- 26 Nov, 2021 21 commits
-
-
Emmanuel Grumbach authored
Add the vendor commands that must be used by the network manager to allow proper operation of iwlmei. * Send information on the AP CSME is connected to * Notify the userspace when roaming is forbidden * Allow the userspace to require ownership Co-Developed-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> v6: remove the VENDOR_CMDS Kconfig option and make the whole infra depend on IWLMEI directly v7: remove // comments remove an unneeded function Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211112062814.7502-5-emmanuel.grumbach@intel.com
-
Emmanuel Grumbach authored
iwlmei needs to know about the follwing events: * Association * De-association * Country Code change * SW Rfkill change * SAR table changes iwlmei can take the device away from us, so report the new rfkill type when this happens. Advertise the required data from the CSME firmware to the usersapce: mostly, the AP that the CSME firmware is currently associated to in case there is an active link protection session. Generate the HOST_ASSOC / HOST_DISSASSOC messages. Don't support WPA1 (non-RSNA) for now. Don't support shared wep either. We can then determine the AUTH parameter by checking the AKM. Feed the cipher from the key installation. SW Rfkill will be implemented later when cfg80211 will allow us to read the SW Rfkill state. Co-Developed-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> v7: Ayala added her signed-off remove pointless function declaration fix a bug due to merge conflict in the HOST_ASSOC message v8: leave a print if we have a SAP connection on a device we do not support (yet) Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211112062814.7502-4-emmanuel.grumbach@intel.com
-
Emmanuel Grumbach authored
Add three debugfs hooks: * status: Check if we have a connection with the CSME firwmare. This hook is a read only. * req_ownership: Send a SAP command to request ownership. This flow should be triggered by iwlwifi (from user space through vendor commands really), but being able to trigger an ownership request from debugfs allows us to request ownership without connecting afterwards. This is an "error" flow that the CSME firmware is designed to handle this way: + Grant ownership since the host asked for it + Wait 3 seconds to let the host connect + If the host didn't connect, take the device back (forcefully). + Don't grant any new ownership request in the following 30 seconds. This debugfs hook allows us to test this flow. * send_start_message: Restart the communication with the CSME firmware from the very beginning. At the very beginning (upon iwlwifi start), iwlmei send a special message: SAP_ME_MSG_START. This hook allows to send it again and this will retrigger the whole flow. It is important to test this restart in the middle of normal operation since it can happen (in case the CSME firmware decided to reset for example). Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211112062814.7502-3-emmanuel.grumbach@intel.com
-
Emmanuel Grumbach authored
CSME in two words ----------------- CSME stands for Converged Security and Management Engine. It is a CPU on the chipset and runs a dedicated firmware. AMT (Active Management Technology) is one of the applications that run on that CPU. AMT allows to control the platform remotely. Here is a partial list of the use cases: * View the screen of the plaform, with keyboard and mouse (KVM) * Attach a remote IDE device * Have a serial console to the device * Query the state of the platform * Reset / shut down / boot the platform Networking in CSME ------------------ For those uses cases, CSME's firmware has an embedded network stack and is able to use the network devices of the system: LAN and WLAN. This is thanks to the CSME's firmware WLAN driver. One can add a profile (SSID / key / certificate) to the CSME's OS and CSME will connect to that profile. Then, one can use the WLAN link to access the applications that run on CSME (AMT is one of them). Note that CSME is active during power state and power state transitions. For example, it is possible to have a KVM session open to the system while the system is rebooting and actually configure the BIOS remotely over WLAN thanks to AMT. How all this is related to Linux -------------------------------- In Linux, there is a driver that allows the OS to talk to the CSME firmware, this driver is drivers/misc/mei. This driver advertises a bus that allows other kernel drivers or even user space) to talk to components inside the CSME firmware. In practice, the system advertises a PCI device that allows to send / receive data to / from the CSME firmware. The mei bus drivers in drivers/misc/mei is an abstration on top of this PCI device. The driver being added here is called iwlmei and talks to the WLAN driver inside the CSME firmware through the mei bus driver. Note that the mei bus driver only gives bus services, it doesn't define the content of the communication. Why do we need this driver? -------------------------- CSME uses the same WLAN device that the OS is expecting to see hence we need an arbitration mechanism. This is what iwlmei is in charge of. iwlmei maintains the communication with the CSME firmware's WLAN driver. The language / protocol that is used between the CSME's firmware WLAN driver and iwlmei is OS agnostic and is called SAP which stands for Software Abritration Protocol. With SAP, iwlmei will be able to tell the CSME firmware's WLAN driver: 1) Please give me the device. 2) Please note that the SW/HW rfkill state change. 3) Please note that I am now associated to X. 4) Please note that I received this packet. etc... There are messages that go the opposite direction as well: 1) Please note that AMT is en/disable. 2) Please note that I believe the OS is broken and hence I'll take the device *now*, whether you like it or not, to make sure that connectivity is preserved. 3) Please note that I am willing to give the device if the OS needs it. 4) Please give me any packet that is sent on UDP / TCP on IP address XX.XX.XX.XX and an port ZZ. 5) Please send this packet. etc... Please check drivers/net/wireless/intel/iwlwifi/mei/sap.h for the full protocol specification. Arbitration is not the only purpose of iwlmei and SAP. SAP also allows to maintain the AMT's functionality even when the OS owns the device. To connect to AMT, one needs to initiate an HTTP connection to port 16992. iwlmei will listen to the Rx path and forward (through SAP) to the CSME firmware the data it got. Then, the embedded HTTP server in the chipset will reply to the request and send a SAP notification to ask iwlmei to send the reply. This way, AMT running on the CSME can still work. In practice this means that all the use cases quoted above (KVM, remote IDE device, etc...) will work even when the OS uses the WLAN device. How to disable all this? --------------------------- iwlmei won't be able to do anything if the CSME's networking stack is not enabled. By default, CSME's networking stack is disabled (this is a BIOS setting). In case the CSME's networking stack is disabled, iwlwifi will just get access to the device because there is no contention with any other actor and, hence, no arbitration is needed. In this patch, I only add the iwlmei driver. Integration with iwlwifi will be implemented in the next one. Co-Developed-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> v2: fix a few warnings raised by the different bots v3: rewrite the commit message v4: put the debugfs content in a different patch v5: fix a NULL pointer dereference upon DHCP TX if SAP is connected since we now have the required cfg80211 bits in wl-drv-next, add the RFKILL handling patch to this series. v6: change the SAP API to inherit the values from iwl-mei.h removing the need to ensure the values are equal with a BUILD_BUG_ON. This was suggested by Arend v7: * fix a locking issue in case of CSME firmware reset: When the CSME firmware resets, we need to unregister the netdev, first take the mutex, and only then, rely on it being taken. * Add a comment to explain why it is ok to have static variables (iwlmei can't have more than a single instance). * Add a define for 26 + 8 + 8 * Add a define SEND_SAP_MAX_WAIT_ITERATION * make struct const * Reword a bit the Kconfig help message * Ayala added her Signed-off * fixed an RCU annotation v8: do not require ownership upfront, use NIC_OWNER instead. This fixes a deadlock when CSME does not have the right WiFi FW. Add more documentation about the owernship transition Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211112062814.7502-2-emmanuel.grumbach@intel.com
-
Alexander Usyskin authored
Expose the client dma mapping via mei client bus interface. The client dma has to be mapped before the device is enabled, therefore we need to create device linking already during mapping and we need to unmap after the client is disable hence we need to postpone the unlink and flush till unmapping or when destroying the device. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Co-developed-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20210420172755.12178-1-emmanuel.grumbach@intel.comSigned-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211112062814.7502-1-emmanuel.grumbach@intel.com
-
Jonas Dreßler authored
The firmware of the 88W8897 PCIe+USB card sends those events very unreliably, sometimes bluetooth together with 2.4ghz-wifi is used and no COEX event comes in, and sometimes bluetooth is disabled but the coexistance mode doesn't get disabled. This means we sometimes end up capping the rx/tx window size while bluetooth is not enabled anymore, artifically limiting wifi speeds even though bluetooth is not being used. Since we can't fix the firmware, let's just ignore those events on the 88W8897 device. From some Wireshark capture sessions it seems that the Windows driver also doesn't change the rx/tx window sizes when bluetooth gets enabled or disabled, so this is fairly consistent with the Windows driver. Signed-off-by: Jonas Dreßler <verdre@v0yd.nl> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211103205827.14559-1-verdre@v0yd.nl
-
Jonas Dreßler authored
We assume at a few places that priv->version_str is 0-terminated, but right now we trust the firmware that this is the case with the version string we get from it. Let's rather ensure this ourselves and replace the last character with '\0'. Signed-off-by: Jonas Dreßler <verdre@v0yd.nl> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211103201800.13531-4-verdre@v0yd.nl
-
Jonas Dreßler authored
The 88W8897 PCIe+USB card in the hardware revision 20 apparently has a hardware issue where the card wakes up from deep sleep randomly and very often, somewhat depending on the card activity, maybe the hardware has a floating wakeup pin or something. This was found by comparing two MS Surface Book 2 devices, where one devices wifi card experienced spurious wakeups, while the other one didn't. Those continuous wakeups prevent the card from entering host sleep when the computer suspends. And because the host won't answer to events from the card anymore while it's suspended, the firmwares internal power saving state machine seems to get confused and the card can't sleep anymore at all after that. Since we can't work around that hardware bug in the firmware, let's get the hardware revision string from the firmware and match it with known bad revisions. Then disable auto deep sleep for those revisions, which makes sure we no longer get those spurious wakeups. Signed-off-by: Jonas Dreßler <verdre@v0yd.nl> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211103201800.13531-3-verdre@v0yd.nl
-
Jonas Dreßler authored
Since the version string we get from the firmware is always 128 characters long, use a define for this size instead of having the number 128 copied all over the place. Signed-off-by: Jonas Dreßler <verdre@v0yd.nl> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211103201800.13531-2-verdre@v0yd.nl
-
Zekun Shen authored
Currently, with an unknown recv_type, mwifiex_usb_recv just return -1 without restoring the skb. Next time mwifiex_usb_rx_complete is invoked with the same skb, calling skb_put causes skb_over_panic. The bug is triggerable with a compromised/malfunctioning usb device. After applying the patch, skb_over_panic no longer shows up with the same input. Attached is the panic report from fuzzing. skbuff: skb_over_panic: text:000000003bf1b5fa len:2048 put:4 head:00000000dd6a115b data:000000000a9445d8 tail:0x844 end:0x840 dev:<NULL> kernel BUG at net/core/skbuff.c:109! invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 PID: 198 Comm: in:imklog Not tainted 5.6.0 #60 RIP: 0010:skb_panic+0x15f/0x161 Call Trace: <IRQ> ? mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] skb_put.cold+0x24/0x24 mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] __usb_hcd_giveback_urb+0x1e4/0x380 usb_giveback_urb_bh+0x241/0x4f0 ? __hrtimer_run_queues+0x316/0x740 ? __usb_hcd_giveback_urb+0x380/0x380 tasklet_action_common.isra.0+0x135/0x330 __do_softirq+0x18c/0x634 irq_exit+0x114/0x140 smp_apic_timer_interrupt+0xde/0x380 apic_timer_interrupt+0xf/0x20 </IRQ> Reported-by: Brendan Dolan-Gavitt <brendandg@nyu.edu> Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home
-
Ping-Ke Shih authored
8821CE causes random freezes on HP 250 G7 Notebook PC. Add a quirk to disable pci ASPM capability. Reported-by: rtl8821cerfe2 <rtl8821cerfe2@protonmail.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211119052437.8671-1-pkshih@realtek.com
-
Yu-Yen Ting authored
The management frame with high rate e.g. 24M may not be transmitted smoothly in long range environment. Add a debugfs to force to use the lowest basic rate in order to debug the reachability of transmitting management frame. obtain current setting cat /sys/kernel/debug/ieee80211/phyX/rtw88/force_lowest_basic_rate force lowest rate: echo 1 > /sys/kernel/debug/ieee80211/phyX/rtw88/force_lowest_basic_rate Signed-off-by: Yu-Yen Ting <steventing@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211102022454.10944-2-pkshih@realtek.com
-
Yu-Yen Ting authored
By default the driver uses the 1M and 6M rate for managemnt frames in 2G and 5G bands respectively. But when the basic rates is configured from the mac80211, we need to send the management frames according to the basic rates. This commit makes the driver use the lowest basic rates to send the management frames. Signed-off-by: Yu-Yen Ting <steventing@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211102022454.10944-1-pkshih@realtek.com
-
Chia-Yuan Li authored
The AXIDMA is tx/rx packet transmission between PCIE host and device, and TX FIFO is MAC TX data. We dump them to verify that these memory buffers are correct. Signed-off-by: Chia-Yuan Li <leo.li@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Reviewed-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211122021129.4339-1-pkshih@realtek.com
-
Ping-Ke Shih authored
The RF register array is used to help firmware to restore RF settings. The original code can potentially access out of range, if the size is between (RTW89_H2C_RF_PAGE_SIZE * RTW89_H2C_RF_PAGE_NUM + 1) to ((RTW89_H2C_RF_PAGE_SIZE + 1) * RTW89_H2C_RF_PAGE_NUM). Fortunately, current used size doesn't fall into the wrong case, and the size will not change if we don't update RF parameter. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211119055729.12826-1-pkshih@realtek.com
-
Changcheng Deng authored
Fix the following coccicheck review: ./drivers/net/wireless/realtek/rtw89/mac.c: 1096: 5-8: Unneeded variable Remove unneeded variable used to store return value. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Changcheng Deng <deng.changcheng@zte.com.cn> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211110121135.151187-1-deng.changcheng@zte.com.cn
-
Ye Guojin authored
The conditional operator is unnecessary while assigning values to the bool variables. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Ye Guojin <ye.guojin@zte.com.cn> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211104061119.1685-1-ye.guojin@zte.com.cn
-
Zong-Zhe Yang authored
Start to configure entries with RTW89_QATAR, RTW89_UKRAINE, RTW89_CN. Adjust some entries with explicit rtw89_regulatory instead of RTW89_WW. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211101093106.28848-5-pkshih@realtek.com
-
Zong-Zhe Yang authored
Update tx power limit table and tx power limit_ru table to R54. Configure entries for MEXICO, CN, QATAR, and adjust some values of original entries. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211101093106.28848-4-pkshih@realtek.com
-
Zong-Zhe Yang authored
Support QATAR in rtw89_regulation_type and reorder the enum to align realtek R58-R31 regulation definition. Besides, if an unassigned entry of limit/limit_ru tables is read, return the corresponding WW value for the unconfigured case. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211101093106.28848-3-pkshih@realtek.com
-
Zong-Zhe Yang authored
This modification just replaces the number filled in the regd field with the corresponding enum. No assignment of a value in a table is changed. Doing this first is because the follow-up patches may adjust the order of enum declarations. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Reviewed-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211101093106.28848-2-pkshih@realtek.com
-
- 19 Nov, 2021 4 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo authored
ath.git patches for v5.17. Major changes: ath10k * fetch (pre-)calibration data via nvmem subsystem ath11k * enable 802.11 power save mode in station mode for qca6390 and wcn6855 * trace log support * proper board file detection for WCN6855 based on PCI ids * BSS color change support
-
Peter Seiderer authored
The struct ath_hw member intr_txqs is never reset/assigned outside of ath9k_hw_init_queues() and with the used bitwise-or in the interrupt handling ar9002_hw_get_isr() accumulates all ever set interrupt flags. Fix this by using a pure assign instead of bitwise-or for the first line (note: intr_txqs is only evaluated in case ATH9K_INT_TX bit is set). Signed-off-by: Peter Seiderer <ps.report@gmx.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211116220720.30145-1-ps.report@gmx.net
-
Seevalamuthu Mariappan authored
Wakeup mhi is needed before pci_read/write only for QCA6390 and WCN6855. Since wakeup & release mhi is enabled for all hardwares, below mhi assert is seen in QCN9074 when doing 'rmmod ath11k_pci': Kernel panic - not syncing: dev_wake != 0 CPU: 2 PID: 13535 Comm: procd Not tainted 4.4.60 #1 Hardware name: Generic DT based system [<80316dac>] (unwind_backtrace) from [<80313700>] (show_stack+0x10/0x14) [<80313700>] (show_stack) from [<805135dc>] (dump_stack+0x7c/0x9c) [<805135dc>] (dump_stack) from [<8032136c>] (panic+0x84/0x1f8) [<8032136c>] (panic) from [<80549b24>] (mhi_pm_disable_transition+0x3b8/0x5b8) [<80549b24>] (mhi_pm_disable_transition) from [<80549ddc>] (mhi_power_down+0xb8/0x100) [<80549ddc>] (mhi_power_down) from [<7f5242b0>] (ath11k_mhi_op_status_cb+0x284/0x3ac [ath11k_pci]) [E][__mhi_device_get_sync] Did not enter M0 state, cur_state:RESET pm_state:SHUTDOWN Process [E][__mhi_device_get_sync] Did not enter M0 state, cur_state:RESET pm_state:SHUTDOWN Process [E][__mhi_device_get_sync] Did not enter M0 state, cur_state:RESET pm_state:SHUTDOWN Process [<7f5242b0>] (ath11k_mhi_op_status_cb [ath11k_pci]) from [<7f524878>] (ath11k_mhi_stop+0x10/0x20 [ath11k_pci]) [<7f524878>] (ath11k_mhi_stop [ath11k_pci]) from [<7f525b94>] (ath11k_pci_power_down+0x54/0x90 [ath11k_pci]) [<7f525b94>] (ath11k_pci_power_down [ath11k_pci]) from [<8056b2a8>] (pci_device_shutdown+0x30/0x44) [<8056b2a8>] (pci_device_shutdown) from [<805cfa0c>] (device_shutdown+0x124/0x174) [<805cfa0c>] (device_shutdown) from [<8033aaa4>] (kernel_restart+0xc/0x50) [<8033aaa4>] (kernel_restart) from [<8033ada8>] (SyS_reboot+0x178/0x1ec) [<8033ada8>] (SyS_reboot) from [<80301b80>] (ret_fast_syscall+0x0/0x34) Hence, disable wakeup/release mhi using hw_param for other hardwares. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01060-QCAHKSWPL_SILICONZ-1 Fixes: a05bd851 ("ath11k: read and write registers below unwindowed address") Signed-off-by: Seevalamuthu Mariappan <quic_seevalam@quicinc.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/1636702019-26142-1-git-send-email-quic_seevalam@quicinc.com
-
Jakub Kicinski authored
Merge tag 'regmap-no-bus-update-bits' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Mark Brown says: =================== regmap: Allow regmap_update_bits() to be offloaded with no bus Some hardware can do this so let's use that capability. =================== Link: https://lore.kernel.org/all/YZWDOidBOssP10yS@sirena.org.uk/Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
- 18 Nov, 2021 15 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski authored
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netLinus Torvalds authored
Pull networking fixes from Jakub Kicinski: "Including fixes from bpf, mac80211. Current release - regressions: - devlink: don't throw an error if flash notification sent before devlink visible - page_pool: Revert "page_pool: disable dma mapping support...", turns out there are active arches who need it Current release - new code bugs: - amt: cancel delayed_work synchronously in amt_fini() Previous releases - regressions: - xsk: fix crash on double free in buffer pool - bpf: fix inner map state pruning regression causing program rejections - mac80211: drop check for DONT_REORDER in __ieee80211_select_queue, preventing mis-selecting the best effort queue - mac80211: do not access the IV when it was stripped - mac80211: fix radiotap header generation, off-by-one - nl80211: fix getting radio statistics in survey dump - e100: fix device suspend/resume Previous releases - always broken: - tcp: fix uninitialized access in skb frags array for Rx 0cp - bpf: fix toctou on read-only map's constant scalar tracking - bpf: forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs - tipc: only accept encrypted MSG_CRYPTO msgs - smc: transfer remaining wait queue entries during fallback, fix missing wake ups - udp: validate checksum in udp_read_sock() (when sockmap is used) - sched: act_mirred: drop dst for the direction from egress to ingress - virtio_net_hdr_to_skb: count transport header in UFO, prevent allowing bad skbs into the stack - nfc: reorder the logic in nfc_{un,}register_device, fix unregister - ipsec: check return value of ipv6_skip_exthdr - usb: r8152: add MAC passthrough support for more Lenovo Docks" * tag 'net-5.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (96 commits) ptp: ocp: Fix a couple NULL vs IS_ERR() checks net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock() net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound ipv6: check return value of ipv6_skip_exthdr e100: fix device suspend/resume devlink: Don't throw an error if flash notification sent before devlink visible page_pool: Revert "page_pool: disable dma mapping support..." ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() octeontx2-af: debugfs: don't corrupt user memory NFC: add NCI_UNREG flag to eliminate the race NFC: reorder the logic in nfc_{un,}register_device NFC: reorganize the functions in nci_request tipc: check for null after calling kmemdup i40e: Fix display error code in dmesg i40e: Fix creation of first queue by omitting it if is not power of two i40e: Fix warning message and call stack during rmmod i40e driver i40e: Fix ping is lost after configuring ADq on VF i40e: Fix changing previously set num_queue_pairs for PFs i40e: Fix NULL ptr dereference on VSI filter sync i40e: Fix correct max_pkt_size on VF RX queue ...
-
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linuxLinus Torvalds authored
Pull btrfs fixes from David Sterba: "Several xes and one old ioctl deprecation. Namely there's fix for crashes/warnings with lzo compression that was suspected to be caused by first pull merge resolution, but it was a different bug. Summary: - regression fix for a crash in lzo due to missing boundary checks of the page array - fix crashes on ARM64 due to missing barriers when synchronizing status bits between work queues - silence lockdep when reading chunk tree during mount - fix false positive warning in integrity checker on devices with disabled write caching - fix signedness of bitfields in scrub - start deprecation of balance v1 ioctl" * tag 'for-5.16-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: deprecate BTRFS_IOC_BALANCE ioctl btrfs: make 1-bit bit-fields of scrub_page unsigned int btrfs: check-integrity: fix a warning on write caching disabled disk btrfs: silence lockdep when reading chunk tree during mount btrfs: fix memory ordering between normal and ordered work functions btrfs: fix a out-of-bound access in copy_compressed_data_to_page()
-
git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fsLinus Torvalds authored
Pull UDF fix from Jan Kara: "A fix for a long-standing UDF bug where we were not properly validating directory position inside readdir" * tag 'fs_for_v5.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix crash after seekdir
-
git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linuxLinus Torvalds authored
Pull setattr idmapping fix from Christian Brauner: "This contains a simple fix for setattr. When determining the validity of the attributes the ia_{g,u}id fields contain the value that will be written to inode->i_{g,u}id. When the {g,u}id attribute of the file isn't altered and the caller's fs{g,u}id matches the current {g,u}id attribute the attribute change is allowed. The value in ia_{g,u}id does already account for idmapped mounts and will have taken the relevant idmapping into account. So in order to verify that the {g,u}id attribute isn't changed we simple need to compare the ia_{g,u}id value against the inode's i_{g,u}id value. This only has any meaning for idmapped mounts as idmapping helpers are idempotent without them. And for idmapped mounts this really only has a meaning when circular idmappings are used, i.e. mappings where e.g. id 1000 is mapped to id 1001 and id 1001 is mapped to id 1000. Such ciruclar mappings can e.g. be useful when sharing the same home directory between multiple users at the same time. Before this patch we could end up denying legitimate attribute changes and allowing invalid attribute changes when circular mappings are used. To even get into this situation the caller must've been privileged both to create that mapping and to create that idmapped mount. This hasn't been seen in the wild anywhere but came up when expanding the fstest suite during work on a series of hardening patches. All idmapped fstests pass without any regressions and we're adding new tests to verify the behavior of circular mappings. The new tests can be found at [1]" Link: https://lore.kernel.org/linux-fsdevel/20211109145713.1868404-2-brauner@kernel.org [1] * tag 'fs.idmapped.v5.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: fs: handle circular mappings correctly
-
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linuxLinus Torvalds authored
Pull parisc fixes from Helge Deller: "parisc bug and warning fixes and wire up futex_waitv. Fix some warnings which showed up with allmodconfig builds, a revert of a change to the sigreturn trampoline which broke signal handling, wire up futex_waitv and add CONFIG_PRINTK_TIME=y to 32bit defconfig" * tag 'for-5.16/parisc-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Enable CONFIG_PRINTK_TIME=y in 32bit defconfig Revert "parisc: Reduce sigreturn trampoline to 3 instructions" parisc: Wrap assembler related defines inside __ASSEMBLY__ parisc: Wire up futex_waitv parisc: Include stringify.h to avoid build error in crypto/api.c parisc/sticon: fix reverse colors
-
git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds authored
Pull KVM fixes from Paolo Bonzini: "Selftest changes: - Cleanups for the perf test infrastructure and mapping hugepages - Avoid contention on mmap_sem when the guests start to run - Add event channel upcall support to xen_shinfo_test x86 changes: - Fixes for Xen emulation - Kill kvm_map_gfn() / kvm_unmap_gfn() and broken gfn_to_pfn_cache - Fixes for migration of 32-bit nested guests on 64-bit hypervisor - Compilation fixes - More SEV cleanups Generic: - Cap the return value of KVM_CAP_NR_VCPUS to both KVM_CAP_MAX_VCPUS and num_online_cpus(). Most architectures were only using one of the two" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (42 commits) KVM: x86: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS KVM: s390: Cap KVM_CAP_NR_VCPUS by num_online_cpus() KVM: RISC-V: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS KVM: PPC: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS KVM: MIPS: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS KVM: arm64: Cap KVM_CAP_NR_VCPUS by kvm_arm_default_max_vcpus() KVM: x86: Assume a 64-bit hypercall for guests with protected state selftests: KVM: Add /x86_64/sev_migrate_tests to .gitignore riscv: kvm: fix non-kernel-doc comment block KVM: SEV: Fix typo in and tweak name of cmd_allowed_from_miror() KVM: SEV: Drop a redundant setting of sev->asid during initialization KVM: SEV: WARN if SEV-ES is marked active but SEV is not KVM: SEV: Set sev_info.active after initial checks in sev_guest_init() KVM: SEV: Disallow COPY_ENC_CONTEXT_FROM if target has created vCPUs KVM: Kill kvm_map_gfn() / kvm_unmap_gfn() and gfn_to_pfn_cache KVM: nVMX: Use a gfn_to_hva_cache for vmptrld KVM: nVMX: Use kvm_read_guest_offset_cached() for nested VMCS check KVM: x86/xen: Use sizeof_field() instead of open-coding it KVM: nVMX: Use kvm_{read,write}_guest_cached() for shadow_vmcs12 KVM: x86/xen: Fix get_attr of KVM_XEN_ATTR_TYPE_SHARED_INFO ...
-
git://git.lwn.net/linuxLinus Torvalds authored
Pull documentation fixes from Jonathan Corbet: "A handful of documentation fixes for 5.16" * tag 'docs-5.16-2' of git://git.lwn.net/linux: Documentation/process: fix a cross reference Documentation: update vcpu-requests.rst reference docs: accounting: update delay-accounting.rst reference libbpf: update index.rst reference docs: filesystems: Fix grammatical error "with" to "which" doc/zh_CN: fix a translation error in management-style docs: ftrace: fix the wrong path of tracefs Documentation: arm: marvell: Fix link to armada_1000_pb.pdf document Documentation: arm: marvell: Put Armada XP section between Armada 370 and 375 Documentation: arm: marvell: Add some links to homepage / product infos docs: Update Sphinx requirements
-
git://git.kernel.org/pub/scm/linux/kernel/git/printk/linuxLinus Torvalds authored
Pull printk fixes from Petr Mladek: - Try to flush backtraces from other CPUs also on the local one. This was a regression caused by printk_safe buffers removal. - Remove header dependency warning. * tag 'printk-for-5.16-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: Remove printk.h inclusion in percpu.h printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces
-
Dan Carpenter authored
The ptp_ocp_get_mem() function does not return NULL, it returns error pointers. Fixes: 773bda96 ("ptp: ocp: Expose various resources on the timecard.") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-
David S. Miller authored
John Efstathiades says: =================== lan78xx NAPI Performance Improvements This patch set introduces a set of changes to the lan78xx driver that were originally developed as part of an investigation into the performance of TCP and UDP transfers on an Android system. The changes increase the throughput of both UDP and TCP transfers and reduce the overall CPU load. These improvements are also seen on a standard Linux kernel. Typical results are included at the end of this document. The changes to the driver evolved over time. The patches presented here attempt to organise the changes in to coherent blocks that affect logically connected parts of the driver. The patches do not reflect the way in which the code evolved during the performance investigation. Each patch produces a working driver that has an incremental improvement but patches 2, 3 and 6 should be considered a single update. The changes affect the following parts of the driver: 1. Deferred URB processing The deferred URB processing that was originally done by a tasklet is now done by a NAPI polling routine. The NAPI cycle has a fixed work budget that controls how many received frames are passed to the network stack. Patch 6 introduces the NAPI polling but depends on preceding patches. The new NAPI polling routine is also responsible for submitting Rx and Tx URBs to the USB host controller. Moving the URB processing to a NAPI-based system "smoothed" incoming and outgoing data flows on the Android system under investigation. However, taken in isolation, moving from a tasklet approach to a NAPI approach made little or no difference to the overall performance. 2. URB buffer management The driver creates a pool of Tx and a pool of Rx URB buffers. Each buffer is large enough to accommodate a packet with the maximum MTU data. URBs are allocated from these pools as required. Patch 2 introduces the new Tx buffer pool. Patch 3 introduces the new Rx buffer pool. 3. Tx pending data SKBs containing data to be transmitted are added to a queue. The driver tracks free Tx URBs and the corresponding free Tx URB space. When new Tx URBs are submitted, pending data is copied into the URB buffer until the URB buffer is filled or there is no more pending data. This maximises utilisation the LAN78xx internal USB and network frame buffers. New Tx URBs are submitted to the USB host controller as part of the NAPI polling cycle. Patch 2 introduces these changes. 4. Rx URB completion A new URB is no longer submitted as part of the URB completion callback. New URBs are submitted during the NAPI polling cycle. Patch 3 introduces these changes. 5. Rx URB processing Completed URBs are put on to queue for processing (as is done in the current driver). Network packets in completed URBs are copied from the URB buffer in to dynamically allocated SKBs and passed to the network stack. The emptied URBs are resubmitted to the USB host controller. Patch 3 introduces this change. Patch 6 updates the change to use NAPI SKBs. Each packet passed to the network stack is a single NAPI work item. If the NAPI work budget is exhausted the remaining packets in the URB are put onto an overflow queue that is processed at the start of the next NAPI cycle. Patch 6 introduces this change. 6. Driver-specific hard_header_len The driver-specific hard_header_len adjustment was removed as it broke generic receive offload (GRO) processing. Moreover, it was no longer required due the change in Tx pending data management (see point 3. above). Patch 5 introduces this change. The modification has been tested on four different target machines: Target | CPU | ARCH | cores | kernel | RAM | -----------------+------------+---------+-------+--------+-------| Raspberry Pi 4B | Cortex-A72 | aarch64 | 4 | 64-bit | 2 GB | Nitrogen8M SBC | Cortex-A53 | aarch64 | 4 | 64-bit | 2 GB | Compaq Pressario | Pentium D | i686 | 2 | 32-bit | 4 GB | Dell T3620 | Core i3 | x86_64 | 2+2 | 64-bit | 16 GB | The targets, apart from the Compaq, each have an on-chip USB3 host controller. A PCIe-based USB3 host controller card was added to the Compaq to provide the necessary USB3 host interface. The network throughput was measured using iperf3. The peer device was a second Dell T3620 fitted with an Intel i210 network interface. The target machine and the peer device were connected via a Netgear GS105 gigabit switch. The CPU load was measured using mpstat running on the target machine. The tables below summarise the throughput and CPU load improvements achieved by the updated driver. The bandwidth is the average bandwidth reported by iperf3 at the end of a 60-second test. The percentage idle figure is the average idle reported across all CPU cores on the target machine for the duration of the test. TCP Rx (target receiving, peer transmitting) | Standard Driver | NAPI Driver | Target | Bandwidth | % Idle | Bandwidth | % Idle | -----------------+-----------+--------+--------------------| RPi4 Model B | 941 | 74.9 | 941 | 91.5 | Nitrogen8M | 941 | 76.2 | 941 | 92.7 | Compaq Pressario | 941 | 44.5 | 941 | 82.1 | Dell T3620 | 941 | 88.9 | 941 | 98.3 | TCP Tx (target transmitting, peer receiving) | Standard Driver | NAPI Driver | Target | Bandwidth | % Idle | Bandwidth | % Idle | -----------------+-----------+--------+--------------------| RPi4 Model B | 683 | 80.1 | 942 | 97.6 | Nitrogen8M | 942 | 97.8 | 942 | 97.3 | Compaq Pressario | 939 | 80.0 | 942 | 91.2 | Dell T3620 | 942 | 95.3 | 942 | 97.6 | UDP Rx (target receiving, peer transmitting) | Standard Driver | NAPI Driver | Target | Bandwidth | % Idle | Bandwidth | % Idle | -----------------+-----------+--------+--------------------| RPi4 Model B | - | - | 958 (0%) | 76.2 | Nitrogen8M | 690 (25%) | 57.7 | 937 (0%) | 68.5 | Compaq Pressario | 958 (0%) | 50.2 | 958 (0%) | 61.6 | Dell T3620 | 958 (0%) | 89.6 | 958 (0%) | 85.3 | The figure in brackets is the percentage packet loss. UDP Tx (target transmitting, peer receiving) | Standard Driver | NAPI Driver | Target | Bandwidth | % Idle | Bandwidth | % Idle | -----------------+-----------+--------+--------------------| RPi4 Model B | 370 | 75.0 | 886 | 78.9 | Nitrogen8M | 710 | 75.0 | 958 | 85.3 | Compaq Pressario | 958 | 65.5 | 958 | 76.6 | Dell T3620 | 958 | 97.0 | 958 | 97.3 | ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
-
John Efstathiades authored
This patch introduces a NAPI-style approach for processing completed Rx URBs that contributes to improving driver throughput and reducing CPU load. Packets in completed URBs are copied to NAPI SKBs and passed to the network stack for processing. Each frame passed to the stack is one work item in the NAPI budget. If the NAPI budget is consumed and frames remain, they are added to an overflow queue that is processed at the start of the next NAPI polling cycle. The NAPI handler is also responsible for copying pending Tx data to Tx URBs and submitting them to the USB host controller for transmission. Signed-off-by: John Efstathiades <john.efstathiades@pebblebay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-
John Efstathiades authored
Remove hardware-specific header length adjustment as it is no longer required. It also breaks generic receive offload (GRO) processing of received TCP frames that results in a TCP ACK being sent for each received frame. Signed-off-by: John Efstathiades <john.efstathiades@pebblebay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-
John Efstathiades authored
Move position of rx_submit() to remove forward declaration of rx_complete() which is now no longer required. Signed-off-by: John Efstathiades <john.efstathiades@pebblebay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-
John Efstathiades authored
This patch introduces a new approach to allocating and managing Rx URBs that contributes to improving driver throughput and reducing CPU load. A pool of Rx URBs is created during driver instantiation. All the URBs are initially submitted to the USB host controller for processing. The default URB buffer size is different for each USB bus speed. The chosen sizes provide good USB utilisation with little impact on overall packet latency. Completed URBs are processed in the driver bottom half. The URB buffer contents are copied to a dynamically allocated SKB, which is then passed to the network stack. The URB is then re-submitted to the USB host controller. NOTE: the call to skb_copy() in rx_process() that copies the URB contents to a new SKB is a temporary change to make this patch work in its own right. This call will be removed when the NAPI processing is introduced by patch 6 in this patch set. Signed-off-by: John Efstathiades <john.efstathiades@pebblebay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-