Code tried to avoid setting ACs for PS-poll by an early return.
However as a result the timeouts weren't set as well.
Inactivity timeout of zero means we will always try to go back to
sleep immediately after moving to AM, which doesn't make much sense,
and isn't supported by FW.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017165728.dda7f6ba0b22.Ia107bfe496b84e8a2edb33d9f39a5d2b56ed63f7@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Sometimes some NICs may fail to initialize, but if we have
such a scenario we may only see an alive timeout (i.e. the
firmware doesn't send us the alive message), and that will
only cause us to fail the interface up.
Try to once grab NIC access during device probe to ensure
we can properly talk to the hardware at all, and to do all
the potential workarounds in that function.
Since we now finish NIC init here, we can remove it from
the later potential read of the RF ID.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017165728.604dfc8f43bd.I07b58a5c9238f75413a91198452ba1268ee79425@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Evidently, it's possible to hit this issue, so reduce the
noise from it by just having it print a (rate-limited)
message instead. We don't really know yet why we hit it,
but there's no value in having a WARN_ON() here.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017162352.8d503387b523.Id2c82d023df5128e553b28c935d30df4d9411917@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Sometimes we might want to have an error message for something
related to TX/RX, but if that somehow happens frequently it'll
overwhelm the logs. Add IWL_ERR_LIMIT() to alleviate that by
rate-limiting those messages.
To do this, rework __iwl_err() a bit to have a mode argument
instead of passing yet another (bool) argument to it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017162352.2cb1e6b75672.Iec5b1c1bcc6ebc87c586921a6c5c2a937f49e83c@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
When auth/assoc completes, we should remove session protection,
except when association is successful, where we need it until a
beacon is received from the AP.
In particular, in the case of assoc comeback, currently the session
protection event just times out, leading to confusing messages:
wlan0: 42:00:00:00:00:00 rejected association temporarily; comeback duration 1000 TU (1024 ms)
iwlwifi 0000:00:00.0: Not associated and the session protection is over already...
wlan0: Connection to AP 42:00:00:00:00:00 lost
wlan0: associate with 42:00:00:00:00:00 (try 2/3)
mac80211 never does anything on the "Connection ... lost" as it's
not even connected.
Removing the session protection when it's no longer needed removes
those confusing messages and lets the device do other things in the
allocated time.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017162352.95e4bebb069b.I635280e5d26c70414ac6eb5d62b46fe4bd942818@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
We don't need this argument, since in all cases where the
function is called, trans->trans_cfg is already set (it's
in fact set during allocation). Remove it to avoid any
confusion about it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017162352.cb04580b8521.I7129d4ba3dc689af839761d5807a10f99718893e@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
As part of the new rate_n_flags, the RTS and CTS flags
are being removed from it. Instead, we have these flags
in the flags field in the TX command.
Add to new flags to the iwl_tx_cmd_flags enum.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017162352.b5aaabb04432.I999f86ed6a9d9b99e63a33f724963f83f85fbb44@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Remove the unused csi parameter from
iwl_mvm_pass_packet_to_mac80211(). It is not used anymore, but was
accidentally left in.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/20211017132604.480251-2-luca@coelho.fi
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
As part of the new rate_n_flags this two APIs
may use the new rate. Add support for the new rate.
These two APIs were updated in one patch because both of them
are using the same functions which were changed.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017162352.7eb6240b8079.I1e804e70a8ebd23840a9431fc5d2a56ad8d5d1a2@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
As part of the new rate_n_flags, a new version of this
structures was added in the FW. Add support for this new
version and for the new rate_n_flags in this API.
Both these APIs were updated in one patch since they are
using the same functions.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017162352.a28e7a92f558.I19f72735c674f815c6e7c11cecfad6230b4510ef@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
As part of the new rate_n_flags, a new version of
BEACON_TEMPLATE_CMD was added in FW in order to support
the new rate_n_flags.
Add support for the new version.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017162352.b42e67f14293.Ic3f1ed8cb3a31cfaa51174497dd993936b00d398@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Previously added BZ reset wasn't taking into account the
call to iwl_trans_pcie_sw_reset which used a pre-BZ logic
to reset the device - enabling iwl_trans_pcie_sw_reset to
support BZ family made this reset redundant.
MAC_ACCESS clear shouldn't be called here but only when calling
_iwl_trans_pcie_stop_device which now support also BZ family.
Signed-off-by: Roee Goldfiner <roee.h.goldfiner@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017162352.648931fe07e2.Ibf30f9b8e70536da93c4a574ace33d325d3f8da4@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Add new TLV for debug config set to read preset
based on TLV is set in context info.
This is needed to set the preset based on ucode in early
trigger point.
Add DRAM frag allocation info in first fragment of
DBGC1 with all details.
New capability from FW for DBGC frag debug support is
added and BUFFER_ALLOCATION_CMD is disabled in capability
is supported.
Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017123741.cacf0babc521.If3704b5fda09b344e3e438252360898a3f2e90fa@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
As part of the new rate_n_flags, FW added a new version for
LOCATION_RANGE_RSP_NTFY, and it's internal structure -
LOCATION_RANGE_RSP_AP_ETRY_NTFY. Add support for this.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017123741.c5c6c863631e.I4b493f4eeabbfa1dc965ae012b72fc57de7d5f4f@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
As part of the new rate_n_flags, a new version of tlc_update_notif
was added in FW in order to support the new rate_n_flags.
Add support for the new version, and move the all API to use the
new rate_n_flags only (if FW supports the old one - convert it).
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017123741.9fc0cb5d5898.I1f88e02317f79f1be7f792c01236d836045a44b3@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
As part of the new rate & flags, convert an old format rate to
the new. This is needed if the driver supports the new format
but the FW supports the old one.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017123741.1ea5263dafec.Iadffe7cb26554d4c23c9242eb2ec8326306202a9@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Use the previously added infrastructure to scrub key material
in firmware dumps:
* in the TX FIFO data, just search for each key that we
know about and override such data
* scrub various commands that we sent to the firmware if
they're present
* in firmware memory, where advertised by firmware TLVs
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017123741.d1514964e6a7.I18f8c2ce8082952af7cfe5f8fe75fe51851b8853@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
In firmware dumps, currently all kinds of key material may be
included, e.g. in host commands (if firmware crashes during the
processing of a key-related command) or in the TX FIFO(s) if
we have been using in-TX-command key material.
Additionally, some firmware versions will advertise sections
of their internal data to not dump, due to them containing some
sensitive data.
Add some infrastructure to allow scrubbing this data out, as
dependent on the opmode's idea of what will need to be done.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017123741.360cc8fe55b1.Ie3bd3ece38043969f7e116e61a6ec1197a58d78b@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
We still had the entire license statement here, but with BSD,
so the SPDX tag was not matching the actual text. Fix that
and remove all the texts since they're no longer needed.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017123741.328c2b33081c.Ib3570e8f214538a878204cc2b0b612b5ed0571b3@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Consensus seems to be emerging that corporations or groups
shouldn't be listed as module authors, and we will not
maintain this email address any longer. Just remove it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017113927.32109514aad0.I91a7d745f4ab50ee8ef918ece00dda8251541595@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
On some RFs we want to advertise vendor specific capabilities to
indicate support for improved beamforming rates and/or on 160 MHz,
some APs where Intel has collaborated with the vendor will use it
to improve behaviour. Add these elements where relevant, i.e. for
HR and GF RFs.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017113927.510f0ef9c2d5.If99bdb9009583ac7cc6cbb708e871a67df836dbe@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Just like we have default SMPS mode as dynamic in powersave,
we should not enable RX-diversity in powersave, to reduce
power consumption when connected to a non-MIMO AP.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017113927.fc896bc5cdaa.I1d11da71b8a5cbe921a37058d5f578f1b14a2023@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
We should consider the P2P interface type, which isn't in
vif->type due to mac80211's special handling of that. Use
ieee80211_vif_type_p2p() to convert appropriately.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017113927.8e992a3beee2.I4231ac8a7ae8f844e35a1ec221baf3e2b676e765@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
- SBEFIFO usersapce interfaces to perform FFDC (First Failure
Data Capture) and detect timeouts
- A fix to handle multiple messages in flight
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+nHMAt9PCBDH63wBa3ZZB4FHcJ4FAmFx+ZIACgkQa3ZZB4FH
cJ7WHhAAn840J0zZS5mUMq7oJC6oWsSwEtKoBqoEwJq0nGGTDY7KX5r5umH1uEdR
SlIjZ8WoNgZVpZEXXOXZyKWU8yzEckVjEYMWNWZGuabuAXMzTDyB/J376vn9IYQO
ZkGYbu4B9CZssn0sDC671R/FHfPFk7L5jJ0sJgi5I3nDOApw+uvcGqw9r0AWmUfp
7BHNLZvvUNO/Z3yqF+YaeDhOIXHRbN0kq7fwi+lp4s5UUhPZDmNrrbVu+6HqJe9E
ghUST309zWUdtBToyzxkRb2U8rK8QDtkZppRPf+e/64RP8Fz1yNDPHG6HQX7cyYS
1VyMbA5AzzbUE2XORmfbPGrJ9WmQSX8JOJX1bxq/eu15VJAeDVYuMVHm0ekNhi3u
gwBvPXeyCwMCn0rQBGxbqoM9bHHj07vJ1FVaSWpWYjbTWo343itjVi54nYxgQxIA
12TW8xRI1H7IHkgKtaCvrINxHgyXinfZuWrNXVKHsiT02Y+F08eXp0xotaMg0bmj
nhvTw4wRZa0rHIFNFqj/yEKpIaaoDuPo1ZxT81NOAK4kxgzuFB/z2IsUXf+xJI4r
2UAWyryth5wFbfu0BBq95onGOI+MgZwpksVNekcS1P2pByox+pKKvUsqXeSBRHnx
DmiSZVME2zRUb+9jZHVfEVHBZBrMVzDn1pb9Fm1OId8cjeFupdA=
=ug/2
-----END PGP SIGNATURE-----
Merge tag 'fsi-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/fsi into char-misc-next
Joel writes:
FSI changes for v5.16
- SBEFIFO usersapce interfaces to perform FFDC (First Failure
Data Capture) and detect timeouts
- A fix to handle multiple messages in flight
* tag 'fsi-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/fsi:
fsi: sbefifo: Use interruptible mutex locking
fsi: sbefifo: Add sysfs file indicating a timeout error
docs: ABI: testing: Document the SBEFIFO timeout interface
hwmon: (occ) Provide the SBEFIFO FFDC in binary sysfs
docs: ABI: testing: Document the OCC hwmon FFDC binary interface
fsi: occ: Store the SBEFIFO FFDC in the user response buffer
fsi: occ: Use a large buffer for responses
hwmon: (occ) Remove sequence numbering and checksum calculation
fsi: occ: Force sequence numbering per OCC
Start scratch debug register for Bz family.
This register is used for FW debug, and the driver
should start this register with a fixed value, during
init, and upon an error, should read it, and add it to
the dump.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210826224715.609ad58a49f3.I05c351233601ecc51dddfa5df69ace292216eb95@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
When having a blank OTP the only way to get the rf id
and the cdb info is from prph registers.
Currently there is some implementation for this, but it
is located in the wrong place in the code (should be before
trying to understand what HW is connected and not after),
and it has a partial implementation.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210826224715.820c2ae18c2b.Iec9b2e2615ce65e6aff5ce896589227a7030f4cf@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
ast:
- fix regression with connector detect
msm:
- fix power stability issue
msxfb:
- fix crash on unload
panel:
- sync fix
kmb:
- modesetting fixes
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmFxyBEACgkQDHTzWXnE
hr6a5RAApVKDg++g2qCDlHs8cOivkO6WH0miNAG92f+kiuFzyG1QoYAXQCj5iDuK
Lt2hzk4nI7zdev0FjZolJyYybxiqzsfeMJws3J4p2RWKbE0V3+yFhTCtGjMjxuhv
Swe/iAy8FbqaUWumYsz1rs/v1vCAWMoUcDzKjRSXHz9CbiSvTgaD3O9w2hxlAbgP
Oo40Tl6USTu2QQKGL0hupWEC/i8yslOxj0RQgCDzATG6xxlG3zg30qEby7uldX6j
JWVq9s0xVhD5t5TQn4fEIXTmlrwgNCGr/ibozlfrMGdRl0QDWstQDC839v9Eg+ZW
+pGuW+p7WKTVfLEtgwUIehQtnLQyt8UJWBr8wiPMl/55GHjNhUubM31F5YVHsj0D
Oi8GTbeWfz61ZhlibxaPTGCOcNhIPF5g7VuDizMOArC1HX1mvhfXbwJFP5zX7yG2
P0BG5TW7S7/AXOXqvYdWRd/NUnAB8JZm0UcKqoqTpqKSdaOAF9d0pxJ0zxJdLQs9
u+Zmx7det+NN6IByj6bOeN+7PZg4Tc7Du6kciadDI6XDRGmMnH/9kTeSTWTfdxZj
NMWyYxIggyJA7lqer05WfuD3W+8LJNfh56yPwN9C80GAlqCJVqS2OF04XdL1sxVw
AeRaHzz1+OVU4ic+ayzAneW6d6jck3IulOdkZZSnrBu9GN436Pw=
=tgQR
-----END PGP SIGNATURE-----
Merge tag 'drm-fixes-2021-10-22' of git://anongit.freedesktop.org/drm/drm
Pull drm fixes from Dave Airlie:
"Nothing too crazy at the end of the cycle, the kmb modesetting fixes
are probably a bit large but it's not a major driver, and its fixing
monitor doesn't turn on type problems.
Otherwise it's just a few minor patches, one ast regression revert, an
msm power stability fix.
ast:
- fix regression with connector detect
msm:
- fix power stability issue
msxfb:
- fix crash on unload
panel:
- sync fix
kmb:
- modesetting fixes"
* tag 'drm-fixes-2021-10-22' of git://anongit.freedesktop.org/drm/drm:
Revert "drm/ast: Add detect function support"
drm/kmb: Enable ADV bridge after modeset
drm/kmb: Corrected typo in handle_lcd_irq
drm/kmb: Disable change of plane parameters
drm/kmb: Remove clearing DPHY regs
drm/kmb: Limit supported mode to 1080p
drm/kmb: Work around for higher system clock
drm/panel: ilitek-ili9881c: Fix sync for Feixin K101-IM2BYL02 panel
drm: mxsfb: Fix NULL pointer dereference crash on unload
drm/msm/devfreq: Restrict idle clamping to a618 for now
Vladimir Zapolskiy reports:
Commit a7259df767 ("memblock: make memblock_find_in_range method
private") invokes a kernel panic while running kmemleak on OF platforms
with nomaped regions:
Unable to handle kernel paging request at virtual address fff000021e00000
[...]
scan_block+0x64/0x170
scan_gray_list+0xe8/0x17c
kmemleak_scan+0x270/0x514
kmemleak_write+0x34c/0x4ac
The memory allocated from memblock is registered with kmemleak, but if
it is marked MEMBLOCK_NOMAP it won't have linear map entries so an
attempt to scan such areas will fault.
Ideally, memblock_mark_nomap() would inform kmemleak to ignore
MEMBLOCK_NOMAP memory, but it can be called before kmemleak interfaces
operating on physical addresses can use __va() conversion.
Make sure that functions that mark allocated memory as MEMBLOCK_NOMAP
take care of informing kmemleak to ignore such memory.
Link: https://lore.kernel.org/all/8ade5174-b143-d621-8c8e-dc6a1898c6fb@linaro.org
Link: https://lore.kernel.org/all/c30ff0a2-d196-c50d-22f0-bd50696b1205@quicinc.com
Fixes: a7259df767 ("memblock: make memblock_find_in_range method private")
Reported-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Tested-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Tested-by: Qian Cai <quic_qiancai@quicinc.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
On VMs with NX encryption, compression, and/or RNG offload, these
capabilities are described by nodes in the ibm,platform-facilities device
tree hierarchy:
$ tree -d /sys/firmware/devicetree/base/ibm,platform-facilities/
/sys/firmware/devicetree/base/ibm,platform-facilities/
├── ibm,compression-v1
├── ibm,random-v1
└── ibm,sym-encryption-v1
3 directories
The acceleration functions that these nodes describe are not disrupted by
live migration, not even temporarily.
But the post-migration ibm,update-nodes sequence firmware always sends
"delete" messages for this hierarchy, followed by an "add" directive to
reconstruct it via ibm,configure-connector (log with debugging statements
enabled in mobility.c):
mobility: removing node /ibm,platform-facilities/ibm,random-v1:4294967285
mobility: removing node /ibm,platform-facilities/ibm,compression-v1:4294967284
mobility: removing node /ibm,platform-facilities/ibm,sym-encryption-v1:4294967283
mobility: removing node /ibm,platform-facilities:4294967286
...
mobility: added node /ibm,platform-facilities:4294967286
Note we receive a single "add" message for the entire hierarchy, and what
we receive from the ibm,configure-connector sequence is the top-level
platform-facilities node along with its three children. The debug message
simply reports the parent node and not the whole subtree.
Also, significantly, the nodes added are almost completely equivalent to
the ones removed; even phandles are unchanged. ibm,shared-interrupt-pool in
the leaf nodes is the only property I've observed to differ, and Linux does
not use that. So in practice, the sum of update messages Linux receives for
this hierarchy is equivalent to minor property updates.
We succeed in removing the original hierarchy from the device tree. But the
vio bus code is ignorant of this, and does not unbind or relinquish its
references. The leaf nodes, still reachable through sysfs, of course still
refer to the now-freed ibm,platform-facilities parent node, which makes
use-after-free possible:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 3 PID: 1706 at lib/refcount.c:25 refcount_warn_saturate+0x164/0x1f0
refcount_warn_saturate+0x160/0x1f0 (unreliable)
kobject_get+0xf0/0x100
of_node_get+0x30/0x50
of_get_parent+0x50/0xb0
of_fwnode_get_parent+0x54/0x90
fwnode_count_parents+0x50/0x150
fwnode_full_name_string+0x30/0x110
device_node_string+0x49c/0x790
vsnprintf+0x1c0/0x4c0
sprintf+0x44/0x60
devspec_show+0x34/0x50
dev_attr_show+0x40/0xa0
sysfs_kf_seq_show+0xbc/0x200
kernfs_seq_show+0x44/0x60
seq_read_iter+0x2a4/0x740
kernfs_fop_read_iter+0x254/0x2e0
new_sync_read+0x120/0x190
vfs_read+0x1d0/0x240
Moreover, the "new" replacement subtree is not correctly added to the
device tree, resulting in ibm,platform-facilities parent node without the
appropriate leaf nodes, and broken symlinks in the sysfs device hierarchy:
$ tree -d /sys/firmware/devicetree/base/ibm,platform-facilities/
/sys/firmware/devicetree/base/ibm,platform-facilities/
0 directories
$ cd /sys/devices/vio ; find . -xtype l -exec file {} +
./ibm,sym-encryption-v1/of_node: broken symbolic link to
../../../firmware/devicetree/base/ibm,platform-facilities/ibm,sym-encryption-v1
./ibm,random-v1/of_node: broken symbolic link to
../../../firmware/devicetree/base/ibm,platform-facilities/ibm,random-v1
./ibm,compression-v1/of_node: broken symbolic link to
../../../firmware/devicetree/base/ibm,platform-facilities/ibm,compression-v1
This is because add_dt_node() -> dlpar_attach_node() attaches only the
parent node returned from configure-connector, ignoring any children. This
should be corrected for the general case, but fixing that won't help with
the stale OF node references, which is the more urgent problem.
One way to address that would be to make the drivers respond to node
removal notifications, so that node references can be dropped
appropriately. But this would likely force the drivers to disrupt active
clients for no useful purpose: equivalent nodes are immediately re-added.
And recall that the acceleration capabilities described by the nodes remain
available throughout the whole process.
The solution I believe to be robust for this situation is to convert
remove+add of a node with an unchanged phandle to an update of the node's
properties in the Linux device tree structure. That would involve changing
and adding a fair amount of code, and may take several iterations to land.
Until that can be realized we have a confirmed use-after-free and the
possibility of memory corruption. So add a limited workaround that
discriminates on the node type, ignoring adds and removes. This should be
amenable to backporting in the meantime.
Fixes: 410bccf978 ("powerpc/pseries: Partition migration in the kernel")
Cc: stable@vger.kernel.org
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211020194703.2613093-1-nathanl@linux.ibm.com
Long time ago we had a config item called STRICT_MM_TYPECHECKS
to build the kernel with pte_t defined as a structure in order
to perform additional build checks or build it with pte_t
defined as a simple type in order to get simpler generated code.
Commit 670eea9241 ("powerpc/mm: Always use STRICT_MM_TYPECHECKS")
made the struct based definition the only one, considering that the
generated code was similar in both cases.
That's right on ppc64 because the ABI is such that the content of a
struct having a single simple type element is passed as register,
but on ppc32 such a structure is passed via the stack like any
structure.
Simple test function:
pte_t test(pte_t pte)
{
return pte;
}
Before this patch we get
c00108ec <test>:
c00108ec: 81 24 00 00 lwz r9,0(r4)
c00108f0: 91 23 00 00 stw r9,0(r3)
c00108f4: 4e 80 00 20 blr
So, for PPC32, restore the simple type behaviour we got before
commit 670eea9241, but instead of adding a config option to
activate type check, do it when __CHECKER__ is set so that type
checking is performed by 'sparse' and provides feedback like:
arch/powerpc/mm/pgtable.c:466:16: warning: incorrect type in return expression (different base types)
arch/powerpc/mm/pgtable.c:466:16: expected unsigned long
arch/powerpc/mm/pgtable.c:466:16: got struct pte_t [usertype] x
With this patch we now get
c0010890 <test>:
c0010890: 4e 80 00 20 blr
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
[mpe: Define STRICT_MM_TYPECHECKS rather than repeating the condition]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/c904599f33aaf6bb7ee2836a9ff8368509e0d78d.1631887042.git.christophe.leroy@csgroup.eu
CONFIG_STRICT_KERNEL_RWX should be set by default on every
architectures (See https://github.com/KSPP/linux/issues/4)
On PPC32 we have to find a compromise between performance and/or
memory wasting and selection of strict_kernel_rwx, because it implies
either smaller memory chunks or larger alignment between RO memory
and RW memory.
For instance the 8xx maps memory with 8M pages. So either the limit
between RO and RW must be 8M aligned or it falls back or 512k pages
which implies more pressure on the TLB.
book3s/32 maps memory with BATs as much as possible. BATS can have
any power-of-two size between 128k and 256M but we have only 4 to 8
BATs so the alignment must be good enough to allow efficient use of
the BATs and avoid falling back on standard page mapping which would
kill performance.
So let's go one step forward and make it the default but still allow
users to unset it when wanted.
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/057c40164084bfc7d77c0b2ff78d95dbf6a2a21b.1632503622.git.christophe.leroy@csgroup.eu
In the old days, when we didn't have kernel userspace access
protection and had set_fs(), it was wise to use __get_user()
and friends to read kernel memory.
Nowadays, get_user() and put_user() are granting userspace access and
are exclusively for userspace access.
Convert single step emulation functions to user_access_begin() and
friends and use unsafe_get_user() and unsafe_put_user().
When addressing kernel addresses, there is no need to open userspace
access. And for book3s/32 it is particularly important to no try and
open userspace access on kernel address, because that would break the
content of kernel space segment registers. No guard has been put
against that risk in order to avoid degrading performance.
copy_from_kernel_nofault() and copy_to_kernel_nofault() should
be used but they are out-of-line functions which would degrade
performance. Those two functions are making use of
__get_kernel_nofault() and __put_kernel_nofault() macros.
Those two macros are just wrappers behind __get_user_size_goto() and
__put_user_size_goto().
unsafe_get_user() and unsafe_put_user() are also wrappers of
__get_user_size_goto() and __put_user_size_goto(). Use them to
access kernel space. That allows refactoring userspace and
kernelspace access.
Reported-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Depends-on: 4fe5cda9f8 ("powerpc/uaccess: Implement user_read_access_begin and user_write_access_begin")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/22831c9d17f948680a12c5292e7627288b15f713.1631817805.git.christophe.leroy@csgroup.eu
dcbz instruction shouldn't be used on non-cached memory. Using
it on non-cached memory can result in alignment exception and
implies a heavy handling.
Instead of silentely emulating the instruction and resulting in high
performance degradation, warn whenever an alignment exception is
taken in kernel mode due to dcbz, so that the user is made aware that
dcbz instruction has been used unexpectedly by the kernel.
Reported-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/2e3acfe63d289c6fba366e16973c9ab8369e8b75.1631803922.git.christophe.leroy@csgroup.eu
