RE: [PATCH net-next v3 06/10] bnxt: Add devlink support for config get/set

[Yuval Mintz]

> +static int bnxt_nvm_read(struct bnxt *bp, int nvm_param, int idx,
> +  void *buf, int size)
> +{
> + struct hwrm_nvm_get_variable_input req = {0};
> + dma_addr_t dest_data_dma_addr;
> + void *dest_data_addr = NULL;
> + int bytesize;
> + int rc;
> +
> + bytesize = (size + 7) / BITS_PER_BYTE;
roundup?

..

+static int bnxt_nvm_write(struct bnxt *bp, int nvm_param, int idx,
> +   const void *buf, int size)
> +{
> + struct hwrm_nvm_set_variable_input req = {0};
> + dma_addr_t src_data_dma_addr;
> + void *src_data_addr = NULL;
> + int bytesize;
> + int rc;
> +
> + bytesize = (size + 7) / BITS_PER_BYTE;
Likewise

> +
> + src_data_addr = dma_alloc_coherent(>pdev->dev, bytesize,
> +_data_dma_addr,
> GFP_KERNEL);
> + if (!src_data_addr) {
> + netdev_err(bp->dev, "dma_alloc_coherent failure\n");

Won't you see an oom? Why do you need the print?

> +static int bnxt_dl_perm_config_set(struct devlink *devlink,
> +enum devlink_perm_config_param param,
> +u8 type, void *value, u8 *restart_reqd)
> +{
> + struct bnxt *bp = bnxt_get_bp_from_dl(devlink);
> + struct bnxt_drv_cfgparam *entry;
> + int idx = 0;
> + int ret = 0;
> + u32 bytesize;
> + u32 val32;
> + u16 val16;
> + u8 val8;
> + int i;
> +
> + *restart_reqd = 0;
> +
> + /* Find parameter in table */
> + for (i = 0; i < BNXT_NUM_DRV_CFGPARAM; i++) {
> + if (param == bnxt_drv_cfgparam_list[i].param) {
> + entry = _drv_cfgparam_list[i];
> + break;
> + }
> + }
> +
> + /* Not found */
> + if (i == BNXT_NUM_DRV_CFGPARAM)
> + return -EINVAL;
> +
Looks cleaner to check whether entry is set instead
...

> + bytesize = (entry->bitlength + 7) / BITS_PER_BYTE;

Roundup?

...

> + if (bytesize == 1) {
> + val8 = val32;

Don't you need explicit castings for these kind of assignments
to prevent warnings?

> + ret = bnxt_nvm_write(bp, entry->nvm_param, idx,
> ,
> +  entry->bitlength);
> + } else if (bytesize == 2) {
> + val16 = val32;
> + ret = bnxt_nvm_write(bp, entry->nvm_param, idx,
> ,
> +  entry->bitlength);
> + } else {
> + ret = bnxt_nvm_write(bp, entry->nvm_param, idx,
> ,
> +  entry->bitlength);
> + }
> + }
> +
> + /* Restart required for all nvm parameter writes */
> + *restart_reqd = 1;
> +
> + return ret;
> +}
> +
> +static int bnxt_dl_perm_config_get(struct devlink *devlink,
> +enum devlink_perm_config_param param,
> +u8 type, void *value)
> +{
Same comments as for the setter
...

> - if (!pci_find_ext_capability(bp->pdev, PCI_EXT_CAP_ID_SRIOV))
> - return 0;
> -
> - if (bp->hwrm_spec_code < 0x10800) {
> + if ((!pci_find_ext_capability(bp->pdev, PCI_EXT_CAP_ID_SRIOV)) ||
> + bp->hwrm_spec_code < 0x10800) {
> + /* eswitch switchdev mode not supported */
> + bnxt_dl_ops.eswitch_mode_set = NULL;
> + bnxt_dl_ops.eswitch_mode_get = NULL;

Why would you need to tie this interface to the presence of SRIOV in PCIe?
Also, Assuming the ability to disable sriov in #2 would cause this capability
not to be exposed after reboot, isn't this a one-way ticket?

RE: [PATCH net-next v3 01/10] devlink: Add permanent config parameter get/set operations

[Yuval Mintz]

> On Tue, Oct 24, 2017 at 5:22 PM, Yuval Mintz 
> wrote:
> >> Add support for permanent config parameter get/set commands. Used
> >> for persistent device configuration parameters.
> >>
> > ...
> >> + int (*perm_config_get)(struct devlink *devlink,
> >> +enum devlink_perm_config_param param, u8
> >> type,
> >> +void *value);
> >> + int (*perm_config_set)(struct devlink *devlink,
> >> +enum devlink_perm_config_param param, u8
> >> type,
> >> +void *value, u8 *restart_reqd);
> >>  };
> >> +static int devlink_nl_single_param_get(struct sk_buff *msg,
> >> +struct devlink *devlink,
> >> +u32 param, u8 type)
> >> +{
> >> + const struct devlink_ops *ops = devlink->ops;
> >> + struct nlattr *param_attr;
> >> + void *value;
> >> + u32 val;
> >> + int err;
> >> +
> >> + /* Allocate buffer for parameter value */
> >> + switch (type) {
> >> + case NLA_U8:
> >> + value = kmalloc(sizeof(u8), GFP_KERNEL);
> >> + break;
> >> + case NLA_U16:
> >> + value = kmalloc(sizeof(u16), GFP_KERNEL);
> >> + break;
> >> + case NLA_U32:
> >> + value = kmalloc(sizeof(u32), GFP_KERNEL);
> >> + break;
> >> + default:
> >> + return -EINVAL; /* Unsupported Type */
> >> + }
> >> +
> >> + if (!value)
> >> + return -ENOMEM;
> >> +
> >> + err = ops->perm_config_get(devlink, param, type, value);
> >> + if (err)
> >> + return err;
> >
> > I suspect this logic might be risky - its dependent on the driver to cast 
> > the
> > 'value' into the proper type or else, E.g., the following switch might break
> > for BE platforms.
> > Is there any reason to have the devlink <-> driver API be based on void*
> > and not on some typed data [of sufficient size]?
> > ...
> >> + switch (type) {
> >> + case NLA_U8:
> >> + val = *((u8 *)value);
> >> + if (nla_put_u8(msg, DEVLINK_ATTR_PERM_CONFIG_VALUE,
> >> val))
> >> + goto nest_err;
> >> + break;
> >> + case NLA_U16:
> >> + val = *((u16 *)value);
> >> + if (nla_put_u16(msg,
> >> DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
> >> + goto nest_err;
> >> + break;
> >> + case NLA_U32:
> >> + val = *((u32 *)value);
> >> + if (nla_put_u32(msg,
> >> DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
> >> + goto nest_err;
> >> + break;
> >> + }
> 
> Why might this break on a BE system?  It's not as though driver will
> be compiled LE and kernel BE or vice versa - as long as driver and
> kernel are same endian-ness, I would think it should be okay?

It depends on the driver implementation to cast your pointer to the right type.
E.g., driver needs to fill in a u8 data in *value for a given parameter.
If the driver casted the pointer to (u8*) everything is fine. But if he casted
it to (u32*) [naïve implementation that doesn't care about the type]
and filled it, then on a LE machine value[0] would contain the data while on
BE value[3] would contain it.


> 
> In general, the issue is that the parameter could be any of the
> netlink types (per Jiri's suggestion to the previous version of this
> patch).  So, we allocate some space, tell the driver the type we're
> expecting (the type argument to the perm_config_get() function), and
> yes, we rely on the driver to write something of the type we request
> to the pointer we provide.  Are you suggesting defining a union of
> U8/U16/U32, and passing a pointer to that for the driver to fill in?

Problem is that the driver-side could always use the biggest data-type
as long as it's working on a LE machine, but that approach would break
if same driver would be tried on a BE machine.
And the developer would have no way of knowing other than via code-review.

> The issue is that whatever the types we support now, we want future
> parameters to be able to be of arbitrary types.  Defining the
> interface to use the void pointer means that some future parameter can
> be of some other type, without having to update all the drivers using
> this API...
> 
> Or did I misunderstand your suggestion?

RE: [PATCH net-next v3 03/10] devlink: Adding num VFs per PF permanent config param

[Yuval Mintz]

> Adding DEVLINK_PERM_CONFIG_NUM_VF_PER_PF permanent config
> parameter.  Value is permanent, so becomes the new default
> value for this device.
> 
> The value sets the number of VFs per PF in SR-IOV mode.

Assuming it's meant to directly control the PCIe capability value
I think you should mention it explicitly in the commit message.

RE: [PATCH net-next v3 02/10] devlink: Adding SR-IOV enablement perm config param

[Yuval Mintz]

> Adding DEVLINK_PERM_CONFIG_SRIOV_ENABLED permanent config
> parameter.  Value is permanent, so becomes the new default
> value for this device.
> 
>   0 = Disable SR-IOV
>   1 = Enable SR-IOV

Does this imposes a requirement on the PCIe specifics, E.g., that the device
should no longer expose the SRIOV PCie capability?
Or does any implementation that would prevent a user from activating
SR-IOV is sufficient?

Re: [PATCH] drivers/wireless: iwlwifi/mvm: Convert timers to use timer_setup()

[Luca Coelho]

On Tue, 2017-10-24 at 02:29 -0700, Kees Cook wrote:
> In preparation for unconditionally passing the struct timer_list
> pointer to
> all timer callbacks, switch to using the new timer_setup() and
> from_timer()
> to pass the timer pointer explicitly.
> 
> The RCU lifetime on baid_data is unclear, so this adds a direct copy
> of the
> rcu_ptr passed to the original callback. It may be possible to
> improve this
> to just use baid_data->mvm->baid_map[baid_data->baid] instead.
> 
> Cc: Johannes Berg 
> Cc: Emmanuel Grumbach 
> Cc: Luca Coelho 
> Cc: Intel Linux Wireless 
> Cc: Kalle Valo 
> Cc: Sara Sharon 
> Cc: linux-wirel...@vger.kernel.org
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 
> ---

Thanks, Kees.  I'm taking this for review on our internal tree.  If all
our checks pass, I'll apply it and it will reach the mainline following
our usual upstreaming process.

--
Cheers,
Luca.

[PATCH net-next 4/4] net: qualcomm: rmnet: Add support for GRO

[Subash Abhinov Kasiviswanathan]

Add gro_cells so that rmnet devices can call gro_cells_receive
instead of netif_receive_skb.

Signed-off-by: Subash Abhinov Kasiviswanathan 
---
 drivers/net/ethernet/qualcomm/rmnet/Kconfig  | 1 +
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c   | 6 +++---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h   | 2 ++
 drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 4 +++-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c  | 9 -
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h  | 2 +-
 6 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/Kconfig 
b/drivers/net/ethernet/qualcomm/rmnet/Kconfig
index 6e2587a..9bb06d2 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/Kconfig
+++ b/drivers/net/ethernet/qualcomm/rmnet/Kconfig
@@ -5,6 +5,7 @@
 menuconfig RMNET
tristate "RmNet MAP driver"
default n
+   select GRO_CELLS
---help---
  If you select this, you will enable the RMNET module which is used
  for handling data in the multiplexing and aggregation protocol (MAP)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 71bee1a..5ce4287 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -191,7 +191,7 @@ static int rmnet_newlink(struct net *src_net, struct 
net_device *dev,
return 0;
 
 err2:
-   rmnet_vnd_dellink(mux_id, port, ep);
+   rmnet_vnd_dellink(mux_id, port, ep, dev);
 err1:
rmnet_unregister_real_device(real_dev, port);
 err0:
@@ -221,7 +221,7 @@ static void rmnet_dellink(struct net_device *dev, struct 
list_head *head)
if (ep) {
hlist_del_init_rcu(>hlnode);
rmnet_unregister_bridge(dev, port);
-   rmnet_vnd_dellink(mux_id, port, ep);
+   rmnet_vnd_dellink(mux_id, port, ep, dev);
kfree(ep);
}
rmnet_unregister_real_device(real_dev, port);
@@ -239,7 +239,7 @@ static int rmnet_dev_walk_unreg(struct net_device 
*rmnet_dev, void *data)
ep = rmnet_get_endpoint(d->port, mux_id);
if (ep) {
hlist_del_init_rcu(>hlnode);
-   rmnet_vnd_dellink(mux_id, d->port, ep);
+   rmnet_vnd_dellink(mux_id, d->port, ep, rmnet_dev);
kfree(ep);
}
netdev_upper_dev_unlink(rmnet_dev, d->real_dev);
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
index 9586703d..c19259e 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
@@ -14,6 +14,7 @@
  */
 
 #include 
+#include 
 
 #ifndef _RMNET_CONFIG_H_
 #define _RMNET_CONFIG_H_
@@ -58,6 +59,7 @@ struct rmnet_priv {
u8 mux_id;
struct net_device *real_dev;
struct rmnet_pcpu_stats __percpu *pcpu_stats;
+   struct gro_cells gro_cells;
 };
 
 struct rmnet_port *rmnet_get_port(struct net_device *real_dev);
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index 1ea9783..29842cc 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -46,13 +46,15 @@ static void rmnet_set_skb_proto(struct sk_buff *skb)
 static void
 rmnet_deliver_skb(struct sk_buff *skb)
 {
+   struct rmnet_priv *priv = netdev_priv(skb->dev);
+
skb_reset_transport_header(skb);
skb_reset_network_header(skb);
rmnet_vnd_rx_fixup(skb, skb->dev);
 
skb->pkt_type = PACKET_HOST;
skb_set_mac_header(skb, 0);
-   netif_receive_skb(skb);
+   gro_cells_receive(>gro_cells, skb);
 }
 
 /* MAP handler */
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index b0befa1..45a97eb 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -149,6 +149,8 @@ static void rmnet_get_stats64(struct net_device *dev,
  */
 void rmnet_vnd_setup(struct net_device *rmnet_dev)
 {
+   struct rmnet_priv *priv = netdev_priv(rmnet_dev);
+
rmnet_dev->netdev_ops = _vnd_ops;
rmnet_dev->mtu = RMNET_DFLT_PACKET_SIZE;
rmnet_dev->needed_headroom = RMNET_NEEDED_HEADROOM;
@@ -162,6 +164,8 @@ void rmnet_vnd_setup(struct net_device *rmnet_dev)
rmnet_dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST);
 
rmnet_dev->needs_free_netdev = true;
+
+   gro_cells_init(>gro_cells, rmnet_dev);
 }
 
 /* Exposed API */
@@ -196,11 +200,14 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
 }
 
 int rmnet_vnd_dellink(u8 id, struct rmnet_port *port,
- struct rmnet_endpoint *ep)
+ struct rmnet_endpoint *ep, struct net_device *rmnet_dev)
 {
+ 

[PATCH net-next 0/4] net: qualcomm: rmnet: Add 64 bit stats and GRO

[Subash Abhinov Kasiviswanathan]

This series adds support for 64 bit per cpu stats and GRO

Patches 1-2 are cleanups of return code and a redundant condition
Patch 3 adds support for 64 bit per cpu stats
Patch 4 adds support for GRO using GRO cells

Subash Abhinov Kasiviswanathan (4):
  net: qualcomm: rmnet: Fix the return value of rmnet_rx_handler()
  net: qualcomm: rmnet: Always assign rmnet dev in deaggregation path
  net: qualcomm: rmnet: Add support for 64 bit stats
  net: qualcomm: rmnet: Add support for GRO

 drivers/net/ethernet/qualcomm/rmnet/Kconfig|  1 +
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c |  6 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 16 
 .../net/ethernet/qualcomm/rmnet/rmnet_handlers.c   | 38 --
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h|  3 +-
 .../ethernet/qualcomm/rmnet/rmnet_map_command.c|  4 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c| 85 --
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h|  2 +-
 8 files changed, 118 insertions(+), 37 deletions(-)

-- 
1.9.1

[PATCH net-next 1/4] net: qualcomm: rmnet: Fix the return value of rmnet_rx_handler()

[Subash Abhinov Kasiviswanathan]

Since packet is always consumed by rmnet_rx_handler(), we always
return RX_HANDLER_CONSUMED. There is no need to pass on this
value through multiple functions.

Signed-off-by: Subash Abhinov Kasiviswanathan 
---
 .../net/ethernet/qualcomm/rmnet/rmnet_handlers.c   | 31 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h|  3 +--
 .../ethernet/qualcomm/rmnet/rmnet_map_command.c|  4 +--
 3 files changed, 14 insertions(+), 24 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index df3d2d1..5dd186d 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -43,7 +43,7 @@ static void rmnet_set_skb_proto(struct sk_buff *skb)
 
 /* Generic handler */
 
-static rx_handler_result_t
+static void
 rmnet_deliver_skb(struct sk_buff *skb)
 {
skb_reset_transport_header(skb);
@@ -53,12 +53,11 @@ static void rmnet_set_skb_proto(struct sk_buff *skb)
skb->pkt_type = PACKET_HOST;
skb_set_mac_header(skb, 0);
netif_receive_skb(skb);
-   return RX_HANDLER_CONSUMED;
 }
 
 /* MAP handler */
 
-static rx_handler_result_t
+static void
 __rmnet_map_ingress_handler(struct sk_buff *skb,
struct rmnet_port *port)
 {
@@ -91,31 +90,27 @@ static void rmnet_set_skb_proto(struct sk_buff *skb)
skb_pull(skb, sizeof(struct rmnet_map_header));
skb_trim(skb, len);
rmnet_set_skb_proto(skb);
-   return rmnet_deliver_skb(skb);
+   rmnet_deliver_skb(skb);
+   return;
 
 free_skb:
kfree_skb(skb);
-   return RX_HANDLER_CONSUMED;
 }
 
-static rx_handler_result_t
+static void
 rmnet_map_ingress_handler(struct sk_buff *skb,
  struct rmnet_port *port)
 {
struct sk_buff *skbn;
-   int rc;
 
if (port->ingress_data_format & RMNET_INGRESS_FORMAT_DEAGGREGATION) {
while ((skbn = rmnet_map_deaggregate(skb)) != NULL)
__rmnet_map_ingress_handler(skbn, port);
 
consume_skb(skb);
-   rc = RX_HANDLER_CONSUMED;
} else {
-   rc = __rmnet_map_ingress_handler(skb, port);
+   __rmnet_map_ingress_handler(skb, port);
}
-
-   return rc;
 }
 
 static int rmnet_map_egress_handler(struct sk_buff *skb,
@@ -149,15 +144,13 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
return RMNET_MAP_SUCCESS;
 }
 
-static rx_handler_result_t
+static void
 rmnet_bridge_handler(struct sk_buff *skb, struct net_device *bridge_dev)
 {
if (bridge_dev) {
skb->dev = bridge_dev;
dev_queue_xmit(skb);
}
-
-   return RX_HANDLER_CONSUMED;
 }
 
 /* Ingress / Egress Entry Points */
@@ -168,13 +161,12 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
  */
 rx_handler_result_t rmnet_rx_handler(struct sk_buff **pskb)
 {
-   int rc = RX_HANDLER_CONSUMED;
struct sk_buff *skb = *pskb;
struct rmnet_port *port;
struct net_device *dev;
 
if (!skb)
-   return RX_HANDLER_CONSUMED;
+   goto done;
 
dev = skb->dev;
port = rmnet_get_port(dev);
@@ -182,14 +174,15 @@ rx_handler_result_t rmnet_rx_handler(struct sk_buff 
**pskb)
switch (port->rmnet_mode) {
case RMNET_EPMODE_VND:
if (port->ingress_data_format & RMNET_INGRESS_FORMAT_MAP)
-   rc = rmnet_map_ingress_handler(skb, port);
+   rmnet_map_ingress_handler(skb, port);
break;
case RMNET_EPMODE_BRIDGE:
-   rc = rmnet_bridge_handler(skb, port->bridge_ep);
+   rmnet_bridge_handler(skb, port->bridge_ep);
break;
}
 
-   return rc;
+done:
+   return RX_HANDLER_CONSUMED;
 }
 
 /* Modifies packet as per logical endpoint configuration and egress data format
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
index ce2302c..3af3fe7 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
@@ -80,7 +80,6 @@ struct rmnet_map_header {
 struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb);
 struct rmnet_map_header *rmnet_map_add_map_header(struct sk_buff *skb,
  int hdrlen, int pad);
-rx_handler_result_t rmnet_map_command(struct sk_buff *skb,
- struct rmnet_port *port);
+void rmnet_map_command(struct sk_buff *skb, struct rmnet_port *port);
 
 #endif /* _RMNET_MAP_H_ */
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
index 74d362f..51e6049 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
+++ 

[PATCH net-next 2/4] net: qualcomm: rmnet: Always assign rmnet dev in deaggregation path

[Subash Abhinov Kasiviswanathan]

The rmnet device needs to assigned for all packets in the
deaggregation path based on the mux id, so the check is not needed.

Signed-off-by: Subash Abhinov Kasiviswanathan 
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index 5dd186d..1ea9783 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -83,8 +83,7 @@ static void rmnet_set_skb_proto(struct sk_buff *skb)
if (!ep)
goto free_skb;
 
-   if (port->ingress_data_format & RMNET_INGRESS_FORMAT_DEMUXING)
-   skb->dev = ep->egress_dev;
+   skb->dev = ep->egress_dev;
 
/* Subtract MAP header */
skb_pull(skb, sizeof(struct rmnet_map_header));
-- 
1.9.1

[PATCH net-next 3/4] net: qualcomm: rmnet: Add support for 64 bit stats

[Subash Abhinov Kasiviswanathan]

Implement 64 bit per cpu stats.

Signed-off-by: Subash Abhinov Kasiviswanathan 
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 14 
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c| 76 --
 2 files changed, 85 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
index 60115e6..9586703d 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
@@ -41,9 +41,23 @@ struct rmnet_port {
 
 extern struct rtnl_link_ops rmnet_link_ops;
 
+struct rmnet_vnd_stats {
+   u64 rx_pkts;
+   u64 rx_bytes;
+   u64 tx_pkts;
+   u64 tx_bytes;
+   u32 tx_drops;
+};
+
+struct rmnet_pcpu_stats {
+   struct rmnet_vnd_stats stats;
+   struct u64_stats_sync syncp;
+};
+
 struct rmnet_priv {
u8 mux_id;
struct net_device *real_dev;
+   struct rmnet_pcpu_stats __percpu *pcpu_stats;
 };
 
 struct rmnet_port *rmnet_get_port(struct net_device *real_dev);
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c 
b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index 12bd0bb..b0befa1 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -27,14 +27,28 @@
 
 void rmnet_vnd_rx_fixup(struct sk_buff *skb, struct net_device *dev)
 {
-   dev->stats.rx_packets++;
-   dev->stats.rx_bytes += skb->len;
+   struct rmnet_priv *priv = netdev_priv(dev);
+   struct rmnet_pcpu_stats *pcpu_ptr;
+
+   pcpu_ptr = this_cpu_ptr(priv->pcpu_stats);
+
+   u64_stats_update_begin(_ptr->syncp);
+   pcpu_ptr->stats.rx_pkts++;
+   pcpu_ptr->stats.rx_bytes += skb->len;
+   u64_stats_update_end(_ptr->syncp);
 }
 
 void rmnet_vnd_tx_fixup(struct sk_buff *skb, struct net_device *dev)
 {
-   dev->stats.tx_packets++;
-   dev->stats.tx_bytes += skb->len;
+   struct rmnet_priv *priv = netdev_priv(dev);
+   struct rmnet_pcpu_stats *pcpu_ptr;
+
+   pcpu_ptr = this_cpu_ptr(priv->pcpu_stats);
+
+   u64_stats_update_begin(_ptr->syncp);
+   pcpu_ptr->stats.tx_pkts++;
+   pcpu_ptr->stats.tx_bytes += skb->len;
+   u64_stats_update_end(_ptr->syncp);
 }
 
 /* Network Device Operations */
@@ -48,7 +62,7 @@ static netdev_tx_t rmnet_vnd_start_xmit(struct sk_buff *skb,
if (priv->real_dev) {
rmnet_egress_handler(skb);
} else {
-   dev->stats.tx_dropped++;
+   this_cpu_inc(priv->pcpu_stats->stats.tx_drops);
kfree_skb(skb);
}
return NETDEV_TX_OK;
@@ -70,12 +84,64 @@ static int rmnet_vnd_get_iflink(const struct net_device 
*dev)
return priv->real_dev->ifindex;
 }
 
+static int rmnet_vnd_init(struct net_device *dev)
+{
+   struct rmnet_priv *priv = netdev_priv(dev);
+
+   priv->pcpu_stats = alloc_percpu(struct rmnet_pcpu_stats);
+   if (!priv->pcpu_stats)
+   return -ENOMEM;
+
+   return 0;
+}
+
+static void rmnet_vnd_uninit(struct net_device *dev)
+{
+   struct rmnet_priv *priv = netdev_priv(dev);
+
+   free_percpu(priv->pcpu_stats);
+}
+
+static void rmnet_get_stats64(struct net_device *dev,
+ struct rtnl_link_stats64 *s)
+{
+   struct rmnet_priv *priv = netdev_priv(dev);
+   struct rmnet_vnd_stats total_stats;
+   struct rmnet_pcpu_stats *pcpu_ptr;
+   unsigned int cpu, start;
+
+   memset(_stats, 0, sizeof(struct rmnet_vnd_stats));
+
+   for_each_possible_cpu(cpu) {
+   pcpu_ptr = this_cpu_ptr(priv->pcpu_stats);
+
+   do {
+   start = u64_stats_fetch_begin_irq(_ptr->syncp);
+   total_stats.rx_pkts += pcpu_ptr->stats.rx_pkts;
+   total_stats.rx_bytes += pcpu_ptr->stats.rx_bytes;
+   total_stats.tx_pkts += pcpu_ptr->stats.tx_pkts;
+   total_stats.tx_bytes += pcpu_ptr->stats.tx_bytes;
+   } while (u64_stats_fetch_retry_irq(_ptr->syncp, start));
+
+   total_stats.tx_drops += pcpu_ptr->stats.tx_drops;
+   }
+
+   s->rx_packets = total_stats.rx_pkts;
+   s->rx_bytes = total_stats.rx_bytes;
+   s->tx_packets = total_stats.tx_pkts;
+   s->tx_bytes = total_stats.tx_bytes;
+   s->tx_dropped = total_stats.tx_drops;
+}
+
 static const struct net_device_ops rmnet_vnd_ops = {
.ndo_start_xmit = rmnet_vnd_start_xmit,
.ndo_change_mtu = rmnet_vnd_change_mtu,
.ndo_get_iflink = rmnet_vnd_get_iflink,
.ndo_add_slave  = rmnet_add_bridge,
.ndo_del_slave  = rmnet_del_bridge,
+   .ndo_init   = rmnet_vnd_init,
+   .ndo_uninit = rmnet_vnd_uninit,
+   .ndo_get_stats64 = rmnet_get_stats64,
 };
 
 /* Called by kernel whenever a new rmnet device is created. Sets MTU,
-- 
1.9.1

Re: [PATCH net] xfrm: Clear sk_dst_cache when applying per-socket policy.

[Steffen Klassert]

On Tue, Oct 24, 2017 at 09:58:48AM -0700, Jonathan Basseri  wrote:
> On Tue, Oct 24, 2017 at 12:04 AM, Steffen Klassert
>  wrote:
> >
> > On Mon, Oct 23, 2017 at 06:18:55PM -0700, Jonathan Basseri wrote:
> > > If a socket has a valid dst cache, then xfrm_lookup_route will get
> > > skipped. However, the cache is not invalidated when applying policy to a
> > > socket (i.e. IPV6_XFRM_POLICY). The result is that new policies are
> > > sometimes ignored on those sockets. (Note: This was broken for IPv4 and
> > > IPv6 at different times.)
> > >
> > > This can be demonstrated like so,
> > > 1. Create UDP socket.
> > > 2. connect() the socket.
> > > 3. Apply an outbound XFRM policy to the socket.
> > > 4. send() data on the socket.
> > >
> > > Packets will continue to be sent in the clear instead of matching an
> > > xfrm or returning a no-match error (EAGAIN). This affects calls to
> > > send() and not sendto().
> > >
> > > Invalidating the sk_dst_cache is necessary to correctly apply xfrm
> > > policies. Since we do this in xfrm_user_policy(), the sk_lock was
> > > already acquired in either do_ip_setsockopt() or do_ipv6_setsockopt(),
> > > and we may call __sk_dst_reset().
> > >
> > > Performance impact should be negligible, since this code is only called
> > > when changing xfrm policy, and only affects the socket in question.
> > >
> > > Note: Creating normal XFRM policies should have a similar effect on
> > > sk_dst_cache entries that match the policy, but that is not fixed in
> > > this patch.
> >
> > I think we don't have this problem with 'normal' policies. When
> > inserting such a policy, we bump the IPv4/IPv6 genid. This should
> > invalidate all cached dst entries, no?
> >
> That sounds reasonable to me. I had not confirmed the behavior for
> normal policies, so I was trying to point out that this fix is only
> for socket policies. Should I modify the commit message?

Yes, please do so. This comment may lead people to the wrong direction.

Thanks!

Re: [PATCH] drivers/net: wan/sbni: Convert timers to use timer_setup()

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:47:00 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
> 
> Cc: David Howells 
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied.

Re: [PATCH] net: xfrm_user: use BUG_ON instead of if condition followed by BUG

[David Miller]

From: Herbert Xu 
Date: Wed, 25 Oct 2017 12:05:41 +0800

> On Tue, Oct 24, 2017 at 05:48:42PM +0900, David Miller wrote:
>> 
>> This discussion has happened before.
>> 
>> But I'll explain the conclusion here for your benefit.
>> 
>> BUG_ON() is a statement and everything inside of it will
>> always execute.
>> 
>> BUG_ON() is always preferred because it allows arch
>> specific code to pass the conditional result properly
>> into inline asm and builtins for optimal code generation.
> 
> This is a good point.  However, while a little bit more verbose you
> can still achieve the same assembly-level result by something like
> 
>   int err;
> 
>   err = ;
>   BUG_ON(err);
> 
> Having real code in BUG_ON may pose problems to people reading the
> code because some of us tend to ignore code in BUG_ON and similar
> macros such as BUILD_BUG_ON.

I agree that this makes the code easier to read and audit.

Re: [PATCH] drivers/net: sis: Convert timers to use timer_setup()

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:46:52 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
> 
> Cc: Francois Romieu 
> Cc: Daniele Venzano 
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied.

Re: [PATCH] net: atm/mpc: Stop using open-coded timer .data field

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:46:45 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using an explicit static variable to hold
> additional expiration details.
> 
> Cc: "David S. Miller" 
> Cc: Bhumika Goyal 
> Cc: Andrew Morton 
> Cc: Alexey Dobriyan 
> Cc: "Reshetova, Elena" 
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied.

Re: [PATCH] ipv6: esp6: use BUG_ON instead of if condition followed by BUG

[Herbert Xu]

On Tue, Oct 24, 2017 at 11:28:26AM -0500, Gustavo A. R. Silva wrote:
> Use BUG_ON instead of if condition followed by BUG in esp_remove_trailer.
> 
> This issue was detected with the help of Coccinelle.
> 
> Signed-off-by: Gustavo A. R. Silva 
> ---
>  net/ipv6/esp6.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
> index 89910e2..603ff06 100644
> --- a/net/ipv6/esp6.c
> +++ b/net/ipv6/esp6.c
> @@ -483,8 +483,7 @@ static inline int esp_remove_trailer(struct sk_buff *skb)
>   goto out;
>   }
>  
> - if (skb_copy_bits(skb, skb->len - alen - 2, nexthdr, 2))
> - BUG();
> + BUG_ON(skb_copy_bits(skb, skb->len - alen - 2, nexthdr, 2));

How about

ret = skb_copy_bits(skb, skb->len - alen - 2, nexthdr, 2);
BUG_ON(ret);

Thanks,
-- 
Email: Herbert Xu 
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] net: xfrm_user: use BUG_ON instead of if condition followed by BUG

[Herbert Xu]

On Tue, Oct 24, 2017 at 05:48:42PM +0900, David Miller wrote:
> 
> This discussion has happened before.
> 
> But I'll explain the conclusion here for your benefit.
> 
> BUG_ON() is a statement and everything inside of it will
> always execute.
> 
> BUG_ON() is always preferred because it allows arch
> specific code to pass the conditional result properly
> into inline asm and builtins for optimal code generation.

This is a good point.  However, while a little bit more verbose you
can still achieve the same assembly-level result by something like

int err;

err = ;
BUG_ON(err);

Having real code in BUG_ON may pose problems to people reading the
code because some of us tend to ignore code in BUG_ON and similar
macros such as BUILD_BUG_ON.

Cheers,
-- 
Email: Herbert Xu 
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] tap: double-free in error path in tap_open()

[Girish Moodalbail]

On 10/24/17 6:55 PM, Jason Wang wrote:



On 2017年10月25日 05:41, Girish Moodalbail wrote:

Double free of skb_array in tap module is causing kernel panic. When
tap_set_queue() fails we free skb_array right away by calling
skb_array_cleanup(). However, later on skb_array_cleanup() is called
again by tap_sock_destruct through sock_put(). This patch fixes that
issue.

Fixes: 362899b8725b35e3 (macvtap: switch to use skb array)
Signed-off-by: Girish Moodalbail 
---
  drivers/net/tap.c | 12 ++--
  1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 21b71ae..878520b 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -542,20 +542,20 @@ static int tap_open(struct inode *inode, struct file 
*file)
  err = -ENOMEM;
  if (skb_array_init(>skb_array, tap->dev->tx_queue_len, GFP_KERNEL))
-    goto err_array;
+    goto err_put;


Looks like this will cause skb_array_cleanup() to be called when skb array was 
uninitialized?


Thanks Jason.

This is an existing issue outside of my code. I will send a v2 of the patch that 
incorporates the fix for this issue as well. I am considering moving 
skb_array_init() to the beginning of tap_open() (near to where we allocate 
memory for the tap_queue itself).


Thanks again.

regards,
~Girish




Thanks


  err = tap_set_queue(tap, file, q);
-    if (err)
-    goto err_queue;
+    if (err) {
+    /* tap_sock_destruct() will take care of freeing skb_array */
+    goto err_put;
+    }
  dev_put(tap->dev);
  rtnl_unlock();
  return err;
-err_queue:
-    skb_array_cleanup(>skb_array);
-err_array:
+err_put:
  sock_put(>sk);
  err:
  if (tap)

Re: [PATCH] net: af_packet: Convert timers to use timer_setup()

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:46:26 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
> 
> Cc: "David S. Miller" 
> Cc: Eric Dumazet 
> Cc: Willem de Bruijn 
> Cc: Mike Maloney 
> Cc: Jarno Rajahalme 
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied.

Re: [PATCH] net: hsr: Convert timers to use timer_setup()

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:46:16 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
> 
> Cc: Arvid Brodin 
> Cc: "David S. Miller" 
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied.

Re: [PATCH] net: dccp: Convert timers to use timer_setup()

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:46:09 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly. Adds a pointer back to the sock.
> 
> Cc: Gerrit Renker 
> Cc: "David S. Miller" 
> Cc: Soheil Hassas Yeganeh 
> Cc: Hannes Frederic Sowa 
> Cc: Eric Dumazet 
> Cc: d...@vger.kernel.org
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied.

Re: [PATCH] net: ethernet/sfc: Convert timers to use timer_setup()

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:45:59 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
> 
> Cc: Solarflare linux maintainers 
> Cc: Edward Cree 
> Cc: Bert Kenward 
> Cc: "David S. Miller" 
> Cc: Eric Dumazet 
> Cc: Jiri Pirko 
> Cc: Jamal Hadi Salim 
> Cc: Ingo Molnar 
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied.

[PATCH net-next] tools: bpftool: try to mount bpffs if required for pinning objects

[Jakub Kicinski]

From: Quentin Monnet 

One possible cause of failure for `bpftool {prog|map} pin * file FILE`
is the FILE not being in an eBPF virtual file system (bpffs). In this
case, make bpftool attempt to mount bpffs on the parent directory of the
FILE. Then, if this operation is successful, try again to pin the
object.

The code for mnt_bpffs() is a copy of function bpf_mnt_fs() from
iproute2 package (under lib/bpf.c, taken at commit 4b73d52f8a81), with
modifications regarding handling of error messages.

Signed-off-by: Quentin Monnet 
Signed-off-by: Jakub Kicinski 
---
 tools/bpf/bpftool/common.c | 71 --
 tools/bpf/bpftool/main.h   |  2 ++
 2 files changed, 65 insertions(+), 8 deletions(-)

diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index b2533f1cae3e..f0288269dae8 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -42,6 +42,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 
@@ -59,6 +60,37 @@ static bool is_bpffs(char *path)
return (unsigned long)st_fs.f_type == BPF_FS_MAGIC;
 }
 
+static int mnt_bpffs(const char *target, char *buff, size_t bufflen)
+{
+   bool bind_done = false;
+
+   while (mount("", target, "none", MS_PRIVATE | MS_REC, NULL)) {
+   if (errno != EINVAL || bind_done) {
+   snprintf(buff, bufflen,
+"mount --make-private %s failed: %s",
+target, strerror(errno));
+   return -1;
+   }
+
+   if (mount(target, target, "none", MS_BIND, NULL)) {
+   snprintf(buff, bufflen,
+"mount --bind %s %s failed: %s",
+target, target, strerror(errno));
+   return -1;
+   }
+
+   bind_done = true;
+   }
+
+   if (mount("bpf", target, "bpf", 0, "mode=0700")) {
+   snprintf(buff, bufflen, "mount -t bpf bpf %s failed: %s",
+target, strerror(errno));
+   return -1;
+   }
+
+   return 0;
+}
+
 int open_obj_pinned_any(char *path, enum bpf_obj_type exp_type)
 {
enum bpf_obj_type type;
@@ -89,8 +121,11 @@ int open_obj_pinned_any(char *path, enum bpf_obj_type 
exp_type)
 
 int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32))
 {
+   char err_str[ERR_MAX_LEN];
unsigned int id;
char *endptr;
+   char *file;
+   char *dir;
int err;
int fd;
 
@@ -117,16 +152,36 @@ int do_pin_any(int argc, char **argv, int 
(*get_fd_by_id)(__u32))
}
 
err = bpf_obj_pin(fd, *argv);
-   close(fd);
-   if (err) {
-   p_err("can't pin the object (%s): %s", *argv,
- errno == EACCES && !is_bpffs(dirname(*argv)) ?
-   "directory not in bpf file system (bpffs)" :
-   strerror(errno));
-   return -1;
+   if (!err)
+   goto out_close;
+
+   file = malloc(strlen(*argv) + 1);
+   strcpy(file, *argv);
+   dir = dirname(file);
+
+   if (errno != EPERM || is_bpffs(dir)) {
+   p_err("can't pin the object (%s): %s", *argv, strerror(errno));
+   goto out_free;
}
 
-   return 0;
+   /* Attempt to mount bpffs, then retry pinning. */
+   err = mnt_bpffs(dir, err_str, ERR_MAX_LEN);
+   if (!err) {
+   err = bpf_obj_pin(fd, *argv);
+   if (err)
+   p_err("can't pin the object (%s): %s", *argv,
+ strerror(errno));
+   } else {
+   err_str[ERR_MAX_LEN - 1] = '\0';
+   p_err("can't mount BPF file system to pin the object (%s): %s",
+ *argv, err_str);
+   }
+
+out_free:
+   free(file);
+out_close:
+   close(fd);
+   return err;
 }
 
 const char *get_fd_type_name(enum bpf_obj_type type)
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 2f94bed03a8d..d315d01be645 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -51,6 +51,8 @@
 #define NEXT_ARGP()({ (*argc)--; (*argv)++; if (*argc < 0) usage(); })
 #define BAD_ARG()  ({ p_err("what is '%s'?\n", *argv); -1; })
 
+#define ERR_MAX_LEN1024
+
 #define BPF_TAG_FMT"%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx"
 
 #define HELP_SPEC_PROGRAM  \
-- 
2.14.1

Re: [PATCH] net: LLC: Convert timers to use timer_setup()

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:45:48 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
> 
> Cc: "David S. Miller" 
> Cc: Eric Dumazet 
> Cc: Hans Liljestrand 
> Cc: "Paul E. McKenney" 
> Cc: "Reshetova, Elena" 
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied, thanks.

Re: [PATCH] net: ax25: Convert timers to use timer_setup()

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:45:39 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
> 
> Cc: Joerg Reuter 
> Cc: Ralf Baechle 
> Cc: "David S. Miller" 
> Cc: linux-h...@vger.kernel.org
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied.

Re: [PATCH] net: sctp: Convert timers to use timer_setup()

[David Miller]

From: Kees Cook 
Date: Tue, 24 Oct 2017 01:45:31 -0700

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
> 
> Cc: Vlad Yasevich 
> Cc: Neil Horman 
> Cc: "David S. Miller" 
> Cc: linux-s...@vger.kernel.org
> Cc: netdev@vger.kernel.org
> Signed-off-by: Kees Cook 

Applied.

Re: [PATCH net-next v3 2/2] net: ethernet: socionext: add AVE ethernet driver

[Masahiro Yamada]

2017-10-25 10:07 GMT+09:00 Kunihiko Hayashi :

> +
> +/* Descriptor Control Register Group */
> +#define AVE_DESCC  0x300   /* Descriptor Control */
> +#define AVE_TXDC   0x304   /* TX Descriptor Configuration */
> +#define AVE_RXDC0  0x308   /* RX Descriptor Ring0 Configuration */
> +#define AVE_IIRQC  0x34c   /* Interval IRQ Control */
> +
> +/* Packet Filter Register Group */
> +#define AVE_PKTF_BASE  0x800   /* PF Base Address */
> +#define AVE_PFMBYTE_BASE   0xd00   /* PF Mask Byte Base Address */
> +#define AVE_PFMBIT_BASE0xe00   /* PF Mask Bit Base Address */
> +#define AVE_PFSEL_BASE 0xf00   /* PF Selector Base Address */
> +#define AVE_PFEN   0xffc   /* Packet Filter Enable */
> +#define AVE_PKTF(ent)  (AVE_PKTF_BASE + (ent) * 0x40)
> +#define AVE_PFMBYTE(ent)   (AVE_PFMBYTE_BASE + (ent) * 8)
> +#define AVE_PFMBIT(ent)(AVE_PFMBIT_BASE + (ent) * 4)
> +#define AVE_PFSEL(ent) (AVE_PFSEL_BASE + (ent) * 4)
> +
> +/* 64bit descriptor memory */
> +#define AVE_DESC_SIZE_64   12  /* Descriptor Size */
> +
> +#define AVE_TXDM_640x1000  /* Tx Descriptor Memory */
> +#define AVE_RXDM_640x1c00  /* Rx Descriptor Memory */
> +
> +#define AVE_TXDM_SIZE_64   0x0ba0  /* Tx Descriptor Memory Size 3KB */
> +#define AVE_RXDM_SIZE_64   0x6000  /* Rx Descriptor Memory Size 24KB */
> +
> +/* 32bit descriptor memory */
> +#define AVE_DESC_SIZE_32   8   /* Descriptor Size */
> +
> +#define AVE_TXDM_320x1000  /* Tx Descriptor Memory */
> +#define AVE_RXDM_320x1800  /* Rx Descriptor Memory */
> +
> +#define AVE_TXDM_SIZE_32   0x07c0  /* Tx Descriptor Memory Size 2KB */
> +#define AVE_RXDM_SIZE_32   0x4000  /* Rx Descriptor Memory Size 16KB */
> +
> +/* RMII Bridge Register Group */
> +#define AVE_RSTCTRL0x8028  /* Reset control */
> +#define AVE_RSTCTRL_RMIIRSTBIT(16)
> +#define AVE_LINKSEL0x8034  /* Link speed setting */
> +#define AVE_LINKSEL_100M   BIT(0)
> +
> +/* AVE_GRR */
> +#define AVE_GRR_RXFFR  BIT(5)  /* Reset RxFIFO */
> +#define AVE_GRR_PHYRST BIT(4)  /* Reset external PHY */
> +#define AVE_GRR_GRST   BIT(0)  /* Reset all MAC */
> +
> +/* AVE_GISR (common with GIMR) */
> +#define AVE_GI_PHY BIT(24) /* PHY interrupt */
> +#define AVE_GI_TX  BIT(16) /* Tx complete */
> +#define AVE_GI_RXERR   BIT(8)  /* Receive frame more than max size */
> +#define AVE_GI_RXOVF   BIT(7)  /* Overflow at the RxFIFO */
> +#define AVE_GI_RXDROP  BIT(6)  /* Drop packet */
> +#define AVE_GI_RXIINT  BIT(5)  /* Interval interrupt */
> +
> +/* AVE_TXCR */
> +#define AVE_TXCR_FLOCTRBIT(18) /* Flow control */
> +#define AVE_TXCR_TXSPD_1G  BIT(17)
> +#define AVE_TXCR_TXSPD_100 BIT(16)
> +
> +/* AVE_RXCR */
> +#define AVE_RXCR_RXEN  BIT(30) /* Rx enable */
> +#define AVE_RXCR_FDUPENBIT(22) /* Interface mode */
> +#define AVE_RXCR_FLOCTRBIT(21) /* Flow control */
> +#define AVE_RXCR_AFEN  BIT(19) /* MAC address filter */
> +#define AVE_RXCR_DRPEN BIT(18) /* Drop pause frame */
> +#define AVE_RXCR_MPSIZ_MASKGENMASK(10, 0)
> +
> +/* AVE_MDIOCTR */
> +#define AVE_MDIOCTR_RREQ   BIT(3)  /* Read request */
> +#define AVE_MDIOCTR_WREQ   BIT(2)  /* Write request */


BIT() is descending.



> +/* AVE_MDIOSR */
> +#define AVE_MDIOSR_STS BIT(0)  /* access status */
> +
> +/* AVE_DESCC */
> +#define AVE_DESCC_TD   BIT(0)  /* Enable Tx descriptor */
> +#define AVE_DESCC_RDSTPBIT(4)  /* Pause Rx descriptor */
> +#define AVE_DESCC_RD0  BIT(8)  /* Enable Rx descriptor Ring0 */
> +#define AVE_DESCC_STATUS_MASK  GENMASK(31, 16)


BIT() is ascending.

Please be consistent.






> +
> +static void ave_wdesc_addr(struct net_device *ndev, enum desc_id id,
> +  int entry, dma_addr_t paddr)
> +{
> +   struct ave_private *priv = netdev_priv(ndev);
> +
> +   ave_wdesc(ndev, id, entry, AVE_DESC_OFS_ADDRL, lower_32_bits(paddr));
> +   if (IS_DESC_64BIT(priv))
> +   ave_wdesc(ndev, id,
> + entry, AVE_DESC_OFS_ADDRU, upper_32_bits(paddr));
> +   else if ((u64)paddr > (u64)U32_MAX)
> +   netdev_warn(ndev, "DMA address exceeds the address space\n");
> +}

Yuk!
Why don't you use dma_set_mask() instead of this?




> +
> +static int ave_mdio_busywait(struct net_device *ndev)
> +{
> +   int ret = 0, loop = 100;
> +   u32 mdiosr;
> +
> +   /* wait until completion */
> +   while (--loop) {
> +   mdiosr = ave_r32(ndev, AVE_MDIOSR);
> +   if (!(mdiosr & AVE_MDIOSR_STS))
> +   break;
> +
> +   usleep_range(10, 20);
> +   }
> +
> +   if (!loop) {
> +   

Re: [PATCH net-next v3 01/10] devlink: Add permanent config parameter get/set operations

[David Miller]

From: Steve Lin 
Date: Tue, 24 Oct 2017 16:12:33 -0400

> + switch (type) {
> + case NLA_U8:
> + val = *((u8 *)value);
> + if (nla_put_u8(msg, DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
> + goto nest_err;
> + break;
> + case NLA_U16:
> + val = *((u16 *)value);
> + if (nla_put_u16(msg, DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
> + goto nest_err;
> + break;
> + case NLA_U32:
> + val = *((u32 *)value);
> + if (nla_put_u32(msg, DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
> + goto nest_err;
> + break;
> + }
> + nla_nest_end(msg, param_attr);
> +
> + kfree(value);

You have to get the endianness right on these things.  Netlink could
theoretically be done over a network, so just saying "device and
system endianness match" is not a valid argument.

Typing and endianness is so important for interfaces like this, so
please contruct the interfaces such that the compiler and 'sparse' can
help us make sure it is done properly.

Thanks.

Re: [PATCH net-next v3 01/10] devlink: Add permanent config parameter get/set operations

[Steve Lin]

On Tue, Oct 24, 2017 at 5:22 PM, Yuval Mintz  wrote:
>> Add support for permanent config parameter get/set commands. Used
>> for persistent device configuration parameters.
>>
> ...
>> + int (*perm_config_get)(struct devlink *devlink,
>> +enum devlink_perm_config_param param, u8
>> type,
>> +void *value);
>> + int (*perm_config_set)(struct devlink *devlink,
>> +enum devlink_perm_config_param param, u8
>> type,
>> +void *value, u8 *restart_reqd);
>>  };
>> +static int devlink_nl_single_param_get(struct sk_buff *msg,
>> +struct devlink *devlink,
>> +u32 param, u8 type)
>> +{
>> + const struct devlink_ops *ops = devlink->ops;
>> + struct nlattr *param_attr;
>> + void *value;
>> + u32 val;
>> + int err;
>> +
>> + /* Allocate buffer for parameter value */
>> + switch (type) {
>> + case NLA_U8:
>> + value = kmalloc(sizeof(u8), GFP_KERNEL);
>> + break;
>> + case NLA_U16:
>> + value = kmalloc(sizeof(u16), GFP_KERNEL);
>> + break;
>> + case NLA_U32:
>> + value = kmalloc(sizeof(u32), GFP_KERNEL);
>> + break;
>> + default:
>> + return -EINVAL; /* Unsupported Type */
>> + }
>> +
>> + if (!value)
>> + return -ENOMEM;
>> +
>> + err = ops->perm_config_get(devlink, param, type, value);
>> + if (err)
>> + return err;
>
> I suspect this logic might be risky - its dependent on the driver to cast the
> 'value' into the proper type or else, E.g., the following switch might break
> for BE platforms.
> Is there any reason to have the devlink <-> driver API be based on void*
> and not on some typed data [of sufficient size]?
> ...
>> + switch (type) {
>> + case NLA_U8:
>> + val = *((u8 *)value);
>> + if (nla_put_u8(msg, DEVLINK_ATTR_PERM_CONFIG_VALUE,
>> val))
>> + goto nest_err;
>> + break;
>> + case NLA_U16:
>> + val = *((u16 *)value);
>> + if (nla_put_u16(msg,
>> DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
>> + goto nest_err;
>> + break;
>> + case NLA_U32:
>> + val = *((u32 *)value);
>> + if (nla_put_u32(msg,
>> DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
>> + goto nest_err;
>> + break;
>> + }

Why might this break on a BE system?  It's not as though driver will
be compiled LE and kernel BE or vice versa - as long as driver and
kernel are same endian-ness, I would think it should be okay?

In general, the issue is that the parameter could be any of the
netlink types (per Jiri's suggestion to the previous version of this
patch).  So, we allocate some space, tell the driver the type we're
expecting (the type argument to the perm_config_get() function), and
yes, we rely on the driver to write something of the type we request
to the pointer we provide.  Are you suggesting defining a union of
U8/U16/U32, and passing a pointer to that for the driver to fill in?
The issue is that whatever the types we support now, we want future
parameters to be able to be of arbitrary types.  Defining the
interface to use the void pointer means that some future parameter can
be of some other type, without having to update all the drivers using
this API...

Or did I misunderstand your suggestion?

Re: [PATCH] rxrpc: recvmsg: use BUG_ON instead of if condition followed by BUG

[Gustavo A. R. Silva]

Hi Tom,

Quoting Tom Herbert :


Please combine these related patches fixing BUG in rxrpc into a patch
set with proper annotation,



I can do that.


Also, can any of these BUG_ONs be replaced by WARN_ONs? Warnings are
generally preferable to crashing the system.



What about WARN_ON_ONCE instead?

Thanks
--
Gustavo A. R. Silva


Tom


On Tue, Oct 24, 2017 at 9:20 AM, Gustavo A. R. Silva
 wrote:

Use BUG_ON instead of if condition followed by BUG.

This issue was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva 
---
 net/rxrpc/recvmsg.c | 6 ++
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index bdece21..9598b92 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -243,8 +243,7 @@ static int rxrpc_verify_packet(struct  
rxrpc_call *call, struct sk_buff *skb,

 */
if ((annotation & RXRPC_RX_ANNO_JUMBO) > 1) {
__be16 tmp;
-   if (skb_copy_bits(skb, offset - 2, , 2) < 0)
-   BUG();
+   BUG_ON(skb_copy_bits(skb, offset - 2, , 2) < 0);
cksum = ntohs(tmp);
seq += (annotation & RXRPC_RX_ANNO_JUMBO) - 1;
}
@@ -503,8 +502,7 @@ int rxrpc_recvmsg(struct socket *sock, struct  
msghdr *msg, size_t len,


release_sock(>sk);

-   if (test_bit(RXRPC_CALL_RELEASED, >flags))
-   BUG();
+   BUG_ON(test_bit(RXRPC_CALL_RELEASED, >flags));

if (test_bit(RXRPC_CALL_HAS_USERID, >flags)) {
if (flags & MSG_CMSG_COMPAT) {
--
2.7.4

Re: [PATCH net-next v3 06/10] bnxt: Add devlink support for config get/set

[Steve Lin]

On Tue, Oct 24, 2017 at 4:52 PM, Michael Chan  wrote:
> On Tue, Oct 24, 2017 at 1:12 PM, Steve Lin  wrote:
>> Implements get and set of configuration parameters using new devlink
>> config get/set API.  Parameters themselves defined in later patches.
>>
>> Signed-off-by: Steve Lin 
>> Acked-by: Andy Gospodarek 
>> ---
>>  drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 262 
>> +-
>>  drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h |  17 ++
>>  drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h | 100 +
>>  3 files changed, 373 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c 
>> b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
>> index f3f6aa8..81ab77e 100644
>> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
>> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
>> @@ -14,11 +14,261 @@
>>  #include "bnxt_vfr.h"
>>  #include "bnxt_devlink.h"
>>
>> -static const struct devlink_ops bnxt_dl_ops = {
>> +struct bnxt_drv_cfgparam bnxt_drv_cfgparam_list[] = {
>> +};
>> +
>> +#define BNXT_NUM_DRV_CFGPARAM ARRAY_SIZE(bnxt_drv_cfgparam_list)
>> +
>> +static int bnxt_nvm_read(struct bnxt *bp, int nvm_param, int idx,
>> +void *buf, int size)
>> +{
>> +   struct hwrm_nvm_get_variable_input req = {0};
>> +   dma_addr_t dest_data_dma_addr;
>> +   void *dest_data_addr = NULL;
>> +   int bytesize;
>> +   int rc;
>> +
>> +   bytesize = (size + 7) / BITS_PER_BYTE;
>> +   dest_data_addr = dma_alloc_coherent(>pdev->dev, bytesize,
>> +   _data_dma_addr, GFP_KERNEL);
>> +   if (!dest_data_addr) {
>> +   netdev_err(bp->dev, "dma_alloc_coherent failure\n");
>> +   return -ENOMEM;
>> +   }
>> +
>> +   bnxt_hwrm_cmd_hdr_init(bp, , HWRM_NVM_GET_VARIABLE, -1, -1);
>> +   req.dest_data_addr = cpu_to_le64(dest_data_dma_addr);
>> +   req.data_len = cpu_to_le16(size);
>> +   req.option_num = cpu_to_le16(nvm_param);
>> +   req.index_0 = cpu_to_le16(idx);
>> +   if (idx != 0)
>> +   req.dimensions = cpu_to_le16(1);
>> +
>> +   rc = _hwrm_send_message(bp, , sizeof(req), HWRM_CMD_TIMEOUT);
>
> This won't have the proper mutex protection.  You should call
> hwrm_send_message() instead.

Ok, thanks, I'll fix that.

Re: [PATCHv3 net-next 0/4] net: remove rtmsg_ifinfo used in bridge and bonding

[David Miller]

From: Xin Long 
Date: Tue, 24 Oct 2017 13:54:16 +0800

> It's better to send notifications to userspace by the events in
> rtnetlink_event, instead of calling rtmsg_ifinfo directly.
> 
> This patcheset is to remove rtmsg_ifinfo called in bonding and
> bridge, the notifications can be handled by NETDEV_CHANGEUPPER
> and NETDEV_CHANGELOWERSTATE events in rtnetlink_event.
> 
> It could also fix some redundant notifications from bonding and
> bridge.
> 
> v1->v2:
>   - post to net-next.git instead of net.git, for it's more like an
> improvement for bonding
> v2->v3:
>   - add patch 1/4 to remove rtmsg_ifinfo called in add_del_if

Series applied, thanks.

Re: [PATCH] tap: double-free in error path in tap_open()

[Jason Wang]

On 2017年10月25日 05:41, Girish Moodalbail wrote:

Double free of skb_array in tap module is causing kernel panic. When
tap_set_queue() fails we free skb_array right away by calling
skb_array_cleanup(). However, later on skb_array_cleanup() is called
again by tap_sock_destruct through sock_put(). This patch fixes that
issue.

Fixes: 362899b8725b35e3 (macvtap: switch to use skb array)
Signed-off-by: Girish Moodalbail 
---
  drivers/net/tap.c | 12 ++--
  1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 21b71ae..878520b 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -542,20 +542,20 @@ static int tap_open(struct inode *inode, struct file 
*file)
  
  	err = -ENOMEM;

if (skb_array_init(>skb_array, tap->dev->tx_queue_len, GFP_KERNEL))
-   goto err_array;
+   goto err_put;


Looks like this will cause skb_array_cleanup() to be called when skb 
array was uninitialized?


Thanks

  
  	err = tap_set_queue(tap, file, q);

-   if (err)
-   goto err_queue;
+   if (err) {
+   /* tap_sock_destruct() will take care of freeing skb_array */
+   goto err_put;
+   }
  
  	dev_put(tap->dev);
  
  	rtnl_unlock();

return err;
  
-err_queue:

-   skb_array_cleanup(>skb_array);
-err_array:
+err_put:
sock_put(>sk);
  err:
if (tap)

Re: [PATCH net] net: dsa: check master device before put

[David Miller]

From: Vivien Didelot 
Date: Tue, 24 Oct 2017 16:37:19 -0400

> In the case of pdata, the dsa_cpu_parse function calls dev_put() before
> making sure it isn't NULL. Fix this.
> 
> Fixes: 71e0bbde0d88 ("net: dsa: Add support for platform data")
> Signed-off-by: Vivien Didelot 
> Reviewed-by: Florian Fainelli 

Applied and queued up for -stable.

Thank you.

Re: [PATCH net-next v3 0/3] bpf: permit multiple bpf attachments for a single perf tracepoint event

[David Miller]

From: Yonghong Song 
Date: Mon, 23 Oct 2017 23:53:06 -0700

> This patch set adds support to permit multiple bpf prog attachments
> for a single perf tracepoint event. Patch 1 does some cleanup such
> that perf_event_{set|free}_bpf_handler is called under the
> same condition. Patch 2 has the core implementation, and
> Patch 3 adds a test case.
> 
> Changelogs:
> v2 -> v3:
>   . fix compilation error.
> v1 -> v2:
>   . fix a potential deadlock issue discovered by Daniel.
>   . fix some coding style issues.

Series applied.

Re: [Patch net 00/15] net_sched: remove RCU callbacks from TC

[David Miller]

From: Cong Wang 
Date: Mon, 23 Oct 2017 15:02:49 -0700

> Recently, the RCU callbacks used in TC filters and TC actions keep
> drawing my attention, they introduce at least 4 race condition bugs:

Like Eric, I think doing a full RCU sync on every delete is too big
a pill to swallow.  This is a major control plane performance
regression.

Please find another reasonable way to fix this.

Thank you.

Re: [PATCH] rxrpc: recvmsg: use BUG_ON instead of if condition followed by BUG

[Tom Herbert]

Please combine these related patches fixing BUG in rxrpc into a patch
set with proper annotation,

Also, can any of these BUG_ONs be replaced by WARN_ONs? Warnings are
generally preferable to crashing the system.

Tom


On Tue, Oct 24, 2017 at 9:20 AM, Gustavo A. R. Silva
 wrote:
> Use BUG_ON instead of if condition followed by BUG.
>
> This issue was detected with the help of Coccinelle.
>
> Signed-off-by: Gustavo A. R. Silva 
> ---
>  net/rxrpc/recvmsg.c | 6 ++
>  1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
> index bdece21..9598b92 100644
> --- a/net/rxrpc/recvmsg.c
> +++ b/net/rxrpc/recvmsg.c
> @@ -243,8 +243,7 @@ static int rxrpc_verify_packet(struct rxrpc_call *call, 
> struct sk_buff *skb,
>  */
> if ((annotation & RXRPC_RX_ANNO_JUMBO) > 1) {
> __be16 tmp;
> -   if (skb_copy_bits(skb, offset - 2, , 2) < 0)
> -   BUG();
> +   BUG_ON(skb_copy_bits(skb, offset - 2, , 2) < 0);
> cksum = ntohs(tmp);
> seq += (annotation & RXRPC_RX_ANNO_JUMBO) - 1;
> }
> @@ -503,8 +502,7 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr 
> *msg, size_t len,
>
> release_sock(>sk);
>
> -   if (test_bit(RXRPC_CALL_RELEASED, >flags))
> -   BUG();
> +   BUG_ON(test_bit(RXRPC_CALL_RELEASED, >flags));
>
> if (test_bit(RXRPC_CALL_HAS_USERID, >flags)) {
> if (flags & MSG_CMSG_COMPAT) {
> --
> 2.7.4
>

Re: [PATCH net-next] strparser: Use delayed work instead of timer for msg timeout

[David Miller]

From: Tom Herbert 
Date: Fri, 20 Oct 2017 16:40:43 -0700

> Sock lock may be taken in the message timer function which is a
> problem since timers run in BH. Instead of timers use delayed_work.
> 
> Reported-by: Eric Dumazet 
> Fixes: bbb03029a899 ("strparser: Generalize strparser")
> Signed-off-by: Tom Herbert 

Since this bug exists in 'net' I've applied this patch there.

Thanks.

Re: [PATCH net-next] ip6_tunnel: Allow rcv/xmit even if remote address is a local address

[David Miller]

From: Shmulik Ladkani 
Date: Sat, 21 Oct 2017 00:25:15 +0300

> From: Shmulik Ladkani 
> 
> Currently, ip6_tnl_xmit_ctl drops tunneled packets if the remote
> address (outer v6 destination) is one of host's locally configured
> addresses.
> Same applies to ip6_tnl_rcv_ctl: it drops packets if the remote address
> (outer v6 source) is a local address.
> 
> This prevents using ipxip6 (and ip6_gre) tunnels whose local/remote
> endpoints are on same host; OTOH v4 tunnels (ipip or gre) allow such
> configurations.
> 
> An example where this proves useful is a system where entities are
> identified by their unique v6 addresses, and use tunnels to encapsulate
> traffic between them. The limitation prevents placing several entities
> on same host.
> 
> Introduce IP6_TNL_F_ALLOW_LOCAL_REMOTE which allows to bypass this
> restriction.
> 
> Signed-off-by: Shmulik Ladkani 

Given this wasn't allowed for so long, making it configurable makes
sense.

Applied, thanks.

[PATCH net-next v3 1/2] dt-bindings: net: add DT bindings for Socionext UniPhier AVE

[Kunihiko Hayashi]

DT bindings for the AVE ethernet controller found on Socionext's
UniPhier platforms.

Signed-off-by: Kunihiko Hayashi 
Signed-off-by: Jassi Brar 
---
 .../bindings/net/socionext,uniphier-ave4.txt   | 48 ++
 1 file changed, 48 insertions(+)
 create mode 100644 
Documentation/devicetree/bindings/net/socionext,uniphier-ave4.txt

diff --git a/Documentation/devicetree/bindings/net/socionext,uniphier-ave4.txt 
b/Documentation/devicetree/bindings/net/socionext,uniphier-ave4.txt
new file mode 100644
index 000..4b7eca8
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/socionext,uniphier-ave4.txt
@@ -0,0 +1,48 @@
+* Socionext AVE ethernet controller
+
+This describes the devicetree bindings for AVE ethernet controller
+implemented on Socionext UniPhier SoCs.
+
+Required properties:
+ - compatible: Should be
+   - "socionext,uniphier-pro4-ave4" : for Pro4 SoC
+   - "socionext,uniphier-pxs2-ave4" : for PXs2 SoC
+   - "socionext,uniphier-ld11-ave4" : for LD11 SoC
+   - "socionext,uniphier-ld20-ave4" : for LD20 SoC
+ - reg: Address where registers are mapped and size of region.
+ - interrupts: Should contain the MAC interrupt.
+ - phy-mode: See ethernet.txt in the same directory. Allow to choose
+   "rgmii", "rmii", or "mii" according to the PHY.
+ - phy-handle: Should point to the external phy device.
+   See ethernet.txt file in the same directory.
+ - clocks: A phandle to the clock for the MAC.
+
+Optional properties:
+ - resets: A phandle to the reset control for the MAC.
+ - local-mac-address: See ethernet.txt in the same directory.
+
+Required subnode:
+ - mdio: Device tree subnode with the following required properties:
+   - #address-cells: Must be <1>.
+   - #size-cells: Must be <0>.
+   - reg: phy ID number, usually a small integer.
+
+Example:
+
+   ether: ethernet@6500 {
+   compatible = "socionext,uniphier-ld20-ave4";
+   reg = <0x6500 0x8500>;
+   interrupts = <0 66 4>;
+   phy-mode = "rgmii";
+   phy-handle = <>;
+   clocks = <_clk 6>;
+   resets = <_rst 6>;
+   local-mac-address = [00 00 00 00 00 00];
+   mdio {
+   #address-cells = <1>;
+   #size-cells = <0>;
+   ethphy: ethphy@1 {
+   reg = <1>;
+   };
+   };
+   };
-- 
2.7.4

[PATCH net-next v3 0/2] add UniPhier AVE ethernet support

[Kunihiko Hayashi]

This series adds support for Socionext AVE ethernet controller implemented
on UniPhier SoCs. This driver supports RGMII/RMII modes.

v1: http://www.spinics.net/lists/netdev/msg454292.html
v2: http://www.spinics.net/lists/netdev/msg460109.html

The PHY patch included in v1 has already separated in:
http://www.spinics.net/lists/netdev/msg454595.html

Changes since v2:
- replace clk_get() with devm_clk_get()
- replace reset_control_get() with devm_reset_control_get_optional_shared()
- add error return when the error occurs on the above *_get functions
- sort soc data and compatible strings
- remove clearly obvious comments
- modify dt-bindings document consistent with these modifications

Changes since v1:
- add/remove devicetree properties and sub-node
  - remove "internal-phy-interrupt" and "desc-bits" property
  - add SoC data structures based on compatible strings
  - add node operation to apply "mdio" sub-node
- add support for features
  - add support for {get,set}_pauseparam and pause frame operations
  - add support for ndo_get_stats64 instead of ndo_get_stats
- replace with desiable functions
  - replace check for valid phy_mode with phy_interface{_mode}_is_rgmii()
  - replace phy attach message with phy_attached_info()
  - replace 32bit operation with {upper,lower}_32_bits() on ave_wdesc_addr()
  - replace nway_reset and get_link with generic functions
- move operations to proper functions
  - move phy_start_aneg() to ndo_open,
and remove unnecessary PHY interrupt operations
See http://www.spinics.net/lists/netdev/msg454590.html
  - move irq initialization and descriptor memory allocation to ndo_open
  - move initialization of reset and clock and mdiobus to ndo_init
- fix skbuffer operations
  - fix skb alignment operations and add Rx buffer adjustment for descriptor
See http://www.spinics.net/lists/netdev/msg456014.html
  - add error returns when dma_map_single() failed 
- clean up code structures
  - clean up wait-loop and wake-queue conditions
  - add ave_wdesc_addr() and offset definitions
  - add ave_macaddr_init() to clean up mac-address operation
  - fix checking whether Tx entry is not enough
  - fix supported features of phydev
  - add necessary free/disable operations
  - add phydev check on ave_{get,set}_wol()
  - remove netif_carrier functions, phydev initializer, and Tx budget check
- change obsolate codes
  - replace ndev->{base_addr,irq} with the members of ave_private
- rename goto labels and mask definitions, and remove unused codes

Kunihiko Hayashi (2):
  dt-bindings: net: add DT bindings for Socionext UniPhier AVE
  net: ethernet: socionext: add AVE ethernet driver

 .../bindings/net/socionext,uniphier-ave4.txt   |   48 +
 drivers/net/ethernet/Kconfig   |1 +
 drivers/net/ethernet/Makefile  |1 +
 drivers/net/ethernet/socionext/Kconfig |   22 +
 drivers/net/ethernet/socionext/Makefile|4 +
 drivers/net/ethernet/socionext/sni_ave.c   | 1746 
 6 files changed, 1822 insertions(+)
 create mode 100644 
Documentation/devicetree/bindings/net/socionext,uniphier-ave4.txt
 create mode 100644 drivers/net/ethernet/socionext/Kconfig
 create mode 100644 drivers/net/ethernet/socionext/Makefile
 create mode 100644 drivers/net/ethernet/socionext/sni_ave.c

-- 
2.7.4

[PATCH net-next v3 2/2] net: ethernet: socionext: add AVE ethernet driver

[Kunihiko Hayashi]

The UniPhier platform from Socionext provides the AVE ethernet
controller that includes MAC and MDIO bus supporting RGMII/RMII
modes. The controller is named AVE.

Signed-off-by: Kunihiko Hayashi 
Signed-off-by: Jassi Brar 
---
 drivers/net/ethernet/Kconfig |1 +
 drivers/net/ethernet/Makefile|1 +
 drivers/net/ethernet/socionext/Kconfig   |   22 +
 drivers/net/ethernet/socionext/Makefile  |4 +
 drivers/net/ethernet/socionext/sni_ave.c | 1746 ++
 5 files changed, 1774 insertions(+)
 create mode 100644 drivers/net/ethernet/socionext/Kconfig
 create mode 100644 drivers/net/ethernet/socionext/Makefile
 create mode 100644 drivers/net/ethernet/socionext/sni_ave.c

diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index c604213..d50519e 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -170,6 +170,7 @@ source "drivers/net/ethernet/sis/Kconfig"
 source "drivers/net/ethernet/sfc/Kconfig"
 source "drivers/net/ethernet/sgi/Kconfig"
 source "drivers/net/ethernet/smsc/Kconfig"
+source "drivers/net/ethernet/socionext/Kconfig"
 source "drivers/net/ethernet/stmicro/Kconfig"
 source "drivers/net/ethernet/sun/Kconfig"
 source "drivers/net/ethernet/tehuti/Kconfig"
diff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile
index a0a03d4..9f55b36 100644
--- a/drivers/net/ethernet/Makefile
+++ b/drivers/net/ethernet/Makefile
@@ -81,6 +81,7 @@ obj-$(CONFIG_SFC) += sfc/
 obj-$(CONFIG_SFC_FALCON) += sfc/falcon/
 obj-$(CONFIG_NET_VENDOR_SGI) += sgi/
 obj-$(CONFIG_NET_VENDOR_SMSC) += smsc/
+obj-$(CONFIG_NET_VENDOR_SOCIONEXT) += socionext/
 obj-$(CONFIG_NET_VENDOR_STMICRO) += stmicro/
 obj-$(CONFIG_NET_VENDOR_SUN) += sun/
 obj-$(CONFIG_NET_VENDOR_TEHUTI) += tehuti/
diff --git a/drivers/net/ethernet/socionext/Kconfig 
b/drivers/net/ethernet/socionext/Kconfig
new file mode 100644
index 000..3a1829e
--- /dev/null
+++ b/drivers/net/ethernet/socionext/Kconfig
@@ -0,0 +1,22 @@
+config NET_VENDOR_SOCIONEXT
+   bool "Socionext ethernet drivers"
+   default y
+   ---help---
+ Option to select ethernet drivers for Socionext platforms.
+
+ Note that the answer to this question doesn't directly affect the
+ kernel: saying N will just cause the configurator to skip all
+ the questions about Socionext devices. If you say Y, you will be asked
+ for your specific card in the following questions.
+
+if NET_VENDOR_SOCIONEXT
+
+config SNI_AVE
+   tristate "Socionext AVE ethernet support"
+   depends on (ARCH_UNIPHIER || COMPILE_TEST) && OF
+   select PHYLIB
+   ---help---
+ Driver for gigabit ethernet MACs, called AVE, in the
+ Socionext UniPhier family.
+
+endif #NET_VENDOR_SOCIONEXT
diff --git a/drivers/net/ethernet/socionext/Makefile 
b/drivers/net/ethernet/socionext/Makefile
new file mode 100644
index 000..0356341
--- /dev/null
+++ b/drivers/net/ethernet/socionext/Makefile
@@ -0,0 +1,4 @@
+#
+# Makefile for all ethernet ip drivers on Socionext platforms
+#
+obj-$(CONFIG_SNI_AVE) += sni_ave.o
diff --git a/drivers/net/ethernet/socionext/sni_ave.c 
b/drivers/net/ethernet/socionext/sni_ave.c
new file mode 100644
index 000..ed0f4a3
--- /dev/null
+++ b/drivers/net/ethernet/socionext/sni_ave.c
@@ -0,0 +1,1746 @@
+/**
+ * sni_ave.c - Socionext UniPhier AVE ethernet driver
+ *
+ * Copyright 2014 Panasonic Corporation
+ * Copyright 2015-2017 Socionext Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2  of
+ * the License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+
+/* General Register Group */
+#define AVE_IDR0x0 /* ID */
+#define AVE_VR 0x4 /* Version */
+#define AVE_GRR0x8 /* Global Reset */
+#define AVE_CFGR   0xc /* Configuration */
+
+/* Interrupt Register Group */
+#define AVE_GIMR   0x100   /* Global Interrupt Mask */
+#define AVE_GISR   0x104   /* Global Interrupt Status */
+
+/* MAC Register Group */
+#define AVE_TXCR   0x200   /* TX Setup */
+#define AVE_RXCR   0x204   /* RX Setup */
+#define AVE_RXMAC1R0x208   /* MAC address (lower) */
+#define AVE_RXMAC2R0x20c   /* MAC address (upper) */
+#define AVE_MDIOCTR0x214   /* MDIO Control */
+#define AVE_MDIOAR 0x218   /* MDIO Address */
+#define AVE_MDIOWDR0x21c   /* MDIO Data */
+#define AVE_MDIOSR 

Re: [PATCH net-next] ipv6: update use count on dst_check()

[Martin KaFai Lau]

On Tue, Oct 24, 2017 at 10:42:57AM +, Paolo Abeni wrote:
> Currently, the dst 'lastuse' field is not updated in a reliable way
> for dst entries only accessed via socket cache.
> 
> This may fool the ipv6 dst gc, especially since we really age out unused
> entries, either via the commit 1859bac04fb6 ("ipv6: remove from fib tree
> aged out RTF_CACHE dst") or via the commit 1e2ea8ad37be ("ipv6: set
> dst.obsolete when a cached route has expired").
There is already an exception table and it already has a different way
of purging which is more inline with IPv4.  It purges based on
'When was the last time the ICMPv6 too-big/redirect received' and
we purge the one that will expire sooner.

As we are moving away from the IPv6's gc,
I don't think we need to further depend on lastuse to purge/age
the RTF_CACHE on top of the purging being done in the exception
table.

Beside, lastuse is only useful for RTF_CACHE route (redirect
route in particular since it has no expire which we should give
it one imo).  However, rt6_check() is called for everything,
e.g. non RTF_CACHE route which is the common case.  Even though
dst_use_noref() is cheap to do now, it is still unnecessary for
the common fast path.

> 
> Updating such field is now very cheap, thanks to commit 0da4af00b2ed
> ("ipv6: only update __use and lastusetime once per jiffy at most"),
> so we can address the issue updating 'lastuse' in ip6_dst_check(),
> if successful.
> 
> Fixes: 1859bac04fb6 ("ipv6: remove from fib tree aged out RTF_CACHE dst")
> Fixes: 1e2ea8ad37be ("ipv6: set dst.obsolete when a cached route has expired")
> Signed-off-by: Paolo Abeni 
> ---
>  net/ipv6/route.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 87a15cbd0e8b..8f8c7fb83b9b 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -1952,6 +1952,7 @@ static struct dst_entry *rt6_check(struct rt6_info *rt, 
> u32 cookie)
>   if (rt6_check_expired(rt))
>   return NULL;
>  
> + dst_use_noref(>dst, jiffies);
>   return >dst;
>  }
>  
> -- 
> 2.13.6
> 

Re: [PATCH V2 net-next 2/3] tcp: TCP experimental option for SMC

[David Miller]

From: Ursula Braun 
Date: Wed, 18 Oct 2017 16:29:59 +0200

> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 3b3b9b968e2d..a2e87ac8cdc0 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -45,6 +45,7 @@
>  
>  #include 
>  #include 
> +#include 

Only tcp_input.c needs this include.  If you include it here, then the
rest of the kernel pays the price of this include.

Re: [RFC] net/unix_diag: Provide UDIAG_SHOW_VFS2 attribute to fetch complete inode number

[Andrei Vagin]

On Wed, Oct 25, 2017 at 12:48:14AM +0300, Cyrill Gorcunov wrote:
> Currently unix_diag_vfs structure reports unix socket inode
> as u32 value which of course doesn't fit to ino_t type and

BTW: As far as I understand, it is not a problem right now, because
get_next_ino returns int. And I'm agree that it maybe a problem in a
future and it is better to be ready.

> the number may be trimmed. Lets rather deprecate old UDIAG_SHOW_VFS
> interface and provide UDIAG_SHOW_VFS2 (with one field "__zero" reserved
> which we could extend in future).

There is one more place where we return ino as u32:

static int sk_diag_dump_peer(struct sock *sk, struct sk_buff *nlskb)

return nla_put_u32(nlskb, UNIX_DIAG_PEER, ino);

> 
> CC: Andrey Vagin 
> CC: David S. Miller 
> CC: Pavel Emelyanov 
> Signed-off-by: Cyrill Gorcunov 
> ---
> 
> I build-tested it only thus not for inclusion yet, but rather
> to discuss if there some better way to handle this potential
> problem.
> 
>  include/uapi/linux/unix_diag.h |8 
>  net/unix/diag.c|   25 -
>  2 files changed, 24 insertions(+), 9 deletions(-)
> 
> Index: linux-ml.git/include/uapi/linux/unix_diag.h
> ===
> --- linux-ml.git.orig/include/uapi/linux/unix_diag.h
> +++ linux-ml.git/include/uapi/linux/unix_diag.h
> @@ -19,6 +19,7 @@ struct unix_diag_req {
>  #define UDIAG_SHOW_ICONS 0x0008  /* show pending connections */
>  #define UDIAG_SHOW_RQLEN 0x0010  /* show skb receive queue len */
>  #define UDIAG_SHOW_MEMINFO   0x0020  /* show memory info of a socket 
> */
> +#define UDIAG_SHOW_VFS2  0x0040  /* show VFS inode info 
> v2 */
>  
>  struct unix_diag_msg {
>   __u8udiag_family;
> @@ -39,6 +40,7 @@ enum {
>   UNIX_DIAG_RQLEN,
>   UNIX_DIAG_MEMINFO,
>   UNIX_DIAG_SHUTDOWN,
> + UNIX_DIAG_VFS2,
>  
>   __UNIX_DIAG_MAX,
>  };
> @@ -50,6 +52,12 @@ struct unix_diag_vfs {
>   __u32   udiag_vfs_dev;
>  };
>  
> +struct unix_diag_vfs2 {
> + __u64   udiag_vfs_ino;
> + __u32   udiag_vfs_dev;
> + __u32   __zero; /* Reserve for future use */

How can a user understand whether this field is used or not?

Each netlink attribute has its size in a header. Any attribute can be
extended, and users can understand which fields are filled by
a size of an attribute.

> +};
> +
>  struct unix_diag_rqlen {
>   __u32   udiag_rqueue;
>   __u32   udiag_wqueue;
> Index: linux-ml.git/net/unix/diag.c
> ===
> --- linux-ml.git.orig/net/unix/diag.c
> +++ linux-ml.git/net/unix/diag.c
> @@ -19,17 +19,24 @@ static int sk_diag_dump_name(struct sock
>  addr->name->sun_path);
>  }
>  
> -static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb)
> +static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb, unsigned 
> int flags)
>  {
>   struct dentry *dentry = unix_sk(sk)->path.dentry;
>  
>   if (dentry) {
> - struct unix_diag_vfs uv = {
> - .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
> - .udiag_vfs_dev = dentry->d_sb->s_dev,
> - };
> -
> - return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), );
> + if (flags & UDIAG_SHOW_VFS2) {
> + struct unix_diag_vfs uv = {
> + .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
> + .udiag_vfs_dev = dentry->d_sb->s_dev,
> + };
> + return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), );
> + } else {
> + struct unix_diag_vfs2 uv = {
> + .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
> + .udiag_vfs_dev = dentry->d_sb->s_dev,
> + };
> + return nla_put(nlskb, UDIAG_SHOW_VFS2, sizeof(uv), );
> + }
>   }
>  
>   return 0;
> @@ -132,8 +139,8 @@ static int sk_diag_fill(struct sock *sk,
>   sk_diag_dump_name(sk, skb))
>   goto out_nlmsg_trim;
>  
> - if ((req->udiag_show & UDIAG_SHOW_VFS) &&
> - sk_diag_dump_vfs(sk, skb))
> + if ((req->udiag_show & (UDIAG_SHOW_VFS | UDIAG_SHOW_VFS2)) &&
> + sk_diag_dump_vfs(sk, skb, req->udiag_show))
>   goto out_nlmsg_trim;
>  
>   if ((req->udiag_show & UDIAG_SHOW_PEER) &&

[iproute PATCH] ss: add detail explains of -m, -o, -e and -i options in ss man page

[peng yu]

commit 340a45f79395144bd14fdf9be1904c0036456b6e
Author: yupeng 
Date:   Tue Oct 24 23:55:29 2017 +

add additional explain in ss man page

Add detail explains of -m, -o, -e and -i options, which are not
documented anywhere

Signed-off-by: Peng Yu 

diff --git a/man/man8/ss.8 b/man/man8/ss.8
index 3bec97f..4597733 100644
--- a/man/man8/ss.8
+++ b/man/man8/ss.8
@@ -176,6 +176,147 @@ states except for
 - opposite to
 .B bucket

+.SH Additional explain of -m, -o, -e and -i options
+Some fields may have different meanings if the netowrk protocl is
different. Below explain focus on tcp protocol.
+.TP
+.B -m option
+skmem:(r,rb,t,tb,f,w,o,bl)
+
+.B 
+the memory allocated for receiving package
+
+.B 
+the total memory can be allocated for receiving package
+
+.B 
+the memory used for sending package (which has been sent to layer 3)
+
+.B 
+the total memory can be allocated for sending package
+
+.B 
+the memory allocated by the socket as cache, but not used for
receiving/sending pacakge yet. If need memory to send/receive package,
the memory in this cache will be used before allocate additional
memory.
+
+.B 
+The memory allocated for sending package (which has not been sent to layer 3)
+
+.B 
+The memory used for storing socket option, e.g., the key for TCP MD5 signature
+
+.B 
+The memory used for the sk backlog queue. On a process context, if
the process is receving package, and a new package is received, it
will be put into the sk backlog queue, so it can be received by the
process immediately
+.TP
+.B -o option
+timer:(,,)
+
+.B 
+the name of the timer, there are five kind of timer names:
+
+.BR on ": means one of these timers: tcp retrans timer, tcp early
retrans timer and tail loss probe timer"
+
+.BR keepalive ": tcp keep alive timer"
+
+.BR timewait ": timewait stage timer"
+
+.BR persist ": zero window probe timer"
+
+.BR unknown ": none of the above timers"
+
+.B 
+how long time the timer will expire
+
+.B 
+how many times the retran occurs
+.TP
+
+.B -e option
+uid: ino: sk:
+
+.B 
+the user id the socket belongs to
+
+.B 
+the socket's inode number in VFS
+
+.B 
+an uuid of the socket
+
+.TP
+.B -i option
+show tcp internal information
+
+.B ts
+show string "ts" if the timestamp option is set
+
+.B sack
+show string "sack" if the sack option is set
+
+.B ecn
+show string "ecn" if the explicit congestion notification option is set
+
+.B ecnseen
+show string "ecnseen" if the saw ecn flag is found in received packages
+
+.B fastopen
+show string "fastopen" if the fastopen option is set
+
+.B cong_alg
+the congestion algorithm name, the default congestion algorithm is "cubic"
+
+.B wscale::
+if window scale option is used, this field shows the send scale
factory and receive scale factory
+
+.B rto:
+tcp retransmission timeout value, the unit is millisecond
+
+.B backoff:
+used for exponential backoff retransmission, the actual
retransmission timeout vaule is icsk_rto << icsk_backoff
+
+.B rtt:/
+rtt is the average round trip time, rttvar is the mean deviation of
rtt, their units are millisecond
+
+.B ato:
+ack timeout, unit is millisecond, used for delay ack mode
+
+.B mss:
+max segment size
+
+.B cwnd:
+congestion window size
+
+.B ssthresh:
+tcp congestion window slow start threshold
+
+.B bytes_acked:
+bytes acked
+
+.B bytes_received:
+bytes received
+
+.B segs_out:
+segments sent out
+
+.B segs_in:
+segments received
+
+.B send bps
+egress bps
+
+.B lastsnd:
+how long time since the last package sent, the unit is millisecond
+
+.B lastrcv:
+how long time since the last package received, the unit is millisecond
+
+.B lastack:
+how long time since the last ack received, the unit is millisecond
+
+.B pacing_rate bps/bps
+the pacing rate and max pacing rate
+
+.B rcv_space:
+a helper variable for TCP internal auto tunning socket receive buffer
+
 .SH USAGE EXAMPLES
 .TP
 .B ss -t -a

[PATCH net-next] tcp: add tracepoint trace_tcp_retransmit_synack()

[Song Liu]

This tracepoint can be used to trace synack retransmits. It maintains
pointer to struct request_sock.

We cannot simply reuse trace_tcp_retransmit_skb() here, because the
sk here is the LISTEN socket. The IP addresses and ports should be
extracted from struct request_sock.

Signed-off-by: Song Liu 
---
 include/trace/events/tcp.h | 56 ++
 net/ipv4/tcp_output.c  |  1 +
 2 files changed, 57 insertions(+)

diff --git a/include/trace/events/tcp.h b/include/trace/events/tcp.h
index 03699ba..07a 100644
--- a/include/trace/events/tcp.h
+++ b/include/trace/events/tcp.h
@@ -237,6 +237,62 @@ TRACE_EVENT(tcp_set_state,
  show_tcp_state_name(__entry->newstate))
 );
 
+TRACE_EVENT(tcp_retransmit_synack,
+
+   TP_PROTO(const struct sock *sk, const struct request_sock *req),
+
+   TP_ARGS(sk, req),
+
+   TP_STRUCT__entry(
+   __field(const void *, skaddr)
+   __field(const void *, req)
+   __field(__u16, sport)
+   __field(__u16, dport)
+   __array(__u8, saddr, 4)
+   __array(__u8, daddr, 4)
+   __array(__u8, saddr_v6, 16)
+   __array(__u8, daddr_v6, 16)
+   ),
+
+   TP_fast_assign(
+   struct inet_request_sock *ireq = inet_rsk(req);
+   struct in6_addr *pin6;
+   __be32 *p32;
+
+   __entry->skaddr = sk;
+   __entry->req = req;
+
+   __entry->sport = ireq->ir_num;
+   __entry->dport = ntohs(ireq->ir_rmt_port);
+
+   p32 = (__be32 *) __entry->saddr;
+   *p32 = ireq->ir_loc_addr;
+
+   p32 = (__be32 *) __entry->daddr;
+   *p32 = ireq->ir_rmt_addr;
+
+#if IS_ENABLED(CONFIG_IPV6)
+   if (sk->sk_family == AF_INET6) {
+   pin6 = (struct in6_addr *)__entry->saddr_v6;
+   *pin6 = ireq->ir_v6_loc_addr;
+   pin6 = (struct in6_addr *)__entry->daddr_v6;
+   *pin6 = ireq->ir_v6_rmt_addr;
+   } else
+#endif
+   {
+   pin6 = (struct in6_addr *)__entry->saddr_v6;
+   ipv6_addr_set_v4mapped(ireq->ir_loc_addr, pin6);
+   pin6 = (struct in6_addr *)__entry->daddr_v6;
+   ipv6_addr_set_v4mapped(ireq->ir_rmt_addr, pin6);
+   }
+   ),
+
+   TP_printk("sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c 
daddrv6=%pI6c",
+ __entry->sport, __entry->dport,
+ __entry->saddr, __entry->daddr,
+ __entry->saddr_v6, __entry->daddr_v6)
+);
+
 #endif /* _TRACE_TCP_H */
 
 /* This part must be outside protection */
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 1f01f4c..6a728a5 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3735,6 +3735,7 @@ int tcp_rtx_synack(const struct sock *sk, struct 
request_sock *req)
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
if (unlikely(tcp_passive_fastopen(sk)))
tcp_sk(sk)->total_retrans++;
+   trace_tcp_retransmit_synack(sk, req);
}
return res;
 }
-- 
2.9.5

[PATCH net] tcp: call tcp_rate_skb_sent() when retransmit with unaligned skb->data

[Yousuk Seung]

Current implementation calls tcp_rate_skb_sent() when tcp_transmit_skb()
is called when it clones skb only. Not calling tcp_rate_skb_sent() is OK
for all such code paths except from __tcp_retransmit_skb() which happens
when skb->data address is not aligned. This may rarely happen e.g. when
small amount of data is sent initially and the receiver partially acks
odd number of bytes for some reason, possibly malicious.

Signed-off-by: Yousuk Seung 
Signed-off-by: Neal Cardwell 
Signed-off-by: Soheil Hassas Yeganeh 
Acked-by: Eric Dumazet 
---
 net/ipv4/tcp_output.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 973befc36fd4..1151870018e3 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2843,8 +2843,10 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff 
*skb, int segs)
nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC);
err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
 -ENOBUFS;
-   if (!err)
+   if (!err) {
skb->skb_mstamp = tp->tcp_mstamp;
+   tcp_rate_skb_sent(sk, skb);
+   }
} else {
err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
}
-- 
2.15.0.rc0.271.g36b669edcc-goog

[Patch net-next] tipc: fix a dangling pointer

[Cong Wang]

tsk->group is set to grp earlier, but we forget to unset it
after grp is freed.

Fixes: 75da2163dbb6 ("tipc: introduce communication groups")
Reported-by: syzkaller bot
Cc: Jon Maloy 
Cc: Ying Xue 
Signed-off-by: Cong Wang 
---
 net/tipc/socket.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b3b72d8e9543..ea61c32f6b80 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock *tsk, struct 
tipc_group_req *mreq)
seq.upper = seq.lower;
tipc_nametbl_build_group(net, grp, mreq->type, domain);
rc = tipc_sk_publish(tsk, mreq->scope, );
-   if (rc)
+   if (rc) {
tipc_group_delete(net, grp);
+   tsk->group = NULL;
+   }
 
/* Eliminate any risk that a broadcast overtakes the sent JOIN */
tsk->mc_method.rcast = true;
-- 
2.13.0

[Patch net-next] vsock: always call vsock_init_tables()

[Cong Wang]

Although CONFIG_VSOCKETS_DIAG depends on CONFIG_VSOCKETS,
vsock_init_tables() is not always called, it is called only
if other modules call its caller. Therefore if we only
enable CONFIG_VSOCKETS_DIAG, it would crash kernel on uninitialized
vsock_bind_table.

This patch fixes it by moving vsock_init_tables() to its own
module_init().

Fixes: 413a4317aca7 ("VSOCK: add sock_diag interface")
Reported-by: syzkaller bot
Cc: Stefan Hajnoczi 
Cc: Jorgen Hansen 
Signed-off-by: Cong Wang 
---
 net/vmw_vsock/af_vsock.c | 7 ---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 98359c19522f..5d28abf87fbf 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -195,7 +195,7 @@ static int vsock_auto_bind(struct vsock_sock *vsk)
return __vsock_bind(sk, _addr);
 }
 
-static void vsock_init_tables(void)
+static int __init vsock_init_tables(void)
 {
int i;
 
@@ -204,6 +204,7 @@ static void vsock_init_tables(void)
 
for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++)
INIT_LIST_HEAD(_connected_table[i]);
+   return 0;
 }
 
 static void __vsock_insert_bound(struct list_head *list,
@@ -1957,8 +1958,6 @@ int __vsock_core_init(const struct vsock_transport *t, 
struct module *owner)
vsock_proto.owner = owner;
transport = t;
 
-   vsock_init_tables();
-
vsock_device.minor = MISC_DYNAMIC_MINOR;
err = misc_register(_device);
if (err) {
@@ -2019,6 +2018,8 @@ const struct vsock_transport 
*vsock_core_get_transport(void)
 }
 EXPORT_SYMBOL_GPL(vsock_core_get_transport);
 
+module_init(vsock_init_tables);
+
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Virtual Socket Family");
 MODULE_VERSION("1.0.2.0-k");
-- 
2.13.0

[PATCH] tap: double-free in error path in tap_open()

[Girish Moodalbail]

Double free of skb_array in tap module is causing kernel panic. When
tap_set_queue() fails we free skb_array right away by calling
skb_array_cleanup(). However, later on skb_array_cleanup() is called
again by tap_sock_destruct through sock_put(). This patch fixes that
issue.

Fixes: 362899b8725b35e3 (macvtap: switch to use skb array)
Signed-off-by: Girish Moodalbail 
---
 drivers/net/tap.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 21b71ae..878520b 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -542,20 +542,20 @@ static int tap_open(struct inode *inode, struct file 
*file)
 
err = -ENOMEM;
if (skb_array_init(>skb_array, tap->dev->tx_queue_len, GFP_KERNEL))
-   goto err_array;
+   goto err_put;
 
err = tap_set_queue(tap, file, q);
-   if (err)
-   goto err_queue;
+   if (err) {
+   /* tap_sock_destruct() will take care of freeing skb_array */
+   goto err_put;
+   }
 
dev_put(tap->dev);
 
rtnl_unlock();
return err;
 
-err_queue:
-   skb_array_cleanup(>skb_array);
-err_array:
+err_put:
sock_put(>sk);
 err:
if (tap)
-- 
1.8.3.1

[RFC] net/unix_diag: Provide UDIAG_SHOW_VFS2 attribute to fetch complete inode number

[Cyrill Gorcunov]

Currently unix_diag_vfs structure reports unix socket inode
as u32 value which of course doesn't fit to ino_t type and
the number may be trimmed. Lets rather deprecate old UDIAG_SHOW_VFS
interface and provide UDIAG_SHOW_VFS2 (with one field "__zero" reserved
which we could extend in future).

CC: Andrey Vagin 
CC: David S. Miller 
CC: Pavel Emelyanov 
Signed-off-by: Cyrill Gorcunov 
---

I build-tested it only thus not for inclusion yet, but rather
to discuss if there some better way to handle this potential
problem.

 include/uapi/linux/unix_diag.h |8 
 net/unix/diag.c|   25 -
 2 files changed, 24 insertions(+), 9 deletions(-)

Index: linux-ml.git/include/uapi/linux/unix_diag.h
===
--- linux-ml.git.orig/include/uapi/linux/unix_diag.h
+++ linux-ml.git/include/uapi/linux/unix_diag.h
@@ -19,6 +19,7 @@ struct unix_diag_req {
 #define UDIAG_SHOW_ICONS   0x0008  /* show pending connections */
 #define UDIAG_SHOW_RQLEN   0x0010  /* show skb receive queue len */
 #define UDIAG_SHOW_MEMINFO 0x0020  /* show memory info of a socket 
*/
+#define UDIAG_SHOW_VFS20x0040  /* show VFS inode info 
v2 */
 
 struct unix_diag_msg {
__u8udiag_family;
@@ -39,6 +40,7 @@ enum {
UNIX_DIAG_RQLEN,
UNIX_DIAG_MEMINFO,
UNIX_DIAG_SHUTDOWN,
+   UNIX_DIAG_VFS2,
 
__UNIX_DIAG_MAX,
 };
@@ -50,6 +52,12 @@ struct unix_diag_vfs {
__u32   udiag_vfs_dev;
 };
 
+struct unix_diag_vfs2 {
+   __u64   udiag_vfs_ino;
+   __u32   udiag_vfs_dev;
+   __u32   __zero; /* Reserve for future use */
+};
+
 struct unix_diag_rqlen {
__u32   udiag_rqueue;
__u32   udiag_wqueue;
Index: linux-ml.git/net/unix/diag.c
===
--- linux-ml.git.orig/net/unix/diag.c
+++ linux-ml.git/net/unix/diag.c
@@ -19,17 +19,24 @@ static int sk_diag_dump_name(struct sock
   addr->name->sun_path);
 }
 
-static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb)
+static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb, unsigned 
int flags)
 {
struct dentry *dentry = unix_sk(sk)->path.dentry;
 
if (dentry) {
-   struct unix_diag_vfs uv = {
-   .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
-   .udiag_vfs_dev = dentry->d_sb->s_dev,
-   };
-
-   return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), );
+   if (flags & UDIAG_SHOW_VFS2) {
+   struct unix_diag_vfs uv = {
+   .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
+   .udiag_vfs_dev = dentry->d_sb->s_dev,
+   };
+   return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), );
+   } else {
+   struct unix_diag_vfs2 uv = {
+   .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
+   .udiag_vfs_dev = dentry->d_sb->s_dev,
+   };
+   return nla_put(nlskb, UDIAG_SHOW_VFS2, sizeof(uv), );
+   }
}
 
return 0;
@@ -132,8 +139,8 @@ static int sk_diag_fill(struct sock *sk,
sk_diag_dump_name(sk, skb))
goto out_nlmsg_trim;
 
-   if ((req->udiag_show & UDIAG_SHOW_VFS) &&
-   sk_diag_dump_vfs(sk, skb))
+   if ((req->udiag_show & (UDIAG_SHOW_VFS | UDIAG_SHOW_VFS2)) &&
+   sk_diag_dump_vfs(sk, skb, req->udiag_show))
goto out_nlmsg_trim;
 
if ((req->udiag_show & UDIAG_SHOW_PEER) &&

RE: [PATCH net-next v3 01/10] devlink: Add permanent config parameter get/set operations

[Yuval Mintz]

> Add support for permanent config parameter get/set commands. Used
> for persistent device configuration parameters.
> 
...
> + int (*perm_config_get)(struct devlink *devlink,
> +enum devlink_perm_config_param param, u8
> type,
> +void *value);
> + int (*perm_config_set)(struct devlink *devlink,
> +enum devlink_perm_config_param param, u8
> type,
> +void *value, u8 *restart_reqd);
>  };
> +static int devlink_nl_single_param_get(struct sk_buff *msg,
> +struct devlink *devlink,
> +u32 param, u8 type)
> +{
> + const struct devlink_ops *ops = devlink->ops;
> + struct nlattr *param_attr;
> + void *value;
> + u32 val;
> + int err;
> +
> + /* Allocate buffer for parameter value */
> + switch (type) {
> + case NLA_U8:
> + value = kmalloc(sizeof(u8), GFP_KERNEL);
> + break;
> + case NLA_U16:
> + value = kmalloc(sizeof(u16), GFP_KERNEL);
> + break;
> + case NLA_U32:
> + value = kmalloc(sizeof(u32), GFP_KERNEL);
> + break;
> + default:
> + return -EINVAL; /* Unsupported Type */
> + }
> +
> + if (!value)
> + return -ENOMEM;
> +
> + err = ops->perm_config_get(devlink, param, type, value);
> + if (err)
> + return err;

I suspect this logic might be risky - its dependent on the driver to cast the
'value' into the proper type or else, E.g., the following switch might break
for BE platforms.
Is there any reason to have the devlink <-> driver API be based on void*
and not on some typed data [of sufficient size]?
...
> + switch (type) {
> + case NLA_U8:
> + val = *((u8 *)value);
> + if (nla_put_u8(msg, DEVLINK_ATTR_PERM_CONFIG_VALUE,
> val))
> + goto nest_err;
> + break;
> + case NLA_U16:
> + val = *((u16 *)value);
> + if (nla_put_u16(msg,
> DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
> + goto nest_err;
> + break;
> + case NLA_U32:
> + val = *((u32 *)value);
> + if (nla_put_u32(msg,
> DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
> + goto nest_err;
> + break;
> + }

...
> +static int devlink_nl_single_param_set(struct sk_buff *msg,
> +struct devlink *devlink,
> +u32 param, u8 type, void *value)
> +{
> + const struct devlink_ops *ops = devlink->ops;
> + struct nlattr *cfgparam_attr;
> + u8 need_restart;
> + int err;
> +
> + /* Now set parameter */
> + err = ops->perm_config_set(devlink, param, type, value,
> _restart);
> + if (err)
> + return err;

Likewise

RE: [PATCH] wimax/i2400m: Remove VLAIS

[Perez-Gonzalez, Inaky]

> ping
> any comments on this?

None from me; I don't have access to this HW anymore, so I can't validate
if the change would work or not.

Re: [PATCH net-next v3 06/10] bnxt: Add devlink support for config get/set

[Michael Chan]

On Tue, Oct 24, 2017 at 1:12 PM, Steve Lin  wrote:
> Implements get and set of configuration parameters using new devlink
> config get/set API.  Parameters themselves defined in later patches.
>
> Signed-off-by: Steve Lin 
> Acked-by: Andy Gospodarek 
> ---
>  drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 262 
> +-
>  drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h |  17 ++
>  drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h | 100 +
>  3 files changed, 373 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c 
> b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
> index f3f6aa8..81ab77e 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
> @@ -14,11 +14,261 @@
>  #include "bnxt_vfr.h"
>  #include "bnxt_devlink.h"
>
> -static const struct devlink_ops bnxt_dl_ops = {
> +struct bnxt_drv_cfgparam bnxt_drv_cfgparam_list[] = {
> +};
> +
> +#define BNXT_NUM_DRV_CFGPARAM ARRAY_SIZE(bnxt_drv_cfgparam_list)
> +
> +static int bnxt_nvm_read(struct bnxt *bp, int nvm_param, int idx,
> +void *buf, int size)
> +{
> +   struct hwrm_nvm_get_variable_input req = {0};
> +   dma_addr_t dest_data_dma_addr;
> +   void *dest_data_addr = NULL;
> +   int bytesize;
> +   int rc;
> +
> +   bytesize = (size + 7) / BITS_PER_BYTE;
> +   dest_data_addr = dma_alloc_coherent(>pdev->dev, bytesize,
> +   _data_dma_addr, GFP_KERNEL);
> +   if (!dest_data_addr) {
> +   netdev_err(bp->dev, "dma_alloc_coherent failure\n");
> +   return -ENOMEM;
> +   }
> +
> +   bnxt_hwrm_cmd_hdr_init(bp, , HWRM_NVM_GET_VARIABLE, -1, -1);
> +   req.dest_data_addr = cpu_to_le64(dest_data_dma_addr);
> +   req.data_len = cpu_to_le16(size);
> +   req.option_num = cpu_to_le16(nvm_param);
> +   req.index_0 = cpu_to_le16(idx);
> +   if (idx != 0)
> +   req.dimensions = cpu_to_le16(1);
> +
> +   rc = _hwrm_send_message(bp, , sizeof(req), HWRM_CMD_TIMEOUT);

This won't have the proper mutex protection.  You should call
hwrm_send_message() instead.

Re: [PATCH net 0/6] rtnetlink: a bunch of fixes for userspace notifications in changing dev properties

[Stefano Brivio]

On Sun, 15 Oct 2017 18:13:40 +0800
Xin Long  wrote:

> Whenever any property of a link, address, route, etc. changes by whatever way,
> kernel should notify the programs that listen for such events in userspace.
> 
> The patchet "rtnetlink: Cleanup user notifications for netdev events" tried to
> fix a redundant notifications issue, but it also introduced a side effect.
> 
> After that, user notifications could only be sent when changing dev properties
> via netlink api. As it removed some events process in rtnetlink_event where
> the notifications was sent to users.
> 
> It resulted in no notification generated when dev properties are changed via
> other ways, like ioctl, sysfs, etc. It may cause some user programs doesn't
> work as expected because of the missing notifications.
> 
> This patchset will fix it by bringing some of these netdev events back and
> also fix the old redundant notifications issue with a proper way.
> 
> Xin Long (6):
>   rtnetlink: bring NETDEV_CHANGEMTU event process back in
> rtnetlink_event
>   rtnetlink: bring NETDEV_CHANGE_TX_QUEUE_LEN event process back in
> rtnetlink_event
>   rtnetlink: bring NETDEV_POST_TYPE_CHANGE event process back in
> rtnetlink_event
>   rtnetlink: bring NETDEV_CHANGEUPPER event process back in
> rtnetlink_event
>   rtnetlink: check DO_SETLINK_NOTIFY correctly in do_setlink
>   rtnetlink: do not set notification for tx_queue_len in do_setlink

I guess this should be considered for -stable (back to 4.12), as it
fixes quite a few critical issues in notification behaviours userspace
might rely on.

-- 
Stefano

[PATCH net] net: dsa: check master device before put

[Vivien Didelot]

In the case of pdata, the dsa_cpu_parse function calls dev_put() before
making sure it isn't NULL. Fix this.

Fixes: 71e0bbde0d88 ("net: dsa: Add support for platform data")
Signed-off-by: Vivien Didelot 
Reviewed-by: Florian Fainelli 
---
 net/dsa/dsa2.c | 7 ---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 873af0108e24..045d8a176279 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -496,14 +496,15 @@ static int dsa_cpu_parse(struct dsa_port *port, u32 index,
if (!ethernet)
return -EINVAL;
ethernet_dev = of_find_net_device_by_node(ethernet);
+   if (!ethernet_dev)
+   return -EPROBE_DEFER;
} else {
ethernet_dev = dsa_dev_to_net_device(ds->cd->netdev[index]);
+   if (!ethernet_dev)
+   return -EPROBE_DEFER;
dev_put(ethernet_dev);
}
 
-   if (!ethernet_dev)
-   return -EPROBE_DEFER;
-
if (!dst->cpu_dp) {
dst->cpu_dp = port;
dst->cpu_dp->netdev = ethernet_dev;
-- 
2.14.2

Re: KASAN: use-after-free Read in tipc_group_self

[Cong Wang]

On Tue, Oct 24, 2017 at 8:14 AM, syzbot

wrote:
> Hello,
>
> syzkaller hit the following crash on
> 65302eba00aea2f1bc715f0438afb63470ac138b
> git://git.cmpxchg.org/linux-mmots.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
> C reproducer is attached
> syzkaller reproducer is attached. See https://goo.gl/kgGztJ
> for information about syzkaller reproducers
>
>
> BUG: KASAN: use-after-free in tipc_group_self+0x1a2/0x1b0
> net/tipc/group.c:335
> Read of size 4 at addr 8801d805726c by task syzkaller195348/2990
>
> CPU: 0 PID: 2990 Comm: syzkaller195348 Not tainted 4.14.0-rc5-mm1+ #19
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:16 [inline]
>  dump_stack+0x194/0x257 lib/dump_stack.c:52
>  print_address_description+0x73/0x250 mm/kasan/report.c:252
>  kasan_report_error mm/kasan/report.c:351 [inline]
>  kasan_report+0x25b/0x340 mm/kasan/report.c:409
>  __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
>  tipc_group_self+0x1a2/0x1b0 net/tipc/group.c:335
>  tipc_sk_leave+0xfc/0x200 net/tipc/socket.c:2781
>  tipc_release+0x154/0xfe0 net/tipc/socket.c:575
>  sock_release+0x8d/0x1e0 net/socket.c:596
>  sock_close+0x16/0x20 net/socket.c:1125
>  __fput+0x327/0x7e0 fs/file_table.c:210
>  fput+0x15/0x20 fs/file_table.c:244
>  task_work_run+0x199/0x270 kernel/task_work.c:112
>  exit_task_work include/linux/task_work.h:21 [inline]
>  do_exit+0x9b5/0x1ad0 kernel/exit.c:869
>  do_group_exit+0x149/0x400 kernel/exit.c:972
>  SYSC_exit_group kernel/exit.c:983 [inline]
>  SyS_exit_group+0x1d/0x20 kernel/exit.c:981
>  entry_SYSCALL_64_fastpath+0x1f/0xbe
> RIP: 0033:0x43e978
> RSP: 002b:7ffcae951f88 EFLAGS: 0246 ORIG_RAX: 00e7
> RAX: ffda RBX:  RCX: 0043e978
> RDX:  RSI: 003c RDI: 
> RBP: 0082 R08: 00e7 R09: ffd0
> R10: 2010e000 R11: 0246 R12: 006ca858
> R13: 006ca858 R14:  R15: 2710
>
> Allocated by task 2990:
>  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
>  set_track mm/kasan/kasan.c:459 [inline]
>  kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
>  kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3614
>  kmalloc include/linux/slab.h:499 [inline]
>  kzalloc include/linux/slab.h:688 [inline]
>  tipc_group_create+0x116/0x9c0 net/tipc/group.c:167
>  tipc_sk_join net/tipc/socket.c:2751 [inline]
>  tipc_setsockopt+0x25e/0xc00 net/tipc/socket.c:2863
>  SYSC_setsockopt net/socket.c:1851 [inline]
>  SyS_setsockopt+0x189/0x360 net/socket.c:1830
>  entry_SYSCALL_64_fastpath+0x1f/0xbe
>
> Freed by task 2990:
>  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
>  set_track mm/kasan/kasan.c:459 [inline]
>  kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
>  __cache_free mm/slab.c:3492 [inline]
>  kfree+0xca/0x250 mm/slab.c:3807
>  tipc_group_delete+0x2c0/0x3c0 net/tipc/group.c:206
>  tipc_sk_join net/tipc/socket.c:2764 [inline]
>  tipc_setsockopt+0xb33/0xc00 net/tipc/socket.c:2863
>  SYSC_setsockopt net/socket.c:1851 [inline]
>  SyS_setsockopt+0x189/0x360 net/socket.c:1830
>  entry_SYSCALL_64_fastpath+0x1f/0xbe

Should be fixed by:

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b3b72d8e9543..ea61c32f6b80 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock *tsk,
struct tipc_group_req *mreq)
seq.upper = seq.lower;
tipc_nametbl_build_group(net, grp, mreq->type, domain);
rc = tipc_sk_publish(tsk, mreq->scope, );
-   if (rc)
+   if (rc) {
tipc_group_delete(net, grp);
+   tsk->group = NULL;
+   }

/* Eliminate any risk that a broadcast overtakes the sent JOIN */
tsk->mc_method.rcast = true;

Re: [RFC PATCH 3/5] sctp: Add LSM hooks

[Richard Haines]

On Fri, 2017-10-20 at 21:14 +0800, Xin Long wrote:
> On Fri, Oct 20, 2017 at 8:04 PM, Richard Haines
>  wrote:
> > On Fri, 2017-10-20 at 07:16 -0400, Neil Horman wrote:
> > > On Wed, Oct 18, 2017 at 11:05:09PM +0800, Xin Long wrote:
> > > > On Tue, Oct 17, 2017 at 9:58 PM, Richard Haines
> > > >  wrote:
> > > > > Add security hooks to allow security modules to exercise
> > > > > access
> > > > > control
> > > > > over SCTP.
> > > > > 
> > > > > Signed-off-by: Richard Haines  > > > > m>
> > > > > ---
> > > > >  include/net/sctp/structs.h | 10 
> > > > >  include/uapi/linux/sctp.h  |  1 +
> > > > >  net/sctp/sm_make_chunk.c   | 12 +
> > > > >  net/sctp/sm_statefuns.c| 14 ++-
> > > > >  net/sctp/socket.c  | 61
> > > > > +-
> > > > >  5 files changed, 96 insertions(+), 2 deletions(-)
> > > > > 
> > > > > diff --git a/include/net/sctp/structs.h
> > > > > b/include/net/sctp/structs.h
> > > > > index 7767577..6e72e3e 100644
> > > > > --- a/include/net/sctp/structs.h
> > > > > +++ b/include/net/sctp/structs.h
> > > > > @@ -1270,6 +1270,16 @@ struct sctp_endpoint {
> > > > >   reconf_enable:1;
> > > > > 
> > > > > __u8  strreset_enable;
> > > > > +
> > > > > +   /* Security identifiers from incoming (INIT). These
> > > > > are
> > > > > set by
> > > > > +* security_sctp_assoc_request(). These will only be
> > > > > used
> > > > > by
> > > > > +* SCTP TCP type sockets and peeled off connections
> > > > > as
> > > > > they
> > > > > +* cause a new socket to be generated.
> > > > > security_sctp_sk_clone()
> > > > > +* will then plug these into the new socket.
> > > > > +*/
> > > > > +
> > > > > +   u32 secid;
> > > > > +   u32 peer_secid;
> > > > >  };
> > > > > 
> > > > >  /* Recover the outter endpoint structure. */
> > > > > diff --git a/include/uapi/linux/sctp.h
> > > > > b/include/uapi/linux/sctp.h
> > > > > index 6217ff8..c04812f 100644
> > > > > --- a/include/uapi/linux/sctp.h
> > > > > +++ b/include/uapi/linux/sctp.h
> > > > > @@ -122,6 +122,7 @@ typedef __s32 sctp_assoc_t;
> > > > >  #define SCTP_RESET_ASSOC   120
> > > > >  #define SCTP_ADD_STREAMS   121
> > > > >  #define SCTP_SOCKOPT_PEELOFF_FLAGS 122
> > > > > +#define SCTP_SENDMSG_CONNECT   123
> > > > > 
> > > > >  /* PR-SCTP policies */
> > > > >  #define SCTP_PR_SCTP_NONE  0x
> > > > > diff --git a/net/sctp/sm_make_chunk.c
> > > > > b/net/sctp/sm_make_chunk.c
> > > > > index 6110447..ca4705b 100644
> > > > > --- a/net/sctp/sm_make_chunk.c
> > > > > +++ b/net/sctp/sm_make_chunk.c
> > > > > @@ -3059,6 +3059,12 @@ static __be16
> > > > > sctp_process_asconf_param(struct sctp_association *asoc,
> > > > > if (af->is_any())
> > > > > memcpy(, >source,
> > > > > sizeof(addr));
> > > > > 
> > > > > +   if (security_sctp_bind_connect(asoc->ep-
> > > > > >base.sk,
> > > > > +  SCTP_PARAM_ADD
> > > > > _IP,
> > > > > +  (struct
> > > > > sockaddr
> > > > > *),
> > > > > +  af-
> > > > > >sockaddr_len))
> > > > > +   return SCTP_ERROR_REQ_REFUSED;
> > > > > +
> > > > > /* ADDIP 4.3 D9) If an endpoint receives an
> > > > > ADD
> > > > > IP address
> > > > >  * request and does not have the local
> > > > > resources
> > > > > to add this
> > > > >  * new address to the association, it MUST
> > > > > return
> > > > > an Error
> > > > > @@ -3125,6 +3131,12 @@ static __be16
> > > > > sctp_process_asconf_param(struct sctp_association *asoc,
> > > > > if (af->is_any())
> > > > > memcpy(, sctp_source(asconf),
> > > > > sizeof(addr));
> > > > > 
> > > > > +   if (security_sctp_bind_connect(asoc->ep-
> > > > > >base.sk,
> > > > > +  SCTP_PARAM_SET
> > > > > _PRI
> > > > > MARY,
> > > > > +  (struct
> > > > > sockaddr
> > > > > *),
> > > > > +  af-
> > > > > >sockaddr_len))
> > > > > +   return SCTP_ERROR_REQ_REFUSED;
> > > > > +
> > > > > peer = sctp_assoc_lookup_paddr(asoc, );
> > > > > if (!peer)
> > > > > return SCTP_ERROR_DNS_FAILED;
> > > > > diff --git a/net/sctp/sm_statefuns.c
> > > > > b/net/sctp/sm_statefuns.c
> > > > > index b2a74c3..4ba5805 100644
> > > > > --- a/net/sctp/sm_statefuns.c
> > > > > +++ b/net/sctp/sm_statefuns.c
> > > > > @@ -314,6 +314,11 @@ sctp_disposition_t
> > > > > sctp_sf_do_5_1B_init(struct net *net,
> > > > > sctp_unrecognized_param_t *unk_param;
> > > > > 

Re: [PATCH v14 5/5] PCI: Remove PCI pool macro functions

[Bjorn Helgaas]

On Mon, Oct 23, 2017 at 07:59:58PM +0200, Romain Perier wrote:
> From: Romain Perier 
> 
> Now that all the drivers use dma pool API, we can remove the macro
> functions for PCI pool.
> 
> Signed-off-by: Romain Perier 
> Reviewed-by: Peter Senna Tschudin 

Acked-by: Bjorn Helgaas 

Since this barely touches drivers/pci and linux-pci wasn't copied
until v14, I assume you're planning to merge this via some other tree.
Let me know if you need anything else from me.

> ---
>  include/linux/pci.h | 9 -
>  1 file changed, 9 deletions(-)
> 
> diff --git a/include/linux/pci.h b/include/linux/pci.h
> index 80eaa2dbe3e9..a827f6eb54db 100644
> --- a/include/linux/pci.h
> +++ b/include/linux/pci.h
> @@ -1325,15 +1325,6 @@ int pci_set_vga_state(struct pci_dev *pdev, bool 
> decode,
>  #include 
>  #include 
>  
> -#define  pci_pool dma_pool
> -#define pci_pool_create(name, pdev, size, align, allocation) \
> - dma_pool_create(name, >dev, size, align, allocation)
> -#define  pci_pool_destroy(pool) dma_pool_destroy(pool)
> -#define  pci_pool_alloc(pool, flags, handle) dma_pool_alloc(pool, flags, 
> handle)
> -#define  pci_pool_zalloc(pool, flags, handle) \
> - dma_pool_zalloc(pool, flags, handle)
> -#define  pci_pool_free(pool, vaddr, addr) dma_pool_free(pool, vaddr, 
> addr)
> -
>  struct msix_entry {
>   u32 vector; /* kernel uses to write allocated vector */
>   u16 entry;  /* driver uses to specify entry, OS writes */
> -- 
> 2.14.1
> 

[PATCH net-next v3 01/10] devlink: Add permanent config parameter get/set operations

[Steve Lin]

Add support for permanent config parameter get/set commands. Used
for persistent device configuration parameters.

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 include/net/devlink.h|   6 +
 include/uapi/linux/devlink.h |  18 +++
 net/core/devlink.c   | 295 +++
 3 files changed, 319 insertions(+)

diff --git a/include/net/devlink.h b/include/net/devlink.h
index b9654e1..eb86031 100644
--- a/include/net/devlink.h
+++ b/include/net/devlink.h
@@ -270,6 +270,12 @@ struct devlink_ops {
int (*eswitch_inline_mode_set)(struct devlink *devlink, u8 inline_mode);
int (*eswitch_encap_mode_get)(struct devlink *devlink, u8 
*p_encap_mode);
int (*eswitch_encap_mode_set)(struct devlink *devlink, u8 encap_mode);
+   int (*perm_config_get)(struct devlink *devlink,
+  enum devlink_perm_config_param param, u8 type,
+  void *value);
+   int (*perm_config_set)(struct devlink *devlink,
+  enum devlink_perm_config_param param, u8 type,
+  void *value, u8 *restart_reqd);
 };
 
 static inline void *devlink_priv(struct devlink *devlink)
diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index 0cbca96..28ea961 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h
@@ -70,6 +70,10 @@ enum devlink_command {
DEVLINK_CMD_DPIPE_HEADERS_GET,
DEVLINK_CMD_DPIPE_TABLE_COUNTERS_SET,
 
+   /* Permanent device config get/set */
+   DEVLINK_CMD_PERM_CONFIG_GET,
+   DEVLINK_CMD_PERM_CONFIG_SET,
+
/* add new commands above here */
__DEVLINK_CMD_MAX,
DEVLINK_CMD_MAX = __DEVLINK_CMD_MAX - 1
@@ -202,6 +206,14 @@ enum devlink_attr {
 
DEVLINK_ATTR_ESWITCH_ENCAP_MODE,/* u8 */
 
+   /* Permanent Configuration Parameters */
+   DEVLINK_ATTR_PERM_CONFIGS,  /* nested */
+   DEVLINK_ATTR_PERM_CONFIG,   /* nested */
+   DEVLINK_ATTR_PERM_CONFIG_PARAMETER, /* u32 */
+   DEVLINK_ATTR_PERM_CONFIG_TYPE,  /* u8 */
+   DEVLINK_ATTR_PERM_CONFIG_VALUE, /* dynamic */
+   DEVLINK_ATTR_PERM_CONFIG_RESTART_REQUIRED,  /* u8 */
+
/* add new attributes above here, update the policy in devlink.c */
 
__DEVLINK_ATTR_MAX,
@@ -244,4 +256,10 @@ enum devlink_dpipe_header_id {
DEVLINK_DPIPE_HEADER_IPV6,
 };
 
+/* Permanent config parameters */
+enum devlink_perm_config_param {
+   __DEVLINK_PERM_CONFIG_MAX,
+   DEVLINK_PERM_CONFIG_MAX = __DEVLINK_PERM_CONFIG_MAX - 1
+};
+
 #endif /* _UAPI_LINUX_DEVLINK_H_ */
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 7d430c1..4deb4da 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1566,6 +1566,285 @@ static int devlink_nl_cmd_eswitch_set_doit(struct 
sk_buff *skb,
return 0;
 }
 
+static const struct nla_policy devlink_nl_policy[DEVLINK_ATTR_MAX + 1];
+
+static const u8 devlink_perm_cfg_param_types[DEVLINK_PERM_CONFIG_MAX + 1] = {
+};
+
+static int devlink_nl_single_param_get(struct sk_buff *msg,
+  struct devlink *devlink,
+  u32 param, u8 type)
+{
+   const struct devlink_ops *ops = devlink->ops;
+   struct nlattr *param_attr;
+   void *value;
+   u32 val;
+   int err;
+
+   /* Allocate buffer for parameter value */
+   switch (type) {
+   case NLA_U8:
+   value = kmalloc(sizeof(u8), GFP_KERNEL);
+   break;
+   case NLA_U16:
+   value = kmalloc(sizeof(u16), GFP_KERNEL);
+   break;
+   case NLA_U32:
+   value = kmalloc(sizeof(u32), GFP_KERNEL);
+   break;
+   default:
+   return -EINVAL; /* Unsupported Type */
+   }
+
+   if (!value)
+   return -ENOMEM;
+
+   err = ops->perm_config_get(devlink, param, type, value);
+   if (err)
+   return err;
+
+   param_attr = nla_nest_start(msg, DEVLINK_ATTR_PERM_CONFIG);
+   if (!param_attr)
+   goto nonest_err;
+
+   if (nla_put_u32(msg, DEVLINK_ATTR_PERM_CONFIG_PARAMETER, param) ||
+   nla_put_u8(msg, DEVLINK_ATTR_PERM_CONFIG_TYPE, type))
+   goto nest_err;
+
+   switch (type) {
+   case NLA_U8:
+   val = *((u8 *)value);
+   if (nla_put_u8(msg, DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
+   goto nest_err;
+   break;
+   case NLA_U16:
+   val = *((u16 *)value);
+   if (nla_put_u16(msg, DEVLINK_ATTR_PERM_CONFIG_VALUE, val))
+   goto nest_err;
+   break;
+   case NLA_U32:
+   val = *((u32 *)value);
+   if (nla_put_u32(msg, 

[PATCH net-next v3 05/10] devlink: Adding num MSI-X vectors per VF perm config param

[Steve Lin]

Adding DEVLINK_PERM_CONFIG_MSIX_VECTORS_PER_VF permanent config
parameter.  Value is permanent, so becomes the new default value
for this device.

Value defines number of MSI-X vectors allocated per VF.

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 include/uapi/linux/devlink.h | 3 +++
 net/core/devlink.c   | 1 +
 2 files changed, 4 insertions(+)

diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index 5877ff9..1b76e8f 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h
@@ -264,11 +264,14 @@ enum devlink_dpipe_header_id {
  *   # of VFs per PF in SR-IOV mode
  * DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT:
  *   Max # of MSI-X vectors per PF
+ * DEVLINK_PERM_CONFIG_MSIX_VECTORS_PER_VF:
+ *   # of MSI-X vectors per VF
  */
 enum devlink_perm_config_param {
DEVLINK_PERM_CONFIG_SRIOV_ENABLED,
DEVLINK_PERM_CONFIG_NUM_VF_PER_PF,
DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT,
+   DEVLINK_PERM_CONFIG_MSIX_VECTORS_PER_VF,
 
__DEVLINK_PERM_CONFIG_MAX,
DEVLINK_PERM_CONFIG_MAX = __DEVLINK_PERM_CONFIG_MAX - 1
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 284e167..07d64da 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1572,6 +1572,7 @@ static const u8 
devlink_perm_cfg_param_types[DEVLINK_PERM_CONFIG_MAX + 1] = {
[DEVLINK_PERM_CONFIG_SRIOV_ENABLED] = NLA_U8,
[DEVLINK_PERM_CONFIG_NUM_VF_PER_PF] = NLA_U32,
[DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT] = NLA_U32,
+   [DEVLINK_PERM_CONFIG_MSIX_VECTORS_PER_VF] = NLA_U32,
 };
 
 static int devlink_nl_single_param_get(struct sk_buff *msg,
-- 
2.7.4

[PATCH net-next v3 07/10] bnxt: Adding SR-IOV enablement permanent cfg param

[Steve Lin]

Adding permanent config parameter for SR-IOV enablement, using
devlink API for get/set operation.

0 = SR-IOV disabled
1 = SR-IOV enabled

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c 
b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 81ab77e..6eb80c1 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -14,7 +14,14 @@
 #include "bnxt_vfr.h"
 #include "bnxt_devlink.h"
 
+/* Permanent config parameters from devlink.h:
+ * DEVLINK_PERM_CONFIG_SRIOV_ENABLED:
+ *   0 = disable SR-IOV
+ *   1 = enable SR-IOV
+ */
 struct bnxt_drv_cfgparam bnxt_drv_cfgparam_list[] = {
+   {DEVLINK_PERM_CONFIG_SRIOV_ENABLED, BNXT_DRV_PF,
+   BNXT_DRV_APPL_SHARED, 1, 401},
 };
 
 #define BNXT_NUM_DRV_CFGPARAM ARRAY_SIZE(bnxt_drv_cfgparam_list)
-- 
2.7.4

[PATCH net-next v3 06/10] bnxt: Add devlink support for config get/set

[Steve Lin]

Implements get and set of configuration parameters using new devlink
config get/set API.  Parameters themselves defined in later patches.

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 262 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h |  17 ++
 drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h | 100 +
 3 files changed, 373 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c 
b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index f3f6aa8..81ab77e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -14,11 +14,261 @@
 #include "bnxt_vfr.h"
 #include "bnxt_devlink.h"
 
-static const struct devlink_ops bnxt_dl_ops = {
+struct bnxt_drv_cfgparam bnxt_drv_cfgparam_list[] = {
+};
+
+#define BNXT_NUM_DRV_CFGPARAM ARRAY_SIZE(bnxt_drv_cfgparam_list)
+
+static int bnxt_nvm_read(struct bnxt *bp, int nvm_param, int idx,
+void *buf, int size)
+{
+   struct hwrm_nvm_get_variable_input req = {0};
+   dma_addr_t dest_data_dma_addr;
+   void *dest_data_addr = NULL;
+   int bytesize;
+   int rc;
+
+   bytesize = (size + 7) / BITS_PER_BYTE;
+   dest_data_addr = dma_alloc_coherent(>pdev->dev, bytesize,
+   _data_dma_addr, GFP_KERNEL);
+   if (!dest_data_addr) {
+   netdev_err(bp->dev, "dma_alloc_coherent failure\n");
+   return -ENOMEM;
+   }
+
+   bnxt_hwrm_cmd_hdr_init(bp, , HWRM_NVM_GET_VARIABLE, -1, -1);
+   req.dest_data_addr = cpu_to_le64(dest_data_dma_addr);
+   req.data_len = cpu_to_le16(size);
+   req.option_num = cpu_to_le16(nvm_param);
+   req.index_0 = cpu_to_le16(idx);
+   if (idx != 0)
+   req.dimensions = cpu_to_le16(1);
+
+   rc = _hwrm_send_message(bp, , sizeof(req), HWRM_CMD_TIMEOUT);
+
+   memcpy(buf, dest_data_addr, bytesize);
+
+   dma_free_coherent(>pdev->dev, bytesize, dest_data_addr,
+ dest_data_dma_addr);
+
+   return rc;
+}
+
+static int bnxt_nvm_write(struct bnxt *bp, int nvm_param, int idx,
+ const void *buf, int size)
+{
+   struct hwrm_nvm_set_variable_input req = {0};
+   dma_addr_t src_data_dma_addr;
+   void *src_data_addr = NULL;
+   int bytesize;
+   int rc;
+
+   bytesize = (size + 7) / BITS_PER_BYTE;
+
+   src_data_addr = dma_alloc_coherent(>pdev->dev, bytesize,
+  _data_dma_addr, GFP_KERNEL);
+   if (!src_data_addr) {
+   netdev_err(bp->dev, "dma_alloc_coherent failure\n");
+   return -ENOMEM;
+   }
+
+   memcpy(src_data_addr, buf, bytesize);
+
+   bnxt_hwrm_cmd_hdr_init(bp, , HWRM_NVM_SET_VARIABLE, -1, -1);
+   req.src_data_addr = cpu_to_le64(src_data_dma_addr);
+   req.data_len = cpu_to_le16(size);
+   req.option_num = cpu_to_le16(nvm_param);
+   req.index_0 = cpu_to_le16(idx);
+   if (idx != 0)
+   req.dimensions = cpu_to_le16(1);
+
+   rc = _hwrm_send_message(bp, , sizeof(req), HWRM_CMD_TIMEOUT);
+
+   dma_free_coherent(>pdev->dev, bytesize, src_data_addr,
+ src_data_dma_addr);
+
+   return 0;
+}
+
+static int bnxt_dl_perm_config_set(struct devlink *devlink,
+  enum devlink_perm_config_param param,
+  u8 type, void *value, u8 *restart_reqd)
+{
+   struct bnxt *bp = bnxt_get_bp_from_dl(devlink);
+   struct bnxt_drv_cfgparam *entry;
+   int idx = 0;
+   int ret = 0;
+   u32 bytesize;
+   u32 val32;
+   u16 val16;
+   u8 val8;
+   int i;
+
+   *restart_reqd = 0;
+
+   /* Find parameter in table */
+   for (i = 0; i < BNXT_NUM_DRV_CFGPARAM; i++) {
+   if (param == bnxt_drv_cfgparam_list[i].param) {
+   entry = _drv_cfgparam_list[i];
+   break;
+   }
+   }
+
+   /* Not found */
+   if (i == BNXT_NUM_DRV_CFGPARAM)
+   return -EINVAL;
+
+   /* Check to see if this func type can access variable */
+   if (BNXT_PF(bp) && !(entry->func & BNXT_DRV_PF))
+   return -EOPNOTSUPP;
+   if (BNXT_VF(bp) && !(entry->func & BNXT_DRV_VF))
+   return -EOPNOTSUPP;
+
+   /* If parameter is per port or function, compute index */
+   if (entry->appl == BNXT_DRV_APPL_PORT) {
+   idx = bp->pf.port_id;
+   } else if (entry->appl == BNXT_DRV_APPL_FUNCTION) {
+   if (BNXT_PF(bp))
+   idx = bp->pf.fw_fid - BNXT_FIRST_PF_FID;
+   }
+
+   bytesize = (entry->bitlength + 7) / BITS_PER_BYTE;
+
+   /* If passed in type matches bytesize, pass value directly */
+   if 

[PATCH net-next v3 00/10] Adding permanent config get/set to devlink

[Steve Lin]

Changes since v2:

* Removed references to "NVRAM" in comments / commits.
* Add parameter descriptions to header file.
* Split bnxt patch into infrastructure, then one patch
  for each new parameter.
* Cleaned up goofs (unused parameters leftover from v1)
* Used enum rather than u32 in prototype for perm_config_get()
  and _set().
* Defined DEVLINK_ATTR_PERM_CONFIG_TYPE so future parameters
  can use arbitrary types (not just U32 and smaller).
* Reverse Christmas tree local variable definitions.
* No longer return original/previous value of parameter in
  response to set.
* Check parameter within enum limits before using it as array
  index.

I have NOT implemented the following suggested changes:

* Have driver report what parameters and parameter options it
  supports.  Could be done in future patch by defining new
  devlink op.
* Support parameters spread across multi-part netlink messages.
  See discussion on list - this doesn't seem necessary even
  for devices with large number of parameters.
* Support specifying per-VF config, if the VFs don't have
  pci b/d/f associated with them.  See discussion on list;
  if/when this support is required, could add
  DEVLINK_ATTR_PERM_CONFIG_VF_INDEX to describe, without
  breaking UAPI.
* Rolling back previously set parameters in a collection of
  sets, when one fails.  Instead, we report back to user
  which sets were successful, so they know which were set
  and which weren't, and can decide how to proceed.

--

Adds a devlink command for getting & setting permanent /
persistent device configuration parameters, and enumerates
the parameters as nested devlink attributes.

bnxt driver patches makes use of these new devlink cmds.

Steve Lin (10):
  devlink: Add permanent config parameter get/set operations
  devlink: Adding SR-IOV enablement perm config param
  devlink: Adding num VFs per PF permanent config param
  devlink: Adding max PF MSI-X vectors perm config param
  devlink: Adding num MSI-X vectors per VF perm config param
  bnxt: Add devlink support for config get/set
  bnxt: Adding SR-IOV enablement permanent cfg param
  bnxt: Adding num VFs per PF perm config param
  bnxt: Adding max PF MSI-X vectors perm config param
  bnxt: Adding num MSI-X vectors per VF perm config param

 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 281 +++-
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h |  17 ++
 drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h | 100 
 include/net/devlink.h |   6 +
 include/uapi/linux/devlink.h  |  33 +++
 net/core/devlink.c| 299 ++
 6 files changed, 730 insertions(+), 6 deletions(-)

-- 
2.7.4

[PATCH net-next v3 02/10] devlink: Adding SR-IOV enablement perm config param

[Steve Lin]

Adding DEVLINK_PERM_CONFIG_SRIOV_ENABLED permanent config
parameter.  Value is permanent, so becomes the new default
value for this device.

  0 = Disable SR-IOV
  1 = Enable SR-IOV

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 include/uapi/linux/devlink.h | 8 +++-
 net/core/devlink.c   | 1 +
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index 28ea961..ed520e7 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h
@@ -256,8 +256,14 @@ enum devlink_dpipe_header_id {
DEVLINK_DPIPE_HEADER_IPV6,
 };
 
-/* Permanent config parameters */
+/* Permanent config parameters:
+ * DEVLINK_PERM_CONFIG_SRIOV_ENABLED:
+ *   0 = disable SR-IOV
+ *   1 = enable SR-IOV
+ */
 enum devlink_perm_config_param {
+   DEVLINK_PERM_CONFIG_SRIOV_ENABLED,
+
__DEVLINK_PERM_CONFIG_MAX,
DEVLINK_PERM_CONFIG_MAX = __DEVLINK_PERM_CONFIG_MAX - 1
 };
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 4deb4da..58ba715 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1569,6 +1569,7 @@ static int devlink_nl_cmd_eswitch_set_doit(struct sk_buff 
*skb,
 static const struct nla_policy devlink_nl_policy[DEVLINK_ATTR_MAX + 1];
 
 static const u8 devlink_perm_cfg_param_types[DEVLINK_PERM_CONFIG_MAX + 1] = {
+   [DEVLINK_PERM_CONFIG_SRIOV_ENABLED] = NLA_U8,
 };
 
 static int devlink_nl_single_param_get(struct sk_buff *msg,
-- 
2.7.4

[PATCH net-next v3 09/10] bnxt: Adding max PF MSI-X vectors perm config param

[Steve Lin]

Adding permanent config parameter for maximum number of PF
MSI-X vectors.

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c 
b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 55913c4..c6e670c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -20,12 +20,16 @@
  *   1 = enable SR-IOV
  * DEVLINK_PERM_CONFIG_NUM_VF_PER_PF:
  *   # of VFs per PF in SR-IOV mode
+ * DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT:
+ *   Max # of MSI-X vectors per PF
  */
 struct bnxt_drv_cfgparam bnxt_drv_cfgparam_list[] = {
{DEVLINK_PERM_CONFIG_SRIOV_ENABLED, BNXT_DRV_PF,
BNXT_DRV_APPL_SHARED, 1, 401},
{DEVLINK_PERM_CONFIG_NUM_VF_PER_PF, BNXT_DRV_PF,
BNXT_DRV_APPL_FUNCTION, 8, 404},
+   {DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT, BNXT_DRV_PF,
+   BNXT_DRV_APPL_SHARED, 10, 108},
 };
 
 #define BNXT_NUM_DRV_CFGPARAM ARRAY_SIZE(bnxt_drv_cfgparam_list)
-- 
2.7.4

[PATCH net-next v3 03/10] devlink: Adding num VFs per PF permanent config param

[Steve Lin]

Adding DEVLINK_PERM_CONFIG_NUM_VF_PER_PF permanent config
parameter.  Value is permanent, so becomes the new default
value for this device.

The value sets the number of VFs per PF in SR-IOV mode.

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 include/uapi/linux/devlink.h | 3 +++
 net/core/devlink.c   | 1 +
 2 files changed, 4 insertions(+)

diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index ed520e7..db512c5 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h
@@ -260,9 +260,12 @@ enum devlink_dpipe_header_id {
  * DEVLINK_PERM_CONFIG_SRIOV_ENABLED:
  *   0 = disable SR-IOV
  *   1 = enable SR-IOV
+ * DEVLINK_PERM_CONFIG_NUM_VF_PER_PF:
+ *   # of VFs per PF in SR-IOV mode
  */
 enum devlink_perm_config_param {
DEVLINK_PERM_CONFIG_SRIOV_ENABLED,
+   DEVLINK_PERM_CONFIG_NUM_VF_PER_PF,
 
__DEVLINK_PERM_CONFIG_MAX,
DEVLINK_PERM_CONFIG_MAX = __DEVLINK_PERM_CONFIG_MAX - 1
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 58ba715..18f2600 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1570,6 +1570,7 @@ static const struct nla_policy 
devlink_nl_policy[DEVLINK_ATTR_MAX + 1];
 
 static const u8 devlink_perm_cfg_param_types[DEVLINK_PERM_CONFIG_MAX + 1] = {
[DEVLINK_PERM_CONFIG_SRIOV_ENABLED] = NLA_U8,
+   [DEVLINK_PERM_CONFIG_NUM_VF_PER_PF] = NLA_U32,
 };
 
 static int devlink_nl_single_param_get(struct sk_buff *msg,
-- 
2.7.4

[PATCH net-next v3 04/10] devlink: Adding max PF MSI-X vectors perm config param

[Steve Lin]

Adding DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT permanent config
parameter.  Value is permanent, so becomes the new default value
for this device.

Value sets the maximum number of PF MSI-X vectors.

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 include/uapi/linux/devlink.h | 3 +++
 net/core/devlink.c   | 1 +
 2 files changed, 4 insertions(+)

diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index db512c5..5877ff9 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h
@@ -262,10 +262,13 @@ enum devlink_dpipe_header_id {
  *   1 = enable SR-IOV
  * DEVLINK_PERM_CONFIG_NUM_VF_PER_PF:
  *   # of VFs per PF in SR-IOV mode
+ * DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT:
+ *   Max # of MSI-X vectors per PF
  */
 enum devlink_perm_config_param {
DEVLINK_PERM_CONFIG_SRIOV_ENABLED,
DEVLINK_PERM_CONFIG_NUM_VF_PER_PF,
+   DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT,
 
__DEVLINK_PERM_CONFIG_MAX,
DEVLINK_PERM_CONFIG_MAX = __DEVLINK_PERM_CONFIG_MAX - 1
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 18f2600..284e167 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1571,6 +1571,7 @@ static const struct nla_policy 
devlink_nl_policy[DEVLINK_ATTR_MAX + 1];
 static const u8 devlink_perm_cfg_param_types[DEVLINK_PERM_CONFIG_MAX + 1] = {
[DEVLINK_PERM_CONFIG_SRIOV_ENABLED] = NLA_U8,
[DEVLINK_PERM_CONFIG_NUM_VF_PER_PF] = NLA_U32,
+   [DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT] = NLA_U32,
 };
 
 static int devlink_nl_single_param_get(struct sk_buff *msg,
-- 
2.7.4

[PATCH net-next v3 10/10] bnxt: Adding num MSI-X vectors per VF perm config param

[Steve Lin]

Adding permanent config parameter for number MSI-X vectors
per VF, using devlink API for get/set operation.

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c 
b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index c6e670c..620a207 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -22,6 +22,8 @@
  *   # of VFs per PF in SR-IOV mode
  * DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT:
  *   Max # of MSI-X vectors per PF
+ * DEVLINK_PERM_CONFIG_MSIX_VECTORS_PER_VF:
+ *   # of MSI-X vectors per VF
  */
 struct bnxt_drv_cfgparam bnxt_drv_cfgparam_list[] = {
{DEVLINK_PERM_CONFIG_SRIOV_ENABLED, BNXT_DRV_PF,
@@ -30,6 +32,8 @@ struct bnxt_drv_cfgparam bnxt_drv_cfgparam_list[] = {
BNXT_DRV_APPL_FUNCTION, 8, 404},
{DEVLINK_PERM_CONFIG_MAX_NUM_PF_MSIX_VECT, BNXT_DRV_PF,
BNXT_DRV_APPL_SHARED, 10, 108},
+   {DEVLINK_PERM_CONFIG_MSIX_VECTORS_PER_VF, BNXT_DRV_PF,
+   BNXT_DRV_APPL_FUNCTION, 10, 406},
 };
 
 #define BNXT_NUM_DRV_CFGPARAM ARRAY_SIZE(bnxt_drv_cfgparam_list)
-- 
2.7.4

[PATCH net-next v3 08/10] bnxt: Adding num VFs per PF perm config param

[Steve Lin]

Adding permanent config parameter for number of VFs per PF,
using devlink API for get/set operation.

Value sets the number of VFs per PF in SR-IOV mode.

Signed-off-by: Steve Lin 
Acked-by: Andy Gospodarek 
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c 
b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 6eb80c1..55913c4 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -18,10 +18,14 @@
  * DEVLINK_PERM_CONFIG_SRIOV_ENABLED:
  *   0 = disable SR-IOV
  *   1 = enable SR-IOV
+ * DEVLINK_PERM_CONFIG_NUM_VF_PER_PF:
+ *   # of VFs per PF in SR-IOV mode
  */
 struct bnxt_drv_cfgparam bnxt_drv_cfgparam_list[] = {
{DEVLINK_PERM_CONFIG_SRIOV_ENABLED, BNXT_DRV_PF,
BNXT_DRV_APPL_SHARED, 1, 401},
+   {DEVLINK_PERM_CONFIG_NUM_VF_PER_PF, BNXT_DRV_PF,
+   BNXT_DRV_APPL_FUNCTION, 8, 404},
 };
 
 #define BNXT_NUM_DRV_CFGPARAM ARRAY_SIZE(bnxt_drv_cfgparam_list)
-- 
2.7.4

Re: [PATCH] net: sunrpc: svcauth_gss: use BUG_ON instead of if condition followed by BUG

[Gustavo A. R. Silva]

Quoting "J. Bruce Fields" :


On Tue, Oct 24, 2017 at 02:18:52PM -0400, Jeff Layton wrote:

On Tue, 2017-10-24 at 13:53 -0400, J. Bruce Fields wrote:
> On Tue, Oct 24, 2017 at 01:26:49PM -0400, Weston Andros Adamson wrote:
> > Is there a reason to BUG() in these places? Couldn't we  
WARN_ON_ONCE and return an error?

>
> I think the BUG() will just kill an nfsd thread that isn't holding any
> interesting locks.
>

Not necessarily. If panic_on_oops is set (and it usually is in
"production" setups), it'll crash the box there.


Maybe they're getting what they asked for?


> The failures look unlikely.  (Except for that read_u32... return, I
> wonder if we're missing a check there.)

Agreed, looks like you only hit an error if the read attempts to go out
of bounds. In principle that shouldn't ever happen (and I haven't seen
any reports of it).

Still...I agree with Dros that it's better to handle this without
oopsing if we can. We can return an error from either of those
functions. A sane error and a WARN_ONCE would be better here.


OK, OK, OK.

There are also some more BUGs that could use looking into if anyone
wants to.

--b.

commit eb754930662f
Author: J. Bruce Fields 
Date:   Tue Oct 24 14:58:11 2017 -0400

rpc: remove some BUG()s

It would be kinder to WARN() and recover in several spots here instead
of BUG()ing.

Also, it looks like the read_u32_from_xdr_buf() call could actually
fail, though it might require a broken (or malicious) client, so convert
that to just an error return.

Reported-by: Weston Andros Adamson 
Signed-off-by: J. Bruce Fields 

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c  
b/net/sunrpc/auth_gss/svcauth_gss.c

index 7b1ee5a0b03c..73165e9ca5bf 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -855,11 +855,13 @@ unwrap_integ_data(struct svc_rqst *rqstp,  
struct xdr_buf *buf, u32 seq, struct g

return stat;
if (integ_len > buf->len)
return stat;
-   if (xdr_buf_subsegment(buf, _buf, 0, integ_len))
-   BUG();
+   if (xdr_buf_subsegment(buf, _buf, 0, integ_len)) {
+   WARN_ON_ONCE(1);
+   return stat;
+   }
/* copy out mic... */
if (read_u32_from_xdr_buf(buf, integ_len, ))
-   BUG();
+   return stat;
if (mic.len > RPC_MAX_AUTH_SIZE)
return stat;
mic.data = kmalloc(mic.len, GFP_KERNEL);
@@ -1611,8 +1613,10 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
BUG_ON(integ_len % 4);
*p++ = htonl(integ_len);
*p++ = htonl(gc->gc_seq);
-   if (xdr_buf_subsegment(resbuf, _buf, integ_offset, integ_len))
-   BUG();
+   if (xdr_buf_subsegment(resbuf, _buf, integ_offset, integ_len)) {
+   WARN_ON_ONCE(1);
+   goto out_err;
+   }
if (resbuf->tail[0].iov_base == NULL) {
if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE)
goto out_err;


What about the following BUG() at net/sunrpc/svc_xprt.c:1058:

/*
 * Remove a dead transport
 */
static void svc_delete_xprt(struct svc_xprt *xprt)
{
struct svc_serv *serv = xprt->xpt_server;
struct svc_deferred_req *dr;

/* Only do this once */
if (test_and_set_bit(XPT_DEAD, >xpt_flags))
BUG();

dprintk("svc: svc_delete_xprt(%p)\n", xprt);
xprt->xpt_ops->xpo_detach(xprt);

spin_lock_bh(>sv_lock);
list_del_init(>xpt_list);
WARN_ON_ONCE(!list_empty(>xpt_ready));
if (test_bit(XPT_TEMP, >xpt_flags))
serv->sv_tmpcnt--;
spin_unlock_bh(>sv_lock);

while ((dr = svc_deferred_dequeue(xprt)) != NULL)
kfree(dr);

call_xpt_users(xprt);
svc_xprt_put(xprt);
}

I'm suspicious about that comment above the _if_ condition: /* Only do  
this once */


Would it help to replace that BUG with a WARN_ON_ONCE?

Thanks
--
Gustavo A. R. Silva

Re: [PATCH] wimax/i2400m: Remove VLAIS

[Matthias Kaehlcke]

El Mon, Oct 09, 2017 at 12:41:53PM -0700 Matthias Kaehlcke ha dit:

> From: Behan Webster 
> 
> Convert Variable Length Array in Struct (VLAIS) to valid C by converting
> local struct definition to use a flexible array. The structure is only
> used to define a cast of a buffer so the size of the struct is not used
> to allocate storage.
> 
> Signed-off-by: Behan Webster 
> Signed-off-by: Mark Charebois 
> Suggested-by: Arnd Bergmann 
> Signed-off-by: Matthias Kaehlcke 
> ---
>  drivers/net/wimax/i2400m/fw.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c
> index c9c711dcd0e6..a89b5685e68b 100644
> --- a/drivers/net/wimax/i2400m/fw.c
> +++ b/drivers/net/wimax/i2400m/fw.c
> @@ -652,7 +652,7 @@ static int i2400m_download_chunk(struct i2400m *i2400m, 
> const void *chunk,
>   struct device *dev = i2400m_dev(i2400m);
>   struct {
>   struct i2400m_bootrom_header cmd;
> - u8 cmd_payload[chunk_len];
> + u8 cmd_payload[];
>   } __packed *buf;
>   struct i2400m_bootrom_header ack;

ping

any comments on this?

Re: [PATCH] net: sunrpc: svcauth_gss: use BUG_ON instead of if condition followed by BUG

[J. Bruce Fields]

On Tue, Oct 24, 2017 at 02:18:52PM -0400, Jeff Layton wrote:
> On Tue, 2017-10-24 at 13:53 -0400, J. Bruce Fields wrote:
> > On Tue, Oct 24, 2017 at 01:26:49PM -0400, Weston Andros Adamson wrote:
> > > Is there a reason to BUG() in these places? Couldn't we WARN_ON_ONCE and 
> > > return an error?
> > 
> > I think the BUG() will just kill an nfsd thread that isn't holding any
> > interesting locks.
> > 
> 
> Not necessarily. If panic_on_oops is set (and it usually is in
> "production" setups), it'll crash the box there.

Maybe they're getting what they asked for?

> > The failures look unlikely.  (Except for that read_u32... return, I
> > wonder if we're missing a check there.)
> 
> Agreed, looks like you only hit an error if the read attempts to go out
> of bounds. In principle that shouldn't ever happen (and I haven't seen
> any reports of it).
> 
> Still...I agree with Dros that it's better to handle this without
> oopsing if we can. We can return an error from either of those
> functions. A sane error and a WARN_ONCE would be better here.

OK, OK, OK.

There are also some more BUGs that could use looking into if anyone
wants to.

--b.

commit eb754930662f
Author: J. Bruce Fields 
Date:   Tue Oct 24 14:58:11 2017 -0400

rpc: remove some BUG()s

It would be kinder to WARN() and recover in several spots here instead
of BUG()ing.

Also, it looks like the read_u32_from_xdr_buf() call could actually
fail, though it might require a broken (or malicious) client, so convert
that to just an error return.

Reported-by: Weston Andros Adamson 
Signed-off-by: J. Bruce Fields 

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c 
b/net/sunrpc/auth_gss/svcauth_gss.c
index 7b1ee5a0b03c..73165e9ca5bf 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -855,11 +855,13 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf 
*buf, u32 seq, struct g
return stat;
if (integ_len > buf->len)
return stat;
-   if (xdr_buf_subsegment(buf, _buf, 0, integ_len))
-   BUG();
+   if (xdr_buf_subsegment(buf, _buf, 0, integ_len)) {
+   WARN_ON_ONCE(1);
+   return stat;
+   }
/* copy out mic... */
if (read_u32_from_xdr_buf(buf, integ_len, ))
-   BUG();
+   return stat;
if (mic.len > RPC_MAX_AUTH_SIZE)
return stat;
mic.data = kmalloc(mic.len, GFP_KERNEL);
@@ -1611,8 +1613,10 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
BUG_ON(integ_len % 4);
*p++ = htonl(integ_len);
*p++ = htonl(gc->gc_seq);
-   if (xdr_buf_subsegment(resbuf, _buf, integ_offset, integ_len))
-   BUG();
+   if (xdr_buf_subsegment(resbuf, _buf, integ_offset, integ_len)) {
+   WARN_ON_ONCE(1);
+   goto out_err;
+   }
if (resbuf->tail[0].iov_base == NULL) {
if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE)
goto out_err;

Re: [PATCH] netfilter: ipvs: Convert timers to use timer_setup()

[Julian Anastasov]

Hello,

On Tue, 24 Oct 2017, Kees Cook wrote:

> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
> 
> Cc: Wensong Zhang 
> Cc: Simon Horman 
> Cc: Julian Anastasov 
> Cc: Pablo Neira Ayuso 
> Cc: Jozsef Kadlecsik 
> Cc: Florian Westphal 
> Cc: "David S. Miller" 
> Cc: netdev@vger.kernel.org
> Cc: lvs-de...@vger.kernel.org
> Cc: netfilter-de...@vger.kernel.org
> Cc: coret...@netfilter.org
> Signed-off-by: Kees Cook 

Looks good to me,

Acked-by: Julian Anastasov 

> ---
>  net/netfilter/ipvs/ip_vs_conn.c  | 10 +-
>  net/netfilter/ipvs/ip_vs_ctl.c   |  7 +++
>  net/netfilter/ipvs/ip_vs_est.c   |  6 +++---
>  net/netfilter/ipvs/ip_vs_lblc.c  | 11 ++-
>  net/netfilter/ipvs/ip_vs_lblcr.c | 11 ++-
>  5 files changed, 23 insertions(+), 22 deletions(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
> index 3d2ac71a83ec..3a43b3470331 100644
> --- a/net/netfilter/ipvs/ip_vs_conn.c
> +++ b/net/netfilter/ipvs/ip_vs_conn.c
> @@ -104,7 +104,7 @@ static inline void ct_write_unlock_bh(unsigned int key)
>   spin_unlock_bh(&__ip_vs_conntbl_lock_array[key_LOCKARRAY_MASK].l);
>  }
>  
> -static void ip_vs_conn_expire(unsigned long data);
> +static void ip_vs_conn_expire(struct timer_list *t);
>  
>  /*
>   *   Returns hash value for IPVS connection entry
> @@ -457,7 +457,7 @@ EXPORT_SYMBOL_GPL(ip_vs_conn_out_get_proto);
>  static void __ip_vs_conn_put_notimer(struct ip_vs_conn *cp)
>  {
>   __ip_vs_conn_put(cp);
> - ip_vs_conn_expire((unsigned long)cp);
> + ip_vs_conn_expire(>timer);
>  }
>  
>  /*
> @@ -817,9 +817,9 @@ static void ip_vs_conn_rcu_free(struct rcu_head *head)
>   kmem_cache_free(ip_vs_conn_cachep, cp);
>  }
>  
> -static void ip_vs_conn_expire(unsigned long data)
> +static void ip_vs_conn_expire(struct timer_list *t)
>  {
> - struct ip_vs_conn *cp = (struct ip_vs_conn *)data;
> + struct ip_vs_conn *cp = from_timer(cp, t, timer);
>   struct netns_ipvs *ipvs = cp->ipvs;
>  
>   /*
> @@ -909,7 +909,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p, int 
> dest_af,
>   }
>  
>   INIT_HLIST_NODE(>c_list);
> - setup_timer(>timer, ip_vs_conn_expire, (unsigned long)cp);
> + timer_setup(>timer, ip_vs_conn_expire, 0);
>   cp->ipvs   = ipvs;
>   cp->af = p->af;
>   cp->daf= dest_af;
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index 4f940d7eb2f7..b47e266c6eca 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -1146,9 +1146,9 @@ ip_vs_del_dest(struct ip_vs_service *svc, struct 
> ip_vs_dest_user_kern *udest)
>   return 0;
>  }
>  
> -static void ip_vs_dest_trash_expire(unsigned long data)
> +static void ip_vs_dest_trash_expire(struct timer_list *t)
>  {
> - struct netns_ipvs *ipvs = (struct netns_ipvs *)data;
> + struct netns_ipvs *ipvs = from_timer(ipvs, t, dest_trash_timer);
>   struct ip_vs_dest *dest, *next;
>   unsigned long now = jiffies;
>  
> @@ -4019,8 +4019,7 @@ int __net_init ip_vs_control_net_init(struct netns_ipvs 
> *ipvs)
>  
>   INIT_LIST_HEAD(>dest_trash);
>   spin_lock_init(>dest_trash_lock);
> - setup_timer(>dest_trash_timer, ip_vs_dest_trash_expire,
> - (unsigned long) ipvs);
> + timer_setup(>dest_trash_timer, ip_vs_dest_trash_expire, 0);
>   atomic_set(>ftpsvc_counter, 0);
>   atomic_set(>nullsvc_counter, 0);
>   atomic_set(>conn_out_counter, 0);
> diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
> index 457c6c193e13..489055091a9b 100644
> --- a/net/netfilter/ipvs/ip_vs_est.c
> +++ b/net/netfilter/ipvs/ip_vs_est.c
> @@ -97,12 +97,12 @@ static void ip_vs_read_cpu_stats(struct ip_vs_kstats *sum,
>  }
>  
>  
> -static void estimation_timer(unsigned long arg)
> +static void estimation_timer(struct timer_list *t)
>  {
>   struct ip_vs_estimator *e;
>   struct ip_vs_stats *s;
>   u64 rate;
> - struct netns_ipvs *ipvs = (struct netns_ipvs *)arg;
> + struct netns_ipvs *ipvs = from_timer(ipvs, t, est_timer);
>  
>   spin_lock(>est_lock);
>   list_for_each_entry(e, >est_list, list) {
> @@ -192,7 +192,7 @@ int __net_init ip_vs_estimator_net_init(struct netns_ipvs 
> *ipvs)
>  {
>   INIT_LIST_HEAD(>est_list);
>   spin_lock_init(>est_lock);
> - setup_timer(>est_timer, estimation_timer, (unsigned long)ipvs);
> + timer_setup(>est_timer, estimation_timer, 0);
>   mod_timer(>est_timer, jiffies + 2 * HZ);
>   return 0;
>  }
> diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
> index 

Re: [PATCH v7 10/10] of: mdio: Prevent of_mdiobus_register from scanning mdio-mux nodes

[Corentin Labbe]

On Tue, Oct 24, 2017 at 01:46:54PM -0500, Rob Herring wrote:
> On Wed, Oct 18, 2017 at 01:44:58PM +0200, Corentin Labbe wrote:
> > Each child node of an MDIO node is scanned as a PHY when calling
> > of_mdiobus_register() givint the following result:
> > [   18.175379] mdio_bus stmmac-0: /soc/ethernet@1c3/mdio/mdio-mux has 
> > invalid PHY address
> > [   18.175408] mdio_bus stmmac-0: scan phy mdio-mux at address 0
> > [   18.175450] mdio_bus stmmac-0: scan phy mdio-mux at address 1
> > [...]
> > [   18.176420] mdio_bus stmmac-0: scan phy mdio-mux at address 30
> > [   18.176452] mdio_bus stmmac-0: scan phy mdio-mux at address 31
> > 
> > Since mdio-mux nodes are not PHY, this patch a way to to not scan
> > them.
> 
> This can be dropped now, right?

Yes and it is dropped in my two last serie.
Forgot to said it in changelog

Re: [PATCH v7 10/10] of: mdio: Prevent of_mdiobus_register from scanning mdio-mux nodes

[Rob Herring]

On Wed, Oct 18, 2017 at 01:44:58PM +0200, Corentin Labbe wrote:
> Each child node of an MDIO node is scanned as a PHY when calling
> of_mdiobus_register() givint the following result:
> [   18.175379] mdio_bus stmmac-0: /soc/ethernet@1c3/mdio/mdio-mux has 
> invalid PHY address
> [   18.175408] mdio_bus stmmac-0: scan phy mdio-mux at address 0
> [   18.175450] mdio_bus stmmac-0: scan phy mdio-mux at address 1
> [...]
> [   18.176420] mdio_bus stmmac-0: scan phy mdio-mux at address 30
> [   18.176452] mdio_bus stmmac-0: scan phy mdio-mux at address 31
> 
> Since mdio-mux nodes are not PHY, this patch a way to to not scan
> them.

This can be dropped now, right?
> 
> Signed-off-by: Corentin Labbe 
> ---
>  drivers/of/of_mdio.c | 10 ++
>  1 file changed, 10 insertions(+)

Re: [PATCH] net: sunrpc: svcauth_gss: use BUG_ON instead of if condition followed by BUG

[Jeff Layton]

On Tue, 2017-10-24 at 13:53 -0400, J. Bruce Fields wrote:
> On Tue, Oct 24, 2017 at 01:26:49PM -0400, Weston Andros Adamson wrote:
> > Is there a reason to BUG() in these places? Couldn't we WARN_ON_ONCE and 
> > return an error?
> 
> I think the BUG() will just kill an nfsd thread that isn't holding any
> interesting locks.
> 

Not necessarily. If panic_on_oops is set (and it usually is in
"production" setups), it'll crash the box there.

> The failures look unlikely.  (Except for that read_u32... return, I
> wonder if we're missing a check there.)
> 

Agreed, looks like you only hit an error if the read attempts to go out
of bounds. In principle that shouldn't ever happen (and I haven't seen
any reports of it).

Still...I agree with Dros that it's better to handle this without
oopsing if we can. We can return an error from either of those
functions. A sane error and a WARN_ONCE would be better here.


> --b.
> 
> > 
> > -dros
> > 
> > > On Oct 23, 2017, at 4:31 PM, J. Bruce Fields  wrote:
> > > 
> > > In the past we've avoided BUG_ON(X) where X might have side effects, on
> > > the theory that it should actually be OK just to compile out BUG_ON()s.
> > > Has that changed?
> > > 
> > > In any case, I don't find that this improves readability; dropping.
> > > 
> > > --b.
> > > 
> > > On Mon, Oct 23, 2017 at 01:16:35PM -0500, Gustavo A. R. Silva wrote:
> > > > Use BUG_ON instead of if condition followed by BUG.
> > > > 
> > > > This issue was detected with the help of Coccinelle.
> > > > 
> > > > Signed-off-by: Gustavo A. R. Silva 
> > > > ---
> > > > net/sunrpc/auth_gss/svcauth_gss.c | 9 +++--
> > > > 1 file changed, 3 insertions(+), 6 deletions(-)
> > > > 
> > > > diff --git a/net/sunrpc/auth_gss/svcauth_gss.c 
> > > > b/net/sunrpc/auth_gss/svcauth_gss.c
> > > > index 7b1ee5a..a10ce43 100644
> > > > --- a/net/sunrpc/auth_gss/svcauth_gss.c
> > > > +++ b/net/sunrpc/auth_gss/svcauth_gss.c
> > > > @@ -855,11 +855,9 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct 
> > > > xdr_buf *buf, u32 seq, struct g
> > > > return stat;
> > > > if (integ_len > buf->len)
> > > > return stat;
> > > > -   if (xdr_buf_subsegment(buf, _buf, 0, integ_len))
> > > > -   BUG();
> > > > +   BUG_ON(xdr_buf_subsegment(buf, _buf, 0, integ_len));
> > > > /* copy out mic... */
> > > > -   if (read_u32_from_xdr_buf(buf, integ_len, ))
> > > > -   BUG();
> > > > +   BUG_ON(read_u32_from_xdr_buf(buf, integ_len, ));
> > > > if (mic.len > RPC_MAX_AUTH_SIZE)
> > > > return stat;
> > > > mic.data = kmalloc(mic.len, GFP_KERNEL);
> > > > @@ -1611,8 +1609,7 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst 
> > > > *rqstp)
> > > > BUG_ON(integ_len % 4);
> > > > *p++ = htonl(integ_len);
> > > > *p++ = htonl(gc->gc_seq);
> > > > -   if (xdr_buf_subsegment(resbuf, _buf, integ_offset, 
> > > > integ_len))
> > > > -   BUG();
> > > > +   BUG_ON(xdr_buf_subsegment(resbuf, _buf, integ_offset, 
> > > > integ_len));
> > > > if (resbuf->tail[0].iov_base == NULL) {
> > > > if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > 
> > > > PAGE_SIZE)
> > > > goto out_err;
> > > > -- 
> > > > 2.7.4
> > > 
> > > --
> > > To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> > > the body of a message to majord...@vger.kernel.org
> > > More majordomo info at  http://vger.kernel.org/majordomo-info.html

-- 
Jeff Layton 

[PATCH v9 00/10] net: stmmac: dwmac-sun8i: Handle integrated PHY

[Corentin Labbe]

Hello

The current way to find if the PHY is internal is to compare DT phy-mode
and emac_variant/internal_phy.
But it will negate a possible future SoC where an external PHY use the
same phy mode than the integrated one.

This patchs series adds a new way to handle this problem via a mdio-mux.

The first try was to create a new MDIO mux "mdio-mux-syscon".
mdio-mux-syscon working the same way than mdio-mux-mmioreg with the exception
that the register is used via syscon/regmap.
But this solution does not work for two reason:
- changing the MDIO selection need the reset of MAC which cannot be done by the
mdio-mux-syscon driver
- There were driver loading order problem:
- mdio-mux-syscon needing that stmmac register the parent MDIO
- stmmac needing that child MDIO was registered just after registering 
parent MDIO

So we cannot use any external MDIO-mux.

The final solution was to represent the mdio-mux in MAC node and let the MAC 
handle all things.

Since DT bits was reverted in 4.13, this patch series include the revert of the 
revert.

I have let patch splited for easy review. (for seeing what's new)
But the final serie could have some patch squashed if someone want.
Like squashing patch and 1 and 2 (documentation)

The first 7 patch should go via the sunxi tree, the last three via the net tree.

Regards

Changes since v8:
- added reference to mdio-mux.txt in documentation
- removed compatible mdio-mux
- added mdio-parent-bus

Changes since v7:
- moved mdio-mux ouf of mdio as asked by Andrew Lunn
- reordered patchs order

Changes since v6:
- renamed external mdio to "external_mdio"
- added compatible to mdio-mux and internal-mdio
- removed usage of phy-is-integrated
- renamed do_not_scan to compatible_muxes (patch 10)
- patch 8 9 of v6 are squashed

Changes since v5:
- reordered patch 1 and 2
- mdio-mux node is now a mdio's child
- added patch 11 for removing unnecessary scan of mdio-mux

Changes since v4:
- Update documentation for new bindings
- Added 4 patchs for bring back reverted stuff of 4.13
- dwmac-sun8i now handle mdio-mux
- MDIO use now compatible = "snps,dwmac-mdio";

Changes since v3:
- Added a patch for handling fixed-link
- Updated documentation

Changes since v2:
- Add a MDIO mux for creating distinction between integrated and external MDIO.
- phy-is-integrated is not set in dtsi.

Changes since v1:
- Dropped phy-is-integrated documentation patch since another same patch was 
already merged
- Moved phy-is-integrated from SoC dtsi to final board DT.

Acked-by: Florian Fainelli 

Corentin Labbe (10):
  dt-bindings: net: Restore sun8i dwmac binding
  dt-bindings: net: dwmac-sun8i: update documentation about integrated
PHY
  arm: dts: sunxi: h3/h5: Restore EMAC changes
  arm: dts: sunxi: h3/h5: represent the mdio switch used by
sun8i-h3-emac
  arm: dts: sunxi: Restore EMAC changes (boards)
  arm64: dts: allwinner: Restore EMAC changes
  arm64: dts: allwinner: add snps,dwmac-mdio compatible to emac/mdio
  net: stmmac: snps,dwmac-mdio MDIOs are automatically registered
  net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs
  net: stmmac: sun8i: Restore the compatibles

 .../devicetree/bindings/net/dwmac-sun8i.txt| 205 
 arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts  |   9 +
 arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts|  19 ++
 arch/arm/boot/dts/sun8i-h3-nanopi-m1-plus.dts  |  19 ++
 arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts  |   7 +
 arch/arm/boot/dts/sun8i-h3-orangepi-2.dts  |   8 +
 arch/arm/boot/dts/sun8i-h3-orangepi-one.dts|   8 +
 arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts|   5 +
 arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts |   8 +
 arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts   |  22 ++
 arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts |  16 +
 arch/arm/boot/dts/sunxi-h3-h5.dtsi |  48 +++
 .../boot/dts/allwinner/sun50i-a64-bananapi-m64.dts |  16 +
 .../boot/dts/allwinner/sun50i-a64-pine64-plus.dts  |  15 +
 .../arm64/boot/dts/allwinner/sun50i-a64-pine64.dts |  17 +
 .../dts/allwinner/sun50i-a64-sopine-baseboard.dts  |  16 +
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi  |  21 ++
 .../boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts   |  17 +
 .../boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts  |  17 +
 .../dts/allwinner/sun50i-h5-orangepi-prime.dts |  17 +
 drivers/net/ethernet/stmicro/stmmac/Kconfig|   1 +
 drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c  | 361 +
 .../net/ethernet/stmicro/stmmac/stmmac_platform.c  |   4 -
 23 files changed, 742 insertions(+), 134 deletions(-)
 create mode 100644 Documentation/devicetree/bindings/net/dwmac-sun8i.txt

-- 
2.13.6

[PATCH v9 01/10] dt-bindings: net: Restore sun8i dwmac binding

[Corentin Labbe]

The original dwmac-sun8i DT bindings have some issue on how to handle
integrated PHY and was reverted in last RC of 4.13.
But now we have a solution so we need to get back that was reverted.

This patch restore dt-bindings documentation about dwmac-sun8i
This reverts commit 8aa33ec2f481 ("dt-bindings: net: Revert sun8i dwmac 
binding")

Signed-off-by: Corentin Labbe 
Acked-by: Rob Herring 
---
 .../devicetree/bindings/net/dwmac-sun8i.txt| 84 ++
 1 file changed, 84 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/net/dwmac-sun8i.txt

diff --git a/Documentation/devicetree/bindings/net/dwmac-sun8i.txt 
b/Documentation/devicetree/bindings/net/dwmac-sun8i.txt
new file mode 100644
index ..725f3b187886
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/dwmac-sun8i.txt
@@ -0,0 +1,84 @@
+* Allwinner sun8i GMAC ethernet controller
+
+This device is a platform glue layer for stmmac.
+Please see stmmac.txt for the other unchanged properties.
+
+Required properties:
+- compatible: should be one of the following string:
+   "allwinner,sun8i-a83t-emac"
+   "allwinner,sun8i-h3-emac"
+   "allwinner,sun8i-v3s-emac"
+   "allwinner,sun50i-a64-emac"
+- reg: address and length of the register for the device.
+- interrupts: interrupt for the device
+- interrupt-names: should be "macirq"
+- clocks: A phandle to the reference clock for this device
+- clock-names: should be "stmmaceth"
+- resets: A phandle to the reset control for this device
+- reset-names: should be "stmmaceth"
+- phy-mode: See ethernet.txt
+- phy-handle: See ethernet.txt
+- #address-cells: shall be 1
+- #size-cells: shall be 0
+- syscon: A phandle to the syscon of the SoC with one of the following
+ compatible string:
+  - allwinner,sun8i-h3-system-controller
+  - allwinner,sun8i-v3s-system-controller
+  - allwinner,sun50i-a64-system-controller
+  - allwinner,sun8i-a83t-system-controller
+
+Optional properties:
+- allwinner,tx-delay-ps: TX clock delay chain value in ps. Range value is 
0-700. Default is 0)
+- allwinner,rx-delay-ps: RX clock delay chain value in ps. Range value is 
0-3100. Default is 0)
+Both delay properties need to be a multiple of 100. They control the delay for
+external PHY.
+
+Optional properties for the following compatibles:
+  - "allwinner,sun8i-h3-emac",
+  - "allwinner,sun8i-v3s-emac":
+- allwinner,leds-active-low: EPHY LEDs are active low
+
+Required child node of emac:
+- mdio bus node: should be named mdio
+
+Required properties of the mdio node:
+- #address-cells: shall be 1
+- #size-cells: shall be 0
+
+The device node referenced by "phy" or "phy-handle" should be a child node
+of the mdio node. See phy.txt for the generic PHY bindings.
+
+Required properties of the phy node with the following compatibles:
+  - "allwinner,sun8i-h3-emac",
+  - "allwinner,sun8i-v3s-emac":
+- clocks: a phandle to the reference clock for the EPHY
+- resets: a phandle to the reset control for the EPHY
+
+Example:
+
+emac: ethernet@1c0b000 {
+   compatible = "allwinner,sun8i-h3-emac";
+   syscon = <>;
+   reg = <0x01c0b000 0x104>;
+   interrupts = ;
+   interrupt-names = "macirq";
+   resets = < RST_BUS_EMAC>;
+   reset-names = "stmmaceth";
+   clocks = < CLK_BUS_EMAC>;
+   clock-names = "stmmaceth";
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   phy-handle = <_mii_phy>;
+   phy-mode = "mii";
+   allwinner,leds-active-low;
+   mdio: mdio {
+   #address-cells = <1>;
+   #size-cells = <0>;
+   int_mii_phy: ethernet-phy@1 {
+   reg = <1>;
+   clocks = < CLK_BUS_EPHY>;
+   resets = < RST_BUS_EPHY>;
+   };
+   };
+};
-- 
2.13.6

[PATCH v9 05/10] arm: dts: sunxi: Restore EMAC changes (boards)

[Corentin Labbe]

The original dwmac-sun8i DT bindings have some issue on how to handle
integrated PHY and was reverted in last RC of 4.13.
But now we have a solution so we need to get back that was reverted.

This patch restore all boards DT about dwmac-sun8i
This reverts partially commit fe45174b72ae ("arm: dts: sunxi: Revert EMAC 
changes")

Signed-off-by: Corentin Labbe 
---
 arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts |  9 +
 arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts   | 19 +++
 arch/arm/boot/dts/sun8i-h3-nanopi-m1-plus.dts | 19 +++
 arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts |  7 +++
 arch/arm/boot/dts/sun8i-h3-orangepi-2.dts |  8 
 arch/arm/boot/dts/sun8i-h3-orangepi-one.dts   |  8 
 arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts   |  5 +
 arch/arm/boot/dts/sun8i-h3-orangepi-pc.dts|  8 
 arch/arm/boot/dts/sun8i-h3-orangepi-plus.dts  | 22 ++
 arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts| 16 
 10 files changed, 121 insertions(+)

diff --git a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts 
b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
index b1502df7b509..6713d0f2b3f4 100644
--- a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
+++ b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
@@ -56,6 +56,8 @@
 
aliases {
serial0 = 
+   /* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */
+   ethernet0 = 
ethernet1 = 
};
 
@@ -102,6 +104,13 @@
status = "okay";
 };
 
+ {
+   phy-handle = <_mii_phy>;
+   phy-mode = "mii";
+   allwinner,leds-active-low;
+   status = "okay";
+};
+
  {
pinctrl-names = "default";
pinctrl-0 = <_pins_a>;
diff --git a/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts 
b/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
index e1dba9ffa94b..f2292deaa590 100644
--- a/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
+++ b/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
@@ -52,6 +52,7 @@
compatible = "sinovoip,bpi-m2-plus", "allwinner,sun8i-h3";
 
aliases {
+   ethernet0 = 
serial0 = 
serial1 = 
};
@@ -111,6 +112,24 @@
status = "okay";
 };
 
+ {
+   pinctrl-names = "default";
+   pinctrl-0 = <_rgmii_pins>;
+   phy-supply = <_gmac_3v3>;
+   phy-handle = <_rgmii_phy>;
+   phy-mode = "rgmii";
+
+   allwinner,leds-active-low;
+   status = "okay";
+};
+
+_mdio {
+   ext_rgmii_phy: ethernet-phy@1 {
+   compatible = "ethernet-phy-ieee802.3-c22";
+   reg = <0>;
+   };
+};
+
  {
pinctrl-names = "default";
pinctrl-0 = <_pins_a>;
diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-m1-plus.dts 
b/arch/arm/boot/dts/sun8i-h3-nanopi-m1-plus.dts
index 73766d38ee6c..cfb96da3cfef 100644
--- a/arch/arm/boot/dts/sun8i-h3-nanopi-m1-plus.dts
+++ b/arch/arm/boot/dts/sun8i-h3-nanopi-m1-plus.dts
@@ -66,6 +66,25 @@
status = "okay";
 };
 
+ {
+   pinctrl-names = "default";
+   pinctrl-0 = <_rgmii_pins>;
+   phy-supply = <_gmac_3v3>;
+   phy-handle = <_rgmii_phy>;
+   phy-mode = "rgmii";
+
+   allwinner,leds-active-low;
+
+   status = "okay";
+};
+
+_mdio {
+   ext_rgmii_phy: ethernet-phy@1 {
+   compatible = "ethernet-phy-ieee802.3-c22";
+   reg = <7>;
+   };
+};
+
  {
pinctrl-names = "default";
pinctrl-0 = <_pins_a>;
diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts 
b/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts
index 8d2cc6e9a03f..78f6c24952dd 100644
--- a/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts
+++ b/arch/arm/boot/dts/sun8i-h3-nanopi-neo.dts
@@ -46,3 +46,10 @@
model = "FriendlyARM NanoPi NEO";
compatible = "friendlyarm,nanopi-neo", "allwinner,sun8i-h3";
 };
+
+ {
+   phy-handle = <_mii_phy>;
+   phy-mode = "mii";
+   allwinner,leds-active-low;
+   status = "okay";
+};
diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts 
b/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts
index 1bf51802f5aa..b20be95b49d5 100644
--- a/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts
+++ b/arch/arm/boot/dts/sun8i-h3-orangepi-2.dts
@@ -54,6 +54,7 @@
aliases {
serial0 = 
/* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */
+   ethernet0 = 
ethernet1 = 
};
 
@@ -117,6 +118,13 @@
status = "okay";
 };
 
+ {
+   phy-handle = <_mii_phy>;
+   phy-mode = "mii";
+   allwinner,leds-active-low;
+   status = "okay";
+};
+
  {
pinctrl-names = "default";
pinctrl-0 = <_pins_a>;
diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts 
b/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
index a1c6ff6fd05d..82e5d28cd698 100644
--- a/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
+++ 

[PATCH v9 02/10] dt-bindings: net: dwmac-sun8i: update documentation about integrated PHY

[Corentin Labbe]

This patch add documentation about the MDIO switch used on sun8i-h3-emac
for integrated PHY.

Signed-off-by: Corentin Labbe 
---
 .../devicetree/bindings/net/dwmac-sun8i.txt| 145 +++--
 1 file changed, 133 insertions(+), 12 deletions(-)

diff --git a/Documentation/devicetree/bindings/net/dwmac-sun8i.txt 
b/Documentation/devicetree/bindings/net/dwmac-sun8i.txt
index 725f3b187886..2600ce9ad3cc 100644
--- a/Documentation/devicetree/bindings/net/dwmac-sun8i.txt
+++ b/Documentation/devicetree/bindings/net/dwmac-sun8i.txt
@@ -4,18 +4,18 @@ This device is a platform glue layer for stmmac.
 Please see stmmac.txt for the other unchanged properties.
 
 Required properties:
-- compatible: should be one of the following string:
+- compatible: must be one of the following string:
"allwinner,sun8i-a83t-emac"
"allwinner,sun8i-h3-emac"
"allwinner,sun8i-v3s-emac"
"allwinner,sun50i-a64-emac"
 - reg: address and length of the register for the device.
 - interrupts: interrupt for the device
-- interrupt-names: should be "macirq"
+- interrupt-names: must be "macirq"
 - clocks: A phandle to the reference clock for this device
-- clock-names: should be "stmmaceth"
+- clock-names: must be "stmmaceth"
 - resets: A phandle to the reset control for this device
-- reset-names: should be "stmmaceth"
+- reset-names: must be "stmmaceth"
 - phy-mode: See ethernet.txt
 - phy-handle: See ethernet.txt
 - #address-cells: shall be 1
@@ -39,23 +39,42 @@ Optional properties for the following compatibles:
 - allwinner,leds-active-low: EPHY LEDs are active low
 
 Required child node of emac:
-- mdio bus node: should be named mdio
+- mdio bus node: with compatible "snps,dwmac-mdio"
 
 Required properties of the mdio node:
 - #address-cells: shall be 1
 - #size-cells: shall be 0
 
-The device node referenced by "phy" or "phy-handle" should be a child node
+The device node referenced by "phy" or "phy-handle" must be a child node
 of the mdio node. See phy.txt for the generic PHY bindings.
 
-Required properties of the phy node with the following compatibles:
+The following compatibles require that the emac node have a mdio-mux child
+node called "mdio-mux":
+  - "allwinner,sun8i-h3-emac"
+  - "allwinner,sun8i-v3s-emac":
+Required properties for the mdio-mux node:
+  - compatible = "allwinner,sun8i-h3-mdio-mux"
+  - mdio-parent-bus: a phandle to EMAC mdio
+  - one child mdio for the integrated mdio with the compatible
+"allwinner,sun8i-h3-mdio-internal"
+  - one child mdio for the external mdio if present (V3s have none)
+Required properties for the mdio-mux children node:
+  - reg: 1 for internal MDIO bus, 2 for external MDIO bus
+
+The following compatibles require a PHY node representing the integrated
+PHY, under the integrated MDIO bus node if an mdio-mux node is used:
   - "allwinner,sun8i-h3-emac",
   - "allwinner,sun8i-v3s-emac":
+
+Additional information regarding generic multiplexer properties can be found
+at Documentation/devicetree/bindings/net/mdio-mux.txt
+
+Required properties of the integrated phy node:
 - clocks: a phandle to the reference clock for the EPHY
 - resets: a phandle to the reset control for the EPHY
+- Must be a child of the integrated mdio
 
-Example:
-
+Example with integrated PHY:
 emac: ethernet@1c0b000 {
compatible = "allwinner,sun8i-h3-emac";
syscon = <>;
@@ -72,13 +91,115 @@ emac: ethernet@1c0b000 {
phy-handle = <_mii_phy>;
phy-mode = "mii";
allwinner,leds-active-low;
+
+   mdio0: mdio {
+   #address-cells = <1>;
+   #size-cells = <0>;
+   compatible = "snps,dwmac-mdio";
+   };
+
+   mdio-mux {
+   compatible = "mdio-mux", "allwinner,sun8i-h3-mdio-mux";
+   #address-cells = <1>;
+   #size-cells = <0>;
+   mdio-parent-bus = <>;
+
+   int_mdio: mdio@1 {
+   compatible = "allwinner,sun8i-h3-mdio-internal";
+   reg = <1>;
+   #address-cells = <1>;
+   #size-cells = <0>;
+   int_mii_phy: ethernet-phy@1 {
+   reg = <1>;
+   clocks = < CLK_BUS_EPHY>;
+   resets = < RST_BUS_EPHY>;
+   phy-is-integrated;
+   };
+   };
+   ext_mdio: mdio@2 {
+   reg = <2>;
+   #address-cells = <1>;
+   #size-cells = <0>;
+   };
+   };
+};
+
+Example with external PHY:
+emac: ethernet@1c0b000 {
+   compatible = "allwinner,sun8i-h3-emac";
+   syscon = <>;
+   reg = <0x01c0b000 0x104>;
+   interrupts = ;
+   interrupt-names = "macirq";
+   resets = < RST_BUS_EMAC>;
+   reset-names = "stmmaceth";
+   clocks = < 

[PATCH v9 07/10] arm64: dts: allwinner: add snps,dwmac-mdio compatible to emac/mdio

[Corentin Labbe]

stmmac bindings docs said that its mdio node must have
compatible = "snps,dwmac-mdio";
Since dwmac-sun8i does not have any good reasons to not doing it, all
their MDIO node must have it.

Signed-off-by: Corentin Labbe 
---
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi 
b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index 0650a1cda107..0a2074f86f2c 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -532,6 +532,7 @@
#size-cells = <0>;
 
mdio: mdio {
+   compatible = "snps,dwmac-mdio";
#address-cells = <1>;
#size-cells = <0>;
};
-- 
2.13.6

[PATCH v9 06/10] arm64: dts: allwinner: Restore EMAC changes

[Corentin Labbe]

The original dwmac-sun8i DT bindings have some issue on how to handle
integrated PHY and was reverted in last RC of 4.13.
But now we have a solution so we need to get back that was reverted.

This patch restore arm64 DT about dwmac-sun8i
This reverts commit 87e1f5e8bb4b ("arm64: dts: allwinner: Revert EMAC changes")

Signed-off-by: Corentin Labbe 
---
 .../boot/dts/allwinner/sun50i-a64-bananapi-m64.dts   | 16 
 .../boot/dts/allwinner/sun50i-a64-pine64-plus.dts| 15 +++
 arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts  | 17 +
 .../dts/allwinner/sun50i-a64-sopine-baseboard.dts| 16 
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi| 20 
 .../boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts | 17 +
 .../boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts| 17 +
 .../boot/dts/allwinner/sun50i-h5-orangepi-prime.dts  | 17 +
 8 files changed, 135 insertions(+)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts 
b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
index d347f52e27f6..45bdbfb96126 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
@@ -51,6 +51,7 @@
compatible = "sinovoip,bananapi-m64", "allwinner,sun50i-a64";
 
aliases {
+   ethernet0 = 
serial0 = 
serial1 = 
};
@@ -69,6 +70,14 @@
status = "okay";
 };
 
+ {
+   pinctrl-names = "default";
+   pinctrl-0 = <_pins>;
+   phy-mode = "rgmii";
+   phy-handle = <_rgmii_phy>;
+   status = "okay";
+};
+
  {
pinctrl-names = "default";
pinctrl-0 = <_pins>;
@@ -79,6 +88,13 @@
bias-pull-up;
 };
 
+ {
+   ext_rgmii_phy: ethernet-phy@1 {
+   compatible = "ethernet-phy-ieee802.3-c22";
+   reg = <1>;
+   };
+};
+
  {
pinctrl-names = "default";
pinctrl-0 = <_pins>;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts 
b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
index f82ccf332c0f..24f1aac366d6 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
@@ -48,3 +48,18 @@
 
/* TODO: Camera, touchscreen, etc. */
 };
+
+ {
+   pinctrl-names = "default";
+   pinctrl-0 = <_pins>;
+   phy-mode = "rgmii";
+   phy-handle = <_rgmii_phy>;
+   status = "okay";
+};
+
+ {
+   ext_rgmii_phy: ethernet-phy@1 {
+   compatible = "ethernet-phy-ieee802.3-c22";
+   reg = <1>;
+   };
+};
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts 
b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
index d06e34b5d192..806442d3e846 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
@@ -51,6 +51,7 @@
compatible = "pine64,pine64", "allwinner,sun50i-a64";
 
aliases {
+   ethernet0 = 
serial0 = 
serial1 = 
serial2 = 
@@ -71,6 +72,15 @@
status = "okay";
 };
 
+ {
+   pinctrl-names = "default";
+   pinctrl-0 = <_pins>;
+   phy-mode = "rmii";
+   phy-handle = <_rmii_phy1>;
+   status = "okay";
+
+};
+
  {
pinctrl-names = "default";
pinctrl-0 = <_pins>;
@@ -81,6 +91,13 @@
bias-pull-up;
 };
 
+ {
+   ext_rmii_phy1: ethernet-phy@1 {
+   compatible = "ethernet-phy-ieee802.3-c22";
+   reg = <1>;
+   };
+};
+
  {
pinctrl-names = "default";
pinctrl-0 = <_pins>;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts 
b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
index 17ccc12b58df..0eb2acedf8c3 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
@@ -53,6 +53,7 @@
 "allwinner,sun50i-a64";
 
aliases {
+   ethernet0 = 
serial0 = 
};
 
@@ -76,6 +77,21 @@
status = "okay";
 };
 
+ {
+   pinctrl-names = "default";
+   pinctrl-0 = <_pins>;
+   phy-mode = "rgmii";
+   phy-handle = <_rgmii_phy>;
+   status = "okay";
+};
+
+ {
+   ext_rgmii_phy: ethernet-phy@1 {
+   compatible = "ethernet-phy-ieee802.3-c22";
+   reg = <1>;
+   };
+};
+
  {
pinctrl-names = "default";
pinctrl-0 = <_pins>;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi 
b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index 905af406dbd3..0650a1cda107 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -517,6 +517,26 @@
#size-cells = <0>;
  

[PATCH v9 04/10] arm: dts: sunxi: h3/h5: represent the mdio switch used by sun8i-h3-emac

[Corentin Labbe]

Since dwmac-sun8i could use either an integrated PHY or an external PHY
(which could be at same MDIO address), we need to represent this selection
by a MDIO switch.

Signed-off-by: Corentin Labbe 
---
 arch/arm/boot/dts/sunxi-h3-h5.dtsi | 32 +++-
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/arch/arm/boot/dts/sunxi-h3-h5.dtsi 
b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
index d762098fc589..0e97df490aba 100644
--- a/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+++ b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
@@ -422,14 +422,36 @@
#size-cells = <0>;
status = "disabled";
 
-   mdio: mdio {
+   mdio0: mdio {
#address-cells = <1>;
#size-cells = <0>;
-   int_mii_phy: ethernet-phy@1 {
-   compatible = 
"ethernet-phy-ieee802.3-c22";
+   compatible = "snps,dwmac-mdio";
+   };
+
+   mdio-mux {
+   compatible = "allwinner,sun8i-h3-mdio-mux";
+   #address-cells = <1>;
+   #size-cells = <0>;
+   mdio-parent-bus = <>;
+   /* Only one MDIO is usable at the time */
+   internal_mdio: mdio@1 {
+   compatible = 
"allwinner,sun8i-h3-mdio-internal";
reg = <1>;
-   clocks = < CLK_BUS_EPHY>;
-   resets = < RST_BUS_EPHY>;
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   int_mii_phy: ethernet-phy@1 {
+   compatible = 
"ethernet-phy-ieee802.3-c22";
+   reg = <1>;
+   clocks = < CLK_BUS_EPHY>;
+   resets = < RST_BUS_EPHY>;
+   };
+   };
+
+   external_mdio: mdio@2 {
+   reg = <2>;
+   #address-cells = <1>;
+   #size-cells = <0>;
};
};
};
-- 
2.13.6

[PATCH v9 08/10] net: stmmac: snps,dwmac-mdio MDIOs are automatically registered

[Corentin Labbe]

stmmac bindings docs said that its mdio node must have
compatible = "snps,dwmac-mdio";
Since dwmac-sun8i does not have any good reasons to not doing it, all
their MDIO node must have it.

Since these compatible is automatically registered, dwmac-sun8i compatible
does not need to be in need_mdio_ids.

Signed-off-by: Corentin Labbe 
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 4 
 1 file changed, 4 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c 
b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 8a280b48e3a9..9e616da0745d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -311,10 +311,6 @@ static int stmmac_dt_phy(struct plat_stmmacenet_data *plat,
bool mdio = true;
static const struct of_device_id need_mdio_ids[] = {
{ .compatible = "snps,dwc-qos-ethernet-4.10" },
-   { .compatible = "allwinner,sun8i-a83t-emac" },
-   { .compatible = "allwinner,sun8i-h3-emac" },
-   { .compatible = "allwinner,sun8i-v3s-emac" },
-   { .compatible = "allwinner,sun50i-a64-emac" },
{},
};
 
-- 
2.13.6

[PATCH v9 10/10] net: stmmac: sun8i: Restore the compatibles

[Corentin Labbe]

The original dwmac-sun8i DT bindings have some issue on how to handle
integrated PHY and was reverted in last RC of 4.13.
But now we have a solution so we need to get back that was reverted.

This patch restore compatibles about dwmac-sun8i
This reverts commit ad4540cc5aa3 ("net: stmmac: sun8i: Remove the compatibles")

Signed-off-by: Corentin Labbe 
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 8 
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c 
b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index b3eb344bb158..e5ff734d4f9b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -1072,6 +1072,14 @@ return ret;
 }
 
 static const struct of_device_id sun8i_dwmac_match[] = {
+   { .compatible = "allwinner,sun8i-h3-emac",
+   .data = _variant_h3 },
+   { .compatible = "allwinner,sun8i-v3s-emac",
+   .data = _variant_v3s },
+   { .compatible = "allwinner,sun8i-a83t-emac",
+   .data = _variant_a83t },
+   { .compatible = "allwinner,sun50i-a64-emac",
+   .data = _variant_a64 },
{ }
 };
 MODULE_DEVICE_TABLE(of, sun8i_dwmac_match);
-- 
2.13.6

[PATCH v9 09/10] net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs

[Corentin Labbe]

The Allwinner H3 SoC have two distinct MDIO bus, only one could be
active at the same time.
The selection of the active MDIO bus are done via some bits in the EMAC
register of the system controller.

This patch implement this MDIO switch via a custom MDIO-mux.

Signed-off-by: Corentin Labbe 
---
 drivers/net/ethernet/stmicro/stmmac/Kconfig   |   1 +
 drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 353 ++
 2 files changed, 224 insertions(+), 130 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig 
b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index 97035766c291..e28c0d2c58e9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -159,6 +159,7 @@ config DWMAC_SUN8I
tristate "Allwinner sun8i GMAC support"
default ARCH_SUNXI
depends on OF && (ARCH_SUNXI || COMPILE_TEST)
+   select MDIO_BUS_MUX
---help---
  Support for Allwinner H3 A83T A64 EMAC ethernet controllers.
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c 
b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index 39c2122a4f26..b3eb344bb158 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -17,6 +17,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -41,14 +42,14 @@
  * This value is used for disabling properly EMAC
  * and used as a good starting value in case of the
  * boot process(uboot) leave some stuff.
- * @internal_phy:  Does the MAC embed an internal PHY
+ * @soc_has_internal_phy:  Does the MAC embed an internal PHY
  * @support_mii:   Does the MAC handle MII
  * @support_rmii:  Does the MAC handle RMII
  * @support_rgmii: Does the MAC handle RGMII
  */
 struct emac_variant {
u32 default_syscon_value;
-   int internal_phy;
+   bool soc_has_internal_phy;
bool support_mii;
bool support_rmii;
bool support_rgmii;
@@ -61,7 +62,8 @@ struct emac_variant {
  * @rst_ephy:  reference to the optional EPHY reset for the internal PHY
  * @variant:   reference to the current board variant
  * @regmap:regmap for using the syscon
- * @use_internal_phy: Does the current PHY choice imply using the internal PHY
+ * @internal_phy_powered: Does the internal PHY is enabled
+ * @mux_handle:Internal pointer used by mdio-mux lib
  */
 struct sunxi_priv_data {
struct clk *tx_clk;
@@ -70,12 +72,13 @@ struct sunxi_priv_data {
struct reset_control *rst_ephy;
const struct emac_variant *variant;
struct regmap *regmap;
-   bool use_internal_phy;
+   bool internal_phy_powered;
+   void *mux_handle;
 };
 
 static const struct emac_variant emac_variant_h3 = {
.default_syscon_value = 0x58000,
-   .internal_phy = PHY_INTERFACE_MODE_MII,
+   .soc_has_internal_phy = true,
.support_mii = true,
.support_rmii = true,
.support_rgmii = true
@@ -83,20 +86,20 @@ static const struct emac_variant emac_variant_h3 = {
 
 static const struct emac_variant emac_variant_v3s = {
.default_syscon_value = 0x38000,
-   .internal_phy = PHY_INTERFACE_MODE_MII,
+   .soc_has_internal_phy = true,
.support_mii = true
 };
 
 static const struct emac_variant emac_variant_a83t = {
.default_syscon_value = 0,
-   .internal_phy = 0,
+   .soc_has_internal_phy = false,
.support_mii = true,
.support_rgmii = true
 };
 
 static const struct emac_variant emac_variant_a64 = {
.default_syscon_value = 0,
-   .internal_phy = 0,
+   .soc_has_internal_phy = false,
.support_mii = true,
.support_rmii = true,
.support_rgmii = true
@@ -195,6 +198,9 @@ static const struct emac_variant emac_variant_a64 = {
 #define H3_EPHY_LED_POLBIT(17) /* 1: active low, 0: active 
high */
 #define H3_EPHY_SHUTDOWN   BIT(16) /* 1: shutdown, 0: power up */
 #define H3_EPHY_SELECT BIT(15) /* 1: internal PHY, 0: external PHY */
+#define H3_EPHY_MUX_MASK   (H3_EPHY_SHUTDOWN | H3_EPHY_SELECT)
+#define DWMAC_SUN8I_MDIO_MUX_INTERNAL_ID   1
+#define DWMAC_SUN8I_MDIO_MUX_EXTERNAL_ID   2
 
 /* H3/A64 specific bits */
 #define SYSCON_RMII_EN BIT(13) /* 1: enable RMII (overrides EPIT) */
@@ -634,6 +640,159 @@ static int sun8i_dwmac_reset(struct stmmac_priv *priv)
return 0;
 }
 
+/* Search in mdio-mux node for internal PHY node and get its clk/reset */
+static int get_ephy_nodes(struct stmmac_priv *priv)
+{
+   struct sunxi_priv_data *gmac = priv->plat->bsp_priv;
+   struct device_node *mdio_mux, *iphynode;
+   struct device_node *mdio_internal;
+   int ret;
+
+   mdio_mux = of_get_child_by_name(priv->device->of_node, "mdio-mux");
+  

[PATCH v9 03/10] arm: dts: sunxi: h3/h5: Restore EMAC changes

[Corentin Labbe]

The original dwmac-sun8i DT bindings have some issue on how to handle
integrated PHY and was reverted in last RC of 4.13.
But now we have a solution so we need to get back that was reverted.

This patch restore sunxi-h3-h5.dtsi
This reverts partially commit fe45174b72ae ("arm: dts: sunxi: Revert EMAC 
changes")

Signed-off-by: Corentin Labbe 
---
 arch/arm/boot/dts/sunxi-h3-h5.dtsi | 26 ++
 1 file changed, 26 insertions(+)

diff --git a/arch/arm/boot/dts/sunxi-h3-h5.dtsi 
b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
index c1bd09dab3da..d762098fc589 100644
--- a/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+++ b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
@@ -408,6 +408,32 @@
clocks = <>;
};
 
+   emac: ethernet@1c3 {
+   compatible = "allwinner,sun8i-h3-emac";
+   syscon = <>;
+   reg = <0x01c3 0x1>;
+   interrupts = ;
+   interrupt-names = "macirq";
+   resets = < RST_BUS_EMAC>;
+   reset-names = "stmmaceth";
+   clocks = < CLK_BUS_EMAC>;
+   clock-names = "stmmaceth";
+   #address-cells = <1>;
+   #size-cells = <0>;
+   status = "disabled";
+
+   mdio: mdio {
+   #address-cells = <1>;
+   #size-cells = <0>;
+   int_mii_phy: ethernet-phy@1 {
+   compatible = 
"ethernet-phy-ieee802.3-c22";
+   reg = <1>;
+   clocks = < CLK_BUS_EPHY>;
+   resets = < RST_BUS_EPHY>;
+   };
+   };
+   };
+
spi0: spi@1c68000 {
compatible = "allwinner,sun8i-h3-spi";
reg = <0x01c68000 0x1000>;
-- 
2.13.6

Re: [PATCH] net: sunrpc: svcauth_gss: use BUG_ON instead of if condition followed by BUG

[J. Bruce Fields]

On Tue, Oct 24, 2017 at 01:26:49PM -0400, Weston Andros Adamson wrote:
> Is there a reason to BUG() in these places? Couldn't we WARN_ON_ONCE and 
> return an error?

I think the BUG() will just kill an nfsd thread that isn't holding any
interesting locks.

The failures look unlikely.  (Except for that read_u32... return, I
wonder if we're missing a check there.)

--b.

> 
> -dros
> 
> > On Oct 23, 2017, at 4:31 PM, J. Bruce Fields  wrote:
> > 
> > In the past we've avoided BUG_ON(X) where X might have side effects, on
> > the theory that it should actually be OK just to compile out BUG_ON()s.
> > Has that changed?
> > 
> > In any case, I don't find that this improves readability; dropping.
> > 
> > --b.
> > 
> > On Mon, Oct 23, 2017 at 01:16:35PM -0500, Gustavo A. R. Silva wrote:
> >> Use BUG_ON instead of if condition followed by BUG.
> >> 
> >> This issue was detected with the help of Coccinelle.
> >> 
> >> Signed-off-by: Gustavo A. R. Silva 
> >> ---
> >> net/sunrpc/auth_gss/svcauth_gss.c | 9 +++--
> >> 1 file changed, 3 insertions(+), 6 deletions(-)
> >> 
> >> diff --git a/net/sunrpc/auth_gss/svcauth_gss.c 
> >> b/net/sunrpc/auth_gss/svcauth_gss.c
> >> index 7b1ee5a..a10ce43 100644
> >> --- a/net/sunrpc/auth_gss/svcauth_gss.c
> >> +++ b/net/sunrpc/auth_gss/svcauth_gss.c
> >> @@ -855,11 +855,9 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct 
> >> xdr_buf *buf, u32 seq, struct g
> >>return stat;
> >>if (integ_len > buf->len)
> >>return stat;
> >> -  if (xdr_buf_subsegment(buf, _buf, 0, integ_len))
> >> -  BUG();
> >> +  BUG_ON(xdr_buf_subsegment(buf, _buf, 0, integ_len));
> >>/* copy out mic... */
> >> -  if (read_u32_from_xdr_buf(buf, integ_len, ))
> >> -  BUG();
> >> +  BUG_ON(read_u32_from_xdr_buf(buf, integ_len, ));
> >>if (mic.len > RPC_MAX_AUTH_SIZE)
> >>return stat;
> >>mic.data = kmalloc(mic.len, GFP_KERNEL);
> >> @@ -1611,8 +1609,7 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
> >>BUG_ON(integ_len % 4);
> >>*p++ = htonl(integ_len);
> >>*p++ = htonl(gc->gc_seq);
> >> -  if (xdr_buf_subsegment(resbuf, _buf, integ_offset, integ_len))
> >> -  BUG();
> >> +  BUG_ON(xdr_buf_subsegment(resbuf, _buf, integ_offset, integ_len));
> >>if (resbuf->tail[0].iov_base == NULL) {
> >>if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE)
> >>goto out_err;
> >> -- 
> >> 2.7.4
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> > the body of a message to majord...@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [5/5] e1000e: Avoid receiver overrun interrupt bursts

[Philip Prindeville]

> On Oct 24, 2017, at 11:20 AM, Lennart Sorensen  
> wrote:
> 
> On Tue, Sep 19, 2017 at 09:41:02PM +0200, Benjamin Poirier wrote:
>> On 2017/09/19 12:38, Philip Prindeville wrote:
>>> Hi.
>>> 
>>> We’ve been running this patchset (all 5) for about as long as they’ve been 
>>> under review… about 2 months.  And in a burn-in lab with heavy traffic.
>>> 
>>> We’ve not seen a single link-flap in hundreds of ours of saturated traffic.
>>> 
>>> Would love to see some resolution soon on this as we don’t want to ship a 
>>> release with unsanctioned patches.
>>> 
>>> Is there an estimate on when that might be?
>> 
>> The patches have been added to Jeff Kirsher's next-queue tree. I guess
>> they will be submitted for v4.15 which might be released in early
>> 2018...
>> http://phb-crystal-ball.org/
> 
> And then they will be submitted to linux-stable so this long standing
> regression can be fixed, right?
> 


Let’s hope!

-Philip

[PATCH v2] ethernet: cavium: octeon: Switch to using netdev_info().

[Steven J. Hill]

Signed-off-by: Steven J. Hill 
Signed-off-by: David Daney 
---
 drivers/net/ethernet/cavium/octeon/octeon_mgmt.c | 27 +++-
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c 
b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
index 2887bca..28e10dc 100644
--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
@@ -705,14 +705,15 @@ static int octeon_mgmt_ioctl_hwtstamp(struct net_device 
*netdev,
u64 clock_comp = (NSEC_PER_SEC << 32) / 
octeon_get_io_clock_rate();
if (!ptp.s.ptp_en)
cvmx_write_csr(CVMX_MIO_PTP_CLOCK_COMP, 
clock_comp);
-   pr_info("PTP Clock: Using sclk reference at %lld Hz\n",
-   (NSEC_PER_SEC << 32) / clock_comp);
+   netdev_info(netdev,
+   "PTP Clock using sclk reference @ %lldHz\n",
+   (NSEC_PER_SEC << 32) / clock_comp);
} else {
/* The clock is already programmed to use a GPIO */
u64 clock_comp = cvmx_read_csr(CVMX_MIO_PTP_CLOCK_COMP);
-   pr_info("PTP Clock: Using GPIO %d at %lld Hz\n",
-   ptp.s.ext_clk_in,
-   (NSEC_PER_SEC << 32) / clock_comp);
+   netdev_info(netdev,
+   "PTP Clock using GPIO%d @ %lld Hz\n",
+   ptp.s.ext_clk_in, (NSEC_PER_SEC << 32) / 
clock_comp);
}
 
/* Enable the clock if it wasn't done already */
@@ -925,16 +926,12 @@ static void octeon_mgmt_adjust_link(struct net_device 
*netdev)
 
spin_unlock_irqrestore(>lock, flags);
 
-   if (link_changed != 0) {
-   if (link_changed > 0) {
-   pr_info("%s: Link is up - %d/%s\n", netdev->name,
-   phydev->speed,
-   phydev->duplex == DUPLEX_FULL ?
-   "Full" : "Half");
-   } else {
-   pr_info("%s: Link is down\n", netdev->name);
-   }
-   }
+   if (link_changed != 0)
+   if (link_changed > 0)
+   netdev_info(netdev, "Link is up - %d/%s\n",
+   phydev->speed, phydev->duplex == 
DUPLEX_FULL ? "Full" : "Half");
+   else
+   netdev_info(netdev, "Link is down\n");
 }
 
 static int octeon_mgmt_init_phy(struct net_device *netdev)
-- 
2.1.4

Re: [PATCH] net: sunrpc: svcauth_gss: use BUG_ON instead of if condition followed by BUG

[Weston Andros Adamson]

Is there a reason to BUG() in these places? Couldn't we WARN_ON_ONCE and return 
an error?

-dros

> On Oct 23, 2017, at 4:31 PM, J. Bruce Fields  wrote:
> 
> In the past we've avoided BUG_ON(X) where X might have side effects, on
> the theory that it should actually be OK just to compile out BUG_ON()s.
> Has that changed?
> 
> In any case, I don't find that this improves readability; dropping.
> 
> --b.
> 
> On Mon, Oct 23, 2017 at 01:16:35PM -0500, Gustavo A. R. Silva wrote:
>> Use BUG_ON instead of if condition followed by BUG.
>> 
>> This issue was detected with the help of Coccinelle.
>> 
>> Signed-off-by: Gustavo A. R. Silva 
>> ---
>> net/sunrpc/auth_gss/svcauth_gss.c | 9 +++--
>> 1 file changed, 3 insertions(+), 6 deletions(-)
>> 
>> diff --git a/net/sunrpc/auth_gss/svcauth_gss.c 
>> b/net/sunrpc/auth_gss/svcauth_gss.c
>> index 7b1ee5a..a10ce43 100644
>> --- a/net/sunrpc/auth_gss/svcauth_gss.c
>> +++ b/net/sunrpc/auth_gss/svcauth_gss.c
>> @@ -855,11 +855,9 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct 
>> xdr_buf *buf, u32 seq, struct g
>>  return stat;
>>  if (integ_len > buf->len)
>>  return stat;
>> -if (xdr_buf_subsegment(buf, _buf, 0, integ_len))
>> -BUG();
>> +BUG_ON(xdr_buf_subsegment(buf, _buf, 0, integ_len));
>>  /* copy out mic... */
>> -if (read_u32_from_xdr_buf(buf, integ_len, ))
>> -BUG();
>> +BUG_ON(read_u32_from_xdr_buf(buf, integ_len, ));
>>  if (mic.len > RPC_MAX_AUTH_SIZE)
>>  return stat;
>>  mic.data = kmalloc(mic.len, GFP_KERNEL);
>> @@ -1611,8 +1609,7 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
>>  BUG_ON(integ_len % 4);
>>  *p++ = htonl(integ_len);
>>  *p++ = htonl(gc->gc_seq);
>> -if (xdr_buf_subsegment(resbuf, _buf, integ_offset, integ_len))
>> -BUG();
>> +BUG_ON(xdr_buf_subsegment(resbuf, _buf, integ_offset, integ_len));
>>  if (resbuf->tail[0].iov_base == NULL) {
>>  if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE)
>>  goto out_err;
>> -- 
>> 2.7.4
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [5/5] e1000e: Avoid receiver overrun interrupt bursts

[Lennart Sorensen]

On Tue, Sep 19, 2017 at 09:41:02PM +0200, Benjamin Poirier wrote:
> On 2017/09/19 12:38, Philip Prindeville wrote:
> > Hi.
> > 
> > We’ve been running this patchset (all 5) for about as long as they’ve been 
> > under review… about 2 months.  And in a burn-in lab with heavy traffic.
> > 
> > We’ve not seen a single link-flap in hundreds of ours of saturated traffic.
> > 
> > Would love to see some resolution soon on this as we don’t want to ship a 
> > release with unsanctioned patches.
> > 
> > Is there an estimate on when that might be?
> 
> The patches have been added to Jeff Kirsher's next-queue tree. I guess
> they will be submitted for v4.15 which might be released in early
> 2018...
> http://phb-crystal-ball.org/

And then they will be submitted to linux-stable so this long standing
regression can be fixed, right?

-- 
Len Sorensen

Re: [patch net-next v2 00/20] net: sched: convert cls ndo_setup_tc offload calls to per-block callbacks

[Nambiar, Amritha]

On 10/24/2017 10:02 AM, Or Gerlitz wrote:
> On Tue, Oct 24, 2017 at 7:24 PM, Alexander Duyck
> > wrote:
> 
> On Tue, Oct 24, 2017 at 9:01 AM, Alexander Duyck
> > wrote:
> 
>  
> 
> > We are getting internal reports of regressions being seen with this
> > patch set applied. Specifically the issues below have been pointed out
> > to me. My understanding is that these issues are all being reported on
> > ixgbe:
> >
> > 1.       To offload filter into HW, the hw-tc-offload feature flag has
> > to be turned on before creating the ingress qdisc.
> 
>  
> 
> > 2.       Deleting the ingress qdisc fails to remove filters added in
> > HW. Filters in SW gets deleted.
> 
> 
> 
> FWIW, I don't think this is what you're hitting, but please note there
> are two  fixes 
> to the series in net-next 
> 
> 9d452ce net/sched: Fix actions list corruption when adding offloaded tc
> flows

It looks like this patch just got applied, this fix wasn't included
during our testing.

> 0843c09 net/sched: Set the net-device for egress device instance

This fix was already in place during our testing. Also, the filters
added were matching on IPv4 addresses with action drop.

> I had to looked on other stuff today, but I will keep stressing see
> if/what is broken w.r.t mlx5 
> and help to get things to work later this and next week so by netdev
> we'll be fine
> 
> Or.
> 
> 

RE: [PATCH net-next 2/2] net: dsa: lan9303: Learn addresses on CPU port when bridged

[Woojung.Huh]

Hi Egil,

> +static inline int lan9303_tx_use_arl(struct dsa_port *dp, u8 *dest_addr)
> +{
> + struct lan9303 *chip = dp->ds->priv;
> +
> + return chip->is_bridged && !ether_addr_equal(dest_addr,
> eth_stp_addr);
> +}
> 
>  static struct sk_buff *lan9303_xmit(struct sk_buff *skb, struct net_device
> *dev)
>  {
> @@ -62,7 +80,10 @@ static struct sk_buff *lan9303_xmit(struct sk_buff *skb,
> struct net_device *dev)
> 
>   lan9303_tag = (u16 *)(skb->data + 2 * ETH_ALEN);
>   lan9303_tag[0] = htons(ETH_P_8021Q);
> - lan9303_tag[1] = htons(dp->index | BIT(4));
> + lan9303_tag[1] = lan9303_tx_use_arl(dp, skb->data) ?

How about using skb_mac_header(skb) than skb->data?

> + LAN9303_TAG_TX_USE_ALR :
> + dp->index |

Thanks.
Woojung

Re: [PATCH] nfp: convert nfp_eth_set_bit_config() into a macro

[Matthias Kaehlcke]

El Tue, Oct 24, 2017 at 10:03:56AM -0700 Jakub Kicinski ha dit:

> On Tue, 24 Oct 2017 09:56:03 -0700, Matthias Kaehlcke wrote:
> > > @@ -561,6 +568,6 @@ int __nfp_eth_set_speed(struct nfp_nsp *nsp, unsigned 
> > > int speed)
> > >   */
> > >  int __nfp_eth_set_split(struct nfp_nsp *nsp, unsigned int lanes)
> > >  {
> > > - return nfp_eth_set_bit_config(nsp, NSP_ETH_RAW_PORT, NSP_ETH_PORT_LANES,
> > > + return NFP_ETH_SET_BIT_CONFIG(nsp, NSP_ETH_RAW_PORT, NSP_ETH_PORT_LANES,
> > > lanes, NSP_ETH_CTRL_SET_LANES);
> > >  }  
> > 
> > Do you plan to send this as an official patch?
> 
> Sorry...  Dirk is prepping a larger series for this area of code and it
> got stuck there a bit :S

No prob, just wanted to make sure it didn't slip under the radar.

>  He says it's coming any day now...

Great, thanks!

Re: general protection fault in __list_del_entry_valid

[Dmitry Vyukov]

On Tue, Oct 24, 2017 at 7:06 PM, Cong Wang  wrote:
> On Tue, Oct 24, 2017 at 8:02 AM, Dmitry Vyukov  wrote:
>> On Tue, Oct 24, 2017 at 4:59 PM, syzbot
>> 
>> wrote:
>>> Hello,
>>>
>>> syzkaller hit the following crash on
>>> aa69ff9e9c32db8aa84835baffea1b70c39e5112
>>> git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master
>>> compiler: gcc (GCC) 7.1.1 20170620
>>> .config is attached
>>> Raw console output is attached.
>>> C reproducer is attached
>>> syzkaller reproducer is attached. See https://goo.gl/kgGztJ
>>> for information about syzkaller reproducers
>>
>> This also happened on more recent commits, including net-next
>> 33ad61d0f799656e8987e9c80e6e15151bb857f3 (Oct 20), with similar
>> signature:
>>
>> general protection fault:  [#1] SMP KASAN
>> Dumping ftrace buffer:
>>(ftrace buffer empty)
>> Modules linked in:
>> CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 4.14.0-rc5+ #89
>> Hardware name: Google Google Compute Engine/Google Compute Engine,
>> BIOS Google 01/01/2011
>> Workqueue: events netlink_sock_destruct_work
>> task: 8801d9f94480 task.stack: 8801d9fa
>> RIP: 0010:__list_del_entry_valid+0x7e/0x150 lib/list_debug.c:51
>> RSP: 0018:8801d9fa70b8 EFLAGS: 00010246
>> RAX: dc00 RBX:  RCX: 
>> RDX:  RSI: 8801cb186b60 RDI: 8801cb186b68
>> RBP: 8801d9fa70d0 R08: 84248f02 R09: 
>> R10: 8801d9fa6f98 R11: 8801ca127a10 R12: 
>> R13: 8801d9fa7198 R14: 8801ca1279f8 R15: 8801cb186b68
>> FS:  () GS:8801db30() knlGS:
>> CS:  0010 DS:  ES:  CR0: 80050033
>> CR2: 2000 CR3: 0001c17a4000 CR4: 001406e0
>> DR0:  DR1:  DR2: 
>> DR3:  DR6: fffe0ff0 DR7: 0400
>> Call Trace:
>>  __list_del_entry include/linux/list.h:116 [inline]
>>  list_del include/linux/list.h:124 [inline]
>>  xfrm_policy_walk_done+0xfa/0x310 net/xfrm/xfrm_policy.c:1048
>>  xfrm_dump_policy_done+0x73/0xa0 net/xfrm/xfrm_user.c:1699
>>  netlink_sock_destruct+0xfa/0x3c0 net/netlink/af_netlink.c:362
>>  __sk_destruct+0xfd/0x910 net/core/sock.c:1560
>>  sk_destruct+0x47/0x80 net/core/sock.c:1595
>>  __sk_free+0x57/0x230 net/core/sock.c:1603
>>  sk_free+0x2a/0x40 net/core/sock.c:1614
>>  netlink_sock_destruct_work+0x19/0x20 net/netlink/af_netlink.c:384
>>  process_one_work+0xbf0/0x1bc0 kernel/workqueue.c:2119
>>  worker_thread+0x223/0x1860 kernel/workqueue.c:2253
>>  kthread+0x35e/0x430 kernel/kthread.c:231
>
> I think this is probably fixed by:

Ah! I guess also syzkaller :)

> [PATCH 2/2] ipsec: Fix aborted xfrm policy dump crash

Can you please follow this part of the guideline? This will greatly
help keeping the overall process working. Thanks!

> syzbot will keep track of this bug report.
> Once a fix for this bug is committed, please reply to this email with:
> #syz fix: exact-commit-title
> Note: all commands must start from beginning of the line.

[PATCH v2] ethernet: cavium: octeon: Switch to using netdev_info().

[Steven J. Hill]

Signed-off-by: Steven J. Hill 
Signed-off-by: David Daney 
---
 drivers/net/ethernet/cavium/octeon/octeon_mgmt.c | 27 +++-
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c 
b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
index 2887bca..28e10dc 100644
--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
@@ -705,14 +705,15 @@ static int octeon_mgmt_ioctl_hwtstamp(struct net_device 
*netdev,
u64 clock_comp = (NSEC_PER_SEC << 32) / 
octeon_get_io_clock_rate();
if (!ptp.s.ptp_en)
cvmx_write_csr(CVMX_MIO_PTP_CLOCK_COMP, 
clock_comp);
-   pr_info("PTP Clock: Using sclk reference at %lld Hz\n",
-   (NSEC_PER_SEC << 32) / clock_comp);
+   netdev_info(netdev,
+   "PTP Clock using sclk reference @ %lldHz\n",
+   (NSEC_PER_SEC << 32) / clock_comp);
} else {
/* The clock is already programmed to use a GPIO */
u64 clock_comp = cvmx_read_csr(CVMX_MIO_PTP_CLOCK_COMP);
-   pr_info("PTP Clock: Using GPIO %d at %lld Hz\n",
-   ptp.s.ext_clk_in,
-   (NSEC_PER_SEC << 32) / clock_comp);
+   netdev_info(netdev,
+   "PTP Clock using GPIO%d @ %lld Hz\n",
+   ptp.s.ext_clk_in, (NSEC_PER_SEC << 32) / 
clock_comp);
}
 
/* Enable the clock if it wasn't done already */
@@ -925,16 +926,12 @@ static void octeon_mgmt_adjust_link(struct net_device 
*netdev)
 
spin_unlock_irqrestore(>lock, flags);
 
-   if (link_changed != 0) {
-   if (link_changed > 0) {
-   pr_info("%s: Link is up - %d/%s\n", netdev->name,
-   phydev->speed,
-   phydev->duplex == DUPLEX_FULL ?
-   "Full" : "Half");
-   } else {
-   pr_info("%s: Link is down\n", netdev->name);
-   }
-   }
+   if (link_changed != 0)
+   if (link_changed > 0)
+   netdev_info(netdev, "Link is up - %d/%s\n",
+   phydev->speed, phydev->duplex == 
DUPLEX_FULL ? "Full" : "Half");
+   else
+   netdev_info(netdev, "Link is down\n");
 }
 
 static int octeon_mgmt_init_phy(struct net_device *netdev)
-- 
2.1.4

Re: general protection fault in __list_del_entry_valid

[Cong Wang]

On Tue, Oct 24, 2017 at 8:02 AM, Dmitry Vyukov  wrote:
> On Tue, Oct 24, 2017 at 4:59 PM, syzbot
> 
> wrote:
>> Hello,
>>
>> syzkaller hit the following crash on
>> aa69ff9e9c32db8aa84835baffea1b70c39e5112
>> git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master
>> compiler: gcc (GCC) 7.1.1 20170620
>> .config is attached
>> Raw console output is attached.
>> C reproducer is attached
>> syzkaller reproducer is attached. See https://goo.gl/kgGztJ
>> for information about syzkaller reproducers
>
> This also happened on more recent commits, including net-next
> 33ad61d0f799656e8987e9c80e6e15151bb857f3 (Oct 20), with similar
> signature:
>
> general protection fault:  [#1] SMP KASAN
> Dumping ftrace buffer:
>(ftrace buffer empty)
> Modules linked in:
> CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 4.14.0-rc5+ #89
> Hardware name: Google Google Compute Engine/Google Compute Engine,
> BIOS Google 01/01/2011
> Workqueue: events netlink_sock_destruct_work
> task: 8801d9f94480 task.stack: 8801d9fa
> RIP: 0010:__list_del_entry_valid+0x7e/0x150 lib/list_debug.c:51
> RSP: 0018:8801d9fa70b8 EFLAGS: 00010246
> RAX: dc00 RBX:  RCX: 
> RDX:  RSI: 8801cb186b60 RDI: 8801cb186b68
> RBP: 8801d9fa70d0 R08: 84248f02 R09: 
> R10: 8801d9fa6f98 R11: 8801ca127a10 R12: 
> R13: 8801d9fa7198 R14: 8801ca1279f8 R15: 8801cb186b68
> FS:  () GS:8801db30() knlGS:
> CS:  0010 DS:  ES:  CR0: 80050033
> CR2: 2000 CR3: 0001c17a4000 CR4: 001406e0
> DR0:  DR1:  DR2: 
> DR3:  DR6: fffe0ff0 DR7: 0400
> Call Trace:
>  __list_del_entry include/linux/list.h:116 [inline]
>  list_del include/linux/list.h:124 [inline]
>  xfrm_policy_walk_done+0xfa/0x310 net/xfrm/xfrm_policy.c:1048
>  xfrm_dump_policy_done+0x73/0xa0 net/xfrm/xfrm_user.c:1699
>  netlink_sock_destruct+0xfa/0x3c0 net/netlink/af_netlink.c:362
>  __sk_destruct+0xfd/0x910 net/core/sock.c:1560
>  sk_destruct+0x47/0x80 net/core/sock.c:1595
>  __sk_free+0x57/0x230 net/core/sock.c:1603
>  sk_free+0x2a/0x40 net/core/sock.c:1614
>  netlink_sock_destruct_work+0x19/0x20 net/netlink/af_netlink.c:384
>  process_one_work+0xbf0/0x1bc0 kernel/workqueue.c:2119
>  worker_thread+0x223/0x1860 kernel/workqueue.c:2253
>  kthread+0x35e/0x430 kernel/kthread.c:231

I think this is probably fixed by:
[PATCH 2/2] ipsec: Fix aborted xfrm policy dump crash