1. 25 Jan, 2020 4 commits
  2. 24 Jan, 2020 14 commits
  3. 23 Jan, 2020 22 commits
    • Finn Thain's avatar
      net/sonic: Prevent tx watchdog timeout · 686f85d7
      Finn Thain authored
      Section 5.5.3.2 of the datasheet says,
      
          If FIFO Underrun, Byte Count Mismatch, Excessive Collision, or
          Excessive Deferral (if enabled) errors occur, transmission ceases.
      
      In this situation, the chip asserts a TXER interrupt rather than TXDN.
      But the handler for the TXDN is the only way that the transmit queue
      gets restarted. Hence, an aborted transmission can result in a watchdog
      timeout.
      
      This problem can be reproduced on congested link, as that can result in
      excessive transmitter collisions. Another way to reproduce this is with
      a FIFO Underrun, which may be caused by DMA latency.
      
      In event of a TXER interrupt, prevent a watchdog timeout by restarting
      transmission.
      
      Fixes: 1da177e4
      
       ("Linux-2.6.12-rc2")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      686f85d7
    • Finn Thain's avatar
      net/sonic: Fix CAM initialization · 772f6642
      Finn Thain authored
      Section 4.3.1 of the datasheet says,
      
          This bit [TXP] must not be set if a Load CAM operation is in
          progress (LCAM is set). The SONIC will lock up if both bits are
          set simultaneously.
      
      Testing has shown that the driver sometimes attempts to set LCAM
      while TXP is set. Avoid this by waiting for command completion
      before and after giving the LCAM command.
      
      After issuing the Load CAM command, poll for !SONIC_CR_LCAM rather than
      SONIC_INT_LCD, because the SONIC_CR_TXP bit can't be used until
      !SONIC_CR_LCAM.
      
      When in reset mode, take the opportunity to reset the CAM Enable
      register.
      
      Fixes: 1da177e4
      
       ("Linux-2.6.12-rc2")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      772f6642
    • Finn Thain's avatar
      net/sonic: Fix command register usage · 27e0c31c
      Finn Thain authored
      There are several issues relating to command register usage during
      chip initialization.
      
      Firstly, the SONIC sometimes comes out of software reset with the
      Start Timer bit set. This gets logged as,
      
          macsonic macsonic eth0: sonic_init: status=24, i=101
      
      Avoid this by giving the Stop Timer command earlier than later.
      
      Secondly, the loop that waits for the Read RRA command to complete has
      the break condition inverted. That's why the for loop iterates until
      its termination condition. Call the helper for this instead.
      
      Finally, give the Receiver Enable command after clearing interrupts,
      not before, to avoid the possibility of losing an interrupt.
      
      Fixes: 1da177e4
      
       ("Linux-2.6.12-rc2")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      27e0c31c
    • Finn Thain's avatar
      net/sonic: Quiesce SONIC before re-initializing descriptor memory · 3f4b7e6a
      Finn Thain authored
      Make sure the SONIC's DMA engine is idle before altering the transmit
      and receive descriptors. Add a helper for this as it will be needed
      again.
      
      Fixes: 1da177e4
      
       ("Linux-2.6.12-rc2")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3f4b7e6a
    • Finn Thain's avatar
      net/sonic: Fix receive buffer replenishment · 89ba879e
      Finn Thain authored
      As soon as the driver is finished with a receive buffer it allocs a new
      one and overwrites the corresponding RRA entry with a new buffer pointer.
      
      Problem is, the buffer pointer is split across two word-sized registers.
      It can't be updated in one atomic store. So this operation races with the
      chip while it stores received packets and advances its RRP register.
      This could result in memory corruption by a DMA write.
      
      Avoid this problem by adding buffers only at the location given by the
      RWP register, in accordance with the National Semiconductor datasheet.
      
      Re-factor this code into separate functions to calculate a RRA pointer
      and to update the RWP.
      
      Fixes: efcce839
      
       ("[PATCH] macsonic/jazzsonic network drivers update")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      89ba879e
    • Finn Thain's avatar
      net/sonic: Improve receive descriptor status flag check · 94b16634
      Finn Thain authored
      After sonic_tx_timeout() calls sonic_init(), it can happen that
      sonic_rx() will subsequently encounter a receive descriptor with no
      flags set. Remove the comment that says that this can't happen.
      
      When giving a receive descriptor to the SONIC, clear the descriptor
      status field. That way, any rx descriptor with flags set can only be
      a newly received packet.
      
      Don't process a descriptor without the LPKT bit set. The buffer is
      still in use by the SONIC.
      
      Fixes: 1da177e4
      
       ("Linux-2.6.12-rc2")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      94b16634
    • Finn Thain's avatar
      net/sonic: Avoid needless receive descriptor EOL flag updates · eaabfd19
      Finn Thain authored
      The while loop in sonic_rx() traverses the rx descriptor ring. It stops
      when it reaches a descriptor that the SONIC has not used. Each iteration
      advances the EOL flag so the SONIC can keep using more descriptors.
      Therefore, the while loop has no definite termination condition.
      
      The algorithm described in the National Semiconductor literature is quite
      different. It consumes descriptors up to the one with its EOL flag set
      (which will also have its "in use" flag set). All freed descriptors are
      then returned to the ring at once, by adjusting the EOL flags (and link
      pointers).
      
      Adopt the algorithm from datasheet as it's simpler, terminates quickly
      and avoids a lot of pointless descriptor EOL flag changes.
      
      Fixes: efcce839
      
       ("[PATCH] macsonic/jazzsonic network drivers update")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eaabfd19
    • Finn Thain's avatar
      net/sonic: Fix receive buffer handling · 9e311820
      Finn Thain authored
      The SONIC can sometimes advance its rx buffer pointer (RRP register)
      without advancing its rx descriptor pointer (CRDA register). As a result
      the index of the current rx descriptor may not equal that of the current
      rx buffer. The driver mistakenly assumes that they are always equal.
      This assumption leads to incorrect packet lengths and possible packet
      duplication. Avoid this by calling a new function to locate the buffer
      corresponding to a given descriptor.
      
      Fixes: efcce839
      
       ("[PATCH] macsonic/jazzsonic network drivers update")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9e311820
    • Finn Thain's avatar
      net/sonic: Fix interface error stats collection · 427db97d
      Finn Thain authored
      The tx_aborted_errors statistic should count packets flagged with EXD,
      EXC, FU, or BCM bits because those bits denote an aborted transmission.
      That corresponds to the bitmask 0x0446, not 0x0642. Use macros for these
      constants to avoid mistakes. Better to leave out FIFO Underruns (FU) as
      there's a separate counter for that purpose.
      
      Don't lump all these errors in with the general tx_errors counter as
      that's used for tx timeout events.
      
      On the rx side, don't count RDE and RBAE interrupts as dropped packets.
      These interrupts don't indicate a lost packet, just a lack of resources.
      When a lack of resources results in a lost packet, this gets reported
      in the rx_missed_errors counter (along with RFO events).
      
      Don't double-count rx_frame_errors and rx_crc_errors.
      
      Don't use the general rx_errors counter for events that already have
      special counters.
      
      Fixes: 1da177e4
      
       ("Linux-2.6.12-rc2")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      427db97d
    • Finn Thain's avatar
      net/sonic: Use MMIO accessors · e3885f57
      Finn Thain authored
      The driver accesses descriptor memory which is simultaneously accessed by
      the chip, so the compiler must not be allowed to re-order CPU accesses.
      sonic_buf_get() used 'volatile' to prevent that. sonic_buf_put() should
      have done so too but was overlooked.
      
      Fixes: efcce839
      
       ("[PATCH] macsonic/jazzsonic network drivers update")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e3885f57
    • Finn Thain's avatar
      net/sonic: Clear interrupt flags immediately · 5fedabf5
      Finn Thain authored
      The chip can change a packet's descriptor status flags at any time.
      However, an active interrupt flag gets cleared rather late. This
      allows a race condition that could theoretically lose an interrupt.
      Fix this by clearing asserted interrupt flags immediately.
      
      Fixes: efcce839
      
       ("[PATCH] macsonic/jazzsonic network drivers update")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5fedabf5
    • Finn Thain's avatar
      net/sonic: Add mutual exclusion for accessing shared state · 865ad2f2
      Finn Thain authored
      The netif_stop_queue() call in sonic_send_packet() races with the
      netif_wake_queue() call in sonic_interrupt(). This causes issues
      like "NETDEV WATCHDOG: eth0 (macsonic): transmit queue 0 timed out".
      Fix this by disabling interrupts when accessing tx_skb[] and next_tx.
      Update a comment to clarify the synchronization properties.
      
      Fixes: efcce839
      
       ("[PATCH] macsonic/jazzsonic network drivers update")
      Tested-by: default avatarStan Johnson <userm57@yahoo.com>
      Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      865ad2f2
    • Madalin Bucur's avatar
      net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G · 457bfc0a
      Madalin Bucur authored
      
      
      As the only 10G PHY interface type defined at the moment the code
      was developed was XGMII, although the PHY interface mode used was
      not XGMII, XGMII was used in the code to denote 10G. This patch
      renames the 10G interface mode to remove the ambiguity.
      
      Signed-off-by: default avatarMadalin Bucur <madalin.bucur@oss.nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      457bfc0a
    • Madalin Bucur's avatar
      net/fsl: treat fsl,erratum-a011043 · 1d3ca681
      Madalin Bucur authored
      
      
      When fsl,erratum-a011043 is set, adjust for erratum A011043:
      MDIO reads to internal PCS registers may result in having
      the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no
      error and read data (MDIO_DATA[MDIO_DATA]) is correct.
      Software may get false read error when reading internal
      PCS registers through MDIO. As a workaround, all internal
      MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
      
      Signed-off-by: default avatarMadalin Bucur <madalin.bucur@oss.nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1d3ca681
    • Manish Chopra's avatar
      qlcnic: Fix CPU soft lockup while collecting firmware dump · 22e98449
      Manish Chopra authored
      
      
      Driver while collecting firmware dump takes longer time to
      collect/process some of the firmware dump entries/memories.
      Bigger capture masks makes it worse as it results in larger
      amount of data being collected and results in CPU soft lockup.
      Place cond_resched() in some of the driver flows that are
      expectedly time consuming to relinquish the CPU to avoid CPU
      soft lockup panic.
      
      Signed-off-by: default avatarShahed Shaikh <shshaikh@marvell.com>
      Tested-by: default avatarYonggen Xu <Yonggen.Xu@dell.com>
      Signed-off-by: default avatarManish Chopra <manishc@marvell.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      22e98449
    • Alex Deucher's avatar
      drm/amdgpu: remove the experimental flag for renoir · 23fe1390
      Alex Deucher authored
      
      
      Should work properly with the latest sbios on 5.5 and newer
      kernels.
      
      Reviewed-by: default avatarHawking Zhang <Hawking.Zhang@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      23fe1390
    • Eric Dumazet's avatar
      tun: add mutex_unlock() call and napi.skb clearing in tun_get_user() · 1efba987
      Eric Dumazet authored
      If both IFF_NAPI_FRAGS mode and XDP are enabled, and the XDP program
      consumes the skb, we need to clear the napi.skb (or risk
      a use-after-free) and release the mutex (or risk a deadlock)
      
      WARNING: lock held when returning to user space!
      5.5.0-rc6-syzkaller #0 Not tainted
      ------------------------------------------------
      syz-executor.0/455 is leaving the kernel with locks still held!
      1 lock held by syz-executor.0/455:
       #0: ffff888098f6e748 (&tfile->napi_mutex){+.+.}, at: tun_get_user+0x1604/0x3fc0 drivers/net/tun.c:1835
      
      Fixes: 90e33d45
      
       ("tun: enable napi_gro_frags() for TUN/TAP driver")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Cc: Petar Penkov <ppenkov@google.com>
      Cc: Willem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1efba987
    • Ido Schimmel's avatar
      mlxsw: spectrum_acl: Fix use-after-free during reload · 971de2e5
      Ido Schimmel authored
      During reload (or module unload), the router block is de-initialized.
      Among other things, this results in the removal of a default multicast
      route from each active virtual router (VRF). These default routes are
      configured during initialization to trap packets to the CPU. In
      Spectrum-2, unlike Spectrum-1, multicast routes are implemented using
      ACL rules.
      
      Since the router block is de-initialized before the ACL block, it is
      possible that the ACL rules corresponding to the default routes are
      deleted while being accessed by the ACL delayed work that queries rules'
      activity from the device. This can result in a rare use-after-free [1].
      
      Fix this by protecting the rules list accessed by the delayed work with
      a lock. We cannot use a spinlock as the activity read operation is
      blocking.
      
      [1]
      [  123.331662] ==================================================================
      [  123.339920] BUG: KASAN: use-after-free in mlxsw_sp_acl_rule_activity_update_work+0x330/0x3b0
      [  123.349381] Read of size 8 at addr ffff8881f3bb4520 by task kworker/0:2/78
      [  123.357080]
      [  123.358773] CPU: 0 PID: 78 Comm: kworker/0:2 Not tainted 5.5.0-rc5-custom-33108-gf5df95d3ef41 #2209
      [  123.368898] Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018
      [  123.378456] Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work
      [  123.385970] Call Trace:
      [  123.388734]  dump_stack+0xc6/0x11e
      [  123.392568]  print_address_description.constprop.4+0x21/0x340
      [  123.403236]  __kasan_report.cold.8+0x76/0xb1
      [  123.414884]  kasan_report+0xe/0x20
      [  123.418716]  mlxsw_sp_acl_rule_activity_update_work+0x330/0x3b0
      [  123.444034]  process_one_work+0xb06/0x19a0
      [  123.453731]  worker_thread+0x91/0xe90
      [  123.467348]  kthread+0x348/0x410
      [  123.476847]  ret_from_fork+0x24/0x30
      [  123.480863]
      [  123.482545] Allocated by task 73:
      [  123.486273]  save_stack+0x19/0x80
      [  123.490000]  __kasan_kmalloc.constprop.6+0xc1/0xd0
      [  123.495379]  mlxsw_sp_acl_rule_create+0xa7/0x230
      [  123.500566]  mlxsw_sp2_mr_tcam_route_create+0xf6/0x3e0
      [  123.506334]  mlxsw_sp_mr_tcam_route_create+0x5b4/0x820
      [  123.512102]  mlxsw_sp_mr_table_create+0x3b5/0x690
      [  123.517389]  mlxsw_sp_vr_get+0x289/0x4d0
      [  123.521797]  mlxsw_sp_fib_node_get+0xa2/0x990
      [  123.526692]  mlxsw_sp_router_fib4_event_work+0x54c/0x2d60
      [  123.532752]  process_one_work+0xb06/0x19a0
      [  123.537352]  worker_thread+0x91/0xe90
      [  123.541471]  kthread+0x348/0x410
      [  123.545103]  ret_from_fork+0x24/0x30
      [  123.549113]
      [  123.550795] Freed by task 518:
      [  123.554231]  save_stack+0x19/0x80
      [  123.557958]  __kasan_slab_free+0x125/0x170
      [  123.562556]  kfree+0xd7/0x3a0
      [  123.565895]  mlxsw_sp_acl_rule_destroy+0x63/0xd0
      [  123.571081]  mlxsw_sp2_mr_tcam_route_destroy+0xd5/0x130
      [  123.576946]  mlxsw_sp_mr_tcam_route_destroy+0xba/0x260
      [  123.582714]  mlxsw_sp_mr_table_destroy+0x1ab/0x290
      [  123.588091]  mlxsw_sp_vr_put+0x1db/0x350
      [  123.592496]  mlxsw_sp_fib_node_put+0x298/0x4c0
      [  123.597486]  mlxsw_sp_vr_fib_flush+0x15b/0x360
      [  123.602476]  mlxsw_sp_router_fib_flush+0xba/0x470
      [  123.607756]  mlxsw_sp_vrs_fini+0xaa/0x120
      [  123.612260]  mlxsw_sp_router_fini+0x137/0x384
      [  123.617152]  mlxsw_sp_fini+0x30a/0x4a0
      [  123.621374]  mlxsw_core_bus_device_unregister+0x159/0x600
      [  123.627435]  mlxsw_devlink_core_bus_device_reload_down+0x7e/0xb0
      [  123.634176]  devlink_reload+0xb4/0x380
      [  123.638391]  devlink_nl_cmd_reload+0x610/0x700
      [  123.643382]  genl_rcv_msg+0x6a8/0xdc0
      [  123.647497]  netlink_rcv_skb+0x134/0x3a0
      [  123.651904]  genl_rcv+0x29/0x40
      [  123.655436]  netlink_unicast+0x4d4/0x700
      [  123.659843]  netlink_sendmsg+0x7c0/0xc70
      [  123.664251]  __sys_sendto+0x265/0x3c0
      [  123.668367]  __x64_sys_sendto+0xe2/0x1b0
      [  123.672773]  do_syscall_64+0xa0/0x530
      [  123.676892]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  123.682552]
      [  123.684238] The buggy address belongs to the object at ffff8881f3bb4500
      [  123.684238]  which belongs to the cache kmalloc-128 of size 128
      [  123.698261] The buggy address is located 32 bytes inside of
      [  123.698261]  128-byte region [ffff8881f3bb4500, ffff8881f3bb4580)
      [  123.711303] The buggy address belongs to the page:
      [  123.716682] page:ffffea0007ceed00 refcount:1 mapcount:0 mapping:ffff888236403500 index:0x0
      [  123.725958] raw: 0200000000000200 dead000000000100 dead000000000122 ffff888236403500
      [  123.734646] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
      [  123.743315] page dumped because: kasan: bad access detected
      [  123.749562]
      [  123.751241] Memory state around the buggy address:
      [  123.756620]  ffff8881f3bb4400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  123.764716]  ffff8881f3bb4480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  123.772812] >ffff8881f3bb4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  123.780904]                                ^
      [  123.785697]  ffff8881f3bb4580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  123.793793]  ffff8881f3bb4600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  123.801883] ==================================================================
      
      Fixes: cf7221a4
      
       ("mlxsw: spectrum_router: Add Multicast routing support for Spectrum-2")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      971de2e5
    • Hayes Wang's avatar
      r8152: disable DelayPhyPwrChg · aa475d93
      Hayes Wang authored
      
      
      When enabling this, the device would wait an internal signal which
      wouldn't be triggered. Then, the device couldn't enter P3 mode, so
      the power consumption is increased.
      
      Signed-off-by: default avatarHayes Wang <hayeswang@realtek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      aa475d93
    • Hayes Wang's avatar
      r8152: avoid the MCU to clear the lanwake · 19813162
      Hayes Wang authored
      
      
      Avoid the MCU to clear the lanwake after suspending. It may cause the
      WOL fail. Disable LANWAKE_CLR_EN before suspending. Besides,enable it
      and reset the lanwake status when resuming or initializing.
      
      Signed-off-by: default avatarHayes Wang <hayeswang@realtek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      19813162
    • Hayes Wang's avatar
      r8152: don't enable U1U2 with USB_SPEED_HIGH for RTL8153B · a0246daf
      Hayes Wang authored
      
      
      For certain platforms, it causes USB reset periodically.
      
      Signed-off-by: default avatarHayes Wang <hayeswang@realtek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a0246daf
    • Hayes Wang's avatar
      r8152: disable test IO for RTL8153B · d7f1b596
      Hayes Wang authored
      
      
      For RTL8153B with QFN32, disable test IO. Otherwise, it may cause
      abnormal behavior for the device randomly.
      
      Signed-off-by: default avatarHayes Wang <hayeswang@realtek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d7f1b596