--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 4 Feb 2020 19:26:05 -0800
+Subject: bonding/alb: properly access headers in bond_alb_xmit()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 38f88c45404293bbc027b956def6c10cbd45c616 ]
+
+syzbot managed to send an IPX packet through bond_alb_xmit()
+and af_packet and triggered a use-after-free.
+
+First, bond_alb_xmit() was using ipx_hdr() helper to reach
+the IPX header, but ipx_hdr() was using the transport offset
+instead of the network offset. In the particular syzbot
+report transport offset was 0xFFFF
+
+This patch removes ipx_hdr() since it was only (mis)used from bonding.
+
+Then we need to make sure IPv4/IPv6/IPX headers are pulled
+in skb->head before dereferencing anything.
+
+BUG: KASAN: use-after-free in bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
+Read of size 2 at addr ffff8801ce56dfff by task syz-executor.2/18108
+ (if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) ...)
+
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ [<ffffffff8441fc42>] __dump_stack lib/dump_stack.c:17 [inline]
+ [<ffffffff8441fc42>] dump_stack+0x14d/0x20b lib/dump_stack.c:53
+ [<ffffffff81a7dec4>] print_address_description+0x6f/0x20b mm/kasan/report.c:282
+ [<ffffffff81a7e0ec>] kasan_report_error mm/kasan/report.c:380 [inline]
+ [<ffffffff81a7e0ec>] kasan_report mm/kasan/report.c:438 [inline]
+ [<ffffffff81a7e0ec>] kasan_report.cold+0x8c/0x2a0 mm/kasan/report.c:422
+ [<ffffffff81a7dc4f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:469
+ [<ffffffff82c8c00a>] bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
+ [<ffffffff82c60c74>] __bond_start_xmit drivers/net/bonding/bond_main.c:4199 [inline]
+ [<ffffffff82c60c74>] bond_start_xmit+0x4f4/0x1570 drivers/net/bonding/bond_main.c:4224
+ [<ffffffff83baa558>] __netdev_start_xmit include/linux/netdevice.h:4525 [inline]
+ [<ffffffff83baa558>] netdev_start_xmit include/linux/netdevice.h:4539 [inline]
+ [<ffffffff83baa558>] xmit_one net/core/dev.c:3611 [inline]
+ [<ffffffff83baa558>] dev_hard_start_xmit+0x168/0x910 net/core/dev.c:3627
+ [<ffffffff83bacf35>] __dev_queue_xmit+0x1f55/0x33b0 net/core/dev.c:4238
+ [<ffffffff83bae3a8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:4278
+ [<ffffffff84339189>] packet_snd net/packet/af_packet.c:3226 [inline]
+ [<ffffffff84339189>] packet_sendmsg+0x4919/0x70b0 net/packet/af_packet.c:3252
+ [<ffffffff83b1ac0c>] sock_sendmsg_nosec net/socket.c:673 [inline]
+ [<ffffffff83b1ac0c>] sock_sendmsg+0x12c/0x160 net/socket.c:684
+ [<ffffffff83b1f5a2>] __sys_sendto+0x262/0x380 net/socket.c:1996
+ [<ffffffff83b1f700>] SYSC_sendto net/socket.c:2008 [inline]
+ [<ffffffff83b1f700>] SyS_sendto+0x40/0x60 net/socket.c:2004
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Cc: Jay Vosburgh <j.vosburgh@gmail.com>
+Cc: Veaceslav Falico <vfalico@gmail.com>
+Cc: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_alb.c | 44 +++++++++++++++++++++++++++++------------
+ include/net/ipx.h | 5 ----
+ 2 files changed, 32 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -1383,26 +1383,31 @@ netdev_tx_t bond_alb_xmit(struct sk_buff
+ bool do_tx_balance = true;
+ u32 hash_index = 0;
+ const u8 *hash_start = NULL;
+- struct ipv6hdr *ip6hdr;
+
+ skb_reset_mac_header(skb);
+ eth_data = eth_hdr(skb);
+
+ switch (ntohs(skb->protocol)) {
+ case ETH_P_IP: {
+- const struct iphdr *iph = ip_hdr(skb);
++ const struct iphdr *iph;
+
+ if (is_broadcast_ether_addr(eth_data->h_dest) ||
+- iph->daddr == ip_bcast ||
+- iph->protocol == IPPROTO_IGMP) {
++ !pskb_network_may_pull(skb, sizeof(*iph))) {
++ do_tx_balance = false;
++ break;
++ }
++ iph = ip_hdr(skb);
++ if (iph->daddr == ip_bcast || iph->protocol == IPPROTO_IGMP) {
+ do_tx_balance = false;
+ break;
+ }
+ hash_start = (char *)&(iph->daddr);
+ hash_size = sizeof(iph->daddr);
+- }
+ break;
+- case ETH_P_IPV6:
++ }
++ case ETH_P_IPV6: {
++ const struct ipv6hdr *ip6hdr;
++
+ /* IPv6 doesn't really use broadcast mac address, but leave
+ * that here just in case.
+ */
+@@ -1419,7 +1424,11 @@ netdev_tx_t bond_alb_xmit(struct sk_buff
+ break;
+ }
+
+- /* Additianally, DAD probes should not be tx-balanced as that
++ if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) {
++ do_tx_balance = false;
++ break;
++ }
++ /* Additionally, DAD probes should not be tx-balanced as that
+ * will lead to false positives for duplicate addresses and
+ * prevent address configuration from working.
+ */
+@@ -1429,17 +1438,26 @@ netdev_tx_t bond_alb_xmit(struct sk_buff
+ break;
+ }
+
+- hash_start = (char *)&(ipv6_hdr(skb)->daddr);
+- hash_size = sizeof(ipv6_hdr(skb)->daddr);
++ hash_start = (char *)&ip6hdr->daddr;
++ hash_size = sizeof(ip6hdr->daddr);
+ break;
+- case ETH_P_IPX:
+- if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) {
++ }
++ case ETH_P_IPX: {
++ const struct ipxhdr *ipxhdr;
++
++ if (pskb_network_may_pull(skb, sizeof(*ipxhdr))) {
++ do_tx_balance = false;
++ break;
++ }
++ ipxhdr = (struct ipxhdr *)skb_network_header(skb);
++
++ if (ipxhdr->ipx_checksum != IPX_NO_CHECKSUM) {
+ /* something is wrong with this packet */
+ do_tx_balance = false;
+ break;
+ }
+
+- if (ipx_hdr(skb)->ipx_type != IPX_TYPE_NCP) {
++ if (ipxhdr->ipx_type != IPX_TYPE_NCP) {
+ /* The only protocol worth balancing in
+ * this family since it has an "ARP" like
+ * mechanism
+@@ -1448,9 +1466,11 @@ netdev_tx_t bond_alb_xmit(struct sk_buff
+ break;
+ }
+
++ eth_data = eth_hdr(skb);
+ hash_start = (char *)eth_data->h_dest;
+ hash_size = ETH_ALEN;
+ break;
++ }
+ case ETH_P_ARP:
+ do_tx_balance = false;
+ if (bond_info->rlb_enabled)
+--- a/include/net/ipx.h
++++ b/include/net/ipx.h
+@@ -47,11 +47,6 @@ struct ipxhdr {
+ /* From af_ipx.c */
+ extern int sysctl_ipx_pprop_broadcasting;
+
+-static __inline__ struct ipxhdr *ipx_hdr(struct sk_buff *skb)
+-{
+- return (struct ipxhdr *)skb_transport_header(skb);
+-}
+-
+ struct ipx_interface {
+ /* IPX address */
+ __be32 if_netnum;
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Tue, 4 Feb 2020 15:59:50 -0800
+Subject: devlink: report 0 after hitting end in region read
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit d5b90e99e1d51b7b5d2b74fbc4c2db236a510913 ]
+
+commit fdd41ec21e15 ("devlink: Return right error code in case of errors
+for region read") modified the region read code to report errors
+properly in unexpected cases.
+
+In the case where the start_offset and ret_offset match, it unilaterally
+converted this into an error. This causes an issue for the "dump"
+version of the command. In this case, the devlink region dump will
+always report an invalid argument:
+
+000000000000ffd0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+000000000000ffe0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+devlink answers: Invalid argument
+000000000000fff0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+
+This occurs because the expected flow for the dump is to return 0 after
+there is no further data.
+
+The simplest fix would be to stop converting the error code to -EINVAL
+if start_offset == ret_offset. However, avoid unnecessary work by
+checking for when start_offset is larger than the region size and
+returning 0 upfront.
+
+Fixes: fdd41ec21e15 ("devlink: Return right error code in case of errors for region read")
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/devlink.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/core/devlink.c
++++ b/net/core/devlink.c
+@@ -3986,6 +3986,12 @@ static int devlink_nl_cmd_region_read_du
+ goto out_unlock;
+ }
+
++ /* return 0 if there is no further data to read */
++ if (start_offset >= region->size) {
++ err = 0;
++ goto out_unlock;
++ }
++
+ hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
+ &devlink_nl_family, NLM_F_ACK | NLM_F_MULTI,
+ DEVLINK_CMD_REGION_READ);
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Date: Tue, 4 Feb 2020 12:08:58 +0200
+Subject: dpaa_eth: support all modes with rate adapting PHYs
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 73a21fa817f0cc8022dc6226250a86bca727a56d ]
+
+Stop removing modes that are not supported on the system interface
+when the connected PHY is capable of rate adaptation. This addresses
+an issue with the LS1046ARDB board 10G interface no longer working
+with an 1G link partner after autonegotiation support was added
+for the Aquantia PHY on board in
+
+commit 09c4c57f7bc4 ("net: phy: aquantia: add support for auto-negotiation configuration")
+
+Before this commit the values advertised by the PHY were not
+influenced by the dpaa_eth driver removal of system-side unsupported
+modes as the aqr_config_aneg() was basically a no-op. After this
+commit, the modes removed by the dpaa_eth driver were no longer
+advertised thus autonegotiation with 1G link partners failed.
+
+Reported-by: Mian Yousaf Kaukab <ykaukab@suse.de>
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2453,6 +2453,9 @@ static void dpaa_adjust_link(struct net_
+ mac_dev->adjust_link(mac_dev);
+ }
+
++/* The Aquantia PHYs are capable of performing rate adaptation */
++#define PHY_VEND_AQUANTIA 0x03a1b400
++
+ static int dpaa_phy_init(struct net_device *net_dev)
+ {
+ __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+@@ -2471,9 +2474,14 @@ static int dpaa_phy_init(struct net_devi
+ return -ENODEV;
+ }
+
+- /* Remove any features not supported by the controller */
+- ethtool_convert_legacy_u32_to_link_mode(mask, mac_dev->if_support);
+- linkmode_and(phy_dev->supported, phy_dev->supported, mask);
++ /* Unless the PHY is capable of rate adaptation */
++ if (mac_dev->phy_if != PHY_INTERFACE_MODE_XGMII ||
++ ((phy_dev->drv->phy_id & GENMASK(31, 10)) != PHY_VEND_AQUANTIA)) {
++ /* remove any features not supported by the controller */
++ ethtool_convert_legacy_u32_to_link_mode(mask,
++ mac_dev->if_support);
++ linkmode_and(phy_dev->supported, phy_dev->supported, mask);
++ }
+
+ phy_support_asym_pause(phy_dev);
+
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Fri, 7 Feb 2020 19:29:28 +0200
+Subject: drop_monitor: Do not cancel uninitialized work item
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit dfa7f709596be5ca46c070d4f8acbb344322056a ]
+
+Drop monitor uses a work item that takes care of constructing and
+sending netlink notifications to user space. In case drop monitor never
+started to monitor, then the work item is uninitialized and not
+associated with a function.
+
+Therefore, a stop command from user space results in canceling an
+uninitialized work item which leads to the following warning [1].
+
+Fix this by not processing a stop command if drop monitor is not
+currently monitoring.
+
+[1]
+[ 31.735402] ------------[ cut here ]------------
+[ 31.736470] WARNING: CPU: 0 PID: 143 at kernel/workqueue.c:3032 __flush_work+0x89f/0x9f0
+...
+[ 31.738120] CPU: 0 PID: 143 Comm: dwdump Not tainted 5.5.0-custom-09491-g16d4077796b8 #727
+[ 31.741968] RIP: 0010:__flush_work+0x89f/0x9f0
+...
+[ 31.760526] Call Trace:
+[ 31.771689] __cancel_work_timer+0x2a6/0x3b0
+[ 31.776809] net_dm_cmd_trace+0x300/0xef0
+[ 31.777549] genl_rcv_msg+0x5c6/0xd50
+[ 31.781005] netlink_rcv_skb+0x13b/0x3a0
+[ 31.784114] genl_rcv+0x29/0x40
+[ 31.784720] netlink_unicast+0x49f/0x6a0
+[ 31.787148] netlink_sendmsg+0x7cf/0xc80
+[ 31.790426] ____sys_sendmsg+0x620/0x770
+[ 31.793458] ___sys_sendmsg+0xfd/0x170
+[ 31.802216] __sys_sendmsg+0xdf/0x1a0
+[ 31.806195] do_syscall_64+0xa0/0x540
+[ 31.806885] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fixes: 8e94c3bc922e ("drop_monitor: Allow user to start monitoring hardware drops")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/drop_monitor.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/core/drop_monitor.c
++++ b/net/core/drop_monitor.c
+@@ -1004,8 +1004,10 @@ static void net_dm_hw_monitor_stop(struc
+ {
+ int cpu;
+
+- if (!monitor_hw)
++ if (!monitor_hw) {
+ NL_SET_ERR_MSG_MOD(extack, "Hardware monitoring already disabled");
++ return;
++ }
+
+ monitor_hw = false;
+
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 7 Feb 2020 07:16:37 -0800
+Subject: ipv6/addrconf: fix potential NULL deref in inet6_set_link_af()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit db3fa271022dacb9f741b96ea4714461a8911bb9 ]
+
+__in6_dev_get(dev) called from inet6_set_link_af() can return NULL.
+
+The needed check has been recently removed, let's add it back.
+
+While do_setlink() does call validate_linkmsg() :
+...
+err = validate_linkmsg(dev, tb); /* OK at this point */
+...
+
+It is possible that the following call happening before the
+->set_link_af() removes IPv6 if MTU is less than 1280 :
+
+if (tb[IFLA_MTU]) {
+ err = dev_set_mtu_ext(dev, nla_get_u32(tb[IFLA_MTU]), extack);
+ if (err < 0)
+ goto errout;
+ status |= DO_SETLINK_MODIFIED;
+}
+...
+
+if (tb[IFLA_AF_SPEC]) {
+ ...
+ err = af_ops->set_link_af(dev, af);
+ ->inet6_set_link_af() // CRASH because idev is NULL
+
+Please note that IPv4 is immune to the bug since inet_set_link_af() does :
+
+struct in_device *in_dev = __in_dev_get_rcu(dev);
+if (!in_dev)
+ return -EAFNOSUPPORT;
+
+This problem has been mentioned in commit cf7afbfeb8ce ("rtnl: make
+link af-specific updates atomic") changelog :
+
+ This method is not fail proof, while it is currently sufficient
+ to make set_link_af() inerrable and thus 100% atomic, the
+ validation function method will not be able to detect all error
+ scenarios in the future, there will likely always be errors
+ depending on states which are f.e. not protected by rtnl_mutex
+ and thus may change between validation and setting.
+
+IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
+general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] PREEMPT SMP KASAN
+KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]
+CPU: 0 PID: 9698 Comm: syz-executor712 Not tainted 5.5.0-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+RIP: 0010:inet6_set_link_af+0x66e/0xae0 net/ipv6/addrconf.c:5733
+Code: 38 d0 7f 08 84 c0 0f 85 20 03 00 00 48 8d bb b0 02 00 00 45 0f b6 64 24 04 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 44 89 a3 b0 02 00
+RSP: 0018:ffffc90005b06d40 EFLAGS: 00010206
+RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff86df39a6
+RDX: 0000000000000056 RSI: ffffffff86df3e74 RDI: 00000000000002b0
+RBP: ffffc90005b06e70 R08: ffff8880a2ac0380 R09: ffffc90005b06db0
+R10: fffff52000b60dbe R11: ffffc90005b06df7 R12: 0000000000000000
+R13: 0000000000000000 R14: ffff8880a1fcc424 R15: dffffc0000000000
+FS: 0000000000c46880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000055f0494ca0d0 CR3: 000000009e4ac000 CR4: 00000000001406f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ do_setlink+0x2a9f/0x3720 net/core/rtnetlink.c:2754
+ rtnl_group_changelink net/core/rtnetlink.c:3103 [inline]
+ __rtnl_newlink+0xdd1/0x1790 net/core/rtnetlink.c:3257
+ rtnl_newlink+0x69/0xa0 net/core/rtnetlink.c:3377
+ rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5438
+ netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
+ rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5456
+ netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
+ netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328
+ netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
+ sock_sendmsg_nosec net/socket.c:652 [inline]
+ sock_sendmsg+0xd7/0x130 net/socket.c:672
+ ____sys_sendmsg+0x753/0x880 net/socket.c:2343
+ ___sys_sendmsg+0x100/0x170 net/socket.c:2397
+ __sys_sendmsg+0x105/0x1d0 net/socket.c:2430
+ __do_sys_sendmsg net/socket.c:2439 [inline]
+ __se_sys_sendmsg net/socket.c:2437 [inline]
+ __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437
+ do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+RIP: 0033:0x4402e9
+Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
+RSP: 002b:00007fffd62fbcf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402e9
+RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
+RBP: 00000000006ca018 R08: 0000000000000008 R09: 00000000004002c8
+R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000401b70
+R13: 0000000000401c00 R14: 0000000000000000 R15: 0000000000000000
+Modules linked in:
+---[ end trace cfa7664b8fdcdff3 ]---
+RIP: 0010:inet6_set_link_af+0x66e/0xae0 net/ipv6/addrconf.c:5733
+Code: 38 d0 7f 08 84 c0 0f 85 20 03 00 00 48 8d bb b0 02 00 00 45 0f b6 64 24 04 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 44 89 a3 b0 02 00
+RSP: 0018:ffffc90005b06d40 EFLAGS: 00010206
+RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff86df39a6
+RDX: 0000000000000056 RSI: ffffffff86df3e74 RDI: 00000000000002b0
+RBP: ffffc90005b06e70 R08: ffff8880a2ac0380 R09: ffffc90005b06db0
+R10: fffff52000b60dbe R11: ffffc90005b06df7 R12: 0000000000000000
+R13: 0000000000000000 R14: ffff8880a1fcc424 R15: dffffc0000000000
+FS: 0000000000c46880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020000004 CR3: 000000009e4ac000 CR4: 00000000001406e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+
+Fixes: 7dc2bccab0ee ("Validate required parameters in inet6_validate_link_af")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Bisected-and-reported-by: syzbot <syzkaller@googlegroups.com>
+Cc: Maxim Mikityanskiy <maximmi@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/addrconf.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -5718,6 +5718,9 @@ static int inet6_set_link_af(struct net_
+ struct nlattr *tb[IFLA_INET6_MAX + 1];
+ int err;
+
++ if (!idev)
++ return -EAFNOSUPPORT;
++
+ if (nla_parse_nested_deprecated(tb, IFLA_INET6_MAX, nla, NULL, NULL) < 0)
+ BUG();
+
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 6 Feb 2020 11:07:45 -0800
+Subject: net: dsa: b53: Always use dev->vlan_enabled in b53_configure_vlan()
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit df373702bc0f8f2d83980ea441e71639fc1efcf8 ]
+
+b53_configure_vlan() is called by the bcm_sf2 driver upon setup and
+indirectly through resume as well. During the initial setup, we are
+guaranteed that dev->vlan_enabled is false, so there is no change in
+behavior, however during suspend, we may have enabled VLANs before, so we
+do want to restore that setting.
+
+Fixes: dad8d7c6452b ("net: dsa: b53: Properly account for VLAN filtering")
+Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -680,7 +680,7 @@ int b53_configure_vlan(struct dsa_switch
+ b53_do_vlan_op(dev, VTA_CMD_CLEAR);
+ }
+
+- b53_enable_vlan(dev, false, ds->vlan_filtering);
++ b53_enable_vlan(dev, dev->vlan_enabled, ds->vlan_filtering);
+
+ b53_for_each_port(dev, i)
+ b53_write16(dev, B53_VLAN_PAGE,
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 6 Feb 2020 11:23:52 -0800
+Subject: net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit de34d7084edd069dac5aa010cfe32bd8c4619fa6 ]
+
+The 7445 switch clocking profiles do not allow us to run the IMP port at
+2Gb/sec in a way that it is reliable and consistent. Make sure that the
+setting is only applied to the 7278 family.
+
+Fixes: 8f1880cbe8d0 ("net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -68,7 +68,9 @@ static void bcm_sf2_imp_setup(struct dsa
+
+ /* Force link status for IMP port */
+ reg = core_readl(priv, offset);
+- reg |= (MII_SW_OR | LINK_STS | GMII_SPEED_UP_2G);
++ reg |= (MII_SW_OR | LINK_STS);
++ if (priv->type == BCM7278_DEVICE_ID)
++ reg |= GMII_SPEED_UP_2G;
+ core_writel(priv, reg, offset);
+
+ /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Razvan Stefanescu <razvan.stefanescu@microchip.com>
+Date: Fri, 7 Feb 2020 17:44:04 +0200
+Subject: net: dsa: microchip: enable module autoprobe
+
+From: Razvan Stefanescu <razvan.stefanescu@microchip.com>
+
+[ Upstream commit f8c2afa66d5397b0b9293c4347dac6dabb327685 ]
+
+This matches /sys/devices/.../spi1.0/modalias content.
+
+Fixes: 9b2d9f05cddf ("net: dsa: microchip: add ksz9567 to ksz9477 driver")
+Fixes: d9033ae95cf4 ("net: dsa: microchip: add KSZ8563 compatibility string")
+Fixes: 8c29bebb1f8a ("net: dsa: microchip: add KSZ9893 switch support")
+Fixes: 45316818371d ("net: dsa: add support for ksz9897 ethernet switch")
+Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477")
+Signed-off-by: Razvan Stefanescu <razvan.stefanescu@microchip.com>
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/microchip/ksz9477_spi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/dsa/microchip/ksz9477_spi.c
++++ b/drivers/net/dsa/microchip/ksz9477_spi.c
+@@ -101,6 +101,12 @@ static struct spi_driver ksz9477_spi_dri
+
+ module_spi_driver(ksz9477_spi_driver);
+
++MODULE_ALIAS("spi:ksz9477");
++MODULE_ALIAS("spi:ksz9897");
++MODULE_ALIAS("spi:ksz9893");
++MODULE_ALIAS("spi:ksz9563");
++MODULE_ALIAS("spi:ksz8563");
++MODULE_ALIAS("spi:ksz9567");
+ MODULE_AUTHOR("Woojung Huh <Woojung.Huh@microchip.com>");
+ MODULE_DESCRIPTION("Microchip KSZ9477 Series Switch SPI access Driver");
+ MODULE_LICENSE("GPL");
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Harini Katakam <harini.katakam@xilinx.com>
+Date: Wed, 5 Feb 2020 18:08:12 +0530
+Subject: net: macb: Limit maximum GEM TX length in TSO
+
+From: Harini Katakam <harini.katakam@xilinx.com>
+
+[ Upstream commit f822e9c4ffa511a5c681cf866287d9383a3b6f1b ]
+
+GEM_MAX_TX_LEN currently resolves to 0x3FF8 for any IP version supporting
+TSO with full 14bits of length field in payload descriptor. But an IP
+errata causes false amba_error (bit 6 of ISR) when length in payload
+descriptors is specified above 16387. The error occurs because the DMA
+falsely concludes that there is not enough space in SRAM for incoming
+payload. These errors were observed continuously under stress of large
+packets using iperf on a version where SRAM was 16K for each queue. This
+errata will be documented shortly and affects all versions since TSO
+functionality was added. Hence limit the max length to 0x3FC0 (rounded).
+
+Signed-off-by: Harini Katakam <harini.katakam@xilinx.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -73,7 +73,11 @@ struct sifive_fu540_macb_mgmt {
+ /* Max length of transmit frame must be a multiple of 8 bytes */
+ #define MACB_TX_LEN_ALIGN 8
+ #define MACB_MAX_TX_LEN ((unsigned int)((1 << MACB_TX_FRMLEN_SIZE) - 1) & ~((unsigned int)(MACB_TX_LEN_ALIGN - 1)))
+-#define GEM_MAX_TX_LEN ((unsigned int)((1 << GEM_TX_FRMLEN_SIZE) - 1) & ~((unsigned int)(MACB_TX_LEN_ALIGN - 1)))
++/* Limit maximum TX length as per Cadence TSO errata. This is to avoid a
++ * false amba_error in TX path from the DMA assuming there is not enough
++ * space in the SRAM (16KB) even when there is.
++ */
++#define GEM_MAX_TX_LEN (unsigned int)(0x3FC0)
+
+ #define GEM_MTU_MIN_SIZE ETH_MIN_MTU
+ #define MACB_NETIF_LSO NETIF_F_TSO
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Harini Katakam <harini.katakam@xilinx.com>
+Date: Wed, 5 Feb 2020 18:08:11 +0530
+Subject: net: macb: Remove unnecessary alignment check for TSO
+
+From: Harini Katakam <harini.katakam@xilinx.com>
+
+[ Upstream commit 41c1ef978c8d0259c6636e6d2d854777e92650eb ]
+
+The IP TSO implementation does NOT require the length to be a
+multiple of 8. That is only a requirement for UFO as per IP
+documentation. Hence, exit macb_features_check function in the
+beginning if the protocol is not UDP. Only when it is UDP,
+proceed further to the alignment checks. Update comments to
+reflect the same. Also remove dead code checking for protocol
+TCP when calculating header length.
+
+Fixes: 1629dd4f763c ("cadence: Add LSO support.")
+Signed-off-by: Harini Katakam <harini.katakam@xilinx.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1752,16 +1752,14 @@ static netdev_features_t macb_features_c
+
+ /* Validate LSO compatibility */
+
+- /* there is only one buffer */
+- if (!skb_is_nonlinear(skb))
++ /* there is only one buffer or protocol is not UDP */
++ if (!skb_is_nonlinear(skb) || (ip_hdr(skb)->protocol != IPPROTO_UDP))
+ return features;
+
+ /* length of header */
+ hdrlen = skb_transport_offset(skb);
+- if (ip_hdr(skb)->protocol == IPPROTO_TCP)
+- hdrlen += tcp_hdrlen(skb);
+
+- /* For LSO:
++ /* For UFO only:
+ * When software supplies two or more payload buffers all payload buffers
+ * apart from the last must be a multiple of 8 bytes in size.
+ */
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Tariq Toukan <tariqt@mellanox.com>
+Date: Mon, 27 Jan 2020 14:18:14 +0200
+Subject: net/mlx5: Deprecate usage of generic TLS HW capability bit
+
+From: Tariq Toukan <tariqt@mellanox.com>
+
+[ Upstream commit 61c00cca41aeeaa8e5263c2f81f28534bc1efafb ]
+
+Deprecate the generic TLS cap bit, use the new TX-specific
+TLS cap bit instead.
+
+Fixes: a12ff35e0fb7 ("net/mlx5: Introduce TLS TX offload hardware bits and structures")
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Reviewed-by: Eran Ben Elisha <eranbe@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/accel/tls.h | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/fw.c | 2 +-
+ include/linux/mlx5/mlx5_ifc.h | 7 ++++---
+ 4 files changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/accel/tls.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/accel/tls.h
+@@ -45,7 +45,7 @@ void mlx5_ktls_destroy_key(struct mlx5_c
+
+ static inline bool mlx5_accel_is_ktls_device(struct mlx5_core_dev *mdev)
+ {
+- if (!MLX5_CAP_GEN(mdev, tls))
++ if (!MLX5_CAP_GEN(mdev, tls_tx))
+ return false;
+
+ if (!MLX5_CAP_GEN(mdev, log_max_dek))
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.c
+@@ -269,7 +269,7 @@ struct sk_buff *mlx5e_tls_handle_tx_skb(
+ int datalen;
+ u32 skb_seq;
+
+- if (MLX5_CAP_GEN(sq->channel->mdev, tls)) {
++ if (MLX5_CAP_GEN(sq->channel->mdev, tls_tx)) {
+ skb = mlx5e_ktls_handle_tx_skb(netdev, sq, skb, wqe, pi);
+ goto out;
+ }
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
+@@ -239,7 +239,7 @@ int mlx5_query_hca_caps(struct mlx5_core
+ return err;
+ }
+
+- if (MLX5_CAP_GEN(dev, tls)) {
++ if (MLX5_CAP_GEN(dev, tls_tx)) {
+ err = mlx5_core_get_caps(dev, MLX5_CAP_TLS);
+ if (err)
+ return err;
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -1418,14 +1418,15 @@ struct mlx5_ifc_cmd_hca_cap_bits {
+
+ u8 reserved_at_440[0x20];
+
+- u8 tls[0x1];
+- u8 reserved_at_461[0x2];
++ u8 reserved_at_460[0x3];
+ u8 log_max_uctx[0x5];
+ u8 reserved_at_468[0x3];
+ u8 log_max_umem[0x5];
+ u8 max_num_eqs[0x10];
+
+- u8 reserved_at_480[0x3];
++ u8 reserved_at_480[0x1];
++ u8 tls_tx[0x1];
++ u8 reserved_at_482[0x1];
+ u8 log_max_l2_table[0x5];
+ u8 reserved_at_488[0x8];
+ u8 log_uar_page_sz[0x10];
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Maor Gottlieb <maorg@mellanox.com>
+Date: Mon, 27 Jan 2020 09:27:51 +0200
+Subject: net/mlx5: Fix deadlock in fs_core
+
+From: Maor Gottlieb <maorg@mellanox.com>
+
+[ Upstream commit c1948390d78b5183ee9b7dd831efd7f6ac496ab0 ]
+
+free_match_list could be called when the flow table is already
+locked. We need to pass this notation to tree_put_node.
+
+It fixes the following lockdep warnning:
+
+[ 1797.268537] ============================================
+[ 1797.276837] WARNING: possible recursive locking detected
+[ 1797.285101] 5.5.0-rc5+ #10 Not tainted
+[ 1797.291641] --------------------------------------------
+[ 1797.299917] handler10/9296 is trying to acquire lock:
+[ 1797.307885] ffff889ad399a0a0 (&node->lock){++++}, at:
+tree_put_node+0x1d5/0x210 [mlx5_core]
+[ 1797.319694]
+[ 1797.319694] but task is already holding lock:
+[ 1797.330904] ffff889ad399a0a0 (&node->lock){++++}, at:
+nested_down_write_ref_node.part.33+0x1a/0x60 [mlx5_core]
+[ 1797.344707]
+[ 1797.344707] other info that might help us debug this:
+[ 1797.356952] Possible unsafe locking scenario:
+[ 1797.356952]
+[ 1797.368333] CPU0
+[ 1797.373357] ----
+[ 1797.378364] lock(&node->lock);
+[ 1797.384222] lock(&node->lock);
+[ 1797.390031]
+[ 1797.390031] *** DEADLOCK ***
+[ 1797.390031]
+[ 1797.403003] May be due to missing lock nesting notation
+[ 1797.403003]
+[ 1797.414691] 3 locks held by handler10/9296:
+[ 1797.421465] #0: ffff889cf2c5a110 (&block->cb_lock){++++}, at:
+tc_setup_cb_add+0x70/0x250
+[ 1797.432810] #1: ffff88a030081490 (&comp->sem){++++}, at:
+mlx5_devcom_get_peer_data+0x4c/0xb0 [mlx5_core]
+[ 1797.445829] #2: ffff889ad399a0a0 (&node->lock){++++}, at:
+nested_down_write_ref_node.part.33+0x1a/0x60 [mlx5_core]
+[ 1797.459913]
+[ 1797.459913] stack backtrace:
+[ 1797.469436] CPU: 1 PID: 9296 Comm: handler10 Kdump: loaded Not
+tainted 5.5.0-rc5+ #10
+[ 1797.480643] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS
+2.4.3 01/17/2017
+[ 1797.491480] Call Trace:
+[ 1797.496701] dump_stack+0x96/0xe0
+[ 1797.502864] __lock_acquire.cold.63+0xf8/0x212
+[ 1797.510301] ? lockdep_hardirqs_on+0x250/0x250
+[ 1797.517701] ? mark_held_locks+0x55/0xa0
+[ 1797.524547] ? quarantine_put+0xb7/0x160
+[ 1797.531422] ? lockdep_hardirqs_on+0x17d/0x250
+[ 1797.538913] lock_acquire+0xd6/0x1f0
+[ 1797.545529] ? tree_put_node+0x1d5/0x210 [mlx5_core]
+[ 1797.553701] down_write+0x94/0x140
+[ 1797.560206] ? tree_put_node+0x1d5/0x210 [mlx5_core]
+[ 1797.568464] ? down_write_killable_nested+0x170/0x170
+[ 1797.576925] ? del_hw_flow_group+0xde/0x1f0 [mlx5_core]
+[ 1797.585629] tree_put_node+0x1d5/0x210 [mlx5_core]
+[ 1797.593891] ? free_match_list.part.25+0x147/0x170 [mlx5_core]
+[ 1797.603389] free_match_list.part.25+0xe0/0x170 [mlx5_core]
+[ 1797.612654] _mlx5_add_flow_rules+0x17e2/0x20b0 [mlx5_core]
+[ 1797.621838] ? lock_acquire+0xd6/0x1f0
+[ 1797.629028] ? esw_get_prio_table+0xb0/0x3e0 [mlx5_core]
+[ 1797.637981] ? alloc_insert_flow_group+0x420/0x420 [mlx5_core]
+[ 1797.647459] ? try_to_wake_up+0x4c7/0xc70
+[ 1797.654881] ? lock_downgrade+0x350/0x350
+[ 1797.662271] ? __mutex_unlock_slowpath+0xb1/0x3f0
+[ 1797.670396] ? find_held_lock+0xac/0xd0
+[ 1797.677540] ? mlx5_add_flow_rules+0xdc/0x360 [mlx5_core]
+[ 1797.686467] mlx5_add_flow_rules+0xdc/0x360 [mlx5_core]
+[ 1797.695134] ? _mlx5_add_flow_rules+0x20b0/0x20b0 [mlx5_core]
+[ 1797.704270] ? irq_exit+0xa5/0x170
+[ 1797.710764] ? retint_kernel+0x10/0x10
+[ 1797.717698] ? mlx5_eswitch_set_rule_source_port.isra.9+0x122/0x230
+[mlx5_core]
+[ 1797.728708] mlx5_eswitch_add_offloaded_rule+0x465/0x6d0 [mlx5_core]
+[ 1797.738713] ? mlx5_eswitch_get_prio_range+0x30/0x30 [mlx5_core]
+[ 1797.748384] ? mlx5_fc_stats_work+0x670/0x670 [mlx5_core]
+[ 1797.757400] mlx5e_tc_offload_fdb_rules.isra.27+0x24/0x90 [mlx5_core]
+[ 1797.767665] mlx5e_tc_add_fdb_flow+0xaf8/0xd40 [mlx5_core]
+[ 1797.776886] ? mlx5e_encap_put+0xd0/0xd0 [mlx5_core]
+[ 1797.785562] ? mlx5e_alloc_flow.isra.43+0x18c/0x1c0 [mlx5_core]
+[ 1797.795353] __mlx5e_add_fdb_flow+0x2e2/0x440 [mlx5_core]
+[ 1797.804558] ? mlx5e_tc_update_neigh_used_value+0x8c0/0x8c0
+[mlx5_core]
+[ 1797.815093] ? wait_for_completion+0x260/0x260
+[ 1797.823272] mlx5e_configure_flower+0xe94/0x1620 [mlx5_core]
+[ 1797.832792] ? __mlx5e_add_fdb_flow+0x440/0x440 [mlx5_core]
+[ 1797.842096] ? down_read+0x11a/0x2e0
+[ 1797.849090] ? down_write+0x140/0x140
+[ 1797.856142] ? mlx5e_rep_indr_setup_block_cb+0xc0/0xc0 [mlx5_core]
+[ 1797.866027] tc_setup_cb_add+0x11a/0x250
+[ 1797.873339] fl_hw_replace_filter+0x25e/0x320 [cls_flower]
+[ 1797.882385] ? fl_hw_destroy_filter+0x1c0/0x1c0 [cls_flower]
+[ 1797.891607] fl_change+0x1d54/0x1fb6 [cls_flower]
+[ 1797.899772] ? __rhashtable_insert_fast.constprop.50+0x9f0/0x9f0
+[cls_flower]
+[ 1797.910728] ? lock_downgrade+0x350/0x350
+[ 1797.918187] ? __radix_tree_lookup+0xa5/0x130
+[ 1797.926046] ? fl_set_key+0x1590/0x1590 [cls_flower]
+[ 1797.934611] ? __rhashtable_insert_fast.constprop.50+0x9f0/0x9f0
+[cls_flower]
+[ 1797.945673] tc_new_tfilter+0xcd1/0x1240
+[ 1797.953138] ? tc_del_tfilter+0xb10/0xb10
+[ 1797.960688] ? avc_has_perm_noaudit+0x92/0x320
+[ 1797.968721] ? avc_has_perm_noaudit+0x1df/0x320
+[ 1797.976816] ? avc_has_extended_perms+0x990/0x990
+[ 1797.985090] ? mark_lock+0xaa/0x9e0
+[ 1797.991988] ? match_held_lock+0x1b/0x240
+[ 1797.999457] ? match_held_lock+0x1b/0x240
+[ 1798.006859] ? find_held_lock+0xac/0xd0
+[ 1798.014045] ? symbol_put_addr+0x40/0x40
+[ 1798.021317] ? rcu_read_lock_sched_held+0xd0/0xd0
+[ 1798.029460] ? tc_del_tfilter+0xb10/0xb10
+[ 1798.036810] rtnetlink_rcv_msg+0x4d5/0x620
+[ 1798.044236] ? rtnl_bridge_getlink+0x460/0x460
+[ 1798.052034] ? lockdep_hardirqs_on+0x250/0x250
+[ 1798.059837] ? match_held_lock+0x1b/0x240
+[ 1798.067146] ? find_held_lock+0xac/0xd0
+[ 1798.074246] netlink_rcv_skb+0xc6/0x1f0
+[ 1798.081339] ? rtnl_bridge_getlink+0x460/0x460
+[ 1798.089104] ? netlink_ack+0x440/0x440
+[ 1798.096061] netlink_unicast+0x2d4/0x3b0
+[ 1798.103189] ? netlink_attachskb+0x3f0/0x3f0
+[ 1798.110724] ? _copy_from_iter_full+0xda/0x370
+[ 1798.118415] netlink_sendmsg+0x3ba/0x6a0
+[ 1798.125478] ? netlink_unicast+0x3b0/0x3b0
+[ 1798.132705] ? netlink_unicast+0x3b0/0x3b0
+[ 1798.139880] sock_sendmsg+0x94/0xa0
+[ 1798.146332] ____sys_sendmsg+0x36c/0x3f0
+[ 1798.153251] ? copy_msghdr_from_user+0x165/0x230
+[ 1798.160941] ? kernel_sendmsg+0x30/0x30
+[ 1798.167738] ___sys_sendmsg+0xeb/0x150
+[ 1798.174411] ? sendmsg_copy_msghdr+0x30/0x30
+[ 1798.181649] ? lock_downgrade+0x350/0x350
+[ 1798.188559] ? rcu_read_lock_sched_held+0xd0/0xd0
+[ 1798.196239] ? __fget+0x21d/0x320
+[ 1798.202335] ? do_dup2+0x2a0/0x2a0
+[ 1798.208499] ? lock_downgrade+0x350/0x350
+[ 1798.215366] ? __fget_light+0xd6/0xf0
+[ 1798.221808] ? syscall_trace_enter+0x369/0x5d0
+[ 1798.229112] __sys_sendmsg+0xd3/0x160
+[ 1798.235511] ? __sys_sendmsg_sock+0x60/0x60
+[ 1798.242478] ? syscall_trace_enter+0x233/0x5d0
+[ 1798.249721] ? syscall_slow_exit_work+0x280/0x280
+[ 1798.257211] ? do_syscall_64+0x1e/0x2e0
+[ 1798.263680] do_syscall_64+0x72/0x2e0
+[ 1798.269950] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fixes: bd71b08ec2ee ("net/mlx5: Support multiple updates of steering rules in parallel")
+Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Alaa Hleihel <alaa@mellanox.com>
+Reviewed-by: Mark Bloch <markb@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -1555,16 +1555,16 @@ struct match_list_head {
+ struct match_list first;
+ };
+
+-static void free_match_list(struct match_list_head *head)
++static void free_match_list(struct match_list_head *head, bool ft_locked)
+ {
+ if (!list_empty(&head->list)) {
+ struct match_list *iter, *match_tmp;
+
+ list_del(&head->first.list);
+- tree_put_node(&head->first.g->node, false);
++ tree_put_node(&head->first.g->node, ft_locked);
+ list_for_each_entry_safe(iter, match_tmp, &head->list,
+ list) {
+- tree_put_node(&iter->g->node, false);
++ tree_put_node(&iter->g->node, ft_locked);
+ list_del(&iter->list);
+ kfree(iter);
+ }
+@@ -1573,7 +1573,8 @@ static void free_match_list(struct match
+
+ static int build_match_list(struct match_list_head *match_head,
+ struct mlx5_flow_table *ft,
+- const struct mlx5_flow_spec *spec)
++ const struct mlx5_flow_spec *spec,
++ bool ft_locked)
+ {
+ struct rhlist_head *tmp, *list;
+ struct mlx5_flow_group *g;
+@@ -1598,7 +1599,7 @@ static int build_match_list(struct match
+
+ curr_match = kmalloc(sizeof(*curr_match), GFP_ATOMIC);
+ if (!curr_match) {
+- free_match_list(match_head);
++ free_match_list(match_head, ft_locked);
+ err = -ENOMEM;
+ goto out;
+ }
+@@ -1778,7 +1779,7 @@ search_again_locked:
+ version = atomic_read(&ft->node.version);
+
+ /* Collect all fgs which has a matching match_criteria */
+- err = build_match_list(&match_head, ft, spec);
++ err = build_match_list(&match_head, ft, spec, take_write);
+ if (err) {
+ if (take_write)
+ up_write_ref_node(&ft->node, false);
+@@ -1792,7 +1793,7 @@ search_again_locked:
+
+ rule = try_add_to_existing_fg(ft, &match_head.list, spec, flow_act, dest,
+ dest_num, version);
+- free_match_list(&match_head);
++ free_match_list(&match_head, take_write);
+ if (!IS_ERR(rule) ||
+ (PTR_ERR(rule) != -ENOENT && PTR_ERR(rule) != -EAGAIN)) {
+ if (take_write)
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Raed Salem <raeds@mellanox.com>
+Date: Tue, 24 Dec 2019 09:54:45 +0200
+Subject: net/mlx5: IPsec, Fix esp modify function attribute
+
+From: Raed Salem <raeds@mellanox.com>
+
+[ Upstream commit 0dc2c534f17c05bed0622b37a744bc38b48ca88a ]
+
+The function mlx5_fpga_esp_validate_xfrm_attrs is wrongly used
+with negative negation as zero value indicates success but it
+used as failure return value instead.
+
+Fix by remove the unary not negation operator.
+
+Fixes: 05564d0ae075 ("net/mlx5: Add flow-steering commands for FPGA IPSec implementation")
+Signed-off-by: Raed Salem <raeds@mellanox.com>
+Reviewed-by: Boris Pismenny <borisp@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+@@ -1478,7 +1478,7 @@ int mlx5_fpga_esp_modify_xfrm(struct mlx
+ if (!memcmp(&xfrm->attrs, attrs, sizeof(xfrm->attrs)))
+ return 0;
+
+- if (!mlx5_fpga_esp_validate_xfrm_attrs(mdev, attrs)) {
++ if (mlx5_fpga_esp_validate_xfrm_attrs(mdev, attrs)) {
+ mlx5_core_warn(mdev, "Tried to create an esp with unsupported attrs\n");
+ return -EOPNOTSUPP;
+ }
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Raed Salem <raeds@mellanox.com>
+Date: Wed, 23 Oct 2019 16:41:21 +0300
+Subject: net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx
+
+From: Raed Salem <raeds@mellanox.com>
+
+[ Upstream commit 08db2cf577487f5123aebcc2f913e0b8a2c14b43 ]
+
+SA context is allocated at mlx5_fpga_ipsec_create_sa_ctx,
+however the counterpart mlx5_fpga_ipsec_delete_sa_ctx function
+nullifies sa_ctx pointer without freeing the memory allocated,
+hence the memory leak.
+
+Fix by free SA context when the SA is released.
+
+Fixes: d6c4f0298cec ("net/mlx5: Refactor accel IPSec code")
+Signed-off-by: Raed Salem <raeds@mellanox.com>
+Reviewed-by: Boris Pismenny <borisp@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+@@ -850,6 +850,7 @@ void mlx5_fpga_ipsec_delete_sa_ctx(void
+ mutex_lock(&fpga_xfrm->lock);
+ if (!--fpga_xfrm->num_rules) {
+ mlx5_fpga_ipsec_release_sa_ctx(fpga_xfrm->sa_ctx);
++ kfree(fpga_xfrm->sa_ctx);
+ fpga_xfrm->sa_ctx = NULL;
+ }
+ mutex_unlock(&fpga_xfrm->lock);
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Tariq Toukan <tariqt@mellanox.com>
+Date: Thu, 9 Jan 2020 15:53:37 +0200
+Subject: net/mlx5e: TX, Error completion is for last WQE in batch
+
+From: Tariq Toukan <tariqt@mellanox.com>
+
+[ Upstream commit b57e66ad42d051ed31319c28ed1b62b191299a29 ]
+
+For a cyclic work queue, when not requesting a completion per WQE,
+a single CQE might indicate the completion of several WQEs.
+However, in case some WQE in the batch causes an error, then an error
+completion is issued, breaking the batch, and pointing to the offending
+WQE in the wqe_counter field.
+
+Hence, WQE-specific error CQE handling (like printing, breaking, etc...)
+should be performed only for the last WQE in batch.
+
+Fixes: 130c7b46c93d ("net/mlx5e: TX, Dump WQs wqe descriptors on CQE with error events")
+Fixes: fd9b4be8002c ("net/mlx5e: RX, Support multiple outstanding UMR posts")
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Reviewed-by: Aya Levin <ayal@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 16 ++++++-----
+ drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 33 ++++++++++--------------
+ 2 files changed, 23 insertions(+), 26 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -613,13 +613,6 @@ void mlx5e_poll_ico_cq(struct mlx5e_cq *
+
+ wqe_counter = be16_to_cpu(cqe->wqe_counter);
+
+- if (unlikely(get_cqe_opcode(cqe) != MLX5_CQE_REQ)) {
+- netdev_WARN_ONCE(cq->channel->netdev,
+- "Bad OP in ICOSQ CQE: 0x%x\n", get_cqe_opcode(cqe));
+- if (!test_and_set_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state))
+- queue_work(cq->channel->priv->wq, &sq->recover_work);
+- break;
+- }
+ do {
+ struct mlx5e_sq_wqe_info *wi;
+ u16 ci;
+@@ -629,6 +622,15 @@ void mlx5e_poll_ico_cq(struct mlx5e_cq *
+ ci = mlx5_wq_cyc_ctr2ix(&sq->wq, sqcc);
+ wi = &sq->db.ico_wqe[ci];
+
++ if (last_wqe && unlikely(get_cqe_opcode(cqe) != MLX5_CQE_REQ)) {
++ netdev_WARN_ONCE(cq->channel->netdev,
++ "Bad OP in ICOSQ CQE: 0x%x\n",
++ get_cqe_opcode(cqe));
++ if (!test_and_set_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state))
++ queue_work(cq->channel->priv->wq, &sq->recover_work);
++ break;
++ }
++
+ if (likely(wi->opcode == MLX5_OPCODE_UMR)) {
+ sqcc += MLX5E_UMR_WQEBBS;
+ wi->umr.rq->mpwqe.umr_completed++;
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+@@ -451,34 +451,17 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *c
+
+ i = 0;
+ do {
++ struct mlx5e_tx_wqe_info *wi;
+ u16 wqe_counter;
+ bool last_wqe;
++ u16 ci;
+
+ mlx5_cqwq_pop(&cq->wq);
+
+ wqe_counter = be16_to_cpu(cqe->wqe_counter);
+
+- if (unlikely(get_cqe_opcode(cqe) == MLX5_CQE_REQ_ERR)) {
+- if (!test_and_set_bit(MLX5E_SQ_STATE_RECOVERING,
+- &sq->state)) {
+- struct mlx5e_tx_wqe_info *wi;
+- u16 ci;
+-
+- ci = mlx5_wq_cyc_ctr2ix(&sq->wq, sqcc);
+- wi = &sq->db.wqe_info[ci];
+- mlx5e_dump_error_cqe(sq,
+- (struct mlx5_err_cqe *)cqe);
+- mlx5_wq_cyc_wqe_dump(&sq->wq, ci, wi->num_wqebbs);
+- queue_work(cq->channel->priv->wq,
+- &sq->recover_work);
+- }
+- stats->cqe_err++;
+- }
+-
+ do {
+- struct mlx5e_tx_wqe_info *wi;
+ struct sk_buff *skb;
+- u16 ci;
+ int j;
+
+ last_wqe = (sqcc == wqe_counter);
+@@ -516,6 +499,18 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *c
+ napi_consume_skb(skb, napi_budget);
+ } while (!last_wqe);
+
++ if (unlikely(get_cqe_opcode(cqe) == MLX5_CQE_REQ_ERR)) {
++ if (!test_and_set_bit(MLX5E_SQ_STATE_RECOVERING,
++ &sq->state)) {
++ mlx5e_dump_error_cqe(sq,
++ (struct mlx5_err_cqe *)cqe);
++ mlx5_wq_cyc_wqe_dump(&sq->wq, ci, wi->num_wqebbs);
++ queue_work(cq->channel->priv->wq,
++ &sq->recover_work);
++ }
++ stats->cqe_err++;
++ }
++
+ } while ((++i < MLX5E_TX_CQ_POLL_BUDGET) && (cqe = mlx5_cqwq_get_cqe(&cq->wq)));
+
+ stats->cqes += i;
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 6 Feb 2020 10:14:39 +0100
+Subject: net: mvneta: move rx_dropped and rx_errors in per-cpu stats
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit c35947b8ff8acca33134ee39c31708233765c31a ]
+
+Move rx_dropped and rx_errors counters in mvneta_pcpu_stats in order to
+avoid possible races updating statistics
+
+Fixes: 562e2f467e71 ("net: mvneta: Improve the buffer allocation method for SWBM")
+Fixes: dc35a10f68d3 ("net: mvneta: bm: add support for hardware buffer management")
+Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 31 ++++++++++++++++++++++---------
+ 1 file changed, 22 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -401,6 +401,8 @@ struct mvneta_pcpu_stats {
+ struct u64_stats_sync syncp;
+ u64 rx_packets;
+ u64 rx_bytes;
++ u64 rx_dropped;
++ u64 rx_errors;
+ u64 tx_packets;
+ u64 tx_bytes;
+ };
+@@ -738,6 +740,8 @@ mvneta_get_stats64(struct net_device *de
+ struct mvneta_pcpu_stats *cpu_stats;
+ u64 rx_packets;
+ u64 rx_bytes;
++ u64 rx_dropped;
++ u64 rx_errors;
+ u64 tx_packets;
+ u64 tx_bytes;
+
+@@ -746,19 +750,20 @@ mvneta_get_stats64(struct net_device *de
+ start = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
+ rx_packets = cpu_stats->rx_packets;
+ rx_bytes = cpu_stats->rx_bytes;
++ rx_dropped = cpu_stats->rx_dropped;
++ rx_errors = cpu_stats->rx_errors;
+ tx_packets = cpu_stats->tx_packets;
+ tx_bytes = cpu_stats->tx_bytes;
+ } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, start));
+
+ stats->rx_packets += rx_packets;
+ stats->rx_bytes += rx_bytes;
++ stats->rx_dropped += rx_dropped;
++ stats->rx_errors += rx_errors;
+ stats->tx_packets += tx_packets;
+ stats->tx_bytes += tx_bytes;
+ }
+
+- stats->rx_errors = dev->stats.rx_errors;
+- stats->rx_dropped = dev->stats.rx_dropped;
+-
+ stats->tx_dropped = dev->stats.tx_dropped;
+ }
+
+@@ -1736,8 +1741,14 @@ static u32 mvneta_txq_desc_csum(int l3_o
+ static void mvneta_rx_error(struct mvneta_port *pp,
+ struct mvneta_rx_desc *rx_desc)
+ {
++ struct mvneta_pcpu_stats *stats = this_cpu_ptr(pp->stats);
+ u32 status = rx_desc->status;
+
++ /* update per-cpu counter */
++ u64_stats_update_begin(&stats->syncp);
++ stats->rx_errors++;
++ u64_stats_update_end(&stats->syncp);
++
+ switch (status & MVNETA_RXD_ERR_CODE_MASK) {
+ case MVNETA_RXD_ERR_CRC:
+ netdev_err(pp->dev, "bad rx status %08x (crc error), size=%d\n",
+@@ -2179,11 +2190,15 @@ mvneta_swbm_rx_frame(struct mvneta_port
+
+ rxq->skb = build_skb(xdp->data_hard_start, PAGE_SIZE);
+ if (unlikely(!rxq->skb)) {
+- netdev_err(dev,
+- "Can't allocate skb on queue %d\n",
+- rxq->id);
+- dev->stats.rx_dropped++;
++ struct mvneta_pcpu_stats *stats = this_cpu_ptr(pp->stats);
++
++ netdev_err(dev, "Can't allocate skb on queue %d\n", rxq->id);
+ rxq->skb_alloc_err++;
++
++ u64_stats_update_begin(&stats->syncp);
++ stats->rx_dropped++;
++ u64_stats_update_end(&stats->syncp);
++
+ return -ENOMEM;
+ }
+ page_pool_release_page(rxq->page_pool, page);
+@@ -2270,7 +2285,6 @@ static int mvneta_rx_swbm(struct napi_st
+ /* Check errors only for FIRST descriptor */
+ if (rx_status & MVNETA_RXD_ERR_SUMMARY) {
+ mvneta_rx_error(pp, rx_desc);
+- dev->stats.rx_errors++;
+ /* leave the descriptor untouched */
+ continue;
+ }
+@@ -2372,7 +2386,6 @@ err_drop_frame_ret_pool:
+ mvneta_bm_pool_put_bp(pp->bm_priv, bm_pool,
+ rx_desc->buf_phys_addr);
+ err_drop_frame:
+- dev->stats.rx_errors++;
+ mvneta_rx_error(pp, rx_desc);
+ /* leave the descriptor untouched */
+ continue;
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Dejin Zheng <zhengdejin5@gmail.com>
+Date: Thu, 6 Feb 2020 23:29:17 +0800
+Subject: net: stmmac: fix a possible endless loop
+
+From: Dejin Zheng <zhengdejin5@gmail.com>
+
+[ Upstream commit 7d10f0774f9e32aa2f2e012f7fcb312a2ce422b9 ]
+
+It forgot to reduce the value of the variable retry in a while loop
+in the ethqos_configure() function. It may cause an endless loop and
+without timeout.
+
+Fixes: a7c30e62d4b8 ("net: stmmac: Add driver for Qualcomm ethqos")
+Signed-off-by: Dejin Zheng <zhengdejin5@gmail.com>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+@@ -413,6 +413,7 @@ static int ethqos_configure(struct qcom_
+ dll_lock = rgmii_readl(ethqos, SDC4_STATUS);
+ if (dll_lock & SDC4_STATUS_DLL_LOCK)
+ break;
++ retry--;
+ } while (retry > 0);
+ if (!retry)
+ dev_err(ðqos->pdev->dev,
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: "Tan, Tee Min" <tee.min.tan@intel.com>
+Date: Fri, 7 Feb 2020 15:33:20 +0800
+Subject: net: stmmac: fix incorrect GMAC_VLAN_TAG register writting in GMAC4+
+
+From: "Tan, Tee Min" <tee.min.tan@intel.com>
+
+[ Upstream commit 9eeeb3c9de4e3aeaa2bec097162f09305dd9f4c3 ]
+
+It should always do a read of current value of GMAC_VLAN_TAG instead of
+directly overwriting the register value.
+
+Fixes: c1be0022df0d ("net: stmmac: Add VLAN HASH filtering support in GMAC4+")
+Signed-off-by: Tan, Tee Min <tee.min.tan@intel.com>
+Signed-off-by: Ong Boon Leong <boon.leong.ong@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -736,11 +736,14 @@ static void dwmac4_update_vlan_hash(stru
+ __le16 perfect_match, bool is_double)
+ {
+ void __iomem *ioaddr = hw->pcsr;
++ u32 value;
+
+ writel(hash, ioaddr + GMAC_VLAN_HASH_TABLE);
+
++ value = readl(ioaddr + GMAC_VLAN_TAG);
++
+ if (hash) {
+- u32 value = GMAC_VLAN_VTHM | GMAC_VLAN_ETV;
++ value |= GMAC_VLAN_VTHM | GMAC_VLAN_ETV;
+ if (is_double) {
+ value |= GMAC_VLAN_EDVLP;
+ value |= GMAC_VLAN_ESVL;
+@@ -759,8 +762,6 @@ static void dwmac4_update_vlan_hash(stru
+
+ writel(value | perfect_match, ioaddr + GMAC_VLAN_TAG);
+ } else {
+- u32 value = readl(ioaddr + GMAC_VLAN_TAG);
+-
+ value &= ~(GMAC_VLAN_VTHM | GMAC_VLAN_ETV);
+ value &= ~(GMAC_VLAN_EDVLP | GMAC_VLAN_ESVL);
+ value &= ~GMAC_VLAN_DOVLTC;
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: "Verma, Aashish" <aashishx.verma@intel.com>
+Date: Fri, 7 Feb 2020 15:33:54 +0800
+Subject: net: stmmac: fix missing IFF_MULTICAST check in dwmac4_set_filter
+
+From: "Verma, Aashish" <aashishx.verma@intel.com>
+
+[ Upstream commit 2ba31cd93784b61813226d259fd94a221ecd9d61 ]
+
+Without checking for IFF_MULTICAST flag, it is wrong to assume multicast
+filtering is always enabled. By checking against IFF_MULTICAST, now
+the driver behaves correctly when the multicast support is toggled by below
+command:-
+ ip link set <devname> multicast off|on
+
+Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
+Signed-off-by: Verma, Aashish <aashishx.verma@intel.com>
+Tested-by: Tan, Tee Min <tee.min.tan@intel.com>
+Signed-off-by: Ong Boon Leong <boon.leong.ong@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -420,7 +420,7 @@ static void dwmac4_set_filter(struct mac
+ value |= GMAC_PACKET_FILTER_PM;
+ /* Set all the bits of the HASH tab */
+ memset(mc_filter, 0xff, sizeof(mc_filter));
+- } else if (!netdev_mc_empty(dev)) {
++ } else if (!netdev_mc_empty(dev) && (dev->flags & IFF_MULTICAST)) {
+ struct netdev_hw_addr *ha;
+
+ /* Hash filter for multicast */
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Voon Weifeng <weifeng.voon@intel.com>
+Date: Fri, 7 Feb 2020 15:34:28 +0800
+Subject: net: stmmac: update pci platform data to use phy_interface
+
+From: Voon Weifeng <weifeng.voon@intel.com>
+
+[ Upstream commit 909c1dde67c433f1e4122f2619cbd8ac370fcf0a ]
+
+The recent patch to support passive mode converter did not take care the
+phy interface configuration in PCI platform data. Hence, converting all
+the PCI platform data from plat->interface to plat->phy_interface as the
+default mode is meant for PHY.
+
+Fixes: 0060c8783330 ("net: stmmac: implement support for passive mode converters via dt")
+Signed-off-by: Voon Weifeng <weifeng.voon@intel.com>
+Tested-by: Tan, Tee Min <tee.min.tan@intel.com>
+Signed-off-by: Ong Boon Leong <boon.leong.ong@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+@@ -96,7 +96,7 @@ static int stmmac_default_data(struct pc
+
+ plat->bus_id = 1;
+ plat->phy_addr = 0;
+- plat->interface = PHY_INTERFACE_MODE_GMII;
++ plat->phy_interface = PHY_INTERFACE_MODE_GMII;
+
+ plat->dma_cfg->pbl = 32;
+ plat->dma_cfg->pblx8 = true;
+@@ -220,7 +220,8 @@ static int ehl_sgmii_data(struct pci_dev
+ {
+ plat->bus_id = 1;
+ plat->phy_addr = 0;
+- plat->interface = PHY_INTERFACE_MODE_SGMII;
++ plat->phy_interface = PHY_INTERFACE_MODE_SGMII;
++
+ return ehl_common_data(pdev, plat);
+ }
+
+@@ -233,7 +234,8 @@ static int ehl_rgmii_data(struct pci_dev
+ {
+ plat->bus_id = 1;
+ plat->phy_addr = 0;
+- plat->interface = PHY_INTERFACE_MODE_RGMII;
++ plat->phy_interface = PHY_INTERFACE_MODE_RGMII;
++
+ return ehl_common_data(pdev, plat);
+ }
+
+@@ -261,7 +263,7 @@ static int tgl_sgmii_data(struct pci_dev
+ {
+ plat->bus_id = 1;
+ plat->phy_addr = 0;
+- plat->interface = PHY_INTERFACE_MODE_SGMII;
++ plat->phy_interface = PHY_INTERFACE_MODE_SGMII;
+ return tgl_common_data(pdev, plat);
+ }
+
+@@ -361,7 +363,7 @@ static int quark_default_data(struct pci
+
+ plat->bus_id = pci_dev_id(pdev);
+ plat->phy_addr = ret;
+- plat->interface = PHY_INTERFACE_MODE_RMII;
++ plat->phy_interface = PHY_INTERFACE_MODE_RMII;
+
+ plat->dma_cfg->pbl = 16;
+ plat->dma_cfg->pblx8 = true;
+@@ -418,7 +420,7 @@ static int snps_gmac5_default_data(struc
+
+ plat->bus_id = 1;
+ plat->phy_addr = -1;
+- plat->interface = PHY_INTERFACE_MODE_GMII;
++ plat->phy_interface = PHY_INTERFACE_MODE_GMII;
+
+ plat->dma_cfg->pbl = 32;
+ plat->dma_cfg->pblx8 = true;
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Ong Boon Leong <boon.leong.ong@intel.com>
+Date: Fri, 7 Feb 2020 15:33:40 +0800
+Subject: net: stmmac: xgmac: fix incorrect XGMAC_VLAN_TAG register writting
+
+From: Ong Boon Leong <boon.leong.ong@intel.com>
+
+[ Upstream commit 907a076881f171254219faad05f46ac5baabedfb ]
+
+We should always do a read of current value of XGMAC_VLAN_TAG instead of
+directly overwriting the register value.
+
+Fixes: 3cd1cfcba26e2 ("net: stmmac: Implement VLAN Hash Filtering in XGMAC")
+Signed-off-by: Ong Boon Leong <boon.leong.ong@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+@@ -569,7 +569,9 @@ static void dwxgmac2_update_vlan_hash(st
+
+ writel(value, ioaddr + XGMAC_PACKET_FILTER);
+
+- value = XGMAC_VLAN_VTHM | XGMAC_VLAN_ETV;
++ value = readl(ioaddr + XGMAC_VLAN_TAG);
++
++ value |= XGMAC_VLAN_VTHM | XGMAC_VLAN_ETV;
+ if (is_double) {
+ value |= XGMAC_VLAN_EDVLP;
+ value |= XGMAC_VLAN_ESVL;
+@@ -584,7 +586,9 @@ static void dwxgmac2_update_vlan_hash(st
+
+ writel(value, ioaddr + XGMAC_PACKET_FILTER);
+
+- value = XGMAC_VLAN_ETV;
++ value = readl(ioaddr + XGMAC_VLAN_TAG);
++
++ value |= XGMAC_VLAN_ETV;
+ if (is_double) {
+ value |= XGMAC_VLAN_EDVLP;
+ value |= XGMAC_VLAN_ESVL;
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: "Tan, Tee Min" <tee.min.tan@intel.com>
+Date: Fri, 7 Feb 2020 15:34:15 +0800
+Subject: net: stmmac: xgmac: fix missing IFF_MULTICAST checki in dwxgmac2_set_filter
+
+From: "Tan, Tee Min" <tee.min.tan@intel.com>
+
+[ Upstream commit 2f633d5820e4ed870f408957322acb9263bce2f4 ]
+
+Without checking for IFF_MULTICAST flag, it is wrong to assume multicast
+filtering is always enabled. By checking against IFF_MULTICAST, now
+the driver behaves correctly when the multicast support is toggled by below
+command:-
+ ip link set <devname> multicast off|on
+
+Fixes: 0efedbf11f07a ("net: stmmac: xgmac: Fix XGMAC selftests")
+Signed-off-by: Tan, Tee Min <tee.min.tan@intel.com>
+Signed-off-by: Ong Boon Leong <boon.leong.ong@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+@@ -458,7 +458,7 @@ static void dwxgmac2_set_filter(struct m
+
+ for (i = 0; i < XGMAC_MAX_HASH_TABLE; i++)
+ writel(~0x0, ioaddr + XGMAC_HASH_TABLE(i));
+- } else if (!netdev_mc_empty(dev)) {
++ } else if (!netdev_mc_empty(dev) && (dev->flags & IFF_MULTICAST)) {
+ struct netdev_hw_addr *ha;
+
+ value |= XGMAC_FILTER_HMC;
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Wed, 5 Feb 2020 12:32:04 -0800
+Subject: net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 263a425a482fc495d6d3f9a29b9103a664c38b69 ]
+
+After a number of suspend and resume cycles, it is possible for the RBUF
+to be stuck in Wake-on-LAN mode, despite the MPD enable bit being
+cleared which instructed the RBUF to exit that mode.
+
+Avoid creating that problematic condition by clearing the RX_EN and
+TX_EN bits in the UniMAC prior to disable the Magic Packet Detector
+logic which is guaranteed to make the RBUF exit Wake-on-LAN mode.
+
+Fixes: 83e82f4c706b ("net: systemport: add Wake-on-LAN support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2728,6 +2728,9 @@ static int __maybe_unused bcm_sysport_re
+
+ umac_reset(priv);
+
++ /* Disable the UniMAC RX/TX */
++ umac_enable_set(priv, CMD_RX_EN | CMD_TX_EN, 0);
++
+ /* We may have been suspended and never received a WOL event that
+ * would turn off MPD detection, take care of that now
+ */
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Tue, 4 Feb 2020 11:10:12 -0800
+Subject: net_sched: fix a resource leak in tcindex_set_parms()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit 52b5ae501c045010aeeb1d5ac0373ff161a88291 ]
+
+Jakub noticed there is a potential resource leak in
+tcindex_set_parms(): when tcindex_filter_result_init() fails
+and it jumps to 'errout1' which doesn't release the memory
+and resources allocated by tcindex_alloc_perfect_hash().
+
+We should just jump to 'errout_alloc' which calls
+tcindex_free_perfect_hash().
+
+Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()")
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Jiri Pirko <jiri@resnulli.us>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/cls_tcindex.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -365,7 +365,7 @@ tcindex_set_parms(struct net *net, struc
+
+ err = tcindex_filter_result_init(&new_filter_result, net);
+ if (err < 0)
+- goto errout1;
++ goto errout_alloc;
+ if (old_r)
+ cr = r->res;
+
+@@ -484,7 +484,6 @@ errout_alloc:
+ tcindex_free_perfect_hash(cp);
+ else if (balloc == 2)
+ kfree(cp->h);
+-errout1:
+ tcf_exts_destroy(&new_filter_result.exts);
+ errout:
+ kfree(cp);
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Date: Wed, 5 Feb 2020 05:10:55 -0800
+Subject: qed: Fix timestamping issue for L2 unicast ptp packets.
+
+From: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+
+[ Upstream commit 0202d293c2faecba791ba4afc5aec086249c393d ]
+
+commit cedeac9df4b8 ("qed: Add support for Timestamping the unicast
+PTP packets.") handles the timestamping of L4 ptp packets only.
+This patch adds driver changes to detect/timestamp both L2/L4 unicast
+PTP packets.
+
+Fixes: cedeac9df4b8 ("qed: Add support for Timestamping the unicast PTP packets.")
+Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ptp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_ptp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ptp.c
+@@ -44,8 +44,8 @@
+ /* Add/subtract the Adjustment_Value when making a Drift adjustment */
+ #define QED_DRIFT_CNTR_DIRECTION_SHIFT 31
+ #define QED_TIMESTAMP_MASK BIT(16)
+-/* Param mask for Hardware to detect/timestamp the unicast PTP packets */
+-#define QED_PTP_UCAST_PARAM_MASK 0xF
++/* Param mask for Hardware to detect/timestamp the L2/L4 unicast PTP packets */
++#define QED_PTP_UCAST_PARAM_MASK 0x70F
+
+ static enum qed_resc_lock qed_ptcdev_to_resc(struct qed_hwfn *p_hwfn)
+ {
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 5 Feb 2020 21:22:46 +0100
+Subject: r8169: fix performance regression related to PCIe max read request size
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 21b5f672fb2eb1366dedc4ac9d32431146b378d3 ]
+
+It turned out that on low performance systems the original change can
+cause lower tx performance. On a N3450-based mini-PC tx performance
+in iperf3 was reduced from 950Mbps to ~900Mbps. Therefore effectively
+revert the original change, just use pcie_set_readrq() now instead of
+changing the PCIe capability register directly.
+
+Fixes: 2df49d365498 ("r8169: remove fiddling with the PCIe max read request size")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -3865,15 +3865,18 @@ static void rtl_hw_jumbo_enable(struct r
+ switch (tp->mac_version) {
+ case RTL_GIGA_MAC_VER_12:
+ case RTL_GIGA_MAC_VER_17:
++ pcie_set_readrq(tp->pci_dev, 512);
+ r8168b_1_hw_jumbo_enable(tp);
+ break;
+ case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_26:
++ pcie_set_readrq(tp->pci_dev, 512);
+ r8168c_hw_jumbo_enable(tp);
+ break;
+ case RTL_GIGA_MAC_VER_27 ... RTL_GIGA_MAC_VER_28:
+ r8168dp_hw_jumbo_enable(tp);
+ break;
+ case RTL_GIGA_MAC_VER_31 ... RTL_GIGA_MAC_VER_33:
++ pcie_set_readrq(tp->pci_dev, 512);
+ r8168e_hw_jumbo_enable(tp);
+ break;
+ default:
+@@ -3903,6 +3906,9 @@ static void rtl_hw_jumbo_disable(struct
+ break;
+ }
+ rtl_lock_config_regs(tp);
++
++ if (pci_is_pcie(tp->pci_dev) && tp->supports_gmii)
++ pcie_set_readrq(tp->pci_dev, 4096);
+ }
+
+ static void rtl_jumbo_config(struct rtl8169_private *tp, int mtu)
bpf-fix-trampoline-usage-in-preempt.patch
libbpf-extract-and-generalize-cpu-mask-parsing-logic.patch
x86-timer-don-t-skip-pit-setup-when-apic-is-disabled-or-in-legacy-mode.patch
+bonding-alb-properly-access-headers-in-bond_alb_xmit.patch
+devlink-report-0-after-hitting-end-in-region-read.patch
+dpaa_eth-support-all-modes-with-rate-adapting-phys.patch
+net-dsa-b53-always-use-dev-vlan_enabled-in-b53_configure_vlan.patch
+net-dsa-bcm_sf2-only-7278-supports-2gb-sec-imp-port.patch
+net-dsa-microchip-enable-module-autoprobe.patch
+net-mvneta-move-rx_dropped-and-rx_errors-in-per-cpu-stats.patch
+net_sched-fix-a-resource-leak-in-tcindex_set_parms.patch
+net-stmmac-fix-a-possible-endless-loop.patch
+net-systemport-avoid-rbuf-stuck-in-wake-on-lan-mode.patch
+net-mlx5-ipsec-fix-esp-modify-function-attribute.patch
+net-mlx5-ipsec-fix-memory-leak-at-mlx5_fpga_ipsec_delete_sa_ctx.patch
+net-macb-remove-unnecessary-alignment-check-for-tso.patch
+net-macb-limit-maximum-gem-tx-length-in-tso.patch
+net-stmmac-fix-incorrect-gmac_vlan_tag-register-writting-in-gmac4.patch
+net-stmmac-xgmac-fix-incorrect-xgmac_vlan_tag-register-writting.patch
+net-stmmac-fix-missing-iff_multicast-check-in-dwmac4_set_filter.patch
+net-stmmac-xgmac-fix-missing-iff_multicast-checki-in-dwxgmac2_set_filter.patch
+net-stmmac-update-pci-platform-data-to-use-phy_interface.patch
+taprio-fix-enabling-offload-with-wrong-number-of-traffic-classes.patch
+taprio-fix-still-allowing-changing-the-flags-during-runtime.patch
+taprio-add-missing-policy-validation-for-flags.patch
+taprio-use-taprio_reset_tc-to-reset-traffic-classes-configuration.patch
+taprio-fix-dropping-packets-when-using-taprio-etf-offloading.patch
+ipv6-addrconf-fix-potential-null-deref-in-inet6_set_link_af.patch
+qed-fix-timestamping-issue-for-l2-unicast-ptp-packets.patch
+drop_monitor-do-not-cancel-uninitialized-work-item.patch
+net-mlx5-fix-deadlock-in-fs_core.patch
+net-mlx5-deprecate-usage-of-generic-tls-hw-capability-bit.patch
+r8169-fix-performance-regression-related-to-pcie-max-read-request-size.patch
+net-mlx5e-tx-error-completion-is-for-last-wqe-in-batch.patch
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Date: Thu, 6 Feb 2020 13:46:08 -0800
+Subject: taprio: Add missing policy validation for flags
+
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+
+[ Upstream commit 49c684d79cfdc3032344bf6f3deeea81c4efedbf ]
+
+netlink policy validation for the 'flags' argument was missing.
+
+Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode")
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_taprio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -767,6 +767,7 @@ static const struct nla_policy taprio_po
+ [TCA_TAPRIO_ATTR_SCHED_CLOCKID] = { .type = NLA_S32 },
+ [TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME] = { .type = NLA_S64 },
+ [TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION] = { .type = NLA_S64 },
++ [TCA_TAPRIO_ATTR_FLAGS] = { .type = NLA_U32 },
+ };
+
+ static int fill_sched_entry(struct nlattr **tb, struct sched_entry *entry,
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Date: Thu, 6 Feb 2020 13:46:10 -0800
+Subject: taprio: Fix dropping packets when using taprio + ETF offloading
+
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+
+[ Upstream commit bfabd41da34180d05382312533a3adc2e012dee0 ]
+
+When using taprio offloading together with ETF offloading, configured
+like this, for example:
+
+$ tc qdisc replace dev $IFACE parent root handle 100 taprio \
+ num_tc 4 \
+ map 2 2 1 0 3 2 2 2 2 2 2 2 2 2 2 2 \
+ queues 1@0 1@1 1@2 1@3 \
+ base-time $BASE_TIME \
+ sched-entry S 01 1000000 \
+ sched-entry S 0e 1000000 \
+ flags 0x2
+
+$ tc qdisc replace dev $IFACE parent 100:1 etf \
+ offload delta 300000 clockid CLOCK_TAI
+
+During enqueue, it works out that the verification added for the
+"txtime" assisted mode is run when using taprio + ETF offloading, the
+only thing missing is initializing the 'next_txtime' of all the cycle
+entries. (if we don't set 'next_txtime' all packets from SO_TXTIME
+sockets are dropped)
+
+Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode")
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_taprio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -1522,9 +1522,9 @@ static int taprio_change(struct Qdisc *s
+ goto unlock;
+ }
+
+- if (TXTIME_ASSIST_IS_ENABLED(q->flags)) {
+- setup_txtime(q, new_admin, start);
++ setup_txtime(q, new_admin, start);
+
++ if (TXTIME_ASSIST_IS_ENABLED(q->flags)) {
+ if (!oper) {
+ rcu_assign_pointer(q->oper_sched, new_admin);
+ err = 0;
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Date: Thu, 6 Feb 2020 13:46:06 -0800
+Subject: taprio: Fix enabling offload with wrong number of traffic classes
+
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+
+[ Upstream commit 5652e63df3303c2a702bac25fbf710b9cb64dfba ]
+
+If the driver implementing taprio offloading depends on the value of
+the network device number of traffic classes (dev->num_tc) for
+whatever reason, it was going to receive the value zero. The value was
+only set after the offloading function is called.
+
+So, moving setting the number of traffic classes to before the
+offloading function is called fixes this issue. This is safe because
+this only happens when taprio is instantiated (we don't allow this
+configuration to be changed without first removing taprio).
+
+Fixes: 9c66d1564676 ("taprio: Add support for hardware offloading")
+Reported-by: Po Liu <po.liu@nxp.com>
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Acked-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_taprio.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -1444,6 +1444,19 @@ static int taprio_change(struct Qdisc *s
+
+ taprio_set_picos_per_byte(dev, q);
+
++ if (mqprio) {
++ netdev_set_num_tc(dev, mqprio->num_tc);
++ for (i = 0; i < mqprio->num_tc; i++)
++ netdev_set_tc_queue(dev, i,
++ mqprio->count[i],
++ mqprio->offset[i]);
++
++ /* Always use supplied priority mappings */
++ for (i = 0; i <= TC_BITMASK; i++)
++ netdev_set_prio_tc_map(dev, i,
++ mqprio->prio_tc_map[i]);
++ }
++
+ if (FULL_OFFLOAD_IS_ENABLED(taprio_flags))
+ err = taprio_enable_offload(dev, mqprio, q, new_admin, extack);
+ else
+@@ -1471,19 +1484,6 @@ static int taprio_change(struct Qdisc *s
+ q->advance_timer.function = advance_sched;
+ }
+
+- if (mqprio) {
+- netdev_set_num_tc(dev, mqprio->num_tc);
+- for (i = 0; i < mqprio->num_tc; i++)
+- netdev_set_tc_queue(dev, i,
+- mqprio->count[i],
+- mqprio->offset[i]);
+-
+- /* Always use supplied priority mappings */
+- for (i = 0; i <= TC_BITMASK; i++)
+- netdev_set_prio_tc_map(dev, i,
+- mqprio->prio_tc_map[i]);
+- }
+-
+ if (FULL_OFFLOAD_IS_ENABLED(taprio_flags)) {
+ q->dequeue = taprio_dequeue_offload;
+ q->peek = taprio_peek_offload;
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Date: Thu, 6 Feb 2020 13:46:07 -0800
+Subject: taprio: Fix still allowing changing the flags during runtime
+
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+
+[ Upstream commit a9d6227436f32142209f4428f2dc616761485112 ]
+
+Because 'q->flags' starts as zero, and zero is a valid value, we
+aren't able to detect the transition from zero to something else
+during "runtime".
+
+The solution is to initialize 'q->flags' with an invalid value, so we
+can detect if 'q->flags' was set by the user or not.
+
+To better solidify the behavior, 'flags' handling is moved to a
+separate function. The behavior is:
+ - 'flags' if unspecified by the user, is assumed to be zero;
+ - 'flags' cannot change during "runtime" (i.e. a change() request
+ cannot modify it);
+
+With this new function we can remove taprio_flags, which should reduce
+the risk of future accidents.
+
+Allowing flags to be changed was causing the following RCU stall:
+
+[ 1730.558249] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
+[ 1730.558258] rcu: 6-...0: (190 ticks this GP) idle=922/0/0x1 softirq=25580/25582 fqs=16250
+[ 1730.558264] (detected by 2, t=65002 jiffies, g=33017, q=81)
+[ 1730.558269] Sending NMI from CPU 2 to CPUs 6:
+[ 1730.559277] NMI backtrace for cpu 6
+[ 1730.559277] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G E 5.5.0-rc6+ #35
+[ 1730.559278] Hardware name: Gigabyte Technology Co., Ltd. Z390 AORUS ULTRA/Z390 AORUS ULTRA-CF, BIOS F7 03/14/2019
+[ 1730.559278] RIP: 0010:__hrtimer_run_queues+0xe2/0x440
+[ 1730.559278] Code: 48 8b 43 28 4c 89 ff 48 8b 75 c0 48 89 45 c8 e8 f4 bb 7c 00 0f 1f 44 00 00 65 8b 05 40 31 f0 68 89 c0 48 0f a3 05 3e 5c 25 01 <0f> 82 fc 01 00 00 48 8b 45 c8 48 89 df ff d0 89 45 c8 0f 1f 44 00
+[ 1730.559279] RSP: 0018:ffff9970802d8f10 EFLAGS: 00000083
+[ 1730.559279] RAX: 0000000000000006 RBX: ffff8b31645bff38 RCX: 0000000000000000
+[ 1730.559280] RDX: 0000000000000000 RSI: ffffffff9710f2ec RDI: ffffffff978daf0e
+[ 1730.559280] RBP: ffff9970802d8f68 R08: 0000000000000000 R09: 0000000000000000
+[ 1730.559280] R10: 0000018336d7944e R11: 0000000000000001 R12: ffff8b316e39f9c0
+[ 1730.559281] R13: ffff8b316e39f940 R14: ffff8b316e39f998 R15: ffff8b316e39f7c0
+[ 1730.559281] FS: 0000000000000000(0000) GS:ffff8b316e380000(0000) knlGS:0000000000000000
+[ 1730.559281] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1730.559281] CR2: 00007f1105303760 CR3: 0000000227210005 CR4: 00000000003606e0
+[ 1730.559282] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1730.559282] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 1730.559282] Call Trace:
+[ 1730.559282] <IRQ>
+[ 1730.559283] ? taprio_dequeue_soft+0x2d0/0x2d0 [sch_taprio]
+[ 1730.559283] hrtimer_interrupt+0x104/0x220
+[ 1730.559283] ? irqtime_account_irq+0x34/0xa0
+[ 1730.559283] smp_apic_timer_interrupt+0x6d/0x230
+[ 1730.559284] apic_timer_interrupt+0xf/0x20
+[ 1730.559284] </IRQ>
+[ 1730.559284] RIP: 0010:cpu_idle_poll+0x35/0x1a0
+[ 1730.559285] Code: 88 82 ff 65 44 8b 25 12 7d 73 68 0f 1f 44 00 00 e8 90 c3 89 ff fb 65 48 8b 1c 25 c0 7e 01 00 48 8b 03 a8 08 74 0b eb 1c f3 90 <48> 8b 03 a8 08 75 13 8b 05 be a8 a8 00 85 c0 75 ed e8 75 48 84 ff
+[ 1730.559285] RSP: 0018:ffff997080137ea8 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
+[ 1730.559285] RAX: 0000000000000001 RBX: ffff8b316bc3c580 RCX: 0000000000000000
+[ 1730.559286] RDX: 0000000000000001 RSI: 000000002819aad9 RDI: ffffffff978da730
+[ 1730.559286] RBP: ffff997080137ec0 R08: 0000018324a6d387 R09: 0000000000000000
+[ 1730.559286] R10: 0000000000000400 R11: 0000000000000001 R12: 0000000000000006
+[ 1730.559286] R13: ffff8b316bc3c580 R14: 0000000000000000 R15: 0000000000000000
+[ 1730.559287] ? cpu_idle_poll+0x20/0x1a0
+[ 1730.559287] ? cpu_idle_poll+0x20/0x1a0
+[ 1730.559287] do_idle+0x4d/0x1f0
+[ 1730.559287] ? complete+0x44/0x50
+[ 1730.559288] cpu_startup_entry+0x1b/0x20
+[ 1730.559288] start_secondary+0x142/0x180
+[ 1730.559288] secondary_startup_64+0xb6/0xc0
+[ 1776.686313] nvme nvme0: I/O 96 QID 1 timeout, completion polled
+
+Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode")
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_taprio.c | 61 ++++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 41 insertions(+), 20 deletions(-)
+
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -31,6 +31,7 @@ static DEFINE_SPINLOCK(taprio_list_lock)
+
+ #define TXTIME_ASSIST_IS_ENABLED(flags) ((flags) & TCA_TAPRIO_ATTR_FLAG_TXTIME_ASSIST)
+ #define FULL_OFFLOAD_IS_ENABLED(flags) ((flags) & TCA_TAPRIO_ATTR_FLAG_FULL_OFFLOAD)
++#define TAPRIO_FLAGS_INVALID U32_MAX
+
+ struct sched_entry {
+ struct list_head list;
+@@ -1367,6 +1368,33 @@ static int taprio_mqprio_cmp(const struc
+ return 0;
+ }
+
++/* The semantics of the 'flags' argument in relation to 'change()'
++ * requests, are interpreted following two rules (which are applied in
++ * this order): (1) an omitted 'flags' argument is interpreted as
++ * zero; (2) the 'flags' of a "running" taprio instance cannot be
++ * changed.
++ */
++static int taprio_new_flags(const struct nlattr *attr, u32 old,
++ struct netlink_ext_ack *extack)
++{
++ u32 new = 0;
++
++ if (attr)
++ new = nla_get_u32(attr);
++
++ if (old != TAPRIO_FLAGS_INVALID && old != new) {
++ NL_SET_ERR_MSG_MOD(extack, "Changing 'flags' of a running schedule is not supported");
++ return -EOPNOTSUPP;
++ }
++
++ if (!taprio_flags_valid(new)) {
++ NL_SET_ERR_MSG_MOD(extack, "Specified 'flags' are not valid");
++ return -EINVAL;
++ }
++
++ return new;
++}
++
+ static int taprio_change(struct Qdisc *sch, struct nlattr *opt,
+ struct netlink_ext_ack *extack)
+ {
+@@ -1375,7 +1403,6 @@ static int taprio_change(struct Qdisc *s
+ struct taprio_sched *q = qdisc_priv(sch);
+ struct net_device *dev = qdisc_dev(sch);
+ struct tc_mqprio_qopt *mqprio = NULL;
+- u32 taprio_flags = 0;
+ unsigned long flags;
+ ktime_t start;
+ int i, err;
+@@ -1388,21 +1415,14 @@ static int taprio_change(struct Qdisc *s
+ if (tb[TCA_TAPRIO_ATTR_PRIOMAP])
+ mqprio = nla_data(tb[TCA_TAPRIO_ATTR_PRIOMAP]);
+
+- if (tb[TCA_TAPRIO_ATTR_FLAGS]) {
+- taprio_flags = nla_get_u32(tb[TCA_TAPRIO_ATTR_FLAGS]);
+-
+- if (q->flags != 0 && q->flags != taprio_flags) {
+- NL_SET_ERR_MSG_MOD(extack, "Changing 'flags' of a running schedule is not supported");
+- return -EOPNOTSUPP;
+- } else if (!taprio_flags_valid(taprio_flags)) {
+- NL_SET_ERR_MSG_MOD(extack, "Specified 'flags' are not valid");
+- return -EINVAL;
+- }
++ err = taprio_new_flags(tb[TCA_TAPRIO_ATTR_FLAGS],
++ q->flags, extack);
++ if (err < 0)
++ return err;
+
+- q->flags = taprio_flags;
+- }
++ q->flags = err;
+
+- err = taprio_parse_mqprio_opt(dev, mqprio, extack, taprio_flags);
++ err = taprio_parse_mqprio_opt(dev, mqprio, extack, q->flags);
+ if (err < 0)
+ return err;
+
+@@ -1457,7 +1477,7 @@ static int taprio_change(struct Qdisc *s
+ mqprio->prio_tc_map[i]);
+ }
+
+- if (FULL_OFFLOAD_IS_ENABLED(taprio_flags))
++ if (FULL_OFFLOAD_IS_ENABLED(q->flags))
+ err = taprio_enable_offload(dev, mqprio, q, new_admin, extack);
+ else
+ err = taprio_disable_offload(dev, q, extack);
+@@ -1477,14 +1497,14 @@ static int taprio_change(struct Qdisc *s
+ q->txtime_delay = nla_get_u32(tb[TCA_TAPRIO_ATTR_TXTIME_DELAY]);
+ }
+
+- if (!TXTIME_ASSIST_IS_ENABLED(taprio_flags) &&
+- !FULL_OFFLOAD_IS_ENABLED(taprio_flags) &&
++ if (!TXTIME_ASSIST_IS_ENABLED(q->flags) &&
++ !FULL_OFFLOAD_IS_ENABLED(q->flags) &&
+ !hrtimer_active(&q->advance_timer)) {
+ hrtimer_init(&q->advance_timer, q->clockid, HRTIMER_MODE_ABS);
+ q->advance_timer.function = advance_sched;
+ }
+
+- if (FULL_OFFLOAD_IS_ENABLED(taprio_flags)) {
++ if (FULL_OFFLOAD_IS_ENABLED(q->flags)) {
+ q->dequeue = taprio_dequeue_offload;
+ q->peek = taprio_peek_offload;
+ } else {
+@@ -1501,7 +1521,7 @@ static int taprio_change(struct Qdisc *s
+ goto unlock;
+ }
+
+- if (TXTIME_ASSIST_IS_ENABLED(taprio_flags)) {
++ if (TXTIME_ASSIST_IS_ENABLED(q->flags)) {
+ setup_txtime(q, new_admin, start);
+
+ if (!oper) {
+@@ -1528,7 +1548,7 @@ static int taprio_change(struct Qdisc *s
+
+ spin_unlock_irqrestore(&q->current_entry_lock, flags);
+
+- if (FULL_OFFLOAD_IS_ENABLED(taprio_flags))
++ if (FULL_OFFLOAD_IS_ENABLED(q->flags))
+ taprio_offload_config_changed(q);
+ }
+
+@@ -1597,6 +1617,7 @@ static int taprio_init(struct Qdisc *sch
+ * and get the valid one on taprio_change().
+ */
+ q->clockid = -1;
++ q->flags = TAPRIO_FLAGS_INVALID;
+
+ spin_lock(&taprio_list_lock);
+ list_add(&q->taprio_list, &taprio_list);
--- /dev/null
+From foo@baz Sun 09 Feb 2020 10:47:54 PM CET
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Date: Thu, 6 Feb 2020 13:46:09 -0800
+Subject: taprio: Use taprio_reset_tc() to reset Traffic Classes configuration
+
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+
+[ Upstream commit 7c16680a08ee1e444a67d232c679ccf5b30fad16 ]
+
+When destroying the current taprio instance, which can happen when the
+creation of one fails, we should reset the traffic class configuration
+back to the default state.
+
+netdev_reset_tc() is a better way because in addition to setting the
+number of traffic classes to zero, it also resets the priority to
+traffic classes mapping to the default value.
+
+Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_taprio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -1588,7 +1588,7 @@ static void taprio_destroy(struct Qdisc
+ }
+ q->qdiscs = NULL;
+
+- netdev_set_num_tc(dev, 0);
++ netdev_reset_tc(dev);
+
+ if (q->oper_sched)
+ call_rcu(&q->oper_sched->rcu, taprio_free_sched_cb);
projects / thirdparty / kernel / stable-queue.git / commitdiff
