summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-12-20bpf: skb_verdict, support SK_PASS on RX BPF pathJohn Fastabend
Add SK_PASS verdict support to SK_SKB_VERDICT programs. Now that support for redirects exists we can implement SK_PASS as a redirect to the same socket. This simplifies the BPF programs and avoids an extra map lookup on RX path for simple visibility cases. Further, reduces user (BPF programmer in this context) confusion when their program drops skb due to lack of support. Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20bpf: skmsg, replace comments with BUILD bugJohn Fastabend
Enforce comment on structure layout dependency with a BUILD_BUG_ON to ensure the condition is maintained. Suggested-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20bpf: sk_msg, improve offset chk in _is_valid_accessJohn Fastabend
The check for max offset in sk_msg_is_valid_access uses sizeof() which is incorrect because it would allow accessing possibly past the end of the struct in the padded case. Further, it doesn't preclude accessing any padding that may be added in the middle of a struct. All told this makes it fragile to rely on. To fix this explicitly check offsets with fields using the bpf_ctx_range() and bpf_ctx_range_till() macros. For reference the current structure layout looks as follows (reported by pahole) struct sk_msg_md { union { void * data; /* 8 */ }; /* 0 8 */ union { void * data_end; /* 8 */ }; /* 8 8 */ __u32 family; /* 16 4 */ __u32 remote_ip4; /* 20 4 */ __u32 local_ip4; /* 24 4 */ __u32 remote_ip6[4]; /* 28 16 */ __u32 local_ip6[4]; /* 44 16 */ __u32 remote_port; /* 60 4 */ /* --- cacheline 1 boundary (64 bytes) --- */ __u32 local_port; /* 64 4 */ __u32 size; /* 68 4 */ /* size: 72, cachelines: 2, members: 10 */ /* last cacheline: 8 bytes */ }; So there should be no padding at the moment but fixing this now prevents future errors. Reported-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20bpf: sk_msg, fix sk_msg_md access past end testJohn Fastabend
Currently, the test to ensure reads past the end of the sk_msg_md data structure fail is incorrectly expecting success. Fix this typo and use correct expected error. Fixes: 945a47d87cee ("bpf: sk_msg, add tests for size field") Reported-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn'tJesper Dangaard Brouer
The frame_size passed to build_skb must be aligned, else it is possible that the embedded struct skb_shared_info gets unaligned. For correctness make sure that xdpf->headroom in included in the alignment. No upstream drivers can hit this, as all XDP drivers provide an aligned headroom. This was discovered when playing with implementing XDP support for mvneta, which have a 2 bytes DSA header, and this Marvell ARM64 platform didn't like doing atomic operations on an unaligned skb_shinfo(skb)->dataref addresses. Fixes: 1c601d829ab0 ("bpf: cpumap xdp_buff to skb conversion and allocation") Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20Merge tag 'upstream-4.20-rc7' of git://git.infradead.org/linux-ubifsLinus Torvalds
Pull UBI/UBIFS fixes from Richard Weinberger: - Kconfig dependency fixes for our new auth feature - Fix for selecting the right compressor when creating a fs - Bugfix for a bug in UBIFS's O_TMPFILE implementation - Refcounting fixes for UBI * tag 'upstream-4.20-rc7' of git://git.infradead.org/linux-ubifs: ubifs: Handle re-linking of inodes correctly while recovery ubi: Do not drop UBI device reference before using ubi: Put MTD device after it is not used ubifs: Fix default compression selection in ubifs ubifs: Fix memory leak on error condition ubifs: auth: Add CONFIG_KEYS dependency ubifs: CONFIG_UBIFS_FS_AUTHENTICATION should depend on UBIFS_FS ubifs: replay: Fix high stack usage
2018-12-20ACPI / tables: Add an ifdef around amlcode and dsdt_amlcodeNathan Chancellor
Clang warns: drivers/acpi/tables.c:715:14: warning: unused variable 'amlcode' [-Wunused-variable] static void *amlcode __attribute__ ((weakref("AmlCode"))); ^ drivers/acpi/tables.c:716:14: warning: unused variable 'dsdt_amlcode' [-Wunused-variable] static void *dsdt_amlcode __attribute__ ((weakref("dsdt_aml_code"))); ^ 2 warnings generated. The only uses of these variables are hiddem behind CONFIG_ACPI_CUSTOM_DSDT so do the same thing here. Fixes: 82e4eb4e9653 (ACPI / tables: add DSDT AmlCode new declaration name support) Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2018-12-20ACPI/APEI: Clear GHES block_status before panic()Lenny Szubowicz
In __ghes_panic() clear the block status in the APEI generic error status block for that generic hardware error source before calling panic() to prevent a second panic() in the crash kernel for exactly the same fatal error. Otherwise ghes_probe(), running in the crash kernel, would see an unhandled error in the APEI generic error status block and panic again, thereby precluding any crash dump. Signed-off-by: Lenny Szubowicz <lszubowi@redhat.com> Signed-off-by: David Arcari <darcari@redhat.com> Tested-by: Tyler Baicar <baicar.tyler@gmail.com> Acked-by: Borislav Petkov <bp@suse.de> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2018-12-20ixgbe: use mii_bus to handle MII related ioctlsSteve Douthit
Use the mii_bus callbacks to address the entire clause 22/45 address space. Enables userspace to poke switch registers instead of a single PHY address. The ixgbe firmware may be polling PHYs in a way that is not protected by the mii_bus lock. This isn't new behavior, but as Andrew Lunn pointed out there are more addresses available for conflicts. Signed-off-by: Stephen Douthit <stephend@silicom-usa.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Tested-by: Andrew Bowers <andrewx.bowers@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20ixgbe: register a mdiobusSteve Douthit
Most dsa devices expect a 'struct mii_bus' pointer to talk to switches via the MII interface. While this works for dsa devices, it will not work safely with Linux PHYs in all configurations since the firmware of the ixgbe device may be polling some PHY addresses in the background. Signed-off-by: Stephen Douthit <stephend@silicom-usa.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Tested-by: Andrew Bowers <andrewx.bowers@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20igb: Fix an issue that PME is not enabled during runtime suspendKai-Heng Feng
I210 ethernet card doesn't wakeup when a cable gets plugged. It's because its PME is not set. Since commit 42eca2302146 ("PCI: Don't touch card regs after runtime suspend D3"), if the PCI state is saved, pci_pm_runtime_suspend() stops calling pci_finish_runtime_suspend(), which enables the PCI PME. To fix the issue, let's not to save PCI states when it's runtime suspend, to let the PCI subsystem enables PME. Fixes: 42eca2302146 ("PCI: Don't touch card regs after runtime suspend D3") Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Tested-by: Aaron Brown <aaron.f.brown@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20ice: Do not enable NAPI on q_vectors that have no ringsYoung Xiao
If ice driver has q_vectors w/ active NAPI that has no rings, then this will result in a divide by zero error. To correct it I am updating the driver code so that we only support NAPI on q_vectors that have 1 or more rings allocated to them. See commit 13a8cd191a2b ("i40e: Do not enable NAPI on q_vectors that have no rings") for detail. Signed-off-by: Young Xiao <YangX92@hotmail.com> Acked-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com> Tested-by: Andrew Bowers <andrewx.bowers@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20i40e: extend PTP gettime function to read system clockMiroslav Lichvar
This adds support for the PTP_SYS_OFFSET_EXTENDED ioctl. Cc: Richard Cochran <richardcochran@gmail.com> Cc: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com> Tested-by: Andrew Bowers <andrewx.bowers@intel.com> Acked-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20i40e: define proper net_device::neigh_priv_lenKonstantin Khorenko
Out of bound read reported by KASan. i40iw_net_event() reads unconditionally 16 bytes from neigh->primary_key while the memory allocated for "neighbour" struct is evaluated in neigh_alloc() as tbl->entry_size + dev->neigh_priv_len where "dev" is a net_device. But the driver does not setup dev->neigh_priv_len and we read beyond the neigh entry allocated memory, so the patch in the next mail fixes this. Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com> Tested-by: Andrew Bowers <andrewx.bowers@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_waitYueHaibing
Fix a static code checker warning: drivers/net/ethernet/intel/e100.c:1349 e100_load_ucode_wait() warn: passing zero to 'PTR_ERR' Signed-off-by: YueHaibing <yuehaibing@huawei.com> Tested-by: Aaron Brown <aaron.f.brown@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller
Lots of conflicts, by happily all cases of overlapping changes, parallel adds, things of that nature. Thanks to Stephen Rothwell, Saeed Mahameed, and others for their guidance in these resolutions. Signed-off-by: David S. Miller <davem@davemloft.net>
2018-12-20Documentation: igb: Add a section about CBSVinicius Costa Gomes
Add some pointers to the definition of the CBS algorithm, and some notes about the limits of its implementation in the i210 family of controllers. Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com> Tested-by: Aaron Brown <aaron.f.brown@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20igb: Change RXPBSIZE size when setting Qav modeJesus Sanchez-Palencia
Section 4.5.9 of the datasheet says that the total size of all packet buffers combined (TxPB 0 + 1 + 2 + 3 + RxPB + BMC2OS + OS2BMC) must not exceed 60KB. Today we are configuring a total of 62KB, so reduce the RxPB from 32KB to 30KB in order to respect that. The choice of changing RxPBSIZE here is mainly because it seems more correct to give more priority to the transmit packet buffers over the receiver ones when running in Qav mode. Also, the BMC2OS and OS2BMC sizes are already too short. Signed-off-by: Jesus Sanchez-Palencia <jesus.s.palencia@gmail.com> Tested-by: Aaron Brown <aaron.f.brown@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20igb: reduce CPU0 latency when updating statisticsJeff Kirsher
This change is based off of the work and suggestion of Jan Jablonsky <jan.jablonsky@thalesgroup.com>. The Watchdog workqueue in igb driver is scheduled every 2s for each network interface. That includes updating a statistics protected by spinlock. Function igb_update_stats in this case will be protected against preemption. According to number of a statistics registers (cca 60), processing this function might cause additional cpu load on CPU0. In case of statistics spinlock may be replaced with mutex, which reduce latency on CPU0. CC: Bernhard Kaindl <bernhard.kaindl@thalesgroup.com> CC: Jan Jablonsky <jan.jablonsky@thalesgroup.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Tested-by: Aaron Brown <aaron.f.brown@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-12-20MIPS: math-emu: Write-protect delay slot emulation pagesPaul Burton
Mapping the delay slot emulation page as both writeable & executable presents a security risk, in that if an exploit can write to & jump into the page then it can be used as an easy way to execute arbitrary code. Prevent this by mapping the page read-only for userland, and using access_process_vm() with the FOLL_FORCE flag to write to it from mips_dsemul(). This will likely be less efficient due to copy_to_user_page() performing cache maintenance on a whole page, rather than a single line as in the previous use of flush_cache_sigtramp(). However this delay slot emulation code ought not to be running in any performance critical paths anyway so this isn't really a problem, and we can probably do better in copy_to_user_page() anyway in future. A major advantage of this approach is that the fix is small & simple to backport to stable kernels. Reported-by: Andy Lutomirski <luto@kernel.org> Signed-off-by: Paul Burton <paul.burton@mips.com> Fixes: 432c6bacbd0c ("MIPS: Use per-mm page to execute branch delay slot instructions") Cc: stable@vger.kernel.org # v4.8+ Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Rich Felker <dalias@libc.org> Cc: David Daney <david.daney@cavium.com>
2018-12-20security: integrity: partial revert of make ima_main explicitly non-modularPaul Gortmaker
In commit 4f83d5ea643a ("security: integrity: make ima_main explicitly non-modular") I'd removed <linux/module.h> after assuming that the function is_module_sig_enforced() was an LSM function and not a core kernel module function. Unfortunately the typical .config selections used in build testing provide an implicit <linux/module.h> presence, and so normal/typical build testing did not immediately reveal my incorrect assumption. Cc: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com> Cc: James Morris <james.l.morris@oracle.com> Cc: "Serge E. Hallyn" <serge@hallyn.com> Cc: linux-ima-devel@lists.sourceforge.net Cc: linux-security-module@vger.kernel.org Reported-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: James Morris <james.morris@microsoft.com>
2018-12-20Merge tag 'perf-core-for-mingo-4.21-20181218' of ↵Ingo Molnar
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: - Implement BPF based syscall filtering in 'perf trace', using BPF maps and the augmented_raw_syscalls.c BPF proggie (Arnaldo Carvalho de Melo) - Allow specifying in .perfconfig a set of events use in 'perf trace' in addition to any other specified from the command line. This initially will be used to always use the augmented_raw_syscalls.o precompiled BPF program for getting pointer contents. (Arnaldo Carvalho de Melo) - Allow fine grained control about how the syscall output should be formatted. This will be used to allow producing the same output produced by the 'strace' tool, to then use in regression tests comparing the output of 'perf trace' with the one produced from 'strace' (Arnaldo Carvalho de Melo) - Beautify the renameat2 olddirfd, newdirfd and flags arguments (Arnaldo Carvalho de Melo) - Beautify arch_prctl 'code' syscall arg (Arnaldo Carvalho de Melo) - Beautify fadvise64 'advice' syscall arg (Arnaldo Carvalho de Melo) - Relax checks on perf-PID.map ownership, resulting in symbols in executable anonymous maps setup by JITs in things like node.js to be resolved in a 'perf top' session run by root without the need for --force to be used (Arnaldo Carvalho de Melo) - Update asm-generic/unistd.h copy (Arnaldo Carvalho de Melo) - Do not use the first and last symbols when setting up address filters in auxtrace, this fails when we don't have a symbol table, filter the entire area based on the dso size. (Adrian Hunter) - Do not use kernel headers to build libsubcmd, we shouldn't use anything from outside tools/, fixes the build with the Android NDK (Arnaldo Carvalho de Melo) - Add several prototypes for systems lacking those, such as open_memstream(), sigqueue(), fixing warnings building with Android's bionic libc that were preventing the use of -Werror there (Arnaldo Carvalho de Melo) - Use LDFLAGS in the libtraceevent build commands, allowing developers to override its values (Jiri Olsa) - Link libperf-jvmti.so with LDFLAGS variable, allowing distro packages to propagate its settings when building this library (Jiri Olsa) - cs-etm (ARM CoreSight) fixes: (Leo Yan) - Correct packets swapping in cs_etm__flush() - Avoid stale branch samples when flush packet - Remove unused 'trace_on' in cs_etm_decoder - Refactor enumeration cs_etm_sample_type - Rename CS_ETM_TRACE_ON to CS_ETM_DISCONTINUITY - Treat NO_SYNC element as trace discontinuity - Treat EO_TRACE element as trace discontinuity - Generate branch sample for exception packet - Use shebangs in the 'perf test' shell scripts, making them identifiable as shell scripts (Michael Petlan) - Avoid segfaults caused by negated options in 'perf stat' (Michael Petlan) - Fix processing of dereferenced args in bprintk events in libtracevent (Steven Rostedt) Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ingo Molnar <mingo@kernel.org>
2018-12-20Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo
ath.git patches for 4.21. Major changes: ath10k * add amsdu support for QCA6174 monitor mode * report tx rate using the new ieee80211_tx_rate_update() API * wcn3990 support is not experimental anymore
2018-12-20Merge tag 'drm-misc-fixes-2018-12-20' of ↵Daniel Vetter
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Fix spectre v1 vuln in drm_ioctl Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> From: Sean Paul <sean@poorly.run> Link: https://patchwork.freedesktop.org/patch/msgid/20181220165740.GA42344@art_vandelay
2018-12-20ath10k: add support to configure BB timing over wmiBhagavathi Perumal S
Add wmi configuration cmd to configure base band(BB) power amplifier(PA) off timing values in hardware. The default PA off timings were fine tuned to make proper DFS radar detection in QCA reference design. If ODM uses different PA in their design, then the same default PA off timing values cannot be used, it requires different settling time to detect radar pulses very sooner and avoid radar detection problems. In that case it provides provision to select proper PA off timing values based on the PA hardware used. The PA component is part of FEM hardware and new device tree entry "ext-fem-name" is used to indentify the FEM hardware. And this wmi configuration cmd is enabled via wmi service flag "WMI_SERVICE_BB_TIMING_CONFIG_SUPPORT". Other way is to apply these values through calibration data, but recalibration of all boards out there might not be feasible. This change tested on firmware ver 10.2.4-1.0-00042 in QCA988X chipset. Signed-off-by: Bhagavathi Perumal S <bperumal@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20dt-bindings: net: ath10k: add new dt entry to identify external FEMBhagavathi Perumal S
This adds new dt entry ext-fem-name, it is used by ath10k driver to select correct timing parameters and configure it in target wifi hardware. The Front End Module(FEM) normally includes tx power amplifier(PA) and rx low noise amplifier(LNA). The default timing parameters like tx end to PA off timing values were fine tuned for internal FEM used in reference design. And these timing values can not be same if ODM modifies hardware design with different external FEM. This DT entry helps to choose correct timing values in driver if different external FEM hardware used. Signed-off-by: Bhagavathi Perumal S <bperumal@codeaurora.org> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20dt-bindings: net: ath10k: fix node name and device type in qcom ath10k exampleBhagavathi Perumal S
In qcom,ath10k documentation, ath10k is used as node name in the example of pci based device. Normally, node name should be class of device and not the model name, so fix it to node name "wifi". And remove the property device_type pci since only pci bridges should have this property. Signed-off-by: Bhagavathi Perumal S <bperumal@codeaurora.org> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: fix tx_stats memory leakZhi Chen
Memory of tx_stats was allocated when a STA was added. But it's not freed if the STA failed to be added to driver. This issue could be seen in MDK3 attack case when STA number reached the limit. Tested: QCA9984 with firmware ver 10.4-3.9.0.1-00005 Signed-off-by: Zhi Chen <zhichen@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: fix peer stats null pointer dereferenceZhi Chen
There was a race condition in SMP that an ath10k_peer was created but its member sta was null. Following are procedures of ath10k_peer creation and member sta access in peer statistics path. 1. Peer creation: ath10k_peer_create() =>ath10k_wmi_peer_create() =>ath10k_wait_for_peer_created() ... # another kernel path, RX from firmware ath10k_htt_t2h_msg_handler() =>ath10k_peer_map_event() =>wake_up() # ar->peer_map[id] = peer //add peer to map #wake up original path from waiting ... # peer->sta = sta //sta assignment 2. RX path of statistics ath10k_htt_t2h_msg_handler() =>ath10k_update_per_peer_tx_stats() =>ath10k_htt_fetch_peer_stats() # peer->sta //sta accessing Any access of peer->sta after peer was added to peer_map but before sta was assigned could cause a null pointer issue. And because these two steps are asynchronous, no proper lock can protect them. So both peer and sta need to be checked before access. Tested: QCA9984 with firmware ver 10.4-3.9.0.1-00005 Signed-off-by: Zhi Chen <zhichen@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20dt: bindings: ath10k: add bindings for wifi iommu nodeGovind Singh
WCN3990 wifi module can optionally make use of the IOMMU. Add binding documentation for phandle to the IOMMU and the stream id of wifi iommu block. Signed-off-by: Govind Singh <govinds@codeaurora.org> Reviewed-by: Rob Herring <robh@kernel.org> Reviewed-by: Brian Norris <briannorris@chromium.org> Tested-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20dt: bindings: ath10k: add missing dt properties for WCN3990 wifi nodeGovind Singh
Add missing optional properties in WCN3990 wifi node. Signed-off-by: Govind Singh <govinds@codeaurora.org> Reviewed-by: Rob Herring <robh@kernel.org> Reviewed-by: Brian Norris <briannorris@chromium.org> Tested-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: remove an unnecessary NULL checkDan Carpenter
The "survey" pointer is the address of an array element. We know that it can't be NULL so this check can be removed. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: move non-fatal warn logs to dbg levelGovind Singh
During driver load below warn logs are printed in the console. Since driver may not implement all wmi events sent by fw and all of them are non-fatal, move this log to debug level to remove un-necessary warn message on console. [ 361.887230] ath10k_snoc a000000.wifi: Unknown eventid: 16393 [ 361.907037] ath10k_snoc a000000.wifi: Unknown eventid: 237569 Signed-off-by: Govind Singh <govinds@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: fix a NULL vs IS_ERR() checkDan Carpenter
The devm_memremap() function doesn't return NULLs, it returns error pointers. Fixes: ba94c753ccb4 ("ath10k: add QMI message handshake for wcn3990 client") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: remove work in progress logs from snoc driverGovind Singh
All the necessary patches to make wifi running (over SNOC) are merged and tested on SDM845/QCS404 platform with WCN3990 wifi module, hence remove work in progress debug from snoc driver and Kconfig. Signed-off-by: Govind Singh <govinds@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: fix warning due to msdu limit errorBhagavathi Perumal S
Some hardwares variants (QCA99x0) are limiting msdu deaggregation with some threshold value(default limit in QCA99x0 is 64 msdus), it was introduced to avoid excessive MSDU-deaggregation in error cases. When number of sub frames exceeds the limit, target hardware will send all msdus starting from present msdu in RAW format as a single msdu packet and it will be indicated with error status bit "RX_MSDU_END_INFO0_MSDU_LIMIT_ERR" set in rx descriptor. This msdu frame is a partial raw MSDU and does't have first msdu and ieee80211 header. It caused below warning message. [ 320.151332] ------------[ cut here ]------------ [ 320.155006] WARNING: CPU: 0 PID: 3 at drivers/net/wireless/ath/ath10k/htt_rx.c:1188 In our issue case, MSDU limit error happened due to FCS error and generated this warning message. This fixes the warning by handling the MSDU limit error. If msdu limit error happens, driver adds first MSDU's ieee80211 header and sets A-MSDU present bit in QOS header so that upper layer processes this frame if it is valid or drop it if FCS error set. And removed the warning message, hence partial msdus without first msdu is expected in msdu limit error cases. Tested on QCA9984, Firmware 10.4-3.6-00104 Signed-off-by: Bhagavathi Perumal S <bperumal@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: disable 4addr source port learning in 10.4 FW by defaultSathishkumar Muruganandam
Currently in 10.4 FW, all the received 4addr frames are processed for source port learning which is enabled by default. This learning can't be disabled by default in FW since it breaks backward compatibility. Since ath10k uses mac80211 based 4addr mode, source port learning done in 10.4 FW is redundant and also causes issues when 3addr frames are transmitted/received for a 4addr station. One such visible functional impact is when GTK rekey frame from hostapd based AP to 4addr STA is dropped in AP's 10.4 FW. This is since GTK rekey EAPOL frame is 3addr frame on AP interface and STA enabled with 4addr is already allowed for receiving 3addr EAPOL frames. Source port learning implementation in 10.4 FW drops this 3addr GTK rekey frame in AP destinated for 4addr STA causing disassociation and re-association for every GTK rekey session. GTK rekey issue is not seen when learning is disabled in FW. To prevent such issues without breaking backward compatibility, FW advertises new service bit making the source port learning configurable and this learning is being currently disabled during ath10k vdev creation. * Tested HW: QCA9984 * Tested FW: 10.4-3.6.0.1-00004 Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: report tx rate using ieee80211_tx_rate_update()Anilkumar Kolli
Mesh path metric needs tx rate information from ieee80211_tx_status() call but in ath10k there is no mechanism to report tx rate information via ieee80211_tx_status(), the tx rate is only accessible via sta_statiscs() op. Per peer tx stats has tx rate info available, Tx rate is available to ath10k driver after every 4 PPDU sent in the air. For each PPDU, ath10k driver updates rate informattion to mac80211 using ieee80211_tx_rate_update(). Per peer txrate information is updated through per peer statistics and is available for QCA9888/QCA9984/QCA4019/QCA998X only Tested on QCA9984 with firmware-5.bin_10.4-3.5.3-00053 Tested on QCA998X with firmware-5.bin_10.2.4-1.0-00036 Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: add amsdu support for monitor modeYu Wang
When processing HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND, if the length of a msdu is larger than the tailroom of the rx skb, skb_over_panic issue will happen when calling skb_put. In monitor mode, amsdu will be handled in this path, and msdu_len of the first msdu_desc is the length of the entire amsdu, which might be larger than the maximum length of a skb, in such case, it will hit the issue upon. To fix this issue, process msdu list separately for monitor mode. Successfully tested with: QCA6174 (FW version: RM.4.4.1.c2-00057-QCARMSWP-1). Signed-off-by: Yu Wang <yyuwang@codeaurora.org> [kvalo@codeaurora.org: cosmetic cleanup] Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: fix kernel panic due to use after freeKarthikeyan Periyasamy
This issue arise in a race condition between ath10k_sta_state() and ath10k_htt_fetch_peer_stats(), explained in below scenario Steps: 1. In ath10k_sta_state(), arsta->tx_stats get deallocated before peer deletion when the station moves from IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST state. 2. Meanwhile ath10k receive HTT_T2H_MSG_TYPE_PEER_STATS message. In ath10k_htt_fetch_peer_stats(), arsta->tx_stats get accessed after the peer validation check. Since arsta->tx_stats get freed before the peer deletion [1]. ath10k_htt_fetch_peer_stats() ended up in "use after free" situation. Fixed this issue by moving the arsta->tx_stats free handling after the peer deletion. so that ath10k_htt_fetch_peer_stats() will not end up in "use after free" situation. Kernel Panic: Unable to handle kernel NULL pointer dereference at virtual address 00000286 pgd = d8754000 [00000286] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM ... CPU: 0 PID: 6245 Comm: hostapd Not tainted task: dc44cac0 ti: d4a38000 task.ti: d4a38000 PC is at kmem_cache_alloc+0x7c/0x114 LR is at ath10k_sta_state+0x190/0xd58 [ath10k_core] pc : [<c02bdc50>] lr : [<bf916b78>] psr: 20000013 sp : d4a39b88 ip : 00000000 fp : 00000001 r10: 00000000 r9 : 1d3bc000 r8 : 00000dc0 r7 : 000080d0 r6 : d4a38000 r5 : dd401b00 r4 : 00000286 r3 : 00000000 r2 : d4a39ba0 r1 : 000080d0 r0 : dd401b00 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 10c5787d Table: 5a75406a DAC: 00000015 Process hostapd (pid: 6245, stack limit = 0xd4a38238) Stack: (0xd4a39b88 to 0xd4a3a000) ... [<c02bdc50>] (kmem_cache_alloc) from [<bf916b78>] (ath10k_sta_state+0x190/0xd58 [ath10k_core]) [<bf916b78>] (ath10k_sta_state [ath10k_core]) from [<bf870d4c>] (sta_info_insert_rcu+0x418/0x61c [mac80211]) [<bf870d4c>] (sta_info_insert_rcu [mac80211]) from [<bf88634c>] (ieee80211_add_station+0xf0/0x134 [mac80211]) [<bf88634c>] (ieee80211_add_station [mac80211]) from [<bf83f3c4>] (nl80211_new_station+0x330/0x36c [cfg80211]) [<bf83f3c4>] (nl80211_new_station [cfg80211]) from [<bf6c4040>] (extack_doit+0x2c/0x74 [compat]) [<bf6c4040>] (extack_doit [compat]) from [<c05c285c>] (genl_rcv_msg+0x274/0x30c) [<c05c285c>] (genl_rcv_msg) from [<c05c1d98>] (netlink_rcv_skb+0x58/0xac) [<c05c1d98>] (netlink_rcv_skb) from [<c05c25d4>] (genl_rcv+0x20/0x34) [<c05c25d4>] (genl_rcv) from [<c05c1750>] (netlink_unicast+0x11c/0x204) [<c05c1750>] (netlink_unicast) from [<c05c1be0>] (netlink_sendmsg+0x30c/0x370) [<c05c1be0>] (netlink_sendmsg) from [<c0587e90>] (sock_sendmsg+0x70/0x84) [<c0587e90>] (sock_sendmsg) from [<c058970c>] (___sys_sendmsg.part.3+0x188/0x228) [<c058970c>] (___sys_sendmsg.part.3) from [<c058a594>] (__sys_sendmsg+0x4c/0x70) [<c058a594>] (__sys_sendmsg) from [<c0208c80>] (ret_fast_syscall+0x0/0x44) Code: ebfffec1 e1a04000 ea00001b e5953014 (e7940003) ath10k_pci 0000:01:00.0: SWBA overrun on vdev 0, skipped old beacon Hardware tested: QCA9984 Firmware tested: 10.4-3.6.0.1-00004 Fixes: a904417fc ("ath10k: add extended per sta tx statistics support") Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20ath10k: remove set but not used variable 'num_tdls_vifs'YueHaibing
Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/ath/ath10k/mac.c: In function 'ath10k_sta_state': drivers/net/wireless/ath/ath10k/mac.c:6238:7: warning: variable 'num_tdls_vifs' set but not used [-Wunused-but-set-variable] 'num_tdls_vifs' not used any more after 9a993cc1ea95 ("ath10k: fix the logic of limiting tdls peer counts") Also, remove the single called function ath10k_mac_tdls_vifs_count and ath10k_mac_tdls_vifs_count_iter. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20Merge branch 'bpf-jset-verifier'Daniel Borkmann
Jakub Kicinski says: ==================== This is a v2 of the patch set to teach the verifier about BPF_JSET instruction. There is also a number of tests include for both basic functioning of the instruction and the verifier logic. The NFP JIT handling of JSET is tweaked. Last patch adds missing file to gitignore. Reposting part of previous series without the dead code elimination. ==================== Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20selftests: bpf: add missing executables to .gitignoreJakub Kicinski
commit 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification") missed adding new test to gitignore. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20nfp: bpf: optimize codegen for JSET with a constantJakub Kicinski
The top word of the constant can only have bits set if sign extension set it to all-1, therefore we don't really have to mask the top half of the register. We can just OR it into the result as is. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20nfp: bpf: remove the trivial JSET optimizationJakub Kicinski
The verifier will now understand the JSET instruction, so don't mark the dead branch in the JIT as noop. We won't generate any code, anyway. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20bpf: verifier: reorder stack size check with dead code sanitizationJakub Kicinski
Reorder the calls to check_max_stack_depth() and sanitize_dead_code() to separate functions which can rewrite instructions from pure checks. No functional changes. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Jiong Wang <jiong.wang@netronome.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20selftests: bpf: verifier: add tests for JSET interpretationJakub Kicinski
Validate that the verifier reasons correctly about the bounds and removes dead code based on results of JSET instruction. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20bpf: verifier: teach the verifier to reason about the BPF_JSET instructionJakub Kicinski
Some JITs (nfp) try to optimize code on their own. It could make sense in case of BPF_JSET instruction which is currently not interpreted by the verifier, meaning for instance that dead could would not be detected if it was under BPF_JSET branch. Teach the verifier basics of BPF_JSET, JIT optimizations will be removed shortly. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Jiong Wang <jiong.wang@netronome.com> Acked-by: Edward Cree <ecree@solarflare.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20selftests: bpf: add trivial JSET testsJakub Kicinski
We seem to have no JSET instruction test, and LLVM does not generate it at all, so let's add a simple hand-coded test to make sure JIT implementations are correct. v2: - extend test_verifier to handle multiple inputs and add the sample there (Daniel) - add a sign extension case Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-12-20Merge branch 'bnxt_en-next'David S. Miller
Michael Chan says: ==================== bnxt_en: Update for net-next. Three main changes in this series, besides the usual firmware spec update: 1. Add support for a new firmware communication channel direct to the firmware processor that handles flow offloads. This speeds up flow offload operations. 2. Use 64-bit internal flow handles to increase the number of flows that can be offloaded. 3. Add level-2 context memory paging so that we can configure more context memory for RDMA on the 57500 chips. Allocate more context memory if RDMA is enabled on the 57500 chips. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit (git 2.34.1) at 2025-09-12 20:50:33 +0000