summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-08-02wifi: mwifiex: fix error recovery in PCIE buffer descriptor managementDmitry Antipov
Add missing 'kfree_skb()' in 'mwifiex_init_rxq_ring()' and never do 'kfree(card->rxbd_ring_vbase)' because this area is DMAed and should be released with 'dma_free_coherent()'. The latter is performed in 'mwifiex_pcie_delete_rxbd_ring()', which is now called to recover from possible errors in 'mwifiex_pcie_create_rxbd_ring()'. Likewise for 'mwifiex_pcie_init_evt_ring()', 'kfree(card->evtbd_ring_vbase)' 'mwifiex_pcie_delete_evtbd_ring()' and 'mwifiex_pcie_create_rxbd_ring()'. Fixes: d930faee141b ("mwifiex: add support for Marvell pcie8766 chipset") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230731074334.56463-1-dmantipov@yandex.ru
2023-08-02wifi: brcmsmac: cleanup SCB-related data typesDmitry Antipov
Drop unused and set-but-unused fields of 'struct scb_ampdu_tid_ini', 'struct scb_ampdu' and 'struct scb', as well as now unused argument of 'brcms_c_ampdu_tx_operational()', adjust related code. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230725162400.192357-2-dmantipov@yandex.ru
2023-08-02wifi: brcmsmac: remove more unused data typesDmitry Antipov
Remove unused 'struct brcmu_iovar' and 'struct tx_inst_power'. This follows commit b2090d93d4b6 ("wifi: brcmsmac: remove unused data type"). Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230725162400.192357-1-dmantipov@yandex.ru
2023-08-02wifi: mt76: Replace strlcpy() with strscpy()Azeem Shaikh
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). Direct replacement is safe here since DEV_ASSIGN is only used by TRACE macros and the return values are ignored. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230703181256.3712079-1-azeemshaikh38@gmail.com
2023-08-02vxlan: Fix nexthop hash sizeBenjamin Poirier
The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to the fact that 'int hash' is a negative number when the MSB is set. In the case of hash threshold nexthop groups, nexthop_select_path_hthr() will disproportionately select the first nexthop group entry. In the case of resilient nexthop groups, nexthop_select_path_res() may do an out of bounds access in nh_buckets[], for example: hash = -912054133 num_nh_buckets = 2 bucket_index = 65535 which leads to the following panic: BUG: unable to handle page fault for address: ffffc900025910c8 PGD 100000067 P4D 100000067 PUD 10026b067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:nexthop_select_path+0x197/0xbf0 Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85 RSP: 0018:ffff88810c36f260 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8 RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219 R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0 R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x1ee/0x5c0 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? search_bpf_extables+0xfe/0x1c0 ? fixup_exception+0x3b/0x470 ? exc_page_fault+0xf6/0x110 ? asm_exc_page_fault+0x26/0x30 ? nexthop_select_path+0x197/0xbf0 ? nexthop_select_path+0x197/0xbf0 ? lock_is_held_type+0xe7/0x140 vxlan_xmit+0x5b2/0x2340 ? __lock_acquire+0x92b/0x3370 ? __pfx_vxlan_xmit+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_register_lock_class+0x10/0x10 ? skb_network_protocol+0xce/0x2d0 ? dev_hard_start_xmit+0xca/0x350 ? __pfx_vxlan_xmit+0x10/0x10 dev_hard_start_xmit+0xca/0x350 __dev_queue_xmit+0x513/0x1e20 ? __pfx___dev_queue_xmit+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? mark_held_locks+0x44/0x90 ? skb_push+0x4c/0x80 ? eth_header+0x81/0xe0 ? __pfx_eth_header+0x10/0x10 ? neigh_resolve_output+0x215/0x310 ? ip6_finish_output2+0x2ba/0xc90 ip6_finish_output2+0x2ba/0xc90 ? lock_release+0x236/0x3e0 ? ip6_mtu+0xbb/0x240 ? __pfx_ip6_finish_output2+0x10/0x10 ? find_held_lock+0x83/0xa0 ? lock_is_held_type+0xe7/0x140 ip6_finish_output+0x1ee/0x780 ip6_output+0x138/0x460 ? __pfx_ip6_output+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_ip6_finish_output+0x10/0x10 NF_HOOK.constprop.0+0xc0/0x420 ? __pfx_NF_HOOK.constprop.0+0x10/0x10 ? ndisc_send_skb+0x2c0/0x960 ? __pfx_lock_release+0x10/0x10 ? __local_bh_enable_ip+0x93/0x110 ? lock_is_held_type+0xe7/0x140 ndisc_send_skb+0x4be/0x960 ? __pfx_ndisc_send_skb+0x10/0x10 ? mark_held_locks+0x65/0x90 ? find_held_lock+0x83/0xa0 ndisc_send_ns+0xb0/0x110 ? __pfx_ndisc_send_ns+0x10/0x10 addrconf_dad_work+0x631/0x8e0 ? lock_acquire+0x180/0x3f0 ? __pfx_addrconf_dad_work+0x10/0x10 ? mark_held_locks+0x24/0x90 process_one_work+0x582/0x9c0 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? mark_held_locks+0x24/0x90 worker_thread+0x93/0x630 ? __kthread_parkme+0xdc/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1a5/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 RIP: 0000:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0000:0000000000000000 EFLAGS: 00000000 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Modules linked in: CR2: ffffc900025910c8 ---[ end trace 0000000000000000 ]--- RIP: 0010:nexthop_select_path+0x197/0xbf0 Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85 RSP: 0018:ffff88810c36f260 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8 RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219 R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0 R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 0000000129d00000 CR4: 0000000000750ee0 PKRU: 55555554 Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: 0x2ca00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Fix this problem by ensuring the MSB of hash is 0 using a right shift - the same approach used in fib_multipath_hash() and rt6_multipath_hash(). Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02Merge branch 'icssg-driver'David S. Miller
MD Danish Anwar says: ==================== Introduce ICSSG based ethernet Driver The Programmable Real-time Unit and Industrial Communication Subsystem Gigabit (PRU_ICSSG) is a low-latency microcontroller subsystem in the TI SoCs. This subsystem is provided for the use cases like the implementation of custom peripheral interfaces, offloading of tasks from the other processor cores of the SoC, etc. The subsystem includes many accelerators for data processing like multiplier and multiplier-accumulator. It also has peripherals like UART, MII/RGMII, MDIO, etc. Every ICSSG core includes two 32-bit load/store RISC CPU cores called PRUs. The above features allow it to be used for implementing custom firmware based peripherals like ethernet. This series adds the YAML documentation and the driver with basic EMAC support for TI AM654 Silicon Rev 2 SoC with the PRU_ICSSG Sub-system. running dual-EMAC firmware. This currently supports basic EMAC with 1Gbps and 100Mbps link. 10M and half-duplex modes are not yet supported because they require the support of an IEP, which will be added later. Advanced features like switch-dev and timestamping will be added later. This is the v13 of the patch series [v1]. This version of the patchset addresses comments made on v12. There series doesn't have any dependency. Changes from v12 to v13 : *) Rebased the series on latest net-next. *) Addressed Jakub's comments on ndo_xmit API. Now we will only stop queues based on occupancy not on dma errors. *) Removed limiting the number of serviced packets to budget for Tx NAPI. Now Tx NAPI will keep servicing packets. *) Removed netif_running() check when packet arrives. *) Introduced prototypes of APIs in the same patch where these APIs are added. Dropped __maybe_unused tags as compiler only cares about prototypes existing, not whether actual callers are in place. Now prototypes of these APIs are present in the same patch where they are introduced but thes APIs are called later (in patch 6). Changes from v11 to v12 : *) Rebased the series on latest net-next. *) Addressed Jakub's comments on ndo_xmit API. *) Added hooks to .get_rmon_stats for the driver. Now tx / rx bucket size and frame counts per bucket will be fetched by ethtool_rmon_stats instead of ethtool -S. *) Added __maybe_unused tags to unused config and classifier APIs in patch 2,3 and 4. These tags are later removed in patch 6. Changes from v10 to v11 : *) Rebased the series on latest net-next. *) Split the ICSSG driver introduction patch into 9 different patches as asked by Jakub. *) Introduced new patch(patch 8/10) to dump Standard network interface staticstics via ndo_get_stats64. Now certain stats that are reported by ICSSG hardware and are also part of struct rtnl_link_stats64, will be reported by ndo_get_stats64. While other stats that are not part of the struct rtnl_link_stats64 will be reported by ethtool -S. These stats are not duplicated. Changes from v9 to v10 : *) Rebased the series on latest net-next. *) Moved 'ndev prueth->emac[mac] == emac' assignment to the end of function prueth_netdev_init(). *) In unsupported phy_mode switch case instead of returning -EINVAL, store the error code in ret and 'goto free' Changes from v8 to v9 : *) Rebased the series on latest net-next. *) Fixed smatch and sparse warnings as pointed by Simon. *) Fixed leaky ndev in prueth_netdev_init() as asked by Simon. Changes from v7 to v8 : *) Rebased the series on 6.5-rc1. *) Fixed few formattings. Changes from v6 to v7 : *) Added RB tag of Rob in patch 1 of this series. *) Addressed Simon's comment on patch 2 of the series. *) Rebased patchset on next-20230428 linux-next. Changes from v5 to v6 : *) Added RB tag of Andrew Lunn in patch 2 of this series. *) Addressed Rob's comment on patch 1 of the series. *) Rebased patchset on next-20230421 linux-next. Changes from v4 to v5 : *) Re-arranged properties section in ti,icssg-prueth.yaml file. *) Added requirement for minimum one ethernet port. *) Fixed some minor formatting errors as asked by Krzysztof. *) Dropped SGMII mode from enum mii_mode as SGMII mode is not currently supported by the driver. *) Added switch-case block to handle different phy modes by ICSSG driver. Changes from v3 to v4 : *) Addressed Krzysztof's comments and fixed dt_binding_check errors in patch 1/2. *) Added interrupt-extended property in ethernet-ports properties section. *) Fixed comments in file icssg_switch_map.h according to the Linux coding style in patch 2/2. Added Documentation of structures in patch 2/2. Changes from v2 to v3 : *) Addressed Rob and Krzysztof's comments on patch 1 of this series. Fixed indentation. Removed description and pinctrl section from ti,icssg-prueth.yaml file. *) Addressed Krzysztof, Paolo, Randy, Andrew and Christophe's comments on patch 2 of this seires. *) Fixed blanklines in Kconfig and Makefile. Changed structures to const as suggested by Krzysztof. *) Fixed while loop logic in emac_tx_complete_packets() API as suggested by Paolo. Previously in the loop's last iteration 'budget' was 0 and napi_consume_skb would wrongly assume the caller is not in NAPI context Now, budget won't be zero in last iteration of loop. *) Removed inline functions addr_to_da1() and addr_to_da0() as asked by Andrew. *) Added dev_err_probe() instead of dev_err() as suggested by Christophe. *) In ti,icssg-prueth.yaml file, in the patternProperties section of ethernet-ports, kept the port name as "port" instead of "ethernet-port" as all other drivers were using "port". Will change it if is compulsory to use "ethernet-port". ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: ti: icssg-prueth: Add Power management supportMD Danish Anwar
Add suspend / resume APIs to support power management in ICSSG ethernet driver. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: ti: icssg-prueth: Add ethtool ops for ICSSG Ethernet driverMD Danish Anwar
Add icssg_ethtool.c file. This file will be used for dumping statistics via ethtool for ICSSG ethernet driver. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: ti: icssg-prueth: Add Standard network staticsticsMD Danish Anwar
Implement .ndo_get_stats64 to dump standard network interface statistics for ICSSG ethernet driver. Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: ti: icssg-prueth: Add ICSSG StatsMD Danish Anwar
Add icssg_stats.c to help dump, icssg related driver statistics. ICSSG has hardware registers for providing statistics like total rx bytes, total tx bytes, etc. These registers are of 32 bits and hence in case of 1G link, they overflows in around 32 seconds. The behaviour of these registers is such that they don't roll back to 0 after overflow but rather stay at UINT_MAX. These registers support a feature where the value written to them is subtracted from the register. This feature can be utilized to fix the overflowing of stats. This solution uses a Workqueues based solution where a function gets called before the registers overflow (every 25 seconds in 1G link, 25000 seconds in 100M link), this function saves the register values in local variables and writes the last read value to the register. So any update during the read will be taken care of. Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: ti: icssg-prueth: Add ICSSG ethernet driverRoger Quadros
This is the Ethernet driver for TI AM654 Silicon rev. 2 with the ICSSG PRU Sub-system running dual-EMAC firmware. The Programmable Real-time Unit and Industrial Communication Subsystem Gigabit (PRU_ICSSG) is a low-latency microcontroller subsystem in the TI SoCs. This subsystem is provided for the use cases like implementation of custom peripheral interfaces, offloading of tasks from the other processor cores of the SoC, etc. Every ICSSG core has two Programmable Real-Time Unit(PRUs), two auxiliary Real-Time Transfer Unit (RT_PRUs), and two Transmit Real-Time Transfer Units (TX_PRUs). Each one of these runs its own firmware. Every ICSSG core has two MII ports connect to these PRUs and also a MDIO port. The cores can run different firmwares to support different protocols and features like switch-dev, timestamping, etc. It uses System DMA to transfer and receive packets and shared memory register emulation between the firmware and driver for control and configuration. This patch adds support for basic EMAC functionality with 1Gbps and 100Mbps link speed. 10M and half duplex mode are not supported currently as they require IEP, the support for which will be added later. Support for switch-dev, timestamp, etc. will be added later by subsequent patch series. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com> Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02dt-bindings: net: Add ICSSG EthernetMD Danish Anwar
Add a YAML binding document for the ICSSG Programmable real time unit based Ethernet hardware. The ICSSG driver uses the PRU and PRUSS consumer APIs to interface the PRUs and load/run the firmware for supporting ethernet functionality. Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: ti: icssg-prueth: Add icssg queues APIs and macrosMD Danish Anwar
Add icssg_queue.c file. This file introduces macros and APIs related to ICSSG queues. These will be used by ICSSG Ethernet driver. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: ti: icssg-prueth: Add Firmware config and classification APIs.MD Danish Anwar
Add icssg_config.h / .c and icssg_classifier.c files. These are firmware configuration and classification related files. These will be used by ICSSG ethernet driver. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: ti: icssg-prueth: Add mii helper apis and macrosMD Danish Anwar
Add MII helper APIs and MACROs. These APIs and MACROs will be later used by ICSSG Ethernet driver. Also introduce icssg_prueth.h which has definition of prueth related structures. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: ti: icssg-prueth: Add Firmware Interface for ICSSG Ethernet driver.MD Danish Anwar
Add firmware interface related headers and macros for ICSSG Ethernet driver. These macros will be later used by the ICSSG ethernet driver. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02Merge tag 'mt76-for-kvalo-2023-07-31' of https://github.com/nbd168/wirelessKalle Valo
mt76 patches for 6.6 * fixes * preparation for mt7925 support * mt7981 support
2023-08-02ip6mr: Fix skb_under_panic in ip6mr_cache_report()Yue Haibing
skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_panic+0x152/0x1d0 Call Trace: <TASK> skb_push+0xc4/0xe0 ip6mr_cache_report+0xd69/0x19b0 reg_vif_xmit+0x406/0x690 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 vlan_dev_hard_start_xmit+0x3ab/0x5c0 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 neigh_connected_output+0x3ed/0x570 ip6_finish_output2+0x5b5/0x1950 ip6_finish_output+0x693/0x11c0 ip6_output+0x24b/0x880 NF_HOOK.constprop.0+0xfd/0x530 ndisc_send_skb+0x9db/0x1400 ndisc_send_rs+0x12a/0x6c0 addrconf_dad_completed+0x3c9/0xea0 addrconf_dad_work+0x849/0x1420 process_one_work+0xa22/0x16e0 worker_thread+0x679/0x10c0 ret_from_fork+0x28/0x60 ret_from_fork_asm+0x11/0x20 When setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit(). reg_vif_xmit() ip6mr_cache_report() skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4 And skb_push declared as: void *skb_push(struct sk_buff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850 skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails. Fixes: 14fb64e1f449 ("[IPV6] MROUTE: Support PIM-SM (SSM).") Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: dsa: mv88e6xxx: Add erratum 3.14 for 88E6390X and 88E6190XAnte Knezic
Fixes XAUI/RXAUI lane alignment errors. Issue causes dropped packets when trying to communicate over fiber via SERDES lanes of port 9 and 10. Errata document applies only to 88E6190X and 88E6390X devices. Requires poking in undocumented registers. Signed-off-by: Ante Knezic <ante.knezic@helmholz.de> Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02s390/qeth: Don't call dev_close/dev_open (DOWN/UP)Alexandra Winter
dev_close() and dev_open() are issued to change the interface state to DOWN or UP (dev->flags IFF_UP). When the netdev is set DOWN it loses e.g its Ipv6 addresses and routes. We don't want this in cases of device recovery (triggered by hardware or software) or when the qeth device is set offline. Setting a qeth device offline or online and device recovery actions call netif_device_detach() and/or netif_device_attach(). That will reset or set the LOWER_UP indication i.e. change the dev->state Bit __LINK_STATE_PRESENT. That is enough to e.g. cause bond failovers, and still preserves the interface settings that are handled by the network stack. Don't call dev_open() nor dev_close() from the qeth device driver. Let the network stack handle this. Fixes: d4560150cb47 ("s390/qeth: call dev_close() during recovery") Signed-off-by: Alexandra Winter <wintera@linux.ibm.com> Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02Merge branch 'tc-flower-SPI'David S. Miller
Ratheesh Kannoth says: ==================== Packet classify by matching against SPI 1. net: flow_dissector: Add IPSEC dissector. Flow dissector patch reads IPSEC headers (ESP or AH) header from packet and retrieves the SPI header. 2. tc: flower: support for SPI. TC control path changes to pass SPI field from userspace to kernel. 3. tc: flower: Enable offload support IPSEC SPI field. Next patch enables the HW support for classify offload for ESP/AH. This patch enables the HW offload control. 4. octeontx2-pf: TC flower offload support for SPI field. HW offload support for classification in octeontx2 driver. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02octeontx2-pf: TC flower offload support for SPI fieldRatheesh Kannoth
Driver support to offload TC flower rules which matches against SPI field of IPSEC packets (AH/ESP). Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02tc: flower: Enable offload support IPSEC SPI field.Ratheesh Kannoth
This patch enables offload for TC classifier flower rules which matches against SPI field. Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02tc: flower: support for SPIRatheesh Kannoth
tc flower rules support to classify ESP/AH packets matching SPI field. Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: flow_dissector: Add IPSEC dissectorRatheesh Kannoth
Support for dissecting IPSEC field SPI (which is 32bits in size) for ESP and AH packets. Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02Merge branch 'tun-tap-uid'David S. Miller
Laszlo Ersek says: ==================== tun/tap: set sk_uid from current_fsuid() The original patches fixing CVE-2023-1076 are incorrect in my opinion. This small series fixes them up; see the individual commit messages for explanation. I have a very elaborate test procedure demonstrating the problem for both tun and tap; it involves libvirt, qemu, and "crash". I can share that procedure if necessary, but it's indeed quite long (I wrote it originally for our QE team). The patches in this series are supposed to "re-fix" CVE-2023-1076; given that said CVE is classified as Low Impact (CVSSv3=5.5), I'm posting this publicly, and not suggesting any embargo. Red Hat Product Security may assign a new CVE number later. I've tested the patches on top of v6.5-rc4, with "crash" built at commit c74f375e0ef7. Cc: Eric Dumazet <edumazet@google.com> Cc: Lorenzo Colitti <lorenzo@google.com> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Pietro Borrello <borrello@diag.uniroma1.it> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: tap_open(): set sk_uid from current_fsuid()Laszlo Ersek
Commit 66b2c338adce initializes the "sk_uid" field in the protocol socket (struct sock) from the "/dev/tapX" device node's owner UID. Per original commit 86741ec25462 ("net: core: Add a UID field to struct sock.", 2016-11-04), that's wrong: the idea is to cache the UID of the userspace process that creates the socket. Commit 86741ec25462 mentions socket() and accept(); with "tap", the action that creates the socket is open("/dev/tapX"). Therefore the device node's owner UID is irrelevant. In most cases, "/dev/tapX" will be owned by root, so in practice, commit 66b2c338adce has no observable effect: - before, "sk_uid" would be zero, due to undefined behavior (CVE-2023-1076), - after, "sk_uid" would be zero, due to "/dev/tapX" being owned by root. What matters is the (fs)UID of the process performing the open(), so cache that in "sk_uid". Cc: Eric Dumazet <edumazet@google.com> Cc: Lorenzo Colitti <lorenzo@google.com> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Pietro Borrello <borrello@diag.uniroma1.it> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Fixes: 66b2c338adce ("tap: tap_open(): correctly initialize socket uid") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: tun_chr_open(): set sk_uid from current_fsuid()Laszlo Ersek
Commit a096ccca6e50 initializes the "sk_uid" field in the protocol socket (struct sock) from the "/dev/net/tun" device node's owner UID. Per original commit 86741ec25462 ("net: core: Add a UID field to struct sock.", 2016-11-04), that's wrong: the idea is to cache the UID of the userspace process that creates the socket. Commit 86741ec25462 mentions socket() and accept(); with "tun", the action that creates the socket is open("/dev/net/tun"). Therefore the device node's owner UID is irrelevant. In most cases, "/dev/net/tun" will be owned by root, so in practice, commit a096ccca6e50 has no observable effect: - before, "sk_uid" would be zero, due to undefined behavior (CVE-2023-1076), - after, "sk_uid" would be zero, due to "/dev/net/tun" being owned by root. What matters is the (fs)UID of the process performing the open(), so cache that in "sk_uid". Cc: Eric Dumazet <edumazet@google.com> Cc: Lorenzo Colitti <lorenzo@google.com> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Pietro Borrello <borrello@diag.uniroma1.it> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Fixes: a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02Merge branch 'oxnas=dwmac-removal'David S. Miller
Neil Armstrong says: ==================== net: ethernet: dwmac: oxnas glue removal With [1] removing MPCore SMP support, this makes the OX820 barely usable, associated with a clear lack of maintainance, development and migration to dt-schema it's clear that Linux support for OX810 and OX820 should be removed. In addition, the OX810 hasn't been booted for years and isn't even present in an ARM config file. For the OX820, lack of USB and SATA support makes the platform not usable in the current Linux support and relies on off-tree drivers hacked from the vendor (defunct for years) sources. The last users are in the OpenWRT distribution, and today's removal means support will still be in stable 6.1 LTS kernel until end of 2026. If someone wants to take over the development even with lack of SMP, I'll be happy to hand off maintainance. It has been a fun time adding support for this architecture, but it's time to get over! This patchset only removes net changes, and is derived from: https://lore.kernel.org/r/20230630-topic-oxnas-upstream-remove-v2-0-fb6ab3dea87c@linaro.org --- Changes in v3: - Removed applied changes - Added Andy's tags - Reduced for net - Link to v2: https://lore.kernel.org/r/20230630-topic-oxnas-upstream-remove-v2-0-fb6ab3dea87c@linaro.org Changes in v2: - s/maintainance/maintenance/ - added acked/review tags - dropped already applied patches - drop RFC - Link to v1: https://lore.kernel.org/r/20230331-topic-oxnas-upstream-remove-v1-0-5bd58fd1dd1f@linaro.org ==================== Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02dt-bindings: net: oxnas-dwmac: remove obsolete bindingsNeil Armstrong
Due to lack of maintenance and stall of development for a few years now, and since no new features will ever be added upstream, remove the OX810 and OX820 dwmac glue. Acked-by: Linus Walleij <linus.walleij@linaro.org> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Daniel Golle <daniel@makrotopia.org> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: stmmac: dwmac-oxnas: remove obsolete dwmac glue driverNeil Armstrong
Due to lack of maintenance and stall of development for a few years now, and since no new features will ever be added upstream, remove support for OX810 and OX820 ethernet. Acked-by: Linus Walleij <linus.walleij@linaro.org> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Daniel Golle <daniel@makrotopia.org> Acked-by: Andy Shevchenko <andy@kernel.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02drm/panel: samsung-s6d7aa0: Add MODULE_DEVICE_TABLENikita Travkin
The driver can be built as a module, however the lack of the MODULE_DEVICE_TABLE macro prevents it from being automatically probed from the DT in such case. Add the missed macro to make sure the module can load automatically. Fixes: 6810bb390282 ("drm/panel: Add Samsung S6D7AA0 panel controller driver") Signed-off-by: Nikita Travkin <nikita@trvn.ru> Acked-by: Artur Weber <aweber.kernel@gmail.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20230802-gt5-panel-dtable-v1-1-c0a765c175e2@trvn.ru
2023-08-02Merge branch 'selftests-mlxsw'David S. Miller
Petr Machata says: ==================== selftests: New selftests for out-of-order-operations patches in mlxsw In the past, the mlxsw driver made the assumption that the user applies configuration in a bottom-up manner. Thus netdevices needed to be added to the bridge before IP addresses were configured on that bridge or SVI added on top of it, because whatever happened before a netdevice was mlxsw upper was generally ignored by mlxsw. Recently, several patch series were pushed to introduce the bookkeeping and replays necessary to offload the full state, not just the immediate configuration step. In this patchset, introduce new selftests that directly exercise the out of order code paths in mlxsw. - Patch #1 adds new tests into the existing selftest router_bridge.sh. - Patches #2-#5 add new generic selftests. - Patches #6-#8 add new mlxsw-specific selftests. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02selftests: mlxsw: rif_bridge: Add a new selftestPetr Machata
This test verifies driver behavior with regards to creation of RIFs for a bridge as LAGs are added or removed to/from it, and ports added or removed to/from the LAG. Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Danielle Ratson <danieller@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02selftests: mlxsw: rif_lag_vlan: Add a new selftestPetr Machata
This test verifies driver behavior with regards to creation of RIFs for LAG VLAN uppers as ports are added or removed to/from the LAG. Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Danielle Ratson <danieller@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02selftests: mlxsw: rif_lag: Add a new selftestPetr Machata
This test verifies driver behavior with regards to creation of RIFs for a LAG as ports are added or removed to/from it. Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Danielle Ratson <danieller@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02selftests: router_bridge_1d_lag: Add a new selftestPetr Machata
Add a selftest to verify that routing through several bridges works when LAG VLANs are used instead of physical ports, and that routing through LAG VLANs themselves works as physical ports are de/enslaved. Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Danielle Ratson <danieller@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02selftests: router_bridge_lag: Add a new selftestPetr Machata
Add a selftest to verify that routing through a bridge works when LAG is used instead of physical ports. Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Danielle Ratson <danieller@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02selftests: router_bridge_vlan_upper: Add a new selftestPetr Machata
Add a selftest that verifies routing through VLAN bridge uppers. Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Danielle Ratson <danieller@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02selftests: router_bridge_1d: Add a new selftestPetr Machata
Add a selftest to verify that routing through a 1d bridge works when VLAN upper of a physical port is used instead of a physical port. Also verify that when a port is attached to an already-configured bridge, the configuration is applied. Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Danielle Ratson <danieller@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02selftests: router_bridge: Add remastering testsPetr Machata
Add two tests to deslave a port from and reenslave to a bridge. This should retain the ability of the system to forward traffic, but on an offloading driver that is sensitive to ordering of operations, it might not. The first test does this configuration in a way that relies on vlan_default_pvid to assign the PVID. The second test disables that autoconfiguration and configures PVID by hand in a separate step. Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Danielle Ratson <danieller@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02net: stmmac: XGMAC support for mdio C22 addr > 3Rohan G Thomas
For XGMAC versions < 2.2 number of supported mdio C22 addresses is restricted to 3. From XGMAC version 2.2 there are no restrictions on the C22 addresses, it supports all valid mdio addresses(0 to 31). Signed-off-by: Rohan G Thomas <rohan.g.thomas@intel.com> Acked-by: Jose Abreu <Jose.Abreu@synopsys.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-08-02ata,scsi: do not issue START STOP UNIT on resumeDamien Le Moal
During system resume, ata_port_pm_resume() triggers ata EH to 1) Resume the controller 2) Reset and rescan the ports 3) Revalidate devices This EH execution is started asynchronously from ata_port_pm_resume(), which means that when sd_resume() is executed, none or only part of the above processing may have been executed. However, sd_resume() issues a START STOP UNIT to wake up the drive from sleep mode. This command is translated to ATA with ata_scsi_start_stop_xlat() and issued to the device. However, depending on the state of execution of the EH process and revalidation triggerred by ata_port_pm_resume(), two things may happen: 1) The START STOP UNIT fails if it is received before the controller has been reenabled at the beginning of the EH execution. This is visible with error messages like: ata10.00: device reported invalid CHS sector 0 sd 9:0:0:0: [sdc] Start/Stop Unit failed: Result: hostbyte=DID_OK driverbyte=DRIVER_OK sd 9:0:0:0: [sdc] Sense Key : Illegal Request [current] sd 9:0:0:0: [sdc] Add. Sense: Unaligned write command sd 9:0:0:0: PM: dpm_run_callback(): scsi_bus_resume+0x0/0x90 returns -5 sd 9:0:0:0: PM: failed to resume async: error -5 2) The START STOP UNIT command is received while the EH process is on-going, which mean that it is stopped and must wait for its completion, at which point the command is rather useless as the drive is already fully spun up already. This case results also in a significant delay in sd_resume() which is observable by users as the entire system resume completion is delayed. Given that ATA devices will be woken up by libata activity on resume, sd_resume() has no need to issue a START STOP UNIT command, which solves the above mentioned problems. Do not issue this command by introducing the new scsi_device flag no_start_on_resume and setting this flag to 1 in ata_scsi_dev_config(). sd_resume() is modified to issue a START STOP UNIT command only if this flag is not set. Reported-by: Paul Ausbeck <paula@soe.ucsc.edu> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215880 Fixes: a19a93e4c6a9 ("scsi: core: pm: Rely on the device driver core for async power management") Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Tested-by: Tanner Watkins <dalzot@gmail.com> Tested-by: Paul Ausbeck <paula@soe.ucsc.edu> Reviewed-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Bart Van Assche <bvanassche@acm.org>
2023-08-02Merge tag 'gvt-fixes-2023-08-02' of https://github.com/intel/gvt-linux into ↵Tvrtko Ursulin
drm-intel-fixes gvt-fixes-2023-08-02 - Fix bug to get AUX CH register message length (Yan) Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> From: Zhenyu Wang <zhenyuw@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/ZMnvf46JqgeIuTir@debian-scheme
2023-08-02libceph: fix potential hang in ceph_osdc_notify()Ilya Dryomov
If the cluster becomes unavailable, ceph_osdc_notify() may hang even with osd_request_timeout option set because linger_notify_finish_wait() waits for MWatchNotify NOTIFY_COMPLETE message with no associated OSD request in flight -- it's completely asynchronous. Introduce an additional timeout, derived from the specified notify timeout. While at it, switch both waits to killable which is more correct. Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Dongsheng Yang <dongsheng.yang@easystack.cn> Reviewed-by: Xiubo Li <xiubli@redhat.com>
2023-08-02rbd: prevent busy loop when requesting exclusive lockIlya Dryomov
Due to rbd_try_acquire_lock() effectively swallowing all but EBLOCKLISTED error from rbd_try_lock() ("request lock anyway") and rbd_request_lock() returning ETIMEDOUT error not only for an actual notify timeout but also when the lock owner doesn't respond, a busy loop inside of rbd_acquire_lock() between rbd_try_acquire_lock() and rbd_request_lock() is possible. Requesting the lock on EBUSY error (returned by get_lock_owner_info() if an incompatible lock or invalid lock owner is detected) makes very little sense. The same goes for ETIMEDOUT error (might pop up pretty much anywhere if osd_request_timeout option is set) and many others. Just fail I/O requests on rbd_dev->acquiring_list immediately on any error from rbd_try_lock(). Cc: stable@vger.kernel.org # 588159009d5b: rbd: retrieve and check lock owner twice before blocklisting Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Dongsheng Yang <dongsheng.yang@easystack.cn>
2023-08-02can: c_can: Do not check for 0 return after calling platform_get_irq()Ruan Jinjie
It is not possible for platform_get_irq() to return 0. Use the return value from platform_get_irq(). Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com> Link: https://lore.kernel.org/all/20230802030900.2271322-1-ruanjinjie@huawei.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2023-08-01net: dcb: choose correct policy to parse DCB_ATTR_BCNLin Ma
The dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN], which is introduced in commit 859ee3c43812 ("DCB: Add support for DCB BCN"). Please see the comment in below code static int dcbnl_bcn_setcfg(...) { ... ret = nla_parse_nested_deprecated(..., dcbnl_pfc_up_nest, .. ) // !!! dcbnl_pfc_up_nest for attributes // DCB_PFC_UP_ATTR_0 to DCB_PFC_UP_ATTR_ALL in enum dcbnl_pfc_up_attrs ... for (i = DCB_BCN_ATTR_RP_0; i <= DCB_BCN_ATTR_RP_7; i++) { // !!! DCB_BCN_ATTR_RP_0 to DCB_BCN_ATTR_RP_7 in enum dcbnl_bcn_attrs ... value_byte = nla_get_u8(data[i]); ... } ... for (i = DCB_BCN_ATTR_BCNA_0; i <= DCB_BCN_ATTR_RI; i++) { // !!! DCB_BCN_ATTR_BCNA_0 to DCB_BCN_ATTR_RI in enum dcbnl_bcn_attrs ... value_int = nla_get_u32(data[i]); ... } ... } That is, the nla_parse_nested_deprecated uses dcbnl_pfc_up_nest attributes to parse nlattr defined in dcbnl_pfc_up_attrs. But the following access code fetch each nlattr as dcbnl_bcn_attrs attributes. By looking up the associated nla_policy for dcbnl_bcn_attrs. We can find the beginning part of these two policies are "same". static const struct nla_policy dcbnl_pfc_up_nest[...] = { [DCB_PFC_UP_ATTR_0] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_1] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_2] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_3] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_4] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_5] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_6] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_7] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_ALL] = {.type = NLA_FLAG}, }; static const struct nla_policy dcbnl_bcn_nest[...] = { [DCB_BCN_ATTR_RP_0] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_1] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_2] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_3] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_4] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_5] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_6] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_7] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_ALL] = {.type = NLA_FLAG}, // from here is somewhat different [DCB_BCN_ATTR_BCNA_0] = {.type = NLA_U32}, ... [DCB_BCN_ATTR_ALL] = {.type = NLA_FLAG}, }; Therefore, the current code is buggy and this nla_parse_nested_deprecated could overflow the dcbnl_pfc_up_nest and use the adjacent nla_policy to parse attributes from DCB_BCN_ATTR_BCNA_0. Hence use the correct policy dcbnl_bcn_nest to parse the nested tb[DCB_ATTR_BCN] TLV. Fixes: 859ee3c43812 ("DCB: Add support for DCB BCN") Signed-off-by: Lin Ma <linma@zju.edu.cn> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20230801013248.87240-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-08-01Merge branch 'add-tja1120-support'Jakub Kicinski
Radu Pirea says: ==================== Add TJA1120 support This patch series got bigger than I expected. It cleans up the next-c45-tja11xx driver and adds support for the TJA1120(1000BaseT1 automotive phy). Master/slave custom implementation was replaced with the generic implementation (genphy_c45_config_aneg/genphy_c45_read_status). The TJA1120 and TJA1103 are a bit different when it comes to the PTP interface. The timestamp read procedure was changed, some addresses were changed and some bits were moved from one register to another. Adding TJA1120 support was tricky, and I tried not to duplicate the code. If something looks too hacky to you, I am open to suggestions. ==================== Link: https://lore.kernel.org/r/20230731091619.77961-1-radu-nicolae.pirea@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-08-01net: phy: nxp-c45-tja11xx: reset PCS if the link goes downRadu Pirea (NXP OSS)
During PTP testing on early TJA1120 engineering samples I observed that if the link is lost and recovered, the tx timestamps will be randomly lost. To avoid this HW issue, the PCS should be reset. Resetting the PCS will break the link and we should reset the PCS on LINK UP -> LINK DOWN transition, otherwise we will trigger and infinite loop of LINK UP -> LINK DOWN events. Signed-off-by: Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/20230731091619.77961-12-radu-nicolae.pirea@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>