wl18xx: multi-role AP & GO doesn't work
Added support for multi-role AP & GO, by adding this combination
to the supported combinations in the wilink driver.
Signed-off-by: Maital Hahn <maitalm@ti.com>
Added support for multi-role AP & GO, by adding this combination
to the supported combinations in the wilink driver.
Signed-off-by: Maital Hahn <maitalm@ti.com>
mesh: mesh is not connected properly after recovery
In the reconfigure process for mesh interface, moved the reconfiguration
of the mesh peers to be done only after restarting the beacons,
the same as it is done for AP.
Signed-off-by: Maital Hahn <maitalm@ti.com>
In the reconfigure process for mesh interface, moved the reconfiguration
of the mesh peers to be done only after restarting the beacons,
the same as it is done for AP.
Signed-off-by: Maital Hahn <maitalm@ti.com>
8 years agomesh: Path table entry update for worse metric only if SN has advanced by two numbers... R8.7_RC9
mesh: Path table entry update for worse metric only if SN has advanced by two numbers [SQUASH]
49fcf4da1bca0034e8ac1f04cef59a67dc6046fd
mesh: update path table only with better PREQ path to next hop
Mesh path table's entry, including its next hop update will be updated on a regular
basis in case when originator's SN advances by more then two.
Improves cases of fast healing and very congested air at the intermediate MP.
Signed-off-by: Victor Asovsky <victora@ti.com>
49fcf4da1bca0034e8ac1f04cef59a67dc6046fd
mesh: update path table only with better PREQ path to next hop
Mesh path table's entry, including its next hop update will be updated on a regular
basis in case when originator's SN advances by more then two.
Improves cases of fast healing and very congested air at the intermediate MP.
Signed-off-by: Victor Asovsky <victora@ti.com>
mesh: PREQ reliability. 3 transmissions per path selection cycle [SQUASH]
d684db467f1e0b6a838b669dd4e78a78998695aa
mesh: increase PREQ/PRES action frames reliability
A number of transmitted PREQs for each MP is 3 to increase a probability
of successful PREQ's (broadcast) packet transmission in congested air
Signed-off-by: Victor Asovsky <victora@ti.com>
d684db467f1e0b6a838b669dd4e78a78998695aa
mesh: increase PREQ/PRES action frames reliability
A number of transmitted PREQs for each MP is 3 to increase a probability
of successful PREQ's (broadcast) packet transmission in congested air
Signed-off-by: Victor Asovsky <victora@ti.com>
mesh: Don't increase lifetime only for the current initiator's process target [SQUASH]
Squash for mesh : PREQ: increase the PREQ lifetime to imporve performance
a352752dea2ccc8c755d0cbbd940fe2ed3279caf
The mesh path entry's lifetime will not be increased only if MP is an originator of
the path selection and if the table's entry is equal to the destination address.
For all other entries of the originator's MP the lifetime will be increase, as for
non initiator MPs.
Signed-off-by: Victor Asovsky <victora@ti.com>
Squash for mesh : PREQ: increase the PREQ lifetime to imporve performance
a352752dea2ccc8c755d0cbbd940fe2ed3279caf
The mesh path entry's lifetime will not be increased only if MP is an originator of
the path selection and if the table's entry is equal to the destination address.
For all other entries of the originator's MP the lifetime will be increase, as for
non initiator MPs.
Signed-off-by: Victor Asovsky <victora@ti.com>
mesh: frames received out of order
MP received data frames from another MP. Frames are forwarded
from Rx to Tx to be transmitted to a third MP.
Upon cloning the skb, the tx_info was zeroed, and the
hw_queue wasn't set correctly, causing frames to be
inserted to queue 0 (VOICE). If requeue occured for some
reason, frame will be inserted to correct queue 2 (BE).
In this case frames are now dequeued from 2 different queues and
sent out of order.
Signed-off-by: Meirav Kama <meiravk@ti.com>
MP received data frames from another MP. Frames are forwarded
from Rx to Tx to be transmitted to a third MP.
Upon cloning the skb, the tx_info was zeroed, and the
hw_queue wasn't set correctly, causing frames to be
inserted to queue 0 (VOICE). If requeue occured for some
reason, frame will be inserted to correct queue 2 (BE).
In this case frames are now dequeued from 2 different queues and
sent out of order.
Signed-off-by: Meirav Kama <meiravk@ti.com>
mesh: path selection improvements
Added vendor specific info element to path req/rep that contains
the previous mesh point from which sender received the frame and
the metric between them.
When action received with this ie, the included info is taken into
account when deciding best path.
Signed-off-by: Meirav Kama <meiravk@ti.com>
Signed-off-by: Victor Asovsky <victora@ti.com>
Added vendor specific info element to path req/rep that contains
the previous mesh point from which sender received the frame and
the metric between them.
When action received with this ie, the included info is taken into
account when deciding best path.
Signed-off-by: Meirav Kama <meiravk@ti.com>
Signed-off-by: Victor Asovsky <victora@ti.com>
mesh: TO is always enabled. Only targets responmd to Originator
TO Flag will always be set to '1'.
Prevent MPs in the middle to send PREP to the originator
in case that the originator re-sends PREQ with a newer orig_sn,
but the same target_sn and those MPs have an updated info.
Only a destination will respond to originator's request.
Prevents sequence numbers' rase between an intermediate MPs
Signed-off-by: Victor Asovsky <victora@ti.com>
TO Flag will always be set to '1'.
Prevent MPs in the middle to send PREP to the originator
in case that the originator re-sends PREQ with a newer orig_sn,
but the same target_sn and those MPs have an updated info.
Only a destination will respond to originator's request.
Prevents sequence numbers' rase between an intermediate MPs
Signed-off-by: Victor Asovsky <victora@ti.com>
mesh: PREQs will be forwarded by a Destination MP
Destination MP will also forward PREQs and not block them.
Permits a proper mesh path table update/construction at the
next MP in case that the nexp MP has also an alternative path from
the target's precede MP.
Signed-off-by: Victor Asovsky <victora@ti.com>
Destination MP will also forward PREQs and not block them.
Permits a proper mesh path table update/construction at the
next MP in case that the nexp MP has also an alternative path from
the target's precede MP.
Signed-off-by: Victor Asovsky <victora@ti.com>
mac80211: Unify mesh and mpp path removal function
mpp_path_del() and mesh_path_del() are mostly the same function.
Move common code into a new static function.
Acked-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
mpp_path_del() and mesh_path_del() are mostly the same function.
Move common code into a new static function.
Acked-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
mac80211: let unused MPP table entries timeout
Remember the last time when a mpp table entry is used for
rx or tx and remove them after MESH_PATH_EXPIRE time.
Acked-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Remember the last time when a mpp table entry is used for
rx or tx and remove them after MESH_PATH_EXPIRE time.
Acked-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
mac80211: Remove MPP table entries with MPath
Make the mesh_path_del() function remove all mpp table entries
that are proxied by the removed mesh path.
Acked-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Make the mesh_path_del() function remove all mpp table entries
that are proxied by the removed mesh path.
Acked-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
mac80211: mesh: drop constant field mean_chain_len
The mean_chain_len field in struct mesh_table is copied whenever a
new mesh table is allocated, but only ever has the value 2 and is
never otherwise updated, so just remove it and use the related
define instead.
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
The mean_chain_len field in struct mesh_table is copied whenever a
new mesh table is allocated, but only ever has the value 2 and is
never otherwise updated, so just remove it and use the related
define instead.
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
mac80211: fix unnecessary frame drops in mesh fwding
The ieee80211_queue_stopped() expects hw queue
number but it was given raw WMM AC number instead.
This could cause frame drops and problems with
traffic in some cases - most notably if driver
doesn't map AC numbers to queue numbers 1:1 and
uses ieee80211_stop_queues() and
ieee80211_wake_queue() only without ever calling
ieee80211_wake_queues().
On ath10k it was possible to hit this problem in
the following case:
1. wlan0 uses queue 0
(ath10k maps queues per vif)
2. offchannel uses queue 15
3. queues 1-14 are unused
4. ieee80211_stop_queues()
5. ieee80211_wake_queue(q=0)
6. ieee80211_wake_queue(q=15)
(other queues are not woken up because both
driver and mac80211 know other queues are
unused)
7. ieee80211_rx_h_mesh_fwding()
8. ieee80211_select_queue_80211() returns 2
9. ieee80211_queue_stopped(q=2) returns true
10. frame is dropped (oops!)
Fixes: d3c1597b8d1b ("mac80211: fix forwarded mesh frame queue mapping")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
The ieee80211_queue_stopped() expects hw queue
number but it was given raw WMM AC number instead.
This could cause frame drops and problems with
traffic in some cases - most notably if driver
doesn't map AC numbers to queue numbers 1:1 and
uses ieee80211_stop_queues() and
ieee80211_wake_queue() only without ever calling
ieee80211_wake_queues().
On ath10k it was possible to hit this problem in
the following case:
1. wlan0 uses queue 0
(ath10k maps queues per vif)
2. offchannel uses queue 15
3. queues 1-14 are unused
4. ieee80211_stop_queues()
5. ieee80211_wake_queue(q=0)
6. ieee80211_wake_queue(q=15)
(other queues are not woken up because both
driver and mac80211 know other queues are
unused)
7. ieee80211_rx_h_mesh_fwding()
8. ieee80211_select_queue_80211() returns 2
9. ieee80211_queue_stopped(q=2) returns true
10. frame is dropped (oops!)
Fixes: d3c1597b8d1b ("mac80211: fix forwarded mesh frame queue mapping")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
mac80211: mesh_plink: remove redundant sta_info check
Remove unnecessory "if" statement and club it with previos "if" block.
Signed-off-by: Sunil Shahu <shshahu@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Remove unnecessory "if" statement and club it with previos "if" block.
Signed-off-by: Sunil Shahu <shshahu@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
mesh : proactive path selection improvements
- Added delay of 50ms for PREP transmissions that responds to broadcast PREQ.
this is to reduce the number of replies, and have a single best reply transmitted.
- Send proactive PREQ (broadcast target) twice to improve reliability.
Signed-off-by: Victor Asovsky <victora@ti.com>
- Added delay of 50ms for PREP transmissions that responds to broadcast PREQ.
this is to reduce the number of replies, and have a single best reply transmitted.
- Send proactive PREQ (broadcast target) twice to improve reliability.
Signed-off-by: Victor Asovsky <victora@ti.com>
mesh: update path table only with better PREQ path to next hop
When the TA of the PREQ already appears in the table as the destination,
but the current next hop to it is a different node we should compare
the metric before we replace the next hop for this destination in the table.
If this PREQs' metric is worst, we will ignore it despite the newer sequence number that it conatains.
Check that the "next hop" is not NULL
Mesh path table's entry, including its next hop update will be updated on a regular
basis in case when originator's SN advances by more then one.
Improves cases of fast healing and very congested air at the intermediate MP.
This will prevent a case of momentarily switching to the worst path.
Signed-off-by: Victor Asovsky <victora@ti.com>
When the TA of the PREQ already appears in the table as the destination,
but the current next hop to it is a different node we should compare
the metric before we replace the next hop for this destination in the table.
If this PREQs' metric is worst, we will ignore it despite the newer sequence number that it conatains.
Check that the "next hop" is not NULL
Mesh path table's entry, including its next hop update will be updated on a regular
basis in case when originator's SN advances by more then one.
Improves cases of fast healing and very congested air at the intermediate MP.
This will prevent a case of momentarily switching to the worst path.
Signed-off-by: Victor Asovsky <victora@ti.com>
mesh : PREQ: increase the PREQ lifetime to imporve performance
All MPs in the mesh, except the initiator MP, after reception of PREQ or PREP,
will update a relevant entry in the mesh path table,
and set the new entry's counter to the lifetime advertised in the PREQ/PREP plus some extra time
This extra time will avoid the intermediate MPs' path expiry prior to the expiry at the path initiator MP;
This extra time will avoid the target MP path expiry,
prior to the expiry at the path initiator MP.
Ttarget MP will not start its own new path selection,
which will lead to an instant path switching, of the "main" data initiator, to a shortest path;
The extra time is set to a twice of "path_refresh_time" that by default is 1 second
All MPs in the mesh, except the initiator MP, after reception of PREQ or PREP,
will update a relevant entry in the mesh path table,
and set the new entry's counter to the lifetime advertised in the PREQ/PREP plus some extra time
This extra time will avoid the intermediate MPs' path expiry prior to the expiry at the path initiator MP;
This extra time will avoid the target MP path expiry,
prior to the expiry at the path initiator MP.
Ttarget MP will not start its own new path selection,
which will lead to an instant path switching, of the "main" data initiator, to a shortest path;
The extra time is set to a twice of "path_refresh_time" that by default is 1 second
mesh: increase PREQ/PRES action frames reliability
Although PRES action frame is sent as unicast, it might not arrive to
it's destination.
To reduce the probability of losing this frame this fix:
- Increase the number of retries for management frames.
- Set 6Mbps rate as basic rate for management frames.
PREQ is sent as broadcast, and might collide in the air.
To reduce the probability of missing that frame, sent it twice.
SN and PDID will not be changed for PREQs of the same transmition, i.e.,
two bcast PREQs a single path selection instance will be identical
The frame will be sent twice only at the originator side,
once the second frame is received in one of the peers, it will be ignore
as the sequence number remains the same.
(This prevents a broadcast storms in the generic case)
Signed-off-by: Victor Asovsky <victora@ti.com>
Signed-off-by: Yaniv Machani <yanivma@ti.com>
Although PRES action frame is sent as unicast, it might not arrive to
it's destination.
To reduce the probability of losing this frame this fix:
- Increase the number of retries for management frames.
- Set 6Mbps rate as basic rate for management frames.
PREQ is sent as broadcast, and might collide in the air.
To reduce the probability of missing that frame, sent it twice.
SN and PDID will not be changed for PREQs of the same transmition, i.e.,
two bcast PREQs a single path selection instance will be identical
The frame will be sent twice only at the originator side,
once the second frame is received in one of the peers, it will be ignore
as the sequence number remains the same.
(This prevents a broadcast storms in the generic case)
Signed-off-by: Victor Asovsky <victora@ti.com>
Signed-off-by: Yaniv Machani <yanivma@ti.com>
Mesh: bypass blockack encryption [WORKAROUND]
Currently didn't implement the blockack encryption mechanism
in the meanwhile we bypass in the driver MFP check (robust mgmt frames check)
in order to support blockack session
BYPASSES: WILINK8_SW_DEV-407
Signed-off-by: Chen Loewy <c-loewy@ti.com>
Currently didn't implement the blockack encryption mechanism
in the meanwhile we bypass in the driver MFP check (robust mgmt frames check)
in order to support blockack session
BYPASSES: WILINK8_SW_DEV-407
Signed-off-by: Chen Loewy <c-loewy@ti.com>
mac80211: mesh: fixed HT ies in beacon template
There are several values in HT info elements of mesh beacon (built by the
mac80211) that are incorrect.
To fix them:
1. mac80211 will check configuration from cfg and will build accordingly.
2. changes made in mesh default values.
fixes #WILINK8_SW_DEV-412
Signed-off-by: Meirav Kama <meiravk@ti.com>
There are several values in HT info elements of mesh beacon (built by the
mac80211) that are incorrect.
To fix them:
1. mac80211 will check configuration from cfg and will build accordingly.
2. changes made in mesh default values.
fixes #WILINK8_SW_DEV-412
Signed-off-by: Meirav Kama <meiravk@ti.com>
mesh : fix crash in path selection when link removed [WORKAROUND]
In some cases we saw kernel panic related to the path lookup
ieee80211_mps_set_frame_flags [mac80211]) from [<bf11af00>] (mesh_nexthop_lookup+0xf0/0x22c [mac80211])
fixes: #WILINK8_SW_DEV-81
Signed-off-by: Maital Hahn <maitalm@ti.com>
Signed-off-by: Yaniv Machani <yanivma@ti.com>
In some cases we saw kernel panic related to the path lookup
ieee80211_mps_set_frame_flags [mac80211]) from [<bf11af00>] (mesh_nexthop_lookup+0xf0/0x22c [mac80211])
fixes: #WILINK8_SW_DEV-81
Signed-off-by: Maital Hahn <maitalm@ti.com>
Signed-off-by: Yaniv Machani <yanivma@ti.com>
Revert "tcp: refine pacing rate determination" [WORAROUND]
this patch seems to have bad performance impact on the first seconds
as we test ~60 seconds, this shows poor results.
This reverts commit 43e122b014c955a33220fabbd09c4b5e4f422c3c.
this patch seems to have bad performance impact on the first seconds
as we test ~60 seconds, this shows poor results.
This reverts commit 43e122b014c955a33220fabbd09c4b5e4f422c3c.
mac80211: mesh: fix call_rcu() usage
When using call_rcu(), the called function may be delayed quite
significantly, and without a matching rcu_barrier() there's no
way to be sure it has finished.
Therefore, global state that could be gone/freed/reused should
never be touched in the callback.
Fix this in mesh by moving the atomic_dec() into the caller;
that's not really a problem since we already unlinked the path
and it will be destroyed anyway.
This fixes a crash Jouni observed when running certain tests in
a certain order, in which the mesh interface was torn down, the
memory reused for a function pointer (work struct) and running
that then crashed since the pointer had been decremented by 1,
resulting in an invalid instruction byte stream.
Cc: stable@vger.kernel.org
Fixes: eb2b9311fd00 ("mac80211: mesh path table implementation")
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Conflicts:
net/mac80211/mesh_pathtbl.c
When using call_rcu(), the called function may be delayed quite
significantly, and without a matching rcu_barrier() there's no
way to be sure it has finished.
Therefore, global state that could be gone/freed/reused should
never be touched in the callback.
Fix this in mesh by moving the atomic_dec() into the caller;
that's not really a problem since we already unlinked the path
and it will be destroyed anyway.
This fixes a crash Jouni observed when running certain tests in
a certain order, in which the mesh interface was torn down, the
memory reused for a function pointer (work struct) and running
that then crashed since the pointer had been decremented by 1,
resulting in an invalid instruction byte stream.
Cc: stable@vger.kernel.org
Fixes: eb2b9311fd00 ("mac80211: mesh path table implementation")
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Conflicts:
net/mac80211/mesh_pathtbl.c
mesh: delayed path reply
Add mechanism to delay the sending of the path reply.
Once a decision is made to respond to a PREQ with a PREP,
(meaning SN received is greater than what we had or a better
metric is received), instead of sending the path reply immediately,
we save the PREP information and start a timer (only for the first PREP).
This will allow more PREQ with same SN, but from other paths,
to be processed. Once the timer is expired, the PREP will be sent
through the best path found.
Signed-off-by: Maital Hahn <maitalm@ti.com>
Add mechanism to delay the sending of the path reply.
Once a decision is made to respond to a PREQ with a PREP,
(meaning SN received is greater than what we had or a better
metric is received), instead of sending the path reply immediately,
we save the PREP information and start a timer (only for the first PREP).
This will allow more PREQ with same SN, but from other paths,
to be processed. Once the timer is expired, the PREP will be sent
through the best path found.
Signed-off-by: Maital Hahn <maitalm@ti.com>
mesh: Fix healing time when a mesh peer is disconnecting
Once receiving a CLOSE action frame from the disconnecting peer,
flush all entries in the path table which has this peer as the
next hop.
In addition, upon receiving a packet, if next hop is not found,
trigger PERQ immidiatly, instead of just putting it in the queue.
fixes #WILINK8_SW_DEV-403
Signed-off-by: Maital Hahn <maitalm@ti.com>
Once receiving a CLOSE action frame from the disconnecting peer,
flush all entries in the path table which has this peer as the
next hop.
In addition, upon receiving a packet, if next hop is not found,
trigger PERQ immidiatly, instead of just putting it in the queue.
fixes #WILINK8_SW_DEV-403
Signed-off-by: Maital Hahn <maitalm@ti.com>
mesh: implement mac80211 op: get_rate_info
Driver will now implement the opcode.
This allows the driver to directly send FW reported
rates to mesh_hwmp module and calculate correct metrics.
Still need to add trace to new op.
Signed-off-by: Maxim Altshul <maxim.altshul@ti.com>
Driver will now implement the opcode.
This allows the driver to directly send FW reported
rates to mesh_hwmp module and calculate correct metrics.
Still need to add trace to new op.
Signed-off-by: Maxim Altshul <maxim.altshul@ti.com>
mesh: support mesh metric calculation
FW will provide a TX rate per link for each FW status
This will allow mesh_hwmp module to calculate metric
per peer using information gathered from TX packets.
Signed-off-by: Maxim Altshul <maxim.altshul@ti.com>
FW will provide a TX rate per link for each FW status
This will allow mesh_hwmp module to calculate metric
per peer using information gathered from TX packets.
Signed-off-by: Maxim Altshul <maxim.altshul@ti.com>
mesh: mac80211 opcode, get rate for metric from driver
Add a new opcode to allow a vendor report a rate directly
from driver, to be used during metric calculation.
A vendor that implements the opcode will have the ability
to report rates directly to the mesh_hwmp module.
Signed-off-by: Maxim Altshul <maxim.altshul@ti.com>
Add a new opcode to allow a vendor report a rate directly
from driver, to be used during metric calculation.
A vendor that implements the opcode will have the ability
to report rates directly to the mesh_hwmp module.
Signed-off-by: Maxim Altshul <maxim.altshul@ti.com>
ieee80211: mesh: handle secured PREQ frames
Add handling of encrypted broadcast action frames (Group addressed privacy)
Up until now all broadcast action frames and management were not encrypted.
When we send Mesh path selection action frames we need to send a broadcast
action frame which is encrypted.
Change applied to tx.c file adding a case where we handle these specific cases
which are defined in the spec in Table 8-38 Category values (Group addressed privacy)
Code: 13 - Mesh
Code: 14 - Multihop
Signed-off-by: Chen Loewy <c-loewy@ti.com>
Signed-off-by: Maital Hahn <maitalm@ti.com>
Add handling of encrypted broadcast action frames (Group addressed privacy)
Up until now all broadcast action frames and management were not encrypted.
When we send Mesh path selection action frames we need to send a broadcast
action frame which is encrypted.
Change applied to tx.c file adding a case where we handle these specific cases
which are defined in the spec in Table 8-38 Category values (Group addressed privacy)
Code: 13 - Mesh
Code: 14 - Multihop
Signed-off-by: Chen Loewy <c-loewy@ti.com>
Signed-off-by: Maital Hahn <maitalm@ti.com>
wlcore: mesh: Add support for RX Boradcast Key
In order to support authentication of equals peers,
need to save RX Broadcast key per peer (on top of 1 TX broadcast key
and unicast key per peer).
fixes #WILINK8_SW_DEV-68
Signed-off-by: Maital Hahn <maitalm@ti.com>
Acked-by: Guy Mishol <guym@ti.com>
In order to support authentication of equals peers,
need to save RX Broadcast key per peer (on top of 1 TX broadcast key
and unicast key per peer).
fixes #WILINK8_SW_DEV-68
Signed-off-by: Maital Hahn <maitalm@ti.com>
Acked-by: Guy Mishol <guym@ti.com>
mac80211: mesh: flush stations before beacons are stopped
Some drivers (e.g. wl18xx) expect that the last stage in the
de-initialization process will be stopping the beacons, similarly to ap.
Update ieee80211_stop_mesh() flow accordingly.
fixes #WILINK8_SW_DEV-84
Signed-off-by: Maital Hahn <maitalm@ti.com>
Acked-by: Yaniv Machani <yanivma@ti.com>
Some drivers (e.g. wl18xx) expect that the last stage in the
de-initialization process will be stopping the beacons, similarly to ap.
Update ieee80211_stop_mesh() flow accordingly.
fixes #WILINK8_SW_DEV-84
Signed-off-by: Maital Hahn <maitalm@ti.com>
Acked-by: Yaniv Machani <yanivma@ti.com>
wl18xx: firmware minor version update
Driver requires updated firmware in order to enable new feature.
Link to the firmware repository was updated as well.
Signed-off-by: Yaniv Machani <yanivma@ti.com>
Driver requires updated firmware in order to enable new feature.
Link to the firmware repository was updated as well.
Signed-off-by: Yaniv Machani <yanivma@ti.com>
mesh: added initial mesh support for wl8
1. Added support for interface and role of mesh type.
2. Enabled enable/start of mesh-point role,
and opening and closing a connection with a mesh peer.
3. Added multirole combination of mesh and ap
under the same limits of dual ap mode.
4. Add support for 'sta_rc_update' opcode for mesh IF.
The 'sta_rc_update' opcode is being used in mesh_plink.c.
Add support in wlcore to handle this opcode correctly for mesh
(as opposed to current implementation that handles STA only).
fixes #WILINK8_SW_DEV-84
fixes #WILINK8_SW_DEV-76
fixes #WILINK8_SW_DEV-83
fixes #WILINK8_SW_DEV-411
Signed-off-by: Maital Hahn <maitalm@ti.com>
Acked-by: Yaniv Machani <yanivma@ti.com>
1. Added support for interface and role of mesh type.
2. Enabled enable/start of mesh-point role,
and opening and closing a connection with a mesh peer.
3. Added multirole combination of mesh and ap
under the same limits of dual ap mode.
4. Add support for 'sta_rc_update' opcode for mesh IF.
The 'sta_rc_update' opcode is being used in mesh_plink.c.
Add support in wlcore to handle this opcode correctly for mesh
(as opposed to current implementation that handles STA only).
fixes #WILINK8_SW_DEV-84
fixes #WILINK8_SW_DEV-76
fixes #WILINK8_SW_DEV-83
fixes #WILINK8_SW_DEV-411
Signed-off-by: Maital Hahn <maitalm@ti.com>
Acked-by: Yaniv Machani <yanivma@ti.com>
wl18xx/wlcore : time sync demo [TMP]
Driver demo level of the time sync feature
triggering the GPIO using hr timers
DT/HW changes are required.
Signed-off-by: Yaniv Machani <yanivma@ti.com>
Signed-off-by: Eliad Peller <eliad@wizery.com>
Driver demo level of the time sync feature
triggering the GPIO using hr timers
DT/HW changes are required.
Signed-off-by: Yaniv Machani <yanivma@ti.com>
Signed-off-by: Eliad Peller <eliad@wizery.com>
wlcore: mesh: add zone time sync support
add time sync support for mesh role
Signed-off-by: Guy Mishol <guym@ti.com>
Acked-by: Yaniv Machani <yanivma@ti.com>
add time sync support for mesh role
Signed-off-by: Guy Mishol <guym@ti.com>
Acked-by: Yaniv Machani <yanivma@ti.com>
wlcore: time Sync : added support for 64 bit clock
Changed the configuration to support 64bit instead of 32bit
this in order to offload the driver from handling a wraparound.
Signed-off-by: Yaniv Machani <yanivma@ti.com>
Changed the configuration to support 64bit instead of 32bit
this in order to offload the driver from handling a wraparound.
Signed-off-by: Yaniv Machani <yanivma@ti.com>
wlcore: split wl12xx/wl18xx sg parameters
Align to new wl18xx sg parameters.
This requires to split both wl12xx/wl18xx enumerators.
fixes #WILINK8_SW_DEV-395
Signed-off-by: Guy Mishol <guym@ti.com>
Acked-by: Eliad Peller <eliad@wizery.com>
Align to new wl18xx sg parameters.
This requires to split both wl12xx/wl18xx enumerators.
fixes #WILINK8_SW_DEV-395
Signed-off-by: Guy Mishol <guym@ti.com>
Acked-by: Eliad Peller <eliad@wizery.com>
am335x-evm : add support Wake on Wlan for EVM
Added support for Wake on Wlan on AM335x-EVM
Signed-off-by: Yaniv Machani <yanivma@ti.com>
Added support for Wake on Wlan on AM335x-EVM
Signed-off-by: Yaniv Machani <yanivma@ti.com>
am335x-bone : add support for different wilink8 capes for BBB
added support for new cape types
-wl1825 (fade out)
-e14-wl1837
-su-audio
Signed-off-by: Yaniv Machani <yanivma@ti.com>
added support for new cape types
-wl1825 (fade out)
-e14-wl1837
-su-audio
Signed-off-by: Yaniv Machani <yanivma@ti.com>
wlcore: remove timestamp strings prints
Due to compatability issues of 4.9 toolchain with __TIMESTAMP__ macro,
it was removed from the version related files and Makefile.
Signed-off-by: Yaniv Machani <yanivma@ti.com>
Due to compatability issues of 4.9 toolchain with __TIMESTAMP__ macro,
it was removed from the version related files and Makefile.
Signed-off-by: Yaniv Machani <yanivma@ti.com>
mac80211: extract basic rates on start_ap
On ap start, the beacon is configured while
the basic rates were not set yet (they are
set only later by userspace).
Since sometimes it's important to know
the supported rates before we start
beaconing (e.g. 11a, p2p), parse the beacon
and configure the bss_conf with the correct
basic rates, according to the supported_rates
and ext_supported_rates ies.
Signed-off-by: Eliad Peller <eliad@wizery.com>
On ap start, the beacon is configured while
the basic rates were not set yet (they are
set only later by userspace).
Since sometimes it's important to know
the supported rates before we start
beaconing (e.g. 11a, p2p), parse the beacon
and configure the bss_conf with the correct
basic rates, according to the supported_rates
and ext_supported_rates ies.
Signed-off-by: Eliad Peller <eliad@wizery.com>
wlcore: don't WARN_ON in case of existing ROC
When working with AP + P2P, it's possible to get into
a state when the AP is in ROC (due to assiciating station)
while trying to ROC on the P2P interface.
Replace the WARN_ON with wl1271_error to avoid warnings
in this case.
Signed-off-by: Eliad Peller <eliad@wizery.com>
When working with AP + P2P, it's possible to get into
a state when the AP is in ROC (due to assiciating station)
while trying to ROC on the P2P interface.
Replace the WARN_ON with wl1271_error to avoid warnings
in this case.
Signed-off-by: Eliad Peller <eliad@wizery.com>
wlcore: Add RX_BA_WIN_SIZE_CHANGE_EVENT event
This event is used by the Firmware to limit the RX BA win size
for a specific link.
The event handler updates the new size in the driver's link struct
and in the mac's sta->sta struct accordingly and closes all active BA
sessions for that link.
Conseqent BA sessions opened for that link will use the new restricted
win_size. This limitation remains until a new update is received or
until the link is closed.
This solves an IOP bug with APs that don't respect the max subframes in
a single-frame and uses the max win_size instead. In these cases the FW
recovers by sending this event to decrease the win_size to use the single
frame limitation.
Update the min fw version accordingly to 8.6.0.0.1
Signed-off-by: Yair Shapira <yair.shapira@ti.com>
Signed-off-by: Igal Chernobelsky <igalc@ti.com>
This event is used by the Firmware to limit the RX BA win size
for a specific link.
The event handler updates the new size in the driver's link struct
and in the mac's sta->sta struct accordingly and closes all active BA
sessions for that link.
Conseqent BA sessions opened for that link will use the new restricted
win_size. This limitation remains until a new update is received or
until the link is closed.
This solves an IOP bug with APs that don't respect the max subframes in
a single-frame and uses the max win_size instead. In these cases the FW
recovers by sending this event to decrease the win_size to use the single
frame limitation.
Update the min fw version accordingly to 8.6.0.0.1
Signed-off-by: Yair Shapira <yair.shapira@ti.com>
Signed-off-by: Igal Chernobelsky <igalc@ti.com>
wlcore: ACX_BA_SESSION_RX_SETUP win_size taken from sta
Now that max_rx_aggregation_subframes (BA RX win size) is stored in the
mac per active link (and not only per chip), use the link (sta) value
when passing the win_size to firmware through the ACX_BA_SESSION_RX_SETUP
command.
Signed-off-by: Yair Shapira <yair.shapira@ti.com>
Now that max_rx_aggregation_subframes (BA RX win size) is stored in the
mac per active link (and not only per chip), use the link (sta) value
when passing the win_size to firmware through the ACX_BA_SESSION_RX_SETUP
command.
Signed-off-by: Yair Shapira <yair.shapira@ti.com>
mac80211: RX BA support for sta max_rx_aggregation_subframes
Normally rx ba buff size is limited by a max limitation set by the driver
with local->hw.max_rx_aggregation_subframes. This is the max aggregation
'win_size' supported by the chip.
This fix adds max_rx_aggregation_subframes field to sta->sta. This field
is initialy set to local->hw.max_rx_aggregation_subframes and is used
by addba_req routine. The driver/chip can choose to change this value
causing stop of existing ba sessions and effectivly forcing new ba sessions
(on this link) to be restricted by the new value.
This capability is usefull in cases of IOP, i.e. cases where peer sta
or ap doesn't respect the max subframes in a single-frame and uses the
max win_size instead. In these cases the driver/chip may recover by
decreasing the win_size to use the single frame limitation.
Signed-off-by: Yair Shapira <yair.shapira@ti.com>
Normally rx ba buff size is limited by a max limitation set by the driver
with local->hw.max_rx_aggregation_subframes. This is the max aggregation
'win_size' supported by the chip.
This fix adds max_rx_aggregation_subframes field to sta->sta. This field
is initialy set to local->hw.max_rx_aggregation_subframes and is used
by addba_req routine. The driver/chip can choose to change this value
causing stop of existing ba sessions and effectivly forcing new ba sessions
(on this link) to be restricted by the new value.
This capability is usefull in cases of IOP, i.e. cases where peer sta
or ap doesn't respect the max subframes in a single-frame and uses the
max win_size instead. In these cases the driver/chip may recover by
decreasing the win_size to use the single frame limitation.
Signed-off-by: Yair Shapira <yair.shapira@ti.com>
mac80211: allow CSA while scanning/ROC (INTERNAL)
Some devices are smart-enough to manage CSA timing
while scanning/ROC. let them handle it.
TODO: add feature flag, etc.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Some devices are smart-enough to manage CSA timing
while scanning/ROC. let them handle it.
TODO: add feature flag, etc.
Signed-off-by: Eliad Peller <eliad@wizery.com>
mac80211: handle hw roc cancel vs. expiration race
mac80211 handles roc expirations (indicated by
ieee80211_remain_on_channel_expired()) with a separate
work (hw_roc_done).
If userspace asks to cancel the ongoing roc before
hw_roc_done was scheduled, mac80211 will cancel
the ongoing roc, while leaving the hw_roc_done work
pending.
This might end up in the next roc being cancelled
by the stale work, causing mac80211 and the low-level
driver to go out of sync.
Fix it by cancelling hw_roc_done on roc cancel.
Since hw_roc_done takes local->mtx, temporarily
release it (before re-acquiring it and starting
the next roc if needed).
Signed-off-by: Eliad Peller <eliad@wizery.com>
mac80211 handles roc expirations (indicated by
ieee80211_remain_on_channel_expired()) with a separate
work (hw_roc_done).
If userspace asks to cancel the ongoing roc before
hw_roc_done was scheduled, mac80211 will cancel
the ongoing roc, while leaving the hw_roc_done work
pending.
This might end up in the next roc being cancelled
by the stale work, causing mac80211 and the low-level
driver to go out of sync.
Fix it by cancelling hw_roc_done on roc cancel.
Since hw_roc_done takes local->mtx, temporarily
release it (before re-acquiring it and starting
the next roc if needed).
Signed-off-by: Eliad Peller <eliad@wizery.com>
cfg80211: use 10 minutes CAC for ETSI (WORKAROUND)
for channels 120, 124 and 128.
Signed-off-by: Eliad Peller <eliad@wizery.com>
for channels 120, 124 and 128.
Signed-off-by: Eliad Peller <eliad@wizery.com>
cfg80211: add dfs_cac/nop_time_ms module params (INTERNAL)
Add new cac_time_ms module param to allow setting
the dfs CAC and NOP times (in milliseconds)
Signed-off-by: Eliad Peller <eliad@wizery.com>
Add new cac_time_ms module param to allow setting
the dfs CAC and NOP times (in milliseconds)
Signed-off-by: Eliad Peller <eliad@wizery.com>
wlcore: add version and timestamp strings (INTERNAL)
In order to allow better version control, add version
and timestamp strings into wlcore module.
These strings will be printed on driver load, and when
reading the driver_state.
If the tree was changed and unstaged or if a new tag was added, we
were not regenerating the version.h file, so it would contain outdated
information.
To fix this, force the version.h file to be rechecked during make and
use __TIMESTAMP__ instead of using the shell's date command, so that
we don't regenerate it everytime.
Additionally, use --dirty in git describe to mark dirty trees as such.
With compat-wireless, we shouldn't force the version.h file checks,
otherwise it will overwrite what we generated in compat-wireless
itself. This was only needed for dirty trees anyway. The side-effect
is that the version will not be regenerated when the tree becomes
dirty.
In environments without .git folder, use release_version.h instead.
There are some reports of compilation errors due
to missing version.h.
This probably means that version.h wasn't recognized
as a dependency, and wasn't generated.
Declare this dependency explicitly in order to make
sure version.h will be generated.
if we use backports to compile our driver, the compilation
is done on the target kernel, but we want to generate the
version tag from the driver git.
check for the existence of KLIB_BUILD and GIT_TREE params,
and generate version.h from the GIT_TREE if they both
exist.
(note that backports doesn't require GIT_TREE to be
defined, so it has to be part of the build script)
When checking for git existence in wlcore's Makefile,
use $(PWD), as the built-in wildcard function returns
unexpected results when working against remote
makefile (e.g. when using backports).
git describe --dirty doesn't work well when specfiying
git-dir and work-tree parameters (git diff-index doesn't
run against the work-tree, resulting in -dirty always
being set).
workaround it by changing the current directory to the
git directory before running the command.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
In order to allow better version control, add version
and timestamp strings into wlcore module.
These strings will be printed on driver load, and when
reading the driver_state.
If the tree was changed and unstaged or if a new tag was added, we
were not regenerating the version.h file, so it would contain outdated
information.
To fix this, force the version.h file to be rechecked during make and
use __TIMESTAMP__ instead of using the shell's date command, so that
we don't regenerate it everytime.
Additionally, use --dirty in git describe to mark dirty trees as such.
With compat-wireless, we shouldn't force the version.h file checks,
otherwise it will overwrite what we generated in compat-wireless
itself. This was only needed for dirty trees anyway. The side-effect
is that the version will not be regenerated when the tree becomes
dirty.
In environments without .git folder, use release_version.h instead.
There are some reports of compilation errors due
to missing version.h.
This probably means that version.h wasn't recognized
as a dependency, and wasn't generated.
Declare this dependency explicitly in order to make
sure version.h will be generated.
if we use backports to compile our driver, the compilation
is done on the target kernel, but we want to generate the
version tag from the driver git.
check for the existence of KLIB_BUILD and GIT_TREE params,
and generate version.h from the GIT_TREE if they both
exist.
(note that backports doesn't require GIT_TREE to be
defined, so it has to be part of the build script)
When checking for git existence in wlcore's Makefile,
use $(PWD), as the built-in wildcard function returns
unexpected results when working against remote
makefile (e.g. when using backports).
git describe --dirty doesn't work well when specfiying
git-dir and work-tree parameters (git diff-index doesn't
run against the work-tree, resulting in -dirty always
being set).
workaround it by changing the current directory to the
git directory before running the command.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
wlcore: don't suspend on pending recovery (ANDROID)
Some customers complain that if we cancel a pending recovery during
suspend, the android scheduler will keep banging on the suspend handler,
without letting recovery take its course. Grab a wakelock to give the
recovery process some breathing room.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Some customers complain that if we cancel a pending recovery during
suspend, the android scheduler will keep banging on the suspend handler,
without letting recovery take its course. Grab a wakelock to give the
recovery process some breathing room.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
wlcore: add wake_locks (ANDROID)
Add timed wakelock on rx, and wakelock to protect the resume flow.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Add timed wakelock on rx, and wakelock to protect the resume flow.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
wlcore: always set MMC_PM_KEEP_POWER (workaround)
Due to some mmc layer issues, the system automatically
powers us up on resume, which later cause issues when
we try to restore_power again explicitly.
temporarily workaround it by always asking to keep power.
this is fine as driver controls the chip power anyway.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Ido Yariv <ido@wizery.com>
Due to some mmc layer issues, the system automatically
powers us up on resume, which later cause issues when
we try to restore_power again explicitly.
temporarily workaround it by always asking to keep power.
this is fine as driver controls the chip power anyway.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Ido Yariv <ido@wizery.com>
Merge branch 'linux-master' of gitorious.ti.com:ti-linux-kernel/ti-linux-kernel into ti-linux-4.4.y
* 'linux-master' of gitorious.ti.com:ti-linux-kernel/ti-linux-kernel: (50 commits)
Linux 4.4
vmstat: allocate vmstat_wq before it is used
Revert "block: Split bios on chunk boundaries"
PCI: dra7xx: Mark driver as broken
firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
ACPI / property: avoid leaking format string into kobject name
ftrace/module: Call clean up function when module init fails early
dts: vt8500: Add SDHC node to DTS file for WM8650
ARM: Fix broken USB support in multi_v7_defconfig for sunxi devices
kvm: x86: only channel 0 of the i8254 is linked to the HPET
iommu/dma: Use correct offset in map_sg
dmaengine: xgene-dma: Fix double IRQ issue by setting IRQ_DISABLE_UNLAZY flag
async_tx: use GFP_NOWAIT rather than GFP_IO
ARM: versatile: fix MMC/SD interrupt assignment
ARM: nomadik: set latencies to 8 cycles
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
sched/core: Reset task's lockless wake-queues on fork()
sched/core: Fix unserialized r-m-w scribbling stuff
sched/core: Check tgid in is_global_init()
sched/fair: Fix multiplication overflow on 32-bit systems
...
* 'linux-master' of gitorious.ti.com:ti-linux-kernel/ti-linux-kernel: (50 commits)
Linux 4.4
vmstat: allocate vmstat_wq before it is used
Revert "block: Split bios on chunk boundaries"
PCI: dra7xx: Mark driver as broken
firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
ACPI / property: avoid leaking format string into kobject name
ftrace/module: Call clean up function when module init fails early
dts: vt8500: Add SDHC node to DTS file for WM8650
ARM: Fix broken USB support in multi_v7_defconfig for sunxi devices
kvm: x86: only channel 0 of the i8254 is linked to the HPET
iommu/dma: Use correct offset in map_sg
dmaengine: xgene-dma: Fix double IRQ issue by setting IRQ_DISABLE_UNLAZY flag
async_tx: use GFP_NOWAIT rather than GFP_IO
ARM: versatile: fix MMC/SD interrupt assignment
ARM: nomadik: set latencies to 8 cycles
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
sched/core: Reset task's lockless wake-queues on fork()
sched/core: Fix unserialized r-m-w scribbling stuff
sched/core: Check tgid in is_global_init()
sched/fair: Fix multiplication overflow on 32-bit systems
...
Linux 4.4
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fix from James Bottomley:
"A single fix for machines with pages > 4k (PPC mostly).
There's a bug in our optimal transfer size code where we don't account
for pages > 4k and can set the transfer size to be less than the page
size causing nasty failures"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
sd: Reject optimal transfer length smaller than page size
Pull SCSI fix from James Bottomley:
"A single fix for machines with pages > 4k (PPC mostly).
There's a bug in our optimal transfer size code where we don't account
for pages > 4k and can set the transfer size to be less than the page
size causing nasty failures"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
sd: Reject optimal transfer length smaller than page size
8 years agoMerge tag 'pci-v4.4-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci
Merge tag 'pci-v4.4-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci
Pull PCI fixlet from Bjorn Helgaas:
"This marks the TI DRA7xx host bridge driver as broken. Apparently it
has never worked without some additional out-of-tree code, so I'm
going to mark it broken now and remove it completely next cycle unless
it's fixed"
* tag 'pci-v4.4-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
PCI: dra7xx: Mark driver as broken
Pull PCI fixlet from Bjorn Helgaas:
"This marks the TI DRA7xx host bridge driver as broken. Apparently it
has never worked without some additional out-of-tree code, so I'm
going to mark it broken now and remove it completely next cycle unless
it's fixed"
* tag 'pci-v4.4-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
PCI: dra7xx: Mark driver as broken
vmstat: allocate vmstat_wq before it is used
kernel test robot has reported the following crash:
BUG: unable to handle kernel NULL pointer dereference at 00000100
IP: [<c1074df6>] __queue_work+0x26/0x390
*pdpt = 0000000000000000 *pde = f000ff53f000ff53 *pde = f000ff53f000ff53
Oops: 0000 [#1] PREEMPT PREEMPT SMP SMP
CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.4.0-rc4-00139-g373ccbe #1
Workqueue: events vmstat_shepherd
task: cb684600 ti: cb7ba000 task.ti: cb7ba000
EIP: 0060:[<c1074df6>] EFLAGS: 00010046 CPU: 0
EIP is at __queue_work+0x26/0x390
EAX: 00000046 EBX: cbb37800 ECX: cbb37800 EDX: 00000000
ESI: 00000000 EDI: 00000000 EBP: cb7bbe68 ESP: cb7bbe38
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0: 8005003b CR2: 00000100 CR3: 01fd5000 CR4: 000006b0
Stack:
Call Trace:
__queue_delayed_work+0xa1/0x160
queue_delayed_work_on+0x36/0x60
vmstat_shepherd+0xad/0xf0
process_one_work+0x1aa/0x4c0
worker_thread+0x41/0x440
kthread+0xb0/0xd0
ret_from_kernel_thread+0x21/0x40
The reason is that start_shepherd_timer schedules the shepherd work item
which uses vmstat_wq (vmstat_shepherd) before setup_vmstat allocates
that workqueue so if the further initialization takes more than HZ we
might end up scheduling on a NULL vmstat_wq. This is really unlikely
but not impossible.
Fixes: 373ccbe59270 ("mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress")
Reported-by: kernel test robot <ying.huang@linux.intel.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
Tested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: stable@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
kernel test robot has reported the following crash:
BUG: unable to handle kernel NULL pointer dereference at 00000100
IP: [<c1074df6>] __queue_work+0x26/0x390
*pdpt = 0000000000000000 *pde = f000ff53f000ff53 *pde = f000ff53f000ff53
Oops: 0000 [#1] PREEMPT PREEMPT SMP SMP
CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.4.0-rc4-00139-g373ccbe #1
Workqueue: events vmstat_shepherd
task: cb684600 ti: cb7ba000 task.ti: cb7ba000
EIP: 0060:[<c1074df6>] EFLAGS: 00010046 CPU: 0
EIP is at __queue_work+0x26/0x390
EAX: 00000046 EBX: cbb37800 ECX: cbb37800 EDX: 00000000
ESI: 00000000 EDI: 00000000 EBP: cb7bbe68 ESP: cb7bbe38
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0: 8005003b CR2: 00000100 CR3: 01fd5000 CR4: 000006b0
Stack:
Call Trace:
__queue_delayed_work+0xa1/0x160
queue_delayed_work_on+0x36/0x60
vmstat_shepherd+0xad/0xf0
process_one_work+0x1aa/0x4c0
worker_thread+0x41/0x440
kthread+0xb0/0xd0
ret_from_kernel_thread+0x21/0x40
The reason is that start_shepherd_timer schedules the shepherd work item
which uses vmstat_wq (vmstat_shepherd) before setup_vmstat allocates
that workqueue so if the further initialization takes more than HZ we
might end up scheduling on a NULL vmstat_wq. This is really unlikely
but not impossible.
Fixes: 373ccbe59270 ("mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress")
Reported-by: kernel test robot <ying.huang@linux.intel.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
Tested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: stable@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Pull ARM SoC fixes from Arnd Bergmann:
"This is the final small set of ARM SoC bug fixes for linux-4.4, almost
all regressions:
OMAP:
- data corruption on the Nokia N900 flash
Allwinner:
- Two defconfig change to get USB working again
ARM Versatile:
- Interrupt numbers gone bad after an older bug fix
Nomadik:
- Crashes from incorrect L2 cache settings
VIA vt8500:
- SD/MMC support on WM8650 never worked"
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
dts: vt8500: Add SDHC node to DTS file for WM8650
ARM: Fix broken USB support in multi_v7_defconfig for sunxi devices
ARM: versatile: fix MMC/SD interrupt assignment
ARM: nomadik: set latencies to 8 cycles
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
ARM: Fix broken USB support in sunxi_defconfig
Pull ARM SoC fixes from Arnd Bergmann:
"This is the final small set of ARM SoC bug fixes for linux-4.4, almost
all regressions:
OMAP:
- data corruption on the Nokia N900 flash
Allwinner:
- Two defconfig change to get USB working again
ARM Versatile:
- Interrupt numbers gone bad after an older bug fix
Nomadik:
- Crashes from incorrect L2 cache settings
VIA vt8500:
- SD/MMC support on WM8650 never worked"
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
dts: vt8500: Add SDHC node to DTS file for WM8650
ARM: Fix broken USB support in multi_v7_defconfig for sunxi devices
ARM: versatile: fix MMC/SD interrupt assignment
ARM: nomadik: set latencies to 8 cycles
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
ARM: Fix broken USB support in sunxi_defconfig
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull KVM fix from Paolo Bonzini:
"A simple fix. I'm sending it before the merge window, because it
refines a patch found in your master branch but not yet in the
kvm/next branch that is destined for 4.5"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
kvm: x86: only channel 0 of the i8254 is linked to the HPET
Pull KVM fix from Paolo Bonzini:
"A simple fix. I'm sending it before the merge window, because it
refines a patch found in your master branch but not yet in the
kvm/next branch that is destined for 4.5"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
kvm: x86: only channel 0 of the i8254 is linked to the HPET
Merge tag 'pm+acpi-4.4-final' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI fix from Rafael Wysocki:
"Just one obvious fix that adds a missing function argument in ACPI
code introduced recently (Kees Cook)"
* tag 'pm+acpi-4.4-final' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI / property: avoid leaking format string into kobject name
Pull ACPI fix from Rafael Wysocki:
"Just one obvious fix that adds a missing function argument in ACPI
code introduced recently (Kees Cook)"
* tag 'pm+acpi-4.4-final' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI / property: avoid leaking format string into kobject name
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
"A handful of x86 fixes:
- a syscall ABI fix, fixing an Android breakage
- a Xen PV guest fix relating to the RTC device, causing a
non-working console
- a Xen guest syscall stack frame fix
- an MCE hotplug CPU crash fix"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/numachip: Fix NumaConnect2 MMCFG PCI access
x86/entry: Restore traditional SYSENTER calling convention
x86/entry: Fix some comments
x86/paravirt: Prevent rtc_cmos platform device init on PV guests
x86/xen: Avoid fast syscall path for Xen PV guests
x86/mce: Ensure offline CPUs don't participate in rendezvous process
Pull x86 fixes from Ingo Molnar:
"A handful of x86 fixes:
- a syscall ABI fix, fixing an Android breakage
- a Xen PV guest fix relating to the RTC device, causing a
non-working console
- a Xen guest syscall stack frame fix
- an MCE hotplug CPU crash fix"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/numachip: Fix NumaConnect2 MMCFG PCI access
x86/entry: Restore traditional SYSENTER calling convention
x86/entry: Fix some comments
x86/paravirt: Prevent rtc_cmos platform device init on PV guests
x86/xen: Avoid fast syscall path for Xen PV guests
x86/mce: Ensure offline CPUs don't participate in rendezvous process
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
"Misc scheduler fixes"
* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/core: Reset task's lockless wake-queues on fork()
sched/core: Fix unserialized r-m-w scribbling stuff
sched/core: Check tgid in is_global_init()
sched/fair: Fix multiplication overflow on 32-bit systems
Pull scheduler fixes from Ingo Molnar:
"Misc scheduler fixes"
* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/core: Reset task's lockless wake-queues on fork()
sched/core: Fix unserialized r-m-w scribbling stuff
sched/core: Check tgid in is_global_init()
sched/fair: Fix multiplication overflow on 32-bit systems
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar:
"Two core subsystem fixes, plus a handful of tooling fixes"
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Fix race in swevent hash
perf: Fix race in perf_event_exec()
perf list: Robustify event printing routine
perf list: Add support for PERF_COUNT_SW_BPF_OUT
perf hists browser: Fix segfault if use symbol filter in cmdline
perf hists browser: Reset selection when refresh
perf hists browser: Add NULL pointer check to prevent crash
perf buildid-list: Fix return value of perf buildid-list -k
perf buildid-list: Show running kernel build id fix
Pull perf fixes from Ingo Molnar:
"Two core subsystem fixes, plus a handful of tooling fixes"
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Fix race in swevent hash
perf: Fix race in perf_event_exec()
perf list: Robustify event printing routine
perf list: Add support for PERF_COUNT_SW_BPF_OUT
perf hists browser: Fix segfault if use symbol filter in cmdline
perf hists browser: Reset selection when refresh
perf hists browser: Add NULL pointer check to prevent crash
perf buildid-list: Fix return value of perf buildid-list -k
perf buildid-list: Show running kernel build id fix
Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq fix from Ingo Molnar:
"Fixes a core IRQ subsystem deadlock"
* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
genirq: Prevent chip buslock deadlock
Pull irq fix from Ingo Molnar:
"Fixes a core IRQ subsystem deadlock"
* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
genirq: Prevent chip buslock deadlock
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull block revert from Jens Axboe:
"The previous pull request had a split fix for NVMe, however there are
corner cases where that ends up blowing up.
So let's revert it for 4.4. The regression isn't introduced in this
cycle, and it's "just" a performance regression, not a
stability/integrity issue"
* 'for-linus' of git://git.kernel.dk/linux-block:
Revert "block: Split bios on chunk boundaries"
Pull block revert from Jens Axboe:
"The previous pull request had a split fix for NVMe, however there are
corner cases where that ends up blowing up.
So let's revert it for 4.4. The regression isn't introduced in this
cycle, and it's "just" a performance regression, not a
stability/integrity issue"
* 'for-linus' of git://git.kernel.dk/linux-block:
Revert "block: Split bios on chunk boundaries"
Merge tag 'dmaengine-fix-4.4' of git://git.infradead.org/users/vkoul/slave-dma
Pull dmaengine fixes from Vinod Koul:
"Late fixes for 4.4 are three fixes for drivers which include a revert
of mic-x100 fix which is causing regression, xgene fix for double IRQ
and async_tx fix to use GFP_NOWAIT"
* tag 'dmaengine-fix-4.4' of git://git.infradead.org/users/vkoul/slave-dma:
dmaengine: xgene-dma: Fix double IRQ issue by setting IRQ_DISABLE_UNLAZY flag
async_tx: use GFP_NOWAIT rather than GFP_IO
dmaengine: Revert "dmaengine: mic_x100: add missing spin_unlock"
Pull dmaengine fixes from Vinod Koul:
"Late fixes for 4.4 are three fixes for drivers which include a revert
of mic-x100 fix which is causing regression, xgene fix for double IRQ
and async_tx fix to use GFP_NOWAIT"
* tag 'dmaengine-fix-4.4' of git://git.infradead.org/users/vkoul/slave-dma:
dmaengine: xgene-dma: Fix double IRQ issue by setting IRQ_DISABLE_UNLAZY flag
async_tx: use GFP_NOWAIT rather than GFP_IO
dmaengine: Revert "dmaengine: mic_x100: add missing spin_unlock"
Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging
Pull dmi fix from Jean Delvare.
* 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
Pull dmi fix from Jean Delvare.
* 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
Merge tag 'sound-4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A slightly higher volume than a new year's wish, but not too
worrisome: a large LOC is only for HD-audio device-specific quirks, so
fairly safe to apply. The rest ASoC fixes are all trivial and small;
a simple replacement of mutex call with nested lock version, a few
Arizona and Realtek codec fixes, and a regression fix for Skylake
firmware handling"
* tag 'sound-4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: Intel: Skylake: Fix the memory leak
ASoC: Intel: Skylake: Revert previous broken fix memory leak fix
ASoC: Use nested lock for snd_soc_dapm_mutex_lock
ASoC: rt5645: add sys clk detection
ALSA: hda - Add keycode map for alc input device
ALSA: hda - Add mic mute hotkey quirk for Lenovo ThinkCentre AIO
ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz
Pull sound fixes from Takashi Iwai:
"A slightly higher volume than a new year's wish, but not too
worrisome: a large LOC is only for HD-audio device-specific quirks, so
fairly safe to apply. The rest ASoC fixes are all trivial and small;
a simple replacement of mutex call with nested lock version, a few
Arizona and Realtek codec fixes, and a regression fix for Skylake
firmware handling"
* tag 'sound-4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: Intel: Skylake: Fix the memory leak
ASoC: Intel: Skylake: Revert previous broken fix memory leak fix
ASoC: Use nested lock for snd_soc_dapm_mutex_lock
ASoC: rt5645: add sys clk detection
ALSA: hda - Add keycode map for alc input device
ALSA: hda - Add mic mute hotkey quirk for Lenovo ThinkCentre AIO
ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz
Merge tag 'omap-for-v4.4/onenand-corruption' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
Pull "urgent onenand file system corruption fix for n900" from Tony Lindgren:
Last minute urgent pull request to prevent file system corruption
on Nokia N900.
Looks like we have a GPMC bus timing bug that has gone unnoticed
because of bootloader configured registers until few days ago. We
are not detecting the onenand clock rate properly unless we have
CONFIG_OMAP_GPMC_DEBUG set and this causes onenand corruption
that can be easily be reproduced.
There seems to be also an additional bug still lurking around for
onenand corruption. But that is still being investigated and
it does not seem to be GPMC timings related.
Meanwhile, it would be good to get this fix into v4.4 to prevent
wrong timings from corrupting onenand.
* tag 'omap-for-v4.4/onenand-corruption' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
Pull "urgent onenand file system corruption fix for n900" from Tony Lindgren:
Last minute urgent pull request to prevent file system corruption
on Nokia N900.
Looks like we have a GPMC bus timing bug that has gone unnoticed
because of bootloader configured registers until few days ago. We
are not detecting the onenand clock rate properly unless we have
CONFIG_OMAP_GPMC_DEBUG set and this causes onenand corruption
that can be easily be reproduced.
There seems to be also an additional bug still lurking around for
onenand corruption. But that is still being investigated and
it does not seem to be GPMC timings related.
Meanwhile, it would be good to get this fix into v4.4 to prevent
wrong timings from corrupting onenand.
* tag 'omap-for-v4.4/onenand-corruption' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
Revert "block: Split bios on chunk boundaries"
This reverts commit d3805611130af9b911e908af9f67a3f64f4f0914.
If we end up splitting on the first segment, we don't adjust
the sector count. That results in hitting a BUG() with attempting
to split 0 sectors.
As this is just a performance issue and not a regression since
4.3 release, let's just rever this change. That gives us more
time to test a real fix for 4.5, which would be marked for
stable anyway.
This reverts commit d3805611130af9b911e908af9f67a3f64f4f0914.
If we end up splitting on the first segment, we don't adjust
the sector count. That results in hitting a BUG() with attempting
to split 0 sectors.
As this is just a performance issue and not a regression since
4.3 release, let's just rever this change. That gives us more
time to test a real fix for 4.5, which would be marked for
stable anyway.
PCI: dra7xx: Mark driver as broken
Mark the dra7xx PCI host driver as broken. This driver was first merged in
v3.17 and has never worked. Although the driver compiles just fine, it is
missing an essential device reset. If the driver is included, the kernel
locks up hard shortly after booting, before any console output appears.
Signed-off-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Mark the dra7xx PCI host driver as broken. This driver was first merged in
v3.17 and has never worked. Although the driver compiles just fine, it is
missing an essential device reset. If the driver is included, the kernel
locks up hard shortly after booting, before any console output appears.
Signed-off-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
The dmi_ver wasn't updated correctly before the dmi_decode method run
to save the uuid.
That resulted in "dmidecode -s system-uuid" and
/sys/class/dmi/id/product_uuid disagreeing. The latter was buggy and
this fixes it.
Reported-by: Federico Simoncelli <fsimonce@redhat.com>
Fixes: 9f9c9cbb6057 ("drivers/firmware/dmi_scan.c: fetch dmi version from SMBIOS if it exists")
Fixes: 79bae42d51a5 ("dmi_scan: refactor dmi_scan_machine(), {smbios,dmi}_present()")
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Jean Delvare <jdelvare@suse.de>
The dmi_ver wasn't updated correctly before the dmi_decode method run
to save the uuid.
That resulted in "dmidecode -s system-uuid" and
/sys/class/dmi/id/product_uuid disagreeing. The latter was buggy and
this fixes it.
Reported-by: Federico Simoncelli <fsimonce@redhat.com>
Fixes: 9f9c9cbb6057 ("drivers/firmware/dmi_scan.c: fetch dmi version from SMBIOS if it exists")
Fixes: 79bae42d51a5 ("dmi_scan: refactor dmi_scan_machine(), {smbios,dmi}_present()")
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Jean Delvare <jdelvare@suse.de>
ACPI / property: avoid leaking format string into kobject name
The dn->name is expected to be used as a literal, so add the missing
"%s".
Fixes: 263b4c1a64bc (ACPI / property: Expose data-only subnodes via sysfs)
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
The dn->name is expected to be used as a literal, so add the missing
"%s".
Fixes: 263b4c1a64bc (ACPI / property: Expose data-only subnodes via sysfs)
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm nouveau fix from Dave Airlie:
"Still not back to work, but I decided to forward this fix"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/nouveau/gr/nv40: fix oops in interrupt handler
Pull drm nouveau fix from Dave Airlie:
"Still not back to work, but I decided to forward this fix"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/nouveau/gr/nv40: fix oops in interrupt handler
Merge tag 'iommu-fixes-v4.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu
Pull IOMMU fixes from Joerg Roedel:
- Two build issues, one in the ipmmu-vmsa driver and one for the new
generic dma-api implemention used on arm64
- A performance fix for said dma-api implemention
- An issue caused by a wrong offset in map_sg in the same code as above
* tag 'iommu-fixes-v4.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
iommu/dma: Use correct offset in map_sg
iommu/ipmmu-vmsa: Don't truncate ttbr if LPAE is not enabled
iommu/dma: Avoid unlikely high-order allocations
iommu/dma: Add some missing #includes
Pull IOMMU fixes from Joerg Roedel:
- Two build issues, one in the ipmmu-vmsa driver and one for the new
generic dma-api implemention used on arm64
- A performance fix for said dma-api implemention
- An issue caused by a wrong offset in map_sg in the same code as above
* tag 'iommu-fixes-v4.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
iommu/dma: Use correct offset in map_sg
iommu/ipmmu-vmsa: Don't truncate ttbr if LPAE is not enabled
iommu/dma: Avoid unlikely high-order allocations
iommu/dma: Add some missing #includes
Merge tag 'trace-v4.4-rc4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
Pull ftrace fix from Steven Rostedt:
"PeiyangX Qiu reported that if a module fails to load between calling
ftrace_module_init() and do_init_module() that the allocations made in
ftrace_module_init() will not be freed, resulting in a memory leak.
The solution is to call ftrace_release_mod() on the failing module in
the fail path befor do_init_module() is called. This will remove any
allocations made for that module, and nothing if ftrace_module_init()
wasn't called yet for that module.
Note, once do_init_module() is called, the MODULE_GOING notifiers are
called for the failed module, which calls into the ftrace code to do
the proper clean up (basically calling ftrace_release_mod())"
* tag 'trace-v4.4-rc4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
ftrace/module: Call clean up function when module init fails early
Pull ftrace fix from Steven Rostedt:
"PeiyangX Qiu reported that if a module fails to load between calling
ftrace_module_init() and do_init_module() that the allocations made in
ftrace_module_init() will not be freed, resulting in a memory leak.
The solution is to call ftrace_release_mod() on the failing module in
the fail path befor do_init_module() is called. This will remove any
allocations made for that module, and nothing if ftrace_module_init()
wasn't called yet for that module.
Note, once do_init_module() is called, the MODULE_GOING notifiers are
called for the failed module, which calls into the ftrace code to do
the proper clean up (basically calling ftrace_release_mod())"
* tag 'trace-v4.4-rc4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
ftrace/module: Call clean up function when module init fails early
ftrace/module: Call clean up function when module init fails early
If the module init code fails after calling ftrace_module_init() and before
calling do_init_module(), we can suffer from a memory leak. This is because
ftrace_module_init() allocates pages to store the locations that ftrace
hooks are placed in the module text. If do_init_module() fails, it still
calls the MODULE_GOING notifiers which will tell ftrace to do a clean up of
the pages it allocated for the module. But if load_module() fails before
then, the pages allocated by ftrace_module_init() will never be freed.
Call ftrace_release_mod() on the module if load_module() fails before
getting to do_init_module().
Link: http://lkml.kernel.org/r/567CEA31.1070507@intel.com
Reported-by: "Qiu, PeiyangX" <peiyangx.qiu@intel.com>
Fixes: a949ae560a511 "ftrace/module: Hardcode ftrace_module_init() call into load_module()"
Cc: stable@vger.kernel.org # v2.6.38+
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
If the module init code fails after calling ftrace_module_init() and before
calling do_init_module(), we can suffer from a memory leak. This is because
ftrace_module_init() allocates pages to store the locations that ftrace
hooks are placed in the module text. If do_init_module() fails, it still
calls the MODULE_GOING notifiers which will tell ftrace to do a clean up of
the pages it allocated for the module. But if load_module() fails before
then, the pages allocated by ftrace_module_init() will never be freed.
Call ftrace_release_mod() on the module if load_module() fails before
getting to do_init_module().
Link: http://lkml.kernel.org/r/567CEA31.1070507@intel.com
Reported-by: "Qiu, PeiyangX" <peiyangx.qiu@intel.com>
Fixes: a949ae560a511 "ftrace/module: Hardcode ftrace_module_init() call into load_module()"
Cc: stable@vger.kernel.org # v2.6.38+
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
dts: vt8500: Add SDHC node to DTS file for WM8650
Since WM8650 has the same 'WMT' SDHC controller as WM8505, and the driver
is already in the kernel, this node enables the controller support for
WM8650
Signed-off-by: Roman Volkov <rvolkov@v1ros.org>
Reviewed-by: Alexey Charkov <alchark@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Since WM8650 has the same 'WMT' SDHC controller as WM8505, and the driver
is already in the kernel, this node enables the controller support for
WM8650
Signed-off-by: Roman Volkov <rvolkov@v1ros.org>
Reviewed-by: Alexey Charkov <alchark@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
ARM: Fix broken USB support in multi_v7_defconfig for sunxi devices
Commit 69fb4dcada77 ("power: Add an axp20x-usb-power driver") introduced a
new driver for the USB power supply used on various Allwinner based SBCs.
However, the driver was not added to multi_v7_defconfig which breaks USB
support for some boards (e.g. LeMaker BananaPi) as the kernel will now
turn off the USB power supply during boot by default if the driver isn't
present. (This was not the case in linux 4.3 or lower where the USB power
was always left on.)
Hence, add the driver to multi_v7_defconfig in order to keep USB support
working on those boards that require it.
Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Tested-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Commit 69fb4dcada77 ("power: Add an axp20x-usb-power driver") introduced a
new driver for the USB power supply used on various Allwinner based SBCs.
However, the driver was not added to multi_v7_defconfig which breaks USB
support for some boards (e.g. LeMaker BananaPi) as the kernel will now
turn off the USB power supply during boot by default if the driver isn't
present. (This was not the case in linux 4.3 or lower where the USB power
was always left on.)
Hence, add the driver to multi_v7_defconfig in order to keep USB support
working on those boards that require it.
Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Tested-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Merge branch 'master' of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into ti-linux-4.4.y
* 'master' of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux:
tcp: fix zero cwnd in tcp_cwnd_reduction
Driver: Vmxnet3: Fix regression caused by 5738a09
net: qmi_wwan: Add WeTelecom-WPD600N
mkiss: fix scribble on freed memory
net: possible use after free in dst_release
net: sched: fix missing free per cpu on qstats
ARM: net: bpf: fix zero right shift
6pack: fix free memory scribbles
net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
mtd: spi-nor: fix stm_is_locked_sr() parameters
mtd: spi-nor: fix Spansion regressions (aliased with Winbond)
bridge: Only call /sbin/bridge-stp for the initial network namespace
af_unix: Fix splice-bind deadlock
net: Propagate lookup failure in l3mdev_get_saddr to caller
r8152: add reset_resume function
connector: bump skb->users before callback invocation
cxgb4: correctly handling failed allocation
qlcnic: correctly handle qlcnic_alloc_mbx_args
mtd: fix cmdlinepart parser, early naming for auto-filled MTD
* 'master' of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux:
tcp: fix zero cwnd in tcp_cwnd_reduction
Driver: Vmxnet3: Fix regression caused by 5738a09
net: qmi_wwan: Add WeTelecom-WPD600N
mkiss: fix scribble on freed memory
net: possible use after free in dst_release
net: sched: fix missing free per cpu on qstats
ARM: net: bpf: fix zero right shift
6pack: fix free memory scribbles
net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
mtd: spi-nor: fix stm_is_locked_sr() parameters
mtd: spi-nor: fix Spansion regressions (aliased with Winbond)
bridge: Only call /sbin/bridge-stp for the initial network namespace
af_unix: Fix splice-bind deadlock
net: Propagate lookup failure in l3mdev_get_saddr to caller
r8152: add reset_resume function
connector: bump skb->users before callback invocation
cxgb4: correctly handling failed allocation
qlcnic: correctly handle qlcnic_alloc_mbx_args
mtd: fix cmdlinepart parser, early naming for auto-filled MTD
kvm: x86: only channel 0 of the i8254 is linked to the HPET
While setting the KVM PIT counters in 'kvm_pit_load_count', if
'hpet_legacy_start' is set, the function disables the timer on
channel[0], instead of the respective index 'channel'. This is
because channels 1-3 are not linked to the HPET. Fix the caller
to only activate the special HPET processing for channel 0.
Reported-by: P J P <pjp@fedoraproject.org>
Fixes: 0185604c2d82c560dab2f2933a18f797e74ab5a8
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
While setting the KVM PIT counters in 'kvm_pit_load_count', if
'hpet_legacy_start' is set, the function disables the timer on
channel[0], instead of the respective index 'channel'. This is
because channels 1-3 are not linked to the HPET. Fix the caller
to only activate the special HPET processing for channel 0.
Reported-by: P J P <pjp@fedoraproject.org>
Fixes: 0185604c2d82c560dab2f2933a18f797e74ab5a8
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
iommu/dma: Use correct offset in map_sg
When mapping a non-page-aligned scatterlist entry, we copy the original
offset to the output DMA address before aligning it to hand off to
iommu_map_sg(), then later adding the IOVA page address portion to get
the final mapped address. However, when the IOVA page size is smaller
than the CPU page size, it is the offset within the IOVA page we want,
not that within the CPU page, which can easily be larger than an IOVA
page and thus result in an incorrect final address.
Fix the bug by taking only the IOVA-aligned part of the offset as the
basis of the DMA address, not the whole thing.
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
When mapping a non-page-aligned scatterlist entry, we copy the original
offset to the output DMA address before aligning it to hand off to
iommu_map_sg(), then later adding the IOVA page address portion to get
the final mapped address. However, when the IOVA page size is smaller
than the CPU page size, it is the offset within the IOVA page we want,
not that within the CPU page, which can easily be larger than an IOVA
page and thus result in an incorrect final address.
Fix the bug by taking only the IOVA-aligned part of the offset as the
basis of the DMA address, not the whole thing.
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Merge branch 'linux-4.4' of git://github.com/skeggsb/linux into drm-fixes
single nv40 oops fix.
* 'linux-4.4' of git://github.com/skeggsb/linux:
drm/nouveau/gr/nv40: fix oops in interrupt handler
single nv40 oops fix.
* 'linux-4.4' of git://github.com/skeggsb/linux:
drm/nouveau/gr/nv40: fix oops in interrupt handler
dmaengine: xgene-dma: Fix double IRQ issue by setting IRQ_DISABLE_UNLAZY flag
For interrupt controller that doesn't support irq_disable and hardware
with level interrupt, an extra interrupt can be pending. This patch fixes
the issue by setting IRQ_DISABLE_UNLAZY flag for the interrupt line.
Reference: http://git.kernel.org/tip/e9849777d0e27cdd2902805be51da73e7c79578c
Signed-off-by: Rameshwar Prasad Sahu <rsahu@apm.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
For interrupt controller that doesn't support irq_disable and hardware
with level interrupt, an extra interrupt can be pending. This patch fixes
the issue by setting IRQ_DISABLE_UNLAZY flag for the interrupt line.
Reference: http://git.kernel.org/tip/e9849777d0e27cdd2902805be51da73e7c79578c
Signed-off-by: Rameshwar Prasad Sahu <rsahu@apm.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
async_tx: use GFP_NOWAIT rather than GFP_IO
These async_XX functions are called from md/raid5 in an atomic
section, between get_cpu() and put_cpu(), so they must not sleep.
So use GFP_NOWAIT rather than GFP_IO.
Dan Williams writes: Longer term async_tx needs to be merged into md
directly as we can allocate this unmap data statically per-stripe
rather than per request.
Fixed: 7476bd79fc01 ("async_pq: convert to dmaengine_unmap_data")
Cc: stable@vger.kernel.org (v3.13+)
Reported-and-tested-by: Stanislav Samsonov <slava@annapurnalabs.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
These async_XX functions are called from md/raid5 in an atomic
section, between get_cpu() and put_cpu(), so they must not sleep.
So use GFP_NOWAIT rather than GFP_IO.
Dan Williams writes: Longer term async_tx needs to be merged into md
directly as we can allocate this unmap data statically per-stripe
rather than per request.
Fixed: 7476bd79fc01 ("async_pq: convert to dmaengine_unmap_data")
Cc: stable@vger.kernel.org (v3.13+)
Reported-and-tested-by: Stanislav Samsonov <slava@annapurnalabs.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
ARM: versatile: fix MMC/SD interrupt assignment
Commit 0976c946a610d06e907335b7a3afa6db046f8e1b
"arm/versatile: Fix versatile irq specifications"
has an off-by-one error on the Versatile AB that has
been regressing the Versatile AB hardware for some time.
However it seems like the interrupt assignments have
never been correct and I have now adjusted them according
to the specification. The masks for the valid interrupts
made it impossible to assign the right SIC interrupt
for the MMCI, so I went in and fixed these to correspond
to the specifications, and added references if anyone
wants to double-check.
Due to the Versatile PB including the Versatile AB
as a base DTS file, we need to override and correct
some values to correspond to the actual changes in the
hardware.
For the Versatile PB I don't think the IRQ line
assignment for MMCI has ever been correct for either of
the two MMCI blocks. It would be nice if someone with the
physical PB board could test this.
Patch tested on the Versatile AB, QEMU for Versatile AB
and QEMU for Versatile PB.
Cc: Rob Herring <robh@kernel.org>
Cc: Grant Likely <grant.likely@linaro.org>
Cc: stable@vger.kernel.org
Fixes: 0976c946a610 ("arm/versatile: Fix versatile irq specifications")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Commit 0976c946a610d06e907335b7a3afa6db046f8e1b
"arm/versatile: Fix versatile irq specifications"
has an off-by-one error on the Versatile AB that has
been regressing the Versatile AB hardware for some time.
However it seems like the interrupt assignments have
never been correct and I have now adjusted them according
to the specification. The masks for the valid interrupts
made it impossible to assign the right SIC interrupt
for the MMCI, so I went in and fixed these to correspond
to the specifications, and added references if anyone
wants to double-check.
Due to the Versatile PB including the Versatile AB
as a base DTS file, we need to override and correct
some values to correspond to the actual changes in the
hardware.
For the Versatile PB I don't think the IRQ line
assignment for MMCI has ever been correct for either of
the two MMCI blocks. It would be nice if someone with the
physical PB board could test this.
Patch tested on the Versatile AB, QEMU for Versatile AB
and QEMU for Versatile PB.
Cc: Rob Herring <robh@kernel.org>
Cc: Grant Likely <grant.likely@linaro.org>
Cc: stable@vger.kernel.org
Fixes: 0976c946a610 ("arm/versatile: Fix versatile irq specifications")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
ARM: nomadik: set latencies to 8 cycles
The Nomadik has sporadic crashes because of these latencies, setting
them to max makes the platform work nicely, so use this values for
now.
These latencies were set to 2 since the Nomadik platform was merged,
but I suspect they never took effect until the right size and
associativity for the cache was specified in the device tree and
that is why the crash comes now.
Cc: stable@vger.kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
The Nomadik has sporadic crashes because of these latencies, setting
them to max makes the platform work nicely, so use this values for
now.
These latencies were set to 2 since the Nomadik platform was merged,
but I suspect they never took effect until the right size and
associativity for the cache was specified in the device tree and
that is why the crash comes now.
Cc: stable@vger.kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Merge tag 'for-linus-20160106' of git://git.infradead.org/linux-mtd
Pull MTD fixes from Brian Norris:
"Three last MTD fixes for v4.4. These are all fixes for regressions
and bugs reported mid cycle. Unfortunately, some of them took a bit
long to get proper testing and feedback.
- Assign the default MTD name earlier in the registration process, so
partition parsers (like cmdlinepart) see the right name. Without
this, some systems may come up with unpartitioned flash. This was
a v4.4-rc1 regression.
- Revert some new Winbond SPI NOR flash unlocking/locking support;
new code in v4.4 caused regressions on some Spansion flash.
- Fix mis-typed parameter ordering in SPI NOR unlock function; this
bug was introduced in v4.4-rc1"
* tag 'for-linus-20160106' of git://git.infradead.org/linux-mtd:
mtd: spi-nor: fix stm_is_locked_sr() parameters
mtd: spi-nor: fix Spansion regressions (aliased with Winbond)
mtd: fix cmdlinepart parser, early naming for auto-filled MTD
Pull MTD fixes from Brian Norris:
"Three last MTD fixes for v4.4. These are all fixes for regressions
and bugs reported mid cycle. Unfortunately, some of them took a bit
long to get proper testing and feedback.
- Assign the default MTD name earlier in the registration process, so
partition parsers (like cmdlinepart) see the right name. Without
this, some systems may come up with unpartitioned flash. This was
a v4.4-rc1 regression.
- Revert some new Winbond SPI NOR flash unlocking/locking support;
new code in v4.4 caused regressions on some Spansion flash.
- Fix mis-typed parameter ordering in SPI NOR unlock function; this
bug was introduced in v4.4-rc1"
* tag 'for-linus-20160106' of git://git.infradead.org/linux-mtd:
mtd: spi-nor: fix stm_is_locked_sr() parameters
mtd: spi-nor: fix Spansion regressions (aliased with Winbond)
mtd: fix cmdlinepart parser, early naming for auto-filled MTD
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:
"As usual, there are a couple straggler bug fixes:
1) qlcnic_alloc_mbx_args() error returns are not checked in qlcnic
driver. Fix from Insu Yun.
2) SKB refcounting bug in connector, from Florian Westphal.
3) vrf_get_saddr() has to propagate fib_lookup() errors to it's
callers, from David Ahern.
4) Fix AF_UNIX splice/bind deadlock, from Rainer Weikusat.
5) qdisc_rcu_free() fails to free the per-cpu qstats. Fix from John
Fastabend.
6) vmxnet3 driver passes wrong page to dma_map_page(), fix from
Shrikrishna Khare.
7) Don't allow zero cwnd in tcp_cwnd_reduction(), from Yuchung Cheng"
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
tcp: fix zero cwnd in tcp_cwnd_reduction
Driver: Vmxnet3: Fix regression caused by 5738a09
net: qmi_wwan: Add WeTelecom-WPD600N
mkiss: fix scribble on freed memory
net: possible use after free in dst_release
net: sched: fix missing free per cpu on qstats
ARM: net: bpf: fix zero right shift
6pack: fix free memory scribbles
net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
bridge: Only call /sbin/bridge-stp for the initial network namespace
af_unix: Fix splice-bind deadlock
net: Propagate lookup failure in l3mdev_get_saddr to caller
r8152: add reset_resume function
connector: bump skb->users before callback invocation
cxgb4: correctly handling failed allocation
qlcnic: correctly handle qlcnic_alloc_mbx_args
Pull networking fixes from David Miller:
"As usual, there are a couple straggler bug fixes:
1) qlcnic_alloc_mbx_args() error returns are not checked in qlcnic
driver. Fix from Insu Yun.
2) SKB refcounting bug in connector, from Florian Westphal.
3) vrf_get_saddr() has to propagate fib_lookup() errors to it's
callers, from David Ahern.
4) Fix AF_UNIX splice/bind deadlock, from Rainer Weikusat.
5) qdisc_rcu_free() fails to free the per-cpu qstats. Fix from John
Fastabend.
6) vmxnet3 driver passes wrong page to dma_map_page(), fix from
Shrikrishna Khare.
7) Don't allow zero cwnd in tcp_cwnd_reduction(), from Yuchung Cheng"
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
tcp: fix zero cwnd in tcp_cwnd_reduction
Driver: Vmxnet3: Fix regression caused by 5738a09
net: qmi_wwan: Add WeTelecom-WPD600N
mkiss: fix scribble on freed memory
net: possible use after free in dst_release
net: sched: fix missing free per cpu on qstats
ARM: net: bpf: fix zero right shift
6pack: fix free memory scribbles
net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
bridge: Only call /sbin/bridge-stp for the initial network namespace
af_unix: Fix splice-bind deadlock
net: Propagate lookup failure in l3mdev_get_saddr to caller
r8152: add reset_resume function
connector: bump skb->users before callback invocation
cxgb4: correctly handling failed allocation
qlcnic: correctly handle qlcnic_alloc_mbx_args
tcp: fix zero cwnd in tcp_cwnd_reduction
Patch 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode
conditionally") introduced a bug that cwnd may become 0 when both
inflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead
to a div-by-zero if the connection starts another cwnd reduction
phase by setting tp->prior_cwnd to the current cwnd (0) in
tcp_init_cwnd_reduction().
To prevent this we skip PRR operation when nothing is acked or
sacked. Then cwnd must be positive in all cases as long as ssthresh
is positive:
1) The proportional reduction mode
inflight > ssthresh > 0
2) The reduction bound mode
a) inflight == ssthresh > 0
b) inflight < ssthresh
sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh
Therefore in all cases inflight and sndcnt can not both be 0.
We check invalid tp->prior_cwnd to avoid potential div0 bugs.
In reality this bug is triggered only with a sequence of less common
events. For example, the connection is terminating an ECN-triggered
cwnd reduction with an inflight 0, then it receives reordered/old
ACKs or DSACKs from prior transmission (which acks nothing). Or the
connection is in fast recovery stage that marks everything lost,
but fails to retransmit due to local issues, then receives data
packets from other end which acks nothing.
Fixes: 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally")
Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Patch 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode
conditionally") introduced a bug that cwnd may become 0 when both
inflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead
to a div-by-zero if the connection starts another cwnd reduction
phase by setting tp->prior_cwnd to the current cwnd (0) in
tcp_init_cwnd_reduction().
To prevent this we skip PRR operation when nothing is acked or
sacked. Then cwnd must be positive in all cases as long as ssthresh
is positive:
1) The proportional reduction mode
inflight > ssthresh > 0
2) The reduction bound mode
a) inflight == ssthresh > 0
b) inflight < ssthresh
sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh
Therefore in all cases inflight and sndcnt can not both be 0.
We check invalid tp->prior_cwnd to avoid potential div0 bugs.
In reality this bug is triggered only with a sequence of less common
events. For example, the connection is terminating an ECN-triggered
cwnd reduction with an inflight 0, then it receives reordered/old
ACKs or DSACKs from prior transmission (which acks nothing). Or the
connection is in fast recovery stage that marks everything lost,
but fails to retransmit due to local issues, then receives data
packets from other end which acks nothing.
Fixes: 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally")
Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Driver: Vmxnet3: Fix regression caused by 5738a09
Reported-by: Bingkuo Liu <bingkuol@vmware.com>
Signed-off-by: Shrikrishna Khare <skhare@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Reported-by: Bingkuo Liu <bingkuol@vmware.com>
Signed-off-by: Shrikrishna Khare <skhare@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net: qmi_wwan: Add WeTelecom-WPD600N
The WeTelecom-WPD600N is an LTE module that, in addition to supporting most
"normal" bands, also supports LTE over 450MHz. Manual testing showed that
only interface number three replies to QMI messages.
Cc: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
The WeTelecom-WPD600N is an LTE module that, in addition to supporting most
"normal" bands, also supports LTE over 450MHz. Manual testing showed that
only interface number three replies to QMI messages.
Cc: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
mkiss: fix scribble on freed memory
commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable
scribble on free memory but added a new one which allows the user to
scribble even more and user controlled data into freed space.
As with 6pack we need to halt the queue before we free the buffers, because
the transmit logic is not protected by the semaphore.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable
scribble on free memory but added a new one which allows the user to
scribble even more and user controlled data into freed space.
As with 6pack we need to halt the queue before we free the buffers, because
the transmit logic is not protected by the semaphore.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net: possible use after free in dst_release
dst_release should not access dst->flags after decrementing
__refcnt to 0. The dst_entry may be in dst_busy_list and
dst_gc_task may dst_destroy it before dst_release gets a chance
to access dst->flags.
Fixes: d69bbf88c8d0 ("net: fix a race in dst_release()")
Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst")
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
dst_release should not access dst->flags after decrementing
__refcnt to 0. The dst_entry may be in dst_busy_list and
dst_gc_task may dst_destroy it before dst_release gets a chance
to access dst->flags.
Fixes: d69bbf88c8d0 ("net: fix a race in dst_release()")
Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst")
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge tag 'asoc-fix-v4.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Last minute fixes for v4.4
A few final fixes for v4.4, the main one being the two patches to the
new Sky Lake drivers which fix a previous incorrect fix that went in
during an earlier -rc.
ASoC: Last minute fixes for v4.4
A few final fixes for v4.4, the main one being the two patches to the
new Sky Lake drivers which fix a previous incorrect fix that went in
during an earlier -rc.
ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
Commit 63aa945b1013 ("memory: omap-gpmc: Add Kconfig option for debug")
unified the GPMC debug for the SoCs with GPMC. The commit also left out
the option for HWMOD_INIT_NO_RESET as we now require proper timings for
GPMC to be able to remap GPMC devices out of address 0.
Unfortunately on Nokia N900, onenand now only partially works with the
device tree provided timings. It works enough to get detected but the
clock rate supported by the onenand chip gets misdetected. This in turn
causes the GPMC timings to be miscalculated and this leads into file
system corruption on N900.
Looks like onenand needs CS_CONFIG1 bit 27 WRITETYPE set for for sync
write. This is needed also for async timings when we write to onenand
with omap2_onenand_set_async_mode(). Without sync write bit set, the
async read for the onenand ONENAND_REG_VERSION_ID will return 0xfff.
Let's exit with an error if onenand rate is not detected. And let's
remove the extra call to omap2_onenand_set_async_mode() as we only need
to do this once at the end of omap2_onenand_setup_async().
Fixes: 63aa945b1013 ("memory: omap-gpmc: Add Kconfig option for debug")
Cc: stable@vger.kernel.org # v4.2+
Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Commit 63aa945b1013 ("memory: omap-gpmc: Add Kconfig option for debug")
unified the GPMC debug for the SoCs with GPMC. The commit also left out
the option for HWMOD_INIT_NO_RESET as we now require proper timings for
GPMC to be able to remap GPMC devices out of address 0.
Unfortunately on Nokia N900, onenand now only partially works with the
device tree provided timings. It works enough to get detected but the
clock rate supported by the onenand chip gets misdetected. This in turn
causes the GPMC timings to be miscalculated and this leads into file
system corruption on N900.
Looks like onenand needs CS_CONFIG1 bit 27 WRITETYPE set for for sync
write. This is needed also for async timings when we write to onenand
with omap2_onenand_set_async_mode(). Without sync write bit set, the
async read for the onenand ONENAND_REG_VERSION_ID will return 0xfff.
Let's exit with an error if onenand rate is not detected. And let's
remove the extra call to omap2_onenand_set_async_mode() as we only need
to do this once at the end of omap2_onenand_setup_async().
Fixes: 63aa945b1013 ("memory: omap-gpmc: Add Kconfig option for debug")
Cc: stable@vger.kernel.org # v4.2+
Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Tony Lindgren <tony@atomide.com>
sched/core: Reset task's lockless wake-queues on fork()
In the following commit:
7675104990ed ("sched: Implement lockless wake-queues")
we gained lockless wake-queues.
The -RT kernel managed to lockup itself with those. There could be multiple
attempts for task X to enqueue it for a wakeup _even_ if task X is already
running.
The reason is that task X could be runnable but not yet on CPU. The the
task performing the wakeup did not leave the CPU it could performe
multiple wakeups.
With the proper timming task X could be running and enqueued for a
wakeup. If this happens while X is performing a fork() then its its
child will have a !NULL `wake_q` member copied.
This is not a problem as long as the child task does not participate in
lockless wakeups :)
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Davidlohr Bueso <dbueso@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 7675104990ed ("sched: Implement lockless wake-queues")
Link: http://lkml.kernel.org/r/20151221171710.GA5499@linutronix.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
In the following commit:
7675104990ed ("sched: Implement lockless wake-queues")
we gained lockless wake-queues.
The -RT kernel managed to lockup itself with those. There could be multiple
attempts for task X to enqueue it for a wakeup _even_ if task X is already
running.
The reason is that task X could be runnable but not yet on CPU. The the
task performing the wakeup did not leave the CPU it could performe
multiple wakeups.
With the proper timming task X could be running and enqueued for a
wakeup. If this happens while X is performing a fork() then its its
child will have a !NULL `wake_q` member copied.
This is not a problem as long as the child task does not participate in
lockless wakeups :)
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Davidlohr Bueso <dbueso@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 7675104990ed ("sched: Implement lockless wake-queues")
Link: http://lkml.kernel.org/r/20151221171710.GA5499@linutronix.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
sched/core: Fix unserialized r-m-w scribbling stuff
Some of the sched bitfieds (notably sched_reset_on_fork) can be set
on other than current, this can cause the r-m-w to race with other
updates.
Since all the sched bits are serialized by scheduler locks, pull them
in a separate word.
Reported-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: akpm@linux-foundation.org
Cc: hannes@cmpxchg.org
Cc: mhocko@kernel.org
Cc: vdavydov@parallels.com
Link: http://lkml.kernel.org/r/20151125150207.GM11639@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Some of the sched bitfieds (notably sched_reset_on_fork) can be set
on other than current, this can cause the r-m-w to race with other
updates.
Since all the sched bits are serialized by scheduler locks, pull them
in a separate word.
Reported-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: akpm@linux-foundation.org
Cc: hannes@cmpxchg.org
Cc: mhocko@kernel.org
Cc: vdavydov@parallels.com
Link: http://lkml.kernel.org/r/20151125150207.GM11639@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>