summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-10-09selftests/bpf: Add testcase for async callback return value failureDavid Vernet
A previous commit updated the verifier to print an accurate failure message for when someone specifies a nonzero return value from an async callback. This adds a testcase for validating that the verifier emits the correct message in such a case. Signed-off-by: David Vernet <void@manifault.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20231009161414.235829-2-void@manifault.com
2023-10-09bpf: Fix verifier log for async callback return valuesDavid Vernet
The verifier, as part of check_return_code(), verifies that async callbacks such as from e.g. timers, will return 0. It does this by correctly checking that R0->var_off is in tnum_const(0), which effectively checks that it's in a range of 0. If this condition fails, however, it prints an error message which says that the value should have been in (0x0; 0x1). This results in possibly confusing output such as the following in which an async callback returns 1: At async callback the register R0 has value (0x1; 0x0) should have been in (0x0; 0x1) The fix is easy -- we should just pass the tnum_const(0) as the correct range to verbose_invalid_scalar(), which will then print the following: At async callback the register R0 has value (0x1; 0x0) should have been in (0x0; 0x0) Fixes: bfc6bb74e4f1 ("bpf: Implement verifier support for validation of async callbacks.") Signed-off-by: David Vernet <void@manifault.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20231009161414.235829-1-void@manifault.com
2023-10-09bpftool: Align bpf_load_and_run_opts insns and dataIan Rogers
A C string lacks alignment so use aligned arrays to avoid potential alignment problems. Switch to using sizeof (less 1 for the \0 terminator) rather than a hardcode size constant. Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Quentin Monnet <quentin@isovalent.com> Link: https://lore.kernel.org/bpf/20231007044439.25171-2-irogers@google.com
2023-10-09bpftool: Align output skeleton ELF codeIan Rogers
libbpf accesses the ELF data requiring at least 8 byte alignment, however, the data is generated into a C string that doesn't guarantee alignment. Fix this by assigning to an aligned char array. Use sizeof on the array, less one for the \0 terminator, rather than generating a constant. Fixes: a6cc6b34b93e ("bpftool: Provide a helper method for accessing skeleton's embedded ELF data") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: Alan Maguire <alan.maguire@oracle.com> Acked-by: Quentin Monnet <quentin@isovalent.com> Link: https://lore.kernel.org/bpf/20231007044439.25171-1-irogers@google.com
2023-10-09selftests/bpf: Test pinning bpf timer to a coreDavid Vernet
Now that we support pinning a BPF timer to the current core, we should test it with some selftests. This patch adds two new testcases to the timer suite, which verifies that a BPF timer both with and without BPF_F_TIMER_ABS, can be pinned to the calling core with BPF_F_TIMER_CPU_PIN. Signed-off-by: David Vernet <void@manifault.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Song Liu <song@kernel.org> Acked-by: Hou Tao <houtao1@huawei.com> Link: https://lore.kernel.org/bpf/20231004162339.200702-3-void@manifault.com
2023-10-09bpf: Add ability to pin bpf timer to calling CPUDavid Vernet
BPF supports creating high resolution timers using bpf_timer_* helper functions. Currently, only the BPF_F_TIMER_ABS flag is supported, which specifies that the timeout should be interpreted as absolute time. It would also be useful to be able to pin that timer to a core. For example, if you wanted to make a subset of cores run without timer interrupts, and only have the timer be invoked on a single core. This patch adds support for this with a new BPF_F_TIMER_CPU_PIN flag. When specified, the HRTIMER_MODE_PINNED flag is passed to hrtimer_start(). A subsequent patch will update selftests to validate. Signed-off-by: David Vernet <void@manifault.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Song Liu <song@kernel.org> Acked-by: Hou Tao <houtao1@huawei.com> Link: https://lore.kernel.org/bpf/20231004162339.200702-2-void@manifault.com
2023-10-09xdp: Fix zero-size allocation warning in xskq_create()Andrew Kanner
Syzkaller reported the following issue: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2807 at mm/vmalloc.c:3247 __vmalloc_node_range (mm/vmalloc.c:3361) Modules linked in: CPU: 0 PID: 2807 Comm: repro Not tainted 6.6.0-rc2+ #12 Hardware name: Generic DT based system unwind_backtrace from show_stack (arch/arm/kernel/traps.c:258) show_stack from dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1)) dump_stack_lvl from __warn (kernel/panic.c:633 kernel/panic.c:680) __warn from warn_slowpath_fmt (./include/linux/context_tracking.h:153 kernel/panic.c:700) warn_slowpath_fmt from __vmalloc_node_range (mm/vmalloc.c:3361 (discriminator 3)) __vmalloc_node_range from vmalloc_user (mm/vmalloc.c:3478) vmalloc_user from xskq_create (net/xdp/xsk_queue.c:40) xskq_create from xsk_setsockopt (net/xdp/xsk.c:953 net/xdp/xsk.c:1286) xsk_setsockopt from __sys_setsockopt (net/socket.c:2308) __sys_setsockopt from ret_fast_syscall (arch/arm/kernel/entry-common.S:68) xskq_get_ring_size() uses struct_size() macro to safely calculate the size of struct xsk_queue and q->nentries of desc members. But the syzkaller repro was able to set q->nentries with the value initially taken from copy_from_sockptr() high enough to return SIZE_MAX by struct_size(). The next PAGE_ALIGN(size) is such case will overflow the size_t value and set it to 0. This will trigger WARN_ON_ONCE in vmalloc_user() -> __vmalloc_node_range(). The issue is reproducible on 32-bit arm kernel. Fixes: 9f78bf330a66 ("xsk: support use vaddr as ring") Reported-by: syzbot+fae676d3cf469331fc89@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000c84b4705fb31741e@google.com/T/ Reported-by: syzbot+b132693e925cbbd89e26@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000e20df20606ebab4f@google.com/T/ Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: syzbot+fae676d3cf469331fc89@syzkaller.appspotmail.com Acked-by: Magnus Karlsson <magnus.karlsson@intel.com> Link: https://syzkaller.appspot.com/bug?extid=fae676d3cf469331fc89 Link: https://lore.kernel.org/bpf/20231007075148.1759-1-andrew.kanner@gmail.com
2023-10-09Merge tag 'irqchip-fixes-6.6-2' of ↵Thomas Gleixner
git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes from Marc Zyngier: - DT binding updates for Renesas r8a779f0 and rzg2l - Let GICv3 honor the "dma-non-coherent" attribute for systems that rely on SW guessing what the HW supports - Fix the RISC-V INTC probing by marking all devices as initialised at once - Properly translate interrupt numbers from DT on stm32-exti - Use irq_data_get_irq_chip_data() in the rzg2l driver instead of blindly dereferencing the irq_data structure - Add a MAINTAINERS entry for the various ARM GIC irqchip drivers - Remove myself as the top-level irqchip/irqdomain maintainer Link: https://lore.kernel.org/all/20231007121933.3840357-1-maz@kernel.org
2023-10-09riscv, bpf: Track both a0 (RISC-V ABI) and a5 (BPF) return valuesBjörn Töpel
The RISC-V BPF uses a5 for BPF return values, which are zero-extended, whereas the RISC-V ABI uses a0 which is sign-extended. In other words, a5 and a0 can differ, and are used in different context. The BPF trampoline are used for both BPF programs, and regular kernel functions. Make sure that the RISC-V BPF trampoline saves, and restores both a0 and a5. Fixes: 49b5e77ae3e2 ("riscv, bpf: Add bpf trampoline support for RV64") Signed-off-by: Björn Töpel <bjorn@rivosinc.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20231004120706.52848-3-bjorn@kernel.org
2023-10-09riscv, bpf: Sign-extend return valuesBjörn Töpel
The RISC-V architecture does not expose sub-registers, and hold all 32-bit values in a sign-extended format [1] [2]: | The compiler and calling convention maintain an invariant that all | 32-bit values are held in a sign-extended format in 64-bit | registers. Even 32-bit unsigned integers extend bit 31 into bits | 63 through 32. Consequently, conversion between unsigned and | signed 32-bit integers is a no-op, as is conversion from a signed | 32-bit integer to a signed 64-bit integer. While BPF, on the other hand, exposes sub-registers, and use zero-extension (similar to arm64/x86). This has led to some subtle bugs, where a BPF JITted program has not sign-extended the a0 register (return value in RISC-V land), passed the return value up the kernel, e.g.: | int from_bpf(void); | | long foo(void) | { | return from_bpf(); | } Here, a0 would be 0xffff_ffff, instead of the expected 0xffff_ffff_ffff_ffff. Internally, the RISC-V JIT uses a5 as a dedicated register for BPF return values. Keep a5 zero-extended, but explicitly sign-extend a0 (which is used outside BPF land). Now that a0 (RISC-V ABI) and a5 (BPF ABI) differs, a0 is only moved to a5 for non-BPF native calls (BPF_PSEUDO_CALL). Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G") Signed-off-by: Björn Töpel <bjorn@rivosinc.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://github.com/riscv/riscv-isa-manual/releases/download/riscv-isa-release-056b6ff-2023-10-02/unpriv-isa-asciidoc.pdf # [2] Link: https://github.com/riscv-non-isa/riscv-elf-psabi-doc/releases/download/draft-20230929-e5c800e661a53efe3c2678d71a306323b60eb13b/riscv-abi.pdf # [2] Link: https://lore.kernel.org/bpf/20231004120706.52848-2-bjorn@kernel.org
2023-10-09printk: flush consoles before checking progressJohn Ogness
Commit 9e70a5e109a4 ("printk: Add per-console suspended state") removed console lock usage during resume and replaced it with the clearly defined console_list_lock and srcu mechanisms. However, the console lock usage had an important side-effect of flushing the consoles. After its removal, consoles were no longer flushed before checking their progress. Add the console_lock/console_unlock dance to the beginning of __pr_flush() to actually flush the consoles before checking their progress. Also add comments to clarify this additional usage of the console lock. Note that console_unlock() does not guarantee flushing all messages since the commit dbdda842fe96f89 ("printk: Add console owner and waiter logic to load balance console writes"). Reported-by: Todd Brandt <todd.e.brandt@intel.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217955 Fixes: 9e70a5e109a4 ("printk: Add per-console suspended state") Co-developed-by: Petr Mladek <pmladek@suse.com> Signed-off-by: Petr Mladek <pmladek@suse.com> Signed-off-by: John Ogness <john.ogness@linutronix.de> Link: https://lore.kernel.org/r/20231006082151.6969-2-pmladek@suse.com
2023-10-09xen/events: replace evtchn_rwlock with RCUJuergen Gross
In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. Normally this is no problem, as the evtchn_rwlock is taken as a reader in both paths, but as soon as an event channel is being closed, the lock will be taken as a writer, which will cause read_lock() to block: CPU0 CPU1 CPU2 (IRQ handling) (__hvc_poll()) (closing event channel) read_lock(evtchn_rwlock) spin_lock(hvc_lock) write_lock(evtchn_rwlock) [blocks] spin_lock(hvc_lock) [blocks] read_lock(evtchn_rwlock) [blocks due to writer waiting, and not in_interrupt()] This issue can be avoided by replacing evtchn_rwlock with RCU in xen_free_irq(). Note that RCU is used only to delay freeing of the irq_info memory. There is no RCU based dereferencing or replacement of pointers involved. In order to avoid potential races between removing the irq_info reference and handling of interrupts, set the irq_info pointer to NULL only when freeing its memory. The IRQ itself must be freed at that time, too, as otherwise the same IRQ number could be allocated again before handling of the old instance would have been finished. This is XSA-441 / CVE-2023-34324. Fixes: 54c9de89895e ("xen/events: add a new "late EOI" evtchn framework") Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Julien Grall <jgrall@amazon.com> Signed-off-by: Juergen Gross <jgross@suse.com>
2023-10-09wifi: rtlwifi: use unsigned long for bt_coexist_8723 timestampDmitry Antipov
Since 'bt_inq_page_start_time' of 'struct bt_coexist_8723' is in jiffies, prefer 'unsigned long' over 'u32' to avoid possible truncation in 'rtl8723e_dm_bt_inq_page_monitor()' and adjust related code. Found with clang's -Wshorten-64-to-32, compile tested only. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004092418.73337-1-dmantipov@yandex.ru
2023-10-09wifi: rtw88: 8821c: tweak CCK TX filter setting for SRRC regulationZong-Zhe Yang
Since new criterion released by SRRC (State Radio Regulatory Commission, China) is stricter, we have adjusted TX power limit tables for it. But, due to RTL8821C HW characteristic, we still need to use specific parameter in CCK TX filter when set channel to avoid violations in some corner cases. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004085051.205683-6-pkshih@realtek.com
2023-10-09wifi: rtw88: regd: update regulatory map to R64-R42Zong-Zhe Yang
Sync Realtek Regulatory R42 and Realtek Channel Plan R64. Start to configure with Realtek regd CHILE, CN, UK, QATAR, UKRAINE. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004085051.205683-5-pkshih@realtek.com
2023-10-09wifi: rtw88: 8822c: update TX power limit to V70Zong-Zhe Yang
Update TX power limit to parameter package V70 * tweak values of CN for its new regulation * configure values for QATAR, UK Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004085051.205683-4-pkshih@realtek.com
2023-10-09wifi: rtw88: 8821c: update TX power limit to V67Zong-Zhe Yang
Update TX power limit to parameter package V67 * configure values for MEXICO, CN, QATAR, UK Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004085051.205683-3-pkshih@realtek.com
2023-10-09wifi: rtw88: regd: configure QATAR and UKZong-Zhe Yang
In newer Realtek parameter package, Realtek regd can configure QATAR and UK individually. So, driver extends the regd enum. Besides, driver configure alternative of them which will be referenced when parameter package of a chip doesn't consider QATAR and UK individually. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004085051.205683-2-pkshih@realtek.com
2023-10-09wifi: wfx: fix case where rates are out of orderFelipe Negrelli Wolter
When frames are sent over the air, the device always applies the data rates in descending order. The driver assumed Minstrel also provided rate in descending order. However, in some cases, Minstrel can a choose a fallback rate greater than the primary rate. In this case, the two rates was inverted, the device try highest rate first and we get many retries. Since the device always applies rates in descending order, the workaround is to drop the rate when it higher than its predecessor in the rate list. Thus [ 4, 5, 3 ] becomes [ 4, 3 ]. This patch has been tested in isolated room with a series of attenuators. Here are the Minstrel statistics with 80dBm of attenuation: Without the fix: best ____________rate__________ ____statistics___ _____last____ ______sum-of________ mode guard # rate [name idx airtime max_tp] [avg(tp) avg(prob)] [retry|suc|att] [#success | #attempts] HT20 LGI 1 S MCS0 0 1477 5.6 5.2 82.7 3 0 0 3 4 HT20 LGI 1 MCS1 1 738 10.6 0.0 0.0 0 0 0 0 1 HT20 LGI 1 D MCS2 2 492 14.9 13.5 81.5 5 0 0 5 9 HT20 LGI 1 C MCS3 3 369 18.8 17.6 84.3 5 0 0 76 96 HT20 LGI 1 A P MCS4 4 246 25.4 22.4 79.5 5 0 0 11268 14026 HT20 LGI 1 B S MCS5 5 185 30.7 19.7 57.7 5 8 9 3918 9793 HT20 LGI 1 MCS6 6 164 33.0 0.0 0.0 5 0 0 6 102 HT20 LGI 1 MCS7 7 148 35.1 0.0 0.0 0 0 0 0 44 With the fix: best ____________rate__________ ____statistics___ _____last____ ______sum-of________ mode guard # rate [name idx airtime max_tp] [avg(tp) avg(prob)] [retry|suc|att] [#success | #attempts] HT20 LGI 1 S MCS0 0 1477 5.6 1.8 28.6 1 0 0 1 5 HT20 LGI 1 DP MCS1 1 738 10.6 9.7 82.6 4 0 0 14 34 HT20 LGI 1 MCS2 2 492 14.9 9.2 55.4 5 0 0 52 77 HT20 LGI 1 B S MCS3 3 369 18.8 15.6 74.9 5 1 1 417 554 HT20 LGI 1 A MCS4 4 246 25.4 16.7 59.2 5 1 1 13812 17951 HT20 LGI 1 C S MCS5 5 185 30.7 14.0 41.0 5 1 5 57 640 HT20 LGI 1 MCS6 6 164 33.0 0.0 0.0 0 0 1 0 48 HT20 LGI 1 S MCS7 7 148 35.1 0.0 0.0 0 0 0 0 36 We can notice the device try now to send with lower rates (and high success rates). At the end, we measured 20-25% better throughput with this patch. Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames") Tested-by: Olivier Souloumiac <olivier.souloumiac@silabs.com> Tested-by: Alexandr Suslenko <suslenko.o@ajax.systems> Reported-by: Alexandr Suslenko <suslenko.o@ajax.systems> Co-developed-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Felipe Negrelli Wolter <felipe.negrelliwolter@silabs.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004123039.157112-1-jerome.pouiller@silabs.com
2023-10-09wifi: wfx: implement wfx_remain_on_channel()Jérôme Pouiller
With some conditions, the device is able to send/receive frames during scan operation. So, it is possible to use it implement the "remain on channel" feature. We just ask for a passive scan (without sending any probe request) on one channel. This architecture allows to leverage some interesting features: - if the device is AP, the device switches channel just after the next beacon and the beacons are stopped during the off-channel interval. - if the device is connected, it advertises it is asleep before to switch channel (so the AP should stop to try to send data) Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004172843.195332-9-jerome.pouiller@silabs.com
2023-10-09wifi: wfx: allow to send frames during ROCJérôme Pouiller
Until now, all the traffic was blocked during scan operation. However, scan operation is going to be used to implement Remain On Channel (ROC). In this case, special frames (marked with IEEE80211_TX_CTL_TX_OFFCHAN) must be sent during the operation. These frames need to be sent on the virtual interface #2. Until now, this interface was only used by the device for internal purpose. But since API 3.9, it can be used to send data during scan operation (we hijack the scan process to implement ROC). Thus, we need to change a bit the way we match the frames with the interface. Fortunately, the frames received during the scan are marked with the correct interface number. So there is no change to do on this part. Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004172843.195332-8-jerome.pouiller@silabs.com
2023-10-09wifi: wfx: scan_lock is global to the deviceJérôme Pouiller
Currently, one scan_lock is associated to each vif. However, concurrent scan on vifs is explicitly prohibited by the device. Currently, scan_lock is associated with a vif but it is always locked with conf_mutex (there is a case where conf_mutex is not associated to scan_lock but scan_lock is tested on all interfaces). So concurrent scan on vifs cannot happen. So, this patch relocate scan_lock to the device and simplify the code. Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004172843.195332-7-jerome.pouiller@silabs.com
2023-10-09wifi: wfx: simplify exclusion between scan and Rx filtersJérôme Pouiller
The device ignore the rx filters during the scan operation. wfx_configure_filter() acquires scan_lock to reflect this restriction. However, it is not really necessary since mac80211 don't try to configure Rx filters during scan. However, the things are changing. The scan operation is going to be used to implement remain-on-channel. In this case, wfx_configure_filter() can be called during the scan. Currently, this scenario generate a delay that end with a timeout in the upper layers. For the final user, some scenario of the EasyConnect specification end with a failure. So, avoid acquiring the scan_lock and just return. Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004172843.195332-6-jerome.pouiller@silabs.com
2023-10-09wifi: wfx: introduce hif_scan_uniq()Jérôme Pouiller
Like hof_scan(), hif_scan_uniq() invoke HIF_SCAN. However, it only allows to probe one channel and disable probe requests. It works very well to implement Remain-On-Channel. Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004172843.195332-5-jerome.pouiller@silabs.com
2023-10-09wifi: wfx: move wfx_skb_*() out of the header fileJérôme Pouiller
There is no real reasons to keep these function in the header file. Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004172843.195332-4-jerome.pouiller@silabs.com
2023-10-09wifi: wfx: relocate wfx_rate_mask_to_hw()Jérôme Pouiller
wfx_rate_mask_to_hw() is only used in hif_tx.c. So relocate it into hif_tx.c and mark it static. Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004172843.195332-3-jerome.pouiller@silabs.com
2023-10-09wifi: wfx: fix power_save setting when AP is stoppedJérôme Pouiller
The WF200 allow to start two network interfaces (one AP, one station) on two different channels. Since magic does not exist, it only works if the station interface enables power save. Thus, the driver detects this case and enforce power save as necessary. This patch fixes the case where the AP interface is stopped and it is no more necessary to enforce power saving on the station interface. Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004172843.195332-2-jerome.pouiller@silabs.com
2023-10-09Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo
ath.git patches for v6.7. Major changes: ath12k * read board data variant name from SMBIOS
2023-10-09Merge tag 'mt76-for-kvalo-2023-09-30' of https://github.com/nbd168/wirelessKalle Valo
mt76 patches for 6.7 * mt7603/mt7628 stability improvements * fixes * new driver for mt7925
2023-10-09ALSA: usb-audio: Fix microphone sound on Nexigo webcam.Christos Skevis
I own an external usb Webcam, model NexiGo N930AF, which had low mic volume and inconsistent sound quality. Video works as expected. (snip) [ +0.047857] usb 5-1: new high-speed USB device number 2 using xhci_hcd [ +0.003406] usb 5-1: New USB device found, idVendor=1bcf, idProduct=2283, bcdDevice=12.17 [ +0.000007] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ +0.000004] usb 5-1: Product: NexiGo N930AF FHD Webcam [ +0.000003] usb 5-1: Manufacturer: SHENZHEN AONI ELECTRONIC CO., LTD [ +0.000004] usb 5-1: SerialNumber: 20201217011 [ +0.003900] usb 5-1: Found UVC 1.00 device NexiGo N930AF FHD Webcam (1bcf:2283) [ +0.025726] usb 5-1: 3:1: cannot get usb sound sample rate freq at ep 0x86 [ +0.071482] usb 5-1: 3:2: cannot get usb sound sample rate freq at ep 0x86 [ +0.004679] usb 5-1: 3:3: cannot get usb sound sample rate freq at ep 0x86 [ +0.051607] usb 5-1: Warning! Unlikely big volume range (=4096), cval->res is probably wrong. [ +0.000005] usb 5-1: [7] FU [Mic Capture Volume] ch = 1, val = 0/4096/1 Set up quirk cval->res to 16 for 256 levels, Set GET_SAMPLE_RATE quirk flag to stop trying to get the sample rate. Confirmed that happened anyway later due to the backoff mechanism, after 3 failures All audio stream on device interfaces share the same values, apart from wMaxPacketSize and tSamFreq : (snip) Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 3 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 8 bDelay 1 frames wFormatTag 0x0001 PCM AudioStreaming Interface Descriptor: bLength 11 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 1 (FORMAT_TYPE_I) bNrChannels 1 bSubframeSize 2 bBitResolution 16 bSamFreqType 1 Discrete tSamFreq[ 0] 44100 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x86 EP 6 IN bmAttributes 5 Transfer Type Isochronous Synch Type Asynchronous Usage Type Data wMaxPacketSize 0x005c 1x 92 bytes bInterval 4 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 0 Undefined wLockDelay 0x0000 (snip) Based on the usb data about manufacturer, SPCA2281B3 is the most likely controller IC Manufacturer does not provide link for datasheet nor detailed specs. No way to confirm if the firmware supports any other way of getting the sample rate. Testing patch provides consistent good sound recording quality and volume range. (snip) [ +0.045764] usb 5-1: new high-speed USB device number 2 using xhci_hcd [ +0.106290] usb 5-1: New USB device found, idVendor=1bcf, idProduct=2283, bcdDevice=12.17 [ +0.000006] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ +0.000004] usb 5-1: Product: NexiGo N930AF FHD Webcam [ +0.000003] usb 5-1: Manufacturer: SHENZHEN AONI ELECTRONIC CO., LTD [ +0.000004] usb 5-1: SerialNumber: 20201217011 [ +0.043700] usb 5-1: set resolution quirk: cval->res = 16 [ +0.002585] usb 5-1: Found UVC 1.00 device NexiGo N930AF FHD Webcam (1bcf:2283) Signed-off-by: Christos Skevis <xristos.thes@gmail.com> Link: https://lore.kernel.org/r/20231006155330.399393-1-xristos.thes@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2023-10-08Linux 6.6-rc5v6.6-rc5Linus Torvalds
2023-10-08Merge tag '6.6-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbdLinus Torvalds
Pull smb server fixes from Steve French: "Six SMB3 server fixes for various races found by RO0T Lab of Huawei: - Fix oops when racing between oplock break ack and freeing file - Simultaneous request fixes for parallel logoffs, and for parallel lock requests - Fixes for tree disconnect race, session expire race, and close/open race" * tag '6.6-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix race condition between tree conn lookup and disconnect ksmbd: fix race condition from parallel smb2 lock requests ksmbd: fix race condition from parallel smb2 logoff requests ksmbd: fix uaf in smb20_oplock_break_ack ksmbd: fix race condition with fp ksmbd: fix race condition between session lookup and expire
2023-10-08Merge tag 'sched-urgent-2023-10-08' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc scheduler fixes from Ingo Molnar: - Two EEVDF fixes: one to fix sysctl_sched_base_slice propagation, and to fix an avg_vruntime() corner-case. - A cpufreq frequency scaling fix * tag 'sched-urgent-2023-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpufreq: schedutil: Update next_freq when cpufreq_limits change sched/eevdf: Fix avg_vruntime() sched/eevdf: Also update slice on placement
2023-10-08net: bcmgenet: Remove custom ndo_poll_controller()Florian Fainelli
The driver gained a .ndo_poll_controller() at a time where the TX cleaning process was always done from NAPI which makes this unnecessary. See commit ac3d9dd034e5 ("netpoll: make ndo_poll_controller() optional") for more background. Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-08ice: block default rule setting on LAG interfaceMichal Swiatkowski
When one of the LAG interfaces is in switchdev mode, setting default rule can't be done. The interface on which switchdev is running has ice_set_rx_mode() blocked to avoid default rule adding (and other rules). The other interfaces (without switchdev running but connected via bond with interface that runs switchdev) can't follow the same scheme, because rx filtering needs to be disabled when failover happens. Notification for bridge to set promisc mode seems like good place to do that. Fixes: bb52f42acef6 ("ice: Add driver support for firmware changes for LAG") Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Sujai Buvaneswaran <sujai.buvaneswaran@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-08Merge tag 'x86-urgent-2023-10-08' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 fixes from Ingo Molnar: - Fix SEV-SNP guest crashes that may happen on NMIs - Fix a potential SEV platform memory setup overflow * tag 'x86-urgent-2023-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Change npages to unsigned long in snp_accept_memory() x86/sev: Use the GHCB protocol when available for SNP CPUID requests
2023-10-08xen-netback: use default TX queue size for vifsRoger Pau Monne
Do not set netback interfaces (vifs) default TX queue size to the ring size. The TX queue size is not related to the ring size, and using the ring size (32) as the queue size can lead to packet drops. Note the TX side of the vif interface in the netback domain is the one receiving packets to be injected to the guest. Do not explicitly set the TX queue length to any value when creating the interface, and instead use the system default. Note that the queue length can also be adjusted at runtime. Fixes: f942dc2552b8 ('xen network backend driver') Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Reviewed-by: Ross Lagerwall <ross.lagerwall@citrix.com> Acked-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-08mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return typeDan Carpenter
The mlxsw_sp2_nve_vxlan_learning_set() function is supposed to return zero on success or negative error codes. So it needs to be type int instead of bool. Fixes: 4ee70efab68d ("mlxsw: spectrum_nve: Add support for VXLAN on Spectrum-2") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Petr Machata <petrm@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-07Merge tag 'parisc-for-6.6-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: - fix random faults in mmap'd memory on pre PA8800 processors - fix boot crash with nr_cpus=1 on kernel command line * tag 'parisc-for-6.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Restore __ldcw_align for PA-RISC 2.0 processors parisc: Fix crash with nr_cpus=1 option
2023-10-07ieee802154: ca8210: Fix a potential UAF in ca8210_probeDinghao Liu
If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca8210_probe() then calls ca8210_remove(), where priv->clk is freed again in ca8210_unregister_ext_clock(). In this case, a use-after-free may happen in the second time we call clk_unregister(). Fix this by removing the first clk_unregister(). Also, priv->clk could be an error code on failure of clk_register_fixed_rate(). Use IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock(). Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Message-ID: <20231007033049.22353-1-dinghao.liu@zju.edu.cn> Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
2023-10-07parisc: Restore __ldcw_align for PA-RISC 2.0 processorsJohn David Anglin
Back in 2005, Kyle McMartin removed the 16-byte alignment for ldcw semaphores on PA 2.0 machines (CONFIG_PA20). This broke spinlocks on pre PA8800 processors. The main symptom was random faults in mmap'd memory (e.g., gcc compilations, etc). Unfortunately, the errata for this ldcw change is lost. The issue is the 16-byte alignment required for ldcw semaphore instructions can only be reduced to natural alignment when the ldcw operation can be handled coherently in cache. Only PA8800 and PA8900 processors actually support doing the operation in cache. Aligning the spinlock dynamically adds two integer instructions to each spinlock. Tested on rp3440, c8000 and a500. Signed-off-by: John David Anglin <dave.anglin@bell.net> Link: https://lore.kernel.org/linux-parisc/6b332788-2227-127f-ba6d-55e99ecf4ed8@bell.net/T/#t Link: https://lore.kernel.org/linux-parisc/20050609050702.GB4641@roadwarrior.mcmartin.ca/ Cc: stable@vger.kernel.org Signed-off-by: Helge Deller <deller@gmx.de>
2023-10-07parisc: Fix crash with nr_cpus=1 optionHelge Deller
John David Anglin reported that giving "nr_cpus=1" on the command line causes a crash, while "maxcpus=1" works. Reported-by: John David Anglin <dave.anglin@bell.net> Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org # v5.18+
2023-10-07Merge tag '6.6-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds
Pull smb client fixes from Steve French: - protect cifs/smb3 socket connect from BPF address overwrite - fix case when directory leases disabled but wasting resources with unneeded thread on each mount * tag '6.6-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: do not start laundromat thread on nohandlecache smb: use kernel_connect() and kernel_bind()
2023-10-07Merge tag 'xfs-6.6-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linuxLinus Torvalds
Pull xfs fixes from Chandan Babu: - Prevent filesystem hang when executing fstrim operations on large and slow storage * tag 'xfs-6.6-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: abort fstrim if kernel is suspending xfs: reduce AGF hold times during fstrim operations xfs: move log discard work to xfs_discard.c
2023-10-07Merge tag 'for-6.6/dm-fixes-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix memory leak when freeing dm zoned target device - Update dm-devel mailing list address in MAINTAINERS * tag 'for-6.6/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: MAINTAINERS: update the dm-devel mailing list dm zoned: free dmz->ddev array in dmz_put_zoned_devices
2023-10-07Merge tag 'media/v6.6-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - two Kconfig build fixes under randconfig - pxa_camera: Fix an error handling path - mediatek: vcodec: Fix a NULL-access pointer - tegra-video: fix an infinite recursion regression * tag 'media/v6.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: mediatek: vcodec: Fix encoder access NULL pointer staging: media: tegra-video: fix infinite recursion regression media: pci: intel: ivsc: select V4L2_FWNODE media: ipu-bridge: Fix Kconfig dependencies media: pxa_camera: Fix an error handling path in pxa_camera_probe()
2023-10-07Merge tag 'devicetree-fixes-for-6.6-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix potential memory leak in of_changeset_action() - Fix some i.MX binding warnings - Fix typo in renesas,vin binding field-even-active property - Fix andestech,ax45mp-cache example unit-address - Add missing additionalProperties on RiscV CPU interrupt-controller node - Add missing unevaluatedProperties on media bindings - Fix brcm,iproc-pcie binding 'msi' child node schema - Fix MEMSIC MXC4005 compatible string * tag 'devicetree-fixes-for-6.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: trivial-devices: Fix MEMSIC MXC4005 compatible string dt-bindings: PCI: brcm,iproc-pcie: Fix 'msi' child node schema dt-bindings: PCI: brcm,iproc-pcie: Drop common pci-bus properties dt-bindings: PCI: brcm,iproc-pcie: Fix example indentation media: dt-bindings: Add missing unevaluatedProperties on child node schemas dt-bindings: bus: fsl,imx8qxp-pixel-link-msi-bus: Drop child 'reg' property media: dt-bindings: imx7-csi: Make power-domains not required for imx8mq dt-bindings: media: renesas,vin: Fix field-even-active spelling dt-bindings: cache: andestech,ax45mp-cache: Fix unit address in example of: overlay: Reorder struct fragment fields kerneldoc dt-bindings: display: fsl,imx6-hdmi: Change to 'unevaluatedProperties: false' dt-bindings: riscv: cpus: Add missing additionalProperties on interrupt-controller node of: dynamic: Fix potential memory leak in of_changeset_action()
2023-10-07Merge tag 'gpio-fixes-for-v6.6-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "Another round of driver one-liners from the GPIO subsystem: - disable pin control on MMP GPIOs in gpio-pxa - fix the GPIO number passed to one of the pinctrl callbacks in gpio-aspeed" * tag 'gpio-fixes-for-v6.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() gpio: pxa: disable pinctrl calls for MMP_GPIO
2023-10-07Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma fixes from Jason Gunthorpe: "This includes a fix for a significant security miss in checking the RDMA_NLDEV_CMD_SYS_SET operation. Summary: - UAF in SRP - Error unwind failure in siw connection management - Missing error checks - NULL/ERR_PTR confusion in erdma - Possible string truncation in CMA configfs and mlx4 - Data ordering issue in bnxt_re - Missing stats decrement on object destroy in bnxt_re - Mlx5 bugs in this merge window: * Incorrect access_flag in the new mkey cache * Missing unlock on error in flow steering * lockdep possible deadlock on new mkey cache destruction (Plus a fix for this too) - Don't leak kernel stack memory to userspace in the CM - Missing permission validation for RDMA_NLDEV_CMD_SYS_SET" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/core: Require admin capabilities to set system parameters RDMA/mlx5: Remove not-used cache disable flag RDMA/cma: Initialize ib_sa_multicast structure to 0 when join RDMA/mlx5: Fix mkey cache possible deadlock on cleanup RDMA/mlx5: Fix NULL string error RDMA/mlx5: Fix mutex unlocking on error flow for steering anchor creation RDMA/mlx5: Fix assigning access flags to cache mkeys IB/mlx4: Fix the size of a buffer in add_port_entries() RDMA/bnxt_re: Decrement resource stats correctly RDMA/bnxt_re: Fix the handling of control path response data RDMA/cma: Fix truncation compilation warning in make_cma_ports RDMA/erdma: Fix NULL pointer access in regmr_cmd RDMA/erdma: Fix error code in erdma_create_scatter_mtt() RDMA/uverbs: Fix typo of sizeof argument RDMA/cxgb4: Check skb value for failure to allocate RDMA/siw: Fix connection failure handling RDMA/srp: Do not call scsi_done() from srp_abort()
2023-10-07MAINTAINERS: Remove myself from the general IRQ subsystem maintenanceMarc Zyngier
It is pretty obvious that I haven't done much on the IRQ side for a while, and it is unlikely that I'll have more bandwidth for it any time soon. People keep sending me patches that I end-up reviewing in a cursory manner, which isn't great for anyone. So in everyone's interest, I'm removing myself from the list of maintainers and leave the irqchip and irqdomain subsystems in Thomas' capable hands. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20231002141302.3409485-3-maz@kernel.org
generated by cgit (git 2.34.1) at 2025-07-19 20:31:36 +0000