Skip to content

Commit ead68f2

Browse files
torvaldstorvalds
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller" "What's a holiday weekend without some networking bug fixes? [1] 1) Fix some eBPF JIT bugs wrt. SKB pointers across helper function calls, from Daniel Borkmann. 2) Fix regression from errata limiting change to marvell PHY driver, from Zhao Qiang. 3) Fix u16 overflow in SCTP, from Xin Long. 4) Fix potential memory leak during bridge newlink, from Nikolay Aleksandrov. 5) Fix BPF selftest build on s390, from Hendrik Brueckner. 6) Don't append to cfg80211 automatically generated certs file, always write new ones from scratch. From Thierry Reding. 7) Fix sleep in atomic in mac80211 hwsim, from Jia-Ju Bai. 8) Fix hang on tg3 MTU change with certain chips, from Brian King. 9) Add stall detection to arc emac driver and reset chip when this happens, from Alexander Kochetkov. 10) Fix MTU limitng in GRE tunnel drivers, from Xin Long. 11) Fix stmmac timestamping bug due to mis-shifting of field. From Fredrik Hallenberg. 12) Fix metrics match when deleting an ipv4 route. The kernel sets some internal metrics bits which the user isn't going to set when it makes the delete request. From Phil Sutter. 13) mvneta driver loop over RX queues limits on "txq_number" :-) Fix from Yelena Krivosheev. 14) Fix double free and memory corruption in get_net_ns_by_id, from Eric W. Biederman. 15) Flush ipv4 FIB tables in the reverse order. Some tables can share their actual backing data, in particular this happens for the MAIN and LOCAL tables. We have to kill the LOCAL table first, because it uses MAIN's backing memory. Fix from Ido Schimmel. 16) Several eBPF verifier value tracking fixes, from Edward Cree, Jann Horn, and Alexei Starovoitov. 17) Make changes to ipv6 autoflowlabel sysctl really propagate to sockets, unless the socket has set the per-socket value explicitly. From Shaohua Li. 18) Fix leaks and double callback invocations of zerocopy SKBs, from Willem de Bruijn" [1] Is this a trick question? "Relaxing"? "Quiet"? "Fine"? - Linus. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (77 commits) skbuff: skb_copy_ubufs must release uarg even without user frags skbuff: orphan frags before zerocopy clone net: reevalulate autoflowlabel setting after sysctl setting openvswitch: Fix pop_vlan action for double tagged frames ipv6: Honor specified parameters in fibmatch lookup bpf: do not allow root to mangle valid pointers selftests/bpf: add tests for recent bugfixes bpf: fix integer overflows bpf: don't prune branches when a scalar is replaced with a pointer bpf: force strict alignment checks for stack pointers bpf: fix missing error return in check_stack_boundary() bpf: fix 32-bit ALU op verification bpf: fix incorrect tracking of register size truncation bpf: fix incorrect sign extension in check_alu_op() bpf/verifier: fix bounds calculation on BPF_RSH ipv4: Fix use-after-free when flushing FIB tables s390/qeth: fix error handling in checksum cmd callback tipc: remove joining group member from congested list selftests: net: Adding config fragment CONFIG_NUMA=y nfp: bpf: keep track of the offloaded program ...
2 parents 9035a89 + c50b7c4 commit ead68f2

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

73 files changed

+1548
-492
lines changed

‎arch/powerpc/net/bpf_jit_comp64.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -763,7 +763,8 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
763763
func = (u8 *) __bpf_call_base + imm;
764764

765765
/* Save skb pointer if we need to re-cache skb data */
766-
if (bpf_helper_changes_pkt_data(func))
766+
if ((ctx->seen & SEEN_SKB) &&
767+
bpf_helper_changes_pkt_data(func))
767768
PPC_BPF_STL(3, 1, bpf_jit_stack_local(ctx));
768769

769770
bpf_jit_emit_func_call(image, ctx, (u64)func);
@@ -772,7 +773,8 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
772773
PPC_MR(b2p[BPF_REG_0], 3);
773774

774775
/* refresh skb cache */
775-
if (bpf_helper_changes_pkt_data(func)) {
776+
if ((ctx->seen & SEEN_SKB) &&
777+
bpf_helper_changes_pkt_data(func)) {
776778
/* reload skb pointer to r3 */
777779
PPC_BPF_LL(3, 1, bpf_jit_stack_local(ctx));
778780
bpf_jit_emit_skb_loads(image, ctx);

‎arch/s390/net/bpf_jit_comp.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,7 @@ struct bpf_jit {
5555
#define SEEN_LITERAL 8 /* code uses literals */
5656
#define SEEN_FUNC 16 /* calls C functions */
5757
#define SEEN_TAIL_CALL 32 /* code uses tail calls */
58-
#define SEEN_SKB_CHANGE 64 /* code changes skb data */
59-
#define SEEN_REG_AX 128 /* code uses constant blinding */
58+
#define SEEN_REG_AX 64 /* code uses constant blinding */
6059
#define SEEN_STACK (SEEN_FUNC | SEEN_MEM | SEEN_SKB)
6160

6261
/*
@@ -448,12 +447,12 @@ static void bpf_jit_prologue(struct bpf_jit *jit, u32 stack_depth)
448447
EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0,
449448
REG_15, 152);
450449
}
451-
if (jit->seen & SEEN_SKB)
450+
if (jit->seen & SEEN_SKB) {
452451
emit_load_skb_data_hlen(jit);
453-
if (jit->seen & SEEN_SKB_CHANGE)
454452
/* stg %b1,ST_OFF_SKBP(%r0,%r15) */
455453
EMIT6_DISP_LH(0xe3000000, 0x0024, BPF_REG_1, REG_0, REG_15,
456454
STK_OFF_SKBP);
455+
}
457456
}
458457

459458
/*
@@ -983,8 +982,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
983982
EMIT2(0x0d00, REG_14, REG_W1);
984983
/* lgr %b0,%r2: load return value into %b0 */
985984
EMIT4(0xb9040000, BPF_REG_0, REG_2);
986-
if (bpf_helper_changes_pkt_data((void *)func)) {
987-
jit->seen |= SEEN_SKB_CHANGE;
985+
if ((jit->seen & SEEN_SKB) &&
986+
bpf_helper_changes_pkt_data((void *)func)) {
988987
/* lg %b1,ST_OFF_SKBP(%r15) */
989988
EMIT6_DISP_LH(0xe3000000, 0x0004, BPF_REG_1, REG_0,
990989
REG_15, STK_OFF_SKBP);

‎arch/sparc/net/bpf_jit_comp_64.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1245,14 +1245,16 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
12451245
u8 *func = ((u8 *)__bpf_call_base) + imm;
12461246

12471247
ctx->saw_call = true;
1248+
if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func))
1249+
emit_reg_move(bpf2sparc[BPF_REG_1], L7, ctx);
12481250

12491251
emit_call((u32 *)func, ctx);
12501252
emit_nop(ctx);
12511253

12521254
emit_reg_move(O0, bpf2sparc[BPF_REG_0], ctx);
12531255

1254-
if (bpf_helper_changes_pkt_data(func) && ctx->saw_ld_abs_ind)
1255-
load_skb_regs(ctx, bpf2sparc[BPF_REG_6]);
1256+
if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func))
1257+
load_skb_regs(ctx, L7);
12561258
break;
12571259
}
12581260

‎drivers/net/ethernet/arc/emac.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,8 @@ struct arc_emac_priv {
159159
unsigned int link;
160160
unsigned int duplex;
161161
unsigned int speed;
162+
163+
unsigned int rx_missed_errors;
162164
};
163165

164166
/**

‎drivers/net/ethernet/arc/emac_main.c

Lines changed: 142 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@
2626

2727
#include "emac.h"
2828

29+
static void arc_emac_restart(struct net_device *ndev);
30+
2931
/**
3032
* arc_emac_tx_avail - Return the number of available slots in the tx ring.
3133
* @priv: Pointer to ARC EMAC private data structure.
@@ -210,39 +212,48 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
210212
continue;
211213
}
212214

213-
pktlen = info & LEN_MASK;
214-
stats->rx_packets++;
215-
stats->rx_bytes += pktlen;
216-
skb = rx_buff->skb;
217-
skb_put(skb, pktlen);
218-
skb->dev = ndev;
219-
skb->protocol = eth_type_trans(skb, ndev);
220-
221-
dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
222-
dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
223-
224-
/* Prepare the BD for next cycle */
225-
rx_buff->skb = netdev_alloc_skb_ip_align(ndev,
226-
EMAC_BUFFER_SIZE);
227-
if (unlikely(!rx_buff->skb)) {
215+
/* Prepare the BD for next cycle. netif_receive_skb()
216+
* only if new skb was allocated and mapped to avoid holes
217+
* in the RX fifo.
218+
*/
219+
skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE);
220+
if (unlikely(!skb)) {
221+
if (net_ratelimit())
222+
netdev_err(ndev, "cannot allocate skb\n");
223+
/* Return ownership to EMAC */
224+
rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
228225
stats->rx_errors++;
229-
/* Because receive_skb is below, increment rx_dropped */
230226
stats->rx_dropped++;
231227
continue;
232228
}
233229

234-
/* receive_skb only if new skb was allocated to avoid holes */
235-
netif_receive_skb(skb);
236-
237-
addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
230+
addr = dma_map_single(&ndev->dev, (void *)skb->data,
238231
EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
239232
if (dma_mapping_error(&ndev->dev, addr)) {
240233
if (net_ratelimit())
241-
netdev_err(ndev, "cannot dma map\n");
242-
dev_kfree_skb(rx_buff->skb);
234+
netdev_err(ndev, "cannot map dma buffer\n");
235+
dev_kfree_skb(skb);
236+
/* Return ownership to EMAC */
237+
rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
243238
stats->rx_errors++;
239+
stats->rx_dropped++;
244240
continue;
245241
}
242+
243+
/* unmap previosly mapped skb */
244+
dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
245+
dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
246+
247+
pktlen = info & LEN_MASK;
248+
stats->rx_packets++;
249+
stats->rx_bytes += pktlen;
250+
skb_put(rx_buff->skb, pktlen);
251+
rx_buff->skb->dev = ndev;
252+
rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev);
253+
254+
netif_receive_skb(rx_buff->skb);
255+
256+
rx_buff->skb = skb;
246257
dma_unmap_addr_set(rx_buff, addr, addr);
247258
dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);
248259

@@ -258,6 +269,53 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
258269
return work_done;
259270
}
260271

272+
/**
273+
* arc_emac_rx_miss_handle - handle R_MISS register
274+
* @ndev: Pointer to the net_device structure.
275+
*/
276+
static void arc_emac_rx_miss_handle(struct net_device *ndev)
277+
{
278+
struct arc_emac_priv *priv = netdev_priv(ndev);
279+
struct net_device_stats *stats = &ndev->stats;
280+
unsigned int miss;
281+
282+
miss = arc_reg_get(priv, R_MISS);
283+
if (miss) {
284+
stats->rx_errors += miss;
285+
stats->rx_missed_errors += miss;
286+
priv->rx_missed_errors += miss;
287+
}
288+
}
289+
290+
/**
291+
* arc_emac_rx_stall_check - check RX stall
292+
* @ndev: Pointer to the net_device structure.
293+
* @budget: How many BDs requested to process on 1 call.
294+
* @work_done: How many BDs processed
295+
*
296+
* Under certain conditions EMAC stop reception of incoming packets and
297+
* continuously increment R_MISS register instead of saving data into
298+
* provided buffer. This function detect that condition and restart
299+
* EMAC.
300+
*/
301+
static void arc_emac_rx_stall_check(struct net_device *ndev,
302+
int budget, unsigned int work_done)
303+
{
304+
struct arc_emac_priv *priv = netdev_priv(ndev);
305+
struct arc_emac_bd *rxbd;
306+
307+
if (work_done)
308+
priv->rx_missed_errors = 0;
309+
310+
if (priv->rx_missed_errors && budget) {
311+
rxbd = &priv->rxbd[priv->last_rx_bd];
312+
if (le32_to_cpu(rxbd->info) & FOR_EMAC) {
313+
arc_emac_restart(ndev);
314+
priv->rx_missed_errors = 0;
315+
}
316+
}
317+
}
318+
261319
/**
262320
* arc_emac_poll - NAPI poll handler.
263321
* @napi: Pointer to napi_struct structure.
@@ -272,13 +330,16 @@ static int arc_emac_poll(struct napi_struct *napi, int budget)
272330
unsigned int work_done;
273331

274332
arc_emac_tx_clean(ndev);
333+
arc_emac_rx_miss_handle(ndev);
275334

276335
work_done = arc_emac_rx(ndev, budget);
277336
if (work_done < budget) {
278337
napi_complete_done(napi, work_done);
279338
arc_reg_or(priv, R_ENABLE, RXINT_MASK | TXINT_MASK);
280339
}
281340

341+
arc_emac_rx_stall_check(ndev, budget, work_done);
342+
282343
return work_done;
283344
}
284345

@@ -320,6 +381,8 @@ static irqreturn_t arc_emac_intr(int irq, void *dev_instance)
320381
if (status & MSER_MASK) {
321382
stats->rx_missed_errors += 0x100;
322383
stats->rx_errors += 0x100;
384+
priv->rx_missed_errors += 0x100;
385+
napi_schedule(&priv->napi);
323386
}
324387

325388
if (status & RXCR_MASK) {
@@ -732,6 +795,63 @@ static int arc_emac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
732795
}
733796

734797

798+
/**
799+
* arc_emac_restart - Restart EMAC
800+
* @ndev: Pointer to net_device structure.
801+
*
802+
* This function do hardware reset of EMAC in order to restore
803+
* network packets reception.
804+
*/
805+
static void arc_emac_restart(struct net_device *ndev)
806+
{
807+
struct arc_emac_priv *priv = netdev_priv(ndev);
808+
struct net_device_stats *stats = &ndev->stats;
809+
int i;
810+
811+
if (net_ratelimit())
812+
netdev_warn(ndev, "restarting stalled EMAC\n");
813+
814+
netif_stop_queue(ndev);
815+
816+
/* Disable interrupts */
817+
arc_reg_clr(priv, R_ENABLE, RXINT_MASK | TXINT_MASK | ERR_MASK);
818+
819+
/* Disable EMAC */
820+
arc_reg_clr(priv, R_CTRL, EN_MASK);
821+
822+
/* Return the sk_buff to system */
823+
arc_free_tx_queue(ndev);
824+
825+
/* Clean Tx BD's */
826+
priv->txbd_curr = 0;
827+
priv->txbd_dirty = 0;
828+
memset(priv->txbd, 0, TX_RING_SZ);
829+
830+
for (i = 0; i < RX_BD_NUM; i++) {
831+
struct arc_emac_bd *rxbd = &priv->rxbd[i];
832+
unsigned int info = le32_to_cpu(rxbd->info);
833+
834+
if (!(info & FOR_EMAC)) {
835+
stats->rx_errors++;
836+
stats->rx_dropped++;
837+
}
838+
/* Return ownership to EMAC */
839+
rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
840+
}
841+
priv->last_rx_bd = 0;
842+
843+
/* Make sure info is visible to EMAC before enable */
844+
wmb();
845+
846+
/* Enable interrupts */
847+
arc_reg_set(priv, R_ENABLE, RXINT_MASK | TXINT_MASK | ERR_MASK);
848+
849+
/* Enable EMAC */
850+
arc_reg_or(priv, R_CTRL, EN_MASK);
851+
852+
netif_start_queue(ndev);
853+
}
854+
735855
static const struct net_device_ops arc_emac_netdev_ops = {
736856
.ndo_open = arc_emac_open,
737857
.ndo_stop = arc_emac_stop,

‎drivers/net/ethernet/broadcom/tg3.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14225,7 +14225,9 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
1422514225
/* Reset PHY, otherwise the read DMA engine will be in a mode that
1422614226
* breaks all requests to 256 bytes.
1422714227
*/
14228-
if (tg3_asic_rev(tp) == ASIC_REV_57766)
14228+
if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
14229+
tg3_asic_rev(tp) == ASIC_REV_5717 ||
14230+
tg3_asic_rev(tp) == ASIC_REV_5719)
1422914231
reset_phy = true;
1423014232

1423114233
err = tg3_restart_hw(tp, reset_phy);

‎drivers/net/ethernet/marvell/mvneta.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1214,6 +1214,10 @@ static void mvneta_port_disable(struct mvneta_port *pp)
12141214
val &= ~MVNETA_GMAC0_PORT_ENABLE;
12151215
mvreg_write(pp, MVNETA_GMAC_CTRL_0, val);
12161216

1217+
pp->link = 0;
1218+
pp->duplex = -1;
1219+
pp->speed = 0;
1220+
12171221
udelay(200);
12181222
}
12191223

@@ -1958,9 +1962,9 @@ static int mvneta_rx_swbm(struct mvneta_port *pp, int rx_todo,
19581962

19591963
if (!mvneta_rxq_desc_is_first_last(rx_status) ||
19601964
(rx_status & MVNETA_RXD_ERR_SUMMARY)) {
1965+
mvneta_rx_error(pp, rx_desc);
19611966
err_drop_frame:
19621967
dev->stats.rx_errors++;
1963-
mvneta_rx_error(pp, rx_desc);
19641968
/* leave the descriptor untouched */
19651969
continue;
19661970
}
@@ -3011,7 +3015,7 @@ static void mvneta_cleanup_rxqs(struct mvneta_port *pp)
30113015
{
30123016
int queue;
30133017

3014-
for (queue = 0; queue < txq_number; queue++)
3018+
for (queue = 0; queue < rxq_number; queue++)
30153019
mvneta_rxq_deinit(pp, &pp->rxqs[queue]);
30163020
}
30173021

‎drivers/net/ethernet/mediatek/mtk_eth_soc.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1961,11 +1961,12 @@ static int mtk_hw_init(struct mtk_eth *eth)
19611961
/* set GE2 TUNE */
19621962
regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0);
19631963

1964-
/* GE1, Force 1000M/FD, FC ON */
1965-
mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0));
1966-
1967-
/* GE2, Force 1000M/FD, FC ON */
1968-
mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1));
1964+
/* Set linkdown as the default for each GMAC. Its own MCR would be set
1965+
* up with the more appropriate value when mtk_phy_link_adjust call is
1966+
* being invoked.
1967+
*/
1968+
for (i = 0; i < MTK_MAC_COUNT; i++)
1969+
mtk_w32(eth, 0, MTK_MAC_MCR(i));
19691970

19701971
/* Indicates CDM to parse the MTK special tag from CPU
19711972
* which also is working out for untag packets.

‎drivers/net/ethernet/mellanox/mlx5/core/cmd.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -362,7 +362,7 @@ static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op,
362362
case MLX5_CMD_OP_QUERY_VPORT_COUNTER:
363363
case MLX5_CMD_OP_ALLOC_Q_COUNTER:
364364
case MLX5_CMD_OP_QUERY_Q_COUNTER:
365-
case MLX5_CMD_OP_SET_RATE_LIMIT:
365+
case MLX5_CMD_OP_SET_PP_RATE_LIMIT:
366366
case MLX5_CMD_OP_QUERY_RATE_LIMIT:
367367
case MLX5_CMD_OP_CREATE_SCHEDULING_ELEMENT:
368368
case MLX5_CMD_OP_QUERY_SCHEDULING_ELEMENT:
@@ -505,7 +505,7 @@ const char *mlx5_command_str(int command)
505505
MLX5_COMMAND_STR_CASE(ALLOC_Q_COUNTER);
506506
MLX5_COMMAND_STR_CASE(DEALLOC_Q_COUNTER);
507507
MLX5_COMMAND_STR_CASE(QUERY_Q_COUNTER);
508-
MLX5_COMMAND_STR_CASE(SET_RATE_LIMIT);
508+
MLX5_COMMAND_STR_CASE(SET_PP_RATE_LIMIT);
509509
MLX5_COMMAND_STR_CASE(QUERY_RATE_LIMIT);
510510
MLX5_COMMAND_STR_CASE(CREATE_SCHEDULING_ELEMENT);
511511
MLX5_COMMAND_STR_CASE(DESTROY_SCHEDULING_ELEMENT);

0 commit comments

Comments
 (0)