcsr = regs->fpcsr; +- +- if (fpcsr & SPR_FPCSR_IVF) +- code = FPE_FLTINV; +- else if (fpcsr & SPR_FPCSR_OVF) +- code = FPE_FLTOVF; +- else if (fpcsr & SPR_FPCSR_UNF) +- code = FPE_FLTUND; +- else if (fpcsr & SPR_FPCSR_DZF) +- code = FPE_FLTDIV; +- else if (fpcsr & SPR_FPCSR_IXF) +- code = FPE_FLTRES; +- +- /* Clear all flags */ +- regs->fpcsr &= ~SPR_FPCSR_ALLF; +- +- force_sig_fault(SIGFPE, code, (void __user *)regs->pc); ++ if (user_mode(regs)) { ++ int code = FPE_FLTUNK; ++ unsigned long fpcsr = regs->fpcsr; ++ ++ if (fpcsr & SPR_FPCSR_IVF) ++ code = FPE_FLTINV; ++ else if (fpcsr & SPR_FPCSR_OVF) ++ code = FPE_FLTOVF; ++ else if (fpcsr & SPR_FPCSR_UNF) ++ code = FPE_FLTUND; ++ else if (fpcsr & SPR_FPCSR_DZF) ++ code = FPE_FLTDIV; ++ else if (fpcsr & SPR_FPCSR_IXF) ++ code = FPE_FLTRES; ++ ++ /* Clear all flags */ ++ regs->fpcsr &= ~SPR_FPCSR_ALLF; ++ ++ force_sig_fault(SIGFPE, code, (void __user *)regs->pc); ++ } else { ++ pr_emerg("KERNEL: Illegal fpe exception 0x%.8lx\n", regs->pc); ++ die("Die:", regs, SIGFPE); ++ } + } + + asmlinkage void do_trap(struct pt_regs *regs, unsigned long address) + { +- force_sig_fault(SIGTRAP, TRAP_BRKPT, (void __user *)regs->pc); ++ if (user_mode(regs)) { ++ force_sig_fault(SIGTRAP, TRAP_BRKPT, (void __user *)regs->pc); ++ } else { ++ pr_emerg("KERNEL: Illegal trap exception 0x%.8lx\n", regs->pc); ++ die("Die:", regs, SIGILL); ++ } + } + + asmlinkage void do_unaligned_access(struct pt_regs *regs, unsigned long address) +-- +2.43.0 + diff --git a/queue-6.6/parisc-add-missing-export-of-__cmpxchg_u8.patch b/queue-6.6/parisc-add-missing-export-of-__cmpxchg_u8.patch new file mode 100644 index 00000000000..f54700d4213 --- /dev/null +++ b/queue-6.6/parisc-add-missing-export-of-__cmpxchg_u8.patch @@ -0,0 +1,36 @@ +From 8e8379e1ec6cb4d55f259f5be5733af16923aa37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 22:35:54 -0400 +Subject: parisc: add missing export of __cmpxchg_u8() + +From: Al Viro + +[ Upstream commit c57e5dccb06decf3cb6c272ab138c033727149b5 ] + +__cmpxchg_u8() had been added (initially) for the sake of +drivers/phy/ti/phy-tusb1210.c; the thing is, that drivers is +modular, so we need an export + +Fixes: b344d6a83d01 "parisc: add support for cmpxchg on u8 pointers" +Signed-off-by: Al Viro +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/parisc_ksyms.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c +index 6f0c92e8149d8..dcf61cbd31470 100644 +--- a/arch/parisc/kernel/parisc_ksyms.c ++++ b/arch/parisc/kernel/parisc_ksyms.c +@@ -22,6 +22,7 @@ EXPORT_SYMBOL(memset); + #include + EXPORT_SYMBOL(__xchg8); + EXPORT_SYMBOL(__xchg32); ++EXPORT_SYMBOL(__cmpxchg_u8); + EXPORT_SYMBOL(__cmpxchg_u32); + EXPORT_SYMBOL(__cmpxchg_u64); + #ifdef CONFIG_SMP +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-isst-add-grand-ridge-to-hpm-cpu-list.patch b/queue-6.6/platform-x86-isst-add-grand-ridge-to-hpm-cpu-list.patch new file mode 100644 index 00000000000..d17b6fd15ae --- /dev/null +++ b/queue-6.6/platform-x86-isst-add-grand-ridge-to-hpm-cpu-list.patch @@ -0,0 +1,39 @@ +From b0e34bf643822d6eff3920a565731dd20078e446 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 14:22:22 -0700 +Subject: platform/x86: ISST: Add Grand Ridge to HPM CPU list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivas Pandruvada + +[ Upstream commit 515a3c3a5489a890c7c3c1df3855eb4868a27598 ] + +Add Grand Ridge (ATOM_CRESTMONT) to hpm_cpu_ids, so that MSR 0x54 can be +used. + +Signed-off-by: Srinivas Pandruvada +Link: https://lore.kernel.org/r/20240422212222.3881606-1-srinivas.pandruvada@linux.intel.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c +index 30951f7131cd9..1accdaaf282c5 100644 +--- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c ++++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c +@@ -721,6 +721,7 @@ static struct miscdevice isst_if_char_driver = { + static const struct x86_cpu_id hpm_cpu_ids[] = { + X86_MATCH_INTEL_FAM6_MODEL(GRANITERAPIDS_D, NULL), + X86_MATCH_INTEL_FAM6_MODEL(GRANITERAPIDS_X, NULL), ++ X86_MATCH_INTEL_FAM6_MODEL(ATOM_CRESTMONT, NULL), + X86_MATCH_INTEL_FAM6_MODEL(ATOM_CRESTMONT_X, NULL), + {} + }; +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch b/queue-6.6/platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch new file mode 100644 index 00000000000..3c7272d1bb3 --- /dev/null +++ b/queue-6.6/platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch @@ -0,0 +1,95 @@ +From 831f943a69833152081ec7393af598f0c8b415fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 16:30:57 +0200 +Subject: platform/x86: xiaomi-wmi: Fix race condition when reporting key + events + +From: Armin Wolf + +[ Upstream commit 290680c2da8061e410bcaec4b21584ed951479af ] + +Multiple WMI events can be received concurrently, so multiple instances +of xiaomi_wmi_notify() can be active at the same time. Since the input +device is shared between those handlers, the key input sequence can be +disturbed. + +Fix this by protecting the key input sequence with a mutex. + +Compile-tested only. + +Fixes: edb73f4f0247 ("platform/x86: wmi: add Xiaomi WMI key driver") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20240402143059.8456-2-W_Armin@gmx.de +Reviewed-by: Kuppuswamy Sathyanarayanan +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/xiaomi-wmi.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/platform/x86/xiaomi-wmi.c b/drivers/platform/x86/xiaomi-wmi.c +index 54a2546bb93bf..be80f0bda9484 100644 +--- a/drivers/platform/x86/xiaomi-wmi.c ++++ b/drivers/platform/x86/xiaomi-wmi.c +@@ -2,8 +2,10 @@ + /* WMI driver for Xiaomi Laptops */ + + #include ++#include + #include + #include ++#include + #include + + #include +@@ -20,12 +22,21 @@ + + struct xiaomi_wmi { + struct input_dev *input_dev; ++ struct mutex key_lock; /* Protects the key event sequence */ + unsigned int key_code; + }; + ++static void xiaomi_mutex_destroy(void *data) ++{ ++ struct mutex *lock = data; ++ ++ mutex_destroy(lock); ++} ++ + static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context) + { + struct xiaomi_wmi *data; ++ int ret; + + if (wdev == NULL || context == NULL) + return -EINVAL; +@@ -35,6 +46,11 @@ static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context) + return -ENOMEM; + dev_set_drvdata(&wdev->dev, data); + ++ mutex_init(&data->key_lock); ++ ret = devm_add_action_or_reset(&wdev->dev, xiaomi_mutex_destroy, &data->key_lock); ++ if (ret < 0) ++ return ret; ++ + data->input_dev = devm_input_allocate_device(&wdev->dev); + if (data->input_dev == NULL) + return -ENOMEM; +@@ -59,10 +75,12 @@ static void xiaomi_wmi_notify(struct wmi_device *wdev, union acpi_object *dummy) + if (data == NULL) + return; + ++ mutex_lock(&data->key_lock); + input_report_key(data->input_dev, data->key_code, 1); + input_sync(data->input_dev); + input_report_key(data->input_dev, data->key_code, 0); + input_sync(data->input_dev); ++ mutex_unlock(&data->key_lock); + } + + static const struct wmi_device_id xiaomi_wmi_id_table[] = { +-- +2.43.0 + diff --git a/queue-6.6/powerpc-fsl-soc-hide-unused-const-variable.patch b/queue-6.6/powerpc-fsl-soc-hide-unused-const-variable.patch new file mode 100644 index 00000000000..05b1af811c8 --- /dev/null +++ b/queue-6.6/powerpc-fsl-soc-hide-unused-const-variable.patch @@ -0,0 +1,48 @@ +From 6a6f093fd984311ed74ac378041cd6316c61df6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 10:06:19 +0200 +Subject: powerpc/fsl-soc: hide unused const variable + +From: Arnd Bergmann + +[ Upstream commit 01acaf3aa75e1641442cc23d8fe0a7bb4226efb1 ] + +vmpic_msi_feature is only used conditionally, which triggers a rare +-Werror=unused-const-variable= warning with gcc: + +arch/powerpc/sysdev/fsl_msi.c:567:37: error: 'vmpic_msi_feature' defined but not used [-Werror=unused-const-variable=] + 567 | static const struct fsl_msi_feature vmpic_msi_feature = + +Hide this one in the same #ifdef as the reference so we can turn on +the warning by default. + +Fixes: 305bcf26128e ("powerpc/fsl-soc: use CONFIG_EPAPR_PARAVIRT for hcalls") +Signed-off-by: Arnd Bergmann +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240403080702.3509288-2-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/fsl_msi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c +index 57978a44d55b6..ce9895633c4e0 100644 +--- a/arch/powerpc/sysdev/fsl_msi.c ++++ b/arch/powerpc/sysdev/fsl_msi.c +@@ -568,10 +568,12 @@ static const struct fsl_msi_feature ipic_msi_feature = { + .msiir_offset = 0x38, + }; + ++#ifdef CONFIG_EPAPR_PARAVIRT + static const struct fsl_msi_feature vmpic_msi_feature = { + .fsl_pic_ip = FSL_PIC_IP_VMPIC, + .msiir_offset = 0, + }; ++#endif + + static const struct of_device_id fsl_of_msi_ids[] = { + { +-- +2.43.0 + diff --git a/queue-6.6/printk-let-no_printk-use-_printk.patch b/queue-6.6/printk-let-no_printk-use-_printk.patch new file mode 100644 index 00000000000..2353340535f --- /dev/null +++ b/queue-6.6/printk-let-no_printk-use-_printk.patch @@ -0,0 +1,55 @@ +From 19f5119931884661d45430fa87db0d266e887287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 15:00:02 +0100 +Subject: printk: Let no_printk() use _printk() + +From: Geert Uytterhoeven + +[ Upstream commit 8522f6b760ca588928eede740d5d69dd1e936b49 ] + +When printk-indexing is enabled, each printk() invocation emits a +pi_entry structure, containing the format string and other information +related to its location in the kernel sources. This is even true for +no_printk(): while the actual code to print the message is optimized out +by the compiler due to the always-false check, the pi_entry structure is +still emitted. + +As the main purpose of no_printk() is to provide a helper to maintain +printf()-style format checking when debugging is disabled, this leads to +the inclusion in the index of lots of printk formats that cannot be +emitted by the current kernel. + +Fix this by switching no_printk() from printk() to _printk(). + +This reduces the size of an arm64 defconfig kernel with +CONFIG_PRINTK_INDEX=y by 576 KiB. + +Fixes: 337015573718b161 ("printk: Userspace format indexing support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Andy Shevchenko +Reviewed-by: Xiubo Li +Reviewed-by: Chris Down +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/56cf92edccffea970e1f40a075334dd6cf5bb2a4.1709127473.git.geert+renesas@glider.be +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + include/linux/printk.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/printk.h b/include/linux/printk.h +index 8ef499ab3c1ed..e4878bb58f663 100644 +--- a/include/linux/printk.h ++++ b/include/linux/printk.h +@@ -126,7 +126,7 @@ struct va_format { + #define no_printk(fmt, ...) \ + ({ \ + if (0) \ +- printk(fmt, ##__VA_ARGS__); \ ++ _printk(fmt, ##__VA_ARGS__); \ + 0; \ + }) + +-- +2.43.0 + diff --git a/queue-6.6/pwm-sti-prepare-removing-pwm_chip-from-driver-data.patch b/queue-6.6/pwm-sti-prepare-removing-pwm_chip-from-driver-data.patch new file mode 100644 index 00000000000..4b68294e0f3 --- /dev/null +++ b/queue-6.6/pwm-sti-prepare-removing-pwm_chip-from-driver-data.patch @@ -0,0 +1,90 @@ +From 9c5bce6fadf04696a724ae0f08ba08c24f704715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 10:32:38 +0100 +Subject: pwm: sti: Prepare removing pwm_chip from driver data +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 54272761ce7c475fa30a31b59b0cb89f7652b39e ] + +This prepares the driver for further changes that will drop struct +pwm_chip chip from struct sti_pwm_chip. Use the pwm_chip as driver data +instead of the sti_pwm_chip to get access to the pwm_chip in +sti_pwm_remove() without using pc->chip. + +Link: https://lore.kernel.org/r/56d53372aacff6871df4d6c6779c9dac94592696.1707900770.git.u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Stable-dep-of: 5bb0b194aeee ("pwm: sti: Simplify probe function using devm functions") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-sti.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c +index c782378dff5e5..8f7aff51787be 100644 +--- a/drivers/pwm/pwm-sti.c ++++ b/drivers/pwm/pwm-sti.c +@@ -571,6 +571,7 @@ static int sti_pwm_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct sti_pwm_compat_data *cdata; ++ struct pwm_chip *chip; + struct sti_pwm_chip *pc; + unsigned int i; + int irq, ret; +@@ -578,6 +579,7 @@ static int sti_pwm_probe(struct platform_device *pdev) + pc = devm_kzalloc(dev, sizeof(*pc), GFP_KERNEL); + if (!pc) + return -ENOMEM; ++ chip = &pc->chip; + + cdata = devm_kzalloc(dev, sizeof(*cdata), GFP_KERNEL); + if (!cdata) +@@ -654,9 +656,9 @@ static int sti_pwm_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- pc->chip.dev = dev; +- pc->chip.ops = &sti_pwm_ops; +- pc->chip.npwm = max(cdata->pwm_num_devs, cdata->cpt_num_devs); ++ chip->dev = dev; ++ chip->ops = &sti_pwm_ops; ++ chip->npwm = max(cdata->pwm_num_devs, cdata->cpt_num_devs); + + for (i = 0; i < cdata->cpt_num_devs; i++) { + struct sti_cpt_ddata *ddata = &cdata->ddata[i]; +@@ -665,23 +667,24 @@ static int sti_pwm_probe(struct platform_device *pdev) + mutex_init(&ddata->lock); + } + +- ret = pwmchip_add(&pc->chip); ++ ret = pwmchip_add(chip); + if (ret < 0) { + clk_unprepare(pc->pwm_clk); + clk_unprepare(pc->cpt_clk); + return ret; + } + +- platform_set_drvdata(pdev, pc); ++ platform_set_drvdata(pdev, chip); + + return 0; + } + + static void sti_pwm_remove(struct platform_device *pdev) + { +- struct sti_pwm_chip *pc = platform_get_drvdata(pdev); ++ struct pwm_chip *chip = platform_get_drvdata(pdev); ++ struct sti_pwm_chip *pc = to_sti_pwmchip(chip); + +- pwmchip_remove(&pc->chip); ++ pwmchip_remove(chip); + + clk_unprepare(pc->pwm_clk); + clk_unprepare(pc->cpt_clk); +-- +2.43.0 + diff --git a/queue-6.6/pwm-sti-simplify-probe-function-using-devm-functions.patch b/queue-6.6/pwm-sti-simplify-probe-function-using-devm-functions.patch new file mode 100644 index 00000000000..914c99b8732 --- /dev/null +++ b/queue-6.6/pwm-sti-simplify-probe-function-using-devm-functions.patch @@ -0,0 +1,115 @@ +From 7bf408fcaec28d4ae2dad63b039d39fbe1046861 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Mar 2024 12:00:54 +0100 +Subject: pwm: sti: Simplify probe function using devm functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 5bb0b194aeee5d5da6881232f4e9989b35957c25 ] + +Instead of of_clk_get_by_name() use devm_clk_get_prepared() which has +several advantages: + + - Combines getting the clock and a call to clk_prepare(). The latter + can be dropped from sti_pwm_probe() accordingly. + - Cares for calling clk_put() which is missing in both probe's error + path and the remove function. + - Cares for calling clk_unprepare() which can be dropped from the error + paths and the remove function. (Note that not all error path got this + right.) + +With additionally using devm_pwmchip_add() instead of pwmchip_add() the +remove callback can be dropped completely. With it the last user of +platform_get_drvdata() goes away and so platform_set_drvdata() can be +dropped from the probe function, too. + +Fixes: 378fe115d19d ("pwm: sti: Add new driver for ST's PWM IP") +Link: https://lore.kernel.org/r/81f0e1d173652f435afda6719adaed1922fe059a.1710068192.git.u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-sti.c | 39 +++------------------------------------ + 1 file changed, 3 insertions(+), 36 deletions(-) + +diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c +index 8f7aff51787be..a0467f0b549c2 100644 +--- a/drivers/pwm/pwm-sti.c ++++ b/drivers/pwm/pwm-sti.c +@@ -625,32 +625,20 @@ static int sti_pwm_probe(struct platform_device *pdev) + return ret; + + if (cdata->pwm_num_devs) { +- pc->pwm_clk = of_clk_get_by_name(dev->of_node, "pwm"); ++ pc->pwm_clk = devm_clk_get_prepared(dev, "pwm"); + if (IS_ERR(pc->pwm_clk)) { + dev_err(dev, "failed to get PWM clock\n"); + return PTR_ERR(pc->pwm_clk); + } +- +- ret = clk_prepare(pc->pwm_clk); +- if (ret) { +- dev_err(dev, "failed to prepare clock\n"); +- return ret; +- } + } + + if (cdata->cpt_num_devs) { +- pc->cpt_clk = of_clk_get_by_name(dev->of_node, "capture"); ++ pc->cpt_clk = devm_clk_get_prepared(dev, "capture"); + if (IS_ERR(pc->cpt_clk)) { + dev_err(dev, "failed to get PWM capture clock\n"); + return PTR_ERR(pc->cpt_clk); + } + +- ret = clk_prepare(pc->cpt_clk); +- if (ret) { +- dev_err(dev, "failed to prepare clock\n"); +- return ret; +- } +- + cdata->ddata = devm_kzalloc(dev, cdata->cpt_num_devs * sizeof(*cdata->ddata), GFP_KERNEL); + if (!cdata->ddata) + return -ENOMEM; +@@ -667,27 +655,7 @@ static int sti_pwm_probe(struct platform_device *pdev) + mutex_init(&ddata->lock); + } + +- ret = pwmchip_add(chip); +- if (ret < 0) { +- clk_unprepare(pc->pwm_clk); +- clk_unprepare(pc->cpt_clk); +- return ret; +- } +- +- platform_set_drvdata(pdev, chip); +- +- return 0; +-} +- +-static void sti_pwm_remove(struct platform_device *pdev) +-{ +- struct pwm_chip *chip = platform_get_drvdata(pdev); +- struct sti_pwm_chip *pc = to_sti_pwmchip(chip); +- +- pwmchip_remove(chip); +- +- clk_unprepare(pc->pwm_clk); +- clk_unprepare(pc->cpt_clk); ++ return devm_pwmchip_add(dev, chip); + } + + static const struct of_device_id sti_pwm_of_match[] = { +@@ -702,7 +670,6 @@ static struct platform_driver sti_pwm_driver = { + .of_match_table = sti_pwm_of_match, + }, + .probe = sti_pwm_probe, +- .remove_new = sti_pwm_remove, + }; + module_platform_driver(sti_pwm_driver); + +-- +2.43.0 + diff --git a/queue-6.6/qed-avoid-truncating-work-queue-length.patch b/queue-6.6/qed-avoid-truncating-work-queue-length.patch new file mode 100644 index 00000000000..b73981a8523 --- /dev/null +++ b/queue-6.6/qed-avoid-truncating-work-queue-length.patch @@ -0,0 +1,58 @@ +From 41ce4bb310ac920d315117cef685e808471d55f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 23:38:02 +0100 +Subject: qed: avoid truncating work queue length + +From: Arnd Bergmann + +[ Upstream commit 954fd908f177604d4cce77e2a88cc50b29bad5ff ] + +clang complains that the temporary string for the name passed into +alloc_workqueue() is too short for its contents: + +drivers/net/ethernet/qlogic/qed/qed_main.c:1218:3: error: 'snprintf' will always be truncated; specified size is 16, but format string expands to at least 18 [-Werror,-Wformat-truncation] + +There is no need for a temporary buffer, and the actual name of a workqueue +is 32 bytes (WQ_NAME_LEN), so just use the interface as intended to avoid +the truncation. + +Fixes: 59ccf86fe69a ("qed: Add driver infrastucture for handling mfw requests.") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240326223825.4084412-4-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_main.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index c278f8893042b..8159b4c315b5d 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -1206,7 +1206,6 @@ static void qed_slowpath_task(struct work_struct *work) + static int qed_slowpath_wq_start(struct qed_dev *cdev) + { + struct qed_hwfn *hwfn; +- char name[NAME_SIZE]; + int i; + + if (IS_VF(cdev)) +@@ -1215,11 +1214,11 @@ static int qed_slowpath_wq_start(struct qed_dev *cdev) + for_each_hwfn(cdev, i) { + hwfn = &cdev->hwfns[i]; + +- snprintf(name, NAME_SIZE, "slowpath-%02x:%02x.%02x", +- cdev->pdev->bus->number, +- PCI_SLOT(cdev->pdev->devfn), hwfn->abs_pf_id); ++ hwfn->slowpath_wq = alloc_workqueue("slowpath-%02x:%02x.%02x", ++ 0, 0, cdev->pdev->bus->number, ++ PCI_SLOT(cdev->pdev->devfn), ++ hwfn->abs_pf_id); + +- hwfn->slowpath_wq = alloc_workqueue(name, 0, 0); + if (!hwfn->slowpath_wq) { + DP_NOTICE(hwfn, "Cannot create slowpath workqueue\n"); + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/rcu-fix-buffer-overflow-in-print_cpu_stall_info.patch b/queue-6.6/rcu-fix-buffer-overflow-in-print_cpu_stall_info.patch new file mode 100644 index 00000000000..f2d8df0de5a --- /dev/null +++ b/queue-6.6/rcu-fix-buffer-overflow-in-print_cpu_stall_info.patch @@ -0,0 +1,51 @@ +From c22f3833980bf7fb291f8b44c692f830c1a23a1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 22:43:15 +0300 +Subject: rcu: Fix buffer overflow in print_cpu_stall_info() + +From: Nikita Kiryushin + +[ Upstream commit 3758f7d9917bd7ef0482c4184c0ad673b4c4e069 ] + +The rcuc-starvation output from print_cpu_stall_info() might overflow the +buffer if there is a huge difference in jiffies difference. The situation +might seem improbable, but computers sometimes get very confused about +time, which can result in full-sized integers, and, in this case, +buffer overflow. + +Also, the unsigned jiffies difference is printed using %ld, which is +normally for signed integers. This is intentional for debugging purposes, +but it is not obvious from the code. + +This commit therefore changes sprintf() to snprintf() and adds a +clarifying comment about intention of %ld format. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 245a62982502 ("rcu: Dump rcuc kthread status for CPUs not reporting quiescent state") +Signed-off-by: Nikita Kiryushin +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Paul E. McKenney +Signed-off-by: Uladzislau Rezki (Sony) +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_stall.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h +index e09f4f624261e..11a1fac3a5898 100644 +--- a/kernel/rcu/tree_stall.h ++++ b/kernel/rcu/tree_stall.h +@@ -503,7 +503,8 @@ static void print_cpu_stall_info(int cpu) + rcu_dynticks_in_eqs(rcu_dynticks_snap(cpu)); + rcuc_starved = rcu_is_rcuc_kthread_starving(rdp, &j); + if (rcuc_starved) +- sprintf(buf, " rcuc=%ld jiffies(starved)", j); ++ // Print signed value, as negative values indicate a probable bug. ++ snprintf(buf, sizeof(buf), " rcuc=%ld jiffies(starved)", j); + pr_err("\t%d-%c%c%c%c: (%lu %s) idle=%04x/%ld/%#lx softirq=%u/%u fqs=%ld%s%s\n", + cpu, + "O."[!!cpu_online(cpu)], +-- +2.43.0 + diff --git a/queue-6.6/rcu-tasks-fix-show_rcu_tasks_trace_gp_kthread-buffer.patch b/queue-6.6/rcu-tasks-fix-show_rcu_tasks_trace_gp_kthread-buffer.patch new file mode 100644 index 00000000000..1ccf4ae1f7d --- /dev/null +++ b/queue-6.6/rcu-tasks-fix-show_rcu_tasks_trace_gp_kthread-buffer.patch @@ -0,0 +1,45 @@ +From bca329814e58c45eec61e9f06fbeab1c2a22dce0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 20:47:47 +0300 +Subject: rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow + +From: Nikita Kiryushin + +[ Upstream commit cc5645fddb0ce28492b15520306d092730dffa48 ] + +There is a possibility of buffer overflow in +show_rcu_tasks_trace_gp_kthread() if counters, passed +to sprintf() are huge. Counter numbers, needed for this +are unrealistically high, but buffer overflow is still +possible. + +Use snprintf() with buffer size instead of sprintf(). + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: edf3775f0ad6 ("rcu-tasks: Add count for idle tasks on offline CPUs") +Signed-off-by: Nikita Kiryushin +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Paul E. McKenney +Signed-off-by: Uladzislau Rezki (Sony) +Signed-off-by: Sasha Levin +--- + kernel/rcu/tasks.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index 65e000ca332cc..305e960c08ac5 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -1938,7 +1938,7 @@ void show_rcu_tasks_trace_gp_kthread(void) + { + char buf[64]; + +- sprintf(buf, "N%lu h:%lu/%lu/%lu", ++ snprintf(buf, sizeof(buf), "N%lu h:%lu/%lu/%lu", + data_race(n_trc_holdouts), + data_race(n_heavy_reader_ofl_updates), + data_race(n_heavy_reader_updates), +-- +2.43.0 + diff --git a/queue-6.6/rdma-bnxt_re-adds-msn-table-capability-for-gen-p7-ad.patch b/queue-6.6/rdma-bnxt_re-adds-msn-table-capability-for-gen-p7-ad.patch new file mode 100644 index 00000000000..52aa9c2c992 --- /dev/null +++ b/queue-6.6/rdma-bnxt_re-adds-msn-table-capability-for-gen-p7-ad.patch @@ -0,0 +1,281 @@ +From b323d8c41ccc2b0fe9b81a49b2591c5f3c85e97d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 02:47:40 -0800 +Subject: RDMA/bnxt_re: Adds MSN table capability for Gen P7 adapters + +From: Selvin Xavier + +[ Upstream commit 07f830ae4913d0b986c8c0ff88a7d597948b9bd8 ] + +GenP7 HW expects an MSN table instead of PSN table. Check +for the HW retransmission capability and populate the MSN +table if HW retansmission is supported. + +Signed-off-by: Damodharam Ammepalli +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1701946060-13931-7-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: 78cfd17142ef ("bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 67 ++++++++++++++++++++-- + drivers/infiniband/hw/bnxt_re/qplib_fp.h | 14 +++++ + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 + + drivers/infiniband/hw/bnxt_re/qplib_res.h | 9 +++ + include/uapi/rdma/bnxt_re-abi.h | 1 + + 5 files changed, 87 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 48dcb14004594..b99451b3c10fc 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -980,6 +980,9 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + u32 tbl_indx; + u16 nsge; + ++ if (res->dattr) ++ qp->dev_cap_flags = res->dattr->dev_cap_flags; ++ + sq->dbinfo.flags = 0; + bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, + CMDQ_BASE_OPCODE_CREATE_QP, +@@ -995,6 +998,11 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + psn_sz = bnxt_qplib_is_chip_gen_p5(res->cctx) ? + sizeof(struct sq_psn_search_ext) : + sizeof(struct sq_psn_search); ++ ++ if (BNXT_RE_HW_RETX(qp->dev_cap_flags)) { ++ psn_sz = sizeof(struct sq_msn_search); ++ qp->msn = 0; ++ } + } + + hwq_attr.res = res; +@@ -1003,6 +1011,13 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + hwq_attr.depth = bnxt_qplib_get_depth(sq); + hwq_attr.aux_stride = psn_sz; + hwq_attr.aux_depth = bnxt_qplib_set_sq_size(sq, qp->wqe_mode); ++ /* Update msn tbl size */ ++ if (BNXT_RE_HW_RETX(qp->dev_cap_flags) && psn_sz) { ++ hwq_attr.aux_depth = roundup_pow_of_two(bnxt_qplib_set_sq_size(sq, qp->wqe_mode)); ++ qp->msn_tbl_sz = hwq_attr.aux_depth; ++ qp->msn = 0; ++ } ++ + hwq_attr.type = HWQ_TYPE_QUEUE; + rc = bnxt_qplib_alloc_init_hwq(&sq->hwq, &hwq_attr); + if (rc) +@@ -1585,6 +1600,27 @@ void *bnxt_qplib_get_qp1_rq_buf(struct bnxt_qplib_qp *qp, + return NULL; + } + ++/* Fil the MSN table into the next psn row */ ++static void bnxt_qplib_fill_msn_search(struct bnxt_qplib_qp *qp, ++ struct bnxt_qplib_swqe *wqe, ++ struct bnxt_qplib_swq *swq) ++{ ++ struct sq_msn_search *msns; ++ u32 start_psn, next_psn; ++ u16 start_idx; ++ ++ msns = (struct sq_msn_search *)swq->psn_search; ++ msns->start_idx_next_psn_start_psn = 0; ++ ++ start_psn = swq->start_psn; ++ next_psn = swq->next_psn; ++ start_idx = swq->slot_idx; ++ msns->start_idx_next_psn_start_psn |= ++ bnxt_re_update_msn_tbl(start_idx, next_psn, start_psn); ++ qp->msn++; ++ qp->msn %= qp->msn_tbl_sz; ++} ++ + static void bnxt_qplib_fill_psn_search(struct bnxt_qplib_qp *qp, + struct bnxt_qplib_swqe *wqe, + struct bnxt_qplib_swq *swq) +@@ -1596,6 +1632,12 @@ static void bnxt_qplib_fill_psn_search(struct bnxt_qplib_qp *qp, + + if (!swq->psn_search) + return; ++ /* Handle MSN differently on cap flags */ ++ if (BNXT_RE_HW_RETX(qp->dev_cap_flags)) { ++ bnxt_qplib_fill_msn_search(qp, wqe, swq); ++ return; ++ } ++ psns = (struct sq_psn_search *)swq->psn_search; + psns = swq->psn_search; + psns_ext = swq->psn_ext; + +@@ -1704,8 +1746,8 @@ static u16 bnxt_qplib_required_slots(struct bnxt_qplib_qp *qp, + return slot; + } + +-static void bnxt_qplib_pull_psn_buff(struct bnxt_qplib_q *sq, +- struct bnxt_qplib_swq *swq) ++static void bnxt_qplib_pull_psn_buff(struct bnxt_qplib_qp *qp, struct bnxt_qplib_q *sq, ++ struct bnxt_qplib_swq *swq, bool hw_retx) + { + struct bnxt_qplib_hwq *hwq; + u32 pg_num, pg_indx; +@@ -1716,6 +1758,11 @@ static void bnxt_qplib_pull_psn_buff(struct bnxt_qplib_q *sq, + if (!hwq->pad_pg) + return; + tail = swq->slot_idx / sq->dbinfo.max_slot; ++ if (hw_retx) { ++ /* For HW retx use qp msn index */ ++ tail = qp->msn; ++ tail %= qp->msn_tbl_sz; ++ } + pg_num = (tail + hwq->pad_pgofft) / (PAGE_SIZE / hwq->pad_stride); + pg_indx = (tail + hwq->pad_pgofft) % (PAGE_SIZE / hwq->pad_stride); + buff = (void *)(hwq->pad_pg[pg_num] + pg_indx * hwq->pad_stride); +@@ -1740,6 +1787,7 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, + struct bnxt_qplib_swq *swq; + bool sch_handler = false; + u16 wqe_sz, qdf = 0; ++ bool msn_update; + void *base_hdr; + void *ext_hdr; + __le32 temp32; +@@ -1767,7 +1815,7 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, + } + + swq = bnxt_qplib_get_swqe(sq, &wqe_idx); +- bnxt_qplib_pull_psn_buff(sq, swq); ++ bnxt_qplib_pull_psn_buff(qp, sq, swq, BNXT_RE_HW_RETX(qp->dev_cap_flags)); + + idx = 0; + swq->slot_idx = hwq->prod; +@@ -1799,6 +1847,8 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, + &idx); + if (data_len < 0) + goto queue_err; ++ /* Make sure we update MSN table only for wired wqes */ ++ msn_update = true; + /* Specifics */ + switch (wqe->type) { + case BNXT_QPLIB_SWQE_TYPE_SEND: +@@ -1839,6 +1889,7 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, + SQ_SEND_DST_QP_MASK); + ext_sqe->avid = cpu_to_le32(wqe->send.avid & + SQ_SEND_AVID_MASK); ++ msn_update = false; + } else { + sqe->length = cpu_to_le32(data_len); + if (qp->mtu) +@@ -1896,7 +1947,7 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, + sqe->wqe_type = wqe->type; + sqe->flags = wqe->flags; + sqe->inv_l_key = cpu_to_le32(wqe->local_inv.inv_l_key); +- ++ msn_update = false; + break; + } + case BNXT_QPLIB_SWQE_TYPE_FAST_REG_MR: +@@ -1928,6 +1979,7 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, + PTU_PTE_VALID); + ext_sqe->pblptr = cpu_to_le64(wqe->frmr.pbl_dma_ptr); + ext_sqe->va = cpu_to_le64(wqe->frmr.va); ++ msn_update = false; + + break; + } +@@ -1945,6 +1997,7 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, + sqe->l_key = cpu_to_le32(wqe->bind.r_key); + ext_sqe->va = cpu_to_le64(wqe->bind.va); + ext_sqe->length_lo = cpu_to_le32(wqe->bind.length); ++ msn_update = false; + break; + } + default: +@@ -1952,8 +2005,10 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, + rc = -EINVAL; + goto done; + } +- swq->next_psn = sq->psn & BTH_PSN_MASK; +- bnxt_qplib_fill_psn_search(qp, wqe, swq); ++ if (!BNXT_RE_HW_RETX(qp->dev_cap_flags) || msn_update) { ++ swq->next_psn = sq->psn & BTH_PSN_MASK; ++ bnxt_qplib_fill_psn_search(qp, wqe, swq); ++ } + queue_err: + bnxt_qplib_swq_mod_start(sq, wqe_idx); + bnxt_qplib_hwq_incr_prod(&sq->dbinfo, hwq, swq->slots); +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index 23c27cb429786..39156cb7b943d 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -338,6 +338,9 @@ struct bnxt_qplib_qp { + dma_addr_t rq_hdr_buf_map; + struct list_head sq_flush; + struct list_head rq_flush; ++ u32 msn; ++ u32 msn_tbl_sz; ++ u16 dev_cap_flags; + }; + + #define BNXT_QPLIB_MAX_CQE_ENTRY_SIZE sizeof(struct cq_base) +@@ -626,4 +629,15 @@ static inline u16 bnxt_qplib_calc_ilsize(struct bnxt_qplib_swqe *wqe, u16 max) + + return size; + } ++ ++/* MSN table update inlin */ ++static inline uint64_t bnxt_re_update_msn_tbl(u32 st_idx, u32 npsn, u32 start_psn) ++{ ++ return cpu_to_le64((((u64)(st_idx) << SQ_MSN_SEARCH_START_IDX_SFT) & ++ SQ_MSN_SEARCH_START_IDX_MASK) | ++ (((u64)(npsn) << SQ_MSN_SEARCH_NEXT_PSN_SFT) & ++ SQ_MSN_SEARCH_NEXT_PSN_MASK) | ++ (((start_psn) << SQ_MSN_SEARCH_START_PSN_SFT) & ++ SQ_MSN_SEARCH_START_PSN_MASK)); ++} + #endif /* __BNXT_QPLIB_FP_H__ */ +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index 15e6d2b80c700..cfa777fc01316 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -905,6 +905,8 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw, + req.max_gid_per_vf = cpu_to_le32(ctx->vf_res.max_gid_per_vf); + + skip_ctx_setup: ++ if (BNXT_RE_HW_RETX(rcfw->res->dattr->dev_cap_flags)) ++ req.flags |= CMDQ_INITIALIZE_FW_FLAGS_HW_REQUESTER_RETX_SUPPORTED; + req.stat_ctx_id = cpu_to_le32(ctx->stats.fw_id); + bnxt_qplib_fill_cmdqmsg(&msg, &req, &resp, NULL, sizeof(req), sizeof(resp), 0); + rc = bnxt_qplib_rcfw_send_message(rcfw, &msg); +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h +index 3e3383b8a9135..534db462216ac 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h +@@ -500,6 +500,15 @@ static inline bool _is_ext_stats_supported(u16 dev_cap_flags) + CREQ_QUERY_FUNC_RESP_SB_EXT_STATS; + } + ++static inline bool _is_hw_retx_supported(u16 dev_cap_flags) ++{ ++ return dev_cap_flags & ++ (CREQ_QUERY_FUNC_RESP_SB_HW_REQUESTER_RETX_ENABLED | ++ CREQ_QUERY_FUNC_RESP_SB_HW_RESPONDER_RETX_ENABLED); ++} ++ ++#define BNXT_RE_HW_RETX(a) _is_hw_retx_supported((a)) ++ + static inline u8 bnxt_qplib_dbr_pacing_en(struct bnxt_qplib_chip_ctx *cctx) + { + return cctx->modes.dbr_pacing; +diff --git a/include/uapi/rdma/bnxt_re-abi.h b/include/uapi/rdma/bnxt_re-abi.h +index a1b896d6d9405..3342276aeac13 100644 +--- a/include/uapi/rdma/bnxt_re-abi.h ++++ b/include/uapi/rdma/bnxt_re-abi.h +@@ -55,6 +55,7 @@ enum { + BNXT_RE_UCNTX_CMASK_WC_DPI_ENABLED = 0x04ULL, + BNXT_RE_UCNTX_CMASK_DBR_PACING_ENABLED = 0x08ULL, + BNXT_RE_UCNTX_CMASK_POW2_DISABLED = 0x10ULL, ++ BNXT_RE_COMP_MASK_UCNTX_HW_RETX_ENABLED = 0x40, + }; + + enum bnxt_re_wqe_mode { +-- +2.43.0 + diff --git a/queue-6.6/rdma-bnxt_re-refactor-the-queue-index-update.patch b/queue-6.6/rdma-bnxt_re-refactor-the-queue-index-update.patch new file mode 100644 index 00000000000..e78cc099731 --- /dev/null +++ b/queue-6.6/rdma-bnxt_re-refactor-the-queue-index-update.patch @@ -0,0 +1,667 @@ +From 75761a2d16722244c32aac906820387251f074a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 07:03:22 -0700 +Subject: RDMA/bnxt_re: Refactor the queue index update + +From: Chandramohan Akula + +[ Upstream commit 3a4304d82695015d0703ee0c3331458d22e3ba7c ] + +The queue index wrap around logic is based on power of 2 size depth. +All queues are created with power of 2 depth. This increases the +memory usage by the driver. This change is required for the next +patches that avoids the power of 2 depth requirement for each of +the queues. + +Update the function that increments producer index and consumer +index during wrap around. Also, changes the index handling across +multiple functions. + +Signed-off-by: Chandramohan Akula +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1698069803-1787-2-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: 78cfd17142ef ("bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 138 ++++++++++----------- + drivers/infiniband/hw/bnxt_re/qplib_fp.h | 20 ++- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 17 ++- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 4 +- + drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- + drivers/infiniband/hw/bnxt_re/qplib_res.h | 37 ++++-- + 6 files changed, 123 insertions(+), 95 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 2a62239187622..48dcb14004594 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -237,18 +237,15 @@ static void clean_nq(struct bnxt_qplib_nq *nq, struct bnxt_qplib_cq *cq) + struct bnxt_qplib_hwq *hwq = &nq->hwq; + struct nq_base *nqe, **nq_ptr; + int budget = nq->budget; +- u32 sw_cons, raw_cons; + uintptr_t q_handle; + u16 type; + + spin_lock_bh(&hwq->lock); + /* Service the NQ until empty */ +- raw_cons = hwq->cons; + while (budget--) { +- sw_cons = HWQ_CMP(raw_cons, hwq); + nq_ptr = (struct nq_base **)hwq->pbl_ptr; +- nqe = &nq_ptr[NQE_PG(sw_cons)][NQE_IDX(sw_cons)]; +- if (!NQE_CMP_VALID(nqe, raw_cons, hwq->max_elements)) ++ nqe = &nq_ptr[NQE_PG(hwq->cons)][NQE_IDX(hwq->cons)]; ++ if (!NQE_CMP_VALID(nqe, nq->nq_db.dbinfo.flags)) + break; + + /* +@@ -276,7 +273,8 @@ static void clean_nq(struct bnxt_qplib_nq *nq, struct bnxt_qplib_cq *cq) + default: + break; + } +- raw_cons++; ++ bnxt_qplib_hwq_incr_cons(hwq->max_elements, &hwq->cons, ++ 1, &nq->nq_db.dbinfo.flags); + } + spin_unlock_bh(&hwq->lock); + } +@@ -302,18 +300,16 @@ static void bnxt_qplib_service_nq(struct tasklet_struct *t) + struct bnxt_qplib_hwq *hwq = &nq->hwq; + struct bnxt_qplib_cq *cq; + int budget = nq->budget; +- u32 sw_cons, raw_cons; + struct nq_base *nqe; + uintptr_t q_handle; ++ u32 hw_polled = 0; + u16 type; + + spin_lock_bh(&hwq->lock); + /* Service the NQ until empty */ +- raw_cons = hwq->cons; + while (budget--) { +- sw_cons = HWQ_CMP(raw_cons, hwq); +- nqe = bnxt_qplib_get_qe(hwq, sw_cons, NULL); +- if (!NQE_CMP_VALID(nqe, raw_cons, hwq->max_elements)) ++ nqe = bnxt_qplib_get_qe(hwq, hwq->cons, NULL); ++ if (!NQE_CMP_VALID(nqe, nq->nq_db.dbinfo.flags)) + break; + + /* +@@ -372,12 +368,12 @@ static void bnxt_qplib_service_nq(struct tasklet_struct *t) + "nqe with type = 0x%x not handled\n", type); + break; + } +- raw_cons++; ++ hw_polled++; ++ bnxt_qplib_hwq_incr_cons(hwq->max_elements, &hwq->cons, ++ 1, &nq->nq_db.dbinfo.flags); + } +- if (hwq->cons != raw_cons) { +- hwq->cons = raw_cons; ++ if (hw_polled) + bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, nq->res->cctx, true); +- } + spin_unlock_bh(&hwq->lock); + } + +@@ -505,6 +501,7 @@ static int bnxt_qplib_map_nq_db(struct bnxt_qplib_nq *nq, u32 reg_offt) + pdev = nq->pdev; + nq_db = &nq->nq_db; + ++ nq_db->dbinfo.flags = 0; + nq_db->reg.bar_id = NQ_CONS_PCI_BAR_REGION; + nq_db->reg.bar_base = pci_resource_start(pdev, nq_db->reg.bar_id); + if (!nq_db->reg.bar_base) { +@@ -649,7 +646,7 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res, + rc = -ENOMEM; + goto fail; + } +- ++ srq->dbinfo.flags = 0; + bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, + CMDQ_BASE_OPCODE_CREATE_SRQ, + sizeof(req)); +@@ -703,13 +700,9 @@ int bnxt_qplib_modify_srq(struct bnxt_qplib_res *res, + struct bnxt_qplib_srq *srq) + { + struct bnxt_qplib_hwq *srq_hwq = &srq->hwq; +- u32 sw_prod, sw_cons, count = 0; +- +- sw_prod = HWQ_CMP(srq_hwq->prod, srq_hwq); +- sw_cons = HWQ_CMP(srq_hwq->cons, srq_hwq); ++ u32 count; + +- count = sw_prod > sw_cons ? sw_prod - sw_cons : +- srq_hwq->max_elements - sw_cons + sw_prod; ++ count = __bnxt_qplib_get_avail(srq_hwq); + if (count > srq->threshold) { + srq->arm_req = false; + bnxt_qplib_srq_arm_db(&srq->dbinfo, srq->threshold); +@@ -762,7 +755,7 @@ int bnxt_qplib_post_srq_recv(struct bnxt_qplib_srq *srq, + struct bnxt_qplib_hwq *srq_hwq = &srq->hwq; + struct rq_wqe *srqe; + struct sq_sge *hw_sge; +- u32 sw_prod, sw_cons, count = 0; ++ u32 count = 0; + int i, next; + + spin_lock(&srq_hwq->lock); +@@ -776,8 +769,7 @@ int bnxt_qplib_post_srq_recv(struct bnxt_qplib_srq *srq, + srq->start_idx = srq->swq[next].next_idx; + spin_unlock(&srq_hwq->lock); + +- sw_prod = HWQ_CMP(srq_hwq->prod, srq_hwq); +- srqe = bnxt_qplib_get_qe(srq_hwq, sw_prod, NULL); ++ srqe = bnxt_qplib_get_qe(srq_hwq, srq_hwq->prod, NULL); + memset(srqe, 0, srq->wqe_size); + /* Calculate wqe_size16 and data_len */ + for (i = 0, hw_sge = (struct sq_sge *)srqe->data; +@@ -793,17 +785,10 @@ int bnxt_qplib_post_srq_recv(struct bnxt_qplib_srq *srq, + srqe->wr_id[0] = cpu_to_le32((u32)next); + srq->swq[next].wr_id = wqe->wr_id; + +- srq_hwq->prod++; ++ bnxt_qplib_hwq_incr_prod(&srq->dbinfo, srq_hwq, srq->dbinfo.max_slot); + + spin_lock(&srq_hwq->lock); +- sw_prod = HWQ_CMP(srq_hwq->prod, srq_hwq); +- /* retaining srq_hwq->cons for this logic +- * actually the lock is only required to +- * read srq_hwq->cons. +- */ +- sw_cons = HWQ_CMP(srq_hwq->cons, srq_hwq); +- count = sw_prod > sw_cons ? sw_prod - sw_cons : +- srq_hwq->max_elements - sw_cons + sw_prod; ++ count = __bnxt_qplib_get_avail(srq_hwq); + spin_unlock(&srq_hwq->lock); + /* Ring DB */ + bnxt_qplib_ring_prod_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ); +@@ -850,6 +835,7 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + u32 tbl_indx; + int rc; + ++ sq->dbinfo.flags = 0; + bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, + CMDQ_BASE_OPCODE_CREATE_QP1, + sizeof(req)); +@@ -886,6 +872,7 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + + /* RQ */ + if (rq->max_wqe) { ++ rq->dbinfo.flags = 0; + hwq_attr.res = res; + hwq_attr.sginfo = &rq->sg_info; + hwq_attr.stride = sizeof(struct sq_sge); +@@ -993,6 +980,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + u32 tbl_indx; + u16 nsge; + ++ sq->dbinfo.flags = 0; + bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, + CMDQ_BASE_OPCODE_CREATE_QP, + sizeof(req)); +@@ -1041,6 +1029,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + + /* RQ */ + if (!qp->srq) { ++ rq->dbinfo.flags = 0; + hwq_attr.res = res; + hwq_attr.sginfo = &rq->sg_info; + hwq_attr.stride = sizeof(struct sq_sge); +@@ -1455,12 +1444,15 @@ int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + static void __clean_cq(struct bnxt_qplib_cq *cq, u64 qp) + { + struct bnxt_qplib_hwq *cq_hwq = &cq->hwq; ++ u32 peek_flags, peek_cons; + struct cq_base *hw_cqe; + int i; + ++ peek_flags = cq->dbinfo.flags; ++ peek_cons = cq_hwq->cons; + for (i = 0; i < cq_hwq->max_elements; i++) { +- hw_cqe = bnxt_qplib_get_qe(cq_hwq, i, NULL); +- if (!CQE_CMP_VALID(hw_cqe, i, cq_hwq->max_elements)) ++ hw_cqe = bnxt_qplib_get_qe(cq_hwq, peek_cons, NULL); ++ if (!CQE_CMP_VALID(hw_cqe, peek_flags)) + continue; + /* + * The valid test of the entry must be done first before +@@ -1490,6 +1482,8 @@ static void __clean_cq(struct bnxt_qplib_cq *cq, u64 qp) + default: + break; + } ++ bnxt_qplib_hwq_incr_cons(cq_hwq->max_elements, &peek_cons, ++ 1, &peek_flags); + } + } + +@@ -1962,7 +1956,7 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, + bnxt_qplib_fill_psn_search(qp, wqe, swq); + queue_err: + bnxt_qplib_swq_mod_start(sq, wqe_idx); +- bnxt_qplib_hwq_incr_prod(hwq, swq->slots); ++ bnxt_qplib_hwq_incr_prod(&sq->dbinfo, hwq, swq->slots); + qp->wqe_cnt++; + done: + if (sch_handler) { +@@ -2050,7 +2044,7 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp, + base_hdr->wr_id[0] = cpu_to_le32(wqe_idx); + queue_err: + bnxt_qplib_swq_mod_start(rq, wqe_idx); +- bnxt_qplib_hwq_incr_prod(hwq, swq->slots); ++ bnxt_qplib_hwq_incr_prod(&rq->dbinfo, hwq, swq->slots); + done: + if (sch_handler) { + nq_work = kzalloc(sizeof(*nq_work), GFP_ATOMIC); +@@ -2087,6 +2081,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq) + return -EINVAL; + } + ++ cq->dbinfo.flags = 0; + hwq_attr.res = res; + hwq_attr.depth = cq->max_wqe; + hwq_attr.stride = sizeof(struct cq_base); +@@ -2102,7 +2097,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq) + + req.dpi = cpu_to_le32(cq->dpi->dpi); + req.cq_handle = cpu_to_le64(cq->cq_handle); +- req.cq_size = cpu_to_le32(cq->hwq.max_elements); ++ req.cq_size = cpu_to_le32(cq->max_wqe); + pbl = &cq->hwq.pbl[PBL_LVL_0]; + pg_sz_lvl = (bnxt_qplib_base_pg_size(&cq->hwq) << + CMDQ_CREATE_CQ_PG_SIZE_SFT); +@@ -2145,6 +2140,8 @@ void bnxt_qplib_resize_cq_complete(struct bnxt_qplib_res *res, + { + bnxt_qplib_free_hwq(res, &cq->hwq); + memcpy(&cq->hwq, &cq->resize_hwq, sizeof(cq->hwq)); ++ /* Reset only the cons bit in the flags */ ++ cq->dbinfo.flags &= ~(1UL << BNXT_QPLIB_FLAG_EPOCH_CONS_SHIFT); + } + + int bnxt_qplib_resize_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq, +@@ -2241,7 +2238,8 @@ static int __flush_sq(struct bnxt_qplib_q *sq, struct bnxt_qplib_qp *qp, + cqe++; + (*budget)--; + skip_compl: +- bnxt_qplib_hwq_incr_cons(&sq->hwq, sq->swq[last].slots); ++ bnxt_qplib_hwq_incr_cons(sq->hwq.max_elements, &sq->hwq.cons, ++ sq->swq[last].slots, &sq->dbinfo.flags); + sq->swq_last = sq->swq[last].next_idx; + } + *pcqe = cqe; +@@ -2288,7 +2286,8 @@ static int __flush_rq(struct bnxt_qplib_q *rq, struct bnxt_qplib_qp *qp, + cqe->wr_id = rq->swq[last].wr_id; + cqe++; + (*budget)--; +- bnxt_qplib_hwq_incr_cons(&rq->hwq, rq->swq[last].slots); ++ bnxt_qplib_hwq_incr_cons(rq->hwq.max_elements, &rq->hwq.cons, ++ rq->swq[last].slots, &rq->dbinfo.flags); + rq->swq_last = rq->swq[last].next_idx; + } + *pcqe = cqe; +@@ -2317,7 +2316,7 @@ void bnxt_qplib_mark_qp_error(void *qp_handle) + static int do_wa9060(struct bnxt_qplib_qp *qp, struct bnxt_qplib_cq *cq, + u32 cq_cons, u32 swq_last, u32 cqe_sq_cons) + { +- u32 peek_sw_cq_cons, peek_raw_cq_cons, peek_sq_cons_idx; ++ u32 peek_sw_cq_cons, peek_sq_cons_idx, peek_flags; + struct bnxt_qplib_q *sq = &qp->sq; + struct cq_req *peek_req_hwcqe; + struct bnxt_qplib_qp *peek_qp; +@@ -2348,16 +2347,14 @@ static int do_wa9060(struct bnxt_qplib_qp *qp, struct bnxt_qplib_cq *cq, + } + if (sq->condition) { + /* Peek at the completions */ +- peek_raw_cq_cons = cq->hwq.cons; ++ peek_flags = cq->dbinfo.flags; + peek_sw_cq_cons = cq_cons; + i = cq->hwq.max_elements; + while (i--) { +- peek_sw_cq_cons = HWQ_CMP((peek_sw_cq_cons), &cq->hwq); + peek_hwcqe = bnxt_qplib_get_qe(&cq->hwq, + peek_sw_cq_cons, NULL); + /* If the next hwcqe is VALID */ +- if (CQE_CMP_VALID(peek_hwcqe, peek_raw_cq_cons, +- cq->hwq.max_elements)) { ++ if (CQE_CMP_VALID(peek_hwcqe, peek_flags)) { + /* + * The valid test of the entry must be done first before + * reading any further. +@@ -2400,8 +2397,9 @@ static int do_wa9060(struct bnxt_qplib_qp *qp, struct bnxt_qplib_cq *cq, + rc = -EINVAL; + goto out; + } +- peek_sw_cq_cons++; +- peek_raw_cq_cons++; ++ bnxt_qplib_hwq_incr_cons(cq->hwq.max_elements, ++ &peek_sw_cq_cons, ++ 1, &peek_flags); + } + dev_err(&cq->hwq.pdev->dev, + "Should not have come here! cq_cons=0x%x qp=0x%x sq cons sw=0x%x hw=0x%x\n", +@@ -2488,7 +2486,8 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq, + } + } + skip: +- bnxt_qplib_hwq_incr_cons(&sq->hwq, swq->slots); ++ bnxt_qplib_hwq_incr_cons(sq->hwq.max_elements, &sq->hwq.cons, ++ swq->slots, &sq->dbinfo.flags); + sq->swq_last = swq->next_idx; + if (sq->single) + break; +@@ -2515,7 +2514,8 @@ static void bnxt_qplib_release_srqe(struct bnxt_qplib_srq *srq, u32 tag) + srq->swq[srq->last_idx].next_idx = (int)tag; + srq->last_idx = (int)tag; + srq->swq[srq->last_idx].next_idx = -1; +- srq->hwq.cons++; /* Support for SRQE counter */ ++ bnxt_qplib_hwq_incr_cons(srq->hwq.max_elements, &srq->hwq.cons, ++ srq->dbinfo.max_slot, &srq->dbinfo.flags); + spin_unlock(&srq->hwq.lock); + } + +@@ -2584,7 +2584,8 @@ static int bnxt_qplib_cq_process_res_rc(struct bnxt_qplib_cq *cq, + cqe->wr_id = swq->wr_id; + cqe++; + (*budget)--; +- bnxt_qplib_hwq_incr_cons(&rq->hwq, swq->slots); ++ bnxt_qplib_hwq_incr_cons(rq->hwq.max_elements, &rq->hwq.cons, ++ swq->slots, &rq->dbinfo.flags); + rq->swq_last = swq->next_idx; + *pcqe = cqe; + +@@ -2670,7 +2671,8 @@ static int bnxt_qplib_cq_process_res_ud(struct bnxt_qplib_cq *cq, + cqe->wr_id = swq->wr_id; + cqe++; + (*budget)--; +- bnxt_qplib_hwq_incr_cons(&rq->hwq, swq->slots); ++ bnxt_qplib_hwq_incr_cons(rq->hwq.max_elements, &rq->hwq.cons, ++ swq->slots, &rq->dbinfo.flags); + rq->swq_last = swq->next_idx; + *pcqe = cqe; + +@@ -2687,14 +2689,11 @@ static int bnxt_qplib_cq_process_res_ud(struct bnxt_qplib_cq *cq, + bool bnxt_qplib_is_cq_empty(struct bnxt_qplib_cq *cq) + { + struct cq_base *hw_cqe; +- u32 sw_cons, raw_cons; + bool rc = true; + +- raw_cons = cq->hwq.cons; +- sw_cons = HWQ_CMP(raw_cons, &cq->hwq); +- hw_cqe = bnxt_qplib_get_qe(&cq->hwq, sw_cons, NULL); ++ hw_cqe = bnxt_qplib_get_qe(&cq->hwq, cq->hwq.cons, NULL); + /* Check for Valid bit. If the CQE is valid, return false */ +- rc = !CQE_CMP_VALID(hw_cqe, raw_cons, cq->hwq.max_elements); ++ rc = !CQE_CMP_VALID(hw_cqe, cq->dbinfo.flags); + return rc; + } + +@@ -2776,7 +2775,8 @@ static int bnxt_qplib_cq_process_res_raweth_qp1(struct bnxt_qplib_cq *cq, + cqe->wr_id = swq->wr_id; + cqe++; + (*budget)--; +- bnxt_qplib_hwq_incr_cons(&rq->hwq, swq->slots); ++ bnxt_qplib_hwq_incr_cons(rq->hwq.max_elements, &rq->hwq.cons, ++ swq->slots, &rq->dbinfo.flags); + rq->swq_last = swq->next_idx; + *pcqe = cqe; + +@@ -2849,7 +2849,8 @@ static int bnxt_qplib_cq_process_terminal(struct bnxt_qplib_cq *cq, + cqe++; + (*budget)--; + } +- bnxt_qplib_hwq_incr_cons(&sq->hwq, sq->swq[swq_last].slots); ++ bnxt_qplib_hwq_incr_cons(sq->hwq.max_elements, &sq->hwq.cons, ++ sq->swq[swq_last].slots, &sq->dbinfo.flags); + sq->swq_last = sq->swq[swq_last].next_idx; + } + *pcqe = cqe; +@@ -2934,19 +2935,17 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe, + int num_cqes, struct bnxt_qplib_qp **lib_qp) + { + struct cq_base *hw_cqe; +- u32 sw_cons, raw_cons; + int budget, rc = 0; ++ u32 hw_polled = 0; + u8 type; + +- raw_cons = cq->hwq.cons; + budget = num_cqes; + + while (budget) { +- sw_cons = HWQ_CMP(raw_cons, &cq->hwq); +- hw_cqe = bnxt_qplib_get_qe(&cq->hwq, sw_cons, NULL); ++ hw_cqe = bnxt_qplib_get_qe(&cq->hwq, cq->hwq.cons, NULL); + + /* Check for Valid bit */ +- if (!CQE_CMP_VALID(hw_cqe, raw_cons, cq->hwq.max_elements)) ++ if (!CQE_CMP_VALID(hw_cqe, cq->dbinfo.flags)) + break; + + /* +@@ -2961,7 +2960,7 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe, + rc = bnxt_qplib_cq_process_req(cq, + (struct cq_req *)hw_cqe, + &cqe, &budget, +- sw_cons, lib_qp); ++ cq->hwq.cons, lib_qp); + break; + case CQ_BASE_CQE_TYPE_RES_RC: + rc = bnxt_qplib_cq_process_res_rc(cq, +@@ -3007,12 +3006,13 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe, + dev_err(&cq->hwq.pdev->dev, + "process_cqe error rc = 0x%x\n", rc); + } +- raw_cons++; ++ hw_polled++; ++ bnxt_qplib_hwq_incr_cons(cq->hwq.max_elements, &cq->hwq.cons, ++ 1, &cq->dbinfo.flags); ++ + } +- if (cq->hwq.cons != raw_cons) { +- cq->hwq.cons = raw_cons; ++ if (hw_polled) + bnxt_qplib_ring_db(&cq->dbinfo, DBC_DBC_TYPE_CQ); +- } + exit: + return num_cqes - budget; + } +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index 404b851091ca2..23c27cb429786 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -348,9 +348,21 @@ struct bnxt_qplib_qp { + #define CQE_IDX(x) ((x) & CQE_MAX_IDX_PER_PG) + + #define ROCE_CQE_CMP_V 0 +-#define CQE_CMP_VALID(hdr, raw_cons, cp_bit) \ ++#define CQE_CMP_VALID(hdr, pass) \ + (!!((hdr)->cqe_type_toggle & CQ_BASE_TOGGLE) == \ +- !((raw_cons) & (cp_bit))) ++ !((pass) & BNXT_QPLIB_FLAG_EPOCH_CONS_MASK)) ++ ++static inline u32 __bnxt_qplib_get_avail(struct bnxt_qplib_hwq *hwq) ++{ ++ int cons, prod, avail; ++ ++ cons = hwq->cons; ++ prod = hwq->prod; ++ avail = cons - prod; ++ if (cons <= prod) ++ avail += hwq->depth; ++ return avail; ++} + + static inline bool bnxt_qplib_queue_full(struct bnxt_qplib_q *que, + u8 slots) +@@ -443,9 +455,9 @@ struct bnxt_qplib_cq { + #define NQE_PG(x) (((x) & ~NQE_MAX_IDX_PER_PG) / NQE_CNT_PER_PG) + #define NQE_IDX(x) ((x) & NQE_MAX_IDX_PER_PG) + +-#define NQE_CMP_VALID(hdr, raw_cons, cp_bit) \ ++#define NQE_CMP_VALID(hdr, pass) \ + (!!(le32_to_cpu((hdr)->info63_v[0]) & NQ_BASE_V) == \ +- !((raw_cons) & (cp_bit))) ++ !((pass) & BNXT_QPLIB_FLAG_EPOCH_CONS_MASK)) + + #define BNXT_QPLIB_NQE_MAX_CNT (128 * 1024) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index e47b4ca64d33e..15e6d2b80c700 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -734,17 +734,15 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t) + u32 type, budget = CREQ_ENTRY_POLL_BUDGET; + struct bnxt_qplib_hwq *hwq = &creq->hwq; + struct creq_base *creqe; +- u32 sw_cons, raw_cons; + unsigned long flags; + u32 num_wakeup = 0; ++ u32 hw_polled = 0; + + /* Service the CREQ until budget is over */ + spin_lock_irqsave(&hwq->lock, flags); +- raw_cons = hwq->cons; + while (budget > 0) { +- sw_cons = HWQ_CMP(raw_cons, hwq); +- creqe = bnxt_qplib_get_qe(hwq, sw_cons, NULL); +- if (!CREQ_CMP_VALID(creqe, raw_cons, hwq->max_elements)) ++ creqe = bnxt_qplib_get_qe(hwq, hwq->cons, NULL); ++ if (!CREQ_CMP_VALID(creqe, creq->creq_db.dbinfo.flags)) + break; + /* The valid test of the entry must be done first before + * reading any further. +@@ -775,15 +773,15 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t) + type); + break; + } +- raw_cons++; + budget--; ++ hw_polled++; ++ bnxt_qplib_hwq_incr_cons(hwq->max_elements, &hwq->cons, ++ 1, &creq->creq_db.dbinfo.flags); + } + +- if (hwq->cons != raw_cons) { +- hwq->cons = raw_cons; ++ if (hw_polled) + bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, + rcfw->res->cctx, true); +- } + spin_unlock_irqrestore(&hwq->lock, flags); + if (num_wakeup) + wake_up_nr(&rcfw->cmdq.waitq, num_wakeup); +@@ -1113,6 +1111,7 @@ static int bnxt_qplib_map_creq_db(struct bnxt_qplib_rcfw *rcfw, u32 reg_offt) + pdev = rcfw->pdev; + creq_db = &rcfw->creq.creq_db; + ++ creq_db->dbinfo.flags = 0; + creq_db->reg.bar_id = RCFW_COMM_CONS_PCI_BAR_REGION; + creq_db->reg.bar_base = pci_resource_start(pdev, creq_db->reg.bar_id); + if (!creq_db->reg.bar_id) +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +index 7b31bee3e0005..45996e60a0d03 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +@@ -141,9 +141,9 @@ struct bnxt_qplib_crsbe { + /* Allocate 1 per QP for async error notification for now */ + #define BNXT_QPLIB_CREQE_MAX_CNT (64 * 1024) + #define BNXT_QPLIB_CREQE_UNITS 16 /* 16-Bytes per prod unit */ +-#define CREQ_CMP_VALID(hdr, raw_cons, cp_bit) \ ++#define CREQ_CMP_VALID(hdr, pass) \ + (!!((hdr)->v & CREQ_BASE_V) == \ +- !((raw_cons) & (cp_bit))) ++ !((pass) & BNXT_QPLIB_FLAG_EPOCH_CONS_MASK)) + #define CREQ_ENTRY_POLL_BUDGET 0x100 + + /* HWQ */ +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c +index 157db6b7e1193..ae2bde34e785b 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c +@@ -343,7 +343,7 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq, + hwq->cons = 0; + hwq->pdev = pdev; + hwq->depth = hwq_attr->depth; +- hwq->max_elements = depth; ++ hwq->max_elements = hwq->depth; + hwq->element_size = stride; + hwq->qe_ppg = pg_size / stride; + /* For direct access to the elements */ +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h +index 5949f004f7856..3e3383b8a9135 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h +@@ -186,6 +186,14 @@ struct bnxt_qplib_db_info { + struct bnxt_qplib_hwq *hwq; + u32 xid; + u32 max_slot; ++ u32 flags; ++}; ++ ++enum bnxt_qplib_db_info_flags_mask { ++ BNXT_QPLIB_FLAG_EPOCH_CONS_SHIFT = 0x0UL, ++ BNXT_QPLIB_FLAG_EPOCH_PROD_SHIFT = 0x1UL, ++ BNXT_QPLIB_FLAG_EPOCH_CONS_MASK = 0x1UL, ++ BNXT_QPLIB_FLAG_EPOCH_PROD_MASK = 0x2UL, + }; + + /* Tables */ +@@ -396,24 +404,34 @@ void bnxt_qplib_unmap_db_bar(struct bnxt_qplib_res *res); + + int bnxt_qplib_determine_atomics(struct pci_dev *dev); + +-static inline void bnxt_qplib_hwq_incr_prod(struct bnxt_qplib_hwq *hwq, u32 cnt) ++static inline void bnxt_qplib_hwq_incr_prod(struct bnxt_qplib_db_info *dbinfo, ++ struct bnxt_qplib_hwq *hwq, u32 cnt) + { +- hwq->prod = (hwq->prod + cnt) % hwq->depth; ++ /* move prod and update toggle/epoch if wrap around */ ++ hwq->prod += cnt; ++ if (hwq->prod >= hwq->depth) { ++ hwq->prod %= hwq->depth; ++ dbinfo->flags ^= 1UL << BNXT_QPLIB_FLAG_EPOCH_PROD_SHIFT; ++ } + } + +-static inline void bnxt_qplib_hwq_incr_cons(struct bnxt_qplib_hwq *hwq, +- u32 cnt) ++static inline void bnxt_qplib_hwq_incr_cons(u32 max_elements, u32 *cons, u32 cnt, ++ u32 *dbinfo_flags) + { +- hwq->cons = (hwq->cons + cnt) % hwq->depth; ++ /* move cons and update toggle/epoch if wrap around */ ++ *cons += cnt; ++ if (*cons >= max_elements) { ++ *cons %= max_elements; ++ *dbinfo_flags ^= 1UL << BNXT_QPLIB_FLAG_EPOCH_CONS_SHIFT; ++ } + } + + static inline void bnxt_qplib_ring_db32(struct bnxt_qplib_db_info *info, + bool arm) + { +- u32 key; ++ u32 key = 0; + +- key = info->hwq->cons & (info->hwq->max_elements - 1); +- key |= (CMPL_DOORBELL_IDX_VALID | ++ key |= info->hwq->cons | (CMPL_DOORBELL_IDX_VALID | + (CMPL_DOORBELL_KEY_CMPL & CMPL_DOORBELL_KEY_MASK)); + if (!arm) + key |= CMPL_DOORBELL_MASK; +@@ -427,8 +445,7 @@ static inline void bnxt_qplib_ring_db(struct bnxt_qplib_db_info *info, + + key = (info->xid & DBC_DBC_XID_MASK) | DBC_DBC_PATH_ROCE | type; + key <<= 32; +- key |= (info->hwq->cons & (info->hwq->max_elements - 1)) & +- DBC_DBC_INDEX_MASK; ++ key |= (info->hwq->cons & DBC_DBC_INDEX_MASK); + writeq(key, info->db); + } + +-- +2.43.0 + diff --git a/queue-6.6/rdma-bnxt_re-remove-roundup_pow_of_two-depth-for-all.patch b/queue-6.6/rdma-bnxt_re-remove-roundup_pow_of_two-depth-for-all.patch new file mode 100644 index 00000000000..69b21e81612 --- /dev/null +++ b/queue-6.6/rdma-bnxt_re-remove-roundup_pow_of_two-depth-for-all.patch @@ -0,0 +1,305 @@ +From 5bdaa8258ea157cd256162eb42ca548a0b4b0617 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 07:03:23 -0700 +Subject: RDMA/bnxt_re: Remove roundup_pow_of_two depth for all hardware queue + resources + +From: Chandramohan Akula + +[ Upstream commit 48f996d4adf15a0a0af8b8184d3ec6042a684ea4 ] + +Rounding up the queue depth to power of two is not a hardware requirement. +In order to optimize the per connection memory usage, removing drivers +implementation which round up to the queue depths to the power of 2. + +Implements a mask to maintain backward compatibility with older +library. + +Signed-off-by: Chandramohan Akula +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1698069803-1787-3-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: 78cfd17142ef ("bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 57 ++++++++++++++++-------- + drivers/infiniband/hw/bnxt_re/ib_verbs.h | 7 +++ + include/uapi/rdma/bnxt_re-abi.h | 9 ++++ + 3 files changed, 54 insertions(+), 19 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index cc466dfd792b0..fd69be982ce06 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1184,7 +1184,8 @@ static struct bnxt_re_qp *bnxt_re_create_shadow_qp + } + + static int bnxt_re_init_rq_attr(struct bnxt_re_qp *qp, +- struct ib_qp_init_attr *init_attr) ++ struct ib_qp_init_attr *init_attr, ++ struct bnxt_re_ucontext *uctx) + { + struct bnxt_qplib_dev_attr *dev_attr; + struct bnxt_qplib_qp *qplqp; +@@ -1213,7 +1214,7 @@ static int bnxt_re_init_rq_attr(struct bnxt_re_qp *qp, + /* Allocate 1 more than what's provided so posting max doesn't + * mean empty. + */ +- entries = roundup_pow_of_two(init_attr->cap.max_recv_wr + 1); ++ entries = bnxt_re_init_depth(init_attr->cap.max_recv_wr + 1, uctx); + rq->max_wqe = min_t(u32, entries, dev_attr->max_qp_wqes + 1); + rq->q_full_delta = 0; + rq->sg_info.pgsize = PAGE_SIZE; +@@ -1243,7 +1244,7 @@ static void bnxt_re_adjust_gsi_rq_attr(struct bnxt_re_qp *qp) + + static int bnxt_re_init_sq_attr(struct bnxt_re_qp *qp, + struct ib_qp_init_attr *init_attr, +- struct ib_udata *udata) ++ struct bnxt_re_ucontext *uctx) + { + struct bnxt_qplib_dev_attr *dev_attr; + struct bnxt_qplib_qp *qplqp; +@@ -1272,7 +1273,7 @@ static int bnxt_re_init_sq_attr(struct bnxt_re_qp *qp, + /* Allocate 128 + 1 more than what's provided */ + diff = (qplqp->wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE) ? + 0 : BNXT_QPLIB_RESERVED_QP_WRS; +- entries = roundup_pow_of_two(entries + diff + 1); ++ entries = bnxt_re_init_depth(entries + diff + 1, uctx); + sq->max_wqe = min_t(u32, entries, dev_attr->max_qp_wqes + diff + 1); + sq->q_full_delta = diff + 1; + /* +@@ -1288,7 +1289,8 @@ static int bnxt_re_init_sq_attr(struct bnxt_re_qp *qp, + } + + static void bnxt_re_adjust_gsi_sq_attr(struct bnxt_re_qp *qp, +- struct ib_qp_init_attr *init_attr) ++ struct ib_qp_init_attr *init_attr, ++ struct bnxt_re_ucontext *uctx) + { + struct bnxt_qplib_dev_attr *dev_attr; + struct bnxt_qplib_qp *qplqp; +@@ -1300,7 +1302,7 @@ static void bnxt_re_adjust_gsi_sq_attr(struct bnxt_re_qp *qp, + dev_attr = &rdev->dev_attr; + + if (!bnxt_qplib_is_chip_gen_p5(rdev->chip_ctx)) { +- entries = roundup_pow_of_two(init_attr->cap.max_send_wr + 1); ++ entries = bnxt_re_init_depth(init_attr->cap.max_send_wr + 1, uctx); + qplqp->sq.max_wqe = min_t(u32, entries, + dev_attr->max_qp_wqes + 1); + qplqp->sq.q_full_delta = qplqp->sq.max_wqe - +@@ -1338,6 +1340,7 @@ static int bnxt_re_init_qp_attr(struct bnxt_re_qp *qp, struct bnxt_re_pd *pd, + struct ib_udata *udata) + { + struct bnxt_qplib_dev_attr *dev_attr; ++ struct bnxt_re_ucontext *uctx; + struct bnxt_qplib_qp *qplqp; + struct bnxt_re_dev *rdev; + struct bnxt_re_cq *cq; +@@ -1347,6 +1350,7 @@ static int bnxt_re_init_qp_attr(struct bnxt_re_qp *qp, struct bnxt_re_pd *pd, + qplqp = &qp->qplib_qp; + dev_attr = &rdev->dev_attr; + ++ uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx); + /* Setup misc params */ + ether_addr_copy(qplqp->smac, rdev->netdev->dev_addr); + qplqp->pd = &pd->qplib_pd; +@@ -1388,18 +1392,18 @@ static int bnxt_re_init_qp_attr(struct bnxt_re_qp *qp, struct bnxt_re_pd *pd, + } + + /* Setup RQ/SRQ */ +- rc = bnxt_re_init_rq_attr(qp, init_attr); ++ rc = bnxt_re_init_rq_attr(qp, init_attr, uctx); + if (rc) + goto out; + if (init_attr->qp_type == IB_QPT_GSI) + bnxt_re_adjust_gsi_rq_attr(qp); + + /* Setup SQ */ +- rc = bnxt_re_init_sq_attr(qp, init_attr, udata); ++ rc = bnxt_re_init_sq_attr(qp, init_attr, uctx); + if (rc) + goto out; + if (init_attr->qp_type == IB_QPT_GSI) +- bnxt_re_adjust_gsi_sq_attr(qp, init_attr); ++ bnxt_re_adjust_gsi_sq_attr(qp, init_attr, uctx); + + if (udata) /* This will update DPI and qp_handle */ + rc = bnxt_re_init_user_qp(rdev, pd, qp, udata); +@@ -1715,6 +1719,7 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, + { + struct bnxt_qplib_dev_attr *dev_attr; + struct bnxt_qplib_nq *nq = NULL; ++ struct bnxt_re_ucontext *uctx; + struct bnxt_re_dev *rdev; + struct bnxt_re_srq *srq; + struct bnxt_re_pd *pd; +@@ -1739,13 +1744,14 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, + goto exit; + } + ++ uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx); + srq->rdev = rdev; + srq->qplib_srq.pd = &pd->qplib_pd; + srq->qplib_srq.dpi = &rdev->dpi_privileged; + /* Allocate 1 more than what's provided so posting max doesn't + * mean empty + */ +- entries = roundup_pow_of_two(srq_init_attr->attr.max_wr + 1); ++ entries = bnxt_re_init_depth(srq_init_attr->attr.max_wr + 1, uctx); + if (entries > dev_attr->max_srq_wqes + 1) + entries = dev_attr->max_srq_wqes + 1; + srq->qplib_srq.max_wqe = entries; +@@ -2102,6 +2108,9 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, + qp->qplib_qp.max_dest_rd_atomic = qp_attr->max_dest_rd_atomic; + } + if (qp_attr_mask & IB_QP_CAP) { ++ struct bnxt_re_ucontext *uctx = ++ rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx); ++ + qp->qplib_qp.modify_flags |= + CMDQ_MODIFY_QP_MODIFY_MASK_SQ_SIZE | + CMDQ_MODIFY_QP_MODIFY_MASK_RQ_SIZE | +@@ -2118,7 +2127,7 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, + "Create QP failed - max exceeded"); + return -EINVAL; + } +- entries = roundup_pow_of_two(qp_attr->cap.max_send_wr); ++ entries = bnxt_re_init_depth(qp_attr->cap.max_send_wr, uctx); + qp->qplib_qp.sq.max_wqe = min_t(u32, entries, + dev_attr->max_qp_wqes + 1); + qp->qplib_qp.sq.q_full_delta = qp->qplib_qp.sq.max_wqe - +@@ -2131,7 +2140,7 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, + qp->qplib_qp.sq.q_full_delta -= 1; + qp->qplib_qp.sq.max_sge = qp_attr->cap.max_send_sge; + if (qp->qplib_qp.rq.max_wqe) { +- entries = roundup_pow_of_two(qp_attr->cap.max_recv_wr); ++ entries = bnxt_re_init_depth(qp_attr->cap.max_recv_wr, uctx); + qp->qplib_qp.rq.max_wqe = + min_t(u32, entries, dev_attr->max_qp_wqes + 1); + qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe - +@@ -2919,9 +2928,11 @@ int bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata) + { ++ struct bnxt_re_cq *cq = container_of(ibcq, struct bnxt_re_cq, ib_cq); + struct bnxt_re_dev *rdev = to_bnxt_re_dev(ibcq->device, ibdev); ++ struct bnxt_re_ucontext *uctx = ++ rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx); + struct bnxt_qplib_dev_attr *dev_attr = &rdev->dev_attr; +- struct bnxt_re_cq *cq = container_of(ibcq, struct bnxt_re_cq, ib_cq); + int rc, entries; + int cqe = attr->cqe; + struct bnxt_qplib_nq *nq = NULL; +@@ -2940,7 +2951,7 @@ int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + cq->rdev = rdev; + cq->qplib_cq.cq_handle = (u64)(unsigned long)(&cq->qplib_cq); + +- entries = roundup_pow_of_two(cqe + 1); ++ entries = bnxt_re_init_depth(cqe + 1, uctx); + if (entries > dev_attr->max_cq_wqes + 1) + entries = dev_attr->max_cq_wqes + 1; + +@@ -2948,8 +2959,6 @@ int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + cq->qplib_cq.sg_info.pgshft = PAGE_SHIFT; + if (udata) { + struct bnxt_re_cq_req req; +- struct bnxt_re_ucontext *uctx = rdma_udata_to_drv_context( +- udata, struct bnxt_re_ucontext, ib_uctx); + if (ib_copy_from_udata(&req, udata, sizeof(req))) { + rc = -EFAULT; + goto fail; +@@ -3071,12 +3080,11 @@ int bnxt_re_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) + return -EINVAL; + } + +- entries = roundup_pow_of_two(cqe + 1); ++ uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx); ++ entries = bnxt_re_init_depth(cqe + 1, uctx); + if (entries > dev_attr->max_cq_wqes + 1) + entries = dev_attr->max_cq_wqes + 1; + +- uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, +- ib_uctx); + /* uverbs consumer */ + if (ib_copy_from_udata(&req, udata, sizeof(req))) { + rc = -EFAULT; +@@ -4107,6 +4115,7 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata) + struct bnxt_qplib_dev_attr *dev_attr = &rdev->dev_attr; + struct bnxt_re_user_mmap_entry *entry; + struct bnxt_re_uctx_resp resp = {}; ++ struct bnxt_re_uctx_req ureq = {}; + u32 chip_met_rev_num = 0; + int rc; + +@@ -4156,6 +4165,16 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata) + if (rdev->pacing.dbr_pacing) + resp.comp_mask |= BNXT_RE_UCNTX_CMASK_DBR_PACING_ENABLED; + ++ if (udata->inlen >= sizeof(ureq)) { ++ rc = ib_copy_from_udata(&ureq, udata, min(udata->inlen, sizeof(ureq))); ++ if (rc) ++ goto cfail; ++ if (ureq.comp_mask & BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT) { ++ resp.comp_mask |= BNXT_RE_UCNTX_CMASK_POW2_DISABLED; ++ uctx->cmask |= BNXT_RE_UCNTX_CMASK_POW2_DISABLED; ++ } ++ } ++ + rc = ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp))); + if (rc) { + ibdev_err(ibdev, "Failed to copy user context"); +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h +index 84715b7e7a4e4..98baea98fc176 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h +@@ -140,6 +140,7 @@ struct bnxt_re_ucontext { + void *shpg; + spinlock_t sh_lock; /* protect shpg */ + struct rdma_user_mmap_entry *shpage_mmap; ++ u64 cmask; + }; + + enum bnxt_re_mmap_flag { +@@ -167,6 +168,12 @@ static inline u16 bnxt_re_get_rwqe_size(int nsge) + return sizeof(struct rq_wqe_hdr) + (nsge * sizeof(struct sq_sge)); + } + ++static inline u32 bnxt_re_init_depth(u32 ent, struct bnxt_re_ucontext *uctx) ++{ ++ return uctx ? (uctx->cmask & BNXT_RE_UCNTX_CMASK_POW2_DISABLED) ? ++ ent : roundup_pow_of_two(ent) : ent; ++} ++ + int bnxt_re_query_device(struct ib_device *ibdev, + struct ib_device_attr *ib_attr, + struct ib_udata *udata); +diff --git a/include/uapi/rdma/bnxt_re-abi.h b/include/uapi/rdma/bnxt_re-abi.h +index 6e7c67a0cca3a..a1b896d6d9405 100644 +--- a/include/uapi/rdma/bnxt_re-abi.h ++++ b/include/uapi/rdma/bnxt_re-abi.h +@@ -54,6 +54,7 @@ enum { + BNXT_RE_UCNTX_CMASK_HAVE_MODE = 0x02ULL, + BNXT_RE_UCNTX_CMASK_WC_DPI_ENABLED = 0x04ULL, + BNXT_RE_UCNTX_CMASK_DBR_PACING_ENABLED = 0x08ULL, ++ BNXT_RE_UCNTX_CMASK_POW2_DISABLED = 0x10ULL, + }; + + enum bnxt_re_wqe_mode { +@@ -62,6 +63,14 @@ enum bnxt_re_wqe_mode { + BNXT_QPLIB_WQE_MODE_INVALID = 0x02, + }; + ++enum { ++ BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT = 0x01, ++}; ++ ++struct bnxt_re_uctx_req { ++ __aligned_u64 comp_mask; ++}; ++ + struct bnxt_re_uctx_resp { + __u32 dev_id; + __u32 max_qp; +-- +2.43.0 + diff --git a/queue-6.6/rdma-bnxt_re-update-the-hw-interface-definitions.patch b/queue-6.6/rdma-bnxt_re-update-the-hw-interface-definitions.patch new file mode 100644 index 00000000000..ae5fbc1257e --- /dev/null +++ b/queue-6.6/rdma-bnxt_re-update-the-hw-interface-definitions.patch @@ -0,0 +1,150 @@ +From e14dd3ddb77c87861a98ebd15aaf4f20e581f96b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 02:47:37 -0800 +Subject: RDMA/bnxt_re: Update the HW interface definitions + +From: Selvin Xavier + +[ Upstream commit 880a5dd1880a296575e92dec9816a7f35a7011d1 ] + +Adds HW interface definitions to support the new +chip revision. + +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1701946060-13931-4-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: 78cfd17142ef ("bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/roce_hsi.h | 67 ++++++++++++++++++++---- + 1 file changed, 57 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/roce_hsi.h b/drivers/infiniband/hw/bnxt_re/roce_hsi.h +index 4a10303e03925..2909608f4b5de 100644 +--- a/drivers/infiniband/hw/bnxt_re/roce_hsi.h ++++ b/drivers/infiniband/hw/bnxt_re/roce_hsi.h +@@ -555,7 +555,12 @@ struct cmdq_modify_qp { + __le16 flags; + __le16 cookie; + u8 resp_size; +- u8 reserved8; ++ u8 qp_type; ++ #define CMDQ_MODIFY_QP_QP_TYPE_RC 0x2UL ++ #define CMDQ_MODIFY_QP_QP_TYPE_UD 0x4UL ++ #define CMDQ_MODIFY_QP_QP_TYPE_RAW_ETHERTYPE 0x6UL ++ #define CMDQ_MODIFY_QP_QP_TYPE_GSI 0x7UL ++ #define CMDQ_MODIFY_QP_QP_TYPE_LAST CMDQ_MODIFY_QP_QP_TYPE_GSI + __le64 resp_addr; + __le32 modify_mask; + #define CMDQ_MODIFY_QP_MODIFY_MASK_STATE 0x1UL +@@ -611,14 +616,12 @@ struct cmdq_modify_qp { + #define CMDQ_MODIFY_QP_NETWORK_TYPE_ROCEV2_IPV6 (0x3UL << 6) + #define CMDQ_MODIFY_QP_NETWORK_TYPE_LAST CMDQ_MODIFY_QP_NETWORK_TYPE_ROCEV2_IPV6 + u8 access; +- #define CMDQ_MODIFY_QP_ACCESS_REMOTE_ATOMIC_REMOTE_READ_REMOTE_WRITE_LOCAL_WRITE_MASK \ +- 0xffUL +- #define CMDQ_MODIFY_QP_ACCESS_REMOTE_ATOMIC_REMOTE_READ_REMOTE_WRITE_LOCAL_WRITE_SFT \ +- 0 +- #define CMDQ_MODIFY_QP_ACCESS_LOCAL_WRITE 0x1UL +- #define CMDQ_MODIFY_QP_ACCESS_REMOTE_WRITE 0x2UL +- #define CMDQ_MODIFY_QP_ACCESS_REMOTE_READ 0x4UL +- #define CMDQ_MODIFY_QP_ACCESS_REMOTE_ATOMIC 0x8UL ++ #define CMDQ_MODIFY_QP_ACCESS_REMOTE_ATOMIC_REMOTE_READ_REMOTE_WRITE_LOCAL_WRITE_MASK 0xffUL ++ #define CMDQ_MODIFY_QP_ACCESS_REMOTE_ATOMIC_REMOTE_READ_REMOTE_WRITE_LOCAL_WRITE_SFT 0 ++ #define CMDQ_MODIFY_QP_ACCESS_LOCAL_WRITE 0x1UL ++ #define CMDQ_MODIFY_QP_ACCESS_REMOTE_WRITE 0x2UL ++ #define CMDQ_MODIFY_QP_ACCESS_REMOTE_READ 0x4UL ++ #define CMDQ_MODIFY_QP_ACCESS_REMOTE_ATOMIC 0x8UL + __le16 pkey; + __le32 qkey; + __le32 dgid[4]; +@@ -673,6 +676,13 @@ struct cmdq_modify_qp { + #define CMDQ_MODIFY_QP_VLAN_PCP_SFT 13 + __le64 irrq_addr; + __le64 orrq_addr; ++ __le32 ext_modify_mask; ++ #define CMDQ_MODIFY_QP_EXT_MODIFY_MASK_EXT_STATS_CTX 0x1UL ++ #define CMDQ_MODIFY_QP_EXT_MODIFY_MASK_SCHQ_ID_VALID 0x2UL ++ __le32 ext_stats_ctx_id; ++ __le16 schq_id; ++ __le16 unused_0; ++ __le32 reserved32; + }; + + /* creq_modify_qp_resp (size:128b/16B) */ +@@ -3017,6 +3027,17 @@ struct sq_psn_search_ext { + __le32 reserved32; + }; + ++/* sq_msn_search (size:64b/8B) */ ++struct sq_msn_search { ++ __le64 start_idx_next_psn_start_psn; ++ #define SQ_MSN_SEARCH_START_PSN_MASK 0xffffffUL ++ #define SQ_MSN_SEARCH_START_PSN_SFT 0 ++ #define SQ_MSN_SEARCH_NEXT_PSN_MASK 0xffffff000000ULL ++ #define SQ_MSN_SEARCH_NEXT_PSN_SFT 24 ++ #define SQ_MSN_SEARCH_START_IDX_MASK 0xffff000000000000ULL ++ #define SQ_MSN_SEARCH_START_IDX_SFT 48 ++}; ++ + /* sq_send (size:1024b/128B) */ + struct sq_send { + u8 wqe_type; +@@ -3705,13 +3726,35 @@ struct cq_base { + #define CQ_BASE_CQE_TYPE_RES_UD (0x2UL << 1) + #define CQ_BASE_CQE_TYPE_RES_RAWETH_QP1 (0x3UL << 1) + #define CQ_BASE_CQE_TYPE_RES_UD_CFA (0x4UL << 1) ++ #define CQ_BASE_CQE_TYPE_REQ_V3 (0x8UL << 1) ++ #define CQ_BASE_CQE_TYPE_RES_RC_V3 (0x9UL << 1) ++ #define CQ_BASE_CQE_TYPE_RES_UD_V3 (0xaUL << 1) ++ #define CQ_BASE_CQE_TYPE_RES_RAWETH_QP1_V3 (0xbUL << 1) ++ #define CQ_BASE_CQE_TYPE_RES_UD_CFA_V3 (0xcUL << 1) + #define CQ_BASE_CQE_TYPE_NO_OP (0xdUL << 1) + #define CQ_BASE_CQE_TYPE_TERMINAL (0xeUL << 1) + #define CQ_BASE_CQE_TYPE_CUT_OFF (0xfUL << 1) + #define CQ_BASE_CQE_TYPE_LAST CQ_BASE_CQE_TYPE_CUT_OFF + u8 status; ++ #define CQ_BASE_STATUS_OK 0x0UL ++ #define CQ_BASE_STATUS_BAD_RESPONSE_ERR 0x1UL ++ #define CQ_BASE_STATUS_LOCAL_LENGTH_ERR 0x2UL ++ #define CQ_BASE_STATUS_HW_LOCAL_LENGTH_ERR 0x3UL ++ #define CQ_BASE_STATUS_LOCAL_QP_OPERATION_ERR 0x4UL ++ #define CQ_BASE_STATUS_LOCAL_PROTECTION_ERR 0x5UL ++ #define CQ_BASE_STATUS_LOCAL_ACCESS_ERROR 0x6UL ++ #define CQ_BASE_STATUS_MEMORY_MGT_OPERATION_ERR 0x7UL ++ #define CQ_BASE_STATUS_REMOTE_INVALID_REQUEST_ERR 0x8UL ++ #define CQ_BASE_STATUS_REMOTE_ACCESS_ERR 0x9UL ++ #define CQ_BASE_STATUS_REMOTE_OPERATION_ERR 0xaUL ++ #define CQ_BASE_STATUS_RNR_NAK_RETRY_CNT_ERR 0xbUL ++ #define CQ_BASE_STATUS_TRANSPORT_RETRY_CNT_ERR 0xcUL ++ #define CQ_BASE_STATUS_WORK_REQUEST_FLUSHED_ERR 0xdUL ++ #define CQ_BASE_STATUS_HW_FLUSH_ERR 0xeUL ++ #define CQ_BASE_STATUS_OVERFLOW_ERR 0xfUL ++ #define CQ_BASE_STATUS_LAST CQ_BASE_STATUS_OVERFLOW_ERR + __le16 reserved16; +- __le32 reserved32; ++ __le32 opaque; + }; + + /* cq_req (size:256b/32B) */ +@@ -4326,6 +4369,8 @@ struct cq_cutoff { + #define CQ_CUTOFF_CQE_TYPE_SFT 1 + #define CQ_CUTOFF_CQE_TYPE_CUT_OFF (0xfUL << 1) + #define CQ_CUTOFF_CQE_TYPE_LAST CQ_CUTOFF_CQE_TYPE_CUT_OFF ++ #define CQ_CUTOFF_RESIZE_TOGGLE_MASK 0x60UL ++ #define CQ_CUTOFF_RESIZE_TOGGLE_SFT 5 + u8 status; + #define CQ_CUTOFF_STATUS_OK 0x0UL + #define CQ_CUTOFF_STATUS_LAST CQ_CUTOFF_STATUS_OK +@@ -4377,6 +4422,8 @@ struct nq_srq_event { + #define NQ_SRQ_EVENT_TYPE_SFT 0 + #define NQ_SRQ_EVENT_TYPE_SRQ_EVENT 0x32UL + #define NQ_SRQ_EVENT_TYPE_LAST NQ_SRQ_EVENT_TYPE_SRQ_EVENT ++ #define NQ_SRQ_EVENT_TOGGLE_MASK 0xc0UL ++ #define NQ_SRQ_EVENT_TOGGLE_SFT 6 + u8 event; + #define NQ_SRQ_EVENT_EVENT_SRQ_THRESHOLD_EVENT 0x1UL + #define NQ_SRQ_EVENT_EVENT_LAST NQ_SRQ_EVENT_EVENT_SRQ_THRESHOLD_EVENT +-- +2.43.0 + diff --git a/queue-6.6/rdma-cma-fix-kmemleak-in-rdma_core-observed-during-b.patch b/queue-6.6/rdma-cma-fix-kmemleak-in-rdma_core-observed-during-b.patch new file mode 100644 index 00000000000..048a4571348 --- /dev/null +++ b/queue-6.6/rdma-cma-fix-kmemleak-in-rdma_core-observed-during-b.patch @@ -0,0 +1,77 @@ +From 6d0be7cfd943ed5df1b488f110f693d8f14cae0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 23:12:47 +0200 +Subject: RDMA/cma: Fix kmemleak in rdma_core observed during blktests + nvme/rdma use siw + +From: Zhu Yanjun + +[ Upstream commit 9c0731832d3b7420cbadba6a7f334363bc8dfb15 ] + +When running blktests nvme/rdma, the following kmemleak issue will appear. + +kmemleak: Kernel memory leak detector initialized (mempool available:36041) +kmemleak: Automatic memory scanning thread started +kmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak) +kmemleak: 8 new suspected memory leaks (see /sys/kernel/debug/kmemleak) +kmemleak: 17 new suspected memory leaks (see /sys/kernel/debug/kmemleak) +kmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak) + +unreferenced object 0xffff88855da53400 (size 192): + comm "rdma", pid 10630, jiffies 4296575922 + hex dump (first 32 bytes): + 37 00 00 00 00 00 00 00 c0 ff ff ff 1f 00 00 00 7............... + 10 34 a5 5d 85 88 ff ff 10 34 a5 5d 85 88 ff ff .4.].....4.].... + backtrace (crc 47f66721): + [] kmalloc_trace+0x30d/0x3b0 + [] alloc_gid_entry+0x47/0x380 [ib_core] + [] add_modify_gid+0x166/0x930 [ib_core] + [] ib_cache_update.part.0+0x6d8/0x910 [ib_core] + [] ib_cache_setup_one+0x24a/0x350 [ib_core] + [] ib_register_device+0x9e/0x3a0 [ib_core] + [] 0xffffffffc2a3d389 + [] nldev_newlink+0x2b8/0x520 [ib_core] + [] rdma_nl_rcv_msg+0x2c3/0x520 [ib_core] + [] +rdma_nl_rcv_skb.constprop.0.isra.0+0x23c/0x3a0 [ib_core] + [] netlink_unicast+0x445/0x710 + [] netlink_sendmsg+0x761/0xc40 + [] __sys_sendto+0x3a9/0x420 + [] __x64_sys_sendto+0xdc/0x1b0 + [] do_syscall_64+0x93/0x180 + [] entry_SYSCALL_64_after_hwframe+0x71/0x79 + +The root cause: rdma_put_gid_attr is not called when sgid_attr is set +to ERR_PTR(-ENODEV). + +Reported-and-tested-by: Yi Zhang +Closes: https://lore.kernel.org/all/19bf5745-1b3b-4b8a-81c2-20d945943aaf@linux.dev/T/ +Fixes: f8ef1be816bf ("RDMA/cma: Avoid GID lookups on iWARP devices") +Reviewed-by: Chuck Lever +Signed-off-by: Zhu Yanjun +Link: https://lore.kernel.org/r/20240510211247.31345-1-yanjun.zhu@linux.dev +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 1e2cd7c8716e8..64ace0b968f07 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -715,8 +715,10 @@ cma_validate_port(struct ib_device *device, u32 port, + rcu_read_lock(); + ndev = rcu_dereference(sgid_attr->ndev); + if (!net_eq(dev_net(ndev), dev_addr->net) || +- ndev->ifindex != bound_if_index) ++ ndev->ifindex != bound_if_index) { ++ rdma_put_gid_attr(sgid_attr); + sgid_attr = ERR_PTR(-ENODEV); ++ } + rcu_read_unlock(); + goto out; + } +-- +2.43.0 + diff --git a/queue-6.6/rdma-hns-fix-deadlock-on-srq-async-events.patch b/queue-6.6/rdma-hns-fix-deadlock-on-srq-async-events.patch new file mode 100644 index 00000000000..be50f2fc10d --- /dev/null +++ b/queue-6.6/rdma-hns-fix-deadlock-on-srq-async-events.patch @@ -0,0 +1,69 @@ +From 3f4ffcd7e7f3706428989e91e3a4497051c30a32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:10 +0800 +Subject: RDMA/hns: Fix deadlock on SRQ async events. + +From: Chengchang Tang + +[ Upstream commit b46494b6f9c19f141114a57729e198698f40af37 ] + +xa_lock for SRQ table may be required in AEQ. Use xa_store_irq()/ +xa_erase_irq() to avoid deadlock. + +Fixes: 81fce6291d99 ("RDMA/hns: Add SRQ asynchronous event support") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-5-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_main.c | 1 + + drivers/infiniband/hw/hns/hns_roce_srq.c | 6 +++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index 4a9cd4d21bc99..c8c49110a3378 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -37,6 +37,7 @@ + #include + #include + #include ++#include "hnae3.h" + #include "hns_roce_common.h" + #include "hns_roce_device.h" + #include "hns_roce_hem.h" +diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c +index 8dae98f827eb2..6a4923c21cbc6 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_srq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c +@@ -122,7 +122,7 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) + return ret; + } + +- ret = xa_err(xa_store(&srq_table->xa, srq->srqn, srq, GFP_KERNEL)); ++ ret = xa_err(xa_store_irq(&srq_table->xa, srq->srqn, srq, GFP_KERNEL)); + if (ret) { + ibdev_err(ibdev, "failed to store SRQC, ret = %d.\n", ret); + goto err_put; +@@ -135,7 +135,7 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) + return 0; + + err_xa: +- xa_erase(&srq_table->xa, srq->srqn); ++ xa_erase_irq(&srq_table->xa, srq->srqn); + err_put: + hns_roce_table_put(hr_dev, &srq_table->table, srq->srqn); + +@@ -153,7 +153,7 @@ static void free_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) + dev_err(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n", + ret, srq->srqn); + +- xa_erase(&srq_table->xa, srq->srqn); ++ xa_erase_irq(&srq_table->xa, srq->srqn); + + if (refcount_dec_and_test(&srq->refcount)) + complete(&srq->free); +-- +2.43.0 + diff --git a/queue-6.6/rdma-hns-fix-gmv-table-pagesize.patch b/queue-6.6/rdma-hns-fix-gmv-table-pagesize.patch new file mode 100644 index 00000000000..6474eac6159 --- /dev/null +++ b/queue-6.6/rdma-hns-fix-gmv-table-pagesize.patch @@ -0,0 +1,39 @@ +From 3c3d7b32d96a0327c880e27c39abbab1b19bc574 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:13 +0800 +Subject: RDMA/hns: Fix GMV table pagesize + +From: Chengchang Tang + +[ Upstream commit ee045493283403969591087bd405fa280103282a ] + +GMV's BA table only supports 4K pages. Currently, PAGESIZE is used to +calculate gmv_bt_num, which will cause an abnormal number of gmv_bt_num +in a 64K OS. + +Fixes: d6d91e46210f ("RDMA/hns: Add support for configuring GMV table") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-8-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index b4799c83282e2..2f88e7853abff 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -2088,7 +2088,7 @@ static void apply_func_caps(struct hns_roce_dev *hr_dev) + caps->gid_table_len[0] = caps->gmv_bt_num * + (HNS_HW_PAGE_SIZE / caps->gmv_entry_sz); + +- caps->gmv_entry_num = caps->gmv_bt_num * (PAGE_SIZE / ++ caps->gmv_entry_num = caps->gmv_bt_num * (HNS_HW_PAGE_SIZE / + caps->gmv_entry_sz); + } else { + u32 func_num = max_t(u32, 1, hr_dev->func_num); +-- +2.43.0 + diff --git a/queue-6.6/rdma-hns-fix-return-value-in-hns_roce_map_mr_sg.patch b/queue-6.6/rdma-hns-fix-return-value-in-hns_roce_map_mr_sg.patch new file mode 100644 index 00000000000..ba764e62bba --- /dev/null +++ b/queue-6.6/rdma-hns-fix-return-value-in-hns_roce_map_mr_sg.patch @@ -0,0 +1,75 @@ +From c6a3be08f4c85b16dd74c441dae75ddc8744019f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 11:38:51 +0800 +Subject: RDMA/hns: Fix return value in hns_roce_map_mr_sg + +From: Zhengchao Shao + +[ Upstream commit 203b70fda63425a4eb29f03f9074859afe821a39 ] + +As described in the ib_map_mr_sg function comment, it returns the number +of sg elements that were mapped to the memory region. However, +hns_roce_map_mr_sg returns the number of pages required for mapping the +DMA area. Fix it. + +Fixes: 9b2cf76c9f05 ("RDMA/hns: Optimize PBL buffer allocation process") +Signed-off-by: Zhengchao Shao +Link: https://lore.kernel.org/r/20240411033851.2884771-1-shaozhengchao@huawei.com +Reviewed-by: Junxian Huang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_mr.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index 14376490ac226..190e62da98e4b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -421,18 +421,18 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, + struct ib_device *ibdev = &hr_dev->ib_dev; + struct hns_roce_mr *mr = to_hr_mr(ibmr); + struct hns_roce_mtr *mtr = &mr->pbl_mtr; +- int ret = 0; ++ int ret, sg_num = 0; + + mr->npages = 0; + mr->page_list = kvcalloc(mr->pbl_mtr.hem_cfg.buf_pg_count, + sizeof(dma_addr_t), GFP_KERNEL); + if (!mr->page_list) +- return ret; ++ return sg_num; + +- ret = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, hns_roce_set_page); +- if (ret < 1) { ++ sg_num = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, hns_roce_set_page); ++ if (sg_num < 1) { + ibdev_err(ibdev, "failed to store sg pages %u %u, cnt = %d.\n", +- mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, ret); ++ mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, sg_num); + goto err_page_list; + } + +@@ -443,17 +443,16 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, + ret = hns_roce_mtr_map(hr_dev, mtr, mr->page_list, mr->npages); + if (ret) { + ibdev_err(ibdev, "failed to map sg mtr, ret = %d.\n", ret); +- ret = 0; ++ sg_num = 0; + } else { + mr->pbl_mtr.hem_cfg.buf_pg_shift = (u32)ilog2(ibmr->page_size); +- ret = mr->npages; + } + + err_page_list: + kvfree(mr->page_list); + mr->page_list = NULL; + +- return ret; ++ return sg_num; + } + + static void hns_roce_mw_free(struct hns_roce_dev *hr_dev, +-- +2.43.0 + diff --git a/queue-6.6/rdma-hns-fix-uaf-for-cq-async-event.patch b/queue-6.6/rdma-hns-fix-uaf-for-cq-async-event.patch new file mode 100644 index 00000000000..b743902ddac --- /dev/null +++ b/queue-6.6/rdma-hns-fix-uaf-for-cq-async-event.patch @@ -0,0 +1,91 @@ +From 137a626c8c65f7dfccfdd09c3dfe6e6d46aafd83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:11 +0800 +Subject: RDMA/hns: Fix UAF for cq async event + +From: Chengchang Tang + +[ Upstream commit a942ec2745ca864cd8512142100e4027dc306a42 ] + +The refcount of CQ is not protected by locks. When CQ asynchronous +events and CQ destruction are concurrent, CQ may have been released, +which will cause UAF. + +Use the xa_lock() to protect the CQ refcount. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_cq.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c +index 736dc2f993b40..ff177466de9b4 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_cq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_cq.c +@@ -151,7 +151,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) + return ret; + } + +- ret = xa_err(xa_store(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL)); ++ ret = xa_err(xa_store_irq(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL)); + if (ret) { + ibdev_err(ibdev, "failed to xa_store CQ, ret = %d.\n", ret); + goto err_put; +@@ -164,7 +164,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) + return 0; + + err_xa: +- xa_erase(&cq_table->array, hr_cq->cqn); ++ xa_erase_irq(&cq_table->array, hr_cq->cqn); + err_put: + hns_roce_table_put(hr_dev, &cq_table->table, hr_cq->cqn); + +@@ -183,7 +183,7 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) + dev_err(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n", ret, + hr_cq->cqn); + +- xa_erase(&cq_table->array, hr_cq->cqn); ++ xa_erase_irq(&cq_table->array, hr_cq->cqn); + + /* Waiting interrupt process procedure carried out */ + synchronize_irq(hr_dev->eq_table.eq[hr_cq->vector].irq); +@@ -472,13 +472,6 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) + struct ib_event event; + struct ib_cq *ibcq; + +- hr_cq = xa_load(&hr_dev->cq_table.array, +- cqn & (hr_dev->caps.num_cqs - 1)); +- if (!hr_cq) { +- dev_warn(dev, "async event for bogus CQ 0x%06x\n", cqn); +- return; +- } +- + if (event_type != HNS_ROCE_EVENT_TYPE_CQ_ID_INVALID && + event_type != HNS_ROCE_EVENT_TYPE_CQ_ACCESS_ERROR && + event_type != HNS_ROCE_EVENT_TYPE_CQ_OVERFLOW) { +@@ -487,7 +480,16 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) + return; + } + +- refcount_inc(&hr_cq->refcount); ++ xa_lock(&hr_dev->cq_table.array); ++ hr_cq = xa_load(&hr_dev->cq_table.array, ++ cqn & (hr_dev->caps.num_cqs - 1)); ++ if (hr_cq) ++ refcount_inc(&hr_cq->refcount); ++ xa_unlock(&hr_dev->cq_table.array); ++ if (!hr_cq) { ++ dev_warn(dev, "async event for bogus CQ 0x%06x\n", cqn); ++ return; ++ } + + ibcq = &hr_cq->ib_cq; + if (ibcq->event_handler) { +-- +2.43.0 + diff --git a/queue-6.6/rdma-hns-modify-the-print-level-of-cqe-error.patch b/queue-6.6/rdma-hns-modify-the-print-level-of-cqe-error.patch new file mode 100644 index 00000000000..4bfe75ccbf8 --- /dev/null +++ b/queue-6.6/rdma-hns-modify-the-print-level-of-cqe-error.patch @@ -0,0 +1,42 @@ +From dcfb9cc0acfaf47624219f7be51aca5c8a81a9bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:16 +0800 +Subject: RDMA/hns: Modify the print level of CQE error + +From: Chengchang Tang + +[ Upstream commit 349e859952285ab9689779fb46de163f13f18f43 ] + +Too much print may lead to a panic in kernel. Change ibdev_err() to +ibdev_err_ratelimited(), and change the printing level of cqe dump +to debug level. + +Fixes: 7c044adca272 ("RDMA/hns: Simplify the cqe code of poll cq") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-11-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 2f88e7853abff..32fb2c00a8f26 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -3698,8 +3698,9 @@ static void get_cqe_status(struct hns_roce_dev *hr_dev, struct hns_roce_qp *qp, + wc->status == IB_WC_WR_FLUSH_ERR)) + return; + +- ibdev_err(&hr_dev->ib_dev, "error cqe status 0x%x:\n", cqe_status); +- print_hex_dump(KERN_ERR, "", DUMP_PREFIX_NONE, 16, 4, cqe, ++ ibdev_err_ratelimited(&hr_dev->ib_dev, "error cqe status 0x%x:\n", ++ cqe_status); ++ print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_NONE, 16, 4, cqe, + cq->cqe_size, false); + wc->vendor_err = hr_reg_read(cqe, CQE_SUB_STATUS); + +-- +2.43.0 + diff --git a/queue-6.6/rdma-hns-use-complete-parentheses-in-macros.patch b/queue-6.6/rdma-hns-use-complete-parentheses-in-macros.patch new file mode 100644 index 00000000000..f7d1fc61774 --- /dev/null +++ b/queue-6.6/rdma-hns-use-complete-parentheses-in-macros.patch @@ -0,0 +1,52 @@ +From 2e67ef6c8f914dfcc05cd71a48624a8926843a5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:15 +0800 +Subject: RDMA/hns: Use complete parentheses in macros + +From: Chengchang Tang + +[ Upstream commit 4125269bb9b22e1d8cdf4412c81be8074dbc61ca ] + +Use complete parentheses to ensure that macro expansion does +not produce unexpected results. + +Fixes: a25d13cbe816 ("RDMA/hns: Add the interfaces to support multi hop addressing for the contexts in hip08") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-10-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h +index 7d23d3c51da46..fea6d7d508b60 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h +@@ -61,16 +61,16 @@ enum { + (sizeof(struct scatterlist) + sizeof(void *))) + + #define check_whether_bt_num_3(type, hop_num) \ +- (type < HEM_TYPE_MTT && hop_num == 2) ++ ((type) < HEM_TYPE_MTT && (hop_num) == 2) + + #define check_whether_bt_num_2(type, hop_num) \ +- ((type < HEM_TYPE_MTT && hop_num == 1) || \ +- (type >= HEM_TYPE_MTT && hop_num == 2)) ++ (((type) < HEM_TYPE_MTT && (hop_num) == 1) || \ ++ ((type) >= HEM_TYPE_MTT && (hop_num) == 2)) + + #define check_whether_bt_num_1(type, hop_num) \ +- ((type < HEM_TYPE_MTT && hop_num == HNS_ROCE_HOP_NUM_0) || \ +- (type >= HEM_TYPE_MTT && hop_num == 1) || \ +- (type >= HEM_TYPE_MTT && hop_num == HNS_ROCE_HOP_NUM_0)) ++ (((type) < HEM_TYPE_MTT && (hop_num) == HNS_ROCE_HOP_NUM_0) || \ ++ ((type) >= HEM_TYPE_MTT && (hop_num) == 1) || \ ++ ((type) >= HEM_TYPE_MTT && (hop_num) == HNS_ROCE_HOP_NUM_0)) + + struct hns_roce_hem_chunk { + struct list_head list; +-- +2.43.0 + diff --git a/queue-6.6/rdma-ipoib-fix-format-truncation-compilation-errors.patch b/queue-6.6/rdma-ipoib-fix-format-truncation-compilation-errors.patch new file mode 100644 index 00000000000..13e56d7232e --- /dev/null +++ b/queue-6.6/rdma-ipoib-fix-format-truncation-compilation-errors.patch @@ -0,0 +1,66 @@ +From 1494ec578706a04aee12ffd5dd9cb82dd61d6dc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 10:39:33 +0300 +Subject: RDMA/IPoIB: Fix format truncation compilation errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 49ca2b2ef3d003402584c68ae7b3055ba72e750a ] + +Truncate the device name to store IPoIB VLAN name. + +[leonro@5b4e8fba4ddd kernel]$ make -s -j 20 allmodconfig +[leonro@5b4e8fba4ddd kernel]$ make -s -j 20 W=1 drivers/infiniband/ulp/ipoib/ +drivers/infiniband/ulp/ipoib/ipoib_vlan.c: In function ‘ipoib_vlan_add’: +drivers/infiniband/ulp/ipoib/ipoib_vlan.c:187:52: error: ‘%04x’ +directive output may be truncated writing 4 bytes into a region of size +between 0 and 15 [-Werror=format-truncation=] + 187 | snprintf(intf_name, sizeof(intf_name), "%s.%04x", + | ^~~~ +drivers/infiniband/ulp/ipoib/ipoib_vlan.c:187:48: note: directive +argument in the range [0, 65535] + 187 | snprintf(intf_name, sizeof(intf_name), "%s.%04x", + | ^~~~~~~~~ +drivers/infiniband/ulp/ipoib/ipoib_vlan.c:187:9: note: ‘snprintf’ output +between 6 and 21 bytes into a destination of size 16 + 187 | snprintf(intf_name, sizeof(intf_name), "%s.%04x", + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 188 | ppriv->dev->name, pkey); + | ~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:244: drivers/infiniband/ulp/ipoib/ipoib_vlan.o] Error 1 +make[6]: *** Waiting for unfinished jobs.... + +Fixes: 9baa0b036410 ("IB/ipoib: Add rtnl_link_ops support") +Link: https://lore.kernel.org/r/e9d3e1fef69df4c9beaf402cc3ac342bad680791.1715240029.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +index 4bd161e86f8dd..562df2b3ef187 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +@@ -184,8 +184,12 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey) + + ppriv = ipoib_priv(pdev); + +- snprintf(intf_name, sizeof(intf_name), "%s.%04x", +- ppriv->dev->name, pkey); ++ /* If you increase IFNAMSIZ, update snprintf below ++ * to allow longer names. ++ */ ++ BUILD_BUG_ON(IFNAMSIZ != 16); ++ snprintf(intf_name, sizeof(intf_name), "%.10s.%04x", ppriv->dev->name, ++ pkey); + + ndev = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name); + if (IS_ERR(ndev)) { +-- +2.43.0 + diff --git a/queue-6.6/rdma-mlx5-adding-remote-atomic-access-flag-to-updata.patch b/queue-6.6/rdma-mlx5-adding-remote-atomic-access-flag-to-updata.patch new file mode 100644 index 00000000000..2a6c77b6461 --- /dev/null +++ b/queue-6.6/rdma-mlx5-adding-remote-atomic-access-flag-to-updata.patch @@ -0,0 +1,39 @@ +From aafd22cdc488b4014774bf4624fdece081ab4b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 13:36:01 +0300 +Subject: RDMA/mlx5: Adding remote atomic access flag to updatable flags + +From: Or Har-Toov + +[ Upstream commit 2ca7e93bc963d9ec2f5c24d117176851454967af ] + +Currently IB_ACCESS_REMOTE_ATOMIC is blocked from being updated via UMR +although in some cases it should be possible. These cases are checked in +mlx5r_umr_can_reconfig function. + +Fixes: ef3642c4f54d ("RDMA/mlx5: Fix error unwinds for rereg_mr") +Signed-off-by: Or Har-Toov +Link: https://lore.kernel.org/r/24dac73e2fa48cb806f33a932d97f3e402a5ea2c.1712140377.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index e0629898c3c06..46847249b4677 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1594,7 +1594,8 @@ static bool can_use_umr_rereg_access(struct mlx5_ib_dev *dev, + unsigned int diffs = current_access_flags ^ target_access_flags; + + if (diffs & ~(IB_ACCESS_LOCAL_WRITE | IB_ACCESS_REMOTE_WRITE | +- IB_ACCESS_REMOTE_READ | IB_ACCESS_RELAXED_ORDERING)) ++ IB_ACCESS_REMOTE_READ | IB_ACCESS_RELAXED_ORDERING | ++ IB_ACCESS_REMOTE_ATOMIC)) + return false; + return mlx5r_umr_can_reconfig(dev, current_access_flags, + target_access_flags); +-- +2.43.0 + diff --git a/queue-6.6/rdma-mlx5-uncacheable-mkey-has-neither-rb_key-or-cac.patch b/queue-6.6/rdma-mlx5-uncacheable-mkey-has-neither-rb_key-or-cac.patch new file mode 100644 index 00000000000..407b291804b --- /dev/null +++ b/queue-6.6/rdma-mlx5-uncacheable-mkey-has-neither-rb_key-or-cac.patch @@ -0,0 +1,38 @@ +From dc9799169bc5755c478708320d7ec6414ddd2178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 13:35:59 +0300 +Subject: RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent + +From: Or Har-Toov + +[ Upstream commit 0611a8e8b475fc5230b9a24d29c8397aaab20b63 ] + +As some mkeys can't be modified with UMR due to some UMR limitations, +like the size of translation that can be updated, not all user mkeys can +be cached. + +Fixes: dd1b913fb0d0 ("RDMA/mlx5: Cache all user cacheable mkeys on dereg MR flow") +Signed-off-by: Or Har-Toov +Link: https://lore.kernel.org/r/f2742dd934ed73b2d32c66afb8e91b823063880c.1712140377.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index 16713baf0d060..6a57af8fa231b 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -643,7 +643,7 @@ struct mlx5_ib_mkey { + unsigned int ndescs; + struct wait_queue_head wait; + refcount_t usecount; +- /* User Mkey must hold either a rb_key or a cache_ent. */ ++ /* Cacheable user Mkey must hold either a rb_key or a cache_ent. */ + struct mlx5r_cache_rb_key rb_key; + struct mlx5_cache_ent *cache_ent; + }; +-- +2.43.0 + diff --git a/queue-6.6/rdma-rxe-allow-good-work-requests-to-be-executed.patch b/queue-6.6/rdma-rxe-allow-good-work-requests-to-be-executed.patch new file mode 100644 index 00000000000..f7b064b0362 --- /dev/null +++ b/queue-6.6/rdma-rxe-allow-good-work-requests-to-be-executed.patch @@ -0,0 +1,58 @@ +From c18dc8618b0a9e537b49bde3f0e21217a6b4791b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 09:55:05 -0500 +Subject: RDMA/rxe: Allow good work requests to be executed + +From: Bob Pearson + +[ Upstream commit b703374837a8f8422fa3f1edcf65505421a65a6a ] + +A previous commit incorrectly added an 'if(!err)' before scheduling the +requester task in rxe_post_send_kernel(). But if there were send wrs +successfully added to the send queue before a bad wr they might never get +executed. + +This commit fixes this by scheduling the requester task if any wqes were +successfully posted in rxe_post_send_kernel() in rxe_verbs.c. + +Link: https://lore.kernel.org/r/20240329145513.35381-5-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Fixes: 5bf944f24129 ("RDMA/rxe: Add error messages") +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_verbs.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 48f86839d36a8..0930350522e38 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -888,6 +888,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, + { + int err = 0; + unsigned long flags; ++ int good = 0; + + spin_lock_irqsave(&qp->sq.sq_lock, flags); + while (ibwr) { +@@ -895,12 +896,15 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, + if (err) { + *bad_wr = ibwr; + break; ++ } else { ++ good++; + } + ibwr = ibwr->next; + } + spin_unlock_irqrestore(&qp->sq.sq_lock, flags); + +- if (!err) ++ /* kickoff processing of any posted wqes */ ++ if (good) + rxe_sched_task(&qp->req.task); + + spin_lock_irqsave(&qp->state_lock, flags); +-- +2.43.0 + diff --git a/queue-6.6/rdma-rxe-fix-incorrect-rxe_put-in-error-path.patch b/queue-6.6/rdma-rxe-fix-incorrect-rxe_put-in-error-path.patch new file mode 100644 index 00000000000..81e6d625670 --- /dev/null +++ b/queue-6.6/rdma-rxe-fix-incorrect-rxe_put-in-error-path.patch @@ -0,0 +1,55 @@ +From 64e92ae797c7adcb3218824cb24b2c79ff7f7e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 09:55:12 -0500 +Subject: RDMA/rxe: Fix incorrect rxe_put in error path + +From: Bob Pearson + +[ Upstream commit 8776618dbbd1b6f210b31509507e1aad461d6435 ] + +In rxe_send() a ref is taken on the qp to keep it alive until the +kfree_skb() has a chance to call the skb destructor rxe_skb_tx_dtor() +which drops the reference. If the packet has an incorrect protocol the +error path just calls kfree_skb() which will call the destructor which +will drop the ref. Currently the driver also calls rxe_put() which is +incorrect. Additionally since the packets sent to rxe_send() are under the +control of the driver and it only ever produces IPV4 or IPV6 packets the +simplest fix is to remove all the code in this block. + +Link: https://lore.kernel.org/r/20240329145513.35381-12-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Fixes: 9eb7f8e44d13 ("IB/rxe: Move refcounting earlier in rxe_send()") +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_net.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c +index cd59666158b18..e5827064ab1e2 100644 +--- a/drivers/infiniband/sw/rxe/rxe_net.c ++++ b/drivers/infiniband/sw/rxe/rxe_net.c +@@ -366,18 +366,10 @@ static int rxe_send(struct sk_buff *skb, struct rxe_pkt_info *pkt) + rxe_get(pkt->qp); + atomic_inc(&pkt->qp->skb_out); + +- if (skb->protocol == htons(ETH_P_IP)) { ++ if (skb->protocol == htons(ETH_P_IP)) + err = ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb); +- } else if (skb->protocol == htons(ETH_P_IPV6)) { ++ else + err = ip6_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb); +- } else { +- rxe_dbg_qp(pkt->qp, "Unknown layer 3 protocol: %d\n", +- skb->protocol); +- atomic_dec(&pkt->qp->skb_out); +- rxe_put(pkt->qp); +- kfree_skb(skb); +- return -EINVAL; +- } + + if (unlikely(net_xmit_eval(err))) { + rxe_dbg_qp(pkt->qp, "error sending packet: %d\n", err); +-- +2.43.0 + diff --git a/queue-6.6/rdma-rxe-fix-seg-fault-in-rxe_comp_queue_pkt.patch b/queue-6.6/rdma-rxe-fix-seg-fault-in-rxe_comp_queue_pkt.patch new file mode 100644 index 00000000000..6d37698ec61 --- /dev/null +++ b/queue-6.6/rdma-rxe-fix-seg-fault-in-rxe_comp_queue_pkt.patch @@ -0,0 +1,52 @@ +From 974f4e4620143b6031ab9dc7d8958ab0e237af4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 09:55:04 -0500 +Subject: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt + +From: Bob Pearson + +[ Upstream commit 2b23b6097303ed0ba5f4bc036a1c07b6027af5c6 ] + +In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the +resp_pkts queue and then a decision is made whether to run the completer +task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' +performance counter. This is wrong because if the completer task is +already running in a separate thread it may have already processed the skb +and freed it which can cause a seg fault. This has been observed +infrequently in testing at high scale. + +This patch fixes this by changing the order of enqueuing the packet until +after the counter is accessed. + +Link: https://lore.kernel.org/r/20240329145513.35381-4-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Fixes: 0b1e5b99a48b ("IB/rxe: Add port protocol stats") +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_comp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c +index d0bdc2d8adc82..acd2172bf092b 100644 +--- a/drivers/infiniband/sw/rxe/rxe_comp.c ++++ b/drivers/infiniband/sw/rxe/rxe_comp.c +@@ -131,12 +131,12 @@ void rxe_comp_queue_pkt(struct rxe_qp *qp, struct sk_buff *skb) + { + int must_sched; + +- skb_queue_tail(&qp->resp_pkts, skb); +- +- must_sched = skb_queue_len(&qp->resp_pkts) > 1; ++ must_sched = skb_queue_len(&qp->resp_pkts) > 0; + if (must_sched != 0) + rxe_counter_inc(SKB_TO_PKT(skb)->rxe, RXE_CNT_COMPLETER_SCHED); + ++ skb_queue_tail(&qp->resp_pkts, skb); ++ + if (must_sched) + rxe_sched_task(&qp->comp.task); + else +-- +2.43.0 + diff --git a/queue-6.6/regulator-irq_helpers-duplicate-irq-name.patch b/queue-6.6/regulator-irq_helpers-duplicate-irq-name.patch new file mode 100644 index 00000000000..277970952ed --- /dev/null +++ b/queue-6.6/regulator-irq_helpers-duplicate-irq-name.patch @@ -0,0 +1,43 @@ +From ba24dc3e79fff37471e6eed4d4f97c70080b04cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Apr 2024 10:35:21 +0300 +Subject: regulator: irq_helpers: duplicate IRQ name + +From: Matti Vaittinen + +[ Upstream commit 7ab681ddedd4b6dd2b047c74af95221c5f827e1d ] + +The regulator IRQ helper requires caller to provide pointer to IRQ name +which is kept in memory by caller. All other data passed to the helper +in the regulator_irq_desc structure is copied. This can cause some +confusion and unnecessary complexity. + +Make the regulator_irq_helper() to copy also the provided IRQ name +information so caller can discard the name after the call to +regulator_irq_helper() completes. + +Signed-off-by: Matti Vaittinen +Link: https://msgid.link/r/ZhJMuUYwaZbBXFGP@drtxq0yyyyyyyyyyyyydy-3.rev.dnainternet.fi +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/irq_helpers.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/regulator/irq_helpers.c b/drivers/regulator/irq_helpers.c +index fe7ae0f3f46af..5ab1a0befe12f 100644 +--- a/drivers/regulator/irq_helpers.c ++++ b/drivers/regulator/irq_helpers.c +@@ -352,6 +352,9 @@ void *regulator_irq_helper(struct device *dev, + + h->irq = irq; + h->desc = *d; ++ h->desc.name = devm_kstrdup(dev, d->name, GFP_KERNEL); ++ if (!h->desc.name) ++ return ERR_PTR(-ENOMEM); + + ret = init_rdev_state(dev, h, rdev, common_errs, per_rdev_errs, + rdev_amount); +-- +2.43.0 + diff --git a/queue-6.6/regulator-qcom-refgen-fix-module-autoloading.patch b/queue-6.6/regulator-qcom-refgen-fix-module-autoloading.patch new file mode 100644 index 00000000000..f36452a14cb --- /dev/null +++ b/queue-6.6/regulator-qcom-refgen-fix-module-autoloading.patch @@ -0,0 +1,36 @@ +From 4794243acc4afd2e54951a12c3ecc250dd84ccc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 19:26:14 +0200 +Subject: regulator: qcom-refgen: fix module autoloading + +From: Krzysztof Kozlowski + +[ Upstream commit ddd3f34c10002e41ed3cd89c9bd8f1d05a22506a ] + +Add MODULE_DEVICE_TABLE(), so the module could be properly autoloaded +based on the alias from of_device_id table. + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Link: https://msgid.link/r/20240410172615.255424-1-krzk@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/qcom-refgen-regulator.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/qcom-refgen-regulator.c b/drivers/regulator/qcom-refgen-regulator.c +index 656fe330d38f0..063e12c08e75f 100644 +--- a/drivers/regulator/qcom-refgen-regulator.c ++++ b/drivers/regulator/qcom-refgen-regulator.c +@@ -140,6 +140,7 @@ static const struct of_device_id qcom_refgen_match_table[] = { + { .compatible = "qcom,sm8250-refgen-regulator", .data = &sm8250_refgen_desc }, + { } + }; ++MODULE_DEVICE_TABLE(of, qcom_refgen_match_table); + + static struct platform_driver qcom_refgen_driver = { + .probe = qcom_refgen_probe, +-- +2.43.0 + diff --git a/queue-6.6/regulator-vqmmc-ipq4019-fix-module-autoloading.patch b/queue-6.6/regulator-vqmmc-ipq4019-fix-module-autoloading.patch new file mode 100644 index 00000000000..3a32affafd6 --- /dev/null +++ b/queue-6.6/regulator-vqmmc-ipq4019-fix-module-autoloading.patch @@ -0,0 +1,36 @@ +From a148848ce8a04a7b18eeda19aeda09df9b67dc25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 19:26:15 +0200 +Subject: regulator: vqmmc-ipq4019: fix module autoloading + +From: Krzysztof Kozlowski + +[ Upstream commit 68adb581a39ae63a0ed082c47f01fbbe515efa0e ] + +Add MODULE_DEVICE_TABLE(), so the module could be properly autoloaded +based on the alias from of_device_id table. + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Link: https://msgid.link/r/20240410172615.255424-2-krzk@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/vqmmc-ipq4019-regulator.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/vqmmc-ipq4019-regulator.c b/drivers/regulator/vqmmc-ipq4019-regulator.c +index 086da36abc0b4..4955616517ce9 100644 +--- a/drivers/regulator/vqmmc-ipq4019-regulator.c ++++ b/drivers/regulator/vqmmc-ipq4019-regulator.c +@@ -84,6 +84,7 @@ static const struct of_device_id regulator_ipq4019_of_match[] = { + { .compatible = "qcom,vqmmc-ipq4019-regulator", }, + {}, + }; ++MODULE_DEVICE_TABLE(of, regulator_ipq4019_of_match); + + static struct platform_driver ipq4019_regulator_driver = { + .probe = ipq4019_regulator_probe, +-- +2.43.0 + diff --git a/queue-6.6/revert-net-txgbe-fix-clk_name-exceed-max_dev_id-limi.patch b/queue-6.6/revert-net-txgbe-fix-clk_name-exceed-max_dev_id-limi.patch new file mode 100644 index 00000000000..f98a7b70f1b --- /dev/null +++ b/queue-6.6/revert-net-txgbe-fix-clk_name-exceed-max_dev_id-limi.patch @@ -0,0 +1,39 @@ +From 8fae01d85d35e8b84aaebe83ec0903b4e875bc60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 16:41:09 +0800 +Subject: Revert "net: txgbe: fix clk_name exceed MAX_DEV_ID limits" + +From: Duanqiang Wen + +[ Upstream commit edd2d250fb3bb5d70419ae82c1f9dbb9684dffd3 ] + +This reverts commit e30cef001da259e8df354b813015d0e5acc08740. +commit 99f4570cfba1 ("clkdev: Update clkdev id usage to allow +for longer names") can fix clk_name exceed MAX_DEV_ID limits, +so this commit is meaningless. + +Signed-off-by: Duanqiang Wen +Reviewed-by: Jacob Keller +Link: https://lore.kernel.org/r/20240422084109.3201-2-duanqiangwen@net-swift.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +index e457ac9ae6d88..4159c84035fdc 100644 +--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c ++++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +@@ -551,7 +551,7 @@ static int txgbe_clock_register(struct txgbe *txgbe) + char clk_name[32]; + struct clk *clk; + +- snprintf(clk_name, sizeof(clk_name), "i2c_dw.%d", ++ snprintf(clk_name, sizeof(clk_name), "i2c_designware.%d", + pci_dev_id(pdev)); + + clk = clk_register_fixed_rate(NULL, clk_name, NULL, 0, 156250000); +-- +2.43.0 + diff --git a/queue-6.6/revert-net-txgbe-fix-i2c-dev-name-cannot-match-clkde.patch b/queue-6.6/revert-net-txgbe-fix-i2c-dev-name-cannot-match-clkde.patch new file mode 100644 index 00000000000..e5d13f4a679 --- /dev/null +++ b/queue-6.6/revert-net-txgbe-fix-i2c-dev-name-cannot-match-clkde.patch @@ -0,0 +1,58 @@ +From 6c132eec61a052ae8a81504d23fa660d4e6bbf77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 16:41:08 +0800 +Subject: Revert "net: txgbe: fix i2c dev name cannot match clkdev" + +From: Duanqiang Wen + +[ Upstream commit 8d6bf83f6740ba52a59e25dad360e1e87ef47666 ] + +This reverts commit c644920ce9220d83e070f575a4df711741c07f07. +when register i2c dev, txgbe shorten "i2c_designware" to "i2c_dw", +will cause this i2c dev can't match platfom driver i2c_designware_platform. + +Signed-off-by: Duanqiang Wen +Reviewed-by: Jacob Keller +Link: https://lore.kernel.org/r/20240422084109.3201-1-duanqiangwen@net-swift.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +index ad5c213dac077..e457ac9ae6d88 100644 +--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c ++++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +@@ -20,8 +20,6 @@ + #include "txgbe_phy.h" + #include "txgbe_hw.h" + +-#define TXGBE_I2C_CLK_DEV_NAME "i2c_dw" +- + static int txgbe_swnodes_register(struct txgbe *txgbe) + { + struct txgbe_nodes *nodes = &txgbe->nodes; +@@ -553,8 +551,8 @@ static int txgbe_clock_register(struct txgbe *txgbe) + char clk_name[32]; + struct clk *clk; + +- snprintf(clk_name, sizeof(clk_name), "%s.%d", +- TXGBE_I2C_CLK_DEV_NAME, pci_dev_id(pdev)); ++ snprintf(clk_name, sizeof(clk_name), "i2c_dw.%d", ++ pci_dev_id(pdev)); + + clk = clk_register_fixed_rate(NULL, clk_name, NULL, 0, 156250000); + if (IS_ERR(clk)) +@@ -616,7 +614,7 @@ static int txgbe_i2c_register(struct txgbe *txgbe) + + info.parent = &pdev->dev; + info.fwnode = software_node_fwnode(txgbe->nodes.group[SWNODE_I2C]); +- info.name = TXGBE_I2C_CLK_DEV_NAME; ++ info.name = "i2c_designware"; + info.id = pci_dev_id(pdev); + + info.res = &DEFINE_RES_IRQ(pdev->irq); +-- +2.43.0 + diff --git a/queue-6.6/revert-sh-handle-calling-csum_partial-with-misaligne.patch b/queue-6.6/revert-sh-handle-calling-csum_partial-with-misaligne.patch new file mode 100644 index 00000000000..f518aef10dd --- /dev/null +++ b/queue-6.6/revert-sh-handle-calling-csum_partial-with-misaligne.patch @@ -0,0 +1,187 @@ +From 11699717b587216a84987648b32c6013dddf5432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Mar 2024 16:18:04 -0700 +Subject: Revert "sh: Handle calling csum_partial with misaligned data" + +From: Guenter Roeck + +[ Upstream commit b5319c96292ff877f6b58d349acf0a9dc8d3b454 ] + +This reverts commit cadc4e1a2b4d20d0cc0e81f2c6ba0588775e54e5. + +Commit cadc4e1a2b4d ("sh: Handle calling csum_partial with misaligned +data") causes bad checksum calculations on unaligned data. Reverting +it fixes the problem. + + # Subtest: checksum + # module: checksum_kunit + 1..5 + # test_csum_fixed_random_inputs: ASSERTION FAILED at lib/checksum_kunit.c:500 + Expected ( u64)result == ( u64)expec, but + ( u64)result == 53378 (0xd082) + ( u64)expec == 33488 (0x82d0) + # test_csum_fixed_random_inputs: pass:0 fail:1 skip:0 total:1 + not ok 1 test_csum_fixed_random_inputs + # test_csum_all_carry_inputs: ASSERTION FAILED at lib/checksum_kunit.c:525 + Expected ( u64)result == ( u64)expec, but + ( u64)result == 65281 (0xff01) + ( u64)expec == 65280 (0xff00) + # test_csum_all_carry_inputs: pass:0 fail:1 skip:0 total:1 + not ok 2 test_csum_all_carry_inputs + # test_csum_no_carry_inputs: ASSERTION FAILED at lib/checksum_kunit.c:573 + Expected ( u64)result == ( u64)expec, but + ( u64)result == 65535 (0xffff) + ( u64)expec == 65534 (0xfffe) + # test_csum_no_carry_inputs: pass:0 fail:1 skip:0 total:1 + not ok 3 test_csum_no_carry_inputs + # test_ip_fast_csum: pass:1 fail:0 skip:0 total:1 + ok 4 test_ip_fast_csum + # test_csum_ipv6_magic: pass:1 fail:0 skip:0 total:1 + ok 5 test_csum_ipv6_magic + # checksum: pass:2 fail:3 skip:0 total:5 + # Totals: pass:2 fail:3 skip:0 total:5 +not ok 22 checksum + +Fixes: cadc4e1a2b4d ("sh: Handle calling csum_partial with misaligned data") +Signed-off-by: Guenter Roeck +Tested-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20240324231804.841099-1-linux@roeck-us.net +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/lib/checksum.S | 67 ++++++++++++------------------------------ + 1 file changed, 18 insertions(+), 49 deletions(-) + +diff --git a/arch/sh/lib/checksum.S b/arch/sh/lib/checksum.S +index 3e07074e00981..06fed5a21e8ba 100644 +--- a/arch/sh/lib/checksum.S ++++ b/arch/sh/lib/checksum.S +@@ -33,7 +33,8 @@ + */ + + /* +- * asmlinkage __wsum csum_partial(const void *buf, int len, __wsum sum); ++ * unsigned int csum_partial(const unsigned char *buf, int len, ++ * unsigned int sum); + */ + + .text +@@ -45,31 +46,11 @@ ENTRY(csum_partial) + * Fortunately, it is easy to convert 2-byte alignment to 4-byte + * alignment for the unrolled loop. + */ ++ mov r5, r1 + mov r4, r0 +- tst #3, r0 ! Check alignment. +- bt/s 2f ! Jump if alignment is ok. +- mov r4, r7 ! Keep a copy to check for alignment ++ tst #2, r0 ! Check alignment. ++ bt 2f ! Jump if alignment is ok. + ! +- tst #1, r0 ! Check alignment. +- bt 21f ! Jump if alignment is boundary of 2bytes. +- +- ! buf is odd +- tst r5, r5 +- add #-1, r5 +- bt 9f +- mov.b @r4+, r0 +- extu.b r0, r0 +- addc r0, r6 ! t=0 from previous tst +- mov r6, r0 +- shll8 r6 +- shlr16 r0 +- shlr8 r0 +- or r0, r6 +- mov r4, r0 +- tst #2, r0 +- bt 2f +-21: +- ! buf is 2 byte aligned (len could be 0) + add #-2, r5 ! Alignment uses up two bytes. + cmp/pz r5 ! + bt/s 1f ! Jump if we had at least two bytes. +@@ -77,17 +58,16 @@ ENTRY(csum_partial) + bra 6f + add #2, r5 ! r5 was < 2. Deal with it. + 1: ++ mov r5, r1 ! Save new len for later use. + mov.w @r4+, r0 + extu.w r0, r0 + addc r0, r6 + bf 2f + add #1, r6 + 2: +- ! buf is 4 byte aligned (len could be 0) +- mov r5, r1 + mov #-5, r0 +- shld r0, r1 +- tst r1, r1 ++ shld r0, r5 ++ tst r5, r5 + bt/s 4f ! if it's =0, go to 4f + clrt + .align 2 +@@ -109,31 +89,30 @@ ENTRY(csum_partial) + addc r0, r6 + addc r2, r6 + movt r0 +- dt r1 ++ dt r5 + bf/s 3b + cmp/eq #1, r0 +- ! here, we know r1==0 +- addc r1, r6 ! add carry to r6 ++ ! here, we know r5==0 ++ addc r5, r6 ! add carry to r6 + 4: +- mov r5, r0 ++ mov r1, r0 + and #0x1c, r0 + tst r0, r0 +- bt 6f +- ! 4 bytes or more remaining +- mov r0, r1 +- shlr2 r1 ++ bt/s 6f ++ mov r0, r5 ++ shlr2 r5 + mov #0, r2 + 5: + addc r2, r6 + mov.l @r4+, r2 + movt r0 +- dt r1 ++ dt r5 + bf/s 5b + cmp/eq #1, r0 + addc r2, r6 +- addc r1, r6 ! r1==0 here, so it means add carry-bit ++ addc r5, r6 ! r5==0 here, so it means add carry-bit + 6: +- ! 3 bytes or less remaining ++ mov r1, r5 + mov #3, r0 + and r0, r5 + tst r5, r5 +@@ -159,16 +138,6 @@ ENTRY(csum_partial) + mov #0, r0 + addc r0, r6 + 9: +- ! Check if the buffer was misaligned, if so realign sum +- mov r7, r0 +- tst #1, r0 +- bt 10f +- mov r6, r0 +- shll8 r6 +- shlr16 r0 +- shlr8 r0 +- or r0, r6 +-10: + rts + mov r6, r0 + +-- +2.43.0 + diff --git a/queue-6.6/riscv-bpf-make-some-atomic-operations-fully-ordered.patch b/queue-6.6/riscv-bpf-make-some-atomic-operations-fully-ordered.patch new file mode 100644 index 00000000000..e1331e44135 --- /dev/null +++ b/queue-6.6/riscv-bpf-make-some-atomic-operations-fully-ordered.patch @@ -0,0 +1,97 @@ +From b4f7df542ff75f255970bbe59c8f454dce45b138 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 20:16:33 +0000 +Subject: riscv, bpf: make some atomic operations fully ordered + +From: Puranjay Mohan + +[ Upstream commit 20a759df3bba35bf5c3ddec0c02ad69b603b584c ] + +The BPF atomic operations with the BPF_FETCH modifier along with +BPF_XCHG and BPF_CMPXCHG are fully ordered but the RISC-V JIT implements +all atomic operations except BPF_CMPXCHG with relaxed ordering. + +Section 8.1 of the "The RISC-V Instruction Set Manual Volume I: +Unprivileged ISA" [1], titled, "Specifying Ordering of Atomic +Instructions" says: + +| To provide more efficient support for release consistency [5], each +| atomic instruction has two bits, aq and rl, used to specify additional +| memory ordering constraints as viewed by other RISC-V harts. + +and + +| If only the aq bit is set, the atomic memory operation is treated as +| an acquire access. +| If only the rl bit is set, the atomic memory operation is treated as a +| release access. +| +| If both the aq and rl bits are set, the atomic memory operation is +| sequentially consistent. + +Fix this by setting both aq and rl bits as 1 for operations with +BPF_FETCH and BPF_XCHG. + +[1] https://riscv.org/wp-content/uploads/2017/05/riscv-spec-v2.2.pdf + +Fixes: dd642ccb45ec ("riscv, bpf: Implement more atomic operations for RV64") +Signed-off-by: Puranjay Mohan +Reviewed-by: Pu Lehui +Link: https://lore.kernel.org/r/20240505201633.123115-1-puranjay@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/riscv/net/bpf_jit_comp64.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c +index b3990874e4818..2f041b5cea970 100644 +--- a/arch/riscv/net/bpf_jit_comp64.c ++++ b/arch/riscv/net/bpf_jit_comp64.c +@@ -516,33 +516,33 @@ static void emit_atomic(u8 rd, u8 rs, s16 off, s32 imm, bool is64, + break; + /* src_reg = atomic_fetch_(dst_reg + off16, src_reg) */ + case BPF_ADD | BPF_FETCH: +- emit(is64 ? rv_amoadd_d(rs, rs, rd, 0, 0) : +- rv_amoadd_w(rs, rs, rd, 0, 0), ctx); ++ emit(is64 ? rv_amoadd_d(rs, rs, rd, 1, 1) : ++ rv_amoadd_w(rs, rs, rd, 1, 1), ctx); + if (!is64) + emit_zext_32(rs, ctx); + break; + case BPF_AND | BPF_FETCH: +- emit(is64 ? rv_amoand_d(rs, rs, rd, 0, 0) : +- rv_amoand_w(rs, rs, rd, 0, 0), ctx); ++ emit(is64 ? rv_amoand_d(rs, rs, rd, 1, 1) : ++ rv_amoand_w(rs, rs, rd, 1, 1), ctx); + if (!is64) + emit_zext_32(rs, ctx); + break; + case BPF_OR | BPF_FETCH: +- emit(is64 ? rv_amoor_d(rs, rs, rd, 0, 0) : +- rv_amoor_w(rs, rs, rd, 0, 0), ctx); ++ emit(is64 ? rv_amoor_d(rs, rs, rd, 1, 1) : ++ rv_amoor_w(rs, rs, rd, 1, 1), ctx); + if (!is64) + emit_zext_32(rs, ctx); + break; + case BPF_XOR | BPF_FETCH: +- emit(is64 ? rv_amoxor_d(rs, rs, rd, 0, 0) : +- rv_amoxor_w(rs, rs, rd, 0, 0), ctx); ++ emit(is64 ? rv_amoxor_d(rs, rs, rd, 1, 1) : ++ rv_amoxor_w(rs, rs, rd, 1, 1), ctx); + if (!is64) + emit_zext_32(rs, ctx); + break; + /* src_reg = atomic_xchg(dst_reg + off16, src_reg); */ + case BPF_XCHG: +- emit(is64 ? rv_amoswap_d(rs, rs, rd, 0, 0) : +- rv_amoswap_w(rs, rs, rd, 0, 0), ctx); ++ emit(is64 ? rv_amoswap_d(rs, rs, rd, 1, 1) : ++ rv_amoswap_w(rs, rs, rd, 1, 1), ctx); + if (!is64) + emit_zext_32(rs, ctx); + break; +-- +2.43.0 + diff --git a/queue-6.6/s390-bpf-emit-a-barrier-for-bpf_fetch-instructions.patch b/queue-6.6/s390-bpf-emit-a-barrier-for-bpf_fetch-instructions.patch new file mode 100644 index 00000000000..f1dffec4122 --- /dev/null +++ b/queue-6.6/s390-bpf-emit-a-barrier-for-bpf_fetch-instructions.patch @@ -0,0 +1,62 @@ +From ccf1bdb5f20e2b5dbc326db81b785f825eea6ea9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 02:02:49 +0200 +Subject: s390/bpf: Emit a barrier for BPF_FETCH instructions + +From: Ilya Leoshkevich + +[ Upstream commit 68378982f0b21de02ac3c6a11e2420badefcb4bc ] + +BPF_ATOMIC_OP() macro documentation states that "BPF_ADD | BPF_FETCH" +should be the same as atomic_fetch_add(), which is currently not the +case on s390x: the serialization instruction "bcr 14,0" is missing. +This applies to "and", "or" and "xor" variants too. + +s390x is allowed to reorder stores with subsequent fetches from +different addresses, so code relying on BPF_FETCH acting as a barrier, +for example: + + stw [%r0], 1 + afadd [%r1], %r2 + ldxw %r3, [%r4] + +may be broken. Fix it by emitting "bcr 14,0". + +Note that a separate serialization instruction is not needed for +BPF_XCHG and BPF_CMPXCHG, because COMPARE AND SWAP performs +serialization itself. + +Fixes: ba3b86b9cef0 ("s390/bpf: Implement new atomic ops") +Reported-by: Puranjay Mohan +Closes: https://lore.kernel.org/bpf/mb61p34qvq3wf.fsf@kernel.org/ +Signed-off-by: Ilya Leoshkevich +Reviewed-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20240507000557.12048-1-iii@linux.ibm.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 8af02176f68bf..62ee557d4b499 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1311,8 +1311,12 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + EMIT6_DISP_LH(0xeb000000, is32 ? (op32) : (op64), \ + (insn->imm & BPF_FETCH) ? src_reg : REG_W0, \ + src_reg, dst_reg, off); \ +- if (is32 && (insn->imm & BPF_FETCH)) \ +- EMIT_ZERO(src_reg); \ ++ if (insn->imm & BPF_FETCH) { \ ++ /* bcr 14,0 - see atomic_fetch_{add,and,or,xor}() */ \ ++ _EMIT2(0x07e0); \ ++ if (is32) \ ++ EMIT_ZERO(src_reg); \ ++ } \ + } while (0) + case BPF_ADD: + case BPF_ADD | BPF_FETCH: +-- +2.43.0 + diff --git a/queue-6.6/s390-cio-fix-tracepoint-subchannel-type-field.patch b/queue-6.6/s390-cio-fix-tracepoint-subchannel-type-field.patch new file mode 100644 index 00000000000..14805ef706f --- /dev/null +++ b/queue-6.6/s390-cio-fix-tracepoint-subchannel-type-field.patch @@ -0,0 +1,38 @@ +From d8f2053ceee9ccb8e6f03f6b336419bc656e971e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 17:04:56 +0100 +Subject: s390/cio: fix tracepoint subchannel type field + +From: Peter Oberparleiter + +[ Upstream commit 8692a24d0fae19f674d51726d179ad04ba95d958 ] + +The subchannel-type field "st" of s390_cio_stsch and s390_cio_msch +tracepoints is incorrectly filled with the subchannel-enabled SCHIB +value "ena". Fix this by assigning the correct value. + +Fixes: d1de8633d96a ("s390 cio: Rewrite trace point class s390_class_schib") +Reviewed-by: Heiko Carstens +Signed-off-by: Peter Oberparleiter +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/cio/trace.h b/drivers/s390/cio/trace.h +index 86993de253451..a4c5c6736b310 100644 +--- a/drivers/s390/cio/trace.h ++++ b/drivers/s390/cio/trace.h +@@ -50,7 +50,7 @@ DECLARE_EVENT_CLASS(s390_class_schib, + __entry->devno = schib->pmcw.dev; + __entry->schib = *schib; + __entry->pmcw_ena = schib->pmcw.ena; +- __entry->pmcw_st = schib->pmcw.ena; ++ __entry->pmcw_st = schib->pmcw.st; + __entry->pmcw_dnv = schib->pmcw.dnv; + __entry->pmcw_dev = schib->pmcw.dev; + __entry->pmcw_lpm = schib->pmcw.lpm; +-- +2.43.0 + diff --git a/queue-6.6/s390-mm-re-enable-the-shared-zeropage-for-pv-and-ske.patch b/queue-6.6/s390-mm-re-enable-the-shared-zeropage-for-pv-and-ske.patch new file mode 100644 index 00000000000..0058ffaa5a1 --- /dev/null +++ b/queue-6.6/s390-mm-re-enable-the-shared-zeropage-for-pv-and-ske.patch @@ -0,0 +1,369 @@ +From 40eaf5033d58d46d1aa9ea14e10f1cd9807b0e55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 18:14:41 +0200 +Subject: s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests + +From: David Hildenbrand + +[ Upstream commit 06201e00ee3e4beacac48aab2b83eff64ebf0bc0 ] + +commit fa41ba0d08de ("s390/mm: avoid empty zero pages for KVM guests to +avoid postcopy hangs") introduced an undesired side effect when combined +with memory ballooning and VM migration: memory part of the inflated +memory balloon will consume memory. + +Assuming we have a 100GiB VM and inflated the balloon to 40GiB. Our VM +will consume ~60GiB of memory. If we now trigger a VM migration, +hypervisors like QEMU will read all VM memory. As s390x does not support +the shared zeropage, we'll end up allocating for all previously-inflated +memory part of the memory balloon: 50 GiB. So we might easily +(unexpectedly) crash the VM on the migration source. + +Even worse, hypervisors like QEMU optimize for zeropage migration to not +consume memory on the migration destination: when migrating a +"page full of zeroes", on the migration destination they check whether the +target memory is already zero (by reading the destination memory) and avoid +writing to the memory to not allocate memory: however, s390x will also +allocate memory here, implying that also on the migration destination, we +will end up allocating all previously-inflated memory part of the memory +balloon. + +This is especially bad if actual memory overcommit was not desired, when +memory ballooning is used for dynamic VM memory resizing, setting aside +some memory during boot that can be added later on demand. Alternatives +like virtio-mem that would avoid this issue are not yet available on +s390x. + +There could be ways to optimize some cases in user space: before reading +memory in an anonymous private mapping on the migration source, check via +/proc/self/pagemap if anything is already populated. Similarly check on +the migration destination before reading. While that would avoid +populating tables full of shared zeropages on all architectures, it's +harder to get right and performant, and requires user space changes. + +Further, with posctopy live migration we must place a page, so there, +"avoid touching memory to avoid allocating memory" is not really +possible. (Note that a previously we would have falsely inserted +shared zeropages into processes using UFFDIO_ZEROPAGE where +mm_forbids_zeropage() would have actually forbidden it) + +PV is currently incompatible with memory ballooning, and in the common +case, KVM guests don't make use of storage keys. Instead of zapping +zeropages when enabling storage keys / PV, that turned out to be +problematic in the past, let's do exactly the same we do with KSM pages: +trigger unsharing faults to replace the shared zeropages by proper +anonymous folios. + +What about added latency when enabling storage kes? Having a lot of +zeropages in applicable environments (PV, legacy guests, unittests) is +unexpected. Further, KSM could today already unshare the zeropages +and unmerging KSM pages when enabling storage kets would unshare the +KSM-placed zeropages in the same way, resulting in the same latency. + +[ agordeev: Fixed sparse and checkpatch complaints and error handling ] + +Reviewed-by: Christian Borntraeger +Tested-by: Christian Borntraeger +Fixes: fa41ba0d08de ("s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs") +Signed-off-by: David Hildenbrand +Link: https://lore.kernel.org/r/20240411161441.910170-3-david@redhat.com +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/gmap.h | 2 +- + arch/s390/include/asm/mmu.h | 5 + + arch/s390/include/asm/mmu_context.h | 1 + + arch/s390/include/asm/pgtable.h | 16 ++- + arch/s390/kvm/kvm-s390.c | 4 +- + arch/s390/mm/gmap.c | 165 +++++++++++++++++++++------- + 6 files changed, 146 insertions(+), 47 deletions(-) + +diff --git a/arch/s390/include/asm/gmap.h b/arch/s390/include/asm/gmap.h +index 5cc46e0dde620..9725586f42597 100644 +--- a/arch/s390/include/asm/gmap.h ++++ b/arch/s390/include/asm/gmap.h +@@ -146,7 +146,7 @@ int gmap_mprotect_notify(struct gmap *, unsigned long start, + + void gmap_sync_dirty_log_pmd(struct gmap *gmap, unsigned long dirty_bitmap[4], + unsigned long gaddr, unsigned long vmaddr); +-int gmap_mark_unmergeable(void); ++int s390_disable_cow_sharing(void); + void s390_unlist_old_asce(struct gmap *gmap); + int s390_replace_asce(struct gmap *gmap); + void s390_uv_destroy_pfns(unsigned long count, unsigned long *pfns); +diff --git a/arch/s390/include/asm/mmu.h b/arch/s390/include/asm/mmu.h +index 829d68e2c6858..a9e5db0f2836e 100644 +--- a/arch/s390/include/asm/mmu.h ++++ b/arch/s390/include/asm/mmu.h +@@ -33,6 +33,11 @@ typedef struct { + unsigned int uses_skeys:1; + /* The mmu context uses CMM. */ + unsigned int uses_cmm:1; ++ /* ++ * The mmu context allows COW-sharing of memory pages (KSM, zeropage). ++ * Note that COW-sharing during fork() is currently always allowed. ++ */ ++ unsigned int allow_cow_sharing:1; + /* The gmaps associated with this context are allowed to use huge pages. */ + unsigned int allow_gmap_hpage_1m:1; + } mm_context_t; +diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h +index 2a38af5a00c2d..8df6d09e9ca87 100644 +--- a/arch/s390/include/asm/mmu_context.h ++++ b/arch/s390/include/asm/mmu_context.h +@@ -36,6 +36,7 @@ static inline int init_new_context(struct task_struct *tsk, + mm->context.has_pgste = 0; + mm->context.uses_skeys = 0; + mm->context.uses_cmm = 0; ++ mm->context.allow_cow_sharing = 1; + mm->context.allow_gmap_hpage_1m = 0; + #endif + switch (mm->context.asce_limit) { +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index 38290b0078c56..548f8666a5ac9 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -565,10 +565,20 @@ static inline pud_t set_pud_bit(pud_t pud, pgprot_t prot) + } + + /* +- * In the case that a guest uses storage keys +- * faults should no longer be backed by zero pages ++ * As soon as the guest uses storage keys or enables PV, we deduplicate all ++ * mapped shared zeropages and prevent new shared zeropages from getting ++ * mapped. + */ +-#define mm_forbids_zeropage mm_has_pgste ++#define mm_forbids_zeropage mm_forbids_zeropage ++static inline int mm_forbids_zeropage(struct mm_struct *mm) ++{ ++#ifdef CONFIG_PGSTE ++ if (!mm->context.allow_cow_sharing) ++ return 1; ++#endif ++ return 0; ++} ++ + static inline int mm_uses_skeys(struct mm_struct *mm) + { + #ifdef CONFIG_PGSTE +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 1af55343a606b..36f60c3dae292 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -2632,9 +2632,7 @@ static int kvm_s390_handle_pv(struct kvm *kvm, struct kvm_pv_cmd *cmd) + if (r) + break; + +- mmap_write_lock(current->mm); +- r = gmap_mark_unmergeable(); +- mmap_write_unlock(current->mm); ++ r = s390_disable_cow_sharing(); + if (r) + break; + +diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c +index 0da54dc9430a9..1a656db09c9fe 100644 +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -2547,41 +2547,6 @@ static inline void thp_split_mm(struct mm_struct *mm) + } + #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ + +-/* +- * Remove all empty zero pages from the mapping for lazy refaulting +- * - This must be called after mm->context.has_pgste is set, to avoid +- * future creation of zero pages +- * - This must be called after THP was disabled. +- * +- * mm contracts with s390, that even if mm were to remove a page table, +- * racing with the loop below and so causing pte_offset_map_lock() to fail, +- * it will never insert a page table containing empty zero pages once +- * mm_forbids_zeropage(mm) i.e. mm->context.has_pgste is set. +- */ +-static int __zap_zero_pages(pmd_t *pmd, unsigned long start, +- unsigned long end, struct mm_walk *walk) +-{ +- unsigned long addr; +- +- for (addr = start; addr != end; addr += PAGE_SIZE) { +- pte_t *ptep; +- spinlock_t *ptl; +- +- ptep = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); +- if (!ptep) +- break; +- if (is_zero_pfn(pte_pfn(*ptep))) +- ptep_xchg_direct(walk->mm, addr, ptep, __pte(_PAGE_INVALID)); +- pte_unmap_unlock(ptep, ptl); +- } +- return 0; +-} +- +-static const struct mm_walk_ops zap_zero_walk_ops = { +- .pmd_entry = __zap_zero_pages, +- .walk_lock = PGWALK_WRLOCK, +-}; +- + /* + * switch on pgstes for its userspace process (for kvm) + */ +@@ -2599,22 +2564,142 @@ int s390_enable_sie(void) + mm->context.has_pgste = 1; + /* split thp mappings and disable thp for future mappings */ + thp_split_mm(mm); +- walk_page_range(mm, 0, TASK_SIZE, &zap_zero_walk_ops, NULL); + mmap_write_unlock(mm); + return 0; + } + EXPORT_SYMBOL_GPL(s390_enable_sie); + +-int gmap_mark_unmergeable(void) ++static int find_zeropage_pte_entry(pte_t *pte, unsigned long addr, ++ unsigned long end, struct mm_walk *walk) ++{ ++ unsigned long *found_addr = walk->private; ++ ++ /* Return 1 of the page is a zeropage. */ ++ if (is_zero_pfn(pte_pfn(*pte))) { ++ /* ++ * Shared zeropage in e.g., a FS DAX mapping? We cannot do the ++ * right thing and likely don't care: FAULT_FLAG_UNSHARE ++ * currently only works in COW mappings, which is also where ++ * mm_forbids_zeropage() is checked. ++ */ ++ if (!is_cow_mapping(walk->vma->vm_flags)) ++ return -EFAULT; ++ ++ *found_addr = addr; ++ return 1; ++ } ++ return 0; ++} ++ ++static const struct mm_walk_ops find_zeropage_ops = { ++ .pte_entry = find_zeropage_pte_entry, ++ .walk_lock = PGWALK_WRLOCK, ++}; ++ ++/* ++ * Unshare all shared zeropages, replacing them by anonymous pages. Note that ++ * we cannot simply zap all shared zeropages, because this could later ++ * trigger unexpected userfaultfd missing events. ++ * ++ * This must be called after mm->context.allow_cow_sharing was ++ * set to 0, to avoid future mappings of shared zeropages. ++ * ++ * mm contracts with s390, that even if mm were to remove a page table, ++ * and racing with walk_page_range_vma() calling pte_offset_map_lock() ++ * would fail, it will never insert a page table containing empty zero ++ * pages once mm_forbids_zeropage(mm) i.e. ++ * mm->context.allow_cow_sharing is set to 0. ++ */ ++static int __s390_unshare_zeropages(struct mm_struct *mm) ++{ ++ struct vm_area_struct *vma; ++ VMA_ITERATOR(vmi, mm, 0); ++ unsigned long addr; ++ vm_fault_t fault; ++ int rc; ++ ++ for_each_vma(vmi, vma) { ++ /* ++ * We could only look at COW mappings, but it's more future ++ * proof to catch unexpected zeropages in other mappings and ++ * fail. ++ */ ++ if ((vma->vm_flags & VM_PFNMAP) || is_vm_hugetlb_page(vma)) ++ continue; ++ addr = vma->vm_start; ++ ++retry: ++ rc = walk_page_range_vma(vma, addr, vma->vm_end, ++ &find_zeropage_ops, &addr); ++ if (rc < 0) ++ return rc; ++ else if (!rc) ++ continue; ++ ++ /* addr was updated by find_zeropage_pte_entry() */ ++ fault = handle_mm_fault(vma, addr, ++ FAULT_FLAG_UNSHARE | FAULT_FLAG_REMOTE, ++ NULL); ++ if (fault & VM_FAULT_OOM) ++ return -ENOMEM; ++ /* ++ * See break_ksm(): even after handle_mm_fault() returned 0, we ++ * must start the lookup from the current address, because ++ * handle_mm_fault() may back out if there's any difficulty. ++ * ++ * VM_FAULT_SIGBUS and VM_FAULT_SIGSEGV are unexpected but ++ * maybe they could trigger in the future on concurrent ++ * truncation. In that case, the shared zeropage would be gone ++ * and we can simply retry and make progress. ++ */ ++ cond_resched(); ++ goto retry; ++ } ++ ++ return 0; ++} ++ ++static int __s390_disable_cow_sharing(struct mm_struct *mm) + { ++ int rc; ++ ++ if (!mm->context.allow_cow_sharing) ++ return 0; ++ ++ mm->context.allow_cow_sharing = 0; ++ ++ /* Replace all shared zeropages by anonymous pages. */ ++ rc = __s390_unshare_zeropages(mm); + /* + * Make sure to disable KSM (if enabled for the whole process or + * individual VMAs). Note that nothing currently hinders user space + * from re-enabling it. + */ +- return ksm_disable(current->mm); ++ if (!rc) ++ rc = ksm_disable(mm); ++ if (rc) ++ mm->context.allow_cow_sharing = 1; ++ return rc; ++} ++ ++/* ++ * Disable most COW-sharing of memory pages for the whole process: ++ * (1) Disable KSM and unmerge/unshare any KSM pages. ++ * (2) Disallow shared zeropages and unshare any zerpages that are mapped. ++ * ++ * Not that we currently don't bother with COW-shared pages that are shared ++ * with parent/child processes due to fork(). ++ */ ++int s390_disable_cow_sharing(void) ++{ ++ int rc; ++ ++ mmap_write_lock(current->mm); ++ rc = __s390_disable_cow_sharing(current->mm); ++ mmap_write_unlock(current->mm); ++ return rc; + } +-EXPORT_SYMBOL_GPL(gmap_mark_unmergeable); ++EXPORT_SYMBOL_GPL(s390_disable_cow_sharing); + + /* + * Enable storage key handling from now on and initialize the storage +@@ -2683,7 +2768,7 @@ int s390_enable_skey(void) + goto out_up; + + mm->context.uses_skeys = 1; +- rc = gmap_mark_unmergeable(); ++ rc = __s390_disable_cow_sharing(mm); + if (rc) { + mm->context.uses_skeys = 0; + goto out_up; +-- +2.43.0 + diff --git a/queue-6.6/sched-core-fix-incorrect-initialization-of-the-burst.patch b/queue-6.6/sched-core-fix-incorrect-initialization-of-the-burst.patch new file mode 100644 index 00000000000..1d7cd23196b --- /dev/null +++ b/queue-6.6/sched-core-fix-incorrect-initialization-of-the-burst.patch @@ -0,0 +1,71 @@ +From 7dec9efa5c4997661a8b3adda881d6935f3afe90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 21:24:38 +0800 +Subject: sched/core: Fix incorrect initialization of the 'burst' parameter in + cpu_max_write() + +From: Cheng Yu + +[ Upstream commit 49217ea147df7647cb89161b805c797487783fc0 ] + +In the cgroup v2 CPU subsystem, assuming we have a +cgroup named 'test', and we set cpu.max and cpu.max.burst: + + # echo 1000000 > /sys/fs/cgroup/test/cpu.max + # echo 1000000 > /sys/fs/cgroup/test/cpu.max.burst + +then we check cpu.max and cpu.max.burst: + + # cat /sys/fs/cgroup/test/cpu.max + 1000000 100000 + # cat /sys/fs/cgroup/test/cpu.max.burst + 1000000 + +Next we set cpu.max again and check cpu.max and +cpu.max.burst: + + # echo 2000000 > /sys/fs/cgroup/test/cpu.max + # cat /sys/fs/cgroup/test/cpu.max + 2000000 100000 + + # cat /sys/fs/cgroup/test/cpu.max.burst + 1000 + +... we find that the cpu.max.burst value changed unexpectedly. + +In cpu_max_write(), the unit of the burst value returned +by tg_get_cfs_burst() is microseconds, while in cpu_max_write(), +the burst unit used for calculation should be nanoseconds, +which leads to the bug. + +To fix it, get the burst value directly from tg->cfs_bandwidth.burst. + +Fixes: f4183717b370 ("sched/fair: Introduce the burstable CFS controller") +Reported-by: Qixin Liao +Signed-off-by: Cheng Yu +Signed-off-by: Zhang Qiao +Signed-off-by: Ingo Molnar +Reviewed-by: Vincent Guittot +Tested-by: Vincent Guittot +Link: https://lore.kernel.org/r/20240424132438.514720-1-serein.chengyu@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 1f91e2c12731e..dcb30e304871a 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -11429,7 +11429,7 @@ static ssize_t cpu_max_write(struct kernfs_open_file *of, + { + struct task_group *tg = css_tg(of_css(of)); + u64 period = tg_get_cfs_period(tg); +- u64 burst = tg_get_cfs_burst(tg); ++ u64 burst = tg->cfs_bandwidth.burst; + u64 quota; + int ret; + +-- +2.43.0 + diff --git a/queue-6.6/sched-fair-add-eas-checks-before-updating-root_domai.patch b/queue-6.6/sched-fair-add-eas-checks-before-updating-root_domai.patch new file mode 100644 index 00000000000..b76c86366b7 --- /dev/null +++ b/queue-6.6/sched-fair-add-eas-checks-before-updating-root_domai.patch @@ -0,0 +1,148 @@ +From 44ec23e7d5db53b422621a1e17a8456b5f75abdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 14:27:23 +0530 +Subject: sched/fair: Add EAS checks before updating root_domain::overutilized + +From: Shrikanth Hegde + +[ Upstream commit be3a51e68f2f1b17250ce40d8872c7645b7a2991 ] + +root_domain::overutilized is only used for EAS(energy aware scheduler) +to decide whether to do load balance or not. It is not used if EAS +not possible. + +Currently enqueue_task_fair and task_tick_fair accesses, sometime updates +this field. In update_sd_lb_stats it is updated often. This causes cache +contention due to true sharing and burns a lot of cycles. ::overload and +::overutilized are part of the same cacheline. Updating it often invalidates +the cacheline. That causes access to ::overload to slow down due to +false sharing. Hence add EAS check before accessing/updating this field. +EAS check is optimized at compile time or it is a static branch. +Hence it shouldn't cost much. + +With the patch, both enqueue_task_fair and newidle_balance don't show +up as hot routines in perf profile. + + 6.8-rc4: + 7.18% swapper [kernel.vmlinux] [k] enqueue_task_fair + 6.78% s [kernel.vmlinux] [k] newidle_balance + + +patch: + 0.14% swapper [kernel.vmlinux] [k] enqueue_task_fair + 0.00% swapper [kernel.vmlinux] [k] newidle_balance + +While at it: trace_sched_overutilized_tp expect that second argument to +be bool. So do a int to bool conversion for that. + +Fixes: 2802bf3cd936 ("sched/fair: Add over-utilization/tipping point indicator") +Signed-off-by: Shrikanth Hegde +Signed-off-by: Ingo Molnar +Reviewed-by: Qais Yousef +Reviewed-by: Srikar Dronamraju +Reviewed-by: Vincent Guittot +Link: https://lore.kernel.org/r/20240307085725.444486-2-sshegde@linux.ibm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 53 +++++++++++++++++++++++++++++---------------- + 1 file changed, 34 insertions(+), 19 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 397ef27c9bdb1..01b3fc97ddc27 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -6564,22 +6564,42 @@ static inline void hrtick_update(struct rq *rq) + #ifdef CONFIG_SMP + static inline bool cpu_overutilized(int cpu) + { +- unsigned long rq_util_min = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MIN); +- unsigned long rq_util_max = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MAX); ++ unsigned long rq_util_min, rq_util_max; ++ ++ if (!sched_energy_enabled()) ++ return false; ++ ++ rq_util_min = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MIN); ++ rq_util_max = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MAX); + + /* Return true only if the utilization doesn't fit CPU's capacity */ + return !util_fits_cpu(cpu_util_cfs(cpu), rq_util_min, rq_util_max, cpu); + } + +-static inline void update_overutilized_status(struct rq *rq) ++static inline void set_rd_overutilized_status(struct root_domain *rd, ++ unsigned int status) + { +- if (!READ_ONCE(rq->rd->overutilized) && cpu_overutilized(rq->cpu)) { +- WRITE_ONCE(rq->rd->overutilized, SG_OVERUTILIZED); +- trace_sched_overutilized_tp(rq->rd, SG_OVERUTILIZED); +- } ++ if (!sched_energy_enabled()) ++ return; ++ ++ WRITE_ONCE(rd->overutilized, status); ++ trace_sched_overutilized_tp(rd, !!status); ++} ++ ++static inline void check_update_overutilized_status(struct rq *rq) ++{ ++ /* ++ * overutilized field is used for load balancing decisions only ++ * if energy aware scheduler is being used ++ */ ++ if (!sched_energy_enabled()) ++ return; ++ ++ if (!READ_ONCE(rq->rd->overutilized) && cpu_overutilized(rq->cpu)) ++ set_rd_overutilized_status(rq->rd, SG_OVERUTILIZED); + } + #else +-static inline void update_overutilized_status(struct rq *rq) { } ++static inline void check_update_overutilized_status(struct rq *rq) { } + #endif + + /* Runqueue only has SCHED_IDLE tasks enqueued */ +@@ -6680,7 +6700,7 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags) + * and the following generally works well enough in practice. + */ + if (!task_new) +- update_overutilized_status(rq); ++ check_update_overutilized_status(rq); + + enqueue_throttle: + assert_list_leaf_cfs_rq(rq); +@@ -10500,19 +10520,14 @@ static inline void update_sd_lb_stats(struct lb_env *env, struct sd_lb_stats *sd + env->fbq_type = fbq_classify_group(&sds->busiest_stat); + + if (!env->sd->parent) { +- struct root_domain *rd = env->dst_rq->rd; +- + /* update overload indicator if we are at root domain */ +- WRITE_ONCE(rd->overload, sg_status & SG_OVERLOAD); ++ WRITE_ONCE(env->dst_rq->rd->overload, sg_status & SG_OVERLOAD); + + /* Update over-utilization (tipping point, U >= 0) indicator */ +- WRITE_ONCE(rd->overutilized, sg_status & SG_OVERUTILIZED); +- trace_sched_overutilized_tp(rd, sg_status & SG_OVERUTILIZED); ++ set_rd_overutilized_status(env->dst_rq->rd, ++ sg_status & SG_OVERUTILIZED); + } else if (sg_status & SG_OVERUTILIZED) { +- struct root_domain *rd = env->dst_rq->rd; +- +- WRITE_ONCE(rd->overutilized, SG_OVERUTILIZED); +- trace_sched_overutilized_tp(rd, SG_OVERUTILIZED); ++ set_rd_overutilized_status(env->dst_rq->rd, SG_OVERUTILIZED); + } + + update_idle_cpu_scan(env, sum_util); +@@ -12503,7 +12518,7 @@ static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued) + task_tick_numa(rq, curr); + + update_misfit_status(curr, rq); +- update_overutilized_status(task_rq(curr)); ++ check_update_overutilized_status(task_rq(curr)); + + task_tick_core(rq, curr); + } +-- +2.43.0 + diff --git a/queue-6.6/sched-fair-allow-disabling-sched_balance_newidle-wit.patch b/queue-6.6/sched-fair-allow-disabling-sched_balance_newidle-wit.patch new file mode 100644 index 00000000000..d02f0d2efdb --- /dev/null +++ b/queue-6.6/sched-fair-allow-disabling-sched_balance_newidle-wit.patch @@ -0,0 +1,64 @@ +From 0691af6c5dd3867faa6d9cc77c63f781aa7e3f94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 18:05:23 +0300 +Subject: sched/fair: Allow disabling sched_balance_newidle with + sched_relax_domain_level + +From: Vitalii Bursov + +[ Upstream commit a1fd0b9d751f840df23ef0e75b691fc00cfd4743 ] + +Change relax_domain_level checks so that it would be possible +to include or exclude all domains from newidle balancing. + +This matches the behavior described in the documentation: + + -1 no request. use system default or follow request of others. + 0 no search. + 1 search siblings (hyperthreads in a core). + +"2" enables levels 0 and 1, level_max excludes the last (level_max) +level, and level_max+1 includes all levels. + +Fixes: 1d3504fcf560 ("sched, cpuset: customize sched domains, core") +Signed-off-by: Vitalii Bursov +Signed-off-by: Ingo Molnar +Tested-by: Dietmar Eggemann +Reviewed-by: Vincent Guittot +Reviewed-by: Valentin Schneider +Link: https://lore.kernel.org/r/bd6de28e80073c79466ec6401cdeae78f0d4423d.1714488502.git.vitaly@bursov.com +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 2 +- + kernel/sched/topology.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 1c2543edefeeb..679460ebccfbf 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -2229,7 +2229,7 @@ bool current_cpuset_is_being_rebound(void) + static int update_relax_domain_level(struct cpuset *cs, s64 val) + { + #ifdef CONFIG_SMP +- if (val < -1 || val >= sched_domain_level_max) ++ if (val < -1 || val > sched_domain_level_max + 1) + return -EINVAL; + #endif + +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 423d08947962c..8c1e183329d97 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1452,7 +1452,7 @@ static void set_domain_attribute(struct sched_domain *sd, + } else + request = attr->relax_domain_level; + +- if (sd->level > request) { ++ if (sd->level >= request) { + /* Turn off idle balance on this domain: */ + sd->flags &= ~(SD_BALANCE_WAKE|SD_BALANCE_NEWIDLE); + } +-- +2.43.0 + diff --git a/queue-6.6/sched-isolation-fix-boot-crash-when-maxcpus-first-ho.patch b/queue-6.6/sched-isolation-fix-boot-crash-when-maxcpus-first-ho.patch new file mode 100644 index 00000000000..46ad0d89d19 --- /dev/null +++ b/queue-6.6/sched-isolation-fix-boot-crash-when-maxcpus-first-ho.patch @@ -0,0 +1,78 @@ +From 26adadf6961715e403e2fb880378479855f25a03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Apr 2024 16:17:46 +0200 +Subject: sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU + +From: Oleg Nesterov + +[ Upstream commit 257bf89d84121280904800acd25cc2c444c717ae ] + +housekeeping_setup() checks cpumask_intersects(present, online) to ensure +that the kernel will have at least one housekeeping CPU after smp_init(), +but this doesn't work if the maxcpus= kernel parameter limits the number of +processors available after bootup. + +For example, a kernel with "maxcpus=2 nohz_full=0-2" parameters crashes at +boot time on a virtual machine with 4 CPUs. + +Change housekeeping_setup() to use cpumask_first_and() and check that the +returned CPU number is valid and less than setup_max_cpus. + +Another corner case is "nohz_full=0" on a machine with a single CPU or with +the maxcpus=1 kernel argument. In this case non_housekeeping_mask is empty +and tick_nohz_full_setup() makes no sense. And indeed, the kernel hits the +WARN_ON(tick_nohz_full_running) in tick_sched_do_timer(). + +And how should the kernel interpret the "nohz_full=" parameter? It should +be silently ignored, but currently cpulist_parse() happily returns the +empty cpumask and this leads to the same problem. + +Change housekeeping_setup() to check cpumask_empty(non_housekeeping_mask) +and do nothing in this case. + +Signed-off-by: Oleg Nesterov +Signed-off-by: Thomas Gleixner +Signed-off-by: Ingo Molnar +Reviewed-by: Phil Auld +Acked-by: Frederic Weisbecker +Link: https://lore.kernel.org/r/20240413141746.GA10008@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/sched/isolation.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c +index 373d42c707bc5..82e2f7fc7c267 100644 +--- a/kernel/sched/isolation.c ++++ b/kernel/sched/isolation.c +@@ -109,6 +109,7 @@ static void __init housekeeping_setup_type(enum hk_type type, + static int __init housekeeping_setup(char *str, unsigned long flags) + { + cpumask_var_t non_housekeeping_mask, housekeeping_staging; ++ unsigned int first_cpu; + int err = 0; + + if ((flags & HK_FLAG_TICK) && !(housekeeping.flags & HK_FLAG_TICK)) { +@@ -129,7 +130,8 @@ static int __init housekeeping_setup(char *str, unsigned long flags) + cpumask_andnot(housekeeping_staging, + cpu_possible_mask, non_housekeeping_mask); + +- if (!cpumask_intersects(cpu_present_mask, housekeeping_staging)) { ++ first_cpu = cpumask_first_and(cpu_present_mask, housekeeping_staging); ++ if (first_cpu >= nr_cpu_ids || first_cpu >= setup_max_cpus) { + __cpumask_set_cpu(smp_processor_id(), housekeeping_staging); + __cpumask_clear_cpu(smp_processor_id(), non_housekeeping_mask); + if (!housekeeping.flags) { +@@ -138,6 +140,9 @@ static int __init housekeeping_setup(char *str, unsigned long flags) + } + } + ++ if (cpumask_empty(non_housekeeping_mask)) ++ goto free_housekeeping_staging; ++ + if (!housekeeping.flags) { + /* First setup call ("nohz_full=" or "isolcpus=") */ + enum hk_type type; +-- +2.43.0 + diff --git a/queue-6.6/scsi-bfa-ensure-the-copied-buf-is-nul-terminated.patch b/queue-6.6/scsi-bfa-ensure-the-copied-buf-is-nul-terminated.patch new file mode 100644 index 00000000000..164f488a3f9 --- /dev/null +++ b/queue-6.6/scsi-bfa-ensure-the-copied-buf-is-nul-terminated.patch @@ -0,0 +1,49 @@ +From 46e41156fb658a8809ba34ccb10011c15fbdb804 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 21:44:20 +0700 +Subject: scsi: bfa: Ensure the copied buf is NUL terminated + +From: Bui Quang Minh + +[ Upstream commit 13d0cecb4626fae67c00c84d3c7851f6b62f7df3 ] + +Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from +userspace to that buffer. Later, we use sscanf on this buffer but we don't +ensure that the string is terminated inside the buffer, this can lead to +OOB read when using sscanf. Fix this issue by using memdup_user_nul instead +of memdup_user. + +Fixes: 9f30b674759b ("bfa: replace 2 kzalloc/copy_from_user by memdup_user") +Signed-off-by: Bui Quang Minh +Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-3-f1f1b53a10f4@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bfa/bfad_debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c +index 52db147d9979d..f6dd077d47c9a 100644 +--- a/drivers/scsi/bfa/bfad_debugfs.c ++++ b/drivers/scsi/bfa/bfad_debugfs.c +@@ -250,7 +250,7 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, + unsigned long flags; + void *kern_buf; + +- kern_buf = memdup_user(buf, nbytes); ++ kern_buf = memdup_user_nul(buf, nbytes); + if (IS_ERR(kern_buf)) + return PTR_ERR(kern_buf); + +@@ -317,7 +317,7 @@ bfad_debugfs_write_regwr(struct file *file, const char __user *buf, + unsigned long flags; + void *kern_buf; + +- kern_buf = memdup_user(buf, nbytes); ++ kern_buf = memdup_user_nul(buf, nbytes); + if (IS_ERR(kern_buf)) + return PTR_ERR(kern_buf); + +-- +2.43.0 + diff --git a/queue-6.6/scsi-hpsa-fix-allocation-size-for-scsi_host-private-.patch b/queue-6.6/scsi-hpsa-fix-allocation-size-for-scsi_host-private-.patch new file mode 100644 index 00000000000..3a5d7934c55 --- /dev/null +++ b/queue-6.6/scsi-hpsa-fix-allocation-size-for-scsi_host-private-.patch @@ -0,0 +1,41 @@ +From e308277f51ed637752232f17c7ed7a8169e4bc91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 20:04:47 +0300 +Subject: scsi: hpsa: Fix allocation size for Scsi_Host private data + +From: Yuri Karpov + +[ Upstream commit 504e2bed5d50610c1836046c0c195b0a6dba9c72 ] + +struct Scsi_Host private data contains pointer to struct ctlr_info. + +Restore allocation of only 8 bytes to store pointer in struct Scsi_Host +private data area. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bbbd25499100 ("scsi: hpsa: Fix allocation size for scsi_host_alloc()") +Signed-off-by: Yuri Karpov +Link: https://lore.kernel.org/r/20240312170447.743709-1-YKarpov@ispras.ru +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index af18d20f30794..49c57a9c110b5 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -5850,7 +5850,7 @@ static int hpsa_scsi_host_alloc(struct ctlr_info *h) + { + struct Scsi_Host *sh; + +- sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info)); ++ sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info *)); + if (sh == NULL) { + dev_err(&h->pdev->dev, "scsi_host_alloc failed\n"); + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/scsi-libsas-fix-the-failure-of-adding-phy-with-zero-.patch b/queue-6.6/scsi-libsas-fix-the-failure-of-adding-phy-with-zero-.patch new file mode 100644 index 00000000000..bb69b50491a --- /dev/null +++ b/queue-6.6/scsi-libsas-fix-the-failure-of-adding-phy-with-zero-.patch @@ -0,0 +1,55 @@ +From 3085506a520ba7b46bad4c3f1ca7840e0c029e26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 14:11:03 +0000 +Subject: scsi: libsas: Fix the failure of adding phy with zero-address to port + +From: Xingui Yang + +[ Upstream commit 06036a0a5db34642c5dbe22021a767141f010b7a ] + +As of commit 7d1d86518118 ("[SCSI] libsas: fix false positive 'device +attached' conditions"), reset the phy->entacted_sas_addr address to a +zero-address when the link rate is less than 1.5G. + +Currently we find that when a new device is attached, and the link rate is +less than 1.5G, but the device type is not NO_DEVICE, for example: the link +rate is SAS_PHY_RESET_IN_PROGRESS and the device type is stp. After setting +the phy->entacted_sas_addr address to the zero address, the port will +continue to be created for the phy with the zero-address, and other phys +with the zero-address will be tried to be added to the new port: + +[562240.051197] sas: ex 500e004aaaaaaa1f phy19:U:0 attached: 0000000000000000 (no device) +// phy19 is deleted but still on the parent port's phy_list +[562240.062536] sas: ex 500e004aaaaaaa1f phy0 new device attached +[562240.062616] sas: ex 500e004aaaaaaa1f phy00:U:5 attached: 0000000000000000 (stp) +[562240.062680] port-7:7:0: trying to add phy phy-7:7:19 fails: it's already part of another port + +Therefore, it should be the same as sas_get_phy_attached_dev(). Only when +device_type is SAS_PHY_UNUSED, sas_address is set to the 0 address. + +Fixes: 7d1d86518118 ("[SCSI] libsas: fix false positive 'device attached' conditions") +Signed-off-by: Xingui Yang +Link: https://lore.kernel.org/r/20240312141103.31358-5-yangxingui@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_expander.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index f6e6db8b8aba9..e97f4e01a865a 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -239,8 +239,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, + /* help some expanders that fail to zero sas_address in the 'no + * device' case + */ +- if (phy->attached_dev_type == SAS_PHY_UNUSED || +- phy->linkrate < SAS_LINK_RATE_1_5_GBPS) ++ if (phy->attached_dev_type == SAS_PHY_UNUSED) + memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE); + else + memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE); +-- +2.43.0 + diff --git a/queue-6.6/scsi-qedf-ensure-the-copied-buf-is-nul-terminated.patch b/queue-6.6/scsi-qedf-ensure-the-copied-buf-is-nul-terminated.patch new file mode 100644 index 00000000000..d048fb83887 --- /dev/null +++ b/queue-6.6/scsi-qedf-ensure-the-copied-buf-is-nul-terminated.patch @@ -0,0 +1,40 @@ +From 5872557c351e6f33d589ad94753bd001285b4a20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 21:44:21 +0700 +Subject: scsi: qedf: Ensure the copied buf is NUL terminated + +From: Bui Quang Minh + +[ Upstream commit d0184a375ee797eb657d74861ba0935b6e405c62 ] + +Currently, we allocate a count-sized kernel buffer and copy count from +userspace to that buffer. Later, we use kstrtouint on this buffer but we +don't ensure that the string is terminated inside the buffer, this can +lead to OOB read when using kstrtouint. Fix this issue by using +memdup_user_nul instead of memdup_user. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Signed-off-by: Bui Quang Minh +Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-4-f1f1b53a10f4@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c +index 451fd236bfd05..96174353e3898 100644 +--- a/drivers/scsi/qedf/qedf_debugfs.c ++++ b/drivers/scsi/qedf/qedf_debugfs.c +@@ -170,7 +170,7 @@ qedf_dbg_debug_cmd_write(struct file *filp, const char __user *buffer, + if (!count || *ppos) + return 0; + +- kern_buf = memdup_user(buffer, count); ++ kern_buf = memdup_user_nul(buffer, count); + if (IS_ERR(kern_buf)) + return PTR_ERR(kern_buf); + +-- +2.43.0 + diff --git a/queue-6.6/scsi-qla2xxx-fix-debugfs-output-for-fw_resource_coun.patch b/queue-6.6/scsi-qla2xxx-fix-debugfs-output-for-fw_resource_coun.patch new file mode 100644 index 00000000000..b5fe02705ed --- /dev/null +++ b/queue-6.6/scsi-qla2xxx-fix-debugfs-output-for-fw_resource_coun.patch @@ -0,0 +1,43 @@ +From a5b2ea4ddb3513ef13df6c5363f5c9587d48aaa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 02:00:56 +0000 +Subject: scsi: qla2xxx: Fix debugfs output for fw_resource_count + +From: Himanshu Madhani + +[ Upstream commit 998d09c5ef6183bd8137d1a892ba255b15978bb4 ] + +DebugFS output for fw_resource_count shows: + +estimate exchange used[0] high water limit [1945] n estimate iocb2 used [0] high water limit [5141] + estimate exchange2 used[0] high water limit [1945] + +Which shows incorrect display due to missing newline in seq_print(). + +[mkp: fix checkpatch warning about space before newline] + +Fixes: 5f63a163ed2f ("scsi: qla2xxx: Fix exchange oversubscription for management commands") +Signed-off-by: Himanshu Madhani +Link: https://lore.kernel.org/r/20240426020056.3639406-1-himanshu.madhani@oracle.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_dfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c +index a7a364760b800..081af4d420a05 100644 +--- a/drivers/scsi/qla2xxx/qla_dfs.c ++++ b/drivers/scsi/qla2xxx/qla_dfs.c +@@ -274,7 +274,7 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused) + seq_printf(s, "Driver: estimate iocb used [%d] high water limit [%d]\n", + iocbs_used, ha->base_qpair->fwres.iocbs_limit); + +- seq_printf(s, "estimate exchange used[%d] high water limit [%d] n", ++ seq_printf(s, "estimate exchange used[%d] high water limit [%d]\n", + exch_used, ha->base_qpair->fwres.exch_limit); + + if (ql2xenforce_iocb_limit == 2) { +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-cdns-pltfrm-perform-read-back-after-writing.patch b/queue-6.6/scsi-ufs-cdns-pltfrm-perform-read-back-after-writing.patch new file mode 100644 index 00000000000..03af14d0244 --- /dev/null +++ b/queue-6.6/scsi-ufs-cdns-pltfrm-perform-read-back-after-writing.patch @@ -0,0 +1,50 @@ +From 5ff19e30be8cb564378571ec55c5f0722e3068d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:48 -0500 +Subject: scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV + +From: Andrew Halaney + +[ Upstream commit b715c55daf598aac8fa339048e4ca8a0916b332e ] + +Currently, HCLKDIV is written to and then completed with an mb(). + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. Because the mb()'s purpose +wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Fixes: d90996dae8e4 ("scsi: ufs: Add UFS platform driver for Cadence UFS") +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-6-181252004586@redhat.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/cdns-pltfrm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ufs/host/cdns-pltfrm.c b/drivers/ufs/host/cdns-pltfrm.c +index 2491e7e870283..56014ef302b49 100644 +--- a/drivers/ufs/host/cdns-pltfrm.c ++++ b/drivers/ufs/host/cdns-pltfrm.c +@@ -136,7 +136,7 @@ static int cdns_ufs_set_hclkdiv(struct ufs_hba *hba) + * Make sure the register was updated, + * UniPro layer will not work with an incorrect value. + */ +- mb(); ++ ufshcd_readl(hba, CDNS_UFS_REG_HCLKDIV); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-core-mcq-fix-ufshcd_mcq_sqe_search.patch b/queue-6.6/scsi-ufs-core-mcq-fix-ufshcd_mcq_sqe_search.patch new file mode 100644 index 00000000000..ef16895d9ff --- /dev/null +++ b/queue-6.6/scsi-ufs-core-mcq-fix-ufshcd_mcq_sqe_search.patch @@ -0,0 +1,50 @@ +From 40041758eedd9c6370bd04d00a4e8b10c8530e92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 17:07:45 -0700 +Subject: scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search() + +From: Bart Van Assche + +[ Upstream commit 3c5d0dce8ce0a2781ac306b9ad1492b005ecbab5 ] + +Fix the calculation of the utrd pointer. This patch addresses the following +Coverity complaint: + +CID 1538170: (#1 of 1): Extra sizeof expression (SIZEOF_MISMATCH) +suspicious_pointer_arithmetic: Adding sq_head_slot * 32UL /* sizeof (struct +utp_transfer_req_desc) */ to pointer hwq->sqe_base_addr of type struct +utp_transfer_req_desc * is suspicious because adding an integral value to +this pointer automatically scales that value by the size, 32 bytes, of the +pointed-to type, struct utp_transfer_req_desc. Most likely, the +multiplication by sizeof (struct utp_transfer_req_desc) in this expression +is extraneous and should be eliminated. + +Cc: Bao D. Nguyen +Cc: Stanley Chu +Cc: Can Guo +Fixes: 8d7290348992 ("scsi: ufs: mcq: Add supporting functions for MCQ abort") +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20240410000751.1047758-1-bvanassche@acm.org +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufs-mcq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c +index c873fd8239427..7ae3096814282 100644 +--- a/drivers/ufs/core/ufs-mcq.c ++++ b/drivers/ufs/core/ufs-mcq.c +@@ -597,8 +597,7 @@ static bool ufshcd_mcq_sqe_search(struct ufs_hba *hba, + addr = le64_to_cpu(cmd_desc_base_addr) & CQE_UCD_BA; + + while (sq_head_slot != hwq->sq_tail_slot) { +- utrd = hwq->sqe_base_addr + +- sq_head_slot * sizeof(struct utp_transfer_req_desc); ++ utrd = hwq->sqe_base_addr + sq_head_slot; + match = le64_to_cpu(utrd->command_desc_base_addr) & CQE_UCD_BA; + if (addr == match) { + ufshcd_mcq_nullify_sqe(utrd); +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-core-perform-read-back-after-disabling-inte.patch b/queue-6.6/scsi-ufs-core-perform-read-back-after-disabling-inte.patch new file mode 100644 index 00000000000..614e1741a22 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-perform-read-back-after-disabling-inte.patch @@ -0,0 +1,53 @@ +From c960f901fc3836dea5806a7488789218379fa20e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:50 -0500 +Subject: scsi: ufs: core: Perform read back after disabling interrupts + +From: Andrew Halaney + +[ Upstream commit e4a628877119bd40164a651d20321247b6f94a8b ] + +Currently, interrupts are cleared and disabled prior to registering the +interrupt. An mb() is used to complete the clear/disable writes before the +interrupt is registered. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring these +bits have taken effect on the device is to perform a read back to force it +to make it all the way to the device. This is documented in device-io.rst +and a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure these bits hit the device. Because the mb()'s +purpose wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Fixes: 199ef13cac7d ("scsi: ufs: avoid spurious UFS host controller interrupts") +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Bart Van Assche +Reviewed-by: Can Guo +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-8-181252004586@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index cd1b9db8543dc..2371b00c56be9 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -10369,7 +10369,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) + * Make sure that UFS interrupts are disabled and any pending interrupt + * status is cleared before registering UFS interrupt handler. + */ +- mb(); ++ ufshcd_readl(hba, REG_INTERRUPT_ENABLE); + + /* IRQ registration */ + err = devm_request_irq(dev, irq, ufshcd_intr, IRQF_SHARED, UFSHCD, hba); +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-core-perform-read-back-after-disabling-uic_.patch b/queue-6.6/scsi-ufs-core-perform-read-back-after-disabling-uic_.patch new file mode 100644 index 00000000000..6c8a66c6bf4 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-perform-read-back-after-disabling-uic_.patch @@ -0,0 +1,52 @@ +From 62c8df03f261ccd5dd4763f21f1a862b0c46b5e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:51 -0500 +Subject: scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL + +From: Andrew Halaney + +[ Upstream commit 4bf3855497b60765ca03b983d064b25e99b97657 ] + +Currently, the UIC_COMMAND_COMPL interrupt is disabled and a wmb() is used +to complete the register write before any following writes. + +wmb() ensures the writes complete in that order, but completion doesn't +mean that it isn't stored in a buffer somewhere. The recommendation for +ensuring this bit has taken effect on the device is to perform a read back +to force it to make it all the way to the device. This is documented in +device-io.rst and a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. Because the wmb()'s +purpose wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Fixes: d75f7fe495cf ("scsi: ufs: reduce the interrupts for power mode change requests") +Reviewed-by: Bart Van Assche +Reviewed-by: Can Guo +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-9-181252004586@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 2371b00c56be9..589c90f4d4021 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -4136,7 +4136,7 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd) + * Make sure UIC command completion interrupt is disabled before + * issuing UIC command. + */ +- wmb(); ++ ufshcd_readl(hba, REG_INTERRUPT_ENABLE); + reenable_intr = true; + } + spin_unlock_irqrestore(hba->host->host_lock, flags); +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-core-perform-read-back-after-writing-utp_ta.patch b/queue-6.6/scsi-ufs-core-perform-read-back-after-writing-utp_ta.patch new file mode 100644 index 00000000000..314eb6abeca --- /dev/null +++ b/queue-6.6/scsi-ufs-core-perform-read-back-after-writing-utp_ta.patch @@ -0,0 +1,53 @@ +From 52f8beaea74a18a297c67063828ba2d25a1ff215 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:49 -0500 +Subject: scsi: ufs: core: Perform read back after writing + UTP_TASK_REQ_LIST_BASE_H + +From: Andrew Halaney + +[ Upstream commit 408e28086f1c7a6423efc79926a43d7001902fae ] + +Currently, the UTP_TASK_REQ_LIST_BASE_L/UTP_TASK_REQ_LIST_BASE_H regs are +written to and then completed with an mb(). + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring these +bits have taken effect on the device is to perform a read back to force it +to make it all the way to the device. This is documented in device-io.rst +and a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bits hit the device. Because the mb()'s purpose +wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Fixes: 88441a8d355d ("scsi: ufs: core: Add hibernation callbacks") +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Bart Van Assche +Reviewed-by: Can Guo +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-7-181252004586@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 344806330be16..cd1b9db8543dc 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -10152,7 +10152,7 @@ int ufshcd_system_restore(struct device *dev) + * are updated with the latest queue addresses. Only after + * updating these addresses, we can queue the new commands. + */ +- mb(); ++ ufshcd_readl(hba, REG_UTP_TASK_REQ_LIST_BASE_H); + + /* Resuming from hibernate, assume that link was OFF */ + ufshcd_set_link_off(hba); +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-cgc-en.patch b/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-cgc-en.patch new file mode 100644 index 00000000000..a32c6e24105 --- /dev/null +++ b/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-cgc-en.patch @@ -0,0 +1,51 @@ +From 6e303d506f6a28ebb4a281f17828d3bb53a3ccb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:47 -0500 +Subject: scsi: ufs: qcom: Perform read back after writing CGC enable + +From: Andrew Halaney + +[ Upstream commit d9488511b3ac7eb48a91bc5eded7027525525e03 ] + +Currently, the CGC enable bit is written and then an mb() is used to ensure +that completes before continuing. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. Because the mb()'s purpose +wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Can Guo +Fixes: 81c0fc51b7a7 ("ufs-qcom: add support for Qualcomm Technologies Inc platforms") +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-5-181252004586@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-qcom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c +index 1f2a64d797c79..922ae1d76d909 100644 +--- a/drivers/ufs/host/ufs-qcom.c ++++ b/drivers/ufs/host/ufs-qcom.c +@@ -498,7 +498,7 @@ static void ufs_qcom_enable_hw_clk_gating(struct ufs_hba *hba) + REG_UFS_CFG2); + + /* Ensure that HW clock gating is enabled before next operations */ +- mb(); ++ ufshcd_readl(hba, REG_UFS_CFG2); + } + + static int ufs_qcom_hce_enable_notify(struct ufs_hba *hba, +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-reg_uf.patch b/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-reg_uf.patch new file mode 100644 index 00000000000..7ba010e5f8c --- /dev/null +++ b/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-reg_uf.patch @@ -0,0 +1,51 @@ +From 08479f8857f697f8d51452fe20749221e869f34a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:44 -0500 +Subject: scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US + +From: Andrew Halaney + +[ Upstream commit a862fafa263aea0f427d51aca6ff7fd9eeaaa8bd ] + +Currently after writing to REG_UFS_SYS1CLK_1US a mb() is used to ensure +that write has gone through to the device. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. Because the mb()'s purpose +wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Fixes: f06fcc7155dc ("scsi: ufs-qcom: add QUniPro hardware support and power optimizations") +Reviewed-by: Can Guo +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-2-181252004586@redhat.com +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-qcom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c +index 797219db026bc..559b4cab16a3e 100644 +--- a/drivers/ufs/host/ufs-qcom.c ++++ b/drivers/ufs/host/ufs-qcom.c +@@ -597,7 +597,7 @@ static int ufs_qcom_cfg_timers(struct ufs_hba *hba, u32 gear, + * make sure above write gets applied before we return from + * this function. + */ +- mb(); ++ ufshcd_readl(hba, REG_UFS_SYS1CLK_1US); + } + + if (ufs_qcom_cap_qunipro(host)) +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-reset-.patch b/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-reset-.patch new file mode 100644 index 00000000000..d5ef21643f3 --- /dev/null +++ b/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-reset-.patch @@ -0,0 +1,71 @@ +From 628205a02f452fb2b932e45463f46b23ccdb4cac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:43 -0500 +Subject: scsi: ufs: qcom: Perform read back after writing reset bit + +From: Andrew Halaney + +[ Upstream commit c4d28e06b0c94636f6e35d003fa9ebac0a94e1ae ] + +Currently, the reset bit for the UFS provided reset controller (used by its +phy) is written to, and then a mb() happens to try and ensure that hit the +device. Immediately afterwards a usleep_range() occurs. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. By doing so and +guaranteeing the ordering against the immediately following usleep_range(), +the mb() can safely be removed. + +Fixes: 81c0fc51b7a7 ("ufs-qcom: add support for Qualcomm Technologies Inc platforms") +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Can Guo +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-1-181252004586@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-qcom.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/ufs/host/ufs-qcom.h b/drivers/ufs/host/ufs-qcom.h +index d6f8e74bd5381..532667d8e6f0e 100644 +--- a/drivers/ufs/host/ufs-qcom.h ++++ b/drivers/ufs/host/ufs-qcom.h +@@ -149,10 +149,10 @@ static inline void ufs_qcom_assert_reset(struct ufs_hba *hba) + REG_UFS_CFG1); + + /* +- * Make sure assertion of ufs phy reset is written to +- * register before returning ++ * Dummy read to ensure the write takes effect before doing any sort ++ * of delay + */ +- mb(); ++ ufshcd_readl(hba, REG_UFS_CFG1); + } + + static inline void ufs_qcom_deassert_reset(struct ufs_hba *hba) +@@ -161,10 +161,10 @@ static inline void ufs_qcom_deassert_reset(struct ufs_hba *hba) + REG_UFS_CFG1); + + /* +- * Make sure de-assertion of ufs phy reset is written to +- * register before returning ++ * Dummy read to ensure the write takes effect before doing any sort ++ * of delay + */ +- mb(); ++ ufshcd_readl(hba, REG_UFS_CFG1); + } + + /* Host controller hardware version: major.minor.step */ +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-unipro.patch b/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-unipro.patch new file mode 100644 index 00000000000..eb2bf83767d --- /dev/null +++ b/queue-6.6/scsi-ufs-qcom-perform-read-back-after-writing-unipro.patch @@ -0,0 +1,52 @@ +From 76f6d013f5f4c954cee747eeef10707c802f00bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:46 -0500 +Subject: scsi: ufs: qcom: Perform read back after writing unipro mode + +From: Andrew Halaney + +[ Upstream commit 823150ecf04f958213cf3bf162187cd1a91c885c ] + +Currently, the QUNIPRO_SEL bit is written to and then an mb() is used to +ensure that completes before continuing. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +But, there's really no reason to even ensure completion before +continuing. The only requirement here is that this write is ordered to this +endpoint (which readl()/writel() guarantees already). For that reason the +mb() can be dropped altogether without anything forcing completion. + +Fixes: f06fcc7155dc ("scsi: ufs-qcom: add QUniPro hardware support and power optimizations") +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-4-181252004586@redhat.com +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-qcom.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c +index 559b4cab16a3e..1f2a64d797c79 100644 +--- a/drivers/ufs/host/ufs-qcom.c ++++ b/drivers/ufs/host/ufs-qcom.c +@@ -373,9 +373,6 @@ static void ufs_qcom_select_unipro_mode(struct ufs_qcom_host *host) + + if (host->hw_ver.major >= 0x05) + ufshcd_rmwl(host->hba, QUNIPRO_G4_SEL, 0, REG_UFS_CFG0); +- +- /* make sure above configuration is applied before we return */ +- mb(); + } + + /* +-- +2.43.0 + diff --git a/queue-6.6/selftests-binderfs-use-the-makefile-s-rules-not-make.patch b/queue-6.6/selftests-binderfs-use-the-makefile-s-rules-not-make.patch new file mode 100644 index 00000000000..c92756dbc13 --- /dev/null +++ b/queue-6.6/selftests-binderfs-use-the-makefile-s-rules-not-make.patch @@ -0,0 +1,71 @@ +From 1237f455e99af880486ff7005f4a0813fd2d98ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 18:58:20 -0700 +Subject: selftests/binderfs: use the Makefile's rules, not Make's implicit + rules + +From: John Hubbard + +[ Upstream commit 019baf635eb6ffe8d6c1343f81788f02a7e0ed98 ] + +First of all, in order to build with clang at all, one must first apply +Valentin Obst's build fix for LLVM [1]. Once that is done, then when +building with clang, via: + + make LLVM=1 -C tools/testing/selftests + +...the following error occurs: + + clang: error: cannot specify -o when generating multiple output files + +This is because clang, unlike gcc, won't accept invocations of this +form: + + clang file1.c header2.h + +While trying to fix this, I noticed that: + +a) selftests/lib.mk already avoids the problem, and + +b) The binderfs Makefile indavertently bypasses the selftests/lib.mk +build system, and quitely uses Make's implicit build rules for .c files +instead. + +The Makefile attempts to set up both a dependency and a source file, +neither of which was needed, because lib.mk is able to automatically +handle both. This line: + + binderfs_test: binderfs_test.c + +...causes Make's implicit rules to run, which builds binderfs_test +without ever looking at lib.mk. + +Fix this by simply deleting the "binderfs_test:" Makefile target and +letting lib.mk handle it instead. + +[1] https://lore.kernel.org/all/20240329-selftests-libmk-llvm-rfc-v1-1-2f9ed7d1c49f@valentinobst.de/ + +Fixes: 6e29225af902 ("binderfs: port tests to test harness infrastructure") +Cc: Christian Brauner +Signed-off-by: John Hubbard +Reviewed-by: Christian Brauner +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/filesystems/binderfs/Makefile | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/selftests/filesystems/binderfs/Makefile b/tools/testing/selftests/filesystems/binderfs/Makefile +index c2f7cef919c04..eb4c3b4119348 100644 +--- a/tools/testing/selftests/filesystems/binderfs/Makefile ++++ b/tools/testing/selftests/filesystems/binderfs/Makefile +@@ -3,6 +3,4 @@ + CFLAGS += $(KHDR_INCLUDES) -pthread + TEST_GEN_PROGS := binderfs_test + +-binderfs_test: binderfs_test.c ../../kselftest.h ../../kselftest_harness.h +- + include ../../lib.mk +-- +2.43.0 + diff --git a/queue-6.6/selftests-bpf-fix-a-fd-leak-in-error-paths-in-open_n.patch b/queue-6.6/selftests-bpf-fix-a-fd-leak-in-error-paths-in-open_n.patch new file mode 100644 index 00000000000..0c07dd63555 --- /dev/null +++ b/queue-6.6/selftests-bpf-fix-a-fd-leak-in-error-paths-in-open_n.patch @@ -0,0 +1,40 @@ +From 45eb3414d762a1f9b533822ba8295dfcf3845611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 18:35:27 +0800 +Subject: selftests/bpf: Fix a fd leak in error paths in open_netns + +From: Geliang Tang + +[ Upstream commit 151f7442436658ee84076681d8f52e987fe147ea ] + +As Martin mentioned in review comment, there is an existing bug that +orig_netns_fd will be leaked in the later "goto fail;" case after +open("/proc/self/ns/net") in open_netns() in network_helpers.c. This +patch adds "close(token->orig_netns_fd);" before "free(token);" to +fix it. + +Fixes: a30338840fa5 ("selftests/bpf: Move open_netns() and close_netns() into network_helpers.c") +Signed-off-by: Geliang Tang +Link: https://lore.kernel.org/r/a104040b47c3c34c67f3f125cdfdde244a870d3c.1713868264.git.tanggeliang@kylinos.cn +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/network_helpers.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c +index da72a3a662300..0877b60ec81f6 100644 +--- a/tools/testing/selftests/bpf/network_helpers.c ++++ b/tools/testing/selftests/bpf/network_helpers.c +@@ -427,6 +427,8 @@ struct nstoken *open_netns(const char *name) + + return token; + fail: ++ if (token->orig_netns_fd != -1) ++ close(token->orig_netns_fd); + free(token); + return NULL; + } +-- +2.43.0 + diff --git a/queue-6.6/selftests-bpf-fix-pointer-arithmetic-in-test_xdp_do_.patch b/queue-6.6/selftests-bpf-fix-pointer-arithmetic-in-test_xdp_do_.patch new file mode 100644 index 00000000000..f9f4155df4f --- /dev/null +++ b/queue-6.6/selftests-bpf-fix-pointer-arithmetic-in-test_xdp_do_.patch @@ -0,0 +1,62 @@ +From 803b8e9aa2b2dfd99f588dda817ff646601da09a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 16:50:22 +0200 +Subject: selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Schmidt + +[ Upstream commit e549b39a0ab8880d7ae6c6495b00fc1cb8f36174 ] + +Cast operation has a higher precedence than addition. The code here +wants to zero the 2nd half of the 64-bit metadata, but due to a pointer +arithmetic mistake, it writes the zero at offset 16 instead. + +Just adding parentheses around "data + 4" would fix this, but I think +this will be slightly better readable with array syntax. + +I was unable to test this with tools/testing/selftests/bpf/vmtest.sh, +because my glibc is newer than glibc in the provided VM image. +So I just checked the difference in the compiled code. +objdump -S tools/testing/selftests/bpf/xdp_do_redirect.test.o: + - *((__u32 *)data) = 0x42; /* metadata test value */ + + ((__u32 *)data)[0] = 0x42; /* metadata test value */ + be7: 48 8d 85 30 fc ff ff lea -0x3d0(%rbp),%rax + bee: c7 00 42 00 00 00 movl $0x42,(%rax) + - *((__u32 *)data + 4) = 0; + + ((__u32 *)data)[1] = 0; + bf4: 48 8d 85 30 fc ff ff lea -0x3d0(%rbp),%rax + - bfb: 48 83 c0 10 add $0x10,%rax + + bfb: 48 83 c0 04 add $0x4,%rax + bff: c7 00 00 00 00 00 movl $0x0,(%rax) + +Fixes: 5640b6d89434 ("selftests/bpf: fix "metadata marker" getting overwritten by the netstack") +Signed-off-by: Michal Schmidt +Signed-off-by: Andrii Nakryiko +Reviewed-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/bpf/20240506145023.214248-1-mschmidt@redhat.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c +index 498d3bdaa4b0b..bad0ea167be70 100644 +--- a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c ++++ b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c +@@ -107,8 +107,8 @@ void test_xdp_do_redirect(void) + .attach_point = BPF_TC_INGRESS); + + memcpy(&data[sizeof(__u64)], &pkt_udp, sizeof(pkt_udp)); +- *((__u32 *)data) = 0x42; /* metadata test value */ +- *((__u32 *)data + 4) = 0; ++ ((__u32 *)data)[0] = 0x42; /* metadata test value */ ++ ((__u32 *)data)[1] = 0; + + skel = test_xdp_do_redirect__open(); + if (!ASSERT_OK_PTR(skel, "skel")) +-- +2.43.0 + diff --git a/queue-6.6/selftests-bpf-fix-umount-cgroup2-error-in-test_sockm.patch b/queue-6.6/selftests-bpf-fix-umount-cgroup2-error-in-test_sockm.patch new file mode 100644 index 00000000000..35aca9058e4 --- /dev/null +++ b/queue-6.6/selftests-bpf-fix-umount-cgroup2-error-in-test_sockm.patch @@ -0,0 +1,43 @@ +From 20e1cb254be4efa102b62ee5565a640544e8ab5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 13:18:40 +0800 +Subject: selftests/bpf: Fix umount cgroup2 error in test_sockmap + +From: Geliang Tang + +[ Upstream commit d75142dbeb2bd1587b9cc19f841578f541275a64 ] + +This patch fixes the following "umount cgroup2" error in test_sockmap.c: + + (cgroup_helpers.c:353: errno: Device or resource busy) umount cgroup2 + +Cgroup fd cg_fd should be closed before cleanup_cgroup_environment(). + +Fixes: 13a5f3ffd202 ("bpf: Selftests, sockmap test prog run without setting cgroup") +Signed-off-by: Geliang Tang +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/0399983bde729708773416b8488bac2cd5e022b8.1712639568.git.tanggeliang@kylinos.cn +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_sockmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c +index 024a0faafb3be..43612de44fbf5 100644 +--- a/tools/testing/selftests/bpf/test_sockmap.c ++++ b/tools/testing/selftests/bpf/test_sockmap.c +@@ -2104,9 +2104,9 @@ int main(int argc, char **argv) + free(options.whitelist); + if (options.blacklist) + free(options.blacklist); ++ close(cg_fd); + if (cg_created) + cleanup_cgroup_environment(); +- close(cg_fd); + return err; + } + +-- +2.43.0 + diff --git a/queue-6.6/selftests-cgroup-skip-test_cgcore_lesser_ns_open-whe.patch b/queue-6.6/selftests-cgroup-skip-test_cgcore_lesser_ns_open-whe.patch new file mode 100644 index 00000000000..1babc7c7156 --- /dev/null +++ b/queue-6.6/selftests-cgroup-skip-test_cgcore_lesser_ns_open-whe.patch @@ -0,0 +1,207 @@ +From 0020160e5b61539c93c2aa78e61dec9c712f75fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 10:44:37 +0800 +Subject: selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 + mounted without nsdelegate + +From: Tianchen Ding + +[ Upstream commit 4793cb599b1bdc3d356f0374c2c99ffe890ae876 ] + +The test case test_cgcore_lesser_ns_open only tasks effect when cgroup2 +is mounted with "nsdelegate" mount option. If it misses this option, or +is remounted without "nsdelegate", the test case will fail. For example, +running bpf/test_cgroup_storage first, and then run cgroup/test_core will +fail on test_cgcore_lesser_ns_open. Skip it if "nsdelegate" is not +detected in cgroup2 mount options. + +Fixes: bf35a7879f1d ("selftests: cgroup: Test open-time cgroup namespace usage for migration checks") +Signed-off-by: Tianchen Ding +Reviewed-by: Muhammad Usama Anjum +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/cgroup/cgroup_util.c | 8 +++++--- + tools/testing/selftests/cgroup/cgroup_util.h | 2 +- + tools/testing/selftests/cgroup/test_core.c | 7 ++++++- + tools/testing/selftests/cgroup/test_cpu.c | 2 +- + tools/testing/selftests/cgroup/test_cpuset.c | 2 +- + tools/testing/selftests/cgroup/test_freezer.c | 2 +- + tools/testing/selftests/cgroup/test_kill.c | 2 +- + tools/testing/selftests/cgroup/test_kmem.c | 2 +- + tools/testing/selftests/cgroup/test_memcontrol.c | 2 +- + tools/testing/selftests/cgroup/test_zswap.c | 2 +- + 10 files changed, 19 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c +index 0340d4ca8f51c..432db923bced0 100644 +--- a/tools/testing/selftests/cgroup/cgroup_util.c ++++ b/tools/testing/selftests/cgroup/cgroup_util.c +@@ -195,10 +195,10 @@ int cg_write_numeric(const char *cgroup, const char *control, long value) + return cg_write(cgroup, control, buf); + } + +-int cg_find_unified_root(char *root, size_t len) ++int cg_find_unified_root(char *root, size_t len, bool *nsdelegate) + { + char buf[10 * PAGE_SIZE]; +- char *fs, *mount, *type; ++ char *fs, *mount, *type, *options; + const char delim[] = "\n\t "; + + if (read_text("/proc/self/mounts", buf, sizeof(buf)) <= 0) +@@ -211,12 +211,14 @@ int cg_find_unified_root(char *root, size_t len) + for (fs = strtok(buf, delim); fs; fs = strtok(NULL, delim)) { + mount = strtok(NULL, delim); + type = strtok(NULL, delim); +- strtok(NULL, delim); ++ options = strtok(NULL, delim); + strtok(NULL, delim); + strtok(NULL, delim); + + if (strcmp(type, "cgroup2") == 0) { + strncpy(root, mount, len); ++ if (nsdelegate) ++ *nsdelegate = !!strstr(options, "nsdelegate"); + return 0; + } + } +diff --git a/tools/testing/selftests/cgroup/cgroup_util.h b/tools/testing/selftests/cgroup/cgroup_util.h +index 1df7f202214af..89e8519fb2719 100644 +--- a/tools/testing/selftests/cgroup/cgroup_util.h ++++ b/tools/testing/selftests/cgroup/cgroup_util.h +@@ -21,7 +21,7 @@ static inline int values_close(long a, long b, int err) + return abs(a - b) <= (a + b) / 100 * err; + } + +-extern int cg_find_unified_root(char *root, size_t len); ++extern int cg_find_unified_root(char *root, size_t len, bool *nsdelegate); + extern char *cg_name(const char *root, const char *name); + extern char *cg_name_indexed(const char *root, const char *name, int index); + extern char *cg_control(const char *cgroup, const char *control); +diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c +index 80aa6b2373b96..a5672a91d273c 100644 +--- a/tools/testing/selftests/cgroup/test_core.c ++++ b/tools/testing/selftests/cgroup/test_core.c +@@ -18,6 +18,8 @@ + #include "../kselftest.h" + #include "cgroup_util.h" + ++static bool nsdelegate; ++ + static int touch_anon(char *buf, size_t size) + { + int fd; +@@ -775,6 +777,9 @@ static int test_cgcore_lesser_ns_open(const char *root) + pid_t pid; + int status; + ++ if (!nsdelegate) ++ return KSFT_SKIP; ++ + cg_test_a = cg_name(root, "cg_test_a"); + cg_test_b = cg_name(root, "cg_test_b"); + +@@ -862,7 +867,7 @@ int main(int argc, char *argv[]) + char root[PATH_MAX]; + int i, ret = EXIT_SUCCESS; + +- if (cg_find_unified_root(root, sizeof(root))) ++ if (cg_find_unified_root(root, sizeof(root), &nsdelegate)) + ksft_exit_skip("cgroup v2 isn't mounted\n"); + + if (cg_read_strstr(root, "cgroup.subtree_control", "memory")) +diff --git a/tools/testing/selftests/cgroup/test_cpu.c b/tools/testing/selftests/cgroup/test_cpu.c +index 24020a2c68dcd..186bf96f6a284 100644 +--- a/tools/testing/selftests/cgroup/test_cpu.c ++++ b/tools/testing/selftests/cgroup/test_cpu.c +@@ -700,7 +700,7 @@ int main(int argc, char *argv[]) + char root[PATH_MAX]; + int i, ret = EXIT_SUCCESS; + +- if (cg_find_unified_root(root, sizeof(root))) ++ if (cg_find_unified_root(root, sizeof(root), NULL)) + ksft_exit_skip("cgroup v2 isn't mounted\n"); + + if (cg_read_strstr(root, "cgroup.subtree_control", "cpu")) +diff --git a/tools/testing/selftests/cgroup/test_cpuset.c b/tools/testing/selftests/cgroup/test_cpuset.c +index b061ed1e05b4d..4034d14ba69ac 100644 +--- a/tools/testing/selftests/cgroup/test_cpuset.c ++++ b/tools/testing/selftests/cgroup/test_cpuset.c +@@ -249,7 +249,7 @@ int main(int argc, char *argv[]) + char root[PATH_MAX]; + int i, ret = EXIT_SUCCESS; + +- if (cg_find_unified_root(root, sizeof(root))) ++ if (cg_find_unified_root(root, sizeof(root), NULL)) + ksft_exit_skip("cgroup v2 isn't mounted\n"); + + if (cg_read_strstr(root, "cgroup.subtree_control", "cpuset")) +diff --git a/tools/testing/selftests/cgroup/test_freezer.c b/tools/testing/selftests/cgroup/test_freezer.c +index ff519029f6f43..969e9f0f495c3 100644 +--- a/tools/testing/selftests/cgroup/test_freezer.c ++++ b/tools/testing/selftests/cgroup/test_freezer.c +@@ -827,7 +827,7 @@ int main(int argc, char *argv[]) + char root[PATH_MAX]; + int i, ret = EXIT_SUCCESS; + +- if (cg_find_unified_root(root, sizeof(root))) ++ if (cg_find_unified_root(root, sizeof(root), NULL)) + ksft_exit_skip("cgroup v2 isn't mounted\n"); + for (i = 0; i < ARRAY_SIZE(tests); i++) { + switch (tests[i].fn(root)) { +diff --git a/tools/testing/selftests/cgroup/test_kill.c b/tools/testing/selftests/cgroup/test_kill.c +index 6153690319c9c..0e5bb6c7307a5 100644 +--- a/tools/testing/selftests/cgroup/test_kill.c ++++ b/tools/testing/selftests/cgroup/test_kill.c +@@ -276,7 +276,7 @@ int main(int argc, char *argv[]) + char root[PATH_MAX]; + int i, ret = EXIT_SUCCESS; + +- if (cg_find_unified_root(root, sizeof(root))) ++ if (cg_find_unified_root(root, sizeof(root), NULL)) + ksft_exit_skip("cgroup v2 isn't mounted\n"); + for (i = 0; i < ARRAY_SIZE(tests); i++) { + switch (tests[i].fn(root)) { +diff --git a/tools/testing/selftests/cgroup/test_kmem.c b/tools/testing/selftests/cgroup/test_kmem.c +index c82f974b85c94..137506db03127 100644 +--- a/tools/testing/selftests/cgroup/test_kmem.c ++++ b/tools/testing/selftests/cgroup/test_kmem.c +@@ -420,7 +420,7 @@ int main(int argc, char **argv) + char root[PATH_MAX]; + int i, ret = EXIT_SUCCESS; + +- if (cg_find_unified_root(root, sizeof(root))) ++ if (cg_find_unified_root(root, sizeof(root), NULL)) + ksft_exit_skip("cgroup v2 isn't mounted\n"); + + /* +diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c b/tools/testing/selftests/cgroup/test_memcontrol.c +index c7c9572003a8c..b462416b38061 100644 +--- a/tools/testing/selftests/cgroup/test_memcontrol.c ++++ b/tools/testing/selftests/cgroup/test_memcontrol.c +@@ -1314,7 +1314,7 @@ int main(int argc, char **argv) + char root[PATH_MAX]; + int i, proc_status, ret = EXIT_SUCCESS; + +- if (cg_find_unified_root(root, sizeof(root))) ++ if (cg_find_unified_root(root, sizeof(root), NULL)) + ksft_exit_skip("cgroup v2 isn't mounted\n"); + + /* +diff --git a/tools/testing/selftests/cgroup/test_zswap.c b/tools/testing/selftests/cgroup/test_zswap.c +index 49def87a909bd..6927b4a06dee6 100644 +--- a/tools/testing/selftests/cgroup/test_zswap.c ++++ b/tools/testing/selftests/cgroup/test_zswap.c +@@ -250,7 +250,7 @@ int main(int argc, char **argv) + char root[PATH_MAX]; + int i, ret = EXIT_SUCCESS; + +- if (cg_find_unified_root(root, sizeof(root))) ++ if (cg_find_unified_root(root, sizeof(root), NULL)) + ksft_exit_skip("cgroup v2 isn't mounted\n"); + + if (!zswap_configured()) +-- +2.43.0 + diff --git a/queue-6.6/selftests-default-to-host-arch-for-llvm-builds.patch b/queue-6.6/selftests-default-to-host-arch-for-llvm-builds.patch new file mode 100644 index 00000000000..bab57166ecd --- /dev/null +++ b/queue-6.6/selftests-default-to-host-arch-for-llvm-builds.patch @@ -0,0 +1,85 @@ +From f55c43fef87d44d347362ee3e014937f9ea9c6cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 11:49:43 +0100 +Subject: selftests: default to host arch for LLVM builds + +From: Valentin Obst + +[ Upstream commit d4e6fbd245c48b272cc591d1c5e7c07aedd7f071 ] + +Align the behavior for gcc and clang builds by interpreting unset +`ARCH` and `CROSS_COMPILE` variables in `LLVM` builds as a sign that the +user wants to build for the host architecture. + +This patch preserves the properties that setting the `ARCH` variable to an +unknown value will trigger an error that complains about insufficient +information, and that a set `CROSS_COMPILE` variable will override the +target triple that is determined based on presence/absence of `ARCH`. + +When compiling with clang, i.e., `LLVM` is set, an unset `ARCH` variable in +combination with an unset `CROSS_COMPILE` variable, i.e., compiling for +the host architecture, leads to compilation failures since `lib.mk` can +not determine the clang target triple. In this case, the following error +message is displayed for each subsystem that does not set `ARCH` in its +own Makefile before including `lib.mk` (lines wrapped at 75 chrs): + + make[1]: Entering directory '/mnt/build/linux/tools/testing/selftests/ + sysctl' + ../lib.mk:33: *** Specify CROSS_COMPILE or add '--target=' option to + lib.mk. Stop. + make[1]: Leaving directory '/mnt/build/linux/tools/testing/selftests/ + sysctl' + +In the same scenario a gcc build would default to the host architecture, +i.e., it would use plain `gcc`. + +Fixes: 795285ef2425 ("selftests: Fix clang cross compilation") +Reviewed-by: Mark Brown +Signed-off-by: Valentin Obst +Reviewed-by: John Hubbard +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/lib.mk | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk +index aa646e0661f36..a8f0442a36bca 100644 +--- a/tools/testing/selftests/lib.mk ++++ b/tools/testing/selftests/lib.mk +@@ -7,6 +7,8 @@ else ifneq ($(filter -%,$(LLVM)),) + LLVM_SUFFIX := $(LLVM) + endif + ++CLANG := $(LLVM_PREFIX)clang$(LLVM_SUFFIX) ++ + CLANG_TARGET_FLAGS_arm := arm-linux-gnueabi + CLANG_TARGET_FLAGS_arm64 := aarch64-linux-gnu + CLANG_TARGET_FLAGS_hexagon := hexagon-linux-musl +@@ -18,7 +20,13 @@ CLANG_TARGET_FLAGS_riscv := riscv64-linux-gnu + CLANG_TARGET_FLAGS_s390 := s390x-linux-gnu + CLANG_TARGET_FLAGS_x86 := x86_64-linux-gnu + CLANG_TARGET_FLAGS_x86_64 := x86_64-linux-gnu +-CLANG_TARGET_FLAGS := $(CLANG_TARGET_FLAGS_$(ARCH)) ++ ++# Default to host architecture if ARCH is not explicitly given. ++ifeq ($(ARCH),) ++CLANG_TARGET_FLAGS := $(shell $(CLANG) -print-target-triple) ++else ++CLANG_TARGET_FLAGS := $(CLANG_TARGET_FLAGS_$(ARCH)) ++endif + + ifeq ($(CROSS_COMPILE),) + ifeq ($(CLANG_TARGET_FLAGS),) +@@ -30,7 +38,7 @@ else + CLANG_FLAGS += --target=$(notdir $(CROSS_COMPILE:%-=%)) + endif # CROSS_COMPILE + +-CC := $(LLVM_PREFIX)clang$(LLVM_SUFFIX) $(CLANG_FLAGS) -fintegrated-as ++CC := $(CLANG) $(CLANG_FLAGS) -fintegrated-as + else + CC := $(CROSS_COMPILE)gcc + endif # LLVM +-- +2.43.0 + diff --git a/queue-6.6/selftests-kcmp-remove-unused-open-mode.patch b/queue-6.6/selftests-kcmp-remove-unused-open-mode.patch new file mode 100644 index 00000000000..a6b48393f19 --- /dev/null +++ b/queue-6.6/selftests-kcmp-remove-unused-open-mode.patch @@ -0,0 +1,42 @@ +From 92f38fa38dcd643d5f68a917289113a764884f1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 23:46:09 +0000 +Subject: selftests/kcmp: remove unused open mode + +From: Edward Liaw + +[ Upstream commit eb59a58113717df04b8a8229befd8ab1e5dbf86e ] + +Android bionic warns that open modes are ignored if O_CREAT or O_TMPFILE +aren't specified. The permissions for the file are set above: + + fd1 = open(kpath, O_RDWR | O_CREAT | O_TRUNC, 0644); + +Link: https://lkml.kernel.org/r/20240429234610.191144-1-edliaw@google.com +Fixes: d97b46a64674 ("syscalls, x86: add __NR_kcmp syscall") +Signed-off-by: Edward Liaw +Reviewed-by: Cyrill Gorcunov +Cc: Eric Biederman +Cc: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kcmp/kcmp_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/kcmp/kcmp_test.c b/tools/testing/selftests/kcmp/kcmp_test.c +index 25110c7c0b3ed..d7a8e321bb16b 100644 +--- a/tools/testing/selftests/kcmp/kcmp_test.c ++++ b/tools/testing/selftests/kcmp/kcmp_test.c +@@ -91,7 +91,7 @@ int main(int argc, char **argv) + ksft_print_header(); + ksft_set_plan(3); + +- fd2 = open(kpath, O_RDWR, 0644); ++ fd2 = open(kpath, O_RDWR); + if (fd2 < 0) { + perror("Can't open file"); + ksft_exit_fail(); +-- +2.43.0 + diff --git a/queue-6.6/selftests-net-add-missing-config-for-amt.sh.patch b/queue-6.6/selftests-net-add-missing-config-for-amt.sh.patch new file mode 100644 index 00000000000..4ce62cf27c9 --- /dev/null +++ b/queue-6.6/selftests-net-add-missing-config-for-amt.sh.patch @@ -0,0 +1,35 @@ +From f8477dc3d9d03ff26f8bb5124bf8e00265f65041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 09:19:19 -0700 +Subject: selftests: net: add missing config for amt.sh + +From: Jakub Kicinski + +[ Upstream commit c499fe96d3f75a5cf50de6089dd8f1cddd1301a9 ] + +Test needs IPv6 multicast. smcroute currently crashes when trying +to install a route in a kernel without IPv6 multicast. + +Fixes: c08e8baea78e ("selftests: add amt interface selftest script") +Link: https://lore.kernel.org/r/20240509161919.3939966-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/config | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config +index 5e4390cac17ed..04de7a6ba6f31 100644 +--- a/tools/testing/selftests/net/config ++++ b/tools/testing/selftests/net/config +@@ -30,6 +30,7 @@ CONFIG_IP_GRE=m + CONFIG_NETFILTER=y + CONFIG_NETFILTER_ADVANCED=y + CONFIG_NF_CONNTRACK=m ++CONFIG_IPV6_MROUTE=y + CONFIG_IPV6_SIT=y + CONFIG_IP_DCCP=m + CONFIG_NF_NAT=m +-- +2.43.0 + diff --git a/queue-6.6/selftests-net-add-more-missing-kernel-config.patch b/queue-6.6/selftests-net-add-more-missing-kernel-config.patch new file mode 100644 index 00000000000..6c5979de399 --- /dev/null +++ b/queue-6.6/selftests-net-add-more-missing-kernel-config.patch @@ -0,0 +1,61 @@ +From ac53dc97ec46a7e9fc3f7895ecaf1990523fafc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 18:31:10 +0100 +Subject: selftests: net: add more missing kernel config + +From: Paolo Abeni + +[ Upstream commit 02d9009f4e8c27dcf10c3e39bc0666436686a219 ] + +The reuseport_addr_any.sh is currently skipping DCCP tests and +pmtu.sh is skipping all the FOU/GUE related cases: add the missing +options. + +Signed-off-by: Paolo Abeni +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/38d3ca7f909736c1aef56e6244d67c82a9bba6ff.1707326987.git.pabeni@redhat.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: c499fe96d3f7 ("selftests: net: add missing config for amt.sh") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/config | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config +index 3b749addd3640..5e4390cac17ed 100644 +--- a/tools/testing/selftests/net/config ++++ b/tools/testing/selftests/net/config +@@ -24,10 +24,14 @@ CONFIG_IFB=y + CONFIG_INET_DIAG=y + CONFIG_INET_ESP=y + CONFIG_INET_ESP_OFFLOAD=y ++CONFIG_NET_FOU=y ++CONFIG_NET_FOU_IP_TUNNELS=y + CONFIG_IP_GRE=m + CONFIG_NETFILTER=y + CONFIG_NETFILTER_ADVANCED=y + CONFIG_NF_CONNTRACK=m ++CONFIG_IPV6_SIT=y ++CONFIG_IP_DCCP=m + CONFIG_NF_NAT=m + CONFIG_IP6_NF_IPTABLES=m + CONFIG_IP_NF_IPTABLES=m +@@ -62,6 +66,7 @@ CONFIG_NET_CLS_MATCHALL=m + CONFIG_NET_CLS_U32=m + CONFIG_NET_IPGRE_DEMUX=m + CONFIG_NET_IPGRE=m ++CONFIG_NET_IPIP=y + CONFIG_NET_SCH_FQ_CODEL=m + CONFIG_NET_SCH_HTB=m + CONFIG_NET_SCH_FQ=m +@@ -78,7 +83,6 @@ CONFIG_TLS=m + CONFIG_TRACEPOINTS=y + CONFIG_NET_DROP_MONITOR=m + CONFIG_NETDEVSIM=m +-CONFIG_NET_FOU=m + CONFIG_MPLS_ROUTING=m + CONFIG_MPLS_IPTUNNEL=m + CONFIG_NET_SCH_INGRESS=m +-- +2.43.0 + diff --git a/queue-6.6/selftests-net-bridge-increase-igmp-mld-exclude-timeo.patch b/queue-6.6/selftests-net-bridge-increase-igmp-mld-exclude-timeo.patch new file mode 100644 index 00000000000..5f7ebc494d8 --- /dev/null +++ b/queue-6.6/selftests-net-bridge-increase-igmp-mld-exclude-timeo.patch @@ -0,0 +1,82 @@ +From 417bdb4ddea2b8e404e4ce342383af5e041d4a74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 13:52:57 +0300 +Subject: selftests: net: bridge: increase IGMP/MLD exclude timeout membership + interval + +From: Nikolay Aleksandrov + +[ Upstream commit 06080ea23095afe04a2cb7a8d05fab4311782623 ] + +When running the bridge IGMP/MLD selftests on debug kernels we can get +spurious errors when setting up the IGMP/MLD exclude timeout tests +because the membership interval is just 3 seconds and the setup has 2 +seconds of sleep plus various validations, the one second that is left +is not enough. Increase the membership interval from 3 to 5 seconds to +make room for the setup validation and 2 seconds of sleep. + +Fixes: 34d7ecb3d4f7 ("selftests: net: bridge: update IGMP/MLD membership interval value") +Reported-by: Jakub Kicinski +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/bridge_igmp.sh | 6 +++--- + tools/testing/selftests/net/forwarding/bridge_mld.sh | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/bridge_igmp.sh b/tools/testing/selftests/net/forwarding/bridge_igmp.sh +index 2aa66d2a1702b..e6a3e04fd83f3 100755 +--- a/tools/testing/selftests/net/forwarding/bridge_igmp.sh ++++ b/tools/testing/selftests/net/forwarding/bridge_igmp.sh +@@ -478,10 +478,10 @@ v3exc_timeout_test() + RET=0 + local X=("192.0.2.20" "192.0.2.30") + +- # GMI should be 3 seconds ++ # GMI should be 5 seconds + ip link set dev br0 type bridge mcast_query_interval 100 \ + mcast_query_response_interval 100 \ +- mcast_membership_interval 300 ++ mcast_membership_interval 500 + + v3exclude_prepare $h1 $ALL_MAC $ALL_GROUP + ip link set dev br0 type bridge mcast_query_interval 500 \ +@@ -489,7 +489,7 @@ v3exc_timeout_test() + mcast_membership_interval 1500 + + $MZ $h1 -c 1 -b $ALL_MAC -B $ALL_GROUP -t ip "proto=2,p=$MZPKT_ALLOW2" -q +- sleep 3 ++ sleep 5 + bridge -j -d -s mdb show dev br0 \ + | jq -e ".[].mdb[] | \ + select(.grp == \"$TEST_GROUP\" and \ +diff --git a/tools/testing/selftests/net/forwarding/bridge_mld.sh b/tools/testing/selftests/net/forwarding/bridge_mld.sh +index e2b9ff773c6b6..f84ab2e657547 100755 +--- a/tools/testing/selftests/net/forwarding/bridge_mld.sh ++++ b/tools/testing/selftests/net/forwarding/bridge_mld.sh +@@ -478,10 +478,10 @@ mldv2exc_timeout_test() + RET=0 + local X=("2001:db8:1::20" "2001:db8:1::30") + +- # GMI should be 3 seconds ++ # GMI should be 5 seconds + ip link set dev br0 type bridge mcast_query_interval 100 \ + mcast_query_response_interval 100 \ +- mcast_membership_interval 300 ++ mcast_membership_interval 500 + + mldv2exclude_prepare $h1 + ip link set dev br0 type bridge mcast_query_interval 500 \ +@@ -489,7 +489,7 @@ mldv2exc_timeout_test() + mcast_membership_interval 1500 + + $MZ $h1 -c 1 $MZPKT_ALLOW2 -q +- sleep 3 ++ sleep 5 + bridge -j -d -s mdb show dev br0 \ + | jq -e ".[].mdb[] | \ + select(.grp == \"$TEST_GROUP\" and \ +-- +2.43.0 + diff --git a/queue-6.6/selftests-net-move-amt-to-socat-for-better-compatibi.patch b/queue-6.6/selftests-net-move-amt-to-socat-for-better-compatibi.patch new file mode 100644 index 00000000000..d6a162ffff4 --- /dev/null +++ b/queue-6.6/selftests-net-move-amt-to-socat-for-better-compatibi.patch @@ -0,0 +1,77 @@ +From dde8c800e8a7768f0a81a3989e957e89f60b8546 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 09:19:52 -0700 +Subject: selftests: net: move amt to socat for better compatibility + +From: Jakub Kicinski + +[ Upstream commit 4c639b6a7b9db236c0907aca8e92d1537076f2cd ] + +The test seems to expect that nc will exit after the first +received message. This is not the case with Ncat 7.94. +There are multiple versions of nc out there, switch +to socat for better compatibility. + +Tell socat to exit after 128 bytes and pad the message. + +Since the test sets -e make sure we don't set exit code +(|| true) and print the pass / fail rather then silently +moving over the test and just setting non-zero exit code +with no output indicating what failed. + +Fixes: c08e8baea78e ("selftests: add amt interface selftest script") +Acked-by: Paolo Abeni +Tested-by: Taehee Yoo +Link: https://lore.kernel.org/r/20240509161952.3940476-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/amt.sh | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/selftests/net/amt.sh b/tools/testing/selftests/net/amt.sh +index 75528788cb95e..5175a42cbe8a2 100755 +--- a/tools/testing/selftests/net/amt.sh ++++ b/tools/testing/selftests/net/amt.sh +@@ -210,8 +210,8 @@ check_features() + + test_ipv4_forward() + { +- RESULT4=$(ip netns exec "${LISTENER}" nc -w 1 -l -u 239.0.0.1 4000) +- if [ "$RESULT4" == "172.17.0.2" ]; then ++ RESULT4=$(ip netns exec "${LISTENER}" timeout 15 socat - UDP4-LISTEN:4000,readbytes=128 || true) ++ if echo "$RESULT4" | grep -q "172.17.0.2"; then + printf "TEST: %-60s [ OK ]\n" "IPv4 amt multicast forwarding" + exit 0 + else +@@ -222,8 +222,8 @@ test_ipv4_forward() + + test_ipv6_forward() + { +- RESULT6=$(ip netns exec "${LISTENER}" nc -w 1 -l -u ff0e::5:6 6000) +- if [ "$RESULT6" == "2001:db8:3::2" ]; then ++ RESULT6=$(ip netns exec "${LISTENER}" timeout 15 socat - UDP6-LISTEN:6000,readbytes=128 || true) ++ if echo "$RESULT6" | grep -q "2001:db8:3::2"; then + printf "TEST: %-60s [ OK ]\n" "IPv6 amt multicast forwarding" + exit 0 + else +@@ -236,14 +236,14 @@ send_mcast4() + { + sleep 2 + ip netns exec "${SOURCE}" bash -c \ +- 'echo 172.17.0.2 | nc -w 1 -u 239.0.0.1 4000' & ++ 'printf "%s %128s" 172.17.0.2 | nc -w 1 -u 239.0.0.1 4000' & + } + + send_mcast6() + { + sleep 2 + ip netns exec "${SOURCE}" bash -c \ +- 'echo 2001:db8:3::2 | nc -w 1 -u ff0e::5:6 6000' & ++ 'printf "%s %128s" 2001:db8:3::2 | nc -w 1 -u ff0e::5:6 6000' & + } + + check_features +-- +2.43.0 + diff --git a/queue-6.6/selftests-resctrl-fix-clang-build-failure-use-local_.patch b/queue-6.6/selftests-resctrl-fix-clang-build-failure-use-local_.patch new file mode 100644 index 00000000000..fb2ec27d933 --- /dev/null +++ b/queue-6.6/selftests-resctrl-fix-clang-build-failure-use-local_.patch @@ -0,0 +1,60 @@ +From 8df900625416e5c37d7f7a077efa798196803de2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 19:17:12 -0700 +Subject: selftests/resctrl: fix clang build failure: use LOCAL_HDRS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: John Hubbard + +[ Upstream commit d8171aa4ca72f1a67bf3c14c59441d63c1d2585f ] + +First of all, in order to build with clang at all, one must first apply +Valentin Obst's build fix for LLVM [1]. Once that is done, then when +building with clang, via: + + make LLVM=1 -C tools/testing/selftests + +...the following error occurs: + + clang: error: cannot specify -o when generating multiple output files + +This is because clang, unlike gcc, won't accept invocations of this +form: + + clang file1.c header2.h + +Fix this by using selftests/lib.mk facilities for tracking local header +file dependencies: add them to LOCAL_HDRS, leaving only the .c files to +be passed to the compiler. + +[1] https://lore.kernel.org/all/20240329-selftests-libmk-llvm-rfc-v1-1-2f9ed7d1c49f@valentinobst.de/ + +Fixes: 8e289f454289 ("selftests/resctrl: Add resctrl.h into build deps") +Cc: Ilpo Järvinen +Signed-off-by: John Hubbard +Acked-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/Makefile | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/resctrl/Makefile b/tools/testing/selftests/resctrl/Makefile +index 2deac2031de9e..021863f86053a 100644 +--- a/tools/testing/selftests/resctrl/Makefile ++++ b/tools/testing/selftests/resctrl/Makefile +@@ -5,6 +5,8 @@ CFLAGS += $(KHDR_INCLUDES) + + TEST_GEN_PROGS := resctrl_tests + ++LOCAL_HDRS += $(wildcard *.h) ++ + include ../lib.mk + +-$(OUTPUT)/resctrl_tests: $(wildcard *.[ch]) ++$(OUTPUT)/resctrl_tests: $(wildcard *.c) +-- +2.43.0 + diff --git a/queue-6.6/selftests-sud_test-return-correct-emulated-syscall-v.patch b/queue-6.6/selftests-sud_test-return-correct-emulated-syscall-v.patch new file mode 100644 index 00000000000..de5b2644706 --- /dev/null +++ b/queue-6.6/selftests-sud_test-return-correct-emulated-syscall-v.patch @@ -0,0 +1,56 @@ +From ab0b75456e201d820ae90f7e99e98872487080f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 14:44:37 +0100 +Subject: selftests: sud_test: return correct emulated syscall value on RISC-V +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 17c67ed752d6a456602b3dbb25c5ae4d3de5deab ] + +Currently, the sud_test expects the emulated syscall to return the +emulated syscall number. This assumption only works on architectures +were the syscall calling convention use the same register for syscall +number/syscall return value. This is not the case for RISC-V and thus +the return value must be also emulated using the provided ucontext. + +Signed-off-by: Clément Léger +Reviewed-by: Palmer Dabbelt +Acked-by: Palmer Dabbelt +Link: https://lore.kernel.org/r/20231206134438.473166-1-cleger@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + .../selftests/syscall_user_dispatch/sud_test.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/tools/testing/selftests/syscall_user_dispatch/sud_test.c b/tools/testing/selftests/syscall_user_dispatch/sud_test.c +index b5d592d4099e8..d975a67673299 100644 +--- a/tools/testing/selftests/syscall_user_dispatch/sud_test.c ++++ b/tools/testing/selftests/syscall_user_dispatch/sud_test.c +@@ -158,6 +158,20 @@ static void handle_sigsys(int sig, siginfo_t *info, void *ucontext) + + /* In preparation for sigreturn. */ + SYSCALL_DISPATCH_OFF(glob_sel); ++ ++ /* ++ * The tests for argument handling assume that `syscall(x) == x`. This ++ * is a NOP on x86 because the syscall number is passed in %rax, which ++ * happens to also be the function ABI return register. Other ++ * architectures may need to swizzle the arguments around. ++ */ ++#if defined(__riscv) ++/* REG_A7 is not defined in libc headers */ ++# define REG_A7 (REG_A0 + 7) ++ ++ ((ucontext_t *)ucontext)->uc_mcontext.__gregs[REG_A0] = ++ ((ucontext_t *)ucontext)->uc_mcontext.__gregs[REG_A7]; ++#endif + } + + TEST(dispatch_and_return) +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index feb90e86c02..38c1860b96e 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -29,3 +29,360 @@ alsa-timer-set-lower-bound-of-start-tick-time.patch alsa-fix-deadlocks-with-kctl-removals-at-disconnection.patch keys-asymmetric-add-missing-dependency-on-crypto_sig.patch keys-asymmetric-add-missing-dependencies-of-fips_signature_selftest.patch +wifi-mac80211-don-t-use-rate-mask-for-scanning.patch +wifi-mac80211-ensure-beacon-is-non-s1g-prior-to-extr.patch +wifi-cfg80211-fix-the-order-of-arguments-for-trace-e.patch +dt-bindings-rockchip-grf-add-missing-type-to-pcie-ph.patch +hid-mcp-2221-cancel-delayed_work-only-when-config_ii.patch +net-usb-qmi_wwan-add-telit-fn920c04-compositions.patch +drm-amd-display-set-color_mgmt_changed-to-true-on-un.patch +drm-amdgpu-update-bo-eviction-priorities.patch +drm-amd-pm-restore-config-space-after-reset.patch +drm-amdkfd-add-vram-accounting-for-svm-migration.patch +drm-amdgpu-fix-the-ring-buffer-size-for-queue-vm-flu.patch +drm-amdgpu-mes-fix-use-after-free-issue.patch +revert-net-txgbe-fix-i2c-dev-name-cannot-match-clkde.patch +revert-net-txgbe-fix-clk_name-exceed-max_dev_id-limi.patch +cpu-ignore-mitigations-kernel-parameter-if-cpu_mitig.patch +loongarch-lately-init-pmu-after-smp-is-online.patch +drm-etnaviv-fix-tx-clock-gating-on-some-gc7000-varia.patch +selftests-sud_test-return-correct-emulated-syscall-v.patch +sched-isolation-fix-boot-crash-when-maxcpus-first-ho.patch +asoc-intel-bytcr_rt5640-apply-asus-t100ta-quirk-to-a.patch +regulator-irq_helpers-duplicate-irq-name.patch +alsa-hda-cs35l56-exit-cache-only-after-cs35l56_wait_.patch +asoc-sof-pcm-restrict-dsp-d0i3-during-s0ix-to-ipc3.patch +asoc-acp-support-microphone-from-device-acer-315-24p.patch +asoc-rt5645-fix-the-electric-noise-due-to-the-cbj-co.patch +asoc-dt-bindings-rt5645-add-cbj-sleeve-gpio-property.patch +asoc-rt722-sdca-modify-channel-number-to-support-4-c.patch +asoc-rt722-sdca-add-headset-microphone-vrefo-setting.patch +regulator-qcom-refgen-fix-module-autoloading.patch +regulator-vqmmc-ipq4019-fix-module-autoloading.patch +asoc-cs35l41-update-dsp1rx5-6-sources-for-dsp-config.patch +asoc-rt715-add-vendor-clear-control-register.patch +asoc-rt715-sdca-volume-step-modification.patch +kvm-selftests-add-test-for-uaccesses-to-non-existent.patch +input-xpad-add-support-for-asus-rog-raikiri.patch +fpga-dfl-pci-add-pci-subdevice-id-for-intel-d5005-ca.patch +bpf-x86-fix-probe_mem-runtime-load-check.patch +alsa-emu10k1-make-e-mu-fpga-writes-potentially-more-.patch +softirq-fix-suspicious-rcu-usage-in-__do_softirq.patch +platform-x86-isst-add-grand-ridge-to-hpm-cpu-list.patch +asoc-da7219-aad-fix-usage-of-device_get_named_child_.patch +alsa-hda-intel-dsp-config-harden-i2c-i2s-codec-detec.patch +drm-amdgpu-fix-vram-memory-accounting.patch +drm-amd-display-add-dtbclk-access-to-dcn315.patch +drm-amd-display-allocate-zero-bw-after-bw-alloc-enab.patch +drm-amd-display-add-vco-speed-parameter-for-dcn31-fp.patch +drm-amd-display-fix-dc-mode-screen-flickering-on-dcn.patch +drm-amd-display-disable-seamless-boot-on-128b-132b-e.patch +drm-amdkfd-flush-the-process-wq-before-creating-a-kf.patch +x86-mm-remove-broken-vsyscall-emulation-code-from-th.patch +nvme-find-numa-distance-only-if-controller-has-valid.patch +nvmet-auth-return-the-error-code-to-the-nvmet_auth_h.patch +nvmet-auth-replace-pr_debug-with-pr_err-to-report-an.patch +nvme-cancel-pending-i-o-if-nvme-controller-is-in-ter.patch +nvmet-tcp-fix-possible-memory-leak-when-tearing-down.patch +nvmet-fix-nvme-status-code-when-namespace-is-disable.patch +epoll-be-better-about-file-lifetimes.patch +ksmbd-fix-uninitialized-symbol-share-in-smb2_tree_co.patch +nvmet-prevent-sprintf-overflow-in-nvmet_subsys_nsid_.patch +openpromfs-finish-conversion-to-the-new-mount-api.patch +crypto-bcm-fix-pointer-arithmetic.patch +mm-slub-kunit-use-inverted-data-to-corrupt-kmem-cach.patch +firmware-raspberrypi-use-correct-device-for-dma-mapp.patch +ecryptfs-fix-buffer-size-for-tag-66-packet.patch +nilfs2-fix-out-of-range-warning.patch +parisc-add-missing-export-of-__cmpxchg_u8.patch +crypto-ccp-drop-platform-ifdef-checks.patch +crypto-x86-nh-avx2-add-missing-vzeroupper.patch +crypto-x86-sha256-avx2-add-missing-vzeroupper.patch +crypto-x86-sha512-avx2-add-missing-vzeroupper.patch +s390-cio-fix-tracepoint-subchannel-type-field.patch +io_uring-use-the-right-type-for-work_llist-empty-che.patch +rcu-tasks-fix-show_rcu_tasks_trace_gp_kthread-buffer.patch +rcu-fix-buffer-overflow-in-print_cpu_stall_info.patch +arm-configs-sunxi-enable-drm_dw_hdmi.patch +jffs2-prevent-xattr-node-from-overflowing-the-eraseb.patch +io-wq-write-next_work-before-dropping-acct_lock.patch +mm-userfaultfd-do-not-place-zeropages-when-zeropages.patch +s390-mm-re-enable-the-shared-zeropage-for-pv-and-ske.patch +soc-qcom-pmic_glink-don-t-traverse-clients-list-with.patch +soc-qcom-pmic_glink-notify-clients-about-the-current.patch +firmware-qcom-scm-fix-__scm-and-waitq-completion-var.patch +soc-mediatek-cmdq-fix-typo-of-cmdq_jump_relative.patch +null_blk-fix-missing-mutex_destroy-at-module-removal.patch +kunit-fortify-fix-mismatched-kvalloc-vfree-usage.patch +soc-qcom-pmic_glink-make-client-lock-non-sleeping.patch +lkdtm-disable-cfi-checking-for-perms-functions.patch +md-fix-resync-softlockup-when-bitmap-size-is-less-th.patch +crypto-qat-specify-firmware-files-for-402xx.patch +block-refine-the-eof-check-in-blkdev_iomap_begin.patch +block-fix-and-simplify-blkdevparts-cmdline-parsing.patch +block-support-to-account-io_ticks-precisely.patch +wifi-ath10k-poll-service-ready-message-before-failin.patch +wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch +wifi-ath11k-don-t-force-enable-power-save-on-non-run.patch +bpftool-fix-missing-pids-during-link-show.patch +wifi-ath12k-use-correct-flag-field-for-320-mhz-chann.patch +wifi-mt76-mt7915-workaround-too-long-expansion-spars.patch +x86-boot-ignore-relocations-in-.notes-sections-in-wa.patch +wifi-ieee80211-fix-ieee80211_mle_basic_sta_prof_size.patch +wifi-iwlwifi-mvm-allocate-sta-links-only-for-active-.patch +wifi-iwlwifi-mvm-select-sta-mask-only-for-active-lin.patch +wifi-iwlwifi-reconfigure-tlc-during-hw-restart.patch +wifi-iwlwifi-mvm-fix-check-in-iwl_mvm_sta_fw_id_mask.patch +sched-fair-add-eas-checks-before-updating-root_domai.patch +acpi-fix-generic-initiator-affinity-_osc-bit.patch +enetc-avoid-truncating-error-message.patch +qed-avoid-truncating-work-queue-length.patch +mlx5-avoid-truncating-error-message.patch +mlx5-stop-warning-for-64kb-pages.patch +bitops-add-missing-prototype-check.patch +dlm-fix-user-space-lock-decision-to-copy-lvb.patch +wifi-carl9170-re-fix-fortified-memset-warning.patch +bpftool-mount-bpffs-on-provided-dir-instead-of-paren.patch +bpf-pack-struct-bpf_fib_lookup.patch +bpf-prevent-r10-register-from-being-marked-as-precis.patch +scsi-ufs-qcom-perform-read-back-after-writing-reset-.patch +scsi-ufs-qcom-perform-read-back-after-writing-reg_uf.patch +scsi-ufs-qcom-perform-read-back-after-writing-unipro.patch +scsi-ufs-qcom-perform-read-back-after-writing-cgc-en.patch +scsi-ufs-cdns-pltfrm-perform-read-back-after-writing.patch +scsi-ufs-core-perform-read-back-after-writing-utp_ta.patch +scsi-ufs-core-perform-read-back-after-disabling-inte.patch +scsi-ufs-core-perform-read-back-after-disabling-uic_.patch +acpi-lpss-advertise-number-of-chip-selects-via-prope.patch +locking-atomic-x86-correct-the-definition-of-__arch_.patch +irqchip-alpine-msi-fix-off-by-one-in-allocation-erro.patch +irqchip-loongson-pch-msi-fix-off-by-one-on-allocatio.patch +acpi-disable-wstringop-truncation.patch +gfs2-don-t-forget-to-complete-delayed-withdraw.patch +gfs2-fix-ignore-unlock-failures-after-withdraw.patch +x86-boot-64-clear-most-of-cr4-in-startup_64-except-p.patch +selftests-bpf-fix-umount-cgroup2-error-in-test_sockm.patch +tcp-define-initial-scaling-factor-value-as-a-macro.patch +tcp-increase-the-default-tcp-scaling-ratio.patch +cpufreq-exit-callback-is-optional.patch +x86-pat-introduce-lookup_address_in_pgd_attr.patch +x86-pat-restructure-_lookup_address_cpa.patch +x86-pat-fix-w-x-violation-false-positives-when-runni.patch +udp-avoid-call-to-compute_score-on-multiple-sites.patch +openrisc-traps-don-t-send-signals-to-kernel-mode-thr.patch +cppc_cpufreq-fix-possible-null-pointer-dereference.patch +wifi-iwlwifi-mvm-init-vif-works-only-once.patch +scsi-libsas-fix-the-failure-of-adding-phy-with-zero-.patch +scsi-hpsa-fix-allocation-size-for-scsi_host-private-.patch +x86-purgatory-switch-to-the-position-independent-sma.patch +wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch +thermal-drivers-tsens-fix-null-pointer-dereference.patch +dt-bindings-thermal-loongson-ls2k-thermal-fix-bindin.patch +dt-bindings-thermal-loongson-ls2k-thermal-add-loongs.patch +dt-bindings-thermal-loongson-ls2k-thermal-fix-incorr.patch +wifi-ath10k-fix-an-error-code-problem-in-ath10k_dbg_.patch +gfs2-get-rid-of-gfs2_alloc_blocks-generation-paramet.patch +gfs2-convert-gfs2_internal_read-to-folios.patch +gfs2-rename-gfs2_lookup_-simple-meta.patch +gfs2-no-longer-use-extern-in-function-declarations.patch +gfs2-remove-ill-placed-consistency-check.patch +gfs2-fix-potential-glock-use-after-free-on-unmount.patch +gfs2-mark-withdraws-as-unlikely.patch +gfs2-rename-gfs2_withdrawn-to-gfs2_withdrawing_or_wi.patch +gfs2-finish_xmote-cleanup.patch +gfs2-do_xmote-fixes.patch +selftests-bpf-fix-a-fd-leak-in-error-paths-in-open_n.patch +scsi-ufs-core-mcq-fix-ufshcd_mcq_sqe_search.patch +cpufreq-brcmstb-avs-cpufreq-iso-c90-forbids-mixed-de.patch +wifi-ath10k-populate-board-data-for-wcn3990.patch +net-dsa-mv88e6xxx-add-support-for-model-specific-pre.patch +net-dsa-mv88e6xxx-avoid-eeprom-timeout-without-eepro.patch +tcp-avoid-premature-drops-in-tcp_add_backlog.patch +pwm-sti-prepare-removing-pwm_chip-from-driver-data.patch +pwm-sti-simplify-probe-function-using-devm-functions.patch +drivers-perf-hisi_pcie-fix-out-of-bound-access-when-.patch +drivers-perf-hisi-hns3-fix-out-of-bound-access-when-.patch +drivers-perf-hisi-hns3-actually-use-devm_add_action_.patch +net-give-more-chances-to-rcu-in-netdev_wait_allrefs_.patch +macintosh-via-macii-fix-bug-sleeping-function-called.patch +wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch +bpf-fix-verifier-assumptions-about-socket-sk.patch +wifi-ar5523-enable-proper-endpoint-verification.patch +bpf-add-bpf_prog_type_cgroup_skb-attach-type-enforce.patch +sh-kprobes-merge-arch_copy_kprobe-into-arch_prepare_.patch +revert-sh-handle-calling-csum_partial-with-misaligne.patch +wifi-mt76-mt7603-fix-tx-queue-of-loopback-packets.patch +wifi-mt76-mt7603-add-wpdma-tx-eof-flag-for-pse-clien.patch +libbpf-fix-error-message-in-attach_kprobe_multi.patch +wifi-nl80211-avoid-address-calculations-via-out-of-b.patch +selftests-binderfs-use-the-makefile-s-rules-not-make.patch +selftests-resctrl-fix-clang-build-failure-use-local_.patch +selftests-default-to-host-arch-for-llvm-builds.patch +kunit-fix-kthread-reference.patch +selftests-bpf-fix-pointer-arithmetic-in-test_xdp_do_.patch +hid-intel-ish-hid-ipc-add-check-for-pci_alloc_irq_ve.patch +scsi-bfa-ensure-the-copied-buf-is-nul-terminated.patch +scsi-qedf-ensure-the-copied-buf-is-nul-terminated.patch +scsi-qla2xxx-fix-debugfs-output-for-fw_resource_coun.patch +kernel-numa.c-move-logging-out-of-numa.h.patch +x86-numa-fix-srat-lookup-of-cfmws-ranges-with-numa_f.patch +wifi-mwl8k-initialize-cmd-addr-properly.patch +hid-amd_sfh-handle-no-sensors-in-pm-operations.patch +usb-aqc111-stop-lying-about-skb-truesize.patch +net-usb-sr9700-stop-lying-about-skb-truesize.patch +m68k-fix-spinlock-race-in-kernel-thread-creation.patch +m68k-mac-fix-reboot-hang-on-mac-iici.patch +net-ipv6-fix-wrong-start-position-when-receive-hop-b.patch +eth-sungem-remove-.ndo_poll_controller-to-avoid-dead.patch +selftests-net-add-more-missing-kernel-config.patch +selftests-net-add-missing-config-for-amt.sh.patch +selftests-net-move-amt-to-socat-for-better-compatibi.patch +net-ethernet-cortina-locking-fixes.patch +af_unix-fix-data-races-in-unix_release_sock-unix_str.patch +net-usb-smsc95xx-stop-lying-about-skb-truesize.patch +net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch +ipv6-sr-add-missing-seg6_local_exit.patch +ipv6-sr-fix-incorrect-unregister-order.patch +ipv6-sr-fix-invalid-unregister-error-path.patch +net-mlx5-enable-4-ports-multiport-e-switch.patch +net-mlx5-reload-only-ib-representors-upon-lag-disabl.patch +net-mlx5-add-a-timeout-to-acquire-the-command-queue-.patch +net-mlx5-discard-command-completions-in-internal-err.patch +s390-bpf-emit-a-barrier-for-bpf_fetch-instructions.patch +riscv-bpf-make-some-atomic-operations-fully-ordered.patch +ax25-use-kernel-universal-linked-list-to-implement-a.patch +ax25-fix-reference-count-leak-issues-of-ax25_dev.patch +ax25-fix-reference-count-leak-issue-of-net_device.patch +net-fec-remove-.ndo_poll_controller-to-avoid-deadloc.patch +mptcp-so_keepalive-fix-getsockopt-support.patch +net-micrel-fix-receiving-the-timestamp-in-the-frame-.patch +bluetooth-compute-le-flow-credits-based-on-recvbuf-s.patch +bluetooth-qca-fix-error-code-in-qca_read_fw_build_in.patch +bluetooth-iso-fix-bis-cleanup.patch +bluetooth-remove-usage-of-the-deprecated-ida_simple_.patch +bluetooth-hci_event-remove-code-to-removed-config_bt.patch +bluetooth-hci-remove-hci_amp-support.patch +drm-bridge-fix-improper-bridge-init-order-with-pre_e.patch +drm-ci-uprev-mesa-version-fix-container-build-crosvm.patch +drm-ci-add-subset-1-gfx-to-lava_tags-and-adjust-shar.patch +drm-ci-update-device-type-for-volteer-devices.patch +drm-omapdrm-fix-console-by-implementing-fb_dirty.patch +fbdev-provide-i-o-memory-helpers-as-module.patch +drm-omapdrm-fix-console-with-deferred-ops.patch +printk-let-no_printk-use-_printk.patch +dev_printk-add-and-use-dev_no_printk.patch +drm-lcdif-do-not-disable-clocks-on-already-suspended.patch +drm-dp-don-t-attempt-aux-transfers-when-edp-panels-a.patch +drm-panel-atna33xc20-fix-unbalanced-regulator-in-the.patch +drm-amd-display-fix-potential-index-out-of-bounds-in.patch +asoc-intel-disable-route-checks-for-skylake-boards.patch +asoc-intel-avs-ssm4567-do-not-ignore-route-checks.patch +mtd-core-report-error-if-first-mtd_otp_size-call-fai.patch +mtd-rawnand-hynix-fixed-typo.patch +asoc-mediatek-assign-dummy-when-codec-not-specified-.patch +fbdev-shmobile-fix-snprintf-truncation.patch +asoc-kirkwood-fix-potential-null-dereference.patch +drm-meson-vclk-fix-calculation-of-59.94-fractional-r.patch +drm-mediatek-add-0-size-check-to-mtk_drm_gem_obj.patch +powerpc-fsl-soc-hide-unused-const-variable.patch +asoc-intel-common-add-acpi-matching-tables-for-arrow.patch +asoc-sof-intel-pci-mtl-use-arl-specific-firmware-def.patch +asoc-sof-intel-pci-mtl-fix-arl-s-definitions.patch +asoc-sof-intel-mtl-correct-rom_status_reg.patch +asoc-sof-intel-lnl-correct-rom_status_reg.patch +asoc-sof-intel-mtl-call-dsp-dump-when-boot-retry-fai.patch +asoc-sof-intel-mtl-disable-interrupts-when-firmware-.patch +asoc-sof-intel-mtl-implement-firmware-boot-state-che.patch +fbdev-sisfb-hide-unused-variables.patch +selftests-cgroup-skip-test_cgcore_lesser_ns_open-whe.patch +asoc-intel-avs-fix-asrc-module-initialization.patch +asoc-intel-avs-fix-potential-integer-overflow.patch +asoc-intel-avs-test-result-of-avs_get_module_entry.patch +media-ngene-add-dvb_ca_en50221_init-return-value-che.patch +media-rcar-vin-work-around-wenum-compare-conditional.patch +media-radio-shark2-avoid-led_names-truncations.patch +drm-bridge-cdns-mhdp8546-fix-possible-null-pointer-d.patch +platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch +drm-msm-dp-allow-voltage-swing-pre-emphasis-of-3.patch +drm-msm-dp-avoid-a-long-timeout-for-aux-transfer-if-.patch +media-ipu3-cio2-request-irq-earlier.patch +media-dt-bindings-ovti-ov2680-fix-the-power-supply-n.patch +media-i2c-et8ek8-don-t-strip-remove-function-when-dr.patch +media-v4l2-subdev-fix-stream-handling-for-crop-api.patch +fbdev-sh7760fb-allow-modular-build.patch +media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch +drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch +drm-vc4-fix-possible-null-pointer-dereference.patch +asoc-tracing-export-snd_soc_dapm_dir_out-to-its-valu.patch +drm-bridge-anx7625-don-t-log-an-error-when-dsi-host-.patch +drm-bridge-icn6211-don-t-log-an-error-when-dsi-host-.patch +drm-bridge-lt8912b-don-t-log-an-error-when-dsi-host-.patch +drm-bridge-lt9611-don-t-log-an-error-when-dsi-host-c.patch +drm-bridge-lt9611uxc-don-t-log-an-error-when-dsi-hos.patch +drm-bridge-tc358775-don-t-log-an-error-when-dsi-host.patch +drm-bridge-dpc3433-don-t-log-an-error-when-dsi-host-.patch +drm-panel-novatek-nt35950-don-t-log-an-error-when-ds.patch +drm-bridge-anx7625-update-audio-status-while-detecti.patch +drm-panel-simple-add-missing-innolux-g121x1-l03-form.patch +drm-mipi-dsi-use-correct-return-type-for-the-dsc-fun.patch +media-uvcvideo-add-quirk-for-logitech-rally-bar.patch +drm-rockchip-vop2-do-not-divide-height-twice-for-yuv.patch +drm-edid-parse-topology-block-for-all-dispid-structu.patch +media-cadence-csi2rx-configure-dphy-before-starting-.patch +clk-samsung-exynosautov9-fix-wrong-pll-clock-id-valu.patch +rdma-mlx5-uncacheable-mkey-has-neither-rb_key-or-cac.patch +rdma-mlx5-adding-remote-atomic-access-flag-to-updata.patch +clk-mediatek-pllfh-don-t-log-error-for-missing-fhctl.patch +iommu-undo-pasid-attachment-only-for-the-devices-tha.patch +rdma-hns-fix-return-value-in-hns_roce_map_mr_sg.patch +rdma-hns-fix-deadlock-on-srq-async-events.patch +rdma-hns-fix-uaf-for-cq-async-event.patch +rdma-hns-fix-gmv-table-pagesize.patch +rdma-hns-use-complete-parentheses-in-macros.patch +rdma-hns-modify-the-print-level-of-cqe-error.patch +clk-mediatek-mt8365-mm-fix-dpi0-parent.patch +clk-rs9-fix-wrong-default-value-for-clock-amplitude.patch +clk-qcom-clk-alpha-pll-remove-invalid-stromer-regist.patch +rdma-rxe-fix-seg-fault-in-rxe_comp_queue_pkt.patch +rdma-rxe-allow-good-work-requests-to-be-executed.patch +rdma-rxe-fix-incorrect-rxe_put-in-error-path.patch +ib-mlx5-use-__iowrite64_copy-for-write-combining-sto.patch +clk-renesas-r8a779a0-fix-canfd-parent-clock.patch +clk-renesas-r9a07g043-add-clock-and-reset-entry-for-.patch +lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch +clk-qcom-dispcc-sm8450-fix-displayport-clocks.patch +clk-qcom-dispcc-sm6350-fix-displayport-clocks.patch +clk-qcom-dispcc-sm8550-fix-displayport-clocks.patch +clk-qcom-mmcc-msm8998-fix-venus-clock-issue.patch +x86-insn-fix-push-instruction-in-x86-instruction-dec.patch +x86-insn-add-vex-versions-of-vpdpbusd-vpdpbusds-vpdp.patch +ext4-avoid-excessive-credit-estimate-in-ext4_tmpfile.patch +virt-acrn-stop-using-follow_pfn.patch +drivers-virt-acrn-fix-pfnmap-pte-checks-in-acrn_vm_r.patch +sunrpc-removed-redundant-procp-check.patch +ext4-fix-potential-unnitialized-variable.patch +ext4-remove-the-redundant-folio_wait_stable.patch +nilfs2-make-superblock-data-array-index-computation-.patch +of-module-add-buffer-overflow-check-in-of_modalias.patch +rdma-bnxt_re-refactor-the-queue-index-update.patch +rdma-bnxt_re-remove-roundup_pow_of_two-depth-for-all.patch +rdma-bnxt_re-update-the-hw-interface-definitions.patch +rdma-bnxt_re-adds-msn-table-capability-for-gen-p7-ad.patch +bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch +sunrpc-fix-gss_free_in_token_pages.patch +selftests-kcmp-remove-unused-open-mode.patch +rdma-ipoib-fix-format-truncation-compilation-errors.patch +rdma-cma-fix-kmemleak-in-rdma_core-observed-during-b.patch +tracing-user_events-allow-events-to-persist-for-perf.patch +tracing-user_events-prepare-find-delete-for-same-nam.patch +tracing-user_events-fix-non-spaced-field-matching.patch +modules-drop-the-.export_symbol-section-from-the-fin.patch +net-bridge-xmit-make-sure-we-have-at-least-eth-heade.patch +selftests-net-bridge-increase-igmp-mld-exclude-timeo.patch +net-bridge-mst-fix-vlan-use-after-free.patch +net-qrtr-ns-fix-module-refcnt.patch +netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch +af_packet-do-not-call-packet_read_pending-from-tpack.patch +sched-fair-allow-disabling-sched_balance_newidle-wit.patch +sched-core-fix-incorrect-initialization-of-the-burst.patch +net-wangxun-fix-to-change-rx-features.patch diff --git a/queue-6.6/sh-kprobes-merge-arch_copy_kprobe-into-arch_prepare_.patch b/queue-6.6/sh-kprobes-merge-arch_copy_kprobe-into-arch_prepare_.patch new file mode 100644 index 00000000000..d982c3663cd --- /dev/null +++ b/queue-6.6/sh-kprobes-merge-arch_copy_kprobe-into-arch_prepare_.patch @@ -0,0 +1,53 @@ +From 5b483c9c3662f8bd33c230554c5274f18677d2ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 22:02:30 +0100 +Subject: sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() + +From: Geert Uytterhoeven + +[ Upstream commit 1422ae080b66134fe192082d9b721ab7bd93fcc5 ] + +arch/sh/kernel/kprobes.c:52:16: warning: no previous prototype for 'arch_copy_kprobe' [-Wmissing-prototypes] + +Although SH kprobes support was only merged in v2.6.28, it missed the +earlier removal of the arch_copy_kprobe() callback in v2.6.15. + +Based on the powerpc part of commit 49a2a1b83ba6fa40 ("[PATCH] kprobes: +changed from using spinlock to mutex"). + +Fixes: d39f5450146ff39f ("sh: Add kprobes support.") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/717d47a19689cc944fae6e981a1ad7cae1642c89.1709326528.git.geert+renesas@glider.be +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/kprobes.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/arch/sh/kernel/kprobes.c b/arch/sh/kernel/kprobes.c +index aed1ea8e2c2f0..74051b8ddf3e7 100644 +--- a/arch/sh/kernel/kprobes.c ++++ b/arch/sh/kernel/kprobes.c +@@ -44,17 +44,12 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + if (OPCODE_RTE(opcode)) + return -EFAULT; /* Bad breakpoint */ + ++ memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t)); + p->opcode = opcode; + + return 0; + } + +-void __kprobes arch_copy_kprobe(struct kprobe *p) +-{ +- memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t)); +- p->opcode = *p->addr; +-} +- + void __kprobes arch_arm_kprobe(struct kprobe *p) + { + *p->addr = BREAKPOINT_INSTRUCTION; +-- +2.43.0 + diff --git a/queue-6.6/soc-mediatek-cmdq-fix-typo-of-cmdq_jump_relative.patch b/queue-6.6/soc-mediatek-cmdq-fix-typo-of-cmdq_jump_relative.patch new file mode 100644 index 00000000000..5c9e60c0341 --- /dev/null +++ b/queue-6.6/soc-mediatek-cmdq-fix-typo-of-cmdq_jump_relative.patch @@ -0,0 +1,49 @@ +From f7f9594fca61f389cf035a0bdaba6d4480fc3ee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 15:41:09 +0000 +Subject: soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE + +From: Chun-Kuang Hu + +[ Upstream commit ed4d5ab179b9f0a60da87c650a31f1816db9b4b4 ] + +For cmdq jump command, offset 0 means relative jump and offset 1 +means absolute jump. cmdq_pkt_jump() is absolute jump, so fix the +typo of CMDQ_JUMP_RELATIVE in cmdq_pkt_jump(). + +Fixes: 946f1792d3d7 ("soc: mediatek: cmdq: add jump function") +Signed-off-by: Chun-Kuang Hu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240222154120.16959-2-chunkuang.hu@kernel.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-cmdq-helper.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/mediatek/mtk-cmdq-helper.c b/drivers/soc/mediatek/mtk-cmdq-helper.c +index b0cd071c4719b..0b2e5690dacfa 100644 +--- a/drivers/soc/mediatek/mtk-cmdq-helper.c ++++ b/drivers/soc/mediatek/mtk-cmdq-helper.c +@@ -14,7 +14,8 @@ + #define CMDQ_POLL_ENABLE_MASK BIT(0) + #define CMDQ_EOC_IRQ_EN BIT(0) + #define CMDQ_REG_TYPE 1 +-#define CMDQ_JUMP_RELATIVE 1 ++#define CMDQ_JUMP_RELATIVE 0 ++#define CMDQ_JUMP_ABSOLUTE 1 + + struct cmdq_instruction { + union { +@@ -397,7 +398,7 @@ int cmdq_pkt_jump(struct cmdq_pkt *pkt, dma_addr_t addr) + struct cmdq_instruction inst = {}; + + inst.op = CMDQ_CODE_JUMP; +- inst.offset = CMDQ_JUMP_RELATIVE; ++ inst.offset = CMDQ_JUMP_ABSOLUTE; + inst.value = addr >> + cmdq_get_shift_pa(((struct cmdq_client *)pkt->cl)->chan); + return cmdq_pkt_append_command(pkt, inst); +-- +2.43.0 + diff --git a/queue-6.6/soc-qcom-pmic_glink-don-t-traverse-clients-list-with.patch b/queue-6.6/soc-qcom-pmic_glink-don-t-traverse-clients-list-with.patch new file mode 100644 index 00000000000..7425c427fe2 --- /dev/null +++ b/queue-6.6/soc-qcom-pmic_glink-don-t-traverse-clients-list-with.patch @@ -0,0 +1,56 @@ +From 236e159ba3077205fc615ed33615f65fe4297303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 06:10:57 +0300 +Subject: soc: qcom: pmic_glink: don't traverse clients list without a lock + +From: Dmitry Baryshkov + +[ Upstream commit 635ce0db89567ba62f64b79e8c6664ba3eff6516 ] + +Take the client_lock before traversing the clients list at the +pmic_glink_state_notify_clients() function. This is required to keep the +list traversal safe from concurrent modification. + +Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Andrew Halaney +Reviewed-by: Mukesh Ojha +Tested-by: Xilin Wu # on QCS8550 AYN Odin 2 +Link: https://lore.kernel.org/r/20240403-pmic-glink-fix-clients-v2-1-aed4e02baacc@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pmic_glink.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/soc/qcom/pmic_glink.c b/drivers/soc/qcom/pmic_glink.c +index d5a4e71633ed6..c6dca5278e61b 100644 +--- a/drivers/soc/qcom/pmic_glink.c ++++ b/drivers/soc/qcom/pmic_glink.c +@@ -118,10 +118,12 @@ static int pmic_glink_rpmsg_callback(struct rpmsg_device *rpdev, void *data, + + hdr = data; + ++ mutex_lock(&pg->client_lock); + list_for_each_entry(client, &pg->clients, node) { + if (client->id == le32_to_cpu(hdr->owner)) + client->cb(data, len, client->priv); + } ++ mutex_unlock(&pg->client_lock); + + return 0; + } +@@ -171,8 +173,10 @@ static void pmic_glink_state_notify_clients(struct pmic_glink *pg) + } + + if (new_state != pg->client_state) { ++ mutex_lock(&pg->client_lock); + list_for_each_entry(client, &pg->clients, node) + client->pdr_notify(client->priv, new_state); ++ mutex_unlock(&pg->client_lock); + pg->client_state = new_state; + } + } +-- +2.43.0 + diff --git a/queue-6.6/soc-qcom-pmic_glink-make-client-lock-non-sleeping.patch b/queue-6.6/soc-qcom-pmic_glink-make-client-lock-non-sleeping.patch new file mode 100644 index 00000000000..e4db97f0be5 --- /dev/null +++ b/queue-6.6/soc-qcom-pmic_glink-make-client-lock-non-sleeping.patch @@ -0,0 +1,142 @@ +From be024dabdafc39bf335bff9cff1eea1f6ced2aca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 20:38:57 -0700 +Subject: soc: qcom: pmic_glink: Make client-lock non-sleeping + +From: Bjorn Andersson + +[ Upstream commit 9329933699b32d467a99befa20415c4b2172389a ] + +The recently introduced commit '635ce0db8956 ("soc: qcom: pmic_glink: +don't traverse clients list without a lock")' ensured that the clients +list is not modified while traversed. + +But the callback is made from the GLINK IRQ handler and as such this +mutual exclusion can not be provided by a (sleepable) mutex. + +Replace the mutex with a spinlock. + +Fixes: 635ce0db8956 ("soc: qcom: pmic_glink: don't traverse clients list without a lock") +Signed-off-by: Bjorn Andersson +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240430-pmic-glink-sleep-while-atomic-v1-1-88fb493e8545@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pmic_glink.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +diff --git a/drivers/soc/qcom/pmic_glink.c b/drivers/soc/qcom/pmic_glink.c +index 062ff7b12de6a..61a359938b6c4 100644 +--- a/drivers/soc/qcom/pmic_glink.c ++++ b/drivers/soc/qcom/pmic_glink.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + enum { + PMIC_GLINK_CLIENT_BATT = 0, +@@ -39,7 +40,7 @@ struct pmic_glink { + unsigned int pdr_state; + + /* serializing clients list updates */ +- struct mutex client_lock; ++ spinlock_t client_lock; + struct list_head clients; + }; + +@@ -61,10 +62,11 @@ static void _devm_pmic_glink_release_client(struct device *dev, void *res) + { + struct pmic_glink_client *client = (struct pmic_glink_client *)res; + struct pmic_glink *pg = client->pg; ++ unsigned long flags; + +- mutex_lock(&pg->client_lock); ++ spin_lock_irqsave(&pg->client_lock, flags); + list_del(&client->node); +- mutex_unlock(&pg->client_lock); ++ spin_unlock_irqrestore(&pg->client_lock, flags); + } + + struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, +@@ -75,6 +77,7 @@ struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, + { + struct pmic_glink_client *client; + struct pmic_glink *pg = dev_get_drvdata(dev->parent); ++ unsigned long flags; + + client = devres_alloc(_devm_pmic_glink_release_client, sizeof(*client), GFP_KERNEL); + if (!client) +@@ -87,12 +90,12 @@ struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, + client->priv = priv; + + mutex_lock(&pg->state_lock); +- mutex_lock(&pg->client_lock); ++ spin_lock_irqsave(&pg->client_lock, flags); + + list_add(&client->node, &pg->clients); + client->pdr_notify(client->priv, pg->client_state); + +- mutex_unlock(&pg->client_lock); ++ spin_unlock_irqrestore(&pg->client_lock, flags); + mutex_unlock(&pg->state_lock); + + devres_add(dev, client); +@@ -115,6 +118,7 @@ static int pmic_glink_rpmsg_callback(struct rpmsg_device *rpdev, void *data, + struct pmic_glink_client *client; + struct pmic_glink_hdr *hdr; + struct pmic_glink *pg = dev_get_drvdata(&rpdev->dev); ++ unsigned long flags; + + if (len < sizeof(*hdr)) { + dev_warn(pg->dev, "ignoring truncated message\n"); +@@ -123,12 +127,12 @@ static int pmic_glink_rpmsg_callback(struct rpmsg_device *rpdev, void *data, + + hdr = data; + +- mutex_lock(&pg->client_lock); ++ spin_lock_irqsave(&pg->client_lock, flags); + list_for_each_entry(client, &pg->clients, node) { + if (client->id == le32_to_cpu(hdr->owner)) + client->cb(data, len, client->priv); + } +- mutex_unlock(&pg->client_lock); ++ spin_unlock_irqrestore(&pg->client_lock, flags); + + return 0; + } +@@ -168,6 +172,7 @@ static void pmic_glink_state_notify_clients(struct pmic_glink *pg) + { + struct pmic_glink_client *client; + unsigned int new_state = pg->client_state; ++ unsigned long flags; + + if (pg->client_state != SERVREG_SERVICE_STATE_UP) { + if (pg->pdr_state == SERVREG_SERVICE_STATE_UP && pg->ept) +@@ -178,10 +183,10 @@ static void pmic_glink_state_notify_clients(struct pmic_glink *pg) + } + + if (new_state != pg->client_state) { +- mutex_lock(&pg->client_lock); ++ spin_lock_irqsave(&pg->client_lock, flags); + list_for_each_entry(client, &pg->clients, node) + client->pdr_notify(client->priv, new_state); +- mutex_unlock(&pg->client_lock); ++ spin_unlock_irqrestore(&pg->client_lock, flags); + pg->client_state = new_state; + } + } +@@ -268,7 +273,7 @@ static int pmic_glink_probe(struct platform_device *pdev) + pg->dev = &pdev->dev; + + INIT_LIST_HEAD(&pg->clients); +- mutex_init(&pg->client_lock); ++ spin_lock_init(&pg->client_lock); + mutex_init(&pg->state_lock); + + match_data = (unsigned long *)of_device_get_match_data(&pdev->dev); +-- +2.43.0 + diff --git a/queue-6.6/soc-qcom-pmic_glink-notify-clients-about-the-current.patch b/queue-6.6/soc-qcom-pmic_glink-notify-clients-about-the-current.patch new file mode 100644 index 00000000000..d75f7961469 --- /dev/null +++ b/queue-6.6/soc-qcom-pmic_glink-notify-clients-about-the-current.patch @@ -0,0 +1,48 @@ +From 9016783340e4324d2cf88d5ae5b9f1b379d1c12d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 06:10:58 +0300 +Subject: soc: qcom: pmic_glink: notify clients about the current state + +From: Dmitry Baryshkov + +[ Upstream commit d6cbce2cd354c9a37a558f290a8f1dfd20584f99 ] + +In case the client is registered after the pmic-glink recived a response +from the Protection Domain mapper, it is going to miss the notification +about the state. Notify clients about the current state upon +registration. + +Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver") +Reviewed-by: Andrew Halaney +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Mukesh Ojha +Tested-by: Xilin Wu # on QCS8550 AYN Odin 2 +Link: https://lore.kernel.org/r/20240403-pmic-glink-fix-clients-v2-2-aed4e02baacc@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pmic_glink.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/soc/qcom/pmic_glink.c b/drivers/soc/qcom/pmic_glink.c +index c6dca5278e61b..062ff7b12de6a 100644 +--- a/drivers/soc/qcom/pmic_glink.c ++++ b/drivers/soc/qcom/pmic_glink.c +@@ -86,9 +86,14 @@ struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, + client->pdr_notify = pdr; + client->priv = priv; + ++ mutex_lock(&pg->state_lock); + mutex_lock(&pg->client_lock); ++ + list_add(&client->node, &pg->clients); ++ client->pdr_notify(client->priv, pg->client_state); ++ + mutex_unlock(&pg->client_lock); ++ mutex_unlock(&pg->state_lock); + + devres_add(dev, client); + +-- +2.43.0 + diff --git a/queue-6.6/softirq-fix-suspicious-rcu-usage-in-__do_softirq.patch b/queue-6.6/softirq-fix-suspicious-rcu-usage-in-__do_softirq.patch new file mode 100644 index 00000000000..5f41a56097f --- /dev/null +++ b/queue-6.6/softirq-fix-suspicious-rcu-usage-in-__do_softirq.patch @@ -0,0 +1,102 @@ +From 90fead0b353f2ec50b9af1f4aef684cdc0679449 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Apr 2024 18:28:08 +0800 +Subject: softirq: Fix suspicious RCU usage in __do_softirq() + +From: Zqiang + +[ Upstream commit 1dd1eff161bd55968d3d46bc36def62d71fb4785 ] + +Currently, the condition "__this_cpu_read(ksoftirqd) == current" is used to +invoke rcu_softirq_qs() in ksoftirqd tasks context for non-RT kernels. + +This works correctly as long as the context is actually task context but +this condition is wrong when: + + - the current task is ksoftirqd + - the task is interrupted in a RCU read side critical section + - __do_softirq() is invoked on return from interrupt + +Syzkaller triggered the following scenario: + + -> finish_task_switch() + -> put_task_struct_rcu_user() + -> call_rcu(&task->rcu, delayed_put_task_struct) + -> __kasan_record_aux_stack() + -> pfn_valid() + -> rcu_read_lock_sched() + + __irq_exit_rcu() + -> __do_softirq)() + -> if (!IS_ENABLED(CONFIG_PREEMPT_RT) && + __this_cpu_read(ksoftirqd) == current) + -> rcu_softirq_qs() + -> RCU_LOCKDEP_WARN(lock_is_held(&rcu_sched_lock_map)) + +The rcu quiescent state is reported in the rcu-read critical section, so +the lockdep warning is triggered. + +Fix this by splitting out the inner working of __do_softirq() into a helper +function which takes an argument to distinguish between ksoftirqd task +context and interrupted context and invoke it from the relevant call sites +with the proper context information and use that for the conditional +invocation of rcu_softirq_qs(). + +Reported-by: syzbot+dce04ed6d1438ad69656@syzkaller.appspotmail.com +Suggested-by: Thomas Gleixner +Signed-off-by: Zqiang +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20240427102808.29356-1-qiang.zhang1211@gmail.com +Link: https://lore.kernel.org/lkml/8f281a10-b85a-4586-9586-5bbc12dc784f@paulmck-laptop/T/#mea8aba4abfcb97bbf499d169ce7f30c4cff1b0e3 +Signed-off-by: Sasha Levin +--- + kernel/softirq.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/kernel/softirq.c b/kernel/softirq.c +index 210cf5f8d92c2..bd9716d7bb638 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -507,7 +507,7 @@ static inline bool lockdep_softirq_start(void) { return false; } + static inline void lockdep_softirq_end(bool in_hardirq) { } + #endif + +-asmlinkage __visible void __softirq_entry __do_softirq(void) ++static void handle_softirqs(bool ksirqd) + { + unsigned long end = jiffies + MAX_SOFTIRQ_TIME; + unsigned long old_flags = current->flags; +@@ -562,8 +562,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void) + pending >>= softirq_bit; + } + +- if (!IS_ENABLED(CONFIG_PREEMPT_RT) && +- __this_cpu_read(ksoftirqd) == current) ++ if (!IS_ENABLED(CONFIG_PREEMPT_RT) && ksirqd) + rcu_softirq_qs(); + + local_irq_disable(); +@@ -583,6 +582,11 @@ asmlinkage __visible void __softirq_entry __do_softirq(void) + current_restore_flags(old_flags, PF_MEMALLOC); + } + ++asmlinkage __visible void __softirq_entry __do_softirq(void) ++{ ++ handle_softirqs(false); ++} ++ + /** + * irq_enter_rcu - Enter an interrupt context with RCU watching + */ +@@ -918,7 +922,7 @@ static void run_ksoftirqd(unsigned int cpu) + * We can safely run softirq on inline stack, as we are not deep + * in the task stack here. + */ +- __do_softirq(); ++ handle_softirqs(true); + ksoftirqd_run_end(); + cond_resched(); + return; +-- +2.43.0 + diff --git a/queue-6.6/sunrpc-fix-gss_free_in_token_pages.patch b/queue-6.6/sunrpc-fix-gss_free_in_token_pages.patch new file mode 100644 index 00000000000..c05bd2bbd51 --- /dev/null +++ b/queue-6.6/sunrpc-fix-gss_free_in_token_pages.patch @@ -0,0 +1,78 @@ +From 9e48bf192eec43ad867ef1e6b9813c30393457c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 09:10:41 -0400 +Subject: SUNRPC: Fix gss_free_in_token_pages() + +From: Chuck Lever + +[ Upstream commit bafa6b4d95d97877baa61883ff90f7e374427fae ] + +Dan Carpenter says: +> Commit 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()") from Oct +> 24, 2019 (linux-next), leads to the following Smatch static checker +> warning: +> +> net/sunrpc/auth_gss/svcauth_gss.c:1039 gss_free_in_token_pages() +> warn: iterator 'i' not incremented +> +> net/sunrpc/auth_gss/svcauth_gss.c +> 1034 static void gss_free_in_token_pages(struct gssp_in_token *in_token) +> 1035 { +> 1036 u32 inlen; +> 1037 int i; +> 1038 +> --> 1039 i = 0; +> 1040 inlen = in_token->page_len; +> 1041 while (inlen) { +> 1042 if (in_token->pages[i]) +> 1043 put_page(in_token->pages[i]); +> ^ +> This puts page zero over and over. +> +> 1044 inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen; +> 1045 } +> 1046 +> 1047 kfree(in_token->pages); +> 1048 in_token->pages = NULL; +> 1049 } + +Based on the way that the ->pages[] array is constructed in +gss_read_proxy_verf(), we know that once the loop encounters a NULL +page pointer, the remaining array elements must also be NULL. + +Reported-by: Dan Carpenter +Suggested-by: Trond Myklebust +Fixes: 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()") +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/auth_gss/svcauth_gss.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index 18734e70c5ddb..708297f338752 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -1043,17 +1043,11 @@ svcauth_gss_proc_init_verf(struct cache_detail *cd, struct svc_rqst *rqstp, + + static void gss_free_in_token_pages(struct gssp_in_token *in_token) + { +- u32 inlen; + int i; + + i = 0; +- inlen = in_token->page_len; +- while (inlen) { +- if (in_token->pages[i]) +- put_page(in_token->pages[i]); +- inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen; +- } +- ++ while (in_token->pages[i]) ++ put_page(in_token->pages[i++]); + kfree(in_token->pages); + in_token->pages = NULL; + } +-- +2.43.0 + diff --git a/queue-6.6/sunrpc-removed-redundant-procp-check.patch b/queue-6.6/sunrpc-removed-redundant-procp-check.patch new file mode 100644 index 00000000000..72993d8c16a --- /dev/null +++ b/queue-6.6/sunrpc-removed-redundant-procp-check.patch @@ -0,0 +1,39 @@ +From aa236284050a787280186b95b8c1480e3f5cef35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 14:10:44 +0700 +Subject: sunrpc: removed redundant procp check + +From: Aleksandr Aprelkov + +[ Upstream commit a576f36971ab4097b6aa76433532aa1fb5ee2d3b ] + +since vs_proc pointer is dereferenced before getting it's address there's +no need to check for NULL. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 8e5b67731d08 ("SUNRPC: Add a callback to initialise server requests") +Signed-off-by: Aleksandr Aprelkov +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/svc.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c +index 812fda9d45dd6..691499d1d2315 100644 +--- a/net/sunrpc/svc.c ++++ b/net/sunrpc/svc.c +@@ -1265,8 +1265,6 @@ svc_generic_init_request(struct svc_rqst *rqstp, + if (rqstp->rq_proc >= versp->vs_nproc) + goto err_bad_proc; + rqstp->rq_procinfo = procp = &versp->vs_proc[rqstp->rq_proc]; +- if (!procp) +- goto err_bad_proc; + + /* Initialize storage for argp and resp */ + memset(rqstp->rq_argp, 0, procp->pc_argzero); +-- +2.43.0 + diff --git a/queue-6.6/tcp-avoid-premature-drops-in-tcp_add_backlog.patch b/queue-6.6/tcp-avoid-premature-drops-in-tcp_add_backlog.patch new file mode 100644 index 00000000000..7cd8afed90b --- /dev/null +++ b/queue-6.6/tcp-avoid-premature-drops-in-tcp_add_backlog.patch @@ -0,0 +1,87 @@ +From b93ded746d1db62889afc610308f167042d51cec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 12:56:20 +0000 +Subject: tcp: avoid premature drops in tcp_add_backlog() + +From: Eric Dumazet + +[ Upstream commit ec00ed472bdb7d0af840da68c8c11bff9f4d9caa ] + +While testing TCP performance with latest trees, +I saw suspect SOCKET_BACKLOG drops. + +tcp_add_backlog() computes its limit with : + + limit = (u32)READ_ONCE(sk->sk_rcvbuf) + + (u32)(READ_ONCE(sk->sk_sndbuf) >> 1); + limit += 64 * 1024; + +This does not take into account that sk->sk_backlog.len +is reset only at the very end of __release_sock(). + +Both sk->sk_backlog.len and sk->sk_rmem_alloc could reach +sk_rcvbuf in normal conditions. + +We should double sk->sk_rcvbuf contribution in the formula +to absorb bubbles in the backlog, which happen more often +for very fast flows. + +This change maintains decent protection against abuses. + +Fixes: c377411f2494 ("net: sk_add_backlog() take rmem_alloc into account") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240423125620.3309458-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ipv4.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index c464ced7137ee..7c2ca4df0daa3 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1822,7 +1822,7 @@ int tcp_v4_early_demux(struct sk_buff *skb) + bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb, + enum skb_drop_reason *reason) + { +- u32 limit, tail_gso_size, tail_gso_segs; ++ u32 tail_gso_size, tail_gso_segs; + struct skb_shared_info *shinfo; + const struct tcphdr *th; + struct tcphdr *thtail; +@@ -1831,6 +1831,7 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb, + bool fragstolen; + u32 gso_segs; + u32 gso_size; ++ u64 limit; + int delta; + + /* In case all data was pulled from skb frags (in __pskb_pull_tail()), +@@ -1928,7 +1929,13 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb, + __skb_push(skb, hdrlen); + + no_coalesce: +- limit = (u32)READ_ONCE(sk->sk_rcvbuf) + (u32)(READ_ONCE(sk->sk_sndbuf) >> 1); ++ /* sk->sk_backlog.len is reset only at the end of __release_sock(). ++ * Both sk->sk_backlog.len and sk->sk_rmem_alloc could reach ++ * sk_rcvbuf in normal conditions. ++ */ ++ limit = ((u64)READ_ONCE(sk->sk_rcvbuf)) << 1; ++ ++ limit += ((u32)READ_ONCE(sk->sk_sndbuf)) >> 1; + + /* Only socket owner can try to collapse/prune rx queues + * to reduce memory overhead, so add a little headroom here. +@@ -1936,6 +1943,8 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb, + */ + limit += 64 * 1024; + ++ limit = min_t(u64, limit, UINT_MAX); ++ + if (unlikely(sk_add_backlog(sk, skb, limit))) { + bh_unlock_sock(sk); + *reason = SKB_DROP_REASON_SOCKET_BACKLOG; +-- +2.43.0 + diff --git a/queue-6.6/tcp-define-initial-scaling-factor-value-as-a-macro.patch b/queue-6.6/tcp-define-initial-scaling-factor-value-as-a-macro.patch new file mode 100644 index 00000000000..91ad60cf1b8 --- /dev/null +++ b/queue-6.6/tcp-define-initial-scaling-factor-value-as-a-macro.patch @@ -0,0 +1,53 @@ +From 5d34038395358f0db0422c67bf373eb66c9371cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 13:44:37 -0700 +Subject: tcp: define initial scaling factor value as a macro + +From: Paolo Abeni + +[ Upstream commit 849ee75a38b297187c760bb1d23d8f2a7b1fc73e ] + +So that other users could access it. Notably MPTCP will use +it in the next patch. + +No functional change intended. + +Acked-by: Matthieu Baerts +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Link: https://lore.kernel.org/r/20231023-send-net-next-20231023-2-v1-4-9dc60939d371@kernel.org +Signed-off-by: Jakub Kicinski +Stable-dep-of: 697a6c8cec03 ("tcp: increase the default TCP scaling ratio") +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index a3840a2749c19..343cd0a5e8e17 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1460,13 +1460,15 @@ static inline int tcp_space_from_win(const struct sock *sk, int win) + return __tcp_space_from_win(tcp_sk(sk)->scaling_ratio, win); + } + ++/* Assume a conservative default of 1200 bytes of payload per 4K page. ++ * This may be adjusted later in tcp_measure_rcv_mss(). ++ */ ++#define TCP_DEFAULT_SCALING_RATIO ((1200 << TCP_RMEM_TO_WIN_SCALE) / \ ++ SKB_TRUESIZE(4096)) ++ + static inline void tcp_scaling_ratio_init(struct sock *sk) + { +- /* Assume a conservative default of 1200 bytes of payload per 4K page. +- * This may be adjusted later in tcp_measure_rcv_mss(). +- */ +- tcp_sk(sk)->scaling_ratio = (1200 << TCP_RMEM_TO_WIN_SCALE) / +- SKB_TRUESIZE(4096); ++ tcp_sk(sk)->scaling_ratio = TCP_DEFAULT_SCALING_RATIO; + } + + /* Note: caller must be prepared to deal with negative returns */ +-- +2.43.0 + diff --git a/queue-6.6/tcp-increase-the-default-tcp-scaling-ratio.patch b/queue-6.6/tcp-increase-the-default-tcp-scaling-ratio.patch new file mode 100644 index 00000000000..585812b9e0f --- /dev/null +++ b/queue-6.6/tcp-increase-the-default-tcp-scaling-ratio.patch @@ -0,0 +1,71 @@ +From 1a35cc892c1a62112949223ee6d5fac341f66002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 09:43:55 -0700 +Subject: tcp: increase the default TCP scaling ratio + +From: Hechao Li + +[ Upstream commit 697a6c8cec03c2299f850fa50322641a8bf6b915 ] + +After commit dfa2f0483360 ("tcp: get rid of sysctl_tcp_adv_win_scale"), +we noticed an application-level timeout due to reduced throughput. + +Before the commit, for a client that sets SO_RCVBUF to 65k, it takes +around 22 seconds to transfer 10M data. After the commit, it takes 40 +seconds. Because our application has a 30-second timeout, this +regression broke the application. + +The reason that it takes longer to transfer data is that +tp->scaling_ratio is initialized to a value that results in ~0.25 of +rcvbuf. In our case, SO_RCVBUF is set to 65536 by the application, which +translates to 2 * 65536 = 131,072 bytes in rcvbuf and hence a ~28k +initial receive window. + +Later, even though the scaling_ratio is updated to a more accurate +skb->len/skb->truesize, which is ~0.66 in our environment, the window +stays at ~0.25 * rcvbuf. This is because tp->window_clamp does not +change together with the tp->scaling_ratio update when autotuning is +disabled due to SO_RCVBUF. As a result, the window size is capped at the +initial window_clamp, which is also ~0.25 * rcvbuf, and never grows +bigger. + +Most modern applications let the kernel do autotuning, and benefit from +the increased scaling_ratio. But there are applications such as kafka +that has a default setting of SO_RCVBUF=64k. + +This patch increases the initial scaling_ratio from ~25% to 50% in order +to make it backward compatible with the original default +sysctl_tcp_adv_win_scale for applications setting SO_RCVBUF. + +Fixes: dfa2f0483360 ("tcp: get rid of sysctl_tcp_adv_win_scale") +Signed-off-by: Hechao Li +Reviewed-by: Tycho Andersen +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/netdev/20240402215405.432863-1-hli@netflix.com/ +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 343cd0a5e8e17..690770321a6e3 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1460,11 +1460,10 @@ static inline int tcp_space_from_win(const struct sock *sk, int win) + return __tcp_space_from_win(tcp_sk(sk)->scaling_ratio, win); + } + +-/* Assume a conservative default of 1200 bytes of payload per 4K page. ++/* Assume a 50% default for skb->len/skb->truesize ratio. + * This may be adjusted later in tcp_measure_rcv_mss(). + */ +-#define TCP_DEFAULT_SCALING_RATIO ((1200 << TCP_RMEM_TO_WIN_SCALE) / \ +- SKB_TRUESIZE(4096)) ++#define TCP_DEFAULT_SCALING_RATIO (1 << (TCP_RMEM_TO_WIN_SCALE - 1)) + + static inline void tcp_scaling_ratio_init(struct sock *sk) + { +-- +2.43.0 + diff --git a/queue-6.6/thermal-drivers-tsens-fix-null-pointer-dereference.patch b/queue-6.6/thermal-drivers-tsens-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..9aa9cae0fc6 --- /dev/null +++ b/queue-6.6/thermal-drivers-tsens-fix-null-pointer-dereference.patch @@ -0,0 +1,42 @@ +From d387c4e811a01ebfb3b249a38abee17092055995 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 14:40:21 +0300 +Subject: thermal/drivers/tsens: Fix null pointer dereference + +From: Aleksandr Mishin + +[ Upstream commit d998ddc86a27c92140b9f7984ff41e3d1d07a48f ] + +compute_intercept_slope() is called from calibrate_8960() (in tsens-8960.c) +as compute_intercept_slope(priv, p1, NULL, ONE_PT_CALIB) which lead to null +pointer dereference (if DEBUG or DYNAMIC_DEBUG set). +Fix this bug by adding null pointer check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: dfc1193d4dbd ("thermal/drivers/tsens: Replace custom 8960 apis with generic apis") +Signed-off-by: Aleksandr Mishin +Reviewed-by: Konrad Dybcio +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20240411114021.12203-1-amishin@t-argos.ru +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c +index 98c356acfe983..ee22672471e81 100644 +--- a/drivers/thermal/qcom/tsens.c ++++ b/drivers/thermal/qcom/tsens.c +@@ -264,7 +264,7 @@ void compute_intercept_slope(struct tsens_priv *priv, u32 *p1, + for (i = 0; i < priv->num_sensors; i++) { + dev_dbg(priv->dev, + "%s: sensor%d - data_point1:%#x data_point2:%#x\n", +- __func__, i, p1[i], p2[i]); ++ __func__, i, p1[i], p2 ? p2[i] : 0); + + if (!priv->sensor[i].slope) + priv->sensor[i].slope = SLOPE_DEFAULT; +-- +2.43.0 + diff --git a/queue-6.6/tracing-user_events-allow-events-to-persist-for-perf.patch b/queue-6.6/tracing-user_events-allow-events-to-persist-for-perf.patch new file mode 100644 index 00000000000..a4bee916d80 --- /dev/null +++ b/queue-6.6/tracing-user_events-allow-events-to-persist-for-perf.patch @@ -0,0 +1,144 @@ +From 1cf797299945810e53ec8fa97b12aeadbba457b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Sep 2023 18:07:02 +0000 +Subject: tracing/user_events: Allow events to persist for perfmon_capable + users + +From: Beau Belgrave + +[ Upstream commit 5dbd04eddb2c0841d1b3930e0a9944a2343c9cac ] + +There are several scenarios that have come up where having a user_event +persist even if the process that registered it exits. The main one is +having a daemon create events on bootup that shouldn't get deleted if +the daemon has to exit or reload. Another is within OpenTelemetry +exporters, they wish to potentially check if a user_event exists on the +system to determine if exporting the data out should occur. The +user_event in this case must exist even in the absence of the owning +process running (such as the above daemon case). + +Expose the previously internal flag USER_EVENT_REG_PERSIST to user +processes. Upon register or delete of events with this flag, ensure the +user is perfmon_capable to prevent random user processes with access to +tracefs from creating events that persist after exit. + +Link: https://lkml.kernel.org/r/20230912180704.1284-2-beaub@linux.microsoft.com + +Signed-off-by: Beau Belgrave +Signed-off-by: Steven Rostedt (Google) +Stable-dep-of: bd125a084091 ("tracing/user_events: Fix non-spaced field matching") +Signed-off-by: Sasha Levin +--- + include/uapi/linux/user_events.h | 11 +++++++++- + kernel/trace/trace_events_user.c | 36 +++++++++++++++++++------------- + 2 files changed, 32 insertions(+), 15 deletions(-) + +diff --git a/include/uapi/linux/user_events.h b/include/uapi/linux/user_events.h +index 2984aae4a2b4f..f74f3aedd49ce 100644 +--- a/include/uapi/linux/user_events.h ++++ b/include/uapi/linux/user_events.h +@@ -17,6 +17,15 @@ + /* Create dynamic location entry within a 32-bit value */ + #define DYN_LOC(offset, size) ((size) << 16 | (offset)) + ++/* List of supported registration flags */ ++enum user_reg_flag { ++ /* Event will not delete upon last reference closing */ ++ USER_EVENT_REG_PERSIST = 1U << 0, ++ ++ /* This value or above is currently non-ABI */ ++ USER_EVENT_REG_MAX = 1U << 1, ++}; ++ + /* + * Describes an event registration and stores the results of the registration. + * This structure is passed to the DIAG_IOCSREG ioctl, callers at a minimum +@@ -33,7 +42,7 @@ struct user_reg { + /* Input: Enable size in bytes at address */ + __u8 enable_size; + +- /* Input: Flags for future use, set to 0 */ ++ /* Input: Flags to use, if any */ + __u16 flags; + + /* Input: Address to update when enabled */ +diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c +index b87f41187c6a9..9365ce4074263 100644 +--- a/kernel/trace/trace_events_user.c ++++ b/kernel/trace/trace_events_user.c +@@ -49,18 +49,6 @@ + #define EVENT_STATUS_PERF BIT(1) + #define EVENT_STATUS_OTHER BIT(7) + +-/* +- * User register flags are not allowed yet, keep them here until we are +- * ready to expose them out to the user ABI. +- */ +-enum user_reg_flag { +- /* Event will not delete upon last reference closing */ +- USER_EVENT_REG_PERSIST = 1U << 0, +- +- /* This value or above is currently non-ABI */ +- USER_EVENT_REG_MAX = 1U << 1, +-}; +- + /* + * Stores the system name, tables, and locks for a group of events. This + * allows isolation for events by various means. +@@ -220,6 +208,17 @@ static u32 user_event_key(char *name) + return jhash(name, strlen(name), 0); + } + ++static bool user_event_capable(u16 reg_flags) ++{ ++ /* Persistent events require CAP_PERFMON / CAP_SYS_ADMIN */ ++ if (reg_flags & USER_EVENT_REG_PERSIST) { ++ if (!perfmon_capable()) ++ return false; ++ } ++ ++ return true; ++} ++ + static struct user_event *user_event_get(struct user_event *user) + { + refcount_inc(&user->refcnt); +@@ -1811,6 +1810,9 @@ static int user_event_free(struct dyn_event *ev) + if (!user_event_last_ref(user)) + return -EBUSY; + ++ if (!user_event_capable(user->reg_flags)) ++ return -EPERM; ++ + return destroy_user_event(user); + } + +@@ -1926,10 +1928,13 @@ static int user_event_parse(struct user_event_group *group, char *name, + int argc = 0; + char **argv; + +- /* User register flags are not ready yet */ +- if (reg_flags != 0 || flags != NULL) ++ /* Currently don't support any text based flags */ ++ if (flags != NULL) + return -EINVAL; + ++ if (!user_event_capable(reg_flags)) ++ return -EPERM; ++ + /* Prevent dyn_event from racing */ + mutex_lock(&event_mutex); + user = find_user_event(group, name, &key); +@@ -2062,6 +2067,9 @@ static int delete_user_event(struct user_event_group *group, char *name) + if (!user_event_last_ref(user)) + return -EBUSY; + ++ if (!user_event_capable(user->reg_flags)) ++ return -EPERM; ++ + return destroy_user_event(user); + } + +-- +2.43.0 + diff --git a/queue-6.6/tracing-user_events-fix-non-spaced-field-matching.patch b/queue-6.6/tracing-user_events-fix-non-spaced-field-matching.patch new file mode 100644 index 00000000000..4012b14cf63 --- /dev/null +++ b/queue-6.6/tracing-user_events-fix-non-spaced-field-matching.patch @@ -0,0 +1,139 @@ +From d3611c0716c22e8f110b9fc02c8470774172bf76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 16:23:37 +0000 +Subject: tracing/user_events: Fix non-spaced field matching + +From: Beau Belgrave + +[ Upstream commit bd125a084091396f3e796bb3dc009940d9771811 ] + +When the ABI was updated to prevent same name w/different args, it +missed an important corner case when fields don't end with a space. +Typically, space is used for fields to help separate them, like +"u8 field1; u8 field2". If no spaces are used, like +"u8 field1;u8 field2", then the parsing works for the first time. +However, the match check fails on a subsequent register, leading to +confusion. + +This is because the match check uses argv_split() and assumes that all +fields will be split upon the space. When spaces are used, we get back +{ "u8", "field1;" }, without spaces we get back { "u8", "field1;u8" }. +This causes a mismatch, and the user program gets back -EADDRINUSE. + +Add a method to detect this case before calling argv_split(). If found +force a space after the field separator character ';'. This ensures all +cases work properly for matching. + +With this fix, the following are all treated as matching: +u8 field1;u8 field2 +u8 field1; u8 field2 +u8 field1;\tu8 field2 +u8 field1;\nu8 field2 + +Link: https://lore.kernel.org/linux-trace-kernel/20240423162338.292-2-beaub@linux.microsoft.com + +Fixes: ba470eebc2f6 ("tracing/user_events: Prevent same name but different args event") +Signed-off-by: Beau Belgrave +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events_user.c | 76 +++++++++++++++++++++++++++++++- + 1 file changed, 75 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c +index dda58681247e1..2461786b1e4d2 100644 +--- a/kernel/trace/trace_events_user.c ++++ b/kernel/trace/trace_events_user.c +@@ -1923,6 +1923,80 @@ static int user_event_trace_register(struct user_event *user) + return ret; + } + ++/* ++ * Counts how many ';' without a trailing space are in the args. ++ */ ++static int count_semis_no_space(char *args) ++{ ++ int count = 0; ++ ++ while ((args = strchr(args, ';'))) { ++ args++; ++ ++ if (!isspace(*args)) ++ count++; ++ } ++ ++ return count; ++} ++ ++/* ++ * Copies the arguments while ensuring all ';' have a trailing space. ++ */ ++static char *insert_space_after_semis(char *args, int count) ++{ ++ char *fixed, *pos; ++ int len; ++ ++ len = strlen(args) + count; ++ fixed = kmalloc(len + 1, GFP_KERNEL); ++ ++ if (!fixed) ++ return NULL; ++ ++ pos = fixed; ++ ++ /* Insert a space after ';' if there is no trailing space. */ ++ while (*args) { ++ *pos = *args++; ++ ++ if (*pos++ == ';' && !isspace(*args)) ++ *pos++ = ' '; ++ } ++ ++ *pos = '\0'; ++ ++ return fixed; ++} ++ ++static char **user_event_argv_split(char *args, int *argc) ++{ ++ char **split; ++ char *fixed; ++ int count; ++ ++ /* Count how many ';' without a trailing space */ ++ count = count_semis_no_space(args); ++ ++ /* No fixup is required */ ++ if (!count) ++ return argv_split(GFP_KERNEL, args, argc); ++ ++ /* We must fixup 'field;field' to 'field; field' */ ++ fixed = insert_space_after_semis(args, count); ++ ++ if (!fixed) ++ return NULL; ++ ++ /* We do a normal split afterwards */ ++ split = argv_split(GFP_KERNEL, fixed, argc); ++ ++ /* We can free since argv_split makes a copy */ ++ kfree(fixed); ++ ++ return split; ++} ++ + /* + * Parses the event name, arguments and flags then registers if successful. + * The name buffer lifetime is owned by this method for success cases only. +@@ -1946,7 +2020,7 @@ static int user_event_parse(struct user_event_group *group, char *name, + return -EPERM; + + if (args) { +- argv = argv_split(GFP_KERNEL, args, &argc); ++ argv = user_event_argv_split(args, &argc); + + if (!argv) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/tracing-user_events-prepare-find-delete-for-same-nam.patch b/queue-6.6/tracing-user_events-prepare-find-delete-for-same-nam.patch new file mode 100644 index 00000000000..2357306aa54 --- /dev/null +++ b/queue-6.6/tracing-user_events-prepare-find-delete-for-same-nam.patch @@ -0,0 +1,234 @@ +From 8233ceecc5f66a3491a36f82df84e0c051fe9846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 00:18:04 +0000 +Subject: tracing/user_events: Prepare find/delete for same name events + +From: Beau Belgrave + +[ Upstream commit 1e953de9e9b4ca77a9ce0fc17a0778eba3a4ca64 ] + +The current code for finding and deleting events assumes that there will +never be cases when user_events are registered with the same name, but +different formats. Scenarios exist where programs want to use the same +name but have different formats. An example is multiple versions of a +program running side-by-side using the same event name, but with updated +formats in each version. + +This change does not yet allow for multi-format events. If user_events +are registered with the same name but different arguments the programs +see the same return values as before. This change simply makes it +possible to easily accommodate for this. + +Update find_user_event() to take in argument parameters and register +flags to accommodate future multi-format event scenarios. Have find +validate argument matching and return error pointers to cover when +an existing event has the same name but different format. Update +callers to handle error pointer logic. + +Move delete_user_event() to use hash walking directly now that +find_user_event() has changed. Delete all events found that match the +register name, stop if an error occurs and report back to the user. + +Update user_fields_match() to cover list_empty() scenarios now that +find_user_event() uses it directly. This makes the logic consistent +across several callsites. + +Link: https://lore.kernel.org/linux-trace-kernel/20240222001807.1463-2-beaub@linux.microsoft.com + +Signed-off-by: Beau Belgrave +Signed-off-by: Steven Rostedt (Google) +Stable-dep-of: bd125a084091 ("tracing/user_events: Fix non-spaced field matching") +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events_user.c | 107 +++++++++++++++++-------------- + 1 file changed, 59 insertions(+), 48 deletions(-) + +diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c +index 9365ce4074263..dda58681247e1 100644 +--- a/kernel/trace/trace_events_user.c ++++ b/kernel/trace/trace_events_user.c +@@ -202,6 +202,8 @@ static struct user_event_mm *user_event_mm_get(struct user_event_mm *mm); + static struct user_event_mm *user_event_mm_get_all(struct user_event *user); + static void user_event_mm_put(struct user_event_mm *mm); + static int destroy_user_event(struct user_event *user); ++static bool user_fields_match(struct user_event *user, int argc, ++ const char **argv); + + static u32 user_event_key(char *name) + { +@@ -1493,17 +1495,24 @@ static int destroy_user_event(struct user_event *user) + } + + static struct user_event *find_user_event(struct user_event_group *group, +- char *name, u32 *outkey) ++ char *name, int argc, const char **argv, ++ u32 flags, u32 *outkey) + { + struct user_event *user; + u32 key = user_event_key(name); + + *outkey = key; + +- hash_for_each_possible(group->register_table, user, node, key) +- if (!strcmp(EVENT_NAME(user), name)) ++ hash_for_each_possible(group->register_table, user, node, key) { ++ if (strcmp(EVENT_NAME(user), name)) ++ continue; ++ ++ if (user_fields_match(user, argc, argv)) + return user_event_get(user); + ++ return ERR_PTR(-EADDRINUSE); ++ } ++ + return NULL; + } + +@@ -1860,6 +1869,9 @@ static bool user_fields_match(struct user_event *user, int argc, + struct list_head *head = &user->fields; + int i = 0; + ++ if (argc == 0) ++ return list_empty(head); ++ + list_for_each_entry_reverse(field, head, link) { + if (!user_field_match(field, argc, argv, &i)) + return false; +@@ -1880,10 +1892,8 @@ static bool user_event_match(const char *system, const char *event, + match = strcmp(EVENT_NAME(user), event) == 0 && + (!system || strcmp(system, USER_EVENTS_SYSTEM) == 0); + +- if (match && argc > 0) ++ if (match) + match = user_fields_match(user, argc, argv); +- else if (match && argc == 0) +- match = list_empty(&user->fields); + + return match; + } +@@ -1922,11 +1932,11 @@ static int user_event_parse(struct user_event_group *group, char *name, + char *args, char *flags, + struct user_event **newuser, int reg_flags) + { +- int ret; +- u32 key; + struct user_event *user; ++ char **argv = NULL; + int argc = 0; +- char **argv; ++ int ret; ++ u32 key; + + /* Currently don't support any text based flags */ + if (flags != NULL) +@@ -1935,41 +1945,34 @@ static int user_event_parse(struct user_event_group *group, char *name, + if (!user_event_capable(reg_flags)) + return -EPERM; + ++ if (args) { ++ argv = argv_split(GFP_KERNEL, args, &argc); ++ ++ if (!argv) ++ return -ENOMEM; ++ } ++ + /* Prevent dyn_event from racing */ + mutex_lock(&event_mutex); +- user = find_user_event(group, name, &key); ++ user = find_user_event(group, name, argc, (const char **)argv, ++ reg_flags, &key); + mutex_unlock(&event_mutex); + +- if (user) { +- if (args) { +- argv = argv_split(GFP_KERNEL, args, &argc); +- if (!argv) { +- ret = -ENOMEM; +- goto error; +- } ++ if (argv) ++ argv_free(argv); + +- ret = user_fields_match(user, argc, (const char **)argv); +- argv_free(argv); +- +- } else +- ret = list_empty(&user->fields); +- +- if (ret) { +- *newuser = user; +- /* +- * Name is allocated by caller, free it since it already exists. +- * Caller only worries about failure cases for freeing. +- */ +- kfree(name); +- } else { +- ret = -EADDRINUSE; +- goto error; +- } ++ if (IS_ERR(user)) ++ return PTR_ERR(user); ++ ++ if (user) { ++ *newuser = user; ++ /* ++ * Name is allocated by caller, free it since it already exists. ++ * Caller only worries about failure cases for freeing. ++ */ ++ kfree(name); + + return 0; +-error: +- user_event_put(user, false); +- return ret; + } + + user = kzalloc(sizeof(*user), GFP_KERNEL_ACCOUNT); +@@ -2052,25 +2055,33 @@ static int user_event_parse(struct user_event_group *group, char *name, + } + + /* +- * Deletes a previously created event if it is no longer being used. ++ * Deletes previously created events if they are no longer being used. + */ + static int delete_user_event(struct user_event_group *group, char *name) + { +- u32 key; +- struct user_event *user = find_user_event(group, name, &key); ++ struct user_event *user; ++ struct hlist_node *tmp; ++ u32 key = user_event_key(name); ++ int ret = -ENOENT; + +- if (!user) +- return -ENOENT; ++ /* Attempt to delete all event(s) with the name passed in */ ++ hash_for_each_possible_safe(group->register_table, user, tmp, node, key) { ++ if (strcmp(EVENT_NAME(user), name)) ++ continue; + +- user_event_put(user, true); ++ if (!user_event_last_ref(user)) ++ return -EBUSY; + +- if (!user_event_last_ref(user)) +- return -EBUSY; ++ if (!user_event_capable(user->reg_flags)) ++ return -EPERM; + +- if (!user_event_capable(user->reg_flags)) +- return -EPERM; ++ ret = destroy_user_event(user); + +- return destroy_user_event(user); ++ if (ret) ++ goto out; ++ } ++out: ++ return ret; + } + + /* +-- +2.43.0 + diff --git a/queue-6.6/udp-avoid-call-to-compute_score-on-multiple-sites.patch b/queue-6.6/udp-avoid-call-to-compute_score-on-multiple-sites.patch new file mode 100644 index 00000000000..c16d36e5107 --- /dev/null +++ b/queue-6.6/udp-avoid-call-to-compute_score-on-multiple-sites.patch @@ -0,0 +1,164 @@ +From 8eb90392db01ad6734fb4bc36126caff28a99139 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:20:04 -0400 +Subject: udp: Avoid call to compute_score on multiple sites + +From: Gabriel Krisman Bertazi + +[ Upstream commit 50aee97d15113b95a68848db1f0cb2a6c09f753a ] + +We've observed a 7-12% performance regression in iperf3 UDP ipv4 and +ipv6 tests with multiple sockets on Zen3 cpus, which we traced back to +commit f0ea27e7bfe1 ("udp: re-score reuseport groups when connected +sockets are present"). The failing tests were those that would spawn +UDP sockets per-cpu on systems that have a high number of cpus. + +Unsurprisingly, it is not caused by the extra re-scoring of the reused +socket, but due to the compiler no longer inlining compute_score, once +it has the extra call site in udp4_lib_lookup2. This is augmented by +the "Safe RET" mitigation for SRSO, needed in our Zen3 cpus. + +We could just explicitly inline it, but compute_score() is quite a large +function, around 300b. Inlining in two sites would almost double +udp4_lib_lookup2, which is a silly thing to do just to workaround a +mitigation. Instead, this patch shuffles the code a bit to avoid the +multiple calls to compute_score. Since it is a static function used in +one spot, the compiler can safely fold it in, as it did before, without +increasing the text size. + +With this patch applied I ran my original iperf3 testcases. The failing +cases all looked like this (ipv4): + iperf3 -c 127.0.0.1 --udp -4 -f K -b $R -l 8920 -t 30 -i 5 -P 64 -O 2 + +where $R is either 1G/10G/0 (max, unlimited). I ran 3 times each. +baseline is v6.9-rc3. harmean == harmonic mean; CV == coefficient of +variation. + +ipv4: + 1G 10G MAX + HARMEAN (CV) HARMEAN (CV) HARMEAN (CV) +baseline 1743852.66(0.0208) 1725933.02(0.0167) 1705203.78(0.0386) +patched 1968727.61(0.0035) 1962283.22(0.0195) 1923853.50(0.0256) + +ipv6: + 1G 10G MAX + HARMEAN (CV) HARMEAN (CV) HARMEAN (CV) +baseline 1729020.03(0.0028) 1691704.49(0.0243) 1692251.34(0.0083) +patched 1900422.19(0.0067) 1900968.01(0.0067) 1568532.72(0.1519) + +This restores the performance we had before the change above with this +benchmark. We obviously don't expect any real impact when mitigations +are disabled, but just to be sure it also doesn't regresses: + +mitigations=off ipv4: + 1G 10G MAX + HARMEAN (CV) HARMEAN (CV) HARMEAN (CV) +baseline 3230279.97(0.0066) 3229320.91(0.0060) 2605693.19(0.0697) +patched 3242802.36(0.0073) 3239310.71(0.0035) 2502427.19(0.0882) + +Cc: Lorenz Bauer +Fixes: f0ea27e7bfe1 ("udp: re-score reuseport groups when connected sockets are present") +Signed-off-by: Gabriel Krisman Bertazi +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/udp.c | 21 ++++++++++++++++----- + net/ipv6/udp.c | 20 ++++++++++++++++---- + 2 files changed, 32 insertions(+), 9 deletions(-) + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index ca576587f6d21..16ca211c8619d 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -429,15 +429,21 @@ static struct sock *udp4_lib_lookup2(struct net *net, + { + struct sock *sk, *result; + int score, badness; ++ bool need_rescore; + + result = NULL; + badness = 0; + udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) { +- score = compute_score(sk, net, saddr, sport, +- daddr, hnum, dif, sdif); ++ need_rescore = false; ++rescore: ++ score = compute_score(need_rescore ? result : sk, net, saddr, ++ sport, daddr, hnum, dif, sdif); + if (score > badness) { + badness = score; + ++ if (need_rescore) ++ continue; ++ + if (sk->sk_state == TCP_ESTABLISHED) { + result = sk; + continue; +@@ -458,9 +464,14 @@ static struct sock *udp4_lib_lookup2(struct net *net, + if (IS_ERR(result)) + continue; + +- badness = compute_score(result, net, saddr, sport, +- daddr, hnum, dif, sdif); +- ++ /* compute_score is too long of a function to be ++ * inlined, and calling it again here yields ++ * measureable overhead for some ++ * workloads. Work around it by jumping ++ * backwards to rescore 'result'. ++ */ ++ need_rescore = true; ++ goto rescore; + } + } + return result; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 124cf2bb2a6d7..c77ee9a3cde24 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -171,15 +171,21 @@ static struct sock *udp6_lib_lookup2(struct net *net, + { + struct sock *sk, *result; + int score, badness; ++ bool need_rescore; + + result = NULL; + badness = -1; + udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) { +- score = compute_score(sk, net, saddr, sport, +- daddr, hnum, dif, sdif); ++ need_rescore = false; ++rescore: ++ score = compute_score(need_rescore ? result : sk, net, saddr, ++ sport, daddr, hnum, dif, sdif); + if (score > badness) { + badness = score; + ++ if (need_rescore) ++ continue; ++ + if (sk->sk_state == TCP_ESTABLISHED) { + result = sk; + continue; +@@ -200,8 +206,14 @@ static struct sock *udp6_lib_lookup2(struct net *net, + if (IS_ERR(result)) + continue; + +- badness = compute_score(sk, net, saddr, sport, +- daddr, hnum, dif, sdif); ++ /* compute_score is too long of a function to be ++ * inlined, and calling it again here yields ++ * measureable overhead for some ++ * workloads. Work around it by jumping ++ * backwards to rescore 'result'. ++ */ ++ need_rescore = true; ++ goto rescore; + } + } + return result; +-- +2.43.0 + diff --git a/queue-6.6/usb-aqc111-stop-lying-about-skb-truesize.patch b/queue-6.6/usb-aqc111-stop-lying-about-skb-truesize.patch new file mode 100644 index 00000000000..43767417087 --- /dev/null +++ b/queue-6.6/usb-aqc111-stop-lying-about-skb-truesize.patch @@ -0,0 +1,55 @@ +From fb59012caad215cd06d14814bc373da9089316fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 13:55:46 +0000 +Subject: usb: aqc111: stop lying about skb->truesize + +From: Eric Dumazet + +[ Upstream commit 9aad6e45c4e7d16b2bb7c3794154b828fb4384b4 ] + +Some usb drivers try to set small skb->truesize and break +core networking stacks. + +I replace one skb_clone() by an allocation of a fresh +and small skb, to get minimally sized skbs, like we did +in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize +in rx path") and 4ce62d5b2f7a ("net: usb: ax88179_178a: +stop lying about skb->truesize") + +Fixes: 361459cd9642 ("net: usb: aqc111: Implement RX data path") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240506135546.3641185-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/aqc111.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c +index 7b8afa589a53c..284375f662f1e 100644 +--- a/drivers/net/usb/aqc111.c ++++ b/drivers/net/usb/aqc111.c +@@ -1141,17 +1141,15 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + continue; + } + +- /* Clone SKB */ +- new_skb = skb_clone(skb, GFP_ATOMIC); ++ new_skb = netdev_alloc_skb_ip_align(dev->net, pkt_len); + + if (!new_skb) + goto err; + +- new_skb->len = pkt_len; ++ skb_put(new_skb, pkt_len); ++ memcpy(new_skb->data, skb->data, pkt_len); + skb_pull(new_skb, AQ_RX_HW_PAD); +- skb_set_tail_pointer(new_skb, new_skb->len); + +- new_skb->truesize = SKB_TRUESIZE(new_skb->len); + if (aqc111_data->rx_checksum) + aqc111_rx_checksum(new_skb, pkt_desc); + +-- +2.43.0 + diff --git a/queue-6.6/virt-acrn-stop-using-follow_pfn.patch b/queue-6.6/virt-acrn-stop-using-follow_pfn.patch new file mode 100644 index 00000000000..c978405193e --- /dev/null +++ b/queue-6.6/virt-acrn-stop-using-follow_pfn.patch @@ -0,0 +1,71 @@ +From 6ca09c6a59328742c68ebea578aba42eaa783a9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 07:45:40 +0800 +Subject: virt: acrn: stop using follow_pfn + +From: Christoph Hellwig + +[ Upstream commit 1b265da7ea1e1ae997fa119c2846bb389eb39c6b ] + +Patch series "remove follow_pfn". + +This series open codes follow_pfn in the only remaining caller, although +the code there remains questionable. It then also moves follow_phys into +the only user and simplifies it a bit. + +This patch (of 3): + +Switch from follow_pfn to follow_pte so that we can get rid of follow_pfn. +Note that this doesn't fix any of the pre-existing raciness and lack of +permission checking in the code. + +Link: https://lkml.kernel.org/r/20240324234542.2038726-1-hch@lst.de +Link: https://lkml.kernel.org/r/20240324234542.2038726-2-hch@lst.de +Signed-off-by: Christoph Hellwig +Reviewed-by: David Hildenbrand +Cc: Andy Lutomirski +Cc: Dave Hansen +Cc: Fei Li +Cc: Peter Zijlstra +Cc: Ingo Molnar +Signed-off-by: Andrew Morton +Stable-dep-of: 3d6586008f7b ("drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()") +Signed-off-by: Sasha Levin +--- + drivers/virt/acrn/mm.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/virt/acrn/mm.c b/drivers/virt/acrn/mm.c +index b4ad8d452e9a1..ffc1d1136f765 100644 +--- a/drivers/virt/acrn/mm.c ++++ b/drivers/virt/acrn/mm.c +@@ -171,18 +171,24 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + mmap_read_lock(current->mm); + vma = vma_lookup(current->mm, memmap->vma_base); + if (vma && ((vma->vm_flags & VM_PFNMAP) != 0)) { ++ spinlock_t *ptl; ++ pte_t *ptep; ++ + if ((memmap->vma_base + memmap->len) > vma->vm_end) { + mmap_read_unlock(current->mm); + return -EINVAL; + } + +- ret = follow_pfn(vma, memmap->vma_base, &pfn); +- mmap_read_unlock(current->mm); ++ ret = follow_pte(vma->vm_mm, memmap->vma_base, &ptep, &ptl); + if (ret < 0) { ++ mmap_read_unlock(current->mm); + dev_dbg(acrn_dev.this_device, + "Failed to lookup PFN at VMA:%pK.\n", (void *)memmap->vma_base); + return ret; + } ++ pfn = pte_pfn(ptep_get(ptep)); ++ pte_unmap_unlock(ptep, ptl); ++ mmap_read_unlock(current->mm); + + return acrn_mm_region_add(vm, memmap->user_vm_pa, + PFN_PHYS(pfn), memmap->len, +-- +2.43.0 + diff --git a/queue-6.6/wifi-ar5523-enable-proper-endpoint-verification.patch b/queue-6.6/wifi-ar5523-enable-proper-endpoint-verification.patch new file mode 100644 index 00000000000..0ce25f58f3b --- /dev/null +++ b/queue-6.6/wifi-ar5523-enable-proper-endpoint-verification.patch @@ -0,0 +1,99 @@ +From d7f29b5350a7af67d168aeb315dcb847b5763210 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 05:14:25 -0700 +Subject: wifi: ar5523: enable proper endpoint verification + +From: Nikita Zhandarovich + +[ Upstream commit e120b6388d7d88635d67dcae6483f39c37111850 ] + +Syzkaller reports [1] hitting a warning about an endpoint in use +not having an expected type to it. + +Fix the issue by checking for the existence of all proper +endpoints with their according types intact. + +Sadly, this patch has not been tested on real hardware. + +[1] Syzkaller report: +------------[ cut here ]------------ +usb 1-1: BOGUS urb xfer, pipe 3 != type 1 +WARNING: CPU: 0 PID: 3643 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 +... +Call Trace: + + ar5523_cmd+0x41b/0x780 drivers/net/wireless/ath/ar5523/ar5523.c:275 + ar5523_cmd_read drivers/net/wireless/ath/ar5523/ar5523.c:302 [inline] + ar5523_host_available drivers/net/wireless/ath/ar5523/ar5523.c:1376 [inline] + ar5523_probe+0x14b0/0x1d10 drivers/net/wireless/ath/ar5523/ar5523.c:1655 + usb_probe_interface+0x30f/0x7f0 drivers/usb/core/driver.c:396 + call_driver_probe drivers/base/dd.c:560 [inline] + really_probe+0x249/0xb90 drivers/base/dd.c:639 + __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 + driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 + __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 + bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 + __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 + bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 + device_add+0xbd9/0x1e90 drivers/base/core.c:3517 + usb_set_configuration+0x101d/0x1900 drivers/usb/core/message.c:2170 + usb_generic_driver_probe+0xbe/0x100 drivers/usb/core/generic.c:238 + usb_probe_device+0xd8/0x2c0 drivers/usb/core/driver.c:293 + call_driver_probe drivers/base/dd.c:560 [inline] + really_probe+0x249/0xb90 drivers/base/dd.c:639 + __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 + driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 + __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 + bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 + __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 + bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 + device_add+0xbd9/0x1e90 drivers/base/core.c:3517 + usb_new_device.cold+0x685/0x10ad drivers/usb/core/hub.c:2573 + hub_port_connect drivers/usb/core/hub.c:5353 [inline] + hub_port_connect_change drivers/usb/core/hub.c:5497 [inline] + port_event drivers/usb/core/hub.c:5653 [inline] + hub_event+0x26cb/0x45d0 drivers/usb/core/hub.c:5735 + process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 + worker_thread+0x669/0x1090 kernel/workqueue.c:2436 + kthread+0x2e8/0x3a0 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 + + +Reported-and-tested-by: syzbot+1bc2c2afd44f820a669f@syzkaller.appspotmail.com +Fixes: b7d572e1871d ("ar5523: Add new driver") +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240408121425.29392-1-n.zhandarovich@fintech.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ar5523/ar5523.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c +index 19f61225a7085..5d82edf8a59d5 100644 +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -1590,6 +1590,20 @@ static int ar5523_probe(struct usb_interface *intf, + struct ar5523 *ar; + int error = -ENOMEM; + ++ static const u8 bulk_ep_addr[] = { ++ AR5523_CMD_TX_PIPE | USB_DIR_OUT, ++ AR5523_DATA_TX_PIPE | USB_DIR_OUT, ++ AR5523_CMD_RX_PIPE | USB_DIR_IN, ++ AR5523_DATA_RX_PIPE | USB_DIR_IN, ++ 0}; ++ ++ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr)) { ++ dev_err(&dev->dev, ++ "Could not find all expected endpoints\n"); ++ error = -ENODEV; ++ goto out; ++ } ++ + /* + * Load firmware if the device requires it. This will return + * -ENXIO on success and we'll get called back afer the usb +-- +2.43.0 + diff --git a/queue-6.6/wifi-ath10k-fix-an-error-code-problem-in-ath10k_dbg_.patch b/queue-6.6/wifi-ath10k-fix-an-error-code-problem-in-ath10k_dbg_.patch new file mode 100644 index 00000000000..d0e39a0d52c --- /dev/null +++ b/queue-6.6/wifi-ath10k-fix-an-error-code-problem-in-ath10k_dbg_.patch @@ -0,0 +1,43 @@ +From 9c2728cc59cf77b4313ffbe62a9eba0f5db38fd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 11:42:44 +0800 +Subject: wifi: ath10k: Fix an error code problem in + ath10k_dbg_sta_write_peer_debug_trigger() + +From: Su Hui + +[ Upstream commit c511a9c12674d246916bb16c479d496b76983193 ] + +Clang Static Checker (scan-build) warns: + +drivers/net/wireless/ath/ath10k/debugfs_sta.c:line 429, column 3 +Value stored to 'ret' is never read. + +Return 'ret' rather than 'count' when 'ret' stores an error code. + +Fixes: ee8b08a1be82 ("ath10k: add debugfs support to get per peer tids log via tracing") +Signed-off-by: Su Hui +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240422034243.938962-1-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/debugfs_sta.c b/drivers/net/wireless/ath/ath10k/debugfs_sta.c +index 87a3365330ff8..5598cf706daab 100644 +--- a/drivers/net/wireless/ath/ath10k/debugfs_sta.c ++++ b/drivers/net/wireless/ath/ath10k/debugfs_sta.c +@@ -438,7 +438,7 @@ ath10k_dbg_sta_write_peer_debug_trigger(struct file *file, + } + out: + mutex_unlock(&ar->conf_mutex); +- return count; ++ return ret ?: count; + } + + static const struct file_operations fops_peer_debug_trigger = { +-- +2.43.0 + diff --git a/queue-6.6/wifi-ath10k-poll-service-ready-message-before-failin.patch b/queue-6.6/wifi-ath10k-poll-service-ready-message-before-failin.patch new file mode 100644 index 00000000000..486d8ba3a56 --- /dev/null +++ b/queue-6.6/wifi-ath10k-poll-service-ready-message-before-failin.patch @@ -0,0 +1,81 @@ +From a36ae507efd9850b5811b10583ce538226546ab3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 07:15:14 +0200 +Subject: wifi: ath10k: poll service ready message before failing + +From: Baochen Qiang + +[ Upstream commit e57b7d62a1b2f496caf0beba81cec3c90fad80d5 ] + +Currently host relies on CE interrupts to get notified that +the service ready message is ready. This results in timeout +issue if the interrupt is not fired, due to some unknown +reasons. See below logs: + +[76321.937866] ath10k_pci 0000:02:00.0: wmi service ready event not received +... +[76322.016738] ath10k_pci 0000:02:00.0: Could not init core: -110 + +And finally it causes WLAN interface bring up failure. + +Change to give it one more chance here by polling CE rings, +before failing directly. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00157-QCARMSWPZ-1 + +Fixes: 5e3dd157d7e7 ("ath10k: mac80211 driver for Qualcomm Atheros 802.11ac CQA98xx devices") +Reported-by: James Prestwood +Tested-By: James Prestwood # on QCA6174 hw3.2 +Link: https://lore.kernel.org/linux-wireless/304ce305-fbe6-420e-ac2a-d61ae5e6ca1a@gmail.com/ +Signed-off-by: Baochen Qiang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240227030409.89702-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 26 +++++++++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 05fa7d4c0e1ab..ee08a4c668f7a 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1762,12 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { +- unsigned long time_left; ++ unsigned long time_left, i; + + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, + WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) +- return -ETIMEDOUT; ++ if (!time_left) { ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings once. ++ */ ++ ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); ++ ++ for (i = 0; i < CE_COUNT; i++) ++ ath10k_hif_send_complete_check(ar, i, 1); ++ ++ time_left = wait_for_completion_timeout(&ar->wmi.service_ready, ++ WMI_SERVICE_READY_TIMEOUT_HZ); ++ if (!time_left) { ++ ath10k_warn(ar, "polling timed out\n"); ++ return -ETIMEDOUT; ++ } ++ ++ ath10k_warn(ar, "service ready completion received, continuing normally\n"); ++ } ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.6/wifi-ath10k-populate-board-data-for-wcn3990.patch b/queue-6.6/wifi-ath10k-populate-board-data-for-wcn3990.patch new file mode 100644 index 00000000000..6fe7e9bd3d5 --- /dev/null +++ b/queue-6.6/wifi-ath10k-populate-board-data-for-wcn3990.patch @@ -0,0 +1,65 @@ +From 7201851d01e2f609fbeabf5ba0e7e3e9093a8305 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 08:47:06 +0200 +Subject: wifi: ath10k: populate board data for WCN3990 + +From: Dmitry Baryshkov + +[ Upstream commit f1f1b5b055c9f27a2f90fd0f0521f5920e9b3c18 ] + +Specify board data size (and board.bin filename) for the WCN3990 +platform. + +Reported-by: Yongqin Liu +Fixes: 03a72288c546 ("ath10k: wmi: add hw params entry for wcn3990") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240130-wcn3990-board-fw-v1-1-738f7c19a8c8@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/core.c | 3 +++ + drivers/net/wireless/ath/ath10k/hw.h | 1 + + drivers/net/wireless/ath/ath10k/targaddrs.h | 3 +++ + 3 files changed, 7 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index 6cdb225b7eacc..81058be3598f1 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -704,6 +704,9 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .max_spatial_stream = 4, + .fw = { + .dir = WCN3990_HW_1_0_FW_DIR, ++ .board = WCN3990_HW_1_0_BOARD_DATA_FILE, ++ .board_size = WCN3990_BOARD_DATA_SZ, ++ .board_ext_size = WCN3990_BOARD_EXT_DATA_SZ, + }, + .sw_decrypt_mcast_mgmt = true, + .rx_desc_ops = &wcn3990_rx_desc_ops, +diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h +index 9643031a4427a..7ecdd0011cfa4 100644 +--- a/drivers/net/wireless/ath/ath10k/hw.h ++++ b/drivers/net/wireless/ath/ath10k/hw.h +@@ -132,6 +132,7 @@ enum qca9377_chip_id_rev { + /* WCN3990 1.0 definitions */ + #define WCN3990_HW_1_0_DEV_VERSION ATH10K_HW_WCN3990 + #define WCN3990_HW_1_0_FW_DIR ATH10K_FW_DIR "/WCN3990/hw1.0" ++#define WCN3990_HW_1_0_BOARD_DATA_FILE "board.bin" + + #define ATH10K_FW_FILE_BASE "firmware" + #define ATH10K_FW_API_MAX 6 +diff --git a/drivers/net/wireless/ath/ath10k/targaddrs.h b/drivers/net/wireless/ath/ath10k/targaddrs.h +index ec556bb88d658..ba37e6c7ced08 100644 +--- a/drivers/net/wireless/ath/ath10k/targaddrs.h ++++ b/drivers/net/wireless/ath/ath10k/targaddrs.h +@@ -491,4 +491,7 @@ struct host_interest { + #define QCA4019_BOARD_DATA_SZ 12064 + #define QCA4019_BOARD_EXT_DATA_SZ 0 + ++#define WCN3990_BOARD_DATA_SZ 26328 ++#define WCN3990_BOARD_EXT_DATA_SZ 0 ++ + #endif /* __TARGADDRS_H__ */ +-- +2.43.0 + diff --git a/queue-6.6/wifi-ath11k-don-t-force-enable-power-save-on-non-run.patch b/queue-6.6/wifi-ath11k-don-t-force-enable-power-save-on-non-run.patch new file mode 100644 index 00000000000..1697810637f --- /dev/null +++ b/queue-6.6/wifi-ath11k-don-t-force-enable-power-save-on-non-run.patch @@ -0,0 +1,94 @@ +From 0caeaea0357322eef3d544864ccb9c5cadb3c5e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Mar 2024 19:31:15 +0800 +Subject: wifi: ath11k: don't force enable power save on non-running vdevs + +From: Baochen Qiang + +[ Upstream commit 01296b39d3515f20a1db64d3c421c592b1e264a0 ] + +Currently we force enable power save on non-running vdevs, this results +in unexpected ping latency in below scenarios: + 1. disable power save from userspace. + 2. trigger suspend/resume. + +With step 1 power save is disabled successfully and we get a good latency: + +PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. +64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=5.13 ms +64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=5.45 ms +64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=5.99 ms +64 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=6.34 ms +64 bytes from 192.168.1.1: icmp_seq=5 ttl=64 time=4.47 ms +64 bytes from 192.168.1.1: icmp_seq=6 ttl=64 time=6.45 ms + +While after step 2, the latency becomes much larger: + +PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. +64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=17.7 ms +64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=15.0 ms +64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=14.3 ms +64 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=16.5 ms +64 bytes from 192.168.1.1: icmp_seq=5 ttl=64 time=20.1 ms + +The reason is, with step 2, power save is force enabled due to vdev not +running, although mac80211 was trying to disable it to honor userspace +configuration: + +ath11k_pci 0000:03:00.0: wmi cmd sta powersave mode psmode 1 vdev id 0 +Call Trace: + ath11k_wmi_pdev_set_ps_mode + ath11k_mac_op_bss_info_changed + ieee80211_bss_info_change_notify + ieee80211_reconfig + ieee80211_resume + wiphy_resume + +This logic is taken from ath10k where it was added due to below comment: + + Firmware doesn't behave nicely and consumes more power than + necessary if PS is disabled on a non-started vdev. + +However we don't know whether such an issue also occurs to ath11k firmware +or not. But even if it does, it's not appropriate because it goes against +userspace, even cfg/mac80211 don't know we have enabled it in fact. + +Remove it to fix this issue. In this way we not only get a better latency, +but also, and the most important, keeps the consistency between userspace +and kernel/driver. The biggest price for that would be the power consumption, +which is not that important, compared with the consistency. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 + +Fixes: b2beffa7d9a6 ("ath11k: enable 802.11 power save mode in station mode") +Signed-off-by: Baochen Qiang +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240309113115.11498-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mac.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index b75cb49c27466..445f59ad1fc08 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -1233,14 +1233,7 @@ static int ath11k_mac_vif_setup_ps(struct ath11k_vif *arvif) + + enable_ps = arvif->ps; + +- if (!arvif->is_started) { +- /* mac80211 can update vif powersave state while disconnected. +- * Firmware doesn't behave nicely and consumes more power than +- * necessary if PS is disabled on a non-started vdev. Hence +- * force-enable PS for non-running vdevs. +- */ +- psmode = WMI_STA_PS_MODE_ENABLED; +- } else if (enable_ps) { ++ if (enable_ps) { + psmode = WMI_STA_PS_MODE_ENABLED; + param = WMI_STA_PS_PARAM_INACTIVITY_TIME; + +-- +2.43.0 + diff --git a/queue-6.6/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch b/queue-6.6/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch new file mode 100644 index 00000000000..b4666c44406 --- /dev/null +++ b/queue-6.6/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch @@ -0,0 +1,72 @@ +From 5fa673a5429f0b206daaf621692a53b7da4babbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 18:30:25 +0300 +Subject: wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() + +From: Karthikeyan Kathirvel + +[ Upstream commit e1bdff48a1bb4a4ac660c19c55a820968c48b3f2 ] + +Currently, there is no terminator entry for ath12k_qmi_msg_handlers hence +facing below KASAN warning, + + ================================================================== + BUG: KASAN: global-out-of-bounds in qmi_invoke_handler+0xa4/0x148 + Read of size 8 at addr ffffffd00a6428d8 by task kworker/u8:2/1273 + + CPU: 0 PID: 1273 Comm: kworker/u8:2 Not tainted 5.4.213 #0 + Workqueue: qmi_msg_handler qmi_data_ready_work + Call trace: + dump_backtrace+0x0/0x20c + show_stack+0x14/0x1c + dump_stack+0xe0/0x138 + print_address_description.isra.5+0x30/0x330 + __kasan_report+0x16c/0x1bc + kasan_report+0xc/0x14 + __asan_load8+0xa8/0xb0 + qmi_invoke_handler+0xa4/0x148 + qmi_handle_message+0x18c/0x1bc + qmi_data_ready_work+0x4ec/0x528 + process_one_work+0x2c0/0x440 + worker_thread+0x324/0x4b8 + kthread+0x210/0x228 + ret_from_fork+0x10/0x18 + + The address belongs to the variable: + ath12k_mac_mon_status_filter_default+0x4bd8/0xfffffffffffe2300 [ath12k] + [...] + ================================================================== + +Add a dummy terminator entry at the end to assist the qmi_invoke_handler() +in traversing up to the terminator entry without accessing an +out-of-boundary index. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Reviewed-by: Jeff Johnson +Signed-off-by: Karthikeyan Kathirvel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240416080234.2882725-1-quic_kathirve@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/qmi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath12k/qmi.c b/drivers/net/wireless/ath/ath12k/qmi.c +index 87de25b87196d..e68accbc837f4 100644 +--- a/drivers/net/wireless/ath/ath12k/qmi.c ++++ b/drivers/net/wireless/ath/ath12k/qmi.c +@@ -2935,6 +2935,9 @@ static const struct qmi_msg_handler ath12k_qmi_msg_handlers[] = { + .decoded_size = sizeof(struct qmi_wlanfw_fw_ready_ind_msg_v01), + .fn = ath12k_qmi_msg_fw_ready_cb, + }, ++ ++ /* end of list */ ++ {}, + }; + + static int ath12k_qmi_ops_new_server(struct qmi_handle *qmi_hdl, +-- +2.43.0 + diff --git a/queue-6.6/wifi-ath12k-use-correct-flag-field-for-320-mhz-chann.patch b/queue-6.6/wifi-ath12k-use-correct-flag-field-for-320-mhz-chann.patch new file mode 100644 index 00000000000..d828e04cbfc --- /dev/null +++ b/queue-6.6/wifi-ath12k-use-correct-flag-field-for-320-mhz-chann.patch @@ -0,0 +1,44 @@ +From 75f93f3564f6a1a3a9753a83639d84b74f345f95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 13:46:51 -0700 +Subject: wifi: ath12k: use correct flag field for 320 MHz channels + +From: Aloka Dixit + +[ Upstream commit 020e08ae5e68cbc0791e8d842443a86eb6aa99f6 ] + +Due to an error during rebasing the patchset 320 MHz channel support got +broken. ath12k was setting the QoS bit instead of the correct flag. +WMI_PEER_EXT_320MHZ (0x2) is defined as an extended flag, replace +peer_flags by peer_flags_ext while sending peer data. + +This affected both QCN9274 and WCN7850 which use the same flag. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 + +Fixes: 6734cf9b4cc7 ("wifi: ath12k: peer assoc for 320 MHz") +Signed-off-by: Aloka Dixit +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240314204651.11075-1-quic_alokad@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index d308a0e7f1871..cd89032fa25e1 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -1834,7 +1834,7 @@ static void ath12k_wmi_copy_peer_flags(struct wmi_peer_assoc_complete_cmd *cmd, + if (arg->bw_160) + cmd->peer_flags |= cpu_to_le32(WMI_PEER_160MHZ); + if (arg->bw_320) +- cmd->peer_flags |= cpu_to_le32(WMI_PEER_EXT_320MHZ); ++ cmd->peer_flags_ext |= cpu_to_le32(WMI_PEER_EXT_320MHZ); + + /* Typically if STBC is enabled for VHT it should be enabled + * for HT as well +-- +2.43.0 + diff --git a/queue-6.6/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch b/queue-6.6/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch new file mode 100644 index 00000000000..bc145175db8 --- /dev/null +++ b/queue-6.6/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch @@ -0,0 +1,71 @@ +From febd52c2947496497310b8ca84d12d77e0a0a98a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 22:04:37 +0800 +Subject: wifi: brcmfmac: pcie: handle randbuf allocation failure + +From: Duoming Zhou + +[ Upstream commit 316f790ebcf94bdf59f794b7cdea4068dc676d4c ] + +The kzalloc() in brcmf_pcie_download_fw_nvram() will return null +if the physical memory has run out. As a result, if we use +get_random_bytes() to generate random bytes in the randbuf, the +null pointer dereference bug will happen. + +In order to prevent allocation failure, this patch adds a separate +function using buffer on kernel stack to generate random bytes in +the randbuf, which could prevent the kernel stack from overflow. + +Fixes: 91918ce88d9f ("wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device") +Suggested-by: Arnd Bergmann +Signed-off-by: Duoming Zhou +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240306140437.18177-1-duoming@zju.edu.cn +Signed-off-by: Sasha Levin +--- + .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index 80220685f5e45..a43af82691401 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -1675,6 +1675,15 @@ struct brcmf_random_seed_footer { + #define BRCMF_RANDOM_SEED_MAGIC 0xfeedc0de + #define BRCMF_RANDOM_SEED_LENGTH 0x100 + ++static noinline_for_stack void ++brcmf_pcie_provide_random_bytes(struct brcmf_pciedev_info *devinfo, u32 address) ++{ ++ u8 randbuf[BRCMF_RANDOM_SEED_LENGTH]; ++ ++ get_random_bytes(randbuf, BRCMF_RANDOM_SEED_LENGTH); ++ memcpy_toio(devinfo->tcm + address, randbuf, BRCMF_RANDOM_SEED_LENGTH); ++} ++ + static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, + const struct firmware *fw, void *nvram, + u32 nvram_len) +@@ -1717,7 +1726,6 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, + .length = cpu_to_le32(rand_len), + .magic = cpu_to_le32(BRCMF_RANDOM_SEED_MAGIC), + }; +- void *randbuf; + + /* Some Apple chips/firmwares expect a buffer of random + * data to be present before NVRAM +@@ -1729,10 +1737,7 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, + sizeof(footer)); + + address -= rand_len; +- randbuf = kzalloc(rand_len, GFP_KERNEL); +- get_random_bytes(randbuf, rand_len); +- memcpy_toio(devinfo->tcm + address, randbuf, rand_len); +- kfree(randbuf); ++ brcmf_pcie_provide_random_bytes(devinfo, address); + } + } else { + brcmf_dbg(PCIE, "No matching NVRAM file found %s\n", +-- +2.43.0 + diff --git a/queue-6.6/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch b/queue-6.6/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch new file mode 100644 index 00000000000..58a2e90e816 --- /dev/null +++ b/queue-6.6/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch @@ -0,0 +1,97 @@ +From 4fc49cb395f303d92cbc9dea2cb66b6ba57d6192 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 11:33:55 -0700 +Subject: wifi: carl9170: add a proper sanity check for endpoints + +From: Nikita Zhandarovich + +[ Upstream commit b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0 ] + +Syzkaller reports [1] hitting a warning which is caused by presence +of a wrong endpoint type at the URB sumbitting stage. While there +was a check for a specific 4th endpoint, since it can switch types +between bulk and interrupt, other endpoints are trusted implicitly. +Similar warning is triggered in a couple of other syzbot issues [2]. + +Fix the issue by doing a comprehensive check of all endpoints +taking into account difference between high- and full-speed +configuration. + +[1] Syzkaller report: +... +WARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 +... +Call Trace: + + carl9170_usb_send_rx_irq_urb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504 + carl9170_usb_init_device drivers/net/wireless/ath/carl9170/usb.c:939 [inline] + carl9170_usb_firmware_finish drivers/net/wireless/ath/carl9170/usb.c:999 [inline] + carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028 + request_firmware_work_func+0x130/0x240 drivers/base/firmware_loader/main.c:1107 + process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 + worker_thread+0x669/0x1090 kernel/workqueue.c:2436 + kthread+0x2e8/0x3a0 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 + + +[2] Related syzkaller crashes: +Link: https://syzkaller.appspot.com/bug?extid=e394db78ae0b0032cb4d +Link: https://syzkaller.appspot.com/bug?extid=9468df99cb63a4a4c4e1 + +Reported-and-tested-by: syzbot+0ae4804973be759fa420@syzkaller.appspotmail.com +Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend") +Signed-off-by: Nikita Zhandarovich +Acked-By: Christian Lamparter +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240422183355.3785-1-n.zhandarovich@fintech.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/carl9170/usb.c | 32 +++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c +index e4eb666c6eea4..a5265997b5767 100644 +--- a/drivers/net/wireless/ath/carl9170/usb.c ++++ b/drivers/net/wireless/ath/carl9170/usb.c +@@ -1069,6 +1069,38 @@ static int carl9170_usb_probe(struct usb_interface *intf, + ar->usb_ep_cmd_is_bulk = true; + } + ++ /* Verify that all expected endpoints are present */ ++ if (ar->usb_ep_cmd_is_bulk) { ++ u8 bulk_ep_addr[] = { ++ AR9170_USB_EP_RX | USB_DIR_IN, ++ AR9170_USB_EP_TX | USB_DIR_OUT, ++ AR9170_USB_EP_CMD | USB_DIR_OUT, ++ 0}; ++ u8 int_ep_addr[] = { ++ AR9170_USB_EP_IRQ | USB_DIR_IN, ++ 0}; ++ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || ++ !usb_check_int_endpoints(intf, int_ep_addr)) ++ err = -ENODEV; ++ } else { ++ u8 bulk_ep_addr[] = { ++ AR9170_USB_EP_RX | USB_DIR_IN, ++ AR9170_USB_EP_TX | USB_DIR_OUT, ++ 0}; ++ u8 int_ep_addr[] = { ++ AR9170_USB_EP_IRQ | USB_DIR_IN, ++ AR9170_USB_EP_CMD | USB_DIR_OUT, ++ 0}; ++ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || ++ !usb_check_int_endpoints(intf, int_ep_addr)) ++ err = -ENODEV; ++ } ++ ++ if (err) { ++ carl9170_free(ar); ++ return err; ++ } ++ + usb_set_intfdata(intf, ar); + SET_IEEE80211_DEV(ar->hw, &intf->dev); + +-- +2.43.0 + diff --git a/queue-6.6/wifi-carl9170-re-fix-fortified-memset-warning.patch b/queue-6.6/wifi-carl9170-re-fix-fortified-memset-warning.patch new file mode 100644 index 00000000000..ea045836cf2 --- /dev/null +++ b/queue-6.6/wifi-carl9170-re-fix-fortified-memset-warning.patch @@ -0,0 +1,60 @@ +From e71122b6529455ccc30a5f64cddba1de52d01fa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 09:35:58 +0300 +Subject: wifi: carl9170: re-fix fortified-memset warning + +From: Arnd Bergmann + +[ Upstream commit 066afafc10c9476ee36c47c9062527a17e763901 ] + +The carl9170_tx_release() function sometimes triggers a fortified-memset +warning in my randconfig builds: + +In file included from include/linux/string.h:254, + from drivers/net/wireless/ath/carl9170/tx.c:40: +In function 'fortify_memset_chk', + inlined from 'carl9170_tx_release' at drivers/net/wireless/ath/carl9170/tx.c:283:2, + inlined from 'kref_put' at include/linux/kref.h:65:3, + inlined from 'carl9170_tx_put_skb' at drivers/net/wireless/ath/carl9170/tx.c:342:9: +include/linux/fortify-string.h:493:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] + 493 | __write_overflow_field(p_size_field, size); + +Kees previously tried to avoid this by using memset_after(), but it seems +this does not fully address the problem. I noticed that the memset_after() +here is done on a different part of the union (status) than the original +cast was from (rate_driver_data), which may confuse the compiler. + +Unfortunately, the memset_after() trick does not work on driver_rates[] +because that is part of an anonymous struct, and I could not get +struct_group() to do this either. Using two separate memset() calls +on the two members does address the warning though. + +Fixes: fb5f6a0e8063b ("mac80211: Use memset_after() to clear tx status") +Link: https://lore.kernel.org/lkml/20230623152443.2296825-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Reviewed-by: Kees Cook +Acked-by: Christian Lamparter +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240328135509.3755090-2-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/carl9170/tx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c +index 6bb9aa2bfe654..88ef6e023f826 100644 +--- a/drivers/net/wireless/ath/carl9170/tx.c ++++ b/drivers/net/wireless/ath/carl9170/tx.c +@@ -280,7 +280,8 @@ static void carl9170_tx_release(struct kref *ref) + * carl9170_tx_fill_rateinfo() has filled the rate information + * before we get to this point. + */ +- memset_after(&txinfo->status, 0, rates); ++ memset(&txinfo->pad, 0, sizeof(txinfo->pad)); ++ memset(&txinfo->rate_driver_data, 0, sizeof(txinfo->rate_driver_data)); + + if (atomic_read(&ar->tx_total_queued)) + ar->tx_schedule = true; +-- +2.43.0 + diff --git a/queue-6.6/wifi-cfg80211-fix-the-order-of-arguments-for-trace-e.patch b/queue-6.6/wifi-cfg80211-fix-the-order-of-arguments-for-trace-e.patch new file mode 100644 index 00000000000..15c33645e7c --- /dev/null +++ b/queue-6.6/wifi-cfg80211-fix-the-order-of-arguments-for-trace-e.patch @@ -0,0 +1,50 @@ +From 3417ea6b092617405405a5cad43231b60ff8e8b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 18:24:30 +0300 +Subject: wifi: cfg80211: fix the order of arguments for trace events of the + tx_rx_evt class + +From: Igor Artemiev + +[ Upstream commit 9ef369973cd2c97cce3388d2c0c7e3c056656e8a ] + +The declarations of the tx_rx_evt class and the rdev_set_antenna event +use the wrong order of arguments in the TP_ARGS macro. + +Fix the order of arguments in the TP_ARGS macro. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Igor Artemiev +Link: https://msgid.link/20240405152431.270267-1-Igor.A.Artemiev@mcst.ru +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/trace.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/wireless/trace.h b/net/wireless/trace.h +index e89443173c7b4..df92ee4d91d1d 100644 +--- a/net/wireless/trace.h ++++ b/net/wireless/trace.h +@@ -1747,7 +1747,7 @@ TRACE_EVENT(rdev_return_void_tx_rx, + + DECLARE_EVENT_CLASS(tx_rx_evt, + TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx), +- TP_ARGS(wiphy, rx, tx), ++ TP_ARGS(wiphy, tx, rx), + TP_STRUCT__entry( + WIPHY_ENTRY + __field(u32, tx) +@@ -1764,7 +1764,7 @@ DECLARE_EVENT_CLASS(tx_rx_evt, + + DEFINE_EVENT(tx_rx_evt, rdev_set_antenna, + TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx), +- TP_ARGS(wiphy, rx, tx) ++ TP_ARGS(wiphy, tx, rx) + ); + + DECLARE_EVENT_CLASS(wiphy_netdev_id_evt, +-- +2.43.0 + diff --git a/queue-6.6/wifi-ieee80211-fix-ieee80211_mle_basic_sta_prof_size.patch b/queue-6.6/wifi-ieee80211-fix-ieee80211_mle_basic_sta_prof_size.patch new file mode 100644 index 00000000000..ad899227ff5 --- /dev/null +++ b/queue-6.6/wifi-ieee80211-fix-ieee80211_mle_basic_sta_prof_size.patch @@ -0,0 +1,45 @@ +From a16e3968f556d0d3c07444510f81ed2864698119 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 18:53:18 +0200 +Subject: wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok() + +From: Johannes Berg + +[ Upstream commit c121514df0daa800cc500dc2738e0b8a1c54af98 ] + +If there was a possibility of an MLE basic STA profile without +subelements, we might reject it because we account for the one +octet for sta_info_len twice (it's part of itself, and in the +fixed portion). Like in ieee80211_mle_reconf_sta_prof_size_ok, +subtract 1 to adjust that. + +When reading the elements we did take this into account, and +since there are always elements, this never really mattered. + +Fixes: 7b6f08771bf6 ("wifi: ieee80211: Support validating ML station profile length") +Signed-off-by: Johannes Berg +Reviewed-by: Ilan Peer +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240318184907.00bb0b20ed60.I8c41dd6fc14c4b187ab901dea15ade73c79fb98c@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/linux/ieee80211.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h +index 2fa186258e359..aaaa5b90bfe25 100644 +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -5081,7 +5081,7 @@ static inline bool ieee80211_mle_basic_sta_prof_size_ok(const u8 *data, + info_len += 1; + + return prof->sta_info_len >= info_len && +- fixed + prof->sta_info_len <= len; ++ fixed + prof->sta_info_len - 1 <= len; + } + + /** +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-allocate-sta-links-only-for-active-.patch b/queue-6.6/wifi-iwlwifi-mvm-allocate-sta-links-only-for-active-.patch new file mode 100644 index 00000000000..3759e2cc201 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-allocate-sta-links-only-for-active-.patch @@ -0,0 +1,50 @@ +From 8ae2ab1daa250b9c9e12a8b500930139d709cdca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 10:10:27 +0200 +Subject: wifi: iwlwifi: mvm: allocate STA links only for active links + +From: Johannes Berg + +[ Upstream commit 62bdd97598f8be82a24f556f78336b05d1c3e84b ] + +For the mvm driver, data structures match what's in the firmware, +we allocate FW IDs for them already etc. During link switch we +already allocate/free the STA links appropriately, but initially +we'd allocate them always. Fix this to allocate memory, a STA ID, +etc. only for active links. + +Fixes: 57974a55d995 ("wifi: iwlwifi: mvm: refactor iwl_mvm_mac_sta_state_common()") +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240319100755.f2093ff73465.Ie891e1cc9c9df09ae22be6aad5c143e376f40f0e@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +index 278454c116fee..3907707e87716 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +@@ -582,14 +582,14 @@ static int iwl_mvm_mld_alloc_sta_links(struct iwl_mvm *mvm, + struct ieee80211_sta *sta) + { + struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta); ++ struct ieee80211_link_sta *link_sta; + unsigned int link_id; + int ret; + + lockdep_assert_held(&mvm->mutex); + +- for (link_id = 0; link_id < ARRAY_SIZE(sta->link); link_id++) { +- if (!rcu_access_pointer(sta->link[link_id]) || +- mvm_sta->link[link_id]) ++ for_each_sta_active_link(vif, sta, link_sta, link_id) { ++ if (WARN_ON(mvm_sta->link[link_id])) + continue; + + ret = iwl_mvm_mld_alloc_sta_link(mvm, vif, sta, link_id); +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-fix-check-in-iwl_mvm_sta_fw_id_mask.patch b/queue-6.6/wifi-iwlwifi-mvm-fix-check-in-iwl_mvm_sta_fw_id_mask.patch new file mode 100644 index 00000000000..04b0bb65937 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-fix-check-in-iwl_mvm_sta_fw_id_mask.patch @@ -0,0 +1,41 @@ +From fab45e8e057f95dd4d7b23c8ec53fdeea17c53f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 18:08:51 +0100 +Subject: wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask + +From: Johannes Berg + +[ Upstream commit d69aef8084cc72df7b0f2583096d9b037c647ec8 ] + +In the previous commit, I renamed the variable to differentiate +mac80211/mvm link STA, but forgot to adjust the check. The one +from mac80211 is already non-NULL anyway, but the mvm one can +be NULL when the mac80211 isn't during link switch conditions. +Fix the check. + +Fixes: 2783ab506eaa ("wifi: iwlwifi: mvm: select STA mask only for active links") +Reviewed-by: Daniel Gabay +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240325180850.e95b442bafe9.I8c0119fce7b00cb4f65782930d2c167ed5dd0a6e@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +index 8f5b8b26909da..121da93e99c6a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +@@ -36,7 +36,7 @@ u32 iwl_mvm_sta_fw_id_mask(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + mvm_link_sta = + rcu_dereference_check(mvmsta->link[link_id], + lockdep_is_held(&mvm->mutex)); +- if (!link_sta) ++ if (!mvm_link_sta) + continue; + + result |= BIT(mvm_link_sta->sta_id); +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-init-vif-works-only-once.patch b/queue-6.6/wifi-iwlwifi-mvm-init-vif-works-only-once.patch new file mode 100644 index 00000000000..d30a7bcfd30 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-init-vif-works-only-once.patch @@ -0,0 +1,116 @@ +From 915033c813b23d717bd27dde43a566309bb4470f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 13:54:05 +0300 +Subject: wifi: iwlwifi: mvm: init vif works only once + +From: Johannes Berg + +[ Upstream commit 0bcc2155983e03c41b21a356af87ae839a6b3ead ] + +It's dangerous to re-initialize works repeatedly, especially +delayed ones that have an associated timer, and even more so +if they're not necessarily canceled inbetween. This can be +the case for these workers here during FW restart scenarios, +so make sure to initialize it only once. + +While at it, also ensure it is cancelled correctly. + +Fixes: f67806140220 ("iwlwifi: mvm: disconnect in case of bad channel switch parameters") +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240416134215.ddf8eece5eac.I4164f5c9c444b64a9abbaab14c23858713778e35@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 19 +++++++++++++++++-- + .../wireless/intel/iwlwifi/mvm/mld-mac80211.c | 2 ++ + drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 ++ + 3 files changed, 21 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index ee9d14250a261..375f401b14535 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -1513,6 +1513,17 @@ static int iwl_mvm_alloc_bcast_mcast_sta(struct iwl_mvm *mvm, + IWL_STA_MULTICAST); + } + ++void iwl_mvm_mac_init_mvmvif(struct iwl_mvm *mvm, struct iwl_mvm_vif *mvmvif) ++{ ++ lockdep_assert_held(&mvm->mutex); ++ ++ if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) ++ return; ++ ++ INIT_DELAYED_WORK(&mvmvif->csa_work, ++ iwl_mvm_channel_switch_disconnect_wk); ++} ++ + static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw, + struct ieee80211_vif *vif) + { +@@ -1522,6 +1533,8 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw, + + mutex_lock(&mvm->mutex); + ++ iwl_mvm_mac_init_mvmvif(mvm, mvmvif); ++ + mvmvif->mvm = mvm; + + /* the first link always points to the default one */ +@@ -1595,8 +1608,6 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw, + mvm->p2p_device_vif = vif; + + iwl_mvm_tcm_add_vif(mvm, vif); +- INIT_DELAYED_WORK(&mvmvif->csa_work, +- iwl_mvm_channel_switch_disconnect_wk); + + if (vif->type == NL80211_IFTYPE_MONITOR) { + mvm->monitor_on = true; +@@ -1638,6 +1649,8 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw, + void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm, + struct ieee80211_vif *vif) + { ++ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); ++ + if (vif->type == NL80211_IFTYPE_P2P_DEVICE) { + /* + * Flush the ROC worker which will flush the OFFCHANNEL queue. +@@ -1646,6 +1659,8 @@ void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm, + */ + flush_work(&mvm->roc_done_wk); + } ++ ++ cancel_delayed_work_sync(&mvmvif->csa_work); + } + + /* This function is doing the common part of removing the interface for +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c +index e22db69d99909..aef8824469e1e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c +@@ -13,6 +13,8 @@ static int iwl_mvm_mld_mac_add_interface(struct ieee80211_hw *hw, + + mutex_lock(&mvm->mutex); + ++ iwl_mvm_mac_init_mvmvif(mvm, mvmvif); ++ + mvmvif->mvm = mvm; + + /* Not much to do here. The stack will not allow interface +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +index 218f3bc31104b..c780e5ffcd596 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +@@ -1737,6 +1737,8 @@ int iwl_mvm_load_d3_fw(struct iwl_mvm *mvm); + + int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm); + ++void iwl_mvm_mac_init_mvmvif(struct iwl_mvm *mvm, struct iwl_mvm_vif *mvmvif); ++ + /* + * FW notifications / CMD responses handlers + * Convention: iwl_mvm_rx_ +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-select-sta-mask-only-for-active-lin.patch b/queue-6.6/wifi-iwlwifi-mvm-select-sta-mask-only-for-active-lin.patch new file mode 100644 index 00000000000..25e36dea968 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-select-sta-mask-only-for-active-lin.patch @@ -0,0 +1,72 @@ +From 28ee5a2791bd054118d6ef3b08f63c3ce8e5da0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 23:26:36 +0200 +Subject: wifi: iwlwifi: mvm: select STA mask only for active links + +From: Johannes Berg + +[ Upstream commit 2783ab506eaa36dbef40bda0f96eb49fe149790e ] + +During reconfig, we might send keys, but those should be only +sent to already active link stations. Iterate only active ones +to fix that issue. + +Fixes: aea99650f731 ("wifi: iwlwifi: mvm: set STA mask for keys in MLO") +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240320232419.c6818d1c6033.I6357f05c55ef111002ddc169287eb356ca0c1b21@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +index 3907707e87716..8f5b8b26909da 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +@@ -9,7 +9,9 @@ + u32 iwl_mvm_sta_fw_id_mask(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + int filter_link_id) + { ++ struct ieee80211_link_sta *link_sta; + struct iwl_mvm_sta *mvmsta; ++ struct ieee80211_vif *vif; + unsigned int link_id; + u32 result = 0; + +@@ -17,26 +19,27 @@ u32 iwl_mvm_sta_fw_id_mask(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + return 0; + + mvmsta = iwl_mvm_sta_from_mac80211(sta); ++ vif = mvmsta->vif; + + /* it's easy when the STA is not an MLD */ + if (!sta->valid_links) + return BIT(mvmsta->deflink.sta_id); + + /* but if it is an MLD, get the mask of all the FW STAs it has ... */ +- for (link_id = 0; link_id < ARRAY_SIZE(mvmsta->link); link_id++) { +- struct iwl_mvm_link_sta *link_sta; ++ for_each_sta_active_link(vif, sta, link_sta, link_id) { ++ struct iwl_mvm_link_sta *mvm_link_sta; + + /* unless we have a specific link in mind */ + if (filter_link_id >= 0 && link_id != filter_link_id) + continue; + +- link_sta = ++ mvm_link_sta = + rcu_dereference_check(mvmsta->link[link_id], + lockdep_is_held(&mvm->mutex)); + if (!link_sta) + continue; + +- result |= BIT(link_sta->sta_id); ++ result |= BIT(mvm_link_sta->sta_id); + } + + return result; +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-reconfigure-tlc-during-hw-restart.patch b/queue-6.6/wifi-iwlwifi-reconfigure-tlc-during-hw-restart.patch new file mode 100644 index 00000000000..ad15c5eb6fa --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-reconfigure-tlc-during-hw-restart.patch @@ -0,0 +1,45 @@ +From 637a74c46ec0a99ed88c19ca22bd66db995edb35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 23:26:38 +0200 +Subject: wifi: iwlwifi: reconfigure TLC during HW restart + +From: Johannes Berg + +[ Upstream commit 96833fb3c7abfd57bb3ee2de2534c5a3f52b0838 ] + +Since the HW restart flow with multi-link is very similar to +the initial association, we do need to reconfigure TLC there. +Remove the check that prevented that. + +Fixes: d2d0468f60cd ("wifi: iwlwifi: mvm: configure TLC on link activation") +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240320232419.a00adcfe381a.Ic798beccbb7b7d852dc976d539205353588853b0@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c +index 2d1fd7ac8577f..e22db69d99909 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c +@@ -296,13 +296,8 @@ __iwl_mvm_mld_assign_vif_chanctx(struct iwl_mvm *mvm, + * this needs the phy context assigned (and in FW?), and we cannot + * do it later because it needs to be initialized as soon as we're + * able to TX on the link, i.e. when active. +- * +- * Firmware restart isn't quite correct yet for MLO, but we don't +- * need to do it in that case anyway since it will happen from the +- * normal station state callback. + */ +- if (mvmvif->ap_sta && +- !test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) { ++ if (mvmvif->ap_sta) { + struct ieee80211_link_sta *link_sta; + + rcu_read_lock(); +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-don-t-use-rate-mask-for-scanning.patch b/queue-6.6/wifi-mac80211-don-t-use-rate-mask-for-scanning.patch new file mode 100644 index 00000000000..7ade685379f --- /dev/null +++ b/queue-6.6/wifi-mac80211-don-t-use-rate-mask-for-scanning.patch @@ -0,0 +1,119 @@ +From f451239ff397036612bcaba7b43d9917280029d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 22:08:54 +0100 +Subject: wifi: mac80211: don't use rate mask for scanning + +From: Johannes Berg + +[ Upstream commit ab9177d83c040eba58387914077ebca56f14fae6 ] + +The rate mask is intended for use during operation, and +can be set to only have masks for the currently active +band. As such, it cannot be used for scanning which can +be on other bands as well. + +Simply ignore the rate masks during scanning to avoid +warnings from incorrect settings. + +Reported-by: syzbot+fdc5123366fb9c3fdc6d@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=fdc5123366fb9c3fdc6d +Co-developed-by: Dmitry Antipov +Signed-off-by: Dmitry Antipov +Tested-by: Dmitry Antipov +Link: https://msgid.link/20240326220854.9594cbb418ca.I7f86c0ba1f98cf7e27c2bacf6c2d417200ecea5c@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/net/mac80211.h | 3 +++ + net/mac80211/rate.c | 6 +++++- + net/mac80211/scan.c | 1 + + net/mac80211/tx.c | 13 +++++++++---- + 4 files changed, 18 insertions(+), 5 deletions(-) + +diff --git a/include/net/mac80211.h b/include/net/mac80211.h +index 7c707358d15c8..a39bd4169f292 100644 +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -936,6 +936,8 @@ enum mac80211_tx_info_flags { + * of their QoS TID or other priority field values. + * @IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX: first MLO TX, used mostly internally + * for sequence number assignment ++ * @IEEE80211_TX_CTRL_SCAN_TX: Indicates that this frame is transmitted ++ * due to scanning, not in normal operation on the interface. + * @IEEE80211_TX_CTRL_MLO_LINK: If not @IEEE80211_LINK_UNSPECIFIED, this + * frame should be transmitted on the specific link. This really is + * only relevant for frames that do not have data present, and is +@@ -956,6 +958,7 @@ enum mac80211_tx_control_flags { + IEEE80211_TX_CTRL_NO_SEQNO = BIT(7), + IEEE80211_TX_CTRL_DONT_REORDER = BIT(8), + IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX = BIT(9), ++ IEEE80211_TX_CTRL_SCAN_TX = BIT(10), + IEEE80211_TX_CTRL_MLO_LINK = 0xf0000000, + }; + +diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c +index 9d33fd2377c88..a2bc9c5d92b8b 100644 +--- a/net/mac80211/rate.c ++++ b/net/mac80211/rate.c +@@ -877,6 +877,7 @@ void ieee80211_get_tx_rates(struct ieee80211_vif *vif, + struct ieee80211_sub_if_data *sdata; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + struct ieee80211_supported_band *sband; ++ u32 mask = ~0; + + rate_control_fill_sta_table(sta, info, dest, max_rates); + +@@ -889,9 +890,12 @@ void ieee80211_get_tx_rates(struct ieee80211_vif *vif, + if (ieee80211_is_tx_data(skb)) + rate_control_apply_mask(sdata, sta, sband, dest, max_rates); + ++ if (!(info->control.flags & IEEE80211_TX_CTRL_SCAN_TX)) ++ mask = sdata->rc_rateidx_mask[info->band]; ++ + if (dest[0].idx < 0) + __rate_control_send_low(&sdata->local->hw, sband, sta, info, +- sdata->rc_rateidx_mask[info->band]); ++ mask); + + if (sta) + rate_fixup_ratelist(vif, sband, info, dest, max_rates); +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index a52813f2b08cb..b68214f159838 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -636,6 +636,7 @@ static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata, + cpu_to_le16(IEEE80211_SN_TO_SEQ(sn)); + } + IEEE80211_SKB_CB(skb)->flags |= tx_flags; ++ IEEE80211_SKB_CB(skb)->control.flags |= IEEE80211_TX_CTRL_SCAN_TX; + ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band); + } + } +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 5c6c5254d987f..46b02a6ae0a36 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -705,11 +705,16 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx) + txrc.bss_conf = &tx->sdata->vif.bss_conf; + txrc.skb = tx->skb; + txrc.reported_rate.idx = -1; +- txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band]; + +- if (tx->sdata->rc_has_mcs_mask[info->band]) +- txrc.rate_idx_mcs_mask = +- tx->sdata->rc_rateidx_mcs_mask[info->band]; ++ if (unlikely(info->control.flags & IEEE80211_TX_CTRL_SCAN_TX)) { ++ txrc.rate_idx_mask = ~0; ++ } else { ++ txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band]; ++ ++ if (tx->sdata->rc_has_mcs_mask[info->band]) ++ txrc.rate_idx_mcs_mask = ++ tx->sdata->rc_rateidx_mcs_mask[info->band]; ++ } + + txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP || + tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT || +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-ensure-beacon-is-non-s1g-prior-to-extr.patch b/queue-6.6/wifi-mac80211-ensure-beacon-is-non-s1g-prior-to-extr.patch new file mode 100644 index 00000000000..a27d7409808 --- /dev/null +++ b/queue-6.6/wifi-mac80211-ensure-beacon-is-non-s1g-prior-to-extr.patch @@ -0,0 +1,42 @@ +From a98b594fc5c69615b6f22111231a4bb387de83dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 11:57:25 +1100 +Subject: wifi: mac80211: ensure beacon is non-S1G prior to extracting the + beacon timestamp field + +From: Richard Kinder + +[ Upstream commit d12b9779cc9ba29d65fbfc728eb8a037871dd331 ] + +Logic inside ieee80211_rx_mgmt_beacon accesses the +mgmt->u.beacon.timestamp field without first checking whether the beacon +received is non-S1G format. + +Fix the problem by checking the beacon is non-S1G format to avoid access +of the mgmt->u.beacon.timestamp field. + +Signed-off-by: Richard Kinder +Link: https://msgid.link/20240328005725.85355-1-richard.kinder@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index cf01f1f298a3b..42e2c84ed2484 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -5979,7 +5979,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link, + link->u.mgd.dtim_period = elems->dtim_period; + link->u.mgd.have_beacon = true; + ifmgd->assoc_data->need_beacon = false; +- if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) { ++ if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) && ++ !ieee80211_is_s1g_beacon(hdr->frame_control)) { + link->conf->sync_tsf = + le64_to_cpu(mgmt->u.beacon.timestamp); + link->conf->sync_device_ts = +-- +2.43.0 + diff --git a/queue-6.6/wifi-mt76-mt7603-add-wpdma-tx-eof-flag-for-pse-clien.patch b/queue-6.6/wifi-mt76-mt7603-add-wpdma-tx-eof-flag-for-pse-clien.patch new file mode 100644 index 00000000000..e6c9eddb8c8 --- /dev/null +++ b/queue-6.6/wifi-mt76-mt7603-add-wpdma-tx-eof-flag-for-pse-clien.patch @@ -0,0 +1,33 @@ +From 06cc347cb78b0366a30ab3333a0d0123e99f4511 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 11:11:54 +0200 +Subject: wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset + +From: Felix Fietkau + +[ Upstream commit 21de5f72260b4246e2415bc900c18139bc52ea80 ] + +This flag is needed for the PSE client reset. Fixes watchdog reset issues. + +Fixes: c677dda16523 ("wifi: mt76: mt7603: improve watchdog reset reliablity") +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/mac.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c +index cf21d06257e53..dc8a77f0a1cc4 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c +@@ -1393,6 +1393,7 @@ void mt7603_pse_client_reset(struct mt7603_dev *dev) + MT_CLIENT_RESET_TX_R_E_2_S); + + /* Start PSE client TX abort */ ++ mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_FORCE_TX_EOF); + mt76_set(dev, addr, MT_CLIENT_RESET_TX_R_E_1); + mt76_poll_msec(dev, addr, MT_CLIENT_RESET_TX_R_E_1_S, + MT_CLIENT_RESET_TX_R_E_1_S, 500); +-- +2.43.0 + diff --git a/queue-6.6/wifi-mt76-mt7603-fix-tx-queue-of-loopback-packets.patch b/queue-6.6/wifi-mt76-mt7603-fix-tx-queue-of-loopback-packets.patch new file mode 100644 index 00000000000..86951ad9bd3 --- /dev/null +++ b/queue-6.6/wifi-mt76-mt7603-fix-tx-queue-of-loopback-packets.patch @@ -0,0 +1,109 @@ +From a0845cf39793f3d54113083e07ab57b98292ebf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 20:14:34 +0200 +Subject: wifi: mt76: mt7603: fix tx queue of loopback packets + +From: Felix Fietkau + +[ Upstream commit b473c0e47f04d3b4ee9d05d2e79234134aad14d5 ] + +Use the correct WMM AC queue instead of the MGMT one to fix potential issues +with aggregation sequence number tracking. Drop non-bufferable packets. + +Fixes: fca9615f1a43 ("mt76: mt7603: fix up hardware queue index for PS filtered packets") +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7603/dma.c | 46 +++++++++++++------ + 1 file changed, 32 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/dma.c b/drivers/net/wireless/mediatek/mt76/mt7603/dma.c +index 03ba11a61c90c..b3a61b0ddd03d 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/dma.c +@@ -4,6 +4,13 @@ + #include "mac.h" + #include "../dma.h" + ++static const u8 wmm_queue_map[] = { ++ [IEEE80211_AC_BK] = 0, ++ [IEEE80211_AC_BE] = 1, ++ [IEEE80211_AC_VI] = 2, ++ [IEEE80211_AC_VO] = 3, ++}; ++ + static void + mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb) + { +@@ -22,10 +29,10 @@ mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb) + struct ieee80211_sta *sta; + struct mt7603_sta *msta; + struct mt76_wcid *wcid; ++ u8 tid = 0, hwq = 0; + void *priv; + int idx; + u32 val; +- u8 tid = 0; + + if (skb->len < MT_TXD_SIZE + sizeof(struct ieee80211_hdr)) + goto free; +@@ -42,19 +49,36 @@ mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb) + goto free; + + priv = msta = container_of(wcid, struct mt7603_sta, wcid); +- val = le32_to_cpu(txd[0]); +- val &= ~(MT_TXD0_P_IDX | MT_TXD0_Q_IDX); +- val |= FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_HW_QUEUE_MGMT); +- txd[0] = cpu_to_le32(val); + + sta = container_of(priv, struct ieee80211_sta, drv_priv); + hdr = (struct ieee80211_hdr *)&skb->data[MT_TXD_SIZE]; +- if (ieee80211_is_data_qos(hdr->frame_control)) ++ ++ hwq = wmm_queue_map[IEEE80211_AC_BE]; ++ if (ieee80211_is_data_qos(hdr->frame_control)) { + tid = *ieee80211_get_qos_ctl(hdr) & +- IEEE80211_QOS_CTL_TAG1D_MASK; +- skb_set_queue_mapping(skb, tid_to_ac[tid]); ++ IEEE80211_QOS_CTL_TAG1D_MASK; ++ u8 qid = tid_to_ac[tid]; ++ hwq = wmm_queue_map[qid]; ++ skb_set_queue_mapping(skb, qid); ++ } else if (ieee80211_is_data(hdr->frame_control)) { ++ skb_set_queue_mapping(skb, IEEE80211_AC_BE); ++ hwq = wmm_queue_map[IEEE80211_AC_BE]; ++ } else { ++ skb_pull(skb, MT_TXD_SIZE); ++ if (!ieee80211_is_bufferable_mmpdu(skb)) ++ goto free; ++ skb_push(skb, MT_TXD_SIZE); ++ skb_set_queue_mapping(skb, MT_TXQ_PSD); ++ hwq = MT_TX_HW_QUEUE_MGMT; ++ } ++ + ieee80211_sta_set_buffered(sta, tid, true); + ++ val = le32_to_cpu(txd[0]); ++ val &= ~(MT_TXD0_P_IDX | MT_TXD0_Q_IDX); ++ val |= FIELD_PREP(MT_TXD0_Q_IDX, hwq); ++ txd[0] = cpu_to_le32(val); ++ + spin_lock_bh(&dev->ps_lock); + __skb_queue_tail(&msta->psq, skb); + if (skb_queue_len(&msta->psq) >= 64) { +@@ -151,12 +175,6 @@ static int mt7603_poll_tx(struct napi_struct *napi, int budget) + + int mt7603_dma_init(struct mt7603_dev *dev) + { +- static const u8 wmm_queue_map[] = { +- [IEEE80211_AC_BK] = 0, +- [IEEE80211_AC_BE] = 1, +- [IEEE80211_AC_VI] = 2, +- [IEEE80211_AC_VO] = 3, +- }; + int ret; + int i; + +-- +2.43.0 + diff --git a/queue-6.6/wifi-mt76-mt7915-workaround-too-long-expansion-spars.patch b/queue-6.6/wifi-mt76-mt7915-workaround-too-long-expansion-spars.patch new file mode 100644 index 00000000000..2e311887262 --- /dev/null +++ b/queue-6.6/wifi-mt76-mt7915-workaround-too-long-expansion-spars.patch @@ -0,0 +1,62 @@ +From 52650f3726e4d36bf56c5159f882a670f7870ae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 16:12:47 +0100 +Subject: wifi: mt76: mt7915: workaround too long expansion sparse warnings + +From: Lorenzo Bianconi + +[ Upstream commit 2d5cde1143eca31c72547dfd589702c6b4a7e684 ] + +Fix the following sparse warnings: + +drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c:1133:29: error: too long token expansion +drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c:1133:29: error: too long token expansion +drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c:1133:29: error: too long token expansion +drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c:1133:29: error: too long token expansion + +No functional changes, compile tested only. + +Fixes: e3296759f347 ("wifi: mt76: mt7915: enable per bandwidth power limit support") +Signed-off-by: Lorenzo Bianconi +Acked-by: Felix Fietkau +Signed-off-by: Kalle Valo +Link: https://msgid.link/5457b92e41909dd75ab3db7a0e9ec372b917a386.1710858172.git.lorenzo@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +index 6c3696c8c7002..450f4d221184b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +@@ -1049,6 +1049,7 @@ static ssize_t + mt7915_rate_txpower_set(struct file *file, const char __user *user_buf, + size_t count, loff_t *ppos) + { ++ int i, ret, pwr, pwr160 = 0, pwr80 = 0, pwr40 = 0, pwr20 = 0; + struct mt7915_phy *phy = file->private_data; + struct mt7915_dev *dev = phy->dev; + struct mt76_phy *mphy = phy->mt76; +@@ -1057,7 +1058,6 @@ mt7915_rate_txpower_set(struct file *file, const char __user *user_buf, + .band_idx = phy->mt76->band_idx, + }; + char buf[100]; +- int i, ret, pwr160 = 0, pwr80 = 0, pwr40 = 0, pwr20 = 0; + enum mac80211_rx_encoding mode; + u32 offs = 0, len = 0; + +@@ -1130,8 +1130,8 @@ mt7915_rate_txpower_set(struct file *file, const char __user *user_buf, + if (ret) + goto out; + +- mphy->txpower_cur = max(mphy->txpower_cur, +- max(pwr160, max(pwr80, max(pwr40, pwr20)))); ++ pwr = max3(pwr80, pwr40, pwr20); ++ mphy->txpower_cur = max3(mphy->txpower_cur, pwr160, pwr); + out: + mutex_unlock(&dev->mt76.mutex); + +-- +2.43.0 + diff --git a/queue-6.6/wifi-mwl8k-initialize-cmd-addr-properly.patch b/queue-6.6/wifi-mwl8k-initialize-cmd-addr-properly.patch new file mode 100644 index 00000000000..18370593f2f --- /dev/null +++ b/queue-6.6/wifi-mwl8k-initialize-cmd-addr-properly.patch @@ -0,0 +1,38 @@ +From 52eaf06102c239d51d27e3b83822161f9417b35b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 14:38:15 +0300 +Subject: wifi: mwl8k: initialize cmd->addr[] properly + +From: Dan Carpenter + +[ Upstream commit 1d60eabb82694e58543e2b6366dae3e7465892a5 ] + +This loop is supposed to copy the mac address to cmd->addr but the +i++ increment is missing so it copies everything to cmd->addr[0] and +only the last address is recorded. + +Fixes: 22bedad3ce11 ("net: convert multicast list to list_head") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://msgid.link/b788be9a-15f5-4cca-a3fe-79df4c8ce7b2@moroto.mountain +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwl8k.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c +index 13bcb123d1223..c0ecd769ada76 100644 +--- a/drivers/net/wireless/marvell/mwl8k.c ++++ b/drivers/net/wireless/marvell/mwl8k.c +@@ -2718,7 +2718,7 @@ __mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw, int allmulti, + cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_MULTICAST); + cmd->numaddr = cpu_to_le16(mc_count); + netdev_hw_addr_list_for_each(ha, mc_list) { +- memcpy(cmd->addr[i], ha->addr, ETH_ALEN); ++ memcpy(cmd->addr[i++], ha->addr, ETH_ALEN); + } + } + +-- +2.43.0 + diff --git a/queue-6.6/wifi-nl80211-avoid-address-calculations-via-out-of-b.patch b/queue-6.6/wifi-nl80211-avoid-address-calculations-via-out-of-b.patch new file mode 100644 index 00000000000..2ca7f3e401d --- /dev/null +++ b/queue-6.6/wifi-nl80211-avoid-address-calculations-via-out-of-b.patch @@ -0,0 +1,70 @@ +From c573f5e85e67cd086e0c1687fba3bcce87d12fb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 15:01:01 -0700 +Subject: wifi: nl80211: Avoid address calculations via out of bounds array + indexing + +From: Kees Cook + +[ Upstream commit 838c7b8f1f278404d9d684c34a8cb26dc41aaaa1 ] + +Before request->channels[] can be used, request->n_channels must be set. +Additionally, address calculations for memory after the "channels" array +need to be calculated from the allocation base ("request") rather than +via the first "out of bounds" index of "channels", otherwise run-time +bounds checking will throw a warning. + +Reported-by: Nathan Chancellor +Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") +Signed-off-by: Kees Cook +Tested-by: Nathan Chancellor +Link: https://msgid.link/20240424220057.work.819-kees@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index c4f08f7eb741d..8f8f077e6cd40 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -9153,6 +9153,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) + struct wiphy *wiphy; + int err, tmp, n_ssids = 0, n_channels, i; + size_t ie_len, size; ++ size_t ssids_offset, ie_offset; + + wiphy = &rdev->wiphy; + +@@ -9198,21 +9199,20 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) + return -EINVAL; + + size = struct_size(request, channels, n_channels); ++ ssids_offset = size; + size = size_add(size, array_size(sizeof(*request->ssids), n_ssids)); ++ ie_offset = size; + size = size_add(size, ie_len); + request = kzalloc(size, GFP_KERNEL); + if (!request) + return -ENOMEM; ++ request->n_channels = n_channels; + + if (n_ssids) +- request->ssids = (void *)&request->channels[n_channels]; ++ request->ssids = (void *)request + ssids_offset; + request->n_ssids = n_ssids; +- if (ie_len) { +- if (n_ssids) +- request->ie = (void *)(request->ssids + n_ssids); +- else +- request->ie = (void *)(request->channels + n_channels); +- } ++ if (ie_len) ++ request->ie = (void *)request + ie_offset; + + i = 0; + if (scan_freqs) { +-- +2.43.0 + diff --git a/queue-6.6/x86-boot-64-clear-most-of-cr4-in-startup_64-except-p.patch b/queue-6.6/x86-boot-64-clear-most-of-cr4-in-startup_64-except-p.patch new file mode 100644 index 00000000000..a2138b1f2b1 --- /dev/null +++ b/queue-6.6/x86-boot-64-clear-most-of-cr4-in-startup_64-except-p.patch @@ -0,0 +1,74 @@ +From e6cb69013699bbd19812b81a63bff33ab2f60574 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 17:13:55 +0200 +Subject: x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and + LA57 + +From: Ard Biesheuvel + +[ Upstream commit a0025f587c685e5ff842fb0194036f2ca0b6eaf4 ] + +The early 64-bit boot code must be entered with a 1:1 mapping of the +bootable image, but it cannot operate without a 1:1 mapping of all the +assets in memory that it accesses, and therefore, it creates such +mappings for all known assets upfront, and additional ones on demand +when a page fault happens on a memory address. + +These mappings are created with the global bit G set, as the flags used +to create page table descriptors are based on __PAGE_KERNEL_LARGE_EXEC +defined by the core kernel, even though the context where these mappings +are used is very different. + +This means that the TLB maintenance carried out by the decompressor is +not sufficient if it is entered with CR4.PGE enabled, which has been +observed to happen with the stage0 bootloader of project Oak. While this +is a dubious practice if no global mappings are being used to begin +with, the decompressor is clearly at fault here for creating global +mappings and not performing the appropriate TLB maintenance. + +Since commit: + + f97b67a773cd84b ("x86/decompressor: Only call the trampoline when changing paging levels") + +CR4 is no longer modified by the decompressor if no change in the number +of paging levels is needed. Before that, CR4 would always be set to a +consistent value with PGE cleared. + +So let's reinstate a simplified version of the original logic to put CR4 +into a known state, and preserve the PAE, MCE and LA57 bits, none of +which can be modified freely at this point (PAE and LA57 cannot be +changed while running in long mode, and MCE cannot be cleared when +running under some hypervisors). + +This effectively clears PGE and works around the project Oak bug. + +Fixes: f97b67a773cd84b ("x86/decompressor: Only call the trampoline when ...") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Ingo Molnar +Cc: Linus Torvalds +Cc: "H. Peter Anvin" +Link: https://lore.kernel.org/r/20240410151354.506098-2-ardb+git@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/head_64.S | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index bf4a10a5794f1..1dcb794c5479e 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -398,6 +398,11 @@ SYM_CODE_START(startup_64) + call sev_enable + #endif + ++ /* Preserve only the CR4 bits that must be preserved, and clear the rest */ ++ movq %cr4, %rax ++ andl $(X86_CR4_PAE | X86_CR4_MCE | X86_CR4_LA57), %eax ++ movq %rax, %cr4 ++ + /* + * configure_5level_paging() updates the number of paging levels using + * a trampoline in 32-bit addressable memory if the current number does +-- +2.43.0 + diff --git a/queue-6.6/x86-boot-ignore-relocations-in-.notes-sections-in-wa.patch b/queue-6.6/x86-boot-ignore-relocations-in-.notes-sections-in-wa.patch new file mode 100644 index 00000000000..6cc550d5447 --- /dev/null +++ b/queue-6.6/x86-boot-ignore-relocations-in-.notes-sections-in-wa.patch @@ -0,0 +1,54 @@ +From dd19205c70c1639186bf1a8125b49446c928b865 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Mar 2024 23:05:47 +0800 +Subject: x86/boot: Ignore relocations in .notes sections in walk_relocs() too + +From: Guixiong Wei + +[ Upstream commit 76e9762d66373354b45c33b60e9a53ef2a3c5ff2 ] + +Commit: + + aaa8736370db ("x86, relocs: Ignore relocations in .notes section") + +... only started ignoring the .notes sections in print_absolute_relocs(), +but the same logic should also by applied in walk_relocs() to avoid +such relocations. + +[ mingo: Fixed various typos in the changelog, removed extra curly braces from the code. ] + +Fixes: aaa8736370db ("x86, relocs: Ignore relocations in .notes section") +Fixes: 5ead97c84fa7 ("xen: Core Xen implementation") +Fixes: da1a679cde9b ("Add /sys/kernel/notes") +Signed-off-by: Guixiong Wei +Signed-off-by: Ingo Molnar +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/20240317150547.24910-1-weiguixiong@bytedance.com +Signed-off-by: Sasha Levin +--- + arch/x86/tools/relocs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c +index e7013283640f5..a2cfd19c11eea 100644 +--- a/arch/x86/tools/relocs.c ++++ b/arch/x86/tools/relocs.c +@@ -746,6 +746,15 @@ static void walk_relocs(int (*process)(struct section *sec, Elf_Rel *rel, + if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) { + continue; + } ++ ++ /* ++ * Do not perform relocations in .notes sections; any ++ * values there are meant for pre-boot consumption (e.g. ++ * startup_xen). ++ */ ++ if (sec_applies->shdr.sh_type == SHT_NOTE) ++ continue; ++ + sh_symtab = sec_symtab->symtab; + sym_strtab = sec_symtab->link->strtab; + for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) { +-- +2.43.0 + diff --git a/queue-6.6/x86-insn-add-vex-versions-of-vpdpbusd-vpdpbusds-vpdp.patch b/queue-6.6/x86-insn-add-vex-versions-of-vpdpbusd-vpdpbusds-vpdp.patch new file mode 100644 index 00000000000..d0747f5fb79 --- /dev/null +++ b/queue-6.6/x86-insn-add-vex-versions-of-vpdpbusd-vpdpbusds-vpdp.patch @@ -0,0 +1,75 @@ +From 3a4079e86de7bfda9ff585f285adaeaf96a34f1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 13:58:46 +0300 +Subject: x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and + VPDPWSSDS + +From: Adrian Hunter + +[ Upstream commit b8000264348979b60dbe479255570a40e1b3a097 ] + +The x86 instruction decoder is used not only for decoding kernel +instructions. It is also used by perf uprobes (user space probes) and by +perf tools Intel Processor Trace decoding. Consequently, it needs to +support instructions executed by user space also. + +Intel Architecture Instruction Set Extensions and Future Features manual +number 319433-044 of May 2021, documented VEX versions of instructions +VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS, but the opcode map has them +listed as EVEX only. + +Remove EVEX-only (ev) annotation from instructions VPDPBUSD, VPDPBUSDS, +VPDPWSSD and VPDPWSSDS, which allows them to be decoded with either a VEX +or EVEX prefix. + +Fixes: 0153d98f2dd6 ("x86/insn: Add misc instructions to x86 instruction decoder") +Signed-off-by: Adrian Hunter +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20240502105853.5338-4-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/lib/x86-opcode-map.txt | 8 ++++---- + tools/arch/x86/lib/x86-opcode-map.txt | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt +index 940913550ed83..d1ccd06c53127 100644 +--- a/arch/x86/lib/x86-opcode-map.txt ++++ b/arch/x86/lib/x86-opcode-map.txt +@@ -698,10 +698,10 @@ AVXcode: 2 + 4d: vrcp14ss/d Vsd,Hpd,Wsd (66),(ev) + 4e: vrsqrt14ps/d Vpd,Wpd (66),(ev) + 4f: vrsqrt14ss/d Vsd,Hsd,Wsd (66),(ev) +-50: vpdpbusd Vx,Hx,Wx (66),(ev) +-51: vpdpbusds Vx,Hx,Wx (66),(ev) +-52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66),(ev) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev) +-53: vpdpwssds Vx,Hx,Wx (66),(ev) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev) ++50: vpdpbusd Vx,Hx,Wx (66) ++51: vpdpbusds Vx,Hx,Wx (66) ++52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev) ++53: vpdpwssds Vx,Hx,Wx (66) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev) + 54: vpopcntb/w Vx,Wx (66),(ev) + 55: vpopcntd/q Vx,Wx (66),(ev) + 58: vpbroadcastd Vx,Wx (66),(v) +diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt +index 940913550ed83..d1ccd06c53127 100644 +--- a/tools/arch/x86/lib/x86-opcode-map.txt ++++ b/tools/arch/x86/lib/x86-opcode-map.txt +@@ -698,10 +698,10 @@ AVXcode: 2 + 4d: vrcp14ss/d Vsd,Hpd,Wsd (66),(ev) + 4e: vrsqrt14ps/d Vpd,Wpd (66),(ev) + 4f: vrsqrt14ss/d Vsd,Hsd,Wsd (66),(ev) +-50: vpdpbusd Vx,Hx,Wx (66),(ev) +-51: vpdpbusds Vx,Hx,Wx (66),(ev) +-52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66),(ev) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev) +-53: vpdpwssds Vx,Hx,Wx (66),(ev) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev) ++50: vpdpbusd Vx,Hx,Wx (66) ++51: vpdpbusds Vx,Hx,Wx (66) ++52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev) ++53: vpdpwssds Vx,Hx,Wx (66) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev) + 54: vpopcntb/w Vx,Wx (66),(ev) + 55: vpopcntd/q Vx,Wx (66),(ev) + 58: vpbroadcastd Vx,Wx (66),(v) +-- +2.43.0 + diff --git a/queue-6.6/x86-insn-fix-push-instruction-in-x86-instruction-dec.patch b/queue-6.6/x86-insn-fix-push-instruction-in-x86-instruction-dec.patch new file mode 100644 index 00000000000..0b8bf48b405 --- /dev/null +++ b/queue-6.6/x86-insn-fix-push-instruction-in-x86-instruction-dec.patch @@ -0,0 +1,98 @@ +From b4179400e7052d64c63985531bbd07e9cc75a7b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 13:58:45 +0300 +Subject: x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map + +From: Adrian Hunter + +[ Upstream commit 59162e0c11d7257cde15f907d19fefe26da66692 ] + +The x86 instruction decoder is used not only for decoding kernel +instructions. It is also used by perf uprobes (user space probes) and by +perf tools Intel Processor Trace decoding. Consequently, it needs to +support instructions executed by user space also. + +Opcode 0x68 PUSH instruction is currently defined as 64-bit operand size +only i.e. (d64). That was based on Intel SDM Opcode Map. However that is +contradicted by the Instruction Set Reference section for PUSH in the +same manual. + +Remove 64-bit operand size only annotation from opcode 0x68 PUSH +instruction. + +Example: + + $ cat pushw.s + .global _start + .text + _start: + pushw $0x1234 + mov $0x1,%eax # system call number (sys_exit) + int $0x80 + $ as -o pushw.o pushw.s + $ ld -s -o pushw pushw.o + $ objdump -d pushw | tail -4 + 0000000000401000 <.text>: + 401000: 66 68 34 12 pushw $0x1234 + 401004: b8 01 00 00 00 mov $0x1,%eax + 401009: cd 80 int $0x80 + $ perf record -e intel_pt//u ./pushw + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.014 MB perf.data ] + + Before: + + $ perf script --insn-trace=disasm + Warning: + 1 instruction trace errors + pushw 10349 [000] 10586.869237014: 401000 [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) pushw $0x1234 + pushw 10349 [000] 10586.869237014: 401006 [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) addb %al, (%rax) + pushw 10349 [000] 10586.869237014: 401008 [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) addb %cl, %ch + pushw 10349 [000] 10586.869237014: 40100a [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) addb $0x2e, (%rax) + instruction trace error type 1 time 10586.869237224 cpu 0 pid 10349 tid 10349 ip 0x40100d code 6: Trace doesn't match instruction + + After: + + $ perf script --insn-trace=disasm + pushw 10349 [000] 10586.869237014: 401000 [unknown] (./pushw) pushw $0x1234 + pushw 10349 [000] 10586.869237014: 401004 [unknown] (./pushw) movl $1, %eax + +Fixes: eb13296cfaf6 ("x86: Instruction decoder API") +Signed-off-by: Adrian Hunter +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20240502105853.5338-3-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/lib/x86-opcode-map.txt | 2 +- + tools/arch/x86/lib/x86-opcode-map.txt | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt +index 5168ee0360b24..940913550ed83 100644 +--- a/arch/x86/lib/x86-opcode-map.txt ++++ b/arch/x86/lib/x86-opcode-map.txt +@@ -148,7 +148,7 @@ AVXcode: + 65: SEG=GS (Prefix) + 66: Operand-Size (Prefix) + 67: Address-Size (Prefix) +-68: PUSH Iz (d64) ++68: PUSH Iz + 69: IMUL Gv,Ev,Iz + 6a: PUSH Ib (d64) + 6b: IMUL Gv,Ev,Ib +diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt +index 5168ee0360b24..940913550ed83 100644 +--- a/tools/arch/x86/lib/x86-opcode-map.txt ++++ b/tools/arch/x86/lib/x86-opcode-map.txt +@@ -148,7 +148,7 @@ AVXcode: + 65: SEG=GS (Prefix) + 66: Operand-Size (Prefix) + 67: Address-Size (Prefix) +-68: PUSH Iz (d64) ++68: PUSH Iz + 69: IMUL Gv,Ev,Iz + 6a: PUSH Ib (d64) + 6b: IMUL Gv,Ev,Ib +-- +2.43.0 + diff --git a/queue-6.6/x86-mm-remove-broken-vsyscall-emulation-code-from-th.patch b/queue-6.6/x86-mm-remove-broken-vsyscall-emulation-code-from-th.patch new file mode 100644 index 00000000000..ecb1f33cec4 --- /dev/null +++ b/queue-6.6/x86-mm-remove-broken-vsyscall-emulation-code-from-th.patch @@ -0,0 +1,232 @@ +From 3f78cb612c2f15f3bf867cea291923dbe301a6f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 10:00:51 +0200 +Subject: x86/mm: Remove broken vsyscall emulation code from the page fault + code + +From: Linus Torvalds + +[ Upstream commit 02b670c1f88e78f42a6c5aee155c7b26960ca054 ] + +The syzbot-reported stack trace from hell in this discussion thread +actually has three nested page faults: + + https://lore.kernel.org/r/000000000000d5f4fc0616e816d4@google.com + +... and I think that's actually the important thing here: + + - the first page fault is from user space, and triggers the vsyscall + emulation. + + - the second page fault is from __do_sys_gettimeofday(), and that should + just have caused the exception that then sets the return value to + -EFAULT + + - the third nested page fault is due to _raw_spin_unlock_irqrestore() -> + preempt_schedule() -> trace_sched_switch(), which then causes a BPF + trace program to run, which does that bpf_probe_read_compat(), which + causes that page fault under pagefault_disable(). + +It's quite the nasty backtrace, and there's a lot going on. + +The problem is literally the vsyscall emulation, which sets + + current->thread.sig_on_uaccess_err = 1; + +and that causes the fixup_exception() code to send the signal *despite* the +exception being caught. + +And I think that is in fact completely bogus. It's completely bogus +exactly because it sends that signal even when it *shouldn't* be sent - +like for the BPF user mode trace gathering. + +In other words, I think the whole "sig_on_uaccess_err" thing is entirely +broken, because it makes any nested page-faults do all the wrong things. + +Now, arguably, I don't think anybody should enable vsyscall emulation any +more, but this test case clearly does. + +I think we should just make the "send SIGSEGV" be something that the +vsyscall emulation does on its own, not this broken per-thread state for +something that isn't actually per thread. + +The x86 page fault code actually tried to deal with the "incorrect nesting" +by having that: + + if (in_interrupt()) + return; + +which ignores the sig_on_uaccess_err case when it happens in interrupts, +but as shown by this example, these nested page faults do not need to be +about interrupts at all. + +IOW, I think the only right thing is to remove that horrendously broken +code. + +The attached patch looks like the ObviouslyCorrect(tm) thing to do. + +NOTE! This broken code goes back to this commit in 2011: + + 4fc3490114bb ("x86-64: Set siginfo and context on vsyscall emulation faults") + +... and back then the reason was to get all the siginfo details right. +Honestly, I do not for a moment believe that it's worth getting the siginfo +details right here, but part of the commit says: + + This fixes issues with UML when vsyscall=emulate. + +... and so my patch to remove this garbage will probably break UML in this +situation. + +I do not believe that anybody should be running with vsyscall=emulate in +2024 in the first place, much less if you are doing things like UML. But +let's see if somebody screams. + +Reported-and-tested-by: syzbot+83e7f982ca045ab4405c@syzkaller.appspotmail.com +Signed-off-by: Linus Torvalds +Signed-off-by: Ingo Molnar +Tested-by: Jiri Olsa +Acked-by: Andy Lutomirski +Link: https://lore.kernel.org/r/CAHk-=wh9D6f7HUkDgZHKmDCHUQmp+Co89GP+b8+z+G56BKeyNg@mail.gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/entry/vsyscall/vsyscall_64.c | 28 ++--------------------- + arch/x86/include/asm/processor.h | 1 - + arch/x86/mm/fault.c | 33 +-------------------------- + 3 files changed, 3 insertions(+), 59 deletions(-) + +diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c +index e0ca8120aea87..1245000a8792f 100644 +--- a/arch/x86/entry/vsyscall/vsyscall_64.c ++++ b/arch/x86/entry/vsyscall/vsyscall_64.c +@@ -98,11 +98,6 @@ static int addr_to_vsyscall_nr(unsigned long addr) + + static bool write_ok_or_segv(unsigned long ptr, size_t size) + { +- /* +- * XXX: if access_ok, get_user, and put_user handled +- * sig_on_uaccess_err, this could go away. +- */ +- + if (!access_ok((void __user *)ptr, size)) { + struct thread_struct *thread = ¤t->thread; + +@@ -120,10 +115,8 @@ static bool write_ok_or_segv(unsigned long ptr, size_t size) + bool emulate_vsyscall(unsigned long error_code, + struct pt_regs *regs, unsigned long address) + { +- struct task_struct *tsk; + unsigned long caller; + int vsyscall_nr, syscall_nr, tmp; +- int prev_sig_on_uaccess_err; + long ret; + unsigned long orig_dx; + +@@ -172,8 +165,6 @@ bool emulate_vsyscall(unsigned long error_code, + goto sigsegv; + } + +- tsk = current; +- + /* + * Check for access_ok violations and find the syscall nr. + * +@@ -234,12 +225,8 @@ bool emulate_vsyscall(unsigned long error_code, + goto do_ret; /* skip requested */ + + /* +- * With a real vsyscall, page faults cause SIGSEGV. We want to +- * preserve that behavior to make writing exploits harder. ++ * With a real vsyscall, page faults cause SIGSEGV. + */ +- prev_sig_on_uaccess_err = current->thread.sig_on_uaccess_err; +- current->thread.sig_on_uaccess_err = 1; +- + ret = -EFAULT; + switch (vsyscall_nr) { + case 0: +@@ -262,23 +249,12 @@ bool emulate_vsyscall(unsigned long error_code, + break; + } + +- current->thread.sig_on_uaccess_err = prev_sig_on_uaccess_err; +- + check_fault: + if (ret == -EFAULT) { + /* Bad news -- userspace fed a bad pointer to a vsyscall. */ + warn_bad_vsyscall(KERN_INFO, regs, + "vsyscall fault (exploit attempt?)"); +- +- /* +- * If we failed to generate a signal for any reason, +- * generate one here. (This should be impossible.) +- */ +- if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) && +- !sigismember(&tsk->pending.signal, SIGSEGV))) +- goto sigsegv; +- +- return true; /* Don't emulate the ret. */ ++ goto sigsegv; + } + + regs->ax = ret; +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 191f1d8f05061..6e19d0f226000 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -464,7 +464,6 @@ struct thread_struct { + unsigned long iopl_emul; + + unsigned int iopl_warn:1; +- unsigned int sig_on_uaccess_err:1; + + /* + * Protection Keys Register for Userspace. Loaded immediately on +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index e238517968836..6529b3e2cff3c 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -717,39 +717,8 @@ kernelmode_fixup_or_oops(struct pt_regs *regs, unsigned long error_code, + WARN_ON_ONCE(user_mode(regs)); + + /* Are we prepared to handle this kernel fault? */ +- if (fixup_exception(regs, X86_TRAP_PF, error_code, address)) { +- /* +- * Any interrupt that takes a fault gets the fixup. This makes +- * the below recursive fault logic only apply to a faults from +- * task context. +- */ +- if (in_interrupt()) +- return; +- +- /* +- * Per the above we're !in_interrupt(), aka. task context. +- * +- * In this case we need to make sure we're not recursively +- * faulting through the emulate_vsyscall() logic. +- */ +- if (current->thread.sig_on_uaccess_err && signal) { +- sanitize_error_code(address, &error_code); +- +- set_signal_archinfo(address, error_code); +- +- if (si_code == SEGV_PKUERR) { +- force_sig_pkuerr((void __user *)address, pkey); +- } else { +- /* XXX: hwpoison faults will set the wrong code. */ +- force_sig_fault(signal, si_code, (void __user *)address); +- } +- } +- +- /* +- * Barring that, we can do the fixup and be happy. +- */ ++ if (fixup_exception(regs, X86_TRAP_PF, error_code, address)) + return; +- } + + /* + * AMD erratum #91 manifests as a spurious page fault on a PREFETCH +-- +2.43.0 + diff --git a/queue-6.6/x86-numa-fix-srat-lookup-of-cfmws-ranges-with-numa_f.patch b/queue-6.6/x86-numa-fix-srat-lookup-of-cfmws-ranges-with-numa_f.patch new file mode 100644 index 00000000000..51715d552d8 --- /dev/null +++ b/queue-6.6/x86-numa-fix-srat-lookup-of-cfmws-ranges-with-numa_f.patch @@ -0,0 +1,118 @@ +From 44494e60a7428de20cbcca527a67a1a0d8940210 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 15:10:09 +0200 +Subject: x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks() + +From: Robert Richter + +[ Upstream commit f9f67e5adc8dc2e1cc51ab2d3d6382fa97f074d4 ] + +For configurations that have the kconfig option NUMA_KEEP_MEMINFO +disabled, numa_fill_memblks() only returns with NUMA_NO_MEMBLK (-1). +SRAT lookup fails then because an existing SRAT memory range cannot be +found for a CFMWS address range. This causes the addition of a +duplicate numa_memblk with a different node id and a subsequent page +fault and kernel crash during boot. + +Fix this by making numa_fill_memblks() always available regardless of +NUMA_KEEP_MEMINFO. + +As Dan suggested, the fix is implemented to remove numa_fill_memblks() +from sparsemem.h and alos using __weak for the function. + +Note that the issue was initially introduced with [1]. But since +phys_to_target_node() was originally used that returned the valid node +0, an additional numa_memblk was not added. Though, the node id was +wrong too, a message is seen then in the logs: + + kernel/numa.c: pr_info_once("Unknown target node for memory at 0x%llx, assuming node 0\n", + +[1] commit fd49f99c1809 ("ACPI: NUMA: Add a node and memblk for each + CFMWS not in SRAT") + +Suggested-by: Dan Williams +Link: https://lore.kernel.org/all/66271b0072317_69102944c@dwillia2-xfh.jf.intel.com.notmuch/ +Fixes: 8f1004679987 ("ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window") +Reviewed-by: Jonathan Cameron +Reviewed-by: Alison Schofield +Reviewed-by: Dan Williams +Signed-off-by: Robert Richter +Acked-by: Borislav Petkov (AMD) +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/sparsemem.h | 2 -- + arch/x86/mm/numa.c | 4 ++-- + drivers/acpi/numa/srat.c | 5 +++++ + include/linux/numa.h | 7 +------ + 4 files changed, 8 insertions(+), 10 deletions(-) + +diff --git a/arch/x86/include/asm/sparsemem.h b/arch/x86/include/asm/sparsemem.h +index 1be13b2dfe8bf..64df897c0ee30 100644 +--- a/arch/x86/include/asm/sparsemem.h ++++ b/arch/x86/include/asm/sparsemem.h +@@ -37,8 +37,6 @@ extern int phys_to_target_node(phys_addr_t start); + #define phys_to_target_node phys_to_target_node + extern int memory_add_physaddr_to_nid(u64 start); + #define memory_add_physaddr_to_nid memory_add_physaddr_to_nid +-extern int numa_fill_memblks(u64 start, u64 end); +-#define numa_fill_memblks numa_fill_memblks + #endif + #endif /* __ASSEMBLY__ */ + +diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c +index dae5c952735c7..c7fa5396c0f05 100644 +--- a/arch/x86/mm/numa.c ++++ b/arch/x86/mm/numa.c +@@ -956,6 +956,8 @@ int memory_add_physaddr_to_nid(u64 start) + } + EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid); + ++#endif ++ + static int __init cmp_memblk(const void *a, const void *b) + { + const struct numa_memblk *ma = *(const struct numa_memblk **)a; +@@ -1028,5 +1030,3 @@ int __init numa_fill_memblks(u64 start, u64 end) + } + return 0; + } +- +-#endif +diff --git a/drivers/acpi/numa/srat.c b/drivers/acpi/numa/srat.c +index b57de78fbf14f..a44c0761fd1c0 100644 +--- a/drivers/acpi/numa/srat.c ++++ b/drivers/acpi/numa/srat.c +@@ -206,6 +206,11 @@ int __init srat_disabled(void) + return acpi_numa < 0; + } + ++__weak int __init numa_fill_memblks(u64 start, u64 end) ++{ ++ return NUMA_NO_MEMBLK; ++} ++ + #if defined(CONFIG_X86) || defined(CONFIG_ARM64) || defined(CONFIG_LOONGARCH) + /* + * Callback for SLIT parsing. pxm_to_node() returns NUMA_NO_NODE for +diff --git a/include/linux/numa.h b/include/linux/numa.h +index 915033a757315..1d43371fafd2f 100644 +--- a/include/linux/numa.h ++++ b/include/linux/numa.h +@@ -36,12 +36,7 @@ int memory_add_physaddr_to_nid(u64 start); + int phys_to_target_node(u64 start); + #endif + +-#ifndef numa_fill_memblks +-static inline int __init numa_fill_memblks(u64 start, u64 end) +-{ +- return NUMA_NO_MEMBLK; +-} +-#endif ++int numa_fill_memblks(u64 start, u64 end); + + #else /* !CONFIG_NUMA */ + static inline int numa_nearest_node(int node, unsigned int state) +-- +2.43.0 + diff --git a/queue-6.6/x86-pat-fix-w-x-violation-false-positives-when-runni.patch b/queue-6.6/x86-pat-fix-w-x-violation-false-positives-when-runni.patch new file mode 100644 index 00000000000..a0b73f1995a --- /dev/null +++ b/queue-6.6/x86-pat-fix-w-x-violation-false-positives-when-runni.patch @@ -0,0 +1,144 @@ +From 135ef2b7a13ecd73b148dc8d6f8f188bd2308790 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:12:58 +0200 +Subject: x86/pat: Fix W^X violation false-positives when running as Xen PV + guest + +From: Juergen Gross + +[ Upstream commit 5bc8b0f5dac04cd4ebe47f8090a5942f2f2647ef ] + +When running as Xen PV guest in some cases W^X violation WARN()s have +been observed. Those WARN()s are produced by verify_rwx(), which looks +into the PTE to verify that writable kernel pages have the NX bit set +in order to avoid code modifications of the kernel by rogue code. + +As the NX bits of all levels of translation entries are or-ed and the +RW bits of all levels are and-ed, looking just into the PTE isn't enough +for the decision that a writable page is executable, too. + +When running as a Xen PV guest, the direct map PMDs and kernel high +map PMDs share the same set of PTEs. Xen kernel initialization will set +the NX bit in the direct map PMD entries, and not the shared PTEs. + +Fixes: 652c5bf380ad ("x86/mm: Refuse W^X violations") +Reported-by: Jason Andryuk +Signed-off-by: Juergen Gross +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20240412151258.9171-5-jgross@suse.com +Signed-off-by: Sasha Levin +--- + arch/x86/mm/pat/set_memory.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c +index a2dd773b1cd29..2d850f6bae701 100644 +--- a/arch/x86/mm/pat/set_memory.c ++++ b/arch/x86/mm/pat/set_memory.c +@@ -619,7 +619,8 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start, + * Validate strict W^X semantics. + */ + static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long start, +- unsigned long pfn, unsigned long npg) ++ unsigned long pfn, unsigned long npg, ++ bool nx, bool rw) + { + unsigned long end; + +@@ -641,6 +642,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star + if ((pgprot_val(new) & (_PAGE_RW | _PAGE_NX)) != _PAGE_RW) + return new; + ++ /* Non-leaf translation entries can disable writing or execution. */ ++ if (!rw || nx) ++ return new; ++ + end = start + npg * PAGE_SIZE - 1; + WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n", + (unsigned long long)pgprot_val(old), +@@ -742,7 +747,7 @@ pte_t *lookup_address(unsigned long address, unsigned int *level) + EXPORT_SYMBOL_GPL(lookup_address); + + static pte_t *_lookup_address_cpa(struct cpa_data *cpa, unsigned long address, +- unsigned int *level) ++ unsigned int *level, bool *nx, bool *rw) + { + pgd_t *pgd; + +@@ -751,7 +756,7 @@ static pte_t *_lookup_address_cpa(struct cpa_data *cpa, unsigned long address, + else + pgd = cpa->pgd + pgd_index(address); + +- return lookup_address_in_pgd(pgd, address, level); ++ return lookup_address_in_pgd_attr(pgd, address, level, nx, rw); + } + + /* +@@ -875,12 +880,13 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address, + pgprot_t old_prot, new_prot, req_prot, chk_prot; + pte_t new_pte, *tmp; + enum pg_level level; ++ bool nx, rw; + + /* + * Check for races, another CPU might have split this page + * up already: + */ +- tmp = _lookup_address_cpa(cpa, address, &level); ++ tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw); + if (tmp != kpte) + return 1; + +@@ -991,7 +997,8 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address, + new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages, + psize, CPA_DETECT); + +- new_prot = verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages); ++ new_prot = verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages, ++ nx, rw); + + /* + * If there is a conflict, split the large page. +@@ -1072,6 +1079,7 @@ __split_large_page(struct cpa_data *cpa, pte_t *kpte, unsigned long address, + pte_t *pbase = (pte_t *)page_address(base); + unsigned int i, level; + pgprot_t ref_prot; ++ bool nx, rw; + pte_t *tmp; + + spin_lock(&pgd_lock); +@@ -1079,7 +1087,7 @@ __split_large_page(struct cpa_data *cpa, pte_t *kpte, unsigned long address, + * Check for races, another CPU might have split this page + * up for us already: + */ +- tmp = _lookup_address_cpa(cpa, address, &level); ++ tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw); + if (tmp != kpte) { + spin_unlock(&pgd_lock); + return 1; +@@ -1620,10 +1628,11 @@ static int __change_page_attr(struct cpa_data *cpa, int primary) + int do_split, err; + unsigned int level; + pte_t *kpte, old_pte; ++ bool nx, rw; + + address = __cpa_addr(cpa, cpa->curpage); + repeat: +- kpte = _lookup_address_cpa(cpa, address, &level); ++ kpte = _lookup_address_cpa(cpa, address, &level, &nx, &rw); + if (!kpte) + return __cpa_process_fault(cpa, address, primary); + +@@ -1645,7 +1654,8 @@ static int __change_page_attr(struct cpa_data *cpa, int primary) + new_prot = static_protections(new_prot, address, pfn, 1, 0, + CPA_PROTECT); + +- new_prot = verify_rwx(old_prot, new_prot, address, pfn, 1); ++ new_prot = verify_rwx(old_prot, new_prot, address, pfn, 1, ++ nx, rw); + + new_prot = pgprot_clear_protnone_bits(new_prot); + +-- +2.43.0 + diff --git a/queue-6.6/x86-pat-introduce-lookup_address_in_pgd_attr.patch b/queue-6.6/x86-pat-introduce-lookup_address_in_pgd_attr.patch new file mode 100644 index 00000000000..eeb67b52f0a --- /dev/null +++ b/queue-6.6/x86-pat-introduce-lookup_address_in_pgd_attr.patch @@ -0,0 +1,127 @@ +From e88449b134cf3181c68811c6e5818762fe51c422 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:12:55 +0200 +Subject: x86/pat: Introduce lookup_address_in_pgd_attr() + +From: Juergen Gross + +[ Upstream commit ceb647b4b529fdeca9021cd34486f5a170746bda ] + +Add lookup_address_in_pgd_attr() doing the same as the already +existing lookup_address_in_pgd(), but returning the effective settings +of the NX and RW bits of all walked page table levels, too. + +This will be needed in order to match hardware behavior when looking +for effective access rights, especially for detecting writable code +pages. + +In order to avoid code duplication, let lookup_address_in_pgd() call +lookup_address_in_pgd_attr() with dummy parameters. + +Signed-off-by: Juergen Gross +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20240412151258.9171-2-jgross@suse.com +Stable-dep-of: 5bc8b0f5dac0 ("x86/pat: Fix W^X violation false-positives when running as Xen PV guest") +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/pgtable_types.h | 2 ++ + arch/x86/mm/pat/set_memory.c | 33 +++++++++++++++++++++++++--- + 2 files changed, 32 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h +index 9abb8cc4cd474..b786449626267 100644 +--- a/arch/x86/include/asm/pgtable_types.h ++++ b/arch/x86/include/asm/pgtable_types.h +@@ -567,6 +567,8 @@ static inline void update_page_count(int level, unsigned long pages) { } + extern pte_t *lookup_address(unsigned long address, unsigned int *level); + extern pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address, + unsigned int *level); ++pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address, ++ unsigned int *level, bool *nx, bool *rw); + extern pmd_t *lookup_pmd_address(unsigned long address); + extern phys_addr_t slow_virt_to_phys(void *__address); + extern int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, +diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c +index f3c4c756fe1ee..1132d222ade82 100644 +--- a/arch/x86/mm/pat/set_memory.c ++++ b/arch/x86/mm/pat/set_memory.c +@@ -657,20 +657,26 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star + + /* + * Lookup the page table entry for a virtual address in a specific pgd. +- * Return a pointer to the entry and the level of the mapping. ++ * Return a pointer to the entry, the level of the mapping, and the effective ++ * NX and RW bits of all page table levels. + */ +-pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address, +- unsigned int *level) ++pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address, ++ unsigned int *level, bool *nx, bool *rw) + { + p4d_t *p4d; + pud_t *pud; + pmd_t *pmd; + + *level = PG_LEVEL_NONE; ++ *nx = false; ++ *rw = true; + + if (pgd_none(*pgd)) + return NULL; + ++ *nx |= pgd_flags(*pgd) & _PAGE_NX; ++ *rw &= pgd_flags(*pgd) & _PAGE_RW; ++ + p4d = p4d_offset(pgd, address); + if (p4d_none(*p4d)) + return NULL; +@@ -679,6 +685,9 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address, + if (p4d_large(*p4d) || !p4d_present(*p4d)) + return (pte_t *)p4d; + ++ *nx |= p4d_flags(*p4d) & _PAGE_NX; ++ *rw &= p4d_flags(*p4d) & _PAGE_RW; ++ + pud = pud_offset(p4d, address); + if (pud_none(*pud)) + return NULL; +@@ -687,6 +696,9 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address, + if (pud_leaf(*pud) || !pud_present(*pud)) + return (pte_t *)pud; + ++ *nx |= pud_flags(*pud) & _PAGE_NX; ++ *rw &= pud_flags(*pud) & _PAGE_RW; ++ + pmd = pmd_offset(pud, address); + if (pmd_none(*pmd)) + return NULL; +@@ -695,11 +707,26 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address, + if (pmd_large(*pmd) || !pmd_present(*pmd)) + return (pte_t *)pmd; + ++ *nx |= pmd_flags(*pmd) & _PAGE_NX; ++ *rw &= pmd_flags(*pmd) & _PAGE_RW; ++ + *level = PG_LEVEL_4K; + + return pte_offset_kernel(pmd, address); + } + ++/* ++ * Lookup the page table entry for a virtual address in a specific pgd. ++ * Return a pointer to the entry and the level of the mapping. ++ */ ++pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address, ++ unsigned int *level) ++{ ++ bool nx, rw; ++ ++ return lookup_address_in_pgd_attr(pgd, address, level, &nx, &rw); ++} ++ + /* + * Lookup the page table entry for a virtual address. Return a pointer + * to the entry and the level of the mapping. +-- +2.43.0 + diff --git a/queue-6.6/x86-pat-restructure-_lookup_address_cpa.patch b/queue-6.6/x86-pat-restructure-_lookup_address_cpa.patch new file mode 100644 index 00000000000..7a8d546a6d0 --- /dev/null +++ b/queue-6.6/x86-pat-restructure-_lookup_address_cpa.patch @@ -0,0 +1,51 @@ +From 54ef3387f6fdd2a8c7560db798fc6098cd447965 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:12:57 +0200 +Subject: x86/pat: Restructure _lookup_address_cpa() + +From: Juergen Gross + +[ Upstream commit 02eac06b820c3eae73e5736ae62f986d37fed991 ] + +Modify _lookup_address_cpa() to no longer use lookup_address(), but +only lookup_address_in_pgd(). + +This is done in preparation of using lookup_address_in_pgd_attr(). + +No functional change intended. + +Signed-off-by: Juergen Gross +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20240412151258.9171-4-jgross@suse.com +Stable-dep-of: 5bc8b0f5dac0 ("x86/pat: Fix W^X violation false-positives when running as Xen PV guest") +Signed-off-by: Sasha Levin +--- + arch/x86/mm/pat/set_memory.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c +index 1132d222ade82..a2dd773b1cd29 100644 +--- a/arch/x86/mm/pat/set_memory.c ++++ b/arch/x86/mm/pat/set_memory.c +@@ -744,11 +744,14 @@ EXPORT_SYMBOL_GPL(lookup_address); + static pte_t *_lookup_address_cpa(struct cpa_data *cpa, unsigned long address, + unsigned int *level) + { +- if (cpa->pgd) +- return lookup_address_in_pgd(cpa->pgd + pgd_index(address), +- address, level); ++ pgd_t *pgd; ++ ++ if (!cpa->pgd) ++ pgd = pgd_offset_k(address); ++ else ++ pgd = cpa->pgd + pgd_index(address); + +- return lookup_address(address, level); ++ return lookup_address_in_pgd(pgd, address, level); + } + + /* +-- +2.43.0 + diff --git a/queue-6.6/x86-purgatory-switch-to-the-position-independent-sma.patch b/queue-6.6/x86-purgatory-switch-to-the-position-independent-sma.patch new file mode 100644 index 00000000000..350b7ba7dc2 --- /dev/null +++ b/queue-6.6/x86-purgatory-switch-to-the-position-independent-sma.patch @@ -0,0 +1,81 @@ +From 1a3c18233417cea1ba37431c2ddda2b75303d289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 22:17:06 +0200 +Subject: x86/purgatory: Switch to the position-independent small code model + +From: Ard Biesheuvel + +[ Upstream commit cba786af84a0f9716204e09f518ce3b7ada8555e ] + +On x86, the ordinary, position dependent small and kernel code models +only support placement of the executable in 32-bit addressable memory, +due to the use of 32-bit signed immediates to generate references to +global variables. For the kernel, this implies that all global variables +must reside in the top 2 GiB of the kernel virtual address space, where +the implicit address bits 63:32 are equal to sign bit 31. + +This means the kernel code model is not suitable for other bare metal +executables such as the kexec purgatory, which can be placed arbitrarily +in the physical address space, where its address may no longer be +representable as a sign extended 32-bit quantity. For this reason, +commit + + e16c2983fba0 ("x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors") + +switched to the large code model, which uses 64-bit immediates for all +symbol references, including function calls, in order to avoid relying +on any assumptions regarding proximity of symbols in the final +executable. + +The large code model is rarely used, clunky and the least likely to +operate in a similar fashion when comparing GCC and Clang, so it is best +avoided. This is especially true now that Clang 18 has started to emit +executable code in two separate sections (.text and .ltext), which +triggers an issue in the kexec loading code at runtime. + +The SUSE bugzilla fixes tag points to gcc 13 having issues with the +large model too and that perhaps the large model should simply not be +used at all. + +Instead, use the position independent small code model, which makes no +assumptions about placement but only about proximity, where all +referenced symbols must be within -/+ 2 GiB, i.e., in range for a +RIP-relative reference. Use hidden visibility to suppress the use of a +GOT, which carries absolute addresses that are not covered by static ELF +relocations, and is therefore incompatible with the kexec loader's +relocation logic. + + [ bp: Massage commit message. ] + +Fixes: e16c2983fba0 ("x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors") +Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1211853 +Closes: https://github.com/ClangBuiltLinux/linux/issues/2016 +Signed-off-by: Ard Biesheuvel +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Nathan Chancellor +Reviewed-by: Fangrui Song +Acked-by: Nick Desaulniers +Tested-by: Nathan Chancellor +Link: https://lore.kernel.org/all/20240417-x86-fix-kexec-with-llvm-18-v1-0-5383121e8fb7@kernel.org/ +Signed-off-by: Sasha Levin +--- + arch/x86/purgatory/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile +index 08aa0f25f12a0..8d1c82795ea1d 100644 +--- a/arch/x86/purgatory/Makefile ++++ b/arch/x86/purgatory/Makefile +@@ -42,7 +42,8 @@ KCOV_INSTRUMENT := n + # make up the standalone purgatory.ro + + PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel +-PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss -g0 ++PURGATORY_CFLAGS := -mcmodel=small -ffreestanding -fno-zero-initialized-in-bss -g0 ++PURGATORY_CFLAGS += -fpic -fvisibility=hidden + PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN) -DDISABLE_BRANCH_PROFILING + PURGATORY_CFLAGS += -fno-stack-protector + +-- +2.43.0 +