1. 27 Jul, 2021 31 commits
    • Arnd Bergmann's avatar
      hamradio: use ndo_siocdevprivate · 25ec92fb
      Arnd Bergmann authored
      hamradio uses a set of private ioctls that do seem to work
      correctly in compat mode, as they only rely on the ifr_data
      pointer.
      
      Move them over to the ndo_siocdevprivate callback as a cleanup.
      
      Cc: Thomas Sailer <t.sailer@alumni.ethz.ch>
      Cc: Joerg Reuter <jreuter@yaina.de>
      Cc: Jean-Paul Roubelat <jpr@f6fbb.org>
      Cc: linux-hams@vger.kernel.org
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      25ec92fb
    • Arnd Bergmann's avatar
      cxgb3: use ndo_siocdevprivate · ebb4a911
      Arnd Bergmann authored
      cxgb3 has a private multiplexor that works correctly in compat
      mode, split out the siocdevprivate callback from do_ioctl for
      simplification.
      
      Cc: Raju Rangoju <rajur@chelsio.com>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ebb4a911
    • Arnd Bergmann's avatar
      qeth: use ndo_siocdevprivate · 18787eee
      Arnd Bergmann authored
      qeth has both standard MII ioctls and custom SIOCDEVPRIVATE ones,
      all of which work correctly with compat user space.
      
      Move the private ones over to the new ndo_siocdevprivate callback.
      
      Cc: Julian Wiedmann <jwi@linux.ibm.com>
      Cc: Karsten Graul <kgraul@linux.ibm.com>
      Cc: Heiko Carstens <hca@linux.ibm.com>
      Cc: Vasily Gorbik <gor@linux.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: linux-s390@vger.kernel.org
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      18787eee
    • Arnd Bergmann's avatar
      slip/plip: use ndo_siocdevprivate · 76b5878c
      Arnd Bergmann authored
      slip and plip both use a couple of SIOCDEVPRIVATE ioctl
      commands that overload the ifreq layout in a way that is
      incompatible with compat mode.
      
      Convert to use ndo_siocdevprivate to allow passing the
      data this way, but return an error in compat mode anyway
      because the private structure is still incompatible.
      
      This could be fixed as well to make compat work properly.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      76b5878c
    • Arnd Bergmann's avatar
      net: usb: use ndo_siocdevprivate · ef1b5b0c
      Arnd Bergmann authored
      The pegasus and rtl8150 drivers use SIOCDEVPRIVATE ioctls
      to access their MII registers, in place of the normal
      commands. This is broken for all compat ioctls today.
      
      Change to ndo_siocdevprivate to fix it.
      
      Cc: Petko Manolov <petkan@nucleusys.com>
      Cc: linux-usb@vger.kernel.org
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef1b5b0c
    • Arnd Bergmann's avatar
      fddi: use ndo_siocdevprivate · 043393d8
      Arnd Bergmann authored
      The skfddi driver has a private ioctl and passes the data correctly
      through ifr_data, but the use of a pointer in s_skfp_ioctl is
      broken in compat mode.
      
      Change the driver to use ndo_siocdevprivate and disallow calling
      it in compat mode until a conversion handler is added.
      
      Cc: "Maciej W. Rozycki" <macro@orcam.me.uk>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      043393d8
    • Arnd Bergmann's avatar
      eql: use ndo_siocdevprivate · d92f7b59
      Arnd Bergmann authored
      The private ioctls in eql pass the arguments correctly through ifr_data,
      but the slaving_request_t and slave_config_t structures are incompatible
      with compat mode and need special conversion code in the driver.
      
      Convert to siocdevprivate for now, and return an error when called
      in compat mode.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d92f7b59
    • Arnd Bergmann's avatar
      tehuti: use ndo_siocdevprivate · 32d05468
      Arnd Bergmann authored
      Tehuti only implements private ioctl commands, and implements
      them by overriding the ifreq layout, which is broken in
      compat mode.
      
      Move it to the ndo_siocdevprivate callback in order to fix this.
      
      Cc: Andy Gospodarek <andy@greyhouse.net>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      32d05468
    • Arnd Bergmann's avatar
      hamachi: use ndo_siocdevprivate · 99b78a37
      Arnd Bergmann authored
      hamachi has one command that overloads the ifreq argument
      and requires a conversion to ndo_siocdevprivate in order to
      make compat mode work, so split it from ndo_ioctl.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      99b78a37
    • Arnd Bergmann's avatar
      appletalk: use ndo_siocdevprivate · dbecb011
      Arnd Bergmann authored
      appletalk has three SIOCDEVPRIVATE ioctl commands that are
      broken in compat mode because the passed structure contains
      a pointer.
      
      Change it over to ndo_siocdevprivate for consistency and
      make it return an error when called in compat mode. This
      could be fixed if there are still users.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dbecb011
    • Arnd Bergmann's avatar
      bonding: use siocdevprivate · 232ec98e
      Arnd Bergmann authored
      The bonding driver supports two command codes for each operation: one
      in the SIOCDEVPRIVATE range and another one with the same definition
      but a unique command code.
      
      Only the second set currently works in compat mode, as the ifr_data
      expansion overwrites part of the ifr_slave field.
      
      Move the private ones into ndo_siocdevprivate and change the
      implementation to call the other function.  This makes both version
      work correctly.
      
      Cc: Jay Vosburgh <j.vosburgh@gmail.com>
      Cc: Veaceslav Falico <vfalico@gmail.com>
      Cc: Andy Gospodarek <andy@greyhouse.net>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      232ec98e
    • Arnd Bergmann's avatar
      tulip: use ndo_siocdevprivate · 029a4fef
      Arnd Bergmann authored
      The tulip driver has a debugging method over ioctl built-in, but it
      does not actually check the command type, which may end up leading
      to random behavior when trying to run other ioctls on it.
      
      Change the driver to use ndo_siocdevprivate and limit the execution
      further to the first private command code. If anyone still has tools
      to run these debugging commands, they might have to be patched for
      it if they pass different ioctl command.
      
      The function has existed in this form since the driver was merged in
      Linux-1.1.86.
      
      Cc: linux-parisc@vger.kernel.org
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      029a4fef
    • Arnd Bergmann's avatar
      phonet: use siocdevprivate · 4747c1a8
      Arnd Bergmann authored
      phonet has a single private ioctl that is broken in compat
      mode on big-endian machines today because the data returned
      from it is never copied back to user space.
      
      Move it over to the ndo_siocdevprivate callback, which also
      fixes the compat issue.
      
      Cc: Remi Denis-Courmont <courmisch@gmail.com>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarRémi Denis-Courmont <courmisch@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4747c1a8
    • Arnd Bergmann's avatar
      bridge: use ndo_siocdevprivate · 561d8352
      Arnd Bergmann authored
      The bridge driver has an old set of ioctls using the SIOCDEVPRIVATE
      namespace that have never worked in compat mode and are explicitly
      forbidden already.
      
      Move them over to ndo_siocdevprivate and fix compat mode for these,
      because we can.
      
      Cc: Roopa Prabhu <roopa@nvidia.com>
      Cc: Nikolay Aleksandrov <nikolay@nvidia.com>
      Cc: bridge@lists.linux-foundation.org
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      561d8352
    • Arnd Bergmann's avatar
      hostap: use ndo_siocdevprivate · 3f3fa534
      Arnd Bergmann authored
      hostap has a combination of iwpriv ioctls that do not work at
      all, and two SIOCDEVPRIVATE commands that work natively but
      lack a compat conversion handler.
      
      For the moment, move them over to the new ndo_siocdevprivate
      interface and return an error for compat mode.
      
      Cc: Jouni Malinen <j@w1.fi>
      Cc: Kalle Valo <kvalo@codeaurora.org>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3f3fa534
    • Arnd Bergmann's avatar
      staging: wlan-ng: use siocdevprivate · 3343c49a
      Arnd Bergmann authored
      wlan-ng has two private ioctls that correctly work in compat
      mode. Move these over to the new ndo_siocdevprivate mechanism.
      
      The p80211netdev_ethtool() function is commented out and
      has no use here, so this can be removed
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3343c49a
    • Arnd Bergmann's avatar
      staging: rtlwifi: use siocdevprivate · 89939e89
      Arnd Bergmann authored
      rtl8188eu has an "android private" ioctl command multiplexer
      that is not currently safe for use in compat mode because
      of its triple-indirect pointer.
      
      rtl8723bs uses a different interface on the SIOCDEVPRIVATE
      command, based on the iwpriv data structure
      
      Both also have normal unreachable iwpriv commands, and all
      of the above should probably just get removed. For the
      moment, just switch over to the new interface.
      
      Cc: Larry Finger <Larry.Finger@lwfinger.net>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      89939e89
    • Arnd Bergmann's avatar
      net: split out SIOCDEVPRIVATE handling from dev_ioctl · b9067f5d
      Arnd Bergmann authored
      SIOCDEVPRIVATE ioctl commands are mainly used in really old
      drivers, and they have a number of problems:
      
      - They hide behind the normal .ndo_do_ioctl function that
        is also used for other things in modern drivers, so it's
        hard to spot a driver that actually uses one of these
      
      - Since drivers use a number different calling conventions,
        it is impossible to support compat mode for them in
        a generic way.
      
      - With all drivers using the same 16 commands codes, there
        is no way to introspect the data being passed through
        things like strace.
      
      Add a new net_device_ops callback pointer, to address the
      first two of these. Separating them from .ndo_do_ioctl
      makes it easy to grep for drivers with a .ndo_siocdevprivate
      callback, and the unwieldy name hopefully makes it easier
      to spot in code review.
      
      By passing the ifreq structure and the ifr_data pointer
      separately, it is no longer necessary to overload these,
      and the driver can use either one for a given command.
      
      Cc: Cong Wang <cong.wang@bytedance.com>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b9067f5d
    • David S. Miller's avatar
      Merge branch 'tcp-rack' · 2fba2eae
      David S. Miller authored
      Neal Cardwell says:
      
      ====================
      more accurate DSACK processing for RACK-TLP
      
      This patch series includes two minor improvements to tighten up the accuracy of
      the processing of incoming DSACK information, so that RACK-TLP behavior is
      faster and more precise: first, to ensure we detect packet loss in some extra
      corner cases; and second, to avoid growing the RACK reordering window (and
      delaying fast recovery) in cases where it seems clear we don't need to.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2fba2eae
    • Neal Cardwell's avatar
      tcp: more accurately check DSACKs to grow RACK reordering window · a657db03
      Neal Cardwell authored
      Previously, a DSACK could expand the RACK reordering window when no
      reordering has been seen, and/or when the DSACK was due to an
      unnecessary TLP retransmit (rather than a spurious fast recovery due
      to reordering). This could result in unnecessarily growing the RACK
      reordering window and thus unnecessarily delaying RACK-based fast
      recovery episodes.
      
      To avoid these issues, this commit tightens the conditions under which
      a DSACK triggers the RACK reordering window to grow, so that a
      connection only expands its RACK reordering window if:
      
      (a) reordering has been seen in the connection
      (b) a DSACKed range does not match the most recent TLP retransmit
      Signed-off-by: default avatarNeal Cardwell <ncardwell@google.com>
      Acked-by: default avatarYuchung Cheng <ycheng@google.com>
      Acked-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a657db03
    • Yuchung Cheng's avatar
      tcp: more accurately detect spurious TLP probes · 63f367d9
      Yuchung Cheng authored
      Previously TLP is considered spurious if the sender receives any
      DSACK during a TLP episode. This patch further checks the DSACK
      sequences match the TLP's to improve accuracy.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
      Acked-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      63f367d9
    • Tonghao Zhang's avatar
      qdisc: add new field for qdisc_enqueue tracepoint · 409f386b
      Tonghao Zhang authored
      qdisc_enqueue tracepoint can work with qdisc:qdisc_dequeue
      to measure packets latency in qdisc queues.
      
      Add a new field txq for it, then we can retrieve more info.
      Signed-off-by: default avatarTonghao Zhang <xiangxia.m.yue@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      409f386b
    • Jason Wang's avatar
      net: qed: remove unneeded return variables · ef17e2ac
      Jason Wang authored
      Some return variables are never changed until function returned.
      These variables are unneeded for their functions. Therefore, the
      unneeded return variables can be removed safely by returning their
      initial values.
      Signed-off-by: default avatarJason Wang <wangborong@cdjrlc.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef17e2ac
    • Ioana Ciornei's avatar
      docs: networking: dpaa2: add documentation for the switch driver · d4b996f9
      Ioana Ciornei authored
      Add a documentation entry for the DPAA2 switch listing its
      requirements, features and some examples to go along them.
      Signed-off-by: default avatarIoana Ciornei <ioana.ciornei@nxp.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d4b996f9
    • David S. Miller's avatar
      Merge branch 'ovs-upcall-issues' · 453a343c
      David S. Miller authored
      Mark Gray says:
      
      ====================
      openvswitch: per-cpu upcall patchwork issues
      
      Some issues were raised by patchwork at:
      https://patchwork.kernel.org/project/netdevbpf/patch/20210630095350.817785-1-mark.d.gray@redhat.com/#24285159
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      453a343c
    • Mark Gray's avatar
      openvswitch: fix sparse warning incorrect type · 076999e4
      Mark Gray authored
      fix incorrect type in argument 1 (different address spaces)
      
      ../net/openvswitch/datapath.c:169:17: warning: incorrect type in argument 1 (different address spaces)
      ../net/openvswitch/datapath.c:169:17:    expected void const *
      ../net/openvswitch/datapath.c:169:17:    got struct dp_nlsk_pids [noderef] __rcu *upcall_portids
      
      Found at: https://patchwork.kernel.org/project/netdevbpf/patch/20210630095350.817785-1-mark.d.gray@redhat.com/#24285159Signed-off-by: default avatarMark Gray <mark.d.gray@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      076999e4
    • Mark Gray's avatar
      openvswitch: fix alignment issues · 784dcfa5
      Mark Gray authored
      Signed-off-by: default avatarMark Gray <mark.d.gray@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      784dcfa5
    • Mark Gray's avatar
      e4252cb6
    • Yajun Deng's avatar
      net: netlink: add the case when nlh is NULL · f9b282b3
      Yajun Deng authored
      Add the case when nlh is NULL in nlmsg_report(),
      so that the caller doesn't need to deal with this case.
      Signed-off-by: default avatarYajun Deng <yajun.deng@linux.dev>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f9b282b3
    • Vladimir Oltean's avatar
      net: build all switchdev drivers as modules when the bridge is a module · b0e81817
      Vladimir Oltean authored
      Currently, all drivers depend on the bool CONFIG_NET_SWITCHDEV, but only
      the drivers that call some sort of function exported by the bridge, like
      br_vlan_enabled() or whatever, have an extra dependency on CONFIG_BRIDGE.
      
      Since the blamed commit, all switchdev drivers have a functional
      dependency upon switchdev_bridge_port_{,un}offload(), which is a pair of
      functions exported by the bridge module and not by the bridge-independent
      part of CONFIG_NET_SWITCHDEV.
      
      Problems appear when we have:
      
      CONFIG_BRIDGE=m
      CONFIG_NET_SWITCHDEV=y
      CONFIG_TI_CPSW_SWITCHDEV=y
      
      because cpsw, am65_cpsw and sparx5 will then be built-in but they will
      call a symbol exported by a loadable module. This is not possible and
      will result in the following build error:
      
      drivers/net/ethernet/ti/cpsw_new.o: in function `cpsw_netdevice_event':
      drivers/net/ethernet/ti/cpsw_new.c:1520: undefined reference to
      					`switchdev_bridge_port_offload'
      drivers/net/ethernet/ti/cpsw_new.c:1537: undefined reference to
      					`switchdev_bridge_port_unoffload'
      
      As mentioned, the other switchdev drivers don't suffer from this because
      switchdev_bridge_port_offload() is not the first symbol exported by the
      bridge that they are calling, so they already needed to deal with this
      in the same way.
      
      Fixes: 2f5dc00f ("net: bridge: switchdev: let drivers inform which bridge ports are offloaded")
      Reported-by: default avatarLinux Kernel Functional Testing <lkft@linaro.org>
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b0e81817
    • Saeed Mahameed's avatar
      ethtool: Fix rxnfc copy to user buffer overflow · 9b29a161
      Saeed Mahameed authored
      In the cited commit, copy_to_user() got called with the wrong pointer,
      instead of passing the actual buffer ptr to copy from, a pointer to
      the pointer got passed, which causes a buffer overflow calltrace to pop
      up when executing "ethtool -x ethX".
      
      Fix ethtool_rxnfc_copy_to_user() to use the rxnfc pointer as passed
      to the function, instead of a pointer to it.
      
      This fixes below call trace:
      [   15.533533] ------------[ cut here ]------------
      [   15.539007] Buffer overflow detected (8 < 192)!
      [   15.544110] WARNING: CPU: 3 PID: 1801 at include/linux/thread_info.h:200 copy_overflow+0x15/0x20
      [   15.549308] Modules linked in:
      [   15.551449] CPU: 3 PID: 1801 Comm: ethtool Not tainted 5.14.0-rc2+ #1058
      [   15.553919] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
      [   15.558378] RIP: 0010:copy_overflow+0x15/0x20
      [   15.560648] Code: e9 7c ff ff ff b8 a1 ff ff ff eb c4 66 0f 1f 84 00 00 00 00 00 55 48 89 f2 89 fe 48 c7 c7 88 55 78 8a 48 89 e5 e8 06 5c 1e 00 <0f> 0b 5d c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 55
      [   15.565114] RSP: 0018:ffffad49c0523bd0 EFLAGS: 00010286
      [   15.566231] RAX: 0000000000000000 RBX: 00000000000000c0 RCX: 0000000000000000
      [   15.567616] RDX: 0000000000000001 RSI: ffffffff8a7912e7 RDI: 00000000ffffffff
      [   15.569050] RBP: ffffad49c0523bd0 R08: ffffffff8ab2ae28 R09: 00000000ffffdfff
      [   15.570534] R10: ffffffff8aa4ae40 R11: ffffffff8aa4ae40 R12: 0000000000000000
      [   15.571899] R13: 00007ffd4cc2a230 R14: ffffad49c0523c00 R15: 0000000000000000
      [   15.573584] FS:  00007f538112f740(0000) GS:ffff96d5bdd80000(0000) knlGS:0000000000000000
      [   15.575639] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   15.577092] CR2: 00007f5381226d40 CR3: 0000000013542000 CR4: 00000000001506e0
      [   15.578929] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [   15.580695] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [   15.582441] Call Trace:
      [   15.582970]  ethtool_rxnfc_copy_to_user+0x30/0x46
      [   15.583815]  ethtool_get_rxnfc.cold+0x23/0x2b
      [   15.584584]  dev_ethtool+0x29c/0x25f0
      [   15.585286]  ? security_netlbl_sid_to_secattr+0x77/0xd0
      [   15.586728]  ? do_set_pte+0xc4/0x110
      [   15.587349]  ? _raw_spin_unlock+0x18/0x30
      [   15.588118]  ? __might_sleep+0x49/0x80
      [   15.588956]  dev_ioctl+0x2c1/0x490
      [   15.589616]  sock_ioctl+0x18e/0x330
      [   15.591143]  __x64_sys_ioctl+0x41c/0x990
      [   15.591823]  ? irqentry_exit_to_user_mode+0x9/0x20
      [   15.592657]  ? irqentry_exit+0x33/0x40
      [   15.593308]  ? exc_page_fault+0x32f/0x770
      [   15.593877]  ? exit_to_user_mode_prepare+0x3c/0x130
      [   15.594775]  do_syscall_64+0x35/0x80
      [   15.595397]  entry_SYSCALL_64_after_hwframe+0x44/0xae
      [   15.596037] RIP: 0033:0x7f5381226d4b
      [   15.596492] Code: 0f 1e fa 48 8b 05 3d b1 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 0d b1 0c 00 f7 d8 64 89 01 48
      [   15.598743] RSP: 002b:00007ffd4cc2a1f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      [   15.599804] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5381226d4b
      [   15.600795] RDX: 00007ffd4cc2a350 RSI: 0000000000008946 RDI: 0000000000000003
      [   15.601712] RBP: 00007ffd4cc2a340 R08: 00007ffd4cc2a350 R09: 0000000000000001
      [   15.602751] R10: 00007f538128a990 R11: 0000000000000246 R12: 0000000000000000
      [   15.603882] R13: 00007ffd4cc2a350 R14: 00007ffd4cc2a4b0 R15: 0000000000000000
      [   15.605042] ---[ end trace 325cf185e2795048 ]---
      
      Fixes: dd98d289 ("ethtool: improve compat ioctl handling")
      Reported-by: default avatarShannon Nelson <snelson@pensando.io>
      CC: Arnd Bergmann <arnd@arndb.de>
      CC: Christoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
      Tested-by: default avatarShannon Nelson <snelson@pensando.io>
      Acked-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9b29a161
  2. 26 Jul, 2021 9 commits
    • David S. Miller's avatar
      Merge branch 'ipa-clock' · 268ca412
      David S. Miller authored
      Alex Elder says:
      
      ====================
      net: ipa: defer taking uC proxy clock
      
      This series rearranges some of the IPA initialization code.
      
      The first patch gets rid of two trivial setup and teardown
      functions, open-coding them in their callers instead.
      
      The second patch has memory regions get configured before endpoints.
      
      IPA interrupts do not depend on GSI being initialized.  Therefore
      they can be initialized in the config phase rather than waiting for
      setup.  The third patch moves this initialization earlier; memory
      regions must already be defined, so it's done after memory config.
      
      The microcontroller also has no dependency on GSI, though it does
      require IPA interrupts to be configured.  The fourth patch moves
      microcontroller initialization so it too happens during the config
      phase rather than setup.
      
      Finally, we currently take a "proxy clock" for the microcontroller
      during the config phase, dropping it only after we learn the
      microcontroller is initialized.  But microcontroller initialization
      is started by the modem, so there's no point in taking that clock
      reference before we know the modem has booted.  So the last patch
      arranges to wait to take the "proxy clock" for the microcontroller
      until we know the modem is about to boot.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      268ca412
    • Alex Elder's avatar
      net: ipa: introduce ipa_uc_clock() · e2f154e6
      Alex Elder authored
      The first time it's booted, the modem loads and starts the
      IPA-resident microcontroller.  Once the microcontroller has
      completed its initialization, it notifies the AP it's "ready"
      by sending an INIT_COMPLETED response message.
      
      Until it receives that microcontroller message, the AP must ensure
      the IPA core clock remains operational.  Currently, a "proxy" clock
      reference is taken in ipa_uc_config(), dropping it again once the
      message is received.
      
      However there could be a long delay between when ipa_config()
      completes and when modem actually starts.  And because the
      microcontroller gets loaded by the modem, there's no need to
      get the modem "proxy clock" until the first time it starts.
      
      Create a new function ipa_uc_clock() which takes the "proxy" clock
      reference for the microcontroller.  Call it when we get remoteproc
      SSR notification that the modem is about to start.  Keep an
      additional flag to record whether this proxy clock reference needs
      to be dropped at shutdown time, and issue a warning if we get the
      microcontroller message either before the clock reference is taken,
      or after it has already been dropped.
      
      Drop the nearby use of "hh" length modifiers, which are no longer
      encouraged in the kernel.
      Signed-off-by: default avatarAlex Elder <elder@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e2f154e6
    • Alex Elder's avatar
      net: ipa: set up the microcontroller earlier · dc8f7e39
      Alex Elder authored
      Initializing up the IPA-resident microcontroller requires the IPA
      clock, and sets up two IPA interrupt handlers, but this does not
      require GSI access.  The interrupt handlers also require the clock
      to be enabled, and require the IPA memory regions to be configured,
      but neither requires GSI access.  As a result, the microcontroller
      can be initialized during the "config" rather than "setup" phase of
      IPA initialization.
      
      Initialize the microcontroller in ipa_config() rather than
      ipa_setup(), and rename the called function ipa_uc_config().
      Do the inverse in ipa_deconfig() rather than ipa_teardown(),
      and rename the function for that case ipa_uc_deconfig().
      Signed-off-by: default avatarAlex Elder <elder@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dc8f7e39
    • Alex Elder's avatar
      net: ipa: set up IPA interrupts earlier · 1118a147
      Alex Elder authored
      Initialization of the IPA driver has several phases:
         - "init" phase can be done without any access to IPA hardware
         - "config" phase requires the IPA hardware to be clocked
         - "setup" phase requires the GSI layer to be functional
      
      Currently, initialization for the IPA interrupt handling code occurs
      in the setup phase.  It requires access to the IPA hardware but does
      not need GSI, so it can be moved to the config phase instead.
      
      Call the interrupt configuration function early in ipa_config()
      rather than from ipa_setup().  Rename ipa_interrupt_setup() to be
      ipa_interrupt_config(), and ipa_interrupt_teardown() to be
      ipa_interupt_deconfig(), so their names properly indicate when
      they get called.
      Signed-off-by: default avatarAlex Elder <elder@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1118a147
    • Alex Elder's avatar
      net: ipa: configure memory regions early · 07e1f689
      Alex Elder authored
      IPA-resident memory is one of the most primitive resources that
      needs initialization, so call init_mem_config() early in
      ipa_config().
      
      This is in preparation for initializing the IPA-resident
      microcontroller earlier.
      Signed-off-by: default avatarAlex Elder <elder@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      07e1f689
    • Alex Elder's avatar
      net: ipa: kill ipa_modem_setup() · 63961f54
      Alex Elder authored
      The functions ipa_modem_setup() and ipa_modem_teardown() are trivial
      wrappers that call ipa_qmi_setup() and ipa_qmi_teardown().  Just
      call the QMI functions directly, and get rid of the wrappers.
      
      Improve the documentation of what setting up QMI does.
      Signed-off-by: default avatarAlex Elder <elder@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      63961f54
    • Gustavo A. R. Silva's avatar
      flow_dissector: Fix out-of-bounds warnings · 323e0cb4
      Gustavo A. R. Silva authored
      Fix the following out-of-bounds warnings:
      
          net/core/flow_dissector.c: In function '__skb_flow_dissect':
      >> net/core/flow_dissector.c:1104:4: warning: 'memcpy' offset [24, 39] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'struct in6_addr' at offset 8 [-Warray-bounds]
           1104 |    memcpy(&key_addrs->v6addrs, &iph->saddr,
                |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           1105 |           sizeof(key_addrs->v6addrs));
                |           ~~~~~~~~~~~~~~~~~~~~~~~~~~~
          In file included from include/linux/ipv6.h:5,
                           from net/core/flow_dissector.c:6:
          include/uapi/linux/ipv6.h:133:18: note: subobject 'saddr' declared here
            133 |  struct in6_addr saddr;
                |                  ^~~~~
      >> net/core/flow_dissector.c:1059:4: warning: 'memcpy' offset [16, 19] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 12 [-Warray-bounds]
           1059 |    memcpy(&key_addrs->v4addrs, &iph->saddr,
                |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           1060 |           sizeof(key_addrs->v4addrs));
                |           ~~~~~~~~~~~~~~~~~~~~~~~~~~~
          In file included from include/linux/ip.h:17,
                           from net/core/flow_dissector.c:5:
          include/uapi/linux/ip.h:103:9: note: subobject 'saddr' declared here
            103 |  __be32 saddr;
                |         ^~~~~
      
      The problem is that the original code is trying to copy data into a
      couple of struct members adjacent to each other in a single call to
      memcpy().  So, the compiler legitimately complains about it. As these
      are just a couple of members, fix this by copying each one of them in
      separate calls to memcpy().
      
      This helps with the ongoing efforts to globally enable -Warray-bounds
      and get us closer to being able to tighten the FORTIFY_SOURCE routines
      on memcpy().
      
      Link: https://github.com/KSPP/linux/issues/109Reported-by: default avatarkernel test robot <lkp@intel.com>
      Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/Signed-off-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      323e0cb4
    • Gustavo A. R. Silva's avatar
      ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() · 6321c7ac
      Gustavo A. R. Silva authored
      Fix the following out-of-bounds warning:
      
          In function 'ip_copy_addrs',
              inlined from '__ip_queue_xmit' at net/ipv4/ip_output.c:517:2:
      net/ipv4/ip_output.c:449:2: warning: 'memcpy' offset [40, 43] from the object at 'fl' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 36 [-Warray-bounds]
            449 |  memcpy(&iph->saddr, &fl4->saddr,
                |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            450 |         sizeof(fl4->saddr) + sizeof(fl4->daddr));
                |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      The problem is that the original code is trying to copy data into a
      couple of struct members adjacent to each other in a single call to
      memcpy(). This causes a legitimate compiler warning because memcpy()
      overruns the length of &iph->saddr and &fl4->saddr. As these are just
      a couple of struct members, fix this by using direct assignments,
      instead of memcpy().
      
      This helps with the ongoing efforts to globally enable -Warray-bounds
      and get us closer to being able to tighten the FORTIFY_SOURCE routines
      on memcpy().
      
      Link: https://github.com/KSPP/linux/issues/109Reported-by: default avatarkernel test robot <lkp@intel.com>
      Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/Signed-off-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6321c7ac
    • Alex Elder's avatar
      net: ipa: enable inline checksum offload for IPA v4.5+ · 22171146
      Alex Elder authored
      The RMNet and IPA drivers both support inline checksum offload now.
      So enable it for the TX and RX modem endoints for IPA version 4.5+.
      Signed-off-by: default avatarAlex Elder <elder@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      22171146