]> Git Repo - linux.git/log
linux.git
7 years agobpf: Fix tcp_cong_kern.c sample program
Lawrence Brakmo [Sat, 11 Nov 2017 06:19:53 +0000 (22:19 -0800)]
bpf: Fix tcp_cong_kern.c sample program

The program was returning -1 in some cases which is not allowed
by the verifier any longer.

Fixes: 390ee7e29fc8 ("bpf: enforce return code for cgroup-bpf programs")
Signed-off-by: Lawrence Brakmo <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agobpf: Fix tcp_bufs_kern.c sample program
Lawrence Brakmo [Sat, 11 Nov 2017 06:19:52 +0000 (22:19 -0800)]
bpf: Fix tcp_bufs_kern.c sample program

The program was returning -1 in some cases which is not allowed
by the verifier any longer.

Fixes: 390ee7e29fc8 ("bpf: enforce return code for cgroup-bpf programs")
Signed-off-by: Lawrence Brakmo <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agobpf: Fix tcp_rwnd_kern.c sample program
Lawrence Brakmo [Sat, 11 Nov 2017 06:19:51 +0000 (22:19 -0800)]
bpf: Fix tcp_rwnd_kern.c sample program

The program was returning -1 in some cases which is not allowed
by the verifier any longer.

Fixes: 390ee7e29fc8 ("bpf: enforce return code for cgroup-bpf programs")
Signed-off-by: Lawrence Brakmo <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agobpf: Fix tcp_synrto_kern.c sample program
Lawrence Brakmo [Sat, 11 Nov 2017 06:19:50 +0000 (22:19 -0800)]
bpf: Fix tcp_synrto_kern.c sample program

The program was returning -1 in some cases which is not allowed
by the verifier any longer.

Fixes: 390ee7e29fc8 ("bpf: enforce return code for cgroup-bpf programs")
Signed-off-by: Lawrence Brakmo <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: dsa: return after vlan prepare phase
Vivien Didelot [Wed, 8 Nov 2017 15:50:10 +0000 (10:50 -0500)]
net: dsa: return after vlan prepare phase

The current code does not return after successfully preparing the VLAN
addition on every ports member of a it. Fix this.

Fixes: 1ca4aa9cd4cc ("net: dsa: check VLAN capability of every switch")
Signed-off-by: Vivien Didelot <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: dsa: return after mdb prepare phase
Vivien Didelot [Wed, 8 Nov 2017 15:49:56 +0000 (10:49 -0500)]
net: dsa: return after mdb prepare phase

The current code does not return after successfully preparing the MDB
addition on every ports member of a multicast group. Fix this.

Fixes: a1a6b7ea7f2d ("net: dsa: add cross-chip multicast support")
Reported-by: Egil Hjelmeland <[email protected]>
Signed-off-by: Vivien Didelot <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agotipc: improve link resiliency when rps is activated
Jon Maloy [Wed, 8 Nov 2017 08:59:26 +0000 (09:59 +0100)]
tipc: improve link resiliency when rps is activated

Currently, the TIPC RPS dissector is based only on the incoming packets'
source node address, hence steering all traffic from a node to the same
core. We have seen that this makes the links vulnerable to starvation
and unnecessary resets when we turn down the link tolerance to very low
values.

To reduce the risk of this happening, we exempt probe and probe replies
packets from the convergence to one core per source node. Instead, we do
the opposite, - we try to diverge those packets across as many cores as
possible, by randomizing the flow selector key.

To make such packets identifiable to the dissector, we add a new
'is_keepalive' bit to word 0 of the LINK_PROTOCOL header. This bit is
set both for PROBE and PROBE_REPLY messages, and only for those.

It should be noted that these packets are not part of any flow anyway,
and only constitute a minuscule fraction of all packets sent across a
link. Hence, there is no risk that this will affect overall performance.

Acked-by: Ying Xue <[email protected]>
Signed-off-by: Jon Maloy <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agoMerge branch 'macb-next'
David S. Miller [Sat, 11 Nov 2017 06:27:45 +0000 (15:27 +0900)]
Merge branch 'macb-next'

Michael Grzeschik says:

====================
net: macb: add error handling on probe and

This series adds more error handling to the macb driver.
====================

Signed-off-by: David S. Miller <[email protected]>
7 years agonet: macb: add of_node_put to error paths
Michael Grzeschik [Wed, 8 Nov 2017 08:56:35 +0000 (09:56 +0100)]
net: macb: add of_node_put to error paths

We add the call of_node_put(bp->phy_node) to all associated error
paths for memory clean up.

Signed-off-by: Michael Grzeschik <[email protected]>
Acked-by: Nicolas Ferre <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: macb: add of_phy_deregister_fixed_link to error paths
Michael Grzeschik [Wed, 8 Nov 2017 08:56:34 +0000 (09:56 +0100)]
net: macb: add of_phy_deregister_fixed_link to error paths

We add the call of_phy_deregister_fixed_link to all associated
error paths for memory clean up.

Signed-off-by: Michael Grzeschik <[email protected]>
Acked-by: Nicolas Ferre <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: mvpp2: fix GOP statistics loop start and stop conditions
Miquel Raynal [Wed, 8 Nov 2017 07:59:40 +0000 (08:59 +0100)]
net: mvpp2: fix GOP statistics loop start and stop conditions

GOP statistics from all ports of one instance of the driver are gathered
with one work recalled in loop in a workqueue. The loop is started when
a port is up, and stopped when a port is down. This last condition is
obviously wrong.

Fix this by having a work per port. This way, starting and stoping it
when the port is up or down will be fine, while minimizing unnecessary
CPU usage.

Fixes: 118d6298f6f0 ("net: mvpp2: add ethtool GOP statistics")
Reported-by: Stefan Chulski <[email protected]>
Signed-off-by: Miquel Raynal <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agoMerge branch 'hns3-bug-fixes'
David S. Miller [Sat, 11 Nov 2017 06:17:56 +0000 (15:17 +0900)]
Merge branch 'hns3-bug-fixes'

Lipeng says:

====================
net: hns3: Bug fixes & Code improvements in HNS3 driver

This patch-set introduces some bug fixes and code improvements.
As [patch 1/2] depends on the patch {5392902 net: hns3: Consistently using
GENMASK in hns3 driver}, which exists in net-next, not exists in net, so
push this serise to nex-next.
====================

Signed-off-by: David S. Miller <[email protected]>
7 years agonet: hns3: cleanup mac auto-negotiation state query in hclge_update_speed_duplex
Fuyun Liang [Wed, 8 Nov 2017 07:52:23 +0000 (15:52 +0800)]
net: hns3: cleanup mac auto-negotiation state query in hclge_update_speed_duplex

When checking whether auto-negotiation is on, driver only needs to
check the value of mac.autoneg(SW) directly, and does not need to
query it from hardware. Because this value is always synchronized
with the auto-negotiation state of hardware.

This patch removes mac auto-negotiation state query in
hclge_update_speed_duplex().

Fixes: 46a3df9f9718 (net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support)
Signed-off-by: Fuyun Liang <[email protected]>
Signed-off-by: Lipeng <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: hns3: fix a bug when getting phy address from NCL_config file
Fuyun Liang [Wed, 8 Nov 2017 07:52:22 +0000 (15:52 +0800)]
net: hns3: fix a bug when getting phy address from NCL_config file

Driver gets phy address from NCL_config file and uses the phy address
to initialize phydev. There are 5 bits for phy address. And C22 phy
address has 5 bits. So 0-31 are all valid address for phy. If there
is no phy, it will crash. Because driver always get a valid phy address.

This patch fixes the phy address to 8 bits, and use 0xff to indicate
invalid phy address.

Fixes: 46a3df9f9718 (net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support)
Signed-off-by: Fuyun Liang <[email protected]>
Signed-off-by: Lipeng <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: netlink: Update attr validation to require exact length for some types
David Ahern [Wed, 8 Nov 2017 05:59:40 +0000 (21:59 -0800)]
net: netlink: Update attr validation to require exact length for some types

Attributes using NLA_U* and NLA_S* (where * is 8, 16,32 and 64) are
expected to be an exact length. Split these data types from
nla_attr_minlen into nla_attr_len and update validate_nla to require
the attribute to have exact length for them.

Signed-off-by: David Ahern <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: ipv6: sysctl to specify IPv6 ND traffic class
Maciej Żenczykowski [Wed, 8 Nov 2017 05:52:09 +0000 (21:52 -0800)]
net: ipv6: sysctl to specify IPv6 ND traffic class

Add a per-device sysctl to specify the default traffic class to use for
kernel originated IPv6 Neighbour Discovery packets.

Currently this includes:

  - Router Solicitation (ICMPv6 type 133)
    ndisc_send_rs() -> ndisc_send_skb() -> ip6_nd_hdr()

  - Neighbour Solicitation (ICMPv6 type 135)
    ndisc_send_ns() -> ndisc_send_skb() -> ip6_nd_hdr()

  - Neighbour Advertisement (ICMPv6 type 136)
    ndisc_send_na() -> ndisc_send_skb() -> ip6_nd_hdr()

  - Redirect (ICMPv6 type 137)
    ndisc_send_redirect() -> ndisc_send_skb() -> ip6_nd_hdr()

and if the kernel ever gets around to generating RA's,
it would presumably also include:

  - Router Advertisement (ICMPv6 type 134)
    (radvd daemon could pick up on the kernel setting and use it)

Interface drivers may examine the Traffic Class value and translate
the DiffServ Code Point into a link-layer appropriate traffic
prioritization scheme.  An example of mapping IETF DSCP values to
IEEE 802.11 User Priority values can be found here:

    https://tools.ietf.org/html/draft-ietf-tsvwg-ieee-802-11

The expected primary use case is to properly prioritize ND over wifi.

Testing:
  jzem22:~# cat /proc/sys/net/ipv6/conf/eth0/ndisc_tclass
  0
  jzem22:~# echo -1 > /proc/sys/net/ipv6/conf/eth0/ndisc_tclass
  -bash: echo: write error: Invalid argument
  jzem22:~# echo 256 > /proc/sys/net/ipv6/conf/eth0/ndisc_tclass
  -bash: echo: write error: Invalid argument
  jzem22:~# echo 0 > /proc/sys/net/ipv6/conf/eth0/ndisc_tclass
  jzem22:~# echo 255 > /proc/sys/net/ipv6/conf/eth0/ndisc_tclass
  jzem22:~# cat /proc/sys/net/ipv6/conf/eth0/ndisc_tclass
  255
  jzem22:~# echo 34 > /proc/sys/net/ipv6/conf/eth0/ndisc_tclass
  jzem22:~# cat /proc/sys/net/ipv6/conf/eth0/ndisc_tclass
  34

  jzem22:~# echo $[0xDC] > /proc/sys/net/ipv6/conf/eth0/ndisc_tclass
  jzem22:~# tcpdump -v -i eth0 icmp6 and src host jzem22.pgc and dst host fe80::1
  tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
  IP6 (class 0xdc, hlim 255, next-header ICMPv6 (58) payload length: 24)
  jzem22.pgc > fe80::1: [icmp6 sum ok] ICMP6, neighbor advertisement,
  length 24, tgt is jzem22.pgc, Flags [solicited]

(based on original change written by Erik Kline, with minor changes)

v2: fix 'suspicious rcu_dereference_check() usage'
    by explicitly grabbing the rcu_read_lock.

Cc: Lorenzo Colitti <[email protected]>
Signed-off-by: Erik Kline <[email protected]>
Signed-off-by: Maciej Żenczykowski <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet/ncsi: Don't return error on normal response
Samuel Mendoza-Jonas [Wed, 8 Nov 2017 05:30:45 +0000 (16:30 +1100)]
net/ncsi: Don't return error on normal response

Several response handlers return EBUSY if the data corresponding to the
command/response pair is already set. There is no reason to return an
error here; the channel is advertising something as enabled because we
told it to enable it, and it's possible that the feature has been
enabled previously.

Signed-off-by: Samuel Mendoza-Jonas <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet/ncsi: Improve general state logging
Samuel Mendoza-Jonas [Wed, 8 Nov 2017 05:30:44 +0000 (16:30 +1100)]
net/ncsi: Improve general state logging

The NCSI driver is mostly silent which becomes a headache when trying to
determine what has occurred on the NCSI connection. This adds additional
logging in a few key areas such as state transitions and calling out
certain errors more visibly.

Signed-off-by: Samuel Mendoza-Jonas <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agoMerge branch 'bpftool-show-filenames-of-pinned-objects'
David S. Miller [Sat, 11 Nov 2017 03:35:49 +0000 (12:35 +0900)]
Merge branch 'bpftool-show-filenames-of-pinned-objects'

Prashant Bhole says:

====================
tools: bpftool: show filenames of pinned objects

This patchset adds support to show pinned objects in object details.

Patch1 adds a funtionality to open a path in bpf-fs regardless of its object
type.

Patch2 adds actual functionality by scanning the bpf-fs once and adding
object information in hash table, with object id as a key. One object may be
associated with multiple paths because an object can be pinned multiple times

Patch3 adds command line option to enable this functionality. Making it optional
because scanning bpf-fs can be costly.
====================

Acked-by: Jakub Kicinski <[email protected]>
7 years agotools: bpftool: optionally show filenames of pinned objects
Prashant Bhole [Wed, 8 Nov 2017 04:55:49 +0000 (13:55 +0900)]
tools: bpftool: optionally show filenames of pinned objects

Making it optional to show file names of pinned objects because
it scans complete bpf-fs filesystem which is costly.
Added option -f|--bpffs. Documentation updated.

Signed-off-by: Prashant Bhole <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agotools: bpftool: show filenames of pinned objects
Prashant Bhole [Wed, 8 Nov 2017 04:55:48 +0000 (13:55 +0900)]
tools: bpftool: show filenames of pinned objects

Added support to show filenames of pinned objects.

For example:

root@test# ./bpftool prog
3: tracepoint  name tracepoint__irq  tag f677a7dd722299a3
    loaded_at Oct 26/11:39  uid 0
    xlated 160B  not jited  memlock 4096B  map_ids 4
    pinned /sys/fs/bpf/softirq_prog

4: tracepoint  name tracepoint__irq  tag ea5dc530d00b92b6
    loaded_at Oct 26/11:39  uid 0
    xlated 392B  not jited  memlock 4096B  map_ids 4,6

root@test# ./bpftool --json --pretty prog
[{
        "id": 3,
        "type": "tracepoint",
        "name": "tracepoint__irq",
        "tag": "f677a7dd722299a3",
        "loaded_at": "Oct 26/11:39",
        "uid": 0,
        "bytes_xlated": 160,
        "jited": false,
        "bytes_memlock": 4096,
        "map_ids": [4
        ],
        "pinned": ["/sys/fs/bpf/softirq_prog"
        ]
    },{
        "id": 4,
        "type": "tracepoint",
        "name": "tracepoint__irq",
        "tag": "ea5dc530d00b92b6",
        "loaded_at": "Oct 26/11:39",
        "uid": 0,
        "bytes_xlated": 392,
        "jited": false,
        "bytes_memlock": 4096,
        "map_ids": [4,6
        ],
        "pinned": []
    }
]

root@test# ./bpftool map
4: hash  name start  flags 0x0
    key 4B  value 16B  max_entries 10240  memlock 1003520B
    pinned /sys/fs/bpf/softirq_map1
5: hash  name iptr  flags 0x0
    key 4B  value 8B  max_entries 10240  memlock 921600B

root@test# ./bpftool --json --pretty map
[{
        "id": 4,
        "type": "hash",
        "name": "start",
        "flags": 0,
        "bytes_key": 4,
        "bytes_value": 16,
        "max_entries": 10240,
        "bytes_memlock": 1003520,
        "pinned": ["/sys/fs/bpf/softirq_map1"
        ]
    },{
        "id": 5,
        "type": "hash",
        "name": "iptr",
        "flags": 0,
        "bytes_key": 4,
        "bytes_value": 8,
        "max_entries": 10240,
        "bytes_memlock": 921600,
        "pinned": []
    }
]

Signed-off-by: Prashant Bhole <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agotools: bpftool: open pinned object without type check
Prashant Bhole [Wed, 8 Nov 2017 04:55:47 +0000 (13:55 +0900)]
tools: bpftool: open pinned object without type check

This was needed for opening any file in bpf-fs without knowing
its object type

Signed-off-by: Prashant Bhole <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agoMerge branch 'BPF-directed-error-injection'
David S. Miller [Sat, 11 Nov 2017 03:18:06 +0000 (12:18 +0900)]
Merge branch 'BPF-directed-error-injection'

Josef Bacik says:

====================
Add the ability to do BPF directed error injection

I'm sending this through Dave since it'll conflict with other BPF changes in his
tree, but since it touches tracing as well Dave would like a review from
somebody on the tracing side.

v4->v5:
- disallow kprobe_override programs from being put in the prog map array so we
  don't tail call into something we didn't check.  This allows us to make the
  normal path still fast without a bunch of percpu operations.

v3->v4:
- fix a build error found by kbuild test bot (I didn't wait long enough
  apparently.)
- Added a warning message as per Daniels suggestion.

v2->v3:
- added a ->kprobe_override flag to bpf_prog.
- added some sanity checks to disallow attaching bpf progs that have
  ->kprobe_override set that aren't for ftrace kprobes.
- added the trace_kprobe_ftrace helper to check if the trace_event_call is a
  ftrace kprobe.
- renamed bpf_kprobe_state to bpf_kprobe_override, fixed it so we only read this
  value in the kprobe path, and thus only write to it if we're overriding or
  clearing the override.

v1->v2:
- moved things around to make sure that bpf_override_return could really only be
  used for an ftrace kprobe.
- killed the special return values from trace_call_bpf.
- renamed pc_modified to bpf_kprobe_state so bpf_override_return could tell if
  it was being called from an ftrace kprobe context.
- reworked the logic in kprobe_perf_func to take advantage of bpf_kprobe_state.
- updated the test as per Alexei's review.

- Original message -

A lot of our error paths are not well tested because we have no good way of
injecting errors generically.  Some subystems (block, memory) have ways to
inject errors, but they are random so it's hard to get reproduceable results.

With BPF we can add determinism to our error injection.  We can use kprobes and
other things to verify we are injecting errors at the exact case we are trying
to test.  This patch gives us the tool to actual do the error injection part.
It is very simple, we just set the return value of the pt_regs we're given to
whatever we provide, and then override the PC with a dummy function that simply
returns.

Right now this only works on x86, but it would be simple enough to expand to
other architectures.  Thanks,
====================

Signed-off-by: David S. Miller <[email protected]>
7 years agosamples/bpf: add a test for bpf_override_return
Josef Bacik [Tue, 7 Nov 2017 20:28:43 +0000 (15:28 -0500)]
samples/bpf: add a test for bpf_override_return

This adds a basic test for bpf_override_return to verify it works.  We
override the main function for mounting a btrfs fs so it'll return
-ENOMEM and then make sure that trying to mount a btrfs fs will fail.

Acked-by: Alexei Starovoitov <[email protected]>
Signed-off-by: Josef Bacik <[email protected]>
Acked-by: Daniel Borkmann <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agobpf: add a bpf_override_function helper
Josef Bacik [Tue, 7 Nov 2017 20:28:42 +0000 (15:28 -0500)]
bpf: add a bpf_override_function helper

Error injection is sloppy and very ad-hoc.  BPF could fill this niche
perfectly with it's kprobe functionality.  We could make sure errors are
only triggered in specific call chains that we care about with very
specific situations.  Accomplish this with the bpf_override_funciton
helper.  This will modify the probe'd callers return value to the
specified value and set the PC to an override function that simply
returns, bypassing the originally probed function.  This gives us a nice
clean way to implement systematic error injection for all of our code
paths.

Acked-by: Alexei Starovoitov <[email protected]>
Signed-off-by: Josef Bacik <[email protected]>
Acked-by: Daniel Borkmann <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agobrcmfmac: add CLM download support
Chung-Hsien Hsu [Fri, 10 Nov 2017 09:27:15 +0000 (17:27 +0800)]
brcmfmac: add CLM download support

The firmware for brcmfmac devices includes information regarding
regulatory constraints. For certain devices this information is kept
separately in a binary form that needs to be downloaded to the device.
This patch adds support to download this so-called CLM blob file. It
uses the same naming scheme as the other firmware files with extension
of .clm_blob.

The CLM blob file is optional. If the file does not exist, the download
process will be bypassed. It will not affect the driver loading.

Reviewed-by: Arend van Spriel <[email protected]>
Signed-off-by: Chung-Hsien Hsu <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoMerge tag 'ceph-for-4.14-rc9' of git://github.com/ceph/ceph-client
Linus Torvalds [Fri, 10 Nov 2017 22:18:24 +0000 (14:18 -0800)]
Merge tag 'ceph-for-4.14-rc9' of git://github.com/ceph/ceph-client

Pull ceph gix from Ilya Dryomov:
 "Memory allocation flags fix, marked for stable"

* tag 'ceph-for-4.14-rc9' of git://github.com/ceph/ceph-client:
  rbd: use GFP_NOIO for parent stat and data requests

7 years agoMerge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Linus Torvalds [Fri, 10 Nov 2017 22:14:23 +0000 (14:14 -0800)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input layer updates from Dmitry Torokhov:

 - a new ACPI ID for Elan touchpad found in yet another Ideapad model

 - Synaptics RMI4 will allow binding to controllers reporting SMB
   version 3 (note that we are not adding any new ACPI IDs to the
   Synaptics PS/2 drover so unless user explicitly enables intertouch
   support there is no user-visible change)

 - a fixup to TSC 2004/5 touchscreen driver to mark input devices as
   "direct" to help userspace identify the type of device they are
   dealing with

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3
  Input: tsc200x-core - set INPUT_PROP_DIRECT
  Input: elan_i2c - add ELAN060C to the ACPI table

7 years agoMerge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Linus Torvalds [Fri, 10 Nov 2017 20:24:42 +0000 (12:24 -0800)]
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull KVM fix from Radim Krčmář:
 "Fix PPC HV host crash that can occur as a result of resizing the guest
  hashed page table"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: PPC: Book3S HV: Fix exclusion between HPT resizing and other HPT updates

7 years agoMerge tag 'mips_fixes_4.14_2' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan...
Linus Torvalds [Fri, 10 Nov 2017 20:21:15 +0000 (12:21 -0800)]
Merge tag 'mips_fixes_4.14_2' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/mips

Pull MIPS fixes from James Hogan:
 "A final few MIPS fixes for 4.14:

   - fix BMIPS NULL pointer dereference (4.7)

   - fix AR7 early GPIO init allocation failure (3.19)

   - fix dead serial output on certain AR7 platforms (2.6.35)"

* tag 'mips_fixes_4.14_2' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/mips:
  MIPS: AR7: Ensure that serial ports are properly set up
  MIPS: AR7: Defer registration of GPIO
  MIPS: BMIPS: Fix missing cbr address

7 years ago.mailmap: Add Maciej W. Rozycki's Imagination e-mail address
Maciej W. Rozycki [Fri, 10 Nov 2017 20:05:24 +0000 (20:05 +0000)]
.mailmap: Add Maciej W. Rozycki's Imagination e-mail address

Following my recent transition from Imagination Technologies to the=20
reincarnated MIPS company add a .mailmap mapping for my work address,
so that `scripts/get_maintainer.pl' gets it right for past commits.

Signed-off-by: Maciej W. Rozycki <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
7 years agoRevert "x86: CPU: Fix up "cpu MHz" in /proc/cpuinfo"
Linus Torvalds [Fri, 10 Nov 2017 19:19:11 +0000 (11:19 -0800)]
Revert "x86: CPU: Fix up "cpu MHz" in /proc/cpuinfo"

This reverts commit 941f5f0f6ef5338814145cf2b813cf1f98873e2f.

Sadly, it turns out that we really can't just do the cross-CPU IPI to
all CPU's to get their proper frequencies, because it's much too
expensive on systems with lots of cores.

So we'll have to revert this for now, and revisit it using a smarter
model (probably doing one system-wide IPI at open time, and doing all
the frequency calculations in parallel).

Reported-by: WANG Chao <[email protected]>
Reported-by: Ingo Molnar <[email protected]>
Cc: Rafael J Wysocki <[email protected]>
Cc: [email protected]
Signed-off-by: Linus Torvalds <[email protected]>
7 years agoMerge tag 'drm-fixes-for-v4.14-rc9' of git://people.freedesktop.org/~airlied/linux
Linus Torvalds [Fri, 10 Nov 2017 17:59:41 +0000 (09:59 -0800)]
Merge tag 'drm-fixes-for-v4.14-rc9' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "Last few patches to wrap up.

  Two i915 fixes that are on their way to stable, one vmware black
  screen bug, and one const patch that I was going to drop, but it was
  clearly a pretty safe one liner"

* tag 'drm-fixes-for-v4.14-rc9' of git://people.freedesktop.org/~airlied/linux:
  drm/i915: Deconstruct struct sgt_dma initialiser
  drm/i915: Reject unknown syncobj flags
  drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue
  drm/vmwgfx: constify vmw_fence_ops

7 years agocan: ifi: Fix transmitter delay calculation
Marek Vasut [Fri, 10 Nov 2017 10:22:39 +0000 (11:22 +0100)]
can: ifi: Fix transmitter delay calculation

The CANFD transmitter delay calculation formula was updated in the
latest software drop from IFI and improves the behavior of the IFI
CANFD core during bitrate switching. Use the new formula to improve
stability of the CANFD operation.

Signed-off-by: Marek Vasut <[email protected]>
Cc: Markus Marb <[email protected]>
Cc: linux-stable <[email protected]>
Signed-off-by: Marc Kleine-Budde <[email protected]>
7 years agotcp: fix tcp_fastretrans_alert warning
Yuchung Cheng [Tue, 7 Nov 2017 23:33:43 +0000 (15:33 -0800)]
tcp: fix tcp_fastretrans_alert warning

This patch fixes the cause of an WARNING indicatng TCP has pending
retransmission in Open state in tcp_fastretrans_alert().

The root cause is a bad interaction between path mtu probing,
if enabled, and the RACK loss detection. Upong receiving a SACK
above the sequence of the MTU probing packet, RACK could mark the
probe packet lost in tcp_fastretrans_alert(), prior to calling
tcp_simple_retransmit().

tcp_simple_retransmit() only enters Loss state if it newly marks
the probe packet lost. If the probe packet is already identified as
lost by RACK, the sender remains in Open state with some packets
marked lost and retransmitted. Then the next SACK would trigger
the warning. The likely scenario is that the probe packet was
lost due to its size or network congestion. The actual impact of
this warning is small by potentially entering fast recovery an
ACK later.

The simple fix is always entering recovery (Loss) state if some
packet is marked lost during path MTU probing.

Fixes: a0370b3f3f2c ("tcp: enable RACK loss detection to trigger recovery")
Reported-by: Oleksandr Natalenko <[email protected]>
Reported-by: Alexei Starovoitov <[email protected]>
Reported-by: Roman Gushchin <[email protected]>
Signed-off-by: Yuchung Cheng <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Acked-by: Neal Cardwell <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agotcp: gso: avoid refcount_t warning from tcp_gso_segment()
Eric Dumazet [Tue, 7 Nov 2017 23:15:04 +0000 (15:15 -0800)]
tcp: gso: avoid refcount_t warning from tcp_gso_segment()

When a GSO skb of truesize O is segmented into 2 new skbs of truesize N1
and N2, we want to transfer socket ownership to the new fresh skbs.

In order to avoid expensive atomic operations on a cache line subject to
cache bouncing, we replace the sequence :

refcount_add(N1, &sk->sk_wmem_alloc);
refcount_add(N2, &sk->sk_wmem_alloc); // repeated by number of segments

refcount_sub(O, &sk->sk_wmem_alloc);

by a single

refcount_add(sum_of(N) - O, &sk->sk_wmem_alloc);

Problem is :

In some pathological cases, sum(N) - O might be a negative number, and
syzkaller bot was apparently able to trigger this trace [1]

atomic_t was ok with this construct, but we need to take care of the
negative delta with refcount_t

[1]
refcount_t: saturated; leaking memory.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 8404 at lib/refcount.c:77 refcount_add_not_zero+0x198/0x200 lib/refcount.c:77
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 8404 Comm: syz-executor2 Not tainted 4.14.0-rc5-mm1+ #20
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 panic+0x1e4/0x41c kernel/panic.c:183
 __warn+0x1c4/0x1e0 kernel/panic.c:546
 report_bug+0x211/0x2d0 lib/bug.c:183
 fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:177
 do_trap_no_signal arch/x86/kernel/traps.c:211 [inline]
 do_trap+0x260/0x390 arch/x86/kernel/traps.c:260
 do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:297
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:310
 invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:905
RIP: 0010:refcount_add_not_zero+0x198/0x200 lib/refcount.c:77
RSP: 0018:ffff8801c606e3a0 EFLAGS: 00010282
RAX: 0000000000000026 RBX: 0000000000001401 RCX: 0000000000000000
RDX: 0000000000000026 RSI: ffffc900036fc000 RDI: ffffed0038c0dc68
RBP: ffff8801c606e430 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8801d97f5eba R11: 0000000000000000 R12: ffff8801d5acf73c
R13: 1ffff10038c0dc75 R14: 00000000ffffffff R15: 00000000fffff72f
 refcount_add+0x1b/0x60 lib/refcount.c:101
 tcp_gso_segment+0x10d0/0x16b0 net/ipv4/tcp_offload.c:155
 tcp4_gso_segment+0xd4/0x310 net/ipv4/tcp_offload.c:51
 inet_gso_segment+0x60c/0x11c0 net/ipv4/af_inet.c:1271
 skb_mac_gso_segment+0x33f/0x660 net/core/dev.c:2749
 __skb_gso_segment+0x35f/0x7f0 net/core/dev.c:2821
 skb_gso_segment include/linux/netdevice.h:3971 [inline]
 validate_xmit_skb+0x4ba/0xb20 net/core/dev.c:3074
 __dev_queue_xmit+0xe49/0x2070 net/core/dev.c:3497
 dev_queue_xmit+0x17/0x20 net/core/dev.c:3538
 neigh_hh_output include/net/neighbour.h:471 [inline]
 neigh_output include/net/neighbour.h:479 [inline]
 ip_finish_output2+0xece/0x1460 net/ipv4/ip_output.c:229
 ip_finish_output+0x85e/0xd10 net/ipv4/ip_output.c:317
 NF_HOOK_COND include/linux/netfilter.h:238 [inline]
 ip_output+0x1cc/0x860 net/ipv4/ip_output.c:405
 dst_output include/net/dst.h:459 [inline]
 ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
 ip_queue_xmit+0x8c6/0x18e0 net/ipv4/ip_output.c:504
 tcp_transmit_skb+0x1ab7/0x3840 net/ipv4/tcp_output.c:1137
 tcp_write_xmit+0x663/0x4de0 net/ipv4/tcp_output.c:2341
 __tcp_push_pending_frames+0xa0/0x250 net/ipv4/tcp_output.c:2513
 tcp_push_pending_frames include/net/tcp.h:1722 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5050 [inline]
 tcp_rcv_established+0x8c7/0x18a0 net/ipv4/tcp_input.c:5497
 tcp_v4_do_rcv+0x2ab/0x7d0 net/ipv4/tcp_ipv4.c:1460
 sk_backlog_rcv include/net/sock.h:909 [inline]
 __release_sock+0x124/0x360 net/core/sock.c:2264
 release_sock+0xa4/0x2a0 net/core/sock.c:2776
 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1462
 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763
 sock_sendmsg_nosec net/socket.c:632 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:642
 ___sys_sendmsg+0x31c/0x890 net/socket.c:2048
 __sys_sendmmsg+0x1e6/0x5f0 net/socket.c:2138

Fixes: 14afee4b6092 ("net: convert sock.sk_wmem_alloc from atomic_t to refcount_t")
Signed-off-by: Eric Dumazet <[email protected]>
Reported-by: syzbot <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: fix incorrect comment with regard to VLAN packet handling
Girish Moodalbail [Tue, 7 Nov 2017 19:32:11 +0000 (11:32 -0800)]
net: fix incorrect comment with regard to VLAN packet handling

The commit bcc6d4790361 ("net: vlan: make non-hw-accel rx path similar
to hw-accel") unified accel and non-accel path for VLAN RX. With that
fix we do not register any packet_type handler for VLANs anymore, so fix
the incorrect comment.

Signed-off-by: Girish Moodalbail <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agocan: peak: Add support for new PCIe/M2 CAN FD interfaces
Stephane Grosjean [Thu, 9 Nov 2017 13:42:14 +0000 (14:42 +0100)]
can: peak: Add support for new PCIe/M2 CAN FD interfaces

This adds support for the following PEAK-System CAN FD interfaces:

PCAN-cPCIe FD         CAN FD Interface for cPCI Serial (2 or 4 channels)
PCAN-PCIe/104-Express CAN FD Interface for PCIe/104-Express (1, 2 or 4 ch.)
PCAN-miniPCIe FD      CAN FD Interface for PCIe Mini (1, 2 or 4 channels)
PCAN-PCIe FD OEM      CAN FD Interface for PCIe OEM version (1, 2 or 4 ch.)
PCAN-M.2              CAN FD Interface for M.2 (1 or 2 channels)

Like the PCAN-PCIe FD interface, all of these boards run the same IP Core
that is able to handle CAN FD (see also http://www.peak-system.com).

Signed-off-by: Stephane Grosjean <[email protected]>
Cc: linux-stable <[email protected]>
Signed-off-by: Marc Kleine-Budde <[email protected]>
7 years agocan: sun4i: handle overrun in RX FIFO
Gerhard Bertelsmann [Mon, 6 Nov 2017 17:16:56 +0000 (18:16 +0100)]
can: sun4i: handle overrun in RX FIFO

SUN4Is CAN IP has a 64 byte deep FIFO buffer. If the buffer is not
drained fast enough (overrun) it's getting mangled. Already received
frames are dropped - the data can't be restored.

Signed-off-by: Gerhard Bertelsmann <[email protected]>
Cc: linux-stable <[email protected]>
Signed-off-by: Marc Kleine-Budde <[email protected]>
7 years agocan: c_can: don't indicate triple sampling support for D_CAN
Richard Schütz [Sun, 29 Oct 2017 12:03:22 +0000 (13:03 +0100)]
can: c_can: don't indicate triple sampling support for D_CAN

The D_CAN controller doesn't provide a triple sampling mode, so don't set
the CAN_CTRLMODE_3_SAMPLES flag in ctrlmode_supported. Currently enabling
triple sampling is a no-op.

Signed-off-by: Richard Schütz <[email protected]>
Cc: linux-stable <[email protected]> # >= v3.6
Signed-off-by: Marc Kleine-Budde <[email protected]>
7 years agonet/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet WQEs
Eugenia Emantayev [Thu, 12 Jan 2017 15:11:45 +0000 (17:11 +0200)]
net/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet WQEs

This is to prevent the case of working with a single MPWQE
(1 WQE is always reserved as RQ is linked-list).
When the WQE is fully consumed, HW should still have available buffer
in order not to drop packets.

Fixes: 461017cb006a ("net/mlx5e: Support RX multi-packet WQE (Striding RQ)")
Signed-off-by: Eugenia Emantayev <[email protected]>
Reviewed-by: Tariq Toukan <[email protected]>
Cc: [email protected]
Signed-off-by: Saeed Mahameed <[email protected]>
7 years agonet/mlx5e: Set page to null in case dma mapping fails
Inbar Karmy [Sun, 15 Oct 2017 14:30:59 +0000 (17:30 +0300)]
net/mlx5e: Set page to null in case dma mapping fails

Currently, when dma mapping fails, put_page is called,
but the page is not set to null. Later, in the page_reuse treatment in
mlx5e_free_rx_descs(), mlx5e_page_release() is called for the second time,
improperly doing dma_unmap (for a non-mapped address) and an extra put_page.
Prevent this by nullifying the page pointer when dma_map fails.

Fixes: accd58833237 ("net/mlx5e: Introduce RX Page-Reuse")
Signed-off-by: Inbar Karmy <[email protected]>
Reviewed-by: Tariq Toukan <[email protected]>
Cc: [email protected]
Signed-off-by: Saeed Mahameed <[email protected]>
7 years agonet/mlx5e: Fix napi poll with zero budget
Saeed Mahameed [Tue, 31 Oct 2017 22:34:00 +0000 (15:34 -0700)]
net/mlx5e: Fix napi poll with zero budget

napi->poll can be called with budget 0, e.g. in netpoll scenarios
where the caller only wants to poll TX rings
(poll_one_napi@net/core/netpoll.c).

The below commit changed RX polling from "while" loop to "do {} while",
which caused to ignore the initial budget and handle at least one RX
packet.

This fixes the following warning:
[ 2852.049194] mlx5e_napi_poll+0x0/0x260 [mlx5_core] exceeded budget in poll
[ 2852.049195] ------------[ cut here ]------------
[ 2852.049195] WARNING: CPU: 0 PID: 25691 at net/core/netpoll.c:171 netpoll_poll_dev+0x18a/0x1a0

Fixes: 4b7dfc992514 ("net/mlx5e: Early-return on empty completion queues")
Signed-off-by: Saeed Mahameed <[email protected]>
Reviewed-by: Tariq Toukan <[email protected]>
Reported-by: Martin KaFai Lau <[email protected]>
Tested-by: Martin KaFai Lau <[email protected]>
Cc: [email protected]
Signed-off-by: Saeed Mahameed <[email protected]>
7 years agonet/mlx5: Cancel health poll before sending panic teardown command
Huy Nguyen [Tue, 26 Sep 2017 20:11:56 +0000 (15:11 -0500)]
net/mlx5: Cancel health poll before sending panic teardown command

After the panic teardown firmware command, health_care detects the error
in PCI bus and calls the mlx5_pci_err_detected. This health_care flow is
no longer needed because the panic teardown firmware command will bring
down the PCI bus communication with the HCA.

The solution is to cancel the health care timer and its pending
workqueue request before sending panic teardown firmware command.

Kernel trace:
mlx5_core 0033:01:00.0: Shutdown was called
mlx5_core 0033:01:00.0: health_care:154:(pid 9304): handling bad device here
mlx5_core 0033:01:00.0: mlx5_handle_bad_state:114:(pid 9304): NIC state 1
mlx5_core 0033:01:00.0: mlx5_pci_err_detected was called
mlx5_core 0033:01:00.0: mlx5_enter_error_state:96:(pid 9304): start
mlx5_3:mlx5_ib_event:3061:(pid 9304): warning: event on port 0
mlx5_core 0033:01:00.0: mlx5_enter_error_state:104:(pid 9304): end
Unable to handle kernel paging request for data at address 0x0000003f
Faulting instruction address: 0xc0080000434b8c80

Fixes: 8812c24d28f4 ('net/mlx5: Add fast unload support in shutdown flow')
Signed-off-by: Huy Nguyen <[email protected]>
Reviewed-by: Moshe Shemesh <[email protected]>
Signed-off-by: Saeed Mahameed <[email protected]>
7 years agonet/mlx5: Loop over temp list to release delay events
Huy Nguyen [Mon, 30 Oct 2017 03:40:56 +0000 (22:40 -0500)]
net/mlx5: Loop over temp list to release delay events

list_splice_init initializing waiting_events_list after splicing it to
temp list, therefore we should loop over temp list to fire the events.

Fixes: 4ca637a20a52 ("net/mlx5: Delay events till mlx5 interface's add complete for pci resume")
Signed-off-by: Huy Nguyen <[email protected]>
Signed-off-by: Feras Daoud <[email protected]>
Signed-off-by: Saeed Mahameed <[email protected]>
7 years agoMerge branch 'act_vlan-rcu'
David S. Miller [Fri, 10 Nov 2017 06:32:20 +0000 (15:32 +0900)]
Merge branch 'act_vlan-rcu'

Manish Kurup says:

====================
net_sched actions: act_vlan now uses RCU

This commit consists of 3 patches:

patch1 (1/3):
The VLAN action maintains one set of stats across all cores, and uses a
spinlock to synchronize updates to it from the same. Changed this to use a
per-CPU stats context instead.
This change will result in better performance.

patch2 (2/3):
Modified netronome nfp flower action to use VLAN helper functions instead
of accessing/referencing TC act_vlan private structures directly.

patch3 (3/3):
Using a spinlock in the VLAN action causes performance issues when the VLAN
action is used on multiple cores. Rewrote the VLAN action to use RCU read
locking for reads and updates instead.
All functions now use an RCU dereferenced pointer to access the VLAN action
context. Modified helper functions used by other modules, to use the RCU as
opposed to directly accessing the structure.

As part of this review, there were some changes suggested by reviewers.
I have incorporated all the changes that were requested.

Here're the changes:
v2: Fixed all helper functions to use RCU (rtnl_dereference) - Eric, Jamal
v2: Fixed indentation, extra line nits - Jamal, Jiri
v2: Moved rcu_head to the end of the struct - Jiri
v2: Re-formatted locals to reverse-christmas-tree - Jiri
v2: Removed mismatched spin_lock() - Cong
v2: Removed spin_lock_bh() in tcf_vlan_init, rtnl_dereference() should
    suffice - Cong, Jiri
v4: Modified the nfp flower action code to use the VLAN helper functions
    instead of referencing the structure directly. Isolated this into a
    separate patch - Pieter Jansen
v5: Got rid of the unlikely() for the allocation case - Simon Horman
v6: Had forgotten cleanup functions for RCU alloc, added them - Dave Miller
v7: Re-formatted more locals to reverse-christmas-tree - Pieter V
v8: Reverted reverse-christmas-tree(v7), not required when dependencies
    make it difficult to implement - Alexander D
v9: Cover letter subject change - Jamal
====================

Signed-off-by: David S. Miller <[email protected]>
7 years agoact_vlan: VLAN action rewrite to use RCU lock/unlock and update
Manish Kurup [Tue, 7 Nov 2017 20:49:05 +0000 (15:49 -0500)]
act_vlan: VLAN action rewrite to use RCU lock/unlock and update

Using a spinlock in the VLAN action causes performance issues when the VLAN
action is used on multiple cores. Rewrote the VLAN action to use RCU read
locking for reads and updates instead.
All functions now use an RCU dereferenced pointer to access the VLAN action
context. Modified helper functions used by other modules, to use the RCU as
opposed to directly accessing the structure.

Acked-by: Jamal Hadi Salim <[email protected]>
Acked-by: Jiri Pirko <[email protected]>
Signed-off-by: Manish Kurup <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonfp flower action: Modified to use VLAN helper functions
Manish Kurup [Tue, 7 Nov 2017 20:48:45 +0000 (15:48 -0500)]
nfp flower action: Modified to use VLAN helper functions

Modified netronome nfp flower action to use VLAN helper functions instead
of accessing/referencing TC act_vlan private structures directly.

Reviewed-by: Pieter Jansen van Vuuren <[email protected]>
Signed-off-by: Manish Kurup <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agoact_vlan: Change stats update to use per-core stats
Manish Kurup [Tue, 7 Nov 2017 20:48:15 +0000 (15:48 -0500)]
act_vlan: Change stats update to use per-core stats

The VLAN action maintains one set of stats across all cores, and uses a
spinlock to synchronize updates to it from the same. Changed this to use a
per-CPU stats context instead.
This change will result in better performance.

Acked-by: Jamal Hadi Salim <[email protected]>
Acked-by: Jiri Pirko <[email protected]>
Signed-off-by: Manish Kurup <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agosfc: don't warn on successful change of MAC
Robert Stonehouse [Tue, 7 Nov 2017 17:30:30 +0000 (17:30 +0000)]
sfc: don't warn on successful change of MAC

Fixes: 535a61777f44e ("sfc: suppress handled MCDI failures when changing the MAC address")
Signed-off-by: Bert Kenward <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: vxge: remove redundant assignments and pointers
Colin Ian King [Tue, 7 Nov 2017 15:47:24 +0000 (15:47 +0000)]
net: vxge: remove redundant assignments and pointers

There are several pointers that are being assigned but never read
so remove these as they are redundant.  Also remove an assignment
to function_mode that is never read. Cleans up several clang
warnings:

vxge-main.c:1139:2: warning: Value stored to 'hldev' is never read
vxge-main.c:1294:2: warning: Value stored to 'hldev' is never read
vxge-main.c:2188:2: warning: Value stored to 'dev' is never read
vxge-main.c:2188:2: warning: Value stored to 'dev' is never read
vxge-main.c:2723:2: warning: Value stored to 'function_mode' is
never read

Signed-off-by: Colin Ian King <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agords: ib: Fix NULL pointer dereference in debug code
Håkon Bugge [Tue, 7 Nov 2017 15:33:34 +0000 (16:33 +0100)]
rds: ib: Fix NULL pointer dereference in debug code

rds_ib_recv_refill() is a function that refills an IB receive
queue. It can be called from both the CQE handler (tasklet) and a
worker thread.

Just after the call to ib_post_recv(), a debug message is printed with
rdsdebug():

            ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
            rdsdebug("recv %p ibinc %p page %p addr %lu ret %d\n", recv,
                     recv->r_ibinc, sg_page(&recv->r_frag->f_sg),
                     (long) ib_sg_dma_address(
                            ic->i_cm_id->device,
                            &recv->r_frag->f_sg),
                    ret);

Now consider an invocation of rds_ib_recv_refill() from the worker
thread, which is preemptible. Further, assume that the worker thread
is preempted between the ib_post_recv() and rdsdebug() statements.

Then, if the preemption is due to a receive CQE event, the
rds_ib_recv_cqe_handler() will be invoked. This function processes
receive completions, including freeing up data structures, such as the
recv->r_frag.

In this scenario, rds_ib_recv_cqe_handler() will process the receive
WR posted above. That implies, that the recv->r_frag has been freed
before the above rdsdebug() statement has been executed. When it is
later executed, we will have a NULL pointer dereference:

[ 4088.068008] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
[ 4088.076754] IP: rds_ib_recv_refill+0x87/0x620 [rds_rdma]
[ 4088.082686] PGD 0 P4D 0
[ 4088.085515] Oops: 0000 [#1] SMP
[ 4088.089015] Modules linked in: rds_rdma(OE) rds(OE) rpcsec_gss_krb5(E) nfsv4(E) dns_resolver(E) nfs(E) fscache(E) mlx4_ib(E) ib_ipoib(E) rdma_ucm(E) ib_ucm(E) ib_uverbs(E) ib_umad(E) rdma_cm(E) ib_cm(E) iw_cm(E) ib_core(E) binfmt_misc(E) sb_edac(E) intel_powerclamp(E) coretemp(E) kvm_intel(E) kvm(E) irqbypass(E) crct10dif_pclmul(E) crc32_pclmul(E) ghash_clmulni_intel(E) pcbc(E) aesni_intel(E) crypto_simd(E) iTCO_wdt(E) glue_helper(E) iTCO_vendor_support(E) sg(E) cryptd(E) pcspkr(E) ipmi_si(E) ipmi_devintf(E) ipmi_msghandler(E) shpchp(E) ioatdma(E) i2c_i801(E) wmi(E) lpc_ich(E) mei_me(E) mei(E) mfd_core(E) nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) sunrpc(E) ip_tables(E) ext4(E) mbcache(E) jbd2(E) fscrypto(E) mgag200(E) i2c_algo_bit(E) drm_kms_helper(E) syscopyarea(E) sysfillrect(E) sysimgblt(E)
[ 4088.168486]  fb_sys_fops(E) ahci(E) ixgbe(E) libahci(E) ttm(E) mdio(E) ptp(E) pps_core(E) drm(E) sd_mod(E) libata(E) crc32c_intel(E) mlx4_core(E) i2c_core(E) dca(E) megaraid_sas(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) [last unloaded: rds]
[ 4088.193442] CPU: 20 PID: 1244 Comm: kworker/20:2 Tainted: G           OE   4.14.0-rc7.master.20171105.ol7.x86_64 #1
[ 4088.205097] Hardware name: Oracle Corporation ORACLE SERVER X5-2L/ASM,MOBO TRAY,2U, BIOS 31110000 03/03/2017
[ 4088.216074] Workqueue: ib_cm cm_work_handler [ib_cm]
[ 4088.221614] task: ffff885fa11d0000 task.stack: ffffc9000e598000
[ 4088.228224] RIP: 0010:rds_ib_recv_refill+0x87/0x620 [rds_rdma]
[ 4088.234736] RSP: 0018:ffffc9000e59bb68 EFLAGS: 00010286
[ 4088.240568] RAX: 0000000000000000 RBX: ffffc9002115d050 RCX: ffffc9002115d050
[ 4088.248535] RDX: ffffffffa0521380 RSI: ffffffffa0522158 RDI: ffffffffa0525580
[ 4088.256498] RBP: ffffc9000e59bbf8 R08: 0000000000000005 R09: 0000000000000000
[ 4088.264465] R10: 0000000000000339 R11: 0000000000000001 R12: 0000000000000000
[ 4088.272433] R13: ffff885f8c9d8000 R14: ffffffff81a0a060 R15: ffff884676268000
[ 4088.280397] FS:  0000000000000000(0000) GS:ffff885fbec80000(0000) knlGS:0000000000000000
[ 4088.289434] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4088.295846] CR2: 0000000000000020 CR3: 0000000001e09005 CR4: 00000000001606e0
[ 4088.303816] Call Trace:
[ 4088.306557]  rds_ib_cm_connect_complete+0xe0/0x220 [rds_rdma]
[ 4088.312982]  ? __dynamic_pr_debug+0x8c/0xb0
[ 4088.317664]  ? __queue_work+0x142/0x3c0
[ 4088.321944]  rds_rdma_cm_event_handler+0x19e/0x250 [rds_rdma]
[ 4088.328370]  cma_ib_handler+0xcd/0x280 [rdma_cm]
[ 4088.333522]  cm_process_work+0x25/0x120 [ib_cm]
[ 4088.338580]  cm_work_handler+0xd6b/0x17aa [ib_cm]
[ 4088.343832]  process_one_work+0x149/0x360
[ 4088.348307]  worker_thread+0x4d/0x3e0
[ 4088.352397]  kthread+0x109/0x140
[ 4088.355996]  ? rescuer_thread+0x380/0x380
[ 4088.360467]  ? kthread_park+0x60/0x60
[ 4088.364563]  ret_from_fork+0x25/0x30
[ 4088.368548] Code: 48 89 45 90 48 89 45 98 eb 4d 0f 1f 44 00 00 48 8b 43 08 48 89 d9 48 c7 c2 80 13 52 a0 48 c7 c6 58 21 52 a0 48 c7 c7 80 55 52 a0 <4c> 8b 48 20 44 89 64 24 08 48 8b 40 30 49 83 e1 fc 48 89 04 24
[ 4088.389612] RIP: rds_ib_recv_refill+0x87/0x620 [rds_rdma] RSP: ffffc9000e59bb68
[ 4088.397772] CR2: 0000000000000020
[ 4088.401505] ---[ end trace fe922e6ccf004431 ]---

This bug was provoked by compiling rds out-of-tree with
EXTRA_CFLAGS="-DRDS_DEBUG -DDEBUG" and inserting an artificial delay
between the rdsdebug() and ib_ib_port_recv() statements:

           /* XXX when can this fail? */
       ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
+ if (can_wait)
+ usleep_range(1000, 5000);
       rdsdebug("recv %p ibinc %p page %p addr %lu ret %d\n", recv,
recv->r_ibinc, sg_page(&recv->r_frag->f_sg),
(long) ib_sg_dma_address(

The fix is simply to move the rdsdebug() statement up before the
ib_post_recv() and remove the printing of ret, which is taken care of
anyway by the non-debug code.

Signed-off-by: Håkon Bugge <[email protected]>
Reviewed-by: Knut Omang <[email protected]>
Reviewed-by: Wei Lin Guay <[email protected]>
Acked-by: Santosh Shilimkar <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agoMerge branch 'ip_gre-flags-update'
David S. Miller [Fri, 10 Nov 2017 05:39:54 +0000 (14:39 +0900)]
Merge branch 'ip_gre-flags-update'

Xin Long says:

====================
ip_gre: add support for i/o_flags update

ip_gre is using as many ip_tunnel apis as possible, newlink works
fine as gre would do it's own part in .ndo_init. But when changing
link, ip_tunnel_changelink doesn't even update i/o_flags, and also
the update of these flags would cause some other gre's properties
need to be updated or recalculated.

These two patch are to add i/o_flags update and then do adjustment
on some gre's properties according to the new i/o_flags.
====================

Signed-off-by: David S. Miller <[email protected]>
7 years agoip_gre: add the support for i/o_flags update via ioctl
Xin Long [Tue, 7 Nov 2017 08:33:09 +0000 (16:33 +0800)]
ip_gre: add the support for i/o_flags update via ioctl

As patch 'ip_gre: add the support for i/o_flags update via netlink'
did for netlink, we also need to do the same job for these update
via ioctl.

This patch is to update i/o_flags and call ipgre_link_update to
recalculate these gre properties after ip_tunnel_ioctl does the
common update.

Signed-off-by: Xin Long <[email protected]>
Acked-by: William Tu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agoip_gre: add the support for i/o_flags update via netlink
Xin Long [Tue, 7 Nov 2017 08:33:08 +0000 (16:33 +0800)]
ip_gre: add the support for i/o_flags update via netlink

Now ip_gre is using ip_tunnel_changelink to update it's properties, but
ip_tunnel_changelink in ip_tunnel doesn't update i/o_flags as a common
function.

o_flags updates would cause that tunnel->tun_hlen / hlen and dev->mtu /
needed_headroom need to be recalculated, and dev->(hw_)features need to
be updated as well.

Therefore, we can't just add the update into ip_tunnel_update called
in ip_tunnel_changelink, and it's also better not to touch ip_tunnel
codes.

This patch updates i/o_flags and calls ipgre_link_update to recalculate
these gre properties after ip_tunnel_changelink does the common update.

Note that since ipgre_link_update doesn't know the lower dev, it will
update gre->hlen, dev->mtu and dev->needed_headroom with the value of
'new tun_hlen - old tun_hlen'. In this way, we can avoid many redundant
codes, unlike ip6_gre.

Reported-by: Jianlin Shi <[email protected]>
Signed-off-by: Xin Long <[email protected]>
Acked-by: William Tu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agoMerge branch 'tcp-ns-rmem-wmem'
David S. Miller [Fri, 10 Nov 2017 05:34:58 +0000 (14:34 +0900)]
Merge branch 'tcp-ns-rmem-wmem'

Eric Dumazet says:

====================
net: Namespace-ify sysctl_tcp_rmem and sysctl_tcp_wmem

We need to get per netns sysctl for sysctl_[proto]_rmem and sysctl_[proto]_wmem

This patch series adds the basic infrastructure allowing per proto
conversion, and takes care of TCP.
====================

Signed-off-by: David S. Miller <[email protected]>
7 years agotcp: Namespace-ify sysctl_tcp_rmem and sysctl_tcp_wmem
Eric Dumazet [Tue, 7 Nov 2017 08:29:28 +0000 (00:29 -0800)]
tcp: Namespace-ify sysctl_tcp_rmem and sysctl_tcp_wmem

Note that when a new netns is created, it inherits its
sysctl_tcp_rmem and sysctl_tcp_wmem from initial netns.

This change is needed so that we can refine TCP rcvbuf autotuning,
to take RTT into consideration.

Signed-off-by: Eric Dumazet <[email protected]>
Cc: Wei Wang <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: allow per netns sysctl_rmem and sysctl_wmem for protos
Eric Dumazet [Tue, 7 Nov 2017 08:29:27 +0000 (00:29 -0800)]
net: allow per netns sysctl_rmem and sysctl_wmem for protos

As we want to gradually implement per netns sysctl_rmem and sysctl_wmem
on per protocol basis, add two new fields in struct proto,
and two new helpers : sk_get_wmem0() and sk_get_rmem0()

First user will be TCP. Then UDP and SCTP can be easily converted,
while DECNET probably wont get this support.

Signed-off-by: Eric Dumazet <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: dsa: Don't add vlans when vlan filtering is disabled
Andrew Lunn [Mon, 6 Nov 2017 23:04:24 +0000 (00:04 +0100)]
net: dsa: Don't add vlans when vlan filtering is disabled

The software bridge can be build with vlan filtering support
included. However, by default it is turned off. In its turned off
state, it still passes VLANs via switchev, even though they are not to
be used. Don't pass these VLANs to the hardware. Only do so when vlan
filtering is enabled.

This fixes at least one corner case. There are still issues in other
corners, such as when vlan_filtering is later enabled.

Signed-off-by: Andrew Lunn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agoMerge tag 'mlx5-updates-2017-11-09' of git://git.kernel.org/pub/scm/linux/kernel...
David S. Miller [Fri, 10 Nov 2017 04:44:46 +0000 (13:44 +0900)]
Merge tag 'mlx5-updates-2017-11-09' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux

Saeed Mahameed says:

====================
mlx5-updates-2017-11-09

This series introduces vlan offloads related improvements for mlx5
ethernet netdev driver, from Gal Pressman.

 - Add support for 802.1ad vlan filter
 - Add support for 802.1ad vlan insertion
 - Add vlan offloads statistics to ethtool (inserted/stripped vlans)
 - CHECKSUM_COMPLETE support for vlan traffic when vlan stripping is off! (Finally)
====================

Signed-off-by: David S. Miller <[email protected]>
7 years agoMerge branch 'IGMP-snooping-for-local-traffic'
David S. Miller [Fri, 10 Nov 2017 04:41:40 +0000 (13:41 +0900)]
Merge branch 'IGMP-snooping-for-local-traffic'

Andrew Lunn says:

====================
IGMP snooping for local traffic

The linux bridge supports IGMP snooping. It will listen to IGMP
reports on bridge ports and keep track of which groups have been
joined on an interface. It will then forward multicast based on this
group membership.

When the bridge adds or removed groups from an interface, it uses
switchdev to request the hardware add an mdb to a port, so the
hardware can perform the selective forwarding between ports.

What is not covered by the current bridge code, is IGMP joins/leaves
from the host on the brX interface. These are not reported via
switchdev so that hardware knows the local host is interested in the
multicast frames.

Luckily, the bridge does track joins/leaves on the brX interface. The
code is obfusticated, which is why i missed it with my first attempt.
So the first patch tries to remove this obfustication. Currently,
there is no notifications sent when the bridge interface joins a
group. The second patch adds them. bridge monitor then shows
joins/leaves in the same way as for other ports of the bridge.

Then starts the work passing down to the hardware that the host has
joined/left a group. The existing switchdev mdb object cannot be used,
since the semantics are different. The existing
SWITCHDEV_OBJ_ID_PORT_MDB is used to indicate a specific multicast
group should be forwarded out that port of the switch. However here we
require the exact opposite. We want multicast frames for the group
received on the port to the forwarded to the host. Hence add a new
object SWITCHDEV_OBJ_ID_HOST_MDB, a multicast database entry to
forward to the host. This new object is then propagated through the
DSA layers. No DSA driver changes should be needed, this should just
work...

This version fixes up the nitpick from Nikolay, removes an unrelated
white space change, and adds in a patch adding a few const attributes
to a couple of functions taking a port parameter, in order to stop the
following patch produces warnings.
====================

Acked-by: Stephen Hemminger <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: dsa: switch: Don't add CPU port to an mdb by default
Andrew Lunn [Thu, 9 Nov 2017 22:11:02 +0000 (23:11 +0100)]
net: dsa: switch: Don't add CPU port to an mdb by default

Now that the host indicates when a multicast group should be forwarded
from the switch to the host, don't do it by default.

Signed-off-by: Andrew Lunn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: dsa: add more const attributes
Andrew Lunn [Thu, 9 Nov 2017 22:11:01 +0000 (23:11 +0100)]
net: dsa: add more const attributes

The notify mechanism does not need to modify the port it is notifying.
So make the parameter const.

Signed-off-by: Andrew Lunn <[email protected]>
Reviewed-by: Vivien Didelot <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: dsa: slave: Handle switchdev host mdb add/del
Andrew Lunn [Thu, 9 Nov 2017 22:11:00 +0000 (23:11 +0100)]
net: dsa: slave: Handle switchdev host mdb add/del

Add code to handle switchdev host mdb add/del. Since DSA uses one of
the switch ports as a transport to the host, we just need to add an
MDB on this port.

Signed-off-by: Andrew Lunn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: bridge: Add/del switchdev object on host join/leave
Andrew Lunn [Thu, 9 Nov 2017 22:10:59 +0000 (23:10 +0100)]
net: bridge: Add/del switchdev object on host join/leave

When the host joins or leaves a multicast group, use switchdev to add
an object to the hardware to forward traffic for the group to the
host.

Signed-off-by: Andrew Lunn <[email protected]>
Acked-by: Nikolay Aleksandrov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: bridge: Send notification when host join/leaves a group
Andrew Lunn [Thu, 9 Nov 2017 22:10:58 +0000 (23:10 +0100)]
net: bridge: Send notification when host join/leaves a group

The host can join or leave a multicast group on the brX interface, as
indicated by IGMP snooping.  This is tracked within the bridge
multicast code. Send a notification when this happens, in the same way
a notification is sent when a port of the bridge joins/leaves a group
because of IGMP snooping.

Signed-off-by: Andrew Lunn <[email protected]>
Acked-by: Nikolay Aleksandrov <[email protected]>
Acked-by: Florian Fainelli <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agonet: bridge: Rename mglist to host_joined
Andrew Lunn [Thu, 9 Nov 2017 22:10:57 +0000 (23:10 +0100)]
net: bridge: Rename mglist to host_joined

The boolean mglist indicates the host has joined a particular
multicast group on the bridge interface. It is badly named, obscuring
what is means. Rename it.

Signed-off-by: Andrew Lunn <[email protected]>
Acked-by: Nikolay Aleksandrov <[email protected]>
Acked-by: Florian Fainelli <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
7 years agorsi: rsi_91x_ps: remove redundant code in str_psstate
Gustavo A. R. Silva [Mon, 6 Nov 2017 21:53:21 +0000 (15:53 -0600)]
rsi: rsi_91x_ps: remove redundant code in str_psstate

"INVALID_STATE" is already being returned in the default case and this
code cannot be reached.

Addresses-Coverity-ID: 1398384
Signed-off-by: Gustavo A. R. Silva <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agort2x00: use monotonic timestamps for frame dump
Arnd Bergmann [Mon, 6 Nov 2017 14:03:59 +0000 (15:03 +0100)]
rt2x00: use monotonic timestamps for frame dump

rt2x00 uses the deprecated do_gettimeofday() function to get a timestamp
for its debugfs "dump" file interface.

The timestamp is using an unsigned 32-bit value, so we could make it
work until 2106 by using ktime_get_real_ts64(), but it seems better to
use monotonic times, as we normally want for timestamps.

Since this is an interface change, I'm incrementing the
DUMP_HEADER_VERSION number, so user space can figure out whether the
timestamps are monotonic or not. Most likely the tools won't care either
way.

Generally speaking, ABI version numbers and in particular changing them
is a bad idea. However since this is in debugfs, we don't put any
API stability rules on the interface according to
Documentation/filesystems/debugfs.txt, and we can take the easy way
out here; anyone using the frame dump feature can probably work out
the differences here.

Signed-off-by: Arnd Bergmann <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agort2x00usb: mark device removed when get ENOENT usb error
Stanislaw Gruszka [Thu, 9 Nov 2017 10:59:24 +0000 (11:59 +0100)]
rt2x00usb: mark device removed when get ENOENT usb error

ENOENT usb error mean "specified interface or endpoint does not exist or
is not enabled". Mark device not present when we encounter this error
similar like we do with ENODEV error.

Otherwise we can have infinite loop in rt2x00usb_work_rxdone(), because
we remove and put again RX entries to the queue infinitely.

We can have similar situation when submit urb will fail all the time
with other error, so we need consider to limit number of entries
processed by rxdone work. But for now, since the patch fixes
reproducible soft lockup issue on single processor systems
and taken ENOENT error meaning, let apply this fix.

Patch adds additional ENOENT check not only in rx kick routine, but
also on other places where we check for ENODEV error.

Reported-by: Richard Genoud <[email protected]>
Debugged-by: Richard Genoud <[email protected]>
Cc: [email protected]
Signed-off-by: Stanislaw Gruszka <[email protected]>
Tested-by: Richard Genoud <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoqtnfmac: pass all CONNECT cmd params to wireless card for processing
Igor Mitsyanko [Tue, 31 Oct 2017 01:04:55 +0000 (18:04 -0700)]
qtnfmac: pass all CONNECT cmd params to wireless card for processing

Specifically, following parameters are needed for wireless device
configuration but were not available to it before:
- HT/VHT capabilities and capabilities masks.
- full channel info (not just IEEE number)
- BSSID hint
- previous BSSID for reassoc request

Move Management Frame Protection setting from common encr info
structure into STA-specific .connect command parameters.

Make sure that all new qlink structure definitions are alignment-safe.

Signed-off-by: Igor Mitsyanko <[email protected]>
Reviewed-by: Sergey Matyukevich <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoqtnfmac: include HTCAP and VHTCAP into config AP command
Igor Mitsyanko [Tue, 31 Oct 2017 01:04:54 +0000 (18:04 -0700)]
qtnfmac: include HTCAP and VHTCAP into config AP command

Include HT/VHT caps directly into command so that they won't have
to be searched for in IEs.

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoqtnfmac: configure and start AP interface with a single command
Igor Mitsyanko [Tue, 31 Oct 2017 01:04:53 +0000 (18:04 -0700)]
qtnfmac: configure and start AP interface with a single command

Current logic artificially divides "start AP" procedure into three
stages:
- generic interface configuration (security, channel etc)
- IE's processing
- enable AP mode on interface

This separation would not allow to do a proper device configuration as
first stage needs to use information from IEs that are processed on
a second stage. Which means first and second stages have to be meged.
In that case there is no point anymore to keep third stage either, so
merge all three into a single command.

This new command carries all the same info as contained in
"struct cfg80211_ap_settings".

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoqtnfmac: convert "Append IEs" command to QTN_TLV_ID_IE_SET usage
Igor Mitsyanko [Tue, 31 Oct 2017 01:04:52 +0000 (18:04 -0700)]
qtnfmac: convert "Append IEs" command to QTN_TLV_ID_IE_SET usage

Data contained within "Append IEs" command (QLINK_CMD_MGMT_SET_APPIE)
duplicates QTN_TLV_ID_IE_SET TLV. Convert the command to use that TLV
instead.

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoqtnfmac: SCAN results: retreive frame type information from "IE set" TLV
Igor Mitsyanko [Tue, 31 Oct 2017 01:04:51 +0000 (18:04 -0700)]
qtnfmac: SCAN results: retreive frame type information from "IE set" TLV

"IE set" TLV carries the same information as
qlink_event_scan_result::frame_type. Convert the event to make use of
TLV and drop frame_type member.
While at it, make qlink_event_scan_result structure alignement-safe.

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoqtnfmac: extend "IE set" TLV to include frame type info
Igor Mitsyanko [Tue, 31 Oct 2017 01:04:50 +0000 (18:04 -0700)]
qtnfmac: extend "IE set" TLV to include frame type info

Specifying frame type for "IE set" TLV will allow to use several
TLVs in a single message.
Modify users accordingly.

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoqtnfmac: get rid of PHYMODE capabilities flags
Igor Mitsyanko [Tue, 31 Oct 2017 01:04:49 +0000 (18:04 -0700)]
qtnfmac: get rid of PHYMODE capabilities flags

Supported WiFi operation modes are now identified per-band based on
HT/VHT capabilities of each band.

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoqtnfmac: initialize HT/VHT caps "can override" masks
Igor Mitsyanko [Tue, 31 Oct 2017 01:04:48 +0000 (18:04 -0700)]
qtnfmac: initialize HT/VHT caps "can override" masks

Information on which HT/VHT capabilities can be overridden is reported
per-MAC by wireless device.

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoqtnfmac: use per-band HT/VHT info from wireless device
Igor Mitsyanko [Tue, 31 Oct 2017 01:04:47 +0000 (18:04 -0700)]
qtnfmac: use per-band HT/VHT info from wireless device

HT/VHT capabilities must be reported per each band supported by a radio,
not for all bands on a radio. Furthermore, driver better not assume
any capabilities and just use whetever is reported by device itself.

To support this, convert "get channels" command into "get band info"
command. Difference is that it may also carry HT/VHT capabilities along
with channels information.

While at it, also add "num_bitrates" field to "get band info" command,
for future use.

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agobrcmfmac: move configuration of probe request IEs
Arend Van Spriel [Wed, 8 Nov 2017 13:36:37 +0000 (14:36 +0100)]
brcmfmac: move configuration of probe request IEs

The configuration of the IEs for probe requests was done in a P2P
related function, which is not very obvious. Moving it to
.scan callback function, ie. brcmf_cfg80211_scan().

Reviewed-by: Hante Meuleman <[email protected]>
Reviewed-by: Pieter-Paul Giesberts <[email protected]>
Reviewed-by: Franky Lin <[email protected]>
Signed-off-by: Arend van Spriel <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agobrcmfmac: get rid of struct brcmf_cfg80211_info::active_scan field
Arend Van Spriel [Wed, 8 Nov 2017 13:36:36 +0000 (14:36 +0100)]
brcmfmac: get rid of struct brcmf_cfg80211_info::active_scan field

The field struct brcmf_cfg80211_info::active_scan is set to true upon
initializing the driver instance, but it is never changed so simply
get rid of it.

Reviewed-by: Hante Meuleman <[email protected]>
Reviewed-by: Pieter-Paul Giesberts <[email protected]>
Reviewed-by: Franky Lin <[email protected]>
Signed-off-by: Arend van Spriel <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agobrcmfmac: get rid of brcmf_cfg80211_escan() function
Arend Van Spriel [Wed, 8 Nov 2017 13:36:35 +0000 (14:36 +0100)]
brcmfmac: get rid of brcmf_cfg80211_escan() function

The function brcmf_cfg80211_escan() is only called by brcmf_cfg80211_scan()
so there is no reason to split in two function especially since the latter
does not do an awful lot.

Reviewed-by: Hante Meuleman <[email protected]>
Reviewed-by: Pieter-Paul Giesberts <[email protected]>
Reviewed-by: Franky Lin <[email protected]>
Signed-off-by: Arend van Spriel <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agobrcmfmac: use msecs_to_jiffies() instead of calculation using HZ
Arend Van Spriel [Wed, 8 Nov 2017 13:36:34 +0000 (14:36 +0100)]
brcmfmac: use msecs_to_jiffies() instead of calculation using HZ

Minor cleanup using provided macro to convert milliseconds interval
to jiffies in brcmf_cfg80211_escan().

Reviewed-by: Hante Meuleman <[email protected]>
Reviewed-by: Pieter-Paul Giesberts <[email protected]>
Reviewed-by: Franky Lin <[email protected]>
Signed-off-by: Arend van Spriel <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agobrcmfmac: cleanup brcmf_cfg80211_escan() function
Arend Van Spriel [Wed, 8 Nov 2017 13:36:33 +0000 (14:36 +0100)]
brcmfmac: cleanup brcmf_cfg80211_escan() function

The function brcmf_cfg80211_escan() was always called with a non-null
request parameter and null pointer for this_ssid parameter. Clean up
the function removing the dead code path.

Reviewed-by: Hante Meuleman <[email protected]>
Reviewed-by: Pieter-Paul Giesberts <[email protected]>
Reviewed-by: Franky Lin <[email protected]>
Signed-off-by: Arend van Spriel <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agobrcmfmac: disable packet filtering in promiscuous mode
Franky Lin [Wed, 8 Nov 2017 13:36:32 +0000 (14:36 +0100)]
brcmfmac: disable packet filtering in promiscuous mode

Disable arp and nd offload to allow all packets sending to host.

Reported-by: Phil Elwell <[email protected]>
Tested-by: Phil Elwell <[email protected]>
Reviewed-by: Arend Van Spriel <[email protected]>
Signed-off-by: Franky Lin <[email protected]>
Signed-off-by: Arend van Spriel <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agobrcmfmac: handle FWHALT mailbox indication
Arend Van Spriel [Wed, 8 Nov 2017 13:36:31 +0000 (14:36 +0100)]
brcmfmac: handle FWHALT mailbox indication

The firmware uses a mailbox to communicate to the host what is going
on. In the driver we validate the bit received. Various people seen
the following message:

 brcmfmac: brcmf_sdio_hostmail: Unknown mailbox data content: 0x40012

Bit 4 is cause of this message, but this actually indicates the firmware
has halted. Handle this bit by giving a more meaningful error message.

Reviewed-by: Hante Meuleman <[email protected]>
Reviewed-by: Pieter-Paul Giesberts <[email protected]>
Reviewed-by: Franky Lin <[email protected]>
Signed-off-by: Arend van Spriel <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
7 years agoMerge branch 'akpm' (patches from Andrew)
Linus Torvalds [Fri, 10 Nov 2017 02:26:51 +0000 (18:26 -0800)]
Merge branch 'akpm' (patches from Andrew)

Merge misc fixes from Andrew Morton:
 "2 fixes"

* emailed patches from Andrew Morton <[email protected]>:
  MAINTAINERS: update TPM driver infrastructure changes
  sysctl: add register_sysctl() dummy helper

7 years agoMAINTAINERS: update TPM driver infrastructure changes
Jarkko Sakkinen [Thu, 9 Nov 2017 21:38:21 +0000 (13:38 -0800)]
MAINTAINERS: update TPM driver infrastructure changes

[[email protected]: alpha-sort CREDITS, per Randy]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Jarkko Sakkinen <[email protected]>
Cc: Marcel Selhorst <[email protected]>
Cc: Ashley Lai <[email protected]>
Cc: Mimi Zohar <[email protected]>
Cc: Jarkko Sakkinen <[email protected]>
Cc: Boris Brezillon <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Håvard Skinnemoen <[email protected]>
Cc: Martin Kepplinger <[email protected]>
Cc: Pavel Machek <[email protected]>
Cc: Geert Uytterhoeven <[email protected]>
Cc: Hans-Christian Noren Egtvedt <[email protected]>
Cc: Arnaldo Carvalho de Melo <[email protected]>
Cc: Gertjan van Wingerde <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>
Cc: David S. Miller <[email protected]>
Cc: Mauro Carvalho Chehab <[email protected]>
Cc: Randy Dunlap <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
7 years agosysctl: add register_sysctl() dummy helper
Arnd Bergmann [Thu, 9 Nov 2017 21:38:18 +0000 (13:38 -0800)]
sysctl: add register_sysctl() dummy helper

register_sysctl() has been around for five years with commit
fea478d4101a ("sysctl: Add register_sysctl for normal sysctl users") but
now that arm64 started using it, I ran into a compile error:

  arch/arm64/kernel/armv8_deprecated.c: In function 'register_insn_emulation_sysctl':
  arch/arm64/kernel/armv8_deprecated.c:257:2: error: implicit declaration of function 'register_sysctl'

This adds a inline function like we already have for
register_sysctl_paths() and register_sysctl_table().

Link: http://lkml.kernel.org/r/[email protected]
Fixes: 38b9aeb32fa7 ("arm64: Port deprecated instruction emulation to new sysctl interface")
Signed-off-by: Arnd Bergmann <[email protected]>
Reviewed-by: Dave Martin <[email protected]>
Acked-by: Kees Cook <[email protected]>
Acked-by: Will Deacon <[email protected]>
Cc: Catalin Marinas <[email protected]>
Cc: "Luis R. Rodriguez" <[email protected]>
Cc: Alex Benne <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Cc: "Eric W. Biederman" <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
7 years agoMerge tag 'pci-v4.14-fixes-7' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaa...
Linus Torvalds [Fri, 10 Nov 2017 01:43:27 +0000 (17:43 -0800)]
Merge tag 'pci-v4.14-fixes-7' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci

Pull PCI maintainership updates from Bjorn Helgaas:
 "Update MAINTAINERS for HiSilicon, Microsemi Switchtec, and native host
  bridge drivers (Gabriele Paoloni, Sebastian Andrzej Siewior).

  Note that starting with changes intended for v4.16, Lorenzo Pieralisi
  will maintain the drivers/pci/{dwc,endpoint,host} directories. My
  intent is to continue to merge those changes via my tree, so this
  should be transparent to you"

* tag 'pci-v4.14-fixes-7' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  MAINTAINERS: Add Lorenzo Pieralisi for PCI host bridge drivers
  MAINTAINERS: Remove Gabriele Paoloni as HiSilicon PCI maintainer
  MAINTAINERS: Remove Stephen Bates as Microsemi Switchtec maintainer

7 years agoMerge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm
Linus Torvalds [Fri, 10 Nov 2017 01:41:39 +0000 (17:41 -0800)]
Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm

Pull ARM fix from Russell King:
 "Last ARM fix for 4.14.

  This plugs a hole in dump_instr(), which, with certain conditions
  satisfied, can dump instructions from kernel space"

* 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
  ARM: 8720/1: ensure dump_instr() checks addr_limit

7 years agoMerge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
David S. Miller [Fri, 10 Nov 2017 01:00:18 +0000 (10:00 +0900)]
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Simple cases of overlapping changes in the packet scheduler.

Must easier to resolve this time.

Which probably means that I screwed it up somehow.

Signed-off-by: David S. Miller <[email protected]>
7 years agoNFC: Add NFC_CMD_DEACTIVATE_TARGET support
Mark Greer [Fri, 16 Jun 2017 03:34:22 +0000 (20:34 -0700)]
NFC: Add NFC_CMD_DEACTIVATE_TARGET support

Once an NFC target (i.e., a tag) is found, it remains active until
there is a failure reading or writing it (often caused by the target
moving out of range).  While the target is active, the NFC adapter
and antenna must remain powered.  This wastes power when the target
remains in range but the client application no longer cares whether
it is there or not.

To mitigate this, add a new netlink command that allows userspace
to deactivate an active target.  When issued, this command will cause
the NFC subsystem to act as though the target was moved out of range.
Once the command has been executed, the client application can power
off the NFC adapter to reduce power consumption.

Signed-off-by: Mark Greer <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>
7 years agoNFC: digital: Abort cmd when deactivating target
Mark Greer [Fri, 16 Jun 2017 03:34:21 +0000 (20:34 -0700)]
NFC: digital: Abort cmd when deactivating target

When deactivating an active target, the outstanding command should
be aborted.

Signed-off-by: Mark Greer <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>
7 years agoMerge tag 'pm-final-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael...
Linus Torvalds [Thu, 9 Nov 2017 19:16:28 +0000 (11:16 -0800)]
Merge tag 'pm-final-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull final power management fixes from Rafael Wysocki:
 "These fix a regression in the schedutil cpufreq governor introduced by
  a recent change and blacklist Dell XPS13 9360 from using the Low Power
  S0 Idle _DSM interface which triggers serious problems on one of these
  machines.

  Specifics:

   - Prevent the schedutil cpufreq governor from using the utilization
     of a wrong CPU in some cases which started to happen after one of
     the recent changes in it (Chris Redpath).

   - Blacklist Dell XPS13 9360 from using the Low Power S0 Idle _DSM
     interface as that causes serious issue (related to NVMe) to appear
     on one of these machines, even though the other Dells XPS13 9360 in
     somewhat different HW configurations behave correctly (Rafael
     Wysocki)"

* tag 'pm-final-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI / PM: Blacklist Low Power S0 Idle _DSM for Dell XPS13 9360
  cpufreq: schedutil: Examine the correct CPU when we update util

7 years agoMerge tag 'sound-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Linus Torvalds [Thu, 9 Nov 2017 17:58:11 +0000 (09:58 -0800)]
Merge tag 'sound-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "The amount of the changes isn't as quite small as wished, nevertheless
  they are straight fixes that deserve merging to 4.14 final.

  Most of fixes are about ALSA core bugs spotted by fuzzer: a follow-up
  fix for the previous nested rwsem patch, a fix to avoid the resource
  hogs due to too many concurrent ALSA timer invocations, and a fix for
  a crash with SYSEX MIDI transfer over OSS sequencer emulation that is
  used by none but fuzzer.

  The rest are usual HD-audio and USB-audio device-specific quirks,
  which are safe to apply"

* tag 'sound-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda - fix headset mic problem for Dell machines with alc274
  ALSA: seq: Fix OSS sysex delivery in OSS emulation
  ALSA: seq: Avoid invalid lockdep class warning
  ALSA: timer: Limit max instances per timer
  ALSA: usb-audio: support new Amanero Combo384 firmware version

7 years agoMerge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Linus Torvalds [Thu, 9 Nov 2017 17:31:34 +0000 (09:31 -0800)]
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix use-after-free in IPSEC input parsing, desintation address
    pointer was loaded before pskb_may_pull() which can change the SKB
    data pointers. From Florian Westphal.

 2) Stack out-of-bounds read in xfrm_state_find(), from Steffen
    Klassert.

 3) IPVS state of SKB is not properly reset when moving between
    namespaces, from Ye Yin.

 4) Fix crash in asix driver suspend and resume, from Andrey Konovalov.

 5) Don't deliver ipv6 l2tp tunnel packets to ipv4 l2tp tunnels, and
    vice versa, from Guillaume Nault.

 6) Fix DSACK undo on non-dup ACKs, from Priyaranjan Jha.

 7) Fix regression in bond_xmit_hash()'s behavior after the TCP port
    selection changes back in 4.2, from Hangbin Liu.

 8) Two divide by zero bugs in USB networking drivers when parsing
    descriptors, from Bjorn Mork.

 9) Fix bonding slaves being stuck in BOND_LINK_FAIL state, from Jay
    Vosburgh.

10) Missing skb_reset_mac_header() in qmi_wwan, from Kristian Evensen.

11) Fix the destruction of tc action object races properly, from Cong
    Wang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (31 commits)
  cls_u32: use tcf_exts_get_net() before call_rcu()
  cls_tcindex: use tcf_exts_get_net() before call_rcu()
  cls_rsvp: use tcf_exts_get_net() before call_rcu()
  cls_route: use tcf_exts_get_net() before call_rcu()
  cls_matchall: use tcf_exts_get_net() before call_rcu()
  cls_fw: use tcf_exts_get_net() before call_rcu()
  cls_flower: use tcf_exts_get_net() before call_rcu()
  cls_flow: use tcf_exts_get_net() before call_rcu()
  cls_cgroup: use tcf_exts_get_net() before call_rcu()
  cls_bpf: use tcf_exts_get_net() before call_rcu()
  cls_basic: use tcf_exts_get_net() before call_rcu()
  net_sched: introduce tcf_exts_get_net() and tcf_exts_put_net()
  Revert "net_sched: hold netns refcnt for each action"
  net: usb: asix: fill null-ptr-deref in asix_suspend
  Revert "net: usb: asix: fill null-ptr-deref in asix_suspend"
  qmi_wwan: Add missing skb_reset_mac_header-call
  bonding: fix slave stuck in BOND_LINK_FAIL state
  qrtr: Move to postcore_initcall
  net: qmi_wwan: fix divide by 0 on bad descriptors
  net: cdc_ether: fix divide by 0 on bad descriptors
  ...

7 years agoMerge tag 'timers-conversion-next5' of git://git.kernel.org/pub/scm/linux/kernel...
Thomas Gleixner [Thu, 9 Nov 2017 10:42:52 +0000 (11:42 +0100)]
Merge tag 'timers-conversion-next5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into timers/core

Pull the 5th batch of timer conversions from Kees Cook

 - qla2xxx patches have passed testing
 - ipvs patches have been Acked
 - prepare for more tree-wide DEFINE_TIMER() changes

7 years agorbd: use GFP_NOIO for parent stat and data requests
Ilya Dryomov [Mon, 6 Nov 2017 10:33:36 +0000 (11:33 +0100)]
rbd: use GFP_NOIO for parent stat and data requests

rbd_img_obj_exists_submit() and rbd_img_obj_parent_read_full() are on
the writeback path for cloned images -- we attempt a stat on the parent
object to see if it exists and potentially read it in to call copyup.
GFP_NOIO should be used instead of GFP_KERNEL here.

Cc: [email protected]
Link: http://tracker.ceph.com/issues/22014
Signed-off-by: Ilya Dryomov <[email protected]>
Reviewed-by: David Disseldorp <[email protected]>
7 years agoALSA: hda - fix headset mic problem for Dell machines with alc274
Hui Wang [Thu, 9 Nov 2017 00:48:08 +0000 (08:48 +0800)]
ALSA: hda - fix headset mic problem for Dell machines with alc274

Confirmed with Kailang of Realtek, the pin 0x19 is for Headset Mic, and
the pin 0x1a is for Headphone Mic, he suggested to apply
ALC269_FIXUP_DELL1_MIC_NO_PRESENCE to fix this problem. And we
verified applying this FIXUP can fix this problem.

Cc: <[email protected]>
Cc: Kailang Yang <[email protected]>
Signed-off-by: Hui Wang <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
This page took 0.120134 seconds and 4 git commands to generate.