summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-09-09bpf: fix out of bounds access in verifier logAlexei Starovoitov
when the verifier log is enabled the print_bpf_insn() is doing bpf_alu_string[BPF_OP(insn->code) >> 4] and bpf_jmp_string[BPF_OP(insn->code) >> 4] where BPF_OP is a 4-bit instruction opcode. Malformed insns can cause out of bounds access. Fix it by sizing arrays appropriately. The bug was found by clang address sanitizer with libfuzzer. Reported-by: Yonghong Song <yhs@plumgrid.com> Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-09ipv6: fix multipath route replace error recoveryRoopa Prabhu
Problem: The ecmp route replace support for ipv6 in the kernel, deletes the existing ecmp route too early, ie when it installs the first nexthop. If there is an error in installing the subsequent nexthops, its too late to recover the already deleted existing route leaving the fib in an inconsistent state. This patch reduces the possibility of this by doing the following: a) Changes the existing multipath route add code to a two stage process: build rt6_infos + insert them ip6_route_add rt6_info creation code is moved into ip6_route_info_create. b) This ensures that most errors are caught during building rt6_infos and we fail early c) Separates multipath add and del code. Because add needs the special two stage mode in a) and delete essentially does not care. d) In any event if the code fails during inserting a route again, a warning is printed (This should be unlikely) Before the patch: $ip -6 route show 3000:1000:1000:1000::2 via fe80::202:ff:fe00:b dev swp49s0 metric 1024 3000:1000:1000:1000::2 via fe80::202:ff:fe00:d dev swp49s1 metric 1024 3000:1000:1000:1000::2 via fe80::202:ff:fe00:f dev swp49s2 metric 1024 /* Try replacing the route with a duplicate nexthop */ $ip -6 route change 3000:1000:1000:1000::2/128 nexthop via fe80::202:ff:fe00:b dev swp49s0 nexthop via fe80::202:ff:fe00:d dev swp49s1 nexthop via fe80::202:ff:fe00:d dev swp49s1 RTNETLINK answers: File exists $ip -6 route show /* previously added ecmp route 3000:1000:1000:1000::2 dissappears from * kernel */ After the patch: $ip -6 route show 3000:1000:1000:1000::2 via fe80::202:ff:fe00:b dev swp49s0 metric 1024 3000:1000:1000:1000::2 via fe80::202:ff:fe00:d dev swp49s1 metric 1024 3000:1000:1000:1000::2 via fe80::202:ff:fe00:f dev swp49s2 metric 1024 /* Try replacing the route with a duplicate nexthop */ $ip -6 route change 3000:1000:1000:1000::2/128 nexthop via fe80::202:ff:fe00:b dev swp49s0 nexthop via fe80::202:ff:fe00:d dev swp49s1 nexthop via fe80::202:ff:fe00:d dev swp49s1 RTNETLINK answers: File exists $ip -6 route show 3000:1000:1000:1000::2 via fe80::202:ff:fe00:b dev swp49s0 metric 1024 3000:1000:1000:1000::2 via fe80::202:ff:fe00:d dev swp49s1 metric 1024 3000:1000:1000:1000::2 via fe80::202:ff:fe00:f dev swp49s2 metric 1024 Fixes: 27596472473a ("ipv6: fix ECMP route replacement") Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com> Reviewed-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-09soc: qcom: smd: Correct fBLOCKREADINTR handlingBjorn Andersson
fBLOCKREADINTR is masking the notification from the remote and should hence be cleared while we're waiting the tx fifo to drain. Also change the reset state to mask the notification, as send is the only use case where we're interested in it. Signed-off-by: Bjorn Andersson <bjorn.andersson@sonymobile.com> Signed-off-by: Andy Gross <agross@codeaurora.org>
2015-09-09soc: qcom: smd: Use correct remote processor IDAndy Gross
This patch fixes SMEM addressing issues when remote processors need to use secure SMEM partitions. Signed-off-by: Andy Gross <agross@codeaurora.org> Reviewed-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
2015-09-09soc: qcom: smem: Fix errant private accessAndy Gross
This patch corrects private partition item access. Instead of falling back to global for instances where we have an actual host and remote partition existing, return the results of the private lookup. Signed-off-by: Andy Gross <agross@codeaurora.org>
2015-09-09Merge tag 'qcom-soc-for-4.3' into v4.2-rc2Andy Gross
Qualcomm ARM Based SoC Updates for 4.3 * Add SMEM driver * Add SMD driver * Add RPM over SMD driver * Select QCOM_SCM by default
2015-09-09ARM: dts: qcom: msm8974-sony-xperia-honami: Use stdout-pathStephen Boyd
Use stdout-path so that we don't have to put the console on the kernel command line. Cc: Tim Bird <tim.bird@sonymobile.com> Cc: Bjorn Andersson <bjorn.andersson@sonymobile.com> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09ARM: dts: qcom: msm8960-cdp: Use stdout-pathStephen Boyd
Use stdout-path so that we don't have to put the console on the kernel command line. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09ARM: dts: qcom: msm8660-surf: Use stdout-pathStephen Boyd
Use stdout-path so that we don't have to put the console on the kernel command line. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09ARM: dts: qcom: ipq8064-ap148: Use stdout-pathStephen Boyd
Use stdout-path so that we don't have to put the console on the kernel command line. Cc: Mathieu Olivari <mathieu@codeaurora.org> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09ARM: dts: qcom: apq8084-mtp: Use stdout-pathStephen Boyd
Use stdout-path so that we don't have to put the console on the kernel command line. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09ARM: dts: qcom: apq8084-ifc6540: Use stdout-pathStephen Boyd
Use stdout-path so that we don't have to put the console on the kernel command line. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09ARM: dts: qcom: apq8074-dragonboard: Use stdout-pathStephen Boyd
Use stdout-path so that we don't have to put the console on the kernel command line. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09ARM: dts: qcom: apq8064-ifc6410: Use stdout-pathStephen Boyd
Use stdout-path so that we don't have to put the console on the kernel command line. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09ARM: dts: qcom: apq8064-cm-qs600: Use stdout-pathStephen Boyd
Use stdout-path so that we don't have to put the console on the kernel command line. Cc: Mike Rapoport <mike.rapoport@gmail.com> Cc: Igor Grinberg <grinberg@compulab.co.il> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09ARM: dts: qcom: Label serial nodes for aliasing and stdout-pathStephen Boyd
Add a label to the serial nodes that are being used for the console. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-09-09Merge tag 'qcom-dt-for-4.3' into v4.2-rc2Andy Gross
Qualcomm ARM Based Device Tree Updates for v4.3 * Switch to use pinctrl compatible for GPIOs * Add RPM regulators for MSM8960 * Add SPI Ethernet support on MSM8960 CDP * Add SMEM support along with dependencies * Add PM8921 support for GPIO and MPP * Fix GSBI cell index * Switch to use real regulators on APQ8064 w/ SDCC
2015-09-09ebpf: fix fd refcount leaks related to maps in bpf syscallDaniel Borkmann
We may already have gotten a proper fd struct through fdget(), so whenever we return at the end of an map operation, we need to call fdput(). However, each map operation from syscall side first probes CHECK_ATTR() to verify that unused fields in the bpf_attr union are zero. In case of malformed input, we return with error, but the lookup to the map_fd was already performed at that time, so that we return without an corresponding fdput(). Fix it by performing an fdget() only right before bpf_map_get(). The fdget() invocation on maps in the verifier is not affected. Fixes: db20fd2b0108 ("bpf: add lookup/update/delete/iterate methods to BPF maps") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-09RDS: verify the underlying transport exists before creating a connectionSasha Levin
There was no verification that an underlying transport exists when creating a connection, this would cause dereferencing a NULL ptr. It might happen on sockets that weren't properly bound before attempting to send a message, which will cause a NULL ptr deref: [135546.047719] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN [135546.051270] Modules linked in: [135546.051781] CPU: 4 PID: 15650 Comm: trinity-c4 Not tainted 4.2.0-next-20150902-sasha-00041-gbaa1222-dirty #2527 [135546.053217] task: ffff8800835bc000 ti: ffff8800bc708000 task.ti: ffff8800bc708000 [135546.054291] RIP: __rds_conn_create (net/rds/connection.c:194) [135546.055666] RSP: 0018:ffff8800bc70fab0 EFLAGS: 00010202 [135546.056457] RAX: dffffc0000000000 RBX: 0000000000000f2c RCX: ffff8800835bc000 [135546.057494] RDX: 0000000000000007 RSI: ffff8800835bccd8 RDI: 0000000000000038 [135546.058530] RBP: ffff8800bc70fb18 R08: 0000000000000001 R09: 0000000000000000 [135546.059556] R10: ffffed014d7a3a23 R11: ffffed014d7a3a21 R12: 0000000000000000 [135546.060614] R13: 0000000000000001 R14: ffff8801ec3d0000 R15: 0000000000000000 [135546.061668] FS: 00007faad4ffb700(0000) GS:ffff880252000000(0000) knlGS:0000000000000000 [135546.062836] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [135546.063682] CR2: 000000000000846a CR3: 000000009d137000 CR4: 00000000000006a0 [135546.064723] Stack: [135546.065048] ffffffffafe2055c ffffffffafe23fc1 ffffed00493097bf ffff8801ec3d0008 [135546.066247] 0000000000000000 00000000000000d0 0000000000000000 ac194a24c0586342 [135546.067438] 1ffff100178e1f78 ffff880320581b00 ffff8800bc70fdd0 ffff880320581b00 [135546.068629] Call Trace: [135546.069028] ? __rds_conn_create (include/linux/rcupdate.h:856 net/rds/connection.c:134) [135546.069989] ? rds_message_copy_from_user (net/rds/message.c:298) [135546.071021] rds_conn_create_outgoing (net/rds/connection.c:278) [135546.071981] rds_sendmsg (net/rds/send.c:1058) [135546.072858] ? perf_trace_lock (include/trace/events/lock.h:38) [135546.073744] ? lockdep_init (kernel/locking/lockdep.c:3298) [135546.074577] ? rds_send_drop_to (net/rds/send.c:976) [135546.075508] ? __might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3795) [135546.076349] ? __might_fault (mm/memory.c:3795) [135546.077179] ? rds_send_drop_to (net/rds/send.c:976) [135546.078114] sock_sendmsg (net/socket.c:611 net/socket.c:620) [135546.078856] SYSC_sendto (net/socket.c:1657) [135546.079596] ? SYSC_connect (net/socket.c:1628) [135546.080510] ? trace_dump_stack (kernel/trace/trace.c:1926) [135546.081397] ? ring_buffer_unlock_commit (kernel/trace/ring_buffer.c:2479 kernel/trace/ring_buffer.c:2558 kernel/trace/ring_buffer.c:2674) [135546.082390] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) [135546.083410] ? trace_event_raw_event_sys_enter (include/trace/events/syscalls.h:16) [135546.084481] ? do_audit_syscall_entry (include/trace/events/syscalls.h:16) [135546.085438] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) [135546.085515] rds_ib_laddr_check(): addr 36.74.25.172 ret -99 node type -1 Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-09xen-netback: require fewer guest Rx slots when not using GSODavid Vrabel
Commit f48da8b14d04ca87ffcffe68829afd45f926ec6a (xen-netback: fix unlimited guest Rx internal queue and carrier flapping) introduced a regression. The PV frontend in IPXE only places 4 requests on the guest Rx ring. Since netback required at least (MAX_SKB_FRAGS + 1) slots, IPXE could not receive any packets. a) If GSO is not enabled on the VIF, fewer guest Rx slots are required for the largest possible packet. Calculate the required slots based on the maximum GSO size or the MTU. This calculation of the number of required slots relies on 1650d5455bd2 (xen-netback: always fully coalesce guest Rx packets) which present in 4.0-rc1 and later. b) Reduce the Rx stall detection to checking for at least one available Rx request. This is fine since we're predominately concerned with detecting interfaces which are down and thus have zero available Rx requests. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-09Merge branch 'cxgb4-fixes'David S. Miller
Hariprasad Shenai says: ==================== cxgb4: Fix tx flit calculation and wc stat configuration This patch series fixes the following: Patch 1/2 fixes tx flit calculation, which if wrong can lead to stall, hang, data corrpution, write combining failure. Patch 2/2 fixes PCI-E write combining stats configuration. This patch series has been created against net tree and includes patches on cxgb4 driver. We have included all the maintainers of respective drivers. Kindly review the change and let us know in case of any review comments. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-09cxgb4: Fix for write-combining stats configurationHariprasad Shenai
The write-combining configuration register SGE_STAT_CFG_A needs to be configured after FW initializes the adapter, else FW will reset the configuration Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-09cxgb4: Fix tx flit calculationHariprasad Shenai
In commit 0aac3f56d4a63f04 ("cxgb4: Add comment for calculate tx flits and sge length code") introduced a regression where tx flit calculation is going wrong, which can lead to data corruption, hang, stall and write-combining failure. Fixing it. Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-09net: eth: altera: Fix the initial device operstateAtsushi Nemoto
Call netif_carrier_off() prior to register_netdev(), otherwise userspace can see incorrect link state. Signed-off-by: Atsushi Nemoto <nemoto@toshiba-tops.co.jp> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-09Merge tag 'tty-4.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty driver reverts from Greg KH: "Here are some reverts for some tty patches (specifically the pl011 driver) that ended up breaking a bunch of machines (i.e. almost all of the ones with this chip). People are working on a fix for this, but in the meantime, it's best to just revert all 5 patches to restore people's serial consoles. These reverts have been in linux-next for many days now" * tag 'tty-4.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: Revert "uart: pl011: Rename regs with enumeration" Revert "uart: pl011: Introduce register accessor" Revert "uart: pl011: Introduce register look up table" Revert "uart: pl011: Improve LCRH register access decision" Revert "uart: pl011: Add support to ZTE ZX296702 uart"
2015-09-09Merge tag 'for-linus-20150909' of git://git.infradead.org/linux-mtdLinus Torvalds
Pull more MTD updates from Brian Norris: "There was one significant bug in my first pull request, fixed here. I also threw in a few trivial ID additions and a small module rename. Details: - SPI NOR: bug fix for a "end of table" check that resulted in a NULL dereference in some cases - SPI NOR: a few new IDs / feature flags - OMAP2 NAND: rename module so it doesn't conflict with onenand omap2.ko" * tag 'for-linus-20150909' of git://git.infradead.org/linux-mtd: mtd: spi-nor: fix NULL dereference when no match found in spi_nor_ids[] mtd: spi-nor: s25sl064p supports both dual and quad I/O mtd: spi-nor: allow dual/quad reads on S25FL129P mtd: nand: omap2: Rename shippable module to omap2_nand mtd: spi-nor: Add support for sst25wf020a mtd: spi-nor: Add support for Micron n25q064a serial flash
2015-09-09Merge tag 'pwm/for-4.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "This set of changes introduces the beginnings of a new API that's based around the concept of states that can be atomically applied. Drivers go to various lengths to implement something similar, which indicates that the core should really be providing the necessary framework. On top of that, there is a bit of cleanup as well as improved kerneldoc and integration into the device-drivers DocBook. Regarding drivers there is a new one for the NXP LPC18xx family of SoCs and a couple of fixes for existing drivers (pca9685, Broadcom Kona and Atmel HLCDC)" * tag 'pwm/for-4.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: ARM: at91: pwm: atmel-hlcdc: Add at91sam9n12 errata pwm: Add NXP LPC18xx PWM/SCT DT binding documentation pwm: NXP LPC18xx PWM/SCT driver pwm-pca9685: Support changing the output frequency pwm-pca9685: Fix several driver bugs pwm: kona: Modify settings application sequence pwm: pca9685: Drop owner assignment pwm: Add to device-drivers documentation pwm: Clean up kerneldoc pwm: Remove useless whitespace pwm: sysfs: Remove unnecessary padding pwm: sysfs: Properly convert from enum to string pwm: Make use of pwm_get_xxx() helpers where appropriate pwm: Add pwm_get_polarity() helper function pwm: Constify PWM device where possible pwm: Add the pwm_is_enabled() helper
2015-09-09fix ufs write vs readpage race when writing into a holeAl Viro
Followup to the UFS series - with the way we clear the new blocks (via buffer cache, possibly on more than a page worth of file) we really should not insert a reference to new block into inode block tree until after we'd cleared it. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-09-09Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhostLinus Torvalds
Pull virtio updates from Michael Tsirkin: "Virtio fixes and features for 4.3: - virtio-mmio can now be auto-loaded through acpi. - virtio blk supports extended partitions. - total memory is better reported when using virtio balloon with auto-deflate. - cache control is re-enabled when using virtio-blk in modern mode" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_balloon: do not change memory amount visible via /proc/meminfo virtio_ballon: change stub of release_pages_by_pfn virtio-blk: Allow extended partitions virtio_mmio: add ACPI probing virtio-blk: use VIRTIO_BLK_F_WCE and VIRTIO_BLK_F_CONFIG_WCE in virtio1
2015-09-09Merge tag 'metag-for-v4.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag Pull metag updates from James Hogan: "Metag architecture changes for v4.3. Just a couple of changes for v4.3-rc1. A preparatory IRQ patch to prepare for moving irq_data struct members, and a tweak to Documentation/features since Meta2 could support THP" * tag 'metag-for-v4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag: Documentation/features/vm: Meta2 is capable of THP metag/irq: Use access helper irq_data_get_affinity_mask()
2015-09-09Merge tag 'nios2-v4.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2 Pull nios2 updates from Ley Foon Tan: - add defconfig and device tree for max 10 support - migrate to new 'set-state' interface for timer - fix unaligned handler - MAINTAINERS: update nios2 git repo * tag 'nios2-v4.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2: nios2: add Max10 defconfig nios2: Add Max10 device tree MAINTAINERS: update nios2 git repo nios2: remove unused statistic counters nios2: fixed variable imm16 to s16 nios2/time: Migrate to new 'set-state' interface
2015-09-09Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds
Pull cifs updates from Steve French: "Small cifs fix and a patch for improved debugging" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix use-after-free on mid_q_entry Update cifs version number Add way to query server fs info for smb3
2015-09-09dax: update PMD fault handler with PMEM APIRoss Zwisler
As part of the v4.3 merge window the DAX code was updated by Matthew and Kirill to handle PMD pages. Also as part of the v4.3 merge window we updated the DAX code to do proper PMEM flushing (commit 2765cfbb342c: "dax: update I/O path to do proper PMEM flushing"). The additional code added by the DAX PMD patches also needs to be updated to properly use the PMEM API. This ensures that after a PMD fault is handled the zeros written to the newly allocated pages are durable on the DIMMs. linux/dax.h is included to get rid of a bunch of sparse warnings. Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com> Cc: Matthew Wilcox <willy@linux.intel.com>, Cc: Dan Williams <dan.j.williams@intel.com> Cc: Kirill Shutemov <kirill@shutemov.name> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-09-09Revert "Hexagon: fix signal.c compile error"Mike Frysinger
This reverts commit f3f601c1d2728f02544cfd143eaa82e5398b3e9b. UAPI headers cannot use "uapi/" in their paths by design -- when they're installed, they do not have the uapi/ prefix. Otherwise doing so breaks userland badly. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Richard Kuo <rkuo@codeaurora.org>
2015-09-09Merge tag 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull inifiniband/rdma updates from Doug Ledford: "This is a fairly sizeable set of changes. I've put them through a decent amount of testing prior to sending the pull request due to that. There are still a few fixups that I know are coming, but I wanted to go ahead and get the big, sizable chunk into your hands sooner rather than waiting for those last few fixups. Of note is the fact that this creates what is intended to be a temporary area in the drivers/staging tree specifically for some cleanups and additions that are coming for the RDMA stack. We deprecated two drivers (ipath and amso1100) and are waiting to hear back if we can deprecate another one (ehca). We also put Intel's new hfi1 driver into this area because it needs to be refactored and a transfer library created out of the factored out code, and then it and the qib driver and the soft-roce driver should all be modified to use that library. I expect drivers/staging/rdma to be around for three or four kernel releases and then to go away as all of the work is completed and final deletions of deprecated drivers are done. Summary of changes for 4.3: - Create drivers/staging/rdma - Move amso1100 driver to staging/rdma and schedule for deletion - Move ipath driver to staging/rdma and schedule for deletion - Add hfi1 driver to staging/rdma and set TODO for move to regular tree - Initial support for namespaces to be used on RDMA devices - Add RoCE GID table handling to the RDMA core caching code - Infrastructure to support handling of devices with differing read and write scatter gather capabilities - Various iSER updates - Kill off unsafe usage of global mr registrations - Update SRP driver - Misc mlx4 driver updates - Support for the mr_alloc verb - Support for a netlink interface between kernel and user space cache daemon to speed path record queries and route resolution - Ininitial support for safe hot removal of verbs devices" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (136 commits) IB/ipoib: Suppress warning for send only join failures IB/ipoib: Clean up send-only multicast joins IB/srp: Fix possible protection fault IB/core: Move SM class defines from ib_mad.h to ib_smi.h IB/core: Remove unnecessary defines from ib_mad.h IB/hfi1: Add PSM2 user space header to header_install IB/hfi1: Add CSRs for CONFIG_SDMA_VERBOSITY mlx5: Fix incorrect wc pkey_index assignment for GSI messages IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow IB/uverbs: reject invalid or unknown opcodes IB/cxgb4: Fix if statement in pick_local_ip6adddrs IB/sa: Fix rdma netlink message flags IB/ucma: HW Device hot-removal support IB/mlx4_ib: Disassociate support IB/uverbs: Enable device removal when there are active user space applications IB/uverbs: Explicitly pass ib_dev to uverbs commands IB/uverbs: Fix race between ib_uverbs_open and remove_one IB/uverbs: Fix reference counting usage of event files IB/core: Make ib_dealloc_pd return void IB/srp: Create an insecure all physical rkey only if needed ...
2015-09-09ARM: at91: pwm: atmel-hlcdc: Add at91sam9n12 errataJosh Wu
The errata for HLCDC PWM of at91sam9n12 are the same as for at91sam9x5. Signed-off-by: Josh Wu <josh.wu@atmel.com> Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
2015-09-09pwm: Add NXP LPC18xx PWM/SCT DT binding documentationAriel D'Alessandro
Add the devicetree binding document for NXP LPC18xx PWM/SCT. Signed-off-by: Ariel D'Alessandro <ariel@vanguardiasur.com.ar> Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
2015-09-09pwm: NXP LPC18xx PWM/SCT driverAriel D'Alessandro
This commit adds support for NXP LPC18xx PWM/SCT. NXP LPC SoCs family, which includes LPC18xx/LPC43xx, provides a State Configurable Timer (SCT) which can be configured as a Pulse Width Modulator. Other SoCs in that family may share the same hardware. The PWM supports a total of 16 channels, but only 15 can be simultaneously requested. There's only one period, global to all the channels, thus PWM driver will refuse setting different values to it, unless there's only one channel requested. Signed-off-by: Ariel D'Alessandro <ariel@vanguardiasur.com.ar> [thierry.reding@gmail.com: remove excessive padding of fields] Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
2015-09-09drm/i915: Limit the number of loops for reading a split 64bit registerChris Wilson
In I915_READ64_2x32 we attempt to read a 64bit register using 2 32bit reads. Due to the nature of the registers we try to read in this manner, they may increment between the two instruction (e.g. a timestamp counter). To keep the result accurate, we repeat the read if we detect an overflow (i.e. the upper value varies). However, some hardware is just plain flaky and may endless loop as the the upper 32bits are not stable. Just give up after a couple of tries and report whatever we read last. v2: Use the most recent values when erring out on an unstable register. Reported-by: russianneuromancer@ya.ru Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91906 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Michał Winiarski <michal.winiarski@intel.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: stable@vger.kernel.org Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2015-09-08net: tipc: fix stall during bclink wakeup procedureKolmakov Dmitriy
If an attempt to wake up users of broadcast link is made when there is no enough place in send queue than it may hang up inside the tipc_sk_rcv() function since the loop breaks only after the wake up queue becomes empty. This can lead to complete CPU stall with the following message generated by RCU: INFO: rcu_sched self-detected stall on CPU { 0} (t=2101 jiffies g=54225 c=54224 q=11465) Task dump for CPU 0: tpch R running task 0 39949 39948 0x0000000a ffffffff818536c0 ffff88181fa037a0 ffffffff8106a4be 0000000000000000 ffffffff818536c0 ffff88181fa037c0 ffffffff8106d8a8 ffff88181fa03800 0000000000000001 ffff88181fa037f0 ffffffff81094a50 ffff88181fa15680 Call Trace: <IRQ> [<ffffffff8106a4be>] sched_show_task+0xae/0x120 [<ffffffff8106d8a8>] dump_cpu_task+0x38/0x40 [<ffffffff81094a50>] rcu_dump_cpu_stacks+0x90/0xd0 [<ffffffff81097c3b>] rcu_check_callbacks+0x3eb/0x6e0 [<ffffffff8106e53f>] ? account_system_time+0x7f/0x170 [<ffffffff81099e64>] update_process_times+0x34/0x60 [<ffffffff810a84d1>] tick_sched_handle.isra.18+0x31/0x40 [<ffffffff810a851c>] tick_sched_timer+0x3c/0x70 [<ffffffff8109a43d>] __run_hrtimer.isra.34+0x3d/0xc0 [<ffffffff8109aa95>] hrtimer_interrupt+0xc5/0x1e0 [<ffffffff81030d52>] ? native_smp_send_reschedule+0x42/0x60 [<ffffffff81032f04>] local_apic_timer_interrupt+0x34/0x60 [<ffffffff810335bc>] smp_apic_timer_interrupt+0x3c/0x60 [<ffffffff8165a3fb>] apic_timer_interrupt+0x6b/0x70 [<ffffffff81659129>] ? _raw_spin_unlock_irqrestore+0x9/0x10 [<ffffffff8107eb9f>] __wake_up_sync_key+0x4f/0x60 [<ffffffffa313ddd1>] tipc_write_space+0x31/0x40 [tipc] [<ffffffffa313dadf>] filter_rcv+0x31f/0x520 [tipc] [<ffffffffa313d699>] ? tipc_sk_lookup+0xc9/0x110 [tipc] [<ffffffff81659259>] ? _raw_spin_lock_bh+0x19/0x30 [<ffffffffa314122c>] tipc_sk_rcv+0x2dc/0x3e0 [tipc] [<ffffffffa312e7ff>] tipc_bclink_wakeup_users+0x2f/0x40 [tipc] [<ffffffffa313ce26>] tipc_node_unlock+0x186/0x190 [tipc] [<ffffffff81597c1c>] ? kfree_skb+0x2c/0x40 [<ffffffffa313475c>] tipc_rcv+0x2ac/0x8c0 [tipc] [<ffffffffa312ff58>] tipc_l2_rcv_msg+0x38/0x50 [tipc] [<ffffffff815a76d3>] __netif_receive_skb_core+0x5a3/0x950 [<ffffffff815a98d3>] __netif_receive_skb+0x13/0x60 [<ffffffff815a993e>] netif_receive_skb_internal+0x1e/0x90 [<ffffffff815aa138>] napi_gro_receive+0x78/0xa0 [<ffffffffa07f93f4>] tg3_poll_work+0xc54/0xf40 [tg3] [<ffffffff81597c8c>] ? consume_skb+0x2c/0x40 [<ffffffffa07f9721>] tg3_poll_msix+0x41/0x160 [tg3] [<ffffffff815ab0f2>] net_rx_action+0xe2/0x290 [<ffffffff8104b92a>] __do_softirq+0xda/0x1f0 [<ffffffff8104bc26>] irq_exit+0x76/0xa0 [<ffffffff81004355>] do_IRQ+0x55/0xf0 [<ffffffff8165a12b>] common_interrupt+0x6b/0x6b <EOI> The issue occurs only when tipc_sk_rcv() is used to wake up postponed senders: tipc_bclink_wakeup_users() // wakeupq - is a queue which consists of special // messages with SOCK_WAKEUP type. tipc_sk_rcv(wakeupq) ... while (skb_queue_len(inputq)) { filter_rcv(skb) // Here the type of message is checked // and if it is SOCK_WAKEUP then // it tries to wake up a sender. tipc_write_space(sk) wake_up_interruptible_sync_poll() } After the sender thread is woke up it can gather control and perform an attempt to send a message. But if there is no enough place in send queue it will call link_schedule_user() function which puts a message of type SOCK_WAKEUP to the wakeup queue and put the sender to sleep. Thus the size of the queue actually is not changed and the while() loop never exits. The approach I proposed is to wake up only senders for which there is enough place in send queue so the described issue can't occur. Moreover the same approach is already used to wake up senders on unicast links. I have got into the issue on our product code but to reproduce the issue I changed a benchmark test application (from tipcutils/demos/benchmark) to perform the following scenario: 1. Run 64 instances of test application (nodes). It can be done on the one physical machine. 2. Each application connects to all other using TIPC sockets in RDM mode. 3. When setup is done all nodes start simultaneously send broadcast messages. 4. Everything hangs up. The issue is reproducible only when a congestion on broadcast link occurs. For example, when there are only 8 nodes it works fine since congestion doesn't occur. Send queue limit is 40 in my case (I use a critical importance level) and when 64 nodes send a message at the same moment a congestion occurs every time. Signed-off-by: Dmitry S Kolmakov <kolmakov.dmitriy@huawei.com> Reviewed-by: Jon Maloy <jon.maloy@ericsson.com> Acked-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-08dm9000: fix a typoBarry Song
Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-08net: bridge: remove unnecessary switchdev includeVivien Didelot
Remove the unnecessary switchdev.h include from br_netlink.c. Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Acked-by: Jiri Pirko <jiri@resnulli.us> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-08net: bridge: check __vlan_vid_del for errorVivien Didelot
Since __vlan_del can return an error code, change its inner function __vlan_vid_del to return an eventual error from switchdev_port_obj_del. Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Acked-by: Jiri Pirko <jiri@resnulli.us> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-08net: dsa: bcm_sf2: Fix ageing conditions and operationFlorian Fainelli
The comparison check between cur_hw_state and hw_state is currently invalid because cur_hw_state is right shifted by G_MISTP_SHIFT, while hw_state is not, so we end-up comparing bits 2:0 with bits 7:5, which is going to cause an additional aging to occur. Fix this by not shifting cur_hw_state while reading it, but instead, mask the value with the appropriately shitfted bitmask. The other problem with the fast-ageing process is that we did not set the EN_AGE_DYNAMIC bit to request the ageing to occur for dynamically learned MAC addresses. Finally, write back 0 to the FAST_AGE_CTRL register to avoid leaving spurious bits sets from one operation to the other. Fixes: 12f460f23423 ("net: dsa: bcm_sf2: add HW bridging support") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-08Merge tag 'for-linus-4.3' of git://git.code.sf.net/p/openipmi/linux-ipmiLinus Torvalds
Pull IPMI updates from Corey Minyard: "Most of these have been sitting in linux-next for more than a release, particularly commit 0fbcf4af7c83 ("ipmi: Convert the IPMI SI ACPI handling to a platform device") which is probably the most complex patch. That is also the one that changes drivers/acpi/acpi_pnp.c. The change in that file is only removing IPMI from a "special platform devices" list, since I convert it to the standard PNP interface. I posted this one to the ACPI list twice and got no response, and it seems to work well in my testing, so I'm hoping it's good. Hidehiro Kawai posted a set of changes that improves the panic time handling in the IPMI driver. The rest of the changes are minor bug fixes or cleanups and some documentation" * tag 'for-linus-4.3' of git://git.code.sf.net/p/openipmi/linux-ipmi: ipmi:ssif: Add a module parm to specify that SMBus alerts don't work ipmi: add of_device_id in MODULE_DEVICE_TABLE ipmi: Compensate for BMCs that wont set the irq enable bit ipmi: Don't call receive handler in the panic context ipmi: Avoid touching possible corrupted lists in the panic context ipmi: Don't flush messages in sender() in run-to-completion mode ipmi: Factor out message flushing procedure ipmi: Remove unneeded set_run_to_completion call ipmi: Make some data const that was only read ipmi: constify SSIF ACPI device ids ipmi: Delete an unnecessary check before the function call "cleanup_one_si" char:ipmi - Change 1 to true for bool type variables during initialization. impi:Remove unneeded setting of module owner to THIS_MODULE in the platform structure, powernv_ipmi_driver ipmi: Add a comment in how messages are delivered from the lower layer ipmi/powernv: Fix potential invalid pointer dereference ipmi: Convert the IPMI SI ACPI handling to a platform device ipmi: Add device tree bindings information
2015-09-08Merge branch 'akpm' (patches from Andrew)Linus Torvalds
Merge second patch-bomb from Andrew Morton: "Almost all of the rest of MM. There was an unusually large amount of MM material this time" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (141 commits) zpool: remove no-op module init/exit mm: zbud: constify the zbud_ops mm: zpool: constify the zpool_ops mm: swap: zswap: maybe_preload & refactoring zram: unify error reporting zsmalloc: remove null check from destroy_handle_cache() zsmalloc: do not take class lock in zs_shrinker_count() zsmalloc: use class->pages_per_zspage zsmalloc: consider ZS_ALMOST_FULL as migrate source zsmalloc: partial page ordering within a fullness_list zsmalloc: use shrinker to trigger auto-compaction zsmalloc: account the number of compacted pages zsmalloc/zram: introduce zs_pool_stats api zsmalloc: cosmetic compaction code adjustments zsmalloc: introduce zs_can_compact() function zsmalloc: always keep per-class stats zsmalloc: drop unused variable `nr_to_migrate' mm/memblock.c: fix comment in __next_mem_range() mm/page_alloc.c: fix type information of memoryless node memory-hotplug: fix comments in zone_spanned_pages_in_node() and zone_spanned_pages_in_node() ...
2015-09-08Merge branch 'parisc-4.3-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "The most important changes in this patchset are: - re-enable 64bit PCI bus addresses which were temporarily disabled for PA-RISC in kernel 4.2 - fix the 64bit CAS operation in the LWS path which now enables us to enable the 64bit gcc atomic builtins even on 32bit userspace with 64bit kernel - fix a long-standing bug which sometimes crashed kernel at bootup while serial interrupt wasn't registered yet" * 'parisc-4.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Use platform_device_register_simple("rtc-generic") parisc: Drop CONFIG_SMP around update_cr16_clocksource() parisc: Use double word condition in 64bit CAS operation parisc: Filter out spurious interrupts in PA-RISC irq handler parisc: Additionally check for in_atomic() in page fault handler PCI,parisc: Enable 64-bit bus addresses on PA-RISC parisc: Define ioremap_uc and ioremap_wc
2015-09-08Merge tag 'linux-kselftest-4.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest update from Shuah Khan: "This update adds new zram test and fixes to problems found during testing this new zram test. In addition, there are a few bug fixes and ksefltest improvement patches from Linaro developers. I will send another update later on this week to fix kselftest breakage due to commit 2bf9e0ab08c6 ("locking/static_keys: Provide a selftest") after the fix soaks in next for a couple of days" * tag 'linux-kselftest-4.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/zram: Makefile fix selftests/zram: must be run as root selftests: breakpoints: fix installing error on the architecture except x86 selftests: check before install selftests/zram: Adding zram tests
2015-09-08Merge tag 'iommu-updates-v4.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates for from Joerg Roedel: "This time the IOMMU updates are mostly cleanups or fixes. No big new features or drivers this time. In particular the changes include: - Bigger cleanup of the Domain<->IOMMU data structures and the code that manages them in the Intel VT-d driver. This makes the code easier to understand and maintain, and also easier to keep the data structures in sync. It is also a preparation step to make use of default domains from the IOMMU core in the Intel VT-d driver. - Fixes for a couple of DMA-API misuses in ARM IOMMU drivers, namely in the ARM and Tegra SMMU drivers. - Fix for a potential buffer overflow in the OMAP iommu driver's debug code - A couple of smaller fixes and cleanups in various drivers - One small new feature: Report domain-id usage in the Intel VT-d driver to easier detect bugs where these are leaked" * tag 'iommu-updates-v4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (83 commits) iommu/vt-d: Really use upper context table when necessary x86/vt-d: Fix documentation of DRHD iommu/fsl: Really fix init section(s) content iommu/io-pgtable-arm: Unmap and free table when overwriting with block iommu/io-pgtable-arm: Move init-fn declarations to io-pgtable.h iommu/msm: Use BUG_ON instead of if () BUG() iommu/vt-d: Access iomem correctly iommu/vt-d: Make two functions static iommu/vt-d: Use BUG_ON instead of if () BUG() iommu/vt-d: Return false instead of 0 in irq_remapping_cap() iommu/amd: Use BUG_ON instead of if () BUG() iommu/amd: Make a symbol static iommu/amd: Simplify allocation in irq_remapping_alloc() iommu/tegra-smmu: Parameterize number of TLB lines iommu/tegra-smmu: Factor out tegra_smmu_set_pde() iommu/tegra-smmu: Extract tegra_smmu_pte_get_use() iommu/tegra-smmu: Use __GFP_ZERO to allocate zeroed pages iommu/tegra-smmu: Remove PageReserved manipulation iommu/tegra-smmu: Convert to use DMA API iommu/tegra-smmu: smmu_flush_ptc() wants device addresses ...
2015-09-08Merge tag 'regmap-v4.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This has been a busy release for regmap. By far the biggest set of changes here are those from Markus Pargmann which implement support for block transfers in smbus devices. This required quite a bit of refactoring but leaves us better able to handle odd restrictions that controllers may have and with better performance on smbus. Other new features include: - Fix interactions with lockdep for nested regmaps (eg, when a device using regmap is connected to a bus where the bus controller has a separate regmap). Lockdep's default class identification is too crude to work without help. - Support for must write bitfield operations, useful for operations which require writing a bit to trigger them from Kuniori Morimoto. - Support for delaying during register patch application from Nariman Poushin. - Support for overriding cache state via the debugfs implementation from Richard Fitzgerald" * tag 'regmap-v4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: (25 commits) regmap: fix a NULL pointer dereference in __regmap_init regmap: Support bulk reads for devices without raw formatting regmap-i2c: Add smbus i2c block support regmap: Add raw_write/read checks for max_raw_write/read sizes regmap: regmap max_raw_read/write getter functions regmap: Introduce max_raw_read/write for regmap_bulk_read/write regmap: Add missing comments about struct regmap_bus regmap: No multi_write support if bus->write does not exist regmap: Split use_single_rw internally into use_single_read/write regmap: Fix regmap_bulk_write for bus writes regmap: regmap_raw_read return error on !bus->read regulator: core: Print at debug level on debugfs creation failure regmap: Fix regmap_can_raw_write check regmap: fix typos in regmap.c regmap: Fix integertypes for register address and value regmap: Move documentation to regmap.h regmap: Use different lockdep class for each regmap init call thermal: sti: Add parentheses around bridge->ops->regmap_init call mfd: vexpress: Add parentheses around bridge->ops->regmap_init call regmap: debugfs: Fix misuse of IS_ENABLED ...