summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-05-29bpf, selftests: Add a verifier test for assigning 32bit reg states to 64bit onesJohn Fastabend
Added a verifier test for assigning 32bit reg states to 64bit where 32bit reg holds a constant value of 0. Without previous kernel verifier.c fix, the test in this patch will fail. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/159077335867.6014.2075350327073125374.stgit@john-Precision-5820-Tower
2020-05-29bpf, selftests: Verifier bounds tests need to be updatedJohn Fastabend
After previous fix for zero extension test_verifier tests #65 and #66 now fail. Before the fix we can see the alu32 mov op at insn 10 10: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP(id=0, smin_value=4294967168,smax_value=4294967423, umin_value=4294967168,umax_value=4294967423, var_off=(0x0; 0x1ffffffff), s32_min_value=-2147483648,s32_max_value=2147483647, u32_min_value=0,u32_max_value=-1) R10=fp0 fp-8_w=mmmmmmmm 10: (bc) w1 = w1 11: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP(id=0, smin_value=0,smax_value=2147483647, umin_value=0,umax_value=4294967295, var_off=(0x0; 0xffffffff), s32_min_value=-2147483648,s32_max_value=2147483647, u32_min_value=0,u32_max_value=-1) R10=fp0 fp-8_w=mmmmmmmm After the fix at insn 10 because we have 's32_min_value < 0' the following step 11 now has 'smax_value=U32_MAX' where before we pulled the s32_max_value bound into the smax_value as seen above in 11 with smax_value=2147483647. 10: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv(id=0, smin_value=4294967168,smax_value=4294967423, umin_value=4294967168,umax_value=4294967423, var_off=(0x0; 0x1ffffffff), s32_min_value=-2147483648, s32_max_value=2147483647, u32_min_value=0,u32_max_value=-1) R10=fp0 fp-8_w=mmmmmmmm 10: (bc) w1 = w1 11: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv(id=0, smin_value=0,smax_value=4294967295, umin_value=0,umax_value=4294967295, var_off=(0x0; 0xffffffff), s32_min_value=-2147483648, s32_max_value=2147483647, u32_min_value=0, u32_max_value=-1) R10=fp0 fp-8_w=mmmmmmmm The fall out of this is by the time we get to the failing instruction at step 14 where previously we had the following: 14: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv(id=0, smin_value=72057594021150720,smax_value=72057594029539328, umin_value=72057594021150720,umax_value=72057594029539328, var_off=(0xffffffff000000; 0xffffff), s32_min_value=-16777216,s32_max_value=-1, u32_min_value=-16777216,u32_max_value=-1) R10=fp0 fp-8_w=mmmmmmmm 14: (0f) r0 += r1 We now have, 14: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv(id=0, smin_value=0,smax_value=72057594037927935, umin_value=0,umax_value=72057594037927935, var_off=(0x0; 0xffffffffffffff), s32_min_value=-2147483648,s32_max_value=2147483647, u32_min_value=0,u32_max_value=-1) R10=fp0 fp-8_w=mmmmmmmm 14: (0f) r0 += r1 In the original step 14 'smin_value=72057594021150720' this trips the logic in the verifier function check_reg_sane_offset(), if (smin >= BPF_MAX_VAR_OFF || smin <= -BPF_MAX_VAR_OFF) { verbose(env, "value %lld makes %s pointer be out of bounds\n", smin, reg_type_str[type]); return false; } Specifically, the 'smin <= -BPF_MAX_VAR_OFF' check. But with the fix at step 14 we have bounds 'smin_value=0' so the above check is not tripped because BPF_MAX_VAR_OFF=1<<29. We have a smin_value=0 here because at step 10 the smaller smin_value=0 means the subtractions at steps 11 and 12 bring the smin_value negative. 11: (17) r1 -= 2147483584 12: (17) r1 -= 2147483584 13: (77) r1 >>= 8 Then the shift clears the top bit and smin_value is set to 0. Note we still have the smax_value in the fixed code so any reads will fail. An alternative would be to have reg_sane_check() do both smin and smax value tests. To fix the test we can omit the 'r1 >>=8' at line 13. This will change the err string, but keeps the intention of the test as suggseted by the title, "check after truncation of boundary-crossing range". If the verifier logic changes a different value is likely to be thrown in the error or the error will no longer be thrown forcing this test to be examined. With this change we see the new state at step 13. 13: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP(id=0, smin_value=-4294967168,smax_value=127, umin_value=0,umax_value=18446744073709551615, s32_min_value=-2147483648,s32_max_value=2147483647, u32_min_value=0,u32_max_value=-1) R10=fp0 fp-8_w=mmmmmmmm Giving the expected out of bounds error, "value -4294967168 makes map_value pointer be out of bounds" However, for unpriv case we see a different error now because of the mixed signed bounds pointer arithmatic. This seems OK so I've only added the unpriv_errstr for this. Another optino may have been to do addition on r1 instead of subtraction but I favor the approach above slightly. Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/159077333942.6014.14004320043595756079.stgit@john-Precision-5820-Tower
2020-05-29bpf: Fix a verifier issue when assigning 32bit reg states to 64bit onesJohn Fastabend
With the latest trunk llvm (llvm 11), I hit a verifier issue for test_prog subtest test_verif_scale1. The following simplified example illustrate the issue: w9 = 0 /* R9_w=inv0 */ r8 = *(u32 *)(r1 + 80) /* __sk_buff->data_end */ r7 = *(u32 *)(r1 + 76) /* __sk_buff->data */ ...... w2 = w9 /* R2_w=inv0 */ r6 = r7 /* R6_w=pkt(id=0,off=0,r=0,imm=0) */ r6 += r2 /* R6_w=inv(id=0) */ r3 = r6 /* R3_w=inv(id=0) */ r3 += 14 /* R3_w=inv(id=0) */ if r3 > r8 goto end r5 = *(u32 *)(r6 + 0) /* R6_w=inv(id=0) */ <== error here: R6 invalid mem access 'inv' ... end: In real test_verif_scale1 code, "w9 = 0" and "w2 = w9" are in different basic blocks. In the above, after "r6 += r2", r6 becomes a scalar, which eventually caused the memory access error. The correct register state should be a pkt pointer. The inprecise register state starts at "w2 = w9". The 32bit register w9 is 0, in __reg_assign_32_into_64(), the 64bit reg->smax_value is assigned to be U32_MAX. The 64bit reg->smin_value is 0 and the 64bit register itself remains constant based on reg->var_off. In adjust_ptr_min_max_vals(), the verifier checks for a known constant, smin_val must be equal to smax_val. Since they are not equal, the verifier decides r6 is a unknown scalar, which caused later failure. The llvm10 does not have this issue as it generates different code: w9 = 0 /* R9_w=inv0 */ r8 = *(u32 *)(r1 + 80) /* __sk_buff->data_end */ r7 = *(u32 *)(r1 + 76) /* __sk_buff->data */ ...... r6 = r7 /* R6_w=pkt(id=0,off=0,r=0,imm=0) */ r6 += r9 /* R6_w=pkt(id=0,off=0,r=0,imm=0) */ r3 = r6 /* R3_w=pkt(id=0,off=0,r=0,imm=0) */ r3 += 14 /* R3_w=pkt(id=0,off=14,r=0,imm=0) */ if r3 > r8 goto end ... To fix the above issue, we can include zero in the test condition for assigning the s32_max_value and s32_min_value to their 64-bit equivalents smax_value and smin_value. Further, fix the condition to avoid doing zero extension bounds checks when s32_min_value <= 0. This could allow for the case where bounds 32-bit bounds (-1,1) get incorrectly translated to (0,1) 64-bit bounds. When in-fact the -1 min value needs to force U32_MAX bound. Fixes: 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/159077331983.6014.5758956193749002737.stgit@john-Precision-5820-Tower
2020-05-29Merge tag 'mmc-v5.7-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix use-after-free issue for rpmb partition MMC host: - Fix quirk for broken CQE support" * tag 'mmc-v5.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: block: Fix use-after-free issue for rpmb mmc: sdhci: Fix SDHCI_QUIRK_BROKEN_CQE
2020-05-29Merge tag 'sound-5.7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Only a few last-minute small fixes: the change in ALSA core hwdep is about the undefined behavior of bit shift, which is almost harmless but still worth to pick up quickly. The rest are all device-specific fixes for HD-audio and USB-audio, and safe to apply at the late stage" * tag 'sound-5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Add new codec supported for ALC287 ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC workaround ALSA: hwdep: fix a left shifting 1 by 31 UB bug
2020-05-29Merge tag 'clk-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Two fixes for the new SM8150 and SM8250 Qualcomm clk drivers to fix a randconfig build error and an incorrect parent mapping" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: qcom: gcc: Fix parent for gpll0_out_even clk: qcom: sm8250 gcc depends on QCOM_GDSC
2020-05-29bpf: Fix use-after-free in fmod_ret checkAlexei Starovoitov
Fix the following issue: [ 436.749342] BUG: KASAN: use-after-free in bpf_trampoline_put+0x39/0x2a0 [ 436.749995] Write of size 4 at addr ffff8881ef38b8a0 by task kworker/3:5/2243 [ 436.750712] [ 436.752677] Workqueue: events bpf_prog_free_deferred [ 436.753183] Call Trace: [ 436.756483] bpf_trampoline_put+0x39/0x2a0 [ 436.756904] bpf_prog_free_deferred+0x16d/0x3d0 [ 436.757377] process_one_work+0x94a/0x15b0 [ 436.761969] [ 436.762130] Allocated by task 2529: [ 436.763323] bpf_trampoline_lookup+0x136/0x540 [ 436.763776] bpf_check+0x2872/0xa0a8 [ 436.764144] bpf_prog_load+0xb6f/0x1350 [ 436.764539] __do_sys_bpf+0x16d7/0x3720 [ 436.765825] [ 436.765988] Freed by task 2529: [ 436.767084] kfree+0xc6/0x280 [ 436.767397] bpf_trampoline_put+0x1fd/0x2a0 [ 436.767826] bpf_check+0x6832/0xa0a8 [ 436.768197] bpf_prog_load+0xb6f/0x1350 [ 436.768594] __do_sys_bpf+0x16d7/0x3720 prog->aux->trampoline = tr should be set only when prog is valid. Otherwise prog freeing will try to put trampoline via prog->aux->trampoline, but it may not point to a valid trampoline. Fixes: 6ba43b761c41 ("bpf: Attachment verification for BPF_MODIFY_RETURN") Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: KP Singh <kpsingh@google.com> Link: https://lore.kernel.org/bpf/20200529043839.15824-2-alexei.starovoitov@gmail.com
2020-05-29Merge branch 'remove-kernel_setsockopt-v4'David S. Miller
Christoph Hellwig says: ==================== remove kernel_setsockopt v4 now that only the dlm calls to sctp are left for kernel_setsockopt, while we haven't really made much progress with the sctp setsockopt refactoring, how about this small series that splits out a sctp_setsockopt_bindx_kernel that takes a kernel space address array to share more code as requested by Marcelo. This should fit in with whatever variant of the refator of sctp setsockopt we go with, but just solved the immediate problem for now. Changes since v3: - dropped all the merged patches, just sctp setsockopt left now - factor out a new sctp_setsockopt_bindx_kernel helper instead of duplicating a small amount of logic Changes since v2: - drop the separately merged kernel_getopt_removal - drop the sctp patches, as there is conflicting cleanup going on - add an additional ACK for the rxrpc changes Changes since v1: - use ->getname for sctp sockets in dlm - add a new ->bind_add struct proto method for dlm/sctp - switch the ipv6 and remaining sctp helpers to inline function so that the ipv6 and sctp modules are not pulled in by any module that could potentially use ipv6 or sctp connections - remove arguments to various sock_* helpers that are always used with the same constant arguments ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29net: remove kernel_setsockoptChristoph Hellwig
No users left. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29net: add a new bind_add methodChristoph Hellwig
The SCTP protocol allows to bind multiple address to a socket. That feature is currently only exposed as a socket option. Add a bind_add method struct proto that allows to bind additional addresses, and switch the dlm code to use the method instead of going through the socket option from kernel space. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29sctp: refactor sctp_setsockopt_bindxChristoph Hellwig
Split out a sctp_setsockopt_bindx_kernel that takes a kernel pointer to the sockaddr and make sctp_setsockopt_bindx a small wrapper around it. This prepares for adding a new bind_add proto op. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29sctp: add sctp_sock_set_nodelayChristoph Hellwig
Add a helper to directly set the SCTP_NODELAY sockopt from kernel space without going through a fake uaccess. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29net/mlx5e: replace EINVAL in mlx5e_flower_parse_meta()Pablo Neira Ayuso
The drivers reports EINVAL to userspace through netlink on invalid meta match. This is confusing since EINVAL is usually reserved for malformed netlink messages. Replace it by more meaningful codes. Fixes: 6d65bc64e232 ("net/mlx5e: Add mlx5e_flower_parse_meta support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-05-29net/mlx5e: Fix MLX5_TC_CT dependenciesVlad Buslov
Change MLX5_TC_CT config dependencies to include MLX5_ESWITCH instead of MLX5_CORE_EN && NET_SWITCHDEV, which are already required by MLX5_ESWITCH. Without this change mlx5 fails to compile if user disables MLX5_ESWITCH without also manually disabling MLX5_TC_CT. Fixes: 4c3844d9e97e ("net/mlx5e: CT: Introduce connection tracking") Signed-off-by: Vlad Buslov <vladbu@mellanox.com> Reviewed-by: Roi Dayan <roid@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-05-29net/mlx5e: Properly set default values when disabling adaptive moderationTal Gilboa
Add a call to mlx5e_reset_rx/tx_moderation() when enabling/disabling adaptive moderation, in order to select the proper default values. In order to do so, we separate the logic of selecting the moderation values and setting moderion mode (CQE/EQE based). Fixes: 0088cbbc4b66 ("net/mlx5e: Enable CQE based moderation on TX CQ") Fixes: 9908aa292971 ("net/mlx5e: CQE based moderation") Signed-off-by: Tal Gilboa <talgi@mellanox.com> Reviewed-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-05-29net/mlx5e: Fix arch depending casting issue in FECAya Levin
Change type of active_fec to u32 to match the type expected by mlx5e_get_fec_mode. Copy active_fec and configured_fec values to unsigned long before preforming bitwise manipulations. Take the same approach when configuring FEC over 50G link modes: copy the policy into an unsigned long and only than preform bitwise operations. Fixes: 2132b71f78d2 ("net/mlx5e: Advertise globaly supported FEC modes") Signed-off-by: Aya Levin <ayal@mellanox.com> Reviewed-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-05-29net/mlx5e: Remove warning "devices are not on same switch HW"Maor Dickman
On tunnel decap rule insertion, the indirect mechanism will attempt to offload the rule on all uplink representors which will trigger the "devices are not on same switch HW, can't offload forwarding" message for the uplink which isn't on the same switch HW as the VF representor. The above flow is valid and shouldn't cause warning message, fix by removing the warning and only report this flow using extack. Fixes: 321348475d54 ("net/mlx5e: Fix allowed tc redirect merged eswitch offload cases") Signed-off-by: Maor Dickman <maord@mellanox.com> Reviewed-by: Roi Dayan <roid@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-05-29net/mlx5e: Fix stats update for matchall classifierRoi Dayan
It's bytes, packets, lastused. Fixes: fcb64c0f5640 ("net/mlx5: E-Switch, add ingress rate support") Signed-off-by: Roi Dayan <roid@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-05-29net/mlx5: Fix crash upon suspend/resumeMark Bloch
Currently a Linux system with the mlx5 NIC always crashes upon hibernation - suspend/resume. Add basic callbacks so the NIC could be suspended and resumed. Fixes: 9603b61de1ee ("mlx5: Move pci device handling from mlx5_ib to mlx5_core") Tested-by: Dexuan Cui <decui@microsoft.com> Signed-off-by: Mark Bloch <markb@mellanox.com> Reviewed-by: Moshe Shemesh <moshe@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-05-29Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2020-05-29 1) Several fixes for ESP gro/gso in transport and beet mode when IPv6 extension headers are present. From Xin Long. 2) Fix a wrong comment on XFRMA_OFFLOAD_DEV. From Antony Antony. 3) Fix sk_destruct callback handling on ESP in TCP encapsulation. From Sabrina Dubroca. 4) Fix a use after free in xfrm_output_gso when used with vxlan. From Xin Long. 5) Fix secpath handling of VTI when used wiuth IPCOMP. From Xin Long. 6) Fix an oops when deleting a x-netns xfrm interface. From Nicolas Dichtel. 7) Fix a possible warning on policy updates. We had a case where it was possible to add two policies with the same lookup keys. From Xin Long. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2020-05-29 1) Add IPv6 encapsulation support for ESP over UDP and TCP. From Sabrina Dubroca. 2) Remove unneeded reference when initializing xfrm interfaces. From Nicolas Dichtel. 3) Remove some indirect calls from the state_afinfo. From Florian Westphal. Please note that this pull request has two merge conflicts between commit: 0c922a4850eb ("xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish") from Linus' tree and commit: 2ab6096db2f1 ("xfrm: remove output_finish indirection from xfrm_state_afinfo") from the ipsec-next tree. and between commit: 3986912f6a9a ("ipv6: move SIOCADDRT and SIOCDELRT handling into ->compat_ioctl") from the net-next tree and commit: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP") from the ipsec-next tree. Both conflicts can be resolved as done in linux-next. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29net: phy: marvell: unlock after phy_select_page() failureDan Carpenter
We need to call phy_restore_page() even if phy_select_page() fails. Otherwise we are holding the phy_lock_mdio_bus() lock. This requirement is documented at the start of the phy_select_page() function. Fixes: a618e86da91d ("net : phy: marvell: Speedup TDR data retrieval by only changing page once") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29net: phy: mscc: fix PHYs using the vsc8574_probeAntoine Tenart
PHYs using the vsc8574_probe fail to be initialized and their config_init return -EIO leading to errors like: "could not attach PHY: -5". This is because when the conversion of the MSCC PHY driver to use the shared PHY package helpers was done, the base address retrieval and the base PHY read and write helpers in the driver were modified. In particular, the base address retrieval logic was moved from the config_init to the probe. But the vsc8574_probe was forgotten. This patch fixes it. Fixes: deb04e9c0ff2 ("net: phy: mscc: use phy_package_shared") Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Reviewed-by: Michael Walle <michael@walle.cc> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29net: ethernet: mtk-star-emac: remove unused variableBartosz Golaszewski
The desc pointer is set but not used. Remove it. Reported-by: kbuild test robot <lkp@intel.com> Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver") Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29Merge tag 'drm-fixes-2020-05-29-1' of git://anongit.freedesktop.org/drm/drmLinus Torvalds
Pull drm fixes from Dave Airlie: "A couple of amdgpu fixes and minor ingenic fixes: amdgpu: - display atomic test fix - Fix soft hang in display vupdate code ingenic: - fix pointer cast - fix crtc atomic check callback" * tag 'drm-fixes-2020-05-29-1' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: Fix potential integer wraparound resulting in a hang drm/amd/display: drop cursor position check in atomic test gpu/drm: Ingenic: Fix opaque pointer casted to wrong type gpu/drm: ingenic: Fix bogus crtc_atomic_check callback
2020-05-29Merge branch '10GbE' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2020-05-28 This series contains updates to e1000, e1000e, igc, igb, ixgbe and i40e. Takashi Iwai, from SUSE, replaces some uses of snprintf() with scnprintf() since the succeeding calls may go beyond the given buffer limit in i40e. Jesper Dangaard Brouer fixes up code comments in i40e_xsk.c Xie XiuQi, from Huawei, fixes a signed-integer-overflow warning ixgbe driver. Jason Yan, from Huawei, converts '==' expression to bool to resolve warnings, also fixed a warning for assigning 0/1 to a bool variable in the ixgbe driver. Converts functions that always return 0 to void in the igb and i40e drivers. YueHaibing, from Hauwei, cleans up dead code in ixgbe driver. Sasha cleans up more dead code which is not used in the igc driver. Added receive error counter to reflect the total number of non-filtered packets received with errors. Fixed a register define name to properly reflect the register address being used. Andre updates the igc driver to reject NFC rules that have multiple matches, which is not supported in i225 devices. Updates the total number of NFC rules supported and added a code comment to explain what is supported. Punit Agrawal, from Toshiba, relaxes the condition to trigger a reset for ME, which was leading to inconsistency between the state of the hardware as expected by the driver in e1000e. Hari, from the Linux community, cleaned up a code comment in the e1000 driver. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29vmxnet3: use correct hdr reference when packet is encapsulatedRonak Doshi
'Commit dacce2be3312 ("vmxnet3: add geneve and vxlan tunnel offload support")' added support for encapsulation offload. However, while preparing inner tso packet, it uses reference to outer ip headers. This patch fixes this issue by using correct reference for inner headers. Fixes: dacce2be3312 ("vmxnet3: add geneve and vxlan tunnel offload support") Signed-off-by: Ronak Doshi <doshir@vmware.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-29Merge tag 'iwlwifi-next-for-kalle-2020-05-29' of ↵Kalle Valo
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Third set of iwlwifi patches intended for v5.8 * Update range request API; * Add ACPI DSM support; * Support enabling 5.2GHz bands in Indonesia via ACPI; * Bump FW API version to 56; * TX queues refactoring started; * Fix one memory leak; * Some other small fixes and clean-ups; # gpg: Signature made Fri 29 May 2020 10:38:28 AM EEST using RSA key ID 1A3CC5FA # gpg: Good signature from "Luciano Roth Coelho (Luca) <luca@coelho.fi>" # gpg: aka "Luciano Roth Coelho (Intel) <luciano.coelho@intel.com>"
2020-05-29Merge tag 'mt76-for-kvalo-2020-05-28' of https://github.com/nbd168/wirelessKalle Valo
mt76 patches for 5.8 * fixes for sparse warnings * DBDC fixes * mt7663 remain-on-channel support * mt7915 spatial reuse support * mt7915 radiotap fix * station wcid allocation fix * mt7663 powersave fix * mt7663 scan fix * mt7611n support * cleanup # gpg: Signature made Thu 28 May 2020 07:02:21 PM EEST using DSA key ID 02A76EF5 # gpg: Good signature from "Felix Fietkau <nbd@nbd.name>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 75D1 1A7D 91A7 710F 4900 42EF D77D 141D 02A7 6EF5
2020-05-29mwifiex: Add support for NL80211_ATTR_MAX_AP_ASSOC_STAPali Rohár
SD8997 firmware sends TLV_TYPE_MAX_CONN with struct hw_spec_max_conn to inform kernel about maximum number of p2p connections and stations in AP mode. During initialization of SD8997 wifi chip kernel prints warning: mwifiex_sdio mmc0:0001:1: Unknown GET_HW_SPEC TLV type: 0x217 This patch adds support for parsing TLV_TYPE_MAX_CONN (0x217) and sets appropriate cfg80211 member 'max_ap_assoc_sta' from retrieved structure. It allows userspace to retrieve NL80211_ATTR_MAX_AP_ASSOC_STA attribute. Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200521123559.29028-1-pali@kernel.org
2020-05-29mwifiex: Parse all API_VER_ID propertiesPali Rohár
During initialization of SD8997 wifi chip kernel prints warnings: mwifiex_sdio mmc0:0001:1: Unknown api_id: 3 mwifiex_sdio mmc0:0001:1: Unknown api_id: 4 This patch adds support for parsing all api ids provided by SD8997 firmware. Signed-off-by: Pali Rohár <pali@kernel.org> Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200521123444.28957-1-pali@kernel.org
2020-05-29airo: Fix read overflows sending packetsDan Carpenter
The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from skb->data even when skb->len is less than ETH_ZLEN so it leads to a read overflow. The fix is to pad skb->data to at least ETH_ZLEN bytes. Cc: <stable@vger.kernel.org> Reported-by: Hu Jiahui <kirin.say@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200527184830.GA1164846@mwanda
2020-05-29brcmfmac: 43012 Update MES WatermarkDouble Lo
Set MES watermark size to 0x50 for 43012. It fixes SDIO bus hang issue when running at high throughput. Signed-off-by: Double Lo <double.lo@cypress.com> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200529034938.124533-6-chi-hsien.lin@cypress.com
2020-05-29brcmfmac: fix 43455 CRC error under SDIO 3.0 SDR104 modeWright Feng
This patch fixes 43455 CRC error while running throughput test with suspend/resume stress test. The continuous failure messages before system crash: brcmfmac: brcmf_sdiod_sglist_rw: CMD53 sg block read failed -84 brcmfmac: brcmf_sdio_rxglom: glom read of 25600 bytes failed: -5 brcmfmac: brcmf_sdio_rxfail: abort command, terminate frame brcmfmac: brcmf_sdiod_sglist_rw: CMD53 sg block read failed -84 brcmfmac: brcmf_sdio_rxglom: glom read of 24576 bytes failed: -5 brcmfmac: brcmf_sdio_rxfail: abort command, terminate frame Signed-off-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200529034938.124533-5-chi-hsien.lin@cypress.com
2020-05-29brcmfmac: set F2 blocksize and watermark for 4354/4356 SDIOFrank Kao
Set F2 blocksize to 256 bytes and watermark to 0x40 for 4354/4356 SDIO. Also enable and configure F1 MesBusyCtrl. It would resolve random driver crash issue. Signed-off-by: Frank Kao <frank.kao@cypress.com> Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200529034938.124533-4-chi-hsien.lin@cypress.com
2020-05-29brcmfmac: fix 4339 CRC error under SDIO 3.0 SDR104 modeDouble Lo
This patch fixes 4339 CRC error while running Tput test with suspend/resume test script. The continuous failure messages before system crash: brcmfmac: brcmf_sdiod_sglist_rw: CMD53 sg block read failed -84 brcmfmac: brcmf_sdio_rxglom: glom read of 25600 bytes failed: -5 brcmfmac: brcmf_sdio_rxfail: abort command, terminate frame brcmfmac: brcmf_sdiod_sglist_rw: CMD53 sg block read failed -84 brcmfmac: brcmf_sdio_rxglom: glom read of 24576 bytes failed: -5 brcmfmac: brcmf_sdio_rxfail: abort command, terminate frame Signed-off-by: Double Lo <double.lo@cypress.com> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200529034938.124533-3-chi-hsien.lin@cypress.com
2020-05-29brcmfmac: set F2 blocksize for 4373Wright Feng
Set F2 blocksize to 256 bytes for 4373. It fixes DMA error while having UDP bi-directional traffic. Also use a defined F1 MesBusyCtrl value. Signed-off-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200529034938.124533-2-chi-hsien.lin@cypress.com
2020-05-29wlcore: fix runtime pm imbalance in wlcore_irq_lockedDinghao Liu
When wlcore_fw_status() returns an error code, a pairing runtime PM usage counter decrement is needed to keep the counter balanced. It's the same for all error paths after wlcore_fw_status(). Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200522044906.29564-1-dinghao.liu@zju.edu.cn
2020-05-29rtw88: 8822c: remove CCK TX setting when switch channelChien-Hsun Liao
The CCK TX setting when switch channel will fix the CCK to path A only, so if the antenna is configured to path B (e.g. iw phy set antenna 0x2 0x3 "TX B/RX AB"), then the CCK packets can never be delivered to the air if only path B is connected with an antenna (it can possibly be transmitted through path A, but as path B is configured, the expected behavior is incorrect). This can also solve the racing issue of CCK TX setting between driver and firmware. The CCK TX setting in driver should be removed. Otherwise, the CCK TX setting would be wrong when the racing occurs. Fixes: 297bcf8222f2 ("rtw88: add support for set/get antennas") Signed-off-by: Chien-Hsun Liao <ben.liao@realtek.com> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200522091234.24495-1-yhchuang@realtek.com
2020-05-29rtw88: 8822c: fix missing brace warning for old compilersYan-Hsuan Chuang
For older versions of gcc, the array = {0}; will cause warnings: drivers/net/wireless/realtek/rtw88/rtw8822c.c: In function 'rtw8822c_power_trim': >> drivers/net/wireless/realtek/rtw88/rtw8822c.c:1039:2: warning: >> missing braces around initializer [-Wmissing-braces] s8 bb_gain[2][8] = {0}; ^ drivers/net/wireless/realtek/rtw88/rtw8822c.c:1039:2: warning: (near initialization for 'bb_gain[0]') [-Wmissing-braces] Fixes: 5ad4d8957b69 ("rtw88: set power trim according to efuse PG values") Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200522035521.12295-1-yhchuang@realtek.com
2020-05-29rtw88: fix EAPOL 4-way failure by finish IQK earlierPing-Ke Shih
Connecting to an AP with WPA2 security may fail. The IQK and the EAPOL 4-way handshake may overlap because the driver does IQK right after assoc success. For 802.11n devices, the IQK is done in the driver and it could require more than 100ms to complete. During IQK, any TX/RX events are paused. So if the EAPOL 4-way handshake started before IQK finished, then the 1/4 and 2/4 part of the handshake could be dropped. The AP will then issue deauth with reason IEEE8021X_FAILED (23). To resolve this, move IQK routine into managed TX prepare (ieee80211_ops::mgd_prepare_tx()). The callback is called before the managed frames (auth/assoc) are sent. This will make sure that the IQK is completed before the handshake starts. But don't do IQK during scanning because doing it on each channel will take too long. For 802.11ac devices, the IQK is done in firmware and it takes less time to complete. Therefore we don't see a failure during the EAPOL 4-way handshake. But it is still worth moving the IQK into ieee80211_ops::mgd_prepare_tx(). Fixes: f5df1a8b4376 ("rtw88: 8723d: Add 8723DE to Kconfig and Makefile") Tested-by: You-Sheng Yang <vicamo.yang@canonical.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200529025009.2468-4-yhchuang@realtek.com
2020-05-29rtw88: coex: 8723d: handle BT inquiry casesPing-Ke Shih
Coex mechanism used to make BT have higher priority and more time to transfer data when BT inquiry-page, which leads to poor WiFi performance. Should take WiFi traffic into consideration. If the WiFi is having heavy traffic, use another parameter to make sure WiFi has more chance to TX/RX, while guarantee the priority of BT for inquiry. If the WiFi isn't busy (connected or not), set proper parameter to fix originals. Fixes: f5df1a8b4376 ("rtw88: 8723d: Add 8723DE to Kconfig and Makefile") Tested-by: You-Sheng Yang <vicamo.yang@canonical.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200529025009.2468-3-yhchuang@realtek.com
2020-05-29rtw88: coex: 8723d: set antanna control ownerPing-Ke Shih
Without setting antenna control owner, the WiFi could be disconnected if the BT has traffic. Because the antenna is switched to BT side for its traffic, and the WiFi will have no chance to transfer data. Set control owner to prevent WiFi disconnect issue. Fixes: f5df1a8b4376 ("rtw88: 8723d: Add 8723DE to Kconfig and Makefile") Tested-by: You-Sheng Yang <vicamo.yang@canonical.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200529025009.2468-2-yhchuang@realtek.com
2020-05-29wlcore: fix runtime pm imbalance in __wl1271_op_remove_interfaceDinghao Liu
When wl12xx_cmd_role_disable() returns an error code, a pairing runtime PM usage counter decrement is needed to keep the counter balanced. Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200520130806.14789-1-dinghao.liu@zju.edu.cn
2020-05-29wlcore: fix runtime pm imbalance in wl1271_op_suspendDinghao Liu
When wlcore_hw_interrupt_notify() returns an error code, a pairing runtime PM usage counter decrement is needed to keep the counter balanced. Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200520125724.12832-1-dinghao.liu@zju.edu.cn
2020-05-29wlcore: fix runtime pm imbalance in wlcore_regdomain_configDinghao Liu
pm_runtime_get_sync() increments the runtime PM usage counter even the call returns an error code. Thus a pairing decrement is needed on the error handling path to keep the counter balanced. Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200520124649.10848-1-dinghao.liu@zju.edu.cn
2020-05-29wlcore: fix runtime pm imbalance in wl1271_tx_workDinghao Liu
There are two error handling paths in this functon. When wlcore_tx_work_locked() returns an error code, we should decrease the runtime PM usage counter the same way as the error handling path beginning from pm_runtime_get_sync(). Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200520124241.9931-1-dinghao.liu@zju.edu.cn
2020-05-29atmel: Use shared constant for rfc1042 headerPascal Terjan
This is one of the 9 drivers redefining rfc1042_header. Signed-off-by: Pascal Terjan <pterjan@google.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200523212735.32364-1-pterjan@google.com
2020-05-29libertas: Use shared constant for rfc1042 headerPascal Terjan
This is one of the 9 drivers redefining rfc1042_header. Signed-off-by: Pascal Terjan <pterjan@google.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200523212628.31526-1-pterjan@google.com
2020-05-29cw1200: Remove local sdio VENDOR and DEVICE id definitionsPali Rohár
They are already present in linux/mmc/sdio_ids.h. Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200520125410.31757-1-pali@kernel.org
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-01 00:43:57 +0000