Merge tag 'net-5.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

+9 -3

MAINTAINERS

··· 7858 7858 F: drivers/input/touchscreen/goodix.c 7859 7859 7860 7860 GOOGLE ETHERNET DRIVERS 7861 - M: Catherine Sullivan <csully@google.com> 7862 - R: Sagi Shahar <sagis@google.com> 7863 - R: Jon Olson <jonolson@google.com> 7861 + M: Jeroen de Borst <jeroendb@google.com> 7862 + R: Catherine Sullivan <csully@google.com> 7863 + R: David Awogbemila <awogbemila@google.com> 7864 7864 L: netdev@vger.kernel.org 7865 7865 S: Supported 7866 7866 F: Documentation/networking/device_drivers/ethernet/google/gve.rst ··· 11326 11326 W: https://linuxtv.org 11327 11327 T: git git://linuxtv.org/media_tree.git 11328 11328 F: drivers/media/radio/radio-maxiradio* 11329 + 11330 + MCAB MICROCHIP CAN BUS ANALYZER TOOL DRIVER 11331 + R: Yasushi SHOJI <yashi@spacecubics.com> 11332 + L: linux-can@vger.kernel.org 11333 + S: Maintained 11334 + F: drivers/net/can/usb/mcba_usb.c 11329 11335 11330 11336 MCAN MMIO DEVICE DRIVER 11331 11337 M: Chandrasekar Ramakrishnan <rcsekar@samsung.com>

+3

arch/arm/net/bpf_jit_32.c

··· 1602 1602 rn = arm_bpf_get_reg32(src_lo, tmp2[1], ctx); 1603 1603 emit_ldx_r(dst, rn, off, ctx, BPF_SIZE(code)); 1604 1604 break; 1605 + /* speculation barrier */ 1606 + case BPF_ST | BPF_NOSPEC: 1607 + break; 1605 1608 /* ST: *(size *)(dst + off) = imm */ 1606 1609 case BPF_ST | BPF_MEM | BPF_W: 1607 1610 case BPF_ST | BPF_MEM | BPF_H:

+2 -2

arch/arm64/boot/dts/freescale/imx8mp.dtsi

··· 579 579 }; 580 580 581 581 flexcan1: can@308c0000 { 582 - compatible = "fsl,imx8mp-flexcan", "fsl,imx6q-flexcan"; 582 + compatible = "fsl,imx8mp-flexcan"; 583 583 reg = <0x308c0000 0x10000>; 584 584 interrupts = <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>; 585 585 clocks = <&clk IMX8MP_CLK_IPG_ROOT>, ··· 594 594 }; 595 595 596 596 flexcan2: can@308d0000 { 597 - compatible = "fsl,imx8mp-flexcan", "fsl,imx6q-flexcan"; 597 + compatible = "fsl,imx8mp-flexcan"; 598 598 reg = <0x308d0000 0x10000>; 599 599 interrupts = <GIC_SPI 144 IRQ_TYPE_LEVEL_HIGH>; 600 600 clocks = <&clk IMX8MP_CLK_IPG_ROOT>,

+13

arch/arm64/net/bpf_jit_comp.c

··· 823 823 return ret; 824 824 break; 825 825 826 + /* speculation barrier */ 827 + case BPF_ST | BPF_NOSPEC: 828 + /* 829 + * Nothing required here. 830 + * 831 + * In case of arm64, we rely on the firmware mitigation of 832 + * Speculative Store Bypass as controlled via the ssbd kernel 833 + * parameter. Whenever the mitigation is enabled, it works 834 + * for all of the kernel code with no need to provide any 835 + * additional instructions. 836 + */ 837 + break; 838 + 826 839 /* ST: *(size *)(dst + off) = imm */ 827 840 case BPF_ST | BPF_MEM | BPF_W: 828 841 case BPF_ST | BPF_MEM | BPF_H:

+3

arch/mips/net/ebpf_jit.c

··· 1355 1355 } 1356 1356 break; 1357 1357 1358 + case BPF_ST | BPF_NOSPEC: /* speculation barrier */ 1359 + break; 1360 + 1358 1361 case BPF_ST | BPF_B | BPF_MEM: 1359 1362 case BPF_ST | BPF_H | BPF_MEM: 1360 1363 case BPF_ST | BPF_W | BPF_MEM:

+6

arch/powerpc/net/bpf_jit_comp32.c

··· 738 738 break; 739 739 740 740 /* 741 + * BPF_ST NOSPEC (speculation barrier) 742 + */ 743 + case BPF_ST | BPF_NOSPEC: 744 + break; 745 + 746 + /* 741 747 * BPF_ST(X) 742 748 */ 743 749 case BPF_STX | BPF_MEM | BPF_B: /* *(u8 *)(dst + off) = src */

+6

arch/powerpc/net/bpf_jit_comp64.c

··· 628 628 break; 629 629 630 630 /* 631 + * BPF_ST NOSPEC (speculation barrier) 632 + */ 633 + case BPF_ST | BPF_NOSPEC: 634 + break; 635 + 636 + /* 631 637 * BPF_ST(X) 632 638 */ 633 639 case BPF_STX | BPF_MEM | BPF_B: /* *(u8 *)(dst + off) = src */

+4

arch/riscv/net/bpf_jit_comp32.c

··· 1251 1251 return -1; 1252 1252 break; 1253 1253 1254 + /* speculation barrier */ 1255 + case BPF_ST | BPF_NOSPEC: 1256 + break; 1257 + 1254 1258 case BPF_ST | BPF_MEM | BPF_B: 1255 1259 case BPF_ST | BPF_MEM | BPF_H: 1256 1260 case BPF_ST | BPF_MEM | BPF_W:

+4

arch/riscv/net/bpf_jit_comp64.c

··· 939 939 emit_ld(rd, 0, RV_REG_T1, ctx); 940 940 break; 941 941 942 + /* speculation barrier */ 943 + case BPF_ST | BPF_NOSPEC: 944 + break; 945 + 942 946 /* ST: *(size *)(dst + off) = imm */ 943 947 case BPF_ST | BPF_MEM | BPF_B: 944 948 emit_imm(RV_REG_T1, imm, ctx);

+5

arch/s390/net/bpf_jit_comp.c

··· 1154 1154 } 1155 1155 break; 1156 1156 /* 1157 + * BPF_NOSPEC (speculation barrier) 1158 + */ 1159 + case BPF_ST | BPF_NOSPEC: 1160 + break; 1161 + /* 1157 1162 * BPF_ST(X) 1158 1163 */ 1159 1164 case BPF_STX | BPF_MEM | BPF_B: /* *(u8 *)(dst + off) = src_reg */

+3

arch/sparc/net/bpf_jit_comp_64.c

··· 1287 1287 return 1; 1288 1288 break; 1289 1289 } 1290 + /* speculation barrier */ 1291 + case BPF_ST | BPF_NOSPEC: 1292 + break; 1290 1293 /* ST: *(size *)(dst + off) = imm */ 1291 1294 case BPF_ST | BPF_MEM | BPF_W: 1292 1295 case BPF_ST | BPF_MEM | BPF_H:

+7

arch/x86/net/bpf_jit_comp.c

··· 1219 1219 } 1220 1220 break; 1221 1221 1222 + /* speculation barrier */ 1223 + case BPF_ST | BPF_NOSPEC: 1224 + if (boot_cpu_has(X86_FEATURE_XMM2)) 1225 + /* Emit 'lfence' */ 1226 + EMIT3(0x0F, 0xAE, 0xE8); 1227 + break; 1228 + 1222 1229 /* ST: *(u8*)(dst_reg + off) = imm */ 1223 1230 case BPF_ST | BPF_MEM | BPF_B: 1224 1231 if (is_ereg(dst_reg))

+6

arch/x86/net/bpf_jit_comp32.c

··· 1886 1886 i++; 1887 1887 break; 1888 1888 } 1889 + /* speculation barrier */ 1890 + case BPF_ST | BPF_NOSPEC: 1891 + if (boot_cpu_has(X86_FEATURE_XMM2)) 1892 + /* Emit 'lfence' */ 1893 + EMIT3(0x0F, 0xAE, 0xE8); 1894 + break; 1889 1895 /* ST: *(u8*)(dst_reg + off) = imm */ 1890 1896 case BPF_ST | BPF_MEM | BPF_H: 1891 1897 case BPF_ST | BPF_MEM | BPF_B:

+1 -1

drivers/net/can/spi/hi311x.c

··· 218 218 return ret; 219 219 } 220 220 221 - static u8 hi3110_cmd(struct spi_device *spi, u8 command) 221 + static int hi3110_cmd(struct spi_device *spi, u8 command) 222 222 { 223 223 struct hi3110_priv *priv = spi_get_drvdata(spi); 224 224

+1

drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c

··· 2300 2300 err, priv->regs_status.intf); 2301 2301 mcp251xfd_dump(priv); 2302 2302 mcp251xfd_chip_interrupts_disable(priv); 2303 + mcp251xfd_timestamp_stop(priv); 2303 2304 2304 2305 return handled; 2305 2306 }

+13 -1

drivers/net/can/usb/ems_usb.c

··· 255 255 unsigned int free_slots; /* remember number of available slots */ 256 256 257 257 struct ems_cpc_msg active_params; /* active controller parameters */ 258 + void *rxbuf[MAX_RX_URBS]; 259 + dma_addr_t rxbuf_dma[MAX_RX_URBS]; 258 260 }; 259 261 260 262 static void ems_usb_read_interrupt_callback(struct urb *urb) ··· 589 587 for (i = 0; i < MAX_RX_URBS; i++) { 590 588 struct urb *urb = NULL; 591 589 u8 *buf = NULL; 590 + dma_addr_t buf_dma; 592 591 593 592 /* create a URB, and a buffer for it */ 594 593 urb = usb_alloc_urb(0, GFP_KERNEL); ··· 599 596 } 600 597 601 598 buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL, 602 - &urb->transfer_dma); 599 + &buf_dma); 603 600 if (!buf) { 604 601 netdev_err(netdev, "No memory left for USB buffer\n"); 605 602 usb_free_urb(urb); 606 603 err = -ENOMEM; 607 604 break; 608 605 } 606 + 607 + urb->transfer_dma = buf_dma; 609 608 610 609 usb_fill_bulk_urb(urb, dev->udev, usb_rcvbulkpipe(dev->udev, 2), 611 610 buf, RX_BUFFER_SIZE, ··· 623 618 usb_free_urb(urb); 624 619 break; 625 620 } 621 + 622 + dev->rxbuf[i] = buf; 623 + dev->rxbuf_dma[i] = buf_dma; 626 624 627 625 /* Drop reference, USB core will take care of freeing it */ 628 626 usb_free_urb(urb); ··· 691 683 usb_unlink_urb(dev->intr_urb); 692 684 693 685 usb_kill_anchored_urbs(&dev->rx_submitted); 686 + 687 + for (i = 0; i < MAX_RX_URBS; ++i) 688 + usb_free_coherent(dev->udev, RX_BUFFER_SIZE, 689 + dev->rxbuf[i], dev->rxbuf_dma[i]); 694 690 695 691 usb_kill_anchored_urbs(&dev->tx_submitted); 696 692 atomic_set(&dev->active_tx_urbs, 0);

+15 -1

drivers/net/can/usb/esd_usb2.c

··· 195 195 int net_count; 196 196 u32 version; 197 197 int rxinitdone; 198 + void *rxbuf[MAX_RX_URBS]; 199 + dma_addr_t rxbuf_dma[MAX_RX_URBS]; 198 200 }; 199 201 200 202 struct esd_usb2_net_priv { ··· 547 545 for (i = 0; i < MAX_RX_URBS; i++) { 548 546 struct urb *urb = NULL; 549 547 u8 *buf = NULL; 548 + dma_addr_t buf_dma; 550 549 551 550 /* create a URB, and a buffer for it */ 552 551 urb = usb_alloc_urb(0, GFP_KERNEL); ··· 557 554 } 558 555 559 556 buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL, 560 - &urb->transfer_dma); 557 + &buf_dma); 561 558 if (!buf) { 562 559 dev_warn(dev->udev->dev.parent, 563 560 "No memory left for USB buffer\n"); 564 561 err = -ENOMEM; 565 562 goto freeurb; 566 563 } 564 + 565 + urb->transfer_dma = buf_dma; 567 566 568 567 usb_fill_bulk_urb(urb, dev->udev, 569 568 usb_rcvbulkpipe(dev->udev, 1), ··· 579 574 usb_unanchor_urb(urb); 580 575 usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf, 581 576 urb->transfer_dma); 577 + goto freeurb; 582 578 } 579 + 580 + dev->rxbuf[i] = buf; 581 + dev->rxbuf_dma[i] = buf_dma; 583 582 584 583 freeurb: 585 584 /* Drop reference, USB core will take care of freeing it */ ··· 672 663 int i, j; 673 664 674 665 usb_kill_anchored_urbs(&dev->rx_submitted); 666 + 667 + for (i = 0; i < MAX_RX_URBS; ++i) 668 + usb_free_coherent(dev->udev, RX_BUFFER_SIZE, 669 + dev->rxbuf[i], dev->rxbuf_dma[i]); 670 + 675 671 for (i = 0; i < dev->net_count; i++) { 676 672 priv = dev->nets[i]; 677 673 if (priv) {

+2

drivers/net/can/usb/mcba_usb.c

··· 653 653 break; 654 654 } 655 655 656 + urb->transfer_dma = buf_dma; 657 + 656 658 usb_fill_bulk_urb(urb, priv->udev, 657 659 usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN), 658 660 buf, MCBA_USB_RX_BUFF_SIZE,

+6 -4

drivers/net/can/usb/peak_usb/pcan_usb.c

··· 117 117 #define PCAN_USB_BERR_MASK (PCAN_USB_ERR_RXERR | PCAN_USB_ERR_TXERR) 118 118 119 119 /* identify bus event packets with rx/tx error counters */ 120 - #define PCAN_USB_ERR_CNT 0x80 120 + #define PCAN_USB_ERR_CNT_DEC 0x00 /* counters are decreasing */ 121 + #define PCAN_USB_ERR_CNT_INC 0x80 /* counters are increasing */ 121 122 122 123 /* private to PCAN-USB adapter */ 123 124 struct pcan_usb { ··· 609 608 610 609 /* acccording to the content of the packet */ 611 610 switch (ir) { 612 - case PCAN_USB_ERR_CNT: 611 + case PCAN_USB_ERR_CNT_DEC: 612 + case PCAN_USB_ERR_CNT_INC: 613 613 614 614 /* save rx/tx error counters from in the device context */ 615 - pdev->bec.rxerr = mc->ptr[0]; 616 - pdev->bec.txerr = mc->ptr[1]; 615 + pdev->bec.rxerr = mc->ptr[1]; 616 + pdev->bec.txerr = mc->ptr[2]; 617 617 break; 618 618 619 619 default:

+13 -2

drivers/net/can/usb/usb_8dev.c

··· 137 137 u8 *cmd_msg_buffer; 138 138 139 139 struct mutex usb_8dev_cmd_lock; 140 - 140 + void *rxbuf[MAX_RX_URBS]; 141 + dma_addr_t rxbuf_dma[MAX_RX_URBS]; 141 142 }; 142 143 143 144 /* tx frame */ ··· 734 733 for (i = 0; i < MAX_RX_URBS; i++) { 735 734 struct urb *urb = NULL; 736 735 u8 *buf; 736 + dma_addr_t buf_dma; 737 737 738 738 /* create a URB, and a buffer for it */ 739 739 urb = usb_alloc_urb(0, GFP_KERNEL); ··· 744 742 } 745 743 746 744 buf = usb_alloc_coherent(priv->udev, RX_BUFFER_SIZE, GFP_KERNEL, 747 - &urb->transfer_dma); 745 + &buf_dma); 748 746 if (!buf) { 749 747 netdev_err(netdev, "No memory left for USB buffer\n"); 750 748 usb_free_urb(urb); 751 749 err = -ENOMEM; 752 750 break; 753 751 } 752 + 753 + urb->transfer_dma = buf_dma; 754 754 755 755 usb_fill_bulk_urb(urb, priv->udev, 756 756 usb_rcvbulkpipe(priv->udev, ··· 770 766 usb_free_urb(urb); 771 767 break; 772 768 } 769 + 770 + priv->rxbuf[i] = buf; 771 + priv->rxbuf_dma[i] = buf_dma; 773 772 774 773 /* Drop reference, USB core will take care of freeing it */ 775 774 usb_free_urb(urb); ··· 842 835 int i; 843 836 844 837 usb_kill_anchored_urbs(&priv->rx_submitted); 838 + 839 + for (i = 0; i < MAX_RX_URBS; ++i) 840 + usb_free_coherent(priv->udev, RX_BUFFER_SIZE, 841 + priv->rxbuf[i], priv->rxbuf_dma[i]); 845 842 846 843 usb_kill_anchored_urbs(&priv->tx_submitted); 847 844 atomic_set(&priv->active_tx_urbs, 0);

+1 -1

drivers/net/dsa/mv88e6xxx/chip.c

··· 2155 2155 int i, err; 2156 2156 2157 2157 if (!vid) 2158 - return -EOPNOTSUPP; 2158 + return 0; 2159 2159 2160 2160 err = mv88e6xxx_vtu_get(chip, vid, &vlan); 2161 2161 if (err)

+2 -3

drivers/net/ethernet/broadcom/bnxt/bnxt.c

··· 12131 12131 /* Make sure fw_reset_state is 0 before clearing the flag */ 12132 12132 smp_mb__before_atomic(); 12133 12133 clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state); 12134 - bnxt_ulp_start(bp, rc); 12135 - if (!rc) 12136 - bnxt_reenable_sriov(bp); 12134 + bnxt_ulp_start(bp, 0); 12135 + bnxt_reenable_sriov(bp); 12137 12136 bnxt_vf_reps_alloc(bp); 12138 12137 bnxt_vf_reps_open(bp); 12139 12138 bnxt_dl_health_recovery_done(bp);

+7

drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c

··· 353 353 354 354 bnxt_ptp_get_current_time(bp); 355 355 ptp->next_period = now + HZ; 356 + if (time_after_eq(now, ptp->next_overflow_check)) { 357 + spin_lock_bh(&ptp->ptp_lock); 358 + timecounter_read(&ptp->tc); 359 + spin_unlock_bh(&ptp->ptp_lock); 360 + ptp->next_overflow_check = now + BNXT_PHC_OVERFLOW_PERIOD; 361 + } 356 362 return HZ; 357 363 } 358 364 ··· 429 423 ptp->cc.shift = 0; 430 424 ptp->cc.mult = 1; 431 425 426 + ptp->next_overflow_check = jiffies + BNXT_PHC_OVERFLOW_PERIOD; 432 427 timecounter_init(&ptp->tc, &ptp->cc, ktime_to_ns(ktime_get_real())); 433 428 434 429 ptp->ptp_info = bnxt_ptp_caps;

+4

drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h

··· 32 32 u64 current_time; 33 33 u64 old_time; 34 34 unsigned long next_period; 35 + unsigned long next_overflow_check; 36 + /* 48-bit PHC overflows in 78 hours. Check overflow every 19 hours. */ 37 + #define BNXT_PHC_OVERFLOW_PERIOD (19 * 3600 * HZ) 38 + 35 39 u16 tx_seqid; 36 40 struct bnxt *bp; 37 41 atomic_t tx_avail;

+2 -5

drivers/net/ethernet/dec/tulip/winbond-840.c

··· 357 357 int i, option = find_cnt < MAX_UNITS ? options[find_cnt] : 0; 358 358 void __iomem *ioaddr; 359 359 360 - i = pci_enable_device(pdev); 360 + i = pcim_enable_device(pdev); 361 361 if (i) return i; 362 362 363 363 pci_set_master(pdev); ··· 379 379 380 380 ioaddr = pci_iomap(pdev, TULIP_BAR, netdev_res_size); 381 381 if (!ioaddr) 382 - goto err_out_free_res; 382 + goto err_out_netdev; 383 383 384 384 for (i = 0; i < 3; i++) 385 385 ((__le16 *)dev->dev_addr)[i] = cpu_to_le16(eeprom_read(ioaddr, i)); ··· 458 458 459 459 err_out_cleardev: 460 460 pci_iounmap(pdev, ioaddr); 461 - err_out_free_res: 462 - pci_release_regions(pdev); 463 461 err_out_netdev: 464 462 free_netdev (dev); 465 463 return -ENODEV; ··· 1524 1526 if (dev) { 1525 1527 struct netdev_private *np = netdev_priv(dev); 1526 1528 unregister_netdev(dev); 1527 - pci_release_regions(pdev); 1528 1529 pci_iounmap(pdev, np->base_addr); 1529 1530 free_netdev(dev); 1530 1531 }

+29 -7

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c

··· 5 5 #include "hclge_main.h" 6 6 #include "hnae3.h" 7 7 8 + static int hclge_ptp_get_cycle(struct hclge_dev *hdev) 9 + { 10 + struct hclge_ptp *ptp = hdev->ptp; 11 + 12 + ptp->cycle.quo = readl(hdev->ptp->io_base + HCLGE_PTP_CYCLE_QUO_REG) & 13 + HCLGE_PTP_CYCLE_QUO_MASK; 14 + ptp->cycle.numer = readl(hdev->ptp->io_base + HCLGE_PTP_CYCLE_NUM_REG); 15 + ptp->cycle.den = readl(hdev->ptp->io_base + HCLGE_PTP_CYCLE_DEN_REG); 16 + 17 + if (ptp->cycle.den == 0) { 18 + dev_err(&hdev->pdev->dev, "invalid ptp cycle denominator!\n"); 19 + return -EINVAL; 20 + } 21 + 22 + return 0; 23 + } 24 + 8 25 static int hclge_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb) 9 26 { 10 27 struct hclge_dev *hdev = hclge_ptp_get_hdev(ptp); 28 + struct hclge_ptp_cycle *cycle = &hdev->ptp->cycle; 11 29 u64 adj_val, adj_base, diff; 12 30 unsigned long flags; 13 31 bool is_neg = false; ··· 36 18 is_neg = true; 37 19 } 38 20 39 - adj_base = HCLGE_PTP_CYCLE_ADJ_BASE * HCLGE_PTP_CYCLE_ADJ_UNIT; 21 + adj_base = (u64)cycle->quo * (u64)cycle->den + (u64)cycle->numer; 40 22 adj_val = adj_base * ppb; 41 23 diff = div_u64(adj_val, 1000000000ULL); 42 24 ··· 47 29 48 30 /* This clock cycle is defined by three part: quotient, numerator 49 31 * and denominator. For example, 2.5ns, the quotient is 2, 50 - * denominator is fixed to HCLGE_PTP_CYCLE_ADJ_UNIT, and numerator 51 - * is 0.5 * HCLGE_PTP_CYCLE_ADJ_UNIT. 32 + * denominator is fixed to ptp->cycle.den, and numerator 33 + * is 0.5 * ptp->cycle.den. 52 34 */ 53 - quo = div_u64_rem(adj_val, HCLGE_PTP_CYCLE_ADJ_UNIT, &numerator); 35 + quo = div_u64_rem(adj_val, cycle->den, &numerator); 54 36 55 37 spin_lock_irqsave(&hdev->ptp->lock, flags); 56 - writel(quo, hdev->ptp->io_base + HCLGE_PTP_CYCLE_QUO_REG); 38 + writel(quo & HCLGE_PTP_CYCLE_QUO_MASK, 39 + hdev->ptp->io_base + HCLGE_PTP_CYCLE_QUO_REG); 57 40 writel(numerator, hdev->ptp->io_base + HCLGE_PTP_CYCLE_NUM_REG); 58 - writel(HCLGE_PTP_CYCLE_ADJ_UNIT, 59 - hdev->ptp->io_base + HCLGE_PTP_CYCLE_DEN_REG); 41 + writel(cycle->den, hdev->ptp->io_base + HCLGE_PTP_CYCLE_DEN_REG); 60 42 writel(HCLGE_PTP_CYCLE_ADJ_EN, 61 43 hdev->ptp->io_base + HCLGE_PTP_CYCLE_CFG_REG); 62 44 spin_unlock_irqrestore(&hdev->ptp->lock, flags); ··· 491 473 492 474 if (!hdev->ptp) { 493 475 ret = hclge_ptp_create_clock(hdev); 476 + if (ret) 477 + return ret; 478 + 479 + ret = hclge_ptp_get_cycle(hdev); 494 480 if (ret) 495 481 return ret; 496 482 }

+8 -2

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.h

··· 29 29 #define HCLGE_PTP_TIME_ADJ_REG 0x60 30 30 #define HCLGE_PTP_TIME_ADJ_EN BIT(0) 31 31 #define HCLGE_PTP_CYCLE_QUO_REG 0x64 32 + #define HCLGE_PTP_CYCLE_QUO_MASK GENMASK(7, 0) 32 33 #define HCLGE_PTP_CYCLE_DEN_REG 0x68 33 34 #define HCLGE_PTP_CYCLE_NUM_REG 0x6C 34 35 #define HCLGE_PTP_CYCLE_CFG_REG 0x70 ··· 38 37 #define HCLGE_PTP_CUR_TIME_SEC_L_REG 0x78 39 38 #define HCLGE_PTP_CUR_TIME_NSEC_REG 0x7C 40 39 41 - #define HCLGE_PTP_CYCLE_ADJ_BASE 2 42 40 #define HCLGE_PTP_CYCLE_ADJ_MAX 500000000 43 - #define HCLGE_PTP_CYCLE_ADJ_UNIT 100000000 44 41 #define HCLGE_PTP_SEC_H_OFFSET 32u 45 42 #define HCLGE_PTP_SEC_L_MASK GENMASK(31, 0) 46 43 47 44 #define HCLGE_PTP_FLAG_EN 0 48 45 #define HCLGE_PTP_FLAG_TX_EN 1 49 46 #define HCLGE_PTP_FLAG_RX_EN 2 47 + 48 + struct hclge_ptp_cycle { 49 + u32 quo; 50 + u32 numer; 51 + u32 den; 52 + }; 50 53 51 54 struct hclge_ptp { 52 55 struct hclge_dev *hdev; ··· 63 58 spinlock_t lock; /* protects ptp registers */ 64 59 u32 ptp_cfg; 65 60 u32 last_tx_seqid; 61 + struct hclge_ptp_cycle cycle; 66 62 unsigned long tx_start; 67 63 unsigned long tx_cnt; 68 64 unsigned long tx_skipped;

+5 -1

drivers/net/ethernet/intel/i40e/i40e_ethtool.c

··· 980 980 default: 981 981 /* if we got here and link is up something bad is afoot */ 982 982 netdev_info(netdev, 983 - "WARNING: Link is up but PHY type 0x%x is not recognized.\n", 983 + "WARNING: Link is up but PHY type 0x%x is not recognized, or incorrect cable is in use\n", 984 984 hw_link_info->phy_type); 985 985 } 986 986 ··· 5294 5294 dev_warn(&pf->pdev->dev, 5295 5295 "Device configuration forbids SW from starting the LLDP agent.\n"); 5296 5296 return -EINVAL; 5297 + case I40E_AQ_RC_EAGAIN: 5298 + dev_warn(&pf->pdev->dev, 5299 + "Stop FW LLDP agent command is still being processed, please try again in a second.\n"); 5300 + return -EBUSY; 5297 5301 default: 5298 5302 dev_warn(&pf->pdev->dev, 5299 5303 "Starting FW LLDP agent failed: error: %s, %s\n",

+37 -24

drivers/net/ethernet/intel/i40e/i40e_main.c

··· 4454 4454 } 4455 4455 4456 4456 /** 4457 - * i40e_vsi_control_tx - Start or stop a VSI's rings 4457 + * i40e_vsi_enable_tx - Start a VSI's rings 4458 4458 * @vsi: the VSI being configured 4459 - * @enable: start or stop the rings 4460 4459 **/ 4461 - static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable) 4460 + static int i40e_vsi_enable_tx(struct i40e_vsi *vsi) 4462 4461 { 4463 4462 struct i40e_pf *pf = vsi->back; 4464 4463 int i, pf_q, ret = 0; ··· 4466 4467 for (i = 0; i < vsi->num_queue_pairs; i++, pf_q++) { 4467 4468 ret = i40e_control_wait_tx_q(vsi->seid, pf, 4468 4469 pf_q, 4469 - false /*is xdp*/, enable); 4470 + false /*is xdp*/, true); 4470 4471 if (ret) 4471 4472 break; 4472 4473 ··· 4475 4476 4476 4477 ret = i40e_control_wait_tx_q(vsi->seid, pf, 4477 4478 pf_q + vsi->alloc_queue_pairs, 4478 - true /*is xdp*/, enable); 4479 + true /*is xdp*/, true); 4479 4480 if (ret) 4480 4481 break; 4481 4482 } ··· 4573 4574 } 4574 4575 4575 4576 /** 4576 - * i40e_vsi_control_rx - Start or stop a VSI's rings 4577 + * i40e_vsi_enable_rx - Start a VSI's rings 4577 4578 * @vsi: the VSI being configured 4578 - * @enable: start or stop the rings 4579 4579 **/ 4580 - static int i40e_vsi_control_rx(struct i40e_vsi *vsi, bool enable) 4580 + static int i40e_vsi_enable_rx(struct i40e_vsi *vsi) 4581 4581 { 4582 4582 struct i40e_pf *pf = vsi->back; 4583 4583 int i, pf_q, ret = 0; 4584 4584 4585 4585 pf_q = vsi->base_queue; 4586 4586 for (i = 0; i < vsi->num_queue_pairs; i++, pf_q++) { 4587 - ret = i40e_control_wait_rx_q(pf, pf_q, enable); 4587 + ret = i40e_control_wait_rx_q(pf, pf_q, true); 4588 4588 if (ret) { 4589 4589 dev_info(&pf->pdev->dev, 4590 - "VSI seid %d Rx ring %d %sable timeout\n", 4591 - vsi->seid, pf_q, (enable ? "en" : "dis")); 4590 + "VSI seid %d Rx ring %d enable timeout\n", 4591 + vsi->seid, pf_q); 4592 4592 break; 4593 4593 } 4594 4594 } 4595 - 4596 - /* Due to HW errata, on Rx disable only, the register can indicate done 4597 - * before it really is. Needs 50ms to be sure 4598 - */ 4599 - if (!enable) 4600 - mdelay(50); 4601 4595 4602 4596 return ret; 4603 4597 } ··· 4604 4612 int ret = 0; 4605 4613 4606 4614 /* do rx first for enable and last for disable */ 4607 - ret = i40e_vsi_control_rx(vsi, true); 4615 + ret = i40e_vsi_enable_rx(vsi); 4608 4616 if (ret) 4609 4617 return ret; 4610 - ret = i40e_vsi_control_tx(vsi, true); 4618 + ret = i40e_vsi_enable_tx(vsi); 4611 4619 4612 4620 return ret; 4613 4621 } 4622 + 4623 + #define I40E_DISABLE_TX_GAP_MSEC 50 4614 4624 4615 4625 /** 4616 4626 * i40e_vsi_stop_rings - Stop a VSI's rings ··· 4620 4626 **/ 4621 4627 void i40e_vsi_stop_rings(struct i40e_vsi *vsi) 4622 4628 { 4629 + struct i40e_pf *pf = vsi->back; 4630 + int pf_q, err, q_end; 4631 + 4623 4632 /* When port TX is suspended, don't wait */ 4624 4633 if (test_bit(__I40E_PORT_SUSPENDED, vsi->back->state)) 4625 4634 return i40e_vsi_stop_rings_no_wait(vsi); 4626 4635 4627 - /* do rx first for enable and last for disable 4628 - * Ignore return value, we need to shutdown whatever we can 4629 - */ 4630 - i40e_vsi_control_tx(vsi, false); 4631 - i40e_vsi_control_rx(vsi, false); 4636 + q_end = vsi->base_queue + vsi->num_queue_pairs; 4637 + for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++) 4638 + i40e_pre_tx_queue_cfg(&pf->hw, (u32)pf_q, false); 4639 + 4640 + for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++) { 4641 + err = i40e_control_wait_rx_q(pf, pf_q, false); 4642 + if (err) 4643 + dev_info(&pf->pdev->dev, 4644 + "VSI seid %d Rx ring %d dissable timeout\n", 4645 + vsi->seid, pf_q); 4646 + } 4647 + 4648 + msleep(I40E_DISABLE_TX_GAP_MSEC); 4649 + pf_q = vsi->base_queue; 4650 + for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++) 4651 + wr32(&pf->hw, I40E_QTX_ENA(pf_q), 0); 4652 + 4653 + i40e_vsi_wait_queues_disabled(vsi); 4632 4654 } 4633 4655 4634 4656 /** ··· 7290 7280 } 7291 7281 if (vsi->num_queue_pairs < 7292 7282 (mqprio_qopt->qopt.offset[i] + mqprio_qopt->qopt.count[i])) { 7283 + dev_err(&vsi->back->pdev->dev, 7284 + "Failed to create traffic channel, insufficient number of queues.\n"); 7293 7285 return -EINVAL; 7294 7286 } 7295 7287 if (sum_max_rate > i40e_get_link_speed(vsi)) { ··· 13273 13261 .ndo_poll_controller = i40e_netpoll, 13274 13262 #endif 13275 13263 .ndo_setup_tc = __i40e_setup_tc, 13264 + .ndo_select_queue = i40e_lan_select_queue, 13276 13265 .ndo_set_features = i40e_set_features, 13277 13266 .ndo_set_vf_mac = i40e_ndo_set_vf_mac, 13278 13267 .ndo_set_vf_vlan = i40e_ndo_set_vf_port_vlan,

+50

drivers/net/ethernet/intel/i40e/i40e_txrx.c

··· 3631 3631 return -1; 3632 3632 } 3633 3633 3634 + static u16 i40e_swdcb_skb_tx_hash(struct net_device *dev, 3635 + const struct sk_buff *skb, 3636 + u16 num_tx_queues) 3637 + { 3638 + u32 jhash_initval_salt = 0xd631614b; 3639 + u32 hash; 3640 + 3641 + if (skb->sk && skb->sk->sk_hash) 3642 + hash = skb->sk->sk_hash; 3643 + else 3644 + hash = (__force u16)skb->protocol ^ skb->hash; 3645 + 3646 + hash = jhash_1word(hash, jhash_initval_salt); 3647 + 3648 + return (u16)(((u64)hash * num_tx_queues) >> 32); 3649 + } 3650 + 3651 + u16 i40e_lan_select_queue(struct net_device *netdev, 3652 + struct sk_buff *skb, 3653 + struct net_device __always_unused *sb_dev) 3654 + { 3655 + struct i40e_netdev_priv *np = netdev_priv(netdev); 3656 + struct i40e_vsi *vsi = np->vsi; 3657 + struct i40e_hw *hw; 3658 + u16 qoffset; 3659 + u16 qcount; 3660 + u8 tclass; 3661 + u16 hash; 3662 + u8 prio; 3663 + 3664 + /* is DCB enabled at all? */ 3665 + if (vsi->tc_config.numtc == 1) 3666 + return i40e_swdcb_skb_tx_hash(netdev, skb, 3667 + netdev->real_num_tx_queues); 3668 + 3669 + prio = skb->priority; 3670 + hw = &vsi->back->hw; 3671 + tclass = hw->local_dcbx_config.etscfg.prioritytable[prio]; 3672 + /* sanity check */ 3673 + if (unlikely(!(vsi->tc_config.enabled_tc & BIT(tclass)))) 3674 + tclass = 0; 3675 + 3676 + /* select a queue assigned for the given TC */ 3677 + qcount = vsi->tc_config.tc_info[tclass].qcount; 3678 + hash = i40e_swdcb_skb_tx_hash(netdev, skb, qcount); 3679 + 3680 + qoffset = vsi->tc_config.tc_info[tclass].qoffset; 3681 + return qoffset + hash; 3682 + } 3683 + 3634 3684 /** 3635 3685 * i40e_xmit_xdp_ring - transmits an XDP buffer to an XDP Tx ring 3636 3686 * @xdpf: data to transmit

+2

drivers/net/ethernet/intel/i40e/i40e_txrx.h

··· 451 451 452 452 bool i40e_alloc_rx_buffers(struct i40e_ring *rxr, u16 cleaned_count); 453 453 netdev_tx_t i40e_lan_xmit_frame(struct sk_buff *skb, struct net_device *netdev); 454 + u16 i40e_lan_select_queue(struct net_device *netdev, struct sk_buff *skb, 455 + struct net_device *sb_dev); 454 456 void i40e_clean_tx_ring(struct i40e_ring *tx_ring); 455 457 void i40e_clean_rx_ring(struct i40e_ring *rx_ring); 456 458 int i40e_setup_tx_descriptors(struct i40e_ring *tx_ring);

+1 -1

drivers/net/ethernet/marvell/octeontx2/af/cgx.c

··· 1504 1504 1505 1505 /* Add reference */ 1506 1506 cgx->lmac_idmap[lmac->lmac_id] = lmac; 1507 - cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, true); 1508 1507 set_bit(lmac->lmac_id, &cgx->lmac_bmap); 1508 + cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, true); 1509 1509 } 1510 1510 1511 1511 return cgx_lmac_verify_fwi_version(cgx);

+3

drivers/net/ethernet/marvell/octeontx2/af/npc.h

··· 151 151 * Software assigns pkind for each incoming port such as CGX 152 152 * Ethernet interfaces, LBK interfaces, etc. 153 153 */ 154 + #define NPC_UNRESERVED_PKIND_COUNT NPC_RX_VLAN_EXDSA_PKIND 155 + 154 156 enum npc_pkind_type { 157 + NPC_RX_LBK_PKIND = 0ULL, 155 158 NPC_RX_VLAN_EXDSA_PKIND = 56ULL, 156 159 NPC_RX_CHLEN24B_PKIND = 57ULL, 157 160 NPC_RX_CPT_HDR_PKIND,

+4 -2

drivers/net/ethernet/marvell/octeontx2/af/rvu.c

··· 391 391 392 392 /* Get numVFs attached to this PF and first HWVF */ 393 393 cfg = rvu_read64(rvu, BLKADDR_RVUM, RVU_PRIV_PFX_CFG(pf)); 394 - *numvfs = (cfg >> 12) & 0xFF; 395 - *hwvf = cfg & 0xFFF; 394 + if (numvfs) 395 + *numvfs = (cfg >> 12) & 0xFF; 396 + if (hwvf) 397 + *hwvf = cfg & 0xFFF; 396 398 } 397 399 398 400 static int rvu_get_hwvf(struct rvu *rvu, int pcifunc)

+14 -3

drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c

··· 196 196 { 197 197 int err; 198 198 199 - /*Sync all in flight RX packets to LLC/DRAM */ 199 + /* Sync all in flight RX packets to LLC/DRAM */ 200 200 rvu_write64(rvu, blkaddr, NIX_AF_RX_SW_SYNC, BIT_ULL(0)); 201 201 err = rvu_poll_reg(rvu, blkaddr, NIX_AF_RX_SW_SYNC, BIT_ULL(0), true); 202 202 if (err) 203 - dev_err(rvu->dev, "NIX RX software sync failed\n"); 203 + dev_err(rvu->dev, "SYNC1: NIX RX software sync failed\n"); 204 + 205 + /* SW_SYNC ensures all existing transactions are finished and pkts 206 + * are written to LLC/DRAM, queues should be teared down after 207 + * successful SW_SYNC. Due to a HW errata, in some rare scenarios 208 + * an existing transaction might end after SW_SYNC operation. To 209 + * ensure operation is fully done, do the SW_SYNC twice. 210 + */ 211 + rvu_write64(rvu, blkaddr, NIX_AF_RX_SW_SYNC, BIT_ULL(0)); 212 + err = rvu_poll_reg(rvu, blkaddr, NIX_AF_RX_SW_SYNC, BIT_ULL(0), true); 213 + if (err) 214 + dev_err(rvu->dev, "SYNC2: NIX RX software sync failed\n"); 204 215 } 205 216 206 217 static bool is_valid_txschq(struct rvu *rvu, int blkaddr, ··· 309 298 rvu_nix_chan_lbk(rvu, lbkid, vf + 1); 310 299 pfvf->rx_chan_cnt = 1; 311 300 pfvf->tx_chan_cnt = 1; 301 + rvu_npc_set_pkind(rvu, NPC_RX_LBK_PKIND, pfvf); 312 302 rvu_npc_install_promisc_entry(rvu, pcifunc, nixlf, 313 303 pfvf->rx_chan_base, 314 304 pfvf->rx_chan_cnt); ··· 3854 3842 vlan = &nix_hw->txvlan; 3855 3843 kfree(vlan->rsrc.bmap); 3856 3844 mutex_destroy(&vlan->rsrc_lock); 3857 - devm_kfree(rvu->dev, vlan->entry2pfvf_map); 3858 3845 3859 3846 mcast = &nix_hw->mcast; 3860 3847 qmem_free(rvu->dev, mcast->mce_ctx);

+7 -4

drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c

··· 1721 1721 { 1722 1722 struct rvu_hwinfo *hw = rvu->hw; 1723 1723 int num_pkinds, num_kpus, idx; 1724 - struct npc_pkind *pkind; 1725 1724 1726 1725 /* Disable all KPUs and their entries */ 1727 1726 for (idx = 0; idx < hw->npc_kpus; idx++) { ··· 1738 1739 * Check HW max count to avoid configuring junk or 1739 1740 * writing to unsupported CSR addresses. 1740 1741 */ 1741 - pkind = &hw->pkind; 1742 1742 num_pkinds = rvu->kpu.pkinds; 1743 - num_pkinds = min_t(int, pkind->rsrc.max, num_pkinds); 1743 + num_pkinds = min_t(int, hw->npc_pkinds, num_pkinds); 1744 1744 1745 1745 for (idx = 0; idx < num_pkinds; idx++) 1746 1746 npc_config_kpuaction(rvu, blkaddr, &rvu->kpu.ikpu[idx], 0, idx, true); ··· 1889 1891 if (npc_const1 & BIT_ULL(63)) 1890 1892 npc_const2 = rvu_read64(rvu, blkaddr, NPC_AF_CONST2); 1891 1893 1892 - pkind->rsrc.max = (npc_const1 >> 12) & 0xFFULL; 1894 + pkind->rsrc.max = NPC_UNRESERVED_PKIND_COUNT; 1895 + hw->npc_pkinds = (npc_const1 >> 12) & 0xFFULL; 1893 1896 hw->npc_kpu_entries = npc_const1 & 0xFFFULL; 1894 1897 hw->npc_kpus = (npc_const >> 8) & 0x1FULL; 1895 1898 hw->npc_intfs = npc_const & 0xFULL; ··· 2001 2002 err = rvu_alloc_bitmap(&pkind->rsrc); 2002 2003 if (err) 2003 2004 return err; 2005 + /* Reserve PKIND#0 for LBKs. Power reset value of LBK_CH_PKIND is '0', 2006 + * no need to configure PKIND for all LBKs separately. 2007 + */ 2008 + rvu_alloc_rsrc(&pkind->rsrc); 2004 2009 2005 2010 /* Allocate mem for pkind to PF and channel mapping info */ 2006 2011 pkind->pfchan_map = devm_kcalloc(rvu->dev, pkind->rsrc.max,

+6 -5

drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c

··· 71 71 struct rvu_switch *rswitch = &rvu->rswitch; 72 72 u16 start = rswitch->start_entry; 73 73 struct rvu_hwinfo *hw = rvu->hw; 74 - int pf, vf, numvfs, hwvf; 75 74 u16 pcifunc, entry = 0; 75 + int pf, vf, numvfs; 76 76 int err; 77 77 78 78 for (pf = 1; pf < hw->total_pfs; pf++) { ··· 110 110 111 111 rswitch->entry2pcifunc[entry++] = pcifunc; 112 112 113 - rvu_get_pf_numvfs(rvu, pf, &numvfs, &hwvf); 114 - for (vf = 0; vf < numvfs; vf++, hwvf++) { 113 + rvu_get_pf_numvfs(rvu, pf, &numvfs, NULL); 114 + for (vf = 0; vf < numvfs; vf++) { 115 115 pcifunc = pf << 10 | ((vf + 1) & 0x3FF); 116 116 rvu_get_nix_blkaddr(rvu, pcifunc); 117 117 ··· 198 198 struct npc_mcam_free_entry_req free_req = { 0 }; 199 199 struct rvu_switch *rswitch = &rvu->rswitch; 200 200 struct rvu_hwinfo *hw = rvu->hw; 201 - int pf, vf, numvfs, hwvf; 201 + int pf, vf, numvfs; 202 202 struct msg_rsp rsp; 203 203 u16 pcifunc; 204 204 int err; ··· 217 217 "Reverting RX rule for PF%d failed(%d)\n", 218 218 pf, err); 219 219 220 - for (vf = 0; vf < numvfs; vf++, hwvf++) { 220 + rvu_get_pf_numvfs(rvu, pf, &numvfs, NULL); 221 + for (vf = 0; vf < numvfs; vf++) { 221 222 pcifunc = pf << 10 | ((vf + 1) & 0x3FF); 222 223 err = rvu_switch_install_rx_rule(rvu, pcifunc, 0xFFF); 223 224 if (err)

+8 -6

drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c

··· 924 924 aq->cq.drop = RQ_DROP_LVL_CQ(pfvf->hw.rq_skid, cq->cqe_cnt); 925 925 aq->cq.drop_ena = 1; 926 926 927 - /* Enable receive CQ backpressure */ 928 - aq->cq.bp_ena = 1; 929 - aq->cq.bpid = pfvf->bpid[0]; 927 + if (!is_otx2_lbkvf(pfvf->pdev)) { 928 + /* Enable receive CQ backpressure */ 929 + aq->cq.bp_ena = 1; 930 + aq->cq.bpid = pfvf->bpid[0]; 930 931 931 - /* Set backpressure level is same as cq pass level */ 932 - aq->cq.bp = RQ_PASS_LVL_CQ(pfvf->hw.rq_skid, qset->rqe_cnt); 932 + /* Set backpressure level is same as cq pass level */ 933 + aq->cq.bp = RQ_PASS_LVL_CQ(pfvf->hw.rq_skid, qset->rqe_cnt); 934 + } 933 935 } 934 936 935 937 /* Fill AQ info */ ··· 1188 1186 aq->aura.fc_hyst_bits = 0; /* Store count on all updates */ 1189 1187 1190 1188 /* Enable backpressure for RQ aura */ 1191 - if (aura_id < pfvf->hw.rqpool_cnt) { 1189 + if (aura_id < pfvf->hw.rqpool_cnt && !is_otx2_lbkvf(pfvf->pdev)) { 1192 1190 aq->aura.bp_ena = 0; 1193 1191 aq->aura.nix0_bpid = pfvf->bpid[0]; 1194 1192 /* Set backpressure level for RQ's Aura */

+3 -4

drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c

··· 298 298 err = otx2_set_real_num_queues(dev, channel->tx_count, 299 299 channel->rx_count); 300 300 if (err) 301 - goto fail; 301 + return err; 302 302 303 303 pfvf->hw.rx_queues = channel->rx_count; 304 304 pfvf->hw.tx_queues = channel->tx_count; 305 305 pfvf->qset.cq_cnt = pfvf->hw.tx_queues + pfvf->hw.rx_queues; 306 306 307 - fail: 308 307 if (if_up) 309 - dev->netdev_ops->ndo_open(dev); 308 + err = dev->netdev_ops->ndo_open(dev); 310 309 311 310 netdev_info(dev, "Setting num Tx rings to %d, Rx rings to %d success\n", 312 311 pfvf->hw.tx_queues, pfvf->hw.rx_queues); ··· 409 410 qs->rqe_cnt = rx_count; 410 411 411 412 if (if_up) 412 - netdev->netdev_ops->ndo_open(netdev); 413 + return netdev->netdev_ops->ndo_open(netdev); 413 414 414 415 return 0; 415 416 }

+5

drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c

··· 1662 1662 err_tx_stop_queues: 1663 1663 netif_tx_stop_all_queues(netdev); 1664 1664 netif_carrier_off(netdev); 1665 + pf->flags |= OTX2_FLAG_INTF_DOWN; 1665 1666 err_free_cints: 1666 1667 otx2_free_cints(pf, qidx); 1667 1668 vec = pci_irq_vector(pf->pdev, ··· 1689 1688 struct otx2_qset *qset = &pf->qset; 1690 1689 struct otx2_rss_info *rss; 1691 1690 int qidx, vec, wrk; 1691 + 1692 + /* If the DOWN flag is set resources are already freed */ 1693 + if (pf->flags & OTX2_FLAG_INTF_DOWN) 1694 + return 0; 1692 1695 1693 1696 netif_carrier_off(netdev); 1694 1697 netif_tx_stop_all_queues(netdev);

+1

drivers/net/ethernet/mellanox/mlx4/main.c

··· 3535 3535 3536 3536 if (!SRIOV_VALID_STATE(dev->flags)) { 3537 3537 mlx4_err(dev, "Invalid SRIOV state\n"); 3538 + err = -EINVAL; 3538 3539 goto err_close; 3539 3540 } 3540 3541 }

+1 -4

drivers/net/ethernet/mellanox/mlx5/core/dev.c

··· 500 500 return 1; 501 501 } 502 502 503 - /* This function is called with two flows: 504 - * 1. During initialization of mlx5_core_dev and we don't need to lock it. 505 - * 2. During LAG configure stage and caller holds &mlx5_intf_mutex. 506 - */ 503 + /* Must be called with intf_mutex held */ 507 504 struct mlx5_core_dev *mlx5_get_next_phys_dev(struct mlx5_core_dev *dev) 508 505 { 509 506 struct auxiliary_device *adev;

+10 -1

drivers/net/ethernet/mellanox/mlx5/core/en/params.c

··· 471 471 param->cq_period_mode = params->rx_cq_moderation.cq_period_mode; 472 472 } 473 473 474 + static u8 rq_end_pad_mode(struct mlx5_core_dev *mdev, struct mlx5e_params *params) 475 + { 476 + bool ro = pcie_relaxed_ordering_enabled(mdev->pdev) && 477 + MLX5_CAP_GEN(mdev, relaxed_ordering_write); 478 + 479 + return ro && params->lro_en ? 480 + MLX5_WQ_END_PAD_MODE_NONE : MLX5_WQ_END_PAD_MODE_ALIGN; 481 + } 482 + 474 483 int mlx5e_build_rq_param(struct mlx5_core_dev *mdev, 475 484 struct mlx5e_params *params, 476 485 struct mlx5e_xsk_param *xsk, ··· 517 508 } 518 509 519 510 MLX5_SET(wq, wq, wq_type, params->rq_wq_type); 520 - MLX5_SET(wq, wq, end_padding_mode, MLX5_WQ_END_PAD_MODE_ALIGN); 511 + MLX5_SET(wq, wq, end_padding_mode, rq_end_pad_mode(mdev, params)); 521 512 MLX5_SET(wq, wq, log_wq_stride, 522 513 mlx5e_get_rqwq_log_stride(params->rq_wq_type, ndsegs)); 523 514 MLX5_SET(wq, wq, pd, mdev->mlx5e_res.hw_objs.pdn);

+5 -2

drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c

··· 482 482 params->log_sq_size = orig->log_sq_size; 483 483 mlx5e_ptp_build_sq_param(c->mdev, params, &cparams->txq_sq_param); 484 484 } 485 - if (test_bit(MLX5E_PTP_STATE_RX, c->state)) 485 + /* RQ */ 486 + if (test_bit(MLX5E_PTP_STATE_RX, c->state)) { 487 + params->vlan_strip_disable = orig->vlan_strip_disable; 486 488 mlx5e_ptp_build_rq_param(c->mdev, c->netdev, c->priv->q_counter, cparams); 489 + } 487 490 } 488 491 489 492 static int mlx5e_init_ptp_rq(struct mlx5e_ptp *c, struct mlx5e_params *params, ··· 497 494 int err; 498 495 499 496 rq->wq_type = params->rq_wq_type; 500 - rq->pdev = mdev->device; 497 + rq->pdev = c->pdev; 501 498 rq->netdev = priv->netdev; 502 499 rq->priv = priv; 503 500 rq->clock = &mdev->clock;

+1 -1

drivers/net/ethernet/mellanox/mlx5/core/en/trap.c

··· 37 37 struct mlx5e_priv *priv = t->priv; 38 38 39 39 rq->wq_type = params->rq_wq_type; 40 - rq->pdev = mdev->device; 40 + rq->pdev = t->pdev; 41 41 rq->netdev = priv->netdev; 42 42 rq->priv = priv; 43 43 rq->clock = &mdev->clock;

+26 -12

drivers/net/ethernet/mellanox/mlx5/core/en_main.c

··· 3384 3384 3385 3385 static int mlx5e_modify_channels_vsd(struct mlx5e_channels *chs, bool vsd) 3386 3386 { 3387 - int err = 0; 3387 + int err; 3388 3388 int i; 3389 3389 3390 3390 for (i = 0; i < chs->num; i++) { ··· 3392 3392 if (err) 3393 3393 return err; 3394 3394 } 3395 + if (chs->ptp && test_bit(MLX5E_PTP_STATE_RX, chs->ptp->state)) 3396 + return mlx5e_modify_rq_vsd(&chs->ptp->rq, vsd); 3395 3397 3396 3398 return 0; 3397 3399 } ··· 3831 3829 return 0; 3832 3830 } 3833 3831 3832 + static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev, 3833 + netdev_features_t features) 3834 + { 3835 + features &= ~NETIF_F_HW_TLS_RX; 3836 + if (netdev->features & NETIF_F_HW_TLS_RX) 3837 + netdev_warn(netdev, "Disabling hw_tls_rx, not supported in switchdev mode\n"); 3838 + 3839 + features &= ~NETIF_F_HW_TLS_TX; 3840 + if (netdev->features & NETIF_F_HW_TLS_TX) 3841 + netdev_warn(netdev, "Disabling hw_tls_tx, not supported in switchdev mode\n"); 3842 + 3843 + features &= ~NETIF_F_NTUPLE; 3844 + if (netdev->features & NETIF_F_NTUPLE) 3845 + netdev_warn(netdev, "Disabling ntuple, not supported in switchdev mode\n"); 3846 + 3847 + return features; 3848 + } 3849 + 3834 3850 static netdev_features_t mlx5e_fix_features(struct net_device *netdev, 3835 3851 netdev_features_t features) 3836 3852 { ··· 3880 3860 netdev_warn(netdev, "Disabling rxhash, not supported when CQE compress is active\n"); 3881 3861 } 3882 3862 3883 - if (mlx5e_is_uplink_rep(priv)) { 3884 - features &= ~NETIF_F_HW_TLS_RX; 3885 - if (netdev->features & NETIF_F_HW_TLS_RX) 3886 - netdev_warn(netdev, "Disabling hw_tls_rx, not supported in switchdev mode\n"); 3887 - 3888 - features &= ~NETIF_F_HW_TLS_TX; 3889 - if (netdev->features & NETIF_F_HW_TLS_TX) 3890 - netdev_warn(netdev, "Disabling hw_tls_tx, not supported in switchdev mode\n"); 3891 - } 3863 + if (mlx5e_is_uplink_rep(priv)) 3864 + features = mlx5e_fix_uplink_rep_features(netdev, features); 3892 3865 3893 3866 mutex_unlock(&priv->state_lock); 3894 3867 ··· 4872 4859 if (MLX5_CAP_ETH(mdev, scatter_fcs)) 4873 4860 netdev->hw_features |= NETIF_F_RXFCS; 4874 4861 4862 + if (mlx5_qos_is_supported(mdev)) 4863 + netdev->hw_features |= NETIF_F_HW_TC; 4864 + 4875 4865 netdev->features = netdev->hw_features; 4876 4866 4877 4867 /* Defaults */ ··· 4895 4879 netdev->hw_features |= NETIF_F_NTUPLE; 4896 4880 #endif 4897 4881 } 4898 - if (mlx5_qos_is_supported(mdev)) 4899 - netdev->features |= NETIF_F_HW_TC; 4900 4882 4901 4883 netdev->features |= NETIF_F_HIGHDMA; 4902 4884 netdev->features |= NETIF_F_HW_VLAN_STAG_FILTER;

+31 -2

drivers/net/ethernet/mellanox/mlx5/core/en_tc.c

··· 452 452 static 453 453 struct mlx5_core_dev *mlx5e_hairpin_get_mdev(struct net *net, int ifindex) 454 454 { 455 + struct mlx5_core_dev *mdev; 455 456 struct net_device *netdev; 456 457 struct mlx5e_priv *priv; 457 458 458 - netdev = __dev_get_by_index(net, ifindex); 459 + netdev = dev_get_by_index(net, ifindex); 460 + if (!netdev) 461 + return ERR_PTR(-ENODEV); 462 + 459 463 priv = netdev_priv(netdev); 460 - return priv->mdev; 464 + mdev = priv->mdev; 465 + dev_put(netdev); 466 + 467 + /* Mirred tc action holds a refcount on the ifindex net_device (see 468 + * net/sched/act_mirred.c:tcf_mirred_get_dev). So, it's okay to continue using mdev 469 + * after dev_put(netdev), while we're in the context of adding a tc flow. 470 + * 471 + * The mdev pointer corresponds to the peer/out net_device of a hairpin. It is then 472 + * stored in a hairpin object, which exists until all flows, that refer to it, get 473 + * removed. 474 + * 475 + * On the other hand, after a hairpin object has been created, the peer net_device may 476 + * be removed/unbound while there are still some hairpin flows that are using it. This 477 + * case is handled by mlx5e_tc_hairpin_update_dead_peer, which is hooked to 478 + * NETDEV_UNREGISTER event of the peer net_device. 479 + */ 480 + return mdev; 461 481 } 462 482 463 483 static int mlx5e_hairpin_create_transport(struct mlx5e_hairpin *hp) ··· 686 666 687 667 func_mdev = priv->mdev; 688 668 peer_mdev = mlx5e_hairpin_get_mdev(dev_net(priv->netdev), peer_ifindex); 669 + if (IS_ERR(peer_mdev)) { 670 + err = PTR_ERR(peer_mdev); 671 + goto create_pair_err; 672 + } 689 673 690 674 pair = mlx5_core_hairpin_create(func_mdev, peer_mdev, params); 691 675 if (IS_ERR(pair)) { ··· 828 804 int err; 829 805 830 806 peer_mdev = mlx5e_hairpin_get_mdev(dev_net(priv->netdev), peer_ifindex); 807 + if (IS_ERR(peer_mdev)) { 808 + NL_SET_ERR_MSG_MOD(extack, "invalid ifindex of mirred device"); 809 + return PTR_ERR(peer_mdev); 810 + } 811 + 831 812 if (!MLX5_CAP_GEN(priv->mdev, hairpin) || !MLX5_CAP_GEN(peer_mdev, hairpin)) { 832 813 NL_SET_ERR_MSG_MOD(extack, "hairpin is not supported"); 833 814 return -EOPNOTSUPP;

+1 -1

drivers/net/ethernet/mellanox/mlx5/core/eswitch.h

··· 636 636 }; 637 637 638 638 struct mlx5_vport_tbl_attr { 639 - u16 chain; 639 + u32 chain; 640 640 u16 prio; 641 641 u16 vport; 642 642 const struct esw_vport_tbl_namespace *vport_ns;

+7 -3

drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c

··· 382 382 { 383 383 dest[dest_idx].type = MLX5_FLOW_DESTINATION_TYPE_VPORT; 384 384 dest[dest_idx].vport.num = esw_attr->dests[attr_idx].rep->vport; 385 - dest[dest_idx].vport.vhca_id = 386 - MLX5_CAP_GEN(esw_attr->dests[attr_idx].mdev, vhca_id); 387 - if (MLX5_CAP_ESW(esw->dev, merged_eswitch)) 385 + if (MLX5_CAP_ESW(esw->dev, merged_eswitch)) { 386 + dest[dest_idx].vport.vhca_id = 387 + MLX5_CAP_GEN(esw_attr->dests[attr_idx].mdev, vhca_id); 388 388 dest[dest_idx].vport.flags |= MLX5_FLOW_DEST_VPORT_VHCA_ID; 389 + } 389 390 if (esw_attr->dests[attr_idx].flags & MLX5_ESW_DEST_ENCAP) { 390 391 if (pkt_reformat) { 391 392 flow_act->action |= MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT; ··· 2368 2367 2369 2368 switch (event) { 2370 2369 case ESW_OFFLOADS_DEVCOM_PAIR: 2370 + if (mlx5_get_next_phys_dev(esw->dev) != peer_esw->dev) 2371 + break; 2372 + 2371 2373 if (mlx5_eswitch_vport_match_metadata_enabled(esw) != 2372 2374 mlx5_eswitch_vport_match_metadata_enabled(peer_esw)) 2373 2375 break;

+6 -4

drivers/net/ethernet/mellanox/mlx5/core/fs_core.c

··· 1024 1024 static int connect_flow_table(struct mlx5_core_dev *dev, struct mlx5_flow_table *ft, 1025 1025 struct fs_prio *prio) 1026 1026 { 1027 - struct mlx5_flow_table *next_ft; 1027 + struct mlx5_flow_table *next_ft, *first_ft; 1028 1028 int err = 0; 1029 1029 1030 1030 /* Connect_prev_fts and update_root_ft_create are mutually exclusive */ 1031 1031 1032 - if (list_empty(&prio->node.children)) { 1032 + first_ft = list_first_entry_or_null(&prio->node.children, 1033 + struct mlx5_flow_table, node.list); 1034 + if (!first_ft || first_ft->level > ft->level) { 1033 1035 err = connect_prev_fts(dev, ft, prio); 1034 1036 if (err) 1035 1037 return err; 1036 1038 1037 - next_ft = find_next_chained_ft(prio); 1039 + next_ft = first_ft ? first_ft : find_next_chained_ft(prio); 1038 1040 err = connect_fwd_rules(dev, ft, next_ft); 1039 1041 if (err) 1040 1042 return err; ··· 2122 2120 node.list) == ft)) 2123 2121 return 0; 2124 2122 2125 - next_ft = find_next_chained_ft(prio); 2123 + next_ft = find_next_ft(ft); 2126 2124 err = connect_fwd_rules(dev, next_ft, ft); 2127 2125 if (err) 2128 2126 return err;

+10 -2

drivers/net/ethernet/mellanox/mlx5/core/health.c

··· 626 626 } 627 627 fw_reporter_ctx.err_synd = health->synd; 628 628 fw_reporter_ctx.miss_counter = health->miss_counter; 629 - devlink_health_report(health->fw_fatal_reporter, 630 - "FW fatal error reported", &fw_reporter_ctx); 629 + if (devlink_health_report(health->fw_fatal_reporter, 630 + "FW fatal error reported", &fw_reporter_ctx) == -ECANCELED) { 631 + /* If recovery wasn't performed, due to grace period, 632 + * unload the driver. This ensures that the driver 633 + * closes all its resources and it is not subjected to 634 + * requests from the kernel. 635 + */ 636 + mlx5_core_err(dev, "Driver is in error state. Unloading\n"); 637 + mlx5_unload_one(dev); 638 + } 631 639 } 632 640 633 641 static const struct devlink_health_reporter_ops mlx5_fw_fatal_reporter_ops = {

+107 -112

drivers/net/ethernet/pensando/ionic/ionic_lif.c

··· 29 29 */ 30 30 }; 31 31 32 - static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode); 32 + static void ionic_lif_rx_mode(struct ionic_lif *lif); 33 33 static int ionic_lif_addr_add(struct ionic_lif *lif, const u8 *addr); 34 34 static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr); 35 35 static void ionic_link_status_check(struct ionic_lif *lif); ··· 53 53 cur_moder = net_dim_get_rx_moderation(dim->mode, dim->profile_ix); 54 54 qcq = container_of(dim, struct ionic_qcq, dim); 55 55 new_coal = ionic_coal_usec_to_hw(qcq->q.lif->ionic, cur_moder.usec); 56 - qcq->intr.dim_coal_hw = new_coal ? new_coal : 1; 56 + new_coal = new_coal ? new_coal : 1; 57 + 58 + if (qcq->intr.dim_coal_hw != new_coal) { 59 + unsigned int qi = qcq->cq.bound_q->index; 60 + struct ionic_lif *lif = qcq->q.lif; 61 + 62 + qcq->intr.dim_coal_hw = new_coal; 63 + 64 + ionic_intr_coal_init(lif->ionic->idev.intr_ctrl, 65 + lif->rxqcqs[qi]->intr.index, 66 + qcq->intr.dim_coal_hw); 67 + } 68 + 57 69 dim->state = DIM_START_MEASURE; 58 70 } 59 71 ··· 89 77 90 78 switch (w->type) { 91 79 case IONIC_DW_TYPE_RX_MODE: 92 - ionic_lif_rx_mode(lif, w->rx_mode); 80 + ionic_lif_rx_mode(lif); 93 81 break; 94 82 case IONIC_DW_TYPE_RX_ADDR_ADD: 95 83 ionic_lif_addr_add(lif, w->addr); ··· 1313 1301 return 0; 1314 1302 } 1315 1303 1316 - static int ionic_lif_addr(struct ionic_lif *lif, const u8 *addr, bool add, 1317 - bool can_sleep) 1304 + static int ionic_lif_addr(struct ionic_lif *lif, const u8 *addr, bool add) 1318 1305 { 1319 - struct ionic_deferred_work *work; 1320 1306 unsigned int nmfilters; 1321 1307 unsigned int nufilters; 1322 1308 ··· 1340 1330 lif->nucast--; 1341 1331 } 1342 1332 1343 - if (!can_sleep) { 1344 - work = kzalloc(sizeof(*work), GFP_ATOMIC); 1345 - if (!work) 1346 - return -ENOMEM; 1347 - work->type = add ? IONIC_DW_TYPE_RX_ADDR_ADD : 1348 - IONIC_DW_TYPE_RX_ADDR_DEL; 1349 - memcpy(work->addr, addr, ETH_ALEN); 1350 - netdev_dbg(lif->netdev, "deferred: rx_filter %s %pM\n", 1351 - add ? "add" : "del", addr); 1352 - ionic_lif_deferred_enqueue(&lif->deferred, work); 1353 - } else { 1354 - netdev_dbg(lif->netdev, "rx_filter %s %pM\n", 1355 - add ? "add" : "del", addr); 1356 - if (add) 1357 - return ionic_lif_addr_add(lif, addr); 1358 - else 1359 - return ionic_lif_addr_del(lif, addr); 1360 - } 1333 + netdev_dbg(lif->netdev, "rx_filter %s %pM\n", 1334 + add ? "add" : "del", addr); 1335 + if (add) 1336 + return ionic_lif_addr_add(lif, addr); 1337 + else 1338 + return ionic_lif_addr_del(lif, addr); 1361 1339 1362 1340 return 0; 1363 1341 } 1364 1342 1365 1343 static int ionic_addr_add(struct net_device *netdev, const u8 *addr) 1366 1344 { 1367 - return ionic_lif_addr(netdev_priv(netdev), addr, ADD_ADDR, CAN_SLEEP); 1368 - } 1369 - 1370 - static int ionic_ndo_addr_add(struct net_device *netdev, const u8 *addr) 1371 - { 1372 - return ionic_lif_addr(netdev_priv(netdev), addr, ADD_ADDR, CAN_NOT_SLEEP); 1345 + return ionic_lif_addr(netdev_priv(netdev), addr, ADD_ADDR); 1373 1346 } 1374 1347 1375 1348 static int ionic_addr_del(struct net_device *netdev, const u8 *addr) 1376 1349 { 1377 - return ionic_lif_addr(netdev_priv(netdev), addr, DEL_ADDR, CAN_SLEEP); 1350 + return ionic_lif_addr(netdev_priv(netdev), addr, DEL_ADDR); 1378 1351 } 1379 1352 1380 - static int ionic_ndo_addr_del(struct net_device *netdev, const u8 *addr) 1353 + static void ionic_lif_rx_mode(struct ionic_lif *lif) 1381 1354 { 1382 - return ionic_lif_addr(netdev_priv(netdev), addr, DEL_ADDR, CAN_NOT_SLEEP); 1383 - } 1384 - 1385 - static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode) 1386 - { 1387 - struct ionic_admin_ctx ctx = { 1388 - .work = COMPLETION_INITIALIZER_ONSTACK(ctx.work), 1389 - .cmd.rx_mode_set = { 1390 - .opcode = IONIC_CMD_RX_MODE_SET, 1391 - .lif_index = cpu_to_le16(lif->index), 1392 - .rx_mode = cpu_to_le16(rx_mode), 1393 - }, 1394 - }; 1355 + struct net_device *netdev = lif->netdev; 1356 + unsigned int nfilters; 1357 + unsigned int nd_flags; 1395 1358 char buf[128]; 1396 - int err; 1359 + u16 rx_mode; 1397 1360 int i; 1398 1361 #define REMAIN(__x) (sizeof(buf) - (__x)) 1362 + 1363 + mutex_lock(&lif->config_lock); 1364 + 1365 + /* grab the flags once for local use */ 1366 + nd_flags = netdev->flags; 1367 + 1368 + rx_mode = IONIC_RX_MODE_F_UNICAST; 1369 + rx_mode |= (nd_flags & IFF_MULTICAST) ? IONIC_RX_MODE_F_MULTICAST : 0; 1370 + rx_mode |= (nd_flags & IFF_BROADCAST) ? IONIC_RX_MODE_F_BROADCAST : 0; 1371 + rx_mode |= (nd_flags & IFF_PROMISC) ? IONIC_RX_MODE_F_PROMISC : 0; 1372 + rx_mode |= (nd_flags & IFF_ALLMULTI) ? IONIC_RX_MODE_F_ALLMULTI : 0; 1373 + 1374 + /* sync unicast addresses 1375 + * next check to see if we're in an overflow state 1376 + * if so, we track that we overflowed and enable NIC PROMISC 1377 + * else if the overflow is set and not needed 1378 + * we remove our overflow flag and check the netdev flags 1379 + * to see if we can disable NIC PROMISC 1380 + */ 1381 + __dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del); 1382 + nfilters = le32_to_cpu(lif->identity->eth.max_ucast_filters); 1383 + if (netdev_uc_count(netdev) + 1 > nfilters) { 1384 + rx_mode |= IONIC_RX_MODE_F_PROMISC; 1385 + lif->uc_overflow = true; 1386 + } else if (lif->uc_overflow) { 1387 + lif->uc_overflow = false; 1388 + if (!(nd_flags & IFF_PROMISC)) 1389 + rx_mode &= ~IONIC_RX_MODE_F_PROMISC; 1390 + } 1391 + 1392 + /* same for multicast */ 1393 + __dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del); 1394 + nfilters = le32_to_cpu(lif->identity->eth.max_mcast_filters); 1395 + if (netdev_mc_count(netdev) > nfilters) { 1396 + rx_mode |= IONIC_RX_MODE_F_ALLMULTI; 1397 + lif->mc_overflow = true; 1398 + } else if (lif->mc_overflow) { 1399 + lif->mc_overflow = false; 1400 + if (!(nd_flags & IFF_ALLMULTI)) 1401 + rx_mode &= ~IONIC_RX_MODE_F_ALLMULTI; 1402 + } 1399 1403 1400 1404 i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:", 1401 1405 lif->rx_mode, rx_mode); ··· 1423 1399 i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC"); 1424 1400 if (rx_mode & IONIC_RX_MODE_F_ALLMULTI) 1425 1401 i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI"); 1426 - netdev_dbg(lif->netdev, "lif%d %s\n", lif->index, buf); 1402 + if (rx_mode & IONIC_RX_MODE_F_RDMA_SNIFFER) 1403 + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_RDMA_SNIFFER"); 1404 + netdev_dbg(netdev, "lif%d %s\n", lif->index, buf); 1427 1405 1428 - err = ionic_adminq_post_wait(lif, &ctx); 1429 - if (err) 1430 - netdev_warn(lif->netdev, "set rx_mode 0x%04x failed: %d\n", 1431 - rx_mode, err); 1432 - else 1433 - lif->rx_mode = rx_mode; 1406 + if (lif->rx_mode != rx_mode) { 1407 + struct ionic_admin_ctx ctx = { 1408 + .work = COMPLETION_INITIALIZER_ONSTACK(ctx.work), 1409 + .cmd.rx_mode_set = { 1410 + .opcode = IONIC_CMD_RX_MODE_SET, 1411 + .lif_index = cpu_to_le16(lif->index), 1412 + }, 1413 + }; 1414 + int err; 1415 + 1416 + ctx.cmd.rx_mode_set.rx_mode = cpu_to_le16(rx_mode); 1417 + err = ionic_adminq_post_wait(lif, &ctx); 1418 + if (err) 1419 + netdev_warn(netdev, "set rx_mode 0x%04x failed: %d\n", 1420 + rx_mode, err); 1421 + else 1422 + lif->rx_mode = rx_mode; 1423 + } 1424 + 1425 + mutex_unlock(&lif->config_lock); 1434 1426 } 1435 1427 1436 1428 static void ionic_set_rx_mode(struct net_device *netdev, bool can_sleep) 1437 1429 { 1438 1430 struct ionic_lif *lif = netdev_priv(netdev); 1439 1431 struct ionic_deferred_work *work; 1440 - unsigned int nfilters; 1441 - unsigned int rx_mode; 1442 1432 1443 - rx_mode = IONIC_RX_MODE_F_UNICAST; 1444 - rx_mode |= (netdev->flags & IFF_MULTICAST) ? IONIC_RX_MODE_F_MULTICAST : 0; 1445 - rx_mode |= (netdev->flags & IFF_BROADCAST) ? IONIC_RX_MODE_F_BROADCAST : 0; 1446 - rx_mode |= (netdev->flags & IFF_PROMISC) ? IONIC_RX_MODE_F_PROMISC : 0; 1447 - rx_mode |= (netdev->flags & IFF_ALLMULTI) ? IONIC_RX_MODE_F_ALLMULTI : 0; 1448 - 1449 - /* sync unicast addresses 1450 - * next check to see if we're in an overflow state 1451 - * if so, we track that we overflowed and enable NIC PROMISC 1452 - * else if the overflow is set and not needed 1453 - * we remove our overflow flag and check the netdev flags 1454 - * to see if we can disable NIC PROMISC 1455 - */ 1456 - if (can_sleep) 1457 - __dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del); 1458 - else 1459 - __dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del); 1460 - nfilters = le32_to_cpu(lif->identity->eth.max_ucast_filters); 1461 - if (netdev_uc_count(netdev) + 1 > nfilters) { 1462 - rx_mode |= IONIC_RX_MODE_F_PROMISC; 1463 - lif->uc_overflow = true; 1464 - } else if (lif->uc_overflow) { 1465 - lif->uc_overflow = false; 1466 - if (!(netdev->flags & IFF_PROMISC)) 1467 - rx_mode &= ~IONIC_RX_MODE_F_PROMISC; 1468 - } 1469 - 1470 - /* same for multicast */ 1471 - if (can_sleep) 1472 - __dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del); 1473 - else 1474 - __dev_mc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del); 1475 - nfilters = le32_to_cpu(lif->identity->eth.max_mcast_filters); 1476 - if (netdev_mc_count(netdev) > nfilters) { 1477 - rx_mode |= IONIC_RX_MODE_F_ALLMULTI; 1478 - lif->mc_overflow = true; 1479 - } else if (lif->mc_overflow) { 1480 - lif->mc_overflow = false; 1481 - if (!(netdev->flags & IFF_ALLMULTI)) 1482 - rx_mode &= ~IONIC_RX_MODE_F_ALLMULTI; 1483 - } 1484 - 1485 - if (lif->rx_mode != rx_mode) { 1486 - if (!can_sleep) { 1487 - work = kzalloc(sizeof(*work), GFP_ATOMIC); 1488 - if (!work) { 1489 - netdev_err(lif->netdev, "rxmode change dropped\n"); 1490 - return; 1491 - } 1492 - work->type = IONIC_DW_TYPE_RX_MODE; 1493 - work->rx_mode = rx_mode; 1494 - netdev_dbg(lif->netdev, "deferred: rx_mode\n"); 1495 - ionic_lif_deferred_enqueue(&lif->deferred, work); 1496 - } else { 1497 - ionic_lif_rx_mode(lif, rx_mode); 1433 + if (!can_sleep) { 1434 + work = kzalloc(sizeof(*work), GFP_ATOMIC); 1435 + if (!work) { 1436 + netdev_err(lif->netdev, "rxmode change dropped\n"); 1437 + return; 1498 1438 } 1439 + work->type = IONIC_DW_TYPE_RX_MODE; 1440 + netdev_dbg(lif->netdev, "deferred: rx_mode\n"); 1441 + ionic_lif_deferred_enqueue(&lif->deferred, work); 1442 + } else { 1443 + ionic_lif_rx_mode(lif); 1499 1444 } 1500 1445 } 1501 1446 ··· 3051 3058 ionic_lif_qcq_deinit(lif, lif->notifyqcq); 3052 3059 ionic_lif_qcq_deinit(lif, lif->adminqcq); 3053 3060 3061 + mutex_destroy(&lif->config_lock); 3054 3062 mutex_destroy(&lif->queue_lock); 3055 3063 ionic_lif_reset(lif); 3056 3064 } ··· 3179 3185 */ 3180 3186 if (!ether_addr_equal(ctx.comp.lif_getattr.mac, 3181 3187 netdev->dev_addr)) 3182 - ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR, CAN_SLEEP); 3188 + ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR); 3183 3189 } else { 3184 3190 /* Update the netdev mac with the device's mac */ 3185 3191 memcpy(addr.sa_data, ctx.comp.lif_getattr.mac, netdev->addr_len); ··· 3196 3202 3197 3203 netdev_dbg(lif->netdev, "adding station MAC addr %pM\n", 3198 3204 netdev->dev_addr); 3199 - ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR, CAN_SLEEP); 3205 + ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR); 3200 3206 3201 3207 return 0; 3202 3208 } ··· 3219 3225 3220 3226 lif->hw_index = le16_to_cpu(comp.hw_index); 3221 3227 mutex_init(&lif->queue_lock); 3228 + mutex_init(&lif->config_lock); 3222 3229 3223 3230 /* now that we have the hw_index we can figure out our doorbell page */ 3224 3231 lif->dbid_count = le32_to_cpu(lif->ionic->ident.dev.ndbpgs_per_lif);

+4 -7

drivers/net/ethernet/pensando/ionic/ionic_lif.h

··· 108 108 struct list_head list; 109 109 enum ionic_deferred_work_type type; 110 110 union { 111 - unsigned int rx_mode; 112 111 u8 addr[ETH_ALEN]; 113 112 u8 fw_status; 114 113 }; ··· 178 179 unsigned int index; 179 180 unsigned int hw_index; 180 181 struct mutex queue_lock; /* lock for queue structures */ 182 + struct mutex config_lock; /* lock for config actions */ 181 183 spinlock_t adminq_lock; /* lock for AdminQ operations */ 182 184 struct ionic_qcq *adminqcq; 183 185 struct ionic_qcq *notifyqcq; ··· 199 199 unsigned int nrxq_descs; 200 200 u32 rx_copybreak; 201 201 u64 rxq_features; 202 - unsigned int rx_mode; 202 + u16 rx_mode; 203 203 u64 hw_features; 204 204 bool registered; 205 205 bool mc_overflow; ··· 302 302 int ionic_lif_size(struct ionic *ionic); 303 303 304 304 #if IS_ENABLED(CONFIG_PTP_1588_CLOCK) 305 - int ionic_lif_hwstamp_replay(struct ionic_lif *lif); 305 + void ionic_lif_hwstamp_replay(struct ionic_lif *lif); 306 306 int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr); 307 307 int ionic_lif_hwstamp_get(struct ionic_lif *lif, struct ifreq *ifr); 308 308 ktime_t ionic_lif_phc_ktime(struct ionic_lif *lif, u64 counter); ··· 311 311 void ionic_lif_alloc_phc(struct ionic_lif *lif); 312 312 void ionic_lif_free_phc(struct ionic_lif *lif); 313 313 #else 314 - static inline int ionic_lif_hwstamp_replay(struct ionic_lif *lif) 315 - { 316 - return -EOPNOTSUPP; 317 - } 314 + static inline void ionic_lif_hwstamp_replay(struct ionic_lif *lif) {} 318 315 319 316 static inline int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr) 320 317 {

+7 -3

drivers/net/ethernet/pensando/ionic/ionic_phc.c

··· 188 188 struct hwtstamp_config config; 189 189 int err; 190 190 191 + if (!lif->phc || !lif->phc->ptp) 192 + return -EOPNOTSUPP; 193 + 191 194 if (copy_from_user(&config, ifr->ifr_data, sizeof(config))) 192 195 return -EFAULT; 193 196 ··· 206 203 return 0; 207 204 } 208 205 209 - int ionic_lif_hwstamp_replay(struct ionic_lif *lif) 206 + void ionic_lif_hwstamp_replay(struct ionic_lif *lif) 210 207 { 211 208 int err; 209 + 210 + if (!lif->phc || !lif->phc->ptp) 211 + return; 212 212 213 213 err = ionic_lif_hwstamp_set_ts_config(lif, NULL); 214 214 if (err) 215 215 netdev_info(lif->netdev, "hwstamp replay failed: %d\n", err); 216 - 217 - return err; 218 216 } 219 217 220 218 int ionic_lif_hwstamp_get(struct ionic_lif *lif, struct ifreq *ifr)

+25 -16

drivers/net/ethernet/pensando/ionic/ionic_txrx.c

··· 274 274 } 275 275 } 276 276 277 - if (likely(netdev->features & NETIF_F_RXCSUM)) { 278 - if (comp->csum_flags & IONIC_RXQ_COMP_CSUM_F_CALC) { 279 - skb->ip_summed = CHECKSUM_COMPLETE; 280 - skb->csum = (__force __wsum)le16_to_cpu(comp->csum); 281 - stats->csum_complete++; 282 - } 277 + if (likely(netdev->features & NETIF_F_RXCSUM) && 278 + (comp->csum_flags & IONIC_RXQ_COMP_CSUM_F_CALC)) { 279 + skb->ip_summed = CHECKSUM_COMPLETE; 280 + skb->csum = (__force __wsum)le16_to_cpu(comp->csum); 281 + stats->csum_complete++; 283 282 } else { 284 283 stats->csum_none++; 285 284 } ··· 450 451 q->tail_idx = 0; 451 452 } 452 453 453 - static void ionic_dim_update(struct ionic_qcq *qcq) 454 + static void ionic_dim_update(struct ionic_qcq *qcq, int napi_mode) 454 455 { 455 456 struct dim_sample dim_sample; 456 457 struct ionic_lif *lif; 457 458 unsigned int qi; 459 + u64 pkts, bytes; 458 460 459 461 if (!qcq->intr.dim_coal_hw) 460 462 return; ··· 463 463 lif = qcq->q.lif; 464 464 qi = qcq->cq.bound_q->index; 465 465 466 - ionic_intr_coal_init(lif->ionic->idev.intr_ctrl, 467 - lif->rxqcqs[qi]->intr.index, 468 - qcq->intr.dim_coal_hw); 466 + switch (napi_mode) { 467 + case IONIC_LIF_F_TX_DIM_INTR: 468 + pkts = lif->txqstats[qi].pkts; 469 + bytes = lif->txqstats[qi].bytes; 470 + break; 471 + case IONIC_LIF_F_RX_DIM_INTR: 472 + pkts = lif->rxqstats[qi].pkts; 473 + bytes = lif->rxqstats[qi].bytes; 474 + break; 475 + default: 476 + pkts = lif->txqstats[qi].pkts + lif->rxqstats[qi].pkts; 477 + bytes = lif->txqstats[qi].bytes + lif->rxqstats[qi].bytes; 478 + break; 479 + } 469 480 470 481 dim_update_sample(qcq->cq.bound_intr->rearm_count, 471 - lif->txqstats[qi].pkts, 472 - lif->txqstats[qi].bytes, 473 - &dim_sample); 482 + pkts, bytes, &dim_sample); 474 483 475 484 net_dim(&qcq->dim, dim_sample); 476 485 } ··· 500 491 ionic_tx_service, NULL, NULL); 501 492 502 493 if (work_done < budget && napi_complete_done(napi, work_done)) { 503 - ionic_dim_update(qcq); 494 + ionic_dim_update(qcq, IONIC_LIF_F_TX_DIM_INTR); 504 495 flags |= IONIC_INTR_CRED_UNMASK; 505 496 cq->bound_intr->rearm_count++; 506 497 } ··· 539 530 ionic_rx_fill(cq->bound_q); 540 531 541 532 if (work_done < budget && napi_complete_done(napi, work_done)) { 542 - ionic_dim_update(qcq); 533 + ionic_dim_update(qcq, IONIC_LIF_F_RX_DIM_INTR); 543 534 flags |= IONIC_INTR_CRED_UNMASK; 544 535 cq->bound_intr->rearm_count++; 545 536 } ··· 585 576 ionic_rx_fill(rxcq->bound_q); 586 577 587 578 if (rx_work_done < budget && napi_complete_done(napi, rx_work_done)) { 588 - ionic_dim_update(qcq); 579 + ionic_dim_update(qcq, 0); 589 580 flags |= IONIC_INTR_CRED_UNMASK; 590 581 rxcq->bound_intr->rearm_count++; 591 582 }

+2 -2

drivers/net/ethernet/qlogic/qede/qede_filter.c

··· 831 831 int qede_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid) 832 832 { 833 833 struct qede_dev *edev = netdev_priv(dev); 834 - struct qede_vlan *vlan = NULL; 834 + struct qede_vlan *vlan; 835 835 int rc = 0; 836 836 837 837 DP_VERBOSE(edev, NETIF_MSG_IFDOWN, "Removing vlan 0x%04x\n", vid); ··· 842 842 if (vlan->vid == vid) 843 843 break; 844 844 845 - if (!vlan || (vlan->vid != vid)) { 845 + if (list_entry_is_head(vlan, &edev->vlan_list, list)) { 846 846 DP_VERBOSE(edev, (NETIF_MSG_IFUP | NETIF_MSG_IFDOWN), 847 847 "Vlan isn't configured\n"); 848 848 goto out;

+3 -3

drivers/net/ethernet/qlogic/qla3xxx.c

··· 154 154 "driver lock acquired\n"); 155 155 return 1; 156 156 } 157 - ssleep(1); 157 + mdelay(1000); 158 158 } while (++i < 10); 159 159 160 160 netdev_err(qdev->ndev, "Timed out waiting for driver lock...\n"); ··· 3274 3274 if ((value & ISP_CONTROL_SR) == 0) 3275 3275 break; 3276 3276 3277 - ssleep(1); 3277 + mdelay(1000); 3278 3278 } while ((--max_wait_time)); 3279 3279 3280 3280 /* ··· 3310 3310 ispControlStatus); 3311 3311 if ((value & ISP_CONTROL_FSR) == 0) 3312 3312 break; 3313 - ssleep(1); 3313 + mdelay(1000); 3314 3314 } while ((--max_wait_time)); 3315 3315 } 3316 3316 if (max_wait_time == 0)

+2 -5

drivers/net/ethernet/sis/sis900.c

··· 443 443 #endif 444 444 445 445 /* setup various bits in PCI command register */ 446 - ret = pci_enable_device(pci_dev); 446 + ret = pcim_enable_device(pci_dev); 447 447 if(ret) return ret; 448 448 449 449 i = dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(32)); ··· 469 469 ioaddr = pci_iomap(pci_dev, 0, 0); 470 470 if (!ioaddr) { 471 471 ret = -ENOMEM; 472 - goto err_out_cleardev; 472 + goto err_out; 473 473 } 474 474 475 475 sis_priv = netdev_priv(net_dev); ··· 581 581 sis_priv->tx_ring_dma); 582 582 err_out_unmap: 583 583 pci_iounmap(pci_dev, ioaddr); 584 - err_out_cleardev: 585 - pci_release_regions(pci_dev); 586 584 err_out: 587 585 free_netdev(net_dev); 588 586 return ret; ··· 2497 2499 sis_priv->tx_ring_dma); 2498 2500 pci_iounmap(pci_dev, sis_priv->ioaddr); 2499 2501 free_netdev(net_dev); 2500 - pci_release_regions(pci_dev); 2501 2502 } 2502 2503 2503 2504 static int __maybe_unused sis900_suspend(struct device *dev)

+2

drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c

··· 1249 1249 .config_l3_filter = dwmac4_config_l3_filter, 1250 1250 .config_l4_filter = dwmac4_config_l4_filter, 1251 1251 .est_configure = dwmac5_est_configure, 1252 + .est_irq_status = dwmac5_est_irq_status, 1252 1253 .fpe_configure = dwmac5_fpe_configure, 1253 1254 .fpe_send_mpacket = dwmac5_fpe_send_mpacket, 1254 1255 .fpe_irq_status = dwmac5_fpe_irq_status, ··· 1301 1300 .config_l3_filter = dwmac4_config_l3_filter, 1302 1301 .config_l4_filter = dwmac4_config_l4_filter, 1303 1302 .est_configure = dwmac5_est_configure, 1303 + .est_irq_status = dwmac5_est_irq_status, 1304 1304 .fpe_configure = dwmac5_fpe_configure, 1305 1305 .fpe_send_mpacket = dwmac5_fpe_send_mpacket, 1306 1306 .fpe_irq_status = dwmac5_fpe_irq_status,

+2 -1

drivers/net/ethernet/sun/niu.c

··· 8191 8191 err = niu_pci_vpd_scan_props(np, here, end); 8192 8192 if (err < 0) 8193 8193 return err; 8194 + /* ret == 1 is not an error */ 8194 8195 if (err == 1) 8195 - return -EINVAL; 8196 + return 0; 8196 8197 } 8197 8198 return 0; 8198 8199 }

+1 -1

drivers/net/phy/broadcom.c

··· 288 288 if (phydev->dev_flags & PHY_BRCM_DIS_TXCRXC_NOENRGY) { 289 289 if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E || 290 290 BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54810 || 291 - BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E) 291 + BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54811) 292 292 val |= BCM54XX_SHD_SCR3_RXCTXC_DIS; 293 293 else 294 294 val |= BCM54XX_SHD_SCR3_TRDDAPD;

+32 -20

drivers/net/wireless/virt_wifi.c

··· 136 136 /* Assigned at module init. Guaranteed locally-administered and unicast. */ 137 137 static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {}; 138 138 139 + static void virt_wifi_inform_bss(struct wiphy *wiphy) 140 + { 141 + u64 tsf = div_u64(ktime_get_boottime_ns(), 1000); 142 + struct cfg80211_bss *informed_bss; 143 + static const struct { 144 + u8 tag; 145 + u8 len; 146 + u8 ssid[8]; 147 + } __packed ssid = { 148 + .tag = WLAN_EID_SSID, 149 + .len = 8, 150 + .ssid = "VirtWifi", 151 + }; 152 + 153 + informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz, 154 + CFG80211_BSS_FTYPE_PRESP, 155 + fake_router_bssid, tsf, 156 + WLAN_CAPABILITY_ESS, 0, 157 + (void *)&ssid, sizeof(ssid), 158 + DBM_TO_MBM(-50), GFP_KERNEL); 159 + cfg80211_put_bss(wiphy, informed_bss); 160 + } 161 + 139 162 /* Called with the rtnl lock held. */ 140 163 static int virt_wifi_scan(struct wiphy *wiphy, 141 164 struct cfg80211_scan_request *request) ··· 179 156 /* Acquires and releases the rdev BSS lock. */ 180 157 static void virt_wifi_scan_result(struct work_struct *work) 181 158 { 182 - struct { 183 - u8 tag; 184 - u8 len; 185 - u8 ssid[8]; 186 - } __packed ssid = { 187 - .tag = WLAN_EID_SSID, .len = 8, .ssid = "VirtWifi", 188 - }; 189 - struct cfg80211_bss *informed_bss; 190 159 struct virt_wifi_wiphy_priv *priv = 191 160 container_of(work, struct virt_wifi_wiphy_priv, 192 161 scan_result.work); 193 162 struct wiphy *wiphy = priv_to_wiphy(priv); 194 163 struct cfg80211_scan_info scan_info = { .aborted = false }; 195 - u64 tsf = div_u64(ktime_get_boottime_ns(), 1000); 196 164 197 - informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz, 198 - CFG80211_BSS_FTYPE_PRESP, 199 - fake_router_bssid, tsf, 200 - WLAN_CAPABILITY_ESS, 0, 201 - (void *)&ssid, sizeof(ssid), 202 - DBM_TO_MBM(-50), GFP_KERNEL); 203 - cfg80211_put_bss(wiphy, informed_bss); 165 + virt_wifi_inform_bss(wiphy); 204 166 205 167 /* Schedules work which acquires and releases the rtnl lock. */ 206 168 cfg80211_scan_done(priv->scan_request, &scan_info); ··· 233 225 if (!could_schedule) 234 226 return -EBUSY; 235 227 236 - if (sme->bssid) 228 + if (sme->bssid) { 237 229 ether_addr_copy(priv->connect_requested_bss, sme->bssid); 238 - else 230 + } else { 231 + virt_wifi_inform_bss(wiphy); 239 232 eth_zero_addr(priv->connect_requested_bss); 233 + } 240 234 241 235 wiphy_debug(wiphy, "connect\n"); 242 236 ··· 251 241 struct virt_wifi_netdev_priv *priv = 252 242 container_of(work, struct virt_wifi_netdev_priv, connect.work); 253 243 u8 *requested_bss = priv->connect_requested_bss; 254 - bool has_addr = !is_zero_ether_addr(requested_bss); 255 244 bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid); 256 245 u16 status = WLAN_STATUS_SUCCESS; 257 246 258 - if (!priv->is_up || (has_addr && !right_addr)) 247 + if (is_zero_ether_addr(requested_bss)) 248 + requested_bss = NULL; 249 + 250 + if (!priv->is_up || (requested_bss && !right_addr)) 259 251 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 260 252 else 261 253 priv->is_connected = true;

+2

drivers/net/wwan/wwan_core.c

··· 984 984 goto unlock; 985 985 } 986 986 987 + rtnl_configure_link(dev, NULL); /* Link initialized, notify new link */ 988 + 987 989 unlock: 988 990 rtnl_unlock(); 989 991

+1 -2

drivers/nfc/nfcsim.c

··· 192 192 193 193 if (!IS_ERR(skb)) 194 194 dev_kfree_skb(skb); 195 - 196 - skb = ERR_PTR(-ENODEV); 195 + return; 197 196 } 198 197 199 198 dev->cb(dev->nfc_digital_dev, dev->arg, skb);

+1 -1

drivers/nfc/s3fwrn5/firmware.c

··· 423 423 if (IS_ERR(tfm)) { 424 424 ret = PTR_ERR(tfm); 425 425 dev_err(&fw_info->ndev->nfc_dev->dev, 426 - "Cannot allocate shash (code=%d)\n", ret); 426 + "Cannot allocate shash (code=%pe)\n", tfm); 427 427 goto out; 428 428 } 429 429

+1

include/linux/bpf_types.h

··· 134 134 BPF_LINK_TYPE(BPF_LINK_TYPE_ITER, iter) 135 135 #ifdef CONFIG_NET 136 136 BPF_LINK_TYPE(BPF_LINK_TYPE_NETNS, netns) 137 + BPF_LINK_TYPE(BPF_LINK_TYPE_XDP, xdp) 137 138 #endif

+2 -1

include/linux/bpf_verifier.h

··· 340 340 }; 341 341 u64 map_key_state; /* constant (32 bit) key tracking for maps */ 342 342 int ctx_field_size; /* the ctx field size for load insn, maybe 0 */ 343 - int sanitize_stack_off; /* stack slot to be cleared */ 344 343 u32 seen; /* this insn was processed by the verifier at env->pass_cnt */ 344 + bool sanitize_stack_spill; /* subject to Spectre v4 sanitation */ 345 345 bool zext_dst; /* this insn zero extends dst reg */ 346 346 u8 alu_state; /* used in combination with alu_limit */ 347 347 ··· 414 414 u32 used_map_cnt; /* number of used maps */ 415 415 u32 used_btf_cnt; /* number of used BTF objects */ 416 416 u32 id_gen; /* used to generate unique reg IDs */ 417 + bool explore_alu_limits; 417 418 bool allow_ptr_leaks; 418 419 bool allow_uninit_stack; 419 420 bool allow_ptr_to_map_access;

+15

include/linux/filter.h

··· 73 73 /* unused opcode to mark call to interpreter with arguments */ 74 74 #define BPF_CALL_ARGS 0xe0 75 75 76 + /* unused opcode to mark speculation barrier for mitigating 77 + * Speculative Store Bypass 78 + */ 79 + #define BPF_NOSPEC 0xc0 80 + 76 81 /* As per nm, we expose JITed images as text (code) section for 77 82 * kallsyms. That way, tools like perf can find it to match 78 83 * addresses. ··· 390 385 #define BPF_EXIT_INSN() \ 391 386 ((struct bpf_insn) { \ 392 387 .code = BPF_JMP | BPF_EXIT, \ 388 + .dst_reg = 0, \ 389 + .src_reg = 0, \ 390 + .off = 0, \ 391 + .imm = 0 }) 392 + 393 + /* Speculation barrier */ 394 + 395 + #define BPF_ST_NOSPEC() \ 396 + ((struct bpf_insn) { \ 397 + .code = BPF_ST | BPF_NOSPEC, \ 393 398 .dst_reg = 0, \ 394 399 .src_reg = 0, \ 395 400 .off = 0, \

+35 -19

include/linux/skmsg.h

··· 285 285 return rcu_dereference_sk_user_data(sk); 286 286 } 287 287 288 + static inline void sk_psock_set_state(struct sk_psock *psock, 289 + enum sk_psock_state_bits bit) 290 + { 291 + set_bit(bit, &psock->state); 292 + } 293 + 294 + static inline void sk_psock_clear_state(struct sk_psock *psock, 295 + enum sk_psock_state_bits bit) 296 + { 297 + clear_bit(bit, &psock->state); 298 + } 299 + 300 + static inline bool sk_psock_test_state(const struct sk_psock *psock, 301 + enum sk_psock_state_bits bit) 302 + { 303 + return test_bit(bit, &psock->state); 304 + } 305 + 306 + static inline void sock_drop(struct sock *sk, struct sk_buff *skb) 307 + { 308 + sk_drops_add(sk, skb); 309 + kfree_skb(skb); 310 + } 311 + 312 + static inline void drop_sk_msg(struct sk_psock *psock, struct sk_msg *msg) 313 + { 314 + if (msg->skb) 315 + sock_drop(psock->sk, msg->skb); 316 + kfree(msg); 317 + } 318 + 288 319 static inline void sk_psock_queue_msg(struct sk_psock *psock, 289 320 struct sk_msg *msg) 290 321 { 291 322 spin_lock_bh(&psock->ingress_lock); 292 - list_add_tail(&msg->list, &psock->ingress_msg); 323 + if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) 324 + list_add_tail(&msg->list, &psock->ingress_msg); 325 + else 326 + drop_sk_msg(psock, msg); 293 327 spin_unlock_bh(&psock->ingress_lock); 294 328 } 295 329 ··· 438 404 { 439 405 if (psock->psock_update_sk_prot) 440 406 psock->psock_update_sk_prot(sk, psock, true); 441 - } 442 - 443 - static inline void sk_psock_set_state(struct sk_psock *psock, 444 - enum sk_psock_state_bits bit) 445 - { 446 - set_bit(bit, &psock->state); 447 - } 448 - 449 - static inline void sk_psock_clear_state(struct sk_psock *psock, 450 - enum sk_psock_state_bits bit) 451 - { 452 - clear_bit(bit, &psock->state); 453 - } 454 - 455 - static inline bool sk_psock_test_state(const struct sk_psock *psock, 456 - enum sk_psock_state_bits bit) 457 - { 458 - return test_bit(bit, &psock->state); 459 407 } 460 408 461 409 static inline struct sk_psock *sk_psock_get(struct sock *sk)

+23 -8

include/net/llc_pdu.h

··· 15 15 #include <linux/if_ether.h> 16 16 17 17 /* Lengths of frame formats */ 18 - #define LLC_PDU_LEN_I 4 /* header and 2 control bytes */ 19 - #define LLC_PDU_LEN_S 4 20 - #define LLC_PDU_LEN_U 3 /* header and 1 control byte */ 18 + #define LLC_PDU_LEN_I 4 /* header and 2 control bytes */ 19 + #define LLC_PDU_LEN_S 4 20 + #define LLC_PDU_LEN_U 3 /* header and 1 control byte */ 21 + /* header and 1 control byte and XID info */ 22 + #define LLC_PDU_LEN_U_XID (LLC_PDU_LEN_U + sizeof(struct llc_xid_info)) 21 23 /* Known SAP addresses */ 22 24 #define LLC_GLOBAL_SAP 0xFF 23 25 #define LLC_NULL_SAP 0x00 /* not network-layer visible */ ··· 52 50 #define LLC_PDU_TYPE_U_MASK 0x03 /* 8-bit control field */ 53 51 #define LLC_PDU_TYPE_MASK 0x03 54 52 55 - #define LLC_PDU_TYPE_I 0 /* first bit */ 56 - #define LLC_PDU_TYPE_S 1 /* first two bits */ 57 - #define LLC_PDU_TYPE_U 3 /* first two bits */ 53 + #define LLC_PDU_TYPE_I 0 /* first bit */ 54 + #define LLC_PDU_TYPE_S 1 /* first two bits */ 55 + #define LLC_PDU_TYPE_U 3 /* first two bits */ 56 + #define LLC_PDU_TYPE_U_XID 4 /* private type for detecting XID commands */ 58 57 59 58 #define LLC_PDU_TYPE_IS_I(pdu) \ 60 59 ((!(pdu->ctrl_1 & LLC_PDU_TYPE_I_MASK)) ? 1 : 0) ··· 233 230 static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, 234 231 u8 ssap, u8 dsap, u8 cr) 235 232 { 236 - const int hlen = type == LLC_PDU_TYPE_U ? 3 : 4; 233 + int hlen = 4; /* default value for I and S types */ 237 234 struct llc_pdu_un *pdu; 235 + 236 + switch (type) { 237 + case LLC_PDU_TYPE_U: 238 + hlen = 3; 239 + break; 240 + case LLC_PDU_TYPE_U_XID: 241 + hlen = 6; 242 + break; 243 + } 238 244 239 245 skb_push(skb, hlen); 240 246 skb_reset_network_header(skb); ··· 386 374 xid_info->fmt_id = LLC_XID_FMT_ID; /* 0x81 */ 387 375 xid_info->type = svcs_supported; 388 376 xid_info->rw = rx_window << 1; /* size of receive window */ 389 - skb_put(skb, sizeof(struct llc_xid_info)); 377 + 378 + /* no need to push/put since llc_pdu_header_init() has already 379 + * pushed 3 + 3 bytes 380 + */ 390 381 } 391 382 392 383 /**

+3 -2

include/net/sctp/structs.h

··· 984 984 } cacc; 985 985 986 986 struct { 987 + __u32 last_rtx_chunks; 987 988 __u16 pmtu; 988 989 __u16 probe_size; 989 990 __u16 probe_high; ··· 1025 1024 void sctp_transport_immediate_rtx(struct sctp_transport *); 1026 1025 void sctp_transport_dst_release(struct sctp_transport *t); 1027 1026 void sctp_transport_dst_confirm(struct sctp_transport *t); 1028 - void sctp_transport_pl_send(struct sctp_transport *t); 1029 - void sctp_transport_pl_recv(struct sctp_transport *t); 1027 + bool sctp_transport_pl_send(struct sctp_transport *t); 1028 + bool sctp_transport_pl_recv(struct sctp_transport *t); 1030 1029 1031 1030 1032 1031 /* This is the structure we use to queue packets as they come into

+18 -1

kernel/bpf/core.c

··· 32 32 #include <linux/perf_event.h> 33 33 #include <linux/extable.h> 34 34 #include <linux/log2.h> 35 + 36 + #include <asm/barrier.h> 35 37 #include <asm/unaligned.h> 36 38 37 39 /* Registers */ ··· 1379 1377 /* Non-UAPI available opcodes. */ 1380 1378 [BPF_JMP | BPF_CALL_ARGS] = &&JMP_CALL_ARGS, 1381 1379 [BPF_JMP | BPF_TAIL_CALL] = &&JMP_TAIL_CALL, 1380 + [BPF_ST | BPF_NOSPEC] = &&ST_NOSPEC, 1382 1381 [BPF_LDX | BPF_PROBE_MEM | BPF_B] = &&LDX_PROBE_MEM_B, 1383 1382 [BPF_LDX | BPF_PROBE_MEM | BPF_H] = &&LDX_PROBE_MEM_H, 1384 1383 [BPF_LDX | BPF_PROBE_MEM | BPF_W] = &&LDX_PROBE_MEM_W, ··· 1624 1621 COND_JMP(s, JSGE, >=) 1625 1622 COND_JMP(s, JSLE, <=) 1626 1623 #undef COND_JMP 1627 - /* STX and ST and LDX*/ 1624 + /* ST, STX and LDX*/ 1625 + ST_NOSPEC: 1626 + /* Speculation barrier for mitigating Speculative Store Bypass. 1627 + * In case of arm64, we rely on the firmware mitigation as 1628 + * controlled via the ssbd kernel parameter. Whenever the 1629 + * mitigation is enabled, it works for all of the kernel code 1630 + * with no need to provide any additional instructions here. 1631 + * In case of x86, we use 'lfence' insn for mitigation. We 1632 + * reuse preexisting logic from Spectre v1 mitigation that 1633 + * happens to produce the required code on x86 for v4 as well. 1634 + */ 1635 + #ifdef CONFIG_X86 1636 + barrier_nospec(); 1637 + #endif 1638 + CONT; 1628 1639 #define LDST(SIZEOP, SIZE) \ 1629 1640 STX_MEM_##SIZEOP: \ 1630 1641 *(SIZE *)(unsigned long) (DST + insn->off) = SRC; \

+9 -7

kernel/bpf/disasm.c

··· 206 206 verbose(cbs->private_data, "BUG_%02x\n", insn->code); 207 207 } 208 208 } else if (class == BPF_ST) { 209 - if (BPF_MODE(insn->code) != BPF_MEM) { 209 + if (BPF_MODE(insn->code) == BPF_MEM) { 210 + verbose(cbs->private_data, "(%02x) *(%s *)(r%d %+d) = %d\n", 211 + insn->code, 212 + bpf_ldst_string[BPF_SIZE(insn->code) >> 3], 213 + insn->dst_reg, 214 + insn->off, insn->imm); 215 + } else if (BPF_MODE(insn->code) == 0xc0 /* BPF_NOSPEC, no UAPI */) { 216 + verbose(cbs->private_data, "(%02x) nospec\n", insn->code); 217 + } else { 210 218 verbose(cbs->private_data, "BUG_st_%02x\n", insn->code); 211 - return; 212 219 } 213 - verbose(cbs->private_data, "(%02x) *(%s *)(r%d %+d) = %d\n", 214 - insn->code, 215 - bpf_ldst_string[BPF_SIZE(insn->code) >> 3], 216 - insn->dst_reg, 217 - insn->off, insn->imm); 218 220 } else if (class == BPF_LDX) { 219 221 if (BPF_MODE(insn->code) != BPF_MEM) { 220 222 verbose(cbs->private_data, "BUG_ldx_%02x\n", insn->code);

+49 -99

kernel/bpf/verifier.c

··· 2610 2610 cur = env->cur_state->frame[env->cur_state->curframe]; 2611 2611 if (value_regno >= 0) 2612 2612 reg = &cur->regs[value_regno]; 2613 + if (!env->bypass_spec_v4) { 2614 + bool sanitize = reg && is_spillable_regtype(reg->type); 2615 + 2616 + for (i = 0; i < size; i++) { 2617 + if (state->stack[spi].slot_type[i] == STACK_INVALID) { 2618 + sanitize = true; 2619 + break; 2620 + } 2621 + } 2622 + 2623 + if (sanitize) 2624 + env->insn_aux_data[insn_idx].sanitize_stack_spill = true; 2625 + } 2613 2626 2614 2627 if (reg && size == BPF_REG_SIZE && register_is_bounded(reg) && 2615 2628 !register_is_null(reg) && env->bpf_capable) { ··· 2645 2632 verbose(env, "invalid size of register spill\n"); 2646 2633 return -EACCES; 2647 2634 } 2648 - 2649 2635 if (state != cur && reg->type == PTR_TO_STACK) { 2650 2636 verbose(env, "cannot spill pointers to stack into stack frame of the caller\n"); 2651 2637 return -EINVAL; 2652 - } 2653 - 2654 - if (!env->bypass_spec_v4) { 2655 - bool sanitize = false; 2656 - 2657 - if (state->stack[spi].slot_type[0] == STACK_SPILL && 2658 - register_is_const(&state->stack[spi].spilled_ptr)) 2659 - sanitize = true; 2660 - for (i = 0; i < BPF_REG_SIZE; i++) 2661 - if (state->stack[spi].slot_type[i] == STACK_MISC) { 2662 - sanitize = true; 2663 - break; 2664 - } 2665 - if (sanitize) { 2666 - int *poff = &env->insn_aux_data[insn_idx].sanitize_stack_off; 2667 - int soff = (-spi - 1) * BPF_REG_SIZE; 2668 - 2669 - /* detected reuse of integer stack slot with a pointer 2670 - * which means either llvm is reusing stack slot or 2671 - * an attacker is trying to exploit CVE-2018-3639 2672 - * (speculative store bypass) 2673 - * Have to sanitize that slot with preemptive 2674 - * store of zero. 2675 - */ 2676 - if (*poff && *poff != soff) { 2677 - /* disallow programs where single insn stores 2678 - * into two different stack slots, since verifier 2679 - * cannot sanitize them 2680 - */ 2681 - verbose(env, 2682 - "insn %d cannot access two stack slots fp%d and fp%d", 2683 - insn_idx, *poff, soff); 2684 - return -EINVAL; 2685 - } 2686 - *poff = soff; 2687 - } 2688 2638 } 2689 2639 save_register_state(state, spi, reg); 2690 2640 } else { ··· 6537 6561 alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0; 6538 6562 alu_state |= ptr_is_dst_reg ? 6539 6563 BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST; 6564 + 6565 + /* Limit pruning on unknown scalars to enable deep search for 6566 + * potential masking differences from other program paths. 6567 + */ 6568 + if (!off_is_imm) 6569 + env->explore_alu_limits = true; 6540 6570 } 6541 6571 6542 6572 err = update_alu_sanitation_state(aux, alu_state, alu_limit); ··· 9918 9936 } 9919 9937 9920 9938 /* Returns true if (rold safe implies rcur safe) */ 9921 - static bool regsafe(struct bpf_reg_state *rold, struct bpf_reg_state *rcur, 9922 - struct bpf_id_pair *idmap) 9939 + static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold, 9940 + struct bpf_reg_state *rcur, struct bpf_id_pair *idmap) 9923 9941 { 9924 9942 bool equal; 9925 9943 ··· 9945 9963 return false; 9946 9964 switch (rold->type) { 9947 9965 case SCALAR_VALUE: 9966 + if (env->explore_alu_limits) 9967 + return false; 9948 9968 if (rcur->type == SCALAR_VALUE) { 9949 9969 if (!rold->precise && !rcur->precise) 9950 9970 return true; ··· 10037 10053 return false; 10038 10054 } 10039 10055 10040 - static bool stacksafe(struct bpf_func_state *old, 10041 - struct bpf_func_state *cur, 10042 - struct bpf_id_pair *idmap) 10056 + static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old, 10057 + struct bpf_func_state *cur, struct bpf_id_pair *idmap) 10043 10058 { 10044 10059 int i, spi; 10045 10060 ··· 10083 10100 continue; 10084 10101 if (old->stack[spi].slot_type[0] != STACK_SPILL) 10085 10102 continue; 10086 - if (!regsafe(&old->stack[spi].spilled_ptr, 10087 - &cur->stack[spi].spilled_ptr, 10088 - idmap)) 10103 + if (!regsafe(env, &old->stack[spi].spilled_ptr, 10104 + &cur->stack[spi].spilled_ptr, idmap)) 10089 10105 /* when explored and current stack slot are both storing 10090 10106 * spilled registers, check that stored pointers types 10091 10107 * are the same as well. ··· 10141 10159 10142 10160 memset(env->idmap_scratch, 0, sizeof(env->idmap_scratch)); 10143 10161 for (i = 0; i < MAX_BPF_REG; i++) 10144 - if (!regsafe(&old->regs[i], &cur->regs[i], env->idmap_scratch)) 10162 + if (!regsafe(env, &old->regs[i], &cur->regs[i], 10163 + env->idmap_scratch)) 10145 10164 return false; 10146 10165 10147 - if (!stacksafe(old, cur, env->idmap_scratch)) 10166 + if (!stacksafe(env, old, cur, env->idmap_scratch)) 10148 10167 return false; 10149 10168 10150 10169 if (!refsafe(old, cur)) ··· 11889 11906 11890 11907 for (i = 0; i < insn_cnt; i++, insn++) { 11891 11908 bpf_convert_ctx_access_t convert_ctx_access; 11909 + bool ctx_access; 11892 11910 11893 11911 if (insn->code == (BPF_LDX | BPF_MEM | BPF_B) || 11894 11912 insn->code == (BPF_LDX | BPF_MEM | BPF_H) || 11895 11913 insn->code == (BPF_LDX | BPF_MEM | BPF_W) || 11896 - insn->code == (BPF_LDX | BPF_MEM | BPF_DW)) 11914 + insn->code == (BPF_LDX | BPF_MEM | BPF_DW)) { 11897 11915 type = BPF_READ; 11898 - else if (insn->code == (BPF_STX | BPF_MEM | BPF_B) || 11899 - insn->code == (BPF_STX | BPF_MEM | BPF_H) || 11900 - insn->code == (BPF_STX | BPF_MEM | BPF_W) || 11901 - insn->code == (BPF_STX | BPF_MEM | BPF_DW)) 11916 + ctx_access = true; 11917 + } else if (insn->code == (BPF_STX | BPF_MEM | BPF_B) || 11918 + insn->code == (BPF_STX | BPF_MEM | BPF_H) || 11919 + insn->code == (BPF_STX | BPF_MEM | BPF_W) || 11920 + insn->code == (BPF_STX | BPF_MEM | BPF_DW) || 11921 + insn->code == (BPF_ST | BPF_MEM | BPF_B) || 11922 + insn->code == (BPF_ST | BPF_MEM | BPF_H) || 11923 + insn->code == (BPF_ST | BPF_MEM | BPF_W) || 11924 + insn->code == (BPF_ST | BPF_MEM | BPF_DW)) { 11902 11925 type = BPF_WRITE; 11903 - else 11926 + ctx_access = BPF_CLASS(insn->code) == BPF_STX; 11927 + } else { 11904 11928 continue; 11929 + } 11905 11930 11906 11931 if (type == BPF_WRITE && 11907 - env->insn_aux_data[i + delta].sanitize_stack_off) { 11932 + env->insn_aux_data[i + delta].sanitize_stack_spill) { 11908 11933 struct bpf_insn patch[] = { 11909 - /* Sanitize suspicious stack slot with zero. 11910 - * There are no memory dependencies for this store, 11911 - * since it's only using frame pointer and immediate 11912 - * constant of zero 11913 - */ 11914 - BPF_ST_MEM(BPF_DW, BPF_REG_FP, 11915 - env->insn_aux_data[i + delta].sanitize_stack_off, 11916 - 0), 11917 - /* the original STX instruction will immediately 11918 - * overwrite the same stack slot with appropriate value 11919 - */ 11920 11934 *insn, 11935 + BPF_ST_NOSPEC(), 11921 11936 }; 11922 11937 11923 11938 cnt = ARRAY_SIZE(patch); ··· 11928 11947 insn = new_prog->insnsi + i + delta; 11929 11948 continue; 11930 11949 } 11950 + 11951 + if (!ctx_access) 11952 + continue; 11931 11953 11932 11954 switch (env->insn_aux_data[i + delta].ptr_type) { 11933 11955 case PTR_TO_CTX: ··· 12736 12752 } 12737 12753 } 12738 12754 12739 - /* The verifier is using insn_aux_data[] to store temporary data during 12740 - * verification and to store information for passes that run after the 12741 - * verification like dead code sanitization. do_check_common() for subprogram N 12742 - * may analyze many other subprograms. sanitize_insn_aux_data() clears all 12743 - * temporary data after do_check_common() finds that subprogram N cannot be 12744 - * verified independently. pass_cnt counts the number of times 12745 - * do_check_common() was run and insn->aux->seen tells the pass number 12746 - * insn_aux_data was touched. These variables are compared to clear temporary 12747 - * data from failed pass. For testing and experiments do_check_common() can be 12748 - * run multiple times even when prior attempt to verify is unsuccessful. 12749 - * 12750 - * Note that special handling is needed on !env->bypass_spec_v1 if this is 12751 - * ever called outside of error path with subsequent program rejection. 12752 - */ 12753 - static void sanitize_insn_aux_data(struct bpf_verifier_env *env) 12754 - { 12755 - struct bpf_insn *insn = env->prog->insnsi; 12756 - struct bpf_insn_aux_data *aux; 12757 - int i, class; 12758 - 12759 - for (i = 0; i < env->prog->len; i++) { 12760 - class = BPF_CLASS(insn[i].code); 12761 - if (class != BPF_LDX && class != BPF_STX) 12762 - continue; 12763 - aux = &env->insn_aux_data[i]; 12764 - if (aux->seen != env->pass_cnt) 12765 - continue; 12766 - memset(aux, 0, offsetof(typeof(*aux), orig_idx)); 12767 - } 12768 - } 12769 - 12770 12755 static int do_check_common(struct bpf_verifier_env *env, int subprog) 12771 12756 { 12772 12757 bool pop_log = !(env->log.level & BPF_LOG_LEVEL2); ··· 12812 12859 if (!ret && pop_log) 12813 12860 bpf_vlog_reset(&env->log, 0); 12814 12861 free_states(env); 12815 - if (ret) 12816 - /* clean aux data in case subprog was rejected */ 12817 - sanitize_insn_aux_data(env); 12818 12862 return ret; 12819 12863 } 12820 12864

+8 -3

net/can/j1939/transport.c

··· 1075 1075 1076 1076 static bool j1939_session_deactivate(struct j1939_session *session) 1077 1077 { 1078 + struct j1939_priv *priv = session->priv; 1078 1079 bool active; 1079 1080 1080 - j1939_session_list_lock(session->priv); 1081 + j1939_session_list_lock(priv); 1082 + /* This function should be called with a session ref-count of at 1083 + * least 2. 1084 + */ 1085 + WARN_ON_ONCE(kref_read(&session->kref) < 2); 1081 1086 active = j1939_session_deactivate_locked(session); 1082 - j1939_session_list_unlock(session->priv); 1087 + j1939_session_list_unlock(priv); 1083 1088 1084 1089 return active; 1085 1090 } ··· 1874 1869 if (!session->transmission) 1875 1870 j1939_tp_schedule_txtimer(session, 0); 1876 1871 } else { 1877 - j1939_tp_set_rxtimeout(session, 250); 1872 + j1939_tp_set_rxtimeout(session, 750); 1878 1873 } 1879 1874 session->last_cmd = 0xff; 1880 1875 consume_skb(se_skb);

+18 -2

net/can/raw.c

··· 546 546 return -EFAULT; 547 547 } 548 548 549 + rtnl_lock(); 549 550 lock_sock(sk); 550 551 551 - if (ro->bound && ro->ifindex) 552 + if (ro->bound && ro->ifindex) { 552 553 dev = dev_get_by_index(sock_net(sk), ro->ifindex); 554 + if (!dev) { 555 + if (count > 1) 556 + kfree(filter); 557 + err = -ENODEV; 558 + goto out_fil; 559 + } 560 + } 553 561 554 562 if (ro->bound) { 555 563 /* (try to) register the new filters */ ··· 596 588 dev_put(dev); 597 589 598 590 release_sock(sk); 591 + rtnl_unlock(); 599 592 600 593 break; 601 594 ··· 609 600 610 601 err_mask &= CAN_ERR_MASK; 611 602 603 + rtnl_lock(); 612 604 lock_sock(sk); 613 605 614 - if (ro->bound && ro->ifindex) 606 + if (ro->bound && ro->ifindex) { 615 607 dev = dev_get_by_index(sock_net(sk), ro->ifindex); 608 + if (!dev) { 609 + err = -ENODEV; 610 + goto out_err; 611 + } 612 + } 616 613 617 614 /* remove current error mask */ 618 615 if (ro->bound) { ··· 642 627 dev_put(dev); 643 628 644 629 release_sock(sk); 630 + rtnl_unlock(); 645 631 646 632 break; 647 633

+2 -8

net/core/devlink.c

··· 9328 9328 9329 9329 switch (attrs->flavour) { 9330 9330 case DEVLINK_PORT_FLAVOUR_PHYSICAL: 9331 - case DEVLINK_PORT_FLAVOUR_VIRTUAL: 9332 9331 n = snprintf(name, len, "p%u", attrs->phys.port_number); 9333 9332 if (n < len && attrs->split) 9334 9333 n += snprintf(name + n, len - n, "s%u", 9335 9334 attrs->phys.split_subport_number); 9336 - if (!attrs->split) 9337 - n = snprintf(name, len, "p%u", attrs->phys.port_number); 9338 - else 9339 - n = snprintf(name, len, "p%us%u", 9340 - attrs->phys.port_number, 9341 - attrs->phys.split_subport_number); 9342 - 9343 9335 break; 9344 9336 case DEVLINK_PORT_FLAVOUR_CPU: 9345 9337 case DEVLINK_PORT_FLAVOUR_DSA: ··· 9373 9381 n = snprintf(name, len, "pf%usf%u", attrs->pci_sf.pf, 9374 9382 attrs->pci_sf.sf); 9375 9383 break; 9384 + case DEVLINK_PORT_FLAVOUR_VIRTUAL: 9385 + return -EOPNOTSUPP; 9376 9386 } 9377 9387 9378 9388 if (n >= len)

+9 -9

net/core/flow_dissector.c

··· 1504 1504 } 1505 1505 EXPORT_SYMBOL(flow_get_u32_dst); 1506 1506 1507 - /* Sort the source and destination IP (and the ports if the IP are the same), 1507 + /* Sort the source and destination IP and the ports, 1508 1508 * to have consistent hash within the two directions 1509 1509 */ 1510 1510 static inline void __flow_hash_consistentify(struct flow_keys *keys) ··· 1515 1515 case FLOW_DISSECTOR_KEY_IPV4_ADDRS: 1516 1516 addr_diff = (__force u32)keys->addrs.v4addrs.dst - 1517 1517 (__force u32)keys->addrs.v4addrs.src; 1518 - if ((addr_diff < 0) || 1519 - (addr_diff == 0 && 1520 - ((__force u16)keys->ports.dst < 1521 - (__force u16)keys->ports.src))) { 1518 + if (addr_diff < 0) 1522 1519 swap(keys->addrs.v4addrs.src, keys->addrs.v4addrs.dst); 1520 + 1521 + if ((__force u16)keys->ports.dst < 1522 + (__force u16)keys->ports.src) { 1523 1523 swap(keys->ports.src, keys->ports.dst); 1524 1524 } 1525 1525 break; ··· 1527 1527 addr_diff = memcmp(&keys->addrs.v6addrs.dst, 1528 1528 &keys->addrs.v6addrs.src, 1529 1529 sizeof(keys->addrs.v6addrs.dst)); 1530 - if ((addr_diff < 0) || 1531 - (addr_diff == 0 && 1532 - ((__force u16)keys->ports.dst < 1533 - (__force u16)keys->ports.src))) { 1530 + if (addr_diff < 0) { 1534 1531 for (i = 0; i < 4; i++) 1535 1532 swap(keys->addrs.v6addrs.src.s6_addr32[i], 1536 1533 keys->addrs.v6addrs.dst.s6_addr32[i]); 1534 + } 1535 + if ((__force u16)keys->ports.dst < 1536 + (__force u16)keys->ports.src) { 1537 1537 swap(keys->ports.src, keys->ports.dst); 1538 1538 } 1539 1539 break;

+28 -11

net/core/skmsg.c

··· 584 584 return sk_psock_skb_ingress(psock, skb); 585 585 } 586 586 587 - static void sock_drop(struct sock *sk, struct sk_buff *skb) 587 + static void sk_psock_skb_state(struct sk_psock *psock, 588 + struct sk_psock_work_state *state, 589 + struct sk_buff *skb, 590 + int len, int off) 588 591 { 589 - sk_drops_add(sk, skb); 590 - kfree_skb(skb); 592 + spin_lock_bh(&psock->ingress_lock); 593 + if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { 594 + state->skb = skb; 595 + state->len = len; 596 + state->off = off; 597 + } else { 598 + sock_drop(psock->sk, skb); 599 + } 600 + spin_unlock_bh(&psock->ingress_lock); 591 601 } 592 602 593 603 static void sk_psock_backlog(struct work_struct *work) 594 604 { 595 605 struct sk_psock *psock = container_of(work, struct sk_psock, work); 596 606 struct sk_psock_work_state *state = &psock->work_state; 597 - struct sk_buff *skb; 607 + struct sk_buff *skb = NULL; 598 608 bool ingress; 599 609 u32 len, off; 600 610 int ret; 601 611 602 612 mutex_lock(&psock->work_mutex); 603 - if (state->skb) { 613 + if (unlikely(state->skb)) { 614 + spin_lock_bh(&psock->ingress_lock); 604 615 skb = state->skb; 605 616 len = state->len; 606 617 off = state->off; 607 618 state->skb = NULL; 608 - goto start; 619 + spin_unlock_bh(&psock->ingress_lock); 609 620 } 621 + if (skb) 622 + goto start; 610 623 611 624 while ((skb = skb_dequeue(&psock->ingress_skb))) { 612 625 len = skb->len; ··· 634 621 len, ingress); 635 622 if (ret <= 0) { 636 623 if (ret == -EAGAIN) { 637 - state->skb = skb; 638 - state->len = len; 639 - state->off = off; 624 + sk_psock_skb_state(psock, state, skb, 625 + len, off); 640 626 goto end; 641 627 } 642 628 /* Hard errors break pipe and stop xmit. */ ··· 734 722 skb_bpf_redirect_clear(skb); 735 723 sock_drop(psock->sk, skb); 736 724 } 725 + kfree_skb(psock->work_state.skb); 726 + /* We null the skb here to ensure that calls to sk_psock_backlog 727 + * do not pick up the free'd skb. 728 + */ 729 + psock->work_state.skb = NULL; 737 730 __sk_psock_purge_ingress_msg(psock); 738 731 } 739 732 ··· 790 773 791 774 void sk_psock_drop(struct sock *sk, struct sk_psock *psock) 792 775 { 793 - sk_psock_stop(psock, false); 794 - 795 776 write_lock_bh(&sk->sk_callback_lock); 796 777 sk_psock_restore_proto(sk, psock); 797 778 rcu_assign_sk_user_data(sk, NULL); ··· 798 783 else if (psock->progs.stream_verdict || psock->progs.skb_verdict) 799 784 sk_psock_stop_verdict(sk, psock); 800 785 write_unlock_bh(&sk->sk_callback_lock); 786 + 787 + sk_psock_stop(psock, false); 801 788 802 789 INIT_RCU_WORK(&psock->rwork, sk_psock_destroy); 803 790 queue_rcu_work(system_wq, &psock->rwork);

+1 -1

net/ipv4/ip_tunnel.c

··· 390 390 tunnel->i_seqno = ntohl(tpi->seq) + 1; 391 391 } 392 392 393 - skb_reset_network_header(skb); 393 + skb_set_network_header(skb, (tunnel->dev->type == ARPHRD_ETHER) ? ETH_HLEN : 0); 394 394 395 395 err = IP_ECN_decapsulate(iph, skb); 396 396 if (unlikely(err)) {

+3 -2

net/ipv6/ip6_output.c

··· 549 549 if (net->ipv6.devconf_all->proxy_ndp && 550 550 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) { 551 551 int proxied = ip6_forward_proxy_check(skb); 552 - if (proxied > 0) 552 + if (proxied > 0) { 553 + hdr->hop_limit--; 553 554 return ip6_input(skb); 554 - else if (proxied < 0) { 555 + } else if (proxied < 0) { 555 556 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS); 556 557 goto drop; 557 558 }

+9 -1

net/llc/af_llc.c

··· 98 98 { 99 99 u8 rc = LLC_PDU_LEN_U; 100 100 101 - if (addr->sllc_test || addr->sllc_xid) 101 + if (addr->sllc_test) 102 102 rc = LLC_PDU_LEN_U; 103 + else if (addr->sllc_xid) 104 + /* We need to expand header to sizeof(struct llc_xid_info) 105 + * since llc_pdu_init_as_xid_cmd() sets 4,5,6 bytes of LLC header 106 + * as XID PDU. In llc_ui_sendmsg() we reserved header size and then 107 + * filled all other space with user data. If we won't reserve this 108 + * bytes, llc_pdu_init_as_xid_cmd() will overwrite user data 109 + */ 110 + rc = LLC_PDU_LEN_U_XID; 103 111 else if (sk->sk_type == SOCK_STREAM) 104 112 rc = LLC_PDU_LEN_I; 105 113 return rc;

+1 -1

net/llc/llc_s_ac.c

··· 79 79 struct llc_sap_state_ev *ev = llc_sap_ev(skb); 80 80 int rc; 81 81 82 - llc_pdu_header_init(skb, LLC_PDU_TYPE_U, ev->saddr.lsap, 82 + llc_pdu_header_init(skb, LLC_PDU_TYPE_U_XID, ev->saddr.lsap, 83 83 ev->daddr.lsap, LLC_PDU_CMD); 84 84 llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0); 85 85 rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);

+19

net/mac80211/cfg.c

··· 152 152 struct vif_params *params) 153 153 { 154 154 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); 155 + struct ieee80211_local *local = sdata->local; 156 + struct sta_info *sta; 155 157 int ret; 156 158 157 159 ret = ieee80211_if_change_type(sdata, type); ··· 164 162 RCU_INIT_POINTER(sdata->u.vlan.sta, NULL); 165 163 ieee80211_check_fast_rx_iface(sdata); 166 164 } else if (type == NL80211_IFTYPE_STATION && params->use_4addr >= 0) { 165 + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 166 + 167 + if (params->use_4addr == ifmgd->use_4addr) 168 + return 0; 169 + 167 170 sdata->u.mgd.use_4addr = params->use_4addr; 171 + if (!ifmgd->associated) 172 + return 0; 173 + 174 + mutex_lock(&local->sta_mtx); 175 + sta = sta_info_get(sdata, ifmgd->bssid); 176 + if (sta) 177 + drv_sta_set_4addr(local, sdata, &sta->sta, 178 + params->use_4addr); 179 + mutex_unlock(&local->sta_mtx); 180 + 181 + if (params->use_4addr) 182 + ieee80211_send_4addr_nullfunc(local, sdata); 168 183 } 169 184 170 185 if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {

+2

net/mac80211/ieee80211_i.h

··· 2201 2201 void ieee80211_send_nullfunc(struct ieee80211_local *local, 2202 2202 struct ieee80211_sub_if_data *sdata, 2203 2203 bool powersave); 2204 + void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local, 2205 + struct ieee80211_sub_if_data *sdata); 2204 2206 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata, 2205 2207 struct ieee80211_hdr *hdr, bool ack, u16 tx_time); 2206 2208

+2 -2

net/mac80211/mlme.c

··· 1095 1095 ieee80211_tx_skb(sdata, skb); 1096 1096 } 1097 1097 1098 - static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local, 1099 - struct ieee80211_sub_if_data *sdata) 1098 + void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local, 1099 + struct ieee80211_sub_if_data *sdata) 1100 1100 { 1101 1101 struct sk_buff *skb; 1102 1102 struct ieee80211_hdr *nullfunc;

+2 -1

net/mac80211/rx.c

··· 730 730 * Need to make a copy and possibly remove radiotap header 731 731 * and FCS from the original. 732 732 */ 733 - skb = skb_copy_expand(*origskb, needed_headroom, 0, GFP_ATOMIC); 733 + skb = skb_copy_expand(*origskb, needed_headroom + NET_SKB_PAD, 734 + 0, GFP_ATOMIC); 734 735 735 736 if (!skb) 736 737 return NULL;

+32 -25

net/mac80211/tx.c

··· 1147 1147 return queued; 1148 1148 } 1149 1149 1150 + static void 1151 + ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata, 1152 + struct sta_info *sta, 1153 + struct sk_buff *skb) 1154 + { 1155 + struct rate_control_ref *ref = sdata->local->rate_ctrl; 1156 + u16 tid; 1157 + 1158 + if (!ref || !(ref->ops->capa & RATE_CTRL_CAPA_AMPDU_TRIGGER)) 1159 + return; 1160 + 1161 + if (!sta || !sta->sta.ht_cap.ht_supported || 1162 + !sta->sta.wme || skb_get_queue_mapping(skb) == IEEE80211_AC_VO || 1163 + skb->protocol == sdata->control_port_protocol) 1164 + return; 1165 + 1166 + tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK; 1167 + if (likely(sta->ampdu_mlme.tid_tx[tid])) 1168 + return; 1169 + 1170 + ieee80211_start_tx_ba_session(&sta->sta, tid, 0); 1171 + } 1172 + 1150 1173 /* 1151 1174 * initialises @tx 1152 1175 * pass %NULL for the station if unknown, a valid pointer if known ··· 1183 1160 struct ieee80211_local *local = sdata->local; 1184 1161 struct ieee80211_hdr *hdr; 1185 1162 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1163 + bool aggr_check = false; 1186 1164 int tid; 1187 1165 1188 1166 memset(tx, 0, sizeof(*tx)); ··· 1212 1188 } else if (tx->sdata->control_port_protocol == tx->skb->protocol) { 1213 1189 tx->sta = sta_info_get_bss(sdata, hdr->addr1); 1214 1190 } 1215 - if (!tx->sta && !is_multicast_ether_addr(hdr->addr1)) 1191 + if (!tx->sta && !is_multicast_ether_addr(hdr->addr1)) { 1216 1192 tx->sta = sta_info_get(sdata, hdr->addr1); 1193 + aggr_check = true; 1194 + } 1217 1195 } 1218 1196 1219 1197 if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) && ··· 1225 1199 struct tid_ampdu_tx *tid_tx; 1226 1200 1227 1201 tid = ieee80211_get_tid(hdr); 1228 - 1229 1202 tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]); 1203 + if (!tid_tx && aggr_check) { 1204 + ieee80211_aggr_check(sdata, tx->sta, skb); 1205 + tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]); 1206 + } 1207 + 1230 1208 if (tid_tx) { 1231 1209 bool queued; 1232 1210 ··· 4149 4119 spin_unlock_bh(&air_sched->lock); 4150 4120 } 4151 4121 EXPORT_SYMBOL(ieee80211_txq_schedule_start); 4152 - 4153 - static void 4154 - ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata, 4155 - struct sta_info *sta, 4156 - struct sk_buff *skb) 4157 - { 4158 - struct rate_control_ref *ref = sdata->local->rate_ctrl; 4159 - u16 tid; 4160 - 4161 - if (!ref || !(ref->ops->capa & RATE_CTRL_CAPA_AMPDU_TRIGGER)) 4162 - return; 4163 - 4164 - if (!sta || !sta->sta.ht_cap.ht_supported || 4165 - !sta->sta.wme || skb_get_queue_mapping(skb) == IEEE80211_AC_VO || 4166 - skb->protocol == sdata->control_port_protocol) 4167 - return; 4168 - 4169 - tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK; 4170 - if (likely(sta->ampdu_mlme.tid_tx[tid])) 4171 - return; 4172 - 4173 - ieee80211_start_tx_ba_session(&sta->sta, tid, 0); 4174 - } 4175 4122 4176 4123 void __ieee80211_subif_start_xmit(struct sk_buff *skb, 4177 4124 struct net_device *dev,

+6 -1

net/netfilter/nf_conntrack_core.c

··· 670 670 return false; 671 671 672 672 tstamp = nf_conn_tstamp_find(ct); 673 - if (tstamp && tstamp->stop == 0) 673 + if (tstamp) { 674 + s32 timeout = ct->timeout - nfct_time_stamp; 675 + 674 676 tstamp->stop = ktime_get_real_ns(); 677 + if (timeout < 0) 678 + tstamp->stop -= jiffies_to_nsecs(-timeout); 679 + } 675 680 676 681 if (nf_conntrack_event_report(IPCT_DESTROY, ct, 677 682 portid, report) < 0) {

+5 -1

net/netfilter/nf_flow_table_core.c

··· 331 331 void flow_offload_refresh(struct nf_flowtable *flow_table, 332 332 struct flow_offload *flow) 333 333 { 334 - flow->timeout = nf_flowtable_time_stamp + flow_offload_get_timeout(flow); 334 + u32 timeout; 335 + 336 + timeout = nf_flowtable_time_stamp + flow_offload_get_timeout(flow); 337 + if (READ_ONCE(flow->timeout) != timeout) 338 + WRITE_ONCE(flow->timeout, timeout); 335 339 336 340 if (likely(!nf_flowtable_hw_offload(flow_table))) 337 341 return;

+12

net/netfilter/nf_tables_api.c

··· 8445 8445 return 0; 8446 8446 } 8447 8447 8448 + static void nf_tables_commit_audit_free(struct list_head *adl) 8449 + { 8450 + struct nft_audit_data *adp, *adn; 8451 + 8452 + list_for_each_entry_safe(adp, adn, adl, list) { 8453 + list_del(&adp->list); 8454 + kfree(adp); 8455 + } 8456 + } 8457 + 8448 8458 static void nf_tables_commit_audit_collect(struct list_head *adl, 8449 8459 struct nft_table *table, u32 op) 8450 8460 { ··· 8519 8509 ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table); 8520 8510 if (ret) { 8521 8511 nf_tables_commit_chain_prepare_cancel(net); 8512 + nf_tables_commit_audit_free(&adl); 8522 8513 return ret; 8523 8514 } 8524 8515 if (trans->msg_type == NFT_MSG_NEWRULE || ··· 8529 8518 ret = nf_tables_commit_chain_prepare(net, chain); 8530 8519 if (ret < 0) { 8531 8520 nf_tables_commit_chain_prepare_cancel(net); 8521 + nf_tables_commit_audit_free(&adl); 8532 8522 return ret; 8533 8523 } 8534 8524 }

+2

net/netfilter/nfnetlink_hook.c

··· 174 174 nfnl_hook_entries_head(u8 pf, unsigned int hook, struct net *net, const char *dev) 175 175 { 176 176 const struct nf_hook_entries *hook_head = NULL; 177 + #ifdef CONFIG_NETFILTER_INGRESS 177 178 struct net_device *netdev; 179 + #endif 178 180 179 181 switch (pf) { 180 182 case NFPROTO_IPV4:

+13 -7

net/netfilter/nft_last.c

··· 48 48 { 49 49 struct nft_last_priv *priv = nft_expr_priv(expr); 50 50 51 - priv->last_jiffies = jiffies; 52 - priv->last_set = 1; 51 + if (READ_ONCE(priv->last_jiffies) != jiffies) 52 + WRITE_ONCE(priv->last_jiffies, jiffies); 53 + if (READ_ONCE(priv->last_set) == 0) 54 + WRITE_ONCE(priv->last_set, 1); 53 55 } 54 56 55 57 static int nft_last_dump(struct sk_buff *skb, const struct nft_expr *expr) 56 58 { 57 59 struct nft_last_priv *priv = nft_expr_priv(expr); 60 + unsigned long last_jiffies = READ_ONCE(priv->last_jiffies); 61 + u32 last_set = READ_ONCE(priv->last_set); 58 62 __be64 msecs; 59 63 60 - if (time_before(jiffies, priv->last_jiffies)) 61 - priv->last_set = 0; 64 + if (time_before(jiffies, last_jiffies)) { 65 + WRITE_ONCE(priv->last_set, 0); 66 + last_set = 0; 67 + } 62 68 63 - if (priv->last_set) 64 - msecs = nf_jiffies64_to_msecs(jiffies - priv->last_jiffies); 69 + if (last_set) 70 + msecs = nf_jiffies64_to_msecs(jiffies - last_jiffies); 65 71 else 66 72 msecs = 0; 67 73 68 - if (nla_put_be32(skb, NFTA_LAST_SET, htonl(priv->last_set)) || 74 + if (nla_put_be32(skb, NFTA_LAST_SET, htonl(last_set)) || 69 75 nla_put_be64(skb, NFTA_LAST_MSECS, msecs, NFTA_LAST_PAD)) 70 76 goto nla_put_failure; 71 77

+3 -1

net/netfilter/nft_nat.c

··· 201 201 alen = sizeof_field(struct nf_nat_range, min_addr.ip6); 202 202 break; 203 203 default: 204 - return -EAFNOSUPPORT; 204 + if (tb[NFTA_NAT_REG_ADDR_MIN]) 205 + return -EAFNOSUPPORT; 206 + break; 205 207 } 206 208 priv->family = family; 207 209

+5 -1

net/qrtr/qrtr.c

··· 518 518 if (!ipc) 519 519 goto err; 520 520 521 - if (sock_queue_rcv_skb(&ipc->sk, skb)) 521 + if (sock_queue_rcv_skb(&ipc->sk, skb)) { 522 + qrtr_port_put(ipc); 522 523 goto err; 524 + } 523 525 524 526 qrtr_port_put(ipc); 525 527 } ··· 841 839 842 840 ipc = qrtr_port_lookup(to->sq_port); 843 841 if (!ipc || &ipc->sk == skb->sk) { /* do not send to self */ 842 + if (ipc) 843 + qrtr_port_put(ipc); 844 844 kfree_skb(skb); 845 845 return -ENODEV; 846 846 }

+1 -1

net/sctp/input.c

··· 1203 1203 if (unlikely(!af)) 1204 1204 return NULL; 1205 1205 1206 - if (af->from_addr_param(&paddr, param, peer_port, 0)) 1206 + if (!af->from_addr_param(&paddr, param, peer_port, 0)) 1207 1207 return NULL; 1208 1208 1209 1209 return __sctp_lookup_association(net, laddr, &paddr, transportp);

+3 -2

net/sctp/ipv6.c

··· 100 100 list_for_each_entry_safe(addr, temp, 101 101 &net->sctp.local_addr_list, list) { 102 102 if (addr->a.sa.sa_family == AF_INET6 && 103 - ipv6_addr_equal(&addr->a.v6.sin6_addr, 104 - &ifa->addr)) { 103 + ipv6_addr_equal(&addr->a.v6.sin6_addr, 104 + &ifa->addr) && 105 + addr->a.v6.sin6_scope_id == ifa->idev->dev->ifindex) { 105 106 sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_DEL); 106 107 found = 1; 107 108 addr->valid = 0;

+7 -8

net/sctp/sm_statefuns.c

··· 1109 1109 if (!sctp_transport_pl_enabled(transport)) 1110 1110 return SCTP_DISPOSITION_CONSUME; 1111 1111 1112 - sctp_transport_pl_send(transport); 1113 - 1114 - reply = sctp_make_heartbeat(asoc, transport, transport->pl.probe_size); 1115 - if (!reply) 1116 - return SCTP_DISPOSITION_NOMEM; 1117 - sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 1112 + if (sctp_transport_pl_send(transport)) { 1113 + reply = sctp_make_heartbeat(asoc, transport, transport->pl.probe_size); 1114 + if (!reply) 1115 + return SCTP_DISPOSITION_NOMEM; 1116 + sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 1117 + } 1118 1118 sctp_add_cmd_sf(commands, SCTP_CMD_PROBE_TIMER_UPDATE, 1119 1119 SCTP_TRANSPORT(transport)); 1120 1120 ··· 1274 1274 !sctp_transport_pl_enabled(link)) 1275 1275 return SCTP_DISPOSITION_DISCARD; 1276 1276 1277 - sctp_transport_pl_recv(link); 1278 - if (link->pl.state == SCTP_PL_COMPLETE) 1277 + if (sctp_transport_pl_recv(link)) 1279 1278 return SCTP_DISPOSITION_CONSUME; 1280 1279 1281 1280 return sctp_sf_send_probe(net, ep, asoc, type, link, commands);

+27 -18

net/sctp/transport.c

··· 258 258 sctp_transport_pl_update(transport); 259 259 } 260 260 261 - void sctp_transport_pl_send(struct sctp_transport *t) 261 + bool sctp_transport_pl_send(struct sctp_transport *t) 262 262 { 263 - pr_debug("%s: PLPMTUD: transport: %p, state: %d, pmtu: %d, size: %d, high: %d\n", 264 - __func__, t, t->pl.state, t->pl.pmtu, t->pl.probe_size, t->pl.probe_high); 263 + if (t->pl.probe_count < SCTP_MAX_PROBES) 264 + goto out; 265 265 266 - if (t->pl.probe_count < SCTP_MAX_PROBES) { 267 - t->pl.probe_count++; 268 - return; 269 - } 270 - 266 + t->pl.last_rtx_chunks = t->asoc->rtx_data_chunks; 267 + t->pl.probe_count = 0; 271 268 if (t->pl.state == SCTP_PL_BASE) { 272 269 if (t->pl.probe_size == SCTP_BASE_PLPMTU) { /* BASE_PLPMTU Confirmation Failed */ 273 270 t->pl.state = SCTP_PL_ERROR; /* Base -> Error */ ··· 296 299 sctp_assoc_sync_pmtu(t->asoc); 297 300 } 298 301 } 299 - t->pl.probe_count = 1; 302 + 303 + out: 304 + if (t->pl.state == SCTP_PL_COMPLETE && t->pl.raise_count < 30 && 305 + !t->pl.probe_count && t->pl.last_rtx_chunks == t->asoc->rtx_data_chunks) { 306 + t->pl.raise_count++; 307 + return false; 308 + } 309 + 310 + pr_debug("%s: PLPMTUD: transport: %p, state: %d, pmtu: %d, size: %d, high: %d\n", 311 + __func__, t, t->pl.state, t->pl.pmtu, t->pl.probe_size, t->pl.probe_high); 312 + 313 + t->pl.probe_count++; 314 + return true; 300 315 } 301 316 302 - void sctp_transport_pl_recv(struct sctp_transport *t) 317 + bool sctp_transport_pl_recv(struct sctp_transport *t) 303 318 { 304 319 pr_debug("%s: PLPMTUD: transport: %p, state: %d, pmtu: %d, size: %d, high: %d\n", 305 320 __func__, t, t->pl.state, t->pl.pmtu, t->pl.probe_size, t->pl.probe_high); 306 321 322 + t->pl.last_rtx_chunks = t->asoc->rtx_data_chunks; 307 323 t->pl.pmtu = t->pl.probe_size; 308 324 t->pl.probe_count = 0; 309 325 if (t->pl.state == SCTP_PL_BASE) { ··· 333 323 if (!t->pl.probe_high) { 334 324 t->pl.probe_size = min(t->pl.probe_size + SCTP_PL_BIG_STEP, 335 325 SCTP_MAX_PLPMTU); 336 - return; 326 + return false; 337 327 } 338 328 t->pl.probe_size += SCTP_PL_MIN_STEP; 339 329 if (t->pl.probe_size >= t->pl.probe_high) { ··· 345 335 t->pathmtu = t->pl.pmtu + sctp_transport_pl_hlen(t); 346 336 sctp_assoc_sync_pmtu(t->asoc); 347 337 } 348 - } else if (t->pl.state == SCTP_PL_COMPLETE) { 349 - t->pl.raise_count++; 350 - if (t->pl.raise_count == 30) { 351 - /* Raise probe_size again after 30 * interval in Search Complete */ 352 - t->pl.state = SCTP_PL_SEARCH; /* Search Complete -> Search */ 353 - t->pl.probe_size += SCTP_PL_MIN_STEP; 354 - } 338 + } else if (t->pl.state == SCTP_PL_COMPLETE && t->pl.raise_count == 30) { 339 + /* Raise probe_size again after 30 * interval in Search Complete */ 340 + t->pl.state = SCTP_PL_SEARCH; /* Search Complete -> Search */ 341 + t->pl.probe_size += SCTP_PL_MIN_STEP; 355 342 } 343 + 344 + return t->pl.state == SCTP_PL_COMPLETE; 356 345 } 357 346 358 347 static bool sctp_transport_pl_toobig(struct sctp_transport *t, u32 pmtu)

+4 -10

net/tipc/crypto.c

··· 898 898 if (unlikely(!aead)) 899 899 return -ENOKEY; 900 900 901 - /* Cow skb data if needed */ 902 - if (likely(!skb_cloned(skb) && 903 - (!skb_is_nonlinear(skb) || !skb_has_frag_list(skb)))) { 904 - nsg = 1 + skb_shinfo(skb)->nr_frags; 905 - } else { 906 - nsg = skb_cow_data(skb, 0, &unused); 907 - if (unlikely(nsg < 0)) { 908 - pr_err("RX: skb_cow_data() returned %d\n", nsg); 909 - return nsg; 910 - } 901 + nsg = skb_cow_data(skb, 0, &unused); 902 + if (unlikely(nsg < 0)) { 903 + pr_err("RX: skb_cow_data() returned %d\n", nsg); 904 + return nsg; 911 905 } 912 906 913 907 /* Allocate memory for the AEAD operation */

+17 -13

net/tipc/socket.c

··· 158 158 static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dsz); 159 159 static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dsz); 160 160 static void tipc_sk_push_backlog(struct tipc_sock *tsk, bool nagle_ack); 161 + static int tipc_wait_for_connect(struct socket *sock, long *timeo_p); 161 162 162 163 static const struct proto_ops packet_ops; 163 164 static const struct proto_ops stream_ops; ··· 1516 1515 rc = 0; 1517 1516 } 1518 1517 1519 - if (unlikely(syn && !rc)) 1518 + if (unlikely(syn && !rc)) { 1520 1519 tipc_set_sk_state(sk, TIPC_CONNECTING); 1520 + if (timeout) { 1521 + timeout = msecs_to_jiffies(timeout); 1522 + tipc_wait_for_connect(sock, &timeout); 1523 + } 1524 + } 1521 1525 1522 1526 return rc ? rc : dlen; 1523 1527 } ··· 1570 1564 return -EMSGSIZE; 1571 1565 1572 1566 /* Handle implicit connection setup */ 1573 - if (unlikely(dest)) { 1567 + if (unlikely(dest && sk->sk_state == TIPC_OPEN)) { 1574 1568 rc = __tipc_sendmsg(sock, m, dlen); 1575 1569 if (dlen && dlen == rc) { 1576 1570 tsk->peer_caps = tipc_node_get_capabilities(net, dnode); ··· 2652 2646 static int tipc_wait_for_accept(struct socket *sock, long timeo) 2653 2647 { 2654 2648 struct sock *sk = sock->sk; 2655 - DEFINE_WAIT(wait); 2649 + DEFINE_WAIT_FUNC(wait, woken_wake_function); 2656 2650 int err; 2657 2651 2658 2652 /* True wake-one mechanism for incoming connections: only ··· 2661 2655 * anymore, the common case will execute the loop only once. 2662 2656 */ 2663 2657 for (;;) { 2664 - prepare_to_wait_exclusive(sk_sleep(sk), &wait, 2665 - TASK_INTERRUPTIBLE); 2666 2658 if (timeo && skb_queue_empty(&sk->sk_receive_queue)) { 2659 + add_wait_queue(sk_sleep(sk), &wait); 2667 2660 release_sock(sk); 2668 - timeo = schedule_timeout(timeo); 2661 + timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 2669 2662 lock_sock(sk); 2663 + remove_wait_queue(sk_sleep(sk), &wait); 2670 2664 } 2671 2665 err = 0; 2672 2666 if (!skb_queue_empty(&sk->sk_receive_queue)) ··· 2678 2672 if (signal_pending(current)) 2679 2673 break; 2680 2674 } 2681 - finish_wait(sk_sleep(sk), &wait); 2682 2675 return err; 2683 2676 } 2684 2677 ··· 2694 2689 bool kern) 2695 2690 { 2696 2691 struct sock *new_sk, *sk = sock->sk; 2697 - struct sk_buff *buf; 2698 2692 struct tipc_sock *new_tsock; 2693 + struct msghdr m = {NULL,}; 2699 2694 struct tipc_msg *msg; 2695 + struct sk_buff *buf; 2700 2696 long timeo; 2701 2697 int res; 2702 2698 ··· 2743 2737 } 2744 2738 2745 2739 /* 2746 - * Respond to 'SYN-' by discarding it & returning 'ACK'-. 2747 - * Respond to 'SYN+' by queuing it on new socket. 2740 + * Respond to 'SYN-' by discarding it & returning 'ACK'. 2741 + * Respond to 'SYN+' by queuing it on new socket & returning 'ACK'. 2748 2742 */ 2749 2743 if (!msg_data_sz(msg)) { 2750 - struct msghdr m = {NULL,}; 2751 - 2752 2744 tsk_advance_rx_queue(sk); 2753 - __tipc_sendstream(new_sock, &m, 0); 2754 2745 } else { 2755 2746 __skb_dequeue(&sk->sk_receive_queue); 2756 2747 __skb_queue_head(&new_sk->sk_receive_queue, buf); 2757 2748 skb_set_owner_r(buf, new_sk); 2758 2749 } 2750 + __tipc_sendstream(new_sock, &m, 0); 2759 2751 release_sock(new_sk); 2760 2752 exit: 2761 2753 release_sock(sk);

+4 -1

net/wireless/nl80211.c

··· 2351 2351 goto nla_put_failure; 2352 2352 2353 2353 for (band = state->band_start; 2354 - band < NUM_NL80211_BANDS; band++) { 2354 + band < (state->split ? 2355 + NUM_NL80211_BANDS : 2356 + NL80211_BAND_60GHZ + 1); 2357 + band++) { 2355 2358 struct ieee80211_supported_band *sband; 2356 2359 2357 2360 /* omit higher bands for ancient software */

+2 -4

net/wireless/scan.c

··· 1754 1754 * be grouped with this beacon for updates ... 1755 1755 */ 1756 1756 if (!cfg80211_combine_bsses(rdev, new)) { 1757 - kfree(new); 1757 + bss_ref_put(rdev, new); 1758 1758 goto drop; 1759 1759 } 1760 1760 } 1761 1761 1762 1762 if (rdev->bss_entries >= bss_entries_limit && 1763 1763 !cfg80211_bss_expire_oldest(rdev)) { 1764 - if (!list_empty(&new->hidden_list)) 1765 - list_del(&new->hidden_list); 1766 - kfree(new); 1764 + bss_ref_put(rdev, new); 1767 1765 goto drop; 1768 1766 } 1769 1767

+229

tools/testing/selftests/bpf/verifier/value_ptr_arith.c

··· 1 1 { 2 + "map access: known scalar += value_ptr unknown vs const", 3 + .insns = { 4 + BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 5 + offsetof(struct __sk_buff, len)), 6 + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 7 + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 8 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 9 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3), 10 + BPF_LD_MAP_FD(BPF_REG_1, 0), 11 + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 12 + BPF_LD_MAP_FD(BPF_REG_1, 0), 13 + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 14 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 15 + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0), 16 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 4), 17 + BPF_MOV64_IMM(BPF_REG_1, 6), 18 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0), 19 + BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7), 20 + BPF_JMP_IMM(BPF_JA, 0, 0, 1), 21 + BPF_MOV64_IMM(BPF_REG_1, 3), 22 + BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0), 23 + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), 24 + BPF_MOV64_IMM(BPF_REG_0, 1), 25 + BPF_EXIT_INSN(), 26 + }, 27 + .fixup_map_hash_16b = { 5 }, 28 + .fixup_map_array_48b = { 8 }, 29 + .result_unpriv = REJECT, 30 + .errstr_unpriv = "R1 tried to add from different maps, paths or scalars", 31 + .result = ACCEPT, 32 + .retval = 1, 33 + }, 34 + { 35 + "map access: known scalar += value_ptr const vs unknown", 36 + .insns = { 37 + BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 38 + offsetof(struct __sk_buff, len)), 39 + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 40 + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 41 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 42 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3), 43 + BPF_LD_MAP_FD(BPF_REG_1, 0), 44 + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 45 + BPF_LD_MAP_FD(BPF_REG_1, 0), 46 + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 47 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 48 + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0), 49 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 2), 50 + BPF_MOV64_IMM(BPF_REG_1, 3), 51 + BPF_JMP_IMM(BPF_JA, 0, 0, 3), 52 + BPF_MOV64_IMM(BPF_REG_1, 6), 53 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0), 54 + BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7), 55 + BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0), 56 + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), 57 + BPF_MOV64_IMM(BPF_REG_0, 1), 58 + BPF_EXIT_INSN(), 59 + }, 60 + .fixup_map_hash_16b = { 5 }, 61 + .fixup_map_array_48b = { 8 }, 62 + .result_unpriv = REJECT, 63 + .errstr_unpriv = "R1 tried to add from different maps, paths or scalars", 64 + .result = ACCEPT, 65 + .retval = 1, 66 + }, 67 + { 68 + "map access: known scalar += value_ptr const vs const (ne)", 69 + .insns = { 70 + BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 71 + offsetof(struct __sk_buff, len)), 72 + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 73 + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 74 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 75 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3), 76 + BPF_LD_MAP_FD(BPF_REG_1, 0), 77 + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 78 + BPF_LD_MAP_FD(BPF_REG_1, 0), 79 + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 80 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 81 + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0), 82 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 2), 83 + BPF_MOV64_IMM(BPF_REG_1, 3), 84 + BPF_JMP_IMM(BPF_JA, 0, 0, 1), 85 + BPF_MOV64_IMM(BPF_REG_1, 5), 86 + BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0), 87 + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), 88 + BPF_MOV64_IMM(BPF_REG_0, 1), 89 + BPF_EXIT_INSN(), 90 + }, 91 + .fixup_map_hash_16b = { 5 }, 92 + .fixup_map_array_48b = { 8 }, 93 + .result_unpriv = REJECT, 94 + .errstr_unpriv = "R1 tried to add from different maps, paths or scalars", 95 + .result = ACCEPT, 96 + .retval = 1, 97 + }, 98 + { 99 + "map access: known scalar += value_ptr const vs const (eq)", 100 + .insns = { 101 + BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 102 + offsetof(struct __sk_buff, len)), 103 + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 104 + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 105 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 106 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3), 107 + BPF_LD_MAP_FD(BPF_REG_1, 0), 108 + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 109 + BPF_LD_MAP_FD(BPF_REG_1, 0), 110 + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 111 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 112 + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0), 113 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 2), 114 + BPF_MOV64_IMM(BPF_REG_1, 5), 115 + BPF_JMP_IMM(BPF_JA, 0, 0, 1), 116 + BPF_MOV64_IMM(BPF_REG_1, 5), 117 + BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0), 118 + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), 119 + BPF_MOV64_IMM(BPF_REG_0, 1), 120 + BPF_EXIT_INSN(), 121 + }, 122 + .fixup_map_hash_16b = { 5 }, 123 + .fixup_map_array_48b = { 8 }, 124 + .result = ACCEPT, 125 + .retval = 1, 126 + }, 127 + { 128 + "map access: known scalar += value_ptr unknown vs unknown (eq)", 129 + .insns = { 130 + BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 131 + offsetof(struct __sk_buff, len)), 132 + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 133 + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 134 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 135 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3), 136 + BPF_LD_MAP_FD(BPF_REG_1, 0), 137 + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 138 + BPF_LD_MAP_FD(BPF_REG_1, 0), 139 + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 140 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11), 141 + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0), 142 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 4), 143 + BPF_MOV64_IMM(BPF_REG_1, 6), 144 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0), 145 + BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7), 146 + BPF_JMP_IMM(BPF_JA, 0, 0, 3), 147 + BPF_MOV64_IMM(BPF_REG_1, 6), 148 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0), 149 + BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7), 150 + BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0), 151 + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), 152 + BPF_MOV64_IMM(BPF_REG_0, 1), 153 + BPF_EXIT_INSN(), 154 + }, 155 + .fixup_map_hash_16b = { 5 }, 156 + .fixup_map_array_48b = { 8 }, 157 + .result = ACCEPT, 158 + .retval = 1, 159 + }, 160 + { 161 + "map access: known scalar += value_ptr unknown vs unknown (lt)", 162 + .insns = { 163 + BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 164 + offsetof(struct __sk_buff, len)), 165 + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 166 + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 167 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 168 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3), 169 + BPF_LD_MAP_FD(BPF_REG_1, 0), 170 + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 171 + BPF_LD_MAP_FD(BPF_REG_1, 0), 172 + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 173 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11), 174 + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0), 175 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 4), 176 + BPF_MOV64_IMM(BPF_REG_1, 6), 177 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0), 178 + BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x3), 179 + BPF_JMP_IMM(BPF_JA, 0, 0, 3), 180 + BPF_MOV64_IMM(BPF_REG_1, 6), 181 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0), 182 + BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7), 183 + BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0), 184 + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), 185 + BPF_MOV64_IMM(BPF_REG_0, 1), 186 + BPF_EXIT_INSN(), 187 + }, 188 + .fixup_map_hash_16b = { 5 }, 189 + .fixup_map_array_48b = { 8 }, 190 + .result_unpriv = REJECT, 191 + .errstr_unpriv = "R1 tried to add from different maps, paths or scalars", 192 + .result = ACCEPT, 193 + .retval = 1, 194 + }, 195 + { 196 + "map access: known scalar += value_ptr unknown vs unknown (gt)", 197 + .insns = { 198 + BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 199 + offsetof(struct __sk_buff, len)), 200 + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 201 + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 202 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 203 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3), 204 + BPF_LD_MAP_FD(BPF_REG_1, 0), 205 + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 206 + BPF_LD_MAP_FD(BPF_REG_1, 0), 207 + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 208 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11), 209 + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0), 210 + BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 4), 211 + BPF_MOV64_IMM(BPF_REG_1, 6), 212 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0), 213 + BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7), 214 + BPF_JMP_IMM(BPF_JA, 0, 0, 3), 215 + BPF_MOV64_IMM(BPF_REG_1, 6), 216 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0), 217 + BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x3), 218 + BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0), 219 + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), 220 + BPF_MOV64_IMM(BPF_REG_0, 1), 221 + BPF_EXIT_INSN(), 222 + }, 223 + .fixup_map_hash_16b = { 5 }, 224 + .fixup_map_array_48b = { 8 }, 225 + .result_unpriv = REJECT, 226 + .errstr_unpriv = "R1 tried to add from different maps, paths or scalars", 227 + .result = ACCEPT, 228 + .retval = 1, 229 + }, 230 + { 2 231 "map access: known scalar += value_ptr from different maps", 3 232 .insns = { 4 233 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,

Configure Feed

Configure Feed