From: Greg Kroah-Hartman Date: Sun, 10 Jan 2021 10:42:40 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.4.251~50 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=80f400ecae259065cdeb9af88145e0f5c27a5924;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: atm-idt77252-call-pci_disable_device-on-error-path.patch bareudp-fix-use-of-incorrect-min_headroom-size.patch bareudp-set-netif_f_lltx-flag.patch bnxt_en-check-tqm-rings-for-maximum-supported-value.patch bnxt_en-fix-aer-recovery.patch cdc-ncm-remove-connected-log-message.patch e1000e-bump-up-timeout-to-wait-when-me-un-configures-ulp-mode.patch e1000e-export-s0ix-flags-to-ethtool.patch e1000e-only-run-s0ix-flows-if-shutdown-succeeded.patch erspan-fix-version-1-check-in-gre_parse_header.patch ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch iavf-fix-double-release-of-rtnl_lock.patch ibmvnic-continue-fatal-error-reset-after-passive-init.patch ibmvnic-fix-login-buffer-memory-leak.patch ibmvnic-fix-null-pointer-dereference.patch ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch net-dcb-validate-netlink-message-in-dcb-handler.patch net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch net-ethernet-fix-memleak-in-ethoc_probe.patch net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch net-hns-fix-return-value-check-in-__lb_other_process.patch net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch net-ncsi-use-real-net-device-for-response-handler.patch net-sched-prevent-invalid-scell_log-shift-count.patch net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch net-stmmac-dwmac-meson8b-ignore-the-second-clock-input.patch net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch net-usb-qmi_wwan-add-quectel-em160r-gl.patch qede-fix-offload-for-ipip-tunnel-packets.patch r8169-work-around-power-saving-bug-on-some-chip-versions.patch revert-e1000e-disable-s0ix-entry-and-exit-flows-for-me-systems.patch selftests-mlxsw-set-headroom-size-of-correct-port.patch stmmac-intel-add-pci-ids-for-tgl-h-platform.patch tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch virtio_net-fix-recursive-call-to-cpus_read_lock.patch --- diff --git a/queue-5.10/atm-idt77252-call-pci_disable_device-on-error-path.patch b/queue-5.10/atm-idt77252-call-pci_disable_device-on-error-path.patch new file mode 100644 index 00000000000..0cc395bf873 --- /dev/null +++ b/queue-5.10/atm-idt77252-call-pci_disable_device-on-error-path.patch @@ -0,0 +1,31 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Dan Carpenter +Date: Sat, 19 Dec 2020 14:01:44 +0300 +Subject: atm: idt77252: call pci_disable_device() on error path + +From: Dan Carpenter + +[ Upstream commit 8df66af5c1e5f80562fe728db5ec069b21810144 ] + +This error path needs to disable the pci device before returning. + +Fixes: ede58ef28e10 ("atm: remove deprecated use of pci api") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X93dmC4NX0vbTpGp@mwanda +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/atm/idt77252.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -3607,7 +3607,7 @@ static int idt77252_init_one(struct pci_ + + if ((err = dma_set_mask_and_coherent(&pcidev->dev, DMA_BIT_MASK(32)))) { + printk("idt77252: can't enable DMA for PCI device at %s\n", pci_name(pcidev)); +- return err; ++ goto err_out_disable_pdev; + } + + card = kzalloc(sizeof(struct idt77252_dev), GFP_KERNEL); diff --git a/queue-5.10/bareudp-fix-use-of-incorrect-min_headroom-size.patch b/queue-5.10/bareudp-fix-use-of-incorrect-min_headroom-size.patch new file mode 100644 index 00000000000..35018aca32f --- /dev/null +++ b/queue-5.10/bareudp-fix-use-of-incorrect-min_headroom-size.patch @@ -0,0 +1,109 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Taehee Yoo +Date: Mon, 28 Dec 2020 15:21:46 +0000 +Subject: bareudp: Fix use of incorrect min_headroom size + +From: Taehee Yoo + +[ Upstream commit 10ad3e998fa0c25315f27cf3002ff8b02dc31c38 ] + +In the bareudp6_xmit_skb(), it calculates min_headroom. +At that point, it uses struct iphdr, but it's not correct. +So panic could occur. +The struct ipv6hdr should be used. + +Test commands: + ip netns add A + ip netns add B + ip link add veth0 netns A type veth peer name veth1 netns B + ip netns exec A ip link set veth0 up + ip netns exec A ip a a 2001:db8:0::1/64 dev veth0 + ip netns exec B ip link set veth1 up + ip netns exec B ip a a 2001:db8:0::2/64 dev veth1 + + for i in {10..1} + do + let A=$i-1 + ip netns exec A ip link add bareudp$i type bareudp dstport $i \ + ethertype 0x86dd + ip netns exec A ip link set bareudp$i up + ip netns exec A ip -6 a a 2001:db8:$i::1/64 dev bareudp$i + ip netns exec A ip -6 r a 2001:db8:$i::2 encap ip6 src \ + 2001:db8:$A::1 dst 2001:db8:$A::2 via 2001:db8:$i::2 \ + dev bareudp$i + + ip netns exec B ip link add bareudp$i type bareudp dstport $i \ + ethertype 0x86dd + ip netns exec B ip link set bareudp$i up + ip netns exec B ip -6 a a 2001:db8:$i::2/64 dev bareudp$i + ip netns exec B ip -6 r a 2001:db8:$i::1 encap ip6 src \ + 2001:db8:$A::2 dst 2001:db8:$A::1 via 2001:db8:$i::1 \ + dev bareudp$i + done + ip netns exec A ping 2001:db8:7::2 + +Splat looks like: +[ 66.436679][ C2] skbuff: skb_under_panic: text:ffffffff928614c8 len:454 put:14 head:ffff88810abb4000 data:ffff88810abb3ffa tail:0x1c0 end:0x3ec0 dev:veth0 +[ 66.441626][ C2] ------------[ cut here ]------------ +[ 66.443458][ C2] kernel BUG at net/core/skbuff.c:109! +[ 66.445313][ C2] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI +[ 66.447606][ C2] CPU: 2 PID: 913 Comm: ping Not tainted 5.10.0+ #819 +[ 66.450251][ C2] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +[ 66.453713][ C2] RIP: 0010:skb_panic+0x15d/0x15f +[ 66.455345][ C2] Code: 98 fe 4c 8b 4c 24 10 53 8b 4d 70 45 89 e0 48 c7 c7 60 8b 78 93 41 57 41 56 41 55 48 8b 54 24 20 48 8b 74 24 28 e8 b5 40 f9 ff <0f> 0b 48 8b 6c 24 20 89 34 24 e8 08 c9 98 fe 8b 34 24 48 c7 c1 80 +[ 66.462314][ C2] RSP: 0018:ffff888119209648 EFLAGS: 00010286 +[ 66.464281][ C2] RAX: 0000000000000089 RBX: ffff888003159000 RCX: 0000000000000000 +[ 66.467216][ C2] RDX: 0000000000000089 RSI: 0000000000000008 RDI: ffffed10232412c0 +[ 66.469768][ C2] RBP: ffff88810a53d440 R08: ffffed102328018d R09: ffffed102328018d +[ 66.472297][ C2] R10: ffff888119400c67 R11: ffffed102328018c R12: 000000000000000e +[ 66.474833][ C2] R13: ffff88810abb3ffa R14: 00000000000001c0 R15: 0000000000003ec0 +[ 66.477361][ C2] FS: 00007f37c0c72f00(0000) GS:ffff888119200000(0000) knlGS:0000000000000000 +[ 66.480214][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 66.482296][ C2] CR2: 000055a058808570 CR3: 000000011039e002 CR4: 00000000003706e0 +[ 66.484811][ C2] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 66.487793][ C2] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 66.490424][ C2] Call Trace: +[ 66.491469][ C2] +[ 66.492374][ C2] ? eth_header+0x28/0x190 +[ 66.494054][ C2] ? eth_header+0x28/0x190 +[ 66.495401][ C2] skb_push.cold.99+0x22/0x22 +[ 66.496700][ C2] eth_header+0x28/0x190 +[ 66.497867][ C2] neigh_resolve_output+0x3de/0x720 +[ 66.499615][ C2] ? __neigh_update+0x7e8/0x20a0 +[ 66.501176][ C2] __neigh_update+0x8bd/0x20a0 +[ 66.502749][ C2] ndisc_update+0x34/0xc0 +[ 66.504010][ C2] ndisc_recv_na+0x8da/0xb80 +[ 66.505041][ C2] ? pndisc_redo+0x20/0x20 +[ 66.505888][ C2] ? rcu_read_lock_sched_held+0xc0/0xc0 +[ 66.506965][ C2] ndisc_rcv+0x3a0/0x470 +[ 66.507797][ C2] icmpv6_rcv+0xad9/0x1b00 +[ 66.508645][ C2] ip6_protocol_deliver_rcu+0xcd6/0x1560 +[ 66.509719][ C2] ip6_input_finish+0x5b/0xf0 +[ 66.510615][ C2] ip6_input+0xcd/0x2d0 +[ 66.511406][ C2] ? ip6_input_finish+0xf0/0xf0 +[ 66.512327][ C2] ? rcu_read_lock_held+0x91/0xa0 +[ 66.513279][ C2] ? ip6_protocol_deliver_rcu+0x1560/0x1560 +[ 66.514414][ C2] ipv6_rcv+0xe8/0x300 +[ ... ] + +Acked-by: Guillaume Nault +Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.") +Signed-off-by: Taehee Yoo +Link: https://lore.kernel.org/r/20201228152146.24270-1-ap420073@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bareudp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/bareudp.c ++++ b/drivers/net/bareudp.c +@@ -380,7 +380,7 @@ static int bareudp6_xmit_skb(struct sk_b + goto free_dst; + + min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len + +- BAREUDP_BASE_HLEN + info->options_len + sizeof(struct iphdr); ++ BAREUDP_BASE_HLEN + info->options_len + sizeof(struct ipv6hdr); + + err = skb_cow_head(skb, min_headroom); + if (unlikely(err)) diff --git a/queue-5.10/bareudp-set-netif_f_lltx-flag.patch b/queue-5.10/bareudp-set-netif_f_lltx-flag.patch new file mode 100644 index 00000000000..8b9adfd4b53 --- /dev/null +++ b/queue-5.10/bareudp-set-netif_f_lltx-flag.patch @@ -0,0 +1,128 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Taehee Yoo +Date: Mon, 28 Dec 2020 15:21:36 +0000 +Subject: bareudp: set NETIF_F_LLTX flag + +From: Taehee Yoo + +[ Upstream commit d9e44981739a96f1a468c13bbbd54ace378caf1c ] + +Like other tunneling interfaces, the bareudp doesn't need TXLOCK. +So, It is good to set the NETIF_F_LLTX flag to improve performance and +to avoid lockdep's false-positive warning. + +Test commands: + ip netns add A + ip netns add B + ip link add veth0 netns A type veth peer name veth1 netns B + ip netns exec A ip link set veth0 up + ip netns exec A ip a a 10.0.0.1/24 dev veth0 + ip netns exec B ip link set veth1 up + ip netns exec B ip a a 10.0.0.2/24 dev veth1 + + for i in {2..1} + do + let A=$i-1 + ip netns exec A ip link add bareudp$i type bareudp \ + dstport $i ethertype ip + ip netns exec A ip link set bareudp$i up + ip netns exec A ip a a 10.0.$i.1/24 dev bareudp$i + ip netns exec A ip r a 10.0.$i.2 encap ip src 10.0.$A.1 \ + dst 10.0.$A.2 via 10.0.$i.2 dev bareudp$i + + ip netns exec B ip link add bareudp$i type bareudp \ + dstport $i ethertype ip + ip netns exec B ip link set bareudp$i up + ip netns exec B ip a a 10.0.$i.2/24 dev bareudp$i + ip netns exec B ip r a 10.0.$i.1 encap ip src 10.0.$A.2 \ + dst 10.0.$A.1 via 10.0.$i.1 dev bareudp$i + done + ip netns exec A ping 10.0.2.2 + +Splat looks like: +[ 96.992803][ T822] ============================================ +[ 96.993954][ T822] WARNING: possible recursive locking detected +[ 96.995102][ T822] 5.10.0+ #819 Not tainted +[ 96.995927][ T822] -------------------------------------------- +[ 96.997091][ T822] ping/822 is trying to acquire lock: +[ 96.998083][ T822] ffff88810f753898 (_xmit_NONE#2){+.-.}-{2:2}, at: __dev_queue_xmit+0x1f52/0x2960 +[ 96.999813][ T822] +[ 96.999813][ T822] but task is already holding lock: +[ 97.001192][ T822] ffff88810c385498 (_xmit_NONE#2){+.-.}-{2:2}, at: __dev_queue_xmit+0x1f52/0x2960 +[ 97.002908][ T822] +[ 97.002908][ T822] other info that might help us debug this: +[ 97.004401][ T822] Possible unsafe locking scenario: +[ 97.004401][ T822] +[ 97.005784][ T822] CPU0 +[ 97.006407][ T822] ---- +[ 97.007010][ T822] lock(_xmit_NONE#2); +[ 97.007779][ T822] lock(_xmit_NONE#2); +[ 97.008550][ T822] +[ 97.008550][ T822] *** DEADLOCK *** +[ 97.008550][ T822] +[ 97.010057][ T822] May be due to missing lock nesting notation +[ 97.010057][ T822] +[ 97.011594][ T822] 7 locks held by ping/822: +[ 97.012426][ T822] #0: ffff888109a144f0 (sk_lock-AF_INET){+.+.}-{0:0}, at: raw_sendmsg+0x12f7/0x2b00 +[ 97.014191][ T822] #1: ffffffffbce2f5a0 (rcu_read_lock_bh){....}-{1:2}, at: ip_finish_output2+0x249/0x2020 +[ 97.016045][ T822] #2: ffffffffbce2f5a0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1fd/0x2960 +[ 97.017897][ T822] #3: ffff88810c385498 (_xmit_NONE#2){+.-.}-{2:2}, at: __dev_queue_xmit+0x1f52/0x2960 +[ 97.019684][ T822] #4: ffffffffbce2f600 (rcu_read_lock){....}-{1:2}, at: bareudp_xmit+0x31b/0x3690 [bareudp] +[ 97.021573][ T822] #5: ffffffffbce2f5a0 (rcu_read_lock_bh){....}-{1:2}, at: ip_finish_output2+0x249/0x2020 +[ 97.023424][ T822] #6: ffffffffbce2f5a0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1fd/0x2960 +[ 97.025259][ T822] +[ 97.025259][ T822] stack backtrace: +[ 97.026349][ T822] CPU: 3 PID: 822 Comm: ping Not tainted 5.10.0+ #819 +[ 97.027609][ T822] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +[ 97.029407][ T822] Call Trace: +[ 97.030015][ T822] dump_stack+0x99/0xcb +[ 97.030783][ T822] __lock_acquire.cold.77+0x149/0x3a9 +[ 97.031773][ T822] ? stack_trace_save+0x81/0xa0 +[ 97.032661][ T822] ? register_lock_class+0x1910/0x1910 +[ 97.033673][ T822] ? register_lock_class+0x1910/0x1910 +[ 97.034679][ T822] ? rcu_read_lock_sched_held+0x91/0xc0 +[ 97.035697][ T822] ? rcu_read_lock_bh_held+0xa0/0xa0 +[ 97.036690][ T822] lock_acquire+0x1b2/0x730 +[ 97.037515][ T822] ? __dev_queue_xmit+0x1f52/0x2960 +[ 97.038466][ T822] ? check_flags+0x50/0x50 +[ 97.039277][ T822] ? netif_skb_features+0x296/0x9c0 +[ 97.040226][ T822] ? validate_xmit_skb+0x29/0xb10 +[ 97.041151][ T822] _raw_spin_lock+0x30/0x70 +[ 97.041977][ T822] ? __dev_queue_xmit+0x1f52/0x2960 +[ 97.042927][ T822] __dev_queue_xmit+0x1f52/0x2960 +[ 97.043852][ T822] ? netdev_core_pick_tx+0x290/0x290 +[ 97.044824][ T822] ? mark_held_locks+0xb7/0x120 +[ 97.045712][ T822] ? lockdep_hardirqs_on_prepare+0x12c/0x3e0 +[ 97.046824][ T822] ? __local_bh_enable_ip+0xa5/0xf0 +[ 97.047771][ T822] ? ___neigh_create+0x12a8/0x1eb0 +[ 97.048710][ T822] ? trace_hardirqs_on+0x41/0x120 +[ 97.049626][ T822] ? ___neigh_create+0x12a8/0x1eb0 +[ 97.050556][ T822] ? __local_bh_enable_ip+0xa5/0xf0 +[ 97.051509][ T822] ? ___neigh_create+0x12a8/0x1eb0 +[ 97.052443][ T822] ? check_chain_key+0x244/0x5f0 +[ 97.053352][ T822] ? rcu_read_lock_bh_held+0x56/0xa0 +[ 97.054317][ T822] ? ip_finish_output2+0x6ea/0x2020 +[ 97.055263][ T822] ? pneigh_lookup+0x410/0x410 +[ 97.056135][ T822] ip_finish_output2+0x6ea/0x2020 +[ ... ] + +Acked-by: Guillaume Nault +Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.") +Signed-off-by: Taehee Yoo +Link: https://lore.kernel.org/r/20201228152136.24215-1-ap420073@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bareudp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/bareudp.c ++++ b/drivers/net/bareudp.c +@@ -534,6 +534,7 @@ static void bareudp_setup(struct net_dev + SET_NETDEV_DEVTYPE(dev, &bareudp_type); + dev->features |= NETIF_F_SG | NETIF_F_HW_CSUM; + dev->features |= NETIF_F_RXCSUM; ++ dev->features |= NETIF_F_LLTX; + dev->features |= NETIF_F_GSO_SOFTWARE; + dev->hw_features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_RXCSUM; + dev->hw_features |= NETIF_F_GSO_SOFTWARE; diff --git a/queue-5.10/bnxt_en-check-tqm-rings-for-maximum-supported-value.patch b/queue-5.10/bnxt_en-check-tqm-rings-for-maximum-supported-value.patch new file mode 100644 index 00000000000..5a7e7c17663 --- /dev/null +++ b/queue-5.10/bnxt_en-check-tqm-rings-for-maximum-supported-value.patch @@ -0,0 +1,74 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Michael Chan +Date: Sun, 27 Dec 2020 14:18:18 -0500 +Subject: bnxt_en: Check TQM rings for maximum supported value. + +From: Michael Chan + +[ Upstream commit a029a2fef5d11bb85587433c3783615442abac96 ] + +TQM rings are hardware resources that require host context memory +managed by the driver. The driver supports up to 9 TQM rings and +the number of rings to use is requested by firmware during run-time. +Cap this number to the maximum supported to prevent accessing beyond +the array. Future firmware may request more than 9 TQM rings. Define +macros to remove the magic number 9 from the C code. + +Fixes: ac3158cb0108 ("bnxt_en: Allocate TQM ring context memory according to fw specification.") +Reviewed-by: Pavan Chebbi +Reviewed-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 +++++-- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 7 ++++++- + 2 files changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6790,8 +6790,10 @@ static int bnxt_hwrm_func_backing_store_ + ctx->tqm_fp_rings_count = resp->tqm_fp_rings_count; + if (!ctx->tqm_fp_rings_count) + ctx->tqm_fp_rings_count = bp->max_q; ++ else if (ctx->tqm_fp_rings_count > BNXT_MAX_TQM_FP_RINGS) ++ ctx->tqm_fp_rings_count = BNXT_MAX_TQM_FP_RINGS; + +- tqm_rings = ctx->tqm_fp_rings_count + 1; ++ tqm_rings = ctx->tqm_fp_rings_count + BNXT_MAX_TQM_SP_RINGS; + ctx_pg = kcalloc(tqm_rings, sizeof(*ctx_pg), GFP_KERNEL); + if (!ctx_pg) { + kfree(ctx); +@@ -6925,7 +6927,8 @@ static int bnxt_hwrm_func_backing_store_ + pg_attr = &req.tqm_sp_pg_size_tqm_sp_lvl, + pg_dir = &req.tqm_sp_page_dir, + ena = FUNC_BACKING_STORE_CFG_REQ_ENABLES_TQM_SP; +- i < 9; i++, num_entries++, pg_attr++, pg_dir++, ena <<= 1) { ++ i < BNXT_MAX_TQM_RINGS; ++ i++, num_entries++, pg_attr++, pg_dir++, ena <<= 1) { + if (!(enables & ena)) + continue; + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1435,6 +1435,11 @@ struct bnxt_ctx_pg_info { + struct bnxt_ctx_pg_info **ctx_pg_tbl; + }; + ++#define BNXT_MAX_TQM_SP_RINGS 1 ++#define BNXT_MAX_TQM_FP_RINGS 8 ++#define BNXT_MAX_TQM_RINGS \ ++ (BNXT_MAX_TQM_SP_RINGS + BNXT_MAX_TQM_FP_RINGS) ++ + struct bnxt_ctx_mem_info { + u32 qp_max_entries; + u16 qp_min_qp1_entries; +@@ -1473,7 +1478,7 @@ struct bnxt_ctx_mem_info { + struct bnxt_ctx_pg_info stat_mem; + struct bnxt_ctx_pg_info mrav_mem; + struct bnxt_ctx_pg_info tim_mem; +- struct bnxt_ctx_pg_info *tqm_mem[9]; ++ struct bnxt_ctx_pg_info *tqm_mem[BNXT_MAX_TQM_RINGS]; + }; + + struct bnxt_fw_health { diff --git a/queue-5.10/bnxt_en-fix-aer-recovery.patch b/queue-5.10/bnxt_en-fix-aer-recovery.patch new file mode 100644 index 00000000000..eac371e6785 --- /dev/null +++ b/queue-5.10/bnxt_en-fix-aer-recovery.patch @@ -0,0 +1,90 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Vasundhara Volam +Date: Sun, 27 Dec 2020 14:18:17 -0500 +Subject: bnxt_en: Fix AER recovery. + +From: Vasundhara Volam + +[ Upstream commit fb1e6e562b37b39adfe251919c9abfdb3e01f921 ] + +A recent change skips sending firmware messages to the firmware when +pci_channel_offline() is true during fatal AER error. To make this +complete, we need to move the re-initialization sequence to +bnxt_io_resume(), otherwise the firmware messages to re-initialize +will all be skipped. In any case, it is more correct to re-initialize +in bnxt_io_resume(). + +Also, fix the reverse x-mas tree format when defining variables +in bnxt_io_slot_reset(). + +Fixes: b340dc680ed4 ("bnxt_en: Avoid sending firmware messages when AER error is detected.") +Reviewed-by: Edwin Peer +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 31 +++++++++++++----------------- + 1 file changed, 14 insertions(+), 17 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -12890,10 +12890,10 @@ static pci_ers_result_t bnxt_io_error_de + */ + static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) + { ++ pci_ers_result_t result = PCI_ERS_RESULT_DISCONNECT; + struct net_device *netdev = pci_get_drvdata(pdev); + struct bnxt *bp = netdev_priv(netdev); + int err = 0, off; +- pci_ers_result_t result = PCI_ERS_RESULT_DISCONNECT; + + netdev_info(bp->dev, "PCI Slot Reset\n"); + +@@ -12922,22 +12922,8 @@ static pci_ers_result_t bnxt_io_slot_res + pci_save_state(pdev); + + err = bnxt_hwrm_func_reset(bp); +- if (!err) { +- err = bnxt_hwrm_func_qcaps(bp); +- if (!err && netif_running(netdev)) +- err = bnxt_open(netdev); +- } +- bnxt_ulp_start(bp, err); +- if (!err) { +- bnxt_reenable_sriov(bp); ++ if (!err) + result = PCI_ERS_RESULT_RECOVERED; +- } +- } +- +- if (result != PCI_ERS_RESULT_RECOVERED) { +- if (netif_running(netdev)) +- dev_close(netdev); +- pci_disable_device(pdev); + } + + rtnl_unlock(); +@@ -12955,10 +12941,21 @@ static pci_ers_result_t bnxt_io_slot_res + static void bnxt_io_resume(struct pci_dev *pdev) + { + struct net_device *netdev = pci_get_drvdata(pdev); ++ struct bnxt *bp = netdev_priv(netdev); ++ int err; + ++ netdev_info(bp->dev, "PCI Slot Resume\n"); + rtnl_lock(); + +- netif_device_attach(netdev); ++ err = bnxt_hwrm_func_qcaps(bp); ++ if (!err && netif_running(netdev)) ++ err = bnxt_open(netdev); ++ ++ bnxt_ulp_start(bp, err); ++ if (!err) { ++ bnxt_reenable_sriov(bp); ++ netif_device_attach(netdev); ++ } + + rtnl_unlock(); + } diff --git a/queue-5.10/cdc-ncm-remove-connected-log-message.patch b/queue-5.10/cdc-ncm-remove-connected-log-message.patch new file mode 100644 index 00000000000..1ab17d5ee6d --- /dev/null +++ b/queue-5.10/cdc-ncm-remove-connected-log-message.patch @@ -0,0 +1,41 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Roland Dreier +Date: Wed, 23 Dec 2020 19:21:16 -0800 +Subject: CDC-NCM: remove "connected" log message + +From: Roland Dreier + +[ Upstream commit 59b4a8fa27f5a895582ada1ae5034af7c94a57b5 ] + +The cdc_ncm driver passes network connection notifications up to +usbnet_link_change(), which is the right place for any logging. +Remove the netdev_info() duplicating this from the driver itself. + +This stops devices such as my "TRENDnet USB 10/100/1G/2.5G LAN" +(ID 20f4:e02b) adapter from spamming the kernel log with + + cdc_ncm 2-2:2.0 enp0s2u2c2: network connection: connected + +messages every 60 msec or so. + +Signed-off-by: Roland Dreier +Reviewed-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20201224032116.2453938-1-roland@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/cdc_ncm.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -1863,9 +1863,6 @@ static void cdc_ncm_status(struct usbnet + * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be + * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE. + */ +- netif_info(dev, link, dev->net, +- "network connection: %sconnected\n", +- !!event->wValue ? "" : "dis"); + usbnet_link_change(dev, !!event->wValue, 0); + break; + diff --git a/queue-5.10/e1000e-bump-up-timeout-to-wait-when-me-un-configures-ulp-mode.patch b/queue-5.10/e1000e-bump-up-timeout-to-wait-when-me-un-configures-ulp-mode.patch new file mode 100644 index 00000000000..e304c21cfa9 --- /dev/null +++ b/queue-5.10/e1000e-bump-up-timeout-to-wait-when-me-un-configures-ulp-mode.patch @@ -0,0 +1,75 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Mario Limonciello +Date: Mon, 14 Dec 2020 13:29:33 -0600 +Subject: e1000e: bump up timeout to wait when ME un-configures ULP mode + +From: Mario Limonciello + +[ Upstream commit 3cf31b1a9effd859bb3d6ff9f8b5b0d5e6cac952 ] + +Per guidance from Intel ethernet architecture team, it may take +up to 1 second for unconfiguring ULP mode. + +However in practice this seems to be taking up to 2 seconds on +some Lenovo machines. Detect scenarios that take more than 1 second +but less than 2.5 seconds and emit a warning on resume for those +scenarios. + +Suggested-by: Aaron Ma +Suggested-by: Sasha Netfin +Suggested-by: Hans de Goede +CC: Mark Pearson +Fixes: f15bb6dde738cc8fa0 ("e1000e: Add support for S0ix") +BugLink: https://bugs.launchpad.net/bugs/1865570 +Link: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20200323191639.48826-1-aaron.ma@canonical.com/ +Link: https://lkml.org/lkml/2020/12/13/15 +Link: https://lkml.org/lkml/2020/12/14/708 +Signed-off-by: Mario Limonciello +Reviewed-by: Hans de Goede +Tested-by: Yijun Shen +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000e/ich8lan.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1240,6 +1240,9 @@ static s32 e1000_disable_ulp_lpt_lp(stru + return 0; + + if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID) { ++ struct e1000_adapter *adapter = hw->adapter; ++ bool firmware_bug = false; ++ + if (force) { + /* Request ME un-configure ULP mode in the PHY */ + mac_reg = er32(H2ME); +@@ -1248,16 +1251,24 @@ static s32 e1000_disable_ulp_lpt_lp(stru + ew32(H2ME, mac_reg); + } + +- /* Poll up to 300msec for ME to clear ULP_CFG_DONE. */ ++ /* Poll up to 2.5 seconds for ME to clear ULP_CFG_DONE. ++ * If this takes more than 1 second, show a warning indicating a ++ * firmware bug ++ */ + while (er32(FWSM) & E1000_FWSM_ULP_CFG_DONE) { +- if (i++ == 30) { ++ if (i++ == 250) { + ret_val = -E1000_ERR_PHY; + goto out; + } ++ if (i > 100 && !firmware_bug) ++ firmware_bug = true; + + usleep_range(10000, 11000); + } +- e_dbg("ULP_CONFIG_DONE cleared after %dmsec\n", i * 10); ++ if (firmware_bug) ++ e_warn("ULP_CONFIG_DONE took %dmsec. This is a firmware bug\n", i * 10); ++ else ++ e_dbg("ULP_CONFIG_DONE cleared after %dmsec\n", i * 10); + + if (force) { + mac_reg = er32(H2ME); diff --git a/queue-5.10/e1000e-export-s0ix-flags-to-ethtool.patch b/queue-5.10/e1000e-export-s0ix-flags-to-ethtool.patch new file mode 100644 index 00000000000..01a4d5bcde8 --- /dev/null +++ b/queue-5.10/e1000e-export-s0ix-flags-to-ethtool.patch @@ -0,0 +1,162 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Mario Limonciello +Date: Mon, 14 Dec 2020 13:29:35 -0600 +Subject: e1000e: Export S0ix flags to ethtool + +From: Mario Limonciello + +[ Upstream commit 3c98cbf22a96c1b12f48c1b2a4680dfe5cb280f9 ] + +This flag can be used by an end user to disable S0ix flows on a +buggy system or by an OEM for development purposes. + +If you need this flag to be persisted across reboots, it's suggested +to use a udev rule to call adjust it until the kernel could have your +configuration in a disallow list. + +Signed-off-by: Mario Limonciello +Reviewed-by: Hans de Goede +Tested-by: Yijun Shen +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000e/e1000.h | 1 + drivers/net/ethernet/intel/e1000e/ethtool.c | 46 ++++++++++++++++++++++++++++ + drivers/net/ethernet/intel/e1000e/netdev.c | 9 +++-- + 3 files changed, 52 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000e/e1000.h ++++ b/drivers/net/ethernet/intel/e1000e/e1000.h +@@ -436,6 +436,7 @@ s32 e1000e_get_base_timinca(struct e1000 + #define FLAG2_DFLT_CRC_STRIPPING BIT(12) + #define FLAG2_CHECK_RX_HWTSTAMP BIT(13) + #define FLAG2_CHECK_SYSTIM_OVERFLOW BIT(14) ++#define FLAG2_ENABLE_S0IX_FLOWS BIT(15) + + #define E1000_RX_DESC_PS(R, i) \ + (&(((union e1000_rx_desc_packet_split *)((R).desc))[i])) +--- a/drivers/net/ethernet/intel/e1000e/ethtool.c ++++ b/drivers/net/ethernet/intel/e1000e/ethtool.c +@@ -23,6 +23,13 @@ struct e1000_stats { + int stat_offset; + }; + ++static const char e1000e_priv_flags_strings[][ETH_GSTRING_LEN] = { ++#define E1000E_PRIV_FLAGS_S0IX_ENABLED BIT(0) ++ "s0ix-enabled", ++}; ++ ++#define E1000E_PRIV_FLAGS_STR_LEN ARRAY_SIZE(e1000e_priv_flags_strings) ++ + #define E1000_STAT(str, m) { \ + .stat_string = str, \ + .type = E1000_STATS, \ +@@ -1776,6 +1783,8 @@ static int e1000e_get_sset_count(struct + return E1000_TEST_LEN; + case ETH_SS_STATS: + return E1000_STATS_LEN; ++ case ETH_SS_PRIV_FLAGS: ++ return E1000E_PRIV_FLAGS_STR_LEN; + default: + return -EOPNOTSUPP; + } +@@ -2097,6 +2106,10 @@ static void e1000_get_strings(struct net + p += ETH_GSTRING_LEN; + } + break; ++ case ETH_SS_PRIV_FLAGS: ++ memcpy(data, e1000e_priv_flags_strings, ++ E1000E_PRIV_FLAGS_STR_LEN * ETH_GSTRING_LEN); ++ break; + } + } + +@@ -2305,6 +2318,37 @@ static int e1000e_get_ts_info(struct net + return 0; + } + ++static u32 e1000e_get_priv_flags(struct net_device *netdev) ++{ ++ struct e1000_adapter *adapter = netdev_priv(netdev); ++ u32 priv_flags = 0; ++ ++ if (adapter->flags2 & FLAG2_ENABLE_S0IX_FLOWS) ++ priv_flags |= E1000E_PRIV_FLAGS_S0IX_ENABLED; ++ ++ return priv_flags; ++} ++ ++static int e1000e_set_priv_flags(struct net_device *netdev, u32 priv_flags) ++{ ++ struct e1000_adapter *adapter = netdev_priv(netdev); ++ unsigned int flags2 = adapter->flags2; ++ ++ flags2 &= ~FLAG2_ENABLE_S0IX_FLOWS; ++ if (priv_flags & E1000E_PRIV_FLAGS_S0IX_ENABLED) { ++ struct e1000_hw *hw = &adapter->hw; ++ ++ if (hw->mac.type < e1000_pch_cnp) ++ return -EINVAL; ++ flags2 |= FLAG2_ENABLE_S0IX_FLOWS; ++ } ++ ++ if (flags2 != adapter->flags2) ++ adapter->flags2 = flags2; ++ ++ return 0; ++} ++ + static const struct ethtool_ops e1000_ethtool_ops = { + .supported_coalesce_params = ETHTOOL_COALESCE_RX_USECS, + .get_drvinfo = e1000_get_drvinfo, +@@ -2336,6 +2380,8 @@ static const struct ethtool_ops e1000_et + .set_eee = e1000e_set_eee, + .get_link_ksettings = e1000_get_link_ksettings, + .set_link_ksettings = e1000_set_link_ksettings, ++ .get_priv_flags = e1000e_get_priv_flags, ++ .set_priv_flags = e1000e_set_priv_flags, + }; + + void e1000e_set_ethtool_ops(struct net_device *netdev) +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -6923,7 +6923,6 @@ static __maybe_unused int e1000e_pm_susp + struct net_device *netdev = pci_get_drvdata(to_pci_dev(dev)); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct pci_dev *pdev = to_pci_dev(dev); +- struct e1000_hw *hw = &adapter->hw; + int rc; + + e1000e_flush_lpic(pdev); +@@ -6935,7 +6934,7 @@ static __maybe_unused int e1000e_pm_susp + e1000e_pm_thaw(dev); + } else { + /* Introduce S0ix implementation */ +- if (hw->mac.type >= e1000_pch_cnp) ++ if (adapter->flags2 & FLAG2_ENABLE_S0IX_FLOWS) + e1000e_s0ix_entry_flow(adapter); + } + +@@ -6947,11 +6946,10 @@ static __maybe_unused int e1000e_pm_resu + struct net_device *netdev = pci_get_drvdata(to_pci_dev(dev)); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct pci_dev *pdev = to_pci_dev(dev); +- struct e1000_hw *hw = &adapter->hw; + int rc; + + /* Introduce S0ix implementation */ +- if (hw->mac.type >= e1000_pch_cnp) ++ if (adapter->flags2 & FLAG2_ENABLE_S0IX_FLOWS) + e1000e_s0ix_exit_flow(adapter); + + rc = __e1000_resume(pdev); +@@ -7615,6 +7613,9 @@ static int e1000_probe(struct pci_dev *p + if (!(adapter->flags & FLAG_HAS_AMT)) + e1000e_get_hw_control(adapter); + ++ if (hw->mac.type >= e1000_pch_cnp) ++ adapter->flags2 |= FLAG2_ENABLE_S0IX_FLOWS; ++ + strlcpy(netdev->name, "eth%d", sizeof(netdev->name)); + err = register_netdev(netdev); + if (err) diff --git a/queue-5.10/e1000e-only-run-s0ix-flows-if-shutdown-succeeded.patch b/queue-5.10/e1000e-only-run-s0ix-flows-if-shutdown-succeeded.patch new file mode 100644 index 00000000000..8ae369a7b49 --- /dev/null +++ b/queue-5.10/e1000e-only-run-s0ix-flows-if-shutdown-succeeded.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Mario Limonciello +Date: Mon, 14 Dec 2020 13:29:32 -0600 +Subject: e1000e: Only run S0ix flows if shutdown succeeded + +From: Mario Limonciello + +[ Upstream commit 808e0d8832cc81738f3e8df12dff0688352baf50 ] + +If the shutdown failed, the part will be thawed and running +S0ix flows will put it into an undefined state. + +Reported-by: Alexander Duyck +Reviewed-by: Alexander Duyck +Signed-off-by: Mario Limonciello +Tested-by: Yijun Shen +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -6970,13 +6970,14 @@ static __maybe_unused int e1000e_pm_susp + e1000e_pm_freeze(dev); + + rc = __e1000_shutdown(pdev, false); +- if (rc) ++ if (rc) { + e1000e_pm_thaw(dev); +- +- /* Introduce S0ix implementation */ +- if (hw->mac.type >= e1000_pch_cnp && +- !e1000e_check_me(hw->adapter->pdev->device)) +- e1000e_s0ix_entry_flow(adapter); ++ } else { ++ /* Introduce S0ix implementation */ ++ if (hw->mac.type >= e1000_pch_cnp && ++ !e1000e_check_me(hw->adapter->pdev->device)) ++ e1000e_s0ix_entry_flow(adapter); ++ } + + return rc; + } diff --git a/queue-5.10/erspan-fix-version-1-check-in-gre_parse_header.patch b/queue-5.10/erspan-fix-version-1-check-in-gre_parse_header.patch new file mode 100644 index 00000000000..eb90dffc18d --- /dev/null +++ b/queue-5.10/erspan-fix-version-1-check-in-gre_parse_header.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Cong Wang +Date: Sat, 26 Dec 2020 15:44:53 -0800 +Subject: erspan: fix version 1 check in gre_parse_header() + +From: Cong Wang + +[ Upstream commit 085c7c4e1c0e50d90b7d90f61a12e12b317a91e2 ] + +Both version 0 and version 1 use ETH_P_ERSPAN, but version 0 does not +have an erspan header. So the check in gre_parse_header() is wrong, +we have to distinguish version 1 from version 0. + +We can just check the gre header length like is_erspan_type1(). + +Fixes: cb73ee40b1b3 ("net: ip_gre: use erspan key field for tunnel lookup") +Reported-by: syzbot+f583ce3d4ddf9836b27a@syzkaller.appspotmail.com +Cc: William Tu +Cc: Lorenzo Bianconi +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/gre_demux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/gre_demux.c ++++ b/net/ipv4/gre_demux.c +@@ -128,7 +128,7 @@ int gre_parse_header(struct sk_buff *skb + * to 0 and sets the configured key in the + * inner erspan header field + */ +- if (greh->protocol == htons(ETH_P_ERSPAN) || ++ if ((greh->protocol == htons(ETH_P_ERSPAN) && hdr_len != 4) || + greh->protocol == htons(ETH_P_ERSPAN2)) { + struct erspan_base_hdr *ershdr; + diff --git a/queue-5.10/ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch b/queue-5.10/ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch new file mode 100644 index 00000000000..40b9dc587a0 --- /dev/null +++ b/queue-5.10/ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Rasmus Villemoes +Date: Fri, 18 Dec 2020 11:55:38 +0100 +Subject: ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() + +From: Rasmus Villemoes + +[ Upstream commit e925e0cd2a705aaacb0b907bb3691fcac3a973a4 ] + +ugeth is the netdiv_priv() part of the netdevice. Accessing the memory +pointed to by ugeth (such as done by ucc_geth_memclean() and the two +of_node_puts) after free_netdev() is thus use-after-free. + +Fixes: 80a9fad8e89a ("ucc_geth: fix module removal") +Signed-off-by: Rasmus Villemoes +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/ucc_geth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/ucc_geth.c ++++ b/drivers/net/ethernet/freescale/ucc_geth.c +@@ -3934,12 +3934,12 @@ static int ucc_geth_remove(struct platfo + struct device_node *np = ofdev->dev.of_node; + + unregister_netdev(dev); +- free_netdev(dev); + ucc_geth_memclean(ugeth); + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(ugeth->ug_info->tbi_node); + of_node_put(ugeth->ug_info->phy_node); ++ free_netdev(dev); + + return 0; + } diff --git a/queue-5.10/ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch b/queue-5.10/ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch new file mode 100644 index 00000000000..ed1f14c5d38 --- /dev/null +++ b/queue-5.10/ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch @@ -0,0 +1,46 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Rasmus Villemoes +Date: Fri, 18 Dec 2020 11:55:36 +0100 +Subject: ethernet: ucc_geth: set dev->max_mtu to 1518 + +From: Rasmus Villemoes + +[ Upstream commit 1385ae5c30f238f81bc6528d897c6d7a0816783f ] + +All the buffers and registers are already set up appropriately for an +MTU slightly above 1500, so we just need to expose this to the +networking stack. AFAICT, there's no need to implement .ndo_change_mtu +when the receive buffers are always set up to support the max_mtu. + +This fixes several warnings during boot on our mpc8309-board with an +embedded mv88e6250 switch: + +mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 0 +... +mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 4 +ucc_geth e0102000.ethernet eth1: error -22 setting MTU to 1504 to include DSA overhead + +The last line explains what the DSA stack tries to do: achieving an MTU +of 1500 on-the-wire requires that the master netdevice connected to +the CPU port supports an MTU of 1500+the tagging overhead. + +Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports") +Reviewed-by: Andrew Lunn +Signed-off-by: Rasmus Villemoes +Reviewed-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/ucc_geth.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/freescale/ucc_geth.c ++++ b/drivers/net/ethernet/freescale/ucc_geth.c +@@ -3889,6 +3889,7 @@ static int ucc_geth_probe(struct platfor + INIT_WORK(&ugeth->timeout_work, ucc_geth_timeout_work); + netif_napi_add(dev, &ugeth->napi, ucc_geth_poll, 64); + dev->mtu = 1500; ++ dev->max_mtu = 1518; + + ugeth->msg_enable = netif_msg_init(debug.msg_enable, UGETH_MSG_DEFAULT); + ugeth->phy_interface = phy_interface; diff --git a/queue-5.10/i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch b/queue-5.10/i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch new file mode 100644 index 00000000000..0aefdf27859 --- /dev/null +++ b/queue-5.10/i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch @@ -0,0 +1,91 @@ +From foo@baz Sun Jan 10 11:18:58 AM CET 2021 +From: Sylwester Dziedziuch +Date: Thu, 22 Oct 2020 12:39:36 +0200 +Subject: i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs + +From: Sylwester Dziedziuch + +[ Upstream commit 3ac874fa84d1baaf0c0175f2a1499f5d88d528b2 ] + +When removing VFs for PF added to bridge there was +an error I40E_AQ_RC_EINVAL. It was caused by not properly +resetting and reinitializing PF when adding/removing VFs. +Changed how reset is performed when adding/removing VFs +to properly reinitialize PFs VSI. + +Fixes: fc60861e9b00 ("i40e: start up in VEPA mode by default") +Signed-off-by: Sylwester Dziedziuch +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e.h | 3 +++ + drivers/net/ethernet/intel/i40e/i40e_main.c | 10 ++++++++++ + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++-- + 3 files changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -120,6 +120,7 @@ enum i40e_state_t { + __I40E_RESET_INTR_RECEIVED, + __I40E_REINIT_REQUESTED, + __I40E_PF_RESET_REQUESTED, ++ __I40E_PF_RESET_AND_REBUILD_REQUESTED, + __I40E_CORE_RESET_REQUESTED, + __I40E_GLOBAL_RESET_REQUESTED, + __I40E_EMP_RESET_INTR_RECEIVED, +@@ -146,6 +147,8 @@ enum i40e_state_t { + }; + + #define I40E_PF_RESET_FLAG BIT_ULL(__I40E_PF_RESET_REQUESTED) ++#define I40E_PF_RESET_AND_REBUILD_FLAG \ ++ BIT_ULL(__I40E_PF_RESET_AND_REBUILD_REQUESTED) + + /* VSI state flags */ + enum i40e_vsi_state_t { +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -36,6 +36,8 @@ static int i40e_setup_misc_vector(struct + static void i40e_determine_queue_usage(struct i40e_pf *pf); + static int i40e_setup_pf_filter_control(struct i40e_pf *pf); + static void i40e_prep_for_reset(struct i40e_pf *pf, bool lock_acquired); ++static void i40e_reset_and_rebuild(struct i40e_pf *pf, bool reinit, ++ bool lock_acquired); + static int i40e_reset(struct i40e_pf *pf); + static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired); + static int i40e_setup_misc_vector_for_recovery_mode(struct i40e_pf *pf); +@@ -8536,6 +8538,14 @@ void i40e_do_reset(struct i40e_pf *pf, u + "FW LLDP is disabled\n" : + "FW LLDP is enabled\n"); + ++ } else if (reset_flags & I40E_PF_RESET_AND_REBUILD_FLAG) { ++ /* Request a PF Reset ++ * ++ * Resets PF and reinitializes PFs VSI. ++ */ ++ i40e_prep_for_reset(pf, lock_acquired); ++ i40e_reset_and_rebuild(pf, true, lock_acquired); ++ + } else if (reset_flags & BIT_ULL(__I40E_REINIT_REQUESTED)) { + int v; + +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1772,7 +1772,7 @@ int i40e_pci_sriov_configure(struct pci_ + if (num_vfs) { + if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) { + pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; +- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG); ++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG); + } + ret = i40e_pci_sriov_enable(pdev, num_vfs); + goto sriov_configure_out; +@@ -1781,7 +1781,7 @@ int i40e_pci_sriov_configure(struct pci_ + if (!pci_vfs_assigned(pf->pdev)) { + i40e_free_vfs(pf); + pf->flags &= ~I40E_FLAG_VEB_MODE_ENABLED; +- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG); ++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG); + } else { + dev_warn(&pdev->dev, "Unable to free VFs because some are assigned to VMs.\n"); + ret = -EINVAL; diff --git a/queue-5.10/iavf-fix-double-release-of-rtnl_lock.patch b/queue-5.10/iavf-fix-double-release-of-rtnl_lock.patch new file mode 100644 index 00000000000..5ad484d1973 --- /dev/null +++ b/queue-5.10/iavf-fix-double-release-of-rtnl_lock.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Jan 10 11:18:58 AM CET 2021 +From: Jakub Kicinski +Date: Wed, 2 Dec 2020 18:18:06 -0800 +Subject: iavf: fix double-release of rtnl_lock + +From: Jakub Kicinski + +[ Upstream commit f1340265726e0edf8a8cef28e665b28ad6302ce9 ] + +This code does not jump to exit on an error in iavf_lan_add_device(), +so the rtnl_unlock() from the normal path will follow. + +Fixes: b66c7bc1cd4d ("iavf: Refactor init state machine") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tony Nguyen +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1834,11 +1834,9 @@ static int iavf_init_get_resources(struc + netif_tx_stop_all_queues(netdev); + if (CLIENT_ALLOWED(adapter)) { + err = iavf_lan_add_device(adapter); +- if (err) { +- rtnl_unlock(); ++ if (err) + dev_info(&pdev->dev, "Failed to add VF to client API service list: %d\n", + err); +- } + } + dev_info(&pdev->dev, "MAC address: %pM\n", adapter->hw.mac.addr); + if (netdev->features & NETIF_F_GRO) diff --git a/queue-5.10/ibmvnic-continue-fatal-error-reset-after-passive-init.patch b/queue-5.10/ibmvnic-continue-fatal-error-reset-after-passive-init.patch new file mode 100644 index 00000000000..2d1e95e3afd --- /dev/null +++ b/queue-5.10/ibmvnic-continue-fatal-error-reset-after-passive-init.patch @@ -0,0 +1,44 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Lijun Pan +Date: Sat, 19 Dec 2020 15:40:34 -0600 +Subject: ibmvnic: continue fatal error reset after passive init + +From: Lijun Pan + +[ Upstream commit 1f45dc22066797479072978feeada0852502e180 ] + +Commit f9c6cea0b385 ("ibmvnic: Skip fatal error reset after passive init") +says "If the passive +CRQ initialization occurs before the FATAL reset task is processed, +the FATAL error reset task would try to access a CRQ message queue +that was freed, causing an oops. The problem may be most likely to +occur during DLPAR add vNIC with a non-default MTU, because the DLPAR +process will automatically issue a change MTU request. +Fix this by not processing fatal error reset if CRQ is passively +initialized after client-driven CRQ initialization fails." + +Even with this commit, we still see similar kernel crashes. In order +to completely solve this problem, we'd better continue the fatal error +reset, capture the kernel crash, and try to fix it from that end. + +Fixes: f9c6cea0b385 ("ibmvnic: Skip fatal error reset after passive init") +Signed-off-by: Lijun Pan +Link: https://lore.kernel.org/r/20201219214034.21123-1-ljp@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmvnic.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2248,8 +2248,7 @@ static void __ibmvnic_reset(struct work_ + set_current_state(TASK_UNINTERRUPTIBLE); + schedule_timeout(60 * HZ); + } +- } else if (!(rwi->reset_reason == VNIC_RESET_FATAL && +- adapter->from_passive_init)) { ++ } else { + rc = do_reset(adapter, rwi, reset_state); + } + kfree(rwi); diff --git a/queue-5.10/ibmvnic-fix-login-buffer-memory-leak.patch b/queue-5.10/ibmvnic-fix-login-buffer-memory-leak.patch new file mode 100644 index 00000000000..5244dc80dea --- /dev/null +++ b/queue-5.10/ibmvnic-fix-login-buffer-memory-leak.patch @@ -0,0 +1,50 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Lijun Pan +Date: Sat, 19 Dec 2020 15:39:19 -0600 +Subject: ibmvnic: fix login buffer memory leak + +From: Lijun Pan + +[ Upstream commit a0c8be56affa7d5ffbdec24c992223be54db3b6e ] + +Commit 34f0f4e3f488 ("ibmvnic: Fix login buffer memory leaks") frees +login_rsp_buffer in release_resources() and send_login() +because handle_login_rsp() does not free it. +Commit f3ae59c0c015 ("ibmvnic: store RX and TX subCRQ handle array in +ibmvnic_adapter struct") frees login_rsp_buffer in handle_login_rsp(). +It seems unnecessary to free it in release_resources() and send_login(). +There are chances that handle_login_rsp returns earlier without freeing +buffers. Double-checking the buffer is harmless since +release_login_buffer and release_login_rsp_buffer will +do nothing if buffer is already freed. + +Fixes: f3ae59c0c015 ("ibmvnic: store RX and TX subCRQ handle array in ibmvnic_adapter struct") +Fixes: 34f0f4e3f488 ("ibmvnic: Fix login buffer memory leaks") +Signed-off-by: Lijun Pan +Link: https://lore.kernel.org/r/20201219213919.21045-1-ljp@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmvnic.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -932,6 +932,7 @@ static void release_resources(struct ibm + release_rx_pools(adapter); + + release_napi(adapter); ++ release_login_buffer(adapter); + release_login_rsp_buffer(adapter); + } + +@@ -3768,7 +3769,9 @@ static int send_login(struct ibmvnic_ada + return -1; + } + ++ release_login_buffer(adapter); + release_login_rsp_buffer(adapter); ++ + client_data_len = vnic_client_data_len(adapter); + + buffer_size = diff --git a/queue-5.10/ibmvnic-fix-null-pointer-dereference.patch b/queue-5.10/ibmvnic-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..0af26d20c6d --- /dev/null +++ b/queue-5.10/ibmvnic-fix-null-pointer-dereference.patch @@ -0,0 +1,46 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: YANG LI +Date: Wed, 30 Dec 2020 15:23:14 +0800 +Subject: ibmvnic: fix: NULL pointer dereference. + +From: YANG LI + +[ Upstream commit 862aecbd9569e563b979c0e23a908b43cda4b0b9 ] + +The error is due to dereference a null pointer in function +reset_one_sub_crq_queue(): + +if (!scrq) { + netdev_dbg(adapter->netdev, + "Invalid scrq reset. irq (%d) or msgs(%p).\n", + scrq->irq, scrq->msgs); + return -EINVAL; +} + +If the expression is true, scrq must be a null pointer and cannot +dereference. + +Fixes: 9281cf2d5840 ("ibmvnic: avoid memset null scrq msgs") +Signed-off-by: YANG LI +Reported-by: Abaci +Acked-by: Lijun Pan +Link: https://lore.kernel.org/r/1609312994-121032-1-git-send-email-abaci-bugfix@linux.alibaba.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmvnic.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2869,9 +2869,7 @@ static int reset_one_sub_crq_queue(struc + int rc; + + if (!scrq) { +- netdev_dbg(adapter->netdev, +- "Invalid scrq reset. irq (%d) or msgs (%p).\n", +- scrq->irq, scrq->msgs); ++ netdev_dbg(adapter->netdev, "Invalid scrq reset.\n"); + return -EINVAL; + } + diff --git a/queue-5.10/ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch b/queue-5.10/ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch new file mode 100644 index 00000000000..bc6aa3cd745 --- /dev/null +++ b/queue-5.10/ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Shannon Nelson +Date: Fri, 18 Dec 2020 13:50:01 -0800 +Subject: ionic: account for vlan tag len in rx buffer len + +From: Shannon Nelson + +[ Upstream commit 83469893204281ecf65d572bddf02de29a19787c ] + +Let the FW know we have enough receive buffer space for the +vlan tag if it isn't stripped. + +Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") +Signed-off-by: Shannon Nelson +Link: https://lore.kernel.org/r/20201218215001.64696-1-snelson@pensando.io +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -337,7 +337,7 @@ void ionic_rx_fill(struct ionic_queue *q + unsigned int i, j; + unsigned int len; + +- len = netdev->mtu + ETH_HLEN; ++ len = netdev->mtu + ETH_HLEN + VLAN_HLEN; + nfrags = round_up(len, PAGE_SIZE) / PAGE_SIZE; + + for (i = ionic_q_space_avail(q); i; i--) { diff --git a/queue-5.10/ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch b/queue-5.10/ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch new file mode 100644 index 00000000000..fc0aedbb969 --- /dev/null +++ b/queue-5.10/ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch @@ -0,0 +1,69 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Guillaume Nault +Date: Thu, 24 Dec 2020 20:01:09 +0100 +Subject: ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() + +From: Guillaume Nault + +[ Upstream commit 21fdca22eb7df2a1e194b8adb812ce370748b733 ] + +RT_TOS() only clears one of the ECN bits. Therefore, when +fib_compute_spec_dst() resorts to a fib lookup, it can return +different results depending on the value of the second ECN bit. + +For example, ECT(0) and ECT(1) packets could be treated differently. + + $ ip netns add ns0 + $ ip netns add ns1 + $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1 + $ ip -netns ns0 link set dev lo up + $ ip -netns ns1 link set dev lo up + $ ip -netns ns0 link set dev veth01 up + $ ip -netns ns1 link set dev veth10 up + + $ ip -netns ns0 address add 192.0.2.10/24 dev veth01 + $ ip -netns ns1 address add 192.0.2.11/24 dev veth10 + + $ ip -netns ns1 address add 192.0.2.21/32 dev lo + $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10 src 192.0.2.21 + $ ip netns exec ns1 sysctl -wq net.ipv4.icmp_echo_ignore_broadcasts=0 + +With TOS 4 and ECT(1), ns1 replies using source address 192.0.2.21 +(ping uses -Q to set all TOS and ECN bits): + + $ ip netns exec ns0 ping -c 1 -b -Q 5 192.0.2.255 + [...] + 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.544 ms + +But with TOS 4 and ECT(0), ns1 replies using source address 192.0.2.11 +because the "tos 4" route isn't matched: + + $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255 + [...] + 64 bytes from 192.0.2.11: icmp_seq=1 ttl=64 time=0.597 ms + +After this patch the ECN bits don't affect the result anymore: + + $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255 + [...] + 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.591 ms + +Fixes: 35ebf65e851c ("ipv4: Create and use fib_compute_spec_dst() helper.") +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/fib_frontend.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -292,7 +292,7 @@ __be32 fib_compute_spec_dst(struct sk_bu + .flowi4_iif = LOOPBACK_IFINDEX, + .flowi4_oif = l3mdev_master_ifindex_rcu(dev), + .daddr = ip_hdr(skb)->saddr, +- .flowi4_tos = RT_TOS(ip_hdr(skb)->tos), ++ .flowi4_tos = ip_hdr(skb)->tos & IPTOS_RT_MASK, + .flowi4_scope = scope, + .flowi4_mark = vmark ? skb->mark : 0, + }; diff --git a/queue-5.10/net-dcb-validate-netlink-message-in-dcb-handler.patch b/queue-5.10/net-dcb-validate-netlink-message-in-dcb-handler.patch new file mode 100644 index 00000000000..8fabd21443f --- /dev/null +++ b/queue-5.10/net-dcb-validate-netlink-message-in-dcb-handler.patch @@ -0,0 +1,47 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Petr Machata +Date: Tue, 22 Dec 2020 22:49:44 +0100 +Subject: net: dcb: Validate netlink message in DCB handler + +From: Petr Machata + +[ Upstream commit 826f328e2b7e8854dd42ea44e6519cd75018e7b1 ] + +DCB uses the same handler function for both RTM_GETDCB and RTM_SETDCB +messages. dcb_doit() bounces RTM_SETDCB mesasges if the user does not have +the CAP_NET_ADMIN capability. + +However, the operation to be performed is not decided from the DCB message +type, but from the DCB command. Thus DCB_CMD_*_GET commands are used for +reading DCB objects, the corresponding SET and DEL commands are used for +manipulation. + +The assumption is that set-like commands will be sent via an RTM_SETDCB +message, and get-like ones via RTM_GETDCB. However, this assumption is not +enforced. + +It is therefore possible to manipulate DCB objects without CAP_NET_ADMIN +capability by sending the corresponding command in an RTM_GETDCB message. +That is a bug. Fix it by validating the type of the request message against +the type used for the response. + +Fixes: 2f90b8657ec9 ("ixgbe: this patch adds support for DCB to the kernel and ixgbe driver") +Signed-off-by: Petr Machata +Link: https://lore.kernel.org/r/a2a9b88418f3a58ef211b718f2970128ef9e3793.1608673640.git.me@pmachata.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/dcb/dcbnl.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1765,6 +1765,8 @@ static int dcb_doit(struct sk_buff *skb, + fn = &reply_funcs[dcb->cmd]; + if (!fn->cb) + return -EOPNOTSUPP; ++ if (fn->type != nlh->nlmsg_type) ++ return -EPERM; + + if (!tb[DCB_ATTR_IFNAME]) + return -EINVAL; diff --git a/queue-5.10/net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch b/queue-5.10/net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch new file mode 100644 index 00000000000..3e8dac67c27 --- /dev/null +++ b/queue-5.10/net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Martin Blumenstingl +Date: Sun, 3 Jan 2021 02:25:43 +0100 +Subject: net: dsa: lantiq_gswip: Enable GSWIP_MII_CFG_EN also for internal PHYs + +From: Martin Blumenstingl + +[ Upstream commit c1a9ec7e5d577a9391660800c806c53287fca991 ] + +Enable GSWIP_MII_CFG_EN also for internal PHYs to make traffic flow. +Without this the PHY link is detected properly and ethtool statistics +for TX are increasing but there's no RX traffic coming in. + +Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") +Suggested-by: Hauke Mehrtens +Signed-off-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/lantiq_gswip.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/dsa/lantiq_gswip.c ++++ b/drivers/net/dsa/lantiq_gswip.c +@@ -1541,9 +1541,7 @@ static void gswip_phylink_mac_link_up(st + { + struct gswip_priv *priv = ds->priv; + +- /* Enable the xMII interface only for the external PHY */ +- if (interface != PHY_INTERFACE_MODE_INTERNAL) +- gswip_mii_mask_cfg(priv, 0, GSWIP_MII_CFG_EN, port); ++ gswip_mii_mask_cfg(priv, 0, GSWIP_MII_CFG_EN, port); + } + + static void gswip_get_strings(struct dsa_switch *ds, int port, u32 stringset, diff --git a/queue-5.10/net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch b/queue-5.10/net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch new file mode 100644 index 00000000000..e5d900a246f --- /dev/null +++ b/queue-5.10/net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch @@ -0,0 +1,78 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Martin Blumenstingl +Date: Sun, 3 Jan 2021 02:25:44 +0100 +Subject: net: dsa: lantiq_gswip: Fix GSWIP_MII_CFG(p) register access + +From: Martin Blumenstingl + +[ Upstream commit 709a3c9dff2a639966ae7d8ba6239d2b8aba036d ] + +There is one GSWIP_MII_CFG register for each switch-port except the CPU +port. The register offset for the first port is 0x0, 0x02 for the +second, 0x04 for the third and so on. + +Update the driver to not only restrict the GSWIP_MII_CFG registers to +ports 0, 1 and 5. Handle ports 0..5 instead but skip the CPU port. This +means we are not overwriting the configuration for the third port (port +two since we start counting from zero) with the settings for the sixth +port (with number five) anymore. + +The GSWIP_MII_PCDU(p) registers are not updated because there's really +only three (one for each of the following ports: 0, 1, 5). + +Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") +Signed-off-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/lantiq_gswip.c | 23 ++++++----------------- + 1 file changed, 6 insertions(+), 17 deletions(-) + +--- a/drivers/net/dsa/lantiq_gswip.c ++++ b/drivers/net/dsa/lantiq_gswip.c +@@ -92,9 +92,7 @@ + GSWIP_MDIO_PHY_FDUP_MASK) + + /* GSWIP MII Registers */ +-#define GSWIP_MII_CFG0 0x00 +-#define GSWIP_MII_CFG1 0x02 +-#define GSWIP_MII_CFG5 0x04 ++#define GSWIP_MII_CFGp(p) (0x2 * (p)) + #define GSWIP_MII_CFG_EN BIT(14) + #define GSWIP_MII_CFG_LDCLKDIS BIT(12) + #define GSWIP_MII_CFG_MODE_MIIP 0x0 +@@ -392,17 +390,9 @@ static void gswip_mii_mask(struct gswip_ + static void gswip_mii_mask_cfg(struct gswip_priv *priv, u32 clear, u32 set, + int port) + { +- switch (port) { +- case 0: +- gswip_mii_mask(priv, clear, set, GSWIP_MII_CFG0); +- break; +- case 1: +- gswip_mii_mask(priv, clear, set, GSWIP_MII_CFG1); +- break; +- case 5: +- gswip_mii_mask(priv, clear, set, GSWIP_MII_CFG5); +- break; +- } ++ /* There's no MII_CFG register for the CPU port */ ++ if (!dsa_is_cpu_port(priv->ds, port)) ++ gswip_mii_mask(priv, clear, set, GSWIP_MII_CFGp(port)); + } + + static void gswip_mii_mask_pcdu(struct gswip_priv *priv, u32 clear, u32 set, +@@ -822,9 +812,8 @@ static int gswip_setup(struct dsa_switch + gswip_mdio_mask(priv, 0xff, 0x09, GSWIP_MDIO_MDC_CFG1); + + /* Disable the xMII link */ +- gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, 0); +- gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, 1); +- gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, 5); ++ for (i = 0; i < priv->hw_info->max_ports; i++) ++ gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, i); + + /* enable special tag insertion on cpu port */ + gswip_switch_mask(priv, 0, GSWIP_FDMA_PCTRL_STEN, diff --git a/queue-5.10/net-ethernet-fix-memleak-in-ethoc_probe.patch b/queue-5.10/net-ethernet-fix-memleak-in-ethoc_probe.patch new file mode 100644 index 00000000000..806b3ef3a9a --- /dev/null +++ b/queue-5.10/net-ethernet-fix-memleak-in-ethoc_probe.patch @@ -0,0 +1,42 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Dinghao Liu +Date: Wed, 23 Dec 2020 19:06:12 +0800 +Subject: net: ethernet: Fix memleak in ethoc_probe + +From: Dinghao Liu + +[ Upstream commit 5d41f9b7ee7a5a5138894f58846a4ffed601498a ] + +When mdiobus_register() fails, priv->mdio allocated +by mdiobus_alloc() has not been freed, which leads +to memleak. + +Fixes: e7f4dc3536a4 ("mdio: Move allocation of interrupts into core") +Signed-off-by: Dinghao Liu +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20201223110615.31389-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ethoc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ethoc.c ++++ b/drivers/net/ethernet/ethoc.c +@@ -1211,7 +1211,7 @@ static int ethoc_probe(struct platform_d + ret = mdiobus_register(priv->mdio); + if (ret) { + dev_err(&netdev->dev, "failed to register MDIO bus\n"); +- goto free2; ++ goto free3; + } + + ret = ethoc_mdio_probe(netdev); +@@ -1243,6 +1243,7 @@ error2: + netif_napi_del(&priv->napi); + error: + mdiobus_unregister(priv->mdio); ++free3: + mdiobus_free(priv->mdio); + free2: + clk_disable_unprepare(priv->clk); diff --git a/queue-5.10/net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch b/queue-5.10/net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch new file mode 100644 index 00000000000..247dfa2754e --- /dev/null +++ b/queue-5.10/net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Dinghao Liu +Date: Sun, 20 Dec 2020 16:29:30 +0800 +Subject: net: ethernet: mvneta: Fix error handling in mvneta_probe + +From: Dinghao Liu + +[ Upstream commit 58f60329a6be35a5653edb3fd2023ccef9eb9943 ] + +When mvneta_port_power_up() fails, we should execute +cleanup functions after label err_netdev to avoid memleak. + +Fixes: 41c2b6b4f0f80 ("net: ethernet: mvneta: Add back interface mode validation") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20201220082930.21623-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvneta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -5232,7 +5232,7 @@ static int mvneta_probe(struct platform_ + err = mvneta_port_power_up(pp, pp->phy_interface); + if (err < 0) { + dev_err(&pdev->dev, "can't power up port\n"); +- return err; ++ goto err_netdev; + } + + /* Armada3700 network controller does not support per-cpu diff --git a/queue-5.10/net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch b/queue-5.10/net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch new file mode 100644 index 00000000000..1a67b7d8268 --- /dev/null +++ b/queue-5.10/net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch @@ -0,0 +1,46 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Grygorii Strashko +Date: Thu, 24 Dec 2020 18:24:05 +0200 +Subject: net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered + +From: Grygorii Strashko + +[ Upstream commit 4614792eebcbf81c60ad3604c1aeeb2b0899cea4 ] + +The CPTS driver registers PTP PHC clock when first netif is going up and +unregister it when all netif are down. Now ethtool will show: + - PTP PHC clock index 0 after boot until first netif is up; + - the last assigned PTP PHC clock index even if PTP PHC clock is not +registered any more after all netifs are down. + +This patch ensures that -1 is returned by ethtool when PTP PHC clock is not +registered any more. + +Fixes: 8a2c9a5ab4b9 ("net: ethernet: ti: cpts: rework initialization/deinitialization") +Signed-off-by: Grygorii Strashko +Acked-by: Richard Cochran +Link: https://lore.kernel.org/r/20201224162405.28032-1-grygorii.strashko@ti.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpts.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/ti/cpts.c ++++ b/drivers/net/ethernet/ti/cpts.c +@@ -599,6 +599,7 @@ void cpts_unregister(struct cpts *cpts) + + ptp_clock_unregister(cpts->clock); + cpts->clock = NULL; ++ cpts->phc_index = -1; + + cpts_write32(cpts, 0, int_enable); + cpts_write32(cpts, 0, control); +@@ -784,6 +785,7 @@ struct cpts *cpts_create(struct device * + cpts->cc.read = cpts_systim_read; + cpts->cc.mask = CLOCKSOURCE_MASK(32); + cpts->info = cpts_info; ++ cpts->phc_index = -1; + + if (n_ext_ts) + cpts->info.n_ext_ts = n_ext_ts; diff --git a/queue-5.10/net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch b/queue-5.10/net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch new file mode 100644 index 00000000000..2f48fbc136e --- /dev/null +++ b/queue-5.10/net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch @@ -0,0 +1,44 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Xie He +Date: Sun, 27 Dec 2020 18:53:39 -0800 +Subject: net: hdlc_ppp: Fix issues when mod_timer is called while timer is running + +From: Xie He + +[ Upstream commit 1fef73597fa545c35fddc953979013882fbd4e55 ] + +ppp_cp_event is called directly or indirectly by ppp_rx with "ppp->lock" +held. It may call mod_timer to add a new timer. However, at the same time +ppp_timer may be already running and waiting for "ppp->lock". In this +case, there's no need for ppp_timer to continue running and it can just +exit. + +If we let ppp_timer continue running, it may call add_timer. This causes +kernel panic because add_timer can't be called with a timer pending. +This patch fixes this problem. + +Fixes: e022c2f07ae5 ("WAN: new synchronous PPP implementation for generic HDLC.") +Cc: Krzysztof Halasa +Signed-off-by: Xie He +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wan/hdlc_ppp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/wan/hdlc_ppp.c ++++ b/drivers/net/wan/hdlc_ppp.c +@@ -569,6 +569,13 @@ static void ppp_timer(struct timer_list + unsigned long flags; + + spin_lock_irqsave(&ppp->lock, flags); ++ /* mod_timer could be called after we entered this function but ++ * before we got the lock. ++ */ ++ if (timer_pending(&proto->timer)) { ++ spin_unlock_irqrestore(&ppp->lock, flags); ++ return; ++ } + switch (proto->state) { + case STOPPING: + case REQ_SENT: diff --git a/queue-5.10/net-hns-fix-return-value-check-in-__lb_other_process.patch b/queue-5.10/net-hns-fix-return-value-check-in-__lb_other_process.patch new file mode 100644 index 00000000000..6ffdd885265 --- /dev/null +++ b/queue-5.10/net-hns-fix-return-value-check-in-__lb_other_process.patch @@ -0,0 +1,33 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Yunjian Wang +Date: Sat, 26 Dec 2020 16:10:05 +0800 +Subject: net: hns: fix return value check in __lb_other_process() + +From: Yunjian Wang + +[ Upstream commit 5ede3ada3da7f050519112b81badc058190b9f9f ] + +The function skb_copy() could return NULL, the return value +need to be checked. + +Fixes: b5996f11ea54 ("net: add Hisilicon Network Subsystem basic ethernet support") +Signed-off-by: Yunjian Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -415,6 +415,10 @@ static void __lb_other_process(struct hn + /* for mutl buffer*/ + new_skb = skb_copy(skb, GFP_ATOMIC); + dev_kfree_skb_any(skb); ++ if (!new_skb) { ++ netdev_err(ndev, "skb alloc failed\n"); ++ return; ++ } + skb = new_skb; + + check_ok = 0; diff --git a/queue-5.10/net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch b/queue-5.10/net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch new file mode 100644 index 00000000000..51a3187210b --- /dev/null +++ b/queue-5.10/net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch @@ -0,0 +1,89 @@ +From foo@baz Sun Jan 10 11:18:58 AM CET 2021 +From: Stefan Chulski +Date: Thu, 17 Dec 2020 20:30:17 +0200 +Subject: net: mvpp2: Add TCAM entry to drop flow control pause frames + +From: Stefan Chulski + +[ Upstream commit 3f48fab62bb81a7f9d01e9d43c40395fad011dd5 ] + +Issue: +Flow control frame used to pause GoP(MAC) was delivered to the CPU +and created a load on the CPU. Since XOFF/XON frames are used only +by MAC, these frames should be dropped inside MAC. + +Fix: +According to 802.3-2012 - IEEE Standard for Ethernet pause frame +has unique destination MAC address 01-80-C2-00-00-01. +Add TCAM parser entry to track and drop pause frames by destination MAC. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608229817-21951-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 33 +++++++++++++++++++++++++ + drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h | 2 - + 2 files changed, 34 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -405,6 +405,38 @@ static int mvpp2_prs_tcam_first_free(str + return -EINVAL; + } + ++/* Drop flow control pause frames */ ++static void mvpp2_prs_drop_fc(struct mvpp2 *priv) ++{ ++ unsigned char da[ETH_ALEN] = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x01 }; ++ struct mvpp2_prs_entry pe; ++ unsigned int len; ++ ++ memset(&pe, 0, sizeof(pe)); ++ ++ /* For all ports - drop flow control frames */ ++ pe.index = MVPP2_PE_FC_DROP; ++ mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC); ++ ++ /* Set match on DA */ ++ len = ETH_ALEN; ++ while (len--) ++ mvpp2_prs_tcam_data_byte_set(&pe, len, da[len], 0xff); ++ ++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_DROP_MASK, ++ MVPP2_PRS_RI_DROP_MASK); ++ ++ mvpp2_prs_sram_bits_set(&pe, MVPP2_PRS_SRAM_LU_GEN_BIT, 1); ++ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_FLOWS); ++ ++ /* Mask all ports */ ++ mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK); ++ ++ /* Update shadow table and hw entry */ ++ mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_MAC); ++ mvpp2_prs_hw_write(priv, &pe); ++} ++ + /* Enable/disable dropping all mac da's */ + static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add) + { +@@ -1162,6 +1194,7 @@ static void mvpp2_prs_mac_init(struct mv + mvpp2_prs_hw_write(priv, &pe); + + /* Create dummy entries for drop all and promiscuous modes */ ++ mvpp2_prs_drop_fc(priv); + mvpp2_prs_mac_drop_all_set(priv, 0, false); + mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false); + mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false); +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h +@@ -129,7 +129,7 @@ + #define MVPP2_PE_VID_EDSA_FLTR_DEFAULT (MVPP2_PRS_TCAM_SRAM_SIZE - 7) + #define MVPP2_PE_VLAN_DBL (MVPP2_PRS_TCAM_SRAM_SIZE - 6) + #define MVPP2_PE_VLAN_NONE (MVPP2_PRS_TCAM_SRAM_SIZE - 5) +-/* reserved */ ++#define MVPP2_PE_FC_DROP (MVPP2_PRS_TCAM_SRAM_SIZE - 4) + #define MVPP2_PE_MAC_MC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 3) + #define MVPP2_PE_MAC_UC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 2) + #define MVPP2_PE_MAC_NON_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 1) diff --git a/queue-5.10/net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch b/queue-5.10/net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch new file mode 100644 index 00000000000..cef13553380 --- /dev/null +++ b/queue-5.10/net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Stefan Chulski +Date: Sun, 20 Dec 2020 13:02:29 +0200 +Subject: net: mvpp2: Fix GoP port 3 Networking Complex Control configurations + +From: Stefan Chulski + +[ Upstream commit 2575bc1aa9d52a62342b57a0b7d0a12146cf6aed ] + +During GoP port 2 Networking Complex Control mode of operation configurations, +also GoP port 3 mode of operation was wrongly set. +Patch removes these configurations. + +Fixes: f84bf386f395 ("net: mvpp2: initialize the GoP") +Acked-by: Marcin Wojtas +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608462149-1702-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -1231,7 +1231,7 @@ static void mvpp22_gop_init_rgmii(struct + + regmap_read(priv->sysctrl_base, GENCONF_CTRL0, &val); + if (port->gop_id == 2) +- val |= GENCONF_CTRL0_PORT0_RGMII | GENCONF_CTRL0_PORT1_RGMII; ++ val |= GENCONF_CTRL0_PORT0_RGMII; + else if (port->gop_id == 3) + val |= GENCONF_CTRL0_PORT1_RGMII_MII; + regmap_write(priv->sysctrl_base, GENCONF_CTRL0, val); diff --git a/queue-5.10/net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch b/queue-5.10/net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch new file mode 100644 index 00000000000..71f0e028cf7 --- /dev/null +++ b/queue-5.10/net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch @@ -0,0 +1,48 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Stefan Chulski +Date: Wed, 23 Dec 2020 20:35:21 +0200 +Subject: net: mvpp2: fix pkt coalescing int-threshold configuration + +From: Stefan Chulski + +[ Upstream commit 4f374d2c43a9e5e773f1dee56db63bd6b8a36276 ] + +The packet coalescing interrupt threshold has separated registers +for different aggregated/cpu (sw-thread). The required value should +be loaded for every thread but not only for 1 current cpu. + +Fixes: 213f428f5056 ("net: mvpp2: add support for TX interrupts and RX queue distribution modes") +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608748521-11033-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -2370,17 +2370,18 @@ static void mvpp2_rx_pkts_coal_set(struc + static void mvpp2_tx_pkts_coal_set(struct mvpp2_port *port, + struct mvpp2_tx_queue *txq) + { +- unsigned int thread = mvpp2_cpu_to_thread(port->priv, get_cpu()); ++ unsigned int thread; + u32 val; + + if (txq->done_pkts_coal > MVPP2_TXQ_THRESH_MASK) + txq->done_pkts_coal = MVPP2_TXQ_THRESH_MASK; + + val = (txq->done_pkts_coal << MVPP2_TXQ_THRESH_OFFSET); +- mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_NUM_REG, txq->id); +- mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_THRESH_REG, val); +- +- put_cpu(); ++ /* PKT-coalescing registers are per-queue + per-thread */ ++ for (thread = 0; thread < MVPP2_MAX_THREADS; thread++) { ++ mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_NUM_REG, txq->id); ++ mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_THRESH_REG, val); ++ } + } + + static u32 mvpp2_usec_to_cycles(u32 usec, unsigned long clk_hz) diff --git a/queue-5.10/net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch b/queue-5.10/net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch new file mode 100644 index 00000000000..21f7162fd23 --- /dev/null +++ b/queue-5.10/net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Jan 10 11:18:58 AM CET 2021 +From: Stefan Chulski +Date: Thu, 17 Dec 2020 20:37:46 +0200 +Subject: net: mvpp2: prs: fix PPPoE with ipv6 packet parse + +From: Stefan Chulski + +[ Upstream commit fec6079b2eeab319d9e3d074f54d3b6f623e9701 ] + +Current PPPoE+IPv6 entry is jumping to 'next-hdr' +field and not to 'DIP' field as done for IPv4. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Reported-by: Liron Himi +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608230266-22111-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -1680,8 +1680,9 @@ static int mvpp2_prs_pppoe_init(struct m + mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP6); + mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP6, + MVPP2_PRS_RI_L3_PROTO_MASK); +- /* Skip eth_type + 4 bytes of IPv6 header */ +- mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 4, ++ /* Jump to DIP of IPV6 header */ ++ mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 8 + ++ MVPP2_MAX_L3_ADDR_SIZE, + MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD); + /* Set L3 offset */ + mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3, diff --git a/queue-5.10/net-ncsi-use-real-net-device-for-response-handler.patch b/queue-5.10/net-ncsi-use-real-net-device-for-response-handler.patch new file mode 100644 index 00000000000..c566f075314 --- /dev/null +++ b/queue-5.10/net-ncsi-use-real-net-device-for-response-handler.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: John Wang +Date: Wed, 23 Dec 2020 13:55:23 +0800 +Subject: net/ncsi: Use real net-device for response handler + +From: John Wang + +[ Upstream commit 427c940558560bff2583d07fc119a21094675982 ] + +When aggregating ncsi interfaces and dedicated interfaces to bond +interfaces, the ncsi response handler will use the wrong net device to +find ncsi_dev, so that the ncsi interface will not work properly. +Here, we use the original net device to fix it. + +Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler") +Signed-off-by: John Wang +Link: https://lore.kernel.org/r/20201223055523.2069-1-wangzhiqiang.bj@bytedance.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ncsi/ncsi-rsp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ncsi/ncsi-rsp.c ++++ b/net/ncsi/ncsi-rsp.c +@@ -1120,7 +1120,7 @@ int ncsi_rcv_rsp(struct sk_buff *skb, st + int payload, i, ret; + + /* Find the NCSI device */ +- nd = ncsi_find_dev(dev); ++ nd = ncsi_find_dev(orig_dev); + ndp = nd ? TO_NCSI_DEV_PRIV(nd) : NULL; + if (!ndp) + return -ENODEV; diff --git a/queue-5.10/net-sched-prevent-invalid-scell_log-shift-count.patch b/queue-5.10/net-sched-prevent-invalid-scell_log-shift-count.patch new file mode 100644 index 00000000000..a0e9f00b1d5 --- /dev/null +++ b/queue-5.10/net-sched-prevent-invalid-scell_log-shift-count.patch @@ -0,0 +1,98 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Randy Dunlap +Date: Thu, 24 Dec 2020 22:23:44 -0800 +Subject: net: sched: prevent invalid Scell_log shift count + +From: Randy Dunlap + +[ Upstream commit bd1248f1ddbc48b0c30565fce897a3b6423313b8 ] + +Check Scell_log shift size in red_check_params() and modify all callers +of red_check_params() to pass Scell_log. + +This prevents a shift out-of-bounds as detected by UBSAN: + UBSAN: shift-out-of-bounds in ./include/net/red.h:252:22 + shift exponent 72 is too large for 32-bit type 'int' + +Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values") +Signed-off-by: Randy Dunlap +Reported-by: syzbot+97c5bd9cc81eca63d36e@syzkaller.appspotmail.com +Cc: Nogah Frankel +Cc: Jamal Hadi Salim +Cc: Cong Wang +Cc: Jiri Pirko +Cc: netdev@vger.kernel.org +Cc: "David S. Miller" +Cc: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/red.h | 4 +++- + net/sched/sch_choke.c | 2 +- + net/sched/sch_gred.c | 2 +- + net/sched/sch_red.c | 2 +- + net/sched/sch_sfq.c | 2 +- + 5 files changed, 7 insertions(+), 5 deletions(-) + +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -168,12 +168,14 @@ static inline void red_set_vars(struct r + v->qcount = -1; + } + +-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog) ++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log) + { + if (fls(qth_min) + Wlog > 32) + return false; + if (fls(qth_max) + Wlog > 32) + return false; ++ if (Scell_log >= 32) ++ return false; + if (qth_max < qth_min) + return false; + return true; +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -362,7 +362,7 @@ static int choke_change(struct Qdisc *sc + + ctl = nla_data(tb[TCA_CHOKE_PARMS]); + +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + return -EINVAL; + + if (ctl->limit > CHOKE_MAX_QUEUE) +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -480,7 +480,7 @@ static inline int gred_change_vq(struct + struct gred_sched *table = qdisc_priv(sch); + struct gred_sched_data *q = table->tab[dp]; + +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) { ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) { + NL_SET_ERR_MSG_MOD(extack, "invalid RED parameters"); + return -EINVAL; + } +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -250,7 +250,7 @@ static int __red_change(struct Qdisc *sc + max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_RED_PARMS]); +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + return -EINVAL; + + err = red_get_flags(ctl->flags, TC_RED_HISTORIC_FLAGS, +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -647,7 +647,7 @@ static int sfq_change(struct Qdisc *sch, + } + + if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, +- ctl_v1->Wlog)) ++ ctl_v1->Wlog, ctl_v1->Scell_log)) + return -EINVAL; + if (ctl_v1 && ctl_v1->qth_min) { + p = kmalloc(sizeof(*p), GFP_KERNEL); diff --git a/queue-5.10/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch b/queue-5.10/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch new file mode 100644 index 00000000000..e621b063123 --- /dev/null +++ b/queue-5.10/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch @@ -0,0 +1,48 @@ +From foo@baz Sun Jan 10 11:18:58 AM CET 2021 +From: Davide Caratti +Date: Thu, 17 Dec 2020 22:29:46 +0100 +Subject: net/sched: sch_taprio: ensure to reset/destroy all child qdiscs + +From: Davide Caratti + +[ Upstream commit 698285da79f5b0b099db15a37ac661ac408c80eb ] + +taprio_graft() can insert a NULL element in the array of child qdiscs. As +a consquence, taprio_reset() might not reset child qdiscs completely, and +taprio_destroy() might leak resources. Fix it by ensuring that loops that +iterate over q->qdiscs[] don't end when they find the first NULL item. + +Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them") +Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") +Suggested-by: Jakub Kicinski +Signed-off-by: Davide Caratti +Link: https://lore.kernel.org/r/13edef6778fef03adc751582562fba4a13e06d6a.1608240532.git.dcaratti@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_taprio.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1604,8 +1604,9 @@ static void taprio_reset(struct Qdisc *s + + hrtimer_cancel(&q->advance_timer); + if (q->qdiscs) { +- for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++) +- qdisc_reset(q->qdiscs[i]); ++ for (i = 0; i < dev->num_tx_queues; i++) ++ if (q->qdiscs[i]) ++ qdisc_reset(q->qdiscs[i]); + } + sch->qstats.backlog = 0; + sch->q.qlen = 0; +@@ -1625,7 +1626,7 @@ static void taprio_destroy(struct Qdisc + taprio_disable_offload(dev, q, NULL); + + if (q->qdiscs) { +- for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++) ++ for (i = 0; i < dev->num_tx_queues; i++) + qdisc_put(q->qdiscs[i]); + + kfree(q->qdiscs); diff --git a/queue-5.10/net-stmmac-dwmac-meson8b-ignore-the-second-clock-input.patch b/queue-5.10/net-stmmac-dwmac-meson8b-ignore-the-second-clock-input.patch new file mode 100644 index 00000000000..1c801492b21 --- /dev/null +++ b/queue-5.10/net-stmmac-dwmac-meson8b-ignore-the-second-clock-input.patch @@ -0,0 +1,61 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Martin Blumenstingl +Date: Sat, 19 Dec 2020 14:50:36 +0100 +Subject: net: stmmac: dwmac-meson8b: ignore the second clock input + +From: Martin Blumenstingl + +[ Upstream commit f87777a3c30cf50c66a20e1d153f0e003bb30774 ] + +The dwmac glue registers on Amlogic Meson8b and newer SoCs has two clock +inputs: +- Meson8b and Meson8m2: MPLL2 and MPLL2 (the same parent is wired to + both inputs) +- GXBB, GXL, GXM, AXG, G12A, G12B, SM1: FCLK_DIV2 and MPLL2 + +All known vendor kernels and u-boots are using the first input only. We +let the common clock framework automatically choose the "right" parent. +For some boards this causes a problem though, specificially with G12A and +newer SoCs. The clock input is used for generating the 125MHz RGMII TX +clock. For the two input clocks this means on G12A: +- FCLK_DIV2: 999999985Hz / 8 = 124999998.125Hz +- MPLL2: 499999993Hz / 4 = 124999998.25Hz + +In theory MPLL2 is the "better" clock input because it's gets us 0.125Hz +closer to the requested frequency than FCLK_DIV2. In reality however +there is a resource conflict because MPLL2 is needed to generate some of +the audio clocks. dwmac-meson8b probes first and sets up the clock tree +with MPLL2. This works fine until the audio driver comes and "steals" +the MPLL2 clocks and configures it with it's own rate (294909637Hz). The +common clock framework happily changes the MPLL2 rate but does not +reconfigure our RGMII TX clock tree, which then ends up at 73727409Hz, +which is more than 40% off the requested 125MHz. + +Don't use the second clock input for now to force the common clock +framework to always select the first parent. This mimics the behavior +from the vendor driver and fixes the clock resource conflict with the +audio driver on G12A boards. Once the common clock framework can handle +this situation this change can be reverted again. + +Fixes: 566e8251625304 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC") +Reported-by: Thomas Graichen +Signed-off-by: Martin Blumenstingl +Tested-by: thomas graichen +Link: https://lore.kernel.org/r/20201219135036.3216017-1-martin.blumenstingl@googlemail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +@@ -135,7 +135,7 @@ static int meson8b_init_rgmii_tx_clk(str + struct device *dev = dwmac->dev; + static const struct clk_parent_data mux_parents[] = { + { .fw_name = "clkin0", }, +- { .fw_name = "clkin1", }, ++ { .index = -1, }, + }; + static const struct clk_div_table div_table[] = { + { .div = 2, .val = 2, }, diff --git a/queue-5.10/net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch b/queue-5.10/net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch new file mode 100644 index 00000000000..215a9f5c849 --- /dev/null +++ b/queue-5.10/net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch @@ -0,0 +1,89 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Antoine Tenart +Date: Wed, 23 Dec 2020 22:23:21 +0100 +Subject: net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc + +From: Antoine Tenart + +[ Upstream commit fb25038586d0064123e393cadf1fadd70a9df97a ] + +Accesses to dev->xps_cpus_map (when using dev->num_tc) should be +protected by the rtnl lock, like we do for netif_set_xps_queue. I didn't +see an actual bug being triggered, but let's be safe here and take the +rtnl lock while accessing the map in sysfs. + +Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes") +Signed-off-by: Antoine Tenart +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 29 ++++++++++++++++++++++------- + 1 file changed, 22 insertions(+), 7 deletions(-) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1317,8 +1317,8 @@ static const struct attribute_group dql_ + static ssize_t xps_cpus_show(struct netdev_queue *queue, + char *buf) + { ++ int cpu, len, ret, num_tc = 1, tc = 0; + struct net_device *dev = queue->dev; +- int cpu, len, num_tc = 1, tc = 0; + struct xps_dev_maps *dev_maps; + cpumask_var_t mask; + unsigned long index; +@@ -1328,22 +1328,31 @@ static ssize_t xps_cpus_show(struct netd + + index = get_netdev_queue_index(queue); + ++ if (!rtnl_trylock()) ++ return restart_syscall(); ++ + if (dev->num_tc) { + /* Do not allow XPS on subordinate device directly */ + num_tc = dev->num_tc; +- if (num_tc < 0) +- return -EINVAL; ++ if (num_tc < 0) { ++ ret = -EINVAL; ++ goto err_rtnl_unlock; ++ } + + /* If queue belongs to subordinate dev use its map */ + dev = netdev_get_tx_queue(dev, index)->sb_dev ? : dev; + + tc = netdev_txq_to_tc(dev, index); +- if (tc < 0) +- return -EINVAL; ++ if (tc < 0) { ++ ret = -EINVAL; ++ goto err_rtnl_unlock; ++ } + } + +- if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) +- return -ENOMEM; ++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) { ++ ret = -ENOMEM; ++ goto err_rtnl_unlock; ++ } + + rcu_read_lock(); + dev_maps = rcu_dereference(dev->xps_cpus_map); +@@ -1366,9 +1375,15 @@ static ssize_t xps_cpus_show(struct netd + } + rcu_read_unlock(); + ++ rtnl_unlock(); ++ + len = snprintf(buf, PAGE_SIZE, "%*pb\n", cpumask_pr_args(mask)); + free_cpumask_var(mask); + return len < PAGE_SIZE ? len : -EINVAL; ++ ++err_rtnl_unlock: ++ rtnl_unlock(); ++ return ret; + } + + static ssize_t xps_cpus_store(struct netdev_queue *queue, diff --git a/queue-5.10/net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch b/queue-5.10/net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch new file mode 100644 index 00000000000..22e83eec196 --- /dev/null +++ b/queue-5.10/net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch @@ -0,0 +1,77 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Antoine Tenart +Date: Wed, 23 Dec 2020 22:23:23 +0100 +Subject: net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc + +From: Antoine Tenart + +[ Upstream commit 4ae2bb81649dc03dfc95875f02126b14b773f7ab ] + +Accesses to dev->xps_rxqs_map (when using dev->num_tc) should be +protected by the rtnl lock, like we do for netif_set_xps_queue. I didn't +see an actual bug being triggered, but let's be safe here and take the +rtnl lock while accessing the map in sysfs. + +Fixes: 8af2c06ff4b1 ("net-sysfs: Add interface for Rx queue(s) map per Tx queue") +Signed-off-by: Antoine Tenart +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1429,22 +1429,29 @@ static struct netdev_queue_attribute xps + + static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf) + { ++ int j, len, ret, num_tc = 1, tc = 0; + struct net_device *dev = queue->dev; + struct xps_dev_maps *dev_maps; + unsigned long *mask, index; +- int j, len, num_tc = 1, tc = 0; + + index = get_netdev_queue_index(queue); + ++ if (!rtnl_trylock()) ++ return restart_syscall(); ++ + if (dev->num_tc) { + num_tc = dev->num_tc; + tc = netdev_txq_to_tc(dev, index); +- if (tc < 0) +- return -EINVAL; ++ if (tc < 0) { ++ ret = -EINVAL; ++ goto err_rtnl_unlock; ++ } + } + mask = bitmap_zalloc(dev->num_rx_queues, GFP_KERNEL); +- if (!mask) +- return -ENOMEM; ++ if (!mask) { ++ ret = -ENOMEM; ++ goto err_rtnl_unlock; ++ } + + rcu_read_lock(); + dev_maps = rcu_dereference(dev->xps_rxqs_map); +@@ -1470,10 +1477,16 @@ static ssize_t xps_rxqs_show(struct netd + out_no_maps: + rcu_read_unlock(); + ++ rtnl_unlock(); ++ + len = bitmap_print_to_pagebuf(false, buf, mask, dev->num_rx_queues); + bitmap_free(mask); + + return len < PAGE_SIZE ? len : -EINVAL; ++ ++err_rtnl_unlock: ++ rtnl_unlock(); ++ return ret; + } + + static ssize_t xps_rxqs_store(struct netdev_queue *queue, const char *buf, diff --git a/queue-5.10/net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch b/queue-5.10/net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch new file mode 100644 index 00000000000..c5e390e72d0 --- /dev/null +++ b/queue-5.10/net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch @@ -0,0 +1,75 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Antoine Tenart +Date: Wed, 23 Dec 2020 22:23:20 +0100 +Subject: net-sysfs: take the rtnl lock when storing xps_cpus + +From: Antoine Tenart + +[ Upstream commit 1ad58225dba3f2f598d2c6daed4323f24547168f ] + +Two race conditions can be triggered when storing xps cpus, resulting in +various oops and invalid memory accesses: + +1. Calling netdev_set_num_tc while netif_set_xps_queue: + + - netif_set_xps_queue uses dev->tc_num as one of the parameters to + compute the size of new_dev_maps when allocating it. dev->tc_num is + also used to access the map, and the compiler may generate code to + retrieve this field multiple times in the function. + + - netdev_set_num_tc sets dev->tc_num. + + If new_dev_maps is allocated using dev->tc_num and then dev->tc_num + is set to a higher value through netdev_set_num_tc, later accesses to + new_dev_maps in netif_set_xps_queue could lead to accessing memory + outside of new_dev_maps; triggering an oops. + +2. Calling netif_set_xps_queue while netdev_set_num_tc is running: + + 2.1. netdev_set_num_tc starts by resetting the xps queues, + dev->tc_num isn't updated yet. + + 2.2. netif_set_xps_queue is called, setting up the map with the + *old* dev->num_tc. + + 2.3. netdev_set_num_tc updates dev->tc_num. + + 2.4. Later accesses to the map lead to out of bound accesses and + oops. + + A similar issue can be found with netdev_reset_tc. + +One way of triggering this is to set an iface up (for which the driver +uses netdev_set_num_tc in the open path, such as bnx2x) and writing to +xps_cpus in a concurrent thread. With the right timing an oops is +triggered. + +Both issues have the same fix: netif_set_xps_queue, netdev_set_num_tc +and netdev_reset_tc should be mutually exclusive. We do that by taking +the rtnl lock in xps_cpus_store. + +Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes") +Signed-off-by: Antoine Tenart +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1396,7 +1396,13 @@ static ssize_t xps_cpus_store(struct net + return err; + } + ++ if (!rtnl_trylock()) { ++ free_cpumask_var(mask); ++ return restart_syscall(); ++ } ++ + err = netif_set_xps_queue(dev, mask, index); ++ rtnl_unlock(); + + free_cpumask_var(mask); + diff --git a/queue-5.10/net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch b/queue-5.10/net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch new file mode 100644 index 00000000000..d64f7473ff7 --- /dev/null +++ b/queue-5.10/net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch @@ -0,0 +1,79 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Antoine Tenart +Date: Wed, 23 Dec 2020 22:23:22 +0100 +Subject: net-sysfs: take the rtnl lock when storing xps_rxqs + +From: Antoine Tenart + +[ Upstream commit 2d57b4f142e0b03e854612b8e28978935414bced ] + +Two race conditions can be triggered when storing xps rxqs, resulting in +various oops and invalid memory accesses: + +1. Calling netdev_set_num_tc while netif_set_xps_queue: + + - netif_set_xps_queue uses dev->tc_num as one of the parameters to + compute the size of new_dev_maps when allocating it. dev->tc_num is + also used to access the map, and the compiler may generate code to + retrieve this field multiple times in the function. + + - netdev_set_num_tc sets dev->tc_num. + + If new_dev_maps is allocated using dev->tc_num and then dev->tc_num + is set to a higher value through netdev_set_num_tc, later accesses to + new_dev_maps in netif_set_xps_queue could lead to accessing memory + outside of new_dev_maps; triggering an oops. + +2. Calling netif_set_xps_queue while netdev_set_num_tc is running: + + 2.1. netdev_set_num_tc starts by resetting the xps queues, + dev->tc_num isn't updated yet. + + 2.2. netif_set_xps_queue is called, setting up the map with the + *old* dev->num_tc. + + 2.3. netdev_set_num_tc updates dev->tc_num. + + 2.4. Later accesses to the map lead to out of bound accesses and + oops. + + A similar issue can be found with netdev_reset_tc. + +One way of triggering this is to set an iface up (for which the driver +uses netdev_set_num_tc in the open path, such as bnx2x) and writing to +xps_rxqs in a concurrent thread. With the right timing an oops is +triggered. + +Both issues have the same fix: netif_set_xps_queue, netdev_set_num_tc +and netdev_reset_tc should be mutually exclusive. We do that by taking +the rtnl lock in xps_rxqs_store. + +Fixes: 8af2c06ff4b1 ("net-sysfs: Add interface for Rx queue(s) map per Tx queue") +Signed-off-by: Antoine Tenart +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1499,10 +1499,17 @@ static ssize_t xps_rxqs_store(struct net + return err; + } + ++ if (!rtnl_trylock()) { ++ bitmap_free(mask); ++ return restart_syscall(); ++ } ++ + cpus_read_lock(); + err = __netif_set_xps_queue(dev, mask, index, true); + cpus_read_unlock(); + ++ rtnl_unlock(); ++ + bitmap_free(mask); + return err ? : len; + } diff --git a/queue-5.10/net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch b/queue-5.10/net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch new file mode 100644 index 00000000000..94f17b97c94 --- /dev/null +++ b/queue-5.10/net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Jan 10 11:18:58 AM CET 2021 +From: Florian Fainelli +Date: Fri, 18 Dec 2020 09:38:43 -0800 +Subject: net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE + +From: Florian Fainelli + +[ Upstream commit 54ddbdb024882e226055cc4c3c246592ddde2ee5 ] + +The driver is already allocating receive buffers of 2KiB and the +Ethernet MAC is configured to accept frames up to UMAC_MAX_MTU_SIZE. + +Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports") +Signed-off-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20201218173843.141046-1-f.fainelli@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bcmsysport.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2577,6 +2577,7 @@ static int bcm_sysport_probe(struct plat + NETIF_F_HW_VLAN_CTAG_TX; + dev->hw_features |= dev->features; + dev->vlan_features |= dev->features; ++ dev->max_mtu = UMAC_MAX_MTU_SIZE; + + /* Request the WOL interrupt and advertise suspend if available */ + priv->wol_irq_disabled = 1; diff --git a/queue-5.10/net-usb-qmi_wwan-add-quectel-em160r-gl.patch b/queue-5.10/net-usb-qmi_wwan-add-quectel-em160r-gl.patch new file mode 100644 index 00000000000..9aa84642dba --- /dev/null +++ b/queue-5.10/net-usb-qmi_wwan-add-quectel-em160r-gl.patch @@ -0,0 +1,57 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: "Bjørn Mork" +Date: Wed, 30 Dec 2020 16:24:51 +0100 +Subject: net: usb: qmi_wwan: add Quectel EM160R-GL + +From: "Bjørn Mork" + +[ Upstream commit cfd82dfc9799c53ef109343a23af006a0f6860a9 ] + +New modem using ff/ff/30 for QCDM, ff/00/00 for AT and NMEA, +and ff/ff/ff for RMNET/QMI. + +T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=2c7c ProdID=0620 Rev= 4.09 +S: Manufacturer=Quectel +S: Product=EM160R-GL +S: SerialNumber=e31cedc1 +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Signed-off-by: Bjørn Mork +Link: https://lore.kernel.org/r/20201230152451.245271-1-bjorn@mork.no +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1036,6 +1036,7 @@ static const struct usb_device_id produc + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */ ++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */ + + /* 3. Combined interface devices matching on interface number */ diff --git a/queue-5.10/qede-fix-offload-for-ipip-tunnel-packets.patch b/queue-5.10/qede-fix-offload-for-ipip-tunnel-packets.patch new file mode 100644 index 00000000000..3c1daa7b7d5 --- /dev/null +++ b/queue-5.10/qede-fix-offload-for-ipip-tunnel-packets.patch @@ -0,0 +1,38 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Manish Chopra +Date: Mon, 21 Dec 2020 06:55:30 -0800 +Subject: qede: fix offload for IPIP tunnel packets + +From: Manish Chopra + +[ Upstream commit 5d5647dad259bb416fd5d3d87012760386d97530 ] + +IPIP tunnels packets are unknown to device, +hence these packets are incorrectly parsed and +caused the packet corruption, so disable offlods +for such packets at run time. + +Signed-off-by: Manish Chopra +Signed-off-by: Sudarsana Kalluru +Signed-off-by: Igor Russkikh +Link: https://lore.kernel.org/r/20201221145530.7771-1-manishc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -1799,6 +1799,11 @@ netdev_features_t qede_features_check(st + ntohs(udp_hdr(skb)->dest) != gnv_port)) + return features & ~(NETIF_F_CSUM_MASK | + NETIF_F_GSO_MASK); ++ } else if (l4_proto == IPPROTO_IPIP) { ++ /* IPIP tunnels are unknown to the device or at least unsupported natively, ++ * offloads for them can't be done trivially, so disable them for such skb. ++ */ ++ return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK); + } + } + diff --git a/queue-5.10/r8169-work-around-power-saving-bug-on-some-chip-versions.patch b/queue-5.10/r8169-work-around-power-saving-bug-on-some-chip-versions.patch new file mode 100644 index 00000000000..2b4c0cafda2 --- /dev/null +++ b/queue-5.10/r8169-work-around-power-saving-bug-on-some-chip-versions.patch @@ -0,0 +1,44 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Heiner Kallweit +Date: Wed, 30 Dec 2020 19:33:34 +0100 +Subject: r8169: work around power-saving bug on some chip versions + +From: Heiner Kallweit + +[ Upstream commit e80bd76fbf563cc7ed8c9e9f3bbcdf59b0897f69 ] + +A user reported failing network with RTL8168dp (a quite rare chip +version). Realtek confirmed that few chip versions suffer from a PLL +power-down hw bug. + +Fixes: 07df5bd874f0 ("r8169: power down chip in probe") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/a1c39460-d533-7f9e-fa9d-2b8990b02426@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/r8169_main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -2243,7 +2243,8 @@ static void rtl_pll_power_down(struct rt + } + + switch (tp->mac_version) { +- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33: ++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: + case RTL_GIGA_MAC_VER_43: +@@ -2269,7 +2270,8 @@ static void rtl_pll_power_down(struct rt + static void rtl_pll_power_up(struct rtl8169_private *tp) + { + switch (tp->mac_version) { +- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33: ++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: + case RTL_GIGA_MAC_VER_43: diff --git a/queue-5.10/revert-e1000e-disable-s0ix-entry-and-exit-flows-for-me-systems.patch b/queue-5.10/revert-e1000e-disable-s0ix-entry-and-exit-flows-for-me-systems.patch new file mode 100644 index 00000000000..698a0781192 --- /dev/null +++ b/queue-5.10/revert-e1000e-disable-s0ix-entry-and-exit-flows-for-me-systems.patch @@ -0,0 +1,111 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Mario Limonciello +Date: Mon, 14 Dec 2020 13:29:34 -0600 +Subject: Revert "e1000e: disable s0ix entry and exit flows for ME systems" + +From: Mario Limonciello + +[ Upstream commit 6cecf02e77ab9bf97e9252f9fcb8f0738a6de12c ] + +commit e086ba2fccda ("e1000e: disable s0ix entry and exit flows for ME +systems") disabled s0ix flows for systems that have various incarnations of +the i219-LM ethernet controller. This changed caused power consumption +regressions on the following shipping Dell Comet Lake based laptops: +* Latitude 5310 +* Latitude 5410 +* Latitude 5410 +* Latitude 5510 +* Precision 3550 +* Latitude 5411 +* Latitude 5511 +* Precision 3551 +* Precision 7550 +* Precision 7750 + +This commit was introduced because of some regressions on certain Thinkpad +laptops. This comment was potentially caused by an earlier +commit 632fbd5eb5b0e ("e1000e: fix S0ix flows for cable connected case"). +or it was possibly caused by a system not meeting platform architectural +requirements for low power consumption. Other changes made in the driver +with extended timeouts are expected to make the driver more impervious to +platform firmware behavior. + +Fixes: e086ba2fccda ("e1000e: disable s0ix entry and exit flows for ME systems") +Reviewed-by: Alexander Duyck +Signed-off-by: Mario Limonciello +Reviewed-by: Hans de Goede +Tested-by: Yijun Shen +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 45 +---------------------------- + 1 file changed, 2 insertions(+), 43 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -103,45 +103,6 @@ static const struct e1000_reg_info e1000 + {0, NULL} + }; + +-struct e1000e_me_supported { +- u16 device_id; /* supported device ID */ +-}; +- +-static const struct e1000e_me_supported me_supported[] = { +- {E1000_DEV_ID_PCH_LPT_I217_LM}, +- {E1000_DEV_ID_PCH_LPTLP_I218_LM}, +- {E1000_DEV_ID_PCH_I218_LM2}, +- {E1000_DEV_ID_PCH_I218_LM3}, +- {E1000_DEV_ID_PCH_SPT_I219_LM}, +- {E1000_DEV_ID_PCH_SPT_I219_LM2}, +- {E1000_DEV_ID_PCH_LBG_I219_LM3}, +- {E1000_DEV_ID_PCH_SPT_I219_LM4}, +- {E1000_DEV_ID_PCH_SPT_I219_LM5}, +- {E1000_DEV_ID_PCH_CNP_I219_LM6}, +- {E1000_DEV_ID_PCH_CNP_I219_LM7}, +- {E1000_DEV_ID_PCH_ICP_I219_LM8}, +- {E1000_DEV_ID_PCH_ICP_I219_LM9}, +- {E1000_DEV_ID_PCH_CMP_I219_LM10}, +- {E1000_DEV_ID_PCH_CMP_I219_LM11}, +- {E1000_DEV_ID_PCH_CMP_I219_LM12}, +- {E1000_DEV_ID_PCH_TGP_I219_LM13}, +- {E1000_DEV_ID_PCH_TGP_I219_LM14}, +- {E1000_DEV_ID_PCH_TGP_I219_LM15}, +- {0} +-}; +- +-static bool e1000e_check_me(u16 device_id) +-{ +- struct e1000e_me_supported *id; +- +- for (id = (struct e1000e_me_supported *)me_supported; +- id->device_id; id++) +- if (device_id == id->device_id) +- return true; +- +- return false; +-} +- + /** + * __ew32_prepare - prepare to write to MAC CSR register on certain parts + * @hw: pointer to the HW structure +@@ -6974,8 +6935,7 @@ static __maybe_unused int e1000e_pm_susp + e1000e_pm_thaw(dev); + } else { + /* Introduce S0ix implementation */ +- if (hw->mac.type >= e1000_pch_cnp && +- !e1000e_check_me(hw->adapter->pdev->device)) ++ if (hw->mac.type >= e1000_pch_cnp) + e1000e_s0ix_entry_flow(adapter); + } + +@@ -6991,8 +6951,7 @@ static __maybe_unused int e1000e_pm_resu + int rc; + + /* Introduce S0ix implementation */ +- if (hw->mac.type >= e1000_pch_cnp && +- !e1000e_check_me(hw->adapter->pdev->device)) ++ if (hw->mac.type >= e1000_pch_cnp) + e1000e_s0ix_exit_flow(adapter); + + rc = __e1000_resume(pdev); diff --git a/queue-5.10/selftests-mlxsw-set-headroom-size-of-correct-port.patch b/queue-5.10/selftests-mlxsw-set-headroom-size-of-correct-port.patch new file mode 100644 index 00000000000..583dd25daf8 --- /dev/null +++ b/queue-5.10/selftests-mlxsw-set-headroom-size-of-correct-port.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Ido Schimmel +Date: Wed, 30 Dec 2020 13:42:51 +0200 +Subject: selftests: mlxsw: Set headroom size of correct port + +From: Ido Schimmel + +[ Upstream commit 2ff2c7e274392871bfdee00ff2adbb8ebae5d240 ] + +The test was setting the headroom size of the wrong port. This was not +visible because of a firmware bug that canceled this bug. + +Set the headroom size of the correct port, so that the test will pass +with both old and new firmware versions. + +Fixes: bfa804784e32 ("selftests: mlxsw: Add a PFC test") +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Link: https://lore.kernel.org/r/20201230114251.394009-1-idosch@idosch.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh ++++ b/tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh +@@ -230,7 +230,7 @@ switch_create() + __mlnx_qos -i $swp4 --pfc=0,1,0,0,0,0,0,0 >/dev/null + # PG0 will get autoconfigured to Xoff, give PG1 arbitrarily 100K, which + # is (-2*MTU) about 80K of delay provision. +- __mlnx_qos -i $swp3 --buffer_size=0,$_100KB,0,0,0,0,0,0 >/dev/null ++ __mlnx_qos -i $swp4 --buffer_size=0,$_100KB,0,0,0,0,0,0 >/dev/null + + # bridges + # ------- diff --git a/queue-5.10/series b/queue-5.10/series index cf6c82a8b7d..c99f6dbdcf0 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1,3 +1,52 @@ +i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch +iavf-fix-double-release-of-rtnl_lock.patch +net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch +net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch +net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch +net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch +ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch +ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch +ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch +atm-idt77252-call-pci_disable_device-on-error-path.patch +net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch +net-stmmac-dwmac-meson8b-ignore-the-second-clock-input.patch +ibmvnic-fix-login-buffer-memory-leak.patch +ibmvnic-continue-fatal-error-reset-after-passive-init.patch +net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch +qede-fix-offload-for-ipip-tunnel-packets.patch +virtio_net-fix-recursive-call-to-cpus_read_lock.patch +net-dcb-validate-netlink-message-in-dcb-handler.patch +net-ncsi-use-real-net-device-for-response-handler.patch +net-ethernet-fix-memleak-in-ethoc_probe.patch +net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch +net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch +net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch +net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch +net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch +tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch +e1000e-only-run-s0ix-flows-if-shutdown-succeeded.patch +e1000e-bump-up-timeout-to-wait-when-me-un-configures-ulp-mode.patch +revert-e1000e-disable-s0ix-entry-and-exit-flows-for-me-systems.patch +e1000e-export-s0ix-flags-to-ethtool.patch +bnxt_en-check-tqm-rings-for-maximum-supported-value.patch +net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch +bnxt_en-fix-aer-recovery.patch +ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch +net-sched-prevent-invalid-scell_log-shift-count.patch +net-hns-fix-return-value-check-in-__lb_other_process.patch +erspan-fix-version-1-check-in-gre_parse_header.patch +net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch +bareudp-set-netif_f_lltx-flag.patch +bareudp-fix-use-of-incorrect-min_headroom-size.patch +vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch +r8169-work-around-power-saving-bug-on-some-chip-versions.patch +net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch +net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch +cdc-ncm-remove-connected-log-message.patch +ibmvnic-fix-null-pointer-dereference.patch +net-usb-qmi_wwan-add-quectel-em160r-gl.patch +selftests-mlxsw-set-headroom-size-of-correct-port.patch +stmmac-intel-add-pci-ids-for-tgl-h-platform.patch selftests-vm-fix-building-protection-keys-test.patch block-add-debugfs-stanza-for-queue_flag_nowait.patch workqueue-kick-a-worker-based-on-the-actual-activati.patch diff --git a/queue-5.10/stmmac-intel-add-pci-ids-for-tgl-h-platform.patch b/queue-5.10/stmmac-intel-add-pci-ids-for-tgl-h-platform.patch new file mode 100644 index 00000000000..9299f476ed1 --- /dev/null +++ b/queue-5.10/stmmac-intel-add-pci-ids-for-tgl-h-platform.patch @@ -0,0 +1,42 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Noor Azura Ahmad Tarmizi +Date: Wed, 23 Dec 2020 00:03:37 +0800 +Subject: stmmac: intel: Add PCI IDs for TGL-H platform + +From: Noor Azura Ahmad Tarmizi + +[ Upstream commit 8450e23f142f629e40bd67afc8375c86c7fbf8f1 ] + +Add TGL-H PCI info and PCI IDs for the new TSN Controller to the list +of supported devices. + +Signed-off-by: Noor Azura Ahmad Tarmizi +Signed-off-by: Voon Weifeng +Signed-off-by: Muhammad Husaini Zulkifli +Link: https://lore.kernel.org/r/20201222160337.30870-1-muhammad.husaini.zulkifli@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +@@ -725,6 +725,8 @@ static SIMPLE_DEV_PM_OPS(intel_eth_pm_op + #define PCI_DEVICE_ID_INTEL_EHL_PSE1_RGMII1G_ID 0x4bb0 + #define PCI_DEVICE_ID_INTEL_EHL_PSE1_SGMII1G_ID 0x4bb1 + #define PCI_DEVICE_ID_INTEL_EHL_PSE1_SGMII2G5_ID 0x4bb2 ++#define PCI_DEVICE_ID_INTEL_TGLH_SGMII1G_0_ID 0x43ac ++#define PCI_DEVICE_ID_INTEL_TGLH_SGMII1G_1_ID 0x43a2 + #define PCI_DEVICE_ID_INTEL_TGL_SGMII1G_ID 0xa0ac + + static const struct pci_device_id intel_eth_pci_id_table[] = { +@@ -739,6 +741,8 @@ static const struct pci_device_id intel_ + { PCI_DEVICE_DATA(INTEL, EHL_PSE1_SGMII1G_ID, &ehl_pse1_sgmii1g_info) }, + { PCI_DEVICE_DATA(INTEL, EHL_PSE1_SGMII2G5_ID, &ehl_pse1_sgmii1g_info) }, + { PCI_DEVICE_DATA(INTEL, TGL_SGMII1G_ID, &tgl_sgmii1g_info) }, ++ { PCI_DEVICE_DATA(INTEL, TGLH_SGMII1G_0_ID, &tgl_sgmii1g_info) }, ++ { PCI_DEVICE_DATA(INTEL, TGLH_SGMII1G_1_ID, &tgl_sgmii1g_info) }, + {} + }; + MODULE_DEVICE_TABLE(pci, intel_eth_pci_id_table); diff --git a/queue-5.10/tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch b/queue-5.10/tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch new file mode 100644 index 00000000000..7ae661cb379 --- /dev/null +++ b/queue-5.10/tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch @@ -0,0 +1,42 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Yunjian Wang +Date: Fri, 25 Dec 2020 10:52:16 +0800 +Subject: tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS + +From: Yunjian Wang + +[ Upstream commit 950271d7cc0b4546af3549d8143c4132d6e1f138 ] + +Currently the tun_napi_alloc_frags() function returns -ENOMEM when the +number of iovs exceeds MAX_SKB_FRAGS + 1. However this is inappropriate, +we should use -EMSGSIZE instead of -ENOMEM. + +The following distinctions are matters: +1. the caller need to drop the bad packet when -EMSGSIZE is returned, + which means meeting a persistent failure. +2. the caller can try again when -ENOMEM is returned, which means + meeting a transient failure. + +Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver") +Signed-off-by: Yunjian Wang +Acked-by: Willem de Bruijn +Acked-by: Jason Wang +Acked-by: Michael S. Tsirkin +Link: https://lore.kernel.org/r/1608864736-24332-1-git-send-email-wangyunjian@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1401,7 +1401,7 @@ static struct sk_buff *tun_napi_alloc_fr + int i; + + if (it->nr_segs > MAX_SKB_FRAGS + 1) +- return ERR_PTR(-ENOMEM); ++ return ERR_PTR(-EMSGSIZE); + + local_bh_disable(); + skb = napi_get_frags(&tfile->napi); diff --git a/queue-5.10/vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch b/queue-5.10/vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch new file mode 100644 index 00000000000..4e31510750d --- /dev/null +++ b/queue-5.10/vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch @@ -0,0 +1,57 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Yunjian Wang +Date: Tue, 29 Dec 2020 10:01:48 +0800 +Subject: vhost_net: fix ubuf refcount incorrectly when sendmsg fails + +From: Yunjian Wang + +[ Upstream commit 01e31bea7e622f1890c274f4aaaaf8bccd296aa5 ] + +Currently the vhost_zerocopy_callback() maybe be called to decrease +the refcount when sendmsg fails in tun. The error handling in vhost +handle_tx_zerocopy() will try to decrease the same refcount again. +This is wrong. To fix this issue, we only call vhost_net_ubuf_put() +when vq->heads[nvq->desc].len == VHOST_DMA_IN_PROGRESS. + +Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support") +Signed-off-by: Yunjian Wang +Acked-by: Willem de Bruijn +Acked-by: Michael S. Tsirkin +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/1609207308-20544-1-git-send-email-wangyunjian@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vhost/net.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -863,6 +863,7 @@ static void handle_tx_zerocopy(struct vh + size_t len, total_len = 0; + int err; + struct vhost_net_ubuf_ref *ubufs; ++ struct ubuf_info *ubuf; + bool zcopy_used; + int sent_pkts = 0; + +@@ -895,9 +896,7 @@ static void handle_tx_zerocopy(struct vh + + /* use msg_control to pass vhost zerocopy ubuf info to skb */ + if (zcopy_used) { +- struct ubuf_info *ubuf; + ubuf = nvq->ubuf_info + nvq->upend_idx; +- + vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head); + vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS; + ubuf->callback = vhost_zerocopy_callback; +@@ -927,7 +926,8 @@ static void handle_tx_zerocopy(struct vh + err = sock->ops->sendmsg(sock, &msg, len); + if (unlikely(err < 0)) { + if (zcopy_used) { +- vhost_net_ubuf_put(ubufs); ++ if (vq->heads[ubuf->desc].len == VHOST_DMA_IN_PROGRESS) ++ vhost_net_ubuf_put(ubufs); + nvq->upend_idx = ((unsigned)nvq->upend_idx - 1) + % UIO_MAXIOV; + } diff --git a/queue-5.10/virtio_net-fix-recursive-call-to-cpus_read_lock.patch b/queue-5.10/virtio_net-fix-recursive-call-to-cpus_read_lock.patch new file mode 100644 index 00000000000..cc3f1b7691b --- /dev/null +++ b/queue-5.10/virtio_net-fix-recursive-call-to-cpus_read_lock.patch @@ -0,0 +1,61 @@ +From foo@baz Sun Jan 10 11:18:59 AM CET 2021 +From: Jeff Dike +Date: Tue, 22 Dec 2020 21:54:21 -0500 +Subject: virtio_net: Fix recursive call to cpus_read_lock() + +From: Jeff Dike + +[ Upstream commit de33212f768c5d9e2fe791b008cb26f92f0aa31c ] + +virtnet_set_channels can recursively call cpus_read_lock if CONFIG_XPS +and CONFIG_HOTPLUG are enabled. + +The path is: + virtnet_set_channels - calls get_online_cpus(), which is a trivial +wrapper around cpus_read_lock() + netif_set_real_num_tx_queues + netif_reset_xps_queues_gt + netif_reset_xps_queues - calls cpus_read_lock() + +This call chain and potential deadlock happens when the number of TX +queues is reduced. + +This commit the removes netif_set_real_num_[tr]x_queues calls from +inside the get/put_online_cpus section, as they don't require that it +be held. + +Fixes: 47be24796c13 ("virtio-net: fix the set affinity bug when CPU IDs are not consecutive") +Signed-off-by: Jeff Dike +Acked-by: Jason Wang +Acked-by: Michael S. Tsirkin +Link: https://lore.kernel.org/r/20201223025421.671-1-jdike@akamai.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/virtio_net.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2093,14 +2093,16 @@ static int virtnet_set_channels(struct n + + get_online_cpus(); + err = _virtnet_set_queues(vi, queue_pairs); +- if (!err) { +- netif_set_real_num_tx_queues(dev, queue_pairs); +- netif_set_real_num_rx_queues(dev, queue_pairs); +- +- virtnet_set_affinity(vi); ++ if (err) { ++ put_online_cpus(); ++ goto err; + } ++ virtnet_set_affinity(vi); + put_online_cpus(); + ++ netif_set_real_num_tx_queues(dev, queue_pairs); ++ netif_set_real_num_rx_queues(dev, queue_pairs); ++ err: + return err; + } +