From 7cc3af765f6152a339f169a6d14ba3d05fc08af9 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 25 Mar 2025 07:52:29 -0400 Subject: [PATCH] 6.6-stable patches added patches: arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch bnxt_en-fix-receive-ring-space-parameters-when-xdp-is-active.patch btrfs-make-sure-that-written-is-set-on-all-metadata-blocks.patch netfilter-nft_counter-use-u64_stats_t-for-statistic.patch revert-sched-core-reduce-cost-of-sched_move_task-when-config-autogroup.patch wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch wifi-iwlwifi-support-bios-override-for-5g9-in-ca-also-in-lari-version-8.patch --- ...ix-u2phy1_host-status-for-nanopi-r4s.patch | 38 +++ ...-space-parameters-when-xdp-is-active.patch | 88 +++++++ ...ritten-is-set-on-all-metadata-blocks.patch | 150 +++++++++++ ...ounter-use-u64_stats_t-for-statistic.patch | 245 ++++++++++++++++++ ...ched_move_task-when-config-autogroup.patch | 194 ++++++++++++++ queue-6.6/series | 7 + ...m-ensure-offloading-tid-queue-exists.patch | 110 ++++++++ ...for-5g9-in-ca-also-in-lari-version-8.patch | 107 ++++++++ 8 files changed, 939 insertions(+) create mode 100644 queue-6.6/arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch create mode 100644 queue-6.6/bnxt_en-fix-receive-ring-space-parameters-when-xdp-is-active.patch create mode 100644 queue-6.6/btrfs-make-sure-that-written-is-set-on-all-metadata-blocks.patch create mode 100644 queue-6.6/netfilter-nft_counter-use-u64_stats_t-for-statistic.patch create mode 100644 queue-6.6/revert-sched-core-reduce-cost-of-sched_move_task-when-config-autogroup.patch create mode 100644 queue-6.6/wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch create mode 100644 queue-6.6/wifi-iwlwifi-support-bios-override-for-5g9-in-ca-also-in-lari-version-8.patch diff --git a/queue-6.6/arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch b/queue-6.6/arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch new file mode 100644 index 0000000000..1248f862ef --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch @@ -0,0 +1,38 @@ +From 38f4aa34a5f737ea8588dac320d884cc2e762c03 Mon Sep 17 00:00:00 2001 +From: Justin Klaassen +Date: Tue, 25 Feb 2025 17:03:58 +0000 +Subject: arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S + +From: Justin Klaassen + +commit 38f4aa34a5f737ea8588dac320d884cc2e762c03 upstream. + +The u2phy1_host should always have the same status as usb_host1_ehci +and usb_host1_ohci, otherwise the EHCI and OHCI drivers may be +initialized for a disabled usb port. + +Per the NanoPi R4S schematic, the phy-supply for u2phy1_host is set to +the vdd_5v regulator. + +Fixes: db792e9adbf8 ("rockchip: rk3399: Add support for FriendlyARM NanoPi R4S") +Cc: stable@vger.kernel.org +Signed-off-by: Justin Klaassen +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20250225170420.3898-1-justin@tidylabs.net +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts +@@ -117,7 +117,7 @@ + }; + + &u2phy1_host { +- status = "disabled"; ++ phy-supply = <&vdd_5v>; + }; + + &uart0 { diff --git a/queue-6.6/bnxt_en-fix-receive-ring-space-parameters-when-xdp-is-active.patch b/queue-6.6/bnxt_en-fix-receive-ring-space-parameters-when-xdp-is-active.patch new file mode 100644 index 0000000000..3e8b43b55d --- /dev/null +++ b/queue-6.6/bnxt_en-fix-receive-ring-space-parameters-when-xdp-is-active.patch @@ -0,0 +1,88 @@ +From 3051a77a09dfe3022aa012071346937fdf059033 Mon Sep 17 00:00:00 2001 +From: Shravya KN +Date: Fri, 22 Nov 2024 14:45:44 -0800 +Subject: bnxt_en: Fix receive ring space parameters when XDP is active + +From: Shravya KN + +commit 3051a77a09dfe3022aa012071346937fdf059033 upstream. + +The MTU setting at the time an XDP multi-buffer is attached +determines whether the aggregation ring will be used and the +rx_skb_func handler. This is done in bnxt_set_rx_skb_mode(). + +If the MTU is later changed, the aggregation ring setting may need +to be changed and it may become out-of-sync with the settings +initially done in bnxt_set_rx_skb_mode(). This may result in +random memory corruption and crashes as the HW may DMA data larger +than the allocated buffer size, such as: + +BUG: kernel NULL pointer dereference, address: 00000000000003c0 +PGD 0 P4D 0 +Oops: 0000 [#1] PREEMPT SMP NOPTI +CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1 +Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021 +RIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en] +Code: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 <0f> b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f +RSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202 +RAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff +RDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380 +RBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf +R10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980 +R13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990 +FS: 0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + + __bnxt_poll_work+0x1c2/0x3e0 [bnxt_en] + +To address the issue, we now call bnxt_set_rx_skb_mode() within +bnxt_change_mtu() to properly set the AGG rings configuration and +update rx_skb_func based on the new MTU value. +Additionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of +bnxt_set_rx_skb_mode() to make sure it gets set or cleared based on +the current MTU. + +Fixes: 08450ea98ae9 ("bnxt_en: Fix max_mtu setting for multi-buf XDP") +Co-developed-by: Somnath Kotur +Signed-off-by: Somnath Kotur +Signed-off-by: Shravya KN +Signed-off-by: Michael Chan +Signed-off-by: Paolo Abeni +Signed-off-by: Jianqi Ren +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -3987,7 +3987,7 @@ int bnxt_set_rx_skb_mode(struct bnxt *bp + struct net_device *dev = bp->dev; + + if (page_mode) { +- bp->flags &= ~BNXT_FLAG_AGG_RINGS; ++ bp->flags &= ~(BNXT_FLAG_AGG_RINGS | BNXT_FLAG_NO_AGG_RINGS); + bp->flags |= BNXT_FLAG_RX_PAGE_MODE; + + if (bp->xdp_prog->aux->xdp_has_frags) +@@ -12796,6 +12796,14 @@ static int bnxt_change_mtu(struct net_de + bnxt_close_nic(bp, true, false); + + dev->mtu = new_mtu; ++ ++ /* MTU change may change the AGG ring settings if an XDP multi-buffer ++ * program is attached. We need to set the AGG rings settings and ++ * rx_skb_func accordingly. ++ */ ++ if (READ_ONCE(bp->xdp_prog)) ++ bnxt_set_rx_skb_mode(bp, true); ++ + bnxt_set_ring_params(bp); + + if (netif_running(dev)) diff --git a/queue-6.6/btrfs-make-sure-that-written-is-set-on-all-metadata-blocks.patch b/queue-6.6/btrfs-make-sure-that-written-is-set-on-all-metadata-blocks.patch new file mode 100644 index 0000000000..c339f7c62e --- /dev/null +++ b/queue-6.6/btrfs-make-sure-that-written-is-set-on-all-metadata-blocks.patch @@ -0,0 +1,150 @@ +From e03418abde871314e1a3a550f4c8afb7b89cb273 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Mon, 29 Apr 2024 09:03:35 -0400 +Subject: btrfs: make sure that WRITTEN is set on all metadata blocks + +From: Josef Bacik + +commit e03418abde871314e1a3a550f4c8afb7b89cb273 upstream. + +We previously would call btrfs_check_leaf() if we had the check +integrity code enabled, which meant that we could only run the extended +leaf checks if we had WRITTEN set on the header flags. + +This leaves a gap in our checking, because we could end up with +corruption on disk where WRITTEN isn't set on the leaf, and then the +extended leaf checks don't get run which we rely on to validate all of +the item pointers to make sure we don't access memory outside of the +extent buffer. + +However, since 732fab95abe2 ("btrfs: check-integrity: remove +CONFIG_BTRFS_FS_CHECK_INTEGRITY option") we no longer call +btrfs_check_leaf() from btrfs_mark_buffer_dirty(), which means we only +ever call it on blocks that are being written out, and thus have WRITTEN +set, or that are being read in, which should have WRITTEN set. + +Add checks to make sure we have WRITTEN set appropriately, and then make +sure __btrfs_check_leaf() always does the item checking. This will +protect us from file systems that have been corrupted and no longer have +WRITTEN set on some of the blocks. + +This was hit on a crafted image tweaking the WRITTEN bit and reported by +KASAN as out-of-bound access in the eb accessors. The example is a dir +item at the end of an eb. + + [2.042] BTRFS warning (device loop1): bad eb member start: ptr 0x3fff start 30572544 member offset 16410 size 2 + [2.040] general protection fault, probably for non-canonical address 0xe0009d1000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI + [2.537] KASAN: maybe wild-memory-access in range [0x0005088000000018-0x000508800000001f] + [2.729] CPU: 0 PID: 2587 Comm: mount Not tainted 6.8.2 #1 + [2.729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 + [2.621] RIP: 0010:btrfs_get_16+0x34b/0x6d0 + [2.621] RSP: 0018:ffff88810871fab8 EFLAGS: 00000206 + [2.621] RAX: 0000a11000000003 RBX: ffff888104ff8720 RCX: ffff88811b2288c0 + [2.621] RDX: dffffc0000000000 RSI: ffffffff81dd8aca RDI: ffff88810871f748 + [2.621] RBP: 000000000000401a R08: 0000000000000001 R09: ffffed10210e3ee9 + [2.621] R10: ffff88810871f74f R11: 205d323430333737 R12: 000000000000001a + [2.621] R13: 000508800000001a R14: 1ffff110210e3f5d R15: ffffffff850011e8 + [2.621] FS: 00007f56ea275840(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000 + [2.621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [2.621] CR2: 00007febd13b75c0 CR3: 000000010bb50000 CR4: 00000000000006f0 + [2.621] Call Trace: + [2.621] + [2.621] ? show_regs+0x74/0x80 + [2.621] ? die_addr+0x46/0xc0 + [2.621] ? exc_general_protection+0x161/0x2a0 + [2.621] ? asm_exc_general_protection+0x26/0x30 + [2.621] ? btrfs_get_16+0x33a/0x6d0 + [2.621] ? btrfs_get_16+0x34b/0x6d0 + [2.621] ? btrfs_get_16+0x33a/0x6d0 + [2.621] ? __pfx_btrfs_get_16+0x10/0x10 + [2.621] ? __pfx_mutex_unlock+0x10/0x10 + [2.621] btrfs_match_dir_item_name+0x101/0x1a0 + [2.621] btrfs_lookup_dir_item+0x1f3/0x280 + [2.621] ? __pfx_btrfs_lookup_dir_item+0x10/0x10 + [2.621] btrfs_get_tree+0xd25/0x1910 + +Reported-by: lei lu +CC: stable@vger.kernel.org # 6.7+ +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +[ copy more details from report ] +Signed-off-by: David Sterba +Signed-off-by: Jianqi Ren +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/tree-checker.c | 30 +++++++++++++++--------------- + fs/btrfs/tree-checker.h | 1 + + 2 files changed, 16 insertions(+), 15 deletions(-) + +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -1889,6 +1889,11 @@ enum btrfs_tree_block_status __btrfs_che + return BTRFS_TREE_BLOCK_INVALID_LEVEL; + } + ++ if (unlikely(!btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_WRITTEN))) { ++ generic_err(leaf, 0, "invalid flag for leaf, WRITTEN not set"); ++ return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET; ++ } ++ + /* + * Extent buffers from a relocation tree have a owner field that + * corresponds to the subvolume tree they are based on. So just from an +@@ -1950,6 +1955,7 @@ enum btrfs_tree_block_status __btrfs_che + for (slot = 0; slot < nritems; slot++) { + u32 item_end_expected; + u64 item_data_end; ++ enum btrfs_tree_block_status ret; + + btrfs_item_key_to_cpu(leaf, &key, slot); + +@@ -2005,21 +2011,10 @@ enum btrfs_tree_block_status __btrfs_che + return BTRFS_TREE_BLOCK_INVALID_OFFSETS; + } + +- /* +- * We only want to do this if WRITTEN is set, otherwise the leaf +- * may be in some intermediate state and won't appear valid. +- */ +- if (btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_WRITTEN)) { +- enum btrfs_tree_block_status ret; +- +- /* +- * Check if the item size and content meet other +- * criteria +- */ +- ret = check_leaf_item(leaf, &key, slot, &prev_key); +- if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN)) +- return ret; +- } ++ /* Check if the item size and content meet other criteria. */ ++ ret = check_leaf_item(leaf, &key, slot, &prev_key); ++ if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN)) ++ return ret; + + prev_key.objectid = key.objectid; + prev_key.type = key.type; +@@ -2049,6 +2044,11 @@ enum btrfs_tree_block_status __btrfs_che + int level = btrfs_header_level(node); + u64 bytenr; + ++ if (unlikely(!btrfs_header_flag(node, BTRFS_HEADER_FLAG_WRITTEN))) { ++ generic_err(node, 0, "invalid flag for node, WRITTEN not set"); ++ return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET; ++ } ++ + if (unlikely(level <= 0 || level >= BTRFS_MAX_LEVEL)) { + generic_err(node, 0, + "invalid level for node, have %d expect [1, %d]", +--- a/fs/btrfs/tree-checker.h ++++ b/fs/btrfs/tree-checker.h +@@ -51,6 +51,7 @@ enum btrfs_tree_block_status { + BTRFS_TREE_BLOCK_INVALID_BLOCKPTR, + BTRFS_TREE_BLOCK_INVALID_ITEM, + BTRFS_TREE_BLOCK_INVALID_OWNER, ++ BTRFS_TREE_BLOCK_WRITTEN_NOT_SET, + }; + + /* diff --git a/queue-6.6/netfilter-nft_counter-use-u64_stats_t-for-statistic.patch b/queue-6.6/netfilter-nft_counter-use-u64_stats_t-for-statistic.patch new file mode 100644 index 0000000000..480a5ce61e --- /dev/null +++ b/queue-6.6/netfilter-nft_counter-use-u64_stats_t-for-statistic.patch @@ -0,0 +1,245 @@ +From 4a1d3acd6ea86075e77fcc1188c3fc372833ba73 Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Tue, 20 Aug 2024 09:54:32 +0200 +Subject: netfilter: nft_counter: Use u64_stats_t for statistic. + +From: Sebastian Andrzej Siewior + +commit 4a1d3acd6ea86075e77fcc1188c3fc372833ba73 upstream. + +The nft_counter uses two s64 counters for statistics. Those two are +protected by a seqcount to ensure that the 64bit variable is always +properly seen during updates even on 32bit architectures where the store +is performed by two writes. A side effect is that the two counter (bytes +and packet) are written and read together in the same window. + +This can be replaced with u64_stats_t. write_seqcount_begin()/ end() is +replaced with u64_stats_update_begin()/ end() and behaves the same way +as with seqcount_t on 32bit architectures. Additionally there is a +preempt_disable on PREEMPT_RT to ensure that a reader does not preempt a +writer. +On 64bit architectures the macros are removed and the reads happen +without any retries. This also means that the reader can observe one +counter (bytes) from before the update and the other counter (packets) +but that is okay since there is no requirement to have both counter from +the same update window. + +Convert the statistic to u64_stats_t. There is one optimisation: +nft_counter_do_init() and nft_counter_clone() allocate a new per-CPU +counter and assign a value to it. During this assignment preemption is +disabled which is not needed because the counter is not yet exposed to +the system so there can not be another writer or reader. Therefore +disabling preemption is omitted and raw_cpu_ptr() is used to obtain a +pointer to a counter for the assignment. + +Cc: Eric Dumazet +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Felix Moessbauer +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nft_counter.c | 90 ++++++++++++++++++++++---------------------- + 1 file changed, 46 insertions(+), 44 deletions(-) + +--- a/net/netfilter/nft_counter.c ++++ b/net/netfilter/nft_counter.c +@@ -8,7 +8,7 @@ + #include + #include + #include +-#include ++#include + #include + #include + #include +@@ -17,6 +17,11 @@ + #include + + struct nft_counter { ++ u64_stats_t bytes; ++ u64_stats_t packets; ++}; ++ ++struct nft_counter_tot { + s64 bytes; + s64 packets; + }; +@@ -25,25 +30,24 @@ struct nft_counter_percpu_priv { + struct nft_counter __percpu *counter; + }; + +-static DEFINE_PER_CPU(seqcount_t, nft_counter_seq); ++static DEFINE_PER_CPU(struct u64_stats_sync, nft_counter_sync); + + static inline void nft_counter_do_eval(struct nft_counter_percpu_priv *priv, + struct nft_regs *regs, + const struct nft_pktinfo *pkt) + { ++ struct u64_stats_sync *nft_sync; + struct nft_counter *this_cpu; +- seqcount_t *myseq; + + local_bh_disable(); + this_cpu = this_cpu_ptr(priv->counter); +- myseq = this_cpu_ptr(&nft_counter_seq); +- +- write_seqcount_begin(myseq); ++ nft_sync = this_cpu_ptr(&nft_counter_sync); + +- this_cpu->bytes += pkt->skb->len; +- this_cpu->packets++; ++ u64_stats_update_begin(nft_sync); ++ u64_stats_add(&this_cpu->bytes, pkt->skb->len); ++ u64_stats_inc(&this_cpu->packets); ++ u64_stats_update_end(nft_sync); + +- write_seqcount_end(myseq); + local_bh_enable(); + } + +@@ -66,17 +70,16 @@ static int nft_counter_do_init(const str + if (cpu_stats == NULL) + return -ENOMEM; + +- preempt_disable(); +- this_cpu = this_cpu_ptr(cpu_stats); ++ this_cpu = raw_cpu_ptr(cpu_stats); + if (tb[NFTA_COUNTER_PACKETS]) { +- this_cpu->packets = +- be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); ++ u64_stats_set(&this_cpu->packets, ++ be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]))); + } + if (tb[NFTA_COUNTER_BYTES]) { +- this_cpu->bytes = +- be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); ++ u64_stats_set(&this_cpu->bytes, ++ be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]))); + } +- preempt_enable(); ++ + priv->counter = cpu_stats; + return 0; + } +@@ -104,40 +107,41 @@ static void nft_counter_obj_destroy(cons + } + + static void nft_counter_reset(struct nft_counter_percpu_priv *priv, +- struct nft_counter *total) ++ struct nft_counter_tot *total) + { ++ struct u64_stats_sync *nft_sync; + struct nft_counter *this_cpu; +- seqcount_t *myseq; + + local_bh_disable(); + this_cpu = this_cpu_ptr(priv->counter); +- myseq = this_cpu_ptr(&nft_counter_seq); ++ nft_sync = this_cpu_ptr(&nft_counter_sync); ++ ++ u64_stats_update_begin(nft_sync); ++ u64_stats_add(&this_cpu->packets, -total->packets); ++ u64_stats_add(&this_cpu->bytes, -total->bytes); ++ u64_stats_update_end(nft_sync); + +- write_seqcount_begin(myseq); +- this_cpu->packets -= total->packets; +- this_cpu->bytes -= total->bytes; +- write_seqcount_end(myseq); + local_bh_enable(); + } + + static void nft_counter_fetch(struct nft_counter_percpu_priv *priv, +- struct nft_counter *total) ++ struct nft_counter_tot *total) + { + struct nft_counter *this_cpu; +- const seqcount_t *myseq; + u64 bytes, packets; + unsigned int seq; + int cpu; + + memset(total, 0, sizeof(*total)); + for_each_possible_cpu(cpu) { +- myseq = per_cpu_ptr(&nft_counter_seq, cpu); ++ struct u64_stats_sync *nft_sync = per_cpu_ptr(&nft_counter_sync, cpu); ++ + this_cpu = per_cpu_ptr(priv->counter, cpu); + do { +- seq = read_seqcount_begin(myseq); +- bytes = this_cpu->bytes; +- packets = this_cpu->packets; +- } while (read_seqcount_retry(myseq, seq)); ++ seq = u64_stats_fetch_begin(nft_sync); ++ bytes = u64_stats_read(&this_cpu->bytes); ++ packets = u64_stats_read(&this_cpu->packets); ++ } while (u64_stats_fetch_retry(nft_sync, seq)); + + total->bytes += bytes; + total->packets += packets; +@@ -148,7 +152,7 @@ static int nft_counter_do_dump(struct sk + struct nft_counter_percpu_priv *priv, + bool reset) + { +- struct nft_counter total; ++ struct nft_counter_tot total; + + nft_counter_fetch(priv, &total); + +@@ -237,7 +241,7 @@ static int nft_counter_clone(struct nft_ + struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst); + struct nft_counter __percpu *cpu_stats; + struct nft_counter *this_cpu; +- struct nft_counter total; ++ struct nft_counter_tot total; + + nft_counter_fetch(priv, &total); + +@@ -245,11 +249,9 @@ static int nft_counter_clone(struct nft_ + if (cpu_stats == NULL) + return -ENOMEM; + +- preempt_disable(); +- this_cpu = this_cpu_ptr(cpu_stats); +- this_cpu->packets = total.packets; +- this_cpu->bytes = total.bytes; +- preempt_enable(); ++ this_cpu = raw_cpu_ptr(cpu_stats); ++ u64_stats_set(&this_cpu->packets, total.packets); ++ u64_stats_set(&this_cpu->bytes, total.bytes); + + priv_clone->counter = cpu_stats; + return 0; +@@ -267,17 +269,17 @@ static void nft_counter_offload_stats(st + const struct flow_stats *stats) + { + struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); ++ struct u64_stats_sync *nft_sync; + struct nft_counter *this_cpu; +- seqcount_t *myseq; + + local_bh_disable(); + this_cpu = this_cpu_ptr(priv->counter); +- myseq = this_cpu_ptr(&nft_counter_seq); ++ nft_sync = this_cpu_ptr(&nft_counter_sync); + +- write_seqcount_begin(myseq); +- this_cpu->packets += stats->pkts; +- this_cpu->bytes += stats->bytes; +- write_seqcount_end(myseq); ++ u64_stats_update_begin(nft_sync); ++ u64_stats_add(&this_cpu->packets, stats->pkts); ++ u64_stats_add(&this_cpu->bytes, stats->bytes); ++ u64_stats_update_end(nft_sync); + local_bh_enable(); + } + +@@ -286,7 +288,7 @@ void nft_counter_init_seqcount(void) + int cpu; + + for_each_possible_cpu(cpu) +- seqcount_init(per_cpu_ptr(&nft_counter_seq, cpu)); ++ u64_stats_init(per_cpu_ptr(&nft_counter_sync, cpu)); + } + + struct nft_expr_type nft_counter_type; diff --git a/queue-6.6/revert-sched-core-reduce-cost-of-sched_move_task-when-config-autogroup.patch b/queue-6.6/revert-sched-core-reduce-cost-of-sched_move_task-when-config-autogroup.patch new file mode 100644 index 0000000000..f0e4e225f0 --- /dev/null +++ b/queue-6.6/revert-sched-core-reduce-cost-of-sched_move_task-when-config-autogroup.patch @@ -0,0 +1,194 @@ +From 76f970ce51c80f625eb6ddbb24e9cb51b977b598 Mon Sep 17 00:00:00 2001 +From: Dietmar Eggemann +Date: Fri, 14 Mar 2025 16:13:45 +0100 +Subject: Revert "sched/core: Reduce cost of sched_move_task when config autogroup" + +From: Dietmar Eggemann + +commit 76f970ce51c80f625eb6ddbb24e9cb51b977b598 upstream. + +This reverts commit eff6c8ce8d4d7faef75f66614dd20bb50595d261. + +Hazem reported a 30% drop in UnixBench spawn test with commit +eff6c8ce8d4d ("sched/core: Reduce cost of sched_move_task when config +autogroup") on a m6g.xlarge AWS EC2 instance with 4 vCPUs and 16 GiB RAM +(aarch64) (single level MC sched domain): + + https://lkml.kernel.org/r/20250205151026.13061-1-hagarhem@amazon.com + +There is an early bail from sched_move_task() if p->sched_task_group is +equal to p's 'cpu cgroup' (sched_get_task_group()). E.g. both are +pointing to taskgroup '/user.slice/user-1000.slice/session-1.scope' +(Ubuntu '22.04.5 LTS'). + +So in: + + do_exit() + + sched_autogroup_exit_task() + + sched_move_task() + + if sched_get_task_group(p) == p->sched_task_group + return + + /* p is enqueued */ + dequeue_task() \ + sched_change_group() | + task_change_group_fair() | + detach_task_cfs_rq() | (1) + set_task_rq() | + attach_task_cfs_rq() | + enqueue_task() / + +(1) isn't called for p anymore. + +Turns out that the regression is related to sgs->group_util in +group_is_overloaded() and group_has_capacity(). If (1) isn't called for +all the 'spawn' tasks then sgs->group_util is ~900 and +sgs->group_capacity = 1024 (single CPU sched domain) and this leads to +group_is_overloaded() returning true (2) and group_has_capacity() false +(3) much more often compared to the case when (1) is called. + +I.e. there are much more cases of 'group_is_overloaded' and +'group_fully_busy' in WF_FORK wakeup sched_balance_find_dst_cpu() which +then returns much more often a CPU != smp_processor_id() (5). + +This isn't good for these extremely short running tasks (FORK + EXIT) +and also involves calling sched_balance_find_dst_group_cpu() unnecessary +(single CPU sched domain). + +Instead if (1) is called for 'p->flags & PF_EXITING' then the path +(4),(6) is taken much more often. + + select_task_rq_fair(..., wake_flags = WF_FORK) + + cpu = smp_processor_id() + + new_cpu = sched_balance_find_dst_cpu(..., cpu, ...) + + group = sched_balance_find_dst_group(..., cpu) + + do { + + update_sg_wakeup_stats() + + sgs->group_type = group_classify() + + if group_is_overloaded() (2) + return group_overloaded + + if !group_has_capacity() (3) + return group_fully_busy + + return group_has_spare (4) + + } while group + + if local_sgs.group_type > idlest_sgs.group_type + return idlest (5) + + case group_has_spare: + + if local_sgs.idle_cpus >= idlest_sgs.idle_cpus + return NULL (6) + +Unixbench Tests './Run -c 4 spawn' on: + +(a) VM AWS instance (m7gd.16xlarge) with v6.13 ('maxcpus=4 nr_cpus=4') + and Ubuntu 22.04.5 LTS (aarch64). + + Shell & test run in '/user.slice/user-1000.slice/session-1.scope'. + + w/o patch w/ patch + 21005 27120 + +(b) i7-13700K with tip/sched/core ('nosmt maxcpus=8 nr_cpus=8') and + Ubuntu 22.04.5 LTS (x86_64). + + Shell & test run in '/A'. + + w/o patch w/ patch + 67675 88806 + +CONFIG_SCHED_AUTOGROUP=y & /sys/proc/kernel/sched_autogroup_enabled equal +0 or 1. + +Reported-by: Hazem Mohamed Abuelfotoh +Signed-off-by: Dietmar Eggemann +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Reviewed-by: Vincent Guittot +Tested-by: Hagar Hemdan +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20250314151345.275739-1-dietmar.eggemann@arm.com +[Hagar: clean revert of eff6c8ce8dd7 to make it work on 6.6] +Signed-off-by: Hagar Hemdan +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/core.c | 22 +++------------------- + 1 file changed, 3 insertions(+), 19 deletions(-) + +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -10494,7 +10494,7 @@ void sched_release_group(struct task_gro + spin_unlock_irqrestore(&task_group_lock, flags); + } + +-static struct task_group *sched_get_task_group(struct task_struct *tsk) ++static void sched_change_group(struct task_struct *tsk) + { + struct task_group *tg; + +@@ -10506,13 +10506,7 @@ static struct task_group *sched_get_task + tg = container_of(task_css_check(tsk, cpu_cgrp_id, true), + struct task_group, css); + tg = autogroup_task_group(tsk, tg); +- +- return tg; +-} +- +-static void sched_change_group(struct task_struct *tsk, struct task_group *group) +-{ +- tsk->sched_task_group = group; ++ tsk->sched_task_group = tg; + + #ifdef CONFIG_FAIR_GROUP_SCHED + if (tsk->sched_class->task_change_group) +@@ -10533,19 +10527,10 @@ void sched_move_task(struct task_struct + { + int queued, running, queue_flags = + DEQUEUE_SAVE | DEQUEUE_MOVE | DEQUEUE_NOCLOCK; +- struct task_group *group; + struct rq_flags rf; + struct rq *rq; + + rq = task_rq_lock(tsk, &rf); +- /* +- * Esp. with SCHED_AUTOGROUP enabled it is possible to get superfluous +- * group changes. +- */ +- group = sched_get_task_group(tsk); +- if (group == tsk->sched_task_group) +- goto unlock; +- + update_rq_clock(rq); + + running = task_current(rq, tsk); +@@ -10556,7 +10541,7 @@ void sched_move_task(struct task_struct + if (running) + put_prev_task(rq, tsk); + +- sched_change_group(tsk, group); ++ sched_change_group(tsk); + + if (queued) + enqueue_task(rq, tsk, queue_flags); +@@ -10570,7 +10555,6 @@ void sched_move_task(struct task_struct + resched_curr(rq); + } + +-unlock: + task_rq_unlock(rq, tsk, &rf); + } + diff --git a/queue-6.6/series b/queue-6.6/series index cc39d33e2a..654e20c5a4 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -68,3 +68,10 @@ kvm-arm64-remove-vhe-host-restore-of-cpacr_el1.smen.patch kvm-arm64-refactor-exit-handlers.patch kvm-arm64-mark-some-header-functions-as-inline.patch kvm-arm64-eagerly-switch-zcr_el-1-2.patch +arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch +revert-sched-core-reduce-cost-of-sched_move_task-when-config-autogroup.patch +btrfs-make-sure-that-written-is-set-on-all-metadata-blocks.patch +bnxt_en-fix-receive-ring-space-parameters-when-xdp-is-active.patch +wifi-iwlwifi-support-bios-override-for-5g9-in-ca-also-in-lari-version-8.patch +wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch +netfilter-nft_counter-use-u64_stats_t-for-statistic.patch diff --git a/queue-6.6/wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch b/queue-6.6/wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch new file mode 100644 index 0000000000..3acd4ea1f7 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch @@ -0,0 +1,110 @@ +From 78f65fbf421a61894c14a1b91fe2fb4437b3fe5f Mon Sep 17 00:00:00 2001 +From: Benjamin Berg +Date: Sun, 18 Feb 2024 19:51:47 +0200 +Subject: wifi: iwlwifi: mvm: ensure offloading TID queue exists + +From: Benjamin Berg + +commit 78f65fbf421a61894c14a1b91fe2fb4437b3fe5f upstream. + +The resume code path assumes that the TX queue for the offloading TID +has been configured. At resume time it then tries to sync the write +pointer as it may have been updated by the firmware. + +In the unusual event that no packets have been send on TID 0, the queue +will not have been allocated and this causes a crash. Fix this by +ensuring the queue exist at suspend time. + +Signed-off-by: Benjamin Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240218194912.6632e6dc7b35.Ie6e6a7488c9c7d4529f13d48f752b5439d8ac3c4@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Jianqi Ren +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 9 +++++++- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 28 +++++++++++++++++++++++++++ + drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 3 +- + 3 files changed, 38 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +@@ -1293,7 +1293,9 @@ static int __iwl_mvm_suspend(struct ieee + + mvm->net_detect = true; + } else { +- struct iwl_wowlan_config_cmd wowlan_config_cmd = {}; ++ struct iwl_wowlan_config_cmd wowlan_config_cmd = { ++ .offloading_tid = 0, ++ }; + + wowlan_config_cmd.sta_id = mvmvif->deflink.ap_sta_id; + +@@ -1305,6 +1307,11 @@ static int __iwl_mvm_suspend(struct ieee + goto out_noreset; + } + ++ ret = iwl_mvm_sta_ensure_queue( ++ mvm, ap_sta->txq[wowlan_config_cmd.offloading_tid]); ++ if (ret) ++ goto out_noreset; ++ + ret = iwl_mvm_get_wowlan_config(mvm, wowlan, &wowlan_config_cmd, + vif, mvmvif, ap_sta); + if (ret) +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -1501,6 +1501,34 @@ out_err: + return ret; + } + ++int iwl_mvm_sta_ensure_queue(struct iwl_mvm *mvm, ++ struct ieee80211_txq *txq) ++{ ++ struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq); ++ int ret = -EINVAL; ++ ++ lockdep_assert_held(&mvm->mutex); ++ ++ if (likely(test_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state)) || ++ !txq->sta) { ++ return 0; ++ } ++ ++ if (!iwl_mvm_sta_alloc_queue(mvm, txq->sta, txq->ac, txq->tid)) { ++ set_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state); ++ ret = 0; ++ } ++ ++ local_bh_disable(); ++ spin_lock(&mvm->add_stream_lock); ++ if (!list_empty(&mvmtxq->list)) ++ list_del_init(&mvmtxq->list); ++ spin_unlock(&mvm->add_stream_lock); ++ local_bh_enable(); ++ ++ return ret; ++} ++ + void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk) + { + struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm, +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h +@@ -1,6 +1,6 @@ + /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ + /* +- * Copyright (C) 2012-2014, 2018-2022 Intel Corporation ++ * Copyright (C) 2012-2014, 2018-2024 Intel Corporation + * Copyright (C) 2013-2014 Intel Mobile Communications GmbH + * Copyright (C) 2015-2016 Intel Deutschland GmbH + */ +@@ -577,6 +577,7 @@ void iwl_mvm_modify_all_sta_disable_tx(s + bool disable); + + void iwl_mvm_csa_client_absent(struct iwl_mvm *mvm, struct ieee80211_vif *vif); ++int iwl_mvm_sta_ensure_queue(struct iwl_mvm *mvm, struct ieee80211_txq *txq); + void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk); + int iwl_mvm_add_pasn_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + struct iwl_mvm_int_sta *sta, u8 *addr, u32 cipher, diff --git a/queue-6.6/wifi-iwlwifi-support-bios-override-for-5g9-in-ca-also-in-lari-version-8.patch b/queue-6.6/wifi-iwlwifi-support-bios-override-for-5g9-in-ca-also-in-lari-version-8.patch new file mode 100644 index 0000000000..5fed125648 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-support-bios-override-for-5g9-in-ca-also-in-lari-version-8.patch @@ -0,0 +1,107 @@ +From b1e8102a4048003097c7054cbc00bbda91a5ced7 Mon Sep 17 00:00:00 2001 +From: Miri Korenblit +Date: Thu, 26 Dec 2024 17:44:49 +0200 +Subject: wifi: iwlwifi: support BIOS override for 5G9 in CA also in LARI version 8 + +From: Miri Korenblit + +commit b1e8102a4048003097c7054cbc00bbda91a5ced7 upstream. + +Commit 6b3e87cc0ca5 ("iwlwifi: Add support for LARI_CONFIG_CHANGE_CMD +cmd v9") +added a few bits to iwl_lari_config_change_cmd::oem_unii4_allow_bitmap +if the FW has LARI version >= 9. +But we also need to send those bits for version 8 if the FW is capable +of this feature (indicated with capability bits) +Add the FW capability bit, and set the additional bits in the cmd when +the version is 8 and the FW capability bit is set. + +Signed-off-by: Miri Korenblit +Reviewed-by: Johannes Berg +Link: https://patch.msgid.link/20241226174257.dc5836f84514.I1e38f94465a36731034c94b9811de10cb6ee5921@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/fw/file.h | 4 ++ + drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 37 +++++++++++++++++++++++++-- + 2 files changed, 38 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h +@@ -372,6 +372,8 @@ typedef unsigned int __bitwise iwl_ucode + * channels even when these are not enabled. + * @IWL_UCODE_TLV_CAPA_DUMP_COMPLETE_SUPPORT: Support for indicating dump collection + * complete to FW. ++ * @IWL_UCODE_TLV_CAPA_BIOS_OVERRIDE_5G9_FOR_CA: supports (de)activating 5G9 ++ * for CA from BIOS. + * + * @NUM_IWL_UCODE_TLV_CAPA: number of bits used + */ +@@ -468,7 +470,7 @@ enum iwl_ucode_tlv_capa { + IWL_UCODE_TLV_CAPA_OFFLOAD_BTM_SUPPORT = (__force iwl_ucode_tlv_capa_t)113, + IWL_UCODE_TLV_CAPA_STA_EXP_MFP_SUPPORT = (__force iwl_ucode_tlv_capa_t)114, + IWL_UCODE_TLV_CAPA_SNIFF_VALIDATE_SUPPORT = (__force iwl_ucode_tlv_capa_t)116, +- ++ IWL_UCODE_TLV_CAPA_BIOS_OVERRIDE_5G9_FOR_CA = (__force iwl_ucode_tlv_capa_t)123, + #ifdef __CHECKER__ + /* sparse says it cannot increment the previous enum member */ + #define NUM_IWL_UCODE_TLV_CAPA 128 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -1195,11 +1195,30 @@ static u8 iwl_mvm_eval_dsm_rfi(struct iw + return DSM_VALUE_RFI_DISABLE; + } + ++enum iwl_dsm_unii4_bitmap { ++ DSM_VALUE_UNII4_US_OVERRIDE_MSK = BIT(0), ++ DSM_VALUE_UNII4_US_EN_MSK = BIT(1), ++ DSM_VALUE_UNII4_ETSI_OVERRIDE_MSK = BIT(2), ++ DSM_VALUE_UNII4_ETSI_EN_MSK = BIT(3), ++ DSM_VALUE_UNII4_CANADA_OVERRIDE_MSK = BIT(4), ++ DSM_VALUE_UNII4_CANADA_EN_MSK = BIT(5), ++}; ++ ++#define DSM_UNII4_ALLOW_BITMAP (DSM_VALUE_UNII4_US_OVERRIDE_MSK |\ ++ DSM_VALUE_UNII4_US_EN_MSK |\ ++ DSM_VALUE_UNII4_ETSI_OVERRIDE_MSK |\ ++ DSM_VALUE_UNII4_ETSI_EN_MSK |\ ++ DSM_VALUE_UNII4_CANADA_OVERRIDE_MSK |\ ++ DSM_VALUE_UNII4_CANADA_EN_MSK) ++ + static void iwl_mvm_lari_cfg(struct iwl_mvm *mvm) + { + int ret; + u32 value; + struct iwl_lari_config_change_cmd_v6 cmd = {}; ++ u8 cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, ++ WIDE_ID(REGULATORY_AND_NVM_GROUP, ++ LARI_CONFIG_CHANGE), 1); + + cmd.config_bitmap = iwl_acpi_get_lari_config_bitmap(&mvm->fwrt); + +@@ -1211,8 +1230,22 @@ static void iwl_mvm_lari_cfg(struct iwl_ + ret = iwl_acpi_get_dsm_u32(mvm->fwrt.dev, 0, + DSM_FUNC_ENABLE_UNII4_CHAN, + &iwl_guid, &value); +- if (!ret) +- cmd.oem_unii4_allow_bitmap = cpu_to_le32(value); ++ if (!ret) { ++ u32 _value = cpu_to_le32(value); ++ ++ _value &= DSM_UNII4_ALLOW_BITMAP; ++ ++ /* Since version 9, bits 4 and 5 are supported ++ * regardless of this capability. ++ */ ++ if (cmd_ver < 9 && ++ !fw_has_capa(&mvm->fw->ucode_capa, ++ IWL_UCODE_TLV_CAPA_BIOS_OVERRIDE_5G9_FOR_CA)) ++ _value &= ~(DSM_VALUE_UNII4_CANADA_OVERRIDE_MSK | ++ DSM_VALUE_UNII4_CANADA_EN_MSK); ++ ++ cmd.oem_unii4_allow_bitmap = cpu_to_le32(_value); ++ } + + ret = iwl_acpi_get_dsm_u32(mvm->fwrt.dev, 0, + DSM_FUNC_ACTIVATE_CHANNEL, -- 2.47.3