From: Sasha Levin Date: Sat, 9 Nov 2024 02:46:07 +0000 (-0500) Subject: Fixes for 6.11 X-Git-Tag: v5.15.172~90 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=da55b96491f3071923e307b2d759713312bec95a;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.11 Signed-off-by: Sasha Levin --- diff --git a/queue-6.11/arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch b/queue-6.11/arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch new file mode 100644 index 00000000000..fb748ed85d7 --- /dev/null +++ b/queue-6.11/arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch @@ -0,0 +1,39 @@ +From 2e3c96016b27b07ec7077c7272379e80e73e0de4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:38 +0200 +Subject: ARM: dts: rockchip: drop grf reference from rk3036 hdmi + +From: Heiko Stuebner + +[ Upstream commit 1580ccb6ed9dc76b8ff3e2d8912e8215c8b0fa6d ] + +Neither the binding nor the driver implementation specify/use the grf +reference provided in the rk3036. And neither does the newer rk3128 +user of the hdmi controller. So drop the rockchip,grf property. + +Fixes: b7217cf19c63 ("ARM: dts: rockchip: add hdmi device node for rk3036") +Cc: Caesar Wang +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-13-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rockchip/rk3036.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rockchip/rk3036.dtsi b/arch/arm/boot/dts/rockchip/rk3036.dtsi +index 37369538483f7..09371f07d7b4b 100644 +--- a/arch/arm/boot/dts/rockchip/rk3036.dtsi ++++ b/arch/arm/boot/dts/rockchip/rk3036.dtsi +@@ -400,7 +400,6 @@ + interrupts = ; + clocks = <&cru PCLK_HDMI>; + clock-names = "pclk"; +- rockchip,grf = <&grf>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_ctl>; + #sound-dai-cells = <0>; +-- +2.43.0 + diff --git a/queue-6.11/arm-dts-rockchip-fix-rk3036-acodec-node.patch b/queue-6.11/arm-dts-rockchip-fix-rk3036-acodec-node.patch new file mode 100644 index 00000000000..9c2dc6cdf0a --- /dev/null +++ b/queue-6.11/arm-dts-rockchip-fix-rk3036-acodec-node.patch @@ -0,0 +1,49 @@ +From 187c245fc634e0ad4003a099acf2dbab79890a30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:37 +0200 +Subject: ARM: dts: rockchip: fix rk3036 acodec node + +From: Heiko Stuebner + +[ Upstream commit c7206853cd7d31c52575fb1dc7616b4398f3bc8f ] + +The acodec node is not conformant to the binding. + +Set the correct nodename, use the correct compatible, add the needed +#sound-dai-cells and sort the rockchip,grf below clocks properties +as expected. + +Fixes: faea098e1808 ("ARM: dts: rockchip: add core rk3036 dtsi") +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-12-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rockchip/rk3036.dtsi | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/rockchip/rk3036.dtsi b/arch/arm/boot/dts/rockchip/rk3036.dtsi +index 96279d1e02fec..37369538483f7 100644 +--- a/arch/arm/boot/dts/rockchip/rk3036.dtsi ++++ b/arch/arm/boot/dts/rockchip/rk3036.dtsi +@@ -384,12 +384,13 @@ + }; + }; + +- acodec: acodec-ana@20030000 { +- compatible = "rk3036-codec"; ++ acodec: audio-codec@20030000 { ++ compatible = "rockchip,rk3036-codec"; + reg = <0x20030000 0x4000>; +- rockchip,grf = <&grf>; + clock-names = "acodec_pclk"; + clocks = <&cru PCLK_ACODEC>; ++ rockchip,grf = <&grf>; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +-- +2.43.0 + diff --git a/queue-6.11/arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch b/queue-6.11/arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch new file mode 100644 index 00000000000..d6e25d99529 --- /dev/null +++ b/queue-6.11/arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch @@ -0,0 +1,41 @@ +From 5c0d704950cfc32729d13407aee6db41ccaed794 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:40 +0200 +Subject: ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin + +From: Heiko Stuebner + +[ Upstream commit 77a9a7f2d3b94d29d13d71b851114d593a2147cf ] + +Both the node name as well as the compatible were not named +according to the binding expectations, fix that. + +Fixes: 47bf3a5c9e2a ("ARM: dts: rockchip: add the sound setup for rk3036-kylin board") +Cc: Caesar Wang +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-15-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rockchip/rk3036-kylin.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/rockchip/rk3036-kylin.dts b/arch/arm/boot/dts/rockchip/rk3036-kylin.dts +index e32c73d32f0aa..2f84e28057121 100644 +--- a/arch/arm/boot/dts/rockchip/rk3036-kylin.dts ++++ b/arch/arm/boot/dts/rockchip/rk3036-kylin.dts +@@ -325,8 +325,8 @@ + &i2c2 { + status = "okay"; + +- rt5616: rt5616@1b { +- compatible = "rt5616"; ++ rt5616: audio-codec@1b { ++ compatible = "realtek,rt5616"; + reg = <0x1b>; + clocks = <&cru SCLK_I2S_OUT>; + clock-names = "mclk"; +-- +2.43.0 + diff --git a/queue-6.11/arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch b/queue-6.11/arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch new file mode 100644 index 00000000000..9dce6fe7277 --- /dev/null +++ b/queue-6.11/arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch @@ -0,0 +1,48 @@ +From 091e2f98061cb9fcb2e0d8e12280a50b47f40a7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:39 +0200 +Subject: ARM: dts: rockchip: Fix the spi controller on rk3036 + +From: Heiko Stuebner + +[ Upstream commit 8bade1ad1f0821aef31f6a8fb1027ae292566d85 ] + +Compatible and clock names did not match the existing binding. +So set the correct values and re-order+rename the clocks. + +It looks like no rk3036 board did use the spi controller so far, +so this was never detected on a running device yet. + +Fixes: f629fcfab2cd ("ARM: dts: rockchip: support the spi for rk3036") +Cc: Caesar Wang +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-14-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rockchip/rk3036.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/rockchip/rk3036.dtsi b/arch/arm/boot/dts/rockchip/rk3036.dtsi +index 09371f07d7b4b..63b9912be06a7 100644 +--- a/arch/arm/boot/dts/rockchip/rk3036.dtsi ++++ b/arch/arm/boot/dts/rockchip/rk3036.dtsi +@@ -553,11 +553,11 @@ + }; + + spi: spi@20074000 { +- compatible = "rockchip,rockchip-spi"; ++ compatible = "rockchip,rk3036-spi"; + reg = <0x20074000 0x1000>; + interrupts = ; +- clocks = <&cru PCLK_SPI>, <&cru SCLK_SPI>; +- clock-names = "apb-pclk","spi_pclk"; ++ clocks = <&cru SCLK_SPI>, <&cru PCLK_SPI>; ++ clock-names = "spiclk", "apb_pclk"; + dmas = <&pdma 8>, <&pdma 9>; + dma-names = "tx", "rx"; + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-imx8-ss-vpu-fix-imx8qm-vpu-irqs.patch b/queue-6.11/arm64-dts-imx8-ss-vpu-fix-imx8qm-vpu-irqs.patch new file mode 100644 index 00000000000..ffec8b7f3fb --- /dev/null +++ b/queue-6.11/arm64-dts-imx8-ss-vpu-fix-imx8qm-vpu-irqs.patch @@ -0,0 +1,68 @@ +From 36d96baf456be8b79f174d2be0b95b34620d3d35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2024 13:41:03 +0200 +Subject: arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs + +From: Alexander Stein + +[ Upstream commit eed2d8e8d0051a6551e4dffba99e16eb88c676ac ] + +imx8-ss-vpu only contained imx8qxp IRQ numbers, only mu2_m0 uses the +correct imx8qm IRQ number, as imx8qxp lacks this MU. +Fix this by providing imx8qm IRQ numbers in the main imx8-ss-vpu.dtsi +and override the IRQ numbers in SoC-specific imx8qxp-ss-vpu.dtsi, similar +to reg property for VPU core devices. + +Fixes: 0d9968d98467d ("arm64: dts: freescale: imx8q: add imx vpu codec entries") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi | 4 ++-- + arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi | 8 ++++++++ + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi +index c6540768bdb92..87211c18d65a9 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi +@@ -15,7 +15,7 @@ vpu: vpu@2c000000 { + mu_m0: mailbox@2d000000 { + compatible = "fsl,imx6sx-mu"; + reg = <0x2d000000 0x20000>; +- interrupts = ; ++ interrupts = ; + #mbox-cells = <2>; + power-domains = <&pd IMX_SC_R_VPU_MU_0>; + status = "disabled"; +@@ -24,7 +24,7 @@ vpu: vpu@2c000000 { + mu1_m0: mailbox@2d020000 { + compatible = "fsl,imx6sx-mu"; + reg = <0x2d020000 0x20000>; +- interrupts = ; ++ interrupts = ; + #mbox-cells = <2>; + power-domains = <&pd IMX_SC_R_VPU_MU_1>; + status = "disabled"; +diff --git a/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi b/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi +index 7894a3ab26d6b..f81937b5fb720 100644 +--- a/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi +@@ -5,6 +5,14 @@ + * Author: Alexander Stein + */ + ++&mu_m0 { ++ interrupts = ; ++}; ++ ++&mu1_m0 { ++ interrupts = ; ++}; ++ + &vpu_core0 { + reg = <0x2d040000 0x10000>; + }; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-imx8mp-correct-sdhc-ipg-clk.patch b/queue-6.11/arm64-dts-imx8mp-correct-sdhc-ipg-clk.patch new file mode 100644 index 00000000000..2b455862b6d --- /dev/null +++ b/queue-6.11/arm64-dts-imx8mp-correct-sdhc-ipg-clk.patch @@ -0,0 +1,55 @@ +From 4d0a4560f3f92559613322aec3b0262b52af1161 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Oct 2024 10:52:21 +0800 +Subject: arm64: dts: imx8mp: correct sdhc ipg clk + +From: Peng Fan + +[ Upstream commit eab6ba2aa3bbaf598a66e31f709bf84b7bb7dc8a ] + +The ipg clk for sdhc sources from IPG_CLK_ROOT per i.MX 8M Plus +Applications Processor Reference Manual, Table 5-2. System Clocks. + +Fixes: 6d9b8d20431f ("arm64: dts: freescale: Add i.MX8MP dtsi support") +Signed-off-by: Peng Fan +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index 603dfe80216f8..6113ea3a284ce 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -1261,7 +1261,7 @@ + compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc"; + reg = <0x30b40000 0x10000>; + interrupts = ; +- clocks = <&clk IMX8MP_CLK_DUMMY>, ++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>, + <&clk IMX8MP_CLK_NAND_USDHC_BUS>, + <&clk IMX8MP_CLK_USDHC1_ROOT>; + clock-names = "ipg", "ahb", "per"; +@@ -1275,7 +1275,7 @@ + compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc"; + reg = <0x30b50000 0x10000>; + interrupts = ; +- clocks = <&clk IMX8MP_CLK_DUMMY>, ++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>, + <&clk IMX8MP_CLK_NAND_USDHC_BUS>, + <&clk IMX8MP_CLK_USDHC2_ROOT>; + clock-names = "ipg", "ahb", "per"; +@@ -1289,7 +1289,7 @@ + compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc"; + reg = <0x30b60000 0x10000>; + interrupts = ; +- clocks = <&clk IMX8MP_CLK_DUMMY>, ++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>, + <&clk IMX8MP_CLK_NAND_USDHC_BUS>, + <&clk IMX8MP_CLK_USDHC3_ROOT>; + clock-names = "ipg", "ahb", "per"; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-imx8mp-phyboard-pollux-set-video-pll1-freq.patch b/queue-6.11/arm64-dts-imx8mp-phyboard-pollux-set-video-pll1-freq.patch new file mode 100644 index 00000000000..7ee7d5f9d16 --- /dev/null +++ b/queue-6.11/arm64-dts-imx8mp-phyboard-pollux-set-video-pll1-freq.patch @@ -0,0 +1,57 @@ +From 9b8c8c3d96ef48769eb64d519bc56b6126bb4315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 05:11:20 +0200 +Subject: arm64: dts: imx8mp-phyboard-pollux: Set Video PLL1 frequency to 506.8 + MHz + +From: Marek Vasut + +[ Upstream commit 4fbb73416b10778adfd2c1319e9c5829780d8535 ] + +The LVDS panel on this device uses 72.4 MHz pixel clock, set IMX8MP_VIDEO_PLL1 +to 72.4 * 7 = 506.8 MHz so the LDB serializer and LCDIFv3 scanout engine can +reach accurate pixel clock of exactly 72.4 MHz. + +Without this patch, the Video PLL1 frequency is the default set in imx8mp.dtsi +which is 1039.5 MHz, which divides down to inaccurate pixel clock of 74.25 MHz +which works for this particular panel by sheer chance. + +Stop taking that chance and set correct accurate pixel clock frequency instead. + +Fixes: 326d86e197fc ("arm64: dts: imx8mp-phyboard-pollux-rdk: add etml panel support") +Reported-by: Isaac Scott +Signed-off-by: Marek Vasut +Reviewed-by: Yannic Moog +Tested-by: Yannic Moog +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/freescale/imx8mp-phyboard-pollux-rdk.dts | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-phyboard-pollux-rdk.dts b/arch/arm64/boot/dts/freescale/imx8mp-phyboard-pollux-rdk.dts +index 00a240484c254..b6fd292a3b91d 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-phyboard-pollux-rdk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-phyboard-pollux-rdk.dts +@@ -191,6 +191,18 @@ + }; + }; + ++&media_blk_ctrl { ++ /* ++ * The LVDS panel on this device uses 72.4 MHz pixel clock, ++ * set IMX8MP_VIDEO_PLL1 to 72.4 * 7 = 506.8 MHz so the LDB ++ * serializer and LCDIFv3 scanout engine can reach accurate ++ * pixel clock of exactly 72.4 MHz. ++ */ ++ assigned-clock-rates = <500000000>, <200000000>, ++ <0>, <0>, <500000000>, ++ <506800000>; ++}; ++ + &snvs_pwrkey { + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-qcom-sm8450-fix-pipe-clock-specification-f.patch b/queue-6.11/arm64-dts-qcom-sm8450-fix-pipe-clock-specification-f.patch new file mode 100644 index 00000000000..365cc97f783 --- /dev/null +++ b/queue-6.11/arm64-dts-qcom-sm8450-fix-pipe-clock-specification-f.patch @@ -0,0 +1,47 @@ +From 3dc09e992eab753ea8c06e1c4549f2cb4bdb3c78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Oct 2024 19:47:56 +0300 +Subject: arm64: dts: qcom: sm8450 fix PIPE clock specification for pcie1 + +From: Dmitry Baryshkov + +[ Upstream commit 5d3d966400d0a094359009147d742b3926a2ea53 ] + +For historical reasons on SM8450 the second PCIe host (pcie1) also keeps +a reference to the PIPE clock coming from the PHY. Commit e76862840660 +("arm64: dts: qcom: sm8450: correct pcie1 phy clocks inputs to gcc") has +updated the PHY to use #clock-cells = <1>, making just <&pcie1_phy> +clock specification invalid. Update corresponding clock entry in the +PCIe1 host node. + + /soc@0/pcie@1c08000: Failed to get clk index: 2 ret: -22 + qcom-pcie 1c08000.pcie: Failed to get clocks + qcom-pcie 1c08000.pcie: probe with driver qcom-pcie failed with error -22 + +Fixes: e76862840660 ("arm64: dts: qcom: sm8450: correct pcie1 phy clocks inputs to gcc") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241006-fix-sm8450-pcie1-v1-1-4f227c9082ed@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index 9bafb3b350ff6..38cb524cc5689 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -1973,7 +1973,7 @@ + + clocks = <&gcc GCC_PCIE_1_PIPE_CLK>, + <&gcc GCC_PCIE_1_PIPE_CLK_SRC>, +- <&pcie1_phy>, ++ <&pcie1_phy QMP_PCIE_PIPE_CLK>, + <&rpmhcc RPMH_CXO_CLK>, + <&gcc GCC_PCIE_1_AUX_CLK>, + <&gcc GCC_PCIE_1_CFG_AHB_CLK>, +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-add-dts-for-friendlyarm-nanopi-r2.patch b/queue-6.11/arm64-dts-rockchip-add-dts-for-friendlyarm-nanopi-r2.patch new file mode 100644 index 00000000000..dcfe11e0f91 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-add-dts-for-friendlyarm-nanopi-r2.patch @@ -0,0 +1,79 @@ +From f8facd46f0b71e91dac4769076a8f1a312dc73f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Aug 2024 17:00:46 +0000 +Subject: arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus + +From: Sergey Bostandzhyan + +[ Upstream commit b8c02878292200ebb5b4a8cfc9dbf227327908bd ] + +The R2S Plus is basically an R2S with additional eMMC. + +The eMMC configuration for the DTS has been extracted and copied from +rk3328-nanopi-r2.dts, v2017.09 branch from the friendlyarm/uboot-rockchip +repository. + +Signed-off-by: Sergey Bostandzhyan +Link: https://lore.kernel.org/r/20240814170048.23816-2-jin@mediatomb.cc +Signed-off-by: Heiko Stuebner +Stable-dep-of: 1b670212ee3d ("arm64: dts: rockchip: Remove undocumented supports-emmc property") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/Makefile | 1 + + .../dts/rockchip/rk3328-nanopi-r2s-plus.dts | 32 +++++++++++++++++++ + 2 files changed, 33 insertions(+) + create mode 100644 arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts + +diff --git a/arch/arm64/boot/dts/rockchip/Makefile b/arch/arm64/boot/dts/rockchip/Makefile +index fda1b980eb4bc..36258dc8dafd5 100644 +--- a/arch/arm64/boot/dts/rockchip/Makefile ++++ b/arch/arm64/boot/dts/rockchip/Makefile +@@ -20,6 +20,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-evb.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c-plus.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb ++dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s-plus.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus-lts.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts +new file mode 100644 +index 0000000000000..cb81ba3f23ffd +--- /dev/null ++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts +@@ -0,0 +1,32 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * (C) Copyright 2018 FriendlyElec Computer Tech. Co., Ltd. ++ * (http://www.friendlyarm.com) ++ * ++ * (C) Copyright 2016 Rockchip Electronics Co., Ltd ++ */ ++ ++/dts-v1/; ++#include "rk3328-nanopi-r2s.dts" ++ ++/ { ++ compatible = "friendlyarm,nanopi-r2s-plus", "rockchip,rk3328"; ++ model = "FriendlyElec NanoPi R2S Plus"; ++ ++ aliases { ++ mmc1 = &emmc; ++ }; ++}; ++ ++&emmc { ++ bus-width = <8>; ++ cap-mmc-highspeed; ++ disable-wp; ++ mmc-hs200-1_8v; ++ non-removable; ++ num-slots = <1>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_bus8>; ++ supports-emmc; ++ status = "okay"; ++}; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-correct-gpio-polarity-on-brcm-bt-.patch b/queue-6.11/arm64-dts-rockchip-correct-gpio-polarity-on-brcm-bt-.patch new file mode 100644 index 00000000000..02b44b6f579 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-correct-gpio-polarity-on-brcm-bt-.patch @@ -0,0 +1,65 @@ +From a9ccda8ffcb71675527c609037dde4bd61443779 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2024 16:45:50 +0200 +Subject: arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes + +From: Diederik de Haas + +[ Upstream commit 08846522d9a7bccf18d4f97c3f39d03c7a193970 ] + +Paragraph "3.4 Power up Timing Sequence" of the AzureWave-CM256SM +datasheet mentions the following about the BT_REG_ON pin, which is +connected to GPIO0_C4_d: + + When this pin is low and WL_REG_ON is high, + the BT section is in reset. + +Therefor set that pin to GPIO_ACTIVE_HIGH so that it can be pulled low +for a reset. +If set to GPIO_ACTIVE_LOW, the following errors are observed: + + Bluetooth: hci0: command 0x0c03 tx timeout + Bluetooth: hci0: BCM: Reset failed (-110) + +So fix the GPIO polarity by setting it to ACTIVE_HIGH. +This also matches what other devices with the same BT device have. + +Fixes: 2b6a3f857550 ("arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes") +Signed-off-by: Diederik de Haas +Link: https://lore.kernel.org/r/20241018145053.11928-2-didi.debian@cknow.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 2 +- + arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +index a477bd992b40e..0131f2cdd312f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +@@ -688,7 +688,7 @@ + host-wakeup-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>; + pinctrl-0 = <&bt_enable_h>, <&bt_host_wake_l>, <&bt_wake_h>; + pinctrl-names = "default"; +- shutdown-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>; ++ shutdown-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_HIGH>; + vbat-supply = <&vcc_wl>; + vddio-supply = <&vcca_1v8_pmu>; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi +index e9fa9bee995ae..1e36f73840dad 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi +@@ -404,7 +404,7 @@ + host-wakeup-gpios = <&gpio2 RK_PB1 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&bt_host_wake_h &bt_reg_on_h &bt_wake_host_h>; +- shutdown-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_LOW>; ++ shutdown-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; + vbat-supply = <&vcc_3v3>; + vddio-supply = <&vcc_1v8>; + }; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-designate-turing-rk1-s-system-pow.patch b/queue-6.11/arm64-dts-rockchip-designate-turing-rk1-s-system-pow.patch new file mode 100644 index 00000000000..7af9314b98a --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-designate-turing-rk1-s-system-pow.patch @@ -0,0 +1,38 @@ +From ce5544e3ccc7c0de2d590af258de1bc6278276f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2024 11:01:48 -0700 +Subject: arm64: dts: rockchip: Designate Turing RK1's system power controller + +From: Sam Edwards + +[ Upstream commit 875ea82c75f56697fa500f30fabaa49f82f9b229 ] + +Currently, the Turing RK1 board reboots when told to power off. + +Resolve this by designating the RK806 as the system power controller, so +that the relevant driver can handle system shutdown requests. + +Fixes: 2806a69f3fef ("arm64: dts: rockchip: Add Turing RK1 SoM support") +Signed-off-by: Sam Edwards +Link: https://lore.kernel.org/r/20240912180148.205957-1-CFSworks@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi +index dbaa94ca69f47..432133251e318 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi +@@ -296,6 +296,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&pmic_pins>, <&rk806_dvs1_null>, + <&rk806_dvs2_null>, <&rk806_dvs3_null>; ++ system-power-controller; + + vcc1-supply = <&vcc5v0_sys>; + vcc2-supply = <&vcc5v0_sys>; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-drop-regulator-init-microvolt-fro.patch b/queue-6.11/arm64-dts-rockchip-drop-regulator-init-microvolt-fro.patch new file mode 100644 index 00000000000..00cfb5671a7 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-drop-regulator-init-microvolt-fro.patch @@ -0,0 +1,75 @@ +From a3e21ab906b0a049df72a8ca1c9dbed04d7558ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:28 +0200 +Subject: arm64: dts: rockchip: Drop regulator-init-microvolt from two boards + +From: Heiko Stuebner + +[ Upstream commit 98c3f4a2d61a29a53244ce45e50655140bd47afb ] + +rk3568-roc-pc and rk3588-toybrick-x0 re-introduced this property despite +previous patches removing older instances already. + +regulator-init-microvolt is not part of any regulator binding and is +only used in the Rockchip vendor kernel. So drop it. + +It is used by u-boot in some places to setup initial regulator-state, +but that should happen in the existing -u-boot devicetree additions. + +Fixes: 007b4bb47f44 ("arm64: dts: rockchip: add dts for Firefly Station P2 aka rk3568-roc-pc") +Cc: Furkan Kardame +Fixes: 8ffe365f8dc7 ("arm64: dts: rockchip: Add devicetree support for TB-RK3588X board") +Cc: Elon Zhang +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-3-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-roc-pc.dts | 3 --- + arch/arm64/boot/dts/rockchip/rk3588-toybrick-x0.dts | 1 - + 2 files changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-roc-pc.dts b/arch/arm64/boot/dts/rockchip/rk3568-roc-pc.dts +index e333449ead045..2fa89a0eeafcd 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-roc-pc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-roc-pc.dts +@@ -272,7 +272,6 @@ + regulator-name = "vdd_logic"; + regulator-always-on; + regulator-boot-on; +- regulator-init-microvolt = <900000>; + regulator-initial-mode = <0x2>; + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <1350000>; +@@ -285,7 +284,6 @@ + + vdd_gpu: DCDC_REG2 { + regulator-name = "vdd_gpu"; +- regulator-init-microvolt = <900000>; + regulator-initial-mode = <0x2>; + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <1350000>; +@@ -309,7 +307,6 @@ + + vdd_npu: DCDC_REG4 { + regulator-name = "vdd_npu"; +- regulator-init-microvolt = <900000>; + regulator-initial-mode = <0x2>; + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <1350000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-toybrick-x0.dts b/arch/arm64/boot/dts/rockchip/rk3588-toybrick-x0.dts +index d0021524e7f95..328dcb894ccb2 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-toybrick-x0.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-toybrick-x0.dts +@@ -428,7 +428,6 @@ + regulator-boot-on; + regulator-min-microvolt = <550000>; + regulator-max-microvolt = <950000>; +- regulator-init-microvolt = <750000>; + regulator-ramp-delay = <12500>; + + regulator-state-mem { +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-fix-bluetooth-properties-on-rk356.patch b/queue-6.11/arm64-dts-rockchip-fix-bluetooth-properties-on-rk356.patch new file mode 100644 index 00000000000..6b087033204 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-fix-bluetooth-properties-on-rk356.patch @@ -0,0 +1,46 @@ +From 17d4471ba44b01401ee8377cf72d0429d29f2d4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:29 +0200 +Subject: arm64: dts: rockchip: Fix bluetooth properties on rk3566 box demo + +From: Heiko Stuebner + +[ Upstream commit 2fa98dcc8d3ea2ebbd9e6be778f8bb19231c28be ] + +The expected clock-name is different, and extclk also is deprecated +in favor of txco for clocks that are not crystals. + +The wakeup gpio properties are named differently too, when changing +from vendor-tree to mainline. So fix those to match the binding. + +Fixes: 2e0537b16b25 ("arm64: dts: rockchip: Add dts for rockchip rk3566 box demo board") +Cc: Andy Yan +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-4-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts b/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts +index 0c18406e4c597..7d46809338239 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts +@@ -449,9 +449,9 @@ + bluetooth { + compatible = "brcm,bcm43438-bt"; + clocks = <&pmucru CLK_RTC_32K>; +- clock-names = "ext_clock"; +- device-wake-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>; +- host-wake-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; ++ clock-names = "txco"; ++ device-wakeup-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>; ++ host-wakeup-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; + shutdown-gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&bt_host_wake_l &bt_wake_l &bt_enable_h>; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch b/queue-6.11/arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch new file mode 100644 index 00000000000..148ee1270d2 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch @@ -0,0 +1,41 @@ +From 99b0855fc679e096137f191c821280cb76d3c898 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:30 +0200 +Subject: arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards + +From: Heiko Stuebner + +[ Upstream commit ea74528aaea5a1dfc8e3de09ef2af37530eca526 ] + +The expected clock-name is different, and extclk also is deprecated +in favor of txco for clocks that are not crystals. + +So fix it to match the binding. + +Fixes: c72235c288c8 ("arm64: dts: rockchip: Add on-board WiFi/BT support for Rock960 boards") +Cc: Manivannan Sadhasivam +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-5-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi +index c920ddf44bafd..55ac7145c0850 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi +@@ -577,7 +577,7 @@ + bluetooth { + compatible = "brcm,bcm43438-bt"; + clocks = <&rk808 1>; +- clock-names = "ext_clock"; ++ clock-names = "txco"; + device-wakeup-gpios = <&gpio2 RK_PD3 GPIO_ACTIVE_HIGH>; + host-wakeup-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_HIGH>; + shutdown-gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-fix-i2c2-pinctrl-names-property-o.patch b/queue-6.11/arm64-dts-rockchip-fix-i2c2-pinctrl-names-property-o.patch new file mode 100644 index 00000000000..d1cb3908032 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-fix-i2c2-pinctrl-names-property-o.patch @@ -0,0 +1,59 @@ +From d3608acdc327e980ffa6db466160ca553a8c33bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:27 +0200 +Subject: arm64: dts: rockchip: fix i2c2 pinctrl-names property on + anbernic-rg353p/v + +From: Heiko Stuebner + +[ Upstream commit f94b934336e30cebae75d4fbe04a2109a3c8fdec ] + +We want to control pins, not beer mugs, so rename pintctrl-names to the +expected pinctrl-names. + +This was not affecting functionality, because the i2c2 controller +already had a set of pinctrl properties. + +Fixes: 523adb553573 ("arm64: dts: rockchip: add Anbernic RG353P and RG503") +Fixes: 1e141cf12726 ("arm64: dts: rockchip: add Anbernic RG353V and RG353VS") +Cc: Chris Morgan +Acked-by: Chris Morgan +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-2-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts | 2 +- + arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts +index a73cf30801ec7..9816a4ed4599e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts +@@ -92,7 +92,7 @@ + }; + + &i2c2 { +- pintctrl-names = "default"; ++ pinctrl-names = "default"; + pinctrl-0 = <&i2c2m1_xfer>; + status = "okay"; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts +index e9954a33e8cd3..a79a5614bcc88 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts +@@ -79,7 +79,7 @@ + }; + + &i2c2 { +- pintctrl-names = "default"; ++ pinctrl-names = "default"; + pinctrl-0 = <&i2c2m1_xfer>; + status = "okay"; + +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-fix-led-triggers-on-rk3308-roc-cc.patch b/queue-6.11/arm64-dts-rockchip-fix-led-triggers-on-rk3308-roc-cc.patch new file mode 100644 index 00000000000..0ab91fb5cc6 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-fix-led-triggers-on-rk3308-roc-cc.patch @@ -0,0 +1,52 @@ +From 8e9c22156114776d317192ebc9af1380484b9ab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:33 +0200 +Subject: arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc + +From: Heiko Stuebner + +[ Upstream commit 3a53a7187f41ec3db12cf4c2cb0db4ba87c2f3a1 ] + +There are two LEDs on the board, power and user events. +Currently both are assigned undocumented IR(-remote) +triggers that are probably only part of the vendor-kernel. + +To make dtbs check happier, assign the power-led to a generic +default-on trigger and the user led to the documented rc-feedback +trigger that should mostly match its current usage. + +Fixes: 4403e1237be3 ("arm64: dts: rockchip: Add devicetree for board roc-rk3308-cc") +Cc: Andy Yan +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-8-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts +index 9232357f4fec9..d9e191ad1d77e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts +@@ -36,14 +36,14 @@ + + power_led: led-0 { + label = "firefly:red:power"; +- linux,default-trigger = "ir-power-click"; ++ linux,default-trigger = "default-on"; + default-state = "on"; + gpios = <&gpio0 RK_PA6 GPIO_ACTIVE_HIGH>; + }; + + user_led: led-1 { + label = "firefly:blue:user"; +- linux,default-trigger = "ir-user-click"; ++ linux,default-trigger = "rc-feedback"; + default-state = "off"; + gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_HIGH>; + }; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-fix-reset-gpios-property-on-brcm-.patch b/queue-6.11/arm64-dts-rockchip-fix-reset-gpios-property-on-brcm-.patch new file mode 100644 index 00000000000..638ff5b3506 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-fix-reset-gpios-property-on-brcm-.patch @@ -0,0 +1,65 @@ +From 15484589ebf6d993545f5f3d8ff258a483b5ac12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 13:15:39 +0200 +Subject: arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes + +From: Diederik de Haas + +[ Upstream commit 2b6a3f857550e52b1cd4872ebb13cb3e3cf12f5f ] + +For most compatibles, the "brcm,bluetooth.yaml" binding doesn't allow +the 'reset-gpios' property, but there is a 'shutdown-gpios' property. + +Page 12 of the AzureWave-CM256SM datasheet (v1.9) has the following wrt +pin 34 'BT_REG_ON' (connected to GPIO0_C4_d on the PineNote): + + Used by PMU to power up or power down the internal regulators used + by the Bluetooth section. Also, when deasserted, this pin holds the + Bluetooth section in reset. This pin has an internal 200k ohm pull + down resistor that is enabled by default. + +So it is safe to replace 'reset-gpios' with 'shutdown-gpios'. + +Fixes: d449121e5e8a ("arm64: dts: rockchip: Add Pine64 PineNote board") +Signed-off-by: Diederik de Haas +Link: https://lore.kernel.org/r/20241008113344.23957-5-didi.debian@cknow.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 2 +- + arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +index ca7666bf5c0a5..a477bd992b40e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +@@ -686,9 +686,9 @@ + clock-names = "lpo"; + device-wakeup-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>; + host-wakeup-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>; +- reset-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>; + pinctrl-0 = <&bt_enable_h>, <&bt_host_wake_l>, <&bt_wake_h>; + pinctrl-names = "default"; ++ shutdown-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>; + vbat-supply = <&vcc_wl>; + vddio-supply = <&vcca_1v8_pmu>; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi +index 45de2630bb503..e9fa9bee995ae 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi +@@ -402,9 +402,9 @@ + clock-names = "lpo"; + device-wakeup-gpios = <&gpio2 RK_PB2 GPIO_ACTIVE_HIGH>; + host-wakeup-gpios = <&gpio2 RK_PB1 GPIO_ACTIVE_HIGH>; +- reset-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&bt_host_wake_h &bt_reg_on_h &bt_wake_host_h>; ++ shutdown-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_LOW>; + vbat-supply = <&vcc_3v3>; + vddio-supply = <&vcc_1v8>; + }; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch b/queue-6.11/arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch new file mode 100644 index 00000000000..c60c76416f4 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch @@ -0,0 +1,38 @@ +From ae28bd32c236b02eca6ce54e6fe354efe4dae7ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 15:48:40 +0200 +Subject: arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610 + +From: Geert Uytterhoeven + +[ Upstream commit 2f39bba3b4f037d6c3c9174eed5befcef1c79abb ] + +There are no DT bindings and driver support for a "rockchip,rt5651" +codec. Replace "rockchip,rt5651" by "realtek,rt5651", which matches the +"simple-audio-card,name" property in the "rt5651-sound" node. + +Fixes: 904f983256fdd24b ("arm64: dts: rockchip: Add dts for a rk3399 based board EAIDK-610") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/a9877b8b1bd0de279d2ec8294d5be14587203a82.1727358193.git.geert+renesas@glider.be +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts b/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts +index 173da81fc2311..ea11d6b86e506 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts +@@ -542,7 +542,7 @@ + status = "okay"; + + rt5651: audio-codec@1a { +- compatible = "rockchip,rt5651"; ++ compatible = "realtek,rt5651"; + reg = <0x1a>; + clocks = <&cru SCLK_I2S_8CH_OUT>; + clock-names = "mclk"; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch-16395 b/queue-6.11/arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch-16395 new file mode 100644 index 00000000000..ff68fb0ea3e --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch-16395 @@ -0,0 +1,39 @@ +From d8aeb12859cdd48a2b7e2cb8c18fbfd9810c0ae3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 15:48:41 +0200 +Subject: arm64: dts: rockchip: Fix rt5651 compatible value on + rk3399-sapphire-excavator + +From: Geert Uytterhoeven + +[ Upstream commit 577b5761679da90e691acc939ebbe7879fff5f31 ] + +There are no DT bindings and driver support for a "rockchip,rt5651" +codec. Replace "rockchip,rt5651" by "realtek,rt5651", which matches the +"simple-audio-card,name" property in the "rt5651-sound" node. + +Fixes: 0a3c78e251b3a266 ("arm64: dts: rockchip: Add support for rk3399 excavator main board") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/abc6c89811b3911785601d6d590483eacb145102.1727358193.git.geert+renesas@glider.be +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +index dbec2b7173a0b..31ea3d0182c06 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +@@ -163,7 +163,7 @@ + status = "okay"; + + rt5651: rt5651@1a { +- compatible = "rockchip,rt5651"; ++ compatible = "realtek,rt5651"; + reg = <0x1a>; + clocks = <&cru SCLK_I2S_8CH_OUT>; + clock-names = "mclk"; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-fix-wakeup-prop-names-on-pinenote.patch b/queue-6.11/arm64-dts-rockchip-fix-wakeup-prop-names-on-pinenote.patch new file mode 100644 index 00000000000..01091192679 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-fix-wakeup-prop-names-on-pinenote.patch @@ -0,0 +1,43 @@ +From 21266f38ebb0b53e1b242119b388669dee8544c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 13:15:38 +0200 +Subject: arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node + +From: Diederik de Haas + +[ Upstream commit 87299d6ee95a37d2d576dd8077ea6860f77ad8e2 ] + +The "brcm,bluetooth.yaml" binding has 'device-wakeup-gpios' and +'host-wakeup-gpios' property names, not '*-wake-gpios'. +Fix the incorrect property names. + +Note that the "realtek,bluetooth.yaml" binding does use the +'*-wake-gpios' property names. + +Fixes: d449121e5e8a ("arm64: dts: rockchip: Add Pine64 PineNote board") +Signed-off-by: Diederik de Haas +Link: https://lore.kernel.org/r/20241008113344.23957-4-didi.debian@cknow.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +index ae2536c65a830..ca7666bf5c0a5 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +@@ -684,8 +684,8 @@ + compatible = "brcm,bcm43438-bt"; + clocks = <&rk817 1>; + clock-names = "lpo"; +- device-wake-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>; +- host-wake-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>; ++ device-wakeup-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>; ++ host-wakeup-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>; + reset-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>; + pinctrl-0 = <&bt_enable_h>, <&bt_host_wake_l>, <&bt_wake_h>; + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-move-l3-cache-outside-cpus-in-rk3.patch b/queue-6.11/arm64-dts-rockchip-move-l3-cache-outside-cpus-in-rk3.patch new file mode 100644 index 00000000000..ccff42eb951 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-move-l3-cache-outside-cpus-in-rk3.patch @@ -0,0 +1,67 @@ +From 8aadb9ce4387e5b7b6ac7610c6b86f7dc08b8686 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 12:29:13 +0200 +Subject: arm64: dts: rockchip: Move L3 cache outside CPUs in RK3588(S) SoC + dtsi + +From: Dragan Simic + +[ Upstream commit df5f6f2f62b9b50cef78f32909485b00fc7cf7f2 ] + +Move the "l3_cache" node outside the "cpus" node in the base dtsi file for +Rockchip RK3588(S) SoCs. The A55 and A76 CPU cores in these SoCs belong to +the ARM DynamIQ IP core lineup, which places the L3 cache outside the CPUs +and into the DynamIQ Shared Unit (DSU). [1] Thus, moving the L3 cache DT +node one level higher in the DT improves the way the physical topology of +the RK3588(S) SoCs is represented in the SoC dtsi files. + +While there, add a comment that explains it briefly, to save curious readers +from the need to reference the repository log for a clarification. + +[1] ARM DynamIQ Shared Unit revision r4p0 TRM, version 0400-02 + +Fixes: c9211fa2602b ("arm64: dts: rockchip: Add base DT for rk3588 SoC") +Helped-by: Robin Murphy +Signed-off-by: Dragan Simic +Link: https://lore.kernel.org/r/84264d0713fb51ae2b9b731e28fc14681beea853.1727345965.git.dsimic@manjaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 20 +++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi +index ee99166ebd46f..f695c5d5f9144 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi +@@ -337,15 +337,19 @@ + cache-unified; + next-level-cache = <&l3_cache>; + }; ++ }; + +- l3_cache: l3-cache { +- compatible = "cache"; +- cache-size = <3145728>; +- cache-line-size = <64>; +- cache-sets = <4096>; +- cache-level = <3>; +- cache-unified; +- }; ++ /* ++ * The L3 cache belongs to the DynamIQ Shared Unit (DSU), ++ * so it's represented here, outside the "cpus" node ++ */ ++ l3_cache: l3-cache { ++ compatible = "cache"; ++ cache-size = <3145728>; ++ cache-line-size = <64>; ++ cache-sets = <4096>; ++ cache-level = <3>; ++ cache-unified; + }; + + display_subsystem: display-subsystem { +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch b/queue-6.11/arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch new file mode 100644 index 00000000000..3b376312a3b --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch @@ -0,0 +1,52 @@ +From b623b6493f1036f40cff45e690a8b7e035f0c8ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:32 +0200 +Subject: arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma + lion + +From: Heiko Stuebner + +[ Upstream commit 5ed96580568c4f79a0aff11a67f10b3e9229ba86 ] + +All Theobroma boards use a ti,amc6821 as fan controller. +It normally runs in an automatically controlled way and while it may be +possible to use it as part of a dt-based thermal management, this is +not yet specified in the binding, nor implemented in any kernel. + +Newer boards already don't contain that #cooling-cells property, but +older ones do. So remove them for now, they can be re-added if thermal +integration gets implemented in the future. + +There are two further occurences in v6.12-rc in px30-ringneck and +rk3399-puma, but those already get removed by the i2c-mux conversion +scheduled for 6.13 . As the undocumented property is in the kernel so +long, I opted for not causing extra merge conflicts between 6.12 and 6.13 + +Fixes: d99a02bcfa81 ("arm64: dts: rockchip: add RK3368-uQ7 (Lion) SoM") +Cc: Quentin Schulz +Cc: Klaus Goger +Reviewed-by: Quentin Schulz +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-7-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +index 8ac8acf4082df..ab3fda69a1fb7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +@@ -61,7 +61,6 @@ + fan: fan@18 { + compatible = "ti,amc6821"; + reg = <0x18>; +- #cooling-cells = <2>; + }; + + rtc_twi: rtc@6f { +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch b/queue-6.11/arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch new file mode 100644 index 00000000000..b79107ee8ac --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch @@ -0,0 +1,53 @@ +From c814cab44868505b174a2e004b3b003dbe4ceada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 13:15:37 +0200 +Subject: arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 + +From: Diederik de Haas + +[ Upstream commit de50a7e3681771c6b990238af82bf1dea9b11b21 ] + +The "synopsys,dw-hdmi.yaml" binding specifies that the interrupts +property of the hdmi node has 'maxItems: 1', so the hdmi node in +rk3328.dtsi having 2 is incorrect. + +Paragraph 1.3 ("System Interrupt connection") of the RK3328 TRM v1.1 +page 16 and 17 define the following hdmi related interrupts: +- 67 hdmi_intr +- 103 hdmi_intr_wakeup + +The difference of 32 is due to a different base used in the TRM. + +The RK3399 (which uses the same binding) has '23: hdmi_irq' and +'24: hdmi_wakeup_irq' according to its TRM (page 19). +The RK3568 (also same binding) has '76: hdmi_wakeup' and '77: hdmi' +according to page 17 of its TRM. +In both cases the non-wakeup IRQ was used, so use that too for rk3328. + +Helped-by: Heiko Stuebner +Fixes: 725e351c265a ("arm64: dts: rockchip: add rk3328 display nodes") +Signed-off-by: Diederik de Haas +Link: https://lore.kernel.org/r/20241008113344.23957-3-didi.debian@cknow.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index b01efd6d042c8..a60259ae8a532 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -754,8 +754,7 @@ + compatible = "rockchip,rk3328-dw-hdmi"; + reg = <0x0 0xff3c0000 0x0 0x20000>; + reg-io-width = <4>; +- interrupts = , +- ; ++ interrupts = ; + clocks = <&cru PCLK_HDMI>, + <&cru SCLK_HDMI_SFC>, + <&cru SCLK_RTC32K>; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-remove-num-slots-property-from-rk.patch b/queue-6.11/arm64-dts-rockchip-remove-num-slots-property-from-rk.patch new file mode 100644 index 00000000000..90d6b1656a9 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-remove-num-slots-property-from-rk.patch @@ -0,0 +1,41 @@ +From 01bfc5615f5d6193791f6d8367a0baa4fc30532a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:34 +0200 +Subject: arm64: dts: rockchip: remove num-slots property from + rk3328-nanopi-r2s-plus + +From: Heiko Stuebner + +[ Upstream commit b1f8d3b81d9289e171141a7120093ddefe7bd2f4 ] + +num-slots was not part of the dw-mmc binding and the last slipage of +one of them seeping in from the vendor kernel was removed way back in +2017. Somehow the nanopi-r2s-plus managed to smuggle another on in the +kernel, so remove that as well. + +Fixes: b8c028782922 ("arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus") +Cc: Sergey Bostandzhyan +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-9-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts +index 3093f607f282e..4b9ced67742d2 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts +@@ -24,7 +24,6 @@ + disable-wp; + mmc-hs200-1_8v; + non-removable; +- num-slots = <1>; + pinctrl-names = "default"; + pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_bus8>; + status = "okay"; +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-remove-orphaned-pinctrl-names-fro.patch b/queue-6.11/arm64-dts-rockchip-remove-orphaned-pinctrl-names-fro.patch new file mode 100644 index 00000000000..5f33e0ea3fe --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-remove-orphaned-pinctrl-names-fro.patch @@ -0,0 +1,54 @@ +From 6006d767e55b39b4eefe2449c22cc3d20ef53c3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:36 +0200 +Subject: arm64: dts: rockchip: remove orphaned pinctrl-names from pinephone + pro + +From: Heiko Stuebner + +[ Upstream commit 3577d5e2bc1ff78808cbe2f233ae1837ee2ce84c ] + +The patch adding display support for the pinephone pro introduced two +regulators that contain pinctrl-names props but no pinctrl-assignments. + +Looks like someone forgot the pinctrl settings, so remove the orphans +for now, until that changes. + +Fixes: 3e987e1f22b9 ("arm64: dts: rockchip: Add internal display support to rk3399-pinephone-pro") +Cc: Martijn Braam +Cc: Javier Martinez Canillas +Cc: Ondrej Jirman +Reviewed-by: Ondrej Jirman +Reviewed-by: Javier Martinez Canillas +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-11-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts +index ef754ea30a940..855e0ca92270b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts +@@ -167,7 +167,6 @@ + regulator-max-microvolt = <1800000>; + vin-supply = <&vcc3v3_sys>; + gpio = <&gpio3 RK_PA5 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; + }; + + /* MIPI DSI panel 2.8v supply */ +@@ -179,7 +178,6 @@ + regulator-max-microvolt = <2800000>; + vin-supply = <&vcc3v3_sys>; + gpio = <&gpio3 RK_PA1 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; + }; + + vibrator { +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-remove-undocumented-supports-emmc.patch b/queue-6.11/arm64-dts-rockchip-remove-undocumented-supports-emmc.patch new file mode 100644 index 00000000000..700e48fb5c3 --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-remove-undocumented-supports-emmc.patch @@ -0,0 +1,85 @@ +From 62101bb455e48a1818b4bf5476838770e1de2887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:31 +0200 +Subject: arm64: dts: rockchip: Remove undocumented supports-emmc property +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Heiko Stuebner + +[ Upstream commit 1b670212ee3dd9d14c6d39a042dfe4ae79b49b4e ] + +supports-emmc is an undocumented property that slipped into the mainline +kernel devicetree for some boards. Drop it. + +Fixes: c484cf93f61b ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard") +Cc: Quentin Schulz +Fixes: b8c028782922 ("arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus") +Cc: Sergey Bostandzhyan +Fixes: 8d94da58de53 ("arm64: dts: rockchip: Add EmbedFire LubanCat 1") +Cc: Wenhao Cui +Fixes: cdf46cdbabfc ("arm64: dts: rockchip: Add dts for EmbedFire rk3568 LubanCat 2") +Cc: Andy Yan +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-6-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 1 - + arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts | 1 - + arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts | 1 - + arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts | 1 - + 4 files changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi +index bb1aea82e666e..b7163ed74232d 100644 +--- a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi ++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi +@@ -66,7 +66,6 @@ + bus-width = <8>; + cap-mmc-highspeed; + mmc-hs200-1_8v; +- supports-emmc; + mmc-pwrseq = <&emmc_pwrseq>; + non-removable; + vmmc-supply = <&vcc_3v3>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts +index cb81ba3f23ffd..3093f607f282e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts +@@ -27,6 +27,5 @@ + num-slots = <1>; + pinctrl-names = "default"; + pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_bus8>; +- supports-emmc; + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts +index c1194d1e438d0..9a2f59a351dee 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts +@@ -507,7 +507,6 @@ + non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>; +- supports-emmc; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts b/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts +index a3112d5df2008..b505a4537ee8c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts +@@ -589,7 +589,6 @@ + non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>; +- supports-emmc; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.11/arm64-dts-rockchip-start-cooling-maps-numbering-from.patch b/queue-6.11/arm64-dts-rockchip-start-cooling-maps-numbering-from.patch new file mode 100644 index 00000000000..ffdff3cff7b --- /dev/null +++ b/queue-6.11/arm64-dts-rockchip-start-cooling-maps-numbering-from.patch @@ -0,0 +1,46 @@ +From 8ad6357dff7ae5447c5a0cdd35bb7501755d9c51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Sep 2024 23:39:05 +0200 +Subject: arm64: dts: rockchip: Start cooling maps numbering from zero on ROCK + 5B + +From: Dragan Simic + +[ Upstream commit 6be82067254cba14f7b9ca00613bdb7caac9501f ] + +The package cooling maps for the Radxa ROCK 5B were mistakenly named map1 +and map2. Their numbering should start from zero instead, because there are +no package cooling maps defined in the parent RK3588 SoC dtsi file, so let's +rename these cooling maps to map0 and map1. + +Fixes: 4a152231b050 ("arm64: dts: rockchip: enable automatic fan control on Rock 5B") +Signed-off-by: Dragan Simic +Link: https://lore.kernel.org/r/335ecd5841ab55f333e17bb391d0e1264fac257b.1726954592.git.dsimic@manjaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts +index 966bbc582d89b..6bd06e46a101d 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts +@@ -304,12 +304,12 @@ + }; + + cooling-maps { +- map1 { ++ map0 { + trip = <&package_fan0>; + cooling-device = <&fan THERMAL_NO_LIMIT 1>; + }; + +- map2 { ++ map1 { + trip = <&package_fan1>; + cooling-device = <&fan 2 THERMAL_NO_LIMIT>; + }; +-- +2.43.0 + diff --git a/queue-6.11/can-c_can-fix-rx-tx-_errors-statistics.patch b/queue-6.11/can-c_can-fix-rx-tx-_errors-statistics.patch new file mode 100644 index 00000000000..bc93b872f10 --- /dev/null +++ b/queue-6.11/can-c_can-fix-rx-tx-_errors-statistics.patch @@ -0,0 +1,71 @@ +From b19b9c1ed164d34b6b324c1094bfe31ebf92b164 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 15:53:13 +0200 +Subject: can: c_can: fix {rx,tx}_errors statistics + +From: Dario Binacchi + +[ Upstream commit 4d6d26537940f3b3e17138987ed9e4a334780bf7 ] + +The c_can_handle_bus_err() function was incorrectly incrementing only the +receive error counter, even in cases of bit or acknowledgment errors that +occur during transmission. The patch fixes the issue by incrementing the +appropriate counter based on the type of error. + +Fixes: 881ff67ad450 ("can: c_can: Added support for Bosch C_CAN controller") +Signed-off-by: Dario Binacchi +Link: https://patch.msgid.link/20241014135319.2009782-1-dario.binacchi@amarulasolutions.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can_main.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/c_can/c_can_main.c b/drivers/net/can/c_can/c_can_main.c +index c63f7fc1e6917..511615dc33419 100644 +--- a/drivers/net/can/c_can/c_can_main.c ++++ b/drivers/net/can/c_can/c_can_main.c +@@ -1011,7 +1011,6 @@ static int c_can_handle_bus_err(struct net_device *dev, + + /* common for all type of bus errors */ + priv->can.can_stats.bus_error++; +- stats->rx_errors++; + + /* propagate the error condition to the CAN stack */ + skb = alloc_can_err_skb(dev, &cf); +@@ -1027,26 +1026,32 @@ static int c_can_handle_bus_err(struct net_device *dev, + case LEC_STUFF_ERROR: + netdev_dbg(dev, "stuff error\n"); + cf->data[2] |= CAN_ERR_PROT_STUFF; ++ stats->rx_errors++; + break; + case LEC_FORM_ERROR: + netdev_dbg(dev, "form error\n"); + cf->data[2] |= CAN_ERR_PROT_FORM; ++ stats->rx_errors++; + break; + case LEC_ACK_ERROR: + netdev_dbg(dev, "ack error\n"); + cf->data[3] = CAN_ERR_PROT_LOC_ACK; ++ stats->tx_errors++; + break; + case LEC_BIT1_ERROR: + netdev_dbg(dev, "bit1 error\n"); + cf->data[2] |= CAN_ERR_PROT_BIT1; ++ stats->tx_errors++; + break; + case LEC_BIT0_ERROR: + netdev_dbg(dev, "bit0 error\n"); + cf->data[2] |= CAN_ERR_PROT_BIT0; ++ stats->tx_errors++; + break; + case LEC_CRC_ERROR: + netdev_dbg(dev, "CRC error\n"); + cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ; ++ stats->rx_errors++; + break; + default: + break; +-- +2.43.0 + diff --git a/queue-6.11/drivers-net-ionic-add-missed-debugfs-cleanup-to-ioni.patch b/queue-6.11/drivers-net-ionic-add-missed-debugfs-cleanup-to-ioni.patch new file mode 100644 index 00000000000..12f3f413a08 --- /dev/null +++ b/queue-6.11/drivers-net-ionic-add-missed-debugfs-cleanup-to-ioni.patch @@ -0,0 +1,43 @@ +From 263a6caa88c061fb338000856cbb85409ee8d3fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:17:56 +0800 +Subject: drivers: net: ionic: add missed debugfs cleanup to ionic_probe() + error path + +From: Wentao Liang + +[ Upstream commit 71712cf519faeed529549a79559c06c7fc250a15 ] + +The ionic_setup_one() creates a debugfs entry for ionic upon +successful execution. However, the ionic_probe() does not +release the dentry before returning, resulting in a memory +leak. + +To fix this bug, we add the ionic_debugfs_del_dev() to release +the resources in a timely manner before returning. + +Fixes: 0de38d9f1dba ("ionic: extract common bits from ionic_probe") +Signed-off-by: Wentao Liang +Acked-by: Shannon Nelson +Link: https://patch.msgid.link/20241107021756.1677-1-liangwentao@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c +index b93791d6b5933..f5dc876eb5009 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c +@@ -394,6 +394,7 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + err_out_pci: + ionic_dev_teardown(ionic); + ionic_clear_pci(ionic); ++ ionic_debugfs_del_dev(ionic); + err_out: + mutex_destroy(&ionic->dev_cmd_lock); + ionic_devlink_free(ionic); +-- +2.43.0 + diff --git a/queue-6.11/dt-bindings-net-xlnx-axi-ethernet-correct-phy-mode-p.patch b/queue-6.11/dt-bindings-net-xlnx-axi-ethernet-correct-phy-mode-p.patch new file mode 100644 index 00000000000..d52876cc47a --- /dev/null +++ b/queue-6.11/dt-bindings-net-xlnx-axi-ethernet-correct-phy-mode-p.patch @@ -0,0 +1,39 @@ +From 989e68d0d856577263ee0895750cc9b5045f7337 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2024 14:42:14 +0530 +Subject: dt-bindings: net: xlnx,axi-ethernet: Correct phy-mode property value + +From: Suraj Gupta + +[ Upstream commit b2183187c5fd30659b9caccb92f7e5e680301769 ] + +Correct phy-mode property value to 1000base-x. + +Fixes: cbb1ca6d5f9a ("dt-bindings: net: xlnx,axi-ethernet: convert bindings document to yaml") +Signed-off-by: Suraj Gupta +Reviewed-by: Radhey Shyam Pandey +Reviewed-by: Andrew Lunn +Acked-by: Rob Herring (Arm) +Link: https://patch.msgid.link/20241028091214.2078726-1-suraj.gupta2@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml b/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml +index e95c216282818..fb02e579463c9 100644 +--- a/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml ++++ b/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml +@@ -61,7 +61,7 @@ properties: + - gmii + - rgmii + - sgmii +- - 1000BaseX ++ - 1000base-x + + xlnx,phy-type: + description: +-- +2.43.0 + diff --git a/queue-6.11/e1000e-remove-meteor-lake-smbus-workarounds.patch b/queue-6.11/e1000e-remove-meteor-lake-smbus-workarounds.patch new file mode 100644 index 00000000000..b1d3ea50562 --- /dev/null +++ b/queue-6.11/e1000e-remove-meteor-lake-smbus-workarounds.patch @@ -0,0 +1,69 @@ +From d3c2901076efdc835d77528d6f0a5c5e385f2ca0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 20:08:48 +0300 +Subject: e1000e: Remove Meteor Lake SMBUS workarounds + +From: Vitaly Lifshits + +[ Upstream commit b8473723272e346e22aa487b9046fd324b73a0a5 ] + +This is a partial revert to commit 76a0a3f9cc2f ("e1000e: fix force smbus +during suspend flow"). That commit fixed a sporadic PHY access issue but +introduced a regression in runtime suspend flows. +The original issue on Meteor Lake systems was rare in terms of the +reproduction rate and the number of the systems affected. + +After the integration of commit 0a6ad4d9e169 ("e1000e: avoid failing the +system during pm_suspend"), PHY access loss can no longer cause a +system-level suspend failure. As it only occurs when the LAN cable is +disconnected, and is recovered during system resume flow. Therefore, its +functional impact is low, and the priority is given to stabilizing +runtime suspend. + +Fixes: 76a0a3f9cc2f ("e1000e: fix force smbus during suspend flow") +Signed-off-by: Vitaly Lifshits +Tested-by: Avigail Dahan +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/ich8lan.c | 17 ++++------------- + 1 file changed, 4 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index ce227b56cf724..2f9655cf5dd9e 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1205,12 +1205,10 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000_hw *hw, bool to_sx) + if (ret_val) + goto out; + +- if (hw->mac.type != e1000_pch_mtp) { +- ret_val = e1000e_force_smbus(hw); +- if (ret_val) { +- e_dbg("Failed to force SMBUS: %d\n", ret_val); +- goto release; +- } ++ ret_val = e1000e_force_smbus(hw); ++ if (ret_val) { ++ e_dbg("Failed to force SMBUS: %d\n", ret_val); ++ goto release; + } + + /* Si workaround for ULP entry flow on i127/rev6 h/w. Enable +@@ -1273,13 +1271,6 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000_hw *hw, bool to_sx) + } + + release: +- if (hw->mac.type == e1000_pch_mtp) { +- ret_val = e1000e_force_smbus(hw); +- if (ret_val) +- e_dbg("Failed to force SMBUS over MTL system: %d\n", +- ret_val); +- } +- + hw->phy.ops.release(hw); + out: + if (ret_val) +-- +2.43.0 + diff --git a/queue-6.11/edac-qcom-make-irq-configuration-optional.patch b/queue-6.11/edac-qcom-make-irq-configuration-optional.patch new file mode 100644 index 00000000000..215b1b287ab --- /dev/null +++ b/queue-6.11/edac-qcom-make-irq-configuration-optional.patch @@ -0,0 +1,103 @@ +From d48f26d5fd6054a1ce14bef322907624600ab1de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2024 15:45:10 +0530 +Subject: EDAC/qcom: Make irq configuration optional + +From: Rajendra Nayak + +[ Upstream commit 0a97195d2181caced187acd7454464b8e37021d7 ] + +On most modern qualcomm SoCs, the configuration necessary to enable the +Tag/Data RAM related irqs being propagated to the SoC irq controller is +already done in firmware (in DSF or 'DDR System Firmware') + +On some like the x1e80100, these registers aren't even accesible to the +kernel causing a crash when edac device is probed. + +Hence, make the irq configuration optional in the driver and mark x1e80100 +as the SoC on which this should be avoided. + +Fixes: af16b00578a7 ("arm64: dts: qcom: Add base X1E80100 dtsi and the QCP dts") +Reported-by: Bjorn Andersson +Signed-off-by: Rajendra Nayak +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20240903101510.3452734-1-quic_rjendra@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/edac/qcom_edac.c | 8 +++++--- + drivers/soc/qcom/llcc-qcom.c | 3 +++ + include/linux/soc/qcom/llcc-qcom.h | 2 ++ + 3 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/edac/qcom_edac.c b/drivers/edac/qcom_edac.c +index d3cd4cc54ace9..a9a8ba067007a 100644 +--- a/drivers/edac/qcom_edac.c ++++ b/drivers/edac/qcom_edac.c +@@ -342,9 +342,11 @@ static int qcom_llcc_edac_probe(struct platform_device *pdev) + int ecc_irq; + int rc; + +- rc = qcom_llcc_core_setup(llcc_driv_data, llcc_driv_data->bcast_regmap); +- if (rc) +- return rc; ++ if (!llcc_driv_data->ecc_irq_configured) { ++ rc = qcom_llcc_core_setup(llcc_driv_data, llcc_driv_data->bcast_regmap); ++ if (rc) ++ return rc; ++ } + + /* Allocate edac control info */ + edev_ctl = edac_device_alloc_ctl_info(0, "qcom-llcc", 1, "bank", +diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c +index 37e11e5017285..9ff3b42cb1955 100644 +--- a/drivers/soc/qcom/llcc-qcom.c ++++ b/drivers/soc/qcom/llcc-qcom.c +@@ -139,6 +139,7 @@ struct qcom_llcc_config { + int size; + bool need_llcc_cfg; + bool no_edac; ++ bool irq_configured; + }; + + struct qcom_sct_config { +@@ -720,6 +721,7 @@ static const struct qcom_llcc_config x1e80100_cfg[] = { + .need_llcc_cfg = true, + .reg_offset = llcc_v2_1_reg_offset, + .edac_reg_offset = &llcc_v2_1_edac_reg_offset, ++ .irq_configured = true, + }, + }; + +@@ -1347,6 +1349,7 @@ static int qcom_llcc_probe(struct platform_device *pdev) + drv_data->cfg = llcc_cfg; + drv_data->cfg_size = sz; + drv_data->edac_reg_offset = cfg->edac_reg_offset; ++ drv_data->ecc_irq_configured = cfg->irq_configured; + mutex_init(&drv_data->lock); + platform_set_drvdata(pdev, drv_data); + +diff --git a/include/linux/soc/qcom/llcc-qcom.h b/include/linux/soc/qcom/llcc-qcom.h +index 9e9f528b13701..2f20281d4ad43 100644 +--- a/include/linux/soc/qcom/llcc-qcom.h ++++ b/include/linux/soc/qcom/llcc-qcom.h +@@ -125,6 +125,7 @@ struct llcc_edac_reg_offset { + * @num_banks: Number of llcc banks + * @bitmap: Bit map to track the active slice ids + * @ecc_irq: interrupt for llcc cache error detection and reporting ++ * @ecc_irq_configured: 'True' if firmware has already configured the irq propagation + * @version: Indicates the LLCC version + */ + struct llcc_drv_data { +@@ -139,6 +140,7 @@ struct llcc_drv_data { + u32 num_banks; + unsigned long *bitmap; + int ecc_irq; ++ bool ecc_irq_configured; + u32 version; + }; + +-- +2.43.0 + diff --git a/queue-6.11/firmware-arm_scmi-fix-slab-use-after-free-in-scmi_bu.patch b/queue-6.11/firmware-arm_scmi-fix-slab-use-after-free-in-scmi_bu.patch new file mode 100644 index 00000000000..bb578a2826a --- /dev/null +++ b/queue-6.11/firmware-arm_scmi-fix-slab-use-after-free-in-scmi_bu.patch @@ -0,0 +1,155 @@ +From 8a7d622fcbadb25636872794ededf7ea4c3fc98d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 14:13:38 +0800 +Subject: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() + +From: Xinqi Zhang + +[ Upstream commit 295416091e44806760ccf753aeafdafc0ae268f3 ] + +The scmi_dev->name is released prematurely in __scmi_device_destroy(), +which causes slab-use-after-free when accessing scmi_dev->name in +scmi_bus_notifier(). So move the release of scmi_dev->name to +scmi_device_release() to avoid slab-use-after-free. + + | BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec + | Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1 + | + | CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1 + | Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT) + | Call trace: + | dump_backtrace+0x94/0x114 + | show_stack+0x18/0x24 + | dump_stack_lvl+0x48/0x60 + | print_report+0xf4/0x5b0 + | kasan_report+0xa4/0xec + | __asan_report_load1_noabort+0x20/0x2c + | strncmp+0xe4/0xec + | scmi_bus_notifier+0x5c/0x54c + | notifier_call_chain+0xb4/0x31c + | blocking_notifier_call_chain+0x68/0x9c + | bus_notify+0x54/0x78 + | device_del+0x1bc/0x840 + | device_unregister+0x20/0xb4 + | __scmi_device_destroy+0xac/0x280 + | scmi_device_destroy+0x94/0xd0 + | scmi_chan_setup+0x524/0x750 + | scmi_probe+0x7fc/0x1508 + | platform_probe+0xc4/0x19c + | really_probe+0x32c/0x99c + | __driver_probe_device+0x15c/0x3c4 + | driver_probe_device+0x5c/0x170 + | __driver_attach+0x1c8/0x440 + | bus_for_each_dev+0xf4/0x178 + | driver_attach+0x3c/0x58 + | bus_add_driver+0x234/0x4d4 + | driver_register+0xf4/0x3c0 + | __platform_driver_register+0x60/0x88 + | scmi_driver_init+0xb0/0x104 + | do_one_initcall+0xb4/0x664 + | kernel_init_freeable+0x3c8/0x894 + | kernel_init+0x24/0x1e8 + | ret_from_fork+0x10/0x20 + | + | Allocated by task 1: + | kasan_save_stack+0x2c/0x54 + | kasan_set_track+0x2c/0x40 + | kasan_save_alloc_info+0x24/0x34 + | __kasan_kmalloc+0xa0/0xb8 + | __kmalloc_node_track_caller+0x6c/0x104 + | kstrdup+0x48/0x84 + | kstrdup_const+0x34/0x40 + | __scmi_device_create.part.0+0x8c/0x408 + | scmi_device_create+0x104/0x370 + | scmi_chan_setup+0x2a0/0x750 + | scmi_probe+0x7fc/0x1508 + | platform_probe+0xc4/0x19c + | really_probe+0x32c/0x99c + | __driver_probe_device+0x15c/0x3c4 + | driver_probe_device+0x5c/0x170 + | __driver_attach+0x1c8/0x440 + | bus_for_each_dev+0xf4/0x178 + | driver_attach+0x3c/0x58 + | bus_add_driver+0x234/0x4d4 + | driver_register+0xf4/0x3c0 + | __platform_driver_register+0x60/0x88 + | scmi_driver_init+0xb0/0x104 + | do_one_initcall+0xb4/0x664 + | kernel_init_freeable+0x3c8/0x894 + | kernel_init+0x24/0x1e8 + | ret_from_fork+0x10/0x20 + | + | Freed by task 1: + | kasan_save_stack+0x2c/0x54 + | kasan_set_track+0x2c/0x40 + | kasan_save_free_info+0x38/0x5c + | __kasan_slab_free+0xe8/0x164 + | __kmem_cache_free+0x11c/0x230 + | kfree+0x70/0x130 + | kfree_const+0x20/0x40 + | __scmi_device_destroy+0x70/0x280 + | scmi_device_destroy+0x94/0xd0 + | scmi_chan_setup+0x524/0x750 + | scmi_probe+0x7fc/0x1508 + | platform_probe+0xc4/0x19c + | really_probe+0x32c/0x99c + | __driver_probe_device+0x15c/0x3c4 + | driver_probe_device+0x5c/0x170 + | __driver_attach+0x1c8/0x440 + | bus_for_each_dev+0xf4/0x178 + | driver_attach+0x3c/0x58 + | bus_add_driver+0x234/0x4d4 + | driver_register+0xf4/0x3c0 + | __platform_driver_register+0x60/0x88 + | scmi_driver_init+0xb0/0x104 + | do_one_initcall+0xb4/0x664 + | kernel_init_freeable+0x3c8/0x894 + | kernel_init+0x24/0x1e8 + | ret_from_fork+0x10/0x20 + +Fixes: ee7a9c9f67c5 ("firmware: arm_scmi: Add support for multiple device per protocol") +Signed-off-by: Xinqi Zhang +Reviewed-by: Cristian Marussi +Reviewed-by: Bjorn Andersson +Message-Id: <20241016-fix-arm-scmi-slab-use-after-free-v2-1-1783685ef90d@quicinc.com> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/bus.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c +index 96b2e5f9a8ef0..157172a5f2b57 100644 +--- a/drivers/firmware/arm_scmi/bus.c ++++ b/drivers/firmware/arm_scmi/bus.c +@@ -325,7 +325,10 @@ EXPORT_SYMBOL_GPL(scmi_driver_unregister); + + static void scmi_device_release(struct device *dev) + { +- kfree(to_scmi_dev(dev)); ++ struct scmi_device *scmi_dev = to_scmi_dev(dev); ++ ++ kfree_const(scmi_dev->name); ++ kfree(scmi_dev); + } + + static void __scmi_device_destroy(struct scmi_device *scmi_dev) +@@ -338,7 +341,6 @@ static void __scmi_device_destroy(struct scmi_device *scmi_dev) + if (scmi_dev->protocol_id == SCMI_PROTOCOL_SYSTEM) + atomic_set(&scmi_syspower_registered, 0); + +- kfree_const(scmi_dev->name); + ida_free(&scmi_bus_id, scmi_dev->id); + device_unregister(&scmi_dev->dev); + } +@@ -410,7 +412,6 @@ __scmi_device_create(struct device_node *np, struct device *parent, + + return scmi_dev; + put_dev: +- kfree_const(scmi_dev->name); + put_device(&scmi_dev->dev); + ida_free(&scmi_bus_id, id); + return NULL; +-- +2.43.0 + diff --git a/queue-6.11/firmware-qcom-scm-fix-a-null-pointer-dereference.patch b/queue-6.11/firmware-qcom-scm-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..b419817757a --- /dev/null +++ b/queue-6.11/firmware-qcom-scm-fix-a-null-pointer-dereference.patch @@ -0,0 +1,45 @@ +From d5f6f3e71fc3ad0d245e7160fe117acf69480f88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2024 10:33:28 +0200 +Subject: firmware: qcom: scm: fix a NULL-pointer dereference + +From: Bartosz Golaszewski + +[ Upstream commit ca61d6836e6f4442a77762e1074d2706a2a6e578 ] + +Some SCM calls can be invoked with __scm being NULL (the driver may not +have been and will not be probed as there's no SCM entry in device-tree). +Make sure we don't dereference a NULL pointer. + +Fixes: 449d0d84bcd8 ("firmware: qcom: scm: smc: switch to using the SCM allocator") +Reported-by: Rudraksha Gupta +Closes: https://lore.kernel.org/lkml/692cfe9a-8c05-4ce4-813e-82b3f310019a@gmail.com/ +Reviewed-by: Konrad Dybcio +Tested-by: Rudraksha Gupta +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Stephan Gerhold +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Kuldeep Singh +Link: https://lore.kernel.org/r/20240930083328.17904-1-brgl@bgdev.pl +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom/qcom_scm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c +index 0f5ac346bda43..a50d8e8d0f1b8 100644 +--- a/drivers/firmware/qcom/qcom_scm.c ++++ b/drivers/firmware/qcom/qcom_scm.c +@@ -207,7 +207,7 @@ static DEFINE_SPINLOCK(scm_query_lock); + + struct qcom_tzmem_pool *qcom_scm_get_tzmem_pool(void) + { +- return __scm->mempool; ++ return __scm ? __scm->mempool : NULL; + } + + static enum qcom_scm_convention __get_convention(void) +-- +2.43.0 + diff --git a/queue-6.11/firmware-qcom-scm-return-eopnotsupp-for-unsupported-.patch b/queue-6.11/firmware-qcom-scm-return-eopnotsupp-for-unsupported-.patch new file mode 100644 index 00000000000..78eb5ee4411 --- /dev/null +++ b/queue-6.11/firmware-qcom-scm-return-eopnotsupp-for-unsupported-.patch @@ -0,0 +1,77 @@ +From 25da4f84535c6698a22603b6e7d1445cd7699475 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 00:51:48 +0530 +Subject: firmware: qcom: scm: Return -EOPNOTSUPP for unsupported SHM bridge + enabling + +From: Qingqing Zhou + +[ Upstream commit f489f6c6eb26482010470d77bad3901a3de1b166 ] + +When enabling SHM bridge, QTEE returns 0 and sets error 4 in result to +qcom_scm for unsupported platforms. Currently, tzmem interprets this as +an unknown error rather than recognizing it as an unsupported platform. + +Error log: +[ 0.177224] qcom_scm firmware:scm: error (____ptrval____): Failed to enable the TrustZone memory allocator +[ 0.177244] qcom_scm firmware:scm: probe with driver qcom_scm failed with error 4 + +To address this, modify the function call qcom_scm_shm_bridge_enable() +to remap result to indicate an unsupported error. This way, tzmem will +correctly identify it as an unsupported platform case instead of +reporting it as an error. + +Fixes: 178e19c0df1b ("firmware: qcom: scm: add support for SHM bridge operations") +Signed-off-by: Qingqing Zhou +Co-developed-by: Kuldeep Singh +Signed-off-by: Kuldeep Singh +Reviewed-by: Bartosz Golaszewski +Reviewed-by: Mukesh Ojha +Link: https://lore.kernel.org/r/20241022192148.1626633-1-quic_kuldsing@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom/qcom_scm.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c +index a50d8e8d0f1b8..6436bd09587a5 100644 +--- a/drivers/firmware/qcom/qcom_scm.c ++++ b/drivers/firmware/qcom/qcom_scm.c +@@ -112,6 +112,7 @@ enum qcom_scm_qseecom_tz_cmd_info { + }; + + #define QSEECOM_MAX_APP_NAME_SIZE 64 ++#define SHMBRIDGE_RESULT_NOTSUPP 4 + + /* Each bit configures cold/warm boot address for one of the 4 CPUs */ + static const u8 qcom_scm_cpu_cold_bits[QCOM_SCM_BOOT_MAX_CPUS] = { +@@ -1353,6 +1354,8 @@ EXPORT_SYMBOL_GPL(qcom_scm_lmh_dcvsh_available); + + int qcom_scm_shm_bridge_enable(void) + { ++ int ret; ++ + struct qcom_scm_desc desc = { + .svc = QCOM_SCM_SVC_MP, + .cmd = QCOM_SCM_MP_SHM_BRIDGE_ENABLE, +@@ -1365,7 +1368,15 @@ int qcom_scm_shm_bridge_enable(void) + QCOM_SCM_MP_SHM_BRIDGE_ENABLE)) + return -EOPNOTSUPP; + +- return qcom_scm_call(__scm->dev, &desc, &res) ?: res.result[0]; ++ ret = qcom_scm_call(__scm->dev, &desc, &res); ++ ++ if (ret) ++ return ret; ++ ++ if (res.result[0] == SHMBRIDGE_RESULT_NOTSUPP) ++ return -EOPNOTSUPP; ++ ++ return res.result[0]; + } + EXPORT_SYMBOL_GPL(qcom_scm_shm_bridge_enable); + +-- +2.43.0 + diff --git a/queue-6.11/hid-core-zero-initialize-the-report-buffer.patch b/queue-6.11/hid-core-zero-initialize-the-report-buffer.patch new file mode 100644 index 00000000000..cbfbc7c73b7 --- /dev/null +++ b/queue-6.11/hid-core-zero-initialize-the-report-buffer.patch @@ -0,0 +1,41 @@ +From 320a33954a13a7447c9efb23b06ee4f606939d8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 15:44:35 +0100 +Subject: HID: core: zero-initialize the report buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Kosina + +[ Upstream commit 177f25d1292c7e16e1199b39c85480f7f8815552 ] + +Since the report buffer is used by all kinds of drivers in various ways, let's +zero-initialize it during allocation to make sure that it can't be ever used +to leak kernel memory via specially-crafted report. + +Fixes: 27ce405039bf ("HID: fix data access in implement()") +Reported-by: Benoît Sevens +Acked-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 988d0acbdf04d..3fcf098f4f569 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1875,7 +1875,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags) + + u32 len = hid_report_len(report) + 7; + +- return kmalloc(len, flags); ++ return kzalloc(len, flags); + } + EXPORT_SYMBOL_GPL(hid_alloc_report_buf); + +-- +2.43.0 + diff --git a/queue-6.11/i40e-fix-race-condition-by-adding-filter-s-intermedi.patch b/queue-6.11/i40e-fix-race-condition-by-adding-filter-s-intermedi.patch new file mode 100644 index 00000000000..7d41bcb00a3 --- /dev/null +++ b/queue-6.11/i40e-fix-race-condition-by-adding-filter-s-intermedi.patch @@ -0,0 +1,134 @@ +From 45c35ec0ac5328b14a214c8e707fa5b6247e5b00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 11:30:11 +0200 +Subject: i40e: fix race condition by adding filter's intermediate sync state + +From: Aleksandr Loktionov + +[ Upstream commit f30490e9695ef7da3d0899c6a0293cc7cd373567 ] + +Fix a race condition in the i40e driver that leads to MAC/VLAN filters +becoming corrupted and leaking. Address the issue that occurs under +heavy load when multiple threads are concurrently modifying MAC/VLAN +filters by setting mac and port VLAN. + +1. Thread T0 allocates a filter in i40e_add_filter() within + i40e_ndo_set_vf_port_vlan(). +2. Thread T1 concurrently frees the filter in __i40e_del_filter() within + i40e_ndo_set_vf_mac(). +3. Subsequently, i40e_service_task() calls i40e_sync_vsi_filters(), which + refers to the already freed filter memory, causing corruption. + +Reproduction steps: +1. Spawn multiple VFs. +2. Apply a concurrent heavy load by running parallel operations to change + MAC addresses on the VFs and change port VLANs on the host. +3. Observe errors in dmesg: +"Error I40E_AQ_RC_ENOSPC adding RX filters on VF XX, + please set promiscuous on manually for VF XX". + +Exact code for stable reproduction Intel can't open-source now. + +The fix involves implementing a new intermediate filter state, +I40E_FILTER_NEW_SYNC, for the time when a filter is on a tmp_add_list. +These filters cannot be deleted from the hash list directly but +must be removed using the full process. + +Fixes: 278e7d0b9d68 ("i40e: store MAC/VLAN filters in a hash with the MAC Address as key") +Signed-off-by: Aleksandr Loktionov +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Reviewed-by: Michal Schmidt +Tested-by: Michal Schmidt +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 1 + + drivers/net/ethernet/intel/i40e/i40e_main.c | 12 ++++++++++-- + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index d546567e0286e..b292f656d18b0 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -754,6 +754,7 @@ enum i40e_filter_state { + I40E_FILTER_ACTIVE, /* Added to switch by FW */ + I40E_FILTER_FAILED, /* Rejected by FW */ + I40E_FILTER_REMOVE, /* To be removed */ ++ I40E_FILTER_NEW_SYNC, /* New, not sent yet, is in i40e_sync_vsi_filters() */ + /* There is no 'removed' state; the filter struct is freed */ + }; + struct i40e_mac_filter { +diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +index abf624d770e67..208c2f0857b61 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +@@ -89,6 +89,7 @@ static char *i40e_filter_state_string[] = { + "ACTIVE", + "FAILED", + "REMOVE", ++ "NEW_SYNC", + }; + + /** +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index f7d4b5f79422b..02c2a04740cd7 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1255,6 +1255,7 @@ int i40e_count_filters(struct i40e_vsi *vsi) + + hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) { + if (f->state == I40E_FILTER_NEW || ++ f->state == I40E_FILTER_NEW_SYNC || + f->state == I40E_FILTER_ACTIVE) + ++cnt; + } +@@ -1441,6 +1442,8 @@ static int i40e_correct_mac_vlan_filters(struct i40e_vsi *vsi, + + new->f = add_head; + new->state = add_head->state; ++ if (add_head->state == I40E_FILTER_NEW) ++ add_head->state = I40E_FILTER_NEW_SYNC; + + /* Add the new filter to the tmp list */ + hlist_add_head(&new->hlist, tmp_add_list); +@@ -1550,6 +1553,8 @@ static int i40e_correct_vf_mac_vlan_filters(struct i40e_vsi *vsi, + return -ENOMEM; + new_mac->f = add_head; + new_mac->state = add_head->state; ++ if (add_head->state == I40E_FILTER_NEW) ++ add_head->state = I40E_FILTER_NEW_SYNC; + + /* Add the new filter to the tmp list */ + hlist_add_head(&new_mac->hlist, tmp_add_list); +@@ -2437,7 +2442,8 @@ static int + i40e_aqc_broadcast_filter(struct i40e_vsi *vsi, const char *vsi_name, + struct i40e_mac_filter *f) + { +- bool enable = f->state == I40E_FILTER_NEW; ++ bool enable = f->state == I40E_FILTER_NEW || ++ f->state == I40E_FILTER_NEW_SYNC; + struct i40e_hw *hw = &vsi->back->hw; + int aq_ret; + +@@ -2611,6 +2617,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) + + /* Add it to the hash list */ + hlist_add_head(&new->hlist, &tmp_add_list); ++ f->state = I40E_FILTER_NEW_SYNC; + } + + /* Count the number of active (current and new) VLAN +@@ -2762,7 +2769,8 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) + spin_lock_bh(&vsi->mac_filter_hash_lock); + hlist_for_each_entry_safe(new, h, &tmp_add_list, hlist) { + /* Only update the state if we're still NEW */ +- if (new->f->state == I40E_FILTER_NEW) ++ if (new->f->state == I40E_FILTER_NEW || ++ new->f->state == I40E_FILTER_NEW_SYNC) + new->f->state = new->state; + hlist_del(&new->hlist); + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); +-- +2.43.0 + diff --git a/queue-6.11/ice-change-q_index-variable-type-to-s16-to-store-1-v.patch b/queue-6.11/ice-change-q_index-variable-type-to-s16-to-store-1-v.patch new file mode 100644 index 00000000000..355f0766805 --- /dev/null +++ b/queue-6.11/ice-change-q_index-variable-type-to-s16-to-store-1-v.patch @@ -0,0 +1,89 @@ +From 1f97b9878162de2aa4ebe6e75106cdcff7d8a0b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2024 12:59:22 -0400 +Subject: ice: change q_index variable type to s16 to store -1 value + +From: Mateusz Polchlopek + +[ Upstream commit 64502dac974a5d9951d16015fa2e16a14e5f2bb2 ] + +Fix Flow Director not allowing to re-map traffic to 0th queue when action +is configured to drop (and vice versa). + +The current implementation of ethtool callback in the ice driver forbids +change Flow Director action from 0 to -1 and from -1 to 0 with an error, +e.g: + + # ethtool -U eth2 flow-type tcp4 src-ip 1.1.1.1 loc 1 action 0 + # ethtool -U eth2 flow-type tcp4 src-ip 1.1.1.1 loc 1 action -1 + rmgr: Cannot insert RX class rule: Invalid argument + +We set the value of `u16 q_index = 0` at the beginning of the function +ice_set_fdir_input_set(). In case of "drop traffic" action (which is +equal to -1 in ethtool) we store the 0 value. Later, when want to change +traffic rule to redirect to queue with index 0 it returns an error +caused by duplicate found. + +Fix this behaviour by change of the type of field `q_index` from u16 to s16 +in `struct ice_fdir_fltr`. This allows to store -1 in the field in case +of "drop traffic" action. What is more, change the variable type in the +function ice_set_fdir_input_set() and assign at the beginning the new +`#define ICE_FDIR_NO_QUEUE_IDX` which is -1. Later, if the action is set +to another value (point specific queue index) the variable value is +overwritten in the function. + +Fixes: cac2a27cd9ab ("ice: Support IPv4 Flow Director filters") +Reviewed-by: Przemek Kitszel +Signed-off-by: Mateusz Polchlopek +Reviewed-by: Simon Horman +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 3 ++- + drivers/net/ethernet/intel/ice/ice_fdir.h | 4 +++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c +index 5412eff8ef233..ee9862ddfe15e 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c +@@ -1830,11 +1830,12 @@ static int + ice_set_fdir_input_set(struct ice_vsi *vsi, struct ethtool_rx_flow_spec *fsp, + struct ice_fdir_fltr *input) + { +- u16 dest_vsi, q_index = 0; ++ s16 q_index = ICE_FDIR_NO_QUEUE_IDX; + u16 orig_q_index = 0; + struct ice_pf *pf; + struct ice_hw *hw; + int flow_type; ++ u16 dest_vsi; + u8 dest_ctl; + + if (!vsi || !fsp || !input) +diff --git a/drivers/net/ethernet/intel/ice/ice_fdir.h b/drivers/net/ethernet/intel/ice/ice_fdir.h +index ab5b118daa2da..820023c0271fd 100644 +--- a/drivers/net/ethernet/intel/ice/ice_fdir.h ++++ b/drivers/net/ethernet/intel/ice/ice_fdir.h +@@ -53,6 +53,8 @@ + */ + #define ICE_FDIR_IPV4_PKT_FLAG_MF 0x20 + ++#define ICE_FDIR_NO_QUEUE_IDX -1 ++ + enum ice_fltr_prgm_desc_dest { + ICE_FLTR_PRGM_DESC_DEST_DROP_PKT, + ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX, +@@ -186,7 +188,7 @@ struct ice_fdir_fltr { + u16 flex_fltr; + + /* filter control */ +- u16 q_index; ++ s16 q_index; + u16 orig_q_index; + u16 dest_vsi; + u8 dest_ctl; +-- +2.43.0 + diff --git a/queue-6.11/net-arc-fix-the-device-for-dma_map_single-dma_unmap_.patch b/queue-6.11/net-arc-fix-the-device-for-dma_map_single-dma_unmap_.patch new file mode 100644 index 00000000000..f4962f756f1 --- /dev/null +++ b/queue-6.11/net-arc-fix-the-device-for-dma_map_single-dma_unmap_.patch @@ -0,0 +1,154 @@ +From d083be914d7a6edcb0538aad6e2882eeaa79b19f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 21:01:38 +0800 +Subject: net: arc: fix the device for dma_map_single/dma_unmap_single + +From: Johan Jonker + +[ Upstream commit 71803c1dfa29e0d13b99e48fda11107cc8caebc7 ] + +The ndev->dev and pdev->dev aren't the same device, use ndev->dev.parent +which has dma_mask, ndev->dev.parent is just pdev->dev. +Or it would cause the following issue: + +[ 39.933526] ------------[ cut here ]------------ +[ 39.938414] WARNING: CPU: 1 PID: 501 at kernel/dma/mapping.c:149 dma_map_page_attrs+0x90/0x1f8 + +Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference") +Signed-off-by: David Wu +Signed-off-by: Johan Jonker +Signed-off-by: Andy Yan +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/arc/emac_main.c | 27 ++++++++++++++++----------- + 1 file changed, 16 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c +index 31ee477dd131e..8283aeee35fb6 100644 +--- a/drivers/net/ethernet/arc/emac_main.c ++++ b/drivers/net/ethernet/arc/emac_main.c +@@ -111,6 +111,7 @@ static void arc_emac_tx_clean(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); + struct net_device_stats *stats = &ndev->stats; ++ struct device *dev = ndev->dev.parent; + unsigned int i; + + for (i = 0; i < TX_BD_NUM; i++) { +@@ -140,7 +141,7 @@ static void arc_emac_tx_clean(struct net_device *ndev) + stats->tx_bytes += skb->len; + } + +- dma_unmap_single(&ndev->dev, dma_unmap_addr(tx_buff, addr), ++ dma_unmap_single(dev, dma_unmap_addr(tx_buff, addr), + dma_unmap_len(tx_buff, len), DMA_TO_DEVICE); + + /* return the sk_buff to system */ +@@ -174,6 +175,7 @@ static void arc_emac_tx_clean(struct net_device *ndev) + static int arc_emac_rx(struct net_device *ndev, int budget) + { + struct arc_emac_priv *priv = netdev_priv(ndev); ++ struct device *dev = ndev->dev.parent; + unsigned int work_done; + + for (work_done = 0; work_done < budget; work_done++) { +@@ -223,9 +225,9 @@ static int arc_emac_rx(struct net_device *ndev, int budget) + continue; + } + +- addr = dma_map_single(&ndev->dev, (void *)skb->data, ++ addr = dma_map_single(dev, (void *)skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, addr)) { ++ if (dma_mapping_error(dev, addr)) { + if (net_ratelimit()) + netdev_err(ndev, "cannot map dma buffer\n"); + dev_kfree_skb(skb); +@@ -237,7 +239,7 @@ static int arc_emac_rx(struct net_device *ndev, int budget) + } + + /* unmap previosly mapped skb */ +- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), ++ dma_unmap_single(dev, dma_unmap_addr(rx_buff, addr), + dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); + + pktlen = info & LEN_MASK; +@@ -423,6 +425,7 @@ static int arc_emac_open(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); + struct phy_device *phy_dev = ndev->phydev; ++ struct device *dev = ndev->dev.parent; + int i; + + phy_dev->autoneg = AUTONEG_ENABLE; +@@ -445,9 +448,9 @@ static int arc_emac_open(struct net_device *ndev) + if (unlikely(!rx_buff->skb)) + return -ENOMEM; + +- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data, ++ addr = dma_map_single(dev, (void *)rx_buff->skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, addr)) { ++ if (dma_mapping_error(dev, addr)) { + netdev_err(ndev, "cannot dma map\n"); + dev_kfree_skb(rx_buff->skb); + return -ENOMEM; +@@ -548,6 +551,7 @@ static void arc_emac_set_rx_mode(struct net_device *ndev) + static void arc_free_tx_queue(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); ++ struct device *dev = ndev->dev.parent; + unsigned int i; + + for (i = 0; i < TX_BD_NUM; i++) { +@@ -555,7 +559,7 @@ static void arc_free_tx_queue(struct net_device *ndev) + struct buffer_state *tx_buff = &priv->tx_buff[i]; + + if (tx_buff->skb) { +- dma_unmap_single(&ndev->dev, ++ dma_unmap_single(dev, + dma_unmap_addr(tx_buff, addr), + dma_unmap_len(tx_buff, len), + DMA_TO_DEVICE); +@@ -579,6 +583,7 @@ static void arc_free_tx_queue(struct net_device *ndev) + static void arc_free_rx_queue(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); ++ struct device *dev = ndev->dev.parent; + unsigned int i; + + for (i = 0; i < RX_BD_NUM; i++) { +@@ -586,7 +591,7 @@ static void arc_free_rx_queue(struct net_device *ndev) + struct buffer_state *rx_buff = &priv->rx_buff[i]; + + if (rx_buff->skb) { +- dma_unmap_single(&ndev->dev, ++ dma_unmap_single(dev, + dma_unmap_addr(rx_buff, addr), + dma_unmap_len(rx_buff, len), + DMA_FROM_DEVICE); +@@ -679,6 +684,7 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev) + unsigned int len, *txbd_curr = &priv->txbd_curr; + struct net_device_stats *stats = &ndev->stats; + __le32 *info = &priv->txbd[*txbd_curr].info; ++ struct device *dev = ndev->dev.parent; + dma_addr_t addr; + + if (skb_padto(skb, ETH_ZLEN)) +@@ -692,10 +698,9 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev) + return NETDEV_TX_BUSY; + } + +- addr = dma_map_single(&ndev->dev, (void *)skb->data, len, +- DMA_TO_DEVICE); ++ addr = dma_map_single(dev, (void *)skb->data, len, DMA_TO_DEVICE); + +- if (unlikely(dma_mapping_error(&ndev->dev, addr))) { ++ if (unlikely(dma_mapping_error(dev, addr))) { + stats->tx_dropped++; + stats->tx_errors++; + dev_kfree_skb_any(skb); +-- +2.43.0 + diff --git a/queue-6.11/net-arc-rockchip-fix-emac-mdio-node-support.patch b/queue-6.11/net-arc-rockchip-fix-emac-mdio-node-support.patch new file mode 100644 index 00000000000..ff8d12fc0fd --- /dev/null +++ b/queue-6.11/net-arc-rockchip-fix-emac-mdio-node-support.patch @@ -0,0 +1,58 @@ +From e946f5c1da0f2f798324f5d3d810b5f9eb5453be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 21:01:39 +0800 +Subject: net: arc: rockchip: fix emac mdio node support + +From: Johan Jonker + +[ Upstream commit 0a1c7a7b0adbf595ce7f218609db53749e966573 ] + +The binding emac_rockchip.txt is converted to YAML. +Changed against the original binding is an added MDIO subnode. +This make the driver failed to find the PHY, and given the 'mdio +has invalid PHY address' it is probably looking in the wrong node. +Fix emac_mdio.c so that it can handle both old and new +device trees. + +Fixes: 1dabb74971b3 ("ARM: dts: rockchip: restyle emac nodes") +Signed-off-by: Johan Jonker +Tested-by: Andy Yan +Link: https://lore.kernel.org/r/20220603163539.537-3-jbx6244@gmail.com +Signed-off-by: Andy Yan +Reviewed-by: Andrew Lunn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/arc/emac_mdio.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c +index 87f40c2ba9040..078b1a72c1613 100644 +--- a/drivers/net/ethernet/arc/emac_mdio.c ++++ b/drivers/net/ethernet/arc/emac_mdio.c +@@ -133,6 +133,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv) + struct arc_emac_mdio_bus_data *data = &priv->bus_data; + struct device_node *np = priv->dev->of_node; + const char *name = "Synopsys MII Bus"; ++ struct device_node *mdio_node; + struct mii_bus *bus; + int error; + +@@ -164,7 +165,13 @@ int arc_mdio_probe(struct arc_emac_priv *priv) + + snprintf(bus->id, MII_BUS_ID_SIZE, "%s", bus->name); + +- error = of_mdiobus_register(bus, priv->dev->of_node); ++ /* Backwards compatibility for EMAC nodes without MDIO subnode. */ ++ mdio_node = of_get_child_by_name(np, "mdio"); ++ if (!mdio_node) ++ mdio_node = of_node_get(np); ++ ++ error = of_mdiobus_register(bus, mdio_node); ++ of_node_put(mdio_node); + if (error) { + mdiobus_free(bus); + return dev_err_probe(priv->dev, error, +-- +2.43.0 + diff --git a/queue-6.11/net-dpaa_eth-print-fd-status-in-cpu-endianness-in-dp.patch b/queue-6.11/net-dpaa_eth-print-fd-status-in-cpu-endianness-in-dp.patch new file mode 100644 index 00000000000..ad79875c51b --- /dev/null +++ b/queue-6.11/net-dpaa_eth-print-fd-status-in-cpu-endianness-in-dp.patch @@ -0,0 +1,54 @@ +From 78863d1f98c5f9642ac29036d0a5afd2e7f52866 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 18:31:05 +0200 +Subject: net: dpaa_eth: print FD status in CPU endianness in dpaa_eth_fd + tracepoint + +From: Vladimir Oltean + +[ Upstream commit 0144c06c5890d1ad0eea65df074cffaf4eea5a3c ] + +Sparse warns: + +note: in included file (through ../include/trace/trace_events.h, +../include/trace/define_trace.h, +../drivers/net/ethernet/freescale/dpaa/dpaa_eth_trace.h): +warning: incorrect type in assignment (different base types) + expected unsigned int [usertype] fd_status + got restricted __be32 const [usertype] status + +We take struct qm_fd :: status, store it and print it as an u32, +though it is a big endian field. We should print the FD status in +CPU endianness for ease of debug and consistency between PowerPC and +Arm systems. + +Though it is a not often used debug feature, it is best to treat it as +a bug and backport the format change to all supported stable kernels, +for consistency. + +Fixes: eb11ddf36eb8 ("dpaa_eth: add trace points") +Signed-off-by: Vladimir Oltean +Acked-by: Madalin Bucur +Link: https://patch.msgid.link/20241029163105.44135-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa/dpaa_eth_trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth_trace.h b/drivers/net/ethernet/freescale/dpaa/dpaa_eth_trace.h +index 6f0e58a2a58ad..9e1d44ae92cce 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth_trace.h ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth_trace.h +@@ -56,7 +56,7 @@ DECLARE_EVENT_CLASS(dpaa_eth_fd, + __entry->fd_format = qm_fd_get_format(fd); + __entry->fd_offset = qm_fd_get_offset(fd); + __entry->fd_length = qm_fd_get_length(fd); +- __entry->fd_status = fd->status; ++ __entry->fd_status = __be32_to_cpu(fd->status); + __assign_str(name); + ), + +-- +2.43.0 + diff --git a/queue-6.11/net-enetc-allocate-vf_state-during-pf-probes.patch b/queue-6.11/net-enetc-allocate-vf_state-during-pf-probes.patch new file mode 100644 index 00000000000..0cc345825fa --- /dev/null +++ b/queue-6.11/net-enetc-allocate-vf_state-during-pf-probes.patch @@ -0,0 +1,105 @@ +From ed52b7da1996dd79e47e3ea663c03812776657b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 14:02:46 +0800 +Subject: net: enetc: allocate vf_state during PF probes + +From: Wei Fang + +[ Upstream commit e15c5506dd39885cd047f811a64240e2e8ab401b ] + +In the previous implementation, vf_state is allocated memory only when VF +is enabled. However, net_device_ops::ndo_set_vf_mac() may be called before +VF is enabled to configure the MAC address of VF. If this is the case, +enetc_pf_set_vf_mac() will access vf_state, resulting in access to a null +pointer. The simplified error log is as follows. + +root@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89 +[ 173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 +[ 173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy +[ 173.641973] lr : do_setlink+0x4a8/0xec8 +[ 173.732292] Call trace: +[ 173.734740] enetc_pf_set_vf_mac+0x3c/0x80 +[ 173.738847] __rtnl_newlink+0x530/0x89c +[ 173.742692] rtnl_newlink+0x50/0x7c +[ 173.746189] rtnetlink_rcv_msg+0x128/0x390 +[ 173.750298] netlink_rcv_skb+0x60/0x130 +[ 173.754145] rtnetlink_rcv+0x18/0x24 +[ 173.757731] netlink_unicast+0x318/0x380 +[ 173.761665] netlink_sendmsg+0x17c/0x3c8 + +Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") +Signed-off-by: Wei Fang +Reviewed-by: Vladimir Oltean +Tested-by: Vladimir Oltean +Link: https://patch.msgid.link/20241031060247.1290941-2-wei.fang@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/freescale/enetc/enetc_pf.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +index 11b14555802c9..d3fbeaa6ed9f2 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +@@ -665,19 +665,11 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs) + + if (!num_vfs) { + enetc_msg_psi_free(pf); +- kfree(pf->vf_state); + pf->num_vfs = 0; + pci_disable_sriov(pdev); + } else { + pf->num_vfs = num_vfs; + +- pf->vf_state = kcalloc(num_vfs, sizeof(struct enetc_vf_state), +- GFP_KERNEL); +- if (!pf->vf_state) { +- pf->num_vfs = 0; +- return -ENOMEM; +- } +- + err = enetc_msg_psi_init(pf); + if (err) { + dev_err(&pdev->dev, "enetc_msg_psi_init (%d)\n", err); +@@ -696,7 +688,6 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs) + err_en_sriov: + enetc_msg_psi_free(pf); + err_msg_psi: +- kfree(pf->vf_state); + pf->num_vfs = 0; + + return err; +@@ -1286,6 +1277,12 @@ static int enetc_pf_probe(struct pci_dev *pdev, + pf = enetc_si_priv(si); + pf->si = si; + pf->total_vfs = pci_sriov_get_totalvfs(pdev); ++ if (pf->total_vfs) { ++ pf->vf_state = kcalloc(pf->total_vfs, sizeof(struct enetc_vf_state), ++ GFP_KERNEL); ++ if (!pf->vf_state) ++ goto err_alloc_vf_state; ++ } + + err = enetc_setup_mac_addresses(node, pf); + if (err) +@@ -1363,6 +1360,8 @@ static int enetc_pf_probe(struct pci_dev *pdev, + free_netdev(ndev); + err_alloc_netdev: + err_setup_mac_addresses: ++ kfree(pf->vf_state); ++err_alloc_vf_state: + enetc_psi_destroy(pdev); + err_psi_create: + return err; +@@ -1389,6 +1388,7 @@ static void enetc_pf_remove(struct pci_dev *pdev) + enetc_free_si_resources(priv); + + free_netdev(si->ndev); ++ kfree(pf->vf_state); + + enetc_psi_destroy(pdev); + } +-- +2.43.0 + diff --git a/queue-6.11/net-enetc-set-mac-address-to-the-vf-net_device.patch b/queue-6.11/net-enetc-set-mac-address-to-the-vf-net_device.patch new file mode 100644 index 00000000000..65a6db12f50 --- /dev/null +++ b/queue-6.11/net-enetc-set-mac-address-to-the-vf-net_device.patch @@ -0,0 +1,66 @@ +From 90c30433e7402e176aef75b05009924c81bf4577 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 17:04:06 +0800 +Subject: net: enetc: set MAC address to the VF net_device + +From: Wei Fang + +[ Upstream commit badccd49b93bb945bf4e5cc8707db67cdc5e27e5 ] + +The MAC address of VF can be configured through the mailbox mechanism of +ENETC, but the previous implementation forgot to set the MAC address in +net_device, resulting in the SMAC of the sent frames still being the old +MAC address. Since the MAC address in the hardware has been changed, Rx +cannot receive frames with the DMAC address as the new MAC address. The +most obvious phenomenon is that after changing the MAC address, we can +see that the MAC address of eno0vf0 has not changed through the "ifconfig +eno0vf0" command and the IP address cannot be obtained . + +root@ls1028ardb:~# ifconfig eno0vf0 down +root@ls1028ardb:~# ifconfig eno0vf0 hw ether 00:04:9f:3a:4d:56 up +root@ls1028ardb:~# ifconfig eno0vf0 +eno0vf0: flags=4163 mtu 1500 + ether 66:36:2c:3b:87:76 txqueuelen 1000 (Ethernet) + RX packets 794 bytes 69239 (69.2 KB) + RX errors 0 dropped 0 overruns 0 frame 0 + TX packets 11 bytes 2226 (2.2 KB) + TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 + +Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") +Signed-off-by: Wei Fang +Reviewed-by: Vladimir Oltean +Reviewed-by: Claudiu Manoil +Link: https://patch.msgid.link/20241029090406.841836-1-wei.fang@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +index dfcaac302e245..b15db70769e5e 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +@@ -78,11 +78,18 @@ static int enetc_vf_set_mac_addr(struct net_device *ndev, void *addr) + { + struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct sockaddr *saddr = addr; ++ int err; + + if (!is_valid_ether_addr(saddr->sa_data)) + return -EADDRNOTAVAIL; + +- return enetc_msg_vsi_set_primary_mac_addr(priv, saddr); ++ err = enetc_msg_vsi_set_primary_mac_addr(priv, saddr); ++ if (err) ++ return err; ++ ++ eth_hw_addr_set(ndev, saddr->sa_data); ++ ++ return 0; + } + + static int enetc_vf_set_features(struct net_device *ndev, +-- +2.43.0 + diff --git a/queue-6.11/net-hns3-fix-kernel-crash-when-uninstalling-driver.patch b/queue-6.11/net-hns3-fix-kernel-crash-when-uninstalling-driver.patch new file mode 100644 index 00000000000..1fb0f495311 --- /dev/null +++ b/queue-6.11/net-hns3-fix-kernel-crash-when-uninstalling-driver.patch @@ -0,0 +1,89 @@ +From 7b172a055df73f64bddcae785a3dcf3b041b28df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2024 17:15:07 +0800 +Subject: net: hns3: fix kernel crash when uninstalling driver + +From: Peiyang Wang + +[ Upstream commit df3dff8ab6d79edc942464999d06fbaedf8cdd18 ] + +When the driver is uninstalled and the VF is disabled concurrently, a +kernel crash occurs. The reason is that the two actions call function +pci_disable_sriov(). The num_VFs is checked to determine whether to +release the corresponding resources. During the second calling, num_VFs +is not 0 and the resource release function is called. However, the +corresponding resource has been released during the first invoking. +Therefore, the problem occurs: + +[15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 +... +[15278.131557][T50670] Call trace: +[15278.134686][T50670] klist_put+0x28/0x12c +[15278.138682][T50670] klist_del+0x14/0x20 +[15278.142592][T50670] device_del+0xbc/0x3c0 +[15278.146676][T50670] pci_remove_bus_device+0x84/0x120 +[15278.151714][T50670] pci_stop_and_remove_bus_device+0x6c/0x80 +[15278.157447][T50670] pci_iov_remove_virtfn+0xb4/0x12c +[15278.162485][T50670] sriov_disable+0x50/0x11c +[15278.166829][T50670] pci_disable_sriov+0x24/0x30 +[15278.171433][T50670] hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3] +[15278.178039][T50670] hclge_exit+0x28/0xd0 [hclge] +[15278.182730][T50670] __se_sys_delete_module.isra.0+0x164/0x230 +[15278.188550][T50670] __arm64_sys_delete_module+0x1c/0x30 +[15278.193848][T50670] invoke_syscall+0x50/0x11c +[15278.198278][T50670] el0_svc_common.constprop.0+0x158/0x164 +[15278.203837][T50670] do_el0_svc+0x34/0xcc +[15278.207834][T50670] el0_svc+0x20/0x30 + +For details, see the following figure. + + rmmod hclge disable VFs +---------------------------------------------------- +hclge_exit() sriov_numvfs_store() + ... device_lock() + pci_disable_sriov() hns3_pci_sriov_configure() + pci_disable_sriov() + sriov_disable() + sriov_disable() if !num_VFs : + if !num_VFs : return; + return; sriov_del_vfs() + sriov_del_vfs() ... + ... klist_put() + klist_put() ... + ... num_VFs = 0; + num_VFs = 0; device_unlock(); + +In this patch, when driver is removing, we get the device_lock() +to protect num_VFs, just like sriov_numvfs_store(). + +Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer") +Signed-off-by: Peiyang Wang +Signed-off-by: Jijie Shao +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20241101091507.3644584-1-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +index 67b0bf310daaa..9a63fbc694083 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +@@ -25,8 +25,11 @@ void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo) + pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev); + if (!pci_id) + continue; +- if (IS_ENABLED(CONFIG_PCI_IOV)) ++ if (IS_ENABLED(CONFIG_PCI_IOV)) { ++ device_lock(&ae_dev->pdev->dev); + pci_disable_sriov(ae_dev->pdev); ++ device_unlock(&ae_dev->pdev->dev); ++ } + } + } + EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare); +-- +2.43.0 + diff --git a/queue-6.11/net-phy-ti-add-phy_rst_after_clk_en-flag.patch b/queue-6.11/net-phy-ti-add-phy_rst_after_clk_en-flag.patch new file mode 100644 index 00000000000..543ddcc3400 --- /dev/null +++ b/queue-6.11/net-phy-ti-add-phy_rst_after_clk_en-flag.patch @@ -0,0 +1,43 @@ +From f88c8b24b3bde3ff032b401bbd557cc93634db34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Nov 2024 16:15:05 +0100 +Subject: net: phy: ti: add PHY_RST_AFTER_CLK_EN flag + +From: Diogo Silva + +[ Upstream commit 256748d5480bb3c4b731236c6d6fc86a8e2815d8 ] + +DP83848 datasheet (section 4.7.2) indicates that the reset pin should be +toggled after the clocks are running. Add the PHY_RST_AFTER_CLK_EN to +make sure that this indication is respected. + +In my experience not having this flag enabled would lead to, on some +boots, the wrong MII mode being selected if the PHY was initialized on +the bootloader and was receiving data during Linux boot. + +Signed-off-by: Diogo Silva +Reviewed-by: Andrew Lunn +Fixes: 34e45ad9378c ("net: phy: dp83848: Add TI DP83848 Ethernet PHY") +Link: https://patch.msgid.link/20241102151504.811306-1-paissilva@ld-100007.ds1.internal +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83848.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c +index 937061acfc613..351411f0aa6f4 100644 +--- a/drivers/net/phy/dp83848.c ++++ b/drivers/net/phy/dp83848.c +@@ -147,6 +147,8 @@ MODULE_DEVICE_TABLE(mdio, dp83848_tbl); + /* IRQ related */ \ + .config_intr = dp83848_config_intr, \ + .handle_interrupt = dp83848_handle_interrupt, \ ++ \ ++ .flags = PHY_RST_AFTER_CLK_EN, \ + } + + static struct phy_driver dp83848_driver[] = { +-- +2.43.0 + diff --git a/queue-6.11/net-smc-do-not-leave-a-dangling-sk-pointer-in-__smc_.patch b/queue-6.11/net-smc-do-not-leave-a-dangling-sk-pointer-in-__smc_.patch new file mode 100644 index 00000000000..0c18c4660c3 --- /dev/null +++ b/queue-6.11/net-smc-do-not-leave-a-dangling-sk-pointer-in-__smc_.patch @@ -0,0 +1,74 @@ +From a2121e55ea79d4ef59dc956c7126d6f803ac625f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 22:19:22 +0000 +Subject: net/smc: do not leave a dangling sk pointer in __smc_create() + +From: Eric Dumazet + +[ Upstream commit d293958a8595ba566fb90b99da4d6263e14fee15 ] + +Thanks to commit 4bbd360a5084 ("socket: Print pf->create() when +it does not clear sock->sk on failure."), syzbot found an issue with AF_SMC: + +smc_create must clear sock->sk on failure, family: 43, type: 1, protocol: 0 + WARNING: CPU: 0 PID: 5827 at net/socket.c:1565 __sock_create+0x96f/0xa30 net/socket.c:1563 +Modules linked in: +CPU: 0 UID: 0 PID: 5827 Comm: syz-executor259 Not tainted 6.12.0-rc6-next-20241106-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 + RIP: 0010:__sock_create+0x96f/0xa30 net/socket.c:1563 +Code: 03 00 74 08 4c 89 e7 e8 4f 3b 85 f8 49 8b 34 24 48 c7 c7 40 89 0c 8d 8b 54 24 04 8b 4c 24 0c 44 8b 44 24 08 e8 32 78 db f7 90 <0f> 0b 90 90 e9 d3 fd ff ff 89 e9 80 e1 07 fe c1 38 c1 0f 8c ee f7 +RSP: 0018:ffffc90003e4fda0 EFLAGS: 00010246 +RAX: 099c6f938c7f4700 RBX: 1ffffffff1a595fd RCX: ffff888034823c00 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +RBP: 00000000ffffffe9 R08: ffffffff81567052 R09: 1ffff920007c9f50 +R10: dffffc0000000000 R11: fffff520007c9f51 R12: ffffffff8d2cafe8 +R13: 1ffffffff1a595fe R14: ffffffff9a789c40 R15: ffff8880764298c0 +FS: 000055557b518380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fa62ff43225 CR3: 0000000031628000 CR4: 00000000003526f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + sock_create net/socket.c:1616 [inline] + __sys_socket_create net/socket.c:1653 [inline] + __sys_socket+0x150/0x3c0 net/socket.c:1700 + __do_sys_socket net/socket.c:1714 [inline] + __se_sys_socket net/socket.c:1712 [inline] + +For reference, see commit 2d859aff775d ("Merge branch +'do-not-leave-dangling-sk-pointers-in-pf-create-functions'") + +Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC") +Signed-off-by: Eric Dumazet +Cc: Ignat Korchagin +Cc: D. Wythe +Cc: Dust Li +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Wenjia Zhang +Link: https://patch.msgid.link/20241106221922.1544045-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 8e3093938cd22..c61a02aba319a 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -3367,8 +3367,10 @@ static int __smc_create(struct net *net, struct socket *sock, int protocol, + else + rc = smc_create_clcsk(net, sk, family); + +- if (rc) ++ if (rc) { + sk_common_release(sk); ++ sock->sk = NULL; ++ } + out: + return rc; + } +-- +2.43.0 + diff --git a/queue-6.11/net-stmmac-fix-unbalanced-irq-wake-disable-warning-o.patch b/queue-6.11/net-stmmac-fix-unbalanced-irq-wake-disable-warning-o.patch new file mode 100644 index 00000000000..c3d27c758f4 --- /dev/null +++ b/queue-6.11/net-stmmac-fix-unbalanced-irq-wake-disable-warning-o.patch @@ -0,0 +1,50 @@ +From f14f9a3ebe01d33d25e8f773a75b7d95c9f50c85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2024 17:17:29 -0400 +Subject: net: stmmac: Fix unbalanced IRQ wake disable warning on single irq + case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 25d70702142ac2115e75e01a0a985c6ea1d78033 ] + +Commit a23aa0404218 ("net: stmmac: ethtool: Fixed calltrace caused by +unbalanced disable_irq_wake calls") introduced checks to prevent +unbalanced enable and disable IRQ wake calls. However it only +initialized the auxiliary variable on one of the paths, +stmmac_request_irq_multi_msi(), missing the other, +stmmac_request_irq_single(). + +Add the same initialization on stmmac_request_irq_single() to prevent +"Unbalanced IRQ wake disable" warnings from being printed the first +time disable_irq_wake() is called on platforms that run on that code +path. + +Fixes: a23aa0404218 ("net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20241101-stmmac-unbalanced-wake-single-fix-v1-1-5952524c97f0@collabora.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 02368917efb4a..afb8a5a079fa0 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -3794,6 +3794,7 @@ static int stmmac_request_irq_single(struct net_device *dev) + /* Request the Wake IRQ in case of another line + * is used for WoL + */ ++ priv->wol_irq_disabled = true; + if (priv->wol_irq > 0 && priv->wol_irq != dev->irq) { + ret = request_irq(priv->wol_irq, stmmac_interrupt, + IRQF_SHARED, dev->name, dev); +-- +2.43.0 + diff --git a/queue-6.11/net-xilinx-axienet-enqueue-tx-packets-in-dql-before-.patch b/queue-6.11/net-xilinx-axienet-enqueue-tx-packets-in-dql-before-.patch new file mode 100644 index 00000000000..a75b18a2b8e --- /dev/null +++ b/queue-6.11/net-xilinx-axienet-enqueue-tx-packets-in-dql-before-.patch @@ -0,0 +1,64 @@ +From 77b1df2aa64e4989df8f4058fac3a36b04eb12fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2024 11:55:32 +0530 +Subject: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine + starts + +From: Suraj Gupta + +[ Upstream commit 5ccdcdf186aec6b9111845fd37e1757e9b413e2f ] + +Enqueue packets in dql after dma engine starts causes race condition. +Tx transfer starts once dma engine is started and may execute dql dequeue +in completion before it gets queued. It results in following kernel crash +while running iperf stress test: + +kernel BUG at lib/dynamic_queue_limits.c:99! + +Internal error: Oops - BUG: 00000000f2000800 [#1] SMP +pc : dql_completed+0x238/0x248 +lr : dql_completed+0x3c/0x248 + +Call trace: + dql_completed+0x238/0x248 + axienet_dma_tx_cb+0xa0/0x170 + xilinx_dma_do_tasklet+0xdc/0x290 + tasklet_action_common+0xf8/0x11c + tasklet_action+0x30/0x3c + handle_softirqs+0xf8/0x230 + + +Start dmaengine after enqueue in dql fixes the crash. + +Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support") +Signed-off-by: Suraj Gupta +Link: https://patch.msgid.link/20241030062533.2527042-2-suraj.gupta2@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index 0c4c57e7fddc2..877f190e3af4e 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -862,13 +862,13 @@ axienet_start_xmit_dmaengine(struct sk_buff *skb, struct net_device *ndev) + skbuf_dma->sg_len = sg_len; + dma_tx_desc->callback_param = lp; + dma_tx_desc->callback_result = axienet_dma_tx_cb; +- dmaengine_submit(dma_tx_desc); +- dma_async_issue_pending(lp->tx_chan); + txq = skb_get_tx_queue(lp->ndev, skb); + netdev_tx_sent_queue(txq, skb->len); + netif_txq_maybe_stop(txq, CIRC_SPACE(lp->tx_ring_head, lp->tx_ring_tail, TX_BD_NUM_MAX), + MAX_SKB_FRAGS + 1, 2 * MAX_SKB_FRAGS); + ++ dmaengine_submit(dma_tx_desc); ++ dma_async_issue_pending(lp->tx_chan); + return NETDEV_TX_OK; + + xmit_error_unmap_sg: +-- +2.43.0 + diff --git a/queue-6.11/netfilter-nf_tables-wait-for-rcu-grace-period-on-net.patch b/queue-6.11/netfilter-nf_tables-wait-for-rcu-grace-period-on-net.patch new file mode 100644 index 00000000000..cb294a809ac --- /dev/null +++ b/queue-6.11/netfilter-nf_tables-wait-for-rcu-grace-period-on-net.patch @@ -0,0 +1,161 @@ +From 8b222907704318b6267c2d8c54a8193949c523f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2024 12:07:22 +0100 +Subject: netfilter: nf_tables: wait for rcu grace period on net_device removal + +From: Pablo Neira Ayuso + +[ Upstream commit c03d278fdf35e73dd0ec543b9b556876b9d9a8dc ] + +8c873e219970 ("netfilter: core: free hooks with call_rcu") removed +synchronize_net() call when unregistering basechain hook, however, +net_device removal event handler for the NFPROTO_NETDEV was not updated +to wait for RCU grace period. + +Note that 835b803377f5 ("netfilter: nf_tables_netdev: unregister hooks +on net_device removal") does not remove basechain rules on device +removal, I was hinted to remove rules on net_device removal later, see +5ebe0b0eec9d ("netfilter: nf_tables: destroy basechain and rules on +netdevice removal"). + +Although NETDEV_UNREGISTER event is guaranteed to be handled after +synchronize_net() call, this path needs to wait for rcu grace period via +rcu callback to release basechain hooks if netns is alive because an +ongoing netlink dump could be in progress (sockets hold a reference on +the netns). + +Note that nf_tables_pre_exit_net() unregisters and releases basechain +hooks but it is possible to see NETDEV_UNREGISTER at a later stage in +the netns exit path, eg. veth peer device in another netns: + + cleanup_net() + default_device_exit_batch() + unregister_netdevice_many_notify() + notifier_call_chain() + nf_tables_netdev_event() + __nft_release_basechain() + +In this particular case, same rule of thumb applies: if netns is alive, +then wait for rcu grace period because netlink dump in the other netns +could be in progress. Otherwise, if the other netns is going away then +no netlink dump can be in progress and basechain hooks can be released +inmediately. + +While at it, turn WARN_ON() into WARN_ON_ONCE() for the basechain +validation, which should not ever happen. + +Fixes: 835b803377f5 ("netfilter: nf_tables_netdev: unregister hooks on net_device removal") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 4 +++ + net/netfilter/nf_tables_api.c | 41 +++++++++++++++++++++++++------ + 2 files changed, 38 insertions(+), 7 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 2be4738eae1cc..0d01e0310e5fe 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -1099,6 +1099,7 @@ struct nft_rule_blob { + * @name: name of the chain + * @udlen: user data length + * @udata: user data in the chain ++ * @rcu_head: rcu head for deferred release + * @blob_next: rule blob pointer to the next in the chain + */ + struct nft_chain { +@@ -1116,6 +1117,7 @@ struct nft_chain { + char *name; + u16 udlen; + u8 *udata; ++ struct rcu_head rcu_head; + + /* Only used during control plane commit phase: */ + struct nft_rule_blob *blob_next; +@@ -1259,6 +1261,7 @@ static inline void nft_use_inc_restore(u32 *use) + * @sets: sets in the table + * @objects: stateful objects in the table + * @flowtables: flow tables in the table ++ * @net: netnamespace this table belongs to + * @hgenerator: handle generator state + * @handle: table handle + * @use: number of chain references to this table +@@ -1278,6 +1281,7 @@ struct nft_table { + struct list_head sets; + struct list_head objects; + struct list_head flowtables; ++ possible_net_t net; + u64 hgenerator; + u64 handle; + u32 use; +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index e792f153f9587..58503348ed3a3 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1493,6 +1493,7 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, + INIT_LIST_HEAD(&table->sets); + INIT_LIST_HEAD(&table->objects); + INIT_LIST_HEAD(&table->flowtables); ++ write_pnet(&table->net, net); + table->family = family; + table->flags = flags; + table->handle = ++nft_net->table_handle; +@@ -11363,22 +11364,48 @@ int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, + } + EXPORT_SYMBOL_GPL(nft_data_dump); + +-int __nft_release_basechain(struct nft_ctx *ctx) ++static void __nft_release_basechain_now(struct nft_ctx *ctx) + { + struct nft_rule *rule, *nr; + +- if (WARN_ON(!nft_is_base_chain(ctx->chain))) +- return 0; +- +- nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); + list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { + list_del(&rule->list); +- nft_use_dec(&ctx->chain->use); + nf_tables_rule_release(ctx, rule); + } ++ nf_tables_chain_destroy(ctx->chain); ++} ++ ++static void nft_release_basechain_rcu(struct rcu_head *head) ++{ ++ struct nft_chain *chain = container_of(head, struct nft_chain, rcu_head); ++ struct nft_ctx ctx = { ++ .family = chain->table->family, ++ .chain = chain, ++ .net = read_pnet(&chain->table->net), ++ }; ++ ++ __nft_release_basechain_now(&ctx); ++ put_net(ctx.net); ++} ++ ++int __nft_release_basechain(struct nft_ctx *ctx) ++{ ++ struct nft_rule *rule; ++ ++ if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain))) ++ return 0; ++ ++ nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); ++ list_for_each_entry(rule, &ctx->chain->rules, list) ++ nft_use_dec(&ctx->chain->use); ++ + nft_chain_del(ctx->chain); + nft_use_dec(&ctx->table->use); +- nf_tables_chain_destroy(ctx->chain); ++ ++ if (maybe_get_net(ctx->net)) ++ call_rcu(&ctx->chain->rcu_head, nft_release_basechain_rcu); ++ else ++ __nft_release_basechain_now(ctx); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.11/nfs-avoid-i_lock-contention-in-nfs_clear_invalid_map.patch b/queue-6.11/nfs-avoid-i_lock-contention-in-nfs_clear_invalid_map.patch new file mode 100644 index 00000000000..f941ba426c9 --- /dev/null +++ b/queue-6.11/nfs-avoid-i_lock-contention-in-nfs_clear_invalid_map.patch @@ -0,0 +1,79 @@ +From 05c05755c386f73a0dc410e24bf3566cc1697daf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2024 17:15:41 -0400 +Subject: nfs: avoid i_lock contention in nfs_clear_invalid_mapping + +From: Mike Snitzer + +[ Upstream commit 867da60d463bb2a3e28c9235c487e56e96cffa00 ] + +Multi-threaded buffered reads to the same file exposed significant +inode spinlock contention in nfs_clear_invalid_mapping(). + +Eliminate this spinlock contention by checking flags without locking, +instead using smp_rmb and smp_load_acquire accordingly, but then take +spinlock and double-check these inode flags. + +Also refactor nfs_set_cache_invalid() slightly to use +smp_store_release() to pair with nfs_clear_invalid_mapping()'s +smp_load_acquire(). + +While this fix is beneficial for all multi-threaded buffered reads +issued by an NFS client, this issue was identified in the context of +surprisingly low LOCALIO performance with 4K multi-threaded buffered +read IO. This fix dramatically speeds up LOCALIO performance: + +before: read: IOPS=1583k, BW=6182MiB/s (6482MB/s)(121GiB/20002msec) +after: read: IOPS=3046k, BW=11.6GiB/s (12.5GB/s)(232GiB/20001msec) + +Fixes: 17dfeb911339 ("NFS: Fix races in nfs_revalidate_mapping") +Signed-off-by: Mike Snitzer +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/inode.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index b6519f4b12663..e36f3efb3bbc8 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -205,12 +205,15 @@ void nfs_set_cache_invalid(struct inode *inode, unsigned long flags) + nfs_fscache_invalidate(inode, 0); + flags &= ~NFS_INO_REVAL_FORCED; + +- nfsi->cache_validity |= flags; ++ flags |= nfsi->cache_validity; ++ if (inode->i_mapping->nrpages == 0) ++ flags &= ~NFS_INO_INVALID_DATA; + +- if (inode->i_mapping->nrpages == 0) { +- nfsi->cache_validity &= ~NFS_INO_INVALID_DATA; +- nfs_ooo_clear(nfsi); +- } else if (nfsi->cache_validity & NFS_INO_INVALID_DATA) { ++ /* pairs with nfs_clear_invalid_mapping()'s smp_load_acquire() */ ++ smp_store_release(&nfsi->cache_validity, flags); ++ ++ if (inode->i_mapping->nrpages == 0 || ++ nfsi->cache_validity & NFS_INO_INVALID_DATA) { + nfs_ooo_clear(nfsi); + } + trace_nfs_set_cache_invalid(inode, 0); +@@ -1421,6 +1424,13 @@ int nfs_clear_invalid_mapping(struct address_space *mapping) + TASK_KILLABLE|TASK_FREEZABLE_UNSAFE); + if (ret) + goto out; ++ smp_rmb(); /* pairs with smp_wmb() below */ ++ if (test_bit(NFS_INO_INVALIDATING, bitlock)) ++ continue; ++ /* pairs with nfs_set_cache_invalid()'s smp_store_release() */ ++ if (!(smp_load_acquire(&nfsi->cache_validity) & NFS_INO_INVALID_DATA)) ++ goto out; ++ /* Slow-path that double-checks with spinlock held */ + spin_lock(&inode->i_lock); + if (test_bit(NFS_INO_INVALIDATING, bitlock)) { + spin_unlock(&inode->i_lock); +-- +2.43.0 + diff --git a/queue-6.11/nfs-fix-attribute-delegation-behaviour-on-exclusive-.patch b/queue-6.11/nfs-fix-attribute-delegation-behaviour-on-exclusive-.patch new file mode 100644 index 00000000000..5721bb2e401 --- /dev/null +++ b/queue-6.11/nfs-fix-attribute-delegation-behaviour-on-exclusive-.patch @@ -0,0 +1,41 @@ +From 91d3d579a352d484e65fc73e662bef99f8c92745 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 09:35:43 -0400 +Subject: NFS: Fix attribute delegation behaviour on exclusive create + +From: Trond Myklebust + +[ Upstream commit d054c5eb2890633935c23c371f45fb2d6b3b4b64 ] + +When the client does an exclusive create and the server decides to store +the verifier in the timestamps, a SETATTR is subsequently sent to fix up +those timestamps. When that is the case, suppress the exceptions for +attribute delegations in nfs4_bitmap_copy_adjust(). + +Fixes: 32215c1f893a ("NFSv4: Don't request atime/mtime/size if they are delegated to us") +Signed-off-by: Trond Myklebust +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index cd2fbde2e6d72..9d40319e063de 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3452,6 +3452,10 @@ static int nfs4_do_setattr(struct inode *inode, const struct cred *cred, + adjust_flags |= NFS_INO_INVALID_MODE; + if (sattr->ia_valid & (ATTR_UID | ATTR_GID)) + adjust_flags |= NFS_INO_INVALID_OTHER; ++ if (sattr->ia_valid & ATTR_ATIME) ++ adjust_flags |= NFS_INO_INVALID_ATIME; ++ if (sattr->ia_valid & ATTR_MTIME) ++ adjust_flags |= NFS_INO_INVALID_MTIME; + + do { + nfs4_bitmap_copy_adjust(bitmask, nfs4_bitmask(server, fattr->label), +-- +2.43.0 + diff --git a/queue-6.11/nfs-further-fixes-to-attribute-delegation-a-mtime-ch.patch b/queue-6.11/nfs-further-fixes-to-attribute-delegation-a-mtime-ch.patch new file mode 100644 index 00000000000..b0b75beaa2d --- /dev/null +++ b/queue-6.11/nfs-further-fixes-to-attribute-delegation-a-mtime-ch.patch @@ -0,0 +1,99 @@ +From c138470221e5e057bc2c24031e28b13c4285bb9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 17:05:48 -0400 +Subject: NFS: Further fixes to attribute delegation a/mtime changes + +From: Trond Myklebust + +[ Upstream commit 40f45ab3814f2aff1ddada629c910aad982fc8e1 ] + +When asked to set both an atime and an mtime to the current system time, +ensure that the setting is atomic by calling inode_update_timestamps() +only once with the appropriate flags. + +Fixes: e12912d94137 ("NFSv4: Add support for delegated atime and mtime attributes") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/inode.c | 49 +++++++++++++++++++++++++++++++------------------ + 1 file changed, 31 insertions(+), 18 deletions(-) + +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index b4914a11c3c25..b6519f4b12663 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -628,23 +628,35 @@ nfs_fattr_fixup_delegated(struct inode *inode, struct nfs_fattr *fattr) + } + } + ++static void nfs_update_timestamps(struct inode *inode, unsigned int ia_valid) ++{ ++ enum file_time_flags time_flags = 0; ++ unsigned int cache_flags = 0; ++ ++ if (ia_valid & ATTR_MTIME) { ++ time_flags |= S_MTIME | S_CTIME; ++ cache_flags |= NFS_INO_INVALID_CTIME | NFS_INO_INVALID_MTIME; ++ } ++ if (ia_valid & ATTR_ATIME) { ++ time_flags |= S_ATIME; ++ cache_flags |= NFS_INO_INVALID_ATIME; ++ } ++ inode_update_timestamps(inode, time_flags); ++ NFS_I(inode)->cache_validity &= ~cache_flags; ++} ++ + void nfs_update_delegated_atime(struct inode *inode) + { + spin_lock(&inode->i_lock); +- if (nfs_have_delegated_atime(inode)) { +- inode_update_timestamps(inode, S_ATIME); +- NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_ATIME; +- } ++ if (nfs_have_delegated_atime(inode)) ++ nfs_update_timestamps(inode, ATTR_ATIME); + spin_unlock(&inode->i_lock); + } + + void nfs_update_delegated_mtime_locked(struct inode *inode) + { +- if (nfs_have_delegated_mtime(inode)) { +- inode_update_timestamps(inode, S_CTIME | S_MTIME); +- NFS_I(inode)->cache_validity &= ~(NFS_INO_INVALID_CTIME | +- NFS_INO_INVALID_MTIME); +- } ++ if (nfs_have_delegated_mtime(inode)) ++ nfs_update_timestamps(inode, ATTR_MTIME); + } + + void nfs_update_delegated_mtime(struct inode *inode) +@@ -682,15 +694,16 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + attr->ia_valid &= ~ATTR_SIZE; + } + +- if (nfs_have_delegated_mtime(inode)) { +- if (attr->ia_valid & ATTR_MTIME) { +- nfs_update_delegated_mtime(inode); +- attr->ia_valid &= ~ATTR_MTIME; +- } +- if (attr->ia_valid & ATTR_ATIME) { +- nfs_update_delegated_atime(inode); +- attr->ia_valid &= ~ATTR_ATIME; +- } ++ if (nfs_have_delegated_mtime(inode) && attr->ia_valid & ATTR_MTIME) { ++ spin_lock(&inode->i_lock); ++ nfs_update_timestamps(inode, attr->ia_valid); ++ spin_unlock(&inode->i_lock); ++ attr->ia_valid &= ~(ATTR_MTIME | ATTR_ATIME); ++ } else if (nfs_have_delegated_atime(inode) && ++ attr->ia_valid & ATTR_ATIME && ++ !(attr->ia_valid & ATTR_MTIME)) { ++ nfs_update_delegated_atime(inode); ++ attr->ia_valid &= ~ATTR_ATIME; + } + + /* Optimization: if the end result is no change, don't RPC */ +-- +2.43.0 + diff --git a/queue-6.11/nfsv3-only-use-nfs-timeout-for-mount-when-protocols-.patch b/queue-6.11/nfsv3-only-use-nfs-timeout-for-mount-when-protocols-.patch new file mode 100644 index 00000000000..e7cb6f9f1bf --- /dev/null +++ b/queue-6.11/nfsv3-only-use-nfs-timeout-for-mount-when-protocols-.patch @@ -0,0 +1,61 @@ +From 0b4e87545a0bac71d8d67b70092c709cd64c6b9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2024 11:07:23 +1000 +Subject: NFSv3: only use NFS timeout for MOUNT when protocols are compatible + +From: NeilBrown + +[ Upstream commit 6e2a10343ecb71c4457bc16be05758f9c7aae7d9 ] + +If a timeout is specified in the mount options, it currently applies to +both the NFS protocol and (with v3) the MOUNT protocol. This is +sensible when they both use the same underlying protocol, or those +protocols are compatible w.r.t timeouts as RDMA and TCP are. + +However if, for example, NFS is using TCP and MOUNT is using UDP then +using the same timeout doesn't make much sense. + +If you + mount -o vers=3,proto=tcp,mountproto=udp,timeo=600,retrans=5 \ + server:/path /mountpoint + +then the timeo=600 which was intended for the NFS/TCP request will +apply to the MOUNT/UDP requests with the result that there will only be +one request sent (because UDP has a maximum timeout of 60 seconds). +This is not what a reasonable person might expect. + +This patch disables the sharing of timeout information in cases where +the underlying protocols are not compatible. + +Fixes: c9301cb35b59 ("nfs: hornor timeo and retrans option when mounting NFSv3") +Signed-off-by: NeilBrown +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/super.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index 97b386032b717..e17d80876cf07 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -882,7 +882,15 @@ static int nfs_request_mount(struct fs_context *fc, + * Now ask the mount server to map our export path + * to a file handle. + */ +- status = nfs_mount(&request, ctx->timeo, ctx->retrans); ++ if ((request.protocol == XPRT_TRANSPORT_UDP) == ++ !(ctx->flags & NFS_MOUNT_TCP)) ++ /* ++ * NFS protocol and mount protocol are both UDP or neither UDP ++ * so timeouts are compatible. Use NFS timeouts for MOUNT ++ */ ++ status = nfs_mount(&request, ctx->timeo, ctx->retrans); ++ else ++ status = nfs_mount(&request, NFS_UNSPEC_TIMEO, NFS_UNSPEC_RETRANS); + if (status != 0) { + dfprintk(MOUNT, "NFS: unable to mount server %s, error %d\n", + request.hostname, status); +-- +2.43.0 + diff --git a/queue-6.11/platform-x86-amd-pmc-detect-when-stb-is-not-availabl.patch b/queue-6.11/platform-x86-amd-pmc-detect-when-stb-is-not-availabl.patch new file mode 100644 index 00000000000..d69d9e5925b --- /dev/null +++ b/queue-6.11/platform-x86-amd-pmc-detect-when-stb-is-not-availabl.patch @@ -0,0 +1,60 @@ +From 7594706f3577b3aaf4d865726f9ac9cde0d9c1af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2024 11:02:41 -0700 +Subject: platform/x86/amd/pmc: Detect when STB is not available +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Corey Hickey + +[ Upstream commit bceec87a73804bb4c33b9a6c96e2d27cd893a801 ] + +Loading the amd_pmc module as: + + amd_pmc enable_stb=1 + +...can result in the following messages in the kernel ring buffer: + + amd_pmc AMDI0009:00: SMU cmd failed. err: 0xff + ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff + WARNING: CPU: 10 PID: 2151 at arch/x86/mm/ioremap.c:217 __ioremap_caller+0x2cd/0x340 + +Further debugging reveals that this occurs when the requests for +S2D_PHYS_ADDR_LOW and S2D_PHYS_ADDR_HIGH return a value of 0, +indicating that the STB is inaccessible. To prevent the ioremap +warning and provide clarity to the user, handle the invalid address +and display an error message. + +Link: https://lore.kernel.org/platform-driver-x86/c588ff5d-3e04-4549-9a86-284b9b4419ba@amd.com +Fixes: 3d7d407dfb05 ("platform/x86: amd-pmc: Add support for AMD Spill to DRAM STB feature") +Acked-by: Shyam Sundar S K +Signed-off-by: Corey Hickey +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20241028180241.1341624-1-bugfood-ml@fatooh.org +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c +index bbb8edb62e009..5669f94c3d06b 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -998,6 +998,11 @@ static int amd_pmc_s2d_init(struct amd_pmc_dev *dev) + amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_LOW, &phys_addr_low, dev->s2d_msg_id, true); + amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_HIGH, &phys_addr_hi, dev->s2d_msg_id, true); + ++ if (!phys_addr_hi && !phys_addr_low) { ++ dev_err(dev->dev, "STB is not enabled on the system; disable enable_stb or contact system vendor\n"); ++ return -EINVAL; ++ } ++ + stb_phys_addr = ((u64)phys_addr_hi << 32 | phys_addr_low); + + /* Clear msg_port for other SMU operation */ +-- +2.43.0 + diff --git a/queue-6.11/regulator-rtq2208-fix-uninitialized-use-of-regulator.patch b/queue-6.11/regulator-rtq2208-fix-uninitialized-use-of-regulator.patch new file mode 100644 index 00000000000..0fac2e68673 --- /dev/null +++ b/queue-6.11/regulator-rtq2208-fix-uninitialized-use-of-regulator.patch @@ -0,0 +1,36 @@ +From 98f857e31a1340bb2395a8a943a78203d6cd1544 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 13:59:18 +0800 +Subject: regulator: rtq2208: Fix uninitialized use of regulator_config + +From: ChiYuan Huang + +[ Upstream commit 2feb023110843acce790e9089e72e9a9503d9fa5 ] + +Fix rtq2208 driver uninitialized use to cause kernel error. + +Fixes: 85a11f55621a ("regulator: rtq2208: Add Richtek RTQ2208 SubPMIC") +Signed-off-by: ChiYuan Huang +Link: https://patch.msgid.link/00d691cfcc0eae9ce80a37b62e99851e8fdcffe2.1729829243.git.cy_huang@richtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/rtq2208-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/rtq2208-regulator.c b/drivers/regulator/rtq2208-regulator.c +index a5c126afc648c..5925fa7a9a06f 100644 +--- a/drivers/regulator/rtq2208-regulator.c ++++ b/drivers/regulator/rtq2208-regulator.c +@@ -568,7 +568,7 @@ static int rtq2208_probe(struct i2c_client *i2c) + struct regmap *regmap; + struct rtq2208_regulator_desc *rdesc[RTQ2208_LDO_MAX]; + struct regulator_dev *rdev; +- struct regulator_config cfg; ++ struct regulator_config cfg = {}; + struct rtq2208_rdev_map *rdev_map; + int i, ret = 0, idx, n_regulator = 0; + unsigned int regulator_idx_table[RTQ2208_LDO_MAX], +-- +2.43.0 + diff --git a/queue-6.11/rxrpc-fix-missing-locking-causing-hanging-calls.patch b/queue-6.11/rxrpc-fix-missing-locking-causing-hanging-calls.patch new file mode 100644 index 00000000000..8070ca33569 --- /dev/null +++ b/queue-6.11/rxrpc-fix-missing-locking-causing-hanging-calls.patch @@ -0,0 +1,69 @@ +From 2031a4f3901c3da938c1225a117d78d853006bd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 13:03:22 +0000 +Subject: rxrpc: Fix missing locking causing hanging calls + +From: David Howells + +[ Upstream commit fc9de52de38f656399d2ce40f7349a6b5f86e787 ] + +If a call gets aborted (e.g. because kafs saw a signal) between it being +queued for connection and the I/O thread picking up the call, the abort +will be prioritised over the connection and it will be removed from +local->new_client_calls by rxrpc_disconnect_client_call() without a lock +being held. This may cause other calls on the list to disappear if a race +occurs. + +Fix this by taking the client_call_lock when removing a call from whatever +list its ->wait_link happens to be on. + +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Reported-by: Marc Dionne +Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread") +Link: https://patch.msgid.link/726660.1730898202@warthog.procyon.org.uk +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/trace/events/rxrpc.h | 1 + + net/rxrpc/conn_client.c | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h +index a1b126a6b0d72..cc22596c7250c 100644 +--- a/include/trace/events/rxrpc.h ++++ b/include/trace/events/rxrpc.h +@@ -287,6 +287,7 @@ + EM(rxrpc_call_see_input, "SEE input ") \ + EM(rxrpc_call_see_release, "SEE release ") \ + EM(rxrpc_call_see_userid_exists, "SEE u-exists") \ ++ EM(rxrpc_call_see_waiting_call, "SEE q-conn ") \ + E_(rxrpc_call_see_zap, "SEE zap ") + + #define rxrpc_txqueue_traces \ +diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c +index d25bf1cf36700..bb11e8289d6dc 100644 +--- a/net/rxrpc/conn_client.c ++++ b/net/rxrpc/conn_client.c +@@ -516,6 +516,7 @@ void rxrpc_connect_client_calls(struct rxrpc_local *local) + + spin_lock(&local->client_call_lock); + list_move_tail(&call->wait_link, &bundle->waiting_calls); ++ rxrpc_see_call(call, rxrpc_call_see_waiting_call); + spin_unlock(&local->client_call_lock); + + if (rxrpc_bundle_has_space(bundle)) +@@ -586,7 +587,10 @@ void rxrpc_disconnect_client_call(struct rxrpc_bundle *bundle, struct rxrpc_call + _debug("call is waiting"); + ASSERTCMP(call->call_id, ==, 0); + ASSERT(!test_bit(RXRPC_CALL_EXPOSED, &call->flags)); ++ /* May still be on ->new_client_calls. */ ++ spin_lock(&local->client_call_lock); + list_del_init(&call->wait_link); ++ spin_unlock(&local->client_call_lock); + return; + } + +-- +2.43.0 + diff --git a/queue-6.11/sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch b/queue-6.11/sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch new file mode 100644 index 00000000000..4b30ea12bcc --- /dev/null +++ b/queue-6.11/sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch @@ -0,0 +1,49 @@ +From 202905273ffa2546db137877b0af4a3842282a43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 13:46:21 -0400 +Subject: sctp: properly validate chunk size in sctp_sf_ootb() + +From: Xin Long + +[ Upstream commit 0ead60804b64f5bd6999eec88e503c6a1a242d41 ] + +A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add +size validation when walking chunks") is also required in sctp_sf_ootb() +to address a crash reported by syzbot: + + BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 + sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 + sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166 + sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407 + sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 + sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243 + sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159 + ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205 + ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 + +Reported-by: syzbot+f0cbb34d39392f2746ca@syzkaller.appspotmail.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xin Long +Link: https://patch.msgid.link/a29ebb6d8b9f8affd0f9abb296faafafe10c17d8.1730223981.git.lucien.xin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 7d315a18612ba..a0524ba8d7878 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -3751,7 +3751,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, + } + + ch = (struct sctp_chunkhdr *)ch_end; +- } while (ch_end < skb_tail_pointer(skb)); ++ } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); + + if (ootb_shut_ack) + return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands); +-- +2.43.0 + diff --git a/queue-6.11/security-keys-fix-slab-out-of-bounds-in-key_task_per.patch b/queue-6.11/security-keys-fix-slab-out-of-bounds-in-key_task_per.patch new file mode 100644 index 00000000000..db49b80f667 --- /dev/null +++ b/queue-6.11/security-keys-fix-slab-out-of-bounds-in-key_task_per.patch @@ -0,0 +1,110 @@ +From 72921b5cad7f0abaadc386b1aa188b7d2211a2c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 12:46:39 +0000 +Subject: security/keys: fix slab-out-of-bounds in key_task_permission + +From: Chen Ridong + +[ Upstream commit 4a74da044ec9ec8679e6beccc4306b936b62873f ] + +KASAN reports an out of bounds read: +BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36 +BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline] +BUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410 +security/keys/permission.c:54 +Read of size 4 at addr ffff88813c3ab618 by task stress-ng/4362 + +CPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15 +Call Trace: + __dump_stack lib/dump_stack.c:82 [inline] + dump_stack+0x107/0x167 lib/dump_stack.c:123 + print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400 + __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560 + kasan_report+0x3a/0x50 mm/kasan/report.c:585 + __kuid_val include/linux/uidgid.h:36 [inline] + uid_eq include/linux/uidgid.h:63 [inline] + key_task_permission+0x394/0x410 security/keys/permission.c:54 + search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793 + +This issue was also reported by syzbot. + +It can be reproduced by following these steps(more details [1]): +1. Obtain more than 32 inputs that have similar hashes, which ends with the + pattern '0xxxxxxxe6'. +2. Reboot and add the keys obtained in step 1. + +The reproducer demonstrates how this issue happened: +1. In the search_nested_keyrings function, when it iterates through the + slots in a node(below tag ascend_to_node), if the slot pointer is meta + and node->back_pointer != NULL(it means a root), it will proceed to + descend_to_node. However, there is an exception. If node is the root, + and one of the slots points to a shortcut, it will be treated as a + keyring. +2. Whether the ptr is keyring decided by keyring_ptr_is_keyring function. + However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as + ASSOC_ARRAY_PTR_SUBTYPE_MASK. +3. When 32 keys with the similar hashes are added to the tree, the ROOT + has keys with hashes that are not similar (e.g. slot 0) and it splits + NODE A without using a shortcut. When NODE A is filled with keys that + all hashes are xxe6, the keys are similar, NODE A will split with a + shortcut. Finally, it forms the tree as shown below, where slot 6 points + to a shortcut. + + NODE A + +------>+---+ + ROOT | | 0 | xxe6 + +---+ | +---+ + xxxx | 0 | shortcut : : xxe6 + +---+ | +---+ + xxe6 : : | | | xxe6 + +---+ | +---+ + | 6 |---+ : : xxe6 + +---+ +---+ + xxe6 : : | f | xxe6 + +---+ +---+ + xxe6 | f | + +---+ + +4. As mentioned above, If a slot(slot 6) of the root points to a shortcut, + it may be mistakenly transferred to a key*, leading to a read + out-of-bounds read. + +To fix this issue, one should jump to descend_to_node if the ptr is a +shortcut, regardless of whether the node is root or not. + +[1] https://lore.kernel.org/linux-kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@huaweicloud.com/ + +[jarkko: tweaked the commit message a bit to have an appropriate closes + tag.] +Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring") +Reported-by: syzbot+5b415c07907a2990d1a3@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/000000000000cbb7860611f61147@google.com/T/ +Signed-off-by: Chen Ridong +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + security/keys/keyring.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/security/keys/keyring.c b/security/keys/keyring.c +index 4448758f643a5..f331725d5a370 100644 +--- a/security/keys/keyring.c ++++ b/security/keys/keyring.c +@@ -772,8 +772,11 @@ static bool search_nested_keyrings(struct key *keyring, + for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) { + ptr = READ_ONCE(node->slots[slot]); + +- if (assoc_array_ptr_is_meta(ptr) && node->back_pointer) +- goto descend_to_node; ++ if (assoc_array_ptr_is_meta(ptr)) { ++ if (node->back_pointer || ++ assoc_array_ptr_is_shortcut(ptr)) ++ goto descend_to_node; ++ } + + if (!keyring_ptr_is_keyring(ptr)) + continue; +-- +2.43.0 + diff --git a/queue-6.11/series b/queue-6.11/series index e69de29bb2d..00e1581586b 100644 --- a/queue-6.11/series +++ b/queue-6.11/series @@ -0,0 +1,63 @@ +arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch +arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch-16395 +arm64-dts-rockchip-move-l3-cache-outside-cpus-in-rk3.patch +arm64-dts-rockchip-start-cooling-maps-numbering-from.patch +arm64-dts-rockchip-designate-turing-rk1-s-system-pow.patch +firmware-qcom-scm-fix-a-null-pointer-dereference.patch +edac-qcom-make-irq-configuration-optional.patch +arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch +arm64-dts-rockchip-fix-wakeup-prop-names-on-pinenote.patch +arm64-dts-rockchip-fix-reset-gpios-property-on-brcm-.patch +arm64-dts-rockchip-fix-i2c2-pinctrl-names-property-o.patch +arm64-dts-rockchip-drop-regulator-init-microvolt-fro.patch +arm64-dts-rockchip-fix-bluetooth-properties-on-rk356.patch +arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch +arm64-dts-rockchip-add-dts-for-friendlyarm-nanopi-r2.patch +arm64-dts-rockchip-remove-undocumented-supports-emmc.patch +arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch +arm64-dts-rockchip-fix-led-triggers-on-rk3308-roc-cc.patch +arm64-dts-rockchip-remove-num-slots-property-from-rk.patch +arm64-dts-qcom-sm8450-fix-pipe-clock-specification-f.patch +arm64-dts-imx8-ss-vpu-fix-imx8qm-vpu-irqs.patch +arm64-dts-imx8mp-correct-sdhc-ipg-clk.patch +arm64-dts-imx8mp-phyboard-pollux-set-video-pll1-freq.patch +firmware-arm_scmi-fix-slab-use-after-free-in-scmi_bu.patch +firmware-qcom-scm-return-eopnotsupp-for-unsupported-.patch +arm64-dts-rockchip-remove-orphaned-pinctrl-names-fro.patch +arm-dts-rockchip-fix-rk3036-acodec-node.patch +arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch +arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch +arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch +arm64-dts-rockchip-correct-gpio-polarity-on-brcm-bt-.patch +hid-core-zero-initialize-the-report-buffer.patch +platform-x86-amd-pmc-detect-when-stb-is-not-availabl.patch +sunrpc-handle-enotconn-in-xs_tcp_setup_socket.patch +nfsv3-only-use-nfs-timeout-for-mount-when-protocols-.patch +nfs-fix-attribute-delegation-behaviour-on-exclusive-.patch +nfs-further-fixes-to-attribute-delegation-a-mtime-ch.patch +nfs-avoid-i_lock-contention-in-nfs_clear_invalid_map.patch +security-keys-fix-slab-out-of-bounds-in-key_task_per.patch +regulator-rtq2208-fix-uninitialized-use-of-regulator.patch +net-enetc-set-mac-address-to-the-vf-net_device.patch +net-dpaa_eth-print-fd-status-in-cpu-endianness-in-dp.patch +dt-bindings-net-xlnx-axi-ethernet-correct-phy-mode-p.patch +sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch +net-enetc-allocate-vf_state-during-pf-probes.patch +net-xilinx-axienet-enqueue-tx-packets-in-dql-before-.patch +can-c_can-fix-rx-tx-_errors-statistics.patch +ice-change-q_index-variable-type-to-s16-to-store-1-v.patch +i40e-fix-race-condition-by-adding-filter-s-intermedi.patch +e1000e-remove-meteor-lake-smbus-workarounds.patch +net-hns3-fix-kernel-crash-when-uninstalling-driver.patch +net-phy-ti-add-phy_rst_after_clk_en-flag.patch +net-stmmac-fix-unbalanced-irq-wake-disable-warning-o.patch +netfilter-nf_tables-wait-for-rcu-grace-period-on-net.patch +virtio_net-support-dynamic-rss-indirection-table-siz.patch +virtio_net-add-hash_key_length-check.patch +virtio_net-sync-rss-config-to-device-when-virtnet_pr.patch +virtio_net-update-rss-when-set-queue.patch +net-arc-fix-the-device-for-dma_map_single-dma_unmap_.patch +net-arc-rockchip-fix-emac-mdio-node-support.patch +rxrpc-fix-missing-locking-causing-hanging-calls.patch +net-smc-do-not-leave-a-dangling-sk-pointer-in-__smc_.patch +drivers-net-ionic-add-missed-debugfs-cleanup-to-ioni.patch diff --git a/queue-6.11/sunrpc-handle-enotconn-in-xs_tcp_setup_socket.patch b/queue-6.11/sunrpc-handle-enotconn-in-xs_tcp_setup_socket.patch new file mode 100644 index 00000000000..e4bac0d083a --- /dev/null +++ b/queue-6.11/sunrpc-handle-enotconn-in-xs_tcp_setup_socket.patch @@ -0,0 +1,46 @@ +From 68af5ac839e4c6f676fbcb3c7320f8501b0a5590 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 16:28:06 +1100 +Subject: sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() + +From: NeilBrown + +[ Upstream commit 10f0740234f0b157b41bdc7e9c3555a9b86c1599 ] + +xs_tcp_finish_connecting() can return -ENOTCONN but the switch statement +in xs_tcp_setup_socket() treats that as an unhandled error. + +If we treat it as a known error it would propagate back to +call_connect_status() which does handle that error code. This appears +to be the intention of the commit (given below) which added -ENOTCONN as +a return status for xs_tcp_finish_connecting(). + +So add -ENOTCONN to the switch statement as an error to pass through to +the caller. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1231050 +Link: https://access.redhat.com/discussions/3434091 +Fixes: 01d37c428ae0 ("SUNRPC: xprt_connect() don't abort the task if the transport isn't bound") +Signed-off-by: NeilBrown +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtsock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 0e1691316f423..1326fbf45a347 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -2459,6 +2459,7 @@ static void xs_tcp_setup_socket(struct work_struct *work) + case -EHOSTUNREACH: + case -EADDRINUSE: + case -ENOBUFS: ++ case -ENOTCONN: + break; + default: + printk("%s: connect returned unhandled error %d\n", +-- +2.43.0 + diff --git a/queue-6.11/virtio_net-add-hash_key_length-check.patch b/queue-6.11/virtio_net-add-hash_key_length-check.patch new file mode 100644 index 00000000000..7c56bc17a06 --- /dev/null +++ b/queue-6.11/virtio_net-add-hash_key_length-check.patch @@ -0,0 +1,43 @@ +From 59a2b3b1e4a46373997afad644e89e6f75bc759a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 16:57:04 +0800 +Subject: virtio_net: Add hash_key_length check + +From: Philo Lu + +[ Upstream commit 3f7d9c1964fcd16d02a8a9d4fd6f6cb60c4cc530 ] + +Add hash_key_length check in virtnet_probe() to avoid possible out of +bound errors when setting/reading the hash key. + +Fixes: c7114b1249fa ("drivers/net/virtio_net: Added basic RSS support.") +Signed-off-by: Philo Lu +Signed-off-by: Xuan Zhuo +Acked-by: Joe Damato +Acked-by: Michael S. Tsirkin +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 4b507007d242b..545dda8ec0775 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -6451,6 +6451,12 @@ static int virtnet_probe(struct virtio_device *vdev) + if (vi->has_rss || vi->has_rss_hash_report) { + vi->rss_key_size = + virtio_cread8(vdev, offsetof(struct virtio_net_config, rss_max_key_size)); ++ if (vi->rss_key_size > VIRTIO_NET_RSS_MAX_KEY_SIZE) { ++ dev_err(&vdev->dev, "rss_max_key_size=%u exceeds the limit %u.\n", ++ vi->rss_key_size, VIRTIO_NET_RSS_MAX_KEY_SIZE); ++ err = -EINVAL; ++ goto free; ++ } + + vi->rss_hash_types_supported = + virtio_cread32(vdev, offsetof(struct virtio_net_config, supported_hash_types)); +-- +2.43.0 + diff --git a/queue-6.11/virtio_net-support-dynamic-rss-indirection-table-siz.patch b/queue-6.11/virtio_net-support-dynamic-rss-indirection-table-siz.patch new file mode 100644 index 00000000000..b9f3f7fee1e --- /dev/null +++ b/queue-6.11/virtio_net-support-dynamic-rss-indirection-table-siz.patch @@ -0,0 +1,124 @@ +From 26f1099ae03e2a348ce4fc3f96f2cc01923a4cd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 16:57:03 +0800 +Subject: virtio_net: Support dynamic rss indirection table size + +From: Philo Lu + +[ Upstream commit 86a48a00efdf61197b6658e52c6140463eb313dc ] + +When reading/writing virtio_net_ctrl_rss, we get the indirection table +size from vi->rss_indir_table_size, which is initialized in +virtnet_probe(). However, the actual size of indirection_table was set +as VIRTIO_NET_RSS_MAX_TABLE_LEN=128. This collision may cause issues if +the vi->rss_indir_table_size exceeds 128. + +This patch instead uses dynamic indirection table, allocated with +vi->rss after vi->rss_indir_table_size initialized. And free it in +virtnet_remove(). + +In virtnet_commit_rss_command(), sgs for rss is initialized differently +with hash_report. So indirection_table is not used if !vi->has_rss, and +then we don't need to alloc indirection_table for hash_report only uses. + +Fixes: c7114b1249fa ("drivers/net/virtio_net: Added basic RSS support.") +Signed-off-by: Philo Lu +Signed-off-by: Xuan Zhuo +Acked-by: Joe Damato +Acked-by: Michael S. Tsirkin +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 39 ++++++++++++++++++++++++++++++++++----- + 1 file changed, 34 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 792e9eadbfc3d..4b507007d242b 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -368,15 +368,16 @@ struct receive_queue { + * because table sizes may be differ according to the device configuration. + */ + #define VIRTIO_NET_RSS_MAX_KEY_SIZE 40 +-#define VIRTIO_NET_RSS_MAX_TABLE_LEN 128 + struct virtio_net_ctrl_rss { + u32 hash_types; + u16 indirection_table_mask; + u16 unclassified_queue; +- u16 indirection_table[VIRTIO_NET_RSS_MAX_TABLE_LEN]; ++ u16 hash_cfg_reserved; /* for HASH_CONFIG (see virtio_net_hash_config for details) */ + u16 max_tx_vq; + u8 hash_key_length; + u8 key[VIRTIO_NET_RSS_MAX_KEY_SIZE]; ++ ++ u16 *indirection_table; + }; + + /* Control VQ buffers: protected by the rtnl lock */ +@@ -512,6 +513,25 @@ static struct sk_buff *virtnet_skb_append_frag(struct sk_buff *head_skb, + struct page *page, void *buf, + int len, int truesize); + ++static int rss_indirection_table_alloc(struct virtio_net_ctrl_rss *rss, u16 indir_table_size) ++{ ++ if (!indir_table_size) { ++ rss->indirection_table = NULL; ++ return 0; ++ } ++ ++ rss->indirection_table = kmalloc_array(indir_table_size, sizeof(u16), GFP_KERNEL); ++ if (!rss->indirection_table) ++ return -ENOMEM; ++ ++ return 0; ++} ++ ++static void rss_indirection_table_free(struct virtio_net_ctrl_rss *rss) ++{ ++ kfree(rss->indirection_table); ++} ++ + static bool is_xdp_frame(void *ptr) + { + return (unsigned long)ptr & VIRTIO_XDP_FLAG; +@@ -3828,11 +3848,15 @@ static bool virtnet_commit_rss_command(struct virtnet_info *vi) + /* prepare sgs */ + sg_init_table(sgs, 4); + +- sg_buf_size = offsetof(struct virtio_net_ctrl_rss, indirection_table); ++ sg_buf_size = offsetof(struct virtio_net_ctrl_rss, hash_cfg_reserved); + sg_set_buf(&sgs[0], &vi->rss, sg_buf_size); + +- sg_buf_size = sizeof(uint16_t) * (vi->rss.indirection_table_mask + 1); +- sg_set_buf(&sgs[1], vi->rss.indirection_table, sg_buf_size); ++ if (vi->has_rss) { ++ sg_buf_size = sizeof(uint16_t) * vi->rss_indir_table_size; ++ sg_set_buf(&sgs[1], vi->rss.indirection_table, sg_buf_size); ++ } else { ++ sg_set_buf(&sgs[1], &vi->rss.hash_cfg_reserved, sizeof(uint16_t)); ++ } + + sg_buf_size = offsetof(struct virtio_net_ctrl_rss, key) + - offsetof(struct virtio_net_ctrl_rss, max_tx_vq); +@@ -6420,6 +6444,9 @@ static int virtnet_probe(struct virtio_device *vdev) + virtio_cread16(vdev, offsetof(struct virtio_net_config, + rss_max_indirection_table_length)); + } ++ err = rss_indirection_table_alloc(&vi->rss, vi->rss_indir_table_size); ++ if (err) ++ goto free; + + if (vi->has_rss || vi->has_rss_hash_report) { + vi->rss_key_size = +@@ -6674,6 +6701,8 @@ static void virtnet_remove(struct virtio_device *vdev) + + remove_vq_common(vi); + ++ rss_indirection_table_free(&vi->rss); ++ + free_netdev(vi->dev); + } + +-- +2.43.0 + diff --git a/queue-6.11/virtio_net-sync-rss-config-to-device-when-virtnet_pr.patch b/queue-6.11/virtio_net-sync-rss-config-to-device-when-virtnet_pr.patch new file mode 100644 index 00000000000..24e889549a9 --- /dev/null +++ b/queue-6.11/virtio_net-sync-rss-config-to-device-when-virtnet_pr.patch @@ -0,0 +1,51 @@ +From add8d6eb048e566b6730a14b48c85f5204976497 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 16:57:05 +0800 +Subject: virtio_net: Sync rss config to device when virtnet_probe + +From: Philo Lu + +[ Upstream commit dc749b7b06082ccaacc602e724445da19cd03e9f ] + +During virtnet_probe, default rss configuration is initialized, but was +not committed to the device. This patch fix this by sending rss command +after device ready in virtnet_probe. Otherwise, the actual rss +configuration used by device can be different with that read by user +from driver, which may confuse the user. + +If the command committing fails, driver rss will be disabled. + +Fixes: c7114b1249fa ("drivers/net/virtio_net: Added basic RSS support.") +Signed-off-by: Philo Lu +Signed-off-by: Xuan Zhuo +Acked-by: Joe Damato +Acked-by: Michael S. Tsirkin +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 545dda8ec0775..b3232b8baa256 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -6584,6 +6584,15 @@ static int virtnet_probe(struct virtio_device *vdev) + + virtio_device_ready(vdev); + ++ if (vi->has_rss || vi->has_rss_hash_report) { ++ if (!virtnet_commit_rss_command(vi)) { ++ dev_warn(&vdev->dev, "RSS disabled because committing failed.\n"); ++ dev->hw_features &= ~NETIF_F_RXHASH; ++ vi->has_rss_hash_report = false; ++ vi->has_rss = false; ++ } ++ } ++ + virtnet_set_queues(vi, vi->curr_queue_pairs); + + /* a random MAC address has been assigned, notify the device. +-- +2.43.0 + diff --git a/queue-6.11/virtio_net-update-rss-when-set-queue.patch b/queue-6.11/virtio_net-update-rss-when-set-queue.patch new file mode 100644 index 00000000000..49025b3bb2b --- /dev/null +++ b/queue-6.11/virtio_net-update-rss-when-set-queue.patch @@ -0,0 +1,140 @@ +From 7ea6384104590c54f145c6796c0b9f3469ff1ce8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 16:57:06 +0800 +Subject: virtio_net: Update rss when set queue + +From: Philo Lu + +[ Upstream commit 50bfcaedd78e53135ec0504302269b3b65bf1eff ] + +RSS configuration should be updated with queue number. In particular, it +should be updated when (1) rss enabled and (2) default rss configuration +is used without user modification. + +During rss command processing, device updates queue_pairs using +rss.max_tx_vq. That is, the device updates queue_pairs together with +rss, so we can skip the sperate queue_pairs update +(VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET below) and return directly. + +Also remove the `vi->has_rss ?` check when setting vi->rss.max_tx_vq, +because this is not used in the other hash_report case. + +Fixes: c7114b1249fa ("drivers/net/virtio_net: Added basic RSS support.") +Signed-off-by: Philo Lu +Signed-off-by: Xuan Zhuo +Acked-by: Michael S. Tsirkin +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 65 +++++++++++++++++++++++++++++++--------- + 1 file changed, 51 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index b3232b8baa256..53a038fcbe991 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -3394,15 +3394,59 @@ static void virtnet_ack_link_announce(struct virtnet_info *vi) + dev_warn(&vi->dev->dev, "Failed to ack link announce.\n"); + } + ++static bool virtnet_commit_rss_command(struct virtnet_info *vi); ++ ++static void virtnet_rss_update_by_qpairs(struct virtnet_info *vi, u16 queue_pairs) ++{ ++ u32 indir_val = 0; ++ int i = 0; ++ ++ for (; i < vi->rss_indir_table_size; ++i) { ++ indir_val = ethtool_rxfh_indir_default(i, queue_pairs); ++ vi->rss.indirection_table[i] = indir_val; ++ } ++ vi->rss.max_tx_vq = queue_pairs; ++} ++ + static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs) + { + struct virtio_net_ctrl_mq *mq __free(kfree) = NULL; +- struct scatterlist sg; ++ struct virtio_net_ctrl_rss old_rss; + struct net_device *dev = vi->dev; ++ struct scatterlist sg; + + if (!vi->has_cvq || !virtio_has_feature(vi->vdev, VIRTIO_NET_F_MQ)) + return 0; + ++ /* Firstly check if we need update rss. Do updating if both (1) rss enabled and ++ * (2) no user configuration. ++ * ++ * During rss command processing, device updates queue_pairs using rss.max_tx_vq. That is, ++ * the device updates queue_pairs together with rss, so we can skip the sperate queue_pairs ++ * update (VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET below) and return directly. ++ */ ++ if (vi->has_rss && !netif_is_rxfh_configured(dev)) { ++ memcpy(&old_rss, &vi->rss, sizeof(old_rss)); ++ if (rss_indirection_table_alloc(&vi->rss, vi->rss_indir_table_size)) { ++ vi->rss.indirection_table = old_rss.indirection_table; ++ return -ENOMEM; ++ } ++ ++ virtnet_rss_update_by_qpairs(vi, queue_pairs); ++ ++ if (!virtnet_commit_rss_command(vi)) { ++ /* restore ctrl_rss if commit_rss_command failed */ ++ rss_indirection_table_free(&vi->rss); ++ memcpy(&vi->rss, &old_rss, sizeof(old_rss)); ++ ++ dev_warn(&dev->dev, "Fail to set num of queue pairs to %d, because committing RSS failed\n", ++ queue_pairs); ++ return -EINVAL; ++ } ++ rss_indirection_table_free(&old_rss); ++ goto succ; ++ } ++ + mq = kzalloc(sizeof(*mq), GFP_KERNEL); + if (!mq) + return -ENOMEM; +@@ -3415,12 +3459,12 @@ static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs) + dev_warn(&dev->dev, "Fail to set num of queue pairs to %d\n", + queue_pairs); + return -EINVAL; +- } else { +- vi->curr_queue_pairs = queue_pairs; +- /* virtnet_open() will refill when device is going to up. */ +- if (dev->flags & IFF_UP) +- schedule_delayed_work(&vi->refill, 0); + } ++succ: ++ vi->curr_queue_pairs = queue_pairs; ++ /* virtnet_open() will refill when device is going to up. */ ++ if (dev->flags & IFF_UP) ++ schedule_delayed_work(&vi->refill, 0); + + return 0; + } +@@ -3880,21 +3924,14 @@ static bool virtnet_commit_rss_command(struct virtnet_info *vi) + + static void virtnet_init_default_rss(struct virtnet_info *vi) + { +- u32 indir_val = 0; +- int i = 0; +- + vi->rss.hash_types = vi->rss_hash_types_supported; + vi->rss_hash_types_saved = vi->rss_hash_types_supported; + vi->rss.indirection_table_mask = vi->rss_indir_table_size + ? vi->rss_indir_table_size - 1 : 0; + vi->rss.unclassified_queue = 0; + +- for (; i < vi->rss_indir_table_size; ++i) { +- indir_val = ethtool_rxfh_indir_default(i, vi->curr_queue_pairs); +- vi->rss.indirection_table[i] = indir_val; +- } ++ virtnet_rss_update_by_qpairs(vi, vi->curr_queue_pairs); + +- vi->rss.max_tx_vq = vi->has_rss ? vi->curr_queue_pairs : 0; + vi->rss.hash_key_length = vi->rss_key_size; + + netdev_rss_key_fill(vi->rss.key, vi->rss_key_size); +-- +2.43.0 +