From: Sasha Levin Date: Mon, 3 Feb 2020 15:10:20 +0000 (-0500) Subject: fixes for 4.4 X-Git-Tag: v5.5.2~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=08e971dcaf29a401afa090632b5e7e32a2938966;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/airo-add-missing-cap_net_admin-check-in-airooldioctl.patch b/queue-4.4/airo-add-missing-cap_net_admin-check-in-airooldioctl.patch new file mode 100644 index 00000000000..49d54fac996 --- /dev/null +++ b/queue-4.4/airo-add-missing-cap_net_admin-check-in-airooldioctl.patch @@ -0,0 +1,83 @@ +From 9f4ec8f816fdcbad148d7a5c56522e4227ced10c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2020 15:07:28 +1100 +Subject: airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE + +From: Michael Ellerman + +[ Upstream commit 78f7a7566f5eb59321e99b55a6fdb16ea05b37d1 ] + +The driver for Cisco Aironet 4500 and 4800 series cards (airo.c), +implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl(). + +The ioctl handler copies an aironet_ioctl struct from userspace, which +includes a command. Some of the commands are handled in readrids(), +where the user controlled command is converted into a driver-internal +value called "ridcode". + +There are two command values, AIROGWEPKTMP and AIROGWEPKNV, which +correspond to ridcode values of RID_WEP_TEMP and RID_WEP_PERM +respectively. These commands both have checks that the user has +CAP_NET_ADMIN, with the comment that "Only super-user can read WEP +keys", otherwise they return -EPERM. + +However there is another command value, AIRORRID, that lets the user +specify the ridcode value directly, with no other checks. This means +the user can bypass the CAP_NET_ADMIN check on AIROGWEPKTMP and +AIROGWEPKNV. + +Fix it by moving the CAP_NET_ADMIN check out of the command handling +and instead do it later based on the ridcode. That way regardless of +whether the ridcode is set via AIROGWEPKTMP or AIROGWEPKNV, or passed +in using AIRORID, we always do the CAP_NET_ADMIN check. + +Found by Ilja by code inspection, not tested as I don't have the +required hardware. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Michael Ellerman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/airo.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c +index 94df9ddfb7eb1..a44496d8423ab 100644 +--- a/drivers/net/wireless/airo.c ++++ b/drivers/net/wireless/airo.c +@@ -7808,16 +7808,8 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) { + case AIROGVLIST: ridcode = RID_APLIST; break; + case AIROGDRVNAM: ridcode = RID_DRVNAME; break; + case AIROGEHTENC: ridcode = RID_ETHERENCAP; break; +- case AIROGWEPKTMP: ridcode = RID_WEP_TEMP; +- /* Only super-user can read WEP keys */ +- if (!capable(CAP_NET_ADMIN)) +- return -EPERM; +- break; +- case AIROGWEPKNV: ridcode = RID_WEP_PERM; +- /* Only super-user can read WEP keys */ +- if (!capable(CAP_NET_ADMIN)) +- return -EPERM; +- break; ++ case AIROGWEPKTMP: ridcode = RID_WEP_TEMP; break; ++ case AIROGWEPKNV: ridcode = RID_WEP_PERM; break; + case AIROGSTAT: ridcode = RID_STATUS; break; + case AIROGSTATSD32: ridcode = RID_STATSDELTA; break; + case AIROGSTATSC32: ridcode = RID_STATS; break; +@@ -7831,6 +7823,12 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) { + return -EINVAL; + } + ++ if (ridcode == RID_WEP_TEMP || ridcode == RID_WEP_PERM) { ++ /* Only super-user can read WEP keys */ ++ if (!capable(CAP_NET_ADMIN)) ++ return -EPERM; ++ } ++ + if ((iobuf = kzalloc(RIDSIZE, GFP_KERNEL)) == NULL) + return -ENOMEM; + +-- +2.20.1 + diff --git a/queue-4.4/airo-fix-possible-info-leak-in-airooldioctl-siocdevp.patch b/queue-4.4/airo-fix-possible-info-leak-in-airooldioctl-siocdevp.patch new file mode 100644 index 00000000000..24355d7b520 --- /dev/null +++ b/queue-4.4/airo-fix-possible-info-leak-in-airooldioctl-siocdevp.patch @@ -0,0 +1,70 @@ +From 3854156021e134cd42cd5e64a7a1f0cc073055a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2020 15:07:27 +1100 +Subject: airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE + +From: Michael Ellerman + +[ Upstream commit d6bce2137f5d6bb1093e96d2f801479099b28094 ] + +The driver for Cisco Aironet 4500 and 4800 series cards (airo.c), +implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl(). + +The ioctl handler copies an aironet_ioctl struct from userspace, which +includes a command and a length. Some of the commands are handled in +readrids(), which kmalloc()'s a buffer of RIDSIZE (2048) bytes. + +That buffer is then passed to PC4500_readrid(), which has two cases. +The else case does some setup and then reads up to RIDSIZE bytes from +the hardware into the kmalloc()'ed buffer. + +Here len == RIDSIZE, pBuf is the kmalloc()'ed buffer: + + // read the rid length field + bap_read(ai, pBuf, 2, BAP1); + // length for remaining part of rid + len = min(len, (int)le16_to_cpu(*(__le16*)pBuf)) - 2; + ... + // read remainder of the rid + rc = bap_read(ai, ((__le16*)pBuf)+1, len, BAP1); + +PC4500_readrid() then returns to readrids() which does: + + len = comp->len; + if (copy_to_user(comp->data, iobuf, min(len, (int)RIDSIZE))) { + +Where comp->len is the user controlled length field. + +So if the "rid length field" returned by the hardware is < 2048, and +the user requests 2048 bytes in comp->len, we will leak the previous +contents of the kmalloc()'ed buffer to userspace. + +Fix it by kzalloc()'ing the buffer. + +Found by Ilja by code inspection, not tested as I don't have the +required hardware. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Michael Ellerman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/airo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c +index 82d24f2b9c190..94df9ddfb7eb1 100644 +--- a/drivers/net/wireless/airo.c ++++ b/drivers/net/wireless/airo.c +@@ -7831,7 +7831,7 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) { + return -EINVAL; + } + +- if ((iobuf = kmalloc(RIDSIZE, GFP_KERNEL)) == NULL) ++ if ((iobuf = kzalloc(RIDSIZE, GFP_KERNEL)) == NULL) + return -ENOMEM; + + PC4500_readrid(ai,ridcode,iobuf,RIDSIZE, 1); +-- +2.20.1 + diff --git a/queue-4.4/arm-8955-1-virt-relax-arch-timer-version-check-durin.patch b/queue-4.4/arm-8955-1-virt-relax-arch-timer-version-check-durin.patch new file mode 100644 index 00000000000..9771d82a9de --- /dev/null +++ b/queue-4.4/arm-8955-1-virt-relax-arch-timer-version-check-durin.patch @@ -0,0 +1,50 @@ +From fab04db4db271d6ce4a2057569bd2efd854d9e8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2020 15:07:46 +0100 +Subject: ARM: 8955/1: virt: Relax arch timer version check during early boot + +From: Vladimir Murzin + +[ Upstream commit 6849b5eba1965ceb0cad3a75877ef4569dd3638e ] + +Updates to the Generic Timer architecture allow ID_PFR1.GenTimer to +have values other than 0 or 1 while still preserving backward +compatibility. At the moment, Linux is quite strict in the way it +handles this field at early boot and will not configure arch timer if +it doesn't find the value 1. + +Since here use ubfx for arch timer version extraction (hyb-stub build +with -march=armv7-a, so it is safe) + +To help backports (even though the code was correct at the time of writing) + +Fixes: 8ec58be9f3ff ("ARM: virt: arch_timers: enable access to physical timers") +Acked-by: Marc Zyngier +Signed-off-by: Vladimir Murzin +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/hyp-stub.S | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S +index 2a55373f49bfb..f9948363111d1 100644 +--- a/arch/arm/kernel/hyp-stub.S ++++ b/arch/arm/kernel/hyp-stub.S +@@ -144,10 +144,9 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE + #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER) + @ make CNTP_* and CNTPCT accessible from PL1 + mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1 +- lsr r7, #16 +- and r7, #0xf +- cmp r7, #1 +- bne 1f ++ ubfx r7, r7, #16, #4 ++ teq r7, #0 ++ beq 1f + mrc p15, 4, r7, c14, c1, 0 @ CNTHCTL + orr r7, r7, #3 @ PL1PCEN | PL1PCTEN + mcr p15, 4, r7, c14, c1, 0 @ CNTHCTL +-- +2.20.1 + diff --git a/queue-4.4/clk-mmp2-fix-the-order-of-timer-mux-parents.patch b/queue-4.4/clk-mmp2-fix-the-order-of-timer-mux-parents.patch new file mode 100644 index 00000000000..98bb65e9ce0 --- /dev/null +++ b/queue-4.4/clk-mmp2-fix-the-order-of-timer-mux-parents.patch @@ -0,0 +1,41 @@ +From dcf311c9ed68729ad611e1e5971b3d4cdd6f9929 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2019 20:04:54 +0100 +Subject: clk: mmp2: Fix the order of timer mux parents + +From: Lubomir Rintel + +[ Upstream commit 8bea5ac0fbc5b2103f8779ddff216122e3c2e1ad ] + +Determined empirically, no documentation is available. + +The OLPC XO-1.75 laptop used parent 1, that one being VCTCXO/4 (65MHz), but +thought it's a VCTCXO/2 (130MHz). The mmp2 timer driver, not knowing +what is going on, ended up just dividing the rate as of +commit f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock")' + +Link: https://lore.kernel.org/r/20191218190454.420358-3-lkundrak@v3.sk +Signed-off-by: Lubomir Rintel +Acked-by: Stephen Boyd +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + drivers/clk/mmp/clk-of-mmp2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c +index 8b45cb2caed1b..60db6531996eb 100644 +--- a/drivers/clk/mmp/clk-of-mmp2.c ++++ b/drivers/clk/mmp/clk-of-mmp2.c +@@ -134,7 +134,7 @@ static DEFINE_SPINLOCK(ssp3_lock); + static const char *ssp_parent_names[] = {"vctcxo_4", "vctcxo_2", "vctcxo", "pll1_16"}; + + static DEFINE_SPINLOCK(timer_lock); +-static const char *timer_parent_names[] = {"clk32", "vctcxo_2", "vctcxo_4", "vctcxo"}; ++static const char *timer_parent_names[] = {"clk32", "vctcxo_4", "vctcxo_2", "vctcxo"}; + + static DEFINE_SPINLOCK(reset_lock); + +-- +2.20.1 + diff --git a/queue-4.4/input-aiptek-use-descriptors-of-current-altsetting.patch b/queue-4.4/input-aiptek-use-descriptors-of-current-altsetting.patch new file mode 100644 index 00000000000..350cc155a0b --- /dev/null +++ b/queue-4.4/input-aiptek-use-descriptors-of-current-altsetting.patch @@ -0,0 +1,38 @@ +From dae56fbae0a4890e171d65de99deec7e9090bb5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2020 11:59:52 -0800 +Subject: Input: aiptek - use descriptors of current altsetting + +From: Johan Hovold + +[ Upstream commit cfa4f6a99fb183742cace65ec551b444852b8ef6 ] + +Make sure to always use the descriptors of the current alternate setting +to avoid future issues when accessing fields that may differ between +settings. + +Signed-off-by: Johan Hovold +Acked-by: Vladis Dronov +Link: https://lore.kernel.org/r/20191210113737.4016-4-johan@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/tablet/aiptek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c +index 40a166773c1b4..142f34a0a3cb6 100644 +--- a/drivers/input/tablet/aiptek.c ++++ b/drivers/input/tablet/aiptek.c +@@ -1731,7 +1731,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) + aiptek->inputdev = inputdev; + aiptek->usbdev = usbdev; + aiptek->intf = intf; +- aiptek->ifnum = intf->altsetting[0].desc.bInterfaceNumber; ++ aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber; + aiptek->inDelay = 0; + aiptek->endDelay = 0; + aiptek->previousJitterable = 0; +-- +2.20.1 + diff --git a/queue-4.4/ixgbe-fix-calculation-of-queue-with-vfs-and-flow-dir.patch b/queue-4.4/ixgbe-fix-calculation-of-queue-with-vfs-and-flow-dir.patch new file mode 100644 index 00000000000..ec8eac1c019 --- /dev/null +++ b/queue-4.4/ixgbe-fix-calculation-of-queue-with-vfs-and-flow-dir.patch @@ -0,0 +1,84 @@ +From 0c86ec65ab8c3c4dbb8418f7bf1c3f68e2445a93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2019 17:03:55 +0800 +Subject: ixgbe: Fix calculation of queue with VFs and flow director on + interface flap + +From: Cambda Zhu + +[ Upstream commit 4fad78ad6422d9bca62135bbed8b6abc4cbb85b8 ] + +This patch fixes the calculation of queue when we restore flow director +filters after resetting adapter. In ixgbe_fdir_filter_restore(), filter's +vf may be zero which makes the queue outside of the rx_ring array. + +The calculation is changed to the same as ixgbe_add_ethtool_fdir_entry(). + +Signed-off-by: Cambda Zhu +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 37 ++++++++++++++----- + 1 file changed, 27 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 4521181aa0ed9..23fb344f9e1cf 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -4532,7 +4532,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter) + struct ixgbe_hw *hw = &adapter->hw; + struct hlist_node *node2; + struct ixgbe_fdir_filter *filter; +- u64 action; ++ u8 queue; + + spin_lock(&adapter->fdir_perfect_lock); + +@@ -4541,17 +4541,34 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter) + + hlist_for_each_entry_safe(filter, node2, + &adapter->fdir_filter_list, fdir_node) { +- action = filter->action; +- if (action != IXGBE_FDIR_DROP_QUEUE && action != 0) +- action = +- (action >> ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF) - 1; ++ if (filter->action == IXGBE_FDIR_DROP_QUEUE) { ++ queue = IXGBE_FDIR_DROP_QUEUE; ++ } else { ++ u32 ring = ethtool_get_flow_spec_ring(filter->action); ++ u8 vf = ethtool_get_flow_spec_ring_vf(filter->action); ++ ++ if (!vf && (ring >= adapter->num_rx_queues)) { ++ e_err(drv, "FDIR restore failed without VF, ring: %u\n", ++ ring); ++ continue; ++ } else if (vf && ++ ((vf > adapter->num_vfs) || ++ ring >= adapter->num_rx_queues_per_pool)) { ++ e_err(drv, "FDIR restore failed with VF, vf: %hhu, ring: %u\n", ++ vf, ring); ++ continue; ++ } ++ ++ /* Map the ring onto the absolute queue index */ ++ if (!vf) ++ queue = adapter->rx_ring[ring]->reg_idx; ++ else ++ queue = ((vf - 1) * ++ adapter->num_rx_queues_per_pool) + ring; ++ } + + ixgbe_fdir_write_perfect_filter_82599(hw, +- &filter->filter, +- filter->sw_idx, +- (action == IXGBE_FDIR_DROP_QUEUE) ? +- IXGBE_FDIR_DROP_QUEUE : +- adapter->rx_ring[action]->reg_idx); ++ &filter->filter, filter->sw_idx, queue); + } + + spin_unlock(&adapter->fdir_perfect_lock); +-- +2.20.1 + diff --git a/queue-4.4/ixgbevf-remove-limit-of-10-entries-for-unicast-filte.patch b/queue-4.4/ixgbevf-remove-limit-of-10-entries-for-unicast-filte.patch new file mode 100644 index 00000000000..b5beeda9713 --- /dev/null +++ b/queue-4.4/ixgbevf-remove-limit-of-10-entries-for-unicast-filte.patch @@ -0,0 +1,42 @@ +From fbd333908332ba6caa090d532f6d2d6eda4b3b3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2019 15:24:52 +0100 +Subject: ixgbevf: Remove limit of 10 entries for unicast filter list + +From: Radoslaw Tyl + +[ Upstream commit aa604651d523b1493988d0bf6710339f3ee60272 ] + +Currently, though the FDB entry is added to VF, it does not appear in +RAR filters. VF driver only allows to add 10 entries. Attempting to add +another causes an error. This patch removes limitation and allows use of +all free RAR entries for the FDB if needed. + +Fixes: 46ec20ff7d ("ixgbevf: Add macvlan support in the set rx mode op") +Signed-off-by: Radoslaw Tyl +Acked-by: Paul Menzel +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +index 723bda33472a7..0fa94ebf0411b 100644 +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -1861,11 +1861,6 @@ static int ixgbevf_write_uc_addr_list(struct net_device *netdev) + struct ixgbe_hw *hw = &adapter->hw; + int count = 0; + +- if ((netdev_uc_count(netdev)) > 10) { +- pr_err("Too many unicast filters - No Space\n"); +- return -ENOSPC; +- } +- + if (!netdev_uc_empty(netdev)) { + struct netdev_hw_addr *ha; + +-- +2.20.1 + diff --git a/queue-4.4/l2t_seq_next-should-increase-position-index.patch b/queue-4.4/l2t_seq_next-should-increase-position-index.patch new file mode 100644 index 00000000000..47af30c82af --- /dev/null +++ b/queue-4.4/l2t_seq_next-should-increase-position-index.patch @@ -0,0 +1,37 @@ +From 4723301ac524dd4f866f64ac697769672265d15e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2020 10:11:13 +0300 +Subject: l2t_seq_next should increase position index + +From: Vasily Averin + +[ Upstream commit 66018a102f7756cf72db4d2704e1b93969d9d332 ] + +if seq_file .next fuction does not change position index, +read after some lseek can generate unexpected output. + +https://bugzilla.kernel.org/show_bug.cgi?id=206283 +Signed-off-by: Vasily Averin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/l2t.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c +index ac27898c6ab0b..e7bdaad6ed0f7 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c +@@ -604,8 +604,7 @@ static void *l2t_seq_start(struct seq_file *seq, loff_t *pos) + static void *l2t_seq_next(struct seq_file *seq, void *v, loff_t *pos) + { + v = l2t_get_idx(seq, *pos); +- if (v) +- ++*pos; ++ ++(*pos); + return v; + } + +-- +2.20.1 + diff --git a/queue-4.4/net-fix-skb-csum-update-in-inet_proto_csum_replace16.patch b/queue-4.4/net-fix-skb-csum-update-in-inet_proto_csum_replace16.patch new file mode 100644 index 00000000000..9eda0819763 --- /dev/null +++ b/queue-4.4/net-fix-skb-csum-update-in-inet_proto_csum_replace16.patch @@ -0,0 +1,73 @@ +From b468573cd122ef095fa15fdc2753fdeef42f1f28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2020 12:33:28 -0800 +Subject: net: Fix skb->csum update in inet_proto_csum_replace16(). + +From: Praveen Chaudhary + +[ Upstream commit 189c9b1e94539b11c80636bc13e9cf47529e7bba ] + +skb->csum is updated incorrectly, when manipulation for +NF_NAT_MANIP_SRC\DST is done on IPV6 packet. + +Fix: +There is no need to update skb->csum in inet_proto_csum_replace16(), +because update in two fields a.) IPv6 src/dst address and b.) L4 header +checksum cancels each other for skb->csum calculation. Whereas +inet_proto_csum_replace4 function needs to update skb->csum, because +update in 3 fields a.) IPv4 src/dst address, b.) IPv4 Header checksum +and c.) L4 header checksum results in same diff as L4 Header checksum +for skb->csum calculation. + +[ pablo@netfilter.org: a few comestic documentation edits ] +Signed-off-by: Praveen Chaudhary +Signed-off-by: Zhenggen Xu +Signed-off-by: Andy Stracner +Reviewed-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/core/utils.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/net/core/utils.c b/net/core/utils.c +index 3d17ca8b47441..13eb3552de078 100644 +--- a/net/core/utils.c ++++ b/net/core/utils.c +@@ -316,6 +316,23 @@ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb, + } + EXPORT_SYMBOL(inet_proto_csum_replace4); + ++/** ++ * inet_proto_csum_replace16 - update layer 4 header checksum field ++ * @sum: Layer 4 header checksum field ++ * @skb: sk_buff for the packet ++ * @from: old IPv6 address ++ * @to: new IPv6 address ++ * @pseudohdr: True if layer 4 header checksum includes pseudoheader ++ * ++ * Update layer 4 header as per the update in IPv6 src/dst address. ++ * ++ * There is no need to update skb->csum in this function, because update in two ++ * fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other ++ * for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to ++ * update skb->csum, because update in 3 fields a.) IPv4 src/dst address, ++ * b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as ++ * L4 Header checksum for skb->csum calculation. ++ */ + void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb, + const __be32 *from, const __be32 *to, + bool pseudohdr) +@@ -327,9 +344,6 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb, + if (skb->ip_summed != CHECKSUM_PARTIAL) { + *sum = csum_fold(csum_partial(diff, sizeof(diff), + ~csum_unfold(*sum))); +- if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr) +- skb->csum = ~csum_partial(diff, sizeof(diff), +- ~skb->csum); + } else if (pseudohdr) + *sum = ~csum_fold(csum_partial(diff, sizeof(diff), + csum_unfold(*sum))); +-- +2.20.1 + diff --git a/queue-4.4/net-fsl-treat-fsl-erratum-a011043.patch b/queue-4.4/net-fsl-treat-fsl-erratum-a011043.patch new file mode 100644 index 00000000000..da5f66d5f97 --- /dev/null +++ b/queue-4.4/net-fsl-treat-fsl-erratum-a011043.patch @@ -0,0 +1,59 @@ +From 7496f7b83d195e6dc4be4ed9d6056b1061ed1daf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2020 15:20:29 +0200 +Subject: net/fsl: treat fsl,erratum-a011043 + +From: Madalin Bucur + +[ Upstream commit 1d3ca681b9d9575ccf696ebc2840a1ebb1fd4074 ] + +When fsl,erratum-a011043 is set, adjust for erratum A011043: +MDIO reads to internal PCS registers may result in having +the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no +error and read data (MDIO_DATA[MDIO_DATA]) is correct. +Software may get false read error when reading internal +PCS registers through MDIO. As a workaround, all internal +MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit. + +Signed-off-by: Madalin Bucur +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/xgmac_mdio.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/xgmac_mdio.c b/drivers/net/ethernet/freescale/xgmac_mdio.c +index 7b8fe866f6038..a15b4a97c172d 100644 +--- a/drivers/net/ethernet/freescale/xgmac_mdio.c ++++ b/drivers/net/ethernet/freescale/xgmac_mdio.c +@@ -49,6 +49,7 @@ struct tgec_mdio_controller { + struct mdio_fsl_priv { + struct tgec_mdio_controller __iomem *mdio_base; + bool is_little_endian; ++ bool has_a011043; + }; + + static u32 xgmac_read32(void __iomem *regs, +@@ -226,7 +227,8 @@ static int xgmac_mdio_read(struct mii_bus *bus, int phy_id, int regnum) + return ret; + + /* Return all Fs if nothing was there */ +- if (xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) { ++ if ((xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) && ++ !priv->has_a011043) { + dev_err(&bus->dev, + "Error while reading PHY%d reg at %d.%hhu\n", + phy_id, dev_addr, regnum); +@@ -277,6 +279,9 @@ static int xgmac_mdio_probe(struct platform_device *pdev) + else + priv->is_little_endian = false; + ++ priv->has_a011043 = of_property_read_bool(pdev->dev.of_node, ++ "fsl,erratum-a011043"); ++ + ret = of_mdiobus_register(bus, np); + if (ret) { + dev_err(&pdev->dev, "cannot register MDIO bus\n"); +-- +2.20.1 + diff --git a/queue-4.4/net-sonic-add-mutual-exclusion-for-accessing-shared-.patch b/queue-4.4/net-sonic-add-mutual-exclusion-for-accessing-shared-.patch new file mode 100644 index 00000000000..5d83e90bdae --- /dev/null +++ b/queue-4.4/net-sonic-add-mutual-exclusion-for-accessing-shared-.patch @@ -0,0 +1,158 @@ +From 5a444b2ac4166581f8b4ea5c9949e31f17dcbbcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2020 09:07:26 +1100 +Subject: net/sonic: Add mutual exclusion for accessing shared state + +From: Finn Thain + +[ Upstream commit 865ad2f2201dc18685ba2686f13217f8b3a9c52c ] + +The netif_stop_queue() call in sonic_send_packet() races with the +netif_wake_queue() call in sonic_interrupt(). This causes issues +like "NETDEV WATCHDOG: eth0 (macsonic): transmit queue 0 timed out". +Fix this by disabling interrupts when accessing tx_skb[] and next_tx. +Update a comment to clarify the synchronization properties. + +Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/natsemi/sonic.c | 49 ++++++++++++++++++++-------- + drivers/net/ethernet/natsemi/sonic.h | 1 + + 2 files changed, 36 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c +index 6679005782499..0374e834f865e 100644 +--- a/drivers/net/ethernet/natsemi/sonic.c ++++ b/drivers/net/ethernet/natsemi/sonic.c +@@ -50,6 +50,8 @@ static int sonic_open(struct net_device *dev) + if (sonic_debug > 2) + printk("sonic_open: initializing sonic driver.\n"); + ++ spin_lock_init(&lp->lock); ++ + for (i = 0; i < SONIC_NUM_RRS; i++) { + struct sk_buff *skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2); + if (skb == NULL) { +@@ -194,8 +196,6 @@ static void sonic_tx_timeout(struct net_device *dev) + * wake the tx queue + * Concurrently with all of this, the SONIC is potentially writing to + * the status flags of the TDs. +- * Until some mutual exclusion is added, this code will not work with SMP. However, +- * MIPS Jazz machines and m68k Macs were all uni-processor machines. + */ + + static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) +@@ -203,7 +203,8 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + struct sonic_local *lp = netdev_priv(dev); + dma_addr_t laddr; + int length; +- int entry = lp->next_tx; ++ int entry; ++ unsigned long flags; + + if (sonic_debug > 2) + printk("sonic_send_packet: skb=%p, dev=%p\n", skb, dev); +@@ -226,6 +227,10 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_OK; + } + ++ spin_lock_irqsave(&lp->lock, flags); ++ ++ entry = lp->next_tx; ++ + sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */ + sonic_tda_put(dev, entry, SONIC_TD_FRAG_COUNT, 1); /* single fragment */ + sonic_tda_put(dev, entry, SONIC_TD_PKTSIZE, length); /* length of packet */ +@@ -235,10 +240,6 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + sonic_tda_put(dev, entry, SONIC_TD_LINK, + sonic_tda_get(dev, entry, SONIC_TD_LINK) | SONIC_EOL); + +- /* +- * Must set tx_skb[entry] only after clearing status, and +- * before clearing EOL and before stopping queue +- */ + wmb(); + lp->tx_len[entry] = length; + lp->tx_laddr[entry] = laddr; +@@ -263,6 +264,8 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + + SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP); + ++ spin_unlock_irqrestore(&lp->lock, flags); ++ + return NETDEV_TX_OK; + } + +@@ -275,9 +278,21 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) + struct net_device *dev = dev_id; + struct sonic_local *lp = netdev_priv(dev); + int status; ++ unsigned long flags; ++ ++ /* The lock has two purposes. Firstly, it synchronizes sonic_interrupt() ++ * with sonic_send_packet() so that the two functions can share state. ++ * Secondly, it makes sonic_interrupt() re-entrant, as that is required ++ * by macsonic which must use two IRQs with different priority levels. ++ */ ++ spin_lock_irqsave(&lp->lock, flags); ++ ++ status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT; ++ if (!status) { ++ spin_unlock_irqrestore(&lp->lock, flags); + +- if (!(status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT)) + return IRQ_NONE; ++ } + + do { + if (status & SONIC_INT_PKTRX) { +@@ -292,11 +307,12 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) + int td_status; + int freed_some = 0; + +- /* At this point, cur_tx is the index of a TD that is one of: +- * unallocated/freed (status set & tx_skb[entry] clear) +- * allocated and sent (status set & tx_skb[entry] set ) +- * allocated and not yet sent (status clear & tx_skb[entry] set ) +- * still being allocated by sonic_send_packet (status clear & tx_skb[entry] clear) ++ /* The state of a Transmit Descriptor may be inferred ++ * from { tx_skb[entry], td_status } as follows. ++ * { clear, clear } => the TD has never been used ++ * { set, clear } => the TD was handed to SONIC ++ * { set, set } => the TD was handed back ++ * { clear, set } => the TD is available for re-use + */ + + if (sonic_debug > 2) +@@ -398,7 +414,12 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) + /* load CAM done */ + if (status & SONIC_INT_LCD) + SONIC_WRITE(SONIC_ISR, SONIC_INT_LCD); /* clear the interrupt */ +- } while((status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT)); ++ ++ status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT; ++ } while (status); ++ ++ spin_unlock_irqrestore(&lp->lock, flags); ++ + return IRQ_HANDLED; + } + +diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h +index 07091dd27e5df..1fd61d7f79bcb 100644 +--- a/drivers/net/ethernet/natsemi/sonic.h ++++ b/drivers/net/ethernet/natsemi/sonic.h +@@ -320,6 +320,7 @@ struct sonic_local { + unsigned int next_tx; /* next free TD */ + struct device *device; /* generic device */ + struct net_device_stats stats; ++ spinlock_t lock; + }; + + #define TX_TIMEOUT (3 * HZ) +-- +2.20.1 + diff --git a/queue-4.4/net-sonic-fix-receive-buffer-handling.patch b/queue-4.4/net-sonic-fix-receive-buffer-handling.patch new file mode 100644 index 00000000000..a3b1f7c8972 --- /dev/null +++ b/queue-4.4/net-sonic-fix-receive-buffer-handling.patch @@ -0,0 +1,116 @@ +From 28e3fa8b211077438d60febed7a0558943afc958 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2020 09:07:26 +1100 +Subject: net/sonic: Fix receive buffer handling + +From: Finn Thain + +[ Upstream commit 9e311820f67e740f4fb8dcb82b4c4b5b05bdd1a5 ] + +The SONIC can sometimes advance its rx buffer pointer (RRP register) +without advancing its rx descriptor pointer (CRDA register). As a result +the index of the current rx descriptor may not equal that of the current +rx buffer. The driver mistakenly assumes that they are always equal. +This assumption leads to incorrect packet lengths and possible packet +duplication. Avoid this by calling a new function to locate the buffer +corresponding to a given descriptor. + +Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/natsemi/sonic.c | 35 ++++++++++++++++++++++++---- + drivers/net/ethernet/natsemi/sonic.h | 5 ++-- + 2 files changed, 33 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c +index 0374e834f865e..21766ec12ef20 100644 +--- a/drivers/net/ethernet/natsemi/sonic.c ++++ b/drivers/net/ethernet/natsemi/sonic.c +@@ -423,6 +423,21 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) + return IRQ_HANDLED; + } + ++/* Return the array index corresponding to a given Receive Buffer pointer. */ ++static int index_from_addr(struct sonic_local *lp, dma_addr_t addr, ++ unsigned int last) ++{ ++ unsigned int i = last; ++ ++ do { ++ i = (i + 1) & SONIC_RRS_MASK; ++ if (addr == lp->rx_laddr[i]) ++ return i; ++ } while (i != last); ++ ++ return -ENOENT; ++} ++ + /* + * We have a good packet(s), pass it/them up the network stack. + */ +@@ -442,6 +457,16 @@ static void sonic_rx(struct net_device *dev) + + status = sonic_rda_get(dev, entry, SONIC_RD_STATUS); + if (status & SONIC_RCR_PRX) { ++ u32 addr = (sonic_rda_get(dev, entry, ++ SONIC_RD_PKTPTR_H) << 16) | ++ sonic_rda_get(dev, entry, SONIC_RD_PKTPTR_L); ++ int i = index_from_addr(lp, addr, entry); ++ ++ if (i < 0) { ++ WARN_ONCE(1, "failed to find buffer!\n"); ++ break; ++ } ++ + /* Malloc up new buffer. */ + new_skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2); + if (new_skb == NULL) { +@@ -463,7 +488,7 @@ static void sonic_rx(struct net_device *dev) + + /* now we have a new skb to replace it, pass the used one up the stack */ + dma_unmap_single(lp->device, lp->rx_laddr[entry], SONIC_RBSIZE, DMA_FROM_DEVICE); +- used_skb = lp->rx_skb[entry]; ++ used_skb = lp->rx_skb[i]; + pkt_len = sonic_rda_get(dev, entry, SONIC_RD_PKTLEN); + skb_trim(used_skb, pkt_len); + used_skb->protocol = eth_type_trans(used_skb, dev); +@@ -472,13 +497,13 @@ static void sonic_rx(struct net_device *dev) + lp->stats.rx_bytes += pkt_len; + + /* and insert the new skb */ +- lp->rx_laddr[entry] = new_laddr; +- lp->rx_skb[entry] = new_skb; ++ lp->rx_laddr[i] = new_laddr; ++ lp->rx_skb[i] = new_skb; + + bufadr_l = (unsigned long)new_laddr & 0xffff; + bufadr_h = (unsigned long)new_laddr >> 16; +- sonic_rra_put(dev, entry, SONIC_RR_BUFADR_L, bufadr_l); +- sonic_rra_put(dev, entry, SONIC_RR_BUFADR_H, bufadr_h); ++ sonic_rra_put(dev, i, SONIC_RR_BUFADR_L, bufadr_l); ++ sonic_rra_put(dev, i, SONIC_RR_BUFADR_H, bufadr_h); + } else { + /* This should only happen, if we enable accepting broken packets. */ + lp->stats.rx_errors++; +diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h +index a009a99c0e544..d9f8ceb5353a4 100644 +--- a/drivers/net/ethernet/natsemi/sonic.h ++++ b/drivers/net/ethernet/natsemi/sonic.h +@@ -273,8 +273,9 @@ + #define SONIC_NUM_RDS SONIC_NUM_RRS /* number of receive descriptors */ + #define SONIC_NUM_TDS 16 /* number of transmit descriptors */ + +-#define SONIC_RDS_MASK (SONIC_NUM_RDS-1) +-#define SONIC_TDS_MASK (SONIC_NUM_TDS-1) ++#define SONIC_RRS_MASK (SONIC_NUM_RRS - 1) ++#define SONIC_RDS_MASK (SONIC_NUM_RDS - 1) ++#define SONIC_TDS_MASK (SONIC_NUM_TDS - 1) + + #define SONIC_RBSIZE 1520 /* size of one resource buffer */ + +-- +2.20.1 + diff --git a/queue-4.4/net-sonic-quiesce-sonic-before-re-initializing-descr.patch b/queue-4.4/net-sonic-quiesce-sonic-before-re-initializing-descr.patch new file mode 100644 index 00000000000..054b880acab --- /dev/null +++ b/queue-4.4/net-sonic-quiesce-sonic-before-re-initializing-descr.patch @@ -0,0 +1,97 @@ +From 988ed4ce5e6e632e179decd6282af4eeaf81ae7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2020 09:07:26 +1100 +Subject: net/sonic: Quiesce SONIC before re-initializing descriptor memory + +From: Finn Thain + +[ Upstream commit 3f4b7e6a2be982fd8820a2b54d46dd9c351db899 ] + +Make sure the SONIC's DMA engine is idle before altering the transmit +and receive descriptors. Add a helper for this as it will be needed +again. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/natsemi/sonic.c | 25 +++++++++++++++++++++++++ + drivers/net/ethernet/natsemi/sonic.h | 3 +++ + 2 files changed, 28 insertions(+) + +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c +index 21766ec12ef20..712be59251f51 100644 +--- a/drivers/net/ethernet/natsemi/sonic.c ++++ b/drivers/net/ethernet/natsemi/sonic.c +@@ -103,6 +103,24 @@ static int sonic_open(struct net_device *dev) + return 0; + } + ++/* Wait for the SONIC to become idle. */ ++static void sonic_quiesce(struct net_device *dev, u16 mask) ++{ ++ struct sonic_local * __maybe_unused lp = netdev_priv(dev); ++ int i; ++ u16 bits; ++ ++ for (i = 0; i < 1000; ++i) { ++ bits = SONIC_READ(SONIC_CMD) & mask; ++ if (!bits) ++ return; ++ if (irqs_disabled() || in_interrupt()) ++ udelay(20); ++ else ++ usleep_range(100, 200); ++ } ++ WARN_ONCE(1, "command deadline expired! 0x%04x\n", bits); ++} + + /* + * Close the SONIC device +@@ -120,6 +138,9 @@ static int sonic_close(struct net_device *dev) + /* + * stop the SONIC, disable interrupts + */ ++ SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS); ++ sonic_quiesce(dev, SONIC_CR_ALL); ++ + SONIC_WRITE(SONIC_IMR, 0); + SONIC_WRITE(SONIC_ISR, 0x7fff); + SONIC_WRITE(SONIC_CMD, SONIC_CR_RST); +@@ -159,6 +180,9 @@ static void sonic_tx_timeout(struct net_device *dev) + * put the Sonic into software-reset mode and + * disable all interrupts before releasing DMA buffers + */ ++ SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS); ++ sonic_quiesce(dev, SONIC_CR_ALL); ++ + SONIC_WRITE(SONIC_IMR, 0); + SONIC_WRITE(SONIC_ISR, 0x7fff); + SONIC_WRITE(SONIC_CMD, SONIC_CR_RST); +@@ -638,6 +662,7 @@ static int sonic_init(struct net_device *dev) + */ + SONIC_WRITE(SONIC_CMD, 0); + SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS); ++ sonic_quiesce(dev, SONIC_CR_ALL); + + /* + * initialize the receive resource area +diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h +index d9f8ceb5353a4..7dcf913d7395a 100644 +--- a/drivers/net/ethernet/natsemi/sonic.h ++++ b/drivers/net/ethernet/natsemi/sonic.h +@@ -109,6 +109,9 @@ + #define SONIC_CR_TXP 0x0002 + #define SONIC_CR_HTX 0x0001 + ++#define SONIC_CR_ALL (SONIC_CR_LCAM | SONIC_CR_RRRA | \ ++ SONIC_CR_RXEN | SONIC_CR_TXP) ++ + /* + * SONIC data configuration bits + */ +-- +2.20.1 + diff --git a/queue-4.4/net-sonic-use-mmio-accessors.patch b/queue-4.4/net-sonic-use-mmio-accessors.patch new file mode 100644 index 00000000000..8876644cac5 --- /dev/null +++ b/queue-4.4/net-sonic-use-mmio-accessors.patch @@ -0,0 +1,69 @@ +From 721c94231604bb0f2b7bb08e39dfd205d7bb86b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2020 09:07:26 +1100 +Subject: net/sonic: Use MMIO accessors + +From: Finn Thain + +[ Upstream commit e3885f576196ddfc670b3d53e745de96ffcb49ab ] + +The driver accesses descriptor memory which is simultaneously accessed by +the chip, so the compiler must not be allowed to re-order CPU accesses. +sonic_buf_get() used 'volatile' to prevent that. sonic_buf_put() should +have done so too but was overlooked. + +Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/natsemi/sonic.h | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h +index 1fd61d7f79bcb..a009a99c0e544 100644 +--- a/drivers/net/ethernet/natsemi/sonic.h ++++ b/drivers/net/ethernet/natsemi/sonic.h +@@ -342,30 +342,30 @@ static void sonic_tx_timeout(struct net_device *dev); + as far as we can tell. */ + /* OpenBSD calls this "SWO". I'd like to think that sonic_buf_put() + is a much better name. */ +-static inline void sonic_buf_put(void* base, int bitmode, ++static inline void sonic_buf_put(u16 *base, int bitmode, + int offset, __u16 val) + { + if (bitmode) + #ifdef __BIG_ENDIAN +- ((__u16 *) base + (offset*2))[1] = val; ++ __raw_writew(val, base + (offset * 2) + 1); + #else +- ((__u16 *) base + (offset*2))[0] = val; ++ __raw_writew(val, base + (offset * 2) + 0); + #endif + else +- ((__u16 *) base)[offset] = val; ++ __raw_writew(val, base + (offset * 1) + 0); + } + +-static inline __u16 sonic_buf_get(void* base, int bitmode, ++static inline __u16 sonic_buf_get(u16 *base, int bitmode, + int offset) + { + if (bitmode) + #ifdef __BIG_ENDIAN +- return ((volatile __u16 *) base + (offset*2))[1]; ++ return __raw_readw(base + (offset * 2) + 1); + #else +- return ((volatile __u16 *) base + (offset*2))[0]; ++ return __raw_readw(base + (offset * 2) + 0); + #endif + else +- return ((volatile __u16 *) base)[offset]; ++ return __raw_readw(base + (offset * 1) + 0); + } + + /* Inlines that you should actually use for reading/writing DMA buffers */ +-- +2.20.1 + diff --git a/queue-4.4/qlcnic-fix-cpu-soft-lockup-while-collecting-firmware.patch b/queue-4.4/qlcnic-fix-cpu-soft-lockup-while-collecting-firmware.patch new file mode 100644 index 00000000000..dbde48ec56e --- /dev/null +++ b/queue-4.4/qlcnic-fix-cpu-soft-lockup-while-collecting-firmware.patch @@ -0,0 +1,62 @@ +From 0b507846d6cb2259bcb6759a28b9b8bdaca44770 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2020 01:43:38 -0800 +Subject: qlcnic: Fix CPU soft lockup while collecting firmware dump + +From: Manish Chopra + +[ Upstream commit 22e984493a41bf8081f13d9ed84def3ca8cfd427 ] + +Driver while collecting firmware dump takes longer time to +collect/process some of the firmware dump entries/memories. +Bigger capture masks makes it worse as it results in larger +amount of data being collected and results in CPU soft lockup. +Place cond_resched() in some of the driver flows that are +expectedly time consuming to relinquish the CPU to avoid CPU +soft lockup panic. + +Signed-off-by: Shahed Shaikh +Tested-by: Yonggen Xu +Signed-off-by: Manish Chopra +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 1 + + drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +index bf892160dd5f0..26263a192a77e 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +@@ -2047,6 +2047,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev, + break; + } + entry += p_hdr->size; ++ cond_resched(); + } + p_dev->ahw->reset.seq_index = index; + } +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +index cda9e604a95f6..e5ea8e972b915 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +@@ -703,6 +703,7 @@ static u32 qlcnic_read_memory_test_agent(struct qlcnic_adapter *adapter, + addr += 16; + reg_read -= 16; + ret += 16; ++ cond_resched(); + } + out: + mutex_unlock(&adapter->ahw->mem_lock); +@@ -1383,6 +1384,7 @@ int qlcnic_dump_fw(struct qlcnic_adapter *adapter) + buf_offset += entry->hdr.cap_size; + entry_offset += entry->hdr.offset; + buffer = fw_dump->data + buf_offset; ++ cond_resched(); + } + + fw_dump->clr = 1; +-- +2.20.1 + diff --git a/queue-4.4/r8152-get-default-setting-of-wol-before-initializing.patch b/queue-4.4/r8152-get-default-setting-of-wol-before-initializing.patch new file mode 100644 index 00000000000..5f4caee91f5 --- /dev/null +++ b/queue-4.4/r8152-get-default-setting-of-wol-before-initializing.patch @@ -0,0 +1,49 @@ +From 3c260bbee386c308c3e5745fef50f4a586757b87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2020 16:02:07 +0800 +Subject: r8152: get default setting of WOL before initializing + +From: Hayes Wang + +[ Upstream commit 9583a3638dc07cc1878f41265e85ed497f72efcb ] + +Initailization would reset runtime suspend by tp->saved_wolopts, so +the tp->saved_wolopts should be set before initializing. + +Signed-off-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index db8b489b0513c..23e299c86b814 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -4313,6 +4313,11 @@ static int rtl8152_probe(struct usb_interface *intf, + + intf->needs_remote_wakeup = 1; + ++ if (!rtl_can_wakeup(tp)) ++ __rtl_set_wol(tp, 0); ++ else ++ tp->saved_wolopts = __rtl_get_wol(tp); ++ + tp->rtl_ops.init(tp); + set_ethernet_addr(tp); + +@@ -4325,10 +4330,6 @@ static int rtl8152_probe(struct usb_interface *intf, + goto out1; + } + +- if (!rtl_can_wakeup(tp)) +- __rtl_set_wol(tp, 0); +- +- tp->saved_wolopts = __rtl_get_wol(tp); + if (tp->saved_wolopts) + device_set_wakeup_enable(&udev->dev, true); + else +-- +2.20.1 + diff --git a/queue-4.4/scsi-fnic-do-not-queue-commands-during-fwreset.patch b/queue-4.4/scsi-fnic-do-not-queue-commands-during-fwreset.patch new file mode 100644 index 00000000000..afb2ebbbcce --- /dev/null +++ b/queue-4.4/scsi-fnic-do-not-queue-commands-during-fwreset.patch @@ -0,0 +1,48 @@ +From 2a6c3c5921907259f4eaa5920477ca2f033ab543 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2020 11:20:53 +0100 +Subject: scsi: fnic: do not queue commands during fwreset + +From: Hannes Reinecke + +[ Upstream commit 0e2209629fec427ba75a6351486153a9feddd36b ] + +When a link is going down the driver will be calling fnic_cleanup_io(), +which will traverse all commands and calling 'done' for each found command. +While the traversal is handled under the host_lock, calling 'done' happens +after the host_lock is being dropped. + +As fnic_queuecommand_lck() is being called with the host_lock held, it +might well be that it will pick the command being selected for abortion +from the above routine and enqueue it for sending, but then 'done' is being +called on that very command from the above routine. + +Which of course confuses the hell out of the scsi midlayer. + +So fix this by not queueing commands when fnic_cleanup_io is active. + +Link: https://lore.kernel.org/r/20200116102053.62755-1-hare@suse.de +Signed-off-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/fnic/fnic_scsi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c +index 82e4bc8c11c57..fc6706b12ac76 100644 +--- a/drivers/scsi/fnic/fnic_scsi.c ++++ b/drivers/scsi/fnic/fnic_scsi.c +@@ -446,6 +446,9 @@ static int fnic_queuecommand_lck(struct scsi_cmnd *sc, void (*done)(struct scsi_ + if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_IO_BLOCKED))) + return SCSI_MLQUEUE_HOST_BUSY; + ++ if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_FWRESET))) ++ return SCSI_MLQUEUE_HOST_BUSY; ++ + rport = starget_to_rport(scsi_target(sc->device)); + ret = fc_remote_port_chkready(rport); + if (ret) { +-- +2.20.1 + diff --git a/queue-4.4/seq_tab_next-should-increase-position-index.patch b/queue-4.4/seq_tab_next-should-increase-position-index.patch new file mode 100644 index 00000000000..21458759f83 --- /dev/null +++ b/queue-4.4/seq_tab_next-should-increase-position-index.patch @@ -0,0 +1,37 @@ +From 6a4d0092493a66063b2789de6ba2f4bc0c9e9899 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2020 10:11:08 +0300 +Subject: seq_tab_next() should increase position index + +From: Vasily Averin + +[ Upstream commit 70a87287c821e9721b62463777f55ba588ac4623 ] + +if seq_file .next fuction does not change position index, +read after some lseek can generate unexpected output. + +https://bugzilla.kernel.org/show_bug.cgi?id=206283 +Signed-off-by: Vasily Averin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +index 129d6095749a4..54d5e53e94af2 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +@@ -66,8 +66,7 @@ static void *seq_tab_start(struct seq_file *seq, loff_t *pos) + static void *seq_tab_next(struct seq_file *seq, void *v, loff_t *pos) + { + v = seq_tab_get_idx(seq->private, *pos + 1); +- if (v) +- ++*pos; ++ ++(*pos); + return v; + } + +-- +2.20.1 + diff --git a/queue-4.4/series b/queue-4.4/series index 12a6c843b7b..bceee284020 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -31,3 +31,23 @@ media-dvb-usb-dvb-usb-urb.c-initialize-actlen-to-0.patch ttyprintk-fix-a-potential-deadlock-in-interrupt-context-issue.patch usb-dwc3-turn-off-vbus-when-leaving-host-mode.patch media-si470x-i2c-move-free-past-last-use-of-radio.patch +clk-mmp2-fix-the-order-of-timer-mux-parents.patch +ixgbevf-remove-limit-of-10-entries-for-unicast-filte.patch +ixgbe-fix-calculation-of-queue-with-vfs-and-flow-dir.patch +wireless-wext-avoid-gcc-o3-warning.patch +input-aiptek-use-descriptors-of-current-altsetting.patch +vti-6-fix-packet-tx-through-bpf_redirect.patch +scsi-fnic-do-not-queue-commands-during-fwreset.patch +arm-8955-1-virt-relax-arch-timer-version-check-durin.patch +airo-fix-possible-info-leak-in-airooldioctl-siocdevp.patch +airo-add-missing-cap_net_admin-check-in-airooldioctl.patch +r8152-get-default-setting-of-wol-before-initializing.patch +qlcnic-fix-cpu-soft-lockup-while-collecting-firmware.patch +net-fsl-treat-fsl-erratum-a011043.patch +net-sonic-add-mutual-exclusion-for-accessing-shared-.patch +net-sonic-use-mmio-accessors.patch +net-sonic-fix-receive-buffer-handling.patch +net-sonic-quiesce-sonic-before-re-initializing-descr.patch +seq_tab_next-should-increase-position-index.patch +l2t_seq_next-should-increase-position-index.patch +net-fix-skb-csum-update-in-inet_proto_csum_replace16.patch diff --git a/queue-4.4/vti-6-fix-packet-tx-through-bpf_redirect.patch b/queue-4.4/vti-6-fix-packet-tx-through-bpf_redirect.patch new file mode 100644 index 00000000000..6465bb05ee6 --- /dev/null +++ b/queue-4.4/vti-6-fix-packet-tx-through-bpf_redirect.patch @@ -0,0 +1,82 @@ +From b6a97ffa94def387d08ea60c459f8195e4922fcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2020 09:32:46 +0100 +Subject: vti[6]: fix packet tx through bpf_redirect() + +From: Nicolas Dichtel + +[ Upstream commit 95224166a9032ff5d08fca633d37113078ce7d01 ] + +With an ebpf program that redirects packets through a vti[6] interface, +the packets are dropped because no dst is attached. + +This could also be reproduced with an AF_PACKET socket, with the following +python script (vti1 is an ip_vti interface): + + import socket + send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0) + # scapy + # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request') + # raw(p) + req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00' + send_s.sendto(req, ('vti1', 0x800, 0, 0)) + +Signed-off-by: Nicolas Dichtel +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_vti.c | 13 +++++++++++-- + net/ipv6/ip6_vti.c | 13 +++++++++++-- + 2 files changed, 22 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index bbcbbc1cc2cc6..42dbd280dc9be 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -195,8 +195,17 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, + int err; + + if (!dst) { +- dev->stats.tx_carrier_errors++; +- goto tx_error_icmp; ++ struct rtable *rt; ++ ++ fl->u.ip4.flowi4_oif = dev->ifindex; ++ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC; ++ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4); ++ if (IS_ERR(rt)) { ++ dev->stats.tx_carrier_errors++; ++ goto tx_error_icmp; ++ } ++ dst = &rt->dst; ++ skb_dst_set(skb, dst); + } + + dst_hold(dst); +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 51da5987952ce..623963a2d8a68 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -441,8 +441,17 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + int err = -1; + int mtu; + +- if (!dst) +- goto tx_err_link_failure; ++ if (!dst) { ++ fl->u.ip6.flowi6_oif = dev->ifindex; ++ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC; ++ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6); ++ if (dst->error) { ++ dst_release(dst); ++ dst = NULL; ++ goto tx_err_link_failure; ++ } ++ skb_dst_set(skb, dst); ++ } + + dst_hold(dst); + dst = xfrm_lookup(t->net, dst, fl, NULL, 0); +-- +2.20.1 + diff --git a/queue-4.4/wireless-wext-avoid-gcc-o3-warning.patch b/queue-4.4/wireless-wext-avoid-gcc-o3-warning.patch new file mode 100644 index 00000000000..6e342f68b8e --- /dev/null +++ b/queue-4.4/wireless-wext-avoid-gcc-o3-warning.patch @@ -0,0 +1,56 @@ +From 03e49066c40b0ebc05234b9b17a1c6fcb11bae25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2020 21:07:35 +0100 +Subject: wireless: wext: avoid gcc -O3 warning + +From: Arnd Bergmann + +[ Upstream commit e16119655c9e6c4aa5767cd971baa9c491f41b13 ] + +After the introduction of CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3, +the wext code produces a bogus warning: + +In function 'iw_handler_get_iwstats', + inlined from 'ioctl_standard_call' at net/wireless/wext-core.c:1015:9, + inlined from 'wireless_process_ioctl' at net/wireless/wext-core.c:935:10, + inlined from 'wext_ioctl_dispatch.part.8' at net/wireless/wext-core.c:986:8, + inlined from 'wext_handle_ioctl': +net/wireless/wext-core.c:671:3: error: argument 1 null where non-null expected [-Werror=nonnull] + memcpy(extra, stats, sizeof(struct iw_statistics)); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from arch/x86/include/asm/string.h:5, +net/wireless/wext-core.c: In function 'wext_handle_ioctl': +arch/x86/include/asm/string_64.h:14:14: note: in a call to function 'memcpy' declared here + +The problem is that ioctl_standard_call() sometimes calls the handler +with a NULL argument that would cause a problem for iw_handler_get_iwstats. +However, iw_handler_get_iwstats never actually gets called that way. + +Marking that function as noinline avoids the warning and leads +to slightly smaller object code as well. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20200107200741.3588770-1-arnd@arndb.de +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/wext-core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c +index b50ee5d622e14..843d2cf1e6a6c 100644 +--- a/net/wireless/wext-core.c ++++ b/net/wireless/wext-core.c +@@ -656,7 +656,8 @@ struct iw_statistics *get_wireless_stats(struct net_device *dev) + return NULL; + } + +-static int iw_handler_get_iwstats(struct net_device * dev, ++/* noinline to avoid a bogus warning with -O3 */ ++static noinline int iw_handler_get_iwstats(struct net_device * dev, + struct iw_request_info * info, + union iwreq_data * wrqu, + char * extra) +-- +2.20.1 +