Shradha Shah [Wed, 20 May 2015 10:11:18 +0000 (11:11 +0100)]
sfc: Add ndo_get_vf_config() function for EF10
rtnetlink calls ndo_get_vf_config when compiling information
about a network interface, so that the VFs associated with a PF
can be listed (eg: ip link show).
Implement a response to this entry point and return PF-set MAC
address for VF in ndo_get_vf_config
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shradha Shah [Wed, 20 May 2015 10:11:03 +0000 (11:11 +0100)]
sfc: add ndo_set_vf_mac() function for EF10
Implement a response to this entrypoint.
The ndo_set_vf_mac() entrypoint is only exposed in the driver if
CONFIG_SFC_SRIOV is defined.
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jon Cooper [Wed, 20 May 2015 10:10:41 +0000 (11:10 +0100)]
sfc: Initialise MCDI buffers to 0 on declaration.
In order to avoid MC bugs the flags field needs to be set to 0.
Instead of explicitly clearing out the flags individually, a
better way to do this is to memset the MCDI_BUF to 0.
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Pieczko [Wed, 20 May 2015 10:10:20 +0000 (11:10 +0100)]
sfc: Enable a VF to get its own MAC address
A VF's MAC address is set by its parent PF and added to its vport.
To get this MAC address, the VF must use MC_CMD_ VPORT_GET_MAC_ADDRESSES.
In the current scheme, a VF's vport should only have one MAC address,
so warn if this is not the case.
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Edward Cree [Wed, 20 May 2015 10:10:03 +0000 (11:10 +0100)]
sfc: protect filter table against use-after-free
If MCDI timeouts are encountered during efx_ef10_filter_table_remove(),
an FLR will be queued, but efx->filter_state will still be kfree()d.
The queued FLR will then call efx_ef10_filter_table_restore(), which
will try to use efx->filter_state. This previously caused a panic.
This patch adds an rwsem to protect the existence of efx->filter_state,
separately from the spinlock protecting its contents. Users which can
race against efx_ef10_filter_table_remove() should down_read this rwsem.
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shradha Shah [Wed, 20 May 2015 10:09:46 +0000 (11:09 +0100)]
sfc: Store the efx_nic struct of the current VF in the VF data struct
Initialised in efx_probe_vf and removal is dealt with in
efx_ef10_remove.
vf->efx is needed in future patches to change the MAC address
of the VF via the parent PF, while the driver is bound to the
VF.
Example: ip link set dev vf NUM mac LLADDR
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shradha Shah [Wed, 20 May 2015 10:09:30 +0000 (11:09 +0100)]
sfc: save old MAC address in case sriov_mac_address_changed fails
Otherwise the PF and VF can disagree on the VF's MAC address and
this leads to strange behaviour, up to and including kernel panics.
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shradha Shah [Wed, 20 May 2015 10:09:15 +0000 (11:09 +0100)]
sfc: Store vf_index in nic_data for Ef10.
Added function efx_ef10_get_vf_index to store the vf_index
in nic_data during probe
vf_index is needed in future patches to access a particular
VF in the VF data structure.
Moved efx_ef10_probe_pf and efx_ef10_probe_vf in order to
used efx_ef10_remove
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shradha Shah [Wed, 20 May 2015 10:08:56 +0000 (11:08 +0100)]
sfc: MC_CMD_SET_MAC can only be called by the link control Function
MC_CMD_SET_MAC is privileged and can only by called by the link
control function.
This patch adds efx_ef10_mac_reconfigure_vf which avoids the call
to MC_CMD_SET_MAC by the Virtual function
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shradha Shah [Wed, 20 May 2015 10:08:40 +0000 (11:08 +0100)]
sfc: change definition of MC_CMD_VADAPTOR_ALLOC
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Shradha Shah [Wed, 20 May 2015 10:08:23 +0000 (11:08 +0100)]
sfc: Add permissions to MCDI commands
There is one primary function per adaptor, one link control function
per port and the rest as categorised as general.
This patch adds privileges to the MCDI commands based on which
functions are allowed to call them.
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vineet Gupta [Wed, 20 May 2015 06:34:40 +0000 (12:04 +0530)]
stmmac: replace open coded __netdev_alloc_skb_ip_align() with actual call
This also matches with the sibling call netdev_alloc_skb_ip_align() made in
rx fast path.
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Joe Perches [Wed, 20 May 2015 04:44:52 +0000 (21:44 -0700)]
qlge: Move jiffies_to_usecs immediately before loop
30 usecs (or really, 1 jiffy) can go by pretty fast.
Move the set of the timeout immediately before the loop.
Remove the unnecessary max(1ul, usecs_to_jiffies(30)) as
usecs_to_jiffies with a non-zero constant is guaranteed
to be non-zero.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Thu, 21 May 2015 21:20:55 +0000 (17:20 -0400)]
Merge branch 'rocker-transaction-fixes'
Simon Horman says:
====================
rocker: transaction fixes
this series addresses what appear to be errors in the handling of
prepare and then commit transactions in the rocker driver.
In all cases the problem is that data structures visible outside of
the transaction are modified during the prepare phase.
In the case of the first two patches this results in the kernel reporting a
BUG. I have noted test-cases in the change logs.
The third patch is also a bug fix, as noted by Toshiaki Makita,
however I have not been able to reliably reproduce the problem and
thus have not provided a test case.
The last patch is a correctness fix that does not fix a bug
that manifests as far as I can tell.
Changes: v3->v4
* All patches
- Add Jiri Pirko's ack
* "rocker: do not make neighbour entry changes when preparing transactions"
- Setting of entry values in all transaction phases
as suggested by Toshiaki Makita
* "rocker: make rocker_port_internal_vlan_id_{get,put}() non-transactional"
- Remove Fixes tag as I believe this is a correctness rather than a bug fix
Changes: v2->v3
* "rocker: do not make neighbour entry changes when preparing transactions"
- Correct inverted logic
- Added ack from Scott Feldman
Changes: v1->v2
* "rocker: do not make neighbour entry changes when preparing transactions"
- Revised changelog to reflect information from Toshiaki Makita
that there is a bug that can manifest
- Update address and ttl regardless of the value of the transaction state
* All other patches
- Added acks from Scott Feldman
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Simon Horman [Thu, 21 May 2015 03:40:17 +0000 (12:40 +0900)]
rocker: make rocker_port_internal_vlan_id_{get, put}() non-transactional
The motivation for this is that rocker_port_internal_vlan_id_{get,put} appear
to only partially implement the transaction model: memory allocation
and freeing is transactional, but hash and bitmap manipulation is not.
The latter could be fixed, however, as it is not currently exercised
due to trans always being SWITCHDEV_TRANS_NONE it seems cleaner
to make rocker_port_internal_vlan_id_get non-transactional.
This problem was introduced by
c4f20321d968 ("rocker: support
prepare-commit transaction model").
Found by inspection.
I do not believe that this change should have any run-time effect.
Acked-by: Scott Feldman <sfeldma@gmail.com>
Acked-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Simon Horman [Thu, 21 May 2015 03:40:16 +0000 (12:40 +0900)]
rocker: do not make neighbour entry changes when preparing transactions
rocker_port_ipv4_nh() and in turn rocker_port_ipv4_neigh() may be
be called with trans == SWITCHDEV_TRANS_PREPARE and then
trans == SWITCHDEV_TRANS_COMMIT from switchdev_port_obj_set() via
fib_table_insert().
The first time that rocker_port_ipv4_nh() is called, with
trans == SWITCHDEV_TRANS_PREPARE, _rocker_neigh_add() adds a new entry to
the neigh table.
And the second time rocker_port_ipv4_nh() is called, with
trans == SWITCHDEV_TRANS_COMMIT, that entry is found. This causes
rocker_port_ipv4_nh() to believe it is not adding an entry and thus it
frees "entry", which is still present in rocker driver's neigh table.
This problem does not appear to affect deletion as my analysis is that
deletion is always performed with trans == SWITCHDEV_TRANS_NONE.
For completeness _rocker_neigh_{add,del,prepare} are updated not to
manipulate fib table entries if trans == SWITCHDEV_TRANS_PREPARE.
Fixes: c4f20321d968 ("rocker: support prepare-commit transaction model")
Reported-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Acked-by: Scott Feldman <sfeldma@gmail.com>
Acked-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Simon Horman [Thu, 21 May 2015 03:40:15 +0000 (12:40 +0900)]
rocker: do not modify fdb table in rocker_port_fdb() when preparing transactions
rocker_port_fdb_flush() may be called be called with
trans == SWITCHDEV_TRANS_PREPARE and then trans == SWITCHDEV_TRANS_COMMIT from
switchdev_port_attr_set() via switchdev_port_obj_add().
Adding the new entry to the FDB table when trans == SWITCHDEV_TRANS_PREPARE
may result in a memory leak because when trans == SWITCHDEV_TRANS_PREPARE
rocker_flow_tbl_bridge() will allocate memory when called via
rocker_port_fdb_learn(). However, when trans == SWITCHDEV_TRANS_COMMIT
the presence of the FDB entry in the FDB table causes
rocker_port_fdb() to set the ROCKER_OP_FLAG_REFRESH flag which results
in rocker_port_fdb_learn() skipping the call to rocker_flow_tbl_bridge()
which would free the memory allocated by it when
trans == SWITCHDEV_TRANS_PREPARE.
ip link add br0 type bridge
ip link set up dev eth0
ip link set dev eth0 master br0
bridge fdb add 52:54:00:12:35:08 dev eth0
bridge fdb add 52:54:00:12:35:09 dev eth0
[ 2.600730] ------------[ cut here ]------------
[ 2.601002] kernel BUG at drivers/net/ethernet/rocker/rocker.c:4369!
[ 2.601373] invalid opcode: 0000 [#1] SMP
[ 2.601963] Modules linked in:
[ 2.602355] CPU: 0 PID: 64 Comm: bridge Not tainted
4.1.0-rc3-01048-g6d0f50c50211-dirty #1075
[ 2.602721] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.0-0-g4c59f5d-20150219_092859-nilsson.home.kraxel.org 04/01/2014
[ 2.602721] task:
ffff880019facef0 ti:
ffff88001f96c000 task.ti:
ffff88001f96c000
[ 2.602721] RIP: 0010:[<
ffffffff811f1470>] [<
ffffffff811f1470>] rocker_port_obj_add+0x150/0x160
[ 2.602721] RSP: 0018:
ffff88001f96fa98 EFLAGS:
00000212
[ 2.602721] RAX:
ffff880019d4fa68 RBX:
ffff88001f96fb18 RCX:
0000000000000000
[ 2.602721] RDX:
ffff880019d4f000 RSI:
ffff88001f96fb18 RDI:
ffff880019d4f000
[ 2.602721] RBP:
0000000000000001 R08:
0000000000000000 R09:
ffff88001f904620
[ 2.602721] R10:
ffff88001f96fb60 R11:
ffff880019e9d100 R12:
ffff88001f96fb18
[ 2.602721] R13:
ffff880019d4f680 R14:
ffff88001f904610 R15:
ffff8800198f7b80
[ 2.602721] FS:
00007f3eee917700(0000) GS:
ffff88001b000000(0000) knlGS:
0000000000000000
[ 2.602721] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
[ 2.602721] CR2:
00007f3eee4a15cb CR3:
000000001f933000 CR4:
00000000000006b0
[ 2.602721] DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
[ 2.602721] DR3:
0000000000000000 DR6:
0000000000000000 DR7:
0000000000000000
[ 2.602721] Stack:
[ 2.602721]
0000000000000000 ffff88001f96fb18 ffff880019d4f000 ffff88001f96fb18
[ 2.602721]
ffff880019d4f000 ffffffff81332105 ffff88001f96fb50 ffffffff814464c0
[ 2.602721]
ffff88001f96fb18 ffff88001f904600 ffff880019d4f000 ffffffff813326e5
[ 2.602721] Call Trace:
[ 2.602721] [<
ffffffff81332105>] ? __switchdev_port_obj_add+0x25/0x90
[ 2.602721] [<
ffffffff813326e5>] ? switchdev_port_obj_add+0x25/0xc0
[ 2.602721] [<
ffffffff813327b1>] ? switchdev_port_fdb_add+0x31/0x40
[ 2.602721] [<
ffffffff8123911f>] ? rtnl_fdb_add+0xff/0x1e0
[ 2.602721] [<
ffffffff81237d8e>] ? rtnetlink_rcv_msg+0x7e/0x250
[ 2.602721] [<
ffffffff8121d1ce>] ? __skb_recv_datagram+0xfe/0x4b0
[ 2.602721] [<
ffffffff81237d10>] ? rtnetlink_rcv+0x30/0x30
[ 2.602721] [<
ffffffff81247958>] ? netlink_rcv_skb+0xa8/0xd0
[ 2.602721] [<
ffffffff81237cff>] ? rtnetlink_rcv+0x1f/0x30
[ 2.602721] [<
ffffffff81247220>] ? netlink_unicast+0x150/0x200
[ 2.602721] [<
ffffffff81247714>] ? netlink_sendmsg+0x374/0x3e0
[ 2.602721] [<
ffffffff8120f8df>] ? sock_sendmsg+0xf/0x30
[ 2.602721] [<
ffffffff8120ffd3>] ? ___sys_sendmsg+0x1f3/0x200
[ 2.602721] [<
ffffffff812100e5>] ? ___sys_recvmsg+0x105/0x140
[ 2.602721] [<
ffffffff810a36f0>] ? SyS_readahead+0x90/0x90
[ 2.602721] [<
ffffffff81098dfd>] ? filemap_map_pages+0x1ed/0x210
[ 2.602721] [<
ffffffff810b77fc>] ? handle_mm_fault+0x5fc/0xe50
[ 2.602721] [<
ffffffff81210ef9>] ? __sys_sendmsg+0x39/0x70
[ 2.602721] [<
ffffffff8133ce17>] ? system_call_fastpath+0x12/0x6a
[ 2.602721] Code: b7 8f a0 06 00 00 48 83 bf 88 06 00 00 00 74 1d 48 83 c4 08 89 ee 4c 89 ef 5b 5d 41 5c 41 5d 0f b7 c9 45 31 c0 e9 51 db ff ff 90 <0f> 0b b8 ea ff ff ff e9 cf fe ff ff 0f 1f 40 00 41 57 41 56 b9
[ 2.602721] RIP [<
ffffffff811f1470>] rocker_port_obj_add+0x150/0x160
[ 2.602721] RSP <
ffff88001f96fa98>
[ 2.615848] ---[ end trace
4f7b4f1c98077108 ]---
The above is resolved by not adding the new FDB entry to the FDB table
if trans == SWITCHDEV_TRANS_PREPARE.
For symmetry this patch also skips deleting FDB entries from the FDB
table trans == SWITCHDEV_TRANS_PREPARE. However, my analysis is that
this never occurs as trans is always SWITCHDEV_TRANS_NONE when removing
FDB entries.
Fixes: c4f20321d968 ("rocker: support prepare-commit transaction model")
Acked-by: Scott Feldman <sfeldma@gmail.com>
Acked-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Simon Horman [Thu, 21 May 2015 03:40:14 +0000 (12:40 +0900)]
rocker: do not delete fdb entries in rocker_port_fdb_flush() when preparing transactions
rocker_port_fdb_flush() is called by rocker_port_stp_update() which in
turn may be called with trans == SWITCHDEV_TRANS_PREPARE and then
trans == SWITCHDEV_TRANS_COMMIT from switchdev_port_attr_set() via
br_set_state().
When rocker_port_fdb_flush() is called with trans == SWITCHDEV_TRANS_PREPARE
it calls rocker_port_fdb_learn() for each entry in the FDB table which in
turn calls rocker_flow_tbl_bridge() which will allocate memory using
rocker_port_kzalloc(). rocker_port_fdb_learn() will then remove the entry
from the FDB table.
Then when rocker_port_fdb_learn() is called with
trans == SWITCHDEV_TRANS_PREPARE no calls are made to rocker_port_fdb_learn()
because there are no longer any entries present in the FDB table. Thus the
memory previously allocated by rocker_port_fdb_learn() is leaked resulting
in the kernel BUG() below.
Furthermore, it looks like the driver ends up with an incorrect view of the
fdb table as the FDB entries are purged from the driver's table but not the
hardware's table.
ip link add br0 type bridge
ip link set up dev eth0
sleep 1
ip link set dev eth0 master br0
[ 3.704360] ------------[ cut here ]------------
[ 3.704611] kernel BUG at drivers/net/ethernet/rocker/rocker.c:4289!
[ 3.704962] invalid opcode: 0000 [#1] SMP
[ 3.705537] Modules linked in:
[ 3.705919] CPU: 0 PID: 63 Comm: ip Not tainted
4.1.0-rc3-01046-gb9fbe709de4d #1044
[ 3.706191] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.0-0-g4c59f5d-20150219_092859-nilsson.home.kraxel.org 04/01/2014
[ 3.706820] task:
ffff880019f70150 ti:
ffff88001f92c000 task.ti:
ffff88001f92c000
[ 3.707138] RIP: 0010:[<
ffffffff811f0080>] [<
ffffffff811f0080>] rocker_port_attr_set+0xe0/0xf0
[ 3.707990] RSP: 0018:
ffff88001f92f808 EFLAGS:
00000212
[ 3.708200] RAX:
ffff880019d4fa68 RBX:
ffff880019d4f000 RCX:
0000000000000000
[ 3.708471] RDX:
000000000000000c RSI:
ffff88001f92f890 RDI:
ffff880019d4f680
[ 3.708740] RBP:
0000000000000001 R08:
0000000000000000 R09:
0000000000000004
[ 3.708999] R10:
ffff880000034024 R11:
0000000000000000 R12:
ffff88001f92f890
[ 3.709276] R13:
ffff88001f8f1c00 R14:
000000000000000b R15:
0000000000000000
[ 3.709303] FS:
00007f8ab66bd700(0000) GS:
ffff88001b000000(0000) knlGS:
0000000000000000
[ 3.709303] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
[ 3.709303] CR2:
0000000000654988 CR3:
000000001f8f3000 CR4:
00000000000006b0
[ 3.709303] DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
[ 3.709303] DR3:
0000000000000000 DR6:
0000000000000000 DR7:
0000000000000000
[ 3.709303] Stack:
[ 3.709303]
ffff88001f8f1c00 000000000000000b ffff88001f92f890 ffff880019d4f000
[ 3.709303]
ffff88001f92f890 ffffffff813332f5 ffff88001f92f880 0000000000000000
[ 3.709303]
ffff88001f92f890 0000000000000001 ffff880019d4f000 ffffffff81333627
[ 3.709303] Call Trace:
[ 3.709303] [<
ffffffff813332f5>] ? __switchdev_port_attr_set+0x25/0x90
[ 3.709303] [<
ffffffff81333627>] ? switchdev_port_attr_set+0x27/0x120
[ 3.709303] [<
ffffffff81318e86>] ? br_set_state+0x36/0x50
[ 3.709303] [<
ffffffff8131795c>] ? br_add_if+0x37c/0x400
[ 3.709303] [<
ffffffff81238ce1>] ? do_setlink+0x7e1/0x800
[ 3.709303] [<
ffffffff8111f980>] ? radix_tree_lookup_slot+0x10/0x30
[ 3.709303] [<
ffffffff81136fba>] ? nla_parse+0xaa/0x110
[ 3.709303] [<
ffffffff81239c98>] ? rtnl_newlink+0x548/0x870
[ 3.709303] [<
ffffffff8111f900>] ? __radix_tree_lookup+0x40/0xb0
[ 3.709303] [<
ffffffff81136f3e>] ? nla_parse+0x2e/0x110
[ 3.709303] [<
ffffffff81237d7e>] ? rtnetlink_rcv_msg+0x7e/0x250
[ 3.709303] [<
ffffffff8121d1be>] ? __skb_recv_datagram+0xfe/0x4b0
[ 3.709303] [<
ffffffff81237d00>] ? rtnetlink_rcv+0x30/0x30
[ 3.709303] [<
ffffffff81247948>] ? netlink_rcv_skb+0xa8/0xd0
[ 3.709303] [<
ffffffff81237cef>] ? rtnetlink_rcv+0x1f/0x30
[ 3.709303] [<
ffffffff81247210>] ? netlink_unicast+0x150/0x200
[ 3.709303] [<
ffffffff81247704>] ? netlink_sendmsg+0x374/0x3e0
[ 3.709303] [<
ffffffff8120f8cf>] ? sock_sendmsg+0xf/0x30
[ 3.709303] [<
ffffffff8120ffc3>] ? ___sys_sendmsg+0x1f3/0x200
[ 3.709303] [<
ffffffff812100d5>] ? ___sys_recvmsg+0x105/0x140
[ 3.709303] [<
ffffffff812228d9>] ? dev_get_by_name_rcu+0x69/0x90
[ 3.709303] [<
ffffffff812228d9>] ? dev_get_by_name_rcu+0x69/0x90
[ 3.709303] [<
ffffffff81217b7d>] ? skb_dequeue+0x4d/0x60
[ 3.709303] [<
ffffffff81217bb0>] ? skb_queue_purge+0x20/0x30
[ 3.709303] [<
ffffffff810ebdcf>] ? __inode_wait_for_writeback+0x5f/0xb0
[ 3.709303] [<
ffffffff810648b0>] ? autoremove_wake_function+0x30/0x30
[ 3.709303] [<
ffffffff81210ee9>] ? __sys_sendmsg+0x39/0x70
[ 3.709303] [<
ffffffff8133e097>] ? system_call_fastpath+0x12/0x6a
[ 3.709303] Code: bb 90 06 00 00 48 c7 04 24 00 00 00 00 45 31 c9 45 31 c0 48 c7 c1 c0 b7 1e 81 89 ea e8 da da ff ff eb 95 0f 1f 84 00 00 00 00 00 <0f> 0b 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 83 fe 15 75
[ 3.709303] RIP [<
ffffffff811f0080>] rocker_port_attr_set+0xe0/0xf0
[ 3.709303] RSP <
ffff88001f92f808>
[ 3.721409] ---[ end trace
b7481fcb7cb032aa ]---
Segmentation fault
Fixes: c4f20321d968 ("rocker: support prepare-commit transaction model")
Acked-by: Scott Feldman <sfeldma@gmail.com>
Acked-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Joe Perches [Wed, 20 May 2015 01:37:55 +0000 (18:37 -0700)]
spider_net: Use DECLARE_BITMAP
Use the generic mechanism to declare a bitmap instead of unsigned long.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Thu, 21 May 2015 21:08:00 +0000 (17:08 -0400)]
Merge branch 'ebpf-tail-call'
Alexei Starovoitov says:
====================
bpf: introduce bpf_tail_call() helper
introduce bpf_tail_call(ctx, &jmp_table, index) helper function
which can be used from BPF programs like:
int bpf_prog(struct pt_regs *ctx)
{
...
bpf_tail_call(ctx, &jmp_table, index);
...
}
that is roughly equivalent to:
int bpf_prog(struct pt_regs *ctx)
{
...
if (jmp_table[index])
return (*jmp_table[index])(ctx);
...
}
The important detail that it's not a normal call, but a tail call.
The kernel stack is precious, so this helper reuses the current
stack frame and jumps into another BPF program without adding
extra call frame.
It's trivially done in interpreter and a bit trickier in JITs.
Use cases:
- simplify complex programs
- dispatch into other programs
(for example: index in jump table can be syscall number or network protocol)
- build dynamic chains of programs
The chain of tail calls can form unpredictable dynamic loops therefore
tail_call_cnt is used to limit the number of calls and currently is set to 32.
patch 1 - support bpf_tail_call() in interpreter
patch 2 - support in x64 JIT
We've discussed what's neccessary to support it in arm64/s390 JITs
and it looks fine.
patch 3 - sample example for tracing
patch 4 - sample example for networking
More details in every patch.
This set went through several iterations of reviews/fixes and older
attempts can be seen:
https://git.kernel.org/cgit/linux/kernel/git/ast/bpf.git/log/?h=tail_call_v[123456]
- tail_call_v1 does it without touching JITs but introduces overhead
for all programs that don't use this helper function.
- tail_call_v2 still has some overhead and x64 JIT does full stack
unwind (prologue skipping optimization wasn't there)
- tail_call_v3 reuses 'call' instruction encoding and has interpreter
overhead for every normal call
- tail_call_v4 fixes above architectural shortcomings and v5,v6 fix few
more bugs
This last tail_call_v6 approach seems to be the best.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Alexei Starovoitov [Tue, 19 May 2015 23:59:06 +0000 (16:59 -0700)]
samples/bpf: bpf_tail_call example for networking
Usage:
$ sudo ./sockex3
IP src.port -> dst.port bytes packets
127.0.0.1.42010 -> 127.0.0.1.12865 1568 8
127.0.0.1.59526 -> 127.0.0.1.33778
11422636 173070
127.0.0.1.33778 -> 127.0.0.1.59526
11260224828 341974
127.0.0.1.12865 -> 127.0.0.1.42010 1832 12
IP src.port -> dst.port bytes packets
127.0.0.1.42010 -> 127.0.0.1.12865 1568 8
127.0.0.1.59526 -> 127.0.0.1.33778
23198092 351486
127.0.0.1.33778 -> 127.0.0.1.59526
22972698518 698616
127.0.0.1.12865 -> 127.0.0.1.42010 1832 12
this example is similar to sockex2 in a way that it accumulates per-flow
statistics, but it does packet parsing differently.
sockex2 inlines full packet parser routine into single bpf program.
This sockex3 example have 4 independent programs that parse vlan, mpls, ip, ipv6
and one main program that starts the process.
bpf_tail_call() mechanism allows each program to be small and be called
on demand potentially multiple times, so that many vlan, mpls, ip in ip,
gre encapsulations can be parsed. These and other protocol parsers can
be added or removed at runtime. TLVs can be parsed in similar manner.
Note, tail_call_cnt dynamic check limits the number of tail calls to 32.
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alexei Starovoitov [Tue, 19 May 2015 23:59:05 +0000 (16:59 -0700)]
samples/bpf: bpf_tail_call example for tracing
kprobe example that demonstrates how future seccomp programs may look like.
It attaches to seccomp_phase1() function and tail-calls other BPF programs
depending on syscall number.
Existing optimized classic BPF seccomp programs generated by Chrome look like:
if (sd.nr < 121) {
if (sd.nr < 57) {
if (sd.nr < 22) {
if (sd.nr < 7) {
if (sd.nr < 4) {
if (sd.nr < 1) {
check sys_read
} else {
if (sd.nr < 3) {
check sys_write and sys_open
} else {
check sys_close
}
}
} else {
} else {
} else {
} else {
} else {
}
the future seccomp using native eBPF may look like:
bpf_tail_call(&sd, &syscall_jmp_table, sd.nr);
which is simpler, faster and leaves more room for per-syscall checks.
Usage:
$ sudo ./tracex5
<...>-366 [001] d... 4.870033: : read(fd=1, buf=
00007f6d5bebf000, size=771)
<...>-369 [003] d... 4.870066: : mmap
<...>-369 [003] d... 4.870077: : syscall=110 (one of get/set uid/pid/gid)
<...>-369 [003] d... 4.870089: : syscall=107 (one of get/set uid/pid/gid)
sh-369 [000] d... 4.891740: : read(fd=0, buf=
00000000023d1000, size=512)
sh-369 [000] d... 4.891747: : write(fd=1, buf=
00000000023d3000, size=512)
sh-369 [000] d... 4.891747: : read(fd=1, buf=
00000000023d3000, size=512)
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alexei Starovoitov [Tue, 19 May 2015 23:59:04 +0000 (16:59 -0700)]
x86: bpf_jit: implement bpf_tail_call() helper
bpf_tail_call() arguments:
ctx - context pointer
jmp_table - one of BPF_MAP_TYPE_PROG_ARRAY maps used as the jump table
index - index in the jump table
In this implementation x64 JIT bypasses stack unwind and jumps into the
callee program after prologue, so the callee program reuses the same stack.
The logic can be roughly expressed in C like:
u32 tail_call_cnt;
void *jumptable[2] = { &&label1, &&label2 };
int bpf_prog1(void *ctx)
{
label1:
...
}
int bpf_prog2(void *ctx)
{
label2:
...
}
int bpf_prog1(void *ctx)
{
...
if (tail_call_cnt++ < MAX_TAIL_CALL_CNT)
goto *jumptable[index]; ... and pass my 'ctx' to callee ...
... fall through if no entry in jumptable ...
}
Note that 'skip current program epilogue and next program prologue' is
an optimization. Other JITs don't have to do it the same way.
>From safety point of view it's valid as well, since programs always
initialize the stack before use, so any residue in the stack left by
the current program is not going be read. The same verifier checks are
done for the calls from the kernel into all bpf programs.
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alexei Starovoitov [Tue, 19 May 2015 23:59:03 +0000 (16:59 -0700)]
bpf: allow bpf programs to tail-call other bpf programs
introduce bpf_tail_call(ctx, &jmp_table, index) helper function
which can be used from BPF programs like:
int bpf_prog(struct pt_regs *ctx)
{
...
bpf_tail_call(ctx, &jmp_table, index);
...
}
that is roughly equivalent to:
int bpf_prog(struct pt_regs *ctx)
{
...
if (jmp_table[index])
return (*jmp_table[index])(ctx);
...
}
The important detail that it's not a normal call, but a tail call.
The kernel stack is precious, so this helper reuses the current
stack frame and jumps into another BPF program without adding
extra call frame.
It's trivially done in interpreter and a bit trickier in JITs.
In case of x64 JIT the bigger part of generated assembler prologue
is common for all programs, so it is simply skipped while jumping.
Other JITs can do similar prologue-skipping optimization or
do stack unwind before jumping into the next program.
bpf_tail_call() arguments:
ctx - context pointer
jmp_table - one of BPF_MAP_TYPE_PROG_ARRAY maps used as the jump table
index - index in the jump table
Since all BPF programs are idenitified by file descriptor, user space
need to populate the jmp_table with FDs of other BPF programs.
If jmp_table[index] is empty the bpf_tail_call() doesn't jump anywhere
and program execution continues as normal.
New BPF_MAP_TYPE_PROG_ARRAY map type is introduced so that user space can
populate this jmp_table array with FDs of other bpf programs.
Programs can share the same jmp_table array or use multiple jmp_tables.
The chain of tail calls can form unpredictable dynamic loops therefore
tail_call_cnt is used to limit the number of calls and currently is set to 32.
Use cases:
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
==========
- simplify complex programs by splitting them into a sequence of small programs
- dispatch routine
For tracing and future seccomp the program may be triggered on all system
calls, but processing of syscall arguments will be different. It's more
efficient to implement them as:
int syscall_entry(struct seccomp_data *ctx)
{
bpf_tail_call(ctx, &syscall_jmp_table, ctx->nr /* syscall number */);
... default: process unknown syscall ...
}
int sys_write_event(struct seccomp_data *ctx) {...}
int sys_read_event(struct seccomp_data *ctx) {...}
syscall_jmp_table[__NR_write] = sys_write_event;
syscall_jmp_table[__NR_read] = sys_read_event;
For networking the program may call into different parsers depending on
packet format, like:
int packet_parser(struct __sk_buff *skb)
{
... parse L2, L3 here ...
__u8 ipproto = load_byte(skb, ... offsetof(struct iphdr, protocol));
bpf_tail_call(skb, &ipproto_jmp_table, ipproto);
... default: process unknown protocol ...
}
int parse_tcp(struct __sk_buff *skb) {...}
int parse_udp(struct __sk_buff *skb) {...}
ipproto_jmp_table[IPPROTO_TCP] = parse_tcp;
ipproto_jmp_table[IPPROTO_UDP] = parse_udp;
- for TC use case, bpf_tail_call() allows to implement reclassify-like logic
- bpf_map_update_elem/delete calls into BPF_MAP_TYPE_PROG_ARRAY jump table
are atomic, so user space can build chains of BPF programs on the fly
Implementation details:
=======================
- high performance of bpf_tail_call() is the goal.
It could have been implemented without JIT changes as a wrapper on top of
BPF_PROG_RUN() macro, but with two downsides:
. all programs would have to pay performance penalty for this feature and
tail call itself would be slower, since mandatory stack unwind, return,
stack allocate would be done for every tailcall.
. tailcall would be limited to programs running preempt_disabled, since
generic 'void *ctx' doesn't have room for 'tail_call_cnt' and it would
need to be either global per_cpu variable accessed by helper and by wrapper
or global variable protected by locks.
In this implementation x64 JIT bypasses stack unwind and jumps into the
callee program after prologue.
- bpf_prog_array_compatible() ensures that prog_type of callee and caller
are the same and JITed/non-JITed flag is the same, since calling JITed
program from non-JITed is invalid, since stack frames are different.
Similarly calling kprobe type program from socket type program is invalid.
- jump table is implemented as BPF_MAP_TYPE_PROG_ARRAY to reuse 'map'
abstraction, its user space API and all of verifier logic.
It's in the existing arraymap.c file, since several functions are
shared with regular array map.
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Borkmann [Tue, 19 May 2015 20:33:25 +0000 (22:33 +0200)]
net: dev: reduce both ingress hook ifdefs
Reduce ifdef pollution slightly, no functional change. We can simply
remove the extra alternative definition of handle_ing() and nf_ingress().
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Tue, 19 May 2015 20:26:55 +0000 (13:26 -0700)]
tcp: add a force_schedule argument to sk_stream_alloc_skb()
In commit
8e4d980ac215 ("tcp: fix behavior for epoll edge trigger")
we fixed a possible hang of TCP sockets under memory pressure,
by allowing sk_stream_alloc_skb() to use sk_forced_mem_schedule()
if no packet is in socket write queue.
It turns out there are other cases where we want to force memory
schedule :
tcp_fragment() & tso_fragment() need to split a big TSO packet into
two smaller ones. If we block here because of TCP memory pressure,
we can effectively block TCP socket from sending new data.
If no further ACK is coming, this hang would be definitive, and socket
has no chance to effectively reduce its memory usage.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Erik Kline [Mon, 18 May 2015 10:44:41 +0000 (19:44 +0900)]
neigh: Better handling of transition to NUD_PROBE state
[1] When entering NUD_PROBE state via neigh_update(), perhaps received
from userspace, correctly (re)initialize the probes count to zero.
This is useful for forcing revalidation of a neighbor (for example
if the host is attempting to do DNA [IPv4 4436, IPv6 6059]).
[2] Notify listeners when a neighbor goes into NUD_PROBE state.
By sending notifications on entry to NUD_PROBE state listeners get
more timely warnings of imminent connectivity issues.
The current notifications on entry to NUD_STALE have somewhat
limited usefulness: NUD_STALE is a perfectly normal state, as is
NUD_DELAY, whereas notifications on entry to NUD_FAILURE come after
a neighbor reachability problem has been confirmed (typically after
three probes).
Signed-off-by: Erik Kline <ek@google.com>
Acked-By: Lorenzo Colitti <lorenzo@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alex Deucher [Wed, 20 May 2015 21:58:49 +0000 (17:58 -0400)]
drm/radeon: fix error flag checking in native aux path
That atom table does not check these bits. Fixes aux
regressions on some boards.
Reported-by: Malte Schröder <malte@tnxip.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Alex Deucher [Mon, 18 May 2015 14:38:25 +0000 (10:38 -0400)]
drm/radeon: retry dcpd fetch
Retry the dpcd fetch several times. Some eDP panels
fail several times before the fetch is successful.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=73530
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Stephane Viau [Wed, 20 May 2015 14:57:27 +0000 (10:57 -0400)]
drm/msm/mdp5: fix incorrect parameter for msm_framebuffer_iova()
The index of ->planes[] array (3rd parameter) cannot be equal to MAX_PLANE.
This looks like a typo that is now fixed.
Signed-off-by: Stephane Viau <sviau@codeaurora.org>
Acked-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
NeilBrown [Wed, 20 May 2015 05:05:09 +0000 (15:05 +1000)]
md/bitmap: remove rcu annotation from pointer arithmetic.
Evaluating "&mddev->disks" is simple pointer arithmetic, so
it does not need 'rcu' annotations - no dereferencing is happening.
Also enhance the comment to explain that 'rdev' in that case
is not actually a pointer to an rdev.
Reported-by: Patrick Marlier <patrick.marlier@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Eric Work [Tue, 19 May 2015 06:26:23 +0000 (23:26 -0700)]
md/raid0: fix restore to sector variable in raid0_make_request
The variable "sector" in "raid0_make_request()" was improperly updated
by a call to "sector_div()" which modifies its first argument in place.
Commit
47d68979cc968535cb87f3e5f2e6a3533ea48fbd restored this variable
after the call for later re-use. Unfortunetly the restore was done after
the referenced variable "bio" was advanced. This lead to the original
value and the restored value being different. Here we move this line to
the proper place.
One observed side effect of this bug was discarding a file though
unlinking would cause an unrelated file's contents to be discarded.
Signed-off-by: NeilBrown <neilb@suse.de>
Fixes: 47d68979cc96 ("md/raid0: fix bug with chunksize not a power of 2.")
Cc: stable@vger.kernel.org (any that received above backport)
URL: https://bugzilla.kernel.org/show_bug.cgi?id=98501
Shaohua Li [Wed, 13 May 2015 16:30:08 +0000 (09:30 -0700)]
raid5: fix broken async operation chain
ops_run_reconstruct6() doesn't correctly chain asyn operations. The tx returned
by async_gen_syndrome should be added as the dependent tx of next stripe.
The issue is introduced by commit
59fc630b8b5f9f21c8ce3ba153341c107dce1b0c
RAID5: batch adjacent full stripe write
Reported-and-tested-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Thomas Hellstrom [Wed, 20 May 2015 21:46:14 +0000 (14:46 -0700)]
Input: vmmouse - do not reference non-existing version of X driver
The vmmouse Kconfig help text was referring to an incorrect user-space
driver version. Fix this.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Hans de Goede [Wed, 20 May 2015 21:37:41 +0000 (14:37 -0700)]
Input: alps - fix finger jumps on lifting 2 fingers on v7 touchpad
On v7 touchpads sometimes when 2 fingers are moved down on the touchpad
until they "fall of" the touchpad, the second touch will report 0 for y
(max y really since the y axis is inverted) and max x as coordinates,
rather then reporting 0, 0 as is expected for a non touching finger.
This commit detects this and treats these touches as non touching.
See the evemu-recording here:
https://bugzilla.redhat.com/attachment.cgi?id=
1025058
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1221200
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Matthew Finlay [Tue, 19 May 2015 07:11:48 +0000 (00:11 -0700)]
IB/cma: Fix broken AF_IB UD support
Support for using UD and AF_IB is currently broken. The
IB_CM_SIDR_REQ_RECEIVED message is not handled properly in
cma_save_net_info() and we end up falling into code that will try and
process the request as ipv4/ipv6, which will end up failing.
The resolution is to add a check for the SIDR_REQ and call
cma_save_ib_info() with a NULL path record. Change cma_save_ib_info()
to copy the src sib info from the listen_id when the path record is NULL.
Reported-by: Hari Shankar <Hari.Shankar@netapp.com>
Signed-off-by: Matt Finlay <matt@mellanox.com>
Acked-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Ted Kim [Thu, 14 May 2015 19:49:01 +0000 (12:49 -0700)]
ib/cm: Change reject message type when destroying cm_id
Problem reported by: Ted Kim <ted.h.kim@oracle.com>:
We have a case where a Linux system and a non-Linux system are
trying to interoperate. The Linux host is the active side and
starts the connection establishment, but later decides to not go
through with the connection setup and does rdma_destroy_id().
The rdma_destroy_id() eventually works its way down to cm_destroy_id()
in core/cm.c, where a REJ is sent. The non-Linux system
has some trouble recognizing the REJ because of:
A. CM states which can't receive the REJ
B. Some issues about REJ formatting (missing comm ID)
ISSUE A: That part of the spec says, a Consumer Reject REJ can be
sent for a connection abort, but it goes further
and says: can send a REJ message with a "Consumer Reject"
Reason code if they are in a CM state (i.e. REP
Rcvd, MRA(REP) Sent, REQ Rcvd, MRA Sent) that allows
a REJ to be sent (lines 35-38).
Of the states listed there in that sentence, it would
seem to limit the active side to using the Consumer Reject
(for the abort case) in just the REP-Rcvd and MRA-REP-Sent
states. That is basically only after the active side
sees a REP (or alternatively goes down the state transitions
to timeout in which case a Timeout REJ is sent).
As a fix, in cm-destroy-id() move the IB-CM-MRA-REQ-RCVD case
to the same as REQ-SENT. Essentially, make a REJ sent after
getting an MRA on active side a timeout rather than Consumer-
Reject, which is arguably more correct with the CM state
diagrams previous to getting a REP.
Signed-off-by: Ted Kim <ted.h.kim@oracle.com>
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Tim Beale [Mon, 18 May 2015 03:38:38 +0000 (15:38 +1200)]
net: phy: Make sure phy_start() always re-enables the phy interrupts
This is an alternative way of fixing:
commit
db9683fb412d ("net: phy: Make sure PHY_RESUMING state change
is always processed")
When the PHY state transitions from PHY_HALTED to PHY_RESUMING, there are
two things we need to do:
1). Re-enable interrupts (and power up the physical link, if powered down)
2). Update the PHY state and net-device based on the link status.
There's no strict reason why #1 has to be done from within the main
phy_state_machine() function. There is a risk that other changes to the
PHY (e.g. setting speed/duplex, which calls phy_start_aneg()) could cause
a subsequent state transition before phy_state_machine() has processed
the PHY_RESUMING state change. This would leave the PHY with interrupts
disabled and/or still in the BMCR_PDOWN/low-power mode.
Moving enabling the interrupts and phy_resume() into phy_start() will
guarantee this work always gets done. As the PHY is already in the HALTED
state and interrupts are disabled, it shouldn't conflict with any work
being done in phy_state_machine(). The downside of this change is that if
the PHY_RESUMING state is ever entered from anywhere else, it'll also have
to repeat this work.
Signed-off-by: Tim Beale <tim.beale@alliedtelesis.co.nz>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Wed, 20 May 2015 16:02:26 +0000 (12:02 -0400)]
Merge branch 'ipv6_ecmp_fixes'
Michal Kubecek says:
====================
IPv6 ECMP route add/replace fixes
(1) When adding a nexthop of a multipath route fails (e.g. because of a
conflict with an existing route), we are supposed to delete nexthops
already added. However, currently we try to also delete all nexthops we
haven't even tried to add yet so that a "ip route add" command can
actually remove pre-existing routes if it fails.
(2) Attempt to replace a multipath route results in a broken siblings
linked list. Following commands (like "ip route del") can then either
follow a link into freed memory or end in an infinite loop (if the slab
object has been reused).
v2: fix an omission in first patch
v3: change the semantics of replace operation to better match IPv4
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Michal Kubeček [Mon, 18 May 2015 18:54:00 +0000 (20:54 +0200)]
ipv6: fix ECMP route replacement
When replacing an IPv6 multipath route with "ip route replace", i.e.
NLM_F_CREATE | NLM_F_REPLACE, fib6_add_rt2node() replaces only first
matching route without fixing its siblings, resulting in corrupted
siblings linked list; removing one of the siblings can then end in an
infinite loop.
IPv6 ECMP implementation is a bit different from IPv4 so that route
replacement cannot work in exactly the same way. This should be a
reasonable approximation:
1. If the new route is ECMP-able and there is a matching ECMP-able one
already, replace it and all its siblings (if any).
2. If the new route is ECMP-able and no matching ECMP-able route exists,
replace first matching non-ECMP-able (if any) or just add the new one.
3. If the new route is not ECMP-able, replace first matching
non-ECMP-able route (if any) or add the new route.
We also need to remove the NLM_F_REPLACE flag after replacing old
route(s) by first nexthop of an ECMP route so that each subsequent
nexthop does not replace previous one.
Fixes: 51ebd3181572 ("ipv6: add support of equal cost multipath (ECMP)")
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Michal Kubeček [Mon, 18 May 2015 18:53:55 +0000 (20:53 +0200)]
ipv6: do not delete previously existing ECMP routes if add fails
If adding a nexthop of an IPv6 multipath route fails, comment in
ip6_route_multipath() says we are going to delete all nexthops already
added. However, current implementation deletes even the routes it
hasn't even tried to add yet. For example, running
ip route add 1234:5678::/64 \
nexthop via fe80::aa dev dummy1 \
nexthop via fe80::bb dev dummy1 \
nexthop via fe80::cc dev dummy1
twice results in removing all routes first command added.
Limit the second (delete) run to nexthops that succeeded in the first
(add) run.
Fixes: 51ebd3181572 ("ipv6: add support of equal cost multipath (ECMP)")
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Florian Westphal [Wed, 20 May 2015 11:42:25 +0000 (13:42 +0200)]
Revert "netfilter: bridge: query conntrack about skb dnat"
This reverts commit
c055d5b03bb4cb69d349d787c9787c0383abd8b2.
There are two issues:
'dnat_took_place' made me think that this is related to
-j DNAT/MASQUERADE.
But thats only one part of the story. This is also relevant for SNAT
when we undo snat translation in reverse/reply direction.
Furthermore, I originally wanted to do this mainly to avoid
storing ipv6 addresses once we make DNAT/REDIRECT work
for ipv6 on bridges.
However, I forgot about SNPT/DNPT which is stateless.
So we can't escape storing address for ipv6 anyway. Might as
well do it for ipv4 too.
Reported-and-tested-by: Bernhard Thaler <bernhard.thaler@wvnet.at>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Dave Jones [Wed, 20 May 2015 00:55:17 +0000 (20:55 -0400)]
netfilter: ensure number of counters is >0 in do_replace()
After improving setsockopt() coverage in trinity, I started triggering
vmalloc failures pretty reliably from this code path:
warn_alloc_failed+0xe9/0x140
__vmalloc_node_range+0x1be/0x270
vzalloc+0x4b/0x50
__do_replace+0x52/0x260 [ip_tables]
do_ipt_set_ctl+0x15d/0x1d0 [ip_tables]
nf_setsockopt+0x65/0x90
ip_setsockopt+0x61/0xa0
raw_setsockopt+0x16/0x60
sock_common_setsockopt+0x14/0x20
SyS_setsockopt+0x71/0xd0
It turns out we don't validate that the num_counters field in the
struct we pass in from userspace is initialized.
The same problem also exists in ebtables, arptables, ipv6, and the
compat variants.
Signed-off-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Francesco Ruggeri [Sun, 17 May 2015 21:30:31 +0000 (14:30 -0700)]
netfilter: nfnetlink_{log,queue}: Register pernet in first place
nfnetlink_{log,queue}_init() register the netlink callback nf*_rcv_nl_event
before registering the pernet_subsys, but the callback relies on data
structures allocated by pernet init functions.
When nfnetlink_{log,queue} is loaded, if a netlink message is received after
the netlink callback is registered but before the pernet_subsys is registered,
the kernel will panic in the sequence
nfulnl_rcv_nl_event
nfnl_log_pernet
net_generic
BUG_ON(id == 0) where id is nfnl_log_net_id.
The panic can be easily reproduced in 4.0.3 by:
while true ;do modprobe nfnetlink_log ; rmmod nfnetlink_log ; done &
while true ;do ip netns add dummy ; ip netns del dummy ; done &
This patch moves register_pernet_subsys to earlier in nfnetlink_log_init.
Notice that the BUG_ON hit in 4.0.3 was recently removed in
2591ffd308
["netns: remove BUG_ONs from net_generic()"].
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Liang Li [Wed, 20 May 2015 20:41:25 +0000 (04:41 +0800)]
kvm/fpu: Enable eager restore kvm FPU for MPX
The MPX feature requires eager KVM FPU restore support. We have verified
that MPX cannot work correctly with the current lazy KVM FPU restore
mechanism. Eager KVM FPU restore should be enabled if the MPX feature is
exposed to VM.
Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
Signed-off-by: Liang Li <liang.z.li@intel.com>
[Also activate the FPU on AMD processors. - Paolo]
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Wed, 20 May 2015 09:33:43 +0000 (11:33 +0200)]
Revert "KVM: x86: drop fpu_activate hook"
This reverts commit
4473b570a7ebb502f63f292ccfba7df622e5fdd3. We'll
use the hook again.
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Andrea Arcangeli [Fri, 8 May 2015 12:32:56 +0000 (14:32 +0200)]
kvm: fix crash in kvm_vcpu_reload_apic_access_page
memslot->userfault_addr is set by the kernel with a mmap executed
from the kernel but the userland can still munmap it and lead to the
below oops after memslot->userfault_addr points to a host virtual
address that has no vma or mapping.
[ 327.538306] BUG: unable to handle kernel paging request at
fffffffffffffffe
[ 327.538407] IP: [<
ffffffff811a7b55>] put_page+0x5/0x50
[ 327.538474] PGD
1a01067 PUD
1a03067 PMD 0
[ 327.538529] Oops: 0000 [#1] SMP
[ 327.538574] Modules linked in: macvtap macvlan xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT iptable_filter ip_tables tun bridge stp llc rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache xprtrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ipmi_devintf iTCO_wdt iTCO_vendor_support intel_powerclamp coretemp dcdbas intel_rapl kvm_intel kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd pcspkr sb_edac edac_core ipmi_si ipmi_msghandler acpi_pad wmi acpi_power_meter lpc_ich mfd_core mei_me
[ 327.539488] mei shpchp nfsd auth_rpcgss nfs_acl lockd grace sunrpc mlx4_ib ib_sa ib_mad ib_core mlx4_en vxlan ib_addr ip_tunnel xfs libcrc32c sd_mod crc_t10dif crct10dif_common crc32c_intel mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm drm ahci i2c_core libahci mlx4_core libata tg3 ptp pps_core megaraid_sas ntb dm_mirror dm_region_hash dm_log dm_mod
[ 327.539956] CPU: 3 PID: 3161 Comm: qemu-kvm Not tainted 3.10.0-240.el7.userfault19.
4ca4011.x86_64.debug #1
[ 327.540045] Hardware name: Dell Inc. PowerEdge R420/0CN7CM, BIOS 2.1.2 01/20/2014
[ 327.540115] task:
ffff8803280ccf00 ti:
ffff880317c58000 task.ti:
ffff880317c58000
[ 327.540184] RIP: 0010:[<
ffffffff811a7b55>] [<
ffffffff811a7b55>] put_page+0x5/0x50
[ 327.540261] RSP: 0018:
ffff880317c5bcf8 EFLAGS:
00010246
[ 327.540313] RAX:
00057ffffffff000 RBX:
ffff880616a20000 RCX:
0000000000000000
[ 327.540379] RDX:
0000000000002014 RSI:
00057ffffffff000 RDI:
fffffffffffffffe
[ 327.540445] RBP:
ffff880317c5bd10 R08:
0000000000000103 R09:
0000000000000000
[ 327.540511] R10:
0000000000000000 R11:
0000000000000000 R12:
fffffffffffffffe
[ 327.540576] R13:
0000000000000000 R14:
ffff880317c5bd70 R15:
ffff880317c5bd50
[ 327.540643] FS:
00007fd230b7f700(0000) GS:
ffff880630800000(0000) knlGS:
0000000000000000
[ 327.540717] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
[ 327.540771] CR2:
fffffffffffffffe CR3:
000000062a2c3000 CR4:
00000000000427e0
[ 327.540837] DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
[ 327.540904] DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
[ 327.540974] Stack:
[ 327.541008]
ffffffffa05d6d0c ffff880616a20000 0000000000000000 ffff880317c5bdc0
[ 327.541093]
ffffffffa05ddaa2 0000000000000000 00000000002191bf 00000042f3feab2d
[ 327.541177]
00000042f3feab2d 0000000000000002 0000000000000001 0321000000000000
[ 327.541261] Call Trace:
[ 327.541321] [<
ffffffffa05d6d0c>] ? kvm_vcpu_reload_apic_access_page+0x6c/0x80 [kvm]
[ 327.543615] [<
ffffffffa05ddaa2>] vcpu_enter_guest+0x3f2/0x10f0 [kvm]
[ 327.545918] [<
ffffffffa05e2f10>] kvm_arch_vcpu_ioctl_run+0x2b0/0x5a0 [kvm]
[ 327.548211] [<
ffffffffa05e2d02>] ? kvm_arch_vcpu_ioctl_run+0xa2/0x5a0 [kvm]
[ 327.550500] [<
ffffffffa05ca845>] kvm_vcpu_ioctl+0x2b5/0x680 [kvm]
[ 327.552768] [<
ffffffff810b8d12>] ? creds_are_invalid.part.1+0x12/0x50
[ 327.555069] [<
ffffffff810b8d71>] ? creds_are_invalid+0x21/0x30
[ 327.557373] [<
ffffffff812d6066>] ? inode_has_perm.isra.49.constprop.65+0x26/0x80
[ 327.559663] [<
ffffffff8122d985>] do_vfs_ioctl+0x305/0x530
[ 327.561917] [<
ffffffff8122dc51>] SyS_ioctl+0xa1/0xc0
[ 327.564185] [<
ffffffff816de829>] system_call_fastpath+0x16/0x1b
[ 327.566480] Code: 0b 31 f6 4c 89 e7 e8 4b 7f ff ff 0f 0b e8 24 fd ff ff e9 a9 fd ff ff 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 <48> f7 07 00 c0 00 00 55 48 89 e5 75 2a 8b 47 1c 85 c0 74 1e f0
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Ping Cheng [Wed, 20 May 2015 00:42:02 +0000 (17:42 -0700)]
HID: wacom: fix an Oops caused by wacom_wac_finger_count_touches
We assumed all touch interfaces report touch data. But, Bamboo
and Intuos non-touch devices report express keys on touch
interface. We need to check touch_max before counting touches.
Reported-by: Tasos Sahanidis <tasos@tasossah.com>
Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Takashi Iwai [Wed, 20 May 2015 04:56:23 +0000 (06:56 +0200)]
ALSA: hda - Disable widget power-saving for ALC292 & co
We've got reports that ALC3226 (a Dell variant of ALC292) gives click
noises at transition from D3 to D0 when the widget power-saving is
enabled. Further debugging session showed that avoiding it isn't
trivial, unfortunately, since paths are basically activated
dynamically while the pins have been already enabled.
This patch disables the widget power-saving for such codecs.
Reported-by: Jonathan McDowell <noodles@earth.li>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Takashi Iwai [Wed, 20 May 2015 04:49:37 +0000 (06:49 +0200)]
ALSA: hda - Reduce verbs by node power-saves
The widget (node) power-saves restore the widget states at each
transition from D3 to D0 on each node. This was added in the commit
[
d545a57c5f84:ALSA: hda - Sync node attributes at resume from widget
power saving]. However, the test was rater false-positive; this
wasn't needed for any codecs.
Since the resync may take significant number of additional verbs to be
executed, it's better to reduce it. Let's disable it for now again.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Arnd Bergmann [Tue, 19 May 2015 15:20:36 +0000 (17:20 +0200)]
ALSA: sound/atmel/ac97c.c: remove unused variable
The recently added DT support for the ac97 driver is causing
a gcc warning:
sound/atmel/ac97c.c: In function 'atmel_ac97c_probe_dt':
sound/atmel/ac97c.c:919:29: warning: unused variable 'match' [-Wunused-variable]
const struct of_device_id *match;
The variable is clearly unused, so we can remove it.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Alexander Stein <alexanders83@web.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Dave Airlie [Tue, 19 May 2015 23:22:00 +0000 (09:22 +1000)]
Merge branch 'exynos-drm-fixes' of git://git./linux/kernel/git/daeinki/drm-exynos into drm-fixes
Summary:
- Use generic function to get buffer count instead of specific one.
In case of Exynos DRM, There was a special case which decides pixel
format of a given buffer according to planer types, which is NV12M and NV12.
However, NV12M doesn't exist in drm fourcc so it removes
exynos_drm_format_num_buffers() specific to Exynos DRM and use a generic function,
drm_format_num_planes() instead.
- Allow mixer driver to support NV21 format for Video processor.
This format was already supported but we just missed DRM_FORMAT_NV21 case
so this patch considers the case so that Mixer driver can handle it correctly.
- Add regression fix and some code cleanups.
* 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
drm/exynos: dp: Lower level of EDID read success message
drm/exynos: cleanup exynos_drm_plane
drm/exynos: 'win' is always unsigned
drm/exynos: mixer: don't dump registers under spinlock
drm/exynos: Consolidate return statements in fimd_bind()
drm/exynos: Constify exynos_drm_crtc_ops
drm/exynos: Fix build breakage on !DRM_EXYNOS_FIMD
drm/exynos: mixer: Constify platform_device_id
drm/exynos: mixer: cleanup pixelformat handling
drm/exynos: mixer: also allow NV21 for the video processor
drm/exynos: mixer: remove buffer count handling in vp_video_buffer()
drm/exynos: plane: honor buffer offset for dma_addr
drm/exynos: fb: use drm_format_num_planes to get buffer count
Andy Zhou [Tue, 19 May 2015 19:41:47 +0000 (12:41 -0700)]
ip: remove unused function prototype
ip_do_nat() function was removed prior to kernel 3.4. Remove the
unnecessary function prototype as well.
Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Andy Zhou <azhou@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Borkmann [Tue, 19 May 2015 19:04:22 +0000 (21:04 +0200)]
tcp: add rfc3168, section 6.1.1.1. fallback
This work as a follow-up of commit
f7b3bec6f516 ("net: allow setting ecn
via routing table") and adds RFC3168 section 6.1.1.1. fallback for outgoing
ECN connections. In other words, this work adds a retry with a non-ECN
setup SYN packet, as suggested from the RFC on the first timeout:
[...] A host that receives no reply to an ECN-setup SYN within the
normal SYN retransmission timeout interval MAY resend the SYN and
any subsequent SYN retransmissions with CWR and ECE cleared. [...]
Schematic client-side view when assuming the server is in tcp_ecn=2 mode,
that is, Linux default since 2009 via commit
255cac91c3c9 ("tcp: extend
ECN sysctl to allow server-side only ECN"):
1) Normal ECN-capable path:
SYN ECE CWR ----->
<----- SYN ACK ECE
ACK ----->
2) Path with broken middlebox, when client has fallback:
SYN ECE CWR ----X crappy middlebox drops packet
(timeout, rtx)
SYN ----->
<----- SYN ACK
ACK ----->
In case we would not have the fallback implemented, the middlebox drop
point would basically end up as:
SYN ECE CWR ----X crappy middlebox drops packet
(timeout, rtx)
SYN ECE CWR ----X crappy middlebox drops packet
(timeout, rtx)
SYN ECE CWR ----X crappy middlebox drops packet
(timeout, rtx)
In any case, it's rather a smaller percentage of sites where there would
occur such additional setup latency: it was found in end of 2014 that ~56%
of IPv4 and 65% of IPv6 servers of Alexa 1 million list would negotiate
ECN (aka tcp_ecn=2 default), 0.42% of these webservers will fail to connect
when trying to negotiate with ECN (tcp_ecn=1) due to timeouts, which the
fallback would mitigate with a slight latency trade-off. Recent related
paper on this topic:
Brian Trammell, Mirja Kühlewind, Damiano Boppart, Iain Learmonth,
Gorry Fairhurst, and Richard Scheffenegger:
"Enabling Internet-Wide Deployment of Explicit Congestion Notification."
Proc. PAM 2015, New York.
http://ecn.ethz.ch/ecn-pam15.pdf
Thus, when net.ipv4.tcp_ecn=1 is being set, the patch will perform RFC3168,
section 6.1.1.1. fallback on timeout. For users explicitly not wanting this
which can be in DC use case, we add a net.ipv4.tcp_ecn_fallback knob that
allows for disabling the fallback.
tp->ecn_flags are not being cleared in tcp_ecn_clear_syn() on output, but
rather we let tcp_ecn_rcv_synack() take that over on input path in case a
SYN ACK ECE was delayed. Thus a spurious SYN retransmission will not prevent
ECN being negotiated eventually in that case.
Reference: https://www.ietf.org/proceedings/92/slides/slides-92-iccrg-1.pdf
Reference: https://www.ietf.org/proceedings/89/slides/slides-89-tsvarea-1.pdf
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mirja Kühlewind <mirja.kuehlewind@tik.ee.ethz.ch>
Signed-off-by: Brian Trammell <trammell@tik.ee.ethz.ch>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Dave That <dave.taht@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 19 May 2015 20:47:32 +0000 (16:47 -0400)]
Merge branch 'cxgb4-next'
Hariprasad Shenai says:
====================
cxgb4: Remove dead code and replace byte-oder functions
This series removes dead fn t4_read_edc and t4_read_mc, also replaces
ntoh{s,l} and hton{s,l} calls with the generic byteorder.
PATCH 2/2 was sent as a single PATCH, but had some byte-ordering issues
in t4_read_edc and t4_read_mc function. Found that t4_read_edc and
t4_read_mc is unused, so PATCH 1/2 is added to remove it.
This patch series is created against net-next tree and includes
patches on cxgb4 driver.
We have included all the maintainers of respective drivers. Kindly review
the change and let us know in case of any review comments.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Hariprasad Shenai [Tue, 19 May 2015 12:50:44 +0000 (18:20 +0530)]
cxgb4: replace ntoh{s, l} and hton{s, l} calls with the generic byteorder
replace ntoh{s,l} and hton{s,l} calls with the generic byteorder in
cxgb4/t4_hw.c file
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Hariprasad Shenai [Tue, 19 May 2015 12:50:43 +0000 (18:20 +0530)]
cxgb4: Remove dead function t4_read_edc and t4_read_mc
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 19 May 2015 20:44:25 +0000 (16:44 -0400)]
Merge tag 'mac80211-for-davem-2015-05-19' of git://git./linux/kernel/git/jberg/mac80211
Johannes Berg says:
====================
This has just a single fix, for a WEP tailroom check
problem that leads to dropped frames.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 19 May 2015 20:43:17 +0000 (16:43 -0400)]
Merge tag 'mac80211-next-for-davem-2015-05-19' of git://git./linux/kernel/git/jberg/mac80211-next
Johannes Berg says:
====================
This just has a few fixes:
* LED throughput trigger was crashing
* fast-xmit wasn't treating QoS changes in IBSS correctly
* TDLS could use the wrong channel definition
* using a reserved channel context could use the wrong channel width
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Arnd Bergmann [Mon, 18 May 2015 21:06:45 +0000 (23:06 +0200)]
be2net: make hwmon interface optional
The hwmon interface in the be2net driver causes a link error when
be2net is built-in while the hwmon subsystem is a loadable module:
drivers/built-in.o: In function `be_probe':
drivers/net/ethernet/emulex/benet/be_main.c:5761: undefined reference to `devm_hwmon_device_register_with_groups'
This adds a new Kconfig symbol, following the example of multiple
other drivers that have the same problem. The new CONFIG_BE2NET_HWMON
will not be available when (BE2NET=y && HWMON=m) to avoid this
problem.
We have to also mark be_hwmon_show_temp as 'static' to ensure the
compiler can optimize out all the unused code.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 29e9122b3a ("be2net: Export board temperature using hwmon-sysfs interface.")
Signed-off-by: David S. Miller <davem@davemloft.net>
Yuchung Cheng [Mon, 18 May 2015 19:31:45 +0000 (12:31 -0700)]
tcp: don't over-send F-RTO probes
After sending the new data packets to probe (step 2), F-RTO may
incorrectly send more probes if the next ACK advances SND_UNA and
does not sack new packet. However F-RTO RFC 5682 probes at most
once. This bug may cause sender to always send new data instead of
repairing holes, inducing longer HoL blocking on the receiver for
the application.
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Yuchung Cheng [Mon, 18 May 2015 19:31:44 +0000 (12:31 -0700)]
tcp: only undo on partial ACKs in CA_Loss
Undo based on TCP timestamps should only happen on ACKs that advance
SND_UNA, according to the Eifel algorithm in RFC 3522:
Section 3.2:
(4) If the value of the Timestamp Echo Reply field of the
acceptable ACK's Timestamps option is smaller than the
value of RetransmitTS, then proceed to step (5),
Section Terminology:
We use the term 'acceptable ACK' as defined in [RFC793]. That is an
ACK that acknowledges previously unacknowledged data.
This is because upon receiving an out-of-order packet, the receiver
returns the last timestamp that advances RCV_NXT, not the current
timestamp of the packet in the DUPACK. Without checking the flag,
the DUPACK will cause tcp_packet_delayed() to return true and
tcp_try_undo_loss() will revert cwnd reduction.
Note that we check the condition in CA_Recovery already by only
calling tcp_try_undo_partial() if FLAG_SND_UNA_ADVANCED is set or
tcp_try_undo_recovery() if snd_una crosses high_seq.
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Henning Rogge [Mon, 18 May 2015 19:08:49 +0000 (21:08 +0200)]
net/ipv6/udp: Fix ipv6 multicast socket filter regression
Commit <
5cf3d46192fc> ("udp: Simplify__udp*_lib_mcast_deliver")
simplified the filter for incoming IPv6 multicast but removed
the check of the local socket address and the UDP destination
address.
This patch restores the filter to prevent sockets bound to a IPv6
multicast IP to receive other UDP traffic link unicast.
Signed-off-by: Henning Rogge <hrogge@gmail.com>
Fixes: 5cf3d46192fc ("udp: Simplify__udp*_lib_mcast_deliver")
Cc: "David S. Miller" <davem@davemloft.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric B Munson [Mon, 18 May 2015 18:35:58 +0000 (14:35 -0400)]
tcp: Return error instead of partial read for saved syn headers
Currently the getsockopt() requesting the cached contents of the syn
packet headers will fail silently if the caller uses a buffer that is
too small to contain the requested data. Rather than fail silently and
discard the headers, getsockopt() should return an error and report the
required size to hold the data.
Signed-off-by: Eric B Munson <emunson@akamai.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: James Morris <jmorris@namei.org>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: Patrick McHardy <kaber@trash.net>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Parav Pandit [Mon, 18 May 2015 11:01:47 +0000 (16:31 +0530)]
net-next: ethtool: Added port speed macros.
Signed-off-by: Parav Pandit <parav.pandit@avagotech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David Vrabel [Tue, 19 May 2015 17:40:49 +0000 (18:40 +0100)]
xen/events: don't bind non-percpu VIRQs with percpu chip
A non-percpu VIRQ (e.g., VIRQ_CONSOLE) may be freed on a different
VCPU than it is bound to. This can result in a race between
handle_percpu_irq() and removing the action in __free_irq() because
handle_percpu_irq() does not take desc->lock. The interrupt handler
sees a NULL action and oopses.
Only use the percpu chip/handler for per-CPU VIRQs (like VIRQ_TIMER).
# cat /proc/interrupts | grep virq
40: 87246 0 xen-percpu-virq timer0
44: 0 0 xen-percpu-virq debug0
47: 0 20995 xen-percpu-virq timer1
51: 0 0 xen-percpu-virq debug1
69: 0 0 xen-dyn-virq xen-pcpu
74: 0 0 xen-dyn-virq mce
75: 29 0 xen-dyn-virq hvc_console
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Cc: <stable@vger.kernel.org>
Linus Torvalds [Tue, 19 May 2015 18:20:48 +0000 (11:20 -0700)]
Merge tag 'nfs-for-4.1-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs
Pull two NFS client bugfixes from Trond Myklebust:
"Highlights include:
- fix a Linux-4.1 regression affecting stat()
- take an extra reference to fl->fl_file when running a setlk"
* tag 'nfs-for-4.1-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
nfs: take extra reference to fl->fl_file when running a setlk
nfs: stat(2) fails during cthon04 basic test5 on NFSv4.0
Linus Torvalds [Tue, 19 May 2015 18:19:49 +0000 (11:19 -0700)]
Merge tag 'powerpc-4.1-4' of git://git./linux/kernel/git/mpe/linux
Pull powerpc fixes from Michael Ellerman:
- THP/hugetlb fixes from Aneesh.
- MCE fix from Daniel.
- TOC fix from Anton.
* tag 'powerpc-4.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux:
powerpc: Align TOC to 256 bytes
powerpc/mce: fix off by one errors in mce event handling
powerpc/mm: Return NULL for not present hugetlb page
powerpc/thp: Serialize pmd clear against a linux page table walk.
Linus Torvalds [Tue, 19 May 2015 18:18:14 +0000 (11:18 -0700)]
Merge tag 'pwm/for-4.1-rc5' of git://git./linux/kernel/git/thierry.reding/linux-pwm
Pull pwm fix from Thierry Reding:
"A single fix to make the Pistachio driver respect the limits imposed
by hardware"
* tag 'pwm/for-4.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm:
pwm: img: Impose upper and lower timebase steps value
Michal Hocko [Tue, 19 May 2015 07:07:27 +0000 (09:07 +0200)]
watchdog: fix double lock in watchdog_nmi_enable_all
Commit
ab992dc38f9a ("watchdog: Fix merge 'conflict'") has introduced an
obvious deadlock because of a typo. watchdog_proc_mutex should be
unlocked on exit.
Thanks to Miroslav Benes who was staring at the code with me and noticed
this.
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Duh-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Eric Dumazet [Tue, 19 May 2015 00:06:14 +0000 (17:06 -0700)]
inet: properly align icsk_ca_priv
tcp_illinois and upcoming tcp_cdg require 64bit alignment of
icsk_ca_priv
x86 does not care, but other architectures might.
Fixes: 05cbc0db03e82 ("ipv4: Create probe timer for tcp PMTU as per RFC4821")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Fan Du <fan.du@intel.com>
Acked-by: Fan Du <fan.du@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Naidu Tellapati [Fri, 8 May 2015 21:47:31 +0000 (18:47 -0300)]
pwm: img: Impose upper and lower timebase steps value
The PWM hardware on Pistachio platform has a maximum timebase steps
value to 255. To fix it, let's introduce a compatible-specific
data structure to contain the SoC-specific details and use it to
specify a maximum timebase.
Also, let's limit the minimum timebase to 16 steps, to allow a sane
range of duty cycle steps.
Fixes: 277bb6a29e00 ("pwm: Imagination Technologies PWM DAC driver")
Signed-off-by: Naidu Tellapati <naidu.tellapati@imgtec.com>
Signed-off-by: Ezequiel Garcia <ezequiel.garcia@imgtec.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Krzysztof Kozlowski [Thu, 14 May 2015 00:03:06 +0000 (09:03 +0900)]
drm/exynos: dp: Lower level of EDID read success message
Don't pollute the dmesg with EDID read success message as an error.
Printing as debug should be fine.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Tobias Jakobi [Sat, 25 Apr 2015 18:06:54 +0000 (20:06 +0200)]
drm/exynos: cleanup exynos_drm_plane
Remove the unused fields of struct exynos_drm_plane.
v2: Remove index_color as well, also unused (thanks Joonyoung).
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Tobias Jakobi [Wed, 6 May 2015 12:10:22 +0000 (14:10 +0200)]
drm/exynos: 'win' is always unsigned
The index for the hardware layer is always >=0. Previous
code that also used -1 as special index is now gone.
Also apply this to 'ch_enabled' (decon/fimd), since the
variable is on the same line (and is again always unsigned).
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Tobias Jakobi [Wed, 6 May 2015 12:10:21 +0000 (14:10 +0200)]
drm/exynos: mixer: don't dump registers under spinlock
mixer_regs_dump() was called in mixer_run(), which was called
under the register spinlock in mixer_graph_buffer() and
vp_video_buffer().
This would trigger a sysmmu pagefault with drm.debug=0xff because
of the large delay caused by the register dumping.
To keep consistency also move register dumping out of mixer_stop(),
which is the counterpart to mixer_run().
Kernel dump:
[ 131.296529] [drm:mixer_win_commit] win: 2
[ 131.300693] [drm:mixer_regs_dump] MXR_STATUS =
00000081
[ 131.305888] [drm:mixer_regs_dump] MXR_CFG =
000007d5
[ 131.310835] [drm:mixer_regs_dump] MXR_INT_EN =
00000000
[ 131.316043] [drm:mixer_regs_dump] MXR_INT_STATUS =
00000900
[ 131.321598] [drm:mixer_regs_dump] MXR_LAYER_CFG =
00000321
[ 131.327066] [drm:mixer_regs_dump] MXR_VIDEO_CFG =
00000000
[ 131.332535] [drm:mixer_regs_dump] MXR_GRAPHIC0_CFG =
00310700
[ 131.338263] [drm:mixer_regs_dump] MXR_GRAPHIC0_BASE =
20c00000
[ 131.344079] [drm:mixer_regs_dump] MXR_GRAPHIC0_SPAN =
00000780
[ 131.349895] [drm:mixer_regs_dump] MXR_GRAPHIC0_WH =
07800438
[ 131.355537] [drm:mixer_regs_dump] MXR_GRAPHIC0_SXY =
00000000
[ 131.361265] [drm:mixer_regs_dump] MXR_GRAPHIC0_DXY =
00000000
[ 131.366994] [drm:mixer_regs_dump] MXR_GRAPHIC1_CFG =
00000000
[ 131.372723] [drm:mixer_regs_dump] MXR_GRAPHIC1_BASE =
00000000
[ 131.378539] [drm:mixer_regs_dump] MXR_GRAPHIC1_SPAN =
00000000
[ 131.384354] [drm:mixer_regs_dump] MXR_GRAPHIC1_WH =
00000000
[ 131.389996] [drm:mixer_regs_dump] MXR_GRAPHIC1_SXY =
00000000
[ 131.395725] [drm:mixer_regs_dump] MXR_GRAPHIC1_DXY =
00000000
[ 131.401486] PAGE FAULT occurred at 0x0 by
12e20000.sysmmu(Page table base: 0x6d990000)
[ 131.409353] Lv1 entry: 0x6e0f2401
[ 131.412753] ------------[ cut here ]------------
[ 131.417339] kernel BUG at drivers/iommu/exynos-iommu.c:358!
[ 131.422894] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
[ 131.428709] Modules linked in: ecb bridge stp llc bnep btrfs xor xor_neon zlib_inflate zlib_deflate raid6_pq btusb bluetooth usb_storage s5p_jpeg
videobuf2_dma_contig videobuf2_memops v4l2_mem2mem videobuf2_core
[ 131.447461] CPU: 0 PID: 2418 Comm: lt-modetest Tainted: G W 4.0.1-debug+ #3
[ 131.455530] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[ 131.461607] task:
ee194100 ti:
ec4fe000 task.ti:
ec4fe000
[ 131.466995] PC is at exynos_sysmmu_irq+0x2a0/0x2a8
[ 131.471766] LR is at vprintk_emit+0x268/0x594
[ 131.476103] pc : [<
c02781a4>] lr : [<
c00650d0>] psr:
a00001d3
[ 131.476103] sp :
ec4ff9d8 ip :
00000000 fp :
ec4ffa14
[ 131.487559] r10:
ffffffda r9 :
ee206e28 r8 :
ee2d1a10
[ 131.492767] r7 :
00000000 r6 :
00000000 r5 :
00000000 r4 :
ee206e10
[ 131.499277] r3 :
c06fca20 r2 :
00000000 r1 :
00000000 r0 :
ee28be00
[ 131.505788] Flags: NzCv IRQs off FIQs off Mode SVC_32 ISA ARM Segment user
[ 131.513079] Control:
10c5387d Table:
6c72404a DAC:
00000015
[ 131.518808] Process lt-modetest (pid: 2418, stack limit = 0xec4fe218)
[ 131.525231] Stack: (0xec4ff9d8 to 0xec500000)
[ 131.529571] f9c0:
ec4ff9e4 c03a0c40
[ 131.537732] f9e0:
bbfa6e35 6d990000 6d161c3d ee20a900 ee04a7e0 00000028 ee007000 00000000
[ 131.545891] fa00:
00000000 c06fb1fc ec4ffa5c ec4ffa18 c0066a34 c0277f10 ee257664 0000000b
[ 131.554050] fa20:
ec4ffa5c c06fafbb ee04a780 c06fb1e8 00000000 ee04a780 ee04a7e0 ee20a900
[ 131.562209] fa40:
ee007000 00000015 ec4ffb48 ee008000 ec4ffa7c ec4ffa60 c0066c90 c00669e0
[ 131.570369] fa60:
00020000 ee04a780 ee04a7e0 00001000 ec4ffa94 ec4ffa80 c0069c6c c0066c58
[ 131.578528] fa80:
00000028 ee004450 ec4ffaac ec4ffa98 c0066028 c0069bac 000000a0 c06e19b4
[ 131.586687] faa0:
ec4ffad4 ec4ffab0 c0223678 c0066000 c02235dc 00000015 00000000 00000015
[ 131.594846] fac0:
ec4ffc80 00000001 ec4ffaec ec4ffad8 c0066028 c02235e8 00000089 c06bfc54
[ 131.603005] fae0:
ec4ffb1c ec4ffaf0 c006633c c0066000 ec4ffb48 f002000c 00000025 00000015
[ 131.611165] fb00:
c06c680c ec4ffb48 f0020000 ee008000 ec4ffb44 ec4ffb20 c000867c c00662c4
[ 131.619324] fb20:
c02046ac 60000153 ffffffff ec4ffb7c 00000000 00000101 ec4ffbb4 ec4ffb48
[ 131.627483] fb40:
c0013240 c0008650 00000001 ee257508 00000002 00000001 ee257504 ee257508
[ 131.635642] fb60:
00000000 c06bf27c 00000000 00000101 ee008000 ec4ffbb4 00000000 ec4ffb90
[ 131.643802] fb80:
c002e124 c02046ac 60000153 ffffffff c002e09c 00000000 c06c6080 00000283
[ 131.651960] fba0:
00000001 c06fb1ac ec4ffc0c ec4ffbb8 c002d690 c002e0a8 ee78d080 ee008000
[ 131.660120] fbc0:
00400000 c04eb3b0 ffff7c44 c06c6100 c06fdac0 0000000a c06bf2f0 c06c6080
[ 131.668279] fbe0:
c06bfc54 c06bfc54 00000000 00000025 00000000 00000001 ec4ffc80 ee008000
[ 131.676438] fc00:
ec4ffc24 ec4ffc10 c002dbb8 c002d564 00000089 c06bfc54 ec4ffc54 ec4ffc28
[ 131.684597] fc20:
c0066340 c002dafc ec4ffc80 f002000c 0000001c 0000000c c06c680c ec4ffc80
[ 131.692757] fc40:
f0020000 00000080 ec4ffc7c ec4ffc58 c000867c c00662c4 c04e6624 60000053
[ 131.700916] fc60:
ffffffff ec4ffcb4 c072df54 ee22d010 ec4ffcdc ec4ffc80 c0013240 c0008650
[ 131.709075] fc80:
ee22d664 ee194100 00000000 ec4fe000 60000053 00000400 00000002 ee22d420
[ 131.717234] fca0:
c072df54 ee22d010 00000080 ec4ffcdc ec4ffcc8 ec4ffcc8 c04e6620 c04e6624
[ 131.725393] fcc0:
60000053 ffffffff ec4fe000 c072df54 ec4ffd34 ec4ffce0 c02b64d0 c04e6618
[ 131.733552] fce0:
ec4ffcf8 00000000 00000000 60000053 00010000 00010000 00000000 200cb000
[ 131.741712] fd00:
20080000 ee22d664 00000001 ee256000 ee261400 ee22d420 00000080 00000080
[ 131.749871] fd20:
ee256000 00000280 ec4ffd74 ec4ffd38 c02a8844 c02b5fec 00000080 00000280
[ 131.758030] fd40:
000001e0 00000000 00000000 00000280 000001e0 ee22d220 01e00000 00000002
[ 131.766189] fd60:
ee22d420 ee261400 ec4ffdbc ec4ffd78 c0293cbc c02a87a4 00000080 00000280
[ 131.774348] fd80:
000001e0 00000000 00000000 02800000 01e00000 ee261400 ee22d460 ee261400
[ 131.782508] fda0:
ee22d420 00000000 01e00000 000001e0 ec4ffe24 ec4ffdc0 c0297800 c0293b24
[ 131.790667] fdc0:
00000080 00000280 000001e0 00000000 00000000 02800000 01e00000 ec4ffdf8
[ 131.798826] fde0:
c028db00 00000080 00000080 ee256000 02800000 00000000 ec4ffe24 c06c6448
[ 131.806985] fe00:
c072df54 000000b7 ee013800 ec4ffe54 edbf7300 ec4ffe54 ec4fff04 ec4ffe28
[ 131.815145] fe20:
c028a848 c029768c 00000001 c06195d8 ec4ffe5c ec4ffe40 c0297680 c0521f6c
[ 131.823304] fe40:
00000030 bed45d38 00000030 c03064b7 ec4ffe8c 00000011 00000015 00000022
[ 131.831463] fe60:
00000000 00000080 00000080 00000280 000001e0 00000000 00000000 01e00000
[ 131.839622] fe80:
02800000 00000000 00000000 0004b000 00000000 00000000 c00121e4 c0011080
[ 131.847781] fea0:
c00110a4 00000000 00000000 00000000 ec4ffeec ec4ffec0 c00110f0 c00121cc
[ 131.855940] fec0:
00000000 c00e7fec ec4ffeec ec4ffed8 c004af2c dc8ba201 edae4fc0 edbf7000
[ 131.864100] fee0:
edbf7000 00000003 bed45d38 00000003 bed45d38 ee3f2040 ec4fff7c ec4fff08
[ 131.872259] ff00:
c010b62c c028a684 edae4fc0 00000000 00000000 b6666000 ec40d108 edae4fc4
[ 131.880418] ff20:
ec4fff6c ec4fff30 c00e7fec c02207b0 000001f9 00000000 edae5008 ec40d110
[ 131.888577] ff40:
00070800 edae5008 edae4fc0 00070800 b6666000 edbf7000 edbf7000 c03064b7
[ 131.896736] ff60:
bed45d38 00000003 ec4fe000 00000000 ec4fffa4 ec4fff80 c010b84c c010b208
[ 131.904896] ff80:
00000022 00000000 bed45d38 c03064b7 00000036 c000ede4 00000000 ec4fffa8
[ 131.913055] ffa0:
c000ec40 c010b81c 00000000 bed45d38 00000003 c03064b7 bed45d38 00000022
[ 131.921214] ffc0:
00000000 bed45d38 c03064b7 00000036 00000080 00000080 00000000 000001e0
[ 131.929373] ffe0:
b6da4064 bed45d1c b6d98968 b6e8082c 60000050 00000003 00000000 00000000
[ 131.937529] Backtrace:
[ 131.939967] [<
c0277f04>] (exynos_sysmmu_irq) from [<
c0066a34>] (handle_irq_event_percpu+0x60/0x278)
[ 131.948988] r10:
c06fb1fc r9:
00000000 r8:
00000000 r7:
ee007000 r6:
00000028 r5:
ee04a7e0
[ 131.956799] r4:
ee20a900
[ 131.959320] [<
c00669d4>] (handle_irq_event_percpu) from [<
c0066c90>] (handle_irq_event+0x44/0x64)
[ 131.968170] r10:
ee008000 r9:
ec4ffb48 r8:
00000015 r7:
ee007000 r6:
ee20a900 r5:
ee04a7e0
[ 131.975982] r4:
ee04a780
[ 131.978504] [<
c0066c4c>] (handle_irq_event) from [<
c0069c6c>] (handle_level_irq+0xcc/0x144)
[ 131.986832] r6:
00001000 r5:
ee04a7e0 r4:
ee04a780 r3:
00020000
[ 131.992478] [<
c0069ba0>] (handle_level_irq) from [<
c0066028>] (generic_handle_irq+0x34/0x44)
[ 132.000894] r5:
ee004450 r4:
00000028
[ 132.004459] [<
c0065ff4>] (generic_handle_irq) from [<
c0223678>] (combiner_handle_cascade_irq+0x9c/0x108)
[ 132.013914] r4:
c06e19b4 r3:
000000a0
[ 132.017476] [<
c02235dc>] (combiner_handle_cascade_irq) from [<
c0066028>] (generic_handle_irq+0x34/0x44)
[ 132.026847] r8:
00000001 r7:
ec4ffc80 r6:
00000015 r5:
00000000 r4:
00000015 r3:
c02235dc
[ 132.034576] [<
c0065ff4>] (generic_handle_irq) from [<
c006633c>] (__handle_domain_irq+0x84/0xf0)
[ 132.043252] r4:
c06bfc54 r3:
00000089
[ 132.046815] [<
c00662b8>] (__handle_domain_irq) from [<
c000867c>] (gic_handle_irq+0x38/0x70)
[ 132.055144] r10:
ee008000 r9:
f0020000 r8:
ec4ffb48 r7:
c06c680c r6:
00000015 r5:
00000025
[ 132.062956] r4:
f002000c r3:
ec4ffb48
[ 132.066520] [<
c0008644>] (gic_handle_irq) from [<
c0013240>] (__irq_svc+0x40/0x74)
[ 132.073980] Exception stack(0xec4ffb48 to 0xec4ffb90)
[ 132.079016] fb40:
00000001 ee257508 00000002 00000001 ee257504 ee257508
[ 132.087176] fb60:
00000000 c06bf27c 00000000 00000101 ee008000 ec4ffbb4 00000000 ec4ffb90
[ 132.095333] fb80:
c002e124 c02046ac 60000153 ffffffff
[ 132.100367] r9:
00000101 r8:
00000000 r7:
ec4ffb7c r6:
ffffffff r5:
60000153 r4:
c02046ac
[ 132.108098] [<
c002e09c>] (tasklet_hi_action) from [<
c002d690>] (__do_softirq+0x138/0x38c)
[ 132.116251] r8:
c06fb1ac r7:
00000001 r6:
00000283 r5:
c06c6080 r4:
00000000 r3:
c002e09c
[ 132.123980] [<
c002d558>] (__do_softirq) from [<
c002dbb8>] (irq_exit+0xc8/0x104)
[ 132.131268] r10:
ee008000 r9:
ec4ffc80 r8:
00000001 r7:
00000000 r6:
00000025 r5:
00000000
[ 132.139080] r4:
c06bfc54
[ 132.141600] [<
c002daf0>] (irq_exit) from [<
c0066340>] (__handle_domain_irq+0x88/0xf0)
[ 132.149409] r4:
c06bfc54 r3:
00000089
[ 132.152971] [<
c00662b8>] (__handle_domain_irq) from [<
c000867c>] (gic_handle_irq+0x38/0x70)
[ 132.161300] r10:
00000080 r9:
f0020000 r8:
ec4ffc80 r7:
c06c680c r6:
0000000c r5:
0000001c
[ 132.169112] r4:
f002000c r3:
ec4ffc80
[ 132.172675] [<
c0008644>] (gic_handle_irq) from [<
c0013240>] (__irq_svc+0x40/0x74)
[ 132.180137] Exception stack(0xec4ffc80 to 0xec4ffcc8)
[ 132.185173] fc80:
ee22d664 ee194100 00000000 ec4fe000 60000053 00000400 00000002 ee22d420
[ 132.193332] fca0:
c072df54 ee22d010 00000080 ec4ffcdc ec4ffcc8 ec4ffcc8 c04e6620 c04e6624
[ 132.201489] fcc0:
60000053 ffffffff
[ 132.204961] r9:
ee22d010 r8:
c072df54 r7:
ec4ffcb4 r6:
ffffffff r5:
60000053 r4:
c04e6624
[ 132.212694] [<
c04e660c>] (_raw_spin_unlock_irqrestore) from [<
c02b64d0>] (mixer_win_commit+0x4f0/0xcc8)
[ 132.222060] r4:
c072df54 r3:
ec4fe000
[ 132.225625] [<
c02b5fe0>] (mixer_win_commit) from [<
c02a8844>] (exynos_update_plane+0xac/0xb8)
[ 132.234126] r10:
00000280 r9:
ee256000 r8:
00000080 r7:
00000080 r6:
ee22d420 r5:
ee261400
[ 132.241937] r4:
ee256000
[ 132.244461] [<
c02a8798>] (exynos_update_plane) from [<
c0293cbc>] (__setplane_internal+0x1a4/0x2c0)
[ 132.253395] r7:
ee261400 r6:
ee22d420 r5:
00000002 r4:
01e00000
[ 132.259041] [<
c0293b18>] (__setplane_internal) from [<
c0297800>] (drm_mode_setplane+0x180/0x244)
[ 132.267804] r9:
000001e0 r8:
01e00000 r7:
00000000 r6:
ee22d420 r5:
ee261400 r4:
ee22d460
[ 132.275535] [<
c0297680>] (drm_mode_setplane) from [<
c028a848>] (drm_ioctl+0x1d0/0x58c)
[ 132.283428] r10:
ec4ffe54 r9:
edbf7300 r8:
ec4ffe54 r7:
ee013800 r6:
000000b7 r5:
c072df54
[ 132.291240] r4:
c06c6448
[ 132.293763] [<
c028a678>] (drm_ioctl) from [<
c010b62c>] (do_vfs_ioctl+0x430/0x614)
[ 132.301222] r10:
ee3f2040 r9:
bed45d38 r8:
00000003 r7:
bed45d38 r6:
00000003 r5:
edbf7000
[ 132.309034] r4:
edbf7000
[ 132.311555] [<
c010b1fc>] (do_vfs_ioctl) from [<
c010b84c>] (SyS_ioctl+0x3c/0x64)
[ 132.318842] r10:
00000000 r9:
ec4fe000 r8:
00000003 r7:
bed45d38 r6:
c03064b7 r5:
edbf7000
[ 132.326654] r4:
edbf7000
[ 132.329176] [<
c010b810>] (SyS_ioctl) from [<
c000ec40>] (ret_fast_syscall+0x0/0x34)
[ 132.336723] r8:
c000ede4 r7:
00000036 r6:
c03064b7 r5:
bed45d38 r4:
00000000 r3:
00000022
[ 132.344451] Code:
e3130002 0affffaf eb09a67d eaffffad (
e7f001f2)
[ 132.350528] ---[ end trace
d428689b94df895c ]---
[ 132.355126] Kernel panic - not syncing: Fatal exception in interrupt
[ 132.361465] CPU2: stopping
[ 132.364155] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D W 4.0.1-debug+ #3
[ 132.371791] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[ 132.377866] Backtrace:
[ 132.380304] [<
c0012484>] (dump_backtrace) from [<
c001269c>] (show_stack+0x18/0x1c)
[ 132.387849] r6:
c06e158c r5:
ffffffff r4:
00000000 r3:
dc8ba201
[ 132.393497] [<
c0012684>] (show_stack) from [<
c04dfb94>] (dump_stack+0x88/0xc8)
[ 132.400698] [<
c04dfb0c>] (dump_stack) from [<
c0014894>] (handle_IPI+0x1c8/0x2c4)
[ 132.408073] r6:
c06bfc54 r5:
c06bfc54 r4:
00000005 r3:
ee0b0000
[ 132.413718] [<
c00146cc>] (handle_IPI) from [<
c00086b0>] (gic_handle_irq+0x6c/0x70)
[ 132.421267] r9:
f0028000 r8:
ee0b1f48 r7:
c06c680c r6:
fffffff5 r5:
00000005 r4:
f002800c
[ 132.428995] [<
c0008644>] (gic_handle_irq) from [<
c0013240>] (__irq_svc+0x40/0x74)
[ 132.436457] Exception stack(0xee0b1f48 to 0xee0b1f90)
[ 132.441493] 1f40:
00000001 00000000 00000000 c00206c0 c06c6518 c04eb3a4
[ 132.449653] 1f60:
00000000 00000000 c06c0dc0 00000001 c06fb774 ee0b1f9c ee0b1fa0 ee0b1f90
[ 132.457811] 1f80:
c000f82c c000f830 600f0053 ffffffff
[ 132.462844] r9:
00000001 r8:
c06c0dc0 r7:
ee0b1f7c r6:
ffffffff r5:
600f0053 r4:
c000f830
[ 132.470575] [<
c000f7f0>] (arch_cpu_idle) from [<
c005b6e8>] (cpu_startup_entry+0x318/0x4ec)
[ 132.478818] [<
c005b3d0>] (cpu_startup_entry) from [<
c00144d0>] (secondary_start_kernel+0xf4/0x100)
[ 132.487755] r7:
c06fd440
[ 132.490279] [<
c00143dc>] (secondary_start_kernel) from [<
40008744>] (0x40008744)
[ 132.497651] r4:
6e09006a r3:
c000872c
[ 132.501210] CPU3: stopping
[ 132.503904] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G D W 4.0.1-debug+ #3
[ 132.511539] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[ 132.517614] Backtrace:
[ 132.520051] [<
c0012484>] (dump_backtrace) from [<
c001269c>] (show_stack+0x18/0x1c)
[ 132.527597] r6:
c06e158c r5:
ffffffff r4:
00000000 r3:
dc8ba201
[ 132.533243] [<
c0012684>] (show_stack) from [<
c04dfb94>] (dump_stack+0x88/0xc8)
[ 132.540446] [<
c04dfb0c>] (dump_stack) from [<
c0014894>] (handle_IPI+0x1c8/0x2c4)
[ 132.547820] r6:
c06bfc54 r5:
c06bfc54 r4:
00000005 r3:
ee0b2000
[ 132.553466] [<
c00146cc>] (handle_IPI) from [<
c00086b0>] (gic_handle_irq+0x6c/0x70)
[ 132.561014] r9:
f002c000 r8:
ee0b3f48 r7:
c06c680c r6:
fffffff5 r5:
00000005 r4:
f002c00c
[ 132.568743] [<
c0008644>] (gic_handle_irq) from [<
c0013240>] (__irq_svc+0x40/0x74)
[ 132.576205] Exception stack(0xee0b3f48 to 0xee0b3f90)
[ 132.581241] 3f40:
00000001 00000000 00000000 c00206c0 c06c6518 c04eb3a4
[ 132.589401] 3f60:
00000000 00000000 c06c0dc0 00000001 c06fb774 ee0b3f9c ee0b3fa0 ee0b3f90
[ 132.597558] 3f80:
c000f82c c000f830 600f0053 ffffffff
[ 132.602591] r9:
00000001 r8:
c06c0dc0 r7:
ee0b3f7c r6:
ffffffff r5:
600f0053 r4:
c000f830
[ 132.610321] [<
c000f7f0>] (arch_cpu_idle) from [<
c005b6e8>] (cpu_startup_entry+0x318/0x4ec)
[ 132.618566] [<
c005b3d0>] (cpu_startup_entry) from [<
c00144d0>] (secondary_start_kernel+0xf4/0x100)
[ 132.627503] r7:
c06fd440
[ 132.630023] [<
c00143dc>] (secondary_start_kernel) from [<
40008744>] (0x40008744)
[ 132.637399] r4:
6e09006a r3:
c000872c
[ 132.640958] CPU1: stopping
[ 132.643651] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G D W 4.0.1-debug+ #3
[ 132.651287] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[ 132.657362] Backtrace:
[ 132.659799] [<
c0012484>] (dump_backtrace) from [<
c001269c>] (show_stack+0x18/0x1c)
[ 132.667344] r6:
c06e158c r5:
ffffffff r4:
00000000 r3:
dc8ba201
[ 132.672991] [<
c0012684>] (show_stack) from [<
c04dfb94>] (dump_stack+0x88/0xc8)
[ 132.680194] [<
c04dfb0c>] (dump_stack) from [<
c0014894>] (handle_IPI+0x1c8/0x2c4)
[ 132.687569] r6:
c06bfc54 r5:
c06bfc54 r4:
00000005 r3:
ee0ae000
[ 132.693214] [<
c00146cc>] (handle_IPI) from [<
c00086b0>] (gic_handle_irq+0x6c/0x70)
[ 132.700762] r9:
f0024000 r8:
ee0aff48 r7:
c06c680c r6:
fffffff5 r5:
00000005 r4:
f002400c
[ 132.708491] [<
c0008644>] (gic_handle_irq) from [<
c0013240>] (__irq_svc+0x40/0x74)
[ 132.715953] Exception stack(0xee0aff48 to 0xee0aff90)
[ 132.720989] ff40:
00000001 00000000 00000000 c00206c0 c06c6518 c04eb3a4
[ 132.729149] ff60:
00000000 00000000 c06c0dc0 00000001 c06fb774 ee0aff9c ee0affa0 ee0aff90
[ 132.737306] ff80:
c000f82c c000f830 60070053 ffffffff
[ 132.742339] r9:
00000001 r8:
c06c0dc0 r7:
ee0aff7c r6:
ffffffff r5:
60070053 r4:
c000f830
[ 132.750069] [<
c000f7f0>] (arch_cpu_idle) from [<
c005b6e8>] (cpu_startup_entry+0x318/0x4ec)
[ 132.758314] [<
c005b3d0>] (cpu_startup_entry) from [<
c00144d0>] (secondary_start_kernel+0xf4/0x100)
[ 132.767251] r7:
c06fd440
[ 132.769772] [<
c00143dc>] (secondary_start_kernel) from [<
40008744>] (0x40008744)
[ 132.777146] r4:
6e09006a r3:
c000872c
[ 132.780709] ---[ end Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Krzysztof Kozlowski [Thu, 7 May 2015 00:04:46 +0000 (09:04 +0900)]
drm/exynos: Consolidate return statements in fimd_bind()
Simplify the code and remove superfluous return statement. Just return
the result of fimd_iommu_attach_devices().
Signed-off-by: Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
Reviewed-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Tested-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Krzysztof Kozlowski [Thu, 7 May 2015 00:04:45 +0000 (09:04 +0900)]
drm/exynos: Constify exynos_drm_crtc_ops
The Exynos DRM code does not modify the ops provided by CRTC driver in
exynos_drm_crtc_create() call.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
Reviewed-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Tested-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Krzysztof Kozlowski [Thu, 7 May 2015 00:04:44 +0000 (09:04 +0900)]
drm/exynos: Fix build breakage on !DRM_EXYNOS_FIMD
Disabling the CONFIG_DRM_EXYNOS_FIMD (e.g. by enabling of CONFIG_FB_S3C)
leads to build error:
drivers/built-in.o: In function `exynos_dp_dpms':
binder.c:(.text+0xd6a840): undefined reference to `fimd_dp_clock_enable'
binder.c:(.text+0xd6ab54): undefined reference to `fimd_dp_clock_enable'
Fix this by changing direct call to fimd_dp_clock_enable() into optional
call to exynos_drm_crtc_ops->clock_enable(). Only the DRM_EXYNOS_FIMD
implements this op.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
Reviewed-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Tested-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Krzysztof Kozlowski [Fri, 1 May 2015 15:56:36 +0000 (00:56 +0900)]
drm/exynos: mixer: Constify platform_device_id
The platform_device_id is not modified by the driver and core uses it as
const.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Tobias Jakobi [Mon, 27 Apr 2015 21:11:59 +0000 (23:11 +0200)]
drm/exynos: mixer: cleanup pixelformat handling
Move the defines for the pixelformats that the mixer supports out
of mixer_graph_buffer() to the top of the source.
Then select the mixer pixelformat (pf) in mixer_graph_buffer() based on
the plane's pf (and not bpp).
Also add handling of RGB565 and XRGB1555 to the switch statement and
exit early if the plane has an unsupported pf.
Partially based on 'drm/exynos: enable/disable blend based on pixel
format' by Gustavo Padovan <gustavo.padovan@collabora.co.uk>.
v2: Use the shorter MXR_FORMAT as prefix.
v3: Re-add ARGB8888 because of compatibility reasons
(suggested by Joonyoung Shim).
Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
Acked-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Tobias Jakobi [Mon, 27 Apr 2015 21:10:16 +0000 (23:10 +0200)]
drm/exynos: mixer: also allow NV21 for the video processor
All the necessary code is already there, just need to
handle the format in the switch statement.
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
Acked-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Tobias Jakobi [Mon, 27 Apr 2015 21:10:15 +0000 (23:10 +0200)]
drm/exynos: mixer: remove buffer count handling in vp_video_buffer()
The video processor (VP) supports four formats: NV12, NV21 and its
tiled variants. All these formats are bi-planar, so the buffer
count in vp_video_buffer() is always 2.
Also properly exit if we're called with an invalid (non-VP) pixelformat.
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
Acked-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Tobias Jakobi [Mon, 27 Apr 2015 21:10:14 +0000 (23:10 +0200)]
drm/exynos: plane: honor buffer offset for dma_addr
Previously we were ignoring the buffer offsets that are
passed through the addfb2 ioctl. This didn't cause any
major issues, since for uni-planar formats (like XRGB8888)
userspace would most of the time just use offsets[0]=0.
However with NV12 offsets[1] is very likely non-zero.
So properly apply the offsets to our dma addresses.
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
Acked-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Tobias Jakobi [Mon, 27 Apr 2015 21:10:13 +0000 (23:10 +0200)]
drm/exynos: fb: use drm_format_num_planes to get buffer count
The previous code had some special case handling for the buffer
count in exynos_drm_format_num_buffers().
This code was incorrect though, since this special case doesn't
exist for DRM. It stemmed from the existence of the special NV12M
V4L2 format. NV12 is a bi-planar format (separate planes for luma
and chroma) and V4L2 differentiates between a NV12 buffer where
luma and chroma is contiguous in memory (so no data between
luma/chroma), and a NV12 buffer where luma and chroma have two
explicit memory locations (which is then called NV12M).
This distinction doesn't exist for DRM. A bi-planar format always
explicitly comes with the information about its two planes (even
if these planes should be contiguous).
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
Acked-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Takashi Iwai [Tue, 19 May 2015 08:46:49 +0000 (10:46 +0200)]
ALSA: usb-audio: Add quirk for MS LifeCam Studio
Microsoft LifeCam Studio (045e:0772) needs a similar quirk for
suppressing the wrong sample rate inquiry.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=98481
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Martin Schwidefsky [Wed, 13 May 2015 12:33:22 +0000 (14:33 +0200)]
s390/mm: correct return value of pmd_pfn
Git commit
152125b7a882df36a55a8eadbea6d0edf1461ee7
"s390/mm: implement dirty bits for large segment table entries"
broke the pmd_pfn function, it changed the return value from
'unsigned long' to 'int'. This breaks all machine configurations
with memory above the 8TB line.
Cc: stable@vger.kernel.org # 3.17+
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Koro Chen [Wed, 13 May 2015 14:39:03 +0000 (22:39 +0800)]
ALSA: pcm: Modify double acknowledged interrupts check condition
Currently in snd_pcm_update_hw_ptr0 during interrupt,
we consider there were double acknowledged interrupts when:
1. HW reported pointer is smaller than expected, and
2. Time from last update time (hdelta) is over half a buffer time.
However, when HW reported pointer is only a few bytes smaller than
expected, and when hdelta is just a little larger than half a buffer time
(e.g. ping-pong buffer), it wrongly treats this IRQ as double acknowledged.
The condition #2 uses jiffies, but jiffies is not high resolution
since it is integer. We should consider jiffies inaccuracy.
Signed-off-by: Koro Chen <koro.chen@mediatek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Thomas Gummerer [Thu, 14 May 2015 07:16:39 +0000 (09:16 +0200)]
drm/i915: fix screen flickering
Commit
c9f038a1a592 ("drm/i915: Don't assume primary & cursor are
always on for wm calculation (v4)") fixes a null pointer dereference.
Setting the primary and cursor panes to false in
ilk_compute_wm_parameters to false does however give the following
errors in the kernel log and causes the screen to flicker.
[ 101.133716] [drm:intel_set_cpu_fifo_underrun_reporting [i915]]
*ERROR* uncleared fifo underrun on pipe A
[ 101.133725] [drm:intel_cpu_fifo_underrun_irq_handler [i915]]
*ERROR* CPU pipe A FIFO underrun
Always setting the panes to enabled fixes this error.
Helped-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Thomas Gummerer <t.gummerer@gmail.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Tested-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
David S. Miller [Tue, 19 May 2015 04:15:50 +0000 (00:15 -0400)]
Merge branch 'icmp_frag'
Andy Zhou says:
====================
fragmentation ICMP
Currently, we send ICMP packets when errors occur during fragmentation or
de-fragmentation. However, it is a bug when sending those ICMP packets
in the context of using netfilter for bridging.
Those ICMP packets are only expected in the context of routing, not in
bridging mode.
The local stack is not involved in bridging forward decisions, thus
should be not used for deciding the reverse path for those ICMP messages.
This bug only affects IPV4, not in IPv6.
v1->v2: restructure the patches into two patches that fix defragmentation and
fragmentation respectively.
A bit is add in IPCB to control whether ICMP packet should be
generated for defragmentation.
Fragmentation ICMP is now removed by restructuring the
ip_fragment() API.
v2->v3: Add droping icmp for bridging contrack users
drop exporting ip_fragment() API.
v3->v4: Remove unnecessary parentheses in 'return' statements
v4->v5: Drop the patch that sets and checks a bit in IPCB
that prevents ip_defrag to send ICMP.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy Zhou [Fri, 15 May 2015 21:15:37 +0000 (14:15 -0700)]
bridge_netfilter: No ICMP packet on IPv4 fragmentation error
When bridge netfilter re-fragments an IP packet for output, all
packets that can not be re-fragmented to their original input size
should be silently discarded.
However, current bridge netfilter output path generates an ICMP packet
with 'size exceeded MTU' message for such packets, this is a bug.
This patch refactors the ip_fragment() API to allow two separate
use cases. The bridge netfilter user case will not
send ICMP, the routing output will, as before.
Signed-off-by: Andy Zhou <azhou@nicira.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy Zhou [Fri, 15 May 2015 21:15:36 +0000 (14:15 -0700)]
IPv4: skip ICMP for bridge contrack users when defrag expires
users in [IP_DEFRAG_CONNTRACK_BRIDGE_IN, __IP_DEFRAG_CONNTRACK_BR_IN]
should not ICMP message also.
Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Andy Zhou <azhou@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy Zhou [Fri, 15 May 2015 21:15:35 +0000 (14:15 -0700)]
ipv4: introduce frag_expire_skip_icmp()
Improve readability of skip ICMP for de-fragmentation expiration logic.
This change will also make the logic easier to maintain when the
following patches in this series are applied.
Signed-off-by: Andy Zhou <azhou@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jean Delvare [Mon, 27 Apr 2015 14:37:39 +0000 (16:37 +0200)]
hwmon: Update the location of my quilt tree
This new location was supposed to be temporary, but a couple years
have elapsed and it's still there, so apparently it's there to stay.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Dave Airlie [Tue, 19 May 2015 00:17:34 +0000 (10:17 +1000)]
Merge branch 'msm-fixes-4.1' of git://people.freedesktop.org/~robclark/linux into drm-fixes
msm fixes, pretty scattered.
* 'msm-fixes-4.1' of git://people.freedesktop.org/~robclark/linux:
drm/msm: fix locking inconsistencies in gpu->destroy()
drm/msm/dsi: Simplify the code to get the number of read byte
drm/msm: Attach assigned encoder to eDP and DSI connectors
drm/msm: setup vram after component_bind_all()
drm/msm/dsi: use pr_err_ratelimited
drm/msm: fix unbalanced DRM framebuffer init/destroy
drm/msm/mdp5: Fix iteration on INTF config array
drm/msm/dsi: Fixup missing *break* statement during cmd rx
drm/msm/dp: fix error return code
drm: msm: Fix build when legacy fbdev support isn't set
drm/msm/dsi: Fix a couple more 64-bit build warnings
drm/msm: Fix a couple of 64-bit build warnings
Zhang Rui [Tue, 19 May 2015 00:12:27 +0000 (08:12 +0800)]
Merge branch 'fixes' of git://git./linux/kernel/git/evalenti/linux-soc-thermal into for-rc
Shaohua Li [Fri, 8 May 2015 17:51:29 +0000 (10:51 -0700)]
sched: always use blk_schedule_flush_plug in io_schedule_out
block plug callback could sleep, so we introduce a parameter
'from_schedule' and corresponding drivers can use it to destinguish a
schedule plug flush or a plug finish. Unfortunately io_schedule_out
still uses blk_flush_plug(). This causes below output (Note, I added a
might_sleep() in raid1_unplug to make it trigger faster, but the whole
thing doesn't matter if I add might_sleep). In raid1/10, this can cause
deadlock.
This patch makes io_schedule_out always uses blk_schedule_flush_plug.
This should only impact drivers (as far as I know, raid 1/10) which are
sensitive to the 'from_schedule' parameter.
[ 370.817949] ------------[ cut here ]------------
[ 370.817960] WARNING: CPU: 7 PID: 145 at ../kernel/sched/core.c:7306 __might_sleep+0x7f/0x90()
[ 370.817969] do not call blocking ops when !TASK_RUNNING; state=2 set at [<
ffffffff81092fcf>] prepare_to_wait+0x2f/0x90
[ 370.817971] Modules linked in: raid1
[ 370.817976] CPU: 7 PID: 145 Comm: kworker/u16:9 Tainted: G W 4.0.0+ #361
[ 370.817977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014
[ 370.817983] Workqueue: writeback bdi_writeback_workfn (flush-9:1)
[ 370.817985]
ffffffff81cd83be ffff8800ba8cb298 ffffffff819dd7af 0000000000000001
[ 370.817988]
ffff8800ba8cb2e8 ffff8800ba8cb2d8 ffffffff81051afc ffff8800ba8cb2c8
[ 370.817990]
ffffffffa00061a8 000000000000041e 0000000000000000 ffff8800ba8cba28
[ 370.817993] Call Trace:
[ 370.817999] [<
ffffffff819dd7af>] dump_stack+0x4f/0x7b
[ 370.818002] [<
ffffffff81051afc>] warn_slowpath_common+0x8c/0xd0
[ 370.818004] [<
ffffffff81051b86>] warn_slowpath_fmt+0x46/0x50
[ 370.818006] [<
ffffffff81092fcf>] ? prepare_to_wait+0x2f/0x90
[ 370.818008] [<
ffffffff81092fcf>] ? prepare_to_wait+0x2f/0x90
[ 370.818010] [<
ffffffff810776ef>] __might_sleep+0x7f/0x90
[ 370.818014] [<
ffffffffa0000c03>] raid1_unplug+0xd3/0x170 [raid1]
[ 370.818024] [<
ffffffff81421d9a>] blk_flush_plug_list+0x8a/0x1e0
[ 370.818028] [<
ffffffff819e3550>] ? bit_wait+0x50/0x50
[ 370.818031] [<
ffffffff819e21b0>] io_schedule_timeout+0x130/0x140
[ 370.818033] [<
ffffffff819e3586>] bit_wait_io+0x36/0x50
[ 370.818034] [<
ffffffff819e31b5>] __wait_on_bit+0x65/0x90
[ 370.818041] [<
ffffffff8125b67c>] ? ext4_read_block_bitmap_nowait+0xbc/0x630
[ 370.818043] [<
ffffffff819e3550>] ? bit_wait+0x50/0x50
[ 370.818045] [<
ffffffff819e3302>] out_of_line_wait_on_bit+0x72/0x80
[ 370.818047] [<
ffffffff810935e0>] ? autoremove_wake_function+0x40/0x40
[ 370.818050] [<
ffffffff811de744>] __wait_on_buffer+0x44/0x50
[ 370.818053] [<
ffffffff8125ae80>] ext4_wait_block_bitmap+0xe0/0xf0
[ 370.818058] [<
ffffffff812975d6>] ext4_mb_init_cache+0x206/0x790
[ 370.818062] [<
ffffffff8114bc6c>] ? lru_cache_add+0x1c/0x50
[ 370.818064] [<
ffffffff81297c7e>] ext4_mb_init_group+0x11e/0x200
[ 370.818066] [<
ffffffff81298231>] ext4_mb_load_buddy+0x341/0x360
[ 370.818068] [<
ffffffff8129a1a3>] ext4_mb_find_by_goal+0x93/0x2f0
[ 370.818070] [<
ffffffff81295b54>] ? ext4_mb_normalize_request+0x1e4/0x5b0
[ 370.818072] [<
ffffffff8129ab67>] ext4_mb_regular_allocator+0x67/0x460
[ 370.818074] [<
ffffffff81295b54>] ? ext4_mb_normalize_request+0x1e4/0x5b0
[ 370.818076] [<
ffffffff8129ca4b>] ext4_mb_new_blocks+0x4cb/0x620
[ 370.818079] [<
ffffffff81290956>] ext4_ext_map_blocks+0x4c6/0x14d0
[ 370.818081] [<
ffffffff812a4d4e>] ? ext4_es_lookup_extent+0x4e/0x290
[ 370.818085] [<
ffffffff8126399d>] ext4_map_blocks+0x14d/0x4f0
[ 370.818088] [<
ffffffff81266fbd>] ext4_writepages+0x76d/0xe50
[ 370.818094] [<
ffffffff81149691>] do_writepages+0x21/0x50
[ 370.818097] [<
ffffffff811d5c00>] __writeback_single_inode+0x60/0x490
[ 370.818099] [<
ffffffff811d630a>] writeback_sb_inodes+0x2da/0x590
[ 370.818103] [<
ffffffff811abf4b>] ? trylock_super+0x1b/0x50
[ 370.818105] [<
ffffffff811abf4b>] ? trylock_super+0x1b/0x50
[ 370.818107] [<
ffffffff811d665f>] __writeback_inodes_wb+0x9f/0xd0
[ 370.818109] [<
ffffffff811d69db>] wb_writeback+0x34b/0x3c0
[ 370.818111] [<
ffffffff811d70df>] bdi_writeback_workfn+0x23f/0x550
[ 370.818116] [<
ffffffff8106bbd8>] process_one_work+0x1c8/0x570
[ 370.818117] [<
ffffffff8106bb5b>] ? process_one_work+0x14b/0x570
[ 370.818119] [<
ffffffff8106c09b>] worker_thread+0x11b/0x470
[ 370.818121] [<
ffffffff8106bf80>] ? process_one_work+0x570/0x570
[ 370.818124] [<
ffffffff81071868>] kthread+0xf8/0x110
[ 370.818126] [<
ffffffff81071770>] ? kthread_create_on_node+0x210/0x210
[ 370.818129] [<
ffffffff819e9322>] ret_from_fork+0x42/0x70
[ 370.818131] [<
ffffffff81071770>] ? kthread_create_on_node+0x210/0x210
[ 370.818132] ---[ end trace
7b4deb71e68b6605 ]---
V2: don't change ->in_iowait
Cc: NeilBrown <neilb@suse.de>
Signed-off-by: Shaohua Li <shli@fb.com>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Willem de Bruijn [Mon, 18 May 2015 19:42:11 +0000 (15:42 -0400)]
selftests/net: expect headroom in psock_fanout rollover
psock_fanout tests the various fanout modes. Change the test for
rollover mode to expect early rollover due to socket pressure
as implemented in
2ccdbaa6d55b ("packet: rollover lock contention
avoidance").
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
John W. Linville [Mon, 18 May 2015 17:51:24 +0000 (13:51 -0400)]
vxlan: correct typo in call to unregister_netdevice_queue
By inspection, this appears to be a typo. The gating comparison
involves vxlan->dev rather than dev. In fact, dev is the iterator in
the preceding loop above but it is actually constant in the 2nd loop.
Use of dev seems to be a bad cut-n-paste from the prior call to
unregister_netdevice_queue. Change dev to vxlan->dev, since that is
what is actually being checked.
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Edward Cree [Mon, 18 May 2015 13:18:27 +0000 (14:18 +0100)]
sfc: nicer log message on Siena SR-IOV probe fail
We expect that MC_CMD_SRIOV will fail if the card has no VFs configured.
So output a readable message instead of a cryptic MCDI error.
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This page took 0.079352 seconds and 5 git commands to generate.