1. 18 Nov, 2018 7 commits
  2. 17 Nov, 2018 7 commits
  3. 16 Nov, 2018 5 commits
  4. 15 Nov, 2018 12 commits
  5. 14 Nov, 2018 1 commit
  6. 13 Nov, 2018 6 commits
  7. 12 Nov, 2018 2 commits
    • Sudarsana Reddy Kalluru's avatar
      bnx2x: Assign unique DMAE channel number for FW DMAE transactions. · 77e461d1
      Sudarsana Reddy Kalluru authored
      Driver assigns DMAE channel 0 for FW as part of START_RAMROD command. FW
      uses this channel for DMAE operations (e.g., TIME_SYNC implementation).
      Driver also uses the same channel 0 for DMAE operations for some of the PFs
      (e.g., PF0 on Port0). This could lead to concurrent access to the DMAE
      channel by FW and driver which is not legal. Hence need to assign unique
      DMAE id for FW.
      Currently following DMAE channels are used by the clients,
        MFW - OCBB/OCSD functionality uses DMAE channel 14/15
        Driver 0-3 and 8-11 (for PF dmae operations)
               4 and 12 (for stats requests)
      Assigning unique dmae_id '13' to the FW.
      
      Changes from previous version:
      ------------------------------
      v2: Incorporated the review comments.
      Signed-off-by: default avatarSudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
      Signed-off-by: default avatarMichal Kalderon <Michal.Kalderon@cavium.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      77e461d1
    • Sven Eckelmann's avatar
      batman-adv: Expand merged fragment buffer for full packet · d7d8bbb4
      Sven Eckelmann authored
      The complete size ("total_size") of the fragmented packet is stored in the
      fragment header and in the size of the fragment chain. When the fragments
      are ready for merge, the skbuff's tail of the first fragment is expanded to
      have enough room after the data pointer for at least total_size. This means
      that it gets expanded by total_size - first_skb->len.
      
      But this is ignoring the fact that after expanding the buffer, the fragment
      header is pulled by from this buffer. Assuming that the tailroom of the
      buffer was already 0, the buffer after the data pointer of the skbuff is
      now only total_size - len(fragment_header) large. When the merge function
      is then processing the remaining fragments, the code to copy the data over
      to the merged skbuff will cause an skb_over_panic when it tries to actually
      put enough data to fill the total_size bytes of the packet.
      
      The size of the skb_pull must therefore also be taken into account when the
      buffer's tailroom is expanded.
      
      Fixes: 610bfc6b ("batman-adv: Receive fragmented packets and merge")
      Reported-by: default avatarMartin Weinelt <martin@darmstadt.freifunk.net>
      Co-authored-by: default avatarLinus Lüssing <linus.luessing@c0d3.blue>
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
      d7d8bbb4