diff --git a/debian/bin/genpatch-pf b/debian/bin/genpatch-pf index 35aa909..36f1e52 100755 --- a/debian/bin/genpatch-pf +++ b/debian/bin/genpatch-pf @@ -7,7 +7,7 @@ w=$(git rev-parse --path-format=absolute --show-toplevel) ; : "${w:?}" ; cd "$w" dst='debian/patches/tmp-pf' src='../linux-extras' -branches='fixes archlinux cpuidle exfat kbuild nfs smb xfs' +branches='archlinux bbr3 cpuidle kbuild steady' if [ -d "${dst}" ] ; then rm -rf "${dst}" ; fi mkdir -p "${dst}" diff --git a/debian/bin/genpatch-zen b/debian/bin/genpatch-zen index a961d83..2b1edb3 100755 --- a/debian/bin/genpatch-zen +++ b/debian/bin/genpatch-zen @@ -7,7 +7,7 @@ w=$(git rev-parse --path-format=absolute --show-toplevel) ; : "${w:?}" ; cd "$w" dst='debian/patches/tmp-zen' src='../linux-extras' -branches='zen-sauce fixes' +branches='bbr3 fixes zen-sauce' if [ -d "${dst}" ] ; then rm -rf "${dst}" ; fi mkdir -p "${dst}" diff --git a/debian/changelog b/debian/changelog index f37dc3e..08c9f4a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,71 +1,9 @@ -linux (6.15.11-1) sid; urgency=medium +linux (6.16.3-1) sid; urgency=medium * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.11 + https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.1 + https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.2 + https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.3 + * New upstream release: https://kernelnewbies.org/Linux_6.16 - -- Konstantin Demin Wed, 20 Aug 2025 21:45:46 +0300 - -linux (6.15.10-1) sid; urgency=medium - - * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.10 - - -- Konstantin Demin Fri, 15 Aug 2025 15:43:04 +0300 - -linux (6.15.9-1) sid; urgency=medium - - * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.9 - - -- Konstantin Demin Fri, 01 Aug 2025 16:49:13 +0300 - -linux (6.15.8-1) sid; urgency=medium - - * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.8 - - -- Konstantin Demin Sat, 26 Jul 2025 12:31:39 +0300 - -linux (6.15.7-1) sid; urgency=medium - - * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.7 - - -- Konstantin Demin Thu, 17 Jul 2025 22:21:12 +0300 - -linux (6.15.6-1) sid; urgency=medium - - * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.6 - - -- Konstantin Demin Thu, 10 Jul 2025 19:38:23 +0300 - -linux (6.15.5-1) sid; urgency=medium - - * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.5 - - -- Konstantin Demin Mon, 07 Jul 2025 01:40:22 +0300 - -linux (6.15.4-1) sid; urgency=medium - - * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.4 - - -- Konstantin Demin Fri, 27 Jun 2025 14:05:47 +0300 - -linux (6.15.3-1) sid; urgency=medium - - * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.3 - - -- Konstantin Demin Thu, 19 Jun 2025 17:46:46 +0300 - -linux (6.15.2-1) sid; urgency=medium - - * New upstream stable update: - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.1 - https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.2 - * New upstream release: https://kernelnewbies.org/Linux_6.15 - - -- Konstantin Demin Tue, 17 Jun 2025 12:18:45 +0300 + -- Konstantin Demin Sun, 24 Aug 2025 20:54:35 +0300 diff --git a/debian/config/amd64/config.cloud b/debian/config/amd64/config.cloud index 627f486..2dce645 100644 --- a/debian/config/amd64/config.cloud +++ b/debian/config/amd64/config.cloud @@ -91,6 +91,7 @@ CONFIG_IO_DELAY_NONE=y ## ## file: crypto/Kconfig ## +# CONFIG_CRYPTO_BENCHMARK is not set CONFIG_CRYPTO_ECDH=m CONFIG_CRYPTO_DEFLATE=m CONFIG_CRYPTO_842=m @@ -201,6 +202,7 @@ CONFIG_SATA_MOBILE_LPM_POLICY=0 ## file: drivers/block/Kconfig ## # CONFIG_ATA_OVER_ETH is not set +# CONFIG_BLK_DEV_ZONED_LOOP is not set ## ## file: drivers/block/mtip32xx/Kconfig @@ -295,6 +297,7 @@ CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y # CONFIG_CRYPTO_DEV_QAT_C62X is not set # CONFIG_CRYPTO_DEV_QAT_4XXX is not set # CONFIG_CRYPTO_DEV_QAT_420XX is not set +# CONFIG_CRYPTO_DEV_QAT_6XXX is not set # CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set @@ -474,7 +477,6 @@ CONFIG_HWMON=m # CONFIG_SENSORS_NCT6683 is not set # CONFIG_SENSORS_NCT6775 is not set # CONFIG_SENSORS_NPCM7XX is not set -# CONFIG_SENSORS_OXP is not set # CONFIG_SENSORS_SIS5595 is not set # CONFIG_SENSORS_SMSC47M1 is not set # CONFIG_SENSORS_SMSC47B397 is not set @@ -826,6 +828,7 @@ CONFIG_FUSION_FC=m ## ## file: drivers/net/Kconfig ## +# CONFIG_OVPN is not set # CONFIG_FUJITSU_ES is not set ## @@ -1223,6 +1226,7 @@ CONFIG_FBNIC=m ## ## file: drivers/net/phy/Kconfig ## +# CONFIG_AS21XXX_PHY is not set # CONFIG_AIR_EN8811H_PHY is not set # CONFIG_AMD_PHY is not set # CONFIG_ADIN_PHY is not set @@ -1245,6 +1249,7 @@ CONFIG_FBNIC=m # CONFIG_MARVELL_88Q2XXX_PHY is not set # CONFIG_MARVELL_88X2222_PHY is not set # CONFIG_MAXLINEAR_GPHY is not set +# CONFIG_MAXLINEAR_86110_PHY is not set # CONFIG_MICREL_PHY is not set # CONFIG_MICROCHIP_T1S_PHY is not set # CONFIG_MICROCHIP_PHY is not set @@ -1389,7 +1394,7 @@ CONFIG_PCIEASPM_DEFAULT=y ## ## file: drivers/pci/pwrctrl/Kconfig ## -# CONFIG_PCI_PWRCTL_SLOT is not set +# CONFIG_PCI_PWRCTRL_SLOT is not set ## ## file: drivers/pci/switch/Kconfig @@ -1762,6 +1767,7 @@ CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y # CONFIG_IBMASR is not set # CONFIG_WAFER_WDT is not set # CONFIG_IE6XX_WDT is not set +# CONFIG_INTEL_OC_WATCHDOG is not set # CONFIG_IT8712F_WDT is not set # CONFIG_IT87_WDT is not set # CONFIG_HP_WATCHDOG is not set @@ -1832,6 +1838,11 @@ CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y ## # CONFIG_EFS_FS is not set +## +## file: fs/erofs/Kconfig +## +# CONFIG_EROFS_FS_ZIP_ACCEL is not set + ## ## file: fs/f2fs/Kconfig ## @@ -1967,6 +1978,11 @@ CONFIG_PROC_VMCORE=y ## # CONFIG_CIFS is not set +## +## file: fs/squashfs/Kconfig +## +# CONFIG_SQUASHFS_COMP_CACHE_FULL is not set + ## ## file: fs/ufs/Kconfig ## @@ -1996,6 +2012,7 @@ CONFIG_KEXEC_SIG=y CONFIG_KEXEC_BZIMAGE_VERIFY_SIG=y CONFIG_KEXEC_JUMP=y CONFIG_CRASH_DUMP=y +# CONFIG_CRASH_DM_CRYPT is not set CONFIG_CRASH_HOTPLUG=y CONFIG_CRASH_MAX_MEMORY_RANGES=8192 @@ -2340,10 +2357,7 @@ CONFIG_CRYPTO_LIB_AESCFB=m CONFIG_CRYPTO_LIB_CHACHA=m CONFIG_CRYPTO_LIB_CHACHA20POLY1305=m CONFIG_CRYPTO_LIB_CHACHA_GENERIC=m -CONFIG_CRYPTO_LIB_CHACHA_INTERNAL=m CONFIG_CRYPTO_LIB_POLY1305=m -CONFIG_CRYPTO_LIB_POLY1305_GENERIC=m -CONFIG_CRYPTO_LIB_POLY1305_INTERNAL=m CONFIG_CRYPTO_POLY1305_X86_64=m CONFIG_CXL_PORT=y CONFIG_INFINIBAND_ADDR_TRANS_CONFIGFS=y @@ -2364,6 +2378,7 @@ CONFIG_ND_BTT=m CONFIG_ND_PFN=m CONFIG_NETFS_SUPPORT=m # CONFIG_NVMEM_LAYOUTS is not set +CONFIG_PLDMFW=y CONFIG_PREEMPT_NONE_BUILD=y CONFIG_RATIONAL=m CONFIG_SCSI_COMMON=m diff --git a/debian/config/amd64/config.mobile b/debian/config/amd64/config.mobile index 3aa423a..8ad0f93 100644 --- a/debian/config/amd64/config.mobile +++ b/debian/config/amd64/config.mobile @@ -107,6 +107,7 @@ CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE=y ## ## file: crypto/Kconfig ## +CONFIG_CRYPTO_BENCHMARK=m CONFIG_CRYPTO_ECDH=y CONFIG_CRYPTO_DEFLATE=y CONFIG_CRYPTO_842=y @@ -320,6 +321,7 @@ CONFIG_BCMA_DRIVER_GPIO=y ## file: drivers/block/Kconfig ## CONFIG_ATA_OVER_ETH=m +CONFIG_BLK_DEV_ZONED_LOOP=m ## ## file: drivers/block/mtip32xx/Kconfig @@ -332,7 +334,6 @@ CONFIG_BLK_DEV_PCIESSD_MTIP32XX=m CONFIG_BT_HCIBTUSB=m CONFIG_BT_HCIBTUSB_AUTOSUSPEND=y CONFIG_BT_HCIBTUSB_POLL_SYNC=y -CONFIG_BT_HCIBTUSB_AUTO_ISOC_ALT=y CONFIG_BT_HCIBTUSB_BCM=y CONFIG_BT_HCIBTUSB_MTK=y CONFIG_BT_HCIBTUSB_RTL=y @@ -545,6 +546,7 @@ CONFIG_CRYPTO_DEV_QAT_C3XXX=m CONFIG_CRYPTO_DEV_QAT_C62X=m CONFIG_CRYPTO_DEV_QAT_4XXX=m CONFIG_CRYPTO_DEV_QAT_420XX=m +CONFIG_CRYPTO_DEV_QAT_6XXX=m CONFIG_CRYPTO_DEV_QAT_DH895xCCVF=m CONFIG_CRYPTO_DEV_QAT_C3XXXVF=m CONFIG_CRYPTO_DEV_QAT_C62XVF=m @@ -556,6 +558,7 @@ CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION=y CONFIG_CXL_BUS=m CONFIG_CXL_MEM_RAW_COMMANDS=y CONFIG_CXL_FEATURES=y +# CONFIG_CXL_EDAC_MEM_FEATURES is not set ## ## file: drivers/devfreq/Kconfig @@ -711,6 +714,14 @@ CONFIG_GOOGLE_MEMCONSOLE_X86_LEGACY=m CONFIG_GOOGLE_FRAMEBUFFER_COREBOOT=y # CONFIG_GOOGLE_VPD is not set +## +## file: drivers/firmware/qcom/Kconfig +## +## choice: TrustZone interface memory allocator mode +CONFIG_QCOM_TZMEM_MODE_GENERIC=y +# CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE is not set +## end choice + ## ## file: drivers/fsi/Kconfig ## @@ -809,6 +820,7 @@ CONFIG_GPIO_LP87565=m CONFIG_GPIO_MADERA=m CONFIG_GPIO_MAX77620=m CONFIG_GPIO_MAX77650=m +CONFIG_GPIO_MAX77759=m CONFIG_GPIO_PALMAS=y CONFIG_GPIO_RC5T583=y CONFIG_GPIO_STMPE=y @@ -855,14 +867,18 @@ CONFIG_GPIO_VIRTUSER=m ## file: drivers/gpu/drm/Kconfig ## CONFIG_DRM=y -# CONFIG_DRM_DEBUG_MM is not set # CONFIG_DRM_PANIC is not set # CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set # CONFIG_DRM_DEBUG_MODESET_LOCK is not set CONFIG_DRM_LOAD_EDID_FIRMWARE=y CONFIG_DRM_VGEM=m CONFIG_DRM_HYPERV=m + +## +## file: drivers/gpu/drm/Kconfig.debug +## # CONFIG_DRM_WERROR is not set +# CONFIG_DRM_DEBUG_MM is not set ## ## file: drivers/gpu/drm/amd/acp/Kconfig @@ -1072,6 +1088,7 @@ CONFIG_DRM_PANEL_ASUS_Z00T_TM5P5_NT35596=m CONFIG_DRM_PANEL_AUO_A030JTN01=m CONFIG_DRM_PANEL_BOE_BF060Y8M_AJ0=m CONFIG_DRM_PANEL_BOE_HIMAX8279D=m +CONFIG_DRM_PANEL_BOE_TD4320=m CONFIG_DRM_PANEL_BOE_TH101MB31UIG002_28A=m CONFIG_DRM_PANEL_BOE_TV101WUM_NL6=m CONFIG_DRM_PANEL_BOE_TV101WUM_LL2=m @@ -1081,6 +1098,7 @@ CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02=m CONFIG_DRM_PANEL_FEIYANG_FY07024DI26A30D=m CONFIG_DRM_PANEL_DSI_CM=m CONFIG_DRM_PANEL_LVDS=m +CONFIG_DRM_PANEL_HIMAX_HX8279=m CONFIG_DRM_PANEL_HIMAX_HX83102=m CONFIG_DRM_PANEL_HIMAX_HX83112A=m CONFIG_DRM_PANEL_HIMAX_HX8394=m @@ -1115,6 +1133,7 @@ CONFIG_DRM_PANEL_NOVATEK_NT35950=m CONFIG_DRM_PANEL_NOVATEK_NT36523=m CONFIG_DRM_PANEL_NOVATEK_NT36672A=m CONFIG_DRM_PANEL_NOVATEK_NT36672E=m +CONFIG_DRM_PANEL_NOVATEK_NT37801=m CONFIG_DRM_PANEL_NOVATEK_NT39016=m CONFIG_DRM_PANEL_OLIMEX_LCD_OLINUXINO=m CONFIG_DRM_PANEL_ORISETECH_OTA5601A=m @@ -1168,6 +1187,7 @@ CONFIG_DRM_PANEL_TPO_TD028TTEC1=m CONFIG_DRM_PANEL_TPO_TD043MTEA1=m CONFIG_DRM_PANEL_TPO_TPG110=m # CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA is not set +CONFIG_DRM_PANEL_VISIONOX_G2647FB105=m CONFIG_DRM_PANEL_VISIONOX_R66451=m # CONFIG_DRM_PANEL_VISIONOX_RM69299 is not set CONFIG_DRM_PANEL_VISIONOX_RM692E5=m @@ -1186,6 +1206,13 @@ CONFIG_DRM_QXL=m CONFIG_DRM_RADEON=m CONFIG_DRM_RADEON_USERPTR=y +## +## file: drivers/gpu/drm/sitronix/Kconfig +## +CONFIG_DRM_ST7571_I2C=m +CONFIG_DRM_ST7586=m +CONFIG_DRM_ST7735R=m + ## ## file: drivers/gpu/drm/solomon/Kconfig ## @@ -1193,6 +1220,13 @@ CONFIG_DRM_SSD130X=m CONFIG_DRM_SSD130X_I2C=m CONFIG_DRM_SSD130X_SPI=m +## +## file: drivers/gpu/drm/sysfb/Kconfig +## +CONFIG_DRM_EFIDRM=m +# CONFIG_DRM_SIMPLEDRM is not set +CONFIG_DRM_VESADRM=m + ## ## file: drivers/gpu/drm/tiny/Kconfig ## @@ -1202,7 +1236,6 @@ CONFIG_DRM_BOCHS=m CONFIG_DRM_CIRRUS_QEMU=m CONFIG_DRM_GM12U320=m CONFIG_DRM_PANEL_MIPI_DBI=m -# CONFIG_DRM_SIMPLEDRM is not set CONFIG_TINYDRM_HX8357D=m CONFIG_TINYDRM_ILI9163=m CONFIG_TINYDRM_ILI9225=m @@ -1211,8 +1244,6 @@ CONFIG_TINYDRM_ILI9486=m CONFIG_TINYDRM_MI0283QT=m CONFIG_TINYDRM_REPAPER=m CONFIG_TINYDRM_SHARP_MEMORY=m -CONFIG_TINYDRM_ST7586=m -CONFIG_TINYDRM_ST7735R=m ## ## file: drivers/gpu/drm/udl/Kconfig @@ -1247,6 +1278,7 @@ CONFIG_DRM_VMWGFX=m CONFIG_DRM_XE=m CONFIG_DRM_XE_DISPLAY=y CONFIG_DRM_XE_DP_TUNNEL=y +CONFIG_DRM_XE_GPUSVM=y CONFIG_DRM_XE_DEVMEM_MIRROR=y CONFIG_DRM_XE_FORCE_PROBE="" @@ -1528,6 +1560,8 @@ CONFIG_SENSORS_ASUS_ROG_RYUJIN=m CONFIG_SENSORS_AXI_FAN_CONTROL=m CONFIG_SENSORS_K8TEMP=m CONFIG_SENSORS_K10TEMP=m +CONFIG_SENSORS_KBATT=m +CONFIG_SENSORS_KFAN=m CONFIG_SENSORS_FAM15H_POWER=m CONFIG_SENSORS_APPLESMC=m CONFIG_SENSORS_ASB100=m @@ -1601,6 +1635,7 @@ CONFIG_SENSORS_MAX6639=m CONFIG_SENSORS_MAX6650=m CONFIG_SENSORS_MAX6697=m CONFIG_SENSORS_MAX31790=m +CONFIG_SENSORS_MAX77705=m CONFIG_SENSORS_MC34VR500=m CONFIG_SENSORS_MCP3021=m CONFIG_SENSORS_TC654=m @@ -1636,13 +1671,11 @@ CONFIG_SENSORS_NPCM7XX=m CONFIG_SENSORS_NZXT_KRAKEN2=m CONFIG_SENSORS_NZXT_KRAKEN3=m CONFIG_SENSORS_NZXT_SMART2=m -CONFIG_SENSORS_OXP=m CONFIG_SENSORS_PCF8591=m CONFIG_SENSORS_PT5161L=m CONFIG_SENSORS_PWM_FAN=m CONFIG_SENSORS_QNAP_MCU_HWMON=m CONFIG_SENSORS_SBTSI=m -CONFIG_SENSORS_SBRMI=m CONFIG_SENSORS_SHT15=m CONFIG_SENSORS_SHT21=m CONFIG_SENSORS_SHT3x=m @@ -1742,6 +1775,8 @@ CONFIG_SENSORS_IRPS5401=m CONFIG_SENSORS_ISL68137=m CONFIG_SENSORS_LM25066=m CONFIG_SENSORS_LM25066_REGULATOR=y +CONFIG_SENSORS_LT3074=m +CONFIG_SENSORS_LT3074_REGULATOR=m CONFIG_SENSORS_LT7182S=m CONFIG_SENSORS_LTC2978=m CONFIG_SENSORS_LTC2978_REGULATOR=y @@ -1856,6 +1891,7 @@ CONFIG_I2C_CGBC=m CONFIG_I2C_DESIGNWARE_CORE=y CONFIG_I2C_DESIGNWARE_SLAVE=y CONFIG_I2C_DESIGNWARE_PLATFORM=y +CONFIG_I2C_DESIGNWARE_AMDISP=m CONFIG_I2C_DESIGNWARE_BAYTRAIL=y CONFIG_I2C_DESIGNWARE_PCI=m CONFIG_I2C_EMEV2=m @@ -2414,6 +2450,7 @@ CONFIG_LEDS_RT4505=m CONFIG_LEDS_RT8515=m CONFIG_LEDS_SGM3140=m CONFIG_LEDS_SY7802=m +CONFIG_LEDS_TPS6131X=m ## ## file: drivers/leds/rgb/Kconfig @@ -2907,6 +2944,7 @@ CONFIG_MFD_MAX77686=m CONFIG_MFD_MAX77693=m CONFIG_MFD_MAX77705=m CONFIG_MFD_MAX77714=m +CONFIG_MFD_MAX77759=m CONFIG_MFD_MAX77843=y CONFIG_MFD_MAX8907=m CONFIG_MFD_MAX8925=y @@ -2931,7 +2969,7 @@ CONFIG_MFD_RC5T583=y CONFIG_MFD_RK8XX_I2C=m CONFIG_MFD_RK8XX_SPI=m CONFIG_MFD_RN5T618=m -CONFIG_MFD_SEC_CORE=m +CONFIG_MFD_SEC_I2C=m CONFIG_MFD_SI476X_CORE=m CONFIG_MFD_SM501=m CONFIG_MFD_SM501_GPIO=y @@ -3009,6 +3047,7 @@ CONFIG_AD525X_DPOT_SPI=m CONFIG_IBM_ASM=m CONFIG_PHANTOM=m CONFIG_RPMB=m +CONFIG_TI_FPC202=m CONFIG_TIFM_CORE=m CONFIG_TIFM_7XX1=m CONFIG_ICS932S401=m @@ -3042,6 +3081,12 @@ CONFIG_MCHP_LAN966X_PCI=m ## CONFIG_ALTERA_STAPL=m +## +## file: drivers/misc/amd-sbi/Kconfig +## +CONFIG_AMD_SBRMI_I2C=m +CONFIG_AMD_SBRMI_HWMON=y + ## ## file: drivers/misc/bcm-vk/Kconfig ## @@ -3348,6 +3393,7 @@ CONFIG_MUX_MMIO=m ## ## file: drivers/net/Kconfig ## +CONFIG_OVPN=m CONFIG_NTB_NETDEV=m CONFIG_RIONET=m CONFIG_RIONET_TX_SIZE=128 @@ -3709,6 +3755,11 @@ CONFIG_NET_VENDOR_HUAWEI=y ## CONFIG_HINIC=m +## +## file: drivers/net/ethernet/huawei/hinic3/Kconfig +## +CONFIG_HINIC3=m + ## ## file: drivers/net/ethernet/i825xx/Kconfig ## @@ -4170,6 +4221,7 @@ CONFIG_PCS_XPCS=m ## CONFIG_LED_TRIGGER_PHY=y CONFIG_SFP=m +CONFIG_AS21XXX_PHY=m CONFIG_AIR_EN8811H_PHY=m CONFIG_AMD_PHY=m CONFIG_ADIN_PHY=m @@ -4192,6 +4244,7 @@ CONFIG_MARVELL_10G_PHY=m CONFIG_MARVELL_88Q2XXX_PHY=m CONFIG_MARVELL_88X2222_PHY=m CONFIG_MAXLINEAR_GPHY=m +CONFIG_MAXLINEAR_86110_PHY=m CONFIG_MICREL_PHY=m CONFIG_MICROCHIP_T1S_PHY=m CONFIG_MICROCHIP_PHY=m @@ -4415,6 +4468,7 @@ CONFIG_ATH11K_SPECTRAL=y ## file: drivers/net/wireless/ath/ath12k/Kconfig ## CONFIG_ATH12K=m +CONFIG_ATH12K_AHB=y CONFIG_ATH12K_DEBUG=y CONFIG_ATH12K_DEBUGFS=y # CONFIG_ATH12K_TRACING is not set @@ -5020,6 +5074,7 @@ CONFIG_NVME_HWMON=y ## ## file: drivers/nvmem/Kconfig ## +CONFIG_NVMEM_MAX77759=m CONFIG_NVMEM_RAVE_SP_EEPROM=m CONFIG_NVMEM_SPMI_SDAM=m CONFIG_NVMEM_U_BOOT_ENV=m @@ -5103,7 +5158,7 @@ CONFIG_PCIEASPM_POWERSAVE=y ## ## file: drivers/pci/pwrctrl/Kconfig ## -CONFIG_PCI_PWRCTL_SLOT=m +CONFIG_PCI_PWRCTRL_SLOT=m ## ## file: drivers/pci/switch/Kconfig @@ -5300,6 +5355,7 @@ CONFIG_MSI_LAPTOP=m CONFIG_MSI_WMI=m CONFIG_MSI_WMI_PLATFORM=m CONFIG_PCENGINES_APU2=m +CONFIG_PORTWELL_EC=m CONFIG_BARCO_P50_GPIO=m CONFIG_SAMSUNG_GALAXYBOOK=m CONFIG_SAMSUNG_LAPTOP=m @@ -5318,6 +5374,7 @@ CONFIG_TOPSTAR_LAPTOP=m CONFIG_SERIAL_MULTI_INSTANTIATE=m CONFIG_INSPUR_PLATFORM_PROFILE=m CONFIG_LENOVO_WMI_CAMERA=m +CONFIG_DASHARO_ACPI=m CONFIG_INTEL_IPS=m CONFIG_INTEL_SCU_PCI=y CONFIG_INTEL_SCU_PLATFORM=m @@ -5325,12 +5382,14 @@ CONFIG_INTEL_SCU_IPC_UTIL=m CONFIG_SILICOM_PLATFORM=m CONFIG_WINMATE_FM07_KEYS=m CONFIG_SEL3350_PLATFORM=m +CONFIG_OXP_EC=m ## ## file: drivers/platform/x86/amd/Kconfig ## CONFIG_AMD_3D_VCACHE=m CONFIG_AMD_WBRF=y +CONFIG_AMD_ISP_PLATFORM=m ## ## file: drivers/platform/x86/amd/hsmp/Kconfig @@ -5466,6 +5525,11 @@ CONFIG_SIEMENS_SIMATIC_IPC_BATT_APOLLOLAKE=m CONFIG_SIEMENS_SIMATIC_IPC_BATT_ELKHARTLAKE=m CONFIG_SIEMENS_SIMATIC_IPC_BATT_F7188X=m +## +## file: drivers/platform/x86/tuxedo/nb04/Kconfig +## +CONFIG_TUXEDO_NB04_WMI_AB=m + ## ## file: drivers/platform/x86/x86-android-tablets/Kconfig ## @@ -5512,6 +5576,7 @@ CONFIG_TEST_POWER=m CONFIG_BATTERY_88PM860X=m CONFIG_CHARGER_ADP5061=m CONFIG_BATTERY_ACT8945A=m +CONFIG_BATTERY_CHAGALL=m CONFIG_BATTERY_CW2015=m CONFIG_BATTERY_DS2760=m CONFIG_BATTERY_DS2780=m @@ -5547,6 +5612,7 @@ CONFIG_CHARGER_MAX77650=m CONFIG_CHARGER_MAX77693=m CONFIG_CHARGER_MAX77705=m CONFIG_CHARGER_MAX77976=m +CONFIG_CHARGER_MAX8971=m CONFIG_CHARGER_MAX8997=m CONFIG_CHARGER_MAX8998=m CONFIG_CHARGER_MT6360=m @@ -5625,6 +5691,7 @@ CONFIG_PWM_IQS620A=m CONFIG_PWM_LP3943=m CONFIG_PWM_LPSS_PCI=m CONFIG_PWM_LPSS_PLATFORM=m +CONFIG_PWM_MC33XS2410=m CONFIG_PWM_NTXEC=m CONFIG_PWM_PCA9685=m CONFIG_PWM_STMPE=y @@ -5682,6 +5749,7 @@ CONFIG_REGULATOR_88PM886=m CONFIG_REGULATOR_ACT8865=m CONFIG_REGULATOR_ACT8945A=m CONFIG_REGULATOR_AD5398=m +CONFIG_REGULATOR_ADP5055=m CONFIG_REGULATOR_AAT2870=m CONFIG_REGULATOR_ARIZONA_LDO1=m CONFIG_REGULATOR_ARIZONA_MICSUPP=m @@ -6087,7 +6155,6 @@ CONFIG_SPI_OFFLOAD_TRIGGER_PWM=m ## file: drivers/spmi/Kconfig ## CONFIG_SPMI=m -CONFIG_SPMI_HISI3670=m ## ## file: drivers/ssb/Kconfig @@ -6506,13 +6573,9 @@ CONFIG_USB_RAW_GADGET=m CONFIG_USB_GR_UDC=m CONFIG_USB_R8A66597=m CONFIG_USB_PXA27X=m -CONFIG_USB_MV_UDC=m -CONFIG_USB_MV_U3D=m CONFIG_USB_SNP_UDC_PLAT=m CONFIG_USB_M66592=m CONFIG_USB_AMD5536UDC=m -CONFIG_USB_NET2272=m -# CONFIG_USB_NET2272_DMA is not set CONFIG_USB_NET2280=m CONFIG_USB_GOKU=m CONFIG_USB_EG20T=m @@ -6538,6 +6601,7 @@ CONFIG_USB_XHCI_HCD=m # CONFIG_USB_XHCI_DBGCAP is not set CONFIG_USB_XHCI_PCI_RENESAS=m CONFIG_USB_XHCI_PLATFORM=m +CONFIG_USB_XHCI_SIDEBAND=y CONFIG_USB_EHCI_HCD=m CONFIG_USB_EHCI_ROOT_HUB_TT=y CONFIG_USB_EHCI_TT_NEWSCHED=y @@ -6986,6 +7050,7 @@ CONFIG_IB700_WDT=m CONFIG_IBMASR=m CONFIG_WAFER_WDT=m CONFIG_IE6XX_WDT=m +CONFIG_INTEL_OC_WATCHDOG=m CONFIG_IT8712F_WDT=m CONFIG_IT87_WDT=m CONFIG_HP_WATCHDOG=m @@ -7088,6 +7153,11 @@ CONFIG_ECRYPT_FS_MESSAGING=y ## CONFIG_EFS_FS=m +## +## file: fs/erofs/Kconfig +## +CONFIG_EROFS_FS_ZIP_ACCEL=y + ## ## file: fs/f2fs/Kconfig ## @@ -7285,6 +7355,11 @@ CONFIG_CIFS_SWN_UPCALL=y CONFIG_CIFS_FSCACHE=y # CONFIG_CIFS_COMPRESSION is not set +## +## file: fs/squashfs/Kconfig +## +CONFIG_SQUASHFS_COMP_CACHE_FULL=y + ## ## file: fs/ubifs/Kconfig ## @@ -7324,6 +7399,7 @@ CONFIG_LOG_CPU_MAX_BUF_SHIFT=14 CONFIG_UCLAMP_TASK=y CONFIG_UCLAMP_BUCKETS_COUNT=10 CONFIG_RT_GROUP_SCHED=y +# CONFIG_RT_GROUP_SCHED_DEFAULT_DISABLED is not set CONFIG_UCLAMP_TASK_GROUP=y ## @@ -7769,6 +7845,7 @@ CONFIG_AF_RXRPC_IPV6=y # CONFIG_AF_RXRPC_INJECT_RX_DELAY is not set # CONFIG_AF_RXRPC_DEBUG is not set CONFIG_RXKAD=y +# CONFIG_RXGK is not set # CONFIG_RXPERF is not set ## @@ -8054,6 +8131,7 @@ CONFIG_SND_YMFPCI=m ## file: sound/pci/hda/Kconfig ## CONFIG_SND_HDA_INTEL=m +CONFIG_SND_HDA_ACPI=m CONFIG_SND_HDA_HWDEP=y CONFIG_SND_HDA_RECONFIG=y CONFIG_SND_HDA_INPUT_BEEP=y @@ -8088,6 +8166,7 @@ CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM=y ## file: sound/soc/Kconfig ## CONFIG_SND_SOC=m +CONFIG_SND_SOC_USB=m ## ## file: sound/soc/adi/Kconfig @@ -8209,6 +8288,7 @@ CONFIG_SND_SOC_CS42XX8_I2C=m CONFIG_SND_SOC_CS43130=m CONFIG_SND_SOC_CS4341=m CONFIG_SND_SOC_CS4349=m +CONFIG_SND_SOC_CS48L32=m CONFIG_SND_SOC_CS53L30=m CONFIG_SND_SOC_CS530X_I2C=m CONFIG_SND_SOC_CX2072X=m @@ -8222,6 +8302,8 @@ CONFIG_SND_SOC_ES8323=m CONFIG_SND_SOC_ES8326=m CONFIG_SND_SOC_ES8328_I2C=m CONFIG_SND_SOC_ES8328_SPI=m +CONFIG_SND_SOC_ES8375=m +CONFIG_SND_SOC_ES8389=m CONFIG_SND_SOC_FRAMER=m CONFIG_SND_SOC_GTM601=m CONFIG_SND_SOC_HDA=m @@ -8280,6 +8362,8 @@ CONFIG_SND_SOC_RT722_SDCA_SDW=m CONFIG_SND_SOC_RT715_SDW=m CONFIG_SND_SOC_RT715_SDCA_SDW=m CONFIG_SND_SOC_RT9120=m +CONFIG_SND_SOC_RT9123=m +CONFIG_SND_SOC_RT9123P=m CONFIG_SND_SOC_RTQ9128=m CONFIG_SND_SOC_SDW_MOCKUP=m CONFIG_SND_SOC_SGTL5000=m @@ -8357,6 +8441,7 @@ CONFIG_SND_SOC_WM8962=m CONFIG_SND_SOC_WM8974=m CONFIG_SND_SOC_WM8978=m CONFIG_SND_SOC_WM8985=m +CONFIG_SND_SOC_WM8998=m CONFIG_SND_SOC_WSA881X=m CONFIG_SND_SOC_WSA883X=m CONFIG_SND_SOC_WSA884X=m @@ -8444,6 +8529,7 @@ CONFIG_SND_SOC_INTEL_AVS=m ## ## file: sound/soc/intel/avs/boards/Kconfig ## +# CONFIG_SND_SOC_INTEL_AVS_CARDNAME_OBSOLETE is not set CONFIG_SND_SOC_INTEL_AVS_MACH_DA7219=m CONFIG_SND_SOC_INTEL_AVS_MACH_DMIC=m CONFIG_SND_SOC_INTEL_AVS_MACH_ES8336=m @@ -8581,6 +8667,7 @@ CONFIG_SND_USB_US122L=m CONFIG_SND_USB_6FIRE=m CONFIG_SND_USB_HIFACE=m CONFIG_SND_BCD2000=m +CONFIG_SND_USB_AUDIO_QMI=m ## ## file: sound/usb/line6/Kconfig @@ -8685,10 +8772,7 @@ CONFIG_CRYPTO_LIB_ARC4=m CONFIG_CRYPTO_LIB_CHACHA=y CONFIG_CRYPTO_LIB_CHACHA20POLY1305=y CONFIG_CRYPTO_LIB_CHACHA_GENERIC=y -CONFIG_CRYPTO_LIB_CHACHA_INTERNAL=y CONFIG_CRYPTO_LIB_POLY1305=y -CONFIG_CRYPTO_LIB_POLY1305_GENERIC=y -CONFIG_CRYPTO_LIB_POLY1305_INTERNAL=y CONFIG_CRYPTO_POLY1305_X86_64=y CONFIG_CXL_PORT=m CONFIG_DCA=m @@ -8735,6 +8819,7 @@ CONFIG_DRM_PANEL_BRIDGE=y CONFIG_DRM_PRIVACY_SCREEN=y CONFIG_DRM_SCHED=m CONFIG_DRM_SUBALLOC_HELPER=m +CONFIG_DRM_SYSFB_HELPER=m CONFIG_DRM_TTM=m CONFIG_DRM_TTM_HELPER=m CONFIG_DRM_VRAM_HELPER=m @@ -8779,6 +8864,7 @@ CONFIG_IGC_LEDS=y CONFIG_INTEL_ATOMISP2_PDX86=y CONFIG_INTEL_GTT=y CONFIG_INTEL_IDXD_BUS=m +CONFIG_INTEL_PMC_SSRAM_TELEMETRY=m CONFIG_INTEL_PMT_CLASS=m CONFIG_INTEL_SCU=y CONFIG_INTEL_SCU_IPC=y @@ -8831,6 +8917,7 @@ CONFIG_MFD_INTEL_LPSS=m CONFIG_MFD_INTEL_M10_BMC_CORE=m CONFIG_MFD_MC13XXX=m CONFIG_MFD_RK8XX=m +CONFIG_MFD_SEC_CORE=m CONFIG_MFD_SIMPLE_MFD_I2C=m CONFIG_MFD_TPS65912=m CONFIG_MFD_TPS6594=m @@ -8909,7 +8996,7 @@ CONFIG_PCIE_DW_PLAT=y CONFIG_PCIE_PLDA_HOST=y CONFIG_PCI_ECAM=y CONFIG_PCI_HOST_COMMON=y -CONFIG_PCI_PWRCTL=m +CONFIG_PCI_PWRCTRL=m CONFIG_PCS_LYNX=m CONFIG_PHYLIB_LEDS=y CONFIG_PINCTRL_CS47L15=y @@ -8936,10 +9023,13 @@ CONFIG_PREEMPT_COUNT=y CONFIG_PWM_DWC_CORE=m CONFIG_PWM_LPSS=m CONFIG_QCA7000=m +CONFIG_QCOM_MDT_LOADER=m CONFIG_QCOM_NET_PHYLIB=m CONFIG_QCOM_PDR_HELPERS=m CONFIG_QCOM_PDR_MSG=m CONFIG_QCOM_QMI_HELPERS=m +CONFIG_QCOM_SCM=m +CONFIG_QCOM_TZMEM=m CONFIG_QTNFMAC=m CONFIG_RAID6_PQ=m CONFIG_RATIONAL=y @@ -9035,7 +9125,6 @@ CONFIG_SND_HDA=m CONFIG_SND_HDA_CIRRUS_SCODEC=m CONFIG_SND_HDA_COMPONENT=y CONFIG_SND_HDA_CORE=m -CONFIG_SND_HDA_CS_DSP_CONTROLS=m CONFIG_SND_HDA_DSP_LOADER=y CONFIG_SND_HDA_EXT_CORE=m CONFIG_SND_HDA_GENERIC_LEDS=y @@ -9043,6 +9132,7 @@ CONFIG_SND_HDA_I915=y CONFIG_SND_HDA_SCODEC_COMPONENT=m CONFIG_SND_HDA_SCODEC_CS35L41=m CONFIG_SND_HDA_SCODEC_CS35L56=m +CONFIG_SND_HDA_SCODEC_TAS2781=m CONFIG_SND_HWDEP=m CONFIG_SND_INTEL_DSP_CONFIG=m CONFIG_SND_INTEL_NHLT=y @@ -9185,6 +9275,7 @@ CONFIG_SND_SOC_SOF_XTENSA=m CONFIG_SND_SOC_SRC4XXX=m CONFIG_SND_SOC_SSM2602=m CONFIG_SND_SOC_TAS2781_COMLIB=m +CONFIG_SND_SOC_TAS2781_COMLIB_I2C=m CONFIG_SND_SOC_TAS2781_FMWLIB=m CONFIG_SND_SOC_TLV320AIC23=m CONFIG_SND_SOC_TLV320AIC32X4=m diff --git a/debian/config/amd64/config.vm b/debian/config/amd64/config.vm index 6ea673d..da773d8 100644 --- a/debian/config/amd64/config.vm +++ b/debian/config/amd64/config.vm @@ -96,6 +96,7 @@ CONFIG_IO_DELAY_NONE=y ## ## file: crypto/Kconfig ## +CONFIG_CRYPTO_BENCHMARK=m CONFIG_CRYPTO_ECDH=m CONFIG_CRYPTO_DEFLATE=m CONFIG_CRYPTO_842=m @@ -216,6 +217,7 @@ CONFIG_SATA_MOBILE_LPM_POLICY=0 ## file: drivers/block/Kconfig ## # CONFIG_ATA_OVER_ETH is not set +CONFIG_BLK_DEV_ZONED_LOOP=m ## ## file: drivers/block/mtip32xx/Kconfig @@ -342,6 +344,7 @@ CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y # CONFIG_CRYPTO_DEV_QAT_C62X is not set # CONFIG_CRYPTO_DEV_QAT_4XXX is not set # CONFIG_CRYPTO_DEV_QAT_420XX is not set +# CONFIG_CRYPTO_DEV_QAT_6XXX is not set # CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set @@ -551,14 +554,18 @@ CONFIG_GPIO_SIM=m ## file: drivers/gpu/drm/Kconfig ## CONFIG_DRM=y -# CONFIG_DRM_DEBUG_MM is not set # CONFIG_DRM_PANIC is not set # CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set # CONFIG_DRM_DEBUG_MODESET_LOCK is not set CONFIG_DRM_LOAD_EDID_FIRMWARE=y CONFIG_DRM_VGEM=m CONFIG_DRM_HYPERV=m + +## +## file: drivers/gpu/drm/Kconfig.debug +## # CONFIG_DRM_WERROR is not set +# CONFIG_DRM_DEBUG_MM is not set ## ## file: drivers/gpu/drm/amd/amdgpu/Kconfig @@ -636,11 +643,23 @@ CONFIG_DRM_QXL=m ## # CONFIG_DRM_RADEON is not set +## +## file: drivers/gpu/drm/sitronix/Kconfig +## +# CONFIG_DRM_ST7571_I2C is not set + ## ## file: drivers/gpu/drm/solomon/Kconfig ## # CONFIG_DRM_SSD130X is not set +## +## file: drivers/gpu/drm/sysfb/Kconfig +## +CONFIG_DRM_EFIDRM=m +# CONFIG_DRM_SIMPLEDRM is not set +CONFIG_DRM_VESADRM=m + ## ## file: drivers/gpu/drm/tiny/Kconfig ## @@ -648,7 +667,6 @@ CONFIG_DRM_QXL=m CONFIG_DRM_BOCHS=m CONFIG_DRM_CIRRUS_QEMU=m # CONFIG_DRM_GM12U320 is not set -# CONFIG_DRM_SIMPLEDRM is not set ## ## file: drivers/gpu/drm/udl/Kconfig @@ -973,11 +991,9 @@ CONFIG_HWMON=y # CONFIG_SENSORS_NZXT_KRAKEN2 is not set # CONFIG_SENSORS_NZXT_KRAKEN3 is not set # CONFIG_SENSORS_NZXT_SMART2 is not set -# CONFIG_SENSORS_OXP is not set # CONFIG_SENSORS_PCF8591 is not set # CONFIG_SENSORS_PT5161L is not set # CONFIG_SENSORS_SBTSI is not set -# CONFIG_SENSORS_SBRMI is not set # CONFIG_SENSORS_SHT15 is not set # CONFIG_SENSORS_SHT21 is not set # CONFIG_SENSORS_SHT3x is not set @@ -1059,6 +1075,7 @@ CONFIG_SENSORS_PMBUS=m # CONFIG_SENSORS_IRPS5401 is not set # CONFIG_SENSORS_ISL68137 is not set # CONFIG_SENSORS_LM25066 is not set +# CONFIG_SENSORS_LT3074 is not set # CONFIG_SENSORS_LT7182S is not set # CONFIG_SENSORS_LTC2978 is not set # CONFIG_SENSORS_LTC3815 is not set @@ -1704,6 +1721,7 @@ CONFIG_MFD_INTEL_PMC_BXT=m # CONFIG_AD525X_DPOT is not set # CONFIG_IBM_ASM is not set # CONFIG_PHANTOM is not set +# CONFIG_TI_FPC202 is not set # CONFIG_TIFM_CORE is not set # CONFIG_ICS932S401 is not set # CONFIG_ENCLOSURE_SERVICES is not set @@ -1726,6 +1744,12 @@ CONFIG_NTSYNC=m ## # CONFIG_ALTERA_STAPL is not set +## +## file: drivers/misc/amd-sbi/Kconfig +## +CONFIG_AMD_SBRMI_I2C=m +CONFIG_AMD_SBRMI_HWMON=y + ## ## file: drivers/misc/bcm-vk/Kconfig ## @@ -1795,6 +1819,7 @@ CONFIG_EEPROM_AT24=m ## ## file: drivers/net/Kconfig ## +CONFIG_OVPN=m # CONFIG_FUJITSU_ES is not set ## @@ -2201,6 +2226,7 @@ CONFIG_MCTP_TRANSPORT_USB=m ## file: drivers/net/phy/Kconfig ## # CONFIG_SFP is not set +# CONFIG_AS21XXX_PHY is not set # CONFIG_AIR_EN8811H_PHY is not set # CONFIG_AMD_PHY is not set # CONFIG_ADIN_PHY is not set @@ -2223,6 +2249,7 @@ CONFIG_MCTP_TRANSPORT_USB=m # CONFIG_MARVELL_88Q2XXX_PHY is not set # CONFIG_MARVELL_88X2222_PHY is not set # CONFIG_MAXLINEAR_GPHY is not set +# CONFIG_MAXLINEAR_86110_PHY is not set # CONFIG_MICREL_PHY is not set # CONFIG_MICROCHIP_T1S_PHY is not set # CONFIG_MICROCHIP_PHY is not set @@ -2393,7 +2420,7 @@ CONFIG_PCIEASPM_DEFAULT=y ## ## file: drivers/pci/pwrctrl/Kconfig ## -# CONFIG_PCI_PWRCTL_SLOT is not set +CONFIG_PCI_PWRCTRL_SLOT=m ## ## file: drivers/pci/switch/Kconfig @@ -2471,6 +2498,7 @@ CONFIG_WMI_BMOF=m CONFIG_ACPI_QUICKSTART=m # CONFIG_MEEGOPAD_ANX7428 is not set CONFIG_MSI_WMI_PLATFORM=m +# CONFIG_PORTWELL_EC is not set # CONFIG_BARCO_P50_GPIO is not set # CONFIG_SAMSUNG_Q10 is not set # CONFIG_TOSHIBA_BT_RFKILL is not set @@ -2481,6 +2509,7 @@ CONFIG_MSI_WMI_PLATFORM=m CONFIG_SERIAL_MULTI_INSTANTIATE=m # CONFIG_INSPUR_PLATFORM_PROFILE is not set # CONFIG_LENOVO_WMI_CAMERA is not set +# CONFIG_DASHARO_ACPI is not set # CONFIG_INTEL_IPS is not set # CONFIG_INTEL_SCU_PCI is not set # CONFIG_INTEL_SCU_PLATFORM is not set @@ -2491,6 +2520,7 @@ CONFIG_SERIAL_MULTI_INSTANTIATE=m ## # CONFIG_AMD_3D_VCACHE is not set # CONFIG_AMD_WBRF is not set +CONFIG_AMD_ISP_PLATFORM=m ## ## file: drivers/platform/x86/amd/hsmp/Kconfig @@ -2561,6 +2591,11 @@ CONFIG_SERIAL_MULTI_INSTANTIATE=m ## # CONFIG_SIEMENS_SIMATIC_IPC is not set +## +## file: drivers/platform/x86/tuxedo/nb04/Kconfig +## +# CONFIG_TUXEDO_NB04_WMI_AB is not set + ## ## file: drivers/pnp/Kconfig ## @@ -2601,6 +2636,7 @@ CONFIG_CHARGER_GPIO=m # CONFIG_CHARGER_LT3651 is not set # CONFIG_CHARGER_LTC4162L is not set # CONFIG_CHARGER_MAX77976 is not set +# CONFIG_CHARGER_MAX8971 is not set # CONFIG_CHARGER_BQ2415X is not set # CONFIG_CHARGER_BQ24190 is not set # CONFIG_CHARGER_BQ24257 is not set @@ -2971,6 +3007,7 @@ CONFIG_USB_XHCI_HCD=m # CONFIG_USB_XHCI_DBGCAP is not set CONFIG_USB_XHCI_PCI_RENESAS=m CONFIG_USB_XHCI_PLATFORM=m +# CONFIG_USB_XHCI_SIDEBAND is not set CONFIG_USB_EHCI_HCD=m CONFIG_USB_EHCI_ROOT_HUB_TT=y CONFIG_USB_EHCI_TT_NEWSCHED=y @@ -3203,6 +3240,7 @@ CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y # CONFIG_IBMASR is not set # CONFIG_WAFER_WDT is not set # CONFIG_IE6XX_WDT is not set +# CONFIG_INTEL_OC_WATCHDOG is not set # CONFIG_IT8712F_WDT is not set # CONFIG_IT87_WDT is not set # CONFIG_HP_WATCHDOG is not set @@ -3285,6 +3323,11 @@ CONFIG_ECRYPT_FS_MESSAGING=y ## # CONFIG_EFS_FS is not set +## +## file: fs/erofs/Kconfig +## +CONFIG_EROFS_FS_ZIP_ACCEL=y + ## ## file: fs/f2fs/Kconfig ## @@ -3447,6 +3490,11 @@ CONFIG_CIFS_SWN_UPCALL=y CONFIG_CIFS_FSCACHE=y # CONFIG_CIFS_COMPRESSION is not set +## +## file: fs/squashfs/Kconfig +## +CONFIG_SQUASHFS_COMP_CACHE_FULL=y + ## ## file: fs/ufs/Kconfig ## @@ -3471,6 +3519,7 @@ CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 CONFIG_UCLAMP_TASK=y CONFIG_UCLAMP_BUCKETS_COUNT=10 CONFIG_RT_GROUP_SCHED=y +# CONFIG_RT_GROUP_SCHED_DEFAULT_DISABLED is not set CONFIG_UCLAMP_TASK_GROUP=y ## @@ -3763,6 +3812,7 @@ CONFIG_AF_RXRPC_IPV6=y # CONFIG_AF_RXRPC_INJECT_RX_DELAY is not set # CONFIG_AF_RXRPC_DEBUG is not set # CONFIG_RXKAD is not set +# CONFIG_RXGK is not set # CONFIG_RXPERF is not set ## @@ -3912,10 +3962,7 @@ CONFIG_CRYPTO_LIB_ARC4=m CONFIG_CRYPTO_LIB_CHACHA=m CONFIG_CRYPTO_LIB_CHACHA20POLY1305=m CONFIG_CRYPTO_LIB_CHACHA_GENERIC=m -CONFIG_CRYPTO_LIB_CHACHA_INTERNAL=m CONFIG_CRYPTO_LIB_POLY1305=m -CONFIG_CRYPTO_LIB_POLY1305_GENERIC=m -CONFIG_CRYPTO_LIB_POLY1305_INTERNAL=m CONFIG_CRYPTO_POLY1305_X86_64=m CONFIG_CXL_PORT=y CONFIG_DEV_SYNC_PROBE=m @@ -3930,6 +3977,7 @@ CONFIG_DRM_GEM_SHMEM_HELPER=m CONFIG_DRM_KMS_HELPER=m CONFIG_DRM_PANEL=y CONFIG_DRM_PANEL_BRIDGE=y +CONFIG_DRM_SYSFB_HELPER=m CONFIG_DRM_TTM=m CONFIG_DRM_TTM_HELPER=m CONFIG_DRM_VRAM_HELPER=m @@ -3964,6 +4012,8 @@ CONFIG_NETFS_SUPPORT=y CONFIG_NET_CLS=y CONFIG_NLS_UCS2_UTILS=m # CONFIG_NVMEM_LAYOUTS is not set +CONFIG_PCI_PWRCTRL=m +CONFIG_PLDMFW=y CONFIG_PM_CLK=y CONFIG_PM_OPP=y CONFIG_PM_SLEEP_DEBUG=y diff --git a/debian/config/config b/debian/config/config index 130309a..337e771 100644 --- a/debian/config/config +++ b/debian/config/config @@ -61,7 +61,6 @@ CONFIG_X86_VSYSCALL_EMULATION=y # CONFIG_MICROCODE_LATE_LOADING is not set CONFIG_X86_MSR=m CONFIG_X86_CPUID=m -# CONFIG_X86_5LEVEL is not set # CONFIG_X86_CPA_STATISTICS is not set CONFIG_AMD_MEM_ENCRYPT=y CONFIG_NUMA=y @@ -127,11 +126,9 @@ CONFIG_IA32_EMULATION=y ## ## file: arch/x86/Kconfig.cpu ## -## choice: x86_64 Compiler Build Optimization # CONFIG_X86_NATIVE_CPU is not set +## choice: x86_64 Compiler Build Optimization CONFIG_GENERIC_CPU=y -# CONFIG_MNATIVE_INTEL is not set -# CONFIG_MNATIVE_AMD is not set # CONFIG_MK8 is not set # CONFIG_MK8SSE3 is not set # CONFIG_MK10 is not set @@ -230,10 +227,8 @@ CONFIG_CRYPTO_ARIA_GFNI_AVX512_X86_64=m CONFIG_CRYPTO_AEGIS128_AESNI_SSE2=m CONFIG_CRYPTO_NHPOLY1305_SSE2=m CONFIG_CRYPTO_NHPOLY1305_AVX2=m -CONFIG_CRYPTO_BLAKE2S_X86=y CONFIG_CRYPTO_POLYVAL_CLMUL_NI=m CONFIG_CRYPTO_SHA1_SSSE3=m -CONFIG_CRYPTO_SHA256_SSSE3=m CONFIG_CRYPTO_SHA512_SSSE3=m CONFIG_CRYPTO_SM3_AVX_X86_64=m CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL=m @@ -265,6 +260,11 @@ CONFIG_KVM_HYPERV=y # CONFIG_KVM_PROVE_MMU is not set CONFIG_KVM_MAX_NR_VCPUS=1024 +## +## file: arch/x86/lib/crypto/Kconfig +## +CONFIG_CRYPTO_BLAKE2S_X86=y + ## ## file: arch/x86/xen/Kconfig ## @@ -325,15 +325,13 @@ CONFIG_SYSTEM_TRUSTED_KEYS="" ## file: crypto/Kconfig ## CONFIG_CRYPTO=y -CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_USER=m -CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y +# CONFIG_CRYPTO_SELFTESTS is not set CONFIG_CRYPTO_NULL=y CONFIG_CRYPTO_PCRYPT=m CONFIG_CRYPTO_CRYPTD=m CONFIG_CRYPTO_AUTHENC=m CONFIG_CRYPTO_KRB5ENC=m -CONFIG_CRYPTO_TEST=m CONFIG_CRYPTO_RSA=y CONFIG_CRYPTO_DH=y CONFIG_CRYPTO_DH_RFC7919_GROUPS=y @@ -376,7 +374,6 @@ CONFIG_CRYPTO_HMAC=y CONFIG_CRYPTO_MD4=m CONFIG_CRYPTO_MD5=y CONFIG_CRYPTO_MICHAEL_MIC=m -CONFIG_CRYPTO_POLY1305=m CONFIG_CRYPTO_RMD160=m CONFIG_CRYPTO_SHA1=y CONFIG_CRYPTO_SHA256=y @@ -628,6 +625,7 @@ CONFIG_TCG_TPM2_HMAC=y CONFIG_HW_RANDOM_TPM=y CONFIG_TCG_XEN=m CONFIG_TCG_VTPM_PROXY=m +CONFIG_TCG_SVSM=m ## ## file: drivers/comedi/Kconfig @@ -963,11 +961,6 @@ CONFIG_VMWARE_BALLOON=m # CONFIG_PCI_ENDPOINT_TEST is not set CONFIG_NSM=m -## -## file: drivers/misc/echo/Kconfig -## -# CONFIG_ECHO is not set - ## ## file: drivers/misc/genwqe/Kconfig ## @@ -1112,7 +1105,7 @@ CONFIG_HYPERV_NET=m ## ## file: drivers/net/mdio/Kconfig ## -CONFIG_MDIO_DEVICE=m +CONFIG_MDIO_BUS=m ## ## file: drivers/net/phy/Kconfig @@ -1734,6 +1727,9 @@ CONFIG_VIRTIO_INPUT=m CONFIG_VIRTIO_MMIO=m CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y # CONFIG_VIRTIO_DEBUG is not set +CONFIG_VIRTIO_RTC=m +CONFIG_VIRTIO_RTC_PTP=y +CONFIG_VIRTIO_RTC_CLASS=y ## ## file: drivers/watchdog/Kconfig @@ -2050,6 +2046,11 @@ CONFIG_QUOTA_NETLINK_INTERFACE=y # CONFIG_QFMT_V1 is not set CONFIG_QFMT_V2=m +## +## file: fs/resctrl/Kconfig +## +CONFIG_RESCTRL_FS=y + ## ## file: fs/smb/server/Kconfig ## @@ -2135,7 +2136,6 @@ CONFIG_SYSVIPC=y CONFIG_POSIX_MQUEUE=y CONFIG_WATCH_QUEUE=y CONFIG_CROSS_MEMORY_ATTACH=y -# CONFIG_USELIB is not set CONFIG_AUDIT=y ## choice: Cputime accounting CONFIG_VIRT_CPU_ACCOUNTING_GEN=y @@ -2181,6 +2181,7 @@ CONFIG_UTS_NS=y CONFIG_TIME_NS=y CONFIG_IPC_NS=y CONFIG_USER_NS=y +CONFIG_USER_NS_UNPRIVILEGED=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_CHECKPOINT_RESTORE=y @@ -2649,6 +2650,7 @@ CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y # CONFIG_READ_ONLY_THP_FOR_FS is not set # CONFIG_NO_PAGE_MAPCOUNT is not set # CONFIG_CMA is not set +CONFIG_PAGE_BLOCK_ORDER=10 CONFIG_MEM_SOFT_DIRTY=y CONFIG_DEFERRED_STRUCT_PAGE_INIT=y # CONFIG_IDLE_PAGE_TRACKING is not set @@ -2764,11 +2766,6 @@ CONFIG_CEPH_LIB=m ## # CONFIG_DCB is not set -## -## file: net/dccp/Kconfig -## -# CONFIG_IP_DCCP is not set - ## ## file: net/dns_resolver/Kconfig ## @@ -3193,6 +3190,7 @@ CONFIG_NET_SCH_FQ_CODEL=y CONFIG_NET_SCH_CAKE=m CONFIG_NET_SCH_PIE=y CONFIG_NET_SCH_FQ_PIE=y +CONFIG_NET_SCH_BPF=y CONFIG_NET_SCH_DEFAULT=y ## choice: Default queuing discipline # CONFIG_DEFAULT_FQ is not set @@ -3439,6 +3437,7 @@ CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y CONFIG_ACPI_LPIT=y CONFIG_ACPI_MADT_WAKEUP=y CONFIG_ACPI_MDIO=m +CONFIG_ACPI_MRRM=y CONFIG_ACPI_NUMA=y CONFIG_ACPI_PROCESSOR_CSTATE=y CONFIG_ACPI_PROCESSOR_IDLE=y @@ -3471,6 +3470,7 @@ CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION=y CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y CONFIG_ARCH_HAS_CPU_PASID=y CONFIG_ARCH_HAS_CPU_RELAX=y +CONFIG_ARCH_HAS_CPU_RESCTRL=y CONFIG_ARCH_HAS_CRC32=y CONFIG_ARCH_HAS_CRC64=y CONFIG_ARCH_HAS_CRC_T10DIF=y @@ -3542,6 +3542,7 @@ CONFIG_ARCH_SUPPORTS_INT128=y CONFIG_ARCH_SUPPORTS_KEXEC=y CONFIG_ARCH_SUPPORTS_KEXEC_BZIMAGE_VERIFY_SIG=y CONFIG_ARCH_SUPPORTS_KEXEC_FILE=y +CONFIG_ARCH_SUPPORTS_KEXEC_HANDOVER=y CONFIG_ARCH_SUPPORTS_KEXEC_JUMP=y CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY=y CONFIG_ARCH_SUPPORTS_KEXEC_SIG=y @@ -3580,6 +3581,7 @@ CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y CONFIG_ARCH_WANT_GENERAL_HUGETLB=y CONFIG_ARCH_WANT_HUGETLB_VMEMMAP_PREINIT=y CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y +CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM=y CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=y @@ -3601,9 +3603,7 @@ CONFIG_BLK_CGROUP_RWSTAT=y CONFIG_BLK_DEV_BSG_COMMON=y CONFIG_BLK_DEV_DM_BUILTIN=y CONFIG_BLK_ICQ=y -CONFIG_BLK_MQ_PCI=y CONFIG_BLK_MQ_STACKING=y -CONFIG_BLK_MQ_VIRTIO=y CONFIG_BLK_PM=y CONFIG_BLK_RQ_ALLOC_TIME=y CONFIG_BLOCK_HOLDER_DEPRECATED=y @@ -3655,6 +3655,8 @@ CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S=y CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA=y CONFIG_CRYPTO_ARCH_HAVE_LIB_CURVE25519=y CONFIG_CRYPTO_ARCH_HAVE_LIB_POLY1305=y +CONFIG_CRYPTO_ARCH_HAVE_LIB_SHA256=y +CONFIG_CRYPTO_ARCH_HAVE_LIB_SHA256_SIMD=y CONFIG_CRYPTO_BLOWFISH_COMMON=m CONFIG_CRYPTO_CAST_COMMON=m CONFIG_CRYPTO_CURVE25519_X86=m @@ -3680,23 +3682,25 @@ CONFIG_CRYPTO_LIB_CURVE25519_GENERIC=m CONFIG_CRYPTO_LIB_CURVE25519_INTERNAL=m CONFIG_CRYPTO_LIB_DES=m CONFIG_CRYPTO_LIB_GF128MUL=y +CONFIG_CRYPTO_LIB_POLY1305_GENERIC=m CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11 CONFIG_CRYPTO_LIB_SHA1=y CONFIG_CRYPTO_LIB_SHA256=y +CONFIG_CRYPTO_LIB_SHA256_GENERIC=y +CONFIG_CRYPTO_LIB_SM3=m CONFIG_CRYPTO_LIB_UTILS=y +CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_MANAGER2=y CONFIG_CRYPTO_NHPOLY1305=m -CONFIG_CRYPTO_NULL2=y CONFIG_CRYPTO_POLYVAL=m CONFIG_CRYPTO_RNG=y CONFIG_CRYPTO_RNG2=y CONFIG_CRYPTO_RNG_DEFAULT=y +CONFIG_CRYPTO_SHA256_X86_64=y CONFIG_CRYPTO_SIG=y CONFIG_CRYPTO_SIG2=y -CONFIG_CRYPTO_SIMD=m CONFIG_CRYPTO_SKCIPHER=y CONFIG_CRYPTO_SKCIPHER2=y -CONFIG_CRYPTO_SM3=m CONFIG_CRYPTO_SM4=m CONFIG_CRYPTO_TWOFISH_COMMON=m CONFIG_CRYPTO_USER_API=m @@ -3738,7 +3742,6 @@ CONFIG_DYNAMIC_EVENTS=y CONFIG_DYNAMIC_FTRACE_WITH_ARGS=y CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y CONFIG_DYNAMIC_FTRACE_WITH_REGS=y -CONFIG_DYNAMIC_MEMORY_LAYOUT=y CONFIG_DYNAMIC_PHYSICAL_MASK=y CONFIG_DYNAMIC_SIGFRAME=y CONFIG_EDAC_ATOMIC_SCRUB=y @@ -3789,6 +3792,7 @@ CONFIG_FUNCTION_ALIGNMENT_4B=y CONFIG_FUNCTION_PADDING_BYTES=16 CONFIG_FUNCTION_PADDING_CFI=11 CONFIG_FUNCTION_TRACE_ARGS=y +CONFIG_FUTEX_MPOL=y CONFIG_FUTEX_PI=y CONFIG_FWNODE_MDIO=m CONFIG_FW_LOADER_PAGED_BUF=y @@ -4082,8 +4086,6 @@ CONFIG_LRU_GEN_WALKS_MMU=y CONFIG_LZ4_DECOMPRESS=y CONFIG_LZO_COMPRESS=y CONFIG_LZO_DECOMPRESS=y -CONFIG_MDIO_BUS=m -CONFIG_MDIO_DEVRES=m CONFIG_MEMORY_BALLOON=y CONFIG_MEMORY_ISOLATION=y CONFIG_MEMREGION=y @@ -4120,6 +4122,7 @@ CONFIG_NETFILTER_NETLINK=y CONFIG_NETFILTER_SKIP_EGRESS=y CONFIG_NETFILTER_SYNPROXY=m CONFIG_NETPOLL=y +CONFIG_NET_CRC32C=y CONFIG_NET_DEVLINK=y CONFIG_NET_DEVMEM=y CONFIG_NET_EGRESS=y @@ -4201,7 +4204,7 @@ CONFIG_PCI_LOCKLESS_CONFIG=y CONFIG_PCI_XEN=y CONFIG_PER_VMA_LOCK=y CONFIG_PGTABLE_HAS_HUGE_LEAVES=y -CONFIG_PGTABLE_LEVELS=4 +CONFIG_PGTABLE_LEVELS=5 CONFIG_PHYLINK=m CONFIG_PHYS_ADDR_T_64BIT=y CONFIG_PM_SLEEP=y @@ -4310,6 +4313,8 @@ CONFIG_TRACING=y CONFIG_TRACING_SUPPORT=y CONFIG_TREE_RCU=y CONFIG_TREE_SRCU=y +CONFIG_TSM_GUEST=y +CONFIG_TSM_MEASUREMENTS=y CONFIG_TSM_REPORTS=m CONFIG_UCS2_STRING=y CONFIG_UEFI_CPER=y @@ -4355,7 +4360,6 @@ CONFIG_X86_DISABLED_FEATURE_CENTAUR_MCR=y CONFIG_X86_DISABLED_FEATURE_CYRIX_ARR=y CONFIG_X86_DISABLED_FEATURE_IBT=y CONFIG_X86_DISABLED_FEATURE_K6_MTRR=y -CONFIG_X86_DISABLED_FEATURE_LA57=y CONFIG_X86_DISABLED_FEATURE_LAM=y CONFIG_X86_DISABLED_FEATURE_RETHUNK=y CONFIG_X86_DISABLED_FEATURE_RETPOLINE=y diff --git a/debian/patches/bugfix/all/bootconfig-fix-negative-seeks-on-32-bit-with-lfs-ena.patch b/debian/patches/bugfix/all/bootconfig-fix-negative-seeks-on-32-bit-with-lfs-ena.patch new file mode 100644 index 0000000..afe2d48 --- /dev/null +++ b/debian/patches/bugfix/all/bootconfig-fix-negative-seeks-on-32-bit-with-lfs-ena.patch @@ -0,0 +1,45 @@ +From: Ben Hutchings +Date: Sun, 17 Aug 2025 16:06:28 +0200 +Subject: bootconfig: Fix negative seeks on 32-bit with LFS enabled +Forwarded: https://lore.kernel.org/linux-trace-kernel/aKHlevxeg6Y7UQrz@decadent.org.uk/T/ + +Commit 26dda5769509 "tools/bootconfig: Cleanup bootconfig footer size +calculations" replaced some expressions of type int with the +BOOTCONFIG_FOOTER_SIZE macro, which expands to an expression of type +size_t, which is unsigned. + +On 32-bit architectures with LFS enabled (i.e. off_t is 64-bit), the +seek offset of -BOOTCONFIG_FOOTER_SIZE now turns into a positive +value. + +Fix this by casting the size to off_t before negating it. + +Just in case someone changes BOOTCONFIG_MAGIC_LEN to have type size_t +later, do the same thing to the seek offset of -BOOTCONFIG_MAGIC_LEN. + +Fixes: 26dda5769509 ("tools/bootconfig: Cleanup bootconfig footer size calculations") +Signed-off-by: Ben Hutchings +--- + tools/bootconfig/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/bootconfig/main.c ++++ b/tools/bootconfig/main.c +@@ -193,7 +193,7 @@ static int load_xbc_from_initrd(int fd, + if (stat.st_size < BOOTCONFIG_FOOTER_SIZE) + return 0; + +- if (lseek(fd, -BOOTCONFIG_MAGIC_LEN, SEEK_END) < 0) ++ if (lseek(fd, -(off_t)BOOTCONFIG_MAGIC_LEN, SEEK_END) < 0) + return pr_errno("Failed to lseek for magic", -errno); + + if (read(fd, magic, BOOTCONFIG_MAGIC_LEN) < 0) +@@ -203,7 +203,7 @@ static int load_xbc_from_initrd(int fd, + if (memcmp(magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN) != 0) + return 0; + +- if (lseek(fd, -BOOTCONFIG_FOOTER_SIZE, SEEK_END) < 0) ++ if (lseek(fd, -(off_t)BOOTCONFIG_FOOTER_SIZE, SEEK_END) < 0) + return pr_errno("Failed to lseek for size", -errno); + + if (read(fd, &size, sizeof(uint32_t)) < 0) diff --git a/debian/patches/bugfix/all/bootconfig-fix-unaligned-access-when-building-footer.patch b/debian/patches/bugfix/all/bootconfig-fix-unaligned-access-when-building-footer.patch new file mode 100644 index 0000000..543a100 --- /dev/null +++ b/debian/patches/bugfix/all/bootconfig-fix-unaligned-access-when-building-footer.patch @@ -0,0 +1,71 @@ +From: Ben Hutchings +Date: Wed, 23 Jul 2025 12:17:14 +0200 +Subject: bootconfig: Fix unaligned access when building footer +Forwarded: https://lore.kernel.org/linux-trace-kernel/aIC-NTw-cdm9ZGFw@decadent.org.uk/T/ + +Currently we add padding between the bootconfig text and footer to +ensure that the footer is aligned within the initramfs image. +However, because only the bootconfig data is held in memory, not the +full initramfs image, the footer may not be naturally aligned in +memory. + +This can result in an alignment fault (SIGBUS) when writing the footer +on some architectures, such as sparc. + +Build the footer in a struct on the stack before adding it to the +buffer. + +References: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=sparc64&ver=6.16%7Erc7-1%7Eexp1&stamp=1753209801&raw=0 +Signed-off-by: Ben Hutchings +--- + tools/bootconfig/main.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +--- a/tools/bootconfig/main.c ++++ b/tools/bootconfig/main.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include + +@@ -363,7 +364,12 @@ static int delete_xbc(const char *path) + + static int apply_xbc(const char *path, const char *xbc_path) + { +- char *buf, *data, *p; ++ struct { ++ uint32_t size; ++ uint32_t csum; ++ char magic[BOOTCONFIG_MAGIC_LEN]; ++ } footer; ++ char *buf, *data; + size_t total_size; + struct stat stat; + const char *msg; +@@ -433,17 +439,13 @@ static int apply_xbc(const char *path, c + size += pad; + + /* Add a footer */ +- p = data + size; +- *(uint32_t *)p = htole32(size); +- p += sizeof(uint32_t); ++ footer.size = htole32(size); ++ footer.csum = htole32(csum); ++ memcpy(footer.magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN); ++ static_assert(sizeof(footer) == BOOTCONFIG_FOOTER_SIZE); ++ memcpy(data + size, &footer, BOOTCONFIG_FOOTER_SIZE); + +- *(uint32_t *)p = htole32(csum); +- p += sizeof(uint32_t); +- +- memcpy(p, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN); +- p += BOOTCONFIG_MAGIC_LEN; +- +- total_size = p - data; ++ total_size = size + BOOTCONFIG_FOOTER_SIZE; + + ret = write(fd, data, total_size); + if (ret < total_size) { diff --git a/debian/patches/bugfix/all/ext4-don-t-try-to-clear-the-orphan_present-feature-b.patch b/debian/patches/bugfix/all/ext4-don-t-try-to-clear-the-orphan_present-feature-b.patch new file mode 100644 index 0000000..218c2b3 --- /dev/null +++ b/debian/patches/bugfix/all/ext4-don-t-try-to-clear-the-orphan_present-feature-b.patch @@ -0,0 +1,45 @@ +From: Theodore Ts'o +Date: Thu, 7 Aug 2025 09:35:20 -0400 +Subject: ext4: don't try to clear the orphan_present feature block device is + r/o +Origin: https://git.kernel.org/linus/c5e104a91e7b6fa12c1dc2d8bf84abb7ef9b89ad +Bug-Debian: https://bugs.debian.org/1108271 + +When the file system is frozen in preparation for taking an LVM +snapshot, the journal is checkpointed and if the orphan_file feature +is enabled, and the orphan file is empty, we clear the orphan_present +feature flag. But if there are pending inodes that need to be removed +the orphan_present feature flag can't be cleared. + +The problem comes if the block device is read-only. In that case, we +can't process the orphan inode list, so it is skipped in +ext4_orphan_cleanup(). But then in ext4_mark_recovery_complete(), +this results in the ext4 error "Orphan file not empty on read-only fs" +firing and the file system mount is aborted. + +Fix this by clearing the needs_recovery flag in the block device is +read-only. We do this after the call to ext4_load_and_init-journal() +since there are some error checks need to be done in case the journal +needs to be replayed and the block device is read-only, or if the +block device containing the externa journal is read-only, etc. + +Cc: stable@kernel.org +Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108271 +Cc: stable@vger.kernel.org +Fixes: 02f310fcf47f ("ext4: Speedup ext4 orphan inode handling") +Signed-off-by: Theodore Ts'o +--- + fs/ext4/super.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5414,6 +5414,8 @@ static int __ext4_fill_super(struct fs_c + err = ext4_load_and_init_journal(sb, es, ctx); + if (err) + goto failed_mount3a; ++ if (bdev_read_only(sb->s_bdev)) ++ needs_recovery = 0; + } else if (test_opt(sb, NOLOAD) && !sb_rdonly(sb) && + ext4_has_feature_journal_needs_recovery(sb)) { + ext4_msg(sb, KERN_ERR, "required journal recovery " diff --git a/debian/patches/bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch b/debian/patches/bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch index dc75c7c..d869580 100644 --- a/debian/patches/bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch +++ b/debian/patches/bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch @@ -18,7 +18,7 @@ Signed-off-by: Ben Hutchings --- a/fs/btrfs/super.c +++ b/fs/btrfs/super.c -@@ -2630,7 +2630,7 @@ module_exit(exit_btrfs_fs) +@@ -2622,7 +2622,7 @@ module_exit(exit_btrfs_fs) MODULE_DESCRIPTION("B-Tree File System (BTRFS)"); MODULE_LICENSE("GPL"); @@ -29,7 +29,7 @@ Signed-off-by: Ben Hutchings MODULE_SOFTDEP("pre: blake2b-256"); --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c -@@ -3158,6 +3158,7 @@ static void __exit journal_exit(void) +@@ -3157,6 +3157,7 @@ static void __exit journal_exit(void) MODULE_DESCRIPTION("Generic filesystem journal-writing module"); MODULE_LICENSE("GPL"); @@ -39,7 +39,7 @@ Signed-off-by: Ben Hutchings --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c -@@ -2349,5 +2349,8 @@ static void __exit exit_nfsd(void) +@@ -2353,5 +2353,8 @@ static void __exit exit_nfsd(void) MODULE_AUTHOR("Olaf Kirch "); MODULE_DESCRIPTION("In-kernel NFS server"); MODULE_LICENSE("GPL"); diff --git a/debian/patches/bugfix/all/kbuild-bpf-fix-btf-reproducibility.patch b/debian/patches/bugfix/all/kbuild-bpf-fix-btf-reproducibility.patch index 610393b..7f9bc9f 100644 --- a/debian/patches/bugfix/all/kbuild-bpf-fix-btf-reproducibility.patch +++ b/debian/patches/bugfix/all/kbuild-bpf-fix-btf-reproducibility.patch @@ -24,7 +24,7 @@ Signed-off-by: Ben Hutchings pahole-flags-$(call test-ge, $(pahole-ver), 125) += --skip_encoding_btf_inconsistent_proto --btf_gen_optimized else -@@ -29,6 +27,18 @@ endif +@@ -31,6 +29,18 @@ endif endif diff --git a/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch b/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch index f4270fe..091a651 100644 --- a/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch +++ b/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch @@ -9,7 +9,7 @@ sources. --- a/scripts/Makefile.build +++ b/scripts/Makefile.build -@@ -184,6 +184,11 @@ cmd_record_mcount = $(if $(findstring $( +@@ -268,6 +268,11 @@ cmd_record_mcount = $(if $(findstring $( $(sub_cmd_record_mcount)) endif # CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT diff --git a/debian/patches/bugfix/all/tools-bootconfig-cleanup-bootconfig-footer-size-calc.patch b/debian/patches/bugfix/all/tools-bootconfig-cleanup-bootconfig-footer-size-calc.patch new file mode 100644 index 0000000..cd6cea1 --- /dev/null +++ b/debian/patches/bugfix/all/tools-bootconfig-cleanup-bootconfig-footer-size-calc.patch @@ -0,0 +1,90 @@ +From: "Masami Hiramatsu (Google)" +Date: Thu, 10 Jul 2025 11:24:17 +0900 +Subject: tools/bootconfig: Cleanup bootconfig footer size calculations +Origin: https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git/commit?id=26dda57695090e05c1a99c3e8f802f862d1ac474 + +There are many same pattern of 8 + BOOTCONFIG_MAGIC_LEN for calculating +the size of bootconfig footer. Use BOOTCONFIG_FOOTER_SIZE macro to +clean up those magic numbers. + +Link: https://lore.kernel.org/all/175211425693.2591046.16029516706923643510.stgit@mhiramat.tok.corp.google.com/ + +Signed-off-by: Masami Hiramatsu (Google) +--- + tools/bootconfig/main.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/tools/bootconfig/main.c ++++ b/tools/bootconfig/main.c +@@ -16,6 +16,10 @@ + + #define pr_err(fmt, ...) fprintf(stderr, fmt, ##__VA_ARGS__) + ++/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */ ++#define BOOTCONFIG_FOOTER_SIZE \ ++ (sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN) ++ + static int xbc_show_value(struct xbc_node *node, bool semicolon) + { + const char *val, *eol; +@@ -185,7 +189,7 @@ static int load_xbc_from_initrd(int fd, + if (ret < 0) + return -errno; + +- if (stat.st_size < 8 + BOOTCONFIG_MAGIC_LEN) ++ if (stat.st_size < BOOTCONFIG_FOOTER_SIZE) + return 0; + + if (lseek(fd, -BOOTCONFIG_MAGIC_LEN, SEEK_END) < 0) +@@ -198,7 +202,7 @@ static int load_xbc_from_initrd(int fd, + if (memcmp(magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN) != 0) + return 0; + +- if (lseek(fd, -(8 + BOOTCONFIG_MAGIC_LEN), SEEK_END) < 0) ++ if (lseek(fd, -BOOTCONFIG_FOOTER_SIZE, SEEK_END) < 0) + return pr_errno("Failed to lseek for size", -errno); + + if (read(fd, &size, sizeof(uint32_t)) < 0) +@@ -210,12 +214,12 @@ static int load_xbc_from_initrd(int fd, + csum = le32toh(csum); + + /* Wrong size error */ +- if (stat.st_size < size + 8 + BOOTCONFIG_MAGIC_LEN) { ++ if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) { + pr_err("bootconfig size is too big\n"); + return -E2BIG; + } + +- if (lseek(fd, stat.st_size - (size + 8 + BOOTCONFIG_MAGIC_LEN), ++ if (lseek(fd, stat.st_size - (size + BOOTCONFIG_FOOTER_SIZE), + SEEK_SET) < 0) + return pr_errno("Failed to lseek", -errno); + +@@ -346,7 +350,7 @@ static int delete_xbc(const char *path) + ret = fstat(fd, &stat); + if (!ret) + ret = ftruncate(fd, stat.st_size +- - size - 8 - BOOTCONFIG_MAGIC_LEN); ++ - size - BOOTCONFIG_FOOTER_SIZE); + if (ret) + ret = -errno; + } /* Ignore if there is no boot config in initrd */ +@@ -376,8 +380,7 @@ static int apply_xbc(const char *path, c + csum = xbc_calc_checksum(buf, size); + + /* Backup the bootconfig data */ +- data = calloc(size + BOOTCONFIG_ALIGN + +- sizeof(uint32_t) + sizeof(uint32_t) + BOOTCONFIG_MAGIC_LEN, 1); ++ data = calloc(size + BOOTCONFIG_ALIGN + BOOTCONFIG_FOOTER_SIZE, 1); + if (!data) + return -ENOMEM; + memcpy(data, buf, size); +@@ -425,7 +428,7 @@ static int apply_xbc(const char *path, c + } + + /* To align up the total size to BOOTCONFIG_ALIGN, get padding size */ +- total_size = stat.st_size + size + sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN; ++ total_size = stat.st_size + size + BOOTCONFIG_FOOTER_SIZE; + pad = ((total_size + BOOTCONFIG_ALIGN - 1) & (~BOOTCONFIG_ALIGN_MASK)) - total_size; + size += pad; + diff --git a/debian/patches/bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch b/debian/patches/bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch index 5581261..c559b4e 100644 --- a/debian/patches/bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch +++ b/debian/patches/bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch @@ -26,7 +26,7 @@ Tested-by: Michal Kubecek --- a/arch/powerpc/boot/Makefile +++ b/arch/powerpc/boot/Makefile -@@ -97,7 +97,7 @@ BOOTCFLAGS += -fno-stack-protector +@@ -98,7 +98,7 @@ BOOTCFLAGS += -fno-stack-protector endif BOOTCFLAGS += -include $(srctree)/include/linux/compiler_attributes.h diff --git a/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch b/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch index 1065ee0..a0e3bbc 100644 --- a/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch +++ b/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch @@ -21,7 +21,7 @@ Signed-off-by: Serge Hallyn --- a/kernel/fork.c +++ b/kernel/fork.c -@@ -119,6 +119,12 @@ +@@ -122,6 +122,12 @@ #include @@ -34,7 +34,7 @@ Signed-off-by: Serge Hallyn /* * Minimum number of threads to boot the kernel */ -@@ -2194,6 +2200,10 @@ __latent_entropy struct task_struct *cop +@@ -1933,6 +1939,10 @@ __latent_entropy struct task_struct *cop if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) return ERR_PTR(-EINVAL); @@ -45,7 +45,7 @@ Signed-off-by: Serge Hallyn /* * Thread groups must share signals as well, and detached threads * can only be started up within the thread group. -@@ -3354,6 +3364,12 @@ int ksys_unshare(unsigned long unshare_f +@@ -3099,6 +3109,12 @@ int ksys_unshare(unsigned long unshare_f if (unshare_flags & CLONE_NEWNS) unshare_flags |= CLONE_FS; @@ -60,7 +60,7 @@ Signed-off-by: Serge Hallyn goto bad_unshare_out; --- a/kernel/sysctl.c +++ b/kernel/sysctl.c -@@ -84,6 +84,10 @@ EXPORT_SYMBOL_GPL(sysctl_long_vals); +@@ -77,6 +77,10 @@ EXPORT_SYMBOL_GPL(sysctl_long_vals); static const int ngroups_max = NGROUPS_MAX; static const int cap_last_cap = CAP_LAST_CAP; @@ -71,10 +71,10 @@ Signed-off-by: Serge Hallyn #ifdef CONFIG_PROC_SYSCTL /** -@@ -1595,6 +1599,15 @@ static const struct ctl_table kern_table - .mode = 0644, - .proc_handler = proc_dointvec, - }, +@@ -1581,6 +1585,15 @@ int proc_do_static_key(const struct ctl_ + } + + static const struct ctl_table kern_table[] = { +#ifdef CONFIG_USER_NS + { + .procname = "unprivileged_userns_clone", diff --git a/debian/patches/debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch b/debian/patches/debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch index a2ce424..3cb9766 100644 --- a/debian/patches/debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch +++ b/debian/patches/debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch @@ -22,7 +22,7 @@ implementation went from disk-io.c to super.c; forwarded the issue] --- a/fs/btrfs/super.c +++ b/fs/btrfs/super.c -@@ -769,6 +769,18 @@ static void set_device_specific_options( +@@ -761,6 +761,18 @@ static void set_device_specific_options( btrfs_set_opt(fs_info->mount_opt, SSD); /* diff --git a/debian/patches/debian/documentation-drop-sphinx-version-check.patch b/debian/patches/debian/documentation-drop-sphinx-version-check.patch index 71fca78..b637252 100644 --- a/debian/patches/debian/documentation-drop-sphinx-version-check.patch +++ b/debian/patches/debian/documentation-drop-sphinx-version-check.patch @@ -10,7 +10,7 @@ Forwarded: not-needed --- a/Documentation/Makefile +++ b/Documentation/Makefile -@@ -118,7 +118,6 @@ $(YNL_RST_DIR)/%.rst: $(YNL_YAML_DIR)/%. +@@ -119,7 +119,6 @@ $(YNL_RST_DIR)/%.rst: $(YNL_YAML_DIR)/%. htmldocs texinfodocs latexdocs epubdocs xmldocs: $(YNL_INDEX) htmldocs: @@ -18,7 +18,7 @@ Forwarded: not-needed @+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,html,$(var),,$(var))) # If Rust support is available and .config exists, add rustdoc generated contents. -@@ -132,7 +131,6 @@ endif +@@ -133,7 +132,6 @@ endif endif texinfodocs: @@ -26,7 +26,7 @@ Forwarded: not-needed @+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,texinfo,$(var),texinfo,$(var))) # Note: the 'info' Make target is generated by sphinx itself when -@@ -144,7 +142,6 @@ linkcheckdocs: +@@ -145,7 +143,6 @@ linkcheckdocs: @$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,linkcheck,$(var),,$(var))) latexdocs: @@ -34,7 +34,7 @@ Forwarded: not-needed @+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,latex,$(var),latex,$(var))) ifeq ($(HAVE_PDFLATEX),0) -@@ -157,7 +154,6 @@ else # HAVE_PDFLATEX +@@ -158,7 +155,6 @@ else # HAVE_PDFLATEX pdfdocs: DENY_VF = XDG_CONFIG_HOME=$(FONTS_CONF_DENY_VF) pdfdocs: latexdocs @@ -42,7 +42,7 @@ Forwarded: not-needed $(foreach var,$(SPHINXDIRS), \ $(MAKE) PDFLATEX="$(PDFLATEX)" LATEXOPTS="$(LATEXOPTS)" $(DENY_VF) -C $(BUILDDIR)/$(var)/latex || sh $(srctree)/scripts/check-variable-fonts.sh || exit; \ mkdir -p $(BUILDDIR)/$(var)/pdf; \ -@@ -167,11 +163,9 @@ pdfdocs: latexdocs +@@ -168,11 +164,9 @@ pdfdocs: latexdocs endif # HAVE_PDFLATEX epubdocs: diff --git a/debian/patches/debian/export-symbols-needed-by-binder.patch b/debian/patches/debian/export-symbols-needed-by-binder.patch index cc2d5e3..07ebffb 100644 --- a/debian/patches/debian/export-symbols-needed-by-binder.patch +++ b/debian/patches/debian/export-symbols-needed-by-binder.patch @@ -17,9 +17,10 @@ Export the currently un-exported symbols it depends on. kernel/sched/wait.c | 1 + kernel/task_work.c | 1 + mm/list_lru.c | 2 ++ - mm/memory.c | 2 ++ + mm/memory.c | 1 + + mm/mmap_lock.c | 1 + security/security.c | 4 ++++ - 9 files changed, 14 insertions(+) + 10 files changed, 14 insertions(+) --- a/fs/file.c +++ b/fs/file.c @@ -101,22 +102,24 @@ Export the currently un-exported symbols it depends on. { --- a/mm/memory.c +++ b/mm/memory.c -@@ -2020,6 +2020,7 @@ void zap_page_range_single(struct vm_are +@@ -2050,6 +2050,7 @@ void zap_page_range_single(struct vm_are + zap_page_range_single_batched(&tlb, vma, address, size, details); tlb_finish_mmu(&tlb); - hugetlb_zap_end(vma, details); } +EXPORT_SYMBOL_GPL(zap_page_range_single); /** * zap_vma_ptes - remove ptes mapping the vma -@@ -6567,6 +6568,7 @@ inval: +--- a/mm/mmap_lock.c ++++ b/mm/mmap_lock.c +@@ -177,6 +177,7 @@ inval: count_vm_vma_lock_event(VMA_LOCK_ABORT); return NULL; } +EXPORT_SYMBOL_GPL(lock_vma_under_rcu); #endif /* CONFIG_PER_VMA_LOCK */ - #ifndef __PAGETABLE_P4D_FOLDED + #ifdef CONFIG_LOCK_MM_AND_FIND_VMA --- a/security/security.c +++ b/security/security.c @@ -996,6 +996,7 @@ int security_binder_set_context_mgr(cons diff --git a/debian/patches/debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch b/debian/patches/debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch index f14ead9..c0acf9e 100644 --- a/debian/patches/debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch +++ b/debian/patches/debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch @@ -12,7 +12,7 @@ actually used. --- --- a/fs/notify/fanotify/fanotify_user.c +++ b/fs/notify/fanotify/fanotify_user.c -@@ -1881,6 +1881,14 @@ static int do_fanotify_mark(int fanotify +@@ -1878,6 +1878,14 @@ static int do_fanotify_mark(int fanotify umask = FANOTIFY_EVENT_FLAGS; } diff --git a/debian/patches/debian/kernelvariables.patch b/debian/patches/debian/kernelvariables.patch index 277765a..6b2fd63 100644 --- a/debian/patches/debian/kernelvariables.patch +++ b/debian/patches/debian/kernelvariables.patch @@ -56,7 +56,7 @@ use of $(ARCH) needs to be moved after this. KCONFIG_CONFIG ?= .config export KCONFIG_CONFIG -@@ -551,6 +521,35 @@ RUSTFLAGS_KERNEL = +@@ -556,6 +526,35 @@ RUSTFLAGS_KERNEL = AFLAGS_KERNEL = LDFLAGS_vmlinux = diff --git a/debian/patches/debian/linux-perf-remove-remaining-source-filenames-from-executable.patch b/debian/patches/debian/linux-perf-remove-remaining-source-filenames-from-executable.patch index 973b59c..d08b507 100644 --- a/debian/patches/debian/linux-perf-remove-remaining-source-filenames-from-executable.patch +++ b/debian/patches/debian/linux-perf-remove-remaining-source-filenames-from-executable.patch @@ -15,7 +15,7 @@ to the installed location. --- --- a/tools/perf/builtin-report.c +++ b/tools/perf/builtin-report.c -@@ -666,10 +666,12 @@ static int report__browse_hists(struct r +@@ -669,10 +669,12 @@ static int report__browse_hists(struct r path = system_path(TIPDIR); if (perf_tip(&help, path) || help == NULL) { @@ -30,7 +30,7 @@ to the installed location. free(path); --- a/tools/perf/tests/Build +++ b/tools/perf/tests/Build -@@ -73,7 +73,7 @@ ifeq ($(SRCARCH),$(filter $(SRCARCH),x86 +@@ -74,7 +74,7 @@ ifeq ($(SRCARCH),$(filter $(SRCARCH),x86 perf-test-$(CONFIG_DWARF_UNWIND) += dwarf-unwind.o endif diff --git a/debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch b/debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch index ded3d69..4b0d384 100644 --- a/debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch +++ b/debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch @@ -31,7 +31,7 @@ cc: linux-efi@vger.kernel.org --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -1127,19 +1127,7 @@ void __init setup_arch(char **cmdline_p) +@@ -1149,19 +1149,7 @@ void __init setup_arch(char **cmdline_p) /* Allocate bigger log buffer */ setup_log_buf(1); diff --git a/debian/patches/features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/debian/patches/features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch index 36e9bde..8237d7f 100644 --- a/debian/patches/features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch +++ b/debian/patches/features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -26,7 +26,7 @@ Signed-off-by: Salvatore Bonaccorso --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -964,6 +964,8 @@ void __init setup_arch(char **cmdline_p) +@@ -986,6 +986,8 @@ void __init setup_arch(char **cmdline_p) if (efi_enabled(EFI_BOOT)) efi_init(); @@ -35,7 +35,7 @@ Signed-off-by: Salvatore Bonaccorso reserve_ibft_region(); x86_init.resources.dmi_setup(); -@@ -1127,8 +1129,6 @@ void __init setup_arch(char **cmdline_p) +@@ -1149,8 +1151,6 @@ void __init setup_arch(char **cmdline_p) /* Allocate bigger log buffer */ setup_log_buf(1); @@ -67,7 +67,7 @@ Signed-off-by: Salvatore Bonaccorso default: --- a/include/linux/security.h +++ b/include/linux/security.h -@@ -574,6 +574,7 @@ int security_inode_notifysecctx(struct i +@@ -573,6 +573,7 @@ int security_inode_notifysecctx(struct i int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp); int security_locked_down(enum lockdown_reason what); @@ -75,7 +75,7 @@ Signed-off-by: Salvatore Bonaccorso int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len, void *val, size_t val_len, u64 id, u64 flags); int security_bdev_alloc(struct block_device *bdev); -@@ -1580,6 +1581,11 @@ static inline int security_locked_down(e +@@ -1574,6 +1575,11 @@ static inline int security_locked_down(e { return 0; } diff --git a/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch b/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch index ceef04a..a1307d5 100644 --- a/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch +++ b/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch @@ -22,7 +22,7 @@ Signed-off-by: Ben Hutchings --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h -@@ -1684,6 +1684,11 @@ extern int sysctl_perf_event_sample_rate +@@ -1761,6 +1761,11 @@ extern int sysctl_perf_event_sample_rate extern void perf_sample_event_took(u64 sample_len_ns); @@ -50,7 +50,7 @@ Signed-off-by: Ben Hutchings /* Minimum for 512 kiB + 1 user control page. 'free' kiB per user. */ static int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); -@@ -13164,6 +13169,9 @@ SYSCALL_DEFINE5(perf_event_open, +@@ -13376,6 +13381,9 @@ SYSCALL_DEFINE5(perf_event_open, if (err) return err; diff --git a/debian/patches/features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch b/debian/patches/features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch index f77b244..01de69f 100644 --- a/debian/patches/features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch +++ b/debian/patches/features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch @@ -22,7 +22,7 @@ Signed-off-by: Ben Hutchings --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -2288,6 +2288,8 @@ +@@ -2306,6 +2306,8 @@ bypassed by not enabling DMAR with this option. In this case, gfx device will use physical address for DMA. @@ -68,7 +68,7 @@ Signed-off-by: Ben Hutchings } else if (!strncmp(str, "forcedac", 8)) { pr_warn("intel_iommu=forcedac deprecated; use iommu.forcedac instead\n"); iommu_dma_forcedac = true; -@@ -1949,6 +1957,9 @@ static int device_def_domain_type(struct +@@ -1899,6 +1907,9 @@ static int device_def_domain_type(struct if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev)) return IOMMU_DOMAIN_IDENTITY; @@ -78,7 +78,7 @@ Signed-off-by: Ben Hutchings } return 0; -@@ -2243,6 +2254,9 @@ static int __init init_dmars(void) +@@ -2189,6 +2200,9 @@ static int __init init_dmars(void) iommu_set_root_entry(iommu); } diff --git a/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch b/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch index 7dd3321..08d59df 100644 --- a/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch +++ b/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch @@ -29,7 +29,7 @@ Signed-off-by: Ben Hutchings --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -7044,6 +7044,10 @@ +@@ -7117,6 +7117,10 @@ later by a loaded module cannot be set this way. Example: sysctl.vm.swappiness=40 @@ -42,7 +42,7 @@ Signed-off-by: Ben Hutchings Ignore sysrq setting - this boot parameter will --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig -@@ -3178,6 +3178,14 @@ config COMPAT_32 +@@ -3150,6 +3150,14 @@ config COMPAT_32 select HAVE_UID16 select OLD_SIGSUSPEND3 @@ -69,7 +69,7 @@ Signed-off-by: Ben Hutchings typedef unsigned long elf_greg_t; -@@ -152,7 +155,8 @@ do { \ +@@ -148,7 +151,8 @@ do { \ #define compat_elf_check_arch(x) \ ((elf_check_arch_ia32(x) && ia32_enabled_verbose()) || \ diff --git a/debian/patches/krd/0002-local-ports.patch b/debian/patches/krd/0002-local-ports.patch index 7cee0be..e8d0dcb 100644 --- a/debian/patches/krd/0002-local-ports.patch +++ b/debian/patches/krd/0002-local-ports.patch @@ -1,6 +1,6 @@ --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c -@@ -1790,7 +1790,7 @@ static __net_init int inet_init_net(stru +@@ -1787,7 +1787,7 @@ static __net_init int inet_init_net(stru /* * Set defaults for local port range */ diff --git a/debian/patches/krd/0003-bridge-group_fwd_mask.patch b/debian/patches/krd/0003-bridge-group_fwd_mask.patch index 6b4f1a6..1ec98b1 100644 --- a/debian/patches/krd/0003-bridge-group_fwd_mask.patch +++ b/debian/patches/krd/0003-bridge-group_fwd_mask.patch @@ -1,6 +1,6 @@ --- a/net/bridge/br_input.c +++ b/net/bridge/br_input.c -@@ -383,7 +383,11 @@ static rx_handler_result_t br_handle_fra +@@ -384,7 +384,11 @@ static rx_handler_result_t br_handle_fra case 0x01: /* IEEE MAC (Pause) */ reason = SKB_DROP_REASON_MAC_IEEE_MAC_CONTROL; diff --git a/debian/patches/misc-openwrt/0001-mac80211-ignore-AP-power-level-when-tx-power-type-is.patch b/debian/patches/misc-openwrt/0101-mac80211-ignore-AP-power-level-when-tx-power-type-is.patch similarity index 100% rename from debian/patches/misc-openwrt/0001-mac80211-ignore-AP-power-level-when-tx-power-type-is.patch rename to debian/patches/misc-openwrt/0101-mac80211-ignore-AP-power-level-when-tx-power-type-is.patch diff --git a/debian/patches/misc-openwrt/0002-mac80211-avoid-crashing-missing-band.patch b/debian/patches/misc-openwrt/0102-mac80211-avoid-crashing-missing-band.patch similarity index 93% rename from debian/patches/misc-openwrt/0002-mac80211-avoid-crashing-missing-band.patch rename to debian/patches/misc-openwrt/0102-mac80211-avoid-crashing-missing-band.patch index 91599de..2de9bec 100644 --- a/debian/patches/misc-openwrt/0002-mac80211-avoid-crashing-missing-band.patch +++ b/debian/patches/misc-openwrt/0102-mac80211-avoid-crashing-missing-band.patch @@ -18,7 +18,7 @@ Signed-off-by: David Bauer --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c -@@ -2467,6 +2467,13 @@ static void sta_stats_decode_rate(struct +@@ -2468,6 +2468,13 @@ static void sta_stats_decode_rate(struct sband = local->hw.wiphy->bands[band]; diff --git a/debian/patches/misc-openwrt/0003-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch b/debian/patches/misc-openwrt/0103-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch similarity index 100% rename from debian/patches/misc-openwrt/0003-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch rename to debian/patches/misc-openwrt/0103-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch diff --git a/debian/patches/misc-openwrt/0004-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch b/debian/patches/misc-openwrt/0104-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch similarity index 100% rename from debian/patches/misc-openwrt/0004-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch rename to debian/patches/misc-openwrt/0104-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch diff --git a/debian/patches/misc-openwrt/0005-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch b/debian/patches/misc-openwrt/0105-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch similarity index 100% rename from debian/patches/misc-openwrt/0005-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch rename to debian/patches/misc-openwrt/0105-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch diff --git a/debian/patches/misc-openwrt/0006-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch b/debian/patches/misc-openwrt/0106-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch similarity index 100% rename from debian/patches/misc-openwrt/0006-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch rename to debian/patches/misc-openwrt/0106-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch diff --git a/debian/patches/misc-openwrt/0007-mac80211-increase-quantum-for-airtime-scheduler.patch b/debian/patches/misc-openwrt/0107-mac80211-increase-quantum-for-airtime-scheduler.patch similarity index 89% rename from debian/patches/misc-openwrt/0007-mac80211-increase-quantum-for-airtime-scheduler.patch rename to debian/patches/misc-openwrt/0107-mac80211-increase-quantum-for-airtime-scheduler.patch index 4b3c863..2382add 100644 --- a/debian/patches/misc-openwrt/0007-mac80211-increase-quantum-for-airtime-scheduler.patch +++ b/debian/patches/misc-openwrt/0107-mac80211-increase-quantum-for-airtime-scheduler.patch @@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c -@@ -4085,7 +4085,7 @@ struct ieee80211_txq *ieee80211_next_txq +@@ -4074,7 +4074,7 @@ struct ieee80211_txq *ieee80211_next_txq if (deficit < 0) sta->airtime[txqi->txq.ac].deficit += @@ -32,7 +32,7 @@ Signed-off-by: Felix Fietkau if (deficit < 0 || !aql_check) { list_move_tail(&txqi->schedule_order, -@@ -4230,7 +4230,8 @@ bool ieee80211_txq_may_transmit(struct i +@@ -4219,7 +4219,8 @@ bool ieee80211_txq_may_transmit(struct i } sta = container_of(iter->txq.sta, struct sta_info, sta); if (ieee80211_sta_deficit(sta, ac) < 0) @@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau list_move_tail(&iter->schedule_order, &local->active_txqs[ac]); } -@@ -4238,7 +4239,7 @@ bool ieee80211_txq_may_transmit(struct i +@@ -4227,7 +4228,7 @@ bool ieee80211_txq_may_transmit(struct i if (sta->airtime[ac].deficit >= 0) goto out; diff --git a/debian/patches/misc-openwrt/0008-mac80211-add-AQL-support-for-broadcast-packets.patch b/debian/patches/misc-openwrt/0108-mac80211-add-AQL-support-for-broadcast-packets.patch similarity index 93% rename from debian/patches/misc-openwrt/0008-mac80211-add-AQL-support-for-broadcast-packets.patch rename to debian/patches/misc-openwrt/0108-mac80211-add-AQL-support-for-broadcast-packets.patch index 0f0df26..213f8bc 100644 --- a/debian/patches/misc-openwrt/0008-mac80211-add-AQL-support-for-broadcast-packets.patch +++ b/debian/patches/misc-openwrt/0108-mac80211-add-AQL-support-for-broadcast-packets.patch @@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h -@@ -3464,6 +3464,7 @@ enum wiphy_params_flags { +@@ -3434,6 +3434,7 @@ enum wiphy_params_flags { /* The per TXQ device queue limit in airtime */ #define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L 5000 #define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H 12000 @@ -70,7 +70,7 @@ Signed-off-by: Felix Fietkau --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h -@@ -1377,10 +1377,12 @@ struct ieee80211_local { +@@ -1392,10 +1392,12 @@ struct ieee80211_local { spinlock_t handle_wake_tx_queue_lock; u16 airtime_flags; @@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau spin_lock_init(&local->active_txq_lock[i]); --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c -@@ -2381,13 +2381,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre +@@ -2382,13 +2382,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local, struct sta_info *sta, u8 ac, @@ -127,7 +127,7 @@ Signed-off-by: Felix Fietkau atomic_add(tx_airtime, --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c -@@ -2556,7 +2556,7 @@ static u16 ieee80211_store_ack_skb(struc +@@ -2546,7 +2546,7 @@ static u16 ieee80211_store_ack_skb(struc spin_lock_irqsave(&local->ack_status_lock, flags); id = idr_alloc(&local->ack_status_frames, ack_skb, @@ -136,7 +136,7 @@ Signed-off-by: Felix Fietkau spin_unlock_irqrestore(&local->ack_status_lock, flags); if (id >= 0) { -@@ -3986,20 +3986,20 @@ begin: +@@ -3975,20 +3975,20 @@ begin: encap_out: info->control.vif = vif; @@ -167,7 +167,7 @@ Signed-off-by: Felix Fietkau } return skb; -@@ -4051,6 +4051,7 @@ struct ieee80211_txq *ieee80211_next_txq +@@ -4040,6 +4040,7 @@ struct ieee80211_txq *ieee80211_next_txq struct ieee80211_txq *ret = NULL; struct txq_info *txqi = NULL, *head = NULL; bool found_eligible_txq = false; @@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau spin_lock_bh(&local->active_txq_lock[ac]); -@@ -4074,26 +4075,26 @@ struct ieee80211_txq *ieee80211_next_txq +@@ -4063,26 +4064,26 @@ struct ieee80211_txq *ieee80211_next_txq if (!head) head = txqi; @@ -214,7 +214,7 @@ Signed-off-by: Felix Fietkau if (txqi->schedule_round == local->schedule_round[ac]) goto out; -@@ -4160,7 +4161,8 @@ bool ieee80211_txq_airtime_check(struct +@@ -4149,7 +4150,8 @@ bool ieee80211_txq_airtime_check(struct return true; if (!txq->sta) @@ -224,7 +224,7 @@ Signed-off-by: Felix Fietkau if (unlikely(txq->tid == IEEE80211_NUM_TIDS)) return true; -@@ -4209,15 +4211,15 @@ bool ieee80211_txq_may_transmit(struct i +@@ -4198,15 +4200,15 @@ bool ieee80211_txq_may_transmit(struct i spin_lock_bh(&local->active_txq_lock[ac]); @@ -245,7 +245,7 @@ Signed-off-by: Felix Fietkau if (iter == txqi) --- a/include/net/mac80211.h +++ b/include/net/mac80211.h -@@ -1238,8 +1238,8 @@ struct ieee80211_tx_info { +@@ -1245,8 +1245,8 @@ struct ieee80211_tx_info { status_data_idr:1, status_data:13, hw_queue:4, diff --git a/debian/patches/misc-openwrt/0009-mac80211-txq-tune.patch b/debian/patches/misc-openwrt/0109-mac80211-txq-tune.patch similarity index 86% rename from debian/patches/misc-openwrt/0009-mac80211-txq-tune.patch rename to debian/patches/misc-openwrt/0109-mac80211-txq-tune.patch index 1fd46fa..96118de 100644 --- a/debian/patches/misc-openwrt/0009-mac80211-txq-tune.patch +++ b/debian/patches/misc-openwrt/0109-mac80211-txq-tune.patch @@ -1,6 +1,6 @@ --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c -@@ -1606,8 +1606,8 @@ int ieee80211_txq_setup_flows(struct iee +@@ -1596,8 +1596,8 @@ int ieee80211_txq_setup_flows(struct iee fq->memory_limit = 4 << 20; /* 4 Mbytes */ codel_params_init(&local->cparams); diff --git a/debian/patches/misc-openwrt/0010-cfg80211-aql-txq-limit.patch b/debian/patches/misc-openwrt/0110-cfg80211-aql-txq-limit.patch similarity index 92% rename from debian/patches/misc-openwrt/0010-cfg80211-aql-txq-limit.patch rename to debian/patches/misc-openwrt/0110-cfg80211-aql-txq-limit.patch index 5dbe2c3..e222714 100644 --- a/debian/patches/misc-openwrt/0010-cfg80211-aql-txq-limit.patch +++ b/debian/patches/misc-openwrt/0110-cfg80211-aql-txq-limit.patch @@ -1,6 +1,6 @@ --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h -@@ -3462,12 +3462,12 @@ enum wiphy_params_flags { +@@ -3432,12 +3432,12 @@ enum wiphy_params_flags { #define IEEE80211_DEFAULT_AIRTIME_WEIGHT 256 /* The per TXQ device queue limit in airtime */ diff --git a/debian/patches/misc-openwrt/0101-sched-sch_cake-fix-bulk-flow-accounting-logic-for-host.patch b/debian/patches/misc-openwrt/0201-sched-sch_cake-fix-bulk-flow-accounting-logic-for-host.patch similarity index 100% rename from debian/patches/misc-openwrt/0101-sched-sch_cake-fix-bulk-flow-accounting-logic-for-host.patch rename to debian/patches/misc-openwrt/0201-sched-sch_cake-fix-bulk-flow-accounting-logic-for-host.patch diff --git a/debian/patches/misc-openwrt/0201-fq-adjust-memory-size.patch b/debian/patches/misc-openwrt/0301-fq-adjust-memory-size.patch similarity index 100% rename from debian/patches/misc-openwrt/0201-fq-adjust-memory-size.patch rename to debian/patches/misc-openwrt/0301-fq-adjust-memory-size.patch diff --git a/debian/patches/mixed-arch/0001-graysky2-more-ISA-levels-and-uarches.patch b/debian/patches/mixed-arch/0001-graysky2-more-ISA-levels-and-uarches.patch index a2f8c87..8e8cb3b 100644 --- a/debian/patches/mixed-arch/0001-graysky2-more-ISA-levels-and-uarches.patch +++ b/debian/patches/mixed-arch/0001-graysky2-more-ISA-levels-and-uarches.patch @@ -1,10 +1,6 @@ -From 906ed24dfc7e1bbceacc087ba38aecfd22a9890b Mon Sep 17 00:00:00 2001 +From 6b1d270f55e3143bcb3ad914adf920774351a6b9 Mon Sep 17 00:00:00 2001 From: graysky -Date: Mon, 16 Sep 2024 14:47:03 -0400 - -FEATURES -This patch adds additional tunings via new x86-64 ISA levels and -more micro-architecture options to the Linux kernel in three classes. +Date: Mon, 18 Aug 2025 04:14:48 -0400 1. New generic x86-64 ISA levels @@ -103,7 +99,7 @@ See the following experimental evidence supporting this statement: https://github.com/graysky2/kernel_compiler_patch?tab=readme-ov-file#benchmarks REQUIREMENTS -linux version 6.1.79+ +linux version 6.16+ gcc version >=9.0 or clang version >=9.0 ACKNOWLEDGMENTS @@ -116,9 +112,9 @@ REFERENCES 4. http://www.linuxforge.net/docs/linux/linux-gcc.php --- - arch/x86/Kconfig.cpu | 462 ++++++++++++++++++++++++++++++++++++++++++- - arch/x86/Makefile | 222 +++++++++++++++++++++ - 2 files changed, 675 insertions(+), 9 deletions(-) + arch/x86/Kconfig.cpu | 427 ++++++++++++++++++++++++++++++++++++++++++- + arch/x86/Makefile | 213 ++++++++++++++++++++- + 2 files changed, 631 insertions(+), 9 deletions(-) --- a/arch/x86/Kconfig.cpu +++ b/arch/x86/Kconfig.cpu @@ -163,38 +159,15 @@ REFERENCES config MK6 bool "K6/K6-II/K6-III" -@@ -245,6 +260,435 @@ config MATOM +@@ -281,6 +296,402 @@ config X86_GENERIC + This is really intended for distributors who need more + generic optimizations. - endchoice - -+config CC_HAS_MARCH_NATIVE -+ # This flag might not be available in cross-compilers: -+ def_bool $(cc-option, -march=native) -+ # LLVM 18 has an easily triggered internal compiler error in core -+ # networking code with '-march=native' on certain systems: -+ # https://github.com/llvm/llvm-project/issues/72026 -+ # LLVM 19 introduces an optimization that resolves some high stack -+ # usage warnings that only appear wth '-march=native'. -+ depends on CC_IS_GCC || CLANG_VERSION >= 190100 -+ +choice + prompt "x86_64 Compiler Build Optimization" ++ depends on !X86_NATIVE_CPU + default GENERIC_CPU + -+config X86_NATIVE_CPU -+ bool "Build and optimize for local/native CPU" -+ depends on X86_64 -+ depends on CC_HAS_MARCH_NATIVE -+ help -+ Optimize for the current CPU used to compile the kernel. -+ Use this option if you intend to build the kernel for your -+ local machine. -+ -+ Note that such a kernel might not work optimally on a -+ different x86 machine. -+ -+ If unsure, say N. -+ +config GENERIC_CPU + bool "Generic-x86-64" + depends on X86_64 @@ -202,26 +175,6 @@ REFERENCES + Generic x86-64 CPU. + Runs equally well on all x86-64 CPUs. + -+config MNATIVE_INTEL -+ bool "Intel-Native optimizations autodetected by the compiler" -+ help -+ -+ Clang 3.8, GCC 4.2 and above support -march=native, which automatically detects -+ the optimum settings to use based on your processor. Do NOT use this -+ for AMD CPUs. Intel Only! -+ -+ Enables -march=native -+ -+config MNATIVE_AMD -+ bool "AMD-Native optimizations autodetected by the compiler" -+ help -+ -+ Clang 3.8, GCC 4.2 and above support -march=native, which automatically detects -+ the optimum settings to use based on your processor. Do NOT use this -+ for Intel CPUs. AMD Only! -+ -+ Enables -march=native -+ +config MK8 + bool "AMD Opteron/Athlon64/Hammer/K8" + help @@ -445,20 +398,20 @@ REFERENCES + Enables -march=skylake + +config MSKYLAKEX -+ bool "Intel Skylake X" ++ bool "Intel Skylake-X (7th Gen Core i7/i9)" + depends on X86_64 + help + -+ Select this for 6th Gen Core processors in the Skylake X family. ++ Select this for 7th Gen Core i7/i9 processors in the Skylake-X family. + + Enables -march=skylake-avx512 + +config MCANNONLAKE -+ bool "Intel Cannon Lake" ++ bool "Intel Coffee Lake/Kaby Lake Refresh (8th Gen Core i3/i5/i7)" + depends on X86_64 + help + -+ Select this for 8th Gen Core processors ++ Select this for 8th Gen Core i3/i5/i7 processors in the Coffee Lake or Kaby Lake Refresh families. + + Enables -march=cannonlake + @@ -472,11 +425,11 @@ REFERENCES + Enables -march=icelake-client + +config MICELAKE_SERVER -+ bool "Intel Ice Lake Server" ++ bool "Intel Ice Lake-SP (3rd Gen Xeon Scalable)" + depends on X86_64 + help + -+ Select this for 10th Gen Core server processors in the Ice Lake family. ++ Select this for 3rd Gen Xeon Scalable processors in the Ice Lake-SP family. + + Enables -march=icelake-server + @@ -566,10 +519,20 @@ REFERENCES + depends on (CC_IS_GCC && GCC_VERSION > 130000) || (CC_IS_CLANG && CLANG_VERSION >= 150500) + help + -+ Select this for fifth-generation 10 nm process processors in the Emerald Rapids family. ++ Select this for fifth-generation Xeon Scalable processors in the Emerald Rapids family. + + Enables -march=emeraldrapids + ++config MDIAMONDRAPIDS ++ bool "Intel Diamond Rapids (7th Gen Xeon Scalable)" ++ depends on X86_64 ++ depends on (CC_IS_GCC && GCC_VERSION > 150000) || (CC_IS_CLANG && CLANG_VERSION >= 200000) ++ help ++ ++ Select this for seventh-generation Xeon Scalable processors in the Diamond Rapids family. ++ ++ Enables -march=diamondrapids ++ +endchoice + +config X86_64_VERSION @@ -596,31 +559,31 @@ REFERENCES + /lib/ld-linux-x86-64.so.2 --help | grep supported + /lib64/ld-linux-x86-64.so.2 --help | grep supported + - config X86_GENERIC - bool "Generic x86 support" - depends on X86_32 -@@ -266,8 +710,8 @@ config X86_INTERNODE_CACHE_SHIFT + # + # Define implied options from the CPU selection here + config X86_INTERNODE_CACHE_SHIFT +@@ -290,8 +701,8 @@ config X86_INTERNODE_CACHE_SHIFT config X86_L1_CACHE_SHIFT int - default "7" if MPENTIUM4 - default "6" if MK7 || MPENTIUMM || MATOM || MVIAC7 || X86_GENERIC || X86_64 + default "7" if MPENTIUM4 || MPSC -+ default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MZEN4 || MZEN5 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MNATIVE_INTEL || MNATIVE_AMD ++ default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MZEN4 || MZEN5 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MDIAMONDRAPIDS || X86_NATIVE_CPU default "4" if MELAN || M486SX || M486 || MGEODEGX1 default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX -@@ -285,19 +729,19 @@ config X86_ALIGNMENT_16 +@@ -309,19 +720,19 @@ config X86_ALIGNMENT_16 config X86_INTEL_USERCOPY def_bool y - depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK7 || MEFFICEON -+ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MNATIVE_INTEL ++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MDIAMONDRAPIDS config X86_USE_PPRO_CHECKSUM def_bool y - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MATOM -+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MZEN4 || MZEN5 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MNATIVE_INTEL || MNATIVE_AMD ++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MZEN4 || MZEN5 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MDIAMONDRAPIDS config X86_TSC def_bool y @@ -634,7 +597,7 @@ REFERENCES config X86_CX8 def_bool y -@@ -307,13 +751,13 @@ config X86_CX8 +@@ -331,12 +742,12 @@ config X86_CX8 # generates cmov. config X86_CMOV def_bool y @@ -645,33 +608,16 @@ REFERENCES int default "64" if X86_64 - default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MK7) -- default "5" if X86_32 && X86_CX8 + default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCORE2 || MK7 || MK8) -+ default "5" if X86_32 && X86_CMPXCHG64 + default "5" if X86_32 && X86_CX8 default "4" - config X86_DEBUGCTLMSR --- a/arch/x86/Makefile +++ b/arch/x86/Makefile -@@ -173,8 +173,230 @@ else - # Use -mskip-rax-setup if supported. - KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup) - -+ifdef CONFIG_X86_NATIVE_CPU -+ KBUILD_CFLAGS += -march=native -+ KBUILD_RUSTFLAGS += -Ctarget-cpu=native -+endif -+ -+ifdef CONFIG_MNATIVE_INTEL -+ KBUILD_CFLAGS += -march=native -+ KBUILD_RUSTFLAGS += -Ctarget-cpu=native -+endif -+ -+ifdef CONFIG_MNATIVE_AMD -+ KBUILD_CFLAGS += -march=native -+ KBUILD_RUSTFLAGS += -Ctarget-cpu=native -+endif -+ +@@ -177,10 +177,221 @@ ifdef CONFIG_X86_NATIVE_CPU + KBUILD_CFLAGS += -march=native + KBUILD_RUSTFLAGS += -Ctarget-cpu=native + else +ifdef CONFIG_MK8 + KBUILD_CFLAGS += -march=k8 + KBUILD_RUSTFLAGS += -Ctarget-cpu=k8 @@ -872,6 +818,11 @@ REFERENCES + KBUILD_RUSTFLAGS += -Ctarget-cpu=emeraldrapids +endif + ++ifdef CONFIG_MDIAMONDRAPIDS ++ KBUILD_CFLAGS += -march=diamondrapids ++ KBUILD_RUSTFLAGS += -Ctarget-cpu=diamondrapids ++endif ++ +ifdef CONFIG_GENERIC_CPU +ifeq ($(CONFIG_X86_64_VERSION),1) KBUILD_CFLAGS += -march=x86-64 -mtune=generic @@ -879,8 +830,10 @@ REFERENCES +else + KBUILD_CFLAGS +=-march=x86-64-v$(CONFIG_X86_64_VERSION) + KBUILD_RUSTFLAGS += -Ctarget-cpu=x86-64-v$(CONFIG_X86_64_VERSION) -+endif # CONFIG_X86_64_VERSION -+endif # CONFIG_GENERIC_CPU - ++endif ++endif + endif +- KBUILD_CFLAGS += -mno-red-zone KBUILD_CFLAGS += -mcmodel=kernel + KBUILD_RUSTFLAGS += -Cno-redzone=y diff --git a/debian/patches/mixed-arch/0002-ZEN-Restore-CONFIG_OPTIMIZE_FOR_PERFORMANCE_O3.patch b/debian/patches/mixed-arch/0002-ZEN-Restore-CONFIG_OPTIMIZE_FOR_PERFORMANCE_O3.patch index 642d3cc..4ef2e99 100644 --- a/debian/patches/mixed-arch/0002-ZEN-Restore-CONFIG_OPTIMIZE_FOR_PERFORMANCE_O3.patch +++ b/debian/patches/mixed-arch/0002-ZEN-Restore-CONFIG_OPTIMIZE_FOR_PERFORMANCE_O3.patch @@ -13,7 +13,7 @@ dependency on CONFIG_ARC and adds RUSTFLAGS. --- a/Makefile +++ b/Makefile -@@ -868,6 +868,9 @@ KBUILD_CFLAGS += -fno-delete-null-pointe +@@ -873,6 +873,9 @@ KBUILD_CFLAGS += -fno-delete-null-pointe ifdef CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE KBUILD_CFLAGS += -O2 KBUILD_RUSTFLAGS += -Copt-level=2 @@ -25,7 +25,7 @@ dependency on CONFIG_ARC and adds RUSTFLAGS. KBUILD_RUSTFLAGS += -Copt-level=s --- a/init/Kconfig +++ b/init/Kconfig -@@ -1479,6 +1479,12 @@ config CC_OPTIMIZE_FOR_PERFORMANCE +@@ -1498,6 +1498,12 @@ config CC_OPTIMIZE_FOR_PERFORMANCE with the "-O2" compiler flag for best performance and most helpful compile-time warnings. diff --git a/debian/patches/mixed-arch/0003-krd-adjust-CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3.patch b/debian/patches/mixed-arch/0003-krd-adjust-CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3.patch index ce9fcb5..a705a79 100644 --- a/debian/patches/mixed-arch/0003-krd-adjust-CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3.patch +++ b/debian/patches/mixed-arch/0003-krd-adjust-CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3.patch @@ -1,6 +1,6 @@ --- a/Makefile +++ b/Makefile -@@ -876,6 +876,10 @@ KBUILD_CFLAGS += -Os +@@ -881,6 +881,10 @@ KBUILD_CFLAGS += -Os KBUILD_RUSTFLAGS += -Copt-level=s endif diff --git a/debian/patches/mixed-arch/0004-XANMOD-x86-build-Prevent-generating-avx2-and-avx512-.patch b/debian/patches/mixed-arch/0004-XANMOD-x86-build-prevent-generating-avx2-floating-point-code.patch similarity index 100% rename from debian/patches/mixed-arch/0004-XANMOD-x86-build-Prevent-generating-avx2-and-avx512-.patch rename to debian/patches/mixed-arch/0004-XANMOD-x86-build-prevent-generating-avx2-floating-point-code.patch diff --git a/debian/patches/mixed-arch/0006-XANMOD-kbuild-Add-GCC-SMS-based-modulo-scheduling-fl.patch b/debian/patches/mixed-arch/0006-XANMOD-kbuild-add-GCC-SMS-based-modulo-scheduling-flags.patch similarity index 94% rename from debian/patches/mixed-arch/0006-XANMOD-kbuild-Add-GCC-SMS-based-modulo-scheduling-fl.patch rename to debian/patches/mixed-arch/0006-XANMOD-kbuild-add-GCC-SMS-based-modulo-scheduling-flags.patch index dd5edd6..9ec60a1 100644 --- a/debian/patches/mixed-arch/0006-XANMOD-kbuild-Add-GCC-SMS-based-modulo-scheduling-fl.patch +++ b/debian/patches/mixed-arch/0006-XANMOD-kbuild-add-GCC-SMS-based-modulo-scheduling-flags.patch @@ -11,7 +11,7 @@ Signed-off-by: Alexandre Frade --- a/Makefile +++ b/Makefile -@@ -880,6 +880,13 @@ ifdef CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE +@@ -885,6 +885,13 @@ ifdef CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE KBUILD_CFLAGS += $(call cc-option,-fivopts) endif diff --git a/debian/patches/patchset-pf/cpuidle/0001-cpuidle-Prefer-teo-over-menu-governor.patch b/debian/patches/patchset-pf/cpuidle/0001-cpuidle-Prefer-teo-over-menu-governor.patch index 0edcd50..f5db05f 100644 --- a/debian/patches/patchset-pf/cpuidle/0001-cpuidle-Prefer-teo-over-menu-governor.patch +++ b/debian/patches/patchset-pf/cpuidle/0001-cpuidle-Prefer-teo-over-menu-governor.patch @@ -1,4 +1,4 @@ -From 1cb9f09cead0ba384729bfdc74d6fa21d586530c Mon Sep 17 00:00:00 2001 +From 2f7f5a0cd283219e09f8b05b7bfef26b518685ee Mon Sep 17 00:00:00 2001 From: Christian Loehle Date: Thu, 5 Sep 2024 10:26:39 +0100 Subject: cpuidle: Prefer teo over menu governor diff --git a/debian/patches/patchset-pf/fixes/0001-Revert-Disable-FOP_DONTCACHE-for-now-due-to-bugs.patch b/debian/patches/patchset-pf/fixes/0001-Revert-Disable-FOP_DONTCACHE-for-now-due-to-bugs.patch deleted file mode 100644 index 1f1f90a..0000000 --- a/debian/patches/patchset-pf/fixes/0001-Revert-Disable-FOP_DONTCACHE-for-now-due-to-bugs.patch +++ /dev/null @@ -1,29 +0,0 @@ -From b3dc27f64b5d62505ae9f03a6c342a43b0b7e0b2 Mon Sep 17 00:00:00 2001 -From: Jens Axboe -Date: Tue, 27 May 2025 07:28:54 -0600 -Subject: Revert "Disable FOP_DONTCACHE for now due to bugs" - -This reverts commit 478ad02d6844217cc7568619aeb0809d93ade43d. - -Both the read and write side dirty && writeback races should be resolved -now, revert the commit that disabled FOP_DONTCACHE for filesystems. - -Link: https://lore.kernel.org/linux-fsdevel/20250525083209.GS2023217@ZenIV/ -Signed-off-by: Jens Axboe -Link: https://lore.kernel.org/20250527133255.452431-4-axboe@kernel.dk -Signed-off-by: Christian Brauner ---- - include/linux/fs.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2186,7 +2186,7 @@ struct file_operations { - /* Supports asynchronous lock callbacks */ - #define FOP_ASYNC_LOCK ((__force fop_flags_t)(1 << 6)) - /* File system supports uncached read/write buffered IO */ --#define FOP_DONTCACHE 0 /* ((__force fop_flags_t)(1 << 7)) */ -+#define FOP_DONTCACHE ((__force fop_flags_t)(1 << 7)) - - /* Wrap a directory iterator that needs exclusive inode access */ - int wrap_directory_iterator(struct file *, struct dir_context *, diff --git a/debian/patches/patchset-pf/fixes/0002-mm-filemap-unify-read-write-dropbehind-naming.patch b/debian/patches/patchset-pf/fixes/0002-mm-filemap-unify-read-write-dropbehind-naming.patch deleted file mode 100644 index 8d56cf6..0000000 --- a/debian/patches/patchset-pf/fixes/0002-mm-filemap-unify-read-write-dropbehind-naming.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 0b8d9b7ae677a03629218f69037be3f342c5ee81 Mon Sep 17 00:00:00 2001 -From: Jens Axboe -Date: Tue, 27 May 2025 07:28:55 -0600 -Subject: mm/filemap: unify read/write dropbehind naming - -The read side is filemap_end_dropbehind_read(), while the write side -used folio_ as the prefix rather than filemap_. The read side makes more -sense, unify the naming such that the write side follows that. - -Signed-off-by: Jens Axboe -Link: https://lore.kernel.org/20250527133255.452431-5-axboe@kernel.dk -Signed-off-by: Christian Brauner ---- - mm/filemap.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -1604,7 +1604,7 @@ static void filemap_end_dropbehind(struc - * completes. Do that now. If we fail, it's likely because of a big folio - - * just reset dropbehind for that case and latter completions should invalidate. - */ --static void folio_end_dropbehind_write(struct folio *folio) -+static void filemap_end_dropbehind_write(struct folio *folio) - { - /* - * Hitting !in_task() should not happen off RWF_DONTCACHE writeback, -@@ -1659,7 +1659,7 @@ void folio_end_writeback(struct folio *f - acct_reclaim_writeback(folio); - - if (folio_dropbehind) -- folio_end_dropbehind_write(folio); -+ filemap_end_dropbehind_write(folio); - folio_put(folio); - } - EXPORT_SYMBOL(folio_end_writeback); diff --git a/debian/patches/patchset-pf/fixes/0003-mm-filemap-unify-dropbehind-flag-testing-and-clearin.patch b/debian/patches/patchset-pf/fixes/0003-mm-filemap-unify-dropbehind-flag-testing-and-clearin.patch deleted file mode 100644 index 1805559..0000000 --- a/debian/patches/patchset-pf/fixes/0003-mm-filemap-unify-dropbehind-flag-testing-and-clearin.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 2c1c3b3aafb153cbc3bd298db57cc7313d1601b1 Mon Sep 17 00:00:00 2001 -From: Jens Axboe -Date: Tue, 27 May 2025 07:28:56 -0600 -Subject: mm/filemap: unify dropbehind flag testing and clearing - -The read and write side does this a bit differently, unify it such that -the _{read,write} helpers check the bit before locking, and the generic -handler is in charge of clearing the bit and invalidating, once under -the folio lock. - -Signed-off-by: Jens Axboe -Link: https://lore.kernel.org/20250527133255.452431-6-axboe@kernel.dk -Signed-off-by: Christian Brauner ---- - mm/filemap.c | 21 +++++++++++---------- - 1 file changed, 11 insertions(+), 10 deletions(-) - ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -1595,7 +1595,11 @@ static void filemap_end_dropbehind(struc - - VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio); - -- if (mapping && !folio_test_writeback(folio) && !folio_test_dirty(folio)) -+ if (folio_test_writeback(folio) || folio_test_dirty(folio)) -+ return; -+ if (!folio_test_clear_dropbehind(folio)) -+ return; -+ if (mapping) - folio_unmap_invalidate(mapping, folio, 0); - } - -@@ -1606,6 +1610,9 @@ static void filemap_end_dropbehind(struc - */ - static void filemap_end_dropbehind_write(struct folio *folio) - { -+ if (!folio_test_dropbehind(folio)) -+ return; -+ - /* - * Hitting !in_task() should not happen off RWF_DONTCACHE writeback, - * but can happen if normal writeback just happens to find dirty folios -@@ -1629,8 +1636,6 @@ static void filemap_end_dropbehind_write - */ - void folio_end_writeback(struct folio *folio) - { -- bool folio_dropbehind = false; -- - VM_BUG_ON_FOLIO(!folio_test_writeback(folio), folio); - - /* -@@ -1652,14 +1657,11 @@ void folio_end_writeback(struct folio *f - * reused before the folio_wake_bit(). - */ - folio_get(folio); -- if (!folio_test_dirty(folio)) -- folio_dropbehind = folio_test_clear_dropbehind(folio); - if (__folio_end_writeback(folio)) - folio_wake_bit(folio, PG_writeback); -- acct_reclaim_writeback(folio); - -- if (folio_dropbehind) -- filemap_end_dropbehind_write(folio); -+ filemap_end_dropbehind_write(folio); -+ acct_reclaim_writeback(folio); - folio_put(folio); - } - EXPORT_SYMBOL(folio_end_writeback); -@@ -2651,8 +2653,7 @@ static void filemap_end_dropbehind_read( - if (folio_test_writeback(folio) || folio_test_dirty(folio)) - return; - if (folio_trylock(folio)) { -- if (folio_test_clear_dropbehind(folio)) -- filemap_end_dropbehind(folio); -+ filemap_end_dropbehind(folio); - folio_unlock(folio); - } - } diff --git a/debian/patches/patchset-pf/fixes/0004-mm-khugepaged-fix-race-with-folio-split-free-using-t.patch b/debian/patches/patchset-pf/fixes/0004-mm-khugepaged-fix-race-with-folio-split-free-using-t.patch deleted file mode 100644 index 847731d..0000000 --- a/debian/patches/patchset-pf/fixes/0004-mm-khugepaged-fix-race-with-folio-split-free-using-t.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 61d27e9dadb2eb2b7596a11a37402452d97625f7 Mon Sep 17 00:00:00 2001 -From: Shivank Garg -Date: Mon, 26 May 2025 18:28:18 +0000 -Subject: mm/khugepaged: fix race with folio split/free using temporary - reference - -hpage_collapse_scan_file() calls is_refcount_suitable(), which in turn -calls folio_mapcount(). folio_mapcount() checks folio_test_large() before -proceeding to folio_large_mapcount(), but there is a race window where the -folio may get split/freed between these checks, triggering: - - VM_WARN_ON_FOLIO(!folio_test_large(folio), folio) - -Take a temporary reference to the folio in hpage_collapse_scan_file(). -This stabilizes the folio during refcount check and prevents incorrect -large folio detection due to concurrent split/free. Use helper -folio_expected_ref_count() + 1 to compare with folio_ref_count() instead -of using is_refcount_suitable(). - -Link: https://lkml.kernel.org/r/20250526182818.37978-1-shivankg@amd.com -Fixes: 05c5323b2a34 ("mm: track mapcount of large folios in single value") -Signed-off-by: Shivank Garg -Reported-by: syzbot+2b99589e33edbe9475ca@syzkaller.appspotmail.com -Closes: https://lore.kernel.org/all/6828470d.a70a0220.38f255.000c.GAE@google.com -Suggested-by: David Hildenbrand -Acked-by: David Hildenbrand -Acked-by: Dev Jain -Reviewed-by: Baolin Wang -Cc: Bharata B Rao -Cc: Fengwei Yin -Cc: Liam Howlett -Cc: Lorenzo Stoakes -Cc: Mariano Pache -Cc: Ryan Roberts -Cc: Zi Yan -Cc: -Signed-off-by: Andrew Morton ---- - mm/khugepaged.c | 18 +++++++++++++++++- - 1 file changed, 17 insertions(+), 1 deletion(-) - ---- a/mm/khugepaged.c -+++ b/mm/khugepaged.c -@@ -2295,6 +2295,17 @@ static int hpage_collapse_scan_file(stru - continue; - } - -+ if (!folio_try_get(folio)) { -+ xas_reset(&xas); -+ continue; -+ } -+ -+ if (unlikely(folio != xas_reload(&xas))) { -+ folio_put(folio); -+ xas_reset(&xas); -+ continue; -+ } -+ - if (folio_order(folio) == HPAGE_PMD_ORDER && - folio->index == start) { - /* Maybe PMD-mapped */ -@@ -2305,23 +2316,27 @@ static int hpage_collapse_scan_file(stru - * it's safe to skip LRU and refcount checks before - * returning. - */ -+ folio_put(folio); - break; - } - - node = folio_nid(folio); - if (hpage_collapse_scan_abort(node, cc)) { - result = SCAN_SCAN_ABORT; -+ folio_put(folio); - break; - } - cc->node_load[node]++; - - if (!folio_test_lru(folio)) { - result = SCAN_PAGE_LRU; -+ folio_put(folio); - break; - } - -- if (!is_refcount_suitable(folio)) { -+ if (folio_expected_ref_count(folio) + 1 != folio_ref_count(folio)) { - result = SCAN_PAGE_COUNT; -+ folio_put(folio); - break; - } - -@@ -2333,6 +2348,7 @@ static int hpage_collapse_scan_file(stru - */ - - present += folio_nr_pages(folio); -+ folio_put(folio); - - if (need_resched()) { - xas_pause(&xas); diff --git a/debian/patches/patchset-pf/fixes/0005-mm-add-folio_expected_ref_count-for-reference-count-.patch b/debian/patches/patchset-pf/fixes/0005-mm-add-folio_expected_ref_count-for-reference-count-.patch deleted file mode 100644 index 0a68486..0000000 --- a/debian/patches/patchset-pf/fixes/0005-mm-add-folio_expected_ref_count-for-reference-count-.patch +++ /dev/null @@ -1,198 +0,0 @@ -From 8135974e9e512fdf6d15f59947f95e44f2834c37 Mon Sep 17 00:00:00 2001 -From: Shivank Garg -Date: Wed, 30 Apr 2025 10:01:51 +0000 -Subject: mm: add folio_expected_ref_count() for reference count calculation - -Patch series " JFS: Implement migrate_folio for jfs_metapage_aops" v5. - -This patchset addresses a warning that occurs during memory compaction due -to JFS's missing migrate_folio operation. The warning was introduced by -commit 7ee3647243e5 ("migrate: Remove call to ->writepage") which added -explicit warnings when filesystem don't implement migrate_folio. - -The syzbot reported following [1]: - jfs_metapage_aops does not implement migrate_folio - WARNING: CPU: 1 PID: 5861 at mm/migrate.c:955 fallback_migrate_folio mm/migrate.c:953 [inline] - WARNING: CPU: 1 PID: 5861 at mm/migrate.c:955 move_to_new_folio+0x70e/0x840 mm/migrate.c:1007 - Modules linked in: - CPU: 1 UID: 0 PID: 5861 Comm: syz-executor280 Not tainted 6.15.0-rc1-next-20250411-syzkaller #0 PREEMPT(full) - Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 - RIP: 0010:fallback_migrate_folio mm/migrate.c:953 [inline] - RIP: 0010:move_to_new_folio+0x70e/0x840 mm/migrate.c:1007 - -To fix this issue, this series implement metapage_migrate_folio() for JFS -which handles both single and multiple metapages per page configurations. - -While most filesystems leverage existing migration implementations like -filemap_migrate_folio(), buffer_migrate_folio_norefs() or -buffer_migrate_folio() (which internally used folio_expected_refs()), -JFS's metapage architecture requires special handling of its private data -during migration. To support this, this series introduce the -folio_expected_ref_count(), which calculates external references to a -folio from page/swap cache, private data, and page table mappings. - -This standardized implementation replaces the previous ad-hoc -folio_expected_refs() function and enables JFS to accurately determine -whether a folio has unexpected references before attempting migration. - - - - -Implement folio_expected_ref_count() to calculate expected folio reference -counts from: -- Page/swap cache (1 per page) -- Private data (1) -- Page table mappings (1 per map) - -While originally needed for page migration operations, this improved -implementation standardizes reference counting by consolidating all -refcount contributors into a single, reusable function that can benefit -any subsystem needing to detect unexpected references to folios. - -The folio_expected_ref_count() returns the sum of these external -references without including any reference the caller itself might hold. -Callers comparing against the actual folio_ref_count() must account for -their own references separately. - -Link: https://syzkaller.appspot.com/bug?extid=8bb6fd945af4e0ad9299 [1] -Link: https://lkml.kernel.org/r/20250430100150.279751-1-shivankg@amd.com -Link: https://lkml.kernel.org/r/20250430100150.279751-2-shivankg@amd.com -Signed-off-by: David Hildenbrand -Signed-off-by: Shivank Garg -Suggested-by: Matthew Wilcox -Co-developed-by: David Hildenbrand -Cc: Alistair Popple -Cc: Dave Kleikamp -Cc: Donet Tom -Cc: Jane Chu -Cc: Kefeng Wang -Cc: Zi Yan -Signed-off-by: Andrew Morton ---- - include/linux/mm.h | 55 ++++++++++++++++++++++++++++++++++++++++++++++ - mm/migrate.c | 22 ++++--------------- - 2 files changed, 59 insertions(+), 18 deletions(-) - ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -2337,6 +2337,61 @@ static inline bool folio_maybe_mapped_sh - return folio_test_large_maybe_mapped_shared(folio); - } - -+/** -+ * folio_expected_ref_count - calculate the expected folio refcount -+ * @folio: the folio -+ * -+ * Calculate the expected folio refcount, taking references from the pagecache, -+ * swapcache, PG_private and page table mappings into account. Useful in -+ * combination with folio_ref_count() to detect unexpected references (e.g., -+ * GUP or other temporary references). -+ * -+ * Does currently not consider references from the LRU cache. If the folio -+ * was isolated from the LRU (which is the case during migration or split), -+ * the LRU cache does not apply. -+ * -+ * Calling this function on an unmapped folio -- !folio_mapped() -- that is -+ * locked will return a stable result. -+ * -+ * Calling this function on a mapped folio will not result in a stable result, -+ * because nothing stops additional page table mappings from coming (e.g., -+ * fork()) or going (e.g., munmap()). -+ * -+ * Calling this function without the folio lock will also not result in a -+ * stable result: for example, the folio might get dropped from the swapcache -+ * concurrently. -+ * -+ * However, even when called without the folio lock or on a mapped folio, -+ * this function can be used to detect unexpected references early (for example, -+ * if it makes sense to even lock the folio and unmap it). -+ * -+ * The caller must add any reference (e.g., from folio_try_get()) it might be -+ * holding itself to the result. -+ * -+ * Returns the expected folio refcount. -+ */ -+static inline int folio_expected_ref_count(const struct folio *folio) -+{ -+ const int order = folio_order(folio); -+ int ref_count = 0; -+ -+ if (WARN_ON_ONCE(folio_test_slab(folio))) -+ return 0; -+ -+ if (folio_test_anon(folio)) { -+ /* One reference per page from the swapcache. */ -+ ref_count += folio_test_swapcache(folio) << order; -+ } else if (!((unsigned long)folio->mapping & PAGE_MAPPING_FLAGS)) { -+ /* One reference per page from the pagecache. */ -+ ref_count += !!folio->mapping << order; -+ /* One reference from PG_private. */ -+ ref_count += folio_test_private(folio); -+ } -+ -+ /* One reference per page table mapping. */ -+ return ref_count + folio_mapcount(folio); -+} -+ - #ifndef HAVE_ARCH_MAKE_FOLIO_ACCESSIBLE - static inline int arch_make_folio_accessible(struct folio *folio) - { ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -445,20 +445,6 @@ unlock: - } - #endif - --static int folio_expected_refs(struct address_space *mapping, -- struct folio *folio) --{ -- int refs = 1; -- if (!mapping) -- return refs; -- -- refs += folio_nr_pages(folio); -- if (folio_test_private(folio)) -- refs++; -- -- return refs; --} -- - /* - * Replace the folio in the mapping. - * -@@ -601,7 +587,7 @@ static int __folio_migrate_mapping(struc - int folio_migrate_mapping(struct address_space *mapping, - struct folio *newfolio, struct folio *folio, int extra_count) - { -- int expected_count = folio_expected_refs(mapping, folio) + extra_count; -+ int expected_count = folio_expected_ref_count(folio) + extra_count + 1; - - if (folio_ref_count(folio) != expected_count) - return -EAGAIN; -@@ -618,7 +604,7 @@ int migrate_huge_page_move_mapping(struc - struct folio *dst, struct folio *src) - { - XA_STATE(xas, &mapping->i_pages, folio_index(src)); -- int rc, expected_count = folio_expected_refs(mapping, src); -+ int rc, expected_count = folio_expected_ref_count(src) + 1; - - if (folio_ref_count(src) != expected_count) - return -EAGAIN; -@@ -749,7 +735,7 @@ static int __migrate_folio(struct addres - struct folio *src, void *src_private, - enum migrate_mode mode) - { -- int rc, expected_count = folio_expected_refs(mapping, src); -+ int rc, expected_count = folio_expected_ref_count(src) + 1; - - /* Check whether src does not have extra refs before we do more work */ - if (folio_ref_count(src) != expected_count) -@@ -837,7 +823,7 @@ static int __buffer_migrate_folio(struct - return migrate_folio(mapping, dst, src, mode); - - /* Check whether page does not have extra refs before we do more work */ -- expected_count = folio_expected_refs(mapping, src); -+ expected_count = folio_expected_ref_count(src) + 1; - if (folio_ref_count(src) != expected_count) - return -EAGAIN; - diff --git a/debian/patches/patchset-pf/fixes/0006-drm-i915-snps_hdmi_pll-Fix-64-bit-divisor-truncation.patch b/debian/patches/patchset-pf/fixes/0006-drm-i915-snps_hdmi_pll-Fix-64-bit-divisor-truncation.patch deleted file mode 100644 index dbd0097..0000000 --- a/debian/patches/patchset-pf/fixes/0006-drm-i915-snps_hdmi_pll-Fix-64-bit-divisor-truncation.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 3d1a493525955678c231ab7ccf0950c0ba2b9f45 Mon Sep 17 00:00:00 2001 -From: Ankit Nautiyal -Date: Fri, 13 Jun 2025 11:42:46 +0530 -Subject: drm/i915/snps_hdmi_pll: Fix 64-bit divisor truncation by using - div64_u64 - -DIV_ROUND_CLOSEST_ULL uses do_div(), which expects a 32-bit divisor. -When passing a 64-bit constant like CURVE2_MULTIPLIER, the value is -silently truncated to u32, potentially leading to incorrect results -on large divisors. - -Replace DIV_ROUND_CLOSEST_ULL with div64_u64(), which correctly -handles full 64-bit division. Since the result is clamped between -1 and 127, rounding is unnecessary and truncating division -is sufficient. - -Fixes: 5947642004bf ("drm/i915/display: Add support for SNPS PHY HDMI PLL algorithm for DG2") -Cc: Ankit Nautiyal -Cc: Suraj Kandpal -Cc: Jani Nikula -Cc: # v6.15+ -Signed-off-by: Ankit Nautiyal -Cherry-picked-for: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/145 ---- - drivers/gpu/drm/i915/display/intel_snps_hdmi_pll.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/gpu/drm/i915/display/intel_snps_hdmi_pll.c -+++ b/drivers/gpu/drm/i915/display/intel_snps_hdmi_pll.c -@@ -103,8 +103,8 @@ static void get_ana_cp_int_prop(u64 vco_ - DIV_ROUND_DOWN_ULL(curve_1_interpolated, CURVE0_MULTIPLIER))); - - ana_cp_int_temp = -- DIV64_U64_ROUND_CLOSEST(DIV_ROUND_DOWN_ULL(adjusted_vco_clk1, curve_2_scaled1), -- CURVE2_MULTIPLIER); -+ div64_u64(DIV_ROUND_DOWN_ULL(adjusted_vco_clk1, curve_2_scaled1), -+ CURVE2_MULTIPLIER); - - *ana_cp_int = max(1, min(ana_cp_int_temp, 127)); - diff --git a/debian/patches/patchset-pf/fixes/0007-mm-compaction-use-folio-in-hugetlb-pathway.patch b/debian/patches/patchset-pf/fixes/0007-mm-compaction-use-folio-in-hugetlb-pathway.patch deleted file mode 100644 index d9c7e5c..0000000 --- a/debian/patches/patchset-pf/fixes/0007-mm-compaction-use-folio-in-hugetlb-pathway.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 336152e6ec30b13f5617ee9b702beb5bc310c6a7 Mon Sep 17 00:00:00 2001 -From: "Vishal Moola (Oracle)" -Date: Mon, 31 Mar 2025 19:10:25 -0700 -Subject: mm/compaction: use folio in hugetlb pathway - -Use a folio in the hugetlb pathway during the compaction migrate-able -pageblock scan. - -This removes a call to compound_head(). - -Link: https://lkml.kernel.org/r/20250401021025.637333-2-vishal.moola@gmail.com -Signed-off-by: Vishal Moola (Oracle) -Acked-by: Oscar Salvador -Reviewed-by: Zi Yan -Cc: Muchun Song -Signed-off-by: Andrew Morton ---- - include/linux/hugetlb.h | 4 ++-- - mm/compaction.c | 8 ++++---- - mm/hugetlb.c | 3 +-- - 3 files changed, 7 insertions(+), 8 deletions(-) - ---- a/include/linux/hugetlb.h -+++ b/include/linux/hugetlb.h -@@ -703,7 +703,7 @@ struct huge_bootmem_page { - - bool hugetlb_bootmem_page_zones_valid(int nid, struct huge_bootmem_page *m); - --int isolate_or_dissolve_huge_page(struct page *page, struct list_head *list); -+int isolate_or_dissolve_huge_folio(struct folio *folio, struct list_head *list); - int replace_free_hugepage_folios(unsigned long start_pfn, unsigned long end_pfn); - void wait_for_freed_hugetlb_folios(void); - struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma, -@@ -1091,7 +1091,7 @@ static inline struct folio *filemap_lock - return NULL; - } - --static inline int isolate_or_dissolve_huge_page(struct page *page, -+static inline int isolate_or_dissolve_huge_folio(struct folio *folio, - struct list_head *list) - { - return -ENOMEM; ---- a/mm/compaction.c -+++ b/mm/compaction.c -@@ -1001,10 +1001,11 @@ isolate_migratepages_block(struct compac - locked = NULL; - } - -- ret = isolate_or_dissolve_huge_page(page, &cc->migratepages); -+ folio = page_folio(page); -+ ret = isolate_or_dissolve_huge_folio(folio, &cc->migratepages); - - /* -- * Fail isolation in case isolate_or_dissolve_huge_page() -+ * Fail isolation in case isolate_or_dissolve_huge_folio() - * reports an error. In case of -ENOMEM, abort right away. - */ - if (ret < 0) { -@@ -1016,12 +1017,11 @@ isolate_migratepages_block(struct compac - goto isolate_fail; - } - -- if (PageHuge(page)) { -+ if (folio_test_hugetlb(folio)) { - /* - * Hugepage was successfully isolated and placed - * on the cc->migratepages list. - */ -- folio = page_folio(page); - low_pfn += folio_nr_pages(folio) - 1; - goto isolate_success_no_list; - } ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2896,10 +2896,9 @@ free_new: - return ret; - } - --int isolate_or_dissolve_huge_page(struct page *page, struct list_head *list) -+int isolate_or_dissolve_huge_folio(struct folio *folio, struct list_head *list) - { - struct hstate *h; -- struct folio *folio = page_folio(page); - int ret = -EBUSY; - - /* diff --git a/debian/patches/patchset-pf/fixes/0008-mm-hugetlb-remove-unnecessary-holding-of-hugetlb_loc.patch b/debian/patches/patchset-pf/fixes/0008-mm-hugetlb-remove-unnecessary-holding-of-hugetlb_loc.patch deleted file mode 100644 index 4deec12..0000000 --- a/debian/patches/patchset-pf/fixes/0008-mm-hugetlb-remove-unnecessary-holding-of-hugetlb_loc.patch +++ /dev/null @@ -1,154 +0,0 @@ -From 2e50b415d59dda319bb3208c5ed5234a23f307e9 Mon Sep 17 00:00:00 2001 -From: Ge Yang -Date: Tue, 27 May 2025 11:36:50 +0800 -Subject: mm/hugetlb: remove unnecessary holding of hugetlb_lock - -In isolate_or_dissolve_huge_folio(), after acquiring the hugetlb_lock, it -is only for the purpose of obtaining the correct hstate, which is then -passed to alloc_and_dissolve_hugetlb_folio(). - -alloc_and_dissolve_hugetlb_folio() itself also acquires the hugetlb_lock. -We can have alloc_and_dissolve_hugetlb_folio() obtain the hstate by -itself, so that isolate_or_dissolve_huge_folio() no longer needs to -acquire the hugetlb_lock. In addition, we keep the folio_test_hugetlb() -check within isolate_or_dissolve_huge_folio(). By doing so, we can avoid -disrupting the normal path by vainly holding the hugetlb_lock. - -replace_free_hugepage_folios() has the same issue, and we should address -it as well. - -Addresses a possible performance problem which was added by the hotfix -113ed54ad276 ("mm/hugetlb: fix kernel NULL pointer dereference when -replacing free hugetlb folios"). - -Link: https://lkml.kernel.org/r/1748317010-16272-1-git-send-email-yangge1116@126.com -Fixes: 113ed54ad276 ("mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios") -Signed-off-by: Ge Yang -Suggested-by: Oscar Salvador -Reviewed-by: Muchun Song -Cc: Baolin Wang -Cc: Barry Song <21cnbao@gmail.com> -Cc: David Hildenbrand -Cc: -Signed-off-by: Andrew Morton ---- - mm/hugetlb.c | 54 +++++++++++++++++----------------------------------- - 1 file changed, 17 insertions(+), 37 deletions(-) - ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2811,20 +2811,24 @@ void restore_reserve_on_error(struct hst - /* - * alloc_and_dissolve_hugetlb_folio - Allocate a new folio and dissolve - * the old one -- * @h: struct hstate old page belongs to - * @old_folio: Old folio to dissolve - * @list: List to isolate the page in case we need to - * Returns 0 on success, otherwise negated error. - */ --static int alloc_and_dissolve_hugetlb_folio(struct hstate *h, -- struct folio *old_folio, struct list_head *list) -+static int alloc_and_dissolve_hugetlb_folio(struct folio *old_folio, -+ struct list_head *list) - { -- gfp_t gfp_mask = htlb_alloc_mask(h) | __GFP_THISNODE; -+ gfp_t gfp_mask; -+ struct hstate *h; - int nid = folio_nid(old_folio); - struct folio *new_folio = NULL; - int ret = 0; - - retry: -+ /* -+ * The old_folio might have been dissolved from under our feet, so make sure -+ * to carefully check the state under the lock. -+ */ - spin_lock_irq(&hugetlb_lock); - if (!folio_test_hugetlb(old_folio)) { - /* -@@ -2853,8 +2857,10 @@ retry: - cond_resched(); - goto retry; - } else { -+ h = folio_hstate(old_folio); - if (!new_folio) { - spin_unlock_irq(&hugetlb_lock); -+ gfp_mask = htlb_alloc_mask(h) | __GFP_THISNODE; - new_folio = alloc_buddy_hugetlb_folio(h, gfp_mask, nid, - NULL, NULL); - if (!new_folio) -@@ -2898,35 +2904,24 @@ free_new: - - int isolate_or_dissolve_huge_folio(struct folio *folio, struct list_head *list) - { -- struct hstate *h; - int ret = -EBUSY; - -- /* -- * The page might have been dissolved from under our feet, so make sure -- * to carefully check the state under the lock. -- * Return success when racing as if we dissolved the page ourselves. -- */ -- spin_lock_irq(&hugetlb_lock); -- if (folio_test_hugetlb(folio)) { -- h = folio_hstate(folio); -- } else { -- spin_unlock_irq(&hugetlb_lock); -+ /* Not to disrupt normal path by vainly holding hugetlb_lock */ -+ if (!folio_test_hugetlb(folio)) - return 0; -- } -- spin_unlock_irq(&hugetlb_lock); - - /* - * Fence off gigantic pages as there is a cyclic dependency between - * alloc_contig_range and them. Return -ENOMEM as this has the effect - * of bailing out right away without further retrying. - */ -- if (hstate_is_gigantic(h)) -+ if (folio_order(folio) > MAX_PAGE_ORDER) - return -ENOMEM; - - if (folio_ref_count(folio) && folio_isolate_hugetlb(folio, list)) - ret = 0; - else if (!folio_ref_count(folio)) -- ret = alloc_and_dissolve_hugetlb_folio(h, folio, list); -+ ret = alloc_and_dissolve_hugetlb_folio(folio, list); - - return ret; - } -@@ -2940,7 +2935,6 @@ int isolate_or_dissolve_huge_folio(struc - */ - int replace_free_hugepage_folios(unsigned long start_pfn, unsigned long end_pfn) - { -- struct hstate *h; - struct folio *folio; - int ret = 0; - -@@ -2949,23 +2943,9 @@ int replace_free_hugepage_folios(unsigne - while (start_pfn < end_pfn) { - folio = pfn_folio(start_pfn); - -- /* -- * The folio might have been dissolved from under our feet, so make sure -- * to carefully check the state under the lock. -- */ -- spin_lock_irq(&hugetlb_lock); -- if (folio_test_hugetlb(folio)) { -- h = folio_hstate(folio); -- } else { -- spin_unlock_irq(&hugetlb_lock); -- start_pfn++; -- continue; -- } -- spin_unlock_irq(&hugetlb_lock); -- -- if (!folio_ref_count(folio)) { -- ret = alloc_and_dissolve_hugetlb_folio(h, folio, -- &isolate_list); -+ /* Not to disrupt normal path by vainly holding hugetlb_lock */ -+ if (folio_test_hugetlb(folio) && !folio_ref_count(folio)) { -+ ret = alloc_and_dissolve_hugetlb_folio(folio, &isolate_list); - if (ret) - break; - diff --git a/debian/patches/patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch b/debian/patches/patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch deleted file mode 100644 index eff552c..0000000 --- a/debian/patches/patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch +++ /dev/null @@ -1,136 +0,0 @@ -From b885aa903c313644f7ba8d46d4c09ead1b52f1f1 Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Tue, 1 Jul 2025 17:38:38 +0100 -Subject: netfs: Provide helpers to perform NETFS_RREQ_IN_PROGRESS flag - wangling - -Provide helpers to clear and test the NETFS_RREQ_IN_PROGRESS and to insert -the appropriate barrierage. - -Signed-off-by: David Howells -Link: https://lore.kernel.org/20250701163852.2171681-4-dhowells@redhat.com -Tested-by: Steve French -Reviewed-by: Paulo Alcantara -cc: netfs@lists.linux.dev -cc: linux-fsdevel@vger.kernel.org -Signed-off-by: Christian Brauner ---- - fs/netfs/internal.h | 18 ++++++++++++++++++ - fs/netfs/misc.c | 10 +++++----- - fs/netfs/read_collect.c | 4 ++-- - fs/netfs/write_collect.c | 4 ++-- - 4 files changed, 27 insertions(+), 9 deletions(-) - ---- a/fs/netfs/internal.h -+++ b/fs/netfs/internal.h -@@ -275,6 +275,24 @@ static inline void netfs_wake_rreq_flag( - } - - /* -+ * Test the NETFS_RREQ_IN_PROGRESS flag, inserting an appropriate barrier. -+ */ -+static inline bool netfs_check_rreq_in_progress(const struct netfs_io_request *rreq) -+{ -+ /* Order read of flags before read of anything else, such as error. */ -+ return test_bit_acquire(NETFS_RREQ_IN_PROGRESS, &rreq->flags); -+} -+ -+/* -+ * Test the NETFS_SREQ_IN_PROGRESS flag, inserting an appropriate barrier. -+ */ -+static inline bool netfs_check_subreq_in_progress(const struct netfs_io_subrequest *subreq) -+{ -+ /* Order read of flags before read of anything else, such as error. */ -+ return test_bit_acquire(NETFS_SREQ_IN_PROGRESS, &subreq->flags); -+} -+ -+/* - * fscache-cache.c - */ - #ifdef CONFIG_PROC_FS ---- a/fs/netfs/misc.c -+++ b/fs/netfs/misc.c -@@ -356,14 +356,14 @@ void netfs_wait_for_in_progress_stream(s - DEFINE_WAIT(myself); - - list_for_each_entry(subreq, &stream->subrequests, rreq_link) { -- if (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags)) -+ if (!netfs_check_subreq_in_progress(subreq)) - continue; - - trace_netfs_rreq(rreq, netfs_rreq_trace_wait_queue); - for (;;) { - prepare_to_wait(&rreq->waitq, &myself, TASK_UNINTERRUPTIBLE); - -- if (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags)) -+ if (!netfs_check_subreq_in_progress(subreq)) - break; - - trace_netfs_sreq(subreq, netfs_sreq_trace_wait_for); -@@ -400,7 +400,7 @@ static int netfs_collect_in_app(struct n - struct netfs_io_subrequest, - rreq_link); - if (subreq && -- (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags) || -+ (!netfs_check_subreq_in_progress(subreq) || - test_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags))) { - need_collect = true; - break; -@@ -454,7 +454,7 @@ static ssize_t netfs_wait_for_in_progres - } - } - -- if (!test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags)) -+ if (!netfs_check_rreq_in_progress(rreq)) - break; - - schedule(); -@@ -525,7 +525,7 @@ static void netfs_wait_for_pause(struct - } - } - -- if (!test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags) || -+ if (!netfs_check_rreq_in_progress(rreq) || - !test_bit(NETFS_RREQ_PAUSE, &rreq->flags)) - break; - ---- a/fs/netfs/read_collect.c -+++ b/fs/netfs/read_collect.c -@@ -220,7 +220,7 @@ reassess: - stream->collected_to = front->start; - } - -- if (test_bit(NETFS_SREQ_IN_PROGRESS, &front->flags)) -+ if (netfs_check_subreq_in_progress(front)) - notes |= HIT_PENDING; - smp_rmb(); /* Read counters after IN_PROGRESS flag. */ - transferred = READ_ONCE(front->transferred); -@@ -447,7 +447,7 @@ void netfs_read_collection_worker(struct - struct netfs_io_request *rreq = container_of(work, struct netfs_io_request, work); - - netfs_see_request(rreq, netfs_rreq_trace_see_work); -- if (test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags)) { -+ if (netfs_check_rreq_in_progress(rreq)) { - if (netfs_read_collection(rreq)) - /* Drop the ref from the IN_PROGRESS flag. */ - netfs_put_request(rreq, netfs_rreq_trace_put_work_ip); ---- a/fs/netfs/write_collect.c -+++ b/fs/netfs/write_collect.c -@@ -240,7 +240,7 @@ reassess_streams: - } - - /* Stall if the front is still undergoing I/O. */ -- if (test_bit(NETFS_SREQ_IN_PROGRESS, &front->flags)) { -+ if (netfs_check_subreq_in_progress(front)) { - notes |= HIT_PENDING; - break; - } -@@ -434,7 +434,7 @@ void netfs_write_collection_worker(struc - struct netfs_io_request *rreq = container_of(work, struct netfs_io_request, work); - - netfs_see_request(rreq, netfs_rreq_trace_see_work); -- if (test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags)) { -+ if (netfs_check_rreq_in_progress(rreq)) { - if (netfs_write_collection(rreq)) - /* Drop the ref from the IN_PROGRESS flag. */ - netfs_put_request(rreq, netfs_rreq_trace_put_work_ip); diff --git a/debian/patches/patchset-pf/kbuild/0001-ice-mark-ice_write_prof_mask_reg-as-noinline.patch b/debian/patches/patchset-pf/kbuild/0001-ice-mark-ice_write_prof_mask_reg-as-noinline.patch index 596976c..ff2c017 100644 --- a/debian/patches/patchset-pf/kbuild/0001-ice-mark-ice_write_prof_mask_reg-as-noinline.patch +++ b/debian/patches/patchset-pf/kbuild/0001-ice-mark-ice_write_prof_mask_reg-as-noinline.patch @@ -1,4 +1,4 @@ -From 3400d11fad849dae6015e448c83d6e90f8a6ef35 Mon Sep 17 00:00:00 2001 +From cb67be41cf8b19fed3b1cc08a42417aa1c7550e0 Mon Sep 17 00:00:00 2001 From: Oleksandr Natalenko Date: Tue, 8 Apr 2025 12:02:36 +0200 Subject: ice: mark ice_write_prof_mask_reg() as noinline diff --git a/debian/patches/patchset-pf/kbuild/0002-wifi-mac80211-mark-copy_mesh_setup-as-noinline.patch b/debian/patches/patchset-pf/kbuild/0002-wifi-mac80211-mark-copy_mesh_setup-as-noinline.patch index 83e9064..9a489f7 100644 --- a/debian/patches/patchset-pf/kbuild/0002-wifi-mac80211-mark-copy_mesh_setup-as-noinline.patch +++ b/debian/patches/patchset-pf/kbuild/0002-wifi-mac80211-mark-copy_mesh_setup-as-noinline.patch @@ -1,4 +1,4 @@ -From 1615cc0c7d979a1c211f349c8c28ee8afb9ad57d Mon Sep 17 00:00:00 2001 +From a3c672256ccc59b07f007b569e1e7507b0a82dce Mon Sep 17 00:00:00 2001 From: Oleksandr Natalenko Date: Thu, 1 May 2025 20:22:53 +0200 Subject: wifi: mac80211: mark copy_mesh_setup() as noinline @@ -24,7 +24,7 @@ Signed-off-by: Oleksandr Natalenko --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c -@@ -2515,7 +2515,7 @@ static inline bool _chg_mesh_attr(enum n +@@ -2539,7 +2539,7 @@ static inline bool _chg_mesh_attr(enum n return (mask >> (parm-1)) & 0x1; } diff --git a/debian/patches/patchset-pf/steady/0001-PCI-Fix-link-speed-calculation-on-retrain-failure.patch b/debian/patches/patchset-pf/steady/0001-PCI-Fix-link-speed-calculation-on-retrain-failure.patch new file mode 100644 index 0000000..d373797 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0001-PCI-Fix-link-speed-calculation-on-retrain-failure.patch @@ -0,0 +1,91 @@ +From e9efb8c2e0d662c1d28a95732f0a085e81c365ab Mon Sep 17 00:00:00 2001 +From: Jiwei Sun +Date: Thu, 23 Jan 2025 13:51:54 +0800 +Subject: PCI: Fix link speed calculation on retrain failure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When pcie_failed_link_retrain() fails to retrain, it tries to revert to the +previous link speed. However it calculates that speed from the Link +Control 2 register without masking out non-speed bits first. + +PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to +PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in +pcie_set_target_speed(): + + pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port + pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s + pci 0000:00:01.1: retraining failed + WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed + RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000 + pcie_failed_link_retrain + pci_device_add + pci_scan_single_device + +Mask out the non-speed bits in PCIE_LNKCTL2_TLS2SPEED() and +PCIE_LNKCAP_SLS2SPEED() so they don't incorrectly return PCI_SPEED_UNKNOWN. + +Fixes: de9a6c8d5dbf ("PCI/bwctrl: Add pcie_set_target_speed() to set PCIe Link Speed") +Reported-by: Andrew +Closes: https://lore.kernel.org/r/7iNzXbCGpf8yUMJZBQjLdbjPcXrEJqBxy5-bHfppz0ek-h4_-G93b1KUrm106r2VNF2FV_sSq0nENv4RsRIUGnlYZMlQr2ZD2NyB5sdj5aU=@protonmail.com/ +Suggested-by: Maciej W. Rozycki +Suggested-by: Ilpo Järvinen +Signed-off-by: Jiwei Sun +[bhelgaas: commit log, add details from https://lore.kernel.org/r/1c92ef6bcb314ee6977839b46b393282e4f52e74.1750684771.git.lukas@wunner.de] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Ilpo Järvinen +Cc: stable@vger.kernel.org # v6.13+ +Link: https://patch.msgid.link/20250123055155.22648-2-sjiwei@163.com +--- + drivers/pci/pci.h | 32 +++++++++++++++++++------------- + 1 file changed, 19 insertions(+), 13 deletions(-) + +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -391,12 +391,14 @@ void pci_bus_put(struct pci_bus *bus); + + #define PCIE_LNKCAP_SLS2SPEED(lnkcap) \ + ({ \ +- ((lnkcap) == PCI_EXP_LNKCAP_SLS_64_0GB ? PCIE_SPEED_64_0GT : \ +- (lnkcap) == PCI_EXP_LNKCAP_SLS_32_0GB ? PCIE_SPEED_32_0GT : \ +- (lnkcap) == PCI_EXP_LNKCAP_SLS_16_0GB ? PCIE_SPEED_16_0GT : \ +- (lnkcap) == PCI_EXP_LNKCAP_SLS_8_0GB ? PCIE_SPEED_8_0GT : \ +- (lnkcap) == PCI_EXP_LNKCAP_SLS_5_0GB ? PCIE_SPEED_5_0GT : \ +- (lnkcap) == PCI_EXP_LNKCAP_SLS_2_5GB ? PCIE_SPEED_2_5GT : \ ++ u32 lnkcap_sls = (lnkcap) & PCI_EXP_LNKCAP_SLS; \ ++ \ ++ (lnkcap_sls == PCI_EXP_LNKCAP_SLS_64_0GB ? PCIE_SPEED_64_0GT : \ ++ lnkcap_sls == PCI_EXP_LNKCAP_SLS_32_0GB ? PCIE_SPEED_32_0GT : \ ++ lnkcap_sls == PCI_EXP_LNKCAP_SLS_16_0GB ? PCIE_SPEED_16_0GT : \ ++ lnkcap_sls == PCI_EXP_LNKCAP_SLS_8_0GB ? PCIE_SPEED_8_0GT : \ ++ lnkcap_sls == PCI_EXP_LNKCAP_SLS_5_0GB ? PCIE_SPEED_5_0GT : \ ++ lnkcap_sls == PCI_EXP_LNKCAP_SLS_2_5GB ? PCIE_SPEED_2_5GT : \ + PCI_SPEED_UNKNOWN); \ + }) + +@@ -411,13 +413,17 @@ void pci_bus_put(struct pci_bus *bus); + PCI_SPEED_UNKNOWN) + + #define PCIE_LNKCTL2_TLS2SPEED(lnkctl2) \ +- ((lnkctl2) == PCI_EXP_LNKCTL2_TLS_64_0GT ? PCIE_SPEED_64_0GT : \ +- (lnkctl2) == PCI_EXP_LNKCTL2_TLS_32_0GT ? PCIE_SPEED_32_0GT : \ +- (lnkctl2) == PCI_EXP_LNKCTL2_TLS_16_0GT ? PCIE_SPEED_16_0GT : \ +- (lnkctl2) == PCI_EXP_LNKCTL2_TLS_8_0GT ? PCIE_SPEED_8_0GT : \ +- (lnkctl2) == PCI_EXP_LNKCTL2_TLS_5_0GT ? PCIE_SPEED_5_0GT : \ +- (lnkctl2) == PCI_EXP_LNKCTL2_TLS_2_5GT ? PCIE_SPEED_2_5GT : \ +- PCI_SPEED_UNKNOWN) ++({ \ ++ u16 lnkctl2_tls = (lnkctl2) & PCI_EXP_LNKCTL2_TLS; \ ++ \ ++ (lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_64_0GT ? PCIE_SPEED_64_0GT : \ ++ lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_32_0GT ? PCIE_SPEED_32_0GT : \ ++ lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_16_0GT ? PCIE_SPEED_16_0GT : \ ++ lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_8_0GT ? PCIE_SPEED_8_0GT : \ ++ lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_5_0GT ? PCIE_SPEED_5_0GT : \ ++ lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_2_5GT ? PCIE_SPEED_2_5GT : \ ++ PCI_SPEED_UNKNOWN); \ ++}) + + /* PCIe speed to Mb/s reduced by encoding overhead */ + #define PCIE_SPEED2MBS_ENC(speed) \ diff --git a/debian/patches/patchset-pf/steady/0002-PCI-endpoint-Fix-configfs-group-list-head-handling.patch b/debian/patches/patchset-pf/steady/0002-PCI-endpoint-Fix-configfs-group-list-head-handling.patch new file mode 100644 index 0000000..862350c --- /dev/null +++ b/debian/patches/patchset-pf/steady/0002-PCI-endpoint-Fix-configfs-group-list-head-handling.patch @@ -0,0 +1,57 @@ +From ab8a3c32946686d57d720dc4a1b23635fb4a39bd Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Tue, 24 Jun 2025 20:45:43 +0900 +Subject: PCI: endpoint: Fix configfs group list head handling + +Doing a list_del() on the epf_group field of struct pci_epf_driver in +pci_epf_remove_cfs() is not correct as this field is a list head, not +a list entry. This list_del() call triggers a KASAN warning when an +endpoint function driver which has a configfs attribute group is torn +down: + +================================================================== +BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 +Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 + +CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE +Hardware name: Radxa ROCK 5B (DT) +Call trace: +show_stack+0x2c/0x84 (C) +dump_stack_lvl+0x70/0x98 +print_report+0x17c/0x538 +kasan_report+0xb8/0x190 +__asan_report_store8_noabort+0x20/0x2c +pci_epf_remove_cfs+0x17c/0x198 +pci_epf_unregister_driver+0x18/0x30 +nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] +__arm64_sys_delete_module+0x264/0x424 +invoke_syscall+0x70/0x260 +el0_svc_common.constprop.0+0xac/0x230 +do_el0_svc+0x40/0x58 +el0_svc+0x48/0xdc +el0t_64_sync_handler+0x10c/0x138 +el0t_64_sync+0x198/0x19c +... + +Remove this incorrect list_del() call from pci_epf_remove_cfs(). + +Fixes: ef1433f717a2 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry") +Signed-off-by: Damien Le Moal +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Niklas Cassel +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250624114544.342159-2-dlemoal@kernel.org +--- + drivers/pci/endpoint/pci-epf-core.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/pci/endpoint/pci-epf-core.c ++++ b/drivers/pci/endpoint/pci-epf-core.c +@@ -338,7 +338,6 @@ static void pci_epf_remove_cfs(struct pc + mutex_lock(&pci_epf_mutex); + list_for_each_entry_safe(group, tmp, &driver->epf_group, group_entry) + pci_ep_cfs_remove_epf_group(group); +- list_del(&driver->epf_group); + mutex_unlock(&pci_epf_mutex); + } + diff --git a/debian/patches/patchset-pf/steady/0003-PCI-endpoint-Fix-configfs-group-removal-on-driver-te.patch b/debian/patches/patchset-pf/steady/0003-PCI-endpoint-Fix-configfs-group-removal-on-driver-te.patch new file mode 100644 index 0000000..908246d --- /dev/null +++ b/debian/patches/patchset-pf/steady/0003-PCI-endpoint-Fix-configfs-group-removal-on-driver-te.patch @@ -0,0 +1,48 @@ +From ac49c252132396b1910ea5aad0541f550c55679c Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Tue, 24 Jun 2025 20:45:44 +0900 +Subject: PCI: endpoint: Fix configfs group removal on driver teardown + +An endpoint driver configfs attributes group is added to the +epf_group list of struct pci_epf_driver by pci_epf_add_cfs() but an +added group is not removed from this list when the attribute group is +unregistered with pci_ep_cfs_remove_epf_group(). + +Add the missing list_del() call in pci_ep_cfs_remove_epf_group() +to correctly remove the attribute group from the driver list. + +With this change, once the loop over all attribute groups in +pci_epf_remove_cfs() completes, the driver epf_group list should be +empty. Add a WARN_ON() to make sure of that. + +Fixes: ef1433f717a2 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry") +Signed-off-by: Damien Le Moal +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Niklas Cassel +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250624114544.342159-3-dlemoal@kernel.org +--- + drivers/pci/endpoint/pci-ep-cfs.c | 1 + + drivers/pci/endpoint/pci-epf-core.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/pci/endpoint/pci-ep-cfs.c ++++ b/drivers/pci/endpoint/pci-ep-cfs.c +@@ -691,6 +691,7 @@ void pci_ep_cfs_remove_epf_group(struct + if (IS_ERR_OR_NULL(group)) + return; + ++ list_del(&group->group_entry); + configfs_unregister_default_group(group); + } + EXPORT_SYMBOL(pci_ep_cfs_remove_epf_group); +--- a/drivers/pci/endpoint/pci-epf-core.c ++++ b/drivers/pci/endpoint/pci-epf-core.c +@@ -338,6 +338,7 @@ static void pci_epf_remove_cfs(struct pc + mutex_lock(&pci_epf_mutex); + list_for_each_entry_safe(group, tmp, &driver->epf_group, group_entry) + pci_ep_cfs_remove_epf_group(group); ++ WARN_ON(!list_empty(&driver->epf_group)); + mutex_unlock(&pci_epf_mutex); + } + diff --git a/debian/patches/patchset-pf/steady/0004-media-v4l2-ctrls-Don-t-reset-handler-s-error-in-v4l2.patch b/debian/patches/patchset-pf/steady/0004-media-v4l2-ctrls-Don-t-reset-handler-s-error-in-v4l2.patch new file mode 100644 index 0000000..a337796 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0004-media-v4l2-ctrls-Don-t-reset-handler-s-error-in-v4l2.patch @@ -0,0 +1,40 @@ +From bb8fada608c868a04288371c76dd387bb9ce5101 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Thu, 8 May 2025 18:55:38 +0300 +Subject: media: v4l2-ctrls: Don't reset handler's error in + v4l2_ctrl_handler_free() + +It's a common pattern in drivers to free the control handler's resources +and then return the handler's error code on drivers' error handling paths. +Alas, the v4l2_ctrl_handler_free() function also zeroes the error field, +effectively indicating successful return to the caller. + +There's no apparent need to touch the error field while releasing the +control handler's resources and cleaning up stale pointers. Not touching +the handler's error field is a more certain way to address this problem +than changing all the users, in which case the pattern would be likely to +re-emerge in new drivers. + +Do just that, don't touch the control handler's error field in +v4l2_ctrl_handler_free(). + +Fixes: 0996517cf8ea ("V4L/DVB: v4l2: Add new control handling framework") +Cc: stable@vger.kernel.org +Signed-off-by: Sakari Ailus +Reviewed-by: Hans Verkuil +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +--- + drivers/media/v4l2-core/v4l2-ctrls-core.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c +@@ -1661,7 +1661,6 @@ void v4l2_ctrl_handler_free(struct v4l2_ + kvfree(hdl->buckets); + hdl->buckets = NULL; + hdl->cached = NULL; +- hdl->error = 0; + mutex_unlock(hdl->lock); + mutex_destroy(&hdl->_lock); + } diff --git a/debian/patches/patchset-pf/steady/0005-dm-dm-crypt-Do-not-partially-accept-write-BIOs-with-.patch b/debian/patches/patchset-pf/steady/0005-dm-dm-crypt-Do-not-partially-accept-write-BIOs-with-.patch new file mode 100644 index 0000000..746eed6 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0005-dm-dm-crypt-Do-not-partially-accept-write-BIOs-with-.patch @@ -0,0 +1,145 @@ +From e90295abea9dd31f84e7784e19e988be0dfcfb83 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Wed, 25 Jun 2025 18:33:26 +0900 +Subject: dm: dm-crypt: Do not partially accept write BIOs with zoned targets + +Read and write operations issued to a dm-crypt target may be split +according to the dm-crypt internal limits defined by the max_read_size +and max_write_size module parameters (default is 128 KB). The intent is +to improve processing time of large BIOs by splitting them into smaller +operations that can be parallelized on different CPUs. + +For zoned dm-crypt targets, this BIO splitting is still done but without +the parallel execution to ensure that the issuing order of write +operations to the underlying devices remains sequential. However, the +splitting itself causes other problems: + +1) Since dm-crypt relies on the block layer zone write plugging to + handle zone append emulation using regular write operations, the + reminder of a split write BIO will always be plugged into the target + zone write plugged. Once the on-going write BIO finishes, this + reminder BIO is unplugged and issued from the zone write plug work. + If this reminder BIO itself needs to be split, the reminder will be + re-issued and plugged again, but that causes a call to a + blk_queue_enter(), which may block if a queue freeze operation was + initiated. This results in a deadlock as DM submission still holds + BIOs that the queue freeze side is waiting for. + +2) dm-crypt relies on the emulation done by the block layer using + regular write operations for processing zone append operations. This + still requires to properly return the written sector as the BIO + sector of the original BIO. However, this can be done correctly only + and only if there is a single clone BIO used for processing the + original zone append operation issued by the user. If the size of a + zone append operation is larger than dm-crypt max_write_size, then + the orginal BIO will be split and processed as a chain of regular + write operations. Such chaining result in an incorrect written sector + being returned to the zone append issuer using the original BIO + sector. This in turn results in file system data corruptions using + xfs or btrfs. + +Fix this by modifying get_max_request_size() to always return the size +of the BIO to avoid it being split with dm_accpet_partial_bio() in +crypt_map(). get_max_request_size() is renamed to +get_max_request_sectors() to clarify the unit of the value returned +and its interface is changed to take a struct dm_target pointer and a +pointer to the struct bio being processed. In addition to this change, +to ensure that crypt_alloc_buffer() works correctly, set the dm-crypt +device max_hw_sectors limit to be at most +BIO_MAX_VECS << PAGE_SECTORS_SHIFT (1 MB with a 4KB page architecture). +This forces DM core to split write BIOs before passing them to +crypt_map(), and thus guaranteeing that dm-crypt can always accept an +entire write BIO without needing to split it. + +This change does not have any effect on the read path of dm-crypt. Read +operations can still be split and the BIO fragments processed in +parallel. There is also no impact on the performance of the write path +given that all zone write BIOs were already processed inline instead of +in parallel. + +This change also does not affect in any way regular dm-crypt block +devices. + +Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Mikulas Patocka +Link: https://lore.kernel.org/r/20250625093327.548866-5-dlemoal@kernel.org +Signed-off-by: Jens Axboe +--- + drivers/md/dm-crypt.c | 49 ++++++++++++++++++++++++++++++++++--------- + 1 file changed, 39 insertions(+), 10 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -253,17 +253,35 @@ MODULE_PARM_DESC(max_read_size, "Maximum + static unsigned int max_write_size = 0; + module_param(max_write_size, uint, 0644); + MODULE_PARM_DESC(max_write_size, "Maximum size of a write request"); +-static unsigned get_max_request_size(struct crypt_config *cc, bool wrt) ++ ++static unsigned get_max_request_sectors(struct dm_target *ti, struct bio *bio) + { ++ struct crypt_config *cc = ti->private; + unsigned val, sector_align; +- val = !wrt ? READ_ONCE(max_read_size) : READ_ONCE(max_write_size); +- if (likely(!val)) +- val = !wrt ? DM_CRYPT_DEFAULT_MAX_READ_SIZE : DM_CRYPT_DEFAULT_MAX_WRITE_SIZE; +- if (wrt || cc->used_tag_size) { +- if (unlikely(val > BIO_MAX_VECS << PAGE_SHIFT)) +- val = BIO_MAX_VECS << PAGE_SHIFT; ++ bool wrt = op_is_write(bio_op(bio)); ++ ++ if (wrt) { ++ /* ++ * For zoned devices, splitting write operations creates the ++ * risk of deadlocking queue freeze operations with zone write ++ * plugging BIO work when the reminder of a split BIO is ++ * issued. So always allow the entire BIO to proceed. ++ */ ++ if (ti->emulate_zone_append) ++ return bio_sectors(bio); ++ ++ val = min_not_zero(READ_ONCE(max_write_size), ++ DM_CRYPT_DEFAULT_MAX_WRITE_SIZE); ++ } else { ++ val = min_not_zero(READ_ONCE(max_read_size), ++ DM_CRYPT_DEFAULT_MAX_READ_SIZE); + } +- sector_align = max(bdev_logical_block_size(cc->dev->bdev), (unsigned)cc->sector_size); ++ ++ if (wrt || cc->used_tag_size) ++ val = min(val, BIO_MAX_VECS << PAGE_SHIFT); ++ ++ sector_align = max(bdev_logical_block_size(cc->dev->bdev), ++ (unsigned)cc->sector_size); + val = round_down(val, sector_align); + if (unlikely(!val)) + val = sector_align; +@@ -3496,7 +3514,7 @@ static int crypt_map(struct dm_target *t + /* + * Check if bio is too large, split as needed. + */ +- max_sectors = get_max_request_size(cc, bio_data_dir(bio) == WRITE); ++ max_sectors = get_max_request_sectors(ti, bio); + if (unlikely(bio_sectors(bio) > max_sectors)) + dm_accept_partial_bio(bio, max_sectors); + +@@ -3733,6 +3751,17 @@ static void crypt_io_hints(struct dm_tar + max_t(unsigned int, limits->physical_block_size, cc->sector_size); + limits->io_min = max_t(unsigned int, limits->io_min, cc->sector_size); + limits->dma_alignment = limits->logical_block_size - 1; ++ ++ /* ++ * For zoned dm-crypt targets, there will be no internal splitting of ++ * write BIOs to avoid exceeding BIO_MAX_VECS vectors per BIO. But ++ * without respecting this limit, crypt_alloc_buffer() will trigger a ++ * BUG(). Avoid this by forcing DM core to split write BIOs to this ++ * limit. ++ */ ++ if (ti->emulate_zone_append) ++ limits->max_hw_sectors = min(limits->max_hw_sectors, ++ BIO_MAX_VECS << PAGE_SECTORS_SHIFT); + } + + static struct target_type crypt_target = { diff --git a/debian/patches/patchset-pf/steady/0006-dm-Check-for-forbidden-splitting-of-zone-write-opera.patch b/debian/patches/patchset-pf/steady/0006-dm-Check-for-forbidden-splitting-of-zone-write-opera.patch new file mode 100644 index 0000000..5336de2 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0006-dm-Check-for-forbidden-splitting-of-zone-write-opera.patch @@ -0,0 +1,62 @@ +From 32eefb128e8ca539632595379da05e5662b72161 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Wed, 25 Jun 2025 18:33:27 +0900 +Subject: dm: Check for forbidden splitting of zone write operations + +DM targets must not split zone append and write operations using +dm_accept_partial_bio() as doing so is forbidden for zone append BIOs, +breaks zone append emulation using regular write BIOs and potentially +creates deadlock situations with queue freeze operations. + +Modify dm_accept_partial_bio() to add missing BUG_ON() checks for all +these cases, that is, check that the BIO is a write or write zeroes +operation. This change packs all the zone related checks together under +a static_branch_unlikely(&zoned_enabled) and done only if the target is +a zoned device. + +Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Mikulas Patocka +Link: https://lore.kernel.org/r/20250625093327.548866-6-dlemoal@kernel.org +Signed-off-by: Jens Axboe +--- + drivers/md/dm.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1293,8 +1293,9 @@ out: + /* + * A target may call dm_accept_partial_bio only from the map routine. It is + * allowed for all bio types except REQ_PREFLUSH, REQ_OP_ZONE_* zone management +- * operations, REQ_OP_ZONE_APPEND (zone append writes) and any bio serviced by +- * __send_duplicate_bios(). ++ * operations, zone append writes (native with REQ_OP_ZONE_APPEND or emulated ++ * with write BIOs flagged with BIO_EMULATES_ZONE_APPEND) and any bio serviced ++ * by __send_duplicate_bios(). + * + * dm_accept_partial_bio informs the dm that the target only wants to process + * additional n_sectors sectors of the bio and the rest of the data should be +@@ -1327,11 +1328,19 @@ void dm_accept_partial_bio(struct bio *b + unsigned int bio_sectors = bio_sectors(bio); + + BUG_ON(dm_tio_flagged(tio, DM_TIO_IS_DUPLICATE_BIO)); +- BUG_ON(op_is_zone_mgmt(bio_op(bio))); +- BUG_ON(bio_op(bio) == REQ_OP_ZONE_APPEND); + BUG_ON(bio_sectors > *tio->len_ptr); + BUG_ON(n_sectors > bio_sectors); + ++ if (static_branch_unlikely(&zoned_enabled) && ++ unlikely(bdev_is_zoned(bio->bi_bdev))) { ++ enum req_op op = bio_op(bio); ++ ++ BUG_ON(op_is_zone_mgmt(op)); ++ BUG_ON(op == REQ_OP_WRITE); ++ BUG_ON(op == REQ_OP_WRITE_ZEROES); ++ BUG_ON(op == REQ_OP_ZONE_APPEND); ++ } ++ + *tio->len_ptr -= bio_sectors - n_sectors; + bio->bi_iter.bi_size = n_sectors << SECTOR_SHIFT; + diff --git a/debian/patches/patchset-pf/steady/0007-mtd-spi-nor-Fix-spi_nor_try_unlock_all.patch b/debian/patches/patchset-pf/steady/0007-mtd-spi-nor-Fix-spi_nor_try_unlock_all.patch new file mode 100644 index 0000000..4d50bd1 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0007-mtd-spi-nor-Fix-spi_nor_try_unlock_all.patch @@ -0,0 +1,110 @@ +From 457eadbe8b4399d1c64d99536f5a2029f5e793d6 Mon Sep 17 00:00:00 2001 +From: Michael Walle +Date: Tue, 1 Jul 2025 16:04:26 +0200 +Subject: mtd: spi-nor: Fix spi_nor_try_unlock_all() + +Commit ff67592cbdfc ("mtd: spi-nor: Introduce spi_nor_set_mtd_info()") +moved all initialization of the mtd fields at the end of spi_nor_scan(). +Normally, the mtd info is only needed for the mtd ops on the device, +with one exception: spi_nor_try_unlock_all(), which will also make use +of the mtd->size parameter. With that commit, the size will always be +zero because it is not initialized. Fix that by not using the size of +the mtd_info struct, but use the size from struct spi_nor_flash_parameter. + +Fixes: ff67592cbdfc ("mtd: spi-nor: Introduce spi_nor_set_mtd_info()") +Cc: stable@vger.kernel.org +Reported-by: Jean-Marc Ranger +Closes: https://lore.kernel.org/all/DM6PR06MB561177323DC5207E34AF2A06C547A@DM6PR06MB5611.namprd06.prod.outlook.com/ +Tested-by: Jean-Marc Ranger +Signed-off-by: Michael Walle +Reviewed-by: Pratyush Yadav +Signed-off-by: Pratyush Yadav +Link: https://lore.kernel.org/r/20250701140426.2355182-1-mwalle@kernel.org +--- + drivers/mtd/spi-nor/swp.c | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +--- a/drivers/mtd/spi-nor/swp.c ++++ b/drivers/mtd/spi-nor/swp.c +@@ -56,7 +56,6 @@ static u64 spi_nor_get_min_prot_length_s + static void spi_nor_get_locked_range_sr(struct spi_nor *nor, u8 sr, loff_t *ofs, + u64 *len) + { +- struct mtd_info *mtd = &nor->mtd; + u64 min_prot_len; + u8 mask = spi_nor_get_sr_bp_mask(nor); + u8 tb_mask = spi_nor_get_sr_tb_mask(nor); +@@ -77,13 +76,13 @@ static void spi_nor_get_locked_range_sr( + min_prot_len = spi_nor_get_min_prot_length_sr(nor); + *len = min_prot_len << (bp - 1); + +- if (*len > mtd->size) +- *len = mtd->size; ++ if (*len > nor->params->size) ++ *len = nor->params->size; + + if (nor->flags & SNOR_F_HAS_SR_TB && sr & tb_mask) + *ofs = 0; + else +- *ofs = mtd->size - *len; ++ *ofs = nor->params->size - *len; + } + + /* +@@ -158,7 +157,6 @@ static bool spi_nor_is_unlocked_sr(struc + */ + static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, u64 len) + { +- struct mtd_info *mtd = &nor->mtd; + u64 min_prot_len; + int ret, status_old, status_new; + u8 mask = spi_nor_get_sr_bp_mask(nor); +@@ -183,7 +181,7 @@ static int spi_nor_sr_lock(struct spi_no + can_be_bottom = false; + + /* If anything above us is unlocked, we can't use 'top' protection */ +- if (!spi_nor_is_locked_sr(nor, ofs + len, mtd->size - (ofs + len), ++ if (!spi_nor_is_locked_sr(nor, ofs + len, nor->params->size - (ofs + len), + status_old)) + can_be_top = false; + +@@ -195,11 +193,11 @@ static int spi_nor_sr_lock(struct spi_no + + /* lock_len: length of region that should end up locked */ + if (use_top) +- lock_len = mtd->size - ofs; ++ lock_len = nor->params->size - ofs; + else + lock_len = ofs + len; + +- if (lock_len == mtd->size) { ++ if (lock_len == nor->params->size) { + val = mask; + } else { + min_prot_len = spi_nor_get_min_prot_length_sr(nor); +@@ -248,7 +246,6 @@ static int spi_nor_sr_lock(struct spi_no + */ + static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, u64 len) + { +- struct mtd_info *mtd = &nor->mtd; + u64 min_prot_len; + int ret, status_old, status_new; + u8 mask = spi_nor_get_sr_bp_mask(nor); +@@ -273,7 +270,7 @@ static int spi_nor_sr_unlock(struct spi_ + can_be_top = false; + + /* If anything above us is locked, we can't use 'bottom' protection */ +- if (!spi_nor_is_unlocked_sr(nor, ofs + len, mtd->size - (ofs + len), ++ if (!spi_nor_is_unlocked_sr(nor, ofs + len, nor->params->size - (ofs + len), + status_old)) + can_be_bottom = false; + +@@ -285,7 +282,7 @@ static int spi_nor_sr_unlock(struct spi_ + + /* lock_len: length of region that should remain locked */ + if (use_top) +- lock_len = mtd->size - (ofs + len); ++ lock_len = nor->params->size - (ofs + len); + else + lock_len = ofs; + diff --git a/debian/patches/patchset-pf/steady/0008-readahead-fix-return-value-of-page_cache_next_miss-w.patch b/debian/patches/patchset-pf/steady/0008-readahead-fix-return-value-of-page_cache_next_miss-w.patch new file mode 100644 index 0000000..9ee5ae2 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0008-readahead-fix-return-value-of-page_cache_next_miss-w.patch @@ -0,0 +1,40 @@ +From dd30d1837412d22457fc47562da3e4ae9c7d70ae Mon Sep 17 00:00:00 2001 +From: Chi Zhiling +Date: Thu, 5 Jun 2025 13:49:35 +0800 +Subject: readahead: fix return value of page_cache_next_miss() when no hole is + found + +max_scan in page_cache_next_miss always decreases to zero when no hole is +found, causing the return value to be index + 0. + +Fix this by preserving the max_scan value throughout the loop. + +Jan said "From what I know and have seen in the past, wrong responses +from page_cache_next_miss() can lead to readahead window reduction and +thus reduced read speeds." + +Link: https://lkml.kernel.org/r/20250605054935.2323451-1-chizhiling@163.com +Fixes: 901a269ff3d5 ("filemap: fix page_cache_next_miss() when no hole found") +Signed-off-by: Chi Zhiling +Reviewed-by: Jan Kara +Cc: Josef Bacik +Cc: Matthew Wilcox (Oracle) +Cc: +Signed-off-by: Andrew Morton +--- + mm/filemap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -1778,8 +1778,9 @@ pgoff_t page_cache_next_miss(struct addr + pgoff_t index, unsigned long max_scan) + { + XA_STATE(xas, &mapping->i_pages, index); ++ unsigned long nr = max_scan; + +- while (max_scan--) { ++ while (nr--) { + void *entry = xas_next(&xas); + if (!entry || xa_is_value(entry)) + return xas.xa_index; diff --git a/debian/patches/patchset-pf/steady/0009-PM-runtime-Take-active-children-into-account-in-pm_r.patch b/debian/patches/patchset-pf/steady/0009-PM-runtime-Take-active-children-into-account-in-pm_r.patch new file mode 100644 index 0000000..c2957d6 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0009-PM-runtime-Take-active-children-into-account-in-pm_r.patch @@ -0,0 +1,77 @@ +From 143c76ac94eddb9c2cb5ff4f57d78f60e22d9e20 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 9 Jul 2025 12:41:45 +0200 +Subject: PM: runtime: Take active children into account in + pm_runtime_get_if_in_use() + +For all practical purposes, there is no difference between the situation +in which a given device is not ignoring children and its active child +count is nonzero and the situation in which its runtime PM usage counter +is nonzero. However, pm_runtime_get_if_in_use() will only increment the +device's usage counter and return 1 in the latter case. + +For consistency, make it do so in the former case either by adjusting +pm_runtime_get_conditional() and update the related kerneldoc comments +accordingly. + +Fixes: c111566bea7c ("PM: runtime: Add pm_runtime_get_if_active()") +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Reviewed-by: Sakari Ailus +Cc: 5.10+ # 5.10+: c0ef3df8dbae: PM: runtime: Simplify pm_runtime_get_if_active() usage +Cc: 5.10+ # 5.10+ +Link: https://patch.msgid.link/12700973.O9o76ZdvQC@rjwysocki.net +--- + drivers/base/power/runtime.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1191,10 +1191,12 @@ EXPORT_SYMBOL_GPL(__pm_runtime_resume); + * + * Return -EINVAL if runtime PM is disabled for @dev. + * +- * Otherwise, if the runtime PM status of @dev is %RPM_ACTIVE and either +- * @ign_usage_count is %true or the runtime PM usage counter of @dev is not +- * zero, increment the usage counter of @dev and return 1. Otherwise, return 0 +- * without changing the usage counter. ++ * Otherwise, if its runtime PM status is %RPM_ACTIVE and (1) @ign_usage_count ++ * is set, or (2) @dev is not ignoring children and its active child count is ++ * nonero, or (3) the runtime PM usage counter of @dev is not zero, increment ++ * the usage counter of @dev and return 1. ++ * ++ * Otherwise, return 0 without changing the usage counter. + * + * If @ign_usage_count is %true, this function can be used to prevent suspending + * the device when its runtime PM status is %RPM_ACTIVE. +@@ -1216,7 +1218,8 @@ static int pm_runtime_get_conditional(st + retval = -EINVAL; + } else if (dev->power.runtime_status != RPM_ACTIVE) { + retval = 0; +- } else if (ign_usage_count) { ++ } else if (ign_usage_count || (!dev->power.ignore_children && ++ atomic_read(&dev->power.child_count) > 0)) { + retval = 1; + atomic_inc(&dev->power.usage_count); + } else { +@@ -1249,10 +1252,16 @@ EXPORT_SYMBOL_GPL(pm_runtime_get_if_acti + * @dev: Target device. + * + * Increment the runtime PM usage counter of @dev if its runtime PM status is +- * %RPM_ACTIVE and its runtime PM usage counter is greater than 0, in which case +- * it returns 1. If the device is in a different state or its usage_count is 0, +- * 0 is returned. -EINVAL is returned if runtime PM is disabled for the device, +- * in which case also the usage_count will remain unmodified. ++ * %RPM_ACTIVE and its runtime PM usage counter is greater than 0 or it is not ++ * ignoring children and its active child count is nonzero. 1 is returned in ++ * this case. ++ * ++ * If @dev is in a different state or it is not in use (that is, its usage ++ * counter is 0, or it is ignoring children, or its active child count is 0), ++ * 0 is returned. ++ * ++ * -EINVAL is returned if runtime PM is disabled for the device, in which case ++ * also the usage counter of @dev is not updated. + */ + int pm_runtime_get_if_in_use(struct device *dev) + { diff --git a/debian/patches/patchset-pf/steady/0010-io_uring-zcrx-always-pass-page-to-io_zcrx_copy_chunk.patch b/debian/patches/patchset-pf/steady/0010-io_uring-zcrx-always-pass-page-to-io_zcrx_copy_chunk.patch new file mode 100644 index 0000000..b68c880 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0010-io_uring-zcrx-always-pass-page-to-io_zcrx_copy_chunk.patch @@ -0,0 +1,77 @@ +From 0958a5878e3cbeb42c0e6dbad00000c15a44c544 Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Wed, 2 Jul 2025 15:29:04 +0100 +Subject: io_uring/zcrx: always pass page to io_zcrx_copy_chunk + +io_zcrx_copy_chunk() currently takes either a page or virtual address. +Unify the parameters, make it take pages and resolve the linear part +into a page the same way general networking code does that. + +Signed-off-by: Pavel Begunkov +Reviewed-by: David Wei +Link: https://lore.kernel.org/r/b8f9f4bac027f5f44a9ccf85350912d1db41ceb8.1751466461.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +--- + io_uring/zcrx.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +--- a/io_uring/zcrx.c ++++ b/io_uring/zcrx.c +@@ -968,8 +968,8 @@ static struct net_iov *io_zcrx_alloc_fal + } + + static ssize_t io_zcrx_copy_chunk(struct io_kiocb *req, struct io_zcrx_ifq *ifq, +- void *src_base, struct page *src_page, +- unsigned int src_offset, size_t len) ++ struct page *src_page, unsigned int src_offset, ++ size_t len) + { + struct io_zcrx_area *area = ifq->area; + size_t copied = 0; +@@ -983,7 +983,7 @@ static ssize_t io_zcrx_copy_chunk(struct + const int dst_off = 0; + struct net_iov *niov; + struct page *dst_page; +- void *dst_addr; ++ void *dst_addr, *src_addr; + + niov = io_zcrx_alloc_fallback(area); + if (!niov) { +@@ -993,13 +993,11 @@ static ssize_t io_zcrx_copy_chunk(struct + + dst_page = io_zcrx_iov_page(niov); + dst_addr = kmap_local_page(dst_page); +- if (src_page) +- src_base = kmap_local_page(src_page); ++ src_addr = kmap_local_page(src_page); + +- memcpy(dst_addr, src_base + src_offset, copy_size); ++ memcpy(dst_addr, src_addr + src_offset, copy_size); + +- if (src_page) +- kunmap_local(src_base); ++ kunmap_local(src_addr); + kunmap_local(dst_addr); + + if (!io_zcrx_queue_cqe(req, niov, ifq, dst_off, copy_size)) { +@@ -1028,7 +1026,7 @@ static int io_zcrx_copy_frag(struct io_k + + skb_frag_foreach_page(frag, off, len, + page, p_off, p_len, t) { +- ret = io_zcrx_copy_chunk(req, ifq, NULL, page, p_off, p_len); ++ ret = io_zcrx_copy_chunk(req, ifq, page, p_off, p_len); + if (ret < 0) + return copied ? copied : ret; + copied += ret; +@@ -1090,8 +1088,9 @@ io_zcrx_recv_skb(read_descriptor_t *desc + size_t to_copy; + + to_copy = min_t(size_t, skb_headlen(skb) - offset, len); +- copied = io_zcrx_copy_chunk(req, ifq, skb->data, NULL, +- offset, to_copy); ++ copied = io_zcrx_copy_chunk(req, ifq, virt_to_page(skb->data), ++ offset_in_page(skb->data) + offset, ++ to_copy); + if (copied < 0) { + ret = copied; + goto out; diff --git a/debian/patches/patchset-pf/steady/0011-io_uring-zcrx-assert-area-type-in-io_zcrx_iov_page.patch b/debian/patches/patchset-pf/steady/0011-io_uring-zcrx-assert-area-type-in-io_zcrx_iov_page.patch new file mode 100644 index 0000000..5c6aa85 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0011-io_uring-zcrx-assert-area-type-in-io_zcrx_iov_page.patch @@ -0,0 +1,26 @@ +From 221ca821b4f8439aa9749e41f1a35b0b19c4d825 Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Wed, 2 Jul 2025 15:29:08 +0100 +Subject: io_uring/zcrx: assert area type in io_zcrx_iov_page + +Add a simple debug assertion to io_zcrx_iov_page() making it's not +trying to return pages for a dmabuf area. + +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/c3c30a926a18436a399a1768f3cc86c76cd17fa7.1751466461.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +--- + io_uring/zcrx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/io_uring/zcrx.c ++++ b/io_uring/zcrx.c +@@ -44,6 +44,8 @@ static inline struct page *io_zcrx_iov_p + { + struct io_zcrx_area *area = io_zcrx_iov_to_area(niov); + ++ lockdep_assert(!area->mem.is_dmabuf); ++ + return area->mem.pages[net_iov_idx(niov)]; + } + diff --git a/debian/patches/patchset-pf/steady/0012-io_uring-zcrx-prepare-fallback-for-larger-pages.patch b/debian/patches/patchset-pf/steady/0012-io_uring-zcrx-prepare-fallback-for-larger-pages.patch new file mode 100644 index 0000000..f025a5f --- /dev/null +++ b/debian/patches/patchset-pf/steady/0012-io_uring-zcrx-prepare-fallback-for-larger-pages.patch @@ -0,0 +1,142 @@ +From ace17dfbf605c4eab9eb68c897ace0708d466bca Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Wed, 2 Jul 2025 15:29:09 +0100 +Subject: io_uring/zcrx: prepare fallback for larger pages + +io_zcrx_copy_chunk() processes one page at a time, which won't be +sufficient when the net_iov size grows. Introduce a structure keeping +the target niov page and other parameters, it's more convenient and can +be reused later. And add a helper function that can efficient copy +buffers of an arbitrary length. For 64bit archs the loop inside should +be compiled out. + +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/e84bc705a4e1edeb9aefff470d96558d8232388f.1751466461.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +--- + io_uring/zcrx.c | 83 +++++++++++++++++++++++++++++++++---------------- + 1 file changed, 56 insertions(+), 27 deletions(-) + +--- a/io_uring/zcrx.c ++++ b/io_uring/zcrx.c +@@ -969,6 +969,51 @@ static struct net_iov *io_zcrx_alloc_fal + return niov; + } + ++struct io_copy_cache { ++ struct page *page; ++ unsigned long offset; ++ size_t size; ++}; ++ ++static ssize_t io_copy_page(struct io_copy_cache *cc, struct page *src_page, ++ unsigned int src_offset, size_t len) ++{ ++ size_t copied = 0; ++ ++ len = min(len, cc->size); ++ ++ while (len) { ++ void *src_addr, *dst_addr; ++ struct page *dst_page = cc->page; ++ unsigned dst_offset = cc->offset; ++ size_t n = len; ++ ++ if (folio_test_partial_kmap(page_folio(dst_page)) || ++ folio_test_partial_kmap(page_folio(src_page))) { ++ dst_page = nth_page(dst_page, dst_offset / PAGE_SIZE); ++ dst_offset = offset_in_page(dst_offset); ++ src_page = nth_page(src_page, src_offset / PAGE_SIZE); ++ src_offset = offset_in_page(src_offset); ++ n = min(PAGE_SIZE - src_offset, PAGE_SIZE - dst_offset); ++ n = min(n, len); ++ } ++ ++ dst_addr = kmap_local_page(dst_page) + dst_offset; ++ src_addr = kmap_local_page(src_page) + src_offset; ++ ++ memcpy(dst_addr, src_addr, n); ++ ++ kunmap_local(src_addr); ++ kunmap_local(dst_addr); ++ ++ cc->size -= n; ++ cc->offset += n; ++ len -= n; ++ copied += n; ++ } ++ return copied; ++} ++ + static ssize_t io_zcrx_copy_chunk(struct io_kiocb *req, struct io_zcrx_ifq *ifq, + struct page *src_page, unsigned int src_offset, + size_t len) +@@ -981,11 +1026,9 @@ static ssize_t io_zcrx_copy_chunk(struct + return -EFAULT; + + while (len) { +- size_t copy_size = min_t(size_t, PAGE_SIZE, len); +- const int dst_off = 0; ++ struct io_copy_cache cc; + struct net_iov *niov; +- struct page *dst_page; +- void *dst_addr, *src_addr; ++ size_t n; + + niov = io_zcrx_alloc_fallback(area); + if (!niov) { +@@ -993,25 +1036,22 @@ static ssize_t io_zcrx_copy_chunk(struct + break; + } + +- dst_page = io_zcrx_iov_page(niov); +- dst_addr = kmap_local_page(dst_page); +- src_addr = kmap_local_page(src_page); +- +- memcpy(dst_addr, src_addr + src_offset, copy_size); ++ cc.page = io_zcrx_iov_page(niov); ++ cc.offset = 0; ++ cc.size = PAGE_SIZE; + +- kunmap_local(src_addr); +- kunmap_local(dst_addr); ++ n = io_copy_page(&cc, src_page, src_offset, len); + +- if (!io_zcrx_queue_cqe(req, niov, ifq, dst_off, copy_size)) { ++ if (!io_zcrx_queue_cqe(req, niov, ifq, 0, n)) { + io_zcrx_return_niov(niov); + ret = -ENOSPC; + break; + } + + io_zcrx_get_niov_uref(niov); +- src_offset += copy_size; +- len -= copy_size; +- copied += copy_size; ++ src_offset += n; ++ len -= n; ++ copied += n; + } + + return copied ? copied : ret; +@@ -1021,19 +1061,8 @@ static int io_zcrx_copy_frag(struct io_k + const skb_frag_t *frag, int off, int len) + { + struct page *page = skb_frag_page(frag); +- u32 p_off, p_len, t, copied = 0; +- int ret = 0; + +- off += skb_frag_off(frag); +- +- skb_frag_foreach_page(frag, off, len, +- page, p_off, p_len, t) { +- ret = io_zcrx_copy_chunk(req, ifq, page, p_off, p_len); +- if (ret < 0) +- return copied ? copied : ret; +- copied += ret; +- } +- return copied; ++ return io_zcrx_copy_chunk(req, ifq, page, off + skb_frag_off(frag), len); + } + + static int io_zcrx_recv_frag(struct io_kiocb *req, struct io_zcrx_ifq *ifq, diff --git a/debian/patches/patchset-pf/steady/0013-crypto-x86-aegis-Fix-sleeping-when-disallowed-on-PRE.patch b/debian/patches/patchset-pf/steady/0013-crypto-x86-aegis-Fix-sleeping-when-disallowed-on-PRE.patch new file mode 100644 index 0000000..562c494 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0013-crypto-x86-aegis-Fix-sleeping-when-disallowed-on-PRE.patch @@ -0,0 +1,57 @@ +From 127ab7f801b3ec9cf94d2436ef1f579a1fc09dd6 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Tue, 8 Jul 2025 12:38:28 -0700 +Subject: crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT + +skcipher_walk_done() can call kfree(), which takes a spinlock, which +makes it incorrect to call while preemption is disabled on PREEMPT_RT. +Therefore, end the kernel-mode FPU section before calling +skcipher_walk_done(), and restart it afterwards. + +Moreover, pass atomic=false to skcipher_walk_aead_encrypt() instead of +atomic=true. The point of atomic=true was to make skcipher_walk_done() +safe to call while in a kernel-mode FPU section, but that does not +actually work. So just use the usual atomic=false. + +Fixes: 1d373d4e8e15 ("crypto: x86 - Add optimized AEGIS implementations") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +--- + arch/x86/crypto/aegis128-aesni-glue.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/x86/crypto/aegis128-aesni-glue.c ++++ b/arch/x86/crypto/aegis128-aesni-glue.c +@@ -119,7 +119,9 @@ crypto_aegis128_aesni_process_crypt(stru + walk->dst.virt.addr, + round_down(walk->nbytes, + AEGIS128_BLOCK_SIZE)); ++ kernel_fpu_end(); + skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE); ++ kernel_fpu_begin(); + } + + if (walk->nbytes) { +@@ -131,7 +133,9 @@ crypto_aegis128_aesni_process_crypt(stru + aegis128_aesni_dec_tail(state, walk->src.virt.addr, + walk->dst.virt.addr, + walk->nbytes); ++ kernel_fpu_end(); + skcipher_walk_done(walk, 0); ++ kernel_fpu_begin(); + } + } + +@@ -176,9 +180,9 @@ crypto_aegis128_aesni_crypt(struct aead_ + struct aegis_state state; + + if (enc) +- skcipher_walk_aead_encrypt(&walk, req, true); ++ skcipher_walk_aead_encrypt(&walk, req, false); + else +- skcipher_walk_aead_decrypt(&walk, req, true); ++ skcipher_walk_aead_decrypt(&walk, req, false); + + kernel_fpu_begin(); + diff --git a/debian/patches/patchset-pf/steady/0014-crypto-x86-aegis-Add-missing-error-checks.patch b/debian/patches/patchset-pf/steady/0014-crypto-x86-aegis-Add-missing-error-checks.patch new file mode 100644 index 0000000..a6bdbea --- /dev/null +++ b/debian/patches/patchset-pf/steady/0014-crypto-x86-aegis-Add-missing-error-checks.patch @@ -0,0 +1,122 @@ +From 3bc9bc41e634767f001b7b37b6f1f89fc0214b8a Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Tue, 8 Jul 2025 12:38:29 -0700 +Subject: crypto: x86/aegis - Add missing error checks + +The skcipher_walk functions can allocate memory and can fail, so +checking for errors is necessary. + +Fixes: 1d373d4e8e15 ("crypto: x86 - Add optimized AEGIS implementations") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +--- + arch/x86/crypto/aegis128-aesni-glue.c | 36 +++++++++++++++++++-------- + 1 file changed, 25 insertions(+), 11 deletions(-) + +--- a/arch/x86/crypto/aegis128-aesni-glue.c ++++ b/arch/x86/crypto/aegis128-aesni-glue.c +@@ -104,10 +104,12 @@ static void crypto_aegis128_aesni_proces + } + } + +-static __always_inline void ++static __always_inline int + crypto_aegis128_aesni_process_crypt(struct aegis_state *state, + struct skcipher_walk *walk, bool enc) + { ++ int err = 0; ++ + while (walk->nbytes >= AEGIS128_BLOCK_SIZE) { + if (enc) + aegis128_aesni_enc(state, walk->src.virt.addr, +@@ -120,7 +122,8 @@ crypto_aegis128_aesni_process_crypt(stru + round_down(walk->nbytes, + AEGIS128_BLOCK_SIZE)); + kernel_fpu_end(); +- skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE); ++ err = skcipher_walk_done(walk, ++ walk->nbytes % AEGIS128_BLOCK_SIZE); + kernel_fpu_begin(); + } + +@@ -134,9 +137,10 @@ crypto_aegis128_aesni_process_crypt(stru + walk->dst.virt.addr, + walk->nbytes); + kernel_fpu_end(); +- skcipher_walk_done(walk, 0); ++ err = skcipher_walk_done(walk, 0); + kernel_fpu_begin(); + } ++ return err; + } + + static struct aegis_ctx *crypto_aegis128_aesni_ctx(struct crypto_aead *aead) +@@ -169,7 +173,7 @@ static int crypto_aegis128_aesni_setauth + return 0; + } + +-static __always_inline void ++static __always_inline int + crypto_aegis128_aesni_crypt(struct aead_request *req, + struct aegis_block *tag_xor, + unsigned int cryptlen, bool enc) +@@ -178,20 +182,24 @@ crypto_aegis128_aesni_crypt(struct aead_ + struct aegis_ctx *ctx = crypto_aegis128_aesni_ctx(tfm); + struct skcipher_walk walk; + struct aegis_state state; ++ int err; + + if (enc) +- skcipher_walk_aead_encrypt(&walk, req, false); ++ err = skcipher_walk_aead_encrypt(&walk, req, false); + else +- skcipher_walk_aead_decrypt(&walk, req, false); ++ err = skcipher_walk_aead_decrypt(&walk, req, false); ++ if (err) ++ return err; + + kernel_fpu_begin(); + + aegis128_aesni_init(&state, &ctx->key, req->iv); + crypto_aegis128_aesni_process_ad(&state, req->src, req->assoclen); +- crypto_aegis128_aesni_process_crypt(&state, &walk, enc); +- aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen); +- ++ err = crypto_aegis128_aesni_process_crypt(&state, &walk, enc); ++ if (err == 0) ++ aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen); + kernel_fpu_end(); ++ return err; + } + + static int crypto_aegis128_aesni_encrypt(struct aead_request *req) +@@ -200,8 +208,11 @@ static int crypto_aegis128_aesni_encrypt + struct aegis_block tag = {}; + unsigned int authsize = crypto_aead_authsize(tfm); + unsigned int cryptlen = req->cryptlen; ++ int err; + +- crypto_aegis128_aesni_crypt(req, &tag, cryptlen, true); ++ err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, true); ++ if (err) ++ return err; + + scatterwalk_map_and_copy(tag.bytes, req->dst, + req->assoclen + cryptlen, authsize, 1); +@@ -216,11 +227,14 @@ static int crypto_aegis128_aesni_decrypt + struct aegis_block tag; + unsigned int authsize = crypto_aead_authsize(tfm); + unsigned int cryptlen = req->cryptlen - authsize; ++ int err; + + scatterwalk_map_and_copy(tag.bytes, req->src, + req->assoclen + cryptlen, authsize, 0); + +- crypto_aegis128_aesni_crypt(req, &tag, cryptlen, false); ++ err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, false); ++ if (err) ++ return err; + + return crypto_memneq(tag.bytes, zeros.bytes, authsize) ? -EBADMSG : 0; + } diff --git a/debian/patches/patchset-pf/steady/0015-hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch b/debian/patches/patchset-pf/steady/0015-hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch new file mode 100644 index 0000000..aea2e4d --- /dev/null +++ b/debian/patches/patchset-pf/steady/0015-hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch @@ -0,0 +1,54 @@ +From 8b4284861b77422d25c46fe00402754ab1a156cc Mon Sep 17 00:00:00 2001 +From: Tim Harvey +Date: Fri, 18 Jul 2025 13:02:59 -0700 +Subject: hwmon: (gsc-hwmon) fix fan pwm setpoint show functions + +The Linux hwmon sysfs API values for pwmX_auto_pointY_pwm represent an +integer value between 0 (0%) to 255 (100%) and the pwmX_auto_pointY_temp +represent millidegrees Celcius. + +Commit a6d80df47ee2 ("hwmon: (gsc-hwmon) fix fan pwm temperature +scaling") properly addressed the incorrect scaling in the +pwm_auto_point_temp_store implementation but erroneously scaled +the pwm_auto_point_pwm_show (pwm value) instead of the +pwm_auto_point_temp_show (temp value) resulting in: + # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm + 25500 + # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp + 4500 + +Fix the scaling of these attributes: + # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm + 255 + # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp + 45000 + +Fixes: a6d80df47ee2 ("hwmon: (gsc-hwmon) fix fan pwm temperature scaling") +Cc: stable@vger.kernel.org +Signed-off-by: Tim Harvey +Link: https://lore.kernel.org/r/20250718200259.1840792-1-tharvey@gateworks.com +Signed-off-by: Guenter Roeck +--- + drivers/hwmon/gsc-hwmon.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/gsc-hwmon.c ++++ b/drivers/hwmon/gsc-hwmon.c +@@ -64,7 +64,7 @@ static ssize_t pwm_auto_point_temp_show( + return ret; + + ret = regs[0] | regs[1] << 8; +- return sprintf(buf, "%d\n", ret * 10); ++ return sprintf(buf, "%d\n", ret * 100); + } + + static ssize_t pwm_auto_point_temp_store(struct device *dev, +@@ -99,7 +99,7 @@ static ssize_t pwm_auto_point_pwm_show(s + { + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + +- return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10))); ++ return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)) / 100); + } + + static SENSOR_DEVICE_ATTR_RO(pwm1_auto_point1_pwm, pwm_auto_point_pwm, 0); diff --git a/debian/patches/patchset-pf/steady/0016-vt-keyboard-Don-t-process-Unicode-characters-in-K_OF.patch b/debian/patches/patchset-pf/steady/0016-vt-keyboard-Don-t-process-Unicode-characters-in-K_OF.patch new file mode 100644 index 0000000..a38e9ab --- /dev/null +++ b/debian/patches/patchset-pf/steady/0016-vt-keyboard-Don-t-process-Unicode-characters-in-K_OF.patch @@ -0,0 +1,31 @@ +From 3f91f07c241bea4ec294315cb41df81f123fa0bb Mon Sep 17 00:00:00 2001 +From: Myrrh Periwinkle +Date: Wed, 2 Jul 2025 21:17:57 +0700 +Subject: vt: keyboard: Don't process Unicode characters in K_OFF mode + +We don't process Unicode characters if the virtual terminal is in raw +mode, so there's no reason why we shouldn't do the same for K_OFF +(especially since people would expect K_OFF to actually turn off all VT +key processing). + +Fixes: 9fc3de9c8356 ("vt: Add virtual console keyboard mode OFF") +Signed-off-by: Myrrh Periwinkle +Cc: stable +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-1-c27e143cc2eb@qtmlabs.xyz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/keyboard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1487,7 +1487,7 @@ static void kbd_keycode(unsigned int key + rc = atomic_notifier_call_chain(&keyboard_notifier_list, + KBD_UNICODE, ¶m); + if (rc != NOTIFY_STOP) +- if (down && !raw_mode) ++ if (down && !(raw_mode || kbd->kbdmode == VC_OFF)) + k_unicode(vc, keysym, !down); + return; + } diff --git a/debian/patches/patchset-pf/steady/0017-vt-defkeymap-Map-keycodes-above-127-to-K_HOLE.patch b/debian/patches/patchset-pf/steady/0017-vt-defkeymap-Map-keycodes-above-127-to-K_HOLE.patch new file mode 100644 index 0000000..8efbfdb --- /dev/null +++ b/debian/patches/patchset-pf/steady/0017-vt-defkeymap-Map-keycodes-above-127-to-K_HOLE.patch @@ -0,0 +1,190 @@ +From f575281d91029d2dbfa0fa628cdc72e80fcd626f Mon Sep 17 00:00:00 2001 +From: Myrrh Periwinkle +Date: Wed, 2 Jul 2025 21:17:58 +0700 +Subject: vt: defkeymap: Map keycodes above 127 to K_HOLE + +The maximum number of keycodes got bumped to 256 a very long time ago, +but the default keymaps were never adjusted to match. This is causing +the kernel to interpret keycodes above 127 as U+0000 if the shipped +generated keymap is used. + +Fix this by mapping all keycodes above 127 to K_HOLE so the kernel +ignores them. + +The contents of this patche were generated by rerunning `loadkeys +--mktable --unicode` and only including the changes to map keycodes +above 127 to K_HOLE. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Myrrh Periwinkle +Cc: stable +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-2-c27e143cc2eb@qtmlabs.xyz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/defkeymap.c_shipped | 112 +++++++++++++++++++++++++++++ + 1 file changed, 112 insertions(+) + +--- a/drivers/tty/vt/defkeymap.c_shipped ++++ b/drivers/tty/vt/defkeymap.c_shipped +@@ -23,6 +23,22 @@ unsigned short plain_map[NR_KEYS] = { + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short shift_map[NR_KEYS] = { +@@ -42,6 +58,22 @@ static unsigned short shift_map[NR_KEYS] + 0xf20b, 0xf601, 0xf602, 0xf117, 0xf600, 0xf20a, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short altgr_map[NR_KEYS] = { +@@ -61,6 +93,22 @@ static unsigned short altgr_map[NR_KEYS] + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short ctrl_map[NR_KEYS] = { +@@ -80,6 +128,22 @@ static unsigned short ctrl_map[NR_KEYS] + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short shift_ctrl_map[NR_KEYS] = { +@@ -99,6 +163,22 @@ static unsigned short shift_ctrl_map[NR_ + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short alt_map[NR_KEYS] = { +@@ -118,6 +198,22 @@ static unsigned short alt_map[NR_KEYS] = + 0xf118, 0xf210, 0xf211, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short ctrl_alt_map[NR_KEYS] = { +@@ -137,6 +233,22 @@ static unsigned short ctrl_alt_map[NR_KE + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf20c, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + unsigned short *key_maps[MAX_NR_KEYMAPS] = { diff --git a/debian/patches/patchset-pf/steady/0018-serial-8250-fix-panic-due-to-PSLVERR.patch b/debian/patches/patchset-pf/steady/0018-serial-8250-fix-panic-due-to-PSLVERR.patch new file mode 100644 index 0000000..8976b73 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0018-serial-8250-fix-panic-due-to-PSLVERR.patch @@ -0,0 +1,55 @@ +From c0bcd8c710c48ab93f0b72c1a3611c39a68c3a74 Mon Sep 17 00:00:00 2001 +From: Yunhui Cui +Date: Wed, 23 Jul 2025 10:33:22 +0800 +Subject: serial: 8250: fix panic due to PSLVERR + +When the PSLVERR_RESP_EN parameter is set to 1, the device generates +an error response if an attempt is made to read an empty RBR (Receive +Buffer Register) while the FIFO is enabled. + +In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, +UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes +dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter +function enables the FIFO via serial_out(p, UART_FCR, p->fcr). +Execution proceeds to the serial_port_in(port, UART_RX). +This satisfies the PSLVERR trigger condition. + +When another CPU (e.g., using printk()) is accessing the UART (UART +is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == +(lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter +dw8250_force_idle(). + +Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock +to fix this issue. + +Panic backtrace: +[ 0.442336] Oops - unknown exception [#1] +[ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a +[ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e +... +[ 0.442416] console_on_rootfs+0x26/0x70 + +Fixes: c49436b657d0 ("serial: 8250_dw: Improve unwritable LCR workaround") +Link: https://lore.kernel.org/all/84cydt5peu.fsf@jogness.linutronix.de/T/ +Signed-off-by: Yunhui Cui +Reviewed-by: John Ogness +Cc: stable +Link: https://lore.kernel.org/r/20250723023322.464-2-cuiyunhui@bytedance.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_port.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -2376,9 +2376,9 @@ int serial8250_do_startup(struct uart_po + /* + * Now, initialize the UART + */ ++ uart_port_lock_irqsave(port, &flags); + serial_port_out(port, UART_LCR, UART_LCR_WLEN8); + +- uart_port_lock_irqsave(port, &flags); + if (up->port.flags & UPF_FOURPORT) { + if (!up->port.irq) + up->port.mctrl |= TIOCM_OUT1; diff --git a/debian/patches/patchset-pf/steady/0019-mm-damon-paddr-use-alloc_migartion_target-with-no-mi.patch b/debian/patches/patchset-pf/steady/0019-mm-damon-paddr-use-alloc_migartion_target-with-no-mi.patch new file mode 100644 index 0000000..16f344d --- /dev/null +++ b/debian/patches/patchset-pf/steady/0019-mm-damon-paddr-use-alloc_migartion_target-with-no-mi.patch @@ -0,0 +1,74 @@ +From 2ee6decb1435c8331404d590f7a5a2d6a5711760 Mon Sep 17 00:00:00 2001 +From: SeongJae Park +Date: Mon, 16 Jun 2025 10:23:44 -0700 +Subject: mm/damon/paddr: use alloc_migartion_target() with no migration + fallback nodemask + +Patch series "mm/damon: use alloc_migrate_target() for +DAMOS_MIGRATE_{HOT,COLD}". + +DAMOS_MIGRATE_{HOT,COLD} implementation resembles that for demotion, and +hence the behavior is also similar to that. But, since those are not only +for demotion but general migrations, it would be better to match with that +for move_pages() system call. Make the implementation and the behavior +more similar to move_pages() by not setting migration fallback nodes, and +using alloc_migration_target() instead of alloc_migrate_folio(). + +alloc_migrate_folio() was renamed from alloc_demote_folio() and been +non-static function, to let DAMOS_MIGRATE_{HOT,COLD} call it. As +alloc_migration_target() is called instead, the renaming and de-static +changes are no more required but could only make future code readers be +confused. Revert the changes, too. + + +This patch (of 3): + +DAMOS_MIGRATE_{HOT,COLD} implementation resembles that for +demote_folio_list(). Because those are not only for demotion but general +folio migrations, it makes more sense to behave similarly to move_pages() +system call. Make the behavior more similar to move_pages(), by using +alloc_migration_target() instead of alloc_migrate_folio(), without +fallback nodemask. + +Link: https://lkml.kernel.org/r/20250616172346.67659-2-sj@kernel.org +Signed-off-by: SeongJae Park +Reviewed-by: Joshua Hahn +Cc: David Hildenbrand +Cc: Honggyu Kim +Cc: Johannes Weiner +Cc: Lorenzo Stoakes +Cc: Michal Hocko +Cc: Qi Zheng +Cc: Shakeel Butt +Signed-off-by: Andrew Morton +--- + mm/damon/paddr.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/mm/damon/paddr.c ++++ b/mm/damon/paddr.c +@@ -386,7 +386,6 @@ static unsigned int __damon_pa_migrate_f + int target_nid) + { + unsigned int nr_succeeded = 0; +- nodemask_t allowed_mask = NODE_MASK_NONE; + struct migration_target_control mtc = { + /* + * Allocate from 'node', or fail quickly and quietly. +@@ -396,7 +395,6 @@ static unsigned int __damon_pa_migrate_f + .gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) | + __GFP_NOWARN | __GFP_NOMEMALLOC | GFP_NOWAIT, + .nid = target_nid, +- .nmask = &allowed_mask + }; + + if (pgdat->node_id == target_nid || target_nid == NUMA_NO_NODE) +@@ -406,7 +404,7 @@ static unsigned int __damon_pa_migrate_f + return 0; + + /* Migration ignores all cpuset and mempolicy settings */ +- migrate_pages(migrate_folios, alloc_migrate_folio, NULL, ++ migrate_pages(migrate_folios, alloc_migration_target, NULL, + (unsigned long)&mtc, MIGRATE_ASYNC, MR_DAMON, + &nr_succeeded); + diff --git a/debian/patches/patchset-pf/steady/0020-mm-damon-move-migration-helpers-from-paddr-to-ops-co.patch b/debian/patches/patchset-pf/steady/0020-mm-damon-move-migration-helpers-from-paddr-to-ops-co.patch new file mode 100644 index 0000000..937de65 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0020-mm-damon-move-migration-helpers-from-paddr-to-ops-co.patch @@ -0,0 +1,318 @@ +From 9292d9753eeab6dd9492ec28b79045ab4890652a Mon Sep 17 00:00:00 2001 +From: Bijan Tabatabai +Date: Tue, 8 Jul 2025 19:59:38 -0500 +Subject: mm/damon: move migration helpers from paddr to ops-common + +This patch moves the damon_pa_migrate_pages function along with its +corresponding helper functions from paddr to ops-common. The function +prefix of "damon_pa_" was also changed to just "damon_" accordingly. + +This patch will allow page migration to be available to vaddr schemes as +well as paddr schemes. + +Link: https://lkml.kernel.org/r/20250709005952.17776-9-bijan311@gmail.com +Co-developed-by: Ravi Shankar Jonnalagadda +Signed-off-by: Ravi Shankar Jonnalagadda +Signed-off-by: Bijan Tabatabai +Reviewed-by: SeongJae Park +Cc: Jonathan Corbet +Signed-off-by: Andrew Morton +--- + mm/damon/ops-common.c | 120 +++++++++++++++++++++++++++++++++++++++++ + mm/damon/ops-common.h | 2 + + mm/damon/paddr.c | 122 +----------------------------------------- + 3 files changed, 123 insertions(+), 121 deletions(-) + +--- a/mm/damon/ops-common.c ++++ b/mm/damon/ops-common.c +@@ -5,6 +5,7 @@ + * Author: SeongJae Park + */ + ++#include + #include + #include + #include +@@ -12,6 +13,7 @@ + #include + #include + ++#include "../internal.h" + #include "ops-common.h" + + /* +@@ -138,3 +140,121 @@ int damon_cold_score(struct damon_ctx *c + /* Return coldness of the region */ + return DAMOS_MAX_SCORE - hotness; + } ++ ++static unsigned int __damon_migrate_folio_list( ++ struct list_head *migrate_folios, struct pglist_data *pgdat, ++ int target_nid) ++{ ++ unsigned int nr_succeeded = 0; ++ struct migration_target_control mtc = { ++ /* ++ * Allocate from 'node', or fail quickly and quietly. ++ * When this happens, 'page' will likely just be discarded ++ * instead of migrated. ++ */ ++ .gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) | ++ __GFP_NOWARN | __GFP_NOMEMALLOC | GFP_NOWAIT, ++ .nid = target_nid, ++ }; ++ ++ if (pgdat->node_id == target_nid || target_nid == NUMA_NO_NODE) ++ return 0; ++ ++ if (list_empty(migrate_folios)) ++ return 0; ++ ++ /* Migration ignores all cpuset and mempolicy settings */ ++ migrate_pages(migrate_folios, alloc_migration_target, NULL, ++ (unsigned long)&mtc, MIGRATE_ASYNC, MR_DAMON, ++ &nr_succeeded); ++ ++ return nr_succeeded; ++} ++ ++static unsigned int damon_migrate_folio_list(struct list_head *folio_list, ++ struct pglist_data *pgdat, ++ int target_nid) ++{ ++ unsigned int nr_migrated = 0; ++ struct folio *folio; ++ LIST_HEAD(ret_folios); ++ LIST_HEAD(migrate_folios); ++ ++ while (!list_empty(folio_list)) { ++ struct folio *folio; ++ ++ cond_resched(); ++ ++ folio = lru_to_folio(folio_list); ++ list_del(&folio->lru); ++ ++ if (!folio_trylock(folio)) ++ goto keep; ++ ++ /* Relocate its contents to another node. */ ++ list_add(&folio->lru, &migrate_folios); ++ folio_unlock(folio); ++ continue; ++keep: ++ list_add(&folio->lru, &ret_folios); ++ } ++ /* 'folio_list' is always empty here */ ++ ++ /* Migrate folios selected for migration */ ++ nr_migrated += __damon_migrate_folio_list( ++ &migrate_folios, pgdat, target_nid); ++ /* ++ * Folios that could not be migrated are still in @migrate_folios. Add ++ * those back on @folio_list ++ */ ++ if (!list_empty(&migrate_folios)) ++ list_splice_init(&migrate_folios, folio_list); ++ ++ try_to_unmap_flush(); ++ ++ list_splice(&ret_folios, folio_list); ++ ++ while (!list_empty(folio_list)) { ++ folio = lru_to_folio(folio_list); ++ list_del(&folio->lru); ++ folio_putback_lru(folio); ++ } ++ ++ return nr_migrated; ++} ++ ++unsigned long damon_migrate_pages(struct list_head *folio_list, int target_nid) ++{ ++ int nid; ++ unsigned long nr_migrated = 0; ++ LIST_HEAD(node_folio_list); ++ unsigned int noreclaim_flag; ++ ++ if (list_empty(folio_list)) ++ return nr_migrated; ++ ++ noreclaim_flag = memalloc_noreclaim_save(); ++ ++ nid = folio_nid(lru_to_folio(folio_list)); ++ do { ++ struct folio *folio = lru_to_folio(folio_list); ++ ++ if (nid == folio_nid(folio)) { ++ list_move(&folio->lru, &node_folio_list); ++ continue; ++ } ++ ++ nr_migrated += damon_migrate_folio_list(&node_folio_list, ++ NODE_DATA(nid), ++ target_nid); ++ nid = folio_nid(lru_to_folio(folio_list)); ++ } while (!list_empty(folio_list)); ++ ++ nr_migrated += damon_migrate_folio_list(&node_folio_list, ++ NODE_DATA(nid), ++ target_nid); ++ ++ memalloc_noreclaim_restore(noreclaim_flag); ++ ++ return nr_migrated; ++} +--- a/mm/damon/ops-common.h ++++ b/mm/damon/ops-common.h +@@ -16,3 +16,5 @@ int damon_cold_score(struct damon_ctx *c + struct damos *s); + int damon_hot_score(struct damon_ctx *c, struct damon_region *r, + struct damos *s); ++ ++unsigned long damon_migrate_pages(struct list_head *folio_list, int target_nid); +--- a/mm/damon/paddr.c ++++ b/mm/damon/paddr.c +@@ -13,7 +13,6 @@ + #include + #include + #include +-#include + #include + + #include "../internal.h" +@@ -381,125 +380,6 @@ static unsigned long damon_pa_deactivate + sz_filter_passed); + } + +-static unsigned int __damon_pa_migrate_folio_list( +- struct list_head *migrate_folios, struct pglist_data *pgdat, +- int target_nid) +-{ +- unsigned int nr_succeeded = 0; +- struct migration_target_control mtc = { +- /* +- * Allocate from 'node', or fail quickly and quietly. +- * When this happens, 'page' will likely just be discarded +- * instead of migrated. +- */ +- .gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) | +- __GFP_NOWARN | __GFP_NOMEMALLOC | GFP_NOWAIT, +- .nid = target_nid, +- }; +- +- if (pgdat->node_id == target_nid || target_nid == NUMA_NO_NODE) +- return 0; +- +- if (list_empty(migrate_folios)) +- return 0; +- +- /* Migration ignores all cpuset and mempolicy settings */ +- migrate_pages(migrate_folios, alloc_migration_target, NULL, +- (unsigned long)&mtc, MIGRATE_ASYNC, MR_DAMON, +- &nr_succeeded); +- +- return nr_succeeded; +-} +- +-static unsigned int damon_pa_migrate_folio_list(struct list_head *folio_list, +- struct pglist_data *pgdat, +- int target_nid) +-{ +- unsigned int nr_migrated = 0; +- struct folio *folio; +- LIST_HEAD(ret_folios); +- LIST_HEAD(migrate_folios); +- +- while (!list_empty(folio_list)) { +- struct folio *folio; +- +- cond_resched(); +- +- folio = lru_to_folio(folio_list); +- list_del(&folio->lru); +- +- if (!folio_trylock(folio)) +- goto keep; +- +- /* Relocate its contents to another node. */ +- list_add(&folio->lru, &migrate_folios); +- folio_unlock(folio); +- continue; +-keep: +- list_add(&folio->lru, &ret_folios); +- } +- /* 'folio_list' is always empty here */ +- +- /* Migrate folios selected for migration */ +- nr_migrated += __damon_pa_migrate_folio_list( +- &migrate_folios, pgdat, target_nid); +- /* +- * Folios that could not be migrated are still in @migrate_folios. Add +- * those back on @folio_list +- */ +- if (!list_empty(&migrate_folios)) +- list_splice_init(&migrate_folios, folio_list); +- +- try_to_unmap_flush(); +- +- list_splice(&ret_folios, folio_list); +- +- while (!list_empty(folio_list)) { +- folio = lru_to_folio(folio_list); +- list_del(&folio->lru); +- folio_putback_lru(folio); +- } +- +- return nr_migrated; +-} +- +-static unsigned long damon_pa_migrate_pages(struct list_head *folio_list, +- int target_nid) +-{ +- int nid; +- unsigned long nr_migrated = 0; +- LIST_HEAD(node_folio_list); +- unsigned int noreclaim_flag; +- +- if (list_empty(folio_list)) +- return nr_migrated; +- +- noreclaim_flag = memalloc_noreclaim_save(); +- +- nid = folio_nid(lru_to_folio(folio_list)); +- do { +- struct folio *folio = lru_to_folio(folio_list); +- +- if (nid == folio_nid(folio)) { +- list_move(&folio->lru, &node_folio_list); +- continue; +- } +- +- nr_migrated += damon_pa_migrate_folio_list(&node_folio_list, +- NODE_DATA(nid), +- target_nid); +- nid = folio_nid(lru_to_folio(folio_list)); +- } while (!list_empty(folio_list)); +- +- nr_migrated += damon_pa_migrate_folio_list(&node_folio_list, +- NODE_DATA(nid), +- target_nid); +- +- memalloc_noreclaim_restore(noreclaim_flag); +- +- return nr_migrated; +-} +- + static unsigned long damon_pa_migrate(struct damon_region *r, struct damos *s, + unsigned long *sz_filter_passed) + { +@@ -527,7 +407,7 @@ put_folio: + addr += folio_size(folio); + folio_put(folio); + } +- applied = damon_pa_migrate_pages(&folio_list, s->target_nid); ++ applied = damon_migrate_pages(&folio_list, s->target_nid); + cond_resched(); + s->last_applied = folio; + return applied * PAGE_SIZE; diff --git a/debian/patches/patchset-pf/steady/0021-mm-damon-move-folio-filtering-from-paddr-to-ops-comm.patch b/debian/patches/patchset-pf/steady/0021-mm-damon-move-folio-filtering-from-paddr-to-ops-comm.patch new file mode 100644 index 0000000..a094219 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0021-mm-damon-move-folio-filtering-from-paddr-to-ops-comm.patch @@ -0,0 +1,381 @@ +From 98fbe2f62c4263248a325867c439f9d7222a3c64 Mon Sep 17 00:00:00 2001 +From: Bijan Tabatabai +Date: Tue, 8 Jul 2025 19:59:42 -0500 +Subject: mm/damon: move folio filtering from paddr to ops-common + +This patch moves damos_pa_filter_match and the functions it calls to +ops-common, renaming it to damos_folio_filter_match. Doing so allows us +to share the filtering logic for the vaddr version of the +migrate_{hot,cold} schemes. + +Link: https://lkml.kernel.org/r/20250709005952.17776-13-bijan311@gmail.com +Co-developed-by: Ravi Shankar Jonnalagadda +Signed-off-by: Ravi Shankar Jonnalagadda +Signed-off-by: Bijan Tabatabai +Reviewed-by: SeongJae Park +Cc: Jonathan Corbet +Signed-off-by: Andrew Morton +--- + mm/damon/ops-common.c | 150 +++++++++++++++++++++++++++++++++++++++++ + mm/damon/ops-common.h | 3 + + mm/damon/paddr.c | 153 +----------------------------------------- + 3 files changed, 154 insertions(+), 152 deletions(-) + +--- a/mm/damon/ops-common.c ++++ b/mm/damon/ops-common.c +@@ -141,6 +141,156 @@ int damon_cold_score(struct damon_ctx *c + return DAMOS_MAX_SCORE - hotness; + } + ++static bool damon_folio_mkold_one(struct folio *folio, ++ struct vm_area_struct *vma, unsigned long addr, void *arg) ++{ ++ DEFINE_FOLIO_VMA_WALK(pvmw, folio, vma, addr, 0); ++ ++ while (page_vma_mapped_walk(&pvmw)) { ++ addr = pvmw.address; ++ if (pvmw.pte) ++ damon_ptep_mkold(pvmw.pte, vma, addr); ++ else ++ damon_pmdp_mkold(pvmw.pmd, vma, addr); ++ } ++ return true; ++} ++ ++void damon_folio_mkold(struct folio *folio) ++{ ++ struct rmap_walk_control rwc = { ++ .rmap_one = damon_folio_mkold_one, ++ .anon_lock = folio_lock_anon_vma_read, ++ }; ++ bool need_lock; ++ ++ if (!folio_mapped(folio) || !folio_raw_mapping(folio)) { ++ folio_set_idle(folio); ++ return; ++ } ++ ++ need_lock = !folio_test_anon(folio) || folio_test_ksm(folio); ++ if (need_lock && !folio_trylock(folio)) ++ return; ++ ++ rmap_walk(folio, &rwc); ++ ++ if (need_lock) ++ folio_unlock(folio); ++ ++} ++ ++static bool damon_folio_young_one(struct folio *folio, ++ struct vm_area_struct *vma, unsigned long addr, void *arg) ++{ ++ bool *accessed = arg; ++ DEFINE_FOLIO_VMA_WALK(pvmw, folio, vma, addr, 0); ++ pte_t pte; ++ ++ *accessed = false; ++ while (page_vma_mapped_walk(&pvmw)) { ++ addr = pvmw.address; ++ if (pvmw.pte) { ++ pte = ptep_get(pvmw.pte); ++ ++ /* ++ * PFN swap PTEs, such as device-exclusive ones, that ++ * actually map pages are "old" from a CPU perspective. ++ * The MMU notifier takes care of any device aspects. ++ */ ++ *accessed = (pte_present(pte) && pte_young(pte)) || ++ !folio_test_idle(folio) || ++ mmu_notifier_test_young(vma->vm_mm, addr); ++ } else { ++#ifdef CONFIG_TRANSPARENT_HUGEPAGE ++ *accessed = pmd_young(pmdp_get(pvmw.pmd)) || ++ !folio_test_idle(folio) || ++ mmu_notifier_test_young(vma->vm_mm, addr); ++#else ++ WARN_ON_ONCE(1); ++#endif /* CONFIG_TRANSPARENT_HUGEPAGE */ ++ } ++ if (*accessed) { ++ page_vma_mapped_walk_done(&pvmw); ++ break; ++ } ++ } ++ ++ /* If accessed, stop walking */ ++ return *accessed == false; ++} ++ ++bool damon_folio_young(struct folio *folio) ++{ ++ bool accessed = false; ++ struct rmap_walk_control rwc = { ++ .arg = &accessed, ++ .rmap_one = damon_folio_young_one, ++ .anon_lock = folio_lock_anon_vma_read, ++ }; ++ bool need_lock; ++ ++ if (!folio_mapped(folio) || !folio_raw_mapping(folio)) { ++ if (folio_test_idle(folio)) ++ return false; ++ else ++ return true; ++ } ++ ++ need_lock = !folio_test_anon(folio) || folio_test_ksm(folio); ++ if (need_lock && !folio_trylock(folio)) ++ return false; ++ ++ rmap_walk(folio, &rwc); ++ ++ if (need_lock) ++ folio_unlock(folio); ++ ++ return accessed; ++} ++ ++bool damos_folio_filter_match(struct damos_filter *filter, struct folio *folio) ++{ ++ bool matched = false; ++ struct mem_cgroup *memcg; ++ size_t folio_sz; ++ ++ switch (filter->type) { ++ case DAMOS_FILTER_TYPE_ANON: ++ matched = folio_test_anon(folio); ++ break; ++ case DAMOS_FILTER_TYPE_ACTIVE: ++ matched = folio_test_active(folio); ++ break; ++ case DAMOS_FILTER_TYPE_MEMCG: ++ rcu_read_lock(); ++ memcg = folio_memcg_check(folio); ++ if (!memcg) ++ matched = false; ++ else ++ matched = filter->memcg_id == mem_cgroup_id(memcg); ++ rcu_read_unlock(); ++ break; ++ case DAMOS_FILTER_TYPE_YOUNG: ++ matched = damon_folio_young(folio); ++ if (matched) ++ damon_folio_mkold(folio); ++ break; ++ case DAMOS_FILTER_TYPE_HUGEPAGE_SIZE: ++ folio_sz = folio_size(folio); ++ matched = filter->sz_range.min <= folio_sz && ++ folio_sz <= filter->sz_range.max; ++ break; ++ case DAMOS_FILTER_TYPE_UNMAPPED: ++ matched = !folio_mapped(folio) || !folio_raw_mapping(folio); ++ break; ++ default: ++ break; ++ } ++ ++ return matched == filter->matching; ++} ++ + static unsigned int __damon_migrate_folio_list( + struct list_head *migrate_folios, struct pglist_data *pgdat, + int target_nid) +--- a/mm/damon/ops-common.h ++++ b/mm/damon/ops-common.h +@@ -11,10 +11,13 @@ struct folio *damon_get_folio(unsigned l + + void damon_ptep_mkold(pte_t *pte, struct vm_area_struct *vma, unsigned long addr); + void damon_pmdp_mkold(pmd_t *pmd, struct vm_area_struct *vma, unsigned long addr); ++void damon_folio_mkold(struct folio *folio); ++bool damon_folio_young(struct folio *folio); + + int damon_cold_score(struct damon_ctx *c, struct damon_region *r, + struct damos *s); + int damon_hot_score(struct damon_ctx *c, struct damon_region *r, + struct damos *s); + ++bool damos_folio_filter_match(struct damos_filter *filter, struct folio *folio); + unsigned long damon_migrate_pages(struct list_head *folio_list, int target_nid); +--- a/mm/damon/paddr.c ++++ b/mm/damon/paddr.c +@@ -18,45 +18,6 @@ + #include "../internal.h" + #include "ops-common.h" + +-static bool damon_folio_mkold_one(struct folio *folio, +- struct vm_area_struct *vma, unsigned long addr, void *arg) +-{ +- DEFINE_FOLIO_VMA_WALK(pvmw, folio, vma, addr, 0); +- +- while (page_vma_mapped_walk(&pvmw)) { +- addr = pvmw.address; +- if (pvmw.pte) +- damon_ptep_mkold(pvmw.pte, vma, addr); +- else +- damon_pmdp_mkold(pvmw.pmd, vma, addr); +- } +- return true; +-} +- +-static void damon_folio_mkold(struct folio *folio) +-{ +- struct rmap_walk_control rwc = { +- .rmap_one = damon_folio_mkold_one, +- .anon_lock = folio_lock_anon_vma_read, +- }; +- bool need_lock; +- +- if (!folio_mapped(folio) || !folio_raw_mapping(folio)) { +- folio_set_idle(folio); +- return; +- } +- +- need_lock = !folio_test_anon(folio) || folio_test_ksm(folio); +- if (need_lock && !folio_trylock(folio)) +- return; +- +- rmap_walk(folio, &rwc); +- +- if (need_lock) +- folio_unlock(folio); +- +-} +- + static void damon_pa_mkold(unsigned long paddr) + { + struct folio *folio = damon_get_folio(PHYS_PFN(paddr)); +@@ -86,75 +47,6 @@ static void damon_pa_prepare_access_chec + } + } + +-static bool damon_folio_young_one(struct folio *folio, +- struct vm_area_struct *vma, unsigned long addr, void *arg) +-{ +- bool *accessed = arg; +- DEFINE_FOLIO_VMA_WALK(pvmw, folio, vma, addr, 0); +- pte_t pte; +- +- *accessed = false; +- while (page_vma_mapped_walk(&pvmw)) { +- addr = pvmw.address; +- if (pvmw.pte) { +- pte = ptep_get(pvmw.pte); +- +- /* +- * PFN swap PTEs, such as device-exclusive ones, that +- * actually map pages are "old" from a CPU perspective. +- * The MMU notifier takes care of any device aspects. +- */ +- *accessed = (pte_present(pte) && pte_young(pte)) || +- !folio_test_idle(folio) || +- mmu_notifier_test_young(vma->vm_mm, addr); +- } else { +-#ifdef CONFIG_TRANSPARENT_HUGEPAGE +- *accessed = pmd_young(pmdp_get(pvmw.pmd)) || +- !folio_test_idle(folio) || +- mmu_notifier_test_young(vma->vm_mm, addr); +-#else +- WARN_ON_ONCE(1); +-#endif /* CONFIG_TRANSPARENT_HUGEPAGE */ +- } +- if (*accessed) { +- page_vma_mapped_walk_done(&pvmw); +- break; +- } +- } +- +- /* If accessed, stop walking */ +- return *accessed == false; +-} +- +-static bool damon_folio_young(struct folio *folio) +-{ +- bool accessed = false; +- struct rmap_walk_control rwc = { +- .arg = &accessed, +- .rmap_one = damon_folio_young_one, +- .anon_lock = folio_lock_anon_vma_read, +- }; +- bool need_lock; +- +- if (!folio_mapped(folio) || !folio_raw_mapping(folio)) { +- if (folio_test_idle(folio)) +- return false; +- else +- return true; +- } +- +- need_lock = !folio_test_anon(folio) || folio_test_ksm(folio); +- if (need_lock && !folio_trylock(folio)) +- return false; +- +- rmap_walk(folio, &rwc); +- +- if (need_lock) +- folio_unlock(folio); +- +- return accessed; +-} +- + static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz) + { + struct folio *folio = damon_get_folio(PHYS_PFN(paddr)); +@@ -205,49 +97,6 @@ static unsigned int damon_pa_check_acces + return max_nr_accesses; + } + +-static bool damos_pa_filter_match(struct damos_filter *filter, +- struct folio *folio) +-{ +- bool matched = false; +- struct mem_cgroup *memcg; +- size_t folio_sz; +- +- switch (filter->type) { +- case DAMOS_FILTER_TYPE_ANON: +- matched = folio_test_anon(folio); +- break; +- case DAMOS_FILTER_TYPE_ACTIVE: +- matched = folio_test_active(folio); +- break; +- case DAMOS_FILTER_TYPE_MEMCG: +- rcu_read_lock(); +- memcg = folio_memcg_check(folio); +- if (!memcg) +- matched = false; +- else +- matched = filter->memcg_id == mem_cgroup_id(memcg); +- rcu_read_unlock(); +- break; +- case DAMOS_FILTER_TYPE_YOUNG: +- matched = damon_folio_young(folio); +- if (matched) +- damon_folio_mkold(folio); +- break; +- case DAMOS_FILTER_TYPE_HUGEPAGE_SIZE: +- folio_sz = folio_size(folio); +- matched = filter->sz_range.min <= folio_sz && +- folio_sz <= filter->sz_range.max; +- break; +- case DAMOS_FILTER_TYPE_UNMAPPED: +- matched = !folio_mapped(folio) || !folio_raw_mapping(folio); +- break; +- default: +- break; +- } +- +- return matched == filter->matching; +-} +- + /* + * damos_pa_filter_out - Return true if the page should be filtered out. + */ +@@ -259,7 +108,7 @@ static bool damos_pa_filter_out(struct d + return false; + + damos_for_each_ops_filter(filter, scheme) { +- if (damos_pa_filter_match(filter, folio)) ++ if (damos_folio_filter_match(filter, folio)) + return !filter->allow; + } + return scheme->ops_filters_default_reject; diff --git a/debian/patches/patchset-pf/steady/0022-mm-damon-ops-common-ignore-migration-request-to-inva.patch b/debian/patches/patchset-pf/steady/0022-mm-damon-ops-common-ignore-migration-request-to-inva.patch new file mode 100644 index 0000000..c5dc2a5 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0022-mm-damon-ops-common-ignore-migration-request-to-inva.patch @@ -0,0 +1,58 @@ +From 28ceaa34f71077b305a2fae3abf9e8af606fbae7 Mon Sep 17 00:00:00 2001 +From: SeongJae Park +Date: Sun, 20 Jul 2025 11:58:22 -0700 +Subject: mm/damon/ops-common: ignore migration request to invalid nodes + +damon_migrate_pages() tries migration even if the target node is invalid. +If users mistakenly make such invalid requests via +DAMOS_MIGRATE_{HOT,COLD} action, the below kernel BUG can happen. + + [ 7831.883495] BUG: unable to handle page fault for address: 0000000000001f48 + [ 7831.884160] #PF: supervisor read access in kernel mode + [ 7831.884681] #PF: error_code(0x0000) - not-present page + [ 7831.885203] PGD 0 P4D 0 + [ 7831.885468] Oops: Oops: 0000 [#1] SMP PTI + [ 7831.885852] CPU: 31 UID: 0 PID: 94202 Comm: kdamond.0 Not tainted 6.16.0-rc5-mm-new-damon+ #93 PREEMPT(voluntary) + [ 7831.886913] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.el9 04/01/2014 + [ 7831.887777] RIP: 0010:__alloc_frozen_pages_noprof (include/linux/mmzone.h:1724 include/linux/mmzone.h:1750 mm/page_alloc.c:4936 mm/page_alloc.c:5137) + [...] + [ 7831.895953] Call Trace: + [ 7831.896195] + [ 7831.896397] __folio_alloc_noprof (mm/page_alloc.c:5183 mm/page_alloc.c:5192) + [ 7831.896787] migrate_pages_batch (mm/migrate.c:1189 mm/migrate.c:1851) + [ 7831.897228] ? __pfx_alloc_migration_target (mm/migrate.c:2137) + [ 7831.897735] migrate_pages (mm/migrate.c:2078) + [ 7831.898141] ? __pfx_alloc_migration_target (mm/migrate.c:2137) + [ 7831.898664] damon_migrate_folio_list (mm/damon/ops-common.c:321 mm/damon/ops-common.c:354) + [ 7831.899140] damon_migrate_pages (mm/damon/ops-common.c:405) + [...] + +Add a target node validity check in damon_migrate_pages(). The validity +check is stolen from that of do_pages_move(), which is being used for the +move_pages() system call. + +Link: https://lkml.kernel.org/r/20250720185822.1451-1-sj@kernel.org +Fixes: b51820ebea65 ("mm/damon/paddr: introduce DAMOS_MIGRATE_COLD action for demotion") [6.11.x] +Signed-off-by: SeongJae Park +Reviewed-by: Joshua Hahn +Cc: Honggyu Kim +Cc: Hyeongtak Ji +Cc: +Signed-off-by: Andrew Morton +--- + mm/damon/ops-common.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/mm/damon/ops-common.c ++++ b/mm/damon/ops-common.c +@@ -383,6 +383,10 @@ unsigned long damon_migrate_pages(struct + if (list_empty(folio_list)) + return nr_migrated; + ++ if (target_nid < 0 || target_nid >= MAX_NUMNODES || ++ !node_state(target_nid, N_MEMORY)) ++ return nr_migrated; ++ + noreclaim_flag = memalloc_noreclaim_save(); + + nid = folio_nid(lru_to_folio(folio_list)); diff --git a/debian/patches/patchset-pf/steady/0023-usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbin.patch b/debian/patches/patchset-pf/steady/0023-usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbin.patch new file mode 100644 index 0000000..2d6365f --- /dev/null +++ b/debian/patches/patchset-pf/steady/0023-usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbin.patch @@ -0,0 +1,28 @@ +From 20235e70d4e5f0f66e0b037e9e02ca7ec0cf97a5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:08 +0200 +Subject: usb: gadget: udc: renesas_usb3: fix device leak at unbind + +Make sure to drop the reference to the companion device taken during +probe when the driver is unbound. + +Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") +Cc: stable@vger.kernel.org # 4.19 +Cc: Yoshihiro Shimoda +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20250724091910.21092-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/renesas_usb3.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2657,6 +2657,7 @@ static void renesas_usb3_remove(struct p + struct renesas_usb3 *usb3 = platform_get_drvdata(pdev); + + debugfs_remove_recursive(usb3->dentry); ++ put_device(usb3->host_dev); + device_remove_file(&pdev->dev, &dev_attr_role); + + cancel_work_sync(&usb3->role_work); diff --git a/debian/patches/patchset-pf/steady/0024-PCI-portdrv-Use-is_pciehp-instead-of-is_hotplug_brid.patch b/debian/patches/patchset-pf/steady/0024-PCI-portdrv-Use-is_pciehp-instead-of-is_hotplug_brid.patch new file mode 100644 index 0000000..d7dd97c --- /dev/null +++ b/debian/patches/patchset-pf/steady/0024-PCI-portdrv-Use-is_pciehp-instead-of-is_hotplug_brid.patch @@ -0,0 +1,36 @@ +From b958aba8ee0d90742627dd46324cd29fd3e3abce Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sun, 13 Jul 2025 16:31:02 +0200 +Subject: PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge + +The PCIe port driver erroneously creates a subdevice for hotplug on ACPI +slots which are handled by the ACPI hotplug driver. + +Avoid by checking the is_pciehp flag instead of is_hotplug_bridge when +deciding whether to create a subdevice. The latter encompasses ACPI slots +whereas the former doesn't. + +The superfluous subdevice has no real negative impact, it occupies memory +and interrupt resources but otherwise just sits there waiting for +interrupts from the slot that are never signaled. + +Fixes: f8415222837b ("PCI: Use cached copy of PCI_EXP_SLTCAP_HPC bit") +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org # v4.7+ +Link: https://patch.msgid.link/40d5a5fe8d40595d505949c620a067fa110ee85e.1752390102.git.lukas@wunner.de +--- + drivers/pci/pcie/portdrv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/pcie/portdrv.c ++++ b/drivers/pci/pcie/portdrv.c +@@ -220,7 +220,7 @@ static int get_port_device_capability(st + struct pci_host_bridge *host = pci_find_host_bridge(dev->bus); + int services = 0; + +- if (dev->is_hotplug_bridge && ++ if (dev->is_pciehp && + (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT || + pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM) && + (pcie_ports_native || host->native_pcie_hotplug)) { diff --git a/debian/patches/patchset-pf/steady/0025-ata-libata-scsi-Fix-ata_to_sense_error-status-handli.patch b/debian/patches/patchset-pf/steady/0025-ata-libata-scsi-Fix-ata_to_sense_error-status-handli.patch new file mode 100644 index 0000000..47f9063 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0025-ata-libata-scsi-Fix-ata_to_sense_error-status-handli.patch @@ -0,0 +1,85 @@ +From eb5df6a83646eb2ecd7eda995b5632031acf94b3 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Tue, 29 Jul 2025 18:28:07 +0900 +Subject: ata: libata-scsi: Fix ata_to_sense_error() status handling + +Commit 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()") +inadvertantly added the entry 0x40 (ATA_DRDY) to the stat_table array in +the function ata_to_sense_error(). This entry ties a failed qc which has +a status filed equal to ATA_DRDY to the sense key ILLEGAL REQUEST with +the additional sense code UNALIGNED WRITE COMMAND. This entry will be +used to generate a failed qc sense key and sense code when the qc is +missing sense data and there is no match for the qc error field in the +sense_table array of ata_to_sense_error(). + +As a result, for a failed qc for which we failed to get sense data (e.g. +read log 10h failed if qc is an NCQ command, or REQUEST SENSE EXT +command failed for the non-ncq case, the user very often end up seeing +the completely misleading "unaligned write command" error, even if qc +was not a write command. E.g.: + +sd 0:0:0:0: [sda] tag#12 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s +sd 0:0:0:0: [sda] tag#12 Sense Key : Illegal Request [current] +sd 0:0:0:0: [sda] tag#12 Add. Sense: Unaligned write command +sd 0:0:0:0: [sda] tag#12 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00 +I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 + +Fix this by removing the ATA_DRDY entry from the stat_table array so +that we default to always returning ABORTED COMMAND without any +additional sense code, since we do not know any better. The entry 0x08 +(ATA_DRQ) is also removed since signaling ABORTED COMMAND with a parity +error is also misleading (as a parity error would likely be signaled +through a bus error). So for this case, also default to returning +ABORTED COMMAND without any additional sense code. With this, the +previous example error case becomes: + +sd 0:0:0:0: [sda] tag#17 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s +sd 0:0:0:0: [sda] tag#17 Sense Key : Aborted Command [current] +sd 0:0:0:0: [sda] tag#17 Add. Sense: No additional sense information +sd 0:0:0:0: [sda] tag#17 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00 +I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 + +Together with these fixes, refactor stat_table to make it more readable +by putting the entries comments in front of the entries and using the +defined status bits macros instead of hardcoded values. + +Reported-by: Lorenz Brun +Reported-by: Brandon Schwartz +Fixes: 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Reviewed-by: Martin K. Petersen +--- + drivers/ata/libata-scsi.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -859,18 +859,14 @@ static void ata_to_sense_error(u8 drv_st + {0xFF, 0xFF, 0xFF, 0xFF}, // END mark + }; + static const unsigned char stat_table[][4] = { +- /* Must be first because BUSY means no other bits valid */ +- {0x80, ABORTED_COMMAND, 0x47, 0x00}, +- // Busy, fake parity for now +- {0x40, ILLEGAL_REQUEST, 0x21, 0x04}, +- // Device ready, unaligned write command +- {0x20, HARDWARE_ERROR, 0x44, 0x00}, +- // Device fault, internal target failure +- {0x08, ABORTED_COMMAND, 0x47, 0x00}, +- // Timed out in xfer, fake parity for now +- {0x04, RECOVERED_ERROR, 0x11, 0x00}, +- // Recovered ECC error Medium error, recovered +- {0xFF, 0xFF, 0xFF, 0xFF}, // END mark ++ /* Busy: must be first because BUSY means no other bits valid */ ++ { ATA_BUSY, ABORTED_COMMAND, 0x00, 0x00 }, ++ /* Device fault: INTERNAL TARGET FAILURE */ ++ { ATA_DF, HARDWARE_ERROR, 0x44, 0x00 }, ++ /* Corrected data error */ ++ { ATA_CORR, RECOVERED_ERROR, 0x00, 0x00 }, ++ ++ { 0xFF, 0xFF, 0xFF, 0xFF }, /* END mark */ + }; + + /* diff --git a/debian/patches/patchset-pf/steady/0026-ata-libata-scsi-Return-aborted-command-when-missing-.patch b/debian/patches/patchset-pf/steady/0026-ata-libata-scsi-Return-aborted-command-when-missing-.patch new file mode 100644 index 0000000..ffcb7a0 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0026-ata-libata-scsi-Return-aborted-command-when-missing-.patch @@ -0,0 +1,69 @@ +From 222f2d776f617895a876ccd7047cbebc82175f38 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Tue, 29 Jul 2025 19:37:12 +0900 +Subject: ata: libata-scsi: Return aborted command when missing sense and + result TF + +ata_gen_ata_sense() is always called for a failed qc missing sense data +so that a sense key, code and code qualifier can be generated using +ata_to_sense_error() from the qc status and error fields of its result +task file. However, if the qc does not have its result task file filled, +ata_gen_ata_sense() returns early without setting a sense key. + +Improve this by defaulting to returning ABORTED COMMAND without any +additional sense code, since we do not know the reason for the failure. +The same fix is also applied in ata_gen_passthru_sense() with the +additional check that the qc failed (qc->err_mask is set). + +Fixes: 816be86c7993 ("ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Reviewed-by: Martin K. Petersen +--- + drivers/ata/libata-scsi.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -938,6 +938,8 @@ static void ata_gen_passthru_sense(struc + if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) { + ata_dev_dbg(dev, + "missing result TF: can't generate ATA PT sense data\n"); ++ if (qc->err_mask) ++ ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0, 0); + return; + } + +@@ -992,8 +994,8 @@ static void ata_gen_ata_sense(struct ata + + if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) { + ata_dev_dbg(dev, +- "missing result TF: can't generate sense data\n"); +- return; ++ "Missing result TF: reporting aborted command\n"); ++ goto aborted; + } + + /* Use ata_to_sense_error() to map status register bits +@@ -1004,13 +1006,15 @@ static void ata_gen_ata_sense(struct ata + ata_to_sense_error(tf->status, tf->error, + &sense_key, &asc, &ascq); + ata_scsi_set_sense(dev, cmd, sense_key, asc, ascq); +- } else { +- /* Could not decode error */ +- ata_dev_warn(dev, "could not decode error status 0x%x err_mask 0x%x\n", +- tf->status, qc->err_mask); +- ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0, 0); + return; + } ++ ++ /* Could not decode error */ ++ ata_dev_warn(dev, ++ "Could not decode error 0x%x, status 0x%x (err_mask=0x%x)\n", ++ tf->error, tf->status, qc->err_mask); ++aborted: ++ ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0, 0); + } + + void ata_scsi_sdev_config(struct scsi_device *sdev) diff --git a/debian/patches/patchset-pf/steady/0027-vhost-vsock-Avoid-allocating-arbitrarily-sized-SKBs.patch b/debian/patches/patchset-pf/steady/0027-vhost-vsock-Avoid-allocating-arbitrarily-sized-SKBs.patch new file mode 100644 index 0000000..039bb10 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0027-vhost-vsock-Avoid-allocating-arbitrarily-sized-SKBs.patch @@ -0,0 +1,48 @@ +From 1696616a3e6e9d5eef2c39723ddaafb78a9a6eeb Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 17 Jul 2025 10:01:08 +0100 +Subject: vhost/vsock: Avoid allocating arbitrarily-sized SKBs + +vhost_vsock_alloc_skb() returns NULL for packets advertising a length +larger than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE in the packet header. However, +this is only checked once the SKB has been allocated and, if the length +in the packet header is zero, the SKB may not be freed immediately. + +Hoist the size check before the SKB allocation so that an iovec larger +than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + the header size is rejected +outright. The subsequent check on the length field in the header can +then simply check that the allocated SKB is indeed large enough to hold +the packet. + +Cc: +Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") +Reviewed-by: Stefano Garzarella +Signed-off-by: Will Deacon +Message-Id: <20250717090116.11987-2-will@kernel.org> +Signed-off-by: Michael S. Tsirkin +--- + drivers/vhost/vsock.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -344,6 +344,9 @@ vhost_vsock_alloc_skb(struct vhost_virtq + + len = iov_length(vq->iov, out); + ++ if (len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM) ++ return NULL; ++ + /* len contains both payload and hdr */ + skb = virtio_vsock_alloc_skb(len, GFP_KERNEL); + if (!skb) +@@ -367,8 +370,7 @@ vhost_vsock_alloc_skb(struct vhost_virtq + return skb; + + /* The pkt is too big or the length in the header is invalid */ +- if (payload_len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || +- payload_len + sizeof(*hdr) > len) { ++ if (payload_len + sizeof(*hdr) > len) { + kfree_skb(skb); + return NULL; + } diff --git a/debian/patches/patchset-pf/steady/0028-vsock-virtio-Validate-length-in-packet-header-before.patch b/debian/patches/patchset-pf/steady/0028-vsock-virtio-Validate-length-in-packet-header-before.patch new file mode 100644 index 0000000..1755d53 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0028-vsock-virtio-Validate-length-in-packet-header-before.patch @@ -0,0 +1,57 @@ +From cfb5ffceff501d3ffe6529706d65a35e6068b638 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 17 Jul 2025 10:01:09 +0100 +Subject: vsock/virtio: Validate length in packet header before skb_put() + +When receiving a vsock packet in the guest, only the virtqueue buffer +size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, +virtio_vsock_skb_rx_put() uses the length from the packet header as the +length argument to skb_put(), potentially resulting in SKB overflow if +the host has gone wonky. + +Validate the length as advertised by the packet header before calling +virtio_vsock_skb_rx_put(). + +Cc: +Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") +Signed-off-by: Will Deacon +Message-Id: <20250717090116.11987-3-will@kernel.org> +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Stefano Garzarella +--- + net/vmw_vsock/virtio_transport.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/net/vmw_vsock/virtio_transport.c ++++ b/net/vmw_vsock/virtio_transport.c +@@ -624,8 +624,9 @@ static void virtio_transport_rx_work(str + do { + virtqueue_disable_cb(vq); + for (;;) { ++ unsigned int len, payload_len; ++ struct virtio_vsock_hdr *hdr; + struct sk_buff *skb; +- unsigned int len; + + if (!virtio_transport_more_replies(vsock)) { + /* Stop rx until the device processes already +@@ -642,11 +643,18 @@ static void virtio_transport_rx_work(str + vsock->rx_buf_nr--; + + /* Drop short/long packets */ +- if (unlikely(len < sizeof(struct virtio_vsock_hdr) || ++ if (unlikely(len < sizeof(*hdr) || + len > virtio_vsock_skb_len(skb))) { + kfree_skb(skb); + continue; + } ++ ++ hdr = virtio_vsock_hdr(skb); ++ payload_len = le32_to_cpu(hdr->len); ++ if (unlikely(payload_len > len - sizeof(*hdr))) { ++ kfree_skb(skb); ++ continue; ++ } + + virtio_vsock_skb_rx_put(skb); + virtio_transport_deliver_tap_pkt(skb); diff --git a/debian/patches/patchset-pf/steady/0029-fs-proc-task_mmu-remove-conversion-of-seq_file-posit.patch b/debian/patches/patchset-pf/steady/0029-fs-proc-task_mmu-remove-conversion-of-seq_file-posit.patch new file mode 100644 index 0000000..a23b4fe --- /dev/null +++ b/debian/patches/patchset-pf/steady/0029-fs-proc-task_mmu-remove-conversion-of-seq_file-posit.patch @@ -0,0 +1,105 @@ +From b7e9e555a80801d33d94287307e7b7606501cffb Mon Sep 17 00:00:00 2001 +From: Suren Baghdasaryan +Date: Sat, 19 Jul 2025 11:28:53 -0700 +Subject: fs/proc/task_mmu: remove conversion of seq_file position to unsigned +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Back in 2.6 era, last_addr used to be stored in seq_file->version +variable, which was unsigned long. As a result, sentinels to represent +gate vma and end of all vmas used unsigned values. In more recent kernels +we don't used seq_file->version anymore and therefore conversion from +loff_t into unsigned type is not needed. Similarly, sentinel values don't +need to be unsigned. Remove type conversion for set_file position and +change sentinel values to signed. While at it, change the hardcoded +sentinel values with named definitions for better documentation. + +Link: https://lkml.kernel.org/r/20250719182854.3166724-6-surenb@google.com +Signed-off-by: Suren Baghdasaryan +Reviewed-by: Lorenzo Stoakes +Reviewed-by: Vlastimil Babka +Acked-by: David Hildenbrand +Cc: Alexey Dobriyan +Cc: Andrii Nakryiko +Cc: Christian Brauner +Cc: Christophe Leroy +Cc: Jann Horn +Cc: Jeongjun Park +Cc: Johannes Weiner +Cc: Josef Bacik +Cc: Kalesh Singh +Cc: Liam Howlett +Cc: Matthew Wilcox (Oracle) +Cc: Michal Hocko +Cc: Oscar Salvador +Cc: "Paul E . McKenney" +Cc: Peter Xu +Cc: Ryan Roberts +Cc: Shuah Khan +Cc: Thomas Weißschuh +Cc: T.J. Mercier +Cc: Ye Bin +Signed-off-by: Andrew Morton +--- + fs/proc/task_mmu.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -29,6 +29,9 @@ + #include + #include "internal.h" + ++#define SENTINEL_VMA_END -1 ++#define SENTINEL_VMA_GATE -2 ++ + #define SEQ_PUT_DEC(str, val) \ + seq_put_decimal_ull_width(m, str, (val) << (PAGE_SHIFT-10), 8) + void task_mem(struct seq_file *m, struct mm_struct *mm) +@@ -135,7 +138,7 @@ static struct vm_area_struct *proc_get_v + if (vma) { + *ppos = vma->vm_start; + } else { +- *ppos = -2UL; ++ *ppos = SENTINEL_VMA_GATE; + vma = get_gate_vma(priv->mm); + } + +@@ -145,11 +148,11 @@ static struct vm_area_struct *proc_get_v + static void *m_start(struct seq_file *m, loff_t *ppos) + { + struct proc_maps_private *priv = m->private; +- unsigned long last_addr = *ppos; ++ loff_t last_addr = *ppos; + struct mm_struct *mm; + + /* See m_next(). Zero at the start or after lseek. */ +- if (last_addr == -1UL) ++ if (last_addr == SENTINEL_VMA_END) + return NULL; + + priv->task = get_proc_task(priv->inode); +@@ -170,9 +173,9 @@ static void *m_start(struct seq_file *m, + return ERR_PTR(-EINTR); + } + +- vma_iter_init(&priv->iter, mm, last_addr); ++ vma_iter_init(&priv->iter, mm, (unsigned long)last_addr); + hold_task_mempolicy(priv); +- if (last_addr == -2UL) ++ if (last_addr == SENTINEL_VMA_GATE) + return get_gate_vma(mm); + + return proc_get_vma(priv, ppos); +@@ -180,8 +183,8 @@ static void *m_start(struct seq_file *m, + + static void *m_next(struct seq_file *m, void *v, loff_t *ppos) + { +- if (*ppos == -2UL) { +- *ppos = -1UL; ++ if (*ppos == SENTINEL_VMA_GATE) { ++ *ppos = SENTINEL_VMA_END; + return NULL; + } + return proc_get_vma(m->private, ppos); diff --git a/debian/patches/patchset-pf/steady/0030-kbuild-userprogs-use-correct-linker-when-mixing-clan.patch b/debian/patches/patchset-pf/steady/0030-kbuild-userprogs-use-correct-linker-when-mixing-clan.patch new file mode 100644 index 0000000..cbe3ba0 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0030-kbuild-userprogs-use-correct-linker-when-mixing-clan.patch @@ -0,0 +1,36 @@ +From 49442fb626f151f886cb5a860c972c300307fdff Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= +Date: Mon, 28 Jul 2025 15:47:37 +0200 +Subject: kbuild: userprogs: use correct linker when mixing clang and GNU ld +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The userprogs infrastructure does not expect clang being used with GNU ld +and in that case uses /usr/bin/ld for linking, not the configured $(LD). +This fallback is problematic as it will break when cross-compiling. +Mixing clang and GNU ld is used for example when building for SPARC64, +as ld.lld is not sufficient; see Documentation/kbuild/llvm.rst. + +Relax the check around --ld-path so it gets used for all linkers. + +Fixes: dfc1b168a8c4 ("kbuild: userprogs: use correct lld when linking through clang") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Weißschuh +Reviewed-by: Nathan Chancellor +Signed-off-by: Masahiro Yamada +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Makefile ++++ b/Makefile +@@ -1154,7 +1154,7 @@ KBUILD_USERCFLAGS += $(filter -m32 -m64 + KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) + + # userspace programs are linked via the compiler, use the correct linker +-ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_LD_IS_LLD),yy) ++ifdef CONFIG_CC_IS_CLANG + KBUILD_USERLDFLAGS += --ld-path=$(LD) + endif + diff --git a/debian/patches/patchset-pf/steady/0031-Revert-vgacon-Add-check-for-vc_origin-address-range-.patch b/debian/patches/patchset-pf/steady/0031-Revert-vgacon-Add-check-for-vc_origin-address-range-.patch new file mode 100644 index 0000000..af1fc76 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0031-Revert-vgacon-Add-check-for-vc_origin-address-range-.patch @@ -0,0 +1,36 @@ +From 31a1e00a65d88e2f051fb6e9551340cc815d54d4 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 2 Aug 2025 21:34:37 +0200 +Subject: Revert "vgacon: Add check for vc_origin address range in + vgacon_scroll()" + +This reverts commit 864f9963ec6b4b76d104d595ba28110b87158003. + +The patch is wrong as it checks vc_origin against vc_screenbuf, +while in text mode it should compare against vga_vram_base. + +As such it broke VGA text scrolling, which can be reproduced like this: +(1) boot a kernel that is configured to use text mode VGA-console +(2) type commands: ls -l /usr/bin | less -S +(3) scroll up/down with cursor-down/up keys + +Reported-by: Jari Ruusu +Cc: stable@vger.kernel.org +Cc: Yi Yang +Cc: GONG Ruiqi +Signed-off-by: Helge Deller +--- + drivers/video/console/vgacon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -1168,7 +1168,7 @@ static bool vgacon_scroll(struct vc_data + c->vc_screenbuf_size - delta); + c->vc_origin = vga_vram_end - c->vc_screenbuf_size; + vga_rolled_over = 0; +- } else if (oldo - delta >= (unsigned long)c->vc_screenbuf) ++ } else + c->vc_origin -= delta; + c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size; + scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char, diff --git a/debian/patches/patchset-pf/steady/0032-crypto-hash-Increase-HASH_MAX_DESCSIZE-for-hmac-sha3.patch b/debian/patches/patchset-pf/steady/0032-crypto-hash-Increase-HASH_MAX_DESCSIZE-for-hmac-sha3.patch new file mode 100644 index 0000000..380e5b8 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0032-crypto-hash-Increase-HASH_MAX_DESCSIZE-for-hmac-sha3.patch @@ -0,0 +1,28 @@ +From 5c50d7a4d6580d6cc83d1231aa358defe43bc46d Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Thu, 31 Jul 2025 09:41:47 +0800 +Subject: crypto: hash - Increase HASH_MAX_DESCSIZE for hmac(sha3-224-s390) + +The value of HASH_MAX_DESCSIZE is off by one for hmac(sha3-224-s390). +Fix this so that hmac(sha3-224-s390) can be registered. + +Reported-by: Ingo Franzki +Reported-by: Eric Biggers +Fixes: 6f90ba706551 ("crypto: s390/sha3 - Use API partial block handling") +Cc: +Signed-off-by: Herbert Xu +--- + include/crypto/hash.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/crypto/hash.h ++++ b/include/crypto/hash.h +@@ -184,7 +184,7 @@ struct shash_desc { + * Worst case is hmac(sha3-224-s390). Its context is a nested 'shash_desc' + * containing a 'struct s390_sha_ctx'. + */ +-#define HASH_MAX_DESCSIZE (sizeof(struct shash_desc) + 360) ++#define HASH_MAX_DESCSIZE (sizeof(struct shash_desc) + 361) + #define MAX_SYNC_HASH_REQSIZE (sizeof(struct ahash_request) + \ + HASH_MAX_DESCSIZE) + diff --git a/debian/patches/patchset-pf/steady/0033-cifs-Add-support-for-creating-reparse-points-over-SM.patch b/debian/patches/patchset-pf/steady/0033-cifs-Add-support-for-creating-reparse-points-over-SM.patch new file mode 100644 index 0000000..bc11d41 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0033-cifs-Add-support-for-creating-reparse-points-over-SM.patch @@ -0,0 +1,478 @@ +From 1b49e1eaff6d1d665cacad667a1fc03c38fc8533 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pali=20Roh=C3=A1r?= +Date: Thu, 26 Dec 2024 00:43:22 +0100 +Subject: cifs: Add support for creating reparse points over SMB1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +SMB1 already supports querying reparse points and detecting types of +symlink, fifo, socket, block and char. + +This change implements the missing part - ability to create a new reparse +points over SMB1. This includes everything which SMB2+ already supports: +- native SMB symlinks and sockets +- NFS style of special files (symlinks, fifos, sockets, char/block devs) +- WSL style of special files (symlinks, fifos, sockets, char/block devs) + +Attaching a reparse point to an existing file or directory is done via +SMB1 SMB_COM_NT_TRANSACT/NT_TRANSACT_IOCTL/FSCTL_SET_REPARSE_POINT command +and implemented in a new cifs_create_reparse_inode() function. + +This change introduce a new callback ->create_reparse_inode() which creates +a new reperse point file or directory and returns inode. For SMB1 it is +provided via that new cifs_create_reparse_inode() function. + +Existing reparse.c code was only slightly updated to call new protocol +callback ->create_reparse_inode() instead of hardcoded SMB2+ function. +This make the whole reparse.c code to work with every SMB dialect. + +The original callback ->create_reparse_symlink() is not needed anymore as +the implementation of new create_reparse_symlink() function is dialect +agnostic too. So the link.c code was updated to call that function directly +(and not via callback). + +Signed-off-by: Pali Rohár +Signed-off-by: Steve French +--- + fs/smb/client/cifsglob.h | 14 +++-- + fs/smb/client/cifsproto.h | 8 +++ + fs/smb/client/cifssmb.c | 128 ++++++++++++++++++++++++++++++++++++++ + fs/smb/client/link.c | 13 ++-- + fs/smb/client/reparse.c | 16 +++-- + fs/smb/client/reparse.h | 4 +- + fs/smb/client/smb1ops.c | 31 ++++++--- + fs/smb/client/smb2inode.c | 2 +- + fs/smb/client/smb2ops.c | 10 +-- + fs/smb/client/smb2proto.h | 5 +- + 10 files changed, 188 insertions(+), 43 deletions(-) + +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -627,12 +627,14 @@ struct smb_version_operations { + bool (*is_network_name_deleted)(char *buf, struct TCP_Server_Info *srv); + struct reparse_data_buffer * (*get_reparse_point_buffer)(const struct kvec *rsp_iov, + u32 *plen); +- int (*create_reparse_symlink)(const unsigned int xid, +- struct inode *inode, +- struct dentry *dentry, +- struct cifs_tcon *tcon, +- const char *full_path, +- const char *symname); ++ struct inode * (*create_reparse_inode)(struct cifs_open_info_data *data, ++ struct super_block *sb, ++ const unsigned int xid, ++ struct cifs_tcon *tcon, ++ const char *full_path, ++ bool directory, ++ struct kvec *reparse_iov, ++ struct kvec *xattr_iov); + }; + + struct smb_version_values { +--- a/fs/smb/client/cifsproto.h ++++ b/fs/smb/client/cifsproto.h +@@ -483,6 +483,14 @@ extern int cifs_query_reparse_point(cons + const char *full_path, + u32 *tag, struct kvec *rsp, + int *rsp_buftype); ++extern struct inode *cifs_create_reparse_inode(struct cifs_open_info_data *data, ++ struct super_block *sb, ++ const unsigned int xid, ++ struct cifs_tcon *tcon, ++ const char *full_path, ++ bool directory, ++ struct kvec *reparse_iov, ++ struct kvec *xattr_iov); + extern int CIFSSMB_set_compression(const unsigned int xid, + struct cifs_tcon *tcon, __u16 fid); + extern int CIFS_open(const unsigned int xid, struct cifs_open_parms *oparms, +--- a/fs/smb/client/cifssmb.c ++++ b/fs/smb/client/cifssmb.c +@@ -2851,6 +2851,134 @@ error: + return rc; + } + ++struct inode *cifs_create_reparse_inode(struct cifs_open_info_data *data, ++ struct super_block *sb, ++ const unsigned int xid, ++ struct cifs_tcon *tcon, ++ const char *full_path, ++ bool directory, ++ struct kvec *reparse_iov, ++ struct kvec *xattr_iov) ++{ ++ struct cifs_sb_info *cifs_sb = CIFS_SB(sb); ++ struct cifs_open_parms oparms; ++ TRANSACT_IOCTL_REQ *io_req; ++ struct inode *new = NULL; ++ struct kvec in_iov[2]; ++ struct kvec out_iov; ++ struct cifs_fid fid; ++ int io_req_len; ++ int oplock = 0; ++ int buf_type = 0; ++ int rc; ++ ++ cifs_tcon_dbg(FYI, "%s: path=%s\n", __func__, full_path); ++ ++ /* ++ * If server filesystem does not support reparse points then do not ++ * attempt to create reparse point. This will prevent creating unusable ++ * empty object on the server. ++ */ ++ if (!(le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS)) ++ return ERR_PTR(-EOPNOTSUPP); ++ ++#ifndef CONFIG_CIFS_XATTR ++ if (xattr_iov) ++ return ERR_PTR(-EOPNOTSUPP); ++#endif ++ ++ oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, ++ FILE_READ_ATTRIBUTES | FILE_WRITE_DATA | FILE_WRITE_EA, ++ FILE_CREATE, ++ (directory ? CREATE_NOT_FILE : CREATE_NOT_DIR) | OPEN_REPARSE_POINT, ++ ACL_NO_MODE); ++ oparms.fid = &fid; ++ ++ rc = CIFS_open(xid, &oparms, &oplock, NULL); ++ if (rc) ++ return ERR_PTR(rc); ++ ++#ifdef CONFIG_CIFS_XATTR ++ if (xattr_iov) { ++ struct smb2_file_full_ea_info *ea; ++ ++ ea = &((struct smb2_create_ea_ctx *)xattr_iov->iov_base)->ea; ++ while (1) { ++ rc = CIFSSMBSetEA(xid, ++ tcon, ++ full_path, ++ &ea->ea_data[0], ++ &ea->ea_data[ea->ea_name_length+1], ++ le16_to_cpu(ea->ea_value_length), ++ cifs_sb->local_nls, ++ cifs_sb); ++ if (rc) ++ goto out_close; ++ if (le32_to_cpu(ea->next_entry_offset) == 0) ++ break; ++ ea = (struct smb2_file_full_ea_info *)((u8 *)ea + ++ le32_to_cpu(ea->next_entry_offset)); ++ } ++ } ++#endif ++ ++ rc = smb_init(SMB_COM_NT_TRANSACT, 23, tcon, (void **)&io_req, NULL); ++ if (rc) ++ goto out_close; ++ ++ inc_rfc1001_len(io_req, sizeof(io_req->Pad)); ++ ++ io_req_len = be32_to_cpu(io_req->hdr.smb_buf_length) + sizeof(io_req->hdr.smb_buf_length); ++ ++ /* NT IOCTL response contains one-word long output setup buffer with size of output data. */ ++ io_req->MaxSetupCount = 1; ++ /* NT IOCTL response does not contain output parameters. */ ++ io_req->MaxParameterCount = cpu_to_le32(0); ++ /* FSCTL_SET_REPARSE_POINT response contains empty output data. */ ++ io_req->MaxDataCount = cpu_to_le32(0); ++ ++ io_req->TotalParameterCount = cpu_to_le32(0); ++ io_req->TotalDataCount = cpu_to_le32(reparse_iov->iov_len); ++ io_req->ParameterCount = io_req->TotalParameterCount; ++ io_req->ParameterOffset = cpu_to_le32(0); ++ io_req->DataCount = io_req->TotalDataCount; ++ io_req->DataOffset = cpu_to_le32(offsetof(typeof(*io_req), Data) - ++ sizeof(io_req->hdr.smb_buf_length)); ++ io_req->SetupCount = 4; ++ io_req->SubCommand = cpu_to_le16(NT_TRANSACT_IOCTL); ++ io_req->FunctionCode = cpu_to_le32(FSCTL_SET_REPARSE_POINT); ++ io_req->Fid = fid.netfid; ++ io_req->IsFsctl = 1; ++ io_req->IsRootFlag = 0; ++ io_req->ByteCount = cpu_to_le16(le32_to_cpu(io_req->DataCount) + sizeof(io_req->Pad)); ++ ++ inc_rfc1001_len(io_req, reparse_iov->iov_len); ++ ++ in_iov[0].iov_base = (char *)io_req; ++ in_iov[0].iov_len = io_req_len; ++ in_iov[1] = *reparse_iov; ++ rc = SendReceive2(xid, tcon->ses, in_iov, ARRAY_SIZE(in_iov), &buf_type, ++ CIFS_NO_RSP_BUF, &out_iov); ++ ++ cifs_buf_release(io_req); ++ ++ if (!rc) ++ rc = cifs_get_inode_info(&new, full_path, data, sb, xid, NULL); ++ ++out_close: ++ CIFSSMBClose(xid, tcon, fid.netfid); ++ ++ /* ++ * If CREATE was successful but FSCTL_SET_REPARSE_POINT failed then ++ * remove the intermediate object created by CREATE. Otherwise ++ * empty object stay on the server when reparse call failed. ++ */ ++ if (rc) ++ CIFSSMBDelFile(xid, tcon, full_path, cifs_sb, NULL); ++ ++ return rc ? ERR_PTR(rc) : new; ++} ++ + int + CIFSSMB_set_compression(const unsigned int xid, struct cifs_tcon *tcon, + __u16 fid) +--- a/fs/smb/client/link.c ++++ b/fs/smb/client/link.c +@@ -19,6 +19,7 @@ + #include "smb2proto.h" + #include "cifs_ioctl.h" + #include "fs_context.h" ++#include "reparse.h" + + /* + * M-F Symlink Functions - Begin +@@ -570,7 +571,6 @@ cifs_symlink(struct mnt_idmap *idmap, st + int rc = -EOPNOTSUPP; + unsigned int xid; + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); +- struct TCP_Server_Info *server; + struct tcon_link *tlink; + struct cifs_tcon *pTcon; + const char *full_path; +@@ -593,7 +593,6 @@ cifs_symlink(struct mnt_idmap *idmap, st + goto symlink_exit; + } + pTcon = tlink_tcon(tlink); +- server = cifs_pick_channel(pTcon->ses); + + full_path = build_path_from_dentry(direntry, page); + if (IS_ERR(full_path)) { +@@ -636,13 +635,9 @@ cifs_symlink(struct mnt_idmap *idmap, st + case CIFS_SYMLINK_TYPE_NATIVE: + case CIFS_SYMLINK_TYPE_NFS: + case CIFS_SYMLINK_TYPE_WSL: +- if (server->ops->create_reparse_symlink && +- (le32_to_cpu(pTcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS)) { +- rc = server->ops->create_reparse_symlink(xid, inode, +- direntry, +- pTcon, +- full_path, +- symname); ++ if (le32_to_cpu(pTcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) { ++ rc = create_reparse_symlink(xid, inode, direntry, pTcon, ++ full_path, symname); + goto symlink_exit; + } + break; +--- a/fs/smb/client/reparse.c ++++ b/fs/smb/client/reparse.c +@@ -34,7 +34,7 @@ static int detect_directory_symlink_targ + const char *symname, + bool *directory); + +-int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode, ++int create_reparse_symlink(const unsigned int xid, struct inode *inode, + struct dentry *dentry, struct cifs_tcon *tcon, + const char *full_path, const char *symname) + { +@@ -227,7 +227,8 @@ static int create_native_symlink(const u + + iov.iov_base = buf; + iov.iov_len = len; +- new = smb2_get_reparse_inode(&data, inode->i_sb, xid, ++ new = tcon->ses->server->ops->create_reparse_inode( ++ &data, inode->i_sb, xid, + tcon, full_path, directory, + &iov, NULL); + if (!IS_ERR(new)) +@@ -399,7 +400,8 @@ static int create_native_socket(const un + struct inode *new; + int rc = 0; + +- new = smb2_get_reparse_inode(&data, inode->i_sb, xid, ++ new = tcon->ses->server->ops->create_reparse_inode( ++ &data, inode->i_sb, xid, + tcon, full_path, false, &iov, NULL); + if (!IS_ERR(new)) + d_instantiate(dentry, new); +@@ -492,7 +494,8 @@ static int mknod_nfs(unsigned int xid, s + .symlink_target = kstrdup(symname, GFP_KERNEL), + }; + +- new = smb2_get_reparse_inode(&data, inode->i_sb, xid, ++ new = tcon->ses->server->ops->create_reparse_inode( ++ &data, inode->i_sb, xid, + tcon, full_path, false, &iov, NULL); + if (!IS_ERR(new)) + d_instantiate(dentry, new); +@@ -685,7 +688,8 @@ static int mknod_wsl(unsigned int xid, s + memcpy(data.wsl.eas, &cc->ea, len); + data.wsl.eas_len = len; + +- new = smb2_get_reparse_inode(&data, inode->i_sb, ++ new = tcon->ses->server->ops->create_reparse_inode( ++ &data, inode->i_sb, + xid, tcon, full_path, false, + &reparse_iov, &xattr_iov); + if (!IS_ERR(new)) +@@ -698,7 +702,7 @@ static int mknod_wsl(unsigned int xid, s + return rc; + } + +-int smb2_mknod_reparse(unsigned int xid, struct inode *inode, ++int mknod_reparse(unsigned int xid, struct inode *inode, + struct dentry *dentry, struct cifs_tcon *tcon, + const char *full_path, umode_t mode, dev_t dev) + { +--- a/fs/smb/client/reparse.h ++++ b/fs/smb/client/reparse.h +@@ -129,10 +129,10 @@ static inline bool cifs_open_data_repars + bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb, + struct cifs_fattr *fattr, + struct cifs_open_info_data *data); +-int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode, ++int create_reparse_symlink(const unsigned int xid, struct inode *inode, + struct dentry *dentry, struct cifs_tcon *tcon, + const char *full_path, const char *symname); +-int smb2_mknod_reparse(unsigned int xid, struct inode *inode, ++int mknod_reparse(unsigned int xid, struct inode *inode, + struct dentry *dentry, struct cifs_tcon *tcon, + const char *full_path, umode_t mode, dev_t dev); + struct reparse_data_buffer *smb2_get_reparse_point_buffer(const struct kvec *rsp_iov, u32 *len); +--- a/fs/smb/client/smb1ops.c ++++ b/fs/smb/client/smb1ops.c +@@ -16,6 +16,7 @@ + #include "fs_context.h" + #include "nterr.h" + #include "smberr.h" ++#include "reparse.h" + + /* + * An NT cancel request header looks just like the original request except: +@@ -1263,17 +1264,26 @@ cifs_make_node(unsigned int xid, struct + if (rc == 0) + d_instantiate(dentry, newinode); + return rc; ++ } else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) { ++ /* ++ * Check if mounted with mount parm 'sfu' mount parm. ++ * SFU emulation should work with all servers ++ * and was used by default in earlier versions of Windows. ++ */ ++ return cifs_sfu_make_node(xid, inode, dentry, tcon, ++ full_path, mode, dev); ++ } else if (le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) { ++ /* ++ * mknod via reparse points requires server support for ++ * storing reparse points, which is available since ++ * Windows 2000, but was not widely used until release ++ * of Windows Server 2012 by the Windows NFS server. ++ */ ++ return mknod_reparse(xid, inode, dentry, tcon, ++ full_path, mode, dev); ++ } else { ++ return -EOPNOTSUPP; + } +- /* +- * Check if mounted with mount parm 'sfu' mount parm. +- * SFU emulation should work with all servers, but only +- * supports block and char device, socket & fifo, +- * and was used by default in earlier versions of Windows +- */ +- if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) +- return -EPERM; +- return cifs_sfu_make_node(xid, inode, dentry, tcon, +- full_path, mode, dev); + } + + static bool +@@ -1370,6 +1380,7 @@ struct smb_version_operations smb1_opera + .create_hardlink = CIFSCreateHardLink, + .query_symlink = cifs_query_symlink, + .get_reparse_point_buffer = cifs_get_reparse_point_buffer, ++ .create_reparse_inode = cifs_create_reparse_inode, + .open = cifs_open_file, + .set_fid = cifs_set_fid, + .close = cifs_close_file, +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -1320,7 +1320,7 @@ smb2_set_file_info(struct inode *inode, + return rc; + } + +-struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data, ++struct inode *smb2_create_reparse_inode(struct cifs_open_info_data *data, + struct super_block *sb, + const unsigned int xid, + struct cifs_tcon *tcon, +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -5271,7 +5271,7 @@ static int smb2_make_node(unsigned int x + full_path, mode, dev); + } else if ((le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) + || (tcon->posix_extensions)) { +- rc = smb2_mknod_reparse(xid, inode, dentry, tcon, ++ rc = mknod_reparse(xid, inode, dentry, tcon, + full_path, mode, dev); + } + return rc; +@@ -5330,7 +5330,7 @@ struct smb_version_operations smb20_oper + .get_reparse_point_buffer = smb2_get_reparse_point_buffer, + .query_mf_symlink = smb3_query_mf_symlink, + .create_mf_symlink = smb3_create_mf_symlink, +- .create_reparse_symlink = smb2_create_reparse_symlink, ++ .create_reparse_inode = smb2_create_reparse_inode, + .open = smb2_open_file, + .set_fid = smb2_set_fid, + .close = smb2_close_file, +@@ -5433,7 +5433,7 @@ struct smb_version_operations smb21_oper + .get_reparse_point_buffer = smb2_get_reparse_point_buffer, + .query_mf_symlink = smb3_query_mf_symlink, + .create_mf_symlink = smb3_create_mf_symlink, +- .create_reparse_symlink = smb2_create_reparse_symlink, ++ .create_reparse_inode = smb2_create_reparse_inode, + .open = smb2_open_file, + .set_fid = smb2_set_fid, + .close = smb2_close_file, +@@ -5540,7 +5540,7 @@ struct smb_version_operations smb30_oper + .get_reparse_point_buffer = smb2_get_reparse_point_buffer, + .query_mf_symlink = smb3_query_mf_symlink, + .create_mf_symlink = smb3_create_mf_symlink, +- .create_reparse_symlink = smb2_create_reparse_symlink, ++ .create_reparse_inode = smb2_create_reparse_inode, + .open = smb2_open_file, + .set_fid = smb2_set_fid, + .close = smb2_close_file, +@@ -5656,7 +5656,7 @@ struct smb_version_operations smb311_ope + .get_reparse_point_buffer = smb2_get_reparse_point_buffer, + .query_mf_symlink = smb3_query_mf_symlink, + .create_mf_symlink = smb3_create_mf_symlink, +- .create_reparse_symlink = smb2_create_reparse_symlink, ++ .create_reparse_inode = smb2_create_reparse_inode, + .open = smb2_open_file, + .set_fid = smb2_set_fid, + .close = smb2_close_file, +--- a/fs/smb/client/smb2proto.h ++++ b/fs/smb/client/smb2proto.h +@@ -54,7 +54,7 @@ extern int smb3_handle_read_data(struct + extern int smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_sb_info *cifs_sb, const char *path, + __u32 *reparse_tag); +-struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data, ++struct inode *smb2_create_reparse_inode(struct cifs_open_info_data *data, + struct super_block *sb, + const unsigned int xid, + struct cifs_tcon *tcon, +@@ -314,9 +314,6 @@ int smb311_posix_query_path_info(const u + int posix_info_parse(const void *beg, const void *end, + struct smb2_posix_info_parsed *out); + int posix_info_sid_size(const void *beg, const void *end); +-int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode, +- struct dentry *dentry, struct cifs_tcon *tcon, +- const char *full_path, const char *symname); + int smb2_make_nfs_node(unsigned int xid, struct inode *inode, + struct dentry *dentry, struct cifs_tcon *tcon, + const char *full_path, umode_t mode, dev_t dev); diff --git a/debian/patches/patchset-pf/steady/0034-smb-client-fix-creating-symlinks-under-POSIX-mounts.patch b/debian/patches/patchset-pf/steady/0034-smb-client-fix-creating-symlinks-under-POSIX-mounts.patch new file mode 100644 index 0000000..804c846 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0034-smb-client-fix-creating-symlinks-under-POSIX-mounts.patch @@ -0,0 +1,109 @@ +From c027b463e9389e4421b21f170128f35c0f2941b9 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Thu, 31 Jul 2025 20:46:43 -0300 +Subject: smb: client: fix creating symlinks under POSIX mounts + +SMB3.1.1 POSIX mounts support native symlinks that are created with +IO_REPARSE_TAG_SYMLINK reparse points, so skip the checking of +FILE_SUPPORTS_REPARSE_POINTS as some servers might not have it set. + +Cc: linux-cifs@vger.kernel.org +Cc: Ralph Boehme +Cc: David Howells +Cc: +Reported-by: Matthew Richardson +Closes: https://marc.info/?i=1124e7cd-6a46-40a6-9f44-b7664a66654b@ed.ac.uk +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +--- + fs/smb/client/cifsglob.h | 5 +++++ + fs/smb/client/cifssmb.c | 4 ++-- + fs/smb/client/link.c | 2 +- + fs/smb/client/smb1ops.c | 2 +- + fs/smb/client/smb2inode.c | 5 ++--- + fs/smb/client/smb2ops.c | 5 ++--- + 6 files changed, 13 insertions(+), 10 deletions(-) + +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -2377,4 +2377,9 @@ static inline bool cifs_netbios_name(con + return ret; + } + ++#define CIFS_REPARSE_SUPPORT(tcon) \ ++ ((tcon)->posix_extensions || \ ++ (le32_to_cpu((tcon)->fsAttrInfo.Attributes) & \ ++ FILE_SUPPORTS_REPARSE_POINTS)) ++ + #endif /* _CIFS_GLOB_H */ +--- a/fs/smb/client/cifssmb.c ++++ b/fs/smb/client/cifssmb.c +@@ -2751,7 +2751,7 @@ int cifs_query_reparse_point(const unsig + if (cap_unix(tcon->ses)) + return -EOPNOTSUPP; + +- if (!(le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS)) ++ if (!CIFS_REPARSE_SUPPORT(tcon)) + return -EOPNOTSUPP; + + oparms = (struct cifs_open_parms) { +@@ -2879,7 +2879,7 @@ struct inode *cifs_create_reparse_inode( + * attempt to create reparse point. This will prevent creating unusable + * empty object on the server. + */ +- if (!(le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS)) ++ if (!CIFS_REPARSE_SUPPORT(tcon)) + return ERR_PTR(-EOPNOTSUPP); + + #ifndef CONFIG_CIFS_XATTR +--- a/fs/smb/client/link.c ++++ b/fs/smb/client/link.c +@@ -635,7 +635,7 @@ cifs_symlink(struct mnt_idmap *idmap, st + case CIFS_SYMLINK_TYPE_NATIVE: + case CIFS_SYMLINK_TYPE_NFS: + case CIFS_SYMLINK_TYPE_WSL: +- if (le32_to_cpu(pTcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) { ++ if (CIFS_REPARSE_SUPPORT(pTcon)) { + rc = create_reparse_symlink(xid, inode, direntry, pTcon, + full_path, symname); + goto symlink_exit; +--- a/fs/smb/client/smb1ops.c ++++ b/fs/smb/client/smb1ops.c +@@ -1272,7 +1272,7 @@ cifs_make_node(unsigned int xid, struct + */ + return cifs_sfu_make_node(xid, inode, dentry, tcon, + full_path, mode, dev); +- } else if (le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) { ++ } else if (CIFS_REPARSE_SUPPORT(tcon)) { + /* + * mknod via reparse points requires server support for + * storing reparse points, which is available since +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -1345,9 +1345,8 @@ struct inode *smb2_create_reparse_inode( + * attempt to create reparse point. This will prevent creating unusable + * empty object on the server. + */ +- if (!(le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS)) +- if (!tcon->posix_extensions) +- return ERR_PTR(-EOPNOTSUPP); ++ if (!CIFS_REPARSE_SUPPORT(tcon)) ++ return ERR_PTR(-EOPNOTSUPP); + + oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, + SYNCHRONIZE | DELETE | +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -5269,10 +5269,9 @@ static int smb2_make_node(unsigned int x + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) { + rc = cifs_sfu_make_node(xid, inode, dentry, tcon, + full_path, mode, dev); +- } else if ((le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) +- || (tcon->posix_extensions)) { ++ } else if (CIFS_REPARSE_SUPPORT(tcon)) { + rc = mknod_reparse(xid, inode, dentry, tcon, +- full_path, mode, dev); ++ full_path, mode, dev); + } + return rc; + } diff --git a/debian/patches/patchset-pf/steady/0035-kasan-test-fix-protection-against-compiler-elision.patch b/debian/patches/patchset-pf/steady/0035-kasan-test-fix-protection-against-compiler-elision.patch new file mode 100644 index 0000000..7e1fd34 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0035-kasan-test-fix-protection-against-compiler-elision.patch @@ -0,0 +1,45 @@ +From 8c47c2c4bebf98d0624c15cecef00536d50d79a6 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Mon, 28 Jul 2025 22:11:54 +0200 +Subject: kasan/test: fix protection against compiler elision + +The kunit test is using assignments to +"static volatile void *kasan_ptr_result" to prevent elision of memory +loads, but that's not working: +In this variable definition, the "volatile" applies to the "void", not to +the pointer. +To make "volatile" apply to the pointer as intended, it must follow +after the "*". + +This makes the kasan_memchr test pass again on my system. The +kasan_strings test is still failing because all the definitions of +load_unaligned_zeropad() are lacking explicit instrumentation hooks and +ASAN does not instrument asm() memory operands. + +Link: https://lkml.kernel.org/r/20250728-kasan-kunit-fix-volatile-v1-1-e7157c9af82d@google.com +Fixes: 5f1c8108e7ad ("mm:kasan: fix sparse warnings: Should it be static?") +Signed-off-by: Jann Horn +Cc: Alexander Potapenko +Cc: Andrey Konovalov +Cc: Andrey Ryabinin +Cc: Dmitriy Vyukov +Cc: Jann Horn +Cc: Nihar Chaithanya +Cc: Vincenzo Frascino +Cc: +Signed-off-by: Andrew Morton +--- + mm/kasan/kasan_test_c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/kasan/kasan_test_c.c ++++ b/mm/kasan/kasan_test_c.c +@@ -47,7 +47,7 @@ static struct { + * Some tests use these global variables to store return values from function + * calls that could otherwise be eliminated by the compiler as dead code. + */ +-static volatile void *kasan_ptr_result; ++static void *volatile kasan_ptr_result; + static volatile int kasan_int_result; + + /* Probe for console output: obtains test_status lines of interest. */ diff --git a/debian/patches/patchset-pf/steady/0036-proc-proc_maps_open-allow-proc_mem_open-to-return-NU.patch b/debian/patches/patchset-pf/steady/0036-proc-proc_maps_open-allow-proc_mem_open-to-return-NU.patch new file mode 100644 index 0000000..41eb1f6 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0036-proc-proc_maps_open-allow-proc_mem_open-to-return-NU.patch @@ -0,0 +1,42 @@ +From d22a1695f7b89c228e60a9310d597597a6710666 Mon Sep 17 00:00:00 2001 +From: Jialin Wang +Date: Fri, 8 Aug 2025 00:54:55 +0800 +Subject: proc: proc_maps_open allow proc_mem_open to return NULL + +The commit 65c66047259f ("proc: fix the issue of proc_mem_open returning +NULL") caused proc_maps_open() to return -ESRCH when proc_mem_open() +returns NULL. This breaks legitimate /proc//maps access for kernel +threads since kernel threads have NULL mm_struct. + +The regression causes perf to fail and exit when profiling a kernel +thread: + + # perf record -v -g -p $(pgrep kswapd0) + ... + couldn't open /proc/65/task/65/maps + +This patch partially reverts the commit to fix it. + +Link: https://lkml.kernel.org/r/20250807165455.73656-1-wjl.linux@gmail.com +Fixes: 65c66047259f ("proc: fix the issue of proc_mem_open returning NULL") +Signed-off-by: Jialin Wang +Cc: Penglei Jiang +Cc: +Signed-off-by: Andrew Morton +--- + fs/proc/task_mmu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -215,8 +215,8 @@ static int proc_maps_open(struct inode * + + priv->inode = inode; + priv->mm = proc_mem_open(inode, PTRACE_MODE_READ); +- if (IS_ERR_OR_NULL(priv->mm)) { +- int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH; ++ if (IS_ERR(priv->mm)) { ++ int err = PTR_ERR(priv->mm); + + seq_release_private(inode, file); + return err; diff --git a/debian/patches/patchset-pf/steady/0037-block-restore-default-wbt-enablement.patch b/debian/patches/patchset-pf/steady/0037-block-restore-default-wbt-enablement.patch new file mode 100644 index 0000000..1856d90 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0037-block-restore-default-wbt-enablement.patch @@ -0,0 +1,56 @@ +From ca0b04683be7bba50703eaec260167ec494d80b8 Mon Sep 17 00:00:00 2001 +From: Julian Sun +Date: Tue, 12 Aug 2025 23:42:57 +0800 +Subject: block: restore default wbt enablement + +The commit 245618f8e45f ("block: protect wbt_lat_usec using +q->elevator_lock") protected wbt_enable_default() with +q->elevator_lock; however, it also placed wbt_enable_default() +before blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);, resulting +in wbt failing to be enabled. + +Moreover, the protection of wbt_enable_default() by q->elevator_lock +was removed in commit 78c271344b6f ("block: move wbt_enable_default() +out of queue freezing from sched ->exit()"), so we can directly fix +this issue by placing wbt_enable_default() after +blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);. + +Additionally, this issue also causes the inability to read the +wbt_lat_usec file, and the scenario is as follows: + +root@q:/sys/block/sda/queue# cat wbt_lat_usec +cat: wbt_lat_usec: Invalid argument + +root@q:/data00/sjc/linux# ls /sys/kernel/debug/block/sda/rqos +cannot access '/sys/kernel/debug/block/sda/rqos': No such file or directory + +root@q:/data00/sjc/linux# find /sys -name wbt +/sys/kernel/debug/tracing/events/wbt + +After testing with this patch, wbt can be enabled normally. + +Signed-off-by: Julian Sun +Cc: stable@vger.kernel.org +Fixes: 245618f8e45f ("block: protect wbt_lat_usec using q->elevator_lock") +Reviewed-by: Nilay Shroff +Reviewed-by: Yu Kuai +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20250812154257.57540-1-sunjunchao@bytedance.com +Signed-off-by: Jens Axboe +--- + block/blk-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -876,9 +876,9 @@ int blk_register_queue(struct gendisk *d + + if (queue_is_mq(q)) + elevator_set_default(q); +- wbt_enable_default(disk); + + blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q); ++ wbt_enable_default(disk); + + /* Now everything is ready and send out KOBJ_ADD uevent */ + kobject_uevent(&disk->queue_kobj, KOBJ_ADD); diff --git a/debian/patches/patchset-pf/steady/0038-xfs-fully-decouple-XFS_IBULK-flags-from-XFS_IWALK-fl.patch b/debian/patches/patchset-pf/steady/0038-xfs-fully-decouple-XFS_IBULK-flags-from-XFS_IWALK-fl.patch new file mode 100644 index 0000000..7f226fe --- /dev/null +++ b/debian/patches/patchset-pf/steady/0038-xfs-fully-decouple-XFS_IBULK-flags-from-XFS_IWALK-fl.patch @@ -0,0 +1,50 @@ +From 599815c47256ca7901fc5b0de5cbc6f08e803e48 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Wed, 23 Jul 2025 14:19:44 +0200 +Subject: xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags + +Fix up xfs_inumbers to now pass in the XFS_IBULK* flags into the flags +argument to xfs_inobt_walk, which expects the XFS_IWALK* flags. + +Currently passing the wrong flags works for non-debug builds because +the only XFS_IWALK* flag has the same encoding as the corresponding +XFS_IBULK* flag, but in debug builds it can trigger an assert that no +incorrect flag is passed. Instead just extra the relevant flag. + +Fixes: 5b35d922c52798 ("xfs: Decouple XFS_IBULK flags from XFS_IWALK flags") +Cc: # v5.19 +Reported-by: cen zhang +Signed-off-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Carlos Maiolino +--- + fs/xfs/xfs_itable.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/xfs/xfs_itable.c ++++ b/fs/xfs/xfs_itable.c +@@ -455,11 +455,15 @@ xfs_inumbers( + .breq = breq, + }; + struct xfs_trans *tp; ++ unsigned int iwalk_flags = 0; + int error = 0; + + if (xfs_bulkstat_already_done(breq->mp, breq->startino)) + return 0; + ++ if (breq->flags & XFS_IBULK_SAME_AG) ++ iwalk_flags |= XFS_IWALK_SAME_AG; ++ + /* + * Grab an empty transaction so that we can use its recursive buffer + * locking abilities to detect cycles in the inobt without deadlocking. +@@ -468,7 +472,7 @@ xfs_inumbers( + if (error) + goto out; + +- error = xfs_inobt_walk(breq->mp, tp, breq->startino, breq->flags, ++ error = xfs_inobt_walk(breq->mp, tp, breq->startino, iwalk_flags, + xfs_inumbers_walk, breq->icount, &ic); + xfs_trans_cancel(tp); + out: diff --git a/debian/patches/patchset-pf/steady/0039-watchdog-intel_oc_wdt-Do-not-try-to-write-into-const.patch b/debian/patches/patchset-pf/steady/0039-watchdog-intel_oc_wdt-Do-not-try-to-write-into-const.patch new file mode 100644 index 0000000..705aaa5 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0039-watchdog-intel_oc_wdt-Do-not-try-to-write-into-const.patch @@ -0,0 +1,66 @@ +From d2a99ecf2d0479f78a21568eee08f4ca27652629 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Sun, 17 Aug 2025 07:48:17 -0700 +Subject: watchdog: intel_oc_wdt: Do not try to write into const memory +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The code tries to update the intel_oc_wdt_info data structure if the +watchdog is locked. That data structure is marked as const and can not +be written into. Copy it into struct intel_oc_wdt and modify it there +to fix the problem. + +Reported-by: Petar Kulić +Cc: Diogo Ivo +Fixes: 535d1784d8a9 ("watchdog: Add driver for Intel OC WDT") +Signed-off-by: Guenter Roeck +--- + drivers/watchdog/intel_oc_wdt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/watchdog/intel_oc_wdt.c ++++ b/drivers/watchdog/intel_oc_wdt.c +@@ -41,6 +41,7 @@ + struct intel_oc_wdt { + struct watchdog_device wdd; + struct resource *ctrl_res; ++ struct watchdog_info info; + bool locked; + }; + +@@ -115,7 +116,6 @@ static const struct watchdog_ops intel_o + + static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt) + { +- struct watchdog_info *info; + unsigned long val; + + val = inl(INTEL_OC_WDT_CTRL_REG(oc_wdt)); +@@ -134,7 +134,6 @@ static int intel_oc_wdt_setup(struct int + set_bit(WDOG_HW_RUNNING, &oc_wdt->wdd.status); + + if (oc_wdt->locked) { +- info = (struct watchdog_info *)&intel_oc_wdt_info; + /* + * Set nowayout unconditionally as we cannot stop + * the watchdog. +@@ -145,7 +144,7 @@ static int intel_oc_wdt_setup(struct int + * and inform the core we can't change it. + */ + oc_wdt->wdd.timeout = (val & INTEL_OC_WDT_TOV) + 1; +- info->options &= ~WDIOF_SETTIMEOUT; ++ oc_wdt->info.options &= ~WDIOF_SETTIMEOUT; + + dev_info(oc_wdt->wdd.parent, + "Register access locked, heartbeat fixed at: %u s\n", +@@ -193,7 +192,8 @@ static int intel_oc_wdt_probe(struct pla + wdd->min_timeout = INTEL_OC_WDT_MIN_TOV; + wdd->max_timeout = INTEL_OC_WDT_MAX_TOV; + wdd->timeout = INTEL_OC_WDT_DEF_TOV; +- wdd->info = &intel_oc_wdt_info; ++ oc_wdt->info = intel_oc_wdt_info; ++ wdd->info = &oc_wdt->info; + wdd->ops = &intel_oc_wdt_ops; + wdd->parent = dev; + diff --git a/debian/patches/patchset-pf/steady/0040-cgroup-avoid-null-de-ref-in-css_rstat_exit.patch b/debian/patches/patchset-pf/steady/0040-cgroup-avoid-null-de-ref-in-css_rstat_exit.patch new file mode 100644 index 0000000..a327c06 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0040-cgroup-avoid-null-de-ref-in-css_rstat_exit.patch @@ -0,0 +1,62 @@ +From 76511b0ae1da7f401fe06c8b4dd18a40c3a2b52b Mon Sep 17 00:00:00 2001 +From: JP Kobryn +Date: Wed, 6 Aug 2025 17:33:50 -0700 +Subject: cgroup: avoid null de-ref in css_rstat_exit() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +css_rstat_exit() may be called asynchronously in scenarios where preceding +calls to css_rstat_init() have not completed. One such example is this +sequence below: + +css_create(...) +{ + ... + init_and_link_css(css, ...); + + err = percpu_ref_init(...); + if (err) + goto err_free_css; + err = cgroup_idr_alloc(...); + if (err) + goto err_free_css; + err = css_rstat_init(css, ...); + if (err) + goto err_free_css; + ... +err_free_css: + INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn); + queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork); + return ERR_PTR(err); +} + +If any of the three goto jumps are taken, async cleanup will begin and +css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu. + +Avoid accessing the unitialized field by returning early in +css_rstat_exit() if this is the case. + +Signed-off-by: JP Kobryn +Suggested-by: Michal Koutný +Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem") +Cc: stable@vger.kernel.org # v6.16 +Reported-by: syzbot+8d052e8b99e40bc625ed@syzkaller.appspotmail.com +Acked-by: Shakeel Butt +Signed-off-by: Tejun Heo +--- + kernel/cgroup/rstat.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/kernel/cgroup/rstat.c ++++ b/kernel/cgroup/rstat.c +@@ -488,6 +488,9 @@ void css_rstat_exit(struct cgroup_subsys + if (!css_uses_rstat(css)) + return; + ++ if (!css->rstat_cpu) ++ return; ++ + css_rstat_flush(css); + + /* sanity check */ diff --git a/debian/patches/patchset-pf/steady/0041-open_tree_attr-do-not-allow-id-mapping-changes-witho.patch b/debian/patches/patchset-pf/steady/0041-open_tree_attr-do-not-allow-id-mapping-changes-witho.patch new file mode 100644 index 0000000..4423023 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0041-open_tree_attr-do-not-allow-id-mapping-changes-witho.patch @@ -0,0 +1,43 @@ +From 1b24003064570fdf29c55bac14d4728977195133 Mon Sep 17 00:00:00 2001 +From: Aleksa Sarai +Date: Fri, 8 Aug 2025 03:55:05 +1000 +Subject: open_tree_attr: do not allow id-mapping changes without + OPEN_TREE_CLONE + +As described in commit 7a54947e727b ('Merge patch series "fs: allow +changing idmappings"'), open_tree_attr(2) was necessary in order to +allow for a detached mount to be created and have its idmappings changed +without the risk of any racing threads operating on it. For this reason, +mount_setattr(2) still does not allow for id-mappings to be changed. + +However, there was a bug in commit 2462651ffa76 ("fs: allow changing +idmappings") which allowed users to bypass this restriction by calling +open_tree_attr(2) *without* OPEN_TREE_CLONE. + +can_idmap_mount() prevented this bug from allowing an attached +mountpoint's id-mapping from being modified (thanks to an is_anon_ns() +check), but this still allows for detached (but visible) mounts to have +their be id-mapping changed. This risks the same UAF and locking issues +as described in the merge commit, and was likely unintentional. + +Fixes: 2462651ffa76 ("fs: allow changing idmappings") +Cc: stable@vger.kernel.org # v6.15+ +Signed-off-by: Aleksa Sarai +Link: https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-1-0ec7bc05646c@cyphar.com +Signed-off-by: Christian Brauner +--- + fs/namespace.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -5302,7 +5302,8 @@ SYSCALL_DEFINE5(open_tree_attr, int, dfd + int ret; + struct mount_kattr kattr = {}; + +- kattr.kflags = MOUNT_KATTR_IDMAP_REPLACE; ++ if (flags & OPEN_TREE_CLONE) ++ kattr.kflags = MOUNT_KATTR_IDMAP_REPLACE; + if (flags & AT_RECURSIVE) + kattr.kflags |= MOUNT_KATTR_RECURSE; + diff --git a/debian/patches/patchset-pf/steady/0042-iomap-Fix-broken-data-integrity-guarantees-for-O_SYN.patch b/debian/patches/patchset-pf/steady/0042-iomap-Fix-broken-data-integrity-guarantees-for-O_SYN.patch new file mode 100644 index 0000000..0bd280a --- /dev/null +++ b/debian/patches/patchset-pf/steady/0042-iomap-Fix-broken-data-integrity-guarantees-for-O_SYN.patch @@ -0,0 +1,53 @@ +From 2435722a492f57a060202726a820b0da64f42105 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 30 Jul 2025 12:28:41 +0200 +Subject: iomap: Fix broken data integrity guarantees for O_SYNC writes + +Commit d279c80e0bac ("iomap: inline iomap_dio_bio_opflags()") has broken +the logic in iomap_dio_bio_iter() in a way that when the device does +support FUA (or has no writeback cache) and the direct IO happens to +freshly allocated or unwritten extents, we will *not* issue fsync after +completing direct IO O_SYNC / O_DSYNC write because the +IOMAP_DIO_WRITE_THROUGH flag stays mistakenly set. Fix the problem by +clearing IOMAP_DIO_WRITE_THROUGH whenever we do not perform FUA write as +it was originally intended. + +CC: John Garry +CC: Ritesh Harjani (IBM) +Fixes: d279c80e0bac ("iomap: inline iomap_dio_bio_opflags()") +CC: stable@vger.kernel.org +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/20250730102840.20470-2-jack@suse.cz +Reviewed-by: Ritesh Harjani (IBM) +Reviewed-by: John Garry +Reviewed-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Christian Brauner +--- + fs/iomap/direct-io.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/fs/iomap/direct-io.c ++++ b/fs/iomap/direct-io.c +@@ -368,14 +368,14 @@ static int iomap_dio_bio_iter(struct iom + if (iomap->flags & IOMAP_F_SHARED) + dio->flags |= IOMAP_DIO_COW; + +- if (iomap->flags & IOMAP_F_NEW) { ++ if (iomap->flags & IOMAP_F_NEW) + need_zeroout = true; +- } else if (iomap->type == IOMAP_MAPPED) { +- if (iomap_dio_can_use_fua(iomap, dio)) +- bio_opf |= REQ_FUA; +- else +- dio->flags &= ~IOMAP_DIO_WRITE_THROUGH; +- } ++ else if (iomap->type == IOMAP_MAPPED && ++ iomap_dio_can_use_fua(iomap, dio)) ++ bio_opf |= REQ_FUA; ++ ++ if (!(bio_opf & REQ_FUA)) ++ dio->flags &= ~IOMAP_DIO_WRITE_THROUGH; + + /* + * We can only do deferred completion for pure overwrites that diff --git a/debian/patches/patchset-pf/steady/0043-sched-ext-Fix-invalid-task-state-transitions-on-clas.patch b/debian/patches/patchset-pf/steady/0043-sched-ext-Fix-invalid-task-state-transitions-on-clas.patch new file mode 100644 index 0000000..46fbf7d --- /dev/null +++ b/debian/patches/patchset-pf/steady/0043-sched-ext-Fix-invalid-task-state-transitions-on-clas.patch @@ -0,0 +1,60 @@ +From 77f4f1ca7b68d33c3841e740ae6b03378a77d281 Mon Sep 17 00:00:00 2001 +From: Andrea Righi +Date: Tue, 5 Aug 2025 10:59:11 +0200 +Subject: sched/ext: Fix invalid task state transitions on class switch + +When enabling a sched_ext scheduler, we may trigger invalid task state +transitions, resulting in warnings like the following (which can be +easily reproduced by running the hotplug selftest in a loop): + + sched_ext: Invalid task state transition 0 -> 3 for fish[770] + WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0 + ... + RIP: 0010:scx_set_task_state+0x7c/0xc0 + ... + Call Trace: + + scx_enable_task+0x11f/0x2e0 + switching_to_scx+0x24/0x110 + scx_enable.isra.0+0xd14/0x13d0 + bpf_struct_ops_link_create+0x136/0x1a0 + __sys_bpf+0x1edd/0x2c30 + __x64_sys_bpf+0x21/0x30 + do_syscall_64+0xbb/0x370 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +This happens because we skip initialization for tasks that are already +dead (with their usage counter set to zero), but we don't exclude them +during the scheduling class transition phase. + +Fix this by also skipping dead tasks during class swiching, preventing +invalid task state transitions. + +Fixes: a8532fac7b5d2 ("sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable") +Cc: stable@vger.kernel.org # v6.12+ +Signed-off-by: Andrea Righi +Signed-off-by: Tejun Heo +--- + kernel/sched/ext.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/kernel/sched/ext.c ++++ b/kernel/sched/ext.c +@@ -5694,6 +5694,9 @@ static int scx_enable(struct sched_ext_o + __setscheduler_class(p->policy, p->prio); + struct sched_enq_and_set_ctx ctx; + ++ if (!tryget_task_struct(p)) ++ continue; ++ + if (old_class != new_class && p->se.sched_delayed) + dequeue_task(task_rq(p), p, DEQUEUE_SLEEP | DEQUEUE_DELAYED); + +@@ -5706,6 +5709,7 @@ static int scx_enable(struct sched_ext_o + sched_enq_and_set_task(&ctx); + + check_class_changed(task_rq(p), p, old_class, p->prio); ++ put_task_struct(p); + } + scx_task_iter_stop(&sti); + percpu_up_write(&scx_fork_rwsem); diff --git a/debian/patches/patchset-pf/steady/0044-platform-x86-intel-uncore-freq-Check-write-blocked-f.patch b/debian/patches/patchset-pf/steady/0044-platform-x86-intel-uncore-freq-Check-write-blocked-f.patch new file mode 100644 index 0000000..4422f36 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0044-platform-x86-intel-uncore-freq-Check-write-blocked-f.patch @@ -0,0 +1,39 @@ +From f64fb7c5338fde361fdaef01b98697a52ee8467b Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Sun, 27 Jul 2025 14:05:13 -0700 +Subject: platform/x86/intel-uncore-freq: Check write blocked for ELC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Add the missing write_blocked check for updating sysfs related to uncore +efficiency latency control (ELC). If write operation is blocked return +error. + +Fixes: bb516dc79c4a ("platform/x86/intel-uncore-freq: Add support for efficiency latency control") +Signed-off-by: Srinivas Pandruvada +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250727210513.2898630-1-srinivas.pandruvada@linux.intel.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +--- + .../x86/intel/uncore-frequency/uncore-frequency-tpmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c ++++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c +@@ -191,9 +191,14 @@ static int uncore_read_control_freq(stru + static int write_eff_lat_ctrl(struct uncore_data *data, unsigned int val, enum uncore_index index) + { + struct tpmi_uncore_cluster_info *cluster_info; ++ struct tpmi_uncore_struct *uncore_root; + u64 control; + + cluster_info = container_of(data, struct tpmi_uncore_cluster_info, uncore_data); ++ uncore_root = cluster_info->uncore_root; ++ ++ if (uncore_root->write_blocked) ++ return -EPERM; + + if (cluster_info->root_domain) + return -ENODATA; diff --git a/debian/patches/patchset-pf/steady/0045-usb-quirks-Add-DELAY_INIT-quick-for-another-SanDisk-.patch b/debian/patches/patchset-pf/steady/0045-usb-quirks-Add-DELAY_INIT-quick-for-another-SanDisk-.patch new file mode 100644 index 0000000..000dc63 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0045-usb-quirks-Add-DELAY_INIT-quick-for-another-SanDisk-.patch @@ -0,0 +1,28 @@ +From 882ab07bcf8574b1618863b6cd16200979cec30f Mon Sep 17 00:00:00 2001 +From: Miao Li +Date: Fri, 1 Aug 2025 16:27:28 +0800 +Subject: usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash + Drive + +Another SanDisk 3.2Gen1 Flash Drive also need DELAY_INIT quick, +or it will randomly work incorrectly on Huawei hisi platforms +when doing reboot test. + +Signed-off-by: Miao Li +Cc: stable +Link: https://lore.kernel.org/r/20250801082728.469406-1-limiao870622@163.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -371,6 +371,7 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM }, + + /* SanDisk Corp. SanDisk 3.2Gen1 */ ++ { USB_DEVICE(0x0781, 0x5596), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x0781, 0x55a3), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* SanDisk Extreme 55AE */ diff --git a/debian/patches/patchset-pf/steady/0046-usb-renesas-xhci-Fix-External-ROM-access-timeouts.patch b/debian/patches/patchset-pf/steady/0046-usb-renesas-xhci-Fix-External-ROM-access-timeouts.patch new file mode 100644 index 0000000..ba0911f --- /dev/null +++ b/debian/patches/patchset-pf/steady/0046-usb-renesas-xhci-Fix-External-ROM-access-timeouts.patch @@ -0,0 +1,68 @@ +From 024303e34931cae365cfeb28d00e3b9b704c1001 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Sun, 3 Aug 2025 00:55:20 +0200 +Subject: usb: renesas-xhci: Fix External ROM access timeouts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Increase the External ROM access timeouts to prevent failures during +programming of External SPI EEPROM chips. The current timeouts are +too short for some SPI EEPROMs used with uPD720201 controllers. + +The current timeout for Chip Erase in renesas_rom_erase() is 100 ms , +the current timeout for Sector Erase issued by the controller before +Page Program in renesas_fw_download_image() is also 100 ms. Neither +timeout is sufficient for e.g. the Macronix MX25L5121E or MX25V5126F. + +MX25L5121E reference manual [1] page 35 section "ERASE AND PROGRAMMING +PERFORMANCE" and page 23 section "Table 8. AC CHARACTERISTICS (Temperature += 0°C to 70°C for Commercial grade, VCC = 2.7V ~ 3.6V)" row "tCE" indicate +that the maximum time required for Chip Erase opcode to complete is 2 s, +and for Sector Erase it is 300 ms . + +MX25V5126F reference manual [2] page 47 section "13. ERASE AND PROGRAMMING +PERFORMANCE (2.3V - 3.6V)" and page 42 section "Table 8. AC CHARACTERISTICS +(Temperature = -40°C to 85°C for Industrial grade, VCC = 2.3V - 3.6V)" row +"tCE" indicate that the maximum time required for Chip Erase opcode to +complete is 3.2 s, and for Sector Erase it is 400 ms . + +Update the timeouts such, that Chip Erase timeout is set to 5 seconds, +and Sector Erase timeout is set to 500 ms. Such lengthy timeouts ought +to be sufficient for majority of SPI EEPROM chips. + +[1] https://www.macronix.com/Lists/Datasheet/Attachments/8634/MX25L5121E,%203V,%20512Kb,%20v1.3.pdf +[2] https://www.macronix.com/Lists/Datasheet/Attachments/8750/MX25V5126F,%202.5V,%20512Kb,%20v1.1.pdf + +Fixes: 2478be82de44 ("usb: renesas-xhci: Add ROM loader for uPD720201") +Cc: stable +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20250802225526.25431-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci-renesas.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci-pci-renesas.c ++++ b/drivers/usb/host/xhci-pci-renesas.c +@@ -47,8 +47,9 @@ + #define RENESAS_ROM_ERASE_MAGIC 0x5A65726F + #define RENESAS_ROM_WRITE_MAGIC 0x53524F4D + +-#define RENESAS_RETRY 10000 +-#define RENESAS_DELAY 10 ++#define RENESAS_RETRY 50000 /* 50000 * RENESAS_DELAY ~= 500ms */ ++#define RENESAS_CHIP_ERASE_RETRY 500000 /* 500000 * RENESAS_DELAY ~= 5s */ ++#define RENESAS_DELAY 10 + + #define RENESAS_FW_NAME "renesas_usb_fw.mem" + +@@ -407,7 +408,7 @@ static void renesas_rom_erase(struct pci + /* sleep a bit while ROM is erased */ + msleep(20); + +- for (i = 0; i < RENESAS_RETRY; i++) { ++ for (i = 0; i < RENESAS_CHIP_ERASE_RETRY; i++) { + retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, + &status); + status &= RENESAS_ROM_STATUS_ERASE; diff --git a/debian/patches/patchset-pf/steady/0047-usb-core-hcd-fix-accessing-unmapped-memory-in-SINGLE.patch b/debian/patches/patchset-pf/steady/0047-usb-core-hcd-fix-accessing-unmapped-memory-in-SINGLE.patch new file mode 100644 index 0000000..2dc6c8e --- /dev/null +++ b/debian/patches/patchset-pf/steady/0047-usb-core-hcd-fix-accessing-unmapped-memory-in-SINGLE.patch @@ -0,0 +1,55 @@ +From ed08be11433715381e5a67569d2eadd9264523e0 Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Wed, 6 Aug 2025 16:39:55 +0800 +Subject: usb: core: hcd: fix accessing unmapped memory in + SINGLE_STEP_SET_FEATURE test + +The USB core will unmap urb->transfer_dma after SETUP stage completes. +Then the USB controller will access unmapped memory when it received +device descriptor. If iommu is equipped, the entire test can't be +completed due to the memory accessing is blocked. + +Fix it by calling map_urb_for_dma() again for IN stage. To reduce +redundant map for urb->transfer_buffer, this will also set +URB_NO_TRANSFER_DMA_MAP flag before first map_urb_for_dma() to skip +dma map for urb->transfer_buffer and clear URB_NO_TRANSFER_DMA_MAP +flag before second map_urb_for_dma(). + +Fixes: 216e0e563d81 ("usb: core: hcd: use map_urb_for_dma for single step set feature urb") +Cc: stable +Reviewed-by: Jun Li +Signed-off-by: Xu Yang +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20250806083955.3325299-1-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hcd.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2153,7 +2153,7 @@ static struct urb *request_single_step_s + urb->complete = usb_ehset_completion; + urb->status = -EINPROGRESS; + urb->actual_length = 0; +- urb->transfer_flags = URB_DIR_IN; ++ urb->transfer_flags = URB_DIR_IN | URB_NO_TRANSFER_DMA_MAP; + usb_get_urb(urb); + atomic_inc(&urb->use_count); + atomic_inc(&urb->dev->urbnum); +@@ -2217,9 +2217,15 @@ int ehset_single_step_set_feature(struct + + /* Complete remaining DATA and STATUS stages using the same URB */ + urb->status = -EINPROGRESS; ++ urb->transfer_flags &= ~URB_NO_TRANSFER_DMA_MAP; + usb_get_urb(urb); + atomic_inc(&urb->use_count); + atomic_inc(&urb->dev->urbnum); ++ if (map_urb_for_dma(hcd, urb, GFP_KERNEL)) { ++ usb_put_urb(urb); ++ goto out1; ++ } ++ + retval = hcd->driver->submit_single_step_set_feature(hcd, urb, 0); + if (!retval && !wait_for_completion_timeout(&done, + msecs_to_jiffies(2000))) { diff --git a/debian/patches/patchset-pf/steady/0048-USB-storage-Add-unusual-devs-entry-for-Novatek-NTK96.patch b/debian/patches/patchset-pf/steady/0048-USB-storage-Add-unusual-devs-entry-for-Novatek-NTK96.patch new file mode 100644 index 0000000..cd2c170 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0048-USB-storage-Add-unusual-devs-entry-for-Novatek-NTK96.patch @@ -0,0 +1,51 @@ +From 10e48c1c6c772eb9c6754dd2340843fe264f71f8 Mon Sep 17 00:00:00 2001 +From: Mael GUERIN +Date: Wed, 6 Aug 2025 18:44:03 +0200 +Subject: USB: storage: Add unusual-devs entry for Novatek NTK96550-based + camera + +Add the US_FL_BULK_IGNORE_TAG quirk for Novatek NTK96550-based camera +to fix USB resets after sending SCSI vendor commands due to CBW and +CSW tags difference, leading to undesired slowness while communicating +with the device. + +Please find below the copy of /sys/kernel/debug/usb/devices with my +device plugged in (listed as TechSys USB mass storage here, the +underlying chipset being the Novatek NTK96550-based camera): + +T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=0603 ProdID=8611 Rev= 0.01 +S: Manufacturer=TechSys +S: Product=USB Mass Storage +S: SerialNumber=966110000000100 +C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Mael GUERIN +Cc: stable +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20250806164406.43450-1-mael.guerin@murena.io +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -934,6 +934,13 @@ UNUSUAL_DEV( 0x05e3, 0x0723, 0x9451, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_SANE_SENSE ), + ++/* Added by Maël GUERIN */ ++UNUSUAL_DEV( 0x0603, 0x8611, 0x0000, 0xffff, ++ "Novatek", ++ "NTK96550-based camera", ++ USB_SC_SCSI, USB_PR_BULK, NULL, ++ US_FL_BULK_IGNORE_TAG ), ++ + /* + * Reported by Hanno Boeck + * Taken from the Lycoris Kernel diff --git a/debian/patches/patchset-pf/steady/0049-usb-dwc3-Ignore-late-xferNotReady-event-to-prevent-h.patch b/debian/patches/patchset-pf/steady/0049-usb-dwc3-Ignore-late-xferNotReady-event-to-prevent-h.patch new file mode 100644 index 0000000..bd8c125 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0049-usb-dwc3-Ignore-late-xferNotReady-event-to-prevent-h.patch @@ -0,0 +1,42 @@ +From c6c200e7836ff1b131442200096a8fd14c600165 Mon Sep 17 00:00:00 2001 +From: Kuen-Han Tsai +Date: Thu, 7 Aug 2025 17:06:55 +0800 +Subject: usb: dwc3: Ignore late xferNotReady event to prevent halt timeout + +During a device-initiated disconnect, the End Transfer command resets +the event filter, allowing a new xferNotReady event to be generated +before the controller is fully halted. Processing this late event +incorrectly triggers a Start Transfer, which prevents the controller +from halting and results in a DSTS.DEVCTLHLT bit polling timeout. + +Ignore the late xferNotReady event if the controller is already in a +disconnected state. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: stable +Signed-off-by: Kuen-Han Tsai +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20250807090700.2397190-1-khtsai@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3779,6 +3779,15 @@ static void dwc3_gadget_endpoint_transfe + static void dwc3_gadget_endpoint_transfer_not_ready(struct dwc3_ep *dep, + const struct dwc3_event_depevt *event) + { ++ /* ++ * During a device-initiated disconnect, a late xferNotReady event can ++ * be generated after the End Transfer command resets the event filter, ++ * but before the controller is halted. Ignore it to prevent a new ++ * transfer from starting. ++ */ ++ if (!dep->dwc->connected) ++ return; ++ + dwc3_gadget_endpoint_frame_from_event(dep, event); + + /* diff --git a/debian/patches/patchset-pf/steady/0050-usb-dwc3-pci-add-support-for-the-Intel-Wildcat-Lake.patch b/debian/patches/patchset-pf/steady/0050-usb-dwc3-pci-add-support-for-the-Intel-Wildcat-Lake.patch new file mode 100644 index 0000000..79ed50c --- /dev/null +++ b/debian/patches/patchset-pf/steady/0050-usb-dwc3-pci-add-support-for-the-Intel-Wildcat-Lake.patch @@ -0,0 +1,34 @@ +From 50d8ed950819f18b60b2eaa7121e16cfb2dd16eb Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Tue, 12 Aug 2025 16:11:00 +0300 +Subject: usb: dwc3: pci: add support for the Intel Wildcat Lake + +This patch adds the necessary PCI ID for Intel Wildcat Lake +devices. + +Signed-off-by: Heikki Krogerus +Cc: stable +Link: https://lore.kernel.org/r/20250812131101.2930199-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -41,6 +41,7 @@ + #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee + #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee + #define PCI_DEVICE_ID_INTEL_JSP 0x4dee ++#define PCI_DEVICE_ID_INTEL_WCL 0x4d7e + #define PCI_DEVICE_ID_INTEL_ADL 0x460e + #define PCI_DEVICE_ID_INTEL_ADL_PCH 0x51ee + #define PCI_DEVICE_ID_INTEL_ADLN 0x465e +@@ -431,6 +432,7 @@ static const struct pci_device_id dwc3_p + { PCI_DEVICE_DATA(INTEL, TGPLP, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, TGPH, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, JSP, &dwc3_pci_intel_swnode) }, ++ { PCI_DEVICE_DATA(INTEL, WCL, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, ADL, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, ADL_PCH, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, ADLN, &dwc3_pci_intel_swnode) }, diff --git a/debian/patches/patchset-pf/steady/0051-usb-storage-realtek_cr-Use-correct-byte-order-for-bc.patch b/debian/patches/patchset-pf/steady/0051-usb-storage-realtek_cr-Use-correct-byte-order-for-bc.patch new file mode 100644 index 0000000..5c9d60a --- /dev/null +++ b/debian/patches/patchset-pf/steady/0051-usb-storage-realtek_cr-Use-correct-byte-order-for-bc.patch @@ -0,0 +1,31 @@ +From 3417b55b75b1ca1003f6a621c77b751958727729 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Wed, 13 Aug 2025 16:52:49 +0200 +Subject: usb: storage: realtek_cr: Use correct byte order for bcs->Residue + +Since 'bcs->Residue' has the data type '__le32', convert it to the +correct byte order of the CPU using this driver when assigning it to +the local variable 'residue'. + +Cc: stable +Fixes: 50a6cb932d5c ("USB: usb_storage: add ums-realtek driver") +Suggested-by: Alan Stern +Acked-by: Alan Stern +Signed-off-by: Thorsten Blum +Link: https://lore.kernel.org/r/20250813145247.184717-3-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/realtek_cr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/storage/realtek_cr.c ++++ b/drivers/usb/storage/realtek_cr.c +@@ -252,7 +252,7 @@ static int rts51x_bulk_transport(struct + return USB_STOR_TRANSPORT_ERROR; + } + +- residue = bcs->Residue; ++ residue = le32_to_cpu(bcs->Residue); + if (bcs->Tag != us->tag) + return USB_STOR_TRANSPORT_ERROR; + diff --git a/debian/patches/patchset-pf/steady/0052-ata-libata-scsi-Fix-CDL-control.patch b/debian/patches/patchset-pf/steady/0052-ata-libata-scsi-Fix-CDL-control.patch new file mode 100644 index 0000000..24dd4dd --- /dev/null +++ b/debian/patches/patchset-pf/steady/0052-ata-libata-scsi-Fix-CDL-control.patch @@ -0,0 +1,57 @@ +From a9cbad46c051cf4467ba13638eddc86f96354c66 Mon Sep 17 00:00:00 2001 +From: Igor Pylypiv +Date: Wed, 13 Aug 2025 19:22:56 -0700 +Subject: ata: libata-scsi: Fix CDL control + +Delete extra checks for the ATA_DFLAG_CDL_ENABLED flag that prevent +SET FEATURES command from being issued to a drive when NCQ commands +are active. + +ata_mselect_control_ata_feature() sets / clears the ATA_DFLAG_CDL_ENABLED +flag during the translation of MODE SELECT to SET FEATURES. If SET FEATURES +gets deferred due to outstanding NCQ commands, the original MODE SELECT +command will be re-queued. When the re-queued MODE SELECT goes through +the ata_mselect_control_ata_feature() translation again, SET FEATURES +will not be issued because ATA_DFLAG_CDL_ENABLED has been already set or +cleared by the initial translation of MODE SELECT. + +The ATA_DFLAG_CDL_ENABLED checks in ata_mselect_control_ata_feature() +are safe to remove because scsi_cdl_enable() implements a similar logic +that avoids enabling CDL if it has been enabled already. + +Fixes: 17e897a45675 ("ata: libata-scsi: Improve CDL control") +Cc: stable@vger.kernel.org +Signed-off-by: Igor Pylypiv +Reviewed-by: Niklas Cassel +Signed-off-by: Damien Le Moal +--- + drivers/ata/libata-scsi.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -3905,21 +3905,16 @@ static int ata_mselect_control_ata_featu + /* Check cdl_ctrl */ + switch (buf[0] & 0x03) { + case 0: +- /* Disable CDL if it is enabled */ +- if (!(dev->flags & ATA_DFLAG_CDL_ENABLED)) +- return 0; ++ /* Disable CDL */ + ata_dev_dbg(dev, "Disabling CDL\n"); + cdl_action = 0; + dev->flags &= ~ATA_DFLAG_CDL_ENABLED; + break; + case 0x02: + /* +- * Enable CDL if not already enabled. Since this is mutually +- * exclusive with NCQ priority, allow this only if NCQ priority +- * is disabled. ++ * Enable CDL. Since CDL is mutually exclusive with NCQ ++ * priority, allow this only if NCQ priority is disabled. + */ +- if (dev->flags & ATA_DFLAG_CDL_ENABLED) +- return 0; + if (dev->flags & ATA_DFLAG_NCQ_PRIO_ENABLED) { + ata_dev_err(dev, + "NCQ priority must be disabled to enable CDL\n"); diff --git a/debian/patches/patchset-pf/steady/0053-netfs-Fix-unbuffered-write-error-handling.patch b/debian/patches/patchset-pf/steady/0053-netfs-Fix-unbuffered-write-error-handling.patch new file mode 100644 index 0000000..9f15c38 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0053-netfs-Fix-unbuffered-write-error-handling.patch @@ -0,0 +1,158 @@ +From c9cb314a4e57bc486a8b563dd6df5f6975b97a2f Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 14 Aug 2025 22:45:50 +0100 +Subject: netfs: Fix unbuffered write error handling + +If all the subrequests in an unbuffered write stream fail, the subrequest +collector doesn't update the stream->transferred value and it retains its +initial LONG_MAX value. Unfortunately, if all active streams fail, then we +take the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set +in wreq->transferred - which is then returned from ->write_iter(). + +LONG_MAX was chosen as the initial value so that all the streams can be +quickly assessed by taking the smallest value of all stream->transferred - +but this only works if we've set any of them. + +Fix this by adding a flag to indicate whether the value in +stream->transferred is valid and checking that when we integrate the +values. stream->transferred can then be initialised to zero. + +This was found by running the generic/750 xfstest against cifs with +cache=none. It splices data to the target file. Once (if) it has used up +all the available scratch space, the writes start failing with ENOSPC. +This causes ->write_iter() to fail. However, it was returning +wreq->transferred, i.e. LONG_MAX, rather than an error (because it thought +the amount transferred was non-zero) and iter_file_splice_write() would +then try to clean up that amount of pipe bufferage - leading to an oops +when it overran. The kernel log showed: + + CIFS: VFS: Send error in write = -28 + +followed by: + + BUG: kernel NULL pointer dereference, address: 0000000000000008 + +with: + + RIP: 0010:iter_file_splice_write+0x3a4/0x520 + do_splice+0x197/0x4e0 + +or: + + RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282) + iter_file_splice_write (fs/splice.c:755) + +Also put a warning check into splice to announce if ->write_iter() returned +that it had written more than it was asked to. + +Fixes: 288ace2f57c9 ("netfs: New writeback implementation") +Reported-by: Xiaoli Feng +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220445 +Signed-off-by: David Howells +Link: https://lore.kernel.org/915443.1755207950@warthog.procyon.org.uk +cc: Paulo Alcantara +cc: Steve French +cc: Shyam Prasad N +cc: netfs@lists.linux.dev +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +cc: stable@vger.kernel.org +Signed-off-by: Christian Brauner +--- + fs/netfs/read_collect.c | 4 +++- + fs/netfs/write_collect.c | 10 ++++++++-- + fs/netfs/write_issue.c | 4 ++-- + fs/splice.c | 3 +++ + include/linux/netfs.h | 1 + + 5 files changed, 17 insertions(+), 5 deletions(-) + +--- a/fs/netfs/read_collect.c ++++ b/fs/netfs/read_collect.c +@@ -281,8 +281,10 @@ reassess: + } else if (test_bit(NETFS_RREQ_SHORT_TRANSFER, &rreq->flags)) { + notes |= MADE_PROGRESS; + } else { +- if (!stream->failed) ++ if (!stream->failed) { + stream->transferred += transferred; ++ stream->transferred_valid = true; ++ } + if (front->transferred < front->len) + set_bit(NETFS_RREQ_SHORT_TRANSFER, &rreq->flags); + notes |= MADE_PROGRESS; +--- a/fs/netfs/write_collect.c ++++ b/fs/netfs/write_collect.c +@@ -254,6 +254,7 @@ reassess_streams: + if (front->start + front->transferred > stream->collected_to) { + stream->collected_to = front->start + front->transferred; + stream->transferred = stream->collected_to - wreq->start; ++ stream->transferred_valid = true; + notes |= MADE_PROGRESS; + } + if (test_bit(NETFS_SREQ_FAILED, &front->flags)) { +@@ -356,6 +357,7 @@ bool netfs_write_collection(struct netfs + { + struct netfs_inode *ictx = netfs_inode(wreq->inode); + size_t transferred; ++ bool transferred_valid = false; + int s; + + _enter("R=%x", wreq->debug_id); +@@ -376,12 +378,16 @@ bool netfs_write_collection(struct netfs + continue; + if (!list_empty(&stream->subrequests)) + return false; +- if (stream->transferred < transferred) ++ if (stream->transferred_valid && ++ stream->transferred < transferred) { + transferred = stream->transferred; ++ transferred_valid = true; ++ } + } + + /* Okay, declare that all I/O is complete. */ +- wreq->transferred = transferred; ++ if (transferred_valid) ++ wreq->transferred = transferred; + trace_netfs_rreq(wreq, netfs_rreq_trace_write_done); + + if (wreq->io_streams[1].active && +--- a/fs/netfs/write_issue.c ++++ b/fs/netfs/write_issue.c +@@ -118,12 +118,12 @@ struct netfs_io_request *netfs_create_wr + wreq->io_streams[0].prepare_write = ictx->ops->prepare_write; + wreq->io_streams[0].issue_write = ictx->ops->issue_write; + wreq->io_streams[0].collected_to = start; +- wreq->io_streams[0].transferred = LONG_MAX; ++ wreq->io_streams[0].transferred = 0; + + wreq->io_streams[1].stream_nr = 1; + wreq->io_streams[1].source = NETFS_WRITE_TO_CACHE; + wreq->io_streams[1].collected_to = start; +- wreq->io_streams[1].transferred = LONG_MAX; ++ wreq->io_streams[1].transferred = 0; + if (fscache_resources_valid(&wreq->cache_resources)) { + wreq->io_streams[1].avail = true; + wreq->io_streams[1].active = true; +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -739,6 +739,9 @@ iter_file_splice_write(struct pipe_inode + sd.pos = kiocb.ki_pos; + if (ret <= 0) + break; ++ WARN_ONCE(ret > sd.total_len - left, ++ "Splice Exceeded! ret=%zd tot=%zu left=%zu\n", ++ ret, sd.total_len, left); + + sd.num_spliced += ret; + sd.total_len -= ret; +--- a/include/linux/netfs.h ++++ b/include/linux/netfs.h +@@ -150,6 +150,7 @@ struct netfs_io_stream { + bool active; /* T if stream is active */ + bool need_retry; /* T if this stream needs retrying */ + bool failed; /* T if this stream failed */ ++ bool transferred_valid; /* T is ->transferred is valid */ + }; + + /* diff --git a/debian/patches/patchset-pf/steady/0054-ALSA-hda-realtek-Add-support-for-HP-EliteBook-x360-8.patch b/debian/patches/patchset-pf/steady/0054-ALSA-hda-realtek-Add-support-for-HP-EliteBook-x360-8.patch new file mode 100644 index 0000000..40a872f --- /dev/null +++ b/debian/patches/patchset-pf/steady/0054-ALSA-hda-realtek-Add-support-for-HP-EliteBook-x360-8.patch @@ -0,0 +1,29 @@ +From 53abd849fe02d16ae158b4f5f7264c761871089f Mon Sep 17 00:00:00 2001 +From: Evgeniy Harchenko +Date: Fri, 15 Aug 2025 12:58:14 +0300 +Subject: ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and + EliteBook 830 G6 + +The HP EliteBook x360 830 G6 and HP EliteBook 830 G6 have +Realtek HDA codec ALC215. It needs the ALC285_FIXUP_HP_GPIO_LED +quirk to enable the mute LED. + +Cc: +Signed-off-by: Evgeniy Harchenko +Link: https://patch.msgid.link/20250815095814.75845-1-evgeniyharchenko.dev@gmail.com +Signed-off-by: Takashi Iwai +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10662,6 +10662,8 @@ static const struct hda_quirk alc269_fix + SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), + SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8548, "HP EliteBook x360 830 G6", ALC285_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x854a, "HP EliteBook 830 G6", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x85c6, "HP Pavilion x360 Convertible 14-dy1xxx", ALC295_FIXUP_HP_MUTE_LED_COEFBIT11), + SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360), + SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), diff --git a/debian/patches/patchset-pf/steady/0055-USB-storage-Ignore-driver-CD-mode-for-Realtek-multi-.patch b/debian/patches/patchset-pf/steady/0055-USB-storage-Ignore-driver-CD-mode-for-Realtek-multi-.patch new file mode 100644 index 0000000..9d69d00 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0055-USB-storage-Ignore-driver-CD-mode-for-Realtek-multi-.patch @@ -0,0 +1,76 @@ +From 23b7b20948f48844f17030dab3b1e556f37c803a Mon Sep 17 00:00:00 2001 +From: Zenm Chen +Date: Thu, 14 Aug 2025 00:24:15 +0800 +Subject: USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi + dongles + +Many Realtek USB Wi-Fi dongles released in recent years have two modes: +one is driver CD mode which has Windows driver onboard, another one is +Wi-Fi mode. Add the US_FL_IGNORE_DEVICE quirk for these multi-mode devices. +Otherwise, usb_modeswitch may fail to switch them to Wi-Fi mode. + +Currently there are only two USB IDs known to be used by these multi-mode +Wi-Fi dongles: 0bda:1a2b and 0bda:a192. + +Information about Mercury MW310UH in /sys/kernel/debug/usb/devices. +T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=0bda ProdID=a192 Rev= 2.00 +S: Manufacturer=Realtek +S: Product=DISK +C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) +E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Information about D-Link AX9U rev. A1 in /sys/kernel/debug/usb/devices. +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 55 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=0bda ProdID=1a2b Rev= 0.00 +S: Manufacturer=Realtek +S: Product=DISK +C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable +Signed-off-by: Zenm Chen +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20250813162415.2630-1-zenmchen@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/unusual_devs.h | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1501,6 +1501,28 @@ UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_WP_DETECT ), + ++/* ++ * Reported by Zenm Chen ++ * Ignore driver CD mode, otherwise usb_modeswitch may fail to switch ++ * the device into Wi-Fi mode. ++ */ ++UNUSUAL_DEV( 0x0bda, 0x1a2b, 0x0000, 0xffff, ++ "Realtek", ++ "DISK", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_IGNORE_DEVICE ), ++ ++/* ++ * Reported by Zenm Chen ++ * Ignore driver CD mode, otherwise usb_modeswitch may fail to switch ++ * the device into Wi-Fi mode. ++ */ ++UNUSUAL_DEV( 0x0bda, 0xa192, 0x0000, 0xffff, ++ "Realtek", ++ "DISK", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_IGNORE_DEVICE ), ++ + UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999, + "Maxtor", + "USB to SATA", diff --git a/debian/patches/patchset-pf/steady/0056-usb-dwc3-Remove-WARN_ON-for-device-endpoint-command-.patch b/debian/patches/patchset-pf/steady/0056-usb-dwc3-Remove-WARN_ON-for-device-endpoint-command-.patch new file mode 100644 index 0000000..d3c01a7 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0056-usb-dwc3-Remove-WARN_ON-for-device-endpoint-command-.patch @@ -0,0 +1,129 @@ +From fc0576dcffc4ec82e728efe8bb3e3e753151fde0 Mon Sep 17 00:00:00 2001 +From: Selvarasu Ganesan +Date: Fri, 8 Aug 2025 18:23:05 +0530 +Subject: usb: dwc3: Remove WARN_ON for device endpoint command timeouts + +This commit addresses a rarely observed endpoint command timeout +which causes kernel panic due to warn when 'panic_on_warn' is enabled +and unnecessary call trace prints when 'panic_on_warn' is disabled. +It is seen during fast software-controlled connect/disconnect testcases. +The following is one such endpoint command timeout that we observed: + +1. Connect + ======= +->dwc3_thread_interrupt + ->dwc3_ep0_interrupt + ->configfs_composite_setup + ->composite_setup + ->usb_ep_queue + ->dwc3_gadget_ep0_queue + ->__dwc3_gadget_ep0_queue + ->__dwc3_ep0_do_control_data + ->dwc3_send_gadget_ep_cmd + +2. Disconnect + ========== +->dwc3_thread_interrupt + ->dwc3_gadget_disconnect_interrupt + ->dwc3_ep0_reset_state + ->dwc3_ep0_end_control_data + ->dwc3_send_gadget_ep_cmd + +In the issue scenario, in Exynos platforms, we observed that control +transfers for the previous connect have not yet been completed and end +transfer command sent as a part of the disconnect sequence and +processing of USB_ENDPOINT_HALT feature request from the host timeout. +This maybe an expected scenario since the controller is processing EP +commands sent as a part of the previous connect. It maybe better to +remove WARN_ON in all places where device endpoint commands are sent to +avoid unnecessary kernel panic due to warn. + +Cc: stable +Co-developed-by: Akash M +Signed-off-by: Akash M +Signed-off-by: Selvarasu Ganesan +Acked-by: Thinh Nguyen +Reviewed-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20250808125315.1607-1-selvarasu.g@samsung.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/ep0.c | 20 ++++++++++++++++---- + drivers/usb/dwc3/gadget.c | 10 ++++++++-- + 2 files changed, 24 insertions(+), 6 deletions(-) + +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -288,7 +288,9 @@ void dwc3_ep0_out_start(struct dwc3 *dwc + dwc3_ep0_prepare_one_trb(dep, dwc->ep0_trb_addr, 8, + DWC3_TRBCTL_CONTROL_SETUP, false); + ret = dwc3_ep0_start_trans(dep); +- WARN_ON(ret < 0); ++ if (ret < 0) ++ dev_err(dwc->dev, "ep0 out start transfer failed: %d\n", ret); ++ + for (i = 2; i < DWC3_ENDPOINTS_NUM; i++) { + struct dwc3_ep *dwc3_ep; + +@@ -1061,7 +1063,9 @@ static void __dwc3_ep0_do_control_data(s + ret = dwc3_ep0_start_trans(dep); + } + +- WARN_ON(ret < 0); ++ if (ret < 0) ++ dev_err(dwc->dev, ++ "ep0 data phase start transfer failed: %d\n", ret); + } + + static int dwc3_ep0_start_control_status(struct dwc3_ep *dep) +@@ -1078,7 +1082,12 @@ static int dwc3_ep0_start_control_status + + static void __dwc3_ep0_do_control_status(struct dwc3 *dwc, struct dwc3_ep *dep) + { +- WARN_ON(dwc3_ep0_start_control_status(dep)); ++ int ret; ++ ++ ret = dwc3_ep0_start_control_status(dep); ++ if (ret) ++ dev_err(dwc->dev, ++ "ep0 status phase start transfer failed: %d\n", ret); + } + + static void dwc3_ep0_do_control_status(struct dwc3 *dwc, +@@ -1121,7 +1130,10 @@ void dwc3_ep0_end_control_data(struct dw + cmd |= DWC3_DEPCMD_PARAM(dep->resource_index); + memset(¶ms, 0, sizeof(params)); + ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms); +- WARN_ON_ONCE(ret); ++ if (ret) ++ dev_err_ratelimited(dwc->dev, ++ "ep0 data phase end transfer failed: %d\n", ret); ++ + dep->resource_index = 0; + } + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1774,7 +1774,11 @@ static int __dwc3_stop_active_transfer(s + dep->flags |= DWC3_EP_DELAY_STOP; + return 0; + } +- WARN_ON_ONCE(ret); ++ ++ if (ret) ++ dev_err_ratelimited(dep->dwc->dev, ++ "end transfer failed: %d\n", ret); ++ + dep->resource_index = 0; + + if (!interrupt) +@@ -4050,7 +4054,9 @@ static void dwc3_clear_stall_all_ep(stru + dep->flags &= ~DWC3_EP_STALL; + + ret = dwc3_send_clear_stall_ep_cmd(dep); +- WARN_ON_ONCE(ret); ++ if (ret) ++ dev_err_ratelimited(dwc->dev, ++ "failed to clear STALL on %s\n", dep->name); + } + } + diff --git a/debian/patches/patchset-pf/steady/0057-usb-typec-maxim_contaminant-disable-low-power-mode-w.patch b/debian/patches/patchset-pf/steady/0057-usb-typec-maxim_contaminant-disable-low-power-mode-w.patch new file mode 100644 index 0000000..740cc64 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0057-usb-typec-maxim_contaminant-disable-low-power-mode-w.patch @@ -0,0 +1,51 @@ +From ce921c8404b2574fe419d3c0efee185b4a951d70 Mon Sep 17 00:00:00 2001 +From: Amit Sunil Dhamne +Date: Fri, 15 Aug 2025 11:31:51 -0700 +Subject: usb: typec: maxim_contaminant: disable low power mode when reading + comparator values + +Low power mode is enabled when reading CC resistance as part of +`max_contaminant_read_resistance_kohm()` and left in that state. +However, it's supposed to work with 1uA current source. To read CC +comparator values current source is changed to 80uA. This causes a storm +of CC interrupts as it (falsely) detects a potential contaminant. To +prevent this, disable low power mode current sourcing before reading +comparator values. + +Fixes: 02b332a06397 ("usb: typec: maxim_contaminant: Implement check_contaminant callback") +Cc: stable +Signed-off-by: Amit Sunil Dhamne +Reviewed-by: Badhri Jagan Sridharan +Rule: add +Link: https://lore.kernel.org/stable/20250814-fix-upstream-contaminant-v1-1-801ce8089031%40google.com +Link: https://lore.kernel.org/r/20250815-fix-upstream-contaminant-v2-1-6c8d6c3adafb@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/maxim_contaminant.c | 5 +++++ + drivers/usb/typec/tcpm/tcpci_maxim.h | 1 + + 2 files changed, 6 insertions(+) + +--- a/drivers/usb/typec/tcpm/maxim_contaminant.c ++++ b/drivers/usb/typec/tcpm/maxim_contaminant.c +@@ -188,6 +188,11 @@ static int max_contaminant_read_comparat + if (ret < 0) + return ret; + ++ /* Disable low power mode */ ++ ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL2, CCLPMODESEL, ++ FIELD_PREP(CCLPMODESEL, ++ LOW_POWER_MODE_DISABLE)); ++ + /* Sleep to allow comparators settle */ + usleep_range(5000, 6000); + ret = regmap_update_bits(regmap, TCPC_TCPC_CTRL, TCPC_TCPC_CTRL_ORIENTATION, PLUG_ORNT_CC1); +--- a/drivers/usb/typec/tcpm/tcpci_maxim.h ++++ b/drivers/usb/typec/tcpm/tcpci_maxim.h +@@ -21,6 +21,7 @@ + #define CCOVPDIS BIT(6) + #define SBURPCTRL BIT(5) + #define CCLPMODESEL GENMASK(4, 3) ++#define LOW_POWER_MODE_DISABLE 0 + #define ULTRA_LOW_POWER_MODE 1 + #define CCRPCTRL GENMASK(2, 0) + #define UA_1_SRC 1 diff --git a/debian/patches/patchset-pf/steady/0058-usb-typec-maxim_contaminant-re-enable-cc-toggle-if-c.patch b/debian/patches/patchset-pf/steady/0058-usb-typec-maxim_contaminant-re-enable-cc-toggle-if-c.patch new file mode 100644 index 0000000..bd49d0d --- /dev/null +++ b/debian/patches/patchset-pf/steady/0058-usb-typec-maxim_contaminant-re-enable-cc-toggle-if-c.patch @@ -0,0 +1,114 @@ +From 9a6bb08b2f28ebc163784da8c61a1ed1d086dc7b Mon Sep 17 00:00:00 2001 +From: Amit Sunil Dhamne +Date: Fri, 15 Aug 2025 11:31:52 -0700 +Subject: usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and + port is clean + +Presently in `max_contaminant_is_contaminant()` if there's no +contaminant detected previously, CC is open & stopped toggling and no +contaminant is currently present, TCPC.RC would be programmed to do DRP +toggling. However, it didn't actively look for a connection. This would +lead to Type-C not detect *any* new connections. Hence, in the above +situation, re-enable toggling & program TCPC to look for a new +connection. + +Also, return early if TCPC was looking for connection as this indicates +TCPC has neither detected a potential connection nor a change in +contaminant state. + +In addition, once dry detection is complete (port is dry), restart +toggling. + +Fixes: 02b332a06397e ("usb: typec: maxim_contaminant: Implement check_contaminant callback") +Cc: stable +Signed-off-by: Amit Sunil Dhamne +Reviewed-by: Badhri Jagan Sridharan +Link: https://lore.kernel.org/r/20250815-fix-upstream-contaminant-v2-2-6c8d6c3adafb@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/maxim_contaminant.c | 53 ++++++++++++++++++++++ + 1 file changed, 53 insertions(+) + +--- a/drivers/usb/typec/tcpm/maxim_contaminant.c ++++ b/drivers/usb/typec/tcpm/maxim_contaminant.c +@@ -329,6 +329,39 @@ static int max_contaminant_enable_dry_de + return 0; + } + ++static int max_contaminant_enable_toggling(struct max_tcpci_chip *chip) ++{ ++ struct regmap *regmap = chip->data.regmap; ++ int ret; ++ ++ /* Disable dry detection if enabled. */ ++ ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL2, CCLPMODESEL, ++ FIELD_PREP(CCLPMODESEL, ++ LOW_POWER_MODE_DISABLE)); ++ if (ret) ++ return ret; ++ ++ ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL1, CCCONNDRY, 0); ++ if (ret) ++ return ret; ++ ++ ret = max_tcpci_write8(chip, TCPC_ROLE_CTRL, TCPC_ROLE_CTRL_DRP | ++ FIELD_PREP(TCPC_ROLE_CTRL_CC1, ++ TCPC_ROLE_CTRL_CC_RD) | ++ FIELD_PREP(TCPC_ROLE_CTRL_CC2, ++ TCPC_ROLE_CTRL_CC_RD)); ++ if (ret) ++ return ret; ++ ++ ret = regmap_update_bits(regmap, TCPC_TCPC_CTRL, ++ TCPC_TCPC_CTRL_EN_LK4CONN_ALRT, ++ TCPC_TCPC_CTRL_EN_LK4CONN_ALRT); ++ if (ret) ++ return ret; ++ ++ return max_tcpci_write8(chip, TCPC_COMMAND, TCPC_CMD_LOOK4CONNECTION); ++} ++ + bool max_contaminant_is_contaminant(struct max_tcpci_chip *chip, bool disconnect_while_debounce, + bool *cc_handled) + { +@@ -345,6 +378,12 @@ bool max_contaminant_is_contaminant(stru + if (ret < 0) + return false; + ++ if (cc_status & TCPC_CC_STATUS_TOGGLING) { ++ if (chip->contaminant_state == DETECTED) ++ return true; ++ return false; ++ } ++ + if (chip->contaminant_state == NOT_DETECTED || chip->contaminant_state == SINK) { + if (!disconnect_while_debounce) + msleep(100); +@@ -377,6 +416,12 @@ bool max_contaminant_is_contaminant(stru + max_contaminant_enable_dry_detection(chip); + return true; + } ++ ++ ret = max_contaminant_enable_toggling(chip); ++ if (ret) ++ dev_err(chip->dev, ++ "Failed to enable toggling, ret=%d", ++ ret); + } + } else if (chip->contaminant_state == DETECTED) { + if (!(cc_status & TCPC_CC_STATUS_TOGGLING)) { +@@ -384,6 +429,14 @@ bool max_contaminant_is_contaminant(stru + if (chip->contaminant_state == DETECTED) { + max_contaminant_enable_dry_detection(chip); + return true; ++ } else { ++ ret = max_contaminant_enable_toggling(chip); ++ if (ret) { ++ dev_err(chip->dev, ++ "Failed to enable toggling, ret=%d", ++ ret); ++ return true; ++ } + } + } + } diff --git a/debian/patches/patchset-pf/steady/0059-debugfs-fix-mount-options-not-being-applied.patch b/debian/patches/patchset-pf/steady/0059-debugfs-fix-mount-options-not-being-applied.patch new file mode 100644 index 0000000..996135a --- /dev/null +++ b/debian/patches/patchset-pf/steady/0059-debugfs-fix-mount-options-not-being-applied.patch @@ -0,0 +1,75 @@ +From 576b70e92168f38ab3167768acb6b65cd5bf8aa7 Mon Sep 17 00:00:00 2001 +From: Charalampos Mitrodimas +Date: Sat, 16 Aug 2025 14:14:37 +0000 +Subject: debugfs: fix mount options not being applied + +Mount options (uid, gid, mode) are silently ignored when debugfs is +mounted. This is a regression introduced during the conversion to the +new mount API. + +When the mount API conversion was done, the parsed options were never +applied to the superblock when it was reused. As a result, the mount +options were ignored when debugfs was mounted. + +Fix this by following the same pattern as the tracefs fix in commit +e4d32142d1de ("tracing: Fix tracefs mount options"). Call +debugfs_reconfigure() in debugfs_get_tree() to apply the mount options +to the superblock after it has been created or reused. + +As an example, with the bug the "mode" mount option is ignored: + + $ mount -o mode=0666 -t debugfs debugfs /tmp/debugfs_test + $ mount | grep debugfs_test + debugfs on /tmp/debugfs_test type debugfs (rw,relatime) + $ ls -ld /tmp/debugfs_test + drwx------ 25 root root 0 Aug 4 14:16 /tmp/debugfs_test + +With the fix applied, it works as expected: + + $ mount -o mode=0666 -t debugfs debugfs /tmp/debugfs_test + $ mount | grep debugfs_test + debugfs on /tmp/debugfs_test type debugfs (rw,relatime,mode=666) + $ ls -ld /tmp/debugfs_test + drw-rw-rw- 37 root root 0 Aug 2 17:28 /tmp/debugfs_test + +Fixes: a20971c18752 ("vfs: Convert debugfs to use the new mount API") +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220406 +Cc: stable +Reviewed-by: Eric Sandeen +Signed-off-by: Charalampos Mitrodimas +Link: https://lore.kernel.org/r/20250816-debugfs-mount-opts-v3-1-d271dad57b5b@posteo.net +Signed-off-by: Greg Kroah-Hartman +--- + fs/debugfs/inode.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -183,6 +183,9 @@ static int debugfs_reconfigure(struct fs + struct debugfs_fs_info *sb_opts = sb->s_fs_info; + struct debugfs_fs_info *new_opts = fc->s_fs_info; + ++ if (!new_opts) ++ return 0; ++ + sync_filesystem(sb); + + /* structure copy of new mount options to sb */ +@@ -282,10 +285,16 @@ static int debugfs_fill_super(struct sup + + static int debugfs_get_tree(struct fs_context *fc) + { ++ int err; ++ + if (!(debugfs_allow & DEBUGFS_ALLOW_API)) + return -EPERM; + +- return get_tree_single(fc, debugfs_fill_super); ++ err = get_tree_single(fc, debugfs_fill_super); ++ if (err) ++ return err; ++ ++ return debugfs_reconfigure(fc); + } + + static void debugfs_free_fc(struct fs_context *fc) diff --git a/debian/patches/patchset-pf/steady/0060-ksmbd-extend-the-connection-limiting-mechanism-to-su.patch b/debian/patches/patchset-pf/steady/0060-ksmbd-extend-the-connection-limiting-mechanism-to-su.patch new file mode 100644 index 0000000..52e052f --- /dev/null +++ b/debian/patches/patchset-pf/steady/0060-ksmbd-extend-the-connection-limiting-mechanism-to-su.patch @@ -0,0 +1,88 @@ +From 80250ddfb13b64a0fef53806669893094a731956 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Sun, 17 Aug 2025 09:48:40 +0900 +Subject: ksmbd: extend the connection limiting mechanism to support IPv6 + +Update the connection tracking logic to handle both IPv4 and IPv6 +address families. + +Cc: stable@vger.kernel.org +Fixes: e6bb91939740 ("ksmbd: limit repeated connections from clients with the same IP") +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +--- + fs/smb/server/connection.h | 7 ++++++- + fs/smb/server/transport_tcp.c | 26 +++++++++++++++++++++++--- + 2 files changed, 29 insertions(+), 4 deletions(-) + +--- a/fs/smb/server/connection.h ++++ b/fs/smb/server/connection.h +@@ -46,7 +46,12 @@ struct ksmbd_conn { + struct mutex srv_mutex; + int status; + unsigned int cli_cap; +- __be32 inet_addr; ++ union { ++ __be32 inet_addr; ++#if IS_ENABLED(CONFIG_IPV6) ++ u8 inet6_addr[16]; ++#endif ++ }; + char *request_buf; + struct ksmbd_transport *transport; + struct nls_table *local_nls; +--- a/fs/smb/server/transport_tcp.c ++++ b/fs/smb/server/transport_tcp.c +@@ -87,7 +87,14 @@ static struct tcp_transport *alloc_trans + return NULL; + } + ++#if IS_ENABLED(CONFIG_IPV6) ++ if (client_sk->sk->sk_family == AF_INET6) ++ memcpy(&conn->inet6_addr, &client_sk->sk->sk_v6_daddr, 16); ++ else ++ conn->inet_addr = inet_sk(client_sk->sk)->inet_daddr; ++#else + conn->inet_addr = inet_sk(client_sk->sk)->inet_daddr; ++#endif + conn->transport = KSMBD_TRANS(t); + KSMBD_TRANS(t)->conn = conn; + KSMBD_TRANS(t)->ops = &ksmbd_tcp_transport_ops; +@@ -231,7 +238,6 @@ static int ksmbd_kthread_fn(void *p) + { + struct socket *client_sk = NULL; + struct interface *iface = (struct interface *)p; +- struct inet_sock *csk_inet; + struct ksmbd_conn *conn; + int ret; + +@@ -254,13 +260,27 @@ static int ksmbd_kthread_fn(void *p) + /* + * Limits repeated connections from clients with the same IP. + */ +- csk_inet = inet_sk(client_sk->sk); + down_read(&conn_list_lock); + list_for_each_entry(conn, &conn_list, conns_list) +- if (csk_inet->inet_daddr == conn->inet_addr) { ++#if IS_ENABLED(CONFIG_IPV6) ++ if (client_sk->sk->sk_family == AF_INET6) { ++ if (memcmp(&client_sk->sk->sk_v6_daddr, ++ &conn->inet6_addr, 16) == 0) { ++ ret = -EAGAIN; ++ break; ++ } ++ } else if (inet_sk(client_sk->sk)->inet_daddr == ++ conn->inet_addr) { + ret = -EAGAIN; + break; + } ++#else ++ if (inet_sk(client_sk->sk)->inet_daddr == ++ conn->inet_addr) { ++ ret = -EAGAIN; ++ break; ++ } ++#endif + up_read(&conn_list_lock); + if (ret == -EAGAIN) + continue; diff --git a/debian/patches/patchset-pf/steady/0061-ksmbd-fix-refcount-leak-causing-resource-not-release.patch b/debian/patches/patchset-pf/steady/0061-ksmbd-fix-refcount-leak-causing-resource-not-release.patch new file mode 100644 index 0000000..52bb084 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0061-ksmbd-fix-refcount-leak-causing-resource-not-release.patch @@ -0,0 +1,56 @@ +From 053ed640e99b096f155a404b3d919b3475bd4275 Mon Sep 17 00:00:00 2001 +From: Ziyan Xu +Date: Sat, 16 Aug 2025 10:20:05 +0900 +Subject: ksmbd: fix refcount leak causing resource not released + +When ksmbd_conn_releasing(opinfo->conn) returns true,the refcount was not +decremented properly, causing a refcount leak that prevents the count from +reaching zero and the memory from being released. + +Cc: stable@vger.kernel.org +Signed-off-by: Ziyan Xu +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +--- + fs/smb/server/oplock.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/fs/smb/server/oplock.c ++++ b/fs/smb/server/oplock.c +@@ -1102,8 +1102,10 @@ void smb_send_parent_lease_break_noti(st + if (!atomic_inc_not_zero(&opinfo->refcount)) + continue; + +- if (ksmbd_conn_releasing(opinfo->conn)) ++ if (ksmbd_conn_releasing(opinfo->conn)) { ++ opinfo_put(opinfo); + continue; ++ } + + oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); + opinfo_put(opinfo); +@@ -1139,8 +1141,11 @@ void smb_lazy_parent_lease_break_close(s + if (!atomic_inc_not_zero(&opinfo->refcount)) + continue; + +- if (ksmbd_conn_releasing(opinfo->conn)) ++ if (ksmbd_conn_releasing(opinfo->conn)) { ++ opinfo_put(opinfo); + continue; ++ } ++ + oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); + opinfo_put(opinfo); + } +@@ -1343,8 +1348,10 @@ void smb_break_all_levII_oplock(struct k + if (!atomic_inc_not_zero(&brk_op->refcount)) + continue; + +- if (ksmbd_conn_releasing(brk_op->conn)) ++ if (ksmbd_conn_releasing(brk_op->conn)) { ++ opinfo_put(brk_op); + continue; ++ } + + if (brk_op->is_lease && (brk_op->o_lease->state & + (~(SMB2_LEASE_READ_CACHING_LE | diff --git a/debian/patches/patchset-pf/steady/0062-mmc-sdhci-pci-gli-Add-a-new-function-to-simplify-the.patch b/debian/patches/patchset-pf/steady/0062-mmc-sdhci-pci-gli-Add-a-new-function-to-simplify-the.patch new file mode 100644 index 0000000..50c8d8d --- /dev/null +++ b/debian/patches/patchset-pf/steady/0062-mmc-sdhci-pci-gli-Add-a-new-function-to-simplify-the.patch @@ -0,0 +1,86 @@ +From 4d73be13721834ee79ae45bd66102501f17a779d Mon Sep 17 00:00:00 2001 +From: Victor Shih +Date: Thu, 31 Jul 2025 14:57:50 +0800 +Subject: mmc: sdhci-pci-gli: Add a new function to simplify the code + +In preparation to fix replay timer timeout, add +sdhci_gli_mask_replay_timer_timeout() function +to simplify some of the code, allowing it to be re-used. + +Signed-off-by: Victor Shih +Fixes: 1ae1d2d6e555 ("mmc: sdhci-pci-gli: Add Genesys Logic GL9763E support") +Cc: stable@vger.kernel.org +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250731065752.450231-2-victorshihgli@gmail.com +Signed-off-by: Ulf Hansson +--- + drivers/mmc/host/sdhci-pci-gli.c | 30 ++++++++++++++++-------------- + 1 file changed, 16 insertions(+), 14 deletions(-) + +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -287,6 +287,20 @@ + #define GLI_MAX_TUNING_LOOP 40 + + /* Genesys Logic chipset */ ++static void sdhci_gli_mask_replay_timer_timeout(struct pci_dev *pdev) ++{ ++ int aer; ++ u32 value; ++ ++ /* mask the replay timer timeout of AER */ ++ aer = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR); ++ if (aer) { ++ pci_read_config_dword(pdev, aer + PCI_ERR_COR_MASK, &value); ++ value |= PCI_ERR_COR_REP_TIMER; ++ pci_write_config_dword(pdev, aer + PCI_ERR_COR_MASK, value); ++ } ++} ++ + static inline void gl9750_wt_on(struct sdhci_host *host) + { + u32 wt_value; +@@ -607,7 +621,6 @@ static void gl9750_hw_setting(struct sdh + { + struct sdhci_pci_slot *slot = sdhci_priv(host); + struct pci_dev *pdev; +- int aer; + u32 value; + + pdev = slot->chip->pdev; +@@ -626,12 +639,7 @@ static void gl9750_hw_setting(struct sdh + pci_set_power_state(pdev, PCI_D0); + + /* mask the replay timer timeout of AER */ +- aer = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR); +- if (aer) { +- pci_read_config_dword(pdev, aer + PCI_ERR_COR_MASK, &value); +- value |= PCI_ERR_COR_REP_TIMER; +- pci_write_config_dword(pdev, aer + PCI_ERR_COR_MASK, value); +- } ++ sdhci_gli_mask_replay_timer_timeout(pdev); + + gl9750_wt_off(host); + } +@@ -806,7 +814,6 @@ static void sdhci_gl9755_set_clock(struc + static void gl9755_hw_setting(struct sdhci_pci_slot *slot) + { + struct pci_dev *pdev = slot->chip->pdev; +- int aer; + u32 value; + + gl9755_wt_on(pdev); +@@ -841,12 +848,7 @@ static void gl9755_hw_setting(struct sdh + pci_set_power_state(pdev, PCI_D0); + + /* mask the replay timer timeout of AER */ +- aer = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR); +- if (aer) { +- pci_read_config_dword(pdev, aer + PCI_ERR_COR_MASK, &value); +- value |= PCI_ERR_COR_REP_TIMER; +- pci_write_config_dword(pdev, aer + PCI_ERR_COR_MASK, value); +- } ++ sdhci_gli_mask_replay_timer_timeout(pdev); + + gl9755_wt_off(pdev); + } diff --git a/debian/patches/patchset-pf/steady/0063-mmc-sdhci-pci-gli-GL9763e-Rename-the-gli_set_gl9763e.patch b/debian/patches/patchset-pf/steady/0063-mmc-sdhci-pci-gli-GL9763e-Rename-the-gli_set_gl9763e.patch new file mode 100644 index 0000000..3cb1cf4 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0063-mmc-sdhci-pci-gli-GL9763e-Rename-the-gli_set_gl9763e.patch @@ -0,0 +1,39 @@ +From dfc8d4137cf986bac6a07e4b202423b0e3d32f9e Mon Sep 17 00:00:00 2001 +From: Victor Shih +Date: Thu, 31 Jul 2025 14:57:51 +0800 +Subject: mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for + consistency + +In preparation to fix replay timer timeout, rename the +gli_set_gl9763e() to gl9763e_hw_setting() for consistency. + +Signed-off-by: Victor Shih +Fixes: 1ae1d2d6e555 ("mmc: sdhci-pci-gli: Add Genesys Logic GL9763E support") +Cc: stable@vger.kernel.org +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250731065752.450231-3-victorshihgli@gmail.com +Signed-off-by: Ulf Hansson +--- + drivers/mmc/host/sdhci-pci-gli.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -1753,7 +1753,7 @@ cleanup: + return ret; + } + +-static void gli_set_gl9763e(struct sdhci_pci_slot *slot) ++static void gl9763e_hw_setting(struct sdhci_pci_slot *slot) + { + struct pci_dev *pdev = slot->chip->pdev; + u32 value; +@@ -1925,7 +1925,7 @@ static int gli_probe_slot_gl9763e(struct + gli_pcie_enable_msi(slot); + host->mmc_host_ops.hs400_enhanced_strobe = + gl9763e_hs400_enhanced_strobe; +- gli_set_gl9763e(slot); ++ gl9763e_hw_setting(slot); + sdhci_enable_v4_mode(host); + + return 0; diff --git a/debian/patches/patchset-pf/steady/0064-mmc-sdhci-pci-gli-GL9763e-Mask-the-replay-timer-time.patch b/debian/patches/patchset-pf/steady/0064-mmc-sdhci-pci-gli-GL9763e-Mask-the-replay-timer-time.patch new file mode 100644 index 0000000..9d06dd0 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0064-mmc-sdhci-pci-gli-GL9763e-Mask-the-replay-timer-time.patch @@ -0,0 +1,32 @@ +From d36b9a791450aec781a3276dd3544bdfb147e539 Mon Sep 17 00:00:00 2001 +From: Victor Shih +Date: Thu, 31 Jul 2025 14:57:52 +0800 +Subject: mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER + +Due to a flaw in the hardware design, the GL9763e replay timer frequently +times out when ASPM is enabled. As a result, the warning messages will +often appear in the system log when the system accesses the GL9763e +PCI config. Therefore, the replay timer timeout must be masked. + +Signed-off-by: Victor Shih +Fixes: 1ae1d2d6e555 ("mmc: sdhci-pci-gli: Add Genesys Logic GL9763E support") +Cc: stable@vger.kernel.org +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250731065752.450231-4-victorshihgli@gmail.com +Signed-off-by: Ulf Hansson +--- + drivers/mmc/host/sdhci-pci-gli.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -1782,6 +1782,9 @@ static void gl9763e_hw_setting(struct sd + value |= FIELD_PREP(GLI_9763E_HS400_RXDLY, GLI_9763E_HS400_RXDLY_5); + pci_write_config_dword(pdev, PCIE_GLI_9763E_CLKRXDLY, value); + ++ /* mask the replay timer timeout of AER */ ++ sdhci_gli_mask_replay_timer_timeout(pdev); ++ + pci_read_config_dword(pdev, PCIE_GLI_9763E_VHS, &value); + value &= ~GLI_9763E_VHS_REV; + value |= FIELD_PREP(GLI_9763E_VHS_REV, GLI_9763E_VHS_REV_R); diff --git a/debian/patches/patchset-pf/steady/0065-mmc-sdhci-of-arasan-Ensure-CD-logic-stabilization-be.patch b/debian/patches/patchset-pf/steady/0065-mmc-sdhci-of-arasan-Ensure-CD-logic-stabilization-be.patch new file mode 100644 index 0000000..0a6980f --- /dev/null +++ b/debian/patches/patchset-pf/steady/0065-mmc-sdhci-of-arasan-Ensure-CD-logic-stabilization-be.patch @@ -0,0 +1,128 @@ +From 848beabc268b0e12a5bc0dbe71c45c5db7a12b43 Mon Sep 17 00:00:00 2001 +From: Sai Krishna Potthuri +Date: Wed, 30 Jul 2025 11:35:43 +0530 +Subject: mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up + +During SD suspend/resume without a full card rescan (when using +non-removable SD cards for rootfs), the SD card initialization may fail +after resume. This occurs because, after a host controller reset, the +card detect logic may take time to stabilize due to debounce logic. +Without waiting for stabilization, the host may attempt powering up the +card prematurely, leading to command timeouts during resume flow. +Add sdhci_arasan_set_power_and_bus_voltage() to wait for the card detect +stable bit before power up the card. Since the stabilization time +is not fixed, a maximum timeout of one second is used to ensure +sufficient wait time for the card detect signal to stabilize. + +Signed-off-by: Sai Krishna Potthuri +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250730060543.1735971-1-sai.krishna.potthuri@amd.com +Signed-off-by: Ulf Hansson +--- + drivers/mmc/host/sdhci-of-arasan.c | 33 ++++++++++++++++++++++++++++-- + 1 file changed, 31 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/sdhci-of-arasan.c ++++ b/drivers/mmc/host/sdhci-of-arasan.c +@@ -99,6 +99,9 @@ + #define HIWORD_UPDATE(val, mask, shift) \ + ((val) << (shift) | (mask) << ((shift) + 16)) + ++#define CD_STABLE_TIMEOUT_US 1000000 ++#define CD_STABLE_MAX_SLEEP_US 10 ++ + /** + * struct sdhci_arasan_soc_ctl_field - Field used in sdhci_arasan_soc_ctl_map + * +@@ -206,12 +209,15 @@ struct sdhci_arasan_data { + * 19MHz instead + */ + #define SDHCI_ARASAN_QUIRK_CLOCK_25_BROKEN BIT(2) ++/* Enable CD stable check before power-up */ ++#define SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE BIT(3) + }; + + struct sdhci_arasan_of_data { + const struct sdhci_arasan_soc_ctl_map *soc_ctl_map; + const struct sdhci_pltfm_data *pdata; + const struct sdhci_arasan_clk_ops *clk_ops; ++ u32 quirks; + }; + + static const struct sdhci_arasan_soc_ctl_map rk3399_soc_ctl_map = { +@@ -514,6 +520,24 @@ static int sdhci_arasan_voltage_switch(s + return -EINVAL; + } + ++static void sdhci_arasan_set_power_and_bus_voltage(struct sdhci_host *host, unsigned char mode, ++ unsigned short vdd) ++{ ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_arasan_data *sdhci_arasan = sdhci_pltfm_priv(pltfm_host); ++ u32 reg; ++ ++ /* ++ * Ensure that the card detect logic has stabilized before powering up, this is ++ * necessary after a host controller reset. ++ */ ++ if (mode == MMC_POWER_UP && sdhci_arasan->quirks & SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE) ++ read_poll_timeout(sdhci_readl, reg, reg & SDHCI_CD_STABLE, CD_STABLE_MAX_SLEEP_US, ++ CD_STABLE_TIMEOUT_US, false, host, SDHCI_PRESENT_STATE); ++ ++ sdhci_set_power_and_bus_voltage(host, mode, vdd); ++} ++ + static const struct sdhci_ops sdhci_arasan_ops = { + .set_clock = sdhci_arasan_set_clock, + .get_max_clock = sdhci_pltfm_clk_get_max_clock, +@@ -521,7 +545,7 @@ static const struct sdhci_ops sdhci_aras + .set_bus_width = sdhci_set_bus_width, + .reset = sdhci_arasan_reset, + .set_uhs_signaling = sdhci_set_uhs_signaling, +- .set_power = sdhci_set_power_and_bus_voltage, ++ .set_power = sdhci_arasan_set_power_and_bus_voltage, + .hw_reset = sdhci_arasan_hw_reset, + }; + +@@ -570,7 +594,7 @@ static const struct sdhci_ops sdhci_aras + .set_bus_width = sdhci_set_bus_width, + .reset = sdhci_arasan_reset, + .set_uhs_signaling = sdhci_set_uhs_signaling, +- .set_power = sdhci_set_power_and_bus_voltage, ++ .set_power = sdhci_arasan_set_power_and_bus_voltage, + .irq = sdhci_arasan_cqhci_irq, + }; + +@@ -1447,6 +1471,7 @@ static const struct sdhci_arasan_clk_ops + static struct sdhci_arasan_of_data sdhci_arasan_zynqmp_data = { + .pdata = &sdhci_arasan_zynqmp_pdata, + .clk_ops = &zynqmp_clk_ops, ++ .quirks = SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE, + }; + + static const struct sdhci_arasan_clk_ops versal_clk_ops = { +@@ -1457,6 +1482,7 @@ static const struct sdhci_arasan_clk_ops + static struct sdhci_arasan_of_data sdhci_arasan_versal_data = { + .pdata = &sdhci_arasan_zynqmp_pdata, + .clk_ops = &versal_clk_ops, ++ .quirks = SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE, + }; + + static const struct sdhci_arasan_clk_ops versal_net_clk_ops = { +@@ -1467,6 +1493,7 @@ static const struct sdhci_arasan_clk_ops + static struct sdhci_arasan_of_data sdhci_arasan_versal_net_data = { + .pdata = &sdhci_arasan_versal_net_pdata, + .clk_ops = &versal_net_clk_ops, ++ .quirks = SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE, + }; + + static struct sdhci_arasan_of_data intel_keembay_emmc_data = { +@@ -1945,6 +1972,8 @@ static int sdhci_arasan_probe(struct pla + if (of_device_is_compatible(np, "rockchip,rk3399-sdhci-5.1")) + sdhci_arasan_update_clockmultiplier(host, 0x0); + ++ sdhci_arasan->quirks |= data->quirks; ++ + if (of_device_is_compatible(np, "intel,keembay-sdhci-5.1-emmc") || + of_device_is_compatible(np, "intel,keembay-sdhci-5.1-sd") || + of_device_is_compatible(np, "intel,keembay-sdhci-5.1-sdio")) { diff --git a/debian/patches/patchset-pf/steady/0066-memstick-Fix-deadlock-by-moving-removing-flag-earlie.patch b/debian/patches/patchset-pf/steady/0066-memstick-Fix-deadlock-by-moving-removing-flag-earlie.patch new file mode 100644 index 0000000..0bc233c --- /dev/null +++ b/debian/patches/patchset-pf/steady/0066-memstick-Fix-deadlock-by-moving-removing-flag-earlie.patch @@ -0,0 +1,75 @@ +From 6b13747a602e6e119a0cfd03d967e0726d12ba26 Mon Sep 17 00:00:00 2001 +From: Jiayi Li +Date: Mon, 4 Aug 2025 09:36:04 +0800 +Subject: memstick: Fix deadlock by moving removing flag earlier + +The existing memstick core patch: commit 62c59a8786e6 ("memstick: Skip +allocating card when removing host") sets host->removing in +memstick_remove_host(),but still exists a critical time window where +memstick_check can run after host->eject is set but before removing is set. + +In the rtsx_usb_ms driver, the problematic sequence is: + +rtsx_usb_ms_drv_remove: memstick_check: + host->eject = true + cancel_work_sync(handle_req) if(!host->removing) + ... memstick_alloc_card() + memstick_set_rw_addr() + memstick_new_req() + rtsx_usb_ms_request() + if(!host->eject) + skip schedule_work + wait_for_completion() + memstick_remove_host: [blocks indefinitely] + host->removing = true + flush_workqueue() + [block] + +1. rtsx_usb_ms_drv_remove sets host->eject = true +2. cancel_work_sync(&host->handle_req) runs +3. memstick_check work may be executed here <-- danger window +4. memstick_remove_host sets removing = 1 + +During this window (step 3), memstick_check calls memstick_alloc_card, +which may indefinitely waiting for mrq_complete completion that will +never occur because rtsx_usb_ms_request sees eject=true and skips +scheduling work, memstick_set_rw_addr waits forever for completion. + +This causes a deadlock when memstick_remove_host tries to flush_workqueue, +waiting for memstick_check to complete, while memstick_check is blocked +waiting for mrq_complete completion. + +Fix this by setting removing=true at the start of rtsx_usb_ms_drv_remove, +before any work cancellation. This ensures memstick_check will see the +removing flag immediately and exit early, avoiding the deadlock. + +Fixes: 62c59a8786e6 ("memstick: Skip allocating card when removing host") +Signed-off-by: Jiayi Li +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250804013604.1311218-1-lijiayi@kylinos.cn +Signed-off-by: Ulf Hansson +--- + drivers/memstick/core/memstick.c | 1 - + drivers/memstick/host/rtsx_usb_ms.c | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/memstick/core/memstick.c ++++ b/drivers/memstick/core/memstick.c +@@ -555,7 +555,6 @@ EXPORT_SYMBOL(memstick_add_host); + */ + void memstick_remove_host(struct memstick_host *host) + { +- host->removing = 1; + flush_workqueue(workqueue); + mutex_lock(&host->lock); + if (host->card) +--- a/drivers/memstick/host/rtsx_usb_ms.c ++++ b/drivers/memstick/host/rtsx_usb_ms.c +@@ -812,6 +812,7 @@ static void rtsx_usb_ms_drv_remove(struc + int err; + + host->eject = true; ++ msh->removing = true; + cancel_work_sync(&host->handle_req); + cancel_delayed_work_sync(&host->poll_card); + diff --git a/debian/patches/patchset-pf/steady/0067-compiler-remove-__ADDRESSABLE_ASM-_STR-again.patch b/debian/patches/patchset-pf/steady/0067-compiler-remove-__ADDRESSABLE_ASM-_STR-again.patch new file mode 100644 index 0000000..8bdc477 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0067-compiler-remove-__ADDRESSABLE_ASM-_STR-again.patch @@ -0,0 +1,63 @@ +From c09f6cef1d27da9baec950c8949926c9fc42a3e7 Mon Sep 17 00:00:00 2001 +From: Jan Beulich +Date: Mon, 14 Apr 2025 16:41:07 +0200 +Subject: compiler: remove __ADDRESSABLE_ASM{_STR,}() again + +__ADDRESSABLE_ASM_STR() is where the necessary stringification happens. +As long as "sym" doesn't contain any odd characters, no quoting is +required for its use with .quad / .long. In fact the quotation gets in +the way with gas 2.25; it's only from 2.26 onwards that quoted symbols +are half-way properly supported. + +However, assembly being different from C anyway, drop +__ADDRESSABLE_ASM_STR() and its helper macro altogether. A simple +.global directive will suffice to get the symbol "declared", i.e. into +the symbol table. While there also stop open-coding STATIC_CALL_TRAMP() +and STATIC_CALL_KEY(). + +Fixes: 0ef8047b737d ("x86/static-call: provide a way to do very early static-call updates") +Signed-off-by: Jan Beulich +Acked-by: Josh Poimboeuf +Cc: stable@vger.kernel.org +Signed-off-by: Juergen Gross +Message-ID: <609d2c74-de13-4fae-ab1a-1ec44afb948d@suse.com> +--- + arch/x86/include/asm/xen/hypercall.h | 5 +++-- + include/linux/compiler.h | 8 -------- + 2 files changed, 3 insertions(+), 10 deletions(-) + +--- a/arch/x86/include/asm/xen/hypercall.h ++++ b/arch/x86/include/asm/xen/hypercall.h +@@ -94,12 +94,13 @@ DECLARE_STATIC_CALL(xen_hypercall, xen_h + #ifdef MODULE + #define __ADDRESSABLE_xen_hypercall + #else +-#define __ADDRESSABLE_xen_hypercall __ADDRESSABLE_ASM_STR(__SCK__xen_hypercall) ++#define __ADDRESSABLE_xen_hypercall \ ++ __stringify(.global STATIC_CALL_KEY(xen_hypercall);) + #endif + + #define __HYPERCALL \ + __ADDRESSABLE_xen_hypercall \ +- "call __SCT__xen_hypercall" ++ __stringify(call STATIC_CALL_TRAMP(xen_hypercall)) + + #define __HYPERCALL_ENTRY(x) "a" (x) + +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -288,14 +288,6 @@ static inline void *offset_to_ptr(const + #define __ADDRESSABLE(sym) \ + ___ADDRESSABLE(sym, __section(".discard.addressable")) + +-#define __ADDRESSABLE_ASM(sym) \ +- .pushsection .discard.addressable,"aw"; \ +- .align ARCH_SEL(8,4); \ +- ARCH_SEL(.quad, .long) __stringify(sym); \ +- .popsection; +- +-#define __ADDRESSABLE_ASM_STR(sym) __stringify(__ADDRESSABLE_ASM(sym)) +- + /* + * This returns a constant expression while determining if an argument is + * a constant expression, most importantly without evaluating the argument. diff --git a/debian/patches/patchset-pf/steady/0068-ACPI-APEI-EINJ-Fix-resource-leak-by-remove-callback-.patch b/debian/patches/patchset-pf/steady/0068-ACPI-APEI-EINJ-Fix-resource-leak-by-remove-callback-.patch new file mode 100644 index 0000000..0a0aa2c --- /dev/null +++ b/debian/patches/patchset-pf/steady/0068-ACPI-APEI-EINJ-Fix-resource-leak-by-remove-callback-.patch @@ -0,0 +1,55 @@ +From 3ba50a386db1ab9c1bdabbdcea6e7063bd7f875d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Thu, 14 Aug 2025 07:11:57 +0200 +Subject: ACPI: APEI: EINJ: Fix resource leak by remove callback in .exit.text +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The .remove() callback is also used during error handling in +faux_probe(). As einj_remove() was marked with __exit it's not linked +into the kernel if the driver is built-in, potentially resulting in +resource leaks. + +Also remove the comment justifying the __exit annotation which doesn't +apply any more since the driver was converted to the faux device +interface. + +Fixes: 6cb9441bfe8d ("ACPI: APEI: EINJ: Transition to the faux device interface") +Signed-off-by: Uwe Kleine-König +Cc: 6.16+ # 6.16+ +Link: https://patch.msgid.link/20250814051157.35867-2-u.kleine-koenig@baylibre.com +Signed-off-by: Rafael J. Wysocki +--- + drivers/acpi/apei/einj-core.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +--- a/drivers/acpi/apei/einj-core.c ++++ b/drivers/acpi/apei/einj-core.c +@@ -842,7 +842,7 @@ err_put_table: + return rc; + } + +-static void __exit einj_remove(struct faux_device *fdev) ++static void einj_remove(struct faux_device *fdev) + { + struct apei_exec_context ctx; + +@@ -864,15 +864,9 @@ static void __exit einj_remove(struct fa + } + + static struct faux_device *einj_dev; +-/* +- * einj_remove() lives in .exit.text. For drivers registered via +- * platform_driver_probe() this is ok because they cannot get unbound at +- * runtime. So mark the driver struct with __refdata to prevent modpost +- * triggering a section mismatch warning. +- */ +-static struct faux_device_ops einj_device_ops __refdata = { ++static struct faux_device_ops einj_device_ops = { + .probe = einj_probe, +- .remove = __exit_p(einj_remove), ++ .remove = einj_remove, + }; + + static int __init einj_init(void) diff --git a/debian/patches/patchset-pf/steady/0069-cpuidle-governors-menu-Avoid-selecting-states-with-t.patch b/debian/patches/patchset-pf/steady/0069-cpuidle-governors-menu-Avoid-selecting-states-with-t.patch new file mode 100644 index 0000000..bde1077 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0069-cpuidle-governors-menu-Avoid-selecting-states-with-t.patch @@ -0,0 +1,118 @@ +From 2d8daa84e1cb9681d49a29cf829eb5678850210e Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 13 Aug 2025 12:25:58 +0200 +Subject: cpuidle: governors: menu: Avoid selecting states with too much + latency + +Occasionally, the exit latency of the idle state selected by the menu +governor may exceed the PM QoS CPU wakeup latency limit. Namely, if the +scheduler tick has been stopped already and predicted_ns is greater than +the tick period length, the governor may return an idle state whose exit +latency exceeds latency_req because that decision is made before +checking the current idle state's exit latency. + +For instance, say that there are 3 idle states, 0, 1, and 2. For idle +states 0 and 1, the exit latency is equal to the target residency and +the values are 0 and 5 us, respectively. State 2 is deeper and has the +exit latency and target residency of 200 us and 2 ms (which is greater +than the tick period length), respectively. + +Say that predicted_ns is equal to TICK_NSEC and the PM QoS latency +limit is 20 us. After the first two iterations of the main loop in +menu_select(), idx becomes 1 and in the third iteration of it the target +residency of the current state (state 2) is greater than predicted_ns. +State 2 is not a polling one and predicted_ns is not less than TICK_NSEC, +so the check on whether or not the tick has been stopped is done. Say +that the tick has been stopped already and there are no imminent timers +(that is, delta_tick is greater than the target residency of state 2). +In that case, idx becomes 2 and it is returned immediately, but the exit +latency of state 2 exceeds the latency limit. + +Address this issue by modifying the code to compare the exit latency of +the current idle state (idle state i) with the latency limit before +comparing its target residency with predicted_ns, which allows one +more exit_latency_ns check that becomes redundant to be dropped. + +However, after the above change, latency_req cannot take the predicted_ns +value any more, which takes place after commit 38f83090f515 ("cpuidle: +menu: Remove iowait influence"), because it may cause a polling state +to be returned prematurely. + +In the context of the previous example say that predicted_ns is 3000 and +the PM QoS latency limit is still 20 us. Additionally, say that idle +state 0 is a polling one. Moving the exit_latency_ns check before the +target_residency_ns one causes the loop to terminate in the second +iteration, before the target_residency_ns check, so idle state 0 will be +returned even though previously state 1 would be returned if there were +no imminent timers. + +For this reason, remove the assignment of the predicted_ns value to +latency_req from the code. + +Fixes: 5ef499cd571c ("cpuidle: menu: Handle stopped tick more aggressively") +Cc: 4.17+ # 4.17+ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Christian Loehle +Link: https://patch.msgid.link/5043159.31r3eYUQgx@rafael.j.wysocki +--- + drivers/cpuidle/governors/menu.c | 29 ++++++++++++----------------- + 1 file changed, 12 insertions(+), 17 deletions(-) + +--- a/drivers/cpuidle/governors/menu.c ++++ b/drivers/cpuidle/governors/menu.c +@@ -287,20 +287,15 @@ static int menu_select(struct cpuidle_dr + return 0; + } + +- if (tick_nohz_tick_stopped()) { +- /* +- * If the tick is already stopped, the cost of possible short +- * idle duration misprediction is much higher, because the CPU +- * may be stuck in a shallow idle state for a long time as a +- * result of it. In that case say we might mispredict and use +- * the known time till the closest timer event for the idle +- * state selection. +- */ +- if (predicted_ns < TICK_NSEC) +- predicted_ns = data->next_timer_ns; +- } else if (latency_req > predicted_ns) { +- latency_req = predicted_ns; +- } ++ /* ++ * If the tick is already stopped, the cost of possible short idle ++ * duration misprediction is much higher, because the CPU may be stuck ++ * in a shallow idle state for a long time as a result of it. In that ++ * case, say we might mispredict and use the known time till the closest ++ * timer event for the idle state selection. ++ */ ++ if (tick_nohz_tick_stopped() && predicted_ns < TICK_NSEC) ++ predicted_ns = data->next_timer_ns; + + /* + * Find the idle state with the lowest power while satisfying +@@ -316,13 +311,15 @@ static int menu_select(struct cpuidle_dr + if (idx == -1) + idx = i; /* first enabled state */ + ++ if (s->exit_latency_ns > latency_req) ++ break; ++ + if (s->target_residency_ns > predicted_ns) { + /* + * Use a physical idle state, not busy polling, unless + * a timer is going to trigger soon enough. + */ + if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) && +- s->exit_latency_ns <= latency_req && + s->target_residency_ns <= data->next_timer_ns) { + predicted_ns = s->target_residency_ns; + idx = i; +@@ -354,8 +351,6 @@ static int menu_select(struct cpuidle_dr + + return idx; + } +- if (s->exit_latency_ns > latency_req) +- break; + + idx = i; + } diff --git a/debian/patches/patchset-pf/steady/0070-mptcp-drop-skb-if-MPTCP-skb-extension-allocation-fai.patch b/debian/patches/patchset-pf/steady/0070-mptcp-drop-skb-if-MPTCP-skb-extension-allocation-fai.patch new file mode 100644 index 0000000..0643250 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0070-mptcp-drop-skb-if-MPTCP-skb-extension-allocation-fai.patch @@ -0,0 +1,57 @@ +From 28803c739ac24f0b71167c2735fb35d04b19384a Mon Sep 17 00:00:00 2001 +From: Christoph Paasch +Date: Fri, 15 Aug 2025 19:28:19 +0200 +Subject: mptcp: drop skb if MPTCP skb extension allocation fails + +When skb_ext_add(skb, SKB_EXT_MPTCP) fails in mptcp_incoming_options(), +we used to return true, letting the segment proceed through the TCP +receive path without a DSS mapping. Such segments can leave inconsistent +mapping state and trigger a mid-stream fallback to TCP, which in testing +collapsed (by artificially forcing failures in skb_ext_add) throughput +to zero. + +Return false instead so the TCP input path drops the skb (see +tcp_data_queue() and step-7 processing). This is the safer choice +under memory pressure: it preserves MPTCP correctness and provides +backpressure to the sender. + +Control packets remain unaffected: ACK updates and DATA_FIN handling +happen before attempting the extension allocation, and tcp_reset() +continues to ignore the return value. + +With this change, MPTCP continues to work at high throughput if we +artificially inject failures into skb_ext_add. + +Fixes: 6787b7e350d3 ("mptcp: avoid processing packet if a subflow reset") +Cc: stable@vger.kernel.org +Signed-off-by: Christoph Paasch +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-1-521fe9957892@kernel.org +Signed-off-by: Jakub Kicinski +--- + net/mptcp/options.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -1117,7 +1117,9 @@ static bool add_addr_hmac_valid(struct m + return hmac == mp_opt->ahmac; + } + +-/* Return false if a subflow has been reset, else return true */ ++/* Return false in case of error (or subflow has been reset), ++ * else return true. ++ */ + bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) + { + struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk); +@@ -1221,7 +1223,7 @@ bool mptcp_incoming_options(struct sock + + mpext = skb_ext_add(skb, SKB_EXT_MPTCP); + if (!mpext) +- return true; ++ return false; + + memset(mpext, 0, sizeof(*mpext)); + diff --git a/debian/patches/patchset-pf/steady/0071-mptcp-pm-kernel-flush-do-not-reset-ADD_ADDR-limit.patch b/debian/patches/patchset-pf/steady/0071-mptcp-pm-kernel-flush-do-not-reset-ADD_ADDR-limit.patch new file mode 100644 index 0000000..4cf2f9b --- /dev/null +++ b/debian/patches/patchset-pf/steady/0071-mptcp-pm-kernel-flush-do-not-reset-ADD_ADDR-limit.patch @@ -0,0 +1,35 @@ +From c4efb64dbe77b1db336896b9fd151d4f306cf521 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Fri, 15 Aug 2025 19:28:20 +0200 +Subject: mptcp: pm: kernel: flush: do not reset ADD_ADDR limit + +A flush of the MPTCP endpoints should not affect the MPTCP limits. In +other words, 'ip mptcp endpoint flush' should not change 'ip mptcp +limits'. + +But it was the case: the MPTCP_PM_ATTR_RCV_ADD_ADDRS (add_addr_accepted) +limit was reset by accident. Removing the reset of this counter during a +flush fixes this issue. + +Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") +Cc: stable@vger.kernel.org +Reported-by: Thomas Dreibholz +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/579 +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-2-521fe9957892@kernel.org +Signed-off-by: Jakub Kicinski +--- + net/mptcp/pm_kernel.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/mptcp/pm_kernel.c ++++ b/net/mptcp/pm_kernel.c +@@ -1085,7 +1085,6 @@ static void __flush_addrs(struct list_he + static void __reset_counters(struct pm_nl_pernet *pernet) + { + WRITE_ONCE(pernet->add_addr_signal_max, 0); +- WRITE_ONCE(pernet->add_addr_accept_max, 0); + WRITE_ONCE(pernet->local_addr_max, 0); + pernet->addrs = 0; + } diff --git a/debian/patches/patchset-pf/steady/0072-mptcp-remove-duplicate-sk_reset_timer-call.patch b/debian/patches/patchset-pf/steady/0072-mptcp-remove-duplicate-sk_reset_timer-call.patch new file mode 100644 index 0000000..ee2f0d0 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0072-mptcp-remove-duplicate-sk_reset_timer-call.patch @@ -0,0 +1,45 @@ +From 135074416baed33c7e855827cf2d93d7fcb6d057 Mon Sep 17 00:00:00 2001 +From: Geliang Tang +Date: Fri, 15 Aug 2025 19:28:22 +0200 +Subject: mptcp: remove duplicate sk_reset_timer call + +sk_reset_timer() was called twice in mptcp_pm_alloc_anno_list. + +Simplify the code by using a 'goto' statement to eliminate the +duplication. + +Note that this is not a fix, but it will help backporting the following +patch. The same "Fixes" tag has been added for this reason. + +Fixes: 93f323b9cccc ("mptcp: add a new sysctl add_addr_timeout") +Cc: stable@vger.kernel.org +Signed-off-by: Geliang Tang +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-4-521fe9957892@kernel.org +Signed-off-by: Jakub Kicinski +--- + net/mptcp/pm.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -353,9 +353,7 @@ bool mptcp_pm_alloc_anno_list(struct mpt + if (WARN_ON_ONCE(mptcp_pm_is_kernel(msk))) + return false; + +- sk_reset_timer(sk, &add_entry->add_timer, +- jiffies + mptcp_get_add_addr_timeout(net)); +- return true; ++ goto reset_timer; + } + + add_entry = kmalloc(sizeof(*add_entry), GFP_ATOMIC); +@@ -369,6 +367,7 @@ bool mptcp_pm_alloc_anno_list(struct mpt + add_entry->retrans_times = 0; + + timer_setup(&add_entry->add_timer, mptcp_pm_add_timer, 0); ++reset_timer: + sk_reset_timer(sk, &add_entry->add_timer, + jiffies + mptcp_get_add_addr_timeout(net)); + diff --git a/debian/patches/patchset-pf/steady/0073-mptcp-disable-add_addr-retransmission-when-timeout-i.patch b/debian/patches/patchset-pf/steady/0073-mptcp-disable-add_addr-retransmission-when-timeout-i.patch new file mode 100644 index 0000000..3552848 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0073-mptcp-disable-add_addr-retransmission-when-timeout-i.patch @@ -0,0 +1,86 @@ +From dda31fb26f0ac5d06db5d59daade7e9ced49667a Mon Sep 17 00:00:00 2001 +From: Geliang Tang +Date: Fri, 15 Aug 2025 19:28:23 +0200 +Subject: mptcp: disable add_addr retransmission when timeout is 0 + +When add_addr_timeout was set to 0, this caused the ADD_ADDR to be +retransmitted immediately, which looks like a buggy behaviour. Instead, +interpret 0 as "no retransmissions needed". + +The documentation is updated to explicitly state that setting the timeout +to 0 disables retransmission. + +Fixes: 93f323b9cccc ("mptcp: add a new sysctl add_addr_timeout") +Cc: stable@vger.kernel.org +Suggested-by: Matthieu Baerts +Signed-off-by: Geliang Tang +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-5-521fe9957892@kernel.org +Signed-off-by: Jakub Kicinski +--- + Documentation/networking/mptcp-sysctl.rst | 2 ++ + net/mptcp/pm.c | 13 ++++++++++--- + 2 files changed, 12 insertions(+), 3 deletions(-) + +--- a/Documentation/networking/mptcp-sysctl.rst ++++ b/Documentation/networking/mptcp-sysctl.rst +@@ -12,6 +12,8 @@ add_addr_timeout - INTEGER (seconds) + resent to an MPTCP peer that has not acknowledged a previous + ADD_ADDR message. + ++ Do not retransmit if set to 0. ++ + The default value matches TCP_RTO_MAX. This is a per-namespace + sysctl. + +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -274,6 +274,7 @@ static void mptcp_pm_add_timer(struct ti + add_timer); + struct mptcp_sock *msk = entry->sock; + struct sock *sk = (struct sock *)msk; ++ unsigned int timeout; + + pr_debug("msk=%p\n", msk); + +@@ -291,6 +292,10 @@ static void mptcp_pm_add_timer(struct ti + goto out; + } + ++ timeout = mptcp_get_add_addr_timeout(sock_net(sk)); ++ if (!timeout) ++ goto out; ++ + spin_lock_bh(&msk->pm.lock); + + if (!mptcp_pm_should_add_signal_addr(msk)) { +@@ -302,7 +307,7 @@ static void mptcp_pm_add_timer(struct ti + + if (entry->retrans_times < ADD_ADDR_RETRANS_MAX) + sk_reset_timer(sk, timer, +- jiffies + mptcp_get_add_addr_timeout(sock_net(sk))); ++ jiffies + timeout); + + spin_unlock_bh(&msk->pm.lock); + +@@ -344,6 +349,7 @@ bool mptcp_pm_alloc_anno_list(struct mpt + struct mptcp_pm_add_entry *add_entry = NULL; + struct sock *sk = (struct sock *)msk; + struct net *net = sock_net(sk); ++ unsigned int timeout; + + lockdep_assert_held(&msk->pm.lock); + +@@ -368,8 +374,9 @@ bool mptcp_pm_alloc_anno_list(struct mpt + + timer_setup(&add_entry->add_timer, mptcp_pm_add_timer, 0); + reset_timer: +- sk_reset_timer(sk, &add_entry->add_timer, +- jiffies + mptcp_get_add_addr_timeout(net)); ++ timeout = mptcp_get_add_addr_timeout(net); ++ if (timeout) ++ sk_reset_timer(sk, &add_entry->add_timer, jiffies + timeout); + + return true; + } diff --git a/debian/patches/patchset-pf/steady/0074-usb-xhci-Fix-slot_id-resource-race-conflict.patch b/debian/patches/patchset-pf/steady/0074-usb-xhci-Fix-slot_id-resource-race-conflict.patch new file mode 100644 index 0000000..7026a66 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0074-usb-xhci-Fix-slot_id-resource-race-conflict.patch @@ -0,0 +1,217 @@ +From 593c5009d3316e756dc882364ac67a78b39332ae Mon Sep 17 00:00:00 2001 +From: Weitao Wang +Date: Tue, 19 Aug 2025 15:58:43 +0300 +Subject: usb: xhci: Fix slot_id resource race conflict + +xHC controller may immediately reuse a slot_id after it's disabled, +giving it to a new enumerating device before the xhci driver freed +all resources related to the disabled device. + +In such a scenario, device-A with slot_id equal to 1 is disconnecting +while device-B is enumerating, device-B will fail to enumerate in the +follow sequence. + +1.[device-A] send disable slot command +2.[device-B] send enable slot command +3.[device-A] disable slot command completed and wakeup waiting thread +4.[device-B] enable slot command completed with slot_id equal to 1 and + wakeup waiting thread +5.[device-B] driver checks that slot_id is still in use (by device-A) in + xhci_alloc_virt_device, and fail to enumerate due to this + conflict +6.[device-A] xhci->devs[slot_id] set to NULL in xhci_free_virt_device + +To fix driver's slot_id resources conflict, clear xhci->devs[slot_id] and +xhci->dcbba->dev_context_ptrs[slot_id] pointers in the interrupt context +when disable slot command completes successfully. Simultaneously, adjust +function xhci_free_virt_device to accurately handle device release. + +[minor smatch warning and commit message fix -Mathias] + +Cc: stable@vger.kernel.org +Fixes: 7faac1953ed1 ("xhci: avoid race between disable slot command and host runtime suspend") +Signed-off-by: Weitao Wang +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250819125844.2042452-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-hub.c | 3 +-- + drivers/usb/host/xhci-mem.c | 22 +++++++++++----------- + drivers/usb/host/xhci-ring.c | 9 +++++++-- + drivers/usb/host/xhci.c | 21 ++++++++++++++------- + drivers/usb/host/xhci.h | 3 ++- + 5 files changed, 35 insertions(+), 23 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -704,8 +704,7 @@ static int xhci_enter_test_mode(struct x + if (!xhci->devs[i]) + continue; + +- retval = xhci_disable_slot(xhci, i); +- xhci_free_virt_device(xhci, i); ++ retval = xhci_disable_and_free_slot(xhci, i); + if (retval) + xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n", + i, retval); +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -865,21 +865,20 @@ free_tts: + * will be manipulated by the configure endpoint, allocate device, or update + * hub functions while this function is removing the TT entries from the list. + */ +-void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id) ++void xhci_free_virt_device(struct xhci_hcd *xhci, struct xhci_virt_device *dev, ++ int slot_id) + { +- struct xhci_virt_device *dev; + int i; + int old_active_eps = 0; + + /* Slot ID 0 is reserved */ +- if (slot_id == 0 || !xhci->devs[slot_id]) ++ if (slot_id == 0 || !dev) + return; + +- dev = xhci->devs[slot_id]; +- +- xhci->dcbaa->dev_context_ptrs[slot_id] = 0; +- if (!dev) +- return; ++ /* If device ctx array still points to _this_ device, clear it */ ++ if (dev->out_ctx && ++ xhci->dcbaa->dev_context_ptrs[slot_id] == cpu_to_le64(dev->out_ctx->dma)) ++ xhci->dcbaa->dev_context_ptrs[slot_id] = 0; + + trace_xhci_free_virt_device(dev); + +@@ -920,8 +919,9 @@ void xhci_free_virt_device(struct xhci_h + dev->udev->slot_id = 0; + if (dev->rhub_port && dev->rhub_port->slot_id == slot_id) + dev->rhub_port->slot_id = 0; +- kfree(xhci->devs[slot_id]); +- xhci->devs[slot_id] = NULL; ++ if (xhci->devs[slot_id] == dev) ++ xhci->devs[slot_id] = NULL; ++ kfree(dev); + } + + /* +@@ -962,7 +962,7 @@ static void xhci_free_virt_devices_depth + out: + /* we are now at a leaf device */ + xhci_debugfs_remove_slot(xhci, slot_id); +- xhci_free_virt_device(xhci, slot_id); ++ xhci_free_virt_device(xhci, vdev, slot_id); + } + + int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1592,7 +1592,8 @@ static void xhci_handle_cmd_enable_slot( + command->slot_id = 0; + } + +-static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id) ++static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id, ++ u32 cmd_comp_code) + { + struct xhci_virt_device *virt_dev; + struct xhci_slot_ctx *slot_ctx; +@@ -1607,6 +1608,10 @@ static void xhci_handle_cmd_disable_slot + if (xhci->quirks & XHCI_EP_LIMIT_QUIRK) + /* Delete default control endpoint resources */ + xhci_free_device_endpoint_resources(xhci, virt_dev, true); ++ if (cmd_comp_code == COMP_SUCCESS) { ++ xhci->dcbaa->dev_context_ptrs[slot_id] = 0; ++ xhci->devs[slot_id] = NULL; ++ } + } + + static void xhci_handle_cmd_config_ep(struct xhci_hcd *xhci, int slot_id) +@@ -1856,7 +1861,7 @@ static void handle_cmd_completion(struct + xhci_handle_cmd_enable_slot(slot_id, cmd, cmd_comp_code); + break; + case TRB_DISABLE_SLOT: +- xhci_handle_cmd_disable_slot(xhci, slot_id); ++ xhci_handle_cmd_disable_slot(xhci, slot_id, cmd_comp_code); + break; + case TRB_CONFIG_EP: + if (!cmd->completion) +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3932,8 +3932,7 @@ static int xhci_discover_or_reset_device + * Obtaining a new device slot to inform the xHCI host that + * the USB device has been reset. + */ +- ret = xhci_disable_slot(xhci, udev->slot_id); +- xhci_free_virt_device(xhci, udev->slot_id); ++ ret = xhci_disable_and_free_slot(xhci, udev->slot_id); + if (!ret) { + ret = xhci_alloc_dev(hcd, udev); + if (ret == 1) +@@ -4090,7 +4089,7 @@ static void xhci_free_dev(struct usb_hcd + xhci_disable_slot(xhci, udev->slot_id); + + spin_lock_irqsave(&xhci->lock, flags); +- xhci_free_virt_device(xhci, udev->slot_id); ++ xhci_free_virt_device(xhci, virt_dev, udev->slot_id); + spin_unlock_irqrestore(&xhci->lock, flags); + + } +@@ -4139,6 +4138,16 @@ int xhci_disable_slot(struct xhci_hcd *x + return 0; + } + ++int xhci_disable_and_free_slot(struct xhci_hcd *xhci, u32 slot_id) ++{ ++ struct xhci_virt_device *vdev = xhci->devs[slot_id]; ++ int ret; ++ ++ ret = xhci_disable_slot(xhci, slot_id); ++ xhci_free_virt_device(xhci, vdev, slot_id); ++ return ret; ++} ++ + /* + * Checks if we have enough host controller resources for the default control + * endpoint. +@@ -4245,8 +4254,7 @@ int xhci_alloc_dev(struct usb_hcd *hcd, + return 1; + + disable_slot: +- xhci_disable_slot(xhci, udev->slot_id); +- xhci_free_virt_device(xhci, udev->slot_id); ++ xhci_disable_and_free_slot(xhci, udev->slot_id); + + return 0; + } +@@ -4382,8 +4390,7 @@ static int xhci_setup_device(struct usb_ + dev_warn(&udev->dev, "Device not responding to setup %s.\n", act); + + mutex_unlock(&xhci->mutex); +- ret = xhci_disable_slot(xhci, udev->slot_id); +- xhci_free_virt_device(xhci, udev->slot_id); ++ ret = xhci_disable_and_free_slot(xhci, udev->slot_id); + if (!ret) { + if (xhci_alloc_dev(hcd, udev) == 1) + xhci_setup_addressable_virt_dev(xhci, udev); +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1791,7 +1791,7 @@ void xhci_dbg_trace(struct xhci_hcd *xhc + /* xHCI memory management */ + void xhci_mem_cleanup(struct xhci_hcd *xhci); + int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags); +-void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id); ++void xhci_free_virt_device(struct xhci_hcd *xhci, struct xhci_virt_device *dev, int slot_id); + int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, struct usb_device *udev, gfp_t flags); + int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *udev); + void xhci_copy_ep0_dequeue_into_input_ctx(struct xhci_hcd *xhci, +@@ -1888,6 +1888,7 @@ void xhci_reset_bandwidth(struct usb_hcd + int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, + struct usb_tt *tt, gfp_t mem_flags); + int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); ++int xhci_disable_and_free_slot(struct xhci_hcd *xhci, u32 slot_id); + int xhci_ext_cap_init(struct xhci_hcd *xhci); + + int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); diff --git a/debian/patches/patchset-pf/steady/0075-usb-xhci-fix-host-not-responding-after-suspend-and-r.patch b/debian/patches/patchset-pf/steady/0075-usb-xhci-fix-host-not-responding-after-suspend-and-r.patch new file mode 100644 index 0000000..3ea055a --- /dev/null +++ b/debian/patches/patchset-pf/steady/0075-usb-xhci-fix-host-not-responding-after-suspend-and-r.patch @@ -0,0 +1,48 @@ +From af9d38028438d5893403b1bea8bd493186f8d2b7 Mon Sep 17 00:00:00 2001 +From: Niklas Neronin +Date: Tue, 19 Aug 2025 15:58:44 +0300 +Subject: usb: xhci: fix host not responding after suspend and resume + +Partially revert commit e1db856bd288 ("usb: xhci: remove '0' write to +write-1-to-clear register") because the patch cleared the Interrupt Pending +bit during interrupt enabling and disabling. The Interrupt Pending bit +should only be cleared when the driver has handled the interrupt. + +Ideally, all interrupts should be handled before disabling the interrupt; +consequently, no interrupt should be pending when enabling the interrupt. +For this reason, keep the debug message informing if an interrupt is still +pending when an interrupt is disabled. + +Because the Interrupt Pending bit is write-1-to-clear, writing '0' to it +ensures that the state does not change. + +Link: https://lore.kernel.org/linux-usb/20250818231103.672ec7ed@foxbook +Fixes: e1db856bd288 ("usb: xhci: remove '0' write to write-1-to-clear register") +Closes: https://bbs.archlinux.org/viewtopic.php?id=307641 +cc: stable@vger.kernel.org # 6.16+ +Signed-off-by: Niklas Neronin +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250819125844.2042452-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -309,6 +309,7 @@ int xhci_enable_interrupter(struct xhci_ + return -EINVAL; + + iman = readl(&ir->ir_set->iman); ++ iman &= ~IMAN_IP; + iman |= IMAN_IE; + writel(iman, &ir->ir_set->iman); + +@@ -325,6 +326,7 @@ int xhci_disable_interrupter(struct xhci + return -EINVAL; + + iman = readl(&ir->ir_set->iman); ++ iman &= ~IMAN_IP; + iman &= ~IMAN_IE; + writel(iman, &ir->ir_set->iman); + diff --git a/debian/patches/patchset-pf/steady/0076-NFS-Fix-a-race-when-updating-an-existing-write.patch b/debian/patches/patchset-pf/steady/0076-NFS-Fix-a-race-when-updating-an-existing-write.patch new file mode 100644 index 0000000..ec0942c --- /dev/null +++ b/debian/patches/patchset-pf/steady/0076-NFS-Fix-a-race-when-updating-an-existing-write.patch @@ -0,0 +1,128 @@ +From 89a721716c46752ff3a1e6b4005130aeb22c107e Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 16 Aug 2025 07:25:20 -0700 +Subject: NFS: Fix a race when updating an existing write + +After nfs_lock_and_join_requests() tests for whether the request is +still attached to the mapping, nothing prevents a call to +nfs_inode_remove_request() from succeeding until we actually lock the +page group. +The reason is that whoever called nfs_inode_remove_request() doesn't +necessarily have a lock on the page group head. + +So in order to avoid races, let's take the page group lock earlier in +nfs_lock_and_join_requests(), and hold it across the removal of the +request in nfs_inode_remove_request(). + +Reported-by: Jeff Layton +Tested-by: Joe Quanaim +Tested-by: Andrew Steffen +Reviewed-by: Jeff Layton +Fixes: bd37d6fce184 ("NFSv4: Convert nfs_lock_and_join_requests() to use nfs_page_find_head_request()") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +--- + fs/nfs/pagelist.c | 9 +++++---- + fs/nfs/write.c | 29 ++++++++++------------------- + include/linux/nfs_page.h | 1 + + 3 files changed, 16 insertions(+), 23 deletions(-) + +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -253,13 +253,14 @@ nfs_page_group_unlock(struct nfs_page *r + nfs_page_clear_headlock(req); + } + +-/* +- * nfs_page_group_sync_on_bit_locked ++/** ++ * nfs_page_group_sync_on_bit_locked - Test if all requests have @bit set ++ * @req: request in page group ++ * @bit: PG_* bit that is used to sync page group + * + * must be called with page group lock held + */ +-static bool +-nfs_page_group_sync_on_bit_locked(struct nfs_page *req, unsigned int bit) ++bool nfs_page_group_sync_on_bit_locked(struct nfs_page *req, unsigned int bit) + { + struct nfs_page *head = req->wb_head; + struct nfs_page *tmp; +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -153,20 +153,10 @@ nfs_page_set_inode_ref(struct nfs_page * + } + } + +-static int +-nfs_cancel_remove_inode(struct nfs_page *req, struct inode *inode) ++static void nfs_cancel_remove_inode(struct nfs_page *req, struct inode *inode) + { +- int ret; +- +- if (!test_bit(PG_REMOVE, &req->wb_flags)) +- return 0; +- ret = nfs_page_group_lock(req); +- if (ret) +- return ret; + if (test_and_clear_bit(PG_REMOVE, &req->wb_flags)) + nfs_page_set_inode_ref(req, inode); +- nfs_page_group_unlock(req); +- return 0; + } + + /** +@@ -585,19 +575,18 @@ retry: + } + } + ++ ret = nfs_page_group_lock(head); ++ if (ret < 0) ++ goto out_unlock; ++ + /* Ensure that nobody removed the request before we locked it */ + if (head != folio->private) { ++ nfs_page_group_unlock(head); + nfs_unlock_and_release_request(head); + goto retry; + } + +- ret = nfs_cancel_remove_inode(head, inode); +- if (ret < 0) +- goto out_unlock; +- +- ret = nfs_page_group_lock(head); +- if (ret < 0) +- goto out_unlock; ++ nfs_cancel_remove_inode(head, inode); + + /* lock each request in the page group */ + for (subreq = head->wb_this_page; +@@ -786,7 +775,8 @@ static void nfs_inode_remove_request(str + { + struct nfs_inode *nfsi = NFS_I(nfs_page_to_inode(req)); + +- if (nfs_page_group_sync_on_bit(req, PG_REMOVE)) { ++ nfs_page_group_lock(req); ++ if (nfs_page_group_sync_on_bit_locked(req, PG_REMOVE)) { + struct folio *folio = nfs_page_to_folio(req->wb_head); + struct address_space *mapping = folio->mapping; + +@@ -798,6 +788,7 @@ static void nfs_inode_remove_request(str + } + spin_unlock(&mapping->i_private_lock); + } ++ nfs_page_group_unlock(req); + + if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags)) { + atomic_long_dec(&nfsi->nrequests); +--- a/include/linux/nfs_page.h ++++ b/include/linux/nfs_page.h +@@ -160,6 +160,7 @@ extern void nfs_join_page_group(struct n + extern int nfs_page_group_lock(struct nfs_page *); + extern void nfs_page_group_unlock(struct nfs_page *); + extern bool nfs_page_group_sync_on_bit(struct nfs_page *, unsigned int); ++extern bool nfs_page_group_sync_on_bit_locked(struct nfs_page *, unsigned int); + extern int nfs_page_set_headlock(struct nfs_page *req); + extern void nfs_page_clear_headlock(struct nfs_page *req); + extern bool nfs_async_iocounter_wait(struct rpc_task *, struct nfs_lock_context *); diff --git a/debian/patches/patchset-pf/steady/0077-kho-init-new_physxa-phys_bits-to-fix-lockdep.patch b/debian/patches/patchset-pf/steady/0077-kho-init-new_physxa-phys_bits-to-fix-lockdep.patch new file mode 100644 index 0000000..4fbeaac --- /dev/null +++ b/debian/patches/patchset-pf/steady/0077-kho-init-new_physxa-phys_bits-to-fix-lockdep.patch @@ -0,0 +1,102 @@ +From cb937c419cee16eb53a09e3c8cc16b675db0214f Mon Sep 17 00:00:00 2001 +From: Pasha Tatashin +Date: Fri, 8 Aug 2025 20:18:02 +0000 +Subject: kho: init new_physxa->phys_bits to fix lockdep + +Patch series "Several KHO Hotfixes". + +Three unrelated fixes for Kexec Handover. + + +This patch (of 3): + +Lockdep shows the following warning: + +INFO: trying to register non-static key. The code is fine but needs +lockdep annotation, or maybe you didn't initialize this object before use? +turning off the locking correctness validator. + +[] dump_stack_lvl+0x66/0xa0 +[] assign_lock_key+0x10c/0x120 +[] register_lock_class+0xf4/0x2f0 +[] __lock_acquire+0x7f/0x2c40 +[] ? __pfx_hlock_conflict+0x10/0x10 +[] ? native_flush_tlb_global+0x8e/0xa0 +[] ? __flush_tlb_all+0x4e/0xa0 +[] ? __kernel_map_pages+0x112/0x140 +[] ? xa_load_or_alloc+0x67/0xe0 +[] lock_acquire+0xe6/0x280 +[] ? xa_load_or_alloc+0x67/0xe0 +[] _raw_spin_lock+0x30/0x40 +[] ? xa_load_or_alloc+0x67/0xe0 +[] xa_load_or_alloc+0x67/0xe0 +[] kho_preserve_folio+0x90/0x100 +[] __kho_finalize+0xcf/0x400 +[] kho_finalize+0x34/0x70 + +This is becase xa has its own lock, that is not initialized in +xa_load_or_alloc. + +Modifiy __kho_preserve_order(), to properly call +xa_init(&new_physxa->phys_bits); + +Link: https://lkml.kernel.org/r/20250808201804.772010-2-pasha.tatashin@soleen.com +Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") +Signed-off-by: Pasha Tatashin +Acked-by: Mike Rapoport (Microsoft) +Cc: Alexander Graf +Cc: Arnd Bergmann +Cc: Baoquan He +Cc: Changyuan Lyu +Cc: Coiby Xu +Cc: Dave Vasilevsky +Cc: Eric Biggers +Cc: Kees Cook +Cc: Pratyush Yadav +Cc: +Signed-off-by: Andrew Morton +--- + kernel/kexec_handover.c | 28 ++++++++++++++++++++++++---- + 1 file changed, 24 insertions(+), 4 deletions(-) + +--- a/kernel/kexec_handover.c ++++ b/kernel/kexec_handover.c +@@ -144,14 +144,34 @@ static int __kho_preserve_order(struct k + unsigned int order) + { + struct kho_mem_phys_bits *bits; +- struct kho_mem_phys *physxa; ++ struct kho_mem_phys *physxa, *new_physxa; + const unsigned long pfn_high = pfn >> order; + + might_sleep(); + +- physxa = xa_load_or_alloc(&track->orders, order, sizeof(*physxa)); +- if (IS_ERR(physxa)) +- return PTR_ERR(physxa); ++ physxa = xa_load(&track->orders, order); ++ if (!physxa) { ++ int err; ++ ++ new_physxa = kzalloc(sizeof(*physxa), GFP_KERNEL); ++ if (!new_physxa) ++ return -ENOMEM; ++ ++ xa_init(&new_physxa->phys_bits); ++ physxa = xa_cmpxchg(&track->orders, order, NULL, new_physxa, ++ GFP_KERNEL); ++ ++ err = xa_err(physxa); ++ if (err || physxa) { ++ xa_destroy(&new_physxa->phys_bits); ++ kfree(new_physxa); ++ ++ if (err) ++ return err; ++ } else { ++ physxa = new_physxa; ++ } ++ } + + bits = xa_load_or_alloc(&physxa->phys_bits, pfn_high / PRESERVE_BITS, + sizeof(*bits)); diff --git a/debian/patches/patchset-pf/steady/0078-kho-mm-don-t-allow-deferred-struct-page-with-KHO.patch b/debian/patches/patchset-pf/steady/0078-kho-mm-don-t-allow-deferred-struct-page-with-KHO.patch new file mode 100644 index 0000000..48c61ba --- /dev/null +++ b/debian/patches/patchset-pf/steady/0078-kho-mm-don-t-allow-deferred-struct-page-with-KHO.patch @@ -0,0 +1,44 @@ +From 8f64c65c577701d4f11d4aa6b487126d52a471c5 Mon Sep 17 00:00:00 2001 +From: Pasha Tatashin +Date: Fri, 8 Aug 2025 20:18:03 +0000 +Subject: kho: mm: don't allow deferred struct page with KHO + +KHO uses struct pages for the preserved memory early in boot, however, +with deferred struct page initialization, only a small portion of memory +has properly initialized struct pages. + +This problem was detected where vmemmap is poisoned, and illegal flag +combinations are detected. + +Don't allow them to be enabled together, and later we will have to teach +KHO to work properly with deferred struct page init kernel feature. + +Link: https://lkml.kernel.org/r/20250808201804.772010-3-pasha.tatashin@soleen.com +Fixes: 4e1d010e3bda ("kexec: add config option for KHO") +Signed-off-by: Pasha Tatashin +Acked-by: Mike Rapoport (Microsoft) +Acked-by: Pratyush Yadav +Cc: Alexander Graf +Cc: Arnd Bergmann +Cc: Baoquan He +Cc: Changyuan Lyu +Cc: Coiby Xu +Cc: Dave Vasilevsky +Cc: Eric Biggers +Cc: Kees Cook +Cc: +Signed-off-by: Andrew Morton +--- + kernel/Kconfig.kexec | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/Kconfig.kexec ++++ b/kernel/Kconfig.kexec +@@ -97,6 +97,7 @@ config KEXEC_JUMP + config KEXEC_HANDOVER + bool "kexec handover" + depends on ARCH_SUPPORTS_KEXEC_HANDOVER && ARCH_SUPPORTS_KEXEC_FILE ++ depends on !DEFERRED_STRUCT_PAGE_INIT + select MEMBLOCK_KHO_SCRATCH + select KEXEC_FILE + select DEBUG_FS diff --git a/debian/patches/patchset-pf/steady/0079-kho-warn-if-KHO-is-disabled-due-to-an-error.patch b/debian/patches/patchset-pf/steady/0079-kho-warn-if-KHO-is-disabled-due-to-an-error.patch new file mode 100644 index 0000000..f22a3a5 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0079-kho-warn-if-KHO-is-disabled-due-to-an-error.patch @@ -0,0 +1,39 @@ +From b784ab2867996b84098abc798052aa503d981745 Mon Sep 17 00:00:00 2001 +From: Pasha Tatashin +Date: Fri, 8 Aug 2025 20:18:04 +0000 +Subject: kho: warn if KHO is disabled due to an error + +During boot scratch area is allocated based on command line parameters or +auto calculated. However, scratch area may fail to allocate, and in that +case KHO is disabled. Currently, no warning is printed that KHO is +disabled, which makes it confusing for the end user to figure out why KHO +is not available. Add the missing warning message. + +Link: https://lkml.kernel.org/r/20250808201804.772010-4-pasha.tatashin@soleen.com +Signed-off-by: Pasha Tatashin +Acked-by: Mike Rapoport (Microsoft) +Acked-by: Pratyush Yadav +Cc: Alexander Graf +Cc: Arnd Bergmann +Cc: Baoquan He +Cc: Changyuan Lyu +Cc: Coiby Xu +Cc: Dave Vasilevsky +Cc: Eric Biggers +Cc: Kees Cook +Cc: +Signed-off-by: Andrew Morton +--- + kernel/kexec_handover.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/kexec_handover.c ++++ b/kernel/kexec_handover.c +@@ -564,6 +564,7 @@ err_free_scratch_areas: + err_free_scratch_desc: + memblock_free(kho_scratch, kho_scratch_cnt * sizeof(*kho_scratch)); + err_disable_kho: ++ pr_warn("Failed to reserve scratch area, disabling kexec handover\n"); + kho_enable = false; + } + diff --git a/debian/patches/patchset-pf/steady/0080-squashfs-fix-memory-leak-in-squashfs_fill_super.patch b/debian/patches/patchset-pf/steady/0080-squashfs-fix-memory-leak-in-squashfs_fill_super.patch new file mode 100644 index 0000000..f7c47d2 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0080-squashfs-fix-memory-leak-in-squashfs_fill_super.patch @@ -0,0 +1,55 @@ +From ef787512b2a3a79de6aac63c9b715cd8791594e5 Mon Sep 17 00:00:00 2001 +From: Phillip Lougher +Date: Mon, 11 Aug 2025 23:37:40 +0100 +Subject: squashfs: fix memory leak in squashfs_fill_super + +If sb_min_blocksize returns 0, squashfs_fill_super exits without freeing +allocated memory (sb->s_fs_info). + +Fix this by moving the call to sb_min_blocksize to before memory is +allocated. + +Link: https://lkml.kernel.org/r/20250811223740.110392-1-phillip@squashfs.org.uk +Fixes: 734aa85390ea ("Squashfs: check return result of sb_min_blocksize") +Signed-off-by: Phillip Lougher +Reported-by: Scott GUO +Closes: https://lore.kernel.org/all/20250811061921.3807353-1-scott_gzh@163.com +Cc: +Signed-off-by: Andrew Morton +--- + fs/squashfs/super.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/fs/squashfs/super.c ++++ b/fs/squashfs/super.c +@@ -187,10 +187,15 @@ static int squashfs_fill_super(struct su + unsigned short flags; + unsigned int fragments; + u64 lookup_table_start, xattr_id_table_start, next_table; +- int err; ++ int err, devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); + + TRACE("Entered squashfs_fill_superblock\n"); + ++ if (!devblksize) { ++ errorf(fc, "squashfs: unable to set blocksize\n"); ++ return -EINVAL; ++ } ++ + sb->s_fs_info = kzalloc(sizeof(*msblk), GFP_KERNEL); + if (sb->s_fs_info == NULL) { + ERROR("Failed to allocate squashfs_sb_info\n"); +@@ -201,12 +206,7 @@ static int squashfs_fill_super(struct su + + msblk->panic_on_errors = (opts->errors == Opt_errors_panic); + +- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); +- if (!msblk->devblksize) { +- errorf(fc, "squashfs: unable to set blocksize\n"); +- return -EINVAL; +- } +- ++ msblk->devblksize = devblksize; + msblk->devblksize_log2 = ffz(~msblk->devblksize); + + mutex_init(&msblk->meta_index_mutex); diff --git a/debian/patches/patchset-pf/steady/0081-mm-debug_vm_pgtable-clear-page-table-entries-at-dest.patch b/debian/patches/patchset-pf/steady/0081-mm-debug_vm_pgtable-clear-page-table-entries-at-dest.patch new file mode 100644 index 0000000..d32a2e6 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0081-mm-debug_vm_pgtable-clear-page-table-entries-at-dest.patch @@ -0,0 +1,140 @@ +From 94ccad3e78c9f1a90526b8ca4301d5e5c2df0f88 Mon Sep 17 00:00:00 2001 +From: "Herton R. Krzesinski" +Date: Thu, 31 Jul 2025 18:40:51 -0300 +Subject: mm/debug_vm_pgtable: clear page table entries at destroy_args() + +The mm/debug_vm_pagetable test allocates manually page table entries for +the tests it runs, using also its manually allocated mm_struct. That in +itself is ok, but when it exits, at destroy_args() it fails to clear those +entries with the *_clear functions. + +The problem is that leaves stale entries. If another process allocates an +mm_struct with a pgd at the same address, it may end up running into the +stale entry. This is happening in practice on a debug kernel with +CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra +debugging I added (it prints a warning trace if pgtables_bytes goes +negative, in addition to the warning at check_mm() function): + +[ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 +[ 2.539366] kmem_cache info +[ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 +[ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e +(...) +[ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 +[ 2.552816] Modules linked in: +[ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY +[ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries +[ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 +[ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) +[ 2.552899] MSR: 800000000282b033 CR: 24002822 XER: 0000000a +[ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 +[ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 +[ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff +[ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 +[ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb +[ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 +[ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 +[ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 +[ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 +[ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 +[ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 +[ 2.553199] Call Trace: +[ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) +[ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 +[ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 +[ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 +[ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 +[ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 +[ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 +[ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 +[ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 +[ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 +[ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec +(...) +[ 2.558892] ---[ end trace 0000000000000000 ]--- +[ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 +[ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144 + +Here the modprobe process ended up with an allocated mm_struct from the +mm_struct slab that was used before by the debug_vm_pgtable test. That is +not a problem, since the mm_struct is initialized again etc., however, if +it ends up using the same pgd table, it bumps into the old stale entry +when clearing/freeing the page table entries, so it tries to free an entry +already gone (that one which was allocated by the debug_vm_pgtable test), +which also explains the negative pgtables_bytes since it's accounting for +not allocated entries in the current process. + +As far as I looked pgd_{alloc,free} etc. does not clear entries, and +clearing of the entries is explicitly done in the free_pgtables-> +free_pgd_range->free_p4d_range->free_pud_range->free_pmd_range-> +free_pte_range path. However, the debug_vm_pgtable test does not call +free_pgtables, since it allocates mm_struct and entries manually for its +test and eg. not goes through page faults. So it also should clear +manually the entries before exit at destroy_args(). + +This problem was noticed on a reboot X number of times test being done on +a powerpc host, with a debug kernel with CONFIG_DEBUG_VM_PGTABLE enabled. +Depends on the system, but on a 100 times reboot loop the problem could +manifest once or twice, if a process ends up getting the right mm->pgd +entry with the stale entries used by mm/debug_vm_pagetable. After using +this patch, I couldn't reproduce/experience the problems anymore. I was +able to reproduce the problem as well on latest upstream kernel (6.16). + +I also modified destroy_args() to use mmput() instead of mmdrop(), there +is no reason to hold mm_users reference and not release the mm_struct +entirely, and in the output above with my debugging prints I already had +patched it to use mmput, it did not fix the problem, but helped in the +debugging as well. + +Link: https://lkml.kernel.org/r/20250731214051.4115182-1-herton@redhat.com +Fixes: 3c9b84f044a9 ("mm/debug_vm_pgtable: introduce struct pgtable_debug_args") +Signed-off-by: Herton R. Krzesinski +Cc: Anshuman Khandual +Cc: Christophe Leroy +Cc: Gavin Shan +Cc: Gerald Schaefer +Cc: +Signed-off-by: Andrew Morton +--- + mm/debug_vm_pgtable.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/mm/debug_vm_pgtable.c ++++ b/mm/debug_vm_pgtable.c +@@ -1041,29 +1041,34 @@ static void __init destroy_args(struct p + + /* Free page table entries */ + if (args->start_ptep) { ++ pmd_clear(args->pmdp); + pte_free(args->mm, args->start_ptep); + mm_dec_nr_ptes(args->mm); + } + + if (args->start_pmdp) { ++ pud_clear(args->pudp); + pmd_free(args->mm, args->start_pmdp); + mm_dec_nr_pmds(args->mm); + } + + if (args->start_pudp) { ++ p4d_clear(args->p4dp); + pud_free(args->mm, args->start_pudp); + mm_dec_nr_puds(args->mm); + } + +- if (args->start_p4dp) ++ if (args->start_p4dp) { ++ pgd_clear(args->pgdp); + p4d_free(args->mm, args->start_p4dp); ++ } + + /* Free vma and mm struct */ + if (args->vma) + vm_area_free(args->vma); + + if (args->mm) +- mmdrop(args->mm); ++ mmput(args->mm); + } + + static struct page * __init diff --git a/debian/patches/patchset-pf/steady/0082-mm-damon-core-fix-commit_ops_filters-by-using-correc.patch b/debian/patches/patchset-pf/steady/0082-mm-damon-core-fix-commit_ops_filters-by-using-correc.patch new file mode 100644 index 0000000..4fbf319 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0082-mm-damon-core-fix-commit_ops_filters-by-using-correc.patch @@ -0,0 +1,52 @@ +From 8e0fc5bd3c988e47827d000f51ffa73512a4a5b6 Mon Sep 17 00:00:00 2001 +From: Sang-Heon Jeon +Date: Sun, 10 Aug 2025 21:42:01 +0900 +Subject: mm/damon/core: fix commit_ops_filters by using correct nth function + +damos_commit_ops_filters() incorrectly uses damos_nth_filter() which +iterates core_filters. As a result, performing a commit unintentionally +corrupts ops_filters. + +Add damos_nth_ops_filter() which iterates ops_filters. Use this function +to fix issues caused by wrong iteration. + +Link: https://lkml.kernel.org/r/20250810124201.15743-1-ekffu200098@gmail.com +Fixes: 3607cc590f18 ("mm/damon/core: support committing ops_filters") # 6.15.x +Signed-off-by: Sang-Heon Jeon +Reviewed-by: SeongJae Park +Cc: +Signed-off-by: Andrew Morton +--- + mm/damon/core.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -843,6 +843,18 @@ static struct damos_filter *damos_nth_fi + return NULL; + } + ++static struct damos_filter *damos_nth_ops_filter(int n, struct damos *s) ++{ ++ struct damos_filter *filter; ++ int i = 0; ++ ++ damos_for_each_ops_filter(filter, s) { ++ if (i++ == n) ++ return filter; ++ } ++ return NULL; ++} ++ + static void damos_commit_filter_arg( + struct damos_filter *dst, struct damos_filter *src) + { +@@ -906,7 +918,7 @@ static int damos_commit_ops_filters(stru + int i = 0, j = 0; + + damos_for_each_ops_filter_safe(dst_filter, next, dst) { +- src_filter = damos_nth_filter(i++, src); ++ src_filter = damos_nth_ops_filter(i++, src); + if (src_filter) + damos_commit_filter(dst_filter, src_filter); + else diff --git a/debian/patches/patchset-pf/steady/0083-iov_iter-iterate_folioq-fix-handling-of-offset-folio.patch b/debian/patches/patchset-pf/steady/0083-iov_iter-iterate_folioq-fix-handling-of-offset-folio.patch new file mode 100644 index 0000000..0c0027a --- /dev/null +++ b/debian/patches/patchset-pf/steady/0083-iov_iter-iterate_folioq-fix-handling-of-offset-folio.patch @@ -0,0 +1,77 @@ +From 0623d1f6690209880885deae614e8368488598c2 Mon Sep 17 00:00:00 2001 +From: Dominique Martinet +Date: Wed, 13 Aug 2025 15:04:55 +0900 +Subject: iov_iter: iterate_folioq: fix handling of offset >= folio size + +It's apparently possible to get an iov advanced all the way up to the end +of the current page we're looking at, e.g. + +(gdb) p *iter +$24 = {iter_type = 4 '\004', nofault = false, data_source = false, iov_offset = 4096, {__ubuf_iovec = { + iov_base = 0xffff88800f5bc000, iov_len = 655}, {{__iov = 0xffff88800f5bc000, kvec = 0xffff88800f5bc000, + bvec = 0xffff88800f5bc000, folioq = 0xffff88800f5bc000, xarray = 0xffff88800f5bc000, + ubuf = 0xffff88800f5bc000}, count = 655}}, {nr_segs = 2, folioq_slot = 2 '\002', xarray_start = 2}} + +Where iov_offset is 4k with 4k-sized folios + +This should have been fine because we're only in the 2nd slot and there's +another one after this, but iterate_folioq should not try to map a folio +that skips the whole size, and more importantly part here does not end up +zero (because 'PAGE_SIZE - skip % PAGE_SIZE' ends up PAGE_SIZE and not +zero..), so skip forward to the "advance to next folio" code + +Link: https://lkml.kernel.org/r/20250813-iot_iter_folio-v3-0-a0ffad2b665a@codewreck.org +Link: https://lkml.kernel.org/r/20250813-iot_iter_folio-v3-1-a0ffad2b665a@codewreck.org +Signed-off-by: Dominique Martinet +Fixes: db0aa2e9566f ("mm: Define struct folio_queue and ITER_FOLIOQ to handle a sequence of folios") +Reported-by: Maximilian Bosch +Reported-by: Ryan Lahfa +Reported-by: Christian Theune +Reported-by: Arnout Engelen +Link: https://lkml.kernel.org/r/D4LHHUNLG79Y.12PI0X6BEHRHW@mbosch.me/ +Acked-by: David Howells +Cc: Al Viro +Cc: Christian Brauner +Cc: Matthew Wilcox (Oracle) +Cc: [6.12+] +Signed-off-by: Andrew Morton +--- + include/linux/iov_iter.h | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +--- a/include/linux/iov_iter.h ++++ b/include/linux/iov_iter.h +@@ -160,7 +160,7 @@ size_t iterate_folioq(struct iov_iter *i + + do { + struct folio *folio = folioq_folio(folioq, slot); +- size_t part, remain, consumed; ++ size_t part, remain = 0, consumed; + size_t fsize; + void *base; + +@@ -168,14 +168,16 @@ size_t iterate_folioq(struct iov_iter *i + break; + + fsize = folioq_folio_size(folioq, slot); +- base = kmap_local_folio(folio, skip); +- part = umin(len, PAGE_SIZE - skip % PAGE_SIZE); +- remain = step(base, progress, part, priv, priv2); +- kunmap_local(base); +- consumed = part - remain; +- len -= consumed; +- progress += consumed; +- skip += consumed; ++ if (skip < fsize) { ++ base = kmap_local_folio(folio, skip); ++ part = umin(len, PAGE_SIZE - skip % PAGE_SIZE); ++ remain = step(base, progress, part, priv, priv2); ++ kunmap_local(base); ++ consumed = part - remain; ++ len -= consumed; ++ progress += consumed; ++ skip += consumed; ++ } + if (skip >= fsize) { + skip = 0; + slot++; diff --git a/debian/patches/patchset-pf/steady/0084-mm-memory-failure-fix-infinite-UCE-for-VM_PFNMAP-pfn.patch b/debian/patches/patchset-pf/steady/0084-mm-memory-failure-fix-infinite-UCE-for-VM_PFNMAP-pfn.patch new file mode 100644 index 0000000..bb49591 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0084-mm-memory-failure-fix-infinite-UCE-for-VM_PFNMAP-pfn.patch @@ -0,0 +1,57 @@ +From 786e39b5e75b7d766b7930519d504a90eaf887da Mon Sep 17 00:00:00 2001 +From: Jinjiang Tu +Date: Fri, 15 Aug 2025 15:32:09 +0800 +Subject: mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn + +When memory_failure() is called for a already hwpoisoned pfn, +kill_accessing_process() will be called to kill current task. However, if +the vma of the accessing vaddr is VM_PFNMAP, walk_page_range() will skip +the vma in walk_page_test() and return 0. + +Before commit aaf99ac2ceb7 ("mm/hwpoison: do not send SIGBUS to processes +with recovered clean pages"), kill_accessing_process() will return EFAULT. +For x86, the current task will be killed in kill_me_maybe(). + +However, after this commit, kill_accessing_process() simplies return 0, +that means UCE is handled properly, but it doesn't actually. In such +case, the user task will trigger UCE infinitely. + +To fix it, add .test_walk callback for hwpoison_walk_ops to scan all vmas. + +Link: https://lkml.kernel.org/r/20250815073209.1984582-1-tujinjiang@huawei.com +Fixes: aaf99ac2ceb7 ("mm/hwpoison: do not send SIGBUS to processes with recovered clean pages") +Signed-off-by: Jinjiang Tu +Acked-by: David Hildenbrand +Acked-by: Miaohe Lin +Reviewed-by: Jane Chu +Cc: Kefeng Wang +Cc: Naoya Horiguchi +Cc: Oscar Salvador +Cc: Shuai Xue +Cc: Zi Yan +Cc: +Signed-off-by: Andrew Morton +--- + mm/memory-failure.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -847,9 +847,17 @@ static int hwpoison_hugetlb_range(pte_t + #define hwpoison_hugetlb_range NULL + #endif + ++static int hwpoison_test_walk(unsigned long start, unsigned long end, ++ struct mm_walk *walk) ++{ ++ /* We also want to consider pages mapped into VM_PFNMAP. */ ++ return 0; ++} ++ + static const struct mm_walk_ops hwpoison_walk_ops = { + .pmd_entry = hwpoison_pte_range, + .hugetlb_entry = hwpoison_hugetlb_range, ++ .test_walk = hwpoison_test_walk, + .walk_lock = PGWALK_RDLOCK, + }; + diff --git a/debian/patches/patchset-pf/steady/0085-mm-damon-core-fix-damos_commit_filter-not-changing-a.patch b/debian/patches/patchset-pf/steady/0085-mm-damon-core-fix-damos_commit_filter-not-changing-a.patch new file mode 100644 index 0000000..0954584 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0085-mm-damon-core-fix-damos_commit_filter-not-changing-a.patch @@ -0,0 +1,32 @@ +From 40faa11c480476ef29d74f44c0126026b37d988d Mon Sep 17 00:00:00 2001 +From: Sang-Heon Jeon +Date: Sat, 16 Aug 2025 10:51:16 +0900 +Subject: mm/damon/core: fix damos_commit_filter not changing allow + +Current damos_commit_filter() does not persist the `allow' value of the +filter. As a result, changing the `allow' value of a filter and +committing doesn't change the `allow' value. + +Add the missing `allow' value update, so committing the filter +persistently changes the `allow' value well. + +Link: https://lkml.kernel.org/r/20250816015116.194589-1-ekffu200098@gmail.com +Fixes: fe6d7fdd6249 ("mm/damon/core: add damos_filter->allow field") +Signed-off-by: Sang-Heon Jeon +Reviewed-by: SeongJae Park +Cc: [6.14.x] +Signed-off-by: Andrew Morton +--- + mm/damon/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -881,6 +881,7 @@ static void damos_commit_filter( + { + dst->type = src->type; + dst->matching = src->matching; ++ dst->allow = src->allow; + damos_commit_filter_arg(dst, src); + } + diff --git a/debian/patches/patchset-pf/steady/0086-mm-mremap-fix-WARN-with-uffd-that-has-remap-events-d.patch b/debian/patches/patchset-pf/steady/0086-mm-mremap-fix-WARN-with-uffd-that-has-remap-events-d.patch new file mode 100644 index 0000000..d86fbf3 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0086-mm-mremap-fix-WARN-with-uffd-that-has-remap-events-d.patch @@ -0,0 +1,157 @@ +From 148516b367dd591d31a2b98ad913417bc1b9c865 Mon Sep 17 00:00:00 2001 +From: David Hildenbrand +Date: Mon, 18 Aug 2025 19:53:58 +0200 +Subject: mm/mremap: fix WARN with uffd that has remap events disabled + +Registering userfaultd on a VMA that spans at least one PMD and then +mremap()'ing that VMA can trigger a WARN when recovering from a failed +page table move due to a page table allocation error. + +The code ends up doing the right thing (recurse, avoiding moving actual +page tables), but triggering that WARN is unpleasant: + +WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline] +WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline] +WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852 +Modules linked in: +CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 +RIP: 0010:move_normal_pmd mm/mremap.c:357 [inline] +RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline] +RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852 +Code: ... +RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293 +RAX: 0000000000000000 RBX: 0000000032930007 RCX: ffffffff820c6645 +RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007 +RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000 +R10: 0000000032930007 R11: 0000000000000000 R12: 0000000000000000 +R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000 +FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0 +Call Trace: + + copy_vma_and_data+0x468/0x790 mm/mremap.c:1215 + move_vma+0x548/0x1780 mm/mremap.c:1282 + mremap_to+0x1b7/0x450 mm/mremap.c:1406 + do_mremap+0xfad/0x1f80 mm/mremap.c:1921 + __do_sys_mremap+0x119/0x170 mm/mremap.c:1977 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7f00d0b8ebe9 +Code: ... +RSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 +RAX: ffffffffffffffda RBX: 00007f00d0db5fa0 RCX: 00007f00d0b8ebe9 +RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000 +RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000 +R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002 +R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005 + + +The underlying issue is that we recurse during the original page table +move, but not during the recovery move. + +Fix it by checking for both VMAs and performing the check before the +pmd_none() sanity check. + +Add a new helper where we perform+document that check for the PMD and PUD +level. + +Thanks to Harry for bisecting. + +Link: https://lkml.kernel.org/r/20250818175358.1184757-1-david@redhat.com +Fixes: 0cef0bb836e3 ("mm: clear uffd-wp PTE/PMD state on mremap()") +Signed-off-by: David Hildenbrand +Reported-by: syzbot+4d9a13f0797c46a29e42@syzkaller.appspotmail.com +Closes: https://lkml.kernel.org/r/689bb893.050a0220.7f033.013a.GAE@google.com +Tested-by: Harry Yoo +Cc: "Liam R. Howlett" +Cc: Lorenzo Stoakes +Cc: Vlastimil Babka +Cc: Jann Horn +Cc: Pedro Falcato +Cc: +Signed-off-by: Andrew Morton +--- + mm/mremap.c | 41 +++++++++++++++++++++++------------------ + 1 file changed, 23 insertions(+), 18 deletions(-) + +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -294,6 +294,25 @@ static inline bool arch_supports_page_ta + } + #endif + ++static inline bool uffd_supports_page_table_move(struct pagetable_move_control *pmc) ++{ ++ /* ++ * If we are moving a VMA that has uffd-wp registered but with ++ * remap events disabled (new VMA will not be registered with uffd), we ++ * need to ensure that the uffd-wp state is cleared from all pgtables. ++ * This means recursing into lower page tables in move_page_tables(). ++ * ++ * We might get called with VMAs reversed when recovering from a ++ * failed page table move. In that case, the ++ * "old"-but-actually-"originally new" VMA during recovery will not have ++ * a uffd context. Recursing into lower page tables during the original ++ * move but not during the recovery move will cause trouble, because we ++ * run into already-existing page tables. So check both VMAs. ++ */ ++ return !vma_has_uffd_without_event_remap(pmc->old) && ++ !vma_has_uffd_without_event_remap(pmc->new); ++} ++ + #ifdef CONFIG_HAVE_MOVE_PMD + static bool move_normal_pmd(struct pagetable_move_control *pmc, + pmd_t *old_pmd, pmd_t *new_pmd) +@@ -306,6 +325,8 @@ static bool move_normal_pmd(struct paget + + if (!arch_supports_page_table_move()) + return false; ++ if (!uffd_supports_page_table_move(pmc)) ++ return false; + /* + * The destination pmd shouldn't be established, free_pgtables() + * should have released it. +@@ -332,15 +353,6 @@ static bool move_normal_pmd(struct paget + if (WARN_ON_ONCE(!pmd_none(*new_pmd))) + return false; + +- /* If this pmd belongs to a uffd vma with remap events disabled, we need +- * to ensure that the uffd-wp state is cleared from all pgtables. This +- * means recursing into lower page tables in move_page_tables(), and we +- * can reuse the existing code if we simply treat the entry as "not +- * moved". +- */ +- if (vma_has_uffd_without_event_remap(vma)) +- return false; +- + /* + * We don't have to worry about the ordering of src and dst + * ptlocks because exclusive mmap_lock prevents deadlock. +@@ -389,6 +401,8 @@ static bool move_normal_pud(struct paget + + if (!arch_supports_page_table_move()) + return false; ++ if (!uffd_supports_page_table_move(pmc)) ++ return false; + /* + * The destination pud shouldn't be established, free_pgtables() + * should have released it. +@@ -396,15 +410,6 @@ static bool move_normal_pud(struct paget + if (WARN_ON_ONCE(!pud_none(*new_pud))) + return false; + +- /* If this pud belongs to a uffd vma with remap events disabled, we need +- * to ensure that the uffd-wp state is cleared from all pgtables. This +- * means recursing into lower page tables in move_page_tables(), and we +- * can reuse the existing code if we simply treat the entry as "not +- * moved". +- */ +- if (vma_has_uffd_without_event_remap(vma)) +- return false; +- + /* + * We don't have to worry about the ordering of src and dst + * ptlocks because exclusive mmap_lock prevents deadlock. diff --git a/debian/patches/patchset-pf/steady/0087-ALSA-hda-tas2781-Fix-wrong-reference-of-tasdevice_pr.patch b/debian/patches/patchset-pf/steady/0087-ALSA-hda-tas2781-Fix-wrong-reference-of-tasdevice_pr.patch new file mode 100644 index 0000000..96da226 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0087-ALSA-hda-tas2781-Fix-wrong-reference-of-tasdevice_pr.patch @@ -0,0 +1,31 @@ +From 33950693dc7b0306b42d8efffbe26bfa5caa478b Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 20 Aug 2025 07:19:01 +0200 +Subject: ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv + +During the conversion to unify the calibration data management, the +reference to tasdevice_priv was wrongly set to h->hda_priv instead of +h->priv. This resulted in memory corruption and crashes eventually. +Unfortunately it's a void pointer, hence the compiler couldn't know +that it's wrong. + +Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") +Link: https://bugzilla.suse.com/show_bug.cgi?id=1248270 +Cc: +Link: https://patch.msgid.link/20250820051902.4523-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +--- + sound/pci/hda/tas2781_hda_i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -287,7 +287,7 @@ static int tas2563_save_calibration(stru + efi_char16_t efi_name[TAS2563_CAL_VAR_NAME_MAX]; + unsigned long max_size = TAS2563_CAL_DATA_SIZE; + unsigned char var8[TAS2563_CAL_VAR_NAME_MAX]; +- struct tasdevice_priv *p = h->hda_priv; ++ struct tasdevice_priv *p = h->priv; + struct calidata *cd = &p->cali_data; + struct cali_reg *r = &cd->cali_reg_array; + unsigned int offset = 0; diff --git a/debian/patches/patchset-pf/steady/0088-tracing-Remove-unneeded-goto-out-logic.patch b/debian/patches/patchset-pf/steady/0088-tracing-Remove-unneeded-goto-out-logic.patch new file mode 100644 index 0000000..4fd4edb --- /dev/null +++ b/debian/patches/patchset-pf/steady/0088-tracing-Remove-unneeded-goto-out-logic.patch @@ -0,0 +1,142 @@ +From f7a227320aab53c99656f21d40481af89dfb8923 Mon Sep 17 00:00:00 2001 +From: Steven Rostedt +Date: Fri, 1 Aug 2025 16:37:23 -0400 +Subject: tracing: Remove unneeded goto out logic + +Several places in the trace.c file there's a goto out where the out is +simply a return. There's no reason to jump to the out label if it's not +doing any more logic but simply returning from the function. + +Replace the goto outs with a return and remove the out labels. + +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Link: https://lore.kernel.org/20250801203857.538726745@kernel.org +Signed-off-by: Steven Rostedt (Google) +--- + kernel/trace/trace.c | 38 +++++++++++++++----------------------- + 1 file changed, 15 insertions(+), 23 deletions(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1846,7 +1846,7 @@ int trace_get_user(struct trace_parser * + + ret = get_user(ch, ubuf++); + if (ret) +- goto out; ++ return ret; + + read++; + cnt--; +@@ -1860,7 +1860,7 @@ int trace_get_user(struct trace_parser * + while (cnt && isspace(ch)) { + ret = get_user(ch, ubuf++); + if (ret) +- goto out; ++ return ret; + read++; + cnt--; + } +@@ -1870,8 +1870,7 @@ int trace_get_user(struct trace_parser * + /* only spaces were written */ + if (isspace(ch) || !ch) { + *ppos += read; +- ret = read; +- goto out; ++ return read; + } + } + +@@ -1879,13 +1878,12 @@ int trace_get_user(struct trace_parser * + while (cnt && !isspace(ch) && ch) { + if (parser->idx < parser->size - 1) + parser->buffer[parser->idx++] = ch; +- else { +- ret = -EINVAL; +- goto out; +- } ++ else ++ return -EINVAL; ++ + ret = get_user(ch, ubuf++); + if (ret) +- goto out; ++ return ret; + read++; + cnt--; + } +@@ -1900,15 +1898,11 @@ int trace_get_user(struct trace_parser * + /* Make sure the parsed string always terminates with '\0'. */ + parser->buffer[parser->idx] = 0; + } else { +- ret = -EINVAL; +- goto out; ++ return -EINVAL; + } + + *ppos += read; +- ret = read; +- +-out: +- return ret; ++ return read; + } + + /* TODO add a seq_buf_to_buffer() */ +@@ -2410,10 +2404,10 @@ int __init register_tracer(struct tracer + mutex_unlock(&trace_types_lock); + + if (ret || !default_bootup_tracer) +- goto out_unlock; ++ return ret; + + if (strncmp(default_bootup_tracer, type->name, MAX_TRACER_SIZE)) +- goto out_unlock; ++ return 0; + + printk(KERN_INFO "Starting tracer '%s'\n", type->name); + /* Do we want this tracer to start on bootup? */ +@@ -2425,8 +2419,7 @@ int __init register_tracer(struct tracer + /* disable other selftests, since this will break it. */ + disable_tracing_selftest("running a tracer"); + +- out_unlock: +- return ret; ++ return 0; + } + + static void tracing_reset_cpu(struct array_buffer *buf, int cpu) +@@ -8954,12 +8947,12 @@ ftrace_trace_snapshot_callback(struct tr + out_reg: + ret = tracing_arm_snapshot(tr); + if (ret < 0) +- goto out; ++ return ret; + + ret = register_ftrace_function_probe(glob, tr, ops, count); + if (ret < 0) + tracing_disarm_snapshot(tr); +- out: ++ + return ret < 0 ? ret : 0; + } + +@@ -11057,7 +11050,7 @@ __init static int tracer_alloc_buffers(v + BUILD_BUG_ON(TRACE_ITER_LAST_BIT > TRACE_FLAGS_MAX_SIZE); + + if (!alloc_cpumask_var(&tracing_buffer_mask, GFP_KERNEL)) +- goto out; ++ return -ENOMEM; + + if (!alloc_cpumask_var(&global_trace.tracing_cpumask, GFP_KERNEL)) + goto out_free_buffer_mask; +@@ -11175,7 +11168,6 @@ out_free_cpumask: + free_cpumask_var(global_trace.tracing_cpumask); + out_free_buffer_mask: + free_cpumask_var(tracing_buffer_mask); +-out: + return ret; + } + diff --git a/debian/patches/patchset-pf/steady/0089-tracing-Limit-access-to-parser-buffer-when-trace_get.patch b/debian/patches/patchset-pf/steady/0089-tracing-Limit-access-to-parser-buffer-when-trace_get.patch new file mode 100644 index 0000000..2aff0b7 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0089-tracing-Limit-access-to-parser-buffer-when-trace_get.patch @@ -0,0 +1,133 @@ +From 04b512d5cc10cec9e13eb434ea8d16d899244e6e Mon Sep 17 00:00:00 2001 +From: Pu Lehui +Date: Wed, 13 Aug 2025 04:02:32 +0000 +Subject: tracing: Limit access to parser->buffer when trace_get_user failed + +When the length of the string written to set_ftrace_filter exceeds +FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: + +BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 +Read of size 1 at addr ffff0000d00bd5ba by task ash/165 + +CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty +Hardware name: linux,dummy-virt (DT) +Call trace: + show_stack+0x34/0x50 (C) + dump_stack_lvl+0xa0/0x158 + print_address_description.constprop.0+0x88/0x398 + print_report+0xb0/0x280 + kasan_report+0xa4/0xf0 + __asan_report_load1_noabort+0x20/0x30 + strsep+0x18c/0x1b0 + ftrace_process_regex.isra.0+0x100/0x2d8 + ftrace_regex_release+0x484/0x618 + __fput+0x364/0xa58 + ____fput+0x28/0x40 + task_work_run+0x154/0x278 + do_notify_resume+0x1f0/0x220 + el0_svc+0xec/0xf0 + el0t_64_sync_handler+0xa0/0xe8 + el0t_64_sync+0x1ac/0x1b0 + +The reason is that trace_get_user will fail when processing a string +longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. +Then an OOB access will be triggered in ftrace_regex_release-> +ftrace_process_regex->strsep->strpbrk. We can solve this problem by +limiting access to parser->buffer when trace_get_user failed. + +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/20250813040232.1344527-1-pulehui@huaweicloud.com +Fixes: 8c9af478c06b ("ftrace: Handle commands when closing set_ftrace_filter file") +Signed-off-by: Pu Lehui +Signed-off-by: Steven Rostedt (Google) +--- + kernel/trace/trace.c | 18 ++++++++++++------ + kernel/trace/trace.h | 8 +++++++- + 2 files changed, 19 insertions(+), 7 deletions(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1846,7 +1846,7 @@ int trace_get_user(struct trace_parser * + + ret = get_user(ch, ubuf++); + if (ret) +- return ret; ++ goto fail; + + read++; + cnt--; +@@ -1860,7 +1860,7 @@ int trace_get_user(struct trace_parser * + while (cnt && isspace(ch)) { + ret = get_user(ch, ubuf++); + if (ret) +- return ret; ++ goto fail; + read++; + cnt--; + } +@@ -1878,12 +1878,14 @@ int trace_get_user(struct trace_parser * + while (cnt && !isspace(ch) && ch) { + if (parser->idx < parser->size - 1) + parser->buffer[parser->idx++] = ch; +- else +- return -EINVAL; ++ else { ++ ret = -EINVAL; ++ goto fail; ++ } + + ret = get_user(ch, ubuf++); + if (ret) +- return ret; ++ goto fail; + read++; + cnt--; + } +@@ -1898,11 +1900,15 @@ int trace_get_user(struct trace_parser * + /* Make sure the parsed string always terminates with '\0'. */ + parser->buffer[parser->idx] = 0; + } else { +- return -EINVAL; ++ ret = -EINVAL; ++ goto fail; + } + + *ppos += read; + return read; ++fail: ++ trace_parser_fail(parser); ++ return ret; + } + + /* TODO add a seq_buf_to_buffer() */ +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -1292,6 +1292,7 @@ bool ftrace_event_is_function(struct tra + */ + struct trace_parser { + bool cont; ++ bool fail; + char *buffer; + unsigned idx; + unsigned size; +@@ -1299,7 +1300,7 @@ struct trace_parser { + + static inline bool trace_parser_loaded(struct trace_parser *parser) + { +- return (parser->idx != 0); ++ return !parser->fail && parser->idx != 0; + } + + static inline bool trace_parser_cont(struct trace_parser *parser) +@@ -1313,6 +1314,11 @@ static inline void trace_parser_clear(st + parser->idx = 0; + } + ++static inline void trace_parser_fail(struct trace_parser *parser) ++{ ++ parser->fail = true; ++} ++ + extern int trace_parser_get_init(struct trace_parser *parser, int size); + extern void trace_parser_put(struct trace_parser *parser); + extern int trace_get_user(struct trace_parser *parser, const char __user *ubuf, diff --git a/debian/patches/patchset-pf/steady/0090-ACPI-pfr_update-Fix-the-driver-update-version-check.patch b/debian/patches/patchset-pf/steady/0090-ACPI-pfr_update-Fix-the-driver-update-version-check.patch new file mode 100644 index 0000000..52d38e2 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0090-ACPI-pfr_update-Fix-the-driver-update-version-check.patch @@ -0,0 +1,44 @@ +From e127b3ec622c786e42ce3a05cf15bfc50f24adc3 Mon Sep 17 00:00:00 2001 +From: Chen Yu +Date: Tue, 22 Jul 2025 22:32:33 +0800 +Subject: ACPI: pfr_update: Fix the driver update version check + +The security-version-number check should be used rather +than the runtime version check for driver updates. + +Otherwise, the firmware update would fail when the update binary had +a lower runtime version number than the current one. + +Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver") +Cc: 5.17+ # 5.17+ +Reported-by: "Govindarajulu, Hariganesh" +Signed-off-by: Chen Yu +Link: https://patch.msgid.link/20250722143233.3970607-1-yu.c.chen@intel.com +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +--- + drivers/acpi/pfr_update.c | 2 +- + include/uapi/linux/pfrut.h | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/pfr_update.c ++++ b/drivers/acpi/pfr_update.c +@@ -310,7 +310,7 @@ static bool applicable_image(const void + if (type == PFRU_CODE_INJECT_TYPE) + return payload_hdr->rt_ver >= cap->code_rt_version; + +- return payload_hdr->rt_ver >= cap->drv_rt_version; ++ return payload_hdr->svn_ver >= cap->drv_svn; + } + + static void print_update_debug_info(struct pfru_updated_result *result, +--- a/include/uapi/linux/pfrut.h ++++ b/include/uapi/linux/pfrut.h +@@ -89,6 +89,7 @@ struct pfru_payload_hdr { + __u32 hw_ver; + __u32 rt_ver; + __u8 platform_id[16]; ++ __u32 svn_ver; + }; + + enum pfru_dsm_status { diff --git a/debian/patches/patchset-pf/steady/0091-tracing-fprobe-event-Sanitize-wildcard-for-fprobe-ev.patch b/debian/patches/patchset-pf/steady/0091-tracing-fprobe-event-Sanitize-wildcard-for-fprobe-ev.patch new file mode 100644 index 0000000..2c0ab9a --- /dev/null +++ b/debian/patches/patchset-pf/steady/0091-tracing-fprobe-event-Sanitize-wildcard-for-fprobe-ev.patch @@ -0,0 +1,36 @@ +From 3e5eb20e114e1bec6a762488a5a3b7aa9632e634 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Sat, 16 Aug 2025 23:10:51 +0900 +Subject: tracing: fprobe-event: Sanitize wildcard for fprobe event name + +Fprobe event accepts wildcards for the target functions, but unless user +specifies its event name, it makes an event with the wildcards. + + /sys/kernel/tracing # echo 'f mutex*' >> dynamic_events + /sys/kernel/tracing # cat dynamic_events + f:fprobes/mutex*__entry mutex* + /sys/kernel/tracing # ls events/fprobes/ + enable filter mutex*__entry + +To fix this, replace the wildcard ('*') with an underscore. + +Link: https://lore.kernel.org/all/175535345114.282990.12294108192847938710.stgit@devnote2/ + +Fixes: 334e5519c375 ("tracing/probes: Add fprobe events for tracing function entry and exit.") +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +--- + kernel/trace/trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -2210,7 +2210,7 @@ static inline bool is_good_system_name(c + static inline void sanitize_event_name(char *name) + { + while (*name++ != '\0') +- if (*name == ':' || *name == '.') ++ if (*name == ':' || *name == '.' || *name == '*') + *name = '_'; + } + diff --git a/debian/patches/patchset-pf/steady/0092-net-hsr-reject-HSR-frame-if-skb-can-t-hold-tag.patch b/debian/patches/patchset-pf/steady/0092-net-hsr-reject-HSR-frame-if-skb-can-t-hold-tag.patch new file mode 100644 index 0000000..d0820a0 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0092-net-hsr-reject-HSR-frame-if-skb-can-t-hold-tag.patch @@ -0,0 +1,184 @@ +From 5395cbf385079c035dc76fdc7f3d4e8c58bb994a Mon Sep 17 00:00:00 2001 +From: Jakub Acs +Date: Tue, 19 Aug 2025 08:28:42 +0000 +Subject: net, hsr: reject HSR frame if skb can't hold tag +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Receiving HSR frame with insufficient space to hold HSR tag in the skb +can result in a crash (kernel BUG): + +[ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 +[ 45.392559] ------------[ cut here ]------------ +[ 45.392912] kernel BUG at net/core/skbuff.c:211! +[ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI +[ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) +[ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 +[ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 + + + +[ 45.402911] Call Trace: +[ 45.403105] +[ 45.404470] skb_push+0xcd/0xf0 +[ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 +[ 45.406513] br_forward_finish+0x128/0x260 +[ 45.408483] __br_forward+0x42d/0x590 +[ 45.409464] maybe_deliver+0x2eb/0x420 +[ 45.409763] br_flood+0x174/0x4a0 +[ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 +[ 45.411618] br_handle_frame+0xac3/0x1230 +[ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 +[ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 +[ 45.424478] __netif_receive_skb+0x22/0x170 +[ 45.424806] process_backlog+0x242/0x6d0 +[ 45.425116] __napi_poll+0xbb/0x630 +[ 45.425394] net_rx_action+0x4d1/0xcc0 +[ 45.427613] handle_softirqs+0x1a4/0x580 +[ 45.427926] do_softirq+0x74/0x90 +[ 45.428196] + +This issue was found by syzkaller. + +The panic happens in br_dev_queue_push_xmit() once it receives a +corrupted skb with ETH header already pushed in linear data. When it +attempts the skb_push() call, there's not enough headroom and +skb_push() panics. + +The corrupted skb is put on the queue by HSR layer, which makes a +sequence of unintended transformations when it receives a specific +corrupted HSR frame (with incomplete TAG). + +Fix it by dropping and consuming frames that are not long enough to +contain both ethernet and hsr headers. + +Alternative fix would be to check for enough headroom before skb_push() +in br_dev_queue_push_xmit(). + +In the reproducer, this is injected via AF_PACKET, but I don't easily +see why it couldn't be sent over the wire from adjacent network. + +Further Details: + +In the reproducer, the following network interface chain is set up: + +┌────────────────┐ ┌────────────────┐ +│ veth0_to_hsr ├───┤ hsr_slave0 ┼───┐ +└────────────────┘ └────────────────┘ │ + │ ┌──────┐ + ├─┤ hsr0 ├───┐ + │ └──────┘ │ +┌────────────────┐ ┌────────────────┐ │ │┌────────┐ +│ veth1_to_hsr ┼───┤ hsr_slave1 ├───┘ └┤ │ +└────────────────┘ └────────────────┘ ┌┼ bridge │ + ││ │ + │└────────┘ + │ + ┌───────┐ │ + │ ... ├──────┘ + └───────┘ + +To trigger the events leading up to crash, reproducer sends a corrupted +HSR frame with incomplete TAG, via AF_PACKET socket on 'veth0_to_hsr'. + +The first HSR-layer function to process this frame is +hsr_handle_frame(). It and then checks if the +protocol is ETH_P_PRP or ETH_P_HSR. If it is, it calls +skb_set_network_header(skb, ETH_HLEN + HSR_HLEN), without checking that +the skb is long enough. For the crashing frame it is not, and hence the +skb->network_header and skb->mac_len fields are set incorrectly, +pointing after the end of the linear buffer. + +I will call this a BUG#1 and it is what is addressed by this patch. In +the crashing scenario before the fix, the skb continues to go down the +hsr path as follows. + +hsr_handle_frame() then calls this sequence +hsr_forward_skb() + fill_frame_info() + hsr->proto_ops->fill_frame_info() + hsr_fill_frame_info() + +hsr_fill_frame_info() contains a check that intends to check whether the +skb actually contains the HSR header. But the check relies on the +skb->mac_len field which was erroneously setup due to BUG#1, so the +check passes and the execution continues back in the hsr_forward_skb(): + +hsr_forward_skb() + hsr_forward_do() + hsr->proto_ops->get_untagged_frame() + hsr_get_untagged_frame() + create_stripped_skb_hsr() + +In create_stripped_skb_hsr(), a copy of the skb is created and is +further corrupted by operation that attempts to strip the HSR tag in a +call to __pskb_copy(). + +The skb enters create_stripped_skb_hsr() with ethernet header pushed in +linear buffer. The skb_pull(skb_in, HSR_HLEN) thus pulls 6 bytes of +ethernet header into the headroom, creating skb_in with a headroom of +size 8. The subsequent __pskb_copy() then creates an skb with headroom +of just 2 and skb->len of just 12, this is how it looks after the copy: + +gdb) p skb->len +$10 = 12 +(gdb) p skb->data +$11 = (unsigned char *) 0xffff888041e45382 "\252\252\252\252\252!\210\373", +(gdb) p skb->head +$12 = (unsigned char *) 0xffff888041e45380 "" + +It seems create_stripped_skb_hsr() assumes that ETH header is pulled +in the headroom when it's entered, because it just pulls HSR header on +top. But that is not the case in our code-path and we end up with the +corrupted skb instead. I will call this BUG#2 + +*I got confused here because it seems that under no conditions can +create_stripped_skb_hsr() work well, the assumption it makes is not true +during the processing of hsr frames - since the skb_push() in +hsr_handle_frame to skb_pull in hsr_deliver_master(). I wonder whether I +missed something here.* + +Next, the execution arrives in hsr_deliver_master(). It calls +skb_pull(ETH_HLEN), which just returns NULL - the SKB does not have +enough space for the pull (as it only has 12 bytes in total at this +point). + +*The skb_pull() here further suggests that ethernet header is meant +to be pushed through the whole hsr processing and +create_stripped_skb_hsr() should pull it before doing the HSR header +pull.* + +hsr_deliver_master() then puts the corrupted skb on the queue, it is +then picked up from there by bridge frame handling layer and finally +lands in br_dev_queue_push_xmit where it panics. + +Cc: stable@kernel.org +Fixes: 48b491a5cc74 ("net: hsr: fix mac_len checks") +Reported-by: syzbot+a81f2759d022496b40ab@syzkaller.appspotmail.com +Signed-off-by: Jakub Acs +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250819082842.94378-1-acsjakub@amazon.de +Signed-off-by: Jakub Kicinski +--- + net/hsr/hsr_slave.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/net/hsr/hsr_slave.c ++++ b/net/hsr/hsr_slave.c +@@ -63,8 +63,14 @@ static rx_handler_result_t hsr_handle_fr + skb_push(skb, ETH_HLEN); + skb_reset_mac_header(skb); + if ((!hsr->prot_version && protocol == htons(ETH_P_PRP)) || +- protocol == htons(ETH_P_HSR)) ++ protocol == htons(ETH_P_HSR)) { ++ if (!pskb_may_pull(skb, ETH_HLEN + HSR_HLEN)) { ++ kfree_skb(skb); ++ goto finish_consume; ++ } ++ + skb_set_network_header(skb, ETH_HLEN + HSR_HLEN); ++ } + skb_reset_mac_len(skb); + + /* Only the frames received over the interlink port will assign a diff --git a/debian/patches/patchset-pf/steady/0093-ipv6-sr-Fix-MAC-comparison-to-be-constant-time.patch b/debian/patches/patchset-pf/steady/0093-ipv6-sr-Fix-MAC-comparison-to-be-constant-time.patch new file mode 100644 index 0000000..b748085 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0093-ipv6-sr-Fix-MAC-comparison-to-be-constant-time.patch @@ -0,0 +1,37 @@ +From 205c57591ac9b825407ea68ad23fb82dc662bd45 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 18 Aug 2025 13:27:24 -0700 +Subject: ipv6: sr: Fix MAC comparison to be constant-time + +To prevent timing attacks, MACs need to be compared in constant time. +Use the appropriate helper function for this. + +Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Reviewed-by: Andrea Mayer +Link: https://patch.msgid.link/20250818202724.15713-1-ebiggers@kernel.org +Signed-off-by: Jakub Kicinski +--- + net/ipv6/seg6_hmac.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv6/seg6_hmac.c ++++ b/net/ipv6/seg6_hmac.c +@@ -35,6 +35,7 @@ + #include + + #include ++#include + #include + #include + #include +@@ -280,7 +281,7 @@ bool seg6_hmac_validate_skb(struct sk_bu + if (seg6_hmac_compute(hinfo, srh, &ipv6_hdr(skb)->saddr, hmac_output)) + return false; + +- if (memcmp(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN) != 0) ++ if (crypto_memneq(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN)) + return false; + + return true; diff --git a/debian/patches/patchset-pf/steady/0094-mmc-sdhci_am654-Drop-the-use-of-sdhci_pltfm_free.patch b/debian/patches/patchset-pf/steady/0094-mmc-sdhci_am654-Drop-the-use-of-sdhci_pltfm_free.patch new file mode 100644 index 0000000..03db465 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0094-mmc-sdhci_am654-Drop-the-use-of-sdhci_pltfm_free.patch @@ -0,0 +1,76 @@ +From 74639c7e934c874de97874850ee04691906dcb75 Mon Sep 17 00:00:00 2001 +From: Binbin Zhou +Date: Sat, 7 Jun 2025 15:52:58 +0800 +Subject: mmc: sdhci_am654: Drop the use of sdhci_pltfm_free() + +Since the devm_mmc_alloc_host() helper is already in use, +sdhci_pltfm_free() is no longer needed. + +Signed-off-by: Binbin Zhou +Link: https://lore.kernel.org/r/a456963bae14b0c6dade02f388f815f1ffcaa98a.1749127796.git.zhoubinbin@loongson.cn +Signed-off-by: Ulf Hansson +--- + drivers/mmc/host/sdhci_am654.c | 20 ++++++-------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -945,35 +945,30 @@ static int sdhci_am654_probe(struct plat + clk_xin = devm_clk_get(dev, "clk_xin"); + if (IS_ERR(clk_xin)) { + dev_err(dev, "clk_xin clock not found.\n"); +- ret = PTR_ERR(clk_xin); +- goto err_pltfm_free; ++ return PTR_ERR(clk_xin); + } + + pltfm_host->clk = clk_xin; + + base = devm_platform_ioremap_resource(pdev, 1); + if (IS_ERR(base)) { +- ret = PTR_ERR(base); +- goto err_pltfm_free; ++ return PTR_ERR(base); + } + + sdhci_am654->base = devm_regmap_init_mmio(dev, base, + &sdhci_am654_regmap_config); + if (IS_ERR(sdhci_am654->base)) { + dev_err(dev, "Failed to initialize regmap\n"); +- ret = PTR_ERR(sdhci_am654->base); +- goto err_pltfm_free; ++ return PTR_ERR(sdhci_am654->base); + } + + ret = sdhci_am654_get_of_property(pdev, sdhci_am654); + if (ret) +- goto err_pltfm_free; ++ return ret; + + ret = mmc_of_parse(host->mmc); +- if (ret) { +- dev_err_probe(dev, ret, "parsing dt failed\n"); +- goto err_pltfm_free; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "parsing dt failed\n"); + + host->mmc_host_ops.start_signal_voltage_switch = sdhci_am654_start_signal_voltage_switch; + host->mmc_host_ops.execute_tuning = sdhci_am654_execute_tuning; +@@ -1004,8 +999,6 @@ pm_disable: + pm_runtime_disable(dev); + pm_put: + pm_runtime_put_noidle(dev); +-err_pltfm_free: +- sdhci_pltfm_free(pdev); + return ret; + } + +@@ -1024,7 +1017,6 @@ static void sdhci_am654_remove(struct pl + clk_disable_unprepare(pltfm_host->clk); + pm_runtime_disable(dev); + pm_runtime_put_noidle(dev); +- sdhci_pltfm_free(pdev); + } + + #ifdef CONFIG_PM diff --git a/debian/patches/patchset-pf/steady/0095-mmc-sdhci_am654-Disable-HS400-for-AM62P-SR1.0-and-SR.patch b/debian/patches/patchset-pf/steady/0095-mmc-sdhci_am654-Disable-HS400-for-AM62P-SR1.0-and-SR.patch new file mode 100644 index 0000000..434ca69 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0095-mmc-sdhci_am654-Disable-HS400-for-AM62P-SR1.0-and-SR.patch @@ -0,0 +1,76 @@ +From a8f43b888ffc5eb53f5735cc21c765d035c11c5e Mon Sep 17 00:00:00 2001 +From: Judith Mendez +Date: Wed, 20 Aug 2025 14:30:47 -0500 +Subject: mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 + +This adds SDHCI_AM654_QUIRK_DISABLE_HS400 quirk which shall be used +to disable HS400 support. AM62P SR1.0 and SR1.1 do not support HS400 +due to errata i2458 [0] so disable HS400 for these SoC revisions. + +[0] https://www.ti.com/lit/er/sprz574a/sprz574a.pdf +Fixes: 37f28165518f ("arm64: dts: ti: k3-am62p: Add ITAP/OTAP values for MMC") +Cc: stable@vger.kernel.org +Signed-off-by: Judith Mendez +Reviewed-by: Andrew Davis +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250820193047.4064142-1-jm@ti.com +Signed-off-by: Ulf Hansson +--- + drivers/mmc/host/sdhci_am654.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -156,6 +156,7 @@ struct sdhci_am654_data { + + #define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0) + #define SDHCI_AM654_QUIRK_SUPPRESS_V1P8_ENA BIT(1) ++#define SDHCI_AM654_QUIRK_DISABLE_HS400 BIT(2) + }; + + struct window { +@@ -765,6 +766,7 @@ static int sdhci_am654_init(struct sdhci + { + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); ++ struct device *dev = mmc_dev(host->mmc); + u32 ctl_cfg_2 = 0; + u32 mask; + u32 val; +@@ -820,6 +822,12 @@ static int sdhci_am654_init(struct sdhci + if (ret) + goto err_cleanup_host; + ++ if (sdhci_am654->quirks & SDHCI_AM654_QUIRK_DISABLE_HS400 && ++ host->mmc->caps2 & (MMC_CAP2_HS400 | MMC_CAP2_HS400_ES)) { ++ dev_info(dev, "HS400 mode not supported on this silicon revision, disabling it\n"); ++ host->mmc->caps2 &= ~(MMC_CAP2_HS400 | MMC_CAP2_HS400_ES); ++ } ++ + ret = __sdhci_add_host(host); + if (ret) + goto err_cleanup_host; +@@ -883,6 +891,12 @@ static int sdhci_am654_get_of_property(s + return 0; + } + ++static const struct soc_device_attribute sdhci_am654_descope_hs400[] = { ++ { .family = "AM62PX", .revision = "SR1.0" }, ++ { .family = "AM62PX", .revision = "SR1.1" }, ++ { /* sentinel */ } ++}; ++ + static const struct of_device_id sdhci_am654_of_match[] = { + { + .compatible = "ti,am654-sdhci-5.1", +@@ -970,6 +984,10 @@ static int sdhci_am654_probe(struct plat + if (ret) + return dev_err_probe(dev, ret, "parsing dt failed\n"); + ++ soc = soc_device_match(sdhci_am654_descope_hs400); ++ if (soc) ++ sdhci_am654->quirks |= SDHCI_AM654_QUIRK_DISABLE_HS400; ++ + host->mmc_host_ops.start_signal_voltage_switch = sdhci_am654_start_signal_voltage_switch; + host->mmc_host_ops.execute_tuning = sdhci_am654_execute_tuning; + diff --git a/debian/patches/patchset-pf/steady/0096-io_uring-futex-ensure-io_futex_wait-cleans-up-proper.patch b/debian/patches/patchset-pf/steady/0096-io_uring-futex-ensure-io_futex_wait-cleans-up-proper.patch new file mode 100644 index 0000000..aa612a9 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0096-io_uring-futex-ensure-io_futex_wait-cleans-up-proper.patch @@ -0,0 +1,43 @@ +From 2988d1717679b28423a316a92aaa7cae7fddceab Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Thu, 21 Aug 2025 13:23:21 -0600 +Subject: io_uring/futex: ensure io_futex_wait() cleans up properly on failure + +The io_futex_data is allocated upfront and assigned to the io_kiocb +async_data field, but the request isn't marked with REQ_F_ASYNC_DATA +at that point. Those two should always go together, as the flag tells +io_uring whether the field is valid or not. + +Additionally, on failure cleanup, the futex handler frees the data but +does not clear ->async_data. Clear the data and the flag in the error +path as well. + +Thanks to Trend Micro Zero Day Initiative and particularly ReDress for +reporting this. + +Cc: stable@vger.kernel.org +Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait") +Signed-off-by: Jens Axboe +--- + io_uring/futex.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/io_uring/futex.c ++++ b/io_uring/futex.c +@@ -288,6 +288,7 @@ int io_futex_wait(struct io_kiocb *req, + goto done_unlock; + } + ++ req->flags |= REQ_F_ASYNC_DATA; + req->async_data = ifd; + ifd->q = futex_q_init; + ifd->q.bitset = iof->futex_mask; +@@ -309,6 +310,8 @@ done: + if (ret < 0) + req_set_fail(req); + io_req_set_res(req, ret, 0); ++ req->async_data = NULL; ++ req->flags &= ~REQ_F_ASYNC_DATA; + kfree(ifd); + return IOU_COMPLETE; + } diff --git a/debian/patches/patchset-pf/steady/0097-iommu-arm-smmu-v3-Fix-smmu_domain-nr_ats_masters-dec.patch b/debian/patches/patchset-pf/steady/0097-iommu-arm-smmu-v3-Fix-smmu_domain-nr_ats_masters-dec.patch new file mode 100644 index 0000000..b096faf --- /dev/null +++ b/debian/patches/patchset-pf/steady/0097-iommu-arm-smmu-v3-Fix-smmu_domain-nr_ats_masters-dec.patch @@ -0,0 +1,48 @@ +From 901e269fd5b5d6868b4055f4b8afcf876cf5c8bd Mon Sep 17 00:00:00 2001 +From: Nicolin Chen +Date: Thu, 31 Jul 2025 20:01:27 -0700 +Subject: iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement + +The arm_smmu_attach_commit() updates master->ats_enabled before calling +arm_smmu_remove_master_domain() that is supposed to clean up everything +in the old domain, including the old domain's nr_ats_masters. So, it is +supposed to use the old ats_enabled state of the device, not an updated +state. + +This isn't a problem if switching between two domains where: + - old ats_enabled = false; new ats_enabled = false + - old ats_enabled = true; new ats_enabled = true +but can fail cases where: + - old ats_enabled = false; new ats_enabled = true + (old domain should keep the counter but incorrectly decreased it) + - old ats_enabled = true; new ats_enabled = false + (old domain needed to decrease the counter but incorrectly missed it) + +Update master->ats_enabled after arm_smmu_remove_master_domain() to fix +this. + +Fixes: 7497f4211f4f ("iommu/arm-smmu-v3: Make changing domains be hitless for ATS") +Cc: stable@vger.kernel.org +Signed-off-by: Nicolin Chen +Acked-by: Will Deacon +Reviewed-by: Jason Gunthorpe +Reviewed-by: Pranjal Shrivastava +Link: https://lore.kernel.org/r/20250801030127.2006979-1-nicolinc@nvidia.com +Signed-off-by: Joerg Roedel +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -2997,9 +2997,9 @@ void arm_smmu_attach_commit(struct arm_s + /* ATS is being switched off, invalidate the entire ATC */ + arm_smmu_atc_inv_master(master, IOMMU_NO_PASID); + } +- master->ats_enabled = state->ats_enabled; + + arm_smmu_remove_master_domain(master, state->old_domain, state->ssid); ++ master->ats_enabled = state->ats_enabled; + } + + static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev) diff --git a/debian/patches/patchset-pf/steady/0098-iommu-Remove-ops.pgsize_bitmap-from-drivers-that-don.patch b/debian/patches/patchset-pf/steady/0098-iommu-Remove-ops.pgsize_bitmap-from-drivers-that-don.patch new file mode 100644 index 0000000..a02561d --- /dev/null +++ b/debian/patches/patchset-pf/steady/0098-iommu-Remove-ops.pgsize_bitmap-from-drivers-that-don.patch @@ -0,0 +1,94 @@ +From 0def0bcc95af6014e2a52c7d69ae83790b310406 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Mon, 9 Jun 2025 17:41:27 -0300 +Subject: iommu: Remove ops.pgsize_bitmap from drivers that don't use it + +These drivers all set the domain->pgsize_bitmap in their +domain_alloc_paging() functions, so the ops value is never used. Delete +it. + +Reviewed-by: Sven Peter # for Apple DART +Reviewed-by: Lu Baolu +Reviewed-by: Kevin Tian +Reviewed-by: Tomasz Jeznach # for RISC-V +Signed-off-by: Jason Gunthorpe +Tested-by: Nicolin Chen +Link: https://lore.kernel.org/r/3-v2-68a2e1ba507c+1fb-iommu_rm_ops_pgsize_jgg@nvidia.com +Signed-off-by: Joerg Roedel +--- + drivers/iommu/apple-dart.c | 1 - + drivers/iommu/intel/iommu.c | 1 - + drivers/iommu/iommufd/selftest.c | 1 - + drivers/iommu/riscv/iommu.c | 1 - + drivers/iommu/virtio-iommu.c | 6 ++---- + 5 files changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/iommu/apple-dart.c ++++ b/drivers/iommu/apple-dart.c +@@ -991,7 +991,6 @@ static const struct iommu_ops apple_dart + .of_xlate = apple_dart_of_xlate, + .def_domain_type = apple_dart_def_domain_type, + .get_resv_regions = apple_dart_get_resv_regions, +- .pgsize_bitmap = -1UL, /* Restricted during dart probe */ + .owner = THIS_MODULE, + .default_domain_ops = &(const struct iommu_domain_ops) { + .attach_dev = apple_dart_attach_dev_paging, +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -4405,7 +4405,6 @@ const struct iommu_ops intel_iommu_ops = + .device_group = intel_iommu_device_group, + .is_attach_deferred = intel_iommu_is_attach_deferred, + .def_domain_type = device_def_domain_type, +- .pgsize_bitmap = SZ_4K, + .page_response = intel_iommu_page_response, + .default_domain_ops = &(const struct iommu_domain_ops) { + .attach_dev = intel_iommu_attach_device, +--- a/drivers/iommu/iommufd/selftest.c ++++ b/drivers/iommu/iommufd/selftest.c +@@ -801,7 +801,6 @@ static const struct iommu_ops mock_ops = + .default_domain = &mock_blocking_domain, + .blocked_domain = &mock_blocking_domain, + .owner = THIS_MODULE, +- .pgsize_bitmap = MOCK_IO_PAGE_SIZE, + .hw_info = mock_domain_hw_info, + .domain_alloc_paging_flags = mock_domain_alloc_paging_flags, + .domain_alloc_nested = mock_domain_alloc_nested, +--- a/drivers/iommu/riscv/iommu.c ++++ b/drivers/iommu/riscv/iommu.c +@@ -1533,7 +1533,6 @@ static void riscv_iommu_release_device(s + } + + static const struct iommu_ops riscv_iommu_ops = { +- .pgsize_bitmap = SZ_4K, + .of_xlate = riscv_iommu_of_xlate, + .identity_domain = &riscv_iommu_identity_domain, + .blocked_domain = &riscv_iommu_blocking_domain, +--- a/drivers/iommu/virtio-iommu.c ++++ b/drivers/iommu/virtio-iommu.c +@@ -998,7 +998,7 @@ static void viommu_get_resv_regions(stru + iommu_dma_get_resv_regions(dev, head); + } + +-static struct iommu_ops viommu_ops; ++static const struct iommu_ops viommu_ops; + static struct virtio_driver virtio_iommu_drv; + + static int viommu_match_node(struct device *dev, const void *data) +@@ -1086,7 +1086,7 @@ static bool viommu_capable(struct device + } + } + +-static struct iommu_ops viommu_ops = { ++static const struct iommu_ops viommu_ops = { + .capable = viommu_capable, + .domain_alloc_identity = viommu_domain_alloc_identity, + .domain_alloc_paging = viommu_domain_alloc_paging, +@@ -1217,8 +1217,6 @@ static int viommu_probe(struct virtio_de + viommu->first_domain++; + } + +- viommu_ops.pgsize_bitmap = viommu->pgsize_bitmap; +- + virtio_device_ready(vdev); + + /* Populate the event queue with buffers */ diff --git a/debian/patches/patchset-pf/steady/0099-iommu-virtio-Make-instance-lookup-robust.patch b/debian/patches/patchset-pf/steady/0099-iommu-virtio-Make-instance-lookup-robust.patch new file mode 100644 index 0000000..350406d --- /dev/null +++ b/debian/patches/patchset-pf/steady/0099-iommu-virtio-Make-instance-lookup-robust.patch @@ -0,0 +1,73 @@ +From 06c0f6a713788e77ed30d1b09b7954e4e24266f2 Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Thu, 14 Aug 2025 17:47:16 +0100 +Subject: iommu/virtio: Make instance lookup robust + +Much like arm-smmu in commit 7d835134d4e1 ("iommu/arm-smmu: Make +instance lookup robust"), virtio-iommu appears to have the same issue +where iommu_device_register() makes the IOMMU instance visible to other +API callers (including itself) straight away, but internally the +instance isn't ready to recognise itself for viommu_probe_device() to +work correctly until after viommu_probe() has returned. This matters a +lot more now that bus_iommu_probe() has the DT/VIOT knowledge to probe +client devices the way that was always intended. Tweak the lookup and +initialisation in much the same way as for arm-smmu, to ensure that what +we register is functional and ready to go. + +Cc: stable@vger.kernel.org +Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path") +Signed-off-by: Robin Murphy +Tested-by: Eric Auger +Link: https://lore.kernel.org/r/308911aaa1f5be32a3a709996c7bd6cf71d30f33.1755190036.git.robin.murphy@arm.com +Signed-off-by: Joerg Roedel +--- + drivers/iommu/virtio-iommu.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/iommu/virtio-iommu.c ++++ b/drivers/iommu/virtio-iommu.c +@@ -998,8 +998,7 @@ static void viommu_get_resv_regions(stru + iommu_dma_get_resv_regions(dev, head); + } + +-static const struct iommu_ops viommu_ops; +-static struct virtio_driver virtio_iommu_drv; ++static const struct bus_type *virtio_bus_type; + + static int viommu_match_node(struct device *dev, const void *data) + { +@@ -1008,8 +1007,9 @@ static int viommu_match_node(struct devi + + static struct viommu_dev *viommu_get_by_fwnode(struct fwnode_handle *fwnode) + { +- struct device *dev = driver_find_device(&virtio_iommu_drv.driver, NULL, +- fwnode, viommu_match_node); ++ struct device *dev = bus_find_device(virtio_bus_type, NULL, fwnode, ++ viommu_match_node); ++ + put_device(dev); + + return dev ? dev_to_virtio(dev)->priv : NULL; +@@ -1160,6 +1160,9 @@ static int viommu_probe(struct virtio_de + if (!viommu) + return -ENOMEM; + ++ /* Borrow this for easy lookups later */ ++ virtio_bus_type = dev->bus; ++ + spin_lock_init(&viommu->request_lock); + ida_init(&viommu->domain_ids); + viommu->dev = dev; +@@ -1229,10 +1232,10 @@ static int viommu_probe(struct virtio_de + if (ret) + goto err_free_vqs; + +- iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev); +- + vdev->priv = viommu; + ++ iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev); ++ + dev_info(dev, "input address: %u bits\n", + order_base_2(viommu->geometry.aperture_end)); + dev_info(dev, "page mask: %#llx\n", viommu->pgsize_bitmap); diff --git a/debian/patches/patchset-pf/steady/0100-ftrace-Also-allocate-and-copy-hash-for-reading-of-fi.patch b/debian/patches/patchset-pf/steady/0100-ftrace-Also-allocate-and-copy-hash-for-reading-of-fi.patch new file mode 100644 index 0000000..ffe2231 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0100-ftrace-Also-allocate-and-copy-hash-for-reading-of-fi.patch @@ -0,0 +1,70 @@ +From 62b8eb7367de30fd149137b08ffbff5aadf02541 Mon Sep 17 00:00:00 2001 +From: Steven Rostedt +Date: Fri, 22 Aug 2025 18:36:06 -0400 +Subject: ftrace: Also allocate and copy hash for reading of filter files + +Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds +the pointer to the global tracer hash to its iterator. Unlike the writer +that allocates a copy of the hash, the reader keeps the pointer to the +filter hashes. This is problematic because this pointer is static across +function calls that release the locks that can update the global tracer +hashes. This can cause UAF and similar bugs. + +Allocate and copy the hash for reading the filter files like it is done +for the writers. This not only fixes UAF bugs, but also makes the code a +bit simpler as it doesn't have to differentiate when to free the +iterator's hash between writers and readers. + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Cc: Nathan Chancellor +Cc: Linus Torvalds +Link: https://lore.kernel.org/20250822183606.12962cc3@batman.local.home +Fixes: c20489dad156 ("ftrace: Assign iter->hash to filter or notrace hashes on seq read") +Closes: https://lore.kernel.org/all/20250813023044.2121943-1-wutengda@huaweicloud.com/ +Closes: https://lore.kernel.org/all/20250822192437.GA458494@ax162/ +Reported-by: Tengda Wu +Tested-by: Tengda Wu +Tested-by: Nathan Chancellor +Signed-off-by: Steven Rostedt (Google) +--- + kernel/trace/ftrace.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -4665,13 +4665,17 @@ ftrace_regex_open(struct ftrace_ops *ops + } else { + iter->hash = alloc_and_copy_ftrace_hash(size_bits, hash); + } ++ } else { ++ if (hash) ++ iter->hash = alloc_and_copy_ftrace_hash(hash->size_bits, hash); ++ else ++ iter->hash = EMPTY_HASH; ++ } + +- if (!iter->hash) { +- trace_parser_put(&iter->parser); +- goto out_unlock; +- } +- } else +- iter->hash = hash; ++ if (!iter->hash) { ++ trace_parser_put(&iter->parser); ++ goto out_unlock; ++ } + + ret = 0; + +@@ -6547,9 +6551,6 @@ int ftrace_regex_release(struct inode *i + ftrace_hash_move_and_update_ops(iter->ops, orig_hash, + iter->hash, filter_hash); + mutex_unlock(&ftrace_lock); +- } else { +- /* For read only, the hash is the ops hash */ +- iter->hash = NULL; + } + + mutex_unlock(&iter->ops->func_hash->regex_lock); diff --git a/debian/patches/patchset-pf/steady/0101-x86-cpu-hygon-Add-missing-resctrl_cpu_detect-in-bsp_.patch b/debian/patches/patchset-pf/steady/0101-x86-cpu-hygon-Add-missing-resctrl_cpu_detect-in-bsp_.patch new file mode 100644 index 0000000..ffe5d98 --- /dev/null +++ b/debian/patches/patchset-pf/steady/0101-x86-cpu-hygon-Add-missing-resctrl_cpu_detect-in-bsp_.patch @@ -0,0 +1,50 @@ +From 6425b7de1cf9820569c2990e88396f236f2099fd Mon Sep 17 00:00:00 2001 +From: Tianxiang Peng +Date: Mon, 23 Jun 2025 17:31:53 +0800 +Subject: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper + +Since + + 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") + +resctrl_cpu_detect() has been moved from common CPU initialization code to +the vendor-specific BSP init helper, while Hygon didn't put that call in their +code. + +This triggers a division by zero fault during early booting stage on our +machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries +to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. + +Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. + + [ bp: Massage commit message. ] + +Fixes: 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") +Signed-off-by: Tianxiang Peng +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Hui Li +Cc: +Link: https://lore.kernel.org/20250623093153.3016937-1-txpeng@tencent.com +--- + arch/x86/kernel/cpu/hygon.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kernel/cpu/hygon.c ++++ b/arch/x86/kernel/cpu/hygon.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #include "cpu.h" + +@@ -117,6 +118,8 @@ static void bsp_init_hygon(struct cpuinf + x86_amd_ls_cfg_ssbd_mask = 1ULL << 10; + } + } ++ ++ resctrl_cpu_detect(c); + } + + static void early_init_hygon(struct cpuinfo_x86 *c) diff --git a/debian/patches/patchset-pf/steady/0102-x86-CPU-AMD-Ignore-invalid-reset-reason-value.patch b/debian/patches/patchset-pf/steady/0102-x86-CPU-AMD-Ignore-invalid-reset-reason-value.patch new file mode 100644 index 0000000..5b1636e --- /dev/null +++ b/debian/patches/patchset-pf/steady/0102-x86-CPU-AMD-Ignore-invalid-reset-reason-value.patch @@ -0,0 +1,57 @@ +From 3d1fea3f1caf32f130c4cb859efd07f824752d3f Mon Sep 17 00:00:00 2001 +From: Yazen Ghannam +Date: Mon, 21 Jul 2025 18:11:54 +0000 +Subject: x86/CPU/AMD: Ignore invalid reset reason value + +The reset reason value may be "all bits set", e.g. 0xFFFFFFFF. This is a +commonly used error response from hardware. This may occur due to a real +hardware issue or when running in a VM. + +The user will see all reset reasons reported in this case. + +Check for an error response value and return early to avoid decoding +invalid data. + +Also, adjust the data variable type to match the hardware register size. + +Fixes: ab8131028710 ("x86/CPU/AMD: Print the reason for the last reset") +Reported-by: Libing He +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Mario Limonciello +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/20250721181155.3536023-1-yazen.ghannam@amd.com +--- + arch/x86/kernel/cpu/amd.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -1324,8 +1324,8 @@ static const char * const s5_reset_reaso + + static __init int print_s5_reset_status_mmio(void) + { +- unsigned long value; + void __iomem *addr; ++ u32 value; + int i; + + if (!cpu_feature_enabled(X86_FEATURE_ZEN)) +@@ -1338,12 +1338,16 @@ static __init int print_s5_reset_status_ + value = ioread32(addr); + iounmap(addr); + ++ /* Value with "all bits set" is an error response and should be ignored. */ ++ if (value == U32_MAX) ++ return 0; ++ + for (i = 0; i < ARRAY_SIZE(s5_reset_reason_txt); i++) { + if (!(value & BIT(i))) + continue; + + if (s5_reset_reason_txt[i]) { +- pr_info("x86/amd: Previous system reset reason [0x%08lx]: %s\n", ++ pr_info("x86/amd: Previous system reset reason [0x%08x]: %s\n", + value, s5_reset_reason_txt[i]); + } + } diff --git a/debian/patches/patchset-xanmod/binder/0001-binder-turn-into-module.patch b/debian/patches/patchset-xanmod/binder/0001-binder-turn-into-module.patch index 30ad1e7..74a3dfd 100644 --- a/debian/patches/patchset-xanmod/binder/0001-binder-turn-into-module.patch +++ b/debian/patches/patchset-xanmod/binder/0001-binder-turn-into-module.patch @@ -46,7 +46,7 @@ Signed-off-by: Alexandre Frade Binderfs is a pseudo-filesystem for the Android Binder IPC driver --- a/drivers/android/binder.c +++ b/drivers/android/binder.c -@@ -7043,9 +7043,20 @@ err_alloc_device_names_failed: +@@ -7107,9 +7107,20 @@ err_alloc_device_names_failed: return ret; } @@ -185,7 +185,7 @@ Signed-off-by: Alexandre Frade return container_of(ns, struct ipc_namespace, ns); --- a/mm/vmalloc.c +++ b/mm/vmalloc.c -@@ -3190,6 +3190,7 @@ struct vm_struct *get_vm_area(unsigned l +@@ -3231,6 +3231,7 @@ struct vm_struct *get_vm_area(unsigned l NUMA_NO_NODE, GFP_KERNEL, __builtin_return_address(0)); } diff --git a/debian/patches/patchset-xanmod/net/netfilter/0001-netfilter-Add-netfilter-nf_tables-fullcone-support.patch b/debian/patches/patchset-xanmod/net/netfilter/0001-netfilter-Add-netfilter-nf_tables-fullcone-support.patch index b972621..fc43f7a 100644 --- a/debian/patches/patchset-xanmod/net/netfilter/0001-netfilter-Add-netfilter-nf_tables-fullcone-support.patch +++ b/debian/patches/patchset-xanmod/net/netfilter/0001-netfilter-Add-netfilter-nf_tables-fullcone-support.patch @@ -1,7 +1,7 @@ -From a78b8dee94d4742c4696c55c0eec964802e812ac Mon Sep 17 00:00:00 2001 +From 5d06324b94cc7c38e4a7943c1a0f25b118819afc Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Mon, 27 Feb 2023 01:38:18 +0000 -Subject: [PATCH 1/2] netfilter: Add netfilter nf_tables fullcone support +Subject: [PATCH] netfilter: Add netfilter nf_tables fullcone support Signed-off-by: Syrone Wong Signed-off-by: Alexandre Frade @@ -1482,9 +1482,9 @@ Signed-off-by: Alexandre Frade + enum ip_conntrack_info ctinfo; + struct nf_conn_nat *nat; + struct nf_conntrack_tuple *ct_tuple, *ct_tuple_origin; -+ uint16_t port, original_port, want_port; ++ uint16_t port, original_port, want_port = 0; + uint8_t protonum; -+ bool is_src_mapping_active; ++ bool is_src_mapping_active = false; + + /* NFPROTO specific def */ + struct nat_mapping *mapping, *src_mapping; diff --git a/debian/patches/patchset-xanmod/net/netfilter/0002-netfilter-add-xt_FLOWOFFLOAD-target.patch b/debian/patches/patchset-xanmod/net/netfilter/0002-netfilter-add-xt_FLOWOFFLOAD-target.patch index 901d7bb..ad7556d 100644 --- a/debian/patches/patchset-xanmod/net/netfilter/0002-netfilter-add-xt_FLOWOFFLOAD-target.patch +++ b/debian/patches/patchset-xanmod/net/netfilter/0002-netfilter-add-xt_FLOWOFFLOAD-target.patch @@ -1,7 +1,7 @@ -From 242e385bcd49ee7ea5332b27864f81aab9b11718 Mon Sep 17 00:00:00 2001 +From b735384e46e7fe572615643b466ec6b3c410256a Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 20 Feb 2018 15:56:02 +0100 -Subject: [PATCH 2/2] netfilter: add xt_FLOWOFFLOAD target +Subject: [PATCH] netfilter: add xt_FLOWOFFLOAD target Signed-off-by: Felix Fietkau Signed-off-by: Alexandre Frade @@ -11,8 +11,8 @@ Signed-off-by: Alexandre Frade net/netfilter/Kconfig | 9 + net/netfilter/Makefile | 1 + net/netfilter/nf_flow_table_core.c | 5 +- - net/netfilter/xt_FLOWOFFLOAD.c | 698 ++++++++++++++++++ - 6 files changed, 732 insertions(+), 3 deletions(-) + net/netfilter/xt_FLOWOFFLOAD.c | 701 ++++++++++++++++++ + 6 files changed, 735 insertions(+), 3 deletions(-) create mode 100644 include/uapi/linux/netfilter/xt_FLOWOFFLOAD.h create mode 100644 net/netfilter/xt_FLOWOFFLOAD.c @@ -108,7 +108,7 @@ Signed-off-by: Alexandre Frade { --- /dev/null +++ b/net/netfilter/xt_FLOWOFFLOAD.c -@@ -0,0 +1,698 @@ +@@ -0,0 +1,701 @@ +/* + * Copyright (C) 2018-2021 Felix Fietkau + * @@ -578,7 +578,7 @@ Signed-off-by: Alexandre Frade + const struct xt_flowoffload_target_info *info = par->targinfo; + struct tcphdr _tcph, *tcph = NULL; + enum ip_conntrack_info ctinfo; -+ enum ip_conntrack_dir dir; ++ enum ip_conntrack_dir dir = IP_CT_DIR_ORIGINAL; + struct nf_flow_route route = {}; + struct flow_offload *flow = NULL; + struct net_device *devs[2] = {}; @@ -804,6 +804,9 @@ Signed-off-by: Alexandre Frade + nf_flow_table_free(&flowtable[1].ft); +} + -+MODULE_LICENSE("GPL"); +module_init(xt_flowoffload_tg_init); +module_exit(xt_flowoffload_tg_exit); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Felix Fietkau "); ++MODULE_DESCRIPTION("Netfilter FLOWOFFLOAD nf_flow_offload module"); diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0001-net-tcp_bbr-broaden-app-limited-rate-sample-detectio.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0001-net-tcp_bbr-broaden-app-limited-rate-sample-detectio.patch deleted file mode 100644 index e48af1d..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0001-net-tcp_bbr-broaden-app-limited-rate-sample-detectio.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 1e164adec73236b05d5b84846a460082d3d211d2 Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Tue, 11 Jun 2019 12:26:55 -0400 -Subject: [PATCH 01/18] net-tcp_bbr: broaden app-limited rate sample detection - -This commit is a bug fix for the Linux TCP app-limited -(application-limited) logic that is used for collecting rate -(bandwidth) samples. - -Previously the app-limited logic only looked for "bubbles" of -silence in between application writes, by checking at the start -of each sendmsg. But "bubbles" of silence can also happen before -retransmits: e.g. bubbles can happen between an application write -and a retransmit, or between two retransmits. - -Retransmits are triggered by ACKs or timers. So this commit checks -for bubbles of app-limited silence upon ACKs or timers. - -Why does this commit check for app-limited state at the start of -ACKs and timer handling? Because at that point we know whether -inflight was fully using the cwnd. During processing the ACK or -timer event we often change the cwnd; after changing the cwnd we -can't know whether inflight was fully using the old cwnd. - -Origin-9xx-SHA1: 3fe9b53291e018407780fb8c356adb5666722cbc -Change-Id: I37221506f5166877c2b110753d39bb0757985e68 -Signed-off-by: Alexandre Frade ---- - net/ipv4/tcp_input.c | 1 + - net/ipv4/tcp_timer.c | 1 + - 2 files changed, 2 insertions(+) - ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -4003,6 +4003,7 @@ static int tcp_ack(struct sock *sk, cons - - prior_fack = tcp_is_sack(tp) ? tcp_highest_sack_seq(tp) : tp->snd_una; - rs.prior_in_flight = tcp_packets_in_flight(tp); -+ tcp_rate_check_app_limited(sk); - - /* ts_recent update must be made after we are sure that the packet - * is in window. ---- a/net/ipv4/tcp_timer.c -+++ b/net/ipv4/tcp_timer.c -@@ -702,6 +702,7 @@ void tcp_write_timer_handler(struct sock - icsk_timeout(icsk)); - return; - } -+ tcp_rate_check_app_limited(sk); - tcp_mstamp_refresh(tcp_sk(sk)); - event = icsk->icsk_pending; - diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0016-net-tcp_bbr-v3-update-TCP-bbr-congestion-control-mod.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0001-tcp_bbr-v3-update-TCP-bbr-congestion-control-module-.patch similarity index 79% rename from debian/patches/patchset-xanmod/net/tcp/bbr3/0016-net-tcp_bbr-v3-update-TCP-bbr-congestion-control-mod.patch rename to debian/patches/patchset-xanmod/net/tcp/bbr3/0001-tcp_bbr-v3-update-TCP-bbr-congestion-control-module-.patch index ac6741a..f2ccfd4 100644 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0016-net-tcp_bbr-v3-update-TCP-bbr-congestion-control-mod.patch +++ b/debian/patches/patchset-xanmod/net/tcp/bbr3/0001-tcp_bbr-v3-update-TCP-bbr-congestion-control-module-.patch @@ -1,143 +1,55 @@ -From 2e495d77c2494b3ebf22dac97dd5dc025b86ba86 Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Tue, 11 Jun 2019 12:54:22 -0400 -Subject: [PATCH 16/18] net-tcp_bbr: v3: update TCP "bbr" congestion control - module to BBRv3 +From 927fd3110839bb83c4366018652b27eb7b3038e6 Mon Sep 17 00:00:00 2001 +From: Oleksandr Natalenko +Date: Mon, 7 Apr 2025 08:12:56 +0200 +Subject: [PATCH] tcp_bbr: v3: update TCP 'bbr' congestion control module to + BBRv3 -BBR v3 is an enhacement to the BBR v1 algorithm. It's designed to aim for lower -queues, lower loss, and better Reno/CUBIC coexistence than BBR v1. +Original patchset +Link: https://github.com/google/bbr/tree/v3 -BBR v3 maintains the core of BBR v1: an explicit model of the network -path that is two-dimensional, adapting to estimate the (a) maximum -available bandwidth and (b) maximum safe volume of data a flow can -keep in-flight in the network. It maintains the estimated BDP as a -core guide for estimating an appropriate level of in-flight data. - -BBR v3 makes several key enhancements: - -o Its bandwidth-probing time scale is adapted, within bounds, to allow improved -coexistence with Reno and CUBIC. The bandwidth-probing time scale is (a) -extended dynamically based on estimated BDP to improve coexistence with -Reno/CUBIC; (b) bounded by an interactive wall-clock time-scale to be more -scalable and responsive than Reno and CUBIC. - -o Rather than being largely agnostic to loss and ECN marks, it explicitly uses -loss and (DCTCP-style) ECN signals to maintain its model. - -o It aims for lower losses than v1 by adjusting its model to attempt to stay -within loss rate and ECN mark rate bounds (loss_thresh and ecn_thresh, -respectively). - -o It adapts to loss/ECN signals even when the application is running out of -data ("application-limited"), in case the "application-limited" flow is also -"network-limited" (the bw and/or inflight available to this flow is lower than -previously estimated when the flow ran out of data). - -o It has a three-part model: the model explicit three tracks operating points, -where an operating point is a tuple: (bandwidth, inflight). The three operating -points are: - - o latest: the latest measurement from the current round trip - o upper bound: robust, optimistic, long-term upper bound - o lower bound: robust, conservative, short-term lower bound - -These are stored in the following state variables: - - o latest: bw_latest, inflight_latest - o lo: bw_lo, inflight_lo - o hi: bw_hi[2], inflight_hi - -To gain intuition about the meaning of the three operating points, it -may help to consider the analogs in CUBIC, which has a somewhat -analogous three-part model used by its probing state machine: - - BBR param CUBIC param - ----------- ------------- - latest ~ cwnd - lo ~ ssthresh - hi ~ last_max_cwnd - -The analogy is only a loose one, though, since the BBR operating -points are calculated differently, and are 2-dimensional (bw,inflight) -rather than CUBIC's one-dimensional notion of operating point -(inflight). - -o It uses the three-part model to adapt the magnitude of its bandwidth -to match the estimated space available in the buffer, rather than (as -in BBR v1) assuming that it was always acceptable to place 0.25*BDP in -the bottleneck buffer when probing (commodity datacenter switches -commonly do not have that much buffer for WAN flows). When BBR v3 -estimates it hit a buffer limit during probing, its bandwidth probing -then starts gently in case little space is still available in the -buffer, and the accelerates, slowly at first and then rapidly if it -can grow inflight without seeing congestion signals. In such cases, -probing is bounded by inflight_hi + inflight_probe, where -inflight_probe grows as: [0, 1, 2, 4, 8, 16,...]. This allows BBR to -keep losses low and bounded if a bottleneck remains congested, while -rapidly/scalably utilizing free bandwidth when it becomes available. - -o It has a slightly revised state machine, to achieve the goals above. - BBR_BW_PROBE_UP: pushes up inflight to probe for bw/vol - BBR_BW_PROBE_DOWN: drain excess inflight from the queue - BBR_BW_PROBE_CRUISE: use pipe, w/ headroom in queue/pipe - BBR_BW_PROBE_REFILL: try refill the pipe again to 100%, leaving queue empty - -o The estimated BDP: BBR v3 continues to maintain an estimate of the -path's two-way propagation delay, by tracking a windowed min_rtt, and -coordinating (on an as-ndeeded basis) to try to expose the two-way -propagation delay by draining the bottleneck queue. - -BBR v3 continues to use its min_rtt and (currently-applicable) bandwidth -estimate to estimate the current bandwidth-delay product. The estimated BDP -still provides one important guideline for bounding inflight data. However, -because any min-filtered RTT and max-filtered bw inherently tend to both -overestimate, the estimated BDP is often too high; in this case loss or ECN -marks can ensue, in which case BBR v3 adjusts inflight_hi and inflight_lo to -adapt its sending rate and inflight down to match the available capacity of the -path. - -o Space: Note that ICSK_CA_PRIV_SIZE increased. This is because BBR v3 -requires more space. Note that much of the space is due to support for -per-socket parameterization and debugging in this release for research -and debugging. With that state removed, the full "struct bbr" is 140 -bytes, or 144 with padding. This is an increase of 40 bytes over the -existing ca_priv space. - -o Code: BBR v3 reuses many pieces from BBR v1. But it omits the following - significant pieces: - - o "packet conservation" (bbr_set_cwnd_to_recover_or_restore(), - bbr_can_grow_inflight()) - o long-term bandwidth estimator ("policer mode") - - The code layout tries to keep BBR v3 code near the bottom of the - file, so that v1-applicable code in the top does not accidentally - refer to v3 code. - -o Docs: - See the following docs for more details and diagrams decsribing the BBR v3 - algorithm: - https://datatracker.ietf.org/meeting/104/materials/slides-104-iccrg-an-update-on-bbr-00 - https://datatracker.ietf.org/meeting/102/materials/slides-102-iccrg-an-update-on-bbr-work-at-google-00 - -o Internal notes: - For this upstream rebase, Neal started from: - git show fed518041ac6:net/ipv4/tcp_bbr.c > net/ipv4/tcp_bbr.c - then removed dev instrumentation (dynamic get/set for parameters) - and code that was only used by BBRv1 - -Effort: net-tcp_bbr -Origin-9xx-SHA1: 2c84098e60bed6d67dde23cd7538c51dee273102 -Change-Id: I125cf26ba2a7a686f2fa5e87f4c2afceb65f7a05 +Signed-off-by: Oleksandr Natalenko Signed-off-by: Alexandre Frade --- + include/linux/tcp.h | 6 +- include/net/inet_connection_sock.h | 4 +- - include/net/tcp.h | 2 +- + include/net/tcp.h | 72 +- include/uapi/linux/inet_diag.h | 23 + + include/uapi/linux/rtnetlink.h | 4 +- + include/uapi/linux/tcp.h | 1 + net/ipv4/Kconfig | 21 +- - net/ipv4/tcp_bbr.c | 2211 +++++++++++++++++++++------- - 5 files changed, 1740 insertions(+), 521 deletions(-) + net/ipv4/bpf_tcp_ca.c | 4 +- + net/ipv4/tcp.c | 3 + + net/ipv4/tcp_bbr.c | 2233 +++++++++++++++++++++------- + net/ipv4/tcp_cong.c | 1 + + net/ipv4/tcp_input.c | 40 +- + net/ipv4/tcp_minisocks.c | 2 + + net/ipv4/tcp_output.c | 48 +- + net/ipv4/tcp_rate.c | 30 +- + net/ipv4/tcp_timer.c | 1 + + 16 files changed, 1939 insertions(+), 554 deletions(-) +--- a/include/linux/tcp.h ++++ b/include/linux/tcp.h +@@ -248,7 +248,8 @@ struct tcp_sock { + void (*tcp_clean_acked)(struct sock *sk, u32 acked_seq); + #endif + u32 snd_ssthresh; /* Slow start size threshold */ +- u8 recvmsg_inq : 1;/* Indicate # of bytes in queue upon recvmsg */ ++ u32 recvmsg_inq : 1,/* Indicate # of bytes in queue upon recvmsg */ ++ fast_ack_mode:1;/* ack ASAP if >1 rcv_mss received? */ + __cacheline_group_end(tcp_sock_read_rx); + + /* TX read-write hotpath cache lines */ +@@ -305,7 +306,8 @@ struct tcp_sock { + */ + struct tcp_options_received rx_opt; + u8 nonagle : 4,/* Disable Nagle algorithm? */ +- rate_app_limited:1; /* rate_{delivered,interval_us} limited? */ ++ rate_app_limited:1, /* rate_{delivered,interval_us} limited? */ ++ tlp_orig_data_app_limited:1; /* app-limited before TLP rtx? */ + __cacheline_group_end(tcp_sock_write_txrx); + + /* RX read-write hotpath cache lines */ --- a/include/net/inet_connection_sock.h +++ b/include/net/inet_connection_sock.h @@ -132,8 +132,8 @@ struct inet_connection_sock { @@ -153,7 +65,166 @@ Signed-off-by: Alexandre Frade #define ICSK_TIME_RETRANS 1 /* Retransmit timer */ --- a/include/net/tcp.h +++ b/include/net/tcp.h -@@ -2546,7 +2546,7 @@ struct tcp_plb_state { +@@ -379,6 +379,8 @@ static inline void tcp_dec_quickack_mode + #define TCP_ECN_DEMAND_CWR BIT(2) + #define TCP_ECN_SEEN BIT(3) + #define TCP_ECN_MODE_ACCECN BIT(4) ++#define TCP_ECN_LOW BIT(5) ++#define TCP_ECN_ECT_PERMANENT BIT(6) + + #define TCP_ECN_DISABLED 0 + #define TCP_ECN_MODE_PENDING (TCP_ECN_MODE_RFC3168 | TCP_ECN_MODE_ACCECN) +@@ -841,6 +843,15 @@ static inline void tcp_fast_path_check(s + + u32 tcp_delack_max(const struct sock *sk); + ++static inline void tcp_set_ecn_low_from_dst(struct sock *sk, ++ const struct dst_entry *dst) ++{ ++ struct tcp_sock *tp = tcp_sk(sk); ++ ++ if (dst_feature(dst, RTAX_FEATURE_ECN_LOW)) ++ tp->ecn_flags |= TCP_ECN_LOW; ++} ++ + /* Compute the actual rto_min value */ + static inline u32 tcp_rto_min(const struct sock *sk) + { +@@ -946,6 +957,11 @@ static inline u32 tcp_stamp_us_delta(u64 + return max_t(s64, t1 - t0, 0); + } + ++static inline u32 tcp_stamp32_us_delta(u32 t1, u32 t0) ++{ ++ return max_t(s32, t1 - t0, 0); ++} ++ + /* provide the departure time in us unit */ + static inline u64 tcp_skb_timestamp_us(const struct sk_buff *skb) + { +@@ -1044,9 +1060,14 @@ struct tcp_skb_cb { + /* pkts S/ACKed so far upon tx of skb, incl retrans: */ + __u32 delivered; + /* start of send pipeline phase */ +- u64 first_tx_mstamp; ++ u32 first_tx_mstamp; + /* when we reached the "delivered" count */ +- u64 delivered_mstamp; ++ u32 delivered_mstamp; ++#define TCPCB_IN_FLIGHT_BITS 20 ++#define TCPCB_IN_FLIGHT_MAX ((1U << TCPCB_IN_FLIGHT_BITS) - 1) ++ u32 in_flight:20, /* packets in flight at transmit */ ++ unused2:12; ++ u32 lost; /* packets lost so far upon tx of skb */ + } tx; /* only used for outgoing skbs */ + union { + struct inet_skb_parm h4; +@@ -1159,6 +1180,7 @@ enum tcp_ca_event { + CA_EVENT_LOSS, /* loss timeout */ + CA_EVENT_ECN_NO_CE, /* ECT set, but not CE marked */ + CA_EVENT_ECN_IS_CE, /* received CE marked IP packet */ ++ CA_EVENT_TLP_RECOVERY, /* a lost segment was repaired by TLP probe */ + }; + + /* Information about inbound ACK, passed to cong_ops->in_ack_event() */ +@@ -1181,7 +1203,11 @@ enum tcp_ca_ack_event_flags { + #define TCP_CONG_NON_RESTRICTED BIT(0) + /* Requires ECN/ECT set on all packets */ + #define TCP_CONG_NEEDS_ECN BIT(1) +-#define TCP_CONG_MASK (TCP_CONG_NON_RESTRICTED | TCP_CONG_NEEDS_ECN) ++/* Wants notification of CE events (CA_EVENT_ECN_IS_CE, CA_EVENT_ECN_NO_CE). */ ++#define TCP_CONG_WANTS_CE_EVENTS BIT(2) ++#define TCP_CONG_MASK (TCP_CONG_NON_RESTRICTED | \ ++ TCP_CONG_NEEDS_ECN | \ ++ TCP_CONG_WANTS_CE_EVENTS) + + union tcp_cc_info; + +@@ -1201,10 +1227,13 @@ struct ack_sample { + */ + struct rate_sample { + u64 prior_mstamp; /* starting timestamp for interval */ ++ u32 prior_lost; /* tp->lost at "prior_mstamp" */ + u32 prior_delivered; /* tp->delivered at "prior_mstamp" */ + u32 prior_delivered_ce;/* tp->delivered_ce at "prior_mstamp" */ ++ u32 tx_in_flight; /* packets in flight at starting timestamp */ ++ s32 lost; /* number of packets lost over interval */ + s32 delivered; /* number of packets delivered over interval */ +- s32 delivered_ce; /* number of packets delivered w/ CE marks*/ ++ s32 delivered_ce; /* packets delivered w/ CE mark over interval */ + long interval_us; /* time for tp->delivered to incr "delivered" */ + u32 snd_interval_us; /* snd interval for delivered packets */ + u32 rcv_interval_us; /* rcv interval for delivered packets */ +@@ -1215,7 +1244,9 @@ struct rate_sample { + u32 last_end_seq; /* end_seq of most recently ACKed packet */ + bool is_app_limited; /* is sample from packet with bubble in pipe? */ + bool is_retrans; /* is sample from retransmission? */ ++ bool is_acking_tlp_retrans_seq; /* ACKed a TLP retransmit sequence? */ + bool is_ack_delayed; /* is this (likely) a delayed ACK? */ ++ bool is_ece; /* did this ACK have ECN marked? */ + }; + + struct tcp_congestion_ops { +@@ -1239,8 +1270,11 @@ struct tcp_congestion_ops { + /* hook for packet ack accounting (optional) */ + void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample); + +- /* override sysctl_tcp_min_tso_segs */ +- u32 (*min_tso_segs)(struct sock *sk); ++ /* pick target number of segments per TSO/GSO skb (optional): */ ++ u32 (*tso_segs)(struct sock *sk, unsigned int mss_now); ++ ++ /* react to a specific lost skb (optional) */ ++ void (*skb_marked_lost)(struct sock *sk, const struct sk_buff *skb); + + /* call when packets are delivered to update cwnd and pacing rate, + * after all the ca_state processing. (optional) +@@ -1306,6 +1340,14 @@ static inline char *tcp_ca_get_name_by_k + } + #endif + ++static inline bool tcp_ca_wants_ce_events(const struct sock *sk) ++{ ++ const struct inet_connection_sock *icsk = inet_csk(sk); ++ ++ return icsk->icsk_ca_ops->flags & (TCP_CONG_NEEDS_ECN | ++ TCP_CONG_WANTS_CE_EVENTS); ++} ++ + static inline bool tcp_ca_needs_ecn(const struct sock *sk) + { + const struct inet_connection_sock *icsk = inet_csk(sk); +@@ -1325,6 +1367,7 @@ static inline void tcp_ca_event(struct s + void tcp_set_ca_state(struct sock *sk, const u8 ca_state); + + /* From tcp_rate.c */ ++void tcp_set_tx_in_flight(struct sock *sk, struct sk_buff *skb); + void tcp_rate_skb_sent(struct sock *sk, struct sk_buff *skb); + void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, + struct rate_sample *rs); +@@ -1337,6 +1380,21 @@ static inline bool tcp_skb_sent_after(u6 + return t1 > t2 || (t1 == t2 && after(seq1, seq2)); + } + ++/* If a retransmit failed due to local qdisc congestion or other local issues, ++ * then we may have called tcp_set_skb_tso_segs() to increase the number of ++ * segments in the skb without increasing the tx.in_flight. In all other cases, ++ * the tx.in_flight should be at least as big as the pcount of the sk_buff. We ++ * do not have the state to know whether a retransmit failed due to local qdisc ++ * congestion or other local issues, so to avoid spurious warnings we consider ++ * that any skb marked lost may have suffered that fate. ++ */ ++static inline bool tcp_skb_tx_in_flight_is_suspicious(u32 skb_pcount, ++ u32 skb_sacked_flags, ++ u32 tx_in_flight) ++{ ++ return (skb_pcount > tx_in_flight) && !(skb_sacked_flags & TCPCB_LOST); ++} ++ + /* These functions determine how the current flow behaves in respect of SACK + * handling. SACK is negotiated with the peer, and therefore it can vary + * between different flows. +@@ -2490,7 +2548,7 @@ struct tcp_plb_state { u8 consec_cong_rounds:5, /* consecutive congested rounds */ unused:3; u32 pause_until; /* jiffies32 when PLB can resume rerouting */ @@ -194,6 +265,34 @@ Signed-off-by: Alexandre Frade }; union tcp_cc_info { +--- a/include/uapi/linux/rtnetlink.h ++++ b/include/uapi/linux/rtnetlink.h +@@ -517,12 +517,14 @@ enum { + #define RTAX_FEATURE_TIMESTAMP (1 << 2) /* unused */ + #define RTAX_FEATURE_ALLFRAG (1 << 3) /* unused */ + #define RTAX_FEATURE_TCP_USEC_TS (1 << 4) ++#define RTAX_FEATURE_ECN_LOW (1 << 5) + + #define RTAX_FEATURE_MASK (RTAX_FEATURE_ECN | \ + RTAX_FEATURE_SACK | \ + RTAX_FEATURE_TIMESTAMP | \ + RTAX_FEATURE_ALLFRAG | \ +- RTAX_FEATURE_TCP_USEC_TS) ++ RTAX_FEATURE_TCP_USEC_TS | \ ++ RTAX_FEATURE_ECN_LOW) + + struct rta_session { + __u8 proto; +--- a/include/uapi/linux/tcp.h ++++ b/include/uapi/linux/tcp.h +@@ -185,6 +185,7 @@ enum tcp_fastopen_client_fail { + #define TCPI_OPT_SYN_DATA 32 /* SYN-ACK acked data in SYN sent or rcvd */ + #define TCPI_OPT_USEC_TS 64 /* usec timestamps */ + #define TCPI_OPT_TFO_CHILD 128 /* child from a Fast Open option on SYN */ ++#define TCPI_OPT_ECN_LOW 256 /* Low-latency ECN enabled at conn init */ + + /* + * Sender's congestion state indicating normal or abnormal situations --- a/net/ipv4/Kconfig +++ b/net/ipv4/Kconfig @@ -669,15 +669,18 @@ config TCP_CONG_BBR @@ -224,6 +323,45 @@ Signed-off-by: Alexandre Frade choice prompt "Default TCP congestion control" +--- a/net/ipv4/bpf_tcp_ca.c ++++ b/net/ipv4/bpf_tcp_ca.c +@@ -280,7 +280,7 @@ static void bpf_tcp_ca_pkts_acked(struct + { + } + +-static u32 bpf_tcp_ca_min_tso_segs(struct sock *sk) ++static u32 bpf_tcp_ca_tso_segs(struct sock *sk, unsigned int mss_now) + { + return 0; + } +@@ -315,7 +315,7 @@ static struct tcp_congestion_ops __bpf_o + .cwnd_event = bpf_tcp_ca_cwnd_event, + .in_ack_event = bpf_tcp_ca_in_ack_event, + .pkts_acked = bpf_tcp_ca_pkts_acked, +- .min_tso_segs = bpf_tcp_ca_min_tso_segs, ++ .tso_segs = bpf_tcp_ca_tso_segs, + .cong_control = bpf_tcp_ca_cong_control, + .undo_cwnd = bpf_tcp_ca_undo_cwnd, + .sndbuf_expand = bpf_tcp_ca_sndbuf_expand, +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3442,6 +3442,7 @@ int tcp_disconnect(struct sock *sk, int + tp->rx_opt.dsack = 0; + tp->rx_opt.num_sacks = 0; + tp->rcv_ooopack = 0; ++ tp->fast_ack_mode = 0; + + + /* Clean up fastopen related fields */ +@@ -4189,6 +4190,8 @@ void tcp_get_info(struct sock *sk, struc + info->tcpi_options |= TCPI_OPT_ECN; + if (tp->ecn_flags & TCP_ECN_SEEN) + info->tcpi_options |= TCPI_OPT_ECN_SEEN; ++ if (tp->ecn_flags & TCP_ECN_LOW) ++ info->tcpi_options |= TCPI_OPT_ECN_LOW; + if (tp->syn_data_acked) + info->tcpi_options |= TCPI_OPT_SYN_DATA; + if (tp->tcp_usec_ts) --- a/net/ipv4/tcp_bbr.c +++ b/net/ipv4/tcp_bbr.c @@ -1,18 +1,19 @@ @@ -587,7 +725,7 @@ Signed-off-by: Alexandre Frade + */ +static bool bbr_can_use_ecn(const struct sock *sk) +{ -+ struct tcp_sock *tp = tcp_sk(sk); ++ const struct tcp_sock *tp = tcp_sk(sk); + + return tcp_ecn_mode_any(tp) && + (tcp_sk(sk)->ecn_flags & TCP_ECN_LOW); @@ -671,33 +809,26 @@ Signed-off-by: Alexandre Frade } /* Pace using current bw estimate and a gain factor. */ -@@ -295,31 +475,38 @@ static void bbr_set_pacing_rate(struct s +@@ -295,26 +475,48 @@ static void bbr_set_pacing_rate(struct s WRITE_ONCE(sk->sk_pacing_rate, rate); } -/* override sysctl_tcp_min_tso_segs */ -__bpf_kfunc static u32 bbr_min_tso_segs(struct sock *sk) --{ -- return READ_ONCE(sk->sk_pacing_rate) < (bbr_min_tso_rate >> 3) ? 1 : 2; --} -- --/* Return the number of segments BBR would like in a TSO/GSO skb, given -- * a particular max gso size as a constraint. +/* Return the number of segments BBR would like in a TSO/GSO skb, given a + * particular max gso size as a constraint. TODO: make this simpler and more + * consistent by switching bbr to just call tcp_tso_autosize(). - */ - static u32 bbr_tso_segs_generic(struct sock *sk, unsigned int mss_now, - u32 gso_max_size) - { -- u32 segs; ++ */ ++static u32 bbr_tso_segs_generic(struct sock *sk, unsigned int mss_now, ++ u32 gso_max_size) ++{ + struct bbr *bbr = inet_csk_ca(sk); + u32 segs, r; - u64 bytes; - - /* Budget a TSO/GSO burst size allowance based on bw (pacing_rate). */ - bytes = READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift); - ++ u64 bytes; ++ ++ /* Budget a TSO/GSO burst size allowance based on bw (pacing_rate). */ ++ bytes = READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift); ++ + /* Budget a TSO/GSO burst size allowance based on min_rtt. For every + * K = 2^tso_rtt_shift microseconds of min_rtt, halve the burst. + * The min_rtt-based burst allowance is: 64 KBytes / 2^(min_rtt/K) @@ -708,29 +839,39 @@ Signed-off-by: Alexandre Frade + bytes += GSO_LEGACY_MAX_SIZE >> r; + } + - bytes = min_t(u32, bytes, gso_max_size - 1 - MAX_TCP_HEADER); -- segs = max_t(u32, bytes / mss_now, bbr_min_tso_segs(sk)); ++ bytes = min_t(u32, bytes, gso_max_size - 1 - MAX_TCP_HEADER); + segs = max_t(u32, bytes / mss_now, + sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs); - return segs; - } - - /* Custom tcp_tso_autosize() for BBR, used at transmit time to cap skb size. */ --static u32 bbr_tso_segs(struct sock *sk, unsigned int mss_now) ++ return segs; ++} ++ ++/* Custom tcp_tso_autosize() for BBR, used at transmit time to cap skb size. */ +__bpf_kfunc static u32 bbr_tso_segs(struct sock *sk, unsigned int mss_now) { - return bbr_tso_segs_generic(sk, mss_now, sk->sk_gso_max_size); +- return READ_ONCE(sk->sk_pacing_rate) < (bbr_min_tso_rate >> 3) ? 1 : 2; ++ return bbr_tso_segs_generic(sk, mss_now, sk->sk_gso_max_size); } -@@ -329,7 +516,7 @@ static u32 bbr_tso_segs_goal(struct sock + ++/* Like bbr_tso_segs(), using mss_cache, ignoring driver's sk_gso_max_size. */ + static u32 bbr_tso_segs_goal(struct sock *sk) { struct tcp_sock *tp = tcp_sk(sk); +- u32 segs, bytes; -- return bbr_tso_segs_generic(sk, tp->mss_cache, GSO_MAX_SIZE); -+ return bbr_tso_segs_generic(sk, tp->mss_cache, GSO_LEGACY_MAX_SIZE); +- /* Sort of tcp_tso_autosize() but ignoring +- * driver provided sk_gso_max_size. +- */ +- bytes = min_t(unsigned long, +- READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift), +- GSO_LEGACY_MAX_SIZE - 1 - MAX_TCP_HEADER); +- segs = max_t(u32, bytes / tp->mss_cache, bbr_min_tso_segs(sk)); +- +- return min(segs, 0x7FU); ++ return bbr_tso_segs_generic(sk, tp->mss_cache, GSO_LEGACY_MAX_SIZE); } /* Save "last known good" cwnd so we can restore it after losses or PROBE_RTT */ -@@ -349,7 +536,9 @@ __bpf_kfunc static void bbr_cwnd_event(s +@@ -334,7 +536,9 @@ __bpf_kfunc static void bbr_cwnd_event(s struct tcp_sock *tp = tcp_sk(sk); struct bbr *bbr = inet_csk_ca(sk); @@ -741,7 +882,7 @@ Signed-off-by: Alexandre Frade bbr->idle_restart = 1; bbr->ack_epoch_mstamp = tp->tcp_mstamp; bbr->ack_epoch_acked = 0; -@@ -360,6 +549,16 @@ __bpf_kfunc static void bbr_cwnd_event(s +@@ -345,6 +549,16 @@ __bpf_kfunc static void bbr_cwnd_event(s bbr_set_pacing_rate(sk, bbr_bw(sk), BBR_UNIT); else if (bbr->mode == BBR_PROBE_RTT) bbr_check_probe_rtt_done(sk); @@ -758,7 +899,7 @@ Signed-off-by: Alexandre Frade } } -@@ -382,10 +581,10 @@ static u32 bbr_bdp(struct sock *sk, u32 +@@ -367,10 +581,10 @@ static u32 bbr_bdp(struct sock *sk, u32 * default. This should only happen when the connection is not using TCP * timestamps and has retransmitted all of the SYN/SYNACK/data packets * ACKed so far. In this case, an RTO can cut cwnd to 1, in which @@ -771,7 +912,7 @@ Signed-off-by: Alexandre Frade w = (u64)bw * bbr->min_rtt_us; -@@ -402,23 +601,23 @@ static u32 bbr_bdp(struct sock *sk, u32 +@@ -387,23 +601,23 @@ static u32 bbr_bdp(struct sock *sk, u32 * - one skb in sending host Qdisc, * - one skb in sending host TSO/GSO engine * - one skb being received by receiver host LRO/GRO/delayed-ACK engine @@ -803,7 +944,7 @@ Signed-off-by: Alexandre Frade cwnd += 2; return cwnd; -@@ -473,10 +672,10 @@ static u32 bbr_ack_aggregation_cwnd(stru +@@ -458,10 +672,10 @@ static u32 bbr_ack_aggregation_cwnd(stru { u32 max_aggr_cwnd, aggr_cwnd = 0; @@ -816,7 +957,7 @@ Signed-off-by: Alexandre Frade >> BBR_SCALE; aggr_cwnd = min(aggr_cwnd, max_aggr_cwnd); } -@@ -484,66 +683,27 @@ static u32 bbr_ack_aggregation_cwnd(stru +@@ -469,66 +683,27 @@ static u32 bbr_ack_aggregation_cwnd(stru return aggr_cwnd; } @@ -890,7 +1031,7 @@ Signed-off-by: Alexandre Frade target_cwnd = bbr_bdp(sk, bw, gain); /* Increment the cwnd to account for excess ACKed data that seems -@@ -552,74 +712,26 @@ static void bbr_set_cwnd(struct sock *sk +@@ -537,74 +712,26 @@ static void bbr_set_cwnd(struct sock *sk target_cwnd += bbr_ack_aggregation_cwnd(sk); target_cwnd = bbr_quantization_budget(sk, target_cwnd); @@ -982,7 +1123,7 @@ Signed-off-by: Alexandre Frade } static void bbr_reset_startup_mode(struct sock *sk) -@@ -629,191 +741,49 @@ static void bbr_reset_startup_mode(struc +@@ -614,191 +741,49 @@ static void bbr_reset_startup_mode(struc bbr->mode = BBR_STARTUP; } @@ -1060,9 +1201,11 @@ Signed-off-by: Alexandre Frade + * returns packets delivered since previous round start plus this ACK. */ -static void bbr_lt_bw_sampling(struct sock *sk, const struct rate_sample *rs) --{ -- struct tcp_sock *tp = tcp_sk(sk); -- struct bbr *bbr = inet_csk_ca(sk); ++static u32 bbr_update_round_start(struct sock *sk, ++ const struct rate_sample *rs, struct bbr_context *ctx) + { + struct tcp_sock *tp = tcp_sk(sk); + struct bbr *bbr = inet_csk_ca(sk); - u32 lost, delivered; - u64 bw; - u32 t; @@ -1133,11 +1276,9 @@ Signed-off-by: Alexandre Frade - -/* Estimate the bandwidth based on how fast packets are delivered */ -static void bbr_update_bw(struct sock *sk, const struct rate_sample *rs) -+static u32 bbr_update_round_start(struct sock *sk, -+ const struct rate_sample *rs, struct bbr_context *ctx) - { - struct tcp_sock *tp = tcp_sk(sk); - struct bbr *bbr = inet_csk_ca(sk); +-{ +- struct tcp_sock *tp = tcp_sk(sk); +- struct bbr *bbr = inet_csk_ca(sk); - u64 bw; + u32 round_delivered = 0; @@ -1198,7 +1339,7 @@ Signed-off-by: Alexandre Frade } /* Estimates the windowed max degree of ack aggregation. -@@ -827,7 +797,7 @@ static void bbr_update_bw(struct sock *s +@@ -812,7 +797,7 @@ static void bbr_update_bw(struct sock *s * * Max extra_acked is clamped by cwnd and bw * bbr_extra_acked_max_us (100 ms). * Max filter is an approximate sliding window of 5-10 (packet timed) round @@ -1207,7 +1348,7 @@ Signed-off-by: Alexandre Frade */ static void bbr_update_ack_aggregation(struct sock *sk, const struct rate_sample *rs) -@@ -835,15 +805,19 @@ static void bbr_update_ack_aggregation(s +@@ -820,15 +805,19 @@ static void bbr_update_ack_aggregation(s u32 epoch_us, expected_acked, extra_acked; struct bbr *bbr = inet_csk_ca(sk); struct tcp_sock *tp = tcp_sk(sk); @@ -1229,7 +1370,7 @@ Signed-off-by: Alexandre Frade bbr->extra_acked_win_rtts = 0; bbr->extra_acked_win_idx = bbr->extra_acked_win_idx ? 0 : 1; -@@ -877,49 +851,6 @@ static void bbr_update_ack_aggregation(s +@@ -862,49 +851,6 @@ static void bbr_update_ack_aggregation(s bbr->extra_acked[bbr->extra_acked_win_idx] = extra_acked; } @@ -1279,7 +1420,7 @@ Signed-off-by: Alexandre Frade static void bbr_check_probe_rtt_done(struct sock *sk) { struct tcp_sock *tp = tcp_sk(sk); -@@ -929,9 +860,9 @@ static void bbr_check_probe_rtt_done(str +@@ -914,9 +860,9 @@ static void bbr_check_probe_rtt_done(str after(tcp_jiffies32, bbr->probe_rtt_done_stamp))) return; @@ -1291,7 +1432,7 @@ Signed-off-by: Alexandre Frade } /* The goal of PROBE_RTT mode is to have BBR flows cooperatively and -@@ -957,23 +888,35 @@ static void bbr_update_min_rtt(struct so +@@ -942,23 +888,35 @@ static void bbr_update_min_rtt(struct so { struct tcp_sock *tp = tcp_sk(sk); struct bbr *bbr = inet_csk_ca(sk); @@ -1336,7 +1477,7 @@ Signed-off-by: Alexandre Frade } if (bbr->mode == BBR_PROBE_RTT) { -@@ -982,9 +925,9 @@ static void bbr_update_min_rtt(struct so +@@ -967,9 +925,9 @@ static void bbr_update_min_rtt(struct so (tp->delivered + tcp_packets_in_flight(tp)) ? : 1; /* Maintain min packets in flight for max(200 ms, 1 round). */ if (!bbr->probe_rtt_done_stamp && @@ -1348,7 +1489,7 @@ Signed-off-by: Alexandre Frade bbr->probe_rtt_round_done = 0; bbr->next_rtt_delivered = tp->delivered; } else if (bbr->probe_rtt_done_stamp) { -@@ -1005,18 +948,20 @@ static void bbr_update_gains(struct sock +@@ -990,18 +948,20 @@ static void bbr_update_gains(struct sock switch (bbr->mode) { case BBR_STARTUP: @@ -1377,7 +1518,7 @@ Signed-off-by: Alexandre Frade break; case BBR_PROBE_RTT: bbr->pacing_gain = BBR_UNIT; -@@ -1028,27 +973,1108 @@ static void bbr_update_gains(struct sock +@@ -1013,27 +973,1108 @@ static void bbr_update_gains(struct sock } } @@ -1437,8 +1578,7 @@ Signed-off-by: Alexandre Frade + +/* Has the given amount of time elapsed since we marked the phase start? */ +static bool bbr_has_elapsed_in_phase(const struct sock *sk, u32 interval_us) - { -- bbr_update_bw(sk, rs); ++{ + const struct tcp_sock *tp = tcp_sk(sk); + const struct bbr *bbr = inet_csk_ca(sk); + @@ -2384,7 +2524,8 @@ Signed-off-by: Alexandre Frade + +static void bbr_update_model(struct sock *sk, const struct rate_sample *rs, + struct bbr_context *ctx) -+{ + { +- bbr_update_bw(sk, rs); + bbr_update_congestion_signals(sk, rs, ctx); bbr_update_ack_aggregation(sk, rs); - bbr_update_cycle_phase(sk, rs); @@ -2496,7 +2637,7 @@ Signed-off-by: Alexandre Frade } __bpf_kfunc static void bbr_init(struct sock *sk) -@@ -1056,20 +2082,21 @@ __bpf_kfunc static void bbr_init(struct +@@ -1041,20 +2082,21 @@ __bpf_kfunc static void bbr_init(struct struct tcp_sock *tp = tcp_sk(sk); struct bbr *bbr = inet_csk_ca(sk); @@ -2523,7 +2664,7 @@ Signed-off-by: Alexandre Frade bbr->has_seen_rtt = 0; bbr_init_pacing_rate_from_rtt(sk); -@@ -1080,7 +2107,7 @@ __bpf_kfunc static void bbr_init(struct +@@ -1065,7 +2107,7 @@ __bpf_kfunc static void bbr_init(struct bbr->full_bw_cnt = 0; bbr->cycle_mstamp = 0; bbr->cycle_idx = 0; @@ -2532,7 +2673,7 @@ Signed-off-by: Alexandre Frade bbr_reset_startup_mode(sk); bbr->ack_epoch_mstamp = tp->tcp_mstamp; -@@ -1090,78 +2117,236 @@ __bpf_kfunc static void bbr_init(struct +@@ -1075,82 +2117,243 @@ __bpf_kfunc static void bbr_init(struct bbr->extra_acked[0] = 0; bbr->extra_acked[1] = 0; @@ -2573,6 +2714,9 @@ Signed-off-by: Alexandre Frade + bbr->plb.pause_until = 0; + + tp->fast_ack_mode = bbr_fast_ack_mode ? 1 : 0; ++ ++ if (bbr_can_use_ecn(sk)) ++ tp->ecn_flags |= TCP_ECN_ECT_PERMANENT; } -__bpf_kfunc static u32 bbr_sndbuf_expand(struct sock *sk) @@ -2797,7 +2941,12 @@ Signed-off-by: Alexandre Frade .undo_cwnd = bbr_undo_cwnd, .cwnd_event = bbr_cwnd_event, .ssthresh = bbr_ssthresh, -@@ -1174,10 +2359,11 @@ BTF_KFUNCS_START(tcp_bbr_check_kfunc_ids +- .min_tso_segs = bbr_min_tso_segs, ++ .tso_segs = bbr_tso_segs, + .get_info = bbr_get_info, + .set_state = bbr_set_state, + }; +@@ -1159,10 +2362,11 @@ BTF_KFUNCS_START(tcp_bbr_check_kfunc_ids BTF_ID_FLAGS(func, bbr_init) BTF_ID_FLAGS(func, bbr_main) BTF_ID_FLAGS(func, bbr_sndbuf_expand) @@ -2810,7 +2959,7 @@ Signed-off-by: Alexandre Frade BTF_ID_FLAGS(func, bbr_set_state) BTF_KFUNCS_END(tcp_bbr_check_kfunc_ids) -@@ -1210,5 +2396,12 @@ MODULE_AUTHOR("Van Jacobson "); MODULE_AUTHOR("Yuchung Cheng "); MODULE_AUTHOR("Soheil Hassas Yeganeh "); @@ -2823,3 +2972,353 @@ Signed-off-by: Alexandre Frade MODULE_LICENSE("Dual BSD/GPL"); MODULE_DESCRIPTION("TCP BBR (Bottleneck Bandwidth and RTT)"); +MODULE_VERSION(__stringify(BBR_VERSION)); +--- a/net/ipv4/tcp_cong.c ++++ b/net/ipv4/tcp_cong.c +@@ -237,6 +237,7 @@ void tcp_init_congestion_control(struct + struct inet_connection_sock *icsk = inet_csk(sk); + + tcp_sk(sk)->prior_ssthresh = 0; ++ tcp_sk(sk)->fast_ack_mode = 0; + if (icsk->icsk_ca_ops->init) + icsk->icsk_ca_ops->init(sk); + if (tcp_ca_needs_ecn(sk)) +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -381,7 +381,7 @@ static void tcp_data_ecn_check(struct so + tcp_enter_quickack_mode(sk, 2); + break; + case INET_ECN_CE: +- if (tcp_ca_needs_ecn(sk)) ++ if (tcp_ca_wants_ce_events(sk)) + tcp_ca_event(sk, CA_EVENT_ECN_IS_CE); + + if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) { +@@ -392,7 +392,7 @@ static void tcp_data_ecn_check(struct so + tp->ecn_flags |= TCP_ECN_SEEN; + break; + default: +- if (tcp_ca_needs_ecn(sk)) ++ if (tcp_ca_wants_ce_events(sk)) + tcp_ca_event(sk, CA_EVENT_ECN_NO_CE); + tp->ecn_flags |= TCP_ECN_SEEN; + break; +@@ -1134,7 +1134,12 @@ static void tcp_verify_retransmit_hint(s + */ + static void tcp_notify_skb_loss_event(struct tcp_sock *tp, const struct sk_buff *skb) + { ++ struct sock *sk = (struct sock *)tp; ++ const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops; ++ + tp->lost += tcp_skb_pcount(skb); ++ if (ca_ops->skb_marked_lost) ++ ca_ops->skb_marked_lost(sk, skb); + } + + void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb) +@@ -1506,6 +1511,17 @@ static bool tcp_shifted_skb(struct sock + WARN_ON_ONCE(tcp_skb_pcount(skb) < pcount); + tcp_skb_pcount_add(skb, -pcount); + ++ /* Adjust tx.in_flight as pcount is shifted from skb to prev. */ ++ if (WARN_ONCE(TCP_SKB_CB(skb)->tx.in_flight < pcount, ++ "prev in_flight: %u skb in_flight: %u pcount: %u", ++ TCP_SKB_CB(prev)->tx.in_flight, ++ TCP_SKB_CB(skb)->tx.in_flight, ++ pcount)) ++ TCP_SKB_CB(skb)->tx.in_flight = 0; ++ else ++ TCP_SKB_CB(skb)->tx.in_flight -= pcount; ++ TCP_SKB_CB(prev)->tx.in_flight += pcount; ++ + /* When we're adding to gso_segs == 1, gso_size will be zero, + * in theory this shouldn't be necessary but as long as DSACK + * code can come after this skb later on it's better to keep +@@ -3856,7 +3872,8 @@ static int tcp_replace_ts_recent(struct + /* This routine deals with acks during a TLP episode and ends an episode by + * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack + */ +-static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) ++static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag, ++ struct rate_sample *rs) + { + struct tcp_sock *tp = tcp_sk(sk); + +@@ -3873,6 +3890,7 @@ static void tcp_process_tlp_ack(struct s + /* ACK advances: there was a loss, so reduce cwnd. Reset + * tlp_high_seq in tcp_init_cwnd_reduction() + */ ++ tcp_ca_event(sk, CA_EVENT_TLP_RECOVERY); + tcp_init_cwnd_reduction(sk); + tcp_set_ca_state(sk, TCP_CA_CWR); + tcp_end_cwnd_reduction(sk); +@@ -3883,6 +3901,11 @@ static void tcp_process_tlp_ack(struct s + FLAG_NOT_DUP | FLAG_DATA_SACKED))) { + /* Pure dupack: original and TLP probe arrived; no loss */ + tp->tlp_high_seq = 0; ++ } else { ++ /* This ACK matches a TLP retransmit. We cannot yet tell if ++ * this ACK is for the original or the TLP retransmit. ++ */ ++ rs->is_acking_tlp_retrans_seq = 1; + } + } + +@@ -4002,6 +4025,7 @@ static int tcp_ack(struct sock *sk, cons + + prior_fack = tcp_is_sack(tp) ? tcp_highest_sack_seq(tp) : tp->snd_una; + rs.prior_in_flight = tcp_packets_in_flight(tp); ++ tcp_rate_check_app_limited(sk); + + /* ts_recent update must be made after we are sure that the packet + * is in window. +@@ -4067,7 +4091,7 @@ static int tcp_ack(struct sock *sk, cons + tcp_in_ack_event(sk, flag); + + if (tp->tlp_high_seq) +- tcp_process_tlp_ack(sk, ack, flag); ++ tcp_process_tlp_ack(sk, ack, flag, &rs); + + if (tcp_ack_is_dubious(sk, flag)) { + if (!(flag & (FLAG_SND_UNA_ADVANCED | +@@ -4091,6 +4115,7 @@ static int tcp_ack(struct sock *sk, cons + delivered = tcp_newly_delivered(sk, delivered, flag); + lost = tp->lost - lost; /* freshly marked lost */ + rs.is_ack_delayed = !!(flag & FLAG_ACK_MAYBE_DELAYED); ++ rs.is_ece = !!(flag & FLAG_ECE); + tcp_rate_gen(sk, delivered, lost, is_sack_reneg, sack_state.rate); + tcp_cong_control(sk, ack, delivered, flag, sack_state.rate); + tcp_xmit_recovery(sk, rexmit); +@@ -4111,7 +4136,7 @@ no_queue: + tcp_ack_probe(sk); + + if (tp->tlp_high_seq) +- tcp_process_tlp_ack(sk, ack, flag); ++ tcp_process_tlp_ack(sk, ack, flag, &rs); + return 1; + + old_ack: +@@ -5795,13 +5820,14 @@ static void __tcp_ack_snd_check(struct s + + /* More than one full frame received... */ + if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss && ++ (tp->fast_ack_mode == 1 || + /* ... and right edge of window advances far enough. + * (tcp_recvmsg() will send ACK otherwise). + * If application uses SO_RCVLOWAT, we want send ack now if + * we have not received enough bytes to satisfy the condition. + */ +- (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat || +- __tcp_select_window(sk) >= tp->rcv_wnd)) || ++ (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat || ++ __tcp_select_window(sk) >= tp->rcv_wnd))) || + /* We ACK each frame or... */ + tcp_in_quickack_mode(sk) || + /* Protocol state mandates a one-time immediate ACK */ +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -475,6 +475,8 @@ void tcp_ca_openreq_child(struct sock *s + u32 ca_key = dst_metric(dst, RTAX_CC_ALGO); + bool ca_got_dst = false; + ++ tcp_set_ecn_low_from_dst(sk, dst); ++ + if (ca_key != TCP_CA_UNSPEC) { + const struct tcp_congestion_ops *ca; + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -339,10 +339,9 @@ static void tcp_ecn_send_syn(struct sock + bool bpf_needs_ecn = tcp_bpf_ca_needs_ecn(sk); + bool use_ecn = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_ecn) == 1 || + tcp_ca_needs_ecn(sk) || bpf_needs_ecn; ++ const struct dst_entry *dst = __sk_dst_get(sk); + + if (!use_ecn) { +- const struct dst_entry *dst = __sk_dst_get(sk); +- + if (dst && dst_feature(dst, RTAX_FEATURE_ECN)) + use_ecn = true; + } +@@ -354,6 +353,9 @@ static void tcp_ecn_send_syn(struct sock + tcp_ecn_mode_set(tp, TCP_ECN_MODE_RFC3168); + if (tcp_ca_needs_ecn(sk) || bpf_needs_ecn) + INET_ECN_xmit(sk); ++ ++ if (dst) ++ tcp_set_ecn_low_from_dst(sk, dst); + } + } + +@@ -391,7 +393,8 @@ static void tcp_ecn_send(struct sock *sk + th->cwr = 1; + skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN; + } +- } else if (!tcp_ca_needs_ecn(sk)) { ++ } else if (!(tp->ecn_flags & TCP_ECN_ECT_PERMANENT) && ++ !tcp_ca_needs_ecn(sk)) { + /* ACK or retransmitted segment: clear ECT|CE */ + INET_ECN_dontxmit(sk); + } +@@ -1614,7 +1617,7 @@ int tcp_fragment(struct sock *sk, enum t + { + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *buff; +- int old_factor; ++ int old_factor, inflight_prev; + long limit; + u16 flags; + int nlen; +@@ -1689,6 +1692,30 @@ int tcp_fragment(struct sock *sk, enum t + + if (diff) + tcp_adjust_pcount(sk, skb, diff); ++ ++ inflight_prev = TCP_SKB_CB(skb)->tx.in_flight - old_factor; ++ if (inflight_prev < 0) { ++ WARN_ONCE(tcp_skb_tx_in_flight_is_suspicious( ++ old_factor, ++ TCP_SKB_CB(skb)->sacked, ++ TCP_SKB_CB(skb)->tx.in_flight), ++ "inconsistent: tx.in_flight: %u " ++ "old_factor: %d mss: %u sacked: %u " ++ "1st pcount: %d 2nd pcount: %d " ++ "1st len: %u 2nd len: %u ", ++ TCP_SKB_CB(skb)->tx.in_flight, old_factor, ++ mss_now, TCP_SKB_CB(skb)->sacked, ++ tcp_skb_pcount(skb), tcp_skb_pcount(buff), ++ skb->len, buff->len); ++ inflight_prev = 0; ++ } ++ /* Set 1st tx.in_flight as if 1st were sent by itself: */ ++ TCP_SKB_CB(skb)->tx.in_flight = inflight_prev + ++ tcp_skb_pcount(skb); ++ /* Set 2nd tx.in_flight with new 1st and 2nd pcounts: */ ++ TCP_SKB_CB(buff)->tx.in_flight = inflight_prev + ++ tcp_skb_pcount(skb) + ++ tcp_skb_pcount(buff); + } + + /* Link BUFF into the send queue. */ +@@ -2045,13 +2072,12 @@ static u32 tcp_tso_autosize(const struct + static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now) + { + const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops; +- u32 min_tso, tso_segs; +- +- min_tso = ca_ops->min_tso_segs ? +- ca_ops->min_tso_segs(sk) : +- READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs); ++ u32 tso_segs; + +- tso_segs = tcp_tso_autosize(sk, mss_now, min_tso); ++ tso_segs = ca_ops->tso_segs ? ++ ca_ops->tso_segs(sk, mss_now) : ++ tcp_tso_autosize(sk, mss_now, ++ sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs); + return min_t(u32, tso_segs, sk->sk_gso_max_segs); + } + +@@ -2776,6 +2802,7 @@ static bool tcp_write_xmit(struct sock * + skb_set_delivery_time(skb, tp->tcp_wstamp_ns, SKB_CLOCK_MONOTONIC); + list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue); + tcp_init_tso_segs(skb, mss_now); ++ tcp_set_tx_in_flight(sk, skb); + goto repair; /* Skip network transmission */ + } + +@@ -2988,6 +3015,7 @@ void tcp_send_loss_probe(struct sock *sk + if (WARN_ON(!skb || !tcp_skb_pcount(skb))) + goto rearm_timer; + ++ tp->tlp_orig_data_app_limited = TCP_SKB_CB(skb)->tx.is_app_limited; + if (__tcp_retransmit_skb(sk, skb, 1)) + goto rearm_timer; + +--- a/net/ipv4/tcp_rate.c ++++ b/net/ipv4/tcp_rate.c +@@ -34,6 +34,24 @@ + * ready to send in the write queue. + */ + ++void tcp_set_tx_in_flight(struct sock *sk, struct sk_buff *skb) ++{ ++ struct tcp_sock *tp = tcp_sk(sk); ++ u32 in_flight; ++ ++ /* Check, sanitize, and record packets in flight after skb was sent. */ ++ in_flight = tcp_packets_in_flight(tp) + tcp_skb_pcount(skb); ++ if (WARN_ONCE(in_flight > TCPCB_IN_FLIGHT_MAX, ++ "insane in_flight %u cc %s mss %u " ++ "cwnd %u pif %u %u %u %u\n", ++ in_flight, inet_csk(sk)->icsk_ca_ops->name, ++ tp->mss_cache, tp->snd_cwnd, ++ tp->packets_out, tp->retrans_out, ++ tp->sacked_out, tp->lost_out)) ++ in_flight = TCPCB_IN_FLIGHT_MAX; ++ TCP_SKB_CB(skb)->tx.in_flight = in_flight; ++} ++ + /* Snapshot the current delivery information in the skb, to generate + * a rate sample later when the skb is (s)acked in tcp_rate_skb_delivered(). + */ +@@ -66,7 +84,9 @@ void tcp_rate_skb_sent(struct sock *sk, + TCP_SKB_CB(skb)->tx.delivered_mstamp = tp->delivered_mstamp; + TCP_SKB_CB(skb)->tx.delivered = tp->delivered; + TCP_SKB_CB(skb)->tx.delivered_ce = tp->delivered_ce; ++ TCP_SKB_CB(skb)->tx.lost = tp->lost; + TCP_SKB_CB(skb)->tx.is_app_limited = tp->app_limited ? 1 : 0; ++ tcp_set_tx_in_flight(sk, skb); + } + + /* When an skb is sacked or acked, we fill in the rate sample with the (prior) +@@ -91,18 +111,21 @@ void tcp_rate_skb_delivered(struct sock + if (!rs->prior_delivered || + tcp_skb_sent_after(tx_tstamp, tp->first_tx_mstamp, + scb->end_seq, rs->last_end_seq)) { ++ rs->prior_lost = scb->tx.lost; + rs->prior_delivered_ce = scb->tx.delivered_ce; + rs->prior_delivered = scb->tx.delivered; + rs->prior_mstamp = scb->tx.delivered_mstamp; + rs->is_app_limited = scb->tx.is_app_limited; + rs->is_retrans = scb->sacked & TCPCB_RETRANS; ++ rs->tx_in_flight = scb->tx.in_flight; + rs->last_end_seq = scb->end_seq; + + /* Record send time of most recently ACKed packet: */ + tp->first_tx_mstamp = tx_tstamp; + /* Find the duration of the "send phase" of this window: */ +- rs->interval_us = tcp_stamp_us_delta(tp->first_tx_mstamp, +- scb->tx.first_tx_mstamp); ++ rs->interval_us = tcp_stamp32_us_delta( ++ tp->first_tx_mstamp, ++ scb->tx.first_tx_mstamp); + + } + /* Mark off the skb delivered once it's sacked to avoid being +@@ -144,6 +167,7 @@ void tcp_rate_gen(struct sock *sk, u32 d + return; + } + rs->delivered = tp->delivered - rs->prior_delivered; ++ rs->lost = tp->lost - rs->prior_lost; + + rs->delivered_ce = tp->delivered_ce - rs->prior_delivered_ce; + /* delivered_ce occupies less than 32 bits in the skb control block */ +@@ -155,7 +179,7 @@ void tcp_rate_gen(struct sock *sk, u32 d + * longer phase. + */ + snd_us = rs->interval_us; /* send phase */ +- ack_us = tcp_stamp_us_delta(tp->tcp_mstamp, ++ ack_us = tcp_stamp32_us_delta(tp->tcp_mstamp, + rs->prior_mstamp); /* ack phase */ + rs->interval_us = max(snd_us, ack_us); + +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -702,6 +702,7 @@ void tcp_write_timer_handler(struct sock + icsk_timeout(icsk)); + return; + } ++ tcp_rate_check_app_limited(sk); + tcp_mstamp_refresh(tcp_sk(sk)); + event = icsk->icsk_pending; + diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0002-net-tcp_bbr-v2-shrink-delivered_mstamp-first_tx_msta.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0002-net-tcp_bbr-v2-shrink-delivered_mstamp-first_tx_msta.patch deleted file mode 100644 index d99295a..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0002-net-tcp_bbr-v2-shrink-delivered_mstamp-first_tx_msta.patch +++ /dev/null @@ -1,74 +0,0 @@ -From e02830baf6c32aceea6c0dfe8a0a4b96db171418 Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Sun, 24 Jun 2018 21:55:59 -0400 -Subject: [PATCH 02/18] net-tcp_bbr: v2: shrink delivered_mstamp, - first_tx_mstamp to u32 to free up 8 bytes - -Free up some space for tracking inflight and losses for each -bw sample, in upcoming commits. - -These timestamps are in microseconds, and are now stored in 32 -bits. So they can only hold time intervals up to roughly 2^12 = 4096 -seconds. But Linux TCP RTT and RTO tracking has the same 32-bit -microsecond implementation approach and resulting deployment -limitations. So this is not introducing a new limit. And these should -not be a limitation for the foreseeable future. - -Effort: net-tcp_bbr -Origin-9xx-SHA1: 238a7e6b5d51625fef1ce7769826a7b21b02ae55 -Change-Id: I3b779603797263b52a61ad57c565eb91fe42680c -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 9 +++++++-- - net/ipv4/tcp_rate.c | 7 ++++--- - 2 files changed, 11 insertions(+), 5 deletions(-) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -945,6 +945,11 @@ static inline u32 tcp_stamp_us_delta(u64 - return max_t(s64, t1 - t0, 0); - } - -+static inline u32 tcp_stamp32_us_delta(u32 t1, u32 t0) -+{ -+ return max_t(s32, t1 - t0, 0); -+} -+ - /* provide the departure time in us unit */ - static inline u64 tcp_skb_timestamp_us(const struct sk_buff *skb) - { -@@ -1043,9 +1048,9 @@ struct tcp_skb_cb { - /* pkts S/ACKed so far upon tx of skb, incl retrans: */ - __u32 delivered; - /* start of send pipeline phase */ -- u64 first_tx_mstamp; -+ u32 first_tx_mstamp; - /* when we reached the "delivered" count */ -- u64 delivered_mstamp; -+ u32 delivered_mstamp; - } tx; /* only used for outgoing skbs */ - union { - struct inet_skb_parm h4; ---- a/net/ipv4/tcp_rate.c -+++ b/net/ipv4/tcp_rate.c -@@ -101,8 +101,9 @@ void tcp_rate_skb_delivered(struct sock - /* Record send time of most recently ACKed packet: */ - tp->first_tx_mstamp = tx_tstamp; - /* Find the duration of the "send phase" of this window: */ -- rs->interval_us = tcp_stamp_us_delta(tp->first_tx_mstamp, -- scb->tx.first_tx_mstamp); -+ rs->interval_us = tcp_stamp32_us_delta( -+ tp->first_tx_mstamp, -+ scb->tx.first_tx_mstamp); - - } - /* Mark off the skb delivered once it's sacked to avoid being -@@ -155,7 +156,7 @@ void tcp_rate_gen(struct sock *sk, u32 d - * longer phase. - */ - snd_us = rs->interval_us; /* send phase */ -- ack_us = tcp_stamp_us_delta(tp->tcp_mstamp, -+ ack_us = tcp_stamp32_us_delta(tp->tcp_mstamp, - rs->prior_mstamp); /* ack phase */ - rs->interval_us = max(snd_us, ack_us); - diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0003-net-tcp_bbr-v2-snapshot-packets-in-flight-at-transmi.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0003-net-tcp_bbr-v2-snapshot-packets-in-flight-at-transmi.patch deleted file mode 100644 index de775da..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0003-net-tcp_bbr-v2-snapshot-packets-in-flight-at-transmi.patch +++ /dev/null @@ -1,109 +0,0 @@ -From b39e9e473ed0446e4268cffb09f4a260cea7c341 Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Sat, 5 Aug 2017 11:49:50 -0400 -Subject: [PATCH 03/18] net-tcp_bbr: v2: snapshot packets in flight at transmit - time and pass in rate_sample - -CC algorithms may want to snapshot the number of packets in flight at -transmit time and pass in rate_sample, to understand the relationship -between inflight and losses or ECN signals, to try to find the highest -inflight value that has acceptable levels of loss/ECN marking. - -We split out the code to set an skb's tx.in_flight field into its own -function, so that this code can be used for the TCP_REPAIR "fake send" -code path that inserts skbs into the rtx queue without sending them. - -Effort: net-tcp_bbr -Origin-9xx-SHA1: b3eb4f2d20efab4ca001f32c9294739036c493ea -Origin-9xx-SHA1: e880fc907d06ea7354333f60f712748ebce9497b -Origin-9xx-SHA1: 330f825a08a6fe92cef74d799cc468864c479f63 -Change-Id: I7314047d0ff14dd261a04b1969a46dc658c8836a -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 6 ++++++ - net/ipv4/tcp_output.c | 1 + - net/ipv4/tcp_rate.c | 20 ++++++++++++++++++++ - 3 files changed, 27 insertions(+) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1051,6 +1051,10 @@ struct tcp_skb_cb { - u32 first_tx_mstamp; - /* when we reached the "delivered" count */ - u32 delivered_mstamp; -+#define TCPCB_IN_FLIGHT_BITS 20 -+#define TCPCB_IN_FLIGHT_MAX ((1U << TCPCB_IN_FLIGHT_BITS) - 1) -+ u32 in_flight:20, /* packets in flight at transmit */ -+ unused2:12; - } tx; /* only used for outgoing skbs */ - union { - struct inet_skb_parm h4; -@@ -1207,6 +1211,7 @@ struct rate_sample { - u64 prior_mstamp; /* starting timestamp for interval */ - u32 prior_delivered; /* tp->delivered at "prior_mstamp" */ - u32 prior_delivered_ce;/* tp->delivered_ce at "prior_mstamp" */ -+ u32 tx_in_flight; /* packets in flight at starting timestamp */ - s32 delivered; /* number of packets delivered over interval */ - s32 delivered_ce; /* number of packets delivered w/ CE marks*/ - long interval_us; /* time for tp->delivered to incr "delivered" */ -@@ -1329,6 +1334,7 @@ static inline void tcp_ca_event(struct s - void tcp_set_ca_state(struct sock *sk, const u8 ca_state); - - /* From tcp_rate.c */ -+void tcp_set_tx_in_flight(struct sock *sk, struct sk_buff *skb); - void tcp_rate_skb_sent(struct sock *sk, struct sk_buff *skb); - void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, - struct rate_sample *rs); ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2777,6 +2777,7 @@ static bool tcp_write_xmit(struct sock * - skb_set_delivery_time(skb, tp->tcp_wstamp_ns, SKB_CLOCK_MONOTONIC); - list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue); - tcp_init_tso_segs(skb, mss_now); -+ tcp_set_tx_in_flight(sk, skb); - goto repair; /* Skip network transmission */ - } - ---- a/net/ipv4/tcp_rate.c -+++ b/net/ipv4/tcp_rate.c -@@ -34,6 +34,24 @@ - * ready to send in the write queue. - */ - -+void tcp_set_tx_in_flight(struct sock *sk, struct sk_buff *skb) -+{ -+ struct tcp_sock *tp = tcp_sk(sk); -+ u32 in_flight; -+ -+ /* Check, sanitize, and record packets in flight after skb was sent. */ -+ in_flight = tcp_packets_in_flight(tp) + tcp_skb_pcount(skb); -+ if (WARN_ONCE(in_flight > TCPCB_IN_FLIGHT_MAX, -+ "insane in_flight %u cc %s mss %u " -+ "cwnd %u pif %u %u %u %u\n", -+ in_flight, inet_csk(sk)->icsk_ca_ops->name, -+ tp->mss_cache, tp->snd_cwnd, -+ tp->packets_out, tp->retrans_out, -+ tp->sacked_out, tp->lost_out)) -+ in_flight = TCPCB_IN_FLIGHT_MAX; -+ TCP_SKB_CB(skb)->tx.in_flight = in_flight; -+} -+ - /* Snapshot the current delivery information in the skb, to generate - * a rate sample later when the skb is (s)acked in tcp_rate_skb_delivered(). - */ -@@ -67,6 +85,7 @@ void tcp_rate_skb_sent(struct sock *sk, - TCP_SKB_CB(skb)->tx.delivered = tp->delivered; - TCP_SKB_CB(skb)->tx.delivered_ce = tp->delivered_ce; - TCP_SKB_CB(skb)->tx.is_app_limited = tp->app_limited ? 1 : 0; -+ tcp_set_tx_in_flight(sk, skb); - } - - /* When an skb is sacked or acked, we fill in the rate sample with the (prior) -@@ -96,6 +115,7 @@ void tcp_rate_skb_delivered(struct sock - rs->prior_mstamp = scb->tx.delivered_mstamp; - rs->is_app_limited = scb->tx.is_app_limited; - rs->is_retrans = scb->sacked & TCPCB_RETRANS; -+ rs->tx_in_flight = scb->tx.in_flight; - rs->last_end_seq = scb->end_seq; - - /* Record send time of most recently ACKed packet: */ diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0004-net-tcp_bbr-v2-count-packets-lost-over-TCP-rate-samp.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0004-net-tcp_bbr-v2-count-packets-lost-over-TCP-rate-samp.patch deleted file mode 100644 index 7a6b88e..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0004-net-tcp_bbr-v2-count-packets-lost-over-TCP-rate-samp.patch +++ /dev/null @@ -1,70 +0,0 @@ -From e4c82a08a05eeee9341511f35e922914520dd401 Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Thu, 12 Oct 2017 23:44:27 -0400 -Subject: [PATCH 04/18] net-tcp_bbr: v2: count packets lost over TCP rate - sampling interval - -For understanding the relationship between inflight and packet loss -signals, to try to find the highest inflight value that has acceptable -levels of packet losses. - -Effort: net-tcp_bbr -Origin-9xx-SHA1: 4527e26b2bd7756a88b5b9ef1ada3da33dd609ab -Change-Id: I594c2500868d9c530770e7ddd68ffc87c57f4fd5 -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 5 ++++- - net/ipv4/tcp_rate.c | 3 +++ - 2 files changed, 7 insertions(+), 1 deletion(-) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1055,6 +1055,7 @@ struct tcp_skb_cb { - #define TCPCB_IN_FLIGHT_MAX ((1U << TCPCB_IN_FLIGHT_BITS) - 1) - u32 in_flight:20, /* packets in flight at transmit */ - unused2:12; -+ u32 lost; /* packets lost so far upon tx of skb */ - } tx; /* only used for outgoing skbs */ - union { - struct inet_skb_parm h4; -@@ -1209,11 +1210,13 @@ struct ack_sample { - */ - struct rate_sample { - u64 prior_mstamp; /* starting timestamp for interval */ -+ u32 prior_lost; /* tp->lost at "prior_mstamp" */ - u32 prior_delivered; /* tp->delivered at "prior_mstamp" */ - u32 prior_delivered_ce;/* tp->delivered_ce at "prior_mstamp" */ - u32 tx_in_flight; /* packets in flight at starting timestamp */ -+ s32 lost; /* number of packets lost over interval */ - s32 delivered; /* number of packets delivered over interval */ -- s32 delivered_ce; /* number of packets delivered w/ CE marks*/ -+ s32 delivered_ce; /* packets delivered w/ CE mark over interval */ - long interval_us; /* time for tp->delivered to incr "delivered" */ - u32 snd_interval_us; /* snd interval for delivered packets */ - u32 rcv_interval_us; /* rcv interval for delivered packets */ ---- a/net/ipv4/tcp_rate.c -+++ b/net/ipv4/tcp_rate.c -@@ -84,6 +84,7 @@ void tcp_rate_skb_sent(struct sock *sk, - TCP_SKB_CB(skb)->tx.delivered_mstamp = tp->delivered_mstamp; - TCP_SKB_CB(skb)->tx.delivered = tp->delivered; - TCP_SKB_CB(skb)->tx.delivered_ce = tp->delivered_ce; -+ TCP_SKB_CB(skb)->tx.lost = tp->lost; - TCP_SKB_CB(skb)->tx.is_app_limited = tp->app_limited ? 1 : 0; - tcp_set_tx_in_flight(sk, skb); - } -@@ -110,6 +111,7 @@ void tcp_rate_skb_delivered(struct sock - if (!rs->prior_delivered || - tcp_skb_sent_after(tx_tstamp, tp->first_tx_mstamp, - scb->end_seq, rs->last_end_seq)) { -+ rs->prior_lost = scb->tx.lost; - rs->prior_delivered_ce = scb->tx.delivered_ce; - rs->prior_delivered = scb->tx.delivered; - rs->prior_mstamp = scb->tx.delivered_mstamp; -@@ -165,6 +167,7 @@ void tcp_rate_gen(struct sock *sk, u32 d - return; - } - rs->delivered = tp->delivered - rs->prior_delivered; -+ rs->lost = tp->lost - rs->prior_lost; - - rs->delivered_ce = tp->delivered_ce - rs->prior_delivered_ce; - /* delivered_ce occupies less than 32 bits in the skb control block */ diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0005-net-tcp_bbr-v2-export-FLAG_ECE-in-rate_sample.is_ece.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0005-net-tcp_bbr-v2-export-FLAG_ECE-in-rate_sample.is_ece.patch deleted file mode 100644 index 57064a5..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0005-net-tcp_bbr-v2-export-FLAG_ECE-in-rate_sample.is_ece.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 3d3b54d263b6271926e0d9800ca000a529267cfe Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Mon, 19 Nov 2018 13:48:36 -0500 -Subject: [PATCH 05/18] net-tcp_bbr: v2: export FLAG_ECE in rate_sample.is_ece - -For understanding the relationship between inflight and ECN signals, -to try to find the highest inflight value that has acceptable levels -ECN marking. - -Effort: net-tcp_bbr -Origin-9xx-SHA1: 3eba998f2898541406c2666781182200934965a8 -Change-Id: I3a964e04cee83e11649a54507043d2dfe769a3b3 -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 1 + - net/ipv4/tcp_input.c | 1 + - 2 files changed, 2 insertions(+) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1228,6 +1228,7 @@ struct rate_sample { - bool is_app_limited; /* is sample from packet with bubble in pipe? */ - bool is_retrans; /* is sample from retransmission? */ - bool is_ack_delayed; /* is this (likely) a delayed ACK? */ -+ bool is_ece; /* did this ACK have ECN marked? */ - }; - - struct tcp_congestion_ops { ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -4093,6 +4093,7 @@ static int tcp_ack(struct sock *sk, cons - delivered = tcp_newly_delivered(sk, delivered, flag); - lost = tp->lost - lost; /* freshly marked lost */ - rs.is_ack_delayed = !!(flag & FLAG_ACK_MAYBE_DELAYED); -+ rs.is_ece = !!(flag & FLAG_ECE); - tcp_rate_gen(sk, delivered, lost, is_sack_reneg, sack_state.rate); - tcp_cong_control(sk, ack, delivered, flag, sack_state.rate); - tcp_xmit_recovery(sk, rexmit); diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0006-net-tcp_bbr-v2-introduce-ca_ops-skb_marked_lost-CC-m.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0006-net-tcp_bbr-v2-introduce-ca_ops-skb_marked_lost-CC-m.patch deleted file mode 100644 index 40b643c..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0006-net-tcp_bbr-v2-introduce-ca_ops-skb_marked_lost-CC-m.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 6f3ecfa5c713cacd451b876f4190da6d36c512eb Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Tue, 7 Aug 2018 21:52:06 -0400 -Subject: [PATCH 06/18] net-tcp_bbr: v2: introduce ca_ops->skb_marked_lost() CC - module callback API - -For connections experiencing reordering, RACK can mark packets lost -long after we receive the SACKs/ACKs hinting that the packets were -actually lost. - -This means that CC modules cannot easily learn the volume of inflight -data at which packet loss happens by looking at the current inflight -or even the packets in flight when the most recently SACKed packet was -sent. To learn this, CC modules need to know how many packets were in -flight at the time lost packets were sent. This new callback, combined -with TCP_SKB_CB(skb)->tx.in_flight, allows them to learn this. - -This also provides a consistent callback that is invoked whether -packets are marked lost upon ACK processing, using the RACK reordering -timer, or at RTO time. - -Effort: net-tcp_bbr -Origin-9xx-SHA1: afcbebe3374e4632ac6714d39e4dc8a8455956f4 -Change-Id: I54826ab53df636be537e5d3c618a46145d12d51a -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 3 +++ - net/ipv4/tcp_input.c | 5 +++++ - 2 files changed, 8 insertions(+) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1255,6 +1255,9 @@ struct tcp_congestion_ops { - /* override sysctl_tcp_min_tso_segs */ - u32 (*min_tso_segs)(struct sock *sk); - -+ /* react to a specific lost skb (optional) */ -+ void (*skb_marked_lost)(struct sock *sk, const struct sk_buff *skb); -+ - /* call when packets are delivered to update cwnd and pacing rate, - * after all the ca_state processing. (optional) - */ ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -1135,7 +1135,12 @@ static void tcp_verify_retransmit_hint(s - */ - static void tcp_notify_skb_loss_event(struct tcp_sock *tp, const struct sk_buff *skb) - { -+ struct sock *sk = (struct sock *)tp; -+ const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops; -+ - tp->lost += tcp_skb_pcount(skb); -+ if (ca_ops->skb_marked_lost) -+ ca_ops->skb_marked_lost(sk, skb); - } - - void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb) diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0007-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-merge-in.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0007-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-merge-in.patch deleted file mode 100644 index 8a2526c..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0007-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-merge-in.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 52b39284416d0d841d4d51db0d3fce1c191a00d7 Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Wed, 1 May 2019 20:16:33 -0400 -Subject: [PATCH 07/18] net-tcp_bbr: v2: adjust skb tx.in_flight upon merge in - tcp_shifted_skb() - -When tcp_shifted_skb() updates state as adjacent SACKed skbs are -coalesced, previously the tx.in_flight was not adjusted, so we could -get contradictory state where the skb's recorded pcount was bigger -than the tx.in_flight (the number of segments that were in_flight -after sending the skb). - -Normally have a SACKed skb with contradictory pcount/tx.in_flight -would not matter. However, with SACK reneging, the SACKed bit is -removed, and an skb once again becomes eligible for retransmitting, -fragmenting, SACKing, etc. Packetdrill testing verified the following -sequence is possible in a kernel that does not have this commit: - - - skb N is SACKed - - skb N+1 is SACKed and combined with skb N using tcp_shifted_skb() - - tcp_shifted_skb() will increase the pcount of prev, - but leave tx.in_flight as-is - - so prev skb can have pcount > tx.in_flight - - RTO, tcp_timeout_mark_lost(), detect reneg, - remove "SACKed" bit, mark skb N as lost - - find pcount of skb N is greater than its tx.in_flight - -I suspect this issue iw what caused the bbr2_inflight_hi_from_lost_skb(): - WARN_ON_ONCE(inflight_prev < 0) -to fire in production machines using bbr2. - -Effort: net-tcp_bbr -Origin-9xx-SHA1: 1a3e997e613d2dcf32b947992882854ebe873715 -Change-Id: I1b0b75c27519953430c7db51c6f358f104c7af55 -Signed-off-by: Alexandre Frade ---- - net/ipv4/tcp_input.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -1512,6 +1512,17 @@ static bool tcp_shifted_skb(struct sock - WARN_ON_ONCE(tcp_skb_pcount(skb) < pcount); - tcp_skb_pcount_add(skb, -pcount); - -+ /* Adjust tx.in_flight as pcount is shifted from skb to prev. */ -+ if (WARN_ONCE(TCP_SKB_CB(skb)->tx.in_flight < pcount, -+ "prev in_flight: %u skb in_flight: %u pcount: %u", -+ TCP_SKB_CB(prev)->tx.in_flight, -+ TCP_SKB_CB(skb)->tx.in_flight, -+ pcount)) -+ TCP_SKB_CB(skb)->tx.in_flight = 0; -+ else -+ TCP_SKB_CB(skb)->tx.in_flight -= pcount; -+ TCP_SKB_CB(prev)->tx.in_flight += pcount; -+ - /* When we're adding to gso_segs == 1, gso_size will be zero, - * in theory this shouldn't be necessary but as long as DSACK - * code can come after this skb later on it's better to keep diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0008-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-split-in.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0008-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-split-in.patch deleted file mode 100644 index 73c3824..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0008-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-split-in.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 64570028a478a2249356345127bb3a3c75509d57 Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Wed, 1 May 2019 20:16:25 -0400 -Subject: [PATCH 08/18] net-tcp_bbr: v2: adjust skb tx.in_flight upon split in - tcp_fragment() - -When we fragment an skb that has already been sent, we need to update -the tx.in_flight for the first skb in the resulting pair ("buff"). - -Because we were not updating the tx.in_flight, the tx.in_flight value -was inconsistent with the pcount of the "buff" skb (tx.in_flight would -be too high). That meant that if the "buff" skb was lost, then -bbr2_inflight_hi_from_lost_skb() would calculate an inflight_hi value -that is too high. This could result in longer queues and higher packet -loss. - -Packetdrill testing verified that without this commit, when the second -half of an skb is SACKed and then later the first half of that skb is -marked lost, the calculated inflight_hi was incorrect. - -Effort: net-tcp_bbr -Origin-9xx-SHA1: 385f1ddc610798fab2837f9f372857438b25f874 -Origin-9xx-SHA1: a0eb099690af net-tcp_bbr: v2: fix tcp_fragment() tx.in_flight recomputation [prod feb 8 2021; use as a fixup] -Origin-9xx-SHA1: 885503228153ff0c9114e net-tcp_bbr: v2: introduce tcp_skb_tx_in_flight_is_suspicious() helper for warnings -Change-Id: I617f8cab4e9be7a0b8e8d30b047bf8645393354d -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 15 +++++++++++++++ - net/ipv4/tcp_output.c | 26 +++++++++++++++++++++++++- - 2 files changed, 40 insertions(+), 1 deletion(-) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1354,6 +1354,21 @@ static inline bool tcp_skb_sent_after(u6 - return t1 > t2 || (t1 == t2 && after(seq1, seq2)); - } - -+/* If a retransmit failed due to local qdisc congestion or other local issues, -+ * then we may have called tcp_set_skb_tso_segs() to increase the number of -+ * segments in the skb without increasing the tx.in_flight. In all other cases, -+ * the tx.in_flight should be at least as big as the pcount of the sk_buff. We -+ * do not have the state to know whether a retransmit failed due to local qdisc -+ * congestion or other local issues, so to avoid spurious warnings we consider -+ * that any skb marked lost may have suffered that fate. -+ */ -+static inline bool tcp_skb_tx_in_flight_is_suspicious(u32 skb_pcount, -+ u32 skb_sacked_flags, -+ u32 tx_in_flight) -+{ -+ return (skb_pcount > tx_in_flight) && !(skb_sacked_flags & TCPCB_LOST); -+} -+ - /* These functions determine how the current flow behaves in respect of SACK - * handling. SACK is negotiated with the peer, and therefore it can vary - * between different flows. ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1614,7 +1614,7 @@ int tcp_fragment(struct sock *sk, enum t - { - struct tcp_sock *tp = tcp_sk(sk); - struct sk_buff *buff; -- int old_factor; -+ int old_factor, inflight_prev; - long limit; - u16 flags; - int nlen; -@@ -1689,6 +1689,30 @@ int tcp_fragment(struct sock *sk, enum t - - if (diff) - tcp_adjust_pcount(sk, skb, diff); -+ -+ inflight_prev = TCP_SKB_CB(skb)->tx.in_flight - old_factor; -+ if (inflight_prev < 0) { -+ WARN_ONCE(tcp_skb_tx_in_flight_is_suspicious( -+ old_factor, -+ TCP_SKB_CB(skb)->sacked, -+ TCP_SKB_CB(skb)->tx.in_flight), -+ "inconsistent: tx.in_flight: %u " -+ "old_factor: %d mss: %u sacked: %u " -+ "1st pcount: %d 2nd pcount: %d " -+ "1st len: %u 2nd len: %u ", -+ TCP_SKB_CB(skb)->tx.in_flight, old_factor, -+ mss_now, TCP_SKB_CB(skb)->sacked, -+ tcp_skb_pcount(skb), tcp_skb_pcount(buff), -+ skb->len, buff->len); -+ inflight_prev = 0; -+ } -+ /* Set 1st tx.in_flight as if 1st were sent by itself: */ -+ TCP_SKB_CB(skb)->tx.in_flight = inflight_prev + -+ tcp_skb_pcount(skb); -+ /* Set 2nd tx.in_flight with new 1st and 2nd pcounts: */ -+ TCP_SKB_CB(buff)->tx.in_flight = inflight_prev + -+ tcp_skb_pcount(skb) + -+ tcp_skb_pcount(buff); - } - - /* Link BUFF into the send queue. */ diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0009-net-tcp-add-new-ca-opts-flag-TCP_CONG_WANTS_CE_EVENT.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0009-net-tcp-add-new-ca-opts-flag-TCP_CONG_WANTS_CE_EVENT.patch deleted file mode 100644 index 9651fc0..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0009-net-tcp-add-new-ca-opts-flag-TCP_CONG_WANTS_CE_EVENT.patch +++ /dev/null @@ -1,73 +0,0 @@ -From fb3f903921be91a91b577d3771e5d5c9e9fe3aa9 Mon Sep 17 00:00:00 2001 -From: Yousuk Seung -Date: Wed, 23 May 2018 17:55:54 -0700 -Subject: [PATCH 09/18] net-tcp: add new ca opts flag TCP_CONG_WANTS_CE_EVENTS - -Add a a new ca opts flag TCP_CONG_WANTS_CE_EVENTS that allows a -congestion control module to receive CE events. - -Currently congestion control modules have to set the TCP_CONG_NEEDS_ECN -bit in opts flag to receive CE events but this may incur changes in ECN -behavior elsewhere. This patch adds a new bit TCP_CONG_WANTS_CE_EVENTS -that allows congestion control modules to receive CE events -independently of TCP_CONG_NEEDS_ECN. - -Effort: net-tcp -Origin-9xx-SHA1: 9f7e14716cde760bc6c67ef8ef7e1ee48501d95b -Change-Id: I2255506985242f376d910c6fd37daabaf4744f24 -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 14 +++++++++++++- - net/ipv4/tcp_input.c | 4 ++-- - 2 files changed, 15 insertions(+), 3 deletions(-) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1190,7 +1190,11 @@ enum tcp_ca_ack_event_flags { - #define TCP_CONG_NON_RESTRICTED BIT(0) - /* Requires ECN/ECT set on all packets */ - #define TCP_CONG_NEEDS_ECN BIT(1) --#define TCP_CONG_MASK (TCP_CONG_NON_RESTRICTED | TCP_CONG_NEEDS_ECN) -+/* Wants notification of CE events (CA_EVENT_ECN_IS_CE, CA_EVENT_ECN_NO_CE). */ -+#define TCP_CONG_WANTS_CE_EVENTS BIT(2) -+#define TCP_CONG_MASK (TCP_CONG_NON_RESTRICTED | \ -+ TCP_CONG_NEEDS_ECN | \ -+ TCP_CONG_WANTS_CE_EVENTS) - - union tcp_cc_info; - -@@ -1322,6 +1326,14 @@ static inline char *tcp_ca_get_name_by_k - } - #endif - -+static inline bool tcp_ca_wants_ce_events(const struct sock *sk) -+{ -+ const struct inet_connection_sock *icsk = inet_csk(sk); -+ -+ return icsk->icsk_ca_ops->flags & (TCP_CONG_NEEDS_ECN | -+ TCP_CONG_WANTS_CE_EVENTS); -+} -+ - static inline bool tcp_ca_needs_ecn(const struct sock *sk) - { - const struct inet_connection_sock *icsk = inet_csk(sk); ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -381,7 +381,7 @@ static void tcp_data_ecn_check(struct so - tcp_enter_quickack_mode(sk, 2); - break; - case INET_ECN_CE: -- if (tcp_ca_needs_ecn(sk)) -+ if (tcp_ca_wants_ce_events(sk)) - tcp_ca_event(sk, CA_EVENT_ECN_IS_CE); - - if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) { -@@ -392,7 +392,7 @@ static void tcp_data_ecn_check(struct so - tp->ecn_flags |= TCP_ECN_SEEN; - break; - default: -- if (tcp_ca_needs_ecn(sk)) -+ if (tcp_ca_wants_ce_events(sk)) - tcp_ca_event(sk, CA_EVENT_ECN_NO_CE); - tp->ecn_flags |= TCP_ECN_SEEN; - break; diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0010-net-tcp-re-generalize-TSO-sizing-in-TCP-CC-module-AP.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0010-net-tcp-re-generalize-TSO-sizing-in-TCP-CC-module-AP.patch deleted file mode 100644 index bf70dd2..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0010-net-tcp-re-generalize-TSO-sizing-in-TCP-CC-module-AP.patch +++ /dev/null @@ -1,139 +0,0 @@ -From e0ac041e7e63d138d210fe875120447c11d2d4ba Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Fri, 27 Sep 2019 17:10:26 -0400 -Subject: [PATCH 10/18] net-tcp: re-generalize TSO sizing in TCP CC module API - -Reorganize the API for CC modules so that the CC module once again -gets complete control of the TSO sizing decision. This is how the API -was set up around 2016 and the initial BBRv1 upstreaming. Later Eric -Dumazet simplified it. But with wider testing it now seems that to -avoid CPU regressions BBR needs to have a different TSO sizing -function. - -This is necessary to handle cases where there are many flows -bottlenecked on the sender host's NIC, in which case BBR's pacing rate -is much lower than CUBIC/Reno/DCTCP's. Why does this happen? Because -BBR's pacing rate adapts to the low bandwidth share each flow sees. By -contrast, CUBIC/Reno/DCTCP see no loss or ECN, so they grow a very -large cwnd, and thus large pacing rate and large TSO burst size. - -Change-Id: Ic8ccfdbe4010ee8d4bf6a6334c48a2fceb2171ea -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 4 ++-- - net/ipv4/bpf_tcp_ca.c | 4 ++-- - net/ipv4/tcp_bbr.c | 37 ++++++++++++++++++++++++++----------- - net/ipv4/tcp_output.c | 11 +++++------ - 4 files changed, 35 insertions(+), 21 deletions(-) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1256,8 +1256,8 @@ struct tcp_congestion_ops { - /* hook for packet ack accounting (optional) */ - void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample); - -- /* override sysctl_tcp_min_tso_segs */ -- u32 (*min_tso_segs)(struct sock *sk); -+ /* pick target number of segments per TSO/GSO skb (optional): */ -+ u32 (*tso_segs)(struct sock *sk, unsigned int mss_now); - - /* react to a specific lost skb (optional) */ - void (*skb_marked_lost)(struct sock *sk, const struct sk_buff *skb); ---- a/net/ipv4/bpf_tcp_ca.c -+++ b/net/ipv4/bpf_tcp_ca.c -@@ -280,7 +280,7 @@ static void bpf_tcp_ca_pkts_acked(struct - { - } - --static u32 bpf_tcp_ca_min_tso_segs(struct sock *sk) -+static u32 bpf_tcp_ca_tso_segs(struct sock *sk, unsigned int mss_now) - { - return 0; - } -@@ -315,7 +315,7 @@ static struct tcp_congestion_ops __bpf_o - .cwnd_event = bpf_tcp_ca_cwnd_event, - .in_ack_event = bpf_tcp_ca_in_ack_event, - .pkts_acked = bpf_tcp_ca_pkts_acked, -- .min_tso_segs = bpf_tcp_ca_min_tso_segs, -+ .tso_segs = bpf_tcp_ca_tso_segs, - .cong_control = bpf_tcp_ca_cong_control, - .undo_cwnd = bpf_tcp_ca_undo_cwnd, - .sndbuf_expand = bpf_tcp_ca_sndbuf_expand, ---- a/net/ipv4/tcp_bbr.c -+++ b/net/ipv4/tcp_bbr.c -@@ -301,20 +301,35 @@ __bpf_kfunc static u32 bbr_min_tso_segs( - return READ_ONCE(sk->sk_pacing_rate) < (bbr_min_tso_rate >> 3) ? 1 : 2; - } - -+/* Return the number of segments BBR would like in a TSO/GSO skb, given -+ * a particular max gso size as a constraint. -+ */ -+static u32 bbr_tso_segs_generic(struct sock *sk, unsigned int mss_now, -+ u32 gso_max_size) -+{ -+ u32 segs; -+ u64 bytes; -+ -+ /* Budget a TSO/GSO burst size allowance based on bw (pacing_rate). */ -+ bytes = READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift); -+ -+ bytes = min_t(u32, bytes, gso_max_size - 1 - MAX_TCP_HEADER); -+ segs = max_t(u32, bytes / mss_now, bbr_min_tso_segs(sk)); -+ return segs; -+} -+ -+/* Custom tcp_tso_autosize() for BBR, used at transmit time to cap skb size. */ -+static u32 bbr_tso_segs(struct sock *sk, unsigned int mss_now) -+{ -+ return bbr_tso_segs_generic(sk, mss_now, sk->sk_gso_max_size); -+} -+ -+/* Like bbr_tso_segs(), using mss_cache, ignoring driver's sk_gso_max_size. */ - static u32 bbr_tso_segs_goal(struct sock *sk) - { - struct tcp_sock *tp = tcp_sk(sk); -- u32 segs, bytes; -- -- /* Sort of tcp_tso_autosize() but ignoring -- * driver provided sk_gso_max_size. -- */ -- bytes = min_t(unsigned long, -- READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift), -- GSO_LEGACY_MAX_SIZE - 1 - MAX_TCP_HEADER); -- segs = max_t(u32, bytes / tp->mss_cache, bbr_min_tso_segs(sk)); - -- return min(segs, 0x7FU); -+ return bbr_tso_segs_generic(sk, tp->mss_cache, GSO_MAX_SIZE); - } - - /* Save "last known good" cwnd so we can restore it after losses or PROBE_RTT */ -@@ -1150,7 +1165,7 @@ static struct tcp_congestion_ops tcp_bbr - .undo_cwnd = bbr_undo_cwnd, - .cwnd_event = bbr_cwnd_event, - .ssthresh = bbr_ssthresh, -- .min_tso_segs = bbr_min_tso_segs, -+ .tso_segs = bbr_tso_segs, - .get_info = bbr_get_info, - .set_state = bbr_set_state, - }; ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2069,13 +2069,12 @@ static u32 tcp_tso_autosize(const struct - static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now) - { - const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops; -- u32 min_tso, tso_segs; -+ u32 tso_segs; - -- min_tso = ca_ops->min_tso_segs ? -- ca_ops->min_tso_segs(sk) : -- READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs); -- -- tso_segs = tcp_tso_autosize(sk, mss_now, min_tso); -+ tso_segs = ca_ops->tso_segs ? -+ ca_ops->tso_segs(sk, mss_now) : -+ tcp_tso_autosize(sk, mss_now, -+ sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs); - return min_t(u32, tso_segs, sk->sk_gso_max_segs); - } - diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0011-net-tcp-add-fast_ack_mode-1-skip-rwin-check-in-tcp_f.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0011-net-tcp-add-fast_ack_mode-1-skip-rwin-check-in-tcp_f.patch deleted file mode 100644 index 34a2341..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0011-net-tcp-add-fast_ack_mode-1-skip-rwin-check-in-tcp_f.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 323945d608bbef5fd3a444f52442bf0154c4ef0b Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Sat, 16 Nov 2019 13:16:25 -0500 -Subject: [PATCH 11/18] net-tcp: add fast_ack_mode=1: skip rwin check in - tcp_fast_ack_mode__tcp_ack_snd_check() - -Add logic for an optional TCP connection behavior, enabled with -tp->fast_ack_mode = 1, which disables checking the receive window -before sending an ack in __tcp_ack_snd_check(). If this behavior is -enabled, the data receiver sends an ACK if the amount of data is > -RCV.MSS. TCP congestion control modules can enable this bit if -they want to generate ACKs quickly. - -Change-Id: Iaa0a0fd7108221f883137a79d5bfa724f1b096d4 -Signed-off-by: Alexandre Frade ---- - include/linux/tcp.h | 3 ++- - net/ipv4/tcp.c | 1 + - net/ipv4/tcp_cong.c | 1 + - net/ipv4/tcp_input.c | 5 +++-- - 4 files changed, 7 insertions(+), 3 deletions(-) - ---- a/include/linux/tcp.h -+++ b/include/linux/tcp.h -@@ -248,7 +248,8 @@ struct tcp_sock { - void (*tcp_clean_acked)(struct sock *sk, u32 acked_seq); - #endif - u32 snd_ssthresh; /* Slow start size threshold */ -- u8 recvmsg_inq : 1;/* Indicate # of bytes in queue upon recvmsg */ -+ u32 recvmsg_inq : 1,/* Indicate # of bytes in queue upon recvmsg */ -+ fast_ack_mode:1;/* ack ASAP if >1 rcv_mss received? */ - __cacheline_group_end(tcp_sock_read_rx); - - /* TX read-write hotpath cache lines */ ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -3411,6 +3411,7 @@ int tcp_disconnect(struct sock *sk, int - tp->rx_opt.dsack = 0; - tp->rx_opt.num_sacks = 0; - tp->rcv_ooopack = 0; -+ tp->fast_ack_mode = 0; - - - /* Clean up fastopen related fields */ ---- a/net/ipv4/tcp_cong.c -+++ b/net/ipv4/tcp_cong.c -@@ -237,6 +237,7 @@ void tcp_init_congestion_control(struct - struct inet_connection_sock *icsk = inet_csk(sk); - - tcp_sk(sk)->prior_ssthresh = 0; -+ tcp_sk(sk)->fast_ack_mode = 0; - if (icsk->icsk_ca_ops->init) - icsk->icsk_ca_ops->init(sk); - if (tcp_ca_needs_ecn(sk)) ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -5811,13 +5811,14 @@ static void __tcp_ack_snd_check(struct s - - /* More than one full frame received... */ - if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss && -+ (tp->fast_ack_mode == 1 || - /* ... and right edge of window advances far enough. - * (tcp_recvmsg() will send ACK otherwise). - * If application uses SO_RCVLOWAT, we want send ack now if - * we have not received enough bytes to satisfy the condition. - */ -- (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat || -- __tcp_select_window(sk) >= tp->rcv_wnd)) || -+ (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat || -+ __tcp_select_window(sk) >= tp->rcv_wnd))) || - /* We ACK each frame or... */ - tcp_in_quickack_mode(sk) || - /* Protocol state mandates a one-time immediate ACK */ diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0012-net-tcp_bbr-v2-record-app-limited-status-of-TLP-repa.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0012-net-tcp_bbr-v2-record-app-limited-status-of-TLP-repa.patch deleted file mode 100644 index 232b881..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0012-net-tcp_bbr-v2-record-app-limited-status-of-TLP-repa.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 30fc364b7834b5dce9434dfab4adb49d4924ac03 Mon Sep 17 00:00:00 2001 -From: Jianfeng Wang -Date: Fri, 19 Jun 2020 17:33:45 +0000 -Subject: [PATCH 12/18] net-tcp_bbr: v2: record app-limited status of - TLP-repaired flight - -When sending a TLP retransmit, record whether the outstanding flight -of data is application limited. This is important for congestion -control modules that want to respond to losses repaired by TLP -retransmits. This is important because the following scenarios convey -very different information: - (1) a packet loss with a small number of packets in flight; - (2) a packet loss with the maximum amount of data in flight allowed - by the CC module; - -Effort: net-tcp_bbr -Change-Id: Ic8ae567caa4e4bfd5fd82c3d4be12a5d9171655e -Signed-off-by: Alexandre Frade ---- - include/linux/tcp.h | 3 ++- - net/ipv4/tcp_output.c | 1 + - 2 files changed, 3 insertions(+), 1 deletion(-) - ---- a/include/linux/tcp.h -+++ b/include/linux/tcp.h -@@ -306,7 +306,8 @@ struct tcp_sock { - */ - struct tcp_options_received rx_opt; - u8 nonagle : 4,/* Disable Nagle algorithm? */ -- rate_app_limited:1; /* rate_{delivered,interval_us} limited? */ -+ rate_app_limited:1, /* rate_{delivered,interval_us} limited? */ -+ tlp_orig_data_app_limited:1; /* app-limited before TLP rtx? */ - __cacheline_group_end(tcp_sock_write_txrx); - - /* RX read-write hotpath cache lines */ ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -3013,6 +3013,7 @@ void tcp_send_loss_probe(struct sock *sk - if (WARN_ON(!skb || !tcp_skb_pcount(skb))) - goto rearm_timer; - -+ tp->tlp_orig_data_app_limited = TCP_SKB_CB(skb)->tx.is_app_limited; - if (__tcp_retransmit_skb(sk, skb, 1)) - goto rearm_timer; - diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0013-net-tcp_bbr-v2-inform-CC-module-of-losses-repaired-b.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0013-net-tcp_bbr-v2-inform-CC-module-of-losses-repaired-b.patch deleted file mode 100644 index d1185f8..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0013-net-tcp_bbr-v2-inform-CC-module-of-losses-repaired-b.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 0c90659bb5c4af502726a0c71cecc096ece1fc95 Mon Sep 17 00:00:00 2001 -From: Jianfeng Wang -Date: Tue, 16 Jun 2020 17:41:19 +0000 -Subject: [PATCH 13/18] net-tcp_bbr: v2: inform CC module of losses repaired by - TLP probe - -Before this commit, when there is a packet loss that creates a sequence -hole that is filled by a TLP loss probe, then tcp_process_tlp_ack() -only informs the congestion control (CC) module via a back-to-back entry -and exit of CWR. But some congestion control modules (e.g. BBR) do not -respond to CWR events. - -This commit adds a new CA event with which the core TCP stack notifies -the CC module when a loss is repaired by a TLP. This will allow CC -modules that do not use the CWR mechanism to have a custom handler for -such TLP recoveries. - -Effort: net-tcp_bbr -Change-Id: Ieba72332b401b329bff5a641d2b2043a3fb8f632 -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 1 + - net/ipv4/tcp_input.c | 1 + - 2 files changed, 2 insertions(+) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1168,6 +1168,7 @@ enum tcp_ca_event { - CA_EVENT_LOSS, /* loss timeout */ - CA_EVENT_ECN_NO_CE, /* ECT set, but not CE marked */ - CA_EVENT_ECN_IS_CE, /* received CE marked IP packet */ -+ CA_EVENT_TLP_RECOVERY, /* a lost segment was repaired by TLP probe */ - }; - - /* Information about inbound ACK, passed to cong_ops->in_ack_event() */ ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -3890,6 +3890,7 @@ static void tcp_process_tlp_ack(struct s - /* ACK advances: there was a loss, so reduce cwnd. Reset - * tlp_high_seq in tcp_init_cwnd_reduction() - */ -+ tcp_ca_event(sk, CA_EVENT_TLP_RECOVERY); - tcp_init_cwnd_reduction(sk); - tcp_set_ca_state(sk, TCP_CA_CWR); - tcp_end_cwnd_reduction(sk); diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0014-net-tcp_bbr-v2-introduce-is_acking_tlp_retrans_seq-i.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0014-net-tcp_bbr-v2-introduce-is_acking_tlp_retrans_seq-i.patch deleted file mode 100644 index f35b65a..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0014-net-tcp_bbr-v2-introduce-is_acking_tlp_retrans_seq-i.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 0c9501f0d0743b7ab6958e064760b773b3bdf19b Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Mon, 21 Sep 2020 14:46:26 -0400 -Subject: [PATCH 14/18] net-tcp_bbr: v2: introduce is_acking_tlp_retrans_seq - into rate_sample - -Introduce is_acking_tlp_retrans_seq into rate_sample. This bool will -export to the CC module the knowledge of whether the current ACK -matched a TLP retransmit. - -Note that when this bool is true, we cannot yet tell (in general) whether -this ACK is for the original or the TLP retransmit. - -Effort: net-tcp_bbr -Change-Id: I2e6494332167e75efcbdc99bd5c119034e9c39b4 -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 1 + - net/ipv4/tcp_input.c | 12 +++++++++--- - 2 files changed, 10 insertions(+), 3 deletions(-) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1232,6 +1232,7 @@ struct rate_sample { - u32 last_end_seq; /* end_seq of most recently ACKed packet */ - bool is_app_limited; /* is sample from packet with bubble in pipe? */ - bool is_retrans; /* is sample from retransmission? */ -+ bool is_acking_tlp_retrans_seq; /* ACKed a TLP retransmit sequence? */ - bool is_ack_delayed; /* is this (likely) a delayed ACK? */ - bool is_ece; /* did this ACK have ECN marked? */ - }; ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -3873,7 +3873,8 @@ static int tcp_replace_ts_recent(struct - /* This routine deals with acks during a TLP episode and ends an episode by - * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack - */ --static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) -+static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag, -+ struct rate_sample *rs) - { - struct tcp_sock *tp = tcp_sk(sk); - -@@ -3901,6 +3902,11 @@ static void tcp_process_tlp_ack(struct s - FLAG_NOT_DUP | FLAG_DATA_SACKED))) { - /* Pure dupack: original and TLP probe arrived; no loss */ - tp->tlp_high_seq = 0; -+ } else { -+ /* This ACK matches a TLP retransmit. We cannot yet tell if -+ * this ACK is for the original or the TLP retransmit. -+ */ -+ rs->is_acking_tlp_retrans_seq = 1; - } - } - -@@ -4086,7 +4092,7 @@ static int tcp_ack(struct sock *sk, cons - tcp_in_ack_event(sk, flag); - - if (tp->tlp_high_seq) -- tcp_process_tlp_ack(sk, ack, flag); -+ tcp_process_tlp_ack(sk, ack, flag, &rs); - - if (tcp_ack_is_dubious(sk, flag)) { - if (!(flag & (FLAG_SND_UNA_ADVANCED | -@@ -4131,7 +4137,7 @@ no_queue: - tcp_ack_probe(sk); - - if (tp->tlp_high_seq) -- tcp_process_tlp_ack(sk, ack, flag); -+ tcp_process_tlp_ack(sk, ack, flag, &rs); - return 1; - - old_ack: diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0015-tcp-introduce-per-route-feature-RTAX_FEATURE_ECN_LOW.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0015-tcp-introduce-per-route-feature-RTAX_FEATURE_ECN_LOW.patch deleted file mode 100644 index 7feb442..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0015-tcp-introduce-per-route-feature-RTAX_FEATURE_ECN_LOW.patch +++ /dev/null @@ -1,112 +0,0 @@ -From c70e032f0effa66e1f67ae0a5ed65fac83c6c267 Mon Sep 17 00:00:00 2001 -From: David Morley -Date: Fri, 14 Jul 2023 11:07:56 -0400 -Subject: [PATCH 15/18] tcp: introduce per-route feature RTAX_FEATURE_ECN_LOW - -Define and implement a new per-route feature, RTAX_FEATURE_ECN_LOW. - -This feature indicates that the given destination network is a -low-latency ECN environment, meaning both that ECN CE marks are -applied by the network using a low-latency marking threshold and also -that TCP endpoints provide precise per-data-segment ECN feedback in -ACKs (where the ACK ECE flag echoes the received CE status of all -newly-acknowledged data segments). This feature indication can be used -by congestion control algorithms to decide how to interpret ECN -signals over the given destination network. - -This feature is appropriate for datacenter-style ECN marking, such as -the ECN marking approach expected by DCTCP or BBR congestion control -modules. - -Signed-off-by: David Morley -Signed-off-by: Neal Cardwell -Signed-off-by: Yuchung Cheng -Tested-by: David Morley -Change-Id: I6bc06e9c6cb426fbae7243fc71c9a8c18175f5d3 -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 10 ++++++++++ - include/uapi/linux/rtnetlink.h | 4 +++- - net/ipv4/tcp_minisocks.c | 2 ++ - net/ipv4/tcp_output.c | 6 ++++-- - 4 files changed, 19 insertions(+), 3 deletions(-) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -379,6 +379,7 @@ static inline void tcp_dec_quickack_mode - #define TCP_ECN_DEMAND_CWR BIT(2) - #define TCP_ECN_SEEN BIT(3) - #define TCP_ECN_MODE_ACCECN BIT(4) -+#define TCP_ECN_LOW BIT(5) - - #define TCP_ECN_DISABLED 0 - #define TCP_ECN_MODE_PENDING (TCP_ECN_MODE_RFC3168 | TCP_ECN_MODE_ACCECN) -@@ -840,6 +841,15 @@ static inline void tcp_fast_path_check(s - - u32 tcp_delack_max(const struct sock *sk); - -+static inline void tcp_set_ecn_low_from_dst(struct sock *sk, -+ const struct dst_entry *dst) -+{ -+ struct tcp_sock *tp = tcp_sk(sk); -+ -+ if (dst_feature(dst, RTAX_FEATURE_ECN_LOW)) -+ tp->ecn_flags |= TCP_ECN_LOW; -+} -+ - /* Compute the actual rto_min value */ - static inline u32 tcp_rto_min(const struct sock *sk) - { ---- a/include/uapi/linux/rtnetlink.h -+++ b/include/uapi/linux/rtnetlink.h -@@ -517,12 +517,14 @@ enum { - #define RTAX_FEATURE_TIMESTAMP (1 << 2) /* unused */ - #define RTAX_FEATURE_ALLFRAG (1 << 3) /* unused */ - #define RTAX_FEATURE_TCP_USEC_TS (1 << 4) -+#define RTAX_FEATURE_ECN_LOW (1 << 5) - - #define RTAX_FEATURE_MASK (RTAX_FEATURE_ECN | \ - RTAX_FEATURE_SACK | \ - RTAX_FEATURE_TIMESTAMP | \ - RTAX_FEATURE_ALLFRAG | \ -- RTAX_FEATURE_TCP_USEC_TS) -+ RTAX_FEATURE_TCP_USEC_TS | \ -+ RTAX_FEATURE_ECN_LOW) - - struct rta_session { - __u8 proto; ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -472,6 +472,8 @@ void tcp_ca_openreq_child(struct sock *s - u32 ca_key = dst_metric(dst, RTAX_CC_ALGO); - bool ca_got_dst = false; - -+ tcp_set_ecn_low_from_dst(sk, dst); -+ - if (ca_key != TCP_CA_UNSPEC) { - const struct tcp_congestion_ops *ca; - ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -339,10 +339,9 @@ static void tcp_ecn_send_syn(struct sock - bool bpf_needs_ecn = tcp_bpf_ca_needs_ecn(sk); - bool use_ecn = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_ecn) == 1 || - tcp_ca_needs_ecn(sk) || bpf_needs_ecn; -+ const struct dst_entry *dst = __sk_dst_get(sk); - - if (!use_ecn) { -- const struct dst_entry *dst = __sk_dst_get(sk); -- - if (dst && dst_feature(dst, RTAX_FEATURE_ECN)) - use_ecn = true; - } -@@ -354,6 +353,9 @@ static void tcp_ecn_send_syn(struct sock - tcp_ecn_mode_set(tp, TCP_ECN_MODE_RFC3168); - if (tcp_ca_needs_ecn(sk) || bpf_needs_ecn) - INET_ECN_xmit(sk); -+ -+ if (dst) -+ tcp_set_ecn_low_from_dst(sk, dst); - } - } - diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0017-net-tcp_bbr-v3-ensure-ECN-enabled-BBR-flows-set-ECT-.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0017-net-tcp_bbr-v3-ensure-ECN-enabled-BBR-flows-set-ECT-.patch deleted file mode 100644 index 95db621..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0017-net-tcp_bbr-v3-ensure-ECN-enabled-BBR-flows-set-ECT-.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 45615e9d62a6b0b688a284dc712c243295df9e65 Mon Sep 17 00:00:00 2001 -From: Adithya Abraham Philip -Date: Fri, 11 Jun 2021 21:56:10 +0000 -Subject: [PATCH 17/18] net-tcp_bbr: v3: ensure ECN-enabled BBR flows set ECT - on retransmits - -Adds a new flag TCP_ECN_ECT_PERMANENT that is used by CCAs to -indicate that retransmitted packets and pure ACKs must have the -ECT bit set. This is necessary for BBR, which when using -ECN expects ECT to be set even on retransmitted packets and ACKs. - -Previous to this addition of TCP_ECN_ECT_PERMANENT, CCAs which can use -ECN but don't "need" it did not have a way to indicate that ECT should -be set on retransmissions/ACKs. - -Signed-off-by: Adithya Abraham Philip -Signed-off-by: Neal Cardwell -Change-Id: I8b048eaab35e136fe6501ef6cd89fd9faa15e6d2 -Signed-off-by: Alexandre Frade ---- - include/net/tcp.h | 1 + - net/ipv4/tcp_bbr.c | 3 +++ - net/ipv4/tcp_output.c | 3 ++- - 3 files changed, 6 insertions(+), 1 deletion(-) - ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -380,6 +380,7 @@ static inline void tcp_dec_quickack_mode - #define TCP_ECN_SEEN BIT(3) - #define TCP_ECN_MODE_ACCECN BIT(4) - #define TCP_ECN_LOW BIT(5) -+#define TCP_ECN_ECT_PERMANENT BIT(6) - - #define TCP_ECN_DISABLED 0 - #define TCP_ECN_MODE_PENDING (TCP_ECN_MODE_RFC3168 | TCP_ECN_MODE_ACCECN) ---- a/net/ipv4/tcp_bbr.c -+++ b/net/ipv4/tcp_bbr.c -@@ -2154,6 +2154,9 @@ __bpf_kfunc static void bbr_init(struct - bbr->plb.pause_until = 0; - - tp->fast_ack_mode = bbr_fast_ack_mode ? 1 : 0; -+ -+ if (bbr_can_use_ecn(sk)) -+ tp->ecn_flags |= TCP_ECN_ECT_PERMANENT; - } - - /* BBR marks the current round trip as a loss round. */ ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -393,7 +393,8 @@ static void tcp_ecn_send(struct sock *sk - th->cwr = 1; - skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN; - } -- } else if (!tcp_ca_needs_ecn(sk)) { -+ } else if (!(tp->ecn_flags & TCP_ECN_ECT_PERMANENT) && -+ !tcp_ca_needs_ecn(sk)) { - /* ACK or retransmitted segment: clear ECT|CE */ - INET_ECN_dontxmit(sk); - } diff --git a/debian/patches/patchset-xanmod/net/tcp/bbr3/0018-tcp-export-TCPI_OPT_ECN_LOW-in-tcp_info-tcpi_options.patch b/debian/patches/patchset-xanmod/net/tcp/bbr3/0018-tcp-export-TCPI_OPT_ECN_LOW-in-tcp_info-tcpi_options.patch deleted file mode 100644 index 1cd309b..0000000 --- a/debian/patches/patchset-xanmod/net/tcp/bbr3/0018-tcp-export-TCPI_OPT_ECN_LOW-in-tcp_info-tcpi_options.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 461bd4bd12039886127019682ba6e7f372d9fa0b Mon Sep 17 00:00:00 2001 -From: Neal Cardwell -Date: Sun, 23 Jul 2023 23:25:34 -0400 -Subject: [PATCH 18/18] tcp: export TCPI_OPT_ECN_LOW in tcp_info tcpi_options - field - -Analogous to other important ECN information, export TCPI_OPT_ECN_LOW -in tcp_info tcpi_options field. - -Signed-off-by: Neal Cardwell -Change-Id: I08d8d8c7e8780e6e37df54038ee50301ac5a0320 -Signed-off-by: Alexandre Frade ---- - include/uapi/linux/tcp.h | 1 + - net/ipv4/tcp.c | 2 ++ - 2 files changed, 3 insertions(+) - ---- a/include/uapi/linux/tcp.h -+++ b/include/uapi/linux/tcp.h -@@ -184,6 +184,7 @@ enum tcp_fastopen_client_fail { - #define TCPI_OPT_ECN_SEEN 16 /* we received at least one packet with ECT */ - #define TCPI_OPT_SYN_DATA 32 /* SYN-ACK acked data in SYN sent or rcvd */ - #define TCPI_OPT_USEC_TS 64 /* usec timestamps */ -+#define TCPI_OPT_ECN_LOW 128 /* Low-latency ECN enabled at conn init */ - - /* - * Sender's congestion state indicating normal or abnormal situations ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -4159,6 +4159,8 @@ void tcp_get_info(struct sock *sk, struc - info->tcpi_options |= TCPI_OPT_ECN; - if (tp->ecn_flags & TCP_ECN_SEEN) - info->tcpi_options |= TCPI_OPT_ECN_SEEN; -+ if (tp->ecn_flags & TCP_ECN_LOW) -+ info->tcpi_options |= TCPI_OPT_ECN_LOW; - if (tp->syn_data_acked) - info->tcpi_options |= TCPI_OPT_SYN_DATA; - if (tp->tcp_usec_ts) diff --git a/debian/patches/patchset-xanmod/net/tcp/cloudflare/0001-tcp-Add-a-sysctl-to-skip-tcp-collapse-processing-whe.patch b/debian/patches/patchset-xanmod/net/tcp/cloudflare/0001-tcp-Add-a-sysctl-to-skip-tcp-collapse-processing-whe.patch index c00e193..b14bfdf 100644 --- a/debian/patches/patchset-xanmod/net/tcp/cloudflare/0001-tcp-Add-a-sysctl-to-skip-tcp-collapse-processing-whe.patch +++ b/debian/patches/patchset-xanmod/net/tcp/cloudflare/0001-tcp-Add-a-sysctl-to-skip-tcp-collapse-processing-whe.patch @@ -1,4 +1,4 @@ -From 1b7e9ad0803cef8cf087bb67a6e4c8d63a02405b Mon Sep 17 00:00:00 2001 +From 4941d9d4ebd5acbee74245ce22f32eca2e320d98 Mon Sep 17 00:00:00 2001 From: "mfreemon@cloudflare.com" Date: Tue, 1 Mar 2022 17:06:02 -0600 Subject: [PATCH] tcp: Add a sysctl to skip tcp collapse processing when the @@ -41,7 +41,7 @@ Signed-off-by: Alexandre Frade --- a/include/net/netns/ipv4.h +++ b/include/net/netns/ipv4.h -@@ -230,6 +230,7 @@ struct netns_ipv4 { +@@ -240,6 +240,7 @@ struct netns_ipv4 { u8 sysctl_fib_notify_on_flag_change; u8 sysctl_tcp_syn_linear_timeouts; @@ -51,8 +51,8 @@ Signed-off-by: Alexandre Frade u8 sysctl_udp_l3mdev_accept; --- a/include/trace/events/tcp.h +++ b/include/trace/events/tcp.h -@@ -213,6 +213,13 @@ DEFINE_EVENT(tcp_event_sk, tcp_rcv_space - TP_ARGS(sk) +@@ -286,6 +286,13 @@ TRACE_EVENT(tcp_rcvbuf_grow, + __entry->sock_cookie) ); +DEFINE_EVENT(tcp_event_sk, tcp_collapse_max_bytes_exceeded, @@ -83,7 +83,7 @@ Signed-off-by: Alexandre Frade .maxlen = sizeof(u8), --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c -@@ -5693,6 +5693,7 @@ static bool tcp_prune_ofo_queue(struct s +@@ -5695,6 +5695,7 @@ static bool tcp_prune_ofo_queue(struct s static int tcp_prune_queue(struct sock *sk, const struct sk_buff *in_skb) { struct tcp_sock *tp = tcp_sk(sk); @@ -91,7 +91,7 @@ Signed-off-by: Alexandre Frade NET_INC_STATS(sock_net(sk), LINUX_MIB_PRUNECALLED); -@@ -5704,6 +5705,39 @@ static int tcp_prune_queue(struct sock * +@@ -5706,6 +5707,39 @@ static int tcp_prune_queue(struct sock * if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) return 0; @@ -131,7 +131,7 @@ Signed-off-by: Alexandre Frade tcp_collapse_ofo_queue(sk); if (!skb_queue_empty(&sk->sk_receive_queue)) tcp_collapse(sk, &sk->sk_receive_queue, NULL, -@@ -5722,6 +5756,8 @@ static int tcp_prune_queue(struct sock * +@@ -5724,6 +5758,8 @@ static int tcp_prune_queue(struct sock * if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) return 0; @@ -142,7 +142,7 @@ Signed-off-by: Alexandre Frade * and hopefully then we'll have sufficient space. --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c -@@ -3541,6 +3541,7 @@ static int __net_init tcp_sk_init(struct +@@ -3542,6 +3542,7 @@ static int __net_init tcp_sk_init(struct net->ipv4.sysctl_tcp_syn_linear_timeouts = 4; net->ipv4.sysctl_tcp_shrink_window = 0; diff --git a/debian/patches/patchset-xanmod/pci_acso/0001-PCI-Enable-overrides-for-missing-ACS-capabilities.patch b/debian/patches/patchset-xanmod/pci_acso/0001-PCI-Enable-overrides-for-missing-ACS-capabilities.patch index 76a8722..5a30b04 100644 --- a/debian/patches/patchset-xanmod/pci_acso/0001-PCI-Enable-overrides-for-missing-ACS-capabilities.patch +++ b/debian/patches/patchset-xanmod/pci_acso/0001-PCI-Enable-overrides-for-missing-ACS-capabilities.patch @@ -1,4 +1,4 @@ -From c98d1c0e1f4b119313eb5852ccbf14b748c5d4a4 Mon Sep 17 00:00:00 2001 +From 0d49c54082a9e3504feb517fc5e0095798bc5f14 Mon Sep 17 00:00:00 2001 From: Mark Weiman Date: Sun, 12 Aug 2018 11:36:21 -0400 Subject: [PATCH] PCI: Enable overrides for missing ACS capabilities @@ -55,7 +55,7 @@ Signed-off-by: Alexandre Frade --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -4691,6 +4691,15 @@ +@@ -4734,6 +4734,15 @@ nomsi [MSI] If the PCI_MSI kernel config parameter is enabled, this kernel boot option can be used to disable the use of MSI interrupts system-wide. @@ -73,7 +73,7 @@ Signed-off-by: Alexandre Frade should never be necessary. --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c -@@ -3749,6 +3749,106 @@ static void quirk_no_bus_reset(struct pc +@@ -3745,6 +3745,106 @@ static void quirk_no_bus_reset(struct pc dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; } @@ -180,7 +180,7 @@ Signed-off-by: Alexandre Frade /* * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be * prevented for those affected devices. -@@ -5196,6 +5296,8 @@ static const struct pci_dev_acs_enabled +@@ -5192,6 +5292,8 @@ static const struct pci_dev_acs_enabled { PCI_VENDOR_ID_ZHAOXIN, PCI_ANY_ID, pci_quirk_zhaoxin_pcie_ports_acs }, /* Wangxun nics */ { PCI_VENDOR_ID_WANGXUN, PCI_ANY_ID, pci_quirk_wangxun_nic_acs }, diff --git a/debian/patches/patchset-xanmod/valve/0001-extcon-Add-driver-for-Steam-Deck.patch b/debian/patches/patchset-xanmod/valve/0001-extcon-Add-driver-for-Steam-Deck.patch index 15d40fe..4e66b67 100644 --- a/debian/patches/patchset-xanmod/valve/0001-extcon-Add-driver-for-Steam-Deck.patch +++ b/debian/patches/patchset-xanmod/valve/0001-extcon-Add-driver-for-Steam-Deck.patch @@ -1,4 +1,4 @@ -From 14d0907ef9d3f5c708d6aff478e32c64cda3d488 Mon Sep 17 00:00:00 2001 +From 2ab619d115fa9b850f95844ab55745d27a637f43 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Sun, 27 Feb 2022 14:46:08 -0800 Subject: [PATCH 1/6] extcon: Add driver for Steam Deck diff --git a/debian/patches/patchset-xanmod/valve/0002-hwmon-Add-driver-for-Steam-Deck-s-EC-sensors.patch b/debian/patches/patchset-xanmod/valve/0002-hwmon-Add-driver-for-Steam-Deck-s-EC-sensors.patch index 1786d69..62db3eb 100644 --- a/debian/patches/patchset-xanmod/valve/0002-hwmon-Add-driver-for-Steam-Deck-s-EC-sensors.patch +++ b/debian/patches/patchset-xanmod/valve/0002-hwmon-Add-driver-for-Steam-Deck-s-EC-sensors.patch @@ -1,4 +1,4 @@ -From 3c5ff39975ce84f9d395349445a8742d58f16a20 Mon Sep 17 00:00:00 2001 +From 7da220466b677e5022380e42899e2521d24bb848 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Sat, 19 Feb 2022 16:09:45 -0800 Subject: [PATCH 2/6] hwmon: Add driver for Steam Deck's EC sensors @@ -17,7 +17,7 @@ Signed-off-by: Alexandre Frade --- a/drivers/hwmon/Kconfig +++ b/drivers/hwmon/Kconfig -@@ -2110,6 +2110,17 @@ config SENSORS_SCH5636 +@@ -2118,6 +2118,17 @@ config SENSORS_SCH5636 This driver can also be built as a module. If so, the module will be called sch5636. @@ -37,7 +37,7 @@ Signed-off-by: Alexandre Frade depends on I2C --- a/drivers/hwmon/Makefile +++ b/drivers/hwmon/Makefile -@@ -213,6 +213,7 @@ obj-$(CONFIG_SENSORS_SMSC47M1) += smsc47 +@@ -215,6 +215,7 @@ obj-$(CONFIG_SENSORS_SMSC47M1) += smsc47 obj-$(CONFIG_SENSORS_SMSC47M192)+= smsc47m192.o obj-$(CONFIG_SENSORS_SPARX5) += sparx5-temp.o obj-$(CONFIG_SENSORS_SPD5118) += spd5118.o diff --git a/debian/patches/patchset-xanmod/valve/0003-hwmon-steamdeck-hwmon-Add-support-for-max-battery-le.patch b/debian/patches/patchset-xanmod/valve/0003-hwmon-steamdeck-hwmon-Add-support-for-max-battery-le.patch index f17b5bc..dd63779 100644 --- a/debian/patches/patchset-xanmod/valve/0003-hwmon-steamdeck-hwmon-Add-support-for-max-battery-le.patch +++ b/debian/patches/patchset-xanmod/valve/0003-hwmon-steamdeck-hwmon-Add-support-for-max-battery-le.patch @@ -1,4 +1,4 @@ -From 5e06cdcc7f6bf61b94a61f5b421573d2e12c0575 Mon Sep 17 00:00:00 2001 +From d4dabdc6f5c3cedfb4f5bb1601624a6b8721f8f6 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Sat, 15 Jul 2023 12:58:54 -0700 Subject: [PATCH 3/6] hwmon: steamdeck-hwmon: Add support for max battery diff --git a/debian/patches/patchset-xanmod/valve/0004-leds-steamdeck-Add-support-for-Steam-Deck-LED.patch b/debian/patches/patchset-xanmod/valve/0004-leds-steamdeck-Add-support-for-Steam-Deck-LED.patch index d356aac..4231b07 100644 --- a/debian/patches/patchset-xanmod/valve/0004-leds-steamdeck-Add-support-for-Steam-Deck-LED.patch +++ b/debian/patches/patchset-xanmod/valve/0004-leds-steamdeck-Add-support-for-Steam-Deck-LED.patch @@ -1,4 +1,4 @@ -From a73fb7a13f21fdee3ffe8f900f32b7f3a325e60a Mon Sep 17 00:00:00 2001 +From 9ee8b0eb23529624f714ddf64177a98394f9d798 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Sun, 27 Feb 2022 12:58:05 -0800 Subject: [PATCH 4/6] leds: steamdeck: Add support for Steam Deck LED @@ -15,7 +15,7 @@ Signed-off-by: Alexandre Frade --- a/drivers/leds/Kconfig +++ b/drivers/leds/Kconfig -@@ -1013,6 +1013,13 @@ config LEDS_ACER_A500 +@@ -1020,6 +1020,13 @@ config LEDS_ACER_A500 This option enables support for the Power Button LED of Acer Iconia Tab A500. @@ -31,7 +31,7 @@ Signed-off-by: Alexandre Frade comment "Flash and Torch LED drivers" --- a/drivers/leds/Makefile +++ b/drivers/leds/Makefile -@@ -85,6 +85,7 @@ obj-$(CONFIG_LEDS_QNAP_MCU) += leds-qna +@@ -86,6 +86,7 @@ obj-$(CONFIG_LEDS_QNAP_MCU) += leds-qna obj-$(CONFIG_LEDS_REGULATOR) += leds-regulator.o obj-$(CONFIG_LEDS_SC27XX_BLTC) += leds-sc27xx-bltc.o obj-$(CONFIG_LEDS_ST1202) += leds-st1202.o diff --git a/debian/patches/patchset-xanmod/valve/0005-mfd-Add-MFD-core-driver-for-Steam-Deck.patch b/debian/patches/patchset-xanmod/valve/0005-mfd-Add-MFD-core-driver-for-Steam-Deck.patch index 113d8e1..608b36b 100644 --- a/debian/patches/patchset-xanmod/valve/0005-mfd-Add-MFD-core-driver-for-Steam-Deck.patch +++ b/debian/patches/patchset-xanmod/valve/0005-mfd-Add-MFD-core-driver-for-Steam-Deck.patch @@ -1,4 +1,4 @@ -From eaf78d7b957552deba7222ca6bd1dae28bdd420b Mon Sep 17 00:00:00 2001 +From 3a053cd6802ab65b8119140afda40921de19361d Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Sat, 19 Feb 2022 16:08:36 -0800 Subject: [PATCH 5/6] mfd: Add MFD core driver for Steam Deck @@ -19,7 +19,7 @@ Signed-off-by: Alexandre Frade --- a/drivers/mfd/Kconfig +++ b/drivers/mfd/Kconfig -@@ -2422,5 +2422,16 @@ config MFD_UPBOARD_FPGA +@@ -2463,5 +2463,16 @@ config MFD_UPBOARD_FPGA To compile this driver as a module, choose M here: the module will be called upboard-fpga. @@ -38,7 +38,7 @@ Signed-off-by: Alexandre Frade endif --- a/drivers/mfd/Makefile +++ b/drivers/mfd/Makefile -@@ -290,3 +290,5 @@ obj-$(CONFIG_MFD_RSMU_I2C) += rsmu_i2c.o +@@ -294,3 +294,5 @@ obj-$(CONFIG_MFD_RSMU_I2C) += rsmu_i2c.o obj-$(CONFIG_MFD_RSMU_SPI) += rsmu_spi.o rsmu_core.o obj-$(CONFIG_MFD_UPBOARD_FPGA) += upboard-fpga.o diff --git a/debian/patches/patchset-xanmod/valve/0006-mfd-steamdeck-Expose-controller-board-power-in-sysfs.patch b/debian/patches/patchset-xanmod/valve/0006-mfd-steamdeck-Expose-controller-board-power-in-sysfs.patch index c877efe..ee149de 100644 --- a/debian/patches/patchset-xanmod/valve/0006-mfd-steamdeck-Expose-controller-board-power-in-sysfs.patch +++ b/debian/patches/patchset-xanmod/valve/0006-mfd-steamdeck-Expose-controller-board-power-in-sysfs.patch @@ -1,4 +1,4 @@ -From 1755d1224560a5d3379489cf83efefdf6fd7d93c Mon Sep 17 00:00:00 2001 +From 97d0aafc2f115cc2df7fd486658659d28930e66c Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Sun, 24 Sep 2023 15:02:33 -0700 Subject: [PATCH 6/6] mfd: steamdeck: Expose controller board power in sysfs diff --git a/debian/patches/patchset-xanmod/xanmod/0001-kbuild-Re-add-.config-file-required-to-sign-external.patch b/debian/patches/patchset-xanmod/xanmod/0001-kbuild-Re-add-.config-file-required-to-sign-external.patch index aa0336e..1a08765 100644 --- a/debian/patches/patchset-xanmod/xanmod/0001-kbuild-Re-add-.config-file-required-to-sign-external.patch +++ b/debian/patches/patchset-xanmod/xanmod/0001-kbuild-Re-add-.config-file-required-to-sign-external.patch @@ -1,7 +1,7 @@ -From 7479efa37dfb05263e0984ca1e1a3da22fa62414 Mon Sep 17 00:00:00 2001 +From 8f188bee3819f45c66b00ffd8a8f3b65247efcdb Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Thu, 28 Nov 2024 22:55:27 +0000 -Subject: [PATCH 03/19] kbuild: Re-add .config file required to sign external +Subject: [PATCH 05/20] kbuild: Re-add .config file required to sign external modules Signed-off-by: Alexandre Frade diff --git a/debian/patches/patchset-xanmod/xanmod/0003-XANMOD-fair-Set-scheduler-tunable-latencies-to-unsca.patch b/debian/patches/patchset-xanmod/xanmod/0002-XANMOD-fair-Set-scheduler-tunable-latencies-to-unsca.patch similarity index 81% rename from debian/patches/patchset-xanmod/xanmod/0003-XANMOD-fair-Set-scheduler-tunable-latencies-to-unsca.patch rename to debian/patches/patchset-xanmod/xanmod/0002-XANMOD-fair-Set-scheduler-tunable-latencies-to-unsca.patch index 2d880ef..58b9529 100644 --- a/debian/patches/patchset-xanmod/xanmod/0003-XANMOD-fair-Set-scheduler-tunable-latencies-to-unsca.patch +++ b/debian/patches/patchset-xanmod/xanmod/0002-XANMOD-fair-Set-scheduler-tunable-latencies-to-unsca.patch @@ -1,7 +1,7 @@ -From 3cd805916cf93d70ef73a006ed54c737c1bb44ca Mon Sep 17 00:00:00 2001 +From dc18410893372cca1aad9e912fd119f462b2d89a Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Thu, 11 May 2023 19:41:41 +0000 -Subject: [PATCH 05/19] XANMOD: fair: Set scheduler tunable latencies to +Subject: [PATCH 06/20] XANMOD: fair: Set scheduler tunable latencies to unscaled Signed-off-by: Alexandre Frade diff --git a/debian/patches/patchset-xanmod/xanmod/0002-kbuild-Remove-GCC-minimal-function-alignment.patch b/debian/patches/patchset-xanmod/xanmod/0002-kbuild-Remove-GCC-minimal-function-alignment.patch deleted file mode 100644 index 90961ca..0000000 --- a/debian/patches/patchset-xanmod/xanmod/0002-kbuild-Remove-GCC-minimal-function-alignment.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 0d678f81894ace50347c6223255b8263161299fe Mon Sep 17 00:00:00 2001 -From: Alexandre Frade -Date: Sat, 31 Aug 2024 16:57:41 +0000 -Subject: [PATCH 04/19] kbuild: Remove GCC minimal function alignment - -Signed-off-by: Alexandre Frade ---- - Makefile | 7 ------- - arch/Kconfig | 12 ------------ - include/linux/compiler_types.h | 10 +++++----- - 3 files changed, 5 insertions(+), 24 deletions(-) - ---- a/Makefile -+++ b/Makefile -@@ -1058,15 +1058,8 @@ export CC_FLAGS_FPU - export CC_FLAGS_NO_FPU - - ifneq ($(CONFIG_FUNCTION_ALIGNMENT),0) --# Set the minimal function alignment. Use the newer GCC option --# -fmin-function-alignment if it is available, or fall back to -falign-funtions. --# See also CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT. --ifdef CONFIG_CC_HAS_MIN_FUNCTION_ALIGNMENT --KBUILD_CFLAGS += -fmin-function-alignment=$(CONFIG_FUNCTION_ALIGNMENT) --else - KBUILD_CFLAGS += -falign-functions=$(CONFIG_FUNCTION_ALIGNMENT) - endif --endif - - # arch Makefile may override CC so keep this after arch Makefile is included - NOSTDINC_FLAGS += -nostdinc ---- a/arch/Kconfig -+++ b/arch/Kconfig -@@ -1734,18 +1734,6 @@ config FUNCTION_ALIGNMENT - default 4 if FUNCTION_ALIGNMENT_4B - default 0 - --config CC_HAS_MIN_FUNCTION_ALIGNMENT -- # Detect availability of the GCC option -fmin-function-alignment which -- # guarantees minimal alignment for all functions, unlike -- # -falign-functions which the compiler ignores for cold functions. -- def_bool $(cc-option, -fmin-function-alignment=8) -- --config CC_HAS_SANE_FUNCTION_ALIGNMENT -- # Set if the guaranteed alignment with -fmin-function-alignment is -- # available or extra care is required in the kernel. Clang provides -- # strict alignment always, even with -falign-functions. -- def_bool CC_HAS_MIN_FUNCTION_ALIGNMENT || CC_IS_CLANG -- - config ARCH_NEED_CMPXCHG_1_EMU - bool - ---- a/include/linux/compiler_types.h -+++ b/include/linux/compiler_types.h -@@ -99,17 +99,17 @@ static inline void __chk_io_ptr(const vo - * gcc: https://gcc.gnu.org/onlinedocs/gcc/Label-Attributes.html#index-cold-label-attribute - * - * When -falign-functions=N is in use, we must avoid the cold attribute as -- * GCC drops the alignment for cold functions. Worse, GCC can implicitly mark -- * callees of cold functions as cold themselves, so it's not sufficient to add -- * __function_aligned here as that will not ensure that callees are correctly -- * aligned. -+ * contemporary versions of GCC drop the alignment for cold functions. Worse, -+ * GCC can implicitly mark callees of cold functions as cold themselves, so -+ * it's not sufficient to add __function_aligned here as that will not ensure -+ * that callees are correctly aligned. - * - * See: - * - * https://lore.kernel.org/lkml/Y77%2FqVgvaJidFpYt@FVFF77S0Q05N - * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345#c9 - */ --#if defined(CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT) || (CONFIG_FUNCTION_ALIGNMENT == 0) -+#if !defined(CONFIG_CC_IS_GCC) || (CONFIG_FUNCTION_ALIGNMENT == 0) - #define __cold __attribute__((__cold__)) - #else - #define __cold diff --git a/debian/patches/patchset-xanmod/xanmod/0004-XANMOD-sched-Add-yield_type-sysctl-to-reduce-or-disa.patch b/debian/patches/patchset-xanmod/xanmod/0003-XANMOD-sched-Add-yield_type-sysctl-to-reduce-or-disa.patch similarity index 77% rename from debian/patches/patchset-xanmod/xanmod/0004-XANMOD-sched-Add-yield_type-sysctl-to-reduce-or-disa.patch rename to debian/patches/patchset-xanmod/xanmod/0003-XANMOD-sched-Add-yield_type-sysctl-to-reduce-or-disa.patch index 680dd01..85ac6bf 100644 --- a/debian/patches/patchset-xanmod/xanmod/0004-XANMOD-sched-Add-yield_type-sysctl-to-reduce-or-disa.patch +++ b/debian/patches/patchset-xanmod/xanmod/0003-XANMOD-sched-Add-yield_type-sysctl-to-reduce-or-disa.patch @@ -1,7 +1,7 @@ -From fa6afaf41316657a46bc70c9e942051e15e837fd Mon Sep 17 00:00:00 2001 +From 3ad875b148a5b6cd734767979c0e99abde0cd27d Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Sun, 15 Sep 2024 23:03:38 +0000 -Subject: [PATCH 06/19] XANMOD: sched: Add yield_type sysctl to reduce or +Subject: [PATCH 07/20] XANMOD: sched: Add yield_type sysctl to reduce or disable sched_yield Signed-off-by: Alexandre Frade @@ -12,7 +12,7 @@ Signed-off-by: Alexandre Frade --- a/kernel/sched/syscalls.c +++ b/kernel/sched/syscalls.c -@@ -1350,15 +1350,29 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t +@@ -1351,15 +1351,29 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t return ret; } @@ -45,7 +45,7 @@ Signed-off-by: Alexandre Frade rq_unlock_irq(rq, &rf); --- a/kernel/sysctl.c +++ b/kernel/sysctl.c -@@ -80,6 +80,8 @@ EXPORT_SYMBOL_GPL(sysctl_long_vals); +@@ -73,6 +73,8 @@ EXPORT_SYMBOL_GPL(sysctl_long_vals); #if defined(CONFIG_SYSCTL) @@ -54,10 +54,10 @@ Signed-off-by: Alexandre Frade /* Constants used for minimum and maximum */ static const int ngroups_max = NGROUPS_MAX; static const int cap_last_cap = CAP_LAST_CAP; -@@ -1608,6 +1610,15 @@ static const struct ctl_table kern_table - .proc_handler = proc_dointvec, - }, - #endif +@@ -1585,6 +1587,15 @@ int proc_do_static_key(const struct ctl_ + } + + static const struct ctl_table kern_table[] = { + { + .procname = "yield_type", + .data = &sysctl_sched_yield_type, @@ -67,6 +67,6 @@ Signed-off-by: Alexandre Frade + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_TWO, + }, - #ifdef CONFIG_PROC_SYSCTL + #ifdef CONFIG_USER_NS { - .procname = "tainted", + .procname = "unprivileged_userns_clone", diff --git a/debian/patches/patchset-xanmod/xanmod/0005-XANMOD-block-mq-deadline-Increase-write-priority-to-.patch b/debian/patches/patchset-xanmod/xanmod/0004-XANMOD-block-mq-deadline-Increase-write-priority-to-.patch similarity index 91% rename from debian/patches/patchset-xanmod/xanmod/0005-XANMOD-block-mq-deadline-Increase-write-priority-to-.patch rename to debian/patches/patchset-xanmod/xanmod/0004-XANMOD-block-mq-deadline-Increase-write-priority-to-.patch index 4d719ee..69e0318 100644 --- a/debian/patches/patchset-xanmod/xanmod/0005-XANMOD-block-mq-deadline-Increase-write-priority-to-.patch +++ b/debian/patches/patchset-xanmod/xanmod/0004-XANMOD-block-mq-deadline-Increase-write-priority-to-.patch @@ -1,7 +1,7 @@ -From 5dc5d7a3a1c25cd5d7c2079bbe56ff7c0066c76a Mon Sep 17 00:00:00 2001 +From db31ff982d647321b426693b3779855926a831db Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Wed, 11 May 2022 18:56:51 +0000 -Subject: [PATCH 07/19] XANMOD: block/mq-deadline: Increase write priority to +Subject: [PATCH 08/20] XANMOD: block/mq-deadline: Increase write priority to improve responsiveness Signed-off-by: Alexandre Frade diff --git a/debian/patches/patchset-xanmod/xanmod/0006-XANMOD-block-mq-deadline-Disable-front_merges-by-def.patch b/debian/patches/patchset-xanmod/xanmod/0005-XANMOD-block-mq-deadline-Disable-front_merges-by-def.patch similarity index 83% rename from debian/patches/patchset-xanmod/xanmod/0006-XANMOD-block-mq-deadline-Disable-front_merges-by-def.patch rename to debian/patches/patchset-xanmod/xanmod/0005-XANMOD-block-mq-deadline-Disable-front_merges-by-def.patch index 26fa7b0..11acd72 100644 --- a/debian/patches/patchset-xanmod/xanmod/0006-XANMOD-block-mq-deadline-Disable-front_merges-by-def.patch +++ b/debian/patches/patchset-xanmod/xanmod/0005-XANMOD-block-mq-deadline-Disable-front_merges-by-def.patch @@ -1,7 +1,7 @@ -From 83f38053e977907d085d7f27a24f1b2844a03f1c Mon Sep 17 00:00:00 2001 +From 5a6a3325e1d23b8981e9ed747276a2b6d7d316a2 Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Thu, 6 Jan 2022 16:59:01 +0000 -Subject: [PATCH 08/19] XANMOD: block/mq-deadline: Disable front_merges by +Subject: [PATCH 09/20] XANMOD: block/mq-deadline: Disable front_merges by default Signed-off-by: Alexandre Frade diff --git a/debian/patches/patchset-xanmod/xanmod/0007-XANMOD-block-Set-rq_affinity-to-force-complete-I-O-r.patch b/debian/patches/patchset-xanmod/xanmod/0006-XANMOD-block-Set-rq_affinity-to-force-complete-I-O-r.patch similarity index 80% rename from debian/patches/patchset-xanmod/xanmod/0007-XANMOD-block-Set-rq_affinity-to-force-complete-I-O-r.patch rename to debian/patches/patchset-xanmod/xanmod/0006-XANMOD-block-Set-rq_affinity-to-force-complete-I-O-r.patch index 7c8dbcd..b8e9933 100644 --- a/debian/patches/patchset-xanmod/xanmod/0007-XANMOD-block-Set-rq_affinity-to-force-complete-I-O-r.patch +++ b/debian/patches/patchset-xanmod/xanmod/0006-XANMOD-block-Set-rq_affinity-to-force-complete-I-O-r.patch @@ -1,7 +1,7 @@ -From 6c75a84f9f89c848e76650cc66672246fa62843f Mon Sep 17 00:00:00 2001 +From 6412c4a256e906ab8bbcddc1be56910613f3c375 Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Mon, 16 Sep 2024 15:36:01 +0000 -Subject: [PATCH 09/19] XANMOD: block: Set rq_affinity to force complete I/O +Subject: [PATCH 10/20] XANMOD: block: Set rq_affinity to force complete I/O requests on same CPU Signed-off-by: Alexandre Frade @@ -11,7 +11,7 @@ Signed-off-by: Alexandre Frade --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h -@@ -652,7 +652,8 @@ enum { +@@ -655,7 +655,8 @@ enum { QUEUE_FLAG_MAX }; diff --git a/debian/patches/patchset-xanmod/xanmod/0008-XANMOD-blk-wbt-Set-wbt_default_latency_nsec-to-2msec.patch b/debian/patches/patchset-xanmod/xanmod/0007-XANMOD-blk-wbt-Set-wbt_default_latency_nsec-to-2msec.patch similarity index 77% rename from debian/patches/patchset-xanmod/xanmod/0008-XANMOD-blk-wbt-Set-wbt_default_latency_nsec-to-2msec.patch rename to debian/patches/patchset-xanmod/xanmod/0007-XANMOD-blk-wbt-Set-wbt_default_latency_nsec-to-2msec.patch index 5d5e95e..e9a71d2 100644 --- a/debian/patches/patchset-xanmod/xanmod/0008-XANMOD-blk-wbt-Set-wbt_default_latency_nsec-to-2msec.patch +++ b/debian/patches/patchset-xanmod/xanmod/0007-XANMOD-blk-wbt-Set-wbt_default_latency_nsec-to-2msec.patch @@ -1,7 +1,7 @@ -From 287c275293025e956f2144e55de8cc51eec0811b Mon Sep 17 00:00:00 2001 +From a16d2a485d2dd60d91fd166c0cd09835d57ce5dc Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Mon, 15 Jul 2024 04:50:34 +0000 -Subject: [PATCH 10/19] XANMOD: blk-wbt: Set wbt_default_latency_nsec() to +Subject: [PATCH 11/20] XANMOD: blk-wbt: Set wbt_default_latency_nsec() to 2msec Signed-off-by: Alexandre Frade @@ -11,7 +11,7 @@ Signed-off-by: Alexandre Frade --- a/block/blk-wbt.c +++ b/block/blk-wbt.c -@@ -727,14 +727,8 @@ EXPORT_SYMBOL_GPL(wbt_enable_default); +@@ -730,14 +730,8 @@ EXPORT_SYMBOL_GPL(wbt_enable_default); u64 wbt_default_latency_nsec(struct request_queue *q) { diff --git a/debian/patches/patchset-xanmod/xanmod/0009-XANMOD-kconfig-add-500Hz-timer-interrupt-kernel-conf.patch b/debian/patches/patchset-xanmod/xanmod/0008-XANMOD-kconfig-add-500Hz-timer-interrupt-kernel-conf.patch similarity index 87% rename from debian/patches/patchset-xanmod/xanmod/0009-XANMOD-kconfig-add-500Hz-timer-interrupt-kernel-conf.patch rename to debian/patches/patchset-xanmod/xanmod/0008-XANMOD-kconfig-add-500Hz-timer-interrupt-kernel-conf.patch index aa45346..6550056 100644 --- a/debian/patches/patchset-xanmod/xanmod/0009-XANMOD-kconfig-add-500Hz-timer-interrupt-kernel-conf.patch +++ b/debian/patches/patchset-xanmod/xanmod/0008-XANMOD-kconfig-add-500Hz-timer-interrupt-kernel-conf.patch @@ -1,7 +1,7 @@ -From 25c1d0ad74a27ac80dbda2840eba4fe53046ed55 Mon Sep 17 00:00:00 2001 +From 9c77ecedb9f94f5140e6dcc15d9ab87adcc2d0ac Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Mon, 29 Jan 2018 17:26:15 +0000 -Subject: [PATCH 11/19] XANMOD: kconfig: add 500Hz timer interrupt kernel +Subject: [PATCH 12/20] XANMOD: kconfig: add 500Hz timer interrupt kernel config option Signed-off-by: Alexandre Frade diff --git a/debian/patches/patchset-xanmod/xanmod/0010-XANMOD-dcache-cache_pressure-50-decreases-the-rate-a.patch b/debian/patches/patchset-xanmod/xanmod/0009-XANMOD-vfs-Decrease-rate-at-which-vfs-caches-are-rec.patch similarity index 65% rename from debian/patches/patchset-xanmod/xanmod/0010-XANMOD-dcache-cache_pressure-50-decreases-the-rate-a.patch rename to debian/patches/patchset-xanmod/xanmod/0009-XANMOD-vfs-Decrease-rate-at-which-vfs-caches-are-rec.patch index bffd409..0355654 100644 --- a/debian/patches/patchset-xanmod/xanmod/0010-XANMOD-dcache-cache_pressure-50-decreases-the-rate-a.patch +++ b/debian/patches/patchset-xanmod/xanmod/0009-XANMOD-vfs-Decrease-rate-at-which-vfs-caches-are-rec.patch @@ -1,8 +1,8 @@ -From 185191cd2a98629f35cb5cd6c0116ceb33635dd8 Mon Sep 17 00:00:00 2001 +From 29bff014ffe0d6179dadb9d7882632c57d93822c Mon Sep 17 00:00:00 2001 From: Alexandre Frade -Date: Mon, 29 Jan 2018 16:59:22 +0000 -Subject: [PATCH 12/19] XANMOD: dcache: cache_pressure = 50 decreases the rate - at which VFS caches are reclaimed +Date: Mon, 28 Jul 2025 17:20:16 +0000 +Subject: [PATCH 13/20] XANMOD: vfs: Decrease rate at which vfs caches are + reclaimed Signed-off-by: Alexandre Frade --- @@ -17,6 +17,6 @@ Signed-off-by: Alexandre Frade */ -static int sysctl_vfs_cache_pressure __read_mostly = 100; +static int sysctl_vfs_cache_pressure __read_mostly = 50; + static int sysctl_vfs_cache_pressure_denom __read_mostly = 100; unsigned long vfs_pressure_ratio(unsigned long val) - { diff --git a/debian/patches/patchset-xanmod/xanmod/0011-XANMOD-mm-Raise-max_map_count-default-value.patch b/debian/patches/patchset-xanmod/xanmod/0010-XANMOD-mm-Raise-max_map_count-default-value.patch similarity index 90% rename from debian/patches/patchset-xanmod/xanmod/0011-XANMOD-mm-Raise-max_map_count-default-value.patch rename to debian/patches/patchset-xanmod/xanmod/0010-XANMOD-mm-Raise-max_map_count-default-value.patch index 722ebdf..55cd1c5 100644 --- a/debian/patches/patchset-xanmod/xanmod/0011-XANMOD-mm-Raise-max_map_count-default-value.patch +++ b/debian/patches/patchset-xanmod/xanmod/0010-XANMOD-mm-Raise-max_map_count-default-value.patch @@ -1,7 +1,7 @@ -From 653701587608c8113dd4c941526104cea83d697e Mon Sep 17 00:00:00 2001 +From 5de3ee4e997355118cbdc6249afebdf3bef3129a Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Sun, 28 Apr 2024 09:06:54 +0000 -Subject: [PATCH 13/19] XANMOD: mm: Raise max_map_count default value +Subject: [PATCH 14/20] XANMOD: mm: Raise max_map_count default value Signed-off-by: Alexandre Frade --- @@ -11,7 +11,7 @@ Signed-off-by: Alexandre Frade --- a/Documentation/admin-guide/sysctl/vm.rst +++ b/Documentation/admin-guide/sysctl/vm.rst -@@ -470,7 +470,7 @@ While most applications need less than a +@@ -477,7 +477,7 @@ While most applications need less than a programs, particularly malloc debuggers, may consume lots of them, e.g., up to one or two maps per allocation. diff --git a/debian/patches/patchset-xanmod/xanmod/0012-XANMOD-mm-vmscan-Reduce-amount-of-swapping.patch b/debian/patches/patchset-xanmod/xanmod/0011-XANMOD-mm-vmscan-Reduce-amount-of-swapping.patch similarity index 77% rename from debian/patches/patchset-xanmod/xanmod/0012-XANMOD-mm-vmscan-Reduce-amount-of-swapping.patch rename to debian/patches/patchset-xanmod/xanmod/0011-XANMOD-mm-vmscan-Reduce-amount-of-swapping.patch index 2cf5657..b5055c2 100644 --- a/debian/patches/patchset-xanmod/xanmod/0012-XANMOD-mm-vmscan-Reduce-amount-of-swapping.patch +++ b/debian/patches/patchset-xanmod/xanmod/0011-XANMOD-mm-vmscan-Reduce-amount-of-swapping.patch @@ -1,7 +1,7 @@ -From 7ede458d310744257808696e599b8e9b11333dd0 Mon Sep 17 00:00:00 2001 +From 5dc99919f35bd759762b4ebaee55cead67f80680 Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Fri, 30 May 2025 19:58:58 +0000 -Subject: [PATCH 14/19] XANMOD: mm/vmscan: Reduce amount of swapping +Subject: [PATCH 15/20] XANMOD: mm/vmscan: Reduce amount of swapping Signed-off-by: Alexandre Frade --- diff --git a/debian/patches/patchset-xanmod/xanmod/0013-XANMOD-sched-autogroup-Add-kernel-parameter-and-conf.patch b/debian/patches/patchset-xanmod/xanmod/0012-XANMOD-sched-autogroup-Add-kernel-parameter-and-conf.patch similarity index 91% rename from debian/patches/patchset-xanmod/xanmod/0013-XANMOD-sched-autogroup-Add-kernel-parameter-and-conf.patch rename to debian/patches/patchset-xanmod/xanmod/0012-XANMOD-sched-autogroup-Add-kernel-parameter-and-conf.patch index 0c38621..e4462f4 100644 --- a/debian/patches/patchset-xanmod/xanmod/0013-XANMOD-sched-autogroup-Add-kernel-parameter-and-conf.patch +++ b/debian/patches/patchset-xanmod/xanmod/0012-XANMOD-sched-autogroup-Add-kernel-parameter-and-conf.patch @@ -1,7 +1,7 @@ -From d5b37aa9862773c0cdf95676cc15d97416311ba2 Mon Sep 17 00:00:00 2001 +From 80ef8da328db02245f16e1873466a8cec86b4846 Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Wed, 15 Jun 2022 17:07:29 +0000 -Subject: [PATCH 15/19] XANMOD: sched/autogroup: Add kernel parameter and +Subject: [PATCH 16/20] XANMOD: sched/autogroup: Add kernel parameter and config option to enable/disable autogroup feature by default Signed-off-by: Alexandre Frade @@ -13,7 +13,7 @@ Signed-off-by: Alexandre Frade --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -507,6 +507,10 @@ +@@ -510,6 +510,10 @@ Format: (must be >=0) Default: 64 @@ -24,7 +24,7 @@ Signed-off-by: Alexandre Frade bau= [X86_UV] Enable the BAU on SGI UV. The default behavior is to disable the BAU (i.e. bau=0). Format: { "0" | "1" } -@@ -4086,8 +4090,6 @@ +@@ -4129,8 +4133,6 @@ noapictimer [APIC,X86] Don't set up the APIC timer @@ -35,7 +35,7 @@ Signed-off-by: Alexandre Frade no_console_suspend --- a/init/Kconfig +++ b/init/Kconfig -@@ -1374,6 +1374,18 @@ config SCHED_AUTOGROUP +@@ -1393,6 +1393,18 @@ config SCHED_AUTOGROUP desktop applications. Task group autogeneration is currently based upon task session. diff --git a/debian/patches/patchset-xanmod/xanmod/0014-XANMOD-cpufreq-tunes-ondemand-and-conservative-gover.patch b/debian/patches/patchset-xanmod/xanmod/0013-XANMOD-cpufreq-tunes-ondemand-and-conservative-gover.patch similarity index 94% rename from debian/patches/patchset-xanmod/xanmod/0014-XANMOD-cpufreq-tunes-ondemand-and-conservative-gover.patch rename to debian/patches/patchset-xanmod/xanmod/0013-XANMOD-cpufreq-tunes-ondemand-and-conservative-gover.patch index d3314f3..5230f2f 100644 --- a/debian/patches/patchset-xanmod/xanmod/0014-XANMOD-cpufreq-tunes-ondemand-and-conservative-gover.patch +++ b/debian/patches/patchset-xanmod/xanmod/0013-XANMOD-cpufreq-tunes-ondemand-and-conservative-gover.patch @@ -1,7 +1,7 @@ -From 475f127d322b1fe12a8f486e779ec60cc03220bc Mon Sep 17 00:00:00 2001 +From df6c5af7be4fdfd1beadc3d9ef5b573717b049e1 Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Tue, 31 Mar 2020 13:32:08 -0300 -Subject: [PATCH 16/19] XANMOD: cpufreq: tunes ondemand and conservative +Subject: [PATCH 17/20] XANMOD: cpufreq: tunes ondemand and conservative governor for performance Signed-off-by: Alexandre Frade diff --git a/debian/patches/patchset-xanmod/xanmod/0015-XANMOD-lib-kconfig.debug-disable-default-SYMBOLIC_ER.patch b/debian/patches/patchset-xanmod/xanmod/0014-XANMOD-lib-kconfig.debug-disable-default-SYMBOLIC_ER.patch similarity index 90% rename from debian/patches/patchset-xanmod/xanmod/0015-XANMOD-lib-kconfig.debug-disable-default-SYMBOLIC_ER.patch rename to debian/patches/patchset-xanmod/xanmod/0014-XANMOD-lib-kconfig.debug-disable-default-SYMBOLIC_ER.patch index d62c710..345d393 100644 --- a/debian/patches/patchset-xanmod/xanmod/0015-XANMOD-lib-kconfig.debug-disable-default-SYMBOLIC_ER.patch +++ b/debian/patches/patchset-xanmod/xanmod/0014-XANMOD-lib-kconfig.debug-disable-default-SYMBOLIC_ER.patch @@ -1,7 +1,7 @@ -From ecbc96ba0c56aa4c94c1a4bcb3184cc79fad1d3d Mon Sep 17 00:00:00 2001 +From b203a73ce3d1b097117180903b33f37ae83e4a94 Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Mon, 16 Sep 2024 08:09:56 +0000 -Subject: [PATCH 17/19] XANMOD: lib/kconfig.debug: disable default +Subject: [PATCH 18/20] XANMOD: lib/kconfig.debug: disable default SYMBOLIC_ERRNAME and DEBUG_BUGVERBOSE Signed-off-by: Alexandre Frade diff --git a/debian/patches/patchset-xanmod/xanmod/0016-XANMOD-scripts-setlocalversion-remove-tag-for-git-re.patch b/debian/patches/patchset-xanmod/xanmod/0015-XANMOD-scripts-setlocalversion-remove-tag-for-git-re.patch similarity index 76% rename from debian/patches/patchset-xanmod/xanmod/0016-XANMOD-scripts-setlocalversion-remove-tag-for-git-re.patch rename to debian/patches/patchset-xanmod/xanmod/0015-XANMOD-scripts-setlocalversion-remove-tag-for-git-re.patch index 23c5cc4..7d62cc6 100644 --- a/debian/patches/patchset-xanmod/xanmod/0016-XANMOD-scripts-setlocalversion-remove-tag-for-git-re.patch +++ b/debian/patches/patchset-xanmod/xanmod/0015-XANMOD-scripts-setlocalversion-remove-tag-for-git-re.patch @@ -1,7 +1,7 @@ -From 3606c4614583729c8471c98d171d42ff895b38c4 Mon Sep 17 00:00:00 2001 +From 9a67710027ff742f3dfd21e32318d056b0c490f3 Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Sun, 29 May 2022 00:57:40 +0000 -Subject: [PATCH 18/19] XANMOD: scripts/setlocalversion: remove "+" tag for git +Subject: [PATCH 19/20] XANMOD: scripts/setlocalversion: remove '+' tag for git repo short version Signed-off-by: Alexandre Frade diff --git a/debian/patches/patchset-xanmod/xanmod/0017-XANMOD-scripts-setlocalversion-Move-localversion-fil.patch b/debian/patches/patchset-xanmod/xanmod/0016-XANMOD-scripts-setlocalversion-Move-localversion-fil.patch similarity index 82% rename from debian/patches/patchset-xanmod/xanmod/0017-XANMOD-scripts-setlocalversion-Move-localversion-fil.patch rename to debian/patches/patchset-xanmod/xanmod/0016-XANMOD-scripts-setlocalversion-Move-localversion-fil.patch index b82a665..051c319 100644 --- a/debian/patches/patchset-xanmod/xanmod/0017-XANMOD-scripts-setlocalversion-Move-localversion-fil.patch +++ b/debian/patches/patchset-xanmod/xanmod/0016-XANMOD-scripts-setlocalversion-Move-localversion-fil.patch @@ -1,7 +1,7 @@ -From 927fa9cd3d3b0a6f65c44d492c263d0669ec4b7e Mon Sep 17 00:00:00 2001 +From d034a044b32f6b646b9b5f798d1b707b2ba02dfc Mon Sep 17 00:00:00 2001 From: Alexandre Frade Date: Mon, 24 Apr 2023 04:50:34 +0000 -Subject: [PATCH 19/19] XANMOD: scripts/setlocalversion: Move localversion* +Subject: [PATCH 20/20] XANMOD: scripts/setlocalversion: Move localversion* files to the end Signed-off-by: Alexandre Frade diff --git a/debian/patches/patchset-zen/fixes/0001-drivers-firmware-skip-simpledrm-if-nvidia-drm.modese.patch b/debian/patches/patchset-zen/fixes/0001-drivers-firmware-skip-simpledrm-if-nvidia-drm.modese.patch deleted file mode 100644 index 2b0062a..0000000 --- a/debian/patches/patchset-zen/fixes/0001-drivers-firmware-skip-simpledrm-if-nvidia-drm.modese.patch +++ /dev/null @@ -1,85 +0,0 @@ -From bf57be2df6a113afba465bea635444764a7d0f11 Mon Sep 17 00:00:00 2001 -From: Javier Martinez Canillas -Date: Thu, 19 May 2022 14:40:07 +0200 -Subject: drivers/firmware: skip simpledrm if nvidia-drm.modeset=1 is set - -The Nvidia proprietary driver has some bugs that leads to issues if used -with the simpledrm driver. The most noticeable is that does not register -an emulated fbdev device. - -It just relies on a fbdev to be registered by another driver, that could -be that could be attached to the framebuffer console. On UEFI machines, -this is the efifb driver. - -This means that disabling the efifb driver will cause virtual consoles to -not be present in the system when using the Nvidia driver. Legacy BIOS is -not affected just because fbcon is not used there, but instead vgacon. - -Unless a VGA mode is specified using the vga= kernel command line option, -in that case the vesafb driver is used instead and its fbdev attached to -the fbcon. - -This is a problem because with CONFIG_SYSFB_SIMPLEFB=y, the sysfb platform -code attempts to register a "simple-framebuffer" platform device (that is -matched against simpledrm) and only registers either an "efi-framebuffer" -or "vesa-framebuffer" if this fails to be registered due the video modes -not being compatible. - -The Nvidia driver relying on another driver to register the fbdev is quite -fragile, since it can't really assume those will stick around. For example -there are patches posted to remove the EFI and VESA platform devices once -a real DRM or fbdev driver probes. - -But in any case, moving to a simpledrm + emulated fbdev only breaks this -assumption and causes users to not have VT if the Nvidia driver is used. - -So to prevent this, let's add a workaround and make the sysfb to skip the -"simple-framebuffer" registration when nvidia-drm.modeset=1 option is set. - -This is quite horrible, but honestly I can't think of any other approach. - -For this to work, the CONFIG_FB_EFI and CONFIG_FB_VESA config options must -be enabled besides CONFIG_DRM_SIMPLEDRM. - -Signed-off-by: Javier Martinez Canillas -Source: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1788 -Cherry-picked-for: https://bugs.archlinux.org/task/73720 -Cherry-picked-for: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/94 ---- - drivers/firmware/sysfb.c | 18 +++++++++++++++++- - 1 file changed, 17 insertions(+), 1 deletion(-) - ---- a/drivers/firmware/sysfb.c -+++ b/drivers/firmware/sysfb.c -@@ -35,6 +35,22 @@ - #include - #include - -+static int skip_simpledrm; -+ -+static int __init simpledrm_disable(char *opt) -+{ -+ if (!opt) -+ return -EINVAL; -+ -+ get_option(&opt, &skip_simpledrm); -+ -+ if (skip_simpledrm) -+ pr_info("The simpledrm driver will not be probed\n"); -+ -+ return 0; -+} -+early_param("nvidia-drm.modeset", simpledrm_disable); -+ - static struct platform_device *pd; - static DEFINE_MUTEX(disable_lock); - static bool disabled; -@@ -165,7 +181,7 @@ static __init int sysfb_init(void) - - /* try to create a simple-framebuffer device */ - compatible = sysfb_parse_mode(si, &mode); -- if (compatible) { -+ if (compatible && !skip_simpledrm) { - pd = sysfb_create_simplefb(si, &mode, parent); - if (!IS_ERR(pd)) - goto put_device; diff --git a/debian/patches/patchset-zen/fixes/0001-proc-fix-missing-pde_set_flags-for-net-proc-files.patch b/debian/patches/patchset-zen/fixes/0001-proc-fix-missing-pde_set_flags-for-net-proc-files.patch new file mode 100644 index 0000000..9ae4416 --- /dev/null +++ b/debian/patches/patchset-zen/fixes/0001-proc-fix-missing-pde_set_flags-for-net-proc-files.patch @@ -0,0 +1,107 @@ +From f556624b84006d199f4e32314589fc3d1800e730 Mon Sep 17 00:00:00 2001 +From: wangzijie +Date: Mon, 18 Aug 2025 20:31:02 +0800 +Subject: proc: fix missing pde_set_flags() for net proc files + +To avoid potential UAF issues during module removal races, we use pde_set_flags() +to save proc_ops flags in PDE itself before proc_register(), and then use +pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*. + +However, the pde_set_flags() call was missing when creating net related proc files. +This omission caused incorrect behavior which FMODE_LSEEK was being cleared +inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1]. + +Fix this by ensuring pde_set_flags() is called when register proc entry, and add +NULL check for proc_ops in pde_set_flags(). + +[1]: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/ + +Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al) +Cc: stable@vger.kernel.org +Reported-by: Lars Wendler +Signed-off-by: wangzijie +Cherry-picked-for: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/151 +--- + fs/proc/generic.c | 36 +++++++++++++++++++----------------- + 1 file changed, 19 insertions(+), 17 deletions(-) + +--- a/fs/proc/generic.c ++++ b/fs/proc/generic.c +@@ -364,6 +364,23 @@ static const struct inode_operations pro + .setattr = proc_notify_change, + }; + ++static void pde_set_flags(struct proc_dir_entry *pde) ++{ ++ if (!pde->proc_ops) ++ return; ++ ++ if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) ++ pde->flags |= PROC_ENTRY_PERMANENT; ++ if (pde->proc_ops->proc_read_iter) ++ pde->flags |= PROC_ENTRY_proc_read_iter; ++#ifdef CONFIG_COMPAT ++ if (pde->proc_ops->proc_compat_ioctl) ++ pde->flags |= PROC_ENTRY_proc_compat_ioctl; ++#endif ++ if (pde->proc_ops->proc_lseek) ++ pde->flags |= PROC_ENTRY_proc_lseek; ++} ++ + /* returns the registered entry, or frees dp and returns NULL on failure */ + struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, + struct proc_dir_entry *dp) +@@ -371,6 +388,8 @@ struct proc_dir_entry *proc_register(str + if (proc_alloc_inum(&dp->low_ino)) + goto out_free_entry; + ++ pde_set_flags(dp); ++ + write_lock(&proc_subdir_lock); + dp->parent = dir; + if (pde_subdir_insert(dir, dp) == false) { +@@ -559,20 +578,6 @@ struct proc_dir_entry *proc_create_reg(c + return p; + } + +-static void pde_set_flags(struct proc_dir_entry *pde) +-{ +- if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) +- pde->flags |= PROC_ENTRY_PERMANENT; +- if (pde->proc_ops->proc_read_iter) +- pde->flags |= PROC_ENTRY_proc_read_iter; +-#ifdef CONFIG_COMPAT +- if (pde->proc_ops->proc_compat_ioctl) +- pde->flags |= PROC_ENTRY_proc_compat_ioctl; +-#endif +- if (pde->proc_ops->proc_lseek) +- pde->flags |= PROC_ENTRY_proc_lseek; +-} +- + struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, + struct proc_dir_entry *parent, + const struct proc_ops *proc_ops, void *data) +@@ -583,7 +588,6 @@ struct proc_dir_entry *proc_create_data( + if (!p) + return NULL; + p->proc_ops = proc_ops; +- pde_set_flags(p); + return proc_register(parent, p); + } + EXPORT_SYMBOL(proc_create_data); +@@ -634,7 +638,6 @@ struct proc_dir_entry *proc_create_seq_p + p->proc_ops = &proc_seq_ops; + p->seq_ops = ops; + p->state_size = state_size; +- pde_set_flags(p); + return proc_register(parent, p); + } + EXPORT_SYMBOL(proc_create_seq_private); +@@ -665,7 +668,6 @@ struct proc_dir_entry *proc_create_singl + return NULL; + p->proc_ops = &proc_single_ops; + p->single_show = show; +- pde_set_flags(p); + return proc_register(parent, p); + } + EXPORT_SYMBOL(proc_create_single_data); diff --git a/debian/patches/patchset-zen/sauce/0001-ZEN-Add-VHBA-driver.patch b/debian/patches/patchset-zen/sauce/0001-ZEN-Add-VHBA-driver.patch index 2be6130..a8a0f06 100644 --- a/debian/patches/patchset-zen/sauce/0001-ZEN-Add-VHBA-driver.patch +++ b/debian/patches/patchset-zen/sauce/0001-ZEN-Add-VHBA-driver.patch @@ -1,4 +1,4 @@ -From eceae849a8242fcfeec64470f6f4c24fbae0d614 Mon Sep 17 00:00:00 2001 +From fff64147d7411e03ec87ec1f9716fe5795dbdfd1 Mon Sep 17 00:00:00 2001 From: "Jan Alexander Steffens (heftig)" Date: Mon, 26 Apr 2021 22:12:46 +0200 Subject: ZEN: Add VHBA driver @@ -18,7 +18,7 @@ tag vhba-module-20250329 --- a/drivers/scsi/Kconfig +++ b/drivers/scsi/Kconfig -@@ -1521,4 +1521,6 @@ endif # SCSI_LOWLEVEL +@@ -1524,4 +1524,6 @@ endif # SCSI_LOWLEVEL source "drivers/scsi/device_handler/Kconfig" diff --git a/debian/patches/patchset-zen/sauce/0002-ZEN-PCI-Add-Intel-remapped-NVMe-device-support.patch b/debian/patches/patchset-zen/sauce/0002-ZEN-PCI-Add-Intel-remapped-NVMe-device-support.patch index 6252ca5..a20ecc7 100644 --- a/debian/patches/patchset-zen/sauce/0002-ZEN-PCI-Add-Intel-remapped-NVMe-device-support.patch +++ b/debian/patches/patchset-zen/sauce/0002-ZEN-PCI-Add-Intel-remapped-NVMe-device-support.patch @@ -1,4 +1,4 @@ -From e0d21c7f4ea5f33bb4a6076d8ff50ad19431e333 Mon Sep 17 00:00:00 2001 +From 8f7dbc1fba107ae9369d57f037f876f3ca69e910 Mon Sep 17 00:00:00 2001 From: Daniel Drake Date: Tue, 4 Jun 2019 14:51:21 +0800 Subject: ZEN: PCI: Add Intel remapped NVMe device support @@ -94,7 +94,7 @@ Contains: -#endif --- a/drivers/ata/ahci.c +++ b/drivers/ata/ahci.c -@@ -1662,7 +1662,7 @@ static irqreturn_t ahci_thunderx_irq_han +@@ -1656,7 +1656,7 @@ static irqreturn_t ahci_thunderx_irq_han } #endif @@ -103,7 +103,7 @@ Contains: struct ahci_host_priv *hpriv) { int i; -@@ -1675,7 +1675,7 @@ static void ahci_remap_check(struct pci_ +@@ -1669,7 +1669,7 @@ static void ahci_remap_check(struct pci_ pci_resource_len(pdev, bar) < SZ_512K || bar != AHCI_PCI_BAR_STANDARD || !(readl(hpriv->mmio + AHCI_VSCAP) & 1)) @@ -112,7 +112,7 @@ Contains: cap = readq(hpriv->mmio + AHCI_REMAP_CAP); for (i = 0; i < AHCI_MAX_REMAP; i++) { -@@ -1690,18 +1690,11 @@ static void ahci_remap_check(struct pci_ +@@ -1684,18 +1684,11 @@ static void ahci_remap_check(struct pci_ } if (!hpriv->remapped_nvme) @@ -135,7 +135,7 @@ Contains: } static int ahci_get_irq_vector(struct ata_host *host, int port) -@@ -1955,7 +1948,9 @@ static int ahci_init_one(struct pci_dev +@@ -1949,7 +1942,9 @@ static int ahci_init_one(struct pci_dev return -ENOMEM; /* detect remapped nvme devices */ diff --git a/debian/patches/patchset-zen/sauce/0003-ZEN-Disable-stack-conservation-for-GCC.patch b/debian/patches/patchset-zen/sauce/0003-ZEN-Disable-stack-conservation-for-GCC.patch index 4fea33f..888db94 100644 --- a/debian/patches/patchset-zen/sauce/0003-ZEN-Disable-stack-conservation-for-GCC.patch +++ b/debian/patches/patchset-zen/sauce/0003-ZEN-Disable-stack-conservation-for-GCC.patch @@ -1,4 +1,4 @@ -From 490a2fd553b92e5ad5f151994a9bbf953cc000f7 Mon Sep 17 00:00:00 2001 +From bc4a77fd53959912f1cc2a866f5d4be640ce5211 Mon Sep 17 00:00:00 2001 From: Sultan Alsawaf Date: Sun, 8 Mar 2020 00:31:35 -0800 Subject: ZEN: Disable stack conservation for GCC @@ -15,7 +15,7 @@ Signed-off-by: Sultan Alsawaf --- a/Makefile +++ b/Makefile -@@ -1076,11 +1076,6 @@ KBUILD_CFLAGS += -fno-strict-overflow +@@ -1088,11 +1088,6 @@ KBUILD_CFLAGS += -fno-strict-overflow # Make sure -fstack-check isn't enabled (like gentoo apparently did) KBUILD_CFLAGS += -fno-stack-check diff --git a/debian/patches/patchset-zen/sauce/0004-ZEN-Input-evdev-use-call_rcu-when-detaching-client.patch b/debian/patches/patchset-zen/sauce/0004-ZEN-Input-evdev-use-call_rcu-when-detaching-client.patch index bda07e6..b54588d 100644 --- a/debian/patches/patchset-zen/sauce/0004-ZEN-Input-evdev-use-call_rcu-when-detaching-client.patch +++ b/debian/patches/patchset-zen/sauce/0004-ZEN-Input-evdev-use-call_rcu-when-detaching-client.patch @@ -1,4 +1,4 @@ -From 71ce760cd36faae55cc0fefebed49998b5eae864 Mon Sep 17 00:00:00 2001 +From f6ed65cd7bda9cb6009c6a12efd7c4311df31936 Mon Sep 17 00:00:00 2001 From: Kenny Levinsen Date: Sun, 27 Dec 2020 14:43:13 +0000 Subject: ZEN: Input: evdev - use call_rcu when detaching client diff --git a/debian/patches/patchset-zen/sauce/0005-ZEN-Add-config-for-default-of-unprivileged_userns_cl.patch b/debian/patches/patchset-zen/sauce/0005-ZEN-Add-config-for-default-of-unprivileged_userns_cl.patch new file mode 100644 index 0000000..65a6a24 --- /dev/null +++ b/debian/patches/patchset-zen/sauce/0005-ZEN-Add-config-for-default-of-unprivileged_userns_cl.patch @@ -0,0 +1,49 @@ +From 8b27c81fbddbde60634661baeb1fd475de32355b Mon Sep 17 00:00:00 2001 +From: "Jan Alexander Steffens (heftig)" +Date: Thu, 22 May 2025 07:32:13 +0200 +Subject: ZEN: Add config for default of unprivileged_userns_clone + +--- + init/Kconfig | 16 ++++++++++++++++ + kernel/user_namespace.c | 4 ++++ + 2 files changed, 20 insertions(+) + +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1349,6 +1349,22 @@ config USER_NS + + If unsure, say N. + ++config USER_NS_UNPRIVILEGED ++ bool "Allow unprivileged users to create namespaces" ++ default y ++ depends on USER_NS ++ help ++ When disabled, unprivileged users will not be able to create ++ new namespaces. Allowing users to create their own namespaces ++ has been part of several recent local privilege escalation ++ exploits, so if you need user namespaces but are ++ paranoid^Wsecurity-conscious you want to disable this. ++ ++ This setting can be overridden at runtime via the ++ kernel.unprivileged_userns_clone sysctl. ++ ++ If unsure, say Y. ++ + config PID_NS + bool "PID Namespaces" + default y +--- a/kernel/user_namespace.c ++++ b/kernel/user_namespace.c +@@ -23,7 +23,11 @@ + #include + + /* sysctl */ ++#ifdef CONFIG_USER_NS_UNPRIVILEGED + int unprivileged_userns_clone = 1; ++#else ++int unprivileged_userns_clone; ++#endif + + static struct kmem_cache *user_ns_cachep __ro_after_init; + static DEFINE_MUTEX(userns_state_mutex); diff --git a/debian/patches/patchset-zen/sauce/0005-ZEN-cpufreq-Remove-schedutil-dependency-on-Intel-AMD.patch b/debian/patches/patchset-zen/sauce/0006-ZEN-cpufreq-Remove-schedutil-dependency-on-Intel-AMD.patch similarity index 94% rename from debian/patches/patchset-zen/sauce/0005-ZEN-cpufreq-Remove-schedutil-dependency-on-Intel-AMD.patch rename to debian/patches/patchset-zen/sauce/0006-ZEN-cpufreq-Remove-schedutil-dependency-on-Intel-AMD.patch index 0c891ac..42eb025 100644 --- a/debian/patches/patchset-zen/sauce/0005-ZEN-cpufreq-Remove-schedutil-dependency-on-Intel-AMD.patch +++ b/debian/patches/patchset-zen/sauce/0006-ZEN-cpufreq-Remove-schedutil-dependency-on-Intel-AMD.patch @@ -1,4 +1,4 @@ -From 45cea9e15f2512535f2836ccddcf711f4823a2e1 Mon Sep 17 00:00:00 2001 +From cab7ea1a4ef6685a133ae121ca27098b9dd31287 Mon Sep 17 00:00:00 2001 From: Steven Barrett Date: Mon, 11 Jul 2022 19:10:30 -0500 Subject: ZEN: cpufreq: Remove schedutil dependency on Intel/AMD P-State diff --git a/debian/patches/patchset-zen/sauce/0006-ZEN-intel-pstate-Implement-enable-parameter.patch b/debian/patches/patchset-zen/sauce/0007-ZEN-intel-pstate-Implement-enable-parameter.patch similarity index 93% rename from debian/patches/patchset-zen/sauce/0006-ZEN-intel-pstate-Implement-enable-parameter.patch rename to debian/patches/patchset-zen/sauce/0007-ZEN-intel-pstate-Implement-enable-parameter.patch index 8fb667c..5799987 100644 --- a/debian/patches/patchset-zen/sauce/0006-ZEN-intel-pstate-Implement-enable-parameter.patch +++ b/debian/patches/patchset-zen/sauce/0007-ZEN-intel-pstate-Implement-enable-parameter.patch @@ -1,4 +1,4 @@ -From c5eb62bb4d6a06a5a95c0da0d41469f22e71556f Mon Sep 17 00:00:00 2001 +From 3d7d0f26977a6d4f6bff2edb4e6388da83789e87 Mon Sep 17 00:00:00 2001 From: Steven Barrett Date: Wed, 15 Jan 2020 20:43:56 -0600 Subject: ZEN: intel-pstate: Implement "enable" parameter @@ -30,7 +30,7 @@ selection. --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -2324,6 +2324,9 @@ +@@ -2342,6 +2342,9 @@ disable Do not enable intel_pstate as the default scaling driver for the supported processors @@ -42,7 +42,7 @@ selection. governors layer of cpufreq and provides it own --- a/drivers/cpufreq/intel_pstate.c +++ b/drivers/cpufreq/intel_pstate.c -@@ -3830,6 +3830,8 @@ static int __init intel_pstate_setup(cha +@@ -3949,6 +3949,8 @@ static int __init intel_pstate_setup(cha if (!strcmp(str, "disable")) no_load = 1; diff --git a/debian/patches/patchset-zen/sauce/0007-ZEN-drm-amdgpu-pm-Allow-override-of-min_power_limit-.patch b/debian/patches/patchset-zen/sauce/0008-ZEN-drm-amdgpu-pm-Allow-override-of-min_power_limit-.patch similarity index 91% rename from debian/patches/patchset-zen/sauce/0007-ZEN-drm-amdgpu-pm-Allow-override-of-min_power_limit-.patch rename to debian/patches/patchset-zen/sauce/0008-ZEN-drm-amdgpu-pm-Allow-override-of-min_power_limit-.patch index 8207a25..a847adf 100644 --- a/debian/patches/patchset-zen/sauce/0007-ZEN-drm-amdgpu-pm-Allow-override-of-min_power_limit-.patch +++ b/debian/patches/patchset-zen/sauce/0008-ZEN-drm-amdgpu-pm-Allow-override-of-min_power_limit-.patch @@ -1,4 +1,4 @@ -From b42cd00b809a2f69bbf5e1d63cb7ff90f5f51410 Mon Sep 17 00:00:00 2001 +From db369c984b7e14f64054fe756c156f2c04b3227a Mon Sep 17 00:00:00 2001 From: Steven Barrett Date: Fri, 15 Mar 2024 12:36:51 -0500 Subject: ZEN: drm/amdgpu/pm: Allow override of min_power_limit with @@ -13,7 +13,7 @@ Subject: ZEN: drm/amdgpu/pm: Allow override of min_power_limit with --- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -161,6 +161,7 @@ struct amdgpu_watchdog_timer { +@@ -163,6 +163,7 @@ struct amdgpu_watchdog_timer { */ extern int amdgpu_modeset; extern unsigned int amdgpu_vram_limit; @@ -23,7 +23,7 @@ Subject: ZEN: drm/amdgpu/pm: Allow override of min_power_limit with extern int amdgpu_gtt_size; --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -143,6 +143,7 @@ enum AMDGPU_DEBUG_MASK { +@@ -147,6 +147,7 @@ enum AMDGPU_DEBUG_MASK { }; unsigned int amdgpu_vram_limit = UINT_MAX; @@ -31,7 +31,7 @@ Subject: ZEN: drm/amdgpu/pm: Allow override of min_power_limit with int amdgpu_vis_vram_limit; int amdgpu_gart_size = -1; /* auto */ int amdgpu_gtt_size = -1; /* auto */ -@@ -263,6 +264,15 @@ struct amdgpu_watchdog_timer amdgpu_watc +@@ -269,6 +270,15 @@ struct amdgpu_watchdog_timer amdgpu_watc }; /** @@ -49,7 +49,7 @@ Subject: ZEN: drm/amdgpu/pm: Allow override of min_power_limit with */ --- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c +++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c -@@ -3057,6 +3057,9 @@ static ssize_t amdgpu_hwmon_show_power_c +@@ -3073,6 +3073,9 @@ static ssize_t amdgpu_hwmon_show_power_c struct device_attribute *attr, char *buf) { diff --git a/debian/patches/patchset-zen/sauce/0008-ZEN-mm-Stop-kswapd-early-when-nothing-s-waiting-for-.patch b/debian/patches/patchset-zen/sauce/0009-ZEN-mm-Stop-kswapd-early-when-nothing-s-waiting-for-.patch similarity index 91% rename from debian/patches/patchset-zen/sauce/0008-ZEN-mm-Stop-kswapd-early-when-nothing-s-waiting-for-.patch rename to debian/patches/patchset-zen/sauce/0009-ZEN-mm-Stop-kswapd-early-when-nothing-s-waiting-for-.patch index ea94055..9b5ccf4 100644 --- a/debian/patches/patchset-zen/sauce/0008-ZEN-mm-Stop-kswapd-early-when-nothing-s-waiting-for-.patch +++ b/debian/patches/patchset-zen/sauce/0009-ZEN-mm-Stop-kswapd-early-when-nothing-s-waiting-for-.patch @@ -1,4 +1,4 @@ -From fe26e658b0a14ba9ab4f800bea6a7a43aae0981e Mon Sep 17 00:00:00 2001 +From 77ad4ad132593a5838fa42942f190a1586d166fd Mon Sep 17 00:00:00 2001 From: Sultan Alsawaf Date: Sun, 19 Apr 2020 19:59:18 -0700 Subject: ZEN: mm: Stop kswapd early when nothing's waiting for it to free @@ -43,7 +43,7 @@ Contains: --- a/mm/internal.h +++ b/mm/internal.h -@@ -788,6 +788,7 @@ void post_alloc_hook(struct page *page, +@@ -791,6 +791,7 @@ void post_alloc_hook(struct page *page, extern bool free_pages_prepare(struct page *page, unsigned int order); extern int user_min_free_kbytes; @@ -62,7 +62,7 @@ Contains: /* prevent >1 _updater_ of zone percpu pageset ->high and ->batch fields */ static DEFINE_MUTEX(pcp_batch_high_lock); #define MIN_PERCPU_PAGELIST_HIGH_FRACTION (8) -@@ -4432,6 +4434,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u +@@ -4421,6 +4423,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u unsigned int cpuset_mems_cookie; unsigned int zonelist_iter_cookie; int reserve_flags; @@ -70,7 +70,7 @@ Contains: if (unlikely(nofail)) { /* -@@ -4491,8 +4494,13 @@ restart: +@@ -4480,8 +4483,13 @@ restart: goto nopage; } @@ -85,7 +85,7 @@ Contains: /* * The adjusted alloc_flags might result in immediate success, so try -@@ -4707,9 +4715,12 @@ nopage: +@@ -4696,9 +4704,12 @@ nopage: goto retry; } fail: @@ -102,7 +102,7 @@ Contains: --- a/mm/vmscan.c +++ b/mm/vmscan.c -@@ -6427,7 +6427,7 @@ retry: +@@ -6471,7 +6471,7 @@ retry: return 0; } @@ -111,7 +111,7 @@ Contains: { struct zone *zone; unsigned long pfmemalloc_reserve = 0; -@@ -6452,6 +6452,10 @@ static bool allow_direct_reclaim(pg_data +@@ -6496,6 +6496,10 @@ static bool allow_direct_reclaim(pg_data wmark_ok = free_pages > pfmemalloc_reserve / 2; @@ -122,7 +122,7 @@ Contains: /* kswapd must be awake if processes are being throttled */ if (!wmark_ok && waitqueue_active(&pgdat->kswapd_wait)) { if (READ_ONCE(pgdat->kswapd_highest_zoneidx) > ZONE_NORMAL) -@@ -6517,7 +6521,7 @@ static bool throttle_direct_reclaim(gfp_ +@@ -6561,7 +6565,7 @@ static bool throttle_direct_reclaim(gfp_ /* Throttle based on the first usable node */ pgdat = zone->zone_pgdat; @@ -131,7 +131,7 @@ Contains: goto out; break; } -@@ -6539,11 +6543,14 @@ static bool throttle_direct_reclaim(gfp_ +@@ -6583,11 +6587,14 @@ static bool throttle_direct_reclaim(gfp_ */ if (!(gfp_mask & __GFP_FS)) wait_event_interruptible_timeout(pgdat->pfmemalloc_wait, @@ -148,7 +148,7 @@ Contains: if (fatal_signal_pending(current)) return true; -@@ -7064,14 +7071,14 @@ restart: +@@ -7108,14 +7115,14 @@ restart: * able to safely make forward progress. Wake them */ if (waitqueue_active(&pgdat->pfmemalloc_wait) && diff --git a/debian/patches/patchset-zen/sauce/0009-ZEN-ahci-Disable-staggered-spinup-by-default.patch b/debian/patches/patchset-zen/sauce/0010-ZEN-ahci-Disable-staggered-spinup-by-default.patch similarity index 93% rename from debian/patches/patchset-zen/sauce/0009-ZEN-ahci-Disable-staggered-spinup-by-default.patch rename to debian/patches/patchset-zen/sauce/0010-ZEN-ahci-Disable-staggered-spinup-by-default.patch index 7792c36..de8e76d 100644 --- a/debian/patches/patchset-zen/sauce/0009-ZEN-ahci-Disable-staggered-spinup-by-default.patch +++ b/debian/patches/patchset-zen/sauce/0010-ZEN-ahci-Disable-staggered-spinup-by-default.patch @@ -1,4 +1,4 @@ -From bc6ff8d7a55a19fdd6828168cc35cba76f05c133 Mon Sep 17 00:00:00 2001 +From 5aa2c66fd59f226e8bbda0aa5628970d38cb2aa4 Mon Sep 17 00:00:00 2001 From: EXtremeExploit Date: Fri, 29 Nov 2024 13:05:27 -0300 Subject: ZEN: ahci: Disable staggered spinup by default diff --git a/debian/patches/patchset-zen/sauce/0010-ZEN-kernel-Kconfig.preempt-Remove-EXPERT-conditional.patch b/debian/patches/patchset-zen/sauce/0011-ZEN-kernel-Kconfig.preempt-Remove-EXPERT-conditional.patch similarity index 91% rename from debian/patches/patchset-zen/sauce/0010-ZEN-kernel-Kconfig.preempt-Remove-EXPERT-conditional.patch rename to debian/patches/patchset-zen/sauce/0011-ZEN-kernel-Kconfig.preempt-Remove-EXPERT-conditional.patch index 0e02e6d..aa8d4ac 100644 --- a/debian/patches/patchset-zen/sauce/0010-ZEN-kernel-Kconfig.preempt-Remove-EXPERT-conditional.patch +++ b/debian/patches/patchset-zen/sauce/0011-ZEN-kernel-Kconfig.preempt-Remove-EXPERT-conditional.patch @@ -1,4 +1,4 @@ -From 4ae0eb6d9a78f53d796996b17743b7df74a7f43d Mon Sep 17 00:00:00 2001 +From f7340c5dabce15dd3285d340f952cfb7fb396344 Mon Sep 17 00:00:00 2001 From: Steven Barrett Date: Sat, 14 Dec 2024 11:23:18 -0600 Subject: ZEN: kernel/Kconfig.preempt: Remove EXPERT conditional on PREEMPT_RT diff --git a/debian/patches/patchset-zen/sauce/0011-ZEN-INTERACTIVE-Base-config-item.patch b/debian/patches/patchset-zen/sauce/0012-ZEN-INTERACTIVE-Base-config-item.patch similarity index 80% rename from debian/patches/patchset-zen/sauce/0011-ZEN-INTERACTIVE-Base-config-item.patch rename to debian/patches/patchset-zen/sauce/0012-ZEN-INTERACTIVE-Base-config-item.patch index e5b9321..208c76c 100644 --- a/debian/patches/patchset-zen/sauce/0011-ZEN-INTERACTIVE-Base-config-item.patch +++ b/debian/patches/patchset-zen/sauce/0012-ZEN-INTERACTIVE-Base-config-item.patch @@ -1,4 +1,4 @@ -From e90e4b57fedca27f5c230f39bd6f67672f1d24ef Mon Sep 17 00:00:00 2001 +From fb5c79d96cc87e4778ac0f2a53bc7c0c23078c54 Mon Sep 17 00:00:00 2001 From: "Jan Alexander Steffens (heftig)" Date: Mon, 27 Jan 2020 18:10:06 +0100 Subject: ZEN: INTERACTIVE: Base config item @@ -9,7 +9,7 @@ Subject: ZEN: INTERACTIVE: Base config item --- a/init/Kconfig +++ b/init/Kconfig -@@ -163,6 +163,12 @@ config THREAD_INFO_IN_TASK +@@ -167,6 +167,12 @@ config THREAD_INFO_IN_TASK menu "General setup" diff --git a/debian/patches/patchset-zen/sauce/0012-ZEN-INTERACTIVE-Use-BFQ-as-the-elevator-for-SQ-devic.patch b/debian/patches/patchset-zen/sauce/0013-ZEN-INTERACTIVE-Use-BFQ-as-the-elevator-for-SQ-devic.patch similarity index 66% rename from debian/patches/patchset-zen/sauce/0012-ZEN-INTERACTIVE-Use-BFQ-as-the-elevator-for-SQ-devic.patch rename to debian/patches/patchset-zen/sauce/0013-ZEN-INTERACTIVE-Use-BFQ-as-the-elevator-for-SQ-devic.patch index a0c2ed5..e506fde 100644 --- a/debian/patches/patchset-zen/sauce/0012-ZEN-INTERACTIVE-Use-BFQ-as-the-elevator-for-SQ-devic.patch +++ b/debian/patches/patchset-zen/sauce/0013-ZEN-INTERACTIVE-Use-BFQ-as-the-elevator-for-SQ-devic.patch @@ -1,4 +1,4 @@ -From 4da290d83614efedb0eb3b8114070fbddc46677b Mon Sep 17 00:00:00 2001 +From 208f2c37cff2a2bde18adcdd79274254e03fac8d Mon Sep 17 00:00:00 2001 From: "Jan Alexander Steffens (heftig)" Date: Mon, 27 Jan 2020 18:11:05 +0100 Subject: ZEN: INTERACTIVE: Use BFQ as the elevator for SQ devices @@ -10,21 +10,21 @@ Subject: ZEN: INTERACTIVE: Use BFQ as the elevator for SQ devices --- a/block/elevator.c +++ b/block/elevator.c -@@ -560,7 +560,11 @@ static struct elevator_type *elevator_ge - !blk_mq_is_shared_tags(q->tag_set->flags)) - return NULL; - +@@ -716,7 +716,11 @@ void elv_update_nr_hw_queues(struct requ + void elevator_set_default(struct request_queue *q) + { + struct elv_change_ctx ctx = { +#if defined(CONFIG_ZEN_INTERACTIVE) && defined(CONFIG_IOSCHED_BFQ) -+ return elevator_find_get("bfq"); ++ .name = "bfq", +#else - return elevator_find_get("mq-deadline"); + .name = "mq-deadline", +#endif - } - - /* + .no_uevent = true, + }; + int err; --- a/init/Kconfig +++ b/init/Kconfig -@@ -169,6 +169,10 @@ config ZEN_INTERACTIVE +@@ -173,6 +173,10 @@ config ZEN_INTERACTIVE help Tunes the kernel for responsiveness at the cost of throughput and power usage. diff --git a/debian/patches/patchset-zen/sauce/0014-block-Clean-up-elevator_set_default.patch b/debian/patches/patchset-zen/sauce/0014-block-Clean-up-elevator_set_default.patch new file mode 100644 index 0000000..f695cb5 --- /dev/null +++ b/debian/patches/patchset-zen/sauce/0014-block-Clean-up-elevator_set_default.patch @@ -0,0 +1,39 @@ +From 9d0d6a80618eca3c985f2307971455d6c8ae9fe7 Mon Sep 17 00:00:00 2001 +From: "Jan Alexander Steffens (heftig)" +Date: Sat, 2 Aug 2025 04:36:06 +0200 +Subject: block: Clean up elevator_set_default + +In case of a multi-queue device, the code pointlessly loaded the +default elevator just to drop it again. +--- + block/elevator.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -737,17 +737,18 @@ void elevator_set_default(struct request + * have multiple queues or mq-deadline is not available, default + * to "none". + */ ++ if (q->nr_hw_queues != 1 && !blk_mq_is_shared_tags(q->tag_set->flags)) ++ return; ++ + e = elevator_find_get(ctx.name); + if (!e) + return; + +- if ((q->nr_hw_queues == 1 || +- blk_mq_is_shared_tags(q->tag_set->flags))) { +- err = elevator_change(q, &ctx); +- if (err < 0) +- pr_warn("\"%s\" elevator initialization, failed %d, falling back to \"none\"\n", +- ctx.name, err); +- } ++ err = elevator_change(q, &ctx); ++ if (err < 0) ++ pr_warn("\"%s\" elevator initialization, failed %d, falling back to \"none\"\n", ++ ctx.name, err); ++ + elevator_put(e); + } + diff --git a/debian/patches/patchset-zen/sauce/0013-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for-MQ-dev.patch b/debian/patches/patchset-zen/sauce/0015-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for-MQ-dev.patch similarity index 60% rename from debian/patches/patchset-zen/sauce/0013-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for-MQ-dev.patch rename to debian/patches/patchset-zen/sauce/0015-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for-MQ-dev.patch index ef73963..d0a6dad 100644 --- a/debian/patches/patchset-zen/sauce/0013-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for-MQ-dev.patch +++ b/debian/patches/patchset-zen/sauce/0015-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for-MQ-dev.patch @@ -1,4 +1,4 @@ -From 1689e70d72aff7c4e26ca326e5e94b2d244d13bd Mon Sep 17 00:00:00 2001 +From 0f5c2376123a8592d9b05167327c67e4cd5e1564 Mon Sep 17 00:00:00 2001 From: "Jan Alexander Steffens (heftig)" Date: Mon, 12 Dec 2022 00:03:03 +0100 Subject: ZEN: INTERACTIVE: Use Kyber as the elevator for MQ devices @@ -10,23 +10,23 @@ Subject: ZEN: INTERACTIVE: Use Kyber as the elevator for MQ devices --- a/block/elevator.c +++ b/block/elevator.c -@@ -558,7 +558,13 @@ static struct elevator_type *elevator_ge - - if (q->nr_hw_queues != 1 && - !blk_mq_is_shared_tags(q->tag_set->flags)) +@@ -738,7 +738,13 @@ void elevator_set_default(struct request + * to "none". + */ + if (q->nr_hw_queues != 1 && !blk_mq_is_shared_tags(q->tag_set->flags)) +#if defined(CONFIG_ZEN_INTERACTIVE) && defined(CONFIG_MQ_IOSCHED_KYBER) -+ return elevator_find_get("kyber"); ++ ctx.name = "kyber"; +#elif defined(CONFIG_ZEN_INTERACTIVE) -+ return elevator_find_get("mq-deadline"); ++ ctx.name = "mq-deadline"; +#else - return NULL; + return; +#endif - #if defined(CONFIG_ZEN_INTERACTIVE) && defined(CONFIG_IOSCHED_BFQ) - return elevator_find_get("bfq"); + e = elevator_find_get(ctx.name); + if (!e) --- a/init/Kconfig +++ b/init/Kconfig -@@ -172,6 +172,7 @@ config ZEN_INTERACTIVE +@@ -176,6 +176,7 @@ config ZEN_INTERACTIVE --- Block Layer ---------------------------------------- Default scheduler for SQ..: mq-deadline -> bfq diff --git a/debian/patches/patchset-zen/sauce/0014-ZEN-INTERACTIVE-Enable-background-reclaim-of-hugepag.patch b/debian/patches/patchset-zen/sauce/0016-ZEN-INTERACTIVE-Enable-background-reclaim-of-hugepag.patch similarity index 95% rename from debian/patches/patchset-zen/sauce/0014-ZEN-INTERACTIVE-Enable-background-reclaim-of-hugepag.patch rename to debian/patches/patchset-zen/sauce/0016-ZEN-INTERACTIVE-Enable-background-reclaim-of-hugepag.patch index eb8192f..99b7f33 100644 --- a/debian/patches/patchset-zen/sauce/0014-ZEN-INTERACTIVE-Enable-background-reclaim-of-hugepag.patch +++ b/debian/patches/patchset-zen/sauce/0016-ZEN-INTERACTIVE-Enable-background-reclaim-of-hugepag.patch @@ -1,4 +1,4 @@ -From 8ae9125b5d9637f6b97d20f71348c3e67322028b Mon Sep 17 00:00:00 2001 +From 21dd0495958b7c1bd34f2d83537a4f3af5b804c3 Mon Sep 17 00:00:00 2001 From: "Jan Alexander Steffens (heftig)" Date: Mon, 27 Jan 2020 18:21:09 +0100 Subject: ZEN: INTERACTIVE: Enable background reclaim of hugepages @@ -32,7 +32,7 @@ Reasoning and details in the original patch: https://lwn.net/Articles/711248/ --- a/init/Kconfig +++ b/init/Kconfig -@@ -174,6 +174,10 @@ config ZEN_INTERACTIVE +@@ -178,6 +178,10 @@ config ZEN_INTERACTIVE Default scheduler for SQ..: mq-deadline -> bfq Default scheduler for MQ..: none -> kyber diff --git a/debian/patches/patchset-zen/sauce/0015-ZEN-INTERACTIVE-Tune-EEVDF-for-interactivity.patch b/debian/patches/patchset-zen/sauce/0017-ZEN-INTERACTIVE-Tune-EEVDF-for-interactivity.patch similarity index 95% rename from debian/patches/patchset-zen/sauce/0015-ZEN-INTERACTIVE-Tune-EEVDF-for-interactivity.patch rename to debian/patches/patchset-zen/sauce/0017-ZEN-INTERACTIVE-Tune-EEVDF-for-interactivity.patch index dea865c..c1aa464 100644 --- a/debian/patches/patchset-zen/sauce/0015-ZEN-INTERACTIVE-Tune-EEVDF-for-interactivity.patch +++ b/debian/patches/patchset-zen/sauce/0017-ZEN-INTERACTIVE-Tune-EEVDF-for-interactivity.patch @@ -1,4 +1,4 @@ -From 93c14f60cef3fe7aa8d11edcab2d9a994b667087 Mon Sep 17 00:00:00 2001 +From 413db39ffc2d95bf43fa5690cbf6300f5d5e45bd Mon Sep 17 00:00:00 2001 From: "Jan Alexander Steffens (heftig)" Date: Tue, 31 Oct 2023 19:03:10 +0100 Subject: ZEN: INTERACTIVE: Tune EEVDF for interactivity @@ -42,7 +42,7 @@ caused by rebalancing too many tasks at once. --- a/init/Kconfig +++ b/init/Kconfig -@@ -178,6 +178,13 @@ config ZEN_INTERACTIVE +@@ -182,6 +182,13 @@ config ZEN_INTERACTIVE Background-reclaim hugepages...: no -> yes @@ -93,7 +93,7 @@ caused by rebalancing too many tasks at once. /* Restrict the NUMA promotion throughput (MB/s) for each target node. */ --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h -@@ -2790,7 +2790,7 @@ extern void deactivate_task(struct rq *r +@@ -2816,7 +2816,7 @@ extern void deactivate_task(struct rq *r extern void wakeup_preempt(struct rq *rq, struct task_struct *p, int flags); diff --git a/debian/patches/patchset-zen/sauce/0016-ZEN-INTERACTIVE-Tune-ondemand-governor-for-interacti.patch b/debian/patches/patchset-zen/sauce/0018-ZEN-INTERACTIVE-Tune-ondemand-governor-for-interacti.patch similarity index 95% rename from debian/patches/patchset-zen/sauce/0016-ZEN-INTERACTIVE-Tune-ondemand-governor-for-interacti.patch rename to debian/patches/patchset-zen/sauce/0018-ZEN-INTERACTIVE-Tune-ondemand-governor-for-interacti.patch index 3b3da24..ee6f565 100644 --- a/debian/patches/patchset-zen/sauce/0016-ZEN-INTERACTIVE-Tune-ondemand-governor-for-interacti.patch +++ b/debian/patches/patchset-zen/sauce/0018-ZEN-INTERACTIVE-Tune-ondemand-governor-for-interacti.patch @@ -1,4 +1,4 @@ -From 06211fa595081b33d5de6d818f5d370055075cb2 Mon Sep 17 00:00:00 2001 +From eb785518e63a468a6825aca26ca5de7dc1368a3a Mon Sep 17 00:00:00 2001 From: "Jan Alexander Steffens (heftig)" Date: Mon, 27 Jan 2020 18:27:16 +0100 Subject: ZEN: INTERACTIVE: Tune ondemand governor for interactivity @@ -65,7 +65,7 @@ Remove MuQSS cpufreq configuration. +#define DEF_SAMPLING_DOWN_FACTOR (5) +#else #define DEF_FREQUENCY_UP_THRESHOLD (63) -+#define MICRO_FREQUENCY_UP_THRESHOLD (70) ++#define MICRO_FREQUENCY_UP_THRESHOLD (95) #define DEF_SAMPLING_DOWN_FACTOR (100) +#endif #define MAX_SAMPLING_DOWN_FACTOR (100000) @@ -75,7 +75,7 @@ Remove MuQSS cpufreq configuration. --- a/init/Kconfig +++ b/init/Kconfig -@@ -185,6 +185,12 @@ config ZEN_INTERACTIVE +@@ -189,6 +189,12 @@ config ZEN_INTERACTIVE Bandwidth slice size...........: 5 -> 3 ms Task rebalancing threshold.....: 32 -> 8 diff --git a/debian/patches/patchset-zen/sauce/0017-ZEN-INTERACTIVE-mm-Disable-unevictable-compaction.patch b/debian/patches/patchset-zen/sauce/0019-ZEN-INTERACTIVE-mm-Disable-unevictable-compaction.patch similarity index 85% rename from debian/patches/patchset-zen/sauce/0017-ZEN-INTERACTIVE-mm-Disable-unevictable-compaction.patch rename to debian/patches/patchset-zen/sauce/0019-ZEN-INTERACTIVE-mm-Disable-unevictable-compaction.patch index 206b4fc..fe08b74 100644 --- a/debian/patches/patchset-zen/sauce/0017-ZEN-INTERACTIVE-mm-Disable-unevictable-compaction.patch +++ b/debian/patches/patchset-zen/sauce/0019-ZEN-INTERACTIVE-mm-Disable-unevictable-compaction.patch @@ -1,4 +1,4 @@ -From a79294bd643ed6b143fc76ddfdeb25caa2121aa4 Mon Sep 17 00:00:00 2001 +From b418708702f7927a7922b90871ab1cdf1df9bb94 Mon Sep 17 00:00:00 2001 From: Steven Barrett Date: Sat, 5 Mar 2022 11:37:14 -0600 Subject: ZEN: INTERACTIVE: mm: Disable unevictable compaction @@ -12,7 +12,7 @@ turn it off when CONFIG_ZEN_INTERACTIVE is set as well. --- a/init/Kconfig +++ b/init/Kconfig -@@ -177,6 +177,7 @@ config ZEN_INTERACTIVE +@@ -181,6 +181,7 @@ config ZEN_INTERACTIVE --- Virtual Memory Subsystem --------------------------- Background-reclaim hugepages...: no -> yes @@ -22,7 +22,7 @@ turn it off when CONFIG_ZEN_INTERACTIVE is set as well. --- a/mm/Kconfig +++ b/mm/Kconfig -@@ -654,7 +654,7 @@ config COMPACTION +@@ -658,7 +658,7 @@ config COMPACTION config COMPACT_UNEVICTABLE_DEFAULT int depends on COMPACTION diff --git a/debian/patches/patchset-zen/sauce/0019-ZEN-INTERACTIVE-mm-Lower-the-non-hugetlbpage-pageblo.patch b/debian/patches/patchset-zen/sauce/0019-ZEN-INTERACTIVE-mm-Lower-the-non-hugetlbpage-pageblo.patch deleted file mode 100644 index 436bbf4..0000000 --- a/debian/patches/patchset-zen/sauce/0019-ZEN-INTERACTIVE-mm-Lower-the-non-hugetlbpage-pageblo.patch +++ /dev/null @@ -1,57 +0,0 @@ -From faa505ee52add9101fc9701edc9567e7f7a254df Mon Sep 17 00:00:00 2001 -From: Sultan Alsawaf -Date: Wed, 20 Oct 2021 20:50:11 -0700 -Subject: ZEN: INTERACTIVE: mm: Lower the non-hugetlbpage pageblock size to - reduce scheduling delays - -The page allocator processes free pages in groups of pageblocks, where -the size of a pageblock is typically quite large (1024 pages without -hugetlbpage support). Pageblocks are processed atomically with the zone -lock held, which can cause severe scheduling delays on both the CPU -going through the pageblock and any other CPUs waiting to acquire the -zone lock. A frequent offender is move_freepages_block(), which is used -by rmqueue() for page allocation. - -As it turns out, there's no requirement for pageblocks to be so large, -so the pageblock order can simply be reduced to ease the scheduling -delays and zone lock contention. PAGE_ALLOC_COSTLY_ORDER is used as a -reasonable setting to ensure non-costly page allocation requests can -still be serviced without always needing to free up more than one -pageblock's worth of pages at a time. - -This has a noticeable effect on overall system latency when memory -pressure is elevated. The various mm functions which operate on -pageblocks no longer appear in the preemptoff tracer, where previously -they would spend up to 100 ms on a mobile arm64 CPU processing a -pageblock with preemption disabled and the zone lock held. - -Signed-off-by: Sultan Alsawaf ---- - include/linux/pageblock-flags.h | 4 ++++ - init/Kconfig | 1 + - 2 files changed, 5 insertions(+) - ---- a/include/linux/pageblock-flags.h -+++ b/include/linux/pageblock-flags.h -@@ -52,7 +52,11 @@ extern unsigned int pageblock_order; - #else /* CONFIG_TRANSPARENT_HUGEPAGE */ - - /* If huge pages are not used, group by MAX_ORDER_NR_PAGES */ -+#ifdef CONFIG_ZEN_INTERACTIVE -+#define pageblock_order PAGE_ALLOC_COSTLY_ORDER -+#else - #define pageblock_order MAX_PAGE_ORDER -+#endif - - #endif /* CONFIG_HUGETLB_PAGE */ - ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -179,6 +179,7 @@ config ZEN_INTERACTIVE - Background-reclaim hugepages...: no -> yes - Compact unevictable............: yes -> no - Watermark boost factor.........: 1.5 -> 0 -+ Pageblock order................: 10 -> 3 - - --- EEVDF CPU Scheduler -------------------------------- - diff --git a/debian/patches/patchset-zen/sauce/0020-ZEN-INTERACTIVE-dm-crypt-Disable-workqueues-for-cryp.patch b/debian/patches/patchset-zen/sauce/0020-ZEN-INTERACTIVE-dm-crypt-Disable-workqueues-for-cryp.patch deleted file mode 100644 index 18697ba..0000000 --- a/debian/patches/patchset-zen/sauce/0020-ZEN-INTERACTIVE-dm-crypt-Disable-workqueues-for-cryp.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 8114de0815b1821e66951288e0a14c5a13b68d82 Mon Sep 17 00:00:00 2001 -From: Steven Barrett -Date: Sat, 21 May 2022 15:15:09 -0500 -Subject: ZEN: INTERACTIVE: dm-crypt: Disable workqueues for crypto ops - -Queueing in dm-crypt for crypto operations reduces performance on modern -systems. As discussed in an article from Cloudflare, they discovered -that queuing was introduced because the crypto subsystem used to be -synchronous. Since it's now asynchronous, we get double queueing when -using the subsystem through dm-crypt. This is obviously undesirable and -reduces throughput and increases latency. - -Disable queueing when using our Zen Interactive configuration. - -Fixes: https://github.com/zen-kernel/zen-kernel/issues/282 ---- - drivers/md/dm-crypt.c | 5 +++++ - init/Kconfig | 1 + - 2 files changed, 6 insertions(+) - ---- a/drivers/md/dm-crypt.c -+++ b/drivers/md/dm-crypt.c -@@ -3284,6 +3284,11 @@ static int crypt_ctr(struct dm_target *t - goto bad; - } - -+#ifdef CONFIG_ZEN_INTERACTIVE -+ set_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags); -+ set_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags); -+#endif -+ - ret = crypt_ctr_cipher(ti, argv[0], argv[1]); - if (ret < 0) - goto bad; ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -173,6 +173,7 @@ config ZEN_INTERACTIVE - - Default scheduler for SQ..: mq-deadline -> bfq - Default scheduler for MQ..: none -> kyber -+ DM-Crypt workqueues.......: yes -> no - - --- Virtual Memory Subsystem --------------------------- - diff --git a/debian/patches/patchset-zen/sauce/0018-ZEN-INTERACTIVE-mm-Disable-watermark-boosting-by-def.patch b/debian/patches/patchset-zen/sauce/0020-ZEN-INTERACTIVE-mm-Disable-watermark-boosting-by-def.patch similarity index 95% rename from debian/patches/patchset-zen/sauce/0018-ZEN-INTERACTIVE-mm-Disable-watermark-boosting-by-def.patch rename to debian/patches/patchset-zen/sauce/0020-ZEN-INTERACTIVE-mm-Disable-watermark-boosting-by-def.patch index 6d8be96..cd60b1e 100644 --- a/debian/patches/patchset-zen/sauce/0018-ZEN-INTERACTIVE-mm-Disable-watermark-boosting-by-def.patch +++ b/debian/patches/patchset-zen/sauce/0020-ZEN-INTERACTIVE-mm-Disable-watermark-boosting-by-def.patch @@ -1,4 +1,4 @@ -From d7c684733ae88876fb00899c621dd40e08902f1e Mon Sep 17 00:00:00 2001 +From 92850f57d0d3dd0c55a6556f4c4a9afd38da7f8a Mon Sep 17 00:00:00 2001 From: Sultan Alsawaf Date: Sat, 28 Mar 2020 13:06:28 -0700 Subject: ZEN: INTERACTIVE: mm: Disable watermark boosting by default @@ -33,7 +33,7 @@ Signed-off-by: Sultan Alsawaf --- a/init/Kconfig +++ b/init/Kconfig -@@ -178,6 +178,7 @@ config ZEN_INTERACTIVE +@@ -182,6 +182,7 @@ config ZEN_INTERACTIVE Background-reclaim hugepages...: no -> yes Compact unevictable............: yes -> no diff --git a/debian/patches/patchset-zen/sauce/0021-ZEN-INTERACTIVE-mm-swap-Disable-swap-in-readahead.patch b/debian/patches/patchset-zen/sauce/0021-ZEN-INTERACTIVE-mm-swap-Disable-swap-in-readahead.patch index ee9b53f..c1f980a 100644 --- a/debian/patches/patchset-zen/sauce/0021-ZEN-INTERACTIVE-mm-swap-Disable-swap-in-readahead.patch +++ b/debian/patches/patchset-zen/sauce/0021-ZEN-INTERACTIVE-mm-swap-Disable-swap-in-readahead.patch @@ -1,4 +1,4 @@ -From 1bc3828fcd5966dd94126355e4d02e42caf1407b Mon Sep 17 00:00:00 2001 +From e3afdec765f5277bbd3b2196e0facb8b428fb9d2 Mon Sep 17 00:00:00 2001 From: Steven Barrett Date: Mon, 5 Sep 2022 11:35:20 -0500 Subject: ZEN: INTERACTIVE: mm/swap: Disable swap-in readahead @@ -20,10 +20,10 @@ same change so Zen Kernel users benefit. --- a/init/Kconfig +++ b/init/Kconfig -@@ -181,6 +181,7 @@ config ZEN_INTERACTIVE +@@ -183,6 +183,7 @@ config ZEN_INTERACTIVE + Background-reclaim hugepages...: no -> yes Compact unevictable............: yes -> no Watermark boost factor.........: 1.5 -> 0 - Pageblock order................: 10 -> 3 + Swap-in readahead..............: 3 -> 0 --- EEVDF CPU Scheduler -------------------------------- diff --git a/debian/patches/patchset-zen/sauce/0022-ZEN-INTERACTIVE-Document-PDS-BMQ-configuration.patch b/debian/patches/patchset-zen/sauce/0022-ZEN-INTERACTIVE-Document-PDS-BMQ-configuration.patch index ffc82a2..a51137b 100644 --- a/debian/patches/patchset-zen/sauce/0022-ZEN-INTERACTIVE-Document-PDS-BMQ-configuration.patch +++ b/debian/patches/patchset-zen/sauce/0022-ZEN-INTERACTIVE-Document-PDS-BMQ-configuration.patch @@ -1,4 +1,4 @@ -From 625fb48c0c4fab13b9c2f231c3fe6368a1b78242 Mon Sep 17 00:00:00 2001 +From c7afc157454cc7f09bc57eadf2efed6fb7fd006d Mon Sep 17 00:00:00 2001 From: Steven Barrett Date: Sun, 19 Sep 2021 16:03:36 -0500 Subject: ZEN: INTERACTIVE: Document PDS/BMQ configuration @@ -9,7 +9,7 @@ Subject: ZEN: INTERACTIVE: Document PDS/BMQ configuration --- a/init/Kconfig +++ b/init/Kconfig -@@ -190,6 +190,11 @@ config ZEN_INTERACTIVE +@@ -192,6 +192,11 @@ config ZEN_INTERACTIVE Bandwidth slice size...........: 5 -> 3 ms Task rebalancing threshold.....: 32 -> 8 diff --git a/debian/patches/patchset-zen/sauce/0023-squash-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for.patch b/debian/patches/patchset-zen/sauce/0023-squash-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for.patch new file mode 100644 index 0000000..62a9c9b --- /dev/null +++ b/debian/patches/patchset-zen/sauce/0023-squash-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for.patch @@ -0,0 +1,25 @@ +From 08d11019f3924f192e1a68d7d2007f8ec7bdf889 Mon Sep 17 00:00:00 2001 +From: "Jan Alexander Steffens (heftig)" +Date: Sun, 3 Aug 2025 15:27:26 +0200 +Subject: squash! ZEN: INTERACTIVE: Use Kyber as the elevator for MQ devices + +Fall back straight to none instead of mq-deadline. Some benchmarks in a +[recent paper][1] suggest that mq-deadline has too much lock contention, +hurting throughput and eating CPU waiting for spinlocks. + +[1]: https://research.spec.org/icpe_proceedings/2024/proceedings/p154.pdf +--- + block/elevator.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -740,8 +740,6 @@ void elevator_set_default(struct request + if (q->nr_hw_queues != 1 && !blk_mq_is_shared_tags(q->tag_set->flags)) + #if defined(CONFIG_ZEN_INTERACTIVE) && defined(CONFIG_MQ_IOSCHED_KYBER) + ctx.name = "kyber"; +-#elif defined(CONFIG_ZEN_INTERACTIVE) +- ctx.name = "mq-deadline"; + #else + return; + #endif diff --git a/debian/patches/series b/debian/patches/series index 4c9cbdf..91f2828 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -67,6 +67,7 @@ features/x86/x86-make-x32-syscall-support-conditional.patch # Miscellaneous bug fixes bugfix/all/disable-some-marvell-phys.patch bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch +bugfix/all/ext4-don-t-try-to-clear-the-orphan_present-feature-b.patch # Miscellaneous features @@ -100,6 +101,9 @@ bugfix/all/perf-tools-pass-extra_cflags-through-to-libbpf-build-again.patch bugfix/all/kbuild-bpf-fix-btf-reproducibility.patch bugfix/all/perf-docs-Fix-perf-check-manual-page-built-with-asci.patch bugfix/all/libbpf-use-the-standard-fixdep-build-rule.patch +bugfix/all/tools-bootconfig-cleanup-bootconfig-footer-size-calc.patch +bugfix/all/bootconfig-fix-unaligned-access-when-building-footer.patch +bugfix/all/bootconfig-fix-negative-seeks-on-32-bit-with-lfs-ena.patch # ABI maintenance @@ -115,22 +119,22 @@ krd/0004-certs-genkey.patch mixed-arch/0001-graysky2-more-ISA-levels-and-uarches.patch mixed-arch/0002-ZEN-Restore-CONFIG_OPTIMIZE_FOR_PERFORMANCE_O3.patch mixed-arch/0003-krd-adjust-CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3.patch -mixed-arch/0004-XANMOD-x86-build-Prevent-generating-avx2-and-avx512-.patch +mixed-arch/0004-XANMOD-x86-build-prevent-generating-avx2-floating-point-code.patch mixed-arch/0005-krd-adjust-KBUILD_CFLAGS-fno-tree-vectorize.patch -mixed-arch/0006-XANMOD-kbuild-Add-GCC-SMS-based-modulo-scheduling-fl.patch +mixed-arch/0006-XANMOD-kbuild-add-GCC-SMS-based-modulo-scheduling-flags.patch -misc-openwrt/0001-mac80211-ignore-AP-power-level-when-tx-power-type-is.patch -misc-openwrt/0002-mac80211-avoid-crashing-missing-band.patch -misc-openwrt/0003-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch -misc-openwrt/0004-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch -misc-openwrt/0005-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch -misc-openwrt/0006-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch -misc-openwrt/0007-mac80211-increase-quantum-for-airtime-scheduler.patch -misc-openwrt/0008-mac80211-add-AQL-support-for-broadcast-packets.patch -misc-openwrt/0009-mac80211-txq-tune.patch -misc-openwrt/0010-cfg80211-aql-txq-limit.patch -misc-openwrt/0101-sched-sch_cake-fix-bulk-flow-accounting-logic-for-host.patch -misc-openwrt/0201-fq-adjust-memory-size.patch +misc-openwrt/0101-mac80211-ignore-AP-power-level-when-tx-power-type-is.patch +misc-openwrt/0102-mac80211-avoid-crashing-missing-band.patch +misc-openwrt/0103-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch +misc-openwrt/0104-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch +misc-openwrt/0105-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch +misc-openwrt/0106-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch +misc-openwrt/0107-mac80211-increase-quantum-for-airtime-scheduler.patch +misc-openwrt/0108-mac80211-add-AQL-support-for-broadcast-packets.patch +misc-openwrt/0109-mac80211-txq-tune.patch +misc-openwrt/0110-cfg80211-aql-txq-limit.patch +misc-openwrt/0201-sched-sch_cake-fix-bulk-flow-accounting-logic-for-host.patch +misc-openwrt/0301-fq-adjust-memory-size.patch patchset-pf/cpuidle/0001-cpuidle-Prefer-teo-over-menu-governor.patch @@ -147,24 +151,7 @@ patchset-xanmod/clearlinux/0004-drivers-initialize-ata-before-graphics.patch patchset-xanmod/net/netfilter/0001-netfilter-Add-netfilter-nf_tables-fullcone-support.patch patchset-xanmod/net/netfilter/0002-netfilter-add-xt_FLOWOFFLOAD-target.patch -patchset-xanmod/net/tcp/bbr3/0001-net-tcp_bbr-broaden-app-limited-rate-sample-detectio.patch -patchset-xanmod/net/tcp/bbr3/0002-net-tcp_bbr-v2-shrink-delivered_mstamp-first_tx_msta.patch -patchset-xanmod/net/tcp/bbr3/0003-net-tcp_bbr-v2-snapshot-packets-in-flight-at-transmi.patch -patchset-xanmod/net/tcp/bbr3/0004-net-tcp_bbr-v2-count-packets-lost-over-TCP-rate-samp.patch -patchset-xanmod/net/tcp/bbr3/0005-net-tcp_bbr-v2-export-FLAG_ECE-in-rate_sample.is_ece.patch -patchset-xanmod/net/tcp/bbr3/0006-net-tcp_bbr-v2-introduce-ca_ops-skb_marked_lost-CC-m.patch -patchset-xanmod/net/tcp/bbr3/0007-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-merge-in.patch -patchset-xanmod/net/tcp/bbr3/0008-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-split-in.patch -patchset-xanmod/net/tcp/bbr3/0009-net-tcp-add-new-ca-opts-flag-TCP_CONG_WANTS_CE_EVENT.patch -patchset-xanmod/net/tcp/bbr3/0010-net-tcp-re-generalize-TSO-sizing-in-TCP-CC-module-AP.patch -patchset-xanmod/net/tcp/bbr3/0011-net-tcp-add-fast_ack_mode-1-skip-rwin-check-in-tcp_f.patch -patchset-xanmod/net/tcp/bbr3/0012-net-tcp_bbr-v2-record-app-limited-status-of-TLP-repa.patch -patchset-xanmod/net/tcp/bbr3/0013-net-tcp_bbr-v2-inform-CC-module-of-losses-repaired-b.patch -patchset-xanmod/net/tcp/bbr3/0014-net-tcp_bbr-v2-introduce-is_acking_tlp_retrans_seq-i.patch -patchset-xanmod/net/tcp/bbr3/0015-tcp-introduce-per-route-feature-RTAX_FEATURE_ECN_LOW.patch -patchset-xanmod/net/tcp/bbr3/0016-net-tcp_bbr-v3-update-TCP-bbr-congestion-control-mod.patch -patchset-xanmod/net/tcp/bbr3/0017-net-tcp_bbr-v3-ensure-ECN-enabled-BBR-flows-set-ECT-.patch -patchset-xanmod/net/tcp/bbr3/0018-tcp-export-TCPI_OPT_ECN_LOW-in-tcp_info-tcpi_options.patch +patchset-xanmod/net/tcp/bbr3/0001-tcp_bbr-v3-update-TCP-bbr-congestion-control-module-.patch patchset-xanmod/net/tcp/cloudflare/0001-tcp-Add-a-sysctl-to-skip-tcp-collapse-processing-whe.patch @@ -178,54 +165,147 @@ patchset-xanmod/valve/0005-mfd-Add-MFD-core-driver-for-Steam-Deck.patch patchset-xanmod/valve/0006-mfd-steamdeck-Expose-controller-board-power-in-sysfs.patch patchset-xanmod/xanmod/0001-kbuild-Re-add-.config-file-required-to-sign-external.patch -patchset-xanmod/xanmod/0002-kbuild-Remove-GCC-minimal-function-alignment.patch -patchset-xanmod/xanmod/0003-XANMOD-fair-Set-scheduler-tunable-latencies-to-unsca.patch -patchset-xanmod/xanmod/0004-XANMOD-sched-Add-yield_type-sysctl-to-reduce-or-disa.patch -patchset-xanmod/xanmod/0005-XANMOD-block-mq-deadline-Increase-write-priority-to-.patch -patchset-xanmod/xanmod/0006-XANMOD-block-mq-deadline-Disable-front_merges-by-def.patch -patchset-xanmod/xanmod/0007-XANMOD-block-Set-rq_affinity-to-force-complete-I-O-r.patch -patchset-xanmod/xanmod/0008-XANMOD-blk-wbt-Set-wbt_default_latency_nsec-to-2msec.patch -patchset-xanmod/xanmod/0009-XANMOD-kconfig-add-500Hz-timer-interrupt-kernel-conf.patch -patchset-xanmod/xanmod/0010-XANMOD-dcache-cache_pressure-50-decreases-the-rate-a.patch -patchset-xanmod/xanmod/0011-XANMOD-mm-Raise-max_map_count-default-value.patch -patchset-xanmod/xanmod/0012-XANMOD-mm-vmscan-Reduce-amount-of-swapping.patch -patchset-xanmod/xanmod/0013-XANMOD-sched-autogroup-Add-kernel-parameter-and-conf.patch -patchset-xanmod/xanmod/0014-XANMOD-cpufreq-tunes-ondemand-and-conservative-gover.patch -patchset-xanmod/xanmod/0015-XANMOD-lib-kconfig.debug-disable-default-SYMBOLIC_ER.patch -patchset-xanmod/xanmod/0016-XANMOD-scripts-setlocalversion-remove-tag-for-git-re.patch -patchset-xanmod/xanmod/0017-XANMOD-scripts-setlocalversion-Move-localversion-fil.patch +patchset-xanmod/xanmod/0002-XANMOD-fair-Set-scheduler-tunable-latencies-to-unsca.patch +patchset-xanmod/xanmod/0003-XANMOD-sched-Add-yield_type-sysctl-to-reduce-or-disa.patch +patchset-xanmod/xanmod/0004-XANMOD-block-mq-deadline-Increase-write-priority-to-.patch +patchset-xanmod/xanmod/0005-XANMOD-block-mq-deadline-Disable-front_merges-by-def.patch +patchset-xanmod/xanmod/0006-XANMOD-block-Set-rq_affinity-to-force-complete-I-O-r.patch +patchset-xanmod/xanmod/0007-XANMOD-blk-wbt-Set-wbt_default_latency_nsec-to-2msec.patch +patchset-xanmod/xanmod/0008-XANMOD-kconfig-add-500Hz-timer-interrupt-kernel-conf.patch +patchset-xanmod/xanmod/0009-XANMOD-vfs-Decrease-rate-at-which-vfs-caches-are-rec.patch +patchset-xanmod/xanmod/0010-XANMOD-mm-Raise-max_map_count-default-value.patch +patchset-xanmod/xanmod/0011-XANMOD-mm-vmscan-Reduce-amount-of-swapping.patch +patchset-xanmod/xanmod/0012-XANMOD-sched-autogroup-Add-kernel-parameter-and-conf.patch +patchset-xanmod/xanmod/0013-XANMOD-cpufreq-tunes-ondemand-and-conservative-gover.patch +patchset-xanmod/xanmod/0014-XANMOD-lib-kconfig.debug-disable-default-SYMBOLIC_ER.patch +patchset-xanmod/xanmod/0015-XANMOD-scripts-setlocalversion-remove-tag-for-git-re.patch +patchset-xanmod/xanmod/0016-XANMOD-scripts-setlocalversion-Move-localversion-fil.patch patchset-zen/sauce/0001-ZEN-Add-VHBA-driver.patch patchset-zen/sauce/0002-ZEN-PCI-Add-Intel-remapped-NVMe-device-support.patch patchset-zen/sauce/0003-ZEN-Disable-stack-conservation-for-GCC.patch patchset-zen/sauce/0004-ZEN-Input-evdev-use-call_rcu-when-detaching-client.patch -patchset-zen/sauce/0005-ZEN-cpufreq-Remove-schedutil-dependency-on-Intel-AMD.patch -patchset-zen/sauce/0006-ZEN-intel-pstate-Implement-enable-parameter.patch -patchset-zen/sauce/0007-ZEN-drm-amdgpu-pm-Allow-override-of-min_power_limit-.patch -patchset-zen/sauce/0008-ZEN-mm-Stop-kswapd-early-when-nothing-s-waiting-for-.patch -patchset-zen/sauce/0009-ZEN-ahci-Disable-staggered-spinup-by-default.patch -patchset-zen/sauce/0010-ZEN-kernel-Kconfig.preempt-Remove-EXPERT-conditional.patch -patchset-zen/sauce/0011-ZEN-INTERACTIVE-Base-config-item.patch -patchset-zen/sauce/0012-ZEN-INTERACTIVE-Use-BFQ-as-the-elevator-for-SQ-devic.patch -patchset-zen/sauce/0013-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for-MQ-dev.patch -patchset-zen/sauce/0014-ZEN-INTERACTIVE-Enable-background-reclaim-of-hugepag.patch -patchset-zen/sauce/0015-ZEN-INTERACTIVE-Tune-EEVDF-for-interactivity.patch -patchset-zen/sauce/0016-ZEN-INTERACTIVE-Tune-ondemand-governor-for-interacti.patch -patchset-zen/sauce/0017-ZEN-INTERACTIVE-mm-Disable-unevictable-compaction.patch -patchset-zen/sauce/0018-ZEN-INTERACTIVE-mm-Disable-watermark-boosting-by-def.patch -patchset-zen/sauce/0019-ZEN-INTERACTIVE-mm-Lower-the-non-hugetlbpage-pageblo.patch -patchset-zen/sauce/0020-ZEN-INTERACTIVE-dm-crypt-Disable-workqueues-for-cryp.patch +patchset-zen/sauce/0005-ZEN-Add-config-for-default-of-unprivileged_userns_cl.patch +patchset-zen/sauce/0006-ZEN-cpufreq-Remove-schedutil-dependency-on-Intel-AMD.patch +patchset-zen/sauce/0007-ZEN-intel-pstate-Implement-enable-parameter.patch +patchset-zen/sauce/0008-ZEN-drm-amdgpu-pm-Allow-override-of-min_power_limit-.patch +patchset-zen/sauce/0009-ZEN-mm-Stop-kswapd-early-when-nothing-s-waiting-for-.patch +patchset-zen/sauce/0010-ZEN-ahci-Disable-staggered-spinup-by-default.patch +patchset-zen/sauce/0011-ZEN-kernel-Kconfig.preempt-Remove-EXPERT-conditional.patch +patchset-zen/sauce/0012-ZEN-INTERACTIVE-Base-config-item.patch +patchset-zen/sauce/0013-ZEN-INTERACTIVE-Use-BFQ-as-the-elevator-for-SQ-devic.patch +patchset-zen/sauce/0014-block-Clean-up-elevator_set_default.patch +patchset-zen/sauce/0015-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for-MQ-dev.patch +patchset-zen/sauce/0016-ZEN-INTERACTIVE-Enable-background-reclaim-of-hugepag.patch +patchset-zen/sauce/0017-ZEN-INTERACTIVE-Tune-EEVDF-for-interactivity.patch +patchset-zen/sauce/0018-ZEN-INTERACTIVE-Tune-ondemand-governor-for-interacti.patch +patchset-zen/sauce/0019-ZEN-INTERACTIVE-mm-Disable-unevictable-compaction.patch +patchset-zen/sauce/0020-ZEN-INTERACTIVE-mm-Disable-watermark-boosting-by-def.patch patchset-zen/sauce/0021-ZEN-INTERACTIVE-mm-swap-Disable-swap-in-readahead.patch patchset-zen/sauce/0022-ZEN-INTERACTIVE-Document-PDS-BMQ-configuration.patch +patchset-zen/sauce/0023-squash-ZEN-INTERACTIVE-Use-Kyber-as-the-elevator-for.patch -patchset-pf/fixes/0001-Revert-Disable-FOP_DONTCACHE-for-now-due-to-bugs.patch -patchset-pf/fixes/0002-mm-filemap-unify-read-write-dropbehind-naming.patch -patchset-pf/fixes/0003-mm-filemap-unify-dropbehind-flag-testing-and-clearin.patch -patchset-pf/fixes/0004-mm-khugepaged-fix-race-with-folio-split-free-using-t.patch -patchset-pf/fixes/0005-mm-add-folio_expected_ref_count-for-reference-count-.patch -patchset-pf/fixes/0006-drm-i915-snps_hdmi_pll-Fix-64-bit-divisor-truncation.patch -patchset-pf/fixes/0007-mm-compaction-use-folio-in-hugetlb-pathway.patch -patchset-pf/fixes/0008-mm-hugetlb-remove-unnecessary-holding-of-hugetlb_loc.patch -patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch +patchset-pf/steady/0001-PCI-Fix-link-speed-calculation-on-retrain-failure.patch +patchset-pf/steady/0002-PCI-endpoint-Fix-configfs-group-list-head-handling.patch +patchset-pf/steady/0003-PCI-endpoint-Fix-configfs-group-removal-on-driver-te.patch +patchset-pf/steady/0004-media-v4l2-ctrls-Don-t-reset-handler-s-error-in-v4l2.patch +patchset-pf/steady/0005-dm-dm-crypt-Do-not-partially-accept-write-BIOs-with-.patch +patchset-pf/steady/0006-dm-Check-for-forbidden-splitting-of-zone-write-opera.patch +patchset-pf/steady/0007-mtd-spi-nor-Fix-spi_nor_try_unlock_all.patch +patchset-pf/steady/0008-readahead-fix-return-value-of-page_cache_next_miss-w.patch +patchset-pf/steady/0009-PM-runtime-Take-active-children-into-account-in-pm_r.patch +patchset-pf/steady/0010-io_uring-zcrx-always-pass-page-to-io_zcrx_copy_chunk.patch +patchset-pf/steady/0011-io_uring-zcrx-assert-area-type-in-io_zcrx_iov_page.patch +patchset-pf/steady/0012-io_uring-zcrx-prepare-fallback-for-larger-pages.patch +patchset-pf/steady/0013-crypto-x86-aegis-Fix-sleeping-when-disallowed-on-PRE.patch +patchset-pf/steady/0014-crypto-x86-aegis-Add-missing-error-checks.patch +patchset-pf/steady/0015-hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch +patchset-pf/steady/0016-vt-keyboard-Don-t-process-Unicode-characters-in-K_OF.patch +patchset-pf/steady/0017-vt-defkeymap-Map-keycodes-above-127-to-K_HOLE.patch +patchset-pf/steady/0018-serial-8250-fix-panic-due-to-PSLVERR.patch +patchset-pf/steady/0019-mm-damon-paddr-use-alloc_migartion_target-with-no-mi.patch +patchset-pf/steady/0020-mm-damon-move-migration-helpers-from-paddr-to-ops-co.patch +patchset-pf/steady/0021-mm-damon-move-folio-filtering-from-paddr-to-ops-comm.patch +patchset-pf/steady/0022-mm-damon-ops-common-ignore-migration-request-to-inva.patch +patchset-pf/steady/0023-usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbin.patch +patchset-pf/steady/0024-PCI-portdrv-Use-is_pciehp-instead-of-is_hotplug_brid.patch +patchset-pf/steady/0025-ata-libata-scsi-Fix-ata_to_sense_error-status-handli.patch +patchset-pf/steady/0026-ata-libata-scsi-Return-aborted-command-when-missing-.patch +patchset-pf/steady/0027-vhost-vsock-Avoid-allocating-arbitrarily-sized-SKBs.patch +patchset-pf/steady/0028-vsock-virtio-Validate-length-in-packet-header-before.patch +patchset-pf/steady/0029-fs-proc-task_mmu-remove-conversion-of-seq_file-posit.patch +patchset-pf/steady/0030-kbuild-userprogs-use-correct-linker-when-mixing-clan.patch +patchset-pf/steady/0031-Revert-vgacon-Add-check-for-vc_origin-address-range-.patch +patchset-pf/steady/0032-crypto-hash-Increase-HASH_MAX_DESCSIZE-for-hmac-sha3.patch +patchset-pf/steady/0033-cifs-Add-support-for-creating-reparse-points-over-SM.patch +patchset-pf/steady/0034-smb-client-fix-creating-symlinks-under-POSIX-mounts.patch +patchset-pf/steady/0035-kasan-test-fix-protection-against-compiler-elision.patch +patchset-pf/steady/0036-proc-proc_maps_open-allow-proc_mem_open-to-return-NU.patch +patchset-pf/steady/0037-block-restore-default-wbt-enablement.patch +patchset-pf/steady/0038-xfs-fully-decouple-XFS_IBULK-flags-from-XFS_IWALK-fl.patch +patchset-pf/steady/0039-watchdog-intel_oc_wdt-Do-not-try-to-write-into-const.patch +patchset-pf/steady/0040-cgroup-avoid-null-de-ref-in-css_rstat_exit.patch +patchset-pf/steady/0041-open_tree_attr-do-not-allow-id-mapping-changes-witho.patch +patchset-pf/steady/0042-iomap-Fix-broken-data-integrity-guarantees-for-O_SYN.patch +patchset-pf/steady/0043-sched-ext-Fix-invalid-task-state-transitions-on-clas.patch +patchset-pf/steady/0044-platform-x86-intel-uncore-freq-Check-write-blocked-f.patch +patchset-pf/steady/0045-usb-quirks-Add-DELAY_INIT-quick-for-another-SanDisk-.patch +patchset-pf/steady/0046-usb-renesas-xhci-Fix-External-ROM-access-timeouts.patch +patchset-pf/steady/0047-usb-core-hcd-fix-accessing-unmapped-memory-in-SINGLE.patch +patchset-pf/steady/0048-USB-storage-Add-unusual-devs-entry-for-Novatek-NTK96.patch +patchset-pf/steady/0049-usb-dwc3-Ignore-late-xferNotReady-event-to-prevent-h.patch +patchset-pf/steady/0050-usb-dwc3-pci-add-support-for-the-Intel-Wildcat-Lake.patch +patchset-pf/steady/0051-usb-storage-realtek_cr-Use-correct-byte-order-for-bc.patch +patchset-pf/steady/0052-ata-libata-scsi-Fix-CDL-control.patch +patchset-pf/steady/0053-netfs-Fix-unbuffered-write-error-handling.patch +patchset-pf/steady/0054-ALSA-hda-realtek-Add-support-for-HP-EliteBook-x360-8.patch +patchset-pf/steady/0055-USB-storage-Ignore-driver-CD-mode-for-Realtek-multi-.patch +patchset-pf/steady/0056-usb-dwc3-Remove-WARN_ON-for-device-endpoint-command-.patch +patchset-pf/steady/0057-usb-typec-maxim_contaminant-disable-low-power-mode-w.patch +patchset-pf/steady/0058-usb-typec-maxim_contaminant-re-enable-cc-toggle-if-c.patch +patchset-pf/steady/0059-debugfs-fix-mount-options-not-being-applied.patch +patchset-pf/steady/0060-ksmbd-extend-the-connection-limiting-mechanism-to-su.patch +patchset-pf/steady/0061-ksmbd-fix-refcount-leak-causing-resource-not-release.patch +patchset-pf/steady/0062-mmc-sdhci-pci-gli-Add-a-new-function-to-simplify-the.patch +patchset-pf/steady/0063-mmc-sdhci-pci-gli-GL9763e-Rename-the-gli_set_gl9763e.patch +patchset-pf/steady/0064-mmc-sdhci-pci-gli-GL9763e-Mask-the-replay-timer-time.patch +patchset-pf/steady/0065-mmc-sdhci-of-arasan-Ensure-CD-logic-stabilization-be.patch +patchset-pf/steady/0066-memstick-Fix-deadlock-by-moving-removing-flag-earlie.patch +patchset-pf/steady/0067-compiler-remove-__ADDRESSABLE_ASM-_STR-again.patch +patchset-pf/steady/0068-ACPI-APEI-EINJ-Fix-resource-leak-by-remove-callback-.patch +patchset-pf/steady/0069-cpuidle-governors-menu-Avoid-selecting-states-with-t.patch +patchset-pf/steady/0070-mptcp-drop-skb-if-MPTCP-skb-extension-allocation-fai.patch +patchset-pf/steady/0071-mptcp-pm-kernel-flush-do-not-reset-ADD_ADDR-limit.patch +patchset-pf/steady/0072-mptcp-remove-duplicate-sk_reset_timer-call.patch +patchset-pf/steady/0073-mptcp-disable-add_addr-retransmission-when-timeout-i.patch +patchset-pf/steady/0074-usb-xhci-Fix-slot_id-resource-race-conflict.patch +patchset-pf/steady/0075-usb-xhci-fix-host-not-responding-after-suspend-and-r.patch +patchset-pf/steady/0076-NFS-Fix-a-race-when-updating-an-existing-write.patch +patchset-pf/steady/0077-kho-init-new_physxa-phys_bits-to-fix-lockdep.patch +patchset-pf/steady/0078-kho-mm-don-t-allow-deferred-struct-page-with-KHO.patch +patchset-pf/steady/0079-kho-warn-if-KHO-is-disabled-due-to-an-error.patch +patchset-pf/steady/0080-squashfs-fix-memory-leak-in-squashfs_fill_super.patch +patchset-pf/steady/0081-mm-debug_vm_pgtable-clear-page-table-entries-at-dest.patch +patchset-pf/steady/0082-mm-damon-core-fix-commit_ops_filters-by-using-correc.patch +patchset-pf/steady/0083-iov_iter-iterate_folioq-fix-handling-of-offset-folio.patch +patchset-pf/steady/0084-mm-memory-failure-fix-infinite-UCE-for-VM_PFNMAP-pfn.patch +patchset-pf/steady/0085-mm-damon-core-fix-damos_commit_filter-not-changing-a.patch +patchset-pf/steady/0086-mm-mremap-fix-WARN-with-uffd-that-has-remap-events-d.patch +patchset-pf/steady/0087-ALSA-hda-tas2781-Fix-wrong-reference-of-tasdevice_pr.patch +patchset-pf/steady/0088-tracing-Remove-unneeded-goto-out-logic.patch +patchset-pf/steady/0089-tracing-Limit-access-to-parser-buffer-when-trace_get.patch +patchset-pf/steady/0090-ACPI-pfr_update-Fix-the-driver-update-version-check.patch +patchset-pf/steady/0091-tracing-fprobe-event-Sanitize-wildcard-for-fprobe-ev.patch +patchset-pf/steady/0092-net-hsr-reject-HSR-frame-if-skb-can-t-hold-tag.patch +patchset-pf/steady/0093-ipv6-sr-Fix-MAC-comparison-to-be-constant-time.patch +patchset-pf/steady/0094-mmc-sdhci_am654-Drop-the-use-of-sdhci_pltfm_free.patch +patchset-pf/steady/0095-mmc-sdhci_am654-Disable-HS400-for-AM62P-SR1.0-and-SR.patch +patchset-pf/steady/0096-io_uring-futex-ensure-io_futex_wait-cleans-up-proper.patch +patchset-pf/steady/0097-iommu-arm-smmu-v3-Fix-smmu_domain-nr_ats_masters-dec.patch +patchset-pf/steady/0098-iommu-Remove-ops.pgsize_bitmap-from-drivers-that-don.patch +patchset-pf/steady/0099-iommu-virtio-Make-instance-lookup-robust.patch +patchset-pf/steady/0100-ftrace-Also-allocate-and-copy-hash-for-reading-of-fi.patch +patchset-pf/steady/0101-x86-cpu-hygon-Add-missing-resctrl_cpu_detect-in-bsp_.patch +patchset-pf/steady/0102-x86-CPU-AMD-Ignore-invalid-reset-reason-value.patch -patchset-zen/fixes/0001-drivers-firmware-skip-simpledrm-if-nvidia-drm.modese.patch +patchset-zen/fixes/0001-proc-fix-missing-pde_set_flags-for-net-proc-files.patch diff --git a/debian/rules.d/scripts/Makefile b/debian/rules.d/scripts/Makefile index a858eeb..0c1be41 100644 --- a/debian/rules.d/scripts/Makefile +++ b/debian/rules.d/scripts/Makefile @@ -21,7 +21,7 @@ SCRIPTS = \ gcc-*.sh \ gen_initramfs_list.sh \ headers_install.sh \ - kernel-doc \ + kernel-doc.py \ ld-version.sh \ Lindent \ makelst \ @@ -40,6 +40,7 @@ SUBDIRS = \ basic \ genksyms \ kconfig \ + lib/kdoc \ mod include $(top_rulesdir)/Makefile.inc diff --git a/debian/rules.d/scripts/lib/kdoc/Makefile b/debian/rules.d/scripts/lib/kdoc/Makefile new file mode 100644 index 0000000..1805564 --- /dev/null +++ b/debian/rules.d/scripts/lib/kdoc/Makefile @@ -0,0 +1,3 @@ +DATA = *.py + +include $(top_rulesdir)/Makefile.inc diff --git a/debian/rules.real b/debian/rules.real index ecf1307..ec883e1 100644 --- a/debian/rules.real +++ b/debian/rules.real @@ -459,6 +459,7 @@ binary_kbuild: build_kbuild $(call make-tools,scripts) install prefix=$(PREFIX_DIR) $(call make-tools,tools/bpf/resolve_btfids) install prefix=$(PREFIX_DIR) $(call make-tools,tools/objtool) install prefix=$(PREFIX_DIR) + dh_python3 $(PREFIX_DIR)/scripts dh_link $(PREFIX_DIR) /usr/src/$(PACKAGE_NAME) $(dh_binary_post) diff --git a/debian/templates/tools-versioned.control.in b/debian/templates/tools-versioned.control.in index 3eeaa42..a467d03 100644 --- a/debian/templates/tools-versioned.control.in +++ b/debian/templates/tools-versioned.control.in @@ -2,7 +2,7 @@ Package: krd-linux-kbuild-@abiname@ Meta-Rules-Target: kbuild Build-Profiles: Architecture: linux-any -Depends: ${shlibs:Depends}, ${misc:Depends}, build-essential, pahole +Depends: ${shlibs:Depends}, ${misc:Depends}, ${python3:Depends}, build-essential, pahole Multi-Arch: foreign Description: Kbuild infrastructure for KrD's Linux @abiname@ This package provides the kbuild infrastructure for the headers packages for Linux kernel version @version@.