Avri Altman [Thu, 24 Jul 2014 16:25:10 +0000 (19:25 +0300)]
iwlwifi: trans: configure the scheduler enable register
Currently the firmware is handling this, but that is wrong as it then
needs to assume a certain command queue, therefore this should be in
the driver; add it here so it can be removed from the firmware in the
future.
Signed-off-by: Avri Altman <avri.altman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Johannes Berg [Fri, 1 Aug 2014 11:33:46 +0000 (13:33 +0200)]
iwlwifi: trans: make aggregation explicit for TX queue handling
Currently a valid sta_id is assumed to mean that the queue is
meant to also be aggregated, but that assumption will not be
true in the future, so don't make it in the lower level but
only in the inline wrapper.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Johannes Berg [Fri, 1 Aug 2014 10:17:40 +0000 (12:17 +0200)]
iwlwifi: trans: allow skipping scheduler hardware config
In a later patch, the hardware configuration will be moved to
firmware. Prepare for this by allowing hardware configuration
in the transport to be skipped by not passing a configuration
on enable and passing configure_scd=false on disable.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Eran Harary [Mon, 4 Aug 2014 09:21:05 +0000 (12:21 +0300)]
iwlwifi: mvm: fix comment typo
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Johannes Berg [Tue, 5 Aug 2014 08:36:54 +0000 (10:36 +0200)]
iwlwifi: don't export tracepoints unnecessarily
The tracepoints that are only used in code linked with iwlwifi.ko,
as are the tracepoints, don't need to be exported, so don't.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Johannes Berg [Mon, 4 Aug 2014 14:39:54 +0000 (16:39 +0200)]
iwlwifi: mvm: add some debugging to quota allocation
In order to follow more easily what's going on, add some
debug statements to the quota allocation algorithm.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
David Spinadel [Tue, 22 Jul 2014 10:11:18 +0000 (13:11 +0300)]
iwlwifi: mvm: enable passive fragmented scan changes
Enable fragmented scan that was diabled due to a FW bug.
New fixed FWs use a TLV bit to advertise fragmented scan support.
Signed-off-by: David Spinadel <david.spinadel@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Johannes Berg [Fri, 1 Aug 2014 09:58:47 +0000 (11:58 +0200)]
iwlwifi: trans: refactor txq_enable arguments
Instead of having all arguments passed to the function,
add a struct to hold them and only pass some directly.
This will make future work in this area cleaner.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Avri Altman [Mon, 14 Jul 2014 06:40:27 +0000 (09:40 +0300)]
iwlwifi: consolidate hw scheduler configuration code
Configuring the hw scheduler during queue enablement is done by
writing the appropriate values to the scheduler peripherals, and
it is essentially the same for all buses.
Whenever writing is done via the standard iwl_write_prph, we can
avoid duplicating the code for each bus. Those operations are
queue deactivation, RA/TID mapping, chain-building settings,
enabling/disabling aggregations and activating/deactivating the
TX FIFOs.
Consolidate this code using static inlines in a new header file.
Signed-off-by: Avri Altman <avri.altman@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Liad Kaufman [Sun, 6 Jul 2014 14:14:39 +0000 (17:14 +0300)]
iwlwifi: mvm: wait for TE notif when protecting TDLS session
Make sure that when running the TDLS discovery session
protection - the time event that ensures we remain on channel
has been scheduled and started running before leaving.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Luciano Coelho [Fri, 8 Aug 2014 16:50:46 +0000 (19:50 +0300)]
iwlwifi: mvm: add option that allows a vif to disable PS
We need to disable PS when a monitor vif is active or, in the future,
when a channel switch is happening. Add a boolean to mvmvif that
allows PS to be disabled generically. Additionally, make the monitor
interface use this new flag when it gets activated.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Luciano Coelho [Fri, 8 Aug 2014 16:18:35 +0000 (19:18 +0300)]
iwlwifi: mvm: add function to update only ps
Add a new iwl_mvm_power_update_ps() function that allows only ps to be
updated according to changes in the vifs. This allows us to disable
ps only without affecting the pm values of the vifs (and to avoid
sending unnecessary MAC_PM_POWER_TABLE commands to the firmware).
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Luciano Coelho [Fri, 8 Aug 2014 15:36:22 +0000 (18:36 +0300)]
iwlwifi: mvm: refactor iwl_mvm_power_set_pm() to spin the ps part off
Separate the ps part of iwl_mvm_power_set_pm() into a new
iwl_mvm_power_set_ps() function. This will enable us to update the ps
part independently from the rest, which is needed by CSA (at least).
This required a bit of refactoring and the creation of a new iterator
function.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Luciano Coelho [Fri, 8 Aug 2014 14:12:07 +0000 (17:12 +0300)]
iwlwifi: mvm: re-enable ps when monitor interfaces are removed
If a monitor interface is added and then removed, we don't reset the
mvm->ps_disabled flag, so we never re-enable power saving. Fix that
and rearrange the code a bit.
Additionally, fix a small indentation mistake in the
iwl_mvm_power_set_pm() function declaration.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Eliad Peller [Sun, 10 Aug 2014 14:00:15 +0000 (17:00 +0300)]
iwlwifi: mvm: clear d0i3 state on recovery
If recovery happened after mvm entered d0i3 (e.g.
due to sysassert when releasing the bus), the
mvm->state wasn't cleared properly, causing the
ongoing recovery to fail (due to iwl_mvm_ref_sync
failure).
This in turn fails the ongoing recovery, and triggers
a reprobe, which terminates any ongoing wifi activity.
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Eyal Shapira [Wed, 27 Aug 2014 23:21:05 +0000 (02:21 +0300)]
iwlwifi: mvm: disable tx aggregation on low latency vifs
Aggregations hit latency so disable it by default on
low latency vifs for now. Enable control over this behavior and
allow control over the max frames in an AMPDU in low latency
vifs via debugfs.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Luciano Coelho [Thu, 7 Aug 2014 15:08:56 +0000 (18:08 +0300)]
iwlwifi: mvm: add debugfs entry for ps_disabled
In order to make debugging easier, add an entry to export the
ps_disabled value via debugfs. To make usage of the
debugfs_create_*() function easier, change the ps_disabled element to
u8.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Johannes Berg [Mon, 1 Sep 2014 09:28:11 +0000 (11:28 +0200)]
iwlwifi: make U-APSD default configurable at compile time
With a significant number of deployed APs, enabling uAPSD leads to the
AP never using aggregation sessions (likely due to the complexities
involved in handling uAPSD in those.) This obviously results in a large
drop in throughput with such APs.
On the other hand, uAPSD can result in some power consumption benefits,
but for now just disable it to get performance with affected APs back
up.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Eran Harary [Sun, 24 Aug 2014 05:02:46 +0000 (08:02 +0300)]
iwlwifi: mvm: fix the dump_umac_error_log
1. the base_address limitation was wrong, address can be bigger than
0x80C000
2. the ucode data_struct changed.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Matti Gottlieb [Mon, 25 Aug 2014 11:41:23 +0000 (14:41 +0300)]
iwlwifi: mvm: Add marker command 0xcb
Add Marker command.
The marker command send the ucode the time of sending the command in
milliseconds since 1970-01-01 00:00:00 UTC, in addition to other metatdata.
The ucode inserts this information into the usniffer logs, and returns the GP2
time stamp inside the command response.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Luciano Coelho [Wed, 20 Aug 2014 14:58:20 +0000 (17:58 +0300)]
iwlwifi: mvm: don't run automatic checks if CT was caused by debugfs
If we're manually testing the CT kill functionality via debugfs, we
shouldn't schedule the work to recheck the temperature after the
ct_kill_duration period has passed.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Luciano Coelho [Wed, 20 Aug 2014 14:26:58 +0000 (17:26 +0300)]
iwlwifi: mvm: reset the temperature when temperature test is disabled
Since we can't read the actual temperature when the firmware is
running, just set the temperature to 0 when the test is disabled and
disable CT Kill if it was enabled.
Additionally, since we rely on iwl_mvm_tt_handler() to exit CT kill
when in test mode, call iwl_mvm_exit_ctkill() in that function if the
temperature is low again. Also make the iwl_mvm_enter_ctkill() and
iwl_mvm_exit_ctkill() return if called when not necessary anymore
(e.g. when iwl_mvm_exit_ctkill() is called when we're not in CT-kill).
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Thu, 31 Jul 2014 10:58:53 +0000 (13:58 +0300)]
iwlwifi: mvm: force protection for P2P
Performance is less an issue in P2P and reliability
is critical. Enable protection always for P2P.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Eliad Peller [Wed, 30 Jul 2014 12:42:19 +0000 (15:42 +0300)]
iwlwifi: mvm: add use_ps-poll debugfs power option
By default, when uapsd is not used, the ucode uses
null data packet to exit power-save and get then
pending frames.
However, some tests require the explicit usage of ps-poll.
Allow setting use_ps_poll power option (through debugfs)
to configure the ucode to use ps-poll instead.
The ucode configuration is done by setting the advanced-pm
flag while setting all the ACs to non-upasd mode.
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Wed, 30 Jul 2014 12:56:42 +0000 (15:56 +0300)]
iwlwifi: mvm: use dynamic SMPS for P2P Client
This allows to force the GO to use protection and enhances
the reliability of the link.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Mon, 28 Jul 2014 09:59:45 +0000 (12:59 +0300)]
iwlwifi: mvm: reduce the AMPDU size in low latency mode
This allows to leave a frame in the Tx Fifo which allows
the firmware to try to enter burst mode.
The end result of this is a better latency since the
firmware utilises the TxOP better.
Also limit the AMPDU size to the limit set in the ADDBA
response. This doesn't change much since the AMPDU size
was limited by the configuration of the hardware scheduler,
but here we add a software limit by the mean of the link
quality command.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Matti Gottlieb [Thu, 17 Jul 2014 13:41:14 +0000 (16:41 +0300)]
iwlwifi: mvm: Add set NIC temperature debug option
Add ability to set the NIC's temperature and ignore the actual temperature
that the FW supplies.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Linus Torvalds [Fri, 22 Aug 2014 21:33:18 +0000 (14:33 -0700)]
Merge git://git./linux/kernel/git/davem/net
Pull networking fixes from David Miller:
"Here are some bug fixes that have piled up during ksummit/linuxcon.
1) Fix endian problems in ibmveth, from Anton Blanchard.
2) IPV6 routing code does GFP_KERNEL allocation in atomic, fix from
Benjamin Block.
3) SCTP association fixes from Daniel Borkmann.
4) When multiple VLAN headers are present we have to make sure the
second and subsequent ones are pullable in the SKB otherwise we
blindly dereference garbage. From Jiri Benc.
5) The argument adjustment of the signature of hlist_add_after*()
introduced a regression in the batman-adv code, fix from Sven
Eckelmann.
6) Fix TX hang handling to avoid a panic in i40e, from Anjali Singhai
Jain.
7) PTP flag test is inverted in i40e driver, from Jesse Brandeburg.
8) ATM LEC driver needs to hold RTNL mutex over MTU changes, from
Chas Williams.
9) Truncate packets larger then the TPACKET_V3 format configured
buffers, otherwise we overwrite past the end of said buffers.
From Eric Dumazet.
10) Fix endianness bugs in qlcnic firmware handling, from Rajesh
Borundia and Shahed Shaikh.
11) CXGB4 sometimes doesn't get all of the TX completion events it
should resulting in SKBs getting stuck in the TX queue, from
Hariprasad Shenai.
12) When the FEC chip's PTP clock is disabled, you can't access the
register. Add necessary checks to avoid the resulting hang, from
Fugang Duan"
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (37 commits)
drivers: isdn: eicon: xdi_msg.h: Fix typo in #ifndef
net: sctp: fix suboptimal edge-case on non-active active/retrans path selection
net: sctp: spare unnecessary comparison in sctp_trans_elect_best
net: ethernet: broadcom: bnx2x: Remove redundant #ifdef
ibmveth: Fix endian issues with rx_no_buffer statistic
net: xgene: fix possible NULL dereference in xgene_enet_free_desc_rings()
openvswitch: fix panic with multiple vlan headers
net: ipv6: fib: don't sleep inside atomic lock
net: fec: ptp: avoid register access when ipg clock is disabled
cxgb4: Free completed tx skbs promptly
cxgb4: Fix race condition in cleanup
sctp: not send SCTP_PEER_ADDR_CHANGE notifications with failed probe
bnx2x: Revert UNDI flushing mechanism
qlcnic: Fix endianess issue in firmware load from file operation
qlcnic: Fix endianess issue in FW dump template header
qlcnic: Fix flash access interface to application
MAINTAINERS: Add section for MRF24J40 IEEE 802.15.4 radio driver
macvlan: Allow setting multicast filter on all macvlan types
packet: handle too big packets for PACKET_V3
MAINTAINERS: add entry for ec_bhf driver
...
Rasmus Villemoes [Fri, 22 Aug 2014 16:39:14 +0000 (18:39 +0200)]
drivers: isdn: eicon: xdi_msg.h: Fix typo in #ifndef
Test for definedness of the macro which is actually defined (the
change is hard to see: it is s/SSS/SSA/).
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Borkmann [Fri, 22 Aug 2014 11:03:30 +0000 (13:03 +0200)]
net: sctp: fix suboptimal edge-case on non-active active/retrans path selection
In SCTP, selection of active (T.ACT) and retransmission (T.RET)
transports is being done whenever transport control operations
(UP, DOWN, PF, ...) are engaged through sctp_assoc_control_transport().
Commits
4c47af4d5eb2 ("net: sctp: rework multihoming retransmission
path selection to rfc4960") and
a7288c4dd509 ("net: sctp: improve
sctp_select_active_and_retran_path selection") have both improved
it towards a more fine-grained and optimal path selection.
Currently, the selection algorithm for T.ACT and T.RET is as follows:
1) Elect the two most recently used ACTIVE transports T1, T2 for
T.ACT, T.RET, where T.ACT<-T1 and T1 is most recently used
2) In case primary path T.PRI not in {T1, T2} but ACTIVE, set
T.ACT<-T.PRI and T.RET<-T1
3) If only T1 is ACTIVE from the set, set T.ACT<-T1 and T.RET<-T1
4) If none is ACTIVE, set T.ACT<-best(T.PRI, T.RET, T3) where
T3 is the most recently used (if avail) in PF, set T.RET<-T.PRI
Prior to above commits, 4) was simply a camp on T.ACT<-T.PRI and
T.RET<-T.PRI, ignoring possible paths in PF. Camping on T.PRI is
still slightly suboptimal as it can lead to the following scenario:
Setup:
<A> <B>
T1: p1p1 (10.0.10.10) <==> .'`) <==> p1p1 (10.0.10.12) <= T.PRI
T2: p1p2 (10.0.10.20) <==> (_ . ) <==> p1p2 (10.0.10.22)
net.sctp.rto_min = 1000
net.sctp.path_max_retrans = 2
net.sctp.pf_retrans = 0
net.sctp.hb_interval = 1000
T.PRI is permanently down, T2 is put briefly into PF state (e.g. due to
link flapping). Here, the first time transmission is sent over PF path
T2 as it's the only non-INACTIVE path, but the retransmitted data-chunks
are sent over the INACTIVE path T1 (T.PRI), which is not good.
After the patch, it's choosing better transports in both cases by
modifying step 4):
4) If none is ACTIVE, set T.ACT_new<-best(T.ACT_old, T3) where T3 is
the most recently used (if avail) in PF, set T.RET<-T.ACT_new
This will still select a best possible path in PF if available (which
can also include T.PRI/T.RET), and set both T.ACT/T.RET to it.
In case sctp_assoc_control_transport() *just* put T.ACT_old into INACTIVE
as it transitioned from ACTIVE->PF->INACTIVE and stays in INACTIVE just
for a very short while before going back ACTIVE, it will guarantee that
this path will be reselected for T.ACT/T.RET since T3 (PF) is not
available.
Previously, this was not possible, as we would only select between T.PRI
and T.RET, and a possible T3 would be NULL due to the fact that we have
just transitioned T3 in sctp_assoc_control_transport() from PF->INACTIVE
and would select a suboptimal path when T.PRI/T.RET have worse properties.
In the case that T.ACT_old permanently went to INACTIVE during this
transition and there's no PF path available, plus T.PRI and T.RET are
INACTIVE as well, we would now camp on T.ACT_old, but if everything is
being INACTIVE there's really not much we can do except hoping for a
successful HB to bring one of the transports back up again and, thus
cause a new selection through sctp_assoc_control_transport().
Now both tests work fine:
Case 1:
1. T1 S(ACTIVE) T.ACT
T2 S(ACTIVE) T.RET
2. T1 S(ACTIVE) T.ACT, T.RET
T2 S(PF)
3. T1 S(ACTIVE) T.ACT, T.RET
T2 S(INACTIVE)
5. T1 S(PF) T.ACT, T.RET
T2 S(INACTIVE)
[ 5.1 T1 S(INACTIVE) T.ACT, T.RET
T2 S(INACTIVE) ]
6. T1 S(ACTIVE) T.ACT, T.RET
T2 S(INACTIVE)
7. T1 S(ACTIVE) T.ACT
T2 S(ACTIVE) T.RET
Case 2:
1. T1 S(ACTIVE) T.ACT
T2 S(ACTIVE) T.RET
2. T1 S(PF)
T2 S(ACTIVE) T.ACT, T.RET
3. T1 S(INACTIVE)
T2 S(ACTIVE) T.ACT, T.RET
5. T1 S(INACTIVE)
T2 S(PF) T.ACT, T.RET
[ 5.1 T1 S(INACTIVE)
T2 S(INACTIVE) T.ACT, T.RET ]
6. T1 S(INACTIVE)
T2 S(ACTIVE) T.ACT, T.RET
7. T1 S(ACTIVE) T.ACT
T2 S(ACTIVE) T.RET
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Borkmann [Fri, 22 Aug 2014 11:03:29 +0000 (13:03 +0200)]
net: sctp: spare unnecessary comparison in sctp_trans_elect_best
When both transports are the same, we don't have to go down that
road only to realize that we will return the very same transport.
We are guaranteed that curr is always non-NULL. Therefore, just
short-circuit this special case.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Rasmus Villemoes [Wed, 20 Aug 2014 13:14:49 +0000 (15:14 +0200)]
net: ethernet: broadcom: bnx2x: Remove redundant #ifdef
Nothing defines _ASM_GENERIC_INT_L64_H, it is a weird way to check for
64 bit longs, and u64 should be printed using %llx anyway.
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Anton Blanchard [Fri, 22 Aug 2014 01:36:52 +0000 (11:36 +1000)]
ibmveth: Fix endian issues with rx_no_buffer statistic
Hidden away in the last 8 bytes of the buffer_list page is a solitary
statistic. It needs to be byte swapped or else ethtool -S will
produce numbers that terrify the user.
Since we do this in multiple places, create a helper function with a
comment explaining what is going on.
Signed-off-by: Anton Blanchard <anton@samba.org>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Iyappan Subramanian [Thu, 21 Aug 2014 20:44:48 +0000 (13:44 -0700)]
net: xgene: fix possible NULL dereference in xgene_enet_free_desc_rings()
A NULL pointer dereference is possible for the argument ring->buf_pool
which is passed to xgene_enet_free_desc_ring(), as ring could be NULL.
And now since NULL pointers are being checked for before the calls to
xgene_enet_free_desc_ring(), might as well take advantage of them and
not call the function if the argument would be NULL.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Iyappan Subramanian <isubramanian@apm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiri Benc [Thu, 21 Aug 2014 19:33:44 +0000 (21:33 +0200)]
openvswitch: fix panic with multiple vlan headers
When there are multiple vlan headers present in a received frame, the first
one is put into vlan_tci and protocol is set to ETH_P_8021Q. Anything in the
skb beyond the VLAN TPID may be still non-linear, including the inner TCI
and ethertype. While ovs_flow_extract takes care of IP and IPv6 headers, it
does nothing with ETH_P_8021Q. Later, if OVS_ACTION_ATTR_POP_VLAN is
executed, __pop_vlan_tci pulls the next vlan header into vlan_tci.
This leads to two things:
1. Part of the resulting ethernet header is in the non-linear part of the
skb. When eth_type_trans is called later as the result of
OVS_ACTION_ATTR_OUTPUT, kernel BUGs in __skb_pull. Also, __pop_vlan_tci
is in fact accessing random data when it reads past the TPID.
2. network_header points into the ethernet header instead of behind it.
mac_len is set to a wrong value (10), too.
Reported-by: Yulong Pei <ypei@redhat.com>
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Benjamin Block [Thu, 21 Aug 2014 17:37:48 +0000 (19:37 +0200)]
net: ipv6: fib: don't sleep inside atomic lock
The function fib6_commit_metrics() allocates a piece of memory in mode
GFP_KERNEL while holding an atomic lock from higher up in the stack, in
the function __ip6_ins_rt(). This produces the following BUG:
> BUG: sleeping function called from invalid context at mm/slub.c:1250
> in_atomic(): 1, irqs_disabled(): 0, pid: 2909, name: dhcpcd
> 2 locks held by dhcpcd/2909:
> #0: (rtnl_mutex){+.+.+.}, at: [<
ffffffff81978e67>] rtnl_lock+0x17/0x20
> #1: (&tb->tb6_lock){++--+.}, at: [<
ffffffff81a6951a>] ip6_route_add+0x65a/0x800
> CPU: 1 PID: 2909 Comm: dhcpcd Not tainted 3.17.0-rc1 #1
> Hardware name: ASUS All Series/Q87T, BIOS 0216 10/16/2013
>
0000000000000008 ffff8800c8f13858 ffffffff81af135a 0000000000000000
>
ffff880212202430 ffff8800c8f13878 ffffffff810f8d3a ffff880212202c98
>
0000000000000010 ffff8800c8f138c8 ffffffff8121ad0e 0000000000000001
> Call Trace:
> [<
ffffffff81af135a>] dump_stack+0x4e/0x68
> [<
ffffffff810f8d3a>] __might_sleep+0x10a/0x120
> [<
ffffffff8121ad0e>] kmem_cache_alloc_trace+0x4e/0x190
> [<
ffffffff81a6bcd6>] ? fib6_commit_metrics+0x66/0x110
> [<
ffffffff81a6bcd6>] fib6_commit_metrics+0x66/0x110
> [<
ffffffff81a6cbf3>] fib6_add+0x883/0xa80
> [<
ffffffff81a6951a>] ? ip6_route_add+0x65a/0x800
> [<
ffffffff81a69535>] ip6_route_add+0x675/0x800
> [<
ffffffff81a68f2a>] ? ip6_route_add+0x6a/0x800
> [<
ffffffff81a6990c>] inet6_rtm_newroute+0x5c/0x80
> [<
ffffffff8197cf01>] rtnetlink_rcv_msg+0x211/0x260
> [<
ffffffff81978e67>] ? rtnl_lock+0x17/0x20
> [<
ffffffff81119708>] ? lock_release_holdtime+0x28/0x180
> [<
ffffffff81978e67>] ? rtnl_lock+0x17/0x20
> [<
ffffffff8197ccf0>] ? __rtnl_unlock+0x20/0x20
> [<
ffffffff819a989e>] netlink_rcv_skb+0x6e/0xd0
> [<
ffffffff81978ee5>] rtnetlink_rcv+0x25/0x40
> [<
ffffffff819a8e59>] netlink_unicast+0xd9/0x180
> [<
ffffffff819a9600>] netlink_sendmsg+0x700/0x770
> [<
ffffffff81103735>] ? local_clock+0x25/0x30
> [<
ffffffff8194e83c>] sock_sendmsg+0x6c/0x90
> [<
ffffffff811f98e3>] ? might_fault+0xa3/0xb0
> [<
ffffffff8195ca6d>] ? verify_iovec+0x7d/0xf0
> [<
ffffffff8194ec3e>] ___sys_sendmsg+0x37e/0x3b0
> [<
ffffffff8111ef15>] ? trace_hardirqs_on_caller+0x185/0x220
> [<
ffffffff81af979e>] ? mutex_unlock+0xe/0x10
> [<
ffffffff819a55ec>] ? netlink_insert+0xbc/0xe0
> [<
ffffffff819a65e5>] ? netlink_autobind.isra.30+0x125/0x150
> [<
ffffffff819a6520>] ? netlink_autobind.isra.30+0x60/0x150
> [<
ffffffff819a84f9>] ? netlink_bind+0x159/0x230
> [<
ffffffff811f989a>] ? might_fault+0x5a/0xb0
> [<
ffffffff8194f25e>] ? SYSC_bind+0x7e/0xd0
> [<
ffffffff8194f8cd>] __sys_sendmsg+0x4d/0x80
> [<
ffffffff8194f912>] SyS_sendmsg+0x12/0x20
> [<
ffffffff81afc692>] system_call_fastpath+0x16/0x1b
Fixing this by replacing the mode GFP_KERNEL with GFP_ATOMIC.
Signed-off-by: Benjamin Block <bebl@mageta.org>
Acked-by: David Rientjes <rientjes@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nimrod Andy [Thu, 21 Aug 2014 09:09:38 +0000 (17:09 +0800)]
net: fec: ptp: avoid register access when ipg clock is disabled
The current kernel hang on i.MX6SX with rootfs mount from MMC.
The root cause is that ptp uses a periodic timer to access enet register
even if ipg clock is disabled.
FEC ptp driver start one period timer to read 1588 counter register in the
ptp init function that is called after FEC driver is probed.
To save power, after FEC probe finish, FEC driver disable all clocks including
ipg clock that is needed for register access.
i.MX5x, i.MX6q/dl/sl FEC register access don't cause system hang when ipg clock
is disabled, just return zero value. But for i.MX6sx SOC, it cause system hang.
To avoid the issue, we need to check ptp clock status before ptp timer count access.
Signed-off-by: Fugang Duan <B38611@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Fri, 22 Aug 2014 16:08:20 +0000 (09:08 -0700)]
Merge tag 'arm64-fixes' of git://git./linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
"This small set of fixes addresses a few issues introduced during the
merge window, including:
- fix typo in I-cache detection that was causing us to treat all
I-caches as aliasing
- hook up memfd_create and getrandom syscalls for native and compat
- revert a temporary hack for defconfig builds in -next (the audit
tree changes didn't make it in this merge window)
- a couple of UEFI fixes for TEXT_OFFSET fuzzing and /memreserve/
- a simple sparsemem fix for 48-bit physical addressing
- small defconfig updates to get autotesters working with X-gene"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
Revert "arm64: Do not invoke audit_syscall_* functions if !CONFIG_AUDIT_SYSCALL"
arm64: mm: update max pa bits to 48
arm64: ignore DT memreserve entries when booting in UEFI mode
arm64: configs: Enable X-Gene SATA and ethernet in defconfig
arm64: align randomized TEXT_OFFSET on 4 kB boundary
asm-generic: add memfd_create system call to unistd.h
arm64: compat: wire up memfd_create and getrandom syscalls for aarch32
arm64: fix typo in I-cache policy detection
Linus Torvalds [Fri, 22 Aug 2014 16:06:22 +0000 (09:06 -0700)]
Merge tag 'iommu-fixes-v3.17-rc1' of git://git./linux/kernel/git/joro/iommu
Pull IOMMU fixes from Joerg Roedel:
"The fixes include:
- fix a crash in the VT-d driver when devices with a driver attached
are hot-unplugged
- fix a AMD IOMMU driver crash with device assignment of 32 bit PCI
devices to KVM guests
- fix for a copy&paste error in generic IOMMU code. Now the right
function pointer is checked before calling"
* tag 'iommu-fixes-v3.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
iommu/core: Check for the right function pointer in iommu_map()
iommu/amd: Fix cleanup_domain for mass device removal
iommu/vt-d: Defer domain removal if device is assigned to a driver
Hariprasad Shenai [Thu, 21 Aug 2014 11:34:46 +0000 (17:04 +0530)]
cxgb4: Free completed tx skbs promptly
Description of problem:
The NIC card is not reporting back to the driver the transmitted skbs,
so they get stuck in the TX ring causing issues with reference
counters in other kernel components.
Developed a new Automatic Egress Queue Update firmware facility to slowly tick
through Egress Queues and send back any outstanding CIDX Updates which are
laying around.
Based on original work by Casey Leedom <leedom@chelsio.com>
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Fri, 22 Aug 2014 04:53:15 +0000 (21:53 -0700)]
Merge tag 'linux-can-fixes-for-3.17-
20140821' of git://gitorious.org/linux-can/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2014-08-21
The first patch is from Mirza Krak, it fixes the initialization of the hardware
in the sja1000 driver. The next patch is contributed by Dan Carpenter, it fixes
the error handling in the c_can's probe function. Then there are two patches
for the flexcan driver, one by Alexander Stein, which fixes the resetting of
the bus error interrupt mask, the other one by Sebastian Andrzej Siewior which
adds an additional error state transition message.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Anish Bhatt [Wed, 20 Aug 2014 20:44:06 +0000 (13:44 -0700)]
cxgb4: Fix race condition in cleanup
There is a possible race condition when we unregister the PCI Driver and then
flush/destroy the global "workq". This could lead to situations where there
are tasks on the Work Queue with references to now deleted adapter data
structures. Instead, have per-adapter Work Queues which were instantiated and
torn down in init_one() and remove_one(), respectively.
v2: Remove unnecessary call to flush_workqueue() before destroy_workqueue()
Signed-off-by: Anish Bhatt <anish@chelsio.com>
Signed-off-by: Casey Leedom <leedom@chelsio.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
zhuyj [Wed, 20 Aug 2014 09:31:43 +0000 (17:31 +0800)]
sctp: not send SCTP_PEER_ADDR_CHANGE notifications with failed probe
Since the transport has always been in state SCTP_UNCONFIRMED, it
therefore wasn't active before and hasn't been used before, and it
always has been, so it is unnecessary to bug the user with a
notification.
Reported-by: Deepak Khandelwal <khandelwal.deepak.1987@gmail.com>
Suggested-by: Vlad Yasevich <vyasevich@gmail.com>
Suggested-by: Michael Tuexen <tuexen@fh-muenster.de>
Suggested-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Zhu Yanjun <Yanjun.Zhu@windriver.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Yuval Mintz [Mon, 18 Aug 2014 19:36:23 +0000 (22:36 +0300)]
bnx2x: Revert UNDI flushing mechanism
Commit
91ebb929b6f8 ("bnx2x: Add support for Multi-Function UNDI") [which was
later supposedly fixed by
de682941eef3 ("bnx2x: Fix UNDI driver unload")]
introduced a bug in which in some [yet-to-be-determined] scenarios the
alternative flushing mechanism which was to guarantee the Rx buffers are
empty before resetting them during device probe will fail.
If this happens, when device will be loaded once more a fatal attention will
occur; Since this most likely happens in boot from SAN scenarios, the machine
will fail to load.
Notice this may occur not only in the 'Multi-Function' scenario but in the
regular scenario as well, i.e., this introduced a regression in the driver's
ability to perform boot from SAN.
The patch reverts the mechanism and applies the old scheme to multi-function
devices as well as to single-function devices.
Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com>
Signed-off-by: Ariel Elior <Ariel.Elior@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Fri, 22 Aug 2014 00:43:20 +0000 (17:43 -0700)]
Merge branch 'qlcnic'
Shahed Shaikh says:
====================
qlcnic: Bug fixes
This series fixes some bugs related to endianess.
Please apply this series to net.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Shahed Shaikh [Mon, 18 Aug 2014 13:31:55 +0000 (09:31 -0400)]
qlcnic: Fix endianess issue in firmware load from file operation
Firmware binary file is in little endian. On big-endian architecture, while
writing this binary FW file to adapters memory, writel() swaps the data resulting into
corruption of FW image. So, swap the data before writing into adapters memory.
Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Rajesh Borundia [Mon, 18 Aug 2014 13:31:54 +0000 (09:31 -0400)]
qlcnic: Fix endianess issue in FW dump template header
Firmware dump template header is read from adapter using
readl() which swaps the data. So, adjust structure
element on the boundary of 32bit dword.
Signed-off-by: Rajesh Borundia <rajesh.borundia@qlogic.com>
Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jitendra Kalsaria [Mon, 18 Aug 2014 13:31:53 +0000 (09:31 -0400)]
qlcnic: Fix flash access interface to application
Application expects flash data in little endian, but driver reads/writes
flash data using readl()/writel() APIs which swaps data on big endian machine.
So, swap the data after reading from and before writing to flash memory.
Signed-off-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com>
Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alan Ott [Sat, 16 Aug 2014 21:09:03 +0000 (17:09 -0400)]
MAINTAINERS: Add section for MRF24J40 IEEE 802.15.4 radio driver
Alan is the original author of the driver. This change was discussed
with the 802.15.4 subsystem maintainer, Alexander Aring.
Signed-off-by: Alan Ott <alan@signal11.us>
Acked-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vlad Yasevich [Fri, 15 Aug 2014 17:04:59 +0000 (13:04 -0400)]
macvlan: Allow setting multicast filter on all macvlan types
Currently, macvlan code restricts multicast and unicast
filter setting only to passthru devices. As a result,
if a guest using macvtap wants to receive multicast
traffic, it has to set IFF_ALLMULTI or IFF_PROMISC.
This patch makes it possible to use the fdb interface
to add multicast addresses to the filter thus allowing
a guest to receive only targeted multicast traffic.
CC: John Fastabend <john.r.fastabend@intel.com>
CC: Michael S. Tsirkin <mst@redhat.com>
CC: Jason Wang <jasowang@redhat.com>
Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com>
Acked-by: John Fastabend <john.r.fastabend@intel.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Fri, 15 Aug 2014 16:16:04 +0000 (09:16 -0700)]
packet: handle too big packets for PACKET_V3
af_packet can currently overwrite kernel memory by out of bound
accesses, because it assumed a [new] block can always hold one frame.
This is not generally the case, even if most existing tools do it right.
This patch clamps too long frames as API permits, and issue a one time
error on syslog.
[ 394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82
In this example, packet header tp_snaplen was set to 3966,
and tp_len was set to 5042 (skb->len)
Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dariusz Marcinkiewicz [Fri, 15 Aug 2014 15:50:47 +0000 (17:50 +0200)]
MAINTAINERS: add entry for ec_bhf driver
Added entry for ec_bhf driver.
Signed-off-by: Dariusz Marcinkiewicz <reksio@newterm.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
chas williams - CONTRACTOR [Thu, 14 Aug 2014 13:19:47 +0000 (09:19 -0400)]
lec: Use rtnl lock/unlock when updating MTU
The LECS response contains the MTU that should be used. Correctly
synchronize with other layers when updating.
Signed-off-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Thu, 21 Aug 2014 21:26:27 +0000 (14:26 -0700)]
Merge branch 'for-3.17-fixes' of git://git./linux/kernel/git/tj/libata
Pull libata fixes from Tejun Heo:
"Nothing drastic but pushing out early due to build breakage in the new
tegra platform.
Additionally:
- M550 tagged trim blacklist pattern is widened so that it matches
the new 1TB model
- three controller specific fixes"
* 'for-3.17-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
libata: widen Crucial M550 blacklist matching
pata_scc: propagate return value of scc_wait_after_reset
ata: ahci_tegra: Change include to fix compilation
pata_samsung_cf: change ret type to signed
ahci_xgene: Removing NCQ support from the APM X-Gene SoC AHCI SATA Host Controller driver.
Linus Torvalds [Thu, 21 Aug 2014 21:25:20 +0000 (14:25 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jikos/hid
Pull HID fixes from Jiri Kosina:
- fixes for a couple potential memory corruption problems (the HW would
have to be manufactured to be deliberately evil to trigger those)
found by Ben Hawkes
- fix for potential infinite loop when using sysfs interface of
logitech driver, from Simon Wood
- a couple more simple driver fixes
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: fix a couple of off-by-ones
HID: logitech: perform bounds checking on device_id early enough
HID: logitech: fix bounds checking on LED report size
HID: logitech: Prevent possibility of infinite loop when using /sys interface
HID: rmi: print an error if F11 is not found instead of stopping the device
HID: hid-sensor-hub: use devm_ functions consistently
HID: huion: Use allocated buffer for DMA
HID: huion: Fail on parameter retrieval errors
Linus Torvalds [Thu, 21 Aug 2014 21:24:40 +0000 (14:24 -0700)]
Merge tag 'sound-3.17-rc2' of git://git./linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A bunch of ASoC fixes with a few HD-audio fixes in this pull request.
All fairly small, boring and device-specific fixes, in addition to
MAINTAINERS update for better reviewing"
* tag 'sound-3.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda/hdmi - apply Valleyview fix-ups to Cherryview display codec
ALSA: hda/hdmi - set depop_delay for haswell plus
ALSA: hda - restore the gpio led after resume
ALSA: hda/realtek - Avoid setting wrong COEF on ALC269 & co
ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE
ASoC: fsl-esai: Revert .xlate_tdm_slot_mask() support
ASoC: mcasp: Fix implicit BLCK divider setting
ASoC: arizona: Fix TDM slot length handling in arizona_hw_params
ASoC: pcm512x: Correct Digital Playback control names
ASoC: dapm: Fix uninitialized variable in snd_soc_dapm_get_enum_double()
ASoC: Intel: Restore Baytrail ADSP streams only when ADSP was in reset
ASoC: Intel: Wait Baytrail ADSP boot at resume_early stage
ASoC: Intel: Merge Baytrail ADSP suspend_noirq into suspend_late
MAINTAINERS: Add i.MX maintainers and paths to Freescale ASoC entry
ASoC: Intel: Update Baytrail ADSP firmware name
Linus Torvalds [Thu, 21 Aug 2014 21:07:44 +0000 (14:07 -0700)]
Merge branch 'i2c/for-next' of git://git./linux/kernel/git/wsa/linux
Pull i2c fixes from Wolfram Sang:
"Here is the fixup for the 'lowlight' of my last pull request. I2C is
not selected anymore by I2C_ACPI. Instead, the code in question now
depends on I2C=y.
Also, Mika has agreed to support me and be the maintainer for I2C-ACPI
related patches. Finally, a new-ID-patch came along last week"
* 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
MAINTAINERS: add maintainer for ACPI parts of I2C
i2c: i801: Add PCI ID for Intel Braswell
i2c: rework kernel config I2C_ACPI
Linus Torvalds [Thu, 21 Aug 2014 21:06:56 +0000 (14:06 -0700)]
Merge tag 'please-pull-memfd_create' of git://git./linux/kernel/git/aegl/linux
Pull ia64 update from Tony Luck:
"Add memfd_create syscall to ia64"
* tag 'please-pull-memfd_create' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
[IA64] Wire up memfd_create() system call
Linus Torvalds [Thu, 21 Aug 2014 21:06:18 +0000 (14:06 -0700)]
Merge tag 'microblaze-3.17-rc2' of git://git.monstr.eu/linux-2.6-microblaze
Pull microblaze update from Michal Simek:
"Wire-up seccomp/getrandom/memfd_create syscalls"
* tag 'microblaze-3.17-rc2' of git://git.monstr.eu/linux-2.6-microblaze:
microblaze: Wire-up memfd_create syscall
microblaze: Wire-up getrandom syscall
microblaze: Wire-up seccomp syscall
Jiri Kosina [Thu, 21 Aug 2014 14:57:48 +0000 (09:57 -0500)]
HID: fix a couple of off-by-ones
There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.
Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Jiri Kosina [Thu, 21 Aug 2014 14:57:17 +0000 (09:57 -0500)]
HID: logitech: perform bounds checking on device_id early enough
device_index is a char type and the size of paired_dj_deivces is 7
elements, therefore proper bounds checking has to be applied to
device_index before it is used.
We are currently performing the bounds checking in
logi_dj_recv_add_djhid_device(), which is too late, as malicious device
could send REPORT_TYPE_NOTIF_DEVICE_UNPAIRED early enough and trigger the
problem in one of the report forwarding functions called from
logi_dj_raw_event().
Fix this by performing the check at the earliest possible ocasion in
logi_dj_raw_event().
Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Jiri Kosina [Thu, 21 Aug 2014 14:56:47 +0000 (09:56 -0500)]
HID: logitech: fix bounds checking on LED report size
The check on report size for REPORT_TYPE_LEDS in logi_dj_ll_raw_request()
is wrong; the current check doesn't make any sense -- the report allocated
by HID core in hid_hw_raw_request() can be much larger than
DJREPORT_SHORT_LENGTH, and currently logi_dj_ll_raw_request() doesn't
handle this properly at all.
Fix the check by actually trimming down the report size properly if it is
too large.
Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Sebastian Andrzej Siewior [Fri, 25 Jul 2014 18:16:40 +0000 (20:16 +0200)]
can: flexcan: handle state passive -> warning transition
Once the CAN-bus is open and a packet is sent, the controller switches
into the PASSIVE state. Once the BUS is closed again it goes the back
err-warning. The TX error counter goes 0 -> 0x80 -> 0x7f.
This patch makes sure that the user learns about this state chang
(CAN_STATE_ERROR_WARNING => CAN_STATE_ERROR_PASSIVE)
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Matthias Klein <matthias.klein@optimeas.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Alexander Stein [Tue, 12 Aug 2014 08:47:21 +0000 (10:47 +0200)]
can: flexcan: Disable error interrupt when bus error reporting is disabled
In case we don't have FLEXCAN_HAS_BROKEN_ERR_STATE and the user set
CAN_CTRLMODE_BERR_REPORTING once it can not be unset again until reboot.
So in case neither hardware nor user wants the error interrupt disable
the bit.
Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Dan Carpenter [Fri, 1 Aug 2014 08:53:44 +0000 (11:53 +0300)]
can: c_can: checking IS_ERR() instead of NULL
devm_ioremap() returns NULL on error, not an ERR_PTR().
Fixes: 33cf75656923 ('can: c_can_platform: Fix raminit, use devm_ioremap() instead of devm_ioremap_resource()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: linux-stable <stable@vger.kernel.org> # >= v3.11
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Mirza Krak [Fri, 8 Aug 2014 12:30:50 +0000 (14:30 +0200)]
can: sja1000: Validate initialization state in start method
When sja1000 is not compiled as module the SJA1000 chip is only
initialized during device registration on kernel boot. Should the chip
get a hardware reset there is no way to reinitialize it without re-
booting the Linux kernel.
This patch adds a check in sja1000_start if the chip is initialized, if
not we initialize it.
Signed-off-by: Mirza Krak <mirza.krak@hostmobility.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Michal Simek [Thu, 21 Aug 2014 08:19:28 +0000 (10:19 +0200)]
microblaze: Wire-up memfd_create syscall
Add new memfd_create syscall.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Michal Simek [Thu, 7 Aug 2014 13:59:05 +0000 (15:59 +0200)]
microblaze: Wire-up getrandom syscall
Add new getrandom syscall.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Michal Simek [Thu, 7 Aug 2014 13:57:41 +0000 (15:57 +0200)]
microblaze: Wire-up seccomp syscall
Add new seccomp syscall.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Linus Torvalds [Wed, 20 Aug 2014 23:33:21 +0000 (18:33 -0500)]
Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6
Pull cifs fixes from Steve French:
"Most important fixes in this set include three SMB3 fixes for stable
(including fix for possible kernel oops), and a workaround to allow
writes to Mac servers (only cifs dialect, not more current SMB2.1,
worked to Mac servers). Also fallocate support added, and lease fix
from Jeff"
* 'for-linus' of git://git.samba.org/sfrench/cifs-2.6:
[SMB3] Enable fallocate -z support for SMB3 mounts
enable fallocate punch hole ("fallocate -p") for SMB3
Incorrect error returned on setting file compressed on SMB2
CIFS: Fix wrong directory attributes after rename
CIFS: Fix SMB2 readdir error handling
[CIFS] Possible null ptr deref in SMB2_tcon
[CIFS] Workaround MacOS server problem with SMB2.1 write response
cifs: handle lease F_UNLCK requests properly
Cleanup sparse file support by creating worker function for it
Add sparse file support to SMB2/SMB3 mounts
Add missing definitions for CIFS File System Attributes
cifs: remove unused function cifs_oplock_break_wait
Linus Torvalds [Wed, 20 Aug 2014 23:32:16 +0000 (18:32 -0500)]
Merge branch 'for_linus' of git://git./linux/kernel/git/jack/linux-fs
Pull filesystem fixes from Jan Kara:
"udf, isofs, and ext3 bug fixes"
* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
ext3: Count internal journal as bsddf overhead in ext3_statfs
isofs: Fix unbounded recursion when processing relocated directories
udf: avoid unneeded up_write when fail to add entry in ->symlink
Linus Torvalds [Wed, 20 Aug 2014 23:23:06 +0000 (18:23 -0500)]
Merge branch 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86
Pull x86 platform driver revert from Matthew Garrett:
"This clearly shouldn't have been merged. No excuse on my part"
* 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86:
Revert "platform/x86/toshiba-apci.c possible bad if test?"
Linus Torvalds [Wed, 20 Aug 2014 23:22:10 +0000 (18:22 -0500)]
Merge tag 'for-linus' of git://git./virt/kvm/kvm
Pull KVM fixes from Paolo Bonzini:
"Reverting a 3.16 patch, fixing two bugs in device assignment (one has
a CVE), and fixing some problems introduced during the merge window
(the CMA bug came in via Andrew, the x86 ones via yours truly)"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
virt/kvm/assigned-dev.c: Set 'dev->irq_source_id' to '-1' after free it
Revert "KVM: x86: Increase the number of fixed MTRR regs to 10"
KVM: x86: do not check CS.DPL against RPL during task switch
KVM: x86: Avoid emulating instructions on #UD mistakenly
PC, KVM, CMA: Fix regression caused by wrong get_order() use
kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601)
Linus Torvalds [Wed, 20 Aug 2014 23:20:50 +0000 (18:20 -0500)]
Merge tag 'scsi-fixes' of git://git./linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"These are the two bug fixes I mentioned in the final merge window
pull. One is a reversed logic check in the device busy tests which
can cause a nasty hang and another crash seen in the new SCSI pool
support if the use count ever goes to zero"
[ The device busy test already got merged from a patch earlier, so is
now duplicated. ]
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] save command pool address of Scsi_Host
[SCSI] fix qemu boot hang problem
Matthew Garrett [Wed, 20 Aug 2014 15:18:18 +0000 (08:18 -0700)]
Revert "platform/x86/toshiba-apci.c possible bad if test?"
This reverts commit
bdc3ae7221213963f438faeaa69c8b4a2195f491.
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Chin-Tsung Cheng [Fri, 15 Aug 2014 07:49:31 +0000 (15:49 +0800)]
ext3: Count internal journal as bsddf overhead in ext3_statfs
The journal blocks of external journal device should not
be counted as overhead.
Signed-off-by: Chin-Tsung Cheng <chintzung@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Will Deacon [Tue, 19 Aug 2014 21:05:45 +0000 (22:05 +0100)]
Revert "arm64: Do not invoke audit_syscall_* functions if !CONFIG_AUDIT_SYSCALL"
For some reason, the audit patches didn't make it out of -next this
merge window, so revert our temporary hack and let the audit guys deal
with fixing up -next.
This reverts commit
2a8f45b040bcb9b2ad2845f061499d1b6f41cc7b.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Ganapatrao Kulkarni [Thu, 14 Aug 2014 15:19:46 +0000 (20:49 +0530)]
arm64: mm: update max pa bits to 48
Now that we support 48-bit physical addressing, update MAX_PHYSMEM_BITS
accordingly.
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Ganapatrao Kulkarni <ganapatrao.kulkarni@caviumnetworks.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Leif Lindholm [Mon, 28 Jul 2014 18:03:03 +0000 (19:03 +0100)]
arm64: ignore DT memreserve entries when booting in UEFI mode
UEFI provides its own method for marking regions to reserve, via the
memory map which is also used to initialise memblock. So when using the
UEFI memory map, ignore any memreserve entries present in the DT.
Reported-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Mark Brown [Thu, 14 Aug 2014 19:57:16 +0000 (20:57 +0100)]
arm64: configs: Enable X-Gene SATA and ethernet in defconfig
Currently when run on an APM platform the ARMv8 defconfig has no viable
options for rootfs other than ramdisk which is rather limiting. Since
we already have both SATA and the bits needed for NFS root enabled we just
need to enable the relevant drivers so do that, helping enable direct
testing of upstream.
If the configuration ends up becoming too big we can consider modularising
some of the drivers and asking people to use an initramfs but for now this
is not an issue.
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Ard Biesheuvel [Wed, 13 Aug 2014 17:53:03 +0000 (18:53 +0100)]
arm64: align randomized TEXT_OFFSET on 4 kB boundary
When booting via UEFI, the kernel Image is loaded at a 4 kB boundary and
the embedded EFI stub is executed in place. The EFI stub relocates the
Image to reside TEXT_OFFSET bytes above a 2 MB boundary, and jumps into
the kernel proper.
In AArch64, PC relative symbol references are emitted using adrp/add or
adrp/ldr pairs, where the offset into a 4 kB page is resolved using a
separate :lo12: relocation. This implicitly assumes that the code will
always be executed at the same relative offset with respect to a 4 kB
boundary, or the references will point to the wrong address.
This means we should link the kernel at a 4 kB aligned base address in
order to remain compatible with the base address the UEFI loader uses
when doing the initial load of Image. So update the code that generates
TEXT_OFFSET to choose a multiple of 4 kB.
At the same time, update the code so it chooses from the interval [0..2MB)
as the author originally intended.
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
David S. Miller [Tue, 19 Aug 2014 18:14:02 +0000 (11:14 -0700)]
tipc: Fix build.
Missing semicolon in range check fix.
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 19 Aug 2014 17:59:12 +0000 (10:59 -0700)]
Merge branch 'cbq-fixes'
Vasily Averin says:
====================
cbq: incorrectly low bandwidth blocks limited traffic
v2: patch description changes
Fixes: f0f6ee1f70c4 ("cbq: incorrect processing of high limits")
Mainstream commit
f0f6ee1f70c4 ("cbq: incorrect processing of high limits")
have side effect: if cbq bandwidth setting is less than real interface
throughput non-limited traffic can delay limited traffic for a very long time.
This happen because of q->now changes incorrectly in cbq_dequeue():
in described scenario L2T is much greater than real time delay,
and q->now gets an extra boost for each transmitted packet.
Accumulated boost prevents update q->now, and blocked class can wait
very long time until (q->now >= cl->undertime) will be true again.
More detailed problem description can be found here:
http://www.spinics.net/lists/netdev/msg292493.html
Following patches should fix the problem.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Vasily Averin [Thu, 14 Aug 2014 08:27:59 +0000 (12:27 +0400)]
cbq: now_rt removal
Now q->now_rt is identical to q->now and is not required anymore.
Signed-off-by: Vasily Averin <vvs@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vasily Averin [Thu, 14 Aug 2014 08:27:47 +0000 (12:27 +0400)]
cbq: incorrectly low bandwidth setting blocks limited traffic
Mainstream commit
f0f6ee1f70c4 ("cbq: incorrect processing of high limits")
have side effect: if cbq bandwidth setting is less than real interface
throughput non-limited traffic can delay limited traffic for a very long time.
This happen because of q->now changes incorrectly in cbq_dequeue():
in described scenario L2T is much greater than real time delay,
and q->now gets an extra boost for each transmitted packet.
Accumulated boost prevents update q->now, and blocked class can wait
very long time until (q->now >= cl->undertime) will be true again.
To fix the problem the patch updates q->now on each cbq_update() call.
L2T-related pre-modification q->now was moved to cbq_update().
My testing confirmed that it fixes the problem and did not discover
any side-effects
Fixes: f0f6ee1f70c4 ("cbq: incorrect processing of high limits")
Signed-off-by: Vasily Averin <vvs@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Guenter Roeck [Sun, 10 Aug 2014 12:54:25 +0000 (05:54 -0700)]
scsi: Fix qemu boot hang problem
The latest kernel fails to boot qemu arm images when using scsi
for disk access. Boot gets stuck after the following messages.
brd: module loaded
sym53c8xx 0000:00:0c.0: enabling device (0100 -> 0103)
sym0: <895a> rev 0x0 at pci 0000:00:0c.0 irq 93
sym0: No NVRAM, ID 7, Fast-40, LVD, parity checking
sym0: SCSI BUS has been reset.
scsi host0: sym-2.2.3
Bisect points to commit
71e75c97f97a ("scsi: convert device_busy to
atomic_t"). Code inspection shows the following suspicious change
in scsi_request_fn.
out_delay:
- if (sdev->device_busy == 0 && !scsi_device_blocked(sdev))
+ if (atomic_read(&sdev->device_busy) && !scsi_device_blocked(sdev))
blk_delay_queue(q, SCSI_QUEUE_DELAY);
}
'sdev->device_busy == 0' was replaced with 'atomic_read(&sdev->device_busy)',
meaning the logic was reversed. Changing this expression to
'!atomic_read(&sdev->device_busy)' fixes the problem.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Acked-by: Jens Axboe <axboe@fb.com>
Reviewed-by: Venkatesh Srinivas <venkateshs@google.com>
Reviewed-by: Webb Scales <webbnh@hp.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jan Kara [Sun, 17 Aug 2014 09:49:57 +0000 (11:49 +0200)]
isofs: Fix unbounded recursion when processing relocated directories
We did not check relocated directory in any way when processing Rock
Ridge 'CL' tag. Thus a corrupted isofs image can possibly have a CL
entry pointing to another CL entry leading to possibly unbounded
recursion in kernel code and thus stack overflow or deadlocks (if there
is a loop created from CL entries).
Fix the problem by not allowing CL entry to point to a directory entry
with CL entry (such use makes no good sense anyway) and by checking
whether CL entry doesn't point to itself.
CC: stable@vger.kernel.org
Reported-by: Chris Evans <cevans@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Chao Yu [Sat, 9 Aug 2014 01:49:31 +0000 (09:49 +0800)]
udf: avoid unneeded up_write when fail to add entry in ->symlink
We have released the ->i_data_sem before invoking udf_add_entry(),
so in following error path, we should not release this lock again.
Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Wolfram Sang [Tue, 19 Aug 2014 15:08:35 +0000 (10:08 -0500)]
MAINTAINERS: add maintainer for ACPI parts of I2C
Mika has done great work in that field, so let people know.
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Alan Cox [Tue, 19 Aug 2014 14:37:28 +0000 (17:37 +0300)]
i2c: i801: Add PCI ID for Intel Braswell
The SMBus host controller is the same as used in Baytrail so add the new
PCI ID to the driver's list of supported IDs.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Lan Tianyu [Fri, 15 Aug 2014 05:38:59 +0000 (13:38 +0800)]
i2c: rework kernel config I2C_ACPI
Commit
da3c6647(I2C/ACPI: Clean up I2C ACPI code and Add CONFIG_I2C_ACPI
config) adds a new kernel config I2C_ACPI and make I2C core built in
when the config is selected. This is wrong because distributions
etc generally compile I2C as a module and the commit broken that.
This patch is to rename I2C_ACPI to ACPI_I2C_OPREGION. New config
only controls ACPI I2C operation region code and depends on I2C=y.
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
[wsa: removed unrelated change for Kconfig]
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Linus Torvalds [Tue, 19 Aug 2014 14:47:01 +0000 (09:47 -0500)]
Merge tag 'md/3.17-fixes' of git://neil.brown.name/md
Pull md bugfixes from Neil Brown:
"Here are the bug-fixes I promised :-)
Funny how you start looking for one and other start appearing.
- raid6 data corruption during recovery
- raid6 livelock
- raid10 memory leaks"
* tag 'md/3.17-fixes' of git://neil.brown.name/md:
md/raid10: always initialise ->state on newly allocated r10_bio
md/raid10: avoid memory leak on error path during reshape.
md/raid10: Fix memory leak when raid10 reshape completes.
md/raid10: fix memory leak when reshaping a RAID10.
md/raid6: avoid data corruption during recovery of double-degraded RAID6
md/raid5: avoid livelock caused by non-aligned writes.
Linus Torvalds [Tue, 19 Aug 2014 14:45:31 +0000 (09:45 -0500)]
Merge tag 'pci-v3.17-changes-3' of git://git./linux/kernel/git/helgaas/pci
Pull PCI changes from Bjorn Helgaas:
"Marvell MVEBU
- Remove ARCH_KIRKWOOD dependency (Andrew Lunn)
NVIDIA Tegra
- Add debugfs support (Thierry Reding)
Synopsys DesignWare
- Look for configuration space in 'reg', not 'ranges' (Kishon Vijay Abraham I)
- Program ATU with untranslated address (Kishon Vijay Abraham I)
- Add config access-related pcie_host_ops for v3.65 hardware (Murali Karicheri)
- Add MSI-related pcie_host_ops for v3.65 hardware (Murali Karicheri)
TI DRA7xx
- Add TI DR7xx PCIe driver (Kishon Vijay Abraham I)"
* tag 'pci-v3.17-changes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
PCI: designware: Add MSI-related pcie_host_ops for v3.65 hardware
PCI: designware: Add config access-related pcie_host_ops for v3.65 hardware
PCI: dra7xx: Add TI DRA7xx PCIe driver
PCI: designware: Program ATU with untranslated address
PCI: designware: Look for configuration space in 'reg', not 'ranges'
PCI: tegra: Add debugfs support
PCI: mvebu: Remove ARCH_KIRKWOOD dependency
Linus Torvalds [Tue, 19 Aug 2014 14:43:48 +0000 (09:43 -0500)]
Merge tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux
Pull devicetree fixes from Grant Likely:
"Three more commits needed for v3.17: A bug fix for reserved regions
based at address zero, a clarification on how to interpret existence
of both interrupts and interrupts-extended properties, and a fix to
allow device tree testcases to run on any platform"
* tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux:
of/irq: Fix lookup to use 'interrupts-extended' property first
Enabling OF selftest to run without machine's devicetree
of: Allow mem_reserve of memory with a base address of zero
Davidlohr Bueso [Mon, 18 Aug 2014 20:00:39 +0000 (13:00 -0700)]
frv: Define cpu_relax_lowlatency()
3a6bfbc91df0 "(arch,locking: Ciao arch_mutex_cpu_relax()") broke
building the frv arch. Fixes errors such as:
kernel/locking/mcs_spinlock.h:87:2: error: implicit declaration of function 'cpu_relax_lowlatency'
Signed-off-by: Davidlohr Bueso <davidlohr@hp.com>
Compile-tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Chen Gang [Fri, 8 Aug 2014 15:37:59 +0000 (23:37 +0800)]
virt/kvm/assigned-dev.c: Set 'dev->irq_source_id' to '-1' after free it
As a generic function, deassign_guest_irq() assumes it can be called
even if assign_guest_irq() is not be called successfully (which can be
triggered by ioctl from user mode, indirectly).
So for assign_guest_irq() failure process, need set 'dev->irq_source_id'
to -1 after free 'dev->irq_source_id', or deassign_guest_irq() may free
it again.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Mon, 18 Aug 2014 14:39:48 +0000 (16:39 +0200)]
Revert "KVM: x86: Increase the number of fixed MTRR regs to 10"
This reverts commit
682367c494869008eb89ef733f196e99415ae862,
which causes 32-bit SMP Windows 7 guests to panic.
SeaBIOS has a limit on the number of MTRRs that it can handle,
and this patch exceeded the limit. Better revert it.
Thanks to Nadav Amit for debugging the cause.
Cc: stable@nongnu.org
Reported-by: Wanpeng Li <wanpeng.li@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Mon, 18 Aug 2014 11:15:51 +0000 (13:15 +0200)]
KVM: x86: do not check CS.DPL against RPL during task switch
This reverts the check added by commit
5045b468037d (KVM: x86: check CS.DPL
against RPL during task switch, 2014-05-15). Although the CS.DPL=CS.RPL
check is mentioned in table 7-1 of the SDM as causing a #TSS exception,
it is not mentioned in table 6-6 that lists "invalid TSS conditions"
which cause #TSS exceptions. In fact it causes some tests to fail, which
pass on bare-metal.
Keep the rest of the commit, since we will find new uses for it in 3.18.
Reported-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Nadav Amit [Wed, 13 Aug 2014 13:50:13 +0000 (16:50 +0300)]
KVM: x86: Avoid emulating instructions on #UD mistakenly
Commit
d40a6898e5 mistakenly caused instructions which are not marked as
EmulateOnUD to be emulated upon #UD exception. The commit caused the check of
whether the instruction flags include EmulateOnUD to never be evaluated. As a
result instructions whose emulation is broken may be emulated. This fix moves
the evaluation of EmulateOnUD so it would be evaluated.
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
[Tweak operand order in &&, remove EmulateOnUD where it's now superfluous.
- Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Alexey Kardashevskiy [Thu, 14 Aug 2014 05:03:07 +0000 (15:03 +1000)]
PC, KVM, CMA: Fix regression caused by wrong get_order() use
fc95ca7284bc54953165cba76c3228bd2cdb9591 claims that there is no
functional change but this is not true as it calls get_order() (which
takes bytes) where it should have called order_base_2() and the kernel
stops on VM_BUG_ON().
This replaces get_order() with order_base_2() (round-up version of ilog2).
Suggested-by: Paul Mackerras <paulus@samba.org>
Cc: Alexander Graf <agraf@suse.de>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>