From: Greg Kroah-Hartman Date: Wed, 21 Feb 2024 11:10:51 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.19.307~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8b67056720f7eafd35cb614765b7e3fd6bec6d39;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: net-bcmgenet-fix-eee-implementation.patch netfilter-nf_tables-fix-pointer-math-issue-in-nft_byteorder_eval.patch revert-revert-mtd-rawnand-gpmi-fix-setting-busy-timeout-setting.patch --- diff --git a/queue-5.4/net-bcmgenet-fix-eee-implementation.patch b/queue-5.4/net-bcmgenet-fix-eee-implementation.patch new file mode 100644 index 00000000000..ae805e27a32 --- /dev/null +++ b/queue-5.4/net-bcmgenet-fix-eee-implementation.patch @@ -0,0 +1,142 @@ +From a9f31047baca57d47440c879cf259b86f900260c Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Tue, 6 Jun 2023 14:43:47 -0700 +Subject: net: bcmgenet: Fix EEE implementation + +From: Florian Fainelli + +commit a9f31047baca57d47440c879cf259b86f900260c upstream. + +We had a number of short comings: + +- EEE must be re-evaluated whenever the state machine detects a link + change as wight be switching from a link partner with EEE + enabled/disabled + +- tx_lpi_enabled controls whether EEE should be enabled/disabled for the + transmit path, which applies to the TBUF block + +- We do not need to forcibly enable EEE upon system resume, as the PHY + state machine will trigger a link event that will do that, too + +Fixes: 6ef398ea60d9 ("net: bcmgenet: add EEE support") +Signed-off-by: Florian Fainelli +Reviewed-by: Russell King (Oracle) +Link: https://lore.kernel.org/r/20230606214348.2408018-1-florian.fainelli@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 22 ++++++++-------------- + drivers/net/ethernet/broadcom/genet/bcmgenet.h | 3 +++ + drivers/net/ethernet/broadcom/genet/bcmmii.c | 6 ++++++ + 3 files changed, 17 insertions(+), 14 deletions(-) + +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -1018,7 +1018,8 @@ static void bcmgenet_get_ethtool_stats(s + } + } + +-static void bcmgenet_eee_enable_set(struct net_device *dev, bool enable) ++void bcmgenet_eee_enable_set(struct net_device *dev, bool enable, ++ bool tx_lpi_enabled) + { + struct bcmgenet_priv *priv = netdev_priv(dev); + u32 off = priv->hw_params->tbuf_offset + TBUF_ENERGY_CTRL; +@@ -1038,7 +1039,7 @@ static void bcmgenet_eee_enable_set(stru + + /* Enable EEE and switch to a 27Mhz clock automatically */ + reg = bcmgenet_readl(priv->base + off); +- if (enable) ++ if (tx_lpi_enabled) + reg |= TBUF_EEE_EN | TBUF_PM_EN; + else + reg &= ~(TBUF_EEE_EN | TBUF_PM_EN); +@@ -1059,6 +1060,7 @@ static void bcmgenet_eee_enable_set(stru + + priv->eee.eee_enabled = enable; + priv->eee.eee_active = enable; ++ priv->eee.tx_lpi_enabled = tx_lpi_enabled; + } + + static int bcmgenet_get_eee(struct net_device *dev, struct ethtool_eee *e) +@@ -1074,6 +1076,7 @@ static int bcmgenet_get_eee(struct net_d + + e->eee_enabled = p->eee_enabled; + e->eee_active = p->eee_active; ++ e->tx_lpi_enabled = p->tx_lpi_enabled; + e->tx_lpi_timer = bcmgenet_umac_readl(priv, UMAC_EEE_LPI_TIMER); + + return phy_ethtool_get_eee(dev->phydev, e); +@@ -1083,7 +1086,6 @@ static int bcmgenet_set_eee(struct net_d + { + struct bcmgenet_priv *priv = netdev_priv(dev); + struct ethtool_eee *p = &priv->eee; +- int ret = 0; + + if (GENET_IS_V1(priv)) + return -EOPNOTSUPP; +@@ -1094,16 +1096,11 @@ static int bcmgenet_set_eee(struct net_d + p->eee_enabled = e->eee_enabled; + + if (!p->eee_enabled) { +- bcmgenet_eee_enable_set(dev, false); ++ bcmgenet_eee_enable_set(dev, false, false); + } else { +- ret = phy_init_eee(dev->phydev, 0); +- if (ret) { +- netif_err(priv, hw, dev, "EEE initialization failed\n"); +- return ret; +- } +- ++ p->eee_active = phy_init_eee(dev->phydev, false) >= 0; + bcmgenet_umac_writel(priv, e->tx_lpi_timer, UMAC_EEE_LPI_TIMER); +- bcmgenet_eee_enable_set(dev, true); ++ bcmgenet_eee_enable_set(dev, p->eee_active, e->tx_lpi_enabled); + } + + return phy_ethtool_set_eee(dev->phydev, e); +@@ -3688,9 +3685,6 @@ static int bcmgenet_resume(struct device + if (!device_may_wakeup(d)) + phy_resume(dev->phydev); + +- if (priv->eee.eee_enabled) +- bcmgenet_eee_enable_set(dev, true); +- + bcmgenet_netif_start(dev); + + netif_device_attach(dev); +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +@@ -736,4 +736,7 @@ int bcmgenet_wol_power_down_cfg(struct b + void bcmgenet_wol_power_up_cfg(struct bcmgenet_priv *priv, + enum bcmgenet_power_mode mode); + ++void bcmgenet_eee_enable_set(struct net_device *dev, bool enable, ++ bool tx_lpi_enabled); ++ + #endif /* __BCMGENET_H__ */ +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -25,6 +25,7 @@ + + #include "bcmgenet.h" + ++ + /* setup netdev link state when PHY link status change and + * update UMAC and RGMII block when link up + */ +@@ -96,6 +97,11 @@ void bcmgenet_mii_setup(struct net_devic + CMD_RX_PAUSE_IGNORE | CMD_TX_PAUSE_IGNORE); + reg |= cmd_bits; + bcmgenet_umac_writel(priv, reg, UMAC_CMD); ++ ++ priv->eee.eee_active = phy_init_eee(phydev, 0) >= 0; ++ bcmgenet_eee_enable_set(dev, ++ priv->eee.eee_enabled && priv->eee.eee_active, ++ priv->eee.tx_lpi_enabled); + } else { + /* done if nothing has changed */ + if (!status_changed) diff --git a/queue-5.4/netfilter-nf_tables-fix-pointer-math-issue-in-nft_byteorder_eval.patch b/queue-5.4/netfilter-nf_tables-fix-pointer-math-issue-in-nft_byteorder_eval.patch new file mode 100644 index 00000000000..fb0f2f730ba --- /dev/null +++ b/queue-5.4/netfilter-nf_tables-fix-pointer-math-issue-in-nft_byteorder_eval.patch @@ -0,0 +1,83 @@ +From c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 3 Nov 2023 09:42:51 +0300 +Subject: netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() + +From: Dan Carpenter + +commit c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 upstream. + +The problem is in nft_byteorder_eval() where we are iterating through a +loop and writing to dst[0], dst[1], dst[2] and so on... On each +iteration we are writing 8 bytes. But dst[] is an array of u32 so each +element only has space for 4 bytes. That means that every iteration +overwrites part of the previous element. + +I spotted this bug while reviewing commit caf3ef7468f7 ("netfilter: +nf_tables: prevent OOB access in nft_byteorder_eval") which is a related +issue. I think that the reason we have not detected this bug in testing +is that most of time we only write one element. + +Fixes: ce1e7989d989 ("netfilter: nft_byteorder: provide 64bit le/be conversion") +Signed-off-by: Dan Carpenter +Signed-off-by: Pablo Neira Ayuso +[Ajay: Modified to apply on v5.4.y] +Signed-off-by: Ajay Kaher +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_tables.h | 4 ++-- + net/netfilter/nft_byteorder.c | 5 +++-- + net/netfilter/nft_meta.c | 2 +- + 3 files changed, 6 insertions(+), 5 deletions(-) + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -130,9 +130,9 @@ static inline u16 nft_reg_load16(u32 *sr + return *(u16 *)sreg; + } + +-static inline void nft_reg_store64(u32 *dreg, u64 val) ++static inline void nft_reg_store64(u64 *dreg, u64 val) + { +- put_unaligned(val, (u64 *)dreg); ++ put_unaligned(val, dreg); + } + + static inline u64 nft_reg_load64(u32 *sreg) +--- a/net/netfilter/nft_byteorder.c ++++ b/net/netfilter/nft_byteorder.c +@@ -38,20 +38,21 @@ void nft_byteorder_eval(const struct nft + + switch (priv->size) { + case 8: { ++ u64 *dst64 = (void *)dst; + u64 src64; + + switch (priv->op) { + case NFT_BYTEORDER_NTOH: + for (i = 0; i < priv->len / 8; i++) { + src64 = nft_reg_load64(&src[i]); +- nft_reg_store64(&dst[i], be64_to_cpu(src64)); ++ nft_reg_store64(&dst64[i], be64_to_cpu(src64)); + } + break; + case NFT_BYTEORDER_HTON: + for (i = 0; i < priv->len / 8; i++) { + src64 = (__force __u64) + cpu_to_be64(nft_reg_load64(&src[i])); +- nft_reg_store64(&dst[i], src64); ++ nft_reg_store64(&dst64[i], src64); + } + break; + } +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -247,7 +247,7 @@ void nft_meta_get_eval(const struct nft_ + strncpy((char *)dest, out->rtnl_link_ops->kind, IFNAMSIZ); + break; + case NFT_META_TIME_NS: +- nft_reg_store64(dest, ktime_get_real_ns()); ++ nft_reg_store64((u64 *)dest, ktime_get_real_ns()); + break; + case NFT_META_TIME_DAY: + nft_reg_store8(dest, nft_meta_weekday(ktime_get_real_seconds())); diff --git a/queue-5.4/revert-revert-mtd-rawnand-gpmi-fix-setting-busy-timeout-setting.patch b/queue-5.4/revert-revert-mtd-rawnand-gpmi-fix-setting-busy-timeout-setting.patch new file mode 100644 index 00000000000..9be6a723439 --- /dev/null +++ b/queue-5.4/revert-revert-mtd-rawnand-gpmi-fix-setting-busy-timeout-setting.patch @@ -0,0 +1,44 @@ +From max.oss.09@gmail.com Wed Feb 21 12:00:21 2024 +From: max.oss.09@gmail.com +Date: Wed, 7 Feb 2024 18:49:11 +0100 +Subject: Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting"" +To: stable@vger.kernel.org +Cc: gregkh@linuxfoundation.org, patches@lists.linux.dev, s.hauer@pengutronix.de, han.xu@nxp.com, tomasz.mon@camlingroup.com, richard@nod.at, tharvey@gateworks.com, linux-mtd@lists.infradead.org, Max Krummenacher +Message-ID: <20240207174911.870822-2-max.oss.09@gmail.com> + +From: Max Krummenacher + +This reverts commit 15a3adfe75937c9e4e0e48f0ed40dd39a0e526e2. + +The backport of [1] relies on having [2] also backported. Having only +one of the two results in a bogus hw->timing1 setting. + +If only [2] is backportet the 16 bit register value likely underflows +resulting in a busy_wait_timeout of 0. +Or if only [1] is applied the value likely overflows with chances of +having last 16 LSBs all 0 which would then result in a +busy_wait_timeout of 0 too. + +Both cases may lead to NAND data corruption, e.g. on a Colibri iMX7 +setup this has been seen. + +[1] commit 0fddf9ad06fd ("mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times") +[2] commit 06781a5026350 ("mtd: rawnand: gpmi: Fix setting busy timeout setting") + +Signed-off-by: Max Krummenacher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -684,7 +684,7 @@ static void gpmi_nfc_compute_timings(str + hw->timing0 = BF_GPMI_TIMING0_ADDRESS_SETUP(addr_setup_cycles) | + BF_GPMI_TIMING0_DATA_HOLD(data_hold_cycles) | + BF_GPMI_TIMING0_DATA_SETUP(data_setup_cycles); +- hw->timing1 = BF_GPMI_TIMING1_BUSY_TIMEOUT(busy_timeout_cycles * 4096); ++ hw->timing1 = BF_GPMI_TIMING1_BUSY_TIMEOUT(DIV_ROUND_UP(busy_timeout_cycles, 4096)); + + /* + * Derive NFC ideal delay from {3}: diff --git a/queue-5.4/series b/queue-5.4/series index dde72e14df6..ae76b84627f 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -260,3 +260,6 @@ pm-runtime-add-devm_pm_runtime_enable-helper.patch pm-runtime-have-devm_pm_runtime_enable-handle-pm_runtime_dont_use_autosuspend.patch drm-msm-dsi-enable-runtime-pm.patch lsm-new-security_file_ioctl_compat-hook.patch +netfilter-nf_tables-fix-pointer-math-issue-in-nft_byteorder_eval.patch +revert-revert-mtd-rawnand-gpmi-fix-setting-busy-timeout-setting.patch +net-bcmgenet-fix-eee-implementation.patch