4.4.223-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 4.4.223-rc1 review
This is the start of the stable review cycle for the 4.4.223 release. There are 312 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 10 May 2020 12:29:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.223-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.223-rc1
Thomas Pedersen <[email protected]>
mac80211: add ieee80211_is_any_nullfunc()
Takashi Iwai <[email protected]>
ALSA: hda: Match both PCI ID and SSID for driver blacklist
Jere Leppänen <[email protected]>
sctp: Fix SHUTDOWN CTSN Ack in the peer restart case
Herbert Xu <[email protected]>
macvlan: Fix potential use-after free for broadcasts
Florian Fainelli <[email protected]>
net: ep93xx_eth: Do not crash unloading module
Shmulik Ladkani <[email protected]>
net: skbuff: Remove errornous length validation in skb_vlan_pop()
Ivan Vecera <[email protected]>
bna: add missing per queue ethtool stat
Toshiaki Makita <[email protected]>
bridge: Fix problems around fdb entries pointing to the bridge device
Arend Van Spriel <[email protected]>
brcmfmac: restore stopping netdev queue when bus clogs up
Jaap Jan Meijer <[email protected]>
brcmfmac: add fallback for devices that do not report per-chain values
Laxman Dewangan <[email protected]>
pinctrl: tegra: Correctly check the supported configuration
Mans Rullgard <[email protected]>
ata: sata_dwc_460ex: remove incorrect locking
Neil Armstrong <[email protected]>
net: ethernet: davinci_emac: Fix platform_data overwrite
Aneesh Kumar K.V <[email protected]>
cxl: Fix DAR check & use REGION_ID instead of opencoding
Javier Martinez Canillas <[email protected]>
regulator: Try to resolve regulators supplies on registration
Sergei Shtylyov <[email protected]>
at803x: fix reset handling
Vivien Didelot <[email protected]>
net: dsa: mv88e6xxx: fix port VLAN maps
Charles Keepax <[email protected]>
regulator: core: Rely on regulator_dev_release to free constraints
Nicolas Schichan <[email protected]>
net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.
Nicolas Dichtel <[email protected]>
ovs/vxlan: fix rtnl notifications on iface deletion
Florian Fainelli <[email protected]>
net: ethoc: Fix early error paths
pravin shelar <[email protected]>
net: vxlan: lwt: Fix vxlan local traffic.
Arnd Bergmann <[email protected]>
mvpp2: use correct size for memset
Geert Uytterhoeven <[email protected]>
ravb: Add missing free_irq() call to ravb_close()
Cyrille Pitchen <[email protected]>
net: macb: replace macb_writel() call by queue_writel() to update queue ISR
Jisheng Zhang <[email protected]>
net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats
David Ahern <[email protected]>
net: icmp_route_lookup should use rt dev to determine L3 domain
Krzysztof Kozlowski <[email protected]>
hwrng: exynos - Disable runtime PM on driver unbind
Sabrina Dubroca <[email protected]>
l2tp: fix use-after-free during module unload
[email protected] <[email protected]>
net: ehea: avoid null pointer dereference
Vivien Didelot <[email protected]>
net: dsa: mv88e6xxx: enable SA learning on DSA ports
Nikolay Aleksandrov <[email protected]>
net: bridge: don't increment tx_dropped in br_do_proxy_arp
Johan Hovold <[email protected]>
net: hns: fix device reference leaks
Johan Hovold <[email protected]>
net: ethernet: ti: cpsw: fix secondary-emac probe error path
Johan Hovold <[email protected]>
net: ethernet: ti: cpsw: fix device and of_node leaks
Andrew Lunn <[email protected]>
net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented
Neil Armstrong <[email protected]>
net: ethernet: davinci_emac: Fix devioctl while in fixed link
Florian Fainelli <[email protected]>
bnxt_en: Remove locking around txr->dev_state
Wei Yongjun <[email protected]>
net: axienet: Fix return value check in axienet_probe()
Eric Dumazet <[email protected]>
qdisc: fix a module refcount leak in qdisc_create_dflt()
Eric Dumazet <[email protected]>
bnxt: add a missing rcu synchronization
Nicolas Dichtel <[email protected]>
ovs/geneve: fix rtnl notifications on iface deletion
Johan Hovold <[email protected]>
net: ethernet: stmmac: dwmac-generic: fix probe error path
Eric Dumazet <[email protected]>
fq_codel: return non zero qlen in class dumps
Johan Hovold <[email protected]>
net: ethernet: stmmac: dwmac-rk: fix probe error path
Mathias Krause <[email protected]>
rtnl: reset calcit fptr in rtnl_unregister()
Johan Hovold <[email protected]>
net: ethernet: stmmac: dwmac-sti: fix probe error path
Florian Fainelli <[email protected]>
et131x: Fix logical vs bitwise check in et131x_tx_timeout()
David Ahern <[email protected]>
net: icmp6_send should use dst dev to determine L3 domain
Wei Yongjun <[email protected]>
tipc: fix the error handling in tipc_udp_enable()
Eric Dumazet <[email protected]>
macvtap: segmented packet is consumed
Wei Yongjun <[email protected]>
net: macb: add missing free_netdev() on error in macb_probe()
Jiri Benc <[email protected]>
cxgbi: fix uninitialized flowi6
Florian Fainelli <[email protected]>
net: bcmsysport: Device stats are unsigned long
Bert Kenward <[email protected]>
sfc: clear napi_hash state when copying channels
Andrew Rybchenko <[email protected]>
sfc: fix potential stack corruption from running past stat bitmask
Jiri Benc <[email protected]>
gre: reject GUE and FOU in collect metadata mode
Jiri Benc <[email protected]>
gre: build header correctly for collect metadata tunnels
Jiri Benc <[email protected]>
gre: do not assign header_ops in collect metadata mode
Nicolas Dichtel <[email protected]>
ovs/gre: fix rtnl notifications on iface deletion
Eric Dumazet <[email protected]>
net: bcmgenet: device stats are unsigned long
Petri Gynther <[email protected]>
net: bcmgenet: fix skb_len in bcmgenet_xmit_single()
Hariprasad Shenai <[email protected]>
cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled
Simon Horman <[email protected]>
openvswitch: update checksum in {push,pop}_mpls
Addy Ke <[email protected]>
spi: rockchip: modify DMA max burst to 1
Peter Ujfalusi <[email protected]>
dmaengine: edma: Add probe callback to edma_tptc_driver
Tahsin Erdogan <[email protected]>
dm: fix second blk_delay_queue() parameter to be in msec units not jiffies
Bartlomiej Zolnierkiewicz <[email protected]>
blk-mq: fix undefined behaviour in order_to_size()
Junxiao Bi <[email protected]>
gfs2: fix flock panic issue
Vivien Didelot <[email protected]>
net: dsa: mv88e6xxx: unlock DSA and CPU ports
Viresh Kumar <[email protected]>
Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT"
Marcin Nowakowski <[email protected]>
MIPS: perf: Remove incorrect odd/even counter handling for I6400
Tobias Jungel <[email protected]>
bonding: fix length of actor system
Andy Shevchenko <[email protected]>
ALSA: fm801: Initialize chip after IRQ handler is registered
Chuck Lever <[email protected]>
xprtrdma: Fix backchannel allocation of extra rpcrdma_reps
Eric Dumazet <[email protected]>
mlx4: do not call napi_schedule() without care
David Ahern <[email protected]>
ipv4: Fix table id reference in fib_sync_down_addr
Nicolas Dichtel <[email protected]>
vti6: fix input path
Mark Tomlinson <[email protected]>
net: Don't delete routes in different VRFs
David Ahern <[email protected]>
net: vrf: Fix dst reference counting
Marcin Niestroj <[email protected]>
power_supply: tps65217-charger: Fix NULL deref during property export
Liu Xiang <[email protected]>
power: bq27xxx_battery: Fix bq27541 AveragePower register address
Sasha Levin <[email protected]>
power: test_power: correctly handle empty writes
H. Nikolaus Schaller <[email protected]>
power: bq27xxx: fix register numbers of bq27500
H. Nikolaus Schaller <[email protected]>
power: bq27xxx: fix reading for bq27000 and bq27010
Peter Zijlstra <[email protected]>
sched/preempt: Fix preempt_count manipulations
Eric Dumazet <[email protected]>
pkt_sched: fq: use proper locking in fq_dump_stats()
Hadar Hen Zion <[email protected]>
net_sched: flower: Avoid dissection of unmasked keys
Peter Zijlstra <[email protected]>
sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion
Elad Raz <[email protected]>
mlxsw: switchx2: Fix ethernet port initialization
Yotam Gigi <[email protected]>
mlxsw: switchx2: Fix misuse of hard_header_len
Moshe Shemesh <[email protected]>
net/mlx4_core: Fix QUERY FUNC CAP flags
Jack Morgenstein <[email protected]>
net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering
Jack Morgenstein <[email protected]>
net/mlx4_en: Fix potential deadlock in port statistics flow
Jack Morgenstein <[email protected]>
net/mlx4_core: Do not access comm channel if it has not yet been initialized
Erez Shitrit <[email protected]>
net/mlx4_en: Process all completions in RX rings after port goes up
Jack Morgenstein <[email protected]>
net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec
Alex Vesker <[email protected]>
net/mlx4_core: Check device state before unregistering it
Kamal Heib <[email protected]>
net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill
Tariq Toukan <[email protected]>
net/mlx4_core: Fix access to uninitialized index
Eran Ben Elisha <[email protected]>
net/mlx4_core: Fix potential corruption in counters database
Daniel Borkmann <[email protected]>
bpf: fix map not being uncharged during map creation failure
Alexei Starovoitov <[email protected]>
bpf, trace: check event type in bpf_perf_event_read
Zi Shen Lim <[email protected]>
arm64: bpf: jit JMP_JSET_{X,K}Daniel Borkmann <[email protected]>
cls_bpf: reset class and reuse major in da
Laura Abbott <[email protected]>
clk: xgene: Don't call __pa on ioremaped address
Dong Aisheng <[email protected]>
clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit
Maxime Ripard <[email protected]>
clk: multiplier: Prevent the multiplier from under / over flowing
Tero Kristo <[email protected]>
clk: ti: omap3+: dpll: use non-locking version of clk_get_rate
Brian Norris <[email protected]>
clk: gpio: handle error codes for of_clk_get_parent_count()
Arnd Bergmann <[email protected]>
clk: st: avoid uninitialized variable use
Pablo Neira <[email protected]>
udp: restore UDPlite many-cast delivery
Liping Zhang <[email protected]>
netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it
Liping Zhang <[email protected]>
netfilter: nf_tables: destroy the set if fail to add transaction
Liping Zhang <[email protected]>
netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled
Liping Zhang <[email protected]>
netfilter: nf_tables: fix a wrong check to skip the inactive rules
David Ahern <[email protected]>
net: ipv6: Fix processing of RAs in presence of VRF
Nicolas Dichtel <[email protected]>
ipv6: add missing netconf notif when 'all' is updated
Eric Dumazet <[email protected]>
ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf()
Hannes Frederic Sowa <[email protected]>
ipv6: fix checksum annotation in udp6_csum_init
David Ahern <[email protected]>
net: vrf: Fix dev refcnt leak due to IPv6 prefix route
Eric Dumazet <[email protected]>
ipv4: accept u8 in IP_TOS ancillary data
Eric Dumazet <[email protected]>
ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf()
Hannes Frederic Sowa <[email protected]>
ipv4: fix checksum annotation in udp4_csum_init
Alexander Duyck <[email protected]>
flow_dissector: Check for IP fragmentation even if not using IPv4 address
Alexander Duyck <[email protected]>
ipv4: Fix memory leak in exception case for splitting tries
Douglas Miller <[email protected]>
be2net: Don't leak iomapped memory on removal.
Stefan Wahren <[email protected]>
pinctrl: bcm2835: Fix memory leak in error path
Vince Hsu <[email protected]>
memory/tegra: Add number of TLB lines for Tegra124
Bart Van Assche <[email protected]>
target: Fix a memory leak in target_dev_lba_map_store()
Dan Carpenter <[email protected]>
qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag()
Dan Carpenter <[email protected]>
qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template()
Dan Carpenter <[email protected]>
qede: uninitialized variable in qede_start_xmit()
Dan Carpenter <[email protected]>
i40e: fix an uninitialized variable bug
Dan Carpenter <[email protected]>
power: ipaq-micro-battery: freeing the wrong variable
Dan Carpenter <[email protected]>
ethernet: micrel: fix some error codes
Dan Carpenter <[email protected]>
mfd: lp8788-irq: Uninitialized variable in irq handler
Dan Carpenter <[email protected]>
net: moxa: fix an error code
Dan Carpenter <[email protected]>
VFIO: platform: reset: fix a warning message condition
Dan Carpenter <[email protected]>
ath9k_htc: check for underflow in ath9k_htc_rx_msg()
Dan Carpenter <[email protected]>
cx23885: uninitialized variable in cx23885_av_work_handler()
Dan Carpenter <[email protected]>
am437x-vpfe: fix an uninitialized variable bug
Alexey Khoroshilov <[email protected]>
lirc_imon: do not leave imon_probe() with mutex held
Russell King <[email protected]>
rc: allow rc modules to be loaded if rc-main is not a module
Doug Berger <[email protected]>
net: systemport: suppress warnings on failed Rx SKB allocations
Doug Berger <[email protected]>
net: bcmgenet: suppress warnings on failed Rx SKB allocations
Nathan Chancellor <[email protected]>
lib/mpi: Fix building for powerpc with clang
Jeremie Francois (on alpha) <[email protected]>
scripts/config: allow colons in option strings for sed
Ronnie Sahlberg <[email protected]>
cifs: protect updating server->dstaddr with a spinlock
Xiyu Yang <[email protected]>
wimax/i2400m: Fix potential urb refcnt leak
Tyler Hicks <[email protected]>
selftests/ipc: Fix test failure seen after initial test run
YueHaibing <[email protected]>
iio:ad7797: Use correct attribute_group
Dan Carpenter <[email protected]>
mdio-sun4i: oops in error handling in probe
Robin Murphy <[email protected]>
iommu/dma: Respect IOMMU aperture when allocating
David Rivshin <[email protected]>
drivers: net: cpsw: don't ignore phy-mode if phy-handle is used
Johan Hovold <[email protected]>
net: dsa: slave: fix of-node leak and phy priority
Roosen Henri <[email protected]>
phy: micrel: Fix finding PHY properties in MAC node for KSZ9031.
Johan Hovold <[email protected]>
of_mdio: fix node leak in of_phy_register_fixed_link error path
Florian Fainelli <[email protected]>
net: phy: bcm7xxx: Fix shadow mode 2 disabling
Florian Fainelli <[email protected]>
net: phy: Fix phy_mac_interrupt()
Florian Fainelli <[email protected]>
net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS
Dan Carpenter <[email protected]>
NFC: nci: memory leak in nci_core_conn_create()
Chuck Lever <[email protected]>
sunrpc: Update RPCBIND_MAXNETIDLEN
Xin Long <[email protected]>
sctp: fix the transports round robin issue when init is retransmitted
Mahesh Salgaonkar <[email protected]>
powerpc/book3s: Fix MCE console messages for unrecoverable MCE.
Michael Neuling <[email protected]>
powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint()
Naveen N. Rao <[email protected]>
perf tools: Fix perf regs mask generation
Adrian Hunter <[email protected]>
mmc: sdhci: Fix regression setting power on Trats2 board
Nicholas Mc Guire <[email protected]>
mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type
Douglas Anderson <[email protected]>
mmc: dw_mmc: rockchip: Set the drive phase properly
Douglas Anderson <[email protected]>
clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization"
Olof Johansson <[email protected]>
mmc: block: return error on failed mmc_blk_get()
Chuanxiao Dong <[email protected]>
mmc: debugfs: correct wrong voltage value
Russell King <[email protected]>
mmc: sd: limit SD card power limit according to cards capabilities
Jisheng Zhang <[email protected]>
mmc: sdhci: restore behavior when setting VDD via external regulator
Andy Shevchenko <[email protected]>
Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
Maciej S. Szmigiero <[email protected]>
ASoC: fsl_ssi: mark SACNT register volatile
Sudip Mukherjee <[email protected]>
ASoC: tegra_alc5632: check return value
Dan Carpenter <[email protected]>
ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()
Robert Jarzmik <[email protected]>
mtd: nand: pxa3xx_nand: fix dmaengine initialization
Boris Brezillon <[email protected]>
mtd: nand: denali: add missing nand_release() call in denali_remove()
Eric Dumazet <[email protected]>
net: get rid of an signed integer overflow in ip_idents_reserve()
Chuck Lever <[email protected]>
NFS: Fix an LOCK/OPEN race when unlinking an open file
Ilan Peer <[email protected]>
mac80211: Fix BW upgrade for TDLS peers
Arik Nemtsov <[email protected]>
mac80211: TDLS: change BW calculation for WIDER_BW peers
Arik Nemtsov <[email protected]>
mac80211: TDLS: always downgrade invalid chandefs
Johannes Berg <[email protected]>
mac80211: fix mgmt-tx abort cookie and leak
Ilan Tayari <[email protected]>
xfrm: Fix memory leak of aead algorithm name
Mathias Krause <[email protected]>
xfrm_user: propagate sec ctx allocation errors
Alexey Kodanev <[email protected]>
net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key
Philipp Zabel <[email protected]>
Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree
Dmitry Torokhov <[email protected]>
Input: gpio-keys - fix check for disabling unsupported keys
Dan Carpenter <[email protected]>
Btrfs: clean up an error code in btrfs_init_space_info()
William Breathitt Gray <[email protected]>
isa: Call isa_bus_init before dependent ISA bus drivers register
Olaf Hering <[email protected]>
Drivers: hv: utils: use memdup_user in hvt_op_write
Krzysztof Kozlowski <[email protected]>
serial: samsung: Fix possible out of bounds access on non-DT platform
Stephen Boyd <[email protected]>
tty: serial: msm: Support more bauds
Simon Wunderlich <[email protected]>
batman-adv: replace WARN with rate limited output on non-existing VLAN
Sven Eckelmann <[email protected]>
batman-adv: Fix lockdep annotation of batadv_tlv_container_remove
David Ahern <[email protected]>
net: ipv6: tcp reset, icmp need to consider L3 domain
Sowmini Varadhan <[email protected]>
RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock
Eric Dumazet <[email protected]>
tcp: do not set rtt_min to 1
Johannes Weiner <[email protected]>
net: tcp_memcontrol: properly detect ancestor socket pressure
Yotam Gigi <[email protected]>
mlxsw: spectrum: Fix misuse of hard_header_len
Ido Schimmel <[email protected]>
mlxsw: spectrum: Indicate support for autonegotiation
Nogah Frankel <[email protected]>
mlxsw: spectrum: Don't count internal TX header bytes to stats
Ido Schimmel <[email protected]>
mlxsw: spectrum: Disable learning according to STP state
Ido Schimmel <[email protected]>
mlxsw: spectrum: Don't forward packets when STP state is DISABLED
Honggang Li <[email protected]>
RDMA/cxgb3: device driver frees DMA memory with different size
Chuck Lever <[email protected]>
xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len
Chuck Lever <[email protected]>
xprtrdma: xprt_rdma_free() must not release backchannel reqs
Chuck Lever <[email protected]>
xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock)
Dan Carpenter <[email protected]>
xprtrdma: checking for NULL instead of IS_ERR()
Raja Mani <[email protected]>
ath10k: free cached fw bin contents when get board id fails
Boris Brezillon <[email protected]>
mtd: nand: fix ONFI parameter page layout
Eric Dumazet <[email protected]>
bonding: prevent out of bound accesses
Johan Hovold <[email protected]>
phy: fix device reference leaks
[email protected] <[email protected]>
irda: Free skb on irda_accept error path.
Jiri Kosina <[email protected]>
btrfs: cleaner_kthread() doesn't need explicit freeze
WANG Cong <[email protected]>
sch_tbf: update backlog as well
WANG Cong <[email protected]>
sch_sfb: keep backlog updated with qlen
WANG Cong <[email protected]>
sch_qfq: keep backlog updated with qlen
WANG Cong <[email protected]>
sch_prio: update backlog as well
WANG Cong <[email protected]>
sch_hfsc: always keep backlog updated
WANG Cong <[email protected]>
sch_drr: update backlog as well
WANG Cong <[email protected]>
net_sched: keep backlog updated with qlen
Matthew Finlay <[email protected]>
net/mlx5e: Copy all L2 headers into inline segment
Mohamad Haj Yahia <[email protected]>
net/mlx5: Fix pci error recovery flow
Mohamad Haj Yahia <[email protected]>
net/mlx5: Add timeout handle to commands with callback
Mohamad Haj Yahia <[email protected]>
net/mlx5: Fix potential deadlock in command mode change
Daniel Jurgens <[email protected]>
net/mlx5: Fix wait_vital for VFs and remove fixed sleep
Mohamad Haj Yahia <[email protected]>
net/mlx5: Avoid calling sleeping function by the health poll thread
Wang Sheng-Hui <[email protected]>
net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create
Eli Cohen <[email protected]>
net/mlx5e: Fix blue flame quota logic
Majd Dibbiny <[email protected]>
net/mlx5: Fix masking of reserved bits in XRCD number
Majd Dibbiny <[email protected]>
net/mlx5: Fix the size of modify QP mailbox
Rana Shahout <[email protected]>
net/mlx5e: Fix MLX5E_100BASE_T define
Eran Ben Elisha <[email protected]>
IB/mlx5: Fix FW version diaplay in sysfs
Or Gerlitz <[email protected]>
net/mlx5: Make command timeout way shorter
Leon Romanovsky <[email protected]>
IB/mlx5: Fix RC transport send queue overhead computation
Noa Osherovich <[email protected]>
net/mlx5: Avoid passing dma address 0 to firmware
Peter Griffin <[email protected]>
c8sectpfe: Rework firmware loading mechanism
Brian Norris <[email protected]>
firmware: actually return NULL on failed request_firmware_nowait()
Alexey Kardashevskiy <[email protected]>
powerpc/pci/of: Parse unassigned resources
Alexander Duyck <[email protected]>
GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU
Nicolas Dichtel <[email protected]>
ovs/gre,geneve: fix error path when creating an iface
Matan Barak <[email protected]>
IB/mlx4: Initialize hop_limit when creating address handle
Ido Schimmel <[email protected]>
mlxsw: Treat local port 64 as valid
Franky Lin <[email protected]>
brcmfmac: add eth_type_trans back for PCIe full dongle
Alex Williamson <[email protected]>
vfio/pci: Allow VPD short read
Bjorn Helgaas <[email protected]>
alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO
Daniel Jurgens <[email protected]>
net/mlx4_core: Implement pci_resume callback
Bjorn Helgaas <[email protected]>
PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive()
Ido Schimmel <[email protected]>
mlxsw: pci: Correctly determine if descriptor queue is full
Daniel Jurgens <[email protected]>
net/mlx4_core: Do not BUG_ON during reset when PCI is offline
Willem de Bruijn <[email protected]>
dccp: limit sk_filter trim to payload
Chin-Ran Lo <[email protected]>
Bluetooth: btmrvl: fix hung task warning dump
Emmanuel Grumbach <[email protected]>
iwlwifi: set max firmware version of 7265 to 17
Amitkumar Karwar <[email protected]>
mwifiex: add missing check for PCIe8997 chipset
chunfan chen <[email protected]>
mwifiex: fix IBSS data path issue.
Vegard Nossum <[email protected]>
xfrm: fix crash in XFRM_MSG_GETSA netlink handler
Pablo Neira Ayuso <[email protected]>
netfilter: nfnetlink: use original skbuff when acking batches
Andy Shevchenko <[email protected]>
ALSA: fm801: detect FM-only card earlier
Andy Shevchenko <[email protected]>
ALSA: fm801: propagate TUNER_ONLY bit when autodetected
Andy Shevchenko <[email protected]>
ALSA: fm801: explicitly free IRQ line
Dan Carpenter <[email protected]>
x86/apic/uv: Silence a shift wrapping warning
Jan Beulich <[email protected]>
x86/LDT: Print the real LDT base address
Stephane Eranian <[email protected]>
perf/x86: Fix filter_events() bug with event mappings
Suman Anna <[email protected]>
ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence
Heinrich Schuchardt <[email protected]>
ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile
Heinrich Schuchardt <[email protected]>
ARM: dts: kirkwood: use unique machine name for ds112
Roger Shimizu <[email protected]>
ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl
Roger Shimizu <[email protected]>
ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl
Roger Shimizu <[email protected]>
ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl
Roger Shimizu <[email protected]>
ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl
Roger Shimizu <[email protected]>
ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl
Roger Shimizu <[email protected]>
ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl
Arnd Bergmann <[email protected]>
ARM: imx: select SRC for i.MX7
Geert Uytterhoeven <[email protected]>
ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz
Hidehiro Kawai <[email protected]>
mips/panic: replace smp_send_stop() with kdump friendly version in panic path
James Hogan <[email protected]>
MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
Dan Carpenter <[email protected]>
MIPS: RM7000: Double locking bug in rm7k_tc_disable()
Daniel Borkmann <[email protected]>
bpf, mips: fix off-by-one in ctx offset allocation
Dan Carpenter <[email protected]>
MIPS: Octeon: Off by one in octeon_irq_gpio_map()
James Hogan <[email protected]>
MIPS: c-r4k: Fix protected_writeback_scache_line for EVA
James Hogan <[email protected]>
MIPS: SMP: Update cpu_foreign_map on CPU disable
James Hogan <[email protected]>
MIPS: KVM: Fix translation of MFC0 ErrCtl
James Hogan <[email protected]>
MIPS: Fix little endian microMIPS MSA encodings
James Hogan <[email protected]>
MIPS: Fix 64-bit HTW configuration
James Hogan <[email protected]>
MIPS: perf: Fix I6400 event numbers
Paul Burton <[email protected]>
MIPS: math-emu: Fix m{add,sub}.s shifts
Paul Burton <[email protected]>
MIPS: Fix BC1{EQ,NE}Z return offset calculation
Paul Burton <[email protected]>
MIPS: math-emu: Fix BC1{EQ,NE}Z emulation
Florian Fainelli <[email protected]>
MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435
James Hogan <[email protected]>
MIPS: Fix HTW config on XPA kernel without LPA enabled
Florian Fainelli <[email protected]>
MIPS: BMIPS: Pretty print BMIPS5200 processor name
Florian Fainelli <[email protected]>
MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache
Florian Fainelli <[email protected]>
MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier
Florian Fainelli <[email protected]>
MIPS: BMIPS: BMIPS5000 has I cache filing from D cache
Matt Redfearn <[email protected]>
MIPS: scall: Handle seccomp filters which redirect syscalls
Paul Burton <[email protected]>
MIPS: smp-cps: Stop printing EJTAG exceptions to UART
Florian Fainelli <[email protected]>
MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200
James Hogan <[email protected]>
MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[]
Jaedon Shin <[email protected]>
MIPS: Fix macro typo
Felipe Balbi <[email protected]>
usb: gadget: udc: core: don't starve DMA resources
Iago Abal <[email protected]>
usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock
Andy Shevchenko <[email protected]>
usb: gadged: pch_udc: get rid of redundant assignments
Krzysztof Opasiak <[email protected]>
usb: gadget: f_acm: Fix configfs attr name
Ben Hutchings <[email protected]>
staging: rtl8192u: Fix crash due to pointers being "confusing"
Vasily Averin <[email protected]>
drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
Vasily Averin <[email protected]>
drm/qxl: qxl_release use after free
Amitkumar Karwar <[email protected]>
mwifiex: fix PCIe register information for 8997 chipset
-------------
Diffstat:
Makefile | 4 +- arch/alpha/kernel/pci-sysfs.c | 4 +- arch/arm/boot/dts/Makefile | 1 + arch/arm/boot/dts/kirkwood-ds112.dts | 2 +- arch/arm/boot/dts/kirkwood-lswvl.dts | 25 +-- arch/arm/boot/dts/kirkwood-lswxl.dts | 31 ++-- arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts | 39 ++++- arch/arm/boot/dts/r8a7740-armadillo800eva.dts | 2 +- arch/arm/mach-imx/Kconfig | 1 + arch/arm/mach-omap2/omap_hwmod.c | 12 +- arch/arm64/net/bpf_jit_comp.c | 1 + arch/mips/boot/dts/brcm/bcm7435.dtsi | 2 +- arch/mips/cavium-octeon/octeon-irq.c | 2 +- arch/mips/cavium-octeon/setup.c | 14 ++ arch/mips/cavium-octeon/smp.c | 1 + arch/mips/include/asm/asmmacro.h | 99 ++++++------ arch/mips/include/asm/elf.h | 1 + arch/mips/include/asm/kexec.h | 1 + arch/mips/include/asm/msa.h | 21 +-- arch/mips/include/asm/r4kcache.h | 4 + arch/mips/include/asm/smp.h | 2 + arch/mips/include/uapi/asm/auxvec.h | 2 + arch/mips/kernel/bmips_vec.S | 9 +- arch/mips/kernel/branch.c | 18 +-- arch/mips/kernel/cps-vec.S | 1 - arch/mips/kernel/cpu-probe.c | 5 +- arch/mips/kernel/crash.c | 18 ++- arch/mips/kernel/machine_kexec.c | 1 + arch/mips/kernel/perf_event_mipsxx.c | 60 ++++++- arch/mips/kernel/ptrace.c | 3 - arch/mips/kernel/scall32-o32.S | 11 +- arch/mips/kernel/scall64-64.S | 3 +- arch/mips/kernel/scall64-n32.S | 14 +- arch/mips/kernel/scall64-o32.S | 14 +- arch/mips/kernel/setup.c | 2 +- arch/mips/kernel/smp-bmips.c | 1 + arch/mips/kernel/smp-cps.c | 1 + arch/mips/kernel/smp.c | 2 +- arch/mips/kvm/dyntrans.c | 2 +- arch/mips/loongson64/loongson-3/smp.c | 1 + arch/mips/math-emu/cp1emu.c | 11 +- arch/mips/math-emu/ieee754sp.c | 3 +- arch/mips/math-emu/ieee754sp.h | 16 +- arch/mips/math-emu/sp_add.c | 6 +- arch/mips/math-emu/sp_maddf.c | 13 +- arch/mips/math-emu/sp_sub.c | 6 +- arch/mips/mm/c-r4k.c | 13 +- arch/mips/mm/sc-rm7k.c | 2 +- arch/mips/mm/tlbex.c | 16 +- arch/mips/net/bpf_jit.c | 2 +- arch/powerpc/kernel/mce.c | 3 +- arch/powerpc/kernel/pci_of_scan.c | 12 +- arch/powerpc/kernel/tm.S | 3 +- arch/powerpc/platforms/powernv/opal.c | 1 + arch/x86/kernel/apic/x2apic_uv_x.c | 4 +- arch/x86/kernel/cpu/perf_event.c | 11 +- arch/x86/kernel/process_64.c | 2 +- block/blk-mq.c | 2 +- drivers/acpi/acpi_lpss.c | 8 +- drivers/ata/sata_dwc_460ex.c | 4 +- drivers/base/firmware_class.c | 8 +- drivers/base/isa.c | 2 +- drivers/bluetooth/btmrvl_sdio.c | 3 +- drivers/char/hw_random/exynos-rng.c | 9 ++ drivers/clk/clk-gpio.c | 6 +- drivers/clk/clk-multiplier.c | 20 ++- drivers/clk/clk-xgene.c | 10 +- drivers/clk/imx/clk-pllv3.c | 8 +- drivers/clk/rockchip/clk-mmc-phase.c | 11 -- drivers/clk/st/clkgen-fsyn.c | 17 +- drivers/clk/ti/dpll3xxx.c | 3 +- drivers/cpufreq/cpufreq.c | 5 - drivers/dma/edma.c | 6 + drivers/gpu/drm/qxl/qxl_cmd.c | 5 +- drivers/gpu/drm/qxl/qxl_display.c | 6 +- drivers/gpu/drm/qxl/qxl_draw.c | 13 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +- drivers/hv/hv_utils_transport.c | 9 +- drivers/iio/adc/ad7793.c | 2 +- drivers/infiniband/hw/cxgb3/cxio_hal.c | 2 +- drivers/infiniband/hw/mlx4/ah.c | 1 + drivers/infiniband/hw/mlx5/main.c | 2 +- drivers/infiniband/hw/mlx5/qp.c | 12 +- drivers/input/keyboard/gpio_keys.c | 29 +++- drivers/input/touchscreen/edt-ft5x06.c | 18 ++- drivers/iommu/dma-iommu.c | 11 +- drivers/md/dm.c | 2 +- drivers/media/pci/cx23885/cx23885-av.c | 2 +- drivers/media/platform/am437x/am437x-vpfe.c | 2 +- .../media/platform/sti/c8sectpfe/c8sectpfe-core.c | 65 +++----- drivers/media/rc/rc-main.c | 2 +- drivers/memory/tegra/tegra124.c | 1 + drivers/mfd/lp8788-irq.c | 2 +- drivers/misc/cxl/fault.c | 2 +- drivers/mmc/card/block.c | 4 +- drivers/mmc/core/debugfs.c | 2 +- drivers/mmc/core/sd.c | 20 ++- drivers/mmc/host/dw_mmc-rockchip.c | 64 ++++++++ drivers/mmc/host/moxart-mmc.c | 5 +- drivers/mmc/host/sdhci-pxav3.c | 22 +++ drivers/mmc/host/sdhci.c | 44 +++-- drivers/mmc/host/sdhci.h | 4 + drivers/mtd/nand/denali.c | 11 +- drivers/mtd/nand/pxa3xx_nand.c | 2 +- drivers/net/bonding/bond_3ad.c | 11 +- drivers/net/bonding/bond_alb.c | 7 +- drivers/net/bonding/bond_netlink.c | 3 +- drivers/net/dsa/mv88e6xxx.c | 9 +- drivers/net/ethernet/agere/et131x.c | 2 +- drivers/net/ethernet/broadcom/bcmsysport.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 11 +- drivers/net/ethernet/brocade/bna/bnad_ethtool.c | 7 +- drivers/net/ethernet/cadence/macb.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/sge.c | 2 +- drivers/net/ethernet/chelsio/cxgb4vf/sge.c | 2 +- drivers/net/ethernet/cirrus/ep93xx_eth.c | 4 + drivers/net/ethernet/emulex/benet/be.h | 1 + drivers/net/ethernet/emulex/benet/be_main.c | 4 + drivers/net/ethernet/ethoc.c | 10 +- drivers/net/ethernet/hisilicon/hns/hnae.c | 8 +- drivers/net/ethernet/ibm/ehea/ehea_main.c | 9 +- drivers/net/ethernet/intel/i40e/i40e_hmc.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 4 +- drivers/net/ethernet/marvell/mvneta.c | 11 +- drivers/net/ethernet/marvell/mvpp2.c | 2 +- drivers/net/ethernet/mellanox/mlx4/catas.c | 11 +- drivers/net/ethernet/mellanox/mlx4/cmd.c | 9 ++ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 28 +++- drivers/net/ethernet/mellanox/mlx4/en_port.c | 4 +- drivers/net/ethernet/mellanox/mlx4/fw.c | 5 +- drivers/net/ethernet/mellanox/mlx4/fw.h | 2 +- drivers/net/ethernet/mellanox/mlx4/intf.c | 3 + drivers/net/ethernet/mellanox/mlx4/main.c | 39 +++-- drivers/net/ethernet/mellanox/mlx4/mcg.c | 11 +- drivers/net/ethernet/mellanox/mlx4/mlx4.h | 5 +- drivers/net/ethernet/mellanox/mlx4/port.c | 13 +- .../net/ethernet/mellanox/mlx4/resource_tracker.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 117 ++++++++------ drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 +- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 7 +- drivers/net/ethernet/mellanox/mlx5/core/health.c | 11 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 84 +++++----- .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 26 ++- drivers/net/ethernet/mellanox/mlx5/core/qp.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/wq.c | 15 +- drivers/net/ethernet/mellanox/mlxsw/pci.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/port.h | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 11 +- .../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 4 +- drivers/net/ethernet/mellanox/mlxsw/switchx2.c | 3 +- drivers/net/ethernet/micrel/ks8842.c | 10 +- drivers/net/ethernet/moxa/moxart_ether.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | 2 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 8 +- drivers/net/ethernet/renesas/ravb_main.c | 2 + drivers/net/ethernet/sfc/ef10.c | 3 +- drivers/net/ethernet/sfc/efx.c | 3 + .../net/ethernet/stmicro/stmmac/dwmac-generic.c | 12 +- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 11 +- drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c | 11 +- drivers/net/ethernet/ti/cpsw-phy-sel.c | 3 + drivers/net/ethernet/ti/cpsw.c | 14 +- drivers/net/ethernet/ti/davinci_emac.c | 7 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 +- drivers/net/geneve.c | 14 +- drivers/net/macvlan.c | 10 +- drivers/net/macvtap.c | 2 +- drivers/net/phy/at803x.c | 6 +- drivers/net/phy/bcm7xxx.c | 2 +- drivers/net/phy/mdio-sun4i.c | 4 +- drivers/net/phy/micrel.c | 12 +- drivers/net/phy/phy.c | 46 +++--- drivers/net/phy/phy_device.c | 2 + drivers/net/vrf.c | 177 ++------------------- drivers/net/vxlan.c | 62 +++++--- drivers/net/wimax/i2400m/usb-fw.c | 1 + drivers/net/wireless/ath/ath10k/core.c | 2 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 2 +- drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 16 ++ drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c | 22 ++- drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c | 2 + drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +- drivers/net/wireless/mwifiex/pcie.h | 9 +- drivers/net/wireless/mwifiex/sta_event.c | 10 +- drivers/net/wireless/mwifiex/wmm.c | 6 +- drivers/of/of_mdio.c | 5 +- drivers/pci/pci-sysfs.c | 7 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 +- drivers/pinctrl/pinctrl-tegra.c | 2 +- drivers/power/bq27xxx_battery.c | 20 ++- drivers/power/ipaq_micro_battery.c | 2 +- drivers/power/test_power.c | 2 + drivers/power/tps65217_charger.c | 6 +- drivers/regulator/core.c | 38 +++-- drivers/scsi/cxgbi/libcxgbi.c | 1 + drivers/spi/spi-rockchip.c | 12 +- drivers/staging/media/lirc/lirc_imon.c | 2 + drivers/staging/rtl8192u/r8192U_core.c | 4 +- drivers/target/target_core_configfs.c | 6 +- drivers/tty/serial/msm_serial.c | 99 ++++++++---- drivers/tty/serial/samsung.c | 4 +- drivers/usb/gadget/function/f_acm.c | 4 +- drivers/usb/gadget/udc/pch_udc.c | 30 ++-- drivers/usb/gadget/udc/udc-core.c | 2 +- drivers/vfio/pci/vfio_pci_config.c | 3 +- .../vfio/platform/reset/vfio_platform_amdxgbe.c | 2 +- fs/btrfs/disk-io.c | 2 +- fs/btrfs/extent-tree.c | 2 +- fs/cifs/connect.c | 2 + fs/gfs2/file.c | 5 +- fs/nfs/nfs4proc.c | 4 + include/asm-generic/preempt.h | 4 +- include/linux/cpufreq.h | 4 - include/linux/ieee80211.h | 9 ++ include/linux/mlx5/driver.h | 3 +- include/linux/mlx5/qp.h | 1 + include/linux/mtd/nand.h | 4 +- include/linux/netdevice.h | 5 +- include/linux/sunrpc/msg_prot.h | 4 +- include/net/bonding.h | 7 +- include/net/ip6_fib.h | 2 + include/net/ip6_route.h | 3 + include/net/ip_fib.h | 3 +- include/net/route.h | 3 + include/net/sch_generic.h | 5 +- include/net/sock.h | 18 ++- include/net/xfrm.h | 4 +- kernel/bpf/syscall.c | 4 +- kernel/sched/fair.c | 27 ++-- kernel/trace/bpf_trace.c | 4 + lib/mpi/longlong.h | 34 ++-- net/batman-adv/main.c | 2 +- net/batman-adv/translation-table.c | 6 +- net/bridge/br_fdb.c | 52 +++--- net/bridge/br_input.c | 7 +- net/core/dev.c | 1 + net/core/flow_dissector.c | 17 +- net/core/rtnetlink.c | 1 + net/core/skbuff.c | 10 +- net/core/sock.c | 7 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 2 +- net/dsa/slave.c | 7 +- net/ipv4/devinet.c | 12 +- net/ipv4/fib_frontend.c | 3 +- net/ipv4/fib_semantics.c | 8 +- net/ipv4/fib_trie.c | 4 +- net/ipv4/fou.c | 6 + net/ipv4/gre_offload.c | 8 + net/ipv4/icmp.c | 4 +- net/ipv4/ip_gre.c | 46 ++++-- net/ipv4/ip_sockglue.c | 7 +- net/ipv4/netfilter/nft_dup_ipv4.c | 6 +- net/ipv4/route.c | 17 +- net/ipv4/tcp_input.c | 5 +- net/ipv4/udp.c | 13 +- net/ipv6/addrconf.c | 21 ++- net/ipv6/icmp.c | 5 +- net/ipv6/ip6_checksum.c | 7 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/ip6mr.c | 13 +- net/ipv6/netfilter/nft_dup_ipv6.c | 6 +- net/ipv6/route.c | 75 ++++++--- net/ipv6/tcp_ipv6.c | 7 +- net/ipv6/udp.c | 6 +- net/ipv6/xfrm6_input.c | 15 +- net/ipv6/xfrm6_tunnel.c | 2 +- net/irda/af_irda.c | 5 +- net/l2tp/l2tp_core.c | 3 + net/mac80211/ieee80211_i.h | 4 + net/mac80211/mlme.c | 2 +- net/mac80211/offchannel.c | 5 +- net/mac80211/rx.c | 8 +- net/mac80211/status.c | 5 +- net/mac80211/tdls.c | 43 ++++- net/mac80211/tx.c | 2 +- net/mac80211/vht.c | 30 +++- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nfnetlink.c | 6 +- net/netfilter/nft_dynset.c | 3 + net/nfc/nci/core.c | 6 +- net/openvswitch/actions.c | 20 ++- net/rds/tcp.c | 2 +- net/rds/tcp_listen.c | 40 +++-- net/sched/cls_bpf.c | 13 +- net/sched/cls_flower.c | 28 ++-- net/sched/sch_drr.c | 4 + net/sched/sch_fq.c | 32 ++-- net/sched/sch_fq_codel.c | 2 +- net/sched/sch_generic.c | 11 +- net/sched/sch_hfsc.c | 12 +- net/sched/sch_prio.c | 4 + net/sched/sch_qfq.c | 3 + net/sched/sch_sfb.c | 3 + net/sched/sch_tbf.c | 4 + net/sctp/associola.c | 2 +- net/sctp/sm_make_chunk.c | 6 +- net/sctp/transport.c | 2 +- net/sunrpc/xprtrdma/backchannel.c | 22 +-- net/sunrpc/xprtrdma/transport.c | 3 + net/sunrpc/xprtrdma/verbs.c | 41 ++--- net/sunrpc/xprtrdma/xprt_rdma.h | 2 +- net/tipc/udp_media.c | 5 +- net/xfrm/xfrm_input.c | 14 +- net/xfrm/xfrm_state.c | 1 + net/xfrm/xfrm_user.c | 15 +- scripts/config | 5 +- sound/pci/fm801.c | 71 +++++---- sound/pci/hda/hda_intel.c | 9 +- sound/soc/fsl/fsl_ssi.c | 8 +- sound/soc/intel/atom/sst/sst_stream.c | 2 +- sound/soc/tegra/tegra_alc5632.c | 12 +- tools/perf/util/perf_regs.c | 8 +- tools/testing/selftests/ipc/msgque.c | 2 +- 318 files changed, 2119 insertions(+), 1364 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/312 mwifiex: fix PCIe register information for 8997 chipset
From: Amitkumar Karwar <[email protected]>
commit ce0c58d998410fb91c63a70e749e98bb0e67eb67 upstream.
This patch corrects some information in mwifiex_pcie_card_reg() structure for 8997 chipset
--- drivers/net/wireless/mwifiex/pcie.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/mwifiex/pcie.h +4 -4
@@ -210,17 +210,17 @@ static const struct mwifiex_pcie_card_re .cmdrsp_addr_lo = PCIE_SCRATCH_4_REG, .cmdrsp_addr_hi = PCIE_SCRATCH_5_REG, .tx_rdptr = 0xC1A4, - .tx_wrptr = 0xC1A8, - .rx_rdptr = 0xC1A8, + .tx_wrptr = 0xC174, + .rx_rdptr = 0xC174, .rx_wrptr = 0xC1A4, .evt_rdptr = PCIE_SCRATCH_10_REG, .evt_wrptr = PCIE_SCRATCH_11_REG, .drv_rdy = PCIE_SCRATCH_12_REG, .tx_start_ptr = 16, .tx_mask = 0x0FFF0000, - .tx_wrap_mask = 0x01FF0000, + .tx_wrap_mask = 0x1FFF0000, .rx_mask = 0x00000FFF, - .rx_wrap_mask = 0x000001FF, + .rx_wrap_mask = 0x00001FFF, .tx_rollover_ind = BIT(28), .rx_rollover_ind = BIT(12), .evt_rollover_ind = MWIFIEX_BD_FLAG_EVT_ROLLOVER_IND,
Greg Kroah-Hartman
maintainerPATCH 2/312 drm/qxl: qxl_release use after free
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit 933db73351d359f74b14f4af095808260aff11f9 upstream.
qxl_release should not be accesses after qxl_push_*_ring_release() calls:
userspace driver can process submitted command quickly, move qxl_release into release_ring, generate interrupt and trigger garbage collector.
It can lead to crashes in qxl driver or trigger memory corruption in some kmalloc-192 slab object
Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() + qxl_push_{cursor,command}_ring_release() calls to close that race window.
--- drivers/gpu/drm/qxl/qxl_cmd.c | 5 ++--- drivers/gpu/drm/qxl/qxl_display.c | 6 +++--- drivers/gpu/drm/qxl/qxl_draw.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +---- 4 files changed, 10 insertions(+), 14 deletions(-)
drivers/gpu/drm/qxl/qxl_cmd.c +2 -3
@@ -529,8 +529,8 @@ int qxl_hw_surface_alloc(struct qxl_devi/* no need to add a release to the fence for this surface bo, since it is only released when we ask to destroy the surface and it would never signal otherwise */ -qxl_push_command_ring_release (qdev, release,QXL_CMD_SURFACE , false);qxl_release_fence_buffer_objects (release); +qxl_push_command_ring_release (qdev, release,QXL_CMD_SURFACE , false); surf->hw_surf_alloc = true;spin_lock (&qdev->surf_id_idr_lock);
@@ -572,9 +572,8 @@ int qxl_hw_surface_dealloc(struct qxl_de cmd->surface_id = id;qxl_release_unmap (qdev, release, &cmd->release_info); -qxl_push_command_ring_release (qdev, release,QXL_CMD_SURFACE , false); -qxl_release_fence_buffer_objects (release); +qxl_push_command_ring_release (qdev, release,QXL_CMD_SURFACE , false);return 0 ; }
drivers/gpu/drm/qxl/qxl_display.c +3 -3
@@ -292,8 +292,8 @@ qxl_hide_cursor(struct qxl_device *qdev) cmd->type =QXL_CURSOR_HIDE ;qxl_release_unmap (qdev, release, &cmd->release_info); -qxl_push_cursor_ring_release (qdev, release,QXL_CMD_CURSOR , false);qxl_release_fence_buffer_objects (release); +qxl_push_cursor_ring_release (qdev, release,QXL_CMD_CURSOR , false);return 0 ; }
@@ -390,8 +390,8 @@ static int qxl_crtc_cursor_set2(struct d cmd->u.set.visible =1 ;qxl_release_unmap (qdev, release, &cmd->release_info); -qxl_push_cursor_ring_release (qdev, release,QXL_CMD_CURSOR , false);qxl_release_fence_buffer_objects (release); +qxl_push_cursor_ring_release (qdev, release,QXL_CMD_CURSOR , false);/* finish with the userspace bo */ ret =qxl_bo_reserve (user_bo, false);
@@ -450,8 +450,8 @@ static int qxl_crtc_cursor_move(struct d cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;qxl_release_unmap (qdev, release, &cmd->release_info); -qxl_push_cursor_ring_release (qdev, release,QXL_CMD_CURSOR , false);qxl_release_fence_buffer_objects (release); +qxl_push_cursor_ring_release (qdev, release,QXL_CMD_CURSOR , false);return 0 ; }
drivers/gpu/drm/qxl/qxl_draw.c +4 -4
@@ -245,8 +245,8 @@ void qxl_draw_opaque_fb(const struct qxlqxl_bo_physical_address (qdev, dimage->bo,0 );qxl_release_unmap (qdev, release, &drawable->release_info); -qxl_push_command_ring_release (qdev, release,QXL_CMD_DRAW , false);qxl_release_fence_buffer_objects (release); +qxl_push_command_ring_release (qdev, release,QXL_CMD_DRAW , false); out_free_palette:if (palette_bo)
@@ -385,8 +385,8 @@ void qxl_draw_dirty_fb(struct qxl_device }qxl_bo_kunmap (clips_bo); -qxl_push_command_ring_release (qdev, release,QXL_CMD_DRAW , false);qxl_release_fence_buffer_objects (release); +qxl_push_command_ring_release (qdev, release,QXL_CMD_DRAW , false); out_release_backoff:if (ret)
@@ -436,8 +436,8 @@ void qxl_draw_copyarea(struct qxl_device drawable->u.copy_bits.src_pos.y = sy;qxl_release_unmap (qdev, release, &drawable->release_info); -qxl_push_command_ring_release (qdev, release,QXL_CMD_DRAW , false);qxl_release_fence_buffer_objects (release); +qxl_push_command_ring_release (qdev, release,QXL_CMD_DRAW , false); out_free_release:if (ret)
@@ -480,8 +480,8 @@ void qxl_draw_fill(struct qxl_draw_fillqxl_release_unmap (qdev, release, &drawable->release_info); -qxl_push_command_ring_release (qdev, release,QXL_CMD_DRAW , false);qxl_release_fence_buffer_objects (release); +qxl_push_command_ring_release (qdev, release,QXL_CMD_DRAW , false); out_free_release:if (ret)
drivers/gpu/drm/qxl/qxl_ioctl.c +1 -4
@@ -257,11 +257,8 @@ static int qxl_process_single_command(stapply_surf_reloc (qdev, &reloc_info[i]); } +qxl_release_fence_buffer_objects (release); ret =qxl_push_command_ring_release (qdev, release, cmd->type, true); -if (ret) -qxl_release_backoff_reserve_list (release); -else -qxl_release_fence_buffer_objects (release); out_free_bos: out_free_release:
Greg Kroah-Hartman
maintainerPATCH 3/312 drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit 85e9b88af1e6164f19ec71381efd5e2bcfc17620 upstream.
ret should be changed to release allocated struct qxl_release
--- drivers/gpu/drm/qxl/qxl_draw.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/qxl/qxl_draw.c +3 -2
@@ -352,9 +352,10 @@ void qxl_draw_dirty_fb(struct qxl_device goto out_release_backoff; rects =drawable_set_clipping (qdev, drawable, num_clips, clips_bo); -if (!rects) +if (!rects) { + ret = -EINVAL ; goto out_release_backoff; - + } drawable = (struct qxl_drawable *)qxl_release_map (qdev, release); drawable->clip.type =SPICE_CLIP_TYPE_RECTS ;
Greg Kroah-Hartman
maintainerPATCH 4/312 staging: rtl8192u: Fix crash due to pointers being "confusing"
In reply to Greg Kroah-HartmanFrom: Ben Hutchings <[email protected]>
commit c3f463484bdd0acd15abd5f92399041f79592d06 upstream.
There's no net_device stashed in skb->cb, there's a net_device * there.
To make it *really* clear, also change the write of the dev pointer into skb->cb from a memcpy() to an assignment.
--- drivers/staging/rtl8192u/r8192U_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/rtl8192u/r8192U_core.c +2 -2
@@ -1050,7 +1050,7 @@ static void rtl8192_hard_data_xmit(strucspin_lock_irqsave (&priv->tx_lock, flags); -memcpy ((unsigned char *)(skb->cb), &dev,sizeof (dev)); + *(struct net_device **)(skb->cb) = dev; tcb_desc->bTxEnableFwCalcDur =1 ;skb_push (skb, priv->ieee80211->tx_headroom); ret =rtl8192_tx (dev, skb);
@@ -1092,7 +1092,7 @@ static int rtl8192_hard_start_xmit(strucstatic void rtl8192_tx_isr (struct urb *tx_urb) {struct sk_buff *skb = (struct sk_buff *)tx_urb->context; -struct net_device *dev = (struct net_device *)(skb->cb); +struct net_device *dev = *(struct net_device **)(skb->cb);struct r8192_priv *priv =NULL ;cb_desc *tcb_desc = (cb_desc *)(skb->cb +MAX_DEV_ADDR_SIZE );u8 queue_index = tcb_desc->queue_index;
Greg Kroah-Hartman
maintainerPATCH 5/312 usb: gadget: f_acm: Fix configfs attr name
In reply to Greg Kroah-HartmanFrom: Krzysztof Opasiak <[email protected]>
commit 0561f77e2db9e72dc32e4f82b56fca8ba6b31171 upstream.
Correct attribute name is port_num not num.
--- drivers/usb/gadget/function/f_acm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_acm.c +2 -2
@@ -779,10 +779,10 @@ static ssize_t f_acm_port_num_show(strucreturn sprintf (page,"%u\n" ,to_f_serial_opts (item)->port_num); } -CONFIGFS_ATTR_RO (f_acm_port_, num); +CONFIGFS_ATTR_RO (f_acm_, port_num);static struct configfs_attribute *acm_attrs[] = { - &f_acm_port_attr_num, + &f_acm_attr_port_num,NULL , };
Greg Kroah-Hartman
maintainerPATCH 6/312 usb: gadged: pch_udc: get rid of redundant assignments
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit 6b968737c3efe7cdaa5407afec972cd7c7d3ca35 upstream.
It seems there are leftovers of some assignments which are not used anymore. Compiler even warns us about:
drivers/usb/gadget/udc/pch_udc.c:2022:22: warning: variable ‘dev’ set \
but not used [-Wunused-but-set-variable]
drivers/usb/gadget/udc/pch_udc.c:2639:9: warning: variable ‘ret’ set \
but not used [-Wunused-but-set-variable]
Remove them and shut compiler about.
--- drivers/usb/gadget/udc/pch_udc.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-)
drivers/usb/gadget/udc/pch_udc.c +4 -14
@@ -1731,14 +1731,12 @@ static int pch_udc_pcd_ep_enable(structstatic int pch_udc_pcd_ep_disable (struct usb_ep *usbep) {struct pch_udc_ep *ep; -struct pch_udc_dev *dev;unsigned long iflags;if (!usbep)return -EINVAL ; ep = container_of(usbep, struct pch_udc_ep, ep); - dev = ep->dev;if ((usbep->name == ep0_string) || !ep->ep.desc)return -EINVAL ;
@@ -1769,12 +1767,10 @@ static struct usb_request *pch_udc_allocstruct pch_udc_request *req;struct pch_udc_ep *ep;struct pch_udc_data_dma_desc *dma_desc; -struct pch_udc_dev *dev;if (!usbep)return NULL ; ep = container_of(usbep, struct pch_udc_ep, ep); - dev = ep->dev; req =kzalloc (sizeof *req, gfp);if (!req)return NULL ;
@@ -1947,12 +1943,10 @@ static int pch_udc_pcd_dequeue(struct us {struct pch_udc_ep *ep;struct pch_udc_request *req; -struct pch_udc_dev *dev;unsigned long flags;int ret = -EINVAL ; ep = container_of(usbep, struct pch_udc_ep, ep); - dev = ep->dev;if (!usbep || !usbreq || (!ep->ep.desc && ep->num))return ret; req = container_of(usbreq, struct pch_udc_request, req);
@@ -1984,14 +1978,12 @@ static int pch_udc_pcd_dequeue(struct usstatic int pch_udc_pcd_set_halt (struct usb_ep *usbep,int halt) {struct pch_udc_ep *ep; -struct pch_udc_dev *dev;unsigned long iflags;int ret;if (!usbep)return -EINVAL ; ep = container_of(usbep, struct pch_udc_ep, ep); - dev = ep->dev;if (!ep->ep.desc && !ep->num)return -EINVAL ;if (!ep->dev->driver || (ep->dev->gadget.speed ==USB_SPEED_UNKNOWN ))
@@ -2029,14 +2021,12 @@ static int pch_udc_pcd_set_halt(struct ustatic int pch_udc_pcd_set_wedge (struct usb_ep *usbep) {struct pch_udc_ep *ep; -struct pch_udc_dev *dev;unsigned long iflags;int ret;if (!usbep)return -EINVAL ; ep = container_of(usbep, struct pch_udc_ep, ep); - dev = ep->dev;if (!ep->ep.desc && !ep->num)return -EINVAL ;if (!ep->dev->driver || (ep->dev->gadget.speed ==USB_SPEED_UNKNOWN ))
@@ -2646,7 +2636,7 @@ static void pch_udc_svc_enum_interrupt(sstatic void pch_udc_svc_intf_interrupt (struct pch_udc_dev *dev) {u32 reg, dev_stat =0 ; -int i, ret; +int i; dev_stat =pch_udc_read_device_status (dev); dev->cfg_data.cur_intf = (dev_stat & UDC_DEVSTS_INTF_MASK) >>
@@ -2675,7 +2665,7 @@ static void pch_udc_svc_intf_interrupt(s } dev->stall =0 ;spin_lock (&dev->lock); - ret = dev->driver->setup (&dev->gadget, &dev->setup_data); + dev->driver->setup (&dev->gadget, &dev->setup_data);spin_unlock (&dev->lock); }
@@ -2686,7 +2676,7 @@ static void pch_udc_svc_intf_interrupt(s*/ static void pch_udc_svc_cfg_interrupt (struct pch_udc_dev *dev) { -int i, ret; +int i;u32 reg, dev_stat =0 ; dev_stat =pch_udc_read_device_status (dev);
@@ -2712,7 +2702,7 @@ static void pch_udc_svc_cfg_interrupt(st/* call gadget zero with setup data received */ spin_lock (&dev->lock); - ret = dev->driver->setup (&dev->gadget, &dev->setup_data); + dev->driver->setup (&dev->gadget, &dev->setup_data);spin_unlock (&dev->lock); }
Greg Kroah-Hartman
maintainerPATCH 7/312 usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock
In reply to Greg Kroah-HartmanFrom: Iago Abal <[email protected]>
commit 1d23d16a88e6c8143b07339435ba061b131ebb8c upstream.
The above commit reordered spin_lock/unlock and now &dev->lock' is acquired (rather than released) before calling dev->driver->disconnect', dev->driver->setup', dev->driver->suspend', usb_gadget_giveback_request', and usb_gadget_udc_reset'.
But this *may* not be the right way to fix the problem pointed by d3cb25a12138.
Note that the other usb/gadget/udc drivers do release the lock before calling these functions. There are also inconsistencies within pch_udc.c, where dev->driver->disconnect' is called while holding &dev->lock' in lines 613 and 1184, but not in line 2739.
Finally, commit d3cb25a12138 may have introduced several potential deadlocks.
For instance, EBA (https://github.com/models-team/eba) reports:
Double lock in drivers/usb/gadget/udc/pch_udc.c
first at 2791: spin_lock(& dev->lock); [pch_udc_isr]
second at 2694: spin_lock(& dev->lock); [pch_udc_svc_cfg_interrupt]
after calling from 2793: pch_udc_dev_isr(dev, dev_intr);
after calling from 2724: pch_udc_svc_cfg_interrupt(dev);Similarly, other potential deadlocks are 2791 -> 2793 -> 2721 -> 2657; and 2791 -> 2793 -> 2711 -> 2573 -> 1499 -> 1480.
--- drivers/usb/gadget/udc/pch_udc.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/usb/gadget/udc/pch_udc.c +8 -8
@@ -1488,11 +1488,11 @@ static void complete_req(struct pch_udc_ req->dma_mapped =0 ; } ep->halted =1 ; -spin_lock (&dev->lock); +spin_unlock (&dev->lock);if (!ep->in)pch_udc_ep_clear_rrdy (ep);usb_gadget_giveback_request (&ep->ep, &req->req); -spin_unlock (&dev->lock); +spin_lock (&dev->lock); ep->halted = halted; }
@@ -2583,9 +2583,9 @@ static void pch_udc_svc_ur_interrupt(strempty_req_queue (ep); }if (dev->driver) { -spin_lock (&dev->lock); -usb_gadget_udc_reset (&dev->gadget, dev->driver);spin_unlock (&dev->lock); +usb_gadget_udc_reset (&dev->gadget, dev->driver); +spin_lock (&dev->lock); } }
@@ -2664,9 +2664,9 @@ static void pch_udc_svc_intf_interrupt(s dev->ep[i].halted =0 ; } dev->stall =0 ; -spin_lock (&dev->lock); - dev->driver->setup (&dev->gadget, &dev->setup_data);spin_unlock (&dev->lock); + dev->driver->setup (&dev->gadget, &dev->setup_data); +spin_lock (&dev->lock); }/**
@@ -2701,9 +2701,9 @@ static void pch_udc_svc_cfg_interrupt(st dev->stall =0 ;/* call gadget zero with setup data received */ -spin_lock (&dev->lock); - dev->driver->setup (&dev->gadget, &dev->setup_data);spin_unlock (&dev->lock); + dev->driver->setup (&dev->gadget, &dev->setup_data); +spin_lock (&dev->lock); }/**
Greg Kroah-Hartman
maintainerPATCH 8/312 usb: gadget: udc: core: dont starve DMA resources
In reply to Greg Kroah-HartmanFrom: Felipe Balbi <[email protected]>
commit 23fd537c9508fb6e3b93ddf23982f51afc087781 upstream.
Always unmap all SG entries as required by DMA API
--- drivers/usb/gadget/udc/udc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/udc-core.c +1 -1
@@ -97,7 +97,7 @@ void usb_gadget_unmap_request(struct usbreturn ;if (req->num_mapped_sgs) { -dma_unmap_sg (gadget->dev.parent, req->sg, req->num_mapped_sgs, +dma_unmap_sg (gadget->dev.parent, req->sg, req->num_sgs, is_in ?DMA_TO_DEVICE :DMA_FROM_DEVICE ); req->num_mapped_sgs =0 ;
Greg Kroah-Hartman
maintainerPATCH 9/312 MIPS: Fix macro typo
In reply to Greg Kroah-HartmanFrom: Jaedon Shin <[email protected]>
commit 2549cc967ebb4043f3507b55e3dc579f44d3b516 upstream.
Change the CONFIG_MIPS_CMDLINE_EXTEND to CONFIG_MIPS_CMDLINE_DTB_EXTEND to resolve the EXTEND_WITH_PROM macro.
Patchwork: https://patchwork.linux-mips.org/patch/11909/
--- arch/mips/kernel/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kernel/setup.c +1 -1
@@ -695,7 +695,7 @@ static void __init request_crashkernel(s#define USE_PROM_CMDLINE IS_ENABLED(CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER)#define USE_DTB_CMDLINE IS_ENABLED(CONFIG_MIPS_CMDLINE_FROM_DTB) -#define EXTEND_WITH_PROM IS_ENABLED(CONFIG_MIPS_CMDLINE_EXTEND) +#define EXTEND_WITH_PROM IS_ENABLED(CONFIG_MIPS_CMDLINE_DTB_EXTEND)static void __init arch_mem_init (char **cmdline_p) {
Greg Kroah-Hartman
maintainerPATCH 10/312 MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[]
In reply to Greg Kroah-HartmanFrom: James Hogan <[email protected]>
commit 555fae60b2bbb2d6282d82c5321d3adfa85b22ae upstream.
The cp0_tcstatus member of struct pt_regs was removed along with the rest of SMTC in v3.16, commit b633648c5ad3 ("MIPS: MT: Remove SMTC support"), however recent uprobes support in v4.3 added back a reference to it in the regoffset_table[] in ptrace.c. Remove it.
Patchwork: https://patchwork.linux-mips.org/patch/11920/
--- arch/mips/kernel/ptrace.c | 3 --- 1 file changed, 3 deletions(-)
arch/mips/kernel/ptrace.c +0 -3
@@ -670,9 +670,6 @@ static const struct pt_regs_offset regofREG_OFFSET_NAME (c0_badvaddr, cp0_badvaddr),REG_OFFSET_NAME (c0_cause, cp0_cause),REG_OFFSET_NAME (c0_epc, cp0_epc), -#ifdef CONFIG_MIPS_MT_SMTC -REG_OFFSET_NAME (c0_tcstatus, cp0_tcstatus), -#endif #ifdef CONFIG_CPU_CAVIUM_OCTEONREG_OFFSET_NAME (mpl0, mpl[0 ]), REG_OFFSET_NAME(mpl1, mpl[1]),
Greg Kroah-Hartman
maintainerPATCH 11/312 MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit cbbda6e7c9c3e4532bd70a73ff9d5e6655c894dc upstream.
BMIPS5000 have a PrID value of 0x5A00 and BMIPS5200 have a PrID value of 0x5B00, which, masked with 0x5A00, returns 0x5A00. Update all conditionals on the PrID to cover both variants since we are going to need this to enable BMIPS5200 SMP. The existing check, masking with 0xFF00 would not cover BMIPS5200 at all.
Patchwork: https://patchwork.linux-mips.org/patch/12279/
--- arch/mips/kernel/bmips_vec.S | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/mips/kernel/bmips_vec.S +7 -2
@@ -93,7 +93,8 @@ NESTED(bmips_reset_nmi_vec, PT_SIZE, sp) #if defined(CONFIG_CPU_BMIPS5000) mfc0 k0, CP0_PRID li k1, PRID_IMP_BMIPS5000 - andi k0, 0xff00 + /* mask with PRID_IMP_BMIPS5000 to cover both variants */ + andi k0, PRID_IMP_BMIPS5000 bne k0, k1, 1f /* if we're not on core 0, this must be the SMP boot signal */
@@ -166,10 +167,12 @@ bmips_smp_entry: 2: #endif /* CONFIG_CPU_BMIPS4350 || CONFIG_CPU_BMIPS4380 */ #if defined(CONFIG_CPU_BMIPS5000) - /* set exception vector base */ + /* mask with PRID_IMP_BMIPS5000 to cover both variants */ li k1, PRID_IMP_BMIPS5000 + andi k0, PRID_IMP_BMIPS5000 bne k0, k1, 3f + /* set exception vector base */ la k0, ebase lw k0, 0(k0) mtc0 k0, $15, 1
@@ -263,6 +266,8 @@ LEAF(bmips_enable_xks01) #endif /* CONFIG_CPU_BMIPS4380 */ #if defined(CONFIG_CPU_BMIPS5000) li t1, PRID_IMP_BMIPS5000 + /* mask with PRID_IMP_BMIPS5000 to cover both variants */ + andi t2, PRID_IMP_BMIPS5000 bne t2, t1, 2f mfc0 t0, $22, 5
Greg Kroah-Hartman
maintainerPATCH 12/312 MIPS: smp-cps: Stop printing EJTAG exceptions to UART
In reply to Greg Kroah-HartmanFrom: Paul Burton <[email protected]>
commit 6609ccdc852f7bfbfa54300dd5b3cd89eb4ced6f upstream.
When CONFIG_MIPS_CPS_NS16550 is enabled, some register state is dumped to the UART when an exception is taken via the BEV on secondary cores. EJTAG exceptions are architecturally expected to be handled by the BEV even when Status.BEV is 0. This effectively means that if userland executes an sdbbp instruction on a secondary core then the kernel dumps register state to the UART even though the exception is perfectly normal & expected. Prevent this by simply not dumping information to the UART for EJTAG exceptions.
Patchwork: https://patchwork.linux-mips.org/patch/12341/
--- arch/mips/kernel/cps-vec.S | 1 - 1 file changed, 1 deletion(-)
arch/mips/kernel/cps-vec.S +0 -1
@@ -245,7 +245,6 @@ LEAF(excep_intex) .org 0x480 LEAF(excep_ejtag) - DUMP_EXCEP("EJTAG") PTR_LA k0, ejtag_debug_handler jr k0 nop
Greg Kroah-Hartman
maintainerPATCH 13/312 MIPS: scall: Handle seccomp filters which redirect syscalls
In reply to Greg Kroah-HartmanFrom: Matt Redfearn <[email protected]>
commit a400bed6d105c23d3673f763596e4b85de14e41a upstream.
Commit d218af78492a ("MIPS: scall: Always run the seccomp syscall filters") modified the syscall code to always call the seccomp filters, but missed the case where a filter may redirect the syscall, as revealed by the seccomp_bpf self test.
The syscall path now restores the syscall from the stack after the filter rather than saving it locally. Syscall number checking and syscall function table lookup is done after the filter may have run such that redirected syscalls are also checked, and executed.
The regular path of syscall number checking and pointer lookup is also made more consistent between ABIs with scall64-64.S being the reference.
With this patch in place, the seccomp_bpf self test now passes TRACE_syscall.syscall_redirected and TRACE_syscall.syscall_dropped on all MIPS ABIs.
Patchwork: https://patchwork.linux-mips.org/patch/12916/
--- arch/mips/kernel/scall32-o32.S | 11 +++++------ arch/mips/kernel/scall64-64.S | 3 +-- arch/mips/kernel/scall64-n32.S | 14 +++++++++----- arch/mips/kernel/scall64-o32.S | 14 +++++++++----- 4 files changed, 24 insertions(+), 18 deletions(-)
arch/mips/kernel/scall32-o32.S +5 -6
@@ -35,7 +35,6 @@ NESTED(handle_sys, PT_SIZE, sp) lw t1, PT_EPC(sp) # skip syscall on return - subu v0, v0, __NR_O32_Linux # check syscall number addiu t1, 4 # skip to next instruction sw t1, PT_EPC(sp)
@@ -89,6 +88,7 @@ loads_done: and t0, t1 bnez t0, syscall_trace_entry # -> yes syscall_common: + subu v0, v0, __NR_O32_Linux # check syscall number sltiu t0, v0, __NR_O32_Linux_syscalls + 1 beqz t0, illegal_syscall
@@ -118,24 +118,23 @@ o32_syscall_exit: syscall_trace_entry: SAVE_STATIC - move s0, v0 move a0, sp /* * syscall number is in v0 unless we called syscall(__NR_###) * where the real syscall number is in a0 */ - addiu a1, v0, __NR_O32_Linux - bnez v0, 1f /* __NR_syscall at offset 0 */ + move a1, v0 + subu t2, v0, __NR_O32_Linux + bnez t2, 1f /* __NR_syscall at offset 0 */ lw a1, PT_R4(sp) 1: jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall - move v0, s0 # restore syscall - RESTORE_STATIC + lw v0, PT_R2(sp) # Restore syscall (maybe modified) lw a0, PT_R4(sp) # Restore argument registers lw a1, PT_R5(sp) lw a2, PT_R6(sp)
arch/mips/kernel/scall64-64.S +1 -2
@@ -82,15 +82,14 @@ n64_syscall_exit: syscall_trace_entry: SAVE_STATIC - move s0, v0 move a0, sp move a1, v0 jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall - move v0, s0 RESTORE_STATIC + ld v0, PT_R2(sp) # Restore syscall (maybe modified) ld a0, PT_R4(sp) # Restore argument registers ld a1, PT_R5(sp) ld a2, PT_R6(sp)
arch/mips/kernel/scall64-n32.S +9 -5
@@ -42,9 +42,6 @@ NESTED(handle_sysn32, PT_SIZE, sp) #endif beqz t0, not_n32_scall - dsll t0, v0, 3 # offset into table - ld t2, (sysn32_call_table - (__NR_N32_Linux * 8))(t0) - sd a3, PT_R26(sp) # save a3 for syscall restarting li t1, _TIF_WORK_SYSCALL_ENTRY
@@ -53,6 +50,9 @@ NESTED(handle_sysn32, PT_SIZE, sp) bnez t0, n32_syscall_trace_entry syscall_common: + dsll t0, v0, 3 # offset into table + ld t2, (sysn32_call_table - (__NR_N32_Linux * 8))(t0) + jalr t2 # Do The Real Thing (TM) li t0, -EMAXERRNO - 1 # error?
@@ -71,21 +71,25 @@ syscall_common: n32_syscall_trace_entry: SAVE_STATIC - move s0, t2 move a0, sp move a1, v0 jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall - move t2, s0 RESTORE_STATIC + ld v0, PT_R2(sp) # Restore syscall (maybe modified) ld a0, PT_R4(sp) # Restore argument registers ld a1, PT_R5(sp) ld a2, PT_R6(sp) ld a3, PT_R7(sp) ld a4, PT_R8(sp) ld a5, PT_R9(sp) + + dsubu t2, v0, __NR_N32_Linux # check (new) syscall number + sltiu t0, t2, __NR_N32_Linux_syscalls + 1 + beqz t0, not_n32_scall + j syscall_common 1: j syscall_exit
arch/mips/kernel/scall64-o32.S +9 -5
@@ -52,9 +52,6 @@ NESTED(handle_sys, PT_SIZE, sp) sll a2, a2, 0 sll a3, a3, 0 - dsll t0, v0, 3 # offset into table - ld t2, (sys32_call_table - (__NR_O32_Linux * 8))(t0) - sd a3, PT_R26(sp) # save a3 for syscall restarting /*
@@ -88,6 +85,9 @@ loads_done: bnez t0, trace_a_syscall syscall_common: + dsll t0, v0, 3 # offset into table + ld t2, (sys32_call_table - (__NR_O32_Linux * 8))(t0) + jalr t2 # Do The Real Thing (TM) li t0, -EMAXERRNO - 1 # error?
@@ -112,7 +112,6 @@ trace_a_syscall: sd a6, PT_R10(sp) sd a7, PT_R11(sp) # For indirect syscalls - move s0, t2 # Save syscall pointer move a0, sp /* * absolute syscall number is in v0 unless we called syscall(__NR_###)
@@ -133,8 +132,8 @@ trace_a_syscall: bltz v0, 1f # seccomp failed? Skip syscall - move t2, s0 RESTORE_STATIC + ld v0, PT_R2(sp) # Restore syscall (maybe modified) ld a0, PT_R4(sp) # Restore argument registers ld a1, PT_R5(sp) ld a2, PT_R6(sp)
@@ -143,6 +142,11 @@ trace_a_syscall: ld a5, PT_R9(sp) ld a6, PT_R10(sp) ld a7, PT_R11(sp) # For indirect syscalls + + dsubu t0, v0, __NR_O32_Linux # check (new) syscall number + sltiu t0, t0, __NR_O32_Linux_syscalls + 1 + beqz t0, not_o32_scall + j syscall_common 1: j syscall_exit
Greg Kroah-Hartman
maintainerPATCH 14/312 MIPS: BMIPS: BMIPS5000 has I cache filing from D cache
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit c130d2fd3d59fbd5d269f7d5827bd4ed1d94aec6 upstream.
BMIPS5000 and BMIPS52000 processors have their I-cache filling from the D-cache. Since BMIPS_GENERIC does not provide (yet) a cpu-feature-overrides.h file, this was not set anywhere, so make sure the R4K cache detection takes care of that.
Patchwork: https://patchwork.linux-mips.org/patch/13010/
--- arch/mips/mm/c-r4k.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/mips/mm/c-r4k.c +4 -0
@@ -1308,6 +1308,10 @@ static void probe_pcache(void) c->icache.flags |=MIPS_CACHE_IC_F_DC ;break ; +case CPU_BMIPS5000 : + c->icache.flags |=MIPS_CACHE_IC_F_DC ; +break ; +case CPU_LOONGSON2 :/* * LOONGSON2 has 4 way icache, but when using indexed cache op,
Greg Kroah-Hartman
maintainerPATCH 15/312 MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit 73c4ca047f440c79f545bc6133e3033f754cd239 upstream.
BMIPS5000 and BMIPS5200 processor have no D cache aliases, and this is properly handled by the per-CPU override added at the end of r4k_cache_init(), the problem is that the output of probe_pcache() disagrees with that, since this is too late:
Primary instruction cache 32kB, VIPT, 4-way, linesize 64 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
With the change moved earlier, we now have a consistent output with the settings we are intending to have:
Primary instruction cache 32kB, VIPT, 4-way, linesize 64 bytes. Primary data cache 32kB, 4-way, VIPT, no aliases, linesize 32 bytes
Patchwork: https://patchwork.linux-mips.org/patch/13011/
--- arch/mips/mm/c-r4k.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/mm/c-r4k.c +2 -2
@@ -1310,6 +1310,8 @@ static void probe_pcache(void)case CPU_BMIPS5000 : c->icache.flags |=MIPS_CACHE_IC_F_DC ; +/* Cache aliases are handled in hardware; allow HIGHMEM */ + c->dcache.flags &= ~MIPS_CACHE_ALIASES ;break ;case CPU_LOONGSON2 :
@@ -1749,8 +1751,6 @@ void r4k_cache_init(void) flush_icache_range = (void *)b5k_instruction_hazard; local_flush_icache_range = (void *)b5k_instruction_hazard; -/* Cache aliases are handled in hardware; allow HIGHMEM */ - current_cpu_data.dcache.flags &= ~MIPS_CACHE_ALIASES ;/* Optimization: an L2 flush implicitly flushes the L1 */ current_cpu_data.options |=MIPS_CPU_INCLUSIVE_CACHES ;
Greg Kroah-Hartman
maintainerPATCH 16/312 MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit f675843ddfdfdf467d08cc922201614a149e439e upstream.
local_r4k___flush_cache_all() is missing a special check for BMIPS5000 processors, we need to blast the S-cache, just like other MTI processors since we have an inclusive cache. We also need an additional __sync() to make sure this is completed.
Patchwork: https://patchwork.linux-mips.org/patch/13012/
--- arch/mips/mm/c-r4k.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/mips/mm/c-r4k.c +5 -0
@@ -447,6 +447,11 @@ static inline void local_r4k___flush_cacr4k_blast_scache ();break ; +case CPU_BMIPS5000 : +r4k_blast_scache (); +__sync (); +break ; +default :r4k_blast_dcache ();r4k_blast_icache ();
Greg Kroah-Hartman
maintainerPATCH 17/312 MIPS: BMIPS: Pretty print BMIPS5200 processor name
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit 37808d62afcdc420d98875c4b514c178d56f6815 upstream.
Just to ease debugging of multiplatform kernel, make sure we print "Broadcom BMIPS5200" for the BMIPS5200 implementation instead of Broadcom BMIPS5000.
Patchwork: https://patchwork.linux-mips.org/patch/13014/
--- arch/mips/kernel/cpu-probe.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/mips/kernel/cpu-probe.c +4 -1
@@ -1284,7 +1284,10 @@ static inline void cpu_probe_broadcom(stcase PRID_IMP_BMIPS5000 :case PRID_IMP_BMIPS5200 : c->cputype =CPU_BMIPS5000 ; - __cpu_name[cpu] ="Broadcom BMIPS5000" ; +if ((c->processor_id &PRID_IMP_MASK ) ==PRID_IMP_BMIPS5200 ) + __cpu_name[cpu] ="Broadcom BMIPS5200" ; +else + __cpu_name[cpu] ="Broadcom BMIPS5000" ;set_elf_platform (cpu,"bmips5000" ); c->options |=MIPS_CPU_ULRI ;break ;
Greg Kroah-Hartman
maintainerPATCH 18/312 MIPS: Fix HTW config on XPA kernel without LPA enabled
In reply to Greg Kroah-HartmanFrom: James Hogan <[email protected]>
commit 14bc241443e126c62fcbf571b7d4c79740debc58 upstream.
The hardware page table walker (HTW) configuration is broken on XPA kernels where XPA couldn't be enabled (either nohtw or the hardware doesn't support it). This is because the PWSize.PTEW field (PTE width) was only set to 8 bytes (an extra shift of 1) in config_htw_params() if PageGrain.ELPA (enable large physical addressing) is set. On an XPA kernel though the size of PTEs is fixed at 8 bytes regardless of whether XPA could actually be enabled.
Fix the initialisation of this field based on sizeof(pte_t) instead.
Patchwork: https://patchwork.linux-mips.org/patch/13113/
--- arch/mips/mm/tlbex.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/mips/mm/tlbex.c +1 -3
@@ -2329,9 +2329,7 @@ static void config_htw_params(void)if (CONFIG_PGTABLE_LEVELS >=3 ) pwsize |=ilog2 (PTRS_PER_PMD ) <<MIPS_PWSIZE_MDW_SHIFT ; -/* If XPA has been enabled, PTEs are 64-bit in size. */ -if (config_enabled (CONFIG_64BITS ) || (read_c0_pagegrain () &PG_ELPA )) - pwsize |=1 ; + pwsize |=ilog2 (sizeof (pte_t)/4 ) <<MIPS_PWSIZE_PTEW_SHIFT ;write_c0_pwsize (pwsize);
Greg Kroah-Hartman
maintainerPATCH 19/312 MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit 80fa40acaa1dad5a0a9c15ed2e5d2e72461843f5 upstream.
The CPU actually runs at 1405Mhz which gives us a 175625000 Hz MIPS timer frequency (CPU frequency / 8).
Patchwork: https://patchwork.linux-mips.org/patch/13132/
--- arch/mips/boot/dts/brcm/bcm7435.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/boot/dts/brcm/bcm7435.dtsi +1 -1
@@ -7,7 +7,7 @@ #address-cells = <1>; #size-cells = <0>; - mips-hpt-frequency = <163125000>; + mips-hpt-frequency = <175625000>; cpu@0 { compatible = "brcm,bmips5200";
Greg Kroah-Hartman
maintainerPATCH 20/312 MIPS: math-emu: Fix BC1{EQ,NE}Z emulation
In reply to Greg Kroah-HartmanFrom: Paul Burton <[email protected]>
commit 93583e178ebfdd2fadf950eef1547f305cac12ca upstream.
The conditions for branching when emulating the BC1EQZ & BC1NEZ instructions were backwards, leading to each of those instructions being treated as the other. Fix this by reversing the conditions, and clear up the code a little for readability & checkpatch.
Patchwork: https://patchwork.linux-mips.org/patch/13150/
--- arch/mips/math-emu/cp1emu.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
arch/mips/math-emu/cp1emu.c +6 -5
@@ -975,9 +975,10 @@ static int cop1Emulate(struct pt_regs *x struct mm_decoded_insn dec_insn, void *__user *fault_addr) { unsigned long contpc = xcp->cp0_epc + dec_insn.pc_inc; -unsigned int cond, cbit; +unsigned int cond, cbit, bit0;mips_instruction ir;int likely, pc_inc; +union fpureg *fpr;u32 __user *wva;u64 __user *dva;u32 wval;
@@ -1189,14 +1190,14 @@ emul:return SIGILL ; cond = likely =0 ; + fpr = ¤t->thread.fpu.fpr[MIPSInst_RT (ir)]; + bit0 =get_fpr32 (fpr,0 ) &0x1 ;switch (MIPSInst_RS (ir)) {case bc1eqz_op: -if (get_fpr32 (¤t->thread.fpu.fpr[MIPSInst_RT (ir)],0 ) &0x1 ) - cond =1 ; + cond = bit0 ==0 ;break ;case bc1nez_op: -if (!(get_fpr32 (¤t->thread.fpu.fpr[MIPSInst_RT (ir)],0 ) &0x1 )) - cond =1 ; + cond = bit0 !=0 ;break ; } goto branch_common;
Greg Kroah-Hartman
maintainerPATCH 21/312 MIPS: Fix BC1{EQ,NE}Z return offset calculation
In reply to Greg Kroah-HartmanFrom: Paul Burton <[email protected]>
commit ac1496980f1d2752f26769f5db63afbc9ac2b603 upstream.
The conditions for branching when emulating the BC1EQZ & BC1NEZ instructions were backwards, leading to each of those instructions being treated as the other. Fix this by reversing the conditions, and clear up the code a little for readability & checkpatch.
Patchwork: https://patchwork.linux-mips.org/patch/13151/
--- arch/mips/kernel/branch.c | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-)
arch/mips/kernel/branch.c +3 -15
@@ -685,21 +685,9 @@ int __compute_return_epc_for_insn(struct }lose_fpu (1 );/* Save FPU state for the emulator. */ reg = insn.i_format.rt; - bit =0 ; -switch (insn.i_format.rs) { -case bc1eqz_op: -/* Test bit 0 */ -if (get_fpr32 (¤t->thread.fpu.fpr[reg],0 ) - &0x1 ) - bit =1 ; -break ; -case bc1nez_op: -/* Test bit 0 */ -if (!(get_fpr32 (¤t->thread.fpu.fpr[reg],0 ) - &0x1 )) - bit =1 ; -break ; - } + bit =get_fpr32 (¤t->thread.fpu.fpr[reg],0 ) &0x1 ; +if (insn.i_format.rs == bc1eqz_op) + bit = !bit;own_fpu (1 );if (bit) epc = epc + 4 +
Greg Kroah-Hartman
maintainerPATCH 22/312 MIPS: math-emu: Fix m{add,sub}.s shifts
In reply to Greg Kroah-HartmanFrom: Paul Burton <[email protected]>
commit db57f29d50683afd75c7f8b9908af7669837c3a9 upstream.
The code in _sp_maddf (formerly ieee754sp_madd) appears to have been copied verbatim from ieee754sp_add, and although it's adding the unpacked "r" & "z" floats it kept using macros that operate on "x" & "y". This led to the addition being carried out incorrectly on some mismash of the product, accumulator & multiplicand fields. Typically this would lead to the assertions "ze == re" & "ze <= SP_EMAX" failing since ze & re hadn't been operated upon.
Patchwork: https://patchwork.linux-mips.org/patch/13159/
--- arch/mips/math-emu/ieee754sp.c | 3 ++- arch/mips/math-emu/ieee754sp.h | 16 +++++++--------- arch/mips/math-emu/sp_add.c | 6 ++++-- arch/mips/math-emu/sp_maddf.c | 13 ++++++++----- arch/mips/math-emu/sp_sub.c | 6 ++++-- 5 files changed, 25 insertions(+), 19 deletions(-)
arch/mips/math-emu/ieee754sp.c +2 -1
@@ -130,7 +130,8 @@ union ieee754sp ieee754sp_format(int sn, }else {/* sticky right shift es bits */ -SPXSRSXn (es); + xm =XSPSRS (xm, es); + xe += es;assert ((xm & (SP_HIDDEN_BIT <<3 )) ==0 );assert (xe ==SP_EMIN ); }
arch/mips/math-emu/ieee754sp.h +7 -9
@@ -46,19 +46,17 @@ static inline int ieee754sp_finite(union }/* 3bit extended single precision sticky right shift */ -#define SPXSRSXn (rs) \ - (xe += rs, \ - xm = (rs > (SP_FBITS+3))?1:((xm) >> (rs)) | ((xm) << (32-(rs)) != 0)) +#define XSPSRS (v, rs) \ + ((rs > (SP_FBITS+3))?1:((v) >> (rs)) | ((v) << (32-(rs)) != 0)) -#define SPXSRSX1 () \ - (xe++, (xm = (xm >> 1) | (xm & 1))) +#define XSPSRS1 (m) \ + ((m >> 1) | (m & 1)) -#define SPXSRSYn (rs) \ - (ye+=rs, \ - ym = (rs > (SP_FBITS+3))?1:((ym) >> (rs)) | ((ym) << (32-(rs)) != 0)) +#define SPXSRSX1 () \ + (xe++, (xm = XSPSRS1(xm)))#define SPXSRSY1 () \ - (ye++, (ym = (ym >> 1) | (ym & 1))) + (ye++, (ym = XSPSRS1(ym)))/* convert denormal to normalized with extended exponent */ #define SPDNORMx (m,e) \
arch/mips/math-emu/sp_add.c +4 -2
@@ -132,13 +132,15 @@ union ieee754sp ieee754sp_add(union ieee* Have to shift y fraction right to align. */ s = xe - ye; -SPXSRSYn (s); + ym =XSPSRS (ym, s); + ye += s; }else if (ye > xe) {/* * Have to shift x fraction right to align. */ s = ye - xe; -SPXSRSXn (s); + xm =XSPSRS (xm, s); + xe += s; }assert (xe == ye);assert (xe <=SP_EMAX );
arch/mips/math-emu/sp_maddf.c +8 -5
@@ -208,16 +208,18 @@ union ieee754sp ieee754sp_maddf(union ieif (ze > re) {/* -* Have to shift y fraction right to align. +* Have to shift r fraction right to align. */ s = ze - re; -SPXSRSYn (s); + rm =XSPSRS (rm, s); + re += s; }else if (re > ze) {/* -* Have to shift x fraction right to align. +* Have to shift z fraction right to align. */ s = re - ze; -SPXSRSYn (s); + zm =XSPSRS (zm, s); + ze += s; }assert (ze == re);assert (ze <=SP_EMAX );
@@ -230,7 +232,8 @@ union ieee754sp ieee754sp_maddf(union ie zm = zm + rm;if (zm >> (SP_FBITS +1 +3 )) {/* carry out */ -SPXSRSX1 (); + zm =XSPSRS1 (zm); + ze++; } }else {if (zm >= rm) {
arch/mips/math-emu/sp_sub.c +4 -2
@@ -134,13 +134,15 @@ union ieee754sp ieee754sp_sub(union ieee* have to shift y fraction right to align */ s = xe - ye; -SPXSRSYn (s); + ym =XSPSRS (ym, s); + ye += s; }else if (ye > xe) {/* * have to shift x fraction right to align */ s = ye - xe; -SPXSRSXn (s); + xm =XSPSRS (xm, s); + xe += s; }assert (xe == ye);assert (xe <=SP_EMAX );
Greg Kroah-Hartman
maintainerPATCH 23/312 MIPS: perf: Fix I6400 event numbers
In reply to Greg Kroah-HartmanFrom: James Hogan <[email protected]>
commit fd716fca10fc3dc0f18b8c16d4ecfa6d93f010d2 upstream.
Fix perf hardware performance counter event numbers for I6400. This core does not follow the performance event numbering scheme of previous MIPS cores. All performance counters (both odd and even) are capable of counting any of the available events.
Patchwork: https://patchwork.linux-mips.org/patch/13259/
--- arch/mips/kernel/perf_event_mipsxx.c | 54 +++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-)
arch/mips/kernel/perf_event_mipsxx.c +52 -2
@@ -825,6 +825,16 @@ static const struct mips_perf_event mips [PERF_COUNT_HW_BRANCH_MISSES] = { 0x27, CNTR_ODD, T }, }; +static const struct mips_perf_event i6400_event_map[PERF_COUNT_HW_MAX ] = { + [PERF_COUNT_HW_CPU_CYCLES ] = {0x00 ,CNTR_EVEN |CNTR_ODD }, + [PERF_COUNT_HW_INSTRUCTIONS ] = {0x01 ,CNTR_EVEN |CNTR_ODD }, +/* These only count dcache, not icache */ + [PERF_COUNT_HW_CACHE_REFERENCES ] = {0x45 ,CNTR_EVEN |CNTR_ODD }, + [PERF_COUNT_HW_CACHE_MISSES ] = {0x48 ,CNTR_EVEN |CNTR_ODD }, + [PERF_COUNT_HW_BRANCH_INSTRUCTIONS ] = {0x15 ,CNTR_EVEN |CNTR_ODD }, + [PERF_COUNT_HW_BRANCH_MISSES ] = {0x16 ,CNTR_EVEN |CNTR_ODD }, +}; +static const struct mips_perf_event loongson3_event_map[PERF_COUNT_HW_MAX ] = { [PERF_COUNT_HW_CPU_CYCLES ] = {0x00 ,CNTR_EVEN }, [PERF_COUNT_HW_INSTRUCTIONS ] = {0x00 ,CNTR_ODD },
@@ -1015,6 +1025,46 @@ static const struct mips_perf_event mips }, }; +static const struct mips_perf_event i6400_cache_map + [PERF_COUNT_HW_CACHE_MAX ] + [PERF_COUNT_HW_CACHE_OP_MAX ] + [PERF_COUNT_HW_CACHE_RESULT_MAX ] = { +[C (L1D )] = { + [C (OP_READ )] = { + [C (RESULT_ACCESS )] = {0x46 ,CNTR_EVEN |CNTR_ODD }, + [C (RESULT_MISS )] = {0x49 ,CNTR_EVEN |CNTR_ODD }, + }, + [C (OP_WRITE )] = { + [C (RESULT_ACCESS )] = {0x47 ,CNTR_EVEN |CNTR_ODD }, + [C (RESULT_MISS )] = {0x4a ,CNTR_EVEN |CNTR_ODD }, + }, +}, +[C (L1I )] = { + [C (OP_READ )] = { + [C (RESULT_ACCESS )] = {0x84 ,CNTR_EVEN |CNTR_ODD }, + [C (RESULT_MISS )] = {0x85 ,CNTR_EVEN |CNTR_ODD }, + }, +}, +[C (DTLB )] = { +/* Can't distinguish read & write */ + [C (OP_READ )] = { + [C (RESULT_ACCESS )] = {0x40 ,CNTR_EVEN |CNTR_ODD }, + [C (RESULT_MISS )] = {0x41 ,CNTR_EVEN |CNTR_ODD }, + }, + [C (OP_WRITE )] = { + [C (RESULT_ACCESS )] = {0x40 ,CNTR_EVEN |CNTR_ODD }, + [C (RESULT_MISS )] = {0x41 ,CNTR_EVEN |CNTR_ODD }, + }, +}, +[C (BPU )] = { +/* Conditional branches / mispredicted */ + [C (OP_READ )] = { + [C (RESULT_ACCESS )] = {0x15 ,CNTR_EVEN |CNTR_ODD }, + [C (RESULT_MISS )] = {0x16 ,CNTR_EVEN |CNTR_ODD }, + }, +}, +}; +static const struct mips_perf_event loongson3_cache_map [PERF_COUNT_HW_CACHE_MAX ] [PERF_COUNT_HW_CACHE_OP_MAX ]
@@ -1720,8 +1770,8 @@ init_hw_perf_events(void)break ;case CPU_I6400 : mipspmu.name ="mips/I6400" ; - mipspmu.general_event_map = &mipsxxcore_event_map2; - mipspmu.cache_event_map = &mipsxxcore_cache_map2; + mipspmu.general_event_map = &i6400_event_map; + mipspmu.cache_event_map = &i6400_cache_map;break ;case CPU_1004K : mipspmu.name ="mips/1004K" ;
Greg Kroah-Hartman
maintainerPATCH 24/312 MIPS: Fix 64-bit HTW configuration
In reply to Greg Kroah-HartmanFrom: James Hogan <[email protected]>
commit aa76042a016474775ccd187c068669148c30c3bb upstream.
The Hardware page Table Walker (HTW) is being misconfigured on 64-bit kernels. The PWSize.PS (pointer size) bit determines whether pointers within directories are loaded as 32-bit or 64-bit addresses, but was never being set to 1 for 64-bit kernels where the unsigned long in pgd_t is 64-bits wide.
This actually reduces rather than improves performance when the HTW is enabled on P6600 since the HTW is initiated lots, but walks are all aborted due I think to bad intermediate pointers.
Since we were already taking the width of the PTEs into account by setting PWSize.PTEW, which is the left shift applied to the page table index *in addition to* the native pointer size, we also need to reduce PTEW by 1 when PS=1. This is done by calculating PTEW based on the relative size of pte_t compared to pgd_t.
Finally in order for the HTW to be used when PS=1, the appropriate XK/XS/XU bits corresponding to the different 64-bit segments need to be set in PWCtl. We enable only XU for now to enable walking for XUSeg.
Supporting walking for XKSeg would be a bit more involved so is left for a future patch. It would either require the use of a per-CPU top level base directory if supported by the HTW (a bit like pgd_current but with a second entry pointing at swapper_pg_dir), or the HTW would prepend bit 63 of the address to the global directory index which doesn't really match how we split user and kernel page directories.
Patchwork: https://patchwork.linux-mips.org/patch/13364/
--- arch/mips/mm/tlbex.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
arch/mips/mm/tlbex.c +12 -2
@@ -2329,15 +2329,25 @@ static void config_htw_params(void)if (CONFIG_PGTABLE_LEVELS >=3 ) pwsize |=ilog2 (PTRS_PER_PMD ) <<MIPS_PWSIZE_MDW_SHIFT ; - pwsize |=ilog2 (sizeof (pte_t)/4 ) <<MIPS_PWSIZE_PTEW_SHIFT ; +/* Set pointer size to size of directory pointers */ +if (config_enabled (CONFIG_64BIT )) + pwsize |=MIPS_PWSIZE_PS_MASK ; +/* PTEs may be multiple pointers long (e.g. with XPA) */ + pwsize |= ((PTE_T_LOG2 -PGD_T_LOG2 ) <<MIPS_PWSIZE_PTEW_SHIFT ) + &MIPS_PWSIZE_PTEW_MASK ;write_c0_pwsize (pwsize);/* Make sure everything is set before we enable the HTW */ back_to_back_c0_hazard (); -/* Enable HTW and disable the rest of the pwctl fields */ +/* +* Enable HTW (and only for XUSeg on 64-bit), and disable the rest of +* the pwctl fields. +*/ config =1 <<MIPS_PWCTL_PWEN_SHIFT ; +if (config_enabled (CONFIG_64BIT )) + config |=MIPS_PWCTL_XU_MASK ;write_c0_pwctl (config);pr_info ("Hardware Page Table Walker enabled\n" );
Greg Kroah-Hartman
maintainerPATCH 25/312 MIPS: Fix little endian microMIPS MSA encodings
In reply to Greg Kroah-HartmanFrom: James Hogan <[email protected]>
commit 6e1b29c3094688b6803fa1f9d5da676a7d0fbff9 upstream.
When the toolchain doesn't support MSA we encode MSA instructions explicitly in assembly. Unfortunately we use .word for both MIPS and microMIPS encodings which is wrong, since 32-bit microMIPS instructions are made up from a pair of halfwords.
- The most significant halfword always comes first, so for little endian builds the halves will be emitted in the wrong order.
- 32-bit alignment isn't guaranteed, so the assembler may insert a 16-bit nop instruction to pad the instruction stream to a 32-bit boundary.
Use the new instruction encoding macros to encode microMIPS MSA instructions correctly.
Patchwork: https://patchwork.linux-mips.org/patch/13312/
--- arch/mips/include/asm/asmmacro.h | 99 +++++++++++++++++++-------------------- arch/mips/include/asm/msa.h | 21 +++----- 2 files changed, 58 insertions(+), 62 deletions(-)
arch/mips/include/asm/asmmacro.h +50 -49
@@ -19,6 +19,28 @@#include <asm/asmmacro-64.h> #endif +/* +* Helper macros for generating raw instruction encodings. +*/ +#ifdef CONFIG_CPU_MICROMIPS + .macro insn32_if_mm enc + .insn + .hword ((\enc) >> 16) + .hword ((\enc) & 0xffff) + .endm + + .macro insn_if_mips enc + .endm +#else + .macro insn32_if_mm enc + .endm + + .macro insn_if_mips enc + .insn + .word (\enc) + .endm +#endif +#if defined(CONFIG_CPU_MIPSR2 ) || defined(CONFIG_CPU_MIPSR6 ) .macro local_irq_enable reg=t0 ei
@@ -336,38 +358,6 @@ .endm#else -#ifdef CONFIG_CPU_MICROMIPS -#define CFC_MSA_INSN 0x587e0056 -#define CTC_MSA_INSN 0x583e0816 -#define LDB_MSA_INSN 0x58000807 -#define LDH_MSA_INSN 0x58000817 -#define LDW_MSA_INSN 0x58000827 -#define LDD_MSA_INSN 0x58000837 -#define STB_MSA_INSN 0x5800080f -#define STH_MSA_INSN 0x5800081f -#define STW_MSA_INSN 0x5800082f -#define STD_MSA_INSN 0x5800083f -#define COPY_SW_MSA_INSN 0x58b00056 -#define COPY_SD_MSA_INSN 0x58b80056 -#define INSERT_W_MSA_INSN 0x59300816 -#define INSERT_D_MSA_INSN 0x59380816 -#else -#define CFC_MSA_INSN 0x787e0059 -#define CTC_MSA_INSN 0x783e0819 -#define LDB_MSA_INSN 0x78000820 -#define LDH_MSA_INSN 0x78000821 -#define LDW_MSA_INSN 0x78000822 -#define LDD_MSA_INSN 0x78000823 -#define STB_MSA_INSN 0x78000824 -#define STH_MSA_INSN 0x78000825 -#define STW_MSA_INSN 0x78000826 -#define STD_MSA_INSN 0x78000827 -#define COPY_SW_MSA_INSN 0x78b00059 -#define COPY_SD_MSA_INSN 0x78b80059 -#define INSERT_W_MSA_INSN 0x79300819 -#define INSERT_D_MSA_INSN 0x79380819 -#endif -/* * Temporary until all toolchains in use include MSA support. */
@@ -375,8 +365,8 @@ .set push .set noat SET_HARDFLOAT - .insn - .word CFC_MSA_INSN | (\cs << 11) + insn_if_mips 0x787e0059 | (\cs << 11) + insn32_if_mm 0x587e0056 | (\cs << 11) move \rd, $1 .set pop .endm
@@ -386,7 +376,8 @@ .set noatSET_HARDFLOAT move $1, \rs - .word CTC_MSA_INSN | (\cd << 6) + insn_if_mips 0x783e0819 | (\cd << 6) + insn32_if_mm 0x583e0816 | (\cd << 6) .set pop .endm
@@ -395,7 +386,8 @@ .set noatSET_HARDFLOAT PTR_ADDU $1, \base, \off - .word LDB_MSA_INSN | (\wd << 6) + insn_if_mips 0x78000820 | (\wd << 6) + insn32_if_mm 0x58000807 | (\wd << 6) .set pop .endm
@@ -404,7 +396,8 @@ .set noatSET_HARDFLOAT PTR_ADDU $1, \base, \off - .word LDH_MSA_INSN | (\wd << 6) + insn_if_mips 0x78000821 | (\wd << 6) + insn32_if_mm 0x58000817 | (\wd << 6) .set pop .endm
@@ -413,7 +406,8 @@ .set noatSET_HARDFLOAT PTR_ADDU $1, \base, \off - .word LDW_MSA_INSN | (\wd << 6) + insn_if_mips 0x78000822 | (\wd << 6) + insn32_if_mm 0x58000827 | (\wd << 6) .set pop .endm
@@ -422,7 +416,8 @@ .set noatSET_HARDFLOAT PTR_ADDU $1, \base, \off - .word LDD_MSA_INSN | (\wd << 6) + insn_if_mips 0x78000823 | (\wd << 6) + insn32_if_mm 0x58000837 | (\wd << 6) .set pop .endm
@@ -431,7 +426,8 @@ .set noatSET_HARDFLOAT PTR_ADDU $1, \base, \off - .word STB_MSA_INSN | (\wd << 6) + insn_if_mips 0x78000824 | (\wd << 6) + insn32_if_mm 0x5800080f | (\wd << 6) .set pop .endm
@@ -440,7 +436,8 @@ .set noatSET_HARDFLOAT PTR_ADDU $1, \base, \off - .word STH_MSA_INSN | (\wd << 6) + insn_if_mips 0x78000825 | (\wd << 6) + insn32_if_mm 0x5800081f | (\wd << 6) .set pop .endm
@@ -449,7 +446,8 @@ .set noatSET_HARDFLOAT PTR_ADDU $1, \base, \off - .word STW_MSA_INSN | (\wd << 6) + insn_if_mips 0x78000826 | (\wd << 6) + insn32_if_mm 0x5800082f | (\wd << 6) .set pop .endm
@@ -458,7 +456,8 @@ .set noatSET_HARDFLOAT PTR_ADDU $1, \base, \off - .word STD_MSA_INSN | (\wd << 6) + insn_if_mips 0x78000827 | (\wd << 6) + insn32_if_mm 0x5800083f | (\wd << 6) .set pop .endm
@@ -466,8 +465,8 @@ .set push .set noat SET_HARDFLOAT - .insn - .word COPY_SW_MSA_INSN | (\n << 16) | (\ws << 11) + insn_if_mips 0x78b00059 | (\n << 16) | (\ws << 11) + insn32_if_mm 0x58b00056 | (\n << 16) | (\ws << 11) .set pop .endm
@@ -475,8 +474,8 @@ .set push .set noat SET_HARDFLOAT - .insn - .word COPY_SD_MSA_INSN | (\n << 16) | (\ws << 11) + insn_if_mips 0x78b80059 | (\n << 16) | (\ws << 11) + insn32_if_mm 0x58b80056 | (\n << 16) | (\ws << 11) .set pop .endm
@@ -484,7 +483,8 @@ .set push .set noat SET_HARDFLOAT - .word INSERT_W_MSA_INSN | (\n << 16) | (\wd << 6) + insn_if_mips 0x79300819 | (\n << 16) | (\wd << 6) + insn32_if_mm 0x59300816 | (\n << 16) | (\wd << 6) .set pop .endm
@@ -492,7 +492,8 @@ .set push .set noat SET_HARDFLOAT - .word INSERT_D_MSA_INSN | (\n << 16) | (\wd << 6) + insn_if_mips 0x79380819 | (\n << 16) | (\wd << 6) + insn32_if_mm 0x59380816 | (\n << 16) | (\wd << 6) .set pop .endm#endif
arch/mips/include/asm/msa.h +8 -13
@@ -192,13 +192,6 @@ static inline void write_msa_##name(unsi* allow compilation with toolchains that do not support MSA. Once all * toolchains in use support MSA these can be removed. */ -#ifdef CONFIG_CPU_MICROMIPS -#define CFC_MSA_INSN 0x587e0056 -#define CTC_MSA_INSN 0x583e0816 -#else -#define CFC_MSA_INSN 0x787e0059 -#define CTC_MSA_INSN 0x783e0819 -#endif #define __BUILD_MSA_CTL_REG (name, cs) \ static inline unsigned int read_msa_##name(void) \
@@ -207,11 +200,12 @@ static inline unsigned int read_msa_##na __asm__ __volatile__( \" .set push\n" \" .set noat\n" \ -" .insn\n" \ - " .word %1 | (" #cs " << 11)\n" \ +" # cfcmsa $1, $%1\n" \ + _ASM_INSN_IF_MIPS(0x787e0059 | %1 << 11) \ + _ASM_INSN32_IF_MM(0x587e0056 | %1 << 11) \ " move %0, $1\n" \ " .set pop\n" \ - :"=r" (reg) :"i" (CFC_MSA_INSN )); \ + : "=r"(reg) : "i"(cs)); \return reg; \ } \ \
@@ -221,10 +215,11 @@ static inline void write_msa_##name(unsi" .set push\n" \" .set noat\n" \" move $1, %0\n" \ -" .insn\n" \ - " .word %1 | (" #cs " << 6)\n" \ +" # ctcmsa $%1, $1\n" \ + _ASM_INSN_IF_MIPS(0x783e0819 | %1 << 6) \ + _ASM_INSN32_IF_MM(0x583e0816 | %1 << 6) \ " .set pop\n" \ - : : "r"(val), "i"(CTC_MSA_INSN)); \ + : : "r"(val), "i"(cs)); \ }#endif /* !TOOLCHAIN_SUPPORTS_MSA */
Greg Kroah-Hartman
maintainerPATCH 26/312 MIPS: KVM: Fix translation of MFC0 ErrCtl
In reply to Greg Kroah-HartmanFrom: James Hogan <[email protected]>
commit 66ffc50c480e7ab6ad5642f47276435a8873c31a upstream.
The MIPS KVM dynamic translation is meant to translate "MFC0 rt, ErrCtl" instructions into "ADD rt, zero, zero" to zero the destination register, however the rt register number was copied into rt of the ADD instruction encoding, which is the 2nd source operand. This results in "ADD zero, zero, rt" which is a no-op, so only the first execution of each such MFC0 from ErrCtl will actually read 0.
Fix the shift to put the rt from the MFC0 encoding into the rd field of the ADD.
--- arch/mips/kvm/dyntrans.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kvm/dyntrans.c +1 -1
@@ -82,7 +82,7 @@ int kvm_mips_trans_mfc0(uint32_t inst, uif ((rd ==MIPS_CP0_ERRCTL ) && (sel ==0 )) { mfc0_inst =CLEAR_TEMPLATE ; - mfc0_inst |= ((rt &0x1f ) <<16 ); + mfc0_inst |= ((rt &0x1f ) <<11 ); }else { mfc0_inst =LW_TEMPLATE ; mfc0_inst |= ((rt &0x1f ) <<16 );
Greg Kroah-Hartman
maintainerPATCH 27/312 MIPS: SMP: Update cpu_foreign_map on CPU disable
In reply to Greg Kroah-HartmanFrom: James Hogan <[email protected]>
commit 826e99be6ab5189dbfb096389016ffb8d20a683e upstream.
When a CPU is disabled via CPU hotplug, cpu_foreign_map is not updated. This could result in cache management SMP calls being sent to offline CPUs instead of online siblings in the same core.
Add a call to calculate_cpu_foreign_map() in the various MIPS cpu disable callbacks after set_cpu_online(). All cases are updated for consistency and to keep cpu_foreign_map strictly up to date, not just those which may support hardware multithreading.
Patchwork: https://patchwork.linux-mips.org/patch/13799/
--- arch/mips/cavium-octeon/smp.c | 1 + arch/mips/include/asm/smp.h | 2 ++ arch/mips/kernel/smp-bmips.c | 1 + arch/mips/kernel/smp-cps.c | 1 + arch/mips/kernel/smp.c | 2 +- arch/mips/loongson64/loongson-3/smp.c | 1 + 6 files changed, 7 insertions(+), 1 deletion(-)
arch/mips/cavium-octeon/smp.c +1 -0
@@ -239,6 +239,7 @@ static int octeon_cpu_disable(void)return -ENOTSUPP ;set_cpu_online (cpu, false); +calculate_cpu_foreign_map ();cpumask_clear_cpu (cpu, &cpu_callin_map);octeon_fixup_irqs ();
arch/mips/include/asm/smp.h +2 -0
@@ -63,6 +63,8 @@ extern cpumask_t cpu_coherent_mask; extern void asmlinkage smp_bootstrap(void); +extern void calculate_cpu_foreign_map (void ); +/* * this function sends a 'reschedule' IPI to another CPU. * it goes straight through and wastes no time serializing
arch/mips/kernel/smp-bmips.c +1 -0
@@ -362,6 +362,7 @@ static int bmips_cpu_disable(void)pr_info ("SMP: CPU%d is offline\n" , cpu);set_cpu_online (cpu, false); +calculate_cpu_foreign_map ();cpumask_clear_cpu (cpu, &cpu_callin_map);clear_c0_status (IE_IRQ5 );
arch/mips/kernel/smp-cps.c +1 -0
@@ -338,6 +338,7 @@ static int cps_cpu_disable(void)atomic_sub (1 <<cpu_vpe_id (¤t_cpu_data), &core_cfg->vpe_mask);smp_mb__after_atomic ();set_cpu_online (cpu, false); +calculate_cpu_foreign_map ();cpumask_clear_cpu (cpu, &cpu_callin_map);return 0 ;
arch/mips/kernel/smp.c +1 -1
@@ -118,7 +118,7 @@ static inline void set_cpu_core_map(int* Calculate a new cpu_foreign_map mask whenever a * new cpu appears or disappears. */ -static inline void calculate_cpu_foreign_map (void ) +void calculate_cpu_foreign_map (void ) {int i, k, core_present;cpumask_t temp_foreign_map;
arch/mips/loongson64/loongson-3/smp.c +1 -0
@@ -417,6 +417,7 @@ static int loongson3_cpu_disable(void)return -EBUSY ;set_cpu_online (cpu, false); +calculate_cpu_foreign_map ();cpumask_clear_cpu (cpu, &cpu_callin_map);local_irq_save (flags);fixup_irqs ();
Greg Kroah-Hartman
maintainerPATCH 28/312 MIPS: c-r4k: Fix protected_writeback_scache_line for EVA
In reply to Greg Kroah-HartmanFrom: James Hogan <[email protected]>
commit 0758b116b4080d9a2a2a715bec6eee2cbd828215 upstream.
The protected_writeback_scache_line() function is used by local_r4k_flush_cache_sigtramp() to flush an FPU delay slot emulation trampoline on the userland stack from the caches so it is visible to subsequent instruction fetches.
Commit de8974e3f76c ("MIPS: asm: r4kcache: Add EVA cache flushing functions") updated some protected_ cache flush functions to use EVA CACHEE instructions via protected_cachee_op(), and commit 83fd43449baa ("MIPS: r4kcache: Add EVA case for protected_writeback_dcache_line") did the same thing for protected_writeback_dcache_line(), but protected_writeback_scache_line() never got updated. Lets fix that now to flush the right user address from the secondary cache rather than some arbitrary kernel unmapped address.
This issue was spotted through code inspection, and it seems unlikely to be possible to hit this in practice. It theoretically affect EVA kernels on EVA capable cores with an L2 cache, where the icache fetches straight from RAM (cpu_icache_snoops_remote_store == 0), running a hard float userland with FPU disabled (nofpu). That both Malta and Boston platforms override cpu_icache_snoops_remote_store to 1 suggests that all MIPS cores fetch instructions into icache straight from L2 rather than RAM.
Patchwork: https://patchwork.linux-mips.org/patch/13800/
--- arch/mips/include/asm/r4kcache.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/mips/include/asm/r4kcache.h +4 -0
@@ -210,7 +210,11 @@ static inline void protected_writeback_dstatic inline void protected_writeback_scache_line (unsigned long addr) { +#ifdef CONFIG_EVA +protected_cachee_op (Hit_Writeback_Inv_SD, addr); +#else protected_cache_op (Hit_Writeback_Inv_SD, addr); +#endif }/*
Greg Kroah-Hartman
maintainerPATCH 29/312 MIPS: Octeon: Off by one in octeon_irq_gpio_map()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 008d0cf1ec69ec6d2c08f2d23aff2b67cbe5d2af upstream.
It should be >= ARRAY_SIZE() instead of > ARRAY_SIZE().
Patchwork: https://patchwork.linux-mips.org/patch/13813/
--- arch/mips/cavium-octeon/octeon-irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/cavium-octeon/octeon-irq.c +1 -1
@@ -1220,7 +1220,7 @@ static int octeon_irq_gpio_map(struct ir line = (hw + gpiod->base_hwirq) >>6 ; bit = (hw + gpiod->base_hwirq) &63 ; -if (line >ARRAY_SIZE (octeon_irq_ciu_to_irq) || +if (line >=ARRAY_SIZE (octeon_irq_ciu_to_irq) || octeon_irq_ciu_to_irq[line][bit] !=0 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 30/312 bpf, mips: fix off-by-one in ctx offset allocation
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
commit b4e76f7e6d3200462c6354a6ad4ae167459e61f8 upstream.
Dan Carpenter reported [1] a static checker warning that ctx->offsets[] may be accessed off by one from build_body(), since it's allocated with fp->len * sizeof(*ctx.offsets) as length. The cBPF arm and ppc code doesn't have this issue as claimed, so only mips seems to be affected and should like most other JITs allocate with fp->len + 1. A few number of JITs (x86, sparc, arm64) handle this differently, where they only require fp->len array elements.
[1] http://www.spinics.net/lists/mips/msg64193.html
Patchwork: https://patchwork.linux-mips.org/patch/13814/
--- arch/mips/net/bpf_jit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/net/bpf_jit.c +1 -1
@@ -1207,7 +1207,7 @@ void bpf_jit_compile(struct bpf_prog *fpmemset (&ctx,0 ,sizeof (ctx)); - ctx.offsets =kcalloc (fp->len,sizeof (*ctx.offsets),GFP_KERNEL ); + ctx.offsets =kcalloc (fp->len +1 ,sizeof (*ctx.offsets),GFP_KERNEL );if (ctx.offsets ==NULL )return ;
Greg Kroah-Hartman
maintainerPATCH 31/312 MIPS: RM7000: Double locking bug in rm7k_tc_disable()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 58a7e1c140f3ad61646bc0cd9a1f6a9cafc0b225 upstream.
We obviously intended to enable IRQs again at the end.
Patchwork: https://patchwork.linux-mips.org/patch/13815/
--- arch/mips/mm/sc-rm7k.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/mm/sc-rm7k.c +1 -1
@@ -161,7 +161,7 @@ static void rm7k_tc_disable(void)local_irq_save (flags);blast_rm7k_tcache ();clear_c0_config (RM7K_CONF_TE ); -local_irq_save (flags); +local_irq_restore (flags); }static void rm7k_sc_disable (void )
Greg Kroah-Hartman
maintainerPATCH 32/312 MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
In reply to Greg Kroah-HartmanFrom: James Hogan <[email protected]>
commit 233b2ca181f20674ecad11be90b00814911ce345 upstream.
AT_VECTOR_SIZE_ARCH should be defined with the maximum number of NEW_AUX_ENT entries that ARCH_DLINFO can contain, but it wasn't defined for MIPS at all even though ARCH_DLINFO will contain one NEW_AUX_ENT for the VDSO address.
This shouldn't be a problem as AT_VECTOR_SIZE_BASE includes space for AT_BASE_PLATFORM which MIPS doesn't use, but lets define it now and add the comment above ARCH_DLINFO as found in several other architectures to remind future modifiers of ARCH_DLINFO to keep AT_VECTOR_SIZE_ARCH up to date.
Patchwork: https://patchwork.linux-mips.org/patch/13823/
--- arch/mips/include/asm/elf.h | 1 + arch/mips/include/uapi/asm/auxvec.h | 2 ++ 2 files changed, 3 insertions(+)
arch/mips/include/asm/elf.h +1 -0
@@ -420,6 +420,7 @@ extern const char *__elf_platform;#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)#endif +/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */ #define ARCH_DLINFO \ do { \ NEW_AUX_ENT(AT_SYSINFO_EHDR, \
arch/mips/include/uapi/asm/auxvec.h +2 -0
@@ -14,4 +14,6 @@/* Location of VDSO image. */ #define AT_SYSINFO_EHDR 33 +#define AT_VECTOR_SIZE_ARCH 1/* entries in ARCH_DLINFO */ +#endif /* __ASM_AUXVEC_H */
Greg Kroah-Hartman
maintainerPATCH 33/312 mips/panic: replace smp_send_stop() with kdump friendly version in panic path
In reply to Greg Kroah-HartmanFrom: Hidehiro Kawai <[email protected]>
commit 54c721b857fd45f3ad3bda695ee4f472518db02a upstream.
Daniel Walker reported problems which happens when crash_kexec_post_notifiers kernel option is enabled
(https://lkml.org/lkml/2015/6/24/44).
In that case, smp_send_stop() is called before entering kdump routines which assume other CPUs are still online. As the result, kdump routines fail to save other CPUs' registers. Additionally for MIPS OCTEON, it misses to stop the watchdog timer.
To fix this problem, call a new kdump friendly function, crash_smp_send_stop(), instead of the smp_send_stop() when crash_kexec_post_notifiers is enabled. crash_smp_send_stop() is a weak function, and it just call smp_send_stop(). Architecture codes should override it so that kdump can work appropriately. This patch provides MIPS version.
--- arch/mips/cavium-octeon/setup.c | 14 ++++++++++++++ arch/mips/include/asm/kexec.h | 1 + arch/mips/kernel/crash.c | 18 +++++++++++++++++- arch/mips/kernel/machine_kexec.c | 1 + 4 files changed, 33 insertions(+), 1 deletion(-)
arch/mips/cavium-octeon/setup.c +14 -0
@@ -251,6 +251,17 @@ static void octeon_crash_shutdown(struct default_machine_crash_shutdown(regs); } +#ifdef CONFIG_SMP +void octeon_crash_smp_send_stop (void ) +{ +int cpu; + +/* disable watchdogs */ +for_each_online_cpu (cpu) +cvmx_write_csr (CVMX_CIU_WDOGX (cpu_logical_map (cpu)),0 ); +} +#endif +#endif /* CONFIG_KEXEC */ #ifdef CONFIG_CAVIUM_RESERVE32
@@ -864,6 +875,9 @@ void __init prom_init(void) _machine_kexec_shutdown = octeon_shutdown; _machine_crash_shutdown = octeon_crash_shutdown; _machine_kexec_prepare = octeon_kexec_prepare; +#ifdef CONFIG_SMP + _crash_smp_send_stop = octeon_crash_smp_send_stop; +#endif #endif octeon_user_io_init ();
arch/mips/include/asm/kexec.h +1 -0
@@ -45,6 +45,7 @@ extern const unsigned char kexec_smp_waiextern unsigned long secondary_kexec_args[4 ];extern void (*relocated_kexec_smp_wait) (void *);extern atomic_t kexec_ready_to_reboot; +extern void (*_crash_smp_send_stop)(void );#endif #endif
arch/mips/kernel/crash.c +17 -1
@@ -50,9 +50,14 @@ static void crash_shutdown_secondary(voistatic void crash_kexec_prepare_cpus (void ) { +static int cpus_stopped;unsigned int msecs; +unsigned int ncpus; -unsigned int ncpus =num_online_cpus () -1 ;/* Excluding the panic cpu */ +if (cpus_stopped) +return ; + + ncpus =num_online_cpus () -1 ;/* Excluding the panic cpu */ dump_send_ipi (crash_shutdown_secondary);smp_wmb ();
@@ -67,6 +72,17 @@ static void crash_kexec_prepare_cpus(voicpu_relax (); mdelay(1); } + + cpus_stopped =1 ; +} + +/* Override the weak function in kernel/panic.c */ +void crash_smp_send_stop (void ) +{ +if (_crash_smp_send_stop) +_crash_smp_send_stop (); + +crash_kexec_prepare_cpus (); }#else /* !defined(CONFIG_SMP) */
arch/mips/kernel/machine_kexec.c +1 -0
@@ -25,6 +25,7 @@ void (*_machine_crash_shutdown)(struct p#ifdef CONFIG_SMP void (*relocated_kexec_smp_wait) (void *);atomic_t kexec_ready_to_reboot =ATOMIC_INIT (0 ); +void (*_crash_smp_send_stop)(void ) =NULL ;#endif int
Greg Kroah-Hartman
maintainerPATCH 34/312 ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit c61f30a255550bbfc6b83c1ca720661489cac4c0 upstream.
On r8a7740/armadillo, actual clock rates are ca. 4% lower than reported by /sys/kernel/debug/clk/clk_summary. Correct the extal1 frequency from 25 MHz to 24 MHz to fix this.
This matches the Armadillo-800 EVA Product Manual, which claims the main crystal runs at 24 MHz, and the old legacy/reference board code.
--- arch/arm/boot/dts/r8a7740-armadillo800eva.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/r8a7740-armadillo800eva.dts +1 -1
@@ -180,7 +180,7 @@ }; &extal1_clk { - clock-frequency = <25000000>; + clock-frequency = <24000000>; }; &extal2_clk { clock-frequency = <48000000>;
Greg Kroah-Hartman
maintainerPATCH 35/312 ARM: imx: select SRC for i.MX7
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit f1858b0e801a45d801dc23bc1ff5be14805022c8 upstream.
The i.MX7 Kconfig option had a couple of missing select lines that I fixed already, but I missed HAVE_IMX_SRC:
arch/arm/mach-imx/built-in.o: In function `imx7d_init_irq':
platform-spi_imx.c:(.init.text+0x25a8): undefined reference to `imx_src_init'
This adds that one as well.
--- arch/arm/mach-imx/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-imx/Kconfig +1 -0
@@ -562,6 +562,7 @@ config SOC_IMX7D select ARM_GIC select HAVE_IMX_ANATOP select HAVE_IMX_MMDC + select HAVE_IMX_SRC help This enables support for Freescale i.MX7 Dual processor.
Greg Kroah-Hartman
maintainerPATCH 36/312 ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl
In reply to Greg Kroah-HartmanFrom: Roger Shimizu <[email protected]>
commit 144e08abe80080c9c2cf0a06e40f1bc8150674eb upstream.
For kirkwood, gpio pins starts from 32 are in the 2nd bank, so it should be converted to "gpio1 <pin minus 32>" in dts file.
e.g. gpio 40 should be "gpio1 8"
Besides, a few other pin fixes for ls-wxl/wsxl, to match with mpp pin definition:
- gpio-leds: "lswxl:blue:power" pin
- gpio-leds: "lswxl:red:func" pin
- gpio-leds: "lswxl:red:hdderr0" pin
- gpio-leds: "lswxl:red:hdderr1" pin
- gpio-fan: low/high/alarm pin
The pin/bank issue was found when discussing Debian Bug #810894
[https://bugs.debian.org/810894#47]
--- arch/arm/boot/dts/kirkwood-lswxl.dts | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-)
arch/arm/boot/dts/kirkwood-lswxl.dts +15 -14
@@ -1,7 +1,8 @@ /* * Device Tree file for Buffalo Linkstation LS-WXL/WSXL * - * Copyright (C) 2015, [email protected] + * Copyright (C) 2015, 2016 + * Roger Shimizu <[email protected]> * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License
@@ -156,21 +157,21 @@ button@1 { label = "Function Button"; linux,code = <KEY_OPTION>; - gpios = <&gpio1 41 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 9 GPIO_ACTIVE_LOW>; }; button@2 { label = "Power-on Switch"; linux,code = <KEY_RESERVED>; linux,input-type = <5>; - gpios = <&gpio1 42 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 10 GPIO_ACTIVE_LOW>; }; button@3 { label = "Power-auto Switch"; linux,code = <KEY_ESC>; linux,input-type = <5>; - gpios = <&gpio1 43 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 11 GPIO_ACTIVE_LOW>; }; };
@@ -185,12 +186,12 @@ led@1 { label = "lswxl:blue:func"; - gpios = <&gpio1 36 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; }; led@2 { label = "lswxl:red:alarm"; - gpios = <&gpio1 49 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 17 GPIO_ACTIVE_LOW>; }; led@3 {
@@ -200,23 +201,23 @@ led@4 { label = "lswxl:blue:power"; - gpios = <&gpio1 8 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 7 GPIO_ACTIVE_LOW>; }; led@5 { label = "lswxl:red:func"; - gpios = <&gpio1 5 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 2 GPIO_ACTIVE_LOW>; default-state = "keep"; }; led@6 { label = "lswxl:red:hdderr0"; - gpios = <&gpio1 2 GPIO_ACTIVE_LOW>; + gpios = <&gpio0 8 GPIO_ACTIVE_LOW>; }; led@7 { label = "lswxl:red:hdderr1"; - gpios = <&gpio1 3 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 14 GPIO_ACTIVE_LOW>; }; };
@@ -225,15 +226,15 @@ pinctrl-0 = <&pmx_fan_low &pmx_fan_high &pmx_fan_lock>; pinctrl-names = "default"; - gpios = <&gpio0 47 GPIO_ACTIVE_LOW - &gpio0 48 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 16 GPIO_ACTIVE_LOW + &gpio1 15 GPIO_ACTIVE_LOW>; gpio-fan,speed-map = <0 3 1500 2 3250 1 5000 0>; - alarm-gpios = <&gpio1 49 GPIO_ACTIVE_HIGH>; + alarm-gpios = <&gpio1 8 GPIO_ACTIVE_HIGH>; }; restart_poweroff {
@@ -256,7 +257,7 @@ enable-active-high; regulator-always-on; regulator-boot-on; - gpio = <&gpio0 37 GPIO_ACTIVE_HIGH>; + gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>; }; hdd_power0: regulator@2 { compatible = "regulator-fixed";
Greg Kroah-Hartman
maintainerPATCH 37/312 ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl
In reply to Greg Kroah-HartmanFrom: Roger Shimizu <[email protected]>
commit 6f86e9adc53b4c0a2a4283692216d119019f0b8d upstream.
For kirkwood, gpio pins starts from 32 are in the 2nd bank, so it should be converted to "gpio1 <pin minus 32>" in dts file.
e.g. gpio 40 should be "gpio1 8"
The pin/bank issue was found when discussing Debian Bug #810894
[https://bugs.debian.org/810894#47]
--- arch/arm/boot/dts/kirkwood-lswvl.dts | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
arch/arm/boot/dts/kirkwood-lswvl.dts +13 -12
@@ -1,7 +1,8 @@ /* * Device Tree file for Buffalo Linkstation LS-WVL/VL * - * Copyright (C) 2015, [email protected] + * Copyright (C) 2015, 2016 + * Roger Shimizu <[email protected]> * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License
@@ -156,21 +157,21 @@ button@1 { label = "Function Button"; linux,code = <KEY_OPTION>; - gpios = <&gpio0 45 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 13 GPIO_ACTIVE_LOW>; }; button@2 { label = "Power-on Switch"; linux,code = <KEY_RESERVED>; linux,input-type = <5>; - gpios = <&gpio0 46 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 14 GPIO_ACTIVE_LOW>; }; button@3 { label = "Power-auto Switch"; linux,code = <KEY_ESC>; linux,input-type = <5>; - gpios = <&gpio0 47 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 15 GPIO_ACTIVE_LOW>; }; };
@@ -185,38 +186,38 @@ led@1 { label = "lswvl:red:alarm"; - gpios = <&gpio0 36 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; }; led@2 { label = "lswvl:red:func"; - gpios = <&gpio0 37 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 5 GPIO_ACTIVE_LOW>; }; led@3 { label = "lswvl:amber:info"; - gpios = <&gpio0 38 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 6 GPIO_ACTIVE_LOW>; }; led@4 { label = "lswvl:blue:func"; - gpios = <&gpio0 39 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 7 GPIO_ACTIVE_LOW>; }; led@5 { label = "lswvl:blue:power"; - gpios = <&gpio0 40 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 8 GPIO_ACTIVE_LOW>; default-state = "keep"; }; led@6 { label = "lswvl:red:hdderr0"; - gpios = <&gpio0 34 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 2 GPIO_ACTIVE_LOW>; }; led@7 { label = "lswvl:red:hdderr1"; - gpios = <&gpio0 35 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 3 GPIO_ACTIVE_LOW>; }; };
@@ -233,7 +234,7 @@ 3250 1 5000 0>; - alarm-gpios = <&gpio0 43 GPIO_ACTIVE_HIGH>; + alarm-gpios = <&gpio1 11 GPIO_ACTIVE_HIGH>; }; restart_poweroff {
Greg Kroah-Hartman
maintainerPATCH 38/312 ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl
In reply to Greg Kroah-HartmanFrom: Roger Shimizu <[email protected]>
commit e98bd707e39d52d8bef8622e6e7b0ab4bd0ed8d0 upstream.
The GPIOs controlling the LEDs, listed below, are active high, not low:
- gpio-leds: "lswxl:blue:power" pin
- gpio-leds: "lswxl:red:func" pin
- gpio-leds: "lswxl:red:hdderr{0,1}" pin
--- arch/arm/boot/dts/kirkwood-lswxl.dts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm/boot/dts/kirkwood-lswxl.dts +5 -5
@@ -201,23 +201,23 @@ led@4 { label = "lswxl:blue:power"; - gpios = <&gpio1 7 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 7 GPIO_ACTIVE_HIGH>; + default-state = "keep"; }; led@5 { label = "lswxl:red:func"; - gpios = <&gpio1 2 GPIO_ACTIVE_LOW>; - default-state = "keep"; + gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>; }; led@6 { label = "lswxl:red:hdderr0"; - gpios = <&gpio0 8 GPIO_ACTIVE_LOW>; + gpios = <&gpio0 8 GPIO_ACTIVE_HIGH>; }; led@7 { label = "lswxl:red:hdderr1"; - gpios = <&gpio1 14 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 14 GPIO_ACTIVE_HIGH>; }; };
Greg Kroah-Hartman
maintainerPATCH 39/312 ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl
In reply to Greg Kroah-HartmanFrom: Roger Shimizu <[email protected]>
commit 0418138e2ffd90f4a00b263593f2e199db87321d upstream.
The GPIOs controlling the LEDs, listed below, are active high, not low:
- gpio-leds: "lswvl:red:alarm" pin
- gpio-leds: "lswvl:red:func" pin
- gpio-leds: "lswvl:amber:info" pin
- gpio-leds: "lswvl:blue:func" pin
- gpio-leds: "lswvl:red:hdderr{0,1}" pin
--- arch/arm/boot/dts/kirkwood-lswvl.dts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm/boot/dts/kirkwood-lswvl.dts +6 -6
@@ -186,22 +186,22 @@ led@1 { label = "lswvl:red:alarm"; - gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; }; led@2 { label = "lswvl:red:func"; - gpios = <&gpio1 5 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 5 GPIO_ACTIVE_HIGH>; }; led@3 { label = "lswvl:amber:info"; - gpios = <&gpio1 6 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 6 GPIO_ACTIVE_HIGH>; }; led@4 { label = "lswvl:blue:func"; - gpios = <&gpio1 7 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 7 GPIO_ACTIVE_HIGH>; }; led@5 {
@@ -212,12 +212,12 @@ led@6 { label = "lswvl:red:hdderr0"; - gpios = <&gpio1 2 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>; }; led@7 { label = "lswvl:red:hdderr1"; - gpios = <&gpio1 3 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 3 GPIO_ACTIVE_HIGH>; }; };
Greg Kroah-Hartman
maintainerPATCH 40/312 ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl
In reply to Greg Kroah-HartmanFrom: Roger Shimizu <[email protected]>
commit ff61ee84e7aa5842d9e33c0b442f0b43a6a44eaf upstream.
Here're a few gpio pin related fixes:
- remove pinctrl-0 definition from pinctrl, since those pins are used in other places such as gpio-fan and regulators.
- keep initial state of power led
- fix for alarm pin of gpio-fan.
--- arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts +4 -4
@@ -1,7 +1,8 @@ /* * Device Tree file for Buffalo Linkstation LS-WTGL * - * Copyright (C) 2015, Roger Shimizu <[email protected]> + * Copyright (C) 2015, 2016 + * Roger Shimizu <[email protected]> * * This file is dual-licensed: you can use it either under the terms * of the GPL or the X11 license, at your option. Note that this dual
@@ -69,8 +70,6 @@ internal-regs { pinctrl: pinctrl@10000 { - pinctrl-0 = <&pmx_usb_power &pmx_power_hdd - &pmx_fan_low &pmx_fan_high &pmx_fan_lock>; pinctrl-names = "default"; pmx_led_power: pmx-leds {
@@ -162,6 +161,7 @@ led@1 { label = "lswtgl:blue:power"; gpios = <&gpio0 0 GPIO_ACTIVE_LOW>; + default-state = "keep"; }; led@2 {
@@ -188,7 +188,7 @@ 3250 1 5000 0>; - alarm-gpios = <&gpio0 2 GPIO_ACTIVE_HIGH>; + alarm-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>; }; restart_poweroff {
Greg Kroah-Hartman
maintainerPATCH 41/312 ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl
In reply to Greg Kroah-HartmanFrom: Roger Shimizu <[email protected]>
commit 44361a2cc13493fc41216d33bb9a562ec3a9cc4e upstream.
MTD flash stores u-boot and u-boot environment on linkstation lswtgl. The latter one can be easily read/write by u-boot-tools package in Debian.
--- arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts | 31 +++++++++++++++++++++++ 1 file changed, 31 insertions(+)
arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts +31 -0
@@ -228,6 +228,37 @@ }; }; +&devbus_bootcs { + status = "okay"; + devbus,keep-config; + + flash@0 { + compatible = "jedec-flash"; + reg = <0 0x40000>; + bank-width = <1>; + + partitions { + compatible = "fixed-partitions"; + #address-cells = <1>; + #size-cells = <1>; + + header@0 { + reg = <0 0x30000>; + read-only; + }; + + uboot@30000 { + reg = <0x30000 0xF000>; + read-only; + }; + + uboot_env@3F000 { + reg = <0x3F000 0x1000>; + }; + }; + }; +}; + &mdio { status = "okay";
Greg Kroah-Hartman
maintainerPATCH 42/312 ARM: dts: kirkwood: use unique machine name for ds112
In reply to Greg Kroah-HartmanFrom: Heinrich Schuchardt <[email protected]>
commit 9d021c9d1b4b774a35d8a03d58dbf029544debda upstream.
Downstream packages like Debian flash-kernel use/proc/device-tree/model
to determine which dtb file to install.
Hence each dts in the Linux kernel should provide a unique model identifier.
Commit 2d0a7addbd10 ("ARM: Kirkwood: Add support for many Synology NAS devices") created the new files kirkwood-ds111.dts and kirkwood-ds112.dts using the same model identifier.
This patch provides a unique model identifier for the Synology DiskStation DS112.
--- arch/arm/boot/dts/kirkwood-ds112.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/kirkwood-ds112.dts +1 -1
@@ -14,7 +14,7 @@ #include "kirkwood-synology.dtsi" / { - model = "Synology DS111"; + model = "Synology DS112"; compatible = "synology,ds111", "marvell,kirkwood"; memory {
Greg Kroah-Hartman
maintainerPATCH 43/312 ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile
In reply to Greg Kroah-HartmanFrom: Heinrich Schuchardt <[email protected]>
commit fc5c796e12511a7c027b5a4438719dde2f796208 upstream.
Commit 2d0a7addbd10 ("ARM: Kirkwood: Add support for many Synology NAS devices") created the new file kirkwood-ds112.dts but did not add it to the Makefile.
--- arch/arm/boot/dts/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/Makefile +1 -0
@@ -166,6 +166,7 @@ dtb-$(CONFIG_MACH_KIRKWOOD) += \ kirkwood-ds109.dtb \ kirkwood-ds110jv10.dtb \ kirkwood-ds111.dtb \ + kirkwood-ds112.dtb \ kirkwood-ds209.dtb \ kirkwood-ds210.dtb \ kirkwood-ds212.dtb \
Greg Kroah-Hartman
maintainerPATCH 44/312 ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence
In reply to Greg Kroah-HartmanFrom: Suman Anna <[email protected]>
commit c20c8f750d9f8f8617f07ee2352d3ff560e66bc2 upstream.
The omap_hwmod _enable() function can return success without setting the hwmod state to _HWMOD_STATE_ENABLED for IPs with reset lines when all of the reset lines are asserted. The omap_hwmod _idle() function also performs a similar check, but after checking for the hwmod state first. This triggers the WARN when pm_runtime_get and pm_runtime_put are invoked on IPs with all reset lines asserted. Reverse the checks for hwmod state and reset lines status to fix this.
Issue found during a unbind operation on a device with reset lines still asserted, example backtrace below
------------[ cut here ]------------ WARNING: CPU: 1 PID: 879 at arch/arm/mach-omap2/omap_hwmod.c:2207 _idle+0x1e4/0x240() omap_hwmod: mmu_dsp: idle state can only be entered from enabled state Modules linked in: CPU: 1 PID: 879 Comm: sh Not tainted 4.4.0-00008-ga989d951331a #3 Hardware name: Generic OMAP5 (Flattened Device Tree) [<c0018e60>] (unwind_backtrace) from [<c0014dc4>] (show_stack+0x10/0x14) [<c0014dc4>] (show_stack) from [<c037ac28>] (dump_stack+0x90/0xc0) [<c037ac28>] (dump_stack) from [<c003f420>] (warn_slowpath_common+0x78/0xb4) [<c003f420>] (warn_slowpath_common) from [<c003f48c>] (warn_slowpath_fmt+0x30/0x40) [<c003f48c>] (warn_slowpath_fmt) from [<c0028c20>] (_idle+0x1e4/0x240) [<c0028c20>] (_idle) from [<c0029080>] (omap_hwmod_idle+0x28/0x48) [<c0029080>] (omap_hwmod_idle) from [<c002a5a4>] (omap_device_idle+0x3c/0x90) [<c002a5a4>] (omap_device_idle) from [<c0427a90>] (__rpm_callback+0x2c/0x60) [<c0427a90>] (__rpm_callback) from [<c0427ae4>] (rpm_callback+0x20/0x80) [<c0427ae4>] (rpm_callback) from [<c0427f84>] (rpm_suspend+0x138/0x74c) [<c0427f84>] (rpm_suspend) from [<c0428b78>] (__pm_runtime_idle+0x78/0xa8) [<c0428b78>] (__pm_runtime_idle) from [<c041f514>] (__device_release_driver+0x64/0x100) [<c041f514>] (__device_release_driver) from [<c041f5d0>] (device_release_driver+0x20/0x2c) [<c041f5d0>] (device_release_driver) from [<c041d85c>] (unbind_store+0x78/0xf8) [<c041d85c>] (unbind_store) from [<c0206df8>] (kernfs_fop_write+0xc0/0x1c4) [<c0206df8>] (kernfs_fop_write) from [<c018a120>] (__vfs_write+0x20/0xdc) [<c018a120>] (__vfs_write) from [<c018a9cc>] (vfs_write+0x90/0x164) [<c018a9cc>] (vfs_write) from [<c018b1f0>] (SyS_write+0x44/0x9c) [<c018b1f0>] (SyS_write) from [<c0010420>] (ret_fast_syscall+0x0/0x1c) ---[ end trace a4182013c75a9f50 ]---
While at this, fix the sequence in _shutdown() as well, though there is no easy reproducible scenario.
--- arch/arm/mach-omap2/omap_hwmod.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm/mach-omap2/omap_hwmod.c +6 -6
@@ -2207,15 +2207,15 @@ static int _idle(struct omap_hwmod *oh)pr_debug ("omap_hwmod: %s: idling\n" , oh->name); +if (_are_all_hardreset_lines_asserted (oh)) +return 0 ; +if (oh->_state != _HWMOD_STATE_ENABLED) {WARN (1 ,"omap_hwmod: %s: idle state can only be entered from enabled state\n" , oh->name);return -EINVAL ; } -if (_are_all_hardreset_lines_asserted (oh)) -return 0 ; -if (oh->class->sysc)_idle_sysc (oh);_del_initiator_dep (oh, mpu_oh);
@@ -2262,6 +2262,9 @@ static int _shutdown(struct omap_hwmod *int ret, i;u8 prev_state; +if (_are_all_hardreset_lines_asserted (oh)) +return 0 ; +if (oh->_state != _HWMOD_STATE_IDLE && oh->_state != _HWMOD_STATE_ENABLED) { WARN(1, "omap_hwmod: %s: disabled state can only be entered from idle, or enabled state\n",
@@ -2269,9 +2272,6 @@ static int _shutdown(struct omap_hwmod *return -EINVAL ; } -if (_are_all_hardreset_lines_asserted (oh)) -return 0 ; -pr_debug ("omap_hwmod: %s: disabling\n" , oh->name);if (oh->class->pre_shutdown) {
Greg Kroah-Hartman
maintainerPATCH 45/312 perf/x86: Fix filter_events() bug with event mappings
In reply to Greg Kroah-HartmanFrom: Stephane Eranian <[email protected]>
commit 61b87cae6361ea6af161c1ffa549898892707b19 upstream.
This patch fixes a bug in the filter_events() function.
The patch fixes the bug whereby if some mappings did not exist, e.g., STALLED_CYCLES_FRONTEND, then any event after it in the attrs array would disappear from the published list of events in /sys/devices/cpu/events. This could be verified easily on any system post SNB (which do not publish STALLED_CYCLES_FRONTEND):
$ ./perf stat -e cycles,ref-cycles true
Performance counter stats for 'true':
1,217,348 cycles
<not supported> ref-cyclesThe problem is that in filter_events() there is an assumption that the argument (attrs) is organized in increasing continuous event indexes related to the event_map(). But if we remove the non-supported events by shifing the position in the array, then the lookup x86_pmu.event_map() needs to compensate for it, otherwise we are looking up the wrong index. This patch corrects this problem by compensating for the deleted events and with that ref-cycles reappears (here shown on Haswell):
$ perf stat -e ref-cycles,cycles true
Performance counter stats for 'true':
4,525,910 ref-cycles
1,064,920 cycles
0.002943888 seconds time elapsed--- arch/x86/kernel/cpu/perf_event.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/perf_event.c +10 -1
@@ -1550,6 +1550,7 @@ static void __init filter_events(struct {struct device_attribute *d;struct perf_pmu_events_attr *pmu_attr; +int offset =0 ;int i, j;for (i =0 ; attrs[i]; i++) {
@@ -1558,7 +1559,7 @@ static void __init filter_events(struct/* str trumps id */ if (pmu_attr->event_str)continue ; -if (x86_pmu.event_map (i)) +if (x86_pmu.event_map (i + offset))continue ;for (j = i; attrs[j]; j++)
@@ -1566,6 +1567,14 @@ static void __init filter_events(struct/* Check the shifted attr. */ i--; + +/* +* event_map() is index based, the attrs array is organized +* by increasing event index. If we shift the events, then +* we need to compensate for the event_map(), otherwise +* we are looking up the wrong event in the map +*/ + offset++; } }
Greg Kroah-Hartman
maintainerPATCH 46/312 x86/LDT: Print the real LDT base address
In reply to Greg Kroah-HartmanFrom: Jan Beulich <[email protected]>
commit 0d430e3fb3f7cdc13c0d22078b820f682821b45a upstream.
This was meant to print base address and entry count; make it do so again.
--- arch/x86/kernel/process_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/process_64.c +1 -1
@@ -128,7 +128,7 @@ void release_thread(struct task_struct *if (dead_task->mm->context.ldt) {pr_warn ("WARNING: dead process %s still has LDT? <%p/%d>\n" , dead_task->comm, - dead_task->mm->context.ldt, + dead_task->mm->context.ldt->entries, dead_task->mm->context.ldt->size);BUG (); }
Greg Kroah-Hartman
maintainerPATCH 47/312 x86/apic/uv: Silence a shift wrapping warning
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit c4597fd756836a5fb7900f2091797ab564390ad0 upstream.
'm_io' is stored in 6 bits so it's a number in the 0-63 range. Static analysis tools complain that 1 << 63 will wrap so I have changed it to 1ULL << m_io.
This code is over three years old so presumably the bug doesn't happen very frequently in real life or someone would have complained by now.
--- arch/x86/kernel/apic/x2apic_uv_x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/apic/x2apic_uv_x.c +2 -2
@@ -648,9 +648,9 @@ static __init void map_mmioh_high_uv3(in l = li; } addr1 = (base << shift) + - f * (unsigned long )(1 << m_io); + f * (1ULL << m_io); addr2 = (base << shift) + - (l +1 ) * (unsigned long )(1 << m_io); + (l +1 ) * (1ULL << m_io);pr_info ("UV: %s[%03d..%03d] NASID 0x%04x ADDR 0x%016lx - 0x%016lx\n" , id, fi, li, lnasid, addr1, addr2);if (max_io < l)
Greg Kroah-Hartman
maintainerPATCH 48/312 ALSA: fm801: explicitly free IRQ line
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit e97e98c63b43040732ad5d1f0b38ad4a8371c73a upstream.
Otherwise we will have a warning on ->remove() since device is a PCI one.
WARNING: CPU: 4 PID: 1411 at /home/andy/prj/linux/fs/proc/generic.c:575 remove_proc_entry+0x137/0x160()
remove_proc_entry: removing non-empty directory 'irq/21', leaking at least 'snd_fm801'
--- sound/pci/fm801.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/fm801.c +2 -0
@@ -1173,6 +1173,8 @@ static int snd_fm801_free(struct fm801 * cmdw |=0x00c3 ;fm801_writew (chip,IRQ_MASK , cmdw); +devm_free_irq (&chip->pci->dev, chip->irq, chip); + __end_hw:#ifdef CONFIG_SND_FM801_TEA575X_BOOL if (!(chip->tea575x_tuner &TUNER_DISABLED )) {
Greg Kroah-Hartman
maintainerPATCH 49/312 ALSA: fm801: propagate TUNER_ONLY bit when autodetected
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit dbec6719ac036f68568d8488805d41346c021eff upstream.
The commit d7ba858a7f7a (ALSA: fm801: implement TEA575x tuner autodetection) brings autodetection to the driver. However the autodetection algorithm misses the TUNER_ONLY bit if it is supplied by the user.
Thus, user gets weird messages and no card registered.
snd_fm801 0000:0d:01.0: detected TEA575x radio type SF64-PCR snd_fm801 0000:0d:01.0: AC'97 interface is busy (1)
snd_fm801 0000:0d:01.0: AC'97 interface is busy (1)
...
snd_fm801 0000:0d:01.0: AC'97 0 does not respond - RESET snd_fm801 0000:0d:01.0: AC'97 interface is busy (1)
snd_fm801 0000:0d:01.0: AC'97 interface is busy (1)
snd_fm801 0000:0d:01.0: AC'97 0 access is not valid [0x0], removing mixer.
snd_fm801: probe of 0000:0d:01.0 failed with error -5
Do a copy of TUNER_ONLY bit to be applied after autodetection is done.
--- sound/pci/fm801.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/pci/fm801.c +4 -0
@@ -1259,6 +1259,8 @@ static int snd_fm801_create(struct snd_creturn -ENODEV ; } }else if ((tea575x_tuner &TUNER_TYPE_MASK ) ==0 ) { +unsigned int tuner_only = tea575x_tuner &TUNER_ONLY ; +/* autodetect tuner connection */ for (tea575x_tuner =1 ; tea575x_tuner <=3 ; tea575x_tuner++) { chip->tea575x_tuner = tea575x_tuner;
@@ -1273,6 +1275,8 @@ static int snd_fm801_create(struct snd_cdev_err (card->dev,"TEA575x radio not found\n" ); chip->tea575x_tuner =TUNER_DISABLED ; } + + chip->tea575x_tuner |= tuner_only; }if (!(chip->tea575x_tuner &TUNER_DISABLED )) { strlcpy(chip->tea.card, get_tea575x_gpio(chip)->name,
Greg Kroah-Hartman
maintainerPATCH 50/312 ALSA: fm801: detect FM-only card earlier
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit b56fa687e02b27f8bd9d282950a88c2ed23d766b upstream.
If user does not supply tea575x_tuner parameter the driver tries to detect the tuner type. The failed codec initialization is considered as FM-only card present, however the driver still registers an IRQ handler for it.
Move codec detection earlier to set tea575x_tuner parameter before check.
Here the following functions are introduced
reset_coded() resets AC97 codec
snd_fm801_chip_multichannel_init() initializes cards with multichannel support
--- sound/pci/fm801.c | 69 ++++++++++++++++++++++++++++++------------------------ 1 file changed, 39 insertions(+), 30 deletions(-)
sound/pci/fm801.c +39 -30
@@ -1088,26 +1088,20 @@ static int wait_for_codec(struct fm801 *return -EIO ; } -static int snd_fm801_chip_init (struct fm801 *chip,int resume) +static int reset_codec (struct fm801 *chip) { -unsigned short cmdw; - -if (chip->tea575x_tuner &TUNER_ONLY ) - goto __ac97_ok; -/* codec cold reset + AC'97 warm reset */ fm801_writew (chip,CODEC_CTRL , (1 <<5 ) | (1 <<6 ));fm801_readw (chip,CODEC_CTRL );/* flush posting data */ udelay (100 );fm801_writew (chip,CODEC_CTRL ,0 ); -if (wait_for_codec (chip,0 ,AC97_RESET ,msecs_to_jiffies (750 )) <0 ) -if (!resume) { -dev_info (chip->card->dev, -"Primary AC'97 codec not found, assume SF64-PCR (tuner-only)\n" ); - chip->tea575x_tuner =3 |TUNER_ONLY ; - goto __ac97_ok; - } +return wait_for_codec (chip,0 ,AC97_RESET ,msecs_to_jiffies (750 )); +} + +static void snd_fm801_chip_multichannel_init (struct fm801 *chip) +{ +unsigned short cmdw;if (chip->multichannel) {if (chip->secondary_addr) {
@@ -1134,8 +1128,11 @@ static int snd_fm801_chip_init(struct fm/* cause timeout problems */ wait_for_codec (chip,0 ,AC97_VENDOR_ID1 ,msecs_to_jiffies (750 )); } +} - __ac97_ok: +static void snd_fm801_chip_init (struct fm801 *chip) +{ +unsigned short cmdw;/* init volume */ fm801_writew (chip,PCM_VOL ,0x0808 );
@@ -1156,11 +1153,8 @@ static int snd_fm801_chip_init(struct fm/* interrupt clear */ fm801_writew (chip,IRQ_STATUS ,FM801_IRQ_PLAYBACK |FM801_IRQ_CAPTURE |FM801_IRQ_MPU ); - -return 0 ; } -static int snd_fm801_free (struct fm801 *chip) {unsigned short cmdw;
@@ -1217,7 +1211,23 @@ static int snd_fm801_create(struct snd_cif ((err =pci_request_regions (pci,"FM801" )) <0 )return err; chip->port =pci_resource_start (pci,0 ); -if ((tea575x_tuner &TUNER_ONLY ) ==0 ) { + +if (pci->revision >=0xb1 )/* FM801-AU */ + chip->multichannel =1 ; + +if (!(chip->tea575x_tuner &TUNER_ONLY )) { +if (reset_codec (chip) <0 ) { +dev_info (chip->card->dev, +"Primary AC'97 codec not found, assume SF64-PCR (tuner-only)\n" ); + chip->tea575x_tuner =3 |TUNER_ONLY ; + }else { +snd_fm801_chip_multichannel_init (chip); + } + } + +snd_fm801_chip_init (chip); + +if ((chip->tea575x_tuner &TUNER_ONLY ) ==0 ) {if (devm_request_irq (&pci->dev, pci->irq, snd_fm801_interrupt,IRQF_SHARED ,KBUILD_MODNAME , chip)) {dev_err (card->dev,"unable to grab IRQ %d\n" , pci->irq);
@@ -1228,13 +1238,6 @@ static int snd_fm801_create(struct snd_cpci_set_master (pci); } -if (pci->revision >=0xb1 )/* FM801-AU */ - chip->multichannel =1 ; - -snd_fm801_chip_init (chip,0 ); -/* init might set tuner access method */ - tea575x_tuner = chip->tea575x_tuner; -if ((err =snd_device_new (card,SNDRV_DEV_LOWLEVEL , chip, &ops)) <0 ) {snd_fm801_free (chip);return err;
@@ -1251,15 +1254,15 @@ static int snd_fm801_create(struct snd_c chip->tea.private_data = chip; chip->tea.ops = &snd_fm801_tea_ops;sprintf (chip->tea.bus_info,"PCI:%s" ,pci_name (pci)); -if ((tea575x_tuner &TUNER_TYPE_MASK ) >0 && - (tea575x_tuner &TUNER_TYPE_MASK ) <4 ) { +if ((chip->tea575x_tuner &TUNER_TYPE_MASK ) >0 && + (chip->tea575x_tuner &TUNER_TYPE_MASK ) <4 ) {if (snd_tea575x_init (&chip->tea,THIS_MODULE )) {dev_err (card->dev,"TEA575x radio not found\n" );snd_fm801_free (chip);return -ENODEV ; } - }else if ((tea575x_tuner &TUNER_TYPE_MASK ) ==0 ) { -unsigned int tuner_only = tea575x_tuner &TUNER_ONLY ; + }else if ((chip->tea575x_tuner &TUNER_TYPE_MASK ) ==0 ) { +unsigned int tuner_only = chip->tea575x_tuner &TUNER_ONLY ;/* autodetect tuner connection */ for (tea575x_tuner =1 ; tea575x_tuner <=3 ; tea575x_tuner++) {
@@ -1395,7 +1398,13 @@ static int snd_fm801_resume(struct devicstruct fm801 *chip = card->private_data;int i; -snd_fm801_chip_init (chip,1 ); +if (chip->tea575x_tuner &TUNER_ONLY ) { +snd_fm801_chip_init (chip); + }else { +reset_codec (chip); +snd_fm801_chip_multichannel_init (chip); +snd_fm801_chip_init (chip); + }snd_ac97_resume (chip->ac97);snd_ac97_resume (chip->ac97_sec);for (i =0 ; i <ARRAY_SIZE (saved_regs); i++)
Greg Kroah-Hartman
maintainerPATCH 51/312 netfilter: nfnetlink: use original skbuff when acking batches
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit 7c7bdf35991bb8f7cfaeaf22ea3a2f2d1967c166 upstream.
Since bd678e09dc17 ("netfilter: nfnetlink: fix splat due to incorrect socket memory accounting in skbuff clones"), we don't manually attach the sk to the skbuff clone anymore, so we have to use the original skbuff from netlink_ack() which needs to access the sk pointer.
--- net/netfilter/nfnetlink.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/netfilter/nfnetlink.c +3 -3
@@ -309,14 +309,14 @@ replay:#endif {nfnl_unlock (subsys_id); -netlink_ack (skb, nlh, -EOPNOTSUPP ); +netlink_ack (oskb, nlh, -EOPNOTSUPP );return kfree_skb (skb); } }if (!ss->commit || !ss->abort) {nfnl_unlock (subsys_id); -netlink_ack (skb, nlh, -EOPNOTSUPP ); +netlink_ack (oskb, nlh, -EOPNOTSUPP );return kfree_skb (skb); }
@@ -406,7 +406,7 @@ ack:* pointing to the batch header. */ nfnl_err_reset (&err_list); -netlink_ack (skb,nlmsg_hdr (oskb), -ENOMEM ); +netlink_ack (oskb,nlmsg_hdr (oskb), -ENOMEM ); status |=NFNL_BATCH_FAILURE ; goto done; }
Greg Kroah-Hartman
maintainerPATCH 52/312 xfrm: fix crash in XFRM_MSG_GETSA netlink handler
In reply to Greg Kroah-HartmanFrom: Vegard Nossum <[email protected]>
commit 1ba5bf993c6a3142e18e68ea6452b347f9cb5635 upstream.
If we hit any of the error conditions inside xfrm_dump_sa(), then xfrm_state_walk_init() never gets called. However, we still call xfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash because the state walk was never initialized properly.
We can fix this by setting cb->args[0] only after we've processed the first element and checking this before calling xfrm_state_walk_done().
--- net/xfrm/xfrm_user.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/xfrm/xfrm_user.c +3 -3
@@ -923,7 +923,8 @@ static int xfrm_dump_sa_done(struct netlstruct sock *sk = cb->skb->sk;struct net *net =sock_net (sk); -xfrm_state_walk_done (walk, net); +if (cb->args[0 ]) +xfrm_state_walk_done (walk, net);return 0 ; }
@@ -948,8 +949,6 @@ static int xfrm_dump_sa(struct sk_buff *u8 proto =0 ;int err; - cb->args[0 ] =1 ; - err =nlmsg_parse (cb->nlh,0 , attrs,XFRMA_MAX , xfrma_policy);if (err <0 )
@@ -966,6 +965,7 @@ static int xfrm_dump_sa(struct sk_buff * proto =nla_get_u8 (attrs[XFRMA_PROTO ]);xfrm_state_walk_init (walk, proto, filter); + cb->args[0 ] =1 ; } (void )xfrm_state_walk (net, walk, dump_one_state, &info);
Greg Kroah-Hartman
maintainerPATCH 53/312 mwifiex: fix IBSS data path issue.
In reply to Greg Kroah-HartmanFrom: chunfan chen <[email protected]>
commit dc386ce76dedaeeaaf006fceb6ed8cf2e20ff026 upstream.
The port_open flag is not applicable for IBSS mode. IBSS data path was broken when port_open flag was introduced. This patch fixes the problem by correcting the checks.
--- drivers/net/wireless/mwifiex/sta_event.c | 10 ++++++---- drivers/net/wireless/mwifiex/wmm.c | 6 ++++-- 2 files changed, 10 insertions(+), 6 deletions(-)
drivers/net/wireless/mwifiex/sta_event.c +6 -4
@@ -607,11 +607,13 @@ int mwifiex_process_sta_event(struct mwicase EVENT_PS_AWAKE :mwifiex_dbg (adapter,EVENT ,"info: EVENT: AWAKE\n" ); -if (!adapter->pps_uapsd_mode && priv->port_open && +if (!adapter->pps_uapsd_mode && + (priv->port_open || + (priv->bss_mode ==NL80211_IFTYPE_ADHOC )) && priv->media_connected && adapter->sleep_period.period) { - adapter->pps_uapsd_mode = true; -mwifiex_dbg (adapter,EVENT , -"event: PPS/UAPSD mode activated\n" ); + adapter->pps_uapsd_mode = true; +mwifiex_dbg (adapter,EVENT , +"event: PPS/UAPSD mode activated\n" ); } adapter->tx_lock_flag = false;if (adapter->pps_uapsd_mode && adapter->gen_null_pkt) {
drivers/net/wireless/mwifiex/wmm.c +4 -2
@@ -475,7 +475,8 @@ mwifiex_wmm_lists_empty(struct mwifiex_a priv = adapter->priv[i];if (!priv)continue ; -if (!priv->port_open) +if (!priv->port_open && + (priv->bss_mode !=NL80211_IFTYPE_ADHOC ))continue ;if (adapter->if_ops.is_port_ready && !adapter->if_ops.is_port_ready (priv))
@@ -1109,7 +1110,8 @@ mwifiex_wmm_get_highest_priolist_ptr(str priv_tmp = adapter->bss_prio_tbl[j].bss_prio_cur->priv; -if (!priv_tmp->port_open || +if (((priv_tmp->bss_mode !=NL80211_IFTYPE_ADHOC ) && + !priv_tmp->port_open) || (atomic_read (&priv_tmp->wmm.tx_pkts_queued) ==0 ))continue ;
Greg Kroah-Hartman
maintainerPATCH 54/312 mwifiex: add missing check for PCIe8997 chipset
In reply to Greg Kroah-HartmanFrom: Amitkumar Karwar <[email protected]>
commit f3b35f28096895f2438c10ef719ef67d2951a8c9 upstream.
This patch ensures mwifiex_pcie_txbd_empty() does take care of 8997 chipset.
--- drivers/net/wireless/mwifiex/pcie.h | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mwifiex/pcie.h +1 -0
@@ -342,6 +342,7 @@ mwifiex_pcie_txbd_empty(struct pcie_servreturn 1 ;break ;case PCIE_DEVICE_ID_MARVELL_88W8897 : +case PCIE_DEVICE_ID_MARVELL_88W8997 : if (((card->txbd_wrptr & reg->tx_mask) == (rdptr & reg->tx_mask)) && ((card->txbd_wrptr & reg->tx_rollover_ind) ==
Greg Kroah-Hartman
maintainerPATCH 55/312 iwlwifi: set max firmware version of 7265 to 17
In reply to Greg Kroah-HartmanFrom: Emmanuel Grumbach <[email protected]>
commit ed0450cef00d2c76bcb8778721df947ba7ff4147 upstream.
Just like 7260, 7265 will not have firmware releases newer than iwlwifi-7265-17.ucode. 7265D is still supported in latest firmware releases.
--- drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/iwlwifi/iwl-7000.c +1 -1
@@ -70,7 +70,7 @@/* Highest firmware API version supported */ #define IWL7260_UCODE_API_MAX 17 -#define IWL7265_UCODE_API_MAX 19 +#define IWL7265_UCODE_API_MAX 17#define IWL7265D_UCODE_API_MAX 19/* Oldest version we won't warn about */
Greg Kroah-Hartman
maintainerPATCH 56/312 Bluetooth: btmrvl: fix hung task warning dump
In reply to Greg Kroah-HartmanFrom: Chin-Ran Lo <[email protected]>
commit 86f7ac77d4035e22ec7e58dcdb96327e2ecc3a9b upstream.
It's been observed that when bluetooth driver fails to activate the firmware, below hung task warning dump is displayed after 120 seconds.
[ 36.461022] Bluetooth: vendor=0x2df, device=0x912e, class=255, fn=2
[ 56.512128] Bluetooth: FW failed to be active in time!
[ 56.517264] Bluetooth: Downloading firmware failed!
[ 240.252176] INFO: task kworker/3:2:129 blocked for more than 120 seconds.
[ 240.258931] Not tainted 3.18.0 #254
[ 240.262972] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 240.270751] kworker/3:2 D ffffffc000205760 0 129 2 0x00000000
[ 240.277825] Workqueue: events request_firmware_work_func
[ 240.283134] Call trace:
[ 240.285581] [<ffffffc000205760>] __switch_to+0x80/0x8c
[ 240.290693] [<ffffffc00088dae0>] __schedule+0x540/0x7b8
[ 240.295921] [<ffffffc00088ddd0>] schedule+0x78/0x84
[ 240.300764] [<ffffffc0006dfd48>] __mmc_claim_host+0xe8/0x1c8
[ 240.306395] [<ffffffc0006edd6c>] sdio_claim_host+0x74/0x84
[ 240.311840] [<ffffffbffc163d08>] 0xffffffbffc163d08
[ 240.316685] [<ffffffbffc165104>] 0xffffffbffc165104
[ 240.321524] [<ffffffbffc130cf8>] mwifiex_dnld_fw+0x98/0x110 [mwifiex]
[ 240.327918] [<ffffffbffc12ee88>] mwifiex_remove_card+0x2c4/0x5fc [mwifiex]
[ 240.334741] [<ffffffc000596780>] request_firmware_work_func+0x44/0x80
[ 240.341127] [<ffffffc00023b934>] process_one_work+0x2ec/0x50c
[ 240.346831] [<ffffffc00023c6a0>] worker_thread+0x350/0x470
[ 240.352272] [<ffffffc0002419bc>] kthread+0xf0/0xfc
[ 240.357019] 2 locks held by kworker/3:2/129:
[ 240.361248] #0: ("events"){.+.+.+}, at: [<ffffffc00023b840>] process_one_work+0x1f8/0x50c
[ 240.369562] #1: ((&fw_work->work)){+.+.+.}, at: [<ffffffc00023b840>] process_one_work+0x1f8/0x50c
[ 240.378589] task PC stack pid father
[ 240.384501] kworker/1:1 D ffffffc000205760 0 40 2 0x00000000
[ 240.391524] Workqueue: events mtk_atomic_work
[ 240.395884] Call trace:
[ 240.398317] [<ffffffc000205760>] __switch_to+0x80/0x8c
[ 240.403448] [<ffffffc00027279c>] lock_acquire+0x128/0x164
[ 240.408821] kworker/3:2 D ffffffc000205760 0 129 2 0x00000000
[ 240.415867] Workqueue: events request_firmware_work_func
[ 240.421138] Call trace:
[ 240.423589] [<ffffffc000205760>] __switch_to+0x80/0x8c
[ 240.428688] [<ffffffc00088dae0>] __schedule+0x540/0x7b8
[ 240.433886] [<ffffffc00088ddd0>] schedule+0x78/0x84
[ 240.438732] [<ffffffc0006dfd48>] __mmc_claim_host+0xe8/0x1c8
[ 240.444361] [<ffffffc0006edd6c>] sdio_claim_host+0x74/0x84
[ 240.449801] [<ffffffbffc163d08>] 0xffffffbffc163d08
[ 240.454649] [<ffffffbffc165104>] 0xffffffbffc165104
[ 240.459486] [<ffffffbffc130cf8>] mwifiex_dnld_fw+0x98/0x110 [mwifiex]
[ 240.465882] [<ffffffbffc12ee88>] mwifiex_remove_card+0x2c4/0x5fc [mwifiex]
[ 240.472705] [<ffffffc000596780>] request_firmware_work_func+0x44/0x80
[ 240.479090] [<ffffffc00023b934>] process_one_work+0x2ec/0x50c
[ 240.484794] [<ffffffc00023c6a0>] worker_thread+0x350/0x470
[ 240.490231] [<ffffffc0002419bc>] kthread+0xf0/0xfcThis patch adds missing sdio_release_host() call so that wlan driver thread can claim sdio host.
--- drivers/bluetooth/btmrvl_sdio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/bluetooth/btmrvl_sdio.c +2 -1
@@ -1112,7 +1112,8 @@ static int btmrvl_sdio_download_fw(struc*/ if (btmrvl_sdio_verify_fw_download (card, pollnum)) {BT_ERR ("FW failed to be active in time!" ); -return -ETIMEDOUT ; + ret = -ETIMEDOUT ; + goto done; }sdio_release_host (card->func);
Greg Kroah-Hartman
maintainerPATCH 57/312 dccp: limit sk_filter trim to payload
In reply to Greg Kroah-HartmanFrom: Willem de Bruijn <[email protected]>
commit 4f0c40d94461cfd23893a17335b2ab78ecb333c8 upstream.
Dccp verifies packet integrity, including length, at initial rcv in dccp_invalid_packet, later pulls headers in dccp_enqueue_skb.
A call to sk_filter in-between can cause __skb_pull to wrap skb->len. skb_copy_datagram_msg interprets this as a negative value, so (correctly) fails with EFAULT. The negative length is reported in ioctl SIOCINQ or possibly in a DCCP_WARN in dccp_close.
Introduce an sk_receive_skb variant that caps how small a filter program can trim packets, and call this in dccp with the header length. Excessively trimmed packets are now processed normally and queued for reception as 0B payloads.
--- include/net/sock.h | 8 +++++++- net/core/sock.c | 7 ++++--- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 2 +- 4 files changed, 13 insertions(+), 6 deletions(-)
include/net/sock.h +7 -1
@@ -1651,7 +1651,13 @@ static inline void sock_put(struct sock*/ void sock_gen_put (struct sock *sk); -int sk_receive_skb (struct sock *sk,struct sk_buff *skb,const int nested); +int __sk_receive_skb (struct sock *sk,struct sk_buff *skb,const int nested, +unsigned int trim_cap); +static inline int sk_receive_skb (struct sock *sk,struct sk_buff *skb, +const int nested) +{ +return __sk_receive_skb (sk, skb, nested,1 ); +}static inline void sk_tx_queue_set (struct sock *sk,int tx_queue) {
net/core/sock.c +4 -3
@@ -484,11 +484,12 @@ int sock_queue_rcv_skb(struct sock *sk, }EXPORT_SYMBOL (sock_queue_rcv_skb); -int sk_receive_skb (struct sock *sk,struct sk_buff *skb,const int nested) +int __sk_receive_skb (struct sock *sk,struct sk_buff *skb, +const int nested,unsigned int trim_cap) {int rc =NET_RX_SUCCESS ; -if (sk_filter (sk, skb)) +if (sk_filter_trim_cap (sk, skb, trim_cap)) goto discard_and_relse; skb->dev =NULL ;
@@ -524,7 +525,7 @@ discard_and_relse:kfree_skb (skb); goto out; } -EXPORT_SYMBOL (sk_receive_skb); +EXPORT_SYMBOL (__sk_receive_skb);struct dst_entry *__sk_dst_check (struct sock *sk,u32 cookie) {
net/dccp/ipv4.c +1 -1
@@ -868,7 +868,7 @@ lookup: goto discard_and_relse;nf_reset (skb); -return sk_receive_skb (sk, skb,1 ); +return __sk_receive_skb (sk, skb,1 , dh->dccph_doff *4 ); no_dccp_socket:if (!xfrm4_policy_check (NULL ,XFRM_POLICY_IN , skb))
net/dccp/ipv6.c +1 -1
@@ -741,7 +741,7 @@ lookup:if (!xfrm6_policy_check (sk,XFRM_POLICY_IN , skb)) goto discard_and_relse; -return sk_receive_skb (sk, skb,1 ) ?-1 :0 ; +return __sk_receive_skb (sk, skb,1 , dh->dccph_doff *4 ) ?-1 :0 ; no_dccp_socket:if (!xfrm6_policy_check (NULL ,XFRM_POLICY_IN , skb))
Greg Kroah-Hartman
maintainerPATCH 58/312 net/mlx4_core: Do not BUG_ON during reset when PCI is offline
In reply to Greg Kroah-HartmanFrom: Daniel Jurgens <[email protected]>
commit 22e3817e6c8301dc0520b855c8a2d764580e719c upstream.
The PCI channel could go offline during reset due to EEH. Don't bug on in this case, the error is recoverable.
--- drivers/net/ethernet/mellanox/mlx4/catas.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx4/catas.c +9 -2
@@ -182,10 +182,17 @@ void mlx4_enter_error_state(struct mlx4_ err =mlx4_reset_slave (dev); else err =mlx4_reset_master (dev); -BUG_ON (err !=0 ); +if (!err) { +mlx4_err (dev,"device was reset successfully\n" ); + }else { +/* EEH could have disabled the PCI channel during reset. That's +* recoverable and the PCI error flow will handle it. +*/ +if (!pci_channel_offline (dev->persist->pdev)) +BUG_ON (1 ); + } dev->persist->state |=MLX4_DEVICE_STATE_INTERNAL_ERROR ; -mlx4_err (dev,"device was reset successfully\n" );mutex_unlock (&persist->device_state_mutex);/* At that step HW was already reset, now notify clients */
Greg Kroah-Hartman
maintainerPATCH 59/312 mlxsw: pci: Correctly determine if descriptor queue is full
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 5091730d7795ccb21eb880699b5194730641c70b upstream.
The descriptor queues for sending (SDQs) and receiving (RDQs) packets are managed by two counters - producer and consumer - which are both 16-bit in size. A queue is considered full when the difference between the two equals the queue's maximum number of descriptors.
However, if the producer counter overflows, then it's possible for the full queue check to fail, as it doesn't take the overflow into account. In such a case, descriptors already passed to the device - but for which a completion has yet to be posted - will be overwritten, thereby causing undefined behavior. The above can be achieved under heavy load (~30 netperf instances).
Fix that by casting the subtraction result to u16, preventing it from being treated as a signed integer.
--- drivers/net/ethernet/mellanox/mlxsw/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/pci.c +1 -1
@@ -215,7 +215,7 @@ mlxsw_pci_queue_elem_info_producer_get(s {int index = q->producer_counter & (q->count -1 ); -if ((q->producer_counter - q->consumer_counter) == q->count) +if ((u16) (q->producer_counter - q->consumer_counter) == q->count)return NULL ;return mlxsw_pci_queue_elem_info_get (q, index); }
Greg Kroah-Hartman
maintainerPATCH 60/312 PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive()
In reply to Greg Kroah-HartmanFrom: Bjorn Helgaas <[email protected]>
commit ca620723d4ff9ea7ed484eab46264c3af871b9ae upstream.
iomem_is_exclusive() requires a CPU physical address, but on some arches we supplied a PCI bus address instead.
On most arches, pci_resource_to_user(res) returns "res->start", which is a CPU physical address. But on microblaze, mips, powerpc, and sparc, it returns the PCI bus address corresponding to "res->start".
The result is that pci_mmap_resource() may fail when it shouldn't (if the bus address happens to match an existing resource), or it may succeed when it should fail (if the resource is exclusive but the bus address doesn't match it).
Call iomem_is_exclusive() with "res->start", which is always a CPU physical address, not the result of pci_resource_to_user().
--- drivers/pci/pci-sysfs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/pci/pci-sysfs.c +3 -4
@@ -1027,6 +1027,9 @@ static int pci_mmap_resource(struct kobjif (i >=PCI_ROM_RESOURCE )return -ENODEV ; +if (res->flags &IORESOURCE_MEM &&iomem_is_exclusive (res->start)) +return -EINVAL ; +if (!pci_mmap_fits (pdev, i, vma,PCI_MMAP_SYSFS )) { WARN(1, "process \"%s\" tried to map 0x%08lx bytes at page 0x%08lx on %s BAR %d (start 0x%16Lx, size 0x%16Lx)\n", current->comm, vma->vm_end-vma->vm_start, vma->vm_pgoff,
@@ -1043,10 +1046,6 @@ static int pci_mmap_resource(struct kobjpci_resource_to_user (pdev, i, res, &start, &end); vma->vm_pgoff += start >>PAGE_SHIFT ; mmap_type = res->flags &IORESOURCE_MEM ? pci_mmap_mem : pci_mmap_io; - -if (res->flags &IORESOURCE_MEM &&iomem_is_exclusive (start)) -return -EINVAL ; -return pci_mmap_page_range (pdev, vma, mmap_type, write_combine); }
Greg Kroah-Hartman
maintainerPATCH 61/312 net/mlx4_core: Implement pci_resume callback
In reply to Greg Kroah-HartmanFrom: Daniel Jurgens <[email protected]>
commit c12833acff62cff83a8b728253e7ebbc1264d75e upstream.
Move resume related activities to a new pci_resume function instead of performing them in mlx4_pci_slot_reset. This change is needed to avoid a hotplug during EEH recovery due to commit f2da4ccf8bd4 ("powerpc/eeh:
More relaxed hotplug criterion").
--- drivers/net/ethernet/mellanox/mlx4/main.c | 39 ++++++++++++++++++------------ 1 file changed, 24 insertions(+), 15 deletions(-)
drivers/net/ethernet/mellanox/mlx4/main.c +24 -15
@@ -3854,45 +3854,53 @@ static pci_ers_result_t mlx4_pci_slot_re {struct mlx4_dev_persistent *persist =pci_get_drvdata (pdev);struct mlx4_dev *dev = persist->dev; -struct mlx4_priv *priv =mlx4_priv (dev); -int ret; -int nvfs[MLX4_MAX_PORTS +1 ] = {0 ,0 ,0 }; -int total_vfs; +int err;mlx4_err (dev,"mlx4_pci_slot_reset was called\n" ); - ret =pci_enable_device (pdev); -if (ret) { -mlx4_err (dev,"Can not re-enable device, ret=%d\n" , ret); + err =pci_enable_device (pdev); +if (err) { +mlx4_err (dev,"Can not re-enable device, err=%d\n" , err);return PCI_ERS_RESULT_DISCONNECT ; }pci_set_master (pdev);pci_restore_state (pdev);pci_save_state (pdev); +return PCI_ERS_RESULT_RECOVERED ; +} + +static void mlx4_pci_resume (struct pci_dev *pdev) +{ +struct mlx4_dev_persistent *persist =pci_get_drvdata (pdev); +struct mlx4_dev *dev = persist->dev; +struct mlx4_priv *priv =mlx4_priv (dev); +int nvfs[MLX4_MAX_PORTS +1 ] = {0 ,0 ,0 }; +int total_vfs; +int err; +mlx4_err (dev,"%s was called\n" , __func__); total_vfs = dev->persist->num_vfs;memcpy (nvfs, dev->persist->nvfs,sizeof (dev->persist->nvfs));mutex_lock (&persist->interface_state_mutex);if (!(persist->interface_state &MLX4_INTERFACE_STATE_UP )) { - ret =mlx4_load_one (pdev, priv->pci_dev_data, total_vfs, nvfs, + err =mlx4_load_one (pdev, priv->pci_dev_data, total_vfs, nvfs, priv,1 ); -if (ret) { -mlx4_err (dev,"%s: mlx4_load_one failed, ret=%d\n" , - __func__, ret); +if (err) { +mlx4_err (dev,"%s: mlx4_load_one failed, err=%d\n" , + __func__, err); goto end; } - ret =restore_current_port_types (dev, dev->persist-> + err =restore_current_port_types (dev, dev->persist-> curr_port_type, dev->persist-> curr_port_poss_type); -if (ret) -mlx4_err (dev,"could not restore original port types (%d)\n" , ret); +if (err) +mlx4_err (dev,"could not restore original port types (%d)\n" , err); } end:mutex_unlock (&persist->interface_state_mutex); -return ret ?PCI_ERS_RESULT_DISCONNECT :PCI_ERS_RESULT_RECOVERED ; }static void mlx4_shutdown (struct pci_dev *pdev)
@@ -3909,6 +3917,7 @@ static void mlx4_shutdown(struct pci_devstatic const struct pci_error_handlers mlx4_err_handler = { .error_detected = mlx4_pci_err_detected, .slot_reset = mlx4_pci_slot_reset, + .resume = mlx4_pci_resume, };static struct pci_driver mlx4_driver = {
Greg Kroah-Hartman
maintainerPATCH 62/312 alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO
In reply to Greg Kroah-HartmanFrom: Bjorn Helgaas <[email protected]>
commit c20e128030caf0537d5e906753eac1c28fefdb75 upstream.
The alpha pci_mmap_resource() is used for both IORESOURCE_MEM and IORESOURCE_IO resources, but iomem_is_exclusive() is only applicable for IORESOURCE_MEM.
Call iomem_is_exclusive() only for IORESOURCE_MEM resources, and do it earlier to match the generic version of pci_mmap_resource().
--- arch/alpha/kernel/pci-sysfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/alpha/kernel/pci-sysfs.c +2 -2
@@ -77,10 +77,10 @@ static int pci_mmap_resource(struct kobjif (i >=PCI_ROM_RESOURCE )return -ENODEV ; -if (!__pci_mmap_fits (pdev, i, vma, sparse)) +if (res->flags &IORESOURCE_MEM &&iomem_is_exclusive (res->start))return -EINVAL ; -if (iomem_is_exclusive (res->start)) +if (!__pci_mmap_fits (pdev, i, vma, sparse))return -EINVAL ;pcibios_resource_to_bus (pdev->bus, &bar, res);
Greg Kroah-Hartman
maintainerPATCH 63/312 vfio/pci: Allow VPD short read
In reply to Greg Kroah-HartmanFrom: Alex Williamson <[email protected]>
commit ce7585f3c4d76bca1dff4b66ae1ea32552954f9e upstream.
The size of the VPD area is not necessarily 4-byte aligned, so a pci_vpd_read() might return less than 4 bytes. Zero our buffer and accept anything other than an error. Intel X710 NICs exercise this.
--- drivers/vfio/pci/vfio_pci_config.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vfio/pci/vfio_pci_config.c +2 -1
@@ -698,7 +698,8 @@ static int vfio_vpd_config_write(structif (pci_write_vpd (pdev, addr & ~PCI_VPD_ADDR_F ,4 , &data) !=4 )return count; }else { -if (pci_read_vpd (pdev, addr,4 , &data) !=4 ) + data =0 ; +if (pci_read_vpd (pdev, addr,4 , &data) <0 )return count; *pdata =cpu_to_le32 (data); }
Greg Kroah-Hartman
maintainerPATCH 64/312 brcmfmac: add eth_type_trans back for PCIe full dongle
In reply to Greg Kroah-HartmanFrom: Franky Lin <[email protected]>
commit 31143e2933d1675c4c1ba6ce125cdd95870edd85 upstream.
A regression was introduced in commit 9c349892ccc9 ("brcmfmac: revise handling events in receive path") which moves eth_type_trans() call to brcmf_rx_frame(). Msgbuf layer doesn't use brcmf_rx_frame() but invokes brcmf_netif_rx() directly. In such case the Ethernet header was not stripped out resulting in null pointer dereference in the networking stack.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 IP: [<ffffffff814c3ce6>] enqueue_to_backlog+0x56/0x260 PGD 0 Oops: 0000 [#1] PREEMPT SMP Modules linked in: fuse ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype [...] rtsx_pci scsi_mod usbcore usb_common i8042 serio nvme nvme_core CPU: 7 PID: 1340 Comm: irq/136-brcmf_p Not tainted 4.7.0-rc1-mainline #1 Hardware name: Dell Inc. XPS 15 9550/0N7TVV, BIOS 01.02.00 04/07/2016 task: ffff8804a0c5bd00 ti: ffff88049e124000 task.ti: ffff88049e124000 RIP: 0010:[<ffffffff814c3ce6>] [<ffffffff814c3ce6>] enqueue_to_backlog+0x56/0x260 RSP: 0018:ffff88049e127ca0 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffff8804bddd7c40 RCX: 000000000000002f RDX: 0000000000000000 RSI: 0000000000000007 RDI: ffff8804bddd7d4c RBP: ffff88049e127ce8 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8804bddd12c0 R11: 000000000000149e R12: 0000000000017c40 R13: ffff88049e127d08 R14: ffff8804a9bd6d00 R15: ffff8804bddd7d4c FS: 0000000000000000(0000) GS:ffff8804bddc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000048 CR3: 0000000001806000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff8804bdddad00 ffff8804ad089e00 0000000000000000 0000000000000282 0000000000000000 ffff8804a9bd6d00 ffff8804a1b27e00 ffff8804a9bd6d00 ffff88002ee88000 ffff88049e127d28 ffffffff814c3f3b ffffffff81311fc3 Call Trace: [<ffffffff814c3f3b>] netif_rx_internal+0x4b/0x170 [<ffffffff81311fc3>] ? swiotlb_tbl_unmap_single+0xf3/0x120 [<ffffffff814c5467>] netif_rx_ni+0x27/0xc0 [<ffffffffa08519e9>] brcmf_netif_rx+0x49/0x70 [brcmfmac] [<ffffffffa08564d4>] brcmf_msgbuf_process_rx+0x2b4/0x570 [brcmfmac] [<ffffffff81020017>] ? __xen_set_pgd_hyper+0x57/0xd0 [<ffffffff810d60b0>] ? irq_forced_thread_fn+0x70/0x70 [<ffffffffa0857381>] brcmf_proto_msgbuf_rx_trigger+0x31/0xe0 [brcmfmac] [<ffffffffa0861e8f>] brcmf_pcie_isr_thread+0x7f/0x110 [brcmfmac] [<ffffffff810d60d0>] irq_thread_fn+0x20/0x50 [<ffffffff810d63ad>] irq_thread+0x12d/0x1c0 [<ffffffff815d07d5>] ? __schedule+0x2f5/0x7a0 [<ffffffff810d61d0>] ? wake_threads_waitq+0x30/0x30 [<ffffffff810d6280>] ? irq_thread_dtor+0xb0/0xb0 [<ffffffff81098ea8>] kthread+0xd8/0xf0 [<ffffffff815d4b7f>] ret_from_fork+0x1f/0x40 [<ffffffff81098dd0>] ? kthread_worker_fn+0x170/0x170 Code: 1c f5 60 9a 8e 81 9c 58 0f 1f 44 00 00 48 89 45 d0 fa 66 0f 1f
44 00 00 4c 8d bb 0c 01 00 00 4c 89 ff e8 5e 08 11 00 49 8b 56 20 <48> 8b 52 48 83 e2 01 74 10 8b 8b 08 01 00 00 8b 15 59 c5 42 00 RIP [<ffffffff814c3ce6>] enqueue_to_backlog+0x56/0x260
RSP <ffff88049e127ca0>
CR2: 0000000000000048
--- drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c +2 -0
@@ -1155,6 +1155,8 @@ brcmf_msgbuf_process_rx_complete(structbrcmu_pkt_buf_free_skb (skb);return ; } + + skb->protocol =eth_type_trans (skb, ifp->ndev);brcmf_netif_rx (ifp, skb); }
Greg Kroah-Hartman
maintainerPATCH 65/312 mlxsw: Treat local port 64 as valid
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 1e5ad30c649a82a062ce79a87c1296e6c6f328c2 upstream.
MLXSW_PORT_MAX_PORTS represents the maximum number of local ports, which is 65 for both ASICs (SwitchX-2 and Spectrum) supported by this driver.
--- drivers/net/ethernet/mellanox/mlxsw/port.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/port.h +1 -1
@@ -49,7 +49,7 @@#define MLXSW_PORT_MID 0xd000#define MLXSW_PORT_MAX_PHY_PORTS 0x40 -#define MLXSW_PORT_MAX_PORTS MLXSW_PORT_MAX_PHY_PORTS +#define MLXSW_PORT_MAX_PORTS (MLXSW_PORT_MAX_PHY_PORTS + 1)#define MLXSW_PORT_DEVID_BITS_OFFSET 10#define MLXSW_PORT_PHY_BITS_OFFSET 4
Greg Kroah-Hartman
maintainerPATCH 66/312 IB/mlx4: Initialize hop_limit when creating address handle
In reply to Greg Kroah-HartmanFrom: Matan Barak <[email protected]>
commit 4e4081673445485aa6bc90383bdb83e7a96cc48a upstream.
Hop limit value wasn't copied from attributes when ah was created. This may influence packets for unconnected services to get dropped in routers when endpoints are not in the same subnet.
--- drivers/infiniband/hw/mlx4/ah.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/mlx4/ah.c +1 -0
@@ -107,6 +107,7 @@ static struct ib_ah *create_iboe_ah(strureturn ERR_PTR (ret); ah->av.eth.gid_index = ret; ah->av.eth.vlan =cpu_to_be16 (vlan_tag); + ah->av.eth.hop_limit = ah_attr->grh.hop_limit;if (ah_attr->static_rate) { ah->av.eth.stat_rate = ah_attr->static_rate +MLX4_STAT_RATE_OFFSET ; while (ah->av.eth.stat_rate > IB_RATE_2_5_GBPS + MLX4_STAT_RATE_OFFSET &&
Greg Kroah-Hartman
maintainerPATCH 67/312 ovs/gre,geneve: fix error path when creating an iface
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
commit 106da663ff495e0aea3ac15b8317aa410754fcac upstream.
After ipgre_newlink()/geneve_configure() call, the netdev is registered.
--- drivers/net/geneve.c | 10 +++++++--- net/ipv4/ip_gre.c | 10 +++++++--- 2 files changed, 14 insertions(+), 6 deletions(-)
drivers/net/geneve.c +7 -3
@@ -1340,6 +1340,7 @@ struct net_device *geneve_dev_create_fb( {struct nlattr *tb[IFLA_MAX +1 ];struct net_device *dev; +LIST_HEAD (list_kill);int err;memset (tb,0 ,sizeof (tb));
@@ -1350,8 +1351,10 @@ struct net_device *geneve_dev_create_fb( err =geneve_configure (net, dev, &geneve_remote_unspec,0 ,0 ,0 ,htons (dst_port), true); -if (err) - goto err; +if (err) { +free_netdev (dev); +return ERR_PTR (err); + }/* openvswitch users expect packet sizes to be unrestricted, * so set the largest MTU we can.
@@ -1363,7 +1366,8 @@ struct net_device *geneve_dev_create_fb(return dev; err: -free_netdev (dev); +geneve_dellink (dev, &list_kill); +unregister_netdevice_many (&list_kill);return ERR_PTR (err); }EXPORT_SYMBOL_GPL (geneve_dev_create_fb);
net/ipv4/ip_gre.c +7 -3
@@ -1230,6 +1230,7 @@ struct net_device *gretap_fb_dev_create( {struct nlattr *tb[IFLA_MAX +1 ];struct net_device *dev; +LIST_HEAD (list_kill);struct ip_tunnel *t;int err;
@@ -1245,8 +1246,10 @@ struct net_device *gretap_fb_dev_create( t->collect_md = true; err =ipgre_newlink (net, dev, tb,NULL ); -if (err <0 ) - goto out; +if (err <0 ) { +free_netdev (dev); +return ERR_PTR (err); + }/* openvswitch users expect packet sizes to be unrestricted, * so set the largest MTU we can.
@@ -1257,7 +1260,8 @@ struct net_device *gretap_fb_dev_create(return dev; out: -free_netdev (dev); +ip_tunnel_dellink (dev, &list_kill); +unregister_netdevice_many (&list_kill);return ERR_PTR (err); }EXPORT_SYMBOL_GPL (gretap_fb_dev_create);
Greg Kroah-Hartman
maintainerPATCH 68/312 GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU
In reply to Greg Kroah-HartmanFrom: Alexander Duyck <[email protected]>
commit a0ca153f98db8cf25298565a09e11fe9d82846ad upstream.
This patch fixes an issue I found in which we were dropping frames if we had enabled checksums on GRE headers that were encapsulated by either FOU or GUE. Without this patch I was barely able to get 1 Gb/s of throughput. With this patch applied I am now at least getting around 6 Gb/s.
The issue is due to the fact that with FOU or GUE applied we do not provide a transport offset pointing to the GRE header, nor do we offload it in software as the GRE header is completely skipped by GSO and treated like a VXLAN or GENEVE type header. As such we need to prevent the stack from generating it and also prevent GRE from generating it via any interface we create.
--- include/linux/netdevice.h | 5 ++++- net/core/dev.c | 1 + net/ipv4/fou.c | 6 ++++++ net/ipv4/gre_offload.c | 8 ++++++++ net/ipv4/ip_gre.c | 13 ++++++++++--- 5 files changed, 29 insertions(+), 4 deletions(-)
include/linux/netdevice.h +4 -1
@@ -2013,7 +2013,10 @@ struct napi_gro_cb {/* Number of gro_receive callbacks this packet already went through */ u8 recursion_counter:4; -/* 3 bit hole */ +/* Used in GRE, set in fou/gue_gro_receive */ + u8 is_fou:1; + +/* 2 bit hole */ /* used to support CHECKSUM_COMPLETE for tunneling protocols */ __wsum csum;
net/core/dev.c +1 -0
@@ -4320,6 +4320,7 @@ static enum gro_result dev_gro_receive(sNAPI_GRO_CB (skb)->free =0 ;NAPI_GRO_CB (skb)->encap_mark =0 ;NAPI_GRO_CB (skb)->recursion_counter =0 ; +NAPI_GRO_CB (skb)->is_fou =0 ;NAPI_GRO_CB (skb)->gro_remcsum_start =0 ;/* Setup for GRO checksum validation */
net/ipv4/fou.c +6 -0
@@ -205,6 +205,9 @@ static struct sk_buff **fou_gro_receive(*/ NAPI_GRO_CB (skb)->encap_mark =0 ; +/* Flag this frame as already having an outer encap header */ +NAPI_GRO_CB (skb)->is_fou =1 ; +rcu_read_lock (); offloads =NAPI_GRO_CB (skb)->is_ipv6 ? inet6_offloads : inet_offloads; ops =rcu_dereference (offloads[proto]);
@@ -372,6 +375,9 @@ static struct sk_buff **gue_gro_receive(*/ NAPI_GRO_CB (skb)->encap_mark =0 ; +/* Flag this frame as already having an outer encap header */ +NAPI_GRO_CB (skb)->is_fou =1 ; +rcu_read_lock (); offloads =NAPI_GRO_CB (skb)->is_ipv6 ? inet6_offloads : inet_offloads; ops =rcu_dereference (offloads[guehdr->proto_ctype]);
net/ipv4/gre_offload.c +8 -0
@@ -151,6 +151,14 @@ static struct sk_buff **gre_gro_receive(if ((greh->flags & ~(GRE_KEY |GRE_CSUM )) !=0 ) goto out; +/* We can only support GRE_CSUM if we can track the location of +* the GRE header. In the case of FOU/GUE we cannot because the +* outer UDP header displaces the GRE header leaving us in a state +* of limbo. +*/ +if ((greh->flags &GRE_CSUM ) &&NAPI_GRO_CB (skb)->is_fou) + goto out; + type = greh->protocol;rcu_read_lock ();
net/ipv4/ip_gre.c +10 -3
@@ -851,9 +851,16 @@ static void __gre_tunnel_init(struct net dev->hw_features |=GRE_FEATURES ;if (!(tunnel->parms.o_flags &TUNNEL_SEQ )) { -/* TCP offload with GRE SEQ is not supported. */ - dev->features |=NETIF_F_GSO_SOFTWARE ; - dev->hw_features |=NETIF_F_GSO_SOFTWARE ; +/* TCP offload with GRE SEQ is not supported, nor +* can we support 2 levels of outer headers requiring +* an update. +*/ +if (!(tunnel->parms.o_flags &TUNNEL_CSUM ) || + (tunnel->encap.type ==TUNNEL_ENCAP_NONE )) { + dev->features |=NETIF_F_GSO_SOFTWARE ; + dev->hw_features |=NETIF_F_GSO_SOFTWARE ; + } +/* Can use a lockless transmit, unless we generate * output sequences */
Greg Kroah-Hartman
maintainerPATCH 69/312 powerpc/pci/of: Parse unassigned resources
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
commit dead1c845dbe97e0061dae2017eaf3bd8f8f06ee upstream.
The pseries platform uses the PCI_PROBE_DEVTREE method of PCI probing which reads "assigned-addresses" of every PCI device and initializes the device resources. However if the property is missing or zero sized, then there is no fallback of any kind and the PCI resources remain undiscovered, i.e. pdev->resource[] array remains empty.
This adds a fallback which parses the "reg" property in pretty much same way except it marks resources as "unset" which later make Linux assign those resources proper addresses.
This has an effect when:
1. a hypervisor failed to assign any resource for a device;
2. /chosen/linux,pci-probe-only=0 is in the DT so the system may try assigning a resource.
Neither is likely to happen under PowerVM.
--- arch/powerpc/kernel/pci_of_scan.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
arch/powerpc/kernel/pci_of_scan.c +10 -2
@@ -82,10 +82,16 @@ static void of_pci_parse_addrs(struct deconst __be32 *addrs;u32 i;int proplen; +bool mark_unset = false; addrs =of_get_property (node,"assigned-addresses" , &proplen); -if (!addrs) -return ; +if (!addrs || !proplen) { + addrs =of_get_property (node,"reg" , &proplen); +if (!addrs || !proplen) +return ; + mark_unset = true; + } +pr_debug (" parse addresses (%d bytes) @ %p\n" , proplen, addrs);for (; proplen >=20 ; proplen -=20 , addrs +=5 ) { flags =pci_parse_of_flags (of_read_number (addrs,1 ),0 );
@@ -110,6 +116,8 @@ static void of_pci_parse_addrs(struct decontinue ; } res->flags = flags; +if (mark_unset) + res->flags |=IORESOURCE_UNSET ; res->name =pci_name (dev); region.start = base; region.end = base + size -1 ;
Greg Kroah-Hartman
maintainerPATCH 70/312 firmware: actually return NULL on failed request_firmware_nowait()
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
commit 715780ae4bb76d6fd2f20eb78e2a9ba9769a6cdc upstream.
The kerneldoc for request_firmware_nowait() says that it may call the provided cont() callback with @fw == NULL, if the firmware request fails. However, this is not the case when called with an empty string (""). This case is short-circuited by the 'name[0] == '\0'' check introduced in commit 471b095dfe0d ("firmware_class: make sure fw requests contain a name"), so _request_firmware() never gets to set the fw to NULL.
Noticed while using the new 'trigger_async_request' testing hook:
# printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
[10553.726178] test_firmware: loading ''
[10553.729859] test_firmware: loaded: 995209091
# printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
[10733.676184] test_firmware: loading ''
[10733.679855] Unable to handle kernel NULL pointer dereference at virtual address 00000004
[10733.687951] pgd = ec188000
[10733.690655] [00000004] *pgd=00000000
[10733.694240] Internal error: Oops: 5 [#1] SMP ARM
[10733.698847] Modules linked in: btmrvl_sdio btmrvl bluetooth sbs_battery nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables asix usbnet mwifiex_sdio mwifiex cfg80211 jitterentropy_rng drbg joydev snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device ppp_async ppp_generic slhc tun
[10733.725670] CPU: 0 PID: 6600 Comm: bash Not tainted 4.4.0-rc4-00351-g63d0877 #178
[10733.733137] Hardware name: Rockchip (Device Tree)
[10733.737831] task: ed24f6c0 ti: ee322000 task.ti: ee322000
[10733.743222] PC is at do_raw_spin_lock+0x18/0x1a0
[10733.747831] LR is at _raw_spin_lock+0x18/0x1c
[10733.752180] pc : [<c00653a0>] lr : [<c054c204>] psr: a00d0013
[10733.752180] sp : ee323df8 ip : ee323e20 fp : ee323e1c
[10733.763634] r10: 00000051 r9 : b6f18000 r8 : ee323f80
[10733.768847] r7 : c089cebc r6 : 00000001 r5 : 00000000 r4 : ec0e6000
[10733.775360] r3 : dead4ead r2 : c06bd140 r1 : eef913b4 r0 : 00000000
[10733.781874] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
[10733.788995] Control: 10c5387d Table: 2c18806a DAC: 00000051
[10733.794728] Process bash (pid: 6600, stack limit = 0xee322218)
[10733.800549] Stack: (0xee323df8 to 0xee324000)
[10733.804896] 3de0: ec0e6000 00000000
[10733.813059] 3e00: 00000001 c089cebc ee323f80 b6f18000 ee323e2c ee323e20 c054c204 c0065394
[10733.821221] 3e20: ee323e44 ee323e30 c02fec60 c054c1f8 ec0e7ec0 ec3fcfc0 ee323e5c ee323e48
[10733.829384] 3e40: c02fed08 c02fec48 c07dbf74 eeb05a00 ee323e8c ee323e60 c0253828 c02fecac
[10733.837547] 3e60: 00000001 c0116950 ee323eac ee323e78 00000001 ec3fce00 ed2d9700 ed2d970c
[10733.845710] 3e80: ee323e9c ee323e90 c02e873c c02537d4 ee323eac ee323ea0 c017bd40 c02e8720
[10733.853873] 3ea0: ee323ee4 ee323eb0 c017b250 c017bd00 00000000 00000000 f3e47a54 ec128b00
[10733.862035] 3ec0: c017b10c ee323f80 00000001 c000f504 ee322000 00000000 ee323f4c ee323ee8
[10733.870197] 3ee0: c011b71c c017b118 ee323fb0 c011bc90 becfa8d9 00000001 ec128b00 00000001
[10733.878359] 3f00: b6f18000 ee323f80 ee323f4c ee323f18 c011bc90 c0063950 ee323f3c ee323f28
[10733.886522] 3f20: c0063950 c0549138 00000001 ec128b00 00000001 ec128b00 b6f18000 ee323f80
[10733.894684] 3f40: ee323f7c ee323f50 c011bed8 c011b6ec c0135fb8 c0135f24 ec128b00 ec128b00
[10733.902847] 3f60: 00000001 b6f18000 c000f504 ee322000 ee323fa4 ee323f80 c011c664 c011be24
[10733.911009] 3f80: 00000000 00000000 00000001 b6f18000 b6e79be0 00000004 00000000 ee323fa8
[10733.919172] 3fa0: c000f340 c011c618 00000001 b6f18000 00000001 b6f18000 00000001 00000000
[10733.927334] 3fc0: 00000001 b6f18000 b6e79be0 00000004 00000001 00000001 8068a3f1 b6e79c84
[10733.935496] 3fe0: 00000000 becfa7dc b6de194d b6e20246 400d0030 00000001 7a4536e8 49bda390
[10733.943664] [<c00653a0>] (do_raw_spin_lock) from [<c054c204>] (_raw_spin_lock+0x18/0x1c)
[10733.951743] [<c054c204>] (_raw_spin_lock) from [<c02fec60>] (fw_free_buf+0x24/0x64)
[10733.959388] [<c02fec60>] (fw_free_buf) from [<c02fed08>] (release_firmware+0x68/0x74)
[10733.967207] [<c02fed08>] (release_firmware) from [<c0253828>] (trigger_async_request_store+0x60/0x124)
[10733.976501] [<c0253828>] (trigger_async_request_store) from [<c02e873c>] (dev_attr_store+0x28/0x34)
[10733.985533] [<c02e873c>] (dev_attr_store) from [<c017bd40>] (sysfs_kf_write+0x4c/0x58)
[10733.993437] [<c017bd40>] (sysfs_kf_write) from [<c017b250>] (kernfs_fop_write+0x144/0x1a8)
[10734.001689] [<c017b250>] (kernfs_fop_write) from [<c011b71c>] (__vfs_write+0x3c/0xe4)After this patch:
# printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
[ 32.126322] test_firmware: loading ''
[ 32.129995] test_firmware: failed to async load firmware
-bash: printf: write error: No such device--- drivers/base/firmware_class.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/base/firmware_class.c +5 -3
@@ -1119,15 +1119,17 @@ static int _request_firmware(const struct firmware **firmware_p, const char *name, struct device *device, unsigned int opt_flags) { - struct firmware *fw; + struct firmware *fw = NULL;long timeout;int ret;if (!firmware_p)return -EINVAL ; -if (!name || name[0 ] =='\0' ) -return -EINVAL ; +if (!name || name[0 ] =='\0' ) { + ret = -EINVAL ; + goto out; + } ret =_request_firmware_prepare (&fw, name, device);if (ret <=0 )/* error or already assigned */
Greg Kroah-Hartman
maintainerPATCH 71/312 c8sectpfe: Rework firmware loading mechanism
In reply to Greg Kroah-HartmanFrom: Peter Griffin <[email protected]>
commit c23ac90f78aa9190643c82c1975a0cfe480d7c60 upstream.
c8sectpfe driver relied on CONFIG_FW_LOADER_USER_HELPER_FALLBACK option for loading its xp70 firmware. A previous commit removed this Kconfig option, as it is apparently harmful, but did not update the driver code which relied on it.
This patch reworks the firmware loading into the start_feed callback. At this point we can be sure the rootfs is present, thereby removing the depedency on CONFIG_FW_LOADER_USER_HELPER_FALLBACK.
--- drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 65 ++++++------------ 1 file changed, 22 insertions(+), 43 deletions(-)
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +22 -43
@@ -49,7 +49,7 @@ MODULE_FIRMWARE(FIRMWARE_MEMDMA);#define PID_TABLE_SIZE 1024#define POLL_MSECS 50 -static int load_c8sectpfe_fw_step1 (struct c8sectpfei *fei); +static int load_c8sectpfe_fw (struct c8sectpfei *fei);#define TS_PKT_SIZE 188#define HEADER_SIZE (4)
@@ -143,6 +143,7 @@ static int c8sectpfe_start_feed(struct dstruct channel_info *channel;u32 tmp;unsigned long *bitmap; +int ret;switch (dvbdmxfeed->type) {case DMX_TYPE_TS :
@@ -171,8 +172,9 @@ static int c8sectpfe_start_feed(struct d }if (!atomic_read (&fei->fw_loaded)) { -dev_err (fei->dev,"%s: c8sectpfe fw not loaded\n" , __func__); -return -EINVAL ; + ret =load_c8sectpfe_fw (fei); +if (ret) +return ret; }mutex_lock (&fei->lock);
@@ -267,8 +269,9 @@ static int c8sectpfe_stop_feed(struct dvunsigned long *bitmap;if (!atomic_read (&fei->fw_loaded)) { -dev_err (fei->dev,"%s: c8sectpfe fw not loaded\n" , __func__); -return -EINVAL ; + ret =load_c8sectpfe_fw (fei); +if (ret) +return ret; }mutex_lock (&fei->lock);
@@ -882,13 +885,6 @@ static int c8sectpfe_probe(struct platfo goto err_clk_disable; } -/* ensure all other init has been done before requesting firmware */ - ret =load_c8sectpfe_fw_step1 (fei); -if (ret) { -dev_err (dev,"Couldn't load slim core firmware\n" ); - goto err_clk_disable; - } -c8sectpfe_debugfs_init (fei);return 0 ;
@@ -1093,15 +1089,14 @@ static void load_dmem_segment(struct c8s phdr->p_memsz - phdr->p_filesz); } -static int load_slim_core_fw (const struct firmware *fw,void *context) +static int load_slim_core_fw (const struct firmware *fw,struct c8sectpfei *fei) { -struct c8sectpfei *fei = context;Elf32_Ehdr *ehdr;Elf32_Phdr *phdr;u8 __iomem *dst;int err =0 , i; -if (!fw || !context) +if (!fw || !fei)return -EINVAL ; ehdr = (Elf32_Ehdr *)fw->data;
@@ -1153,29 +1148,35 @@ static int load_slim_core_fw(const strucreturn err; } -static void load_c8sectpfe_fw_cb (const struct firmware *fw,void *context) +static int load_c8sectpfe_fw (struct c8sectpfei *fei) { -struct c8sectpfei *fei = context; +const struct firmware *fw;int err; +dev_info (fei->dev,"Loading firmware: %s\n" ,FIRMWARE_MEMDMA ); + + err =request_firmware (&fw,FIRMWARE_MEMDMA , fei->dev); +if (err) +return err; + err =c8sectpfe_elf_sanity_check (fei, fw);if (err) {dev_err (fei->dev,"c8sectpfe_elf_sanity_check failed err=(%d)\n" , err); - goto err; +return err; } - err =load_slim_core_fw (fw, context); + err =load_slim_core_fw (fw, fei);if (err) {dev_err (fei->dev,"load_slim_core_fw failed err=(%d)\n" , err); - goto err; +return err; }/* now the firmware is loaded configure the input blocks */ err =configure_channels (fei);if (err) {dev_err (fei->dev,"configure_channels failed err=(%d)\n" , err); - goto err; +return err; }/*
@@ -1188,28 +1189,6 @@ static void load_c8sectpfe_fw_cb(const swritel (0x1 , fei->io +DMA_CPU_RUN );atomic_set (&fei->fw_loaded,1 ); -err: -complete_all (&fei->fw_ack); -} - -static int load_c8sectpfe_fw_step1 (struct c8sectpfei *fei) -{ -int err; - -dev_info (fei->dev,"Loading firmware: %s\n" ,FIRMWARE_MEMDMA ); - -init_completion (&fei->fw_ack); -atomic_set (&fei->fw_loaded,0 ); - - err =request_firmware_nowait (THIS_MODULE ,FW_ACTION_HOTPLUG , -FIRMWARE_MEMDMA , fei->dev,GFP_KERNEL , fei, - load_c8sectpfe_fw_cb); - -if (err) { -dev_err (fei->dev,"request_firmware_nowait err: %d.\n" , err); -complete_all (&fei->fw_ack); -return err; - }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 72/312 net/mlx5: Avoid passing dma address 0 to firmware
In reply to Greg Kroah-HartmanFrom: Noa Osherovich <[email protected]>
commit 6b276190c50a12511d889d9079ffb901ff94a822 upstream.
Currently the firmware can't work with a page with dma address 0. Passing such an address to the firmware will cause the give_pages command to fail.
To avoid this, in case we get a 0 dma address of a page from the dma engine, we avoid passing it to FW by remapping to get an address other than 0.
--- drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 26 +++++++++++++------- 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +18 -8
@@ -243,6 +243,7 @@ static void free_4k(struct mlx5_core_devstatic int alloc_system_page (struct mlx5_core_dev *dev,u16 func_id) {struct page *page; +u64 zero_addr =1 ;u64 addr;int err;int nid =dev_to_node (&dev->pdev->dev);
@@ -252,26 +253,35 @@ static int alloc_system_page(struct mlx5mlx5_core_warn (dev,"failed to allocate page\n" );return -ENOMEM ; } +map: addr =dma_map_page (&dev->pdev->dev, page,0 ,PAGE_SIZE ,DMA_BIDIRECTIONAL );if (dma_mapping_error (&dev->pdev->dev, addr)) {mlx5_core_warn (dev,"failed dma mapping page\n" ); err = -ENOMEM ; - goto out_alloc; + goto err_mapping; } + +/* Firmware doesn't support page with physical address 0 */ +if (addr ==0 ) { + zero_addr = addr; + goto map; + } + err =insert_page (dev, addr, page, func_id);if (err) {mlx5_core_err (dev,"failed to track allocated page\n" ); - goto out_mapping; +dma_unmap_page (&dev->pdev->dev, addr,PAGE_SIZE , +DMA_BIDIRECTIONAL ); } -return 0 ; - -out_mapping: -dma_unmap_page (&dev->pdev->dev, addr,PAGE_SIZE ,DMA_BIDIRECTIONAL ); +err_mapping: +if (err) +__free_page (page); -out_alloc: -__free_page (page); +if (zero_addr ==0 ) +dma_unmap_page (&dev->pdev->dev, zero_addr,PAGE_SIZE , +DMA_BIDIRECTIONAL );return err; }
Greg Kroah-Hartman
maintainerPATCH 73/312 IB/mlx5: Fix RC transport send queue overhead computation
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
commit 75c1657e1d50730dc0130a67977f7831a4e241f4 upstream.
Fix the RC QPs send queue overhead computation to take into account two additional segments in the WQE which are needed for registration operations.
The ATOMIC and UMR segments can't coexist together, so chose maximum out of them.
The commit 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead computation") was intended to update RC transport as commit messages states, but added the code to UC transport.
--- drivers/infiniband/hw/mlx5/qp.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/infiniband/hw/mlx5/qp.c +7 -5
@@ -271,8 +271,10 @@ static int sq_overhead(enum ib_qp_type q/* fall through */ case IB_QPT_RC : size +=sizeof (struct mlx5_wqe_ctrl_seg ) + -sizeof (struct mlx5_wqe_atomic_seg ) + -sizeof (struct mlx5_wqe_raddr_seg ); +max (sizeof (struct mlx5_wqe_atomic_seg ) + +sizeof (struct mlx5_wqe_raddr_seg ), +sizeof (struct mlx5_wqe_umr_ctrl_seg ) + +sizeof (struct mlx5_mkey_seg ));break ;case IB_QPT_XRC_TGT :
@@ -280,9 +282,9 @@ static int sq_overhead(enum ib_qp_type qcase IB_QPT_UC : size +=sizeof (struct mlx5_wqe_ctrl_seg ) + -sizeof (struct mlx5_wqe_raddr_seg ) + -sizeof (struct mlx5_wqe_umr_ctrl_seg ) + -sizeof (struct mlx5_mkey_seg ); +max (sizeof (struct mlx5_wqe_raddr_seg ), +sizeof (struct mlx5_wqe_umr_ctrl_seg ) + +sizeof (struct mlx5_mkey_seg ));break ;case IB_QPT_UD :
Greg Kroah-Hartman
maintainerPATCH 74/312 net/mlx5: Make command timeout way shorter
In reply to Greg Kroah-HartmanFrom: Or Gerlitz <[email protected]>
commit 6b6c07bdcdc97ccac2596063bfc32a5faddfe884 upstream.
The command timeout is terribly long, whole two hours. Make it 60s so if things do go wrong, the user gets feedback in relatively short time, so they can take corrective actions and/or investigate using tools and such.
--- include/linux/mlx5/driver.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/mlx5/driver.h +1 -1
@@ -54,7 +54,7 @@ enum {/* one minute for the sake of bringup. Generally, commands must always * complete and we may need to increase this timeout value */ -MLX5_CMD_TIMEOUT_MSEC =7200 *1000 , +MLX5_CMD_TIMEOUT_MSEC =60 *1000 , MLX5_CMD_WQ_MAX_NAME = 32, };
Greg Kroah-Hartman
maintainerPATCH 75/312 IB/mlx5: Fix FW version diaplay in sysfs
In reply to Greg Kroah-HartmanFrom: Eran Ben Elisha <[email protected]>
commit c0fcebf55289c48148992eee002a7caf853a5358 upstream.
Add a 4-digit padding to show FW version in proper format.
--- drivers/infiniband/hw/mlx5/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/main.c +1 -1
@@ -905,7 +905,7 @@ static ssize_t show_fw_ver(struct device {struct mlx5_ib_dev *dev = container_of(device, struct mlx5_ib_dev, ib_dev.dev); -return sprintf (buf,"%d.%d.%d\n" ,fw_rev_maj (dev->mdev), +return sprintf (buf,"%d.%d.%04d\n" ,fw_rev_maj (dev->mdev),fw_rev_min (dev->mdev),fw_rev_sub (dev->mdev)); }
Greg Kroah-Hartman
maintainerPATCH 76/312 net/mlx5e: Fix MLX5E_100BASE_T define
In reply to Greg Kroah-HartmanFrom: Rana Shahout <[email protected]>
commit 6e4c21894673baabdbef03c3ac2458a28246128b upstream.
Bit 25 of eth_proto_capability in PTYS register is 1000Base-TT and not 100Base-T.
support ConnectX-4 Ethernet functionality')
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -1
@@ -543,7 +543,7 @@ enum mlx5e_link_mode {MLX5E_100GBASE_KR4 =22 ,MLX5E_100GBASE_LR4 =23 ,MLX5E_100BASE_TX =24 , -MLX5E_100BASE_T =25 , +MLX5E_1000BASE_T =25 ,MLX5E_10GBASE_T =26 ,MLX5E_25GBASE_CR =27 , MLX5E_25GBASE_KR = 28,
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +4 -4
@@ -138,10 +138,10 @@ static const struct { [MLX5E_100BASE_TX] = { .speed = 100, }, - [MLX5E_100BASE_T] = { - .supported = SUPPORTED_100baseT_Full, - .advertised = ADVERTISED_100baseT_Full, - .speed = 100, + [MLX5E_1000BASE_T] = { + .supported = SUPPORTED_1000baseT_Full, + .advertised = ADVERTISED_1000baseT_Full, + .speed = 1000, }, [MLX5E_10GBASE_T] = { .supported = SUPPORTED_10000baseT_Full,
Greg Kroah-Hartman
maintainerPATCH 77/312 net/mlx5: Fix the size of modify QP mailbox
In reply to Greg Kroah-HartmanFrom: Majd Dibbiny <[email protected]>
commit 418f8399a8bedf376ec13eb01088f04a76ebdd6f upstream.
Add 16 reserved bytes at the end of mlx5_modify_qp_mbox_in to match the hardware spec definition.
--- include/linux/mlx5/qp.h | 1 + 1 file changed, 1 insertion(+)
include/linux/mlx5/qp.h +1 -0
@@ -539,6 +539,7 @@ struct mlx5_modify_qp_mbox_in {__be32 optparam;u8 rsvd1[4 ];struct mlx5_qp_context ctx; +u8 rsvd2[16 ]; };struct mlx5_modify_qp_mbox_out {
Greg Kroah-Hartman
maintainerPATCH 78/312 net/mlx5: Fix masking of reserved bits in XRCD number
In reply to Greg Kroah-HartmanFrom: Majd Dibbiny <[email protected]>
commit 9cd3411c42c5d5ba55d6e745edfe7df53c1ffa41 upstream.
Mask the reserved bits when reading the number of newly created XRCD.
--- drivers/net/ethernet/mellanox/mlx5/core/qp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/qp.c +1 -1
@@ -393,7 +393,7 @@ int mlx5_core_xrcd_alloc(struct mlx5_corif (out.hdr.status) err =mlx5_cmd_status_to_err (&out.hdr);else - *xrcdn =be32_to_cpu (out.xrcdn); + *xrcdn =be32_to_cpu (out.xrcdn) &0xffffff ;return err; }
Greg Kroah-Hartman
maintainerPATCH 79/312 net/mlx5e: Fix blue flame quota logic
In reply to Greg Kroah-HartmanFrom: Eli Cohen <[email protected]>
commit 0ca00fc1f808602137dc6d51f17747b3bb0fc34d upstream.
Blue flame is a latency enhancement feature that allows the driver to write the packet data directly to the NIC's registers thus making the read of the packet data from host memory redundant.
We maintain a quota for the blue flame which is reloaded whenever we identify that the hardware is processing send requests and processes them fast enough so by the time we post the next send request it was able to process all the pending ones. This indicates that the hardware is capable of processing more blue flame requests efficiently. The blue flame quota is decremented whenever we send using blue flame.
The current code erroneously clears the budget if we did not use blue flame for the current post send operation and we fix it here.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +2 -1
@@ -290,7 +290,8 @@ static netdev_tx_t mlx5e_sq_xmit(structwhile ((sq->pc & wq->sz_m1) > sq->edge)mlx5e_send_nop (sq, false); - sq->bf_budget = bf ? sq->bf_budget -1 :0 ; +if (bf) + sq->bf_budget--; sq->stats.packets++;return NETDEV_TX_OK ;
Greg Kroah-Hartman
maintainerPATCH 80/312 net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create
In reply to Greg Kroah-HartmanFrom: Wang Sheng-Hui <[email protected]>
commit f299a02d5f13c4deb52c1a7ddf2b42630fe6294a upstream.
Commit 311c7c71c9bb ("net/mlx5e: Allocate DMA coherent memory on reader NUMA node") introduced mlx5_*_alloc_node() but missed changing some calling and warn messages. This patch introduces 2 changes:
* Use mlx5_buf_alloc_node() instead of mlx5_buf_alloc() in mlx5_wq_ll_create()
* Update the failure warn messages with _node postfix for mlx5_*_alloc function names
--- drivers/net/ethernet/mellanox/mlx5/core/wq.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/wq.c +8 -7
@@ -75,14 +75,14 @@ int mlx5_wq_cyc_create(struct mlx5_core_ err =mlx5_db_alloc_node (mdev, &wq_ctrl->db, param->db_numa_node);if (err) { -mlx5_core_warn (mdev,"mlx5_db_alloc() failed, %d\n" , err); +mlx5_core_warn (mdev,"mlx5_db_alloc_node() failed, %d\n" , err);return err; } err =mlx5_buf_alloc_node (mdev,mlx5_wq_cyc_get_byte_size (wq), &wq_ctrl->buf, param->buf_numa_node);if (err) { -mlx5_core_warn (mdev,"mlx5_buf_alloc() failed, %d\n" , err); +mlx5_core_warn (mdev,"mlx5_buf_alloc_node() failed, %d\n" , err); goto err_db_free; }
@@ -111,14 +111,14 @@ int mlx5_cqwq_create(struct mlx5_core_de err =mlx5_db_alloc_node (mdev, &wq_ctrl->db, param->db_numa_node);if (err) { -mlx5_core_warn (mdev,"mlx5_db_alloc() failed, %d\n" , err); +mlx5_core_warn (mdev,"mlx5_db_alloc_node() failed, %d\n" , err);return err; } err =mlx5_buf_alloc_node (mdev,mlx5_cqwq_get_byte_size (wq), &wq_ctrl->buf, param->buf_numa_node);if (err) { -mlx5_core_warn (mdev,"mlx5_buf_alloc() failed, %d\n" , err); +mlx5_core_warn (mdev,"mlx5_buf_alloc_node() failed, %d\n" , err); goto err_db_free; }
@@ -148,13 +148,14 @@ int mlx5_wq_ll_create(struct mlx5_core_d err =mlx5_db_alloc_node (mdev, &wq_ctrl->db, param->db_numa_node);if (err) { -mlx5_core_warn (mdev,"mlx5_db_alloc() failed, %d\n" , err); +mlx5_core_warn (mdev,"mlx5_db_alloc_node() failed, %d\n" , err);return err; } - err =mlx5_buf_alloc (mdev,mlx5_wq_ll_get_byte_size (wq), &wq_ctrl->buf); + err =mlx5_buf_alloc_node (mdev,mlx5_wq_ll_get_byte_size (wq), + &wq_ctrl->buf, param->buf_numa_node);if (err) { -mlx5_core_warn (mdev,"mlx5_buf_alloc() failed, %d\n" , err); +mlx5_core_warn (mdev,"mlx5_buf_alloc_node() failed, %d\n" , err); goto err_db_free; }
Greg Kroah-Hartman
maintainerPATCH 81/312 net/mlx5: Avoid calling sleeping function by the health poll thread
In reply to Greg Kroah-HartmanFrom: Mohamad Haj Yahia <[email protected]>
commit c1d4d2e92ad670168a17a57dfa182a5a5baa72d4 upstream.
In internal error state the health poll thread will eventually call synchronize_irq() (to safely trigger command completions) which might sleep, so we are calling sleeping function from atomic context which is invalid.
Here we move trigger_cmd_completions(dev) to enter error state which is the earliest stage in error state handling.
This way we won't need to wait for next health poll to trigger command completions and will solve the scheduling while atomic issue. mlx5_enter_error_state can be called from two contexts, protect it with dev->intf_state_lock
--- drivers/net/ethernet/mellanox/mlx5/core/health.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/health.c +8 -3
@@ -108,15 +108,21 @@ static int in_fatal(struct mlx5_core_devvoid mlx5_enter_error_state (struct mlx5_core_dev *dev) { +mutex_lock (&dev->intf_state_mutex);if (dev->state ==MLX5_DEVICE_STATE_INTERNAL_ERROR ) -return ; + goto unlock;mlx5_core_err (dev,"start\n" ); -if (pci_channel_offline (dev->pdev) ||in_fatal (dev)) +if (pci_channel_offline (dev->pdev) ||in_fatal (dev)) { dev->state =MLX5_DEVICE_STATE_INTERNAL_ERROR ; +trigger_cmd_completions (dev); + }mlx5_core_event (dev,MLX5_DEV_EVENT_SYS_ERROR ,0 );mlx5_core_err (dev,"end\n" ); + +unlock: +mutex_unlock (&dev->intf_state_mutex); }static void mlx5_handle_bad_state (struct mlx5_core_dev *dev)
@@ -245,7 +251,6 @@ static void poll_health(unsigned long dau32 count;if (dev->state ==MLX5_DEVICE_STATE_INTERNAL_ERROR ) { -trigger_cmd_completions (dev);mod_timer (&health->timer,get_next_poll_jiffies ());return ; }
Greg Kroah-Hartman
maintainerPATCH 82/312 net/mlx5: Fix wait_vital for VFs and remove fixed sleep
In reply to Greg Kroah-HartmanFrom: Daniel Jurgens <[email protected]>
commit d57847dc4177c6fd8d950cb533f5edf0eab45b11 upstream.
The device ID for VFs is in a different location than PFs. This results in the poll always timing out for VFs. There's no good way to read the VF device ID without using the PF's configuration space. Switch to waiting for the health poll to start incrementing. Also remove the 1s sleep at the beginning.
driver')
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 41 +++++++++---------------- 1 file changed, 15 insertions(+), 26 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +15 -26
@@ -1306,46 +1306,31 @@ void mlx5_disable_device(struct mlx5_cormlx5_pci_err_detected (dev->pdev,0 ); } -/* wait for the device to show vital signs. For now we check -* that we can read the device ID and that the health buffer -* shows a non zero value which is different than 0xffffffff +/* wait for the device to show vital signs by waiting +* for the health counter to start counting. */ -static void wait_vital (struct pci_dev *pdev) +static int wait_vital (struct pci_dev *pdev) {struct mlx5_core_dev *dev =pci_get_drvdata (pdev);struct mlx5_core_health *health = &dev->priv.health;const int niter =100 ; +u32 last_count =0 ;u32 count; -u16 did;int i; -/* Wait for firmware to be ready after reset */ -msleep (1000 ); -for (i =0 ; i < niter; i++) { -if (pci_read_config_word (pdev,2 , &did)) { -dev_warn (&pdev->dev,"failed reading config word\n" ); -break ; - } -if (did == pdev->device) { -dev_info (&pdev->dev,"device ID correctly read after %d iterations\n" , i); -break ; - } -msleep (50 ); - } -if (i == niter) -dev_warn (&pdev->dev,"%s-%d: could not read device ID\n" , __func__, __LINE__); -for (i =0 ; i < niter; i++) { count =ioread32be (health->health_counter);if (count && count !=0xffffffff ) { -dev_info (&pdev->dev,"Counter value 0x%x after %d iterations\n" , count, i); -break ; +if (last_count && last_count != count) { +dev_info (&pdev->dev,"Counter value 0x%x after %d iterations\n" , count, i); +return 0 ; + } + last_count = count; }msleep (50 ); } -if (i == niter) -dev_warn (&pdev->dev,"%s-%d: could not read device ID\n" , __func__, __LINE__); +return -ETIMEDOUT ; }static void mlx5_pci_resume (struct pci_dev *pdev)
@@ -1357,7 +1342,11 @@ static void mlx5_pci_resume(struct pci_ddev_info (&pdev->dev,"%s was called\n" , __func__);pci_save_state (pdev); -wait_vital (pdev); + err =wait_vital (pdev); +if (err) { +dev_err (&pdev->dev,"%s: wait_vital timed out\n" , __func__); +return ; + } err =mlx5_load_one (dev, priv);if (err)
Greg Kroah-Hartman
maintainerPATCH 83/312 net/mlx5: Fix potential deadlock in command mode change
In reply to Greg Kroah-HartmanFrom: Mohamad Haj Yahia <[email protected]>
commit 9cba4ebcf374c3772f6eb61f2d065294b2451b49 upstream.
Call command completion handler in case of timeout when working in interrupts mode.
Avoid flushing the commands workqueue after acquiring the semaphores to prevent a potential deadlock.
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 79 ++++++++++---------------- 1 file changed, 33 insertions(+), 46 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +33 -46
@@ -750,13 +750,13 @@ static int wait_func(struct mlx5_core_deif (cmd->mode ==CMD_MODE_POLLING ) {wait_for_completion (&ent->done); - err = ent->ret; - }else { -if (!wait_for_completion_timeout (&ent->done, timeout)) - err = -ETIMEDOUT ; -else - err =0 ; + }else if (!wait_for_completion_timeout (&ent->done, timeout)) { + ent->ret = -ETIMEDOUT ; +mlx5_cmd_comp_handler (dev,1UL << ent->idx); } + + err = ent->ret; +if (err == -ETIMEDOUT ) { mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n", mlx5_command_str(msg_to_opcode(ent->in)),
@@ -817,28 +817,26 @@ static int mlx5_cmd_invoke(struct mlx5_c goto out_free; } -if (!callback) { - err =wait_func (dev, ent); -if (err == -ETIMEDOUT ) - goto out; - - ds = ent->ts2 - ent->ts1; - op =be16_to_cpu (((struct mlx5_inbox_hdr *)in->first.data)->opcode); -if (op <ARRAY_SIZE (cmd->stats)) { - stats = &cmd->stats[op]; -spin_lock_irq (&stats->lock); - stats->sum += ds; - ++stats->n; -spin_unlock_irq (&stats->lock); - } -mlx5_core_dbg_mask (dev,1 <<MLX5_CMD_TIME , -"fw exec time for %s is %lld nsec\n" , -mlx5_command_str (op), ds); - *status = ent->status; -free_cmd (ent); - } +if (callback) + goto out; -return err; + err =wait_func (dev, ent); +if (err == -ETIMEDOUT ) + goto out_free; + + ds = ent->ts2 - ent->ts1; + op =be16_to_cpu (((struct mlx5_inbox_hdr *)in->first.data)->opcode); +if (op <ARRAY_SIZE (cmd->stats)) { + stats = &cmd->stats[op]; +spin_lock_irq (&stats->lock); + stats->sum += ds; + ++stats->n; +spin_unlock_irq (&stats->lock); + } +mlx5_core_dbg_mask (dev,1 <<MLX5_CMD_TIME , +"fw exec time for %s is %lld nsec\n" , +mlx5_command_str (op), ds); + *status = ent->status; out_free:free_cmd (ent);
@@ -1230,41 +1228,30 @@ err_dbg:return err; } -void mlx5_cmd_use_events (struct mlx5_core_dev *dev) +static void mlx5_cmd_change_mod (struct mlx5_core_dev *dev,int mode) {struct mlx5_cmd *cmd = &dev->cmd;int i;for (i =0 ; i < cmd->max_reg_cmds; i++)down (&cmd->sem); -down (&cmd->pages_sem); -flush_workqueue (cmd->wq); - - cmd->mode =CMD_MODE_EVENTS ; + cmd->mode = mode;up (&cmd->pages_sem);for (i =0 ; i < cmd->max_reg_cmds; i++)up (&cmd->sem); } -void mlx5_cmd_use_polling (struct mlx5_core_dev *dev) +void mlx5_cmd_use_events (struct mlx5_core_dev *dev) { -struct mlx5_cmd *cmd = &dev->cmd; -int i; - -for (i =0 ; i < cmd->max_reg_cmds; i++) -down (&cmd->sem); - -down (&cmd->pages_sem); - -flush_workqueue (cmd->wq); - cmd->mode =CMD_MODE_POLLING ; +mlx5_cmd_change_mod (dev,CMD_MODE_EVENTS ); +} -up (&cmd->pages_sem); -for (i =0 ; i < cmd->max_reg_cmds; i++) -up (&cmd->sem); +void mlx5_cmd_use_polling (struct mlx5_core_dev *dev) +{ +mlx5_cmd_change_mod (dev,CMD_MODE_POLLING ); }static void free_msg (struct mlx5_core_dev *dev,struct mlx5_cmd_msg *msg)
Greg Kroah-Hartman
maintainerPATCH 84/312 net/mlx5: Add timeout handle to commands with callback
In reply to Greg Kroah-HartmanFrom: Mohamad Haj Yahia <[email protected]>
commit 65ee67084589c1783a74b4a4a5db38d7264ec8b5 upstream.
The current implementation does not handle timeout in case of command with callback request, and this can lead to deadlock if the command doesn't get fw response.
Add delayed callback timeout work before posting the command to fw. In case of real fw command completion we will cancel the delayed work. In case of fw command timeout the callback timeout handler will be called and it will simulate fw completion with timeout error.
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 38 +++++++++++++++++++++----- include/linux/mlx5/driver.h | 1 2 files changed, 32 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +31 -7
@@ -634,11 +634,36 @@ static void free_msg(struct mlx5_core_destatic void mlx5_free_cmd_msg (struct mlx5_core_dev *dev,struct mlx5_cmd_msg *msg); +static u16 msg_to_opcode (struct mlx5_cmd_msg *in) +{ +struct mlx5_inbox_hdr *hdr = (struct mlx5_inbox_hdr *)(in->first.data); + +return be16_to_cpu (hdr->opcode); +} + +static void cb_timeout_handler (struct work_struct *work) +{ + struct delayed_work *dwork = container_of(work, struct delayed_work, + work); +struct mlx5_cmd_work_ent *ent =container_of (dwork, + struct mlx5_cmd_work_ent, + cb_timeout_work); + struct mlx5_core_dev *dev = container_of(ent->cmd, struct mlx5_core_dev, + cmd); + + ent->ret = -ETIMEDOUT ; +mlx5_core_warn (dev,"%s(0x%x) timeout. Will cause a leak of a command resource\n" , +mlx5_command_str (msg_to_opcode (ent->in)), +msg_to_opcode (ent->in)); +mlx5_cmd_comp_handler (dev,1UL << ent->idx); +} +static void cmd_work_handler (struct work_struct *work) { struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work);struct mlx5_cmd *cmd = ent->cmd; struct mlx5_core_dev *dev = container_of(cmd, struct mlx5_core_dev, cmd); +unsigned long cb_timeout =msecs_to_jiffies (MLX5_CMD_TIMEOUT_MSEC );struct mlx5_cmd_layout *lay;struct semaphore *sem;unsigned long flags;
@@ -691,6 +716,9 @@ static void cmd_work_handler(struct work ent->ts1 =ktime_get_ns (); cmd_mode = cmd->mode; +if (ent->callback) +schedule_delayed_work (&ent->cb_timeout_work, cb_timeout); +/* ring doorbell after the descriptor is valid */ mlx5_core_dbg (dev,"writing 0x%x to command doorbell\n" ,1 << ent->idx);wmb ();
@@ -735,13 +763,6 @@ static const char *deliv_status_to_str(u } } -static u16 msg_to_opcode (struct mlx5_cmd_msg *in) -{ -struct mlx5_inbox_hdr *hdr = (struct mlx5_inbox_hdr *)(in->first.data); - -return be16_to_cpu (hdr->opcode); -} -static int wait_func (struct mlx5_core_dev *dev,struct mlx5_cmd_work_ent *ent) {unsigned long timeout =msecs_to_jiffies (MLX5_CMD_TIMEOUT_MSEC );
@@ -808,6 +829,7 @@ static int mlx5_cmd_invoke(struct mlx5_cif (!callback)init_completion (&ent->done); +INIT_DELAYED_WORK (&ent->cb_timeout_work, cb_timeout_handler);INIT_WORK (&ent->work, cmd_work_handler);if (page_queue) {cmd_work_handler (&ent->work);
@@ -1287,6 +1309,8 @@ void mlx5_cmd_comp_handler(struct mlx5_cstruct semaphore *sem; ent = cmd->ent_arr[i]; +if (ent->callback) +cancel_delayed_work (&ent->cb_timeout_work);if (ent->page_queue) sem = &cmd->pages_sem;else
include/linux/mlx5/driver.h +1 -0
@@ -566,6 +566,7 @@ struct mlx5_cmd_work_ent {void *uout;int uout_size;mlx5_cmd_cbk_t callback; +struct delayed_work cb_timeout_work;void *context;int idx;struct completion done;
Greg Kroah-Hartman
maintainerPATCH 85/312 net/mlx5: Fix pci error recovery flow
In reply to Greg Kroah-HartmanFrom: Mohamad Haj Yahia <[email protected]>
commit 1061c90f524963a0a90e7d2f9a6bfa666458af51 upstream.
When PCI error is detected we should save the state of the pci prior to disabling it.
Also when receiving pci slot reset call we need to verify that the device is responsive.
driver')
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 59 ++++++++++++------------- 1 file changed, 29 insertions(+), 30 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +29 -30
@@ -1276,36 +1276,12 @@ static pci_ers_result_t mlx5_pci_err_detdev_info (&pdev->dev,"%s was called\n" , __func__);mlx5_enter_error_state (dev);mlx5_unload_one (dev, priv); +pci_save_state (pdev);mlx5_pci_disable_device (dev);return state == pci_channel_io_perm_failure ?PCI_ERS_RESULT_DISCONNECT :PCI_ERS_RESULT_NEED_RESET ; } -static pci_ers_result_t mlx5_pci_slot_reset (struct pci_dev *pdev) -{ -struct mlx5_core_dev *dev =pci_get_drvdata (pdev); -int err =0 ; - -dev_info (&pdev->dev,"%s was called\n" , __func__); - - err =mlx5_pci_enable_device (dev); -if (err) { -dev_err (&pdev->dev,"%s: mlx5_pci_enable_device failed with error code: %d\n" - , __func__, err); -return PCI_ERS_RESULT_DISCONNECT ; - } -pci_set_master (pdev); -pci_set_power_state (pdev,PCI_D0 ); -pci_restore_state (pdev); - -return err ?PCI_ERS_RESULT_DISCONNECT :PCI_ERS_RESULT_RECOVERED ; -} - -void mlx5_disable_device (struct mlx5_core_dev *dev) -{ -mlx5_pci_err_detected (dev->pdev,0 ); -} -/* wait for the device to show vital signs by waiting * for the health counter to start counting. */
@@ -1333,21 +1309,44 @@ static int wait_vital(struct pci_dev *pdreturn -ETIMEDOUT ; } -static void mlx5_pci_resume (struct pci_dev *pdev) +static pci_ers_result_t mlx5_pci_slot_reset (struct pci_dev *pdev) {struct mlx5_core_dev *dev =pci_get_drvdata (pdev); -struct mlx5_priv *priv = &dev->priv;int err;dev_info (&pdev->dev,"%s was called\n" , __func__); -pci_save_state (pdev); - err =wait_vital (pdev); + err =mlx5_pci_enable_device (dev);if (err) { +dev_err (&pdev->dev,"%s: mlx5_pci_enable_device failed with error code: %d\n" + , __func__, err); +return PCI_ERS_RESULT_DISCONNECT ; + } + +pci_set_master (pdev); +pci_restore_state (pdev); + +if (wait_vital (pdev)) {dev_err (&pdev->dev,"%s: wait_vital timed out\n" , __func__); -return ; +return PCI_ERS_RESULT_DISCONNECT ; } +return PCI_ERS_RESULT_RECOVERED ; +} + +void mlx5_disable_device (struct mlx5_core_dev *dev) +{ +mlx5_pci_err_detected (dev->pdev,0 ); +} + +static void mlx5_pci_resume (struct pci_dev *pdev) +{ +struct mlx5_core_dev *dev =pci_get_drvdata (pdev); +struct mlx5_priv *priv = &dev->priv; +int err; + +dev_info (&pdev->dev,"%s was called\n" , __func__); + err =mlx5_load_one (dev, priv);if (err) dev_err(&pdev->dev, "%s: mlx5_load_one failed with error code: %d\n"
Greg Kroah-Hartman
maintainerPATCH 86/312 net/mlx5e: Copy all L2 headers into inline segment
In reply to Greg Kroah-HartmanFrom: Matthew Finlay <[email protected]>
commit e3a19b53cbb0e6738b7a547f262179065b72e3fa upstream.
ConnectX4-Lx uses an inline wqe mode that currently defaults to requiring the entire L2 header be included in the wqe. This patch fixes mlx5e_get_inline_hdr_size() to account for all L2 headers (VLAN, QinQ, etc) using skb_network_offset(skb).
--- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +2 -2
@@ -124,7 +124,7 @@ static inline u16 mlx5e_get_inline_hdr_s* headers and occur before the data gather. * Therefore these headers must be copied into the WQE */ -#define MLX5E_MIN_INLINE ETH_HLEN +#define MLX5E_MIN_INLINE (ETH_HLEN + VLAN_HLEN)if (bf) {u16 ihs =skb_headlen (skb);
@@ -136,7 +136,7 @@ static inline u16 mlx5e_get_inline_hdr_sreturn skb_headlen (skb); } -return MLX5E_MIN_INLINE ; +return max (skb_network_offset (skb),MLX5E_MIN_INLINE ); }static inline void mlx5e_insert_vlan (void *start,struct sk_buff *skb,u16 ihs)
Greg Kroah-Hartman
maintainerPATCH 87/312 net_sched: keep backlog updated with qlen
In reply to Greg Kroah-HartmanFrom: WANG Cong <[email protected]>
commit a27758ffaf96f89002129eedb2cc172d254099f8 upstream.
For gso_skb we only update qlen, backlog should be updated too.
Note, it is correct to just update these stats at one layer, because the gso_skb is cached there.
--- include/net/sch_generic.h | 5 ++++- net/sched/sch_generic.c | 2 ++ 2 files changed, 6 insertions(+), 1 deletion(-)
include/net/sch_generic.h +4 -1
@@ -674,9 +674,11 @@ static inline struct sk_buff *qdisc_peek/* we can reuse ->gso_skb because peek isn't called for root qdiscs */ if (!sch->gso_skb) { sch->gso_skb = sch->dequeue (sch); -if (sch->gso_skb) +if (sch->gso_skb) {/* it's still part of the queue */ +qdisc_qstats_backlog_inc (sch, sch->gso_skb); sch->q.qlen++; + } }return sch->gso_skb;
@@ -689,6 +691,7 @@ static inline struct sk_buff *qdisc_dequif (skb) { sch->gso_skb =NULL ; +qdisc_qstats_backlog_dec (sch, skb); sch->q.qlen--; }else { skb = sch->dequeue (sch);
net/sched/sch_generic.c +2 -0
@@ -49,6 +49,7 @@ static inline int dev_requeue_skb(struct { q->gso_skb = skb; q->qstats.requeues++; +qdisc_qstats_backlog_inc (q, skb); q->q.qlen++;/* it's still part of the queue */ __netif_schedule (q);
@@ -92,6 +93,7 @@ static struct sk_buff *dequeue_skb(struc txq =skb_get_tx_queue (txq->dev, skb);if (!netif_xmit_frozen_or_stopped (txq)) { q->gso_skb =NULL ; +qdisc_qstats_backlog_dec (q, skb); q->q.qlen--; }else skb =NULL ;
Greg Kroah-Hartman
maintainerPATCH 88/312 sch_drr: update backlog as well
In reply to Greg Kroah-HartmanFrom: WANG Cong <[email protected]>
commit 6a73b571b63075ef408c83f07c2565b5652f93cc upstream.
--- net/sched/sch_drr.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sched/sch_drr.c +4 -0
@@ -375,6 +375,7 @@ static int drr_enqueue(struct sk_buff *s cl->deficit = cl->quantum; } +qdisc_qstats_backlog_inc (sch, skb); sch->q.qlen++;return err; }
@@ -405,6 +406,7 @@ static struct sk_buff *drr_dequeue(strucbstats_update (&cl->bstats, skb);qdisc_bstats_update (sch, skb); +qdisc_qstats_backlog_dec (sch, skb); sch->q.qlen--;return skb; }
@@ -426,6 +428,7 @@ static unsigned int drr_drop(struct Qdisif (cl->qdisc->ops->drop) { len = cl->qdisc->ops->drop (cl->qdisc);if (len >0 ) { + sch->qstats.backlog -= len; sch->q.qlen--;if (cl->qdisc->q.qlen ==0 )list_del (&cl->alist);
@@ -461,6 +464,7 @@ static void drr_reset_qdisc(struct Qdiscqdisc_reset (cl->qdisc); } } + sch->qstats.backlog =0 ; sch->q.qlen =0 ; }
Greg Kroah-Hartman
maintainerPATCH 89/312 sch_hfsc: always keep backlog updated
In reply to Greg Kroah-HartmanFrom: WANG Cong <[email protected]>
commit 357cc9b4a8a7a0cd0e662537b76e6fa4670b6798 upstream.
hfsc updates backlog lazily, that is only when we dump the stats. This is problematic after we begin to update backlog in qdisc_tree_reduce_backlog().
--- net/sched/sch_hfsc.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
net/sched/sch_hfsc.c +4 -8
@@ -1529,6 +1529,7 @@ hfsc_reset_qdisc(struct Qdisc *sch) q->eligible =RB_ROOT ;INIT_LIST_HEAD (&q->droplist);qdisc_watchdog_cancel (&q->watchdog); + sch->qstats.backlog =0 ; sch->q.qlen =0 ; }
@@ -1559,14 +1560,6 @@ hfsc_dump_qdisc(struct Qdisc *sch, strucstruct hfsc_sched *q =qdisc_priv (sch);unsigned char *b =skb_tail_pointer (skb);struct tc_hfsc_qopt qopt; -struct hfsc_class *cl; -unsigned int i; - - sch->qstats.backlog =0 ; -for (i =0 ; i < q->clhash.hashsize; i++) { -hlist_for_each_entry (cl, &q->clhash.hash[i], cl_common.hnode) - sch->qstats.backlog += cl->qdisc->qstats.backlog; - } qopt.defcls = q->defcls;if (nla_put (skb,TCA_OPTIONS ,sizeof (qopt), &qopt))
@@ -1604,6 +1597,7 @@ hfsc_enqueue(struct sk_buff *skb, structif (cl->qdisc->q.qlen ==1 )set_active (cl,qdisc_pkt_len (skb)); +qdisc_qstats_backlog_inc (sch, skb); sch->q.qlen++;return NET_XMIT_SUCCESS ;
@@ -1672,6 +1666,7 @@ hfsc_dequeue(struct Qdisc *sch)qdisc_unthrottled (sch);qdisc_bstats_update (sch, skb); +qdisc_qstats_backlog_dec (sch, skb); sch->q.qlen--;return skb;
@@ -1695,6 +1690,7 @@ hfsc_drop(struct Qdisc *sch) } cl->qstats.drops++;qdisc_qstats_drop (sch); + sch->qstats.backlog -= len; sch->q.qlen--;return len; }
Greg Kroah-Hartman
maintainerPATCH 90/312 sch_prio: update backlog as well
In reply to Greg Kroah-HartmanFrom: WANG Cong <[email protected]>
commit 6529d75ad9228f4d8a8f6c5c5244ceb945ac9bc2 upstream.
We need to update backlog too when we update qlen.
Joint work with Stas.
--- net/sched/sch_prio.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sched/sch_prio.c +4 -0
@@ -85,6 +85,7 @@ prio_enqueue(struct sk_buff *skb, struct ret =qdisc_enqueue (skb, qdisc);if (ret ==NET_XMIT_SUCCESS ) { +qdisc_qstats_backlog_inc (sch, skb); sch->q.qlen++;return NET_XMIT_SUCCESS ; }
@@ -117,6 +118,7 @@ static struct sk_buff *prio_dequeue(strustruct sk_buff *skb =qdisc_dequeue_peeked (qdisc);if (skb) {qdisc_bstats_update (sch, skb); +qdisc_qstats_backlog_dec (sch, skb); sch->q.qlen--;return skb; }
@@ -135,6 +137,7 @@ static unsigned int prio_drop(struct Qdifor (prio = q->bands-1 ; prio >=0 ; prio--) { qdisc = q->queues[prio];if (qdisc->ops->drop && (len = qdisc->ops->drop (qdisc)) !=0 ) { + sch->qstats.backlog -= len; sch->q.qlen--;return len; }
@@ -151,6 +154,7 @@ prio_reset(struct Qdisc *sch)for (prio =0 ; prio < q->bands; prio++)qdisc_reset (q->queues[prio]); + sch->qstats.backlog =0 ; sch->q.qlen =0 ; }
Greg Kroah-Hartman
maintainerPATCH 91/312 sch_qfq: keep backlog updated with qlen
In reply to Greg Kroah-HartmanFrom: WANG Cong <[email protected]>
commit 2ed5c3f09627f72a2e0e407a86b2ac05494190f9 upstream.
--- net/sched/sch_qfq.c | 3 +++ 1 file changed, 3 insertions(+)
net/sched/sch_qfq.c +3 -0
@@ -1150,6 +1150,7 @@ static struct sk_buff *qfq_dequeue(strucif (!skb)return NULL ; +qdisc_qstats_backlog_dec (sch, skb); sch->q.qlen--;qdisc_bstats_update (sch, skb);
@@ -1250,6 +1251,7 @@ static int qfq_enqueue(struct sk_buff *s }bstats_update (&cl->bstats, skb); +qdisc_qstats_backlog_inc (sch, skb); ++sch->q.qlen; agg = cl->agg;
@@ -1516,6 +1518,7 @@ static void qfq_reset_qdisc(struct Qdiscqdisc_reset (cl->qdisc); } } + sch->qstats.backlog =0 ; sch->q.qlen =0 ; }
Greg Kroah-Hartman
maintainerPATCH 92/312 sch_sfb: keep backlog updated with qlen
In reply to Greg Kroah-HartmanFrom: WANG Cong <[email protected]>
commit 3d4357fba82b3cf19ebf0a04d1c9cb086af15d02 upstream.
--- net/sched/sch_sfb.c | 3 +++ 1 file changed, 3 insertions(+)
net/sched/sch_sfb.c +3 -0
@@ -400,6 +400,7 @@ static int sfb_enqueue(struct sk_buff *s enqueue: ret =qdisc_enqueue (skb, child);if (likely (ret ==NET_XMIT_SUCCESS )) { +qdisc_qstats_backlog_inc (sch, skb); sch->q.qlen++;increment_qlen (skb, q); }else if (net_xmit_drop_count (ret)) {
@@ -428,6 +429,7 @@ static struct sk_buff *sfb_dequeue(strucif (skb) {qdisc_bstats_update (sch, skb); +qdisc_qstats_backlog_dec (sch, skb); sch->q.qlen--;decrement_qlen (skb, q); }
@@ -450,6 +452,7 @@ static void sfb_reset(struct Qdisc *sch)struct sfb_sched_data *q =qdisc_priv (sch);qdisc_reset (q->qdisc); + sch->qstats.backlog =0 ; sch->q.qlen =0 ; q->slot =0 ; q->double_buffering = false;
Greg Kroah-Hartman
maintainerPATCH 93/312 sch_tbf: update backlog as well
In reply to Greg Kroah-HartmanFrom: WANG Cong <[email protected]>
commit 8d5958f424b62060a8696b12c17dad198d5d386f upstream.
--- net/sched/sch_tbf.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sched/sch_tbf.c +4 -0
@@ -197,6 +197,7 @@ static int tbf_enqueue(struct sk_buff *sreturn ret; } +qdisc_qstats_backlog_inc (sch, skb); sch->q.qlen++;return NET_XMIT_SUCCESS ; }
@@ -207,6 +208,7 @@ static unsigned int tbf_drop(struct Qdisunsigned int len =0 ;if (q->qdisc->ops->drop && (len = q->qdisc->ops->drop (q->qdisc)) !=0 ) { + sch->qstats.backlog -= len; sch->q.qlen--;qdisc_qstats_drop (sch); }
@@ -253,6 +255,7 @@ static struct sk_buff *tbf_dequeue(struc q->t_c = now; q->tokens = toks; q->ptokens = ptoks; +qdisc_qstats_backlog_dec (sch, skb); sch->q.qlen--;qdisc_unthrottled (sch);qdisc_bstats_update (sch, skb);
@@ -284,6 +287,7 @@ static void tbf_reset(struct Qdisc *sch)struct tbf_sched_data *q =qdisc_priv (sch);qdisc_reset (q->qdisc); + sch->qstats.backlog =0 ; sch->q.qlen =0 ; q->t_c =ktime_get_ns (); q->tokens = q->buffer;
Greg Kroah-Hartman
maintainerPATCH 94/312 btrfs: cleaner_kthread() doesnt need explicit freeze
In reply to Greg Kroah-HartmanFrom: Jiri Kosina <[email protected]>
commit 838fe1887765f4cc679febea60d87d2a06bd300e upstream.
cleaner_kthread() is not marked freezable, and therefore calling try_to_freeze() in its context is a pointless no-op.
In addition to that, as has been clearly demonstrated by 80ad623edd2d ("Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()"), it's perfectly valid / legal for cleaner_kthread() to stay scheduled out in an arbitrary place during suspend (in that particular example that was waiting for reading of extent pages), so there is no need to leave any traces of freezer in this kthread.
--- fs/btrfs/disk-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/disk-io.c +1 -1
@@ -1750,7 +1750,7 @@ static int cleaner_kthread(void *arg)*/ btrfs_delete_unused_bgs (root->fs_info); sleep: -if (!try_to_freeze () && !again) { +if (!again) {set_current_state (TASK_INTERRUPTIBLE );if (!kthread_should_stop ())schedule ();
Greg Kroah-Hartman
maintainerPATCH 95/312 irda: Free skb on irda_accept error path.
In reply to Greg Kroah-HartmanFrom: [email protected] <[email protected]>
commit 8ab86c00e349cef9fb14719093a7f198bcc72629 upstream.
skb is not freed if newsk is NULL. Rework the error path so free_skb is unconditionally called on function exit.
--- net/irda/af_irda.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/irda/af_irda.c +2 -3
@@ -839,7 +839,7 @@ static int irda_accept(struct socket *sostruct sock *sk = sock->sk;struct irda_sock *new, *self =irda_sk (sk);struct sock *newsk; -struct sk_buff *skb; +struct sk_buff *skb =NULL ;int err; err =irda_create (sock_net (sk), newsock, sk->sk_protocol,0 );
@@ -907,7 +907,6 @@ static int irda_accept(struct socket *so err = -EPERM ;/* value does not seem to make sense. -arnd */ if (!new->tsap) {pr_debug ("%s(), dup failed!\n" , __func__); -kfree_skb (skb); goto out; }
@@ -926,7 +925,6 @@ static int irda_accept(struct socket *so/* Clean up the original one to keep it in listen state */ irttp_listen (self->tsap); -kfree_skb (skb); sk->sk_ack_backlog--; newsock->state =SS_CONNECTED ;
@@ -934,6 +932,7 @@ static int irda_accept(struct socket *soirda_connect_response (new); err =0 ; out: +kfree_skb (skb);release_sock (sk);return err; }
Greg Kroah-Hartman
maintainerPATCH 96/312 phy: fix device reference leaks
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 17ae1c650c1ecf8dc8e16d54b0f68a345965f43f upstream.
Make sure to drop the reference taken by bus_find_device_by_name() before returning from phy_connect() and phy_attach().
Note that both function still take a reference to the phy device through phy_attach_direct().
--- drivers/net/phy/phy_device.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/phy/phy_device.c +2 -0
@@ -522,6 +522,7 @@ struct phy_device *phy_connect(struct ne phydev =to_phy_device (d); rc =phy_connect_direct (dev, phydev, handler, interface); +put_device (d);if (rc)return ERR_PTR (rc);
@@ -721,6 +722,7 @@ struct phy_device *phy_attach(struct net phydev =to_phy_device (d); rc =phy_attach_direct (dev, phydev, phydev->dev_flags, interface); +put_device (d);if (rc)return ERR_PTR (rc);
Greg Kroah-Hartman
maintainerPATCH 97/312 bonding: prevent out of bound accesses
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit f87fda00b6ed232a817c655b8d179b48bde8fdbe upstream.
ether_addr_equal_64bits() requires some care about its arguments, namely that 8 bytes might be read, even if last 2 byte values are not used.
KASan detected a violation with null_mac_addr and lacpdu_mcast_addr in bond_3ad.c
Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c :
Although the 8-byte alignment was there, KASan would detect out of bound accesses.
--- drivers/net/bonding/bond_3ad.c | 11 +++++++---- drivers/net/bonding/bond_alb.c | 7 ++----- include/net/bonding.h | 7 ++++++- 3 files changed, 15 insertions(+), 10 deletions(-)
drivers/net/bonding/bond_3ad.c +7 -4
@@ -100,11 +100,14 @@ enum ad_link_speed_type {#define MAC_ADDRESS_EQUAL (A ,B ) \ ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) -static struct mac_addr null_mac_addr = { {0 ,0 ,0 ,0 ,0 ,0 } }; +static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = { +0 ,0 ,0 ,0 ,0 ,0 +};static u16 ad_ticks_per_sec;static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL *HZ ) /1000 ; -static const u8 lacpdu_mcast_addr[ETH_ALEN ] =MULTICAST_LACPDU_ADDR ; +static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned = +MULTICAST_LACPDU_ADDR ;/* ================= main 802.3ad protocol functions ================== */ static int ad_lacpdu_send (struct port *port);
@@ -1701,7 +1704,7 @@ static void ad_clear_agg(struct aggregat aggregator->is_individual = false; aggregator->actor_admin_aggregator_key =0 ; aggregator->actor_oper_aggregator_key =0 ; - aggregator->partner_system = null_mac_addr; +eth_zero_addr (aggregator->partner_system.mac_addr_value); aggregator->partner_system_priority =0 ; aggregator->partner_oper_aggregator_key =0 ; aggregator->receive_state =0 ;
@@ -1723,7 +1726,7 @@ static void ad_initialize_agg(struct aggif (aggregator) {ad_clear_agg (aggregator); - aggregator->aggregator_mac_address = null_mac_addr; +eth_zero_addr (aggregator->aggregator_mac_address.mac_addr_value); aggregator->aggregator_identifier =0 ; aggregator->slave =NULL ; }
drivers/net/bonding/bond_alb.c +2 -5
@@ -42,13 +42,10 @@ -#ifndef __long_aligned -#define __long_aligned __attribute__((aligned((sizeof(long))))) -#endif -static const u8 mac_bcast[ETH_ALEN] __long_aligned = { +static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = {0xff ,0xff ,0xff ,0xff ,0xff ,0xff }; -static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = { +static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = {0x33 ,0x33 ,0x00 ,0x00 ,0x00 ,0x01 };static const int alb_delta_in_ticks =HZ /ALB_TIMER_TICKS_PER_SEC ;
include/net/bonding.h +6 -1
@@ -34,6 +34,9 @@#define BOND_DEFAULT_MIIMON 100 +#ifndef __long_aligned +#define __long_aligned __attribute__((aligned((sizeof(long))))) +#endif /* * Less bad way to call ioctl from within the kernel; this needs to be * done some other way to get the call out of interrupt context.
@@ -138,7 +141,9 @@ struct bond_params {struct reciprocal_value reciprocal_packets_per_slave;u16 ad_actor_sys_prio;u16 ad_user_port_key; -u8 ad_actor_system[ETH_ALEN ]; + +/* 2 bytes of padding : see ether_addr_equal_64bits() */ +u8 ad_actor_system[ETH_ALEN +2 ]; };struct bond_parm_tbl {
Greg Kroah-Hartman
maintainerPATCH 98/312 mtd: nand: fix ONFI parameter page layout
In reply to Greg Kroah-HartmanFrom: Boris Brezillon <[email protected]>
commit de64aa9ec129ba627634088f662a4d09e356ddb6 upstream.
src_ssync_features field is only 1 byte large, and the 4th reserved area is actually 8 bytes large.
--- include/linux/mtd/nand.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/mtd/nand.h +2 -2
@@ -276,7 +276,7 @@ struct nand_onfi_params {__le16 t_r;__le16 t_ccs;__le16 src_sync_timing_mode; -__le16 src_ssync_features; +u8 src_ssync_features;__le16 clk_pin_capacitance_typ;__le16 io_pin_capacitance_typ;__le16 input_pin_capacitance_typ;
@@ -284,7 +284,7 @@ struct nand_onfi_params {u8 driver_strength_support;__le16 t_int_r;__le16 t_ald; -u8 reserved4[7 ]; +u8 reserved4[8 ];/* vendor */ __le16 vendor_revision;
Greg Kroah-Hartman
maintainerPATCH 99/312 ath10k: free cached fw bin contents when get board id fails
In reply to Greg Kroah-HartmanFrom: Raja Mani <[email protected]>
commit b9c191be3fbdd9d78be11160dd7a3ddb9fdc6d42 upstream.
ath10k_core_probe_fw() simply returns error without freeing cached firmware file content when get board id operation fails. Free cached fw bin data in failure case to avoid memory leak.
--- drivers/net/wireless/ath/ath10k/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/core.c +1 -1
@@ -1805,7 +1805,7 @@ static int ath10k_core_probe_fw(struct aif (ret && ret != -EOPNOTSUPP ) {ath10k_err (ar,"failed to get board id from otp for qca99x0: %d\n" , ret); -return ret; + goto err_free_firmware_files; } ret =ath10k_core_fetch_board_file (ar);
Greg Kroah-Hartman
maintainerPATCH 100/312 xprtrdma: checking for NULL instead of IS_ERR()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit abfb689711aaebd14d893236c6ea4bcdfb61e74c upstream.
The rpcrdma_create_req() function returns error pointers or success. It never returns NULL.
--- net/sunrpc/xprtrdma/backchannel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sunrpc/xprtrdma/backchannel.c +2 -2
@@ -42,8 +42,8 @@ static int rpcrdma_bc_setup_rqst(structsize_t size; req =rpcrdma_create_req (r_xprt); -if (!req) -return -ENOMEM ; +if (IS_ERR (req)) +return PTR_ERR (req); req->rl_backchannel = true; size =RPCRDMA_INLINE_WRITE_THRESHOLD (rqst);
Greg Kroah-Hartman
maintainerPATCH 101/312 xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock)
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit 9b06688bc3b9f13f8de90f832c455fddec3d4e8a upstream.
Clean up.
rb_lock critical sections added in rpcrdma_ep_post_extra_recv() should have first been converted to use normal spin_lock now that the reply handler is a work queue.
The backchannel set up code should use the appropriate helper instead of open-coding a rb_recv_bufs list add.
Problem introduced by glib patch re-ordering on my part.
--- net/sunrpc/xprtrdma/backchannel.c | 6 +----- net/sunrpc/xprtrdma/verbs.c | 7 +++---- 2 files changed, 4 insertions(+), 9 deletions(-)
net/sunrpc/xprtrdma/backchannel.c +1 -5
@@ -84,9 +84,7 @@ out_fail:static int rpcrdma_bc_setup_reps (struct rpcrdma_xprt *r_xprt,unsigned int count) { -struct rpcrdma_buffer *buffers = &r_xprt->rx_buf;struct rpcrdma_rep *rep; -unsigned long flags;int rc =0 ;while (count--) {
@@ -98,9 +96,7 @@ static int rpcrdma_bc_setup_reps(structbreak ; } -spin_lock_irqsave (&buffers->rb_lock, flags); -list_add (&rep->rr_list, &buffers->rb_recv_bufs); -spin_unlock_irqrestore (&buffers->rb_lock, flags); +rpcrdma_recv_buffer_put (rep); }return rc;
net/sunrpc/xprtrdma/verbs.c +3 -4
@@ -1337,15 +1337,14 @@ rpcrdma_ep_post_extra_recv(struct rpcrdmstruct rpcrdma_ia *ia = &r_xprt->rx_ia;struct rpcrdma_ep *ep = &r_xprt->rx_ep;struct rpcrdma_rep *rep; -unsigned long flags;int rc;while (count--) { -spin_lock_irqsave (&buffers->rb_lock, flags); +spin_lock (&buffers->rb_lock);if (list_empty (&buffers->rb_recv_bufs)) goto out_reqbuf; rep =rpcrdma_buffer_get_rep_locked (buffers); -spin_unlock_irqrestore (&buffers->rb_lock, flags); +spin_unlock (&buffers->rb_lock); rc =rpcrdma_ep_post_recv (ia, ep, rep);if (rc)
@@ -1355,7 +1354,7 @@ rpcrdma_ep_post_extra_recv(struct rpcrdmreturn 0 ; out_reqbuf: -spin_unlock_irqrestore (&buffers->rb_lock, flags); +spin_unlock (&buffers->rb_lock);pr_warn ("%s: no extra receive buffers\n" , __func__);return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 102/312 xprtrdma: xprt_rdma_free() must not release backchannel reqs
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit ffc4d9b1596c34caa98962722e930e97912c8a9f upstream.
Preserve any rpcrdma_req that is attached to rpc_rqst's allocated for the backchannel. Otherwise, after all the pre-allocated backchannel req's are consumed, incoming backward calls start writing on freed memory.
Somehow this hunk got lost.
--- net/sunrpc/xprtrdma/transport.c | 3 +++ 1 file changed, 3 insertions(+)
net/sunrpc/xprtrdma/transport.c +3 -0
@@ -576,6 +576,9 @@ xprt_rdma_free(void *buffer) rb = container_of(buffer, struct rpcrdma_regbuf, rg_base[0]); req = rb->rg_owner; +if (req->rl_backchannel) +return ; + r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);dprintk ("RPC: %s: called on 0x%p\n" , __func__, req->rl_reply);
Greg Kroah-Hartman
maintainerPATCH 103/312 xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit 9f74660bcf1e4cca577be99e54bc77b5df62b508 upstream.
Some NFSv4.1 OPEN requests were hanging waiting for the NFS server to finish recalling delegations. Turns out that each NFSv4.1 CB request on RDMA gets a GARBAGE_ARGS reply from the Linux client.
Commit 756b9b37cfb2e3dc added a line in bc_svc_process that overwrites the incoming rq_rcv_buf's length with the value in rq_private_buf.len. But rpcrdma_bc_receive_call() does not invoke xprt_complete_bc_request(), thus rq_private_buf.len is not initialized. svc_process_common() is invoked with a zero-length RPC message, and fails.
--- net/sunrpc/xprtrdma/backchannel.c | 2 ++ 1 file changed, 2 insertions(+)
net/sunrpc/xprtrdma/backchannel.c +2 -0
@@ -337,6 +337,8 @@ void rpcrdma_bc_receive_call(struct rpcr rqst->rq_reply_bytes_recvd =0 ; rqst->rq_bytes_sent =0 ; rqst->rq_xid = headerp->rm_xid; + + rqst->rq_private_buf.len = size;set_bit (RPC_BC_PA_IN_USE , &rqst->rq_bc_pa_state); buf = &rqst->rq_rcv_buf;
Greg Kroah-Hartman
maintainerPATCH 104/312 RDMA/cxgb3: device driver frees DMA memory with different size
In reply to Greg Kroah-HartmanFrom: Honggang Li <[email protected]>
commit 0de4cbb3dddca35ecd06b95918f38439c9c6401f upstream.
[ 598.852037] ------------[ cut here ]------------ [ 598.856698] WARNING: at lib/dma-debug.c:887 check_unmap+0xf8/0x920() [ 598.863079] cxgb3 0000:01:00.0: DMA-API: device driver frees DMA memory with different size [device address=0x0000000003310000] [map size=17 bytes] [unmap size=16 bytes] [ 598.878265] Modules linked in: xprtrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_sa ib_mad kvm_amd kvm ipmi_devintf ipmi_ssif dcdbas pcspkr ipmi_si sg ipmi_msghandler acpi_power_meter amd64_edac_mod shpchp edac_core sp5100_tco k10temp edac_mce_amd i2c_piix4 acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_common ata_generic iw_cxgb3 pata_acpi ib_core ib_addr mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm pata_atiixp drm ahci libahci serio_raw i2c_core cxgb3 libata bnx2 mdio dm_mirror dm_region_hash dm_log dm_mod [ 598.946822] CPU: 3 PID: 11820 Comm: cmtime Not tainted 3.10.0-327.el7.x86_64.debug #1 [ 598.954681] Hardware name: Dell Inc. PowerEdge R415/0GXH08, BIOS 2.0.2 10/22/2012 [ 598.962193] ffff8808077479a8 000000000381a432 ffff880807747960 ffffffff81700918 [ 598.969663] ffff880807747998 ffffffff8108b6c0 ffff880807747a80 ffff8808063f55c0 [ 598.977132] ffffffff833ca850 0000000000000282 ffff88080b1bb800 ffff880807747a00 [ 598.984602] Call Trace: [ 598.987062] [<ffffffff81700918>] dump_stack+0x19/0x1b [ 598.992224] [<ffffffff8108b6c0>] warn_slowpath_common+0x70/0xb0 [ 598.998254] [<ffffffff8108b75c>] warn_slowpath_fmt+0x5c/0x80 [ 599.004033] [<ffffffff813903b8>] check_unmap+0xf8/0x920 [ 599.009369] [<ffffffff81025959>] ? sched_clock+0x9/0x10 [ 599.014702] [<ffffffff81390cee>] debug_dma_free_coherent+0x7e/0xa0 [ 599.021008] [<ffffffffa01ece2c>] cxio_destroy_cq+0xcc/0x160 [iw_cxgb3] [ 599.027654] [<ffffffffa01e8da0>] iwch_destroy_cq+0xf0/0x140 [iw_cxgb3] [ 599.034307] [<ffffffffa01c4bfe>] ib_destroy_cq+0x1e/0x30 [ib_core] [ 599.040601] [<ffffffffa04ff2d2>] ib_uverbs_close+0x302/0x4d0 [ib_uverbs] [ 599.047417] [<ffffffff812335a2>] __fput+0x102/0x310 [ 599.052401] [<ffffffff8123388e>] ____fput+0xe/0x10 [ 599.057297] [<ffffffff810bbde4>] task_work_run+0xb4/0xe0 [ 599.062719] [<ffffffff81092a84>] do_exit+0x304/0xc60 [ 599.067789] [<ffffffff81025905>] ? native_sched_clock+0x35/0x80 [ 599.073820] [<ffffffff81025959>] ? sched_clock+0x9/0x10 [ 599.079153] [<ffffffff8170a49c>] ? _raw_spin_unlock_irq+0x2c/0x50 [ 599.085358] [<ffffffff8109346c>] do_group_exit+0x4c/0xc0 [ 599.090779] [<ffffffff810a8661>] get_signal_to_deliver+0x2e1/0x960 [ 599.097071] [<ffffffff8101c497>] do_signal+0x57/0x6e0 [ 599.102229] [<ffffffff81714bd1>] ? sysret_signal+0x5/0x4e [ 599.107738] [<ffffffff8101cb7f>] do_notify_resume+0x5f/0xb0 [ 599.113418] [<ffffffff81714e7d>] int_signal+0x12/0x17 [ 599.118576] ---[ end trace 1e4653102e7e7019 ]--- [ 599.123211] Mapped at: [ 599.125577] [<ffffffff8138ed8b>] debug_dma_alloc_coherent+0x2b/0x80 [ 599.131968] [<ffffffffa01ec862>] cxio_create_cq+0xf2/0x1f0 [iw_cxgb3] [ 599.139920] [<ffffffffa01e9c05>] iwch_create_cq+0x105/0x4e0 [iw_cxgb3] [ 599.147895] [<ffffffffa0500584>] create_cq.constprop.14+0x184/0x2e0 [ib_uverbs] [ 599.156649] [<ffffffffa05027fb>] ib_uverbs_create_cq+0x10b/0x140 [ib_uverbs]
--- drivers/infiniband/hw/cxgb3/cxio_hal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/cxgb3/cxio_hal.c +1 -1
@@ -327,7 +327,7 @@ int cxio_destroy_cq(struct cxio_rdev *rdkfree (cq->sw_queue);dma_free_coherent (&(rdev_p->rnic_info.pdev->dev), (1UL << (cq->size_log2)) - *sizeof (struct t3_cqe ), cq->queue, + *sizeof (struct t3_cqe ) +1 , cq->queue,dma_unmap_addr (cq, mapping));cxio_hal_put_cqid (rdev_p->rscp, cq->cqid);return err;
Greg Kroah-Hartman
maintainerPATCH 105/312 mlxsw: spectrum: Dont forward packets when STP state is DISABLED
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 9cb026ebb8ab76829a8d8e4bbd057168ac38fb86 upstream.
When STP state is set to DISABLED the port is assumed to be inactive, but currently we forward packets ingressing through it.
Instead, set the port's STP state in hardware to DISCARDING, which means it doesn't forward packets or perform any learning, but it does trap control packets. However, these packets will be dropped by bridge code, which results in the expected behavior.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +1 -1
@@ -87,7 +87,6 @@ static int mlxsw_sp_port_stp_state_set(sint err;switch (state) { -case BR_STATE_DISABLED :/* fall-through */ case BR_STATE_FORWARDING : spms_state =MLXSW_REG_SPMS_STATE_FORWARDING ;break ;
@@ -95,6 +94,7 @@ static int mlxsw_sp_port_stp_state_set(scase BR_STATE_LEARNING : spms_state =MLXSW_REG_SPMS_STATE_LEARNING ;break ; +case BR_STATE_DISABLED :/* fall-through */ case BR_STATE_BLOCKING : spms_state =MLXSW_REG_SPMS_STATE_DISCARDING ;break ;
Greg Kroah-Hartman
maintainerPATCH 106/312 mlxsw: spectrum: Disable learning according to STP state
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 454911333b1d86e1d58a557be271bc6b7e9e7f10 upstream.
When port is put into LISTENING state it shouldn't populate the FDB, so set the port's STP state in hardware to DISCARDING instead of LEARNING. It will therefore keep listening to BPDU packets, but discard other non-control packets and won't perform any learning.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +1 -1
@@ -90,10 +90,10 @@ static int mlxsw_sp_port_stp_state_set(scase BR_STATE_FORWARDING : spms_state =MLXSW_REG_SPMS_STATE_FORWARDING ;break ; -case BR_STATE_LISTENING :/* fall-through */ case BR_STATE_LEARNING : spms_state =MLXSW_REG_SPMS_STATE_LEARNING ;break ; +case BR_STATE_LISTENING :/* fall-through */ case BR_STATE_DISABLED :/* fall-through */ case BR_STATE_BLOCKING : spms_state =MLXSW_REG_SPMS_STATE_DISCARDING ;
Greg Kroah-Hartman
maintainerPATCH 107/312 mlxsw: spectrum: Dont count internal TX header bytes to stats
In reply to Greg Kroah-HartmanFrom: Nogah Frankel <[email protected]>
commit 63dcdd35c1552ca0c911e98ba3389a0729a457f4 upstream.
Stop the SW TX counter from counting the TX header bytes since they are not being sent out.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +5 -1
@@ -399,7 +399,11 @@ static netdev_tx_t mlxsw_sp_port_xmit(st }mlxsw_sp_txhdr_construct (skb, &tx_info); - len = skb->len; +/* TX header is consumed by HW on the way so we shouldn't count its +* bytes as being sent. +*/ + len = skb->len -MLXSW_TXHDR_LEN ; +/* Due to a race we might fail here because of a full queue. In that * unlikely case we simply drop the packet. */
Greg Kroah-Hartman
maintainerPATCH 108/312 mlxsw: spectrum: Indicate support for autonegotiation
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit c3f1576810affced47684e04a08c1ffa845144c9 upstream.
The device supports link autonegotiation, so let the user know about it by indicating support via ethtool ops.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +2 -1
@@ -1104,7 +1104,8 @@ static int mlxsw_sp_port_get_settings(st cmd->supported =mlxsw_sp_from_ptys_supported_port (eth_proto_cap) |mlxsw_sp_from_ptys_supported_link (eth_proto_cap) | - SUPPORTED_Pause | SUPPORTED_Asym_Pause; + SUPPORTED_Pause | SUPPORTED_Asym_Pause | + SUPPORTED_Autoneg; cmd->advertising =mlxsw_sp_from_ptys_advert_link (eth_proto_admin);mlxsw_sp_from_ptys_speed_duplex (netif_carrier_ok (dev), eth_proto_oper, cmd);
Greg Kroah-Hartman
maintainerPATCH 109/312 mlxsw: spectrum: Fix misuse of hard_header_len
In reply to Greg Kroah-HartmanFrom: Yotam Gigi <[email protected]>
commit feb7d387a6cf6c1ec66d4a2b6d4b2cc52309876e upstream.
In order to specify that the mlxsw spectrum driver needs additional headroom for packets, there have been use of the hard_header_len field of the netdevice struct.
This commit changes that to use needed_headroom instead, as this is the correct way to do that.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +1 -1
@@ -1261,7 +1261,7 @@ static int mlxsw_sp_port_create(struct m/* Each packet needs to have a Tx header (metadata) on top all other * headers. */ - dev->hard_header_len +=MLXSW_TXHDR_LEN ; + dev->needed_headroom =MLXSW_TXHDR_LEN ; err =mlxsw_sp_port_module_check (mlxsw_sp_port, &usable);if (err) {
Greg Kroah-Hartman
maintainerPATCH 110/312 net: tcp_memcontrol: properly detect ancestor socket pressure
In reply to Greg Kroah-HartmanFrom: Johannes Weiner <[email protected]>
commit 8c2c2358b236530bc2c79b4c2a447cbdbc3d96d7 upstream.
When charging socket memory, the code currently checks only the local page counter for excess to determine whether the memcg is under socket pressure. But even if the local counter is fine, one of the ancestors could have breached its limit, which should also force this child to enter socket pressure. This currently doesn't happen.
Fix this by using page_counter_try_charge() first. If that fails, it means that either the local counter or one of the ancestors are in excess of their limit, and the child should enter socket pressure.
--- include/net/sock.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
include/net/sock.h +6 -4
@@ -1204,11 +1204,13 @@ static inline void memcg_memory_allocateunsigned long amt, int *parent_status) { - page_counter_charge(&prot->memory_allocated, amt); + struct page_counter *counter; + +if (page_counter_try_charge (&prot->memory_allocated, amt, &counter)) +return ; -if (page_counter_read (&prot->memory_allocated) > - prot->memory_allocated.limit) - *parent_status =OVER_LIMIT ; +page_counter_charge (&prot->memory_allocated, amt); + *parent_status =OVER_LIMIT ; } static inline void memcg_memory_allocated_sub(struct cg_proto *prot,
Greg Kroah-Hartman
maintainerPATCH 111/312 tcp: do not set rtt_min to 1
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 372022830b06d9980c7e8b41fa0a4081cff883b0 upstream.
There are some cases where rtt_us derives from deltas of jiffies, instead of using usec timestamps.
Since we want to track minimal rtt, better to assume a delta of 0 jiffie might be in fact be very close to 1 jiffie.
It is kind of sad jiffies_to_usecs(1) calls a function instead of simply using a constant.
--- net/ipv4/tcp_input.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/ipv4/tcp_input.c +4 -1
@@ -2926,7 +2926,10 @@ static void tcp_update_rtt_min(struct so {const u32 now = tcp_time_stamp, wlen = sysctl_tcp_min_rtt_wlen *HZ ;struct rtt_meas *m =tcp_sk (sk)->rtt_min; -struct rtt_meas rttm = { .rtt = (rtt_us ? :1 ), .ts = now }; +struct rtt_meas rttm = { + .rtt =likely (rtt_us) ? rtt_us :jiffies_to_usecs (1 ), + .ts = now, + };u32 elapsed;/* Check if the new measurement updates the 1st, 2nd, or 3rd choices */
Greg Kroah-Hartman
maintainerPATCH 112/312 RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock
In reply to Greg Kroah-HartmanFrom: Sowmini Varadhan <[email protected]>
commit eb192840266fab3e3da644018121eed30153355d upstream.
There is a race condition between rds_send_xmit -> rds_tcp_xmit and the code that deals with resolution of duelling syns added by commit 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an outgoing socket in rds_tcp_accept_one()").
Specifically, we may end up derefencing a null pointer in rds_send_xmit if we have the interleaving sequence:
rds_tcp_accept_one rds_send_xmit
conn is RDS_CONN_UP, so
invoke rds_tcp_xmit
tc = conn->c_transport_data
rds_tcp_restore_callbacks
/* reset t_sock */
null ptr deref from tc->t_sockThe race condition can be avoided without adding the overhead of additional locking in the xmit path: have rds_tcp_accept_one wait for rds_tcp_xmit threads to complete before resetting callbacks. The synchronization can be done in the same manner as rds_conn_shutdown(). First set the rds_conn_state to something other than RDS_CONN_UP (so that new threads cannot get into rds_tcp_xmit()), then wait for RDS_IN_XMIT to be cleared in the conn->c_flags indicating that any threads in rds_tcp_xmit are done.
outgoing socket in rds_tcp_accept_one()")
--- net/rds/tcp.c | 2 +- net/rds/tcp_listen.c | 38 +++++++++++++++++++++++--------------- 2 files changed, 24 insertions(+), 16 deletions(-)
net/rds/tcp.c +1 -1
@@ -110,7 +110,7 @@ void rds_tcp_restore_callbacks(struct so/* * This is the only path that sets tc->t_sock. Send and receive trust that -* it is set. The RDS_CONN_CONNECTED bit protects those paths from being +* it is set. The RDS_CONN_UP bit protects those paths from being * called while it isn't set. */ void rds_tcp_set_callbacks (struct socket *sock,struct rds_connection *conn)
net/rds/tcp_listen.c +23 -15
@@ -115,24 +115,32 @@ int rds_tcp_accept_one(struct socket *so* rds_tcp_state_change() will do that cleanup */ rs_tcp = (struct rds_tcp_connection *)conn->c_transport_data; -if (rs_tcp->t_sock && -ntohl (inet->inet_saddr) <ntohl (inet->inet_daddr)) { -struct sock *nsk = new_sock->sk; +rds_conn_transition (conn,RDS_CONN_DOWN ,RDS_CONN_CONNECTING ); +if (rs_tcp->t_sock) { +/* Need to resolve a duelling SYN between peers. +* We have an outstanding SYN to this peer, which may +* potentially have transitioned to the RDS_CONN_UP state, +* so we must quiesce any send threads before resetting +* c_transport_data. +*/ +wait_event (conn->c_waitq, + !test_bit (RDS_IN_XMIT , &conn->c_flags)); +if (ntohl (inet->inet_saddr) <ntohl (inet->inet_daddr)) { +struct sock *nsk = new_sock->sk; - nsk->sk_user_data =NULL ; - nsk->sk_prot->disconnect (nsk,0 ); -tcp_done (nsk); - new_sock =NULL ; - ret =0 ; - goto out; - }else if (rs_tcp->t_sock) { -rds_tcp_restore_callbacks (rs_tcp->t_sock, rs_tcp); - conn->c_outgoing =0 ; + nsk->sk_user_data =NULL ; + nsk->sk_prot->disconnect (nsk,0 ); +tcp_done (nsk); + new_sock =NULL ; + ret =0 ; + goto out; + }else if (rs_tcp->t_sock) { +rds_tcp_restore_callbacks (rs_tcp->t_sock, rs_tcp); + conn->c_outgoing =0 ; + } } - -rds_conn_transition (conn,RDS_CONN_DOWN ,RDS_CONN_CONNECTING );rds_tcp_set_callbacks (new_sock, conn); -rds_connect_complete (conn); +rds_connect_complete (conn);/* marks RDS_CONN_UP */ new_sock =NULL ; ret =0 ;
Greg Kroah-Hartman
maintainerPATCH 113/312 net: ipv6: tcp reset, icmp need to consider L3 domain
In reply to Greg Kroah-HartmanFrom: David Ahern <[email protected]>
commit 1d2f7b2d956e242179aaf4a08f3545f99c81f9a3 upstream.
Responses for packets to unused ports are getting lost with L3 domains.
IPv4 has ip_send_unicast_reply for sending TCP responses which accounts for L3 domains; update the IPv6 counterpart tcp_v6_send_response. For icmp the L3 master check needs to be moved up in icmp6_send to properly respond to UDP packets to a port with no listener.
--- net/ipv6/icmp.c | 5 ++--- net/ipv6/tcp_ipv6.c | 7 ++++++- 2 files changed, 8 insertions(+), 4 deletions(-)
net/ipv6/icmp.c +2 -3
@@ -445,6 +445,8 @@ static void icmp6_send(struct sk_buff *sif (__ipv6_addr_needs_scope_id (addr_type)) iif = skb->dev->ifindex; +else + iif =l3mdev_master_ifindex (skb->dev);/* * Must not send error if the source does not uniquely
@@ -499,9 +501,6 @@ static void icmp6_send(struct sk_buff *selse if (!fl6.flowi6_oif) fl6.flowi6_oif = np->ucast_oif; -if (!fl6.flowi6_oif) - fl6.flowi6_oif =l3mdev_master_ifindex (skb->dev); - dst =icmpv6_route_lookup (net, skb, sk, &fl6);if (IS_ERR (dst)) goto out;
net/ipv6/tcp_ipv6.c +6 -1
@@ -815,8 +815,13 @@ static void tcp_v6_send_response(const s fl6.flowi6_proto =IPPROTO_TCP ;if (rt6_need_strict (&fl6.daddr) && !oif) fl6.flowi6_oif =tcp_v6_iif (skb); -else +else { +if (!oif &&netif_index_is_l3_master (net, skb->skb_iif)) + oif = skb->skb_iif; + fl6.flowi6_oif = oif; + } + fl6.flowi6_mark =IP6_REPLY_MARK (net, skb->mark); fl6.fl6_dport = t1->dest; fl6.fl6_sport = t1->source;
Greg Kroah-Hartman
maintainerPATCH 114/312 batman-adv: Fix lockdep annotation of batadv_tlv_container_remove
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 008a374487070a391c12aa39288fd8511f822cab upstream.
The function handles tlv containers and not tlv handlers. Thus the lockdep_assert_held has to check for the container_list lock.
--- net/batman-adv/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/main.c +1 -1
@@ -747,7 +747,7 @@ static u16 batadv_tvlv_container_list_sistatic void batadv_tvlv_container_remove (struct batadv_priv *bat_priv,struct batadv_tvlv_container *tvlv) { -lockdep_assert_held (&bat_priv->tvlv.handler_list_lock); +lockdep_assert_held (&bat_priv->tvlv.container_list_lock);if (!tvlv)return ;
Greg Kroah-Hartman
maintainerPATCH 115/312 batman-adv: replace WARN with rate limited output on non-existing VLAN
In reply to Greg Kroah-HartmanFrom: Simon Wunderlich <[email protected]>
commit 0b3dd7dfb81ad8af53791ea2bb64b83bac1b7d32 upstream.
If a VLAN tagged frame is received and the corresponding VLAN is not configured on the soft interface, it will splat a WARN on every packet received. This is a quite annoying behaviour for some scenarios, e.g. if bat0 is bridged with eth0, and there are arbitrary VLAN tagged frames from Ethernet coming in without having any VLAN configuration on bat0.
The code should probably create vlan objects on the fly and transparently transport these VLAN-tagged Ethernet frames, but until this is done, at least the WARN splat should be replaced by a rate limited output.
--- net/batman-adv/translation-table.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/batman-adv/translation-table.c +4 -2
@@ -614,8 +614,10 @@ bool batadv_tt_local_add(struct net_devi/* increase the refcounter of the related vlan */ vlan =batadv_softif_vlan_get (bat_priv, vid); -if (WARN (!vlan,"adding TT local entry %pM to non-existent VLAN %d" , - addr,BATADV_PRINT_VID (vid))) { +if (!vlan) { +net_ratelimited_function (batadv_info, soft_iface, +"adding TT local entry %pM to non-existent VLAN %d\n" , + addr,BATADV_PRINT_VID (vid));kfree (tt_local); tt_local =NULL ; goto out;
Greg Kroah-Hartman
maintainerPATCH 116/312 tty: serial: msm: Support more bauds
In reply to Greg Kroah-HartmanFrom: Stephen Boyd <[email protected]>
commit 98952bf510d0c7cdfc284f098bbf4682dc47bc61 upstream.
The msm_find_best_baud() function is written with the assumption that the port->uartclk rate is fixed to a particular rate at boot time, but now this driver changes that clk rate at runtime when the baud is changed.
The way the hardware works is that an input clk rate comes from the clk controller into the uart hw block. That rate is typically 1843200 or 3686400 Hz. That rate can then be divided by an internal divider in the hw block to achieve a particular baud on the serial wire. msm_find_best_baud() is looking for that divider value.
A few things are wrong with the way the code is written. First, it assumes that the maximum baud that the uart can support if the clk rate is fixed at boot is 460800, which would correspond to an input clk rate of 230400 * 16 == 3686400 Hz. Except some devices have a boot rate of 1843200 Hz or max baud of 115200, so achieving 230400 on those devices doesn't work at all because we don't increase the clk rate unless max baud is 460800.
Second, we can't achieve bauds higher than 460800 that require anything besides a divisor of 1, because we always call msm_find_best_baud() with a fixed port->uartclk rate that will eventually be changed after we calculate the divisor. So if we need to get a baud of 500000, we'll just multiply that by 16 and hope that the clk can give us 500000 * 16 == 8000000 Hz, which it typically can't do. To really achieve 500000 baud, we need to get an input clk rate of 24000000 Hz and then divide that by 3 inside the uart hardware.
Finally, we return success for bauds even when we can't actually achieve them. This means that when the user asks for 500000 baud, we actually get 921600 right now, but the user doesn't know that.
Fix all of this by searching through the divisor and clk rate space with a combination of clk_round_rate() and baud calculations, keeping track of the best clk rate and divisor we find if we can't get an exact match. Typically we can get an exact match with a divisor of 1, but sometimes we need to keep track and try more frequencies. On my msm8916 device, this results in all standard bauds in baud_table being supported except for 1800, 576000, 1152000, and 4000000.
--- drivers/tty/serial/msm_serial.c | 101 ++++++++++++++++++++++++++-------------- 1 file changed, 67 insertions(+), 34 deletions(-)
drivers/tty/serial/msm_serial.c +67 -34
@@ -872,37 +872,72 @@ struct msm_baud_map { };static const struct msm_baud_map * -msm_find_best_baud (struct uart_port *port,unsigned int baud) +msm_find_best_baud (struct uart_port *port,unsigned int baud, +unsigned long *rate) { -unsigned int i, divisor; -const struct msm_baud_map *entry; +struct msm_port *msm_port =UART_TO_MSM (port); +unsigned int divisor, result; +unsigned long target, old, best_rate =0 , diff, best_diff =ULONG_MAX ; +const struct msm_baud_map *entry, *end, *best;static const struct msm_baud_map table[] = { - {1536 ,0x00 ,1 }, - {768 ,0x11 ,1 }, - {384 ,0x22 ,1 }, - {192 ,0x33 ,1 }, - {96 ,0x44 ,1 }, - {48 ,0x55 ,1 }, - {32 ,0x66 ,1 }, - {24 ,0x77 ,1 }, - {16 ,0x88 ,1 }, - {12 ,0x99 ,6 }, - {8 ,0xaa ,6 }, - {6 ,0xbb ,6 }, - {4 ,0xcc ,6 }, - {3 ,0xdd ,8 }, - {2 ,0xee ,16 }, {1 ,0xff ,31 }, - {0 ,0xff ,31 }, + {2 ,0xee ,16 }, + {3 ,0xdd ,8 }, + {4 ,0xcc ,6 }, + {6 ,0xbb ,6 }, + {8 ,0xaa ,6 }, + {12 ,0x99 ,6 }, + {16 ,0x88 ,1 }, + {24 ,0x77 ,1 }, + {32 ,0x66 ,1 }, + {48 ,0x55 ,1 }, + {96 ,0x44 ,1 }, + {192 ,0x33 ,1 }, + {384 ,0x22 ,1 }, + {768 ,0x11 ,1 }, + {1536 ,0x00 ,1 }, }; - divisor =uart_get_divisor (port, baud); - -for (i =0 , entry = table; i <ARRAY_SIZE (table); i++, entry++) -if (entry->divisor <= divisor) -break ; + best = table;/* Default to smallest divider */ + target =clk_round_rate (msm_port->clk,16 * baud); + divisor =DIV_ROUND_CLOSEST (target,16 * baud); + + end = table +ARRAY_SIZE (table); + entry = table; +while (entry < end) { +if (entry->divisor <= divisor) { + result = target / entry->divisor /16 ; + diff =abs (result - baud); + +/* Keep track of best entry */ +if (diff < best_diff) { + best_diff = diff; + best = entry; + best_rate = target; + } + +if (result == baud) +break ; + }else if (entry->divisor > divisor) { + old = target; + target =clk_round_rate (msm_port->clk, old +1 ); +/* +* The rate didn't get any faster so we can't do +* better at dividing it down +*/ +if (target == old) +break ; + +/* Start the divisor search over at this new rate */ + entry = table; + divisor =DIV_ROUND_CLOSEST (target,16 * baud); +continue ; + } + entry++; + } -return entry;/* Default to smallest divider */ + *rate = best_rate; +return best; } static int msm_set_baud_rate(struct uart_port *port, unsigned int baud,
@@ -911,22 +946,20 @@ static int msm_set_baud_rate(struct uartunsigned int rxstale, watermark, mask;struct msm_port *msm_port =UART_TO_MSM (port);const struct msm_baud_map *entry; -unsigned long flags; - - entry =msm_find_best_baud (port, baud); - -msm_write (port, entry->code,UART_CSR ); - -if (baud >460800 ) - port->uartclk = baud *16 ; +unsigned long flags, rate; flags = *saved_flags;spin_unlock_irqrestore (&port->lock, flags); -clk_set_rate (msm_port->clk, port->uartclk); + entry =msm_find_best_baud (port, baud, &rate); +clk_set_rate (msm_port->clk, rate); + baud = rate /16 / entry->divisor;spin_lock_irqsave (&port->lock, flags); *saved_flags = flags; + port->uartclk = rate; + +msm_write (port, entry->code,UART_CSR );/* RX stale watermark */ rxstale = entry->rxstale;
Greg Kroah-Hartman
maintainerPATCH 117/312 serial: samsung: Fix possible out of bounds access on non-DT platform
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 926b7b5122c96e1f18cd20e85a286c7ec8d18c97 upstream.
On non-DeviceTree platforms, the index of serial device is a static variable incremented on each probe. It is incremented even if deferred probe happens when getting the clock in s3c24xx_serial_init_port().
This index is used for referencing elements of statically allocated s3c24xx_serial_ports array. In case of re-probe, the index will point outside of this array leading to memory corruption.
Increment the index only on successful probe.
--- drivers/tty/serial/samsung.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/samsung.c +2 -2
@@ -1841,8 +1841,6 @@ static int s3c24xx_serial_probe(struct p ourport->min_dma_size =max_t (int, ourport->port.fifosize,dma_get_cache_alignment ()); - probe_index++; -dbg ("%s: initialising port %p...\n" , __func__, ourport); ret =s3c24xx_serial_init_port (ourport, pdev);
@@ -1872,6 +1870,8 @@ static int s3c24xx_serial_probe(struct pif (ret <0 )dev_err (&pdev->dev,"failed to add cpufreq notifier\n" ); + probe_index++; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 118/312 Drivers: hv: utils: use memdup_user in hvt_op_write
In reply to Greg Kroah-HartmanFrom: Olaf Hering <[email protected]>
commit b00359642c2427da89dc8f77daa2c9e8a84e6d76 upstream.
Use memdup_user to handle OOM.
--- drivers/hv/hv_utils_transport.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/hv/hv_utils_transport.c +4 -5
@@ -80,11 +80,10 @@ static ssize_t hvt_op_write(struct file hvt = container_of(file->f_op, struct hvutil_transport, fops); - inmsg =kzalloc (count,GFP_KERNEL ); -if (copy_from_user (inmsg, buf, count)) { -kfree (inmsg); -return -EFAULT ; - } + inmsg =memdup_user (buf, count); +if (IS_ERR (inmsg)) +return PTR_ERR (inmsg); +if (hvt->on_msg (inmsg, count))return -EFAULT ;kfree (inmsg);
Greg Kroah-Hartman
maintainerPATCH 119/312 isa: Call isa_bus_init before dependent ISA bus drivers register
In reply to Greg Kroah-HartmanFrom: William Breathitt Gray <[email protected]>
commit 32a5a0c047343b11f581f663a2309cf43d13466f upstream.
The isa_bus_init function must be called before drivers which utilize the ISA bus driver are registered. A race condition for initilization exists if device_initcall is used (the isa_bus_init callback is placed in the same initcall level as dependent drivers which use module_init). This patch ensures that isa_bus_init is called first by utilizing postcore_initcall in favor of device_initcall.
--- drivers/base/isa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/isa.c +1 -1
@@ -180,4 +180,4 @@ static int __init isa_bus_init(void)return error; } -device_initcall (isa_bus_init); +postcore_initcall (isa_bus_init);
Greg Kroah-Hartman
maintainerPATCH 120/312 Btrfs: clean up an error code in btrfs_init_space_info()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 0dc924c5f2a3c4d999e12feaccee5f970cea1315 upstream.
If we return 1 here, then the caller treats it as an error and returns -EINVAL. It causes a static checker warning to treat positive returns as an error.
--- fs/btrfs/extent-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/extent-tree.c +1 -1
@@ -10688,7 +10688,7 @@ int btrfs_init_space_info(struct btrfs_f disk_super = fs_info->super_copy;if (!btrfs_super_root (disk_super)) -return 1 ; +return -EINVAL ; features =btrfs_super_incompat_flags (disk_super);if (features &BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS )
Greg Kroah-Hartman
maintainerPATCH 121/312 Input: gpio-keys - fix check for disabling unsupported keys
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
commit 8679ee4204cfd5cf78b996508ccadc1ec6130f1a upstream.
Commit 4ea14a53d8f881034fa9e186653821c4e3d9a8fb ("Input: gpio-keys - report error when disabling unsupported key") tried let user know that they attempted to disable an unsupported key, unfortunately the check is wrong as it believes that all codes are invalid. Fix it by ensuring that keys that we try to disable are subset of keys (or switches) that device reports.
--- drivers/input/keyboard/gpio_keys.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-)
drivers/input/keyboard/gpio_keys.c +23 -6
@@ -96,7 +96,7 @@ struct gpio_keys_drvdata {* Return value of this function can be used to allocate bitmap * large enough to hold all bits for given type. */ -static inline int get_n_events_by_type (int type) +static int get_n_events_by_type (int type) {BUG_ON (type !=EV_SW && type !=EV_KEY );
@@ -104,6 +104,22 @@ static inline int get_n_events_by_type(i }/** +* get_bm_events_by_type() - returns bitmap of supported events per @type +* @input: input device from which bitmap is retrieved +* @type: type of button (%EV_KEY, %EV_SW) +* +* Return value of this function can be used to allocate bitmap +* large enough to hold all bits for given type. +*/ +static const unsigned long *get_bm_events_by_type (struct input_dev *dev, +int type) +{ +BUG_ON (type !=EV_SW && type !=EV_KEY ); + +return (type ==EV_KEY ) ? dev->keybit : dev->swbit; +} + +/** * gpio_keys_disable_button() - disables given GPIO button * @bdata: button data for button to be disabled *
@@ -213,6 +229,7 @@ static ssize_t gpio_keys_attr_store_help const char *buf, unsigned int type) { int n_events = get_n_events_by_type(type); +const unsigned long *bitmap =get_bm_events_by_type (ddata->input, type);unsigned long *bits;ssize_t error;int i;
@@ -226,6 +243,11 @@ static ssize_t gpio_keys_attr_store_help goto out;/* First validate */ +if (!bitmap_subset (bits, bitmap, n_events)) { + error = -EINVAL ; + goto out; + } +for (i =0 ; i < ddata->pdata->nbuttons; i++) {struct gpio_button_data *bdata = &ddata->data[i];
@@ -239,11 +261,6 @@ static ssize_t gpio_keys_attr_store_help } } -if (i == ddata->pdata->nbuttons) { - error = -EINVAL ; - goto out; - } -mutex_lock (&ddata->disable_lock);for (i =0 ; i < ddata->pdata->nbuttons; i++) {
Greg Kroah-Hartman
maintainerPATCH 122/312 Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree
In reply to Greg Kroah-HartmanFrom: Philipp Zabel <[email protected]>
commit dc262dfaaeda7617ae0b15b5ce1252a6cd102b19 upstream.
A recent patch broke parsing the gain, offset, and threshold parameters from device tree. Instead of setting the cached values and writing them to the correct registers during probe, it would write the values from DT into the register address variables and never write them to the chip during normal operation.
--- drivers/input/touchscreen/edt-ft5x06.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/input/touchscreen/edt-ft5x06.c +12 -6
@@ -822,16 +822,22 @@ static void edt_ft5x06_ts_get_defaults(sint error; error =device_property_read_u32 (dev,"threshold" , &val); -if (!error) - reg_addr->reg_threshold = val; +if (!error) { +edt_ft5x06_register_write (tsdata, reg_addr->reg_threshold, val); + tsdata->threshold = val; + } error =device_property_read_u32 (dev,"gain" , &val); -if (!error) - reg_addr->reg_gain = val; +if (!error) { +edt_ft5x06_register_write (tsdata, reg_addr->reg_gain, val); + tsdata->gain = val; + } error =device_property_read_u32 (dev,"offset" , &val); -if (!error) - reg_addr->reg_offset = val; +if (!error) { +edt_ft5x06_register_write (tsdata, reg_addr->reg_offset, val); + tsdata->offset = val; + } } static void
Greg Kroah-Hartman
maintainerPATCH 123/312 net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key
In reply to Greg Kroah-HartmanFrom: Alexey Kodanev <[email protected]>
commit 1625f4529957738be7d87cf157e107b8fb9d23b9 upstream.
Running LTP 'icmp-uni-basic.sh -6 -p ipcomp -m tunnel' test over openvswitch + veth can trigger kernel panic:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000e0 IP: [<ffffffff8169d1d2>] xfrm_input+0x82/0x750 ... [<ffffffff816d472e>] xfrm6_rcv_spi+0x1e/0x20 [<ffffffffa082c3c2>] xfrm6_tunnel_rcv+0x42/0x50 [xfrm6_tunnel] [<ffffffffa082727e>] tunnel6_rcv+0x3e/0x8c [tunnel6] [<ffffffff8169f365>] ip6_input_finish+0xd5/0x430 [<ffffffff8169fc53>] ip6_input+0x33/0x90 [<ffffffff8169f1d5>] ip6_rcv_finish+0xa5/0xb0 ...
It seems that tunnel.ip6 can have garbage values and also dereferenced without a proper check, only tunnel.ip4 is being verified. Fix it by adding one more if block for AF_INET6 and initialize tunnel.ip6 with NULL inside xfrm6_rcv_spi() (which is similar to xfrm4_rcv_spi()).
--- net/ipv6/xfrm6_input.c | 1 + net/xfrm/xfrm_input.c | 14 +++++++------- 2 files changed, 8 insertions(+), 7 deletions(-)
net/ipv6/xfrm6_input.c +1 -0
@@ -23,6 +23,7 @@ int xfrm6_extract_input(struct xfrm_statint xfrm6_rcv_spi (struct sk_buff *skb,int nexthdr,__be32 spi) { +XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip6 =NULL ;XFRM_SPI_SKB_CB (skb)->family =AF_INET6 ;XFRM_SPI_SKB_CB (skb)->daddroff = offsetof(struct ipv6hdr , daddr);return xfrm_input (skb, nexthdr, spi,0 );
net/xfrm/xfrm_input.c +7 -7
@@ -207,15 +207,15 @@ int xfrm_input(struct sk_buff *skb, int family =XFRM_SPI_SKB_CB (skb)->family;/* if tunnel is present override skb->mark value with tunnel i_key */ -if (XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip4) { -switch (family) { -case AF_INET : +switch (family) { +case AF_INET : +if (XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip4) mark =be32_to_cpu (XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip4->parms.i_key); -break ; -case AF_INET6 : +break ; +case AF_INET6 : +if (XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip6) mark =be32_to_cpu (XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip6->parms.i_key); -break ; - } +break ; }/* Allocate new secpath or COW existing one. */
Greg Kroah-Hartman
maintainerPATCH 124/312 xfrm_user: propagate sec ctx allocation errors
In reply to Greg Kroah-HartmanFrom: Mathias Krause <[email protected]>
commit 2f30ea5090cbc57ea573cdc66421264b3de3fb0a upstream.
When we fail to attach the security context in xfrm_state_construct() we'll return 0 as error value which, in turn, will wrongly claim success to userland when, in fact, we won't be adding / updating the XFRM state.
This is a regression introduced by commit fd21150a0fe1 ("[XFRM] netlink:
Inline attach_encap_tmpl(), attach_sec_ctx(), and attach_one_addr()").
Fix it by propagating the error returned by security_xfrm_state_alloc() in this case.
--- net/xfrm/xfrm_user.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/xfrm/xfrm_user.c +6 -3
@@ -609,9 +609,12 @@ static struct xfrm_state *xfrm_state_conif (err) goto error; -if (attrs[XFRMA_SEC_CTX ] && -security_xfrm_state_alloc (x,nla_data (attrs[XFRMA_SEC_CTX ]))) - goto error; +if (attrs[XFRMA_SEC_CTX ]) { + err =security_xfrm_state_alloc (x, +nla_data (attrs[XFRMA_SEC_CTX ])); +if (err) + goto error; + }if ((err =xfrm_alloc_replay_state_esn (&x->replay_esn, &x->preplay_esn, attrs[XFRMA_REPLAY_ESN_VAL ])))
Greg Kroah-Hartman
maintainerPATCH 125/312 xfrm: Fix memory leak of aead algorithm name
In reply to Greg Kroah-HartmanFrom: Ilan Tayari <[email protected]>
commit b588479358ce26f32138e0f0a7ab0678f8e3e601 upstream.
commit 1a6509d99122 ("[IPSEC]: Add support for combined mode algorithms") introduced aead. The function attach_aead kmemdup()s the algorithm name during xfrm_state_construct().
However this memory is never freed.
Implementation has since been slightly modified in
commit ee5c23176fcc ("xfrm: Clone states properly on migration") without resolving this leak.
This patch adds a kfree() call for the aead algorithm name.
--- net/xfrm/xfrm_state.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_state.c +1 -0
@@ -332,6 +332,7 @@ static void xfrm_state_gc_destroy(struct {tasklet_hrtimer_cancel (&x->mtimer);del_timer_sync (&x->rtimer); +kfree (x->aead);kfree (x->aalg);kfree (x->ealg);kfree (x->calg);
Greg Kroah-Hartman
maintainerPATCH 126/312 mac80211: fix mgmt-tx abort cookie and leak
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit e673a65952b4ab045a3e3eb200fdf408004fb4fd upstream.
If a mgmt-tx operation is aborted before it runs, the wrong cookie is reported back to userspace, and the ack_skb gets leaked since the frame is freed directly instead of freeing it using ieee80211_free_txskb(). Fix that.
--- net/mac80211/offchannel.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/mac80211/offchannel.c +2 -3
@@ -308,11 +308,10 @@ void ieee80211_roc_notify_destroy(struct/* was never transmitted */ if (roc->frame) { -cfg80211_mgmt_tx_status (&roc->sdata->wdev, - (unsigned long )roc->frame, +cfg80211_mgmt_tx_status (&roc->sdata->wdev, roc->mgmt_tx_cookie, roc->frame->data, roc->frame->len, false,GFP_KERNEL ); -kfree_skb (roc->frame); +ieee80211_free_txskb (&roc->sdata->local->hw, roc->frame); }if (!roc->mgmt_tx_cookie)
Greg Kroah-Hartman
maintainerPATCH 127/312 mac80211: TDLS: always downgrade invalid chandefs
In reply to Greg Kroah-HartmanFrom: Arik Nemtsov <[email protected]>
commit db8d99774c2682559b7648857697b9b588c6795a upstream.
Even if the current chandef width is equal to the station's max-BW, it doesn't mean it's a valid width for TDLS. Make sure to always check regulatory constraints in these cases.
--- net/mac80211/tdls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/tdls.c +1 -1
@@ -332,7 +332,7 @@ ieee80211_tdls_chandef_vht_upgrade(strucreturn ;/* proceed to downgrade the chandef until usable or the same */ -while (uc.width > max_width && +while (uc.width > max_width || !cfg80211_reg_can_beacon_relax (sdata->local->hw.wiphy, &uc, sdata->wdev.iftype))ieee80211_chandef_downgrade (&uc);
Greg Kroah-Hartman
maintainerPATCH 128/312 mac80211: TDLS: change BW calculation for WIDER_BW peers
In reply to Greg Kroah-HartmanFrom: Arik Nemtsov <[email protected]>
commit 59021c675995281d453eee45b3e2e1e3edbc0ec2 upstream.
The previous approach simply ignored chandef restrictions when calculating the appropriate peer BW for a WIDER_BW peer. This could result in a regulatory violation if both peers indicated 80MHz support, but the regdomain forbade it.
Change the approach to setting a WIDER_BW peer's BW. Don't exempt it from the chandef width at first. If during TDLS negotiation the chandef width is upgraded, update the peer's BW to match.
--- net/mac80211/ieee80211_i.h | 4 ++++ net/mac80211/tdls.c | 38 ++++++++++++++++++++++++++++++++------ net/mac80211/vht.c | 30 +++++++++++++++++++++++++----- 3 files changed, 61 insertions(+), 11 deletions(-)
net/mac80211/ieee80211_i.h +4 -0
@@ -1706,6 +1706,10 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struenum ieee80211_sta_rx_bandwidth ieee80211_sta_cap_rx_bw (struct sta_info *sta);enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw (struct sta_info *sta);void ieee80211_sta_set_rx_nss (struct sta_info *sta); +enum ieee80211_sta_rx_bandwidth +ieee80211_chan_width_to_rx_bw (enum nl80211_chan_width width); +enum nl80211_chan_width ieee80211_sta_cap_chan_bw (struct sta_info *sta); +void ieee80211_sta_set_rx_nss (struct sta_info *sta);u32 __ieee80211_vht_handle_opmode (struct ieee80211_sub_if_data *sdata,struct sta_info *sta,u8 opmode,enum ieee80211_band band);
net/mac80211/tdls.c +32 -6
@@ -4,7 +4,7 @@* Copyright 2006-2010 Johannes Berg <[email protected]> * Copyright 2014, Intel Corporation * Copyright 2014 Intel Mobile Communications GmbH -* Copyright 2015 Intel Deutschland GmbH +* Copyright 2015 - 2016 Intel Deutschland GmbH * * This file is GPLv2 as found in COPYING. */
@@ -15,6 +15,7 @@#include <linux/rtnetlink.h> #include "ieee80211_i.h" #include "driver-ops.h" +#include "rate.h" /* give usermode some time for retries in setting up the TDLS session */ #define TDLS_PEER_SETUP_TIMEOUT (15 * HZ)
@@ -302,7 +303,7 @@ ieee80211_tdls_chandef_vht_upgrade(struc/* IEEE802.11ac-2013 Table E-4 */ u16 centers_80mhz[] = {5210 ,5290 ,5530 ,5610 ,5690 ,5775 };struct cfg80211_chan_def uc = sta->tdls_chandef; -enum nl80211_chan_width max_width =ieee80211_get_sta_bw (&sta->sta); +enum nl80211_chan_width max_width =ieee80211_sta_cap_chan_bw (sta);int i;/* only support upgrading non-narrow channels up to 80Mhz */
@@ -1242,18 +1243,44 @@ int ieee80211_tdls_mgmt(struct wiphy *wireturn ret; } -static void iee80211_tdls_recalc_chanctx (struct ieee80211_sub_if_data *sdata) +static void iee80211_tdls_recalc_chanctx (struct ieee80211_sub_if_data *sdata, +struct sta_info *sta) {struct ieee80211_local *local = sdata->local;struct ieee80211_chanctx_conf *conf;struct ieee80211_chanctx *ctx; +enum nl80211_chan_width width; +struct ieee80211_supported_band *sband;mutex_lock (&local->chanctx_mtx); conf =rcu_dereference_protected (sdata->vif.chanctx_conf,lockdep_is_held (&local->chanctx_mtx));if (conf) { + width = conf->def.width; + sband = local->hw.wiphy->bands[conf->def.chan->band]; ctx = container_of(conf, struct ieee80211_chanctx, conf);ieee80211_recalc_chanctx_chantype (local, ctx); + +/* if width changed and a peer is given, update its BW */ +if (width != conf->def.width && sta && +test_sta_flag (sta,WLAN_STA_TDLS_WIDER_BW )) { +enum ieee80211_sta_rx_bandwidth bw; + + bw =ieee80211_chan_width_to_rx_bw (conf->def.width); + bw =min (bw,ieee80211_sta_cap_rx_bw (sta)); +if (bw != sta->sta.bandwidth) { + sta->sta.bandwidth = bw; +rate_control_rate_update (local, sband, sta, +IEEE80211_RC_BW_CHANGED ); +/* +* if a TDLS peer BW was updated, we need to +* recalc the chandef width again, to get the +* correct chanctx min_def +*/ +ieee80211_recalc_chanctx_chantype (local, ctx); + } + } + }mutex_unlock (&local->chanctx_mtx); }
@@ -1350,8 +1377,6 @@ int ieee80211_tdls_oper(struct wiphy *wibreak ; } -iee80211_tdls_recalc_chanctx (sdata); -mutex_lock (&local->sta_mtx); sta =sta_info_get (sdata, peer);if (!sta) {
@@ -1360,6 +1385,7 @@ int ieee80211_tdls_oper(struct wiphy *wibreak ; } +iee80211_tdls_recalc_chanctx (sdata, sta);iee80211_tdls_recalc_ht_protection (sdata, sta);set_sta_flag (sta,WLAN_STA_TDLS_PEER_AUTH );
@@ -1390,7 +1416,7 @@ int ieee80211_tdls_oper(struct wiphy *wiiee80211_tdls_recalc_ht_protection (sdata,NULL );mutex_unlock (&local->sta_mtx); -iee80211_tdls_recalc_chanctx (sdata); +iee80211_tdls_recalc_chanctx (sdata,NULL );break ;default : ret = -ENOTSUPP ;
net/mac80211/vht.c +25 -5
@@ -299,7 +299,30 @@ enum ieee80211_sta_rx_bandwidth ieee8021return IEEE80211_STA_RX_BW_80 ; } -static enum ieee80211_sta_rx_bandwidth +enum nl80211_chan_width ieee80211_sta_cap_chan_bw (struct sta_info *sta) +{ +struct ieee80211_sta_vht_cap *vht_cap = &sta->sta.vht_cap; +u32 cap_width; + +if (!vht_cap->vht_supported) { +if (!sta->sta.ht_cap.ht_supported) +return NL80211_CHAN_WIDTH_20_NOHT ; + +return sta->sta.ht_cap.cap &IEEE80211_HT_CAP_SUP_WIDTH_20_40 ? +NL80211_CHAN_WIDTH_40 :NL80211_CHAN_WIDTH_20 ; + } + + cap_width = vht_cap->cap &IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK ; + +if (cap_width ==IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ) +return NL80211_CHAN_WIDTH_160 ; +else if (cap_width ==IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ ) +return NL80211_CHAN_WIDTH_80P80 ; + +return NL80211_CHAN_WIDTH_80 ; +} + +enum ieee80211_sta_rx_bandwidth ieee80211_chan_width_to_rx_bw (enum nl80211_chan_width width) {switch (width) {
@@ -327,10 +350,7 @@ enum ieee80211_sta_rx_bandwidth ieee8021 bw =ieee80211_sta_cap_rx_bw (sta); bw =min (bw, sta->cur_max_bandwidth); - -/* do not cap the BW of TDLS WIDER_BW peers by the bss */ -if (!test_sta_flag (sta,WLAN_STA_TDLS_WIDER_BW )) - bw =min (bw,ieee80211_chan_width_to_rx_bw (bss_width)); + bw =min (bw,ieee80211_chan_width_to_rx_bw (bss_width));return bw; }
Greg Kroah-Hartman
maintainerPATCH 129/312 mac80211: Fix BW upgrade for TDLS peers
In reply to Greg Kroah-HartmanFrom: Ilan Peer <[email protected]>
commit 4b559ec0bfc3a9f41a127cea6964f38b2b4bb323 upstream.
It is possible that the station is connected to an AP with bandwidth of 80+80MHz or 160MHz. In such cases there is no need to perform an upgrade as the maximal supported bandwidth is 80MHz.
In addition, when upgrading and setting center_freq1 and bandwidth to 80MHz also set center_freq2 to 0.
--- net/mac80211/tdls.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/tdls.c +2 -1
@@ -314,7 +314,7 @@ ieee80211_tdls_chandef_vht_upgrade(strucif (max_width >NL80211_CHAN_WIDTH_80 ) max_width =NL80211_CHAN_WIDTH_80 ; -if (uc.width == max_width) +if (uc.width >= max_width)return ;/* * Channel usage constrains in the IEEE802.11ac-2013 specification only
@@ -325,6 +325,7 @@ ieee80211_tdls_chandef_vht_upgrade(strucfor (i =0 ; i <ARRAY_SIZE (centers_80mhz); i++)if (abs (uc.chan->center_freq - centers_80mhz[i]) <=30 ) { uc.center_freq1 = centers_80mhz[i]; + uc.center_freq2 =0 ; uc.width =NL80211_CHAN_WIDTH_80 ;break ; }
Greg Kroah-Hartman
maintainerPATCH 130/312 NFS: Fix an LOCK/OPEN race when unlinking an open file
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit 11476e9dec39d90fe1e9bf12abc6f3efe35a073d upstream.
At Connectathon 2016, we found that recent upstream Linux clients would occasionally send a LOCK operation with a zero stateid. This appeared to happen in close proximity to another thread returning a delegation before unlinking the same file while it remained open.
Earlier, the client received a write delegation on this file and returned the open stateid. Now, as it is getting ready to unlink the file, it returns the write delegation. But there is still an open file descriptor on that file, so the client must OPEN the file again before it returns the delegation.
Since commit 24311f884189 ('NFSv4: Recovery of recalled read delegations is broken'), nfs_open_delegation_recall() clears the NFS_DELEGATED_STATE flag _before_ it sends the OPEN. This allows a racing LOCK on the same inode to be put on the wire before the OPEN operation has returned a valid open stateid.
To eliminate this race, serialize delegation return with the acquisition of a file lock on the same file. Adopt the same approach as is used in the unlock path.
This patch also eliminates a similar race seen when sending a LOCK operation at the same time as returning a delegation on the same file.
--- fs/nfs/nfs4proc.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/nfs/nfs4proc.c +4 -0
@@ -6054,6 +6054,7 @@ static int nfs41_lock_expired(struct nfsstatic int _nfs4_proc_setlk (struct nfs4_state *state,int cmd,struct file_lock *request) {struct nfs_inode *nfsi =NFS_I (state->inode); +struct nfs4_state_owner *sp = state->owner;unsigned char fl_flags = request->fl_flags;int status = -ENOLCK ;
@@ -6068,6 +6069,7 @@ static int _nfs4_proc_setlk(struct nfs4_ status =do_vfs_lock (state->inode, request);if (status <0 ) goto out; +mutex_lock (&sp->so_delegreturn_mutex);down_read (&nfsi->rwsem);if (test_bit (NFS_DELEGATED_STATE , &state->flags)) {/* Yes: cache locks! */
@@ -6075,9 +6077,11 @@ static int _nfs4_proc_setlk(struct nfs4_ request->fl_flags = fl_flags & ~FL_SLEEP ; status =do_vfs_lock (state->inode, request);up_read (&nfsi->rwsem); +mutex_unlock (&sp->so_delegreturn_mutex); goto out; }up_read (&nfsi->rwsem); +mutex_unlock (&sp->so_delegreturn_mutex); status =_nfs4_do_setlk (state, cmd, request,NFS_LOCK_NEW ); out: request->fl_flags = fl_flags;
Greg Kroah-Hartman
maintainerPATCH 131/312 net: get rid of an signed integer overflow in ip_idents_reserve()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit adb03115f4590baa280ddc440a8eff08a6be0cb7 upstream.
Jiri Pirko reported an UBSAN warning happening in ip_idents_reserve()
[] UBSAN: Undefined behaviour in ./arch/x86/include/asm/atomic.h:156:11 [] signed integer overflow:
[] -2117905507 + -695755206 cannot be represented in type 'int'
Since we do not have uatomic_add_return() yet, use atomic_cmpxchg() so that the arithmetics can be done using unsigned int.
--- net/ipv4/route.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
net/ipv4/route.c +8 -2
@@ -477,12 +477,18 @@ u32 ip_idents_reserve(u32 hash, int segsatomic_t *p_id = ip_idents + hash %IP_IDENTS_SZ ;u32 old =ACCESS_ONCE (*p_tstamp);u32 now = (u32 )jiffies; -u32 delta =0 ; +u32 new, delta =0 ;if (old != now &&cmpxchg (p_tstamp, old, now) == old) delta =prandom_u32_max (now - old); -return atomic_add_return (segs + delta, p_id) - segs; +/* Do not use atomic_add_return() as it makes UBSAN unhappy */ +do { + old = (u32 )atomic_read (p_id); + new = old + delta + segs; + }while (atomic_cmpxchg (p_id, old, new) != old); + +return new - segs; }EXPORT_SYMBOL (ip_idents_reserve);
Greg Kroah-Hartman
maintainerPATCH 132/312 mtd: nand: denali: add missing nand_release() call in denali_remove()
In reply to Greg Kroah-HartmanFrom: Boris Brezillon <[email protected]>
commit 320092a05dab2f44819c42f33d6b51efb6c474f2 upstream.
Unregister the NAND device from the NAND subsystem when removing a denali NAND controller, otherwise the MTD attached to the NAND device is still exposed by the MTD layer, and accesses to this device will likely crash the system.
--- drivers/mtd/nand/denali.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/mtd/nand/denali.c +9 -2
@@ -1622,9 +1622,16 @@ EXPORT_SYMBOL(denali_init);/* driver exit point */ void denali_remove (struct denali_nand_info *denali) { +/* +* Pre-compute DMA buffer size to avoid any problems in case +* nand_release() ever changes in a way that mtd->writesize and +* mtd->oobsize are not reliable after this call. +*/ +int bufsize = denali->mtd.writesize + denali->mtd.oobsize; + +nand_release (&denali->mtd);denali_irq_cleanup (denali->irq, denali); -dma_unmap_single (denali->dev, denali->buf.dma_buf, - denali->mtd.writesize + denali->mtd.oobsize, +dma_unmap_single (denali->dev, denali->buf.dma_buf, bufsize,DMA_BIDIRECTIONAL ); }EXPORT_SYMBOL (denali_remove);
Greg Kroah-Hartman
maintainerPATCH 133/312 mtd: nand: pxa3xx_nand: fix dmaengine initialization
In reply to Greg Kroah-HartmanFrom: Robert Jarzmik <[email protected]>
commit 9097103f06332d099c5ab06d1e7f22f4bcaca6e2 upstream.
When the driver is initialized in a pure device-tree platform, the driver's probe fails allocating the dma channel :
[ 525.624435] pxa3xx-nand 43100000.nand: no resource defined for data DMA [ 525.632088] pxa3xx-nand 43100000.nand: alloc nand resource failed
The reason is that the DMA IO resource is not acquired through platform resources but by OF bindings.
Fix this by ensuring that DMA IO resources are only queried in the non device-tree case.
--- drivers/mtd/nand/pxa3xx_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/pxa3xx_nand.c +1 -1
@@ -1750,7 +1750,7 @@ static int alloc_nand_resource(struct plif (ret <0 )return ret; -if (use_dma) { +if (!np && use_dma) { r =platform_get_resource (pdev,IORESOURCE_DMA ,0 );if (r ==NULL ) { dev_err(&pdev->dev,
Greg Kroah-Hartman
maintainerPATCH 134/312 ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit d16a2b9f2465b5486f830178fbfb7d203e0a17ae upstream.
"data" is always NULL in this function. I think we should be passing "&data" to sst_prepare_and_post_msg() instead of "data".
--- sound/soc/intel/atom/sst/sst_stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/atom/sst/sst_stream.c +1 -1
@@ -108,7 +108,7 @@ int sst_alloc_stream_mrfld(struct intel_ str_id, pipe_id); ret =sst_prepare_and_post_msg (sst_drv_ctx, task_id,IPC_CMD ,IPC_IA_ALLOC_STREAM_MRFLD , pipe_id,sizeof (alloc_param), - &alloc_param, data, true, true, false, true); + &alloc_param, &data, true, true, false, true);if (ret <0 ) {dev_err (sst_drv_ctx->dev,"FW alloc failed ret %d\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 135/312 ASoC: tegra_alc5632: check return value
In reply to Greg Kroah-HartmanFrom: Sudip Mukherjee <[email protected]>
commit 319c32597fc22a58b946a6146f2be1fd208582e0 upstream.
We have been returning success even if snd_soc_card_jack_new() fails. Lets check the return value and return error if it fails.
--- sound/soc/tegra/tegra_alc5632.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
sound/soc/tegra/tegra_alc5632.c +8 -4
@@ -101,12 +101,16 @@ static const struct snd_kcontrol_new tegstatic int tegra_alc5632_asoc_init (struct snd_soc_pcm_runtime *rtd) { +int ret;struct tegra_alc5632 *machine =snd_soc_card_get_drvdata (rtd->card); -snd_soc_card_jack_new (rtd->card,"Headset Jack" ,SND_JACK_HEADSET , - &tegra_alc5632_hs_jack, - tegra_alc5632_hs_jack_pins, -ARRAY_SIZE (tegra_alc5632_hs_jack_pins)); + ret =snd_soc_card_jack_new (rtd->card,"Headset Jack" , +SND_JACK_HEADSET , + &tegra_alc5632_hs_jack, + tegra_alc5632_hs_jack_pins, +ARRAY_SIZE (tegra_alc5632_hs_jack_pins)); +if (ret) +return ret;if (gpio_is_valid (machine->gpio_hp_det)) { tegra_alc5632_hp_jack_gpio.gpio = machine->gpio_hp_det;
Greg Kroah-Hartman
maintainerPATCH 136/312 ASoC: fsl_ssi: mark SACNT register volatile
In reply to Greg Kroah-HartmanFrom: Maciej S. Szmigiero <[email protected]>
commit 3f1c241f0f5f90046258e6b8d4aeb6463ffdc08e upstream.
SACNT register should be marked volatile since
its WR and RD bits are cleared by SSI after
completing the relevant operation.
This unbreaks AC'97 register access.
--- sound/soc/fsl/fsl_ssi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_ssi.c +7 -1
@@ -146,6 +146,7 @@ static bool fsl_ssi_volatile_reg(structcase CCSR_SSI_SRX1 :case CCSR_SSI_SISR :case CCSR_SSI_SFCSR : +case CCSR_SSI_SACNT :case CCSR_SSI_SACADD :case CCSR_SSI_SACDAT :case CCSR_SSI_SATAG :
@@ -239,8 +240,9 @@ struct fsl_ssi_private {unsigned int baudclk_streams;unsigned int bitclk_freq; -/*regcache for SFCSR*/ +/* regcache for volatile regs */ u32 regcache_sfcsr; +u32 regcache_sacnt;/* DMA params */ struct snd_dmaengine_dai_dma_data dma_params_tx;
@@ -1597,6 +1599,8 @@ static int fsl_ssi_suspend(struct deviceregmap_read (regs,CCSR_SSI_SFCSR , &ssi_private->regcache_sfcsr); +regmap_read (regs,CCSR_SSI_SACNT , + &ssi_private->regcache_sacnt);regcache_cache_only (regs, true);regcache_mark_dirty (regs);
@@ -1615,6 +1619,8 @@ static int fsl_ssi_resume(struct deviceCCSR_SSI_SFCSR_RFWM1_MASK |CCSR_SSI_SFCSR_TFWM1_MASK |CCSR_SSI_SFCSR_RFWM0_MASK |CCSR_SSI_SFCSR_TFWM0_MASK , ssi_private->regcache_sfcsr); +regmap_write (regs,CCSR_SSI_SACNT , + ssi_private->regcache_sacnt);return regcache_sync (regs); }
Greg Kroah-Hartman
maintainerPATCH 137/312 Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit b5f88dd1d6efc472e35ca1b21a44e662c5422088 upstream.
The specific power domain can't be used in a way provided by the commit 01ac170ba29a, i.e. pointer to platform device is a subject to change during unbound / bind cycle.
This reverts commit 01ac170ba29a9903ee590e1ef2d8e6b27b49a16c.
--- drivers/acpi/acpi_lpss.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/acpi/acpi_lpss.c +6 -2
@@ -704,8 +704,13 @@ static int acpi_lpss_platform_notify(str }switch (action) { -case BUS_NOTIFY_ADD_DEVICE : +case BUS_NOTIFY_BOUND_DRIVER : pdev->dev.pm_domain = &acpi_lpss_pm_domain; +break ; +case BUS_NOTIFY_UNBOUND_DRIVER : + pdev->dev.pm_domain =NULL ; +break ; +case BUS_NOTIFY_ADD_DEVICE :if (pdata->dev_desc->flags &LPSS_LTR )return sysfs_create_group (&pdev->dev.kobj, &lpss_attr_group);
@@ -713,7 +718,6 @@ static int acpi_lpss_platform_notify(strcase BUS_NOTIFY_DEL_DEVICE :if (pdata->dev_desc->flags &LPSS_LTR )sysfs_remove_group (&pdev->dev.kobj, &lpss_attr_group); - pdev->dev.pm_domain =NULL ;break ;default :break ;
Greg Kroah-Hartman
maintainerPATCH 138/312 mmc: sdhci: restore behavior when setting VDD via external regulator
In reply to Greg Kroah-HartmanFrom: Jisheng Zhang <[email protected]>
commit 918f4cbd4340ddd1eb389cd8efa3b07ac74ec4c0 upstream.
After commit 52221610dd84 ("mmc: sdhci: Improve external VDD regulator support"), for the VDD is supplied via external regulators, we ignore the code to convert a VDD voltage request into one of the standard SDHCI voltage levels, then program it in the SDHCI_POWER_CONTROL. This brings two issues:
1. SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON quirk isn't handled properly any more.
2. What's more, once SDHCI_POWER_ON bit is set, some controllers such as the sdhci-pxav3 used in marvell berlin SoCs require the voltage levels programming in the SDHCI_POWER_CONTROL register, even the VDD is supplied by external regulator. So the host in marvell berlin SoCs still works fine after the commit. However, commit 3cbc6123a93d ("mmc:
sdhci: Set SDHCI_POWER_ON with external vmmc") sets the SDHCI_POWER_ON bit, this would make the host in marvell berlin SoCs won't work any more with external vmmc.
This patch restores the behavior when setting VDD through external regulator by moving the call of mmc_regulator_set_ocr() to the end of sdhci_set_power() function.
After this patch, the sdcard on Marvell Berlin SoC boards work again.
--- drivers/mmc/host/sdhci.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-)
drivers/mmc/host/sdhci.c +6 -13
@@ -1290,19 +1290,6 @@ static void sdhci_set_power(struct sdhcistruct mmc_host *mmc = host->mmc;u8 pwr =0 ; -if (!IS_ERR (mmc->supply.vmmc)) { -spin_unlock_irq (&host->lock); -mmc_regulator_set_ocr (mmc, mmc->supply.vmmc, vdd); -spin_lock_irq (&host->lock); - -if (mode !=MMC_POWER_OFF ) -sdhci_writeb (host,SDHCI_POWER_ON ,SDHCI_POWER_CONTROL ); -else -sdhci_writeb (host,0 ,SDHCI_POWER_CONTROL ); - -return ; - } -if (mode !=MMC_POWER_OFF ) {switch (1 << vdd) {case MMC_VDD_165_195 :
@@ -1363,6 +1350,12 @@ static void sdhci_set_power(struct sdhciif (host->quirks &SDHCI_QUIRK_DELAY_AFTER_POWER )mdelay (10 ); } + +if (!IS_ERR (mmc->supply.vmmc)) { +spin_unlock_irq (&host->lock); +mmc_regulator_set_ocr (mmc, mmc->supply.vmmc, vdd); +spin_lock_irq (&host->lock); + } }/*****************************************************************************\
Greg Kroah-Hartman
maintainerPATCH 139/312 mmc: sd: limit SD card power limit according to cards capabilities
In reply to Greg Kroah-HartmanFrom: Russell King <[email protected]>
commit d9812780a020bcec44565b5950b2a8b31afb5545 upstream.
The SD card specification allows cards to error out a SWITCH command where the requested function in a group is not supported. The spec provides for a set of capabilities which indicate which functions are supported.
In the case of the power limit, requesting an unsupported power level via the SWITCH command fails, resulting in the power level remaining at the power-on default of 0.72W, even though the host and card may support higher powers levels.
This has been seen with SanDisk 8GB cards, which support the default 0.72W and 1.44W (200mA and 400mA) in combination with an iMX6 host, supporting up to 2.88W (800mA). This currently causes us to try to set a power limit function value of '3' (2.88W) which the card errors out on, and thereby causes the power level to remain at 0.72W rather than the desired 1.44W.
Arrange to limit the selected current limit by the capabilities reported by the card to avoid the SWITCH command failing. Select the highest current limit that the host and card combination support.
--- drivers/mmc/core/sd.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/mmc/core/sd.c +16 -4
@@ -337,6 +337,7 @@ static int mmc_read_switch(struct mmc_ca card->sw_caps.sd3_bus_mode = status[13 ];/* Driver Strengths supported by the card */ card->sw_caps.sd3_drv_type = status[9 ]; + card->sw_caps.sd3_curr_limit = status[7 ] | status[6 ] <<8 ; } out:
@@ -553,14 +554,25 @@ static int sd_set_current_limit(struct m* when we set current limit to 200ma, the card will draw 200ma, and * when we set current limit to 400/600/800ma, the card will draw its * maximum 300ma from the host. +* +* The above is incorrect: if we try to set a current limit that is +* not supported by the card, the card can rightfully error out the +* attempt, and remain at the default current limit. This results +* in a 300mA card being limited to 200mA even though the host +* supports 800mA. Failures seen with SanDisk 8GB UHS cards with +* an iMX6 host. --rmk */ -if (max_current >=800 ) +if (max_current >=800 && + card->sw_caps.sd3_curr_limit &SD_MAX_CURRENT_800 ) current_limit =SD_SET_CURRENT_LIMIT_800 ; -else if (max_current >=600 ) +else if (max_current >=600 && + card->sw_caps.sd3_curr_limit &SD_MAX_CURRENT_600 ) current_limit =SD_SET_CURRENT_LIMIT_600 ; -else if (max_current >=400 ) +else if (max_current >=400 && + card->sw_caps.sd3_curr_limit &SD_MAX_CURRENT_400 ) current_limit =SD_SET_CURRENT_LIMIT_400 ; -else if (max_current >=200 ) +else if (max_current >=200 && + card->sw_caps.sd3_curr_limit &SD_MAX_CURRENT_200 ) current_limit =SD_SET_CURRENT_LIMIT_200 ;if (current_limit !=SD_SET_CURRENT_NO_CHANGE ) {
Greg Kroah-Hartman
maintainerPATCH 140/312 mmc: debugfs: correct wrong voltage value
In reply to Greg Kroah-HartmanFrom: Chuanxiao Dong <[email protected]>
commit 0036e74686344f1051afc3107740140abfd03616 upstream.
Correct the wrong voltage value shown in debugfs for mmc/sd/sdio.
--- drivers/mmc/core/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/core/debugfs.c +1 -1
@@ -170,7 +170,7 @@ static int mmc_ios_show(struct seq_file str ="invalid" ;break ; } -seq_printf (s,"signal voltage:\t%u (%s)\n" , ios->chip_select, str); +seq_printf (s,"signal voltage:\t%u (%s)\n" , ios->signal_voltage, str);switch (ios->drv_type) {case MMC_SET_DRIVER_TYPE_A :
Greg Kroah-Hartman
maintainerPATCH 141/312 mmc: block: return error on failed mmc_blk_get()
In reply to Greg Kroah-HartmanFrom: Olof Johansson <[email protected]>
commit f00ab14c252ac459e86194747a1f580ab503c954 upstream.
This used to return -EFAULT, but the function above returns -EINVAL on the same condition so let's stick to that.
The removal of error return on this path was introduced with b093410c9aef ('mmc: block: copy resp[] data on err for MMC_IOC_MULTI_CMD').
--- drivers/mmc/card/block.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mmc/card/block.c +3 -1
@@ -668,8 +668,10 @@ static int mmc_blk_ioctl_multi_cmd(struc } md =mmc_blk_get (bdev->bd_disk); -if (!md) +if (!md) { + err = -EINVAL ; goto cmd_err; + } card = md->queue.card;if (IS_ERR (card)) {
Greg Kroah-Hartman
maintainerPATCH 142/312 clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization"
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
commit 4715f81afc342996f680b08c944a712d9cbef11b upstream.
This reverts commit 7a03fe6f48f3 ("clk: rockchip: reset init state before mmc card initialization").
Though not totally obvious from the commit message nor from the source code, that commit appears to be trying to reset the "_drv" MMC clocks to 90 degrees (note that the "_sample" MMC clocks have a shift of 0 so are not touched).
The major problem here is that it doesn't properly reset things. The phase is a two bit field and the commit only touches one of the two bits. Thus the commit had the following affect:
- phase 0 => phase 90 - phase 90 => phase 90 - phase 180 => phase 270 - phase 270 => phase 270
Things get even weirder if you happen to have a bootloader that was actually using delay elements (should be no reason to, but you never know), since those are additional bits that weren't touched by the original patch.
This is unlikely to be what we actually want. Checking on rk3288-veyron devices, I can see that the bootloader leaves these clocks as:
- emmc: phase 180
- sdmmc: phase 90
- sdio0: phase 90
Thus on rk3288-veyron devices the commit we're reverting had the effect of changing the eMMC clock to phase 270. This probably explains the scattered reports I've heard of eMMC devices not working on some veyron devices when using the upstream kernel.
The original commit was presumably made because previously the kernel didn't touch the "_drv" phase at all and relied on whatever value was there when the kernel started. If someone was using a bootloader that touched the "_drv" phase then, indeed, we should have code in the kernel to fix that. ...and also, to get ideal timings, we should also have the kernel change the phase depending on the speed mode. In fact, that's the subject of a recent patch I posted at
<https://patchwork.kernel.org/patch/9075141/>.
Ideally, we should take both the patch posted to dw_mmc and this revert. Since those will likely go through different trees, here I describe behavior with the combos:
1. Just this revert: likely will fix rk3288-veyron eMMC on some devices
+ other cases; might break someone with a strange bootloader that sets the phase to 0 or one that uses delay elements (pretty unpredicable what would happen in that case).
2. Just dw_mmc patch: fixes everyone. Effectly the dw_mmc patch will totally override the broken patch and fix everything.
3. Both patches: fixes everyone. Once dw_mmc is initting properly then any defaults from the clock code doesn't mattery.
[emmc and sdmmc still work on all current boards in mainline after this revert, so they should take precedence over any out-of-tree board that will hopefully again get fixed with the better upcoming dw_mmc change.]
--- drivers/clk/rockchip/clk-mmc-phase.c | 11 ----------- 1 file changed, 11 deletions(-)
drivers/clk/rockchip/clk-mmc-phase.c +0 -11
@@ -41,8 +41,6 @@ static unsigned long rockchip_mmc_recalc#define ROCKCHIP_MMC_DEGREE_MASK 0x3#define ROCKCHIP_MMC_DELAYNUM_OFFSET 2#define ROCKCHIP_MMC_DELAYNUM_MASK (0xff << ROCKCHIP_MMC_DELAYNUM_OFFSET) -#define ROCKCHIP_MMC_INIT_STATE_RESET 0x1 -#define ROCKCHIP_MMC_INIT_STATE_SHIFT 1#define PSECS_PER_SEC 1000000000000LL
@@ -183,15 +181,6 @@ struct clk *rockchip_clk_register_mmc(co mmc_clock->reg = reg; mmc_clock->shift = shift; -/* -* Assert init_state to soft reset the CLKGEN -* for mmc tuning phase and degree -*/ -if (mmc_clock->shift ==ROCKCHIP_MMC_INIT_STATE_SHIFT ) -writel (HIWORD_UPDATE (ROCKCHIP_MMC_INIT_STATE_RESET , -ROCKCHIP_MMC_INIT_STATE_RESET , - mmc_clock->shift), mmc_clock->reg); - clk =clk_register (NULL , &mmc_clock->hw);if (IS_ERR (clk)) goto err_free;
Greg Kroah-Hartman
maintainerPATCH 143/312 mmc: dw_mmc: rockchip: Set the drive phase properly
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
commit d4aa908c7978f60557a799ca53b5ae4166fd8355 upstream.
Historically for Rockchip devices we've relied on the power-on default (or perhaps the firmware setting) to get the correct drive phase for dw_mmc devices. This worked OK for the most part, but:
* Relying on the setting just "being right" is a bit fragile.
* As soon as there is an instance where the power on default is wrong or where the firmware didn't configure this properly then we'll get a mysterious failure.
In commit 7a03fe6f48f3 ("clk: rockchip: reset init state before mmc card initialization") we actually started setting this explicitly in the kernel, but that commit wasn't quite right and also wasn't quite enough. See <https://patchwork.kernel.org/patch/9085311/> for some details.
Let's explicitly set this phase in dw_mmc.
The comments inside this patch try to explain the situation quite throughly, but the high level overview of this is:
Before this patch on rk3288 devices tested (after revert of the clock patch described above):
* eMMC: 180 degrees
* SDMMC/SDIO0/SDIO1: 90 degrees
After this patch:
* Use 90 degree phase offset usually.
* Use 180 degree phase offset for MMC_DDR52, SDR104, HS200.
That means we are _changing_ behavior for those devices in this way:
* If we have HS200 eMMC or DDR52 eMMC, we'll run ID mode at 90 degrees (vs 180) but otherwise have no change.
* For any non-HS200 / non-DDR52 eMMC devices we'll now _always_ run at 90 degrees (vs 180). It seems fairly unlikely that building modern hardware is using an eMMC that isn't using DDR52 or HS200, of course.
* For SDR104 cards we'll now run with 180 degree phase offset (vs 90). It's expected that 90 degree phase offset would have worked OK, but this gives us extra margin.
I have tested this by inserting my collection of uSD cards (mostly UHS, though a few not) into a veyron_minnie and confirmed that they still seem to enumerate properly. For a subset of them I tried putting a filesystem on them and also tried running mmc_test.
--- drivers/mmc/host/dw_mmc-rockchip.c | 64 +++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+)
drivers/mmc/host/dw_mmc-rockchip.c +64 -0
@@ -78,6 +78,70 @@ static void dw_mci_rk3288_set_ios(struct/* Make sure we use phases which we can enumerate with */ if (!IS_ERR (priv->sample_clk))clk_set_phase (priv->sample_clk, priv->default_sample_phase); + +/* +* Set the drive phase offset based on speed mode to achieve hold times. +* +* NOTE: this is _not_ a value that is dynamically tuned and is also +* _not_ a value that will vary from board to board. It is a value +* that could vary between different SoC models if they had massively +* different output clock delays inside their dw_mmc IP block (delay_o), +* but since it's OK to overshoot a little we don't need to do complex +* calculations and can pick values that will just work for everyone. +* +* When picking values we'll stick with picking 0/90/180/270 since +* those can be made very accurately on all known Rockchip SoCs. +* +* Note that these values match values from the DesignWare Databook +* tables for the most part except for SDR12 and "ID mode". For those +* two modes the databook calculations assume a clock in of 50MHz. As +* seen above, we always use a clock in rate that is exactly the +* card's input clock (times RK3288_CLKGEN_DIV, but that gets divided +* back out before the controller sees it). +* +* From measurement of a single device, it appears that delay_o is +* about .5 ns. Since we try to leave a bit of margin, it's expected +* that numbers here will be fine even with much larger delay_o +* (the 1.4 ns assumed by the DesignWare Databook would result in the +* same results, for instance). +*/ +if (!IS_ERR (priv->drv_clk)) { +int phase; + +/* +* In almost all cases a 90 degree phase offset will provide +* sufficient hold times across all valid input clock rates +* assuming delay_o is not absurd for a given SoC. We'll use +* that as a default. +*/ + phase =90 ; + +switch (ios->timing) { +case MMC_TIMING_MMC_DDR52 : +/* +* Since clock in rate with MMC_DDR52 is doubled when +* bus width is 8 we need to double the phase offset +* to get the same timings. +*/ +if (ios->bus_width ==MMC_BUS_WIDTH_8 ) + phase =180 ; +break ; +case MMC_TIMING_UHS_SDR104 : +case MMC_TIMING_MMC_HS200 : +/* +* In the case of 150 MHz clock (typical max for +* Rockchip SoCs), 90 degree offset will add a delay +* of 1.67 ns. That will meet min hold time of .8 ns +* as long as clock output delay is < .87 ns. On +* SoCs measured this seems to be OK, but it doesn't +* hurt to give margin here, so we use 180. +*/ + phase =180 ; +break ; + } + +clk_set_phase (priv->drv_clk, phase); + } }#define NUM_PHASES 360
Greg Kroah-Hartman
maintainerPATCH 144/312 mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type
In reply to Greg Kroah-HartmanFrom: Nicholas Mc Guire <[email protected]>
commit 41f469cac2663a41a7b0c84cb94e8f7024385ae4 upstream.
wait_for_completion_timeout_interruptible returns long not unsigned long so dma_time, which is used exclusively here, is changed to long.
--- drivers/mmc/host/moxart-mmc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/mmc/host/moxart-mmc.c +3 -2
@@ -257,7 +257,7 @@ static void moxart_dma_complete(void *pastatic void moxart_transfer_dma (struct mmc_data *data,struct moxart_host *host) {u32 len, dir_data, dir_slave; -unsigned long dma_time; +long dma_time;struct dma_async_tx_descriptor *desc =NULL ;struct dma_chan *dma_chan;
@@ -397,7 +397,8 @@ static void moxart_prepare_data(struct mstatic void moxart_request (struct mmc_host *mmc,struct mmc_request *mrq) {struct moxart_host *host =mmc_priv (mmc); -unsigned long pio_time, flags; +long pio_time; +unsigned long flags;u32 status;spin_lock_irqsave (&host->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 145/312 mmc: sdhci: Fix regression setting power on Trats2 board
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit 1dceb0415aa0c6bc11dacdab47c9ef83a3604166 upstream.
Several commits relating to setting power have been introducing problems by putting driver-specific rules into generic SDHCI code.
Krzysztof Kozlowski reported that after commit 918f4cbd4340 ("mmc:
sdhci: restore behavior when setting VDD via external regulator") on Trats2 board there are warnings for invalid VDD value (2.8V):
[ 3.119656] ------------[ cut here ]------------ [ 3.119666] WARNING: CPU: 3 PID: 90 at ../drivers/mmc/host/sdhci.c:1234 sdhci_do_set_ios+0x4cc/0x5e0 [ 3.119669] mmc0: Invalid vdd 0x10 [ 3.119673] Modules linked in: [ 3.119679] CPU: 3 PID: 90 Comm: kworker/3:1 Tainted: G W 4.5.0-next-20160324 #23 [ 3.119681] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [ 3.119690] Workqueue: events_freezable mmc_rescan [ 3.119708] [<c010e0ac>] (unwind_backtrace) from [<c010ae10>] (show_stack+0x10/0x14) [ 3.119719] [<c010ae10>] (show_stack) from [<c0323260>] (dump_stack+0x88/0x9c) [ 3.119728] [<c0323260>] (dump_stack) from [<c011b754>] (__warn+0xe8/0x100) [ 3.119734] [<c011b754>] (__warn) from [<c011b7a4>] (warn_slowpath_fmt+0x38/0x48) [ 3.119740] [<c011b7a4>] (warn_slowpath_fmt) from [<c0527d28>] (sdhci_do_set_ios+0x4cc/0x5e0) [ 3.119748] [<c0527d28>] (sdhci_do_set_ios) from [<c0528018>] (sdhci_runtime_resume_host+0x60/0x114) [ 3.119758] [<c0528018>] (sdhci_runtime_resume_host) from [<c0402570>] (__rpm_callback+0x2c/0x60) [ 3.119767] [<c0402570>] (__rpm_callback) from [<c04025c4>] (rpm_callback+0x20/0x80) [ 3.119773] [<c04025c4>] (rpm_callback) from [<c04034b8>] (rpm_resume+0x36c/0x558) [ 3.119780] [<c04034b8>] (rpm_resume) from [<c04036f0>] (__pm_runtime_resume+0x4c/0x64) [ 3.119788] [<c04036f0>] (__pm_runtime_resume) from [<c0512728>] (__mmc_claim_host+0x170/0x1b0) [ 3.119795] [<c0512728>] (__mmc_claim_host) from [<c0514e2c>] (mmc_rescan+0x54/0x348) [ 3.119807] [<c0514e2c>] (mmc_rescan) from [<c0130dac>] (process_one_work+0x120/0x3f4) [ 3.119815] [<c0130dac>] (process_one_work) from [<c01310b8>] (worker_thread+0x38/0x554) [ 3.119823] [<c01310b8>] (worker_thread) from [<c01365a4>] (kthread+0xdc/0xf4) [ 3.119831] [<c01365a4>] (kthread) from [<c0107878>] (ret_from_fork+0x14/0x3c) [ 3.119834] ---[ end trace a22d652aa3276886 ]---
Fix by adding a 'set_power' callback and restoring the default behaviour prior to commit 918f4cbd4340 ("mmc: sdhci: restore behavior when setting VDD via external regulator"). The desired behaviour of that commit is gotten by having sdhci-pxav3 provide its own set_power callback.
--- drivers/mmc/host/sdhci-pxav3.c | 22 ++++++++++++++++++++++ drivers/mmc/host/sdhci.c | 39 ++++++++++++++++++++++++++++++--------- drivers/mmc/host/sdhci.h | 4 ++++ 3 files changed, 56 insertions(+), 9 deletions(-)
drivers/mmc/host/sdhci-pxav3.c +22 -0
@@ -307,8 +307,30 @@ static void pxav3_set_uhs_signaling(stru __func__, uhs, ctrl_2); } +static void pxav3_set_power (struct sdhci_host *host,unsigned char mode, +unsigned short vdd) +{ +struct mmc_host *mmc = host->mmc; +u8 pwr = host->pwr; + +sdhci_set_power (host, mode, vdd); + +if (host->pwr == pwr) +return ; + +if (host->pwr ==0 ) + vdd =0 ; + +if (!IS_ERR (mmc->supply.vmmc)) { +spin_unlock_irq (&host->lock); +mmc_regulator_set_ocr (mmc, mmc->supply.vmmc, vdd); +spin_lock_irq (&host->lock); + } +} +static const struct sdhci_ops pxav3_sdhci_ops = { .set_clock = sdhci_set_clock, + .set_power = pxav3_set_power, .platform_send_init_74_clocks = pxav3_gen_init_74_clocks, .get_max_clock = sdhci_pltfm_clk_get_max_clock, .set_bus_width = sdhci_set_bus_width,
drivers/mmc/host/sdhci.c +30 -9
@@ -1284,10 +1284,24 @@ clock_set: }EXPORT_SYMBOL_GPL (sdhci_set_clock); -static void sdhci_set_power (struct sdhci_host *host,unsigned char mode, -unsigned short vdd) +static void sdhci_set_power_reg (struct sdhci_host *host,unsigned char mode, +unsigned short vdd) {struct mmc_host *mmc = host->mmc; + +spin_unlock_irq (&host->lock); +mmc_regulator_set_ocr (mmc, mmc->supply.vmmc, vdd); +spin_lock_irq (&host->lock); + +if (mode !=MMC_POWER_OFF ) +sdhci_writeb (host,SDHCI_POWER_ON ,SDHCI_POWER_CONTROL ); +else +sdhci_writeb (host,0 ,SDHCI_POWER_CONTROL ); +} + +void sdhci_set_power (struct sdhci_host *host,unsigned char mode, +unsigned short vdd) +{u8 pwr =0 ;if (mode !=MMC_POWER_OFF ) {
@@ -1319,7 +1333,6 @@ static void sdhci_set_power(struct sdhcisdhci_writeb (host,0 ,SDHCI_POWER_CONTROL );if (host->quirks2 &SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON )sdhci_runtime_pm_bus_off (host); - vdd =0 ; }else {/* * Spec says that we should clear the power reg before setting
@@ -1350,12 +1363,20 @@ static void sdhci_set_power(struct sdhciif (host->quirks &SDHCI_QUIRK_DELAY_AFTER_POWER )mdelay (10 ); } +} +EXPORT_SYMBOL_GPL (sdhci_set_power); -if (!IS_ERR (mmc->supply.vmmc)) { -spin_unlock_irq (&host->lock); -mmc_regulator_set_ocr (mmc, mmc->supply.vmmc, vdd); -spin_lock_irq (&host->lock); - } +static void __sdhci_set_power (struct sdhci_host *host,unsigned char mode, +unsigned short vdd) +{ +struct mmc_host *mmc = host->mmc; + +if (host->ops->set_power) + host->ops->set_power (host, mode, vdd); +else if (!IS_ERR (mmc->supply.vmmc)) +sdhci_set_power_reg (host, mode, vdd); +else +sdhci_set_power (host, mode, vdd); }/*****************************************************************************\
@@ -1505,7 +1526,7 @@ static void sdhci_do_set_ios(struct sdhc } } -sdhci_set_power (host, ios->power_mode, ios->vdd); +__sdhci_set_power (host, ios->power_mode, ios->vdd);if (host->ops->platform_send_init_74_clocks) host->ops->platform_send_init_74_clocks (host, ios->power_mode);
drivers/mmc/host/sdhci.h +4 -0
@@ -529,6 +529,8 @@ struct sdhci_ops {#endif void (*set_clock)(struct sdhci_host *host,unsigned int clock); +void (*set_power)(struct sdhci_host *host,unsigned char mode, +unsigned short vdd);int (*enable_dma)(struct sdhci_host *host);unsigned int (*get_max_clock)(struct sdhci_host *host);
@@ -660,6 +662,8 @@ static inline bool sdhci_sdio_irq_enable }void sdhci_set_clock (struct sdhci_host *host,unsigned int clock); +void sdhci_set_power (struct sdhci_host *host,unsigned char mode, +unsigned short vdd);void sdhci_set_bus_width (struct sdhci_host *host,int width);void sdhci_reset (struct sdhci_host *host,u8 mask);void sdhci_set_uhs_signaling (struct sdhci_host *host,unsigned timing);
Greg Kroah-Hartman
maintainerPATCH 146/312 perf tools: Fix perf regs mask generation
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
commit f47822078dece7189cad0a5f472f148e5e916736 upstream.
On some architectures (powerpc in particular), the number of registers exceeds what can be represented in an integer bitmask. Ensure we generate the proper bitmask on such platforms.
--- tools/perf/util/perf_regs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/perf/util/perf_regs.c +4 -4
@@ -12,18 +12,18 @@ int perf_reg_value(u64 *valp, struct regint i, idx =0 ;u64 mask = regs->mask; -if (regs->cache_mask & (1 << id)) +if (regs->cache_mask & (1ULL << id)) goto out; -if (!(mask & (1 << id))) +if (!(mask & (1ULL << id)))return -EINVAL ;for (i =0 ; i < id; i++) { -if (mask & (1 << i)) +if (mask & (1ULL << i)) idx++; } - regs->cache_mask |= (1 << id); + regs->cache_mask |= (1ULL << id); regs->cache_regs[id] = regs->regs[idx]; out:
Greg Kroah-Hartman
maintainerPATCH 147/312 powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint()
In reply to Greg Kroah-HartmanFrom: Michael Neuling <[email protected]>
commit 6bcb80143e792becfd2b9cc6a339ce523e4e2219 upstream.
At the start of __tm_recheckpoint() we save the kernel stack pointer (r1) in SPRG SCRATCH0 (SPRG2) so that we can restore it after the trecheckpoint.
Unfortunately, the same SPRG is used in the SLB miss handler. If an SLB miss is taken between the save and restore of r1 to the SPRG, the SPRG is changed and hence r1 is also corrupted. We can end up with the following crash when we start using r1 again after the restore from the SPRG:
Oops: Bad kernel stack pointer, sig: 6 [#1] SMP NR_CPUS=2048 NUMA pSeries CPU: 658 PID: 143777 Comm: htm_demo Tainted: G EL X 4.4.13-0-default #1 task: c0000b56993a7810 ti: c00000000cfec000 task.ti: c0000b56993bc000 NIP: c00000000004f188 LR: 00000000100040b8 CTR: 0000000010002570 REGS: c00000000cfefd40 TRAP: 0300 Tainted: G EL X (4.4.13-0-default) MSR: 8000000300001033 <SF,ME,IR,DR,RI,LE> CR: 02000424 XER: 20000000 CFAR: c000000000008468 DAR: 00003ffd84e66880 DSISR: 40000000 SOFTE: 0 PACATMSCRATCH: 00003ffbc865e680 GPR00: fffffffcfabc4268 00003ffd84e667a0 00000000100d8c38 000000030544bb80 GPR04: 0000000000000002 00000000100cf200 0000000000000449 00000000100cf100 GPR08: 000000000000c350 0000000000002569 0000000000002569 00000000100d6c30 GPR12: 00000000100d6c28 c00000000e6a6b00 00003ffd84660000 0000000000000000 GPR16: 0000000000000003 0000000000000449 0000000010002570 0000010009684f20 GPR20: 0000000000800000 00003ffd84e5f110 00003ffd84e5f7a0 00000000100d0f40 GPR24: 0000000000000000 0000000000000000 0000000000000000 00003ffff0673f50 GPR28: 00003ffd84e5e960 00000000003d0f00 00003ffd84e667a0 00003ffd84e5e680 NIP [c00000000004f188] restore_gprs+0x110/0x17c LR [00000000100040b8] 0x100040b8 Call Trace: Instruction dump: f8a1fff0 e8e700a8 38a00000 7ca10164 e8a1fff8 e821fff0 7c0007dd 7c421378 7db142a6 7c3242a6 38800002 7c810164 <e9c100e0> e9e100e8 ea0100f0 ea2100f8
We hit this on large memory machines (> 2TB) but it can also be hit on smaller machines when 1TB segments are disabled.
To hit this, you also need to be virtualised to ensure SLBs are periodically removed by the hypervisor.
This patches moves the saving of r1 to the SPRG to the region where we are guaranteed not to take any further SLB misses.
--- arch/powerpc/kernel/tm.S | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/powerpc/kernel/tm.S +1 -2
@@ -352,8 +352,6 @@ _GLOBAL(__tm_recheckpoint) */ subi r7, r7, STACK_FRAME_OVERHEAD - SET_SCRATCH0(r1) - mfmsr r6 /* R4 = original MSR to indicate whether thread used FP/Vector etc. */
@@ -482,6 +480,7 @@ restore_gprs: * until we turn MSR RI back on. */ + SET_SCRATCH0(r1) ld r5, -8(r1) ld r1, -16(r1)
Greg Kroah-Hartman
maintainerPATCH 148/312 powerpc/book3s: Fix MCE console messages for unrecoverable MCE.
In reply to Greg Kroah-HartmanFrom: Mahesh Salgaonkar <[email protected]>
commit c74dd88e77d3ecbc9e55c78796d82c9aa21cabad upstream.
When machine check occurs with MSR(RI=0), it means MC interrupt is unrecoverable and kernel goes down to panic path. But the console message still shows it as recovered. This patch fixes the MCE console messages.
--- arch/powerpc/kernel/mce.c | 3 ++- arch/powerpc/platforms/powernv/opal.c | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kernel/mce.c +2 -1
@@ -92,7 +92,8 @@ void save_mce_event(struct pt_regs *regs mce->in_use =1 ; mce->initiator =MCE_INITIATOR_CPU ; -if (handled) +/* Mark it recovered if we have handled it and MSR(RI=1). */ +if (handled && (regs->msr &MSR_RI )) mce->disposition =MCE_DISPOSITION_RECOVERED ;else mce->disposition =MCE_DISPOSITION_NOT_RECOVERED ;
arch/powerpc/platforms/powernv/opal.c +1 -0
@@ -401,6 +401,7 @@ static int opal_recover_mce(struct pt_reif (!(regs->msr &MSR_RI )) {/* If MSR_RI isn't set, we cannot recover */ +pr_err ("Machine check interrupt unrecoverable: MSR(RI=0)\n" ); recovered =0 ; }else if (evt->disposition ==MCE_DISPOSITION_RECOVERED ) {/* Platform corrected itself */
Greg Kroah-Hartman
maintainerPATCH 149/312 sctp: fix the transports round robin issue when init is retransmitted
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit 39d2adebf137de5f900843f69f5e500932e31047 upstream.
prior to this patch, at the beginning if we have two paths in one assoc, they may have the same params other than the last_time_heard, it will try the paths like this:
1st cycle
try trans1 fail.
then trans2 is selected.(cause it's last_time_heard is after trans1).
2nd cycle:
try trans2 fail
then trans2 is selected.(cause it's last_time_heard is after trans1).
3rd cycle:
try trans2 fail
then trans2 is selected.(cause it's last_time_heard is after trans1).
....
trans1 will never have change to be selected, which is not what we expect. we should keeping round robin all the paths if they are just added at the beginning.
So at first every tranport's last_time_heard should be initialized 0, so that we ensure they have the same value at the beginning, only by this, all the transports could get equal chance to be selected.
Then for sctp_trans_elect_best, it should return the trans_next one when *trans == *trans_next, so that we can try next if it fails, but now it always return trans. so we can fix it by exchanging these two params when we calls sctp_trans_elect_tie().
--- net/sctp/associola.c | 2 +- net/sctp/transport.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/sctp/associola.c +1 -1
@@ -1290,7 +1290,7 @@ static struct sctp_transport *sctp_transif (score_curr > score_best)return curr;else if (score_curr == score_best) -return sctp_trans_elect_tie (curr, best); +return sctp_trans_elect_tie (best, curr);else return best; }
net/sctp/transport.c +1 -1
@@ -72,7 +72,7 @@ static struct sctp_transport *sctp_trans*/ peer->rto =msecs_to_jiffies (net->sctp.rto_initial); - peer->last_time_heard =ktime_get (); + peer->last_time_heard =ktime_set (0 ,0 ); peer->last_time_ecne_reduced = jiffies; peer->param_flags = SPP_HB_DISABLE |
Greg Kroah-Hartman
maintainerPATCH 150/312 sunrpc: Update RPCBIND_MAXNETIDLEN
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit 4b9c7f9db9a003f5c342184dc4401c1b7f2efb39 upstream.
Commit 176e21ee2ec8 ("SUNRPC: Support for RPC over AF_LOCAL transports") added a 5-character netid, but did not bump RPCBIND_MAXNETIDLEN from 4 to 5.
--- include/linux/sunrpc/msg_prot.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/sunrpc/msg_prot.h +2 -2
@@ -158,9 +158,9 @@ typedef __be32 rpc_fraghdr;/* * Note that RFC 1833 does not put any size restrictions on the -* netid string, but all currently defined netid's fit in 4 bytes. +* netid string, but all currently defined netid's fit in 5 bytes. */ -#define RPCBIND_MAXNETIDLEN (4u) +#define RPCBIND_MAXNETIDLEN (5u)/* * Universal addresses are introduced in RFC 1833 and further spelled
Greg Kroah-Hartman
maintainerPATCH 151/312 NFC: nci: memory leak in nci_core_conn_create()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit c6dc65d885b98898bf287aaf44e020077b41769f upstream.
I've moved the check for "number_destination_params" forward a few lines to avoid leaking "cmd".
--- net/nfc/nci/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/nfc/nci/core.c +3 -3
@@ -610,14 +610,14 @@ int nci_core_conn_create(struct nci_devstruct nci_core_conn_create_cmd *cmd;struct core_conn_create_data data; +if (!number_destination_params) +return -EINVAL ; + data.length = params_len +sizeof (struct nci_core_conn_create_cmd ); cmd =kzalloc (data.length,GFP_KERNEL );if (!cmd)return -ENOMEM ; -if (!number_destination_params) -return -EINVAL ; - cmd->destination_type = destination_type; cmd->number_destination_params = number_destination_params;memcpy (cmd->params, params, params_len);
Greg Kroah-Hartman
maintainerPATCH 152/312 net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit d5c3d84657db57bd23ecd58b97f1c99dd42a7b80 upstream.
Commit 2c7b49212a86 ("phy: fix the use of PHY_IGNORE_INTERRUPT") changed a hunk in phy_state_machine() in the PHY_RUNNING case which was not needed. The change essentially makes the PHY library treat PHY devices with PHY_IGNORE_INTERRUPT to keep polling for the PHY device, even though the intent is not to do it.
Fix this by reverting that specific hunk, which makes the PHY state machine wait for state changes, and stay in the PHY_RUNNING state for as long as needed.
--- drivers/net/phy/phy.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/net/phy/phy.c +10 -5
@@ -912,10 +912,10 @@ void phy_state_machine(struct work_struc phydev->adjust_link (phydev->attached_dev);break ;case PHY_RUNNING : -/* Only register a CHANGE if we are polling or ignoring -* interrupts and link changed since latest checking. +/* Only register a CHANGE if we are polling and link changed +* since latest checking. */ -if (!phy_interrupt_is_valid (phydev)) { +if (phydev->irq ==PHY_POLL ) { old_link = phydev->link; err =phy_read_status (phydev);if (err)
@@ -1015,8 +1015,13 @@ void phy_state_machine(struct work_strucdev_dbg (&phydev->dev,"PHY state change %s -> %s\n" ,phy_state_to_str (old_state),phy_state_to_str (phydev->state)); -queue_delayed_work (system_power_efficient_wq, &phydev->state_queue, -PHY_STATE_TIME *HZ ); +/* Only re-schedule a PHY state machine change if we are polling the +* PHY, if PHY_IGNORE_INTERRUPT is set, then we will be moving +* between states from phy_mac_interrupt() +*/ +if (phydev->irq ==PHY_POLL ) +queue_delayed_work (system_power_efficient_wq, &phydev->state_queue, +PHY_STATE_TIME *HZ ); }void phy_mac_interrupt (struct phy_device *phydev,int new_link)
Greg Kroah-Hartman
maintainerPATCH 153/312 net: phy: Fix phy_mac_interrupt()
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit deccd16f91f930af8e91ffbbfc839d0ad8da999d upstream.
Commit 5ea94e7686a3 ("phy: add phy_mac_interrupt()") to use with PHY_IGNORE_INTERRUPT added a cancel_work_sync() into phy_mac_interrupt() which is allowed to sleep, whereas phy_mac_interrupt() is expected to be callable from interrupt context.
Now that we have fixed how the PHY state machine treats PHY_IGNORE_INTERRUPT with respect to state changes, we can just set the new link state, and queue the PHY state machine for execution so it is going to read the new link state.
For that to work properly, we need to update phy_change() not to try to invoke any interrupt callbacks if we have configured the PHY device for PHY_IGNORE_INTERRUPT, because that PHY device and its driver are not required to implement those.
--- drivers/net/phy/phy.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
drivers/net/phy/phy.c +18 -13
@@ -699,25 +699,29 @@ void phy_change(struct work_struct *workstruct phy_device *phydev = container_of(work, struct phy_device, phy_queue); -if (phydev->drv->did_interrupt && - !phydev->drv->did_interrupt (phydev)) - goto ignore; +if (phy_interrupt_is_valid (phydev)) { +if (phydev->drv->did_interrupt && + !phydev->drv->did_interrupt (phydev)) + goto ignore; -if (phy_disable_interrupts (phydev)) - goto phy_err; +if (phy_disable_interrupts (phydev)) + goto phy_err; + }mutex_lock (&phydev->lock);if ((PHY_RUNNING == phydev->state) || (PHY_NOLINK == phydev->state)) phydev->state =PHY_CHANGELINK ;mutex_unlock (&phydev->lock); -atomic_dec (&phydev->irq_disable); -enable_irq (phydev->irq); +if (phy_interrupt_is_valid (phydev)) { +atomic_dec (&phydev->irq_disable); +enable_irq (phydev->irq); -/* Reenable interrupts */ -if (PHY_HALTED != phydev->state && -phy_config_interrupt (phydev,PHY_INTERRUPT_ENABLED )) - goto irq_enable_err; +/* Reenable interrupts */ +if (PHY_HALTED != phydev->state && +phy_config_interrupt (phydev,PHY_INTERRUPT_ENABLED )) + goto irq_enable_err; + }/* reschedule state queue work to run as soon as possible */ cancel_delayed_work_sync (&phydev->state_queue);
@@ -1026,9 +1030,10 @@ void phy_state_machine(struct work_strucvoid phy_mac_interrupt (struct phy_device *phydev,int new_link) { -cancel_work_sync (&phydev->phy_queue); phydev->link = new_link; -schedule_work (&phydev->phy_queue); + +/* Trigger a state machine change */ +queue_work (system_power_efficient_wq, &phydev->phy_queue); }EXPORT_SYMBOL (phy_mac_interrupt);
Greg Kroah-Hartman
maintainerPATCH 154/312 net: phy: bcm7xxx: Fix shadow mode 2 disabling
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit 50d899808d33a5b0aa82be23e824119944042689 upstream.
The clear and set masks in the call to phy_set_clr_bits() called from bcm7xxx_config_init() are inverted. We need to fix this by swapping the two arguments, that is, set 0 bits, but clear the shade mode 2 enable bit.
--- drivers/net/phy/bcm7xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/bcm7xxx.c +1 -1
@@ -270,7 +270,7 @@ static int bcm7xxx_config_init(struct phphy_write (phydev,MII_BCM7XXX_100TX_FALSE_CAR ,0x7555 );/* reset shadow mode 2 */ - ret =phy_set_clr_bits (phydev,MII_BCM7XXX_TEST ,MII_BCM7XXX_SHD_MODE_2 ,0 ); + ret =phy_set_clr_bits (phydev,MII_BCM7XXX_TEST ,0 ,MII_BCM7XXX_SHD_MODE_2 );if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 155/312 of_mdio: fix node leak in of_phy_register_fixed_link error path
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 48c1699d5335bc045b50989a06b1c526b17a25ff upstream.
Make sure to drop the of_node reference also on failure to parse the speed property in of_phy_register_fixed_link().
--- drivers/of/of_mdio.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/of/of_mdio.c +4 -1
@@ -334,8 +334,11 @@ int of_phy_register_fixed_link(struct de status.link =1 ; status.duplex =of_property_read_bool (fixed_link_node,"full-duplex" ); -if (of_property_read_u32 (fixed_link_node,"speed" , &status.speed)) +if (of_property_read_u32 (fixed_link_node,"speed" , + &status.speed)) { +of_node_put (fixed_link_node);return -EINVAL ; + } status.pause =of_property_read_bool (fixed_link_node,"pause" ); status.asym_pause =of_property_read_bool (fixed_link_node,"asym-pause" );
Greg Kroah-Hartman
maintainerPATCH 156/312 phy: micrel: Fix finding PHY properties in MAC node for KSZ9031.
In reply to Greg Kroah-HartmanFrom: Roosen Henri <[email protected]>
commit b4c19f71252e3b6b8c6478fd712c592f00b11438 upstream.
Commit 651df2183543 ("phy: micrel: Fix finding PHY properties in MAC
node.") only fixes finding PHY properties in MAC node for KSZ9021. This
commit applies the same fix for KSZ9031.
--- drivers/net/phy/micrel.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/phy/micrel.c +10 -2
@@ -482,9 +482,17 @@ static int ksz9031_config_init(struct ph"txd2-skew-ps" ,"txd3-skew-ps" };static const char *control_skews[2 ] = {"txen-skew-ps" ,"rxdv-skew-ps" }; +const struct device *dev_walker; -if (!of_node && dev->parent->of_node) - of_node = dev->parent->of_node; +/* The Micrel driver has a deprecated option to place phy OF +* properties in the MAC node. Walk up the tree of devices to +* find a device with an OF node. +*/ + dev_walker = &phydev->dev; +do { + of_node = dev_walker->of_node; + dev_walker = dev_walker->parent; + }while (!of_node && dev_walker);if (of_node) { ksz9031_of_load_skew_values(phydev, of_node,
Greg Kroah-Hartman
maintainerPATCH 157/312 net: dsa: slave: fix of-node leak and phy priority
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 0d8f3c67151faaa80e332c254372dca58fb2a9d4 upstream.
Make sure to drop the reference taken by of_parse_phandle() before returning from dsa_slave_phy_setup().
Note that this also modifies the PHY priority so that any fixed-link node is only parsed when no phy-handle is given, which is in accordance with the common scheme for this.
--- net/dsa/slave.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/dsa/slave.c +5 -2
@@ -1031,7 +1031,7 @@ static int dsa_slave_phy_setup(struct ds p->phy_interface = mode; phy_dn =of_parse_phandle (port_dn,"phy-handle" ,0 ); -if (of_phy_is_fixed_link (port_dn)) { +if (!phy_dn &&of_phy_is_fixed_link (port_dn)) {/* In the case of a fixed PHY, the DT node associated * to the fixed PHY is the Port DT node */
@@ -1041,7 +1041,7 @@ static int dsa_slave_phy_setup(struct dsreturn ret; } phy_is_fixed = true; - phy_dn = port_dn; + phy_dn =of_node_get (port_dn); }if (ds->drv->get_phy_flags)
@@ -1060,6 +1060,7 @@ static int dsa_slave_phy_setup(struct ds ret =dsa_slave_phy_connect (p, slave_dev, phy_id);if (ret) {netdev_err (slave_dev,"failed to connect to phy%d: %d\n" , phy_id, ret); +of_node_put (phy_dn);return ret; } }else {
@@ -1068,6 +1069,8 @@ static int dsa_slave_phy_setup(struct ds phy_flags, p->phy_interface); } + +of_node_put (phy_dn); }if (p->phy && phy_is_fixed)
Greg Kroah-Hartman
maintainerPATCH 158/312 drivers: net: cpsw: dont ignore phy-mode if phy-handle is used
In reply to Greg Kroah-HartmanFrom: David Rivshin <[email protected]>
commit ae092b5bded24d5dc7dae0e0aef4669c169ce874 upstream.
The phy-mode emac property was only being processed in the phy_id or fixed-link cases. However if phy-handle was specified instead, an error message would complain about the lack of phy_id or fixed-link, and then jump past the of_get_phy_mode(). This would result in the PHY mode defaulting to MII, regardless of what the devicetree specified.
--- drivers/net/ethernet/ti/cpsw.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/cpsw.c +8 -2
@@ -2060,7 +2060,11 @@ static int cpsw_probe_dt(struct cpsw_pla slave_data->phy_node =of_parse_phandle (slave_node,"phy-handle" ,0 ); parp =of_get_property (slave_node,"phy_id" , &lenp); -if (of_phy_is_fixed_link (slave_node)) { +if (slave_data->phy_node) { +dev_dbg (&pdev->dev, +"slave[%d] using phy-handle=\"%s\"\n" , + i, slave_data->phy_node->full_name); + }else if (of_phy_is_fixed_link (slave_node)) {struct device_node *phy_node;struct phy_device *phy_dev;
@@ -2097,7 +2101,9 @@ static int cpsw_probe_dt(struct cpsw_pla PHY_ID_FMT, mdio->name, phyid);put_device (&mdio->dev); }else { -dev_err (&pdev->dev,"No slave[%d] phy_id or fixed-link property\n" , i); +dev_err (&pdev->dev, +"No slave[%d] phy_id, phy-handle, or fixed-link property\n" , + i); goto no_phy_slave; } slave_data->phy_if =of_get_phy_mode (slave_node);
Greg Kroah-Hartman
maintainerPATCH 159/312 iommu/dma: Respect IOMMU aperture when allocating
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
commit c987ff0d3cb37d7fe1ddaa370811dfd9f73643fa upstream.
Where a device driver has set a 64-bit DMA mask to indicate the absence of addressing limitations, we still need to ensure that we don't allocate IOVAs beyond the actual input size of the IOMMU. The reported aperture is the most reliable way we have of inferring that input address size, so use that to enforce a hard upper limit where available.
--- drivers/iommu/dma-iommu.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/iommu/dma-iommu.c +7 -4
@@ -152,12 +152,15 @@ int dma_direction_to_prot(enum dma_data_ } } -static struct iova *__alloc_iova (struct iova_domain *iovad,size_t size, +static struct iova *__alloc_iova (struct iommu_domain *domain,size_t size,dma_addr_t dma_limit) { +struct iova_domain *iovad = domain->iova_cookie;unsigned long shift =iova_shift (iovad);unsigned long length =iova_align (iovad, size) >> shift; +if (domain->geometry.force_aperture) + dma_limit =min (dma_limit, domain->geometry.aperture_end);/* * Enforce size-alignment to be safe - there could perhaps be an * attribute to control this per-device, or at least per-domain...
@@ -297,7 +300,7 @@ struct page **iommu_dma_alloc(struct devif (!pages)return NULL ; - iova =__alloc_iova (iovad, size, dev->coherent_dma_mask); + iova =__alloc_iova (domain, size, dev->coherent_dma_mask);if (!iova) goto out_free_pages;
@@ -369,7 +372,7 @@ dma_addr_t iommu_dma_map_page(struct devphys_addr_t phys =page_to_phys (page) + offset;size_t iova_off =iova_offset (iovad, phys);size_t len =iova_align (iovad, size + iova_off); -struct iova *iova =__alloc_iova (iovad, len,dma_get_mask (dev)); +struct iova *iova =__alloc_iova (domain, len,dma_get_mask (dev));if (!iova)return DMA_ERROR_CODE ;
@@ -483,7 +486,7 @@ int iommu_dma_map_sg(struct device *dev, prev = s; } - iova =__alloc_iova (iovad, iova_len,dma_get_mask (dev)); + iova =__alloc_iova (domain, iova_len,dma_get_mask (dev));if (!iova) goto out_restore_sg;
Greg Kroah-Hartman
maintainerPATCH 160/312 mdio-sun4i: oops in error handling in probe
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 227f33beab746aeec4ef3305bd17b1d374df09e7 upstream.
We could end up dereferencing an error pointer when we call regulator_disable().
--- drivers/net/phy/mdio-sun4i.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/phy/mdio-sun4i.c +3 -1
@@ -134,6 +134,7 @@ static int sun4i_mdio_probe(struct platf }dev_info (&pdev->dev,"no regulator found\n" ); + data->regulator =NULL ; }else { ret =regulator_enable (data->regulator);if (ret)
@@ -149,7 +150,8 @@ static int sun4i_mdio_probe(struct platfreturn 0 ; err_out_disable_regulator: -regulator_disable (data->regulator); +if (data->regulator) +regulator_disable (data->regulator); err_out_free_mdiobus:mdiobus_free (bus);return ret;