Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 40d9018e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 

Pull networking fixes from David Miller:

 1) BPF tail call handling bug fixes from Daniel Borkmann.

 2) Fix allowance of too many rx queues in sfc driver, from Bert
    Kenward.

 3) Non-loopback ipv6 packets claiming src of ::1 should be dropped,
    from Florian Westphal.

 4) Statistics requests on KSZ9031 can crash, fix from Grygorii
    Strashko.

 5) TX ring handling fixes in mediatek driver, from Sean Wang.

 6) ip_ra_control can deadlock, fix lock acquisition ordering to fix,
    from Cong WANG.

 7) Fix use after free in ip_recv_error(), from Willem de Buijn.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  bpf: fix checking xdp_adjust_head on tail calls
  bpf: fix cb access in socket filter programs on tail calls
  ipv6: drop non loopback packets claiming to originate from ::1
  net: ethernet: mediatek: fix inconsistency of port number carried in TXD
  net: ethernet: mediatek: fix inconsistency between TXD and the used buffer
  net: phy: micrel: fix crash when statistic requested for KSZ9031 phy
  net: vrf: Fix setting NLM_F_EXCL flag when adding l3mdev rule
  net: thunderx: Fix set_max_bgx_per_node for 81xx rgx
  net-timestamp: avoid use-after-free in ip_recv_error
  ipv4: fix a deadlock in ip_ra_control
  sfc: limit the number of receive queues
parents fb5e2154 acf167f3

drivers/net/ethernet/cavium/thunder/thunder_bgx.c

+1 −0
Original line number Diff line number Diff line
@@ -134,6 +134,7 @@ static void set_max_bgx_per_node(struct pci_dev *pdev) 
	pci_read_config_word(pdev, PCI_SUBSYSTEM_ID, &sdevid);

	switch (sdevid) {

	case PCI_SUBSYS_DEVID_81XX_BGX:

	case PCI_SUBSYS_DEVID_81XX_RGX:

		max_bgx_per_node = MAX_BGX_PER_CN81XX;

		break;

	case PCI_SUBSYS_DEVID_83XX_BGX:

drivers/net/ethernet/cavium/thunder/thunder_bgx.h

+1 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 
/* Subsystem device IDs */

#define PCI_SUBSYS_DEVID_88XX_BGX		0xA126

#define PCI_SUBSYS_DEVID_81XX_BGX		0xA226

#define PCI_SUBSYS_DEVID_81XX_RGX		0xA254

#define PCI_SUBSYS_DEVID_83XX_BGX		0xA326



#define    MAX_BGX_THUNDER			8 /* Max 2 nodes, 4 per node */

drivers/net/ethernet/mediatek/mtk_eth_soc.c

+17 −14
Original line number Diff line number Diff line
@@ -613,7 +613,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev, 
	struct mtk_mac *mac = netdev_priv(dev);

	struct mtk_eth *eth = mac->hw;

	struct mtk_tx_dma *itxd, *txd;

	struct mtk_tx_buf *tx_buf;

	struct mtk_tx_buf *itx_buf, *tx_buf;

	dma_addr_t mapped_addr;

	unsigned int nr_frags;

	int i, n_desc = 1;
@@ -627,8 +627,8 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev, 
	fport = (mac->id + 1) << TX_DMA_FPORT_SHIFT;

	txd4 |= fport;



	tx_buf = mtk_desc_to_tx_buf(ring, itxd);

	memset(tx_buf, 0, sizeof(*tx_buf));

	itx_buf = mtk_desc_to_tx_buf(ring, itxd);

	memset(itx_buf, 0, sizeof(*itx_buf));



	if (gso)

		txd4 |= TX_DMA_TSO;
@@ -647,9 +647,11 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev, 
		return -ENOMEM;



	WRITE_ONCE(itxd->txd1, mapped_addr);

	tx_buf->flags |= MTK_TX_FLAGS_SINGLE0;

	dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);

	dma_unmap_len_set(tx_buf, dma_len0, skb_headlen(skb));

	itx_buf->flags |= MTK_TX_FLAGS_SINGLE0;

	itx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :

			  MTK_TX_FLAGS_FPORT1;

	dma_unmap_addr_set(itx_buf, dma_addr0, mapped_addr);

	dma_unmap_len_set(itx_buf, dma_len0, skb_headlen(skb));



	/* TX SG offload */

	txd = itxd;
@@ -685,11 +687,13 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev, 
					       last_frag * TX_DMA_LS0));

			WRITE_ONCE(txd->txd4, fport);



			tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;

			tx_buf = mtk_desc_to_tx_buf(ring, txd);

			memset(tx_buf, 0, sizeof(*tx_buf));



			tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;

			tx_buf->flags |= MTK_TX_FLAGS_PAGE0;

			tx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :

					 MTK_TX_FLAGS_FPORT1;



			dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);

			dma_unmap_len_set(tx_buf, dma_len0, frag_map_size);

			frag_size -= frag_map_size;
@@ -698,7 +702,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev, 
	}



	/* store skb to cleanup */

	tx_buf->skb = skb;

	itx_buf->skb = skb;



	WRITE_ONCE(itxd->txd4, txd4);

	WRITE_ONCE(itxd->txd3, (TX_DMA_SWC | TX_DMA_PLEN0(skb_headlen(skb)) |
@@ -1012,17 +1016,16 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget) 


	while ((cpu != dma) && budget) {

		u32 next_cpu = desc->txd2;

		int mac;

		int mac = 0;



		desc = mtk_qdma_phys_to_virt(ring, desc->txd2);

		if ((desc->txd3 & TX_DMA_OWNER_CPU) == 0)

			break;



		mac = (desc->txd4 >> TX_DMA_FPORT_SHIFT) &

		       TX_DMA_FPORT_MASK;

		mac--;



		tx_buf = mtk_desc_to_tx_buf(ring, desc);

		if (tx_buf->flags & MTK_TX_FLAGS_FPORT1)

			mac = 1;



		skb = tx_buf->skb;

		if (!skb) {

			condition = 1;

drivers/net/ethernet/mediatek/mtk_eth_soc.h

+9 −3
Original line number Diff line number Diff line
@@ -406,12 +406,18 @@ struct mtk_hw_stats { 
	struct u64_stats_sync	syncp;

};



/* PDMA descriptor can point at 1-2 segments. This enum allows us to track how

 * memory was allocated so that it can be freed properly

 */

enum mtk_tx_flags {

	/* PDMA descriptor can point at 1-2 segments. This enum allows us to

	 * track how memory was allocated so that it can be freed properly.

	 */

	MTK_TX_FLAGS_SINGLE0	= 0x01,

	MTK_TX_FLAGS_PAGE0	= 0x02,



	/* MTK_TX_FLAGS_FPORTx allows tracking which port the transmitted

	 * SKB out instead of looking up through hardware TX descriptor.

	 */

	MTK_TX_FLAGS_FPORT0	= 0x04,

	MTK_TX_FLAGS_FPORT1	= 0x08,

};



/* This enum allows us to identify how the clock is defined on the array of the

drivers/net/ethernet/sfc/efx.c

+7 −0
Original line number Diff line number Diff line
@@ -1371,6 +1371,13 @@ static unsigned int efx_wanted_parallelism(struct efx_nic *efx) 
		free_cpumask_var(thread_mask);

	}



	if (count > EFX_MAX_RX_QUEUES) {

		netif_cond_dbg(efx, probe, efx->net_dev, !rss_cpus, warn,

			       "Reducing number of rx queues from %u to %u.\n",

			       count, EFX_MAX_RX_QUEUES);

		count = EFX_MAX_RX_QUEUES;

	}



	/* If RSS is requested for the PF *and* VFs then we can't write RSS

	 * table entries that are inaccessible to VFs

	 */