From: Sasha Levin Date: Sat, 13 Jul 2024 16:34:06 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v6.1.99~9 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=746d2ea48b73223031847e757638d944daf8e29f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/arm-davinci-convert-comma-to-semicolon.patch b/queue-6.1/arm-davinci-convert-comma-to-semicolon.patch new file mode 100644 index 00000000000..7bded642fa7 --- /dev/null +++ b/queue-6.1/arm-davinci-convert-comma-to-semicolon.patch @@ -0,0 +1,36 @@ +From 1e1d28446009fc58529853a24e2c27d70a02302d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 16:16:48 +0800 +Subject: ARM: davinci: Convert comma to semicolon + +From: Chen Ni + +[ Upstream commit acc3815db1a02d654fbc19726ceaadca0d7dd81c ] + +Replace a comma between expression statements by a semicolon. + +Fixes: efc1bb8a6fd5 ("davinci: add power management support") +Signed-off-by: Chen Ni +Acked-by: Bartosz Golaszewski +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-davinci/pm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-davinci/pm.c b/arch/arm/mach-davinci/pm.c +index 8aa39db095d76..2c5155bd376ba 100644 +--- a/arch/arm/mach-davinci/pm.c ++++ b/arch/arm/mach-davinci/pm.c +@@ -61,7 +61,7 @@ static void davinci_pm_suspend(void) + + /* Configure sleep count in deep sleep register */ + val = __raw_readl(pm_config.deepsleep_reg); +- val &= ~DEEPSLEEP_SLEEPCOUNT_MASK, ++ val &= ~DEEPSLEEP_SLEEPCOUNT_MASK; + val |= pm_config.sleepcount; + __raw_writel(val, pm_config.deepsleep_reg); + +-- +2.43.0 + diff --git a/queue-6.1/firmware-cs_dsp-fix-overflow-checking-of-wmfw-header.patch b/queue-6.1/firmware-cs_dsp-fix-overflow-checking-of-wmfw-header.patch new file mode 100644 index 00000000000..f187501eafd --- /dev/null +++ b/queue-6.1/firmware-cs_dsp-fix-overflow-checking-of-wmfw-header.patch @@ -0,0 +1,115 @@ +From d18c98cf893c857f6bf189a3fde8be3125656c48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 15:14:29 +0100 +Subject: firmware: cs_dsp: Fix overflow checking of wmfw header + +From: Richard Fitzgerald + +[ Upstream commit 3019b86bce16fbb5bc1964f3544d0ce7d0137278 ] + +Fix the checking that firmware file buffer is large enough for the +wmfw header, to prevent overrunning the buffer. + +The original code tested that the firmware data buffer contained +enough bytes for the sums of the size of the structs + + wmfw_header + wmfw_adsp1_sizes + wmfw_footer + +But wmfw_adsp1_sizes is only used on ADSP1 firmware. For ADSP2 and +Halo Core the equivalent struct is wmfw_adsp2_sizes, which is +4 bytes longer. So the length check didn't guarantee that there +are enough bytes in the firmware buffer for a header with +wmfw_adsp2_sizes. + +This patch splits the length check into three separate parts. Each +of the wmfw_header, wmfw_adsp?_sizes and wmfw_footer are checked +separately before they are used. + +Signed-off-by: Richard Fitzgerald +Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") +Link: https://patch.msgid.link/20240627141432.93056-2-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/firmware/cirrus/cs_dsp.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c +index 64ed9d3f5d5d8..fd1145b2894b3 100644 +--- a/drivers/firmware/cirrus/cs_dsp.c ++++ b/drivers/firmware/cirrus/cs_dsp.c +@@ -1228,6 +1228,10 @@ static unsigned int cs_dsp_adsp1_parse_sizes(struct cs_dsp *dsp, + const struct wmfw_adsp1_sizes *adsp1_sizes; + + adsp1_sizes = (void *)&firmware->data[pos]; ++ if (sizeof(*adsp1_sizes) > firmware->size - pos) { ++ cs_dsp_err(dsp, "%s: file truncated\n", file); ++ return 0; ++ } + + cs_dsp_dbg(dsp, "%s: %d DM, %d PM, %d ZM\n", file, + le32_to_cpu(adsp1_sizes->dm), le32_to_cpu(adsp1_sizes->pm), +@@ -1244,6 +1248,10 @@ static unsigned int cs_dsp_adsp2_parse_sizes(struct cs_dsp *dsp, + const struct wmfw_adsp2_sizes *adsp2_sizes; + + adsp2_sizes = (void *)&firmware->data[pos]; ++ if (sizeof(*adsp2_sizes) > firmware->size - pos) { ++ cs_dsp_err(dsp, "%s: file truncated\n", file); ++ return 0; ++ } + + cs_dsp_dbg(dsp, "%s: %d XM, %d YM %d PM, %d ZM\n", file, + le32_to_cpu(adsp2_sizes->xm), le32_to_cpu(adsp2_sizes->ym), +@@ -1283,7 +1291,6 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, + struct regmap *regmap = dsp->regmap; + unsigned int pos = 0; + const struct wmfw_header *header; +- const struct wmfw_adsp1_sizes *adsp1_sizes; + const struct wmfw_footer *footer; + const struct wmfw_region *region; + const struct cs_dsp_region *mem; +@@ -1296,10 +1303,8 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, + + ret = -EINVAL; + +- pos = sizeof(*header) + sizeof(*adsp1_sizes) + sizeof(*footer); +- if (pos >= firmware->size) { +- cs_dsp_err(dsp, "%s: file too short, %zu bytes\n", +- file, firmware->size); ++ if (sizeof(*header) >= firmware->size) { ++ ret = -EOVERFLOW; + goto out_fw; + } + +@@ -1327,13 +1332,16 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, + + pos = sizeof(*header); + pos = dsp->ops->parse_sizes(dsp, file, pos, firmware); ++ if ((pos == 0) || (sizeof(*footer) > firmware->size - pos)) { ++ ret = -EOVERFLOW; ++ goto out_fw; ++ } + + footer = (void *)&firmware->data[pos]; + pos += sizeof(*footer); + + if (le32_to_cpu(header->len) != pos) { +- cs_dsp_err(dsp, "%s: unexpected header length %d\n", +- file, le32_to_cpu(header->len)); ++ ret = -EOVERFLOW; + goto out_fw; + } + +@@ -1459,6 +1467,9 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, + cs_dsp_buf_free(&buf_list); + kfree(text); + ++ if (ret == -EOVERFLOW) ++ cs_dsp_err(dsp, "%s: file content overflows file data\n", file); ++ + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.1/firmware-cs_dsp-prevent-buffer-overrun-when-processi.patch b/queue-6.1/firmware-cs_dsp-prevent-buffer-overrun-when-processi.patch new file mode 100644 index 00000000000..7ed9128fca9 --- /dev/null +++ b/queue-6.1/firmware-cs_dsp-prevent-buffer-overrun-when-processi.patch @@ -0,0 +1,265 @@ +From d1238bd32f24af414a99814d35435ae1fb9bb1e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 15:14:32 +0100 +Subject: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg + headers + +From: Richard Fitzgerald + +[ Upstream commit 2163aff6bebbb752edf73f79700f5e2095f3559e ] + +Check that all fields of a V2 algorithm header fit into the available +firmware data buffer. + +The wmfw V2 format introduced variable-length strings in the algorithm +block header. This means the overall header length is variable, and the +position of most fields varies depending on the length of the string +fields. Each field must be checked to ensure that it does not overflow +the firmware data buffer. + +As this ia bugfix patch, the fixes avoid making any significant change to +the existing code. This makes it easier to review and less likely to +introduce new bugs. + +Signed-off-by: Richard Fitzgerald +Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") +Link: https://patch.msgid.link/20240627141432.93056-5-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/firmware/cirrus/cs_dsp.c | 144 ++++++++++++++++++++++++------- + 1 file changed, 113 insertions(+), 31 deletions(-) + +diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c +index 7882f3a5f8556..eb6caeba6cdc3 100644 +--- a/drivers/firmware/cirrus/cs_dsp.c ++++ b/drivers/firmware/cirrus/cs_dsp.c +@@ -1014,9 +1014,16 @@ struct cs_dsp_coeff_parsed_coeff { + int len; + }; + +-static int cs_dsp_coeff_parse_string(int bytes, const u8 **pos, const u8 **str) ++static int cs_dsp_coeff_parse_string(int bytes, const u8 **pos, unsigned int avail, ++ const u8 **str) + { +- int length; ++ int length, total_field_len; ++ ++ /* String fields are at least one __le32 */ ++ if (sizeof(__le32) > avail) { ++ *pos = NULL; ++ return 0; ++ } + + switch (bytes) { + case 1: +@@ -1029,10 +1036,16 @@ static int cs_dsp_coeff_parse_string(int bytes, const u8 **pos, const u8 **str) + return 0; + } + ++ total_field_len = ((length + bytes) + 3) & ~0x03; ++ if ((unsigned int)total_field_len > avail) { ++ *pos = NULL; ++ return 0; ++ } ++ + if (str) + *str = *pos + bytes; + +- *pos += ((length + bytes) + 3) & ~0x03; ++ *pos += total_field_len; + + return length; + } +@@ -1057,51 +1070,100 @@ static int cs_dsp_coeff_parse_int(int bytes, const u8 **pos) + return val; + } + +-static inline void cs_dsp_coeff_parse_alg(struct cs_dsp *dsp, const u8 **data, +- struct cs_dsp_coeff_parsed_alg *blk) ++static int cs_dsp_coeff_parse_alg(struct cs_dsp *dsp, ++ const struct wmfw_region *region, ++ struct cs_dsp_coeff_parsed_alg *blk) + { + const struct wmfw_adsp_alg_data *raw; ++ unsigned int data_len = le32_to_cpu(region->len); ++ unsigned int pos; ++ const u8 *tmp; ++ ++ raw = (const struct wmfw_adsp_alg_data *)region->data; + + switch (dsp->fw_ver) { + case 0: + case 1: +- raw = (const struct wmfw_adsp_alg_data *)*data; +- *data = raw->data; ++ if (sizeof(*raw) > data_len) ++ return -EOVERFLOW; + + blk->id = le32_to_cpu(raw->id); + blk->name = raw->name; + blk->name_len = strlen(raw->name); + blk->ncoeff = le32_to_cpu(raw->ncoeff); ++ ++ pos = sizeof(*raw); + break; + default: +- blk->id = cs_dsp_coeff_parse_int(sizeof(raw->id), data); +- blk->name_len = cs_dsp_coeff_parse_string(sizeof(u8), data, ++ if (sizeof(raw->id) > data_len) ++ return -EOVERFLOW; ++ ++ tmp = region->data; ++ blk->id = cs_dsp_coeff_parse_int(sizeof(raw->id), &tmp); ++ pos = tmp - region->data; ++ ++ tmp = ®ion->data[pos]; ++ blk->name_len = cs_dsp_coeff_parse_string(sizeof(u8), &tmp, data_len - pos, + &blk->name); +- cs_dsp_coeff_parse_string(sizeof(u16), data, NULL); +- blk->ncoeff = cs_dsp_coeff_parse_int(sizeof(raw->ncoeff), data); ++ if (!tmp) ++ return -EOVERFLOW; ++ ++ pos = tmp - region->data; ++ cs_dsp_coeff_parse_string(sizeof(u16), &tmp, data_len - pos, NULL); ++ if (!tmp) ++ return -EOVERFLOW; ++ ++ pos = tmp - region->data; ++ if (sizeof(raw->ncoeff) > (data_len - pos)) ++ return -EOVERFLOW; ++ ++ blk->ncoeff = cs_dsp_coeff_parse_int(sizeof(raw->ncoeff), &tmp); ++ pos += sizeof(raw->ncoeff); + break; + } + ++ if ((int)blk->ncoeff < 0) ++ return -EOVERFLOW; ++ + cs_dsp_dbg(dsp, "Algorithm ID: %#x\n", blk->id); + cs_dsp_dbg(dsp, "Algorithm name: %.*s\n", blk->name_len, blk->name); + cs_dsp_dbg(dsp, "# of coefficient descriptors: %#x\n", blk->ncoeff); ++ ++ return pos; + } + +-static inline void cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp, const u8 **data, +- struct cs_dsp_coeff_parsed_coeff *blk) ++static int cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp, ++ const struct wmfw_region *region, ++ unsigned int pos, ++ struct cs_dsp_coeff_parsed_coeff *blk) + { + const struct wmfw_adsp_coeff_data *raw; ++ unsigned int data_len = le32_to_cpu(region->len); ++ unsigned int blk_len, blk_end_pos; + const u8 *tmp; +- int length; ++ ++ raw = (const struct wmfw_adsp_coeff_data *)®ion->data[pos]; ++ if (sizeof(raw->hdr) > (data_len - pos)) ++ return -EOVERFLOW; ++ ++ blk_len = le32_to_cpu(raw->hdr.size); ++ if (blk_len > S32_MAX) ++ return -EOVERFLOW; ++ ++ if (blk_len > (data_len - pos - sizeof(raw->hdr))) ++ return -EOVERFLOW; ++ ++ blk_end_pos = pos + sizeof(raw->hdr) + blk_len; ++ ++ blk->offset = le16_to_cpu(raw->hdr.offset); ++ blk->mem_type = le16_to_cpu(raw->hdr.type); + + switch (dsp->fw_ver) { + case 0: + case 1: +- raw = (const struct wmfw_adsp_coeff_data *)*data; +- *data = *data + sizeof(raw->hdr) + le32_to_cpu(raw->hdr.size); ++ if (sizeof(*raw) > (data_len - pos)) ++ return -EOVERFLOW; + +- blk->offset = le16_to_cpu(raw->hdr.offset); +- blk->mem_type = le16_to_cpu(raw->hdr.type); + blk->name = raw->name; + blk->name_len = strlen(raw->name); + blk->ctl_type = le16_to_cpu(raw->ctl_type); +@@ -1109,19 +1171,33 @@ static inline void cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp, const u8 **data, + blk->len = le32_to_cpu(raw->len); + break; + default: +- tmp = *data; +- blk->offset = cs_dsp_coeff_parse_int(sizeof(raw->hdr.offset), &tmp); +- blk->mem_type = cs_dsp_coeff_parse_int(sizeof(raw->hdr.type), &tmp); +- length = cs_dsp_coeff_parse_int(sizeof(raw->hdr.size), &tmp); +- blk->name_len = cs_dsp_coeff_parse_string(sizeof(u8), &tmp, ++ pos += sizeof(raw->hdr); ++ tmp = ®ion->data[pos]; ++ blk->name_len = cs_dsp_coeff_parse_string(sizeof(u8), &tmp, data_len - pos, + &blk->name); +- cs_dsp_coeff_parse_string(sizeof(u8), &tmp, NULL); +- cs_dsp_coeff_parse_string(sizeof(u16), &tmp, NULL); ++ if (!tmp) ++ return -EOVERFLOW; ++ ++ pos = tmp - region->data; ++ cs_dsp_coeff_parse_string(sizeof(u8), &tmp, data_len - pos, NULL); ++ if (!tmp) ++ return -EOVERFLOW; ++ ++ pos = tmp - region->data; ++ cs_dsp_coeff_parse_string(sizeof(u16), &tmp, data_len - pos, NULL); ++ if (!tmp) ++ return -EOVERFLOW; ++ ++ pos = tmp - region->data; ++ if (sizeof(raw->ctl_type) + sizeof(raw->flags) + sizeof(raw->len) > ++ (data_len - pos)) ++ return -EOVERFLOW; ++ + blk->ctl_type = cs_dsp_coeff_parse_int(sizeof(raw->ctl_type), &tmp); ++ pos += sizeof(raw->ctl_type); + blk->flags = cs_dsp_coeff_parse_int(sizeof(raw->flags), &tmp); ++ pos += sizeof(raw->flags); + blk->len = cs_dsp_coeff_parse_int(sizeof(raw->len), &tmp); +- +- *data = *data + sizeof(raw->hdr) + length; + break; + } + +@@ -1131,6 +1207,8 @@ static inline void cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp, const u8 **data, + cs_dsp_dbg(dsp, "\tCoefficient flags: %#x\n", blk->flags); + cs_dsp_dbg(dsp, "\tALSA control type: %#x\n", blk->ctl_type); + cs_dsp_dbg(dsp, "\tALSA control len: %#x\n", blk->len); ++ ++ return blk_end_pos; + } + + static int cs_dsp_check_coeff_flags(struct cs_dsp *dsp, +@@ -1154,12 +1232,16 @@ static int cs_dsp_parse_coeff(struct cs_dsp *dsp, + struct cs_dsp_alg_region alg_region = {}; + struct cs_dsp_coeff_parsed_alg alg_blk; + struct cs_dsp_coeff_parsed_coeff coeff_blk; +- const u8 *data = region->data; +- int i, ret; ++ int i, pos, ret; ++ ++ pos = cs_dsp_coeff_parse_alg(dsp, region, &alg_blk); ++ if (pos < 0) ++ return pos; + +- cs_dsp_coeff_parse_alg(dsp, &data, &alg_blk); + for (i = 0; i < alg_blk.ncoeff; i++) { +- cs_dsp_coeff_parse_coeff(dsp, &data, &coeff_blk); ++ pos = cs_dsp_coeff_parse_coeff(dsp, region, pos, &coeff_blk); ++ if (pos < 0) ++ return pos; + + switch (coeff_blk.ctl_type) { + case WMFW_CTL_TYPE_BYTES: +-- +2.43.0 + diff --git a/queue-6.1/firmware-cs_dsp-return-error-if-block-header-overflo.patch b/queue-6.1/firmware-cs_dsp-return-error-if-block-header-overflo.patch new file mode 100644 index 00000000000..55fbc826aea --- /dev/null +++ b/queue-6.1/firmware-cs_dsp-return-error-if-block-header-overflo.patch @@ -0,0 +1,65 @@ +From 2fa6daabd6457e7c77de6c0f954755d084581127 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 15:14:30 +0100 +Subject: firmware: cs_dsp: Return error if block header overflows file + +From: Richard Fitzgerald + +[ Upstream commit 959fe01e85b7241e3ec305d657febbe82da16a02 ] + +Return an error from cs_dsp_power_up() if a block header is longer +than the amount of data left in the file. + +The previous code in cs_dsp_load() and cs_dsp_load_coeff() would loop +while there was enough data left in the file for a valid region. This +protected against overrunning the end of the file data, but it didn't +abort the file processing with an error. + +Signed-off-by: Richard Fitzgerald +Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") +Link: https://patch.msgid.link/20240627141432.93056-3-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/firmware/cirrus/cs_dsp.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c +index fd1145b2894b3..208c799af7968 100644 +--- a/drivers/firmware/cirrus/cs_dsp.c ++++ b/drivers/firmware/cirrus/cs_dsp.c +@@ -1348,8 +1348,13 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, + cs_dsp_dbg(dsp, "%s: timestamp %llu\n", file, + le64_to_cpu(footer->timestamp)); + +- while (pos < firmware->size && +- sizeof(*region) < firmware->size - pos) { ++ while (pos < firmware->size) { ++ /* Is there enough data for a complete block header? */ ++ if (sizeof(*region) > firmware->size - pos) { ++ ret = -EOVERFLOW; ++ goto out_fw; ++ } ++ + region = (void *)&(firmware->data[pos]); + region_name = "Unknown"; + reg = 0; +@@ -2037,8 +2042,13 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware + pos = le32_to_cpu(hdr->len); + + blocks = 0; +- while (pos < firmware->size && +- sizeof(*blk) < firmware->size - pos) { ++ while (pos < firmware->size) { ++ /* Is there enough data for a complete block header? */ ++ if (sizeof(*blk) > firmware->size - pos) { ++ ret = -EOVERFLOW; ++ goto out_fw; ++ } ++ + blk = (void *)(&firmware->data[pos]); + + type = le16_to_cpu(blk->type); +-- +2.43.0 + diff --git a/queue-6.1/firmware-cs_dsp-use-strnlen-on-name-fields-in-v1-wmf.patch b/queue-6.1/firmware-cs_dsp-use-strnlen-on-name-fields-in-v1-wmf.patch new file mode 100644 index 00000000000..6952c118287 --- /dev/null +++ b/queue-6.1/firmware-cs_dsp-use-strnlen-on-name-fields-in-v1-wmf.patch @@ -0,0 +1,50 @@ +From de91091663500033b114cebc30d84850e124680a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 15:48:55 +0100 +Subject: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files + +From: Richard Fitzgerald + +[ Upstream commit 680e126ec0400f6daecf0510c5bb97a55779ff03 ] + +Use strnlen() instead of strlen() on the algorithm and coefficient name +string arrays in V1 wmfw files. + +In V1 wmfw files the name is a NUL-terminated string in a fixed-size +array. cs_dsp should protect against overrunning the array if the NUL +terminator is missing. + +Signed-off-by: Richard Fitzgerald +Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") +Link: https://patch.msgid.link/20240708144855.385332-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/firmware/cirrus/cs_dsp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c +index eb6caeba6cdc3..ee4c32669607f 100644 +--- a/drivers/firmware/cirrus/cs_dsp.c ++++ b/drivers/firmware/cirrus/cs_dsp.c +@@ -1089,7 +1089,7 @@ static int cs_dsp_coeff_parse_alg(struct cs_dsp *dsp, + + blk->id = le32_to_cpu(raw->id); + blk->name = raw->name; +- blk->name_len = strlen(raw->name); ++ blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name)); + blk->ncoeff = le32_to_cpu(raw->ncoeff); + + pos = sizeof(*raw); +@@ -1165,7 +1165,7 @@ static int cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp, + return -EOVERFLOW; + + blk->name = raw->name; +- blk->name_len = strlen(raw->name); ++ blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name)); + blk->ctl_type = le16_to_cpu(raw->ctl_type); + blk->flags = le16_to_cpu(raw->flags); + blk->len = le32_to_cpu(raw->len); +-- +2.43.0 + diff --git a/queue-6.1/firmware-cs_dsp-validate-payload-length-before-proce.patch b/queue-6.1/firmware-cs_dsp-validate-payload-length-before-proce.patch new file mode 100644 index 00000000000..c0db4462516 --- /dev/null +++ b/queue-6.1/firmware-cs_dsp-validate-payload-length-before-proce.patch @@ -0,0 +1,104 @@ +From 56871c65491f36fa330abfd4130a8d15a4029a18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 15:14:31 +0100 +Subject: firmware: cs_dsp: Validate payload length before processing block + +From: Richard Fitzgerald + +[ Upstream commit 6598afa9320b6ab13041616950ca5f8f938c0cf1 ] + +Move the payload length check in cs_dsp_load() and cs_dsp_coeff_load() +to be done before the block is processed. + +The check that the length of a block payload does not exceed the number +of remaining bytes in the firwmware file buffer was being done near the +end of the loop iteration. However, some code before that check used the +length field without validating it. + +Signed-off-by: Richard Fitzgerald +Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") +Link: https://patch.msgid.link/20240627141432.93056-4-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/firmware/cirrus/cs_dsp.c | 36 +++++++++++++------------------- + 1 file changed, 15 insertions(+), 21 deletions(-) + +diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c +index 208c799af7968..7882f3a5f8556 100644 +--- a/drivers/firmware/cirrus/cs_dsp.c ++++ b/drivers/firmware/cirrus/cs_dsp.c +@@ -1356,6 +1356,12 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, + } + + region = (void *)&(firmware->data[pos]); ++ ++ if (le32_to_cpu(region->len) > firmware->size - pos - sizeof(*region)) { ++ ret = -EOVERFLOW; ++ goto out_fw; ++ } ++ + region_name = "Unknown"; + reg = 0; + text = NULL; +@@ -1412,16 +1418,6 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, + regions, le32_to_cpu(region->len), offset, + region_name); + +- if (le32_to_cpu(region->len) > +- firmware->size - pos - sizeof(*region)) { +- cs_dsp_err(dsp, +- "%s.%d: %s region len %d bytes exceeds file length %zu\n", +- file, regions, region_name, +- le32_to_cpu(region->len), firmware->size); +- ret = -EINVAL; +- goto out_fw; +- } +- + if (text) { + memcpy(text, region->data, le32_to_cpu(region->len)); + cs_dsp_info(dsp, "%s: %s\n", file, text); +@@ -2051,6 +2047,11 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware + + blk = (void *)(&firmware->data[pos]); + ++ if (le32_to_cpu(blk->len) > firmware->size - pos - sizeof(*blk)) { ++ ret = -EOVERFLOW; ++ goto out_fw; ++ } ++ + type = le16_to_cpu(blk->type); + offset = le16_to_cpu(blk->offset); + version = le32_to_cpu(blk->ver) >> 8; +@@ -2146,17 +2147,6 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware + } + + if (reg) { +- if (le32_to_cpu(blk->len) > +- firmware->size - pos - sizeof(*blk)) { +- cs_dsp_err(dsp, +- "%s.%d: %s region len %d bytes exceeds file length %zu\n", +- file, blocks, region_name, +- le32_to_cpu(blk->len), +- firmware->size); +- ret = -EINVAL; +- goto out_fw; +- } +- + buf = cs_dsp_buf_alloc(blk->data, + le32_to_cpu(blk->len), + &buf_list); +@@ -2196,6 +2186,10 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware + regmap_async_complete(regmap); + cs_dsp_buf_free(&buf_list); + kfree(text); ++ ++ if (ret == -EOVERFLOW) ++ cs_dsp_err(dsp, "%s: file content overflows file data\n", file); ++ + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-af-extend-rss-supported-offload-types.patch b/queue-6.1/octeontx2-af-extend-rss-supported-offload-types.patch new file mode 100644 index 00000000000..ca6fb11de67 --- /dev/null +++ b/queue-6.1/octeontx2-af-extend-rss-supported-offload-types.patch @@ -0,0 +1,155 @@ +From 64819fe16d687710d0cd29602f3be7d5bb813243 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 11:34:20 +0530 +Subject: octeontx2-af: extend RSS supported offload types + +From: Kiran Kumar K + +[ Upstream commit 79bc788c038c9c87224d41ba6bbab20b6bf1a141 ] + +Add support to select L3 SRC or DST only, L4 SRC or DST only for RSS +calculation. + +AF consumer may have requirement as we can select only SRC or DST data for +RSS calculation in L3, L4 layers. With this requirement there will be +following combinations, IPV[4,6]_SRC_ONLY, IPV[4,6]_DST_ONLY, +[TCP,UDP,SCTP]_SRC_ONLY, [TCP,UDP,SCTP]_DST_ONLY. So, instead of creating +a bit for each combination, we are using upper 4 bits (31:28) in the +flow_key_cfg to represent the SRC, DST selection. 31 => L3_SRC, +30 => L3_DST, 29 => L4_SRC, 28 => L4_DST. These won't be part of flow_cfg, +so that we don't need to change the existing ABI. + +Signed-off-by: Kiran Kumar K +Signed-off-by: Geetha sowjanya +Signed-off-by: Naveen Mamindlapalli +Signed-off-by: David S. Miller +Stable-dep-of: e23ac1095b9e ("octeontx2-af: fix issue with IPv6 ext match for RSS") +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/mbox.h | 6 ++ + .../ethernet/marvell/octeontx2/af/rvu_nix.c | 57 +++++++++++++++++++ + 2 files changed, 63 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +index e76d3bc8edea1..c288589446935 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +@@ -1084,6 +1084,8 @@ struct nix_vtag_config_rsp { + */ + }; + ++#define NIX_FLOW_KEY_TYPE_L3_L4_MASK (~(0xf << 28)) ++ + struct nix_rss_flowkey_cfg { + struct mbox_msghdr hdr; + int mcam_index; /* MCAM entry index to modify */ +@@ -1109,6 +1111,10 @@ struct nix_rss_flowkey_cfg { + #define NIX_FLOW_KEY_TYPE_IPV4_PROTO BIT(21) + #define NIX_FLOW_KEY_TYPE_AH BIT(22) + #define NIX_FLOW_KEY_TYPE_ESP BIT(23) ++#define NIX_FLOW_KEY_TYPE_L4_DST_ONLY BIT(28) ++#define NIX_FLOW_KEY_TYPE_L4_SRC_ONLY BIT(29) ++#define NIX_FLOW_KEY_TYPE_L3_DST_ONLY BIT(30) ++#define NIX_FLOW_KEY_TYPE_L3_SRC_ONLY BIT(31) + u32 flowkey_cfg; /* Flowkey types selected */ + u8 group; /* RSS context or group */ + }; +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 67080d5053e07..8a18497ad1a03 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -3361,6 +3361,7 @@ static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + struct nix_rx_flowkey_alg *field; + struct nix_rx_flowkey_alg tmp; + u32 key_type, valid_key; ++ u32 l3_l4_src_dst; + int l4_key_offset = 0; + + if (!alg) +@@ -3388,6 +3389,15 @@ static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + * group_member - Enabled when protocol is part of a group. + */ + ++ /* Last 4 bits (31:28) are reserved to specify SRC, DST ++ * selection for L3, L4 i.e IPV[4,6]_SRC, IPV[4,6]_DST, ++ * [TCP,UDP,SCTP]_SRC, [TCP,UDP,SCTP]_DST ++ * 31 => L3_SRC, 30 => L3_DST, 29 => L4_SRC, 28 => L4_DST ++ */ ++ l3_l4_src_dst = flow_cfg; ++ /* Reset these 4 bits, so that these won't be part of key */ ++ flow_cfg &= NIX_FLOW_KEY_TYPE_L3_L4_MASK; ++ + keyoff_marker = 0; max_key_off = 0; group_member = 0; + nr_field = 0; key_off = 0; field_marker = 1; + field = &tmp; max_bit_pos = fls(flow_cfg); +@@ -3425,6 +3435,22 @@ static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + } + field->hdr_offset = 12; /* SIP offset */ + field->bytesm1 = 7; /* SIP + DIP, 8 bytes */ ++ ++ /* Only SIP */ ++ if (l3_l4_src_dst & NIX_FLOW_KEY_TYPE_L3_SRC_ONLY) ++ field->bytesm1 = 3; /* SIP, 4 bytes */ ++ ++ if (l3_l4_src_dst & NIX_FLOW_KEY_TYPE_L3_DST_ONLY) { ++ /* Both SIP + DIP */ ++ if (field->bytesm1 == 3) { ++ field->bytesm1 = 7; /* SIP + DIP, 8B */ ++ } else { ++ /* Only DIP */ ++ field->hdr_offset = 16; /* DIP off */ ++ field->bytesm1 = 3; /* DIP, 4 bytes */ ++ } ++ } ++ + field->ltype_mask = 0xF; /* Match only IPv4 */ + keyoff_marker = false; + break; +@@ -3438,6 +3464,22 @@ static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + } + field->hdr_offset = 8; /* SIP offset */ + field->bytesm1 = 31; /* SIP + DIP, 32 bytes */ ++ ++ /* Only SIP */ ++ if (l3_l4_src_dst & NIX_FLOW_KEY_TYPE_L3_SRC_ONLY) ++ field->bytesm1 = 15; /* SIP, 16 bytes */ ++ ++ if (l3_l4_src_dst & NIX_FLOW_KEY_TYPE_L3_DST_ONLY) { ++ /* Both SIP + DIP */ ++ if (field->bytesm1 == 15) { ++ /* SIP + DIP, 32 bytes */ ++ field->bytesm1 = 31; ++ } else { ++ /* Only DIP */ ++ field->hdr_offset = 24; /* DIP off */ ++ field->bytesm1 = 15; /* DIP,16 bytes */ ++ } ++ } + field->ltype_mask = 0xF; /* Match only IPv6 */ + break; + case NIX_FLOW_KEY_TYPE_TCP: +@@ -3453,6 +3495,21 @@ static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + field->lid = NPC_LID_LH; + field->bytesm1 = 3; /* Sport + Dport, 4 bytes */ + ++ if (l3_l4_src_dst & NIX_FLOW_KEY_TYPE_L4_SRC_ONLY) ++ field->bytesm1 = 1; /* SRC, 2 bytes */ ++ ++ if (l3_l4_src_dst & NIX_FLOW_KEY_TYPE_L4_DST_ONLY) { ++ /* Both SRC + DST */ ++ if (field->bytesm1 == 1) { ++ /* SRC + DST, 4 bytes */ ++ field->bytesm1 = 3; ++ } else { ++ /* Only DIP */ ++ field->hdr_offset = 2; /* DST off */ ++ field->bytesm1 = 1; /* DST, 2 bytes */ ++ } ++ } ++ + /* Enum values for NPC_LID_LD and NPC_LID_LG are same, + * so no need to change the ltype_match, just change + * the lid for inner protocols +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-af-fix-a-issue-with-cpt_lf_alloc-mailbox.patch b/queue-6.1/octeontx2-af-fix-a-issue-with-cpt_lf_alloc-mailbox.patch new file mode 100644 index 00000000000..654b80bc001 --- /dev/null +++ b/queue-6.1/octeontx2-af-fix-a-issue-with-cpt_lf_alloc-mailbox.patch @@ -0,0 +1,37 @@ +From 5b219684f718fec1ea0a12a4d3f3fc751ccc371e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 13:21:24 +0530 +Subject: octeontx2-af: fix a issue with cpt_lf_alloc mailbox + +From: Srujana Challa + +[ Upstream commit 845fe19139ab5a1ee303a3bee327e3191c3938af ] + +This patch fixes CPT_LF_ALLOC mailbox error due to +incompatible mailbox message format. Specifically, it +corrects the `blkaddr` field type from `int` to `u8`. + +Fixes: de2854c87c64 ("octeontx2-af: Mailbox changes for 98xx CPT block") +Signed-off-by: Srujana Challa +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +index 7c3d7e61afeb3..e76d3bc8edea1 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +@@ -1627,7 +1627,7 @@ struct cpt_lf_alloc_req_msg { + u16 nix_pf_func; + u16 sso_pf_func; + u16 eng_grpmsk; +- int blkaddr; ++ u8 blkaddr; + u8 ctx_ilen_valid : 1; + u8 ctx_ilen : 7; + }; +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-af-fix-detection-of-ip-layer.patch b/queue-6.1/octeontx2-af-fix-detection-of-ip-layer.patch new file mode 100644 index 00000000000..6c3fbc7ea15 --- /dev/null +++ b/queue-6.1/octeontx2-af-fix-detection-of-ip-layer.patch @@ -0,0 +1,52 @@ +From 3c580d9a7f53bc4d96b2786d807a973fba9cc21d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 13:21:25 +0530 +Subject: octeontx2-af: fix detection of IP layer + +From: Michal Mazur + +[ Upstream commit 404dc0fd6fb0bb942b18008c6f8c0320b80aca20 ] + +Checksum and length checks are not enabled for IPv4 header with +options and IPv6 with extension headers. +To fix this a change in enum npc_kpu_lc_ltype is required which will +allow adjustment of LTYPE_MASK to detect all types of IP headers. + +Fixes: 21e6699e5cd6 ("octeontx2-af: Add NPC KPU profile") +Signed-off-by: Michal Mazur +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/npc.h | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc.h b/drivers/net/ethernet/marvell/octeontx2/af/npc.h +index aaff91bc7415a..32a9425a2b1ea 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/npc.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/npc.h +@@ -63,8 +63,13 @@ enum npc_kpu_lb_ltype { + NPC_LT_LB_CUSTOM1 = 0xF, + }; + ++/* Don't modify ltypes up to IP6_EXT, otherwise length and checksum of IP ++ * headers may not be checked correctly. IPv4 ltypes and IPv6 ltypes must ++ * differ only at bit 0 so mask 0xE can be used to detect extended headers. ++ */ + enum npc_kpu_lc_ltype { +- NPC_LT_LC_IP = 1, ++ NPC_LT_LC_PTP = 1, ++ NPC_LT_LC_IP, + NPC_LT_LC_IP_OPT, + NPC_LT_LC_IP6, + NPC_LT_LC_IP6_EXT, +@@ -72,7 +77,6 @@ enum npc_kpu_lc_ltype { + NPC_LT_LC_RARP, + NPC_LT_LC_MPLS, + NPC_LT_LC_NSH, +- NPC_LT_LC_PTP, + NPC_LT_LC_FCOE, + NPC_LT_LC_NGIO, + NPC_LT_LC_CUSTOM0 = 0xE, +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-af-fix-issue-with-ipv4-match-for-rss.patch b/queue-6.1/octeontx2-af-fix-issue-with-ipv4-match-for-rss.patch new file mode 100644 index 00000000000..9933c678ca0 --- /dev/null +++ b/queue-6.1/octeontx2-af-fix-issue-with-ipv4-match-for-rss.patch @@ -0,0 +1,57 @@ +From 13734472e912e83074c2eee48a977b3fb816629b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 13:21:27 +0530 +Subject: octeontx2-af: fix issue with IPv4 match for RSS + +From: Satheesh Paul + +[ Upstream commit 60795bbf047654c9f8ae88d34483233a56033578 ] + +While performing RSS based on IPv4, packets with +IPv4 options are not being considered. Adding changes +to match both plain IPv4 and IPv4 with option header. + +Fixes: 41a7aa7b800d ("octeontx2-af: NIX Rx flowkey configuration for RSS") +Signed-off-by: Satheesh Paul +Reviewed-by: Kalesh AP +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 8be809aa72a95..ef526408b0bd2 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -3356,6 +3356,8 @@ static int get_flowkey_alg_idx(struct nix_hw *nix_hw, u32 flow_cfg) + + /* Mask to match ipv6(NPC_LT_LC_IP6) and ipv6 ext(NPC_LT_LC_IP6_EXT) */ + #define NPC_LT_LC_IP6_MATCH_MSK ((~(NPC_LT_LC_IP6 ^ NPC_LT_LC_IP6_EXT)) & 0xf) ++/* Mask to match both ipv4(NPC_LT_LC_IP) and ipv4 ext(NPC_LT_LC_IP_OPT) */ ++#define NPC_LT_LC_IP_MATCH_MSK ((~(NPC_LT_LC_IP ^ NPC_LT_LC_IP_OPT)) & 0xf) + + static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + { +@@ -3426,7 +3428,7 @@ static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + field->hdr_offset = 9; /* offset */ + field->bytesm1 = 0; /* 1 byte */ + field->ltype_match = NPC_LT_LC_IP; +- field->ltype_mask = 0xF; ++ field->ltype_mask = NPC_LT_LC_IP_MATCH_MSK; + break; + case NIX_FLOW_KEY_TYPE_IPV4: + case NIX_FLOW_KEY_TYPE_INNR_IPV4: +@@ -3453,8 +3455,7 @@ static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + field->bytesm1 = 3; /* DIP, 4 bytes */ + } + } +- +- field->ltype_mask = 0xF; /* Match only IPv4 */ ++ field->ltype_mask = NPC_LT_LC_IP_MATCH_MSK; + keyoff_marker = false; + break; + case NIX_FLOW_KEY_TYPE_IPV6: +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-af-fix-issue-with-ipv6-ext-match-for-rss.patch b/queue-6.1/octeontx2-af-fix-issue-with-ipv6-ext-match-for-rss.patch new file mode 100644 index 00000000000..602fc24cc98 --- /dev/null +++ b/queue-6.1/octeontx2-af-fix-issue-with-ipv6-ext-match-for-rss.patch @@ -0,0 +1,50 @@ +From 8093c23d0cf46f455d72bc81366d247f8b9a7e36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 13:21:26 +0530 +Subject: octeontx2-af: fix issue with IPv6 ext match for RSS + +From: Kiran Kumar K + +[ Upstream commit e23ac1095b9eb8ac48f98c398d81d6ba062c9b5d ] + +While performing RSS based on IPv6, extension ltype +is not being considered. This will be problem for +fragmented packets or packets with extension header. +Adding changes to match IPv6 ext header along with IPv6 +ltype. + +Fixes: 41a7aa7b800d ("octeontx2-af: NIX Rx flowkey configuration for RSS") +Signed-off-by: Kiran Kumar K +Reviewed-by: Kalesh AP +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 8a18497ad1a03..8be809aa72a95 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -3354,6 +3354,9 @@ static int get_flowkey_alg_idx(struct nix_hw *nix_hw, u32 flow_cfg) + return -ERANGE; + } + ++/* Mask to match ipv6(NPC_LT_LC_IP6) and ipv6 ext(NPC_LT_LC_IP6_EXT) */ ++#define NPC_LT_LC_IP6_MATCH_MSK ((~(NPC_LT_LC_IP6 ^ NPC_LT_LC_IP6_EXT)) & 0xf) ++ + static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + { + int idx, nr_field, key_off, field_marker, keyoff_marker; +@@ -3480,7 +3483,7 @@ static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg) + field->bytesm1 = 15; /* DIP,16 bytes */ + } + } +- field->ltype_mask = 0xF; /* Match only IPv6 */ ++ field->ltype_mask = NPC_LT_LC_IP6_MATCH_MSK; + break; + case NIX_FLOW_KEY_TYPE_TCP: + case NIX_FLOW_KEY_TYPE_UDP: +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-af-replace-cpt-slot-with-lf-id-on-reg-writ.patch b/queue-6.1/octeontx2-af-replace-cpt-slot-with-lf-id-on-reg-writ.patch new file mode 100644 index 00000000000..d5c27d77533 --- /dev/null +++ b/queue-6.1/octeontx2-af-replace-cpt-slot-with-lf-id-on-reg-writ.patch @@ -0,0 +1,71 @@ +From a7244dace4983ce0437205cb4172fc2e6cb30c32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 13:21:23 +0530 +Subject: octeontx2-af: replace cpt slot with lf id on reg write + +From: Nithin Dabilpuram + +[ Upstream commit bc35e28af7890085dcbe5cc32373647dfb4d9af9 ] + +Replace slot id with global CPT lf id on reg read/write as +CPTPF/VF driver would send slot number instead of global +lf id in the reg offset. And also update the mailbox response +with the global lf's register offset. + +Fixes: ae454086e3c2 ("octeontx2-af: add mailbox interface for CPT") +Signed-off-by: Nithin Dabilpuram +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/af/rvu_cpt.c | 23 +++++++++++++------ + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c +index 6fb02b93c1718..63a52cc8592a0 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c +@@ -692,7 +692,8 @@ int rvu_mbox_handler_cpt_rd_wr_register(struct rvu *rvu, + struct cpt_rd_wr_reg_msg *req, + struct cpt_rd_wr_reg_msg *rsp) + { +- int blkaddr; ++ u64 offset = req->reg_offset; ++ int blkaddr, lf; + + blkaddr = validate_and_get_cpt_blkaddr(req->blkaddr); + if (blkaddr < 0) +@@ -703,17 +704,25 @@ int rvu_mbox_handler_cpt_rd_wr_register(struct rvu *rvu, + !is_cpt_vf(rvu, req->hdr.pcifunc)) + return CPT_AF_ERR_ACCESS_DENIED; + +- rsp->reg_offset = req->reg_offset; +- rsp->ret_val = req->ret_val; +- rsp->is_write = req->is_write; +- + if (!is_valid_offset(rvu, req)) + return CPT_AF_ERR_ACCESS_DENIED; + ++ /* Translate local LF used by VFs to global CPT LF */ ++ lf = rvu_get_lf(rvu, &rvu->hw->block[blkaddr], req->hdr.pcifunc, ++ (offset & 0xFFF) >> 3); ++ ++ /* Translate local LF's offset to global CPT LF's offset */ ++ offset &= 0xFF000; ++ offset += lf << 3; ++ ++ rsp->reg_offset = offset; ++ rsp->ret_val = req->ret_val; ++ rsp->is_write = req->is_write; ++ + if (req->is_write) +- rvu_write64(rvu, blkaddr, req->reg_offset, req->val); ++ rvu_write64(rvu, blkaddr, offset, req->val); + else +- rsp->val = rvu_read64(rvu, blkaddr, req->reg_offset); ++ rsp->val = rvu_read64(rvu, blkaddr, offset); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-af-update-cpt-lf-alloc-mailbox.patch b/queue-6.1/octeontx2-af-update-cpt-lf-alloc-mailbox.patch new file mode 100644 index 00000000000..443f90175d4 --- /dev/null +++ b/queue-6.1/octeontx2-af-update-cpt-lf-alloc-mailbox.patch @@ -0,0 +1,69 @@ +From 10bda86ab657a7e019050584a80479365ba5514f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 17:33:53 +0530 +Subject: octeontx2-af: update cpt lf alloc mailbox + +From: Srujana Challa + +[ Upstream commit c0688ec002a451d04a51d43b849765c5ce6cb36f ] + +The CN10K CPT coprocessor contains a context processor +to accelerate updates to the IPsec security association +contexts. The context processor contains a context cache. +This patch updates CPT LF ALLOC mailbox to config ctx_ilen +requested by VFs. CPT_LF_ALLOC:ctx_ilen is the size of +initial context fetch. + +Signed-off-by: Srujana Challa +Signed-off-by: David S. Miller +Stable-dep-of: 845fe19139ab ("octeontx2-af: fix a issue with cpt_lf_alloc mailbox") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 2 ++ + drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c | 10 +++++++--- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +index be70269e91684..7c3d7e61afeb3 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +@@ -1628,6 +1628,8 @@ struct cpt_lf_alloc_req_msg { + u16 sso_pf_func; + u16 eng_grpmsk; + int blkaddr; ++ u8 ctx_ilen_valid : 1; ++ u8 ctx_ilen : 7; + }; + + #define CPT_INLINE_INBOUND 0 +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c +index 63a52cc8592a0..b226a4d376aab 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c +@@ -17,7 +17,7 @@ + #define PCI_DEVID_OTX2_CPT10K_PF 0xA0F2 + + /* Length of initial context fetch in 128 byte words */ +-#define CPT_CTX_ILEN 2ULL ++#define CPT_CTX_ILEN 1ULL + + #define cpt_get_eng_sts(e_min, e_max, rsp, etype) \ + ({ \ +@@ -429,8 +429,12 @@ int rvu_mbox_handler_cpt_lf_alloc(struct rvu *rvu, + + /* Set CPT LF group and priority */ + val = (u64)req->eng_grpmsk << 48 | 1; +- if (!is_rvu_otx2(rvu)) +- val |= (CPT_CTX_ILEN << 17); ++ if (!is_rvu_otx2(rvu)) { ++ if (req->ctx_ilen_valid) ++ val |= (req->ctx_ilen << 17); ++ else ++ val |= (CPT_CTX_ILEN << 17); ++ } + + rvu_write64(rvu, blkaddr, CPT_AF_LFX_CTL(cptlf), val); + +-- +2.43.0 + diff --git a/queue-6.1/s390-mark-psw-in-__load_psw_mask-as-__unitialized.patch b/queue-6.1/s390-mark-psw-in-__load_psw_mask-as-__unitialized.patch new file mode 100644 index 00000000000..b7542981af0 --- /dev/null +++ b/queue-6.1/s390-mark-psw-in-__load_psw_mask-as-__unitialized.patch @@ -0,0 +1,47 @@ +From c9510a53244422804516ff3f1268a205d844aae0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 16:30:01 +0200 +Subject: s390: Mark psw in __load_psw_mask() as __unitialized + +From: Sven Schnelle + +[ Upstream commit 7278a8fb8d032dfdc03d9b5d17e0bc451cdc1492 ] + +Without __unitialized, the following code is generated when +INIT_STACK_ALL_ZERO is enabled: + +86: d7 0f f0 a0 f0 a0 xc 160(16,%r15), 160(%r15) +8c: e3 40 f0 a0 00 24 stg %r4, 160(%r15) +92: c0 10 00 00 00 08 larl %r1, 0xa2 +98: e3 10 f0 a8 00 24 stg %r1, 168(%r15) +9e: b2 b2 f0 a0 lpswe 160(%r15) + +The xc is not adding any security because psw is fully initialized +with the following instructions. Add __unitialized to the psw +definitiation to avoid the superfluous clearing of psw. + +Reviewed-by: Heiko Carstens +Signed-off-by: Sven Schnelle +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/processor.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h +index c907f747d2a04..26861b09293f1 100644 +--- a/arch/s390/include/asm/processor.h ++++ b/arch/s390/include/asm/processor.h +@@ -250,8 +250,8 @@ static inline void __load_psw(psw_t psw) + */ + static __always_inline void __load_psw_mask(unsigned long mask) + { ++ psw_t psw __uninitialized; + unsigned long addr; +- psw_t psw; + + psw.mask = mask; + +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 5d2462af1e2..5e10e4fb9e0 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -27,3 +27,17 @@ ethtool-netlink-do-not-return-sqi-value-if-link-is-d.patch udp-set-sock_rcu_free-earlier-in-udp_lib_get_port.patch net-sched-fix-uaf-when-resolving-a-clash.patch net-sunrpc-remap-eperm-in-case-of-connection-failure.patch +s390-mark-psw-in-__load_psw_mask-as-__unitialized.patch +firmware-cs_dsp-fix-overflow-checking-of-wmfw-header.patch +firmware-cs_dsp-return-error-if-block-header-overflo.patch +firmware-cs_dsp-validate-payload-length-before-proce.patch +firmware-cs_dsp-prevent-buffer-overrun-when-processi.patch +firmware-cs_dsp-use-strnlen-on-name-fields-in-v1-wmf.patch +arm-davinci-convert-comma-to-semicolon.patch +octeontx2-af-replace-cpt-slot-with-lf-id-on-reg-writ.patch +octeontx2-af-update-cpt-lf-alloc-mailbox.patch +octeontx2-af-fix-a-issue-with-cpt_lf_alloc-mailbox.patch +octeontx2-af-fix-detection-of-ip-layer.patch +octeontx2-af-extend-rss-supported-offload-types.patch +octeontx2-af-fix-issue-with-ipv6-ext-match-for-rss.patch +octeontx2-af-fix-issue-with-ipv4-match-for-rss.patch