diff options
28 files changed, 2765 insertions, 0 deletions
diff --git a/queue-6.6/af_unix-don-t-set-econnreset-for-consumed-oob-skb.patch b/queue-6.6/af_unix-don-t-set-econnreset-for-consumed-oob-skb.patch new file mode 100644 index 0000000000..7a11586184 --- /dev/null +++ b/queue-6.6/af_unix-don-t-set-econnreset-for-consumed-oob-skb.patch @@ -0,0 +1,99 @@ +From acc2b0eab34c91524459922bdfb84d1f7e69a156 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 18 Jun 2025 21:13:57 -0700 +Subject: af_unix: Don't set -ECONNRESET for consumed OOB skb. + +From: Kuniyuki Iwashima <kuniyu@google.com> + +[ Upstream commit 2a5a4841846b079b5fca5752fe94e59346fbda40 ] + +Christian Brauner reported that even after MSG_OOB data is consumed, +calling close() on the receiver socket causes the peer's recv() to +return -ECONNRESET: + + 1. send() and recv() an OOB data. + + >>> from socket import * + >>> s1, s2 = socketpair(AF_UNIX, SOCK_STREAM) + >>> s1.send(b'x', MSG_OOB) + 1 + >>> s2.recv(1, MSG_OOB) + b'x' + + 2. close() for s2 sets ECONNRESET to s1->sk_err even though + s2 consumed the OOB data + + >>> s2.close() + >>> s1.recv(10, MSG_DONTWAIT) + ... + ConnectionResetError: [Errno 104] Connection reset by peer + +Even after being consumed, the skb holding the OOB 1-byte data stays in +the recv queue to mark the OOB boundary and break recv() at that point. + +This must be considered while close()ing a socket. + +Let's skip the leading consumed OOB skb while checking the -ECONNRESET +condition in unix_release_sock(). + +Fixes: 314001f0bf92 ("af_unix: Add OOB support") +Reported-by: Christian Brauner <brauner@kernel.org> +Closes: https://lore.kernel.org/netdev/20250529-sinkt-abfeuern-e7b08200c6b0@brauner/ +Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> +Acked-by: Christian Brauner <brauner@kernel.org> +Link: https://patch.msgid.link/20250619041457.1132791-4-kuni1840@gmail.com +Signed-off-by: Paolo Abeni <pabeni@redhat.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/unix/af_unix.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 7604d399a7788..f89cd01247f6b 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -630,6 +630,11 @@ static void unix_sock_destructor(struct sock *sk) + #endif + } + ++static unsigned int unix_skb_len(const struct sk_buff *skb) ++{ ++ return skb->len - UNIXCB(skb).consumed; ++} ++ + static void unix_release_sock(struct sock *sk, int embrion) + { + struct unix_sock *u = unix_sk(sk); +@@ -664,10 +669,16 @@ static void unix_release_sock(struct sock *sk, int embrion) + + if (skpair != NULL) { + if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) { ++ struct sk_buff *skb = skb_peek(&sk->sk_receive_queue); ++ ++#if IS_ENABLED(CONFIG_AF_UNIX_OOB) ++ if (skb && !unix_skb_len(skb)) ++ skb = skb_peek_next(skb, &sk->sk_receive_queue); ++#endif + unix_state_lock(skpair); + /* No more writes */ + WRITE_ONCE(skpair->sk_shutdown, SHUTDOWN_MASK); +- if (!skb_queue_empty_lockless(&sk->sk_receive_queue) || embrion) ++ if (skb || embrion) + WRITE_ONCE(skpair->sk_err, ECONNRESET); + unix_state_unlock(skpair); + skpair->sk_state_change(skpair); +@@ -2552,11 +2563,6 @@ static long unix_stream_data_wait(struct sock *sk, long timeo, + return timeo; + } + +-static unsigned int unix_skb_len(const struct sk_buff *skb) +-{ +- return skb->len - UNIXCB(skb).consumed; +-} +- + struct unix_stream_read_state { + int (*recv_actor)(struct sk_buff *, int, int, + struct unix_stream_read_state *); +-- +2.39.5 + diff --git a/queue-6.6/alsa-hda-realtek-fix-built-in-mic-on-asus-vivobook-x.patch b/queue-6.6/alsa-hda-realtek-fix-built-in-mic-on-asus-vivobook-x.patch new file mode 100644 index 0000000000..db2139f76f --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-fix-built-in-mic-on-asus-vivobook-x.patch @@ -0,0 +1,39 @@ +From ddc5af477b79ada8047826ab82e4677258fb5fb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 25 Jun 2025 20:41:28 +0200 +Subject: ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR + +From: Salvatore Bonaccorso <carnil@debian.org> + +[ Upstream commit 7ab6847a03229e73bb7c58ca397630f699e79b53 ] + +The built-in mic of ASUS VivoBook X507UAR is broken recently by the fix +of the pin sort. The fixup ALC256_FIXUP_ASUS_MIC_NO_PRESENCE is working +for addressing the regression, too. + +Fixes: 3b4309546b48 ("ALSA: hda: Fix headset detection failure due to unstable sort") +Reported-by: Igor Tamara <igor.tamara@gmail.com> +Closes: https://bugs.debian.org/1108069 +Signed-off-by: Salvatore Bonaccorso <carnil@debian.org> +Link: https://lore.kernel.org/CADdHDco7_o=4h_epjEAb92Dj-vUz_PoTC2-W9g5ncT2E0NzfeQ@mail.gmail.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 82210b1e3b978..0d367cec03ade 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10325,6 +10325,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1da2, "ASUS UP6502ZA/ZD", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x1e10, "ASUS VivoBook X507UAR", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), + SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), +-- +2.39.5 + diff --git a/queue-6.6/alsa-usb-audio-fix-out-of-bounds-read-in-snd_usb_get.patch b/queue-6.6/alsa-usb-audio-fix-out-of-bounds-read-in-snd_usb_get.patch new file mode 100644 index 0000000000..37ecc8ec38 --- /dev/null +++ b/queue-6.6/alsa-usb-audio-fix-out-of-bounds-read-in-snd_usb_get.patch @@ -0,0 +1,47 @@ +From 308e86dce58f9fe6a0f1074384a6a77dcc6c1fbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 23 Jun 2025 20:05:25 +0900 +Subject: ALSA: usb-audio: Fix out-of-bounds read in + snd_usb_get_audioformat_uac3() + +From: Youngjun Lee <yjjuny.lee@samsung.com> + +[ Upstream commit fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a ] + +In snd_usb_get_audioformat_uac3(), the length value returned from +snd_usb_ctl_msg() is used directly for memory allocation without +validation. This length is controlled by the USB device. + +The allocated buffer is cast to a uac3_cluster_header_descriptor +and its fields are accessed without verifying that the buffer +is large enough. If the device returns a smaller than expected +length, this leads to an out-of-bounds read. + +Add a length check to ensure the buffer is large enough for +uac3_cluster_header_descriptor. + +Signed-off-by: Youngjun Lee <yjjuny.lee@samsung.com> +Fixes: 9a2fe9b801f5 ("ALSA: usb: initial USB Audio Device Class 3.0 support") +Link: https://patch.msgid.link/20250623-uac3-oob-fix-v1-1-527303eaf40a@samsung.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + sound/usb/stream.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/usb/stream.c b/sound/usb/stream.c +index e14c725acebf2..0f1558ef85553 100644 +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -982,6 +982,8 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip, + * and request Cluster Descriptor + */ + wLength = le16_to_cpu(hc_header.wLength); ++ if (wLength < sizeof(cluster)) ++ return NULL; + cluster = kzalloc(wLength, GFP_KERNEL); + if (!cluster) + return ERR_PTR(-ENOMEM); +-- +2.39.5 + diff --git a/queue-6.6/atm-clip-prevent-null-deref-in-clip_push.patch b/queue-6.6/atm-clip-prevent-null-deref-in-clip_push.patch new file mode 100644 index 0000000000..40a4105874 --- /dev/null +++ b/queue-6.6/atm-clip-prevent-null-deref-in-clip_push.patch @@ -0,0 +1,60 @@ +From 70d2cca47201ff7834f232dc6848e0d75f9d2aaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 20 Jun 2025 14:28:44 +0000 +Subject: atm: clip: prevent NULL deref in clip_push() + +From: Eric Dumazet <edumazet@google.com> + +[ Upstream commit b993ea46b3b601915ceaaf3c802adf11e7d6bac6 ] + +Blamed commit missed that vcc_destroy_socket() calls +clip_push() with a NULL skb. + +If clip_devs is NULL, clip_push() then crashes when reading +skb->truesize. + +Fixes: 93a2014afbac ("atm: fix a UAF in lec_arp_clear_vccs()") +Reported-by: syzbot+1316233c4c6803382a8b@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/68556f59.a00a0220.137b3.004e.GAE@google.com/T/#u +Signed-off-by: Eric Dumazet <edumazet@google.com> +Cc: Cong Wang <xiyou.wangcong@gmail.com> +Cc: Gengming Liu <l.dmxcsnsbh@gmail.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/atm/clip.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/net/atm/clip.c b/net/atm/clip.c +index 294cb9efe3d38..511467bb7fe40 100644 +--- a/net/atm/clip.c ++++ b/net/atm/clip.c +@@ -193,12 +193,6 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb) + + pr_debug("\n"); + +- if (!clip_devs) { +- atm_return(vcc, skb->truesize); +- kfree_skb(skb); +- return; +- } +- + if (!skb) { + pr_debug("removing VCC %p\n", clip_vcc); + if (clip_vcc->entry) +@@ -208,6 +202,11 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb) + return; + } + atm_return(vcc, skb->truesize); ++ if (!clip_devs) { ++ kfree_skb(skb); ++ return; ++ } ++ + skb->dev = clip_vcc->entry ? clip_vcc->entry->neigh->dev : clip_devs; + /* clip_vcc->entry == NULL if we don't have an IP address yet */ + if (!skb->dev) { +-- +2.39.5 + diff --git a/queue-6.6/atm-release-atm_dev_mutex-after-removing-procfs-in-a.patch b/queue-6.6/atm-release-atm_dev_mutex-after-removing-procfs-in-a.patch new file mode 100644 index 0000000000..d83a199665 --- /dev/null +++ b/queue-6.6/atm-release-atm_dev_mutex-after-removing-procfs-in-a.patch @@ -0,0 +1,106 @@ +From 59676fb8940965a096f4f0b3b5293480c0fcae34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 24 Jun 2025 14:45:00 -0700 +Subject: atm: Release atm_dev_mutex after removing procfs in + atm_dev_deregister(). + +From: Kuniyuki Iwashima <kuniyu@google.com> + +[ Upstream commit a433791aeaea6e84df709e0b9584b9bbe040cd1c ] + +syzbot reported a warning below during atm_dev_register(). [0] + +Before creating a new device and procfs/sysfs for it, atm_dev_register() +looks up a duplicated device by __atm_dev_lookup(). These operations are +done under atm_dev_mutex. + +However, when removing a device in atm_dev_deregister(), it releases the +mutex just after removing the device from the list that __atm_dev_lookup() +iterates over. + +So, there will be a small race window where the device does not exist on +the device list but procfs/sysfs are still not removed, triggering the +splat. + +Let's hold the mutex until procfs/sysfs are removed in +atm_dev_deregister(). + +[0]: +proc_dir_entry 'atm/atmtcp:0' already registered +WARNING: CPU: 0 PID: 5919 at fs/proc/generic.c:377 proc_register+0x455/0x5f0 fs/proc/generic.c:377 +Modules linked in: +CPU: 0 UID: 0 PID: 5919 Comm: syz-executor284 Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 +RIP: 0010:proc_register+0x455/0x5f0 fs/proc/generic.c:377 +Code: 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 a2 01 00 00 48 8b 44 24 10 48 c7 c7 20 c0 c2 8b 48 8b b0 d8 00 00 00 e8 0c 02 1c ff 90 <0f> 0b 90 90 48 c7 c7 80 f2 82 8e e8 0b de 23 09 48 8b 4c 24 28 48 +RSP: 0018:ffffc9000466fa30 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ae248 +RDX: ffff888026280000 RSI: ffffffff817ae255 RDI: 0000000000000001 +RBP: ffff8880232bed48 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: ffff888076ed2140 +R13: dffffc0000000000 R14: ffff888078a61340 R15: ffffed100edda444 +FS: 00007f38b3b0c6c0(0000) GS:ffff888124753000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f38b3bdf953 CR3: 0000000076d58000 CR4: 00000000003526f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + <TASK> + proc_create_data+0xbe/0x110 fs/proc/generic.c:585 + atm_proc_dev_register+0x112/0x1e0 net/atm/proc.c:361 + atm_dev_register+0x46d/0x890 net/atm/resources.c:113 + atmtcp_create+0x77/0x210 drivers/atm/atmtcp.c:369 + atmtcp_attach drivers/atm/atmtcp.c:403 [inline] + atmtcp_ioctl+0x2f9/0xd60 drivers/atm/atmtcp.c:464 + do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 + sock_do_ioctl+0x115/0x280 net/socket.c:1190 + sock_ioctl+0x227/0x6b0 net/socket.c:1311 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:907 [inline] + __se_sys_ioctl fs/ioctl.c:893 [inline] + __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7f38b3b74459 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f38b3b0c198 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +RAX: ffffffffffffffda RBX: 00007f38b3bfe318 RCX: 00007f38b3b74459 +RDX: 0000000000000000 RSI: 0000000000006180 RDI: 0000000000000005 +RBP: 00007f38b3bfe310 R08: 65732f636f72702f R09: 65732f636f72702f +R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f38b3bcb0ac +R13: 00007f38b3b0c1a0 R14: 0000200000000200 R15: 00007f38b3bcb03b + </TASK> + +Fixes: 64bf69ddff76 ("[ATM]: deregistration removes device from atm_devs list immediately") +Reported-by: syzbot+8bd335d2ad3b93e80715@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/685316de.050a0220.216029.0087.GAE@google.com/ +Tested-by: syzbot+8bd335d2ad3b93e80715@syzkaller.appspotmail.com +Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> +Link: https://patch.msgid.link/20250624214505.570679-1-kuni1840@gmail.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/atm/resources.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/atm/resources.c b/net/atm/resources.c +index 995d29e7fb138..b19d851e1f443 100644 +--- a/net/atm/resources.c ++++ b/net/atm/resources.c +@@ -146,11 +146,10 @@ void atm_dev_deregister(struct atm_dev *dev) + */ + mutex_lock(&atm_dev_mutex); + list_del(&dev->dev_list); +- mutex_unlock(&atm_dev_mutex); +- + atm_dev_release_vccs(dev); + atm_unregister_sysfs(dev); + atm_proc_dev_deregister(dev); ++ mutex_unlock(&atm_dev_mutex); + + atm_dev_put(dev); + } +-- +2.39.5 + diff --git a/queue-6.6/attach_recursive_mnt-do-not-lock-the-covering-tree-w.patch b/queue-6.6/attach_recursive_mnt-do-not-lock-the-covering-tree-w.patch new file mode 100644 index 0000000000..ad56a54089 --- /dev/null +++ b/queue-6.6/attach_recursive_mnt-do-not-lock-the-covering-tree-w.patch @@ -0,0 +1,51 @@ +From c5a382a7d5d6e9db2b7b35138ceafccfcc721bfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sun, 22 Jun 2025 18:03:29 -0400 +Subject: attach_recursive_mnt(): do not lock the covering tree when sliding + something under it + +From: Al Viro <viro@zeniv.linux.org.uk> + +[ Upstream commit ce7df19686530920f2f6b636e71ce5eb1d9303ef ] + +If we are propagating across the userns boundary, we need to lock the +mounts added there. However, in case when something has already +been mounted there and we end up sliding a new tree under that, +the stuff that had been there before should not get locked. + +IOW, lock_mnt_tree() should be called before we reparent the +preexisting tree on top of what we are adding. + +Fixes: 3bd045cc9c4b ("separate copying and locking mount tree on cross-userns copies") +Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + fs/namespace.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/namespace.c b/fs/namespace.c +index eab9185e22858..cebcb9fa2acc0 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -2364,14 +2364,14 @@ static int attach_recursive_mnt(struct mount *source_mnt, + hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) { + struct mount *q; + hlist_del_init(&child->mnt_hash); +- q = __lookup_mnt(&child->mnt_parent->mnt, +- child->mnt_mountpoint); +- if (q) +- mnt_change_mountpoint(child, smp, q); + /* Notice when we are propagating across user namespaces */ + if (child->mnt_parent->mnt_ns->user_ns != user_ns) + lock_mnt_tree(child); + child->mnt.mnt_flags &= ~MNT_LOCKED; ++ q = __lookup_mnt(&child->mnt_parent->mnt, ++ child->mnt_mountpoint); ++ if (q) ++ mnt_change_mountpoint(child, smp, q); + commit_tree(child); + } + put_mountpoint(smp); +-- +2.39.5 + diff --git a/queue-6.6/bnxt-properly-flush-xdp-redirect-lists.patch b/queue-6.6/bnxt-properly-flush-xdp-redirect-lists.patch new file mode 100644 index 0000000000..ea0427a9cf --- /dev/null +++ b/queue-6.6/bnxt-properly-flush-xdp-redirect-lists.patch @@ -0,0 +1,139 @@ +From 9c15e0c70d5937b492e7e0e5236dc20f24f7329e Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 23 Jun 2025 09:06:38 -0700 +Subject: bnxt: properly flush XDP redirect lists + +From: Yan Zhai <yan@cloudflare.com> + +[ Upstream commit 9caca6ac0e26cd20efd490d8b3b2ffb1c7c00f6f ] + +We encountered following crash when testing a XDP_REDIRECT feature +in production: + +[56251.579676] list_add corruption. next->prev should be prev (ffff93120dd40f30), but was ffffb301ef3a6740. (next=ffff93120dd +40f30). +[56251.601413] ------------[ cut here ]------------ +[56251.611357] kernel BUG at lib/list_debug.c:29! +[56251.621082] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI +[56251.632073] CPU: 111 UID: 0 PID: 0 Comm: swapper/111 Kdump: loaded Tainted: P O 6.12.33-cloudflare-2025.6. +3 #1 +[56251.653155] Tainted: [P]=PROPRIETARY_MODULE, [O]=OOT_MODULE +[56251.663877] Hardware name: MiTAC GC68B-B8032-G11P6-GPU/S8032GM-HE-CFR, BIOS V7.020.B10-sig 01/22/2025 +[56251.682626] RIP: 0010:__list_add_valid_or_report+0x4b/0xa0 +[56251.693203] Code: 0e 48 c7 c7 68 e7 d9 97 e8 42 16 fe ff 0f 0b 48 8b 52 08 48 39 c2 74 14 48 89 f1 48 c7 c7 90 e7 d9 97 48 + 89 c6 e8 25 16 fe ff <0f> 0b 4c 8b 02 49 39 f0 74 14 48 89 d1 48 c7 c7 e8 e7 d9 97 4c 89 +[56251.725811] RSP: 0018:ffff93120dd40b80 EFLAGS: 00010246 +[56251.736094] RAX: 0000000000000075 RBX: ffffb301e6bba9d8 RCX: 0000000000000000 +[56251.748260] RDX: 0000000000000000 RSI: ffff9149afda0b80 RDI: ffff9149afda0b80 +[56251.760349] RBP: ffff9131e49c8000 R08: 0000000000000000 R09: ffff93120dd40a18 +[56251.772382] R10: ffff9159cf2ce1a8 R11: 0000000000000003 R12: ffff911a80850000 +[56251.784364] R13: ffff93120fbc7000 R14: 0000000000000010 R15: ffff9139e7510e40 +[56251.796278] FS: 0000000000000000(0000) GS:ffff9149afd80000(0000) knlGS:0000000000000000 +[56251.809133] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[56251.819561] CR2: 00007f5e85e6f300 CR3: 00000038b85e2006 CR4: 0000000000770ef0 +[56251.831365] PKRU: 55555554 +[56251.838653] Call Trace: +[56251.845560] <IRQ> +[56251.851943] cpu_map_enqueue.cold+0x5/0xa +[56251.860243] xdp_do_redirect+0x2d9/0x480 +[56251.868388] bnxt_rx_xdp+0x1d8/0x4c0 [bnxt_en] +[56251.877028] bnxt_rx_pkt+0x5f7/0x19b0 [bnxt_en] +[56251.885665] ? cpu_max_write+0x1e/0x100 +[56251.893510] ? srso_alias_return_thunk+0x5/0xfbef5 +[56251.902276] __bnxt_poll_work+0x190/0x340 [bnxt_en] +[56251.911058] bnxt_poll+0xab/0x1b0 [bnxt_en] +[56251.919041] ? srso_alias_return_thunk+0x5/0xfbef5 +[56251.927568] ? srso_alias_return_thunk+0x5/0xfbef5 +[56251.935958] ? srso_alias_return_thunk+0x5/0xfbef5 +[56251.944250] __napi_poll+0x2b/0x160 +[56251.951155] bpf_trampoline_6442548651+0x79/0x123 +[56251.959262] __napi_poll+0x5/0x160 +[56251.966037] net_rx_action+0x3d2/0x880 +[56251.973133] ? srso_alias_return_thunk+0x5/0xfbef5 +[56251.981265] ? srso_alias_return_thunk+0x5/0xfbef5 +[56251.989262] ? __hrtimer_run_queues+0x162/0x2a0 +[56251.996967] ? srso_alias_return_thunk+0x5/0xfbef5 +[56252.004875] ? srso_alias_return_thunk+0x5/0xfbef5 +[56252.012673] ? bnxt_msix+0x62/0x70 [bnxt_en] +[56252.019903] handle_softirqs+0xcf/0x270 +[56252.026650] irq_exit_rcu+0x67/0x90 +[56252.032933] common_interrupt+0x85/0xa0 +[56252.039498] </IRQ> +[56252.044246] <TASK> +[56252.048935] asm_common_interrupt+0x26/0x40 +[56252.055727] RIP: 0010:cpuidle_enter_state+0xb8/0x420 +[56252.063305] Code: dc 01 00 00 e8 f9 79 3b ff e8 64 f7 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 a5 32 3a ff 45 84 ff 0f 85 ae + 01 00 00 fb 45 85 f6 <0f> 88 88 01 00 00 48 8b 04 24 49 63 ce 4c 89 ea 48 6b f1 68 48 29 +[56252.088911] RSP: 0018:ffff93120c97fe98 EFLAGS: 00000202 +[56252.096912] RAX: ffff9149afd80000 RBX: ffff9141d3a72800 RCX: 0000000000000000 +[56252.106844] RDX: 00003329176c6b98 RSI: ffffffe36db3fdc7 RDI: 0000000000000000 +[56252.116733] RBP: 0000000000000002 R08: 0000000000000002 R09: 000000000000004e +[56252.126652] R10: ffff9149afdb30c4 R11: 071c71c71c71c71c R12: ffffffff985ff860 +[56252.136637] R13: 00003329176c6b98 R14: 0000000000000002 R15: 0000000000000000 +[56252.146667] ? cpuidle_enter_state+0xab/0x420 +[56252.153909] cpuidle_enter+0x2d/0x40 +[56252.160360] do_idle+0x176/0x1c0 +[56252.166456] cpu_startup_entry+0x29/0x30 +[56252.173248] start_secondary+0xf7/0x100 +[56252.179941] common_startup_64+0x13e/0x141 +[56252.186886] </TASK> + +From the crash dump, we found that the cpu_map_flush_list inside +redirect info is partially corrupted: its list_head->next points to +itself, but list_head->prev points to a valid list of unflushed bq +entries. + +This turned out to be a result of missed XDP flush on redirect lists. By +digging in the actual source code, we found that +commit 7f0a168b0441 ("bnxt_en: Add completion ring pointer in TX and RX +ring structures") incorrectly overwrites the event mask for XDP_REDIRECT +in bnxt_rx_xdp. We can stably reproduce this crash by returning XDP_TX +and XDP_REDIRECT randomly for incoming packets in a naive XDP program. +Properly propagate the XDP_REDIRECT events back fixes the crash. + +Fixes: a7559bc8c17c ("bnxt: support transmit and free of aggregation buffers") +Tested-by: Andrew Rzeznik <arzeznik@cloudflare.com> +Signed-off-by: Yan Zhai <yan@cloudflare.com> +Acked-by: Jesper Dangaard Brouer <hawk@kernel.org> +Reviewed-by: Michael Chan <michael.chan@broadcom.com> +Reviewed-by: Andy Gospodarek <gospo@broadcom.com> +Link: https://patch.msgid.link/aFl7jpCNzscumuN2@debian.debian +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 2ada8345180dc..27328864d3053 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -2509,6 +2509,7 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + { + struct bnxt_napi *bnapi = cpr->bnapi; + u32 raw_cons = cpr->cp_raw_cons; ++ bool flush_xdp = false; + u32 cons; + int rx_pkts = 0; + u8 event = 0; +@@ -2553,6 +2554,8 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + else + rc = bnxt_force_rx_discard(bp, cpr, &raw_cons, + &event); ++ if (event & BNXT_REDIRECT_EVENT) ++ flush_xdp = true; + if (likely(rc >= 0)) + rx_pkts += rc; + /* Increment rx_pkts when rc is -ENOMEM to count towards +@@ -2580,7 +2583,7 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + } + } + +- if (event & BNXT_REDIRECT_EVENT) { ++ if (flush_xdp) { + xdp_do_flush(); + event &= ~BNXT_REDIRECT_EVENT; + } +-- +2.39.5 + diff --git a/queue-6.6/bnxt_en-add-completion-ring-pointer-in-tx-and-rx-rin.patch b/queue-6.6/bnxt_en-add-completion-ring-pointer-in-tx-and-rx-rin.patch new file mode 100644 index 0000000000..6ee72990e1 --- /dev/null +++ b/queue-6.6/bnxt_en-add-completion-ring-pointer-in-tx-and-rx-rin.patch @@ -0,0 +1,284 @@ +From 1f23f4cdbbb520fd63295d62eafaeb610ba48e70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 13 Nov 2023 16:16:10 -0800 +Subject: bnxt_en: Add completion ring pointer in TX and RX ring structures + +From: Michael Chan <michael.chan@broadcom.com> + +[ Upstream commit 7f0a168b0441ef7fd6b46563efb2706c58ac2a4c ] + +From the TX or RX ring structure, we need to find the corresponding +completion ring during initialization. On P5 chips, we use the MSIX/napi +entry to locate the completion ring because there is only one RX/TX +ring per MSIX. To allow multiple TX rings for each MSIX, we need +to add a direct pointer from the TX ring and RX ring structures. +This also simplifies the existing logic. + +Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com> +Signed-off-by: Michael Chan <michael.chan@broadcom.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Stable-dep-of: 9caca6ac0e26 ("bnxt: properly flush XDP redirect lists") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 43 +++++++++++-------- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 11 ++++- + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 12 +++--- + 3 files changed, 40 insertions(+), 26 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 5b137747937ac..7e1f4b3adb2c9 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -332,16 +332,16 @@ static void bnxt_sched_reset_rxr(struct bnxt *bp, struct bnxt_rx_ring_info *rxr) + } + + void bnxt_sched_reset_txr(struct bnxt *bp, struct bnxt_tx_ring_info *txr, +- int idx) ++ u16 curr) + { + struct bnxt_napi *bnapi = txr->bnapi; + + if (bnapi->tx_fault) + return; + +- netdev_err(bp->dev, "Invalid Tx completion (ring:%d tx_pkts:%d cons:%u prod:%u i:%d)", +- txr->txq_index, bnapi->tx_pkts, +- txr->tx_cons, txr->tx_prod, idx); ++ netdev_err(bp->dev, "Invalid Tx completion (ring:%d tx_hw_cons:%u cons:%u prod:%u curr:%u)", ++ txr->txq_index, txr->tx_hw_cons, ++ txr->tx_cons, txr->tx_prod, curr); + WARN_ON_ONCE(1); + bnapi->tx_fault = 1; + bnxt_queue_sp_work(bp, BNXT_RESET_TASK_SP_EVENT); +@@ -691,13 +691,13 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + { + struct bnxt_tx_ring_info *txr = bnapi->tx_ring; + struct netdev_queue *txq = netdev_get_tx_queue(bp->dev, txr->txq_index); ++ u16 hw_cons = txr->tx_hw_cons; + u16 cons = txr->tx_cons; + struct pci_dev *pdev = bp->pdev; +- int nr_pkts = bnapi->tx_pkts; +- int i; + unsigned int tx_bytes = 0; ++ int tx_pkts = 0; + +- for (i = 0; i < nr_pkts; i++) { ++ while (cons != hw_cons) { + struct bnxt_sw_tx_bd *tx_buf; + struct sk_buff *skb; + int j, last; +@@ -708,10 +708,11 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + tx_buf->skb = NULL; + + if (unlikely(!skb)) { +- bnxt_sched_reset_txr(bp, txr, i); ++ bnxt_sched_reset_txr(bp, txr, cons); + return; + } + ++ tx_pkts++; + tx_bytes += skb->len; + + if (tx_buf->is_push) { +@@ -748,10 +749,10 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + dev_consume_skb_any(skb); + } + +- bnapi->tx_pkts = 0; ++ bnapi->events &= ~BNXT_TX_CMP_EVENT; + WRITE_ONCE(txr->tx_cons, cons); + +- __netif_txq_completed_wake(txq, nr_pkts, tx_bytes, ++ __netif_txq_completed_wake(txq, tx_pkts, tx_bytes, + bnxt_tx_avail(bp, txr), bp->tx_wake_thresh, + READ_ONCE(txr->dev_state) == BNXT_DEV_STATE_CLOSING); + } +@@ -2492,14 +2493,15 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + { + struct bnxt_napi *bnapi = cpr->bnapi; + u32 raw_cons = cpr->cp_raw_cons; ++ struct bnxt_tx_ring_info *txr; + u32 cons; +- int tx_pkts = 0; + int rx_pkts = 0; + u8 event = 0; + struct tx_cmp *txcmp; + + cpr->has_more_work = 0; + cpr->had_work_done = 1; ++ txr = bnapi->tx_ring; + while (1) { + int rc; + +@@ -2514,9 +2516,15 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + */ + dma_rmb(); + if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) { +- tx_pkts++; ++ u32 opaque = txcmp->tx_cmp_opaque; ++ u16 tx_freed; ++ ++ event |= BNXT_TX_CMP_EVENT; ++ txr->tx_hw_cons = TX_OPAQUE_PROD(bp, opaque); ++ tx_freed = (txr->tx_hw_cons - txr->tx_cons) & ++ bp->tx_ring_mask; + /* return full budget so NAPI will complete. */ +- if (unlikely(tx_pkts >= bp->tx_wake_thresh)) { ++ if (unlikely(tx_freed >= bp->tx_wake_thresh)) { + rx_pkts = budget; + raw_cons = NEXT_RAW_CMP(raw_cons); + if (budget) +@@ -2570,7 +2578,6 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + } + + cpr->cp_raw_cons = raw_cons; +- bnapi->tx_pkts += tx_pkts; + bnapi->events |= event; + return rx_pkts; + } +@@ -2578,7 +2585,7 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + static void __bnxt_poll_work_done(struct bnxt *bp, struct bnxt_napi *bnapi, + int budget) + { +- if (bnapi->tx_pkts && !bnapi->tx_fault) ++ if ((bnapi->events & BNXT_TX_CMP_EVENT) && !bnapi->tx_fault) + bnapi->tx_int(bp, bnapi, budget); + + if ((bnapi->events & BNXT_RX_EVENT) && !(bnapi->in_reset)) { +@@ -2591,7 +2598,7 @@ static void __bnxt_poll_work_done(struct bnxt *bp, struct bnxt_napi *bnapi, + + bnxt_db_write(bp, &rxr->rx_agg_db, rxr->rx_agg_prod); + } +- bnapi->events = 0; ++ bnapi->events &= BNXT_TX_CMP_EVENT; + } + + static int bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, +@@ -4421,6 +4428,7 @@ static void bnxt_clear_ring_indices(struct bnxt *bp) + if (txr) { + txr->tx_prod = 0; + txr->tx_cons = 0; ++ txr->tx_hw_cons = 0; + } + + rxr = bnapi->rx_ring; +@@ -4430,6 +4438,7 @@ static void bnxt_clear_ring_indices(struct bnxt *bp) + rxr->rx_sw_agg_prod = 0; + rxr->rx_next_cons = 0; + } ++ bnapi->events = 0; + } + } + +@@ -9434,8 +9443,6 @@ static void bnxt_enable_napi(struct bnxt *bp) + cpr = &bnapi->cp_ring; + bnapi->in_reset = false; + +- bnapi->tx_pkts = 0; +- + if (bnapi->rx_ring) { + INIT_WORK(&cpr->dim.work, bnxt_dim_work); + cpr->dim.mode = DIM_CQ_PERIOD_MODE_START_FROM_EQE; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 39b09e49db9e3..fd2122d9ecc3d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -68,6 +68,12 @@ struct tx_bd { + #define SET_TX_OPAQUE(bp, idx, bds) \ + (((bds) << TX_OPAQUE_BDS_SHIFT) | ((idx) & (bp)->tx_ring_mask)) + ++#define TX_OPAQUE_IDX(opq) ((opq) & TX_OPAQUE_IDX_MASK) ++#define TX_OPAQUE_BDS(opq) (((opq) & TX_OPAQUE_BDS_MASK) >> \ ++ TX_OPAQUE_BDS_SHIFT) ++#define TX_OPAQUE_PROD(bp, opq) ((TX_OPAQUE_IDX(opq) + TX_OPAQUE_BDS(opq)) &\ ++ (bp)->tx_ring_mask) ++ + struct tx_bd_ext { + __le32 tx_bd_hsize_lflags; + #define TX_BD_FLAGS_TCP_UDP_CHKSUM (1 << 0) +@@ -715,6 +721,7 @@ struct nqe_cn { + #define BNXT_AGG_EVENT 2 + #define BNXT_TX_EVENT 4 + #define BNXT_REDIRECT_EVENT 8 ++#define BNXT_TX_CMP_EVENT 0x10 + + struct bnxt_sw_tx_bd { + union { +@@ -807,6 +814,7 @@ struct bnxt_tx_ring_info { + struct bnxt_napi *bnapi; + u16 tx_prod; + u16 tx_cons; ++ u16 tx_hw_cons; + u16 txq_index; + u8 kick_pending; + struct bnxt_db_info tx_db; +@@ -1033,7 +1041,6 @@ struct bnxt_napi { + + void (*tx_int)(struct bnxt *, struct bnxt_napi *, + int budget); +- int tx_pkts; + u8 events; + u8 tx_fault:1; + +@@ -2360,7 +2367,7 @@ int bnxt_reserve_rings(struct bnxt *bp, bool irq_re_init); + void bnxt_tx_disable(struct bnxt *bp); + void bnxt_tx_enable(struct bnxt *bp); + void bnxt_sched_reset_txr(struct bnxt *bp, struct bnxt_tx_ring_info *txr, +- int idx); ++ u16 curr); + void bnxt_report_link(struct bnxt *bp); + int bnxt_update_link(struct bnxt *bp, bool chng_link_state); + int bnxt_hwrm_set_pause(struct bnxt *); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +index 37d155312f150..0c9dca6d9c352 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +@@ -122,17 +122,17 @@ void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + { + struct bnxt_tx_ring_info *txr = bnapi->tx_ring; + struct bnxt_rx_ring_info *rxr = bnapi->rx_ring; ++ u16 tx_hw_cons = txr->tx_hw_cons; + bool rx_doorbell_needed = false; +- int nr_pkts = bnapi->tx_pkts; + struct bnxt_sw_tx_bd *tx_buf; + u16 tx_cons = txr->tx_cons; + u16 last_tx_cons = tx_cons; +- int i, j, frags; ++ int j, frags; + + if (!budget) + return; + +- for (i = 0; i < nr_pkts; i++) { ++ while (tx_cons != tx_hw_cons) { + tx_buf = &txr->tx_buf_ring[tx_cons]; + + if (tx_buf->action == XDP_REDIRECT) { +@@ -157,13 +157,13 @@ void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + page_pool_recycle_direct(rxr->page_pool, tx_buf->page); + } + } else { +- bnxt_sched_reset_txr(bp, txr, i); ++ bnxt_sched_reset_txr(bp, txr, tx_cons); + return; + } + tx_cons = NEXT_TX(tx_cons); + } + +- bnapi->tx_pkts = 0; ++ bnapi->events &= ~BNXT_TX_CMP_EVENT; + WRITE_ONCE(txr->tx_cons, tx_cons); + if (rx_doorbell_needed) { + tx_buf = &txr->tx_buf_ring[last_tx_cons]; +@@ -268,7 +268,7 @@ bool bnxt_rx_xdp(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, u16 cons, + case XDP_TX: + rx_buf = &rxr->rx_buf_ring[cons]; + mapping = rx_buf->mapping - bp->rx_dma_offset; +- *event = 0; ++ *event &= BNXT_TX_CMP_EVENT; + + if (unlikely(xdp_buff_has_frags(&xdp))) { + struct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(&xdp); +-- +2.39.5 + diff --git a/queue-6.6/bnxt_en-allow-some-tx-packets-to-be-unprocessed-in-n.patch b/queue-6.6/bnxt_en-allow-some-tx-packets-to-be-unprocessed-in-n.patch new file mode 100644 index 0000000000..9069db9061 --- /dev/null +++ b/queue-6.6/bnxt_en-allow-some-tx-packets-to-be-unprocessed-in-n.patch @@ -0,0 +1,121 @@ +From eb246d2a49015e74e4d760c5bfdc6276492a2848 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 28 Jun 2024 12:29:58 -0700 +Subject: bnxt_en: Allow some TX packets to be unprocessed in NAPI + +From: Michael Chan <michael.chan@broadcom.com> + +[ Upstream commit ba0155f1e9fca8e5c59c840cf5451101b8360fe6 ] + +The driver's current logic will always free all the TX SKBs up to +txr->tx_hw_cons within NAPI. In the next patches, we'll be adding +logic to handle TX timestamp completion and we may need to hold +some remaining TX SKBs if we don't have the timestamp completions +yet. + +Modify __bnxt_poll_work_done() to clear each event bit separately to +allow bnapi->tx_int() to decide whether to clear BNXT_TX_CMP_EVENT or +not. bnapi->tx_int() will not clear BNXT_TX_CMP_EVENT if some TX +SKBs are held waiting for TX timestamps. Note that legacy chips will +never hold any SKBs this way. The SKB is always deferred to the PTP +worker slow path to retrieve the timestamp from firmware. On the new +P7 chips, the timestamp is returned by the hardware directly and we +can retrieve it directly from NAPI. + +Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> +Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com> +Signed-off-by: Michael Chan <michael.chan@broadcom.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Stable-dep-of: 9caca6ac0e26 ("bnxt: properly flush XDP redirect lists") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 143425e7a3029..2ada8345180dc 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -687,7 +687,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_OK; + } + +-static void __bnxt_tx_int(struct bnxt *bp, struct bnxt_tx_ring_info *txr, ++/* Returns true if some remaining TX packets not processed. */ ++static bool __bnxt_tx_int(struct bnxt *bp, struct bnxt_tx_ring_info *txr, + int budget) + { + struct netdev_queue *txq = netdev_get_tx_queue(bp->dev, txr->txq_index); +@@ -709,7 +710,7 @@ static void __bnxt_tx_int(struct bnxt *bp, struct bnxt_tx_ring_info *txr, + + if (unlikely(!skb)) { + bnxt_sched_reset_txr(bp, txr, cons); +- return; ++ return false; + } + + tx_pkts++; +@@ -754,18 +755,22 @@ static void __bnxt_tx_int(struct bnxt *bp, struct bnxt_tx_ring_info *txr, + __netif_txq_completed_wake(txq, tx_pkts, tx_bytes, + bnxt_tx_avail(bp, txr), bp->tx_wake_thresh, + READ_ONCE(txr->dev_state) == BNXT_DEV_STATE_CLOSING); ++ ++ return false; + } + + static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + { + struct bnxt_tx_ring_info *txr; ++ bool more = false; + int i; + + bnxt_for_each_napi_tx(i, bnapi, txr) { + if (txr->tx_hw_cons != RING_TX(bp, txr->tx_cons)) +- __bnxt_tx_int(bp, txr, budget); ++ more |= __bnxt_tx_int(bp, txr, budget); + } +- bnapi->events &= ~BNXT_TX_CMP_EVENT; ++ if (!more) ++ bnapi->events &= ~BNXT_TX_CMP_EVENT; + } + + static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, +@@ -2575,8 +2580,10 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + } + } + +- if (event & BNXT_REDIRECT_EVENT) ++ if (event & BNXT_REDIRECT_EVENT) { + xdp_do_flush(); ++ event &= ~BNXT_REDIRECT_EVENT; ++ } + + if (event & BNXT_TX_EVENT) { + struct bnxt_tx_ring_info *txr = bnapi->tx_ring[0]; +@@ -2586,6 +2593,7 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + wmb(); + + bnxt_db_write_relaxed(bp, &txr->tx_db, prod); ++ event &= ~BNXT_TX_EVENT; + } + + cpr->cp_raw_cons = raw_cons; +@@ -2603,13 +2611,14 @@ static void __bnxt_poll_work_done(struct bnxt *bp, struct bnxt_napi *bnapi, + struct bnxt_rx_ring_info *rxr = bnapi->rx_ring; + + bnxt_db_write(bp, &rxr->rx_db, rxr->rx_prod); ++ bnapi->events &= ~BNXT_RX_EVENT; + } + if (bnapi->events & BNXT_AGG_EVENT) { + struct bnxt_rx_ring_info *rxr = bnapi->rx_ring; + + bnxt_db_write(bp, &rxr->rx_agg_db, rxr->rx_agg_prod); ++ bnapi->events &= ~BNXT_AGG_EVENT; + } +- bnapi->events &= BNXT_TX_CMP_EVENT; + } + + static int bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, +-- +2.39.5 + diff --git a/queue-6.6/bnxt_en-fix-tx-ring-indexing-logic.patch b/queue-6.6/bnxt_en-fix-tx-ring-indexing-logic.patch new file mode 100644 index 0000000000..e62ea18c16 --- /dev/null +++ b/queue-6.6/bnxt_en-fix-tx-ring-indexing-logic.patch @@ -0,0 +1,54 @@ +From 8343c0046958e92447b923f3bf464e047c6d39ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 11 Dec 2023 16:51:12 -0800 +Subject: bnxt_en: Fix TX ring indexing logic + +From: Michael Chan <michael.chan@broadcom.com> + +[ Upstream commit 18fe0a383cca78cfb183f83f947e75bebc7b3a20 ] + +Two spots were missed when modifying the TX ring indexing logic. +The use of unmasked TX index in bnxt_tx_int() will cause unnecessary +__bnxt_tx_int() calls. The same issue in bnxt_tx_int_xdp() can +result in illegal array index. + +Fixes: 6d1add95536b ("bnxt_en: Modify TX ring indexing logic.") +Signed-off-by: Michael Chan <michael.chan@broadcom.com> +Link: https://lore.kernel.org/r/20231212005122.2401-4-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Stable-dep-of: 9caca6ac0e26 ("bnxt: properly flush XDP redirect lists") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 8ef8d51f4c709..143425e7a3029 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -762,7 +762,7 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + int i; + + bnxt_for_each_napi_tx(i, bnapi, txr) { +- if (txr->tx_hw_cons != txr->tx_cons) ++ if (txr->tx_hw_cons != RING_TX(bp, txr->tx_cons)) + __bnxt_tx_int(bp, txr, budget); + } + bnapi->events &= ~BNXT_TX_CMP_EVENT; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +index 5e45fdd0d596f..20fb7cc2edd02 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +@@ -166,7 +166,7 @@ void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + bnapi->events &= ~BNXT_TX_CMP_EVENT; + WRITE_ONCE(txr->tx_cons, tx_cons); + if (rx_doorbell_needed) { +- tx_buf = &txr->tx_buf_ring[last_tx_cons]; ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, last_tx_cons)]; + bnxt_db_write(bp, &rxr->rx_db, tx_buf->rx_prod); + + } +-- +2.39.5 + diff --git a/queue-6.6/bnxt_en-modify-tx-ring-indexing-logic.patch b/queue-6.6/bnxt_en-modify-tx-ring-indexing-logic.patch new file mode 100644 index 0000000000..c30eb6fea4 --- /dev/null +++ b/queue-6.6/bnxt_en-modify-tx-ring-indexing-logic.patch @@ -0,0 +1,200 @@ +From f0ef6ad45c34505b1d670300db57d945b4bd4e4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 20 Nov 2023 15:44:02 -0800 +Subject: bnxt_en: Modify TX ring indexing logic. + +From: Michael Chan <michael.chan@broadcom.com> + +[ Upstream commit 6d1add95536bafe585c500ad8114af7ed4225a0f ] + +Change the TX ring logic so that the index increments unbounded and +mask it only when needed. + +Modify the existing macros so that the index is not masked. Add a +new macro RING_TX() to mask it only when needed to get the index of +txr->tx_buf_ring[]. + +Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> +Signed-off-by: Michael Chan <michael.chan@broadcom.com> +Link: https://lore.kernel.org/r/20231120234405.194542-11-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Stable-dep-of: 9caca6ac0e26 ("bnxt: properly flush XDP redirect lists") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 22 +++++++++---------- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 5 +++-- + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 14 ++++++------ + 3 files changed, 21 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 65cc301b0993b..8ef8d51f4c709 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -431,9 +431,9 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + len = skb_headlen(skb); + last_frag = skb_shinfo(skb)->nr_frags; + +- txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; ++ txbd = &txr->tx_desc_ring[TX_RING(bp, prod)][TX_IDX(prod)]; + +- tx_buf = &txr->tx_buf_ring[prod]; ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, prod)]; + tx_buf->skb = skb; + tx_buf->nr_frags = last_frag; + +@@ -521,7 +521,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, txr, prod, 2); + prod = NEXT_TX(prod); + tx_push->tx_bd_opaque = txbd->tx_bd_opaque; +- txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; ++ txbd = &txr->tx_desc_ring[TX_RING(bp, prod)][TX_IDX(prod)]; + memcpy(txbd, tx_push1, sizeof(*txbd)); + prod = NEXT_TX(prod); + tx_push->doorbell = +@@ -567,7 +567,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + prod = NEXT_TX(prod); + txbd1 = (struct tx_bd_ext *) +- &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; ++ &txr->tx_desc_ring[TX_RING(bp, prod)][TX_IDX(prod)]; + + txbd1->tx_bd_hsize_lflags = lflags; + if (skb_is_gso(skb)) { +@@ -607,7 +607,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; + + prod = NEXT_TX(prod); +- txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; ++ txbd = &txr->tx_desc_ring[TX_RING(bp, prod)][TX_IDX(prod)]; + + len = skb_frag_size(frag); + mapping = skb_frag_dma_map(&pdev->dev, frag, 0, len, +@@ -616,7 +616,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + if (unlikely(dma_mapping_error(&pdev->dev, mapping))) + goto tx_dma_error; + +- tx_buf = &txr->tx_buf_ring[prod]; ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, prod)]; + dma_unmap_addr_set(tx_buf, mapping, mapping); + + txbd->tx_bd_haddr = cpu_to_le64(mapping); +@@ -661,7 +661,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + /* start back at beginning and unmap skb */ + prod = txr->tx_prod; +- tx_buf = &txr->tx_buf_ring[prod]; ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, prod)]; + dma_unmap_single(&pdev->dev, dma_unmap_addr(tx_buf, mapping), + skb_headlen(skb), DMA_TO_DEVICE); + prod = NEXT_TX(prod); +@@ -669,7 +669,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + /* unmap remaining mapped pages */ + for (i = 0; i < last_frag; i++) { + prod = NEXT_TX(prod); +- tx_buf = &txr->tx_buf_ring[prod]; ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, prod)]; + dma_unmap_page(&pdev->dev, dma_unmap_addr(tx_buf, mapping), + skb_frag_size(&skb_shinfo(skb)->frags[i]), + DMA_TO_DEVICE); +@@ -697,12 +697,12 @@ static void __bnxt_tx_int(struct bnxt *bp, struct bnxt_tx_ring_info *txr, + u16 cons = txr->tx_cons; + int tx_pkts = 0; + +- while (cons != hw_cons) { ++ while (RING_TX(bp, cons) != hw_cons) { + struct bnxt_sw_tx_bd *tx_buf; + struct sk_buff *skb; + int j, last; + +- tx_buf = &txr->tx_buf_ring[cons]; ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, cons)]; + cons = NEXT_TX(cons); + skb = tx_buf->skb; + tx_buf->skb = NULL; +@@ -726,7 +726,7 @@ static void __bnxt_tx_int(struct bnxt *bp, struct bnxt_tx_ring_info *txr, + + for (j = 0; j < last; j++) { + cons = NEXT_TX(cons); +- tx_buf = &txr->tx_buf_ring[cons]; ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, cons)]; + dma_unmap_page( + &pdev->dev, + dma_unmap_addr(tx_buf, mapping), +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 0ebe51bcf8e6f..fe180e6095b32 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -682,7 +682,7 @@ struct nqe_cn { + #define RX_RING(x) (((x) & ~(RX_DESC_CNT - 1)) >> (BNXT_PAGE_SHIFT - 4)) + #define RX_IDX(x) ((x) & (RX_DESC_CNT - 1)) + +-#define TX_RING(x) (((x) & ~(TX_DESC_CNT - 1)) >> (BNXT_PAGE_SHIFT - 4)) ++#define TX_RING(bp, x) (((x) & (bp)->tx_ring_mask) >> (BNXT_PAGE_SHIFT - 4)) + #define TX_IDX(x) ((x) & (TX_DESC_CNT - 1)) + + #define CP_RING(x) (((x) & ~(CP_DESC_CNT - 1)) >> (BNXT_PAGE_SHIFT - 4)) +@@ -713,7 +713,8 @@ struct nqe_cn { + + #define NEXT_RX_AGG(idx) (((idx) + 1) & bp->rx_agg_ring_mask) + +-#define NEXT_TX(idx) (((idx) + 1) & bp->tx_ring_mask) ++#define RING_TX(bp, idx) ((idx) & (bp)->tx_ring_mask) ++#define NEXT_TX(idx) ((idx) + 1) + + #define ADV_RAW_CMP(idx, n) ((idx) + (n)) + #define NEXT_RAW_CMP(idx) ADV_RAW_CMP(idx, 1) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +index c3fb7f9b081ed..5e45fdd0d596f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +@@ -42,12 +42,12 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp, + + /* fill up the first buffer */ + prod = txr->tx_prod; +- tx_buf = &txr->tx_buf_ring[prod]; ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, prod)]; + tx_buf->nr_frags = num_frags; + if (xdp) + tx_buf->page = virt_to_head_page(xdp->data); + +- txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; ++ txbd = &txr->tx_desc_ring[TX_RING(bp, prod)][TX_IDX(prod)]; + flags = (len << TX_BD_LEN_SHIFT) | + ((num_frags + 1) << TX_BD_FLAGS_BD_CNT_SHIFT) | + bnxt_lhint_arr[len >> 9]; +@@ -66,10 +66,10 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp, + WRITE_ONCE(txr->tx_prod, prod); + + /* first fill up the first buffer */ +- frag_tx_buf = &txr->tx_buf_ring[prod]; ++ frag_tx_buf = &txr->tx_buf_ring[RING_TX(bp, prod)]; + frag_tx_buf->page = skb_frag_page(frag); + +- txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; ++ txbd = &txr->tx_desc_ring[TX_RING(bp, prod)][TX_IDX(prod)]; + + frag_len = skb_frag_size(frag); + flags = frag_len << TX_BD_LEN_SHIFT; +@@ -132,8 +132,8 @@ void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + if (!budget) + return; + +- while (tx_cons != tx_hw_cons) { +- tx_buf = &txr->tx_buf_ring[tx_cons]; ++ while (RING_TX(bp, tx_cons) != tx_hw_cons) { ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, tx_cons)]; + + if (tx_buf->action == XDP_REDIRECT) { + struct pci_dev *pdev = bp->pdev; +@@ -153,7 +153,7 @@ void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + frags = tx_buf->nr_frags; + for (j = 0; j < frags; j++) { + tx_cons = NEXT_TX(tx_cons); +- tx_buf = &txr->tx_buf_ring[tx_cons]; ++ tx_buf = &txr->tx_buf_ring[RING_TX(bp, tx_cons)]; + page_pool_recycle_direct(rxr->page_pool, tx_buf->page); + } + } else { +-- +2.39.5 + diff --git a/queue-6.6/bnxt_en-new-encoding-for-the-tx-opaque-field.patch b/queue-6.6/bnxt_en-new-encoding-for-the-tx-opaque-field.patch new file mode 100644 index 0000000000..74a9a4cc9e --- /dev/null +++ b/queue-6.6/bnxt_en-new-encoding-for-the-tx-opaque-field.patch @@ -0,0 +1,94 @@ +From 37e7c3b9e44da10a14e35d3a72be465aaa557830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 13 Nov 2023 16:16:15 -0800 +Subject: bnxt_en: New encoding for the TX opaque field + +From: Michael Chan <michael.chan@broadcom.com> + +[ Upstream commit 5a3c585fa83f9172848c19b1000c6ad3c8b36129 ] + +In order to support multiple TX rings on the same MSIX, we'll use the +upper byte of the TX opaque field to store the ring index in the new +tx_napi_idx field. This tx_napi_idx field is currently always 0 until +more infrastructure is added in later patches. + +Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com> +Signed-off-by: Michael Chan <michael.chan@broadcom.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Stable-dep-of: 9caca6ac0e26 ("bnxt: properly flush XDP redirect lists") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++-- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 10 ++++++++-- + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- + 3 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 056ca742ae1f7..b5ed6c0753f7a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -518,7 +518,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + txbd->tx_bd_len_flags_type = tx_push->tx_bd_len_flags_type; + txbd->tx_bd_haddr = txr->data_mapping; +- txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, prod, 2); ++ txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, txr, prod, 2); + prod = NEXT_TX(prod); + tx_push->tx_bd_opaque = txbd->tx_bd_opaque; + txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; +@@ -563,7 +563,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + ((last_frag + 2) << TX_BD_FLAGS_BD_CNT_SHIFT); + + txbd->tx_bd_haddr = cpu_to_le64(mapping); +- txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, prod, 2 + last_frag); ++ txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, txr, prod, 2 + last_frag); + + prod = NEXT_TX(prod); + txbd1 = (struct tx_bd_ext *) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index fd2122d9ecc3d..d6636af60d821 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -64,11 +64,16 @@ struct tx_bd { + #define TX_OPAQUE_IDX_MASK 0x0000ffff + #define TX_OPAQUE_BDS_MASK 0x00ff0000 + #define TX_OPAQUE_BDS_SHIFT 16 ++#define TX_OPAQUE_RING_MASK 0xff000000 ++#define TX_OPAQUE_RING_SHIFT 24 + +-#define SET_TX_OPAQUE(bp, idx, bds) \ +- (((bds) << TX_OPAQUE_BDS_SHIFT) | ((idx) & (bp)->tx_ring_mask)) ++#define SET_TX_OPAQUE(bp, txr, idx, bds) \ ++ (((txr)->tx_napi_idx << TX_OPAQUE_RING_SHIFT) | \ ++ ((bds) << TX_OPAQUE_BDS_SHIFT) | ((idx) & (bp)->tx_ring_mask)) + + #define TX_OPAQUE_IDX(opq) ((opq) & TX_OPAQUE_IDX_MASK) ++#define TX_OPAQUE_RING(opq) (((opq) & TX_OPAQUE_RING_MASK) >> \ ++ TX_OPAQUE_RING_SHIFT) + #define TX_OPAQUE_BDS(opq) (((opq) & TX_OPAQUE_BDS_MASK) >> \ + TX_OPAQUE_BDS_SHIFT) + #define TX_OPAQUE_PROD(bp, opq) ((TX_OPAQUE_IDX(opq) + TX_OPAQUE_BDS(opq)) &\ +@@ -816,6 +821,7 @@ struct bnxt_tx_ring_info { + u16 tx_cons; + u16 tx_hw_cons; + u16 txq_index; ++ u8 tx_napi_idx; + u8 kick_pending; + struct bnxt_db_info tx_db; + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +index 0c9dca6d9c352..f9ed827efddd4 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +@@ -52,7 +52,7 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp, + ((num_frags + 1) << TX_BD_FLAGS_BD_CNT_SHIFT) | + bnxt_lhint_arr[len >> 9]; + txbd->tx_bd_len_flags_type = cpu_to_le32(flags); +- txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, prod, 1 + num_frags); ++ txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, txr, prod, 1 + num_frags); + txbd->tx_bd_haddr = cpu_to_le64(mapping); + + /* now let us fill up the frags into the next buffers */ +-- +2.39.5 + diff --git a/queue-6.6/bnxt_en-put-the-tx-producer-information-in-the-tx-bd.patch b/queue-6.6/bnxt_en-put-the-tx-producer-information-in-the-tx-bd.patch new file mode 100644 index 0000000000..9f4dc84ba1 --- /dev/null +++ b/queue-6.6/bnxt_en-put-the-tx-producer-information-in-the-tx-bd.patch @@ -0,0 +1,101 @@ +From aa7e97245bba05960cc8473dab52e708fe946da5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 13 Nov 2023 16:16:09 -0800 +Subject: bnxt_en: Put the TX producer information in the TX BD opaque field + +From: Michael Chan <michael.chan@broadcom.com> + +[ Upstream commit 34eec1f29a5998305578fcc3e55d491a1795b56d ] + +Currently, the opaque field in the TX BD is only used for debugging. +The TX completion logic relies on getting one TX completion for each +packet and they always complete in order. + +Improve this scheme by putting the producer information (ring index plus +number of BDs for the packet) in the opaque field. This way, we can +handle TX completion processing by looking at the last TX completion +instead of counting the number of completions. + +Since we no longer need to count the exact number of completions, we can +optimize xmit_more by disabling TX completion when the xmit_more +condition is true. This will be done in later patches. + +This patch is only initializing the opaque field in the TX BD and is +not changing the driver's TX completion logic yet. + +Reviewed-by: Andy Gospodarek <gospo@broadcom.com> +Signed-off-by: Michael Chan <michael.chan@broadcom.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Stable-dep-of: 9caca6ac0e26 ("bnxt: properly flush XDP redirect lists") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +++-- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 7 +++++++ + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- + 3 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 6bf4a21853858..5b137747937ac 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -433,8 +433,6 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; + +- txbd->tx_bd_opaque = prod; +- + tx_buf = &txr->tx_buf_ring[prod]; + tx_buf->skb = skb; + tx_buf->nr_frags = last_frag; +@@ -520,7 +518,9 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + txbd->tx_bd_len_flags_type = tx_push->tx_bd_len_flags_type; + txbd->tx_bd_haddr = txr->data_mapping; ++ txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, prod, 2); + prod = NEXT_TX(prod); ++ tx_push->tx_bd_opaque = txbd->tx_bd_opaque; + txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; + memcpy(txbd, tx_push1, sizeof(*txbd)); + prod = NEXT_TX(prod); +@@ -563,6 +563,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + ((last_frag + 2) << TX_BD_FLAGS_BD_CNT_SHIFT); + + txbd->tx_bd_haddr = cpu_to_le64(mapping); ++ txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, prod, 2 + last_frag); + + prod = NEXT_TX(prod); + txbd1 = (struct tx_bd_ext *) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 0116f67593e3a..39b09e49db9e3 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -61,6 +61,13 @@ struct tx_bd { + __le64 tx_bd_haddr; + } __packed; + ++#define TX_OPAQUE_IDX_MASK 0x0000ffff ++#define TX_OPAQUE_BDS_MASK 0x00ff0000 ++#define TX_OPAQUE_BDS_SHIFT 16 ++ ++#define SET_TX_OPAQUE(bp, idx, bds) \ ++ (((bds) << TX_OPAQUE_BDS_SHIFT) | ((idx) & (bp)->tx_ring_mask)) ++ + struct tx_bd_ext { + __le32 tx_bd_hsize_lflags; + #define TX_BD_FLAGS_TCP_UDP_CHKSUM (1 << 0) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +index 758f51366ef03..37d155312f150 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +@@ -52,7 +52,7 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp, + ((num_frags + 1) << TX_BD_FLAGS_BD_CNT_SHIFT) | + bnxt_lhint_arr[len >> 9]; + txbd->tx_bd_len_flags_type = cpu_to_le32(flags); +- txbd->tx_bd_opaque = prod; ++ txbd->tx_bd_opaque = SET_TX_OPAQUE(bp, prod, 1 + num_frags); + txbd->tx_bd_haddr = cpu_to_le64(mapping); + + /* now let us fill up the frags into the next buffers */ +-- +2.39.5 + diff --git a/queue-6.6/bnxt_en-refactor-bnxt_hwrm_set_coal.patch b/queue-6.6/bnxt_en-refactor-bnxt_hwrm_set_coal.patch new file mode 100644 index 0000000000..0859bc3ccd --- /dev/null +++ b/queue-6.6/bnxt_en-refactor-bnxt_hwrm_set_coal.patch @@ -0,0 +1,96 @@ +From 9243fccd2bad5a5748b13726548fbba28e3b9143 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 13 Nov 2023 16:16:16 -0800 +Subject: bnxt_en: Refactor bnxt_hwrm_set_coal() + +From: Michael Chan <michael.chan@broadcom.com> + +[ Upstream commit 877edb347323b669c5c9511cc9e097e1192dd31b ] + +Add 2 helper functions to set coalescing for each RX and TX rings. This +will make it easier to expand the number of TX rings per MSIX in the +next patches. + +Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com> +Signed-off-by: Michael Chan <michael.chan@broadcom.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Stable-dep-of: 9caca6ac0e26 ("bnxt: properly flush XDP redirect lists") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 43 ++++++++++++++--------- + 1 file changed, 26 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index b5ed6c0753f7a..85872fcff5c9f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6810,10 +6810,29 @@ int bnxt_hwrm_set_ring_coal(struct bnxt *bp, struct bnxt_napi *bnapi) + return hwrm_req_send(bp, req_rx); + } + ++static int ++bnxt_hwrm_set_rx_coal(struct bnxt *bp, struct bnxt_napi *bnapi, ++ struct hwrm_ring_cmpl_ring_cfg_aggint_params_input *req) ++{ ++ u16 ring_id = bnxt_cp_ring_for_rx(bp, bnapi->rx_ring); ++ ++ req->ring_id = cpu_to_le16(ring_id); ++ return hwrm_req_send(bp, req); ++} ++ ++static int ++bnxt_hwrm_set_tx_coal(struct bnxt *bp, struct bnxt_napi *bnapi, ++ struct hwrm_ring_cmpl_ring_cfg_aggint_params_input *req) ++{ ++ u16 ring_id = bnxt_cp_ring_for_tx(bp, bnapi->tx_ring); ++ ++ req->ring_id = cpu_to_le16(ring_id); ++ return hwrm_req_send(bp, req); ++} ++ + int bnxt_hwrm_set_coal(struct bnxt *bp) + { +- struct hwrm_ring_cmpl_ring_cfg_aggint_params_input *req_rx, *req_tx, +- *req; ++ struct hwrm_ring_cmpl_ring_cfg_aggint_params_input *req_rx, *req_tx; + int i, rc; + + rc = hwrm_req_init(bp, req_rx, HWRM_RING_CMPL_RING_CFG_AGGINT_PARAMS); +@@ -6834,18 +6853,11 @@ int bnxt_hwrm_set_coal(struct bnxt *bp) + for (i = 0; i < bp->cp_nr_rings; i++) { + struct bnxt_napi *bnapi = bp->bnapi[i]; + struct bnxt_coal *hw_coal; +- u16 ring_id; + +- req = req_rx; +- if (!bnapi->rx_ring) { +- ring_id = bnxt_cp_ring_for_tx(bp, bnapi->tx_ring); +- req = req_tx; +- } else { +- ring_id = bnxt_cp_ring_for_rx(bp, bnapi->rx_ring); +- } +- req->ring_id = cpu_to_le16(ring_id); +- +- rc = hwrm_req_send(bp, req); ++ if (!bnapi->rx_ring) ++ rc = bnxt_hwrm_set_tx_coal(bp, bnapi, req_tx); ++ else ++ rc = bnxt_hwrm_set_rx_coal(bp, bnapi, req_rx); + if (rc) + break; + +@@ -6853,10 +6865,7 @@ int bnxt_hwrm_set_coal(struct bnxt *bp) + continue; + + if (bnapi->rx_ring && bnapi->tx_ring) { +- req = req_tx; +- ring_id = bnxt_cp_ring_for_tx(bp, bnapi->tx_ring); +- req->ring_id = cpu_to_le16(ring_id); +- rc = hwrm_req_send(bp, req); ++ rc = bnxt_hwrm_set_tx_coal(bp, bnapi, req_tx); + if (rc) + break; + } +-- +2.39.5 + diff --git a/queue-6.6/bnxt_en-refactor-bnxt_tx_int.patch b/queue-6.6/bnxt_en-refactor-bnxt_tx_int.patch new file mode 100644 index 0000000000..d089a5e694 --- /dev/null +++ b/queue-6.6/bnxt_en-refactor-bnxt_tx_int.patch @@ -0,0 +1,72 @@ +From f0836d14a6d42d57fb167d65a785fa3845f79c1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 13 Nov 2023 16:16:14 -0800 +Subject: bnxt_en: Refactor bnxt_tx_int() + +From: Michael Chan <michael.chan@broadcom.com> + +[ Upstream commit ebf72319cef6e1c038e13bd4c9e3f0ad857e57ff ] + +bnxt_tx_int() processes the only one TX ring from the bnxt_napi pointer. +To prepare for more TX rings associated with the bnxt_napi structure, +add a new __bnxt_tx_int() function that takes the bnxt_tx_ring_info +pointer to process that one TX ring. No functional change. + +Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com> +Signed-off-by: Michael Chan <michael.chan@broadcom.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Stable-dep-of: 9caca6ac0e26 ("bnxt: properly flush XDP redirect lists") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 7e1f4b3adb2c9..056ca742ae1f7 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -687,14 +687,14 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_OK; + } + +-static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) ++static void __bnxt_tx_int(struct bnxt *bp, struct bnxt_tx_ring_info *txr, ++ int budget) + { +- struct bnxt_tx_ring_info *txr = bnapi->tx_ring; + struct netdev_queue *txq = netdev_get_tx_queue(bp->dev, txr->txq_index); +- u16 hw_cons = txr->tx_hw_cons; +- u16 cons = txr->tx_cons; + struct pci_dev *pdev = bp->pdev; ++ u16 hw_cons = txr->tx_hw_cons; + unsigned int tx_bytes = 0; ++ u16 cons = txr->tx_cons; + int tx_pkts = 0; + + while (cons != hw_cons) { +@@ -749,7 +749,6 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + dev_consume_skb_any(skb); + } + +- bnapi->events &= ~BNXT_TX_CMP_EVENT; + WRITE_ONCE(txr->tx_cons, cons); + + __netif_txq_completed_wake(txq, tx_pkts, tx_bytes, +@@ -757,6 +756,14 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + READ_ONCE(txr->dev_state) == BNXT_DEV_STATE_CLOSING); + } + ++static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) ++{ ++ struct bnxt_tx_ring_info *txr = bnapi->tx_ring; ++ ++ __bnxt_tx_int(bp, txr, budget); ++ bnapi->events &= ~BNXT_TX_CMP_EVENT; ++} ++ + static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, + struct bnxt_rx_ring_info *rxr, + unsigned int *offset, +-- +2.39.5 + diff --git a/queue-6.6/bnxt_en-support-up-to-8-tx-rings-per-msix.patch b/queue-6.6/bnxt_en-support-up-to-8-tx-rings-per-msix.patch new file mode 100644 index 0000000000..443d0abeac --- /dev/null +++ b/queue-6.6/bnxt_en-support-up-to-8-tx-rings-per-msix.patch @@ -0,0 +1,266 @@ +From c0dcbfb47f056112690ed3c42168123234d2e345 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 13 Nov 2023 16:16:17 -0800 +Subject: bnxt_en: Support up to 8 TX rings per MSIX + +From: Michael Chan <michael.chan@broadcom.com> + +[ Upstream commit 0589a1ed4d334c156110f7f42ad7c39a02761438 ] + +For each mqprio TC, we allocate a set of TX rings to map to the new +hardware CoS queue. Expand the tx_ring pointer in struct bnxt_napi +to an array of 8 to support up to 8 TX rings, one for each TC. +Only array entry 0 is used at this time. The rest of the array +entries will be used in later patches. + +Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com> +Signed-off-by: Michael Chan <michael.chan@broadcom.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Stable-dep-of: 9caca6ac0e26 ("bnxt: properly flush XDP redirect lists") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 78 +++++++++++-------- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 12 ++- + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 4 +- + 3 files changed, 55 insertions(+), 39 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 85872fcff5c9f..65cc301b0993b 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -758,9 +758,13 @@ static void __bnxt_tx_int(struct bnxt *bp, struct bnxt_tx_ring_info *txr, + + static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + { +- struct bnxt_tx_ring_info *txr = bnapi->tx_ring; ++ struct bnxt_tx_ring_info *txr; ++ int i; + +- __bnxt_tx_int(bp, txr, budget); ++ bnxt_for_each_napi_tx(i, bnapi, txr) { ++ if (txr->tx_hw_cons != txr->tx_cons) ++ __bnxt_tx_int(bp, txr, budget); ++ } + bnapi->events &= ~BNXT_TX_CMP_EVENT; + } + +@@ -2500,7 +2504,6 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + { + struct bnxt_napi *bnapi = cpr->bnapi; + u32 raw_cons = cpr->cp_raw_cons; +- struct bnxt_tx_ring_info *txr; + u32 cons; + int rx_pkts = 0; + u8 event = 0; +@@ -2508,7 +2511,6 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + + cpr->has_more_work = 0; + cpr->had_work_done = 1; +- txr = bnapi->tx_ring; + while (1) { + int rc; + +@@ -2524,8 +2526,10 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + dma_rmb(); + if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) { + u32 opaque = txcmp->tx_cmp_opaque; ++ struct bnxt_tx_ring_info *txr; + u16 tx_freed; + ++ txr = bnapi->tx_ring[TX_OPAQUE_RING(opaque)]; + event |= BNXT_TX_CMP_EVENT; + txr->tx_hw_cons = TX_OPAQUE_PROD(bp, opaque); + tx_freed = (txr->tx_hw_cons - txr->tx_cons) & +@@ -2575,7 +2579,7 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + xdp_do_flush(); + + if (event & BNXT_TX_EVENT) { +- struct bnxt_tx_ring_info *txr = bnapi->tx_ring; ++ struct bnxt_tx_ring_info *txr = bnapi->tx_ring[0]; + u16 prod = txr->tx_prod; + + /* Sync BD data before updating doorbell */ +@@ -3558,7 +3562,7 @@ static int bnxt_alloc_cp_rings(struct bnxt *bp) + + static void bnxt_init_ring_struct(struct bnxt *bp) + { +- int i; ++ int i, j; + + for (i = 0; i < bp->cp_nr_rings; i++) { + struct bnxt_napi *bnapi = bp->bnapi[i]; +@@ -3603,18 +3607,16 @@ static void bnxt_init_ring_struct(struct bnxt *bp) + rmem->vmem = (void **)&rxr->rx_agg_ring; + + skip_rx: +- txr = bnapi->tx_ring; +- if (!txr) +- continue; +- +- ring = &txr->tx_ring_struct; +- rmem = &ring->ring_mem; +- rmem->nr_pages = bp->tx_nr_pages; +- rmem->page_size = HW_RXBD_RING_SIZE; +- rmem->pg_arr = (void **)txr->tx_desc_ring; +- rmem->dma_arr = txr->tx_desc_mapping; +- rmem->vmem_size = SW_TXBD_RING_SIZE * bp->tx_nr_pages; +- rmem->vmem = (void **)&txr->tx_buf_ring; ++ bnxt_for_each_napi_tx(j, bnapi, txr) { ++ ring = &txr->tx_ring_struct; ++ rmem = &ring->ring_mem; ++ rmem->nr_pages = bp->tx_nr_pages; ++ rmem->page_size = HW_TXBD_RING_SIZE; ++ rmem->pg_arr = (void **)txr->tx_desc_ring; ++ rmem->dma_arr = txr->tx_desc_mapping; ++ rmem->vmem_size = SW_TXBD_RING_SIZE * bp->tx_nr_pages; ++ rmem->vmem = (void **)&txr->tx_buf_ring; ++ } + } + } + +@@ -4414,7 +4416,7 @@ static int bnxt_alloc_stats(struct bnxt *bp) + + static void bnxt_clear_ring_indices(struct bnxt *bp) + { +- int i; ++ int i, j; + + if (!bp->bnapi) + return; +@@ -4431,8 +4433,7 @@ static void bnxt_clear_ring_indices(struct bnxt *bp) + cpr = &bnapi->cp_ring; + cpr->cp_raw_cons = 0; + +- txr = bnapi->tx_ring; +- if (txr) { ++ bnxt_for_each_napi_tx(j, bnapi, txr) { + txr->tx_prod = 0; + txr->tx_cons = 0; + txr->tx_hw_cons = 0; +@@ -4601,7 +4602,7 @@ static int bnxt_alloc_mem(struct bnxt *bp, bool irq_re_init) + txr->tx_ring_struct.ring_mem.flags = + BNXT_RMEM_RING_PTE_FLAG; + txr->bnapi = bp->bnapi[j]; +- bp->bnapi[j]->tx_ring = txr; ++ bp->bnapi[j]->tx_ring[0] = txr; + bp->tx_ring_map[i] = bp->tx_nr_rings_xdp + i; + if (i >= bp->tx_nr_rings_xdp) { + txr->txq_index = i - bp->tx_nr_rings_xdp; +@@ -6824,10 +6825,21 @@ static int + bnxt_hwrm_set_tx_coal(struct bnxt *bp, struct bnxt_napi *bnapi, + struct hwrm_ring_cmpl_ring_cfg_aggint_params_input *req) + { +- u16 ring_id = bnxt_cp_ring_for_tx(bp, bnapi->tx_ring); ++ struct bnxt_tx_ring_info *txr; ++ int i, rc; + +- req->ring_id = cpu_to_le16(ring_id); +- return hwrm_req_send(bp, req); ++ bnxt_for_each_napi_tx(i, bnapi, txr) { ++ u16 ring_id; ++ ++ ring_id = bnxt_cp_ring_for_tx(bp, txr); ++ req->ring_id = cpu_to_le16(ring_id); ++ rc = hwrm_req_send(bp, req); ++ if (rc) ++ return rc; ++ if (!(bp->flags & BNXT_FLAG_CHIP_P5)) ++ return 0; ++ } ++ return 0; + } + + int bnxt_hwrm_set_coal(struct bnxt *bp) +@@ -6864,7 +6876,7 @@ int bnxt_hwrm_set_coal(struct bnxt *bp) + if (!(bp->flags & BNXT_FLAG_CHIP_P5)) + continue; + +- if (bnapi->rx_ring && bnapi->tx_ring) { ++ if (bnapi->rx_ring && bnapi->tx_ring[0]) { + rc = bnxt_hwrm_set_tx_coal(bp, bnapi, req_tx); + if (rc) + break; +@@ -11569,15 +11581,13 @@ static int bnxt_dbg_hwrm_ring_info_get(struct bnxt *bp, u8 ring_type, + + static void bnxt_dump_tx_sw_state(struct bnxt_napi *bnapi) + { +- struct bnxt_tx_ring_info *txr = bnapi->tx_ring; +- int i = bnapi->index; +- +- if (!txr) +- return; ++ struct bnxt_tx_ring_info *txr; ++ int i = bnapi->index, j; + +- netdev_info(bnapi->bp->dev, "[%d]: tx{fw_ring: %d prod: %x cons: %x}\n", +- i, txr->tx_ring_struct.fw_ring_id, txr->tx_prod, +- txr->tx_cons); ++ bnxt_for_each_napi_tx(j, bnapi, txr) ++ netdev_info(bnapi->bp->dev, "[%d.%d]: tx{fw_ring: %d prod: %x cons: %x}\n", ++ i, j, txr->tx_ring_struct.fw_ring_id, txr->tx_prod, ++ txr->tx_cons); + } + + static void bnxt_dump_rx_sw_state(struct bnxt_napi *bnapi) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index d6636af60d821..0ebe51bcf8e6f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1036,6 +1036,14 @@ struct bnxt_cp_ring_info { + #define BNXT_TX_HDL 1 + }; + ++#define BNXT_MAX_QUEUE 8 ++#define BNXT_MAX_TXR_PER_NAPI BNXT_MAX_QUEUE ++ ++#define bnxt_for_each_napi_tx(iter, bnapi, txr) \ ++ for (iter = 0, txr = (bnapi)->tx_ring[0]; txr; \ ++ txr = (iter < BNXT_MAX_TXR_PER_NAPI - 1) ? \ ++ (bnapi)->tx_ring[++iter] : NULL) ++ + struct bnxt_napi { + struct napi_struct napi; + struct bnxt *bp; +@@ -1043,7 +1051,7 @@ struct bnxt_napi { + int index; + struct bnxt_cp_ring_info cp_ring; + struct bnxt_rx_ring_info *rx_ring; +- struct bnxt_tx_ring_info *tx_ring; ++ struct bnxt_tx_ring_info *tx_ring[BNXT_MAX_TXR_PER_NAPI]; + + void (*tx_int)(struct bnxt *, struct bnxt_napi *, + int budget); +@@ -1380,8 +1388,6 @@ struct bnxt_link_info { + (PORT_PHY_CFG_REQ_FLAGS_FEC_CLAUSE74_DISABLE | \ + BNXT_FEC_RS_OFF(link_info)) + +-#define BNXT_MAX_QUEUE 8 +- + struct bnxt_queue_info { + u8 queue_id; + u8 queue_profile; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +index f9ed827efddd4..c3fb7f9b081ed 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +@@ -120,7 +120,7 @@ static void __bnxt_xmit_xdp_redirect(struct bnxt *bp, + + void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + { +- struct bnxt_tx_ring_info *txr = bnapi->tx_ring; ++ struct bnxt_tx_ring_info *txr = bnapi->tx_ring[0]; + struct bnxt_rx_ring_info *rxr = bnapi->rx_ring; + u16 tx_hw_cons = txr->tx_hw_cons; + bool rx_doorbell_needed = false; +@@ -242,7 +242,7 @@ bool bnxt_rx_xdp(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, u16 cons, + pdev = bp->pdev; + offset = bp->rx_offset; + +- txr = rxr->bnapi->tx_ring; ++ txr = rxr->bnapi->tx_ring[0]; + /* BNXT_RX_PAGE_MODE(bp) when XDP enabled */ + orig_data = xdp.data; + +-- +2.39.5 + diff --git a/queue-6.6/drm-bridge-ti-sn65dsi86-add-hpd-for-displayport-conn.patch b/queue-6.6/drm-bridge-ti-sn65dsi86-add-hpd-for-displayport-conn.patch new file mode 100644 index 0000000000..ac7b9e8a45 --- /dev/null +++ b/queue-6.6/drm-bridge-ti-sn65dsi86-add-hpd-for-displayport-conn.patch @@ -0,0 +1,150 @@ +From d17a489b0e4b2b6d7883352551ebbc0946a159a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 24 Jun 2025 10:18:35 +0530 +Subject: drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type + +From: Jayesh Choudhary <j-choudhary@ti.com> + +[ Upstream commit 55e8ff842051b1150461d7595d8f1d033c69d66b ] + +By default, HPD was disabled on SN65DSI86 bridge. When the driver was +added (commit "a095f15c00e27"), the HPD_DISABLE bit was set in pre-enable +call which was moved to other function calls subsequently. +Later on, commit "c312b0df3b13" added detect utility for DP mode. But with +HPD_DISABLE bit set, all the HPD events are disabled[0] and the debounced +state always return 1 (always connected state). + +Set HPD_DISABLE bit conditionally based on display sink's connector type. +Since the HPD_STATE is reflected correctly only after waiting for debounce +time (~100-400ms) and adding this delay in detect() is not feasible +owing to the performace impact (glitches and frame drop), remove runtime +calls in detect() and add hpd_enable()/disable() bridge hooks with runtime +calls, to detect hpd properly without any delay. + +[0]: <https://www.ti.com/lit/gpn/SN65DSI86> (Pg. 32) + +Fixes: c312b0df3b13 ("drm/bridge: ti-sn65dsi86: Implement bridge connector operations for DP") +Cc: Max Krummenacher <max.krummenacher@toradex.com> +Reviewed-by: Douglas Anderson <dianders@chromium.org> +Tested-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com> +Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com> +Signed-off-by: Douglas Anderson <dianders@chromium.org> +Link: https://lore.kernel.org/r/20250624044835.165708-1-j-choudhary@ti.com +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 69 +++++++++++++++++++++++---- + 1 file changed, 60 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 3e31a0c5a6d25..002f8aaa509bc 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -331,12 +331,18 @@ static void ti_sn65dsi86_enable_comms(struct ti_sn65dsi86 *pdata) + * 200 ms. We'll assume that the panel driver will have the hardcoded + * delay in its prepare and always disable HPD. + * +- * If HPD somehow makes sense on some future panel we'll have to +- * change this to be conditional on someone specifying that HPD should +- * be used. ++ * For DisplayPort bridge type, we need HPD. So we use the bridge type ++ * to conditionally disable HPD. ++ * NOTE: The bridge type is set in ti_sn_bridge_probe() but enable_comms() ++ * can be called before. So for DisplayPort, HPD will be enabled once ++ * bridge type is set. We are using bridge type instead of "no-hpd" ++ * property because it is not used properly in devicetree description ++ * and hence is unreliable. + */ +- regmap_update_bits(pdata->regmap, SN_HPD_DISABLE_REG, HPD_DISABLE, +- HPD_DISABLE); ++ ++ if (pdata->bridge.type != DRM_MODE_CONNECTOR_DisplayPort) ++ regmap_update_bits(pdata->regmap, SN_HPD_DISABLE_REG, HPD_DISABLE, ++ HPD_DISABLE); + + pdata->comms_enabled = true; + +@@ -1173,9 +1179,14 @@ static enum drm_connector_status ti_sn_bridge_detect(struct drm_bridge *bridge) + struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); + int val = 0; + +- pm_runtime_get_sync(pdata->dev); ++ /* ++ * Runtime reference is grabbed in ti_sn_bridge_hpd_enable() ++ * as the chip won't report HPD just after being powered on. ++ * HPD_DEBOUNCED_STATE reflects correct state only after the ++ * debounce time (~100-400 ms). ++ */ ++ + regmap_read(pdata->regmap, SN_HPD_DISABLE_REG, &val); +- pm_runtime_put_autosuspend(pdata->dev); + + return val & HPD_DEBOUNCED_STATE ? connector_status_connected + : connector_status_disconnected; +@@ -1198,6 +1209,26 @@ static void ti_sn65dsi86_debugfs_init(struct drm_bridge *bridge, struct dentry * + debugfs_create_file("status", 0600, debugfs, pdata, &status_fops); + } + ++static void ti_sn_bridge_hpd_enable(struct drm_bridge *bridge) ++{ ++ struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); ++ ++ /* ++ * Device needs to be powered on before reading the HPD state ++ * for reliable hpd detection in ti_sn_bridge_detect() due to ++ * the high debounce time. ++ */ ++ ++ pm_runtime_get_sync(pdata->dev); ++} ++ ++static void ti_sn_bridge_hpd_disable(struct drm_bridge *bridge) ++{ ++ struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); ++ ++ pm_runtime_put_autosuspend(pdata->dev); ++} ++ + static const struct drm_bridge_funcs ti_sn_bridge_funcs = { + .attach = ti_sn_bridge_attach, + .detach = ti_sn_bridge_detach, +@@ -1212,6 +1243,8 @@ static const struct drm_bridge_funcs ti_sn_bridge_funcs = { + .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, + .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, + .debugfs_init = ti_sn65dsi86_debugfs_init, ++ .hpd_enable = ti_sn_bridge_hpd_enable, ++ .hpd_disable = ti_sn_bridge_hpd_disable, + }; + + static void ti_sn_bridge_parse_lanes(struct ti_sn65dsi86 *pdata, +@@ -1300,8 +1333,26 @@ static int ti_sn_bridge_probe(struct auxiliary_device *adev, + pdata->bridge.type = pdata->next_bridge->type == DRM_MODE_CONNECTOR_DisplayPort + ? DRM_MODE_CONNECTOR_DisplayPort : DRM_MODE_CONNECTOR_eDP; + +- if (pdata->bridge.type == DRM_MODE_CONNECTOR_DisplayPort) +- pdata->bridge.ops = DRM_BRIDGE_OP_EDID | DRM_BRIDGE_OP_DETECT; ++ if (pdata->bridge.type == DRM_MODE_CONNECTOR_DisplayPort) { ++ pdata->bridge.ops = DRM_BRIDGE_OP_EDID | DRM_BRIDGE_OP_DETECT | ++ DRM_BRIDGE_OP_HPD; ++ /* ++ * If comms were already enabled they would have been enabled ++ * with the wrong value of HPD_DISABLE. Update it now. Comms ++ * could be enabled if anyone is holding a pm_runtime reference ++ * (like if a GPIO is in use). Note that in most cases nobody ++ * is doing AUX channel xfers before the bridge is added so ++ * HPD doesn't _really_ matter then. The only exception is in ++ * the eDP case where the panel wants to read the EDID before ++ * the bridge is added. We always consistently have HPD disabled ++ * for eDP. ++ */ ++ mutex_lock(&pdata->comms_mutex); ++ if (pdata->comms_enabled) ++ regmap_update_bits(pdata->regmap, SN_HPD_DISABLE_REG, ++ HPD_DISABLE, 0); ++ mutex_unlock(&pdata->comms_mutex); ++ }; + + drm_bridge_add(&pdata->bridge); + +-- +2.39.5 + diff --git a/queue-6.6/drm-bridge-ti-sn65dsi86-make-use-of-debugfs_init-cal.patch b/queue-6.6/drm-bridge-ti-sn65dsi86-make-use-of-debugfs_init-cal.patch new file mode 100644 index 0000000000..f0c710393b --- /dev/null +++ b/queue-6.6/drm-bridge-ti-sn65dsi86-make-use-of-debugfs_init-cal.patch @@ -0,0 +1,104 @@ +From cdf6cb5973f2310b096ed3211bd1151f19073bdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sat, 15 Mar 2025 21:15:11 +0100 +Subject: drm/bridge: ti-sn65dsi86: make use of debugfs_init callback + +From: Wolfram Sang <wsa+renesas@sang-engineering.com> + +[ Upstream commit 1d1f7b15cb9c11974cebfd39da51dc69b8cb31ff ] + +Do not create a custom directory in debugfs-root, but use the +debugfs_init callback to create a custom directory at the given place +for the bridge. The new directory layout looks like this on a Renesas +GrayHawk-Single with a R-Car V4M SoC: + + /sys/kernel/debug/dri/feb00000.display/DP-1/1-002c + +Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> +Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> +Reviewed-by: Douglas Anderson <dianders@chromium.org> +Signed-off-by: Douglas Anderson <dianders@chromium.org> +Link: https://patchwork.freedesktop.org/patch/msgid/20250315201651.7339-2-wsa+renesas@sang-engineering.com +Stable-dep-of: 55e8ff842051 ("drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 40 +++++++-------------------- + 1 file changed, 10 insertions(+), 30 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index bfbd3fee12567..3e31a0c5a6d25 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -424,36 +424,8 @@ static int status_show(struct seq_file *s, void *data) + + return 0; + } +- + DEFINE_SHOW_ATTRIBUTE(status); + +-static void ti_sn65dsi86_debugfs_remove(void *data) +-{ +- debugfs_remove_recursive(data); +-} +- +-static void ti_sn65dsi86_debugfs_init(struct ti_sn65dsi86 *pdata) +-{ +- struct device *dev = pdata->dev; +- struct dentry *debugfs; +- int ret; +- +- debugfs = debugfs_create_dir(dev_name(dev), NULL); +- +- /* +- * We might get an error back if debugfs wasn't enabled in the kernel +- * so let's just silently return upon failure. +- */ +- if (IS_ERR_OR_NULL(debugfs)) +- return; +- +- ret = devm_add_action_or_reset(dev, ti_sn65dsi86_debugfs_remove, debugfs); +- if (ret) +- return; +- +- debugfs_create_file("status", 0600, debugfs, pdata, &status_fops); +-} +- + /* ----------------------------------------------------------------------------- + * Auxiliary Devices (*not* AUX) + */ +@@ -1217,6 +1189,15 @@ static struct edid *ti_sn_bridge_get_edid(struct drm_bridge *bridge, + return drm_get_edid(connector, &pdata->aux.ddc); + } + ++static void ti_sn65dsi86_debugfs_init(struct drm_bridge *bridge, struct dentry *root) ++{ ++ struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); ++ struct dentry *debugfs; ++ ++ debugfs = debugfs_create_dir(dev_name(pdata->dev), root); ++ debugfs_create_file("status", 0600, debugfs, pdata, &status_fops); ++} ++ + static const struct drm_bridge_funcs ti_sn_bridge_funcs = { + .attach = ti_sn_bridge_attach, + .detach = ti_sn_bridge_detach, +@@ -1230,6 +1211,7 @@ static const struct drm_bridge_funcs ti_sn_bridge_funcs = { + .atomic_reset = drm_atomic_helper_bridge_reset, + .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, + .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, ++ .debugfs_init = ti_sn65dsi86_debugfs_init, + }; + + static void ti_sn_bridge_parse_lanes(struct ti_sn65dsi86 *pdata, +@@ -1935,8 +1917,6 @@ static int ti_sn65dsi86_probe(struct i2c_client *client) + if (ret) + return ret; + +- ti_sn65dsi86_debugfs_init(pdata); +- + /* + * Break ourselves up into a collection of aux devices. The only real + * motiviation here is to solve the chicken-and-egg problem of probe +-- +2.39.5 + diff --git a/queue-6.6/drm-i915-fix-build-error-some-more.patch b/queue-6.6/drm-i915-fix-build-error-some-more.patch new file mode 100644 index 0000000000..c15f3f3878 --- /dev/null +++ b/queue-6.6/drm-i915-fix-build-error-some-more.patch @@ -0,0 +1,52 @@ +From 4817f3ff521c7247ebe5f630e545c0c85c45fa8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 20 Jun 2025 13:18:18 +0200 +Subject: drm/i915: fix build error some more + +From: Arnd Bergmann <arnd@arndb.de> + +[ Upstream commit d02b2103a08b6d6908f1d3d8e8783d3f342555ac ] + +An earlier patch fixed a build failure with clang, but I still see the +same problem with some configurations using gcc: + +drivers/gpu/drm/i915/i915_pmu.c: In function 'config_mask': +include/linux/compiler_types.h:568:38: error: call to '__compiletime_assert_462' declared with attribute error: BUILD_BUG_ON failed: bit > BITS_PER_TYPE(typeof_member(struct i915_pmu, enable)) - 1 +drivers/gpu/drm/i915/i915_pmu.c:116:3: note: in expansion of macro 'BUILD_BUG_ON' + 116 | BUILD_BUG_ON(bit > + +As I understand it, the problem is that the function is not always fully +inlined, but the __builtin_constant_p() can still evaluate the argument +as being constant. + +Marking it as __always_inline so far works for me in all configurations. + +Fixes: a7137b1825b5 ("drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled") +Fixes: a644fde77ff7 ("drm/i915/pmu: Change bitmask of enabled events to u32") +Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> +Signed-off-by: Arnd Bergmann <arnd@arndb.de> +Link: https://lore.kernel.org/r/20250620111824.3395007-1-arnd@kernel.org +Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> +(cherry picked from commit ef69f9dd1cd7301cdf04ba326ed28152a3affcf6) +Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/gpu/drm/i915/i915_pmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c +index 33ab82c334a88..461aafc2ae9af 100644 +--- a/drivers/gpu/drm/i915/i915_pmu.c ++++ b/drivers/gpu/drm/i915/i915_pmu.c +@@ -101,7 +101,7 @@ static unsigned int config_bit(const u64 config) + return other_bit(config); + } + +-static u32 config_mask(const u64 config) ++static __always_inline u32 config_mask(const u64 config) + { + unsigned int bit = config_bit(config); + +-- +2.39.5 + diff --git a/queue-6.6/libbpf-fix-null-pointer-dereference-in-btf_dump__fre.patch b/queue-6.6/libbpf-fix-null-pointer-dereference-in-btf_dump__fre.patch new file mode 100644 index 0000000000..fd10ef7402 --- /dev/null +++ b/queue-6.6/libbpf-fix-null-pointer-dereference-in-btf_dump__fre.patch @@ -0,0 +1,42 @@ +From 8ce68ecf592696ccd3fd16f85a06f6963ca951f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 18 Jun 2025 09:19:33 +0800 +Subject: libbpf: Fix null pointer dereference in btf_dump__free on allocation + failure + +From: Yuan Chen <chenyuan@kylinos.cn> + +[ Upstream commit aa485e8789d56a4573f7c8d000a182b749eaa64d ] + +When btf_dump__new() fails to allocate memory for the internal hashmap +(btf_dump->type_names), it returns an error code. However, the cleanup +function btf_dump__free() does not check if btf_dump->type_names is NULL +before attempting to free it. This leads to a null pointer dereference +when btf_dump__free() is called on a btf_dump object. + +Fixes: 351131b51c7a ("libbpf: add btf_dump API for BTF-to-C conversion") +Signed-off-by: Yuan Chen <chenyuan@kylinos.cn> +Signed-off-by: Andrii Nakryiko <andrii@kernel.org> +Link: https://lore.kernel.org/bpf/20250618011933.11423-1-chenyuan_fl@163.com +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + tools/lib/bpf/btf_dump.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index ebf56d21d08ee..cf4db51b99eb5 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -225,6 +225,9 @@ static void btf_dump_free_names(struct hashmap *map) + size_t bkt; + struct hashmap_entry *cur; + ++ if (!map) ++ return; ++ + hashmap__for_each_entry(map, cur, bkt) + free((void *)cur->pkey); + +-- +2.39.5 + diff --git a/queue-6.6/libbpf-fix-possible-use-after-free-for-externs.patch b/queue-6.6/libbpf-fix-possible-use-after-free-for-externs.patch new file mode 100644 index 0000000000..db3e485c42 --- /dev/null +++ b/queue-6.6/libbpf-fix-possible-use-after-free-for-externs.patch @@ -0,0 +1,112 @@ +From c48aa43653bfc3c084583feedb443c6792c2d151 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 24 Jun 2025 22:02:15 -0700 +Subject: libbpf: Fix possible use-after-free for externs + +From: Adin Scannell <amscanne@meta.com> + +[ Upstream commit fa6f092cc0a02d0fcee37e9e8172eda372a03d33 ] + +The `name` field in `obj->externs` points into the BTF data at initial +open time. However, some functions may invalidate this after opening and +before loading (e.g. `bpf_map__set_value_size`), which results in +pointers into freed memory and undefined behavior. + +The simplest solution is to simply `strdup` these strings, similar to +the `essent_name`, and free them at the same time. + +In order to test this path, the `global_map_resize` BPF selftest is +modified slightly to ensure the presence of an extern, which causes this +test to fail prior to the fix. Given there isn't an obvious API or error +to test against, I opted to add this to the existing test as an aspect +of the resizing feature rather than duplicate the test. + +Fixes: 9d0a23313b1a ("libbpf: Add capability for resizing datasec maps") +Signed-off-by: Adin Scannell <amscanne@meta.com> +Signed-off-by: Andrii Nakryiko <andrii@kernel.org> +Link: https://lore.kernel.org/bpf/20250625050215.2777374-1-amscanne@meta.com +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + tools/lib/bpf/libbpf.c | 10 +++++++--- + .../selftests/bpf/progs/test_global_map_resize.c | 16 ++++++++++++++++ + 2 files changed, 23 insertions(+), 3 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 5dc2e55553358..aefbfa2df6207 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -554,7 +554,7 @@ struct extern_desc { + int sym_idx; + int btf_id; + int sec_btf_id; +- const char *name; ++ char *name; + char *essent_name; + bool is_set; + bool is_weak; +@@ -3822,7 +3822,9 @@ static int bpf_object__collect_externs(struct bpf_object *obj) + return ext->btf_id; + } + t = btf__type_by_id(obj->btf, ext->btf_id); +- ext->name = btf__name_by_offset(obj->btf, t->name_off); ++ ext->name = strdup(btf__name_by_offset(obj->btf, t->name_off)); ++ if (!ext->name) ++ return -ENOMEM; + ext->sym_idx = i; + ext->is_weak = ELF64_ST_BIND(sym->st_info) == STB_WEAK; + +@@ -8457,8 +8459,10 @@ void bpf_object__close(struct bpf_object *obj) + zfree(&obj->btf_custom_path); + zfree(&obj->kconfig); + +- for (i = 0; i < obj->nr_extern; i++) ++ for (i = 0; i < obj->nr_extern; i++) { ++ zfree(&obj->externs[i].name); + zfree(&obj->externs[i].essent_name); ++ } + + zfree(&obj->externs); + obj->nr_extern = 0; +diff --git a/tools/testing/selftests/bpf/progs/test_global_map_resize.c b/tools/testing/selftests/bpf/progs/test_global_map_resize.c +index 1fbb73d3e5d5a..9be0e32cfeeea 100644 +--- a/tools/testing/selftests/bpf/progs/test_global_map_resize.c ++++ b/tools/testing/selftests/bpf/progs/test_global_map_resize.c +@@ -31,6 +31,16 @@ int my_int_last SEC(".data.array_not_last"); + + int percpu_arr[1] SEC(".data.percpu_arr"); + ++/* at least one extern is included, to ensure that a specific ++ * regression is tested whereby resizing resulted in a free-after-use ++ * bug after type information is invalidated by the resize operation. ++ * ++ * There isn't a particularly good API to test for this specific condition, ++ * but by having externs for the resizing tests it will cover this path. ++ */ ++extern int LINUX_KERNEL_VERSION __kconfig; ++long version_sink; ++ + SEC("tp/syscalls/sys_enter_getpid") + int bss_array_sum(void *ctx) + { +@@ -43,6 +53,9 @@ int bss_array_sum(void *ctx) + for (size_t i = 0; i < bss_array_len; ++i) + sum += array[i]; + ++ /* see above; ensure this is not optimized out */ ++ version_sink = LINUX_KERNEL_VERSION; ++ + return 0; + } + +@@ -58,5 +71,8 @@ int data_array_sum(void *ctx) + for (size_t i = 0; i < data_array_len; ++i) + sum += my_array[i]; + ++ /* see above; ensure this is not optimized out */ ++ version_sink = LINUX_KERNEL_VERSION; ++ + return 0; + } +-- +2.39.5 + diff --git a/queue-6.6/net-enetc-correct-endianness-handling-in-_enetc_rd_r.patch b/queue-6.6/net-enetc-correct-endianness-handling-in-_enetc_rd_r.patch new file mode 100644 index 0000000000..8240529ec4 --- /dev/null +++ b/queue-6.6/net-enetc-correct-endianness-handling-in-_enetc_rd_r.patch @@ -0,0 +1,60 @@ +From d9b67fac88d4659e26adba37c7b9d424ea9e5993 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 24 Jun 2025 17:35:12 +0100 +Subject: net: enetc: Correct endianness handling in _enetc_rd_reg64 + +From: Simon Horman <horms@kernel.org> + +[ Upstream commit 7b515f35a911fdc31fbde6531828dcd6ae9803d3 ] + +enetc_hw.h provides two versions of _enetc_rd_reg64. +One which simply calls ioread64() when available. +And another that composes the 64-bit result from ioread32() calls. + +In the second case the code appears to assume that each ioread32() call +returns a little-endian value. However both the shift and logical or +used to compose the return value would not work correctly on big endian +systems if this were the case. Moreover, this is inconsistent with the +first case where the return value of ioread64() is assumed to be in host +byte order. + +It appears that the correct approach is for both versions to treat the +return value of ioread*() functions as being in host byte order. And +this patch corrects the ioread32()-based version to do so. + +This is a bug but would only manifest on big endian systems +that make use of the ioread32-based implementation of _enetc_rd_reg64. +While all in-tree users of this driver are little endian and +make use of the ioread64-based implementation of _enetc_rd_reg64. +Thus, no in-tree user of this driver is affected by this bug. + +Flagged by Sparse. +Compile tested only. + +Fixes: 16eb4c85c964 ("enetc: Add ethtool statistics") +Closes: https://lore.kernel.org/all/AM9PR04MB850500D3FC24FE23DEFCEA158879A@AM9PR04MB8505.eurprd04.prod.outlook.com/ +Signed-off-by: Simon Horman <horms@kernel.org> +Reviewed-by: Wei Fang <wei.fang@nxp.com> +Link: https://patch.msgid.link/20250624-etnetc-le-v1-1-a73a95d96e4e@kernel.org +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/freescale/enetc/enetc_hw.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +index 1619943fb2637..4e8881b479e48 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h ++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +@@ -485,7 +485,7 @@ static inline u64 _enetc_rd_reg64(void __iomem *reg) + tmp = ioread32(reg + 4); + } while (high != tmp); + +- return le64_to_cpu((__le64)high << 32 | low); ++ return (u64)high << 32 | low; + } + #endif + +-- +2.39.5 + diff --git a/queue-6.6/net-selftests-fix-tcp-packet-checksum.patch b/queue-6.6/net-selftests-fix-tcp-packet-checksum.patch new file mode 100644 index 0000000000..cfa72bb9d3 --- /dev/null +++ b/queue-6.6/net-selftests-fix-tcp-packet-checksum.patch @@ -0,0 +1,46 @@ +From f6f90d8f9f839a269226934cdba027b7af9bd900 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 24 Jun 2025 11:32:58 -0700 +Subject: net: selftests: fix TCP packet checksum + +From: Jakub Kicinski <kuba@kernel.org> + +[ Upstream commit 8d89661a36dd3bb8c9902cff36dc0c144dce3faf ] + +The length in the pseudo header should be the length of the L3 payload +AKA the L4 header+payload. The selftest code builds the packet from +the lower layers up, so all the headers are pushed already when it +constructs L4. We need to subtract the lower layer headers from skb->len. + +Fixes: 3e1e58d64c3d ("net: add generic selftest support") +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Reviewed-by: Gerhard Engleder <gerhard@engleder-embedded.com> +Reported-by: Oleksij Rempel <o.rempel@pengutronix.de> +Tested-by: Oleksij Rempel <o.rempel@pengutronix.de> +Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de> +Link: https://patch.msgid.link/20250624183258.3377740-1-kuba@kernel.org +Signed-off-by: Paolo Abeni <pabeni@redhat.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/core/selftests.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/core/selftests.c b/net/core/selftests.c +index 7af99d07762ea..946e92cca2111 100644 +--- a/net/core/selftests.c ++++ b/net/core/selftests.c +@@ -160,8 +160,9 @@ static struct sk_buff *net_test_get_skb(struct net_device *ndev, + skb->csum = 0; + skb->ip_summed = CHECKSUM_PARTIAL; + if (attr->tcp) { +- thdr->check = ~tcp_v4_check(skb->len, ihdr->saddr, +- ihdr->daddr, 0); ++ int l4len = skb->len - skb_transport_offset(skb); ++ ++ thdr->check = ~tcp_v4_check(l4len, ihdr->saddr, ihdr->daddr, 0); + skb->csum_start = skb_transport_header(skb) - skb->head; + skb->csum_offset = offsetof(struct tcphdr, check); + } else { +-- +2.39.5 + diff --git a/queue-6.6/series b/queue-6.6/series index 1a7dabf186..ae89079bf3 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -75,3 +75,30 @@ asoc-amd-yc-add-dmi-quirk-for-lenovo-ideapad-slim-5-15.patch s390-pkey-prevent-overflow-in-size-calculation-for-memdup_user.patch lib-group_cpus-fix-null-pointer-dereference-from-group_cpus_evenly.patch drm-dp-change-aux-dpcd-probe-address-from-dpcd_rev-to-lane0_1_status.patch +atm-clip-prevent-null-deref-in-clip_push.patch +alsa-usb-audio-fix-out-of-bounds-read-in-snd_usb_get.patch +attach_recursive_mnt-do-not-lock-the-covering-tree-w.patch +libbpf-fix-null-pointer-dereference-in-btf_dump__fre.patch +wifi-mac80211-fix-beacon-interval-calculation-overfl.patch +af_unix-don-t-set-econnreset-for-consumed-oob-skb.patch +vsock-uapi-fix-linux-vm_sockets.h-userspace-compilat.patch +bnxt_en-put-the-tx-producer-information-in-the-tx-bd.patch +bnxt_en-add-completion-ring-pointer-in-tx-and-rx-rin.patch +bnxt_en-refactor-bnxt_tx_int.patch +bnxt_en-new-encoding-for-the-tx-opaque-field.patch +bnxt_en-refactor-bnxt_hwrm_set_coal.patch +bnxt_en-support-up-to-8-tx-rings-per-msix.patch +bnxt_en-modify-tx-ring-indexing-logic.patch +bnxt_en-fix-tx-ring-indexing-logic.patch +bnxt_en-allow-some-tx-packets-to-be-unprocessed-in-n.patch +bnxt-properly-flush-xdp-redirect-lists.patch +um-ubd-add-missing-error-check-in-start_io_thread.patch +libbpf-fix-possible-use-after-free-for-externs.patch +net-enetc-correct-endianness-handling-in-_enetc_rd_r.patch +atm-release-atm_dev_mutex-after-removing-procfs-in-a.patch +alsa-hda-realtek-fix-built-in-mic-on-asus-vivobook-x.patch +net-selftests-fix-tcp-packet-checksum.patch +drm-i915-fix-build-error-some-more.patch +drm-bridge-ti-sn65dsi86-make-use-of-debugfs_init-cal.patch +drm-bridge-ti-sn65dsi86-add-hpd-for-displayport-conn.patch +smb-client-fix-potential-deadlock-when-reconnecting-.patch diff --git a/queue-6.6/smb-client-fix-potential-deadlock-when-reconnecting-.patch b/queue-6.6/smb-client-fix-potential-deadlock-when-reconnecting-.patch new file mode 100644 index 0000000000..3c915fdd2f --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-deadlock-when-reconnecting-.patch @@ -0,0 +1,214 @@ +From 60ff6a6d1e2f39d083f042d9da343fd463741fcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 25 Jun 2025 12:22:38 -0300 +Subject: smb: client: fix potential deadlock when reconnecting channels + +From: Paulo Alcantara <pc@manguebit.org> + +[ Upstream commit 711741f94ac3cf9f4e3aa73aa171e76d188c0819 ] + +Fix cifs_signal_cifsd_for_reconnect() to take the correct lock order +and prevent the following deadlock from happening + +====================================================== +WARNING: possible circular locking dependency detected +6.16.0-rc3-build2+ #1301 Tainted: G S W +------------------------------------------------------ +cifsd/6055 is trying to acquire lock: +ffff88810ad56038 (&tcp_ses->srv_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x134/0x200 + +but task is already holding lock: +ffff888119c64330 (&ret_buf->chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #2 (&ret_buf->chan_lock){+.+.}-{3:3}: + validate_chain+0x1cf/0x270 + __lock_acquire+0x60e/0x780 + lock_acquire.part.0+0xb4/0x1f0 + _raw_spin_lock+0x2f/0x40 + cifs_setup_session+0x81/0x4b0 + cifs_get_smb_ses+0x771/0x900 + cifs_mount_get_session+0x7e/0x170 + cifs_mount+0x92/0x2d0 + cifs_smb3_do_mount+0x161/0x460 + smb3_get_tree+0x55/0x90 + vfs_get_tree+0x46/0x180 + do_new_mount+0x1b0/0x2e0 + path_mount+0x6ee/0x740 + do_mount+0x98/0xe0 + __do_sys_mount+0x148/0x180 + do_syscall_64+0xa4/0x260 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +-> #1 (&ret_buf->ses_lock){+.+.}-{3:3}: + validate_chain+0x1cf/0x270 + __lock_acquire+0x60e/0x780 + lock_acquire.part.0+0xb4/0x1f0 + _raw_spin_lock+0x2f/0x40 + cifs_match_super+0x101/0x320 + sget+0xab/0x270 + cifs_smb3_do_mount+0x1e0/0x460 + smb3_get_tree+0x55/0x90 + vfs_get_tree+0x46/0x180 + do_new_mount+0x1b0/0x2e0 + path_mount+0x6ee/0x740 + do_mount+0x98/0xe0 + __do_sys_mount+0x148/0x180 + do_syscall_64+0xa4/0x260 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +-> #0 (&tcp_ses->srv_lock){+.+.}-{3:3}: + check_noncircular+0x95/0xc0 + check_prev_add+0x115/0x2f0 + validate_chain+0x1cf/0x270 + __lock_acquire+0x60e/0x780 + lock_acquire.part.0+0xb4/0x1f0 + _raw_spin_lock+0x2f/0x40 + cifs_signal_cifsd_for_reconnect+0x134/0x200 + __cifs_reconnect+0x8f/0x500 + cifs_handle_standard+0x112/0x280 + cifs_demultiplex_thread+0x64d/0xbc0 + kthread+0x2f7/0x310 + ret_from_fork+0x2a/0x230 + ret_from_fork_asm+0x1a/0x30 + +other info that might help us debug this: + +Chain exists of: + &tcp_ses->srv_lock --> &ret_buf->ses_lock --> &ret_buf->chan_lock + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&ret_buf->chan_lock); + lock(&ret_buf->ses_lock); + lock(&ret_buf->chan_lock); + lock(&tcp_ses->srv_lock); + + *** DEADLOCK *** + +3 locks held by cifsd/6055: + #0: ffffffff857de398 (&cifs_tcp_ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x7b/0x200 + #1: ffff888119c64060 (&ret_buf->ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x9c/0x200 + #2: ffff888119c64330 (&ret_buf->chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200 + +Cc: linux-cifs@vger.kernel.org +Reported-by: David Howells <dhowells@redhat.com> +Fixes: d7d7a66aacd6 ("cifs: avoid use of global locks for high contention data") +Reviewed-by: David Howells <dhowells@redhat.com> +Tested-by: David Howells <dhowells@redhat.com> +Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> +Signed-off-by: David Howells <dhowells@redhat.com> +Signed-off-by: Steve French <stfrench@microsoft.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + fs/smb/client/cifsglob.h | 1 + + fs/smb/client/connect.c | 58 +++++++++++++++++++++++++--------------- + 2 files changed, 37 insertions(+), 22 deletions(-) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index c7da6bf2f44be..d776340ad91ce 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -677,6 +677,7 @@ inc_rfc1001_len(void *buf, int count) + struct TCP_Server_Info { + struct list_head tcp_ses_list; + struct list_head smb_ses_list; ++ struct list_head rlist; /* reconnect list */ + spinlock_t srv_lock; /* protect anything here that is not protected */ + __u64 conn_id; /* connection identifier (useful for debugging) */ + int srv_count; /* reference counter */ +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index 8fa5fe0a8c5c5..454420aa02220 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -140,6 +140,14 @@ static void smb2_query_server_interfaces(struct work_struct *work) + (SMB_INTERFACE_POLL_INTERVAL * HZ)); + } + ++#define set_need_reco(server) \ ++do { \ ++ spin_lock(&server->srv_lock); \ ++ if (server->tcpStatus != CifsExiting) \ ++ server->tcpStatus = CifsNeedReconnect; \ ++ spin_unlock(&server->srv_lock); \ ++} while (0) ++ + /* + * Update the tcpStatus for the server. + * This is used to signal the cifsd thread to call cifs_reconnect +@@ -153,39 +161,45 @@ void + cifs_signal_cifsd_for_reconnect(struct TCP_Server_Info *server, + bool all_channels) + { +- struct TCP_Server_Info *pserver; ++ struct TCP_Server_Info *nserver; + struct cifs_ses *ses; ++ LIST_HEAD(reco); + int i; + +- /* If server is a channel, select the primary channel */ +- pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; +- + /* if we need to signal just this channel */ + if (!all_channels) { +- spin_lock(&server->srv_lock); +- if (server->tcpStatus != CifsExiting) +- server->tcpStatus = CifsNeedReconnect; +- spin_unlock(&server->srv_lock); ++ set_need_reco(server); + return; + } + +- spin_lock(&cifs_tcp_ses_lock); +- list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { +- if (cifs_ses_exiting(ses)) +- continue; +- spin_lock(&ses->chan_lock); +- for (i = 0; i < ses->chan_count; i++) { +- if (!ses->chans[i].server) ++ if (SERVER_IS_CHAN(server)) ++ server = server->primary_server; ++ scoped_guard(spinlock, &cifs_tcp_ses_lock) { ++ set_need_reco(server); ++ list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { ++ spin_lock(&ses->ses_lock); ++ if (ses->ses_status == SES_EXITING) { ++ spin_unlock(&ses->ses_lock); + continue; +- +- spin_lock(&ses->chans[i].server->srv_lock); +- if (ses->chans[i].server->tcpStatus != CifsExiting) +- ses->chans[i].server->tcpStatus = CifsNeedReconnect; +- spin_unlock(&ses->chans[i].server->srv_lock); ++ } ++ spin_lock(&ses->chan_lock); ++ for (i = 1; i < ses->chan_count; i++) { ++ nserver = ses->chans[i].server; ++ if (!nserver) ++ continue; ++ nserver->srv_count++; ++ list_add(&nserver->rlist, &reco); ++ } ++ spin_unlock(&ses->chan_lock); ++ spin_unlock(&ses->ses_lock); + } +- spin_unlock(&ses->chan_lock); + } +- spin_unlock(&cifs_tcp_ses_lock); ++ ++ list_for_each_entry_safe(server, nserver, &reco, rlist) { ++ list_del_init(&server->rlist); ++ set_need_reco(server); ++ cifs_put_tcp_session(server, 0); ++ } + } + + /* +-- +2.39.5 + diff --git a/queue-6.6/um-ubd-add-missing-error-check-in-start_io_thread.patch b/queue-6.6/um-ubd-add-missing-error-check-in-start_io_thread.patch new file mode 100644 index 0000000000..0d160691ad --- /dev/null +++ b/queue-6.6/um-ubd-add-missing-error-check-in-start_io_thread.patch @@ -0,0 +1,37 @@ +From ea1b1206e2d778db7d08047322ed12377728d5f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 6 Jun 2025 20:44:25 +0800 +Subject: um: ubd: Add missing error check in start_io_thread() + +From: Tiwei Bie <tiwei.btw@antgroup.com> + +[ Upstream commit c55c7a85e02a7bfee20a3ffebdff7cbeb41613ef ] + +The subsequent call to os_set_fd_block() overwrites the previous +return value. OR the two return values together to fix it. + +Fixes: f88f0bdfc32f ("um: UBD Improvements") +Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com> +Link: https://patch.msgid.link/20250606124428.148164-2-tiwei.btw@antgroup.com +Signed-off-by: Johannes Berg <johannes.berg@intel.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/um/drivers/ubd_user.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/um/drivers/ubd_user.c b/arch/um/drivers/ubd_user.c +index a1afe414ce481..fb5b1e7c133d8 100644 +--- a/arch/um/drivers/ubd_user.c ++++ b/arch/um/drivers/ubd_user.c +@@ -41,7 +41,7 @@ int start_io_thread(unsigned long sp, int *fd_out) + *fd_out = fds[1]; + + err = os_set_fd_block(*fd_out, 0); +- err = os_set_fd_block(kernel_fd, 0); ++ err |= os_set_fd_block(kernel_fd, 0); + if (err) { + printk("start_io_thread - failed to set nonblocking I/O.\n"); + goto out_close; +-- +2.39.5 + diff --git a/queue-6.6/vsock-uapi-fix-linux-vm_sockets.h-userspace-compilat.patch b/queue-6.6/vsock-uapi-fix-linux-vm_sockets.h-userspace-compilat.patch new file mode 100644 index 0000000000..fbd45a73a6 --- /dev/null +++ b/queue-6.6/vsock-uapi-fix-linux-vm_sockets.h-userspace-compilat.patch @@ -0,0 +1,54 @@ +From ff5afd7b32dbad3fe212d05c290eb18388a217fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 23 Jun 2025 12:00:53 +0200 +Subject: vsock/uapi: fix linux/vm_sockets.h userspace compilation errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefano Garzarella <sgarzare@redhat.com> + +[ Upstream commit 22bbc1dcd0d6785fb390c41f0dd5b5e218d23bdd ] + +If a userspace application just include <linux/vm_sockets.h> will fail +to build with the following errors: + + /usr/include/linux/vm_sockets.h:182:39: error: invalid application of ‘sizeof’ to incomplete type ‘struct sockaddr’ + 182 | unsigned char svm_zero[sizeof(struct sockaddr) - + | ^~~~~~ + /usr/include/linux/vm_sockets.h:183:39: error: ‘sa_family_t’ undeclared here (not in a function) + 183 | sizeof(sa_family_t) - + | + +Include <sys/socket.h> for userspace (guarded by ifndef __KERNEL__) +where `struct sockaddr` and `sa_family_t` are defined. +We already do something similar in <linux/mptcp.h> and <linux/if.h>. + +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Reported-by: Daan De Meyer <daan.j.demeyer@gmail.com> +Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> +Link: https://patch.msgid.link/20250623100053.40979-1-sgarzare@redhat.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + include/uapi/linux/vm_sockets.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/uapi/linux/vm_sockets.h b/include/uapi/linux/vm_sockets.h +index ed07181d4eff9..e05280e415228 100644 +--- a/include/uapi/linux/vm_sockets.h ++++ b/include/uapi/linux/vm_sockets.h +@@ -17,6 +17,10 @@ + #ifndef _UAPI_VM_SOCKETS_H + #define _UAPI_VM_SOCKETS_H + ++#ifndef __KERNEL__ ++#include <sys/socket.h> /* for struct sockaddr and sa_family_t */ ++#endif ++ + #include <linux/socket.h> + #include <linux/types.h> + +-- +2.39.5 + diff --git a/queue-6.6/wifi-mac80211-fix-beacon-interval-calculation-overfl.patch b/queue-6.6/wifi-mac80211-fix-beacon-interval-calculation-overfl.patch new file mode 100644 index 0000000000..1146fe0189 --- /dev/null +++ b/queue-6.6/wifi-mac80211-fix-beacon-interval-calculation-overfl.patch @@ -0,0 +1,38 @@ +From e8289a1d6f9cc549eb1801627f249323d695fd9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sat, 21 Jun 2025 22:32:09 +1000 +Subject: wifi: mac80211: fix beacon interval calculation overflow + +From: Lachlan Hodges <lachlan.hodges@morsemicro.com> + +[ Upstream commit 7a3750ff0f2e8fee338a9c168f429f6c37f0e820 ] + +As we are converting from TU to usecs, a beacon interval of +100*1024 usecs will lead to integer wrapping. To fix change +to use a u32. + +Fixes: 057d5f4ba1e4 ("mac80211: sync dtim_count to TSF") +Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> +Link: https://patch.msgid.link/20250621123209.511796-1-lachlan.hodges@morsemicro.com +Signed-off-by: Johannes Berg <johannes.berg@intel.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/mac80211/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 154b41af4157d..3a3cd09bdab65 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -4753,7 +4753,7 @@ void ieee80211_recalc_dtim(struct ieee80211_local *local, + { + u64 tsf = drv_get_tsf(local, sdata); + u64 dtim_count = 0; +- u16 beacon_int = sdata->vif.bss_conf.beacon_int * 1024; ++ u32 beacon_int = sdata->vif.bss_conf.beacon_int * 1024; + u8 dtim_period = sdata->vif.bss_conf.dtim_period; + struct ps_data *ps; + u8 bcns_from_dtim; +-- +2.39.5 + |