1. 03 Nov, 2017 12 commits
    • Stafford Horne's avatar
      openrisc: support framepointers and STACKTRACE_SUPPORT · eecac38b
      Stafford Horne authored
      For lockdep support a reliable stack trace mechanism is needed.  This
      patch adds support in OpenRISC for the stacktrace framework, implemented
      by a simple unwinder api.  The unwinder api supports both framepointer
      and basic stack tracing.
      
      The unwinder is now used to replace the stack_dump() implementation as
      well. The new traces are inline with other architectures trace format:
      
       Call trace:
       [<c0004448>] show_stack+0x3c/0x58
       [<c031c940>] dump_stack+0xa8/0xe4
       [<c0008104>] __cpu_up+0x64/0x130
       [<c000d268>] bringup_cpu+0x3c/0x178
       [<c000d038>] cpuhp_invoke_callback+0xa8/0x1fc
       [<c000d680>] cpuhp_up_callbacks+0x44/0x14c
       [<c000e400>] cpu_up+0x14c/0x1bc
       [<c041da60>] smp_init+0x104/0x15c
       [<c033843c>] ? kernel_init+0x0/0x140
       [<c0415e04>] kernel_init_freeable+0xbc/0x25c
       [<c033843c>] ? kernel_init+0x0/0x140
       [<c0338458>] kernel_init+0x1c/0x140
       [<c003a174>] ? schedule_tail+0x18/0xa0
       [<c0006b80>] ret_from_fork+0x1c/0x9c
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      eecac38b
    • Stefan Kristiansson's avatar
      openrisc: add simple_smp dts and defconfig for simulators · 306e5e50
      Stefan Kristiansson authored
      Simple enough to be compatible with simulation environments,
      such as verilated systems, QEMU and other targets supporting OpenRISC
      SMP.  This also supports our base FPGA SoC's if the cpu frequency is
      upped to 50Mhz.
      Signed-off-by: default avatarStefan Kristiansson <stefan.kristiansson@saunalahti.fi>
      [shorne@gmail.com: Added defconfig]
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      306e5e50
    • Jan Henrik Weinstock's avatar
      openrisc: add cacheflush support to fix icache aliasing · 4ee93d80
      Jan Henrik Weinstock authored
      On OpenRISC the icache does not snoop data stores.  This can cause
      aliasing as reported by Jan. This patch fixes the issue to ensure icache
      is properly synchronized when code is written to memory.  It supports both
      SMP and UP flushing.
      
      This supports dcache flush as well for architectures that do not support
      write-through caches; most OpenRISC implementations do implement
      write-through cache however. Dcache flushes are done only on a single
      core as OpenRISC dcaches all support snooping of bus stores.
      Signed-off-by: default avatarJan Henrik Weinstock <jan.weinstock@ice.rwth-aachen.de>
      [shorne@gmail.com: Squashed patches and wrote commit message]
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      4ee93d80
    • Stafford Horne's avatar
      openrisc: sleep instead of spin on secondary wait · c0567184
      Stafford Horne authored
      Currently we do a spin on secondary cpus when waiting to boot.  This
      theoretically causes issues with power consumption and does cause issues
      with qemu cycle burning (it starves cpu 0 from actually being able to
      boot.)
      
      This change puts each secondary cpu to sleep if they have a power
      management unit, then signals them to wake via IPI when its time to boot.
      If the cpus have no power management unit they will loop as before.
      
      Note: The wakeup IPI requires a special interrupt handler as on secondary
      cpu's the interrupt infrastructure is not yet established.  This
      interrupt handler is set and reset by updating SPR_EVBAR.
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      c0567184
    • Stafford Horne's avatar
      openrisc: fix initial preempt state for secondary cpu tasks · b441aab7
      Stafford Horne authored
      During SMP testing we were getting the below warning after booting the
      secondary cpu:
      
      [    0.060000] BUG: scheduling while atomic: swapper/1/0/0x00000000
      
      This change follows similar patterns from other architectures to start
      the schduler with preempt disabled.
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      b441aab7
    • Stefan Kristiansson's avatar
      openrisc: initial SMP support · 8e6d08e0
      Stefan Kristiansson authored
      This patch introduces the SMP support for the OpenRISC architecture.
      The SMP architecture requires cores which have multi-core features which
      have been introduced a few years back including:
      
       - New SPRS SPR_COREID SPR_NUMCORES
       - Shadow SPRs
       - Atomic Instructions
       - Cache Coherency
       - A wired in IPI controller
      
      This patch adds all of the SMP specific changes to core infrastructure,
      it looks big but it needs to go all together as its hard to split this
      one up.
      
      Boot loader spinning of second cpu is not supported yet, it's assumed
      that Linux is booted straight after cpu reset.
      
      The bulk of these changes are trivial changes to refactor to use per cpu
      data structures throughout.  The addition of the smp.c and changes in
      time.c are the changes.  Some specific notes:
      
      MM changes
      ----------
      The reason why this is created as an array, and not with DEFINE_PER_CPU
      is that doing it this way, we'll save a load in the tlb-miss handler
      (the load from __per_cpu_offset).
      
      TLB Flush
      ---------
      The SMP implementation of flush_tlb_* works by sending out a
      function-call IPI to all the non-local cpus by using the generic
      on_each_cpu() function.
      
      Currently, all flush_tlb_* functions will result in a flush_tlb_all(),
      which has always been the behaviour in the UP case.
      
      CPU INFO
      --------
      This creates a per cpu cpuinfo struct and fills it out accordingly for
      each activated cpu.  show_cpuinfo is also updated to reflect new version
      information in later versions of the spec.
      
      SMP API
      -------
      This imitates the arm64 implementation by having a smp_cross_call
      callback that can be set by set_smp_cross_call to initiate an IPI and a
      handle_IPI function that is expected to be called from an IPI irqchip
      driver.
      Signed-off-by: default avatarStefan Kristiansson <stefan.kristiansson@saunalahti.fi>
      [shorne@gmail.com: added cpu stop, checkpatch fixes, wrote commit message]
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      8e6d08e0
    • Stafford Horne's avatar
      irqchip: add initial support for ompic · 9b54470a
      Stafford Horne authored
      IPI driver for the Open Multi-Processor Interrupt Controller (ompic) as
      described in the Multi-core support section of the OpenRISC 1.2
      architecture specification:
      
        https://github.com/openrisc/doc/raw/master/openrisc-arch-1.2-rev0.pdf
      
      Each OpenRISC core contains a full interrupt controller which is used in
      the SMP architecture for interrupt balancing.  This IPI device, the
      ompic, is the only external device required for enabling SMP on
      OpenRISC.
      
      Pending ops are stored in a memory bit mask which can allow multiple
      pending operations to be set and serviced at a time. This is mostly
      borrowed from the alpha IPI implementation.
      Reviewed-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
      Acked-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarStefan Kristiansson <stefan.kristiansson@saunalahti.fi>
      [shorne@gmail.com: converted ops to bitmask, wrote commit message]
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      9b54470a
    • Stafford Horne's avatar
      dt-bindings: add openrisc to vendor prefixes list · fab8be88
      Stafford Horne authored
      Add OpenRISC.io to vendor prefixes.  This is reserved for softcores
      developed by the OpenRISC community.  The OpenRISC community has
      separated from OpenCores.org requiring a new prefix.
      Reviewed-by: default avatarAndreas Färber <afaerber@suse.de>
      Acked-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      fab8be88
    • Stafford Horne's avatar
      openrisc: use qspinlocks and qrwlocks · b5f82176
      Stafford Horne authored
      Enable OpenRISC to use qspinlocks and qrwlocks for upcoming SMP support.
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      b5f82176
    • Stafford Horne's avatar
      openrisc: add 1 and 2 byte cmpxchg support · 489e0f80
      Stafford Horne authored
      OpenRISC only supports hardware instructions that perform 4 byte atomic
      operations.  For enabling qrwlocks for upcoming SMP support 1 and 2 byte
      implementations are needed.  To do this we leverage the 4 byte atomic
      operations and shift/mask the 1 and 2 byte areas as needed.
      
      This heavily borrows ideas and routines from sh and mips, which do
      something similar.
      
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      489e0f80
    • Stefan Kristiansson's avatar
      openrisc: use shadow registers to save regs on exception · 91993c8c
      Stefan Kristiansson authored
      Previously, the area between 0x0-0x100 have been used as a "scratch"
      memory area to temporarily store regs during exception entry. In a
      multi-core environment, this will not work.
      
      This change is to use shadow registers for nested context.
      
      Currently only the "critical" temp load/stores are covered, the
      EMERGENCY_PRINT ones are left as is (when they are used, it's game over
      anyway), they need to be handled as well in the future.
      Signed-off-by: default avatarStefan Kristiansson <stefan.kristiansson@saunalahti.fi>
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      91993c8c
    • Stafford Horne's avatar
      dt-bindings: openrisc: Add OpenRISC platform SoC · ddc92bec
      Stafford Horne authored
      Add devicetree binding documentation for the OpenRISC platform
      opencores,or1ksim.  This is the main OpenRISC reference platform
      supporting multiple FPGA SoC's.
      
      This format is based on some of the mips binding docs as we have
      similar requirements.
      
      Also, update maintainers so openrisc related binding changes are visible
      to the openrisc team.
      Acked-by: default avatarRob Herring <robh@kernel.org>
      Suggested-by: default avatarPavel Machek <pavel@ucw.cz>
      Signed-off-by: default avatarStafford Horne <shorne@gmail.com>
      ddc92bec
  2. 30 Oct, 2017 4 commits
  3. 23 Oct, 2017 4 commits
    • Linus Torvalds's avatar
      Linux 4.14-rc6 · bb176f67
      Linus Torvalds authored
      bb176f67
    • Linus Torvalds's avatar
      Merge tag 'staging-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · dd9d064e
      Linus Torvalds authored
      Pull staging and IIO fixes from Greg KH:
       "Here are a small number of patches to resolve some reported IIO and a
        staging driver problem. Nothing major here, full details are in the
        shortlog below.
      
        All have been in linux-next with no reported issues"
      
      * tag 'staging-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: bcm2835-audio: Fix memory corruption
        iio: adc: at91-sama5d2_adc: fix probe error on missing trigger property
        iio: adc: dln2-adc: fix build error
        iio: dummy: events: Add missing break
        staging: iio: ade7759: fix signed extension bug on shift of a u8
        iio: pressure: zpa2326: Remove always-true check which confuses gcc
        iio: proximity: as3935: noise detection + threshold changes
      dd9d064e
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 17e7637f
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are four small fixes for 4.14-rc6.
      
        Three of them are binder driver fixes for reported issues, and the
        last one is a hyperv driver bugfix. Nothing major, but good fixes to
        get into 4.14-final.
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'char-misc-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        android: binder: Fix null ptr dereference in debug msg
        android: binder: Don't get mm from task
        vmbus: hvsock: add proper sync for vmbus_hvsock_device_unregister()
        binder: call poll_wait() unconditionally.
      17e7637f
    • Linus Torvalds's avatar
      Merge tag 'usb-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 58059921
      Linus Torvalds authored
      Pull USB/PHY fixes from Greg KH:
       "Here are a small number of USB and PHY driver fixes for 4.14-rc6
      
        There is the usual musb and xhci fixes in here, as well as some needed
        phy patches. Also is a nasty regression fix for usbfs that has started
        to hit a lot of people using virtual machines.
      
        All of these have been in linux-next with no reported problems"
      
      * tag 'usb-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (26 commits)
        usb: hub: Allow reset retry for USB2 devices on connect bounce
        USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()
        MAINTAINERS: fix git tree url for musb module
        usb: quirks: add quirk for WORLDE MINI MIDI keyboard
        usb: musb: sunxi: Explicitly release USB PHY on exit
        usb: musb: Check for host-mode using is_host_active() on reset interrupt
        usb: musb: musb_cppi41: Configure the number of channels for DA8xx
        usb: musb: musb_cppi41: Fix cppi41_set_dma_mode() for DA8xx
        usb: musb: musb_cppi41: Fix the address of teardown and autoreq registers
        USB: musb: fix late external abort on suspend
        USB: musb: fix session-bit runtime-PM quirk
        usb: cdc_acm: Add quirk for Elatec TWN3
        USB: devio: Revert "USB: devio: Don't corrupt user memory"
        usb: xhci: Handle error condition in xhci_stop_device()
        usb: xhci: Reset halted endpoint if trb is noop
        xhci: Cleanup current_cmd in xhci_cleanup_command_queue()
        xhci: Identify USB 3.1 capable hosts by their port protocol capability
        USB: serial: metro-usb: add MS7820 device id
        phy: rockchip-typec: Check for errors from tcphy_phy_init()
        phy: rockchip-typec: Don't set the aux voltage swing to 400 mV
        ...
      58059921
  4. 22 Oct, 2017 20 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 02982f85
      Linus Torvalds authored
      Pull input fix from Dmitry Torokhov:
       "A fix for a broken commit in the previous pull breaking automatic
        module loading of input handlers, such ad evdev"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: do not use property bits when generating module alias
      02982f85
    • Dmitry Torokhov's avatar
      Input: do not use property bits when generating module alias · 09c3e01b
      Dmitry Torokhov authored
      The commit 8724ecb0 ("Input: allow matching device IDs on property
      bits") started using property bits when generating module aliases for input
      handlers, but did not adjust the generation of MODALIAS attribute on input
      device uevents, breaking automatic module loading. Given that no handler
      currently uses property bits in their module tables, let's revert this part
      of the commit for now.
      Reported-by: default avatarDamien Wyart <damien.wyart@gmail.com>
      Tested-by: default avatarDamien Wyart <damien.wyart@gmail.com>
      Fixes: 8724ecb0 ("Input: allow matching device IDs on property bits")
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      09c3e01b
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 936fd005
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A couple of fixes addressing the following issues:
      
         - The last polishing for the TLB code, removing the last BUG_ON() and
           the debug file along with tidying up the lazy TLB code.
      
         - Prevent triple fault on 1st Gen. 486 caused by stupidly calling the
           early IDT setup after the first function which causes a fault which
           should be caught by the exception table.
      
         - Limit the mmap of /dev/mem to valid addresses
      
         - Prevent late microcode loading on Broadwell X
      
         - Remove a redundant assignment in the cache info code"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/mm: Limit mmap() of /dev/mem to valid physical addresses
        x86/mm: Remove debug/x86/tlb_defer_switch_to_init_mm
        x86/mm: Tidy up "x86/mm: Flush more aggressively in lazy TLB mode"
        x86/mm/64: Remove the last VM_BUG_ON() from the TLB code
        x86/microcode/intel: Disable late loading on model 79
        x86/idt: Initialize early IDT before cr4_init_shadow()
        x86/cpu/intel_cacheinfo: Remove redundant assignment to 'this_leaf'
      936fd005
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 9e415a8e
      Linus Torvalds authored
      Pull timer fix from Thomas Gleixner:
       "A single fix to make the cs5535 clock event driver robust agaist
        spurious interrupts"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clockevents/drivers/cs5535: Improve resilience to spurious interrupts
      9e415a8e
    • Linus Torvalds's avatar
      Merge branch 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 5670a847
      Linus Torvalds authored
      Pull smp/hotplug fix from Thomas Gleixner:
       "The recent rework of the callback invocation missed to cleanup the
        leftovers of the operation, so under certain circumstances a
        subsequent CPU hotplug operation accesses stale data and crashes.
        Clean it up."
      
      * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        cpu/hotplug: Reset node state after operation
      5670a847
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 085cf9bf
      Linus Torvalds authored
      Pull perf fixes from Thomas Gleixner:
       "A series of fixes for perf tooling:
      
         - Make xyarray return the X/Y size correctly which fixes a crash in
           the exit code.
      
         - Fix the libc path in test so it works not only on Debian/Ubuntu
           correctly
      
         - Check for eBPF file existance and output a useful error message
           instead of failing to compile a non existant file
      
         - Make sure perf_hpp_fmt is not longer references before freeing it
      
         - Use list_del_init() in the histogram code to prevent a crash when
           the already deleted element is deleted again
      
         - Remove the leftovers of the removed '-l' option
      
         - Add reviewer entries to the MAINTAINERS file"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf test shell trace+probe_libc_inet_pton.sh: Be compatible with Debian/Ubuntu
        perf xyarray: Fix wrong processing when closing evsel fd
        perf buildid-list: Fix crash when processing PERF_RECORD_NAMESPACE
        perf record: Fix documentation for a inexistent option '-l'
        perf tools: Add long time reviewers to MAINTAINERS
        perf tools: Check wether the eBPF file exists in event parsing
        perf hists: Add extra integrity checks to fmt_free()
        perf hists: Fix crash in perf_hpp__reset_output_field()
      085cf9bf
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 4f184d7d
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "A set of small fixes mostly in the irq drivers area:
      
         - Make the tango irq chip work correctly, which requires a new
           function in the generiq irq chip implementation
      
         - A set of updates to the GIC-V3 ITS driver removing a bogus BUG_ON()
           and parsing the VCPU table size correctly"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        genirq: generic chip: remove irq_gc_mask_disable_reg_and_ack()
        irqchip/tango: Use irq_gc_mask_disable_and_ack_set
        genirq: generic chip: Add irq_gc_mask_disable_and_ack_set()
        irqchip/gic-v3-its: Add missing changes to support 52bit physical address
        irqchip/gic-v3-its: Fix the incorrect parsing of VCPU table size
        irqchip/gic-v3-its: Fix the incorrect BUG_ON in its_init_vpe_domain()
        DT: arm,gic-v3: Update the ITS size in the examples
      4f184d7d
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · b8d389e8
      Linus Torvalds authored
      Pull objtool fix from Thomas Gleixner:
       "Plug a memory leak in the instruction decoder"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        objtool: Fix memory leak in decode_instructions()
      b8d389e8
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · b5ac3beb
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "A little more than usual this time around. Been travelling, so that is
        part of it.
      
        Anyways, here are the highlights:
      
         1) Deal with memcontrol races wrt. listener dismantle, from Eric
            Dumazet.
      
         2) Handle page allocation failures properly in nfp driver, from Jaku
            Kicinski.
      
         3) Fix memory leaks in macsec, from Sabrina Dubroca.
      
         4) Fix crashes in pppol2tp_session_ioctl(), from Guillaume Nault.
      
         5) Several fixes in bnxt_en driver, including preventing potential
            NVRAM parameter corruption from Michael Chan.
      
         6) Fix for KRACK attacks in wireless, from Johannes Berg.
      
         7) rtnetlink event generation fixes from Xin Long.
      
         8) Deadlock in mlxsw driver, from Ido Schimmel.
      
         9) Disallow arithmetic operations on context pointers in bpf, from
            Jakub Kicinski.
      
        10) Missing sock_owned_by_user() check in sctp_icmp_redirect(), from
            Xin Long.
      
        11) Only TCP is supported for sockmap, make that explicit with a
            check, from John Fastabend.
      
        12) Fix IP options state races in DCCP and TCP, from Eric Dumazet.
      
        13) Fix panic in packet_getsockopt(), also from Eric Dumazet.
      
        14) Add missing locked in hv_sock layer, from Dexuan Cui.
      
        15) Various aquantia bug fixes, including several statistics handling
            cures. From Igor Russkikh et al.
      
        16) Fix arithmetic overflow in devmap code, from John Fastabend.
      
        17) Fix busted socket memory accounting when we get a fault in the tcp
            zero copy paths. From Willem de Bruijn.
      
        18) Don't leave opt->tot_len uninitialized in ipv6, from Eric Dumazet"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (106 commits)
        stmmac: Don't access tx_q->dirty_tx before netif_tx_lock
        ipv6: flowlabel: do not leave opt->tot_len with garbage
        of_mdio: Fix broken PHY IRQ in case of probe deferral
        textsearch: fix typos in library helpers
        rxrpc: Don't release call mutex on error pointer
        net: stmmac: Prevent infinite loop in get_rx_timestamp_status()
        net: stmmac: Fix stmmac_get_rx_hwtstamp()
        net: stmmac: Add missing call to dev_kfree_skb()
        mlxsw: spectrum_router: Configure TIGCR on init
        mlxsw: reg: Add Tunneling IPinIP General Configuration Register
        net: ethtool: remove error check for legacy setting transceiver type
        soreuseport: fix initialization race
        net: bridge: fix returning of vlan range op errors
        sock: correct sk_wmem_queued accounting on efault in tcp zerocopy
        bpf: add test cases to bpf selftests to cover all access tests
        bpf: fix pattern matches for direct packet access
        bpf: fix off by one for range markings with L{T, E} patterns
        bpf: devmap fix arithmetic overflow in bitmap_size calculation
        net: aquantia: Bad udp rate on default interrupt coalescing
        net: aquantia: Enable coalescing management via ethtool interface
        ...
      b5ac3beb
    • Bernd Edlinger's avatar
      stmmac: Don't access tx_q->dirty_tx before netif_tx_lock · 8d5f4b07
      Bernd Edlinger authored
      This is the possible reason for different hard to reproduce
      problems on my ARMv7-SMP test system.
      
      The symptoms are in recent kernels imprecise external aborts,
      and in older kernels various kinds of network stalls and
      unexpected page allocation failures.
      
      My testing indicates that the trouble started between v4.5 and v4.6
      and prevails up to v4.14.
      
      Using the dirty_tx before acquiring the spin lock is clearly
      wrong and was first introduced with v4.6.
      
      Fixes: e3ad57c9 ("stmmac: review RX/TX ring management")
      Signed-off-by: default avatarBernd Edlinger <bernd.edlinger@hotmail.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d5f4b07
    • Eric Dumazet's avatar
      ipv6: flowlabel: do not leave opt->tot_len with garbage · 864e2a1f
      Eric Dumazet authored
      When syzkaller team brought us a C repro for the crash [1] that
      had been reported many times in the past, I finally could find
      the root cause.
      
      If FlowLabel info is merged by fl6_merge_options(), we leave
      part of the opt_space storage provided by udp/raw/l2tp with random value
      in opt_space.tot_len, unless a control message was provided at sendmsg()
      time.
      
      Then ip6_setup_cork() would use this random value to perform a kzalloc()
      call. Undefined behavior and crashes.
      
      Fix is to properly set tot_len in fl6_merge_options()
      
      At the same time, we can also avoid consuming memory and cpu cycles
      to clear it, if every option is copied via a kmemdup(). This is the
      change in ip6_setup_cork().
      
      [1]
      kasan: CONFIG_KASAN_INLINE enabled
      kasan: GPF could be caused by NULL-ptr deref or user memory access
      general protection fault: 0000 [#1] SMP KASAN
      Dumping ftrace buffer:
         (ftrace buffer empty)
      Modules linked in:
      CPU: 0 PID: 6613 Comm: syz-executor0 Not tainted 4.14.0-rc4+ #127
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      task: ffff8801cb64a100 task.stack: ffff8801cc350000
      RIP: 0010:ip6_setup_cork+0x274/0x15c0 net/ipv6/ip6_output.c:1168
      RSP: 0018:ffff8801cc357550 EFLAGS: 00010203
      RAX: dffffc0000000000 RBX: ffff8801cc357748 RCX: 0000000000000010
      RDX: 0000000000000002 RSI: ffffffff842bd1d9 RDI: 0000000000000014
      RBP: ffff8801cc357620 R08: ffff8801cb17f380 R09: ffff8801cc357b10
      R10: ffff8801cb64a100 R11: 0000000000000000 R12: ffff8801cc357ab0
      R13: ffff8801cc357b10 R14: 0000000000000000 R15: ffff8801c3bbf0c0
      FS:  00007f9c5c459700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000020324000 CR3: 00000001d1cf2000 CR4: 00000000001406f0
      DR0: 0000000020001010 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
      Call Trace:
       ip6_make_skb+0x282/0x530 net/ipv6/ip6_output.c:1729
       udpv6_sendmsg+0x2769/0x3380 net/ipv6/udp.c:1340
       inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:762
       sock_sendmsg_nosec net/socket.c:633 [inline]
       sock_sendmsg+0xca/0x110 net/socket.c:643
       SYSC_sendto+0x358/0x5a0 net/socket.c:1750
       SyS_sendto+0x40/0x50 net/socket.c:1718
       entry_SYSCALL_64_fastpath+0x1f/0xbe
      RIP: 0033:0x4520a9
      RSP: 002b:00007f9c5c458c08 EFLAGS: 00000216 ORIG_RAX: 000000000000002c
      RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 00000000004520a9
      RDX: 0000000000000001 RSI: 0000000020fd1000 RDI: 0000000000000016
      RBP: 0000000000000086 R08: 0000000020e0afe4 R09: 000000000000001c
      R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004bb1ee
      R13: 00000000ffffffff R14: 0000000000000016 R15: 0000000000000029
      Code: e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ea 0f 00 00 48 8d 79 04 48 b8 00 00 00 00 00 fc ff df 45 8b 74 24 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
      RIP: ip6_setup_cork+0x274/0x15c0 net/ipv6/ip6_output.c:1168 RSP: ffff8801cc357550
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      864e2a1f
    • Geert Uytterhoeven's avatar
      of_mdio: Fix broken PHY IRQ in case of probe deferral · 66bdede4
      Geert Uytterhoeven authored
      If an Ethernet PHY is initialized before the interrupt controller it is
      connected to, a message like the following is printed:
      
          irq: no irq domain found for /interrupt-controller@e61c0000 !
      
      However, the actual error is ignored, leading to a non-functional (POLL)
      PHY interrupt later:
      
          Micrel KSZ8041RNLI ee700000.ethernet-ffffffff:01: attached PHY driver [Micrel KSZ8041RNLI] (mii_bus:phy_addr=ee700000.ethernet-ffffffff:01, irq=POLL)
      
      Depending on whether the PHY driver will fall back to polling, Ethernet
      may or may not work.
      
      To fix this:
        1. Switch of_mdiobus_register_phy() from irq_of_parse_and_map() to
           of_irq_get().
           Unlike the former, the latter returns -EPROBE_DEFER if the
           interrupt controller is not yet available, so this condition can be
           detected.
           Other errors are handled the same as before, i.e. use the passed
           mdio->irq[addr] as interrupt.
        2. Propagate and handle errors from of_mdiobus_register_phy() and
           of_mdiobus_register_device().
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      66bdede4
    • Randy Dunlap's avatar
      textsearch: fix typos in library helpers · 7433a8d6
      Randy Dunlap authored
      Fix spellos (typos) in textsearch library helpers.
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7433a8d6
    • David Howells's avatar
      rxrpc: Don't release call mutex on error pointer · 6cb3ece9
      David Howells authored
      Don't release call mutex at the end of rxrpc_kernel_begin_call() if the
      call pointer actually holds an error value.
      
      Fixes: 540b1c48 ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg")
      Reported-by: default avatarMarc Dionne <marc.dionne@auristor.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6cb3ece9
    • David S. Miller's avatar
      Merge branch 'stmmac-hw-tstamp-fixes' · 748759d5
      David S. Miller authored
      Jose Abreu says:
      
      ====================
      net: stmmac: Fix HW timestamping
      
      Three fixes for HW timestamping feature, all of them for RX side.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      748759d5
    • Jose Abreu's avatar
      net: stmmac: Prevent infinite loop in get_rx_timestamp_status() · 9454360d
      Jose Abreu authored
      Prevent infinite loop by correctly setting the loop condition to
      break when i == 10.
      Signed-off-by: default avatarJose Abreu <joabreu@synopsys.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Joao Pinto <jpinto@synopsys.com>
      Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
      Cc: Alexandre Torgue <alexandre.torgue@st.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9454360d
    • Jose Abreu's avatar
      net: stmmac: Fix stmmac_get_rx_hwtstamp() · 98870943
      Jose Abreu authored
      When using GMAC4 the valid timestamp is from CTX next desc but
      we are passing the previous desc to get_rx_timestamp_status()
      callback.
      
      Fix this and while at it rework a little bit the function logic.
      Signed-off-by: default avatarJose Abreu <joabreu@synopsys.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Joao Pinto <jpinto@synopsys.com>
      Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
      Cc: Alexandre Torgue <alexandre.torgue@st.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      98870943
    • Jose Abreu's avatar
      net: stmmac: Add missing call to dev_kfree_skb() · 9c8080d0
      Jose Abreu authored
      When RX HW timestamp is enabled and a frame is discarded we are
      not freeing the skb but instead only setting to NULL the entry.
      
      Add a call to dev_kfree_skb_any() so that skb entry is correctly
      freed.
      Signed-off-by: default avatarJose Abreu <joabreu@synopsys.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Joao Pinto <jpinto@synopsys.com>
      Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
      Cc: Alexandre Torgue <alexandre.torgue@st.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9c8080d0
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · e5f468b3
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
      
       - joydev now implements a blacklist to avoid creating joystick nodes
         for accelerometers found in composite devices such as PlaStation
         controllers
      
       - assorted driver fixes
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: ims-psu - check if CDC union descriptor is sane
        Input: joydev - blacklist ds3/ds4/udraw motion sensors
        Input: allow matching device IDs on property bits
        Input: factor out and export input_device_id matching code
        Input: goodix - poll the 'buffer status' bit before reading data
        Input: axp20x-pek - fix module not auto-loading for axp221 pek
        Input: tca8418 - enable interrupt after it has been requested
        Input: stmfts - fix setting ABS_MT_POSITION_* maximum size
        Input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen
        Input: synaptics - disable kernel tracking on SMBus devices
      e5f468b3
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · ec0145e9
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "MS_I_VERSION fixes - Mimi's fix + missing bits picked from Matthew
        (his patch contained a duplicate of the fs/namespace.c fix as well,
        but by that point the original fix had already been applied)"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        Convert fs/*/* to SB_I_VERSION
        vfs: fix mounting a filesystem with i_version
      ec0145e9