12 Feb, 2019

2 commits


23 Jan, 2019

1 commit

  • commit 28b170e88bc0c7509e6724717c15cb4b5686026e upstream.

    Add an of_node_put when the result of of_graph_get_remote_port_parent is
    not available.

    The semantic match that finds this problem is as follows
    (http://coccinelle.lip6.fr):

    //
    @r exists@
    local idexpression e;
    expression x;
    @@
    e = of_graph_get_remote_port_parent(...);
    ... when != x = e
    when != true e == NULL
    when != of_node_put(e)
    when != of_fwnode_handle(e)
    (
    return e;
    |
    *return ...;
    )
    //

    Signed-off-by: Julia Lawall
    Cc: stable@vger.kernel.org
    Signed-off-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    Julia Lawall
     

01 Dec, 2018

1 commit

  • [ Upstream commit 36156f9241cb0f9e37d998052873ca7501ad4b36 ]

    Add of_get_compatible_child() helper that can be used to lookup
    compatible child nodes.

    Several drivers currently use of_find_compatible_node() to lookup child
    nodes while failing to notice that the of_find_ functions search the
    entire tree depth-first (from a given start node) and therefore can
    match unrelated nodes. The fact that these functions also drop a
    reference to the node they start searching from (e.g. the parent node)
    is typically also overlooked, something which can lead to use-after-free
    bugs.

    Signed-off-by: Johan Hovold
    Signed-off-by: Rob Herring
    Signed-off-by: Sasha Levin

    Johan Hovold
     

21 Nov, 2018

1 commit

  • commit 89c38422e072bb453e3045b8f1b962a344c3edea upstream.

    Currently the NUMA distance map parsing does not validate the distance
    table for the distance-matrix rules 1-2 in [1].

    However the arch NUMA code may enforce some of these rules, but not all.
    Such is the case for the arm64 port, which does not enforce the rule that
    the distance between separates nodes cannot equal LOCAL_DISTANCE.

    The patch adds the following rules validation:
    - distance of node to self equals LOCAL_DISTANCE
    - distance of separate nodes > LOCAL_DISTANCE

    This change avoids a yet-unresolved crash reported in [2].

    A note on dealing with symmetrical distances between nodes:

    Validating symmetrical distances between nodes is difficult. If it were
    mandated in the bindings that every distance must be recorded in the
    table, then it would be easy. However, it isn't.

    In addition to this, it is also possible to record [b, a] distance only
    (and not [a, b]). So, when processing the table for [b, a], we cannot
    assert that current distance of [a, b] != [b, a] as invalid, as [a, b]
    distance may not be present in the table and current distance would be
    default at REMOTE_DISTANCE.

    As such, we maintain the policy that we overwrite distance [a, b] = [b, a]
    for b > a. This policy is different to kernel ACPI SLIT validation, which
    allows non-symmetrical distances (ACPI spec SLIT rules allow it). However,
    the distance debug message is dropped as it may be misleading (for a distance
    which is later overwritten).

    Some final notes on semantics:

    - It is implied that it is the responsibility of the arch NUMA code to
    reset the NUMA distance map for an error in distance map parsing.

    - It is the responsibility of the FW NUMA topology parsing (whether OF or
    ACPI) to enforce NUMA distance rules, and not arch NUMA code.

    [1] Documents/devicetree/bindings/numa.txt
    [2] https://www.spinics.net/lists/arm-kernel/msg683304.html

    Cc: stable@vger.kernel.org # 4.7
    Signed-off-by: John Garry
    Acked-by: Will Deacon
    Signed-off-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    John Garry
     

13 Oct, 2018

1 commit

  • commit 8894891446c9380709451b99ab45c5c53adfd2fc upstream.

    On systems with OF_IMAP_OLDWORLD_MAC set in of_irq_workarounds, the
    devicetree interrupt parsing code is different, causing unit tests of
    devicetree interrupt nodes to fail. Due to a bug in unittest code, which
    tries to dereference an uninitialized pointer, this results in a crash.

    OF: /testcase-data/phandle-tests/consumer-a: arguments longer than property
    Unable to handle kernel paging request for data at address 0x00bc616e
    Faulting instruction address: 0xc08e9468
    Oops: Kernel access of bad area, sig: 11 [#1]
    BE PREEMPT PowerMac
    Modules linked in:
    CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.72-rc1-yocto-standard+ #1
    task: cf8e0000 task.stack: cf8da000
    NIP: c08e9468 LR: c08ea5bc CTR: c08ea5ac
    REGS: cf8dbb50 TRAP: 0300 Not tainted (4.14.72-rc1-yocto-standard+)
    MSR: 00001032 CR: 82004044 XER: 00000000
    DAR: 00bc616e DSISR: 40000000
    GPR00: c08ea5bc cf8dbc00 cf8e0000 c13ca517 c13ca517 c13ca8a0 00000066 00000002
    GPR08: 00000063 00bc614e c0b05865 000affff 82004048 00000000 c00047f0 00000000
    GPR16: c0a80000 c0a9cc34 c13ca517 c0ad1134 05ffffff 000affff c0b05860 c0abeef8
    GPR24: cecec278 cecec278 c0a8c4d0 c0a885e0 c13ca8a0 05ffffff c13ca8a0 c13ca517

    NIP [c08e9468] device_node_gen_full_name+0x30/0x15c
    LR [c08ea5bc] device_node_string+0x190/0x3c8
    Call Trace:
    [cf8dbc00] [c007f670] trace_hardirqs_on_caller+0x118/0x1fc (unreliable)
    [cf8dbc40] [c08ea5bc] device_node_string+0x190/0x3c8
    [cf8dbcb0] [c08eb794] pointer+0x25c/0x4d0
    [cf8dbd00] [c08ebcbc] vsnprintf+0x2b4/0x5ec
    [cf8dbd60] [c08ec00c] vscnprintf+0x18/0x48
    [cf8dbd70] [c008e268] vprintk_store+0x4c/0x22c
    [cf8dbda0] [c008ecac] vprintk_emit+0x94/0x130
    [cf8dbdd0] [c008ff54] printk+0x5c/0x6c
    [cf8dbe10] [c0b8ddd4] of_unittest+0x2220/0x26f8
    [cf8dbea0] [c0004434] do_one_initcall+0x4c/0x184
    [cf8dbf00] [c0b4534c] kernel_init_freeable+0x13c/0x1d8
    [cf8dbf30] [c0004814] kernel_init+0x24/0x118
    [cf8dbf40] [c0013398] ret_from_kernel_thread+0x5c/0x64

    The problem was observed when running a qemu test for the g3beige machine
    with devicetree unittests enabled.

    Disable interrupt node tests on affected systems to avoid both false
    unittest failures and the crash.

    With this patch in place, unittest on the affected system passes with
    the following message.

    dt-test ### end of unittest - 144 passed, 0 failed

    Fixes: 53a42093d96ef ("of: Add device tree selftests")
    Signed-off-by: Guenter Roeck
    Reviewed-by: Frank Rowand
    Signed-off-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    Guenter Roeck
     

03 Jul, 2018

3 commits

  • commit 522811e944ed9b36806faa019faec10f9d259cca upstream.

    Immediately after the platform_device_unregister() the device will be
    cleaned up. Accessing the freed pointer immediately after that will
    crash the system.

    Found this bug when kernel is built with CONFIG_PAGE_POISONING and testing
    loading/unloading audio drivers in a loop on Qcom platforms.

    Fix this by moving of_node_clear_flag() just before the unregister calls.

    Below is the crash trace:

    Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c03
    Mem abort info:
    ESR = 0x96000021
    Exception class = DABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
    Data abort info:
    ISV = 0, ISS = 0x00000021
    CM = 0, WnR = 0
    [006b6b6b6b6b6c03] address between user and kernel address ranges
    Internal error: Oops: 96000021 [#1] PREEMPT SMP
    Modules linked in:
    CPU: 2 PID: 1784 Comm: sh Tainted: G W 4.17.0-rc7-02230-ge3a63a7ef641-dirty #204
    Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT)
    pstate: 80000005 (Nzcv daif -PAN -UAO)
    pc : clear_bit+0x18/0x2c
    lr : of_platform_device_destroy+0x64/0xb8
    sp : ffff00000c9c3930
    x29: ffff00000c9c3930 x28: ffff80003d39b200
    x27: ffff000008bb1000 x26: 0000000000000040
    x25: 0000000000000124 x24: ffff80003a9a3080
    x23: 0000000000000060 x22: ffff00000939f518
    x21: ffff80003aa79e98 x20: ffff80003aa3dae0
    x19: ffff80003aa3c890 x18: ffff800009feb794
    x17: 0000000000000000 x16: 0000000000000000
    x15: ffff800009feb790 x14: 0000000000000000
    x13: ffff80003a058778 x12: ffff80003a058728
    x11: ffff80003a058750 x10: 0000000000000000
    x9 : 0000000000000006 x8 : ffff80003a825988
    x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000001
    x5 : 0000000000000000 x4 : 0000000000000001
    x3 : 0000000000000008 x2 : 0000000000000001
    x1 : 6b6b6b6b6b6b6c03 x0 : 0000000000000000
    Process sh (pid: 1784, stack limit = 0x (ptrval))
    Call trace:
    clear_bit+0x18/0x2c
    q6afe_remove+0x20/0x38
    apr_device_remove+0x30/0x70
    device_release_driver_internal+0x170/0x208
    device_release_driver+0x14/0x20
    bus_remove_device+0xcc/0x150
    device_del+0x10c/0x310
    device_unregister+0x1c/0x70
    apr_remove_device+0xc/0x18
    device_for_each_child+0x50/0x80
    apr_remove+0x18/0x20
    rpmsg_dev_remove+0x38/0x68
    device_release_driver_internal+0x170/0x208
    device_release_driver+0x14/0x20
    bus_remove_device+0xcc/0x150
    device_del+0x10c/0x310
    device_unregister+0x1c/0x70
    qcom_smd_remove_device+0xc/0x18
    device_for_each_child+0x50/0x80
    qcom_smd_unregister_edge+0x3c/0x70
    smd_subdev_remove+0x18/0x28
    rproc_stop+0x48/0xd8
    rproc_shutdown+0x60/0xe8
    state_store+0xbc/0xf8
    dev_attr_store+0x18/0x28
    sysfs_kf_write+0x3c/0x50
    kernfs_fop_write+0x118/0x1e0
    __vfs_write+0x18/0x110
    vfs_write+0xa4/0x1a8
    ksys_write+0x48/0xb0
    sys_write+0xc/0x18
    el0_svc_naked+0x30/0x34
    Code: d2800022 8b400c21 f9800031 9ac32043 (c85f7c22)
    ---[ end trace 32020935775616a2 ]---

    Signed-off-by: Srinivas Kandagatla
    Cc: stable@vger.kernel.org
    Signed-off-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    Srinivas Kandagatla
     
  • commit 3b9cf7905fe3ab35ab437b5072c883e609d3498d upstream.

    For strings, account for trailing \0 in property length field:

    This is consistent with how dtc builds string properties.

    Function __of_prop_dup() would misbehave on such properties as it duplicates
    properties based on the property length field creating new string values
    without trailing \0s.

    Signed-off-by: Stefan M Schaeckeler
    Reviewed-by: Frank Rowand
    Tested-by: Frank Rowand
    Cc:
    Signed-off-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    Stefan M Schaeckeler
     
  • commit 482137bf2aecd887ebfa8756456764a2f6a0e545 upstream.

    The smatch static checker marks the data in offset as untrusted,
    leading it to warn:

    drivers/of/resolver.c:125 update_usages_of_a_phandle_reference()
    error: buffer underflow 'prop->value' 's32min-s32max'

    Add check to verify that offset is within the property data.

    Reported-by: Dan Carpenter
    Signed-off-by: Frank Rowand
    Cc:
    Signed-off-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    Frank Rowand
     

02 May, 2018

1 commit

  • commit dd709e72cb934eefd44de8d9969097173fbf45dc upstream.

    Commit 99492c39f39f ("earlycon: Fix __earlycon_table stride") tried to fix
    __earlycon_table stride by forcing the earlycon_id struct alignment to 32
    and asking the linker to 32-byte align the __earlycon_table symbol. This
    fix was based on commit 07fca0e57fca92 ("tracing: Properly align linker
    defined symbols") which tried a similar fix for the tracing subsystem.

    However, this fix doesn't quite work because there is no guarantee that
    gcc will place structures packed into an array format. In fact, gcc 4.9
    chooses to 64-byte align these structs by inserting additional padding
    between the entries because it has no clue that they are supposed to be in
    an array. If we are unlucky, the linker will assign symbol
    "__earlycon_table" to a 32-byte aligned address which does not correspond
    to the 64-byte aligned contents of section "__earlycon_table".

    To address this same problem, the fix to the tracing system was
    subsequently re-implemented using a more robust table of pointers approach
    by commits:
    3d56e331b653 ("tracing: Replace syscall_meta_data struct array with pointer array")
    654986462939 ("tracepoints: Fix section alignment using pointer array")
    e4a9ea5ee7c8 ("tracing: Replace trace_event struct array with pointer array")

    Let's use this same "array of pointers to structs" approach for
    EARLYCON_TABLE.

    Fixes: 99492c39f39f ("earlycon: Fix __earlycon_table stride")
    Signed-off-by: Daniel Kurtz
    Suggested-by: Aaron Durbin
    Reviewed-by: Rob Herring
    Tested-by: Guenter Roeck
    Reviewed-by: Guenter Roeck
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Daniel Kurtz
     

03 Mar, 2018

1 commit

  • [ Upstream commit 95f566de0269a0c59fd6a737a147731302136429 ]

    If one of the child devices is missing the of_mdiobus_register_phy()
    call will return -ENODEV. When a missing device is encountered the
    registration of the remaining PHYs is stopped and the MDIO bus will
    fail to register. Propagate all errors except ENODEV to avoid it.

    Signed-off-by: Madalin Bucur
    Reviewed-by: Andrew Lunn
    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Madalin Bucur
     

13 Feb, 2018

1 commit

  • commit 10b62a2f785ab55857380f0c63d9fa468fd8c676 upstream.

    Most of DT files are compiled under arch/*/boot/dts/, but we have some
    other directories, like drivers/of/unittest-data/. We often miss to
    add gitignore patterns per directory. Since there are no source files
    that end with .dtb or .dtb.S, we can ignore the patterns globally.

    Signed-off-by: Masahiro Yamada
    Signed-off-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    Masahiro Yamada
     

02 Nov, 2017

1 commit

  • Many source files in the tree are missing licensing information, which
    makes it harder for compliance tools to determine the correct license.

    By default all files without license information are under the default
    license of the kernel, which is GPL version 2.

    Update the files which contain no license information with the 'GPL-2.0'
    SPDX license identifier. The SPDX identifier is a legally binding
    shorthand, which can be used instead of the full boiler plate text.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne.

    How this work was done:

    Patches were generated and checked against linux-4.14-rc6 for a subset of
    the use cases:
    - file had no licensing information it it.
    - file was a */uapi/* one with no licensing information in it,
    - file was a */uapi/* one with existing licensing information,

    Further patches will be generated in subsequent months to fix up cases
    where non-standard license headers were used, and references to license
    had to be inferred by heuristics based on keywords.

    The analysis to determine which SPDX License Identifier to be applied to
    a file was done in a spreadsheet of side by side results from of the
    output of two independent scanners (ScanCode & Windriver) producing SPDX
    tag:value files created by Philippe Ombredanne. Philippe prepared the
    base worksheet, and did an initial spot review of a few 1000 files.

    The 4.13 kernel was the starting point of the analysis with 60,537 files
    assessed. Kate Stewart did a file by file comparison of the scanner
    results in the spreadsheet to determine which SPDX license identifier(s)
    to be applied to the file. She confirmed any determination that was not
    immediately clear with lawyers working with the Linux Foundation.

    Criteria used to select files for SPDX license identifier tagging was:
    - Files considered eligible had to be source code files.
    - Make and config files were included as candidates if they contained >5
    lines of source
    - File already had some variant of a license header in it (even if
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

22 Oct, 2017

2 commits

  • Pull networking fixes from David Miller:
    "A little more than usual this time around. Been travelling, so that is
    part of it.

    Anyways, here are the highlights:

    1) Deal with memcontrol races wrt. listener dismantle, from Eric
    Dumazet.

    2) Handle page allocation failures properly in nfp driver, from Jaku
    Kicinski.

    3) Fix memory leaks in macsec, from Sabrina Dubroca.

    4) Fix crashes in pppol2tp_session_ioctl(), from Guillaume Nault.

    5) Several fixes in bnxt_en driver, including preventing potential
    NVRAM parameter corruption from Michael Chan.

    6) Fix for KRACK attacks in wireless, from Johannes Berg.

    7) rtnetlink event generation fixes from Xin Long.

    8) Deadlock in mlxsw driver, from Ido Schimmel.

    9) Disallow arithmetic operations on context pointers in bpf, from
    Jakub Kicinski.

    10) Missing sock_owned_by_user() check in sctp_icmp_redirect(), from
    Xin Long.

    11) Only TCP is supported for sockmap, make that explicit with a
    check, from John Fastabend.

    12) Fix IP options state races in DCCP and TCP, from Eric Dumazet.

    13) Fix panic in packet_getsockopt(), also from Eric Dumazet.

    14) Add missing locked in hv_sock layer, from Dexuan Cui.

    15) Various aquantia bug fixes, including several statistics handling
    cures. From Igor Russkikh et al.

    16) Fix arithmetic overflow in devmap code, from John Fastabend.

    17) Fix busted socket memory accounting when we get a fault in the tcp
    zero copy paths. From Willem de Bruijn.

    18) Don't leave opt->tot_len uninitialized in ipv6, from Eric Dumazet"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (106 commits)
    stmmac: Don't access tx_q->dirty_tx before netif_tx_lock
    ipv6: flowlabel: do not leave opt->tot_len with garbage
    of_mdio: Fix broken PHY IRQ in case of probe deferral
    textsearch: fix typos in library helpers
    rxrpc: Don't release call mutex on error pointer
    net: stmmac: Prevent infinite loop in get_rx_timestamp_status()
    net: stmmac: Fix stmmac_get_rx_hwtstamp()
    net: stmmac: Add missing call to dev_kfree_skb()
    mlxsw: spectrum_router: Configure TIGCR on init
    mlxsw: reg: Add Tunneling IPinIP General Configuration Register
    net: ethtool: remove error check for legacy setting transceiver type
    soreuseport: fix initialization race
    net: bridge: fix returning of vlan range op errors
    sock: correct sk_wmem_queued accounting on efault in tcp zerocopy
    bpf: add test cases to bpf selftests to cover all access tests
    bpf: fix pattern matches for direct packet access
    bpf: fix off by one for range markings with L{T, E} patterns
    bpf: devmap fix arithmetic overflow in bitmap_size calculation
    net: aquantia: Bad udp rate on default interrupt coalescing
    net: aquantia: Enable coalescing management via ethtool interface
    ...

    Linus Torvalds
     
  • If an Ethernet PHY is initialized before the interrupt controller it is
    connected to, a message like the following is printed:

    irq: no irq domain found for /interrupt-controller@e61c0000 !

    However, the actual error is ignored, leading to a non-functional (POLL)
    PHY interrupt later:

    Micrel KSZ8041RNLI ee700000.ethernet-ffffffff:01: attached PHY driver [Micrel KSZ8041RNLI] (mii_bus:phy_addr=ee700000.ethernet-ffffffff:01, irq=POLL)

    Depending on whether the PHY driver will fall back to polling, Ethernet
    may or may not work.

    To fix this:
    1. Switch of_mdiobus_register_phy() from irq_of_parse_and_map() to
    of_irq_get().
    Unlike the former, the latter returns -EPROBE_DEFER if the
    interrupt controller is not yet available, so this condition can be
    detected.
    Other errors are handled the same as before, i.e. use the passed
    mdio->irq[addr] as interrupt.
    2. Propagate and handle errors from of_mdiobus_register_phy() and
    of_mdiobus_register_device().

    Signed-off-by: Geert Uytterhoeven
    Signed-off-by: David S. Miller

    Geert Uytterhoeven
     

13 Oct, 2017

3 commits

  • Using CONFIG_OF_DYNAMIC=y uncovered an imbalance in the usecount of the
    node being passed to of_fwnode_graph_get_port_parent(). Preserve the
    usecount by using of_get_parent() instead of of_get_next_parent() which
    don't decrement the usecount of the node passed to it.

    Fixes: 3b27d00e7b6d7c88 ("device property: Move fwnode graph ops to firmware specific locations")
    Signed-off-by: Niklas Söderlund
    Acked-by: Sakari Ailus
    Signed-off-by: Rob Herring

    Niklas Söderlund
     
  • There are two types of memory reservations firmware can ask the kernel
    to make in the device tree: static and dynamic.
    See Documentation/devicetree/bindings/reserved-memory/reserved-memory.txt

    If you have greater than 16 entries in /reserved-memory (as we do on
    POWER9 systems) you would get this scary looking error message:
    [ 0.000000] OF: reserved mem: not enough space all defined regions.

    This is harmless if all your reservations are static (which with OPAL on
    POWER9, they are).

    It is not harmless if you have any dynamic reservations after the 16th.

    In the first pass over the fdt to find reservations, the child nodes of
    /reserved-memory are added to a static array in of_reserved_mem.c so that
    memory can be reserved in a 2nd pass. The array has 16 entries. This is why,
    on my dual socket POWER9 system, I get that error 4 times with 20 static
    reservations.

    We don't have a problem on ppc though, as in arch/powerpc/kernel/prom.c
    we look at the new style /reserved-ranges property to do reservations,
    and this logic was introduced in 0962e8004e974 (well before any powernv
    system shipped).

    A Google search shows up no occurances of that exact error message, so we're
    probably safe in that no machine that people use has memory not being reserved
    when it should be.

    The simple fix is to bump the length of the array to 32 which "should be
    enough for everyone(TM)". The simple fix of not recording static allocations
    in the array would cause problems for devices with "memory-region" properties.
    A more future-proof fix is likely possible, although more invasive and this
    simple fix is perfectly suitable in the meantime while a more future-proof
    fix is developed.

    Signed-off-by: Stewart Smith
    Tested-by: Mauricio Faria de Oliveira
    Signed-off-by: Rob Herring

    Stewart Smith
     
  • Do not strdup() console options. It seems that the only reason for
    it to be strdup()-ed was a compilation warning: printk, UART and
    console drivers, for some reason, expect char pointer instead of
    const char pointer. So we can just pass `of_stdout_options', but
    need to cast it to char pointer. A better fix would be to change
    printk, console drivers and UART to accept const char `options';
    but that will take time - there are lots of drivers to update.

    The patch also fixes a possible memory leak: add_preferred_console()
    can fail, but we don't kfree() options.

    Signed-off-by: Sergey Senozhatsky
    Reviewed-by: Petr Mladek
    Signed-off-by: Rob Herring

    Sergey Senozhatsky
     

13 Sep, 2017

1 commit

  • Pull dma-mapping updates from Christoph Hellwig:

    - removal of the old dma_alloc_noncoherent interface

    - remove unused flags to dma_declare_coherent_memory

    - restrict OF DMA configuration to specific physical busses

    - use the iommu mailing list for dma-mapping questions and patches

    * tag 'dma-mapping-4.14' of git://git.infradead.org/users/hch/dma-mapping:
    dma-coherent: fix dma_declare_coherent_memory() logic error
    ARM: imx: mx31moboard: Remove unused 'dma' variable
    dma-coherent: remove an unused variable
    MAINTAINERS: use the iommu list for the dma-mapping subsystem
    dma-coherent: remove the DMA_MEMORY_MAP and DMA_MEMORY_IO flags
    dma-coherent: remove the DMA_MEMORY_INCLUDES_CHILDREN flag
    of: restrict DMA configuration
    dma-mapping: remove dma_alloc_noncoherent and dma_free_noncoherent
    i825xx: switch to switch to dma_alloc_attrs
    au1000_eth: switch to dma_alloc_attrs
    sgiseeq: switch to dma_alloc_attrs
    dma-mapping: reduce dma_mapping_error inline bloat

    Linus Torvalds
     

08 Sep, 2017

1 commit

  • Pull DeviceTree updates from Rob Herring:
    "There's a few orphans in the conversion to %pOF printf specifiers
    included here that no one else picked up.

    Summary:

    - Convert more DT code to use of_property_read_* API.

    - Improve DT overlay support when adding multiple overlays

    - Convert printk's to %pOF format specifiers. Most went via subsystem
    trees, but picked up the remaining orphans

    - Correct unittests to use preferred "okay" for "status" property
    value

    - Add a KASLR seed property

    - Vendor prefixes for Mellanox, Theobroma System, Adaptrum, Moxa

    - Fix modalias buffer handling

    - Clean-up of include paths for building dtbs

    - Add bindings for amc6821, isl1208, tsl2x7x, srf02, and srf10
    devices

    - Add nvmem bindings for MediaTek MT7623 and MT7622 SoC

    - Add compatible string for Allwinner H5 Mali-450 GPU

    - Fix links to old OpenFirmware docs with new mirror on
    devicetree.org

    - Remove status property from binding doc examples"

    * tag 'devicetree-for-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (45 commits)
    devicetree: Adjust status "ok" -> "okay" under drivers/of/
    dt-bindings: Remove "status" from examples
    dt-bindings: pinctrl: sh-pfc: Use generic node name
    dt-bindings: Add vendor Mellanox
    dt-binding: net/phy: fix interrupts description
    virt: Convert to using %pOF instead of full_name
    macintosh: Convert to using %pOF instead of full_name
    ide: pmac: Convert to using %pOF instead of full_name
    microblaze: Convert to using %pOF instead of full_name
    dt-bindings: usb: musb: Grammar s/the/to/, s/is/are/
    of: Use PLATFORM_DEVID_NONE definition
    of/device: Fix of_device_get_modalias() buffer handling
    of/device: Prevent buffer overflow in of_device_modalias()
    dt-bindings: add amc6821, isl1208 trivial bindings
    dt-bindings: add vendor prefix for Theobroma Systems
    of: search scripts/dtc/include-prefixes path for both CPP and DTC
    of: remove arch/$(SRCARCH)/boot/dts from include search path for CPP
    of: remove drivers/of/testcase-data from include search path for CPP
    of: return of_get_cpu_node from of_cpu_device_node_get if CPUs are not registered
    iio: srf08: add device tree binding for srf02 and srf10
    ...

    Linus Torvalds
     

07 Sep, 2017

1 commit

  • Pull networking updates from David Miller:

    1) Support ipv6 checksum offload in sunvnet driver, from Shannon
    Nelson.

    2) Move to RB-tree instead of custom AVL code in inetpeer, from Eric
    Dumazet.

    3) Allow generic XDP to work on virtual devices, from John Fastabend.

    4) Add bpf device maps and XDP_REDIRECT, which can be used to build
    arbitrary switching frameworks using XDP. From John Fastabend.

    5) Remove UFO offloads from the tree, gave us little other than bugs.

    6) Remove the IPSEC flow cache, from Florian Westphal.

    7) Support ipv6 route offload in mlxsw driver.

    8) Support VF representors in bnxt_en, from Sathya Perla.

    9) Add support for forward error correction modes to ethtool, from
    Vidya Sagar Ravipati.

    10) Add time filter for packet scheduler action dumping, from Jamal Hadi
    Salim.

    11) Extend the zerocopy sendmsg() used by virtio and tap to regular
    sockets via MSG_ZEROCOPY. From Willem de Bruijn.

    12) Significantly rework value tracking in the BPF verifier, from Edward
    Cree.

    13) Add new jump instructions to eBPF, from Daniel Borkmann.

    14) Rework rtnetlink plumbing so that operations can be run without
    taking the RTNL semaphore. From Florian Westphal.

    15) Support XDP in tap driver, from Jason Wang.

    16) Add 32-bit eBPF JIT for ARM, from Shubham Bansal.

    17) Add Huawei hinic ethernet driver.

    18) Allow to report MD5 keys in TCP inet_diag dumps, from Ivan
    Delalande.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1780 commits)
    i40e: point wb_desc at the nvm_wb_desc during i40e_read_nvm_aq
    i40e: avoid NVM acquire deadlock during NVM update
    drivers: net: xgene: Remove return statement from void function
    drivers: net: xgene: Configure tx/rx delay for ACPI
    drivers: net: xgene: Read tx/rx delay for ACPI
    rocker: fix kcalloc parameter order
    rds: Fix non-atomic operation on shared flag variable
    net: sched: don't use GFP_KERNEL under spin lock
    vhost_net: correctly check tx avail during rx busy polling
    net: mdio-mux: add mdio_mux parameter to mdio_mux_init()
    rxrpc: Make service connection lookup always check for retry
    net: stmmac: Delete dead code for MDIO registration
    gianfar: Fix Tx flow control deactivation
    cxgb4: Ignore MPS_TX_INT_CAUSE[Bubble] for T6
    cxgb4: Fix pause frame count in t4_get_port_stats
    cxgb4: fix memory leak
    tun: rename generic_xdp to skb_xdp
    tun: reserve extra headroom only when XDP is set
    net: dsa: bcm_sf2: Configure IMP port TC2QOS mapping
    net: dsa: bcm_sf2: Advertise number of egress queues
    ...

    Linus Torvalds
     

06 Sep, 2017

1 commit

  • Pull device properties framework updates from Rafael Wysocki:
    "These introduce fwnode operations for all of the separate types of
    'firmware nodes' that can be handled by the device properties
    framework, make the framework use const fwnode arguments all over, add
    a helper for the consolidated handling of node references and switch
    over the framework to the new UUID API.

    Specifics:

    - Introduce fwnode operations for all of the separate types of
    'firmware nodes' that can be handled by the device properties
    framework and drop the type field from struct fwnode_handle (Sakari
    Ailus, Arnd Bergmann).

    - Make the device properties framework use const fwnode arguments
    where possible (Sakari Ailus).

    - Add a helper for the consolidated handling of node references to
    the device properties framework (Sakari Ailus).

    - Switch over the ACPI part of the device properties framework to the
    new UUID API (Andy Shevchenko)"

    * tag 'devprop-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
    ACPI: device property: Switch to use new generic UUID API
    device property: export irqchip_fwnode_ops
    device property: Introduce fwnode_property_get_reference_args
    device property: Constify fwnode property API
    device property: Constify argument to pset fwnode backend
    ACPI: Constify internal fwnode arguments
    ACPI: Constify acpi_bus helper functions, switch to macros
    ACPI: Prepare for constifying acpi_get_next_subnode() fwnode argument
    device property: Get rid of struct fwnode_handle type field
    ACPI: Use IS_ERR_OR_NULL() instead of non-NULL check in is_acpi_data_node()

    Linus Torvalds
     

05 Sep, 2017

1 commit


01 Sep, 2017

1 commit

  • Moving DMA configuration to happen later at driver probe time had the
    unnoticed side-effect that we now perform DMA configuration for *every*
    device represented in DT, rather than only those explicitly created by
    the of_platform and PCI code.

    As Christoph points out, this is not really the best thing to do. Whilst
    there may well be other DMA-capable buses that can benefit from having
    their children automatically configured after the bridge has probed,
    there are also plenty of others like USB, MDIO, etc. that definitely do
    not support DMA and should not be indiscriminately processed.

    The good news is that in most cases the DT "dma-ranges" property serves
    as an appropriate indicator - per a strict interpretation of the spec,
    anything lacking a "dma-ranges" property should be considered not to
    have a mapping of DMA address space from its children to its parent,
    thus anything for which of_dma_get_range() does not succeed does not
    need DMA configuration. Certain bus types have a general expectation of
    DMA capability and carry a well-established precedent that an absent
    "dma-ranges" implies the same as the empty property, so we automatically
    opt those in to DMA configuration regardless, to avoid regressing most
    existing platforms.

    Fixes: 09515ef5ddad ("of/acpi: Configure dma operations at probe time for platform/amba/pci bus devices")
    Reported-by: Christoph Hellwig
    Signed-off-by: Robin Murphy
    Acked-by: Rob Herring
    Signed-off-by: Christoph Hellwig

    Robin Murphy
     

25 Aug, 2017

3 commits

  • Use dedicated definition instead of plain -1 where it's appropriate.

    No functional change intended.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Rob Herring

    Andy Shevchenko
     
  • of_device_request_module() calls of_device_get_modalias() with "len" 0,
    to calculate the size of the buffer needed to store the result, but due
    to integer promotion the ssize_t "len" will be compared as unsigned with
    strlen(compat) and the loop will generally never break. This results in
    a call to snprintf() with a negative len, which triggers below warning,
    followed by a dereference of a invalid pointer:

    [ 3.060067] WARNING: CPU: 0 PID: 51 at lib/vsprintf.c:2122 vsnprintf+0x348/0x6d8
    ...
    [ 3.060301] [] vsnprintf+0x348/0x6d8
    [ 3.060308] [] snprintf+0x48/0x50
    [ 3.060316] [] of_device_get_modalias+0x108/0x160
    [ 3.060322] [] of_device_request_module+0x20/0x88
    ...

    Further more of_device_get_modalias() is supposed to return the number
    of bytes needed to store the entire modalias, so the loop needs to
    continue accumulate the total size even though the buffer is full.

    Finally the function is not expected to ensure space for the NUL, nor
    include it in the returned size, so only 1 should be added to the length
    of "compat" in the loop (to account for the character 'C').

    Fixes: bc575064d688 ("of/device: use of_property_for_each_string to parse compatible strings")
    Cc: Rob Herring
    Signed-off-by: Bjorn Andersson
    Signed-off-by: Rob Herring

    Bjorn Andersson
     
  • As of_device_get_modalias() returns the number of bytes that would have
    been written to the target string, regardless of how much did fit in the
    buffer, it's possible that the returned index points beyond the buffer
    passed to of_device_modalias() - causing memory beyond the buffer to be
    null terminated.

    Fixes: 0634c2958927 ("of: Add function for generating a DT modalias with a newline")
    Cc: Rob Herring
    Cc: stable@vger.kernel.org
    Signed-off-by: Bjorn Andersson
    Signed-off-by: Rob Herring

    Bjorn Andersson
     

22 Aug, 2017

1 commit


17 Aug, 2017

1 commit

  • Historically, DMA masks have suffered some ambiguity between whether
    they represent the range of physical memory a device can access, or the
    address bits a device is capable of driving, particularly since on many
    platforms the two are equivalent. Whilst there are some stragglers left
    (dma_max_pfn(), I'm looking at you...), the majority of DMA code has
    been cleaned up to follow the latter definition, not least since it is
    the only one which makes sense once IOMMUs are involved.

    In this respect, of_dma_configure() has always done the wrong thing in
    how it generates initial masks based on "dma-ranges". Although rounding
    down did not affect the TI Keystone platform where dma_addr + size is
    already a power of two, in any other case it results in a mask which is
    at best unnecessarily constrained and at worst unusable.

    BCM2837 illustrates the problem nicely, where we have a DMA base of 3GB
    and a size of 1GB - 16MB, giving dma_addr + size = 0xff000000 and a
    resultant mask of 0x7fffffff, which is then insufficient to even cover
    the necessary offset, effectively making all DMA addresses out-of-range.
    This has been hidden until now (mostly because we don't yet prevent
    drivers from simply overwriting this initial mask later upon probe), but
    due to recent changes elsewhere now shows up as USB being broken on
    Raspberry Pi 3.

    Make it right by rounding up instead of down, such that the mask
    correctly correctly describes all possisble bits the device needs to
    emit.

    Fixes: 9a6d7298b083 ("of: Calculate device DMA masks based on DT dma-range size")
    Reported-by: Stefan Wahren
    Reported-by: Andreas Färber
    Reported-by: Hans Verkuil
    Signed-off-by: Robin Murphy
    Acked-by: Rob Herring
    Signed-off-by: Christoph Hellwig

    Robin Murphy
     

15 Aug, 2017

1 commit


14 Aug, 2017

1 commit

  • Looks like gcc isn't always able to figure out that 3 *if* branches in
    of_phy_register_fixed_link() calling fixed_phy_register() at their ends
    are similar enough and thus can be merged. The "manual" merge saves 40
    bytes of the object code (AArch64 gcc 4.8.5), and still saves 12 bytes
    even if gcc was able to merge the branch tails (ARM gcc 4.8.5)...

    Signed-off-by: Sergei Shtylyov
    Signed-off-by: David S. Miller

    Sergei Shtylyov
     

08 Aug, 2017

2 commits

  • The "fixed-link" prop support predated of_property_read_u32_array(), so
    basically had to open-code it. Using the modern API saves 24 bytes of the
    object code (ARM gcc 4.8.5); the only behavior change would be that the
    prop length check is now less strict (however the strict pre-check done
    in of_phy_is_fixed_link() is left intact anyway)...

    Signed-off-by: Sergei Shtylyov
    Reviewed-by: Andrew Lunn
    Reviewed-by: Rob Herring
    Signed-off-by: David S. Miller

    Sergei Shtylyov
     
  • Saeed Mahameed says:

    ====================
    mlx5-shared-2017-08-07

    This series includes some mlx5 updates for both net-next and rdma trees.

    From Saeed,
    Core driver updates to allow selectively building the driver with
    or without some large driver components, such as
    - E-Switch (Ethernet SRIOV support).
    - Multi-Physical Function Switch (MPFs) support.
    For that we split E-Switch and MPFs functionalities into separate files.

    From Erez,
    Delay mlx5_core events when mlx5 interfaces, namely mlx5_ib, registration
    is taking place and until it completes.

    From Rabie,
    Increase the maximum supported flow counters.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

02 Aug, 2017

3 commits


01 Aug, 2017

2 commits

  • …6', 'asoc/fix/multi-pcm', 'asoc/fix/of-graph' and 'asoc/fix/pxa' into asoc-linus

    Mark Brown
     
  • Fix inconsistent use of of_graph_get_port_parent() where
    asoc_simple_card_parse_graph_dai() does of_node_get() before
    calling it while other callers do not. We can fix this by
    not trashing the node passed to of_graph_get_port_parent().

    Let's also make sure the callers have correct refcounts and remove
    related incorrect of_node_put() calls for of_for_each_phandle
    as that's done by of_phandle_iterator_next() except when
    we break out of the loop early.

    Let's fix both issues with a single patch to avoid kobject
    refcounts getting messed up more if two patches are merged
    separately.

    Otherwise strange issues can happen caused by memory corruption
    caused by too many kobject_del() calls such as:

    BUG: sleeping function called from invalid context at
    kernel/locking/mutex.c:747
    ...
    (___might_sleep)
    (__mutex_lock)
    (mutex_lock_nested)
    (kernfs_remove)
    (kobject_del)
    (kobject_put)
    (of_get_next_parent)
    (of_graph_get_port_parent)
    (asoc_simple_card_parse_graph_dai [snd_soc_simple_card_utils])
    (asoc_graph_card_probe [snd_soc_audio_graph_card])

    Fixes: 0ef472a973eb ("of_graph: add of_graph_get_port_parent()")
    Fixes: 2692c1c63c29 ("ASoC: add audio-graph-card support")
    Fixes: 1689333f8311 ("ASoC: simple-card-utils: add asoc_simple_card_parse_graph_dai()")
    Signed-off-by: Tony Lindgren
    Reviewed-by: Rob Herring
    Tested-by: Antonio Borneo
    Tested-by: Kuninori Morimoto
    Signed-off-by: Mark Brown

    Tony Lindgren
     

25 Jul, 2017

1 commit

  • of_phy_register_fixed_link() declares the 'err' variable to hold the result
    of of_property_read_string() but only uses it once after that, while that
    function can be called directly from the *if* statement...

    Remove that variable and move/regroup 'link_gpio' and 'len' variables in
    order to sort the declarations in the reverse Xmas tree order -- to please
    DaveM. ;-)

    Signed-off-by: Sergei Shtylyov
    Signed-off-by: David S. Miller

    Sergei Shtylyov
     

24 Jul, 2017

1 commit

  • of_pci_get_devfn() and of_pci_parse_bus_range() somehow didn't use
    of_property_read_u32_array() though it was long available, basically
    open-coding it. Using the modern DT API saves several bytes and
    also adds some prop sanity checks as a bonus...

    Signed-off-by: Sergei Shtylyov
    Signed-off-by: Rob Herring

    Sergei Shtylyov