From: Sasha Levin Date: Sat, 9 Dec 2023 02:36:55 +0000 (-0500) Subject: Fixes for 6.6 X-Git-Tag: v6.6.6~55 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d81d46eaa0cafd1a29b70e437641cf3191b00bb4;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/arcnet-restoring-support-for-multiple-sohard-arcnet-.patch b/queue-6.6/arcnet-restoring-support-for-multiple-sohard-arcnet-.patch new file mode 100644 index 00000000000..87a312d6704 --- /dev/null +++ b/queue-6.6/arcnet-restoring-support-for-multiple-sohard-arcnet-.patch @@ -0,0 +1,216 @@ +From 6daad650b6eecf45c16edc9203b29a80de231204 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 12:35:03 +0100 +Subject: arcnet: restoring support for multiple Sohard Arcnet cards + +From: Thomas Reichinger + +[ Upstream commit 6b17a597fc2f13aaaa0a2780eb7edb9ae7ac9aea ] + +Probe of Sohard Arcnet cards fails, +if 2 or more cards are installed in a system. +See kernel log: +[ 2.759203] arcnet: arcnet loaded +[ 2.763648] arcnet:com20020: COM20020 chipset support (by David Woodhouse et al.) +[ 2.770585] arcnet:com20020_pci: COM20020 PCI support +[ 2.772295] com20020 0000:02:00.0: enabling device (0000 -> 0003) +[ 2.772354] (unnamed net_device) (uninitialized): PLX-PCI Controls +... +[ 3.071301] com20020 0000:02:00.0 arc0-0 (uninitialized): PCI COM20020: station FFh found at F080h, IRQ 101. +[ 3.071305] com20020 0000:02:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s +[ 3.071534] com20020 0000:07:00.0: enabling device (0000 -> 0003) +[ 3.071581] (unnamed net_device) (uninitialized): PLX-PCI Controls +... +[ 3.369501] com20020 0000:07:00.0: Led pci:green:tx:0-0 renamed to pci:green:tx:0-0_1 due to name collision +[ 3.369535] com20020 0000:07:00.0: Led pci:red:recon:0-0 renamed to pci:red:recon:0-0_1 due to name collision +[ 3.370586] com20020 0000:07:00.0 arc0-0 (uninitialized): PCI COM20020: station E1h found at C000h, IRQ 35. +[ 3.370589] com20020 0000:07:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s +[ 3.370608] com20020: probe of 0000:07:00.0 failed with error -5 + +commit 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support") +changes the device name of all COM20020 based PCI cards, +even if only some cards support this: + snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i); + +The error happens because all Sohard Arcnet cards would be called arc0-0, +since the Sohard Arcnet cards don't have a PLX rotary coder. +I.e. EAE Arcnet cards have a PLX rotary coder, +which sets the first decimal, ensuring unique devices names. + +This patch adds two new card feature flags to indicate +which cards support LEDs and the PLX rotary coder. +For EAE based cards the names still depend on the PLX rotary coder +(untested, since missing EAE hardware). +For Sohard based cards, this patch will result in devices +being called arc0, arc1, ... (tested). + +Signed-off-by: Thomas Reichinger +Fixes: 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support") +Link: https://lore.kernel.org/r/20231130113503.6812-1-thomas.reichinger@sohard.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/arcnet/arcdevice.h | 2 + + drivers/net/arcnet/com20020-pci.c | 89 ++++++++++++++++--------------- + 2 files changed, 48 insertions(+), 43 deletions(-) + +diff --git a/drivers/net/arcnet/arcdevice.h b/drivers/net/arcnet/arcdevice.h +index 19e996a829c9d..b54275389f8ac 100644 +--- a/drivers/net/arcnet/arcdevice.h ++++ b/drivers/net/arcnet/arcdevice.h +@@ -186,6 +186,8 @@ do { \ + #define ARC_IS_5MBIT 1 /* card default speed is 5MBit */ + #define ARC_CAN_10MBIT 2 /* card uses COM20022, supporting 10MBit, + but default is 2.5MBit. */ ++#define ARC_HAS_LED 4 /* card has software controlled LEDs */ ++#define ARC_HAS_ROTARY 8 /* card has rotary encoder */ + + /* information needed to define an encapsulation driver */ + struct ArcProto { +diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c +index c580acb8b1d34..7b5c8bb02f119 100644 +--- a/drivers/net/arcnet/com20020-pci.c ++++ b/drivers/net/arcnet/com20020-pci.c +@@ -213,12 +213,13 @@ static int com20020pci_probe(struct pci_dev *pdev, + if (!strncmp(ci->name, "EAE PLX-PCI FB2", 15)) + lp->backplane = 1; + +- /* Get the dev_id from the PLX rotary coder */ +- if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15)) +- dev_id_mask = 0x3; +- dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask; +- +- snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i); ++ if (ci->flags & ARC_HAS_ROTARY) { ++ /* Get the dev_id from the PLX rotary coder */ ++ if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15)) ++ dev_id_mask = 0x3; ++ dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask; ++ snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i); ++ } + + if (arcnet_inb(ioaddr, COM20020_REG_R_STATUS) == 0xFF) { + pr_err("IO address %Xh is empty!\n", ioaddr); +@@ -230,6 +231,10 @@ static int com20020pci_probe(struct pci_dev *pdev, + goto err_free_arcdev; + } + ++ ret = com20020_found(dev, IRQF_SHARED); ++ if (ret) ++ goto err_free_arcdev; ++ + card = devm_kzalloc(&pdev->dev, sizeof(struct com20020_dev), + GFP_KERNEL); + if (!card) { +@@ -239,41 +244,39 @@ static int com20020pci_probe(struct pci_dev *pdev, + + card->index = i; + card->pci_priv = priv; +- card->tx_led.brightness_set = led_tx_set; +- card->tx_led.default_trigger = devm_kasprintf(&pdev->dev, +- GFP_KERNEL, "arc%d-%d-tx", +- dev->dev_id, i); +- card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, +- "pci:green:tx:%d-%d", +- dev->dev_id, i); +- +- card->tx_led.dev = &dev->dev; +- card->recon_led.brightness_set = led_recon_set; +- card->recon_led.default_trigger = devm_kasprintf(&pdev->dev, +- GFP_KERNEL, "arc%d-%d-recon", +- dev->dev_id, i); +- card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, +- "pci:red:recon:%d-%d", +- dev->dev_id, i); +- card->recon_led.dev = &dev->dev; +- card->dev = dev; +- +- ret = devm_led_classdev_register(&pdev->dev, &card->tx_led); +- if (ret) +- goto err_free_arcdev; + +- ret = devm_led_classdev_register(&pdev->dev, &card->recon_led); +- if (ret) +- goto err_free_arcdev; +- +- dev_set_drvdata(&dev->dev, card); +- +- ret = com20020_found(dev, IRQF_SHARED); +- if (ret) +- goto err_free_arcdev; +- +- devm_arcnet_led_init(dev, dev->dev_id, i); ++ if (ci->flags & ARC_HAS_LED) { ++ card->tx_led.brightness_set = led_tx_set; ++ card->tx_led.default_trigger = devm_kasprintf(&pdev->dev, ++ GFP_KERNEL, "arc%d-%d-tx", ++ dev->dev_id, i); ++ card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, ++ "pci:green:tx:%d-%d", ++ dev->dev_id, i); ++ ++ card->tx_led.dev = &dev->dev; ++ card->recon_led.brightness_set = led_recon_set; ++ card->recon_led.default_trigger = devm_kasprintf(&pdev->dev, ++ GFP_KERNEL, "arc%d-%d-recon", ++ dev->dev_id, i); ++ card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, ++ "pci:red:recon:%d-%d", ++ dev->dev_id, i); ++ card->recon_led.dev = &dev->dev; ++ ++ ret = devm_led_classdev_register(&pdev->dev, &card->tx_led); ++ if (ret) ++ goto err_free_arcdev; ++ ++ ret = devm_led_classdev_register(&pdev->dev, &card->recon_led); ++ if (ret) ++ goto err_free_arcdev; ++ ++ dev_set_drvdata(&dev->dev, card); ++ devm_arcnet_led_init(dev, dev->dev_id, i); ++ } + ++ card->dev = dev; + list_add(&card->list, &priv->list_dev); + continue; + +@@ -329,7 +332,7 @@ static struct com20020_pci_card_info card_info_5mbit = { + }; + + static struct com20020_pci_card_info card_info_sohard = { +- .name = "PLX-PCI", ++ .name = "SOHARD SH ARC-PCI", + .devcount = 1, + /* SOHARD needs PCI base addr 4 */ + .chan_map_tbl = { +@@ -364,7 +367,7 @@ static struct com20020_pci_card_info card_info_eae_arc1 = { + }, + }, + .rotary = 0x0, +- .flags = ARC_CAN_10MBIT, ++ .flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT, + }; + + static struct com20020_pci_card_info card_info_eae_ma1 = { +@@ -396,7 +399,7 @@ static struct com20020_pci_card_info card_info_eae_ma1 = { + }, + }, + .rotary = 0x0, +- .flags = ARC_CAN_10MBIT, ++ .flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT, + }; + + static struct com20020_pci_card_info card_info_eae_fb2 = { +@@ -421,7 +424,7 @@ static struct com20020_pci_card_info card_info_eae_fb2 = { + }, + }, + .rotary = 0x0, +- .flags = ARC_CAN_10MBIT, ++ .flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT, + }; + + static const struct pci_device_id com20020pci_id_table[] = { +-- +2.42.0 + diff --git a/queue-6.6/bpf-fix-a-verifier-bug-due-to-incorrect-branch-offse.patch b/queue-6.6/bpf-fix-a-verifier-bug-due-to-incorrect-branch-offse.patch new file mode 100644 index 00000000000..6dcca9e94ae --- /dev/null +++ b/queue-6.6/bpf-fix-a-verifier-bug-due-to-incorrect-branch-offse.patch @@ -0,0 +1,72 @@ +From 478166d775bc5a9125f13720d0f4031f5a26497e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 18:46:40 -0800 +Subject: bpf: Fix a verifier bug due to incorrect branch offset comparison + with cpu=v4 + +From: Yonghong Song + +[ Upstream commit dfce9cb3140592b886838e06f3e0c25fea2a9cae ] + +Bpf cpu=v4 support is introduced in [1] and Commit 4cd58e9af8b9 +("bpf: Support new 32bit offset jmp instruction") added support for new +32bit offset jmp instruction. Unfortunately, in function +bpf_adj_delta_to_off(), for new branch insn with 32bit offset, the offset +(plus/minor a small delta) compares to 16-bit offset bound +[S16_MIN, S16_MAX], which caused the following verification failure: + $ ./test_progs-cpuv4 -t verif_scale_pyperf180 + ... + insn 10 cannot be patched due to 16-bit range + ... + libbpf: failed to load object 'pyperf180.bpf.o' + scale_test:FAIL:expect_success unexpected error: -12 (errno 12) + #405 verif_scale_pyperf180:FAIL + +Note that due to recent llvm18 development, the patch [2] (already applied +in bpf-next) needs to be applied to bpf tree for testing purpose. + +The fix is rather simple. For 32bit offset branch insn, the adjusted +offset compares to [S32_MIN, S32_MAX] and then verification succeeded. + + [1] https://lore.kernel.org/all/20230728011143.3710005-1-yonghong.song@linux.dev + [2] https://lore.kernel.org/bpf/20231110193644.3130906-1-yonghong.song@linux.dev + +Fixes: 4cd58e9af8b9 ("bpf: Support new 32bit offset jmp instruction") +Signed-off-by: Yonghong Song +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20231201024640.3417057-1-yonghong.song@linux.dev +Signed-off-by: Sasha Levin +--- + kernel/bpf/core.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 64fcd81ad3da4..5d1efe5200ba3 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -371,14 +371,18 @@ static int bpf_adj_delta_to_imm(struct bpf_insn *insn, u32 pos, s32 end_old, + static int bpf_adj_delta_to_off(struct bpf_insn *insn, u32 pos, s32 end_old, + s32 end_new, s32 curr, const bool probe_pass) + { +- const s32 off_min = S16_MIN, off_max = S16_MAX; ++ s64 off_min, off_max, off; + s32 delta = end_new - end_old; +- s32 off; + +- if (insn->code == (BPF_JMP32 | BPF_JA)) ++ if (insn->code == (BPF_JMP32 | BPF_JA)) { + off = insn->imm; +- else ++ off_min = S32_MIN; ++ off_max = S32_MAX; ++ } else { + off = insn->off; ++ off_min = S16_MIN; ++ off_max = S16_MAX; ++ } + + if (curr < pos && curr + off + 1 >= end_old) + off += delta; +-- +2.42.0 + diff --git a/queue-6.6/bpf-sockmap-updating-the-sg-structure-should-also-up.patch b/queue-6.6/bpf-sockmap-updating-the-sg-structure-should-also-up.patch new file mode 100644 index 00000000000..2d8f0ed2e48 --- /dev/null +++ b/queue-6.6/bpf-sockmap-updating-the-sg-structure-should-also-up.patch @@ -0,0 +1,74 @@ +From bee01d570576f376807f95c34202c05308d473a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:27:06 -0800 +Subject: bpf: sockmap, updating the sg structure should also update curr + +From: John Fastabend + +[ Upstream commit bb9aefde5bbaf6c168c77ba635c155b4980c2287 ] + +Curr pointer should be updated when the sg structure is shifted. + +Fixes: 7246d8ed4dcce ("bpf: helper to pop data from messages") +Signed-off-by: John Fastabend +Link: https://lore.kernel.org/r/20231206232706.374377-3-john.fastabend@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index b149a165c405c..90fe3e7543833 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2591,6 +2591,22 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes) + return 0; + } + ++static void sk_msg_reset_curr(struct sk_msg *msg) ++{ ++ u32 i = msg->sg.start; ++ u32 len = 0; ++ ++ do { ++ len += sk_msg_elem(msg, i)->length; ++ sk_msg_iter_var_next(i); ++ if (len >= msg->sg.size) ++ break; ++ } while (i != msg->sg.end); ++ ++ msg->sg.curr = i; ++ msg->sg.copybreak = 0; ++} ++ + static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { + .func = bpf_msg_cork_bytes, + .gpl_only = false, +@@ -2710,6 +2726,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_msg *, msg, u32, start, + msg->sg.end - shift + NR_MSG_FRAG_IDS : + msg->sg.end - shift; + out: ++ sk_msg_reset_curr(msg); + msg->data = sg_virt(&msg->sg.data[first_sge]) + start - offset; + msg->data_end = msg->data + bytes; + return 0; +@@ -2846,6 +2863,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, + msg->sg.data[new] = rsge; + } + ++ sk_msg_reset_curr(msg); + sk_msg_compute_data_pointers(msg); + return 0; + } +@@ -3014,6 +3032,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, + + sk_mem_uncharge(msg->sk, len - pop); + msg->sg.size -= (len - pop); ++ sk_msg_reset_curr(msg); + sk_msg_compute_data_pointers(msg); + return 0; + } +-- +2.42.0 + diff --git a/queue-6.6/drm-amd-amdgpu-amdgpu_doorbell_mgr-correct-misdocume.patch b/queue-6.6/drm-amd-amdgpu-amdgpu_doorbell_mgr-correct-misdocume.patch new file mode 100644 index 00000000000..76a293bea9b --- /dev/null +++ b/queue-6.6/drm-amd-amdgpu-amdgpu_doorbell_mgr-correct-misdocume.patch @@ -0,0 +1,39 @@ +From 04971880143e3034ccda1c8b86819b2528b44441 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 08:36:56 +0100 +Subject: drm/amd/amdgpu/amdgpu_doorbell_mgr: Correct misdocumented param + 'doorbell_index' + +From: Lee Jones + +[ Upstream commit 04cef5f58395806294a64118cf8a39534bd032a2 ] + +Fixes the following W=1 kernel build warning(s): + + drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c:123: warning: Function parameter or member 'doorbell_index' not described in 'amdgpu_doorbell_index_on_bar' + drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c:123: warning: Excess function parameter 'db_index' description in 'amdgpu_doorbell_index_on_bar' + +Reviewed-by: Shashank Sharma +Signed-off-by: Lee Jones +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c +index 8eee5d783a92b..599aece42017a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c +@@ -113,7 +113,7 @@ void amdgpu_mm_wdoorbell64(struct amdgpu_device *adev, u32 index, u64 v) + * + * @adev: amdgpu_device pointer + * @db_bo: doorbell object's bo +- * @db_index: doorbell relative index in this doorbell object ++ * @doorbell_index: doorbell relative index in this doorbell object + * + * returns doorbell's absolute index in BAR + */ +-- +2.42.0 + diff --git a/queue-6.6/drm-amdkfd-get-doorbell-s-absolute-offset-based-on-t.patch b/queue-6.6/drm-amdkfd-get-doorbell-s-absolute-offset-based-on-t.patch new file mode 100644 index 00000000000..380d4102c8f --- /dev/null +++ b/queue-6.6/drm-amdkfd-get-doorbell-s-absolute-offset-based-on-t.patch @@ -0,0 +1,144 @@ +From b69a9fdff270074142f4099cdc2c4e1196109f6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2023 22:43:16 +0530 +Subject: drm/amdkfd: get doorbell's absolute offset based on the db_size + +From: Arvind Yadav + +[ Upstream commit 367a0af43373d4f791cc8b466a659ecf5aa52377 ] + +Here, Adding db_size in byte to find the doorbell's +absolute offset for both 32-bit and 64-bit doorbell sizes. +So that doorbell offset will be aligned based on the doorbell +size. + +v2: +- Addressed the review comment from Felix. +v3: +- Adding doorbell_size as parameter to get db absolute offset. +v4: + Squash the two patches into one. + +Cc: Christian Koenig +Cc: Alex Deucher +Reviewed-by: Felix Kuehling +Signed-off-by: Shashank Sharma +Signed-off-by: Arvind Yadav +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell.h | 5 +++-- + drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c | 13 +++++++++---- + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 3 ++- + drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c | 10 ++++++++-- + .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 3 ++- + 5 files changed, 24 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell.h +index 09f6727e7c73a..4a8b33f55f6bc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell.h +@@ -357,8 +357,9 @@ int amdgpu_doorbell_init(struct amdgpu_device *adev); + void amdgpu_doorbell_fini(struct amdgpu_device *adev); + int amdgpu_doorbell_create_kernel_doorbells(struct amdgpu_device *adev); + uint32_t amdgpu_doorbell_index_on_bar(struct amdgpu_device *adev, +- struct amdgpu_bo *db_bo, +- uint32_t doorbell_index); ++ struct amdgpu_bo *db_bo, ++ uint32_t doorbell_index, ++ uint32_t db_size); + + #define RDOORBELL32(index) amdgpu_mm_rdoorbell(adev, (index)) + #define WDOORBELL32(index, v) amdgpu_mm_wdoorbell(adev, (index), (v)) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c +index 599aece42017a..3f3662e8b8710 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c +@@ -114,19 +114,24 @@ void amdgpu_mm_wdoorbell64(struct amdgpu_device *adev, u32 index, u64 v) + * @adev: amdgpu_device pointer + * @db_bo: doorbell object's bo + * @doorbell_index: doorbell relative index in this doorbell object ++ * @db_size: doorbell size is in byte + * + * returns doorbell's absolute index in BAR + */ + uint32_t amdgpu_doorbell_index_on_bar(struct amdgpu_device *adev, +- struct amdgpu_bo *db_bo, +- uint32_t doorbell_index) ++ struct amdgpu_bo *db_bo, ++ uint32_t doorbell_index, ++ uint32_t db_size) + { + int db_bo_offset; + + db_bo_offset = amdgpu_bo_gpu_offset_no_check(db_bo); + +- /* doorbell index is 32 bit but doorbell's size is 64-bit, so *2 */ +- return db_bo_offset / sizeof(u32) + doorbell_index * 2; ++ /* doorbell index is 32 bit but doorbell's size can be 32 bit ++ * or 64 bit, so *db_size(in byte)/4 for alignment. ++ */ ++ return db_bo_offset / sizeof(u32) + doorbell_index * ++ DIV_ROUND_UP(db_size, 4); + } + + /** +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +index 0d3d538b64ebc..e07652e724965 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -407,7 +407,8 @@ static int allocate_doorbell(struct qcm_process_device *qpd, + + q->properties.doorbell_off = amdgpu_doorbell_index_on_bar(dev->adev, + qpd->proc_doorbells, +- q->doorbell_id); ++ q->doorbell_id, ++ dev->kfd->device_info.doorbell_size); + return 0; + } + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c +index 7b38537c7c99b..05c74887fd6fd 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c +@@ -161,7 +161,10 @@ void __iomem *kfd_get_kernel_doorbell(struct kfd_dev *kfd, + if (inx >= KFD_MAX_NUM_OF_QUEUES_PER_PROCESS) + return NULL; + +- *doorbell_off = amdgpu_doorbell_index_on_bar(kfd->adev, kfd->doorbells, inx); ++ *doorbell_off = amdgpu_doorbell_index_on_bar(kfd->adev, ++ kfd->doorbells, ++ inx, ++ kfd->device_info.doorbell_size); + inx *= 2; + + pr_debug("Get kernel queue doorbell\n" +@@ -240,7 +243,10 @@ phys_addr_t kfd_get_process_doorbells(struct kfd_process_device *pdd) + return 0; + } + +- first_db_index = amdgpu_doorbell_index_on_bar(adev, pdd->qpd.proc_doorbells, 0); ++ first_db_index = amdgpu_doorbell_index_on_bar(adev, ++ pdd->qpd.proc_doorbells, ++ 0, ++ pdd->dev->kfd->device_info.doorbell_size); + return adev->doorbell.base + first_db_index * sizeof(uint32_t); + } + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +index adb5e4bdc0b20..77649392e2331 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +@@ -377,7 +377,8 @@ int pqm_create_queue(struct process_queue_manager *pqm, + */ + uint32_t first_db_index = amdgpu_doorbell_index_on_bar(pdd->dev->adev, + pdd->qpd.proc_doorbells, +- 0); ++ 0, ++ pdd->dev->kfd->device_info.doorbell_size); + + *p_doorbell_offset_in_process = (q->properties.doorbell_off + - first_db_index) * sizeof(uint32_t); +-- +2.42.0 + diff --git a/queue-6.6/drop_monitor-require-cap_sys_admin-when-joining-even.patch b/queue-6.6/drop_monitor-require-cap_sys_admin-when-joining-even.patch new file mode 100644 index 00000000000..080afa4e638 --- /dev/null +++ b/queue-6.6/drop_monitor-require-cap_sys_admin-when-joining-even.patch @@ -0,0 +1,164 @@ +From 85f8c6394d4c36e9c47fca080380d9c5636f42cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 23:31:02 +0200 +Subject: drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group + +From: Ido Schimmel + +[ Upstream commit e03781879a0d524ce3126678d50a80484a513c4b ] + +The "NET_DM" generic netlink family notifies drop locations over the +"events" multicast group. This is problematic since by default generic +netlink allows non-root users to listen to these notifications. + +Fix by adding a new field to the generic netlink multicast group +structure that when set prevents non-root users or root without the +'CAP_SYS_ADMIN' capability (in the user namespace owning the network +namespace) from joining the group. Set this field for the "events" +group. Use 'CAP_SYS_ADMIN' rather than 'CAP_NET_ADMIN' because of the +nature of the information that is shared over this group. + +Note that the capability check in this case will always be performed +against the initial user namespace since the family is not netns aware +and only operates in the initial network namespace. + +A new field is added to the structure rather than using the "flags" +field because the existing field uses uAPI flags and it is inappropriate +to add a new uAPI flag for an internal kernel check. In net-next we can +rework the "flags" field to use internal flags and fold the new field +into it. But for now, in order to reduce the amount of changes, add a +new field. + +Since the information can only be consumed by root, mark the control +plane operations that start and stop the tracing as root-only using the +'GENL_ADMIN_PERM' flag. + +Tested using [1]. + +Before: + + # capsh -- -c ./dm_repo + # capsh --drop=cap_sys_admin -- -c ./dm_repo + +After: + + # capsh -- -c ./dm_repo + # capsh --drop=cap_sys_admin -- -c ./dm_repo + Failed to join "events" multicast group + +[1] + $ cat dm.c + #include + #include + #include + #include + + int main(int argc, char **argv) + { + struct nl_sock *sk; + int grp, err; + + sk = nl_socket_alloc(); + if (!sk) { + fprintf(stderr, "Failed to allocate socket\n"); + return -1; + } + + err = genl_connect(sk); + if (err) { + fprintf(stderr, "Failed to connect socket\n"); + return err; + } + + grp = genl_ctrl_resolve_grp(sk, "NET_DM", "events"); + if (grp < 0) { + fprintf(stderr, + "Failed to resolve \"events\" multicast group\n"); + return grp; + } + + err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); + if (err) { + fprintf(stderr, "Failed to join \"events\" multicast group\n"); + return err; + } + + return 0; + } + $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o dm_repo dm.c + +Fixes: 9a8afc8d3962 ("Network Drop Monitor: Adding drop monitor implementation & Netlink protocol") +Reported-by: "The UK's National Cyber Security Centre (NCSC)" +Signed-off-by: Ido Schimmel +Reviewed-by: Jacob Keller +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20231206213102.1824398-3-idosch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/genetlink.h | 2 ++ + net/core/drop_monitor.c | 4 +++- + net/netlink/genetlink.c | 3 +++ + 3 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/include/net/genetlink.h b/include/net/genetlink.h +index e18a4c0d69eed..c53244f204370 100644 +--- a/include/net/genetlink.h ++++ b/include/net/genetlink.h +@@ -12,10 +12,12 @@ + * struct genl_multicast_group - generic netlink multicast group + * @name: name of the multicast group, names are per-family + * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM) ++ * @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding + */ + struct genl_multicast_group { + char name[GENL_NAMSIZ]; + u8 flags; ++ u8 cap_sys_admin:1; + }; + + struct genl_split_ops; +diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c +index aff31cd944c29..b240d9aae4a64 100644 +--- a/net/core/drop_monitor.c ++++ b/net/core/drop_monitor.c +@@ -183,7 +183,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data) + } + + static const struct genl_multicast_group dropmon_mcgrps[] = { +- { .name = "events", }, ++ { .name = "events", .cap_sys_admin = 1 }, + }; + + static void send_dm_alert(struct work_struct *work) +@@ -1619,11 +1619,13 @@ static const struct genl_small_ops dropmon_ops[] = { + .cmd = NET_DM_CMD_START, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .doit = net_dm_cmd_trace, ++ .flags = GENL_ADMIN_PERM, + }, + { + .cmd = NET_DM_CMD_STOP, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .doit = net_dm_cmd_trace, ++ .flags = GENL_ADMIN_PERM, + }, + { + .cmd = NET_DM_CMD_CONFIG_GET, +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index 8315d31b53db4..d41c4a936ad0c 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -1690,6 +1690,9 @@ static int genl_bind(struct net *net, int group) + if ((grp->flags & GENL_UNS_ADMIN_PERM) && + !ns_capable(net->user_ns, CAP_NET_ADMIN)) + ret = -EPERM; ++ if (grp->cap_sys_admin && ++ !ns_capable(net->user_ns, CAP_SYS_ADMIN)) ++ ret = -EPERM; + + break; + } +-- +2.42.0 + diff --git a/queue-6.6/dt-bindings-interrupt-controller-allow-power-domain-.patch b/queue-6.6/dt-bindings-interrupt-controller-allow-power-domain-.patch new file mode 100644 index 00000000000..e8bc11a4ea6 --- /dev/null +++ b/queue-6.6/dt-bindings-interrupt-controller-allow-power-domain-.patch @@ -0,0 +1,45 @@ +From 90af99b65c123000e2ce97ebf79a2587db4af372 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 20:12:31 +0100 +Subject: dt-bindings: interrupt-controller: Allow #power-domain-cells + +From: Konrad Dybcio + +[ Upstream commit c0a2755aced969e0125fd68ccd95269b28d8913a ] + +MPM provides a single genpd. Allow #power-domain-cells = <0>. + +Fixes: 54fc9851c0e0 ("dt-bindings: interrupt-controller: Add Qualcomm MPM support") +Acked-by: Shawn Guo +Acked-by: Krzysztof Kozlowski +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231129-topic-mpmbindingspd-v2-1-acbe909ceee1@linaro.org +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/interrupt-controller/qcom,mpm.yaml | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml b/Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml +index 509d20c091af8..6a206111d4e0f 100644 +--- a/Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml ++++ b/Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml +@@ -62,6 +62,9 @@ properties: + - description: MPM pin number + - description: GIC SPI number for the MPM pin + ++ '#power-domain-cells': ++ const: 0 ++ + required: + - compatible + - reg +@@ -93,4 +96,5 @@ examples: + <86 183>, + <90 260>, + <91 260>; ++ #power-domain-cells = <0>; + }; +-- +2.42.0 + diff --git a/queue-6.6/dt-dt-extract-compatibles-don-t-follow-symlinks-when.patch b/queue-6.6/dt-dt-extract-compatibles-don-t-follow-symlinks-when.patch new file mode 100644 index 00000000000..884608054df --- /dev/null +++ b/queue-6.6/dt-dt-extract-compatibles-don-t-follow-symlinks-when.patch @@ -0,0 +1,75 @@ +From bb423f74c334bc9c216fc264f2a4635f61f3c9ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Nov 2023 17:55:28 -0500 +Subject: dt: dt-extract-compatibles: Don't follow symlinks when walking tree +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 8f51593cdcab82fb23ef2e1a0010b2e6f99aae02 ] + +The iglob function, which we use to find C source files in the kernel +tree, always follows symbolic links. This can cause unintentional +recursions whenever a symbolic link points to a parent directory. A +common scenario is building the kernel with the output set to a +directory inside the kernel tree, which will contain such a symlink. + +Instead of using the iglob function, use os.walk to traverse the +directory tree, which by default doesn't follow symbolic links. fnmatch +is then used to match the glob on the filename, as well as ignore hidden +files (which were ignored by default with iglob). + +This approach runs just as fast as using iglob. + +Fixes: b6acf8073517 ("dt: Add a check for undocumented compatible strings in kernel") +Reported-by: Aishwarya TCV +Closes: https://lore.kernel.org/all/e90cb52f-d55b-d3ba-3933-6cc7b43fcfbc@arm.com +Signed-off-by: "Nícolas F. R. A. Prado" +Link: https://lore.kernel.org/r/20231107225624.9811-1-nfraprado@collabora.com +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + scripts/dtc/dt-extract-compatibles | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/scripts/dtc/dt-extract-compatibles b/scripts/dtc/dt-extract-compatibles +index 2b6d228602e85..2f9d0eb59f5b7 100755 +--- a/scripts/dtc/dt-extract-compatibles ++++ b/scripts/dtc/dt-extract-compatibles +@@ -1,8 +1,8 @@ + #!/usr/bin/env python3 + # SPDX-License-Identifier: GPL-2.0-only + ++import fnmatch + import os +-import glob + import re + import argparse + +@@ -49,10 +49,20 @@ def print_compat(filename, compatibles): + else: + print(*compatibles, sep='\n') + ++def glob_without_symlinks(root, glob): ++ for path, dirs, files in os.walk(root): ++ # Ignore hidden directories ++ for d in dirs: ++ if fnmatch.fnmatch(d, ".*"): ++ dirs.remove(d) ++ for f in files: ++ if fnmatch.fnmatch(f, glob): ++ yield os.path.join(path, f) ++ + def files_to_parse(path_args): + for f in path_args: + if os.path.isdir(f): +- for filename in glob.iglob(f + "/**/*.c", recursive=True): ++ for filename in glob_without_symlinks(f, "*.c"): + yield filename + else: + yield f +-- +2.42.0 + diff --git a/queue-6.6/dt-dt-extract-compatibles-handle-cfile-arguments-in-.patch b/queue-6.6/dt-dt-extract-compatibles-handle-cfile-arguments-in-.patch new file mode 100644 index 00000000000..fc540e60abb --- /dev/null +++ b/queue-6.6/dt-dt-extract-compatibles-handle-cfile-arguments-in-.patch @@ -0,0 +1,62 @@ +From 6072b600ecf90da82d651cfc8924c22ee572afa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Aug 2023 17:13:10 -0400 +Subject: dt: dt-extract-compatibles: Handle cfile arguments in generator + function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit eb2139fc0da63b89a2ad565ecd8133a37e8b7c4f ] + +Move the handling of the cfile arguments to a separate generator +function to avoid redundancy. + +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20230828211424.2964562-2-nfraprado@collabora.com +Signed-off-by: Rob Herring +Stable-dep-of: 8f51593cdcab ("dt: dt-extract-compatibles: Don't follow symlinks when walking tree") +Signed-off-by: Sasha Levin +--- + scripts/dtc/dt-extract-compatibles | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/scripts/dtc/dt-extract-compatibles b/scripts/dtc/dt-extract-compatibles +index 9df9f1face832..2b6d228602e85 100755 +--- a/scripts/dtc/dt-extract-compatibles ++++ b/scripts/dtc/dt-extract-compatibles +@@ -49,6 +49,14 @@ def print_compat(filename, compatibles): + else: + print(*compatibles, sep='\n') + ++def files_to_parse(path_args): ++ for f in path_args: ++ if os.path.isdir(f): ++ for filename in glob.iglob(f + "/**/*.c", recursive=True): ++ yield filename ++ else: ++ yield f ++ + show_filename = False + + if __name__ == "__main__": +@@ -59,11 +67,6 @@ if __name__ == "__main__": + + show_filename = args.with_filename + +- for f in args.cfile: +- if os.path.isdir(f): +- for filename in glob.iglob(f + "/**/*.c", recursive=True): +- compat_list = parse_compatibles(filename) +- print_compat(filename, compat_list) +- else: +- compat_list = parse_compatibles(f) +- print_compat(f, compat_list) ++ for f in files_to_parse(args.cfile): ++ compat_list = parse_compatibles(f) ++ print_compat(f, compat_list) +-- +2.42.0 + diff --git a/queue-6.6/hv_netvsc-rndis_filter-needs-to-select-nls.patch b/queue-6.6/hv_netvsc-rndis_filter-needs-to-select-nls.patch new file mode 100644 index 00000000000..cbf24411465 --- /dev/null +++ b/queue-6.6/hv_netvsc-rndis_filter-needs-to-select-nls.patch @@ -0,0 +1,44 @@ +From 62be798ba628b80d9ab6a696ee0f8342eba269a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 21:58:53 -0800 +Subject: hv_netvsc: rndis_filter needs to select NLS + +From: Randy Dunlap + +[ Upstream commit 6c89f49964375c904cea33c0247467873f4daf2c ] + +rndis_filter uses utf8s_to_utf16s() which is provided by setting +NLS, so select NLS to fix the build error: + +ERROR: modpost: "utf8s_to_utf16s" [drivers/net/hyperv/hv_netvsc.ko] undefined! + +Fixes: 1ce09e899d28 ("hyperv: Add support for setting MAC from within guests") +Signed-off-by: Randy Dunlap +Cc: Haiyang Zhang +Cc: K. Y. Srinivasan +Cc: Wei Liu +Cc: Dexuan Cui +Reviewed-by: Simon Horman +Tested-by: Simon Horman # build-tested +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20231130055853.19069-1-rdunlap@infradead.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/hyperv/Kconfig b/drivers/net/hyperv/Kconfig +index ca7bf7f897d36..c8cbd85adcf99 100644 +--- a/drivers/net/hyperv/Kconfig ++++ b/drivers/net/hyperv/Kconfig +@@ -3,5 +3,6 @@ config HYPERV_NET + tristate "Microsoft Hyper-V virtual network driver" + depends on HYPERV + select UCS2_STRING ++ select NLS + help + Select this option to enable the Hyper-V virtual network driver. +-- +2.42.0 + diff --git a/queue-6.6/i40e-fix-unexpected-mfs-warning-message.patch b/queue-6.6/i40e-fix-unexpected-mfs-warning-message.patch new file mode 100644 index 00000000000..430cc4ae608 --- /dev/null +++ b/queue-6.6/i40e-fix-unexpected-mfs-warning-message.patch @@ -0,0 +1,58 @@ +From 54e43b0a922c46ba365cbb07e0fa31ec192808d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Nov 2023 09:12:09 +0100 +Subject: i40e: Fix unexpected MFS warning message + +From: Ivan Vecera + +[ Upstream commit 7d9f22b3d3ef379ed05bd3f3e2de83dfa8da8258 ] + +Commit 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") added +a warning message that reports unexpected size of port's MFS (max +frame size) value. This message use for the port number local +variable 'i' that is wrong. +In i40e_probe() this 'i' variable is used only to iterate VSIs +to find FDIR VSI: + + +... +/* if FDIR VSI was set up, start it now */ + for (i = 0; i < pf->num_alloc_vsi; i++) { + if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) { + i40e_vsi_open(pf->vsi[i]); + break; + } + } +... + + +So the warning message use for the port number index of FDIR VSI +if this exists or pf->num_alloc_vsi if not. + +Fix the message by using 'pf->hw.port' for the port number. + +Fixes: 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") +Signed-off-by: Ivan Vecera +Reviewed-by: Simon Horman +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 00ca2b88165cb..a9f5a8a7d3f05 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -16195,7 +16195,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + I40E_PRTGL_SAH_MFS_MASK) >> I40E_PRTGL_SAH_MFS_SHIFT; + if (val < MAX_FRAME_SIZE_DEFAULT) + dev_warn(&pdev->dev, "MFS for port %x has been set below the default: %x\n", +- i, val); ++ pf->hw.port, val); + + /* Add a filter to drop all Flow control frames from any VSI from being + * transmitted. By doing so we stop a malicious VF from sending out +-- +2.42.0 + diff --git a/queue-6.6/iavf-validate-tx_coalesce_usecs-even-if-rx_coalesce_.patch b/queue-6.6/iavf-validate-tx_coalesce_usecs-even-if-rx_coalesce_.patch new file mode 100644 index 00000000000..85b2ddbc2c2 --- /dev/null +++ b/queue-6.6/iavf-validate-tx_coalesce_usecs-even-if-rx_coalesce_.patch @@ -0,0 +1,79 @@ +From 01204111a062d5f493c58968706d2bb80af442c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 15:33:50 -0800 +Subject: iavf: validate tx_coalesce_usecs even if rx_coalesce_usecs is zero + +From: Jacob Keller + +[ Upstream commit a206d9959f5ccd0fb2d54a997c993947ae0e881c ] + +In __iavf_set_coalesce, the driver checks both ec->rx_coalesce_usecs and +ec->tx_coalesce_usecs for validity. It does this via a chain if if/else-if +blocks. If every single branch of the series of if statements exited, this +would be fine. However, the rx_coalesce_usecs is checked against zero to +print an informative message if use_adaptive_rx_coalesce is enabled. If +this check is true, it short circuits the entire chain of statements, +preventing validation of the tx_coalesce_usecs field. + +Indeed, since commit e792779e6b63 ("iavf: Prevent changing static ITR +values if adaptive moderation is on") the iavf driver actually rejects any +change to the tx_coalesce_usecs or rx_coalesce_usecs when +use_adaptive_tx_coalesce or use_adaptive_rx_coalesce is enabled, making +this checking a bit redundant. + +Fix this error by removing the unnecessary and redundant checks for +use_adaptive_rx_coalesce and use_adaptive_tx_coalesce. Since zero is a +valid value, and since the tx_coalesce_usecs and rx_coalesce_usecs fields +are already unsigned, remove the minimum value check. This allows assigning +an ITR value ranging from 0-8160 as described by the printed message. + +Fixes: 65e87c0398f5 ("i40evf: support queue-specific settings for interrupt moderation") +Signed-off-by: Jacob Keller +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 12 ++---------- + drivers/net/ethernet/intel/iavf/iavf_txrx.h | 1 - + 2 files changed, 2 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +index 90397293525f7..1b412754aa422 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +@@ -829,18 +829,10 @@ static int __iavf_set_coalesce(struct net_device *netdev, + struct iavf_adapter *adapter = netdev_priv(netdev); + int i; + +- if (ec->rx_coalesce_usecs == 0) { +- if (ec->use_adaptive_rx_coalesce) +- netif_info(adapter, drv, netdev, "rx-usecs=0, need to disable adaptive-rx for a complete disable\n"); +- } else if ((ec->rx_coalesce_usecs < IAVF_MIN_ITR) || +- (ec->rx_coalesce_usecs > IAVF_MAX_ITR)) { ++ if (ec->rx_coalesce_usecs > IAVF_MAX_ITR) { + netif_info(adapter, drv, netdev, "Invalid value, rx-usecs range is 0-8160\n"); + return -EINVAL; +- } else if (ec->tx_coalesce_usecs == 0) { +- if (ec->use_adaptive_tx_coalesce) +- netif_info(adapter, drv, netdev, "tx-usecs=0, need to disable adaptive-tx for a complete disable\n"); +- } else if ((ec->tx_coalesce_usecs < IAVF_MIN_ITR) || +- (ec->tx_coalesce_usecs > IAVF_MAX_ITR)) { ++ } else if (ec->tx_coalesce_usecs > IAVF_MAX_ITR) { + netif_info(adapter, drv, netdev, "Invalid value, tx-usecs range is 0-8160\n"); + return -EINVAL; + } +diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.h b/drivers/net/ethernet/intel/iavf/iavf_txrx.h +index 7e6ee32d19b69..10ba36602c0c1 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_txrx.h ++++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.h +@@ -15,7 +15,6 @@ + */ + #define IAVF_ITR_DYNAMIC 0x8000 /* use top bit as a flag */ + #define IAVF_ITR_MASK 0x1FFE /* mask for ITR register value */ +-#define IAVF_MIN_ITR 2 /* reg uses 2 usec resolution */ + #define IAVF_ITR_100K 10 /* all values below must be even */ + #define IAVF_ITR_50K 20 + #define IAVF_ITR_20K 50 +-- +2.42.0 + diff --git a/queue-6.6/ice-restore-fix-disabling-rx-vlan-filtering.patch b/queue-6.6/ice-restore-fix-disabling-rx-vlan-filtering.patch new file mode 100644 index 00000000000..a523ee9dc3c --- /dev/null +++ b/queue-6.6/ice-restore-fix-disabling-rx-vlan-filtering.patch @@ -0,0 +1,75 @@ +From 42aa8f646b4425bb641ee0550337811e8e85cb60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Nov 2023 14:51:38 +0100 +Subject: ice: Restore fix disabling RX VLAN filtering + +From: Marcin Szycik + +[ Upstream commit 4e7f0087b058cc3cab8f3c32141b51aa5457d298 ] + +Fix setting dis_rx_filtering depending on whether port vlan is being +turned on or off. This was originally fixed in commit c793f8ea15e3 ("ice: +Fix disabling Rx VLAN filtering with port VLAN enabled"), but while +refactoring ice_vf_vsi_init_vlan_ops(), the fix has been lost. Restore the +fix along with the original comment from that change. + +Also delete duplicate lines in ice_port_vlan_on(). + +Fixes: 2946204b3fa8 ("ice: implement bridge port vlan") +Reviewed-by: Wojciech Drewek +Signed-off-by: Marcin Szycik +Reviewed-by: Simon Horman +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c b/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c +index d7b10dc67f035..80dc4bcdd3a41 100644 +--- a/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c ++++ b/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c +@@ -32,7 +32,6 @@ static void ice_port_vlan_on(struct ice_vsi *vsi) + /* setup outer VLAN ops */ + vlan_ops->set_port_vlan = ice_vsi_set_outer_port_vlan; + vlan_ops->clear_port_vlan = ice_vsi_clear_outer_port_vlan; +- vlan_ops->clear_port_vlan = ice_vsi_clear_outer_port_vlan; + + /* setup inner VLAN ops */ + vlan_ops = &vsi->inner_vlan_ops; +@@ -47,8 +46,13 @@ static void ice_port_vlan_on(struct ice_vsi *vsi) + + vlan_ops->set_port_vlan = ice_vsi_set_inner_port_vlan; + vlan_ops->clear_port_vlan = ice_vsi_clear_inner_port_vlan; +- vlan_ops->clear_port_vlan = ice_vsi_clear_inner_port_vlan; + } ++ ++ /* all Rx traffic should be in the domain of the assigned port VLAN, ++ * so prevent disabling Rx VLAN filtering ++ */ ++ vlan_ops->dis_rx_filtering = noop_vlan; ++ + vlan_ops->ena_rx_filtering = ice_vsi_ena_rx_vlan_filtering; + } + +@@ -77,6 +81,8 @@ static void ice_port_vlan_off(struct ice_vsi *vsi) + vlan_ops->del_vlan = ice_vsi_del_vlan; + } + ++ vlan_ops->dis_rx_filtering = ice_vsi_dis_rx_vlan_filtering; ++ + if (!test_bit(ICE_FLAG_VF_VLAN_PRUNING, pf->flags)) + vlan_ops->ena_rx_filtering = noop_vlan; + else +@@ -141,7 +147,6 @@ void ice_vf_vsi_init_vlan_ops(struct ice_vsi *vsi) + &vsi->outer_vlan_ops : &vsi->inner_vlan_ops; + + vlan_ops->add_vlan = ice_vsi_add_vlan; +- vlan_ops->dis_rx_filtering = ice_vsi_dis_rx_vlan_filtering; + vlan_ops->ena_tx_filtering = ice_vsi_ena_tx_vlan_filtering; + vlan_ops->dis_tx_filtering = ice_vsi_dis_tx_vlan_filtering; + } +-- +2.42.0 + diff --git a/queue-6.6/ionic-fix-dim-work-handling-in-split-interrupt-mode.patch b/queue-6.6/ionic-fix-dim-work-handling-in-split-interrupt-mode.patch new file mode 100644 index 00000000000..b2873501915 --- /dev/null +++ b/queue-6.6/ionic-fix-dim-work-handling-in-split-interrupt-mode.patch @@ -0,0 +1,67 @@ +From b4002add8261d9bc49bea886f0ffaee2140c88ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 11:22:34 -0800 +Subject: ionic: Fix dim work handling in split interrupt mode + +From: Brett Creeley + +[ Upstream commit 4115ba677c35f694b62298e55f0e04ce84eed469 ] + +Currently ionic_dim_work() is incorrect when in +split interrupt mode. This is because the interrupt +rate is only being changed for the Rx side even for +dim running on Tx. Fix this by using the qcq from +the container_of macro. Also, introduce some local +variables for a bit of cleanup. + +Fixes: a6ff85e0a2d9 ("ionic: remove intr coalesce update from napi") +Signed-off-by: Brett Creeley +Signed-off-by: Shannon Nelson +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20231204192234.21017-3-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 2c3e36b2dd7f2..c9bd2c57a37d2 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -49,24 +49,24 @@ static void ionic_lif_queue_identify(struct ionic_lif *lif); + static void ionic_dim_work(struct work_struct *work) + { + struct dim *dim = container_of(work, struct dim, work); ++ struct ionic_intr_info *intr; + struct dim_cq_moder cur_moder; + struct ionic_qcq *qcq; ++ struct ionic_lif *lif; + u32 new_coal; + + cur_moder = net_dim_get_rx_moderation(dim->mode, dim->profile_ix); + qcq = container_of(dim, struct ionic_qcq, dim); +- new_coal = ionic_coal_usec_to_hw(qcq->q.lif->ionic, cur_moder.usec); ++ lif = qcq->q.lif; ++ new_coal = ionic_coal_usec_to_hw(lif->ionic, cur_moder.usec); + new_coal = new_coal ? new_coal : 1; + +- if (qcq->intr.dim_coal_hw != new_coal) { +- unsigned int qi = qcq->cq.bound_q->index; +- struct ionic_lif *lif = qcq->q.lif; +- +- qcq->intr.dim_coal_hw = new_coal; ++ intr = &qcq->intr; ++ if (intr->dim_coal_hw != new_coal) { ++ intr->dim_coal_hw = new_coal; + + ionic_intr_coal_init(lif->ionic->idev.intr_ctrl, +- lif->rxqcqs[qi]->intr.index, +- qcq->intr.dim_coal_hw); ++ intr->index, intr->dim_coal_hw); + } + + dim->state = DIM_START_MEASURE; +-- +2.42.0 + diff --git a/queue-6.6/ionic-fix-snprintf-format-length-warning.patch b/queue-6.6/ionic-fix-snprintf-format-length-warning.patch new file mode 100644 index 00000000000..e8d98833cfb --- /dev/null +++ b/queue-6.6/ionic-fix-snprintf-format-length-warning.patch @@ -0,0 +1,45 @@ +From ce977786cb4505485e3ad02183ed7b6b775a55bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 11:22:33 -0800 +Subject: ionic: fix snprintf format length warning + +From: Shannon Nelson + +[ Upstream commit 0ceb3860a67652f9d36dfdecfcd2cb3eb2f4537d ] + +Our friendly kernel test robot has reminded us that with a new +check we have a warning about a potential string truncation. +In this case it really doesn't hurt anything, but it is worth +addressing especially since there really is no reason to reserve +so many bytes for our queue names. It seems that cutting the +queue name buffer length in half stops the complaint. + +Fixes: c06107cabea3 ("ionic: more ionic name tweaks") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311300201.lO8v7mKU-lkp@intel.com/ +Signed-off-by: Shannon Nelson +Reviewed-by: Brett Creeley +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20231204192234.21017-2-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_dev.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h +index aae4131f146a8..bd2d4a26f5438 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h ++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h +@@ -222,7 +222,7 @@ struct ionic_desc_info { + void *cb_arg; + }; + +-#define IONIC_QUEUE_NAME_MAX_SZ 32 ++#define IONIC_QUEUE_NAME_MAX_SZ 16 + + struct ionic_queue { + struct device *dev; +-- +2.42.0 + diff --git a/queue-6.6/ipv4-ip_gre-avoid-skb_pull-failure-in-ipgre_xmit.patch b/queue-6.6/ipv4-ip_gre-avoid-skb_pull-failure-in-ipgre_xmit.patch new file mode 100644 index 00000000000..c81e43e9dad --- /dev/null +++ b/queue-6.6/ipv4-ip_gre-avoid-skb_pull-failure-in-ipgre_xmit.patch @@ -0,0 +1,58 @@ +From eca7dba499c6db16f4d8b8e8426d5f5209c9fc70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Dec 2023 01:14:41 +0900 +Subject: ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit() + +From: Shigeru Yoshida + +[ Upstream commit 80d875cfc9d3711a029f234ef7d680db79e8fa4b ] + +In ipgre_xmit(), skb_pull() may fail even if pskb_inet_may_pull() returns +true. For example, applications can use PF_PACKET to create a malformed +packet with no IP header. This type of packet causes a problem such as +uninit-value access. + +This patch ensures that skb_pull() can pull the required size by checking +the skb with pskb_network_may_pull() before skb_pull(). + +Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") +Signed-off-by: Shigeru Yoshida +Reviewed-by: Eric Dumazet +Reviewed-by: Suman Ghosh +Link: https://lore.kernel.org/r/20231202161441.221135-1-syoshida@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 22a26d1d29a09..5169c3c72cffe 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -635,15 +635,18 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, + } + + if (dev->header_ops) { ++ int pull_len = tunnel->hlen + sizeof(struct iphdr); ++ + if (skb_cow_head(skb, 0)) + goto free_skb; + + tnl_params = (const struct iphdr *)skb->data; + +- /* Pull skb since ip_tunnel_xmit() needs skb->data pointing +- * to gre header. +- */ +- skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); ++ if (!pskb_network_may_pull(skb, pull_len)) ++ goto free_skb; ++ ++ /* ip_tunnel_xmit() needs skb->data pointing to gre header. */ ++ skb_pull(skb, pull_len); + skb_reset_mac_header(skb); + + if (skb->ip_summed == CHECKSUM_PARTIAL && +-- +2.42.0 + diff --git a/queue-6.6/ipv6-fix-potential-null-deref-in-fib6_add.patch b/queue-6.6/ipv6-fix-potential-null-deref-in-fib6_add.patch new file mode 100644 index 00000000000..d69a22c6624 --- /dev/null +++ b/queue-6.6/ipv6-fix-potential-null-deref-in-fib6_add.patch @@ -0,0 +1,79 @@ +From fe3a0102dc4dda2adc4e868440bc9a99a1fca87d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 16:06:30 +0000 +Subject: ipv6: fix potential NULL deref in fib6_add() + +From: Eric Dumazet + +[ Upstream commit 75475bb51e78a3f54ad2f69380f2a1c985e85f2d ] + +If fib6_find_prefix() returns NULL, we should silently fallback +using fib6_null_entry regardless of RT6_DEBUG value. + +syzbot reported: + +WARNING: CPU: 0 PID: 5477 at net/ipv6/ip6_fib.c:1516 fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 +Modules linked in: +CPU: 0 PID: 5477 Comm: syz-executor.0 Not tainted 6.7.0-rc2-syzkaller-00029-g9b6de136b5f0 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 +RIP: 0010:fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 +Code: 00 48 8b 54 24 68 e8 42 22 00 00 48 85 c0 74 14 49 89 c6 e8 d5 d3 c2 f7 eb 5d e8 ce d3 c2 f7 e9 ca 00 00 00 e8 c4 d3 c2 f7 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 80 3c 01 00 +RSP: 0018:ffffc90005067740 EFLAGS: 00010293 +RAX: ffffffff89cba5bc RBX: ffffc90005067ab0 RCX: ffff88801a2e9dc0 +RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 +RBP: ffffc90005067980 R08: ffffffff89cbca85 R09: 1ffff110040d4b85 +R10: dffffc0000000000 R11: ffffed10040d4b86 R12: 00000000ffffffff +R13: 1ffff110051c3904 R14: ffff8880206a5c00 R15: ffff888028e1c820 +FS: 00007f763783c6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f763783bff8 CR3: 000000007f74d000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +__ip6_ins_rt net/ipv6/route.c:1303 [inline] +ip6_route_add+0x88/0x120 net/ipv6/route.c:3847 +ipv6_route_ioctl+0x525/0x7b0 net/ipv6/route.c:4467 +inet6_ioctl+0x21a/0x270 net/ipv6/af_inet6.c:575 +sock_do_ioctl+0x152/0x460 net/socket.c:1220 +sock_ioctl+0x615/0x8c0 net/socket.c:1339 +vfs_ioctl fs/ioctl.c:51 [inline] +__do_sys_ioctl fs/ioctl.c:871 [inline] +__se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857 +do_syscall_x64 arch/x86/entry/common.c:51 [inline] +do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 + +Fixes: 7bbfe00e0252 ("ipv6: fix general protection fault in fib6_add()") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Wei Wang +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20231129160630.3509216-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_fib.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index 28b01a068412a..7772f42ff2b94 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -1511,13 +1511,9 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt, + if (!pn_leaf && !(pn->fn_flags & RTN_RTINFO)) { + pn_leaf = fib6_find_prefix(info->nl_net, table, + pn); +-#if RT6_DEBUG >= 2 +- if (!pn_leaf) { +- WARN_ON(!pn_leaf); ++ if (!pn_leaf) + pn_leaf = + info->nl_net->ipv6.fib6_null_entry; +- } +-#endif + fib6_info_hold(pn_leaf); + rcu_assign_pointer(pn->leaf, pn_leaf); + } +-- +2.42.0 + diff --git a/queue-6.6/mlxbf-bootctl-correctly-identify-secure-boot-with-de.patch b/queue-6.6/mlxbf-bootctl-correctly-identify-secure-boot-with-de.patch new file mode 100644 index 00000000000..61b7741beee --- /dev/null +++ b/queue-6.6/mlxbf-bootctl-correctly-identify-secure-boot-with-de.patch @@ -0,0 +1,120 @@ +From 092332ff4b159b4caa99d5c35414394cccd72f75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 13:35:15 -0500 +Subject: mlxbf-bootctl: correctly identify secure boot with development keys +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Thompson + +[ Upstream commit d4eef75279f5e9d594f5785502038c763ce42268 ] + +The secure boot state of the BlueField SoC is represented by two bits: + 0 = production state + 1 = secure boot enabled + 2 = non-secure (secure boot disabled) + 3 = RMA state +There is also a single bit to indicate whether production keys or +development keys are being used when secure boot is enabled. +This single bit (specified by MLXBF_BOOTCTL_SB_DEV_MASK) only has +meaning if secure boot state equals 1 (secure boot enabled). + +The secure boot states are as follows: +- “GA secured” is when secure boot is enabled with official production keys. +- “Secured (development)” is when secure boot is enabled with development keys. + +Without this fix “GA Secured” is displayed on development cards which is +misleading. This patch updates the logic in "lifecycle_state_show()" to +handle the case where the SoC is configured for secure boot and is using +development keys. + +Fixes: 79e29cb8fbc5c ("platform/mellanox: Add bootctl driver for Mellanox BlueField Soc") +Reviewed-by: Khalil Blaiech +Signed-off-by: David Thompson +Link: https://lore.kernel.org/r/20231130183515.17214-1-davthompson@nvidia.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-bootctl.c | 39 +++++++++++++++-------- + 1 file changed, 26 insertions(+), 13 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-bootctl.c b/drivers/platform/mellanox/mlxbf-bootctl.c +index 4ee7bb431b7c0..e278092f889b9 100644 +--- a/drivers/platform/mellanox/mlxbf-bootctl.c ++++ b/drivers/platform/mellanox/mlxbf-bootctl.c +@@ -20,6 +20,7 @@ + + #define MLXBF_BOOTCTL_SB_SECURE_MASK 0x03 + #define MLXBF_BOOTCTL_SB_TEST_MASK 0x0c ++#define MLXBF_BOOTCTL_SB_DEV_MASK BIT(4) + + #define MLXBF_SB_KEY_NUM 4 + +@@ -40,11 +41,18 @@ static struct mlxbf_bootctl_name boot_names[] = { + { MLXBF_BOOTCTL_NONE, "none" }, + }; + ++enum { ++ MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION = 0, ++ MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE = 1, ++ MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE = 2, ++ MLXBF_BOOTCTL_SB_LIFECYCLE_RMA = 3 ++}; ++ + static const char * const mlxbf_bootctl_lifecycle_states[] = { +- [0] = "Production", +- [1] = "GA Secured", +- [2] = "GA Non-Secured", +- [3] = "RMA", ++ [MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION] = "Production", ++ [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE] = "GA Secured", ++ [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE] = "GA Non-Secured", ++ [MLXBF_BOOTCTL_SB_LIFECYCLE_RMA] = "RMA", + }; + + /* Log header format. */ +@@ -247,25 +255,30 @@ static ssize_t second_reset_action_store(struct device *dev, + static ssize_t lifecycle_state_show(struct device *dev, + struct device_attribute *attr, char *buf) + { ++ int status_bits; ++ int use_dev_key; ++ int test_state; + int lc_state; + +- lc_state = mlxbf_bootctl_smc(MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS, +- MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE); +- if (lc_state < 0) +- return lc_state; ++ status_bits = mlxbf_bootctl_smc(MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS, ++ MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE); ++ if (status_bits < 0) ++ return status_bits; + +- lc_state &= +- MLXBF_BOOTCTL_SB_TEST_MASK | MLXBF_BOOTCTL_SB_SECURE_MASK; ++ use_dev_key = status_bits & MLXBF_BOOTCTL_SB_DEV_MASK; ++ test_state = status_bits & MLXBF_BOOTCTL_SB_TEST_MASK; ++ lc_state = status_bits & MLXBF_BOOTCTL_SB_SECURE_MASK; + + /* + * If the test bits are set, we specify that the current state may be + * due to using the test bits. + */ +- if (lc_state & MLXBF_BOOTCTL_SB_TEST_MASK) { +- lc_state &= MLXBF_BOOTCTL_SB_SECURE_MASK; +- ++ if (test_state) { + return sprintf(buf, "%s(test)\n", + mlxbf_bootctl_lifecycle_states[lc_state]); ++ } else if (use_dev_key && ++ (lc_state == MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE)) { ++ return sprintf(buf, "Secured (development)\n"); + } + + return sprintf(buf, "%s\n", mlxbf_bootctl_lifecycle_states[lc_state]); +-- +2.42.0 + diff --git a/queue-6.6/mm-damon-sysfs-eliminate-potential-uninitialized-var.patch b/queue-6.6/mm-damon-sysfs-eliminate-potential-uninitialized-var.patch new file mode 100644 index 00000000000..d6ae091c105 --- /dev/null +++ b/queue-6.6/mm-damon-sysfs-eliminate-potential-uninitialized-var.patch @@ -0,0 +1,38 @@ +From 9a438222e62d83c0a75c4085dbd2f92abac07737 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 17:07:40 +0300 +Subject: mm/damon/sysfs: eliminate potential uninitialized variable warning + +From: Dan Carpenter + +[ Upstream commit 85c2ceaafbd306814a3a4740bf4d95ac26a8b36a ] + +The "err" variable is not initialized if damon_target_has_pid(ctx) is +false and sys_target->regions->nr is zero. + +Link: https://lkml.kernel.org/r/739e6aaf-a634-4e33-98a8-16546379ec9f@moroto.mountain +Fixes: 0bcd216c4741 ("mm/damon/sysfs: update monitoring target regions for online input commit") +Signed-off-by: Dan Carpenter +Reviewed-by: SeongJae Park +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/damon/sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c +index faaef5098e264..b317f51dcc987 100644 +--- a/mm/damon/sysfs.c ++++ b/mm/damon/sysfs.c +@@ -1172,7 +1172,7 @@ static int damon_sysfs_update_target(struct damon_target *target, + struct damon_ctx *ctx, + struct damon_sysfs_target *sys_target) + { +- int err; ++ int err = 0; + + if (damon_target_has_pid(ctx)) { + err = damon_sysfs_update_target_pid(target, sys_target->pid); +-- +2.42.0 + diff --git a/queue-6.6/net-atlantic-fix-null-dereference-of-skb-pointer-in.patch b/queue-6.6/net-atlantic-fix-null-dereference-of-skb-pointer-in.patch new file mode 100644 index 00000000000..3fef86840ac --- /dev/null +++ b/queue-6.6/net-atlantic-fix-null-dereference-of-skb-pointer-in.patch @@ -0,0 +1,148 @@ +From 753b0469b337c3f925770e27e4fcdb0e0897a08b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 11:58:10 +0300 +Subject: net: atlantic: Fix NULL dereference of skb pointer in + +From: Daniil Maximov + +[ Upstream commit cbe860be36095e68e4e5561ab43610982fb429fd ] + +If is_ptp_ring == true in the loop of __aq_ring_xdp_clean function, +then a timestamp is stored from a packet in a field of skb object, +which is not allocated at the moment of the call (skb == NULL). + +Generalize aq_ptp_extract_ts and other affected functions so they don't +work with struct sk_buff*, but with struct skb_shared_hwtstamps*. + +Found by Linux Verification Center (linuxtesting.org) with SVACE + +Fixes: 26efaef759a1 ("net: atlantic: Implement xdp data plane") +Signed-off-by: Daniil Maximov +Reviewed-by: Igor Russkikh +Link: https://lore.kernel.org/r/20231204085810.1681386-1-daniil31415it@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/ethernet/aquantia/atlantic/aq_ptp.c | 10 +++++----- + .../net/ethernet/aquantia/atlantic/aq_ptp.h | 4 ++-- + .../net/ethernet/aquantia/atlantic/aq_ring.c | 18 ++++++++++++------ + 3 files changed, 19 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c +index 80b44043e6c53..28c9b6f1a54f1 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c +@@ -553,17 +553,17 @@ void aq_ptp_tx_hwtstamp(struct aq_nic_s *aq_nic, u64 timestamp) + + /* aq_ptp_rx_hwtstamp - utility function which checks for RX time stamp + * @adapter: pointer to adapter struct +- * @skb: particular skb to send timestamp with ++ * @shhwtstamps: particular skb_shared_hwtstamps to save timestamp + * + * if the timestamp is valid, we convert it into the timecounter ns + * value, then store that result into the hwtstamps structure which + * is passed up the network stack + */ +-static void aq_ptp_rx_hwtstamp(struct aq_ptp_s *aq_ptp, struct sk_buff *skb, ++static void aq_ptp_rx_hwtstamp(struct aq_ptp_s *aq_ptp, struct skb_shared_hwtstamps *shhwtstamps, + u64 timestamp) + { + timestamp -= atomic_read(&aq_ptp->offset_ingress); +- aq_ptp_convert_to_hwtstamp(aq_ptp, skb_hwtstamps(skb), timestamp); ++ aq_ptp_convert_to_hwtstamp(aq_ptp, shhwtstamps, timestamp); + } + + void aq_ptp_hwtstamp_config_get(struct aq_ptp_s *aq_ptp, +@@ -639,7 +639,7 @@ bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring) + &aq_ptp->ptp_rx == ring || &aq_ptp->hwts_rx == ring; + } + +-u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct sk_buff *skb, u8 *p, ++u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct skb_shared_hwtstamps *shhwtstamps, u8 *p, + unsigned int len) + { + struct aq_ptp_s *aq_ptp = aq_nic->aq_ptp; +@@ -648,7 +648,7 @@ u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct sk_buff *skb, u8 *p, + p, len, ×tamp); + + if (ret > 0) +- aq_ptp_rx_hwtstamp(aq_ptp, skb, timestamp); ++ aq_ptp_rx_hwtstamp(aq_ptp, shhwtstamps, timestamp); + + return ret; + } +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.h b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.h +index 28ccb7ca2df9e..210b723f22072 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.h +@@ -67,7 +67,7 @@ int aq_ptp_hwtstamp_config_set(struct aq_ptp_s *aq_ptp, + /* Return either ring is belong to PTP or not*/ + bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring); + +-u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct sk_buff *skb, u8 *p, ++u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct skb_shared_hwtstamps *shhwtstamps, u8 *p, + unsigned int len); + + struct ptp_clock *aq_ptp_get_ptp_clock(struct aq_ptp_s *aq_ptp); +@@ -143,7 +143,7 @@ static inline bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring) + } + + static inline u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, +- struct sk_buff *skb, u8 *p, ++ struct skb_shared_hwtstamps *shhwtstamps, u8 *p, + unsigned int len) + { + return 0; +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index 4de22eed099a8..694daeaf3e615 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -647,7 +647,7 @@ static int __aq_ring_rx_clean(struct aq_ring_s *self, struct napi_struct *napi, + } + if (is_ptp_ring) + buff->len -= +- aq_ptp_extract_ts(self->aq_nic, skb, ++ aq_ptp_extract_ts(self->aq_nic, skb_hwtstamps(skb), + aq_buf_vaddr(&buff->rxdata), + buff->len); + +@@ -742,6 +742,8 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring, + struct aq_ring_buff_s *buff = &rx_ring->buff_ring[rx_ring->sw_head]; + bool is_ptp_ring = aq_ptp_ring(rx_ring->aq_nic, rx_ring); + struct aq_ring_buff_s *buff_ = NULL; ++ u16 ptp_hwtstamp_len = 0; ++ struct skb_shared_hwtstamps shhwtstamps; + struct sk_buff *skb = NULL; + unsigned int next_ = 0U; + struct xdp_buff xdp; +@@ -810,11 +812,12 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring, + hard_start = page_address(buff->rxdata.page) + + buff->rxdata.pg_off - rx_ring->page_offset; + +- if (is_ptp_ring) +- buff->len -= +- aq_ptp_extract_ts(rx_ring->aq_nic, skb, +- aq_buf_vaddr(&buff->rxdata), +- buff->len); ++ if (is_ptp_ring) { ++ ptp_hwtstamp_len = aq_ptp_extract_ts(rx_ring->aq_nic, &shhwtstamps, ++ aq_buf_vaddr(&buff->rxdata), ++ buff->len); ++ buff->len -= ptp_hwtstamp_len; ++ } + + xdp_init_buff(&xdp, frame_sz, &rx_ring->xdp_rxq); + xdp_prepare_buff(&xdp, hard_start, rx_ring->page_offset, +@@ -834,6 +837,9 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring, + if (IS_ERR(skb) || !skb) + continue; + ++ if (ptp_hwtstamp_len > 0) ++ *skb_hwtstamps(skb) = shhwtstamps; ++ + if (buff->is_vlan) + __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), + buff->vlan_rx_tag); +-- +2.42.0 + diff --git a/queue-6.6/net-bnxt-fix-a-potential-use-after-free-in-bnxt_init.patch b/queue-6.6/net-bnxt-fix-a-potential-use-after-free-in-bnxt_init.patch new file mode 100644 index 00000000000..70e33d8e78a --- /dev/null +++ b/queue-6.6/net-bnxt-fix-a-potential-use-after-free-in-bnxt_init.patch @@ -0,0 +1,43 @@ +From e7a4222b3dc5dcec86f2423d04da620194950a90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 10:40:04 +0800 +Subject: net: bnxt: fix a potential use-after-free in bnxt_init_tc + +From: Dinghao Liu + +[ Upstream commit d007caaaf052f82ca2340d4c7b32d04a3f5dbf3f ] + +When flow_indr_dev_register() fails, bnxt_init_tc will free +bp->tc_info through kfree(). However, the caller function +bnxt_init_one() will ignore this failure and call +bnxt_shutdown_tc() on failure of bnxt_dl_register(), where +a use-after-free happens. Fix this issue by setting +bp->tc_info to NULL after kfree(). + +Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks") +Signed-off-by: Dinghao Liu +Reviewed-by: Pavan Chebbi +Reviewed-by: Michael Chan +Reviewed-by: Somnath Kotur +Link: https://lore.kernel.org/r/20231204024004.8245-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +index 38d89d80b4a9c..273c9ba48f09a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +@@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp) + rhashtable_destroy(&tc_info->flow_table); + free_tc_info: + kfree(tc_info); ++ bp->tc_info = NULL; + return rc; + } + +-- +2.42.0 + diff --git a/queue-6.6/net-dsa-microchip-provide-a-list-of-valid-protocols-.patch b/queue-6.6/net-dsa-microchip-provide-a-list-of-valid-protocols-.patch new file mode 100644 index 00000000000..d987becb22e --- /dev/null +++ b/queue-6.6/net-dsa-microchip-provide-a-list-of-valid-protocols-.patch @@ -0,0 +1,64 @@ +From 16ef2ec6ffbf217c6a72fe1393b3f8b80e9122d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 08:16:54 +0100 +Subject: net: dsa: microchip: provide a list of valid protocols for xmit + handler + +From: Sean Nyekjaer + +[ Upstream commit 1499b89289bf272fd83cb296c82fb5519d0fe93f ] + +Provide a list of valid protocols for which the driver will provide +it's deferred xmit handler. + +When using DSA_TAG_PROTO_KSZ8795 protocol, it does not provide a +"connect" method, therefor ksz_connect() is not allocating ksz_tagger_data. + +This avoids the following null pointer dereference: + ksz_connect_tag_protocol from dsa_register_switch+0x9ac/0xee0 + dsa_register_switch from ksz_switch_register+0x65c/0x828 + ksz_switch_register from ksz_spi_probe+0x11c/0x168 + ksz_spi_probe from spi_probe+0x84/0xa8 + spi_probe from really_probe+0xc8/0x2d8 + +Fixes: ab32f56a4100 ("net: dsa: microchip: ptp: add packet transmission timestamping") +Signed-off-by: Sean Nyekjaer +Reviewed-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20231206071655.1626479-1-sean@geanix.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 42db7679c3606..286e20f340e5c 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -2624,10 +2624,18 @@ static int ksz_connect_tag_protocol(struct dsa_switch *ds, + { + struct ksz_tagger_data *tagger_data; + +- tagger_data = ksz_tagger_data(ds); +- tagger_data->xmit_work_fn = ksz_port_deferred_xmit; +- +- return 0; ++ switch (proto) { ++ case DSA_TAG_PROTO_KSZ8795: ++ return 0; ++ case DSA_TAG_PROTO_KSZ9893: ++ case DSA_TAG_PROTO_KSZ9477: ++ case DSA_TAG_PROTO_LAN937X: ++ tagger_data = ksz_tagger_data(ds); ++ tagger_data->xmit_work_fn = ksz_port_deferred_xmit; ++ return 0; ++ default: ++ return -EPROTONOSUPPORT; ++ } + } + + static int ksz_port_vlan_filtering(struct dsa_switch *ds, int port, +-- +2.42.0 + diff --git a/queue-6.6/net-dsa-mv88e6xxx-restore-usxgmii-support-for-6393x.patch b/queue-6.6/net-dsa-mv88e6xxx-restore-usxgmii-support-for-6393x.patch new file mode 100644 index 00000000000..82176033326 --- /dev/null +++ b/queue-6.6/net-dsa-mv88e6xxx-restore-usxgmii-support-for-6393x.patch @@ -0,0 +1,92 @@ +From 415db364d2dce1ba62fa8b1f4065002438368e95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 23:13:59 +0100 +Subject: net: dsa: mv88e6xxx: Restore USXGMII support for 6393X + +From: Tobias Waldekranz + +[ Upstream commit 0c7ed1f9197aecada33a08b022e484a97bf584ba ] + +In 4a56212774ac, USXGMII support was added for 6393X, but this was +lost in the PCS conversion (the blamed commit), most likely because +these efforts where more or less done in parallel. + +Restore this feature by porting Michal's patch to fit the new +implementation. + +Reviewed-by: Florian Fainelli +Tested-by: Michal Smulski +Reviewed-by: Vladimir Oltean +Fixes: e5b732a275f5 ("net: dsa: mv88e6xxx: convert 88e639x to phylink_pcs") +Signed-off-by: Tobias Waldekranz +Link: https://lore.kernel.org/r/20231205221359.3926018-1-tobias@waldekranz.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/pcs-639x.c | 31 ++++++++++++++++++++++++++-- + 1 file changed, 29 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/pcs-639x.c b/drivers/net/dsa/mv88e6xxx/pcs-639x.c +index ba373656bfe14..c31f0e54f1e64 100644 +--- a/drivers/net/dsa/mv88e6xxx/pcs-639x.c ++++ b/drivers/net/dsa/mv88e6xxx/pcs-639x.c +@@ -465,6 +465,7 @@ mv88e639x_pcs_select(struct mv88e6xxx_chip *chip, int port, + case PHY_INTERFACE_MODE_10GBASER: + case PHY_INTERFACE_MODE_XAUI: + case PHY_INTERFACE_MODE_RXAUI: ++ case PHY_INTERFACE_MODE_USXGMII: + return &mpcs->xg_pcs; + + default: +@@ -873,7 +874,8 @@ static int mv88e6393x_xg_pcs_post_config(struct phylink_pcs *pcs, + struct mv88e639x_pcs *mpcs = xg_pcs_to_mv88e639x_pcs(pcs); + int err; + +- if (interface == PHY_INTERFACE_MODE_10GBASER) { ++ if (interface == PHY_INTERFACE_MODE_10GBASER || ++ interface == PHY_INTERFACE_MODE_USXGMII) { + err = mv88e6393x_erratum_5_2(mpcs); + if (err) + return err; +@@ -886,12 +888,37 @@ static int mv88e6393x_xg_pcs_post_config(struct phylink_pcs *pcs, + return mv88e639x_xg_pcs_enable(mpcs); + } + ++static void mv88e6393x_xg_pcs_get_state(struct phylink_pcs *pcs, ++ struct phylink_link_state *state) ++{ ++ struct mv88e639x_pcs *mpcs = xg_pcs_to_mv88e639x_pcs(pcs); ++ u16 status, lp_status; ++ int err; ++ ++ if (state->interface != PHY_INTERFACE_MODE_USXGMII) ++ return mv88e639x_xg_pcs_get_state(pcs, state); ++ ++ state->link = false; ++ ++ err = mv88e639x_read(mpcs, MV88E6390_USXGMII_PHY_STATUS, &status); ++ err = err ? : mv88e639x_read(mpcs, MV88E6390_USXGMII_LP_STATUS, &lp_status); ++ if (err) { ++ dev_err(mpcs->mdio.dev.parent, ++ "can't read USXGMII status: %pe\n", ERR_PTR(err)); ++ return; ++ } ++ ++ state->link = !!(status & MDIO_USXGMII_LINK); ++ state->an_complete = state->link; ++ phylink_decode_usxgmii_word(state, lp_status); ++} ++ + static const struct phylink_pcs_ops mv88e6393x_xg_pcs_ops = { + .pcs_enable = mv88e6393x_xg_pcs_enable, + .pcs_disable = mv88e6393x_xg_pcs_disable, + .pcs_pre_config = mv88e6393x_xg_pcs_pre_config, + .pcs_post_config = mv88e6393x_xg_pcs_post_config, +- .pcs_get_state = mv88e639x_xg_pcs_get_state, ++ .pcs_get_state = mv88e6393x_xg_pcs_get_state, + .pcs_config = mv88e639x_xg_pcs_config, + }; + +-- +2.42.0 + diff --git a/queue-6.6/net-hns-fix-fake-link-up-on-xge-port.patch b/queue-6.6/net-hns-fix-fake-link-up-on-xge-port.patch new file mode 100644 index 00000000000..1180a51eacd --- /dev/null +++ b/queue-6.6/net-hns-fix-fake-link-up-on-xge-port.patch @@ -0,0 +1,74 @@ +From fc7af1b98560b00e1fec1d9ef6e9b964f9634e20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 22:32:32 +0800 +Subject: net: hns: fix fake link up on xge port + +From: Yonglong Liu + +[ Upstream commit f708aba40f9c1eeb9c7e93ed4863b5f85b09b288 ] + +If a xge port just connect with an optical module and no fiber, +it may have a fake link up because there may be interference on +the hardware. This patch adds an anti-shake to avoid the problem. +And the time of anti-shake is base on tests. + +Fixes: b917078c1c10 ("net: hns: Add ACPI support to check SFP present") +Signed-off-by: Yonglong Liu +Signed-off-by: Jijie Shao +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 29 +++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +index 928d934cb21a5..f75668c479351 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +@@ -66,6 +66,27 @@ static enum mac_mode hns_get_enet_interface(const struct hns_mac_cb *mac_cb) + } + } + ++static u32 hns_mac_link_anti_shake(struct mac_driver *mac_ctrl_drv) ++{ ++#define HNS_MAC_LINK_WAIT_TIME 5 ++#define HNS_MAC_LINK_WAIT_CNT 40 ++ ++ u32 link_status = 0; ++ int i; ++ ++ if (!mac_ctrl_drv->get_link_status) ++ return link_status; ++ ++ for (i = 0; i < HNS_MAC_LINK_WAIT_CNT; i++) { ++ msleep(HNS_MAC_LINK_WAIT_TIME); ++ mac_ctrl_drv->get_link_status(mac_ctrl_drv, &link_status); ++ if (!link_status) ++ break; ++ } ++ ++ return link_status; ++} ++ + void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status) + { + struct mac_driver *mac_ctrl_drv; +@@ -83,6 +104,14 @@ void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status) + &sfp_prsnt); + if (!ret) + *link_status = *link_status && sfp_prsnt; ++ ++ /* for FIBER port, it may have a fake link up. ++ * when the link status changes from down to up, we need to do ++ * anti-shake. the anti-shake time is base on tests. ++ * only FIBER port need to do this. ++ */ ++ if (*link_status && !mac_cb->link) ++ *link_status = hns_mac_link_anti_shake(mac_ctrl_drv); + } + + mac_cb->link = *link_status; +-- +2.42.0 + diff --git a/queue-6.6/net-hns-fix-wrong-head-when-modify-the-tx-feature-wh.patch b/queue-6.6/net-hns-fix-wrong-head-when-modify-the-tx-feature-wh.patch new file mode 100644 index 00000000000..5428c801eda --- /dev/null +++ b/queue-6.6/net-hns-fix-wrong-head-when-modify-the-tx-feature-wh.patch @@ -0,0 +1,161 @@ +From 1327bd0ac726bdc76d36546635d9a1fc764f35a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 22:32:31 +0800 +Subject: net: hns: fix wrong head when modify the tx feature when sending + packets + +From: Yonglong Liu + +[ Upstream commit 84757d0839451b20b11e993128f0a77393ca50c1 ] + +Upon changing the tx feature, the hns driver will modify the +maybe_stop_tx() and fill_desc() functions, if the modify happens +during packet sending, will cause the hardware and software +pointers do not match, and the port can not work anymore. + +This patch deletes the maybe_stop_tx() and fill_desc() functions +modification when setting tx feature, and use the skb_is_gro() +to determine which functions to use in the tx path. + +Fixes: 38f616da1c28 ("net:hns: Add support of ethtool TSO set option for Hip06 in HNS") +Signed-off-by: Yonglong Liu +Signed-off-by: Jijie Shao +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns/hns_enet.c | 53 +++++++++++-------- + drivers/net/ethernet/hisilicon/hns/hns_enet.h | 3 +- + 2 files changed, 33 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 7cf10d1e2b311..85722afe21770 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -142,7 +142,8 @@ MODULE_DEVICE_TABLE(acpi, hns_enet_acpi_match); + + static void fill_desc(struct hnae_ring *ring, void *priv, + int size, dma_addr_t dma, int frag_end, +- int buf_num, enum hns_desc_type type, int mtu) ++ int buf_num, enum hns_desc_type type, int mtu, ++ bool is_gso) + { + struct hnae_desc *desc = &ring->desc[ring->next_to_use]; + struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use]; +@@ -275,6 +276,15 @@ static int hns_nic_maybe_stop_tso( + return 0; + } + ++static int hns_nic_maybe_stop_tx_v2(struct sk_buff **out_skb, int *bnum, ++ struct hnae_ring *ring) ++{ ++ if (skb_is_gso(*out_skb)) ++ return hns_nic_maybe_stop_tso(out_skb, bnum, ring); ++ else ++ return hns_nic_maybe_stop_tx(out_skb, bnum, ring); ++} ++ + static void fill_tso_desc(struct hnae_ring *ring, void *priv, + int size, dma_addr_t dma, int frag_end, + int buf_num, enum hns_desc_type type, int mtu) +@@ -300,6 +310,19 @@ static void fill_tso_desc(struct hnae_ring *ring, void *priv, + mtu); + } + ++static void fill_desc_v2(struct hnae_ring *ring, void *priv, ++ int size, dma_addr_t dma, int frag_end, ++ int buf_num, enum hns_desc_type type, int mtu, ++ bool is_gso) ++{ ++ if (is_gso) ++ fill_tso_desc(ring, priv, size, dma, frag_end, buf_num, type, ++ mtu); ++ else ++ fill_v2_desc(ring, priv, size, dma, frag_end, buf_num, type, ++ mtu); ++} ++ + netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, + struct sk_buff *skb, + struct hns_nic_ring_data *ring_data) +@@ -313,6 +336,7 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, + int seg_num; + dma_addr_t dma; + int size, next_to_use; ++ bool is_gso; + int i; + + switch (priv->ops.maybe_stop_tx(&skb, &buf_num, ring)) { +@@ -339,8 +363,9 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, + ring->stats.sw_err_cnt++; + goto out_err_tx_ok; + } ++ is_gso = skb_is_gso(skb); + priv->ops.fill_desc(ring, skb, size, dma, seg_num == 1 ? 1 : 0, +- buf_num, DESC_TYPE_SKB, ndev->mtu); ++ buf_num, DESC_TYPE_SKB, ndev->mtu, is_gso); + + /* fill the fragments */ + for (i = 1; i < seg_num; i++) { +@@ -354,7 +379,7 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, + } + priv->ops.fill_desc(ring, skb_frag_page(frag), size, dma, + seg_num - 1 == i ? 1 : 0, buf_num, +- DESC_TYPE_PAGE, ndev->mtu); ++ DESC_TYPE_PAGE, ndev->mtu, is_gso); + } + + /*complete translate all packets*/ +@@ -1776,15 +1801,6 @@ static int hns_nic_set_features(struct net_device *netdev, + netdev_info(netdev, "enet v1 do not support tso!\n"); + break; + default: +- if (features & (NETIF_F_TSO | NETIF_F_TSO6)) { +- priv->ops.fill_desc = fill_tso_desc; +- priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tso; +- /* The chip only support 7*4096 */ +- netif_set_tso_max_size(netdev, 7 * 4096); +- } else { +- priv->ops.fill_desc = fill_v2_desc; +- priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; +- } + break; + } + netdev->features = features; +@@ -2159,16 +2175,9 @@ static void hns_nic_set_priv_ops(struct net_device *netdev) + priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; + } else { + priv->ops.get_rxd_bnum = get_v2rx_desc_bnum; +- if ((netdev->features & NETIF_F_TSO) || +- (netdev->features & NETIF_F_TSO6)) { +- priv->ops.fill_desc = fill_tso_desc; +- priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tso; +- /* This chip only support 7*4096 */ +- netif_set_tso_max_size(netdev, 7 * 4096); +- } else { +- priv->ops.fill_desc = fill_v2_desc; +- priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; +- } ++ priv->ops.fill_desc = fill_desc_v2; ++ priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx_v2; ++ netif_set_tso_max_size(netdev, 7 * 4096); + /* enable tso when init + * control tso on/off through TSE bit in bd + */ +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.h b/drivers/net/ethernet/hisilicon/hns/hns_enet.h +index ffa9d6573f54b..3f3ee032f631c 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.h ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.h +@@ -44,7 +44,8 @@ struct hns_nic_ring_data { + struct hns_nic_ops { + void (*fill_desc)(struct hnae_ring *ring, void *priv, + int size, dma_addr_t dma, int frag_end, +- int buf_num, enum hns_desc_type type, int mtu); ++ int buf_num, enum hns_desc_type type, int mtu, ++ bool is_gso); + int (*maybe_stop_tx)(struct sk_buff **out_skb, + int *bnum, struct hnae_ring *ring); + void (*get_rxd_bnum)(u32 bnum_flag, int *out_bnum); +-- +2.42.0 + diff --git a/queue-6.6/net-smc-fix-missing-byte-order-conversion-in-clc-han.patch b/queue-6.6/net-smc-fix-missing-byte-order-conversion-in-clc-han.patch new file mode 100644 index 00000000000..91f37996acf --- /dev/null +++ b/queue-6.6/net-smc-fix-missing-byte-order-conversion-in-clc-han.patch @@ -0,0 +1,99 @@ +From 2538b01379f010ed5d75b6922c06e39e0c7be082 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 01:02:37 +0800 +Subject: net/smc: fix missing byte order conversion in CLC handshake + +From: Wen Gu + +[ Upstream commit c5a10397d4571bcfd4bd7ca211ee47bcb6792ec3 ] + +The byte order conversions of ISM GID and DMB token are missing in +process of CLC accept and confirm. So fix it. + +Fixes: 3d9725a6a133 ("net/smc: common routine for CLC accept and confirm") +Signed-off-by: Wen Gu +Reviewed-by: Tony Lu +Reviewed-by: Alexandra Winter +Reviewed-by: Wenjia Zhang +Link: https://lore.kernel.org/r/1701882157-87956-1-git-send-email-guwen@linux.alibaba.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 4 ++-- + net/smc/smc_clc.c | 9 ++++----- + net/smc/smc_clc.h | 4 ++-- + 3 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 741339ac94833..ef5b5d498ef3e 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -723,7 +723,7 @@ static void smcd_conn_save_peer_info(struct smc_sock *smc, + int bufsize = smc_uncompress_bufsize(clc->d0.dmbe_size); + + smc->conn.peer_rmbe_idx = clc->d0.dmbe_idx; +- smc->conn.peer_token = clc->d0.token; ++ smc->conn.peer_token = ntohll(clc->d0.token); + /* msg header takes up space in the buffer */ + smc->conn.peer_rmbe_size = bufsize - sizeof(struct smcd_cdc_msg); + atomic_set(&smc->conn.peer_rmbe_space, smc->conn.peer_rmbe_size); +@@ -1415,7 +1415,7 @@ static int smc_connect_ism(struct smc_sock *smc, + if (rc) + return rc; + } +- ini->ism_peer_gid[ini->ism_selected] = aclc->d0.gid; ++ ini->ism_peer_gid[ini->ism_selected] = ntohll(aclc->d0.gid); + + /* there is only one lgr role for SMC-D; use server lock */ + mutex_lock(&smc_server_lgr_pending); +diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c +index 8deb46c28f1d5..72f4d81a3f41f 100644 +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -1004,6 +1004,7 @@ static int smc_clc_send_confirm_accept(struct smc_sock *smc, + { + struct smc_connection *conn = &smc->conn; + struct smc_clc_first_contact_ext_v2x fce; ++ struct smcd_dev *smcd = conn->lgr->smcd; + struct smc_clc_msg_accept_confirm *clc; + struct smc_clc_fce_gid_ext gle; + struct smc_clc_msg_trail trl; +@@ -1021,17 +1022,15 @@ static int smc_clc_send_confirm_accept(struct smc_sock *smc, + memcpy(clc->hdr.eyecatcher, SMCD_EYECATCHER, + sizeof(SMCD_EYECATCHER)); + clc->hdr.typev1 = SMC_TYPE_D; +- clc->d0.gid = +- conn->lgr->smcd->ops->get_local_gid(conn->lgr->smcd); +- clc->d0.token = conn->rmb_desc->token; ++ clc->d0.gid = htonll(smcd->ops->get_local_gid(smcd)); ++ clc->d0.token = htonll(conn->rmb_desc->token); + clc->d0.dmbe_size = conn->rmbe_size_comp; + clc->d0.dmbe_idx = 0; + memcpy(&clc->d0.linkid, conn->lgr->id, SMC_LGR_ID_SIZE); + if (version == SMC_V1) { + clc->hdr.length = htons(SMCD_CLC_ACCEPT_CONFIRM_LEN); + } else { +- clc_v2->d1.chid = +- htons(smc_ism_get_chid(conn->lgr->smcd)); ++ clc_v2->d1.chid = htons(smc_ism_get_chid(smcd)); + if (eid && eid[0]) + memcpy(clc_v2->d1.eid, eid, SMC_MAX_EID_LEN); + len = SMCD_CLC_ACCEPT_CONFIRM_LEN_V2; +diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h +index c5c8e7db775a7..08155a96a02a1 100644 +--- a/net/smc/smc_clc.h ++++ b/net/smc/smc_clc.h +@@ -204,8 +204,8 @@ struct smcr_clc_msg_accept_confirm { /* SMCR accept/confirm */ + } __packed; + + struct smcd_clc_msg_accept_confirm_common { /* SMCD accept/confirm */ +- u64 gid; /* Sender GID */ +- u64 token; /* DMB token */ ++ __be64 gid; /* Sender GID */ ++ __be64 token; /* DMB token */ + u8 dmbe_idx; /* DMBE index */ + #if defined(__BIG_ENDIAN_BITFIELD) + u8 dmbe_size : 4, /* buf size (compressed) */ +-- +2.42.0 + diff --git a/queue-6.6/net-stmmac-fix-fpe-events-losing.patch b/queue-6.6/net-stmmac-fix-fpe-events-losing.patch new file mode 100644 index 00000000000..acdb5c19a1a --- /dev/null +++ b/queue-6.6/net-stmmac-fix-fpe-events-losing.patch @@ -0,0 +1,243 @@ +From ace813f61ab59e787c9290781981609fc85f5754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 03:22:03 +0000 +Subject: net: stmmac: fix FPE events losing + +From: Jianheng Zhang + +[ Upstream commit 37e4b8df27bc68340f3fc80dbb27e3549c7f881c ] + +The status bits of register MAC_FPE_CTRL_STS are clear on read. Using +32-bit read for MAC_FPE_CTRL_STS in dwmac5_fpe_configure() and +dwmac5_fpe_send_mpacket() clear the status bits. Then the stmmac interrupt +handler missing FPE event status and leads to FPE handshaking failure and +retries. +To avoid clear status bits of MAC_FPE_CTRL_STS in dwmac5_fpe_configure() +and dwmac5_fpe_send_mpacket(), add fpe_csr to stmmac_fpe_cfg structure to +cache the control bits of MAC_FPE_CTRL_STS and to avoid reading +MAC_FPE_CTRL_STS in those methods. + +Fixes: 5a5586112b92 ("net: stmmac: support FPE link partner hand-shaking procedure") +Reviewed-by: Serge Semin +Signed-off-by: Jianheng Zhang +Link: https://lore.kernel.org/r/CY5PR12MB637225A7CF529D5BE0FBE59CBF81A@CY5PR12MB6372.namprd12.prod.outlook.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 45 ++++++++----------- + drivers/net/ethernet/stmicro/stmmac/dwmac5.h | 4 +- + .../ethernet/stmicro/stmmac/dwxgmac2_core.c | 3 +- + drivers/net/ethernet/stmicro/stmmac/hwif.h | 4 +- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 8 +++- + .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + + include/linux/stmmac.h | 1 + + 7 files changed, 36 insertions(+), 30 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +index e95d35f1e5a0c..8fd167501fa0e 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +@@ -710,28 +710,22 @@ void dwmac5_est_irq_status(void __iomem *ioaddr, struct net_device *dev, + } + } + +-void dwmac5_fpe_configure(void __iomem *ioaddr, u32 num_txq, u32 num_rxq, ++void dwmac5_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ u32 num_txq, u32 num_rxq, + bool enable) + { + u32 value; + +- if (!enable) { +- value = readl(ioaddr + MAC_FPE_CTRL_STS); +- +- value &= ~EFPE; +- +- writel(value, ioaddr + MAC_FPE_CTRL_STS); +- return; ++ if (enable) { ++ cfg->fpe_csr = EFPE; ++ value = readl(ioaddr + GMAC_RXQ_CTRL1); ++ value &= ~GMAC_RXQCTRL_FPRQ; ++ value |= (num_rxq - 1) << GMAC_RXQCTRL_FPRQ_SHIFT; ++ writel(value, ioaddr + GMAC_RXQ_CTRL1); ++ } else { ++ cfg->fpe_csr = 0; + } +- +- value = readl(ioaddr + GMAC_RXQ_CTRL1); +- value &= ~GMAC_RXQCTRL_FPRQ; +- value |= (num_rxq - 1) << GMAC_RXQCTRL_FPRQ_SHIFT; +- writel(value, ioaddr + GMAC_RXQ_CTRL1); +- +- value = readl(ioaddr + MAC_FPE_CTRL_STS); +- value |= EFPE; +- writel(value, ioaddr + MAC_FPE_CTRL_STS); ++ writel(cfg->fpe_csr, ioaddr + MAC_FPE_CTRL_STS); + } + + int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) +@@ -741,6 +735,9 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) + + status = FPE_EVENT_UNKNOWN; + ++ /* Reads from the MAC_FPE_CTRL_STS register should only be performed ++ * here, since the status flags of MAC_FPE_CTRL_STS are "clear on read" ++ */ + value = readl(ioaddr + MAC_FPE_CTRL_STS); + + if (value & TRSP) { +@@ -766,19 +763,15 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) + return status; + } + +-void dwmac5_fpe_send_mpacket(void __iomem *ioaddr, enum stmmac_mpacket_type type) ++void dwmac5_fpe_send_mpacket(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ enum stmmac_mpacket_type type) + { +- u32 value; ++ u32 value = cfg->fpe_csr; + +- value = readl(ioaddr + MAC_FPE_CTRL_STS); +- +- if (type == MPACKET_VERIFY) { +- value &= ~SRSP; ++ if (type == MPACKET_VERIFY) + value |= SVER; +- } else { +- value &= ~SVER; ++ else if (type == MPACKET_RESPONSE) + value |= SRSP; +- } + + writel(value, ioaddr + MAC_FPE_CTRL_STS); + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.h b/drivers/net/ethernet/stmicro/stmmac/dwmac5.h +index 53c138d0ff480..34e620790eb37 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.h ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.h +@@ -153,9 +153,11 @@ int dwmac5_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, + unsigned int ptp_rate); + void dwmac5_est_irq_status(void __iomem *ioaddr, struct net_device *dev, + struct stmmac_extra_stats *x, u32 txqcnt); +-void dwmac5_fpe_configure(void __iomem *ioaddr, u32 num_txq, u32 num_rxq, ++void dwmac5_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ u32 num_txq, u32 num_rxq, + bool enable); + void dwmac5_fpe_send_mpacket(void __iomem *ioaddr, ++ struct stmmac_fpe_cfg *cfg, + enum stmmac_mpacket_type type); + int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +index 453e88b75be08..a74e71db79f94 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +@@ -1484,7 +1484,8 @@ static int dwxgmac3_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, + return 0; + } + +-static void dwxgmac3_fpe_configure(void __iomem *ioaddr, u32 num_txq, ++static void dwxgmac3_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ u32 num_txq, + u32 num_rxq, bool enable) + { + u32 value; +diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h +index b95d3e1378136..68aa2d5ca6e56 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h ++++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h +@@ -412,9 +412,11 @@ struct stmmac_ops { + unsigned int ptp_rate); + void (*est_irq_status)(void __iomem *ioaddr, struct net_device *dev, + struct stmmac_extra_stats *x, u32 txqcnt); +- void (*fpe_configure)(void __iomem *ioaddr, u32 num_txq, u32 num_rxq, ++ void (*fpe_configure)(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ u32 num_txq, u32 num_rxq, + bool enable); + void (*fpe_send_mpacket)(void __iomem *ioaddr, ++ struct stmmac_fpe_cfg *cfg, + enum stmmac_mpacket_type type); + int (*fpe_irq_status)(void __iomem *ioaddr, struct net_device *dev); + }; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 1fa4da96c8f50..69b9c71f0eded 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -964,7 +964,8 @@ static void stmmac_fpe_link_state_handle(struct stmmac_priv *priv, bool is_up) + bool *hs_enable = &fpe_cfg->hs_enable; + + if (is_up && *hs_enable) { +- stmmac_fpe_send_mpacket(priv, priv->ioaddr, MPACKET_VERIFY); ++ stmmac_fpe_send_mpacket(priv, priv->ioaddr, fpe_cfg, ++ MPACKET_VERIFY); + } else { + *lo_state = FPE_STATE_OFF; + *lp_state = FPE_STATE_OFF; +@@ -5803,6 +5804,7 @@ static void stmmac_fpe_event_status(struct stmmac_priv *priv, int status) + /* If user has requested FPE enable, quickly response */ + if (*hs_enable) + stmmac_fpe_send_mpacket(priv, priv->ioaddr, ++ fpe_cfg, + MPACKET_RESPONSE); + } + +@@ -7227,6 +7229,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work) + if (*lo_state == FPE_STATE_ENTERING_ON && + *lp_state == FPE_STATE_ENTERING_ON) { + stmmac_fpe_configure(priv, priv->ioaddr, ++ fpe_cfg, + priv->plat->tx_queues_to_use, + priv->plat->rx_queues_to_use, + *enable); +@@ -7245,6 +7248,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work) + netdev_info(priv->dev, SEND_VERIFY_MPAKCET_FMT, + *lo_state, *lp_state); + stmmac_fpe_send_mpacket(priv, priv->ioaddr, ++ fpe_cfg, + MPACKET_VERIFY); + } + /* Sleep then retry */ +@@ -7259,6 +7263,7 @@ void stmmac_fpe_handshake(struct stmmac_priv *priv, bool enable) + if (priv->plat->fpe_cfg->hs_enable != enable) { + if (enable) { + stmmac_fpe_send_mpacket(priv, priv->ioaddr, ++ priv->plat->fpe_cfg, + MPACKET_VERIFY); + } else { + priv->plat->fpe_cfg->lo_fpe_state = FPE_STATE_OFF; +@@ -7719,6 +7724,7 @@ int stmmac_suspend(struct device *dev) + if (priv->dma_cap.fpesel) { + /* Disable FPE */ + stmmac_fpe_configure(priv, priv->ioaddr, ++ priv->plat->fpe_cfg, + priv->plat->tx_queues_to_use, + priv->plat->rx_queues_to_use, false); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +index ac41ef4cbd2f0..6ad3e0a119366 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +@@ -1079,6 +1079,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, + + priv->plat->fpe_cfg->enable = false; + stmmac_fpe_configure(priv, priv->ioaddr, ++ priv->plat->fpe_cfg, + priv->plat->tx_queues_to_use, + priv->plat->rx_queues_to_use, + false); +diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h +index ce89cc3e49135..e3f7ee169c086 100644 +--- a/include/linux/stmmac.h ++++ b/include/linux/stmmac.h +@@ -174,6 +174,7 @@ struct stmmac_fpe_cfg { + bool hs_enable; /* FPE handshake enable */ + enum stmmac_fpe_state lp_fpe_state; /* Link Partner FPE state */ + enum stmmac_fpe_state lo_fpe_state; /* Local station FPE state */ ++ u32 fpe_csr; /* MAC_FPE_CTRL_STS reg cache */ + }; + + struct stmmac_safety_feature_cfg { +-- +2.42.0 + diff --git a/queue-6.6/net-tls-update-curr-on-splice-as-well.patch b/queue-6.6/net-tls-update-curr-on-splice-as-well.patch new file mode 100644 index 00000000000..21032838f82 --- /dev/null +++ b/queue-6.6/net-tls-update-curr-on-splice-as-well.patch @@ -0,0 +1,38 @@ +From 13617a18f890a1ffc6fd0e142c974dc9c76fb4df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:27:05 -0800 +Subject: net: tls, update curr on splice as well + +From: John Fastabend + +[ Upstream commit c5a595000e2677e865a39f249c056bc05d6e55fd ] + +The curr pointer must also be updated on the splice similar to how +we do this for other copy types. + +Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface") +Signed-off-by: John Fastabend +Reported-by: Jann Horn +Link: https://lore.kernel.org/r/20231206232706.374377-2-john.fastabend@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 779815b885e94..27cc0f0a90e1f 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -952,6 +952,8 @@ static int tls_sw_sendmsg_splice(struct sock *sk, struct msghdr *msg, + } + + sk_msg_page_add(msg_pl, page, part, off); ++ msg_pl->sg.copybreak = 0; ++ msg_pl->sg.curr = msg_pl->sg.end; + sk_mem_charge(sk, part); + *copied += part; + try_to_copy -= part; +-- +2.42.0 + diff --git a/queue-6.6/netfilter-bpf-fix-bad-registration-on-nf_defrag.patch b/queue-6.6/netfilter-bpf-fix-bad-registration-on-nf_defrag.patch new file mode 100644 index 00000000000..40b58e3a4ee --- /dev/null +++ b/queue-6.6/netfilter-bpf-fix-bad-registration-on-nf_defrag.patch @@ -0,0 +1,121 @@ +From 37f7f17c95198b6e6245647fcc0db18cbaf17eac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 15:23:23 +0800 +Subject: netfilter: bpf: fix bad registration on nf_defrag + +From: D. Wythe + +[ Upstream commit 1834d62ae88500f37cba4439c3237aa85242272e ] + +We should pass a pointer to global_hook to the get_proto_defrag_hook() +instead of its value, since the passed value won't be updated even if +the request module was loaded successfully. + +Log: + +[ 54.915713] nf_defrag_ipv4 has bad registration +[ 54.915779] WARNING: CPU: 3 PID: 6323 at net/netfilter/nf_bpf_link.c:62 get_proto_defrag_hook+0x137/0x160 +[ 54.915835] CPU: 3 PID: 6323 Comm: fentry Kdump: loaded Tainted: G E 6.7.0-rc2+ #35 +[ 54.915839] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 +[ 54.915841] RIP: 0010:get_proto_defrag_hook+0x137/0x160 +[ 54.915844] Code: 4f 8c e8 2c cf 68 ff 80 3d db 83 9a 01 00 0f 85 74 ff ff ff 48 89 ee 48 c7 c7 8f 12 4f 8c c6 05 c4 83 9a 01 01 e8 09 ee 5f ff <0f> 0b e9 57 ff ff ff 49 8b 3c 24 4c 63 e5 e8 36 28 6c ff 4c 89 e0 +[ 54.915849] RSP: 0018:ffffb676003fbdb0 EFLAGS: 00010286 +[ 54.915852] RAX: 0000000000000023 RBX: ffff9596503d5600 RCX: ffff95996fce08c8 +[ 54.915854] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff95996fce08c0 +[ 54.915855] RBP: ffffffff8c4f12de R08: 0000000000000000 R09: 00000000fffeffff +[ 54.915859] R10: ffffb676003fbc70 R11: ffffffff8d363ae8 R12: 0000000000000000 +[ 54.915861] R13: ffffffff8e1f75c0 R14: ffffb676003c9000 R15: 00007ffd15e78ef0 +[ 54.915864] FS: 00007fb6e9cab740(0000) GS:ffff95996fcc0000(0000) knlGS:0000000000000000 +[ 54.915867] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 54.915868] CR2: 00007ffd15e75c40 CR3: 0000000101e62006 CR4: 0000000000360ef0 +[ 54.915870] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 54.915871] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 54.915873] Call Trace: +[ 54.915891] +[ 54.915894] ? __warn+0x84/0x140 +[ 54.915905] ? get_proto_defrag_hook+0x137/0x160 +[ 54.915908] ? __report_bug+0xea/0x100 +[ 54.915925] ? report_bug+0x2b/0x80 +[ 54.915928] ? handle_bug+0x3c/0x70 +[ 54.915939] ? exc_invalid_op+0x18/0x70 +[ 54.915942] ? asm_exc_invalid_op+0x1a/0x20 +[ 54.915948] ? get_proto_defrag_hook+0x137/0x160 +[ 54.915950] bpf_nf_link_attach+0x1eb/0x240 +[ 54.915953] link_create+0x173/0x290 +[ 54.915969] __sys_bpf+0x588/0x8f0 +[ 54.915974] __x64_sys_bpf+0x20/0x30 +[ 54.915977] do_syscall_64+0x45/0xf0 +[ 54.915989] entry_SYSCALL_64_after_hwframe+0x6e/0x76 +[ 54.915998] RIP: 0033:0x7fb6e9daa51d +[ 54.916001] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2b 89 0c 00 f7 d8 64 89 01 48 +[ 54.916003] RSP: 002b:00007ffd15e78ed8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 +[ 54.916006] RAX: ffffffffffffffda RBX: 00007ffd15e78fc0 RCX: 00007fb6e9daa51d +[ 54.916007] RDX: 0000000000000040 RSI: 00007ffd15e78ef0 RDI: 000000000000001c +[ 54.916009] RBP: 000000000000002d R08: 00007fb6e9e73a60 R09: 0000000000000001 +[ 54.916010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 +[ 54.916012] R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000 +[ 54.916014] +[ 54.916015] ---[ end trace 0000000000000000 ]--- + +Fixes: 91721c2d02d3 ("netfilter: bpf: Support BPF_F_NETFILTER_IP_DEFRAG in netfilter link") +Signed-off-by: D. Wythe +Acked-by: Daniel Xu +Reviewed-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_bpf_link.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c +index e502ec00b2fe1..0e4beae421f83 100644 +--- a/net/netfilter/nf_bpf_link.c ++++ b/net/netfilter/nf_bpf_link.c +@@ -31,7 +31,7 @@ struct bpf_nf_link { + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) || IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + static const struct nf_defrag_hook * + get_proto_defrag_hook(struct bpf_nf_link *link, +- const struct nf_defrag_hook __rcu *global_hook, ++ const struct nf_defrag_hook __rcu **ptr_global_hook, + const char *mod) + { + const struct nf_defrag_hook *hook; +@@ -39,7 +39,7 @@ get_proto_defrag_hook(struct bpf_nf_link *link, + + /* RCU protects us from races against module unloading */ + rcu_read_lock(); +- hook = rcu_dereference(global_hook); ++ hook = rcu_dereference(*ptr_global_hook); + if (!hook) { + rcu_read_unlock(); + err = request_module(mod); +@@ -47,7 +47,7 @@ get_proto_defrag_hook(struct bpf_nf_link *link, + return ERR_PTR(err < 0 ? err : -EINVAL); + + rcu_read_lock(); +- hook = rcu_dereference(global_hook); ++ hook = rcu_dereference(*ptr_global_hook); + } + + if (hook && try_module_get(hook->owner)) { +@@ -78,7 +78,7 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link) + switch (link->hook_ops.pf) { + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + case NFPROTO_IPV4: +- hook = get_proto_defrag_hook(link, nf_defrag_v4_hook, "nf_defrag_ipv4"); ++ hook = get_proto_defrag_hook(link, &nf_defrag_v4_hook, "nf_defrag_ipv4"); + if (IS_ERR(hook)) + return PTR_ERR(hook); + +@@ -87,7 +87,7 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link) + #endif + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + case NFPROTO_IPV6: +- hook = get_proto_defrag_hook(link, nf_defrag_v6_hook, "nf_defrag_ipv6"); ++ hook = get_proto_defrag_hook(link, &nf_defrag_v6_hook, "nf_defrag_ipv6"); + if (IS_ERR(hook)) + return PTR_ERR(hook); + +-- +2.42.0 + diff --git a/queue-6.6/netfilter-nf_tables-bail-out-on-mismatching-dynset-a.patch b/queue-6.6/netfilter-nf_tables-bail-out-on-mismatching-dynset-a.patch new file mode 100644 index 00000000000..171c89e82c9 --- /dev/null +++ b/queue-6.6/netfilter-nf_tables-bail-out-on-mismatching-dynset-a.patch @@ -0,0 +1,48 @@ +From eb3c3b5c84c4a1764e3e9c75fd59fd44a6ea3f60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 14:25:33 +0100 +Subject: netfilter: nf_tables: bail out on mismatching dynset and set + expressions + +From: Pablo Neira Ayuso + +[ Upstream commit 3701cd390fd731ee7ae8b8006246c8db82c72bea ] + +If dynset expressions provided by userspace is larger than the declared +set expressions, then bail out. + +Fixes: 48b0ae046ee9 ("netfilter: nftables: netlink support for several set element expressions") +Reported-by: Xingyuan Mo +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_dynset.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c +index 5c5cc01c73c5a..629a91a8c6141 100644 +--- a/net/netfilter/nft_dynset.c ++++ b/net/netfilter/nft_dynset.c +@@ -279,10 +279,15 @@ static int nft_dynset_init(const struct nft_ctx *ctx, + priv->expr_array[i] = dynset_expr; + priv->num_exprs++; + +- if (set->num_exprs && +- dynset_expr->ops != set->exprs[i]->ops) { +- err = -EOPNOTSUPP; +- goto err_expr_free; ++ if (set->num_exprs) { ++ if (i >= set->num_exprs) { ++ err = -EINVAL; ++ goto err_expr_free; ++ } ++ if (dynset_expr->ops != set->exprs[i]->ops) { ++ err = -EOPNOTSUPP; ++ goto err_expr_free; ++ } + } + i++; + } +-- +2.42.0 + diff --git a/queue-6.6/netfilter-nf_tables-fix-exist-matching-on-bigendian-.patch b/queue-6.6/netfilter-nf_tables-fix-exist-matching-on-bigendian-.patch new file mode 100644 index 00000000000..e193c38afd3 --- /dev/null +++ b/queue-6.6/netfilter-nf_tables-fix-exist-matching-on-bigendian-.patch @@ -0,0 +1,94 @@ +From d1c8db618dcdd734dc8323997fd667801571201c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 12:29:54 +0100 +Subject: netfilter: nf_tables: fix 'exist' matching on bigendian arches +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Florian Westphal + +[ Upstream commit 63331e37fb227e796894b31d713697612c8dee7f ] + +Maze reports "tcp option fastopen exists" fails to match on +OpenWrt 22.03.5, r20134-5f15225c1e (5.10.176) router. + +"tcp option fastopen exists" translates to: +inet + [ exthdr load tcpopt 1b @ 34 + 0 present => reg 1 ] + [ cmp eq reg 1 0x00000001 ] + +.. but existing nft userspace generates a 1-byte compare. + +On LSB (x86), "*reg32 = 1" is identical to nft_reg_store8(reg32, 1), but +not on MSB, which will place the 1 last. IOW, on bigendian aches the cmp8 +is awalys false. + +Make sure we store this in a consistent fashion, so existing userspace +will also work on MSB (bigendian). + +Regardless of this patch we can also change nft userspace to generate +'reg32 == 0' and 'reg32 != 0' instead of u8 == 0 // u8 == 1 when +adding 'option x missing/exists' expressions as well. + +Fixes: 3c1fece8819e ("netfilter: nft_exthdr: Allow checking TCP option presence, too") +Fixes: b9f9a485fb0e ("netfilter: nft_exthdr: add boolean DCCP option matching") +Fixes: 055c4b34b94f ("netfilter: nft_fib: Support existence check") +Reported-by: Maciej Å»enczykowski +Closes: https://lore.kernel.org/netfilter-devel/CAHo-OozyEqHUjL2-ntATzeZOiuftLWZ_HU6TOM_js4qLfDEAJg@mail.gmail.com/ +Signed-off-by: Florian Westphal +Acked-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_exthdr.c | 4 ++-- + net/netfilter/nft_fib.c | 8 ++++++-- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c +index 3fbaa7bf41f9c..6eb571d0c3fdf 100644 +--- a/net/netfilter/nft_exthdr.c ++++ b/net/netfilter/nft_exthdr.c +@@ -214,7 +214,7 @@ static void nft_exthdr_tcp_eval(const struct nft_expr *expr, + + offset = i + priv->offset; + if (priv->flags & NFT_EXTHDR_F_PRESENT) { +- *dest = 1; ++ nft_reg_store8(dest, 1); + } else { + if (priv->len % NFT_REG32_SIZE) + dest[priv->len / NFT_REG32_SIZE] = 0; +@@ -461,7 +461,7 @@ static void nft_exthdr_dccp_eval(const struct nft_expr *expr, + type = bufp[0]; + + if (type == priv->type) { +- *dest = 1; ++ nft_reg_store8(dest, 1); + return; + } + +diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c +index 04b51f2853321..ca905aa8227e5 100644 +--- a/net/netfilter/nft_fib.c ++++ b/net/netfilter/nft_fib.c +@@ -145,11 +145,15 @@ void nft_fib_store_result(void *reg, const struct nft_fib *priv, + switch (priv->result) { + case NFT_FIB_RESULT_OIF: + index = dev ? dev->ifindex : 0; +- *dreg = (priv->flags & NFTA_FIB_F_PRESENT) ? !!index : index; ++ if (priv->flags & NFTA_FIB_F_PRESENT) ++ nft_reg_store8(dreg, !!index); ++ else ++ *dreg = index; ++ + break; + case NFT_FIB_RESULT_OIFNAME: + if (priv->flags & NFTA_FIB_F_PRESENT) +- *dreg = !!dev; ++ nft_reg_store8(dreg, !!dev); + else + strscpy_pad(reg, dev ? dev->name : "", IFNAMSIZ); + break; +-- +2.42.0 + diff --git a/queue-6.6/netfilter-nf_tables-validate-family-when-identifying.patch b/queue-6.6/netfilter-nf_tables-validate-family-when-identifying.patch new file mode 100644 index 00000000000..37eacb5b6bf --- /dev/null +++ b/queue-6.6/netfilter-nf_tables-validate-family-when-identifying.patch @@ -0,0 +1,53 @@ +From 9e91123a8786dab85027d2f10ba918481febfd8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 14:51:48 +0100 +Subject: netfilter: nf_tables: validate family when identifying table via + handle + +From: Pablo Neira Ayuso + +[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ] + +Validate table family when looking up for it via NFTA_TABLE_HANDLE. + +Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle") +Reported-by: Xingyuan Mo +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 4a450f6d12a59..fb5c62aa8d9ce 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -805,7 +805,7 @@ static struct nft_table *nft_table_lookup(const struct net *net, + + static struct nft_table *nft_table_lookup_byhandle(const struct net *net, + const struct nlattr *nla, +- u8 genmask, u32 nlpid) ++ int family, u8 genmask, u32 nlpid) + { + struct nftables_pernet *nft_net; + struct nft_table *table; +@@ -813,6 +813,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net, + nft_net = nft_pernet(net); + list_for_each_entry(table, &nft_net->tables, list) { + if (be64_to_cpu(nla_get_be64(nla)) == table->handle && ++ table->family == family && + nft_active_genmask(table, genmask)) { + if (nft_table_has_owner(table) && + nlpid && table->nlpid != nlpid) +@@ -1546,7 +1547,7 @@ static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info, + + if (nla[NFTA_TABLE_HANDLE]) { + attr = nla[NFTA_TABLE_HANDLE]; +- table = nft_table_lookup_byhandle(net, attr, genmask, ++ table = nft_table_lookup_byhandle(net, attr, family, genmask, + NETLINK_CB(skb).portid); + } else { + attr = nla[NFTA_TABLE_NAME]; +-- +2.42.0 + diff --git a/queue-6.6/netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch b/queue-6.6/netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch new file mode 100644 index 00000000000..cc4de86dfcd --- /dev/null +++ b/queue-6.6/netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch @@ -0,0 +1,71 @@ +From 45de32d4a960d625d89dfa018db2590b25fca2c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 21:58:12 +0100 +Subject: netfilter: xt_owner: Fix for unsafe access of sk->sk_socket + +From: Phil Sutter + +[ Upstream commit 7ae836a3d630e146b732fe8ef7d86b243748751f ] + +A concurrently running sock_orphan() may NULL the sk_socket pointer in +between check and deref. Follow other users (like nft_meta.c for +instance) and acquire sk_callback_lock before dereferencing sk_socket. + +Fixes: 0265ab44bacc ("[NETFILTER]: merge ipt_owner/ip6t_owner in xt_owner") +Reported-by: Jann Horn +Signed-off-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_owner.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c +index e85ce69924aee..50332888c8d23 100644 +--- a/net/netfilter/xt_owner.c ++++ b/net/netfilter/xt_owner.c +@@ -76,18 +76,23 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par) + */ + return false; + +- filp = sk->sk_socket->file; +- if (filp == NULL) ++ read_lock_bh(&sk->sk_callback_lock); ++ filp = sk->sk_socket ? sk->sk_socket->file : NULL; ++ if (filp == NULL) { ++ read_unlock_bh(&sk->sk_callback_lock); + return ((info->match ^ info->invert) & + (XT_OWNER_UID | XT_OWNER_GID)) == 0; ++ } + + if (info->match & XT_OWNER_UID) { + kuid_t uid_min = make_kuid(net->user_ns, info->uid_min); + kuid_t uid_max = make_kuid(net->user_ns, info->uid_max); + if ((uid_gte(filp->f_cred->fsuid, uid_min) && + uid_lte(filp->f_cred->fsuid, uid_max)) ^ +- !(info->invert & XT_OWNER_UID)) ++ !(info->invert & XT_OWNER_UID)) { ++ read_unlock_bh(&sk->sk_callback_lock); + return false; ++ } + } + + if (info->match & XT_OWNER_GID) { +@@ -112,10 +117,13 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par) + } + } + +- if (match ^ !(info->invert & XT_OWNER_GID)) ++ if (match ^ !(info->invert & XT_OWNER_GID)) { ++ read_unlock_bh(&sk->sk_callback_lock); + return false; ++ } + } + ++ read_unlock_bh(&sk->sk_callback_lock); + return true; + } + +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-af-add-missing-mcs-flr-handler-call.patch b/queue-6.6/octeontx2-af-add-missing-mcs-flr-handler-call.patch new file mode 100644 index 00000000000..74636538edc --- /dev/null +++ b/queue-6.6/octeontx2-af-add-missing-mcs-flr-handler-call.patch @@ -0,0 +1,38 @@ +From d40951d5eaad1c45a2a3605232e6e101b106e9d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 13:34:33 +0530 +Subject: octeontx2-af: Add missing mcs flr handler call + +From: Geetha sowjanya + +[ Upstream commit d431abd0a9aa27be379fb5f8304062071b0f5a7e ] + +If mcs resources are attached to PF/VF. These resources need +to be freed on FLR. This patch add missing mcs flr call on PF FLR. + +Fixes: bd69476e86fc ("octeontx2-af: cn10k: mcs: Install a default TCAM for normal traffic") +Signed-off-by: Geetha sowjanya +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index 22c395c7d040b..731bb82b577c2 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -2631,6 +2631,9 @@ static void __rvu_flr_handler(struct rvu *rvu, u16 pcifunc) + rvu_npc_free_mcam_entries(rvu, pcifunc, -1); + rvu_mac_reset(rvu, pcifunc); + ++ if (rvu->mcs_blk_cnt) ++ rvu_mcs_flr_handler(rvu, pcifunc); ++ + mutex_unlock(&rvu->flr_lock); + } + +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-af-adjust-tx-credits-when-mcs-external-byp.patch b/queue-6.6/octeontx2-af-adjust-tx-credits-when-mcs-external-byp.patch new file mode 100644 index 00000000000..907a37115bc --- /dev/null +++ b/queue-6.6/octeontx2-af-adjust-tx-credits-when-mcs-external-byp.patch @@ -0,0 +1,153 @@ +From 0fbe5c137aa29fdd0942d9b10621dc09a4d866d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 13:34:30 +0530 +Subject: octeontx2-af: Adjust Tx credits when MCS external bypass is disabled + +From: Nithin Dabilpuram + +[ Upstream commit dca6fa8644b89f54345e55501b1419316ba5cb29 ] + +When MCS external bypass is disabled, MCS returns additional +2 credits(32B) for every packet Tx'ed on LMAC. To account for +these extra credits, NIX_AF_TX_LINKX_NORM_CREDIT.CC_MCS_CNT +needs to be configured as otherwise NIX Tx credits would overflow +and will never be returned to idle state credit count +causing issues with credit control and MTU change. + +This patch fixes the same by configuring CC_MCS_CNT at probe +time for MCS enabled SoC's + +Fixes: bd69476e86fc ("octeontx2-af: cn10k: mcs: Install a default TCAM for normal traffic") +Signed-off-by: Nithin Dabilpuram +Signed-off-by: Geetha sowjanya +Signed-off-by: Sunil Goutham +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 14 +++++++++++++- + drivers/net/ethernet/marvell/octeontx2/af/mcs.h | 2 ++ + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 8 ++++++++ + .../net/ethernet/marvell/octeontx2/af/rvu_reg.h | 1 + + 5 files changed, 25 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c +index c43f19dfbd744..bd87507cf8eaa 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c +@@ -1219,6 +1219,17 @@ struct mcs *mcs_get_pdata(int mcs_id) + return NULL; + } + ++bool is_mcs_bypass(int mcs_id) ++{ ++ struct mcs *mcs_dev; ++ ++ list_for_each_entry(mcs_dev, &mcs_list, mcs_list) { ++ if (mcs_dev->mcs_id == mcs_id) ++ return mcs_dev->bypass; ++ } ++ return true; ++} ++ + void mcs_set_port_cfg(struct mcs *mcs, struct mcs_port_cfg_set_req *req) + { + u64 val = 0; +@@ -1436,7 +1447,7 @@ static int mcs_x2p_calibration(struct mcs *mcs) + return err; + } + +-static void mcs_set_external_bypass(struct mcs *mcs, u8 bypass) ++static void mcs_set_external_bypass(struct mcs *mcs, bool bypass) + { + u64 val; + +@@ -1447,6 +1458,7 @@ static void mcs_set_external_bypass(struct mcs *mcs, u8 bypass) + else + val &= ~BIT_ULL(6); + mcs_reg_write(mcs, MCSX_MIL_GLOBAL, val); ++ mcs->bypass = bypass; + } + + static void mcs_global_cfg(struct mcs *mcs) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.h b/drivers/net/ethernet/marvell/octeontx2/af/mcs.h +index 0f89dcb764654..f927cc61dfd21 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.h +@@ -149,6 +149,7 @@ struct mcs { + u16 num_vec; + void *rvu; + u16 *tx_sa_active; ++ bool bypass; + }; + + struct mcs_ops { +@@ -206,6 +207,7 @@ void mcs_get_custom_tag_cfg(struct mcs *mcs, struct mcs_custom_tag_cfg_get_req * + int mcs_alloc_ctrlpktrule(struct rsrc_bmap *rsrc, u16 *pf_map, u16 offset, u16 pcifunc); + int mcs_free_ctrlpktrule(struct mcs *mcs, struct mcs_free_ctrl_pkt_rule_req *req); + int mcs_ctrlpktrule_write(struct mcs *mcs, struct mcs_ctrl_pkt_rule_write_req *req); ++bool is_mcs_bypass(int mcs_id); + + /* CN10K-B APIs */ + void cn10kb_mcs_set_hw_capabilities(struct mcs *mcs); +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index c4d999ef5ab4b..cce2806aaa50c 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -345,6 +345,7 @@ struct nix_hw { + struct nix_txvlan txvlan; + struct nix_ipolicer *ipolicer; + u64 *tx_credits; ++ u8 cc_mcs_cnt; + }; + + /* RVU block's capabilities or functionality, +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index c112c71ff576f..4227ebb4a758d 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -12,6 +12,7 @@ + #include "rvu_reg.h" + #include "rvu.h" + #include "npc.h" ++#include "mcs.h" + #include "cgx.h" + #include "lmac_common.h" + #include "rvu_npc_hash.h" +@@ -4389,6 +4390,12 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, + SDP_HW_MAX_FRS << 16 | NIC_HW_MIN_FRS); + } + ++ /* Get MCS external bypass status for CN10K-B */ ++ if (mcs_get_blkcnt() == 1) { ++ /* Adjust for 2 credits when external bypass is disabled */ ++ nix_hw->cc_mcs_cnt = is_mcs_bypass(0) ? 0 : 2; ++ } ++ + /* Set credits for Tx links assuming max packet length allowed. + * This will be reconfigured based on MTU set for PF/VF. + */ +@@ -4412,6 +4419,7 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, + tx_credits = (lmac_fifo_len - lmac_max_frs) / 16; + /* Enable credits and set credit pkt count to max allowed */ + cfg = (tx_credits << 12) | (0x1FF << 2) | BIT_ULL(1); ++ cfg |= FIELD_PREP(NIX_AF_LINKX_MCS_CNT_MASK, nix_hw->cc_mcs_cnt); + + link = iter + slink; + nix_hw->tx_credits[link] = tx_credits; +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h +index b42e631e52d0f..18c1c9f361cc6 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h +@@ -437,6 +437,7 @@ + + #define NIX_AF_LINKX_BASE_MASK GENMASK_ULL(11, 0) + #define NIX_AF_LINKX_RANGE_MASK GENMASK_ULL(19, 16) ++#define NIX_AF_LINKX_MCS_CNT_MASK GENMASK_ULL(33, 32) + + /* SSO */ + #define SSO_AF_CONST (0x1000) +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-af-check-return-value-of-nix_get_nixlf-bef.patch b/queue-6.6/octeontx2-af-check-return-value-of-nix_get_nixlf-bef.patch new file mode 100644 index 00000000000..26606a4234a --- /dev/null +++ b/queue-6.6/octeontx2-af-check-return-value-of-nix_get_nixlf-bef.patch @@ -0,0 +1,45 @@ +From b4664e1819e90dc468b7c63c07eba5e8075b3eb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 11:11:48 +0530 +Subject: octeontx2-af: Check return value of nix_get_nixlf before using nixlf + +From: Subbaraya Sundeep + +[ Upstream commit 830139e7b6911266a84a77e1f18abf758995cc89 ] + +If a NIXLF is not attached to a PF/VF device then +nix_get_nixlf function fails and returns proper error +code. But npc_get_default_entry_action does not check it +and uses garbage value in subsequent calls. Fix this +by cheking the return value of nix_get_nixlf. + +Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet replication feature") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 16cfc802e348d..f65805860c8d4 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -389,7 +389,13 @@ static u64 npc_get_default_entry_action(struct rvu *rvu, struct npc_mcam *mcam, + int bank, nixlf, index; + + /* get ucast entry rule entry index */ +- nix_get_nixlf(rvu, pf_func, &nixlf, NULL); ++ if (nix_get_nixlf(rvu, pf_func, &nixlf, NULL)) { ++ dev_err(rvu->dev, "%s: nixlf not attached to pcifunc:0x%x\n", ++ __func__, pf_func); ++ /* Action 0 is drop */ ++ return 0; ++ } ++ + index = npc_get_nixlf_mcam_index(mcam, pf_func, nixlf, + NIXLF_UCAST_ENTRY); + bank = npc_get_bank(mcam, index); +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch b/queue-6.6/octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch new file mode 100644 index 00000000000..7a095a86d44 --- /dev/null +++ b/queue-6.6/octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch @@ -0,0 +1,61 @@ +From 2eb35aa669c3200ae9fb47659827f3295188f2f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Dec 2023 17:59:02 +0800 +Subject: octeontx2-af: fix a use-after-free in rvu_npa_register_reporters + +From: Zhipeng Lu + +[ Upstream commit 3c91c909f13f0c32b0d54d75c3f798479b1a84f5 ] + +The rvu_dl will be freed in rvu_npa_health_reporters_destroy(rvu_dl) +after the create_workqueue fails, and after that free, the rvu_dl will +be translate back through rvu_npa_health_reporters_create, +rvu_health_reporters_create, and rvu_register_dl. Finally it goes to the +err_dl_health label, being freed again in +rvu_health_reporters_destroy(rvu) by rvu_npa_health_reporters_destroy. +In the second calls of rvu_npa_health_reporters_destroy, however, +it uses rvu_dl->rvu_npa_health_reporter, which is already freed at +the end of rvu_npa_health_reporters_destroy in the first call. + +So this patch prevents the first destroy by instantly returning -ENONMEN +when create_workqueue fails. In addition, since the failure of +create_workqueue is the only entrence of label err, it has been +integrated into the error-handling path of create_workqueue. + +Fixes: f1168d1e207c ("octeontx2-af: Add devlink health reporters for NPA") +Signed-off-by: Zhipeng Lu +Acked-by: Paolo Abeni +Acked-by: Geethasowjanya Akula +Link: https://lore.kernel.org/r/20231202095902.3264863-1-alexious@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +index 41df5ac23f927..058f75dc4c8a5 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +@@ -1285,7 +1285,7 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) + + rvu_dl->devlink_wq = create_workqueue("rvu_devlink_wq"); + if (!rvu_dl->devlink_wq) +- goto err; ++ return -ENOMEM; + + INIT_WORK(&rvu_reporters->intr_work, rvu_npa_intr_work); + INIT_WORK(&rvu_reporters->err_work, rvu_npa_err_work); +@@ -1293,9 +1293,6 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) + INIT_WORK(&rvu_reporters->ras_work, rvu_npa_ras_work); + + return 0; +-err: +- rvu_npa_health_reporters_destroy(rvu_dl); +- return -ENOMEM; + } + + static int rvu_npa_health_reporters_create(struct rvu_devlink *rvu_dl) +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-af-fix-mcs-sa-cam-entries-size.patch b/queue-6.6/octeontx2-af-fix-mcs-sa-cam-entries-size.patch new file mode 100644 index 00000000000..5332dd5e094 --- /dev/null +++ b/queue-6.6/octeontx2-af-fix-mcs-sa-cam-entries-size.patch @@ -0,0 +1,38 @@ +From 596cca86065379dae2982fdf60d27719627eecc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 13:34:31 +0530 +Subject: octeontx2-af: Fix mcs sa cam entries size + +From: Geetha sowjanya + +[ Upstream commit 9723b2cca1f0e980c53156b52ea73b93966b3c8a ] + +On latest silicon versions SA cam entries increased to 256. +This patch fixes the datatype of sa_entries in mcs_hw_info +struct to u16 to hold 256 entries. + +Fixes: 080bbd19c9dd ("octeontx2-af: cn10k: mcs: Add mailboxes for port related operations") +Signed-off-by: Geetha sowjanya +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +index 6b5b06c2b4e99..31bd9aeb41e7e 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +@@ -1938,7 +1938,7 @@ struct mcs_hw_info { + u8 tcam_entries; /* RX/TX Tcam entries per mcs block */ + u8 secy_entries; /* RX/TX SECY entries per mcs block */ + u8 sc_entries; /* RX/TX SC CAM entries per mcs block */ +- u8 sa_entries; /* PN table entries = SA entries */ ++ u16 sa_entries; /* PN table entries = SA entries */ + u64 rsvd[16]; + }; + +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-af-fix-mcs-stats-register-address.patch b/queue-6.6/octeontx2-af-fix-mcs-stats-register-address.patch new file mode 100644 index 00000000000..4d82e0d50ae --- /dev/null +++ b/queue-6.6/octeontx2-af-fix-mcs-stats-register-address.patch @@ -0,0 +1,93 @@ +From dd852ba3f707b802bd325bfee7150a478f9f21bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 13:34:32 +0530 +Subject: octeontx2-af: Fix mcs stats register address + +From: Geetha sowjanya + +[ Upstream commit 3ba98a8c6f8ceb4e01a78f973d8d9017020bbd57 ] + +This patch adds the miss mcs stats register +for mcs supported platforms. + +Fixes: 9312150af8da ("octeontx2-af: cn10k: mcs: Support for stats collection") +Signed-off-by: Geetha sowjanya +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/mcs.c | 4 +-- + .../ethernet/marvell/octeontx2/af/mcs_reg.h | 31 ++++++++++++++++--- + 2 files changed, 29 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c +index bd87507cf8eaa..c1775bd01c2b4 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c +@@ -117,7 +117,7 @@ void mcs_get_rx_secy_stats(struct mcs *mcs, struct mcs_secy_stats *stats, int id + reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYTAGGEDCTLX(id); + stats->pkt_tagged_ctl_cnt = mcs_reg_read(mcs, reg); + +- reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDORNOTAGX(id); ++ reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX(id); + stats->pkt_untaged_cnt = mcs_reg_read(mcs, reg); + + reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX(id); +@@ -215,7 +215,7 @@ void mcs_get_sc_stats(struct mcs *mcs, struct mcs_sc_stats *stats, + reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSCNOTVALIDX(id); + stats->pkt_notvalid_cnt = mcs_reg_read(mcs, reg); + +- reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDOROKX(id); ++ reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDX(id); + stats->pkt_unchecked_cnt = mcs_reg_read(mcs, reg); + + if (mcs->hw->mcs_blks > 1) { +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h b/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h +index f3ab01fc363c8..f4c6de89002c1 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h +@@ -810,14 +810,37 @@ + offset = 0x9d8ull; \ + offset; }) + ++#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDX(a) ({ \ ++ u64 offset; \ ++ \ ++ offset = 0xee80ull; \ ++ if (mcs->hw->mcs_blks > 1) \ ++ offset = 0xe818ull; \ ++ offset += (a) * 0x8ull; \ ++ offset; }) ++ ++#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX(a) ({ \ ++ u64 offset; \ ++ \ ++ offset = 0xa680ull; \ ++ if (mcs->hw->mcs_blks > 1) \ ++ offset = 0xd018ull; \ ++ offset += (a) * 0x8ull; \ ++ offset; }) ++ ++#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCLATEORDELAYEDX(a) ({ \ ++ u64 offset; \ ++ \ ++ offset = 0xf680ull; \ ++ if (mcs->hw->mcs_blks > 1) \ ++ offset = 0xe018ull; \ ++ offset += (a) * 0x8ull; \ ++ offset; }) ++ + #define MCSX_CSE_RX_MEM_SLAVE_INOCTETSSCDECRYPTEDX(a) (0xe680ull + (a) * 0x8ull) + #define MCSX_CSE_RX_MEM_SLAVE_INOCTETSSCVALIDATEX(a) (0xde80ull + (a) * 0x8ull) +-#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDORNOTAGX(a) (0xa680ull + (a) * 0x8ull) + #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYNOTAGX(a) (0xd218 + (a) * 0x8ull) +-#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX(a) (0xd018ull + (a) * 0x8ull) +-#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDOROKX(a) (0xee80ull + (a) * 0x8ull) + #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX(a) (0xb680ull + (a) * 0x8ull) +-#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCLATEORDELAYEDX(a) (0xf680ull + (a) * 0x8ull) + #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSAINVALIDX(a) (0x12680ull + (a) * 0x8ull) + #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSANOTUSINGSAERRORX(a) (0x15680ull + (a) * 0x8ull) + #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSANOTVALIDX(a) (0x13680ull + (a) * 0x8ull) +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-af-update-tx-link-register-range.patch b/queue-6.6/octeontx2-af-update-tx-link-register-range.patch new file mode 100644 index 00000000000..80b28fcd86f --- /dev/null +++ b/queue-6.6/octeontx2-af-update-tx-link-register-range.patch @@ -0,0 +1,41 @@ +From 26898c58bed21f756fae7e3948edf1a765dd7ee4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 13:34:34 +0530 +Subject: octeontx2-af: Update Tx link register range + +From: Rahul Bhansali + +[ Upstream commit 7336fc196748f82646b630d5a2e9d283e200b988 ] + +On new silicons the TX channels for transmit level has increased. +This patch fixes the respective register offset range to +configure the newly added channels. + +Fixes: b279bbb3314e ("octeontx2-af: NIX Tx scheduler queue config support") +Signed-off-by: Rahul Bhansali +Signed-off-by: Geetha sowjanya +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c +index b3150f0532919..d46ac29adb966 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c +@@ -31,8 +31,8 @@ static struct hw_reg_map txsch_reg_map[NIX_TXSCH_LVL_CNT] = { + {NIX_TXSCH_LVL_TL4, 3, 0xFFFF, {{0x0B00, 0x0B08}, {0x0B10, 0x0B18}, + {0x1200, 0x12E0} } }, + {NIX_TXSCH_LVL_TL3, 4, 0xFFFF, {{0x1000, 0x10E0}, {0x1600, 0x1608}, +- {0x1610, 0x1618}, {0x1700, 0x17B0} } }, +- {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17B0} } }, ++ {0x1610, 0x1618}, {0x1700, 0x17C8} } }, ++ {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17C8} } }, + {NIX_TXSCH_LVL_TL1, 1, 0xFFFF, {{0x0C00, 0x0D98} } }, + }; + +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-pf-add-missing-mutex-lock-in-otx2_get_paus.patch b/queue-6.6/octeontx2-pf-add-missing-mutex-lock-in-otx2_get_paus.patch new file mode 100644 index 00000000000..1e0cdbda6bc --- /dev/null +++ b/queue-6.6/octeontx2-pf-add-missing-mutex-lock-in-otx2_get_paus.patch @@ -0,0 +1,51 @@ +From e5717adaf4eedeef877fa6ebf79f15fef34747c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 10:53:42 +0530 +Subject: octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam + +From: Subbaraya Sundeep + +[ Upstream commit 9572c949385aa2ef10368287c439bcb7935137c8 ] + +All the mailbox messages sent to AF needs to be guarded +by mutex lock. Add the missing lock in otx2_get_pauseparam +function. + +Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool") +Signed-off-by: Subbaraya Sundeep +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +index 9efcec549834e..53f6258a973c2 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +@@ -334,9 +334,12 @@ static void otx2_get_pauseparam(struct net_device *netdev, + if (is_otx2_lbkvf(pfvf->pdev)) + return; + ++ mutex_lock(&pfvf->mbox.lock); + req = otx2_mbox_alloc_msg_cgx_cfg_pause_frm(&pfvf->mbox); +- if (!req) ++ if (!req) { ++ mutex_unlock(&pfvf->mbox.lock); + return; ++ } + + if (!otx2_sync_mbox_msg(&pfvf->mbox)) { + rsp = (struct cgx_pause_frm_cfg *) +@@ -344,6 +347,7 @@ static void otx2_get_pauseparam(struct net_device *netdev, + pause->rx_pause = rsp->rx_pause; + pause->tx_pause = rsp->tx_pause; + } ++ mutex_unlock(&pfvf->mbox.lock); + } + + static int otx2_set_pauseparam(struct net_device *netdev, +-- +2.42.0 + diff --git a/queue-6.6/octeontx2-pf-consider-both-rx-and-tx-packet-stats-fo.patch b/queue-6.6/octeontx2-pf-consider-both-rx-and-tx-packet-stats-fo.patch new file mode 100644 index 00000000000..b4bf7b58a77 --- /dev/null +++ b/queue-6.6/octeontx2-pf-consider-both-rx-and-tx-packet-stats-fo.patch @@ -0,0 +1,101 @@ +From 76aff9f625898b598c09ea3d6f77c337d31cfeea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 11:03:30 +0530 +Subject: octeontx2-pf: consider both Rx and Tx packet stats for adaptive + interrupt coalescing + +From: Naveen Mamindlapalli + +[ Upstream commit adbf100fc47001c93d7e513ecac6fd6e04d5b4a1 ] + +The current adaptive interrupt coalescing code updates only rx +packet stats for dim algorithm. This patch also updates tx packet +stats which will be useful when there is only tx traffic. +Also moved configuring hardware adaptive interrupt setting to +driver dim callback. + +Fixes: 6e144b47f560 ("octeontx2-pf: Add support for adaptive interrupt coalescing") +Signed-off-by: Naveen Mamindlapalli +Signed-off-by: Suman Ghosh +Reviewed-by: Wojciech Drewek +Link: https://lore.kernel.org/r/20231201053330.3903694-1-sumang@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 9 +++++++++ + .../marvell/octeontx2/nic/otx2_txrx.c | 20 +++++++++---------- + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 532e324bdcc8e..0c17ebdda1487 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1688,6 +1688,14 @@ static void otx2_do_set_rx_mode(struct otx2_nic *pf) + mutex_unlock(&pf->mbox.lock); + } + ++static void otx2_set_irq_coalesce(struct otx2_nic *pfvf) ++{ ++ int cint; ++ ++ for (cint = 0; cint < pfvf->hw.cint_cnt; cint++) ++ otx2_config_irq_coalescing(pfvf, cint); ++} ++ + static void otx2_dim_work(struct work_struct *w) + { + struct dim_cq_moder cur_moder; +@@ -1703,6 +1711,7 @@ static void otx2_dim_work(struct work_struct *w) + CQ_TIMER_THRESH_MAX : cur_moder.usec; + pfvf->hw.cq_ecount_wait = (cur_moder.pkts > NAPI_POLL_WEIGHT) ? + NAPI_POLL_WEIGHT : cur_moder.pkts; ++ otx2_set_irq_coalesce(pfvf); + dim->state = DIM_START_MEASURE; + } + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +index 6ee15f3c25ede..4d519ea833b2c 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +@@ -512,11 +512,18 @@ static void otx2_adjust_adaptive_coalese(struct otx2_nic *pfvf, struct otx2_cq_p + { + struct dim_sample dim_sample; + u64 rx_frames, rx_bytes; ++ u64 tx_frames, tx_bytes; + + rx_frames = OTX2_GET_RX_STATS(RX_BCAST) + OTX2_GET_RX_STATS(RX_MCAST) + + OTX2_GET_RX_STATS(RX_UCAST); + rx_bytes = OTX2_GET_RX_STATS(RX_OCTS); +- dim_update_sample(pfvf->napi_events, rx_frames, rx_bytes, &dim_sample); ++ tx_bytes = OTX2_GET_TX_STATS(TX_OCTS); ++ tx_frames = OTX2_GET_TX_STATS(TX_UCAST); ++ ++ dim_update_sample(pfvf->napi_events, ++ rx_frames + tx_frames, ++ rx_bytes + tx_bytes, ++ &dim_sample); + net_dim(&cq_poll->dim, dim_sample); + } + +@@ -558,16 +565,9 @@ int otx2_napi_handler(struct napi_struct *napi, int budget) + if (pfvf->flags & OTX2_FLAG_INTF_DOWN) + return workdone; + +- /* Check for adaptive interrupt coalesce */ +- if (workdone != 0 && +- ((pfvf->flags & OTX2_FLAG_ADPTV_INT_COAL_ENABLED) == +- OTX2_FLAG_ADPTV_INT_COAL_ENABLED)) { +- /* Adjust irq coalese using net_dim */ ++ /* Adjust irq coalese using net_dim */ ++ if (pfvf->flags & OTX2_FLAG_ADPTV_INT_COAL_ENABLED) + otx2_adjust_adaptive_coalese(pfvf, cq_poll); +- /* Update irq coalescing */ +- for (i = 0; i < pfvf->hw.cint_cnt; i++) +- otx2_config_irq_coalescing(pfvf, i); +- } + + if (unlikely(!filled_cnt)) { + struct refill_work *work; +-- +2.42.0 + diff --git a/queue-6.6/of-dynamic-fix-of_reconfig_get_state_change-return-v.patch b/queue-6.6/of-dynamic-fix-of_reconfig_get_state_change-return-v.patch new file mode 100644 index 00000000000..cae3b2fb0e3 --- /dev/null +++ b/queue-6.6/of-dynamic-fix-of_reconfig_get_state_change-return-v.patch @@ -0,0 +1,41 @@ +From 68781fc841722665825676f223ec5b097127c894 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 15:47:18 +0100 +Subject: of: dynamic: Fix of_reconfig_get_state_change() return value + documentation + +From: Luca Ceresoli + +[ Upstream commit d79972789d17499b6091ded2fc0c6763c501a5ba ] + +The documented numeric return values do not match the actual returned +values. Fix them by using the enum names instead of raw numbers. + +Fixes: b53a2340d0d3 ("of/reconfig: Add of_reconfig_get_state_change() of notifier helper.") +Signed-off-by: Luca Ceresoli +Link: https://lore.kernel.org/r/20231123-fix-of_reconfig_get_state_change-docs-v1-1-f51892050ff9@bootlin.com +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/dynamic.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c +index f63250c650caf..3bf27052832f3 100644 +--- a/drivers/of/dynamic.c ++++ b/drivers/of/dynamic.c +@@ -98,8 +98,9 @@ int of_reconfig_notify(unsigned long action, struct of_reconfig_data *p) + * + * Returns the new state of a device based on the notifier used. + * +- * Return: 0 on device going from enabled to disabled, 1 on device +- * going from disabled to enabled and -1 on no change. ++ * Return: OF_RECONFIG_CHANGE_REMOVE on device going from enabled to ++ * disabled, OF_RECONFIG_CHANGE_ADD on device going from disabled to ++ * enabled and OF_RECONFIG_NO_CHANGE on no change. + */ + int of_reconfig_get_state_change(unsigned long action, struct of_reconfig_data *pr) + { +-- +2.42.0 + diff --git a/queue-6.6/platform-mellanox-add-null-pointer-checks-for-devm_k.patch b/queue-6.6/platform-mellanox-add-null-pointer-checks-for-devm_k.patch new file mode 100644 index 00000000000..023b0a6364e --- /dev/null +++ b/queue-6.6/platform-mellanox-add-null-pointer-checks-for-devm_k.patch @@ -0,0 +1,92 @@ +From 154bef6663a3f201a96d61ae4b88c6f267e09b16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 13:54:47 +0800 +Subject: platform/mellanox: Add null pointer checks for devm_kasprintf() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kunwu Chan + +[ Upstream commit 2c7c857f5fed997be93047d2de853d7f10c8defe ] + +devm_kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. + +Compile-tested only. + +Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") +Suggested-by: Ilpo Järvinen +Suggested-by: Vadim Pasternak +Signed-off-by: Kunwu Chan +Reviewed-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20231201055447.2356001-1-chentao@kylinos.cn +[ij: split the change into two] +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index 2d4bbe99959ef..925bfc4aef8ce 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1202,6 +1202,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) + attr->dev_attr.show = mlxbf_pmc_event_list_show; + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, "event_list"); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; + attr = NULL; + +@@ -1214,6 +1216,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, + "enable"); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; + attr = NULL; + } +@@ -1240,6 +1244,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, + "counter%d", j); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; + attr = NULL; + +@@ -1251,6 +1257,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, + "event%d", j); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; + attr = NULL; + } +@@ -1283,6 +1291,8 @@ static int mlxbf_pmc_init_perftype_reg(struct device *dev, int blk_num) + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, + events[j].evt_name); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; + attr = NULL; + i++; +@@ -1311,6 +1321,8 @@ static int mlxbf_pmc_create_groups(struct device *dev, int blk_num) + pmc->block[blk_num].block_attr_grp.attrs = pmc->block[blk_num].block_attr; + pmc->block[blk_num].block_attr_grp.name = devm_kasprintf( + dev, GFP_KERNEL, pmc->block_name[blk_num]); ++ if (!pmc->block[blk_num].block_attr_grp.name) ++ return -ENOMEM; + pmc->groups[blk_num] = &pmc->block[blk_num].block_attr_grp; + + return 0; +-- +2.42.0 + diff --git a/queue-6.6/platform-mellanox-check-devm_hwmon_device_register_w.patch b/queue-6.6/platform-mellanox-check-devm_hwmon_device_register_w.patch new file mode 100644 index 00000000000..71d5c298b56 --- /dev/null +++ b/queue-6.6/platform-mellanox-check-devm_hwmon_device_register_w.patch @@ -0,0 +1,48 @@ +From e3fad87600ac77c814d7305a82964a4dc9866b78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 13:54:47 +0800 +Subject: platform/mellanox: Check devm_hwmon_device_register_with_groups() + return value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kunwu Chan + +[ Upstream commit 3494a594315b56516988afb6854d75dee5b501db ] + +devm_hwmon_device_register_with_groups() returns an error pointer upon +failure. Check its return value for errors. + +Compile-tested only. + +Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") +Suggested-by: Ilpo Järvinen +Suggested-by: Vadim Pasternak +Signed-off-by: Kunwu Chan +Reviewed-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20231201055447.2356001-1-chentao@kylinos.cn +[ij: split the change into two] +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index 925bfc4aef8ce..db7a1d360cd2c 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1454,6 +1454,8 @@ static int mlxbf_pmc_probe(struct platform_device *pdev) + + pmc->hwmon_dev = devm_hwmon_device_register_with_groups( + dev, "bfperf", pmc, pmc->groups); ++ if (IS_ERR(pmc->hwmon_dev)) ++ return PTR_ERR(pmc->hwmon_dev); + platform_set_drvdata(pdev, pmc); + + return 0; +-- +2.42.0 + diff --git a/queue-6.6/platform-x86-asus-wmi-move-i8042-filter-install-to-s.patch b/queue-6.6/platform-x86-asus-wmi-move-i8042-filter-install-to-s.patch new file mode 100644 index 00000000000..ccbdd911dd4 --- /dev/null +++ b/queue-6.6/platform-x86-asus-wmi-move-i8042-filter-install-to-s.patch @@ -0,0 +1,111 @@ +From 89532c058306ab304dd70dc280290acb549c8c43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:42:33 +0100 +Subject: platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi + code +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit b52cbca22cbf6c9d2700c1e576d0ddcc670e49d5 ] + +asus-nb-wmi calls i8042_install_filter() in some cases, but it never +calls i8042_remove_filter(). This means that a dangling pointer to +the filter function is left after rmmod leading to crashes. + +Fix this by moving the i8042-filter installation to the shared +asus-wmi code and also remove it from the shared code on driver unbind. + +Fixes: b5643539b825 ("platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A") +Cc: Oleksij Rempel +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20231120154235.610808-2-hdegoede@redhat.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/Kconfig | 2 +- + drivers/platform/x86/asus-nb-wmi.c | 11 ----------- + drivers/platform/x86/asus-wmi.c | 8 ++++++++ + 3 files changed, 9 insertions(+), 12 deletions(-) + +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index 2a10705433911..07eea525091b0 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -263,6 +263,7 @@ config ASUS_WMI + depends on RFKILL || RFKILL = n + depends on HOTPLUG_PCI + depends on ACPI_VIDEO || ACPI_VIDEO = n ++ depends on SERIO_I8042 || SERIO_I8042 = n + select INPUT_SPARSEKMAP + select LEDS_CLASS + select NEW_LEDS +@@ -279,7 +280,6 @@ config ASUS_WMI + config ASUS_NB_WMI + tristate "Asus Notebook WMI Driver" + depends on ASUS_WMI +- depends on SERIO_I8042 || SERIO_I8042 = n + help + This is a driver for newer Asus notebooks. It adds extra features + like wireless radio and bluetooth control, leds, hotkeys, backlight... +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index df1db54d4e183..af3da303e2b15 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -501,8 +501,6 @@ static const struct dmi_system_id asus_quirks[] = { + + static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) + { +- int ret; +- + quirks = &quirk_asus_unknown; + dmi_check_system(asus_quirks); + +@@ -517,15 +515,6 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) + + if (tablet_mode_sw != -1) + quirks->tablet_switch_mode = tablet_mode_sw; +- +- if (quirks->i8042_filter) { +- ret = i8042_install_filter(quirks->i8042_filter); +- if (ret) { +- pr_warn("Unable to install key filter\n"); +- return; +- } +- pr_info("Using i8042 filter function for receiving events\n"); +- } + } + + static const struct key_entry asus_nb_wmi_keymap[] = { +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 19bfd30861aa8..9c6321c2fc3c5 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -4437,6 +4437,12 @@ static int asus_wmi_add(struct platform_device *pdev) + goto fail_wmi_handler; + } + ++ if (asus->driver->quirks->i8042_filter) { ++ err = i8042_install_filter(asus->driver->quirks->i8042_filter); ++ if (err) ++ pr_warn("Unable to install key filter - %d\n", err); ++ } ++ + asus_wmi_battery_init(asus); + + asus_wmi_debugfs_init(asus); +@@ -4471,6 +4477,8 @@ static int asus_wmi_remove(struct platform_device *device) + struct asus_wmi *asus; + + asus = platform_get_drvdata(device); ++ if (asus->driver->quirks->i8042_filter) ++ i8042_remove_filter(asus->driver->quirks->i8042_filter); + wmi_remove_notify_handler(asus->driver->event_guid); + asus_wmi_backlight_exit(asus); + asus_wmi_input_exit(asus); +-- +2.42.0 + diff --git a/queue-6.6/platform-x86-wmi-skip-blocks-with-zero-instances.patch b/queue-6.6/platform-x86-wmi-skip-blocks-with-zero-instances.patch new file mode 100644 index 00000000000..213f1f11fb7 --- /dev/null +++ b/queue-6.6/platform-x86-wmi-skip-blocks-with-zero-instances.patch @@ -0,0 +1,49 @@ +From 43745ce44e7f7d21edb04bdea32fc751cf3f7927 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 19:16:54 +0100 +Subject: platform/x86: wmi: Skip blocks with zero instances +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit cbf54f37600e874d82886aa3b2f471778cae01ce ] + +Some machines like the HP Omen 17 ck2000nf contain WMI blocks +with zero instances, so any WMI driver which tries to handle the +associated WMI device will fail. +Skip such WMI blocks to avoid confusing any WMI drivers. + +Reported-by: Alexis Belmonte +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218188 +Fixes: bff431e49ff5 ("ACPI: WMI: Add ACPI-WMI mapping driver") +Tested-by: Alexis Belmonte +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20231129181654.5800-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/wmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c +index 317c907304149..d75a0ae9cd0c5 100644 +--- a/drivers/platform/x86/wmi.c ++++ b/drivers/platform/x86/wmi.c +@@ -1285,6 +1285,11 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device) + if (debug_dump_wdg) + wmi_dump_wdg(&gblock[i]); + ++ if (!gblock[i].instance_count) { ++ dev_info(wmi_bus_dev, FW_INFO "%pUL has zero instances\n", &gblock[i].guid); ++ continue; ++ } ++ + if (guid_already_parsed_for_legacy(device, &gblock[i].guid)) + continue; + +-- +2.42.0 + diff --git a/queue-6.6/psample-require-cap_net_admin-when-joining-packets-g.patch b/queue-6.6/psample-require-cap_net_admin-when-joining-packets-g.patch new file mode 100644 index 00000000000..bed78b04d8d --- /dev/null +++ b/queue-6.6/psample-require-cap_net_admin-when-joining-packets-g.patch @@ -0,0 +1,117 @@ +From a74e4a36c1029e1f95b501caca8f2d05c67880af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 23:31:01 +0200 +Subject: psample: Require 'CAP_NET_ADMIN' when joining "packets" group + +From: Ido Schimmel + +[ Upstream commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 ] + +The "psample" generic netlink family notifies sampled packets over the +"packets" multicast group. This is problematic since by default generic +netlink allows non-root users to listen to these notifications. + +Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will +prevent non-root users or root without the 'CAP_NET_ADMIN' capability +(in the user namespace owning the network namespace) from joining the +group. + +Tested using [1]. + +Before: + + # capsh -- -c ./psample_repo + # capsh --drop=cap_net_admin -- -c ./psample_repo + +After: + + # capsh -- -c ./psample_repo + # capsh --drop=cap_net_admin -- -c ./psample_repo + Failed to join "packets" multicast group + +[1] + $ cat psample.c + #include + #include + #include + #include + + int join_grp(struct nl_sock *sk, const char *grp_name) + { + int grp, err; + + grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); + if (grp < 0) { + fprintf(stderr, "Failed to resolve \"%s\" multicast group\n", + grp_name); + return grp; + } + + err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); + if (err) { + fprintf(stderr, "Failed to join \"%s\" multicast group\n", + grp_name); + return err; + } + + return 0; + } + + int main(int argc, char **argv) + { + struct nl_sock *sk; + int err; + + sk = nl_socket_alloc(); + if (!sk) { + fprintf(stderr, "Failed to allocate socket\n"); + return -1; + } + + err = genl_connect(sk); + if (err) { + fprintf(stderr, "Failed to connect socket\n"); + return err; + } + + err = join_grp(sk, "config"); + if (err) + return err; + + err = join_grp(sk, "packets"); + if (err) + return err; + + return 0; + } + $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c + +Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") +Reported-by: "The UK's National Cyber Security Centre (NCSC)" +Signed-off-by: Ido Schimmel +Reviewed-by: Jacob Keller +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20231206213102.1824398-2-idosch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/psample/psample.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/psample/psample.c b/net/psample/psample.c +index 81a794e36f535..c34e902855dbe 100644 +--- a/net/psample/psample.c ++++ b/net/psample/psample.c +@@ -31,7 +31,8 @@ enum psample_nl_multicast_groups { + + static const struct genl_multicast_group psample_nl_mcgrps[] = { + [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME }, +- [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME }, ++ [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME, ++ .flags = GENL_UNS_ADMIN_PERM }, + }; + + static struct genl_family psample_nl_family __ro_after_init; +-- +2.42.0 + diff --git a/queue-6.6/r8152-add-rtl8152_inaccessible-checks-to-more-loops.patch b/queue-6.6/r8152-add-rtl8152_inaccessible-checks-to-more-loops.patch new file mode 100644 index 00000000000..565c55b4591 --- /dev/null +++ b/queue-6.6/r8152-add-rtl8152_inaccessible-checks-to-more-loops.patch @@ -0,0 +1,72 @@ +From 2cfec670fe02608f3d5686bfdb354bce7da54ca7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 13:25:21 -0800 +Subject: r8152: Add RTL8152_INACCESSIBLE checks to more loops + +From: Douglas Anderson + +[ Upstream commit 32a574c7e2685aa8138754d4d755f9246cc6bd48 ] + +Previous commits added checks for RTL8152_INACCESSIBLE in the loops in +the driver. There are still a few more that keep tripping the driver +up in error cases and make things take longer than they should. Add +those in. + +All the loops that are part of this commit existed in some form or +another since the r8152 driver was first introduced, though +RTL8152_INACCESSIBLE was known as RTL8152_UNPLUG before commit +715f67f33af4 ("r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE") + +Fixes: ac718b69301c ("net/usb: new driver for RTL8152") +Reviewed-by: Grant Grundler +Signed-off-by: Douglas Anderson +Acked-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 77408265e612a..bbb2824f285d8 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2967,6 +2967,8 @@ static void rtl8152_nic_reset(struct r8152 *tp) + ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CR, CR_RST); + + for (i = 0; i < 1000; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + if (!(ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CR) & CR_RST)) + break; + usleep_range(100, 400); +@@ -3296,6 +3298,8 @@ static void rtl_disable(struct r8152 *tp) + rxdy_gated_en(tp, true); + + for (i = 0; i < 1000; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL); + if ((ocp_data & FIFO_EMPTY) == FIFO_EMPTY) + break; +@@ -3303,6 +3307,8 @@ static void rtl_disable(struct r8152 *tp) + } + + for (i = 0; i < 1000; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_TCR0) & TCR0_TX_EMPTY) + break; + usleep_range(1000, 2000); +@@ -5466,6 +5472,8 @@ static void wait_oob_link_list_ready(struct r8152 *tp) + int i; + + for (i = 0; i < 1000; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL); + if (ocp_data & LINK_LIST_READY) + break; +-- +2.42.0 + diff --git a/queue-6.6/r8152-add-rtl8152_inaccessible-to-r8153_aldps_en.patch b/queue-6.6/r8152-add-rtl8152_inaccessible-to-r8153_aldps_en.patch new file mode 100644 index 00000000000..08706f16dd9 --- /dev/null +++ b/queue-6.6/r8152-add-rtl8152_inaccessible-to-r8153_aldps_en.patch @@ -0,0 +1,39 @@ +From be406bccb1eebb0941edd71d1284e89abdb5653b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 13:25:24 -0800 +Subject: r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en() + +From: Douglas Anderson + +[ Upstream commit 79321a793945fdbff2f405f84712d0ab81bed287 ] + +Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set +so that they don't delay too long if the device becomes +inaccessible. Add the break to the loop in r8153_aldps_en(). + +Fixes: 4214cc550bf9 ("r8152: check if disabling ALDPS is finished") +Reviewed-by: Grant Grundler +Signed-off-by: Douglas Anderson +Acked-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 4393ffd3b2949..7611c406fdb96 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5770,6 +5770,8 @@ static void r8153_aldps_en(struct r8152 *tp, bool enable) + data &= ~EN_ALDPS; + ocp_reg_write(tp, OCP_POWER_CFG, data); + for (i = 0; i < 20; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ return; + usleep_range(1000, 2000); + if (ocp_read_word(tp, MCU_TYPE_PLA, 0xe000) & 0x0100) + break; +-- +2.42.0 + diff --git a/queue-6.6/r8152-add-rtl8152_inaccessible-to-r8153_pre_firmware.patch b/queue-6.6/r8152-add-rtl8152_inaccessible-to-r8153_pre_firmware.patch new file mode 100644 index 00000000000..4b3c3c76718 --- /dev/null +++ b/queue-6.6/r8152-add-rtl8152_inaccessible-to-r8153_pre_firmware.patch @@ -0,0 +1,39 @@ +From 8187f94bb08fee4a374dbc60b6294556c5d15433 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 13:25:23 -0800 +Subject: r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1() + +From: Douglas Anderson + +[ Upstream commit 8c53a7bd706535a9cf4e2ec3a4e8d61d46353ca0 ] + +Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set +so that they don't delay too long if the device becomes +inaccessible. Add the break to the loop in r8153_pre_firmware_1(). + +Fixes: 9370f2d05a2a ("r8152: support request_firmware for RTL8153") +Reviewed-by: Grant Grundler +Signed-off-by: Douglas Anderson +Acked-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index ec43279a482fe..4393ffd3b2949 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5612,6 +5612,8 @@ static int r8153_pre_firmware_1(struct r8152 *tp) + for (i = 0; i < 104; i++) { + u32 ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_WDT1_CTRL); + ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ return -ENODEV; + if (!(ocp_data & WTD1_EN)) + break; + usleep_range(1000, 2000); +-- +2.42.0 + diff --git a/queue-6.6/r8152-add-rtl8152_inaccessible-to-r8156b_wait_loadin.patch b/queue-6.6/r8152-add-rtl8152_inaccessible-to-r8156b_wait_loadin.patch new file mode 100644 index 00000000000..d691e65429d --- /dev/null +++ b/queue-6.6/r8152-add-rtl8152_inaccessible-to-r8156b_wait_loadin.patch @@ -0,0 +1,40 @@ +From ebb9eca724ec7e95dc32005b859319dd2faefb85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 13:25:22 -0800 +Subject: r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash() + +From: Douglas Anderson + +[ Upstream commit 8a67b47fced9f6a84101eb9ec5ce4c7d64204bc7 ] + +Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set +so that they don't delay too long if the device becomes +inaccessible. Add the break to the loop in +r8156b_wait_loading_flash(). + +Fixes: 195aae321c82 ("r8152: support new chips") +Reviewed-by: Grant Grundler +Signed-off-by: Douglas Anderson +Acked-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index bbb2824f285d8..ec43279a482fe 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5488,6 +5488,8 @@ static void r8156b_wait_loading_flash(struct r8152 *tp) + int i; + + for (i = 0; i < 100; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + if (ocp_read_word(tp, MCU_TYPE_USB, USB_GPHY_CTRL) & GPHY_PATCH_DONE) + break; + usleep_range(1000, 2000); +-- +2.42.0 + diff --git a/queue-6.6/r8152-hold-the-rtnl_lock-for-all-of-reset.patch b/queue-6.6/r8152-hold-the-rtnl_lock-for-all-of-reset.patch new file mode 100644 index 00000000000..03232f91a65 --- /dev/null +++ b/queue-6.6/r8152-hold-the-rtnl_lock-for-all-of-reset.patch @@ -0,0 +1,98 @@ +From 518d5772caf005bdb58681a7cacc0020cc65c648 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 13:25:20 -0800 +Subject: r8152: Hold the rtnl_lock for all of reset + +From: Douglas Anderson + +[ Upstream commit e62adaeecdc6a1e8ae86e7f3f9f8223a3ede94f5 ] + +As of commit d9962b0d4202 ("r8152: Block future register access if +register access fails") there is a race condition that can happen +between the USB device reset thread and napi_enable() (not) getting +called during rtl8152_open(). Specifically: +* While rtl8152_open() is running we get a register access error + that's _not_ -ENODEV and queue up a USB reset. +* rtl8152_open() exits before calling napi_enable() due to any reason + (including usb_submit_urb() returning an error). + +In that case: +* Since the USB reset is perform in a separate thread asynchronously, + it can run at anytime USB device lock is not held - even before + rtl8152_open() has exited with an error and caused __dev_open() to + clear the __LINK_STATE_START bit. +* The rtl8152_pre_reset() will notice that the netif_running() returns + true (since __LINK_STATE_START wasn't cleared) so it won't exit + early. +* rtl8152_pre_reset() will then hang in napi_disable() because + napi_enable() was never called. + +We can fix the race by making sure that the r8152 reset routines don't +run at the same time as we're opening the device. Specifically we need +the reset routines in their entirety rely on the return value of +netif_running(). The only way to reliably depend on that is for them +to hold the rntl_lock() mutex for the duration of reset. + +Grabbing the rntl_lock() mutex for the duration of reset seems like a +long time, but reset is not expected to be common and the rtnl_lock() +mutex is already held for long durations since the core grabs it +around the open/close calls. + +Fixes: d9962b0d4202 ("r8152: Block future register access if register access fails") +Reviewed-by: Grant Grundler +Signed-off-by: Douglas Anderson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index be18d72cefcce..77408265e612a 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -8364,6 +8364,8 @@ static int rtl8152_pre_reset(struct usb_interface *intf) + struct r8152 *tp = usb_get_intfdata(intf); + struct net_device *netdev; + ++ rtnl_lock(); ++ + if (!tp || !test_bit(PROBED_WITH_NO_ERRORS, &tp->flags)) + return 0; + +@@ -8395,20 +8397,17 @@ static int rtl8152_post_reset(struct usb_interface *intf) + struct sockaddr sa; + + if (!tp || !test_bit(PROBED_WITH_NO_ERRORS, &tp->flags)) +- return 0; ++ goto exit; + + rtl_set_accessible(tp); + + /* reset the MAC address in case of policy change */ +- if (determine_ethernet_addr(tp, &sa) >= 0) { +- rtnl_lock(); ++ if (determine_ethernet_addr(tp, &sa) >= 0) + dev_set_mac_address (tp->netdev, &sa, NULL); +- rtnl_unlock(); +- } + + netdev = tp->netdev; + if (!netif_running(netdev)) +- return 0; ++ goto exit; + + set_bit(WORK_ENABLE, &tp->flags); + if (netif_carrier_ok(netdev)) { +@@ -8427,6 +8426,8 @@ static int rtl8152_post_reset(struct usb_interface *intf) + if (!list_empty(&tp->rx_done)) + napi_schedule(&tp->napi); + ++exit: ++ rtnl_unlock(); + return 0; + } + +-- +2.42.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 43f10aaab46..4680fc44fb2 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -20,3 +20,59 @@ x86-coco-disable-32-bit-emulation-by-default-on-tdx-and-sev.patch x86-entry-convert-int-0x80-emulation-to-idtentry.patch x86-entry-do-not-allow-external-0x80-interrupts.patch x86-tdx-allow-32-bit-emulation-by-default.patch +dt-dt-extract-compatibles-handle-cfile-arguments-in-.patch +dt-dt-extract-compatibles-don-t-follow-symlinks-when.patch +platform-x86-asus-wmi-move-i8042-filter-install-to-s.patch +of-dynamic-fix-of_reconfig_get_state_change-return-v.patch +platform-x86-wmi-skip-blocks-with-zero-instances.patch +ipv6-fix-potential-null-deref-in-fib6_add.patch +octeontx2-pf-add-missing-mutex-lock-in-otx2_get_paus.patch +octeontx2-af-check-return-value-of-nix_get_nixlf-bef.patch +bpf-fix-a-verifier-bug-due-to-incorrect-branch-offse.patch +hv_netvsc-rndis_filter-needs-to-select-nls.patch +r8152-hold-the-rtnl_lock-for-all-of-reset.patch +r8152-add-rtl8152_inaccessible-checks-to-more-loops.patch +r8152-add-rtl8152_inaccessible-to-r8156b_wait_loadin.patch +r8152-add-rtl8152_inaccessible-to-r8153_pre_firmware.patch +r8152-add-rtl8152_inaccessible-to-r8153_aldps_en.patch +mlxbf-bootctl-correctly-identify-secure-boot-with-de.patch +platform-mellanox-add-null-pointer-checks-for-devm_k.patch +platform-mellanox-check-devm_hwmon_device_register_w.patch +arcnet-restoring-support-for-multiple-sohard-arcnet-.patch +octeontx2-pf-consider-both-rx-and-tx-packet-stats-fo.patch +net-stmmac-fix-fpe-events-losing.patch +xsk-skip-polling-event-check-for-unbound-socket.patch +octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch +ice-restore-fix-disabling-rx-vlan-filtering.patch +i40e-fix-unexpected-mfs-warning-message.patch +iavf-validate-tx_coalesce_usecs-even-if-rx_coalesce_.patch +net-bnxt-fix-a-potential-use-after-free-in-bnxt_init.patch +tcp-fix-mid-stream-window-clamp.patch +ionic-fix-snprintf-format-length-warning.patch +ionic-fix-dim-work-handling-in-split-interrupt-mode.patch +ipv4-ip_gre-avoid-skb_pull-failure-in-ipgre_xmit.patch +net-atlantic-fix-null-dereference-of-skb-pointer-in.patch +net-hns-fix-wrong-head-when-modify-the-tx-feature-wh.patch +net-hns-fix-fake-link-up-on-xge-port.patch +octeontx2-af-adjust-tx-credits-when-mcs-external-byp.patch +octeontx2-af-fix-mcs-sa-cam-entries-size.patch +octeontx2-af-fix-mcs-stats-register-address.patch +octeontx2-af-add-missing-mcs-flr-handler-call.patch +octeontx2-af-update-tx-link-register-range.patch +dt-bindings-interrupt-controller-allow-power-domain-.patch +netfilter-bpf-fix-bad-registration-on-nf_defrag.patch +netfilter-nf_tables-fix-exist-matching-on-bigendian-.patch +netfilter-nf_tables-bail-out-on-mismatching-dynset-a.patch +netfilter-nf_tables-validate-family-when-identifying.patch +netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch +tcp-do-not-accept-ack-of-bytes-we-never-sent.patch +net-dsa-mv88e6xxx-restore-usxgmii-support-for-6393x.patch +net-tls-update-curr-on-splice-as-well.patch +bpf-sockmap-updating-the-sg-structure-should-also-up.patch +psample-require-cap_net_admin-when-joining-packets-g.patch +drop_monitor-require-cap_sys_admin-when-joining-even.patch +net-dsa-microchip-provide-a-list-of-valid-protocols-.patch +net-smc-fix-missing-byte-order-conversion-in-clc-han.patch +drm-amd-amdgpu-amdgpu_doorbell_mgr-correct-misdocume.patch +drm-amdkfd-get-doorbell-s-absolute-offset-based-on-t.patch +mm-damon-sysfs-eliminate-potential-uninitialized-var.patch diff --git a/queue-6.6/tcp-do-not-accept-ack-of-bytes-we-never-sent.patch b/queue-6.6/tcp-do-not-accept-ack-of-bytes-we-never-sent.patch new file mode 100644 index 00000000000..157c72e9173 --- /dev/null +++ b/queue-6.6/tcp-do-not-accept-ack-of-bytes-we-never-sent.patch @@ -0,0 +1,106 @@ +From cabf52194f0d70c6d7d66de419f2a808d69f3bc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 16:18:41 +0000 +Subject: tcp: do not accept ACK of bytes we never sent + +From: Eric Dumazet + +[ Upstream commit 3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 ] + +This patch is based on a detailed report and ideas from Yepeng Pan +and Christian Rossow. + +ACK seq validation is currently following RFC 5961 5.2 guidelines: + + The ACK value is considered acceptable only if + it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= + SND.NXT). All incoming segments whose ACK value doesn't satisfy the + above condition MUST be discarded and an ACK sent back. It needs to + be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a + duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK + acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an + ACK, drop the segment, and return". The "ignored" above implies that + the processing of the incoming data segment continues, which means + the ACK value is treated as acceptable. This mitigation makes the + ACK check more stringent since any ACK < SND.UNA wouldn't be + accepted, instead only ACKs that are in the range ((SND.UNA - + MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through. + +This can be refined for new (and possibly spoofed) flows, +by not accepting ACK for bytes that were never sent. + +This greatly improves TCP security at a little cost. + +I added a Fixes: tag to make sure this patch will reach stable trees, +even if the 'blamed' patch was adhering to the RFC. + +tp->bytes_acked was added in linux-4.2 + +Following packetdrill test (courtesy of Yepeng Pan) shows +the issue at hand: + +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 ++0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 ++0 bind(3, ..., ...) = 0 ++0 listen(3, 1024) = 0 + +// ---------------- Handshake ------------------- // + +// when window scale is set to 14 the window size can be extended to +// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet +// with ack number in (Server_ISN+1-1073725440. Server_ISN+1) +// ,though this ack number acknowledges some data never +// sent by the server. + ++0 < S 0:0(0) win 65535 ++0 > S. 0:0(0) ack 1 <...> ++0 < . 1:1(0) ack 1 win 65535 ++0 accept(3, ..., ...) = 4 + +// For the established connection, we send an ACK packet, +// the ack packet uses ack number 1 - 1073725300 + 2^32, +// where 2^32 is used to wrap around. +// Note: we used 1073725300 instead of 1073725440 to avoid possible +// edge cases. +// 1 - 1073725300 + 2^32 = 3221241997 + +// Oops, old kernels happily accept this packet. ++0 < . 1:1001(1000) ack 3221241997 win 65535 + +// After the kernel fix the following will be replaced by a challenge ACK, +// and prior malicious frame would be dropped. ++0 > . 1:1(0) ack 1001 + +Fixes: 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation") +Signed-off-by: Eric Dumazet +Reported-by: Yepeng Pan +Reported-by: Christian Rossow +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20231205161841.2702925-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 1f9d1d445fb3b..e6c4929549428 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3809,8 +3809,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + * then we can probably ignore it. + */ + if (before(ack, prior_snd_una)) { ++ u32 max_window; ++ ++ /* do not accept ACK for bytes we never sent. */ ++ max_window = min_t(u64, tp->max_window, tp->bytes_acked); + /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */ +- if (before(ack, prior_snd_una - tp->max_window)) { ++ if (before(ack, prior_snd_una - max_window)) { + if (!(flag & FLAG_NO_CHALLENGE_ACK)) + tcp_send_challenge_ack(sk); + return -SKB_DROP_REASON_TCP_TOO_OLD_ACK; +-- +2.42.0 + diff --git a/queue-6.6/tcp-fix-mid-stream-window-clamp.patch b/queue-6.6/tcp-fix-mid-stream-window-clamp.patch new file mode 100644 index 00000000000..adc5b91fe17 --- /dev/null +++ b/queue-6.6/tcp-fix-mid-stream-window-clamp.patch @@ -0,0 +1,104 @@ +From 1cb03b7863d2a2b2af35df8fc5b917e3a17a9089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 17:08:05 +0100 +Subject: tcp: fix mid stream window clamp. + +From: Paolo Abeni + +[ Upstream commit 58d3aade20cdddbac6c9707ac0f3f5f8c1278b74 ] + +After the blamed commit below, if the user-space application performs +window clamping when tp->rcv_wnd is 0, the TCP socket will never be +able to announce a non 0 receive window, even after completely emptying +the receive buffer and re-setting the window clamp to higher values. + +Refactor tcp_set_window_clamp() to address the issue: when the user +decreases the current clamp value, set rcv_ssthresh according to the +same logic used at buffer initialization, but ensuring reserved mem +provisioning. + +To avoid code duplication factor-out the relevant bits from +tcp_adjust_rcv_ssthresh() in a new helper and reuse it in the above +scenario. + +When increasing the clamp value, give the rcv_ssthresh a chance to grow +according to previously implemented heuristic. + +Fixes: 3aa7857fe1d7 ("tcp: enable mid stream window clamp") +Reported-by: David Gibson +Reported-by: Stefano Brivio +Signed-off-by: Paolo Abeni +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/705dad54e6e6e9a010e571bf58e0b35a8ae70503.1701706073.git.pabeni@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 9 +++++++-- + net/ipv4/tcp.c | 22 +++++++++++++++++++--- + 2 files changed, 26 insertions(+), 5 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 0239e815edf71..a88bf8f6db235 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1480,17 +1480,22 @@ static inline int tcp_full_space(const struct sock *sk) + return tcp_win_from_space(sk, READ_ONCE(sk->sk_rcvbuf)); + } + +-static inline void tcp_adjust_rcv_ssthresh(struct sock *sk) ++static inline void __tcp_adjust_rcv_ssthresh(struct sock *sk, u32 new_ssthresh) + { + int unused_mem = sk_unused_reserved_mem(sk); + struct tcp_sock *tp = tcp_sk(sk); + +- tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss); ++ tp->rcv_ssthresh = min(tp->rcv_ssthresh, new_ssthresh); + if (unused_mem) + tp->rcv_ssthresh = max_t(u32, tp->rcv_ssthresh, + tcp_win_from_space(sk, unused_mem)); + } + ++static inline void tcp_adjust_rcv_ssthresh(struct sock *sk) ++{ ++ __tcp_adjust_rcv_ssthresh(sk, 4U * tcp_sk(sk)->advmss); ++} ++ + void tcp_cleanup_rbuf(struct sock *sk, int copied); + void __tcp_cleanup_rbuf(struct sock *sk, int copied); + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 3d3a24f795734..ec46d74c20938 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3368,9 +3368,25 @@ int tcp_set_window_clamp(struct sock *sk, int val) + return -EINVAL; + tp->window_clamp = 0; + } else { +- tp->window_clamp = val < SOCK_MIN_RCVBUF / 2 ? +- SOCK_MIN_RCVBUF / 2 : val; +- tp->rcv_ssthresh = min(tp->rcv_wnd, tp->window_clamp); ++ u32 new_rcv_ssthresh, old_window_clamp = tp->window_clamp; ++ u32 new_window_clamp = val < SOCK_MIN_RCVBUF / 2 ? ++ SOCK_MIN_RCVBUF / 2 : val; ++ ++ if (new_window_clamp == old_window_clamp) ++ return 0; ++ ++ tp->window_clamp = new_window_clamp; ++ if (new_window_clamp < old_window_clamp) { ++ /* need to apply the reserved mem provisioning only ++ * when shrinking the window clamp ++ */ ++ __tcp_adjust_rcv_ssthresh(sk, tp->window_clamp); ++ ++ } else { ++ new_rcv_ssthresh = min(tp->rcv_wnd, tp->window_clamp); ++ tp->rcv_ssthresh = max(new_rcv_ssthresh, ++ tp->rcv_ssthresh); ++ } + } + return 0; + } +-- +2.42.0 + diff --git a/queue-6.6/xsk-skip-polling-event-check-for-unbound-socket.patch b/queue-6.6/xsk-skip-polling-event-check-for-unbound-socket.patch new file mode 100644 index 00000000000..c1069394ee8 --- /dev/null +++ b/queue-6.6/xsk-skip-polling-event-check-for-unbound-socket.patch @@ -0,0 +1,56 @@ +From a6ebd0951c7ebe00d3595adb79e1f4aa9c894d35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 15:10:52 +0900 +Subject: xsk: Skip polling event check for unbound socket + +From: Yewon Choi + +[ Upstream commit e4d008d49a7135214e0ee70537405b6a069e3a3f ] + +In xsk_poll(), checking available events and setting mask bits should +be executed only when a socket has been bound. Setting mask bits for +unbound socket is meaningless. + +Currently, it checks events even when xsk_check_common() failed. +To prevent this, we move goto location (skip_tx) after that checking. + +Fixes: 1596dae2f17e ("xsk: check IFF_UP earlier in Tx path") +Signed-off-by: Yewon Choi +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Link: https://lore.kernel.org/bpf/20231201061048.GA1510@libra05 +Signed-off-by: Sasha Levin +--- + net/xdp/xsk.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 55f8b9b0e06d1..3515e19852d88 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -919,7 +919,7 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock, + + rcu_read_lock(); + if (xsk_check_common(xs)) +- goto skip_tx; ++ goto out; + + pool = xs->pool; + +@@ -931,12 +931,11 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock, + xsk_generic_xmit(sk); + } + +-skip_tx: + if (xs->rx && !xskq_prod_is_empty(xs->rx)) + mask |= EPOLLIN | EPOLLRDNORM; + if (xs->tx && xsk_tx_writeable(xs)) + mask |= EPOLLOUT | EPOLLWRNORM; +- ++out: + rcu_read_unlock(); + return mask; + } +-- +2.42.0 +