summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-06-29bpf: prevent leaking pointer via xadd on unpriviledgedDaniel Borkmann2-0/+71
Leaking kernel addresses on unpriviledged is generally disallowed, for example, verifier rejects the following: 0: (b7) r0 = 0 1: (18) r2 = 0xffff897e82304400 3: (7b) *(u64 *)(r1 +48) = r2 R2 leaks addr into ctx Doing pointer arithmetic on them is also forbidden, so that they don't turn into unknown value and then get leaked out. However, there's xadd as a special case, where we don't check the src reg for being a pointer register, e.g. the following will pass: 0: (b7) r0 = 0 1: (7b) *(u64 *)(r1 +48) = r0 2: (18) r2 = 0xffff897e82304400 ; map 4: (db) lock *(u64 *)(r1 +48) += r2 5: (95) exit We could store the pointer into skb->cb, loose the type context, and then read it out from there again to leak it eventually out of a map value. Or more easily in a different variant, too: 0: (bf) r6 = r1 1: (7a) *(u64 *)(r10 -8) = 0 2: (bf) r2 = r10 3: (07) r2 += -8 4: (18) r1 = 0x0 6: (85) call bpf_map_lookup_elem#1 7: (15) if r0 == 0x0 goto pc+3 R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R6=ctx R10=fp 8: (b7) r3 = 0 9: (7b) *(u64 *)(r0 +0) = r3 10: (db) lock *(u64 *)(r0 +0) += r6 11: (b7) r0 = 0 12: (95) exit from 7 to 11: R0=inv,min_value=0,max_value=0 R6=ctx R10=fp 11: (b7) r0 = 0 12: (95) exit Prevent this by checking xadd src reg for pointer types. Also add a couple of test cases related to this. Fixes: 1be7f75d1668 ("bpf: enable non-root eBPF programs") Fixes: 17a5267067f3 ("bpf: verifier (add verifier core)") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Edward Cree <ecree@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29ibmvnic: Fix assignment of RX/TX IRQ'sThomas Falcon1-7/+7
The driver currently creates RX/TX queues during device probe, but assigns IRQ's to them during device open. On reset, however, IRQ's are assigned when resetting the queues. If there is a reset while the device is closed and the device is later opened, the driver will request IRQ's twice, causing the open to fail. This patch assigns the IRQ's in the ibmvnic_init function after the queues are reset or initialized, ensuring IRQ's are only requested once. Signed-off-by: Thomas Falcon <tlfalcon@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29net: ipmr: Add ipmr_rtm_getrouteDonald Sharp1-1/+62
Add to RTNL_FAMILY_IPMR, RTM_GETROUTE the ability to retrieve one S,G mroute from a specified table. *,G will return mroute information for just that particular mroute if it exists. This is because it is entirely possible to have more S's then can fit in one skb to return to the requesting process. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com> Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29bpf: Fix out-of-bound access on interpreters[]Martin KaFai Lau1-1/+3
The index is off-by-one when fp->aux->stack_depth has already been rounded up to 32. In particular, if stack_depth is 512, the index will be 16. The fix is to round_up and then takes -1 instead of round_down. [ 22.318680] ================================================================== [ 22.319745] BUG: KASAN: global-out-of-bounds in bpf_prog_select_runtime+0x48a/0x670 [ 22.320737] Read of size 8 at addr ffffffff82aadae0 by task sockex3/1946 [ 22.321646] [ 22.321858] CPU: 1 PID: 1946 Comm: sockex3 Tainted: G W 4.12.0-rc6-01680-g2ee87db3a287 #22 [ 22.323061] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-1.el7.centos 04/01/2014 [ 22.324260] Call Trace: [ 22.324612] dump_stack+0x67/0x99 [ 22.325081] print_address_description+0x1e8/0x290 [ 22.325734] ? bpf_prog_select_runtime+0x48a/0x670 [ 22.326360] kasan_report+0x265/0x350 [ 22.326860] __asan_report_load8_noabort+0x19/0x20 [ 22.327484] bpf_prog_select_runtime+0x48a/0x670 [ 22.328109] bpf_prog_load+0x626/0xd40 [ 22.328637] ? __bpf_prog_charge+0xc0/0xc0 [ 22.329222] ? check_nnp_nosuid.isra.61+0x100/0x100 [ 22.329890] ? __might_fault+0xf6/0x1b0 [ 22.330446] ? lock_acquire+0x360/0x360 [ 22.331013] SyS_bpf+0x67c/0x24d0 [ 22.331491] ? trace_hardirqs_on+0xd/0x10 [ 22.332049] ? __getnstimeofday64+0xaf/0x1c0 [ 22.332635] ? bpf_prog_get+0x20/0x20 [ 22.333135] ? __audit_syscall_entry+0x300/0x600 [ 22.333770] ? syscall_trace_enter+0x540/0xdd0 [ 22.334339] ? exit_to_usermode_loop+0xe0/0xe0 [ 22.334950] ? do_syscall_64+0x48/0x410 [ 22.335446] ? bpf_prog_get+0x20/0x20 [ 22.335954] do_syscall_64+0x181/0x410 [ 22.336454] entry_SYSCALL64_slow_path+0x25/0x25 [ 22.337121] RIP: 0033:0x7f263fe81f19 [ 22.337618] RSP: 002b:00007ffd9a3440c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000141 [ 22.338619] RAX: ffffffffffffffda RBX: 0000000000aac5fb RCX: 00007f263fe81f19 [ 22.339600] RDX: 0000000000000030 RSI: 00007ffd9a3440d0 RDI: 0000000000000005 [ 22.340470] RBP: 0000000000a9a1e0 R08: 0000000000a9a1e0 R09: 0000009d00000001 [ 22.341430] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000010000 [ 22.342411] R13: 0000000000a9a023 R14: 0000000000000001 R15: 0000000000000003 [ 22.343369] [ 22.343593] The buggy address belongs to the variable: [ 22.344241] interpreters+0x80/0x980 [ 22.344708] [ 22.344908] Memory state around the buggy address: [ 22.345556] ffffffff82aad980: 00 00 00 04 fa fa fa fa 04 fa fa fa fa fa fa fa [ 22.346449] ffffffff82aada00: 00 00 00 00 00 fa fa fa fa fa fa fa 00 00 00 00 [ 22.347361] >ffffffff82aada80: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa [ 22.348301] ^ [ 22.349142] ffffffff82aadb00: 00 01 fa fa fa fa fa fa 00 00 00 00 00 00 00 00 [ 22.350058] ffffffff82aadb80: 00 00 07 fa fa fa fa fa 00 00 05 fa fa fa fa fa [ 22.350984] ================================================================== Fixes: b870aa901f4b ("bpf: use different interpreter depending on required stack size") Signed-off-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Alexei Starovoitov <ast@fb.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: fix spelling mistake: "avialable" -> "available"Colin Ian King1-1/+1
Trivial fix to spelling mistake in netdev_err message Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29Merge branch 'arcnet-features'David S. Miller3-10/+126
Michael Grzeschik says: ==================== arcnet: Collection of latest features Here we sum up the latest features to improve the arcnet framework. One patch is used to get feedback from the transfer queue about failed xfers by adding the err_skb message queue. Beside that we improve the backplane status that can be read by the PCI-based cards and offer that status via an extra sysfs attribute. In the last patch we add another card type PCIFB2. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29arcnet: com20020-pci: add support for PCIFB2 cardMichael Grzeschik1-0/+34
We add support for the PCIFB2 card from EAE. Beside other cards, this card has the backplane mode enabled by default. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29arcnet: com20020-pci: handle backplane mode depending on card typeMichael Grzeschik1-0/+2
We read the backplane mode of each subcard from bits 2 and 3 of the misc register. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29arcnet: com20020-pci: add attribute to readback backplane statusMichael Grzeschik1-0/+22
We add the sysfs interface the read back the backplane status of the interface. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29arcnet: add err_skb package for package status feedbackMichael Grzeschik2-10/+68
We need to track the status of our queued packages. This way the driving process knows if failed packages need to be retransmitted. For this purpose we queue the transferred/failed packages back into the err_skb message queue added with some status information. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29Merge branch 'arcnet-fixes'David S. Miller4-8/+9
Michael Grzeschik says: ==================== arcnet: Collection of latest fixes Here we sum up the recent fixes I collected on the way to use and stabilise the framework. Part of it is an possible deadlock that we prevent as well to fix the calculation of the dev_id that can be setup by an rotary encoder. Beside that we added an trivial spelling patch and fix some wrong and missing assignments that improves the code footprint. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29arcnet: com20020-pci: add missing pdev setup in netdev structureMichael Grzeschik1-0/+1
We add the pdev data to the pci devices netdev structure. This way the interface get consistent device names in the userspace (udev). Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29arcnet: com20020-pci: fix dev_id calculationMichael Grzeschik1-2/+3
The dev_id was miscalculated. Only the two bits 4-5 are relevant for the MA1 card. PCIARC1 and PCIFB2 use the four bits 4-7 for id selection. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29arcnet: com20020: remove needless base_addr assignmentMichael Grzeschik1-2/+0
The assignment is superfluous. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29Trivial fix to spelling mistake in arc_printk messageColin Ian King1-1/+1
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29arcnet: change irq handler to lock irqsaveMichael Grzeschik1-3/+4
This patch prevents the arcnet driver from the following deadlock. [ 41.273910] ====================================================== [ 41.280397] [ INFO: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected ] [ 41.287433] 4.4.0-00034-gc0ae784 #536 Not tainted [ 41.292366] ------------------------------------------------------ [ 41.298863] arcecho/233 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire: [ 41.305628] (&(&lp->lock)->rlock){+.+...}, at: [<bf083bc8>] arcnet_send_packet+0x60/0x1c0 [arcnet] [ 41.315199] [ 41.315199] and this task is already holding: [ 41.321324] (_xmit_ARCNET#2){+.-...}, at: [<c06b934c>] packet_direct_xmit+0xfc/0x1c8 [ 41.329593] which would create a new lock dependency: [ 41.334893] (_xmit_ARCNET#2){+.-...} -> (&(&lp->lock)->rlock){+.+...} [ 41.341801] [ 41.341801] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 41.350108] (_xmit_ARCNET#2){+.-...} ... which became SOFTIRQ-irq-safe at: [ 41.357539] [<c06f8fc8>] _raw_spin_lock+0x30/0x40 [ 41.362677] [<c063ab8c>] dev_watchdog+0x5c/0x264 [ 41.367723] [<c0094edc>] call_timer_fn+0x6c/0xf4 [ 41.372759] [<c00950b8>] run_timer_softirq+0x154/0x210 [ 41.378340] [<c0036b30>] __do_softirq+0x144/0x298 [ 41.383469] [<c0036fb4>] irq_exit+0xcc/0x130 [ 41.388138] [<c0085c50>] __handle_domain_irq+0x60/0xb4 [ 41.393728] [<c0014578>] __irq_svc+0x58/0x78 [ 41.398402] [<c0010274>] arch_cpu_idle+0x24/0x3c [ 41.403443] [<c007127c>] cpu_startup_entry+0x1f8/0x25c [ 41.409029] [<c09adc90>] start_kernel+0x3c0/0x3cc [ 41.414170] [ 41.414170] to a SOFTIRQ-irq-unsafe lock: [ 41.419931] (&(&lp->lock)->rlock){+.+...} ... which became SOFTIRQ-irq-unsafe at: [ 41.427996] ... [<c06f8fc8>] _raw_spin_lock+0x30/0x40 [ 41.433409] [<bf083d54>] arcnet_interrupt+0x2c/0x800 [arcnet] [ 41.439646] [<c0089120>] handle_nested_irq+0x8c/0xec [ 41.445063] [<c03c1170>] regmap_irq_thread+0x190/0x314 [ 41.450661] [<c0087244>] irq_thread_fn+0x1c/0x34 [ 41.455700] [<c0087548>] irq_thread+0x13c/0x1dc [ 41.460649] [<c0050f10>] kthread+0xe4/0xf8 [ 41.465158] [<c000f810>] ret_from_fork+0x14/0x24 [ 41.470207] [ 41.470207] other info that might help us debug this: [ 41.470207] [ 41.478627] Possible interrupt unsafe locking scenario: [ 41.478627] [ 41.485763] CPU0 CPU1 [ 41.490521] ---- ---- [ 41.495279] lock(&(&lp->lock)->rlock); [ 41.499414] local_irq_disable(); [ 41.505636] lock(_xmit_ARCNET#2); [ 41.511967] lock(&(&lp->lock)->rlock); [ 41.518741] <Interrupt> [ 41.521490] lock(_xmit_ARCNET#2); [ 41.525356] [ 41.525356] *** DEADLOCK *** [ 41.525356] [ 41.531587] 1 lock held by arcecho/233: [ 41.535617] #0: (_xmit_ARCNET#2){+.-...}, at: [<c06b934c>] packet_direct_xmit+0xfc/0x1c8 [ 41.544355] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 41.552362] -> (_xmit_ARCNET#2){+.-...} ops: 27 { [ 41.557357] HARDIRQ-ON-W at: [ 41.560664] [<c06f8fc8>] _raw_spin_lock+0x30/0x40 [ 41.567445] [<c063ba28>] dev_deactivate_many+0x114/0x304 [ 41.574866] [<c063bc3c>] dev_deactivate+0x24/0x38 [ 41.581646] [<c0630374>] linkwatch_do_dev+0x40/0x74 [ 41.588613] [<c06305d8>] __linkwatch_run_queue+0xec/0x140 [ 41.596120] [<c0630658>] linkwatch_event+0x2c/0x34 [ 41.602991] [<c004af30>] process_one_work+0x188/0x40c [ 41.610131] [<c004b200>] worker_thread+0x4c/0x480 [ 41.616912] [<c0050f10>] kthread+0xe4/0xf8 [ 41.623048] [<c000f810>] ret_from_fork+0x14/0x24 [ 41.629735] IN-SOFTIRQ-W at: [ 41.633039] [<c06f8fc8>] _raw_spin_lock+0x30/0x40 [ 41.639820] [<c063ab8c>] dev_watchdog+0x5c/0x264 [ 41.646508] [<c0094edc>] call_timer_fn+0x6c/0xf4 [ 41.653190] [<c00950b8>] run_timer_softirq+0x154/0x210 [ 41.660425] [<c0036b30>] __do_softirq+0x144/0x298 [ 41.667201] [<c0036fb4>] irq_exit+0xcc/0x130 [ 41.673518] [<c0085c50>] __handle_domain_irq+0x60/0xb4 [ 41.680754] [<c0014578>] __irq_svc+0x58/0x78 [ 41.687077] [<c0010274>] arch_cpu_idle+0x24/0x3c [ 41.693769] [<c007127c>] cpu_startup_entry+0x1f8/0x25c [ 41.701006] [<c09adc90>] start_kernel+0x3c0/0x3cc [ 41.707791] INITIAL USE at: [ 41.711003] [<c06f8fc8>] _raw_spin_lock+0x30/0x40 [ 41.717696] [<c063ba28>] dev_deactivate_many+0x114/0x304 [ 41.725026] [<c063bc3c>] dev_deactivate+0x24/0x38 [ 41.731718] [<c0630374>] linkwatch_do_dev+0x40/0x74 [ 41.738593] [<c06305d8>] __linkwatch_run_queue+0xec/0x140 [ 41.746011] [<c0630658>] linkwatch_event+0x2c/0x34 [ 41.752789] [<c004af30>] process_one_work+0x188/0x40c [ 41.759847] [<c004b200>] worker_thread+0x4c/0x480 [ 41.766541] [<c0050f10>] kthread+0xe4/0xf8 [ 41.772596] [<c000f810>] ret_from_fork+0x14/0x24 [ 41.779198] } [ 41.780945] ... key at: [<c124d620>] netdev_xmit_lock_key+0x38/0x1c8 [ 41.788192] ... acquired at: [ 41.791309] [<c007bed8>] lock_acquire+0x70/0x90 [ 41.796361] [<c06f9140>] _raw_spin_lock_irqsave+0x40/0x54 [ 41.802324] [<bf083bc8>] arcnet_send_packet+0x60/0x1c0 [arcnet] [ 41.808844] [<c06b9380>] packet_direct_xmit+0x130/0x1c8 [ 41.814622] [<c06bc7e4>] packet_sendmsg+0x3b8/0x680 [ 41.820034] [<c05fe8b0>] sock_sendmsg+0x14/0x24 [ 41.825091] [<c05ffd68>] SyS_sendto+0xb8/0xe0 [ 41.829956] [<c05ffda8>] SyS_send+0x18/0x20 [ 41.834638] [<c000f780>] ret_fast_syscall+0x0/0x1c [ 41.839954] [ 41.841514] the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: [ 41.850302] -> (&(&lp->lock)->rlock){+.+...} ops: 5 { [ 41.855644] HARDIRQ-ON-W at: [ 41.858945] [<c06f8fc8>] _raw_spin_lock+0x30/0x40 [ 41.865726] [<bf083d54>] arcnet_interrupt+0x2c/0x800 [arcnet] [ 41.873607] [<c0089120>] handle_nested_irq+0x8c/0xec [ 41.880666] [<c03c1170>] regmap_irq_thread+0x190/0x314 [ 41.887901] [<c0087244>] irq_thread_fn+0x1c/0x34 [ 41.894593] [<c0087548>] irq_thread+0x13c/0x1dc [ 41.901195] [<c0050f10>] kthread+0xe4/0xf8 [ 41.907338] [<c000f810>] ret_from_fork+0x14/0x24 [ 41.914025] SOFTIRQ-ON-W at: [ 41.917328] [<c06f8fc8>] _raw_spin_lock+0x30/0x40 [ 41.924106] [<bf083d54>] arcnet_interrupt+0x2c/0x800 [arcnet] [ 41.931981] [<c0089120>] handle_nested_irq+0x8c/0xec [ 41.939028] [<c03c1170>] regmap_irq_thread+0x190/0x314 [ 41.946264] [<c0087244>] irq_thread_fn+0x1c/0x34 [ 41.952954] [<c0087548>] irq_thread+0x13c/0x1dc [ 41.959548] [<c0050f10>] kthread+0xe4/0xf8 [ 41.965689] [<c000f810>] ret_from_fork+0x14/0x24 [ 41.972379] INITIAL USE at: [ 41.975595] [<c06f8fc8>] _raw_spin_lock+0x30/0x40 [ 41.982283] [<bf083d54>] arcnet_interrupt+0x2c/0x800 [arcnet] [ 41.990063] [<c0089120>] handle_nested_irq+0x8c/0xec [ 41.997027] [<c03c1170>] regmap_irq_thread+0x190/0x314 [ 42.004172] [<c0087244>] irq_thread_fn+0x1c/0x34 [ 42.010766] [<c0087548>] irq_thread+0x13c/0x1dc [ 42.017267] [<c0050f10>] kthread+0xe4/0xf8 [ 42.023314] [<c000f810>] ret_from_fork+0x14/0x24 [ 42.029903] } [ 42.031648] ... key at: [<bf0854cc>] __key.42091+0x0/0xfffff0f8 [arcnet] [ 42.039255] ... acquired at: [ 42.042372] [<c007bed8>] lock_acquire+0x70/0x90 [ 42.047413] [<c06f9140>] _raw_spin_lock_irqsave+0x40/0x54 [ 42.053364] [<bf083bc8>] arcnet_send_packet+0x60/0x1c0 [arcnet] [ 42.059872] [<c06b9380>] packet_direct_xmit+0x130/0x1c8 [ 42.065634] [<c06bc7e4>] packet_sendmsg+0x3b8/0x680 [ 42.071030] [<c05fe8b0>] sock_sendmsg+0x14/0x24 [ 42.076069] [<c05ffd68>] SyS_sendto+0xb8/0xe0 [ 42.080926] [<c05ffda8>] SyS_send+0x18/0x20 [ 42.085601] [<c000f780>] ret_fast_syscall+0x0/0x1c [ 42.090918] [ 42.092481] [ 42.092481] stack backtrace: [ 42.097065] CPU: 0 PID: 233 Comm: arcecho Not tainted 4.4.0-00034-gc0ae784 #536 [ 42.104751] Hardware name: Generic AM33XX (Flattened Device Tree) [ 42.111183] [<c0017ec8>] (unwind_backtrace) from [<c00139d0>] (show_stack+0x10/0x14) [ 42.119337] [<c00139d0>] (show_stack) from [<c02a82c4>] (dump_stack+0x8c/0x9c) [ 42.126937] [<c02a82c4>] (dump_stack) from [<c0078260>] (check_usage+0x4bc/0x63c) [ 42.134815] [<c0078260>] (check_usage) from [<c0078438>] (check_irq_usage+0x58/0xb0) [ 42.142964] [<c0078438>] (check_irq_usage) from [<c007aaa0>] (__lock_acquire+0x1524/0x20b0) [ 42.151740] [<c007aaa0>] (__lock_acquire) from [<c007bed8>] (lock_acquire+0x70/0x90) [ 42.159886] [<c007bed8>] (lock_acquire) from [<c06f9140>] (_raw_spin_lock_irqsave+0x40/0x54) [ 42.168768] [<c06f9140>] (_raw_spin_lock_irqsave) from [<bf083bc8>] (arcnet_send_packet+0x60/0x1c0 [arcnet]) [ 42.179115] [<bf083bc8>] (arcnet_send_packet [arcnet]) from [<c06b9380>] (packet_direct_xmit+0x130/0x1c8) [ 42.189182] [<c06b9380>] (packet_direct_xmit) from [<c06bc7e4>] (packet_sendmsg+0x3b8/0x680) [ 42.198059] [<c06bc7e4>] (packet_sendmsg) from [<c05fe8b0>] (sock_sendmsg+0x14/0x24) [ 42.206199] [<c05fe8b0>] (sock_sendmsg) from [<c05ffd68>] (SyS_sendto+0xb8/0xe0) [ 42.213978] [<c05ffd68>] (SyS_sendto) from [<c05ffda8>] (SyS_send+0x18/0x20) [ 42.221388] [<c05ffda8>] (SyS_send) from [<c000f780>] (ret_fast_syscall+0x0/0x1c) Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> --- v1 -> v2: removed unneeded zero assignment of flags Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29Merge branch 'amd-xgbe-updates'David S. Miller12-488/+547
Tom Lendacky says: ==================== amd-xgbe: AMD XGBE driver updates 2016-06-28 The following updates and fixes are included in this driver update series: - Simplify mailbox interface code - Fix SFP supported and advertising settings - Fix PTP initialization register usage - Insure there is timestamp skb present before using it - Add a timeout to timestamp register updates - Handle return code from software reset function - Some fixes for handling 2.5Gbps rates - Limit I2C error messages - Fix non-DMA interrupt handling through tasklet usage - Add NUMA affinity support for memory allocations - Add NUMA affinity support for interrupts - Prepare for more fine-grained cache coherency controls - Simplify setting the DMA burst length programming - Performance improvements This patch series is based on net-next. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Adjust register settings to improve performanceLendacky, Thomas5-6/+58
Add support to change some general performance settings and to provide some performance settings based on the device that is probed. This includes: - Setting the maximum read/write outstanding request limit - Reducing the AXI interface burst length size - Selectively setting the Tx and Rx descriptor pre-fetch threshold - Selectively setting additional cache coherency controls Tested and verified on all versions of the hardware. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Simplify the burst length settingsLendacky, Thomas4-64/+31
Currently the driver hardcodes the PBLx8 setting. Remove the need for specifying the PBLx8 setting and automatically calculate based on the specified PBL value. Since the PBLx8 setting applies to both Tx and Rx use the same PBL value for both of them. Also, the driver currently uses a bit field to set the AXI master burst len setting. Change to the full bit field range and set the burst length based on the specified value. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Prepare for more fine grained cache coherency controlsLendacky, Thomas5-67/+14
In prep for setting fine grained read and write DMA cache coherency controls, allow specific values to be used to set the cache coherency registers. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Add NUMA affinity support for IRQ hintsLendacky, Thomas2-3/+17
For IRQ affinity, set the affinity hints for the IRQs to be (initially) on the processors corresponding to the NUMA node of the device. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Add NUMA affinity support for memory allocationsLendacky, Thomas4-194/+217
Add support to perform memory allocations on the node of the device. The original allocation or the ring structure and Tx/Rx queues allocated all of the memory at once and then carved it up for each channel and queue. To best ensure that we get as much memory from the NUMA node as we can, break the channel and ring allocations into individual allocations. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Re-issue interrupt if interrupt status not clearedLendacky, Thomas6-17/+115
Some of the device interrupts should function as level interrupts. For some hardware configurations this requires setting some control bits so that if the interrupt status has not been cleared the interrupt should be reissued. Additionally, when using MSI or MSI-X interrupts, run the interrupt service routine as a tasklet so that the re-issuance of the interrupt is handled properly. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Limit the I2C error messages that are outputLendacky, Thomas1-3/+6
When I2C communication fails, it tends to always fail. Rather than continuously issue an error message (once per second in most cases), change the message to be issued just once. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Fixes for working with PHYs that support 2.5GbELendacky, Thomas1-0/+7
The driver has some missing functionality when operating in the mode that supports 2.5GbE. Fix the driver to fully recognize and support this speed. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Handle return code from software reset functionLendacky, Thomas1-1/+5
Currently the function that performs a software reset of the hardware provides a return code. During driver probe check this return code and exit with an error if the software reset fails. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Prevent looping forever if timestamp update failsLendacky, Thomas1-2/+13
Just to be on the safe side, should the update of the timestamp registers not complete, issue a warning rather than looping forever waiting for the update to complete. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Add a check for an skb in the timestamp pathLendacky, Thomas1-1/+6
Spurious Tx timestamp interrupts can cause an oops in the Tx timestamp processing function if a Tx timestamp skb is NULL. Add a check to insure a Tx timestamp skb is present before attempting to use it. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Use the proper register during PTP initializationLendacky, Thomas1-1/+1
During PTP initialization, the Timestamp Control register should be cleared and not the Tx Configuration register. While this typo causes the wrong register to be cleared, the default value of each register and and the fact that the Tx Configuration register is programmed afterwards doesn't result in a bug, hence only fixing in net-next. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Fix SFP PHY supported/advertised settingsLendacky, Thomas1-22/+47
When using SFPs, the supported and advertised settings should be initially based on the SFP that has been detected. The code currently indicates the overall support of the device as opposed to what the SFP is capable of. Update the code to change the supported link modes, auto-negotiation, etc. to be based on the installed SFP. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29amd-xgbe: Simplify mailbox interface rate change codeLendacky, Thomas1-126/+29
Simplify and centralize the mailbox command rate change interface by having a single function perform the writes to the mailbox registers to issue the request. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29rocker: move dereference before freeDan Carpenter1-1/+1
My static checker complains that ofdpa_neigh_del() can sometimes free "found". It just makes sense to use it first before deleting it. Fixes: ecf244f753e0 ("rocker: fix maybe-uninitialized warning") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29iwlwifi: bump MAX API for 8000/9000/A000 to 33Luca Coelho3-4/+4
Bump the maximum API supported by these device families to 33. Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: pcie: wait longer after device resetEmmanuel Grumbach4-25/+15
The newest devices need a longer time to reset because of their more complex hardware. Wait 5ms after device reset. Consolidate all the places that reset the device in the PCIe transport to avoid future bugs. While at it, unify the flow to use set_bit instead of full write as requested by the hardware designers. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: pcie: propagate iwl_pcie_apm_init's statusEmmanuel Grumbach1-8/+13
iwl_pcie_apm_init can fail so make sure that the caller takes the status into account. Also, ensure that the error that iwl_pcie_apm_init can emit will appear in the kernel log by default. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: mvm: quietly accept non-sta disassoc framesJohannes Berg1-1/+4
When a station that's not associated sends a data frame (e.g. an NDP) hostapd will respond with a disassoc frame, telling it that it's not associated. The station might also not be authenticated, in which case there will not be a station entry for it, and as a result we need to accept such frames without a station. Fixes: 3ee0f0e23e4f ("iwlwifi: mvm: fix DQA AP mode station assumption") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: mvm: update rx statistics cmd apiLiad Kaufman7-141/+371
The API has changed - update the code. Signed-off-by: Liad Kaufman <liad.kaufman@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: mvm: remove DQA non-STA client mode special caseJohannes Berg1-8/+0
When we get a non-STA frame to transmit in client mode, we try to use the IWL_MVM_DQA_BSS_CLIENT_QUEUE queue (queue #4). However, at this point, the queue might not be allocated at all, causing warnings. The scenario on which this happened was a race condition between mac80211 and our queue allocation work: * mac80211 sends auth * we stop mac80211 queues to allocate a hw queue * authentication is aborted * we allocate HW queue and start mac80211 queues * mac80211 removes station * mac80211 hands us the auth frame from the pending queue At this point, since mac80211 has already removed the station, we try to transmit the frame through this special non-station case on queue 4 anyway. In order to really use it properly, we'd have to again go through the hw queue allocation work, and attach it to a station, etc. In this case that isn't possible (there's no station anymore), but if this special case were needed, then we'd have to do it this way. However, the special case is documented to exist for TDLS, but can't trigger there because the TDLS setup frames etc. are normal to-DS frames going to the peer through the AP. Testing also confirms that this code path isn't triggered in TDLS. Therefore, remove the code path to avoid using an unused queue. The erroneous frame described above will still be transmitted on the AUX queue, but arguably that's a mac80211 problem, which will eventually be fixed by moving everything there to TXQs. Fixes: e3118ad74d7e ("iwlwifi: mvm: support tdls in dqa mode") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: mvm: don't mess the SNAP header in TSO for non-QoS packetsEmmanuel Grumbach1-4/+6
When we get large sends on non-QoS association, we had a bug that mangled the SNAP header. Fix that. Fixes: a6d5e32f247c ("iwlwifi: mvm: send large SKBs to the transport") Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: pcie: reconfigure MSI-X HW on resumeJohannes Berg1-0/+3
When going into suspend, the HW configuration for MSI-X will likely be lost. As a consequence, after waking up, all IRQ causes will be mapped to interrupt 0, and as a consequence we don't notice the interrupt because in most cases this is an interrupt for a queue, and getting it doesn't read the other cause registers. Fixes: 2e5d4a8f61dc ("iwlwifi: pcie: Add new configuration to enable MSIX") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: mvm: don't send fetch the TID from a non-QoS packet in TSOEmmanuel Grumbach1-5/+5
Getting the TID of a packet before we know it is a QoS data packet isn't a good idea. Delay the TID retrieval until we know the packet is a QoS data packet. Fixes: bb81bb68f472 ("iwlwifi: mvm: add Tx A-MSDU inside A-MPDU") Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: mvm: fix mac80211's hw_queue in DQA modeJohannes Berg1-6/+26
When in non-DQA mode, mac80211 actually gets a pretty much perfect idea (in vif->hw_queue/cab_queue) of which queues we're using. But in DQA mode, this isn't true - nonetheless, we were adding all the queues, even the ones stations are using, to the queue allocation bitmap. Fix this, we should only add the queues we really are using in DQA mode: * IWL_MVM_OFFCHANNEL_QUEUE, as we use this in both modes * mvm->aux_queue, as we use this in both modes - mac80211 never really knows about it but we use it as a cookie internally, so can't reuse it * possibly the GCAST queue (cab_queue) * all the "queues" we told mac80211 about we were using on each interface (vif->hw_queue), these are entirely virtual in this mode Also add back the failure now when we can't allocate any more of these - now virtual - queues; this was skipped in DQA mode and would lead to having multiple ACs or even interfaces use the same queue number in mac80211 (10, since that's the limit), which would stop far too many queues if stopped. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: mvm: map cab_queue to real one earlierJohannes Berg1-5/+6
There may be a difference between the mac80211 vif->cab_queue and mvmvif->cab_queue, particularly with TVQM. Make the code map this earlier, instead of first returning the mac80211 one again from iwl_mvm_get_ctrl_vif_queue(). Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: mvm: fix mac80211 queue trackingJohannes Berg3-2/+12
In the driver, we track which hardware queue is associated with which mac80211 "hw_queue", in order to be able to stop and wake it. When moving these bitmaps out of the queue_info structures, the type of the bitmap was erroneously changed from u32 to u8, presumably in order to save memory. Turns out that u32 isn't needed, because the highest queue we can ever tell mac80211 is always < 16, but a u16 definitely is needed, queues >=8 do happen. While at it, throw a BUILD_BUG_ON() into the place where we set the limit (mvm->first_agg_queue) and a warning when it actually gets put into the bitmap. The consequence of this bug is that full HW queues associated with such a too-high mac80211 number never stop higher layer queues when full, and thus would simply drop all packets that couldn't be enqueued to the hardware queue. Fixes: 34e10860ae8d ("iwlwifi: mvm: remove references to queue_info in new TX path") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: mvm: properly enable IP header checksummingJohannes Berg1-8/+12
The code was intended to enable IP header checksumming on AMSDUs, but failed to really do so because the A-MSDU bit was set after all the checksumming bits, and thus checking for A-MSDU could never be true. Fix this by setting the A-MSDU bit before the offload bits. Fixes: 5e6a98dc4863 ("iwlwifi: mvm: enable TCP/UDP checksum support for 9000 family") Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29iwlwifi: pcie: add MSI-X interrupt tracingJohannes Berg2-1/+29
We have tracing for both pre-ICT and ICT interrupts, including all the data read there. Extend the tracing to MSI-X interrupts. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-06-29Merge branch 'bpf-Add-syscall-lookup-support-for-fd-array-and-htab'David S. Miller8-4/+101
Martin KaFai Lau says: ==================== bpf: Add syscall lookup support for fd array and htab This patchset adds BPF_MAP_LOOKUP_ELEM syscall support for BPF_MAP_TYPE_PROG_ARRAY, BPF_MAP_TYPE_ARRAY_OF_MAPS and BPF_MAP_TYPE_HASH_OF_MAPS ==================== Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29bpf: Add test for syscall on fd array/htab lookupMartin KaFai Lau2-1/+31
Checks are added to the existing sockex3 and test_map_in_map test. Signed-off-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29bpf: Add syscall lookup support for fd array and htabMartin KaFai Lau6-3/+70
This patch allows userspace to do BPF_MAP_LOOKUP_ELEM on BPF_MAP_TYPE_PROG_ARRAY, BPF_MAP_TYPE_ARRAY_OF_MAPS and BPF_MAP_TYPE_HASH_OF_MAPS. The lookup returns a prog-id or map-id to the userspace. The userspace can then use the BPF_PROG_GET_FD_BY_ID or BPF_MAP_GET_FD_BY_ID to get a fd. Signed-off-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-29mlxsw: spectrum_router: Fix NULL pointer dereferenceIdo Schimmel1-0/+3
In case a VLAN device is enslaved to a bridge we shouldn't create a router interface (RIF) for it when it's configured with an IP address. This is already handled by the driver for other types of netdevs, such as physical ports and LAG devices. If this IP address is then removed and the interface is subsequently unlinked from the bridge, a NULL pointer dereference can happen, as the original 802.1d FID was replaced with an rFID which was then deleted. To reproduce: $ ip link set dev enp3s0np9 up $ ip link add name enp3s0np9.111 link enp3s0np9 type vlan id 111 $ ip link set dev enp3s0np9.111 up $ ip link add name br0 type bridge $ ip link set dev br0 up $ ip link set enp3s0np9.111 master br0 $ ip address add dev enp3s0np9.111 192.168.0.1/24 $ ip address del dev enp3s0np9.111 192.168.0.1/24 $ ip link set dev enp3s0np9.111 nomaster Fixes: 99724c18fc66 ("mlxsw: spectrum: Introduce support for router interfaces") Signed-off-by: Ido Schimmel <idosch@mellanox.com> Reported-by: Petr Machata <petrm@mellanox.com> Tested-by: Petr Machata <petrm@mellanox.com> Reviewed-by: Petr Machata <petrm@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.0) at 2025-10-01 00:37:04 +0300