Commit graph

937235 commits

Author SHA1 Message Date
Linus Torvalds
6ba1b005ff asm-generic: bugfix for v5.8
This is a single bugfix for a regression introduced through a
 typo in the v5.8 merge window, leading to incorrect data
 returned from inl() on some architectures.
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAl8gGBEACgkQmmx57+YA
 GNldaQ//efCqrYB0DYmj0NVuSWnO5ol84agWMjGM6lfBPRetxpVfprM1u8Auwe8Q
 GAGsEFn3thMj4DTIWaBGc4iCbXikjWTKQUzzsz1U05+JVf+lXVwmWTWpfZ1wAdnl
 UNjeP9m0pvCgbCmfmPo3vjwc6UYlHDcBIXxzagpLEjPqtvQL/SpEgT3GJGoThrqR
 bH/l2vJ+ajsw/cIaVd6xwLdasaPBqvl1gelUnkeMvPJddb9K7DKeNbU0N+yz4m5b
 9+rb5o3rXdIIEfS1njqCZoHEs7vEoRvGrSggEDXJyHjD/wd2+1C6sEyF7vOJBrmC
 gVcFuu3vNLtrHPUo+vI16ZWcS6rpxRJ+5QC7/Lyj3aC8QtbYoGUoHzNLPPYBraUH
 tqB/gBqOrh8FDcRs1WqrvXaflhVxWnU9119c98faLI6W1ZthU2/9XH1ZUfF3LjEp
 7O3kqrgbzpZp/QrbvPI4hG3xCMh+1whkh4aTw7cCVxu1io/eGjG2bjA2Yutnib3c
 0EdBZ58W4bjxO4Os3UB9zlrg4B1wGDZWwu4F5vcJfnU8ghHpcOlSmwutzGVuFQLZ
 tJlZLJysFilVxdnkiAIuJzh7uj8AjGWeHvUwwn+X/UQ19p5FwhqHDDIjOJtJuak6
 +idjl37eRPzY6/IDoUUZwURpUxFA57nx8AvvBGmjgZ4vswsfF6c=
 =XnT4
 -----END PGP SIGNATURE-----

Merge tag 'asm-generic-fixes-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic into master

Pull asm-generic bugfix from Arnd Bergmann:
 "A single bugfix for a regression introduced through a typo in the v5.8
  merge window, leading to incorrect data returned from inl() on some
  architectures"

* tag 'asm-generic-fixes-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  io: Fix return type of _inb and _inl
2020-07-28 11:55:53 -07:00
Linus Torvalds
fb896c9107 ARM: SoC DT fixes for v5.8
These are the latest device tree fixes for Arm SoCs:
 
   - TI Keystone2 ethernet regressed after a driver change broke with
     incorrect phy-mode in a board's DT source.
 
   - A similar fix is needed for two i.MX boards that were missed in
     an earlier bugfix.
 
   - DT change for Armada 38x allowing to add the register needed to fix
     NETA lockup when repeatedly switching speed.
 
   - One fix on imx6qdl-icore pin muxing to get USB OTG_ID and SD card
     detect work correctly.
 
   - Two fixes for the Allwinner SoCs, one to relax the CMA allocation
     ranges that were failing on older SoCs and one to fix Cedrus on the H6.
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAl8gF10ACgkQmmx57+YA
 GNkBGA/+OXUz9WyQrF32/f/Y2PmtDQV9v+0lCnqH3cdbuqYlVCAclAPxoZFy0qy+
 cfK+FIAfzKdn8tsDQ3yReLujZgmlm40Tn2m7xS8ZBiwNX6g+ucGmrGyivySYXrFt
 39cXHUYG8P8AjpZHaT7MHHGMNIczR4ESp4xSIQhvY4WjE/klkw5E3INqU3Z9M5zm
 Ch2BB9UhfbJLSKZtKNPUomqE6wF6VJvyrr3bMPXWYkkZbFugvXFQFNYbrmkxJMVL
 BQucXXli/mI8ZaWUwwzZvtLJXuARTtxFuguX/1OLOXHyhY7vBQx3RV96MfmQuFiT
 GGgJSVLxA8gO/KlM9IEaAMbpXn3qWRtmDGAqfcRJo/ZQX3QwoaC6Pr5aiU5eGlpk
 3jy3X1W+kmYgQem3trDVubIiemTaExHEHs0NN8DUE0zx2cg8AfSdZUEYhQVKXYic
 9ijRSVoUg9SYhVXMFp+18thlzMTvm9tO+LNVDmBaucjLTbSGsdedNp+qRCo5OssH
 p2704xANlKWBXmAgdZ/n+tlEEOeEqMnKMQHWoeDjKVdhoasswbr7KsIqDVrMjHF/
 8M4HrXaYbNT+GL4giFmkuScrBZkHilO5aBJT4RqYli2O3XzThLhLvILf7ar9dwUR
 SGpHExsZP+EpfdZYQJkbHrm11SxQRxKbzHAUXg/QIEUld0UsbFM=
 =qXc9
 -----END PGP SIGNATURE-----

Merge tag 'arm-fixes-5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc into master

Pull ARM SoC DT fixes from Arnd Bergmann:
 "These are the latest device tree fixes for Arm SoCs:

   - TI Keystone2 ethernet regressed after a driver change broke with
     incorrect phy-mode in a board's DT source.

   - A similar fix is needed for two i.MX boards that were missed in an
     earlier bugfix.

   - DT change for Armada 38x allowing to add the register needed to fix
     NETA lockup when repeatedly switching speed.

   - One fix on imx6qdl-icore pin muxing to get USB OTG_ID and SD card
     detect work correctly.

   - Two fixes for the Allwinner SoCs, one to relax the CMA allocation
     ranges that were failing on older SoCs and one to fix Cedrus on the
     H6"

* tag 'arm-fixes-5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  ARM: dts: keystone-k2g-evm: fix rgmii phy-mode for ksz9031 phy
  ARM: dts: armada-38x: fix NETA lockup when repeatedly switching speeds
  ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect
  ARM: dts: imx6sx-sabreauto: Fix the phy-mode on fec2
  ARM: dts: imx6sx-sdb: Fix the phy-mode on fec2
  arm64: dts: allwinner: h6: Fix Cedrus IOMMU usage
  ARM: dts sunxi: Relax a bit the CMA pool allocation range
2020-07-28 11:44:44 -07:00
Venkata Lakshmi Narayana Gubba
58789a1990 Bluetooth: hci_qca: Stop collecting memdump again for command timeout during SSR
Setting memdump state to idle prior to setting of callback function
pointer for command timeout to NULL,causing the issue.Now moved the
initialisation of memdump state to qca_setup().

Fixes: d841502c79 ("Bluetooth: hci_qca: Collect controller memory dump during SSR")
Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2020-07-28 20:29:43 +02:00
Abhishek Pandit-Subedi
4e8c36c3b0 Bluetooth: Fix suspend notifier race
Unregister from suspend notifications and cancel suspend preparations
before running hci_dev_do_close. Otherwise, the suspend notifier may
race with unregister and cause cmd_timeout even after hdev has been
freed.

Below is the trace from when this panic was seen:

[  832.578518] Bluetooth: hci_core.c:hci_cmd_timeout() hci0: command 0x0c05 tx timeout
[  832.586200] BUG: kernel NULL pointer dereference, address: 0000000000000000
[  832.586203] #PF: supervisor read access in kernel mode
[  832.586205] #PF: error_code(0x0000) - not-present page
[  832.586206] PGD 0 P4D 0
[  832.586210] PM: suspend exit
[  832.608870] Oops: 0000 [#1] PREEMPT SMP NOPTI
[  832.613232] CPU: 3 PID: 10755 Comm: kworker/3:7 Not tainted 5.4.44-04894-g1e9dbb96a161 #1
[  832.630036] Workqueue: events hci_cmd_timeout [bluetooth]
[  832.630046] RIP: 0010:__queue_work+0xf0/0x374
[  832.630051] RSP: 0018:ffff9b5285f1fdf8 EFLAGS: 00010046
[  832.674033] RAX: ffff8a97681bac00 RBX: 0000000000000000 RCX: ffff8a976a000600
[  832.681162] RDX: 0000000000000000 RSI: 0000000000000009 RDI: ffff8a976a000748
[  832.688289] RBP: ffff9b5285f1fe38 R08: 0000000000000000 R09: ffff8a97681bac00
[  832.695418] R10: 0000000000000002 R11: ffff8a976a0006d8 R12: ffff8a9745107600
[  832.698045] usb 1-6: new full-speed USB device number 119 using xhci_hcd
[  832.702547] R13: ffff8a9673658850 R14: 0000000000000040 R15: 000000000000001e
[  832.702549] FS:  0000000000000000(0000) GS:ffff8a976af80000(0000) knlGS:0000000000000000
[  832.702550] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  832.702550] CR2: 0000000000000000 CR3: 000000010415a000 CR4: 00000000003406e0
[  832.702551] Call Trace:
[  832.702558]  queue_work_on+0x3f/0x68
[  832.702562]  process_one_work+0x1db/0x396
[  832.747397]  worker_thread+0x216/0x375
[  832.751147]  kthread+0x138/0x140
[  832.754377]  ? pr_cont_work+0x58/0x58
[  832.758037]  ? kthread_blkcg+0x2e/0x2e
[  832.761787]  ret_from_fork+0x22/0x40
[  832.846191] ---[ end trace fa93f466da517212 ]---

Fixes: 9952d90ea2 ("Bluetooth: Handle PM_SUSPEND_PREPARE and PM_POST_SUSPEND")
Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Reviewed-by: Miao-chen Chou <mcchou@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2020-07-28 20:27:14 +02:00
Wolfram Sang
8808981baf i2c: slave: add sanity check when unregistering
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Alain Volmat <alain.volmat@st.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-07-28 18:37:17 +02:00
Wolfram Sang
1b1be3bf27 i2c: slave: improve sanity check when registering
Add check for ERR_PTR and simplify code while here.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Alain Volmat <alain.volmat@st.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-07-28 18:37:08 +02:00
Julia Lawall
22f9d2f4ee net/mlx5: drop unnecessary list_empty
list_for_each_entry is able to handle an empty list.
The only effect of avoiding the loop is not initializing the
index variable.
Drop list_empty tests in cases where these variables are not
used.

Note that list_for_each_entry is defined in terms of list_first_entry,
which indicates that it should not be used on an empty list.  But in
list_for_each_entry, the element obtained by list_first_entry is not
really accessed, only the address of its list_head field is compared
to the address of the list head, so the list_first_entry is safe.

The semantic patch that makes this change is as follows (with another
variant for the no brace case): (http://coccinelle.lip6.fr/)

<smpl>
@@
expression x,e;
iterator name list_for_each_entry;
statement S;
identifier i;
@@

-if (!(list_empty(x))) {
   list_for_each_entry(i,x,...) S
- }
 ... when != i
? i = e
</smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:57 -07:00
Gustavo A. R. Silva
c8b838d108 net/mlx5: Use fallthrough pseudo-keyword
Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.

[1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:55 -07:00
Alex Vesker
ffdc8ec0b7 net/mlx5: DR, Reduce print level for matcher print
There is no need to print on each unsuccessful matcher
ip_version combination since it probably will happen when
trying to create all the possible combinations.
On a real failure we have a print in the calling function.

Signed-off-by: Alex Vesker <valex@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:52 -07:00
Aya Levin
17347d5430 net/mlx5e: Add support for PCI relaxed ordering
The concept of Relaxed Ordering in the PCI Express environment allows
switches in the path between the Requester and Completer to reorder some
transactions just received before others that were previously enqueued.

In ETH driver, there is no question of write integrity since each memory
segment is written only once per cycle. In addition, the driver doesn't
access the memory shared with the hardware until the corresponding CQE
arrives indicating all PCI transactions are done.

Running TCP single stream over ConnectX-4 LX, ARM CPU on remote-numa has
300% improvement in the bandwidth.

With relaxed ordering turned off: BW:10 [GB/s]
With relaxed ordering turned on: BW:40 [GB/s]

The driver turns relaxed ordering with respect to the firmware
capabilities and the return value from pcie_relaxed_ordering_enabled().

Signed-off-by: Aya Levin <ayal@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:49 -07:00
Tariq Toukan
5d0b847694 net/mlx5e: Use indirect call wrappers for RX post WQEs functions
Use the indirect call wrapper API macros for declaration and scope
of the RX post WQEs functions.

Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Reviewed-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:47 -07:00
Tariq Toukan
b307f7f163 net/mlx5e: Move exposure of datapath function to txrx header
Move them from the generic header file "en.h", to the
datapath header file "txrx.h".

Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Reviewed-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:44 -07:00
Tariq Toukan
5adf4c475a net/mlx5e: RX, Re-work initializaiton of RX function pointers
Instead of exposing the RQ datapath handlers (from en_rx.c) so that
they are set in the control path (in en_main.c), wrap this logic
in a single function in en_rx.c and expose it alone.

Every profile will now have a pointer to the new mlx5e_rx_handlers
structure, instead of directly pointing to the previously-exposed
RQ handlers.

This significantly improves locality and modularity of the driver,
and allows many functions in en_rx.c to become static.

Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Reviewed-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:41 -07:00
Parav Pandit
123f0f53dd net/mlx5e: Link non uplink representors to PCI device
Currently PF and VF representors are exposed as virtual device.
They are not linked to its parent PCI device like how uplink
representor is linked.
Due to this, PF and VF representors cannot benefit of the
systemd defined naming scheme. This requires special handling
by the users.

Hence, link the PF and VF representors to their parent PCI device
similar to existing uplink representor netdevice.

Example:
udevadm output before linking to PCI device:
$ udevadm test-builtin net_id  /sys/class/net/eth6
Load module index
Network interface NamePolicy= disabled on kernel command line, ignoring.
Parsed configuration file /usr/lib/systemd/network/99-default.link
Created link configuration context.
Using default interface naming scheme 'v243'.
ID_NET_NAMING_SCHEME=v243
Unload module index
Unloaded link configuration context.

udevadm output after linking to PCI device:
$ udevadm test-builtin net_id /sys/class/net/eth6
Load module index
Network interface NamePolicy= disabled on kernel command line, ignoring.
Parsed configuration file /usr/lib/systemd/network/99-default.link
Created link configuration context.
Using default interface naming scheme 'v243'.
ID_NET_NAMING_SCHEME=v243
ID_NET_NAME_PATH=enp0s8f0npf0vf0
Unload module index
Unloaded link configuration context.

In past there was little concern over seeing 10,000 lines output
showing up at thread [1] is not applicable as ndo ops for VF
handling is not exposed for all the 100 repesentors for mlx5 devices.

Additionally alternative device naming [2] to overcome shorter device
naming is also part of the latest systemd release v245.

[1] https://marc.info/?l=linux-netdev&m=152657949117904&w=2
[2] https://lwn.net/Articles/814068/

Signed-off-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:39 -07:00
Parav Pandit
8d6bd3c339 net/mlx5: E-switch, Use eswitch total_vports
Currently steering table and rx group initialization helper
routines works on the total_vports passed as input parameter.

Both eswitch helpers work on the mlx5_eswitch and thereby have access
to esw->total_vports. Hence use it directly instead of passing it
via function input arguments.

Signed-off-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Bodong Wang <bodong@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:36 -07:00
Parav Pandit
0da3c12dd6 net/mlx5: E-switch, Reuse total_vports and avoid duplicate nvports
Total e-switch vports are already stored in mlx5_eswitch total_vports.
Avoid copy of it in nvports and reuse existing total_vports calculation.

Signed-off-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Bodong Wang <bodong@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:34 -07:00
Parav Pandit
8b95bda47c net/mlx5: E-switch, Consider maximum vf vports for steering init
When eswitch is enabled, VFs might not be enabled. Hence, consider
maximum number of VFs.
This further closes the gap between handling VF vports between ECPF and
PF.

Fixes: ea2128fd63 ("net/mlx5: E-switch, Reduce dependency on num_vfs during mode set")
Signed-off-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Bodong Wang <bodong@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:31 -07:00
Avihu Hagag
c1a0969ee8 net/mlx5: Add function ID to reclaim pages debug log
Add function ID to reclaim pages debug log for better user visibility.

Signed-off-by: Avihu Hagag <avihuh@mellanox.com>
Reviewed-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:29 -07:00
Eran Ben Elisha
d6945242f4 net/mlx5: Hold pages RB tree per VF
Per page request event, FW request to allocated or release pages for a
single function. Driver maintains FW pages object per function, so there
is no need to hold one global page data-base. Instead, have a page
data-base per function, which will improve performance release flow in all
cases, especially for "release all pages".

As the range of function IDs is large and not sequential, use xarray to
store a per function ID page data-base, where the function ID is the key.

Upon first allocation of a page to a function ID, create the page
data-base per function. This data-base will be released only at pagealloc
mechanism cleanup.

NIC: ConnectX-4 Lx
CPU: Intel(R) Xeon(R) CPU E5-2650 v2 @ 2.60GHz
Test case: 32 VFs, measure release pages on one VF as part of FLR
Before: 0.021 Sec
After:  0.014 Sec

The improvement depends on amount of VFs and memory utilization
by them. Time measurements above were taken from idle system.

Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Reviewed-by: Mark Bloch <markb@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2020-07-28 02:37:26 -07:00
Takashi Iwai
c2c3657f0a ALSA: hda/hdmi: Fix keep_power assignment for non-component devices
It's been reported that, when neither nouveau nor Nvidia graphics
driver is used, the screen starts flickering.  And, after comparing
between the working case (stable 4.4.x) and the broken case, it turned
out that the problem comes from the audio component binding.  The
Nvidia and AMD audio binding code clears the bus->keep_power flag
whenever snd_hdac_acomp_init() succeeds.  But this doesn't mean that
the component is actually bound, but it merely indicates that it's
ready for binding.  So, when both nouveau and Nvidia are blacklisted
or not ready, the driver keeps running without the audio component but
also with bus->keep_power = false.  This made the driver runtime PM
kicked in and powering down when unused, which results in flickering
in the graphics side, as it seems.

For fixing the bug, this patch moves the bus->keep_power flag change
into generic_acomp_notifier_set() that is the function called from the
master_bind callback of component ops; i.e. it's guaranteed that the
binding succeeded.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208609
Fixes: 5a858e79c9 ("ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200728082033.23933-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-07-28 10:23:35 +02:00
Nicolas Boichat
202798db95 Bluetooth: hci_serdev: Only unregister device if it was registered
We should not call hci_unregister_dev if the device was not
successfully registered.

Fixes: c34dc3bfa7 ("Bluetooth: hci_serdev: Introduce hci_uart_unregister_device()")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2020-07-28 09:17:19 +02:00
Max Chou
24b065727c Bluetooth: Return NOTIFY_DONE for hci_suspend_notifier
The original return is NOTIFY_STOP, but notifier_call_chain would stop
the future call for register_pm_notifier even registered on other Kernel
modules with the same priority which value is zero.

Signed-off-by: Max Chou <max.chou@realtek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2020-07-28 09:12:31 +02:00
Nicolas Boichat
a7ad4b6119 Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
HCI_UART_RESET_ON_INIT belongs in hdev_flags, not flags.

Fixes: ce945552fd ("Bluetooth: hci_h5: Add support for serdev enumerated devices")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2020-07-28 09:11:46 +02:00
Ismael Ferreras Morezuelas
cde1a8a992 Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers
For some reason they tend to squat on the very first CSR/
Cambridge Silicon Radio VID/PID instead of paying fees.

This is an extremely common problem; the issue goes as back as 2013
and these devices are only getting more popular, even rebranded by
reputable vendors and sold by retailers everywhere.

So, at this point in time there are hundreds of modern dongles reusing
the ID of what originally was an early Bluetooth 1.1 controller.

Linux is the only place where they don't work due to spotty checks
in our detection code. It only covered a minimum subset.

So what's the big idea? Take advantage of the fact that all CSR
chips report the same internal version as both the LMP sub-version and
HCI revision number. It always matches, couple that with the manufacturer
code, that rarely lies, and we now have a good idea of who is who.

Additionally, by compiling a list of user-reported HCI/lsusb dumps, and
searching around for legit CSR dongles in similar product ranges we can
find what CSR BlueCore firmware supported which Bluetooth versions.

That way we can narrow down ranges of fakes for each of them.

e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
     support BT 1.1 only; so it's a dead giveaway when some
     third-party BT 4.0 dongle reuses it.

So, to sum things up; there are multiple classes of fake controllers
reusing the same 0A12:0001 VID/PID. This has been broken for a while.

Known 'fake' bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
  IC markings on 0x7558: FR3191AHAL 749H15143 (???)

https://bugzilla.kernel.org/show_bug.cgi?id=60824

Fixes: 81cac64ba2 (Deal with USB devices that are faking CSR vendor)
Reported-by: Michał Wiśniewski <brylozketrzyn@gmail.com>
Tested-by: Mike Johnson <yuyuyak@gmail.com>
Tested-by: Ricardo Rodrigues <ekatonb@gmail.com>
Tested-by: M.Hanny Sabbagh <mhsabbagh@outlook.com>
Tested-by: Oussama BEN BRAHIM <b.brahim.oussama@gmail.com>
Tested-by: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
Signed-off-by: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2020-07-28 09:09:00 +02:00
Sabrina Dubroca
d5dba1376e xfrm: esp6: fix the location of the transport header with encapsulation
commit 17175d1a27 ("xfrm: esp6: fix encapsulation header offset
computation") changed esp6_input_done2 to correctly find the size of
the IPv6 header that precedes the TCP/UDP encapsulation header, but
didn't adjust the final call to skb_set_transport_header, which I
assumed was correct in using skb_network_header_len.

Xiumei Mu reported that when we create xfrm states that include port
numbers in the selector, traffic from the user sockets is dropped. It
turns out that we get a state mismatch in __xfrm_policy_check, because
we end up trying to compare the encapsulation header's ports with the
selector that's based on user traffic ports.

Fixes: 0146dca70b ("xfrm: add support for UDPv6 encapsulation of ESP")
Fixes: 26333c37fc ("xfrm: add IPv6 support for espintcp")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2020-07-28 07:57:23 +02:00
Linus Torvalds
4764e61e1d Fixes for major regression and longstanding bounds-checking error.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQEcBAABAgAGBQJfH06MAAoJELcQ+SIFb8HagcsH/iqwRtQJAfYgaB8hDJhe2EQX
 bJ82PQRjCpFiUdsutKQdDaQZ2nrPsAt+SK4Sb/H3xtFtun4Agonf01mfFNYTJRjv
 ej/H/mgznBjathuv+nEbb/Ie3+hPM946py7DtBK4ZWIZxlCWizwZo1hD1Lv8ZjFk
 Jd5pD823aXYBWKdu2vv59SG/IvOKp/6GF6s2B5i9rnCz1K8QiGT2uTLsnuVuI/yl
 UcJJHh9nyEEebX1P32cLbTCIzAErLZHaQ8Z/1RbhKo/lwGuKW1+KK4dCud7G30q6
 LPNpnIJoRoLVvkFI96WevXd+62wTicRgp1LQaESnFLoxBXjhY0Pi07Q/PYMbb28=
 =NQ5R
 -----END PGP SIGNATURE-----

Merge tag 'sh-for-5.8-part2' of git://git.libc.org/linux-sh into master

Pull arch/sh fixes from Rich Felker:
 "Two last-minute fixes: one is for a boot regression (mmu code broken)
  and the other fixes a long-standing broken syscall number bounds
  check"

* tag 'sh-for-5.8-part2' of git://git.libc.org/linux-sh:
  sh: Fix validation of system call number
  sh/tlb: Fix PGTABLE_LEVELS > 2
2020-07-27 17:04:45 -07:00
Al Viro
181964e619 fix a braino in cmsghdr_from_user_compat_to_kern()
commit 547ce4cfb3 ("switch cmsghdr_from_user_compat_to_kern() to
copy_from_user()") missed one of the places where ucmlen should've been
replaced with cmsg.cmsg_len, now that we are fetching the entire struct
rather than doing it field-by-field.

	As the result, compat sendmsg() with several different-sized cmsg
attached started to fail with EINVAL.  Trivial to fix, fortunately.

Fixes: 547ce4cfb3 ("switch cmsghdr_from_user_compat_to_kern() to copy_from_user()")
Reported-by: Nick Bowler <nbowler@draconx.ca>
Tested-by: Nick Bowler <nbowler@draconx.ca>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 13:25:39 -07:00
Gustavo A. R. Silva
5e619d73e6 net/mlx4: Use fallthrough pseudo-keyword
Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1].

[1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 13:14:10 -07:00
Michael Karcher
04a8a3d0a7 sh: Fix validation of system call number
The slow path for traced system call entries accessed a wrong memory
location to get the number of the maximum allowed system call number.
Renumber the numbered "local" label for the correct location to avoid
collisions with actual local labels.

Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Fixes: f3a8308864 ("sh: Add a few missing irqflags tracing markers.")
Signed-off-by: Rich Felker <dalias@libc.org>
2020-07-27 16:12:49 -04:00
Peter Zijlstra
c7bcbc8ab9 sh/tlb: Fix PGTABLE_LEVELS > 2
Geert reported that his SH7722-based Migo-R board failed to boot after
commit:

  c5b27a889d ("sh/tlb: Convert SH to generic mmu_gather")

That commit fell victim to copying the wrong pattern --
__pmd_free_tlb() used to be implemented with pmd_free().

Fixes: c5b27a889d ("sh/tlb: Convert SH to generic mmu_gather")
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rich Felker <dalias@libc.org>
2020-07-27 16:12:48 -04:00
David S. Miller
a02d26fe48 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue
Tony Nguyen says:

====================
1GbE Intel Wired LAN Driver Updates 2020-07-27

This series contains updates to igc driver only.

Sasha cleans up double definitions, unneeded and non applicable
registers, and removes unused fields in structs. Ensures the Receive
Descriptor Minimum Threshold Count is cleared and fixes a static checker
error.

v2: Remove fields from hw_stats in patches that removed their uses.
Reworded patch descriptions for patches 1, 2, and 4.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 13:11:57 -07:00
Steve Cohen
8490d6a7e0 drm: hold gem reference until object is no longer accessed
A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.

Signed-off-by: Steve Cohen <cohens@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
2020-07-27 22:05:51 +02:00
David S. Miller
11d268107a Merge branch 'selftests-net-Fix-clang-warnings-on-powerpc'
Tanner Love says:

====================
selftests/net: Fix clang warnings on powerpc

This is essentially a v2 of
http://patchwork.ozlabs.org/project/netdev/patch/20200724181757.2331172-1-tannerlove.kernel@gmail.com/,
but it has been split up in order to have only one "Fixes" tag per
patch.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:56:59 -07:00
Tanner Love
94b6c13be5 selftests/net: tcp_mmap: fix clang warning for target arch PowerPC
When size_t maps to unsigned int (e.g. on 32-bit powerpc), then the
comparison with 1<<35 is always true. Clang 9 threw:
warning: result of comparison of constant 34359738368 with \
expression of type 'size_t' (aka 'unsigned int') is always true \
[-Wtautological-constant-out-of-range-compare]
        while (total < FILE_SZ) {

Tested: make -C tools/testing/selftests TARGETS="net" run_tests

Fixes: 192dc405f3 ("selftests: net: add tcp_mmap program")
Signed-off-by: Tanner Love <tannerlove@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:56:59 -07:00
Tanner Love
b4da96ffd3 selftests/net: so_txtime: fix clang issues for target arch PowerPC
On powerpcle, int64_t maps to long long. Clang 9 threw:
warning: absolute value function 'labs' given an argument of type \
'long long' but has parameter of type 'long' which may cause \
truncation of value [-Wabsolute-value]
        if (labs(tstop - texpect) > cfg_variance_us)

Tested: make -C tools/testing/selftests TARGETS="net" run_tests

Fixes: af5136f950 ("selftests/net: SO_TXTIME with ETF and FQ")
Signed-off-by: Tanner Love <tannerlove@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:56:58 -07:00
Tanner Love
64f9ede227 selftests/net: psock_fanout: fix clang issues for target arch PowerPC
Clang 9 threw:
warning: format specifies type 'unsigned short' but the argument has \
type 'int' [-Wformat]
                typeflags, PORT_BASE, PORT_BASE + port_off);

Tested: make -C tools/testing/selftests TARGETS="net" run_tests

Fixes: 77f65ebdca ("packet: packet fanout rollover during socket overload")
Signed-off-by: Tanner Love <tannerlove@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:56:58 -07:00
Tanner Love
955cbe91bc selftests/net: rxtimestamp: fix clang issues for target arch PowerPC
The signedness of char is implementation-dependent. Some systems
(including PowerPC and ARM) use unsigned char. Clang 9 threw:
warning: result of comparison of constant -1 with expression of type \
'char' is always true [-Wtautological-constant-out-of-range-compare]
                                  &arg_index)) != -1) {

Tested: make -C tools/testing/selftests TARGETS="net" run_tests

Fixes: 16e7812241 ("selftests/net: Add a test to validate behavior of rx timestamps")
Signed-off-by: Tanner Love <tannerlove@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:56:58 -07:00
Colin Ian King
3540669761 qed: fix assignment of n_rq_elems to incorrect params field
Currently n_rq_elems is being assigned to params.elem_size instead of the
field params.num_elems.  Coverity is detecting this as a double assingment
to params.elem_size and reporting this as an usused value on the first
assignment.  Fix this.

Addresses-Coverity: ("Unused value")
Fixes: b6db3f71c9 ("qed: simplify chain allocation with init params struct")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Alexander Lobakin <alobakin@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:46:28 -07:00
David S. Miller
86f968a098 Merge branch 'sfc-driver-for-EF100-family-NICs-part-1'
Edward Cree says:

====================
sfc: driver for EF100 family NICs, part 1

EF100 is a new NIC architecture under development at Xilinx, based
 partly on existing Solarflare technology.  As many of the hardware
 interfaces resemble EF10, support is implemented within the 'sfc'
 driver, which previous patch series "commonised" for this purpose.

In order to maintain bisectability while splitting into patches of a
 reasonable size, I had to do a certain amount of back-and-forth with
 stubs for things that the common code may try to call, mainly because
 we can't do them until we've set up MCDI, but we can't set up MCDI
 without probing the event queues, at which point a lot of the common
 machinery becomes reachable from event handlers.
Consequently, this first series doesn't get as far as actually sending
 and receiving packets.  I have a second series ready to follow it
 which implements the datapath (and a few other things like ethtool).

Changes from v4:
 * Fix build on CONFIG_RETPOLINE=n by using plain prototypes instead
   of INDIRECT_CALLABLE_DECLARE.

Changes from v3:
 * combine both drivers (sfc_ef100 and sfc) into a single module, to
   make non-modular builds work.  Patch #4 now adds a few indirections
   to support this; the ones in the RX and TX path use indirect-call-
   wrappers to minimise the performance impact.

Changes from v2:
 * remove MODULE_VERSION.
 * call efx_destroy_reset_workqueue() from ef100_exit_module().
 * correct uint32_ts to u32s.  While I was at it, I fixed a bunch of
   other style issues in the function-control-window code.
All in patch #4.

Changes from v1:
 * kernel test robot spotted a link error when sfc_ef100 was built
   without mdio.  It turns out the thing we were trying to link to
   was a bogus thing to do on anything but Falcon, so new patch #1
   removes it from this driver.
 * fix undeclared symbols in patch #4 by shuffling around prototypes
   and #includes and adding 'static' where appropriate.
 * fix uninitialised variable 'rc2' in patch #7.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:56 -07:00
Edward Cree
1c74884387 sfc_ef100: implement ndo_get_phys_port_{id,name}
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:56 -07:00
Edward Cree
29ec1b27e7 sfc_ef100: read device MAC address at probe time
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:56 -07:00
Edward Cree
99a23c1168 sfc_ef100: probe the PHY and configure the MAC
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:56 -07:00
Edward Cree
4e5675bbab sfc_ef100: actually perform resets
In ef100_reset(), make the MCDI call to do the reset.
Also, do a reset at start-of-day during probe, to put the function in
 a clean state.

Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:56 -07:00
Edward Cree
d802b0ae65 sfc_ef100: extend ef100_check_caps to cover datapath_caps3
MC_CMD_GET_CAPABILITIES now has a third word of flags; extend the
 efx_has_cap() machinery to cover it.

Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:55 -07:00
Edward Cree
f65731207d sfc_ef100: read datapath caps, implement check_caps
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:55 -07:00
Edward Cree
5e4ef67346 sfc_ef100: process events for MCDI completions
Currently RX and TX-completion events are unhandled, as neither the RX
 nor the TX path has been implemented yet.

Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:55 -07:00
Edward Cree
965b549f3c sfc_ef100: implement ndo_open/close and EVQ probing
Channels are probed, but actual event handling is still stubbed out.

Stub implementation of check_caps is needed because ptp.c will call into
 it from efx_ptp_use_mac_tx_timestamps() to decide if it wants TXQs.

Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:55 -07:00
Edward Cree
2200e6d92e sfc_ef100: implement MCDI transport
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:55 -07:00
Edward Cree
35a36af88f sfc_ef100: don't call efx_reset_down()/up() on EF100
We handle everything ourselves in ef100_reset(), rather than relying on
 the generic down/up routines.

Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:55 -07:00
Edward Cree
aa86a75fed sfc_ef100: PHY probe stub
We can't actually do the MCDI to probe it fully until we have working
 MCDI, which comes later, but we need efx->phy_data to be allocated so
 that when we get MCDI events the link-state change handler doesn't
 NULL-dereference.

Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-27 12:26:55 -07:00