1. 16 Mar, 2015 1 commit
    • Borislav Petkov's avatar
      Revert "x86/mm/ASLR: Propagate base load address calculation" · 69797daf
      Borislav Petkov authored
      This reverts commit:
      
        f47233c2 ("x86/mm/ASLR: Propagate base load address calculation")
      
      The main reason for the revert is that the new boot flag does not work
      at all currently, and in order to make this work, we need non-trivial
      changes to the x86 boot code which we didn't manage to get done in
      time for merging.
      
      And even if we did, they would've been too risky so instead of
      rushing things and break booting 4.1 on boxes left and right, we
      will be very strict and conservative and will take our time with
      this to fix and test it properly.
      Reported-by: default avatarYinghai Lu <yinghai@kernel.org>
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
      Cc: Baoquan He <bhe@redhat.com>
      Cc: H. Peter Anvin <hpa@linux.intel.com
      Cc: Jiri Kosina <jkosina@suse.cz>
      Cc: Josh Triplett <josh@joshtriplett.org>
      Cc: Junjie Mao <eternal.n08@gmail.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Matt Fleming <matt.fleming@intel.com>
      Link: http://lkml.kernel.org/r/20150316100628.GD22995@pd.tnicSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      69797daf
  2. 13 Mar, 2015 2 commits
    • Oleg Nesterov's avatar
      x86/fpu: Drop_fpu() should not assume that tsk equals current · f4c36863
      Oleg Nesterov authored
      drop_fpu() does clear_used_math() and usually this is correct
      because tsk == current.
      
      However switch_fpu_finish()->restore_fpu_checking() is called before
      __switch_to() updates the "current_task" variable. If it fails,
      we will wrongly clear the PF_USED_MATH flag of the previous task.
      
      So use clear_stopped_child_used_math() instead.
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Reviewed-by: default avatarRik van Riel <riel@redhat.com>
      Cc: <stable@vger.kernel.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Pekka Riikonen <priikone@iki.fi>
      Cc: Quentin Casasnovas <quentin.casasnovas@oracle.com>
      Cc: Suresh Siddha <sbsiddha@gmail.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/20150309171041.GB11388@redhat.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      f4c36863
    • Oleg Nesterov's avatar
      x86/fpu: Avoid math_state_restore() without used_math() in __restore_xstate_sig() · a7c80ebc
      Oleg Nesterov authored
      math_state_restore() assumes it is called with irqs disabled,
      but this is not true if the caller is __restore_xstate_sig().
      
      This means that if ia32_fxstate == T and __copy_from_user()
      fails, __restore_xstate_sig() returns with irqs disabled too.
      
      This triggers:
      
        BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:41
         dump_stack
         ___might_sleep
         ? _raw_spin_unlock_irqrestore
         __might_sleep
         down_read
         ? _raw_spin_unlock_irqrestore
         print_vma_addr
         signal_fault
         sys32_rt_sigreturn
      
      Change __restore_xstate_sig() to call set_used_math()
      unconditionally. This avoids enabling and disabling interrupts
      in math_state_restore(). If copy_from_user() fails, we can
      simply do fpu_finit() by hand.
      
      [ Note: this is only the first step. math_state_restore() should
              not check used_math(), it should set this flag. While
      	init_fpu() should simply die. ]
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: <stable@vger.kernel.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Pekka Riikonen <priikone@iki.fi>
      Cc: Quentin Casasnovas <quentin.casasnovas@oracle.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Suresh Siddha <sbsiddha@gmail.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/20150307153844.GB25954@redhat.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      a7c80ebc
  3. 12 Mar, 2015 2 commits
  4. 10 Mar, 2015 1 commit
  5. 06 Mar, 2015 1 commit
    • Jiri Slaby's avatar
      x86/vdso: Fix the build on GCC5 · e8932869
      Jiri Slaby authored
      On gcc5 the kernel does not link:
      
        ld: .eh_frame_hdr table[4] FDE at 0000000000000648 overlaps table[5] FDE at 0000000000000670.
      
      Because prior GCC versions always emitted NOPs on ALIGN directives, but
      gcc5 started omitting them.
      
      .LSTARTFDEDLSI1 says:
      
              /* HACK: The dwarf2 unwind routines will subtract 1 from the
                 return address to get an address in the middle of the
                 presumed call instruction.  Since we didn't get here via
                 a call, we need to include the nop before the real start
                 to make up for it.  */
              .long .LSTART_sigreturn-1-.     /* PC-relative start address */
      
      But commit 69d0627a ("x86 vDSO: reorder vdso32 code") from 2.6.25
      replaced .org __kernel_vsyscall+32,0x90 by ALIGN right before
      __kernel_sigreturn.
      
      Of course, ALIGN need not generate any NOP in there. Esp. gcc5 collapses
      vclock_gettime.o and int80.o together with no generated NOPs as "ALIGN".
      
      So fix this by adding to that point at least a single NOP and make the
      function ALIGN possibly with more NOPs then.
      
      Kudos for reporting and diagnosing should go to Richard.
      Reported-by: default avatarRichard Biener <rguenther@suse.de>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      Acked-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Cc: <stable@vger.kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/1425543211-12542-1-git-send-email-jslaby@suse.czSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      e8932869
  6. 05 Mar, 2015 4 commits
  7. 04 Mar, 2015 7 commits
  8. 03 Mar, 2015 15 commits
    • Linus Torvalds's avatar
      Merge branch 'for-4.0' of git://linux-nfs.org/~bfields/linux · a6c5170d
      Linus Torvalds authored
      Pull nfsd fixes from Bruce Fields:
       "Three miscellaneous bugfixes, most importantly the clp->cl_revoked
        bug, which we've seen several reports of people hitting"
      
      * 'for-4.0' of git://linux-nfs.org/~bfields/linux:
        sunrpc: integer underflow in rsc_parse()
        nfsd: fix clp->cl_revoked list deletion causing softlock in nfsd
        svcrpc: fix memory leak in gssp_accept_sec_context_upcall
      a6c5170d
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 789d7f60
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) If an IPVS tunnel is created with a mixed-family destination
          address, it cannot be removed.  Fix from Alexey Andriyanov.
      
       2) Fix module refcount underflow in netfilter's nft_compat, from Pablo
          Neira Ayuso.
      
       3) Generic statistics infrastructure can reference variables sitting on
          a released function stack, therefore use dynamic allocation always.
          Fix from Ignacy Gawędzki.
      
       4) skb_copy_bits() return value test is inverted in ip_check_defrag().
      
       5) Fix network namespace exit in openvswitch, we have to release all of
          the per-net vports.  From Pravin B Shelar.
      
       6) Fix signedness bug in CAIF's cfpkt_iterate(), from Dan Carpenter.
      
       7) Fix rhashtable grow/shrink behavior, only expand during inserts and
          shrink during deletes.  From Daniel Borkmann.
      
       8) Netdevice names with semicolons should never be allowed, because
          they serve as a separator.  From Matthew Thode.
      
       9) Use {,__}set_current_state() where appropriate, from Fabian
          Frederick.
      
      10) Revert byte queue limits support in r8169 driver, it's causing
          regressions we can't figure out.
      
      11) tcp_should_expand_sndbuf() erroneously uses tp->packets_out to
          measure packets in flight, properly use tcp_packets_in_flight()
          instead.  From Neal Cardwell.
      
      12) Fix accidental removal of support for bluetooth in CSR based Intel
          wireless cards.  From Marcel Holtmann.
      
      13) We accidently added a behavioral change between native and compat
          tasks, wrt testing the MSG_CMSG_COMPAT bit.  Just ignore it if the
          user happened to set it in a native binary as that was always the
          behavior we had.  From Catalin Marinas.
      
      14) Check genlmsg_unicast() return valud in hwsim netlink tx frame
          handling, from Bob Copeland.
      
      15) Fix stale ->radar_required setting in mac80211 that can prevent
          starting new scans, from Eliad Peller.
      
      16) Fix memory leak in nl80211 monitor, from Johannes Berg.
      
      17) Fix race in TX index handling in xen-netback, from David Vrabel.
      
      18) Don't enable interrupts in amx-xgbe driver until all software et al.
          state is ready for the interrupt handler to run.  From Thomas
          Lendacky.
      
      19) Add missing netlink_ns_capable() checks to rtnl_newlink(), from Eric
          W Biederman.
      
      20) The amount of header space needed in macvtap was not calculated
          properly, fix it otherwise we splat past the beginning of the
          packet.  From Eric Dumazet.
      
      21) Fix bcmgenet TCP TX perf regression, from Jaedon Shin.
      
      22) Don't raw initialize or mod timers, use setup_timer() and
          mod_timer() instead.  From Vaishali Thakkar.
      
      23) Fix software maintained statistics in bcmgenet and systemport
          drivers, from Florian Fainelli.
      
      24) DMA descriptor updates in sh_eth need proper memory barriers, from
          Ben Hutchings.
      
      25) Don't do UDP Fragmentation Offload on RAW sockets, from Michal
          Kubecek.
      
      26) Openvswitch's non-masked set actions aren't constructed properly
          into netlink messages, fix from Joe Stringer.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (116 commits)
        openvswitch: Fix serialization of non-masked set actions.
        gianfar: Reduce logging noise seen due to phy polling if link is down
        ibmveth: Add function to enable live MAC address changes
        net: bridge: add compile-time assert for cb struct size
        udp: only allow UFO for packets from SOCK_DGRAM sockets
        sh_eth: Really fix padding of short frames on TX
        Revert "sh_eth: Enable Rx descriptor word 0 shift for r8a7790"
        sh_eth: Fix RX recovery on R-Car in case of RX ring underrun
        sh_eth: Ensure proper ordering of descriptor active bit write/read
        net/mlx4_en: Disbale GRO for incoming loopback/selftest packets
        net/mlx4_core: Fix wrong mask and error flow for the update-qp command
        net: systemport: fix software maintained statistics
        net: bcmgenet: fix software maintained statistics
        rxrpc: don't multiply with HZ twice
        rxrpc: terminate retrans loop when sending of skb fails
        net/hsr: Fix NULL pointer dereference and refcnt bugs when deleting a HSR interface.
        net: pasemi: Use setup_timer and mod_timer
        net: stmmac: Use setup_timer and mod_timer
        net: 8390: axnet_cs: Use setup_timer and mod_timer
        net: 8390: pcnet_cs: Use setup_timer and mod_timer
        ...
      789d7f60
    • Joe Stringer's avatar
      openvswitch: Fix serialization of non-masked set actions. · f4f8e738
      Joe Stringer authored
      Set actions consist of a regular OVS_KEY_ATTR_* attribute nested inside
      of a OVS_ACTION_ATTR_SET action attribute. When converting masked actions
      back to regular set actions, the inner attribute length was not changed,
      ie, double the length being serialized. This patch fixes the bug.
      
      Fixes: 83d2b9ba ("net: openvswitch: Support masked set actions.")
      Signed-off-by: default avatarJoe Stringer <joestringer@nicira.com>
      Acked-by: default avatarJarno Rajahalme <jrajahalme@nicira.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f4f8e738
    • Guenter Roeck's avatar
      gianfar: Reduce logging noise seen due to phy polling if link is down · 0ae93b2c
      Guenter Roeck authored
      Commit 6ce29b0e ("gianfar: Avoid unnecessary reg accesses in adjust_link()")
      eliminates unnecessary calls to adjust_link for phy devices which don't support
      interrupts and need polling. As part of that work, the 'new_state' local flag,
      which was used to reduce logging noise on the console, was eliminated.
      
      Unfortunately, that means that a 'Link is Down' log message will now be
      issued continuously if a link is configured as UP, the link state is down,
      and the associated phy requires polling. This occurs because priv->oldduplex
      is -1 in this case, which always differs from phydev->duplex. In addition,
      phydev->speed may also differ from priv->oldspeed.  gfar_update_link_state()
      is therefore called each time a phy is polled, even if the link state did not
      change.
      
      Cc: Claudiu Manoil <claudiu.manoil@freescale.com>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Reviewed-by: default avatarClaudiu Manoil <claudiu.manoil@freescale.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0ae93b2c
    • Thomas Falcon's avatar
      ibmveth: Add function to enable live MAC address changes · c77c761f
      Thomas Falcon authored
      Add a function that will enable changing the MAC address
      of an ibmveth interface while it is still running.
      Signed-off-by: default avatarThomas Falcon <tlfalcon@linux.vnet.ibm.com>
      Reviewed-by: default avatarJiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c77c761f
    • Florian Westphal's avatar
      net: bridge: add compile-time assert for cb struct size · 71e168b1
      Florian Westphal authored
      make build fail if structure no longer fits into ->cb storage.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      71e168b1
    • Linus Torvalds's avatar
      Linux 4.0-rc2 · 13a7a6ac
      Linus Torvalds authored
      13a7a6ac
    • Daniel Vetter's avatar
      drm/i915: Fix modeset state confusion in the load detect code · 9128b040
      Daniel Vetter authored
      This is a tricky story of the new atomic state handling and the legacy
      code fighting over each another. The bug at hand is an underrun of the
      framebuffer reference with subsequent hilarity caused by the load
      detect code. Which is peculiar since the the exact same code works
      fine as the implementation of the legacy setcrtc ioctl.
      
      Let's look at the ingredients:
      
      - Currently our code is a crazy mix of legacy modeset interfaces to
        set the parameters and half-baked atomic state tracking underneath.
        While this transition is going we're using the transitional plane
        helpers to update the atomic side (drm_plane_helper_disable/update
        and friends), i.e. plane->state->fb. Since the state structure owns
        the fb those functions take care of that themselves.
      
        The legacy state (specifically crtc->primary->fb) is still managed
        by the old code (and mostly by the drm core), with the fb reference
        counting done by callers (core drm for the ioctl or the i915 load
        detect code). The relevant commit is
      
        commit ea2c67bb
        Author: Matt Roper <matthew.d.roper@intel.com>
        Date:   Tue Dec 23 10:41:52 2014 -0800
      
            drm/i915: Move to atomic plane helpers (v9)
      
      - drm_plane_helper_disable has special code to handle multiple calls
        in a row - it checks plane->crtc == NULL and bails out. This is to
        match the proper atomic implementation which needs the crtc to get
        at the implied locking context atomic updates always need. See
      
        commit acf24a39
        Author: Daniel Vetter <daniel.vetter@ffwll.ch>
        Date:   Tue Jul 29 15:33:05 2014 +0200
      
            drm/plane-helper: transitional atomic plane helpers
      
      - The universal plane code split out the implicit primary plane from
        the CRTC into it's own full-blown drm_plane object. As part of that
        the setcrtc ioctl (which updated both the crtc mode and primary
        plane) learned to set crtc->primary->crtc on modeset to make sure
        the plane->crtc assignments statate up to date in
      
        commit e13161af
        Author: Matt Roper <matthew.d.roper@intel.com>
        Date:   Tue Apr 1 15:22:38 2014 -0700
      
            drm: Add drm_crtc_init_with_planes() (v2)
      
        Unfortunately we've forgotten to update the load detect code. Which
        wasn't a problem since the load detect modeset is temporary and
        always undone before we drop the locks.
      
      - Finally there is a organically grown history (i.e. don't ask) around
        who sets the legacy plane->fb for the various driver entry points.
        Originally updating that was the drivers duty, but for almost all
        places we've moved that (plus updating the refcounts) into the core.
        Again the exception is the load detect code.
      
      Taking all together the following happens:
      - The load detect code doesn't set crtc->primary->crtc. This is only
        really an issue on crtcs never before used or when userspace
        explicitly disabled the primary plane.
      
      - The plane helper glue code short-circuits because of that and leaves
        a non-NULL fb behind in plane->state->fb and plane->fb. The state
        fb isn't a real problem (it's properly refcounted on its own), it's
        just the canary.
      
      - Load detect code drops the reference for that fb, but doesn't set
        plane->fb = NULL. This is ok since it's still living in that old
        world where drivers had to clear the pointer but the core/callers
        handled the refcounting.
      
      - On the next modeset the drm core notices plane->fb and takes care of
        refcounting it properly by doing another unref. This drops the
        refcount to zero, leaving state->plane now pointing at freed memory.
      
      - intel_plane_duplicate_state still assume it owns a reference to that
        very state->fb and bad things start to happen.
      
      Fix this all by applying the same duct-tape as for the legacy setcrtc
      ioctl code and set crtc->primary->crtc properly.
      
      Cc: Matt Roper <matthew.d.roper@intel.com>
      Cc: Paul Bolle <pebolle@tiscali.nl>
      Cc: Rob Clark <robdclark@gmail.com>
      Cc: Paulo Zanoni <przanoni@gmail.com>
      Cc: Sean Paul <seanpaul@chromium.org>
      Cc: Matt Roper <matthew.d.roper@intel.com>
      Reported-and-tested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Reported-by: default avatarPaul Bolle <pebolle@tiscali.nl>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9128b040
    • Tyler Hicks's avatar
      eCryptfs: don't pass fs-specific ioctl commands through · 6d65261a
      Tyler Hicks authored
      eCryptfs can't be aware of what to expect when after passing an
      arbitrary ioctl command through to the lower filesystem. The ioctl
      command may trigger an action in the lower filesystem that is
      incompatible with eCryptfs.
      
      One specific example is when one attempts to use the Btrfs clone
      ioctl command when the source file is in the Btrfs filesystem that
      eCryptfs is mounted on top of and the destination fd is from a new file
      created in the eCryptfs mount. The ioctl syscall incorrectly returns
      success because the command is passed down to Btrfs which thinks that it
      was able to do the clone operation. However, the result is an empty
      eCryptfs file.
      
      This patch allows the trim, {g,s}etflags, and {g,s}etversion ioctl
      commands through and then copies up the inode metadata from the lower
      inode to the eCryptfs inode to catch any changes made to the lower
      inode's metadata. Those five ioctl commands are mostly common across all
      filesystems but the whitelist may need to be further pruned in the
      future.
      
      https://bugzilla.kernel.org/show_bug.cgi?id=93691
      https://launchpad.net/bugs/1305335Signed-off-by: default avatarTyler Hicks <tyhicks@canonical.com>
      Cc: Rocko <rockorequin@hotmail.com>
      Cc: Colin Ian King <colin.king@canonical.com>
      Cc: stable@vger.kernel.org # v2.6.36+: c43f7b8f eCryptfs: Handle ioctl calls with unlocked and compat functions
      6d65261a
    • Michal Kubeček's avatar
      udp: only allow UFO for packets from SOCK_DGRAM sockets · acf8dd0a
      Michal Kubeček authored
      If an over-MTU UDP datagram is sent through a SOCK_RAW socket to a
      UFO-capable device, ip_ufo_append_data() sets skb->ip_summed to
      CHECKSUM_PARTIAL unconditionally as all GSO code assumes transport layer
      checksum is to be computed on segmentation. However, in this case,
      skb->csum_start and skb->csum_offset are never set as raw socket
      transmit path bypasses udp_send_skb() where they are usually set. As a
      result, driver may access invalid memory when trying to calculate the
      checksum and store the result (as observed in virtio_net driver).
      
      Moreover, the very idea of modifying the userspace provided UDP header
      is IMHO against raw socket semantics (I wasn't able to find a document
      clearly stating this or the opposite, though). And while allowing
      CHECKSUM_NONE in the UFO case would be more efficient, it would be a bit
      too intrusive change just to handle a corner case like this. Therefore
      disallowing UFO for packets from SOCK_DGRAM seems to be the best option.
      Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      acf8dd0a
    • David S. Miller's avatar
      Merge branch 'sh_eth' · 096b1c17
      David S. Miller authored
      Ben Hutchings says:
      
      ====================
      Fixes for sh_eth #4 v2
      
      I'm continuing review and testing of Ethernet support on the R-Car H2
      chip, with help from a colleague.  This series fixes a few more issues.
      
      These are not tested on any of the other supported chips.
      
      v2: Add note that the revert is not a pure revert.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      096b1c17
    • Ben Hutchings's avatar
      sh_eth: Really fix padding of short frames on TX · dacc73e0
      Ben Hutchings authored
      My previous fix to clear padding of short frames used skb->len as the
      DMA length, assuming that skb_padto() extended skb->len to include the
      padding.  That isn't the case; we need to use skb_put_padto() instead.
      
      (This wasn't immediately obvious because software padding isn't
      actually needed on the R-Car H2.  We could make it conditional on
      which chip is being driven, but it's probably not worth the effort.)
      Reported-by: default avatar"Violeta Menéndez González" <violeta.menendez@codethink.co.uk>
      Fixes: 612a17a54b50 ("sh_eth: Fix padding of short frames on TX")
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dacc73e0
    • Ben Hutchings's avatar
      Revert "sh_eth: Enable Rx descriptor word 0 shift for r8a7790" · 9b4a6364
      Ben Hutchings authored
      This reverts commit fd9af07c.
      
      The hardware manual states that the frame error and multicast bits are
      copied to bits 9:0 of RD0, not bits 25:16.  I've tested that this is
      true for RFS1 (CRC error), RFS3 (frame too short), RFS4 (frame too
      long) and RFS8 (multicast).
      
      Also adjust a comment to agree with this.
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9b4a6364
    • Ben Hutchings's avatar
      sh_eth: Fix RX recovery on R-Car in case of RX ring underrun · 6ded2865
      Ben Hutchings authored
      In case of RX ring underrun (RDE), we attempt to reset the software
      descriptor pointers (dirty_rx and cur_rx) to match where the hardware
      will read the next descriptor from, as that might not be the first
      dirty descriptor.  This relies on reading RDFAR, but that register
      doesn't exist on all supported chips - specifically, not on the R-Car
      chips.  This will result in unpredictable behaviour on those chips
      after an RDE.
      
      Make this pointer reset conditional and assume that it isn't needed on
      the R-Car chips.  This fix also assumes that RDFAR is never exposed at
      offset 0 in the memory map - this is currently true, and a subsequent
      commit will fix the ambiguity between offset 0 and no-offset in the
      register offset maps.
      
      Fixes: 79fba9f5 ("net: sh_eth: fix the rxdesc pointer when rx ...")
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6ded2865
    • Ben Hutchings's avatar
      sh_eth: Ensure proper ordering of descriptor active bit write/read · 7d7355f5
      Ben Hutchings authored
      When submitting a DMA descriptor, the active bit must be written last.
      When reading a completed DMA descriptor, the active bit must be read
      first.
      
      Add memory barriers to ensure that this ordering is maintained.
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7d7355f5
  9. 02 Mar, 2015 7 commits
    • Tapasweni Pathak's avatar
      KVM: MIPS: Enable after disabling interrupt · cfec0e75
      Tapasweni Pathak authored
      Enable disabled interrupt, on unsuccessful operation.
      
      Found by Coccinelle.
      Signed-off-by: default avatarTapasweni Pathak <tapaswenipathak@gmail.com>
      Acked-by: default avatarJulia Lawall <julia.lawall@lip6.fr>
      Reviewed-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      cfec0e75
    • James Hogan's avatar
      KVM: MIPS: Fix trace event to save PC directly · b3cffac0
      James Hogan authored
      Currently the guest exit trace event saves the VCPU pointer to the
      structure, and the guest PC is retrieved by dereferencing it when the
      event is printed rather than directly from the trace record. This isn't
      safe as the printing may occur long afterwards, after the PC has changed
      and potentially after the VCPU has been freed. Usually this results in
      the same (wrong) PC being printed for multiple trace events. It also
      isn't portable as userland has no way to access the VCPU data structure
      when interpreting the trace record itself.
      
      Lets save the actual PC in the structure so that the correct value is
      accessible later.
      
      Fixes: 669e846e ("KVM/MIPS32: MIPS arch specific APIs for KVM")
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Marcelo Tosatti <mtosatti@redhat.com>
      Cc: Gleb Natapov <gleb@kernel.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: linux-mips@linux-mips.org
      Cc: kvm@vger.kernel.org
      Cc: <stable@vger.kernel.org> # v3.10+
      Acked-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      b3cffac0
    • Linus Torvalds's avatar
      Merge tag 'gpio-v4.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 023a6007
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Two GPIO fixes:
      
         - Fix a translation problem in of_get_named_gpiod_flags()
      
         - Fix a long standing container_of() mistake in the TPS65912 driver"
      
      * tag 'gpio-v4.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: tps65912: fix wrong container_of arguments
        gpiolib: of: allow of_gpiochip_find_and_xlate to find more than one chip per node
      023a6007
    • Linus Torvalds's avatar
      Merge branch 'fixes-for-4.0-rc2' of... · 10d6dfc1
      Linus Torvalds authored
      Merge branch 'fixes-for-4.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal
      
      Pull thermal management fixes from Eduardo Valentin:
       "Specifics:
      
         - Several fixes in tmon tool.
      
         - Fixes in intel int340x for _ART and _TRT tables.
      
         - Add id for Avoton SoC into powerclamp driver.
      
         - Fixes in RCAR thermal driver to remove race conditions and fix fail
           path
      
         - Fixes in TI thermal driver: removal of unnecessary code and build
           fix if !CONFIG_PM_SLEEP
      
         - Cleanups in exynos thermal driver
      
         - Add stubs for include/linux/thermal.h.  Now drivers using thermal
           calls but that also work without CONFIG_THERMAL will be able to
           compile for systems that don't care about thermal.
      
        Note: I am sending this pull on Rui's behalf while he fixes issues in
        his Linux box"
      
      * 'fixes-for-4.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal:
        thermal: int340x_thermal: Ignore missing _ART, _TRT tables
        thermal/intel_powerclamp: add id for Avoton SoC
        tools/thermal: tmon: silence 'set but not used' warnings
        tools/thermal: tmon: use pkg-config to determine library dependencies
        tools/thermal: tmon: support cross-compiling
        tools/thermal: tmon: add .gitignore
        tools/thermal: tmon: fixup tui windowing calculations
        tools/thermal: tmon: tui: don't hard-code dialog window size assumptions
        tools/thermal: tmon: add min/max macros
        tools/thermal: tmon: add --target-temp parameter
        thermal: exynos: Clean-up code to use oneline entry for exynos compatible table
        thermal: rcar: Make error and remove paths symmetrical with init
        thermal: rcar: Fix race condition between init and interrupt
        thermal: Introduce dummy functions when thermal is not defined
        ti-soc-thermal: Delete an unnecessary check before the function call "cpufreq_cooling_unregister"
        thermal: ti-soc-thermal: bandgap: Fix build warning if !CONFIG_PM_SLEEP
      10d6dfc1
    • Radim Krčmář's avatar
      KVM: SVM: fix interrupt injection (apic->isr_count always 0) · f563db4b
      Radim Krčmář authored
      In commit b4eef9b3, we started to use hwapic_isr_update() != NULL
      instead of kvm_apic_vid_enabled(vcpu->kvm).  This didn't work because
      SVM had it defined and "apicv" path in apic_{set,clear}_isr() does not
      change apic->isr_count, because it should always be 1.  The initial
      value of apic->isr_count was based on kvm_apic_vid_enabled(vcpu->kvm),
      which is always 0 for SVM, so KVM could have injected interrupts when it
      shouldn't.
      
      Fix it by implicitly setting SVM's hwapic_isr_update to NULL and make the
      initial isr_count depend on hwapic_isr_update() for good measure.
      
      Fixes: b4eef9b3 ("kvm: x86: vmx: NULL out hwapic_isr_update() in case of !enable_apicv")
      Reported-and-tested-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      f563db4b
    • Linus Torvalds's avatar
      Merge tag 'md/4.0-fixes' of git://neil.brown.name/md · 1a6f77ab
      Linus Torvalds authored
      Pull md fixes from Neil Brown:
       "Three md fixes:
      
         - fix a read-balance problem that was reported 2 years ago, but that
           I never noticed the report :-(
      
         - fix for rare RAID6 problem causing incorrect bitmap updates when
           two devices fail.
      
         - add __ATTR_PREALLOC annotation now that it is possible"
      
      * tag 'md/4.0-fixes' of git://neil.brown.name/md:
        md: mark some attributes as pre-alloc
        raid5: check faulty flag for array status during recovery.
        md/raid1: fix read balance when a drive is write-mostly.
      1a6f77ab
    • Linus Torvalds's avatar
      Merge tag 'metag-fixes-v4.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag · 49db1f0e
      Linus Torvalds authored
      Pull arch/metag fix from James Hogan:
       "This is just a single patch to fix the KSTK_EIP() and KSTK_ESP()
        macros for metag which have always been erronously returning the PC
        and stack pointer of the task's kernel context rather than from its
        user context saved at entry from userland into the kernel, which
        affects the contents of /proc/<pid>/maps and /proc/<pid>/stat"
      
      * tag 'metag-fixes-v4.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag:
        metag: Fix KSTK_EIP() and KSTK_ESP() macros
      49db1f0e