]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.9-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 19 Dec 2020 10:39:46 +0000 (11:39 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 19 Dec 2020 10:39:46 +0000 (11:39 +0100)
added patches:
bonding-fix-feature-flag-setting-at-init-time.patch
bridge-fix-a-deadlock-when-enabling-multicast-snooping.patch
ch_ktls-fix-build-warning-for-ipv4-only-config.patch
e1000e-fix-s0ix-flow-to-allow-s0i3.2-subset-entry.patch
enetc-fix-reporting-of-h-w-packet-counters.patch
ethtool-fix-stack-overflow-in-ethnl_parse_bitset.patch
ipv4-fix-error-return-code-in-rtm_to_fib_config.patch
lan743x-fix-for-potential-null-pointer-dereference-with-bare-card.patch
mac80211-mesh-fix-mesh_pathtbl_init-error-path.patch
mptcp-print-new-line-in-mptcp_seq_show-if-mptcp-isn-t-in-use.patch
net-bridge-vlan-fix-error-return-code-in-__vlan_add.patch
net-flow_offload-fix-memory-leak-for-indirect-flow-block.patch
net-hns3-remove-a-misused-pragma-packed.patch
net-ipa-pass-the-correct-size-when-freeing-dma-memory.patch
net-ll_temac-fix-potential-null-dereference-in-temac_probe.patch
net-mlx4_en-avoid-scheduling-restart-task-if-it-is-already-running.patch
net-mlx4_en-handle-tx-error-cqe.patch
net-mscc-ocelot-fix-dropping-of-unknown-ipv4-multicast-on-seville.patch
net-sched-fix-dump-of-mpls_opt_lse_label-attribute-in-cls_flower.patch
net-sched-fq_pie-initialize-timer-earlier-in-fq_pie_init.patch
net-stmmac-delete-the-eee_ctrl_timer-after-napi-disabled.patch
net-stmmac-dwmac-meson8b-fix-mask-definition-of-the-m250_sel-mux.patch
net-stmmac-free-tx-skb-buffer-in-stmmac_resume.patch
net-stmmac-increase-the-timeout-for-dma-reset.patch
net-stmmac-overwrite-the-dma_cap.addr64-according-to-hw-design.patch
net-stmmac-start-phylink-instance-before-stmmac_hw_setup.patch
net-tipc-prevent-possible-null-deref-of-link.patch
tcp-fix-cwnd-limited-bug-for-tso-deferral-where-we-send-nothing.patch
tcp-select-sane-initial-rcvq_space.space-for-big-mss.patch
udp-fix-the-proto-value-passed-to-ip_protocol_deliver_rcu-for-the-segments.patch
vrf-packets-with-lladdr-src-needs-dst-at-input-with-orig_iif-when-needs-strict.patch

32 files changed:
queue-5.9/bonding-fix-feature-flag-setting-at-init-time.patch [new file with mode: 0644]
queue-5.9/bridge-fix-a-deadlock-when-enabling-multicast-snooping.patch [new file with mode: 0644]
queue-5.9/ch_ktls-fix-build-warning-for-ipv4-only-config.patch [new file with mode: 0644]
queue-5.9/e1000e-fix-s0ix-flow-to-allow-s0i3.2-subset-entry.patch [new file with mode: 0644]
queue-5.9/enetc-fix-reporting-of-h-w-packet-counters.patch [new file with mode: 0644]
queue-5.9/ethtool-fix-stack-overflow-in-ethnl_parse_bitset.patch [new file with mode: 0644]
queue-5.9/ipv4-fix-error-return-code-in-rtm_to_fib_config.patch [new file with mode: 0644]
queue-5.9/lan743x-fix-for-potential-null-pointer-dereference-with-bare-card.patch [new file with mode: 0644]
queue-5.9/mac80211-mesh-fix-mesh_pathtbl_init-error-path.patch [new file with mode: 0644]
queue-5.9/mptcp-print-new-line-in-mptcp_seq_show-if-mptcp-isn-t-in-use.patch [new file with mode: 0644]
queue-5.9/net-bridge-vlan-fix-error-return-code-in-__vlan_add.patch [new file with mode: 0644]
queue-5.9/net-flow_offload-fix-memory-leak-for-indirect-flow-block.patch [new file with mode: 0644]
queue-5.9/net-hns3-remove-a-misused-pragma-packed.patch [new file with mode: 0644]
queue-5.9/net-ipa-pass-the-correct-size-when-freeing-dma-memory.patch [new file with mode: 0644]
queue-5.9/net-ll_temac-fix-potential-null-dereference-in-temac_probe.patch [new file with mode: 0644]
queue-5.9/net-mlx4_en-avoid-scheduling-restart-task-if-it-is-already-running.patch [new file with mode: 0644]
queue-5.9/net-mlx4_en-handle-tx-error-cqe.patch [new file with mode: 0644]
queue-5.9/net-mscc-ocelot-fix-dropping-of-unknown-ipv4-multicast-on-seville.patch [new file with mode: 0644]
queue-5.9/net-sched-fix-dump-of-mpls_opt_lse_label-attribute-in-cls_flower.patch [new file with mode: 0644]
queue-5.9/net-sched-fq_pie-initialize-timer-earlier-in-fq_pie_init.patch [new file with mode: 0644]
queue-5.9/net-stmmac-delete-the-eee_ctrl_timer-after-napi-disabled.patch [new file with mode: 0644]
queue-5.9/net-stmmac-dwmac-meson8b-fix-mask-definition-of-the-m250_sel-mux.patch [new file with mode: 0644]
queue-5.9/net-stmmac-free-tx-skb-buffer-in-stmmac_resume.patch [new file with mode: 0644]
queue-5.9/net-stmmac-increase-the-timeout-for-dma-reset.patch [new file with mode: 0644]
queue-5.9/net-stmmac-overwrite-the-dma_cap.addr64-according-to-hw-design.patch [new file with mode: 0644]
queue-5.9/net-stmmac-start-phylink-instance-before-stmmac_hw_setup.patch [new file with mode: 0644]
queue-5.9/net-tipc-prevent-possible-null-deref-of-link.patch [new file with mode: 0644]
queue-5.9/series
queue-5.9/tcp-fix-cwnd-limited-bug-for-tso-deferral-where-we-send-nothing.patch [new file with mode: 0644]
queue-5.9/tcp-select-sane-initial-rcvq_space.space-for-big-mss.patch [new file with mode: 0644]
queue-5.9/udp-fix-the-proto-value-passed-to-ip_protocol_deliver_rcu-for-the-segments.patch [new file with mode: 0644]
queue-5.9/vrf-packets-with-lladdr-src-needs-dst-at-input-with-orig_iif-when-needs-strict.patch [new file with mode: 0644]

diff --git a/queue-5.9/bonding-fix-feature-flag-setting-at-init-time.patch b/queue-5.9/bonding-fix-feature-flag-setting-at-init-time.patch
new file mode 100644 (file)
index 0000000..9089f4d
--- /dev/null
@@ -0,0 +1,96 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Jarod Wilson <jarod@redhat.com>
+Date: Sat, 5 Dec 2020 12:22:29 -0500
+Subject: bonding: fix feature flag setting at init time
+
+From: Jarod Wilson <jarod@redhat.com>
+
+[ Upstream commit 007ab5345545aba2f9cbe4c096cc35d2fd3275ac ]
+
+Don't try to adjust XFRM support flags if the bond device isn't yet
+registered. Bad things can currently happen when netdev_change_features()
+is called without having wanted_features fully filled in yet. This code
+runs both on post-module-load mode changes, as well as at module init
+time, and when run at module init time, it is before register_netdevice()
+has been called and filled in wanted_features. The empty wanted_features
+led to features also getting emptied out, which was definitely not the
+intended behavior, so prevent that from happening.
+
+Originally, I'd hoped to stop adjusting wanted_features at all in the
+bonding driver, as it's documented as being something only the network
+core should touch, but we actually do need to do this to properly update
+both the features and wanted_features fields when changing the bond type,
+or we get to a situation where ethtool sees:
+
+    esp-hw-offload: off [requested on]
+
+I do think we should be using netdev_update_features instead of
+netdev_change_features here though, so we only send notifiers when the
+features actually changed.
+
+Fixes: a3b658cfb664 ("bonding: allow xfrm offload setup post-module-load")
+Reported-by: Ivan Vecera <ivecera@redhat.com>
+Suggested-by: Ivan Vecera <ivecera@redhat.com>
+Cc: Jay Vosburgh <j.vosburgh@gmail.com>
+Cc: Veaceslav Falico <vfalico@gmail.com>
+Cc: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Link: https://lore.kernel.org/r/20201205172229.576587-1-jarod@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_options.c |   22 +++++++++++++++-------
+ include/net/bonding.h              |    2 --
+ 2 files changed, 15 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -745,6 +745,19 @@ const struct bond_option *bond_opt_get(u
+       return &bond_opts[option];
+ }
++static void bond_set_xfrm_features(struct net_device *bond_dev, u64 mode)
++{
++      if (!IS_ENABLED(CONFIG_XFRM_OFFLOAD))
++              return;
++
++      if (mode == BOND_MODE_ACTIVEBACKUP)
++              bond_dev->wanted_features |= BOND_XFRM_FEATURES;
++      else
++              bond_dev->wanted_features &= ~BOND_XFRM_FEATURES;
++
++      netdev_update_features(bond_dev);
++}
++
+ static int bond_option_mode_set(struct bonding *bond,
+                               const struct bond_opt_value *newval)
+ {
+@@ -767,13 +780,8 @@ static int bond_option_mode_set(struct b
+       if (newval->value == BOND_MODE_ALB)
+               bond->params.tlb_dynamic_lb = 1;
+-#ifdef CONFIG_XFRM_OFFLOAD
+-      if (newval->value == BOND_MODE_ACTIVEBACKUP)
+-              bond->dev->wanted_features |= BOND_XFRM_FEATURES;
+-      else
+-              bond->dev->wanted_features &= ~BOND_XFRM_FEATURES;
+-      netdev_change_features(bond->dev);
+-#endif /* CONFIG_XFRM_OFFLOAD */
++      if (bond->dev->reg_state == NETREG_REGISTERED)
++              bond_set_xfrm_features(bond->dev, newval->value);
+       /* don't cache arp_validate between modes */
+       bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -86,10 +86,8 @@
+ #define bond_for_each_slave_rcu(bond, pos, iter) \
+       netdev_for_each_lower_private_rcu((bond)->dev, pos, iter)
+-#ifdef CONFIG_XFRM_OFFLOAD
+ #define BOND_XFRM_FEATURES (NETIF_F_HW_ESP | NETIF_F_HW_ESP_TX_CSUM | \
+                           NETIF_F_GSO_ESP)
+-#endif /* CONFIG_XFRM_OFFLOAD */
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ extern atomic_t netpoll_block_tx;
diff --git a/queue-5.9/bridge-fix-a-deadlock-when-enabling-multicast-snooping.patch b/queue-5.9/bridge-fix-a-deadlock-when-enabling-multicast-snooping.patch
new file mode 100644 (file)
index 0000000..6008f7a
--- /dev/null
@@ -0,0 +1,201 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Joseph Huang <Joseph.Huang@garmin.com>
+Date: Fri, 4 Dec 2020 18:56:28 -0500
+Subject: bridge: Fix a deadlock when enabling multicast snooping
+
+From: Joseph Huang <Joseph.Huang@garmin.com>
+
+[ Upstream commit 851d0a73c90e6c8c63fef106c6c1e73df7e05d9d ]
+
+When enabling multicast snooping, bridge module deadlocks on multicast_lock
+if 1) IPv6 is enabled, and 2) there is an existing querier on the same L2
+network.
+
+The deadlock was caused by the following sequence: While holding the lock,
+br_multicast_open calls br_multicast_join_snoopers, which eventually causes
+IP stack to (attempt to) send out a Listener Report (in igmp6_join_group).
+Since the destination Ethernet address is a multicast address, br_dev_xmit
+feeds the packet back to the bridge via br_multicast_rcv, which in turn
+calls br_multicast_add_group, which then deadlocks on multicast_lock.
+
+The fix is to move the call br_multicast_join_snoopers outside of the
+critical section. This works since br_multicast_join_snoopers only deals
+with IP and does not modify any multicast data structures of the bridge,
+so there's no need to hold the lock.
+
+Steps to reproduce:
+1. sysctl net.ipv6.conf.all.force_mld_version=1
+2. have another querier
+3. ip link set dev bridge type bridge mcast_snooping 0 && \
+   ip link set dev bridge type bridge mcast_snooping 1 < deadlock >
+
+A typical call trace looks like the following:
+
+[  936.251495]  _raw_spin_lock+0x5c/0x68
+[  936.255221]  br_multicast_add_group+0x40/0x170 [bridge]
+[  936.260491]  br_multicast_rcv+0x7ac/0xe30 [bridge]
+[  936.265322]  br_dev_xmit+0x140/0x368 [bridge]
+[  936.269689]  dev_hard_start_xmit+0x94/0x158
+[  936.273876]  __dev_queue_xmit+0x5ac/0x7f8
+[  936.277890]  dev_queue_xmit+0x10/0x18
+[  936.281563]  neigh_resolve_output+0xec/0x198
+[  936.285845]  ip6_finish_output2+0x240/0x710
+[  936.290039]  __ip6_finish_output+0x130/0x170
+[  936.294318]  ip6_output+0x6c/0x1c8
+[  936.297731]  NF_HOOK.constprop.0+0xd8/0xe8
+[  936.301834]  igmp6_send+0x358/0x558
+[  936.305326]  igmp6_join_group.part.0+0x30/0xf0
+[  936.309774]  igmp6_group_added+0xfc/0x110
+[  936.313787]  __ipv6_dev_mc_inc+0x1a4/0x290
+[  936.317885]  ipv6_dev_mc_inc+0x10/0x18
+[  936.321677]  br_multicast_open+0xbc/0x110 [bridge]
+[  936.326506]  br_multicast_toggle+0xec/0x140 [bridge]
+
+Fixes: 4effd28c1245 ("bridge: join all-snoopers multicast address")
+Signed-off-by: Joseph Huang <Joseph.Huang@garmin.com>
+Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
+Link: https://lore.kernel.org/r/20201204235628.50653-1-Joseph.Huang@garmin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/br_device.c    |    6 ++++++
+ net/bridge/br_multicast.c |   34 +++++++++++++++++++++++++---------
+ net/bridge/br_private.h   |   10 ++++++++++
+ 3 files changed, 41 insertions(+), 9 deletions(-)
+
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -177,6 +177,9 @@ static int br_dev_open(struct net_device
+       br_stp_enable_bridge(br);
+       br_multicast_open(br);
++      if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
++              br_multicast_join_snoopers(br);
++
+       return 0;
+ }
+@@ -197,6 +200,9 @@ static int br_dev_stop(struct net_device
+       br_stp_disable_bridge(br);
+       br_multicast_stop(br);
++      if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
++              br_multicast_leave_snoopers(br);
++
+       netif_stop_queue(dev);
+       return 0;
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1848,7 +1848,7 @@ static inline void br_ip6_multicast_join
+ }
+ #endif
+-static void br_multicast_join_snoopers(struct net_bridge *br)
++void br_multicast_join_snoopers(struct net_bridge *br)
+ {
+       br_ip4_multicast_join_snoopers(br);
+       br_ip6_multicast_join_snoopers(br);
+@@ -1879,7 +1879,7 @@ static inline void br_ip6_multicast_leav
+ }
+ #endif
+-static void br_multicast_leave_snoopers(struct net_bridge *br)
++void br_multicast_leave_snoopers(struct net_bridge *br)
+ {
+       br_ip4_multicast_leave_snoopers(br);
+       br_ip6_multicast_leave_snoopers(br);
+@@ -1898,9 +1898,6 @@ static void __br_multicast_open(struct n
+ void br_multicast_open(struct net_bridge *br)
+ {
+-      if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
+-              br_multicast_join_snoopers(br);
+-
+       __br_multicast_open(br, &br->ip4_own_query);
+ #if IS_ENABLED(CONFIG_IPV6)
+       __br_multicast_open(br, &br->ip6_own_query);
+@@ -1916,9 +1913,6 @@ void br_multicast_stop(struct net_bridge
+       del_timer_sync(&br->ip6_other_query.timer);
+       del_timer_sync(&br->ip6_own_query.timer);
+ #endif
+-
+-      if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
+-              br_multicast_leave_snoopers(br);
+ }
+ void br_multicast_dev_del(struct net_bridge *br)
+@@ -2049,6 +2043,7 @@ static void br_multicast_start_querier(s
+ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
+ {
+       struct net_bridge_port *port;
++      bool change_snoopers = false;
+       spin_lock_bh(&br->multicast_lock);
+       if (!!br_opt_get(br, BROPT_MULTICAST_ENABLED) == !!val)
+@@ -2057,7 +2052,7 @@ int br_multicast_toggle(struct net_bridg
+       br_mc_disabled_update(br->dev, val);
+       br_opt_toggle(br, BROPT_MULTICAST_ENABLED, !!val);
+       if (!br_opt_get(br, BROPT_MULTICAST_ENABLED)) {
+-              br_multicast_leave_snoopers(br);
++              change_snoopers = true;
+               goto unlock;
+       }
+@@ -2068,9 +2063,30 @@ int br_multicast_toggle(struct net_bridg
+       list_for_each_entry(port, &br->port_list, list)
+               __br_multicast_enable_port(port);
++      change_snoopers = true;
++
+ unlock:
+       spin_unlock_bh(&br->multicast_lock);
++      /* br_multicast_join_snoopers has the potential to cause
++       * an MLD Report/Leave to be delivered to br_multicast_rcv,
++       * which would in turn call br_multicast_add_group, which would
++       * attempt to acquire multicast_lock. This function should be
++       * called after the lock has been released to avoid deadlocks on
++       * multicast_lock.
++       *
++       * br_multicast_leave_snoopers does not have the problem since
++       * br_multicast_rcv first checks BROPT_MULTICAST_ENABLED, and
++       * returns without calling br_multicast_ipv4/6_rcv if it's not
++       * enabled. Moved both functions out just for symmetry.
++       */
++      if (change_snoopers) {
++              if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
++                      br_multicast_join_snoopers(br);
++              else
++                      br_multicast_leave_snoopers(br);
++      }
++
+       return 0;
+ }
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -745,6 +745,8 @@ void br_multicast_del_port(struct net_br
+ void br_multicast_enable_port(struct net_bridge_port *port);
+ void br_multicast_disable_port(struct net_bridge_port *port);
+ void br_multicast_init(struct net_bridge *br);
++void br_multicast_join_snoopers(struct net_bridge *br);
++void br_multicast_leave_snoopers(struct net_bridge *br);
+ void br_multicast_open(struct net_bridge *br);
+ void br_multicast_stop(struct net_bridge *br);
+ void br_multicast_dev_del(struct net_bridge *br);
+@@ -872,6 +874,14 @@ static inline void br_multicast_init(str
+ {
+ }
++static inline void br_multicast_join_snoopers(struct net_bridge *br)
++{
++}
++
++static inline void br_multicast_leave_snoopers(struct net_bridge *br)
++{
++}
++
+ static inline void br_multicast_open(struct net_bridge *br)
+ {
+ }
diff --git a/queue-5.9/ch_ktls-fix-build-warning-for-ipv4-only-config.patch b/queue-5.9/ch_ktls-fix-build-warning-for-ipv4-only-config.patch
new file mode 100644 (file)
index 0000000..13b11ce
--- /dev/null
@@ -0,0 +1,63 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 3 Dec 2020 23:26:16 +0100
+Subject: ch_ktls: fix build warning for ipv4-only config
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a54ba3465d86fa5dd7d41bb88c0b5e71fb3b627e ]
+
+When CONFIG_IPV6 is disabled, clang complains that a variable
+is uninitialized for non-IPv4 data:
+
+drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c:1046:6: error: variable 'cntrl1' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized]
+        if (tx_info->ip_family == AF_INET) {
+            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c:1059:2: note: uninitialized use occurs here
+        cntrl1 |= T6_TXPKT_ETHHDR_LEN_V(maclen - ETH_HLEN) |
+        ^~~~~~
+
+Replace the preprocessor conditional with the corresponding C version,
+and make the ipv4 case unconditional in this configuration to improve
+readability and avoid the warning.
+
+Fixes: 86716b51d14f ("ch_ktls: Update cheksum information")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20201203222641.964234-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/chelsio/chcr_ktls.c |    6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/crypto/chelsio/chcr_ktls.c
++++ b/drivers/crypto/chelsio/chcr_ktls.c
+@@ -921,9 +921,7 @@ chcr_ktls_write_tcp_options(struct chcr_
+       struct fw_eth_tx_pkt_wr *wr;
+       struct cpl_tx_pkt_core *cpl;
+       u32 ctrl, iplen, maclen;
+-#if IS_ENABLED(CONFIG_IPV6)
+       struct ipv6hdr *ip6;
+-#endif
+       unsigned int ndesc;
+       struct tcphdr *tcp;
+       int len16, pktlen;
+@@ -971,17 +969,15 @@ chcr_ktls_write_tcp_options(struct chcr_
+       cpl->len = htons(pktlen);
+       memcpy(buf, skb->data, pktlen);
+-      if (tx_info->ip_family == AF_INET) {
++      if (!IS_ENABLED(CONFIG_IPV6) || tx_info->ip_family == AF_INET) {
+               /* we need to correct ip header len */
+               ip = (struct iphdr *)(buf + maclen);
+               ip->tot_len = htons(pktlen - maclen);
+               cntrl1 = TXPKT_CSUM_TYPE_V(TX_CSUM_TCPIP);
+-#if IS_ENABLED(CONFIG_IPV6)
+       } else {
+               ip6 = (struct ipv6hdr *)(buf + maclen);
+               ip6->payload_len = htons(pktlen - maclen - iplen);
+               cntrl1 = TXPKT_CSUM_TYPE_V(TX_CSUM_TCPIP6);
+-#endif
+       }
+       cntrl1 |= T6_TXPKT_ETHHDR_LEN_V(maclen - ETH_HLEN) |
diff --git a/queue-5.9/e1000e-fix-s0ix-flow-to-allow-s0i3.2-subset-entry.patch b/queue-5.9/e1000e-fix-s0ix-flow-to-allow-s0i3.2-subset-entry.patch
new file mode 100644 (file)
index 0000000..1d3a2bd
--- /dev/null
@@ -0,0 +1,62 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Vitaly Lifshits <vitaly.lifshits@intel.com>
+Date: Tue, 8 Dec 2020 12:56:32 -0600
+Subject: e1000e: fix S0ix flow to allow S0i3.2 subset entry
+
+From: Vitaly Lifshits <vitaly.lifshits@intel.com>
+
+[ Upstream commit a379b01cd4b2aa3f12786b281a714871574e5ccb ]
+
+Changed a configuration in the flows to align with
+architecture requirements to achieve S0i3.2 substate.
+
+This helps both i219V and i219LM configurations.
+
+Also fixed a typo in the previous commit 632fbd5eb5b0
+("e1000e: fix S0ix flows for cable connected case").
+
+Fixes: 632fbd5eb5b0 ("e1000e: fix S0ix flows for cable connected case").
+Signed-off-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Link: https://lore.kernel.org/r/20201208185632.151052-1-mario.limonciello@dell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/netdev.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -6449,13 +6449,13 @@ static void e1000e_s0ix_entry_flow(struc
+       /* Ungate PGCB clock */
+       mac_data = er32(FEXTNVM9);
+-      mac_data |= BIT(28);
++      mac_data &= ~BIT(28);
+       ew32(FEXTNVM9, mac_data);
+       /* Enable K1 off to enable mPHY Power Gating */
+       mac_data = er32(FEXTNVM6);
+       mac_data |= BIT(31);
+-      ew32(FEXTNVM12, mac_data);
++      ew32(FEXTNVM6, mac_data);
+       /* Enable mPHY power gating for any link and speed */
+       mac_data = er32(FEXTNVM8);
+@@ -6499,11 +6499,11 @@ static void e1000e_s0ix_exit_flow(struct
+       /* Disable K1 off */
+       mac_data = er32(FEXTNVM6);
+       mac_data &= ~BIT(31);
+-      ew32(FEXTNVM12, mac_data);
++      ew32(FEXTNVM6, mac_data);
+       /* Disable Ungate PGCB clock */
+       mac_data = er32(FEXTNVM9);
+-      mac_data &= ~BIT(28);
++      mac_data |= BIT(28);
+       ew32(FEXTNVM9, mac_data);
+       /* Cancel not waking from dynamic
diff --git a/queue-5.9/enetc-fix-reporting-of-h-w-packet-counters.patch b/queue-5.9/enetc-fix-reporting-of-h-w-packet-counters.patch
new file mode 100644 (file)
index 0000000..359e27d
--- /dev/null
@@ -0,0 +1,80 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+Date: Fri, 4 Dec 2020 19:15:05 +0200
+Subject: enetc: Fix reporting of h/w packet counters
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+[ Upstream commit eb96b686fc2c601e78903cc61b6cf4588ddde013 ]
+
+Noticed some inconsistencies in packet statistics reporting.
+This patch adds the missing Tx packet counter registers to
+ethtool reporting and fixes the information strings for a
+few of them.
+
+Fixes: 16eb4c85c964 ("enetc: Add ethtool statistics")
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Link: https://lore.kernel.org/r/20201204171505.21389-1-claudiu.manoil@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_ethtool.c |   10 +++++++---
+ drivers/net/ethernet/freescale/enetc/enetc_hw.h      |   10 +++++++---
+ 2 files changed, 14 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
+@@ -143,8 +143,8 @@ static const struct {
+       { ENETC_PM0_R255,   "MAC rx 128-255 byte packets" },
+       { ENETC_PM0_R511,   "MAC rx 256-511 byte packets" },
+       { ENETC_PM0_R1023,  "MAC rx 512-1023 byte packets" },
+-      { ENETC_PM0_R1518,  "MAC rx 1024-1518 byte packets" },
+-      { ENETC_PM0_R1519X, "MAC rx 1519 to max-octet packets" },
++      { ENETC_PM0_R1522,  "MAC rx 1024-1522 byte packets" },
++      { ENETC_PM0_R1523X, "MAC rx 1523 to max-octet packets" },
+       { ENETC_PM0_ROVR,   "MAC rx oversized packets" },
+       { ENETC_PM0_RJBR,   "MAC rx jabber packets" },
+       { ENETC_PM0_RFRG,   "MAC rx fragment packets" },
+@@ -163,9 +163,13 @@ static const struct {
+       { ENETC_PM0_TBCA,   "MAC tx broadcast frames" },
+       { ENETC_PM0_TPKT,   "MAC tx packets" },
+       { ENETC_PM0_TUND,   "MAC tx undersized packets" },
++      { ENETC_PM0_T64,    "MAC tx 64 byte packets" },
+       { ENETC_PM0_T127,   "MAC tx 65-127 byte packets" },
++      { ENETC_PM0_T255,   "MAC tx 128-255 byte packets" },
++      { ENETC_PM0_T511,   "MAC tx 256-511 byte packets" },
+       { ENETC_PM0_T1023,  "MAC tx 512-1023 byte packets" },
+-      { ENETC_PM0_T1518,  "MAC tx 1024-1518 byte packets" },
++      { ENETC_PM0_T1522,  "MAC tx 1024-1522 byte packets" },
++      { ENETC_PM0_T1523X, "MAC tx 1523 to max-octet packets" },
+       { ENETC_PM0_TCNP,   "MAC tx control packets" },
+       { ENETC_PM0_TDFR,   "MAC tx deferred packets" },
+       { ENETC_PM0_TMCOL,  "MAC tx multiple collisions" },
+--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+@@ -267,8 +267,8 @@ enum enetc_bdr_type {TX, RX};
+ #define ENETC_PM0_R255                0x8180
+ #define ENETC_PM0_R511                0x8188
+ #define ENETC_PM0_R1023               0x8190
+-#define ENETC_PM0_R1518               0x8198
+-#define ENETC_PM0_R1519X      0x81A0
++#define ENETC_PM0_R1522               0x8198
++#define ENETC_PM0_R1523X      0x81A0
+ #define ENETC_PM0_ROVR                0x81A8
+ #define ENETC_PM0_RJBR                0x81B0
+ #define ENETC_PM0_RFRG                0x81B8
+@@ -287,9 +287,13 @@ enum enetc_bdr_type {TX, RX};
+ #define ENETC_PM0_TBCA                0x8250
+ #define ENETC_PM0_TPKT                0x8260
+ #define ENETC_PM0_TUND                0x8268
++#define ENETC_PM0_T64         0x8270
+ #define ENETC_PM0_T127                0x8278
++#define ENETC_PM0_T255                0x8280
++#define ENETC_PM0_T511                0x8288
+ #define ENETC_PM0_T1023               0x8290
+-#define ENETC_PM0_T1518               0x8298
++#define ENETC_PM0_T1522               0x8298
++#define ENETC_PM0_T1523X      0x82A0
+ #define ENETC_PM0_TCNP                0x82C0
+ #define ENETC_PM0_TDFR                0x82D0
+ #define ENETC_PM0_TMCOL               0x82D8
diff --git a/queue-5.9/ethtool-fix-stack-overflow-in-ethnl_parse_bitset.patch b/queue-5.9/ethtool-fix-stack-overflow-in-ethnl_parse_bitset.patch
new file mode 100644 (file)
index 0000000..63f5888
--- /dev/null
@@ -0,0 +1,37 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Michal Kubecek <mkubecek@suse.cz>
+Date: Tue, 8 Dec 2020 23:13:51 +0100
+Subject: ethtool: fix stack overflow in ethnl_parse_bitset()
+
+From: Michal Kubecek <mkubecek@suse.cz>
+
+[ Upstream commit a770bf515613c6e12ae904c3593e26016de99448 ]
+
+Syzbot reported a stack overflow in bitmap_from_arr32() called from
+ethnl_parse_bitset() when bitset from netlink message is longer than
+target bitmap length. While ethnl_compact_sanity_checks() makes sure that
+trailing part is all zeros (i.e. the request does not try to touch bits
+kernel does not recognize), we also need to cap change_bits to nbits so
+that we don't try to write past the prepared bitmaps.
+
+Fixes: 88db6d1e4f62 ("ethtool: add ethnl_parse_bitset() helper")
+Reported-by: syzbot+9d39fa49d4df294aab93@syzkaller.appspotmail.com
+Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
+Link: https://lore.kernel.org/r/3487ee3a98e14cd526f55b6caaa959d2dcbcad9f.1607465316.git.mkubecek@suse.cz
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ethtool/bitset.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ethtool/bitset.c
++++ b/net/ethtool/bitset.c
+@@ -630,6 +630,8 @@ int ethnl_parse_bitset(unsigned long *va
+                       return ret;
+               change_bits = nla_get_u32(tb[ETHTOOL_A_BITSET_SIZE]);
++              if (change_bits > nbits)
++                      change_bits = nbits;
+               bitmap_from_arr32(val, nla_data(tb[ETHTOOL_A_BITSET_VALUE]),
+                                 change_bits);
+               if (change_bits < nbits)
diff --git a/queue-5.9/ipv4-fix-error-return-code-in-rtm_to_fib_config.patch b/queue-5.9/ipv4-fix-error-return-code-in-rtm_to_fib_config.patch
new file mode 100644 (file)
index 0000000..e2a32b0
--- /dev/null
@@ -0,0 +1,34 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Fri, 4 Dec 2020 16:48:14 +0800
+Subject: ipv4: fix error return code in rtm_to_fib_config()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit b410f04eb5b482b5efc4eee90de81ad35d3d923b ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: d15662682db2 ("ipv4: Allow ipv6 gateway with ipv4 routes")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/1607071695-33740-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/fib_frontend.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -825,7 +825,7 @@ static int rtm_to_fib_config(struct net
+       if (has_gw && has_via) {
+               NL_SET_ERR_MSG(extack,
+                              "Nexthop configuration can not contain both GATEWAY and VIA");
+-              goto errout;
++              return -EINVAL;
+       }
+       return 0;
diff --git a/queue-5.9/lan743x-fix-for-potential-null-pointer-dereference-with-bare-card.patch b/queue-5.9/lan743x-fix-for-potential-null-pointer-dereference-with-bare-card.patch
new file mode 100644 (file)
index 0000000..adb4c24
--- /dev/null
@@ -0,0 +1,87 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Sergej Bauer <sbauer@blackbox.su>
+Date: Mon, 2 Nov 2020 01:35:55 +0300
+Subject: lan743x: fix for potential NULL pointer dereference with bare card
+
+From: Sergej Bauer <sbauer@blackbox.su>
+
+[ Upstream commit e9e13b6adc338be1eb88db87bcb392696144bd02 ]
+
+This is the 3rd revision of the patch fix for potential null pointer dereference
+with lan743x card.
+
+The simpliest way to reproduce: boot with bare lan743x and issue "ethtool ethN"
+commant where ethN is the interface with lan743x card. Example:
+
+$ sudo ethtool eth7
+dmesg:
+[  103.510336] BUG: kernel NULL pointer dereference, address: 0000000000000340
+...
+[  103.510836] RIP: 0010:phy_ethtool_get_wol+0x5/0x30 [libphy]
+...
+[  103.511629] Call Trace:
+[  103.511666]  lan743x_ethtool_get_wol+0x21/0x40 [lan743x]
+[  103.511724]  dev_ethtool+0x1507/0x29d0
+[  103.511769]  ? avc_has_extended_perms+0x17f/0x440
+[  103.511820]  ? tomoyo_init_request_info+0x84/0x90
+[  103.511870]  ? tomoyo_path_number_perm+0x68/0x1e0
+[  103.511919]  ? tty_insert_flip_string_fixed_flag+0x82/0xe0
+[  103.511973]  ? inet_ioctl+0x187/0x1d0
+[  103.512016]  dev_ioctl+0xb5/0x560
+[  103.512055]  sock_do_ioctl+0xa0/0x140
+[  103.512098]  sock_ioctl+0x2cb/0x3c0
+[  103.512139]  __x64_sys_ioctl+0x84/0xc0
+[  103.512183]  do_syscall_64+0x33/0x80
+[  103.512224]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[  103.512274] RIP: 0033:0x7f54a9cba427
+...
+
+Previous versions can be found at:
+v1:
+initial version
+    https://lkml.org/lkml/2020/10/28/921
+
+v2:
+do not return from lan743x_ethtool_set_wol if netdev->phydev == NULL, just skip
+the call of phy_ethtool_set_wol() instead.
+    https://lkml.org/lkml/2020/10/31/380
+
+v3:
+in function lan743x_ethtool_set_wol:
+use ternary operator instead of if-else sentence (review by Markus Elfring)
+return -ENETDOWN insted of -EIO (review by Andrew Lunn)
+
+Signed-off-by: Sergej Bauer <sbauer@blackbox.su>
+
+Link: https://lore.kernel.org/r/20201101223556.16116-1-sbauer@blackbox.su
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microchip/lan743x_ethtool.c |    9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/microchip/lan743x_ethtool.c
++++ b/drivers/net/ethernet/microchip/lan743x_ethtool.c
+@@ -780,7 +780,9 @@ static void lan743x_ethtool_get_wol(stru
+       wol->supported = 0;
+       wol->wolopts = 0;
+-      phy_ethtool_get_wol(netdev->phydev, wol);
++
++      if (netdev->phydev)
++              phy_ethtool_get_wol(netdev->phydev, wol);
+       wol->supported |= WAKE_BCAST | WAKE_UCAST | WAKE_MCAST |
+               WAKE_MAGIC | WAKE_PHY | WAKE_ARP;
+@@ -809,9 +811,8 @@ static int lan743x_ethtool_set_wol(struc
+       device_set_wakeup_enable(&adapter->pdev->dev, (bool)wol->wolopts);
+-      phy_ethtool_set_wol(netdev->phydev, wol);
+-
+-      return 0;
++      return netdev->phydev ? phy_ethtool_set_wol(netdev->phydev, wol)
++                      : -ENETDOWN;
+ }
+ #endif /* CONFIG_PM */
diff --git a/queue-5.9/mac80211-mesh-fix-mesh_pathtbl_init-error-path.patch b/queue-5.9/mac80211-mesh-fix-mesh_pathtbl_init-error-path.patch
new file mode 100644 (file)
index 0000000..86aa5ac
--- /dev/null
@@ -0,0 +1,91 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 4 Dec 2020 08:24:28 -0800
+Subject: mac80211: mesh: fix mesh_pathtbl_init() error path
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 905b2032fa424f253d9126271439cc1db2b01130 ]
+
+If tbl_mpp can not be allocated, we call mesh_table_free(tbl_path)
+while tbl_path rhashtable has not yet been initialized, which causes
+panics.
+
+Simply factorize the rhashtable_init() call into mesh_table_alloc()
+
+WARNING: CPU: 1 PID: 8474 at kernel/workqueue.c:3040 __flush_work kernel/workqueue.c:3040 [inline]
+WARNING: CPU: 1 PID: 8474 at kernel/workqueue.c:3040 __cancel_work_timer+0x514/0x540 kernel/workqueue.c:3136
+Modules linked in:
+CPU: 1 PID: 8474 Comm: syz-executor663 Not tainted 5.10.0-rc6-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+RIP: 0010:__flush_work kernel/workqueue.c:3040 [inline]
+RIP: 0010:__cancel_work_timer+0x514/0x540 kernel/workqueue.c:3136
+Code: 5d c3 e8 bf ae 29 00 0f 0b e9 f0 fd ff ff e8 b3 ae 29 00 0f 0b 43 80 3c 3e 00 0f 85 31 ff ff ff e9 34 ff ff ff e8 9c ae 29 00 <0f> 0b e9 dc fe ff ff 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 7d fd ff
+RSP: 0018:ffffc9000165f5a0 EFLAGS: 00010293
+RAX: ffffffff814b7064 RBX: 0000000000000001 RCX: ffff888021c80000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+RBP: ffff888024039ca0 R08: dffffc0000000000 R09: fffffbfff1dd3e64
+R10: fffffbfff1dd3e64 R11: 0000000000000000 R12: 1ffff920002cbebd
+R13: ffff888024039c88 R14: 1ffff11004807391 R15: dffffc0000000000
+FS:  0000000001347880(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020000140 CR3: 000000002cc0a000 CR4: 00000000001506e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ rhashtable_free_and_destroy+0x25/0x9c0 lib/rhashtable.c:1137
+ mesh_table_free net/mac80211/mesh_pathtbl.c:69 [inline]
+ mesh_pathtbl_init+0x287/0x2e0 net/mac80211/mesh_pathtbl.c:785
+ ieee80211_mesh_init_sdata+0x2ee/0x530 net/mac80211/mesh.c:1591
+ ieee80211_setup_sdata+0x733/0xc40 net/mac80211/iface.c:1569
+ ieee80211_if_add+0xd5c/0x1cd0 net/mac80211/iface.c:1987
+ ieee80211_add_iface+0x59/0x130 net/mac80211/cfg.c:125
+ rdev_add_virtual_intf net/wireless/rdev-ops.h:45 [inline]
+ nl80211_new_interface+0x563/0xb40 net/wireless/nl80211.c:3855
+ genl_family_rcv_msg_doit net/netlink/genetlink.c:739 [inline]
+ genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
+ genl_rcv_msg+0xe4e/0x1280 net/netlink/genetlink.c:800
+ netlink_rcv_skb+0x190/0x3a0 net/netlink/af_netlink.c:2494
+ genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
+ netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
+ netlink_unicast+0x780/0x930 net/netlink/af_netlink.c:1330
+ netlink_sendmsg+0x9a8/0xd40 net/netlink/af_netlink.c:1919
+ sock_sendmsg_nosec net/socket.c:651 [inline]
+ sock_sendmsg net/socket.c:671 [inline]
+ ____sys_sendmsg+0x519/0x800 net/socket.c:2353
+ ___sys_sendmsg net/socket.c:2407 [inline]
+ __sys_sendmsg+0x2b1/0x360 net/socket.c:2440
+ do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: 60854fd94573 ("mac80211: mesh: convert path table to rhashtable")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Link: https://lore.kernel.org/r/20201204162428.2583119-1-eric.dumazet@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/mesh_pathtbl.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -60,6 +60,7 @@ static struct mesh_table *mesh_table_all
+       atomic_set(&newtbl->entries,  0);
+       spin_lock_init(&newtbl->gates_lock);
+       spin_lock_init(&newtbl->walk_lock);
++      rhashtable_init(&newtbl->rhead, &mesh_rht_params);
+       return newtbl;
+ }
+@@ -773,9 +774,6 @@ int mesh_pathtbl_init(struct ieee80211_s
+               goto free_path;
+       }
+-      rhashtable_init(&tbl_path->rhead, &mesh_rht_params);
+-      rhashtable_init(&tbl_mpp->rhead, &mesh_rht_params);
+-
+       sdata->u.mesh.mesh_paths = tbl_path;
+       sdata->u.mesh.mpp_paths = tbl_mpp;
diff --git a/queue-5.9/mptcp-print-new-line-in-mptcp_seq_show-if-mptcp-isn-t-in-use.patch b/queue-5.9/mptcp-print-new-line-in-mptcp_seq_show-if-mptcp-isn-t-in-use.patch
new file mode 100644 (file)
index 0000000..3e11010
--- /dev/null
@@ -0,0 +1,44 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Jianguo Wu <wujianguo@chinatelecom.cn>
+Date: Sat, 5 Dec 2020 15:56:33 +0800
+Subject: mptcp: print new line in mptcp_seq_show() if mptcp isn't in use
+
+From: Jianguo Wu <wujianguo@chinatelecom.cn>
+
+[ Upstream commit f55628b3e7648198e9c072b52080c5dea8678adf ]
+
+When do cat /proc/net/netstat, the output isn't append with a new line, it looks like this:
+[root@localhost ~]# cat /proc/net/netstat
+...
+MPTcpExt: 0 0 0 0 0 0 0 0 0 0 0 0 0[root@localhost ~]#
+
+This is because in mptcp_seq_show(), if mptcp isn't in use, net->mib.mptcp_statistics is NULL,
+so it just puts all 0 after "MPTcpExt:", and return, forgot the '\n'.
+
+After this patch:
+
+[root@localhost ~]# cat /proc/net/netstat
+...
+MPTcpExt: 0 0 0 0 0 0 0 0 0 0 0 0 0
+[root@localhost ~]#
+
+Fixes: fc518953bc9c8d7d ("mptcp: add and use MIB counter infrastructure")
+Signed-off-by: Jianguo Wu <wujianguo@chinatelecom.cn>
+Acked-by: Florian Westphal <fw@strlen.de>
+Link: https://lore.kernel.org/r/142e2fd9-58d9-bb13-fb75-951cccc2331e@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/mib.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/mptcp/mib.c
++++ b/net/mptcp/mib.c
+@@ -58,6 +58,7 @@ void mptcp_seq_show(struct seq_file *seq
+               for (i = 0; mptcp_snmp_list[i].name; i++)
+                       seq_puts(seq, " 0");
++              seq_putc(seq, '\n');
+               return;
+       }
diff --git a/queue-5.9/net-bridge-vlan-fix-error-return-code-in-__vlan_add.patch b/queue-5.9/net-bridge-vlan-fix-error-return-code-in-__vlan_add.patch
new file mode 100644 (file)
index 0000000..f686c1e
--- /dev/null
@@ -0,0 +1,37 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Fri, 4 Dec 2020 16:48:56 +0800
+Subject: net: bridge: vlan: fix error return code in __vlan_add()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit ee4f52a8de2c6f78b01f10b4c330867d88c1653a ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: f8ed289fab84 ("bridge: vlan: use br_vlan_(get|put)_master to deal with refcounts")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
+Link: https://lore.kernel.org/r/1607071737-33875-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/br_vlan.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -266,8 +266,10 @@ static int __vlan_add(struct net_bridge_
+               }
+               masterv = br_vlan_get_master(br, v->vid, extack);
+-              if (!masterv)
++              if (!masterv) {
++                      err = -ENOMEM;
+                       goto out_filt;
++              }
+               v->brvlan = masterv;
+               if (br_opt_get(br, BROPT_VLAN_STATS_PER_PORT)) {
+                       v->stats = netdev_alloc_pcpu_stats(struct br_vlan_stats);
diff --git a/queue-5.9/net-flow_offload-fix-memory-leak-for-indirect-flow-block.patch b/queue-5.9/net-flow_offload-fix-memory-leak-for-indirect-flow-block.patch
new file mode 100644 (file)
index 0000000..01ae3f7
--- /dev/null
@@ -0,0 +1,37 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Chris Mi <cmi@nvidia.com>
+Date: Tue, 8 Dec 2020 10:48:35 +0800
+Subject: net: flow_offload: Fix memory leak for indirect flow block
+
+From: Chris Mi <cmi@nvidia.com>
+
+[ Upstream commit 5137d303659d8c324e67814b1cc2e1bc0c0d9836 ]
+
+The offending commit introduces a cleanup callback that is invoked
+when the driver module is removed to clean up the tunnel device
+flow block. But it returns on the first iteration of the for loop.
+The remaining indirect flow blocks will never be freed.
+
+Fixes: 1fac52da5942 ("net: flow_offload: consolidate indirect flow_block infrastructure")
+CC: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Chris Mi <cmi@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/flow_offload.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/net/core/flow_offload.c
++++ b/net/core/flow_offload.c
+@@ -381,10 +381,8 @@ static void __flow_block_indr_cleanup(vo
+       list_for_each_entry_safe(this, next, &flow_block_indr_list, indr.list) {
+               if (this->release == release &&
+-                  this->indr.cb_priv == cb_priv) {
++                  this->indr.cb_priv == cb_priv)
+                       list_move(&this->indr.list, cleanup_list);
+-                      return;
+-              }
+       }
+ }
diff --git a/queue-5.9/net-hns3-remove-a-misused-pragma-packed.patch b/queue-5.9/net-hns3-remove-a-misused-pragma-packed.patch
new file mode 100644 (file)
index 0000000..0cdc5e1
--- /dev/null
@@ -0,0 +1,51 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Huazhong Tan <tanhuazhong@huawei.com>
+Date: Mon, 7 Dec 2020 15:20:25 +0800
+Subject: net: hns3: remove a misused pragma packed
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit 61f54de2e9194f01874d5eda12037b0978e77519 ]
+
+hclge_dbg_reg_info[] is defined as an array of packed structure
+accidentally. However, this array contains pointers, which are
+no longer aligned naturally, and cannot be relocated on PPC64.
+Hence, when compile-testing this driver on PPC64 with
+CONFIG_RELOCATABLE=y (e.g. PowerPC allyesconfig), there will be
+some warnings.
+
+Since each field in structure hclge_qos_pri_map_cmd and
+hclge_dbg_bitmap_cmd is type u8, the pragma packed is unnecessary
+for these two structures as well, so remove the pragma packed in
+hclge_debugfs.h to fix this issue, and this increases
+hclge_dbg_reg_info[] by 4 bytes per entry.
+
+Fixes: a582b78dfc33 ("net: hns3: code optimization for debugfs related to "dump reg"")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.h |    4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.h
+@@ -35,8 +35,6 @@
+ #define HCLGE_DBG_DFX_SSU_2_OFFSET 12
+-#pragma pack(1)
+-
+ struct hclge_qos_pri_map_cmd {
+       u8 pri0_tc  : 4,
+          pri1_tc  : 4;
+@@ -85,8 +83,6 @@ struct hclge_dbg_reg_type_info {
+       struct hclge_dbg_reg_common_msg reg_msg;
+ };
+-#pragma pack()
+-
+ static struct hclge_dbg_dfx_message hclge_dbg_bios_common_reg[] = {
+       {false, "Reserved"},
+       {true,  "BP_CPU_STATE"},
diff --git a/queue-5.9/net-ipa-pass-the-correct-size-when-freeing-dma-memory.patch b/queue-5.9/net-ipa-pass-the-correct-size-when-freeing-dma-memory.patch
new file mode 100644 (file)
index 0000000..539e535
--- /dev/null
@@ -0,0 +1,48 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Alex Elder <elder@linaro.org>
+Date: Thu, 3 Dec 2020 15:51:06 -0600
+Subject: net: ipa: pass the correct size when freeing DMA memory
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 1130b252480f3c98cf468e78c1c5c516b390a29c ]
+
+When the coherent memory is freed in gsi_trans_pool_exit_dma(), we
+are mistakenly passing the size of a single element in the pool
+rather than the actual allocated size.  Fix this bug.
+
+Fixes: 9dd441e4ed575 ("soc: qcom: ipa: GSI transactions")
+Reported-by: Stephen Boyd <swboyd@chromium.org>
+Tested-by: Sujit Kautkar <sujitka@chromium.org>
+Signed-off-by: Alex Elder <elder@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20201203215106.17450-1-elder@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipa/gsi_trans.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ipa/gsi_trans.c
++++ b/drivers/net/ipa/gsi_trans.c
+@@ -157,6 +157,9 @@ int gsi_trans_pool_init_dma(struct devic
+       /* The allocator will give us a power-of-2 number of pages.  But we
+        * can't guarantee that, so request it.  That way we won't waste any
+        * memory that would be available beyond the required space.
++       *
++       * Note that gsi_trans_pool_exit_dma() assumes the total allocated
++       * size is exactly (count * size).
+        */
+       total_size = get_order(total_size) << PAGE_SHIFT;
+@@ -176,7 +179,9 @@ int gsi_trans_pool_init_dma(struct devic
+ void gsi_trans_pool_exit_dma(struct device *dev, struct gsi_trans_pool *pool)
+ {
+-      dma_free_coherent(dev, pool->size, pool->base, pool->addr);
++      size_t total_size = pool->count * pool->size;
++
++      dma_free_coherent(dev, total_size, pool->base, pool->addr);
+       memset(pool, 0, sizeof(*pool));
+ }
diff --git a/queue-5.9/net-ll_temac-fix-potential-null-dereference-in-temac_probe.patch b/queue-5.9/net-ll_temac-fix-potential-null-dereference-in-temac_probe.patch
new file mode 100644 (file)
index 0000000..7539e9e
--- /dev/null
@@ -0,0 +1,63 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Tue, 8 Dec 2020 09:53:42 +0800
+Subject: net: ll_temac: Fix potential NULL dereference in temac_probe()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit cc6596fc7295e9dcd78156ed42f9f8e1221f7530 ]
+
+platform_get_resource() may fail and in this case a NULL dereference
+will occur.
+
+Fix it to use devm_platform_ioremap_resource() instead of calling
+platform_get_resource() and devm_ioremap().
+
+This is detected by Coccinelle semantic patch.
+
+@@
+expression pdev, res, n, t, e, e1, e2;
+@@
+
+res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t, n);
++ if (!res)
++   return -EINVAL;
+... when != res == NULL
+e = devm_ioremap(e1, res->start, e2);
+
+Fixes: 8425c41d1ef7 ("net: ll_temac: Extend support to non-device-tree platforms")
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Acked-by: Esben Haabendal <esben@geanix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c |    9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -1351,7 +1351,6 @@ static int temac_probe(struct platform_d
+       struct device_node *temac_np = dev_of_node(&pdev->dev), *dma_np;
+       struct temac_local *lp;
+       struct net_device *ndev;
+-      struct resource *res;
+       const void *addr;
+       __be32 *p;
+       bool little_endian;
+@@ -1500,13 +1499,11 @@ static int temac_probe(struct platform_d
+               of_node_put(dma_np);
+       } else if (pdata) {
+               /* 2nd memory resource specifies DMA registers */
+-              res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+-              lp->sdma_regs = devm_ioremap(&pdev->dev, res->start,
+-                                                   resource_size(res));
+-              if (!lp->sdma_regs) {
++              lp->sdma_regs = devm_platform_ioremap_resource(pdev, 1);
++              if (IS_ERR(lp->sdma_regs)) {
+                       dev_err(&pdev->dev,
+                               "could not map DMA registers\n");
+-                      return -ENOMEM;
++                      return PTR_ERR(lp->sdma_regs);
+               }
+               if (pdata->dma_little_endian) {
+                       lp->dma_in = temac_dma_in32_le;
diff --git a/queue-5.9/net-mlx4_en-avoid-scheduling-restart-task-if-it-is-already-running.patch b/queue-5.9/net-mlx4_en-avoid-scheduling-restart-task-if-it-is-already-running.patch
new file mode 100644 (file)
index 0000000..b4f3c48
--- /dev/null
@@ -0,0 +1,124 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Moshe Shemesh <moshe@mellanox.com>
+Date: Wed, 9 Dec 2020 15:03:38 +0200
+Subject: net/mlx4_en: Avoid scheduling restart task if it is already running
+
+From: Moshe Shemesh <moshe@mellanox.com>
+
+[ Upstream commit fed91613c9dd455dd154b22fa8e11b8526466082 ]
+
+Add restarting state flag to avoid scheduling another restart task while
+such task is already running. Change task name from watchdog_task to
+restart_task to better fit the task role.
+
+Fixes: 1e338db56e5a ("mlx4_en: Fix a race at restart task")
+Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c |   20 +++++++++++++-------
+ drivers/net/ethernet/mellanox/mlx4/mlx4_en.h   |    7 ++++++-
+ 2 files changed, 19 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1378,8 +1378,10 @@ static void mlx4_en_tx_timeout(struct ne
+               tx_ring->cons, tx_ring->prod);
+       priv->port_stats.tx_timeout++;
+-      en_dbg(DRV, priv, "Scheduling watchdog\n");
+-      queue_work(mdev->workqueue, &priv->watchdog_task);
++      if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state)) {
++              en_dbg(DRV, priv, "Scheduling port restart\n");
++              queue_work(mdev->workqueue, &priv->restart_task);
++      }
+ }
+@@ -1829,6 +1831,7 @@ int mlx4_en_start_port(struct net_device
+               local_bh_enable();
+       }
++      clear_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state);
+       netif_tx_start_all_queues(dev);
+       netif_device_attach(dev);
+@@ -1999,7 +2002,7 @@ void mlx4_en_stop_port(struct net_device
+ static void mlx4_en_restart(struct work_struct *work)
+ {
+       struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
+-                                               watchdog_task);
++                                               restart_task);
+       struct mlx4_en_dev *mdev = priv->mdev;
+       struct net_device *dev = priv->dev;
+@@ -2377,7 +2380,7 @@ static int mlx4_en_change_mtu(struct net
+       if (netif_running(dev)) {
+               mutex_lock(&mdev->state_lock);
+               if (!mdev->device_up) {
+-                      /* NIC is probably restarting - let watchdog task reset
++                      /* NIC is probably restarting - let restart task reset
+                        * the port */
+                       en_dbg(DRV, priv, "Change MTU called with card down!?\n");
+               } else {
+@@ -2386,7 +2389,9 @@ static int mlx4_en_change_mtu(struct net
+                       if (err) {
+                               en_err(priv, "Failed restarting port:%d\n",
+                                        priv->port);
+-                              queue_work(mdev->workqueue, &priv->watchdog_task);
++                              if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING,
++                                                    &priv->state))
++                                      queue_work(mdev->workqueue, &priv->restart_task);
+                       }
+               }
+               mutex_unlock(&mdev->state_lock);
+@@ -2792,7 +2797,8 @@ static int mlx4_xdp_set(struct net_devic
+               if (err) {
+                       en_err(priv, "Failed starting port %d for XDP change\n",
+                              priv->port);
+-                      queue_work(mdev->workqueue, &priv->watchdog_task);
++                      if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
++                              queue_work(mdev->workqueue, &priv->restart_task);
+               }
+       }
+@@ -3165,7 +3171,7 @@ int mlx4_en_init_netdev(struct mlx4_en_d
+       priv->counter_index = MLX4_SINK_COUNTER_INDEX(mdev->dev);
+       spin_lock_init(&priv->stats_lock);
+       INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode);
+-      INIT_WORK(&priv->watchdog_task, mlx4_en_restart);
++      INIT_WORK(&priv->restart_task, mlx4_en_restart);
+       INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate);
+       INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats);
+       INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task);
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -530,6 +530,10 @@ struct mlx4_en_stats_bitmap {
+       struct mutex mutex; /* for mutual access to stats bitmap */
+ };
++enum {
++      MLX4_EN_STATE_FLAG_RESTARTING,
++};
++
+ struct mlx4_en_priv {
+       struct mlx4_en_dev *mdev;
+       struct mlx4_en_port_profile *prof;
+@@ -595,7 +599,7 @@ struct mlx4_en_priv {
+       struct mlx4_en_cq *rx_cq[MAX_RX_RINGS];
+       struct mlx4_qp drop_qp;
+       struct work_struct rx_mode_task;
+-      struct work_struct watchdog_task;
++      struct work_struct restart_task;
+       struct work_struct linkstate_task;
+       struct delayed_work stats_task;
+       struct delayed_work service_task;
+@@ -641,6 +645,7 @@ struct mlx4_en_priv {
+       u32 pflags;
+       u8 rss_key[MLX4_EN_RSS_KEY_SIZE];
+       u8 rss_hash_fn;
++      unsigned long state;
+ };
+ enum mlx4_en_wol {
diff --git a/queue-5.9/net-mlx4_en-handle-tx-error-cqe.patch b/queue-5.9/net-mlx4_en-handle-tx-error-cqe.patch
new file mode 100644 (file)
index 0000000..95ae9b4
--- /dev/null
@@ -0,0 +1,114 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Moshe Shemesh <moshe@mellanox.com>
+Date: Wed, 9 Dec 2020 15:03:39 +0200
+Subject: net/mlx4_en: Handle TX error CQE
+
+From: Moshe Shemesh <moshe@mellanox.com>
+
+[ Upstream commit ba603d9d7b1215c72513d7c7aa02b6775fd4891b ]
+
+In case error CQE was found while polling TX CQ, the QP is in error
+state and all posted WQEs will generate error CQEs without any data
+transmitted. Fix it by reopening the channels, via same method used for
+TX timeout handling.
+
+In addition add some more info on error CQE and WQE for debug.
+
+Fixes: bd2f631d7c60 ("net/mlx4_en: Notify user when TX ring in error state")
+Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c |    1 
+ drivers/net/ethernet/mellanox/mlx4/en_tx.c     |   40 ++++++++++++++++++++-----
+ drivers/net/ethernet/mellanox/mlx4/mlx4_en.h   |    5 +++
+ 3 files changed, 39 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1735,6 +1735,7 @@ int mlx4_en_start_port(struct net_device
+                               mlx4_en_deactivate_cq(priv, cq);
+                               goto tx_err;
+                       }
++                      clear_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &tx_ring->state);
+                       if (t != TX_XDP) {
+                               tx_ring->tx_queue = netdev_get_tx_queue(dev, i);
+                               tx_ring->recycle_ring = NULL;
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -392,6 +392,35 @@ int mlx4_en_free_tx_buf(struct net_devic
+       return cnt;
+ }
++static void mlx4_en_handle_err_cqe(struct mlx4_en_priv *priv, struct mlx4_err_cqe *err_cqe,
++                                 u16 cqe_index, struct mlx4_en_tx_ring *ring)
++{
++      struct mlx4_en_dev *mdev = priv->mdev;
++      struct mlx4_en_tx_info *tx_info;
++      struct mlx4_en_tx_desc *tx_desc;
++      u16 wqe_index;
++      int desc_size;
++
++      en_err(priv, "CQE error - cqn 0x%x, ci 0x%x, vendor syndrome: 0x%x syndrome: 0x%x\n",
++             ring->sp_cqn, cqe_index, err_cqe->vendor_err_syndrome, err_cqe->syndrome);
++      print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, err_cqe, sizeof(*err_cqe),
++                     false);
++
++      wqe_index = be16_to_cpu(err_cqe->wqe_index) & ring->size_mask;
++      tx_info = &ring->tx_info[wqe_index];
++      desc_size = tx_info->nr_txbb << LOG_TXBB_SIZE;
++      en_err(priv, "Related WQE - qpn 0x%x, wqe index 0x%x, wqe size 0x%x\n", ring->qpn,
++             wqe_index, desc_size);
++      tx_desc = ring->buf + (wqe_index << LOG_TXBB_SIZE);
++      print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, tx_desc, desc_size, false);
++
++      if (test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
++              return;
++
++      en_err(priv, "Scheduling port restart\n");
++      queue_work(mdev->workqueue, &priv->restart_task);
++}
++
+ int mlx4_en_process_tx_cq(struct net_device *dev,
+                         struct mlx4_en_cq *cq, int napi_budget)
+ {
+@@ -438,13 +467,10 @@ int mlx4_en_process_tx_cq(struct net_dev
+               dma_rmb();
+               if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
+-                           MLX4_CQE_OPCODE_ERROR)) {
+-                      struct mlx4_err_cqe *cqe_err = (struct mlx4_err_cqe *)cqe;
+-
+-                      en_err(priv, "CQE error - vendor syndrome: 0x%x syndrome: 0x%x\n",
+-                             cqe_err->vendor_err_syndrome,
+-                             cqe_err->syndrome);
+-              }
++                           MLX4_CQE_OPCODE_ERROR))
++                      if (!test_and_set_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &ring->state))
++                              mlx4_en_handle_err_cqe(priv, (struct mlx4_err_cqe *)cqe, index,
++                                                     ring);
+               /* Skip over last polled CQE */
+               new_index = be16_to_cpu(cqe->wqe_index) & size_mask;
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -271,6 +271,10 @@ struct mlx4_en_page_cache {
+       } buf[MLX4_EN_CACHE_SIZE];
+ };
++enum {
++      MLX4_EN_TX_RING_STATE_RECOVERING,
++};
++
+ struct mlx4_en_priv;
+ struct mlx4_en_tx_ring {
+@@ -317,6 +321,7 @@ struct mlx4_en_tx_ring {
+        * Only queue_stopped might be used if BQL is not properly working.
+        */
+       unsigned long           queue_stopped;
++      unsigned long           state;
+       struct mlx4_hwq_resources sp_wqres;
+       struct mlx4_qp          sp_qp;
+       struct mlx4_qp_context  sp_context;
diff --git a/queue-5.9/net-mscc-ocelot-fix-dropping-of-unknown-ipv4-multicast-on-seville.patch b/queue-5.9/net-mscc-ocelot-fix-dropping-of-unknown-ipv4-multicast-on-seville.patch
new file mode 100644 (file)
index 0000000..0a97d72
--- /dev/null
@@ -0,0 +1,138 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Fri, 4 Dec 2020 19:54:16 +0200
+Subject: net: mscc: ocelot: fix dropping of unknown IPv4 multicast on Seville
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit edd2410b165e2ef00b2264ae362edf7441ca929c ]
+
+The current assumption is that the felix DSA driver has flooding knobs
+per traffic class, while ocelot switchdev has a single flooding knob.
+This was correct for felix VSC9959 and ocelot VSC7514, but with the
+introduction of seville VSC9953, we see a switch driven by felix.c which
+has a single flooding knob.
+
+So it is clear that we must do what should have been done from the
+beginning, which is not to overwrite the configuration done by ocelot.c
+in felix, but instead to teach the common ocelot library about the
+differences in our switches, and set up the flooding PGIDs centrally.
+
+The effect that the bogus iteration through FELIX_NUM_TC has upon
+seville is quite dramatic. ANA_FLOODING is located at 0x00b548, and
+ANA_FLOODING_IPMC is located at 0x00b54c. So the bogus iteration will
+actually overwrite ANA_FLOODING_IPMC when attempting to write
+ANA_FLOODING[1]. There is no ANA_FLOODING[1] in sevile, just ANA_FLOODING.
+
+And when ANA_FLOODING_IPMC is overwritten with a bogus value, the effect
+is that ANA_FLOODING_IPMC gets the value of 0x0003CF7D:
+       MC6_DATA = 61,
+       MC6_CTRL = 61,
+       MC4_DATA = 60,
+       MC4_CTRL = 0.
+Because MC4_CTRL is zero, this means that IPv4 multicast control packets
+are not flooded, but dropped. An invalid configuration, and this is how
+the issue was actually spotted.
+
+Reported-by: Eldar Gasanov <eldargasanov2@gmail.com>
+Reported-by: Maxim Kochetkov <fido_max@inbox.ru>
+Tested-by: Eldar Gasanov <eldargasanov2@gmail.com>
+Fixes: 84705fc16552 ("net: dsa: felix: introduce support for Seville VSC9953 switch")
+Fixes: 3c7b51bd39b2 ("net: dsa: felix: allow flooding for all traffic classes")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20201204175416.1445937-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/ocelot/felix.c             |    7 -------
+ drivers/net/dsa/ocelot/felix_vsc9959.c     |    1 +
+ drivers/net/dsa/ocelot/seville_vsc9953.c   |    1 +
+ drivers/net/ethernet/mscc/ocelot.c         |    9 +++++----
+ drivers/net/ethernet/mscc/ocelot_vsc7514.c |    1 +
+ include/soc/mscc/ocelot.h                  |    3 +++
+ 6 files changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/dsa/ocelot/felix.c
++++ b/drivers/net/dsa/ocelot/felix.c
+@@ -579,7 +579,6 @@ static int felix_setup(struct dsa_switch
+       struct ocelot *ocelot = ds->priv;
+       struct felix *felix = ocelot_to_felix(ocelot);
+       int port, err;
+-      int tc;
+       err = felix_init_structs(felix, ds->num_ports);
+       if (err)
+@@ -621,12 +620,6 @@ static int felix_setup(struct dsa_switch
+       ocelot_write_rix(ocelot,
+                        ANA_PGID_PGID_PGID(GENMASK(ocelot->num_phys_ports, 0)),
+                        ANA_PGID_PGID, PGID_UC);
+-      /* Setup the per-traffic class flooding PGIDs */
+-      for (tc = 0; tc < FELIX_NUM_TC; tc++)
+-              ocelot_write_rix(ocelot, ANA_FLOODING_FLD_MULTICAST(PGID_MC) |
+-                               ANA_FLOODING_FLD_BROADCAST(PGID_MC) |
+-                               ANA_FLOODING_FLD_UNICAST(PGID_UC),
+-                               ANA_FLOODING, tc);
+       ds->mtu_enforcement_ingress = true;
+       ds->configure_vlan_while_not_filtering = true;
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -1588,6 +1588,7 @@ static int felix_pci_probe(struct pci_de
+       pci_set_drvdata(pdev, felix);
+       ocelot = &felix->ocelot;
+       ocelot->dev = &pdev->dev;
++      ocelot->num_flooding_pgids = FELIX_NUM_TC;
+       felix->info = &felix_info_vsc9959;
+       felix->switch_base = pci_resource_start(pdev,
+                                               felix->info->switch_pci_bar);
+--- a/drivers/net/dsa/ocelot/seville_vsc9953.c
++++ b/drivers/net/dsa/ocelot/seville_vsc9953.c
+@@ -1042,6 +1042,7 @@ static int seville_probe(struct platform
+       ocelot = &felix->ocelot;
+       ocelot->dev = &pdev->dev;
++      ocelot->num_flooding_pgids = 1;
+       felix->info = &seville_info_vsc9953;
+       res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1485,10 +1485,11 @@ int ocelot_init(struct ocelot *ocelot)
+                    SYS_FRM_AGING_MAX_AGE(307692), SYS_FRM_AGING);
+       /* Setup flooding PGIDs */
+-      ocelot_write_rix(ocelot, ANA_FLOODING_FLD_MULTICAST(PGID_MC) |
+-                       ANA_FLOODING_FLD_BROADCAST(PGID_MC) |
+-                       ANA_FLOODING_FLD_UNICAST(PGID_UC),
+-                       ANA_FLOODING, 0);
++      for (i = 0; i < ocelot->num_flooding_pgids; i++)
++              ocelot_write_rix(ocelot, ANA_FLOODING_FLD_MULTICAST(PGID_MC) |
++                               ANA_FLOODING_FLD_BROADCAST(PGID_MC) |
++                               ANA_FLOODING_FLD_UNICAST(PGID_UC),
++                               ANA_FLOODING, i);
+       ocelot_write(ocelot, ANA_FLOODING_IPMC_FLD_MC6_DATA(PGID_MCIPV6) |
+                    ANA_FLOODING_IPMC_FLD_MC6_CTRL(PGID_MC) |
+                    ANA_FLOODING_IPMC_FLD_MC4_DATA(PGID_MCIPV4) |
+--- a/drivers/net/ethernet/mscc/ocelot_vsc7514.c
++++ b/drivers/net/ethernet/mscc/ocelot_vsc7514.c
+@@ -1118,6 +1118,7 @@ static int mscc_ocelot_probe(struct plat
+       }
+       ocelot->num_phys_ports = of_get_child_count(ports);
++      ocelot->num_flooding_pgids = 1;
+       ocelot->vcap_is2_keys = vsc7514_vcap_is2_keys;
+       ocelot->vcap_is2_actions = vsc7514_vcap_is2_actions;
+--- a/include/soc/mscc/ocelot.h
++++ b/include/soc/mscc/ocelot.h
+@@ -597,6 +597,9 @@ struct ocelot {
+       /* Keep track of the vlan port masks */
+       u32                             vlan_mask[VLAN_N_VID];
++      /* Switches like VSC9959 have flooding per traffic class */
++      int                             num_flooding_pgids;
++
+       /* In tables like ANA:PORT and the ANA:PGID:PGID mask,
+        * the CPU is located after the physical ports (at the
+        * num_phys_ports index).
diff --git a/queue-5.9/net-sched-fix-dump-of-mpls_opt_lse_label-attribute-in-cls_flower.patch b/queue-5.9/net-sched-fix-dump-of-mpls_opt_lse_label-attribute-in-cls_flower.patch
new file mode 100644 (file)
index 0000000..4a493ea
--- /dev/null
@@ -0,0 +1,47 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Guillaume Nault <gnault@redhat.com>
+Date: Wed, 9 Dec 2020 16:48:41 +0100
+Subject: net: sched: Fix dump of MPLS_OPT_LSE_LABEL attribute in cls_flower
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 7fdd375e383097a785bb65c66802e468f398bf82 ]
+
+TCA_FLOWER_KEY_MPLS_OPT_LSE_LABEL is a u32 attribute (MPLS label is
+20 bits long).
+
+Fixes the following bug:
+
+ $ tc filter add dev ethX ingress protocol mpls_uc \
+     flower mpls lse depth 2 label 256             \
+     action drop
+
+ $ tc filter show dev ethX ingress
+   filter protocol mpls_uc pref 49152 flower chain 0
+   filter protocol mpls_uc pref 49152 flower chain 0 handle 0x1
+     eth_type 8847
+     mpls
+       lse depth 2 label 0  <-- invalid label 0, should be 256
+   ...
+
+Fixes: 61aec25a6db5 ("cls_flower: Support filtering on multiple MPLS Label Stack Entries")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/cls_flower.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -2424,8 +2424,8 @@ static int fl_dump_key_mpls_opt_lse(stru
+                       return err;
+       }
+       if (lse_mask->mpls_label) {
+-              err = nla_put_u8(skb, TCA_FLOWER_KEY_MPLS_OPT_LSE_LABEL,
+-                               lse_key->mpls_label);
++              err = nla_put_u32(skb, TCA_FLOWER_KEY_MPLS_OPT_LSE_LABEL,
++                                lse_key->mpls_label);
+               if (err)
+                       return err;
+       }
diff --git a/queue-5.9/net-sched-fq_pie-initialize-timer-earlier-in-fq_pie_init.patch b/queue-5.9/net-sched-fq_pie-initialize-timer-earlier-in-fq_pie_init.patch
new file mode 100644 (file)
index 0000000..aee548b
--- /dev/null
@@ -0,0 +1,93 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Thu, 3 Dec 2020 19:40:47 +0100
+Subject: net/sched: fq_pie: initialize timer earlier in fq_pie_init()
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit 4eef8b1f36f2ff06966b8f7c2143ef0c447877de ]
+
+with the following tdc testcase:
+
+ 83be: (qdisc, fq_pie) Create FQ-PIE with invalid number of flows
+
+as fq_pie_init() fails, fq_pie_destroy() is called to clean up. Since the
+timer is not yet initialized, it's possible to observe a splat like this:
+
+  INFO: trying to register non-static key.
+  the code is fine but needs lockdep annotation.
+  turning off the locking correctness validator.
+  CPU: 0 PID: 975 Comm: tc Not tainted 5.10.0-rc4+ #298
+  Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
+  Call Trace:
+   dump_stack+0x99/0xcb
+   register_lock_class+0x12dd/0x1750
+   __lock_acquire+0xfe/0x3970
+   lock_acquire+0x1c8/0x7f0
+   del_timer_sync+0x49/0xd0
+   fq_pie_destroy+0x3f/0x80 [sch_fq_pie]
+   qdisc_create+0x916/0x1160
+   tc_modify_qdisc+0x3c4/0x1630
+   rtnetlink_rcv_msg+0x346/0x8e0
+   netlink_unicast+0x439/0x630
+   netlink_sendmsg+0x719/0xbf0
+   sock_sendmsg+0xe2/0x110
+   ____sys_sendmsg+0x5ba/0x890
+   ___sys_sendmsg+0xe9/0x160
+   __sys_sendmsg+0xd3/0x170
+   do_syscall_64+0x33/0x40
+   entry_SYSCALL_64_after_hwframe+0x44/0xa9
+  [...]
+  ODEBUG: assert_init not available (active state 0) object type: timer_list hint: 0x0
+  WARNING: CPU: 0 PID: 975 at lib/debugobjects.c:508 debug_print_object+0x162/0x210
+  [...]
+  Call Trace:
+   debug_object_assert_init+0x268/0x380
+   try_to_del_timer_sync+0x6a/0x100
+   del_timer_sync+0x9e/0xd0
+   fq_pie_destroy+0x3f/0x80 [sch_fq_pie]
+   qdisc_create+0x916/0x1160
+   tc_modify_qdisc+0x3c4/0x1630
+   rtnetlink_rcv_msg+0x346/0x8e0
+   netlink_rcv_skb+0x120/0x380
+   netlink_unicast+0x439/0x630
+   netlink_sendmsg+0x719/0xbf0
+   sock_sendmsg+0xe2/0x110
+   ____sys_sendmsg+0x5ba/0x890
+   ___sys_sendmsg+0xe9/0x160
+   __sys_sendmsg+0xd3/0x170
+   do_syscall_64+0x33/0x40
+   entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+fix it moving timer_setup() before any failure, like it was done on 'red'
+with former commit 608b4adab178 ("net_sched: initialize timer earlier in
+red_init()").
+
+Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler")
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Reviewed-by: Cong Wang <cong.wang@bytedance.com>
+Link: https://lore.kernel.org/r/2e78e01c504c633ebdff18d041833cf2e079a3a4.1607020450.git.dcaratti@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_fq_pie.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_fq_pie.c
++++ b/net/sched/sch_fq_pie.c
+@@ -401,6 +401,7 @@ static int fq_pie_init(struct Qdisc *sch
+       INIT_LIST_HEAD(&q->new_flows);
+       INIT_LIST_HEAD(&q->old_flows);
++      timer_setup(&q->adapt_timer, fq_pie_timer, 0);
+       if (opt) {
+               err = fq_pie_change(sch, opt, extack);
+@@ -426,7 +427,6 @@ static int fq_pie_init(struct Qdisc *sch
+               pie_vars_init(&flow->vars);
+       }
+-      timer_setup(&q->adapt_timer, fq_pie_timer, 0);
+       mod_timer(&q->adapt_timer, jiffies + HZ / 2);
+       return 0;
diff --git a/queue-5.9/net-stmmac-delete-the-eee_ctrl_timer-after-napi-disabled.patch b/queue-5.9/net-stmmac-delete-the-eee_ctrl_timer-after-napi-disabled.patch
new file mode 100644 (file)
index 0000000..d1acc77
--- /dev/null
@@ -0,0 +1,62 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Fugang Duan <fugang.duan@nxp.com>
+Date: Mon, 7 Dec 2020 18:51:40 +0800
+Subject: net: stmmac: delete the eee_ctrl_timer after napi disabled
+
+From: Fugang Duan <fugang.duan@nxp.com>
+
+[ Upstream commit 5f58591323bf3f342920179f24515935c4b5fd60 ]
+
+There have chance to re-enable the eee_ctrl_timer and fire the timer
+in napi callback after delete the timer in .stmmac_release(), which
+introduces to access eee registers in the timer function after clocks
+are disabled then causes system hang. Found this issue when do
+suspend/resume and reboot stress test.
+
+It is safe to delete the timer after napi disabled and disable lpi mode.
+
+Fixes: d765955d2ae0b ("stmmac: add the Energy Efficient Ethernet support")
+Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |   13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2893,9 +2893,6 @@ static int stmmac_release(struct net_dev
+       struct stmmac_priv *priv = netdev_priv(dev);
+       u32 chan;
+-      if (priv->eee_enabled)
+-              del_timer_sync(&priv->eee_ctrl_timer);
+-
+       if (device_may_wakeup(priv->device))
+               phylink_speed_down(priv->phylink, false);
+       /* Stop and disconnect the PHY */
+@@ -2914,6 +2911,11 @@ static int stmmac_release(struct net_dev
+       if (priv->lpi_irq > 0)
+               free_irq(priv->lpi_irq, dev);
++      if (priv->eee_enabled) {
++              priv->tx_path_in_lpi_mode = false;
++              del_timer_sync(&priv->eee_ctrl_timer);
++      }
++
+       /* Stop TX/RX DMA and clear the descriptors */
+       stmmac_stop_all_dma(priv);
+@@ -5077,6 +5079,11 @@ int stmmac_suspend(struct device *dev)
+       for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+               del_timer_sync(&priv->tx_queue[chan].txtimer);
++      if (priv->eee_enabled) {
++              priv->tx_path_in_lpi_mode = false;
++              del_timer_sync(&priv->eee_ctrl_timer);
++      }
++
+       /* Stop TX/RX DMA */
+       stmmac_stop_all_dma(priv);
diff --git a/queue-5.9/net-stmmac-dwmac-meson8b-fix-mask-definition-of-the-m250_sel-mux.patch b/queue-5.9/net-stmmac-dwmac-meson8b-fix-mask-definition-of-the-m250_sel-mux.patch
new file mode 100644 (file)
index 0000000..38342f7
--- /dev/null
@@ -0,0 +1,50 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sat, 5 Dec 2020 22:32:07 +0100
+Subject: net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 82ca4c922b8992013a238d65cf4e60cc33e12f36 ]
+
+The m250_sel mux clock uses bit 4 in the PRG_ETH0 register. Fix this by
+shifting the PRG_ETH0_CLK_M250_SEL_MASK accordingly as the "mask" in
+struct clk_mux expects the mask relative to the "shift" field in the
+same struct.
+
+While here, get rid of the PRG_ETH0_CLK_M250_SEL_SHIFT macro and use
+__ffs() to determine it from the existing PRG_ETH0_CLK_M250_SEL_MASK
+macro.
+
+Fixes: 566e8251625304 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201205213207.519341-1-martin.blumenstingl@googlemail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -30,7 +30,6 @@
+ #define PRG_ETH0_EXT_RMII_MODE                4
+ /* mux to choose between fclk_div2 (bit unset) and mpll2 (bit set) */
+-#define PRG_ETH0_CLK_M250_SEL_SHIFT   4
+ #define PRG_ETH0_CLK_M250_SEL_MASK    GENMASK(4, 4)
+ /* TX clock delay in ns = "8ns / 4 * tx_dly_val" (where 8ns are exactly one
+@@ -155,8 +154,9 @@ static int meson8b_init_rgmii_tx_clk(str
+               return -ENOMEM;
+       clk_configs->m250_mux.reg = dwmac->regs + PRG_ETH0;
+-      clk_configs->m250_mux.shift = PRG_ETH0_CLK_M250_SEL_SHIFT;
+-      clk_configs->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK;
++      clk_configs->m250_mux.shift = __ffs(PRG_ETH0_CLK_M250_SEL_MASK);
++      clk_configs->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK >>
++                                   clk_configs->m250_mux.shift;
+       clk = meson8b_dwmac_register_clk(dwmac, "m250_sel", mux_parents,
+                                        ARRAY_SIZE(mux_parents), &clk_mux_ops,
+                                        &clk_configs->m250_mux.hw);
diff --git a/queue-5.9/net-stmmac-free-tx-skb-buffer-in-stmmac_resume.patch b/queue-5.9/net-stmmac-free-tx-skb-buffer-in-stmmac_resume.patch
new file mode 100644 (file)
index 0000000..e4e0028
--- /dev/null
@@ -0,0 +1,111 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Fugang Duan <fugang.duan@nxp.com>
+Date: Mon, 7 Dec 2020 18:51:39 +0800
+Subject: net: stmmac: free tx skb buffer in stmmac_resume()
+
+From: Fugang Duan <fugang.duan@nxp.com>
+
+[ Upstream commit 4ec236c7c51f89abb0224a4da4a6b77f9beb6600 ]
+
+When do suspend/resume test, there have WARN_ON() log dump from
+stmmac_xmit() funciton, the code logic:
+       entry = tx_q->cur_tx;
+       first_entry = entry;
+       WARN_ON(tx_q->tx_skbuff[first_entry]);
+
+In normal case, tx_q->tx_skbuff[txq->cur_tx] should be NULL because
+the skb should be handled and freed in stmmac_tx_clean().
+
+But stmmac_resume() reset queue parameters like below, skb buffers
+may not be freed.
+       tx_q->cur_tx = 0;
+       tx_q->dirty_tx = 0;
+
+So free tx skb buffer in stmmac_resume() to avoid warning and
+memory leak.
+
+log:
+[   46.139824] ------------[ cut here ]------------
+[   46.144453] WARNING: CPU: 0 PID: 0 at drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:3235 stmmac_xmit+0x7a0/0x9d0
+[   46.154969] Modules linked in: crct10dif_ce vvcam(O) flexcan can_dev
+[   46.161328] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O      5.4.24-2.1.0+g2ad925d15481 #1
+[   46.170369] Hardware name: NXP i.MX8MPlus EVK board (DT)
+[   46.175677] pstate: 80000005 (Nzcv daif -PAN -UAO)
+[   46.180465] pc : stmmac_xmit+0x7a0/0x9d0
+[   46.184387] lr : dev_hard_start_xmit+0x94/0x158
+[   46.188913] sp : ffff800010003cc0
+[   46.192224] x29: ffff800010003cc0 x28: ffff000177e2a100
+[   46.197533] x27: ffff000176ef0840 x26: ffff000176ef0090
+[   46.202842] x25: 0000000000000000 x24: 0000000000000000
+[   46.208151] x23: 0000000000000003 x22: ffff8000119ddd30
+[   46.213460] x21: ffff00017636f000 x20: ffff000176ef0cc0
+[   46.218769] x19: 0000000000000003 x18: 0000000000000000
+[   46.224078] x17: 0000000000000000 x16: 0000000000000000
+[   46.229386] x15: 0000000000000079 x14: 0000000000000000
+[   46.234695] x13: 0000000000000003 x12: 0000000000000003
+[   46.240003] x11: 0000000000000010 x10: 0000000000000010
+[   46.245312] x9 : ffff00017002b140 x8 : 0000000000000000
+[   46.250621] x7 : ffff00017636f000 x6 : 0000000000000010
+[   46.255930] x5 : 0000000000000001 x4 : ffff000176ef0000
+[   46.261238] x3 : 0000000000000003 x2 : 00000000ffffffff
+[   46.266547] x1 : ffff000177e2a000 x0 : 0000000000000000
+[   46.271856] Call trace:
+[   46.274302]  stmmac_xmit+0x7a0/0x9d0
+[   46.277874]  dev_hard_start_xmit+0x94/0x158
+[   46.282056]  sch_direct_xmit+0x11c/0x338
+[   46.285976]  __qdisc_run+0x118/0x5f0
+[   46.289549]  net_tx_action+0x110/0x198
+[   46.293297]  __do_softirq+0x120/0x23c
+[   46.296958]  irq_exit+0xb8/0xd8
+[   46.300098]  __handle_domain_irq+0x64/0xb8
+[   46.304191]  gic_handle_irq+0x5c/0x148
+[   46.307936]  el1_irq+0xb8/0x180
+[   46.311076]  cpuidle_enter_state+0x84/0x360
+[   46.315256]  cpuidle_enter+0x34/0x48
+[   46.318829]  call_cpuidle+0x18/0x38
+[   46.322314]  do_idle+0x1e0/0x280
+[   46.325539]  cpu_startup_entry+0x24/0x40
+[   46.329460]  rest_init+0xd4/0xe0
+[   46.332687]  arch_call_rest_init+0xc/0x14
+[   46.336695]  start_kernel+0x420/0x44c
+[   46.340353] ---[ end trace bc1ee695123cbacd ]---
+
+Fixes: 47dd7a540b8a0 ("net: add support for STMicroelectronics Ethernet controllers.")
+Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |   14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1530,6 +1530,19 @@ static void dma_free_tx_skbufs(struct st
+ }
+ /**
++ * stmmac_free_tx_skbufs - free TX skb buffers
++ * @priv: private structure
++ */
++static void stmmac_free_tx_skbufs(struct stmmac_priv *priv)
++{
++      u32 tx_queue_cnt = priv->plat->tx_queues_to_use;
++      u32 queue;
++
++      for (queue = 0; queue < tx_queue_cnt; queue++)
++              dma_free_tx_skbufs(priv, queue);
++}
++
++/**
+  * free_dma_rx_desc_resources - free RX dma desc resources
+  * @priv: private structure
+  */
+@@ -5183,6 +5196,7 @@ int stmmac_resume(struct device *dev)
+       stmmac_reset_queues_param(priv);
++      stmmac_free_tx_skbufs(priv);
+       stmmac_clear_descriptors(priv);
+       stmmac_hw_setup(ndev, false);
diff --git a/queue-5.9/net-stmmac-increase-the-timeout-for-dma-reset.patch b/queue-5.9/net-stmmac-increase-the-timeout-for-dma-reset.patch
new file mode 100644 (file)
index 0000000..2024288
--- /dev/null
@@ -0,0 +1,31 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Fugang Duan <fugang.duan@nxp.com>
+Date: Mon, 7 Dec 2020 18:51:37 +0800
+Subject: net: stmmac: increase the timeout for dma reset
+
+From: Fugang Duan <fugang.duan@nxp.com>
+
+[ Upstream commit 9d14edfdeabf37d8d8f045e63e5873712aadcd6b ]
+
+Current timeout value is not enough for gmac5 dma reset
+on imx8mp platform, increase the timeout range.
+
+Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+@@ -22,7 +22,7 @@ int dwmac4_dma_reset(void __iomem *ioadd
+       return readl_poll_timeout(ioaddr + DMA_BUS_MODE, value,
+                                !(value & DMA_BUS_MODE_SFT_RESET),
+-                               10000, 100000);
++                               10000, 1000000);
+ }
+ void dwmac4_set_rx_tail_ptr(void __iomem *ioaddr, u32 tail_ptr, u32 chan)
diff --git a/queue-5.9/net-stmmac-overwrite-the-dma_cap.addr64-according-to-hw-design.patch b/queue-5.9/net-stmmac-overwrite-the-dma_cap.addr64-according-to-hw-design.patch
new file mode 100644 (file)
index 0000000..f3c1438
--- /dev/null
@@ -0,0 +1,77 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Fugang Duan <fugang.duan@nxp.com>
+Date: Mon, 7 Dec 2020 18:51:41 +0800
+Subject: net: stmmac: overwrite the dma_cap.addr64 according to HW design
+
+From: Fugang Duan <fugang.duan@nxp.com>
+
+[ Upstream commit f119cc9818eb33b66e977ad3af75aef6500bbdc3 ]
+
+The current IP register MAC_HW_Feature1[ADDR64] only defines
+32/40/64 bit width, but some SOCs support others like i.MX8MP
+support 34 bits but it maps to 40 bits width in MAC_HW_Feature1[ADDR64].
+So overwrite dma_cap.addr64 according to HW real design.
+
+Fixes: 94abdad6974a ("net: ethernet: dwmac: add ethernet glue logic for NXP imx8 chip")
+Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c   |    9 +--------
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |    8 ++++++++
+ include/linux/stmmac.h                            |    1 +
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c
+@@ -247,13 +247,7 @@ static int imx_dwmac_probe(struct platfo
+               goto err_parse_dt;
+       }
+-      ret = dma_set_mask_and_coherent(&pdev->dev,
+-                                      DMA_BIT_MASK(dwmac->ops->addr_width));
+-      if (ret) {
+-              dev_err(&pdev->dev, "DMA mask set failed\n");
+-              goto err_dma_mask;
+-      }
+-
++      plat_dat->addr64 = dwmac->ops->addr_width;
+       plat_dat->init = imx_dwmac_init;
+       plat_dat->exit = imx_dwmac_exit;
+       plat_dat->fix_mac_speed = imx_dwmac_fix_speed;
+@@ -273,7 +267,6 @@ static int imx_dwmac_probe(struct platfo
+ err_dwmac_init:
+ err_drv_probe:
+       imx_dwmac_exit(pdev, plat_dat->bsp_priv);
+-err_dma_mask:
+ err_parse_dt:
+ err_match_data:
+       stmmac_remove_config_dt(pdev, plat_dat);
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4842,6 +4842,14 @@ int stmmac_dvr_probe(struct device *devi
+               dev_info(priv->device, "SPH feature enabled\n");
+       }
++      /* The current IP register MAC_HW_Feature1[ADDR64] only define
++       * 32/40/64 bit width, but some SOC support others like i.MX8MP
++       * support 34 bits but it map to 40 bits width in MAC_HW_Feature1[ADDR64].
++       * So overwrite dma_cap.addr64 according to HW real design.
++       */
++      if (priv->plat->addr64)
++              priv->dma_cap.addr64 = priv->plat->addr64;
++
+       if (priv->dma_cap.addr64) {
+               ret = dma_set_mask_and_coherent(device,
+                               DMA_BIT_MASK(priv->dma_cap.addr64));
+--- a/include/linux/stmmac.h
++++ b/include/linux/stmmac.h
+@@ -170,6 +170,7 @@ struct plat_stmmacenet_data {
+       int unicast_filter_entries;
+       int tx_fifo_size;
+       int rx_fifo_size;
++      u32 addr64;
+       u32 rx_queues_to_use;
+       u32 tx_queues_to_use;
+       u8 rx_sched_algorithm;
diff --git a/queue-5.9/net-stmmac-start-phylink-instance-before-stmmac_hw_setup.patch b/queue-5.9/net-stmmac-start-phylink-instance-before-stmmac_hw_setup.patch
new file mode 100644 (file)
index 0000000..a285c12
--- /dev/null
@@ -0,0 +1,56 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Fugang Duan <fugang.duan@nxp.com>
+Date: Mon, 7 Dec 2020 18:51:38 +0800
+Subject: net: stmmac: start phylink instance before stmmac_hw_setup()
+
+From: Fugang Duan <fugang.duan@nxp.com>
+
+[ Upstream commit 36d18b5664ef617ccf4da266291d2f2342fab89d ]
+
+Start phylink instance and resume back the PHY to supply
+RX clock to MAC before MAC layer initialization by calling
+.stmmac_hw_setup(), since DMA reset depends on the RX clock,
+otherwise DMA reset cost maximum timeout value then finally
+timeout.
+
+Fixes: 74371272f97f ("net: stmmac: Convert to phylink and remove phylib logic")
+Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |   16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -5170,6 +5170,14 @@ int stmmac_resume(struct device *dev)
+                       return ret;
+       }
++      if (!device_may_wakeup(priv->device) || !priv->plat->pmt) {
++              rtnl_lock();
++              phylink_start(priv->phylink);
++              /* We may have called phylink_speed_down before */
++              phylink_speed_up(priv->phylink);
++              rtnl_unlock();
++      }
++
+       rtnl_lock();
+       mutex_lock(&priv->lock);
+@@ -5188,14 +5196,6 @@ int stmmac_resume(struct device *dev)
+       mutex_unlock(&priv->lock);
+       rtnl_unlock();
+-      if (!device_may_wakeup(priv->device) || !priv->plat->pmt) {
+-              rtnl_lock();
+-              phylink_start(priv->phylink);
+-              /* We may have called phylink_speed_down before */
+-              phylink_speed_up(priv->phylink);
+-              rtnl_unlock();
+-      }
+-
+       phylink_mac_change(priv->phylink, true);
+       netif_device_attach(ndev);
diff --git a/queue-5.9/net-tipc-prevent-possible-null-deref-of-link.patch b/queue-5.9/net-tipc-prevent-possible-null-deref-of-link.patch
new file mode 100644 (file)
index 0000000..e698a89
--- /dev/null
@@ -0,0 +1,41 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Cengiz Can <cengiz@kernel.wtf>
+Date: Mon, 7 Dec 2020 11:14:24 +0300
+Subject: net: tipc: prevent possible null deref of link
+
+From: Cengiz Can <cengiz@kernel.wtf>
+
+[ Upstream commit 0398ba9e5a4b5675aa571e0445689d3c2e499c2d ]
+
+`tipc_node_apply_property` does a null check on a `tipc_link_entry`
+pointer but also accesses the same pointer out of the null check block.
+
+This triggers a warning on Coverity Static Analyzer because we're
+implying that `e->link` can BE null.
+
+Move "Update MTU for node link entry" line into if block to make sure
+that we're not in a state that `e->link` is null.
+
+Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/node.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -2170,9 +2170,11 @@ void tipc_node_apply_property(struct net
+                                                       &xmitq);
+                       else if (prop == TIPC_NLA_PROP_MTU)
+                               tipc_link_set_mtu(e->link, b->mtu);
++
++                      /* Update MTU for node link entry */
++                      e->mtu = tipc_link_mss(e->link);
+               }
+-              /* Update MTU for node link entry */
+-              e->mtu = tipc_link_mss(e->link);
++
+               tipc_node_write_unlock(n);
+               tipc_bearer_xmit(net, bearer_id, &xmitq, &e->maddr, NULL);
+       }
index 1ee0ea3de8373a53b0f0417c3abc24fe4d5d1887..0b1b0388198bbb5938163e87bd6bd309aaf2c879 100644 (file)
@@ -1 +1,32 @@
 ptrace-prevent-kernel-infoleak-in-ptrace_get_syscall_info.patch
+net-sched-fq_pie-initialize-timer-earlier-in-fq_pie_init.patch
+net-ipa-pass-the-correct-size-when-freeing-dma-memory.patch
+ipv4-fix-error-return-code-in-rtm_to_fib_config.patch
+mac80211-mesh-fix-mesh_pathtbl_init-error-path.patch
+net-bridge-vlan-fix-error-return-code-in-__vlan_add.patch
+vrf-packets-with-lladdr-src-needs-dst-at-input-with-orig_iif-when-needs-strict.patch
+net-mscc-ocelot-fix-dropping-of-unknown-ipv4-multicast-on-seville.patch
+net-hns3-remove-a-misused-pragma-packed.patch
+udp-fix-the-proto-value-passed-to-ip_protocol_deliver_rcu-for-the-segments.patch
+enetc-fix-reporting-of-h-w-packet-counters.patch
+bridge-fix-a-deadlock-when-enabling-multicast-snooping.patch
+mptcp-print-new-line-in-mptcp_seq_show-if-mptcp-isn-t-in-use.patch
+net-stmmac-dwmac-meson8b-fix-mask-definition-of-the-m250_sel-mux.patch
+net-stmmac-start-phylink-instance-before-stmmac_hw_setup.patch
+net-stmmac-free-tx-skb-buffer-in-stmmac_resume.patch
+net-stmmac-delete-the-eee_ctrl_timer-after-napi-disabled.patch
+net-stmmac-overwrite-the-dma_cap.addr64-according-to-hw-design.patch
+net-ll_temac-fix-potential-null-dereference-in-temac_probe.patch
+tcp-select-sane-initial-rcvq_space.space-for-big-mss.patch
+e1000e-fix-s0ix-flow-to-allow-s0i3.2-subset-entry.patch
+ethtool-fix-stack-overflow-in-ethnl_parse_bitset.patch
+tcp-fix-cwnd-limited-bug-for-tso-deferral-where-we-send-nothing.patch
+net-flow_offload-fix-memory-leak-for-indirect-flow-block.patch
+net-mlx4_en-avoid-scheduling-restart-task-if-it-is-already-running.patch
+net-mlx4_en-handle-tx-error-cqe.patch
+net-sched-fix-dump-of-mpls_opt_lse_label-attribute-in-cls_flower.patch
+bonding-fix-feature-flag-setting-at-init-time.patch
+ch_ktls-fix-build-warning-for-ipv4-only-config.patch
+lan743x-fix-for-potential-null-pointer-dereference-with-bare-card.patch
+net-stmmac-increase-the-timeout-for-dma-reset.patch
+net-tipc-prevent-possible-null-deref-of-link.patch
diff --git a/queue-5.9/tcp-fix-cwnd-limited-bug-for-tso-deferral-where-we-send-nothing.patch b/queue-5.9/tcp-fix-cwnd-limited-bug-for-tso-deferral-where-we-send-nothing.patch
new file mode 100644 (file)
index 0000000..17a4498
--- /dev/null
@@ -0,0 +1,86 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Neal Cardwell <ncardwell@google.com>
+Date: Tue, 8 Dec 2020 22:57:59 -0500
+Subject: tcp: fix cwnd-limited bug for TSO deferral where we send nothing
+
+From: Neal Cardwell <ncardwell@google.com>
+
+[ Upstream commit 299bcb55ecd1412f6df606e9dc0912d55610029e ]
+
+When cwnd is not a multiple of the TSO skb size of N*MSS, we can get
+into persistent scenarios where we have the following sequence:
+
+(1) ACK for full-sized skb of N*MSS arrives
+  -> tcp_write_xmit() transmit full-sized skb with N*MSS
+  -> move pacing release time forward
+  -> exit tcp_write_xmit() because pacing time is in the future
+
+(2) TSQ callback or TCP internal pacing timer fires
+  -> try to transmit next skb, but TSO deferral finds remainder of
+     available cwnd is not big enough to trigger an immediate send
+     now, so we defer sending until the next ACK.
+
+(3) repeat...
+
+So we can get into a case where we never mark ourselves as
+cwnd-limited for many seconds at a time, even with
+bulk/infinite-backlog senders, because:
+
+o In case (1) above, every time in tcp_write_xmit() we have enough
+cwnd to send a full-sized skb, we are not fully using the cwnd
+(because cwnd is not a multiple of the TSO skb size). So every time we
+send data, we are not cwnd limited, and so in the cwnd-limited
+tracking code in tcp_cwnd_validate() we mark ourselves as not
+cwnd-limited.
+
+o In case (2) above, every time in tcp_write_xmit() that we try to
+transmit the "remainder" of the cwnd but defer, we set the local
+variable is_cwnd_limited to true, but we do not send any packets, so
+sent_pkts is zero, so we don't call the cwnd-limited logic to update
+tp->is_cwnd_limited.
+
+Fixes: ca8a22634381 ("tcp: make cwnd-limited checks measurement-based, and gentler")
+Reported-by: Ingemar Johansson <ingemar.s.johansson@ericsson.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20201209035759.1225145-1-ncardwell.kernel@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_output.c |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1723,7 +1723,8 @@ static void tcp_cwnd_validate(struct soc
+        * window, and remember whether we were cwnd-limited then.
+        */
+       if (!before(tp->snd_una, tp->max_packets_seq) ||
+-          tp->packets_out > tp->max_packets_out) {
++          tp->packets_out > tp->max_packets_out ||
++          is_cwnd_limited) {
+               tp->max_packets_out = tp->packets_out;
+               tp->max_packets_seq = tp->snd_nxt;
+               tp->is_cwnd_limited = is_cwnd_limited;
+@@ -2545,6 +2546,10 @@ repair:
+       else
+               tcp_chrono_stop(sk, TCP_CHRONO_RWND_LIMITED);
++      is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
++      if (likely(sent_pkts || is_cwnd_limited))
++              tcp_cwnd_validate(sk, is_cwnd_limited);
++
+       if (likely(sent_pkts)) {
+               if (tcp_in_cwnd_reduction(sk))
+                       tp->prr_out += sent_pkts;
+@@ -2552,8 +2557,6 @@ repair:
+               /* Send one loss probe per tail loss episode. */
+               if (push_one != 2)
+                       tcp_schedule_loss_probe(sk, false);
+-              is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
+-              tcp_cwnd_validate(sk, is_cwnd_limited);
+               return false;
+       }
+       return !tp->packets_out && !tcp_write_queue_empty(sk);
diff --git a/queue-5.9/tcp-select-sane-initial-rcvq_space.space-for-big-mss.patch b/queue-5.9/tcp-select-sane-initial-rcvq_space.space-for-big-mss.patch
new file mode 100644 (file)
index 0000000..27cc0f7
--- /dev/null
@@ -0,0 +1,67 @@
+From foo@baz Sat Dec 19 11:38:44 AM CET 2020
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 8 Dec 2020 08:21:31 -0800
+Subject: tcp: select sane initial rcvq_space.space for big MSS
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 72d05c00d7ecda85df29abd046da7e41cc071c17 ]
+
+Before commit a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin to around 64KB")
+small tcp_rmem[1] values were overridden by tcp_fixup_rcvbuf() to accommodate various MSS.
+
+This is no longer the case, and Hazem Mohamed Abuelfotoh reported
+that DRS would not work for MTU 9000 endpoints receiving regular (1500 bytes) frames.
+
+Root cause is that tcp_init_buffer_space() uses tp->rcv_wnd for upper limit
+of rcvq_space.space computation, while it can select later a smaller
+value for tp->rcv_ssthresh and tp->window_clamp.
+
+ss -temoi on receiver would show :
+
+skmem:(r0,rb131072,t0,tb46080,f0,w0,o0,bl0,d0) rcv_space:62496 rcv_ssthresh:56596
+
+This means that TCP can not increase its window in tcp_grow_window(),
+and that DRS can never kick.
+
+Fix this by making sure that rcvq_space.space is not bigger than number of bytes
+that can be held in TCP receive queue.
+
+People unable/unwilling to change their kernel can work around this issue by
+selecting a bigger tcp_rmem[1] value as in :
+
+echo "4096 196608 6291456" >/proc/sys/net/ipv4/tcp_rmem
+
+Based on an initial report and patch from Hazem Mohamed Abuelfotoh
+ https://lore.kernel.org/netdev/20201204180622.14285-1-abuehaze@amazon.com/
+
+Fixes: a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin to around 64KB")
+Fixes: 041a14d26715 ("tcp: start receiver buffer autotuning sooner")
+Reported-by: Hazem Mohamed Abuelfotoh <abuehaze@amazon.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_input.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -447,7 +447,6 @@ static void tcp_init_buffer_space(struct
+       if (!(sk->sk_userlocks & SOCK_SNDBUF_LOCK))
+               tcp_sndbuf_expand(sk);
+-      tp->rcvq_space.space = min_t(u32, tp->rcv_wnd, TCP_INIT_CWND * tp->advmss);
+       tcp_mstamp_refresh(tp);
+       tp->rcvq_space.time = tp->tcp_mstamp;
+       tp->rcvq_space.seq = tp->copied_seq;
+@@ -471,6 +470,8 @@ static void tcp_init_buffer_space(struct
+       tp->rcv_ssthresh = min(tp->rcv_ssthresh, tp->window_clamp);
+       tp->snd_cwnd_stamp = tcp_jiffies32;
++      tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd,
++                                  (u32)TCP_INIT_CWND * tp->advmss);
+ }
+ /* 4. Recalculate window clamp after socket hit its memory bounds. */
diff --git a/queue-5.9/udp-fix-the-proto-value-passed-to-ip_protocol_deliver_rcu-for-the-segments.patch b/queue-5.9/udp-fix-the-proto-value-passed-to-ip_protocol_deliver_rcu-for-the-segments.patch
new file mode 100644 (file)
index 0000000..5a66bd4
--- /dev/null
@@ -0,0 +1,38 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 7 Dec 2020 15:55:40 +0800
+Subject: udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 10c678bd0a035ac2c64a9b26b222f20556227a53 ]
+
+Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the
+proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu().
+Otherwize, with a negtive value passed, it will underflow inet_protos.
+
+This can be reproduced with IPIP FOU:
+
+  # ip fou add port 5555 ipproto 4
+  # ethtool -K eth1 rx-gro-list on
+
+Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection")
+Reported-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/udp.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2173,7 +2173,7 @@ static int udp_queue_rcv_skb(struct sock
+               __skb_pull(skb, skb_transport_offset(skb));
+               ret = udp_queue_rcv_one_skb(sk, skb);
+               if (ret > 0)
+-                      ip_protocol_deliver_rcu(dev_net(skb->dev), skb, -ret);
++                      ip_protocol_deliver_rcu(dev_net(skb->dev), skb, ret);
+       }
+       return 0;
+ }
diff --git a/queue-5.9/vrf-packets-with-lladdr-src-needs-dst-at-input-with-orig_iif-when-needs-strict.patch b/queue-5.9/vrf-packets-with-lladdr-src-needs-dst-at-input-with-orig_iif-when-needs-strict.patch
new file mode 100644 (file)
index 0000000..ebc7abf
--- /dev/null
@@ -0,0 +1,174 @@
+From foo@baz Sat Dec 19 11:38:43 AM CET 2020
+From: Stephen Suryaputra <ssuryaextr@gmail.com>
+Date: Thu, 3 Dec 2020 22:06:04 -0500
+Subject: vrf: packets with lladdr src needs dst at input with orig_iif when needs strict
+
+From: Stephen Suryaputra <ssuryaextr@gmail.com>
+
+[ Upstream commit 205704c618af0ab2366015d2281a3b0814d918a0 ]
+
+Depending on the order of the routes to fe80::/64 are installed on the
+VRF table, the NS for the source link-local address of the originator
+might be sent to the wrong interface.
+
+This patch ensures that packets with link-local addr source is doing a
+lookup with the orig_iif when the destination addr indicates that it
+is strict.
+
+Add the reproducer as a use case in self test script fcnal-test.sh.
+
+Fixes: b4869aa2f881 ("net: vrf: ipv6 support for local traffic to local addresses")
+Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20201204030604.18828-1-ssuryaextr@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vrf.c                         |   10 ++-
+ tools/testing/selftests/net/fcnal-test.sh |   95 ++++++++++++++++++++++++++++++
+ 2 files changed, 103 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -1315,11 +1315,17 @@ static struct sk_buff *vrf_ip6_rcv(struc
+       int orig_iif = skb->skb_iif;
+       bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
+       bool is_ndisc = ipv6_ndisc_frame(skb);
++      bool is_ll_src;
+       /* loopback, multicast & non-ND link-local traffic; do not push through
+-       * packet taps again. Reset pkt_type for upper layers to process skb
++       * packet taps again. Reset pkt_type for upper layers to process skb.
++       * for packets with lladdr src, however, skip so that the dst can be
++       * determine at input using original ifindex in the case that daddr
++       * needs strict
+        */
+-      if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
++      is_ll_src = ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL;
++      if (skb->pkt_type == PACKET_LOOPBACK ||
++          (need_strict && !is_ndisc && !is_ll_src)) {
+               skb->dev = vrf_dev;
+               skb->skb_iif = vrf_dev->ifindex;
+               IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -256,6 +256,28 @@ setup_cmd_nsb()
+       fi
+ }
++setup_cmd_nsc()
++{
++      local cmd="$*"
++      local rc
++
++      run_cmd_nsc ${cmd}
++      rc=$?
++      if [ $rc -ne 0 ]; then
++              # show user the command if not done so already
++              if [ "$VERBOSE" = "0" ]; then
++                      echo "setup command: $cmd"
++              fi
++              echo "failed. stopping tests"
++              if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
++                      echo
++                      echo "hit enter to continue"
++                      read a
++              fi
++              exit $rc
++      fi
++}
++
+ # set sysctl values in NS-A
+ set_sysctl()
+ {
+@@ -471,6 +493,36 @@ setup()
+       sleep 1
+ }
++setup_lla_only()
++{
++      # make sure we are starting with a clean slate
++      kill_procs
++      cleanup 2>/dev/null
++
++      log_debug "Configuring network namespaces"
++      set -e
++
++      create_ns ${NSA} "-" "-"
++      create_ns ${NSB} "-" "-"
++      create_ns ${NSC} "-" "-"
++      connect_ns ${NSA} ${NSA_DEV} "-" "-" \
++                 ${NSB} ${NSB_DEV} "-" "-"
++      connect_ns ${NSA} ${NSA_DEV2} "-" "-" \
++                 ${NSC} ${NSC_DEV}  "-" "-"
++
++      NSA_LINKIP6=$(get_linklocal ${NSA} ${NSA_DEV})
++      NSB_LINKIP6=$(get_linklocal ${NSB} ${NSB_DEV})
++      NSC_LINKIP6=$(get_linklocal ${NSC} ${NSC_DEV})
++
++      create_vrf ${NSA} ${VRF} ${VRF_TABLE} "-" "-"
++      ip -netns ${NSA} link set dev ${NSA_DEV} vrf ${VRF}
++      ip -netns ${NSA} link set dev ${NSA_DEV2} vrf ${VRF}
++
++      set +e
++
++      sleep 1
++}
++
+ ################################################################################
+ # IPv4
+@@ -3787,10 +3839,53 @@ use_case_br()
+       setup_cmd_nsb ip li del vlan100 2>/dev/null
+ }
++# VRF only.
++# ns-A device is connected to both ns-B and ns-C on a single VRF but only has
++# LLA on the interfaces
++use_case_ping_lla_multi()
++{
++      setup_lla_only
++      # only want reply from ns-A
++      setup_cmd_nsb sysctl -qw net.ipv6.icmp.echo_ignore_multicast=1
++      setup_cmd_nsc sysctl -qw net.ipv6.icmp.echo_ignore_multicast=1
++
++      log_start
++      run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV}
++      log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Pre cycle, ping out ns-B"
++
++      run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV}
++      log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Pre cycle, ping out ns-C"
++
++      # cycle/flap the first ns-A interface
++      setup_cmd ip link set ${NSA_DEV} down
++      setup_cmd ip link set ${NSA_DEV} up
++      sleep 1
++
++      log_start
++      run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV}
++      log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV}, ping out ns-B"
++      run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV}
++      log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV}, ping out ns-C"
++
++      # cycle/flap the second ns-A interface
++      setup_cmd ip link set ${NSA_DEV2} down
++      setup_cmd ip link set ${NSA_DEV2} up
++      sleep 1
++
++      log_start
++      run_cmd_nsb ping -c1 -w1 ${MCAST}%${NSB_DEV}
++      log_test_addr ${MCAST}%${NSB_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV2}, ping out ns-B"
++      run_cmd_nsc ping -c1 -w1 ${MCAST}%${NSC_DEV}
++      log_test_addr ${MCAST}%${NSC_DEV} $? 0 "Post cycle ${NSA} ${NSA_DEV2}, ping out ns-C"
++}
++
+ use_cases()
+ {
+       log_section "Use cases"
++      log_subsection "Device enslaved to bridge"
+       use_case_br
++      log_subsection "Ping LLA with multiple interfaces"
++      use_case_ping_lla_multi
+ }
+ ################################################################################