Age | Commit message (Collapse) | Author |
|
Signed-off-by: Marc Yang <yangyang@marvell.com>
Update SD8897 and SD8797 WLAN driver
Add SD8897 and SD8797 BT drivers
Bug 1256420
Bug 1279040
Change-Id: I3338479450b1b6716a1e3b899e33de92850c9e85
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Reviewed-on: http://git-master/r/235723
Reviewed-by: Mohan Thadikamalla <mohant@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Add SUSPEND/RESUME flags to Makefiles of SD8897 and SD8797 WLAN drivers
Signed-off-by: Marc Yang <yangyang@marvell.com>
Bug 1279040
Bug 1256420
Change-Id: I2d0518c38b6003a96d3c7447a8a64210ffc319dc
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Reviewed-on: http://git-master/r/235722
Reviewed-by: Mohan Thadikamalla <mohant@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Signed-off-by: Marc Yang <yangyang@marvell.com>
Bug 1279040
Change-Id: Ifee06a06feb304b039f62f2a3730dc4f04f1e7b5
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Reviewed-on: http://git-master/r/235721
Reviewed-by: Mohan Thadikamalla <mohant@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Signed-off-by: Marc Yang <yangyang@marvell.com>
Bug 1256420
Change-Id: I43f342a7fe0bc0a8a1e28929a50170d9efe0a499
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Reviewed-on: http://git-master/r/231454
Reviewed-by: Riham Haidar <rhaidar@nvidia.com>
Tested-by: Riham Haidar <rhaidar@nvidia.com>
|
|
Add P2P_DISCOVERY_WAR in bcm43241/Makefile which
is used to compile driver for bcm43241
Bug 1282833
Bug 1282700
Change-Id: Ia975e4765038feeedd53580eb4275c5e34c50d38
Signed-off-by: bibhayr <bibhayr@nvidia.com>
Reviewed-on: http://git-master/r/231137
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bitan Biswas <bbiswas@nvidia.com>
|
|
- Fixed Miracast discovery issue after P2P disconnection.
- Fixed P2P action frame issue when multiple P2P IEs are in the probe response.
- BW allocation for VSDB
- Support offset for RSSI report
Bug 1282833
Bug 1282700
Change-Id: Ia45f496711f3775858de38e1c7e3c762d2f58828
Signed-off-by: bibhayr <bibhayr@nvidia.com>
Reviewed-on: http://git-master/r/228683
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
kernel_thread is deprecated and sometimes it fails.
Bug 1242544
Change-Id: I1472cfdbcfa85684380463e5c5ea268a0b2cbdbc
Signed-off-by: bibhayr <bibhayr@nvidia.com>
Reviewed-on: http://git-master/r/227039
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
increase delay before reading SBSDIO_FUNC1_SLEEPCSR
to wake sdio bus
Bug 1274359
Change-Id: I54c1bf199e2fe309d55ae52f0156c497b0c90144
Signed-off-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-on: http://git-master/r/226260
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
When remove this module, there will call kthread_stop() to stop the
kernel thread. But sometimes, the thread will be exited by itself befor
calling kthread_stop, this will cause the crash.
I add a completion to fix this issue. If the kernel thread is exited by
itself, there will not call the ktherad_stop.
bug 1174020
bug 1179865
Change-Id: Iaea97cd57d63b0b64790017943860252b4080d75
Signed-off-by: Wei Ni <wni@nvidia.com>
Reviewed-on: http://git-master/r/165659
(cherry picked from commit c54aba042c92de7faaec7243c40ebb44b5117b00)
Reviewed-on: http://git-master/r/223009
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mursalin Akon <makon@nvidia.com>
Tested-by: Mursalin Akon <makon@nvidia.com>
Reviewed-by: Allen Martin <amartin@nvidia.com>
|
|
It seems BRCM chip is slow in processing commands when
there is huge command load from the host. In this
scenario we are getting more command timeouts.
Which is causing to generate a chip hang event.
So increase Max command timeout count to avoid Chips
hang event generation here.
Bug 1259834
Change-Id: I3777cb5b0fd5dcc806ccb2ddde1fafd00095d8a6
Signed-off-by: Mohan T <mohant@nvidia.com>
Reviewed-on: http://git-master/r/223819
GVS: Gerrit_Virtual_Submit
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
The priority level of Warning message F1 Signature is
reduced from DHD_ERROR to DHD_INFO.
Bug 1249615
Change-Id: I0e976c0741bc3794268f31b0e874465c94173c6e
Signed-off-by: Jeetesh Burman <jburman@nvidia.com>
Reviewed-on: http://git-master/r/221939
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Add 300 msec delay during power-off to complete
leftover commands.
Bug 1267427
Change-Id: Id5a8a514bc64cd4d6717c71afb35e3dc44b14b62
Signed-off-by: Nitin Bindal <nbindal@nvidia.com>
Reviewed-on: http://git-master/r/218243
(cherry picked from commit 26fdc55fc2a213002a491866f266d355b047386a)
Reviewed-on: http://git-master/r/219663
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Bug 1258426
Bug 1262099
Change-Id: I48d6139ae7d36970233501ca284952be19be8039
Signed-off-by: bibhayr <bibhayr@nvidia.com>
Reviewed-on: http://git-master/r/217660
(cherry picked from commit 0ab241eaa4a92e96972bdcd4f271c48422d28434)
Reviewed-on: http://git-master/r/222060
Reviewed-by: Nitin Bindal <nbindal@nvidia.com>
Tested-by: Nitin Bindal <nbindal@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
According to Realtek, the firmware provides
power optimizations. The driver works without
the firmware. Plus, there are scenarios where
the firmware is not available, which makes the
driver wait at request_firmware call (i.e.,
60 sec wait).
Bug 1236060
Change-Id: Ifad95b9eb9e161c77171df3e65351aff80e4a4ad
Signed-off-by: Mursalin Akon <makon@nvidia.com>
Reviewed-on: http://git-master/r/218609
Reviewed-by: Eric Brower <ebrower@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Allen Martin <amartin@nvidia.com>
|
|
Different broadcom chip need different configuration of bcmdhd
driver. Add seperate makefile for bcm43341 and bcm43241 with
chip specific configuration
Sym-link bcmdhd driver source for bcm43341 and bcm43241
Bug 1247033
Change-Id: If06076f8769d0dbd4ed74bef7fa108c34cd9c4f8
Signed-off-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-on: http://git-master/r/203280
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Bug 1247033
Change-Id: Ie2f90bdf5bc582c04d2062d60a368e00b8e68b00
Signed-off-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-on: http://git-master/r/211656
(cherry picked from commit fa8e327ced8ab144fa4e6a4ff969a5a6e518448e)
Reviewed-on: http://git-master/r/211594
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
kernel_thread is deprecated and sometimes it fails.
Bug 1242544
Change-Id: I3751c12aad2661998dcbc1ae1e305f5f2ecf355e
Signed-off-by: Nitin Bindal <nbindal@nvidia.com>
Reviewed-on: http://git-master/r/206996
(cherry picked from commit 490584489acde7046744c5863df30473aaa20336)
Reviewed-on: http://git-master/r/206706
Reviewed-by: Ajay Nandakumar M <anandakumarm@nvidia.com>
Reviewed-by: Om Prakash Singh <omp@nvidia.com>
Tested-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Bug 1258426
Bug 1262099
Change-Id: I0a2fd3a1a7306e8c762a96c47582a4511cd5249a
Signed-off-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-on: http://git-master/r/214422
(cherry picked from commit b14a0b33e2ccd6b90dd1d47c6597dae4b5cef929)
Reviewed-on: http://git-master/r/217248
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Bug 1258426
Change-Id: I288a0e1dd59c0fb1a8d4d96b90dee8003a1f34a9
Signed-off-by: Kyeong Baek Kim <kyeongk@nvidia.com>
Reviewed-on: http://git-master/r/213363
(cherry picked from commit c40024936ef8c85da1ae75bf5b0e53ac631cdfce)
Reviewed-on: http://git-master/r/217247
Reviewed-by: Om Prakash Singh <omp@nvidia.com>
Tested-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
When supplicant disconnect P2P link, it calls
wl_cfg80211_disconnect and removes p2p interface(netdevice).
There can be race condition since supplicant remove interface
without waiting for disconnected event. In most cases, disconnection
event is processed before deleting interface. But if interface
is removed before disconnection event is handled, it make crash.
wait_for_completion_timeout() and complete() api takes care of above,
but there is a problem, since signal by complete() is accumulative.
Sometimes, previous disconnect event calls complete() and it
unblock next wait_for_completion_timeout() right away.
Bug 1237588
Change-Id: I2937a55b2aced668e0c3f5c2285aad0c7a7cc0bf
Signed-off-by: Narayan Reddy <narayanr@nvidia.com>
Reviewed-on: http://git-master/r/202882
(cherry picked from commit ac95237f65ed5bead2009f476c78f83146f4b9e2)
Reviewed-on: http://git-master/r/217246
Reviewed-by: Om Prakash Singh <omp@nvidia.com>
Tested-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Bug 1243631
Change-Id: I915826047b2e20f0ad0a7d75df295c6cbf6e5b0a
|
|
Check if bcmdhd driver is registered to edp manager
before calling edp state update request.
Bug 1160685
Change-Id: Ic7f4526275f026419ec460940c33c8a3118c7cff
Signed-off-by: Harshavardhan Nalajala <hnalajala@nvidia.com>
Reviewed-on: http://git-master/r/204643
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Bug 1239409
Change-Id: I78e07aaf9665bd19838d1e46ee7b343dc9d347bf
Signed-off-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-on: http://git-master/r/204600
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
Power off the card when wifi is off and power up only when wifi
is turned on
Bug 1011349
Change-Id: I018c3757280c81c9077dd07949422bf572fc3a0d
Signed-off-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-on: http://git-master/r/200667
Reviewed-by: Bitan Biswas <bbiswas@nvidia.com>
|
|
commit 4a8f199508d79ff8a7d1e22f47b912baaf225336 upstream.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: CAI Qian <caiqian@redhat.com>
Reviewed-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 3e55f8b306cf305832a4ac78aa82e1b40e818ece ]
If the credit timer is left armed after calling
xen_netbk_remove_xenvif(), then it may fire and attempt to schedule
the vif which will then oops as vif->netbk == NULL.
This may happen both in the fatal error path and during normal
disconnection from the front end.
The sequencing during shutdown is critical to ensure that: a)
vif->netbk doesn't become unexpectedly NULL; and b) the net device/vif
is not freed.
1. Mark as unschedulable (netif_carrier_off()).
2. Synchronously cancel the timer.
3. Remove the vif from the schedule list.
4. Remove it from it netback thread group.
5. Wait for vif->refcnt to become 0.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Reported-by: Christopher S. Aker <caker@theshore.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 35876b5ffc154c357476b2c3bdab10feaf4bd8f0 ]
netbk_count_requests() could detect an error, call
netbk_fatal_tx_error() but return 0. The vif may then be used
afterwards (e.g., in a call to netbk_tx_error().
Since netbk_fatal_tx_error() could set vif->refcnt to 1, the vif may
be freed immediately after the call to netbk_fatal_tx_error() (e.g.,
if the vif is also removed).
Netback thread Xenwatch thread
-------------------------------------------
netbk_fatal_tx_err() netback_remove()
xenvif_disconnect()
...
free_netdev()
netbk_tx_err() Oops!
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reported-by: Christopher S. Aker <caker@theshore.net>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
commit 008e33f733ca51acb2dd9d88ea878693b04d1d2a upstream.
Corrected USB ID for T-Com Sinus 154 data II. ISL3887-based. The
device was tested in managed mode with no security, WEP 128
bit and WPA-PSK (TKIP) with firmware 2.13.1.0.lm87.arm (md5sum:
7d676323ac60d6e1a3b6d61e8c528248). It works.
Signed-off-by: Tomasz Guszkowski <tsg@o2.pl>
Acked-By: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
separately
commit bc6b89237acb3dee6af6e64e51a18255fef89cc2 upstream.
rtlwifi allocates both setup_packet and data buffer of control message urb,
using shared kmalloc in _usbctrl_vendorreq_async_write. Structure used for
allocating is:
struct {
u8 data[254];
struct usb_ctrlrequest dr;
};
Because 'struct usb_ctrlrequest' is __packed, setup packet is unaligned and
DMA mapping of both 'data' and 'dr' confuses ARM/sunxi, leading to memory
corruptions and freezes.
Patch changes setup packet to be allocated separately.
[v2]:
- Use WARN_ON_ONCE instead of WARN_ON
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
commit 8708aac79e4572ba673d7a21e94ddca9f3abb7fc upstream.
A new model of the RTL8188CUS has appeared.
Reported-and-tested-by: Thomas Rosenkrantz <tom.rosary@googlemail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
commit ccae0e50c16a7f7adb029c169147400d1ce9f703 upstream.
Bastian Bittorf reported that some of the silent freezes on a Linksys WRT54G
were due to overflow of the RX DMA ring buffer, which was created with 64
slots. That finding reminded me that I was seeing similar crashed on a netbook,
which also has a relatively slow processor. After increasing the number of
slots to 128, runs on the netbook that previously failed now worked; however,
I found that 109 slots had been used in one test. For that reason, the number
of slots is being increased to 256.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Bastian Bittorf <bittorf@bluebottle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
BCMDHD changes for Wifi EDP support
Bug 1160685
Change-Id: I404dce894ccdd542598641dbbf9e99bfb33ba123
Signed-off-by: Harshavardhan Nalajala <hnalajala@nvidia.com>
Reviewed-on: http://git-master/r/202465
Reviewed-by: Riham Haidar <rhaidar@nvidia.com>
Tested-by: Riham Haidar <rhaidar@nvidia.com>
|
|
Bug 1176649
Change-Id: I6222f28e1a323333a324745a764b8384795ce5d1
Signed-off-by: Steve Lin <stlin@nvidia.com>
Reviewed-on: http://git-master/r/197220
Reviewed-by: Riham Haidar <rhaidar@nvidia.com>
Tested-by: Riham Haidar <rhaidar@nvidia.com>
|
|
switch to appropriate nvram and firmware file based on cis data
Bug 1192564
Change-Id: Icbab7e254be3dd8354843066cd2d30018f466af9
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Reviewed-on: http://git-master/r/201047
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
|
|
TCP network stack uses skb->truesize as hint to grow TCP window size.
However, the NCM driver uses skb_clone to push the ethernet packet to
the network stack. The skb->truesize is actually the memory allocated
for the whole transfer block, not the true packet size with overhead.
tcp_grow_window function doesn't handle this case properly so the
receiver window will not grow. This patch is to update the skb->truesize
in the cdc_ncm_rx_fixup function so the TCP stack can use it to grow the
window size as expected.
Bug 1207244
Bug 1235981
Change-Id: I7c48eb65e7f991d7eb0f2ef14c515134b9180ea4
Signed-off-by: Steve Lin <stlin@nvidia.com>
Reviewed-on: http://git-master/r/200895
Reviewed-by: David Norman <dnorman@nvidia.com>
Reviewed-by: Rick Song <ricks@nvidia.com>
|
|
When association failed, supplicant always sends re-association
rather than assoc. With this pattern, there is a potential
problem from wpa-supplicant with respect to WPS association
after provisioning. When supplicant requests disassociate, the
state of supplicant is changed to DISCONNECTED by disconnect
event from the cfg80211(driver) layer in normal case. However,
in this case (post provisioning assoc), supplicant requests
disassociate and send locally generated event to
itself and changes state to DISCONNECTED. Therefore, sometimes
the association request is coming to cfg80211/driver while
driver is processing disassociating (before link down event
come from the f/w). This conflict between disassociation processing
and association request make re-association request in the f/w and
resulted in association failure.
To avoid this conflict, supplicant should wait for the
disconnected event from the driver. Thus modified driver
to hold association request until disassociation is finished.
In most case, link event comes from f/w within 50 ms.
Bug 1232700
Change-Id: I7ac9b6edc3675dabc04131d562bb839187e73ad3
Signed-off-by: Narayan Reddy <narayanr@nvidia.com>
Reviewed-on: http://git-master/r/201116
Reviewed-by: Kyeong Kim <kyeongk@nvidia.com>
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Laxman Dewangan <ldewangan@nvidia.com>
|
|
commit ae1c07a6b7ced6c0c94c99e3b53f4e7856fa8bff upstream.
For some reason the reading of the RQDPC register was being artificially
limited to 4K. Instead of limiting the value we should read the value and
add the full amount. Otherwise this can lead to a misleading number of
dropped packets when the actual value is in fact much higher.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Cc: Vinson Lee <vlee@twitter.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
commit 93040ae5cc8dcc893eca4a4366dc8415af278edf upstream.
Fixed spelling error in a comment as pointed out by DaveM.
Also refactored existing code a bit to provide placeholders for another ASIC
Bug workaround that will be checked-in soon after this.
Signed-off-by: Somnath Kotur <somnath.kotur@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Jacek Luczak <difrost.kernel@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit daf3ec688e057f6060fb9bb0819feac7a8bbf45c ]
TG3_PHY_AUXCTL_SMDSP_ENABLE/DISABLE macros do a blind write to the phy
auxiliary control register and overwrite the EXT_PKT_LEN (bit 14) resulting
in intermittent crc errors on jumbo frames with some link partners. Change
the code to do a read/modify/write.
Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 9c13cb8bb477a83b9a3c9e5a5478a4e21294a760 ]
When netconsole is enabled, logging messages generated during tg3_open
can result in a null pointer dereference for the uninitialized tg3
status block. Use the irq_sync flag to disable polling in the early
stages. irq_sync is cleared when the driver is enabling interrupts after
all initialization is completed.
Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit b9149729ebdcfce63f853aa54a404c6a8f6ebbf3 ]
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 4cc7c1cb7b11b6f3515bd9075527576a1eecc4aa ]
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 7d5145d8eb2b9791533ffe4dc003b129b9696c48 ]
Signed-off-by: Matthew Daley <mattjd@gmail.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 48856286b64e4b66ec62b94e504d0b29c1ade664 ]
A buggy or malicious frontend should not be able to confuse netback.
If we spot anything which is not as it should be then shutdown the
device and don't try to continue with the ring in a potentially
hostile state. Well behaved and non-hostile frontends will not be
penalised.
As well as making the existing checks for such errors fatal also add a
new check that ensures that there isn't an insane number of requests
on the ring (i.e. more than would fit in the ring). If the ring
contains garbage then previously is was possible to loop over this
insane number, getting an error each time and therefore not generating
any more pending requests and therefore not exiting the loop in
xen_netbk_tx_build_gops for an externded period.
Also turn various netdev_dbg calls which no precipitate a fatal error
into netdev_err, they are rate limited because the device is shutdown
afterwards.
This fixes at least one known DoS/softlockup of the backend domain.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 559bcac35facfed49ab4f408e162971612dcfdf3 ]
1) rhine_tx() should use dev_kfree_skb() not dev_kfree_skb_irq()
2) rhine_slow_event_task's NAPI triggering logic is racey, it
should just hit the interrupt mask register. This is the
same as commit 7dbb491878a2c51d372a8890fa45a8ff80358af1
("r8169: avoid NAPI scheduling delay.") made to fix the same
problem in the r8169 driver. From Francois Romieu.
Reported-by: Jamie Gloudon <jamie.gloudon@gmail.com>
Tested-by: Jamie Gloudon <jamie.gloudon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 794ed393b707f01858f5ebe2ae5eabaf89d00022 ]
Ben Greear reported crashes in ip_rcv_finish() on a stress
test involving many macvlans.
We tracked the bug to a dst use after free. ip_rcv_finish()
was calling dst->input() and got garbage for dst->input value.
It appears the bug is in loopback driver, lacking
a skb_dst_force() before calling netif_rx().
As a result, a non refcounted dst, normally protected by a
RCU read_lock section, was escaping this section and could
be freed before the packet being processed.
[<ffffffff813a3c4d>] loopback_xmit+0x64/0x83
[<ffffffff81477364>] dev_hard_start_xmit+0x26c/0x35e
[<ffffffff8147771a>] dev_queue_xmit+0x2c4/0x37c
[<ffffffff81477456>] ? dev_hard_start_xmit+0x35e/0x35e
[<ffffffff8148cfa6>] ? eth_header+0x28/0xb6
[<ffffffff81480f09>] neigh_resolve_output+0x176/0x1a7
[<ffffffff814ad835>] ip_finish_output2+0x297/0x30d
[<ffffffff814ad6d5>] ? ip_finish_output2+0x137/0x30d
[<ffffffff814ad90e>] ip_finish_output+0x63/0x68
[<ffffffff814ae412>] ip_output+0x61/0x67
[<ffffffff814ab904>] dst_output+0x17/0x1b
[<ffffffff814adb6d>] ip_local_out+0x1e/0x23
[<ffffffff814ae1c4>] ip_queue_xmit+0x315/0x353
[<ffffffff814adeaf>] ? ip_send_unicast_reply+0x2cc/0x2cc
[<ffffffff814c018f>] tcp_transmit_skb+0x7ca/0x80b
[<ffffffff814c3571>] tcp_connect+0x53c/0x587
[<ffffffff810c2f0c>] ? getnstimeofday+0x44/0x7d
[<ffffffff810c2f56>] ? ktime_get_real+0x11/0x3e
[<ffffffff814c6f9b>] tcp_v4_connect+0x3c2/0x431
[<ffffffff814d6913>] __inet_stream_connect+0x84/0x287
[<ffffffff814d6b38>] ? inet_stream_connect+0x22/0x49
[<ffffffff8108d695>] ? _local_bh_enable_ip+0x84/0x9f
[<ffffffff8108d6c8>] ? local_bh_enable+0xd/0x11
[<ffffffff8146763c>] ? lock_sock_nested+0x6e/0x79
[<ffffffff814d6b38>] ? inet_stream_connect+0x22/0x49
[<ffffffff814d6b49>] inet_stream_connect+0x33/0x49
[<ffffffff814632c6>] sys_connect+0x75/0x98
This bug was introduced in linux-2.6.35, in commit
7fee226ad2397b (net: add a noref bit on skb dst)
skb_dst_force() is enforced in dev_queue_xmit() for devices having a
qdisc.
Reported-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 5d0feaff230c0abfe4a112e6f09f096ed99e0b2d ]
This was introduced in commit 6dccd16 "r8169: merge with version
6.001.00 of Realtek's r8169 driver". I did not find the version
6.001.00 online, but in 6.002.00 or any later r8169 from Realtek
this hunk is no longer present.
Also commit 05af214 "r8169: fix Ethernet Hangup for RTL8110SC
rev d" claims to have fixed this issue otherwise.
The magic compare mask of 0xfffe000 is dubious as it masks
parts of the Reserved part, and parts of the VLAN tag. But this
does not make much sense as the VLAN tag parts are perfectly
valid there. In matter of fact this seems to be triggered with
any VLAN tagged packet as RxVlanTag bit is matched. I would
suspect 0xfffe0000 was intended to test reserved part only.
Finally, this hunk is evil as it can cause more packets to be
handled than what was NAPI quota causing net/core/dev.c:
net_rx_action(): WARN_ON_ONCE(work > weight) to trigger, and
mess up the NAPI state causing device to hang.
As result, any system using VLANs and having high receive
traffic (so that NAPI poll budget limits rtl_rx) would result
in device hang.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
Acked-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit a05948f296ce103989b28a2606e47d2e287c3c89 ]
Christoph Paasch found netxen could trigger a BUG in its dismantle
phase, in netxen_release_tx_buffer(), using full size TSO packets.
cmd_buf->frag_count includes the skb->data part, so the loop must
start at index 1 instead of 0, or else we can make an out
of bound access to cmd_buff->frag_array[MAX_SKB_FRAGS + 2]
Christoph provided the fixes in netxen_map_tx_skb() function.
In case of a dma mapping error, its better to clear the dma fields
so that we don't try to unmap them again in netxen_release_tx_buffer()
Reported-by: Christoph Paasch <christoph.paasch@uclouvain.be>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Christoph Paasch <christoph.paasch@uclouvain.be>
Cc: Sony Chacko <sony.chacko@qlogic.com>
Cc: Rajesh Borundia <rajesh.borundia@qlogic.com>
Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit ca4c7b35f75492de7fbf5ee95be07481c348caee ]
The lines
if (mlx4_is_mfunc(dev)) {
nreq = 2;
} else {
which hard code the number of requested msi-x vectors under multi-function
mode to two can be removed completely, since the firmware sets num_eqs and
reserved_eqs appropriately Thus, the code line:
nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs, nreq);
is by itself sufficient and correct for all cases. Currently, for mfunc
mode num_eqs = 32 and reserved_eqs = 28, hence four vectors will be enabled.
This triples (one vector is used for the async events and commands EQ) the
horse power provided for processing of incoming packets on netdev RSS scheme,
IO initiators/targets commands processing flows, etc.
Reviewed-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
[ Upstream commit 213815a1e6ae70b9648483b110bc5081795f99e8 ]
Commit 5b4c4d36860e "mlx4_en: Allow communication between functions on
same host" introduced a regression under which a bridge acting as vSwitch
whose uplink is an mlx4 Ethernet device become non-operative in native
(non sriov) mode. This happens since broadcast ARP requests sent by VMs
were loopback-ed by the HW and hence the bridge learned VM source MACs
on both the VM and the uplink ports.
The fix is to place the DMAC in the send WQE only under SRIOV/eSwitch
configuration or when the device is in selftest.
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Yan Burman <yanb@mellanox.com>
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|