1. 25 3月, 2020 5 次提交
    • A
      net: axienet: Factor out TX descriptor chain cleanup · ab365c33
      Andre Przywara 提交于
      Factor out the code that cleans up a number of connected TX descriptors,
      as we will need it to properly roll back a failed _xmit() call.
      There are subtle differences between cleaning up a successfully sent
      chain (unknown number of involved descriptors, total data size needed)
      and a chain that was about to set up (number of descriptors known), so
      cater for those variations with some extra parameters.
      Signed-off-by: NAndre Przywara <andre.przywara@arm.com>
      Reviewed-by: NRadhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ab365c33
    • A
      net: axienet: Improve DMA error handling · e7fea0b9
      Andre Przywara 提交于
      Since 0 is a valid DMA address, we cannot use the physical address to
      check whether a TX descriptor is valid and is holding a DMA mapping.
      
      Use the "cntrl" member of the descriptor to make this decision, as it
      contains at least the length of the buffer, so 0 points to an
      uninitialised buffer.
      Signed-off-by: NAndre Przywara <andre.przywara@arm.com>
      Reviewed-by: NRadhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e7fea0b9
    • A
      net: axienet: Fix DMA descriptor cleanup path · f26667a3
      Andre Przywara 提交于
      When axienet_dma_bd_init() bails out during the initialisation process,
      it might do so with parts of the structure already allocated and
      initialised, while other parts have not been touched yet. Before
      returning in this case, we call axienet_dma_bd_release(), which does not
      take care of this corner case.
      This is most obvious by the first loop happily dereferencing
      lp->rx_bd_v, which we actually check to be non NULL *afterwards*.
      
      Make sure we only unmap or free already allocated structures, by:
      - directly returning with -ENOMEM if nothing has been allocated at all
      - checking for lp->rx_bd_v to be non-NULL *before* using it
      - only unmapping allocated DMA RX regions
      
      This avoids NULL pointer dereferences when initialisation fails.
      Signed-off-by: NAndre Przywara <andre.przywara@arm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f26667a3
    • A
      net: axienet: Propagate failure of DMA descriptor setup · ee44d0b7
      Andre Przywara 提交于
      When we fail allocating the DMA buffers in axienet_dma_bd_init(), we
      report this error, but carry on with initialisation nevertheless.
      
      This leads to a kernel panic when the driver later wants to send a
      packet, as it uses uninitialised data structures.
      
      Make the axienet_device_reset() routine return an error value, as it
      contains the DMA buffer initialisation. Make sure we propagate the error
      up the chain and eventually fail the driver initialisation, to avoid
      relying on non-initialised buffers.
      Signed-off-by: NAndre Przywara <andre.przywara@arm.com>
      Reviewed-by: NRadhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ee44d0b7
    • A
      net: axienet: Convert DMA error handler to a work queue · 24201a64
      Andre Przywara 提交于
      The DMA error handler routine is currently a tasklet, scheduled to run
      after the DMA error IRQ was handled.
      However it needs to take the MDIO mutex, which is not allowed to do in a
      tasklet. A kernel (with debug options) complains consequently:
      [  614.050361] net eth0: DMA Tx error 0x174019
      [  614.064002] net eth0: Current BD is at: 0x8f84aa0ce
      [  614.080195] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:935
      [  614.109484] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 40, name: kworker/u4:4
      [  614.135428] 3 locks held by kworker/u4:4/40:
      [  614.149075]  #0: ffff000879863328 ((wq_completion)rpciod){....}, at: process_one_work+0x1f0/0x6a8
      [  614.177528]  #1: ffff80001251bdf8 ((work_completion)(&task->u.tk_work)){....}, at: process_one_work+0x1f0/0x6a8
      [  614.209033]  #2: ffff0008784e0110 (sk_lock-AF_INET-RPC){....}, at: tcp_sendmsg+0x24/0x58
      [  614.235429] CPU: 0 PID: 40 Comm: kworker/u4:4 Not tainted 5.6.0-rc3-00926-g4a165a9d5921 #26
      [  614.260854] Hardware name: ARM Test FPGA (DT)
      [  614.274734] Workqueue: rpciod rpc_async_schedule
      [  614.289022] Call trace:
      [  614.296871]  dump_backtrace+0x0/0x1a0
      [  614.308311]  show_stack+0x14/0x20
      [  614.318751]  dump_stack+0xbc/0x100
      [  614.329403]  ___might_sleep+0xf0/0x140
      [  614.341018]  __might_sleep+0x4c/0x80
      [  614.352201]  __mutex_lock+0x5c/0x8a8
      [  614.363348]  mutex_lock_nested+0x1c/0x28
      [  614.375654]  axienet_dma_err_handler+0x38/0x388
      [  614.389999]  tasklet_action_common.isra.15+0x160/0x1a8
      [  614.405894]  tasklet_action+0x24/0x30
      [  614.417297]  efi_header_end+0xe0/0x494
      [  614.429020]  irq_exit+0xd0/0xd8
      [  614.439047]  __handle_domain_irq+0x60/0xb0
      [  614.451877]  gic_handle_irq+0xdc/0x2d0
      [  614.463486]  el1_irq+0xcc/0x180
      [  614.473451]  __tcp_transmit_skb+0x41c/0xb58
      [  614.486513]  tcp_write_xmit+0x224/0x10a0
      [  614.498792]  __tcp_push_pending_frames+0x38/0xc8
      [  614.513126]  tcp_rcv_established+0x41c/0x820
      [  614.526301]  tcp_v4_do_rcv+0x8c/0x218
      [  614.537784]  __release_sock+0x5c/0x108
      [  614.549466]  release_sock+0x34/0xa0
      [  614.560318]  tcp_sendmsg+0x40/0x58
      [  614.571053]  inet_sendmsg+0x40/0x68
      [  614.582061]  sock_sendmsg+0x18/0x30
      [  614.593074]  xs_sendpages+0x218/0x328
      [  614.604506]  xs_tcp_send_request+0xa0/0x1b8
      [  614.617461]  xprt_transmit+0xc8/0x4f0
      [  614.628943]  call_transmit+0x8c/0xa0
      [  614.640028]  __rpc_execute+0xbc/0x6f8
      [  614.651380]  rpc_async_schedule+0x28/0x48
      [  614.663846]  process_one_work+0x298/0x6a8
      [  614.676299]  worker_thread+0x40/0x490
      [  614.687687]  kthread+0x134/0x138
      [  614.697804]  ret_from_fork+0x10/0x18
      [  614.717319] xilinx_axienet 7fe00000.ethernet eth0: Link is Down
      [  615.748343] xilinx_axienet 7fe00000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
      
      Since tasklets are not really popular anymore anyway, lets convert this
      over to a work queue, which can sleep and thus can take the MDIO mutex.
      Signed-off-by: NAndre Przywara <andre.przywara@arm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      24201a64
  2. 18 3月, 2020 1 次提交
  3. 28 2月, 2020 2 次提交
  4. 24 11月, 2019 1 次提交
  5. 07 11月, 2019 1 次提交
  6. 05 11月, 2019 1 次提交
    • A
      net: of_get_phy_mode: Change API to solve int/unit warnings · 0c65b2b9
      Andrew Lunn 提交于
      Before this change of_get_phy_mode() returned an enum,
      phy_interface_t. On error, -ENODEV etc, is returned. If the result of
      the function is stored in a variable of type phy_interface_t, and the
      compiler has decided to represent this as an unsigned int, comparision
      with -ENODEV etc, is a signed vs unsigned comparision.
      
      Fix this problem by changing the API. Make the function return an
      error, or 0 on success, and pass a pointer, of type phy_interface_t,
      where the phy mode should be stored.
      
      v2:
      Return with *interface set to PHY_INTERFACE_MODE_NA on error.
      Add error checks to all users of of_get_phy_mode()
      Fixup a few reverse christmas tree errors
      Fixup a few slightly malformed reverse christmas trees
      
      v3:
      Fix 0-day reported errors.
      Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0c65b2b9
  7. 27 9月, 2019 1 次提交
  8. 09 7月, 2019 1 次提交
    • W
      net: axienet: fix a potential double free in axienet_probe() · ef86ea98
      Wen Yang 提交于
      There is a possible use-after-free issue in the axienet_probe():
      
      1701:	np = of_parse_phandle(pdev->dev.of_node, "axistream-connected", 0);
      1702:   if (np) {
      ...
      1787:		of_node_put(np); ---> released here
      1788:		lp->eth_irq = platform_get_irq(pdev, 0);
      1789:	} else {
      ...
      1801:	}
      1802:	if (IS_ERR(lp->dma_regs)) {
      ...
      1805:		of_node_put(np); ---> double released here
      1806:		goto free_netdev;
      1807:	}
      
      We solve this problem by removing the unnecessary of_node_put().
      
      Fixes: 28ef9ebd ("net: axienet: make use of axistream-connected attribute optional")
      Signed-off-by: NWen Yang <wen.yang99@zte.com.cn>
      Cc: Anirudha Sarangi <anirudh@xilinx.com>
      Cc: John Linn <John.Linn@xilinx.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Michal Simek <michal.simek@xilinx.com>
      Cc: Robert Hancock <hancock@sedsystems.ca>
      Cc: netdev@vger.kernel.org
      Cc: linux-arm-kernel@lists.infradead.org
      Cc: linux-kernel@vger.kernel.org
      Reviewed-by: NRobert Hancock <hancock@sedsystems.ca>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ef86ea98
  9. 14 6月, 2019 1 次提交
  10. 07 6月, 2019 16 次提交
  11. 21 5月, 2019 1 次提交
  12. 08 5月, 2019 1 次提交
  13. 24 3月, 2019 1 次提交
    • W
      net: xilinx: fix possible object reference leak · fa3a419d
      Wen Yang 提交于
      The call to of_parse_phandle returns a node pointer with refcount
      incremented thus it must be explicitly decremented after the last
      usage.
      
      Detected by coccinelle with the following warnings:
      ./drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1624:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1569, but without a corresponding object release within this function.
      Signed-off-by: NWen Yang <wen.yang99@zte.com.cn>
      Cc: Anirudha Sarangi <anirudh@xilinx.com>
      Cc: John Linn <John.Linn@xilinx.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Michal Simek <michal.simek@xilinx.com>
      Cc: netdev@vger.kernel.org
      Cc: linux-arm-kernel@lists.infradead.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fa3a419d
  14. 15 2月, 2019 1 次提交
  15. 08 1月, 2019 1 次提交
  16. 20 9月, 2018 1 次提交
  17. 03 6月, 2018 1 次提交
  18. 17 7月, 2017 1 次提交
  19. 07 3月, 2017 1 次提交
  20. 09 12月, 2016 1 次提交