From 743992cd65da33215b9fa1b7dddd6825d719ecf4 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 8 Dec 2023 21:36:58 -0500 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...-support-for-multiple-sohard-arcnet-.patch | 216 +++++++++ ...ting-the-sg-structure-should-also-up.patch | 74 +++ ...uire-cap_sys_admin-when-joining-even.patch | 164 +++++++ ...vsc-rndis_filter-needs-to-select-nls.patch | 44 ++ ...e-fix-unexpected-mfs-warning-message.patch | 58 +++ ...ork-handling-in-split-interrupt-mode.patch | 67 +++ ...c-fix-snprintf-format-length-warning.patch | 45 ++ ...avoid-skb_pull-failure-in-ipgre_xmit.patch | 58 +++ ...fix-potential-null-deref-in-fib6_add.patch | 79 +++ queue-5.15/kbuild-move-to-std-gnu11.patch | 158 ++++++ ...ild-use-wdeclaration-after-statement.patch | 91 ++++ ...rrectly-identify-secure-boot-with-de.patch | 120 +++++ ...kdoc-for-struct-genl_multicast_group.patch | 56 +++ ...otential-use-after-free-in-bnxt_init.patch | 43 ++ ...net-hns-fix-fake-link-up-on-xge-port.patch | 74 +++ .../net-stmmac-fix-fpe-events-losing.patch | 243 ++++++++++ ...les-bail-out-on-mismatching-dynset-a.patch | 48 ++ ...les-validate-family-when-identifying.patch | 53 ++ ...er-fix-for-unsafe-access-of-sk-sk_so.patch | 71 +++ ...ck-return-value-of-nix_get_nixlf-bef.patch | 45 ++ ...-a-use-after-free-in-rvu_npa_registe.patch | 61 +++ ...tx2-af-update-tx-link-register-range.patch | 41 ++ ...-missing-mutex-lock-in-otx2_get_paus.patch | 51 ++ ...f_reconfig_get_state_change-return-v.patch | 41 ++ ...x-add-null-pointer-checks-for-devm_k.patch | 92 ++++ ...x-check-devm_hwmon_device_register_w.patch | 48 ++ ...s-wmi-add-support-for-rog-x13-tablet.patch | 175 +++++++ ...s-wmi-adjust-tablet-lidflip-handling.patch | 220 +++++++++ ...s-wmi-move-i8042-filter-install-to-s.patch | 111 +++++ ...s-wmi-simplify-tablet-mode-switch-ha.patch | 192 ++++++++ ...s-wmi-simplify-tablet-mode-switch-pr.patch | 107 ++++ ...-allow-duplicate-guids-for-drivers-t.patch | 136 ++++++ ...-wmi-skip-blocks-with-zero-instances.patch | 49 ++ ...cap_net_admin-when-joining-packets-g.patch | 117 +++++ ...52_inaccessible-checks-to-more-loops.patch | 72 +++ ...l8152_inaccessible-to-r8153_aldps_en.patch | 39 ++ ...2_inaccessible-to-r8153_pre_firmware.patch | 39 ++ ...2_inaccessible-to-r8156b_wait_loadin.patch | 40 ++ ...l8152_unplug-to-rtl8152_inaccessible.patch | 458 ++++++++++++++++++ queue-5.15/series | 40 ++ ...ot-accept-ack-of-bytes-we-never-sent.patch | 106 ++++ 41 files changed, 4042 insertions(+) create mode 100644 queue-5.15/arcnet-restoring-support-for-multiple-sohard-arcnet-.patch create mode 100644 queue-5.15/bpf-sockmap-updating-the-sg-structure-should-also-up.patch create mode 100644 queue-5.15/drop_monitor-require-cap_sys_admin-when-joining-even.patch create mode 100644 queue-5.15/hv_netvsc-rndis_filter-needs-to-select-nls.patch create mode 100644 queue-5.15/i40e-fix-unexpected-mfs-warning-message.patch create mode 100644 queue-5.15/ionic-fix-dim-work-handling-in-split-interrupt-mode.patch create mode 100644 queue-5.15/ionic-fix-snprintf-format-length-warning.patch create mode 100644 queue-5.15/ipv4-ip_gre-avoid-skb_pull-failure-in-ipgre_xmit.patch create mode 100644 queue-5.15/ipv6-fix-potential-null-deref-in-fib6_add.patch create mode 100644 queue-5.15/kbuild-move-to-std-gnu11.patch create mode 100644 queue-5.15/kbuild-use-wdeclaration-after-statement.patch create mode 100644 queue-5.15/mlxbf-bootctl-correctly-identify-secure-boot-with-de.patch create mode 100644 queue-5.15/net-add-missing-kdoc-for-struct-genl_multicast_group.patch create mode 100644 queue-5.15/net-bnxt-fix-a-potential-use-after-free-in-bnxt_init.patch create mode 100644 queue-5.15/net-hns-fix-fake-link-up-on-xge-port.patch create mode 100644 queue-5.15/net-stmmac-fix-fpe-events-losing.patch create mode 100644 queue-5.15/netfilter-nf_tables-bail-out-on-mismatching-dynset-a.patch create mode 100644 queue-5.15/netfilter-nf_tables-validate-family-when-identifying.patch create mode 100644 queue-5.15/netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch create mode 100644 queue-5.15/octeontx2-af-check-return-value-of-nix_get_nixlf-bef.patch create mode 100644 queue-5.15/octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch create mode 100644 queue-5.15/octeontx2-af-update-tx-link-register-range.patch create mode 100644 queue-5.15/octeontx2-pf-add-missing-mutex-lock-in-otx2_get_paus.patch create mode 100644 queue-5.15/of-dynamic-fix-of_reconfig_get_state_change-return-v.patch create mode 100644 queue-5.15/platform-mellanox-add-null-pointer-checks-for-devm_k.patch create mode 100644 queue-5.15/platform-mellanox-check-devm_hwmon_device_register_w.patch create mode 100644 queue-5.15/platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch create mode 100644 queue-5.15/platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch create mode 100644 queue-5.15/platform-x86-asus-wmi-move-i8042-filter-install-to-s.patch create mode 100644 queue-5.15/platform-x86-asus-wmi-simplify-tablet-mode-switch-ha.patch create mode 100644 queue-5.15/platform-x86-asus-wmi-simplify-tablet-mode-switch-pr.patch create mode 100644 queue-5.15/platform-x86-wmi-allow-duplicate-guids-for-drivers-t.patch create mode 100644 queue-5.15/platform-x86-wmi-skip-blocks-with-zero-instances.patch create mode 100644 queue-5.15/psample-require-cap_net_admin-when-joining-packets-g.patch create mode 100644 queue-5.15/r8152-add-rtl8152_inaccessible-checks-to-more-loops.patch create mode 100644 queue-5.15/r8152-add-rtl8152_inaccessible-to-r8153_aldps_en.patch create mode 100644 queue-5.15/r8152-add-rtl8152_inaccessible-to-r8153_pre_firmware.patch create mode 100644 queue-5.15/r8152-add-rtl8152_inaccessible-to-r8156b_wait_loadin.patch create mode 100644 queue-5.15/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch create mode 100644 queue-5.15/tcp-do-not-accept-ack-of-bytes-we-never-sent.patch diff --git a/queue-5.15/arcnet-restoring-support-for-multiple-sohard-arcnet-.patch b/queue-5.15/arcnet-restoring-support-for-multiple-sohard-arcnet-.patch new file mode 100644 index 00000000000..9d40010989d --- /dev/null +++ b/queue-5.15/arcnet-restoring-support-for-multiple-sohard-arcnet-.patch @@ -0,0 +1,216 @@ +From 3bbab180891d568f8d4cc4a14b5a360edfcbe71a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 12:35:03 +0100 +Subject: arcnet: restoring support for multiple Sohard Arcnet cards + +From: Thomas Reichinger + +[ Upstream commit 6b17a597fc2f13aaaa0a2780eb7edb9ae7ac9aea ] + +Probe of Sohard Arcnet cards fails, +if 2 or more cards are installed in a system. +See kernel log: +[ 2.759203] arcnet: arcnet loaded +[ 2.763648] arcnet:com20020: COM20020 chipset support (by David Woodhouse et al.) +[ 2.770585] arcnet:com20020_pci: COM20020 PCI support +[ 2.772295] com20020 0000:02:00.0: enabling device (0000 -> 0003) +[ 2.772354] (unnamed net_device) (uninitialized): PLX-PCI Controls +... +[ 3.071301] com20020 0000:02:00.0 arc0-0 (uninitialized): PCI COM20020: station FFh found at F080h, IRQ 101. +[ 3.071305] com20020 0000:02:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s +[ 3.071534] com20020 0000:07:00.0: enabling device (0000 -> 0003) +[ 3.071581] (unnamed net_device) (uninitialized): PLX-PCI Controls +... +[ 3.369501] com20020 0000:07:00.0: Led pci:green:tx:0-0 renamed to pci:green:tx:0-0_1 due to name collision +[ 3.369535] com20020 0000:07:00.0: Led pci:red:recon:0-0 renamed to pci:red:recon:0-0_1 due to name collision +[ 3.370586] com20020 0000:07:00.0 arc0-0 (uninitialized): PCI COM20020: station E1h found at C000h, IRQ 35. +[ 3.370589] com20020 0000:07:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s +[ 3.370608] com20020: probe of 0000:07:00.0 failed with error -5 + +commit 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support") +changes the device name of all COM20020 based PCI cards, +even if only some cards support this: + snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i); + +The error happens because all Sohard Arcnet cards would be called arc0-0, +since the Sohard Arcnet cards don't have a PLX rotary coder. +I.e. EAE Arcnet cards have a PLX rotary coder, +which sets the first decimal, ensuring unique devices names. + +This patch adds two new card feature flags to indicate +which cards support LEDs and the PLX rotary coder. +For EAE based cards the names still depend on the PLX rotary coder +(untested, since missing EAE hardware). +For Sohard based cards, this patch will result in devices +being called arc0, arc1, ... (tested). + +Signed-off-by: Thomas Reichinger +Fixes: 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support") +Link: https://lore.kernel.org/r/20231130113503.6812-1-thomas.reichinger@sohard.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/arcnet/arcdevice.h | 2 + + drivers/net/arcnet/com20020-pci.c | 89 ++++++++++++++++--------------- + 2 files changed, 48 insertions(+), 43 deletions(-) + +diff --git a/drivers/net/arcnet/arcdevice.h b/drivers/net/arcnet/arcdevice.h +index 5d4a4c7efbbff..deeabd6ec2e81 100644 +--- a/drivers/net/arcnet/arcdevice.h ++++ b/drivers/net/arcnet/arcdevice.h +@@ -186,6 +186,8 @@ do { \ + #define ARC_IS_5MBIT 1 /* card default speed is 5MBit */ + #define ARC_CAN_10MBIT 2 /* card uses COM20022, supporting 10MBit, + but default is 2.5MBit. */ ++#define ARC_HAS_LED 4 /* card has software controlled LEDs */ ++#define ARC_HAS_ROTARY 8 /* card has rotary encoder */ + + /* information needed to define an encapsulation driver */ + struct ArcProto { +diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c +index 28dccbc0e8d8f..9d9e4200064f9 100644 +--- a/drivers/net/arcnet/com20020-pci.c ++++ b/drivers/net/arcnet/com20020-pci.c +@@ -213,12 +213,13 @@ static int com20020pci_probe(struct pci_dev *pdev, + if (!strncmp(ci->name, "EAE PLX-PCI FB2", 15)) + lp->backplane = 1; + +- /* Get the dev_id from the PLX rotary coder */ +- if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15)) +- dev_id_mask = 0x3; +- dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask; +- +- snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i); ++ if (ci->flags & ARC_HAS_ROTARY) { ++ /* Get the dev_id from the PLX rotary coder */ ++ if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15)) ++ dev_id_mask = 0x3; ++ dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask; ++ snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i); ++ } + + if (arcnet_inb(ioaddr, COM20020_REG_R_STATUS) == 0xFF) { + pr_err("IO address %Xh is empty!\n", ioaddr); +@@ -230,6 +231,10 @@ static int com20020pci_probe(struct pci_dev *pdev, + goto err_free_arcdev; + } + ++ ret = com20020_found(dev, IRQF_SHARED); ++ if (ret) ++ goto err_free_arcdev; ++ + card = devm_kzalloc(&pdev->dev, sizeof(struct com20020_dev), + GFP_KERNEL); + if (!card) { +@@ -239,41 +244,39 @@ static int com20020pci_probe(struct pci_dev *pdev, + + card->index = i; + card->pci_priv = priv; +- card->tx_led.brightness_set = led_tx_set; +- card->tx_led.default_trigger = devm_kasprintf(&pdev->dev, +- GFP_KERNEL, "arc%d-%d-tx", +- dev->dev_id, i); +- card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, +- "pci:green:tx:%d-%d", +- dev->dev_id, i); +- +- card->tx_led.dev = &dev->dev; +- card->recon_led.brightness_set = led_recon_set; +- card->recon_led.default_trigger = devm_kasprintf(&pdev->dev, +- GFP_KERNEL, "arc%d-%d-recon", +- dev->dev_id, i); +- card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, +- "pci:red:recon:%d-%d", +- dev->dev_id, i); +- card->recon_led.dev = &dev->dev; +- card->dev = dev; +- +- ret = devm_led_classdev_register(&pdev->dev, &card->tx_led); +- if (ret) +- goto err_free_arcdev; + +- ret = devm_led_classdev_register(&pdev->dev, &card->recon_led); +- if (ret) +- goto err_free_arcdev; +- +- dev_set_drvdata(&dev->dev, card); +- +- ret = com20020_found(dev, IRQF_SHARED); +- if (ret) +- goto err_free_arcdev; +- +- devm_arcnet_led_init(dev, dev->dev_id, i); ++ if (ci->flags & ARC_HAS_LED) { ++ card->tx_led.brightness_set = led_tx_set; ++ card->tx_led.default_trigger = devm_kasprintf(&pdev->dev, ++ GFP_KERNEL, "arc%d-%d-tx", ++ dev->dev_id, i); ++ card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, ++ "pci:green:tx:%d-%d", ++ dev->dev_id, i); ++ ++ card->tx_led.dev = &dev->dev; ++ card->recon_led.brightness_set = led_recon_set; ++ card->recon_led.default_trigger = devm_kasprintf(&pdev->dev, ++ GFP_KERNEL, "arc%d-%d-recon", ++ dev->dev_id, i); ++ card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, ++ "pci:red:recon:%d-%d", ++ dev->dev_id, i); ++ card->recon_led.dev = &dev->dev; ++ ++ ret = devm_led_classdev_register(&pdev->dev, &card->tx_led); ++ if (ret) ++ goto err_free_arcdev; ++ ++ ret = devm_led_classdev_register(&pdev->dev, &card->recon_led); ++ if (ret) ++ goto err_free_arcdev; ++ ++ dev_set_drvdata(&dev->dev, card); ++ devm_arcnet_led_init(dev, dev->dev_id, i); ++ } + ++ card->dev = dev; + list_add(&card->list, &priv->list_dev); + continue; + +@@ -329,7 +332,7 @@ static struct com20020_pci_card_info card_info_5mbit = { + }; + + static struct com20020_pci_card_info card_info_sohard = { +- .name = "PLX-PCI", ++ .name = "SOHARD SH ARC-PCI", + .devcount = 1, + /* SOHARD needs PCI base addr 4 */ + .chan_map_tbl = { +@@ -364,7 +367,7 @@ static struct com20020_pci_card_info card_info_eae_arc1 = { + }, + }, + .rotary = 0x0, +- .flags = ARC_CAN_10MBIT, ++ .flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT, + }; + + static struct com20020_pci_card_info card_info_eae_ma1 = { +@@ -396,7 +399,7 @@ static struct com20020_pci_card_info card_info_eae_ma1 = { + }, + }, + .rotary = 0x0, +- .flags = ARC_CAN_10MBIT, ++ .flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT, + }; + + static struct com20020_pci_card_info card_info_eae_fb2 = { +@@ -421,7 +424,7 @@ static struct com20020_pci_card_info card_info_eae_fb2 = { + }, + }, + .rotary = 0x0, +- .flags = ARC_CAN_10MBIT, ++ .flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT, + }; + + static const struct pci_device_id com20020pci_id_table[] = { +-- +2.42.0 + diff --git a/queue-5.15/bpf-sockmap-updating-the-sg-structure-should-also-up.patch b/queue-5.15/bpf-sockmap-updating-the-sg-structure-should-also-up.patch new file mode 100644 index 00000000000..c27b50abf39 --- /dev/null +++ b/queue-5.15/bpf-sockmap-updating-the-sg-structure-should-also-up.patch @@ -0,0 +1,74 @@ +From 763c34f949cffa1b229d9e403a70c2636e1e0c81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:27:06 -0800 +Subject: bpf: sockmap, updating the sg structure should also update curr + +From: John Fastabend + +[ Upstream commit bb9aefde5bbaf6c168c77ba635c155b4980c2287 ] + +Curr pointer should be updated when the sg structure is shifted. + +Fixes: 7246d8ed4dcce ("bpf: helper to pop data from messages") +Signed-off-by: John Fastabend +Link: https://lore.kernel.org/r/20231206232706.374377-3-john.fastabend@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 76432aa3b717c..0f5faa876fd12 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2576,6 +2576,22 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes) + return 0; + } + ++static void sk_msg_reset_curr(struct sk_msg *msg) ++{ ++ u32 i = msg->sg.start; ++ u32 len = 0; ++ ++ do { ++ len += sk_msg_elem(msg, i)->length; ++ sk_msg_iter_var_next(i); ++ if (len >= msg->sg.size) ++ break; ++ } while (i != msg->sg.end); ++ ++ msg->sg.curr = i; ++ msg->sg.copybreak = 0; ++} ++ + static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { + .func = bpf_msg_cork_bytes, + .gpl_only = false, +@@ -2695,6 +2711,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_msg *, msg, u32, start, + msg->sg.end - shift + NR_MSG_FRAG_IDS : + msg->sg.end - shift; + out: ++ sk_msg_reset_curr(msg); + msg->data = sg_virt(&msg->sg.data[first_sge]) + start - offset; + msg->data_end = msg->data + bytes; + return 0; +@@ -2831,6 +2848,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, + msg->sg.data[new] = rsge; + } + ++ sk_msg_reset_curr(msg); + sk_msg_compute_data_pointers(msg); + return 0; + } +@@ -2999,6 +3017,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, + + sk_mem_uncharge(msg->sk, len - pop); + msg->sg.size -= (len - pop); ++ sk_msg_reset_curr(msg); + sk_msg_compute_data_pointers(msg); + return 0; + } +-- +2.42.0 + diff --git a/queue-5.15/drop_monitor-require-cap_sys_admin-when-joining-even.patch b/queue-5.15/drop_monitor-require-cap_sys_admin-when-joining-even.patch new file mode 100644 index 00000000000..009c4fd267c --- /dev/null +++ b/queue-5.15/drop_monitor-require-cap_sys_admin-when-joining-even.patch @@ -0,0 +1,164 @@ +From aae9bd96813606c88e53326d11f71043bf294fcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 23:31:02 +0200 +Subject: drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group + +From: Ido Schimmel + +[ Upstream commit e03781879a0d524ce3126678d50a80484a513c4b ] + +The "NET_DM" generic netlink family notifies drop locations over the +"events" multicast group. This is problematic since by default generic +netlink allows non-root users to listen to these notifications. + +Fix by adding a new field to the generic netlink multicast group +structure that when set prevents non-root users or root without the +'CAP_SYS_ADMIN' capability (in the user namespace owning the network +namespace) from joining the group. Set this field for the "events" +group. Use 'CAP_SYS_ADMIN' rather than 'CAP_NET_ADMIN' because of the +nature of the information that is shared over this group. + +Note that the capability check in this case will always be performed +against the initial user namespace since the family is not netns aware +and only operates in the initial network namespace. + +A new field is added to the structure rather than using the "flags" +field because the existing field uses uAPI flags and it is inappropriate +to add a new uAPI flag for an internal kernel check. In net-next we can +rework the "flags" field to use internal flags and fold the new field +into it. But for now, in order to reduce the amount of changes, add a +new field. + +Since the information can only be consumed by root, mark the control +plane operations that start and stop the tracing as root-only using the +'GENL_ADMIN_PERM' flag. + +Tested using [1]. + +Before: + + # capsh -- -c ./dm_repo + # capsh --drop=cap_sys_admin -- -c ./dm_repo + +After: + + # capsh -- -c ./dm_repo + # capsh --drop=cap_sys_admin -- -c ./dm_repo + Failed to join "events" multicast group + +[1] + $ cat dm.c + #include + #include + #include + #include + + int main(int argc, char **argv) + { + struct nl_sock *sk; + int grp, err; + + sk = nl_socket_alloc(); + if (!sk) { + fprintf(stderr, "Failed to allocate socket\n"); + return -1; + } + + err = genl_connect(sk); + if (err) { + fprintf(stderr, "Failed to connect socket\n"); + return err; + } + + grp = genl_ctrl_resolve_grp(sk, "NET_DM", "events"); + if (grp < 0) { + fprintf(stderr, + "Failed to resolve \"events\" multicast group\n"); + return grp; + } + + err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); + if (err) { + fprintf(stderr, "Failed to join \"events\" multicast group\n"); + return err; + } + + return 0; + } + $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o dm_repo dm.c + +Fixes: 9a8afc8d3962 ("Network Drop Monitor: Adding drop monitor implementation & Netlink protocol") +Reported-by: "The UK's National Cyber Security Centre (NCSC)" +Signed-off-by: Ido Schimmel +Reviewed-by: Jacob Keller +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20231206213102.1824398-3-idosch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/genetlink.h | 2 ++ + net/core/drop_monitor.c | 4 +++- + net/netlink/genetlink.c | 3 +++ + 3 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/include/net/genetlink.h b/include/net/genetlink.h +index 56a50e1c51b97..8043594a7f84a 100644 +--- a/include/net/genetlink.h ++++ b/include/net/genetlink.h +@@ -12,10 +12,12 @@ + * struct genl_multicast_group - generic netlink multicast group + * @name: name of the multicast group, names are per-family + * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM) ++ * @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding + */ + struct genl_multicast_group { + char name[GENL_NAMSIZ]; + u8 flags; ++ u8 cap_sys_admin:1; + }; + + struct genl_ops; +diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c +index 22015ebc1dd56..937d74aeef547 100644 +--- a/net/core/drop_monitor.c ++++ b/net/core/drop_monitor.c +@@ -184,7 +184,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data) + } + + static const struct genl_multicast_group dropmon_mcgrps[] = { +- { .name = "events", }, ++ { .name = "events", .cap_sys_admin = 1 }, + }; + + static void send_dm_alert(struct work_struct *work) +@@ -1618,11 +1618,13 @@ static const struct genl_small_ops dropmon_ops[] = { + .cmd = NET_DM_CMD_START, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .doit = net_dm_cmd_trace, ++ .flags = GENL_ADMIN_PERM, + }, + { + .cmd = NET_DM_CMD_STOP, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .doit = net_dm_cmd_trace, ++ .flags = GENL_ADMIN_PERM, + }, + { + .cmd = NET_DM_CMD_CONFIG_GET, +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index 57010927e20a8..69b3a6b82f680 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -1379,6 +1379,9 @@ static int genl_bind(struct net *net, int group) + if ((grp->flags & GENL_UNS_ADMIN_PERM) && + !ns_capable(net->user_ns, CAP_NET_ADMIN)) + ret = -EPERM; ++ if (grp->cap_sys_admin && ++ !ns_capable(net->user_ns, CAP_SYS_ADMIN)) ++ ret = -EPERM; + + break; + } +-- +2.42.0 + diff --git a/queue-5.15/hv_netvsc-rndis_filter-needs-to-select-nls.patch b/queue-5.15/hv_netvsc-rndis_filter-needs-to-select-nls.patch new file mode 100644 index 00000000000..e3dce68eeeb --- /dev/null +++ b/queue-5.15/hv_netvsc-rndis_filter-needs-to-select-nls.patch @@ -0,0 +1,44 @@ +From c60c277614ceab0fdb4566f245640dd8afb2fc03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 21:58:53 -0800 +Subject: hv_netvsc: rndis_filter needs to select NLS + +From: Randy Dunlap + +[ Upstream commit 6c89f49964375c904cea33c0247467873f4daf2c ] + +rndis_filter uses utf8s_to_utf16s() which is provided by setting +NLS, so select NLS to fix the build error: + +ERROR: modpost: "utf8s_to_utf16s" [drivers/net/hyperv/hv_netvsc.ko] undefined! + +Fixes: 1ce09e899d28 ("hyperv: Add support for setting MAC from within guests") +Signed-off-by: Randy Dunlap +Cc: Haiyang Zhang +Cc: K. Y. Srinivasan +Cc: Wei Liu +Cc: Dexuan Cui +Reviewed-by: Simon Horman +Tested-by: Simon Horman # build-tested +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20231130055853.19069-1-rdunlap@infradead.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/hyperv/Kconfig b/drivers/net/hyperv/Kconfig +index ca7bf7f897d36..c8cbd85adcf99 100644 +--- a/drivers/net/hyperv/Kconfig ++++ b/drivers/net/hyperv/Kconfig +@@ -3,5 +3,6 @@ config HYPERV_NET + tristate "Microsoft Hyper-V virtual network driver" + depends on HYPERV + select UCS2_STRING ++ select NLS + help + Select this option to enable the Hyper-V virtual network driver. +-- +2.42.0 + diff --git a/queue-5.15/i40e-fix-unexpected-mfs-warning-message.patch b/queue-5.15/i40e-fix-unexpected-mfs-warning-message.patch new file mode 100644 index 00000000000..5fa49d19eaa --- /dev/null +++ b/queue-5.15/i40e-fix-unexpected-mfs-warning-message.patch @@ -0,0 +1,58 @@ +From 9fbde881f7a30b935270c6855b26f3b100e241b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Nov 2023 09:12:09 +0100 +Subject: i40e: Fix unexpected MFS warning message + +From: Ivan Vecera + +[ Upstream commit 7d9f22b3d3ef379ed05bd3f3e2de83dfa8da8258 ] + +Commit 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") added +a warning message that reports unexpected size of port's MFS (max +frame size) value. This message use for the port number local +variable 'i' that is wrong. +In i40e_probe() this 'i' variable is used only to iterate VSIs +to find FDIR VSI: + + +... +/* if FDIR VSI was set up, start it now */ + for (i = 0; i < pf->num_alloc_vsi; i++) { + if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) { + i40e_vsi_open(pf->vsi[i]); + break; + } + } +... + + +So the warning message use for the port number index of FDIR VSI +if this exists or pf->num_alloc_vsi if not. + +Fix the message by using 'pf->hw.port' for the port number. + +Fixes: 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") +Signed-off-by: Ivan Vecera +Reviewed-by: Simon Horman +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 20e26aa5b81c8..cf085bd8d790f 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -16132,7 +16132,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + I40E_PRTGL_SAH_MFS_MASK) >> I40E_PRTGL_SAH_MFS_SHIFT; + if (val < MAX_FRAME_SIZE_DEFAULT) + dev_warn(&pdev->dev, "MFS for port %x has been set below the default: %x\n", +- i, val); ++ pf->hw.port, val); + + /* Add a filter to drop all Flow control frames from any VSI from being + * transmitted. By doing so we stop a malicious VF from sending out +-- +2.42.0 + diff --git a/queue-5.15/ionic-fix-dim-work-handling-in-split-interrupt-mode.patch b/queue-5.15/ionic-fix-dim-work-handling-in-split-interrupt-mode.patch new file mode 100644 index 00000000000..e99256b7e90 --- /dev/null +++ b/queue-5.15/ionic-fix-dim-work-handling-in-split-interrupt-mode.patch @@ -0,0 +1,67 @@ +From e956c5f160cc5799903f2332c8482451a46a3a90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 11:22:34 -0800 +Subject: ionic: Fix dim work handling in split interrupt mode + +From: Brett Creeley + +[ Upstream commit 4115ba677c35f694b62298e55f0e04ce84eed469 ] + +Currently ionic_dim_work() is incorrect when in +split interrupt mode. This is because the interrupt +rate is only being changed for the Rx side even for +dim running on Tx. Fix this by using the qcq from +the container_of macro. Also, introduce some local +variables for a bit of cleanup. + +Fixes: a6ff85e0a2d9 ("ionic: remove intr coalesce update from napi") +Signed-off-by: Brett Creeley +Signed-off-by: Shannon Nelson +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20231204192234.21017-3-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 2cc126d378353..63181866809fd 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -44,24 +44,24 @@ static void ionic_lif_queue_identify(struct ionic_lif *lif); + static void ionic_dim_work(struct work_struct *work) + { + struct dim *dim = container_of(work, struct dim, work); ++ struct ionic_intr_info *intr; + struct dim_cq_moder cur_moder; + struct ionic_qcq *qcq; ++ struct ionic_lif *lif; + u32 new_coal; + + cur_moder = net_dim_get_rx_moderation(dim->mode, dim->profile_ix); + qcq = container_of(dim, struct ionic_qcq, dim); +- new_coal = ionic_coal_usec_to_hw(qcq->q.lif->ionic, cur_moder.usec); ++ lif = qcq->q.lif; ++ new_coal = ionic_coal_usec_to_hw(lif->ionic, cur_moder.usec); + new_coal = new_coal ? new_coal : 1; + +- if (qcq->intr.dim_coal_hw != new_coal) { +- unsigned int qi = qcq->cq.bound_q->index; +- struct ionic_lif *lif = qcq->q.lif; +- +- qcq->intr.dim_coal_hw = new_coal; ++ intr = &qcq->intr; ++ if (intr->dim_coal_hw != new_coal) { ++ intr->dim_coal_hw = new_coal; + + ionic_intr_coal_init(lif->ionic->idev.intr_ctrl, +- lif->rxqcqs[qi]->intr.index, +- qcq->intr.dim_coal_hw); ++ intr->index, intr->dim_coal_hw); + } + + dim->state = DIM_START_MEASURE; +-- +2.42.0 + diff --git a/queue-5.15/ionic-fix-snprintf-format-length-warning.patch b/queue-5.15/ionic-fix-snprintf-format-length-warning.patch new file mode 100644 index 00000000000..95d92f734d1 --- /dev/null +++ b/queue-5.15/ionic-fix-snprintf-format-length-warning.patch @@ -0,0 +1,45 @@ +From 35aa029da54fa6207c1f1e89e15f36e09b3a2412 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 11:22:33 -0800 +Subject: ionic: fix snprintf format length warning + +From: Shannon Nelson + +[ Upstream commit 0ceb3860a67652f9d36dfdecfcd2cb3eb2f4537d ] + +Our friendly kernel test robot has reminded us that with a new +check we have a warning about a potential string truncation. +In this case it really doesn't hurt anything, but it is worth +addressing especially since there really is no reason to reserve +so many bytes for our queue names. It seems that cutting the +queue name buffer length in half stops the complaint. + +Fixes: c06107cabea3 ("ionic: more ionic name tweaks") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311300201.lO8v7mKU-lkp@intel.com/ +Signed-off-by: Shannon Nelson +Reviewed-by: Brett Creeley +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20231204192234.21017-2-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_dev.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h +index 676c58dc19817..38f38fe8f21d9 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h ++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h +@@ -208,7 +208,7 @@ struct ionic_desc_info { + void *cb_arg; + }; + +-#define IONIC_QUEUE_NAME_MAX_SZ 32 ++#define IONIC_QUEUE_NAME_MAX_SZ 16 + + struct ionic_queue { + struct device *dev; +-- +2.42.0 + diff --git a/queue-5.15/ipv4-ip_gre-avoid-skb_pull-failure-in-ipgre_xmit.patch b/queue-5.15/ipv4-ip_gre-avoid-skb_pull-failure-in-ipgre_xmit.patch new file mode 100644 index 00000000000..f2160aef18b --- /dev/null +++ b/queue-5.15/ipv4-ip_gre-avoid-skb_pull-failure-in-ipgre_xmit.patch @@ -0,0 +1,58 @@ +From e46d7d11d13b0b11ebefabc25dbc3f159cb04972 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Dec 2023 01:14:41 +0900 +Subject: ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit() + +From: Shigeru Yoshida + +[ Upstream commit 80d875cfc9d3711a029f234ef7d680db79e8fa4b ] + +In ipgre_xmit(), skb_pull() may fail even if pskb_inet_may_pull() returns +true. For example, applications can use PF_PACKET to create a malformed +packet with no IP header. This type of packet causes a problem such as +uninit-value access. + +This patch ensures that skb_pull() can pull the required size by checking +the skb with pskb_network_may_pull() before skb_pull(). + +Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") +Signed-off-by: Shigeru Yoshida +Reviewed-by: Eric Dumazet +Reviewed-by: Suman Ghosh +Link: https://lore.kernel.org/r/20231202161441.221135-1-syoshida@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index c094963a86f1e..5d17e5f5d090d 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -634,15 +634,18 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, + } + + if (dev->header_ops) { ++ int pull_len = tunnel->hlen + sizeof(struct iphdr); ++ + if (skb_cow_head(skb, 0)) + goto free_skb; + + tnl_params = (const struct iphdr *)skb->data; + +- /* Pull skb since ip_tunnel_xmit() needs skb->data pointing +- * to gre header. +- */ +- skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); ++ if (!pskb_network_may_pull(skb, pull_len)) ++ goto free_skb; ++ ++ /* ip_tunnel_xmit() needs skb->data pointing to gre header. */ ++ skb_pull(skb, pull_len); + skb_reset_mac_header(skb); + + if (skb->ip_summed == CHECKSUM_PARTIAL && +-- +2.42.0 + diff --git a/queue-5.15/ipv6-fix-potential-null-deref-in-fib6_add.patch b/queue-5.15/ipv6-fix-potential-null-deref-in-fib6_add.patch new file mode 100644 index 00000000000..b13a0736a83 --- /dev/null +++ b/queue-5.15/ipv6-fix-potential-null-deref-in-fib6_add.patch @@ -0,0 +1,79 @@ +From 1b3d49322c0bb8214e1349c0f7fe918a013cc8e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 16:06:30 +0000 +Subject: ipv6: fix potential NULL deref in fib6_add() + +From: Eric Dumazet + +[ Upstream commit 75475bb51e78a3f54ad2f69380f2a1c985e85f2d ] + +If fib6_find_prefix() returns NULL, we should silently fallback +using fib6_null_entry regardless of RT6_DEBUG value. + +syzbot reported: + +WARNING: CPU: 0 PID: 5477 at net/ipv6/ip6_fib.c:1516 fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 +Modules linked in: +CPU: 0 PID: 5477 Comm: syz-executor.0 Not tainted 6.7.0-rc2-syzkaller-00029-g9b6de136b5f0 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 +RIP: 0010:fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 +Code: 00 48 8b 54 24 68 e8 42 22 00 00 48 85 c0 74 14 49 89 c6 e8 d5 d3 c2 f7 eb 5d e8 ce d3 c2 f7 e9 ca 00 00 00 e8 c4 d3 c2 f7 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 80 3c 01 00 +RSP: 0018:ffffc90005067740 EFLAGS: 00010293 +RAX: ffffffff89cba5bc RBX: ffffc90005067ab0 RCX: ffff88801a2e9dc0 +RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 +RBP: ffffc90005067980 R08: ffffffff89cbca85 R09: 1ffff110040d4b85 +R10: dffffc0000000000 R11: ffffed10040d4b86 R12: 00000000ffffffff +R13: 1ffff110051c3904 R14: ffff8880206a5c00 R15: ffff888028e1c820 +FS: 00007f763783c6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f763783bff8 CR3: 000000007f74d000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +__ip6_ins_rt net/ipv6/route.c:1303 [inline] +ip6_route_add+0x88/0x120 net/ipv6/route.c:3847 +ipv6_route_ioctl+0x525/0x7b0 net/ipv6/route.c:4467 +inet6_ioctl+0x21a/0x270 net/ipv6/af_inet6.c:575 +sock_do_ioctl+0x152/0x460 net/socket.c:1220 +sock_ioctl+0x615/0x8c0 net/socket.c:1339 +vfs_ioctl fs/ioctl.c:51 [inline] +__do_sys_ioctl fs/ioctl.c:871 [inline] +__se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857 +do_syscall_x64 arch/x86/entry/common.c:51 [inline] +do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 + +Fixes: 7bbfe00e0252 ("ipv6: fix general protection fault in fib6_add()") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Wei Wang +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20231129160630.3509216-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_fib.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index a506e57c4032a..7e0a30380be09 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -1501,13 +1501,9 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt, + if (!pn_leaf && !(pn->fn_flags & RTN_RTINFO)) { + pn_leaf = fib6_find_prefix(info->nl_net, table, + pn); +-#if RT6_DEBUG >= 2 +- if (!pn_leaf) { +- WARN_ON(!pn_leaf); ++ if (!pn_leaf) + pn_leaf = + info->nl_net->ipv6.fib6_null_entry; +- } +-#endif + fib6_info_hold(pn_leaf); + rcu_assign_pointer(pn->leaf, pn_leaf); + } +-- +2.42.0 + diff --git a/queue-5.15/kbuild-move-to-std-gnu11.patch b/queue-5.15/kbuild-move-to-std-gnu11.patch new file mode 100644 index 00000000000..733d7a83c37 --- /dev/null +++ b/queue-5.15/kbuild-move-to-std-gnu11.patch @@ -0,0 +1,158 @@ +From 6439890c47551e612037e8f410068d2c8b105211 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 22:56:14 +0100 +Subject: Kbuild: move to -std=gnu11 + +From: Arnd Bergmann + +[ Upstream commit e8c07082a810fbb9db303a2b66b66b8d7e588b53 ] + +During a patch discussion, Linus brought up the option of changing +the C standard version from gnu89 to gnu99, which allows using variable +declaration inside of a for() loop. While the C99, C11 and later standards +introduce many other features, most of these are already available in +gnu89 as GNU extensions as well. + +An earlier attempt to do this when gcc-5 started defaulting to +-std=gnu11 failed because at the time that caused warnings about +designated initializers with older compilers. Now that gcc-5.1 is +the minimum compiler version used for building kernels, that is no +longer a concern. Similarly, the behavior of 'inline' functions changes +between gnu89 using gnu_inline behavior and gnu11 using standard c99+ +behavior, but this was taken care of by defining 'inline' to include +__attribute__((gnu_inline)) in order to allow building with clang a +while ago. + +Nathan Chancellor reported a new -Wdeclaration-after-statement +warning that appears in a system header on arm, this still needs a +workaround. + +The differences between gnu99, gnu11, gnu1x and gnu17 are fairly +minimal and mainly impact warnings at the -Wpedantic level that the +kernel never enables. Between these, gnu11 is the newest version +that is supported by all supported compiler versions, though it is +only the default on gcc-5, while all other supported versions of +gcc or clang default to gnu1x/gnu17. + +Link: https://lore.kernel.org/lkml/CAHk-=wiyCH7xeHcmiFJ-YgXUy2Jaj7pnkdKpcovt8fYbVFW3TA@mail.gmail.com/ +Link: https://github.com/ClangBuiltLinux/linux/issues/1603 +Suggested-by: Linus Torvalds +Acked-by: Marco Elver +Acked-by: Jani Nikula +Acked-by: David Sterba +Tested-by: Sedat Dilek +Reviewed-by: Alex Shi +Reviewed-by: Nick Desaulniers +Reviewed-by: Miguel Ojeda +Signed-off-by: Arnd Bergmann +Reviewed-by: Nathan Chancellor +Signed-off-by: Masahiro Yamada +Stable-dep-of: cbf54f37600e ("platform/x86: wmi: Skip blocks with zero instances") +Signed-off-by: Sasha Levin +--- + Documentation/process/programming-language.rst | 6 +++--- + .../translations/it_IT/process/programming-language.rst | 4 ++-- + .../translations/zh_CN/process/programming-language.rst | 3 +-- + .../translations/zh_TW/process/programming-language.rst | 3 +-- + Makefile | 4 ++-- + arch/arm64/kernel/vdso32/Makefile | 2 +- + 6 files changed, 10 insertions(+), 12 deletions(-) + +diff --git a/Documentation/process/programming-language.rst b/Documentation/process/programming-language.rst +index ec474a70a02fa..5fc9160ca1fa5 100644 +--- a/Documentation/process/programming-language.rst ++++ b/Documentation/process/programming-language.rst +@@ -5,9 +5,9 @@ Programming Language + + The kernel is written in the C programming language [c-language]_. + More precisely, the kernel is typically compiled with ``gcc`` [gcc]_ +-under ``-std=gnu89`` [gcc-c-dialect-options]_: the GNU dialect of ISO C90 +-(including some C99 features). ``clang`` [clang]_ is also supported, see +-docs on :ref:`Building Linux with Clang/LLVM `. ++under ``-std=gnu11`` [gcc-c-dialect-options]_: the GNU dialect of ISO C11. ++``clang`` [clang]_ is also supported, see docs on ++:ref:`Building Linux with Clang/LLVM `. + + This dialect contains many extensions to the language [gnu-extensions]_, + and many of them are used within the kernel as a matter of course. +diff --git a/Documentation/translations/it_IT/process/programming-language.rst b/Documentation/translations/it_IT/process/programming-language.rst +index 41db2598ce119..c1a9b481a6f99 100644 +--- a/Documentation/translations/it_IT/process/programming-language.rst ++++ b/Documentation/translations/it_IT/process/programming-language.rst +@@ -10,8 +10,8 @@ Linguaggio di programmazione + + Il kernel è scritto nel linguaggio di programmazione C [it-c-language]_. + Più precisamente, il kernel viene compilato con ``gcc`` [it-gcc]_ usando +-l'opzione ``-std=gnu89`` [it-gcc-c-dialect-options]_: il dialetto GNU +-dello standard ISO C90 (con l'aggiunta di alcune funzionalità da C99). ++l'opzione ``-std=gnu11`` [it-gcc-c-dialect-options]_: il dialetto GNU ++dello standard ISO C11. + Linux supporta anche ``clang`` [it-clang]_, leggete la documentazione + :ref:`Building Linux with Clang/LLVM `. + +diff --git a/Documentation/translations/zh_CN/process/programming-language.rst b/Documentation/translations/zh_CN/process/programming-language.rst +index 2a47a1d2ec20f..fabdc338dbfbc 100644 +--- a/Documentation/translations/zh_CN/process/programming-language.rst ++++ b/Documentation/translations/zh_CN/process/programming-language.rst +@@ -9,8 +9,7 @@ + ============ + + 内核是用C语言 :ref:`c-language ` 编写的。更准确地说，内核通常是用 :ref:`gcc ` +-在 ``-std=gnu89`` :ref:`gcc-c-dialect-options ` 下编译的：ISO C90的 GNU 方言（ +-包括一些C99特性） ++在 ``-std=gnu11`` :ref:`gcc-c-dialect-options ` 下编译的：ISO C11的 GNU 方言 + + 这种方言包含对语言 :ref:`gnu-extensions ` 的许多扩展，当然，它们许多都在内核中使用。 + +diff --git a/Documentation/translations/zh_TW/process/programming-language.rst b/Documentation/translations/zh_TW/process/programming-language.rst +index 54e3699eadf85..144bdaf81a416 100644 +--- a/Documentation/translations/zh_TW/process/programming-language.rst ++++ b/Documentation/translations/zh_TW/process/programming-language.rst +@@ -12,8 +12,7 @@ + ============ + + 內核是用C語言 :ref:`c-language ` 編寫的。更準確地說，內核通常是用 :ref:`gcc ` +-在 ``-std=gnu89`` :ref:`gcc-c-dialect-options ` 下編譯的：ISO C90的 GNU 方言（ +-包括一些C99特性） ++在 ``-std=gnu11`` :ref:`gcc-c-dialect-options ` 下編譯的：ISO C11的 GNU 方言 + + 這種方言包含對語言 :ref:`gnu-extensions ` 的許多擴展，當然，它們許多都在內核中使用。 + +diff --git a/Makefile b/Makefile +index 5976e71522607..fb1517f05c3ff 100644 +--- a/Makefile ++++ b/Makefile +@@ -524,7 +524,7 @@ KBUILD_CFLAGS := -Wall -Wundef -Werror=strict-prototypes -Wno-trigraphs \ + -fno-strict-aliasing -fno-common -fshort-wchar -fno-PIE \ + -Werror=implicit-function-declaration -Werror=implicit-int \ + -Werror=return-type -Wno-format-security \ +- -std=gnu89 ++ -std=gnu11 + KBUILD_CPPFLAGS := -D__KERNEL__ + KBUILD_AFLAGS_KERNEL := + KBUILD_CFLAGS_KERNEL := +@@ -809,7 +809,7 @@ KBUILD_CFLAGS += $(KBUILD_CFLAGS-y) + + ifdef CONFIG_CC_IS_CLANG + KBUILD_CPPFLAGS += -Qunused-arguments +-# The kernel builds with '-std=gnu89' so use of GNU extensions is acceptable. ++# The kernel builds with '-std=gnu11' so use of GNU extensions is acceptable. + KBUILD_CFLAGS += -Wno-gnu + # CLANG uses a _MergedGlobals as optimization, but this breaks modpost, as the + # source of a reference will be _MergedGlobals and not on of the whitelisted names. +diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile +index 50cb1ec092ae5..d7f5b140a5d2a 100644 +--- a/arch/arm64/kernel/vdso32/Makefile ++++ b/arch/arm64/kernel/vdso32/Makefile +@@ -77,7 +77,7 @@ VDSO_CFLAGS += -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ + -Werror-implicit-function-declaration \ + -Wno-format-security \ + -Wdeclaration-after-statement \ +- -std=gnu89 ++ -std=gnu11 + VDSO_CFLAGS += -O2 + # Some useful compiler-dependent flags from top-level Makefile + VDSO_CFLAGS += $(call cc32-option,-Wdeclaration-after-statement,) +-- +2.42.0 + diff --git a/queue-5.15/kbuild-use-wdeclaration-after-statement.patch b/queue-5.15/kbuild-use-wdeclaration-after-statement.patch new file mode 100644 index 00000000000..47eb36f5088 --- /dev/null +++ b/queue-5.15/kbuild-use-wdeclaration-after-statement.patch @@ -0,0 +1,91 @@ +From c06a25dc5234f3654a23eb292536f8f7f6a69a8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 22:56:13 +0100 +Subject: Kbuild: use -Wdeclaration-after-statement +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mark Rutland + +[ Upstream commit 4d94f910e79a349b00a4f8aab6f3ae87129d8c5a ] + +The kernel is moving from using `-std=gnu89` to `-std=gnu11`, permitting +the use of additional C11 features such as for-loop initial declarations. + +One contentious aspect of C99 is that it permits mixed declarations and +code, and for now at least, it seems preferable to enforce that +declarations must come first. + +These warnings were already enabled in the kernel itself, but not +for KBUILD_USERCFLAGS or the compat VDSO on arch/arm64, which uses +a separate set of CFLAGS. + +This patch fixes an existing violation in modpost.c, which is not +reported because of the missing flag in KBUILD_USERCFLAGS: + +| scripts/mod/modpost.c: In function ‘match’: +| scripts/mod/modpost.c:837:3: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement] +| 837 | const char *endp = p + strlen(p) - 1; +| | ^~~~~ + +Signed-off-by: Mark Rutland +[arnd: don't add a duplicate flag to the default set, update changelog] +Signed-off-by: Arnd Bergmann +Reviewed-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Tested-by: Sedat Dilek # LLVM/Clang v13.0.0 (x86-64) +Signed-off-by: Masahiro Yamada +Stable-dep-of: cbf54f37600e ("platform/x86: wmi: Skip blocks with zero instances") +Signed-off-by: Sasha Levin +--- + Makefile | 3 ++- + arch/arm64/kernel/vdso32/Makefile | 1 + + scripts/mod/modpost.c | 4 +++- + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/Makefile b/Makefile +index 678e712591f89..5976e71522607 100644 +--- a/Makefile ++++ b/Makefile +@@ -440,7 +440,8 @@ endif + HOSTPKG_CONFIG = pkg-config + + export KBUILD_USERCFLAGS := -Wall -Wmissing-prototypes -Wstrict-prototypes \ +- -O2 -fomit-frame-pointer -std=gnu89 ++ -O2 -fomit-frame-pointer -std=gnu89 \ ++ -Wdeclaration-after-statement + export KBUILD_USERLDFLAGS := + + KBUILD_HOSTCFLAGS := $(KBUILD_USERCFLAGS) $(HOST_LFS_CFLAGS) $(HOSTCFLAGS) +diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile +index 83e9399e38368..50cb1ec092ae5 100644 +--- a/arch/arm64/kernel/vdso32/Makefile ++++ b/arch/arm64/kernel/vdso32/Makefile +@@ -76,6 +76,7 @@ VDSO_CFLAGS += -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ + -fno-strict-aliasing -fno-common \ + -Werror-implicit-function-declaration \ + -Wno-format-security \ ++ -Wdeclaration-after-statement \ + -std=gnu89 + VDSO_CFLAGS += -O2 + # Some useful compiler-dependent flags from top-level Makefile +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index c6e655e0ed988..945f9ecb34079 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -833,8 +833,10 @@ static int match(const char *sym, const char * const pat[]) + { + const char *p; + while (*pat) { ++ const char *endp; ++ + p = *pat++; +- const char *endp = p + strlen(p) - 1; ++ endp = p + strlen(p) - 1; + + /* "*foo*" */ + if (*p == '*' && *endp == '*') { +-- +2.42.0 + diff --git a/queue-5.15/mlxbf-bootctl-correctly-identify-secure-boot-with-de.patch b/queue-5.15/mlxbf-bootctl-correctly-identify-secure-boot-with-de.patch new file mode 100644 index 00000000000..995015156a6 --- /dev/null +++ b/queue-5.15/mlxbf-bootctl-correctly-identify-secure-boot-with-de.patch @@ -0,0 +1,120 @@ +From 6db77aeffd6c7ca82c63f6f9ccd64da0df492e86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 13:35:15 -0500 +Subject: mlxbf-bootctl: correctly identify secure boot with development keys +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Thompson + +[ Upstream commit d4eef75279f5e9d594f5785502038c763ce42268 ] + +The secure boot state of the BlueField SoC is represented by two bits: + 0 = production state + 1 = secure boot enabled + 2 = non-secure (secure boot disabled) + 3 = RMA state +There is also a single bit to indicate whether production keys or +development keys are being used when secure boot is enabled. +This single bit (specified by MLXBF_BOOTCTL_SB_DEV_MASK) only has +meaning if secure boot state equals 1 (secure boot enabled). + +The secure boot states are as follows: +- “GA secured” is when secure boot is enabled with official production keys. +- “Secured (development)” is when secure boot is enabled with development keys. + +Without this fix “GA Secured” is displayed on development cards which is +misleading. This patch updates the logic in "lifecycle_state_show()" to +handle the case where the SoC is configured for secure boot and is using +development keys. + +Fixes: 79e29cb8fbc5c ("platform/mellanox: Add bootctl driver for Mellanox BlueField Soc") +Reviewed-by: Khalil Blaiech +Signed-off-by: David Thompson +Link: https://lore.kernel.org/r/20231130183515.17214-1-davthompson@nvidia.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-bootctl.c | 39 +++++++++++++++-------- + 1 file changed, 26 insertions(+), 13 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-bootctl.c b/drivers/platform/mellanox/mlxbf-bootctl.c +index 1c7a288b59a5c..6a171a4f9dc68 100644 +--- a/drivers/platform/mellanox/mlxbf-bootctl.c ++++ b/drivers/platform/mellanox/mlxbf-bootctl.c +@@ -17,6 +17,7 @@ + + #define MLXBF_BOOTCTL_SB_SECURE_MASK 0x03 + #define MLXBF_BOOTCTL_SB_TEST_MASK 0x0c ++#define MLXBF_BOOTCTL_SB_DEV_MASK BIT(4) + + #define MLXBF_SB_KEY_NUM 4 + +@@ -37,11 +38,18 @@ static struct mlxbf_bootctl_name boot_names[] = { + { MLXBF_BOOTCTL_NONE, "none" }, + }; + ++enum { ++ MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION = 0, ++ MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE = 1, ++ MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE = 2, ++ MLXBF_BOOTCTL_SB_LIFECYCLE_RMA = 3 ++}; ++ + static const char * const mlxbf_bootctl_lifecycle_states[] = { +- [0] = "Production", +- [1] = "GA Secured", +- [2] = "GA Non-Secured", +- [3] = "RMA", ++ [MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION] = "Production", ++ [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE] = "GA Secured", ++ [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE] = "GA Non-Secured", ++ [MLXBF_BOOTCTL_SB_LIFECYCLE_RMA] = "RMA", + }; + + /* ARM SMC call which is atomic and no need for lock. */ +@@ -165,25 +173,30 @@ static ssize_t second_reset_action_store(struct device *dev, + static ssize_t lifecycle_state_show(struct device *dev, + struct device_attribute *attr, char *buf) + { ++ int status_bits; ++ int use_dev_key; ++ int test_state; + int lc_state; + +- lc_state = mlxbf_bootctl_smc(MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS, +- MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE); +- if (lc_state < 0) +- return lc_state; ++ status_bits = mlxbf_bootctl_smc(MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS, ++ MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE); ++ if (status_bits < 0) ++ return status_bits; + +- lc_state &= +- MLXBF_BOOTCTL_SB_TEST_MASK | MLXBF_BOOTCTL_SB_SECURE_MASK; ++ use_dev_key = status_bits & MLXBF_BOOTCTL_SB_DEV_MASK; ++ test_state = status_bits & MLXBF_BOOTCTL_SB_TEST_MASK; ++ lc_state = status_bits & MLXBF_BOOTCTL_SB_SECURE_MASK; + + /* + * If the test bits are set, we specify that the current state may be + * due to using the test bits. + */ +- if (lc_state & MLXBF_BOOTCTL_SB_TEST_MASK) { +- lc_state &= MLXBF_BOOTCTL_SB_SECURE_MASK; +- ++ if (test_state) { + return sprintf(buf, "%s(test)\n", + mlxbf_bootctl_lifecycle_states[lc_state]); ++ } else if (use_dev_key && ++ (lc_state == MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE)) { ++ return sprintf(buf, "Secured (development)\n"); + } + + return sprintf(buf, "%s\n", mlxbf_bootctl_lifecycle_states[lc_state]); +-- +2.42.0 + diff --git a/queue-5.15/net-add-missing-kdoc-for-struct-genl_multicast_group.patch b/queue-5.15/net-add-missing-kdoc-for-struct-genl_multicast_group.patch new file mode 100644 index 00000000000..9f0f6d97f2d --- /dev/null +++ b/queue-5.15/net-add-missing-kdoc-for-struct-genl_multicast_group.patch @@ -0,0 +1,56 @@ +From b510952a8028fadc96a531309d78a49b1a67bdb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Aug 2022 16:20:12 -0700 +Subject: net: add missing kdoc for struct genl_multicast_group::flags + +From: Jakub Kicinski + +[ Upstream commit 5c221f0af68cfa9edcffd26ba6dbbc4b7ddb1700 ] + +Multicast group flags were added in commit 4d54cc32112d ("mptcp: avoid +lock_fast usage in accept path"), but it missed adding the kdoc. + +Mention which flags go into that field, and do the same for +op structs. + +Link: https://lore.kernel.org/r/20220809232012.403730-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Stable-dep-of: e03781879a0d ("drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group") +Signed-off-by: Sasha Levin +--- + include/net/genetlink.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/net/genetlink.h b/include/net/genetlink.h +index 7cb3fa8310edd..56a50e1c51b97 100644 +--- a/include/net/genetlink.h ++++ b/include/net/genetlink.h +@@ -11,6 +11,7 @@ + /** + * struct genl_multicast_group - generic netlink multicast group + * @name: name of the multicast group, names are per-family ++ * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM) + */ + struct genl_multicast_group { + char name[GENL_NAMSIZ]; +@@ -116,7 +117,7 @@ enum genl_validate_flags { + * struct genl_small_ops - generic netlink operations (small version) + * @cmd: command identifier + * @internal_flags: flags used by the family +- * @flags: flags ++ * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM) + * @validate: validation flags from enum genl_validate_flags + * @doit: standard command callback + * @dumpit: callback for dumpers +@@ -137,7 +138,7 @@ struct genl_small_ops { + * struct genl_ops - generic netlink operations + * @cmd: command identifier + * @internal_flags: flags used by the family +- * @flags: flags ++ * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM) + * @maxattr: maximum number of attributes supported + * @policy: netlink policy (takes precedence over family policy) + * @validate: validation flags from enum genl_validate_flags +-- +2.42.0 + diff --git a/queue-5.15/net-bnxt-fix-a-potential-use-after-free-in-bnxt_init.patch b/queue-5.15/net-bnxt-fix-a-potential-use-after-free-in-bnxt_init.patch new file mode 100644 index 00000000000..28ef273d7fe --- /dev/null +++ b/queue-5.15/net-bnxt-fix-a-potential-use-after-free-in-bnxt_init.patch @@ -0,0 +1,43 @@ +From 0904dbd18e902aa80304297e5f71c842afaccc68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 10:40:04 +0800 +Subject: net: bnxt: fix a potential use-after-free in bnxt_init_tc + +From: Dinghao Liu + +[ Upstream commit d007caaaf052f82ca2340d4c7b32d04a3f5dbf3f ] + +When flow_indr_dev_register() fails, bnxt_init_tc will free +bp->tc_info through kfree(). However, the caller function +bnxt_init_one() will ignore this failure and call +bnxt_shutdown_tc() on failure of bnxt_dl_register(), where +a use-after-free happens. Fix this issue by setting +bp->tc_info to NULL after kfree(). + +Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks") +Signed-off-by: Dinghao Liu +Reviewed-by: Pavan Chebbi +Reviewed-by: Michael Chan +Reviewed-by: Somnath Kotur +Link: https://lore.kernel.org/r/20231204024004.8245-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +index 1471b6130a2b9..b3473883eae6b 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +@@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp) + rhashtable_destroy(&tc_info->flow_table); + free_tc_info: + kfree(tc_info); ++ bp->tc_info = NULL; + return rc; + } + +-- +2.42.0 + diff --git a/queue-5.15/net-hns-fix-fake-link-up-on-xge-port.patch b/queue-5.15/net-hns-fix-fake-link-up-on-xge-port.patch new file mode 100644 index 00000000000..2e2fe89fa7a --- /dev/null +++ b/queue-5.15/net-hns-fix-fake-link-up-on-xge-port.patch @@ -0,0 +1,74 @@ +From b4c4543c6be46dd57ab0ab8879b97392bd01dcc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 22:32:32 +0800 +Subject: net: hns: fix fake link up on xge port + +From: Yonglong Liu + +[ Upstream commit f708aba40f9c1eeb9c7e93ed4863b5f85b09b288 ] + +If a xge port just connect with an optical module and no fiber, +it may have a fake link up because there may be interference on +the hardware. This patch adds an anti-shake to avoid the problem. +And the time of anti-shake is base on tests. + +Fixes: b917078c1c10 ("net: hns: Add ACPI support to check SFP present") +Signed-off-by: Yonglong Liu +Signed-off-by: Jijie Shao +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 29 +++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +index f41379de21865..ec9a02495df47 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +@@ -66,6 +66,27 @@ static enum mac_mode hns_get_enet_interface(const struct hns_mac_cb *mac_cb) + } + } + ++static u32 hns_mac_link_anti_shake(struct mac_driver *mac_ctrl_drv) ++{ ++#define HNS_MAC_LINK_WAIT_TIME 5 ++#define HNS_MAC_LINK_WAIT_CNT 40 ++ ++ u32 link_status = 0; ++ int i; ++ ++ if (!mac_ctrl_drv->get_link_status) ++ return link_status; ++ ++ for (i = 0; i < HNS_MAC_LINK_WAIT_CNT; i++) { ++ msleep(HNS_MAC_LINK_WAIT_TIME); ++ mac_ctrl_drv->get_link_status(mac_ctrl_drv, &link_status); ++ if (!link_status) ++ break; ++ } ++ ++ return link_status; ++} ++ + void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status) + { + struct mac_driver *mac_ctrl_drv; +@@ -83,6 +104,14 @@ void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status) + &sfp_prsnt); + if (!ret) + *link_status = *link_status && sfp_prsnt; ++ ++ /* for FIBER port, it may have a fake link up. ++ * when the link status changes from down to up, we need to do ++ * anti-shake. the anti-shake time is base on tests. ++ * only FIBER port need to do this. ++ */ ++ if (*link_status && !mac_cb->link) ++ *link_status = hns_mac_link_anti_shake(mac_ctrl_drv); + } + + mac_cb->link = *link_status; +-- +2.42.0 + diff --git a/queue-5.15/net-stmmac-fix-fpe-events-losing.patch b/queue-5.15/net-stmmac-fix-fpe-events-losing.patch new file mode 100644 index 00000000000..44463011db8 --- /dev/null +++ b/queue-5.15/net-stmmac-fix-fpe-events-losing.patch @@ -0,0 +1,243 @@ +From 103862a3cfca3d4e1b16a9ef02ea8ac812d96157 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 03:22:03 +0000 +Subject: net: stmmac: fix FPE events losing + +From: Jianheng Zhang + +[ Upstream commit 37e4b8df27bc68340f3fc80dbb27e3549c7f881c ] + +The status bits of register MAC_FPE_CTRL_STS are clear on read. Using +32-bit read for MAC_FPE_CTRL_STS in dwmac5_fpe_configure() and +dwmac5_fpe_send_mpacket() clear the status bits. Then the stmmac interrupt +handler missing FPE event status and leads to FPE handshaking failure and +retries. +To avoid clear status bits of MAC_FPE_CTRL_STS in dwmac5_fpe_configure() +and dwmac5_fpe_send_mpacket(), add fpe_csr to stmmac_fpe_cfg structure to +cache the control bits of MAC_FPE_CTRL_STS and to avoid reading +MAC_FPE_CTRL_STS in those methods. + +Fixes: 5a5586112b92 ("net: stmmac: support FPE link partner hand-shaking procedure") +Reviewed-by: Serge Semin +Signed-off-by: Jianheng Zhang +Link: https://lore.kernel.org/r/CY5PR12MB637225A7CF529D5BE0FBE59CBF81A@CY5PR12MB6372.namprd12.prod.outlook.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 45 ++++++++----------- + drivers/net/ethernet/stmicro/stmmac/dwmac5.h | 4 +- + .../ethernet/stmicro/stmmac/dwxgmac2_core.c | 3 +- + drivers/net/ethernet/stmicro/stmmac/hwif.h | 4 +- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 8 +++- + .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + + include/linux/stmmac.h | 1 + + 7 files changed, 36 insertions(+), 30 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +index e95d35f1e5a0c..8fd167501fa0e 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +@@ -710,28 +710,22 @@ void dwmac5_est_irq_status(void __iomem *ioaddr, struct net_device *dev, + } + } + +-void dwmac5_fpe_configure(void __iomem *ioaddr, u32 num_txq, u32 num_rxq, ++void dwmac5_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ u32 num_txq, u32 num_rxq, + bool enable) + { + u32 value; + +- if (!enable) { +- value = readl(ioaddr + MAC_FPE_CTRL_STS); +- +- value &= ~EFPE; +- +- writel(value, ioaddr + MAC_FPE_CTRL_STS); +- return; ++ if (enable) { ++ cfg->fpe_csr = EFPE; ++ value = readl(ioaddr + GMAC_RXQ_CTRL1); ++ value &= ~GMAC_RXQCTRL_FPRQ; ++ value |= (num_rxq - 1) << GMAC_RXQCTRL_FPRQ_SHIFT; ++ writel(value, ioaddr + GMAC_RXQ_CTRL1); ++ } else { ++ cfg->fpe_csr = 0; + } +- +- value = readl(ioaddr + GMAC_RXQ_CTRL1); +- value &= ~GMAC_RXQCTRL_FPRQ; +- value |= (num_rxq - 1) << GMAC_RXQCTRL_FPRQ_SHIFT; +- writel(value, ioaddr + GMAC_RXQ_CTRL1); +- +- value = readl(ioaddr + MAC_FPE_CTRL_STS); +- value |= EFPE; +- writel(value, ioaddr + MAC_FPE_CTRL_STS); ++ writel(cfg->fpe_csr, ioaddr + MAC_FPE_CTRL_STS); + } + + int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) +@@ -741,6 +735,9 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) + + status = FPE_EVENT_UNKNOWN; + ++ /* Reads from the MAC_FPE_CTRL_STS register should only be performed ++ * here, since the status flags of MAC_FPE_CTRL_STS are "clear on read" ++ */ + value = readl(ioaddr + MAC_FPE_CTRL_STS); + + if (value & TRSP) { +@@ -766,19 +763,15 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) + return status; + } + +-void dwmac5_fpe_send_mpacket(void __iomem *ioaddr, enum stmmac_mpacket_type type) ++void dwmac5_fpe_send_mpacket(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ enum stmmac_mpacket_type type) + { +- u32 value; ++ u32 value = cfg->fpe_csr; + +- value = readl(ioaddr + MAC_FPE_CTRL_STS); +- +- if (type == MPACKET_VERIFY) { +- value &= ~SRSP; ++ if (type == MPACKET_VERIFY) + value |= SVER; +- } else { +- value &= ~SVER; ++ else if (type == MPACKET_RESPONSE) + value |= SRSP; +- } + + writel(value, ioaddr + MAC_FPE_CTRL_STS); + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.h b/drivers/net/ethernet/stmicro/stmmac/dwmac5.h +index 53c138d0ff480..34e620790eb37 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.h ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.h +@@ -153,9 +153,11 @@ int dwmac5_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, + unsigned int ptp_rate); + void dwmac5_est_irq_status(void __iomem *ioaddr, struct net_device *dev, + struct stmmac_extra_stats *x, u32 txqcnt); +-void dwmac5_fpe_configure(void __iomem *ioaddr, u32 num_txq, u32 num_rxq, ++void dwmac5_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ u32 num_txq, u32 num_rxq, + bool enable); + void dwmac5_fpe_send_mpacket(void __iomem *ioaddr, ++ struct stmmac_fpe_cfg *cfg, + enum stmmac_mpacket_type type); + int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +index 54aa0fbd1bf63..3568bf3ccfbe7 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +@@ -1440,7 +1440,8 @@ static int dwxgmac3_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, + return 0; + } + +-static void dwxgmac3_fpe_configure(void __iomem *ioaddr, u32 num_txq, ++static void dwxgmac3_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ u32 num_txq, + u32 num_rxq, bool enable) + { + u32 value; +diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h +index fe2660d5694d7..cc229ccd5d81d 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h ++++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h +@@ -395,9 +395,11 @@ struct stmmac_ops { + unsigned int ptp_rate); + void (*est_irq_status)(void __iomem *ioaddr, struct net_device *dev, + struct stmmac_extra_stats *x, u32 txqcnt); +- void (*fpe_configure)(void __iomem *ioaddr, u32 num_txq, u32 num_rxq, ++ void (*fpe_configure)(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, ++ u32 num_txq, u32 num_rxq, + bool enable); + void (*fpe_send_mpacket)(void __iomem *ioaddr, ++ struct stmmac_fpe_cfg *cfg, + enum stmmac_mpacket_type type); + int (*fpe_irq_status)(void __iomem *ioaddr, struct net_device *dev); + }; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 2b4c30a5ffcd9..7042abc6979a9 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1054,7 +1054,8 @@ static void stmmac_fpe_link_state_handle(struct stmmac_priv *priv, bool is_up) + bool *hs_enable = &fpe_cfg->hs_enable; + + if (is_up && *hs_enable) { +- stmmac_fpe_send_mpacket(priv, priv->ioaddr, MPACKET_VERIFY); ++ stmmac_fpe_send_mpacket(priv, priv->ioaddr, fpe_cfg, ++ MPACKET_VERIFY); + } else { + *lo_state = FPE_STATE_OFF; + *lp_state = FPE_STATE_OFF; +@@ -5621,6 +5622,7 @@ static void stmmac_fpe_event_status(struct stmmac_priv *priv, int status) + /* If user has requested FPE enable, quickly response */ + if (*hs_enable) + stmmac_fpe_send_mpacket(priv, priv->ioaddr, ++ fpe_cfg, + MPACKET_RESPONSE); + } + +@@ -6958,6 +6960,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work) + if (*lo_state == FPE_STATE_ENTERING_ON && + *lp_state == FPE_STATE_ENTERING_ON) { + stmmac_fpe_configure(priv, priv->ioaddr, ++ fpe_cfg, + priv->plat->tx_queues_to_use, + priv->plat->rx_queues_to_use, + *enable); +@@ -6976,6 +6979,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work) + netdev_info(priv->dev, SEND_VERIFY_MPAKCET_FMT, + *lo_state, *lp_state); + stmmac_fpe_send_mpacket(priv, priv->ioaddr, ++ fpe_cfg, + MPACKET_VERIFY); + } + /* Sleep then retry */ +@@ -6990,6 +6994,7 @@ void stmmac_fpe_handshake(struct stmmac_priv *priv, bool enable) + if (priv->plat->fpe_cfg->hs_enable != enable) { + if (enable) { + stmmac_fpe_send_mpacket(priv, priv->ioaddr, ++ priv->plat->fpe_cfg, + MPACKET_VERIFY); + } else { + priv->plat->fpe_cfg->lo_fpe_state = FPE_STATE_OFF; +@@ -7399,6 +7404,7 @@ int stmmac_suspend(struct device *dev) + if (priv->dma_cap.fpesel) { + /* Disable FPE */ + stmmac_fpe_configure(priv, priv->ioaddr, ++ priv->plat->fpe_cfg, + priv->plat->tx_queues_to_use, + priv->plat->rx_queues_to_use, false); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +index d0a2b289f4603..08cffc0558743 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +@@ -952,6 +952,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, + + priv->plat->fpe_cfg->enable = false; + stmmac_fpe_configure(priv, priv->ioaddr, ++ priv->plat->fpe_cfg, + priv->plat->tx_queues_to_use, + priv->plat->rx_queues_to_use, + false); +diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h +index 24bc3f7967c3b..a266e11525220 100644 +--- a/include/linux/stmmac.h ++++ b/include/linux/stmmac.h +@@ -172,6 +172,7 @@ struct stmmac_fpe_cfg { + bool hs_enable; /* FPE handshake enable */ + enum stmmac_fpe_state lp_fpe_state; /* Link Partner FPE state */ + enum stmmac_fpe_state lo_fpe_state; /* Local station FPE state */ ++ u32 fpe_csr; /* MAC_FPE_CTRL_STS reg cache */ + }; + + struct stmmac_safety_feature_cfg { +-- +2.42.0 + diff --git a/queue-5.15/netfilter-nf_tables-bail-out-on-mismatching-dynset-a.patch b/queue-5.15/netfilter-nf_tables-bail-out-on-mismatching-dynset-a.patch new file mode 100644 index 00000000000..d7fa78a81c7 --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-bail-out-on-mismatching-dynset-a.patch @@ -0,0 +1,48 @@ +From 535fdbc7265d5084323ec1827d8bb65942271038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 14:25:33 +0100 +Subject: netfilter: nf_tables: bail out on mismatching dynset and set + expressions + +From: Pablo Neira Ayuso + +[ Upstream commit 3701cd390fd731ee7ae8b8006246c8db82c72bea ] + +If dynset expressions provided by userspace is larger than the declared +set expressions, then bail out. + +Fixes: 48b0ae046ee9 ("netfilter: nftables: netlink support for several set element expressions") +Reported-by: Xingyuan Mo +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_dynset.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c +index 73e606372b05d..e714e0efa7363 100644 +--- a/net/netfilter/nft_dynset.c ++++ b/net/netfilter/nft_dynset.c +@@ -279,10 +279,15 @@ static int nft_dynset_init(const struct nft_ctx *ctx, + priv->expr_array[i] = dynset_expr; + priv->num_exprs++; + +- if (set->num_exprs && +- dynset_expr->ops != set->exprs[i]->ops) { +- err = -EOPNOTSUPP; +- goto err_expr_free; ++ if (set->num_exprs) { ++ if (i >= set->num_exprs) { ++ err = -EINVAL; ++ goto err_expr_free; ++ } ++ if (dynset_expr->ops != set->exprs[i]->ops) { ++ err = -EOPNOTSUPP; ++ goto err_expr_free; ++ } + } + i++; + } +-- +2.42.0 + diff --git a/queue-5.15/netfilter-nf_tables-validate-family-when-identifying.patch b/queue-5.15/netfilter-nf_tables-validate-family-when-identifying.patch new file mode 100644 index 00000000000..1e7fade3e6e --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-validate-family-when-identifying.patch @@ -0,0 +1,53 @@ +From 79dfb3bb1d2e43fc633715c3a05125779e5e65ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 14:51:48 +0100 +Subject: netfilter: nf_tables: validate family when identifying table via + handle + +From: Pablo Neira Ayuso + +[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ] + +Validate table family when looking up for it via NFTA_TABLE_HANDLE. + +Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle") +Reported-by: Xingyuan Mo +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index bf0bd44f2fb3a..20c2b4f5e8938 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -753,7 +753,7 @@ static struct nft_table *nft_table_lookup(const struct net *net, + + static struct nft_table *nft_table_lookup_byhandle(const struct net *net, + const struct nlattr *nla, +- u8 genmask, u32 nlpid) ++ int family, u8 genmask, u32 nlpid) + { + struct nftables_pernet *nft_net; + struct nft_table *table; +@@ -761,6 +761,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net, + nft_net = nft_pernet(net); + list_for_each_entry(table, &nft_net->tables, list) { + if (be64_to_cpu(nla_get_be64(nla)) == table->handle && ++ table->family == family && + nft_active_genmask(table, genmask)) { + if (nft_table_has_owner(table) && + nlpid && table->nlpid != nlpid) +@@ -1458,7 +1459,7 @@ static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info, + + if (nla[NFTA_TABLE_HANDLE]) { + attr = nla[NFTA_TABLE_HANDLE]; +- table = nft_table_lookup_byhandle(net, attr, genmask, ++ table = nft_table_lookup_byhandle(net, attr, family, genmask, + NETLINK_CB(skb).portid); + } else { + attr = nla[NFTA_TABLE_NAME]; +-- +2.42.0 + diff --git a/queue-5.15/netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch b/queue-5.15/netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch new file mode 100644 index 00000000000..45ff61c8194 --- /dev/null +++ b/queue-5.15/netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch @@ -0,0 +1,71 @@ +From d0990f820a975367709de6893b8c4b45e3d15e10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 21:58:12 +0100 +Subject: netfilter: xt_owner: Fix for unsafe access of sk->sk_socket + +From: Phil Sutter + +[ Upstream commit 7ae836a3d630e146b732fe8ef7d86b243748751f ] + +A concurrently running sock_orphan() may NULL the sk_socket pointer in +between check and deref. Follow other users (like nft_meta.c for +instance) and acquire sk_callback_lock before dereferencing sk_socket. + +Fixes: 0265ab44bacc ("[NETFILTER]: merge ipt_owner/ip6t_owner in xt_owner") +Reported-by: Jann Horn +Signed-off-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_owner.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c +index e85ce69924aee..50332888c8d23 100644 +--- a/net/netfilter/xt_owner.c ++++ b/net/netfilter/xt_owner.c +@@ -76,18 +76,23 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par) + */ + return false; + +- filp = sk->sk_socket->file; +- if (filp == NULL) ++ read_lock_bh(&sk->sk_callback_lock); ++ filp = sk->sk_socket ? sk->sk_socket->file : NULL; ++ if (filp == NULL) { ++ read_unlock_bh(&sk->sk_callback_lock); + return ((info->match ^ info->invert) & + (XT_OWNER_UID | XT_OWNER_GID)) == 0; ++ } + + if (info->match & XT_OWNER_UID) { + kuid_t uid_min = make_kuid(net->user_ns, info->uid_min); + kuid_t uid_max = make_kuid(net->user_ns, info->uid_max); + if ((uid_gte(filp->f_cred->fsuid, uid_min) && + uid_lte(filp->f_cred->fsuid, uid_max)) ^ +- !(info->invert & XT_OWNER_UID)) ++ !(info->invert & XT_OWNER_UID)) { ++ read_unlock_bh(&sk->sk_callback_lock); + return false; ++ } + } + + if (info->match & XT_OWNER_GID) { +@@ -112,10 +117,13 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par) + } + } + +- if (match ^ !(info->invert & XT_OWNER_GID)) ++ if (match ^ !(info->invert & XT_OWNER_GID)) { ++ read_unlock_bh(&sk->sk_callback_lock); + return false; ++ } + } + ++ read_unlock_bh(&sk->sk_callback_lock); + return true; + } + +-- +2.42.0 + diff --git a/queue-5.15/octeontx2-af-check-return-value-of-nix_get_nixlf-bef.patch b/queue-5.15/octeontx2-af-check-return-value-of-nix_get_nixlf-bef.patch new file mode 100644 index 00000000000..0427cf5c37c --- /dev/null +++ b/queue-5.15/octeontx2-af-check-return-value-of-nix_get_nixlf-bef.patch @@ -0,0 +1,45 @@ +From 2fb6d821c60e7430601d4e93346f3e988dd4725e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 11:11:48 +0530 +Subject: octeontx2-af: Check return value of nix_get_nixlf before using nixlf + +From: Subbaraya Sundeep + +[ Upstream commit 830139e7b6911266a84a77e1f18abf758995cc89 ] + +If a NIXLF is not attached to a PF/VF device then +nix_get_nixlf function fails and returns proper error +code. But npc_get_default_entry_action does not check it +and uses garbage value in subsequent calls. Fix this +by cheking the return value of nix_get_nixlf. + +Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet replication feature") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index d1249da7a18fb..a3fd20d26b942 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -388,7 +388,13 @@ static u64 npc_get_default_entry_action(struct rvu *rvu, struct npc_mcam *mcam, + int bank, nixlf, index; + + /* get ucast entry rule entry index */ +- nix_get_nixlf(rvu, pf_func, &nixlf, NULL); ++ if (nix_get_nixlf(rvu, pf_func, &nixlf, NULL)) { ++ dev_err(rvu->dev, "%s: nixlf not attached to pcifunc:0x%x\n", ++ __func__, pf_func); ++ /* Action 0 is drop */ ++ return 0; ++ } ++ + index = npc_get_nixlf_mcam_index(mcam, pf_func, nixlf, + NIXLF_UCAST_ENTRY); + bank = npc_get_bank(mcam, index); +-- +2.42.0 + diff --git a/queue-5.15/octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch b/queue-5.15/octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch new file mode 100644 index 00000000000..03fd4b2789f --- /dev/null +++ b/queue-5.15/octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch @@ -0,0 +1,61 @@ +From 3c88655de2a80da6dfeae378a5a9fa7c3959c7ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Dec 2023 17:59:02 +0800 +Subject: octeontx2-af: fix a use-after-free in rvu_npa_register_reporters + +From: Zhipeng Lu + +[ Upstream commit 3c91c909f13f0c32b0d54d75c3f798479b1a84f5 ] + +The rvu_dl will be freed in rvu_npa_health_reporters_destroy(rvu_dl) +after the create_workqueue fails, and after that free, the rvu_dl will +be translate back through rvu_npa_health_reporters_create, +rvu_health_reporters_create, and rvu_register_dl. Finally it goes to the +err_dl_health label, being freed again in +rvu_health_reporters_destroy(rvu) by rvu_npa_health_reporters_destroy. +In the second calls of rvu_npa_health_reporters_destroy, however, +it uses rvu_dl->rvu_npa_health_reporter, which is already freed at +the end of rvu_npa_health_reporters_destroy in the first call. + +So this patch prevents the first destroy by instantly returning -ENONMEN +when create_workqueue fails. In addition, since the failure of +create_workqueue is the only entrence of label err, it has been +integrated into the error-handling path of create_workqueue. + +Fixes: f1168d1e207c ("octeontx2-af: Add devlink health reporters for NPA") +Signed-off-by: Zhipeng Lu +Acked-by: Paolo Abeni +Acked-by: Geethasowjanya Akula +Link: https://lore.kernel.org/r/20231202095902.3264863-1-alexious@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +index 274d3abe30eb4..ba7ff776760d3 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +@@ -1284,7 +1284,7 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) + + rvu_dl->devlink_wq = create_workqueue("rvu_devlink_wq"); + if (!rvu_dl->devlink_wq) +- goto err; ++ return -ENOMEM; + + INIT_WORK(&rvu_reporters->intr_work, rvu_npa_intr_work); + INIT_WORK(&rvu_reporters->err_work, rvu_npa_err_work); +@@ -1292,9 +1292,6 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) + INIT_WORK(&rvu_reporters->ras_work, rvu_npa_ras_work); + + return 0; +-err: +- rvu_npa_health_reporters_destroy(rvu_dl); +- return -ENOMEM; + } + + static int rvu_npa_health_reporters_create(struct rvu_devlink *rvu_dl) +-- +2.42.0 + diff --git a/queue-5.15/octeontx2-af-update-tx-link-register-range.patch b/queue-5.15/octeontx2-af-update-tx-link-register-range.patch new file mode 100644 index 00000000000..b1c83fa0125 --- /dev/null +++ b/queue-5.15/octeontx2-af-update-tx-link-register-range.patch @@ -0,0 +1,41 @@ +From b74948a8b79cf0b9bf192be7c5d5e91dac467a94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 13:34:34 +0530 +Subject: octeontx2-af: Update Tx link register range + +From: Rahul Bhansali + +[ Upstream commit 7336fc196748f82646b630d5a2e9d283e200b988 ] + +On new silicons the TX channels for transmit level has increased. +This patch fixes the respective register offset range to +configure the newly added channels. + +Fixes: b279bbb3314e ("octeontx2-af: NIX Tx scheduler queue config support") +Signed-off-by: Rahul Bhansali +Signed-off-by: Geetha sowjanya +Reviewed-by: Wojciech Drewek +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c +index b3150f0532919..d46ac29adb966 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c +@@ -31,8 +31,8 @@ static struct hw_reg_map txsch_reg_map[NIX_TXSCH_LVL_CNT] = { + {NIX_TXSCH_LVL_TL4, 3, 0xFFFF, {{0x0B00, 0x0B08}, {0x0B10, 0x0B18}, + {0x1200, 0x12E0} } }, + {NIX_TXSCH_LVL_TL3, 4, 0xFFFF, {{0x1000, 0x10E0}, {0x1600, 0x1608}, +- {0x1610, 0x1618}, {0x1700, 0x17B0} } }, +- {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17B0} } }, ++ {0x1610, 0x1618}, {0x1700, 0x17C8} } }, ++ {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17C8} } }, + {NIX_TXSCH_LVL_TL1, 1, 0xFFFF, {{0x0C00, 0x0D98} } }, + }; + +-- +2.42.0 + diff --git a/queue-5.15/octeontx2-pf-add-missing-mutex-lock-in-otx2_get_paus.patch b/queue-5.15/octeontx2-pf-add-missing-mutex-lock-in-otx2_get_paus.patch new file mode 100644 index 00000000000..48d37440904 --- /dev/null +++ b/queue-5.15/octeontx2-pf-add-missing-mutex-lock-in-otx2_get_paus.patch @@ -0,0 +1,51 @@ +From c3d17af8c005af47641e2a1989afb2c53229141b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 10:53:42 +0530 +Subject: octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam + +From: Subbaraya Sundeep + +[ Upstream commit 9572c949385aa2ef10368287c439bcb7935137c8 ] + +All the mailbox messages sent to AF needs to be guarded +by mutex lock. Add the missing lock in otx2_get_pauseparam +function. + +Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool") +Signed-off-by: Subbaraya Sundeep +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +index dbfa3bc39e34e..fa4b2d833d77b 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +@@ -316,9 +316,12 @@ static void otx2_get_pauseparam(struct net_device *netdev, + if (is_otx2_lbkvf(pfvf->pdev)) + return; + ++ mutex_lock(&pfvf->mbox.lock); + req = otx2_mbox_alloc_msg_cgx_cfg_pause_frm(&pfvf->mbox); +- if (!req) ++ if (!req) { ++ mutex_unlock(&pfvf->mbox.lock); + return; ++ } + + if (!otx2_sync_mbox_msg(&pfvf->mbox)) { + rsp = (struct cgx_pause_frm_cfg *) +@@ -326,6 +329,7 @@ static void otx2_get_pauseparam(struct net_device *netdev, + pause->rx_pause = rsp->rx_pause; + pause->tx_pause = rsp->tx_pause; + } ++ mutex_unlock(&pfvf->mbox.lock); + } + + static int otx2_set_pauseparam(struct net_device *netdev, +-- +2.42.0 + diff --git a/queue-5.15/of-dynamic-fix-of_reconfig_get_state_change-return-v.patch b/queue-5.15/of-dynamic-fix-of_reconfig_get_state_change-return-v.patch new file mode 100644 index 00000000000..1bc1b6e7211 --- /dev/null +++ b/queue-5.15/of-dynamic-fix-of_reconfig_get_state_change-return-v.patch @@ -0,0 +1,41 @@ +From 8e882b5b23dd4043e072ce83c75e8e952a553c18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 15:47:18 +0100 +Subject: of: dynamic: Fix of_reconfig_get_state_change() return value + documentation + +From: Luca Ceresoli + +[ Upstream commit d79972789d17499b6091ded2fc0c6763c501a5ba ] + +The documented numeric return values do not match the actual returned +values. Fix them by using the enum names instead of raw numbers. + +Fixes: b53a2340d0d3 ("of/reconfig: Add of_reconfig_get_state_change() of notifier helper.") +Signed-off-by: Luca Ceresoli +Link: https://lore.kernel.org/r/20231123-fix-of_reconfig_get_state_change-docs-v1-1-f51892050ff9@bootlin.com +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/dynamic.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c +index 0dfbfae15d6a0..ffb7b0446afde 100644 +--- a/drivers/of/dynamic.c ++++ b/drivers/of/dynamic.c +@@ -104,8 +104,9 @@ int of_reconfig_notify(unsigned long action, struct of_reconfig_data *p) + * + * Returns the new state of a device based on the notifier used. + * +- * Return: 0 on device going from enabled to disabled, 1 on device +- * going from disabled to enabled and -1 on no change. ++ * Return: OF_RECONFIG_CHANGE_REMOVE on device going from enabled to ++ * disabled, OF_RECONFIG_CHANGE_ADD on device going from disabled to ++ * enabled and OF_RECONFIG_NO_CHANGE on no change. + */ + int of_reconfig_get_state_change(unsigned long action, struct of_reconfig_data *pr) + { +-- +2.42.0 + diff --git a/queue-5.15/platform-mellanox-add-null-pointer-checks-for-devm_k.patch b/queue-5.15/platform-mellanox-add-null-pointer-checks-for-devm_k.patch new file mode 100644 index 00000000000..52d14c99ce2 --- /dev/null +++ b/queue-5.15/platform-mellanox-add-null-pointer-checks-for-devm_k.patch @@ -0,0 +1,92 @@ +From 5e8e90a806da024c4cdf30f21335be2ac02968fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 13:54:47 +0800 +Subject: platform/mellanox: Add null pointer checks for devm_kasprintf() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kunwu Chan + +[ Upstream commit 2c7c857f5fed997be93047d2de853d7f10c8defe ] + +devm_kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. + +Compile-tested only. + +Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") +Suggested-by: Ilpo Järvinen +Suggested-by: Vadim Pasternak +Signed-off-by: Kunwu Chan +Reviewed-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20231201055447.2356001-1-chentao@kylinos.cn +[ij: split the change into two] +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index 2d4bbe99959ef..925bfc4aef8ce 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1202,6 +1202,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) + attr->dev_attr.show = mlxbf_pmc_event_list_show; + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, "event_list"); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; + attr = NULL; + +@@ -1214,6 +1216,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, + "enable"); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; + attr = NULL; + } +@@ -1240,6 +1244,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, + "counter%d", j); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; + attr = NULL; + +@@ -1251,6 +1257,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, + "event%d", j); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; + attr = NULL; + } +@@ -1283,6 +1291,8 @@ static int mlxbf_pmc_init_perftype_reg(struct device *dev, int blk_num) + attr->nr = blk_num; + attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, + events[j].evt_name); ++ if (!attr->dev_attr.attr.name) ++ return -ENOMEM; + pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; + attr = NULL; + i++; +@@ -1311,6 +1321,8 @@ static int mlxbf_pmc_create_groups(struct device *dev, int blk_num) + pmc->block[blk_num].block_attr_grp.attrs = pmc->block[blk_num].block_attr; + pmc->block[blk_num].block_attr_grp.name = devm_kasprintf( + dev, GFP_KERNEL, pmc->block_name[blk_num]); ++ if (!pmc->block[blk_num].block_attr_grp.name) ++ return -ENOMEM; + pmc->groups[blk_num] = &pmc->block[blk_num].block_attr_grp; + + return 0; +-- +2.42.0 + diff --git a/queue-5.15/platform-mellanox-check-devm_hwmon_device_register_w.patch b/queue-5.15/platform-mellanox-check-devm_hwmon_device_register_w.patch new file mode 100644 index 00000000000..55aeb37e25c --- /dev/null +++ b/queue-5.15/platform-mellanox-check-devm_hwmon_device_register_w.patch @@ -0,0 +1,48 @@ +From fc7046e24e818b35053d8fbd136c29d946d890fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 13:54:47 +0800 +Subject: platform/mellanox: Check devm_hwmon_device_register_with_groups() + return value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kunwu Chan + +[ Upstream commit 3494a594315b56516988afb6854d75dee5b501db ] + +devm_hwmon_device_register_with_groups() returns an error pointer upon +failure. Check its return value for errors. + +Compile-tested only. + +Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") +Suggested-by: Ilpo Järvinen +Suggested-by: Vadim Pasternak +Signed-off-by: Kunwu Chan +Reviewed-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20231201055447.2356001-1-chentao@kylinos.cn +[ij: split the change into two] +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index 925bfc4aef8ce..db7a1d360cd2c 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1454,6 +1454,8 @@ static int mlxbf_pmc_probe(struct platform_device *pdev) + + pmc->hwmon_dev = devm_hwmon_device_register_with_groups( + dev, "bfperf", pmc, pmc->groups); ++ if (IS_ERR(pmc->hwmon_dev)) ++ return PTR_ERR(pmc->hwmon_dev); + platform_set_drvdata(pdev, pmc); + + return 0; +-- +2.42.0 + diff --git a/queue-5.15/platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch b/queue-5.15/platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch new file mode 100644 index 00000000000..23a0a3ee7c3 --- /dev/null +++ b/queue-5.15/platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch @@ -0,0 +1,175 @@ +From 1f5af8a4f0ec1f3c78c7083e3f3f0545c8d7fb22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 21:27:53 +1200 +Subject: platform/x86: asus-wmi: Add support for ROG X13 tablet mode + +From: Luke D. Jones + +[ Upstream commit e397c3c460bf3849384f2f55516d1887617cfca9 ] + +Add quirk for ASUS ROG X13 Flow 2-in-1 to enable tablet mode with +lid flip (all screen rotations). + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20220813092753.6635-2-luke@ljones.dev +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code") +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 15 +++++++++ + drivers/platform/x86/asus-wmi.c | 37 ++++++++++++++++++++++ + drivers/platform/x86/asus-wmi.h | 1 + + include/linux/platform_data/x86/asus-wmi.h | 1 + + 4 files changed, 54 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index f723af0106a1f..2857678efa2eb 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -123,6 +123,11 @@ static struct quirk_entry quirk_asus_use_lid_flip_devid = { + .tablet_switch_mode = asus_wmi_lid_flip_devid, + }; + ++static struct quirk_entry quirk_asus_tablet_mode = { ++ .wmi_backlight_set_devstate = true, ++ .tablet_switch_mode = asus_wmi_lid_flip_rog_devid, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + pr_info("Identified laptop model '%s'\n", dmi->ident); +@@ -471,6 +476,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_use_lid_flip_devid, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUS ROG FLOW X13", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GV301Q"), ++ }, ++ .driver_data = &quirk_asus_tablet_mode, ++ }, + {}, + }; + +@@ -581,6 +595,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, + { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ + { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ ++ { KE_KEY, 0xBD, { KEY_PROG2 } }, /* Lid flip action on ROG xflow laptops */ + { KE_END, 0}, + }; + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 720202837ca3f..8b7a86c6c363f 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -68,6 +68,7 @@ module_param(fnlock_default, bool, 0444); + #define NOTIFY_KBD_FBM 0x99 + #define NOTIFY_KBD_TTP 0xae + #define NOTIFY_LID_FLIP 0xfa ++#define NOTIFY_LID_FLIP_ROG 0xbd + + #define ASUS_WMI_FNLOCK_BIOS_DISABLED BIT(0) + +@@ -410,6 +411,19 @@ static int asus_wmi_input_init(struct asus_wmi *asus) + dev_err(dev, "Error checking for lid-flip: %d\n", result); + } + break; ++ case asus_wmi_lid_flip_rog_devid: ++ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG); ++ if (result < 0) ++ asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; ++ if (result >= 0) { ++ input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); ++ input_report_switch(asus->inputdev, SW_TABLET_MODE, result); ++ } else if (result == -ENODEV) { ++ dev_err(dev, "This device has lid-flip-rog quirk but got ENODEV checking it. This is a bug."); ++ } else { ++ dev_err(dev, "Error checking for lid-flip: %d\n", result); ++ } ++ break; + } + + err = input_register_device(asus->inputdev); +@@ -444,6 +458,17 @@ static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus) + } + } + ++static void lid_flip_rog_tablet_mode_get_state(struct asus_wmi *asus) ++{ ++ int result; ++ ++ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG); ++ if (result >= 0) { ++ input_report_switch(asus->inputdev, SW_TABLET_MODE, result); ++ input_sync(asus->inputdev); ++ } ++} ++ + /* dGPU ********************************************************************/ + static int dgpu_disable_check_present(struct asus_wmi *asus) + { +@@ -2556,6 +2581,12 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus) + return; + } + ++ if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_rog_devid && ++ code == NOTIFY_LID_FLIP_ROG) { ++ lid_flip_rog_tablet_mode_get_state(asus); ++ return; ++ } ++ + if (asus->fan_boost_mode_available && code == NOTIFY_KBD_FBM) { + fan_boost_mode_switch_next(asus); + return; +@@ -3189,6 +3220,9 @@ static int asus_hotk_resume(struct device *device) + case asus_wmi_lid_flip_devid: + lid_flip_tablet_mode_get_state(asus); + break; ++ case asus_wmi_lid_flip_rog_devid: ++ lid_flip_rog_tablet_mode_get_state(asus); ++ break; + } + + return 0; +@@ -3237,6 +3271,9 @@ static int asus_hotk_restore(struct device *device) + case asus_wmi_lid_flip_devid: + lid_flip_tablet_mode_get_state(asus); + break; ++ case asus_wmi_lid_flip_rog_devid: ++ lid_flip_rog_tablet_mode_get_state(asus); ++ break; + } + + return 0; +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index f0302a51c5196..b817a312f2e1a 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -29,6 +29,7 @@ enum asus_wmi_tablet_switch_mode { + asus_wmi_no_tablet_switch, + asus_wmi_kbd_dock_devid, + asus_wmi_lid_flip_devid, ++ asus_wmi_lid_flip_rog_devid, + }; + + struct quirk_entry { +diff --git a/include/linux/platform_data/x86/asus-wmi.h b/include/linux/platform_data/x86/asus-wmi.h +index 17dc5cb6f3f29..1b20b5e7a76ba 100644 +--- a/include/linux/platform_data/x86/asus-wmi.h ++++ b/include/linux/platform_data/x86/asus-wmi.h +@@ -64,6 +64,7 @@ + #define ASUS_WMI_DEVID_PANEL_OD 0x00050019 + #define ASUS_WMI_DEVID_CAMERA 0x00060013 + #define ASUS_WMI_DEVID_LID_FLIP 0x00060062 ++#define ASUS_WMI_DEVID_LID_FLIP_ROG 0x00060077 + + /* Storage */ + #define ASUS_WMI_DEVID_CARDREADER 0x00080013 +-- +2.42.0 + diff --git a/queue-5.15/platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch b/queue-5.15/platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch new file mode 100644 index 00000000000..d96381a954d --- /dev/null +++ b/queue-5.15/platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch @@ -0,0 +1,220 @@ +From 8271da67e10e22a9a00f06669438df0f2ac47160 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 21:27:52 +1200 +Subject: platform/x86: asus-wmi: Adjust tablet/lidflip handling to use enum + +From: Luke D. Jones + +[ Upstream commit 00aa846955fbfb04f7bc0c26c49febfe5395eca1 ] + +Due to multiple types of tablet/lidflip, the existing code for +handling these events is refactored to use an enum for each type. + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20220813092753.6635-1-luke@ljones.dev +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code") +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 13 +++----- + drivers/platform/x86/asus-wmi.c | 49 +++++++++++++++++++++--------- + drivers/platform/x86/asus-wmi.h | 9 ++++-- + 3 files changed, 47 insertions(+), 24 deletions(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 59ca3dab59e10..f723af0106a1f 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -115,12 +115,12 @@ static struct quirk_entry quirk_asus_forceals = { + }; + + static struct quirk_entry quirk_asus_use_kbd_dock_devid = { +- .use_kbd_dock_devid = true, ++ .tablet_switch_mode = asus_wmi_kbd_dock_devid, + }; + + static struct quirk_entry quirk_asus_use_lid_flip_devid = { + .wmi_backlight_set_devstate = true, +- .use_lid_flip_devid = true, ++ .tablet_switch_mode = asus_wmi_lid_flip_devid, + }; + + static int dmi_matched(const struct dmi_system_id *dmi) +@@ -492,16 +492,13 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) + + switch (tablet_mode_sw) { + case 0: +- quirks->use_kbd_dock_devid = false; +- quirks->use_lid_flip_devid = false; ++ quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; + break; + case 1: +- quirks->use_kbd_dock_devid = true; +- quirks->use_lid_flip_devid = false; ++ quirks->tablet_switch_mode = asus_wmi_kbd_dock_devid; + break; + case 2: +- quirks->use_kbd_dock_devid = false; +- quirks->use_lid_flip_devid = true; ++ quirks->tablet_switch_mode = asus_wmi_lid_flip_devid; + break; + } + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index f030ea97f1266..720202837ca3f 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -366,8 +366,11 @@ static bool asus_wmi_dev_is_present(struct asus_wmi *asus, u32 dev_id) + + static int asus_wmi_input_init(struct asus_wmi *asus) + { ++ struct device *dev; + int err, result; + ++ dev = &asus->platform_device->dev; ++ + asus->inputdev = input_allocate_device(); + if (!asus->inputdev) + return -ENOMEM; +@@ -375,35 +378,38 @@ static int asus_wmi_input_init(struct asus_wmi *asus) + asus->inputdev->name = asus->driver->input_name; + asus->inputdev->phys = asus->driver->input_phys; + asus->inputdev->id.bustype = BUS_HOST; +- asus->inputdev->dev.parent = &asus->platform_device->dev; ++ asus->inputdev->dev.parent = dev; + set_bit(EV_REP, asus->inputdev->evbit); + + err = sparse_keymap_setup(asus->inputdev, asus->driver->keymap, NULL); + if (err) + goto err_free_dev; + +- if (asus->driver->quirks->use_kbd_dock_devid) { ++ switch (asus->driver->quirks->tablet_switch_mode) { ++ case asus_wmi_no_tablet_switch: ++ break; ++ case asus_wmi_kbd_dock_devid: + result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_KBD_DOCK); + if (result >= 0) { + input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); + input_report_switch(asus->inputdev, SW_TABLET_MODE, !result); + } else if (result != -ENODEV) { +- pr_err("Error checking for keyboard-dock: %d\n", result); ++ dev_err(dev, "Error checking for keyboard-dock: %d\n", result); + } +- } +- +- if (asus->driver->quirks->use_lid_flip_devid) { ++ break; ++ case asus_wmi_lid_flip_devid: + result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP); + if (result < 0) +- asus->driver->quirks->use_lid_flip_devid = 0; ++ asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; + if (result >= 0) { + input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); + input_report_switch(asus->inputdev, SW_TABLET_MODE, result); + } else if (result == -ENODEV) { +- pr_err("This device has lid_flip quirk but got ENODEV checking it. This is a bug."); ++ dev_err(dev, "This device has lid_flip quirk but got ENODEV checking it. This is a bug."); + } else { +- pr_err("Error checking for lid-flip: %d\n", result); ++ dev_err(dev, "Error checking for lid-flip: %d\n", result); + } ++ break; + } + + err = input_register_device(asus->inputdev); +@@ -429,8 +435,9 @@ static void asus_wmi_input_exit(struct asus_wmi *asus) + + static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus) + { +- int result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP); ++ int result; + ++ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP); + if (result >= 0) { + input_report_switch(asus->inputdev, SW_TABLET_MODE, result); + input_sync(asus->inputdev); +@@ -2531,7 +2538,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus) + return; + } + +- if (asus->driver->quirks->use_kbd_dock_devid && code == NOTIFY_KBD_DOCK_CHANGE) { ++ if (asus->driver->quirks->tablet_switch_mode == asus_wmi_kbd_dock_devid && ++ code == NOTIFY_KBD_DOCK_CHANGE) { + result = asus_wmi_get_devstate_simple(asus, + ASUS_WMI_DEVID_KBD_DOCK); + if (result >= 0) { +@@ -2542,7 +2550,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus) + return; + } + +- if (asus->driver->quirks->use_lid_flip_devid && code == NOTIFY_LID_FLIP) { ++ if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_devid && ++ code == NOTIFY_LID_FLIP) { + lid_flip_tablet_mode_get_state(asus); + return; + } +@@ -3173,8 +3182,14 @@ static int asus_hotk_resume(struct device *device) + if (asus_wmi_has_fnlock_key(asus)) + asus_wmi_fnlock_update(asus); + +- if (asus->driver->quirks->use_lid_flip_devid) ++ switch (asus->driver->quirks->tablet_switch_mode) { ++ case asus_wmi_no_tablet_switch: ++ case asus_wmi_kbd_dock_devid: ++ break; ++ case asus_wmi_lid_flip_devid: + lid_flip_tablet_mode_get_state(asus); ++ break; ++ } + + return 0; + } +@@ -3215,8 +3230,14 @@ static int asus_hotk_restore(struct device *device) + if (asus_wmi_has_fnlock_key(asus)) + asus_wmi_fnlock_update(asus); + +- if (asus->driver->quirks->use_lid_flip_devid) ++ switch (asus->driver->quirks->tablet_switch_mode) { ++ case asus_wmi_no_tablet_switch: ++ case asus_wmi_kbd_dock_devid: ++ break; ++ case asus_wmi_lid_flip_devid: + lid_flip_tablet_mode_get_state(asus); ++ break; ++ } + + return 0; + } +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 49f2b8f8ad3eb..f0302a51c5196 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -25,6 +25,12 @@ struct module; + struct key_entry; + struct asus_wmi; + ++enum asus_wmi_tablet_switch_mode { ++ asus_wmi_no_tablet_switch, ++ asus_wmi_kbd_dock_devid, ++ asus_wmi_lid_flip_devid, ++}; ++ + struct quirk_entry { + bool hotplug_wireless; + bool scalar_panel_brightness; +@@ -33,8 +39,7 @@ struct quirk_entry { + bool wmi_backlight_native; + bool wmi_backlight_set_devstate; + bool wmi_force_als_set; +- bool use_kbd_dock_devid; +- bool use_lid_flip_devid; ++ enum asus_wmi_tablet_switch_mode tablet_switch_mode; + int wapf; + /* + * For machines with AMD graphic chips, it will send out WMI event +-- +2.42.0 + diff --git a/queue-5.15/platform-x86-asus-wmi-move-i8042-filter-install-to-s.patch b/queue-5.15/platform-x86-asus-wmi-move-i8042-filter-install-to-s.patch new file mode 100644 index 00000000000..3995767e3b5 --- /dev/null +++ b/queue-5.15/platform-x86-asus-wmi-move-i8042-filter-install-to-s.patch @@ -0,0 +1,111 @@ +From b74036ca1d85900dfe0e7f411f874c2b672dc3ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:42:33 +0100 +Subject: platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi + code +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit b52cbca22cbf6c9d2700c1e576d0ddcc670e49d5 ] + +asus-nb-wmi calls i8042_install_filter() in some cases, but it never +calls i8042_remove_filter(). This means that a dangling pointer to +the filter function is left after rmmod leading to crashes. + +Fix this by moving the i8042-filter installation to the shared +asus-wmi code and also remove it from the shared code on driver unbind. + +Fixes: b5643539b825 ("platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A") +Cc: Oleksij Rempel +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20231120154235.610808-2-hdegoede@redhat.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/Kconfig | 2 +- + drivers/platform/x86/asus-nb-wmi.c | 11 ----------- + drivers/platform/x86/asus-wmi.c | 8 ++++++++ + 3 files changed, 9 insertions(+), 12 deletions(-) + +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index 50abcf0c483c3..c03367b13db62 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -257,6 +257,7 @@ config ASUS_WMI + depends on RFKILL || RFKILL = n + depends on HOTPLUG_PCI + depends on ACPI_VIDEO || ACPI_VIDEO = n ++ depends on SERIO_I8042 || SERIO_I8042 = n + select INPUT_SPARSEKMAP + select LEDS_CLASS + select NEW_LEDS +@@ -271,7 +272,6 @@ config ASUS_WMI + config ASUS_NB_WMI + tristate "Asus Notebook WMI Driver" + depends on ASUS_WMI +- depends on SERIO_I8042 || SERIO_I8042 = n + help + This is a driver for newer Asus notebooks. It adds extra features + like wireless radio and bluetooth control, leds, hotkeys, backlight... +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 7b8942fee76dd..49505939352ae 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -490,8 +490,6 @@ static const struct dmi_system_id asus_quirks[] = { + + static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) + { +- int ret; +- + quirks = &quirk_asus_unknown; + dmi_check_system(asus_quirks); + +@@ -506,15 +504,6 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) + + if (tablet_mode_sw != -1) + quirks->tablet_switch_mode = tablet_mode_sw; +- +- if (quirks->i8042_filter) { +- ret = i8042_install_filter(quirks->i8042_filter); +- if (ret) { +- pr_warn("Unable to install key filter\n"); +- return; +- } +- pr_info("Using i8042 filter function for receiving events\n"); +- } + } + + static const struct key_entry asus_nb_wmi_keymap[] = { +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index e7a01accf4ff1..2a06831449d5d 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -3092,6 +3092,12 @@ static int asus_wmi_add(struct platform_device *pdev) + goto fail_wmi_handler; + } + ++ if (asus->driver->quirks->i8042_filter) { ++ err = i8042_install_filter(asus->driver->quirks->i8042_filter); ++ if (err) ++ pr_warn("Unable to install key filter - %d\n", err); ++ } ++ + asus_wmi_battery_init(asus); + + asus_wmi_debugfs_init(asus); +@@ -3128,6 +3134,8 @@ static int asus_wmi_remove(struct platform_device *device) + struct asus_wmi *asus; + + asus = platform_get_drvdata(device); ++ if (asus->driver->quirks->i8042_filter) ++ i8042_remove_filter(asus->driver->quirks->i8042_filter); + wmi_remove_notify_handler(asus->driver->event_guid); + asus_wmi_backlight_exit(asus); + asus_wmi_input_exit(asus); +-- +2.42.0 + diff --git a/queue-5.15/platform-x86-asus-wmi-simplify-tablet-mode-switch-ha.patch b/queue-5.15/platform-x86-asus-wmi-simplify-tablet-mode-switch-ha.patch new file mode 100644 index 00000000000..03ad43e0166 --- /dev/null +++ b/queue-5.15/platform-x86-asus-wmi-simplify-tablet-mode-switch-ha.patch @@ -0,0 +1,192 @@ +From 2e120f8acb23c90a2c707e87332da34620ee9286 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 17:11:45 +0200 +Subject: platform/x86: asus-wmi: Simplify tablet-mode-switch handling + +From: Hans de Goede + +[ Upstream commit 1ea0d3b46798afc35c3185f6058b8bc08525d56c ] + +Simplify tablet-mode-switch handling: +1. The code is the same for all variants, the only difference is the + dev_id and notify event code. Store the dev_id + code in struct asus_wmi + and unify the handling +2. Make the new unified asus_wmi_tablet_mode_get_state() check dev_id has + been set and make it a no-op when not set. This allows calling it + unconditionally at resume/restore time +3. Simplify the tablet_mode_sw module-param handling, this also allows + selecting the new lid-flip-rog type through the module-param. + +Cc: Luke D. Jones +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20220824151145.1448010-2-hdegoede@redhat.com +Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code") +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 13 +---- + drivers/platform/x86/asus-wmi.c | 76 ++++++------------------------ + 2 files changed, 16 insertions(+), 73 deletions(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 2857678efa2eb..7b8942fee76dd 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -504,17 +504,8 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) + else + wapf = quirks->wapf; + +- switch (tablet_mode_sw) { +- case 0: +- quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; +- break; +- case 1: +- quirks->tablet_switch_mode = asus_wmi_kbd_dock_devid; +- break; +- case 2: +- quirks->tablet_switch_mode = asus_wmi_lid_flip_devid; +- break; +- } ++ if (tablet_mode_sw != -1) ++ quirks->tablet_switch_mode = tablet_mode_sw; + + if (quirks->i8042_filter) { + ret = i8042_install_filter(quirks->i8042_filter); +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 35b2fbb466b45..e7a01accf4ff1 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -204,6 +204,9 @@ struct asus_wmi { + struct asus_rfkill gps; + struct asus_rfkill uwb; + ++ int tablet_switch_event_code; ++ u32 tablet_switch_dev_id; ++ + enum fan_type fan_type; + int fan_pwm_mode; + int agfn_pwm; +@@ -370,11 +373,11 @@ static void asus_wmi_tablet_sw_init(struct asus_wmi *asus, u32 dev_id, int event + int result; + + result = asus_wmi_get_devstate_simple(asus, dev_id); +- if (result < 0) +- asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; + if (result >= 0) { + input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); + input_report_switch(asus->inputdev, SW_TABLET_MODE, result); ++ asus->tablet_switch_dev_id = dev_id; ++ asus->tablet_switch_event_code = event_code; + } else if (result == -ENODEV) { + dev_err(dev, "This device has tablet-mode-switch quirk but got ENODEV checking it. This is a bug."); + } else { +@@ -436,22 +439,14 @@ static void asus_wmi_input_exit(struct asus_wmi *asus) + + /* Tablet mode ****************************************************************/ + +-static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus) ++static void asus_wmi_tablet_mode_get_state(struct asus_wmi *asus) + { + int result; + +- result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP); +- if (result >= 0) { +- input_report_switch(asus->inputdev, SW_TABLET_MODE, result); +- input_sync(asus->inputdev); +- } +-} +- +-static void lid_flip_rog_tablet_mode_get_state(struct asus_wmi *asus) +-{ +- int result; ++ if (!asus->tablet_switch_dev_id) ++ return; + +- result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG); ++ result = asus_wmi_get_devstate_simple(asus, asus->tablet_switch_dev_id); + if (result >= 0) { + input_report_switch(asus->inputdev, SW_TABLET_MODE, result); + input_sync(asus->inputdev); +@@ -2507,9 +2502,7 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus) + { + unsigned int key_value = 1; + bool autorelease = 1; +- int result, orig_code; +- +- orig_code = code; ++ int orig_code = code; + + if (asus->driver->key_filter) { + asus->driver->key_filter(asus->driver, &code, &key_value, +@@ -2552,27 +2545,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus) + return; + } + +- if (asus->driver->quirks->tablet_switch_mode == asus_wmi_kbd_dock_devid && +- code == NOTIFY_KBD_DOCK_CHANGE) { +- result = asus_wmi_get_devstate_simple(asus, +- ASUS_WMI_DEVID_KBD_DOCK); +- if (result >= 0) { +- input_report_switch(asus->inputdev, SW_TABLET_MODE, +- !result); +- input_sync(asus->inputdev); +- } +- return; +- } +- +- if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_devid && +- code == NOTIFY_LID_FLIP) { +- lid_flip_tablet_mode_get_state(asus); +- return; +- } +- +- if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_rog_devid && +- code == NOTIFY_LID_FLIP_ROG) { +- lid_flip_rog_tablet_mode_get_state(asus); ++ if (code == asus->tablet_switch_event_code) { ++ asus_wmi_tablet_mode_get_state(asus); + return; + } + +@@ -3202,18 +3176,7 @@ static int asus_hotk_resume(struct device *device) + if (asus_wmi_has_fnlock_key(asus)) + asus_wmi_fnlock_update(asus); + +- switch (asus->driver->quirks->tablet_switch_mode) { +- case asus_wmi_no_tablet_switch: +- case asus_wmi_kbd_dock_devid: +- break; +- case asus_wmi_lid_flip_devid: +- lid_flip_tablet_mode_get_state(asus); +- break; +- case asus_wmi_lid_flip_rog_devid: +- lid_flip_rog_tablet_mode_get_state(asus); +- break; +- } +- ++ asus_wmi_tablet_mode_get_state(asus); + return 0; + } + +@@ -3253,18 +3216,7 @@ static int asus_hotk_restore(struct device *device) + if (asus_wmi_has_fnlock_key(asus)) + asus_wmi_fnlock_update(asus); + +- switch (asus->driver->quirks->tablet_switch_mode) { +- case asus_wmi_no_tablet_switch: +- case asus_wmi_kbd_dock_devid: +- break; +- case asus_wmi_lid_flip_devid: +- lid_flip_tablet_mode_get_state(asus); +- break; +- case asus_wmi_lid_flip_rog_devid: +- lid_flip_rog_tablet_mode_get_state(asus); +- break; +- } +- ++ asus_wmi_tablet_mode_get_state(asus); + return 0; + } + +-- +2.42.0 + diff --git a/queue-5.15/platform-x86-asus-wmi-simplify-tablet-mode-switch-pr.patch b/queue-5.15/platform-x86-asus-wmi-simplify-tablet-mode-switch-pr.patch new file mode 100644 index 00000000000..e1b29ed21f0 --- /dev/null +++ b/queue-5.15/platform-x86-asus-wmi-simplify-tablet-mode-switch-pr.patch @@ -0,0 +1,107 @@ +From b780e4a84b0243f398a371be17e445dbe0ce4175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 17:11:44 +0200 +Subject: platform/x86: asus-wmi: Simplify tablet-mode-switch probing + +From: Hans de Goede + +[ Upstream commit c98dc61ee08f833e68337700546e120e2edac7c9 ] + +The 3 different tablet-mode-switch initialization paths repeat a lot +of the same code. Add a helper function for this. + +This also makes the error-handling for the kbd_dock_devid case consistent +with the other 2 cases. + +Cc: Luke D. Jones +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20220824151145.1448010-1-hdegoede@redhat.com +Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code") +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 55 +++++++++++++-------------------- + 1 file changed, 22 insertions(+), 33 deletions(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 8b7a86c6c363f..35b2fbb466b45 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -364,13 +364,28 @@ static bool asus_wmi_dev_is_present(struct asus_wmi *asus, u32 dev_id) + } + + /* Input **********************************************************************/ ++static void asus_wmi_tablet_sw_init(struct asus_wmi *asus, u32 dev_id, int event_code) ++{ ++ struct device *dev = &asus->platform_device->dev; ++ int result; ++ ++ result = asus_wmi_get_devstate_simple(asus, dev_id); ++ if (result < 0) ++ asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; ++ if (result >= 0) { ++ input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); ++ input_report_switch(asus->inputdev, SW_TABLET_MODE, result); ++ } else if (result == -ENODEV) { ++ dev_err(dev, "This device has tablet-mode-switch quirk but got ENODEV checking it. This is a bug."); ++ } else { ++ dev_err(dev, "Error checking for tablet-mode-switch: %d\n", result); ++ } ++} + + static int asus_wmi_input_init(struct asus_wmi *asus) + { +- struct device *dev; +- int err, result; +- +- dev = &asus->platform_device->dev; ++ struct device *dev = &asus->platform_device->dev; ++ int err; + + asus->inputdev = input_allocate_device(); + if (!asus->inputdev) +@@ -390,39 +405,13 @@ static int asus_wmi_input_init(struct asus_wmi *asus) + case asus_wmi_no_tablet_switch: + break; + case asus_wmi_kbd_dock_devid: +- result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_KBD_DOCK); +- if (result >= 0) { +- input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); +- input_report_switch(asus->inputdev, SW_TABLET_MODE, !result); +- } else if (result != -ENODEV) { +- dev_err(dev, "Error checking for keyboard-dock: %d\n", result); +- } ++ asus_wmi_tablet_sw_init(asus, ASUS_WMI_DEVID_KBD_DOCK, NOTIFY_KBD_DOCK_CHANGE); + break; + case asus_wmi_lid_flip_devid: +- result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP); +- if (result < 0) +- asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; +- if (result >= 0) { +- input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); +- input_report_switch(asus->inputdev, SW_TABLET_MODE, result); +- } else if (result == -ENODEV) { +- dev_err(dev, "This device has lid_flip quirk but got ENODEV checking it. This is a bug."); +- } else { +- dev_err(dev, "Error checking for lid-flip: %d\n", result); +- } ++ asus_wmi_tablet_sw_init(asus, ASUS_WMI_DEVID_LID_FLIP, NOTIFY_LID_FLIP); + break; + case asus_wmi_lid_flip_rog_devid: +- result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG); +- if (result < 0) +- asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; +- if (result >= 0) { +- input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); +- input_report_switch(asus->inputdev, SW_TABLET_MODE, result); +- } else if (result == -ENODEV) { +- dev_err(dev, "This device has lid-flip-rog quirk but got ENODEV checking it. This is a bug."); +- } else { +- dev_err(dev, "Error checking for lid-flip: %d\n", result); +- } ++ asus_wmi_tablet_sw_init(asus, ASUS_WMI_DEVID_LID_FLIP_ROG, NOTIFY_LID_FLIP_ROG); + break; + } + +-- +2.42.0 + diff --git a/queue-5.15/platform-x86-wmi-allow-duplicate-guids-for-drivers-t.patch b/queue-5.15/platform-x86-wmi-allow-duplicate-guids-for-drivers-t.patch new file mode 100644 index 00000000000..ffc2636b46d --- /dev/null +++ b/queue-5.15/platform-x86-wmi-allow-duplicate-guids-for-drivers-t.patch @@ -0,0 +1,136 @@ +From 0b6fb9b0fe953cb2c95b405f916e366004223d8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 15:14:59 -0500 +Subject: platform/x86: wmi: Allow duplicate GUIDs for drivers that use struct + wmi_driver + +From: Mario Limonciello + +[ Upstream commit 134038b075cb1dae21623499d765973d286ac94a ] + +The WMI subsystem in the kernel currently tracks WMI devices by +a GUID string not by ACPI device. The GUID used by the `wmi-bmof` +module however is available from many devices on nearly every machine. + +This originally was thought to be a bug, but as it happens on most +machines it is a design mistake. It has been fixed by tying an ACPI +device to the driver with struct wmi_driver. So drivers that have +moved over to struct wmi_driver can actually support multiple +instantiations of a GUID without any problem. + +Add an allow list into wmi.c for GUIDs that the drivers that are known +to use struct wmi_driver. The list is populated with `wmi-bmof` right +now. The additional instances of that in sysfs with be suffixed with -%d + +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20220829201500.6341-1-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Stable-dep-of: cbf54f37600e ("platform/x86: wmi: Skip blocks with zero instances") +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/wmi.c | 49 +++++++++++++++++++++++++++++++------- + 1 file changed, 40 insertions(+), 9 deletions(-) + +diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c +index 63265ab964245..ce3380f09a472 100644 +--- a/drivers/platform/x86/wmi.c ++++ b/drivers/platform/x86/wmi.c +@@ -99,6 +99,12 @@ static const struct acpi_device_id wmi_device_ids[] = { + }; + MODULE_DEVICE_TABLE(acpi, wmi_device_ids); + ++/* allow duplicate GUIDs as these device drivers use struct wmi_driver */ ++static const char * const allow_duplicates[] = { ++ "05901221-D566-11D1-B2F0-00A0C9062910", /* wmi-bmof */ ++ NULL ++}; ++ + static struct platform_driver acpi_wmi_driver = { + .driver = { + .name = "acpi-wmi", +@@ -1039,6 +1045,23 @@ static const struct device_type wmi_type_data = { + .release = wmi_dev_release, + }; + ++/* ++ * _WDG is a static list that is only parsed at startup, ++ * so it's safe to count entries without extra protection. ++ */ ++static int guid_count(const guid_t *guid) ++{ ++ struct wmi_block *wblock; ++ int count = 0; ++ ++ list_for_each_entry(wblock, &wmi_block_list, list) { ++ if (guid_equal(&wblock->gblock.guid, guid)) ++ count++; ++ } ++ ++ return count; ++} ++ + static int wmi_create_device(struct device *wmi_bus_dev, + struct wmi_block *wblock, + struct acpi_device *device) +@@ -1046,6 +1069,7 @@ static int wmi_create_device(struct device *wmi_bus_dev, + struct acpi_device_info *info; + char method[5]; + int result; ++ uint count; + + if (wblock->gblock.flags & ACPI_WMI_EVENT) { + wblock->dev.dev.type = &wmi_type_event; +@@ -1102,7 +1126,11 @@ static int wmi_create_device(struct device *wmi_bus_dev, + wblock->dev.dev.bus = &wmi_bus_type; + wblock->dev.dev.parent = wmi_bus_dev; + +- dev_set_name(&wblock->dev.dev, "%pUL", &wblock->gblock.guid); ++ count = guid_count(&wblock->gblock.guid); ++ if (count) ++ dev_set_name(&wblock->dev.dev, "%pUL-%d", &wblock->gblock.guid, count); ++ else ++ dev_set_name(&wblock->dev.dev, "%pUL", &wblock->gblock.guid); + + device_initialize(&wblock->dev.dev); + +@@ -1122,11 +1150,20 @@ static void wmi_free_devices(struct acpi_device *device) + } + } + +-static bool guid_already_parsed(struct acpi_device *device, const guid_t *guid) ++static bool guid_already_parsed_for_legacy(struct acpi_device *device, const guid_t *guid) + { + struct wmi_block *wblock; + + list_for_each_entry(wblock, &wmi_block_list, list) { ++ /* skip warning and register if we know the driver will use struct wmi_driver */ ++ for (int i = 0; allow_duplicates[i] != NULL; i++) { ++ guid_t tmp; ++ ++ if (guid_parse(allow_duplicates[i], &tmp)) ++ continue; ++ if (guid_equal(&tmp, guid)) ++ return false; ++ } + if (guid_equal(&wblock->gblock.guid, guid)) { + /* + * Because we historically didn't track the relationship +@@ -1176,13 +1213,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device) + if (debug_dump_wdg) + wmi_dump_wdg(&gblock[i]); + +- /* +- * Some WMI devices, like those for nVidia hooks, have a +- * duplicate GUID. It's not clear what we should do in this +- * case yet, so for now, we'll just ignore the duplicate +- * for device creation. +- */ +- if (guid_already_parsed(device, &gblock[i].guid)) ++ if (guid_already_parsed_for_legacy(device, &gblock[i].guid)) + continue; + + wblock = kzalloc(sizeof(struct wmi_block), GFP_KERNEL); +-- +2.42.0 + diff --git a/queue-5.15/platform-x86-wmi-skip-blocks-with-zero-instances.patch b/queue-5.15/platform-x86-wmi-skip-blocks-with-zero-instances.patch new file mode 100644 index 00000000000..9798f6463f2 --- /dev/null +++ b/queue-5.15/platform-x86-wmi-skip-blocks-with-zero-instances.patch @@ -0,0 +1,49 @@ +From 87c2b93c70757e5cb6abb171bebf1808ae270bf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 19:16:54 +0100 +Subject: platform/x86: wmi: Skip blocks with zero instances +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit cbf54f37600e874d82886aa3b2f471778cae01ce ] + +Some machines like the HP Omen 17 ck2000nf contain WMI blocks +with zero instances, so any WMI driver which tries to handle the +associated WMI device will fail. +Skip such WMI blocks to avoid confusing any WMI drivers. + +Reported-by: Alexis Belmonte +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218188 +Fixes: bff431e49ff5 ("ACPI: WMI: Add ACPI-WMI mapping driver") +Tested-by: Alexis Belmonte +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20231129181654.5800-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/wmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c +index ce3380f09a472..7bb849aaa99e1 100644 +--- a/drivers/platform/x86/wmi.c ++++ b/drivers/platform/x86/wmi.c +@@ -1213,6 +1213,11 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device) + if (debug_dump_wdg) + wmi_dump_wdg(&gblock[i]); + ++ if (!gblock[i].instance_count) { ++ dev_info(wmi_bus_dev, FW_INFO "%pUL has zero instances\n", &gblock[i].guid); ++ continue; ++ } ++ + if (guid_already_parsed_for_legacy(device, &gblock[i].guid)) + continue; + +-- +2.42.0 + diff --git a/queue-5.15/psample-require-cap_net_admin-when-joining-packets-g.patch b/queue-5.15/psample-require-cap_net_admin-when-joining-packets-g.patch new file mode 100644 index 00000000000..553a61bc5b5 --- /dev/null +++ b/queue-5.15/psample-require-cap_net_admin-when-joining-packets-g.patch @@ -0,0 +1,117 @@ +From 58eea1b790ed6391eedb1c7aea43d5811e945733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 23:31:01 +0200 +Subject: psample: Require 'CAP_NET_ADMIN' when joining "packets" group + +From: Ido Schimmel + +[ Upstream commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 ] + +The "psample" generic netlink family notifies sampled packets over the +"packets" multicast group. This is problematic since by default generic +netlink allows non-root users to listen to these notifications. + +Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will +prevent non-root users or root without the 'CAP_NET_ADMIN' capability +(in the user namespace owning the network namespace) from joining the +group. + +Tested using [1]. + +Before: + + # capsh -- -c ./psample_repo + # capsh --drop=cap_net_admin -- -c ./psample_repo + +After: + + # capsh -- -c ./psample_repo + # capsh --drop=cap_net_admin -- -c ./psample_repo + Failed to join "packets" multicast group + +[1] + $ cat psample.c + #include + #include + #include + #include + + int join_grp(struct nl_sock *sk, const char *grp_name) + { + int grp, err; + + grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); + if (grp < 0) { + fprintf(stderr, "Failed to resolve \"%s\" multicast group\n", + grp_name); + return grp; + } + + err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); + if (err) { + fprintf(stderr, "Failed to join \"%s\" multicast group\n", + grp_name); + return err; + } + + return 0; + } + + int main(int argc, char **argv) + { + struct nl_sock *sk; + int err; + + sk = nl_socket_alloc(); + if (!sk) { + fprintf(stderr, "Failed to allocate socket\n"); + return -1; + } + + err = genl_connect(sk); + if (err) { + fprintf(stderr, "Failed to connect socket\n"); + return err; + } + + err = join_grp(sk, "config"); + if (err) + return err; + + err = join_grp(sk, "packets"); + if (err) + return err; + + return 0; + } + $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c + +Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") +Reported-by: "The UK's National Cyber Security Centre (NCSC)" +Signed-off-by: Ido Schimmel +Reviewed-by: Jacob Keller +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20231206213102.1824398-2-idosch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/psample/psample.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/psample/psample.c b/net/psample/psample.c +index 118d5d2a81a02..0d9d9936579e0 100644 +--- a/net/psample/psample.c ++++ b/net/psample/psample.c +@@ -31,7 +31,8 @@ enum psample_nl_multicast_groups { + + static const struct genl_multicast_group psample_nl_mcgrps[] = { + [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME }, +- [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME }, ++ [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME, ++ .flags = GENL_UNS_ADMIN_PERM }, + }; + + static struct genl_family psample_nl_family __ro_after_init; +-- +2.42.0 + diff --git a/queue-5.15/r8152-add-rtl8152_inaccessible-checks-to-more-loops.patch b/queue-5.15/r8152-add-rtl8152_inaccessible-checks-to-more-loops.patch new file mode 100644 index 00000000000..02606ff24c2 --- /dev/null +++ b/queue-5.15/r8152-add-rtl8152_inaccessible-checks-to-more-loops.patch @@ -0,0 +1,72 @@ +From c6a6f6b702a76466fe045e41e4c0032a0811295b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 13:25:21 -0800 +Subject: r8152: Add RTL8152_INACCESSIBLE checks to more loops + +From: Douglas Anderson + +[ Upstream commit 32a574c7e2685aa8138754d4d755f9246cc6bd48 ] + +Previous commits added checks for RTL8152_INACCESSIBLE in the loops in +the driver. There are still a few more that keep tripping the driver +up in error cases and make things take longer than they should. Add +those in. + +All the loops that are part of this commit existed in some form or +another since the r8152 driver was first introduced, though +RTL8152_INACCESSIBLE was known as RTL8152_UNPLUG before commit +715f67f33af4 ("r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE") + +Fixes: ac718b69301c ("net/usb: new driver for RTL8152") +Reviewed-by: Grant Grundler +Signed-off-by: Douglas Anderson +Acked-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 7a353409928a6..1bb304857a744 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2850,6 +2850,8 @@ static void rtl8152_nic_reset(struct r8152 *tp) + ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CR, CR_RST); + + for (i = 0; i < 1000; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + if (!(ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CR) & CR_RST)) + break; + usleep_range(100, 400); +@@ -3179,6 +3181,8 @@ static void rtl_disable(struct r8152 *tp) + rxdy_gated_en(tp, true); + + for (i = 0; i < 1000; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL); + if ((ocp_data & FIFO_EMPTY) == FIFO_EMPTY) + break; +@@ -3186,6 +3190,8 @@ static void rtl_disable(struct r8152 *tp) + } + + for (i = 0; i < 1000; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_TCR0) & TCR0_TX_EMPTY) + break; + usleep_range(1000, 2000); +@@ -5374,6 +5380,8 @@ static void wait_oob_link_list_ready(struct r8152 *tp) + int i; + + for (i = 0; i < 1000; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL); + if (ocp_data & LINK_LIST_READY) + break; +-- +2.42.0 + diff --git a/queue-5.15/r8152-add-rtl8152_inaccessible-to-r8153_aldps_en.patch b/queue-5.15/r8152-add-rtl8152_inaccessible-to-r8153_aldps_en.patch new file mode 100644 index 00000000000..8bc40135cd4 --- /dev/null +++ b/queue-5.15/r8152-add-rtl8152_inaccessible-to-r8153_aldps_en.patch @@ -0,0 +1,39 @@ +From f8dfc1b2934cb672995eb71d66ce0a318ef2a781 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 13:25:24 -0800 +Subject: r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en() + +From: Douglas Anderson + +[ Upstream commit 79321a793945fdbff2f405f84712d0ab81bed287 ] + +Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set +so that they don't delay too long if the device becomes +inaccessible. Add the break to the loop in r8153_aldps_en(). + +Fixes: 4214cc550bf9 ("r8152: check if disabling ALDPS is finished") +Reviewed-by: Grant Grundler +Signed-off-by: Douglas Anderson +Acked-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index da3a2a5584a58..54779caf18f9b 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5678,6 +5678,8 @@ static void r8153_aldps_en(struct r8152 *tp, bool enable) + data &= ~EN_ALDPS; + ocp_reg_write(tp, OCP_POWER_CFG, data); + for (i = 0; i < 20; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ return; + usleep_range(1000, 2000); + if (ocp_read_word(tp, MCU_TYPE_PLA, 0xe000) & 0x0100) + break; +-- +2.42.0 + diff --git a/queue-5.15/r8152-add-rtl8152_inaccessible-to-r8153_pre_firmware.patch b/queue-5.15/r8152-add-rtl8152_inaccessible-to-r8153_pre_firmware.patch new file mode 100644 index 00000000000..86930302dbd --- /dev/null +++ b/queue-5.15/r8152-add-rtl8152_inaccessible-to-r8153_pre_firmware.patch @@ -0,0 +1,39 @@ +From d6e915daf4add035249c2b9bf49d54bc9ae79365 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 13:25:23 -0800 +Subject: r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1() + +From: Douglas Anderson + +[ Upstream commit 8c53a7bd706535a9cf4e2ec3a4e8d61d46353ca0 ] + +Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set +so that they don't delay too long if the device becomes +inaccessible. Add the break to the loop in r8153_pre_firmware_1(). + +Fixes: 9370f2d05a2a ("r8152: support request_firmware for RTL8153") +Reviewed-by: Grant Grundler +Signed-off-by: Douglas Anderson +Acked-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index c4a3076bb2261..da3a2a5584a58 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5520,6 +5520,8 @@ static int r8153_pre_firmware_1(struct r8152 *tp) + for (i = 0; i < 104; i++) { + u32 ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_WDT1_CTRL); + ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ return -ENODEV; + if (!(ocp_data & WTD1_EN)) + break; + usleep_range(1000, 2000); +-- +2.42.0 + diff --git a/queue-5.15/r8152-add-rtl8152_inaccessible-to-r8156b_wait_loadin.patch b/queue-5.15/r8152-add-rtl8152_inaccessible-to-r8156b_wait_loadin.patch new file mode 100644 index 00000000000..4a30cfffa44 --- /dev/null +++ b/queue-5.15/r8152-add-rtl8152_inaccessible-to-r8156b_wait_loadin.patch @@ -0,0 +1,40 @@ +From 16f43727cb635006355a694b6784fa493e768b22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 13:25:22 -0800 +Subject: r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash() + +From: Douglas Anderson + +[ Upstream commit 8a67b47fced9f6a84101eb9ec5ce4c7d64204bc7 ] + +Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set +so that they don't delay too long if the device becomes +inaccessible. Add the break to the loop in +r8156b_wait_loading_flash(). + +Fixes: 195aae321c82 ("r8152: support new chips") +Reviewed-by: Grant Grundler +Signed-off-by: Douglas Anderson +Acked-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 1bb304857a744..c4a3076bb2261 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5396,6 +5396,8 @@ static void r8156b_wait_loading_flash(struct r8152 *tp) + int i; + + for (i = 0; i < 100; i++) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ break; + if (ocp_read_word(tp, MCU_TYPE_USB, USB_GPHY_CTRL) & GPHY_PATCH_DONE) + break; + usleep_range(1000, 2000); +-- +2.42.0 + diff --git a/queue-5.15/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch b/queue-5.15/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch new file mode 100644 index 00000000000..ab7067595bf --- /dev/null +++ b/queue-5.15/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch @@ -0,0 +1,458 @@ +From eea9a2b77b3c5bed2558bd5367933b6feab08aab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:58 -0700 +Subject: r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE + +From: Douglas Anderson + +[ Upstream commit 715f67f33af45ce2cc3a5b1ef133cc8c8e7787b0 ] + +Whenever the RTL8152_UNPLUG is set that just tells the driver that all +accesses will fail and we should just immediately bail. A future patch +will use this same concept at a time when the driver hasn't actually +been unplugged but is about to be reset. Rename the flag in +preparation for the future patch. + +This is a no-op change and just a search and replace. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Stable-dep-of: 32a574c7e268 ("r8152: Add RTL8152_INACCESSIBLE checks to more loops") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 96 ++++++++++++++++++++--------------------- + 1 file changed, 48 insertions(+), 48 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 663e3880bf713..7a353409928a6 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -763,7 +763,7 @@ enum rtl_register_content { + + /* rtl8152 flags */ + enum rtl8152_flags { +- RTL8152_UNPLUG = 0, ++ RTL8152_INACCESSIBLE = 0, + RTL8152_SET_RX_MODE, + WORK_ENABLE, + RTL8152_LINK_CHG, +@@ -1241,7 +1241,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) + static void rtl_set_unplug(struct r8152 *tp) + { + if (tp->udev->state == USB_STATE_NOTATTACHED) { +- set_bit(RTL8152_UNPLUG, &tp->flags); ++ set_bit(RTL8152_INACCESSIBLE, &tp->flags); + smp_mb__after_atomic(); + } + } +@@ -1252,7 +1252,7 @@ static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size, + u16 limit = 64; + int ret = 0; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + /* both size and indix must be 4 bytes align */ +@@ -1296,7 +1296,7 @@ static int generic_ocp_write(struct r8152 *tp, u16 index, u16 byteen, + u16 byteen_start, byteen_end, byen; + u16 limit = 512; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + /* both size and indix must be 4 bytes align */ +@@ -1526,7 +1526,7 @@ static int read_mii_word(struct net_device *netdev, int phy_id, int reg) + struct r8152 *tp = netdev_priv(netdev); + int ret; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + if (phy_id != R8152_PHY_ID) +@@ -1542,7 +1542,7 @@ void write_mii_word(struct net_device *netdev, int phy_id, int reg, int val) + { + struct r8152 *tp = netdev_priv(netdev); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (phy_id != R8152_PHY_ID) +@@ -1747,7 +1747,7 @@ static void read_bulk_callback(struct urb *urb) + if (!tp) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!test_bit(WORK_ENABLE, &tp->flags)) +@@ -1839,7 +1839,7 @@ static void write_bulk_callback(struct urb *urb) + if (!test_bit(WORK_ENABLE, &tp->flags)) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!skb_queue_empty(&tp->tx_queue)) +@@ -1860,7 +1860,7 @@ static void intr_callback(struct urb *urb) + if (!test_bit(WORK_ENABLE, &tp->flags)) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + switch (status) { +@@ -2604,7 +2604,7 @@ static void bottom_half(struct tasklet_struct *t) + { + struct r8152 *tp = from_tasklet(tp, t, tx_tl); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!test_bit(WORK_ENABLE, &tp->flags)) +@@ -2647,7 +2647,7 @@ int r8152_submit_rx(struct r8152 *tp, struct rx_agg *agg, gfp_t mem_flags) + int ret; + + /* The rx would be stopped, so skip submitting */ +- if (test_bit(RTL8152_UNPLUG, &tp->flags) || ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || + !test_bit(WORK_ENABLE, &tp->flags) || !netif_carrier_ok(tp->netdev)) + return 0; + +@@ -3043,7 +3043,7 @@ static int rtl_enable(struct r8152 *tp) + + static int rtl8152_enable(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -3130,7 +3130,7 @@ static int rtl8153_enable(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -3162,7 +3162,7 @@ static void rtl_disable(struct r8152 *tp) + u32 ocp_data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -3616,7 +3616,7 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired) + } + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -3648,7 +3648,7 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) +@@ -3690,7 +3690,7 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) +@@ -4055,8 +4055,8 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait) + for (i = 0; wait && i < 5000; i++) { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) +- break; ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ return -ENODEV; + + usleep_range(1000, 2000); + ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT); +@@ -6019,7 +6019,7 @@ static int rtl8156_enable(struct r8152 *tp) + u32 ocp_data; + u16 speed; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + r8156_fc_parameter(tp); +@@ -6077,7 +6077,7 @@ static int rtl8156b_enable(struct r8152 *tp) + u32 ocp_data; + u16 speed; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -6263,7 +6263,7 @@ static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u32 speed, u8 duplex, + + static void rtl8152_up(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8152_aldps_en(tp, false); +@@ -6273,7 +6273,7 @@ static void rtl8152_up(struct r8152 *tp) + + static void rtl8152_down(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6288,7 +6288,7 @@ static void rtl8153_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_u1u2en(tp, false); +@@ -6328,7 +6328,7 @@ static void rtl8153_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6349,7 +6349,7 @@ static void rtl8153b_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6373,7 +6373,7 @@ static void rtl8153b_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6410,7 +6410,7 @@ static void rtl8153c_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6491,7 +6491,7 @@ static void rtl8156_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6564,7 +6564,7 @@ static void rtl8156_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6702,7 +6702,7 @@ static void rtl_work_func_t(struct work_struct *work) + /* If the device is unplugged or !netif_running(), the workqueue + * doesn't need to wake the device, and could return directly. + */ +- if (test_bit(RTL8152_UNPLUG, &tp->flags) || !netif_running(tp->netdev)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || !netif_running(tp->netdev)) + return; + + if (usb_autopm_get_interface(tp->intf) < 0) +@@ -6741,7 +6741,7 @@ static void rtl_hw_phy_work_func_t(struct work_struct *work) + { + struct r8152 *tp = container_of(work, struct r8152, hw_phy_work.work); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (usb_autopm_get_interface(tp->intf) < 0) +@@ -6868,7 +6868,7 @@ static int rtl8152_close(struct net_device *netdev) + netif_stop_queue(netdev); + + res = usb_autopm_get_interface(tp->intf); +- if (res < 0 || test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (res < 0 || test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + rtl_stop_rx(tp); + } else { +@@ -6901,7 +6901,7 @@ static void r8152b_init(struct r8152 *tp) + u32 ocp_data; + u16 data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + data = r8152_mdio_read(tp, MII_BMCR); +@@ -6945,7 +6945,7 @@ static void r8153_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_u1u2en(tp, false); +@@ -6956,7 +6956,7 @@ static void r8153_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -7085,7 +7085,7 @@ static void r8153b_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -7096,7 +7096,7 @@ static void r8153b_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -7167,7 +7167,7 @@ static void r8153c_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -7187,7 +7187,7 @@ static void r8153c_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -8016,7 +8016,7 @@ static void r8156_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); +@@ -8037,7 +8037,7 @@ static void r8156_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -8112,7 +8112,7 @@ static void r8156b_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); +@@ -8146,7 +8146,7 @@ static void r8156b_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -9208,7 +9208,7 @@ static int rtl8152_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd) + struct mii_ioctl_data *data = if_mii(rq); + int res; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + res = usb_autopm_get_interface(tp->intf); +@@ -9310,7 +9310,7 @@ static const struct net_device_ops rtl8152_netdev_ops = { + + static void rtl8152_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (tp->version != RTL_VER_01) +@@ -9319,7 +9319,7 @@ static void rtl8152_unload(struct r8152 *tp) + + static void rtl8153_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_power_cut_en(tp, false); +@@ -9327,7 +9327,7 @@ static void rtl8153_unload(struct r8152 *tp) + + static void rtl8153b_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_power_cut_en(tp, false); +-- +2.42.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 334e39ec076..8d80e0851a1 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -6,3 +6,43 @@ tg3-move-the-rt-x_dropped-counters-to-tg3_napi.patch tg3-increment-tx_dropped-in-tg3_tso_bug.patch kconfig-fix-memory-leak-from-range-properties.patch drm-amdgpu-correct-chunk_ptr-to-a-pointer-to-chunk.patch +platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch +platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch +platform-x86-asus-wmi-simplify-tablet-mode-switch-pr.patch +platform-x86-asus-wmi-simplify-tablet-mode-switch-ha.patch +platform-x86-asus-wmi-move-i8042-filter-install-to-s.patch +of-dynamic-fix-of_reconfig_get_state_change-return-v.patch +kbuild-use-wdeclaration-after-statement.patch +kbuild-move-to-std-gnu11.patch +platform-x86-wmi-allow-duplicate-guids-for-drivers-t.patch +platform-x86-wmi-skip-blocks-with-zero-instances.patch +ipv6-fix-potential-null-deref-in-fib6_add.patch +octeontx2-pf-add-missing-mutex-lock-in-otx2_get_paus.patch +octeontx2-af-check-return-value-of-nix_get_nixlf-bef.patch +hv_netvsc-rndis_filter-needs-to-select-nls.patch +r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch +r8152-add-rtl8152_inaccessible-checks-to-more-loops.patch +r8152-add-rtl8152_inaccessible-to-r8156b_wait_loadin.patch +r8152-add-rtl8152_inaccessible-to-r8153_pre_firmware.patch +r8152-add-rtl8152_inaccessible-to-r8153_aldps_en.patch +mlxbf-bootctl-correctly-identify-secure-boot-with-de.patch +platform-mellanox-add-null-pointer-checks-for-devm_k.patch +platform-mellanox-check-devm_hwmon_device_register_w.patch +arcnet-restoring-support-for-multiple-sohard-arcnet-.patch +net-stmmac-fix-fpe-events-losing.patch +octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch +i40e-fix-unexpected-mfs-warning-message.patch +net-bnxt-fix-a-potential-use-after-free-in-bnxt_init.patch +ionic-fix-snprintf-format-length-warning.patch +ionic-fix-dim-work-handling-in-split-interrupt-mode.patch +ipv4-ip_gre-avoid-skb_pull-failure-in-ipgre_xmit.patch +net-hns-fix-fake-link-up-on-xge-port.patch +octeontx2-af-update-tx-link-register-range.patch +netfilter-nf_tables-bail-out-on-mismatching-dynset-a.patch +netfilter-nf_tables-validate-family-when-identifying.patch +netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch +tcp-do-not-accept-ack-of-bytes-we-never-sent.patch +bpf-sockmap-updating-the-sg-structure-should-also-up.patch +psample-require-cap_net_admin-when-joining-packets-g.patch +net-add-missing-kdoc-for-struct-genl_multicast_group.patch +drop_monitor-require-cap_sys_admin-when-joining-even.patch diff --git a/queue-5.15/tcp-do-not-accept-ack-of-bytes-we-never-sent.patch b/queue-5.15/tcp-do-not-accept-ack-of-bytes-we-never-sent.patch new file mode 100644 index 00000000000..22cb4d9504c --- /dev/null +++ b/queue-5.15/tcp-do-not-accept-ack-of-bytes-we-never-sent.patch @@ -0,0 +1,106 @@ +From c22c097fd305b9580322457b1a395304a2f6bc73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 16:18:41 +0000 +Subject: tcp: do not accept ACK of bytes we never sent + +From: Eric Dumazet + +[ Upstream commit 3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 ] + +This patch is based on a detailed report and ideas from Yepeng Pan +and Christian Rossow. + +ACK seq validation is currently following RFC 5961 5.2 guidelines: + + The ACK value is considered acceptable only if + it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= + SND.NXT). All incoming segments whose ACK value doesn't satisfy the + above condition MUST be discarded and an ACK sent back. It needs to + be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a + duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK + acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an + ACK, drop the segment, and return". The "ignored" above implies that + the processing of the incoming data segment continues, which means + the ACK value is treated as acceptable. This mitigation makes the + ACK check more stringent since any ACK < SND.UNA wouldn't be + accepted, instead only ACKs that are in the range ((SND.UNA - + MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through. + +This can be refined for new (and possibly spoofed) flows, +by not accepting ACK for bytes that were never sent. + +This greatly improves TCP security at a little cost. + +I added a Fixes: tag to make sure this patch will reach stable trees, +even if the 'blamed' patch was adhering to the RFC. + +tp->bytes_acked was added in linux-4.2 + +Following packetdrill test (courtesy of Yepeng Pan) shows +the issue at hand: + +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 ++0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 ++0 bind(3, ..., ...) = 0 ++0 listen(3, 1024) = 0 + +// ---------------- Handshake ------------------- // + +// when window scale is set to 14 the window size can be extended to +// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet +// with ack number in (Server_ISN+1-1073725440. Server_ISN+1) +// ,though this ack number acknowledges some data never +// sent by the server. + ++0 < S 0:0(0) win 65535 ++0 > S. 0:0(0) ack 1 <...> ++0 < . 1:1(0) ack 1 win 65535 ++0 accept(3, ..., ...) = 4 + +// For the established connection, we send an ACK packet, +// the ack packet uses ack number 1 - 1073725300 + 2^32, +// where 2^32 is used to wrap around. +// Note: we used 1073725300 instead of 1073725440 to avoid possible +// edge cases. +// 1 - 1073725300 + 2^32 = 3221241997 + +// Oops, old kernels happily accept this packet. ++0 < . 1:1001(1000) ack 3221241997 win 65535 + +// After the kernel fix the following will be replaced by a challenge ACK, +// and prior malicious frame would be dropped. ++0 > . 1:1(0) ack 1001 + +Fixes: 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation") +Signed-off-by: Eric Dumazet +Reported-by: Yepeng Pan +Reported-by: Christian Rossow +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20231205161841.2702925-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index a3453b4ac339c..e51b5d887c24b 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3796,8 +3796,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + * then we can probably ignore it. + */ + if (before(ack, prior_snd_una)) { ++ u32 max_window; ++ ++ /* do not accept ACK for bytes we never sent. */ ++ max_window = min_t(u64, tp->max_window, tp->bytes_acked); + /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */ +- if (before(ack, prior_snd_una - tp->max_window)) { ++ if (before(ack, prior_snd_una - max_window)) { + if (!(flag & FLAG_NO_CHALLENGE_ACK)) + tcp_send_challenge_ack(sk, skb); + return -1; +-- +2.42.0 + -- 2.47.3