From: Sasha Levin Date: Sun, 23 Mar 2025 17:44:03 +0000 (-0400) Subject: Fixes for 6.12 X-Git-Tag: v6.1.132~41 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e0f158dfe7d9986be360a6039821315848557990;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.12 Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/accel-qaic-fix-possible-data-corruption-in-bos-2g.patch b/queue-6.12/accel-qaic-fix-possible-data-corruption-in-bos-2g.patch new file mode 100644 index 0000000000..9072fc8df5 --- /dev/null +++ b/queue-6.12/accel-qaic-fix-possible-data-corruption-in-bos-2g.patch @@ -0,0 +1,67 @@ +From de4e4fda67a37c0e14648416136dc7b12b8dce9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Mar 2025 10:19:59 -0700 +Subject: accel/qaic: Fix possible data corruption in BOs > 2G + +From: Jeffrey Hugo + +[ Upstream commit 84a833d90635e4b846333e2df0ae72f9cbecac39 ] + +When slicing a BO, we need to iterate through the BO's sgt to find the +right pieces to construct the slice. Some of the data types chosen for +this process are incorrectly too small, and can overflow. This can +result in the incorrect slice construction, which can lead to data +corruption in workload execution. + +The device can only handle 32-bit sized transfers, and the scatterlist +struct only supports 32-bit buffer sizes, so our upper limit for an +individual transfer is an unsigned int. Using an int is incorrect due to +the reservation of the sign bit. Upgrade the length of a scatterlist +entry and the offsets into a scatterlist entry to unsigned int for a +correct representation. + +While each transfer may be limited to 32-bits, the overall BO may exceed +that size. For counting the total length of the BO, we need a type that +can represent the largest allocation possible on the system. That is the +definition of size_t, so use it. + +Fixes: ff13be830333 ("accel/qaic: Add datapath") +Signed-off-by: Jeffrey Hugo +Signed-off-by: Jeff Hugo +Reviewed-by: Lizhi Hou +Reviewed-by: Troy Hanson +Reviewed-by: Youssef Samir +Link: https://patchwork.freedesktop.org/patch/msgid/20250306171959.853466-1-jeff.hugo@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/accel/qaic/qaic_data.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c +index c20eb63750f51..ffcdf5738d099 100644 +--- a/drivers/accel/qaic/qaic_data.c ++++ b/drivers/accel/qaic/qaic_data.c +@@ -172,9 +172,10 @@ static void free_slice(struct kref *kref) + static int clone_range_of_sgt_for_slice(struct qaic_device *qdev, struct sg_table **sgt_out, + struct sg_table *sgt_in, u64 size, u64 offset) + { +- int total_len, len, nents, offf = 0, offl = 0; + struct scatterlist *sg, *sgn, *sgf, *sgl; ++ unsigned int len, nents, offf, offl; + struct sg_table *sgt; ++ size_t total_len; + int ret, j; + + /* find out number of relevant nents needed for this mem */ +@@ -182,6 +183,8 @@ static int clone_range_of_sgt_for_slice(struct qaic_device *qdev, struct sg_tabl + sgf = NULL; + sgl = NULL; + nents = 0; ++ offf = 0; ++ offl = 0; + + size = size ? size : PAGE_SIZE; + for_each_sgtable_dma_sg(sgt_in, sg, j) { +-- +2.39.5 + diff --git a/queue-6.12/arm-davinci-da850-fix-selecting-arch_davinci_da8xx.patch b/queue-6.12/arm-davinci-da850-fix-selecting-arch_davinci_da8xx.patch new file mode 100644 index 0000000000..8d19e0db58 --- /dev/null +++ b/queue-6.12/arm-davinci-da850-fix-selecting-arch_davinci_da8xx.patch @@ -0,0 +1,38 @@ +From 40c15ae791c27f8e4490c0d3c362622fc943f7a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 10:09:46 -0500 +Subject: ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX + +From: David Lechner + +[ Upstream commit 45d5fe1c53baaed1fb3043f45d1e15ebb4bbe86a ] + +Chips in the DA850 family need to have ARCH_DAVINCI_DA8XX to be selected +in order to enable some peripheral drivers. + +This was accidentally removed in a previous commit. + +Fixes: dec85a95167a ("ARM: davinci: clean up platform support") +Signed-off-by: David Lechner +Acked-by: Bartosz Golaszewski +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-davinci/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig +index 2a8a9fe46586d..3fa15f3422409 100644 +--- a/arch/arm/mach-davinci/Kconfig ++++ b/arch/arm/mach-davinci/Kconfig +@@ -27,6 +27,7 @@ config ARCH_DAVINCI_DA830 + + config ARCH_DAVINCI_DA850 + bool "DA850/OMAP-L138/AM18x based system" ++ select ARCH_DAVINCI_DA8XX + select DAVINCI_CP_INTC + + config ARCH_DAVINCI_DA8XX +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch b/queue-6.12/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch new file mode 100644 index 0000000000..cab4cc94c9 --- /dev/null +++ b/queue-6.12/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch @@ -0,0 +1,44 @@ +From e218f2335b593ad8fbee8f3d11bed4b29717ad02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Feb 2025 10:41:13 +0100 +Subject: ARM: dts: bcm2711: Don't mark timer regs unconfigured + +From: Phil Elwell + +[ Upstream commit c24f272ae751a9f54f8816430e7f2d56031892cc ] + +During upstream process of Raspberry Pi 4 back in 2019 the ARMv7 stubs +didn't configured the ARM architectural timer. This firmware issue has +been fixed in 2020, which gave users enough time to update their system. + +So drop this property to allow the use of the vDSO version of +clock_gettime. + +Link: https://github.com/raspberrypi/tools/pull/113 +Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20250222094113.48198-1-wahrenst@gmx.net +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/broadcom/bcm2711.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/broadcom/bcm2711.dtsi b/arch/arm/boot/dts/broadcom/bcm2711.dtsi +index 4fd0732a34d32..c06d9f5e53c80 100644 +--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi +@@ -451,8 +451,6 @@ IRQ_TYPE_LEVEL_LOW)>, + IRQ_TYPE_LEVEL_LOW)>, + ; +- /* This only applies to the ARMv7 stub */ +- arm,cpu-registers-not-fw-configured; + }; + + cpus: cpus { +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-bcm2711-fix-xhci-power-domain.patch b/queue-6.12/arm-dts-bcm2711-fix-xhci-power-domain.patch new file mode 100644 index 0000000000..0b58095918 --- /dev/null +++ b/queue-6.12/arm-dts-bcm2711-fix-xhci-power-domain.patch @@ -0,0 +1,71 @@ +From c3d7b9ec4beab4744ca1b8a21863f3f41c01fc11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Feb 2025 12:27:29 +0100 +Subject: ARM: dts: bcm2711: Fix xHCI power-domain + +From: Stefan Wahren + +[ Upstream commit f44fa354a0715577ca32b085f6f60bcf32c748dd ] + +During s2idle tests on the Raspberry CM4 the VPU firmware always crashes +on xHCI power-domain resume: + +root@raspberrypi:/sys/power# echo freeze > state +[ 70.724347] xhci_suspend finished +[ 70.727730] xhci_plat_suspend finished +[ 70.755624] bcm2835-power bcm2835-power: Power grafx off +[ 70.761127] USB: Set power to 0 + +[ 74.653040] USB: Failed to set power to 1 (-110) + +This seems to be caused because of the mixed usage of +raspberrypi-power and bcm2835-power at the same time. So avoid +the usage of the VPU firmware power-domain driver, which +prevents the VPU crash. + +Fixes: 522c35e08b53 ("ARM: dts: bcm2711: Add BCM2711 xHCI support") +Link: https://github.com/raspberrypi/linux/issues/6537 +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20250201112729.31509-1-wahrenst@gmx.net +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi | 5 ----- + arch/arm/boot/dts/broadcom/bcm2711.dtsi | 1 + + 2 files changed, 1 insertion(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi b/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi +index 6bf4241fe3b73..c78ed064d1667 100644 +--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi +@@ -1,7 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 + #include "bcm2835-rpi.dtsi" + +-#include + #include + + / { +@@ -101,7 +100,3 @@ &v3d { + &vchiq { + interrupts = ; + }; +- +-&xhci { +- power-domains = <&power RPI_POWER_DOMAIN_USB>; +-}; +diff --git a/arch/arm/boot/dts/broadcom/bcm2711.dtsi b/arch/arm/boot/dts/broadcom/bcm2711.dtsi +index e4e42af21ef3a..5eaec6c6a1df3 100644 +--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi +@@ -610,6 +610,7 @@ xhci: usb@7e9c0000 { + #address-cells = <1>; + #size-cells = <0>; + interrupts = ; ++ power-domains = <&pm BCM2835_POWER_DOMAIN_USB>; + /* DWC2 and this IP block share the same USB PHY, + * enabling both at the same time results in lockups. + * So keep this node disabled and let the bootloader +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch b/queue-6.12/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch new file mode 100644 index 0000000000..c375960f15 --- /dev/null +++ b/queue-6.12/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch @@ -0,0 +1,74 @@ +From 4add6d9f06102097676655be993f974bbbbb2381 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Feb 2025 13:56:13 +0100 +Subject: ARM: dts: bcm2711: PL011 UARTs are actually r1p5 + +From: Phil Elwell + +[ Upstream commit 0de09025f161f67c07978c4742e221243d070d41 ] + +The ARM PL011 UART instances in BCM2711 are r1p5 spec, which means they +have 32-entry FIFOs. The correct periphid value for this is 0x00341011. +Thanks to N Buchwitz for pointing this out. + +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20250223125614.3592-2-wahrenst@gmx.net +Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/broadcom/bcm2711.dtsi | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/broadcom/bcm2711.dtsi b/arch/arm/boot/dts/broadcom/bcm2711.dtsi +index 5eaec6c6a1df3..4fd0732a34d32 100644 +--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi +@@ -134,7 +134,7 @@ uart2: serial@7e201400 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -145,7 +145,7 @@ uart3: serial@7e201600 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -156,7 +156,7 @@ uart4: serial@7e201800 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -167,7 +167,7 @@ uart5: serial@7e201a00 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -1178,6 +1178,7 @@ &txp { + }; + + &uart0 { ++ arm,primecell-periphid = <0x00341011>; + interrupts = ; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch b/queue-6.12/arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch new file mode 100644 index 0000000000..ff0d863ca1 --- /dev/null +++ b/queue-6.12/arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch @@ -0,0 +1,57 @@ +From 522c351e720a3d0e363fa4fdfe4df274f2d1b9bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 13:06:50 +0000 +Subject: ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 + +From: Chester A. Unal + +[ Upstream commit 56e12d0c8d395b6e48f128858d4f725c1ded6c95 ] + +After using the device for a while, Tom reports that he initially described +the switch port labels incorrectly. Correct them. + +Reported-by: Tom Brautaset +Fixes: 961dedc6b4e4 ("ARM: dts: BCM5301X: Add DT for ASUS RT-AC5300") +Signed-off-by: Chester A. Unal +Link: https://lore.kernel.org/r/20250303-for-broadcom-fix-rt-ac5300-switch-ports-v1-1-e058856ef4d3@arinc9.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts b/arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts +index 6c666dc7ad23e..01ec8c03686a6 100644 +--- a/arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts ++++ b/arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts +@@ -126,11 +126,11 @@ &srab { + + ports { + port@0 { +- label = "lan4"; ++ label = "wan"; + }; + + port@1 { +- label = "lan3"; ++ label = "lan1"; + }; + + port@2 { +@@ -138,11 +138,11 @@ port@2 { + }; + + port@3 { +- label = "lan1"; ++ label = "lan3"; + }; + + port@4 { +- label = "wan"; ++ label = "lan4"; + }; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch-8866 b/queue-6.12/arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch-8866 new file mode 100644 index 0000000000..b00c015b0a --- /dev/null +++ b/queue-6.12/arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch-8866 @@ -0,0 +1,54 @@ +From 6e2666b600ac9badade16d506b0e9c582877bcdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Mar 2025 15:55:36 +0000 +Subject: ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 + +From: Chester A. Unal + +[ Upstream commit 24d4c56dd68906bf55ff8fc2e2d36760f97dce5f ] + +After using the device for a while, Tom reports that he initially described +the switch port labels incorrectly. Apparently, ASUS's own firmware also +describes them incorrectly. Correct them to what is seen on the chassis. + +Reported-by: Tom Brautaset +Fixes: b116239094d8 ("ARM: dts: BCM5301X: Add DT for ASUS RT-AC3200") +Signed-off-by: Chester A. Unal +Link: https://lore.kernel.org/r/20250304-for-broadcom-fix-rt-ac3200-switch-ports-v1-1-7e249a19a13e@arinc9.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts b/arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts +index 53cb0c58f6d05..3da2daee0c849 100644 +--- a/arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts ++++ b/arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts +@@ -124,19 +124,19 @@ port@0 { + }; + + port@1 { +- label = "lan1"; ++ label = "lan4"; + }; + + port@2 { +- label = "lan2"; ++ label = "lan3"; + }; + + port@3 { +- label = "lan3"; ++ label = "lan2"; + }; + + port@4 { +- label = "lan4"; ++ label = "lan1"; + }; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm-omap1-select-config_generic_irq_chip.patch b/queue-6.12/arm-omap1-select-config_generic_irq_chip.patch new file mode 100644 index 0000000000..72fdcb0a0b --- /dev/null +++ b/queue-6.12/arm-omap1-select-config_generic_irq_chip.patch @@ -0,0 +1,46 @@ +From 00ecd83a128fee441dbb69b0cc7577efcae25309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 13:11:33 +0100 +Subject: ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP + +From: Arnd Bergmann + +[ Upstream commit 98f3ab18a0a55aa1ff2cd6b74bd0c02c8f76f17e ] + +When GENERIC_IRQ_CHIP is disabled, OMAP1 kernels fail to link: + +arm-linux-gnueabi-ld: arch/arm/mach-omap1/irq.o: in function `omap1_init_irq': +irq.c:(.init.text+0x1e8): undefined reference to `irq_alloc_generic_chip' +arm-linux-gnueabi-ld: irq.c:(.init.text+0x228): undefined reference to `irq_setup_generic_chip' +arm-linux-gnueabi-ld: irq.c:(.init.text+0x2a8): undefined reference to `irq_gc_set_wake' +arm-linux-gnueabi-ld: irq.c:(.init.text+0x2b0): undefined reference to `irq_gc_mask_set_bit' +arm-linux-gnueabi-ld: irq.c:(.init.text+0x2b4): undefined reference to `irq_gc_mask_clr_bit' + +This has apparently been the case for many years, but I never caught it +in randconfig builds until now, as there are dozens of other drivers +that also 'select GENERIC_IRQ_CHIP' and statistically there is almost +always one of them enabled. + +Fixes: 55b447744389 ("ARM: OMAP1: Switch to use generic irqchip in preparation for sparse IRQ") +Link: https://lore.kernel.org/r/20250205121151.289535-1-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap1/Kconfig b/arch/arm/mach-omap1/Kconfig +index a643b71e30a35..08ec6bd84ada5 100644 +--- a/arch/arm/mach-omap1/Kconfig ++++ b/arch/arm/mach-omap1/Kconfig +@@ -8,6 +8,7 @@ menuconfig ARCH_OMAP1 + select ARCH_OMAP + select CLKSRC_MMIO + select FORCE_PCI if PCCARD ++ select GENERIC_IRQ_CHIP + select GPIOLIB + help + Support for older TI OMAP1 (omap7xx, omap15xx or omap16xx) +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-bcm2712-pl011-uarts-are-actually-r1p5.patch b/queue-6.12/arm64-dts-bcm2712-pl011-uarts-are-actually-r1p5.patch new file mode 100644 index 0000000000..bcf5e870b4 --- /dev/null +++ b/queue-6.12/arm64-dts-bcm2712-pl011-uarts-are-actually-r1p5.patch @@ -0,0 +1,39 @@ +From dc6a76c1e82be77d34e3107b0003f1b3b41b58cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Feb 2025 13:56:14 +0100 +Subject: arm64: dts: bcm2712: PL011 UARTs are actually r1p5 + +From: Phil Elwell + +[ Upstream commit 768953614c1c13fdf771be5742f1be573eea8fa4 ] + +The ARM PL011 UART instances in BCM2712 are r1p5 spec, which means they +have 32-entry FIFOs. The correct periphid value for this is 0x00341011. +Thanks to N Buchwitz for pointing this out. + +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20250223125614.3592-3-wahrenst@gmx.net +Fixes: faa3381267d0 ("arm64: dts: broadcom: Add minimal support for Raspberry Pi 5") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi +index 26a29e5e5078d..447bfa060918c 100644 +--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi +@@ -232,7 +232,7 @@ uart10: serial@7d001000 { + interrupts = ; + clocks = <&clk_uart>, <&clk_vpu>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch b/queue-6.12/arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch new file mode 100644 index 0000000000..7addfe41ef --- /dev/null +++ b/queue-6.12/arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch @@ -0,0 +1,63 @@ +From c961aa2dfc4c9e43298f8d53c016d5bb75e1b3e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 16:03:09 +0100 +Subject: arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply + +From: Alexander Stein + +[ Upstream commit 38f59e0e8bd2b3e1319716e4aeaeb9a6223b006d ] + +eMMC is supplied by BUCK5 rail. Use the actual regulator instead of +a virtual fixed regulator. + +Fixes: 418d1d840e421 ("arm64: dts: freescale: add initial device tree for TQMa8MPQL with i.MX8MP") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/freescale/imx8mp-tqma8mpql.dtsi | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi +index 336785a9fba89..3ddc5aaa7c5f0 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi +@@ -1,7 +1,8 @@ + // SPDX-License-Identifier: GPL-2.0-or-later OR MIT + /* +- * Copyright 2021-2022 TQ-Systems GmbH +- * Author: Alexander Stein ++ * Copyright 2021-2025 TQ-Systems GmbH , ++ * D-82229 Seefeld, Germany. ++ * Author: Alexander Stein + */ + + #include "imx8mp.dtsi" +@@ -23,15 +24,6 @@ reg_vcc3v3: regulator-vcc3v3 { + regulator-max-microvolt = <3300000>; + regulator-always-on; + }; +- +- /* e-MMC IO, needed for HS modes */ +- reg_vcc1v8: regulator-vcc1v8 { +- compatible = "regulator-fixed"; +- regulator-name = "VCC1V8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- regulator-always-on; +- }; + }; + + &A53_0 { +@@ -197,7 +189,7 @@ &usdhc3 { + no-sd; + no-sdio; + vmmc-supply = <®_vcc3v3>; +- vqmmc-supply = <®_vcc1v8>; ++ vqmmc-supply = <&buck5_reg>; + status = "okay"; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-rockchip-remove-supports-cqe-from-rk3588-j.patch b/queue-6.12/arm64-dts-rockchip-remove-supports-cqe-from-rk3588-j.patch new file mode 100644 index 0000000000..f6a3b810a7 --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-remove-supports-cqe-from-rk3588-j.patch @@ -0,0 +1,45 @@ +From 472d41503f84b8f50f700c1d2c50e90d1c589b0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 10:33:02 +0100 +Subject: arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar + +From: Heiko Stuebner + +[ Upstream commit 304b0a60d38dc24bfbfc9adc7d254d1cf8f98317 ] + +The sdhci controller supports cqe it seems and necessary code also is in +place - in theory. + +At this point Jaguar and Tiger are the only boards enabling cqe support +on the rk3588 and we are seeing reliability issues under load. + +This can be caused by either a controller-, hw- or driver-issue and +definitly needs more investigation to work properly it seems. + +So disable cqe support on Jaguar for now. + +Fixes: d1b8b36a2cc5 ("arm64: dts: rockchip: add Theobroma Jaguar SBC") +Signed-off-by: Heiko Stuebner +Reviewed-by: Quentin Schulz +Link: https://lore.kernel.org/r/20250219093303.2320517-1-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts b/arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts +index 31d2f8994f851..e61c5731fb99f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts +@@ -455,7 +455,6 @@ &sdhci { + non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&emmc_bus8 &emmc_cmd &emmc_clk &emmc_data_strobe>; +- supports-cqe; + vmmc-supply = <&vcc_3v3_s3>; + vqmmc-supply = <&vcc_1v8_s3>; + status = "okay"; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-rockchip-remove-supports-cqe-from-rk3588-t.patch b/queue-6.12/arm64-dts-rockchip-remove-supports-cqe-from-rk3588-t.patch new file mode 100644 index 0000000000..f66c772c2b --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-remove-supports-cqe-from-rk3588-t.patch @@ -0,0 +1,45 @@ +From d98023ec2b0ef50d4c2c0a92f0309d9e003a79da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 10:33:03 +0100 +Subject: arm64: dts: rockchip: remove supports-cqe from rk3588 tiger + +From: Heiko Stuebner + +[ Upstream commit 3e0711f89e5e7b0c7b2ab4843dc92dcbbdbba777 ] + +The sdhci controller supports cqe it seems and necessary code also is in +place - in theory. + +At this point Jaguar and Tiger are the only boards enabling cqe support +on the rk3588 and we are seeing reliability issues under load. + +This can be caused by either a controller-, hw- or driver-issue and +definitly needs more investigation to work properly it seems. + +So disable cqe support on Tiger for now. + +Fixes: 6173ef24b35b ("arm64: dts: rockchip: add RK3588-Q7 (Tiger) SoM") +Signed-off-by: Heiko Stuebner +Reviewed-by: Quentin Schulz +Link: https://lore.kernel.org/r/20250219093303.2320517-2-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi +index 615094bb8ba38..a82fe75bda55c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi +@@ -367,7 +367,6 @@ &sdhci { + non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&emmc_bus8 &emmc_cmd &emmc_clk &emmc_data_strobe>; +- supports-cqe; + vmmc-supply = <&vcc_3v3_s3>; + vqmmc-supply = <&vcc_1v8_s3>; + status = "okay"; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-rockchip-remove-undocumented-sdmmc-propert.patch b/queue-6.12/arm64-dts-rockchip-remove-undocumented-sdmmc-propert.patch new file mode 100644 index 0000000000..8ba054c3cc --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-remove-undocumented-sdmmc-propert.patch @@ -0,0 +1,42 @@ +From 593af9a0b8af8580ce242632bb28eda42fdf7950 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Feb 2025 16:31:18 +0000 +Subject: arm64: dts: rockchip: Remove undocumented sdmmc property from + lubancat-1 + +From: Yao Zi + +[ Upstream commit 43c854c65e47d2f3763345683b06257b4d12e4e3 ] + +Property "supports-sd" isn't documented anywhere and is unnecessary for +mainline driver to function. It seems a property used by downstream +kernel was brought into mainline. + +This should be reported by dtbs_check, but mmc-controller-common.yaml +defaults additionalProperties to true thus allows it. Remove the +property to clean the devicetree up and avoid possible confusion. + +Fixes: 8d94da58de53 ("arm64: dts: rockchip: Add EmbedFire LubanCat 1") +Signed-off-by: Yao Zi +Link: https://lore.kernel.org/r/20250228163117.47318-2-ziyao@disroot.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts +index 9a2f59a351dee..48ccdd6b47118 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts +@@ -512,7 +512,6 @@ &sdhci { + + &sdmmc0 { + max-frequency = <150000000>; +- supports-sd; + bus-width = <4>; + cap-mmc-highspeed; + cap-sd-highspeed; +-- +2.39.5 + diff --git a/queue-6.12/ata-libata-core-add-ata_quirk_no_lpm_on_ati-for-cert.patch b/queue-6.12/ata-libata-core-add-ata_quirk_no_lpm_on_ati-for-cert.patch new file mode 100644 index 0000000000..d6459eb334 --- /dev/null +++ b/queue-6.12/ata-libata-core-add-ata_quirk_no_lpm_on_ati-for-cert.patch @@ -0,0 +1,116 @@ +From 9c5c5abeee5592dd7a2780db702fe75f489194f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Mar 2025 18:03:49 +0100 +Subject: ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung + SSDs + +From: Niklas Cassel + +[ Upstream commit f2aac4c73c9945cce156fd58a9a2f31f2c8a90c7 ] + +Before commit 7627a0edef54 ("ata: ahci: Drop low power policy board type") +the ATI AHCI controllers specified board type 'board_ahci' rather than +board type 'board_ahci'. This means that LPM was historically not enabled +for the ATI AHCI controllers. + +By looking at commit 7a8526a5cd51 ("libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI +for Samsung 860 and 870 SSD."), it is clear that, for some unknown reason, +that Samsung SSDs do not play nice with ATI AHCI controllers. (When using +other AHCI controllers, NCQ can be enabled on these Samsung SSDs without +issues.) + +In a similar way, from user reports, it is clear the ATI AHCI controllers +can enable LPM on e.g. Maxtor HDDs perfectly fine, but when enabling LPM +on certain Samsung SSDs, things break. (E.g. the SSDs will not get detected +by the ATI AHCI controller even after a COMRESET.) + +Yet, when using LPM on these Samsung SSDs with other AHCI controllers, e.g. +Intel AHCI controllers, these Samsung drives appear to work perfectly fine. + +Considering that the combination of ATI + Samsung, for some unknown reason, +does not seem to work well, disable LPM when detecting an ATI AHCI +controller with a problematic Samsung SSD. + +Apply this new ATA_QUIRK_NO_LPM_ON_ATI quirk for all Samsung SSDs that have +already been reported to not play nice with ATI (ATA_QUIRK_NO_NCQ_ON_ATI). + +Fixes: 7627a0edef54 ("ata: ahci: Drop low power policy board type") +Suggested-by: Hans de Goede +Reported-by: Eric +Closes: https://lore.kernel.org/linux-ide/Z8SBZMBjvVXA7OAK@eldamar.lan/ +Tested-by: Eric +Reviewed-by: Damien Le Moal +Link: https://lore.kernel.org/r/20250317170348.1748671-2-cassel@kernel.org +Signed-off-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 14 +++++++++++--- + include/linux/libata.h | 2 ++ + 2 files changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index c085dd81ebe7f..d956735e2a764 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2845,6 +2845,10 @@ int ata_dev_configure(struct ata_device *dev) + (id[ATA_ID_SATA_CAPABILITY] & 0xe) == 0x2) + dev->quirks |= ATA_QUIRK_NOLPM; + ++ if (dev->quirks & ATA_QUIRK_NO_LPM_ON_ATI && ++ ata_dev_check_adapter(dev, PCI_VENDOR_ID_ATI)) ++ dev->quirks |= ATA_QUIRK_NOLPM; ++ + if (ap->flags & ATA_FLAG_NO_LPM) + dev->quirks |= ATA_QUIRK_NOLPM; + +@@ -3897,6 +3901,7 @@ static const char * const ata_quirk_names[] = { + [__ATA_QUIRK_MAX_SEC_1024] = "maxsec1024", + [__ATA_QUIRK_MAX_TRIM_128M] = "maxtrim128m", + [__ATA_QUIRK_NO_NCQ_ON_ATI] = "noncqonati", ++ [__ATA_QUIRK_NO_LPM_ON_ATI] = "nolpmonati", + [__ATA_QUIRK_NO_ID_DEV_LOG] = "noiddevlog", + [__ATA_QUIRK_NO_LOG_DIR] = "nologdir", + [__ATA_QUIRK_NO_FUA] = "nofua", +@@ -4142,13 +4147,16 @@ static const struct ata_dev_quirks_entry __ata_dev_quirks[] = { + ATA_QUIRK_ZERO_AFTER_TRIM }, + { "Samsung SSD 860*", NULL, ATA_QUIRK_NO_NCQ_TRIM | + ATA_QUIRK_ZERO_AFTER_TRIM | +- ATA_QUIRK_NO_NCQ_ON_ATI }, ++ ATA_QUIRK_NO_NCQ_ON_ATI | ++ ATA_QUIRK_NO_LPM_ON_ATI }, + { "Samsung SSD 870*", NULL, ATA_QUIRK_NO_NCQ_TRIM | + ATA_QUIRK_ZERO_AFTER_TRIM | +- ATA_QUIRK_NO_NCQ_ON_ATI }, ++ ATA_QUIRK_NO_NCQ_ON_ATI | ++ ATA_QUIRK_NO_LPM_ON_ATI }, + { "SAMSUNG*MZ7LH*", NULL, ATA_QUIRK_NO_NCQ_TRIM | + ATA_QUIRK_ZERO_AFTER_TRIM | +- ATA_QUIRK_NO_NCQ_ON_ATI, }, ++ ATA_QUIRK_NO_NCQ_ON_ATI | ++ ATA_QUIRK_NO_LPM_ON_ATI }, + { "FCCT*M500*", NULL, ATA_QUIRK_NO_NCQ_TRIM | + ATA_QUIRK_ZERO_AFTER_TRIM }, + +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 9b4a6ff03235b..79974a99265fc 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -88,6 +88,7 @@ enum ata_quirks { + __ATA_QUIRK_MAX_SEC_1024, /* Limit max sects to 1024 */ + __ATA_QUIRK_MAX_TRIM_128M, /* Limit max trim size to 128M */ + __ATA_QUIRK_NO_NCQ_ON_ATI, /* Disable NCQ on ATI chipset */ ++ __ATA_QUIRK_NO_LPM_ON_ATI, /* Disable LPM on ATI chipset */ + __ATA_QUIRK_NO_ID_DEV_LOG, /* Identify device log missing */ + __ATA_QUIRK_NO_LOG_DIR, /* Do not read log directory */ + __ATA_QUIRK_NO_FUA, /* Do not use FUA */ +@@ -434,6 +435,7 @@ enum { + ATA_QUIRK_MAX_SEC_1024 = (1U << __ATA_QUIRK_MAX_SEC_1024), + ATA_QUIRK_MAX_TRIM_128M = (1U << __ATA_QUIRK_MAX_TRIM_128M), + ATA_QUIRK_NO_NCQ_ON_ATI = (1U << __ATA_QUIRK_NO_NCQ_ON_ATI), ++ ATA_QUIRK_NO_LPM_ON_ATI = (1U << __ATA_QUIRK_NO_LPM_ON_ATI), + ATA_QUIRK_NO_ID_DEV_LOG = (1U << __ATA_QUIRK_NO_ID_DEV_LOG), + ATA_QUIRK_NO_LOG_DIR = (1U << __ATA_QUIRK_NO_LOG_DIR), + ATA_QUIRK_NO_FUA = (1U << __ATA_QUIRK_NO_FUA), +-- +2.39.5 + diff --git a/queue-6.12/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch b/queue-6.12/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch new file mode 100644 index 0000000000..2b55decf5d --- /dev/null +++ b/queue-6.12/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch @@ -0,0 +1,45 @@ +From 2d491754004e9738b74f6591c0e6d440aef591fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 22:46:56 +0300 +Subject: Bluetooth: Fix error code in chan_alloc_skb_cb() + +From: Dan Carpenter + +[ Upstream commit 72d061ee630d0dbb45c2920d8d19b3861c413e54 ] + +The chan_alloc_skb_cb() function is supposed to return error pointers on +error. Returning NULL will lead to a NULL dereference. + +Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one") +Signed-off-by: Dan Carpenter +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/6lowpan.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c +index 50cfec8ccac4f..3c29778171c58 100644 +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -825,11 +825,16 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan, + unsigned long hdr_len, + unsigned long len, int nb) + { ++ struct sk_buff *skb; ++ + /* Note that we must allocate using GFP_ATOMIC here as + * this function is called originally from netdev hard xmit + * function in atomic context. + */ +- return bt_skb_alloc(hdr_len + len, GFP_ATOMIC); ++ skb = bt_skb_alloc(hdr_len + len, GFP_ATOMIC); ++ if (!skb) ++ return ERR_PTR(-ENOMEM); ++ return skb; + } + + static void chan_suspend_cb(struct l2cap_chan *chan) +-- +2.39.5 + diff --git a/queue-6.12/bluetooth-hci_event-fix-connection-regression-betwee.patch b/queue-6.12/bluetooth-hci_event-fix-connection-regression-betwee.patch new file mode 100644 index 0000000000..3e7cb51027 --- /dev/null +++ b/queue-6.12/bluetooth-hci_event-fix-connection-regression-betwee.patch @@ -0,0 +1,39 @@ +From ecbda9e27e8df9e51e2e5171f080c9cb1432c2ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 20:09:43 +0100 +Subject: Bluetooth: hci_event: Fix connection regression between LE and non-LE + adapters + +From: Arkadiusz Bokowy + +[ Upstream commit f6685a96c8c8a07e260e39bac86d4163cfb38a4d ] + +Due to a typo during defining HCI errors it is not possible to connect +LE-capable device with BR/EDR only adapter. The connection is terminated +by the LE adapter because the invalid LL params error code is treated +as unsupported remote feature. + +Fixes: 79c0868ad65a ("Bluetooth: hci_event: Use HCI error defines instead of magic values") +Signed-off-by: Arkadiusz Bokowy +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index 5bb4eaa52e14c..dd10e02bfc746 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -683,7 +683,7 @@ enum { + #define HCI_ERROR_REMOTE_POWER_OFF 0x15 + #define HCI_ERROR_LOCAL_HOST_TERM 0x16 + #define HCI_ERROR_PAIRING_NOT_ALLOWED 0x18 +-#define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE 0x1e ++#define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE 0x1a + #define HCI_ERROR_INVALID_LL_PARAMS 0x1e + #define HCI_ERROR_UNSPECIFIED 0x1f + #define HCI_ERROR_ADVERTISING_TIMEOUT 0x3c +-- +2.39.5 + diff --git a/queue-6.12/devlink-fix-xa_alloc_cyclic-error-handling.patch b/queue-6.12/devlink-fix-xa_alloc_cyclic-error-handling.patch new file mode 100644 index 0000000000..921e083add --- /dev/null +++ b/queue-6.12/devlink-fix-xa_alloc_cyclic-error-handling.patch @@ -0,0 +1,43 @@ +From 2298ba717880e3766dc4a1af9a21a68c84014016 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 10:52:49 +0100 +Subject: devlink: fix xa_alloc_cyclic() error handling + +From: Michal Swiatkowski + +[ Upstream commit f3b97b7d4bf316c3991e5634c9f4847c2df35478 ] + +In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will +be returned, which will cause IS_ERR() to be false. Which can lead to +dereference not allocated pointer (rel). + +Fix it by checking if err is lower than zero. + +This wasn't found in real usecase, only noticed. Credit to Pierre. + +Fixes: c137743bce02 ("devlink: introduce object and nested devlink relationship infra") +Signed-off-by: Michal Swiatkowski +Reviewed-by: Andrew Lunn +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/devlink/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/devlink/core.c b/net/devlink/core.c +index f49cd83f1955f..7203c39532fcc 100644 +--- a/net/devlink/core.c ++++ b/net/devlink/core.c +@@ -117,7 +117,7 @@ static struct devlink_rel *devlink_rel_alloc(void) + + err = xa_alloc_cyclic(&devlink_rels, &rel->index, rel, + xa_limit_32b, &next, GFP_KERNEL); +- if (err) { ++ if (err < 0) { + kfree(rel); + return ERR_PTR(err); + } +-- +2.39.5 + diff --git a/queue-6.12/dma-mapping-fix-missing-clear-bdr-in-check_ram_in_ra.patch b/queue-6.12/dma-mapping-fix-missing-clear-bdr-in-check_ram_in_ra.patch new file mode 100644 index 0000000000..3b422af6b2 --- /dev/null +++ b/queue-6.12/dma-mapping-fix-missing-clear-bdr-in-check_ram_in_ra.patch @@ -0,0 +1,79 @@ +From 88383fa19ffdcdf4f59a19a2a0cf417f2d62fd91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Mar 2025 11:03:50 +0800 +Subject: dma-mapping: fix missing clear bdr in check_ram_in_range_map() + +From: Baochen Qiang + +[ Upstream commit 8324993f60305e50f27b98358b01b9837e10d159 ] + +As discussed in [1], if 'bdr' is set once, it would never get +cleared, hence 0 is always returned. + +Refactor the range check hunk into a new helper dma_find_range(), +which allows 'bdr' to be cleared in each iteration. + +Link: https://lore.kernel.org/all/64931fac-085b-4ff3-9314-84bac2fa9bdb@quicinc.com/ # [1] +Fixes: a409d9600959 ("dma-mapping: fix dma_addressing_limited() if dma_range_map can't cover all system RAM") +Suggested-by: Christoph Hellwig +Signed-off-by: Baochen Qiang +Link: https://lore.kernel.org/r/20250307030350.69144-1-quic_bqiang@quicinc.com +Signed-off-by: Marek Szyprowski +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 5b4e6d3bf7bcc..b8fe0b3d0ffb6 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -584,6 +584,22 @@ int dma_direct_supported(struct device *dev, u64 mask) + return mask >= phys_to_dma_unencrypted(dev, min_mask); + } + ++static const struct bus_dma_region *dma_find_range(struct device *dev, ++ unsigned long start_pfn) ++{ ++ const struct bus_dma_region *m; ++ ++ for (m = dev->dma_range_map; PFN_DOWN(m->size); m++) { ++ unsigned long cpu_start_pfn = PFN_DOWN(m->cpu_start); ++ ++ if (start_pfn >= cpu_start_pfn && ++ start_pfn - cpu_start_pfn < PFN_DOWN(m->size)) ++ return m; ++ } ++ ++ return NULL; ++} ++ + /* + * To check whether all ram resource ranges are covered by dma range map + * Returns 0 when further check is needed +@@ -593,20 +609,12 @@ static int check_ram_in_range_map(unsigned long start_pfn, + unsigned long nr_pages, void *data) + { + unsigned long end_pfn = start_pfn + nr_pages; +- const struct bus_dma_region *bdr = NULL; +- const struct bus_dma_region *m; + struct device *dev = data; + + while (start_pfn < end_pfn) { +- for (m = dev->dma_range_map; PFN_DOWN(m->size); m++) { +- unsigned long cpu_start_pfn = PFN_DOWN(m->cpu_start); ++ const struct bus_dma_region *bdr; + +- if (start_pfn >= cpu_start_pfn && +- start_pfn - cpu_start_pfn < PFN_DOWN(m->size)) { +- bdr = m; +- break; +- } +- } ++ bdr = dma_find_range(dev, start_pfn); + if (!bdr) + return 1; + +-- +2.39.5 + diff --git a/queue-6.12/dpll-fix-xa_alloc_cyclic-error-handling.patch b/queue-6.12/dpll-fix-xa_alloc_cyclic-error-handling.patch new file mode 100644 index 0000000000..344c6a1448 --- /dev/null +++ b/queue-6.12/dpll-fix-xa_alloc_cyclic-error-handling.patch @@ -0,0 +1,44 @@ +From 841f69df56953abd557e4164410396d1bbfda142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 10:52:50 +0100 +Subject: dpll: fix xa_alloc_cyclic() error handling + +From: Michal Swiatkowski + +[ Upstream commit 3614bf90130d60f191a5fe218d04f6251c678e13 ] + +In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will +be returned, which will cause IS_ERR() to be false. Which can lead to +dereference not allocated pointer (pin). + +Fix it by checking if err is lower than zero. + +This wasn't found in real usecase, only noticed. Credit to Pierre. + +Fixes: 97f265ef7f5b ("dpll: allocate pin ids in cycle") +Signed-off-by: Michal Swiatkowski +Reviewed-by: Vadim Fedorenko +Reviewed-by: Arkadiusz Kubalewski +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/dpll/dpll_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c +index 32019dc33cca7..1877201d1aa9f 100644 +--- a/drivers/dpll/dpll_core.c ++++ b/drivers/dpll/dpll_core.c +@@ -505,7 +505,7 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module, + xa_init_flags(&pin->parent_refs, XA_FLAGS_ALLOC); + ret = xa_alloc_cyclic(&dpll_pin_xa, &pin->id, pin, xa_limit_32b, + &dpll_pin_xa_id, GFP_KERNEL); +- if (ret) ++ if (ret < 0) + goto err_xa_alloc; + return pin; + err_xa_alloc: +-- +2.39.5 + diff --git a/queue-6.12/firmware-imx-scu-fix-of-node-leak-in-.probe.patch b/queue-6.12/firmware-imx-scu-fix-of-node-leak-in-.probe.patch new file mode 100644 index 0000000000..880c803c9d --- /dev/null +++ b/queue-6.12/firmware-imx-scu-fix-of-node-leak-in-.probe.patch @@ -0,0 +1,36 @@ +From b4647f1b0c802975a6032609d501ad922e20b69e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:34:56 +0900 +Subject: firmware: imx-scu: fix OF node leak in .probe() + +From: Joe Hattori + +[ Upstream commit fbf10b86f6057cf79300720da4ea4b77e6708b0d ] + +imx_scu_probe() calls of_parse_phandle_with_args(), but does not +release the OF node reference obtained by it. Add a of_node_put() call +after done with the node. + +Fixes: f25a066d1a07 ("firmware: imx-scu: Support one TX and one RX") +Signed-off-by: Joe Hattori +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/imx-scu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/imx/imx-scu.c b/drivers/firmware/imx/imx-scu.c +index 1dd4362ef9a3f..8c28e25ddc8a6 100644 +--- a/drivers/firmware/imx/imx-scu.c ++++ b/drivers/firmware/imx/imx-scu.c +@@ -280,6 +280,7 @@ static int imx_scu_probe(struct platform_device *pdev) + return ret; + + sc_ipc->fast_ipc = of_device_is_compatible(args.np, "fsl,imx8-mu-scu"); ++ of_node_put(args.np); + + num_channel = sc_ipc->fast_ipc ? 2 : SCU_MU_CHAN_NUM; + for (i = 0; i < num_channel; i++) { +-- +2.39.5 + diff --git a/queue-6.12/firmware-qcom-scm-fix-error-code-in-probe.patch b/queue-6.12/firmware-qcom-scm-fix-error-code-in-probe.patch new file mode 100644 index 0000000000..4016884e9b --- /dev/null +++ b/queue-6.12/firmware-qcom-scm-fix-error-code-in-probe.patch @@ -0,0 +1,40 @@ +From 142c20afd5c0231d432ee016d20859c0fa4e7640 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 09:52:53 +0300 +Subject: firmware: qcom: scm: Fix error code in probe() + +From: Dan Carpenter + +[ Upstream commit 7f048b202333b967782a98aa21bb3354dc379bbf ] + +Set the error code if devm_qcom_tzmem_pool_new() fails. Don't return +success. + +Fixes: 1e76b546e6fc ("firmware: qcom: scm: Cleanup global '__scm' on probe failures") +Signed-off-by: Dan Carpenter +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/a0845467-4f83-4070-ab1e-ff7e6764609f@stanley.mountain +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom/qcom_scm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c +index 2e093c39b610a..23aefbf6fca58 100644 +--- a/drivers/firmware/qcom/qcom_scm.c ++++ b/drivers/firmware/qcom/qcom_scm.c +@@ -2054,8 +2054,8 @@ static int qcom_scm_probe(struct platform_device *pdev) + + __scm->mempool = devm_qcom_tzmem_pool_new(__scm->dev, &pool_config); + if (IS_ERR(__scm->mempool)) { +- dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool), +- "Failed to create the SCM memory pool\n"); ++ ret = dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool), ++ "Failed to create the SCM memory pool\n"); + goto err; + } + +-- +2.39.5 + diff --git a/queue-6.12/gpu-host1x-do-not-assume-that-a-null-domain-means-no.patch b/queue-6.12/gpu-host1x-do-not-assume-that-a-null-domain-means-no.patch new file mode 100644 index 0000000000..6aa2abecfc --- /dev/null +++ b/queue-6.12/gpu-host1x-do-not-assume-that-a-null-domain-means-no.patch @@ -0,0 +1,63 @@ +From e16eeaae05e2abf18e53f72b70c158c81c1010e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Feb 2025 15:18:19 -0400 +Subject: gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU + +From: Jason Gunthorpe + +[ Upstream commit cb83f4b965a66d85e9a03621ef3b22c044f4a033 ] + +Previously with tegra-smmu, even with CONFIG_IOMMU_DMA, the default domain +could have been left as NULL. The NULL domain is specially recognized by +host1x_iommu_attach() as meaning it is not the DMA domain and +should be replaced with the special shared domain. + +This happened prior to the below commit because tegra-smmu was using the +NULL domain to mean IDENTITY. + +Now that the domain is properly labled the test in DRM doesn't see NULL. +Check for IDENTITY as well to enable the special domains. + +This is the same issue and basic fix as seen in +commit fae6e669cdc5 ("drm/tegra: Do not assume that a NULL domain means no +DMA IOMMU"). + +Fixes: c8cc2655cc6c ("iommu/tegra-smmu: Implement an IDENTITY domain") +Reported-by: Diogo Ivo +Closes: https://lore.kernel.org/all/c6a6f114-3acd-4d56-a13b-b88978e927dc@tecnico.ulisboa.pt/ +Tested-by: Diogo Ivo +Signed-off-by: Jason Gunthorpe +Signed-off-by: Thierry Reding +Link: https://patchwork.freedesktop.org/patch/msgid/0-v1-10dcc8ce3869+3a7-host1x_identity_jgg@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/dev.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c +index 710674ef40a97..3f23a7d91519f 100644 +--- a/drivers/gpu/host1x/dev.c ++++ b/drivers/gpu/host1x/dev.c +@@ -367,6 +367,10 @@ static bool host1x_wants_iommu(struct host1x *host1x) + return true; + } + ++/* ++ * Returns ERR_PTR on failure, NULL if the translation is IDENTITY, otherwise a ++ * valid paging domain. ++ */ + static struct iommu_domain *host1x_iommu_attach(struct host1x *host) + { + struct iommu_domain *domain = iommu_get_domain_for_dev(host->dev); +@@ -391,6 +395,8 @@ static struct iommu_domain *host1x_iommu_attach(struct host1x *host) + * Similarly, if host1x is already attached to an IOMMU (via the DMA + * API), don't try to attach again. + */ ++ if (domain && domain->type == IOMMU_DOMAIN_IDENTITY) ++ domain = NULL; + if (!host1x_wants_iommu(host) || domain) + return domain; + +-- +2.39.5 + diff --git a/queue-6.12/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch b/queue-6.12/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch new file mode 100644 index 0000000000..5e59eaccd8 --- /dev/null +++ b/queue-6.12/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch @@ -0,0 +1,49 @@ +From e29cdeb5aa2a0643d33373547ba78897d11db012 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 18:03:25 -0700 +Subject: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). + +From: Kuniyuki Iwashima + +[ Upstream commit 9740890ee20e01f99ff1dde84c63dcf089fabb98 ] + +fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything +when it fails. + +Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") +moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init() +but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in +case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak. + +Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the +error path. + +Note that we can remove the fib6_nh_release() call in nh_create_ipv6() +later in net-next.git. + +Fixes: 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20250312010333.56001-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 2736dea77575b..e9a30978abac1 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -3644,7 +3644,8 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh, + in6_dev_put(idev); + + if (err) { +- lwtstate_put(fib6_nh->fib_nh_lws); ++ fib_nh_common_release(&fib6_nh->nh_common); ++ fib6_nh->nh_common.nhc_pcpu_rth_output = NULL; + fib6_nh->fib_nh_lws = NULL; + netdev_put(dev, dev_tracker); + } +-- +2.39.5 + diff --git a/queue-6.12/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch b/queue-6.12/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch new file mode 100644 index 0000000000..0f4d35ba01 --- /dev/null +++ b/queue-6.12/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch @@ -0,0 +1,57 @@ +From fa0958d43a6d88a015f2f1209aae3ef0024ea5a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 18:38:48 -0700 +Subject: ipv6: Set errno after ip_fib_metrics_init() in + ip6_route_info_create(). + +From: Kuniyuki Iwashima + +[ Upstream commit 9a81fc3480bf5dbe2bf80e278c440770f6ba2692 ] + +While creating a new IPv6, we could get a weird -ENOMEM when +RTA_NH_ID is set and either of the conditions below is true: + + 1) CONFIG_IPV6_SUBTREES is enabled and rtm_src_len is specified + 2) nexthop_get() fails + +e.g.) + + # strace ip -6 route add fe80::dead:beef:dead:beef nhid 1 from :: + recvmsg(3, {msg_iov=[{iov_base=[...[ + {error=-ENOMEM, msg=[... [...]]}, + [{nla_len=49, nla_type=NLMSGERR_ATTR_MSG}, "Nexthops can not be used with so"...] + ]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 148 + +Let's set err explicitly after ip_fib_metrics_init() in +ip6_route_info_create(). + +Fixes: f88d8ea67fbd ("ipv6: Plumb support for nexthop object in a fib6_info") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250312013854.61125-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index e9a30978abac1..b393c37d24245 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -3803,10 +3803,12 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, + if (nh) { + if (rt->fib6_src.plen) { + NL_SET_ERR_MSG(extack, "Nexthops can not be used with source routing"); ++ err = -EINVAL; + goto out_free; + } + if (!nexthop_get(nh)) { + NL_SET_ERR_MSG(extack, "Nexthop has been deleted"); ++ err = -ENOENT; + goto out_free; + } + rt->nh = nh; +-- +2.39.5 + diff --git a/queue-6.12/libfs-fix-duplicate-directory-entry-in-offset_dir_lo.patch b/queue-6.12/libfs-fix-duplicate-directory-entry-in-offset_dir_lo.patch new file mode 100644 index 0000000000..00b8d94958 --- /dev/null +++ b/queue-6.12/libfs-fix-duplicate-directory-entry-in-offset_dir_lo.patch @@ -0,0 +1,68 @@ +From 2fd39f4bf0cb7a731f23358b7916cb0a4860743d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 11:44:17 +0800 +Subject: libfs: Fix duplicate directory entry in offset_dir_lookup + +From: Yongjian Sun + +[ Upstream commit f70681e9e6066ab7b102e6b46a336a8ed67812ae ] + +There is an issue in the kernel: + +In tmpfs, when using the "ls" command to list the contents +of a directory with a large number of files, glibc performs +the getdents call in multiple rounds. If a concurrent unlink +occurs between these getdents calls, it may lead to duplicate +directory entries in the ls output. One possible reproduction +scenario is as follows: + +Create 1026 files and execute ls and rm concurrently: + +for i in {1..1026}; do + echo "This is file $i" > /tmp/dir/file$i +done + +ls /tmp/dir rm /tmp/dir/file4 + ->getdents(file1026-file5) + ->unlink(file4) + + ->getdents(file5,file3,file2,file1) + +It is expected that the second getdents call to return file3 +through file1, but instead it returns an extra file5. + +The root cause of this problem is in the offset_dir_lookup +function. It uses mas_find to determine the starting position +for the current getdents call. Since mas_find locates the first +position that is greater than or equal to mas->index, when file4 +is deleted, it ends up returning file5. + +It can be fixed by replacing mas_find with mas_find_rev, which +finds the first position that is less than or equal to mas->index. + +Fixes: b9b588f22a0c ("libfs: Use d_children list to iterate simple_offset directories") +Signed-off-by: Yongjian Sun +Link: https://lore.kernel.org/r/20250320034417.555810-1-sunyongjian@huaweicloud.com +Reviewed-by: Chuck Lever +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/libfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/libfs.c b/fs/libfs.c +index b0f262223b535..3cb49463a8496 100644 +--- a/fs/libfs.c ++++ b/fs/libfs.c +@@ -492,7 +492,7 @@ offset_dir_lookup(struct dentry *parent, loff_t offset) + found = find_positive_dentry(parent, NULL, false); + else { + rcu_read_lock(); +- child = mas_find(&mas, DIR_OFFSET_MAX); ++ child = mas_find_rev(&mas, DIR_OFFSET_MIN); + found = find_positive_dentry(parent, child, false); + rcu_read_unlock(); + } +-- +2.39.5 + diff --git a/queue-6.12/net-atm-fix-use-after-free-in-lec_send.patch b/queue-6.12/net-atm-fix-use-after-free-in-lec_send.patch new file mode 100644 index 0000000000..9a8b745ea6 --- /dev/null +++ b/queue-6.12/net-atm-fix-use-after-free-in-lec_send.patch @@ -0,0 +1,46 @@ +From c1554bc31ade96f07392c608ba990c383cb8e63c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 13:10:57 +0300 +Subject: net: atm: fix use after free in lec_send() + +From: Dan Carpenter + +[ Upstream commit f3009d0d6ab78053117f8857b921a8237f4d17b3 ] + +The ->send() operation frees skb so save the length before calling +->send() to avoid a use after free. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Dan Carpenter +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/c751531d-4af4-42fe-affe-6104b34b791d@stanley.mountain +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/atm/lec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/atm/lec.c b/net/atm/lec.c +index ffef658862db1..a948dd47c3f34 100644 +--- a/net/atm/lec.c ++++ b/net/atm/lec.c +@@ -181,6 +181,7 @@ static void + lec_send(struct atm_vcc *vcc, struct sk_buff *skb) + { + struct net_device *dev = skb->dev; ++ unsigned int len = skb->len; + + ATM_SKB(skb)->vcc = vcc; + atm_account_tx(vcc, skb); +@@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) + } + + dev->stats.tx_packets++; +- dev->stats.tx_bytes += skb->len; ++ dev->stats.tx_bytes += len; + } + + static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue) +-- +2.39.5 + diff --git a/queue-6.12/net-ethernet-ti-am65-cpsw-fix-napi-registration-sequ.patch b/queue-6.12/net-ethernet-ti-am65-cpsw-fix-napi-registration-sequ.patch new file mode 100644 index 0000000000..79c80b91fa --- /dev/null +++ b/queue-6.12/net-ethernet-ti-am65-cpsw-fix-napi-registration-sequ.patch @@ -0,0 +1,119 @@ +From 23038404bbd1f351b90983ed4f788a155229687a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 21:12:59 +0530 +Subject: net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence + +From: Vignesh Raghavendra + +[ Upstream commit 5f079290e5913a0060e059500b7d440990ac1066 ] + +Registering the interrupts for TX or RX DMA Channels prior to registering +their respective NAPI callbacks can result in a NULL pointer dereference. +This is seen in practice as a random occurrence since it depends on the +randomness associated with the generation of traffic by Linux and the +reception of traffic from the wire. + +Fixes: 681eb2beb3ef ("net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path") +Signed-off-by: Vignesh Raghavendra +Co-developed-by: Siddharth Vadapalli +Signed-off-by: Siddharth Vadapalli +Reviewed-by: Alexander Sverdlin +Reviewed-by: Roger Quadros +Link: https://patch.msgid.link/20250311154259.102865-1-s-vadapalli@ti.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 32 +++++++++++++----------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 3e090f87f97eb..308a2b72a65de 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2225,14 +2225,18 @@ static void am65_cpsw_nuss_remove_tx_chns(struct am65_cpsw_common *common) + static int am65_cpsw_nuss_ndev_add_tx_napi(struct am65_cpsw_common *common) + { + struct device *dev = common->dev; ++ struct am65_cpsw_tx_chn *tx_chn; + int i, ret = 0; + + for (i = 0; i < common->tx_ch_num; i++) { +- struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i]; ++ tx_chn = &common->tx_chns[i]; + + hrtimer_init(&tx_chn->tx_hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_PINNED); + tx_chn->tx_hrtimer.function = &am65_cpsw_nuss_tx_timer_callback; + ++ netif_napi_add_tx(common->dma_ndev, &tx_chn->napi_tx, ++ am65_cpsw_nuss_tx_poll); ++ + ret = devm_request_irq(dev, tx_chn->irq, + am65_cpsw_nuss_tx_irq, + IRQF_TRIGGER_HIGH, +@@ -2242,19 +2246,16 @@ static int am65_cpsw_nuss_ndev_add_tx_napi(struct am65_cpsw_common *common) + tx_chn->id, tx_chn->irq, ret); + goto err; + } +- +- netif_napi_add_tx(common->dma_ndev, &tx_chn->napi_tx, +- am65_cpsw_nuss_tx_poll); + } + + return 0; + + err: +- for (--i ; i >= 0 ; i--) { +- struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i]; +- +- netif_napi_del(&tx_chn->napi_tx); ++ netif_napi_del(&tx_chn->napi_tx); ++ for (--i; i >= 0; i--) { ++ tx_chn = &common->tx_chns[i]; + devm_free_irq(dev, tx_chn->irq, tx_chn); ++ netif_napi_del(&tx_chn->napi_tx); + } + + return ret; +@@ -2488,6 +2489,9 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common) + HRTIMER_MODE_REL_PINNED); + flow->rx_hrtimer.function = &am65_cpsw_nuss_rx_timer_callback; + ++ netif_napi_add(common->dma_ndev, &flow->napi_rx, ++ am65_cpsw_nuss_rx_poll); ++ + ret = devm_request_irq(dev, flow->irq, + am65_cpsw_nuss_rx_irq, + IRQF_TRIGGER_HIGH, +@@ -2496,11 +2500,8 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common) + dev_err(dev, "failure requesting rx %d irq %u, %d\n", + i, flow->irq, ret); + flow->irq = -EINVAL; +- goto err_flow; ++ goto err_request_irq; + } +- +- netif_napi_add(common->dma_ndev, &flow->napi_rx, +- am65_cpsw_nuss_rx_poll); + } + + /* setup classifier to route priorities to flows */ +@@ -2508,11 +2509,14 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common) + + return 0; + ++err_request_irq: ++ netif_napi_del(&flow->napi_rx); ++ + err_flow: +- for (--i; i >= 0 ; i--) { ++ for (--i; i >= 0; i--) { + flow = &rx_chn->flows[i]; +- netif_napi_del(&flow->napi_rx); + devm_free_irq(dev, flow->irq, flow); ++ netif_napi_del(&flow->napi_rx); + } + + err: +-- +2.39.5 + diff --git a/queue-6.12/net-ipv6-fix-tcp-gso-segmentation-with-nat.patch b/queue-6.12/net-ipv6-fix-tcp-gso-segmentation-with-nat.patch new file mode 100644 index 0000000000..21fcbb759e --- /dev/null +++ b/queue-6.12/net-ipv6-fix-tcp-gso-segmentation-with-nat.patch @@ -0,0 +1,69 @@ +From c41e3b62e03580eb389d4fd84733cdfa32bee992 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 22:25:30 +0100 +Subject: net: ipv6: fix TCP GSO segmentation with NAT + +From: Felix Fietkau + +[ Upstream commit daa624d3c2ddffdcbad140a9625a4064371db44f ] + +When updating the source/destination address, the TCP/UDP checksum needs to +be updated as well. + +Fixes: bee88cd5bd83 ("net: add support for segmenting TCP fraglist GSO packets") +Signed-off-by: Felix Fietkau +Link: https://patch.msgid.link/20250311212530.91519-1-nbd@nbd.name +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/tcpv6_offload.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c +index a45bf17cb2a17..ae2da28f9dfb1 100644 +--- a/net/ipv6/tcpv6_offload.c ++++ b/net/ipv6/tcpv6_offload.c +@@ -94,14 +94,23 @@ INDIRECT_CALLABLE_SCOPE int tcp6_gro_complete(struct sk_buff *skb, int thoff) + } + + static void __tcpv6_gso_segment_csum(struct sk_buff *seg, ++ struct in6_addr *oldip, ++ const struct in6_addr *newip, + __be16 *oldport, __be16 newport) + { +- struct tcphdr *th; ++ struct tcphdr *th = tcp_hdr(seg); ++ ++ if (!ipv6_addr_equal(oldip, newip)) { ++ inet_proto_csum_replace16(&th->check, seg, ++ oldip->s6_addr32, ++ newip->s6_addr32, ++ true); ++ *oldip = *newip; ++ } + + if (*oldport == newport) + return; + +- th = tcp_hdr(seg); + inet_proto_csum_replace2(&th->check, seg, *oldport, newport, false); + *oldport = newport; + } +@@ -129,10 +138,10 @@ static struct sk_buff *__tcpv6_gso_segment_list_csum(struct sk_buff *segs) + th2 = tcp_hdr(seg); + iph2 = ipv6_hdr(seg); + +- iph2->saddr = iph->saddr; +- iph2->daddr = iph->daddr; +- __tcpv6_gso_segment_csum(seg, &th2->source, th->source); +- __tcpv6_gso_segment_csum(seg, &th2->dest, th->dest); ++ __tcpv6_gso_segment_csum(seg, &iph2->saddr, &iph->saddr, ++ &th2->source, th->source); ++ __tcpv6_gso_segment_csum(seg, &iph2->daddr, &iph->daddr, ++ &th2->dest, th->dest); + } + + return segs; +-- +2.39.5 + diff --git a/queue-6.12/net-ipv6-ioam6-fix-lwtunnel_output-loop.patch b/queue-6.12/net-ipv6-ioam6-fix-lwtunnel_output-loop.patch new file mode 100644 index 0000000000..c361835ffc --- /dev/null +++ b/queue-6.12/net-ipv6-ioam6-fix-lwtunnel_output-loop.patch @@ -0,0 +1,60 @@ +From 41b6a098dc09ee0783f03b09af2ac69b032824dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 13:00:47 +0100 +Subject: net: ipv6: ioam6: fix lwtunnel_output() loop + +From: Justin Iurman + +[ Upstream commit 3e7a60b368eadf6c30a4a79dea1eb8f88b6d620d ] + +Fix the lwtunnel_output() reentry loop in ioam6_iptunnel when the +destination is the same after transformation. Note that a check on the +destination address was already performed, but it was not enough. This +is the example of a lwtunnel user taking care of loops without relying +only on the last resort detection offered by lwtunnel. + +Fixes: 8cb3bf8bff3c ("ipv6: ioam: Add support for the ip6ip6 encapsulation") +Signed-off-by: Justin Iurman +Link: https://patch.msgid.link/20250314120048.12569-3-justin.iurman@uliege.be +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/ioam6_iptunnel.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c +index 4215cebe7d85a..647dd8417c6cf 100644 +--- a/net/ipv6/ioam6_iptunnel.c ++++ b/net/ipv6/ioam6_iptunnel.c +@@ -339,7 +339,6 @@ static int ioam6_do_encap(struct net *net, struct sk_buff *skb, + static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + { + struct dst_entry *dst = skb_dst(skb), *cache_dst = NULL; +- struct in6_addr orig_daddr; + struct ioam6_lwt *ilwt; + int err = -EINVAL; + u32 pkt_cnt; +@@ -354,8 +353,6 @@ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + if (pkt_cnt % ilwt->freq.n >= ilwt->freq.k) + goto out; + +- orig_daddr = ipv6_hdr(skb)->daddr; +- + local_bh_disable(); + cache_dst = dst_cache_get(&ilwt->cache); + local_bh_enable(); +@@ -424,7 +421,10 @@ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + goto drop; + } + +- if (!ipv6_addr_equal(&orig_daddr, &ipv6_hdr(skb)->daddr)) { ++ /* avoid lwtunnel_output() reentry loop when destination is the same ++ * after transformation (e.g., with the inline mode) ++ */ ++ if (dst->lwtstate != cache_dst->lwtstate) { + skb_dst_drop(skb); + skb_dst_set(skb, cache_dst); + return dst_output(net, sk, skb); +-- +2.39.5 + diff --git a/queue-6.12/net-lwtunnel-fix-recursion-loops.patch b/queue-6.12/net-lwtunnel-fix-recursion-loops.patch new file mode 100644 index 0000000000..5111f48dc8 --- /dev/null +++ b/queue-6.12/net-lwtunnel-fix-recursion-loops.patch @@ -0,0 +1,176 @@ +From 02d14ee576b4777ec191b2cfdab4e88ff8678948 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 13:00:46 +0100 +Subject: net: lwtunnel: fix recursion loops + +From: Justin Iurman + +[ Upstream commit 986ffb3a57c5650fb8bf6d59a8f0f07046abfeb6 ] + +This patch acts as a parachute, catch all solution, by detecting +recursion loops in lwtunnel users and taking care of them (e.g., a loop +between routes, a loop within the same route, etc). In general, such +loops are the consequence of pathological configurations. Each lwtunnel +user is still free to catch such loops early and do whatever they want +with them. It will be the case in a separate patch for, e.g., seg6 and +seg6_local, in order to provide drop reasons and update statistics. +Another example of a lwtunnel user taking care of loops is ioam6, which +has valid use cases that include loops (e.g., inline mode), and which is +addressed by the next patch in this series. Overall, this patch acts as +a last resort to catch loops and drop packets, since we don't want to +leak something unintentionally because of a pathological configuration +in lwtunnels. + +The solution in this patch reuses dev_xmit_recursion(), +dev_xmit_recursion_inc(), and dev_xmit_recursion_dec(), which seems fine +considering the context. + +Closes: https://lore.kernel.org/netdev/2bc9e2079e864a9290561894d2a602d6@akamai.com/ +Closes: https://lore.kernel.org/netdev/Z7NKYMY7fJT5cYWu@shredder/ +Fixes: ffce41962ef6 ("lwtunnel: support dst output redirect function") +Fixes: 2536862311d2 ("lwt: Add support to redirect dst.input") +Fixes: 14972cbd34ff ("net: lwtunnel: Handle fragmentation") +Signed-off-by: Justin Iurman +Link: https://patch.msgid.link/20250314120048.12569-2-justin.iurman@uliege.be +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/lwtunnel.c | 65 ++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 53 insertions(+), 12 deletions(-) + +diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c +index 711cd3b4347a7..4417a18b3e951 100644 +--- a/net/core/lwtunnel.c ++++ b/net/core/lwtunnel.c +@@ -23,6 +23,8 @@ + #include + #include + ++#include "dev.h" ++ + DEFINE_STATIC_KEY_FALSE(nf_hooks_lwtunnel_enabled); + EXPORT_SYMBOL_GPL(nf_hooks_lwtunnel_enabled); + +@@ -325,13 +327,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_cmp_encap); + + int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) + { +- struct dst_entry *dst = skb_dst(skb); + const struct lwtunnel_encap_ops *ops; + struct lwtunnel_state *lwtstate; +- int ret = -EINVAL; ++ struct dst_entry *dst; ++ int ret; ++ ++ if (dev_xmit_recursion()) { ++ net_crit_ratelimited("%s(): recursion limit reached on datapath\n", ++ __func__); ++ ret = -ENETDOWN; ++ goto drop; ++ } + +- if (!dst) ++ dst = skb_dst(skb); ++ if (!dst) { ++ ret = -EINVAL; + goto drop; ++ } + lwtstate = dst->lwtstate; + + if (lwtstate->type == LWTUNNEL_ENCAP_NONE || +@@ -341,8 +353,11 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) + ret = -EOPNOTSUPP; + rcu_read_lock(); + ops = rcu_dereference(lwtun_encaps[lwtstate->type]); +- if (likely(ops && ops->output)) ++ if (likely(ops && ops->output)) { ++ dev_xmit_recursion_inc(); + ret = ops->output(net, sk, skb); ++ dev_xmit_recursion_dec(); ++ } + rcu_read_unlock(); + + if (ret == -EOPNOTSUPP) +@@ -359,13 +374,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_output); + + int lwtunnel_xmit(struct sk_buff *skb) + { +- struct dst_entry *dst = skb_dst(skb); + const struct lwtunnel_encap_ops *ops; + struct lwtunnel_state *lwtstate; +- int ret = -EINVAL; ++ struct dst_entry *dst; ++ int ret; ++ ++ if (dev_xmit_recursion()) { ++ net_crit_ratelimited("%s(): recursion limit reached on datapath\n", ++ __func__); ++ ret = -ENETDOWN; ++ goto drop; ++ } + +- if (!dst) ++ dst = skb_dst(skb); ++ if (!dst) { ++ ret = -EINVAL; + goto drop; ++ } + + lwtstate = dst->lwtstate; + +@@ -376,8 +401,11 @@ int lwtunnel_xmit(struct sk_buff *skb) + ret = -EOPNOTSUPP; + rcu_read_lock(); + ops = rcu_dereference(lwtun_encaps[lwtstate->type]); +- if (likely(ops && ops->xmit)) ++ if (likely(ops && ops->xmit)) { ++ dev_xmit_recursion_inc(); + ret = ops->xmit(skb); ++ dev_xmit_recursion_dec(); ++ } + rcu_read_unlock(); + + if (ret == -EOPNOTSUPP) +@@ -394,13 +422,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_xmit); + + int lwtunnel_input(struct sk_buff *skb) + { +- struct dst_entry *dst = skb_dst(skb); + const struct lwtunnel_encap_ops *ops; + struct lwtunnel_state *lwtstate; +- int ret = -EINVAL; ++ struct dst_entry *dst; ++ int ret; + +- if (!dst) ++ if (dev_xmit_recursion()) { ++ net_crit_ratelimited("%s(): recursion limit reached on datapath\n", ++ __func__); ++ ret = -ENETDOWN; + goto drop; ++ } ++ ++ dst = skb_dst(skb); ++ if (!dst) { ++ ret = -EINVAL; ++ goto drop; ++ } + lwtstate = dst->lwtstate; + + if (lwtstate->type == LWTUNNEL_ENCAP_NONE || +@@ -410,8 +448,11 @@ int lwtunnel_input(struct sk_buff *skb) + ret = -EOPNOTSUPP; + rcu_read_lock(); + ops = rcu_dereference(lwtun_encaps[lwtstate->type]); +- if (likely(ops && ops->input)) ++ if (likely(ops && ops->input)) { ++ dev_xmit_recursion_inc(); + ret = ops->input(skb); ++ dev_xmit_recursion_dec(); ++ } + rcu_read_unlock(); + + if (ret == -EOPNOTSUPP) +-- +2.39.5 + diff --git a/queue-6.12/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch b/queue-6.12/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch new file mode 100644 index 0000000000..bc00a18c47 --- /dev/null +++ b/queue-6.12/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch @@ -0,0 +1,39 @@ +From 0993b503bbee58cd077f487fffe984af86bf66c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Mar 2025 00:51:13 +0800 +Subject: net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES + +From: Lin Ma + +[ Upstream commit 90a7138619a0c55e2aefaad27b12ffc2ddbeed78 ] + +Previous commit 8b5c171bb3dc ("neigh: new unresolved queue limits") +introduces new netlink attribute NDTPA_QUEUE_LENBYTES to represent +approximative value for deprecated QUEUE_LEN. However, it forgot to add +the associated nla_policy in nl_ntbl_parm_policy array. Fix it with one +simple NLA_U32 type policy. + +Fixes: 8b5c171bb3dc ("neigh: new unresolved queue limits") +Signed-off-by: Lin Ma +Link: https://patch.msgid.link/20250315165113.37600-1-linma@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index c7f7ea61b524a..8082cc6be4fc1 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -2301,6 +2301,7 @@ static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = { + static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = { + [NDTPA_IFINDEX] = { .type = NLA_U32 }, + [NDTPA_QUEUE_LEN] = { .type = NLA_U32 }, ++ [NDTPA_QUEUE_LENBYTES] = { .type = NLA_U32 }, + [NDTPA_PROXY_QLEN] = { .type = NLA_U32 }, + [NDTPA_APP_PROBES] = { .type = NLA_U32 }, + [NDTPA_UCAST_PROBES] = { .type = NLA_U32 }, +-- +2.39.5 + diff --git a/queue-6.12/net-ti-icssg-prueth-add-lock-to-stats.patch b/queue-6.12/net-ti-icssg-prueth-add-lock-to-stats.patch new file mode 100644 index 0000000000..cb2f19ff02 --- /dev/null +++ b/queue-6.12/net-ti-icssg-prueth-add-lock-to-stats.patch @@ -0,0 +1,78 @@ +From d4aff454dbc6b50642c9ef877f3b8979d97050f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 15:57:21 +0530 +Subject: net: ti: icssg-prueth: Add lock to stats + +From: MD Danish Anwar + +[ Upstream commit 47a9b5e52abd2b717dfc8b9460589f89936d93cf ] + +Currently the API emac_update_hardware_stats() reads different ICSSG +stats without any lock protection. + +This API gets called by .ndo_get_stats64() which is only under RCU +protection and nothing else. Add lock to this API so that the reading of +statistics happens during lock. + +Fixes: c1e10d5dc7a1 ("net: ti: icssg-prueth: Add ICSSG Stats") +Signed-off-by: MD Danish Anwar +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250314102721.1394366-1-danishanwar@ti.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/icssg/icssg_prueth.c | 1 + + drivers/net/ethernet/ti/icssg/icssg_prueth.h | 2 ++ + drivers/net/ethernet/ti/icssg/icssg_stats.c | 4 ++++ + 3 files changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/ti/icssg/icssg_prueth.c b/drivers/net/ethernet/ti/icssg/icssg_prueth.c +index cb11635a8d120..6f0700d156e71 100644 +--- a/drivers/net/ethernet/ti/icssg/icssg_prueth.c ++++ b/drivers/net/ethernet/ti/icssg/icssg_prueth.c +@@ -1555,6 +1555,7 @@ static int prueth_probe(struct platform_device *pdev) + } + + spin_lock_init(&prueth->vtbl_lock); ++ spin_lock_init(&prueth->stats_lock); + /* setup netdev interfaces */ + if (eth0_node) { + ret = prueth_netdev_init(prueth, eth0_node); +diff --git a/drivers/net/ethernet/ti/icssg/icssg_prueth.h b/drivers/net/ethernet/ti/icssg/icssg_prueth.h +index 5473315ea2040..e456a11c5d4e3 100644 +--- a/drivers/net/ethernet/ti/icssg/icssg_prueth.h ++++ b/drivers/net/ethernet/ti/icssg/icssg_prueth.h +@@ -297,6 +297,8 @@ struct prueth { + int default_vlan; + /** @vtbl_lock: Lock for vtbl in shared memory */ + spinlock_t vtbl_lock; ++ /** @stats_lock: Lock for reading icssg stats */ ++ spinlock_t stats_lock; + }; + + struct emac_tx_ts_response { +diff --git a/drivers/net/ethernet/ti/icssg/icssg_stats.c b/drivers/net/ethernet/ti/icssg/icssg_stats.c +index 8800bd3a8d074..6f0edae38ea24 100644 +--- a/drivers/net/ethernet/ti/icssg/icssg_stats.c ++++ b/drivers/net/ethernet/ti/icssg/icssg_stats.c +@@ -26,6 +26,8 @@ void emac_update_hardware_stats(struct prueth_emac *emac) + u32 val, reg; + int i; + ++ spin_lock(&prueth->stats_lock); ++ + for (i = 0; i < ARRAY_SIZE(icssg_all_miig_stats); i++) { + regmap_read(prueth->miig_rt, + base + icssg_all_miig_stats[i].offset, +@@ -51,6 +53,8 @@ void emac_update_hardware_stats(struct prueth_emac *emac) + emac->pa_stats[i] += val; + } + } ++ ++ spin_unlock(&prueth->stats_lock); + } + + void icssg_stats_work_handler(struct work_struct *work) +-- +2.39.5 + diff --git a/queue-6.12/phy-fix-xa_alloc_cyclic-error-handling.patch b/queue-6.12/phy-fix-xa_alloc_cyclic-error-handling.patch new file mode 100644 index 0000000000..b48d1ed4dd --- /dev/null +++ b/queue-6.12/phy-fix-xa_alloc_cyclic-error-handling.patch @@ -0,0 +1,38 @@ +From 03bb5078e07a4fa34aca71b8576553cb80222880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 10:52:51 +0100 +Subject: phy: fix xa_alloc_cyclic() error handling + +From: Michal Swiatkowski + +[ Upstream commit 3178d2b048365fe2c078cd53f85f2abf1487733b ] + +xa_alloc_cyclic() can return 1, which isn't an error. To prevent +situation when the caller of this function will treat it as no error do +a check only for negative here. + +Fixes: 384968786909 ("net: phy: Introduce ethernet link topology representation") +Signed-off-by: Michal Swiatkowski +Reviewed-by: Maxime Chevallier +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_link_topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/phy_link_topology.c b/drivers/net/phy/phy_link_topology.c +index 4a5d73002a1a8..0e9e987f37dd8 100644 +--- a/drivers/net/phy/phy_link_topology.c ++++ b/drivers/net/phy/phy_link_topology.c +@@ -73,7 +73,7 @@ int phy_link_topo_add_phy(struct net_device *dev, + xa_limit_32b, &topo->next_phy_index, + GFP_KERNEL); + +- if (ret) ++ if (ret < 0) + goto err; + + return 0; +-- +2.39.5 + diff --git a/queue-6.12/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch b/queue-6.12/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch new file mode 100644 index 0000000000..137d78b596 --- /dev/null +++ b/queue-6.12/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch @@ -0,0 +1,42 @@ +From 769856595a21b46066004e7cec3ae2bcbd74b691 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 08:59:37 -0800 +Subject: RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx + +From: Kashyap Desai + +[ Upstream commit 67ee8d496511ad8e1cb88f72944847e7b3e4e47c ] + +The modulo operation returns wrong result without the +paranthesis and that resulted in wrong QP table indexing. + +Fixes: 84cf229f4001 ("RDMA/bnxt_re: Fix the qp table indexing") +Reviewed-by: Kalesh AP +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/1741021178-2569-3-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +index 07779aeb75759..a4deb45ec849f 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +@@ -283,9 +283,10 @@ int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw); + int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw, + struct bnxt_qplib_ctx *ctx, int is_virtfn); + void bnxt_qplib_mark_qp_error(void *qp_handle); ++ + static inline u32 map_qp_id_to_tbl_indx(u32 qid, struct bnxt_qplib_rcfw *rcfw) + { + /* Last index of the qp_tbl is for QP1 ie. qp_tbl_size - 1*/ +- return (qid == 1) ? rcfw->qp_tbl_size - 1 : qid % rcfw->qp_tbl_size - 2; ++ return (qid == 1) ? rcfw->qp_tbl_size - 1 : (qid % (rcfw->qp_tbl_size - 2)); + } + #endif /* __BNXT_QPLIB_RCFW_H__ */ +-- +2.39.5 + diff --git a/queue-6.12/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch b/queue-6.12/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch new file mode 100644 index 0000000000..4dcbd251b8 --- /dev/null +++ b/queue-6.12/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch @@ -0,0 +1,42 @@ +From 554656fbcec8502c3e513ad4498e0795b95c095d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 22:16:36 -0700 +Subject: RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path + +From: Saravanan Vajravel + +[ Upstream commit 81c0db302a674f8004ed805393d17fd76f552e83 ] + +Driver is always clearing the mask that sets the VLAN ID/Service Level +in the adapter. Recent change for supporting multiple traffic class +exposed this issue. + +Allow setting SL and VLAN_ID while QP is moved from INIT to RTR state. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Fixes: c64b16a37b6d ("RDMA/bnxt_re: Support different traffic class") +Signed-off-by: Saravanan Vajravel +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/1741670196-2919-1-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 613b5fc70e13e..7436ce5515797 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -1216,8 +1216,6 @@ static void __modify_flags_from_init_state(struct bnxt_qplib_qp *qp) + qp->path_mtu = + CMDQ_MODIFY_QP_PATH_MTU_MTU_2048; + } +- qp->modify_flags &= +- ~CMDQ_MODIFY_QP_MODIFY_MASK_VLAN_ID; + /* Bono FW require the max_dest_rd_atomic to be >= 1 */ + if (qp->max_dest_rd_atomic < 1) + qp->max_dest_rd_atomic = 1; +-- +2.39.5 + diff --git a/queue-6.12/rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch b/queue-6.12/rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch new file mode 100644 index 0000000000..2411dbe975 --- /dev/null +++ b/queue-6.12/rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch @@ -0,0 +1,39 @@ +From cac6f8e6610dbcfec6600e3d4dc904ac2f0808c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:55 +0800 +Subject: RDMA/hns: Fix a missing rollback in error path of + hns_roce_create_qp_common() + +From: Junxian Huang + +[ Upstream commit 444907dd45cbe62fd69398805b6e2c626fab5b3a ] + +When ib_copy_to_udata() fails in hns_roce_create_qp_common(), +hns_roce_qp_remove() should be called in the error path to +clean up resources in hns_roce_qp_store(). + +Fixes: 0f00571f9433 ("RDMA/hns: Use new SQ doorbell register for HIP09") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-6-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 8408f9a5c309d..52b671156246b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -1220,7 +1220,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, + min(udata->outlen, sizeof(resp))); + if (ret) { + ibdev_err(ibdev, "copy qp resp failed!\n"); +- goto err_store; ++ goto err_flow_ctrl; + } + } + +-- +2.39.5 + diff --git a/queue-6.12/rdma-hns-fix-invalid-sq-params-not-being-blocked.patch b/queue-6.12/rdma-hns-fix-invalid-sq-params-not-being-blocked.patch new file mode 100644 index 0000000000..845817adcc --- /dev/null +++ b/queue-6.12/rdma-hns-fix-invalid-sq-params-not-being-blocked.patch @@ -0,0 +1,64 @@ +From 7056ae7b74325398cc4f965b04ef8bc19b82c598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:54 +0800 +Subject: RDMA/hns: Fix invalid sq params not being blocked + +From: Junxian Huang + +[ Upstream commit 13c90c222049764bb7e6a1689bd785f424bd8bd5 ] + +SQ params from userspace are checked in by set_user_sq_size(). But +when the check fails, the function doesn't return but instead keep +running and overwrite 'ret'. As a result, the invalid params will +not get blocked actually. + +Add a return right after the failed check. Besides, although the +check result of kernel sq params will not be overwritten, to keep +coding style unified, move default_congest_type() before +set_kernel_sq_size(). + +Fixes: 6ec429d5887a ("RDMA/hns: Support userspace configuring congestion control algorithm with QP granularity") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-5-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index a97348a1c61f1..8408f9a5c309d 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -1121,24 +1121,23 @@ static int set_qp_param(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp, + ibucontext); + hr_qp->config = uctx->config; + ret = set_user_sq_size(hr_dev, &init_attr->cap, hr_qp, ucmd); +- if (ret) ++ if (ret) { + ibdev_err(ibdev, + "failed to set user SQ size, ret = %d.\n", + ret); ++ return ret; ++ } + + ret = set_congest_param(hr_dev, hr_qp, ucmd); +- if (ret) +- return ret; + } else { + if (hr_dev->pci_dev->revision >= PCI_REVISION_ID_HIP09) + hr_qp->config = HNS_ROCE_EXSGE_FLAGS; ++ default_congest_type(hr_dev, hr_qp); + ret = set_kernel_sq_size(hr_dev, &init_attr->cap, hr_qp); + if (ret) + ibdev_err(ibdev, + "failed to set kernel SQ size, ret = %d.\n", + ret); +- +- default_congest_type(hr_dev, hr_qp); + } + + return ret; +-- +2.39.5 + diff --git a/queue-6.12/rdma-hns-fix-missing-xa_destroy.patch b/queue-6.12/rdma-hns-fix-missing-xa_destroy.patch new file mode 100644 index 0000000000..4b18e5a344 --- /dev/null +++ b/queue-6.12/rdma-hns-fix-missing-xa_destroy.patch @@ -0,0 +1,66 @@ +From 08854ddd07095259cb62855412f1a521ced12a4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:56 +0800 +Subject: RDMA/hns: Fix missing xa_destroy() + +From: Junxian Huang + +[ Upstream commit eda0a2fdbc24c35cd8d61d9c9111cafd5f89b2dc ] + +Add xa_destroy() for xarray in driver. + +Fixes: 5c1f167af112 ("RDMA/hns: Init SRQ table for hip08") +Fixes: 27e19f451089 ("RDMA/hns: Convert cq_table to XArray") +Fixes: 736b5a70db98 ("RDMA/hns: Convert qp_table_tree to XArray") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-7-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_alloc.c | 4 +++- + drivers/infiniband/hw/hns/hns_roce_cq.c | 1 + + drivers/infiniband/hw/hns/hns_roce_qp.c | 1 + + 3 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_alloc.c b/drivers/infiniband/hw/hns/hns_roce_alloc.c +index 950c133d4220e..6ee911f6885b5 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_alloc.c ++++ b/drivers/infiniband/hw/hns/hns_roce_alloc.c +@@ -175,8 +175,10 @@ void hns_roce_cleanup_bitmap(struct hns_roce_dev *hr_dev) + if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_XRC) + ida_destroy(&hr_dev->xrcd_ida.ida); + +- if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ) ++ if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ) { + ida_destroy(&hr_dev->srq_table.srq_ida.ida); ++ xa_destroy(&hr_dev->srq_table.xa); ++ } + hns_roce_cleanup_qp_table(hr_dev); + hns_roce_cleanup_cq_table(hr_dev); + ida_destroy(&hr_dev->mr_table.mtpt_ida.ida); +diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c +index 4106423a1b399..3a5c93c9fb3e6 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_cq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_cq.c +@@ -537,5 +537,6 @@ void hns_roce_cleanup_cq_table(struct hns_roce_dev *hr_dev) + + for (i = 0; i < HNS_ROCE_CQ_BANK_NUM; i++) + ida_destroy(&hr_dev->cq_table.bank[i].ida); ++ xa_destroy(&hr_dev->cq_table.array); + mutex_destroy(&hr_dev->cq_table.bank_mutex); + } +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 52b671156246b..8901c142c1b65 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -1603,6 +1603,7 @@ void hns_roce_cleanup_qp_table(struct hns_roce_dev *hr_dev) + for (i = 0; i < HNS_ROCE_QP_BANK_NUM; i++) + ida_destroy(&hr_dev->qp_table.bank[i].ida); + xa_destroy(&hr_dev->qp_table.dip_xa); ++ xa_destroy(&hr_dev->qp_table_xa); + mutex_destroy(&hr_dev->qp_table.bank_mutex); + mutex_destroy(&hr_dev->qp_table.scc_mutex); + } +-- +2.39.5 + diff --git a/queue-6.12/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch b/queue-6.12/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch new file mode 100644 index 0000000000..e936048ab8 --- /dev/null +++ b/queue-6.12/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch @@ -0,0 +1,100 @@ +From ae0a1bd77712df8ba5da3fe5aa0f94c5b398c927 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:52 +0800 +Subject: RDMA/hns: Fix soft lockup during bt pages loop + +From: Junxian Huang + +[ Upstream commit 25655580136de59ec89f09089dd28008ea440fc9 ] + +Driver runs a for-loop when allocating bt pages and mapping them with +buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated, +it may require a considerable loop count. This will lead to soft lockup: + + watchdog: BUG: soft lockup - CPU#27 stuck for 22s! + ... + Call trace: + hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2] + hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2] + hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2] + alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2] + hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2] + ib_uverbs_reg_mr+0x118/0x290 + + watchdog: BUG: soft lockup - CPU#35 stuck for 23s! + ... + Call trace: + hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2] + mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2] + hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2] + alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2] + hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2] + ib_uverbs_reg_mr+0x120/0x2bc + +Add a cond_resched() to fix soft lockup during these loops. In order not +to affect the allocation performance of normal-size buffer, set the loop +count of a 100GB MR as the threshold to call cond_resched(). + +Fixes: 38389eaa4db1 ("RDMA/hns: Add mtr support for mixed multihop addressing") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-3-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index 605562122ecce..ca0798224e565 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -1361,6 +1361,11 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev, + return ret; + } + ++/* This is the bottom bt pages number of a 100G MR on 4K OS, assuming ++ * the bt page size is not expanded by cal_best_bt_pg_sz() ++ */ ++#define RESCHED_LOOP_CNT_THRESHOLD_ON_4K 12800 ++ + /* construct the base address table and link them by address hop config */ + int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, + struct hns_roce_hem_list *hem_list, +@@ -1369,6 +1374,7 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, + { + const struct hns_roce_buf_region *r; + int ofs, end; ++ int loop; + int unit; + int ret; + int i; +@@ -1386,7 +1392,10 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, + continue; + + end = r->offset + r->count; +- for (ofs = r->offset; ofs < end; ofs += unit) { ++ for (ofs = r->offset, loop = 1; ofs < end; ofs += unit, loop++) { ++ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K)) ++ cond_resched(); ++ + ret = hem_list_alloc_mid_bt(hr_dev, r, unit, ofs, + hem_list->mid_bt[i], + &hem_list->btm_bt); +@@ -1443,9 +1452,14 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev, + struct list_head *head = &hem_list->btm_bt; + struct hns_roce_hem_item *hem, *temp_hem; + void *cpu_base = NULL; ++ int loop = 1; + int nr = 0; + + list_for_each_entry_safe(hem, temp_hem, head, sibling) { ++ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K)) ++ cond_resched(); ++ loop++; ++ + if (hem_list_page_is_in_range(hem, offset)) { + nr = offset - hem->start; + cpu_base = hem->addr + nr * BA_BYTE_LEN; +-- +2.39.5 + diff --git a/queue-6.12/rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch b/queue-6.12/rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch new file mode 100644 index 0000000000..511a806f3b --- /dev/null +++ b/queue-6.12/rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch @@ -0,0 +1,64 @@ +From be9b47aca32662020615f3b805f40b9319c61993 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:53 +0800 +Subject: RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() + +From: Junxian Huang + +[ Upstream commit b9f59a24ba35a7d955a9f8e148dd9f85b7b40a01 ] + +Currently the condition of unmapping sdb in error path is not exactly +the same as the condition of mapping in alloc_user_qp_db(). This may +cause a problem of unmapping an unmapped db in some case, such as +when the QP is XRC TGT. Unified the two conditions. + +Fixes: 90ae0b57e4a5 ("RDMA/hns: Combine enable flags of qp") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-4-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 9e2e76c594063..a97348a1c61f1 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -868,12 +868,14 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, + struct hns_roce_ib_create_qp *ucmd, + struct hns_roce_ib_create_qp_resp *resp) + { ++ bool has_sdb = user_qp_has_sdb(hr_dev, init_attr, udata, resp, ucmd); + struct hns_roce_ucontext *uctx = rdma_udata_to_drv_context(udata, + struct hns_roce_ucontext, ibucontext); ++ bool has_rdb = user_qp_has_rdb(hr_dev, init_attr, udata, resp); + struct ib_device *ibdev = &hr_dev->ib_dev; + int ret; + +- if (user_qp_has_sdb(hr_dev, init_attr, udata, resp, ucmd)) { ++ if (has_sdb) { + ret = hns_roce_db_map_user(uctx, ucmd->sdb_addr, &hr_qp->sdb); + if (ret) { + ibdev_err(ibdev, +@@ -884,7 +886,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, + hr_qp->en_flags |= HNS_ROCE_QP_CAP_SQ_RECORD_DB; + } + +- if (user_qp_has_rdb(hr_dev, init_attr, udata, resp)) { ++ if (has_rdb) { + ret = hns_roce_db_map_user(uctx, ucmd->db_addr, &hr_qp->rdb); + if (ret) { + ibdev_err(ibdev, +@@ -898,7 +900,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, + return 0; + + err_sdb: +- if (hr_qp->en_flags & HNS_ROCE_QP_CAP_SQ_RECORD_DB) ++ if (has_sdb) + hns_roce_db_unmap_user(uctx, &hr_qp->sdb); + err_out: + return ret; +-- +2.39.5 + diff --git a/queue-6.12/rdma-hns-fix-wrong-value-of-max_sge_rd.patch b/queue-6.12/rdma-hns-fix-wrong-value-of-max_sge_rd.patch new file mode 100644 index 0000000000..82eeeb119e --- /dev/null +++ b/queue-6.12/rdma-hns-fix-wrong-value-of-max_sge_rd.patch @@ -0,0 +1,38 @@ +From e9190478f26777399ed06cae22c259d3db21d1a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:57 +0800 +Subject: RDMA/hns: Fix wrong value of max_sge_rd + +From: Junxian Huang + +[ Upstream commit 6b5e41a8b51fce520bb09bd651a29ef495e990de ] + +There is no difference between the sge of READ and non-READ +operations in hns RoCE. Set max_sge_rd to the same value as +max_send_sge. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-8-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index ae24c81c9812d..cf89a8db4f64c 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -183,7 +183,7 @@ static int hns_roce_query_device(struct ib_device *ib_dev, + IB_DEVICE_RC_RNR_NAK_GEN; + props->max_send_sge = hr_dev->caps.max_sq_sg; + props->max_recv_sge = hr_dev->caps.max_rq_sg; +- props->max_sge_rd = 1; ++ props->max_sge_rd = hr_dev->caps.max_sq_sg; + props->max_cq = hr_dev->caps.num_cqs; + props->max_cqe = hr_dev->caps.max_cqes; + props->max_mr = hr_dev->caps.num_mtpts; +-- +2.39.5 + diff --git a/queue-6.12/rdma-mlx5-handle-errors-returned-from-mlx5r_ib_rate.patch b/queue-6.12/rdma-mlx5-handle-errors-returned-from-mlx5r_ib_rate.patch new file mode 100644 index 0000000000..014ee89176 --- /dev/null +++ b/queue-6.12/rdma-mlx5-handle-errors-returned-from-mlx5r_ib_rate.patch @@ -0,0 +1,86 @@ +From f559f6c77a78ce59130bc27c9a0cf323c738d77e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Mar 2025 14:02:46 +0000 +Subject: RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() + +From: Qasim Ijaz + +[ Upstream commit 556f93b90c1872ad85e216e613c0b33803e621cb ] + +In function create_ib_ah() the following line attempts +to left shift the return value of mlx5r_ib_rate() by 4 +and store it in the stat_rate_sl member of av: + +However the code overlooks the fact that mlx5r_ib_rate() +may return -EINVAL if the rate passed to it is less than +IB_RATE_2_5_GBPS or greater than IB_RATE_800_GBPS. + +Because of this, the code may invoke undefined behaviour when +shifting a signed negative value when doing "-EINVAL << 4". + +To fix this check for errors before assigning stat_rate_sl and +propagate any error value to the callers. + +Fixes: c534ffda781f ("RDMA/mlx5: Fix AH static rate parsing") +Signed-off-by: Qasim Ijaz +Link: https://patch.msgid.link/20250304140246.205919-1-qasdev00@gmail.com +Reviewed-by: Patrisious Haddad +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/ah.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/ah.c b/drivers/infiniband/hw/mlx5/ah.c +index 99036afb3aef0..531a57f9ee7e8 100644 +--- a/drivers/infiniband/hw/mlx5/ah.c ++++ b/drivers/infiniband/hw/mlx5/ah.c +@@ -50,11 +50,12 @@ static __be16 mlx5_ah_get_udp_sport(const struct mlx5_ib_dev *dev, + return sport; + } + +-static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, ++static int create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, + struct rdma_ah_init_attr *init_attr) + { + struct rdma_ah_attr *ah_attr = init_attr->ah_attr; + enum ib_gid_type gid_type; ++ int rate_val; + + if (rdma_ah_get_ah_flags(ah_attr) & IB_AH_GRH) { + const struct ib_global_route *grh = rdma_ah_read_grh(ah_attr); +@@ -67,8 +68,10 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, + ah->av.tclass = grh->traffic_class; + } + +- ah->av.stat_rate_sl = +- (mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr)) << 4); ++ rate_val = mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr)); ++ if (rate_val < 0) ++ return rate_val; ++ ah->av.stat_rate_sl = rate_val << 4; + + if (ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) { + if (init_attr->xmit_slave) +@@ -89,6 +92,8 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, + ah->av.fl_mlid = rdma_ah_get_path_bits(ah_attr) & 0x7f; + ah->av.stat_rate_sl |= (rdma_ah_get_sl(ah_attr) & 0xf); + } ++ ++ return 0; + } + + int mlx5_ib_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, +@@ -121,8 +126,7 @@ int mlx5_ib_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, + return err; + } + +- create_ib_ah(dev, ah, init_attr); +- return 0; ++ return create_ib_ah(dev, ah, init_attr); + } + + int mlx5_ib_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr) +-- +2.39.5 + diff --git a/queue-6.12/rdma-rxe-fix-the-failure-of-ibv_query_device-and-ibv.patch b/queue-6.12/rdma-rxe-fix-the-failure-of-ibv_query_device-and-ibv.patch new file mode 100644 index 0000000000..d4eed413bf --- /dev/null +++ b/queue-6.12/rdma-rxe-fix-the-failure-of-ibv_query_device-and-ibv.patch @@ -0,0 +1,138 @@ +From 2773c3a66cad680c65a2a9e5dfcbbce813087d3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Mar 2025 22:54:44 +0100 +Subject: RDMA/rxe: Fix the failure of ibv_query_device() and + ibv_query_device_ex() tests + +From: Zhu Yanjun + +[ Upstream commit 8ce2eb9dfac8743d1c423b86339336a5b6a6069e ] + +In rdma-core, the following failures appear. + +" +$ ./build/bin/run_tests.py -k device +ssssssss....FF........s +====================================================================== +FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device) +Test ibv_query_device() +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in + test_query_device + self.verify_device_attr(attr, dev) + File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in + verify_device_attr + assert attr.sys_image_guid != 0 + ^^^^^^^^^^^^^^^^^^^^^^^^ +AssertionError + +====================================================================== +FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_ex) +Test ibv_query_device_ex() +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in + test_query_device_ex + self.verify_device_attr(attr_ex.orig_attr, dev) + File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in + verify_device_attr + assert attr.sys_image_guid != 0 + ^^^^^^^^^^^^^^^^^^^^^^^^ +AssertionError +" + +The root cause is: before a net device is set with rxe, this net device +is used to generate a sys_image_guid. + +Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device") +Signed-off-by: Zhu Yanjun +Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev +Reviewed-by: Daisuke Matsuda +Tested-by: Daisuke Matsuda +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe.c | 25 ++++++------------------- + 1 file changed, 6 insertions(+), 19 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index 1ba4a0c8726ae..e27478fe9456c 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -38,10 +38,8 @@ void rxe_dealloc(struct ib_device *ib_dev) + } + + /* initialize rxe device parameters */ +-static void rxe_init_device_param(struct rxe_dev *rxe) ++static void rxe_init_device_param(struct rxe_dev *rxe, struct net_device *ndev) + { +- struct net_device *ndev; +- + rxe->max_inline_data = RXE_MAX_INLINE_DATA; + + rxe->attr.vendor_id = RXE_VENDOR_ID; +@@ -74,15 +72,9 @@ static void rxe_init_device_param(struct rxe_dev *rxe) + rxe->attr.max_pkeys = RXE_MAX_PKEYS; + rxe->attr.local_ca_ack_delay = RXE_LOCAL_CA_ACK_DELAY; + +- ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); +- if (!ndev) +- return; +- + addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid, + ndev->dev_addr); + +- dev_put(ndev); +- + rxe->max_ucontext = RXE_MAX_UCONTEXT; + } + +@@ -115,18 +107,13 @@ static void rxe_init_port_param(struct rxe_port *port) + /* initialize port state, note IB convention that HCA ports are always + * numbered from 1 + */ +-static void rxe_init_ports(struct rxe_dev *rxe) ++static void rxe_init_ports(struct rxe_dev *rxe, struct net_device *ndev) + { + struct rxe_port *port = &rxe->port; +- struct net_device *ndev; + + rxe_init_port_param(port); +- ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); +- if (!ndev) +- return; + addrconf_addr_eui48((unsigned char *)&port->port_guid, + ndev->dev_addr); +- dev_put(ndev); + spin_lock_init(&port->port_lock); + } + +@@ -144,12 +131,12 @@ static void rxe_init_pools(struct rxe_dev *rxe) + } + + /* initialize rxe device state */ +-static void rxe_init(struct rxe_dev *rxe) ++static void rxe_init(struct rxe_dev *rxe, struct net_device *ndev) + { + /* init default device parameters */ +- rxe_init_device_param(rxe); ++ rxe_init_device_param(rxe, ndev); + +- rxe_init_ports(rxe); ++ rxe_init_ports(rxe, ndev); + rxe_init_pools(rxe); + + /* init pending mmap list */ +@@ -184,7 +171,7 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu) + int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name, + struct net_device *ndev) + { +- rxe_init(rxe); ++ rxe_init(rxe, ndev); + rxe_set_mtu(rxe, mtu); + + return rxe_register_device(rxe, ibdev_name, ndev); +-- +2.39.5 + diff --git a/queue-6.12/revert-gre-fix-ipv6-link-local-address-generation.patch b/queue-6.12/revert-gre-fix-ipv6-link-local-address-generation.patch new file mode 100644 index 0000000000..796025ba5a --- /dev/null +++ b/queue-6.12/revert-gre-fix-ipv6-link-local-address-generation.patch @@ -0,0 +1,66 @@ +From fa1b25e55aaf83e82bd4346c935639ce56a2eadb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 22:26:50 +0100 +Subject: Revert "gre: Fix IPv6 link-local address generation." + +From: Guillaume Nault + +[ Upstream commit fc486c2d060f67d672ddad81724f7c8a4d329570 ] + +This reverts commit 183185a18ff96751db52a46ccf93fff3a1f42815. + +This patch broke net/forwarding/ip6gre_custom_multipath_hash.sh in some +circumstances (https://lore.kernel.org/netdev/Z9RIyKZDNoka53EO@mini-arch/). +Let's revert it while the problem is being investigated. + +Fixes: 183185a18ff9 ("gre: Fix IPv6 link-local address generation.") +Signed-off-by: Guillaume Nault +Link: https://patch.msgid.link/8b1ce738eb15dd841aab9ef888640cab4f6ccfea.1742418408.git.gnault@redhat.com +Acked-by: Stanislav Fomichev +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 26cdb66574757..f7c17388ff6aa 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3237,13 +3237,16 @@ static void add_v4_addrs(struct inet6_dev *idev) + struct in6_addr addr; + struct net_device *dev; + struct net *net = dev_net(idev->dev); +- int scope, plen; ++ int scope, plen, offset = 0; + u32 pflags = 0; + + ASSERT_RTNL(); + + memset(&addr, 0, sizeof(struct in6_addr)); +- memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4); ++ /* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */ ++ if (idev->dev->addr_len == sizeof(struct in6_addr)) ++ offset = sizeof(struct in6_addr) - 4; ++ memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4); + + if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) { + scope = IPV6_ADDR_COMPATv4; +@@ -3554,13 +3557,7 @@ static void addrconf_gre_config(struct net_device *dev) + return; + } + +- /* Generate the IPv6 link-local address using addrconf_addr_gen(), +- * unless we have an IPv4 GRE device not bound to an IP address and +- * which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this +- * case). Such devices fall back to add_v4_addrs() instead. +- */ +- if (!(dev->type == ARPHRD_IPGRE && *(__be32 *)dev->dev_addr == 0 && +- idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)) { ++ if (dev->type == ARPHRD_ETHER) { + addrconf_addr_gen(idev, true); + return; + } +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series new file mode 100644 index 0000000000..8634a45ca2 --- /dev/null +++ b/queue-6.12/series @@ -0,0 +1,50 @@ +firmware-qcom-scm-fix-error-code-in-probe.patch +firmware-imx-scu-fix-of-node-leak-in-.probe.patch +arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch +arm64-dts-rockchip-remove-supports-cqe-from-rk3588-j.patch +arm64-dts-rockchip-remove-supports-cqe-from-rk3588-t.patch +xfrm-fix-tunnel-mode-tx-datapath-in-packet-offload-m.patch +xfrm_output-force-software-gso-only-in-tunnel-mode.patch +soc-imx8m-remove-global-soc_uid.patch +soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch +soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch +arm-dts-bcm2711-fix-xhci-power-domain.patch +arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch +arm64-dts-bcm2712-pl011-uarts-are-actually-r1p5.patch +arm64-dts-rockchip-remove-undocumented-sdmmc-propert.patch +rdma-rxe-fix-the-failure-of-ibv_query_device-and-ibv.patch +rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch +rdma-mlx5-handle-errors-returned-from-mlx5r_ib_rate.patch +arm-omap1-select-config_generic_irq_chip.patch +arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch +arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch +arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch-8866 +dma-mapping-fix-missing-clear-bdr-in-check_ram_in_ra.patch +rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch +rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch +rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch +rdma-hns-fix-invalid-sq-params-not-being-blocked.patch +rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch +rdma-hns-fix-missing-xa_destroy.patch +rdma-hns-fix-wrong-value-of-max_sge_rd.patch +bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch +bluetooth-hci_event-fix-connection-regression-betwee.patch +accel-qaic-fix-possible-data-corruption-in-bos-2g.patch +arm-davinci-da850-fix-selecting-arch_davinci_da8xx.patch +tracing-tprobe-events-fix-to-clean-up-tprobe-correct.patch +ata-libata-core-add-ata_quirk_no_lpm_on_ati-for-cert.patch +net-ethernet-ti-am65-cpsw-fix-napi-registration-sequ.patch +net-ipv6-fix-tcp-gso-segmentation-with-nat.patch +ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch +ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch +devlink-fix-xa_alloc_cyclic-error-handling.patch +dpll-fix-xa_alloc_cyclic-error-handling.patch +phy-fix-xa_alloc_cyclic-error-handling.patch +gpu-host1x-do-not-assume-that-a-null-domain-means-no.patch +net-atm-fix-use-after-free-in-lec_send.patch +net-ti-icssg-prueth-add-lock-to-stats.patch +net-lwtunnel-fix-recursion-loops.patch +net-ipv6-ioam6-fix-lwtunnel_output-loop.patch +libfs-fix-duplicate-directory-entry-in-offset_dir_lo.patch +net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch +revert-gre-fix-ipv6-link-local-address-generation.patch diff --git a/queue-6.12/soc-imx8m-remove-global-soc_uid.patch b/queue-6.12/soc-imx8m-remove-global-soc_uid.patch new file mode 100644 index 0000000000..8a4c147abb --- /dev/null +++ b/queue-6.12/soc-imx8m-remove-global-soc_uid.patch @@ -0,0 +1,127 @@ +From 73c8d7073d79d3f010fd80564bebf82be2d3d535 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2024 20:49:17 +0200 +Subject: soc: imx8m: Remove global soc_uid + +From: Marek Vasut + +[ Upstream commit 9c1c02fe8d7f33c18547b79c41f3fa41ef7bae8f ] + +The static global soc_uid is only ever used as kasprintf() parameter in +imx8m_soc_probe(). Pass pointer to local u64 variable to .soc_revision() +callback instead and let the .soc_revision() callback fill in the content. +Remove the unnecessary static global variable. + +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Stable-dep-of: cf7139aac463 ("soc: imx8m: Unregister cpufreq and soc dev in cleanup path") +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 31 +++++++++++++++---------------- + 1 file changed, 15 insertions(+), 16 deletions(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index 5ea8887828c06..966593320e28d 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -30,11 +30,9 @@ + + struct imx8_soc_data { + char *name; +- int (*soc_revision)(u32 *socrev); ++ int (*soc_revision)(u32 *socrev, u64 *socuid); + }; + +-static u64 soc_uid; +- + #ifdef CONFIG_HAVE_ARM_SMCCC + static u32 imx8mq_soc_revision_from_atf(void) + { +@@ -51,7 +49,7 @@ static u32 imx8mq_soc_revision_from_atf(void) + static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; }; + #endif + +-static int imx8mq_soc_revision(u32 *socrev) ++static int imx8mq_soc_revision(u32 *socrev, u64 *socuid) + { + struct device_node *np; + void __iomem *ocotp_base; +@@ -89,9 +87,9 @@ static int imx8mq_soc_revision(u32 *socrev) + rev = REV_B1; + } + +- soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH); +- soc_uid <<= 32; +- soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); ++ *socuid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH); ++ *socuid <<= 32; ++ *socuid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); + + *socrev = rev; + +@@ -109,7 +107,7 @@ static int imx8mq_soc_revision(u32 *socrev) + return ret; + } + +-static int imx8mm_soc_uid(void) ++static int imx8mm_soc_uid(u64 *socuid) + { + void __iomem *ocotp_base; + struct device_node *np; +@@ -136,9 +134,9 @@ static int imx8mm_soc_uid(void) + + clk_prepare_enable(clk); + +- soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH + offset); +- soc_uid <<= 32; +- soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW + offset); ++ *socuid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH + offset); ++ *socuid <<= 32; ++ *socuid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW + offset); + + clk_disable_unprepare(clk); + clk_put(clk); +@@ -151,7 +149,7 @@ static int imx8mm_soc_uid(void) + return ret; + } + +-static int imx8mm_soc_revision(u32 *socrev) ++static int imx8mm_soc_revision(u32 *socrev, u64 *socuid) + { + struct device_node *np; + void __iomem *anatop_base; +@@ -172,7 +170,7 @@ static int imx8mm_soc_revision(u32 *socrev) + iounmap(anatop_base); + of_node_put(np); + +- return imx8mm_soc_uid(); ++ return imx8mm_soc_uid(socuid); + + err_iomap: + of_node_put(np); +@@ -215,10 +213,11 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { + static int imx8m_soc_probe(struct platform_device *pdev) + { + struct soc_device_attribute *soc_dev_attr; +- struct soc_device *soc_dev; ++ const struct imx8_soc_data *data; + const struct of_device_id *id; ++ struct soc_device *soc_dev; + u32 soc_rev = 0; +- const struct imx8_soc_data *data; ++ u64 soc_uid = 0; + int ret; + + soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL); +@@ -241,7 +240,7 @@ static int imx8m_soc_probe(struct platform_device *pdev) + if (data) { + soc_dev_attr->soc_id = data->name; + if (data->soc_revision) { +- ret = data->soc_revision(&soc_rev); ++ ret = data->soc_revision(&soc_rev, &soc_uid); + if (ret) + goto free_soc; + } +-- +2.39.5 + diff --git a/queue-6.12/soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch b/queue-6.12/soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch new file mode 100644 index 0000000000..7f9f425680 --- /dev/null +++ b/queue-6.12/soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch @@ -0,0 +1,78 @@ +From cfcdd92dd3785ad849a1bf2209216876ae76885f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2025 16:47:51 +0800 +Subject: soc: imx8m: Unregister cpufreq and soc dev in cleanup path + +From: Peng Fan + +[ Upstream commit cf7139aac463880cbd5c5e999c118fbe91631411 ] + +Unregister the cpufreq device and soc device when resource unwinding, +otherwise there will be warning when do removing test: +sysfs: cannot create duplicate filename '/devices/platform/imx-cpufreq-dt' +CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.13.0-rc1-next-20241204 +Hardware name: NXP i.MX8MPlus EVK board (DT) + +Fixes: 9cc832d37799 ("soc: imx8m: Probe the SoC driver as platform driver") +Cc: Marco Felsch +Signed-off-by: Peng Fan +Reviewed-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 26 ++++++++++++++++++++++++-- + 1 file changed, 24 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index 8ac7658e3d525..3ed8161d7d28b 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -192,9 +192,20 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { + devm_kasprintf((dev), GFP_KERNEL, "%d.%d", ((soc_rev) >> 4) & 0xf, (soc_rev) & 0xf) : \ + "unknown" + ++static void imx8m_unregister_soc(void *data) ++{ ++ soc_device_unregister(data); ++} ++ ++static void imx8m_unregister_cpufreq(void *data) ++{ ++ platform_device_unregister(data); ++} ++ + static int imx8m_soc_probe(struct platform_device *pdev) + { + struct soc_device_attribute *soc_dev_attr; ++ struct platform_device *cpufreq_dev; + const struct imx8_soc_data *data; + struct device *dev = &pdev->dev; + const struct of_device_id *id; +@@ -239,11 +250,22 @@ static int imx8m_soc_probe(struct platform_device *pdev) + if (IS_ERR(soc_dev)) + return PTR_ERR(soc_dev); + ++ ret = devm_add_action(dev, imx8m_unregister_soc, soc_dev); ++ if (ret) ++ return ret; ++ + pr_info("SoC: %s revision %s\n", soc_dev_attr->soc_id, + soc_dev_attr->revision); + +- if (IS_ENABLED(CONFIG_ARM_IMX_CPUFREQ_DT)) +- platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0); ++ if (IS_ENABLED(CONFIG_ARM_IMX_CPUFREQ_DT)) { ++ cpufreq_dev = platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0); ++ if (IS_ERR(cpufreq_dev)) ++ return dev_err_probe(dev, PTR_ERR(cpufreq_dev), ++ "Failed to register imx-cpufreq-dev device\n"); ++ ret = devm_add_action(dev, imx8m_unregister_cpufreq, cpufreq_dev); ++ if (ret) ++ return ret; ++ } + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.12/soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch b/queue-6.12/soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch new file mode 100644 index 0000000000..2009ed01e8 --- /dev/null +++ b/queue-6.12/soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch @@ -0,0 +1,235 @@ +From d480a4ad0172ea809e301fff86d292f1d989066d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2024 20:49:18 +0200 +Subject: soc: imx8m: Use devm_* to simplify probe failure handling + +From: Marek Vasut + +[ Upstream commit 22b03a4e957e462b380a982759ccf0f6554735d3 ] + +Use device managed functions to simplify handling of failures during +probe. Remove fail paths which are no longer necessary. + +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Stable-dep-of: cf7139aac463 ("soc: imx8m: Unregister cpufreq and soc dev in cleanup path") +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 92 ++++++++++++------------------------- + 1 file changed, 29 insertions(+), 63 deletions(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index 966593320e28d..8ac7658e3d525 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -51,22 +51,20 @@ static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; }; + + static int imx8mq_soc_revision(u32 *socrev, u64 *socuid) + { +- struct device_node *np; ++ struct device_node *np __free(device_node) = ++ of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); + void __iomem *ocotp_base; + u32 magic; + u32 rev; + struct clk *clk; + int ret; + +- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); + if (!np) + return -EINVAL; + + ocotp_base = of_iomap(np, 0); +- if (!ocotp_base) { +- ret = -EINVAL; +- goto err_iomap; +- } ++ if (!ocotp_base) ++ return -EINVAL; + + clk = of_clk_get_by_name(np, NULL); + if (IS_ERR(clk)) { +@@ -96,35 +94,30 @@ static int imx8mq_soc_revision(u32 *socrev, u64 *socuid) + clk_disable_unprepare(clk); + clk_put(clk); + iounmap(ocotp_base); +- of_node_put(np); + + return 0; + + err_clk: + iounmap(ocotp_base); +-err_iomap: +- of_node_put(np); + return ret; + } + + static int imx8mm_soc_uid(u64 *socuid) + { ++ struct device_node *np __free(device_node) = ++ of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp"); + void __iomem *ocotp_base; +- struct device_node *np; + struct clk *clk; + int ret = 0; + u32 offset = of_machine_is_compatible("fsl,imx8mp") ? + IMX8MP_OCOTP_UID_OFFSET : 0; + +- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp"); + if (!np) + return -EINVAL; + + ocotp_base = of_iomap(np, 0); +- if (!ocotp_base) { +- ret = -EINVAL; +- goto err_iomap; +- } ++ if (!ocotp_base) ++ return -EINVAL; + + clk = of_clk_get_by_name(np, NULL); + if (IS_ERR(clk)) { +@@ -143,38 +136,27 @@ static int imx8mm_soc_uid(u64 *socuid) + + err_clk: + iounmap(ocotp_base); +-err_iomap: +- of_node_put(np); +- + return ret; + } + + static int imx8mm_soc_revision(u32 *socrev, u64 *socuid) + { +- struct device_node *np; ++ struct device_node *np __free(device_node) = ++ of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop"); + void __iomem *anatop_base; +- int ret; + +- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop"); + if (!np) + return -EINVAL; + + anatop_base = of_iomap(np, 0); +- if (!anatop_base) { +- ret = -EINVAL; +- goto err_iomap; +- } ++ if (!anatop_base) ++ return -EINVAL; + + *socrev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM); + + iounmap(anatop_base); +- of_node_put(np); + + return imx8mm_soc_uid(socuid); +- +-err_iomap: +- of_node_put(np); +- return ret; + } + + static const struct imx8_soc_data imx8mq_soc_data = { +@@ -205,22 +187,23 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { + { } + }; + +-#define imx8_revision(soc_rev) \ +- soc_rev ? \ +- kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf, soc_rev & 0xf) : \ ++#define imx8_revision(dev, soc_rev) \ ++ (soc_rev) ? \ ++ devm_kasprintf((dev), GFP_KERNEL, "%d.%d", ((soc_rev) >> 4) & 0xf, (soc_rev) & 0xf) : \ + "unknown" + + static int imx8m_soc_probe(struct platform_device *pdev) + { + struct soc_device_attribute *soc_dev_attr; + const struct imx8_soc_data *data; ++ struct device *dev = &pdev->dev; + const struct of_device_id *id; + struct soc_device *soc_dev; + u32 soc_rev = 0; + u64 soc_uid = 0; + int ret; + +- soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL); ++ soc_dev_attr = devm_kzalloc(dev, sizeof(*soc_dev_attr), GFP_KERNEL); + if (!soc_dev_attr) + return -ENOMEM; + +@@ -228,13 +211,11 @@ static int imx8m_soc_probe(struct platform_device *pdev) + + ret = of_property_read_string(of_root, "model", &soc_dev_attr->machine); + if (ret) +- goto free_soc; ++ return ret; + + id = of_match_node(imx8_soc_match, of_root); +- if (!id) { +- ret = -ENODEV; +- goto free_soc; +- } ++ if (!id) ++ return -ENODEV; + + data = id->data; + if (data) { +@@ -242,27 +223,21 @@ static int imx8m_soc_probe(struct platform_device *pdev) + if (data->soc_revision) { + ret = data->soc_revision(&soc_rev, &soc_uid); + if (ret) +- goto free_soc; ++ return ret; + } + } + +- soc_dev_attr->revision = imx8_revision(soc_rev); +- if (!soc_dev_attr->revision) { +- ret = -ENOMEM; +- goto free_soc; +- } ++ soc_dev_attr->revision = imx8_revision(dev, soc_rev); ++ if (!soc_dev_attr->revision) ++ return -ENOMEM; + +- soc_dev_attr->serial_number = kasprintf(GFP_KERNEL, "%016llX", soc_uid); +- if (!soc_dev_attr->serial_number) { +- ret = -ENOMEM; +- goto free_rev; +- } ++ soc_dev_attr->serial_number = devm_kasprintf(dev, GFP_KERNEL, "%016llX", soc_uid); ++ if (!soc_dev_attr->serial_number) ++ return -ENOMEM; + + soc_dev = soc_device_register(soc_dev_attr); +- if (IS_ERR(soc_dev)) { +- ret = PTR_ERR(soc_dev); +- goto free_serial_number; +- } ++ if (IS_ERR(soc_dev)) ++ return PTR_ERR(soc_dev); + + pr_info("SoC: %s revision %s\n", soc_dev_attr->soc_id, + soc_dev_attr->revision); +@@ -271,15 +246,6 @@ static int imx8m_soc_probe(struct platform_device *pdev) + platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0); + + return 0; +- +-free_serial_number: +- kfree(soc_dev_attr->serial_number); +-free_rev: +- if (strcmp(soc_dev_attr->revision, "unknown")) +- kfree(soc_dev_attr->revision); +-free_soc: +- kfree(soc_dev_attr); +- return ret; + } + + static struct platform_driver imx8m_soc_driver = { +-- +2.39.5 + diff --git a/queue-6.12/tracing-tprobe-events-fix-to-clean-up-tprobe-correct.patch b/queue-6.12/tracing-tprobe-events-fix-to-clean-up-tprobe-correct.patch new file mode 100644 index 0000000000..ce03862252 --- /dev/null +++ b/queue-6.12/tracing-tprobe-events-fix-to-clean-up-tprobe-correct.patch @@ -0,0 +1,64 @@ +From 0eb14445cf95f25eebc3cf73249e21f7f284f950 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 15:14:09 +0900 +Subject: tracing: tprobe-events: Fix to clean up tprobe correctly when module + unload + +From: Masami Hiramatsu (Google) + +[ Upstream commit 0a8bb688aa824863716fc570d818b8659a79309d ] + +When unloading module, the tprobe events are not correctly cleaned +up. Thus it becomes `fprobe-event` and never be enabled again even +if loading the same module again. + +For example; + + # cd /sys/kernel/tracing + # modprobe trace_events_sample + # echo 't:my_tprobe foo_bar' >> dynamic_events + # cat dynamic_events +t:tracepoints/my_tprobe foo_bar + # rmmod trace_events_sample + # cat dynamic_events +f:tracepoints/my_tprobe foo_bar + +As you can see, the second time my_tprobe starts with 'f' instead +of 't'. + +This unregisters the fprobe and tracepoint callback when module is +unloaded but marks the fprobe-event is tprobe-event. + +Link: https://lore.kernel.org/all/174158724946.189309.15826571379395619524.stgit@mhiramat.tok.corp.google.com/ + +Fixes: 57a7e6de9e30 ("tracing/fprobe: Support raw tracepoints on future loaded modules") +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_fprobe.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/trace_fprobe.c b/kernel/trace/trace_fprobe.c +index 99048c3303822..092c31907c71a 100644 +--- a/kernel/trace/trace_fprobe.c ++++ b/kernel/trace/trace_fprobe.c +@@ -977,10 +977,13 @@ static int __tracepoint_probe_module_cb(struct notifier_block *self, + reenable_trace_fprobe(tf); + } + } else if (val == MODULE_STATE_GOING && tp_mod->mod == tf->mod) { +- tracepoint_probe_unregister(tf->tpoint, ++ unregister_fprobe(&tf->fp); ++ if (trace_fprobe_is_tracepoint(tf)) { ++ tracepoint_probe_unregister(tf->tpoint, + tf->tpoint->probestub, NULL); +- tf->tpoint = NULL; +- tf->mod = NULL; ++ tf->tpoint = TRACEPOINT_STUB; ++ tf->mod = NULL; ++ } + } + } + mutex_unlock(&event_mutex); +-- +2.39.5 + diff --git a/queue-6.12/xfrm-fix-tunnel-mode-tx-datapath-in-packet-offload-m.patch b/queue-6.12/xfrm-fix-tunnel-mode-tx-datapath-in-packet-offload-m.patch new file mode 100644 index 0000000000..55a4ee4a50 --- /dev/null +++ b/queue-6.12/xfrm-fix-tunnel-mode-tx-datapath-in-packet-offload-m.patch @@ -0,0 +1,91 @@ +From 213bfc9b10e8a98a62475dcdbc65904025f69fae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 12:20:37 +0200 +Subject: xfrm: fix tunnel mode TX datapath in packet offload mode + +From: Alexandre Cassen + +[ Upstream commit 5eddd76ec2fd1988f0a3450fde9730b10dd22992 ] + +Packets that match the output xfrm policy are delivered to the netstack. +In IPsec packet mode for tunnel mode, the HW is responsible for building +the hard header and outer IP header. In such a situation, the inner +header may refer to a network that is not directly reachable by the host, +resulting in a failed neighbor resolution. The packet is then dropped. +xfrm policy defines the netdevice to use for xmit so we can send packets +directly to it. + +Makes direct xmit exclusive to tunnel mode, since some rules may apply +in transport mode. + +Fixes: f8a70afafc17 ("xfrm: add TX datapath support for IPsec packet offload mode") +Signed-off-by: Alexandre Cassen +Signed-off-by: Leon Romanovsky +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_output.c | 41 +++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 41 insertions(+) + +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index e5722c95b8bb3..9160a5e09041d 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -610,6 +610,40 @@ int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err) + } + EXPORT_SYMBOL_GPL(xfrm_output_resume); + ++static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x, ++ struct sk_buff *skb) ++{ ++ struct dst_entry *dst = skb_dst(skb); ++ struct net *net = xs_net(x); ++ int err; ++ ++ dst = skb_dst_pop(skb); ++ if (!dst) { ++ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); ++ kfree_skb(skb); ++ return -EHOSTUNREACH; ++ } ++ skb_dst_set(skb, dst); ++ nf_reset_ct(skb); ++ ++ err = skb_dst(skb)->ops->local_out(net, sk, skb); ++ if (unlikely(err != 1)) { ++ kfree_skb(skb); ++ return err; ++ } ++ ++ /* In transport mode, network destination is ++ * directly reachable, while in tunnel mode, ++ * inner packet network may not be. In packet ++ * offload type, HW is responsible for hard ++ * header packet mangling so directly xmit skb ++ * to netdevice. ++ */ ++ skb->dev = x->xso.dev; ++ __skb_push(skb, skb->dev->hard_header_len); ++ return dev_queue_xmit(skb); ++} ++ + static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb) + { + return xfrm_output_resume(sk, skb, 1); +@@ -729,6 +763,13 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) + return -EHOSTUNREACH; + } + ++ /* Exclusive direct xmit for tunnel mode, as ++ * some filtering or matching rules may apply ++ * in transport mode. ++ */ ++ if (x->props.mode == XFRM_MODE_TUNNEL) ++ return xfrm_dev_direct_output(sk, x, skb); ++ + return xfrm_output_resume(sk, skb, 0); + } + +-- +2.39.5 + diff --git a/queue-6.12/xfrm_output-force-software-gso-only-in-tunnel-mode.patch b/queue-6.12/xfrm_output-force-software-gso-only-in-tunnel-mode.patch new file mode 100644 index 0000000000..9af48bc129 --- /dev/null +++ b/queue-6.12/xfrm_output-force-software-gso-only-in-tunnel-mode.patch @@ -0,0 +1,77 @@ +From 4a0b8512ef52a8c68f9c765ba0450b5ef7386f0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 12:52:48 +0200 +Subject: xfrm_output: Force software GSO only in tunnel mode + +From: Cosmin Ratiu + +[ Upstream commit 0aae2867aa6067f73d066bc98385e23c8454a1d7 ] + +The cited commit fixed a software GSO bug with VXLAN + IPSec in tunnel +mode. Unfortunately, it is slightly broader than necessary, as it also +severely affects performance for Geneve + IPSec transport mode over a +device capable of both HW GSO and IPSec crypto offload. In this case, +xfrm_output unnecessarily triggers software GSO instead of letting the +HW do it. In simple iperf3 tests over Geneve + IPSec transport mode over +a back-2-back pair of NICs with MTU 1500, the performance was observed +to be up to 6x worse when doing software GSO compared to leaving it to +the hardware. + +This commit makes xfrm_output only trigger software GSO in crypto +offload cases for already encapsulated packets in tunnel mode, as not +doing so would then cause the inner tunnel skb->inner_networking_header +to be overwritten and break software GSO for that packet later if the +device turns out to not be capable of HW GSO. + +Taking a closer look at the conditions for the original bug, to better +understand the reasons for this change: +- vxlan_build_skb -> iptunnel_handle_offloads sets inner_protocol and + inner network header. +- then, udp_tunnel_xmit_skb -> ip_tunnel_xmit adds outer transport and + network headers. +- later in the xmit path, xfrm_output -> xfrm_outer_mode_output -> + xfrm4_prepare_output -> xfrm4_tunnel_encap_add overwrites the inner + network header with the one set in ip_tunnel_xmit before adding the + second outer header. +- __dev_queue_xmit -> validate_xmit_skb checks whether GSO segmentation + needs to happen based on dev features. In the original bug, the hw + couldn't segment the packets, so skb_gso_segment was invoked. +- deep in the .gso_segment callback machinery, __skb_udp_tunnel_segment + tries to use the wrong inner network header, expecting the one set in + iptunnel_handle_offloads but getting the one set by xfrm instead. +- a bit later, ipv6_gso_segment accesses the wrong memory based on that + wrong inner network header. + +With the new change, the original bug (or similar ones) cannot happen +again, as xfrm will now trigger software GSO before applying a tunnel. +This concern doesn't exist in packet offload mode, when the HW adds +encapsulation headers. For the non-offloaded packets (crypto in SW), +software GSO is still done unconditionally in the else branch. + +Reviewed-by: Dragos Tatulea +Reviewed-by: Yael Chemla +Reviewed-by: Leon Romanovsky +Fixes: a204aef9fd77 ("xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output") +Signed-off-by: Cosmin Ratiu +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index 9160a5e09041d..a30538a980cc7 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -793,7 +793,7 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) + skb->encapsulation = 1; + + if (skb_is_gso(skb)) { +- if (skb->inner_protocol) ++ if (skb->inner_protocol && x->props.mode == XFRM_MODE_TUNNEL) + return xfrm_output_gso(net, sk, skb); + + skb_shinfo(skb)->gso_type |= SKB_GSO_ESP; +-- +2.39.5 +