From 4b778254f5a9105d60a65326c124249d2bef45ad Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 3 Dec 2023 15:07:01 -0500 Subject: [PATCH] Fixes for 6.6 Signed-off-by: Sasha Levin --- ...llocation-hint-for-bpf_mem_cache_all.patch | 40 ++ ...nix-stream-sockets-need-to-hold-ref-.patch | 139 +++++++ ...te-fix-scaling_min_freq-and-scaling_.patch | 208 +++++++++++ ...te-only-print-supported-epp-values-f.patch | 69 ++++ ...n-t-disable-792-mhz-opp-unnecessaril.patch | 49 +++ ...se-the-needed-headroom-to-account-fo.patch | 85 +++++ ...e-the-rx-buffer-only-after-all-proce.patch | 70 ++++ ...d-display-refactor-edp-power-control.patch | 259 +++++++++++++ ...isplay-remove-power-sequencing-check.patch | 46 +++ ...x-a-memleak-in-aldebaran_tables_init.patch | 40 ++ ...tel_pre_plane_updates-also-for-pipes.patch | 49 +++ ...k-internal-gsc-engine-with-reserved-.patch | 119 ++++++ ...3-fix-return-value-check-in-nt36523_.patch | 43 +++ ...-2081101qfh032011-53g-fine-tune-the-.patch | 40 ++ ...ix-off-by-one-when-checking-for-over.patch | 45 +++ ...on-t-propagate-eopnotsupp-from-dumps.patch | 42 +++ ...-paths-when-interface-in-a-failed-ov.patch | 341 ++++++++++++++++++ ...ntk-arg-in-of_iommu_get_resv_regions.patch | 40 ++ ...le-pci-ats-in-legacy-passthrough-mod.patch | 50 +++ ...context-clearing-consistent-with-con.patch | 46 +++ ...devtlb-invalidation-requests-when-te.patch | 69 ++++ ...fcnt-uaf-issue-when-receiving-igmp-q.patch | 114 ++++++ .../media-v4l2-subdev-fix-a-64bit-bug.patch | 46 +++ ...randomize_layout-crash-in-struct-nei.patch | 50 +++ ...88e6xxx-fix-marvell-6350-probe-crash.patch | 77 ++++ ...6xxx-fix-marvell-6350-switch-probing.patch | 99 +++++ ...eturn-value-of-reset_control_deasser.patch | 60 +++ ...verse-order-of-operations-in-ravb_re.patch | 141 ++++++++ ...ite-access-to-cxr35-first-before-acc.patch | 81 +++++ ...x-queues-after-hw-initialization-suc.patch | 46 +++ ...dma-in-case-of-failures-on-ravb_open.patch | 37 ++ ...t-ravb-use-pm_runtime_resume_and_get.patch | 48 +++ ...missing-dev_kfree_skb_any-in-error-p.patch | 69 ++++ ...x-return-value-in-rswitch_start_xmit.patch | 37 ++ ...ix-type-of-ret-in-rswitch_start_xmit.patch | 38 ++ ...mac-xgmac-disable-fpe-mmc-interrupts.patch | 54 +++ ...m-don-t-accept-device-bound-programs.patch | 55 +++ ...ntx2-af-fix-possible-buffer-overflow.patch | 55 +++ ...-adding-mbox-work-queue-entry-when-n.patch | 51 +++ ...tore-tc-ingress-police-rules-when-in.patch | 263 ++++++++++++++ ...trl-stm32-add-check-for-devm_kcalloc.patch | 41 +++ ...rl-stm32-fix-array-read-out-of-bound.patch | 46 +++ ...iommu-enable_ddw-incorrectly-returns.patch | 74 ++++ ...-potential-deadlock-in-rtl8169_close.patch | 51 +++ ...etween-ravb_tx_timeout_work-and-net-.patch | 79 ++++ ...ndling-of-swapper_pg_dir-and-invalid.patch | 50 +++ ...ests-net-fix-a-char-signedness-issue.patch | 50 +++ ...-net-ipsec-fix-constant-out-of-range.patch | 56 +++ ...tcp-fix-uninitialized-variable-warni.patch | 110 ++++++ ...ix-fix-unused-variable-compiler-warn.patch | 39 ++ queue-6.6/series | 53 +++ ..._struct_group-attributes-to-the-cont.patch | 79 ++++ ...-fix-an-error-code-in-iwl_mvm_mld_ad.patch | 40 ++ ...-not-pass-ap_vlan-vif-pointer-to-dri.patch | 71 ++++ 54 files changed, 4149 insertions(+) create mode 100644 queue-6.6/bpf-add-missed-allocation-hint-for-bpf_mem_cache_all.patch create mode 100644 queue-6.6/bpf-sockmap-af_unix-stream-sockets-need-to-hold-ref-.patch create mode 100644 queue-6.6/cpufreq-amd-pstate-fix-scaling_min_freq-and-scaling_.patch create mode 100644 queue-6.6/cpufreq-amd-pstate-only-print-supported-epp-values-f.patch create mode 100644 queue-6.6/cpufreq-imx6q-don-t-disable-792-mhz-opp-unnecessaril.patch create mode 100644 queue-6.6/dpaa2-eth-increase-the-needed-headroom-to-account-fo.patch create mode 100644 queue-6.6/dpaa2-eth-recycle-the-rx-buffer-only-after-all-proce.patch create mode 100644 queue-6.6/drm-amd-display-refactor-edp-power-control.patch create mode 100644 queue-6.6/drm-amd-display-remove-power-sequencing-check.patch create mode 100644 queue-6.6/drm-amd-pm-fix-a-memleak-in-aldebaran_tables_init.patch create mode 100644 queue-6.6/drm-i915-call-intel_pre_plane_updates-also-for-pipes.patch create mode 100644 queue-6.6/drm-i915-gsc-mark-internal-gsc-engine-with-reserved-.patch create mode 100644 queue-6.6/drm-panel-nt36523-fix-return-value-check-in-nt36523_.patch create mode 100644 queue-6.6/drm-panel-starry-2081101qfh032011-53g-fine-tune-the-.patch create mode 100644 queue-6.6/efi-unaccepted-fix-off-by-one-when-checking-for-over.patch create mode 100644 queue-6.6/ethtool-don-t-propagate-eopnotsupp-from-dumps.patch create mode 100644 queue-6.6/ice-fix-vf-reset-paths-when-interface-in-a-failed-ov.patch create mode 100644 queue-6.6/iommu-fix-printk-arg-in-of_iommu_get_resv_regions.patch create mode 100644 queue-6.6/iommu-vt-d-disable-pci-ats-in-legacy-passthrough-mod.patch create mode 100644 queue-6.6/iommu-vt-d-make-context-clearing-consistent-with-con.patch create mode 100644 queue-6.6/iommu-vt-d-omit-devtlb-invalidation-requests-when-te.patch create mode 100644 queue-6.6/ipv4-igmp-fix-refcnt-uaf-issue-when-receiving-igmp-q.patch create mode 100644 queue-6.6/media-v4l2-subdev-fix-a-64bit-bug.patch create mode 100644 queue-6.6/neighbour-fix-__randomize_layout-crash-in-struct-nei.patch create mode 100644 queue-6.6/net-dsa-mv88e6xxx-fix-marvell-6350-probe-crash.patch create mode 100644 queue-6.6/net-dsa-mv88e6xxx-fix-marvell-6350-switch-probing.patch create mode 100644 queue-6.6/net-ravb-check-return-value-of-reset_control_deasser.patch create mode 100644 queue-6.6/net-ravb-keep-reverse-order-of-operations-in-ravb_re.patch create mode 100644 queue-6.6/net-ravb-make-write-access-to-cxr35-first-before-acc.patch create mode 100644 queue-6.6/net-ravb-start-tx-queues-after-hw-initialization-suc.patch create mode 100644 queue-6.6/net-ravb-stop-dma-in-case-of-failures-on-ravb_open.patch create mode 100644 queue-6.6/net-ravb-use-pm_runtime_resume_and_get.patch create mode 100644 queue-6.6/net-rswitch-fix-missing-dev_kfree_skb_any-in-error-p.patch create mode 100644 queue-6.6/net-rswitch-fix-return-value-in-rswitch_start_xmit.patch create mode 100644 queue-6.6/net-rswitch-fix-type-of-ret-in-rswitch_start_xmit.patch create mode 100644 queue-6.6/net-stmmac-xgmac-disable-fpe-mmc-interrupts.patch create mode 100644 queue-6.6/netdevsim-don-t-accept-device-bound-programs.patch create mode 100644 queue-6.6/octeontx2-af-fix-possible-buffer-overflow.patch create mode 100644 queue-6.6/octeontx2-pf-fix-adding-mbox-work-queue-entry-when-n.patch create mode 100644 queue-6.6/octeontx2-pf-restore-tc-ingress-police-rules-when-in.patch create mode 100644 queue-6.6/pinctrl-stm32-add-check-for-devm_kcalloc.patch create mode 100644 queue-6.6/pinctrl-stm32-fix-array-read-out-of-bound.patch create mode 100644 queue-6.6/powerpc-pseries-iommu-enable_ddw-incorrectly-returns.patch create mode 100644 queue-6.6/r8169-prevent-potential-deadlock-in-rtl8169_close.patch create mode 100644 queue-6.6/ravb-fix-races-between-ravb_tx_timeout_work-and-net-.patch create mode 100644 queue-6.6/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid.patch create mode 100644 queue-6.6/selftests-net-fix-a-char-signedness-issue.patch create mode 100644 queue-6.6/selftests-net-ipsec-fix-constant-out-of-range.patch create mode 100644 queue-6.6/selftests-net-mptcp-fix-uninitialized-variable-warni.patch create mode 100644 queue-6.6/selftests-net-unix-fix-unused-variable-compiler-warn.patch create mode 100644 queue-6.6/uapi-propagate-__struct_group-attributes-to-the-cont.patch create mode 100644 queue-6.6/wifi-iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_mld_ad.patch create mode 100644 queue-6.6/wifi-mac80211-do-not-pass-ap_vlan-vif-pointer-to-dri.patch diff --git a/queue-6.6/bpf-add-missed-allocation-hint-for-bpf_mem_cache_all.patch b/queue-6.6/bpf-add-missed-allocation-hint-for-bpf_mem_cache_all.patch new file mode 100644 index 00000000000..bea7750b9bb --- /dev/null +++ b/queue-6.6/bpf-add-missed-allocation-hint-for-bpf_mem_cache_all.patch @@ -0,0 +1,40 @@ +From 171ecabddb1b78ea242bb66a1bcbd2900df067a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Nov 2023 12:38:21 +0800 +Subject: bpf: Add missed allocation hint for bpf_mem_cache_alloc_flags() + +From: Hou Tao + +[ Upstream commit 75a442581d05edaee168222ffbe00d4389785636 ] + +bpf_mem_cache_alloc_flags() may call __alloc() directly when there is no +free object in free list, but it doesn't initialize the allocation hint +for the returned pointer. It may lead to bad memory dereference when +freeing the pointer, so fix it by initializing the allocation hint. + +Fixes: 822fb26bdb55 ("bpf: Add a hint to allocated objects.") +Signed-off-by: Hou Tao +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20231111043821.2258513-1-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/memalloc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c +index d93ddac283d40..956f80ee6f5c5 100644 +--- a/kernel/bpf/memalloc.c ++++ b/kernel/bpf/memalloc.c +@@ -958,6 +958,8 @@ void notrace *bpf_mem_cache_alloc_flags(struct bpf_mem_alloc *ma, gfp_t flags) + memcg = get_memcg(c); + old_memcg = set_active_memcg(memcg); + ret = __alloc(c, NUMA_NO_NODE, GFP_KERNEL | __GFP_NOWARN | __GFP_ACCOUNT); ++ if (ret) ++ *(struct bpf_mem_cache **)ret = c; + set_active_memcg(old_memcg); + mem_cgroup_put(memcg); + } +-- +2.42.0 + diff --git a/queue-6.6/bpf-sockmap-af_unix-stream-sockets-need-to-hold-ref-.patch b/queue-6.6/bpf-sockmap-af_unix-stream-sockets-need-to-hold-ref-.patch new file mode 100644 index 00000000000..563bbbcbe82 --- /dev/null +++ b/queue-6.6/bpf-sockmap-af_unix-stream-sockets-need-to-hold-ref-.patch @@ -0,0 +1,139 @@ +From 709716e910f9ea287287e1d76c53e9283f0ac7c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 17:25:56 -0800 +Subject: bpf, sockmap: af_unix stream sockets need to hold ref for pair sock + +From: John Fastabend + +[ Upstream commit 8866730aed5100f06d3d965c22f1c61f74942541 ] + +AF_UNIX stream sockets are a paired socket. So sending on one of the pairs +will lookup the paired socket as part of the send operation. It is possible +however to put just one of the pairs in a BPF map. This currently increments +the refcnt on the sock in the sockmap to ensure it is not free'd by the +stack before sockmap cleans up its state and stops any skbs being sent/recv'd +to that socket. + +But we missed a case. If the peer socket is closed it will be free'd by the +stack. However, the paired socket can still be referenced from BPF sockmap +side because we hold a reference there. Then if we are sending traffic through +BPF sockmap to that socket it will try to dereference the free'd pair in its +send logic creating a use after free. And following splat: + + [59.900375] BUG: KASAN: slab-use-after-free in sk_wake_async+0x31/0x1b0 + [59.901211] Read of size 8 at addr ffff88811acbf060 by task kworker/1:2/954 + [...] + [59.905468] Call Trace: + [59.905787] + [59.906066] dump_stack_lvl+0x130/0x1d0 + [59.908877] print_report+0x16f/0x740 + [59.910629] kasan_report+0x118/0x160 + [59.912576] sk_wake_async+0x31/0x1b0 + [59.913554] sock_def_readable+0x156/0x2a0 + [59.914060] unix_stream_sendmsg+0x3f9/0x12a0 + [59.916398] sock_sendmsg+0x20e/0x250 + [59.916854] skb_send_sock+0x236/0xac0 + [59.920527] sk_psock_backlog+0x287/0xaa0 + +To fix let BPF sockmap hold a refcnt on both the socket in the sockmap and its +paired socket. It wasn't obvious how to contain the fix to bpf_unix logic. The +primarily problem with keeping this logic in bpf_unix was: In the sock close() +we could handle the deref by having a close handler. But, when we are destroying +the psock through a map delete operation we wouldn't have gotten any signal +thorugh the proto struct other than it being replaced. If we do the deref from +the proto replace its too early because we need to deref the sk_pair after the +backlog worker has been stopped. + +Given all this it seems best to just cache it at the end of the psock and eat 8B +for the af_unix and vsock users. Notice dgram sockets are OK because they handle +locking already. + +Fixes: 94531cfcbe79 ("af_unix: Add unix_stream_proto for sockmap") +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/20231129012557.95371-2-john.fastabend@gmail.com +Signed-off-by: Sasha Levin +--- + include/linux/skmsg.h | 1 + + include/net/af_unix.h | 1 + + net/core/skmsg.c | 2 ++ + net/unix/af_unix.c | 2 -- + net/unix/unix_bpf.c | 5 +++++ + 5 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h +index c1637515a8a41..c953b8c0d2f43 100644 +--- a/include/linux/skmsg.h ++++ b/include/linux/skmsg.h +@@ -106,6 +106,7 @@ struct sk_psock { + struct mutex work_mutex; + struct sk_psock_work_state work_state; + struct delayed_work work; ++ struct sock *sk_pair; + struct rcu_work rwork; + }; + +diff --git a/include/net/af_unix.h b/include/net/af_unix.h +index 824c258143a3a..49c4640027d8a 100644 +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -75,6 +75,7 @@ struct unix_sock { + }; + + #define unix_sk(ptr) container_of_const(ptr, struct unix_sock, sk) ++#define unix_peer(sk) (unix_sk(sk)->peer) + + #define peer_wait peer_wq.wait + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 6c31eefbd7778..93ecfceac1bc4 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -826,6 +826,8 @@ static void sk_psock_destroy(struct work_struct *work) + + if (psock->sk_redir) + sock_put(psock->sk_redir); ++ if (psock->sk_pair) ++ sock_put(psock->sk_pair); + sock_put(psock->sk); + kfree(psock); + } +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 3e6eeacb13aec..1e1a88bd4e688 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -212,8 +212,6 @@ static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb) + } + #endif /* CONFIG_SECURITY_NETWORK */ + +-#define unix_peer(sk) (unix_sk(sk)->peer) +- + static inline int unix_our_peer(struct sock *sk, struct sock *osk) + { + return unix_peer(osk) == sk; +diff --git a/net/unix/unix_bpf.c b/net/unix/unix_bpf.c +index 2f9d8271c6ec7..7ea7c3a0d0d06 100644 +--- a/net/unix/unix_bpf.c ++++ b/net/unix/unix_bpf.c +@@ -159,12 +159,17 @@ int unix_dgram_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool re + + int unix_stream_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore) + { ++ struct sock *sk_pair; ++ + if (restore) { + sk->sk_write_space = psock->saved_write_space; + sock_replace_proto(sk, psock->sk_proto); + return 0; + } + ++ sk_pair = unix_peer(sk); ++ sock_hold(sk_pair); ++ psock->sk_pair = sk_pair; + unix_stream_bpf_check_needs_rebuild(psock->sk_proto); + sock_replace_proto(sk, &unix_stream_bpf_prot); + return 0; +-- +2.42.0 + diff --git a/queue-6.6/cpufreq-amd-pstate-fix-scaling_min_freq-and-scaling_.patch b/queue-6.6/cpufreq-amd-pstate-fix-scaling_min_freq-and-scaling_.patch new file mode 100644 index 00000000000..f9307575c36 --- /dev/null +++ b/queue-6.6/cpufreq-amd-pstate-fix-scaling_min_freq-and-scaling_.patch @@ -0,0 +1,208 @@ +From 3f8b25966347f5da329d763a15004584c8ff7110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 06:38:39 +0000 +Subject: cpufreq/amd-pstate: Fix scaling_min_freq and scaling_max_freq update + +From: Wyes Karny + +[ Upstream commit febab20caebac959fdc3d7520bc52de8b1184455 ] + +When amd_pstate is running, writing to scaling_min_freq and +scaling_max_freq has no effect. These values are only passed to the +policy level, but not to the platform level. This means that the +platform does not know about the frequency limits set by the user. + +To fix this, update the min_perf and max_perf values at the platform +level whenever the user changes the scaling_min_freq and scaling_max_freq +values. + +Fixes: ffa5096a7c33 ("cpufreq: amd-pstate: implement Pstate EPP support for the AMD processors") +Acked-by: Huang Rui +Signed-off-by: Wyes Karny +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd-pstate.c | 60 ++++++++++++++++++++++++++++-------- + include/linux/amd-pstate.h | 4 +++ + 2 files changed, 51 insertions(+), 13 deletions(-) + +diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c +index 300f81d36291b..3313d1d2c6ddf 100644 +--- a/drivers/cpufreq/amd-pstate.c ++++ b/drivers/cpufreq/amd-pstate.c +@@ -307,11 +307,11 @@ static int pstate_init_perf(struct amd_cpudata *cpudata) + highest_perf = AMD_CPPC_HIGHEST_PERF(cap1); + + WRITE_ONCE(cpudata->highest_perf, highest_perf); +- ++ WRITE_ONCE(cpudata->max_limit_perf, highest_perf); + WRITE_ONCE(cpudata->nominal_perf, AMD_CPPC_NOMINAL_PERF(cap1)); + WRITE_ONCE(cpudata->lowest_nonlinear_perf, AMD_CPPC_LOWNONLIN_PERF(cap1)); + WRITE_ONCE(cpudata->lowest_perf, AMD_CPPC_LOWEST_PERF(cap1)); +- ++ WRITE_ONCE(cpudata->min_limit_perf, AMD_CPPC_LOWEST_PERF(cap1)); + return 0; + } + +@@ -329,11 +329,12 @@ static int cppc_init_perf(struct amd_cpudata *cpudata) + highest_perf = cppc_perf.highest_perf; + + WRITE_ONCE(cpudata->highest_perf, highest_perf); +- ++ WRITE_ONCE(cpudata->max_limit_perf, highest_perf); + WRITE_ONCE(cpudata->nominal_perf, cppc_perf.nominal_perf); + WRITE_ONCE(cpudata->lowest_nonlinear_perf, + cppc_perf.lowest_nonlinear_perf); + WRITE_ONCE(cpudata->lowest_perf, cppc_perf.lowest_perf); ++ WRITE_ONCE(cpudata->min_limit_perf, cppc_perf.lowest_perf); + + if (cppc_state == AMD_PSTATE_ACTIVE) + return 0; +@@ -432,6 +433,10 @@ static void amd_pstate_update(struct amd_cpudata *cpudata, u32 min_perf, + u64 prev = READ_ONCE(cpudata->cppc_req_cached); + u64 value = prev; + ++ min_perf = clamp_t(unsigned long, min_perf, cpudata->min_limit_perf, ++ cpudata->max_limit_perf); ++ max_perf = clamp_t(unsigned long, max_perf, cpudata->min_limit_perf, ++ cpudata->max_limit_perf); + des_perf = clamp_t(unsigned long, des_perf, min_perf, max_perf); + + if ((cppc_state == AMD_PSTATE_GUIDED) && (gov_flags & CPUFREQ_GOV_DYNAMIC_SWITCHING)) { +@@ -470,6 +475,22 @@ static int amd_pstate_verify(struct cpufreq_policy_data *policy) + return 0; + } + ++static int amd_pstate_update_min_max_limit(struct cpufreq_policy *policy) ++{ ++ u32 max_limit_perf, min_limit_perf; ++ struct amd_cpudata *cpudata = policy->driver_data; ++ ++ max_limit_perf = div_u64(policy->max * cpudata->highest_perf, cpudata->max_freq); ++ min_limit_perf = div_u64(policy->min * cpudata->highest_perf, cpudata->max_freq); ++ ++ WRITE_ONCE(cpudata->max_limit_perf, max_limit_perf); ++ WRITE_ONCE(cpudata->min_limit_perf, min_limit_perf); ++ WRITE_ONCE(cpudata->max_limit_freq, policy->max); ++ WRITE_ONCE(cpudata->min_limit_freq, policy->min); ++ ++ return 0; ++} ++ + static int amd_pstate_update_freq(struct cpufreq_policy *policy, + unsigned int target_freq, bool fast_switch) + { +@@ -480,6 +501,9 @@ static int amd_pstate_update_freq(struct cpufreq_policy *policy, + if (!cpudata->max_freq) + return -ENODEV; + ++ if (policy->min != cpudata->min_limit_freq || policy->max != cpudata->max_limit_freq) ++ amd_pstate_update_min_max_limit(policy); ++ + cap_perf = READ_ONCE(cpudata->highest_perf); + min_perf = READ_ONCE(cpudata->lowest_perf); + max_perf = cap_perf; +@@ -534,6 +558,10 @@ static void amd_pstate_adjust_perf(unsigned int cpu, + struct amd_cpudata *cpudata = policy->driver_data; + unsigned int target_freq; + ++ if (policy->min != cpudata->min_limit_freq || policy->max != cpudata->max_limit_freq) ++ amd_pstate_update_min_max_limit(policy); ++ ++ + cap_perf = READ_ONCE(cpudata->highest_perf); + lowest_nonlinear_perf = READ_ONCE(cpudata->lowest_nonlinear_perf); + max_freq = READ_ONCE(cpudata->max_freq); +@@ -747,6 +775,8 @@ static int amd_pstate_cpu_init(struct cpufreq_policy *policy) + /* Initial processor data capability frequencies */ + cpudata->max_freq = max_freq; + cpudata->min_freq = min_freq; ++ cpudata->max_limit_freq = max_freq; ++ cpudata->min_limit_freq = min_freq; + cpudata->nominal_freq = nominal_freq; + cpudata->lowest_nonlinear_freq = lowest_nonlinear_freq; + +@@ -1185,16 +1215,25 @@ static int amd_pstate_epp_cpu_exit(struct cpufreq_policy *policy) + return 0; + } + +-static void amd_pstate_epp_init(unsigned int cpu) ++static void amd_pstate_epp_update_limit(struct cpufreq_policy *policy) + { +- struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); + struct amd_cpudata *cpudata = policy->driver_data; +- u32 max_perf, min_perf; ++ u32 max_perf, min_perf, min_limit_perf, max_limit_perf; + u64 value; + s16 epp; + + max_perf = READ_ONCE(cpudata->highest_perf); + min_perf = READ_ONCE(cpudata->lowest_perf); ++ max_limit_perf = div_u64(policy->max * cpudata->highest_perf, cpudata->max_freq); ++ min_limit_perf = div_u64(policy->min * cpudata->highest_perf, cpudata->max_freq); ++ ++ max_perf = clamp_t(unsigned long, max_perf, cpudata->min_limit_perf, ++ cpudata->max_limit_perf); ++ min_perf = clamp_t(unsigned long, min_perf, cpudata->min_limit_perf, ++ cpudata->max_limit_perf); ++ ++ WRITE_ONCE(cpudata->max_limit_perf, max_limit_perf); ++ WRITE_ONCE(cpudata->min_limit_perf, min_limit_perf); + + value = READ_ONCE(cpudata->cppc_req_cached); + +@@ -1212,9 +1251,6 @@ static void amd_pstate_epp_init(unsigned int cpu) + value &= ~AMD_CPPC_DES_PERF(~0L); + value |= AMD_CPPC_DES_PERF(0); + +- if (cpudata->epp_policy == cpudata->policy) +- goto skip_epp; +- + cpudata->epp_policy = cpudata->policy; + + /* Get BIOS pre-defined epp value */ +@@ -1224,7 +1260,7 @@ static void amd_pstate_epp_init(unsigned int cpu) + * This return value can only be negative for shared_memory + * systems where EPP register read/write not supported. + */ +- goto skip_epp; ++ return; + } + + if (cpudata->policy == CPUFREQ_POLICY_PERFORMANCE) +@@ -1238,8 +1274,6 @@ static void amd_pstate_epp_init(unsigned int cpu) + + WRITE_ONCE(cpudata->cppc_req_cached, value); + amd_pstate_set_epp(cpudata, epp); +-skip_epp: +- cpufreq_cpu_put(policy); + } + + static int amd_pstate_epp_set_policy(struct cpufreq_policy *policy) +@@ -1254,7 +1288,7 @@ static int amd_pstate_epp_set_policy(struct cpufreq_policy *policy) + + cpudata->policy = policy->policy; + +- amd_pstate_epp_init(policy->cpu); ++ amd_pstate_epp_update_limit(policy); + + return 0; + } +diff --git a/include/linux/amd-pstate.h b/include/linux/amd-pstate.h +index 446394f846064..6ad02ad9c7b42 100644 +--- a/include/linux/amd-pstate.h ++++ b/include/linux/amd-pstate.h +@@ -70,6 +70,10 @@ struct amd_cpudata { + u32 nominal_perf; + u32 lowest_nonlinear_perf; + u32 lowest_perf; ++ u32 min_limit_perf; ++ u32 max_limit_perf; ++ u32 min_limit_freq; ++ u32 max_limit_freq; + + u32 max_freq; + u32 min_freq; +-- +2.42.0 + diff --git a/queue-6.6/cpufreq-amd-pstate-only-print-supported-epp-values-f.patch b/queue-6.6/cpufreq-amd-pstate-only-print-supported-epp-values-f.patch new file mode 100644 index 00000000000..23f30275d3f --- /dev/null +++ b/queue-6.6/cpufreq-amd-pstate-only-print-supported-epp-values-f.patch @@ -0,0 +1,69 @@ +From 5e3fe7e05d8caaf53030009a329098baabf6a6f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 15:18:15 +0530 +Subject: cpufreq/amd-pstate: Only print supported EPP values for performance + governor + +From: Ayush Jain + +[ Upstream commit 142c169b31beb364ef39385b4e88735bd51d37fe ] + +show_energy_performance_available_preferences() to show only supported +values which is performance in performance governor policy. + +-------Before-------- +$ cat /sys/devices/system/cpu/cpu1/cpufreq/scaling_driver +amd-pstate-epp +$ cat /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor +performance +$ cat /sys/devices/system/cpu/cpu1/cpufreq/energy_performance_preference +performance +$ cat /sys/devices/system/cpu/cpu1/cpufreq/energy_performance_available_preferences +default performance balance_performance balance_power power + +-------After-------- +$ cat /sys/devices/system/cpu/cpu1/cpufreq/scaling_driver +amd-pstate-epp +$ cat /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor +performance +$ cat /sys/devices/system/cpu/cpu1/cpufreq/energy_performance_preference +performance +$ cat /sys/devices/system/cpu/cpu1/cpufreq/energy_performance_available_preferences +performance + +Fixes: ffa5096a7c33 ("cpufreq: amd-pstate: implement Pstate EPP support for the AMD processors") +Suggested-by: Wyes Karny +Signed-off-by: Ayush Jain +Reviewed-by: Wyes Karny +Acked-by: Huang Rui +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd-pstate.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c +index 3313d1d2c6ddf..1f6186475715e 100644 +--- a/drivers/cpufreq/amd-pstate.c ++++ b/drivers/cpufreq/amd-pstate.c +@@ -882,11 +882,16 @@ static ssize_t show_energy_performance_available_preferences( + { + int i = 0; + int offset = 0; ++ struct amd_cpudata *cpudata = policy->driver_data; ++ ++ if (cpudata->policy == CPUFREQ_POLICY_PERFORMANCE) ++ return sysfs_emit_at(buf, offset, "%s\n", ++ energy_perf_strings[EPP_INDEX_PERFORMANCE]); + + while (energy_perf_strings[i] != NULL) + offset += sysfs_emit_at(buf, offset, "%s ", energy_perf_strings[i++]); + +- sysfs_emit_at(buf, offset, "\n"); ++ offset += sysfs_emit_at(buf, offset, "\n"); + + return offset; + } +-- +2.42.0 + diff --git a/queue-6.6/cpufreq-imx6q-don-t-disable-792-mhz-opp-unnecessaril.patch b/queue-6.6/cpufreq-imx6q-don-t-disable-792-mhz-opp-unnecessaril.patch new file mode 100644 index 00000000000..dd9e04e99cc --- /dev/null +++ b/queue-6.6/cpufreq-imx6q-don-t-disable-792-mhz-opp-unnecessaril.patch @@ -0,0 +1,49 @@ +From 80d2b0e8baa5d1ac363e85591d3f9dda91bea24f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 14:41:13 +0100 +Subject: cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily + +From: Christoph Niedermaier + +[ Upstream commit 2e4e0984c7d696cc74cf2fd7e7f62997f0e9ebe6 ] + +For a 900MHz i.MX6ULL CPU the 792MHz OPP is disabled. There is no +convincing reason to disable this OPP. If a CPU can run at 900MHz, +it should also be able to cope with 792MHz. Looking at the voltage +level of 792MHz in [1] (page 24, table 10. "Operating Ranges") the +current defined OPP is above the minimum. So the voltage level +shouldn't be a problem. However in [2] (page 24, table 10. +"Operating Ranges"), it is not mentioned that 792MHz OPP isn't +allowed. Change it to only disable 792MHz OPP for i.MX6ULL types +below 792 MHz. + +[1] https://www.nxp.com/docs/en/data-sheet/IMX6ULLIEC.pdf +[2] https://www.nxp.com/docs/en/data-sheet/IMX6ULLCEC.pdf + +Fixes: 0aa9abd4c212 ("cpufreq: imx6q: check speed grades for i.MX6ULL") +Signed-off-by: Christoph Niedermaier +Reviewed-by: Marek Vasut +Reviewed-by: Fabio Estevam +[ Viresh: Edited subject ] +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/imx6q-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c +index 494d044b9e720..33728c242f66c 100644 +--- a/drivers/cpufreq/imx6q-cpufreq.c ++++ b/drivers/cpufreq/imx6q-cpufreq.c +@@ -327,7 +327,7 @@ static int imx6ul_opp_check_speed_grading(struct device *dev) + imx6x_disable_freq_in_opp(dev, 696000000); + + if (of_machine_is_compatible("fsl,imx6ull")) { +- if (val != OCOTP_CFG3_6ULL_SPEED_792MHZ) ++ if (val < OCOTP_CFG3_6ULL_SPEED_792MHZ) + imx6x_disable_freq_in_opp(dev, 792000000); + + if (val != OCOTP_CFG3_6ULL_SPEED_900MHZ) +-- +2.42.0 + diff --git a/queue-6.6/dpaa2-eth-increase-the-needed-headroom-to-account-fo.patch b/queue-6.6/dpaa2-eth-increase-the-needed-headroom-to-account-fo.patch new file mode 100644 index 00000000000..e6c6479ae79 --- /dev/null +++ b/queue-6.6/dpaa2-eth-increase-the-needed-headroom-to-account-fo.patch @@ -0,0 +1,85 @@ +From d0809da00216c4d3caf1aba2827d55275eff9431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:28:04 +0200 +Subject: dpaa2-eth: increase the needed headroom to account for alignment + +From: Ioana Ciornei + +[ Upstream commit f422abe3f23d483cf01f386819f26fb3fe0dbb2b ] + +Increase the needed headroom to account for a 64 byte alignment +restriction which, with this patch, we make mandatory on the Tx path. +The case in which the amount of headroom needed is not available is +already handled by the driver which instead sends a S/G frame with the +first buffer only holding the SW and HW annotation areas. + +Without this patch, we can empirically see data corruption happening +between Tx and Tx confirmation which sometimes leads to the SW +annotation area being overwritten. + +Since this is an old IP where the hardware team cannot help to +understand the underlying behavior, we make the Tx alignment mandatory +for all frames to avoid the crash on Tx conf. Also, remove the comment +that suggested that this is just an optimization. + +This patch also sets the needed_headroom net device field to the usual +value that the driver would need on the Tx path: + - 64 bytes for the software annotation area + - 64 bytes to account for a 64 byte aligned buffer address + +Fixes: 6e2387e8f19e ("staging: fsl-dpaa2/eth: Add Freescale DPAA2 Ethernet driver") +Closes: https://lore.kernel.org/netdev/aa784d0c-85eb-4e5d-968b-c8f74fa86be6@gin.de/ +Signed-off-by: Ioana Ciornei +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 ++++---- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 15bab41cee48d..774377db0b4bd 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -1073,14 +1073,12 @@ static int dpaa2_eth_build_single_fd(struct dpaa2_eth_priv *priv, + dma_addr_t addr; + + buffer_start = skb->data - dpaa2_eth_needed_headroom(skb); +- +- /* If there's enough room to align the FD address, do it. +- * It will help hardware optimize accesses. +- */ + aligned_start = PTR_ALIGN(buffer_start - DPAA2_ETH_TX_BUF_ALIGN, + DPAA2_ETH_TX_BUF_ALIGN); + if (aligned_start >= skb->head) + buffer_start = aligned_start; ++ else ++ return -ENOMEM; + + /* Store a backpointer to the skb at the beginning of the buffer + * (in the private data area) such that we can release it +@@ -4967,6 +4965,8 @@ static int dpaa2_eth_probe(struct fsl_mc_device *dpni_dev) + if (err) + goto err_dl_port_add; + ++ net_dev->needed_headroom = DPAA2_ETH_SWA_SIZE + DPAA2_ETH_TX_BUF_ALIGN; ++ + err = register_netdev(net_dev); + if (err < 0) { + dev_err(dev, "register_netdev() failed\n"); +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h +index bfb6c96c3b2f0..834cba8c3a416 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h +@@ -740,7 +740,7 @@ static inline bool dpaa2_eth_rx_pause_enabled(u64 link_options) + + static inline unsigned int dpaa2_eth_needed_headroom(struct sk_buff *skb) + { +- unsigned int headroom = DPAA2_ETH_SWA_SIZE; ++ unsigned int headroom = DPAA2_ETH_SWA_SIZE + DPAA2_ETH_TX_BUF_ALIGN; + + /* If we don't have an skb (e.g. XDP buffer), we only need space for + * the software annotation area +-- +2.42.0 + diff --git a/queue-6.6/dpaa2-eth-recycle-the-rx-buffer-only-after-all-proce.patch b/queue-6.6/dpaa2-eth-recycle-the-rx-buffer-only-after-all-proce.patch new file mode 100644 index 00000000000..8f015f11412 --- /dev/null +++ b/queue-6.6/dpaa2-eth-recycle-the-rx-buffer-only-after-all-proce.patch @@ -0,0 +1,70 @@ +From 2cba3ae7902d9b746acec5e557166f7b578b0728 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:28:05 +0200 +Subject: dpaa2-eth: recycle the RX buffer only after all processing done + +From: Ioana Ciornei + +[ Upstream commit beb1930f966d1517921488bd5d64147f58f79abf ] + +The blamed commit added support for Rx copybreak. This meant that for +certain frame sizes, a new skb was allocated and the initial data buffer +was recycled. Instead of waiting to recycle the Rx buffer only after all +processing was done on it (like accessing the parse results or timestamp +information), the code path just went ahead and re-used the buffer right +away. + +This sometimes lead to corrupted HW and SW annotation areas. +Fix this by delaying the moment when the buffer is recycled. + +Fixes: 50f826999a80 ("dpaa2-eth: add rx copybreak support") +Signed-off-by: Ioana Ciornei +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 774377db0b4bd..888509cf1f210 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -516,8 +516,6 @@ struct sk_buff *dpaa2_eth_alloc_skb(struct dpaa2_eth_priv *priv, + + memcpy(skb->data, fd_vaddr + fd_offset, fd_length); + +- dpaa2_eth_recycle_buf(priv, ch, dpaa2_fd_get_addr(fd)); +- + return skb; + } + +@@ -589,6 +587,7 @@ void dpaa2_eth_rx(struct dpaa2_eth_priv *priv, + struct rtnl_link_stats64 *percpu_stats; + struct dpaa2_eth_drv_stats *percpu_extras; + struct device *dev = priv->net_dev->dev.parent; ++ bool recycle_rx_buf = false; + void *buf_data; + u32 xdp_act; + +@@ -618,6 +617,8 @@ void dpaa2_eth_rx(struct dpaa2_eth_priv *priv, + dma_unmap_page(dev, addr, priv->rx_buf_size, + DMA_BIDIRECTIONAL); + skb = dpaa2_eth_build_linear_skb(ch, fd, vaddr); ++ } else { ++ recycle_rx_buf = true; + } + } else if (fd_format == dpaa2_fd_sg) { + WARN_ON(priv->xdp_prog); +@@ -637,6 +638,9 @@ void dpaa2_eth_rx(struct dpaa2_eth_priv *priv, + goto err_build_skb; + + dpaa2_eth_receive_skb(priv, ch, fd, vaddr, fq, percpu_stats, skb); ++ ++ if (recycle_rx_buf) ++ dpaa2_eth_recycle_buf(priv, ch, dpaa2_fd_get_addr(fd)); + return; + + err_build_skb: +-- +2.42.0 + diff --git a/queue-6.6/drm-amd-display-refactor-edp-power-control.patch b/queue-6.6/drm-amd-display-refactor-edp-power-control.patch new file mode 100644 index 00000000000..8dc41e23c73 --- /dev/null +++ b/queue-6.6/drm-amd-display-refactor-edp-power-control.patch @@ -0,0 +1,259 @@ +From 423575c095d5371bbbdf6fec782b94d4bcdc3104 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 15:31:43 +0800 +Subject: drm/amd/display: Refactor edp power control + +From: Ian Chen + +[ Upstream commit 45f98fccb1f6895f527bd5f811f23478c2f920f5 ] + +[Why & How] +To organize the edp power control a bit: + +1. add flag in dc_link to indicate dc to skip all implicit eDP power control. +2. add edp_set_panel_power link service for DM to call. + +Reviewed-by: Aric Cyr +Reviewed-by: Jun Lei +Acked-by: Wayne Lin +Signed-off-by: Ian Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Stable-dep-of: b0399e22ada0 ("drm/amd/display: Remove power sequencing check") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 21 ++++++++++++++ + drivers/gpu/drm/amd/display/dc/dc.h | 4 +++ + drivers/gpu/drm/amd/display/dc/dc_stream.h | 1 - + .../display/dc/dce110/dce110_hw_sequencer.c | 2 +- + .../drm/amd/display/dc/dcn314/dcn314_hwseq.c | 3 +- + drivers/gpu/drm/amd/display/dc/inc/link.h | 1 + + .../gpu/drm/amd/display/dc/link/link_dpms.c | 9 +++--- + .../drm/amd/display/dc/link/link_factory.c | 1 + + .../display/dc/link/protocols/link_dp_phy.c | 3 +- + .../link/protocols/link_edp_panel_control.c | 29 +++++++++++++++++++ + .../link/protocols/link_edp_panel_control.h | 1 + + 11 files changed, 66 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 186936ad283a5..a1be93f6385c6 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -5254,3 +5254,24 @@ void dc_query_current_properties(struct dc *dc, struct dc_current_properties *pr + properties->cursor_size_limit = subvp_in_use ? 64 : dc->caps.max_cursor_size; + } + ++/** ++ ***************************************************************************** ++ * dc_set_edp_power() - DM controls eDP power to be ON/OFF ++ * ++ * Called when DM wants to power on/off eDP. ++ * Only work on links with flag skip_implict_edp_power_control is set. ++ * ++ ***************************************************************************** ++ */ ++void dc_set_edp_power(const struct dc *dc, struct dc_link *edp_link, ++ bool powerOn) ++{ ++ if (edp_link->connector_signal != SIGNAL_TYPE_EDP) ++ return; ++ ++ if (edp_link->skip_implict_edp_power_control == false) ++ return; ++ ++ edp_link->dc->link_srv->edp_set_panel_power(edp_link, powerOn); ++} ++ +diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h +index c05e91b257ace..dd7bf31ef6b04 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc.h ++++ b/drivers/gpu/drm/amd/display/dc/dc.h +@@ -1578,6 +1578,7 @@ struct dc_link { + struct phy_state phy_state; + // BW ALLOCATON USB4 ONLY + struct dc_dpia_bw_alloc dpia_bw_alloc_config; ++ bool skip_implict_edp_power_control; + }; + + /* Return an enumerated dc_link. +@@ -1597,6 +1598,9 @@ void dc_get_edp_links(const struct dc *dc, + struct dc_link **edp_links, + int *edp_num); + ++void dc_set_edp_power(const struct dc *dc, struct dc_link *edp_link, ++ bool powerOn); ++ + /* The function initiates detection handshake over the given link. It first + * determines if there are display connections over the link. If so it initiates + * detection protocols supported by the connected receiver device. The function +diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h +index 3697ea1d14c1b..d5b3e3a32cc6d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h +@@ -302,7 +302,6 @@ struct dc_stream_state { + bool vblank_synchronized; + bool fpo_in_use; + struct mall_stream_config mall_stream_config; +- bool skip_edp_power_down; + }; + + #define ABM_LEVEL_IMMEDIATE_DISABLE 255 +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index 2a6157555fd1e..9c78e42418f34 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -1226,7 +1226,7 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx) + struct dce_hwseq *hws = link->dc->hwseq; + + if (link->local_sink && link->local_sink->sink_signal == SIGNAL_TYPE_EDP) { +- if (!stream->skip_edp_power_down) ++ if (!link->skip_implict_edp_power_control) + hws->funcs.edp_backlight_control(link, false); + link->dc->hwss.set_abm_immediate_disable(pipe_ctx); + } +diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c +index 4d2820ffe4682..33a8626bda735 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c +@@ -476,7 +476,8 @@ void dcn314_disable_link_output(struct dc_link *link, + struct dmcu *dmcu = dc->res_pool->dmcu; + + if (signal == SIGNAL_TYPE_EDP && +- link->dc->hwss.edp_backlight_control) ++ link->dc->hwss.edp_backlight_control && ++ !link->skip_implict_edp_power_control) + link->dc->hwss.edp_backlight_control(link, false); + else if (dmcu != NULL && dmcu->funcs->lock_phy) + dmcu->funcs->lock_phy(dmcu); +diff --git a/drivers/gpu/drm/amd/display/dc/inc/link.h b/drivers/gpu/drm/amd/display/dc/inc/link.h +index e3e8c76c17cfa..d7685368140ab 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/link.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/link.h +@@ -295,6 +295,7 @@ struct link_service { + bool (*edp_receiver_ready_T9)(struct dc_link *link); + bool (*edp_receiver_ready_T7)(struct dc_link *link); + bool (*edp_power_alpm_dpcd_enable)(struct dc_link *link, bool enable); ++ void (*edp_set_panel_power)(struct dc_link *link, bool powerOn); + + + /*************************** DP CTS ************************************/ +diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +index 79aef205598b7..28cb1f5a504d1 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +@@ -1930,7 +1930,8 @@ static void disable_link_dp(struct dc_link *link, + dp_disable_link_phy(link, link_res, signal); + + if (link->connector_signal == SIGNAL_TYPE_EDP) { +- if (!link->dc->config.edp_no_power_sequencing) ++ if (!link->dc->config.edp_no_power_sequencing && ++ !link->skip_implict_edp_power_control) + link->dc->hwss.edp_power_control(link, false); + } + +@@ -2219,7 +2220,7 @@ static enum dc_status enable_link( + * link settings. Need to call disable first before enabling at + * new link settings. + */ +- if (link->link_status.link_active && !stream->skip_edp_power_down) ++ if (link->link_status.link_active) + disable_link(link, &pipe_ctx->link_res, pipe_ctx->stream->signal); + + switch (pipe_ctx->stream->signal) { +@@ -2338,9 +2339,7 @@ void link_set_dpms_off(struct pipe_ctx *pipe_ctx) + dc->hwss.disable_stream(pipe_ctx); + } else { + dc->hwss.disable_stream(pipe_ctx); +- if (!pipe_ctx->stream->skip_edp_power_down) { +- disable_link(pipe_ctx->stream->link, &pipe_ctx->link_res, pipe_ctx->stream->signal); +- } ++ disable_link(pipe_ctx->stream->link, &pipe_ctx->link_res, pipe_ctx->stream->signal); + } + + if (pipe_ctx->stream->timing.flags.DSC) { +diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c b/drivers/gpu/drm/amd/display/dc/link/link_factory.c +index 0895742a31024..e406561c2c237 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c +@@ -223,6 +223,7 @@ static void construct_link_service_edp_panel_control(struct link_service *link_s + link_srv->edp_receiver_ready_T9 = edp_receiver_ready_T9; + link_srv->edp_receiver_ready_T7 = edp_receiver_ready_T7; + link_srv->edp_power_alpm_dpcd_enable = edp_power_alpm_dpcd_enable; ++ link_srv->edp_set_panel_power = edp_set_panel_power; + } + + /* link dp cts implements dp compliance test automation protocols and manual +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c +index b7abba55bc2fd..0050e0a06cbc2 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c +@@ -73,7 +73,8 @@ void dp_disable_link_phy(struct dc_link *link, + { + struct dc *dc = link->ctx->dc; + +- if (!link->wa_flags.dp_keep_receiver_powered) ++ if (!link->wa_flags.dp_keep_receiver_powered && ++ !link->skip_implict_edp_power_control) + dpcd_write_rx_power_ctrl(link, false); + + dc->hwss.disable_link_output(link, link_res, signal); +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c +index 98e715aa6d8e3..24b47fa82f93c 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c +@@ -33,6 +33,7 @@ + #include "link_dp_capability.h" + #include "dm_helpers.h" + #include "dal_asic_id.h" ++#include "link_dp_phy.h" + #include "dce/dmub_psr.h" + #include "dc/dc_dmub_srv.h" + #include "dce/dmub_replay.h" +@@ -362,6 +363,34 @@ void edp_panel_backlight_power_on(struct dc_link *link, bool wait_for_hpd) + link->dc->hwss.edp_backlight_control(link, true); + } + ++void edp_set_panel_power(struct dc_link *link, bool powerOn) ++{ ++ if (powerOn) { ++ // 1. panel VDD on ++ if (!link->dc->config.edp_no_power_sequencing) ++ link->dc->hwss.edp_power_control(link, true); ++ link->dc->hwss.edp_wait_for_hpd_ready(link, true); ++ ++ // 2. panel BL on ++ if (link->dc->hwss.edp_backlight_control) ++ link->dc->hwss.edp_backlight_control(link, true); ++ ++ // 3. Rx power on ++ dpcd_write_rx_power_ctrl(link, true); ++ } else { ++ // 3. Rx power off ++ dpcd_write_rx_power_ctrl(link, false); ++ ++ // 2. panel BL off ++ if (link->dc->hwss.edp_backlight_control) ++ link->dc->hwss.edp_backlight_control(link, false); ++ ++ // 1. panel VDD off ++ if (!link->dc->config.edp_no_power_sequencing) ++ link->dc->hwss.edp_power_control(link, false); ++ } ++} ++ + bool edp_wait_for_t12(struct dc_link *link) + { + if (link->connector_signal == SIGNAL_TYPE_EDP && link->dc->hwss.edp_wait_for_T12) { +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.h b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.h +index 0a5bbda8c739c..20f91de852e30 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.h ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.h +@@ -69,4 +69,5 @@ void edp_add_delay_for_T9(struct dc_link *link); + bool edp_receiver_ready_T9(struct dc_link *link); + bool edp_receiver_ready_T7(struct dc_link *link); + bool edp_power_alpm_dpcd_enable(struct dc_link *link, bool enable); ++void edp_set_panel_power(struct dc_link *link, bool powerOn); + #endif /* __DC_LINK_EDP_POWER_CONTROL_H__ */ +-- +2.42.0 + diff --git a/queue-6.6/drm-amd-display-remove-power-sequencing-check.patch b/queue-6.6/drm-amd-display-remove-power-sequencing-check.patch new file mode 100644 index 00000000000..faa1fd55b36 --- /dev/null +++ b/queue-6.6/drm-amd-display-remove-power-sequencing-check.patch @@ -0,0 +1,46 @@ +From 41199b15c86a73d96376494ef9ec210907373a5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Oct 2023 10:21:08 -0400 +Subject: drm/amd/display: Remove power sequencing check + +From: Agustin Gutierrez + +[ Upstream commit b0399e22ada096435de3e3e73899aa8bc026820d ] + +[Why] + Some ASICs keep backlight powered on after dpms off + command has been issued. + +[How] + The check for no edp power sequencing was never going to pass. + The value is never changed from what it is set by design. + +Cc: stable@vger.kernel.org # 6.1+ +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2765 +Reviewed-by: Swapnil Patel +Acked-by: Roman Li +Signed-off-by: Agustin Gutierrez +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +index 28cb1f5a504d1..a17a06eb7762b 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +@@ -1930,8 +1930,7 @@ static void disable_link_dp(struct dc_link *link, + dp_disable_link_phy(link, link_res, signal); + + if (link->connector_signal == SIGNAL_TYPE_EDP) { +- if (!link->dc->config.edp_no_power_sequencing && +- !link->skip_implict_edp_power_control) ++ if (!link->skip_implict_edp_power_control) + link->dc->hwss.edp_power_control(link, false); + } + +-- +2.42.0 + diff --git a/queue-6.6/drm-amd-pm-fix-a-memleak-in-aldebaran_tables_init.patch b/queue-6.6/drm-amd-pm-fix-a-memleak-in-aldebaran_tables_init.patch new file mode 100644 index 00000000000..b4313ee9bd4 --- /dev/null +++ b/queue-6.6/drm-amd-pm-fix-a-memleak-in-aldebaran_tables_init.patch @@ -0,0 +1,40 @@ +From 8cec107d371bcba428345074b6b931e38efc5ccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 15:33:22 +0800 +Subject: drm/amd/pm: fix a memleak in aldebaran_tables_init + +From: Dinghao Liu + +[ Upstream commit 7a88f23e768491bae653b444a96091d2aaeb0818 ] + +When kzalloc() for smu_table->ecc_table fails, we should free +the previously allocated resources to prevent memleak. + +Fixes: edd794208555 ("drm/amd/pm: add message smu to get ecc_table v2") +Signed-off-by: Dinghao Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +index cc3169400c9b0..08fff9600bd29 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +@@ -257,8 +257,11 @@ static int aldebaran_tables_init(struct smu_context *smu) + } + + smu_table->ecc_table = kzalloc(tables[SMU_TABLE_ECCINFO].size, GFP_KERNEL); +- if (!smu_table->ecc_table) ++ if (!smu_table->ecc_table) { ++ kfree(smu_table->metrics_table); ++ kfree(smu_table->gpu_metrics_table); + return -ENOMEM; ++ } + + return 0; + } +-- +2.42.0 + diff --git a/queue-6.6/drm-i915-call-intel_pre_plane_updates-also-for-pipes.patch b/queue-6.6/drm-i915-call-intel_pre_plane_updates-also-for-pipes.patch new file mode 100644 index 00000000000..f6e7d1d2f91 --- /dev/null +++ b/queue-6.6/drm-i915-call-intel_pre_plane_updates-also-for-pipes.patch @@ -0,0 +1,49 @@ +From 96b8700b91f6931409b5979c15d478756f645152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 07:43:15 +0200 +Subject: drm/i915: Call intel_pre_plane_updates() also for pipes getting + enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit d21a3962d3042e6f56ad324cf18bdd64a1e6ecfa ] + +We used to call intel_pre_plane_updates() for any pipe going through +a modeset whether the pipe was previously enabled or not. This in +fact needed to apply all the necessary clock gating workarounds/etc. +Restore the correct behaviour. + +Fixes: 39919997322f ("drm/i915: Disable all planes before modesetting any pipes") +Reviewed-by: Jani Nikula +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20231121054324.9988-3-ville.syrjala@linux.intel.com +(cherry picked from commit e0d5ce11ed0a21bb2bf328ad82fd261783c7ad88) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_display.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index 763ab569d8f32..8232887fdf948 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -6658,10 +6658,11 @@ static void intel_commit_modeset_disables(struct intel_atomic_state *state) + if (!intel_crtc_needs_modeset(new_crtc_state)) + continue; + ++ intel_pre_plane_update(state, crtc); ++ + if (!old_crtc_state->hw.active) + continue; + +- intel_pre_plane_update(state, crtc); + intel_crtc_disable_planes(state, crtc); + } + +-- +2.42.0 + diff --git a/queue-6.6/drm-i915-gsc-mark-internal-gsc-engine-with-reserved-.patch b/queue-6.6/drm-i915-gsc-mark-internal-gsc-engine-with-reserved-.patch new file mode 100644 index 00000000000..47a6d8c190c --- /dev/null +++ b/queue-6.6/drm-i915-gsc-mark-internal-gsc-engine-with-reserved-.patch @@ -0,0 +1,119 @@ +From 54a62e2c93b92883b3153267c8e2fc592f351269 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 08:44:56 +0000 +Subject: drm/i915/gsc: Mark internal GSC engine with reserved uabi class + +From: Tvrtko Ursulin + +[ Upstream commit 503579448db93f9fbcc93cd99a1f2d5aa4b2cda6 ] + +The GSC CS is not exposed to the user, so we skipped assigning a uabi +class number for it. However, the trace logs use the uabi class and +instance to identify the engine, so leaving uabi class unset makes the +GSC CS show up as the RCS in those logs. + +Given that the engine is not exposed to the user, we can't add a new +case in the uabi enum, so we insted internally define a kernel +internal class as -1. + +At the same time remove special handling for the name and complete +the uabi_classes array so internal class is automatically correctly +assigned. + +Engine will show as 65535:0 other0 in the logs/traces which should +be unique enough. + +v2: + * Fix uabi class u8 vs u16 type confusion. + +Signed-off-by: Tvrtko Ursulin +Fixes: 194babe26bdc ("drm/i915/mtl: don't expose GSC command streamer to the user") +Cc: Daniele Ceraolo Spurio +Cc: Alan Previn +Cc: Matt Roper +Reviewed-by: Daniele Ceraolo Spurio +Link: https://patchwork.freedesktop.org/patch/msgid/20231116084456.291533-1-tvrtko.ursulin@linux.intel.com +(cherry picked from commit dfed6b58d54f3a5d7e6bc1fb060e2c936330eba2) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_engine_user.c | 39 ++++++++++++--------- + 1 file changed, 22 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_engine_user.c b/drivers/gpu/drm/i915/gt/intel_engine_user.c +index dcedff41a825f..d304e0a948f0d 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine_user.c ++++ b/drivers/gpu/drm/i915/gt/intel_engine_user.c +@@ -42,12 +42,15 @@ void intel_engine_add_user(struct intel_engine_cs *engine) + (struct llist_head *)&engine->i915->uabi_engines); + } + +-static const u8 uabi_classes[] = { ++#define I915_NO_UABI_CLASS ((u16)(-1)) ++ ++static const u16 uabi_classes[] = { + [RENDER_CLASS] = I915_ENGINE_CLASS_RENDER, + [COPY_ENGINE_CLASS] = I915_ENGINE_CLASS_COPY, + [VIDEO_DECODE_CLASS] = I915_ENGINE_CLASS_VIDEO, + [VIDEO_ENHANCEMENT_CLASS] = I915_ENGINE_CLASS_VIDEO_ENHANCE, + [COMPUTE_CLASS] = I915_ENGINE_CLASS_COMPUTE, ++ [OTHER_CLASS] = I915_NO_UABI_CLASS, /* Not exposed to users, no uabi class. */ + }; + + static int engine_cmp(void *priv, const struct list_head *A, +@@ -202,6 +205,7 @@ static void engine_rename(struct intel_engine_cs *engine, const char *name, u16 + + void intel_engines_driver_register(struct drm_i915_private *i915) + { ++ u16 name_instance, other_instance = 0; + struct legacy_ring ring = {}; + struct list_head *it, *next; + struct rb_node **p, *prev; +@@ -219,27 +223,28 @@ void intel_engines_driver_register(struct drm_i915_private *i915) + if (intel_gt_has_unrecoverable_error(engine->gt)) + continue; /* ignore incomplete engines */ + +- /* +- * We don't want to expose the GSC engine to the users, but we +- * still rename it so it is easier to identify in the debug logs +- */ +- if (engine->id == GSC0) { +- engine_rename(engine, "gsc", 0); +- continue; +- } +- + GEM_BUG_ON(engine->class >= ARRAY_SIZE(uabi_classes)); + engine->uabi_class = uabi_classes[engine->class]; ++ if (engine->uabi_class == I915_NO_UABI_CLASS) { ++ name_instance = other_instance++; ++ } else { ++ GEM_BUG_ON(engine->uabi_class >= ++ ARRAY_SIZE(i915->engine_uabi_class_count)); ++ name_instance = ++ i915->engine_uabi_class_count[engine->uabi_class]++; ++ } ++ engine->uabi_instance = name_instance; + +- GEM_BUG_ON(engine->uabi_class >= +- ARRAY_SIZE(i915->engine_uabi_class_count)); +- engine->uabi_instance = +- i915->engine_uabi_class_count[engine->uabi_class]++; +- +- /* Replace the internal name with the final user facing name */ ++ /* ++ * Replace the internal name with the final user and log facing ++ * name. ++ */ + engine_rename(engine, + intel_engine_class_repr(engine->class), +- engine->uabi_instance); ++ name_instance); ++ ++ if (engine->uabi_class == I915_NO_UABI_CLASS) ++ continue; + + rb_link_node(&engine->uabi_node, prev, p); + rb_insert_color(&engine->uabi_node, &i915->uabi_engines); +-- +2.42.0 + diff --git a/queue-6.6/drm-panel-nt36523-fix-return-value-check-in-nt36523_.patch b/queue-6.6/drm-panel-nt36523-fix-return-value-check-in-nt36523_.patch new file mode 100644 index 00000000000..44e44b34fed --- /dev/null +++ b/queue-6.6/drm-panel-nt36523-fix-return-value-check-in-nt36523_.patch @@ -0,0 +1,43 @@ +From d325045e0ac7895fcb5cc3b79c0311fdb9c681d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 17:07:15 +0800 +Subject: drm/panel: nt36523: fix return value check in nt36523_probe() + +From: Yang Yingliang + +[ Upstream commit fb18fe0fdf22a2f4512a8b644bb5ea1473829cda ] + +mipi_dsi_device_register_full() never returns NULL pointer, it +will return ERR_PTR() when it fails, so replace the check with +IS_ERR(). + +Fixes: 0993234a0045 ("drm/panel: Add driver for Novatek NT36523") +Signed-off-by: Yang Yingliang +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20231129090715.856263-1-yangyingliang@huaweicloud.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20231129090715.856263-1-yangyingliang@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt36523.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt36523.c b/drivers/gpu/drm/panel/panel-novatek-nt36523.c +index 9632b9e95b715..c4a804c5d6aac 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt36523.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt36523.c +@@ -1266,9 +1266,9 @@ static int nt36523_probe(struct mipi_dsi_device *dsi) + return dev_err_probe(dev, -EPROBE_DEFER, "cannot get secondary DSI host\n"); + + pinfo->dsi[1] = mipi_dsi_device_register_full(dsi1_host, info); +- if (!pinfo->dsi[1]) { ++ if (IS_ERR(pinfo->dsi[1])) { + dev_err(dev, "cannot get secondary DSI device\n"); +- return -ENODEV; ++ return PTR_ERR(pinfo->dsi[1]); + } + } + +-- +2.42.0 + diff --git a/queue-6.6/drm-panel-starry-2081101qfh032011-53g-fine-tune-the-.patch b/queue-6.6/drm-panel-starry-2081101qfh032011-53g-fine-tune-the-.patch new file mode 100644 index 00000000000..86d22c47a33 --- /dev/null +++ b/queue-6.6/drm-panel-starry-2081101qfh032011-53g-fine-tune-the-.patch @@ -0,0 +1,40 @@ +From 2896184b7ae7049f486e7d2bdb19238fb6d057f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 16:41:15 +0800 +Subject: drm/panel: starry-2081101qfh032011-53g: Fine tune the panel power + sequence + +From: xiazhengqiao + +[ Upstream commit fc1ccc16271a0526518f19f460fed63d575a8a42 ] + +For the "starry, 2081101qfh032011-53g" panel, it is stipulated in the +panel spec that MIPI needs to keep the LP11 state before the +lcm_reset pin is pulled high. + +Fixes: 6069b66cd962 ("drm/panel: support for STARRY 2081101QFH032011-53G MIPI-DSI panel") +Signed-off-by: xiazhengqiao +Reviewed-by: Jessica Zhang +Link: https://lore.kernel.org/r/20231129084115.7918-1-xiazhengqiao@huaqin.corp-partner.google.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20231129084115.7918-1-xiazhengqiao@huaqin.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +index d76a8ca9c40f8..29e63cdfb8954 100644 +--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c ++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +@@ -2104,6 +2104,7 @@ static const struct panel_desc starry_qfh032011_53g_desc = { + .mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE | + MIPI_DSI_MODE_LPM, + .init_cmds = starry_qfh032011_53g_init_cmd, ++ .lp11_before_reset = true, + }; + + static const struct drm_display_mode starry_himax83102_j02_default_mode = { +-- +2.42.0 + diff --git a/queue-6.6/efi-unaccepted-fix-off-by-one-when-checking-for-over.patch b/queue-6.6/efi-unaccepted-fix-off-by-one-when-checking-for-over.patch new file mode 100644 index 00000000000..8af51dd1c81 --- /dev/null +++ b/queue-6.6/efi-unaccepted-fix-off-by-one-when-checking-for-over.patch @@ -0,0 +1,45 @@ +From 3109302956a3531f571abfba69eebe93f5f6f8c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 10:13:54 -0500 +Subject: efi/unaccepted: Fix off-by-one when checking for overlapping ranges + +From: Michael Roth + +[ Upstream commit 01b1e3ca0e5ce47bbae8217d47376ad01b331b07 ] + +When a task needs to accept memory it will scan the accepting_list +to see if any ranges already being processed by other tasks overlap +with its range. Due to an off-by-one in the range comparisons, a task +might falsely determine that an overlapping range is being accepted, +leading to an unnecessary delay before it begins processing the range. + +Fix the off-by-one in the range comparison to prevent this and slightly +improve performance. + +Fixes: 50e782a86c98 ("efi/unaccepted: Fix soft lockups caused by parallel memory acceptance") +Link: https://lore.kernel.org/linux-mm/20231101004523.vseyi5bezgfaht5i@amd.com/T/#me2eceb9906fcae5fe958b3fe88e41f920f8335b6 +Reviewed-by: Kirill A. Shutemov +Signed-off-by: Michael Roth +Acked-by: Vlastimil Babka +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/unaccepted_memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/unaccepted_memory.c b/drivers/firmware/efi/unaccepted_memory.c +index 135278ddaf627..79fb687bb90f9 100644 +--- a/drivers/firmware/efi/unaccepted_memory.c ++++ b/drivers/firmware/efi/unaccepted_memory.c +@@ -100,7 +100,7 @@ void accept_memory(phys_addr_t start, phys_addr_t end) + * overlap on physical address level. + */ + list_for_each_entry(entry, &accepting_list, list) { +- if (entry->end < range.start) ++ if (entry->end <= range.start) + continue; + if (entry->start >= range.end) + continue; +-- +2.42.0 + diff --git a/queue-6.6/ethtool-don-t-propagate-eopnotsupp-from-dumps.patch b/queue-6.6/ethtool-don-t-propagate-eopnotsupp-from-dumps.patch new file mode 100644 index 00000000000..7415ffc361a --- /dev/null +++ b/queue-6.6/ethtool-don-t-propagate-eopnotsupp-from-dumps.patch @@ -0,0 +1,42 @@ +From 992b91c0cfda279dfca1b2680c6680546b69319f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Nov 2023 14:58:06 -0800 +Subject: ethtool: don't propagate EOPNOTSUPP from dumps + +From: Jakub Kicinski + +[ Upstream commit cbeb989e41f4094f54bec2cecce993f26f547bea ] + +The default dump handler needs to clear ret before returning. +Otherwise if the last interface returns an inconsequential +error this error will propagate to user space. + +This may confuse user space (ethtool CLI seems to ignore it, +but YNL doesn't). It will also terminate the dump early +for mutli-skb dump, because netlink core treats EOPNOTSUPP +as a real error. + +Fixes: 728480f12442 ("ethtool: default handlers for GET requests") +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20231126225806.2143528-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ethtool/netlink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c +index 3bbd5afb7b31c..fe3553f60bf39 100644 +--- a/net/ethtool/netlink.c ++++ b/net/ethtool/netlink.c +@@ -505,6 +505,7 @@ static int ethnl_default_dumpit(struct sk_buff *skb, + ret = skb->len; + break; + } ++ ret = 0; + } + rtnl_unlock(); + +-- +2.42.0 + diff --git a/queue-6.6/ice-fix-vf-reset-paths-when-interface-in-a-failed-ov.patch b/queue-6.6/ice-fix-vf-reset-paths-when-interface-in-a-failed-ov.patch new file mode 100644 index 00000000000..fec24aac178 --- /dev/null +++ b/queue-6.6/ice-fix-vf-reset-paths-when-interface-in-a-failed-ov.patch @@ -0,0 +1,341 @@ +From 9212728fc10adf929fc9db8936351bf57fae85b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 13:23:38 -0800 +Subject: ice: Fix VF Reset paths when interface in a failed over aggregate + +From: Dave Ertman + +[ Upstream commit 9f74a3dfcf83e11aedcb98250b8040dbc6d9659a ] + +There is an error when an interface has the following conditions: +- PF is in an aggregate (bond) +- PF has VFs created on it +- bond is in a state where it is failed-over to the secondary interface +- A VF reset is issued on one or more of those VFs + +The issue is generated by the originating PF trying to rebuild or +reconfigure the VF resources. Since the bond is failed over to the +secondary interface the queue contexts are in a modified state. + +To fix this issue, have the originating interface reclaim its resources +prior to the tear-down and rebuild or reconfigure. Then after the process +is complete, move the resources back to the currently active interface. + +There are multiple paths that can be used depending on what triggered the +event, so create a helper function to move the queues and use paired calls +to the helper (back to origin, process, then move back to active interface) +under the same lag_mutex lock. + +Fixes: 1e0f9881ef79 ("ice: Flesh out implementation of support for SRIOV on bonded interface") +Signed-off-by: Dave Ertman +Tested-by: Sujai Buvaneswaran +Signed-off-by: Tony Nguyen +Reviewed-by: Przemek Kitszel +Link: https://lore.kernel.org/r/20231127212340.1137657-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_lag.c | 122 +++++++++++------- + drivers/net/ethernet/intel/ice/ice_lag.h | 1 + + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 20 +++ + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 25 ++++ + 4 files changed, 118 insertions(+), 50 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c +index fb40ad98e6aad..d86e2460b5a4d 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lag.c ++++ b/drivers/net/ethernet/intel/ice/ice_lag.c +@@ -536,6 +536,50 @@ ice_lag_move_vf_node_tc(struct ice_lag *lag, u8 oldport, u8 newport, + dev_dbg(dev, "Problem restarting traffic for LAG node move\n"); + } + ++/** ++ * ice_lag_build_netdev_list - populate the lag struct's netdev list ++ * @lag: local lag struct ++ * @ndlist: pointer to netdev list to populate ++ */ ++static void ice_lag_build_netdev_list(struct ice_lag *lag, ++ struct ice_lag_netdev_list *ndlist) ++{ ++ struct ice_lag_netdev_list *nl; ++ struct net_device *tmp_nd; ++ ++ INIT_LIST_HEAD(&ndlist->node); ++ rcu_read_lock(); ++ for_each_netdev_in_bond_rcu(lag->upper_netdev, tmp_nd) { ++ nl = kzalloc(sizeof(*nl), GFP_ATOMIC); ++ if (!nl) ++ break; ++ ++ nl->netdev = tmp_nd; ++ list_add(&nl->node, &ndlist->node); ++ } ++ rcu_read_unlock(); ++ lag->netdev_head = &ndlist->node; ++} ++ ++/** ++ * ice_lag_destroy_netdev_list - free lag struct's netdev list ++ * @lag: pointer to local lag struct ++ * @ndlist: pointer to lag struct netdev list ++ */ ++static void ice_lag_destroy_netdev_list(struct ice_lag *lag, ++ struct ice_lag_netdev_list *ndlist) ++{ ++ struct ice_lag_netdev_list *entry, *n; ++ ++ rcu_read_lock(); ++ list_for_each_entry_safe(entry, n, &ndlist->node, node) { ++ list_del(&entry->node); ++ kfree(entry); ++ } ++ rcu_read_unlock(); ++ lag->netdev_head = NULL; ++} ++ + /** + * ice_lag_move_single_vf_nodes - Move Tx scheduling nodes for single VF + * @lag: primary interface LAG struct +@@ -564,7 +608,6 @@ ice_lag_move_single_vf_nodes(struct ice_lag *lag, u8 oldport, u8 newport, + void ice_lag_move_new_vf_nodes(struct ice_vf *vf) + { + struct ice_lag_netdev_list ndlist; +- struct list_head *tmp, *n; + u8 pri_port, act_port; + struct ice_lag *lag; + struct ice_vsi *vsi; +@@ -588,38 +631,15 @@ void ice_lag_move_new_vf_nodes(struct ice_vf *vf) + pri_port = pf->hw.port_info->lport; + act_port = lag->active_port; + +- if (lag->upper_netdev) { +- struct ice_lag_netdev_list *nl; +- struct net_device *tmp_nd; +- +- INIT_LIST_HEAD(&ndlist.node); +- rcu_read_lock(); +- for_each_netdev_in_bond_rcu(lag->upper_netdev, tmp_nd) { +- nl = kzalloc(sizeof(*nl), GFP_ATOMIC); +- if (!nl) +- break; +- +- nl->netdev = tmp_nd; +- list_add(&nl->node, &ndlist.node); +- } +- rcu_read_unlock(); +- } +- +- lag->netdev_head = &ndlist.node; ++ if (lag->upper_netdev) ++ ice_lag_build_netdev_list(lag, &ndlist); + + if (ice_is_feature_supported(pf, ICE_F_SRIOV_LAG) && + lag->bonded && lag->primary && pri_port != act_port && + !list_empty(lag->netdev_head)) + ice_lag_move_single_vf_nodes(lag, pri_port, act_port, vsi->idx); + +- list_for_each_safe(tmp, n, &ndlist.node) { +- struct ice_lag_netdev_list *entry; +- +- entry = list_entry(tmp, struct ice_lag_netdev_list, node); +- list_del(&entry->node); +- kfree(entry); +- } +- lag->netdev_head = NULL; ++ ice_lag_destroy_netdev_list(lag, &ndlist); + + new_vf_unlock: + mutex_unlock(&pf->lag_mutex); +@@ -646,6 +666,29 @@ static void ice_lag_move_vf_nodes(struct ice_lag *lag, u8 oldport, u8 newport) + ice_lag_move_single_vf_nodes(lag, oldport, newport, i); + } + ++/** ++ * ice_lag_move_vf_nodes_cfg - move vf nodes outside LAG netdev event context ++ * @lag: local lag struct ++ * @src_prt: lport value for source port ++ * @dst_prt: lport value for destination port ++ * ++ * This function is used to move nodes during an out-of-netdev-event situation, ++ * primarily when the driver needs to reconfigure or recreate resources. ++ * ++ * Must be called while holding the lag_mutex to avoid lag events from ++ * processing while out-of-sync moves are happening. Also, paired moves, ++ * such as used in a reset flow, should both be called under the same mutex ++ * lock to avoid changes between start of reset and end of reset. ++ */ ++void ice_lag_move_vf_nodes_cfg(struct ice_lag *lag, u8 src_prt, u8 dst_prt) ++{ ++ struct ice_lag_netdev_list ndlist; ++ ++ ice_lag_build_netdev_list(lag, &ndlist); ++ ice_lag_move_vf_nodes(lag, src_prt, dst_prt); ++ ice_lag_destroy_netdev_list(lag, &ndlist); ++} ++ + #define ICE_LAG_SRIOV_CP_RECIPE 10 + #define ICE_LAG_SRIOV_TRAIN_PKT_LEN 16 + +@@ -2022,7 +2065,6 @@ void ice_lag_rebuild(struct ice_pf *pf) + { + struct ice_lag_netdev_list ndlist; + struct ice_lag *lag, *prim_lag; +- struct list_head *tmp, *n; + u8 act_port, loc_port; + + if (!pf->lag || !pf->lag->bonded) +@@ -2034,21 +2076,7 @@ void ice_lag_rebuild(struct ice_pf *pf) + if (lag->primary) { + prim_lag = lag; + } else { +- struct ice_lag_netdev_list *nl; +- struct net_device *tmp_nd; +- +- INIT_LIST_HEAD(&ndlist.node); +- rcu_read_lock(); +- for_each_netdev_in_bond_rcu(lag->upper_netdev, tmp_nd) { +- nl = kzalloc(sizeof(*nl), GFP_ATOMIC); +- if (!nl) +- break; +- +- nl->netdev = tmp_nd; +- list_add(&nl->node, &ndlist.node); +- } +- rcu_read_unlock(); +- lag->netdev_head = &ndlist.node; ++ ice_lag_build_netdev_list(lag, &ndlist); + prim_lag = ice_lag_find_primary(lag); + } + +@@ -2078,13 +2106,7 @@ void ice_lag_rebuild(struct ice_pf *pf) + + ice_clear_rdma_cap(pf); + lag_rebuild_out: +- list_for_each_safe(tmp, n, &ndlist.node) { +- struct ice_lag_netdev_list *entry; +- +- entry = list_entry(tmp, struct ice_lag_netdev_list, node); +- list_del(&entry->node); +- kfree(entry); +- } ++ ice_lag_destroy_netdev_list(lag, &ndlist); + mutex_unlock(&pf->lag_mutex); + } + +diff --git a/drivers/net/ethernet/intel/ice/ice_lag.h b/drivers/net/ethernet/intel/ice/ice_lag.h +index facb6c894b6dd..7f22987675012 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lag.h ++++ b/drivers/net/ethernet/intel/ice/ice_lag.h +@@ -63,4 +63,5 @@ int ice_init_lag(struct ice_pf *pf); + void ice_deinit_lag(struct ice_pf *pf); + void ice_lag_rebuild(struct ice_pf *pf); + bool ice_lag_is_switchdev_running(struct ice_pf *pf); ++void ice_lag_move_vf_nodes_cfg(struct ice_lag *lag, u8 src_prt, u8 dst_prt); + #endif /* _ICE_LAG_H_ */ +diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c +index 24e4f4d897b66..d488c7156d093 100644 +--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c +@@ -827,12 +827,16 @@ static void ice_notify_vf_reset(struct ice_vf *vf) + int ice_reset_vf(struct ice_vf *vf, u32 flags) + { + struct ice_pf *pf = vf->pf; ++ struct ice_lag *lag; + struct ice_vsi *vsi; ++ u8 act_prt, pri_prt; + struct device *dev; + int err = 0; + bool rsd; + + dev = ice_pf_to_dev(pf); ++ act_prt = ICE_LAG_INVALID_PORT; ++ pri_prt = pf->hw.port_info->lport; + + if (flags & ICE_VF_RESET_NOTIFY) + ice_notify_vf_reset(vf); +@@ -843,6 +847,17 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags) + return 0; + } + ++ lag = pf->lag; ++ mutex_lock(&pf->lag_mutex); ++ if (lag && lag->bonded && lag->primary) { ++ act_prt = lag->active_port; ++ if (act_prt != pri_prt && act_prt != ICE_LAG_INVALID_PORT && ++ lag->upper_netdev) ++ ice_lag_move_vf_nodes_cfg(lag, act_prt, pri_prt); ++ else ++ act_prt = ICE_LAG_INVALID_PORT; ++ } ++ + if (flags & ICE_VF_RESET_LOCK) + mutex_lock(&vf->cfg_lock); + else +@@ -935,6 +950,11 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags) + if (flags & ICE_VF_RESET_LOCK) + mutex_unlock(&vf->cfg_lock); + ++ if (lag && lag->bonded && lag->primary && ++ act_prt != ICE_LAG_INVALID_PORT) ++ ice_lag_move_vf_nodes_cfg(lag, pri_prt, act_prt); ++ mutex_unlock(&pf->lag_mutex); ++ + return err; + } + +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c +index db97353efd067..62337e6569b23 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c +@@ -1600,9 +1600,24 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg) + (struct virtchnl_vsi_queue_config_info *)msg; + struct virtchnl_queue_pair_info *qpi; + struct ice_pf *pf = vf->pf; ++ struct ice_lag *lag; + struct ice_vsi *vsi; ++ u8 act_prt, pri_prt; + int i = -1, q_idx; + ++ lag = pf->lag; ++ mutex_lock(&pf->lag_mutex); ++ act_prt = ICE_LAG_INVALID_PORT; ++ pri_prt = pf->hw.port_info->lport; ++ if (lag && lag->bonded && lag->primary) { ++ act_prt = lag->active_port; ++ if (act_prt != pri_prt && act_prt != ICE_LAG_INVALID_PORT && ++ lag->upper_netdev) ++ ice_lag_move_vf_nodes_cfg(lag, act_prt, pri_prt); ++ else ++ act_prt = ICE_LAG_INVALID_PORT; ++ } ++ + if (!test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) + goto error_param; + +@@ -1710,6 +1725,11 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg) + } + } + ++ if (lag && lag->bonded && lag->primary && ++ act_prt != ICE_LAG_INVALID_PORT) ++ ice_lag_move_vf_nodes_cfg(lag, pri_prt, act_prt); ++ mutex_unlock(&pf->lag_mutex); ++ + /* send the response to the VF */ + return ice_vc_send_msg_to_vf(vf, VIRTCHNL_OP_CONFIG_VSI_QUEUES, + VIRTCHNL_STATUS_SUCCESS, NULL, 0); +@@ -1724,6 +1744,11 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg) + vf->vf_id, i); + } + ++ if (lag && lag->bonded && lag->primary && ++ act_prt != ICE_LAG_INVALID_PORT) ++ ice_lag_move_vf_nodes_cfg(lag, pri_prt, act_prt); ++ mutex_unlock(&pf->lag_mutex); ++ + ice_lag_move_new_vf_nodes(vf); + + /* send the response to the VF */ +-- +2.42.0 + diff --git a/queue-6.6/iommu-fix-printk-arg-in-of_iommu_get_resv_regions.patch b/queue-6.6/iommu-fix-printk-arg-in-of_iommu_get_resv_regions.patch new file mode 100644 index 00000000000..98332a14329 --- /dev/null +++ b/queue-6.6/iommu-fix-printk-arg-in-of_iommu_get_resv_regions.patch @@ -0,0 +1,40 @@ +From fdbf1ef4cb6156668a208ccd3e8396d46fa6b269 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Nov 2023 22:22:26 -0800 +Subject: iommu: Fix printk arg in of_iommu_get_resv_regions() + +From: Daniel Mentz + +[ Upstream commit c2183b3dcc9dd41b768569ea88bededa58cceebb ] + +The variable phys is defined as (struct resource *) which aligns with +the printk format specifier %pr. Taking the address of it results in a +value of type (struct resource **) which is incompatible with the format +specifier %pr. Therefore, remove the address of operator (&). + +Fixes: a5bf3cfce8cb ("iommu: Implement of_iommu_get_resv_regions()") +Signed-off-by: Daniel Mentz +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20231108062226.928985-1-danielmentz@google.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/of_iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c +index c25b4ae6aeee7..35ba090f3b5e2 100644 +--- a/drivers/iommu/of_iommu.c ++++ b/drivers/iommu/of_iommu.c +@@ -197,7 +197,7 @@ iommu_resv_region_get_type(struct device *dev, + if (start == phys->start && end == phys->end) + return IOMMU_RESV_DIRECT; + +- dev_warn(dev, "treating non-direct mapping [%pr] -> [%pap-%pap] as reservation\n", &phys, ++ dev_warn(dev, "treating non-direct mapping [%pr] -> [%pap-%pap] as reservation\n", phys, + &start, &end); + return IOMMU_RESV_RESERVED; + } +-- +2.42.0 + diff --git a/queue-6.6/iommu-vt-d-disable-pci-ats-in-legacy-passthrough-mod.patch b/queue-6.6/iommu-vt-d-disable-pci-ats-in-legacy-passthrough-mod.patch new file mode 100644 index 00000000000..e8605266de2 --- /dev/null +++ b/queue-6.6/iommu-vt-d-disable-pci-ats-in-legacy-passthrough-mod.patch @@ -0,0 +1,50 @@ +From 6bfd72bd25cdd0cdf20f7fcc8876b8b238ba844a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 11:26:04 +0800 +Subject: iommu/vt-d: Disable PCI ATS in legacy passthrough mode + +From: Lu Baolu + +[ Upstream commit da37dddcf4caf015c400a930301d2ee27a7a15fb ] + +When IOMMU hardware operates in legacy mode, the TT field of the context +entry determines the translation type, with three supported types (Section +9.3 Context Entry): + +- DMA translation without device TLB support +- DMA translation with device TLB support +- Passthrough mode with translated and translation requests blocked + +Device TLB support is absent when hardware is configured in passthrough +mode. + +Disable the PCI ATS feature when IOMMU is configured for passthrough +translation type in legacy (non-scalable) mode. + +Fixes: 0faa19a1515f ("iommu/vt-d: Decouple PASID & PRI enabling from SVA") +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20231114011036.70142-3-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 8e878c3beec5c..18fa71aadc903 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -2487,7 +2487,8 @@ static int dmar_domain_attach_device(struct dmar_domain *domain, + return ret; + } + +- iommu_enable_pci_caps(info); ++ if (sm_supported(info->iommu) || !domain_type_is_si(info->domain)) ++ iommu_enable_pci_caps(info); + + return 0; + } +-- +2.42.0 + diff --git a/queue-6.6/iommu-vt-d-make-context-clearing-consistent-with-con.patch b/queue-6.6/iommu-vt-d-make-context-clearing-consistent-with-con.patch new file mode 100644 index 00000000000..6cd1941a489 --- /dev/null +++ b/queue-6.6/iommu-vt-d-make-context-clearing-consistent-with-con.patch @@ -0,0 +1,46 @@ +From 29251120cc816a0ef21092dc137953bcf2b711d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 11:26:05 +0800 +Subject: iommu/vt-d: Make context clearing consistent with context mapping + +From: Lu Baolu + +[ Upstream commit 9a16ab9d640274b20813d2d17475e18d3e99d834 ] + +In the iommu probe_device path, domain_context_mapping() allows setting +up the context entry for a non-PCI device. However, in the iommu +release_device path, domain_context_clear() only clears context entries +for PCI devices. + +Make domain_context_clear() behave consistently with +domain_context_mapping() by clearing context entries for both PCI and +non-PCI devices. + +Fixes: 579305f75d34 ("iommu/vt-d: Update to use PCI DMA aliases") +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20231114011036.70142-4-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 18fa71aadc903..4c3707384bd92 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -3923,8 +3923,8 @@ static int domain_context_clear_one_cb(struct pci_dev *pdev, u16 alias, void *op + */ + static void domain_context_clear(struct device_domain_info *info) + { +- if (!info->iommu || !info->dev || !dev_is_pci(info->dev)) +- return; ++ if (!dev_is_pci(info->dev)) ++ domain_context_clear_one(info, info->bus, info->devfn); + + pci_for_each_dma_alias(to_pci_dev(info->dev), + &domain_context_clear_one_cb, info); +-- +2.42.0 + diff --git a/queue-6.6/iommu-vt-d-omit-devtlb-invalidation-requests-when-te.patch b/queue-6.6/iommu-vt-d-omit-devtlb-invalidation-requests-when-te.patch new file mode 100644 index 00000000000..feba6ccb227 --- /dev/null +++ b/queue-6.6/iommu-vt-d-omit-devtlb-invalidation-requests-when-te.patch @@ -0,0 +1,69 @@ +From 546e2c2e1f8578e79eafbec3da549e68902af424 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 11:26:03 +0800 +Subject: iommu/vt-d: Omit devTLB invalidation requests when TES=0 + +From: Lu Baolu + +[ Upstream commit 0f5432a9b839847dcfe9fa369d72e3d646102ddf ] + +The latest VT-d spec indicates that when remapping hardware is disabled +(TES=0 in Global Status Register), upstream ATS Invalidation Completion +requests are treated as UR (Unsupported Request). + +Consequently, the spec recommends in section 4.3 Handling of Device-TLB +Invalidations that software refrain from submitting any Device-TLB +invalidation requests when address remapping hardware is disabled. + +Verify address remapping hardware is enabled prior to submitting Device- +TLB invalidation requests. + +Fixes: 792fb43ce2c9 ("iommu/vt-d: Enable Intel IOMMU scalable mode by default") +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20231114011036.70142-2-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/dmar.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c +index a3414afe11b07..23cb80d62a9ab 100644 +--- a/drivers/iommu/intel/dmar.c ++++ b/drivers/iommu/intel/dmar.c +@@ -1522,6 +1522,15 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid, + { + struct qi_desc desc; + ++ /* ++ * VT-d spec, section 4.3: ++ * ++ * Software is recommended to not submit any Device-TLB invalidation ++ * requests while address remapping hardware is disabled. ++ */ ++ if (!(iommu->gcmd & DMA_GCMD_TE)) ++ return; ++ + if (mask) { + addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1; + desc.qw1 = QI_DEV_IOTLB_ADDR(addr) | QI_DEV_IOTLB_SIZE; +@@ -1587,6 +1596,15 @@ void qi_flush_dev_iotlb_pasid(struct intel_iommu *iommu, u16 sid, u16 pfsid, + unsigned long mask = 1UL << (VTD_PAGE_SHIFT + size_order - 1); + struct qi_desc desc = {.qw1 = 0, .qw2 = 0, .qw3 = 0}; + ++ /* ++ * VT-d spec, section 4.3: ++ * ++ * Software is recommended to not submit any Device-TLB invalidation ++ * requests while address remapping hardware is disabled. ++ */ ++ if (!(iommu->gcmd & DMA_GCMD_TE)) ++ return; ++ + desc.qw0 = QI_DEV_EIOTLB_PASID(pasid) | QI_DEV_EIOTLB_SID(sid) | + QI_DEV_EIOTLB_QDEP(qdep) | QI_DEIOTLB_TYPE | + QI_DEV_IOTLB_PFSID(pfsid); +-- +2.42.0 + diff --git a/queue-6.6/ipv4-igmp-fix-refcnt-uaf-issue-when-receiving-igmp-q.patch b/queue-6.6/ipv4-igmp-fix-refcnt-uaf-issue-when-receiving-igmp-q.patch new file mode 100644 index 00000000000..5b35c163597 --- /dev/null +++ b/queue-6.6/ipv4-igmp-fix-refcnt-uaf-issue-when-receiving-igmp-q.patch @@ -0,0 +1,114 @@ +From 4322e4f2a72084bf2cf2850e4ce8019136d12e4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 15:13:14 +0800 +Subject: ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet + +From: Zhengchao Shao + +[ Upstream commit e2b706c691905fe78468c361aaabc719d0a496f1 ] + +When I perform the following test operations: +1.ip link add br0 type bridge +2.brctl addif br0 eth0 +3.ip addr add 239.0.0.1/32 dev eth0 +4.ip addr add 239.0.0.1/32 dev br0 +5.ip addr add 224.0.0.1/32 dev br0 +6.while ((1)) + do + ifconfig br0 up + ifconfig br0 down + done +7.send IGMPv2 query packets to port eth0 continuously. For example, +./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00 +1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00" + +The preceding tests may trigger the refcnt uaf issue of the mc list. The +stack is as follows: + refcount_t: addition on 0; use-after-free. + WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25) + CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80 + Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 + RIP: 0010:refcount_warn_saturate (lib/refcount.c:25) + RSP: 0018:ffffb68f00657910 EFLAGS: 00010286 + RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908 + RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900 + RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff + R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680 + R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00 + FS: 0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0 + Call Trace: + + igmp_heard_query (net/ipv4/igmp.c:1068) + igmp_rcv (net/ipv4/igmp.c:1132) + ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) + ip_local_deliver_finish (net/ipv4/ip_input.c:234) + __netif_receive_skb_one_core (net/core/dev.c:5529) + netif_receive_skb_internal (net/core/dev.c:5729) + netif_receive_skb (net/core/dev.c:5788) + br_handle_frame_finish (net/bridge/br_input.c:216) + nf_hook_bridge_pre (net/bridge/br_input.c:294) + __netif_receive_skb_core (net/core/dev.c:5423) + __netif_receive_skb_list_core (net/core/dev.c:5606) + __netif_receive_skb_list (net/core/dev.c:5674) + netif_receive_skb_list_internal (net/core/dev.c:5764) + napi_gro_receive (net/core/gro.c:609) + e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467) + e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805) + __napi_poll (net/core/dev.c:6533) + net_rx_action (net/core/dev.c:6735) + __do_softirq (kernel/softirq.c:554) + run_ksoftirqd (kernel/softirq.c:913) + smpboot_thread_fn (kernel/smpboot.c:164) + kthread (kernel/kthread.c:388) + ret_from_fork (arch/x86/kernel/process.c:153) + ret_from_fork_asm (arch/x86/entry/entry_64.S:250) + + +The root causes are as follows: +Thread A Thread B +... netif_receive_skb +br_dev_stop ... + br_multicast_leave_snoopers ... + __ip_mc_dec_group ... + __igmp_group_dropped igmp_rcv + igmp_stop_timer igmp_heard_query //ref = 1 + ip_ma_put igmp_mod_timer + refcount_dec_and_test igmp_start_timer //ref = 0 + ... refcount_inc //ref increases from 0 +When the device receives an IGMPv2 Query message, it starts the timer +immediately, regardless of whether the device is running. If the device is +down and has left the multicast group, it will cause the mc list refcount +uaf issue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Zhengchao Shao +Reviewed-by: Eric Dumazet +Reviewed-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/igmp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 418e5fb58fd3f..d515881d02a6f 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -216,8 +216,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) + int tv = get_random_u32_below(max_delay); + + im->tm_running = 1; +- if (!mod_timer(&im->timer, jiffies+tv+2)) +- refcount_inc(&im->refcnt); ++ if (refcount_inc_not_zero(&im->refcnt)) { ++ if (mod_timer(&im->timer, jiffies + tv + 2)) ++ ip_ma_put(im); ++ } + } + + static void igmp_gq_start_timer(struct in_device *in_dev) +-- +2.42.0 + diff --git a/queue-6.6/media-v4l2-subdev-fix-a-64bit-bug.patch b/queue-6.6/media-v4l2-subdev-fix-a-64bit-bug.patch new file mode 100644 index 00000000000..c249f8fefee --- /dev/null +++ b/queue-6.6/media-v4l2-subdev-fix-a-64bit-bug.patch @@ -0,0 +1,46 @@ +From 60de0085943170a49611583a1aeb08a1b781cb0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 10:39:24 +0300 +Subject: media: v4l2-subdev: Fix a 64bit bug + +From: Dan Carpenter + +[ Upstream commit 5d33213fac5929a2e7766c88d78779fd443b0fe8 ] + +The problem is this line here from subdev_do_ioctl(). + + client_cap->capabilities &= ~V4L2_SUBDEV_CLIENT_CAP_STREAMS; + +The "client_cap->capabilities" variable is a u64. The AND operation +is supposed to clear out the V4L2_SUBDEV_CLIENT_CAP_STREAMS flag. But +because it's a 32 bit variable it accidentally clears out the high 32 +bits as well. + +Currently we only use the first bit and none of the upper bits so this +doesn't affect runtime behavior. + +Fixes: f57fa2959244 ("media: v4l2-subdev: Add new ioctl for client capabilities") +Signed-off-by: Dan Carpenter +Reviewed-by: Tomi Valkeinen +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/v4l2-subdev.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/v4l2-subdev.h b/include/uapi/linux/v4l2-subdev.h +index 4a195b68f28f6..b383c2fe0cf35 100644 +--- a/include/uapi/linux/v4l2-subdev.h ++++ b/include/uapi/linux/v4l2-subdev.h +@@ -239,7 +239,7 @@ struct v4l2_subdev_routing { + * set (which is the default), the 'stream' fields will be forced to 0 by the + * kernel. + */ +- #define V4L2_SUBDEV_CLIENT_CAP_STREAMS (1U << 0) ++ #define V4L2_SUBDEV_CLIENT_CAP_STREAMS (1ULL << 0) + + /** + * struct v4l2_subdev_client_capability - Capabilities of the client accessing +-- +2.42.0 + diff --git a/queue-6.6/neighbour-fix-__randomize_layout-crash-in-struct-nei.patch b/queue-6.6/neighbour-fix-__randomize_layout-crash-in-struct-nei.patch new file mode 100644 index 00000000000..1650e8c2ea8 --- /dev/null +++ b/queue-6.6/neighbour-fix-__randomize_layout-crash-in-struct-nei.patch @@ -0,0 +1,50 @@ +From 6ebf707e10dee4d186e46e414fe6d923e60e1aae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Nov 2023 15:33:58 -0600 +Subject: neighbour: Fix __randomize_layout crash in struct neighbour + +From: Gustavo A. R. Silva + +[ Upstream commit 45b3fae4675dc1d4ee2d7aefa19d85ee4f891377 ] + +Previously, one-element and zero-length arrays were treated as true +flexible arrays, even though they are actually "fake" flex arrays. +The __randomize_layout would leave them untouched at the end of the +struct, similarly to proper C99 flex-array members. + +However, this approach changed with commit 1ee60356c2dc ("gcc-plugins: +randstruct: Only warn about true flexible arrays"). Now, only C99 +flexible-array members will remain untouched at the end of the struct, +while one-element and zero-length arrays will be subject to randomization. + +Fix a `__randomize_layout` crash in `struct neighbour` by transforming +zero-length array `primary_key` into a proper C99 flexible-array member. + +Fixes: 1ee60356c2dc ("gcc-plugins: randstruct: Only warn about true flexible arrays") +Closes: https://lore.kernel.org/linux-hardening/20231124102458.GB1503258@e124191.cambridge.arm.com/ +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Kees Cook +Tested-by: Joey Gouly +Link: https://lore.kernel.org/r/ZWJoRsJGnCPdJ3+2@work +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + include/net/neighbour.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/neighbour.h b/include/net/neighbour.h +index 07022bb0d44d4..0d28172193fa6 100644 +--- a/include/net/neighbour.h ++++ b/include/net/neighbour.h +@@ -162,7 +162,7 @@ struct neighbour { + struct rcu_head rcu; + struct net_device *dev; + netdevice_tracker dev_tracker; +- u8 primary_key[0]; ++ u8 primary_key[]; + } __randomize_layout; + + struct neigh_ops { +-- +2.42.0 + diff --git a/queue-6.6/net-dsa-mv88e6xxx-fix-marvell-6350-probe-crash.patch b/queue-6.6/net-dsa-mv88e6xxx-fix-marvell-6350-probe-crash.patch new file mode 100644 index 00000000000..ccf8317c2aa --- /dev/null +++ b/queue-6.6/net-dsa-mv88e6xxx-fix-marvell-6350-probe-crash.patch @@ -0,0 +1,77 @@ +From b4ca02ebf983dc17514738aced7b9171f401981e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 14:15:29 +1000 +Subject: net: dsa: mv88e6xxx: fix marvell 6350 probe crash + +From: Greg Ungerer + +[ Upstream commit a524eabcd72d28425d9db242cf375d0389d74eba ] + +As of commit b92143d4420f ("net: dsa: mv88e6xxx: add infrastructure for +phylink_pcs") probing of a Marvell 88e6350 switch causes a NULL pointer +de-reference like this example: + + ... + mv88e6085 d0072004.mdio-mii:11: switch 0x3710 detected: Marvell 88E6350, revision 2 + 8<--- cut here --- + Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read + [00000000] *pgd=00000000 + Internal error: Oops: 5 [#1] ARM + Modules linked in: + CPU: 0 PID: 8 Comm: kworker/u2:0 Not tainted 6.7.0-rc2-dirty #26 + Hardware name: Marvell Armada 370/XP (Device Tree) + Workqueue: events_unbound deferred_probe_work_func + PC is at mv88e6xxx_port_setup+0x1c/0x44 + LR is at dsa_port_devlink_setup+0x74/0x154 + pc : [] lr : [] psr: a0000013 + sp : c184fce0 ip : c542b8f4 fp : 00000000 + r10: 00000001 r9 : c542a540 r8 : c542bc00 + r7 : c542b838 r6 : c5244580 r5 : 00000005 r4 : c5244580 + r3 : 00000000 r2 : c542b840 r1 : 00000005 r0 : c1a02040 + ... + +The Marvell 6350 switch has no SERDES interface and so has no +corresponding pcs_ops defined for it. But during probing a call is made +to mv88e6xxx_port_setup() which unconditionally expects pcs_ops to exist - +though the presence of the pcs_ops->pcs_init function is optional. + +Modify code to check for pcs_ops first, before checking for and calling +pcs_ops->pcs_init. Modify checking and use of pcs_ops->pcs_teardown +which may potentially suffer the same problem. + +Fixes: b92143d4420f ("net: dsa: mv88e6xxx: add infrastructure for phylink_pcs") +Signed-off-by: Greg Ungerer +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 6d7256ea477a1..dc7f9b99f409f 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3892,7 +3892,8 @@ static int mv88e6xxx_port_setup(struct dsa_switch *ds, int port) + struct mv88e6xxx_chip *chip = ds->priv; + int err; + +- if (chip->info->ops->pcs_ops->pcs_init) { ++ if (chip->info->ops->pcs_ops && ++ chip->info->ops->pcs_ops->pcs_init) { + err = chip->info->ops->pcs_ops->pcs_init(chip, port); + if (err) + return err; +@@ -3907,7 +3908,8 @@ static void mv88e6xxx_port_teardown(struct dsa_switch *ds, int port) + + mv88e6xxx_teardown_devlink_regions_port(ds, port); + +- if (chip->info->ops->pcs_ops->pcs_teardown) ++ if (chip->info->ops->pcs_ops && ++ chip->info->ops->pcs_ops->pcs_teardown) + chip->info->ops->pcs_ops->pcs_teardown(chip, port); + } + +-- +2.42.0 + diff --git a/queue-6.6/net-dsa-mv88e6xxx-fix-marvell-6350-switch-probing.patch b/queue-6.6/net-dsa-mv88e6xxx-fix-marvell-6350-switch-probing.patch new file mode 100644 index 00000000000..319db8d9c0e --- /dev/null +++ b/queue-6.6/net-dsa-mv88e6xxx-fix-marvell-6350-switch-probing.patch @@ -0,0 +1,99 @@ +From 92bcf42a0c3d5c03d85dcc6bfe23c598d7a00fb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 14:15:28 +1000 +Subject: net: dsa: mv88e6xxx: fix marvell 6350 switch probing + +From: Greg Ungerer + +[ Upstream commit b3f1a164c7f742503dc7159011f7ad6b092b660e ] + +As of commit de5c9bf40c45 ("net: phylink: require supported_interfaces to +be filled") Marvell 88e6350 switches fail to be probed: + + ... + mv88e6085 d0072004.mdio-mii:11: switch 0x3710 detected: Marvell 88E6350, revision 2 + mv88e6085 d0072004.mdio-mii:11: phylink: error: empty supported_interfaces + error creating PHYLINK: -22 + mv88e6085: probe of d0072004.mdio-mii:11 failed with error -22 + ... + +The problem stems from the use of mv88e6185_phylink_get_caps() to get +the device capabilities. Create a new dedicated phylink_get_caps for the +6351 family (which the 6350 is one of) to properly support their set of +capabilities. + +According to chip.h the 6351 switch family includes the 6171, 6175, 6350 +and 6351 switches, so update each of these to use the correct +phylink_get_caps. + +Fixes: de5c9bf40c45 ("net: phylink: require supported_interfaces to be filled") +Signed-off-by: Greg Ungerer +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index ab434a77b059a..6d7256ea477a1 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -577,6 +577,18 @@ static void mv88e6250_phylink_get_caps(struct mv88e6xxx_chip *chip, int port, + config->mac_capabilities = MAC_SYM_PAUSE | MAC_10 | MAC_100; + } + ++static void mv88e6351_phylink_get_caps(struct mv88e6xxx_chip *chip, int port, ++ struct phylink_config *config) ++{ ++ unsigned long *supported = config->supported_interfaces; ++ ++ /* Translate the default cmode */ ++ mv88e6xxx_translate_cmode(chip->ports[port].cmode, supported); ++ ++ config->mac_capabilities = MAC_SYM_PAUSE | MAC_10 | MAC_100 | ++ MAC_1000FD; ++} ++ + static int mv88e6352_get_port4_serdes_cmode(struct mv88e6xxx_chip *chip) + { + u16 reg, val; +@@ -4340,7 +4352,7 @@ static const struct mv88e6xxx_ops mv88e6171_ops = { + .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge, + .stu_getnext = mv88e6352_g1_stu_getnext, + .stu_loadpurge = mv88e6352_g1_stu_loadpurge, +- .phylink_get_caps = mv88e6185_phylink_get_caps, ++ .phylink_get_caps = mv88e6351_phylink_get_caps, + }; + + static const struct mv88e6xxx_ops mv88e6172_ops = { +@@ -4440,7 +4452,7 @@ static const struct mv88e6xxx_ops mv88e6175_ops = { + .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge, + .stu_getnext = mv88e6352_g1_stu_getnext, + .stu_loadpurge = mv88e6352_g1_stu_loadpurge, +- .phylink_get_caps = mv88e6185_phylink_get_caps, ++ .phylink_get_caps = mv88e6351_phylink_get_caps, + }; + + static const struct mv88e6xxx_ops mv88e6176_ops = { +@@ -5069,7 +5081,7 @@ static const struct mv88e6xxx_ops mv88e6350_ops = { + .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge, + .stu_getnext = mv88e6352_g1_stu_getnext, + .stu_loadpurge = mv88e6352_g1_stu_loadpurge, +- .phylink_get_caps = mv88e6185_phylink_get_caps, ++ .phylink_get_caps = mv88e6351_phylink_get_caps, + }; + + static const struct mv88e6xxx_ops mv88e6351_ops = { +@@ -5117,7 +5129,7 @@ static const struct mv88e6xxx_ops mv88e6351_ops = { + .stu_loadpurge = mv88e6352_g1_stu_loadpurge, + .avb_ops = &mv88e6352_avb_ops, + .ptp_ops = &mv88e6352_ptp_ops, +- .phylink_get_caps = mv88e6185_phylink_get_caps, ++ .phylink_get_caps = mv88e6351_phylink_get_caps, + }; + + static const struct mv88e6xxx_ops mv88e6352_ops = { +-- +2.42.0 + diff --git a/queue-6.6/net-ravb-check-return-value-of-reset_control_deasser.patch b/queue-6.6/net-ravb-check-return-value-of-reset_control_deasser.patch new file mode 100644 index 00000000000..72b1b85469d --- /dev/null +++ b/queue-6.6/net-ravb-check-return-value-of-reset_control_deasser.patch @@ -0,0 +1,60 @@ +From 77fe6d80dea456cd2768ffba95fae023c25d5a8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 10:04:34 +0200 +Subject: net: ravb: Check return value of reset_control_deassert() + +From: Claudiu Beznea + +[ Upstream commit d8eb6ea4b302e7ff78535c205510e359ac10a0bd ] + +reset_control_deassert() could return an error. Some devices cannot work +if reset signal de-assert operation fails. To avoid this check the return +code of reset_control_deassert() in ravb_probe() and take proper action. + +Along with it, the free_netdev() call from the error path was moved after +reset_control_assert() on its own label (out_free_netdev) to free +netdev in case reset_control_deassert() fails. + +Fixes: 0d13a1a464a0 ("ravb: Add reset support") +Reviewed-by: Sergey Shtylyov +Reviewed-by: Philipp Zabel +Signed-off-by: Claudiu Beznea +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index de12c02c55cbc..f76ccb543838c 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -2654,7 +2654,10 @@ static int ravb_probe(struct platform_device *pdev) + ndev->features = info->net_features; + ndev->hw_features = info->net_hw_features; + +- reset_control_deassert(rstc); ++ error = reset_control_deassert(rstc); ++ if (error) ++ goto out_free_netdev; ++ + pm_runtime_enable(&pdev->dev); + pm_runtime_get_sync(&pdev->dev); + +@@ -2881,11 +2884,11 @@ static int ravb_probe(struct platform_device *pdev) + out_disable_refclk: + clk_disable_unprepare(priv->refclk); + out_release: +- free_netdev(ndev); +- + pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + reset_control_assert(rstc); ++out_free_netdev: ++ free_netdev(ndev); + return error; + } + +-- +2.42.0 + diff --git a/queue-6.6/net-ravb-keep-reverse-order-of-operations-in-ravb_re.patch b/queue-6.6/net-ravb-keep-reverse-order-of-operations-in-ravb_re.patch new file mode 100644 index 00000000000..de6cc873354 --- /dev/null +++ b/queue-6.6/net-ravb-keep-reverse-order-of-operations-in-ravb_re.patch @@ -0,0 +1,141 @@ +From e8fb90959ce6d43f412ef687277b42117c410b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 10:04:39 +0200 +Subject: net: ravb: Keep reverse order of operations in ravb_remove() + +From: Claudiu Beznea + +[ Upstream commit edf9bc396e05081ca281ffb0cd41e44db478ff26 ] + +On RZ/G3S SMARC Carrier II board having RGMII connections b/w Ethernet +MACs and PHYs it has been discovered that doing unbind/bind for ravb +driver in a loop leads to wrong speed and duplex for Ethernet links and +broken connectivity (the connectivity cannot be restored even with +bringing interface down/up). Before doing unbind/bind the Ethernet +interfaces were configured though systemd. The sh instructions used to +do unbind/bind were: + +$ cd /sys/bus/platform/drivers/ravb/ +$ while :; do echo 11c30000.ethernet > unbind ; \ + echo 11c30000.ethernet > bind; done + +It has been discovered that there is a race b/w IOCTLs initialized by +systemd at the response of success binding and the +"ravb_write(ndev, CCC_OPC_RESET, CCC)" call in ravb_remove() as +follows: + +1/ as a result of bind success the user space open/configures the + interfaces tough an IOCTL; the following stack trace has been + identified on RZ/G3S: + +Call trace: +dump_backtrace+0x9c/0x100 +show_stack+0x20/0x38 +dump_stack_lvl+0x48/0x60 +dump_stack+0x18/0x28 +ravb_open+0x70/0xa58 +__dev_open+0xf4/0x1e8 +__dev_change_flags+0x198/0x218 +dev_change_flags+0x2c/0x80 +devinet_ioctl+0x640/0x708 +inet_ioctl+0x1e4/0x200 +sock_do_ioctl+0x50/0x108 +sock_ioctl+0x240/0x358 +__arm64_sys_ioctl+0xb0/0x100 +invoke_syscall+0x50/0x128 +el0_svc_common.constprop.0+0xc8/0xf0 +do_el0_svc+0x24/0x38 +el0_svc+0x34/0xb8 +el0t_64_sync_handler+0xc0/0xc8 +el0t_64_sync+0x190/0x198 + +2/ this call may execute concurrently with ravb_remove() as the + unbind/bind operation was executed in a loop +3/ if the operation mode is changed to RESET (through + ravb_write(ndev, CCC_OPC_RESET, CCC) call in ravb_remove()) + while the above ravb_open() is in progress it may lead to MAC + (or PHY, or MAC-PHY connection, the right point hasn't been identified + at the moment) to be broken, thus the Ethernet connectivity fails to + restore. + +The simple fix for this is to move ravb_write(ndev, CCC_OPC_RESET, CCC)) +after unregister_netdev() to avoid resetting the controller while the +netdev interface is still registered. + +To avoid future issues in ravb_remove(), the patch follows the proper order +of operations in ravb_remove(): reverse order compared with ravb_probe(). +This avoids described races as the IOCTLs as well as unregister_netdev() +(called now at the beginning of ravb_remove()) calls rtnl_lock() before +continuing and IOCTLs check (though devinet_ioctl()) if device is still +registered just after taking the lock: + +int devinet_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr) +{ + // ... + + rtnl_lock(); + + ret = -ENODEV; + dev = __dev_get_by_name(net, ifr->ifr_name); + if (!dev) + goto done; + + // ... +done: + rtnl_unlock(); +out: + return ret; +} + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Reviewed-by: Sergey Shtylyov +Signed-off-by: Claudiu Beznea +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 0b8af7be20fab..bb56cf4090423 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -2903,22 +2903,26 @@ static int ravb_remove(struct platform_device *pdev) + struct ravb_private *priv = netdev_priv(ndev); + const struct ravb_hw_info *info = priv->info; + +- /* Stop PTP Clock driver */ +- if (info->ccc_gac) +- ravb_ptp_stop(ndev); +- +- clk_disable_unprepare(priv->gptp_clk); +- clk_disable_unprepare(priv->refclk); +- +- /* Set reset mode */ +- ravb_write(ndev, CCC_OPC_RESET, CCC); + unregister_netdev(ndev); + if (info->nc_queues) + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); ++ + ravb_mdio_release(priv); ++ ++ /* Stop PTP Clock driver */ ++ if (info->ccc_gac) ++ ravb_ptp_stop(ndev); ++ + dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, + priv->desc_bat_dma); ++ ++ /* Set reset mode */ ++ ravb_write(ndev, CCC_OPC_RESET, CCC); ++ ++ clk_disable_unprepare(priv->gptp_clk); ++ clk_disable_unprepare(priv->refclk); ++ + pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); + reset_control_assert(priv->rstc); +-- +2.42.0 + diff --git a/queue-6.6/net-ravb-make-write-access-to-cxr35-first-before-acc.patch b/queue-6.6/net-ravb-make-write-access-to-cxr35-first-before-acc.patch new file mode 100644 index 00000000000..5934fe2ac60 --- /dev/null +++ b/queue-6.6/net-ravb-make-write-access-to-cxr35-first-before-acc.patch @@ -0,0 +1,81 @@ +From 6b3de2ccb6fbe40fa76a202a009aac6954560498 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 10:04:36 +0200 +Subject: net: ravb: Make write access to CXR35 first before accessing other + EMAC registers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Claudiu Beznea + +[ Upstream commit d78c0ced60d5e2f8b5a4a0468a5c400b24aeadf2 ] + +Hardware manual of RZ/G3S (and RZ/G2L) specifies the following on the +description of CXR35 register (chapter "PHY interface select register +(CXR35)"): "After release reset, make write-access to this register before +making write-access to other registers (except MDIOMOD). Even if not need +to change the value of this register, make write-access to this register +at least one time. Because RGMII/MII MODE is recognized by accessing this +register". + +The setup procedure for EMAC module (chapter "Setup procedure" of RZ/G3S, +RZ/G2L manuals) specifies the E-MAC.CXR35 register is the first EMAC +register that is to be configured. + +Note [A] from chapter "PHY interface select register (CXR35)" specifies +the following: +[A] The case which CXR35 SEL_XMII is used for the selection of RGMII/MII +in APB Clock 100 MHz. +(1) To use RGMII interface, Set ‘H’03E8_0000’ to this register. +(2) To use MII interface, Set ‘H’03E8_0002’ to this register. + +Take into account these indication. + +Fixes: 1089877ada8d ("ravb: Add RZ/G2L MII interface support") +Reviewed-by: Sergey Shtylyov +Signed-off-by: Claudiu Beznea +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index cdcac7d1f93a0..9bf938eed66bd 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -515,6 +515,15 @@ static void ravb_emac_init_gbeth(struct net_device *ndev) + { + struct ravb_private *priv = netdev_priv(ndev); + ++ if (priv->phy_interface == PHY_INTERFACE_MODE_MII) { ++ ravb_write(ndev, (1000 << 16) | CXR35_SEL_XMII_MII, CXR35); ++ ravb_modify(ndev, CXR31, CXR31_SEL_LINK0 | CXR31_SEL_LINK1, 0); ++ } else { ++ ravb_write(ndev, (1000 << 16) | CXR35_SEL_XMII_RGMII, CXR35); ++ ravb_modify(ndev, CXR31, CXR31_SEL_LINK0 | CXR31_SEL_LINK1, ++ CXR31_SEL_LINK0); ++ } ++ + /* Receive frame limit set register */ + ravb_write(ndev, GBETH_RX_BUFF_MAX + ETH_FCS_LEN, RFLR); + +@@ -537,14 +546,6 @@ static void ravb_emac_init_gbeth(struct net_device *ndev) + + /* E-MAC interrupt enable register */ + ravb_write(ndev, ECSIPR_ICDIP, ECSIPR); +- +- if (priv->phy_interface == PHY_INTERFACE_MODE_MII) { +- ravb_modify(ndev, CXR31, CXR31_SEL_LINK0 | CXR31_SEL_LINK1, 0); +- ravb_write(ndev, (1000 << 16) | CXR35_SEL_XMII_MII, CXR35); +- } else { +- ravb_modify(ndev, CXR31, CXR31_SEL_LINK0 | CXR31_SEL_LINK1, +- CXR31_SEL_LINK0); +- } + } + + static void ravb_emac_init_rcar(struct net_device *ndev) +-- +2.42.0 + diff --git a/queue-6.6/net-ravb-start-tx-queues-after-hw-initialization-suc.patch b/queue-6.6/net-ravb-start-tx-queues-after-hw-initialization-suc.patch new file mode 100644 index 00000000000..07bbb1b5c93 --- /dev/null +++ b/queue-6.6/net-ravb-start-tx-queues-after-hw-initialization-suc.patch @@ -0,0 +1,46 @@ +From 4cc4b134fe4ce112851094be4c45130702611ce5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 10:04:37 +0200 +Subject: net: ravb: Start TX queues after HW initialization succeeded + +From: Claudiu Beznea + +[ Upstream commit 6f32c086602050fc11157adeafaa1c1eb393f0af ] + +ravb_phy_start() may fail. If that happens, the TX queues will remain +started. Thus, move the netif_tx_start_all_queues() after PHY is +successfully initialized. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Reviewed-by: Sergey Shtylyov +Signed-off-by: Claudiu Beznea +Reviewed-by: Kalesh AP +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 9bf938eed66bd..1b35cc216d386 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1812,13 +1812,13 @@ static int ravb_open(struct net_device *ndev) + if (info->gptp) + ravb_ptp_init(ndev, priv->pdev); + +- netif_tx_start_all_queues(ndev); +- + /* PHY control start */ + error = ravb_phy_start(ndev); + if (error) + goto out_ptp_stop; + ++ netif_tx_start_all_queues(ndev); ++ + return 0; + + out_ptp_stop: +-- +2.42.0 + diff --git a/queue-6.6/net-ravb-stop-dma-in-case-of-failures-on-ravb_open.patch b/queue-6.6/net-ravb-stop-dma-in-case-of-failures-on-ravb_open.patch new file mode 100644 index 00000000000..73524a765fd --- /dev/null +++ b/queue-6.6/net-ravb-stop-dma-in-case-of-failures-on-ravb_open.patch @@ -0,0 +1,37 @@ +From 80ed341b3b89ca684ae0ecf61e73bb4aed2de982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 10:04:38 +0200 +Subject: net: ravb: Stop DMA in case of failures on ravb_open() + +From: Claudiu Beznea + +[ Upstream commit eac16a733427ba0de2449ffc7bd3da32ddb65cb7 ] + +In case ravb_phy_start() returns with error the settings applied in +ravb_dmac_init() are not reverted (e.g. config mode). For this call +ravb_stop_dma() on failure path of ravb_open(). + +Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver") +Reviewed-by: Sergey Shtylyov +Signed-off-by: Claudiu Beznea +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 1b35cc216d386..0b8af7be20fab 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1825,6 +1825,7 @@ static int ravb_open(struct net_device *ndev) + /* Stop PTP Clock driver */ + if (info->gptp) + ravb_ptp_stop(ndev); ++ ravb_stop_dma(ndev); + out_free_irq_mgmta: + if (!info->multi_irqs) + goto out_free_irq; +-- +2.42.0 + diff --git a/queue-6.6/net-ravb-use-pm_runtime_resume_and_get.patch b/queue-6.6/net-ravb-use-pm_runtime_resume_and_get.patch new file mode 100644 index 00000000000..b4863311731 --- /dev/null +++ b/queue-6.6/net-ravb-use-pm_runtime_resume_and_get.patch @@ -0,0 +1,48 @@ +From 407bdca097bf3ffa2b8504b1305b3fc55269f025 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 10:04:35 +0200 +Subject: net: ravb: Use pm_runtime_resume_and_get() + +From: Claudiu Beznea + +[ Upstream commit 88b74831faaee455c2af380382d979fc38e79270 ] + +pm_runtime_get_sync() may return an error. In case it returns with an error +dev->power.usage_count needs to be decremented. pm_runtime_resume_and_get() +takes care of this. Thus use it. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Reviewed-by: Sergey Shtylyov +Signed-off-by: Claudiu Beznea +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index f76ccb543838c..cdcac7d1f93a0 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -2659,7 +2659,9 @@ static int ravb_probe(struct platform_device *pdev) + goto out_free_netdev; + + pm_runtime_enable(&pdev->dev); +- pm_runtime_get_sync(&pdev->dev); ++ error = pm_runtime_resume_and_get(&pdev->dev); ++ if (error < 0) ++ goto out_rpm_disable; + + if (info->multi_irqs) { + if (info->err_mgmt_irqs) +@@ -2885,6 +2887,7 @@ static int ravb_probe(struct platform_device *pdev) + clk_disable_unprepare(priv->refclk); + out_release: + pm_runtime_put(&pdev->dev); ++out_rpm_disable: + pm_runtime_disable(&pdev->dev); + reset_control_assert(rstc); + out_free_netdev: +-- +2.42.0 + diff --git a/queue-6.6/net-rswitch-fix-missing-dev_kfree_skb_any-in-error-p.patch b/queue-6.6/net-rswitch-fix-missing-dev_kfree_skb_any-in-error-p.patch new file mode 100644 index 00000000000..dbab6ff287d --- /dev/null +++ b/queue-6.6/net-rswitch-fix-missing-dev_kfree_skb_any-in-error-p.patch @@ -0,0 +1,69 @@ +From 9a5597f668d436235d103d24dab3bf1a99f7b7ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 14:11:43 +0900 +Subject: net: rswitch: Fix missing dev_kfree_skb_any() in error path + +From: Yoshihiro Shimoda + +[ Upstream commit 782486af9b5b76493012711413c141509ac45dec ] + +Before returning the rswitch_start_xmit() in the error path, +dev_kfree_skb_any() should be called. So, fix it. + +Fixes: 33f5d733b589 ("net: renesas: rswitch: Improve TX timestamp accuracy") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Wojciech Drewek +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/rswitch.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c +index 3ccf93184c9b2..ae9d8722b76f7 100644 +--- a/drivers/net/ethernet/renesas/rswitch.c ++++ b/drivers/net/ethernet/renesas/rswitch.c +@@ -1514,10 +1514,8 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd + return ret; + + dma_addr = dma_map_single(ndev->dev.parent, skb->data, skb->len, DMA_TO_DEVICE); +- if (dma_mapping_error(ndev->dev.parent, dma_addr)) { +- dev_kfree_skb_any(skb); +- return ret; +- } ++ if (dma_mapping_error(ndev->dev.parent, dma_addr)) ++ goto err_kfree; + + gq->skbs[gq->cur] = skb; + desc = &gq->tx_ring[gq->cur]; +@@ -1530,10 +1528,8 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd + struct rswitch_gwca_ts_info *ts_info; + + ts_info = kzalloc(sizeof(*ts_info), GFP_ATOMIC); +- if (!ts_info) { +- dma_unmap_single(ndev->dev.parent, dma_addr, skb->len, DMA_TO_DEVICE); +- return ret; +- } ++ if (!ts_info) ++ goto err_unmap; + + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; + rdev->ts_tag++; +@@ -1555,6 +1551,14 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd + gq->cur = rswitch_next_queue_index(gq, true, 1); + rswitch_modify(rdev->addr, GWTRC(gq->index), 0, BIT(gq->index % 32)); + ++ return ret; ++ ++err_unmap: ++ dma_unmap_single(ndev->dev.parent, dma_addr, skb->len, DMA_TO_DEVICE); ++ ++err_kfree: ++ dev_kfree_skb_any(skb); ++ + return ret; + } + +-- +2.42.0 + diff --git a/queue-6.6/net-rswitch-fix-return-value-in-rswitch_start_xmit.patch b/queue-6.6/net-rswitch-fix-return-value-in-rswitch_start_xmit.patch new file mode 100644 index 00000000000..f8232c12ab6 --- /dev/null +++ b/queue-6.6/net-rswitch-fix-return-value-in-rswitch_start_xmit.patch @@ -0,0 +1,37 @@ +From 6ab17094a71c749d1aa528bc27ffc2d4ec3cf7e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 14:11:42 +0900 +Subject: net: rswitch: Fix return value in rswitch_start_xmit() + +From: Yoshihiro Shimoda + +[ Upstream commit 1aaef8634a20b322c82e84f12a9b6aec1e2fd4fa ] + +This .ndo_start_xmit() function should return netdev_tx_t value, +not -ENOMEM. So, fix it. + +Fixes: 33f5d733b589 ("net: renesas: rswitch: Improve TX timestamp accuracy") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Wojciech Drewek +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/rswitch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c +index 898f22aa796e2..3ccf93184c9b2 100644 +--- a/drivers/net/ethernet/renesas/rswitch.c ++++ b/drivers/net/ethernet/renesas/rswitch.c +@@ -1532,7 +1532,7 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd + ts_info = kzalloc(sizeof(*ts_info), GFP_ATOMIC); + if (!ts_info) { + dma_unmap_single(ndev->dev.parent, dma_addr, skb->len, DMA_TO_DEVICE); +- return -ENOMEM; ++ return ret; + } + + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; +-- +2.42.0 + diff --git a/queue-6.6/net-rswitch-fix-type-of-ret-in-rswitch_start_xmit.patch b/queue-6.6/net-rswitch-fix-type-of-ret-in-rswitch_start_xmit.patch new file mode 100644 index 00000000000..adc9aee838a --- /dev/null +++ b/queue-6.6/net-rswitch-fix-type-of-ret-in-rswitch_start_xmit.patch @@ -0,0 +1,38 @@ +From 9017398f9dc06004e05e030c582da78d2483f3d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 14:11:41 +0900 +Subject: net: rswitch: Fix type of ret in rswitch_start_xmit() + +From: Yoshihiro Shimoda + +[ Upstream commit 109b25d13e0054337860d44841b990d11b32d262 ] + +The type of ret in rswitch_start_xmit() should be netdev_tx_t. So, +fix it. + +Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Wojciech Drewek +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/rswitch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c +index 0fc0b6bea7530..898f22aa796e2 100644 +--- a/drivers/net/ethernet/renesas/rswitch.c ++++ b/drivers/net/ethernet/renesas/rswitch.c +@@ -1501,8 +1501,8 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd + { + struct rswitch_device *rdev = netdev_priv(ndev); + struct rswitch_gwca_queue *gq = rdev->tx_queue; ++ netdev_tx_t ret = NETDEV_TX_OK; + struct rswitch_ext_desc *desc; +- int ret = NETDEV_TX_OK; + dma_addr_t dma_addr; + + if (rswitch_get_num_cur_queues(gq) >= gq->ring_size - 1) { +-- +2.42.0 + diff --git a/queue-6.6/net-stmmac-xgmac-disable-fpe-mmc-interrupts.patch b/queue-6.6/net-stmmac-xgmac-disable-fpe-mmc-interrupts.patch new file mode 100644 index 00000000000..d8a1738a57c --- /dev/null +++ b/queue-6.6/net-stmmac-xgmac-disable-fpe-mmc-interrupts.patch @@ -0,0 +1,54 @@ +From c627768e70aab852677b744701be0a2c65d611bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Nov 2023 14:01:26 +0800 +Subject: net: stmmac: xgmac: Disable FPE MMC interrupts + +From: Furong Xu <0x1207@gmail.com> + +[ Upstream commit e54d628a2721bfbb002c19f6e8ca6746cec7640f ] + +Commit aeb18dd07692 ("net: stmmac: xgmac: Disable MMC interrupts +by default") tries to disable MMC interrupts to avoid a storm of +unhandled interrupts, but leaves the FPE(Frame Preemption) MMC +interrupts enabled, FPE MMC interrupts can cause the same problem. +Now we mask FPE TX and RX interrupts to disable all MMC interrupts. + +Fixes: aeb18dd07692 ("net: stmmac: xgmac: Disable MMC interrupts by default") +Reviewed-by: Larysa Zaremba +Signed-off-by: Furong Xu <0x1207@gmail.com> +Reviewed-by: Serge Semin +Reviewed-by: Wojciech Drewek +Link: https://lore.kernel.org/r/20231125060126.2328690-1-0x1207@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c +index ea4910ae0921a..6a7c1d325c464 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c +@@ -177,8 +177,10 @@ + #define MMC_XGMAC_RX_DISCARD_OCT_GB 0x1b4 + #define MMC_XGMAC_RX_ALIGN_ERR_PKT 0x1bc + ++#define MMC_XGMAC_TX_FPE_INTR_MASK 0x204 + #define MMC_XGMAC_TX_FPE_FRAG 0x208 + #define MMC_XGMAC_TX_HOLD_REQ 0x20c ++#define MMC_XGMAC_RX_FPE_INTR_MASK 0x224 + #define MMC_XGMAC_RX_PKT_ASSEMBLY_ERR 0x228 + #define MMC_XGMAC_RX_PKT_SMD_ERR 0x22c + #define MMC_XGMAC_RX_PKT_ASSEMBLY_OK 0x230 +@@ -352,6 +354,8 @@ static void dwxgmac_mmc_intr_all_mask(void __iomem *mmcaddr) + { + writel(0x0, mmcaddr + MMC_RX_INTR_MASK); + writel(0x0, mmcaddr + MMC_TX_INTR_MASK); ++ writel(MMC_DEFAULT_MASK, mmcaddr + MMC_XGMAC_TX_FPE_INTR_MASK); ++ writel(MMC_DEFAULT_MASK, mmcaddr + MMC_XGMAC_RX_FPE_INTR_MASK); + writel(MMC_DEFAULT_MASK, mmcaddr + MMC_XGMAC_RX_IPC_INTR_MASK); + } + +-- +2.42.0 + diff --git a/queue-6.6/netdevsim-don-t-accept-device-bound-programs.patch b/queue-6.6/netdevsim-don-t-accept-device-bound-programs.patch new file mode 100644 index 00000000000..fb385ee762f --- /dev/null +++ b/queue-6.6/netdevsim-don-t-accept-device-bound-programs.patch @@ -0,0 +1,55 @@ +From f5db45b80d5dd82a21d88afa3bf8c8b74665641b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Nov 2023 20:54:52 -0800 +Subject: netdevsim: Don't accept device bound programs + +From: Stanislav Fomichev + +[ Upstream commit c0c6bde586c7dce82719b4ff32a2db6af9ee3d65 ] + +Commit 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") introduced +device-bound programs by largely reusing existing offloading infrastructure. +This changed the semantics of 'prog->aux->offload' a bit. Now, it's non-NULL +for both offloaded and device-bound programs. + +Instead of looking at 'prog->aux->offload' let's call bpf_prog_is_offloaded +which should be true iff the program is offloaded and not merely device-bound. + +Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") +Reported-by: syzbot+44c2416196b7c607f226@syzkaller.appspotmail.com +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Reviewed-by: Jakub Kicinski +Cc: Dipendra Khadka +Link: https://lore.kernel.org/bpf/20231114045453.1816995-2-sdf@google.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/bpf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c +index f60eb97e3a627..608953d4f98da 100644 +--- a/drivers/net/netdevsim/bpf.c ++++ b/drivers/net/netdevsim/bpf.c +@@ -93,7 +93,7 @@ static void nsim_prog_set_loaded(struct bpf_prog *prog, bool loaded) + { + struct nsim_bpf_bound_prog *state; + +- if (!prog || !prog->aux->offload) ++ if (!prog || !bpf_prog_is_offloaded(prog->aux)) + return; + + state = prog->aux->offload->dev_priv; +@@ -311,7 +311,7 @@ nsim_setup_prog_hw_checks(struct netdevsim *ns, struct netdev_bpf *bpf) + if (!bpf->prog) + return 0; + +- if (!bpf->prog->aux->offload) { ++ if (!bpf_prog_is_offloaded(bpf->prog->aux)) { + NSIM_EA(bpf->extack, "xdpoffload of non-bound program"); + return -EINVAL; + } +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-af-fix-possible-buffer-overflow.patch b/queue-6.6/octeontx2-af-fix-possible-buffer-overflow.patch new file mode 100644 index 00000000000..91042a009ad --- /dev/null +++ b/queue-6.6/octeontx2-af-fix-possible-buffer-overflow.patch @@ -0,0 +1,55 @@ +From 6ac0d2ef2f3c4900753c603eb5f18fcfe223436e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Nov 2023 00:08:02 +0300 +Subject: octeontx2-af: Fix possible buffer overflow + +From: Elena Salomatkina + +[ Upstream commit ad31c629ca3c87f6d557488c1f9faaebfbcd203c ] + +A loop in rvu_mbox_handler_nix_bandprof_free() contains +a break if (idx == MAX_BANDPROF_PER_PFFUNC), +but if idx may reach MAX_BANDPROF_PER_PFFUNC +buffer '(*req->prof_idx)[layer]' overflow happens before that check. + +The patch moves the break to the +beginning of the loop. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: e8e095b3b370 ("octeontx2-af: cn10k: Bandwidth profiles config support"). +Signed-off-by: Elena Salomatkina +Reviewed-by: Simon Horman +Reviewed-by: Subbaraya Sundeep +Link: https://lore.kernel.org/r/20231124210802.109763-1-elena.salomatkina.cmc@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 23c2f2ed2fb83..c112c71ff576f 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -5505,6 +5505,8 @@ int rvu_mbox_handler_nix_bandprof_free(struct rvu *rvu, + + ipolicer = &nix_hw->ipolicer[layer]; + for (idx = 0; idx < req->prof_count[layer]; idx++) { ++ if (idx == MAX_BANDPROF_PER_PFFUNC) ++ break; + prof_idx = req->prof_idx[layer][idx]; + if (prof_idx >= ipolicer->band_prof.max || + ipolicer->pfvf_map[prof_idx] != pcifunc) +@@ -5518,8 +5520,6 @@ int rvu_mbox_handler_nix_bandprof_free(struct rvu *rvu, + ipolicer->pfvf_map[prof_idx] = 0x00; + ipolicer->match_id[prof_idx] = 0; + rvu_free_rsrc(&ipolicer->band_prof, prof_idx); +- if (idx == MAX_BANDPROF_PER_PFFUNC) +- break; + } + } + mutex_unlock(&rvu->rsrc_lock); +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-pf-fix-adding-mbox-work-queue-entry-when-n.patch b/queue-6.6/octeontx2-pf-fix-adding-mbox-work-queue-entry-when-n.patch new file mode 100644 index 00000000000..a2342788c2e --- /dev/null +++ b/queue-6.6/octeontx2-pf-fix-adding-mbox-work-queue-entry-when-n.patch @@ -0,0 +1,51 @@ +From 9843c88991b7f9fc73e7166bad0b9f2deed2821a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Nov 2023 22:04:02 +0530 +Subject: octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64 + +From: Geetha sowjanya + +[ Upstream commit 51597219e0cd5157401d4d0ccb5daa4d9961676f ] + +When more than 64 VFs are enabled for a PF then mbox communication +between VF and PF is not working as mbox work queueing for few VFs +are skipped due to wrong calculation of VF numbers. + +Fixes: d424b6c02415 ("octeontx2-pf: Enable SRIOV and added VF mbox handling") +Signed-off-by: Geetha sowjanya +Signed-off-by: Subbaraya Sundeep +Link: https://lore.kernel.org/r/1700930042-5400-1-git-send-email-sbhatta@marvell.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index ba95ac9132746..6d56fc1918455 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -566,7 +566,9 @@ static irqreturn_t otx2_pfvf_mbox_intr_handler(int irq, void *pf_irq) + otx2_write64(pf, RVU_PF_VFPF_MBOX_INTX(1), intr); + otx2_queue_work(mbox, pf->mbox_pfvf_wq, 64, vfs, intr, + TYPE_PFVF); +- vfs -= 64; ++ if (intr) ++ trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr); ++ vfs = 64; + } + + intr = otx2_read64(pf, RVU_PF_VFPF_MBOX_INTX(0)); +@@ -574,7 +576,8 @@ static irqreturn_t otx2_pfvf_mbox_intr_handler(int irq, void *pf_irq) + + otx2_queue_work(mbox, pf->mbox_pfvf_wq, 0, vfs, intr, TYPE_PFVF); + +- trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr); ++ if (intr) ++ trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr); + + return IRQ_HANDLED; + } +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-pf-restore-tc-ingress-police-rules-when-in.patch b/queue-6.6/octeontx2-pf-restore-tc-ingress-police-rules-when-in.patch new file mode 100644 index 00000000000..11d396e7801 --- /dev/null +++ b/queue-6.6/octeontx2-pf-restore-tc-ingress-police-rules-when-in.patch @@ -0,0 +1,263 @@ +From 9e0f2a180653b75f56b74b1f51f5e5922a9c6662 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Nov 2023 22:06:57 +0530 +Subject: octeontx2-pf: Restore TC ingress police rules when interface is up + +From: Subbaraya Sundeep + +[ Upstream commit fd7f98b2e12a3d96a92bde6640657ec7116f4372 ] + +TC ingress policer rules depends on interface receive queue +contexts since the bandwidth profiles are attached to RQ +contexts. When an interface is brought down all the queue +contexts are freed. This in turn frees bandwidth profiles in +hardware causing ingress police rules non-functional after +the interface is brought up. Fix this by applying all the ingress +police rules config to hardware in otx2_open. Also allow +adding ingress rules only when interface is running +since no contexts exist for the interface when it is down. + +Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower") +Signed-off-by: Subbaraya Sundeep +Link: https://lore.kernel.org/r/1700930217-5707-1-git-send-email-sbhatta@marvell.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/nic/cn10k.c | 3 + + .../marvell/octeontx2/nic/otx2_common.h | 2 + + .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 + + .../ethernet/marvell/octeontx2/nic/otx2_tc.c | 120 ++++++++++++++---- + 4 files changed, 102 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c +index a4a258da8dd59..c1c99d7054f87 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c +@@ -450,6 +450,9 @@ int cn10k_set_ipolicer_rate(struct otx2_nic *pfvf, u16 profile, + aq->prof.pebs_mantissa = 0; + aq->prof_mask.pebs_mantissa = 0xFF; + ++ aq->prof.hl_en = 0; ++ aq->prof_mask.hl_en = 1; ++ + /* Fill AQ info */ + aq->qidx = profile; + aq->ctype = NIX_AQ_CTYPE_BANDPROF; +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +index e7c69b57147e0..06910307085ef 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +@@ -1070,6 +1070,8 @@ int otx2_init_tc(struct otx2_nic *nic); + void otx2_shutdown_tc(struct otx2_nic *nic); + int otx2_setup_tc(struct net_device *netdev, enum tc_setup_type type, + void *type_data); ++void otx2_tc_apply_ingress_police_rules(struct otx2_nic *nic); ++ + /* CGX/RPM DMAC filters support */ + int otx2_dmacflt_get_max_cnt(struct otx2_nic *pf); + int otx2_dmacflt_add(struct otx2_nic *pf, const u8 *mac, u32 bit_pos); +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 6d56fc1918455..532e324bdcc8e 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1873,6 +1873,8 @@ int otx2_open(struct net_device *netdev) + if (pf->flags & OTX2_FLAG_DMACFLTR_SUPPORT) + otx2_dmacflt_reinstall_flows(pf); + ++ otx2_tc_apply_ingress_police_rules(pf); ++ + err = otx2_rxtx_enable(pf, true); + /* If a mbox communication error happens at this point then interface + * will end up in a state such that it is in down state but hardware +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +index fab9d85bfb371..423ce54eaea69 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +@@ -45,6 +45,9 @@ struct otx2_tc_flow { + bool is_act_police; + u32 prio; + struct npc_install_flow_req req; ++ u64 rate; ++ u32 burst; ++ bool is_pps; + }; + + static void otx2_get_egress_burst_cfg(struct otx2_nic *nic, u32 burst, +@@ -282,21 +285,10 @@ static int otx2_tc_egress_matchall_delete(struct otx2_nic *nic, + return err; + } + +-static int otx2_tc_act_set_police(struct otx2_nic *nic, +- struct otx2_tc_flow *node, +- struct flow_cls_offload *f, +- u64 rate, u32 burst, u32 mark, +- struct npc_install_flow_req *req, bool pps) ++static int otx2_tc_act_set_hw_police(struct otx2_nic *nic, ++ struct otx2_tc_flow *node) + { +- struct netlink_ext_ack *extack = f->common.extack; +- struct otx2_hw *hw = &nic->hw; +- int rq_idx, rc; +- +- rq_idx = find_first_zero_bit(&nic->rq_bmap, hw->rx_queues); +- if (rq_idx >= hw->rx_queues) { +- NL_SET_ERR_MSG_MOD(extack, "Police action rules exceeded"); +- return -EINVAL; +- } ++ int rc; + + mutex_lock(&nic->mbox.lock); + +@@ -306,23 +298,17 @@ static int otx2_tc_act_set_police(struct otx2_nic *nic, + return rc; + } + +- rc = cn10k_set_ipolicer_rate(nic, node->leaf_profile, burst, rate, pps); ++ rc = cn10k_set_ipolicer_rate(nic, node->leaf_profile, ++ node->burst, node->rate, node->is_pps); + if (rc) + goto free_leaf; + +- rc = cn10k_map_unmap_rq_policer(nic, rq_idx, node->leaf_profile, true); ++ rc = cn10k_map_unmap_rq_policer(nic, node->rq, node->leaf_profile, true); + if (rc) + goto free_leaf; + + mutex_unlock(&nic->mbox.lock); + +- req->match_id = mark & 0xFFFFULL; +- req->index = rq_idx; +- req->op = NIX_RX_ACTIONOP_UCAST; +- set_bit(rq_idx, &nic->rq_bmap); +- node->is_act_police = true; +- node->rq = rq_idx; +- + return 0; + + free_leaf: +@@ -334,6 +320,39 @@ static int otx2_tc_act_set_police(struct otx2_nic *nic, + return rc; + } + ++static int otx2_tc_act_set_police(struct otx2_nic *nic, ++ struct otx2_tc_flow *node, ++ struct flow_cls_offload *f, ++ u64 rate, u32 burst, u32 mark, ++ struct npc_install_flow_req *req, bool pps) ++{ ++ struct netlink_ext_ack *extack = f->common.extack; ++ struct otx2_hw *hw = &nic->hw; ++ int rq_idx, rc; ++ ++ rq_idx = find_first_zero_bit(&nic->rq_bmap, hw->rx_queues); ++ if (rq_idx >= hw->rx_queues) { ++ NL_SET_ERR_MSG_MOD(extack, "Police action rules exceeded"); ++ return -EINVAL; ++ } ++ ++ req->match_id = mark & 0xFFFFULL; ++ req->index = rq_idx; ++ req->op = NIX_RX_ACTIONOP_UCAST; ++ ++ node->is_act_police = true; ++ node->rq = rq_idx; ++ node->burst = burst; ++ node->rate = rate; ++ node->is_pps = pps; ++ ++ rc = otx2_tc_act_set_hw_police(nic, node); ++ if (!rc) ++ set_bit(rq_idx, &nic->rq_bmap); ++ ++ return rc; ++} ++ + static int otx2_tc_parse_actions(struct otx2_nic *nic, + struct flow_action *flow_action, + struct npc_install_flow_req *req, +@@ -986,6 +1005,11 @@ static int otx2_tc_del_flow(struct otx2_nic *nic, + } + + if (flow_node->is_act_police) { ++ __clear_bit(flow_node->rq, &nic->rq_bmap); ++ ++ if (nic->flags & OTX2_FLAG_INTF_DOWN) ++ goto free_mcam_flow; ++ + mutex_lock(&nic->mbox.lock); + + err = cn10k_map_unmap_rq_policer(nic, flow_node->rq, +@@ -1001,11 +1025,10 @@ static int otx2_tc_del_flow(struct otx2_nic *nic, + "Unable to free leaf bandwidth profile(%d)\n", + flow_node->leaf_profile); + +- __clear_bit(flow_node->rq, &nic->rq_bmap); +- + mutex_unlock(&nic->mbox.lock); + } + ++free_mcam_flow: + otx2_del_mcam_flow_entry(nic, flow_node->entry, NULL); + otx2_tc_update_mcam_table(nic, flow_cfg, flow_node, false); + kfree_rcu(flow_node, rcu); +@@ -1025,6 +1048,11 @@ static int otx2_tc_add_flow(struct otx2_nic *nic, + if (!(nic->flags & OTX2_FLAG_TC_FLOWER_SUPPORT)) + return -ENOMEM; + ++ if (nic->flags & OTX2_FLAG_INTF_DOWN) { ++ NL_SET_ERR_MSG_MOD(extack, "Interface not initialized"); ++ return -EINVAL; ++ } ++ + if (flow_cfg->nr_flows == flow_cfg->max_flows) { + NL_SET_ERR_MSG_MOD(extack, + "Free MCAM entry not available to add the flow"); +@@ -1384,3 +1412,45 @@ void otx2_shutdown_tc(struct otx2_nic *nic) + otx2_destroy_tc_flow_list(nic); + } + EXPORT_SYMBOL(otx2_shutdown_tc); ++ ++static void otx2_tc_config_ingress_rule(struct otx2_nic *nic, ++ struct otx2_tc_flow *node) ++{ ++ struct npc_install_flow_req *req; ++ ++ if (otx2_tc_act_set_hw_police(nic, node)) ++ return; ++ ++ mutex_lock(&nic->mbox.lock); ++ ++ req = otx2_mbox_alloc_msg_npc_install_flow(&nic->mbox); ++ if (!req) ++ goto err; ++ ++ memcpy(req, &node->req, sizeof(struct npc_install_flow_req)); ++ ++ if (otx2_sync_mbox_msg(&nic->mbox)) ++ netdev_err(nic->netdev, ++ "Failed to install MCAM flow entry for ingress rule"); ++err: ++ mutex_unlock(&nic->mbox.lock); ++} ++ ++void otx2_tc_apply_ingress_police_rules(struct otx2_nic *nic) ++{ ++ struct otx2_flow_config *flow_cfg = nic->flow_cfg; ++ struct otx2_tc_flow *node; ++ ++ /* If any ingress policer rules exist for the interface then ++ * apply those rules. Ingress policer rules depend on bandwidth ++ * profiles linked to the receive queues. Since no receive queues ++ * exist when interface is down, ingress policer rules are stored ++ * and configured in hardware after all receive queues are allocated ++ * in otx2_open. ++ */ ++ list_for_each_entry(node, &flow_cfg->flow_list_tc, list) { ++ if (node->is_act_police) ++ otx2_tc_config_ingress_rule(nic, node); ++ } ++} ++EXPORT_SYMBOL(otx2_tc_apply_ingress_police_rules); +-- +2.42.0 + diff --git a/queue-6.6/pinctrl-stm32-add-check-for-devm_kcalloc.patch b/queue-6.6/pinctrl-stm32-add-check-for-devm_kcalloc.patch new file mode 100644 index 00000000000..970e81d02b3 --- /dev/null +++ b/queue-6.6/pinctrl-stm32-add-check-for-devm_kcalloc.patch @@ -0,0 +1,41 @@ +From 5c231d9d6795636f33b349b62b70a3e67976111c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Oct 2023 08:08:07 +0000 +Subject: pinctrl: stm32: Add check for devm_kcalloc + +From: Chen Ni + +[ Upstream commit b0eeba527e704d6023a6cd9103f929226e326b03 ] + +Add check for the return value of devm_kcalloc() and return the error +if it fails in order to avoid NULL pointer dereference. + +Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names") +Signed-off-by: Chen Ni +Acked-by: Valentin Caron +Link: https://lore.kernel.org/r/20231031080807.3600656-1-nichen@iscas.ac.cn +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index a73385a431de9..419eca49ccecb 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -1378,6 +1378,11 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode + } + + names = devm_kcalloc(dev, npins, sizeof(char *), GFP_KERNEL); ++ if (!names) { ++ err = -ENOMEM; ++ goto err_clk; ++ } ++ + for (i = 0; i < npins; i++) { + stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i); + if (stm32_pin && stm32_pin->pin.name) +-- +2.42.0 + diff --git a/queue-6.6/pinctrl-stm32-fix-array-read-out-of-bound.patch b/queue-6.6/pinctrl-stm32-fix-array-read-out-of-bound.patch new file mode 100644 index 00000000000..1365d0f36b7 --- /dev/null +++ b/queue-6.6/pinctrl-stm32-fix-array-read-out-of-bound.patch @@ -0,0 +1,46 @@ +From 1fefc60e7041a503dee13ae5fb493e73369a6ae5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Nov 2023 12:05:20 +0100 +Subject: pinctrl: stm32: fix array read out of bound + +From: Antonio Borneo + +[ Upstream commit edd48fd9d45370d6c8ba0dd834fcc51ff688cc87 ] + +The existing code does not verify if the "tentative" index exceeds +the size of the array, causing out of bound read. +Issue identified with kasan. + +Check the index before using it. + +Signed-off-by: Antonio Borneo +Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names") +Link: https://lore.kernel.org/r/20231107110520.4449-1-antonio.borneo@foss.st.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index 419eca49ccecb..346a31f31bba8 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -1283,9 +1283,11 @@ static struct stm32_desc_pin *stm32_pctrl_get_desc_pin_from_gpio(struct stm32_pi + int i; + + /* With few exceptions (e.g. bank 'Z'), pin number matches with pin index in array */ +- pin_desc = pctl->pins + stm32_pin_nb; +- if (pin_desc->pin.number == stm32_pin_nb) +- return pin_desc; ++ if (stm32_pin_nb < pctl->npins) { ++ pin_desc = pctl->pins + stm32_pin_nb; ++ if (pin_desc->pin.number == stm32_pin_nb) ++ return pin_desc; ++ } + + /* Otherwise, loop all array to find the pin with the right number */ + for (i = 0; i < pctl->npins; i++) { +-- +2.42.0 + diff --git a/queue-6.6/powerpc-pseries-iommu-enable_ddw-incorrectly-returns.patch b/queue-6.6/powerpc-pseries-iommu-enable_ddw-incorrectly-returns.patch new file mode 100644 index 00000000000..eef06ab5a6e --- /dev/null +++ b/queue-6.6/powerpc-pseries-iommu-enable_ddw-incorrectly-returns.patch @@ -0,0 +1,74 @@ +From 378d567a97cbfd7670dd69fc2f29994ab5c7d645 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Oct 2023 22:08:02 -0500 +Subject: powerpc/pseries/iommu: enable_ddw incorrectly returns direct mapping + for SR-IOV device + +From: Gaurav Batra + +[ Upstream commit 3bf983e4e93ce8e6d69e9d63f52a66ec0856672e ] + +When a device is initialized, the driver invokes dma_supported() twice - +first for streaming mappings followed by coherent mappings. For an +SR-IOV device, default window is deleted and DDW created. With vPMEM +enabled, TCE mappings are dynamically created for both vPMEM and SR-IOV +device. There are no direct mappings. + +First time when dma_supported() is called with 64 bit mask, DDW is created +and marked as dynamic window. The second time dma_supported() is called, +enable_ddw() finds existing window for the device and incorrectly returns +it as "direct mapping". + +This only happens when size of DDW is big enough to map max LPAR memory. + +This results in streaming TCEs to not get dynamically mapped, since code +incorrently assumes these are already pre-mapped. The adapter initially +comes up but goes down due to EEH. + +Fixes: 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping") +Cc: stable@vger.kernel.org # v5.15+ +Signed-off-by: Gaurav Batra +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231003030802.47914-1-gbatra@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/iommu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c +index 16d93b580f61f..496e16c588aaa 100644 +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -914,7 +914,8 @@ static int remove_ddw(struct device_node *np, bool remove_prop, const char *win_ + return 0; + } + +-static bool find_existing_ddw(struct device_node *pdn, u64 *dma_addr, int *window_shift) ++static bool find_existing_ddw(struct device_node *pdn, u64 *dma_addr, int *window_shift, ++ bool *direct_mapping) + { + struct dma_win *window; + const struct dynamic_dma_window_prop *dma64; +@@ -927,6 +928,7 @@ static bool find_existing_ddw(struct device_node *pdn, u64 *dma_addr, int *windo + dma64 = window->prop; + *dma_addr = be64_to_cpu(dma64->dma_base); + *window_shift = be32_to_cpu(dma64->window_shift); ++ *direct_mapping = window->direct; + found = true; + break; + } +@@ -1270,10 +1272,8 @@ static bool enable_ddw(struct pci_dev *dev, struct device_node *pdn) + + mutex_lock(&dma_win_init_mutex); + +- if (find_existing_ddw(pdn, &dev->dev.archdata.dma_offset, &len)) { +- direct_mapping = (len >= max_ram_len); ++ if (find_existing_ddw(pdn, &dev->dev.archdata.dma_offset, &len, &direct_mapping)) + goto out_unlock; +- } + + /* + * If we already went through this for a previous function of +-- +2.42.0 + diff --git a/queue-6.6/r8169-prevent-potential-deadlock-in-rtl8169_close.patch b/queue-6.6/r8169-prevent-potential-deadlock-in-rtl8169_close.patch new file mode 100644 index 00000000000..dccaae897ff --- /dev/null +++ b/queue-6.6/r8169-prevent-potential-deadlock-in-rtl8169_close.patch @@ -0,0 +1,51 @@ +From 7191f59f9713622a6feaa0c0a3f6a2d9f2317c7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Nov 2023 23:01:02 +0100 +Subject: r8169: prevent potential deadlock in rtl8169_close + +From: Heiner Kallweit + +[ Upstream commit 91d3d149978ba7b238198dd80e4b823756aa7cfa ] + +ndo_stop() is RTNL-protected by net core, and the worker function takes +RTNL as well. Therefore we will deadlock when trying to execute a +pending work synchronously. To fix this execute any pending work +asynchronously. This will do no harm because netif_running() is false +in ndo_stop(), and therefore the work function is effectively a no-op. +However we have to ensure that no task is running or pending after +rtl_remove_one(), therefore add a call to cancel_work_sync(). + +Fixes: abe5fc42f9ce ("r8169: use RTNL to protect critical sections") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/12395867-1d17-4cac-aa7d-c691938fcddf@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index a43e33e4b25e6..62cabeeb842a1 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4694,7 +4694,7 @@ static int rtl8169_close(struct net_device *dev) + rtl8169_down(tp); + rtl8169_rx_clear(tp); + +- cancel_work_sync(&tp->wk.work); ++ cancel_work(&tp->wk.work); + + free_irq(tp->irq, tp); + +@@ -4928,6 +4928,8 @@ static void rtl_remove_one(struct pci_dev *pdev) + if (pci_dev_run_wake(pdev)) + pm_runtime_get_noresume(&pdev->dev); + ++ cancel_work_sync(&tp->wk.work); ++ + unregister_netdev(tp->dev); + + if (tp->dash_type != RTL_DASH_NONE) +-- +2.42.0 + diff --git a/queue-6.6/ravb-fix-races-between-ravb_tx_timeout_work-and-net-.patch b/queue-6.6/ravb-fix-races-between-ravb_tx_timeout_work-and-net-.patch new file mode 100644 index 00000000000..2263426e2b0 --- /dev/null +++ b/queue-6.6/ravb-fix-races-between-ravb_tx_timeout_work-and-net-.patch @@ -0,0 +1,79 @@ +From f7d8188ac407ee98c29cca125b821433ed05ffbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 21:24:20 +0900 +Subject: ravb: Fix races between ravb_tx_timeout_work() and net related ops + +From: Yoshihiro Shimoda + +[ Upstream commit 9870257a0a338cd8d6c1cddab74e703f490f6779 ] + +Fix races between ravb_tx_timeout_work() and functions of net_device_ops +and ethtool_ops by using rtnl_trylock() and rtnl_unlock(). Note that +since ravb_close() is under the rtnl lock and calls cancel_work_sync(), +ravb_tx_timeout_work() should calls rtnl_trylock(). Otherwise, a deadlock +may happen in ravb_tx_timeout_work() like below: + +CPU0 CPU1 + ravb_tx_timeout() + schedule_work() +... +__dev_close_many() +// Under rtnl lock +ravb_close() +cancel_work_sync() +// Waiting + ravb_tx_timeout_work() + rtnl_lock() + // This is possible to cause a deadlock + +If rtnl_trylock() fails, rescheduling the work with sleep for 1 msec. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/20231127122420.3706751-1-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 0ef0b88b71459..de12c02c55cbc 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1874,6 +1874,12 @@ static void ravb_tx_timeout_work(struct work_struct *work) + struct net_device *ndev = priv->ndev; + int error; + ++ if (!rtnl_trylock()) { ++ usleep_range(1000, 2000); ++ schedule_work(&priv->work); ++ return; ++ } ++ + netif_tx_stop_all_queues(ndev); + + /* Stop PTP Clock driver */ +@@ -1907,7 +1913,7 @@ static void ravb_tx_timeout_work(struct work_struct *work) + */ + netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n", + __func__, error); +- return; ++ goto out_unlock; + } + ravb_emac_init(ndev); + +@@ -1917,6 +1923,9 @@ static void ravb_tx_timeout_work(struct work_struct *work) + ravb_ptp_init(ndev, priv->pdev); + + netif_tx_start_all_queues(ndev); ++ ++out_unlock: ++ rtnl_unlock(); + } + + /* Packet transmit function for Ethernet AVB */ +-- +2.42.0 + diff --git a/queue-6.6/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid.patch b/queue-6.6/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid.patch new file mode 100644 index 00000000000..9fc5497a1e6 --- /dev/null +++ b/queue-6.6/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid.patch @@ -0,0 +1,50 @@ +From f351ad21a347721c35701459a28e5803e11f8c71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Oct 2023 10:15:20 +0200 +Subject: s390/cmma: fix handling of swapper_pg_dir and invalid_pg_dir + +From: Heiko Carstens + +[ Upstream commit 84bb41d5df48868055d159d9247b80927f1f70f9 ] + +If the cmma no-dat feature is available the kernel page tables are walked +to identify and mark all pages which are used for address translation (all +region, segment, and page tables). In a subsequent loop all other pages are +marked as "no-dat" pages with the ESSA instruction. + +This information is visible to the hypervisor, so that the hypervisor can +optimize purging of guest TLB entries. All pages used for swapper_pg_dir +and invalid_pg_dir are incorrectly marked as no-dat, which in turn can +result in incorrect guest TLB flushes. + +Fix this by marking those pages correctly as being used for DAT. + +Cc: +Reviewed-by: Claudio Imbrenda +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/mm/page-states.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/s390/mm/page-states.c b/arch/s390/mm/page-states.c +index 00e7b0876dc50..79a037f49f707 100644 +--- a/arch/s390/mm/page-states.c ++++ b/arch/s390/mm/page-states.c +@@ -181,6 +181,12 @@ void __init cmma_init_nodat(void) + return; + /* Mark pages used in kernel page tables */ + mark_kernel_pgd(); ++ page = virt_to_page(&swapper_pg_dir); ++ for (i = 0; i < 4; i++) ++ set_bit(PG_arch_1, &page[i].flags); ++ page = virt_to_page(&invalid_pg_dir); ++ for (i = 0; i < 4; i++) ++ set_bit(PG_arch_1, &page[i].flags); + + /* Set all kernel pages not used for page tables to stable/no-dat */ + for_each_mem_pfn_range(i, MAX_NUMNODES, &start, &end, NULL) { +-- +2.42.0 + diff --git a/queue-6.6/selftests-net-fix-a-char-signedness-issue.patch b/queue-6.6/selftests-net-fix-a-char-signedness-issue.patch new file mode 100644 index 00000000000..e3cb0cf67a0 --- /dev/null +++ b/queue-6.6/selftests-net-fix-a-char-signedness-issue.patch @@ -0,0 +1,50 @@ +From 45a879c5c8ac69422d557d79137b55a32542f356 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:15:20 -0500 +Subject: selftests/net: fix a char signedness issue + +From: Willem de Bruijn + +[ Upstream commit 7b29828c5af6841bdeb9fafa32fdfeff7ab9c407 ] + +Signedness of char is signed on x86_64, but unsigned on arm64. + +Fix the warning building cmsg_sender.c on signed platforms or +forced with -fsigned-char: + + msg_sender.c:455:12: + error: implicit conversion from 'int' to 'char' + changes value from 128 to -128 + [-Werror,-Wconstant-conversion] + buf[0] = ICMPV6_ECHO_REQUEST; + +constant ICMPV6_ECHO_REQUEST is 128. + +Link: https://lwn.net/Articles/911914 +Fixes: de17e305a810 ("selftests: net: cmsg_sender: support icmp and raw sockets") +Signed-off-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20231124171645.1011043-3-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/cmsg_sender.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/cmsg_sender.c b/tools/testing/selftests/net/cmsg_sender.c +index 24b21b15ed3fb..6ff3e732f449f 100644 +--- a/tools/testing/selftests/net/cmsg_sender.c ++++ b/tools/testing/selftests/net/cmsg_sender.c +@@ -416,9 +416,9 @@ int main(int argc, char *argv[]) + { + struct addrinfo hints, *ai; + struct iovec iov[1]; ++ unsigned char *buf; + struct msghdr msg; + char cbuf[1024]; +- char *buf; + int err; + int fd; + +-- +2.42.0 + diff --git a/queue-6.6/selftests-net-ipsec-fix-constant-out-of-range.patch b/queue-6.6/selftests-net-ipsec-fix-constant-out-of-range.patch new file mode 100644 index 00000000000..ee65f4a0429 --- /dev/null +++ b/queue-6.6/selftests-net-ipsec-fix-constant-out-of-range.patch @@ -0,0 +1,56 @@ +From bb14fbd2db8a5d03be75c8dbd615f26feede1c8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:15:19 -0500 +Subject: selftests/net: ipsec: fix constant out of range + +From: Willem de Bruijn + +[ Upstream commit 088559815477c6f623a5db5993491ddd7facbec7 ] + +Fix a small compiler warning. + +nr_process must be a signed long: it is assigned a signed long by +strtol() and is compared against LONG_MIN and LONG_MAX. + +ipsec.c:2280:65: + error: result of comparison of constant -9223372036854775808 + with expression of type 'unsigned int' is always false + [-Werror,-Wtautological-constant-out-of-range-compare] + + if ((errno == ERANGE && (nr_process == LONG_MAX || nr_process == LONG_MIN)) + +Fixes: bc2652b7ae1e ("selftest/net/xfrm: Add test for ipsec tunnel") +Signed-off-by: Willem de Bruijn +Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> +Link: https://lore.kernel.org/r/20231124171645.1011043-2-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/ipsec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/net/ipsec.c b/tools/testing/selftests/net/ipsec.c +index 9a8229abfa026..be4a30a0d02ae 100644 +--- a/tools/testing/selftests/net/ipsec.c ++++ b/tools/testing/selftests/net/ipsec.c +@@ -2263,7 +2263,7 @@ static int check_results(void) + + int main(int argc, char **argv) + { +- unsigned int nr_process = 1; ++ long nr_process = 1; + int route_sock = -1, ret = KSFT_SKIP; + int test_desc_fd[2]; + uint32_t route_seq; +@@ -2284,7 +2284,7 @@ int main(int argc, char **argv) + exit_usage(argv); + } + +- if (nr_process > MAX_PROCESSES || !nr_process) { ++ if (nr_process > MAX_PROCESSES || nr_process < 1) { + printk("nr_process should be between [1; %u]", + MAX_PROCESSES); + exit_usage(argv); +-- +2.42.0 + diff --git a/queue-6.6/selftests-net-mptcp-fix-uninitialized-variable-warni.patch b/queue-6.6/selftests-net-mptcp-fix-uninitialized-variable-warni.patch new file mode 100644 index 00000000000..0075dd018c0 --- /dev/null +++ b/queue-6.6/selftests-net-mptcp-fix-uninitialized-variable-warni.patch @@ -0,0 +1,110 @@ +From 326c7a0484287717d5a05e023efa21a6a5cda318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:15:22 -0500 +Subject: selftests/net: mptcp: fix uninitialized variable warnings + +From: Willem de Bruijn + +[ Upstream commit 00a4f8fd9c750f20d8fd4535c71c9caa7ef5ff2f ] + +Same init_rng() in both tests. The function reads /dev/urandom to +initialize srand(). In case of failure, it falls back onto the +entropy in the uninitialized variable. Not sure if this is on purpose. +But failure reading urandom should be rare, so just fail hard. While +at it, convert to getrandom(). Which man 4 random suggests is simpler +and more robust. + + mptcp_inq.c:525:6: + mptcp_connect.c:1131:6: + + error: variable 'foo' is used uninitialized + whenever 'if' condition is false + [-Werror,-Wsometimes-uninitialized] + +Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") +Fixes: b51880568f20 ("selftests: mptcp: add inq test case") +Cc: Florian Westphal +Signed-off-by: Willem de Bruijn + +---- + +When input is randomized because this is expected to meaningfully +explore edge cases, should we also add +1. logging the random seed to stdout and +2. adding a command line argument to replay from a specific seed +I can do this in net-next, if authors find it useful in this case. +Reviewed-by: Matthieu Baerts + +Link: https://lore.kernel.org/r/20231124171645.1011043-5-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/mptcp/mptcp_connect.c | 11 ++++------- + tools/testing/selftests/net/mptcp/mptcp_inq.c | 11 ++++------- + 2 files changed, 8 insertions(+), 14 deletions(-) + +diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c +index c7f9ebeebc2c5..d2043ec3bf6d6 100644 +--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c ++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c +@@ -18,6 +18,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -1125,15 +1126,11 @@ int main_loop_s(int listensock) + + static void init_rng(void) + { +- int fd = open("/dev/urandom", O_RDONLY); + unsigned int foo; + +- if (fd > 0) { +- int ret = read(fd, &foo, sizeof(foo)); +- +- if (ret < 0) +- srand(fd + foo); +- close(fd); ++ if (getrandom(&foo, sizeof(foo), 0) == -1) { ++ perror("getrandom"); ++ exit(1); + } + + srand(foo); +diff --git a/tools/testing/selftests/net/mptcp/mptcp_inq.c b/tools/testing/selftests/net/mptcp/mptcp_inq.c +index 8672d898f8cda..218aac4673212 100644 +--- a/tools/testing/selftests/net/mptcp/mptcp_inq.c ++++ b/tools/testing/selftests/net/mptcp/mptcp_inq.c +@@ -18,6 +18,7 @@ + #include + + #include ++#include + #include + #include + #include +@@ -519,15 +520,11 @@ static int client(int unixfd) + + static void init_rng(void) + { +- int fd = open("/dev/urandom", O_RDONLY); + unsigned int foo; + +- if (fd > 0) { +- int ret = read(fd, &foo, sizeof(foo)); +- +- if (ret < 0) +- srand(fd + foo); +- close(fd); ++ if (getrandom(&foo, sizeof(foo), 0) == -1) { ++ perror("getrandom"); ++ exit(1); + } + + srand(foo); +-- +2.42.0 + diff --git a/queue-6.6/selftests-net-unix-fix-unused-variable-compiler-warn.patch b/queue-6.6/selftests-net-unix-fix-unused-variable-compiler-warn.patch new file mode 100644 index 00000000000..eedf5cfefd0 --- /dev/null +++ b/queue-6.6/selftests-net-unix-fix-unused-variable-compiler-warn.patch @@ -0,0 +1,39 @@ +From 9b64c73aa0c68244d16880c0c7ef0c5146fb8205 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:15:21 -0500 +Subject: selftests/net: unix: fix unused variable compiler warning + +From: Willem de Bruijn + +[ Upstream commit 59fef379d453781f0dabfa1f1a1e86e78aee919a ] + +Remove an unused variable. + + diag_uid.c:151:24: + error: unused variable 'udr' + [-Werror,-Wunused-variable] + +Fixes: ac011361bd4f ("af_unix: Add test for sock_diag and UDIAG_SHOW_UID.") +Signed-off-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20231124171645.1011043-4-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/af_unix/diag_uid.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/tools/testing/selftests/net/af_unix/diag_uid.c b/tools/testing/selftests/net/af_unix/diag_uid.c +index 5b88f7129fea4..79a3dd75590e8 100644 +--- a/tools/testing/selftests/net/af_unix/diag_uid.c ++++ b/tools/testing/selftests/net/af_unix/diag_uid.c +@@ -148,7 +148,6 @@ void receive_response(struct __test_metadata *_metadata, + .msg_iov = &iov, + .msg_iovlen = 1 + }; +- struct unix_diag_req *udr; + struct nlmsghdr *nlh; + int ret; + +-- +2.42.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 49b0006e541..b430f2c5d36 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -71,3 +71,56 @@ btrfs-fix-64bit-compat-send-ioctl-arguments-not-initializing-version-member.patc io_uring-enable-io_mem_alloc-free-to-be-used-in-other-parts.patch io_uring-kbuf-defer-release-of-mapped-buffer-rings.patch io_uring-kbuf-recycle-freed-mapped-buffer-ring-entries.patch +pinctrl-stm32-add-check-for-devm_kcalloc.patch +pinctrl-stm32-fix-array-read-out-of-bound.patch +media-v4l2-subdev-fix-a-64bit-bug.patch +netdevsim-don-t-accept-device-bound-programs.patch +net-rswitch-fix-type-of-ret-in-rswitch_start_xmit.patch +net-rswitch-fix-return-value-in-rswitch_start_xmit.patch +net-rswitch-fix-missing-dev_kfree_skb_any-in-error-p.patch +ipv4-igmp-fix-refcnt-uaf-issue-when-receiving-igmp-q.patch +wifi-iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_mld_ad.patch +wifi-mac80211-do-not-pass-ap_vlan-vif-pointer-to-dri.patch +net-dsa-mv88e6xxx-fix-marvell-6350-switch-probing.patch +net-dsa-mv88e6xxx-fix-marvell-6350-probe-crash.patch +dpaa2-eth-increase-the-needed-headroom-to-account-fo.patch +dpaa2-eth-recycle-the-rx-buffer-only-after-all-proce.patch +bpf-add-missed-allocation-hint-for-bpf_mem_cache_all.patch +uapi-propagate-__struct_group-attributes-to-the-cont.patch +selftests-net-ipsec-fix-constant-out-of-range.patch +selftests-net-fix-a-char-signedness-issue.patch +selftests-net-unix-fix-unused-variable-compiler-warn.patch +selftests-net-mptcp-fix-uninitialized-variable-warni.patch +octeontx2-af-fix-possible-buffer-overflow.patch +net-stmmac-xgmac-disable-fpe-mmc-interrupts.patch +octeontx2-pf-fix-adding-mbox-work-queue-entry-when-n.patch +octeontx2-pf-restore-tc-ingress-police-rules-when-in.patch +neighbour-fix-__randomize_layout-crash-in-struct-nei.patch +efi-unaccepted-fix-off-by-one-when-checking-for-over.patch +r8169-prevent-potential-deadlock-in-rtl8169_close.patch +ravb-fix-races-between-ravb_tx_timeout_work-and-net-.patch +ethtool-don-t-propagate-eopnotsupp-from-dumps.patch +bpf-sockmap-af_unix-stream-sockets-need-to-hold-ref-.patch +ice-fix-vf-reset-paths-when-interface-in-a-failed-ov.patch +net-ravb-check-return-value-of-reset_control_deasser.patch +net-ravb-use-pm_runtime_resume_and_get.patch +net-ravb-make-write-access-to-cxr35-first-before-acc.patch +net-ravb-start-tx-queues-after-hw-initialization-suc.patch +net-ravb-stop-dma-in-case-of-failures-on-ravb_open.patch +net-ravb-keep-reverse-order-of-operations-in-ravb_re.patch +powerpc-pseries-iommu-enable_ddw-incorrectly-returns.patch +s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid.patch +drm-amd-display-refactor-edp-power-control.patch +drm-amd-display-remove-power-sequencing-check.patch +cpufreq-imx6q-don-t-disable-792-mhz-opp-unnecessaril.patch +iommu-vt-d-omit-devtlb-invalidation-requests-when-te.patch +iommu-vt-d-disable-pci-ats-in-legacy-passthrough-mod.patch +iommu-vt-d-make-context-clearing-consistent-with-con.patch +drm-i915-gsc-mark-internal-gsc-engine-with-reserved-.patch +drm-i915-call-intel_pre_plane_updates-also-for-pipes.patch +drm-panel-starry-2081101qfh032011-53g-fine-tune-the-.patch +drm-panel-nt36523-fix-return-value-check-in-nt36523_.patch +cpufreq-amd-pstate-fix-scaling_min_freq-and-scaling_.patch +cpufreq-amd-pstate-only-print-supported-epp-values-f.patch +drm-amd-pm-fix-a-memleak-in-aldebaran_tables_init.patch +iommu-fix-printk-arg-in-of_iommu_get_resv_regions.patch diff --git a/queue-6.6/uapi-propagate-__struct_group-attributes-to-the-cont.patch b/queue-6.6/uapi-propagate-__struct_group-attributes-to-the-cont.patch new file mode 100644 index 00000000000..a4ba3a4f90e --- /dev/null +++ b/queue-6.6/uapi-propagate-__struct_group-attributes-to-the-cont.patch @@ -0,0 +1,79 @@ +From 8a27a5e187afc1ad2e660d47ad60b4a1c5f8657f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 14:05:08 +0300 +Subject: uapi: propagate __struct_group() attributes to the container union + +From: Dmitry Antipov + +[ Upstream commit 4e86f32a13af1970d21be94f659cae56bbe487ee ] + +Recently the kernel test robot has reported an ARM-specific BUILD_BUG_ON() +in an old and unmaintained wil6210 wireless driver. The problem comes from +the structure packing rules of old ARM ABI ('-mabi=apcs-gnu'). For example, +the following structure is packed to 18 bytes instead of 16: + +struct poorly_packed { + unsigned int a; + unsigned int b; + unsigned short c; + union { + struct { + unsigned short d; + unsigned int e; + } __attribute__((packed)); + struct { + unsigned short d; + unsigned int e; + } __attribute__((packed)) inner; + }; +} __attribute__((packed)); + +To fit it into 16 bytes, it's required to add packed attribute to the +container union as well: + +struct poorly_packed { + unsigned int a; + unsigned int b; + unsigned short c; + union { + struct { + unsigned short d; + unsigned int e; + } __attribute__((packed)); + struct { + unsigned short d; + unsigned int e; + } __attribute__((packed)) inner; + } __attribute__((packed)); +} __attribute__((packed)); + +Thanks to Andrew Pinski of GCC team for sorting the things out at +https://gcc.gnu.org/pipermail/gcc/2023-November/242888.html. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311150821.cI4yciFE-lkp@intel.com +Signed-off-by: Dmitry Antipov +Link: https://lore.kernel.org/r/20231120110607.98956-1-dmantipov@yandex.ru +Fixes: 50d7bd38c3aa ("stddef: Introduce struct_group() helper macro") +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + include/uapi/linux/stddef.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h +index 5c6c4269f7efe..2ec6f35cda32e 100644 +--- a/include/uapi/linux/stddef.h ++++ b/include/uapi/linux/stddef.h +@@ -27,7 +27,7 @@ + union { \ + struct { MEMBERS } ATTRS; \ + struct TAG { MEMBERS } ATTRS NAME; \ +- } ++ } ATTRS + + #ifdef __cplusplus + /* sizeof(struct{}) is 1 in C++, not 0, can't use C version of the macro. */ +-- +2.42.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_mld_ad.patch b/queue-6.6/wifi-iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_mld_ad.patch new file mode 100644 index 00000000000..075058a317c --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_mld_ad.patch @@ -0,0 +1,40 @@ +From 255a629a17b78890f26cdc7750ced707525677d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Sep 2023 15:40:41 +0300 +Subject: wifi: iwlwifi: mvm: fix an error code in iwl_mvm_mld_add_sta() + +From: Dan Carpenter + +[ Upstream commit 71b5e40651d89a8685bea1592dfcd2aa61559628 ] + +This error path should return -EINVAL instead of success. + +Fixes: 57974a55d995 ("wifi: iwlwifi: mvm: refactor iwl_mvm_mac_sta_state_common()") +Signed-off-by: Dan Carpenter +Acked-by: Gregory Greenman +Link: https://lore.kernel.org/r/75e4ea09-db58-462f-bd4e-5ad4e5e5dcb5@moroto.mountain +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +index 56f51344c193c..1ccbe8c1eeb42 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +@@ -705,8 +705,10 @@ int iwl_mvm_mld_add_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + rcu_dereference_protected(mvm_sta->link[link_id], + lockdep_is_held(&mvm->mutex)); + +- if (WARN_ON(!link_conf || !mvm_link_sta)) ++ if (WARN_ON(!link_conf || !mvm_link_sta)) { ++ ret = -EINVAL; + goto err; ++ } + + ret = iwl_mvm_mld_cfg_sta(mvm, sta, vif, link_sta, link_conf, + mvm_link_sta); +-- +2.42.0 + diff --git a/queue-6.6/wifi-mac80211-do-not-pass-ap_vlan-vif-pointer-to-dri.patch b/queue-6.6/wifi-mac80211-do-not-pass-ap_vlan-vif-pointer-to-dri.patch new file mode 100644 index 00000000000..6b9c552d217 --- /dev/null +++ b/queue-6.6/wifi-mac80211-do-not-pass-ap_vlan-vif-pointer-to-dri.patch @@ -0,0 +1,71 @@ +From 68d40693d1b78efe26becf7f8c3d8b9f6f79b7b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Nov 2023 15:13:33 +0100 +Subject: wifi: mac80211: do not pass AP_VLAN vif pointer to drivers during + flush +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Oldřich Jedlička + +[ Upstream commit 3e3a2b645c043f7e3e488d5011478cefb69bbe8b ] + +This fixes WARN_ONs when using AP_VLANs after station removal. The flush +call passed AP_VLAN vif to driver, but because these vifs are virtual and +not registered with drivers, we need to translate to the correct AP vif +first. + +Closes: https://github.com/openwrt/openwrt/issues/12420 +Fixes: 0b75a1b1e42e ("wifi: mac80211: flush queues on STA removal") +Fixes: d00800a289c9 ("wifi: mac80211: add flush_sta method") +Tested-by: Konstantin Demin +Tested-by: Koen Vandeputte +Signed-off-by: Oldřich Jedlička +Link: https://lore.kernel.org/r/20231104141333.3710-1-oldium.pro@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/driver-ops.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h +index c4505593ba7a6..2bc2fbe58f944 100644 +--- a/net/mac80211/driver-ops.h ++++ b/net/mac80211/driver-ops.h +@@ -23,7 +23,7 @@ + static inline struct ieee80211_sub_if_data * + get_bss_sdata(struct ieee80211_sub_if_data *sdata) + { +- if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) ++ if (sdata && sdata->vif.type == NL80211_IFTYPE_AP_VLAN) + sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, + u.ap); + +@@ -638,10 +638,13 @@ static inline void drv_flush(struct ieee80211_local *local, + struct ieee80211_sub_if_data *sdata, + u32 queues, bool drop) + { +- struct ieee80211_vif *vif = sdata ? &sdata->vif : NULL; ++ struct ieee80211_vif *vif; + + might_sleep(); + ++ sdata = get_bss_sdata(sdata); ++ vif = sdata ? &sdata->vif : NULL; ++ + if (sdata && !check_sdata_in_driver(sdata)) + return; + +@@ -657,6 +660,8 @@ static inline void drv_flush_sta(struct ieee80211_local *local, + { + might_sleep(); + ++ sdata = get_bss_sdata(sdata); ++ + if (sdata && !check_sdata_in_driver(sdata)) + return; + +-- +2.42.0 + -- 2.47.3