Commit e8c127b0 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-6.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Paolo Abeni:
 "Including fixes from CAN and BPF.

  We have a regression in TC currently under investigation, otherwise
  the things that stand off most are probably the TCP and AF_PACKET
  fixes, with both issues coming from 6.5.

  Previous releases - regressions:

   - af_packet: fix fortified memcpy() without flex array.

   - tcp: fix crashes trying to free half-baked MTU probes

   - xdp: fix zero-size allocation warning in xskq_create()

   - can: sja1000: always restart the tx queue after an overrun

   - eth: mlx5e: again mutually exclude RX-FCS and RX-port-timestamp

   - eth: nfp: avoid rmmod nfp crash issues

   - eth: octeontx2-pf: fix page pool frag allocation warning

  Previous releases - always broken:

   - mctp: perform route lookups under a RCU read-side lock

   - bpf: s390: fix clobbering the caller's backchain in the trampoline

   - phy: lynx-28g: cancel the CDR check work item on the remove path

   - dsa: qca8k: fix qca8k driver for Turris 1.x

   - eth: ravb: fix use-after-free issue in ravb_tx_timeout_work()

   - eth: ixgbe: fix crash with empty VF macvlan list"

* tag 'net-6.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (54 commits)
  rswitch: Fix imbalance phy_power_off() calling
  rswitch: Fix renesas_eth_sw_remove() implementation
  octeontx2-pf: Fix page pool frag allocation warning
  nfc: nci: assert requested protocol is valid
  af_packet: Fix fortified memcpy() without flex array.
  net: tcp: fix crashes trying to free half-baked MTU probes
  net/smc: Fix pos miscalculation in statistics
  nfp: flower: avoid rmmod nfp crash issues
  net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
  ethtool: Fix mod state of verbose no_mask bitset
  net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  mctp: perform route lookups under a RCU read-side lock
  net: skbuff: fix kernel-doc typos
  s390/bpf: Fix unwinding past the trampoline
  s390/bpf: Fix clobbering the caller's backchain in the trampoline
  net/mlx5e: Again mutually exclude RX-FCS and RX-port-timestamp
  net/smc: Fix dependency of SMC on ISM
  ixgbe: fix crash with empty VF macvlan list
  net/mlx5e: macsec: use update_pn flag instead of PN comparation
  net: phy: mscc: macsec: reject PN update requests
  ...
parents 9a5a1494 b91e8403

arch/arm64/boot/dts/freescale/imx93.dtsi

+3 −1
Original line number Diff line number Diff line
@@ -185,7 +185,7 @@ 
			#size-cells = <1>;

			ranges;



			anomix_ns_gpr: syscon@44210000 {

			aonmix_ns_gpr: syscon@44210000 {

				compatible = "fsl,imx93-aonmix-ns-syscfg", "syscon";

				reg = <0x44210000 0x1000>;

			};
@@ -319,6 +319,7 @@ 
				assigned-clock-parents = <&clk IMX93_CLK_SYS_PLL_PFD1_DIV2>;

				assigned-clock-rates = <40000000>;

				fsl,clk-source = /bits/ 8 <0>;

				fsl,stop-mode = <&aonmix_ns_gpr 0x14 0>;

				status = "disabled";

			};
@@ -591,6 +592,7 @@ 
				assigned-clock-parents = <&clk IMX93_CLK_SYS_PLL_PFD1_DIV2>;

				assigned-clock-rates = <40000000>;

				fsl,clk-source = /bits/ 8 <0>;

				fsl,stop-mode = <&wakeupmix_gpr 0x0c 2>;

				status = "disabled";

			};

arch/riscv/net/bpf_jit_comp64.c

+12 −6
Original line number Diff line number Diff line
@@ -245,7 +245,7 @@ static void __build_epilogue(bool is_tail_call, struct rv_jit_context *ctx) 
	emit_addi(RV_REG_SP, RV_REG_SP, stack_adjust, ctx);

	/* Set return value. */

	if (!is_tail_call)

		emit_mv(RV_REG_A0, RV_REG_A5, ctx);

		emit_addiw(RV_REG_A0, RV_REG_A5, 0, ctx);

	emit_jalr(RV_REG_ZERO, is_tail_call ? RV_REG_T3 : RV_REG_RA,

		  is_tail_call ? (RV_FENTRY_NINSNS + 1) * 4 : 0, /* skip reserved nops and TCC init */

		  ctx);
@@ -759,8 +759,10 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of 
	if (ret)

		return ret;



	if (save_ret)

		emit_sd(RV_REG_FP, -retval_off, regmap[BPF_REG_0], ctx);

	if (save_ret) {

		emit_sd(RV_REG_FP, -retval_off, RV_REG_A0, ctx);

		emit_sd(RV_REG_FP, -(retval_off - 8), regmap[BPF_REG_0], ctx);

	}



	/* update branch with beqz */

	if (ctx->insns) {
@@ -853,7 +855,7 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, 


	save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);

	if (save_ret) {

		stack_size += 8;

		stack_size += 16; /* Save both A5 (BPF R0) and A0 */

		retval_off = stack_size;

	}
@@ -957,6 +959,7 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, 
		if (ret)

			goto out;

		emit_sd(RV_REG_FP, -retval_off, RV_REG_A0, ctx);

		emit_sd(RV_REG_FP, -(retval_off - 8), regmap[BPF_REG_0], ctx);

		im->ip_after_call = ctx->insns + ctx->ninsns;

		/* 2 nops reserved for auipc+jalr pair */

		emit(rv_nop(), ctx);
@@ -988,8 +991,10 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, 
	if (flags & BPF_TRAMP_F_RESTORE_REGS)

		restore_args(nregs, args_off, ctx);



	if (save_ret)

	if (save_ret) {

		emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);

		emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx);

	}



	emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx);
@@ -1515,6 +1520,7 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx, 
		if (ret)

			return ret;



		if (insn->src_reg != BPF_PSEUDO_CALL)

			emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);

		break;

	}

arch/s390/net/bpf_jit_comp.c

+20 −5
Original line number Diff line number Diff line
@@ -2066,6 +2066,7 @@ struct bpf_tramp_jit { 
				 * func_addr's original caller

				 */

	int stack_size;		/* Trampoline stack size */

	int backchain_off;	/* Offset of backchain */

	int stack_args_off;	/* Offset of stack arguments for calling

				 * func_addr, has to be at the top

				 */
@@ -2086,9 +2087,10 @@ struct bpf_tramp_jit { 
				 * for __bpf_prog_enter() return value and

				 * func_addr respectively

				 */

	int r14_off;		/* Offset of saved %r14 */

	int run_ctx_off;	/* Offset of struct bpf_tramp_run_ctx */

	int tccnt_off;		/* Offset of saved tailcall counter */

	int r14_off;		/* Offset of saved %r14, has to be at the

				 * bottom */

	int do_fexit;		/* do_fexit: label */

};
@@ -2247,8 +2249,12 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, 
	 * Calculate the stack layout.

	 */



	/* Reserve STACK_FRAME_OVERHEAD bytes for the callees. */

	/*

	 * Allocate STACK_FRAME_OVERHEAD bytes for the callees. As the s390x

	 * ABI requires, put our backchain at the end of the allocated memory.

	 */

	tjit->stack_size = STACK_FRAME_OVERHEAD;

	tjit->backchain_off = tjit->stack_size - sizeof(u64);

	tjit->stack_args_off = alloc_stack(tjit, nr_stack_args * sizeof(u64));

	tjit->reg_args_off = alloc_stack(tjit, nr_reg_args * sizeof(u64));

	tjit->ip_off = alloc_stack(tjit, sizeof(u64));
@@ -2256,16 +2262,25 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, 
	tjit->bpf_args_off = alloc_stack(tjit, nr_bpf_args * sizeof(u64));

	tjit->retval_off = alloc_stack(tjit, sizeof(u64));

	tjit->r7_r8_off = alloc_stack(tjit, 2 * sizeof(u64));

	tjit->r14_off = alloc_stack(tjit, sizeof(u64));

	tjit->run_ctx_off = alloc_stack(tjit,

					sizeof(struct bpf_tramp_run_ctx));

	tjit->tccnt_off = alloc_stack(tjit, sizeof(u64));

	/* The caller has already reserved STACK_FRAME_OVERHEAD bytes. */

	tjit->stack_size -= STACK_FRAME_OVERHEAD;

	tjit->r14_off = alloc_stack(tjit, sizeof(u64) * 2);

	/*

	 * In accordance with the s390x ABI, the caller has allocated

	 * STACK_FRAME_OVERHEAD bytes for us. 8 of them contain the caller's

	 * backchain, and the rest we can use.

	 */

	tjit->stack_size -= STACK_FRAME_OVERHEAD - sizeof(u64);

	tjit->orig_stack_args_off = tjit->stack_size + STACK_FRAME_OVERHEAD;



	/* lgr %r1,%r15 */

	EMIT4(0xb9040000, REG_1, REG_15);

	/* aghi %r15,-stack_size */

	EMIT4_IMM(0xa70b0000, REG_15, -tjit->stack_size);

	/* stg %r1,backchain_off(%r15) */

	EMIT6_DISP_LH(0xe3000000, 0x0024, REG_1, REG_0, REG_15,

		      tjit->backchain_off);

	/* mvc tccnt_off(4,%r15),stack_size+STK_OFF_TCCNT(%r15) */

	_EMIT6(0xd203f000 | tjit->tccnt_off,

	       0xf000 | (tjit->stack_size + STK_OFF_TCCNT));

drivers/net/can/Kconfig

+1 −1
Original line number Diff line number Diff line
@@ -190,7 +190,7 @@ config CAN_SLCAN 


config CAN_SUN4I

	tristate "Allwinner A10 CAN controller"

	depends on MACH_SUN4I || MACH_SUN7I || RISCV || COMPILE_TEST

	depends on MACH_SUN4I || MACH_SUN7I || (RISCV && ARCH_SUNXI) || COMPILE_TEST

	help

	  Say Y here if you want to use CAN controller found on Allwinner

	  A10/A20/D1 SoCs.

drivers/net/can/flexcan/flexcan-core.c

+13 −33
Original line number Diff line number Diff line
@@ -348,7 +348,7 @@ static struct flexcan_devtype_data fsl_imx8mp_devtype_data = { 
static struct flexcan_devtype_data fsl_imx93_devtype_data = {

	.quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS |

		FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_RX_MAILBOX |

		FLEXCAN_QUIRK_BROKEN_PERR_STATE | FLEXCAN_QUIRK_AUTO_STOP_MODE |

		FLEXCAN_QUIRK_BROKEN_PERR_STATE | FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR |

		FLEXCAN_QUIRK_SUPPORT_FD | FLEXCAN_QUIRK_SUPPORT_ECC |

		FLEXCAN_QUIRK_SUPPORT_RX_MAILBOX |

		FLEXCAN_QUIRK_SUPPORT_RX_MAILBOX_RTR,
@@ -544,11 +544,6 @@ static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv) 
	} else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR) {

		regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr,

				   1 << priv->stm.req_bit, 1 << priv->stm.req_bit);

	} else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE) {

		/* For the auto stop mode, software do nothing, hardware will cover

		 * all the operation automatically after system go into low power mode.

		 */

		return 0;

	}



	return flexcan_low_power_enter_ack(priv);
@@ -574,12 +569,6 @@ static inline int flexcan_exit_stop_mode(struct flexcan_priv *priv) 
	reg_mcr &= ~FLEXCAN_MCR_SLF_WAK;

	priv->write(reg_mcr, &regs->mcr);



	/* For the auto stop mode, hardware will exist stop mode

	 * automatically after system go out of low power mode.

	 */

	if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE)

		return 0;



	return flexcan_low_power_exit_ack(priv);

}
@@ -1994,13 +1983,18 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev) 
		ret = flexcan_setup_stop_mode_scfw(pdev);

	else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR)

		ret = flexcan_setup_stop_mode_gpr(pdev);

	else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE)

		ret = 0;

	else

		/* return 0 directly if doesn't support stop mode feature */

		return 0;



	if (ret)

	/* If ret is -EINVAL, this means SoC claim to support stop mode, but

	 * dts file lack the stop mode property definition. For this case,

	 * directly return 0, this will skip the wakeup capable setting and

	 * will not block the driver probe.

	 */

	if (ret == -EINVAL)

		return 0;

	else if (ret)

		return ret;



	device_set_wakeup_capable(&pdev->dev, true);
@@ -2320,16 +2314,8 @@ static int __maybe_unused flexcan_noirq_suspend(struct device *device) 
	if (netif_running(dev)) {

		int err;



		if (device_may_wakeup(device)) {

		if (device_may_wakeup(device))

			flexcan_enable_wakeup_irq(priv, true);

			/* For auto stop mode, need to keep the clock on before

			 * system go into low power mode. After system go into

			 * low power mode, hardware will config the flexcan into

			 * stop mode, and gate off the clock automatically.

			 */

			if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE)

				return 0;

		}



		err = pm_runtime_force_suspend(device);

		if (err)
@@ -2347,15 +2333,9 @@ static int __maybe_unused flexcan_noirq_resume(struct device *device) 
	if (netif_running(dev)) {

		int err;



		/* For the wakeup in auto stop mode, no need to gate on the

		 * clock here, hardware will do this automatically.

		 */

		if (!(device_may_wakeup(device) &&

		      priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE)) {

		err = pm_runtime_force_resume(device);

		if (err)

			return err;

		}



		if (device_may_wakeup(device))

			flexcan_enable_wakeup_irq(priv, false);