pinctrl: meson: fix pull enable register calculation
Subsystems (17)
Sasha Levin
maintainerPATCH 1/59 pinctrl: meson: fix pull enable register calculation
From: Jerome Brunet <[email protected]>
[ Upstream commit 614b1868a125a0ba24be08f3a7fa832ddcde6bca ]
We just changed the code so we apply bias disable on the correct register but forgot to align the register calculation. The result is that we apply the change on the correct register, but possibly at the incorrect offset/bit
This went undetected because offsets tends to be the same between REG_PULL and REG_PULLEN for a given pin the EE controller. This is not true for the AO controller.
--- drivers/pinctrl/meson/pinctrl-meson.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pinctrl/meson/pinctrl-meson.c +2 -1
@@ -272,7 +272,8 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,case PIN_CONFIG_BIAS_DISABLE :dev_dbg (pc->dev,"pin %u: disable bias\n" , pin); -meson_calc_reg_and_bit (bank, pin,REG_PULL , ®, &bit); +meson_calc_reg_and_bit (bank, pin,REG_PULLEN , ®, + &bit); ret =regmap_update_bits (pc->reg_pullen, reg,BIT (bit),0 );if (ret)
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 2/59 powerpc: Fix COFF zImage booting on old powermacs
From: Paul Mackerras <[email protected]>
[ Upstream commit 5564597d51c8ff5b88d95c76255e18b13b760879 ]
Commit 6975a783d7b4 ("powerpc/boot: Allow building the zImage wrapper as a relocatable ET_DYN", 2011-04-12) changed the procedure descriptor at the start of crt0.S to have a hard-coded start address of 0x500000 rather than a reference to _zimage_start, presumably because having a reference to a symbol introduced a relocation which is awkward to handle in a position-independent executable. Unfortunately, what is at 0x500000 in the COFF image is not the first instruction, but the procedure descriptor itself, that is, a word containing 0x500000, which is not a valid instruction. Hence, booting a COFF zImage results in a "DEFAULT CATCH!, code=FFF00700" message from Open Firmware.
This fixes the problem by (a) putting the procedure descriptor in the data section and (b) adding a branch to _zimage_start as the first instruction in the program.
--- arch/powerpc/boot/crt0.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/boot/crt0.S +3 -1
@@ -15,7 +15,7 @@ RELA = 7 RELACOUNT = 0x6ffffff9 - .text + .data /* A procedure descriptor used when booting this as a COFF file. * When making COFF, this comes first in the link and we're * linked at 0x500000.
@@ -23,6 +23,8 @@ RELACOUNT = 0x6ffffff9 .globl _zimage_start_opd _zimage_start_opd: .long 0x500000, 0, 0, 0 + .text + b _zimage_start #ifdef __powerpc64__ .balign 8
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 3/59 powerpc/mm: Fix linux page tables build with some configs
In reply to Sasha LevinFrom: Michael Ellerman <[email protected]>
[ Upstream commit 462951cd32e1496dc64b00051dfb777efc8ae5d8 ]
For some configs the build fails with:
arch/powerpc/mm/dump_linuxpagetables.c: In function 'populate_markers':
arch/powerpc/mm/dump_linuxpagetables.c:306:39: error: 'PKMAP_BASE' undeclared (first use in this function) arch/powerpc/mm/dump_linuxpagetables.c:314:50: error: 'LAST_PKMAP' undeclared (first use in this function)
These come from highmem.h, including that fixes the build.
--- arch/powerpc/mm/dump_linuxpagetables.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/mm/dump_linuxpagetables.c +1 -0
@@ -19,6 +19,7 @@#include <linux/hugetlb.h> #include <linux/io.h> #include <linux/mm.h> +#include <linux/highmem.h> #include <linux/sched.h> #include <linux/seq_file.h> #include <asm/fixmap.h>
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 4/59 HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk
In reply to Sasha LevinFrom: Hans de Goede <[email protected]>
[ Upstream commit 4050207485e47e00353e87f2fe2166083e282688 ]
The 258a:6a88 keyboard-dock shipped with the Prowise PT301 tablet is likely another ITE based design. The controller die is directly bonded to the PCB with a blob of black glue on top so there are no markings and the 258a vendor-id used is unknown anywhere. But the keyboard has the exact same hotkeys mapped to Fn+F1 - F10 as the other ITE8595 keyboard I have *and* it has the same quirky behavior wrt the rfkill hotkey.
Either way as said this keyboard has the same quirk for its rfkill / airplane mode hotkey as the ITE 8595 chip, it only sends a single release event when pressed and released, it never sends a press event.
This commit adds the 258a:6a88 USB id to the hid-ite id-table, fixing the rfkill key not working on this keyboard.
--- drivers/hid/hid-ids.h | 3 +++ drivers/hid/hid-ite.c | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +3 -0
@@ -17,6 +17,9 @@#ifndef HID_IDS_H_FILE #define HID_IDS_H_FILE +#define USB_VENDOR_ID_258A 0x258a +#define USB_DEVICE_ID_258A_6A88 0x6a88 +#define USB_VENDOR_ID_3M 0x0596#define USB_DEVICE_ID_3M1968 0x0500#define USB_DEVICE_ID_3M2256 0x0502
drivers/hid/hid-ite.c +1 -0
@@ -42,6 +42,7 @@ static int ite_event(struct hid_device *hdev, struct hid_field *field,static const struct hid_device_id ite_devices[] = { {HID_USB_DEVICE (USB_VENDOR_ID_ITE ,USB_DEVICE_ID_ITE8595 ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_258A ,USB_DEVICE_ID_258A_6A88 ) }, { } };MODULE_DEVICE_TABLE (hid, ite_devices);
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 5/59 ARM: imx: update the cpu power up timing setting on i.mx6sx
In reply to Sasha LevinFrom: Anson Huang <[email protected]>
[ Upstream commit 1e434b703248580b7aaaf8a115d93e682f57d29f ]
The sw2iso count should cover ARM LDO ramp-up time, the MAX ARM LDO ramp-up time may be up to more than 100us on some boards, this patch sets sw2iso to 0xf (~384us) which is the reset value, and it is much more safe to cover different boards, since we have observed that some customer boards failed with current setting of 0x2.
--- arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-imx/cpuidle-imx6sx.c +1 -1
@@ -108,7 +108,7 @@ int __init imx6sx_cpuidle_init(void)* except for power up sw2iso which need to be * larger than LDO ramp up time. */ -imx_gpc_set_arm_power_up_timing (2 ,1 ); +imx_gpc_set_arm_power_up_timing (0xf ,1 );imx_gpc_set_arm_power_down_timing (1 ,1 );return cpuidle_register (&imx6sx_cpuidle_driver,NULL );
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 6/59 ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
In reply to Sasha LevinFrom: Fabio Estevam <[email protected]>
[ Upstream commit f15096f12a4e9340168df5fdd9201aa8ed60d59e ]
According to bindings/regulator/fixed-regulator.txt the 'clocks' and 'clock-names' properties are not valid ones.
In order to turn on the Wifi clock the correct location for describing the CLKO2 clock is via a mmc-pwrseq handle, so do it accordingly.
--- arch/arm/boot/dts/imx7d-nitrogen7.dts | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx7d-nitrogen7.dts +7 -2
@@ -117,13 +117,17 @@ compatible = "regulator-fixed"; regulator-min-microvolt = <3300000>; regulator-max-microvolt = <3300000>; - clocks = <&clks IMX7D_CLKO2_ROOT_DIV>; - clock-names = "slow"; regulator-name = "reg_wlan"; startup-delay-us = <70000>; gpio = <&gpio4 21 GPIO_ACTIVE_HIGH>; enable-active-high; }; + + usdhc2_pwrseq: usdhc2_pwrseq { + compatible = "mmc-pwrseq-simple"; + clocks = <&clks IMX7D_CLKO2_ROOT_DIV>; + clock-names = "ext_clock"; + }; }; &adc1 {
@@ -430,6 +434,7 @@ bus-width = <4>; non-removable; vmmc-supply = <®_wlan>; + mmc-pwrseq = <&usdhc2_pwrseq>; cap-power-off-card; keep-power-in-suspend; status = "okay";
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 7/59 Input: restore EV_ABS ABS_RESERVED
In reply to Sasha LevinFrom: Peter Hutterer <[email protected]>
[ Upstream commit c201e3808e0e4be9b98d192802085a9f491bd80c ]
ABS_RESERVED was added in d9ca1c990a7 and accidentally removed as part of ffe0e7cf290f5c9 when the high-resolution scrolling code was removed.
--- include/uapi/linux/input-event-codes.h | 9 +++++++++ 1 file changed, 9 insertions(+)
include/uapi/linux/input-event-codes.h +9 -0
@@ -742,6 +742,15 @@#define ABS_MISC 0x28 +/* +* 0x2e is reserved and should not be used in input drivers. +* It was used by HID as ABS_MISC+6 and userspace needs to detect if +* the next ABS_* event is correct or is just ABS_MISC + n. +* We define here ABS_RESERVED so userspace can rely on it and detect +* the situation described above. +*/ +#define ABS_RESERVED 0x2e +#define ABS_MT_SLOT 0x2f/* MT slot being modified */ #define ABS_MT_TOUCH_MAJOR 0x30/* Major axis of touching ellipse */ #define ABS_MT_TOUCH_MINOR 0x31/* Minor axis (omit if circular) */
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 8/59 checkstack.pl: fix for aarch64
In reply to Sasha LevinFrom: Qian Cai <[email protected]>
[ Upstream commit f1733a1d3cd32a9492f4cf866be37bb46e10163d ]
There is actually a space after "sp," like this,
ffff2000080813c8: a9bb7bfd stp x29, x30, [sp, #-80]!
Right now, checkstack.pl isn't able to print anything on aarch64, because it won't be able to match the stating objdump line of a function due to this missing space. Hence, it displays every stack as zero-size.
After this patch, checkpatch.pl is able to match the start of a function's objdump, and is then able to calculate each function's stack correctly.
--- scripts/checkstack.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/checkstack.pl +2 -2
@@ -46,8 +46,8 @@ my (@stack, $re, $dre, $x, $xs, $funcre); $xs = "[0-9a-f ]"; # hex character or space $funcre = qr/^$x* <(.*)>:$/; if ($arch eq 'aarch64') { - #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp,#-80]! - $re = qr/^.*stp.*sp,\#-([0-9]{1,8})\]\!/o; + #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]! + $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o; } elsif ($arch eq 'arm') { #c0008ffc: e24dd064 sub sp, sp, #100 ; 0x64 $re = qr/.*sub.*sp, sp, #(([0-9]{2}|[3-9])[0-9]{2})/o;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 9/59 xfrm: Fix error return code in xfrm_output_one()
In reply to Sasha LevinFrom: Wei Yongjun <[email protected]>
[ Upstream commit 533555e5cbb6aa2d77598917871ae5b579fe724b ]
xfrm_output_one() does not return a error code when there is no dst_entry attached to the skb, it is still possible crash with a NULL pointer dereference in xfrm_output_resume(). Fix it by return error code -EHOSTUNREACH.
--- net/xfrm/xfrm_output.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_output.c +1 -0
@@ -103,6 +103,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)skb_dst_force (skb);if (!skb_dst (skb)) {XFRM_INC_STATS (net,LINUX_MIB_XFRMOUTERROR ); + err = -EHOSTUNREACH ; goto error_nolock; }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 10/59 xfrm: Fix bucket count reported to userspace
In reply to Sasha LevinFrom: Benjamin Poirier <[email protected]>
[ Upstream commit ca92e173ab34a4f7fc4128bd372bd96f1af6f507 ]
sadhcnt is reported by ip -s xfrm state count as "buckets count", not the hash mask.
--- net/xfrm/xfrm_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_state.c +1 -1
@@ -789,7 +789,7 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si) {spin_lock_bh (&net->xfrm.xfrm_state_lock); si->sadcnt = net->xfrm.state_num; - si->sadhcnt = net->xfrm.state_hmask; + si->sadhcnt = net->xfrm.state_hmask +1 ; si->sadhmcnt = xfrm_state_hashmax;spin_unlock_bh (&net->xfrm.xfrm_state_lock); }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 11/59 xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.
In reply to Sasha LevinFrom: Steffen Klassert <[email protected]>
[ Upstream commit 0152eee6fc3b84298bb6a79961961734e8afa5b8 ]
Since commit 222d7dbd258d ("net: prevent dst uses after free") skb_dst_force() might clear the dst_entry attached to the skb. The xfrm code doesn't expect this to happen, so we crash with a NULL pointer dereference in this case.
Fix it by checking skb_dst(skb) for NULL after skb_dst_force() and drop the packet in case the dst_entry was cleared. We also move the skb_dst_force() to a codepath that is not used when the transformation was offloaded, because in this case we don't have a dst_entry attached to the skb.
The output and forwarding path was already fixed by commit 9e1437937807 ("xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.")
--- net/xfrm/xfrm_input.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/xfrm/xfrm_input.c +6 -1
@@ -341,6 +341,12 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) skb->sp->xvec[skb->sp->len++] = x; +skb_dst_force (skb); +if (!skb_dst (skb)) { +XFRM_INC_STATS (net,LINUX_MIB_XFRMINERROR ); + goto drop; + } + lock:spin_lock (&x->lock);
@@ -380,7 +386,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)XFRM_SKB_CB (skb)->seq.input.low = seq;XFRM_SKB_CB (skb)->seq.input.hi = seq_hi; -skb_dst_force (skb);dev_hold (skb->dev);if (crypto_done)
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 12/59 netfilter: seqadj: re-load tcp header pointer after possible head reallocation
In reply to Sasha LevinFrom: Florian Westphal <[email protected]>
[ Upstream commit 530aad77010b81526586dfc09130ec875cd084e4 ]
When adjusting sack block sequence numbers, skb_make_writable() gets called to make sure tcp options are all in the linear area, and buffer is not shared.
This can cause tcp header pointer to get reallocated, so we must reaload it to avoid memory corruption.
This bug pre-dates git history.
--- net/netfilter/nf_conntrack_seqadj.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/netfilter/nf_conntrack_seqadj.c +4 -3
@@ -115,12 +115,12 @@ static void nf_ct_sack_block_adjust(struct sk_buff *skb,/* TCP SACK sequence number adjustment */ static unsigned int nf_ct_sack_adjust (struct sk_buff *skb,unsigned int protoff, -struct tcphdr *tcph,struct nf_conn *ct,enum ip_conntrack_info ctinfo) { -unsigned int dir, optoff, optend; +struct tcphdr *tcph = (void *)skb->data + protoff;struct nf_conn_seqadj *seqadj =nfct_seqadj (ct); +unsigned int dir, optoff, optend; optoff = protoff +sizeof (struct tcphdr ); optend = protoff + tcph->doff *4 ;
@@ -128,6 +128,7 @@ static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,if (!skb_make_writable (skb, optend))return 0 ; + tcph = (void *)skb->data + protoff; dir =CTINFO2DIR (ctinfo);while (optoff < optend) {
@@ -207,7 +208,7 @@ int nf_ct_seq_adjust(struct sk_buff *skb, ntohl(newack)); tcph->ack_seq = newack; - res =nf_ct_sack_adjust (skb, protoff, tcph, ct, ctinfo); + res =nf_ct_sack_adjust (skb, protoff, ct, ctinfo); out:spin_unlock_bh (&ct->lock);
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 13/59 scsi: bnx2fc: Fix NULL dereference in error handling
In reply to Sasha LevinFrom: Dan Carpenter <[email protected]>
[ Upstream commit 9ae4f8420ed7be4b13c96600e3568c144d101a23 ]
If "interface" is NULL then we can't release it and trying to will only lead to an Oops.
--- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/bnx2fc/bnx2fc_fcoe.c +1 -1
@@ -2372,7 +2372,7 @@ static int _bnx2fc_create(struct net_device *netdev,if (!interface) { printk(KERN_ERR PFX "bnx2fc_interface_create failed\n"); rc = -ENOMEM ; - goto ifput_err; + goto netdev_err; }if (is_vlan_dev (netdev)) {
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 14/59 Input: omap-keypad - fix idle configuration to not block SoC idle states
In reply to Sasha LevinFrom: Tony Lindgren <[email protected]>
[ Upstream commit e2ca26ec4f01486661b55b03597c13e2b9c18b73 ]
With PM enabled, I noticed that pressing a key on the droid4 keyboard will block deeper idle states for the SoC. Let's fix this by using IRQF_ONESHOT and stop constantly toggling the device OMAP4_KBD_IRQENABLE register as suggested by Dmitry Torokhov <[email protected]>.
Quoted 1 line
From the hardware point of view, looks like we need to manage the registers
for OMAP4_KBD_IRQENABLE and OMAP4_KBD_WAKEUPENABLE together to avoid blocking deeper SoC idle states. And with toggling of OMAP4_KBD_IRQENABLE register now gone with IRQF_ONESHOT, also the SoC idle state problem is gone during runtime. We still also need to clear OMAP4_KBD_WAKEUPENABLE in omap4_keypad_close() though to pair it with omap4_keypad_open() to prevent blocking deeper SoC idle states after rmmod omap4-keypad.
--- drivers/input/keyboard/omap4-keypad.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/input/keyboard/omap4-keypad.c +4 -12
@@ -126,12 +126,8 @@ static irqreturn_t omap4_keypad_irq_handler(int irq, void *dev_id) {struct omap4_keypad *keypad_data = dev_id; -if (kbd_read_irqreg (keypad_data,OMAP4_KBD_IRQSTATUS )) { -/* Disable interrupts */ -kbd_write_irqreg (keypad_data,OMAP4_KBD_IRQENABLE , -OMAP4_VAL_IRQDISABLE ); +if (kbd_read_irqreg (keypad_data,OMAP4_KBD_IRQSTATUS ))return IRQ_WAKE_THREAD ; - }return IRQ_NONE ; }
@@ -173,11 +169,6 @@ static irqreturn_t omap4_keypad_irq_thread_fn(int irq, void *dev_id)kbd_write_irqreg (keypad_data,OMAP4_KBD_IRQSTATUS ,kbd_read_irqreg (keypad_data,OMAP4_KBD_IRQSTATUS )); -/* enable interrupts */ -kbd_write_irqreg (keypad_data,OMAP4_KBD_IRQENABLE , -OMAP4_DEF_IRQENABLE_EVENTEN | -OMAP4_DEF_IRQENABLE_LONGKEY ); -return IRQ_HANDLED ; }
@@ -214,9 +205,10 @@ static void omap4_keypad_close(struct input_dev *input)disable_irq (keypad_data->irq); -/* Disable interrupts */ +/* Disable interrupts and wake-up events */ kbd_write_irqreg (keypad_data,OMAP4_KBD_IRQENABLE ,OMAP4_VAL_IRQDISABLE ); +kbd_writel (keypad_data,OMAP4_KBD_WAKEUPENABLE ,0 );/* clear pending interrupts */ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
@@ -364,7 +356,7 @@ static int omap4_keypad_probe(struct platform_device *pdev) } error =request_threaded_irq (keypad_data->irq, omap4_keypad_irq_handler, - omap4_keypad_irq_thread_fn,0 , + omap4_keypad_irq_thread_fn,IRQF_ONESHOT ,"omap4-keypad" , keypad_data);if (error) {dev_err (&pdev->dev,"failed to register interrupt\n" );
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 15/59 Input: synaptics - enable RMI on ThinkPad T560
In reply to Sasha LevinFrom: Yussuf Khalil <[email protected]>
[ Upstream commit ca5047286c9c93a01e1f471d00a6019536992954 ]
Before commit 7fd6d98b89f3 ("i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus"), enabling RMI on the T560 would cause the touchpad to stop working after resuming from suspend. Now that this issue is fixed, RMI can be enabled safely and works fine.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -171,6 +171,7 @@ static const char * const smbus_pnp_ids[] = {"LEN0046" ,/* X250 */ "LEN004a" ,/* W541 */ "LEN005b" ,/* P50 */ +"LEN005e" ,/* T560 */ "LEN0071" ,/* T480 */ "LEN0072" ,/* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */ "LEN0073", /* X1 Carbon G5 (Elantech) */
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 16/59 ibmvnic: Fix non-atomic memory allocation in IRQ context
In reply to Sasha LevinFrom: Thomas Falcon <[email protected]>
[ Upstream commit 1d1bbc37f89b0559c9e913682f2489d89cfde6b8 ]
ibmvnic_reset allocated new reset work item objects in a non-atomic context. This can be called from a tasklet, generating the output below. Allocate work items with the GFP_ATOMIC flag instead.
BUG: sleeping function called from invalid context at mm/slab.h:421 in_atomic(): 1, irqs_disabled(): 1, pid: 93, name: kworker/0:2 INFO: lockdep is turned off. irq event stamp: 66049 hardirqs last enabled at (66048): [<c000000000122468>] tasklet_action_common.isra.12+0x78/0x1c0 hardirqs last disabled at (66049): [<c000000000befce8>] _raw_spin_lock_irqsave+0x48/0xf0 softirqs last enabled at (66044): [<c000000000a8ac78>] dev_deactivate_queue.constprop.28+0xc8/0x160 softirqs last disabled at (66045): [<c0000000000306e0>] call_do_softirq+0x14/0x24 CPU: 0 PID: 93 Comm: kworker/0:2 Kdump: loaded Not tainted 4.20.0-rc6-00001-g1b50a8f03706 #7 Workqueue: events linkwatch_event Call Trace: [c0000003fffe7ae0] [c000000000bc83e4] dump_stack+0xe8/0x164 (unreliable) [c0000003fffe7b30] [c00000000015ba0c] ___might_sleep+0x2dc/0x320 [c0000003fffe7bb0] [c000000000391514] kmem_cache_alloc_trace+0x3e4/0x440 [c0000003fffe7c30] [d000000005b2309c] ibmvnic_reset+0x16c/0x360 [ibmvnic] [c0000003fffe7cc0] [d000000005b29834] ibmvnic_tasklet+0x1054/0x2010 [ibmvnic] [c0000003fffe7e00] [c0000000001224c8] tasklet_action_common.isra.12+0xd8/0x1c0 [c0000003fffe7e60] [c000000000bf1238] __do_softirq+0x1a8/0x64c [c0000003fffe7f90] [c0000000000306e0] call_do_softirq+0x14/0x24 [c0000003f3967980] [c00000000001ba50] do_softirq_own_stack+0x60/0xb0 [c0000003f39679c0] [c0000000001218a8] do_softirq+0xa8/0x100 [c0000003f39679f0] [c000000000121a74] __local_bh_enable_ip+0x174/0x180 [c0000003f3967a60] [c000000000bf003c] _raw_spin_unlock_bh+0x5c/0x80 [c0000003f3967a90] [c000000000a8ac78] dev_deactivate_queue.constprop.28+0xc8/0x160 [c0000003f3967ad0] [c000000000a8c8b0] dev_deactivate_many+0xd0/0x520 [c0000003f3967b70] [c000000000a8cd40] dev_deactivate+0x40/0x60 [c0000003f3967ba0] [c000000000a5e0c4] linkwatch_do_dev+0x74/0xd0 [c0000003f3967bd0] [c000000000a5e694] __linkwatch_run_queue+0x1a4/0x1f0 [c0000003f3967c30] [c000000000a5e728] linkwatch_event+0x48/0x60 [c0000003f3967c50] [c0000000001444e8] process_one_work+0x238/0x710 [c0000003f3967d20] [c000000000144a48] worker_thread+0x88/0x4e0 [c0000003f3967db0] [c00000000014e3a8] kthread+0x178/0x1c0 [c0000003f3967e20] [c00000000000bfd0] ret_from_kernel_thread+0x5c/0x6c
--- drivers/net/ethernet/ibm/ibmvnic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/ibm/ibmvnic.c +1 -1
@@ -1596,7 +1596,7 @@ static void ibmvnic_reset(struct ibmvnic_adapter *adapter, } } - rwi =kzalloc (sizeof (*rwi),GFP_KERNEL ); + rwi =kzalloc (sizeof (*rwi),GFP_ATOMIC );if (!rwi) {mutex_unlock (&adapter->rwi_lock);ibmvnic_close (netdev);
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 17/59 ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done
In reply to Sasha LevinFrom: YueHaibing <[email protected]>
[ Upstream commit 8e41cae64b08fe2e86a9ffb88b295c6b4b3a3322 ]
gcc warning this:
drivers/net/ieee802154/ca8210.c:730:10: warning:
comparison is always false due to limited range of data type [-Wtype-limits]
'len' is u8 type, we get it from buf[1] adding 2, which can overflow. This patch change the type of 'len' to unsigned int to avoid this,also fix the gcc warning.
--- drivers/net/ieee802154/ca8210.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ieee802154/ca8210.c +2 -2
@@ -722,7 +722,7 @@ static void ca8210_mlme_reset_worker(struct work_struct *work)static void ca8210_rx_done (struct cas_control *cas_ctl) {u8 *buf; -u8 len; +unsigned int len;struct work_priv_container *mlme_reset_wpc;struct ca8210_priv *priv = cas_ctl->priv;
@@ -731,7 +731,7 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)if (len >CA8210_SPI_BUF_SIZE ) {dev_crit ( &priv->spi->dev, -"Received packet len (%d) erroneously long\n" , +"Received packet len (%u) erroneously long\n" , len ); goto finish;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 18/59 x86/mm: Fix guard hole handling
In reply to Sasha LevinFrom: "Kirill A. Shutemov" <[email protected]>
[ Upstream commit 16877a5570e0c5f4270d5b17f9bab427bcae9514 ]
There is a guard hole at the beginning of the kernel address space, also used by hypervisors. It occupies 16 PGD entries.
This reserved range is not defined explicitely, it is calculated relative to other entities: direct mapping and user space ranges.
The calculation got broken by recent changes of the kernel memory layout:
LDT remap range is now mapped before direct mapping and makes the calculation invalid.
The breakage leads to crash on Xen dom0 boot[1].
Define the reserved range explicitely. It's part of kernel ABI (hypervisors expect it to be stable) and must not depend on changes in the rest of kernel memory layout.
[1] https://lists.xenproject.org/archives/html/xen-devel/2018-11/msg03313.html
--- arch/x86/include/asm/pgtable_64_types.h | 5 +++++ arch/x86/mm/dump_pagetables.c | 8 ++++---- arch/x86/xen/mmu_pv.c | 11 ++++++----- 3 files changed, 15 insertions(+), 9 deletions(-)
arch/x86/include/asm/pgtable_64_types.h +5 -0
@@ -94,6 +94,11 @@ typedef struct { pteval_t pte; } pte_t;# define __VMEMMAP_BASE _AC(0xffffea0000000000, UL)#endif +#define GUARD_HOLE_PGD_ENTRY -256UL +#define GUARD_HOLE_SIZE (16UL << PGDIR_SHIFT) +#define GUARD_HOLE_BASE_ADDR (GUARD_HOLE_PGD_ENTRY << PGDIR_SHIFT) +#define GUARD_HOLE_END_ADDR (GUARD_HOLE_BASE_ADDR + GUARD_HOLE_SIZE) +#define LDT_PGD_ENTRY -240UL#define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT)
arch/x86/mm/dump_pagetables.c +4 -4
@@ -465,11 +465,11 @@ static inline bool is_hypervisor_range(int idx) {#ifdef CONFIG_X86_64 /* -* ffff800000000000 - ffff87ffffffffff is reserved for -* the hypervisor. +* A hole in the beginning of kernel address space reserved +* for a hypervisor. */ -return (idx >=pgd_index (__PAGE_OFFSET) -16 ) && - (idx <pgd_index (__PAGE_OFFSET)); +return (idx >=pgd_index (GUARD_HOLE_BASE_ADDR )) && + (idx <pgd_index (GUARD_HOLE_END_ADDR ));#else return false;#endif
arch/x86/xen/mmu_pv.c +6 -5
@@ -614,19 +614,20 @@ static int __xen_pgd_walk(struct mm_struct *mm, pgd_t *pgd, unsigned long limit) {int i, nr, flush =0 ; -unsigned hole_low, hole_high; +unsigned hole_low =0 , hole_high =0 ;/* The limit is the last byte to be touched */ limit--;BUG_ON (limit >=FIXADDR_TOP ); +#ifdef CONFIG_X86_64 /* * 64-bit has a great big hole in the middle of the address -* space, which contains the Xen mappings. On 32-bit these -* will end up making a zero-sized hole and so is a no-op. +* space, which contains the Xen mappings. */ - hole_low =pgd_index (USER_LIMIT ); - hole_high =pgd_index (PAGE_OFFSET ); + hole_low =pgd_index (GUARD_HOLE_BASE_ADDR ); + hole_high =pgd_index (GUARD_HOLE_END_ADDR ); +#endif nr =pgd_index (limit) +1 ;for (i =0 ; i < nr; i++) {
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 18/59 x86/mm: Fix guard hole handling
In reply to Sasha LevinFrom: "Kirill A. Shutemov" <[email protected]>
[ Upstream commit 16877a5570e0c5f4270d5b17f9bab427bcae9514 ]
There is a guard hole at the beginning of the kernel address space, also used by hypervisors. It occupies 16 PGD entries.
This reserved range is not defined explicitely, it is calculated relative to other entities: direct mapping and user space ranges.
The calculation got broken by recent changes of the kernel memory layout:
LDT remap range is now mapped before direct mapping and makes the calculation invalid.
The breakage leads to crash on Xen dom0 boot[1].
Define the reserved range explicitely. It's part of kernel ABI (hypervisors expect it to be stable) and must not depend on changes in the rest of kernel memory layout.
[1] https://lists.xenproject.org/archives/html/xen-devel/2018-11/msg03313.html
--- arch/x86/include/asm/pgtable_64_types.h | 5 +++++ arch/x86/mm/dump_pagetables.c | 8 ++++---- arch/x86/xen/mmu_pv.c | 11 ++++++----- 3 files changed, 15 insertions(+), 9 deletions(-)
arch/x86/include/asm/pgtable_64_types.h +5 -0
@@ -94,6 +94,11 @@ typedef struct { pteval_t pte; } pte_t;# define __VMEMMAP_BASE _AC(0xffffea0000000000, UL)#endif +#define GUARD_HOLE_PGD_ENTRY -256UL +#define GUARD_HOLE_SIZE (16UL << PGDIR_SHIFT) +#define GUARD_HOLE_BASE_ADDR (GUARD_HOLE_PGD_ENTRY << PGDIR_SHIFT) +#define GUARD_HOLE_END_ADDR (GUARD_HOLE_BASE_ADDR + GUARD_HOLE_SIZE) +#define LDT_PGD_ENTRY -240UL#define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT)
arch/x86/mm/dump_pagetables.c +4 -4
@@ -465,11 +465,11 @@ static inline bool is_hypervisor_range(int idx) {#ifdef CONFIG_X86_64 /* -* ffff800000000000 - ffff87ffffffffff is reserved for -* the hypervisor. +* A hole in the beginning of kernel address space reserved +* for a hypervisor. */ -return (idx >=pgd_index (__PAGE_OFFSET) -16 ) && - (idx <pgd_index (__PAGE_OFFSET)); +return (idx >=pgd_index (GUARD_HOLE_BASE_ADDR )) && + (idx <pgd_index (GUARD_HOLE_END_ADDR ));#else return false;#endif
arch/x86/xen/mmu_pv.c +6 -5
@@ -614,19 +614,20 @@ static int __xen_pgd_walk(struct mm_struct *mm, pgd_t *pgd, unsigned long limit) {int i, nr, flush =0 ; -unsigned hole_low, hole_high; +unsigned hole_low =0 , hole_high =0 ;/* The limit is the last byte to be touched */ limit--;BUG_ON (limit >=FIXADDR_TOP ); +#ifdef CONFIG_X86_64 /* * 64-bit has a great big hole in the middle of the address -* space, which contains the Xen mappings. On 32-bit these -* will end up making a zero-sized hole and so is a no-op. +* space, which contains the Xen mappings. */ - hole_low =pgd_index (USER_LIMIT ); - hole_high =pgd_index (PAGE_OFFSET ); + hole_low =pgd_index (GUARD_HOLE_BASE_ADDR ); + hole_high =pgd_index (GUARD_HOLE_END_ADDR ); +#endif nr =pgd_index (limit) +1 ;for (i =0 ; i < nr; i++) {
Signature · 7 lines
2.19.1 _______________________________________________ Xen-devel mailing list [email protected] https://lists.xenproject.org/mailman/listinfo/xen-devel
Sasha Levin
maintainerPATCH 19/59 x86/dump_pagetables: Fix LDT remap address marker
In reply to Sasha LevinFrom: "Kirill A. Shutemov" <[email protected]>
[ Upstream commit 254eb5505ca0ca749d3a491fc6668b6c16647a99 ]
The LDT remap placement has been changed. It's now placed before the direct mapping in the kernel virtual address space for both paging modes.
Change address markers order accordingly.
--- arch/x86/mm/dump_pagetables.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
arch/x86/mm/dump_pagetables.c +2 -5
@@ -51,10 +51,10 @@ struct addr_marker {enum address_markers_idx {USER_SPACE_NR =0 ,KERNEL_SPACE_NR , -LOW_KERNEL_NR , -#if defined(CONFIG_MODIFY_LDT_SYSCALL ) && defined(CONFIG_X86_5LEVEL ) +#ifdef CONFIG_MODIFY_LDT_SYSCALL LDT_NR ,#endif +LOW_KERNEL_NR ,VMALLOC_START_NR ,VMEMMAP_START_NR ,#ifdef CONFIG_KASAN
@@ -62,9 +62,6 @@ enum address_markers_idx { KASAN_SHADOW_END_NR, #endif CPU_ENTRY_AREA_NR, -#if defined(CONFIG_MODIFY_LDT_SYSCALL ) && !defined(CONFIG_X86_5LEVEL ) - LDT_NR, -#endif #ifdef CONFIG_X86_ESPFIX64 ESPFIX_START_NR,#endif
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 20/59 i40e: fix mac filter delete when setting mac address
In reply to Sasha LevinFrom: Stefan Assmann <[email protected]>
[ Upstream commit 158daed16efb1170694e420ae06ba8ba954d82e5 ]
A previous commit moved the ether_addr_copy() in i40e_set_mac() before the mac filter del/add to avoid a race. However it wasn't taken into account that this alters the mac address being handed to i40e_del_mac_filter().
Also changed i40e_add_mac_filter() to operate on netdev->dev_addr, hopefully that makes the code easier to read.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +7 -7
@@ -1554,17 +1554,17 @@ static int i40e_set_mac(struct net_device *netdev, void *p)netdev_info (netdev,"set new mac address %pM\n" , addr->sa_data);/* Copy the address first, so that we avoid a possible race with -* .set_rx_mode(). If we copy after changing the address in the filter -* list, we might open ourselves to a narrow race window where -* .set_rx_mode could delete our dev_addr filter and prevent traffic -* from passing. +* .set_rx_mode(). +* - Remove old address from MAC filter +* - Copy new address +* - Add new address to MAC filter */ -ether_addr_copy (netdev->dev_addr, addr->sa_data); -spin_lock_bh (&vsi->mac_filter_hash_lock);i40e_del_mac_filter (vsi, netdev->dev_addr); -i40e_add_mac_filter (vsi, addr->sa_data); +ether_addr_copy (netdev->dev_addr, addr->sa_data); +i40e_add_mac_filter (vsi, netdev->dev_addr);spin_unlock_bh (&vsi->mac_filter_hash_lock); +if (vsi->type ==I40E_VSI_MAIN ) {i40e_status ret;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 21/59 USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
In reply to Sasha LevinFrom: Hui Peng <[email protected]>
[ Upstream commit 5146f95df782b0ac61abde36567e718692725c89 ]
The function hso_probe reads if_num from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data.
Add a length check for both locations and updated hso_probe to bail on error.
This issue has been assigned CVE-2018-19985.
--- drivers/net/usb/hso.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/net/usb/hso.c +16 -2
@@ -2806,6 +2806,12 @@ static int hso_get_config_data(struct usb_interface *interface)return -EIO ; } +/* check if we have a valid interface */ +if (if_num >16 ) { +kfree (config_data); +return -EINVAL ; + } +switch (config_data[if_num]) {case 0x0 : result =0 ;
@@ -2876,10 +2882,18 @@ static int hso_probe(struct usb_interface *interface,/* Get the interface/port specification from either driver_info or from * the device itself */ -if (id->driver_info) +if (id->driver_info) { +/* if_num is controlled by the device, driver_info is a 0 terminated +* array. Make sure, the access is in bounds! */ +for (i =0 ; i <= if_num; ++i) +if (((u32 *)(id->driver_info))[i] ==0 ) + goto exit; port_spec = ((u32 *)(id->driver_info))[if_num]; -else + }else { port_spec =hso_get_config_data (interface); +if (port_spec <0 ) + goto exit; + }/* Check if we need to switch to alt interfaces prior to port * configuration */
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 22/59 netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
In reply to Sasha LevinFrom: Pan Bian <[email protected]>
[ Upstream commit 708abf74dd87f8640871b814faa195fb5970b0e3 ]
In the error handling block, nla_nest_cancel(skb, atd) is called to cancel the nest operation. But then, ipset_nest_end(skb, atd) is unexpected called to end the nest operation. This patch calls the ipset_nest_end only on the branch that nla_nest_cancel is not called.
--- net/netfilter/ipset/ip_set_list_set.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/ipset/ip_set_list_set.c +1 -1
@@ -542,8 +542,8 @@ list_set_list(const struct ip_set *set, ret = -EMSGSIZE ; }else { cb->args[IPSET_CB_ARG0 ] = i; +ipset_nest_end (skb, atd); } -ipset_nest_end (skb, atd); out:rcu_read_unlock ();return ret;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 23/59 netfilter: nat: can't use dst_hold on noref dst
In reply to Sasha LevinFrom: Florian Westphal <[email protected]>
[ Upstream commit 542fbda0f08f1cbbc250f9e59f7537649651d0c8 ]
The dst entry might already have a zero refcount, waiting on rcu list to be free'd. Using dst_hold() transitions its reference count to 1, and next dst release will try to free it again -- resulting in a double free:
WARNING: CPU: 1 PID: 0 at include/net/dst.h:239 nf_xfrm_me_harder+0xe7/0x130 [nf_nat] RIP: 0010:nf_xfrm_me_harder+0xe7/0x130 [nf_nat] Code: 48 8b 5c 24 60 65 48 33 1c 25 28 00 00 00 75 53 48 83 c4 68 5b 5d 41 5c c3 85 c0 74 0d 8d 48 01 f0 0f b1 0a 74 86 85 c0 75 f3 <0f> 0b e9 7b ff ff ff 29 c6 31 d2 b9 20 00 48 00 4c 89 e7 e8 31 27 Call Trace: nf_nat_ipv4_out+0x78/0x90 [nf_nat_ipv4] nf_hook_slow+0x36/0xd0 ip_output+0x9f/0xd0 ip_forward+0x328/0x440 ip_rcv+0x8a/0xb0
Use dst_hold_safe instead and bail out if we cannot take a reference.
--- net/netfilter/nf_nat_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_nat_core.c +2 -1
@@ -97,7 +97,8 @@ int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family) dst =skb_dst (skb);if (dst->xfrm) dst = ((struct xfrm_dst *)dst)->route; -dst_hold (dst); +if (!dst_hold_safe (dst)) +return -EHOSTUNREACH ; dst =xfrm_lookup (net, dst, &fl, skb->sk,0 );if (IS_ERR (dst))
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 24/59 bnx2x: Clear fip MAC when fcoe offload support is disabled
In reply to Sasha LevinFrom: Sudarsana Reddy Kalluru <[email protected]>
[ Upstream commit bbf666c1af916ed74795493c564df6fad462cc80 ]
On some customer setups it was observed that shmem contains a non-zero fip MAC for 57711 which would lead to enabling of SW FCoE.
Add a software workaround to clear the bad fip mac address if no FCoE connections are supported.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +3 -1
@@ -11733,8 +11733,10 @@ static void bnx2x_get_fcoe_info(struct bnx2x *bp)* If maximum allowed number of connections is zero - * disable the feature. */ -if (!bp->cnic_eth_dev.max_fcoe_conn) +if (!bp->cnic_eth_dev.max_fcoe_conn) { bp->flags |=NO_FCOE_FLAG ; +eth_zero_addr (bp->fip_mac); + } }static void bnx2x_get_cnic_info (struct bnx2x *bp)
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 25/59 bnx2x: Remove configured vlans as part of unload sequence.
In reply to Sasha LevinFrom: Sudarsana Reddy Kalluru <[email protected]>
[ Upstream commit 04f05230c5c13b1384f66f5186a68d7499e34622 ]
Vlans are not getting removed when drivers are unloaded. The recent storm firmware versions had added safeguards against re-configuring an already configured vlan. As a result, PF inner reload flows (e.g., mtu change) might trigger an assertion.
This change is going to remove vlans (same as we do for MACs) when doing a chip cleanup during unload.
--- .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 34 +++++++++++++++---- .../net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 4 ++- 2 files changed, 30 insertions(+), 8 deletions(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +27 -7
@@ -8462,6 +8462,7 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,/* Fill a user request section if needed */ if (!test_bit (RAMROD_CONT , ramrod_flags)) { ramrod_param.user_req.u.vlan.vlan = vlan; +__set_bit (BNX2X_VLAN , &ramrod_param.user_req.vlan_mac_flags);/* Set the command: ADD or DEL */ if (set) ramrod_param.user_req.cmd =BNX2X_VLAN_MAC_ADD ;
@@ -8482,6 +8483,27 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,return rc; } +static int bnx2x_del_all_vlans (struct bnx2x *bp) +{ +struct bnx2x_vlan_mac_obj *vlan_obj = &bp->sp_objs[0 ].vlan_obj; +unsigned long ramrod_flags =0 , vlan_flags =0 ; +struct bnx2x_vlan_entry *vlan; +int rc; + +__set_bit (RAMROD_COMP_WAIT , &ramrod_flags); +__set_bit (BNX2X_VLAN , &vlan_flags); + rc = vlan_obj->delete_all (bp, vlan_obj, &vlan_flags, &ramrod_flags); +if (rc) +return rc; + +/* Mark that hw forgot all entries */ +list_for_each_entry (vlan, &bp->vlan_reg, link) + vlan->hw = false; + bp->vlan_cnt =0 ; + +return 0 ; +} +int bnx2x_del_all_macs (struct bnx2x *bp,struct bnx2x_vlan_mac_obj *mac_obj,int mac_type,bool wait_for_comp)
@@ -9320,6 +9342,11 @@ void bnx2x_chip_cleanup(struct bnx2x *bp, int unload_mode, bool keep_link)BNX2X_ERR ("Failed to schedule DEL commands for UC MACs list: %d\n" , rc); +/* Remove all currently configured VLANs */ + rc =bnx2x_del_all_vlans (bp); +if (rc <0 ) +BNX2X_ERR ("Failed to delete all VLANs\n" ); +/* Disable LLH */ if (!CHIP_IS_E1 (bp))REG_WR (bp,NIG_REG_LLH0_FUNC_EN + port*8 ,0 );
@@ -13006,13 +13033,6 @@ static void bnx2x_vlan_configure(struct bnx2x *bp, bool set_rx_mode)int bnx2x_vlan_reconfigure_vid (struct bnx2x *bp) { -struct bnx2x_vlan_entry *vlan; - -/* The hw forgot all entries after reload */ -list_for_each_entry (vlan, &bp->vlan_reg, link) - vlan->hw = false; - bp->vlan_cnt =0 ; -/* Don't set rx mode here. Our caller will do it. */ bnx2x_vlan_configure (bp, false);
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h +3 -1
@@ -265,6 +265,7 @@ enum {BNX2X_ETH_MAC ,BNX2X_ISCSI_ETH_MAC ,BNX2X_NETQ_ETH_MAC , +BNX2X_VLAN ,BNX2X_DONT_CONSUME_CAM_CREDIT , BNX2X_DONT_CONSUME_CAM_CREDIT_DEST, };
@@ -272,7 +273,8 @@ enum {#define BNX2X_VLAN_MAC_CMP_MASK (1 << BNX2X_UC_LIST_MAC | \ 1 << BNX2X_ETH_MAC | \ 1 << BNX2X_ISCSI_ETH_MAC | \ - 1 << BNX2X_NETQ_ETH_MAC) + 1 << BNX2X_NETQ_ETH_MAC | \ + 1 << BNX2X_VLAN)#define BNX2X_VLAN_MAC_CMP_FLAGS (flags) \ ((flags) & BNX2X_VLAN_MAC_CMP_MASK)
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 26/59 bnx2x: Send update-svid ramrod with retry/poll flags enabled
In reply to Sasha LevinFrom: Sudarsana Reddy Kalluru <[email protected]>
[ Upstream commit 9061193c4ee065d3240fde06767c2e06ec61decc ]
Driver sends update-SVID ramrod in the MFW notification path. If there is a pending ramrod, driver doesn't retry the command and storm firmware will never be updated with the SVID value. The patch adds changes to send update-svid ramrod in process context with retry/poll flags set.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +1 -0
@@ -1278,6 +1278,7 @@ enum sp_rtnl_flag {BNX2X_SP_RTNL_TX_STOP ,BNX2X_SP_RTNL_GET_DRV_VERSION ,BNX2X_SP_RTNL_CHANGE_UDP_PORT , + BNX2X_SP_RTNL_UPDATE_SVID, }; enum bnx2x_iov_flag {
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +9 -1
@@ -2925,6 +2925,10 @@ static void bnx2x_handle_update_svid_cmd(struct bnx2x *bp) func_params.f_obj = &bp->func_obj; func_params.cmd =BNX2X_F_CMD_SWITCH_UPDATE ; +/* Prepare parameters for function state transitions */ +__set_bit (RAMROD_COMP_WAIT , &func_params.ramrod_flags); +__set_bit (RAMROD_RETRY , &func_params.ramrod_flags); +if (IS_MF_UFP (bp) ||IS_MF_BD (bp)) {int func =BP_ABS_FUNC (bp);u32 val;
@@ -4301,7 +4305,8 @@ static void bnx2x_attn_int_deasserted3(struct bnx2x *bp, u32 attn)bnx2x_handle_eee_event (bp);if (val &DRV_STATUS_OEM_UPDATE_SVID ) -bnx2x_handle_update_svid_cmd (bp); +bnx2x_schedule_sp_rtnl (bp, +BNX2X_SP_RTNL_UPDATE_SVID ,0 );if (bp->link_vars.periodic_flags &PERIODIC_FLAGS_LINK_EVENT ) {
@@ -10369,6 +10374,9 @@ static void bnx2x_sp_rtnl_task(struct work_struct *work) &bp->sp_rtnl_state))bnx2x_update_mng_version (bp); +if (test_and_clear_bit (BNX2X_SP_RTNL_UPDATE_SVID , &bp->sp_rtnl_state)) +bnx2x_handle_update_svid_cmd (bp); +if (test_and_clear_bit (BNX2X_SP_RTNL_CHANGE_UDP_PORT , &bp->sp_rtnl_state)) {if (bnx2x_udp_port_update (bp)) {
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 27/59 scsi: target: iscsi: cxgbit: fix csk leak
In reply to Sasha LevinFrom: Varun Prakash <[email protected]>
[ Upstream commit 801df68d617e3cb831f531c99fa6003620e6b343 ]
csk leak can happen if a new TCP connection gets established after cxgbit_accept_np() returns, to fix this leak free remaining csk in cxgbit_free_np().
--- drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/target/iscsi/cxgbit/cxgbit_cm.c +4 -1
@@ -631,8 +631,11 @@ static void cxgbit_send_halfclose(struct cxgbit_sock *csk)static void cxgbit_arp_failure_discard (void *handle,struct sk_buff *skb) { +struct cxgbit_sock *csk = handle; +pr_debug ("%s cxgbit_device %p\n" , __func__, handle);kfree_skb (skb); +cxgbit_put_csk (csk); }static void cxgbit_abort_arp_failure (void *handle,struct sk_buff *skb)
@@ -1147,7 +1150,7 @@ cxgbit_pass_accept_rpl(struct cxgbit_sock *csk, struct cpl_pass_accept_req *req) rpl5->opt0 =cpu_to_be64 (opt0); rpl5->opt2 =cpu_to_be32 (opt2);set_wr_txq (skb,CPL_PRIORITY_SETUP , csk->ctrlq_idx); -t4_set_arp_err_handler (skb,NULL , cxgbit_arp_failure_discard); +t4_set_arp_err_handler (skb, csk, cxgbit_arp_failure_discard);cxgbit_l2t_send (csk->com.cdev, skb, csk->l2t); }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 28/59 scsi: target: iscsi: cxgbit: add missing spin_lock_init()
In reply to Sasha LevinFrom: Varun Prakash <[email protected]>
[ Upstream commit 9e6371d3c6913ff1707fb2c0274c9925f7aaef80 ]
Add missing spin_lock_init() for cdev->np_lock.
--- drivers/target/iscsi/cxgbit/cxgbit_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/target/iscsi/cxgbit/cxgbit_main.c +1 -0
@@ -58,6 +58,7 @@ static void *cxgbit_uld_add(const struct cxgb4_lld_info *lldi)return ERR_PTR (-ENOMEM );kref_init (&cdev->kref); +spin_lock_init (&cdev->np_lock); cdev->lldi = *lldi;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 29/59 x86, hyperv: remove PCI dependency
In reply to Sasha LevinFrom: Sinan Kaya <[email protected]>
[ Upstream commit c629421a990033ba539eb8585e73a2e6fa9ea631 ]
Need to be able to boot without PCI devices present.
--- drivers/hv/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hv/Kconfig +1 -1
@@ -2,7 +2,7 @@ menu "Microsoft Hyper-V guest support" config HYPERV tristate "Microsoft Hyper-V client drivers" - depends on X86 && ACPI && PCI && X86_LOCAL_APIC && HYPERVISOR_GUEST + depends on X86 && ACPI && X86_LOCAL_APIC && HYPERVISOR_GUEST select PARAVIRT help Select this option to run Linux as a Hyper-V client operating
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 30/59 drivers: net: xgene: Remove unnecessary forward declarations
In reply to Sasha LevinFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 2ab4c3426c0cf711d7147e3f559638e4ab88960e ]
Clang warns:
drivers/net/ethernet/apm/xgene/xgene_enet_main.c:33:36: warning:
tentative array definition assumed to have one element
static const struct acpi_device_id xgene_enet_acpi_match[];
^1 warning generated.
Both xgene_enet_acpi_match and xgene_enet_of_match are defined before their uses at the bottom of the file so this is unnecessary. When CONFIG_ACPI is disabled, ACPI_PTR becomes NULL so xgene_enet_acpi_match doesn't need to be defined.
--- drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/ethernet/apm/xgene/xgene_enet_main.c +0 -3
@@ -29,9 +29,6 @@#define RES_RING_CSR 1#define RES_RING_CMD 2 -static const struct of_device_id xgene_enet_of_match[]; -static const struct acpi_device_id xgene_enet_acpi_match[]; -static void xgene_enet_init_bufpool (struct xgene_enet_desc_ring *buf_pool) {struct xgene_enet_raw_desc16 *raw_desc;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 31/59 w90p910_ether: remove incorrect __init annotation
In reply to Sasha LevinFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 51367e423c6501a26e67d91a655d2bc892303462 ]
The get_mac_address() function is normally inline, but when it is not, we get a warning that this configuration is broken:
WARNING: vmlinux.o(.text+0x4aff00): Section mismatch in reference from the function w90p910_ether_setup() to the function .init.text:get_mac_address() The function w90p910_ether_setup() references
the function __init get_mac_address().
This is often because w90p910_ether_setup lacks a __init
Remove the __init to make it always do the right thing.
--- drivers/net/ethernet/nuvoton/w90p910_ether.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/nuvoton/w90p910_ether.c +1 -1
@@ -912,7 +912,7 @@ static const struct net_device_ops w90p910_ether_netdev_ops = { .ndo_validate_addr = eth_validate_addr, }; -static void __init get_mac_address (struct net_device *dev) +static void get_mac_address (struct net_device *dev) {struct w90p910_ether *ether =netdev_priv (dev);struct platform_device *pdev;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 32/59 qmi_wwan: Added support for Telit LN940 series
In reply to Sasha LevinFrom: Jörgen Storvist <[email protected]>
[ Upstream commit 1986af16e8ed355822600c24b3d2f0be46b573df ]
Added support for the Telit LN940 series cellular modules QMI interface. QMI_QUIRK_SET_DTR quirk requied for Qualcomm MDM9x40 chipset.
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1221,6 +1221,7 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */ {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */ {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)}, /* Telewell TW-3G HSPA+ */ {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 33/59 net: hns: Incorrect offset address used for some registers.
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit 4e1d4be681b2c26fd874adbf584bf034573ac45d ]
According to the hip06 Datasheet:
1. The offset of INGRESS_SW_VLAN_TAG_DISC should be 0x1A00+4*all_chn_num
2. The offset of INGRESS_IN_DATA_STP_DISC should be 0x1A50+4*all_chn_num
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +2 -2
@@ -2159,9 +2159,9 @@ void hns_dsaf_update_stats(struct dsaf_device *dsaf_dev, u32 node_num) DSAF_INODE_LOCAL_ADDR_FALSE_NUM_0_REG + 0x80 * (u64)node_num); hw_stats->vlan_drop +=dsaf_read_dev (dsaf_dev, -DSAF_INODE_SW_VLAN_TAG_DISC_0_REG +0x80 * (u64 )node_num); +DSAF_INODE_SW_VLAN_TAG_DISC_0_REG +4 * (u64 )node_num); hw_stats->stp_drop +=dsaf_read_dev (dsaf_dev, -DSAF_INODE_IN_DATA_STP_DISC_0_REG +0x80 * (u64 )node_num); +DSAF_INODE_IN_DATA_STP_DISC_0_REG +4 * (u64 )node_num);/* pfc pause frame statistics stored in dsaf inode*/ if ((node_num <DSAF_SERVICE_NW_NUM ) && !is_ver1) {
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 34/59 net: hns: All ports can not work when insmod hns ko after rmmod.
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit 308c6cafde0147616da45e3a928adae55c428deb ]
There are two test cases:
1. Remove the 4 modules:hns_enet_drv/hns_dsaf/hnae/hns_mdio, and install them again, must use "ifconfig down/ifconfig up" command pair to bring port to work.
This patch calls phy_stop function when init phy to fix this bug.
2. Remove the 2 modules:hns_enet_drv/hns_dsaf, and install them again, all ports can not use anymore, because of the phy devices register failed(phy devices already exists).
Phy devices are registered when hns_dsaf installed, this patch removes them when hns_dsaf removed.
The two cases are sometimes related, fixing the second case also requires fixing the first case, so fix them together.
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 15 +++++++++++++++ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 3 +++ 2 files changed, 18 insertions(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +15 -0
@@ -783,6 +783,17 @@ static int hns_mac_register_phy(struct hns_mac_cb *mac_cb)return rc; } +static void hns_mac_remove_phydev (struct hns_mac_cb *mac_cb) +{ +if (!to_acpi_device_node (mac_cb->fw_port) || !mac_cb->phy_dev) +return ; + +phy_device_remove (mac_cb->phy_dev); +phy_device_free (mac_cb->phy_dev); + + mac_cb->phy_dev =NULL ; +} +#define MAC_MEDIA_TYPE_MAX_LEN 16 static const struct {
@@ -1120,7 +1131,11 @@ void hns_mac_uninit(struct dsaf_device *dsaf_dev)int max_port_num =hns_mac_get_max_port_num (dsaf_dev);for (i =0 ; i < max_port_num; i++) { +if (!dsaf_dev->mac_cb[i]) +continue ; + dsaf_dev->misc_op->cpld_reset_led (dsaf_dev->mac_cb[i]); +hns_mac_remove_phydev (dsaf_dev->mac_cb[i]); dsaf_dev->mac_cb[i] =NULL ; } }
drivers/net/ethernet/hisilicon/hns/hns_enet.c +3 -0
@@ -1286,6 +1286,9 @@ int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h)if (h->phy_if ==PHY_INTERFACE_MODE_XGMII ) phy_dev->autoneg = false; +if (h->phy_if ==PHY_INTERFACE_MODE_SGMII ) +phy_stop (phy_dev); +return 0 ; }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 35/59 net: hns: Some registers use wrong address according to the datasheet.
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit 4ad26f117b6ea0f5d5f1592127bafb5ec65904d3 ]
According to the hip06 datasheet:
1.Six registers use wrong address:
RCB_COM_SF_CFG_INTMASK_RING
RCB_COM_SF_CFG_RING_STS
RCB_COM_SF_CFG_RING
RCB_COM_SF_CFG_INTMASK_BD
RCB_COM_SF_CFG_BD_RINT_STS DSAF_INODE_VC1_IN_PKT_NUM_0_REG
2.The offset of DSAF_INODE_VC1_IN_PKT_NUM_0_REG should be
0x103C + 0x80 * all_chn_num
3.The offset to show the value of DSAF_INODE_IN_DATA_STP_DISC_0_REG
is wrong, so the value of DSAF_INODE_SW_VLAN_TAG_DISC_0_REG will be overwrite
These registers are only used in "ethtool -d", so that did not cause ndev to misfunction.
--- .../ethernet/hisilicon/hns/hns_dsaf_main.c | 242 +++++++++--------- .../net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 12 +- 2 files changed, 127 insertions(+), 127 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +121 -121
@@ -2278,237 +2278,237 @@ void hns_dsaf_get_regs(struct dsaf_device *ddev, u32 port, void *data) DSAF_INODE_BD_ORDER_STATUS_0_REG + j * 4); p[223 + i] =dsaf_read_dev (ddev,DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + j *4 ); - p[224 + i] =dsaf_read_dev (ddev, + p[226 + i] =dsaf_read_dev (ddev,DSAF_INODE_IN_DATA_STP_DISC_0_REG + j *4 ); } - p[227 ] =dsaf_read_dev (ddev,DSAF_INODE_GE_FC_EN_0_REG + port *4 ); + p[229 ] =dsaf_read_dev (ddev,DSAF_INODE_GE_FC_EN_0_REG + port *4 );for (i =0 ; i <DSAF_INODE_NUM /DSAF_COMM_CHN ; i++) { j = i *DSAF_COMM_CHN + port; - p[228 + i] =dsaf_read_dev (ddev, + p[230 + i] =dsaf_read_dev (ddev,DSAF_INODE_VC0_IN_PKT_NUM_0_REG + j *4 ); } - p[231 ] =dsaf_read_dev (ddev, -DSAF_INODE_VC1_IN_PKT_NUM_0_REG + port *4 ); + p[233 ] =dsaf_read_dev (ddev, +DSAF_INODE_VC1_IN_PKT_NUM_0_REG + port *0x80 );/* dsaf inode registers */ for (i =0 ; i <HNS_DSAF_SBM_NUM (ddev) /DSAF_COMM_CHN ; i++) { j = i *DSAF_COMM_CHN + port; - p[232 + i] =dsaf_read_dev (ddev, + p[234 + i] =dsaf_read_dev (ddev,DSAF_SBM_CFG_REG_0_REG + j *0x80 ); - p[235 + i] =dsaf_read_dev (ddev, + p[237 + i] =dsaf_read_dev (ddev,DSAF_SBM_BP_CFG_0_XGE_REG_0_REG + j *0x80 ); - p[238 + i] =dsaf_read_dev (ddev, + p[240 + i] =dsaf_read_dev (ddev,DSAF_SBM_BP_CFG_1_REG_0_REG + j *0x80 ); - p[241 + i] =dsaf_read_dev (ddev, + p[243 + i] =dsaf_read_dev (ddev,DSAF_SBM_BP_CFG_2_XGE_REG_0_REG + j *0x80 ); - p[244 + i] =dsaf_read_dev (ddev, + p[246 + i] =dsaf_read_dev (ddev,DSAF_SBM_FREE_CNT_0_0_REG + j *0x80 ); - p[245 + i] =dsaf_read_dev (ddev, + p[249 + i] =dsaf_read_dev (ddev,DSAF_SBM_FREE_CNT_1_0_REG + j *0x80 ); - p[248 + i] =dsaf_read_dev (ddev, + p[252 + i] =dsaf_read_dev (ddev,DSAF_SBM_BP_CNT_0_0_REG + j *0x80 ); - p[251 + i] =dsaf_read_dev (ddev, + p[255 + i] =dsaf_read_dev (ddev,DSAF_SBM_BP_CNT_1_0_REG + j *0x80 ); - p[254 + i] =dsaf_read_dev (ddev, + p[258 + i] =dsaf_read_dev (ddev,DSAF_SBM_BP_CNT_2_0_REG + j *0x80 ); - p[257 + i] =dsaf_read_dev (ddev, + p[261 + i] =dsaf_read_dev (ddev,DSAF_SBM_BP_CNT_3_0_REG + j *0x80 ); - p[260 + i] =dsaf_read_dev (ddev, + p[264 + i] =dsaf_read_dev (ddev,DSAF_SBM_INER_ST_0_REG + j *0x80 ); - p[263 + i] =dsaf_read_dev (ddev, + p[267 + i] =dsaf_read_dev (ddev,DSAF_SBM_MIB_REQ_FAILED_TC_0_REG + j *0x80 ); - p[266 + i] =dsaf_read_dev (ddev, + p[270 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_INPORT_CNT_0_REG + j *0x80 ); - p[269 + i] =dsaf_read_dev (ddev, + p[273 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_DROP_CNT_0_REG + j *0x80 ); - p[272 + i] =dsaf_read_dev (ddev, + p[276 + i] =dsaf_read_dev (ddev,DSAF_SBM_INF_OUTPORT_CNT_0_REG + j *0x80 ); - p[275 + i] =dsaf_read_dev (ddev, + p[279 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_INPORT_TC0_CNT_0_REG + j *0x80 ); - p[278 + i] =dsaf_read_dev (ddev, + p[282 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_INPORT_TC1_CNT_0_REG + j *0x80 ); - p[281 + i] =dsaf_read_dev (ddev, + p[285 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_INPORT_TC2_CNT_0_REG + j *0x80 ); - p[284 + i] =dsaf_read_dev (ddev, + p[288 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_INPORT_TC3_CNT_0_REG + j *0x80 ); - p[287 + i] =dsaf_read_dev (ddev, + p[291 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_INPORT_TC4_CNT_0_REG + j *0x80 ); - p[290 + i] =dsaf_read_dev (ddev, + p[294 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_INPORT_TC5_CNT_0_REG + j *0x80 ); - p[293 + i] =dsaf_read_dev (ddev, + p[297 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_INPORT_TC6_CNT_0_REG + j *0x80 ); - p[296 + i] =dsaf_read_dev (ddev, + p[300 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_INPORT_TC7_CNT_0_REG + j *0x80 ); - p[299 + i] =dsaf_read_dev (ddev, + p[303 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_REQ_CNT_0_REG + j *0x80 ); - p[302 + i] =dsaf_read_dev (ddev, + p[306 + i] =dsaf_read_dev (ddev,DSAF_SBM_LNK_RELS_CNT_0_REG + j *0x80 ); - p[305 + i] =dsaf_read_dev (ddev, + p[309 + i] =dsaf_read_dev (ddev,DSAF_SBM_BP_CFG_3_REG_0_REG + j *0x80 ); - p[308 + i] =dsaf_read_dev (ddev, + p[312 + i] =dsaf_read_dev (ddev,DSAF_SBM_BP_CFG_4_REG_0_REG + j *0x80 ); }/* dsaf onode registers */ for (i =0 ; i <DSAF_XOD_NUM ; i++) { - p[311 + i] =dsaf_read_dev (ddev, + p[315 + i] =dsaf_read_dev (ddev,DSAF_XOD_ETS_TSA_TC0_TC3_CFG_0_REG + i *0x90 ); - p[319 + i] =dsaf_read_dev (ddev, + p[323 + i] =dsaf_read_dev (ddev,DSAF_XOD_ETS_TSA_TC4_TC7_CFG_0_REG + i *0x90 ); - p[327 + i] =dsaf_read_dev (ddev, + p[331 + i] =dsaf_read_dev (ddev,DSAF_XOD_ETS_BW_TC0_TC3_CFG_0_REG + i *0x90 ); - p[335 + i] =dsaf_read_dev (ddev, + p[339 + i] =dsaf_read_dev (ddev,DSAF_XOD_ETS_BW_TC4_TC7_CFG_0_REG + i *0x90 ); - p[343 + i] =dsaf_read_dev (ddev, + p[347 + i] =dsaf_read_dev (ddev,DSAF_XOD_ETS_BW_OFFSET_CFG_0_REG + i *0x90 ); - p[351 + i] =dsaf_read_dev (ddev, + p[355 + i] =dsaf_read_dev (ddev,DSAF_XOD_ETS_TOKEN_CFG_0_REG + i *0x90 ); } - p[359 ] =dsaf_read_dev (ddev,DSAF_XOD_PFS_CFG_0_0_REG + port *0x90 ); - p[360 ] =dsaf_read_dev (ddev,DSAF_XOD_PFS_CFG_1_0_REG + port *0x90 ); - p[361 ] =dsaf_read_dev (ddev,DSAF_XOD_PFS_CFG_2_0_REG + port *0x90 ); + p[363 ] =dsaf_read_dev (ddev,DSAF_XOD_PFS_CFG_0_0_REG + port *0x90 ); + p[364 ] =dsaf_read_dev (ddev,DSAF_XOD_PFS_CFG_1_0_REG + port *0x90 ); + p[365 ] =dsaf_read_dev (ddev,DSAF_XOD_PFS_CFG_2_0_REG + port *0x90 );for (i =0 ; i <DSAF_XOD_BIG_NUM /DSAF_COMM_CHN ; i++) { j = i *DSAF_COMM_CHN + port; - p[362 + i] =dsaf_read_dev (ddev, + p[366 + i] =dsaf_read_dev (ddev,DSAF_XOD_GNT_L_0_REG + j *0x90 ); - p[365 + i] =dsaf_read_dev (ddev, + p[369 + i] =dsaf_read_dev (ddev,DSAF_XOD_GNT_H_0_REG + j *0x90 ); - p[368 + i] =dsaf_read_dev (ddev, + p[372 + i] =dsaf_read_dev (ddev,DSAF_XOD_CONNECT_STATE_0_REG + j *0x90 ); - p[371 + i] =dsaf_read_dev (ddev, + p[375 + i] =dsaf_read_dev (ddev,DSAF_XOD_RCVPKT_CNT_0_REG + j *0x90 ); - p[374 + i] =dsaf_read_dev (ddev, + p[378 + i] =dsaf_read_dev (ddev,DSAF_XOD_RCVTC0_CNT_0_REG + j *0x90 ); - p[377 + i] =dsaf_read_dev (ddev, + p[381 + i] =dsaf_read_dev (ddev,DSAF_XOD_RCVTC1_CNT_0_REG + j *0x90 ); - p[380 + i] =dsaf_read_dev (ddev, + p[384 + i] =dsaf_read_dev (ddev,DSAF_XOD_RCVTC2_CNT_0_REG + j *0x90 ); - p[383 + i] =dsaf_read_dev (ddev, + p[387 + i] =dsaf_read_dev (ddev,DSAF_XOD_RCVTC3_CNT_0_REG + j *0x90 ); - p[386 + i] =dsaf_read_dev (ddev, + p[390 + i] =dsaf_read_dev (ddev,DSAF_XOD_RCVVC0_CNT_0_REG + j *0x90 ); - p[389 + i] =dsaf_read_dev (ddev, + p[393 + i] =dsaf_read_dev (ddev,DSAF_XOD_RCVVC1_CNT_0_REG + j *0x90 ); } - p[392 ] =dsaf_read_dev (ddev, + p[396 ] =dsaf_read_dev (ddev,DSAF_XOD_XGE_RCVIN0_CNT_0_REG + port *0x90 ); - p[393 ] =dsaf_read_dev (ddev, + p[397 ] =dsaf_read_dev (ddev,DSAF_XOD_XGE_RCVIN1_CNT_0_REG + port *0x90 ); - p[394 ] =dsaf_read_dev (ddev, + p[398 ] =dsaf_read_dev (ddev,DSAF_XOD_XGE_RCVIN2_CNT_0_REG + port *0x90 ); - p[395 ] =dsaf_read_dev (ddev, + p[399 ] =dsaf_read_dev (ddev,DSAF_XOD_XGE_RCVIN3_CNT_0_REG + port *0x90 ); - p[396 ] =dsaf_read_dev (ddev, + p[400 ] =dsaf_read_dev (ddev,DSAF_XOD_XGE_RCVIN4_CNT_0_REG + port *0x90 ); - p[397 ] =dsaf_read_dev (ddev, + p[401 ] =dsaf_read_dev (ddev,DSAF_XOD_XGE_RCVIN5_CNT_0_REG + port *0x90 ); - p[398 ] =dsaf_read_dev (ddev, + p[402 ] =dsaf_read_dev (ddev,DSAF_XOD_XGE_RCVIN6_CNT_0_REG + port *0x90 ); - p[399 ] =dsaf_read_dev (ddev, + p[403 ] =dsaf_read_dev (ddev,DSAF_XOD_XGE_RCVIN7_CNT_0_REG + port *0x90 ); - p[400 ] =dsaf_read_dev (ddev, + p[404 ] =dsaf_read_dev (ddev,DSAF_XOD_PPE_RCVIN0_CNT_0_REG + port *0x90 ); - p[401 ] =dsaf_read_dev (ddev, + p[405 ] =dsaf_read_dev (ddev,DSAF_XOD_PPE_RCVIN1_CNT_0_REG + port *0x90 ); - p[402 ] =dsaf_read_dev (ddev, + p[406 ] =dsaf_read_dev (ddev,DSAF_XOD_ROCEE_RCVIN0_CNT_0_REG + port *0x90 ); - p[403 ] =dsaf_read_dev (ddev, + p[407 ] =dsaf_read_dev (ddev,DSAF_XOD_ROCEE_RCVIN1_CNT_0_REG + port *0x90 ); - p[404 ] =dsaf_read_dev (ddev, + p[408 ] =dsaf_read_dev (ddev,DSAF_XOD_FIFO_STATUS_0_REG + port *0x90 );/* dsaf voq registers */ for (i =0 ; i <DSAF_VOQ_NUM /DSAF_COMM_CHN ; i++) { j = (i *DSAF_COMM_CHN + port) *0x90 ; - p[405 + i] =dsaf_read_dev (ddev, + p[409 + i] =dsaf_read_dev (ddev,DSAF_VOQ_ECC_INVERT_EN_0_REG + j); - p[408 + i] =dsaf_read_dev (ddev, + p[412 + i] =dsaf_read_dev (ddev,DSAF_VOQ_SRAM_PKT_NUM_0_REG + j); - p[411 + i] =dsaf_read_dev (ddev,DSAF_VOQ_IN_PKT_NUM_0_REG + j); - p[414 + i] =dsaf_read_dev (ddev, + p[415 + i] =dsaf_read_dev (ddev,DSAF_VOQ_IN_PKT_NUM_0_REG + j); + p[418 + i] =dsaf_read_dev (ddev,DSAF_VOQ_OUT_PKT_NUM_0_REG + j); - p[417 + i] =dsaf_read_dev (ddev, + p[421 + i] =dsaf_read_dev (ddev,DSAF_VOQ_ECC_ERR_ADDR_0_REG + j); - p[420 + i] =dsaf_read_dev (ddev,DSAF_VOQ_BP_STATUS_0_REG + j); - p[423 + i] =dsaf_read_dev (ddev,DSAF_VOQ_SPUP_IDLE_0_REG + j); - p[426 + i] =dsaf_read_dev (ddev, + p[424 + i] =dsaf_read_dev (ddev,DSAF_VOQ_BP_STATUS_0_REG + j); + p[427 + i] =dsaf_read_dev (ddev,DSAF_VOQ_SPUP_IDLE_0_REG + j); + p[430 + i] =dsaf_read_dev (ddev,DSAF_VOQ_XGE_XOD_REQ_0_0_REG + j); - p[429 + i] =dsaf_read_dev (ddev, + p[433 + i] =dsaf_read_dev (ddev,DSAF_VOQ_XGE_XOD_REQ_1_0_REG + j); - p[432 + i] =dsaf_read_dev (ddev, + p[436 + i] =dsaf_read_dev (ddev,DSAF_VOQ_PPE_XOD_REQ_0_REG + j); - p[435 + i] =dsaf_read_dev (ddev, + p[439 + i] =dsaf_read_dev (ddev,DSAF_VOQ_ROCEE_XOD_REQ_0_REG + j); - p[438 + i] =dsaf_read_dev (ddev, + p[442 + i] =dsaf_read_dev (ddev,DSAF_VOQ_BP_ALL_THRD_0_REG + j); }/* dsaf tbl registers */ - p[441 ] =dsaf_read_dev (ddev,DSAF_TBL_CTRL_0_REG ); - p[442 ] =dsaf_read_dev (ddev,DSAF_TBL_INT_MSK_0_REG ); - p[443 ] =dsaf_read_dev (ddev,DSAF_TBL_INT_SRC_0_REG ); - p[444 ] =dsaf_read_dev (ddev,DSAF_TBL_INT_STS_0_REG ); - p[445 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_ADDR_0_REG ); - p[446 ] =dsaf_read_dev (ddev,DSAF_TBL_LINE_ADDR_0_REG ); - p[447 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_HIGH_0_REG ); - p[448 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_LOW_0_REG ); - p[449 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_4_0_REG ); - p[450 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_3_0_REG ); - p[451 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_2_0_REG ); - p[452 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_1_0_REG ); - p[453 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_0_0_REG ); - p[454 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_UCAST_CFG_0_REG ); - p[455 ] =dsaf_read_dev (ddev,DSAF_TBL_LIN_CFG_0_REG ); - p[456 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RDATA_HIGH_0_REG ); - p[457 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RDATA_LOW_0_REG ); - p[458 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA4_0_REG ); - p[459 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA3_0_REG ); - p[460 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA2_0_REG ); - p[461 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA1_0_REG ); - p[462 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA0_0_REG ); - p[463 ] =dsaf_read_dev (ddev,DSAF_TBL_LIN_RDATA_0_REG ); + p[445 ] =dsaf_read_dev (ddev,DSAF_TBL_CTRL_0_REG ); + p[446 ] =dsaf_read_dev (ddev,DSAF_TBL_INT_MSK_0_REG ); + p[447 ] =dsaf_read_dev (ddev,DSAF_TBL_INT_SRC_0_REG ); + p[448 ] =dsaf_read_dev (ddev,DSAF_TBL_INT_STS_0_REG ); + p[449 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_ADDR_0_REG ); + p[450 ] =dsaf_read_dev (ddev,DSAF_TBL_LINE_ADDR_0_REG ); + p[451 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_HIGH_0_REG ); + p[452 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_LOW_0_REG ); + p[453 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_4_0_REG ); + p[454 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_3_0_REG ); + p[455 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_2_0_REG ); + p[456 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_1_0_REG ); + p[457 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_MCAST_CFG_0_0_REG ); + p[458 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_UCAST_CFG_0_REG ); + p[459 ] =dsaf_read_dev (ddev,DSAF_TBL_LIN_CFG_0_REG ); + p[460 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RDATA_HIGH_0_REG ); + p[461 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RDATA_LOW_0_REG ); + p[462 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA4_0_REG ); + p[463 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA3_0_REG ); + p[464 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA2_0_REG ); + p[465 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA1_0_REG ); + p[466 ] =dsaf_read_dev (ddev,DSAF_TBL_TCAM_RAM_RDATA0_0_REG ); + p[467 ] =dsaf_read_dev (ddev,DSAF_TBL_LIN_RDATA_0_REG );for (i =0 ; i <DSAF_SW_PORT_NUM ; i++) { j = i *0x8 ; - p[464 +2 * i] =dsaf_read_dev (ddev, + p[468 +2 * i] =dsaf_read_dev (ddev,DSAF_TBL_DA0_MIS_INFO1_0_REG + j); - p[465 +2 * i] =dsaf_read_dev (ddev, + p[469 +2 * i] =dsaf_read_dev (ddev,DSAF_TBL_DA0_MIS_INFO0_0_REG + j); } - p[480 ] =dsaf_read_dev (ddev,DSAF_TBL_SA_MIS_INFO2_0_REG ); - p[481 ] =dsaf_read_dev (ddev,DSAF_TBL_SA_MIS_INFO1_0_REG ); - p[482 ] =dsaf_read_dev (ddev,DSAF_TBL_SA_MIS_INFO0_0_REG ); - p[483 ] =dsaf_read_dev (ddev,DSAF_TBL_PUL_0_REG ); - p[484 ] =dsaf_read_dev (ddev,DSAF_TBL_OLD_RSLT_0_REG ); - p[485 ] =dsaf_read_dev (ddev,DSAF_TBL_OLD_SCAN_VAL_0_REG ); - p[486 ] =dsaf_read_dev (ddev,DSAF_TBL_DFX_CTRL_0_REG ); - p[487 ] =dsaf_read_dev (ddev,DSAF_TBL_DFX_STAT_0_REG ); - p[488 ] =dsaf_read_dev (ddev,DSAF_TBL_DFX_STAT_2_0_REG ); - p[489 ] =dsaf_read_dev (ddev,DSAF_TBL_LKUP_NUM_I_0_REG ); - p[490 ] =dsaf_read_dev (ddev,DSAF_TBL_LKUP_NUM_O_0_REG ); - p[491 ] =dsaf_read_dev (ddev,DSAF_TBL_UCAST_BCAST_MIS_INFO_0_0_REG ); + p[484 ] =dsaf_read_dev (ddev,DSAF_TBL_SA_MIS_INFO2_0_REG ); + p[485 ] =dsaf_read_dev (ddev,DSAF_TBL_SA_MIS_INFO1_0_REG ); + p[486 ] =dsaf_read_dev (ddev,DSAF_TBL_SA_MIS_INFO0_0_REG ); + p[487 ] =dsaf_read_dev (ddev,DSAF_TBL_PUL_0_REG ); + p[488 ] =dsaf_read_dev (ddev,DSAF_TBL_OLD_RSLT_0_REG ); + p[489 ] =dsaf_read_dev (ddev,DSAF_TBL_OLD_SCAN_VAL_0_REG ); + p[490 ] =dsaf_read_dev (ddev,DSAF_TBL_DFX_CTRL_0_REG ); + p[491 ] =dsaf_read_dev (ddev,DSAF_TBL_DFX_STAT_0_REG ); + p[492 ] =dsaf_read_dev (ddev,DSAF_TBL_DFX_STAT_2_0_REG ); + p[493 ] =dsaf_read_dev (ddev,DSAF_TBL_LKUP_NUM_I_0_REG ); + p[494 ] =dsaf_read_dev (ddev,DSAF_TBL_LKUP_NUM_O_0_REG ); + p[495 ] =dsaf_read_dev (ddev,DSAF_TBL_UCAST_BCAST_MIS_INFO_0_0_REG );/* dsaf other registers */ - p[492 ] =dsaf_read_dev (ddev,DSAF_INODE_FIFO_WL_0_REG + port *0x4 ); - p[493 ] =dsaf_read_dev (ddev,DSAF_ONODE_FIFO_WL_0_REG + port *0x4 ); - p[494 ] =dsaf_read_dev (ddev,DSAF_XGE_GE_WORK_MODE_0_REG + port *0x4 ); - p[495 ] =dsaf_read_dev (ddev, + p[496 ] =dsaf_read_dev (ddev,DSAF_INODE_FIFO_WL_0_REG + port *0x4 ); + p[497 ] =dsaf_read_dev (ddev,DSAF_ONODE_FIFO_WL_0_REG + port *0x4 ); + p[498 ] =dsaf_read_dev (ddev,DSAF_XGE_GE_WORK_MODE_0_REG + port *0x4 ); + p[499 ] =dsaf_read_dev (ddev,DSAF_XGE_APP_RX_LINK_UP_0_REG + port *0x4 ); - p[496 ] =dsaf_read_dev (ddev,DSAF_NETPORT_CTRL_SIG_0_REG + port *0x4 ); - p[497 ] =dsaf_read_dev (ddev,DSAF_XGE_CTRL_SIG_CFG_0_REG + port *0x4 ); + p[500 ] =dsaf_read_dev (ddev,DSAF_NETPORT_CTRL_SIG_0_REG + port *0x4 ); + p[501 ] =dsaf_read_dev (ddev,DSAF_XGE_CTRL_SIG_CFG_0_REG + port *0x4 );if (!is_ver1) - p[498 ] =dsaf_read_dev (ddev,DSAF_PAUSE_CFG_REG + port *0x4 ); + p[502 ] =dsaf_read_dev (ddev,DSAF_PAUSE_CFG_REG + port *0x4 );/* mark end of dsaf regs */ -for (i =499 ; i <504 ; i++) +for (i =503 ; i <504 ; i++) p[i] =0xdddddddd ; }
drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h +6 -6
@@ -176,7 +176,7 @@#define DSAF_INODE_IN_DATA_STP_DISC_0_REG 0x1A50#define DSAF_INODE_GE_FC_EN_0_REG 0x1B00#define DSAF_INODE_VC0_IN_PKT_NUM_0_REG 0x1B50 -#define DSAF_INODE_VC1_IN_PKT_NUM_0_REG 0x1C00 +#define DSAF_INODE_VC1_IN_PKT_NUM_0_REG 0x103C#define DSAF_INODE_IN_PRIO_PAUSE_BASE_REG 0x1C00#define DSAF_INODE_IN_PRIO_PAUSE_BASE_OFFSET 0x100#define DSAF_INODE_IN_PRIO_PAUSE_OFFSET 0x50
@@ -404,11 +404,11 @@#define RCB_ECC_ERR_ADDR4_REG 0x460#define RCB_ECC_ERR_ADDR5_REG 0x464 -#define RCB_COM_SF_CFG_INTMASK_RING 0x480 -#define RCB_COM_SF_CFG_RING_STS 0x484 -#define RCB_COM_SF_CFG_RING 0x488 -#define RCB_COM_SF_CFG_INTMASK_BD 0x48C -#define RCB_COM_SF_CFG_BD_RINT_STS 0x470 +#define RCB_COM_SF_CFG_INTMASK_RING 0x470 +#define RCB_COM_SF_CFG_RING_STS 0x474 +#define RCB_COM_SF_CFG_RING 0x478 +#define RCB_COM_SF_CFG_INTMASK_BD 0x47C +#define RCB_COM_SF_CFG_BD_RINT_STS 0x480#define RCB_COM_RCB_RD_BD_BUSY 0x490#define RCB_COM_RCB_FBD_CRT_EN 0x494#define RCB_COM_AXI_WR_ERR_INTMASK 0x498
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 36/59 net: hns: Fixed bug that netdev was opened twice
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit 5778b13b64eca5549d242686f2f91a2c80c8fa40 ]
After resetting dsaf to try to repair chip error such as ecc error, the net device will be open if net interface is up. But at this time if there is the users set the net device up with the command ifconfig, the net device will be opened twice consecutively.
Function napi_enable was called when open device. And Kernel panic will be occurred if it was called twice consecutively. Such as follow:
static inline void napi_enable(struct napi_struct *n)
{
BUG_ON(!test_bit(NAPI_STATE_SCHED, &n->state));
smp_mb__before_clear_bit();
clear_bit(NAPI_STATE_SCHED, &n->state);
}[37255.571996] Kernel panic - not syncing: BUG! [37255.595234] Call trace: [37255.597694] [<ffff80000008ab48>] dump_backtrace+0x0/0x1a0 [37255.603114] [<ffff80000008ad08>] show_stack+0x20/0x28 [37255.608187] [<ffff8000009c4944>] dump_stack+0x98/0xb8 [37255.613258] [<ffff8000009c149c>] panic+0x10c/0x26c [37255.618070] [<ffff80000070f134>] hns_nic_net_up+0x30c/0x4e0 [37255.623664] [<ffff80000070f39c>] hns_nic_net_open+0x94/0x12c [37255.629346] [<ffff80000084be78>] __dev_open+0xf4/0x168 [37255.634504] [<ffff80000084c1ac>] __dev_change_flags+0x98/0x15c [37255.640359] [<ffff80000084c29c>] dev_change_flags+0x2c/0x68 [37255.769580] [<ffff8000008dc400>] devinet_ioctl+0x650/0x704 [37255.775086] [<ffff8000008ddc38>] inet_ioctl+0x98/0xb4 [37255.780159] [<ffff800000827b7c>] sock_do_ioctl+0x44/0x84 [37255.785490] [<ffff800000828e04>] sock_ioctl+0x248/0x30c [37255.790737] [<ffff80000026dc6c>] do_vfs_ioctl+0x480/0x618 [37255.796156] [<ffff80000026de94>] SyS_ioctl+0x90/0xa4 [37255.801139] SMP: stopping secondary CPUs [37255.805079] kbox: catch panic event. [37255.809586] collected_len = 128928, LOG_BUF_LEN_LOCAL = 131072 [37255.816103] flush cache 0xffff80003f000000 size 0x800000 [37255.822192] flush cache 0xffff80003f000000 size 0x800000 [37255.828289] flush cache 0xffff80003f000000 size 0x800000 [37255.834378] kbox: no notify die func register. no need to notify [37255.840413] ---[ end Kernel panic - not syncing: BUG!
This patchset fix this bug according to the flag NIC_STATE_DOWN.
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +3 -0
@@ -1433,6 +1433,9 @@ static int hns_nic_net_up(struct net_device *ndev)int i, j;int ret; +if (!test_bit (NIC_STATE_DOWN , &priv->state)) +return 0 ; + ret =hns_nic_init_irq (priv);if (ret !=0 ) {netdev_err (ndev,"hns init irq failed! ret=%d\n" , ret);
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 37/59 net: hns: Clean rx fbd when ae stopped.
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit 31f6b61d810654fb3ef43f4d8afda0f44b142fad ]
If there are packets in hardware when changing the speed or duplex, it may cause hardware hang up.
This patch adds the code to wait rx fbd clean up when ae stopped.
--- drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +3 -0
@@ -379,6 +379,9 @@ void hns_ae_stop(struct hnae_handle *handle)hns_ae_ring_enable_all (handle,0 ); +/* clean rx fbd. */ +hns_rcb_wait_fbd_clean (handle->qs, handle->q_num,RCB_INT_FLAG_RX ); + (void )hns_mac_vm_config_bc_en (mac_cb,0 , false); }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 38/59 net: hns: Free irq when exit from abnormal branch
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit c82bd077e1ba3dd586569c733dc6d3dd4b0e43cd ]
1.In "hns_nic_init_irq", if request irq fail at index i,
the function return directly without releasing irq resources that already requested.
2.In "hns_nic_net_up" after "hns_nic_init_irq",
if exceptional branch occurs, irqs that already requested are not release.
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +22 -1
@@ -1384,6 +1384,22 @@ static int hns_nic_init_affinity_mask(int q_num, int ring_idx,return cpu; } +static void hns_nic_free_irq (int q_num,struct hns_nic_priv *priv) +{ +int i; + +for (i =0 ; i < q_num *2 ; i++) { +if (priv->ring_data[i].ring->irq_init_flag ==RCB_IRQ_INITED ) { +irq_set_affinity_hint (priv->ring_data[i].ring->irq, +NULL ); +free_irq (priv->ring_data[i].ring->irq, + &priv->ring_data[i]); + priv->ring_data[i].ring->irq_init_flag = +RCB_IRQ_NOT_INITED ; + } + } +} +static int hns_nic_init_irq (struct hns_nic_priv *priv) {struct hnae_handle *h = priv->ae_handle;
@@ -1409,7 +1425,7 @@ static int hns_nic_init_irq(struct hns_nic_priv *priv)if (ret) {netdev_err (priv->netdev,"request irq(%d) fail\n" , rd->ring->irq); -return ret; + goto out_free_irq; }disable_irq (rd->ring->irq);
@@ -1424,6 +1440,10 @@ static int hns_nic_init_irq(struct hns_nic_priv *priv) }return 0 ; + +out_free_irq: +hns_nic_free_irq (h->q_num, priv); +return ret; }static int hns_nic_net_up (struct net_device *ndev)
@@ -1471,6 +1491,7 @@ static int hns_nic_net_up(struct net_device *ndev)for (j = i -1 ; j >=0 ; j--)hns_nic_ring_close (ndev, j); +hns_nic_free_irq (h->q_num, priv);set_bit (NIC_STATE_DOWN , &priv->state);return ret;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 39/59 net: hns: Avoid net reset caused by pause frames storm
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit a57275d35576fdd89d8c771eedf1e7cf97e0dfa6 ]
There will be a large number of MAC pause frames on the net, which caused tx timeout of net device. And then the net device was reset to try to recover it. So that is not useful, and will cause some other problems.
So need doubled ndev->watchdog_timeo if device watchdog occurred until watchdog_timeo up to 40s and then try resetting to recover it.
When collecting dfx information such as hardware registers when tx timeout. Some registers for count were cleared when read. So need move this task before update net state which also read the count registers.
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +10 -2
@@ -1609,11 +1609,19 @@ static int hns_nic_net_stop(struct net_device *ndev) }static void hns_tx_timeout_reset (struct hns_nic_priv *priv); +#define HNS_TX_TIMEO_LIMIT (40 * HZ)static void hns_nic_net_timeout (struct net_device *ndev) {struct hns_nic_priv *priv =netdev_priv (ndev); -hns_tx_timeout_reset (priv); +if (ndev->watchdog_timeo <HNS_TX_TIMEO_LIMIT ) { + ndev->watchdog_timeo *=2 ; +netdev_info (ndev,"watchdog_timo changed to %d.\n" , + ndev->watchdog_timeo); + }else { + ndev->watchdog_timeo =HNS_NIC_TX_TIMEOUT ; +hns_tx_timeout_reset (priv); + } } static int hns_nic_do_ioctl(struct net_device *netdev, struct ifreq *ifr,
@@ -2193,11 +2201,11 @@ static void hns_nic_service_task(struct work_struct *work) = container_of(work, struct hns_nic_priv, service_task);struct hnae_handle *h = priv->ae_handle; +hns_nic_reset_subtask (priv);hns_nic_update_link_status (priv->netdev); h->dev->ops->update_led_status (h);hns_nic_update_stats (priv->netdev); -hns_nic_reset_subtask (priv);hns_nic_service_event_complete (priv); }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 40/59 net: hns: Fix ntuple-filters status error.
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit 7e74a19ca522aec7c2be201a7ae1d1d57ded409b ]
The ntuple-filters features is forced on by chip. But it shows "ntuple-filters: off [fixed]" when use ethtool. This patch make it correct with "ntuple-filters: on [fixed]".
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +1 -1
@@ -2486,7 +2486,7 @@ static int hns_nic_dev_probe(struct platform_device *pdev) ndev->min_mtu =MAC_MIN_MTU ;switch (priv->enet_ver) {case AE_VERSION_2 : - ndev->features |=NETIF_F_TSO |NETIF_F_TSO6 ; + ndev->features |=NETIF_F_TSO |NETIF_F_TSO6 |NETIF_F_NTUPLE ; ndev->hw_features |=NETIF_F_IP_CSUM |NETIF_F_IPV6_CSUM |NETIF_F_RXCSUM |NETIF_F_SG |NETIF_F_GSO |NETIF_F_GRO |NETIF_F_TSO |NETIF_F_TSO6 ;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 41/59 net: hns: Add mac pcs config when enable|disable mac
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit 726ae5c9e5f0c18eca8ea5296b526242c3e89822 ]
In some case, when mac enable|disable and adjust link, may cause hard to link(or abnormal) between mac and phy. This patch adds the code for rx PCS to avoid this bug.
Disable the rx PCS when driver disable the gmac, and enable the rx PCS when driver enable the mac.
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 14 ++++++++++---- drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 1 + 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +10 -4
@@ -67,11 +67,14 @@ static void hns_gmac_enable(void *mac_drv, enum mac_commom_mode mode)struct mac_driver *drv = (struct mac_driver *)mac_drv;/*enable GE rX/tX */ -if ((mode ==MAC_COMM_MODE_TX ) || (mode ==MAC_COMM_MODE_RX_AND_TX )) +if (mode ==MAC_COMM_MODE_TX || mode ==MAC_COMM_MODE_RX_AND_TX )dsaf_set_dev_bit (drv,GMAC_PORT_EN_REG ,GMAC_PORT_TX_EN_B ,1 ); -if ((mode ==MAC_COMM_MODE_RX ) || (mode ==MAC_COMM_MODE_RX_AND_TX )) +if (mode ==MAC_COMM_MODE_RX || mode ==MAC_COMM_MODE_RX_AND_TX ) { +/* enable rx pcs */ +dsaf_set_dev_bit (drv,GMAC_PCS_RX_EN_REG ,0 ,0 );dsaf_set_dev_bit (drv,GMAC_PORT_EN_REG ,GMAC_PORT_RX_EN_B ,1 ); + } }static void hns_gmac_disable (void *mac_drv,enum mac_commom_mode mode)
@@ -79,11 +82,14 @@ static void hns_gmac_disable(void *mac_drv, enum mac_commom_mode mode)struct mac_driver *drv = (struct mac_driver *)mac_drv;/*disable GE rX/tX */ -if ((mode ==MAC_COMM_MODE_TX ) || (mode ==MAC_COMM_MODE_RX_AND_TX )) +if (mode ==MAC_COMM_MODE_TX || mode ==MAC_COMM_MODE_RX_AND_TX )dsaf_set_dev_bit (drv,GMAC_PORT_EN_REG ,GMAC_PORT_TX_EN_B ,0 ); -if ((mode ==MAC_COMM_MODE_RX ) || (mode ==MAC_COMM_MODE_RX_AND_TX )) +if (mode ==MAC_COMM_MODE_RX || mode ==MAC_COMM_MODE_RX_AND_TX ) { +/* disable rx pcs */ +dsaf_set_dev_bit (drv,GMAC_PCS_RX_EN_REG ,0 ,1 );dsaf_set_dev_bit (drv,GMAC_PORT_EN_REG ,GMAC_PORT_RX_EN_B ,0 ); + } }/* hns_gmac_get_en - get port enable
drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h +1 -0
@@ -534,6 +534,7 @@#define GMAC_LD_LINK_COUNTER_REG 0x01D0UL#define GMAC_LOOP_REG 0x01DCUL#define GMAC_RECV_CONTROL_REG 0x01E0UL +#define GMAC_PCS_RX_EN_REG 0x01E4UL#define GMAC_VLAN_CODE_REG 0x01E8UL#define GMAC_RX_OVERRUN_CNT_REG 0x01ECUL#define GMAC_RX_LENGTHFIELD_ERR_CNT_REG 0x01F4UL
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 42/59 net: hns: Fix ping failed when use net bridge and send multicast
In reply to Sasha LevinFrom: Yonglong Liu <[email protected]>
[ Upstream commit 6adafc356e20189193b38ee6b9af7743078bf6b4 ]
Create a net bridge, add eth and vnet to the bridge. The vnet is used by a virtual machine. When ping the virtual machine from the outside host and the virtual machine send multicast at the same time, the ping package will lost.
The multicast package send to the eth, eth will send it to the bridge too, and the bridge learn the mac of eth. When outside host ping the virtual mechine, it will match the promisc entry of the eth which is not expected, and the bridge send it to eth not to vnet, cause ping lost.
So this patch change promisc tcam entry position to the END of 512 tcam entries, which indicate lower priority. And separate one promisc entry to
two: mc & uc, to avoid package match the wrong tcam entry.
--- .../ethernet/hisilicon/hns/hns_dsaf_main.c | 257 +++++++++++++++--- 1 file changed, 216 insertions(+), 41 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +216 -41
@@ -934,6 +934,62 @@ static void hns_dsaf_tcam_mc_cfg(spin_unlock_bh (&dsaf_dev->tcam_lock); } +/** +* hns_dsaf_tcam_uc_cfg_vague - INT +* @dsaf_dev: dsa fabric device struct pointer +* @address, +* @ptbl_tcam_data, +*/ +static void hns_dsaf_tcam_uc_cfg_vague (struct dsaf_device *dsaf_dev, +u32 address, +struct dsaf_tbl_tcam_data *tcam_data, +struct dsaf_tbl_tcam_data *tcam_mask, +struct dsaf_tbl_tcam_ucast_cfg *tcam_uc) +{ +spin_lock_bh (&dsaf_dev->tcam_lock); +hns_dsaf_tbl_tcam_addr_cfg (dsaf_dev, address); +hns_dsaf_tbl_tcam_data_cfg (dsaf_dev, tcam_data); +hns_dsaf_tbl_tcam_ucast_cfg (dsaf_dev, tcam_uc); +hns_dsaf_tbl_tcam_match_cfg (dsaf_dev, tcam_mask); +hns_dsaf_tbl_tcam_data_ucast_pul (dsaf_dev); + +/*Restore Match Data*/ + tcam_mask->tbl_tcam_data_high =0xffffffff ; + tcam_mask->tbl_tcam_data_low =0xffffffff ; +hns_dsaf_tbl_tcam_match_cfg (dsaf_dev, tcam_mask); + +spin_unlock_bh (&dsaf_dev->tcam_lock); +} + +/** +* hns_dsaf_tcam_mc_cfg_vague - INT +* @dsaf_dev: dsa fabric device struct pointer +* @address, +* @ptbl_tcam_data, +* @ptbl_tcam_mask +* @ptbl_tcam_mcast +*/ +static void hns_dsaf_tcam_mc_cfg_vague (struct dsaf_device *dsaf_dev, +u32 address, +struct dsaf_tbl_tcam_data *tcam_data, +struct dsaf_tbl_tcam_data *tcam_mask, +struct dsaf_tbl_tcam_mcast_cfg *tcam_mc) +{ +spin_lock_bh (&dsaf_dev->tcam_lock); +hns_dsaf_tbl_tcam_addr_cfg (dsaf_dev, address); +hns_dsaf_tbl_tcam_data_cfg (dsaf_dev, tcam_data); +hns_dsaf_tbl_tcam_mcast_cfg (dsaf_dev, tcam_mc); +hns_dsaf_tbl_tcam_match_cfg (dsaf_dev, tcam_mask); +hns_dsaf_tbl_tcam_data_mcast_pul (dsaf_dev); + +/*Restore Match Data*/ + tcam_mask->tbl_tcam_data_high =0xffffffff ; + tcam_mask->tbl_tcam_data_low =0xffffffff ; +hns_dsaf_tbl_tcam_match_cfg (dsaf_dev, tcam_mask); + +spin_unlock_bh (&dsaf_dev->tcam_lock); +} +/** * hns_dsaf_tcam_mc_invld - INT * @dsaf_id: dsa fabric id
@@ -1491,6 +1547,27 @@ static u16 hns_dsaf_find_empty_mac_entry(struct dsaf_device *dsaf_dev)return DSAF_INVALID_ENTRY_IDX ; } +/** +* hns_dsaf_find_empty_mac_entry_reverse +* search dsa fabric soft empty-entry from the end +* @dsaf_dev: dsa fabric device struct pointer +*/ +static u16 hns_dsaf_find_empty_mac_entry_reverse (struct dsaf_device *dsaf_dev) +{ +struct dsaf_drv_priv *priv =hns_dsaf_dev_priv (dsaf_dev); +struct dsaf_drv_soft_mac_tbl *soft_mac_entry; +int i; + + soft_mac_entry = priv->soft_mac_tbl + (DSAF_TCAM_SUM -1 ); +for (i = (DSAF_TCAM_SUM -1 ); i >0 ; i--) { +/* search all entry from end to start.*/ +if (soft_mac_entry->index ==DSAF_INVALID_ENTRY_IDX ) +return i; + soft_mac_entry--; + } +return DSAF_INVALID_ENTRY_IDX ; +} +/** * hns_dsaf_set_mac_key - set mac key * @dsaf_dev: dsa fabric device struct pointer
@@ -2666,58 +2743,156 @@ int hns_dsaf_get_regs_count(void)return DSAF_DUMP_REGS_NUM ; } -/* Reserve the last TCAM entry for promisc support */ -#define dsaf_promisc_tcam_entry (port) \ - (DSAF_TCAM_SUM - DSAFV2_MAC_FUZZY_TCAM_NUM + (port)) -void hns_dsaf_set_promisc_tcam (struct dsaf_device *dsaf_dev, -u32 port,bool enable) +static void set_promisc_tcam_enable (struct dsaf_device *dsaf_dev,u32 port) { +struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0 ,1 ,0 ,0 ,0x80 }; +struct dsaf_tbl_tcam_data tbl_tcam_data_mc = {0x01000000 , port}; +struct dsaf_tbl_tcam_data tbl_tcam_mask_uc = {0x01000000 ,0xf }; +struct dsaf_tbl_tcam_mcast_cfg tbl_tcam_mcast = {0 ,0 , {0 } };struct dsaf_drv_priv *priv =hns_dsaf_dev_priv (dsaf_dev); -struct dsaf_drv_soft_mac_tbl *soft_mac_entry = priv->soft_mac_tbl; -u16 entry_index; -struct dsaf_drv_tbl_tcam_key tbl_tcam_data, tbl_tcam_mask; -struct dsaf_tbl_tcam_mcast_cfg mac_data = {0 }; +struct dsaf_tbl_tcam_data tbl_tcam_data_uc = {0 , port}; +struct dsaf_drv_mac_single_dest_entry mask_entry; +struct dsaf_drv_tbl_tcam_key temp_key, mask_key; +struct dsaf_drv_soft_mac_tbl *soft_mac_entry; +u16 entry_index =DSAF_INVALID_ENTRY_IDX ; +struct dsaf_drv_tbl_tcam_key mac_key; +struct hns_mac_cb *mac_cb; +u8 addr[ETH_ALEN ] = {0 }; +u8 port_num; +u16 mskid; -if ((AE_IS_VER1 (dsaf_dev->dsaf_ver)) ||HNS_DSAF_IS_DEBUG (dsaf_dev)) +/* promisc use vague table match with vlanid = 0 & macaddr = 0 */ +hns_dsaf_set_mac_key (dsaf_dev, &mac_key,0x00 , port, addr); + entry_index =hns_dsaf_find_soft_mac_entry (dsaf_dev, &mac_key); +if (entry_index !=DSAF_INVALID_ENTRY_IDX )return ; -/* find the tcam entry index for promisc */ - entry_index =dsaf_promisc_tcam_entry (port); - -memset (&tbl_tcam_data,0 ,sizeof (tbl_tcam_data)); -memset (&tbl_tcam_mask,0 ,sizeof (tbl_tcam_mask)); - -/* config key mask */ -if (enable) { -dsaf_set_field (tbl_tcam_data.low.bits.port_vlan, -DSAF_TBL_TCAM_KEY_PORT_M , -DSAF_TBL_TCAM_KEY_PORT_S , port); -dsaf_set_field (tbl_tcam_mask.low.bits.port_vlan, -DSAF_TBL_TCAM_KEY_PORT_M , -DSAF_TBL_TCAM_KEY_PORT_S ,0xf ); - -/* SUB_QID */ -dsaf_set_bit (mac_data.tbl_mcast_port_msk[0 ], -DSAF_SERVICE_NW_NUM , true); - mac_data.tbl_mcast_item_vld = true;/* item_vld bit */ +/* put promisc tcam entry in the end. */ +/* 1. set promisc unicast vague tcam entry. */ + entry_index =hns_dsaf_find_empty_mac_entry_reverse (dsaf_dev); +if (entry_index ==DSAF_INVALID_ENTRY_IDX ) { +dev_err (dsaf_dev->dev, +"enable uc promisc failed (port:%#x)\n" , + port); +return ; + } + + mac_cb = dsaf_dev->mac_cb[port]; + (void )hns_mac_get_inner_port_num (mac_cb,0 , &port_num); + tbl_tcam_ucast.tbl_ucast_out_port = port_num; + +/* config uc vague table */ +hns_dsaf_tcam_uc_cfg_vague (dsaf_dev, entry_index, &tbl_tcam_data_uc, + &tbl_tcam_mask_uc, &tbl_tcam_ucast); + +/* update software entry */ + soft_mac_entry = priv->soft_mac_tbl; + soft_mac_entry += entry_index; + soft_mac_entry->index = entry_index; + soft_mac_entry->tcam_key.high.val = mac_key.high.val; + soft_mac_entry->tcam_key.low.val = mac_key.low.val; +/* step back to the START for mc. */ + soft_mac_entry = priv->soft_mac_tbl; + +/* 2. set promisc multicast vague tcam entry. */ + entry_index =hns_dsaf_find_empty_mac_entry_reverse (dsaf_dev); +if (entry_index ==DSAF_INVALID_ENTRY_IDX ) { +dev_err (dsaf_dev->dev, +"enable mc promisc failed (port:%#x)\n" , + port); +return ; + } + +memset (&mask_entry,0x0 ,sizeof (mask_entry)); +memset (&mask_key,0x0 ,sizeof (mask_key)); +memset (&temp_key,0x0 ,sizeof (temp_key)); + mask_entry.addr[0 ] =0x01 ; +hns_dsaf_set_mac_key (dsaf_dev, &mask_key, mask_entry.in_vlan_id, + port, mask_entry.addr); + tbl_tcam_mcast.tbl_mcast_item_vld =1 ; + tbl_tcam_mcast.tbl_mcast_old_en =0 ; + +if (port <DSAF_SERVICE_NW_NUM ) { + mskid = port; + }else if (port >=DSAF_BASE_INNER_PORT_NUM ) { + mskid = port -DSAF_BASE_INNER_PORT_NUM +DSAF_SERVICE_NW_NUM ; }else { - mac_data.tbl_mcast_item_vld = false;/* item_vld bit */ +dev_err (dsaf_dev->dev,"%s,pnum(%d)error,key(%#x:%#x)\n" , + dsaf_dev->ae_dev.name, port, + mask_key.high.val, mask_key.low.val); +return ; } -dev_dbg (dsaf_dev->dev, -"set_promisc_entry, %s Mac key(%#x:%#x) entry_index%d\n" , - dsaf_dev->ae_dev.name, tbl_tcam_data.high.val, - tbl_tcam_data.low.val, entry_index); +dsaf_set_bit (tbl_tcam_mcast.tbl_mcast_port_msk[mskid /32 ], + mskid %32 ,1 ); +memcpy (&temp_key, &mask_key,sizeof (mask_key)); +hns_dsaf_tcam_mc_cfg_vague (dsaf_dev, entry_index, &tbl_tcam_data_mc, + (struct dsaf_tbl_tcam_data *)(&mask_key), + &tbl_tcam_mcast); -/* config promisc entry with mask */ -hns_dsaf_tcam_mc_cfg (dsaf_dev, entry_index, - (struct dsaf_tbl_tcam_data *)&tbl_tcam_data, - (struct dsaf_tbl_tcam_data *)&tbl_tcam_mask, - &mac_data); +/* update software entry */ + soft_mac_entry += entry_index; + soft_mac_entry->index = entry_index; + soft_mac_entry->tcam_key.high.val = temp_key.high.val; + soft_mac_entry->tcam_key.low.val = temp_key.low.val; +} -/* config software entry */ +static void set_promisc_tcam_disable (struct dsaf_device *dsaf_dev,u32 port) +{ +struct dsaf_tbl_tcam_data tbl_tcam_data_mc = {0x01000000 , port}; +struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0 ,0 ,0 ,0 ,0 }; +struct dsaf_tbl_tcam_mcast_cfg tbl_tcam_mcast = {0 ,0 , {0 } }; +struct dsaf_drv_priv *priv =hns_dsaf_dev_priv (dsaf_dev); +struct dsaf_tbl_tcam_data tbl_tcam_data_uc = {0 ,0 }; +struct dsaf_tbl_tcam_data tbl_tcam_mask = {0 ,0 }; +struct dsaf_drv_soft_mac_tbl *soft_mac_entry; +u16 entry_index =DSAF_INVALID_ENTRY_IDX ; +struct dsaf_drv_tbl_tcam_key mac_key; +u8 addr[ETH_ALEN ] = {0 }; + +/* 1. delete uc vague tcam entry. */ +/* promisc use vague table match with vlanid = 0 & macaddr = 0 */ +hns_dsaf_set_mac_key (dsaf_dev, &mac_key,0x00 , port, addr); + entry_index =hns_dsaf_find_soft_mac_entry (dsaf_dev, &mac_key); + +if (entry_index ==DSAF_INVALID_ENTRY_IDX ) +return ; + +/* config uc vague table */ +hns_dsaf_tcam_uc_cfg_vague (dsaf_dev, entry_index, &tbl_tcam_data_uc, + &tbl_tcam_mask, &tbl_tcam_ucast); +/* update soft management table. */ + soft_mac_entry = priv->soft_mac_tbl; soft_mac_entry += entry_index; - soft_mac_entry->index = enable ? entry_index :DSAF_INVALID_ENTRY_IDX ; + soft_mac_entry->index =DSAF_INVALID_ENTRY_IDX ; +/* step back to the START for mc. */ + soft_mac_entry = priv->soft_mac_tbl; + +/* 2. delete mc vague tcam entry. */ + addr[0 ] =0x01 ; +memset (&mac_key,0x0 ,sizeof (mac_key)); +hns_dsaf_set_mac_key (dsaf_dev, &mac_key,0x00 , port, addr); + entry_index =hns_dsaf_find_soft_mac_entry (dsaf_dev, &mac_key); + +if (entry_index ==DSAF_INVALID_ENTRY_IDX ) +return ; + +/* config mc vague table */ +hns_dsaf_tcam_mc_cfg_vague (dsaf_dev, entry_index, &tbl_tcam_data_mc, + &tbl_tcam_mask, &tbl_tcam_mcast); +/* update soft management table. */ + soft_mac_entry += entry_index; + soft_mac_entry->index =DSAF_INVALID_ENTRY_IDX ; +} + +/* Reserve the last TCAM entry for promisc support */ +void hns_dsaf_set_promisc_tcam (struct dsaf_device *dsaf_dev, +u32 port,bool enable) +{ +if (enable) +set_promisc_tcam_enable (dsaf_dev, port); +else +set_promisc_tcam_disable (dsaf_dev, port); }int hns_dsaf_wait_pkt_clean (struct dsaf_device *dsaf_dev,int port)
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 43/59 SUNRPC: Fix a race with XPRT_CONNECTING
In reply to Sasha LevinFrom: Trond Myklebust <[email protected]>
[ Upstream commit cf76785d30712d90185455e752337acdb53d2a5d ]
Ensure that we clear XPRT_CONNECTING before releasing the XPRT_LOCK so that we don't have races between the (asynchronous) socket setup code and tasks in xprt_connect().
--- net/sunrpc/xprtsock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sunrpc/xprtsock.c +2 -2
@@ -2223,8 +2223,8 @@ static void xs_udp_setup_socket(struct work_struct *work)trace_rpc_socket_connect (xprt, sock,0 ); status =0 ; out: -xprt_unlock_connect (xprt, transport);xprt_clear_connecting (xprt); +xprt_unlock_connect (xprt, transport);xprt_wake_pending_tasks (xprt, status); }
@@ -2451,8 +2451,8 @@ static void xs_tcp_setup_socket(struct work_struct *work) } status = -EAGAIN ; out: -xprt_unlock_connect (xprt, transport);xprt_clear_connecting (xprt); +xprt_unlock_connect (xprt, transport);xprt_wake_pending_tasks (xprt, status); }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 44/59 x86/mtrr: Don't copy uninitialized gentry fields back to userspace
In reply to Sasha LevinFrom: Colin Ian King <[email protected]>
[ Upstream commit 32043fa065b51e0b1433e48d118821c71b5cd65d ]
Currently the copy_to_user of data in the gentry struct is copying uninitiaized data in field _pad from the stack to userspace.
Fix this by explicitly memset'ing gentry to zero, this also will zero any compiler added padding fields that may be in struct (currently there are none).
Detected by CoverityScan, CID#200783 ("Uninitialized scalar variable")
--- arch/x86/kernel/cpu/mtrr/if.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kernel/cpu/mtrr/if.c +2 -0
@@ -173,6 +173,8 @@ mtrr_ioctl(struct file *file, unsigned int cmd, unsigned long __arg)struct mtrr_gentry gentry;void __user *arg = (void __user *) __arg; +memset (&gentry,0 ,sizeof (gentry)); +switch (cmd) {case MTRRIOC_ADD_ENTRY :case MTRRIOC_SET_ENTRY :
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 45/59 qed: Fix an error code qed_ll2_start_xmit()
In reply to Sasha LevinFrom: Dan Carpenter <[email protected]>
[ Upstream commit f07d4276892d97671e880190ff195a288b2d8d92 ]
We accidentally deleted the code to set "rc = -ENOMEM;" and this patch adds it back.
--- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/qlogic/qed/qed_ll2.c +1 -0
@@ -2351,6 +2351,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb)if (unlikely (dma_mapping_error (&cdev->pdev->dev, mapping))) {DP_NOTICE (cdev,"Unable to map frag - dropping packet\n" ); + rc = -ENOMEM ; goto err; }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 46/59 net: macb: fix random memory corruption on RX with 64-bit DMA
In reply to Sasha LevinFrom: Anssi Hannula <[email protected]>
[ Upstream commit e100a897bf9b19089e57f236f2398c9e0538900e ]
64-bit DMA addresses are split in upper and lower halves that are written in separate fields on GEM. For RX, bit 0 of the address is used as the ownership bit (RX_USED). When the RX_USED bit is unset the controller is allowed to write data to the buffer.
The driver does not guarantee that the controller already sees the upper half when the RX_USED bit is cleared, possibly resulting in the controller writing an incoming frame to an address with an incorrect upper half and therefore possibly corrupting unrelated system memory.
Fix that by adding the necessary DMA memory barrier between the writes.
This corruption was observed on a ZynqMP based system.
--- drivers/net/ethernet/cadence/macb_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/cadence/macb_main.c +5 -0
@@ -674,6 +674,11 @@ static void macb_set_addr(struct macb *bp, struct macb_dma_desc *desc, dma_addr_if (bp->hw_dma_cap &HW_DMA_CAP_64B ) { desc_64 =macb_64b_desc (bp, desc); desc_64->addrh =upper_32_bits (addr); +/* The low bits of RX address contain the RX_USED bit, clearing +* of which allows packet RX. Make sure the high bits are also +* visible to HW at that point. +*/ +dma_wmb (); }#endif desc->addr =lower_32_bits (addr);
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 47/59 net: macb: fix dropped RX frames due to a race
In reply to Sasha LevinFrom: Anssi Hannula <[email protected]>
[ Upstream commit 8159ecab0db9095902d4c73605fb8787f5c7d653 ]
Bit RX_USED set to 0 in the address field allows the controller to write data to the receive buffer descriptor.
The driver does not ensure the ctrl field is ready (cleared) when the controller sees the RX_USED=0 written by the driver. The ctrl field might only be cleared after the controller has already updated it according to a newly received frame, causing the frame to be discarded in gem_rx() due to unexpected ctrl field contents.
A message is logged when the above scenario occurs:
macb ff0b0000.ethernet eth0: not whole frame pointed by descriptor
Fix the issue by ensuring that when the controller sees RX_USED=0 the ctrl field is already cleared.
This issue was observed on a ZynqMP based system.
--- drivers/net/ethernet/cadence/macb_main.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +7 -2
@@ -922,14 +922,19 @@ static void gem_rx_refill(struct macb *bp)if (entry == bp->rx_ring_size -1 ) paddr |=MACB_BIT (RX_WRAP ); -macb_set_addr (bp, desc, paddr); desc->ctrl =0 ; +/* Setting addr clears RX_USED and allows reception, +* make sure ctrl is cleared first to avoid a race. +*/ +dma_wmb (); +macb_set_addr (bp, desc, paddr);/* properly align Ethernet header */ skb_reserve (skb,NET_IP_ALIGN ); }else { - desc->addr &= ~MACB_BIT (RX_USED ); desc->ctrl =0 ; +dma_wmb (); + desc->addr &= ~MACB_BIT (RX_USED ); } }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 48/59 lan78xx: Resolve issue with changing MAC address
In reply to Sasha LevinFrom: Jason Martinsen <[email protected]>
[ Upstream commit 15515aaaa69659c502003926a2067ee76176148a ]
Current state for the lan78xx driver does not allow for changing the MAC address of the interface, without either removing the module (if you compiled it that way) or rebooting the machine. If you attempt to change the MAC address, ifconfig will show the new address, however, the system/interface will not respond to any traffic using that configuration. A few short-term options to work around this are to unload the module and reload it with the new MAC address, change the interface to "promisc", or reboot with the correct configuration to change the MAC.
This patch enables the ability to change the MAC address via fairly normal means... ifdown <interface>
modify entry in /etc/network/interfaces OR a similar method
ifup <interface>
Then test via any network communication, such as ICMP requests to gateway.
My only test platform for this patch has been a raspberry pi model 3b+.
-----
--- drivers/net/usb/lan78xx.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/usb/lan78xx.c +4 -0
@@ -2212,6 +2212,10 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p) ret =lan78xx_write_reg (dev,RX_ADDRL , addr_lo); ret =lan78xx_write_reg (dev,RX_ADDRH , addr_hi); +/* Added to support MAC address changes */ + ret =lan78xx_write_reg (dev,MAF_LO (0 ), addr_lo); + ret =lan78xx_write_reg (dev,MAF_HI (0 ), addr_hi |MAF_HI_VALID_ ); +return 0 ; }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 49/59 xen/netfront: tolerate frags with no data
In reply to Sasha LevinFrom: Juergen Gross <[email protected]>
[ Upstream commit d81c5054a5d1d4999c7cdead7636b6cd4af83d36 ]
At least old Xen net backends seem to send frags with no real data sometimes. In case such a fragment happens to occur with the frag limit already reached the frontend will BUG currently even if this situation is easily recoverable.
Modify the BUG_ON() condition accordingly.
--- drivers/net/xen-netfront.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/xen-netfront.c +1 -1
@@ -904,7 +904,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,if (skb_shinfo (skb)->nr_frags ==MAX_SKB_FRAGS ) {unsigned int pull_to =NETFRONT_SKB_CB (skb)->pull_to; -BUG_ON (pull_to <=skb_headlen (skb)); +BUG_ON (pull_to <skb_headlen (skb));__pskb_pull_tail (skb, pull_to -skb_headlen (skb)); }if (unlikely (skb_shinfo (skb)->nr_frags >=MAX_SKB_FRAGS )) {
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 50/59 vxge: ensure data0 is initialized in when fetching firmware version information
In reply to Sasha LevinFrom: Colin Ian King <[email protected]>
[ Upstream commit f7db2beb4c2c6cc8111f5ab90fc7363ca91107b6 ]
Currently variable data0 is not being initialized so a garbage value is being passed to vxge_hw_vpath_fw_api and this value is being written to the rts_access_steer_data0 register. There are other occurrances where data0 is being initialized to zero (e.g. in function vxge_hw_upgrade_read_version) so I think it makes sense to ensure data0 is initialized likewise to 0.
Detected by CoverityScan, CID#140696 ("Uninitialized scalar variable")
--- drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/neterion/vxge/vxge-config.c +1 -1
@@ -808,7 +808,7 @@ __vxge_hw_vpath_fw_ver_get(struct __vxge_hw_virtualpath *vpath,struct vxge_hw_device_date *fw_date = &hw_info->fw_date;struct vxge_hw_device_version *flash_version = &hw_info->flash_version;struct vxge_hw_device_date *flash_date = &hw_info->flash_date; -u64 data0, data1 =0 , steer_ctrl =0 ; +u64 data0 =0 , data1 =0 , steer_ctrl =0 ;enum vxge_hw_status status; status = vxge_hw_vpath_fw_api(vpath,
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 51/59 mac80211: free skb fraglist before freeing the skb
In reply to Sasha LevinFrom: Sara Sharon <[email protected]>
[ Upstream commit 34b1e0e9efe101822e83cc62d22443ed3867ae7a ]
mac80211 uses the frag list to build AMSDU. When freeing the skb, it may not be really freed, since someone is still holding a reference to it.
In that case, when TCP skb is being retransmitted, the pointer to the frag list is being reused, while the data in there is no longer valid.
Since we will never get frag list from the network stack, as mac80211 doesn't advertise the capability, we can safely free and nullify it before releasing the SKB.
--- net/mac80211/status.c | 5 +++++ 1 file changed, 5 insertions(+)
net/mac80211/status.c +5 -0
@@ -545,6 +545,11 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local, }ieee80211_led_tx (local); + +if (skb_has_frag_list (skb)) { +kfree_skb_list (skb_shinfo (skb)->frag_list); +skb_shinfo (skb)->frag_list =NULL ; + } }/*
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 52/59 kbuild: fix false positive warning/error about missing libelf
In reply to Sasha LevinFrom: Masahiro Yamada <[email protected]>
[ Upstream commit ef7cfd00b2caf6edeb7f169682b64be2d0a798cf ]
For the same reason as commit 25896d073d8a ("x86/build: Fix compiler support check for CONFIG_RETPOLINE"), you cannot put this $(error ...) into the parse stage of the top Makefile.
Perhaps I'd propose a more sophisticated solution later, but this is the best I can do for now.
--- Makefile | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
Makefile +8 -5
@@ -954,11 +954,6 @@ ifdef CONFIG_STACK_VALIDATION ifeq ($(has_libelf),1) objtool_target := tools/objtool FORCE else - ifdef CONFIG_UNWINDER_ORC - $(error "Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel") - else - $(warning "Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel") - endif SKIP_STACK_VALIDATION := 1 export SKIP_STACK_VALIDATION endif
@@ -1102,6 +1097,14 @@ uapi-asm-generic: PHONY += prepare-objtool prepare-objtool: $(objtool_target) +ifeq ($(SKIP_STACK_VALIDATION),1) +ifdef CONFIG_UNWINDER_ORC + @echo "error: Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2 + @false +else + @echo "warning: Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2 +endif +endif # Check for CONFIG flags that require compiler support. Abort the build # after .config has been processed, but before the kernel build starts.
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 53/59 net/mlx5: Typo fix in del_sw_hw_rule
In reply to Sasha LevinFrom: Yuval Avnery <[email protected]>
[ Upstream commit f0337889147c956721696553ffcc97212b0948fe ]
Expression terminated with "," instead of ";", resulted in set_fte getting bad value for modify_enable_mask field.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +1 -1
@@ -425,7 +425,7 @@ static void del_rule(struct fs_node *node)if ((fte->action &MLX5_FLOW_CONTEXT_ACTION_FWD_DEST ) && --fte->dests_size) { - modify_mask =BIT (MLX5_SET_FTE_MODIFY_ENABLE_MASK_DESTINATION_LIST ), + modify_mask =BIT (MLX5_SET_FTE_MODIFY_ENABLE_MASK_DESTINATION_LIST ); update_fte = true; } out:
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 54/59 virtio: fix test build after uio.h change
In reply to Sasha LevinFrom: "Michael S. Tsirkin" <[email protected]>
[ Upstream commit c5c08bed843c2b2c048c16d1296d7631d7c1620e ]
--- tools/virtio/linux/kernel.h | 4 ++++ 1 file changed, 4 insertions(+)
tools/virtio/linux/kernel.h +4 -0
@@ -23,6 +23,10 @@#define PAGE_MASK (~(PAGE_SIZE-1))#define PAGE_ALIGN (x) ((x + PAGE_SIZE - 1) & PAGE_MASK) +/* generic data direction definitions */ +#define READ 0 +#define WRITE 1 +typedef unsigned long long phys_addr_t ;typedef unsigned long long dma_addr_t ;typedef size_t __kernel_size_t ;
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 55/59 gpio: mvebu: only fail on missing clk if pwm is actually to be used
In reply to Sasha LevinFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit c8da642d41a6811c21177c9994aa7dc35be67d46 ]
The gpio IP on Armada 370 at offset 0x18180 has neither a clk nor pwm registers. So there is no need for a clk as the pwm isn't used anyhow. So only check for the clk in the presence of the pwm registers. This fixes a failure to probe the gpio driver for the above mentioned gpio device.
--- drivers/gpio/gpio-mvebu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpio/gpio-mvebu.c +3 -3
@@ -777,9 +777,6 @@ static int mvebu_pwm_probe(struct platform_device *pdev, "marvell,armada-370-gpio"))return 0 ; -if (IS_ERR (mvchip->clk)) -return PTR_ERR (mvchip->clk); -/* * There are only two sets of PWM configuration registers for * all the GPIO lines on those SoCs which this driver reserves
@@ -790,6 +787,9 @@ static int mvebu_pwm_probe(struct platform_device *pdev,if (!res)return 0 ; +if (IS_ERR (mvchip->clk)) +return PTR_ERR (mvchip->clk); +/* * Use set A for lines of GPIO chip with id 0, B for GPIO chip * with id 1. Don't allow further GPIO chips to be used for PWM.
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 56/59 Input: synaptics - enable SMBus for HP EliteBook 840 G4
In reply to Sasha LevinFrom: Mantas Mikulėnas <[email protected]>
[ Upstream commit 7a71712293ba303aad928f580b89addb0be2892e ]
dmesg reports that "Your touchpad (PNP: SYN3052 SYN0100 SYN0002 PNP0f13) says it can support a different bus."
I've tested the offered psmouse.synaptics_intertouch=1 with 4.18.x and 4.19.x and it seems to work well. No problems seen with suspend/resume.
Also, it appears that RMI/SMBus mode is actually required for 3-4 finger multitouch gestures to work -- otherwise they are not reported at all.
Information from dmesg in both modes:
psmouse serio3: synaptics: Touchpad model: 1, fw: 8.2, id: 0x1e2b1,
caps: 0xf00123/0x840300/0x2e800/0x0, board id: 3139, fw id: 2000742
psmouse serio3: synaptics: Trying to set up SMBus access rmi4_smbus 6-002c: registering SMbus-connected sensor rmi4_f01 rmi4-00.fn01: found RMI device,
manufacturer: Synaptics, product: TM3139-001, fw id: 2000742
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {"LEN0096" ,/* X280 */ "LEN0097" ,/* X280 -> ALPS trackpoint */ "LEN200f" ,/* T450s */ +"SYN3052" ,/* HP EliteBook 840 G4 */ "SYN3221" ,/* HP 15-ay000 */ NULL };
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 57/59 net: netxen: fix a missing check and an uninitialized use
In reply to Sasha LevinFrom: Kangjie Lu <[email protected]>
[ Upstream commit d134e486e831defd26130770181f01dfc6195f7d ]
When netxen_rom_fast_read() fails, "bios" is left uninitialized and may contain random value, thus should not be used.
The fix ensures that if netxen_rom_fast_read() fails, we return "-EIO".
--- drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c +2 -1
@@ -1125,7 +1125,8 @@ netxen_validate_firmware(struct netxen_adapter *adapter)return -EINVAL ; } val =nx_get_bios_version (adapter); -netxen_rom_fast_read (adapter,NX_BIOS_VERSION_OFFSET , (int *)&bios); +if (netxen_rom_fast_read (adapter,NX_BIOS_VERSION_OFFSET , (int *)&bios)) +return -EIO ;if ((__force u32 )val != bios) {dev_err (&pdev->dev,"%s: firmware bios is incompatible\n" , fw_name[fw_type]);
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 58/59 qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup
In reply to Sasha LevinFrom: Daniele Palmas <[email protected]>
[ Upstream commit d667044f49513d55fcfefe4fa8f8d96091782901 ]
This patch fixes qmap header retrieval when modem is configured for dl data aggregation.
--- drivers/net/usb/qmi_wwan.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/net/usb/qmi_wwan.c +8 -7
@@ -151,17 +151,18 @@ static bool qmimux_has_slaves(struct usbnet *dev)static int qmimux_rx_fixup (struct usbnet *dev,struct sk_buff *skb) { -unsigned int len, offset =sizeof (struct qmimux_hdr ); +unsigned int len, offset =0 ;struct qmimux_hdr *hdr;struct net_device *net;struct sk_buff *skbn; +u8 qmimux_hdr_sz =sizeof (*hdr); -while (offset < skb->len) { - hdr = (struct qmimux_hdr *)skb->data; +while (offset + qmimux_hdr_sz < skb->len) { + hdr = (struct qmimux_hdr *)(skb->data + offset); len =be16_to_cpu (hdr->pkt_len);/* drop the packet, bogus length */ -if (offset + len > skb->len) +if (offset + len + qmimux_hdr_sz > skb->len)return 0 ;/* control packet, we do not know what to do */
@@ -176,7 +177,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)return 0 ; skbn->dev = net; -switch (skb->data[offset] &0xf0 ) { +switch (skb->data[offset + qmimux_hdr_sz] &0xf0 ) {case 0x40 : skbn->protocol =htons (ETH_P_IP );break ;
@@ -188,12 +189,12 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb) goto skip; } -skb_put_data (skbn, skb->data + offset, len); +skb_put_data (skbn, skb->data + offset + qmimux_hdr_sz, len);if (netif_rx (skbn) !=NET_RX_SUCCESS )return 0 ; skip: - offset += len +sizeof (struct qmimux_hdr ); + offset += len + qmimux_hdr_sz; }return 1 ; }
Signature · 1 line
2.19.1
Sasha Levin
maintainerPATCH 59/59 serial/sunsu: fix refcount leak
In reply to Sasha LevinFrom: Yangtao Li <[email protected]>
[ Upstream commit d430aff8cd0c57502d873909c184e3b5753f8b88 ]
The function of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller.
su_get_type() doesn't do that. The match node are used as an identifier to compare against the current node, so we can directly drop the refcount after getting the node from the path as it is not used as pointer.
Fix this by use a single variable and drop the refcount right after of_find_node_by_path().
--- drivers/tty/serial/sunsu.c | 31 ++++++++++++++++++++++++++----- 1 file changed, 26 insertions(+), 5 deletions(-)
drivers/tty/serial/sunsu.c +26 -5
@@ -1393,22 +1393,43 @@ static inline struct console *SUNSU_CONSOLE(void)static enum su_type su_get_type (struct device_node *dp) {struct device_node *ap =of_find_node_by_path ("/aliases" ); +enum su_type rc =SU_PORT_PORT ;if (ap) {const char *keyb =of_get_property (ap,"keyboard" ,NULL );const char *ms =of_get_property (ap,"mouse" ,NULL ); +struct device_node *match;if (keyb) { -if (dp ==of_find_node_by_path (keyb)) -return SU_PORT_KBD ; + match =of_find_node_by_path (keyb); + +/* +* The pointer is used as an identifier not +* as a pointer, we can drop the refcount on +* the of__node immediately after getting it. +*/ +of_node_put (match); + +if (dp == match) { + rc =SU_PORT_KBD ; + goto out; + } }if (ms) { -if (dp ==of_find_node_by_path (ms)) -return SU_PORT_MS ; + match =of_find_node_by_path (ms); + +of_node_put (match); + +if (dp == match) { + rc =SU_PORT_MS ; + goto out; + } } } -return SU_PORT_PORT ; +out: +of_node_put (ap); +return rc; }static int su_probe (struct platform_device *op)
Signature · 1 line
2.19.1