1. 15 Nov, 2016 5 commits
    • Felix Fietkau's avatar
      mac80211: remove bogus skb vif assignment · fff712cb
      Felix Fietkau authored
      
      
      The call to ieee80211_txq_enqueue overwrites the vif pointer with the
      codel enqueue time, so setting it just before that call makes no sense.
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Acked-by: default avatarToke Høiland-Jørgensen <toke@toke.dk>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      fff712cb
    • Felix Fietkau's avatar
      mac80211: update A-MPDU flag on tx dequeue · c1f4c9ed
      Felix Fietkau authored
      The sequence number counter is used to derive the starting sequence
      number. Since that counter is updated on tx dequeue, the A-MPDU flag
      needs to be up to date at the tme of dequeue as well.
      
      This patch prevents sending more A-MPDU frames after the session has
      been terminated and also ensures that aggregation starts right after the
      session has been established
      
      Fixes: bb42f2d1
      
       ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue")
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Acked-by: default avatarToke Høiland-Jørgensen <toke@toke.dk>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      c1f4c9ed
    • Pedersen, Thomas's avatar
      cfg80211: add bitrate for 20MHz MCS 9 · 8fdd136f
      Pedersen, Thomas authored
      
      
      Some drivers (ath10k) report MCS 9 @ 20MHz, which
      technically isn't defined. To get more meaningful value
      than 0 out of this however, just extrapolate a bitrate
      from ratio of MCS 7 and 9 in channels where it is allowed.
      Signed-off-by: default avatarThomas Pedersen <twp@qca.qualcomm.com>
      [add a comment about it in the code]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      8fdd136f
    • Felix Fietkau's avatar
      Revert "mac80211: allow using AP_LINK_PS with mac80211-generated TIM IE" · 6c18a6b4
      Felix Fietkau authored
      This reverts commit c68df2e7.
      
      __sta_info_recalc_tim turns into a no-op if local->ops->set_tim is not
      set. This prevents the beacon TIM bit from being set for all drivers
      that do not implement this op (almost all of them), thus thoroughly
      essential AP mode powersave functionality.
      
      Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
      Fixes: c68df2e7
      
       ("mac80211: allow using AP_LINK_PS with mac80211-generated TIM IE")
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      6c18a6b4
    • Filip Matusiak's avatar
      mac80211: Ignore VHT IE from peer with wrong rx_mcs_map · c8eaf347
      Filip Matusiak authored
      
      
      This is a workaround for VHT-enabled STAs which break the spec
      and have the VHT-MCS Rx map filled in with value 3 for all eight
      spacial streams, an example is AR9462 in AP mode.
      
      As per spec, in section 22.1.1 Introduction to the VHT PHY
      A VHT STA shall support at least single spactial stream VHT-MCSs
      0 to 7 (transmit and receive) in all supported channel widths.
      
      Some devices in STA mode will get firmware assert when trying to
      associate, examples are QCA9377 & QCA6174.
      
      Packet example of broken VHT Cap IE of AR9462:
      
      Tag: VHT Capabilities (IEEE Std 802.11ac/D3.1)
          Tag Number: VHT Capabilities (IEEE Std 802.11ac/D3.1) (191)
          Tag length: 12
          VHT Capabilities Info: 0x00000000
          VHT Supported MCS Set
              Rx MCS Map: 0xffff
                  .... .... .... ..11 = Rx 1 SS: Not Supported (0x0003)
                  .... .... .... 11.. = Rx 2 SS: Not Supported (0x0003)
                  .... .... ..11 .... = Rx 3 SS: Not Supported (0x0003)
                  .... .... 11.. .... = Rx 4 SS: Not Supported (0x0003)
                  .... ..11 .... .... = Rx 5 SS: Not Supported (0x0003)
                  .... 11.. .... .... = Rx 6 SS: Not Supported (0x0003)
                  ..11 .... .... .... = Rx 7 SS: Not Supported (0x0003)
                  11.. .... .... .... = Rx 8 SS: Not Supported (0x0003)
              ...0 0000 0000 0000 = Rx Highest Long GI Data Rate (in Mb/s, 0 = subfield not in use): 0x0000
              Tx MCS Map: 0xffff
              ...0 0000 0000 0000 = Tx Highest Long GI Data Rate  (in Mb/s, 0 = subfield not in use): 0x0000
      Signed-off-by: default avatarFilip Matusiak <filip.matusiak@tieto.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      c8eaf347
  2. 02 Nov, 2016 4 commits
  3. 01 Nov, 2016 9 commits
  4. 31 Oct, 2016 16 commits
  5. 30 Oct, 2016 4 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 2a26d99b
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "Lots of fixes, mostly drivers as is usually the case.
      
         1) Don't treat zero DMA address as invalid in vmxnet3, from Alexey
            Khoroshilov.
      
         2) Fix element timeouts in netfilter's nft_dynset, from Anders K.
            Pedersen.
      
         3) Don't put aead_req crypto struct on the stack in mac80211, from
            Ard Biesheuvel.
      
         4) Several uninitialized variable warning fixes from Arnd Bergmann.
      
         5) Fix memory leak in cxgb4, from Colin Ian King.
      
         6) Fix bpf handling of VLAN header push/pop, from Daniel Borkmann.
      
         7) Several VRF semantic fixes from David Ahern.
      
         8) Set skb->protocol properly in ip6_tnl_xmit(), from Eli Cooper.
      
         9) Socket needs to be locked in udp_disconnect(), from Eric Dumazet.
      
        10) Div-by-zero on 32-bit fix in mlx4 driver, from Eugenia Emantayev.
      
        11) Fix stale link state during failover in NCSCI driver, from Gavin
            Shan.
      
        12) Fix netdev lower adjacency list traversal, from Ido Schimmel.
      
        13) Propvide proper handle when emitting notifications of filter
            deletes, from Jamal Hadi Salim.
      
        14) Memory leaks and big-endian issues in rtl8xxxu, from Jes Sorensen.
      
        15) Fix DESYNC_FACTOR handling in ipv6, from Jiri Bohac.
      
        16) Several routing offload fixes in mlxsw driver, from Jiri Pirko.
      
        17) Fix broadcast sync problem in TIPC, from Jon Paul Maloy.
      
        18) Validate chunk len before using it in SCTP, from Marcelo Ricardo
            Leitner.
      
        19) Revert a netns locking change that causes regressions, from Paul
            Moore.
      
        20) Add recursion limit to GRO handling, from Sabrina Dubroca.
      
        21) GFP_KERNEL in irq context fix in ibmvnic, from Thomas Falcon.
      
        22) Avoid accessing stale vxlan/geneve socket in data path, from
            Pravin Shelar"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (189 commits)
        geneve: avoid using stale geneve socket.
        vxlan: avoid using stale vxlan socket.
        qede: Fix out-of-bound fastpath memory access
        net: phy: dp83848: add dp83822 PHY support
        enic: fix rq disable
        tipc: fix broadcast link synchronization problem
        ibmvnic: Fix missing brackets in init_sub_crq_irqs
        ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context
        Revert "ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context"
        arch/powerpc: Update parameters for csum_tcpudp_magic & csum_tcpudp_nofold
        net/mlx4_en: Save slave ethtool stats command
        net/mlx4_en: Fix potential deadlock in port statistics flow
        net/mlx4: Fix firmware command timeout during interrupt test
        net/mlx4_core: Do not access comm channel if it has not yet been initialized
        net/mlx4_en: Fix panic during reboot
        net/mlx4_en: Process all completions in RX rings after port goes up
        net/mlx4_en: Resolve dividing by zero in 32-bit system
        net/mlx4_core: Change the default value of enable_qos
        net/mlx4_core: Avoid setting ports to auto when only one port type is supported
        net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec
        ...
      2a26d99b
    • pravin shelar's avatar
      geneve: avoid using stale geneve socket. · fceb9c3e
      pravin shelar authored
      
      
      This patch is similar to earlier vxlan patch.
      Geneve device close operation frees geneve socket. This
      operation can race with geneve-xmit function which
      dereferences geneve socket. Following patch uses RCU
      mechanism to avoid this situation.
      Signed-off-by: default avatarPravin B Shelar <pshelar@ovn.org>
      Acked-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fceb9c3e
    • pravin shelar's avatar
      vxlan: avoid using stale vxlan socket. · c6fcc4fc
      pravin shelar authored
      
      
      When vxlan device is closed vxlan socket is freed. This
      operation can race with vxlan-xmit function which
      dereferences vxlan socket. Following patch uses RCU
      mechanism to avoid this situation.
      Signed-off-by: default avatarPravin B Shelar <pshelar@ovn.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c6fcc4fc
    • Mintz, Yuval's avatar
      qede: Fix out-of-bound fastpath memory access · 087892d2
      Mintz, Yuval authored
      
      
      Driver allocates a shadow array for transmitted SKBs with X entries;
      That means valid indices are {0,...,X - 1}. [X == 8191]
      Problem is the driver also uses X as a mask for a
      producer/consumer in order to choose the right entry in the
      array which allows access to entry X which is out of bounds.
      
      To fix this, simply allocate X + 1 entries in the shadow array.
      Signed-off-by: default avatarYuval Mintz <Yuval.Mintz@cavium.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      087892d2
  6. 29 Oct, 2016 2 commits
    • Roger Quadros's avatar
      net: phy: dp83848: add dp83822 PHY support · 30347834
      Roger Quadros authored
      
      
      This PHY has a compatible register set with DP83848x so
      add support for it.
      Acked-by: default avatarAndrew F. Davis <afd@ti.com>
      Signed-off-by: default avatarRoger Quadros <rogerq@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30347834
    • Govindarajulu Varadarajan's avatar
      enic: fix rq disable · 9fe1c98a
      Govindarajulu Varadarajan authored
      
      
      When MTU is changed from 9000 to 1500 while there is burst of inbound 9000
      bytes packets, adaptor sometimes delivers 9000 bytes packets to 1500 bytes
      buffers. This causes memory corruption and sometimes crash.
      
      This is because of a race condition in adaptor between "RQ disable"
      clearing descriptor mini-cache and mini-cache valid bit being set by
      completion of descriptor fetch. This can result in stale RQ desc being
      cached and used when packets arrive. In this case, the stale descriptor
      have old MTU value.
      
      Solution is to write RQ->disable twice. The first write will stop any
      further desc fetches, allowing the second disable to clear the mini-cache
      valid bit without danger of a race.
      
      Also, the check for rq->running becoming 0 after writing rq->enable to 0
      is not done properly. When incoming packets are flooding the interface,
      rq->running will pulse high for each dropped packet. Since the driver was
      waiting for 10us between each poll, it is possible to see rq->running = 1
      1000 times in a row, even though it is not actually stuck running.
      This results in false failure of vnic_rq_disable(). Fix is to try more
      than 1000 time without delay between polls to ensure we do not miss when
      running goes low.
      
      In old adaptors rq->enable needs to be re-written to 0 when posted_index
      is reset in vnic_rq_clean() in order to keep rq->prefetch_index in sync.
      Signed-off-by: default avatarGovindarajulu Varadarajan <_govind@gmx.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9fe1c98a