summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-03-26of/Documentation: Specify local APIC ID in "reg"Ivan Gorinov
Use the "reg" property to specify the processor's local APIC ID instead of setting it to the CPU node index in Device Tree. Local APIC ID is assigned by hardware and visible in the APIC ID register. Some processor models allow APIC ID to be changed by software, but CPUID instruction executed with %eax = 0x0b always returns the initial ID in %edx. Local APIC ID does not match the node index in many systems. Signed-off-by: Ivan Gorinov <ivan.gorinov@intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Reviewed-by: Rob Herring <robh@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Rob Herring <robh+dt@kernel.org> Cc: Frank Rowand <frowand.list@gmail.com> Link: https://lkml.kernel.org/r/4b1a471a56ac0ebd7510f4759afce9104595d6da.1521753738.git.ivan.gorinov@intel.com
2018-03-26m68k/mac: Remove bogus "FIXME" commentFinn Thain
This code works fine. The comment is misleading so remove it. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2018-03-26m68k/mac: Enable RTC for 100-series PowerBooksFinn Thain
According to Apple's Developer Notes, all of the early PowerBook models have their RTC connected to VIA1. Use the VIA clock ops as appropriate. This was tested on a PowerBook 170. Don't use the VIA ops when not appropriate. Calling unimplemented clock or PRAM getter or setter ops can now result in an error instead of failing silently. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2018-03-26m68k/mac: Clean up whitespace and remove redundant parenthesesFinn Thain
Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2018-03-26pinctrl/amd: poll InterruptEnable bits in enable_irqDaniel Kurtz
In certain cases interrupt enablement will be delayed relative to when the InterruptEnable bits are written. One example of this is when a GPIO's "debounce" logice is first enabled. After enabling debounce, there is a 900 us "warm up" period during which InterruptEnable[0] (bit 11) will read as 0 despite being written 1. During this time InterruptSts will not be updated, nor will interrupts be delivered, even if the GPIO's interrupt configuration has been written to the register. To work around this delay, poll the InterruptEnable bits after setting them to ensure interrupts have truly been enabled in hardware before returning from the irq_enable handler. Signed-off-by: Daniel Kurtz <djkurtz@chromium.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2018-03-26pinctrl: ocelot: fix gpio directionAlexandre Belloni
Bits have to be cleared in DEVCPU_GCB:GPIO:GPIO_OE for input and set for output. ocelot_gpio_set_direction() got it wrong and this went unnoticed when the driver was reworked. Reported-by: Gregory Clement <gregory.clement@bootlin.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2018-03-26pinctrl: mtk: fix check warnings.Zhiyong Tao
This patch fixes check warnings. Signed-off-by: Zhiyong Tao <zhiyong.tao@mediatek.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2018-03-26pintcrl: mtk: support bias-disable of generic and special pins simultaneouslyZhiyong Tao
For generic pins, parameter "arg" is 0 or 1. For special pins, bias-disable is set by R0R1, so we need transmited "00" to set bias-disable When we set "bias-disable" as high-z property, the parameter should be "MTK_PUPD_SET_R1R0_00". Signed-off-by: Zhiyong Tao <zhiyong.tao@mediatek.com> Reviewed-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2018-03-26pinctrl: add mt2712 pinctrl driverZhiyong Tao
The commit includes mt2712 pinctrl driver. Signed-off-by: Zhiyong Tao <zhiyong.tao@mediatek.com> Reviewed-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2018-03-26pinctrl: pinctrl-single: Fix pcs_request_gpio() when bits_per_mux != 0David Lechner
This fixes pcs_request_gpio() in the pinctrl-single driver when bits_per_mux != 0. It appears this was overlooked when the multiple pins per register feature was added. Fixes: 4e7e8017a80e ("pinctrl: pinctrl-single: enhance to configure multiple pins of different modules") Signed-off-by: David Lechner <david@lechnology.com> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2018-03-26Merge branch 'bpf-verifier-log-btf-prep'Daniel Borkmann
Martin KaFai Lau says: ==================== This patch set has some changes and clean-up works for the bpf_verifier_log. They are the prep works for the BTF (BPF Type Format). ==================== Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-03-26bpf: Add bpf_verifier_vlog() and bpf_verifier_log_needed()Martin KaFai Lau
The BTF (BPF Type Format) verifier needs to reuse the current BPF verifier log. Hence, it requires the following changes: (1) Expose log_write() in verifier.c for other users. Its name is renamed to bpf_verifier_vlog(). (2) The BTF verifier also needs to check 'log->level && log->ubuf && !bpf_verifier_log_full(log);' independently outside of the current log_write(). It is because the BTF verifier will do one-check before making multiple calls to btf_verifier_vlog to log the details of a type. Hence, this check is also re-factored to a new function bpf_verifier_log_needed(). Since it is re-factored, we can check it before va_start() in the current bpf_verifier_log_write() and verbose(). Signed-off-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Alexei Starovoitov <ast@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-03-26bpf: Rename bpf_verifer_logMartin KaFai Lau
bpf_verifer_log => bpf_verifier_log Signed-off-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Alexei Starovoitov <ast@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-03-26x86/apic: Finish removing unused callbacksDavid Rientjes
The ->cpu_mask_to_apicid() and ->vector_allocation_domain() callbacks are now unused, so remove them. Signed-off-by: David Rientjes <rientjes@google.com> Cc: Juergen Gross <jgross@suse.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Fixes: baab1e84b112 ("x86/apic: Remove unused callbacks") Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1803251403540.80485@chino.kir.corp.google.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
2018-03-25Merge tag 'wireless-drivers-next-for-davem-2018-03-24' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 4.17 The biggest changes are the bluetooth related patches to the rsi driver. It adds a new bluetooth driver which communicates directly with the wireless driver and the interface is defined in include/net/rsi_91x.h. Major changes: wl1251 * read the MAC address from the NVS file rtlwifi * enable mac80211 fast-tx support mt76 * add capability to select tx/rx antennas mt7601 * let mac80211 validate rx CCMP Packet Number (PN) rsi * bluetooth: add new btrsi driver * btcoex support with the new btrsi driver ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25Merge tag 'wireless-drivers-for-davem-2018-03-24' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.16 Some fixes for 4.16, only for iwlwifi and brcmfmac this time. All pretty small. iwlwifi * fix an issue with the multicast queue * fix IGTK handling * fix some missing return value checks * add support for a HW workaround for issues on some platforms * a couple of fixes for channel-switch * a few fixes for the aggregation handling code brcmfmac * drop Inter-Access Point Protocol packets by default * fix check for ISO3166 regulatory code ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25tipc: tipc_disc_addr_trial_msg() can be statickbuild test robot
Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values") Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Acked-by: Jon Maloy jon.maloy@ericsson.com Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25ipv6: the entire IPv6 header chain must fit the first fragmentPaolo Abeni
While building ipv6 datagram we currently allow arbitrary large extheaders, even beyond pmtu size. The syzbot has found a way to exploit the above to trigger the following splat: kernel BUG at ./include/linux/skbuff.h:2073! invalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 4230 Comm: syzkaller672661 Not tainted 4.16.0-rc2+ #326 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__skb_pull include/linux/skbuff.h:2073 [inline] RIP: 0010:__ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636 RSP: 0018:ffff8801bc18f0f0 EFLAGS: 00010293 RAX: ffff8801b17400c0 RBX: 0000000000000738 RCX: ffffffff84f01828 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801b415ac18 RBP: ffff8801bc18f360 R08: ffff8801b4576844 R09: 0000000000000000 R10: ffff8801bc18f380 R11: ffffed00367aee4e R12: 00000000000000d6 R13: ffff8801b415a740 R14: dffffc0000000000 R15: ffff8801b45767c0 FS: 0000000001535880(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000b000 CR3: 00000001b4123001 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ip6_finish_skb include/net/ipv6.h:969 [inline] udp_v6_push_pending_frames+0x269/0x3b0 net/ipv6/udp.c:1073 udpv6_sendmsg+0x2a96/0x3400 net/ipv6/udp.c:1343 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:764 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg+0xca/0x110 net/socket.c:640 ___sys_sendmsg+0x320/0x8b0 net/socket.c:2046 __sys_sendmmsg+0x1ee/0x620 net/socket.c:2136 SYSC_sendmmsg net/socket.c:2167 [inline] SyS_sendmmsg+0x35/0x60 net/socket.c:2162 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x4404c9 RSP: 002b:00007ffdce35f948 EFLAGS: 00000217 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004404c9 RDX: 0000000000000003 RSI: 0000000020001f00 RDI: 0000000000000003 RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8 R10: 0000000020000080 R11: 0000000000000217 R12: 0000000000401df0 R13: 0000000000401e80 R14: 0000000000000000 R15: 0000000000000000 Code: ff e8 1d 5e b9 fc e9 15 e9 ff ff e8 13 5e b9 fc e9 44 e8 ff ff e8 29 5e b9 fc e9 c0 e6 ff ff e8 3f f3 80 fc 0f 0b e8 38 f3 80 fc <0f> 0b 49 8d 87 80 00 00 00 4d 8d 87 84 00 00 00 48 89 85 20 fe RIP: __skb_pull include/linux/skbuff.h:2073 [inline] RSP: ffff8801bc18f0f0 RIP: __ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636 RSP: ffff8801bc18f0f0 As stated by RFC 7112 section 5: When a host fragments an IPv6 datagram, it MUST include the entire IPv6 Header Chain in the First Fragment. So this patch addresses the issue dropping datagrams with excessive extheader length. It also updates the error path to report to the calling socket nonnegative pmtu values. The issue apparently predates git history. v1 -> v2: cleanup error path, as per Eric's suggestion Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+91e6f9932ff122fa4410@syzkaller.appspotmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25netlink: make sure nladdr has correct size in netlink_connect()Alexander Potapenko
KMSAN reports use of uninitialized memory in the case when |alen| is smaller than sizeof(struct sockaddr_nl), and therefore |nladdr| isn't fully copied from the userspace. Signed-off-by: Alexander Potapenko <glider@google.com> Fixes: 1da177e4c3f41524 ("Linux-2.6.12-rc2") Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25ibmvnic: Potential NULL dereference in clean_one_tx_pool()Dan Carpenter
There is an && vs || typo here, which potentially leads to a NULL dereference. Fixes: e9e1e97884b7 ("ibmvnic: Update TX pool cleaning routine") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25cxgb4: support new ISSI flash partsGanesh Goudar
Add support for new 32MB and 64MB ISSI (Integrated Silicon Solution, Inc.) FLASH parts. Signed-off-by: Casey Leedom <leedom@chelsio.com> Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25cxgb4: depend on firmware event for link statusGanesh Goudar
Depend on the firmware sending us link status changes, rather than assuming that the link goes down upon L1 configuration. Signed-off-by: Casey Leedom <leedom@chelsio.com> Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25cxgb4: copy vlan_id in ndo_get_vf_configArjun Vynipadath
Copy vlan_id to get it displayed in vf info. Signed-off-by: Arjun Vynipadath <arjun@chelsio.com> Signed-off-by: Casey Leedom <leedom@chelsio.com> Signed-off-by: Ganesh Goudhar <ganeshgr@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25lan78xx: Set ASD in MAC_CR when EEE is enabled.Raghuram Chary J
Description: EEE does not work with lan7800 when AutoSpeed is not set. (This can happen when EEPROM is not populated or configured incorrectly) Root-Cause: When EEE is enabled, the mac config register ASD is not set i.e. in default state, causing EEE fail. Fix: Set the register when eeprom is not present. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Signed-off-by: Raghuram Chary J <raghuramchary.jallipalli@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25net/ipv4: disable SMC TCP option with SYN CookiesHans Wippel
Currently, the SMC experimental TCP option in a SYN packet is lost on the server side when SYN Cookies are active. However, the corresponding SYNACK sent back to the client contains the SMC option. This causes an inconsistent view of the SMC capabilities on the client and server. This patch disables the SMC option in the SYNACK when SYN Cookies are active to avoid this issue. Fixes: 60e2a7780793b ("tcp: TCP experimental option for SMC") Signed-off-by: Hans Wippel <hwippel@linux.vnet.ibm.com> Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25cxgb4: Setup FW queues before registering netdevArjun Vynipadath
When NetworkManager is enabled, there are chances that interface up is called even before probe completes. This means we have not yet allocated the FW sge queues, hence rest of ingress queue allocation wont be proper. Fix this by calling setup_fw_sge_queues() before register_netdev(). Fixes: 0fbc81b3ad51 ('chcr/cxgb4i/cxgbit/RDMA/cxgb4: Allocate resources dynamically for all cxgb4 ULD's') Signed-off-by: Arjun Vynipadath <arjun@chelsio.com> Signed-off-by: Casey Leedom <leedom@chelsio.com> Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25Merge branch 'broadcom-Adaptive-interrupt-coalescing'David S. Miller
Florian Fainelli says: ==================== net: broadcom: Adaptive interrupt coalescing This patch series adds adaptive interrupt coalescing for the Gigabit Ethernet drivers SYSTEMPORT and GENET. This really helps lower the interrupt count and system load, as measured by vmstat for a Gigabit TCP RX session: SYSTEMPORT: without: 1 0 0 192188 0 25472 0 0 0 0 122100 38870 1 42 57 0 0 [ ID] Interval Transfer Bandwidth [ 4] 0.0-10.0 sec 1.03 GBytes 884 Mbits/sec with: 1 0 0 192288 0 25468 0 0 0 0 58806 44401 0 100 0 0 0 [ 5] 0.0-10.0 sec 1.04 GBytes 888 Mbits/sec GENET: without: 1 0 0 1170404 0 25420 0 0 0 0 130785 63402 2 85 12 0 0 [ ID] Interval Transfer Bandwidth [ 4] 0.0-10.0 sec 1.04 GBytes 888 Mbits/sec with: 1 0 0 1170560 0 25420 0 0 0 0 50610 48477 0 100 0 0 0 [ 5] 0.0-10.0 sec 1.05 GBytes 899 Mbits/sec Please look at the implementation and let me know if you see any problems, this was largely inspired by bnxt_en. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25net: bcmgenet: Add support for adaptive RX coalescingFlorian Fainelli
Unlike the moder modern SYSTEMPORT hardware, we do not have a configurable TDMA timeout, which limits us to implement adaptive RX interrupt coalescing only. We have each of our RX rings implement a bcmgenet_net_dim structure which holds an interrupt counter, number of packets, bytes, and a container for a net_dim instance. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25net: systemport: Implement adaptive interrupt coalescingFlorian Fainelli
Implement support for adaptive RX and TX interrupt coalescing using net_dim. We have each of our TX ring and our single RX ring implement a bcm_sysport_net_dim structure which holds an interrupt counter, number of packets, bytes, and a container for a net_dim instance. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25Merge branch 'mv88e6xxx-module-reloading'David S. Miller
Andrew Lunn says: ==================== Fixes to allow mv88e6xxx module to be reloaded As reported by Uwe Kleine-König, the interrupt trigger is first configured by DT and then reconfigured to edge. This results in a failure on EPROBE_DEFER, or if the module is unloaded and reloaded. A second crash happens on module reload due to a missing call to the common IRQ free code when using polled interrupts. With these fixes in place, it becomes possible to load and unload the kernel modules a few times without it crashing. v2: Fix the ü in Künig a couple of times v3: But the ü should be an ö! ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25net: dsa: mv88e6xxx: Call the common IRQ free codeAndrew Lunn
When free'ing the polled IRQs, call the common irq free code. Otherwise the interrupts are left registered, and when we come to load the driver a second time, we get an Opps. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25net: dsa: mv88e6xxx: Use the DT IRQ trigger modeAndrew Lunn
By calling request_threaded_irq() with the flag IRQF_TRIGGER_FALLING we override the trigger mode provided in device tree. And the interrupt is actually active low, which is what all the current device tree descriptions use. Suggested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Lunn <andrew@lunn.ch> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25tc-testing: updated police, mirred, skbedit and skbmod with more testsRoman Mashak
Added extra test cases for control actions (reclassify, pipe etc.), cookies, max index value and police args sanity check. Signed-off-by: Roman Mashak <mrv@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-26Merge branch 'drm-next-4.17' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-next Last pull for 4.17. Highlights: - Vega12 support - A few more bug fixes and cleanups for powerplay * 'drm-next-4.17' of git://people.freedesktop.org/~agd5f/linux: (77 commits) drm/amd/pp: clean header file hwmgr.h drm/amd/pp: use mlck_table.count for array loop index limit drm/amdgpu: Add an ATPX quirk for hybrid laptop drm/amdgpu: fix spelling mistake: "asssert" -> "assert" drm/amd/pp: Add new asic support in pp_psm.c drm/amd/pp: Clean up powerplay code on Vega12 drm/amd/pp: Add smu irq handlers for legacy asics drm/amd/pp: Fix set wrong temperature range on smu7 drm/amdgpu: Don't change preferred domian when fallback GTT v5 drm/amdgpu: Fix NULL ptr on driver unload due to init failure. drm/amdgpu: fix "mitigate workaround for i915" drm/amd/pp: Add smu irq handlers in sw_init instand of hw_init drm/amd/pp: Refine register_thermal_interrupt function drm/amdgpu: Remove wrapper layer of cgs irq handling drm/amd/powerplay: Return per DPM level clock drm/amd/powerplay: Remove the SOC floor voltage setting drm/amdgpu: no job timeout setting on compute queues drm/amdgpu: add vega12 pci ids (v2) drm/amd/powerplay: add the hw manager for vega12 (v4) drm/amd/powerplay: add the smu manager for vega12 (v4) ...
2018-03-25Linux 4.16-rc7v4.16-rc7Linus Torvalds
2018-03-25Merge branch 'hv_netvsc-Fix-improve-RX-path-error-handling'David S. Miller
Haiyang Zhang says: ==================== hv_netvsc: Fix/improve RX path error handling Fix the status code returned to the host. Also add range check for rx packet offset and length. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25hv_netvsc: Add range checking for rx packet offset and lengthHaiyang Zhang
This patch adds range checking for rx packet offset and length. It may only happen if there is a host side bug. Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25hv_netvsc: Fix the return status in RX pathHaiyang Zhang
As defined in hyperv_net.h, the NVSP_STAT_SUCCESS is one not zero. Some functions returns 0 when it actually means NVSP_STAT_SUCCESS. This patch fixes them. In netvsc_receive(), it puts the last RNDIS packet's receive status for all packets in a vmxferpage which may contain multiple RNDIS packets. This patch puts NVSP_STAT_FAIL in the receive completion if one of the packets in a vmxferpage fails. Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25Merge branch 'net-permit-skb_segment-on-head_frag-frag_list-skb'David S. Miller
Yonghong Song says: ==================== net: permit skb_segment on head_frag frag_list skb One of our in-house projects, bpf-based NAT, hits a kernel BUG_ON at function skb_segment(), line 3667. The bpf program attaches to clsact ingress, calls bpf_skb_change_proto to change protocol from ipv4 to ipv6 or from ipv6 to ipv4, and then calls bpf_redirect to send the changed packet out. ... 3665 while (pos < offset + len) { 3666 if (i >= nfrags) { 3667 BUG_ON(skb_headlen(list_skb)); ... The triggering input skb has the following properties: list_skb = skb->frag_list; skb->nfrags != NULL && skb_headlen(list_skb) != 0 and skb_segment() is not able to handle a frag_list skb if its headlen (list_skb->len - list_skb->data_len) is not 0. Patch #1 provides a simple solution to avoid BUG_ON. If list_skb->head_frag is true, its page-backed frag will be processed before the list_skb->frags. Patch #2 provides a test case in test_bpf module which constructs a skb and calls skb_segment() directly. The test case is able to trigger the BUG_ON without Patch #1. The patch has been tested in the following setup: ipv6_host <-> nat_server <-> ipv4_host where nat_server has a bpf program doing ipv4<->ipv6 translation and forwarding through clsact hook bpf_skb_change_proto. Changelog: v5 -> v6: . Added back missed BUG_ON(!nfrags) for zero skb_headlen(skb) case, plus a couple of cosmetic changes, from Alexander. v4 -> v5: . Replace local variable head_frag with a static inline function skb_head_frag_to_page_desc which gets the head_frag on-demand. This makes code more readable and also does not increase the stack size, from Alexander. . Remove the "if(nfrags)" guard for skb_orphan_frags and skb_zerocopy_clone as I found that they can handle zero-frag skb (with non-zero skb_headlen(skb)) properly. . Properly release segment list from skb_segment() in the test, from Eric. v3 -> v4: . Remove dynamic memory allocation and use rewinding for both index and frag to remove one branch in fast path, from Alexander. . Fix a bunch of issues in test_bpf skb_segment() test, including proper way to allocate skb, proper function argument for skb_add_rx_frag and not freeint skb, etc., from Eric. v2 -> v3: . Use starting frag index -1 (instead of 0) to special process head_frag before other frags in the skb, from Alexander Duyck. v1 -> v2: . Removed never-hit BUG_ON, spotted by Linyu Yuan. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25net: bpf: add a test for skb_segment in test_bpf moduleYonghong Song
Without the previous commit, "modprobe test_bpf" will have the following errors: ... [ 98.149165] ------------[ cut here ]------------ [ 98.159362] kernel BUG at net/core/skbuff.c:3667! [ 98.169756] invalid opcode: 0000 [#1] SMP PTI [ 98.179370] Modules linked in: [ 98.179371] test_bpf(+) ... which triggers the bug the previous commit intends to fix. The skbs are constructed to mimic what mlx5 may generate. The packet size/header may not mimic real cases in production. But the processing flow is similar. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25net: permit skb_segment on head_frag frag_list skbYonghong Song
One of our in-house projects, bpf-based NAT, hits a kernel BUG_ON at function skb_segment(), line 3667. The bpf program attaches to clsact ingress, calls bpf_skb_change_proto to change protocol from ipv4 to ipv6 or from ipv6 to ipv4, and then calls bpf_redirect to send the changed packet out. 3472 struct sk_buff *skb_segment(struct sk_buff *head_skb, 3473 netdev_features_t features) 3474 { 3475 struct sk_buff *segs = NULL; 3476 struct sk_buff *tail = NULL; ... 3665 while (pos < offset + len) { 3666 if (i >= nfrags) { 3667 BUG_ON(skb_headlen(list_skb)); 3668 3669 i = 0; 3670 nfrags = skb_shinfo(list_skb)->nr_frags; 3671 frag = skb_shinfo(list_skb)->frags; 3672 frag_skb = list_skb; ... call stack: ... #1 [ffff883ffef03558] __crash_kexec at ffffffff8110c525 #2 [ffff883ffef03620] crash_kexec at ffffffff8110d5cc #3 [ffff883ffef03640] oops_end at ffffffff8101d7e7 #4 [ffff883ffef03668] die at ffffffff8101deb2 #5 [ffff883ffef03698] do_trap at ffffffff8101a700 #6 [ffff883ffef036e8] do_error_trap at ffffffff8101abfe #7 [ffff883ffef037a0] do_invalid_op at ffffffff8101acd0 #8 [ffff883ffef037b0] invalid_op at ffffffff81a00bab [exception RIP: skb_segment+3044] RIP: ffffffff817e4dd4 RSP: ffff883ffef03860 RFLAGS: 00010216 RAX: 0000000000002bf6 RBX: ffff883feb7aaa00 RCX: 0000000000000011 RDX: ffff883fb87910c0 RSI: 0000000000000011 RDI: ffff883feb7ab500 RBP: ffff883ffef03928 R8: 0000000000002ce2 R9: 00000000000027da R10: 000001ea00000000 R11: 0000000000002d82 R12: ffff883f90a1ee80 R13: ffff883fb8791120 R14: ffff883feb7abc00 R15: 0000000000002ce2 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #9 [ffff883ffef03930] tcp_gso_segment at ffffffff818713e7 Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-26powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRsNicholas Piggin
The SLB bad address handler's trap number fixup does not preserve the low bit that indicates nonvolatile GPRs have not been saved. This leads save_nvgprs to skip saving them, and subsequent functions and return from interrupt will think they are saved. This causes kernel branch-to-garbage debugging to not have correct registers, can also cause userspace to have its registers clobbered after a segfault. Fixes: f0f558b131db ("powerpc/mm: Preserve CFAR value on SLB miss caused by access to bogus address") Cc: stable@vger.kernel.org # v4.9+ Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2018-03-25Merge branch '10GbE' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== 10GbE Intel Wired LAN Driver Updates 2018-03-23 This series contains updates to ixgbe and ixgbevf only. Paul adds status register reads to reduce a potential race condition where registers can read 0xFFFFFFFF during a PCI reset, which in turn causes the driver to remove the adapter. Then fixes an assignment operation with an "OR" operation. Shannon Nelson provides several IPsec offload cleanups to ixgbe, as well as a patch to enable TSO with IPsec offload. Tony provides the much anticipated XDP support for ixgbevf. Currently, pass, drop and XDP_TX actions are supported, as well as meta data and stats reporting. Björn Töpel tweaks the page counting for XDP_REDIRECT, since a page can have its reference count decreased via the xdp_do_redirect() call. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25Merge branch 'liquidio-Tx-queue-cleanup'David S. Miller
Intiyaz Basha says: ==================== liquidio: Tx queue cleanup Moved some common function to octeon_network.h Removed some unwanted functions and checks. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25liquidio: Renamed txqs_start to start_txqsIntiyaz Basha
For consistency renaming txqs_start to start_txqs Signed-off-by: Intiyaz Basha <intiyaz.basha@cavium.com> Acked-by: Derek Chickles <derek.chickles@cavium.com> Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25liquidio: Renamed txqs_stop to stop_txqsIntiyaz Basha
For consistency renaming txqs_stop to stop_txqs Signed-off-by: Intiyaz Basha <intiyaz.basha@cavium.com> Acked-by: Derek Chickles <derek.chickles@cavium.com> Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25liquidio: Renamed txqs_wake to wake_txqsIntiyaz Basha
For consistency renaming txqs_wake to wake_txqs Signed-off-by: Intiyaz Basha <intiyaz.basha@cavium.com> Acked-by: Derek Chickles <derek.chickles@cavium.com> Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25liquidio: Function call skb_iq for deriving queue from skbIntiyaz Basha
Using skb_iq function for deriving queue from skb Signed-off-by: Intiyaz Basha <intiyaz.basha@cavium.com> Acked-by: Derek Chickles <derek.chickles@cavium.com> Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25liquidio: Removed one line function wake_qIntiyaz Basha
Removing one line function wake_q Signed-off-by: Intiyaz Basha <intiyaz.basha@cavium.com> Acked-by: Derek Chickles <derek.chickles@cavium.com> Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-25liquidio: Removed one line function stop_qIntiyaz Basha
Removing one line function stop_q Signed-off-by: Intiyaz Basha <intiyaz.basha@cavium.com> Acked-by: Derek Chickles <derek.chickles@cavium.com> Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit (git 2.34.1) at 2025-09-15 17:54:13 +0000