* [PATCH 4.2.y-ckt 01/59] x86/mm/32: Enable full randomization on i386 and X86_32
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 02/59] USB: usbip: fix potential out-of-bounds write Kamal Mostafa
` (57 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Hector Marco-Gisbert, Linus Torvalds, Peter Zijlstra,
Thomas Gleixner, akpm, kees Cook, Ingo Molnar, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hector Marco-Gisbert <hecmargi@upv.es>
commit 8b8addf891de8a00e4d39fc32f93f7c5eb8feceb upstream.
Currently on i386 and on X86_64 when emulating X86_32 in legacy mode, only
the stack and the executable are randomized but not other mmapped files
(libraries, vDSO, etc.). This patch enables randomization for the
libraries, vDSO and mmap requests on i386 and in X86_32 in legacy mode.
By default on i386 there are 8 bits for the randomization of the libraries,
vDSO and mmaps which only uses 1MB of VA.
This patch preserves the original randomness, using 1MB of VA out of 3GB or
4GB. We think that 1MB out of 3GB is not a big cost for having the ASLR.
The first obvious security benefit is that all objects are randomized (not
only the stack and the executable) in legacy mode which highly increases
the ASLR effectiveness, otherwise the attackers may use these
non-randomized areas. But also sensitive setuid/setgid applications are
more secure because currently, attackers can disable the randomization of
these applications by setting the ulimit stack to "unlimited". This is a
very old and widely known trick to disable the ASLR in i386 which has been
allowed for too long.
Another trick used to disable the ASLR was to set the ADDR_NO_RANDOMIZE
personality flag, but fortunately this doesn't work on setuid/setgid
applications because there is security checks which clear Security-relevant
flags.
This patch always randomizes the mmap_legacy_base address, removing the
possibility to disable the ASLR by setting the stack to "unlimited".
Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
Acked-by: Ismael Ripoll Ripoll <iripoll@upv.es>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Arjan van de Ven <arjan@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: akpm@linux-foundation.org
Cc: kees Cook <keescook@chromium.org>
Link: http://lkml.kernel.org/r/1457639460-5242-1-git-send-email-hecmargi@upv.es
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reference: CVE-2016-3672
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/mm/mmap.c | 14 +-------------
1 file changed, 1 insertion(+), 13 deletions(-)
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 844b06d..307f60e 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -94,18 +94,6 @@ static unsigned long mmap_base(unsigned long rnd)
}
/*
- * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
- * does, but not when emulating X86_32
- */
-static unsigned long mmap_legacy_base(unsigned long rnd)
-{
- if (mmap_is_ia32())
- return TASK_UNMAPPED_BASE;
- else
- return TASK_UNMAPPED_BASE + rnd;
-}
-
-/*
* This function, called very early during the creation of a new
* process VM image, sets up which VM layout function to use:
*/
@@ -116,7 +104,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
if (current->flags & PF_RANDOMIZE)
random_factor = arch_mmap_rnd();
- mm->mmap_legacy_base = mmap_legacy_base(random_factor);
+ mm->mmap_legacy_base = TASK_UNMAPPED_BASE + random_factor;
if (mmap_is_legacy()) {
mm->mmap_base = mm->mmap_legacy_base;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 02/59] USB: usbip: fix potential out-of-bounds write
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 01/59] x86/mm/32: Enable full randomization on i386 and X86_32 Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 03/59] ASoC: rt5640: Correct the digital interface data select Kamal Mostafa
` (56 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ignat Korchagin, Greg Kroah-Hartman, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ignat Korchagin <ignat.korchagin@gmail.com>
commit b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb upstream.
Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.
Signed-off-by: Ignat Korchagin <ignat.korchagin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reference: CVE-2016-3955
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/usb/usbip/usbip_common.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
index facaaf0..e40da77 100644
--- a/drivers/usb/usbip/usbip_common.c
+++ b/drivers/usb/usbip/usbip_common.c
@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
if (!(size > 0))
return 0;
+ if (size > urb->transfer_buffer_length) {
+ /* should not happen, probably malicious packet */
+ if (ud->side == USBIP_STUB) {
+ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
+ return 0;
+ } else {
+ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+ return -EPIPE;
+ }
+ }
+
ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
if (ret != size) {
dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 03/59] ASoC: rt5640: Correct the digital interface data select
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 01/59] x86/mm/32: Enable full randomization on i386 and X86_32 Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 02/59] USB: usbip: fix potential out-of-bounds write Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 04/59] ASoC: dapm: Make sure we have a card when displaying component widgets Kamal Mostafa
` (55 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Sugar Zhang, Mark Brown, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Sugar Zhang <sugar.zhang@rock-chips.com>
commit 653aa4645244042826f105aab1be3d01b3d493ca upstream.
this patch corrects the interface adc/dac control register definition
according to datasheet.
Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
sound/soc/codecs/rt5640.c | 2 +-
sound/soc/codecs/rt5640.h | 36 ++++++++++++++++++------------------
2 files changed, 19 insertions(+), 19 deletions(-)
diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
index ff72cd8..78624e8 100644
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -360,7 +360,7 @@ static unsigned int bst_tlv[] = {
/* Interface data select */
static const char * const rt5640_data_select[] = {
- "Normal", "left copy to right", "right copy to left", "Swap"};
+ "Normal", "Swap", "left copy to right", "right copy to left"};
static SOC_ENUM_SINGLE_DECL(rt5640_if1_dac_enum, RT5640_DIG_INF_DATA,
RT5640_IF1_DAC_SEL_SFT, rt5640_data_select);
diff --git a/sound/soc/codecs/rt5640.h b/sound/soc/codecs/rt5640.h
index 3deb8ba..243f426 100644
--- a/sound/soc/codecs/rt5640.h
+++ b/sound/soc/codecs/rt5640.h
@@ -442,39 +442,39 @@
#define RT5640_IF1_DAC_SEL_MASK (0x3 << 14)
#define RT5640_IF1_DAC_SEL_SFT 14
#define RT5640_IF1_DAC_SEL_NOR (0x0 << 14)
-#define RT5640_IF1_DAC_SEL_L2R (0x1 << 14)
-#define RT5640_IF1_DAC_SEL_R2L (0x2 << 14)
-#define RT5640_IF1_DAC_SEL_SWAP (0x3 << 14)
+#define RT5640_IF1_DAC_SEL_SWAP (0x1 << 14)
+#define RT5640_IF1_DAC_SEL_L2R (0x2 << 14)
+#define RT5640_IF1_DAC_SEL_R2L (0x3 << 14)
#define RT5640_IF1_ADC_SEL_MASK (0x3 << 12)
#define RT5640_IF1_ADC_SEL_SFT 12
#define RT5640_IF1_ADC_SEL_NOR (0x0 << 12)
-#define RT5640_IF1_ADC_SEL_L2R (0x1 << 12)
-#define RT5640_IF1_ADC_SEL_R2L (0x2 << 12)
-#define RT5640_IF1_ADC_SEL_SWAP (0x3 << 12)
+#define RT5640_IF1_ADC_SEL_SWAP (0x1 << 12)
+#define RT5640_IF1_ADC_SEL_L2R (0x2 << 12)
+#define RT5640_IF1_ADC_SEL_R2L (0x3 << 12)
#define RT5640_IF2_DAC_SEL_MASK (0x3 << 10)
#define RT5640_IF2_DAC_SEL_SFT 10
#define RT5640_IF2_DAC_SEL_NOR (0x0 << 10)
-#define RT5640_IF2_DAC_SEL_L2R (0x1 << 10)
-#define RT5640_IF2_DAC_SEL_R2L (0x2 << 10)
-#define RT5640_IF2_DAC_SEL_SWAP (0x3 << 10)
+#define RT5640_IF2_DAC_SEL_SWAP (0x1 << 10)
+#define RT5640_IF2_DAC_SEL_L2R (0x2 << 10)
+#define RT5640_IF2_DAC_SEL_R2L (0x3 << 10)
#define RT5640_IF2_ADC_SEL_MASK (0x3 << 8)
#define RT5640_IF2_ADC_SEL_SFT 8
#define RT5640_IF2_ADC_SEL_NOR (0x0 << 8)
-#define RT5640_IF2_ADC_SEL_L2R (0x1 << 8)
-#define RT5640_IF2_ADC_SEL_R2L (0x2 << 8)
-#define RT5640_IF2_ADC_SEL_SWAP (0x3 << 8)
+#define RT5640_IF2_ADC_SEL_SWAP (0x1 << 8)
+#define RT5640_IF2_ADC_SEL_L2R (0x2 << 8)
+#define RT5640_IF2_ADC_SEL_R2L (0x3 << 8)
#define RT5640_IF3_DAC_SEL_MASK (0x3 << 6)
#define RT5640_IF3_DAC_SEL_SFT 6
#define RT5640_IF3_DAC_SEL_NOR (0x0 << 6)
-#define RT5640_IF3_DAC_SEL_L2R (0x1 << 6)
-#define RT5640_IF3_DAC_SEL_R2L (0x2 << 6)
-#define RT5640_IF3_DAC_SEL_SWAP (0x3 << 6)
+#define RT5640_IF3_DAC_SEL_SWAP (0x1 << 6)
+#define RT5640_IF3_DAC_SEL_L2R (0x2 << 6)
+#define RT5640_IF3_DAC_SEL_R2L (0x3 << 6)
#define RT5640_IF3_ADC_SEL_MASK (0x3 << 4)
#define RT5640_IF3_ADC_SEL_SFT 4
#define RT5640_IF3_ADC_SEL_NOR (0x0 << 4)
-#define RT5640_IF3_ADC_SEL_L2R (0x1 << 4)
-#define RT5640_IF3_ADC_SEL_R2L (0x2 << 4)
-#define RT5640_IF3_ADC_SEL_SWAP (0x3 << 4)
+#define RT5640_IF3_ADC_SEL_SWAP (0x1 << 4)
+#define RT5640_IF3_ADC_SEL_L2R (0x2 << 4)
+#define RT5640_IF3_ADC_SEL_R2L (0x3 << 4)
/* REC Left Mixer Control 1 (0x3b) */
#define RT5640_G_HP_L_RM_L_MASK (0x7 << 13)
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 04/59] ASoC: dapm: Make sure we have a card when displaying component widgets
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (2 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 03/59] ASoC: rt5640: Correct the digital interface data select Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 05/59] ath9k: ar5008_hw_cmn_spur_mitigate: add missing mask_m & mask_p initialisation Kamal Mostafa
` (54 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Mark Brown, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mark Brown <broonie@kernel.org>
commit 47325078f2a3e543150e7df967e45756b2fff7ec upstream.
The dummy component is reused for all cards so we special case and don't
bind it to any of them. This means that code like that displaying the
component widgets that tries to look at the card will crash. In the
future we will fix this by ensuring that the dummy component looks like
other components but that is invasive and so not suitable for a fix.
Instead add a special case check here.
Reported-by: Harry Pan <harry.pan@intel.com>
Suggested-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
[ kamal: backport to 4.2-stable ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
sound/soc/soc-dapm.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 0859a3f..dfd4405 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2229,6 +2229,13 @@ static ssize_t dapm_widget_show_codec(struct snd_soc_codec *codec, char *buf)
int count = 0;
char *state = "not set";
+ /* card won't be set for the dummy component, as a spot fix
+ * we're checking for that case specifically here but in future
+ * we will ensure that the dummy component looks like others.
+ */
+ if (!codec->component.card)
+ return 0;
+
list_for_each_entry(w, &codec->component.card->widgets, list) {
if (w->dapm != &codec->dapm)
continue;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 05/59] ath9k: ar5008_hw_cmn_spur_mitigate: add missing mask_m & mask_p initialisation
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (3 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 04/59] ASoC: dapm: Make sure we have a card when displaying component widgets Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 06/59] iio: ak8975: Fix NULL pointer exception on early interrupt Kamal Mostafa
` (53 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Oleksij Rempel, Kalle Valo, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Oleksij Rempel <linux@rempel-privat.de>
commit de478a61389cacafe94dc8b035081b681b878f9d upstream.
by moving common code to ar5008_hw_cmn_spur_mitigate i forgot to move
mask_m & mask_p initialisation. This coused a performance regression
on ar9281.
Fixes: f911085ffa88 ("ath9k: split ar5008_hw_spur_mitigate and reuse common code in ar9002_hw_spur_mitigate.")
Reported-by: Gustav Frederiksen <lkml2017@openmailbox.org>
Tested-by: Gustav Frederiksen <lkml2017@openmailbox.org>
Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/wireless/ath/ath9k/ar5008_phy.c | 8 +++-----
drivers/net/wireless/ath/ath9k/ar9002_phy.c | 5 -----
2 files changed, 3 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 8f87930..1b271b9 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -274,6 +274,9 @@ void ar5008_hw_cmn_spur_mitigate(struct ath_hw *ah,
};
static const int inc[4] = { 0, 100, 0, 0 };
+ memset(&mask_m, 0, sizeof(int8_t) * 123);
+ memset(&mask_p, 0, sizeof(int8_t) * 123);
+
cur_bin = -6000;
upper = bin + 100;
lower = bin - 100;
@@ -424,14 +427,9 @@ static void ar5008_hw_spur_mitigate(struct ath_hw *ah,
int tmp, new;
int i;
- int8_t mask_m[123];
- int8_t mask_p[123];
int cur_bb_spur;
bool is2GHz = IS_CHAN_2GHZ(chan);
- memset(&mask_m, 0, sizeof(int8_t) * 123);
- memset(&mask_p, 0, sizeof(int8_t) * 123);
-
for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
if (AR_NO_SPUR == cur_bb_spur)
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index db66245..53d7445 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -178,14 +178,9 @@ static void ar9002_hw_spur_mitigate(struct ath_hw *ah,
int i;
struct chan_centers centers;
- int8_t mask_m[123];
- int8_t mask_p[123];
int cur_bb_spur;
bool is2GHz = IS_CHAN_2GHZ(chan);
- memset(&mask_m, 0, sizeof(int8_t) * 123);
- memset(&mask_p, 0, sizeof(int8_t) * 123);
-
ath9k_hw_get_channel_centers(ah, chan, ¢ers);
freq = centers.synth_center;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 06/59] iio: ak8975: Fix NULL pointer exception on early interrupt
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (4 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 05/59] ath9k: ar5008_hw_cmn_spur_mitigate: add missing mask_m & mask_p initialisation Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 07/59] iio: ak8975: fix maybe-uninitialized warning Kamal Mostafa
` (52 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Krzysztof Kozlowski, Jonathan Cameron, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit 07d2390e36ee5b3265e9cc8305f2a106c8721e16 upstream.
In certain probe conditions the interrupt came right after registering
the handler causing a NULL pointer exception because of uninitialized
waitqueue:
$ udevadm trigger
i2c-gpio i2c-gpio-1: using pins 143 (SDA) and 144 (SCL)
i2c-gpio i2c-gpio-3: using pins 53 (SDA) and 52 (SCL)
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = e8b38000
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] SMP ARM
Modules linked in: snd_soc_i2s(+) i2c_gpio(+) snd_soc_idma snd_soc_s3c_dma snd_soc_core snd_pcm_dmaengine snd_pcm snd_timer snd soundcore ac97_bus spi_s3c64xx pwm_samsung dwc2 exynos_adc phy_exynos_usb2 exynosdrm exynos_rng rng_core rtc_s3c
CPU: 0 PID: 717 Comm: data-provider-m Not tainted 4.6.0-rc1-next-20160401-00011-g1b8d87473b9e-dirty #101
Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
(...)
(__wake_up_common) from [<c0379624>] (__wake_up+0x38/0x4c)
(__wake_up) from [<c0a41d30>] (ak8975_irq_handler+0x28/0x30)
(ak8975_irq_handler) from [<c0386720>] (handle_irq_event_percpu+0x88/0x140)
(handle_irq_event_percpu) from [<c038681c>] (handle_irq_event+0x44/0x68)
(handle_irq_event) from [<c0389c40>] (handle_edge_irq+0xf0/0x19c)
(handle_edge_irq) from [<c0385e04>] (generic_handle_irq+0x24/0x34)
(generic_handle_irq) from [<c05ee360>] (exynos_eint_gpio_irq+0x50/0x68)
(exynos_eint_gpio_irq) from [<c0386720>] (handle_irq_event_percpu+0x88/0x140)
(handle_irq_event_percpu) from [<c038681c>] (handle_irq_event+0x44/0x68)
(handle_irq_event) from [<c0389a70>] (handle_fasteoi_irq+0xb4/0x194)
(handle_fasteoi_irq) from [<c0385e04>] (generic_handle_irq+0x24/0x34)
(generic_handle_irq) from [<c03860b4>] (__handle_domain_irq+0x5c/0xb4)
(__handle_domain_irq) from [<c0301774>] (gic_handle_irq+0x54/0x94)
(gic_handle_irq) from [<c030c910>] (__irq_usr+0x50/0x80)
The bug was reproduced on exynos4412-trats2 (with a max77693 device also
using i2c-gpio) after building max77693 as a module.
Fixes: 94a6d5cf7caa ("iio:ak8975 Implement data ready interrupt handling")
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Tested-by: Gregor Boirie <gregor.boirie@parrot.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/iio/magnetometer/ak8975.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
index b13936d..fd780bb 100644
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -462,6 +462,8 @@ static int ak8975_setup_irq(struct ak8975_data *data)
int rc;
int irq;
+ init_waitqueue_head(&data->data_ready_queue);
+ clear_bit(0, &data->flags);
if (client->irq)
irq = client->irq;
else
@@ -477,8 +479,6 @@ static int ak8975_setup_irq(struct ak8975_data *data)
return rc;
}
- init_waitqueue_head(&data->data_ready_queue);
- clear_bit(0, &data->flags);
data->eoc_irq = irq;
return rc;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 07/59] iio: ak8975: fix maybe-uninitialized warning
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (5 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 06/59] iio: ak8975: Fix NULL pointer exception on early interrupt Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 08/59] i2c: cpm: Fix build break due to incompatible pointer types Kamal Mostafa
` (51 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Richard Leitner, Jonathan Cameron, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Richard Leitner <dev@g0hl1n.net>
commit 05be8d4101d960bad271d32b4f6096af1ccb1534 upstream.
If i2c_device_id *id is NULL and acpi_match_device returns NULL too,
then chipset may be unitialized when accessing &ak_def_array[chipset] in
ak8975_probe. Therefore initialize chipset to AK_MAX_TYPE, which will
return an error when not changed.
This patch fixes the following maybe-uninitialized warning:
drivers/iio/magnetometer/ak8975.c: In function ‘ak8975_probe’:
drivers/iio/magnetometer/ak8975.c:788:14: warning: ‘chipset’ may be used
uninitialized in this function [-Wmaybe-uninitialized]
data->def = &ak_def_array[chipset];
Signed-off-by: Richard Leitner <dev@g0hl1n.net>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/iio/magnetometer/ak8975.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
index fd780bb..f2a7f72 100644
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -732,7 +732,7 @@ static int ak8975_probe(struct i2c_client *client,
int eoc_gpio;
int err;
const char *name = NULL;
- enum asahi_compass_chipset chipset;
+ enum asahi_compass_chipset chipset = AK_MAX_TYPE;
/* Grab and set up the supplied GPIO. */
if (client->dev.platform_data)
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 08/59] i2c: cpm: Fix build break due to incompatible pointer types
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (6 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 07/59] iio: ak8975: fix maybe-uninitialized warning Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 09/59] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared Kamal Mostafa
` (50 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Michael Ellerman, Wolfram Sang, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Michael Ellerman <mpe@ellerman.id.au>
commit 609d5a1b2b35bb62b4b3750396e55453160c2a17 upstream.
Since commit ea8daa7b9784 ("kbuild: Add option to turn incompatible
pointer check into error"), assignments from an incompatible pointer
types have become a hard error, eg:
drivers/i2c/busses/i2c-cpm.c:545:91: error: passing argument 3 of
'dma_alloc_coherent' from incompatible pointer type
Fix the build break by converting txdma & rxdma to dma_addr_t.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Fixes: ea8daa7b9784
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/i2c/busses/i2c-cpm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index 714bdc8..b167ab2 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -116,8 +116,8 @@ struct cpm_i2c {
cbd_t __iomem *rbase;
u_char *txbuf[CPM_MAXBD];
u_char *rxbuf[CPM_MAXBD];
- u32 txdma[CPM_MAXBD];
- u32 rxdma[CPM_MAXBD];
+ dma_addr_t txdma[CPM_MAXBD];
+ dma_addr_t rxdma[CPM_MAXBD];
};
static irqreturn_t cpm_i2c_interrupt(int irq, void *dev_id)
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 09/59] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (7 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 08/59] i2c: cpm: Fix build break due to incompatible pointer types Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 10/59] efi: Fix out-of-bounds read in variable_matches() Kamal Mostafa
` (49 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Javier Martinez Canillas, Wolfram Sang, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Javier Martinez Canillas <javier@osg.samsung.com>
commit 10ff4c5239a137abfc896ec73ef3d15a0f86a16a upstream.
The exynos5 I2C controller driver always prepares and enables a clock
before using it and then disables unprepares it when the clock is not
used anymore.
But this can cause a possible ABBA deadlock in some scenarios since a
driver that uses regmap to access its I2C registers, will first grab
the regmap lock and then the I2C xfer function will grab the prepare
lock when preparing the I2C clock. But since the clock driver also
uses regmap for I2C accesses, preparing a clock will first grab the
prepare lock and then the regmap lock when using the regmap API.
An example of this happens on the Exynos5422 Odroid XU4 board where a
s2mps11 PMIC is used and both the s2mps11 regulators and clk drivers
share the same I2C regmap.
The possible deadlock is reported by the kernel lockdep:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(sec_core:428:(regmap)->lock);
lock(prepare_lock);
lock(sec_core:428:(regmap)->lock);
lock(prepare_lock);
*** DEADLOCK ***
Fix it by leaving the code prepared on probe and use {en,dis}able in
the I2C transfer function.
This patch is similar to commit 34e81ad5f0b6 ("i2c: s3c2410: fix ABBA
deadlock by keeping clock prepared") that fixes the same bug in other
driver for an I2C controller found in Samsung SoCs.
Reported-by: Anand Moon <linux.amoon@gmail.com>
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Reviewed-by: Anand Moon <linux.amoon@gmail.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/i2c/busses/i2c-exynos5.c | 24 +++++++++++++++++++-----
1 file changed, 19 insertions(+), 5 deletions(-)
diff --git a/drivers/i2c/busses/i2c-exynos5.c b/drivers/i2c/busses/i2c-exynos5.c
index b29c750..f54ece8 100644
--- a/drivers/i2c/busses/i2c-exynos5.c
+++ b/drivers/i2c/busses/i2c-exynos5.c
@@ -671,7 +671,9 @@ static int exynos5_i2c_xfer(struct i2c_adapter *adap,
return -EIO;
}
- clk_prepare_enable(i2c->clk);
+ ret = clk_enable(i2c->clk);
+ if (ret)
+ return ret;
for (i = 0; i < num; i++, msgs++) {
stop = (i == num - 1);
@@ -695,7 +697,7 @@ static int exynos5_i2c_xfer(struct i2c_adapter *adap,
}
out:
- clk_disable_unprepare(i2c->clk);
+ clk_disable(i2c->clk);
return ret;
}
@@ -747,7 +749,9 @@ static int exynos5_i2c_probe(struct platform_device *pdev)
return -ENOENT;
}
- clk_prepare_enable(i2c->clk);
+ ret = clk_prepare_enable(i2c->clk);
+ if (ret)
+ return ret;
mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
i2c->regs = devm_ioremap_resource(&pdev->dev, mem);
@@ -799,6 +803,10 @@ static int exynos5_i2c_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, i2c);
+ clk_disable(i2c->clk);
+
+ return 0;
+
err_clk:
clk_disable_unprepare(i2c->clk);
return ret;
@@ -810,6 +818,8 @@ static int exynos5_i2c_remove(struct platform_device *pdev)
i2c_del_adapter(&i2c->adap);
+ clk_unprepare(i2c->clk);
+
return 0;
}
@@ -821,6 +831,8 @@ static int exynos5_i2c_suspend_noirq(struct device *dev)
i2c->suspended = 1;
+ clk_unprepare(i2c->clk);
+
return 0;
}
@@ -830,7 +842,9 @@ static int exynos5_i2c_resume_noirq(struct device *dev)
struct exynos5_i2c *i2c = platform_get_drvdata(pdev);
int ret = 0;
- clk_prepare_enable(i2c->clk);
+ ret = clk_prepare_enable(i2c->clk);
+ if (ret)
+ return ret;
ret = exynos5_hsi2c_clock_setup(i2c);
if (ret) {
@@ -839,7 +853,7 @@ static int exynos5_i2c_resume_noirq(struct device *dev)
}
exynos5_i2c_init(i2c);
- clk_disable_unprepare(i2c->clk);
+ clk_disable(i2c->clk);
i2c->suspended = 0;
return 0;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 10/59] efi: Fix out-of-bounds read in variable_matches()
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (8 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 09/59] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 11/59] USB: serial: cp210x: add ID for Link ECU Kamal Mostafa
` (48 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Laszlo Ersek, Peter Jones, Matthew Garrett, Jason Andryuk,
Jani Nikula, Matt Fleming, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Laszlo Ersek <lersek@redhat.com>
commit 630ba0cc7a6dbafbdee43795617c872b35cde1b4 upstream.
The variable_matches() function can currently read "var_name[len]", for
example when:
- var_name[0] == 'a',
- len == 1
- match_name points to the NUL-terminated string "ab".
This function is supposed to accept "var_name" inputs that are not
NUL-terminated (hence the "len" parameter"). Document the function, and
access "var_name[*match]" only if "*match" is smaller than "len".
Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Cc: Peter Jones <pjones@redhat.com>
Cc: Matthew Garrett <mjg59@coreos.com>
Cc: Jason Andryuk <jandryuk@gmail.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Link: http://thread.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/86906
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/firmware/efi/vars.c | 37 ++++++++++++++++++++++++++-----------
1 file changed, 26 insertions(+), 11 deletions(-)
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 7f2ea21..6f182fd 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = {
{ NULL_GUID, "", NULL },
};
+/*
+ * Check if @var_name matches the pattern given in @match_name.
+ *
+ * @var_name: an array of @len non-NUL characters.
+ * @match_name: a NUL-terminated pattern string, optionally ending in "*". A
+ * final "*" character matches any trailing characters @var_name,
+ * including the case when there are none left in @var_name.
+ * @match: on output, the number of non-wildcard characters in @match_name
+ * that @var_name matches, regardless of the return value.
+ * @return: whether @var_name fully matches @match_name.
+ */
static bool
variable_matches(const char *var_name, size_t len, const char *match_name,
int *match)
{
for (*match = 0; ; (*match)++) {
char c = match_name[*match];
- char u = var_name[*match];
- /* Wildcard in the matching name means we've matched */
- if (c == '*')
+ switch (c) {
+ case '*':
+ /* Wildcard in @match_name means we've matched. */
return true;
- /* Case sensitive match */
- if (!c && *match == len)
- return true;
+ case '\0':
+ /* @match_name has ended. Has @var_name too? */
+ return (*match == len);
- if (c != u)
+ default:
+ /*
+ * We've reached a non-wildcard char in @match_name.
+ * Continue only if there's an identical character in
+ * @var_name.
+ */
+ if (*match < len && c == var_name[*match])
+ continue;
return false;
-
- if (!c)
- return true;
+ }
}
- return true;
}
bool
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 11/59] USB: serial: cp210x: add ID for Link ECU
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (9 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 10/59] efi: Fix out-of-bounds read in variable_matches() Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 12/59] USB: serial: cp210x: add Straizona Focusers device ids Kamal Mostafa
` (47 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mike Manning, Johan Hovold, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mike Manning <michael@bsch.com.au>
commit 1d377f4d690637a0121eac8701f84a0aa1e69a69 upstream.
The Link ECU is an aftermarket ECU computer for vehicles that provides
full tuning abilities as well as datalogging and displaying capabilities
via the USB to Serial adapter built into the device.
Signed-off-by: Mike Manning <michael@bsch.com.au>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/usb/serial/cp210x.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index bdc0f2f..7f45d00 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -140,6 +140,8 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */
{ USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */
{ USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */
+ { USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */
+ { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */
{ USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
{ USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */
{ USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 12/59] USB: serial: cp210x: add Straizona Focusers device ids
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (10 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 11/59] USB: serial: cp210x: add ID for Link ECU Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 13/59] [media] v4l2-dv-timings.h: fix polarity for 4k formats Kamal Mostafa
` (46 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jasem Mutlaq, Johan Hovold, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jasem Mutlaq <mutlaqja@ikarustech.com>
commit 613ac23a46e10d4d4339febdd534fafadd68e059 upstream.
Adding VID:PID for Straizona Focusers to cp210x driver.
Signed-off-by: Jasem Mutlaq <mutlaqja@ikarustech.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/usb/serial/cp210x.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 7f45d00..a2b43a6 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -108,6 +108,7 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
{ USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
{ USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
+ { USB_DEVICE(0x10C4, 0x82F4) }, /* Starizona MicroTouch */
{ USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
{ USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
{ USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
@@ -117,6 +118,7 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
{ USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
+ { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */
{ USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
{ USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */
{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 13/59] [media] v4l2-dv-timings.h: fix polarity for 4k formats
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (11 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 12/59] USB: serial: cp210x: add Straizona Focusers device ids Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 14/59] ALSA: hda - Add dock support for ThinkPad X260 Kamal Mostafa
` (45 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Hans Verkuil, Mauro Carvalho Chehab, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hans Verkuil <hverkuil@xs4all.nl>
commit 3020ca711871fdaf0c15c8bab677a6bc302e28fe upstream.
The VSync polarity was negative instead of positive for the 4k CEA formats.
I probably copy-and-pasted these from the DMT 4k format, which does have a
negative VSync polarity.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Martin Bugge <marbugge@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/uapi/linux/v4l2-dv-timings.h | 30 ++++++++++++++++++++----------
1 file changed, 20 insertions(+), 10 deletions(-)
diff --git a/include/uapi/linux/v4l2-dv-timings.h b/include/uapi/linux/v4l2-dv-timings.h
index c039f1d..086168e 100644
--- a/include/uapi/linux/v4l2-dv-timings.h
+++ b/include/uapi/linux/v4l2-dv-timings.h
@@ -183,7 +183,8 @@
#define V4L2_DV_BT_CEA_3840X2160P24 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
297000000, 1276, 88, 296, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, \
V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -191,14 +192,16 @@
#define V4L2_DV_BT_CEA_3840X2160P25 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
297000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
}
#define V4L2_DV_BT_CEA_3840X2160P30 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
297000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, \
V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -206,14 +209,16 @@
#define V4L2_DV_BT_CEA_3840X2160P50 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
594000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
}
#define V4L2_DV_BT_CEA_3840X2160P60 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
594000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, \
V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -221,7 +226,8 @@
#define V4L2_DV_BT_CEA_4096X2160P24 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
297000000, 1020, 88, 296, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, \
V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -229,14 +235,16 @@
#define V4L2_DV_BT_CEA_4096X2160P25 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
297000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
}
#define V4L2_DV_BT_CEA_4096X2160P30 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
297000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, \
V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -244,14 +252,16 @@
#define V4L2_DV_BT_CEA_4096X2160P50 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
594000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
}
#define V4L2_DV_BT_CEA_4096X2160P60 { \
.type = V4L2_DV_BT_656_1120, \
- V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
+ V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
+ V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
594000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \
V4L2_DV_BT_STD_CEA861, \
V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 14/59] ALSA: hda - Add dock support for ThinkPad X260
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (12 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 13/59] [media] v4l2-dv-timings.h: fix polarity for 4k formats Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 15/59] workqueue: fix ghost PENDING flag while doing MQ IO Kamal Mostafa
` (44 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Conrad Kostecki, Takashi Iwai, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Conrad Kostecki <ck+linuxkernel@bl4ckb0x.de>
commit 037e119738120c1cdc460c6ae33871c3000531f3 upstream.
Fixes audio output on a ThinkPad X260, when using Lenovo CES 2013
docking station series (basic, pro, ultra).
Signed-off-by: Conrad Kostecki <ck+linuxkernel@bl4ckb0x.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index da8f2ac..e83f613 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5533,6 +5533,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 15/59] workqueue: fix ghost PENDING flag while doing MQ IO
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (13 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 14/59] ALSA: hda - Add dock support for ThinkPad X260 Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 16/59] drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() Kamal Mostafa
` (43 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Roman Pen, Gioh Kim, Michael Wang, Tejun Heo, Jens Axboe,
linux-block, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Roman Pen <roman.penyaev@profitbricks.com>
commit 346c09f80459a3ad97df1816d6d606169a51001a upstream.
The bug in a workqueue leads to a stalled IO request in MQ ctx->rq_list
with the following backtrace:
[ 601.347452] INFO: task kworker/u129:5:1636 blocked for more than 120 seconds.
[ 601.347574] Tainted: G O 4.4.5-1-storage+ #6
[ 601.347651] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 601.348142] kworker/u129:5 D ffff880803077988 0 1636 2 0x00000000
[ 601.348519] Workqueue: ibnbd_server_fileio_wq ibnbd_dev_file_submit_io_worker [ibnbd_server]
[ 601.348999] ffff880803077988 ffff88080466b900 ffff8808033f9c80 ffff880803078000
[ 601.349662] ffff880807c95000 7fffffffffffffff ffffffff815b0920 ffff880803077ad0
[ 601.350333] ffff8808030779a0 ffffffff815b01d5 0000000000000000 ffff880803077a38
[ 601.350965] Call Trace:
[ 601.351203] [<ffffffff815b0920>] ? bit_wait+0x60/0x60
[ 601.351444] [<ffffffff815b01d5>] schedule+0x35/0x80
[ 601.351709] [<ffffffff815b2dd2>] schedule_timeout+0x192/0x230
[ 601.351958] [<ffffffff812d43f7>] ? blk_flush_plug_list+0xc7/0x220
[ 601.352208] [<ffffffff810bd737>] ? ktime_get+0x37/0xa0
[ 601.352446] [<ffffffff815b0920>] ? bit_wait+0x60/0x60
[ 601.352688] [<ffffffff815af784>] io_schedule_timeout+0xa4/0x110
[ 601.352951] [<ffffffff815b3a4e>] ? _raw_spin_unlock_irqrestore+0xe/0x10
[ 601.353196] [<ffffffff815b093b>] bit_wait_io+0x1b/0x70
[ 601.353440] [<ffffffff815b056d>] __wait_on_bit+0x5d/0x90
[ 601.353689] [<ffffffff81127bd0>] wait_on_page_bit+0xc0/0xd0
[ 601.353958] [<ffffffff81096db0>] ? autoremove_wake_function+0x40/0x40
[ 601.354200] [<ffffffff81127cc4>] __filemap_fdatawait_range+0xe4/0x140
[ 601.354441] [<ffffffff81127d34>] filemap_fdatawait_range+0x14/0x30
[ 601.354688] [<ffffffff81129a9f>] filemap_write_and_wait_range+0x3f/0x70
[ 601.354932] [<ffffffff811ced3b>] blkdev_fsync+0x1b/0x50
[ 601.355193] [<ffffffff811c82d9>] vfs_fsync_range+0x49/0xa0
[ 601.355432] [<ffffffff811cf45a>] blkdev_write_iter+0xca/0x100
[ 601.355679] [<ffffffff81197b1a>] __vfs_write+0xaa/0xe0
[ 601.355925] [<ffffffff81198379>] vfs_write+0xa9/0x1a0
[ 601.356164] [<ffffffff811c59d8>] kernel_write+0x38/0x50
The underlying device is a null_blk, with default parameters:
queue_mode = MQ
submit_queues = 1
Verification that nullb0 has something inflight:
root@pserver8:~# cat /sys/block/nullb0/inflight
0 1
root@pserver8:~# find /sys/block/nullb0/mq/0/cpu* -name rq_list -print -exec cat {} \;
...
/sys/block/nullb0/mq/0/cpu2/rq_list
CTX pending:
ffff8838038e2400
...
During debug it became clear that stalled request is always inserted in
the rq_list from the following path:
save_stack_trace_tsk + 34
blk_mq_insert_requests + 231
blk_mq_flush_plug_list + 281
blk_flush_plug_list + 199
wait_on_page_bit + 192
__filemap_fdatawait_range + 228
filemap_fdatawait_range + 20
filemap_write_and_wait_range + 63
blkdev_fsync + 27
vfs_fsync_range + 73
blkdev_write_iter + 202
__vfs_write + 170
vfs_write + 169
kernel_write + 56
So blk_flush_plug_list() was called with from_schedule == true.
If from_schedule is true, that means that finally blk_mq_insert_requests()
offloads execution of __blk_mq_run_hw_queue() and uses kblockd workqueue,
i.e. it calls kblockd_schedule_delayed_work_on().
That means, that we race with another CPU, which is about to execute
__blk_mq_run_hw_queue() work.
Further debugging shows the following traces from different CPUs:
CPU#0 CPU#1
---------------------------------- -------------------------------
reqeust A inserted
STORE hctx->ctx_map[0] bit marked
kblockd_schedule...() returns 1
<schedule to kblockd workqueue>
request B inserted
STORE hctx->ctx_map[1] bit marked
kblockd_schedule...() returns 0
*** WORK PENDING bit is cleared ***
flush_busy_ctxs() is executed, but
bit 1, set by CPU#1, is not observed
As a result request B pended forever.
This behaviour can be explained by speculative LOAD of hctx->ctx_map on
CPU#0, which is reordered with clear of PENDING bit and executed _before_
actual STORE of bit 1 on CPU#1.
The proper fix is an explicit full barrier <mfence>, which guarantees
that clear of PENDING bit is to be executed before all possible
speculative LOADS or STORES inside actual work function.
Signed-off-by: Roman Pen <roman.penyaev@profitbricks.com>
Cc: Gioh Kim <gi-oh.kim@profitbricks.com>
Cc: Michael Wang <yun.wang@profitbricks.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: linux-block@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
kernel/workqueue.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index c743abf..a2a7ac1 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -649,6 +649,35 @@ static void set_work_pool_and_clear_pending(struct work_struct *work,
*/
smp_wmb();
set_work_data(work, (unsigned long)pool_id << WORK_OFFQ_POOL_SHIFT, 0);
+ /*
+ * The following mb guarantees that previous clear of a PENDING bit
+ * will not be reordered with any speculative LOADS or STORES from
+ * work->current_func, which is executed afterwards. This possible
+ * reordering can lead to a missed execution on attempt to qeueue
+ * the same @work. E.g. consider this case:
+ *
+ * CPU#0 CPU#1
+ * ---------------------------- --------------------------------
+ *
+ * 1 STORE event_indicated
+ * 2 queue_work_on() {
+ * 3 test_and_set_bit(PENDING)
+ * 4 } set_..._and_clear_pending() {
+ * 5 set_work_data() # clear bit
+ * 6 smp_mb()
+ * 7 work->current_func() {
+ * 8 LOAD event_indicated
+ * }
+ *
+ * Without an explicit full barrier speculative LOAD on line 8 can
+ * be executed before CPU#0 does STORE on line 1. If that happens,
+ * CPU#0 observes the PENDING bit is still set and new execution of
+ * a @work is not queued in a hope, that CPU#1 will eventually
+ * finish the queued @work. Meanwhile CPU#1 does not see
+ * event_indicated is set, because speculative LOAD was executed
+ * before actual STORE.
+ */
+ smp_mb();
}
static void clear_work_data(struct work_struct *work)
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 16/59] drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (14 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 15/59] workqueue: fix ghost PENDING flag while doing MQ IO Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 17/59] drm/virtio: send vblank event after crtc updates Kamal Mostafa
` (42 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Lyude, Dave Airlie, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "cpaul@redhat.com" <cpaul@redhat.com>
commit 263efde31f97c498e1ebad30e4d2906609d7ad6b upstream.
We can thank KASAN for finding this, otherwise I probably would have spent
hours on it. This fixes a somewhat harder to trigger kernel panic, occuring
while enabling MST where the port we were currently updating the payload on
would have all of it's refs dropped before we finished what we were doing:
==================================================================
BUG: KASAN: use-after-free in drm_dp_update_payload_part1+0xb3f/0xdb0 [drm_kms_helper] at addr ffff8800d29de018
Read of size 4 by task Xorg/973
=============================================================================
BUG kmalloc-2048 (Tainted: G B W ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] age=16477 cpu=0 pid=2175
___slab_alloc+0x472/0x490
__slab_alloc+0x20/0x40
kmem_cache_alloc_trace+0x151/0x190
drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper]
drm_dp_send_link_address+0x526/0x960 [drm_kms_helper]
drm_dp_check_and_send_link_address+0x1ac/0x210 [drm_kms_helper]
drm_dp_mst_link_probe_work+0x77/0xd0 [drm_kms_helper]
process_one_work+0x562/0x1350
worker_thread+0xd9/0x1390
kthread+0x1c5/0x260
ret_from_fork+0x22/0x40
INFO: Freed in drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] age=7521 cpu=0 pid=2175
__slab_free+0x17f/0x2d0
kfree+0x169/0x180
drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper]
drm_dp_destroy_connector_work+0x2b8/0x490 [drm_kms_helper]
process_one_work+0x562/0x1350
worker_thread+0xd9/0x1390
kthread+0x1c5/0x260
ret_from_fork+0x22/0x40
which on this T460s, would eventually lead to kernel panics in somewhat
random places later in intel_mst_enable_dp() if we got lucky enough.
Signed-off-by: Lyude <cpaul@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index e001149..246aafa 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1779,6 +1779,11 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
req_payload.start_slot = cur_slots;
if (mgr->proposed_vcpis[i]) {
port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi);
+ port = drm_dp_get_validated_port_ref(mgr, port);
+ if (!port) {
+ mutex_unlock(&mgr->payload_lock);
+ return -EINVAL;
+ }
req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots;
} else {
port = NULL;
@@ -1804,6 +1809,9 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
mgr->payloads[i].payload_state = req_payload.payload_state;
}
cur_slots += req_payload.num_slots;
+
+ if (port)
+ drm_dp_put_port(port);
}
for (i = 0; i < mgr->max_payloads; i++) {
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 17/59] drm/virtio: send vblank event after crtc updates
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (15 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 16/59] drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 18/59] cxl: Keep IRQ mappings on context teardown Kamal Mostafa
` (41 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Gustavo Padovan, Dave Airlie, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
commit 9a11d2e7e66b6b8764a2430686b8716637bf812e upstream.
virtio_gpu was failing to send vblank events when using the atomic IOCTL
with the DRM_MODE_PAGE_FLIP_EVENT flag set. This patch fixes each and
enables atomic pageflips updates.
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
[ kamal: backport to 4.2-stable: older crtc api ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/virtio/virtgpu_display.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c
index 54b70f1..7f9e96d 100644
--- a/drivers/gpu/drm/virtio/virtgpu_display.c
+++ b/drivers/gpu/drm/virtio/virtgpu_display.c
@@ -223,12 +223,23 @@ static int virtio_gpu_crtc_atomic_check(struct drm_crtc *crtc,
return 0;
}
+static void virtio_gpu_crtc_atomic_flush(struct drm_crtc *crtc)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&crtc->dev->event_lock, flags);
+ if (crtc->state->event)
+ drm_crtc_send_vblank_event(crtc, crtc->state->event);
+ spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+}
+
static const struct drm_crtc_helper_funcs virtio_gpu_crtc_helper_funcs = {
.enable = virtio_gpu_crtc_enable,
.disable = virtio_gpu_crtc_disable,
.mode_fixup = virtio_gpu_crtc_mode_fixup,
.mode_set_nofb = virtio_gpu_crtc_mode_set_nofb,
.atomic_check = virtio_gpu_crtc_atomic_check,
+ .atomic_flush = virtio_gpu_crtc_atomic_flush,
};
static bool virtio_gpu_enc_mode_fixup(struct drm_encoder *encoder,
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 18/59] cxl: Keep IRQ mappings on context teardown
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (16 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 17/59] drm/virtio: send vblank event after crtc updates Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 19/59] drm/i915: Fix system resume if PCI device remained enabled Kamal Mostafa
` (40 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Michael Neuling, Michael Ellerman, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Michael Neuling <mikey@neuling.org>
commit d6776bba44d9752f6cdf640046070e71ee4bba7b upstream.
Keep IRQ mappings on context teardown. This won't leak IRQs as if we
allocate the mapping again, the generic code will give the same
mapping used last time.
Doing this works around a race in the generic code. Masking the
interrupt introduces a race which can crash the kernel or result in
IRQ that is never EOIed. The lost of EOI results in all subsequent
mappings to the same HW IRQ never receiving an interrupt.
We've seen this race with cxl test cases which are doing heavy context
startup and teardown at the same time as heavy interrupt load.
A fix to the generic code is being investigated also.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Tested-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Ian Munsie <imunsie@au1.ibm.com>
Tested-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/misc/cxl/irq.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c
index 680cd26..8a6b710 100644
--- a/drivers/misc/cxl/irq.c
+++ b/drivers/misc/cxl/irq.c
@@ -288,7 +288,6 @@ unsigned int cxl_map_irq(struct cxl *adapter, irq_hw_number_t hwirq,
void cxl_unmap_irq(unsigned int virq, void *cookie)
{
free_irq(virq, cookie);
- irq_dispose_mapping(virq);
}
static int cxl_register_one_irq(struct cxl *adapter,
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 19/59] drm/i915: Fix system resume if PCI device remained enabled
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (17 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 18/59] cxl: Keep IRQ mappings on context teardown Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 20/59] drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume Kamal Mostafa
` (39 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ville Syrjälä,
Chris Wilson, Imre Deak, Jani Nikula, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Imre Deak <imre.deak@intel.com>
commit dab9a2663f4e688106c041f7cd2797a721382f0a upstream.
During system resume we depended on pci_enable_device() also putting the
device into PCI D0 state. This won't work if the PCI device was already
enabled but still in D3 state. This is because pci_enable_device() is
refcounted and will not change the HW state if called with a non-zero
refcount. Leaving the device in D3 will make all subsequent device
accesses fail.
This didn't cause a problem most of the time, since we resumed with an
enable refcount of 0. But it fails at least after module reload because
after that we also happen to leak a PCI device enable reference: During
probing we call drm_get_pci_dev() which will enable the PCI device, but
during device removal drm_put_dev() won't disable it. This is a bug of
its own in DRM core, but without much harm as it only leaves the PCI
device enabled. Fixing it is also a bit more involved, due to DRM
mid-layering and because it affects non-i915 drivers too. The fix in
this patch is valid regardless of the problem in DRM core.
v2:
- Add a code comment about the relation of this fix to the freeze/thaw
vs. the suspend/resume phases. (Ville)
- Add a code comment about the inconsistent ordering of set power state
and device enable calls. (Chris)
CC: Ville Syrjälä <ville.syrjala@linux.intel.com>
CC: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1460979954-14503-1-git-send-email-imre.deak@intel.com
(cherry picked from commit 44410cd0bfb26bde9288da34c190cc9267d42a20)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
[ kamal: backport to 4.2-stable ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/i915/i915_drv.c | 32 +++++++++++++++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 603146e..9d42aeb 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -796,7 +796,7 @@ static int i915_drm_resume(struct drm_device *dev)
static int i915_drm_resume_early(struct drm_device *dev)
{
struct drm_i915_private *dev_priv = dev->dev_private;
- int ret = 0;
+ int ret;
/*
* We have a resume ordering issue with the snd-hda driver also
@@ -807,6 +807,36 @@ static int i915_drm_resume_early(struct drm_device *dev)
* FIXME: This should be solved with a special hdmi sink device or
* similar so that power domains can be employed.
*/
+
+ /*
+ * Note that we need to set the power state explicitly, since we
+ * powered off the device during freeze and the PCI core won't power
+ * it back up for us during thaw. Powering off the device during
+ * freeze is not a hard requirement though, and during the
+ * suspend/resume phases the PCI core makes sure we get here with the
+ * device powered on. So in case we change our freeze logic and keep
+ * the device powered we can also remove the following set power state
+ * call.
+ */
+ ret = pci_set_power_state(dev->pdev, PCI_D0);
+ if (ret) {
+ DRM_ERROR("failed to set PCI D0 power state (%d)\n", ret);
+ return ret;
+ }
+
+ /*
+ * Note that pci_enable_device() first enables any parent bridge
+ * device and only then sets the power state for this device. The
+ * bridge enabling is a nop though, since bridge devices are resumed
+ * first. The order of enabling power and enabling the device is
+ * imposed by the PCI core as described above, so here we preserve the
+ * same order for the freeze/thaw phases.
+ *
+ * TODO: eventually we should remove pci_disable_device() /
+ * pci_enable_enable_device() from suspend/resume. Due to how they
+ * depend on the device enable refcount we can't anyway depend on them
+ * disabling/enabling the device.
+ */
if (pci_enable_device(dev->pdev))
return -EIO;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 20/59] drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (18 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 19/59] drm/i915: Fix system resume if PCI device remained enabled Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 21/59] drm/i915: Fix eDP low vswing for Broadwell Kamal Mostafa
` (38 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ville Syrjälä, Imre Deak, Jani Nikula, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Imre Deak <imre.deak@intel.com>
commit 5eaa60c7109b40f17ac81090bc8b90482da76cd1 upstream.
The driver's VDD on/off logic assumes that whenever the VDD is on we
also hold an AUX power domain reference. Since BIOS can leave the VDD on
during booting and resuming and on DDI platforms we won't take a
corresponding power reference, the above assumption won't hold on those
platforms and an eventual delayed VDD off work will do an extraneous AUX
power domain put resulting in a refcount underflow. Fix this the same
way we did this for non-DDI DP encoders:
commit 6d93c0c41760c0 ("drm/i915: fix VDD state tracking after system
resume")
At the same time call the DP encoder suspend handler the same way as the
non-DDI DP encoders do to flush any pending VDD off work. Leaving the
work running may cause a HW access where we don't expect this (at a point
where power domains are suspended already).
While at it remove an unnecessary function call indirection.
This fixed for me AUX refcount underflow problems on BXT during
suspend/resume.
CC: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1460963062-13211-4-git-send-email-imre.deak@intel.com
(cherry picked from commit bf93ba67e9c05882f05b7ca2d773cfc8bf462c2a)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/i915/intel_ddi.c | 10 +++-------
drivers/gpu/drm/i915/intel_dp.c | 4 ++--
drivers/gpu/drm/i915/intel_drv.h | 2 ++
3 files changed, 7 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index cb60498..cca3816 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2717,12 +2717,6 @@ void intel_ddi_get_config(struct intel_encoder *encoder,
intel_ddi_clock_get(encoder, pipe_config);
}
-static void intel_ddi_destroy(struct drm_encoder *encoder)
-{
- /* HDMI has nothing special to destroy, so we can go with this. */
- intel_dp_encoder_destroy(encoder);
-}
-
static bool intel_ddi_compute_config(struct intel_encoder *encoder,
struct intel_crtc_state *pipe_config)
{
@@ -2741,7 +2735,8 @@ static bool intel_ddi_compute_config(struct intel_encoder *encoder,
}
static const struct drm_encoder_funcs intel_ddi_funcs = {
- .destroy = intel_ddi_destroy,
+ .reset = intel_dp_encoder_reset,
+ .destroy = intel_dp_encoder_destroy,
};
static struct intel_connector *
@@ -2814,6 +2809,7 @@ void intel_ddi_init(struct drm_device *dev, enum port port)
intel_encoder->post_disable = intel_ddi_post_disable;
intel_encoder->get_hw_state = intel_ddi_get_hw_state;
intel_encoder->get_config = intel_ddi_get_config;
+ intel_encoder->suspend = intel_dp_encoder_suspend;
intel_dig_port->port = port;
intel_dig_port->saved_port_bits = I915_READ(DDI_BUF_CTL(port)) &
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index da3c653..0de5308 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4843,7 +4843,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
kfree(intel_dig_port);
}
-static void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder)
+void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder)
{
struct intel_dp *intel_dp = enc_to_intel_dp(&intel_encoder->base);
@@ -4885,7 +4885,7 @@ static void intel_edp_panel_vdd_sanitize(struct intel_dp *intel_dp)
edp_panel_vdd_schedule_off(intel_dp);
}
-static void intel_dp_encoder_reset(struct drm_encoder *encoder)
+void intel_dp_encoder_reset(struct drm_encoder *encoder)
{
struct intel_dp *intel_dp;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 04d4261..7af4c15 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -1168,6 +1168,8 @@ void intel_dp_start_link_train(struct intel_dp *intel_dp);
void intel_dp_complete_link_train(struct intel_dp *intel_dp);
void intel_dp_stop_link_train(struct intel_dp *intel_dp);
void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode);
+void intel_dp_encoder_reset(struct drm_encoder *encoder);
+void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder);
void intel_dp_encoder_destroy(struct drm_encoder *encoder);
int intel_dp_sink_crc(struct intel_dp *intel_dp, u8 *crc);
bool intel_dp_compute_config(struct intel_encoder *encoder,
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 21/59] drm/i915: Fix eDP low vswing for Broadwell
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (19 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 20/59] drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 22/59] drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW Kamal Mostafa
` (37 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mika Kahola, Ville Syrjälä, Jani Nikula, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mika Kahola <mika.kahola@intel.com>
commit 992e7a41f9fcc7bcd10e7d346aee5ed7a2c241cb upstream.
It was noticed on bug #94087 that module parameter
i915.edp_vswing=2 that should override the VBT setting
to use default voltage swing (400 mV) was not applied
for Broadwell.
This patch provides a fix for this by checking if default
i.e. higher voltage swing is requested to be used and
applies the DDI translations table for DP instead of eDP
(low vswing) table.
v2: Combine two if statements into one (Jani)
v3: Change dev_priv->edp_low_vswing to use dev_priv->vbt.edp.low_vswing
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94087
Signed-off-by: Mika Kahola <mika.kahola@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1461155942-7749-1-git-send-email-mika.kahola@intel.com
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
(cherry picked from commit 00983519214b61c1b9371ec2ed55a4dde773e384)
[Jani: s/dev_priv->vbt.edp.low_vswing/dev_priv->edp_low_vswing/ to backport]
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/i915/intel_ddi.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index cca3816..8c443c9 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -296,9 +296,17 @@ static void intel_prepare_ddi_buffers(struct drm_device *dev, enum port port,
} else if (IS_BROADWELL(dev)) {
ddi_translations_fdi = bdw_ddi_translations_fdi;
ddi_translations_dp = bdw_ddi_translations_dp;
- ddi_translations_edp = bdw_ddi_translations_edp;
+
+ if (dev_priv->edp_low_vswing) {
+ ddi_translations_edp = bdw_ddi_translations_edp;
+ n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp);
+ } else {
+ ddi_translations_edp = bdw_ddi_translations_dp;
+ n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
+ }
+
ddi_translations_hdmi = bdw_ddi_translations_hdmi;
- n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp);
+
n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
hdmi_default_entry = 7;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 22/59] drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (20 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 21/59] drm/i915: Fix eDP low vswing for Broadwell Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 23/59] mac80211: fix statistics leak if dev_alloc_name() fails Kamal Mostafa
` (36 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Akash Goel, Chris Wilson, Ville Syrjälä,
Jani Nikula, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
commit 4ea3959018d09edfa36a9e7b5ccdbd4ec4b99e49 upstream.
Somehow my SNB GT1 (Dell XPS 8300) gets very unhappy around
GPU hangs if the RPS EI/thresholds aren't suitably aligned.
It seems like scheduling/timer interupts stop working somehow
and things get stuck eg. in usleep_range().
I bisected the problem down to
commit 8a5864377b12 ("drm/i915/skl: Restructured the gen6_set_rps_thresholds function")
I observed that before all the values were at least multiples of 25,
but afterwards they are not. And rounding things up to the next multiple
of 25 does seem to help, so lets' do that. I also tried roundup(..., 5)
but that wasn't sufficient. Also I have no idea if we might need this sort of
thing on gen9+ as well.
These are the original EI/thresholds:
LOW_POWER
GEN6_RP_UP_EI 12500
GEN6_RP_UP_THRESHOLD 11800
GEN6_RP_DOWN_EI 25000
GEN6_RP_DOWN_THRESHOLD 21250
BETWEEN
GEN6_RP_UP_EI 10250
GEN6_RP_UP_THRESHOLD 9225
GEN6_RP_DOWN_EI 25000
GEN6_RP_DOWN_THRESHOLD 18750
HIGH_POWER
GEN6_RP_UP_EI 8000
GEN6_RP_UP_THRESHOLD 6800
GEN6_RP_DOWN_EI 25000
GEN6_RP_DOWN_THRESHOLD 15000
These are after 8a5864377b12:
LOW_POWER
GEN6_RP_UP_EI 12500
GEN6_RP_UP_THRESHOLD 11875
GEN6_RP_DOWN_EI 25000
GEN6_RP_DOWN_THRESHOLD 21250
BETWEEN
GEN6_RP_UP_EI 10156
GEN6_RP_UP_THRESHOLD 9140
GEN6_RP_DOWN_EI 25000
GEN6_RP_DOWN_THRESHOLD 18750
HIGH_POWER
GEN6_RP_UP_EI 7812
GEN6_RP_UP_THRESHOLD 6640
GEN6_RP_DOWN_EI 25000
GEN6_RP_DOWN_THRESHOLD 15000
And these are what we have after this patch:
LOW_POWER
GEN6_RP_UP_EI 12500
GEN6_RP_UP_THRESHOLD 11875
GEN6_RP_DOWN_EI 25000
GEN6_RP_DOWN_THRESHOLD 21250
BETWEEN
GEN6_RP_UP_EI 10175
GEN6_RP_UP_THRESHOLD 9150
GEN6_RP_DOWN_EI 25000
GEN6_RP_DOWN_THRESHOLD 18750
HIGH_POWER
GEN6_RP_UP_EI 7825
GEN6_RP_UP_THRESHOLD 6650
GEN6_RP_DOWN_EI 25000
GEN6_RP_DOWN_THRESHOLD 15000
Cc: Akash Goel <akash.goel@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Testcase: igt/kms_pipe_crc_basic/hang-read-crc-pipe-B
Fixes: 8a5864377b12 ("drm/i915/skl: Restructured the gen6_set_rps_thresholds function")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1461159836-9108-1-git-send-email-ville.syrjala@linux.intel.com
Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Patrik Jakobsson <patrik.jakobsson@linux.intel.com>
(cherry picked from commit 8a292d016d1cc4938ff14b4df25328230b08a408)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/i915/i915_reg.h | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 2030f60..3888d13 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2721,7 +2721,14 @@ enum skl_disp_power_wells {
#define GEN6_RP_STATE_LIMITS (MCHBAR_MIRROR_BASE_SNB + 0x5994)
#define GEN6_RP_STATE_CAP (MCHBAR_MIRROR_BASE_SNB + 0x5998)
-#define INTERVAL_1_28_US(us) (((us) * 100) >> 7)
+/*
+ * Make these a multiple of magic 25 to avoid SNB (eg. Dell XPS
+ * 8300) freezing up around GPU hangs. Looks as if even
+ * scheduling/timer interrupts start misbehaving if the RPS
+ * EI/thresholds are "bad", leading to a very sluggish or even
+ * frozen machine.
+ */
+#define INTERVAL_1_28_US(us) roundup(((us) * 100) >> 7, 25)
#define INTERVAL_1_33_US(us) (((us) * 3) >> 2)
#define GT_INTERVAL_FROM_US(dev_priv, us) (IS_GEN9(dev_priv) ? \
INTERVAL_1_33_US(us) : \
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 23/59] mac80211: fix statistics leak if dev_alloc_name() fails
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (21 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 22/59] drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 24/59] drm/radeon: fix vertical bars appear on monitor (v2) Kamal Mostafa
` (35 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Johannes Berg, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Johannes Berg <johannes.berg@intel.com>
commit e6436be21e77e3659b4ff7e357ab5a8342d132d2 upstream.
In the case that dev_alloc_name() fails, e.g. because the name was
given by the user and already exists, we need to clean up properly
and free the per-CPU statistics. Fix that.
Fixes: 5a490510ba5f ("mac80211: use per-CPU TX/RX statistics")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/mac80211/iface.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 2caf837..a36c24d 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1750,7 +1750,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
ret = dev_alloc_name(ndev, ndev->name);
if (ret < 0) {
- free_netdev(ndev);
+ ieee80211_if_free(ndev);
return ret;
}
@@ -1826,7 +1826,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
ret = register_netdevice(ndev);
if (ret) {
- free_netdev(ndev);
+ ieee80211_if_free(ndev);
return ret;
}
}
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 24/59] drm/radeon: fix vertical bars appear on monitor (v2)
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (22 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 23/59] mac80211: fix statistics leak if dev_alloc_name() fails Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 25/59] ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel Kamal Mostafa
` (34 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Vitaly Prosyak, Alex Deucher, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Vitaly Prosyak <vitaly.prosyak@amd.com>
commit 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 upstream.
When crtc/timing is disabled on boot the dig block
should be stopped in order ignore timing from crtc,
reset the steering fifo otherwise we get display
corruption or hung in dp sst mode.
v2: agd: fix coding style
Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/radeon/evergreen.c | 154 ++++++++++++++++++++++++++++++++-
drivers/gpu/drm/radeon/evergreen_reg.h | 46 ++++++++++
2 files changed, 199 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 0acde19..1887a0e 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2629,10 +2629,152 @@ static void evergreen_agp_enable(struct radeon_device *rdev)
WREG32(VM_CONTEXT1_CNTL, 0);
}
+static const unsigned ni_dig_offsets[] =
+{
+ NI_DIG0_REGISTER_OFFSET,
+ NI_DIG1_REGISTER_OFFSET,
+ NI_DIG2_REGISTER_OFFSET,
+ NI_DIG3_REGISTER_OFFSET,
+ NI_DIG4_REGISTER_OFFSET,
+ NI_DIG5_REGISTER_OFFSET
+};
+
+static const unsigned ni_tx_offsets[] =
+{
+ NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1,
+ NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1,
+ NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1,
+ NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1,
+ NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1,
+ NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1
+};
+
+static const unsigned evergreen_dp_offsets[] =
+{
+ EVERGREEN_DP0_REGISTER_OFFSET,
+ EVERGREEN_DP1_REGISTER_OFFSET,
+ EVERGREEN_DP2_REGISTER_OFFSET,
+ EVERGREEN_DP3_REGISTER_OFFSET,
+ EVERGREEN_DP4_REGISTER_OFFSET,
+ EVERGREEN_DP5_REGISTER_OFFSET
+};
+
+
+/*
+ * Assumption is that EVERGREEN_CRTC_MASTER_EN enable for requested crtc
+ * We go from crtc to connector and it is not relible since it
+ * should be an opposite direction .If crtc is enable then
+ * find the dig_fe which selects this crtc and insure that it enable.
+ * if such dig_fe is found then find dig_be which selects found dig_be and
+ * insure that it enable and in DP_SST mode.
+ * if UNIPHY_PLL_CONTROL1.enable then we should disconnect timing
+ * from dp symbols clocks .
+ */
+static bool evergreen_is_dp_sst_stream_enabled(struct radeon_device *rdev,
+ unsigned crtc_id, unsigned *ret_dig_fe)
+{
+ unsigned i;
+ unsigned dig_fe;
+ unsigned dig_be;
+ unsigned dig_en_be;
+ unsigned uniphy_pll;
+ unsigned digs_fe_selected;
+ unsigned dig_be_mode;
+ unsigned dig_fe_mask;
+ bool is_enabled = false;
+ bool found_crtc = false;
+
+ /* loop through all running dig_fe to find selected crtc */
+ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
+ dig_fe = RREG32(NI_DIG_FE_CNTL + ni_dig_offsets[i]);
+ if (dig_fe & NI_DIG_FE_CNTL_SYMCLK_FE_ON &&
+ crtc_id == NI_DIG_FE_CNTL_SOURCE_SELECT(dig_fe)) {
+ /* found running pipe */
+ found_crtc = true;
+ dig_fe_mask = 1 << i;
+ dig_fe = i;
+ break;
+ }
+ }
+
+ if (found_crtc) {
+ /* loop through all running dig_be to find selected dig_fe */
+ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
+ dig_be = RREG32(NI_DIG_BE_CNTL + ni_dig_offsets[i]);
+ /* if dig_fe_selected by dig_be? */
+ digs_fe_selected = NI_DIG_BE_CNTL_FE_SOURCE_SELECT(dig_be);
+ dig_be_mode = NI_DIG_FE_CNTL_MODE(dig_be);
+ if (dig_fe_mask & digs_fe_selected &&
+ /* if dig_be in sst mode? */
+ dig_be_mode == NI_DIG_BE_DPSST) {
+ dig_en_be = RREG32(NI_DIG_BE_EN_CNTL +
+ ni_dig_offsets[i]);
+ uniphy_pll = RREG32(NI_DCIO_UNIPHY0_PLL_CONTROL1 +
+ ni_tx_offsets[i]);
+ /* dig_be enable and tx is running */
+ if (dig_en_be & NI_DIG_BE_EN_CNTL_ENABLE &&
+ dig_en_be & NI_DIG_BE_EN_CNTL_SYMBCLK_ON &&
+ uniphy_pll & NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE) {
+ is_enabled = true;
+ *ret_dig_fe = dig_fe;
+ break;
+ }
+ }
+ }
+ }
+
+ return is_enabled;
+}
+
+/*
+ * Blank dig when in dp sst mode
+ * Dig ignores crtc timing
+ */
+static void evergreen_blank_dp_output(struct radeon_device *rdev,
+ unsigned dig_fe)
+{
+ unsigned stream_ctrl;
+ unsigned fifo_ctrl;
+ unsigned counter = 0;
+
+ if (dig_fe >= ARRAY_SIZE(evergreen_dp_offsets)) {
+ DRM_ERROR("invalid dig_fe %d\n", dig_fe);
+ return;
+ }
+
+ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
+ evergreen_dp_offsets[dig_fe]);
+ if (!(stream_ctrl & EVERGREEN_DP_VID_STREAM_CNTL_ENABLE)) {
+ DRM_ERROR("dig %d , should be enable\n", dig_fe);
+ return;
+ }
+
+ stream_ctrl &=~EVERGREEN_DP_VID_STREAM_CNTL_ENABLE;
+ WREG32(EVERGREEN_DP_VID_STREAM_CNTL +
+ evergreen_dp_offsets[dig_fe], stream_ctrl);
+
+ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
+ evergreen_dp_offsets[dig_fe]);
+ while (counter < 32 && stream_ctrl & EVERGREEN_DP_VID_STREAM_STATUS) {
+ msleep(1);
+ counter++;
+ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
+ evergreen_dp_offsets[dig_fe]);
+ }
+ if (counter >= 32 )
+ DRM_ERROR("counter exceeds %d\n", counter);
+
+ fifo_ctrl = RREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe]);
+ fifo_ctrl |= EVERGREEN_DP_STEER_FIFO_RESET;
+ WREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe], fifo_ctrl);
+
+}
+
void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *save)
{
u32 crtc_enabled, tmp, frame_count, blackout;
int i, j;
+ unsigned dig_fe;
if (!ASIC_IS_NODCE(rdev)) {
save->vga_render_control = RREG32(VGA_RENDER_CONTROL);
@@ -2672,7 +2814,17 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
break;
udelay(1);
}
-
+ /*we should disable dig if it drives dp sst*/
+ /*but we are in radeon_device_init and the topology is unknown*/
+ /*and it is available after radeon_modeset_init*/
+ /*the following method radeon_atom_encoder_dpms_dig*/
+ /*does the job if we initialize it properly*/
+ /*for now we do it this manually*/
+ /**/
+ if (ASIC_IS_DCE5(rdev) &&
+ evergreen_is_dp_sst_stream_enabled(rdev, i ,&dig_fe))
+ evergreen_blank_dp_output(rdev, dig_fe);
+ /*we could remove 6 lines below*/
/* XXX this is a hack to avoid strange behavior with EFI on certain systems */
WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
diff --git a/drivers/gpu/drm/radeon/evergreen_reg.h b/drivers/gpu/drm/radeon/evergreen_reg.h
index aa939dfe..b436bad 100644
--- a/drivers/gpu/drm/radeon/evergreen_reg.h
+++ b/drivers/gpu/drm/radeon/evergreen_reg.h
@@ -250,8 +250,43 @@
/* HDMI blocks at 0x7030, 0x7c30, 0x10830, 0x11430, 0x12030, 0x12c30 */
#define EVERGREEN_HDMI_BASE 0x7030
+/*DIG block*/
+#define NI_DIG0_REGISTER_OFFSET (0x7000 - 0x7000)
+#define NI_DIG1_REGISTER_OFFSET (0x7C00 - 0x7000)
+#define NI_DIG2_REGISTER_OFFSET (0x10800 - 0x7000)
+#define NI_DIG3_REGISTER_OFFSET (0x11400 - 0x7000)
+#define NI_DIG4_REGISTER_OFFSET (0x12000 - 0x7000)
+#define NI_DIG5_REGISTER_OFFSET (0x12C00 - 0x7000)
+
+
+#define NI_DIG_FE_CNTL 0x7000
+# define NI_DIG_FE_CNTL_SOURCE_SELECT(x) ((x) & 0x3)
+# define NI_DIG_FE_CNTL_SYMCLK_FE_ON (1<<24)
+
+
+#define NI_DIG_BE_CNTL 0x7140
+# define NI_DIG_BE_CNTL_FE_SOURCE_SELECT(x) (((x) >> 8 ) & 0x3F)
+# define NI_DIG_FE_CNTL_MODE(x) (((x) >> 16) & 0x7 )
+
+#define NI_DIG_BE_EN_CNTL 0x7144
+# define NI_DIG_BE_EN_CNTL_ENABLE (1 << 0)
+# define NI_DIG_BE_EN_CNTL_SYMBCLK_ON (1 << 8)
+# define NI_DIG_BE_DPSST 0
/* Display Port block */
+#define EVERGREEN_DP0_REGISTER_OFFSET (0x730C - 0x730C)
+#define EVERGREEN_DP1_REGISTER_OFFSET (0x7F0C - 0x730C)
+#define EVERGREEN_DP2_REGISTER_OFFSET (0x10B0C - 0x730C)
+#define EVERGREEN_DP3_REGISTER_OFFSET (0x1170C - 0x730C)
+#define EVERGREEN_DP4_REGISTER_OFFSET (0x1230C - 0x730C)
+#define EVERGREEN_DP5_REGISTER_OFFSET (0x12F0C - 0x730C)
+
+
+#define EVERGREEN_DP_VID_STREAM_CNTL 0x730C
+# define EVERGREEN_DP_VID_STREAM_CNTL_ENABLE (1 << 0)
+# define EVERGREEN_DP_VID_STREAM_STATUS (1 <<16)
+#define EVERGREEN_DP_STEER_FIFO 0x7310
+# define EVERGREEN_DP_STEER_FIFO_RESET (1 << 0)
#define EVERGREEN_DP_SEC_CNTL 0x7280
# define EVERGREEN_DP_SEC_STREAM_ENABLE (1 << 0)
# define EVERGREEN_DP_SEC_ASP_ENABLE (1 << 4)
@@ -266,4 +301,15 @@
# define EVERGREEN_DP_SEC_N_BASE_MULTIPLE(x) (((x) & 0xf) << 24)
# define EVERGREEN_DP_SEC_SS_EN (1 << 28)
+/*DCIO_UNIPHY block*/
+#define NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1 (0x6600 -0x6600)
+#define NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1 (0x6640 -0x6600)
+#define NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1 (0x6680 - 0x6600)
+#define NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1 (0x66C0 - 0x6600)
+#define NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1 (0x6700 - 0x6600)
+#define NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1 (0x6740 - 0x6600)
+
+#define NI_DCIO_UNIPHY0_PLL_CONTROL1 0x6618
+# define NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE (1 << 0)
+
#endif
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 25/59] ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (23 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 24/59] drm/radeon: fix vertical bars appear on monitor (v2) Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 26/59] x86/irq: Fix a race in x86_vector_free_irqs() Kamal Mostafa
` (33 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Sascha Hauer, Dinh Nguyen, Kevin Hilman, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Sascha Hauer <s.hauer@pengutronix.de>
commit 5616f36713ea77f57ae908bf2fef641364403c9f upstream.
The secondary CPU starts up in ARM mode. When the kernel is compiled in
thumb2 mode we have to explicitly compile the secondary startup
trampoline in ARM mode, otherwise the CPU will go to Nirvana.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Reported-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Dinh Nguyen <dinguyen@opensource.altera.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/arm/mach-socfpga/headsmp.S | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-socfpga/headsmp.S b/arch/arm/mach-socfpga/headsmp.S
index 5d94b7a..c160fa3 100644
--- a/arch/arm/mach-socfpga/headsmp.S
+++ b/arch/arm/mach-socfpga/headsmp.S
@@ -13,6 +13,7 @@
#include <asm/assembler.h>
.arch armv7-a
+ .arm
ENTRY(secondary_trampoline)
/* CPU1 will always fetch from 0x0 when it is brought out of reset.
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 26/59] x86/irq: Fix a race in x86_vector_free_irqs()
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (24 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 25/59] ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 27/59] x86/apic: Handle zero vector gracefully in clear_vector_irq() Kamal Mostafa
` (32 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jiang Liu, Jeremiah Mahler, andy.shevchenko, Guenter Roeck,
Thomas Gleixner, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jiang Liu <jiang.liu@linux.intel.com>
commit 111abeba67e0dbdc26537429de9155e4f1d807d8 upstream.
There's a race condition between
x86_vector_free_irqs()
{
free_apic_chip_data(irq_data->chip_data);
xxxxx //irq_data->chip_data has been freed, but the pointer
//hasn't been reset yet
irq_domain_reset_irq_data(irq_data);
}
and
smp_irq_move_cleanup_interrupt()
{
raw_spin_lock(&vector_lock);
data = apic_chip_data(irq_desc_get_irq_data(desc));
access data->xxxx // may access freed memory
raw_spin_unlock(&desc->lock);
}
which may cause smp_irq_move_cleanup_interrupt() to access freed memory.
Call irq_domain_reset_irq_data(), which clears the pointer with vector lock
held.
[ tglx: Free memory outside of lock held region. ]
Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com>
Tested-by: Borislav Petkov <bp@alien8.de>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
Cc: Jeremiah Mahler <jmmahler@gmail.com>
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck <linux@roeck-us.net>
Link: http://lkml.kernel.org/r/1450880014-11741-3-git-send-email-jiang.liu@linux.intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[ kamal: backport to 4.2-stable; prereq for
1bdb897 x86/apic: Handle zero vector gracefully in clear_vector_irq() ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/kernel/apic/vector.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index ea4ba83..7889bec 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -225,9 +225,7 @@ static int assign_irq_vector_policy(int irq, int node,
static void clear_irq_vector(int irq, struct apic_chip_data *data)
{
int cpu, vector;
- unsigned long flags;
- raw_spin_lock_irqsave(&vector_lock, flags);
BUG_ON(!data->cfg.vector);
vector = data->cfg.vector;
@@ -237,10 +235,8 @@ static void clear_irq_vector(int irq, struct apic_chip_data *data)
data->cfg.vector = 0;
cpumask_clear(data->domain);
- if (likely(!data->move_in_progress)) {
- raw_spin_unlock_irqrestore(&vector_lock, flags);
+ if (likely(!data->move_in_progress))
return;
- }
for_each_cpu_and(cpu, data->old_domain, cpu_online_mask) {
for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
@@ -252,7 +248,6 @@ static void clear_irq_vector(int irq, struct apic_chip_data *data)
}
}
data->move_in_progress = 0;
- raw_spin_unlock_irqrestore(&vector_lock, flags);
}
void init_irq_alloc_info(struct irq_alloc_info *info,
@@ -273,19 +268,24 @@ void copy_irq_alloc_info(struct irq_alloc_info *dst, struct irq_alloc_info *src)
static void x86_vector_free_irqs(struct irq_domain *domain,
unsigned int virq, unsigned int nr_irqs)
{
+ struct apic_chip_data *apic_data;
struct irq_data *irq_data;
+ unsigned long flags;
int i;
for (i = 0; i < nr_irqs; i++) {
irq_data = irq_domain_get_irq_data(x86_vector_domain, virq + i);
if (irq_data && irq_data->chip_data) {
+ raw_spin_lock_irqsave(&vector_lock, flags);
clear_irq_vector(virq + i, irq_data->chip_data);
- free_apic_chip_data(irq_data->chip_data);
+ apic_data = irq_data->chip_data;
+ irq_domain_reset_irq_data(irq_data);
+ raw_spin_unlock_irqrestore(&vector_lock, flags);
+ free_apic_chip_data(apic_data);
#ifdef CONFIG_X86_IO_APIC
if (virq + i < nr_legacy_irqs())
legacy_irq_data[virq + i] = NULL;
#endif
- irq_domain_reset_irq_data(irq_data);
}
}
}
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 27/59] x86/apic: Handle zero vector gracefully in clear_vector_irq()
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (25 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 26/59] x86/irq: Fix a race in x86_vector_free_irqs() Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 28/59] ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value Kamal Mostafa
` (31 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Keith Busch, Thomas Gleixner, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Keith Busch <keith.busch@intel.com>
commit 1bdb8970392a68489b469c3a330a1adb5ef61beb upstream.
If x86_vector_alloc_irq() fails x86_vector_free_irqs() is invoked to cleanup
the already allocated vectors. This subsequently calls clear_vector_irq().
The failed irq has no vector assigned, which triggers the BUG_ON(!vector) in
clear_vector_irq().
We cannot suppress the call to x86_vector_free_irqs() for the failed
interrupt, because the other data related to this irq must be cleaned up as
well. So calling clear_vector_irq() with vector == 0 is legitimate.
Remove the BUG_ON and return if vector is zero,
[ tglx: Massaged changelog ]
Fixes: b5dc8e6c21e7 "x86/irq: Use hierarchical irqdomain to manage CPU interrupt vectors"
Signed-off-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/kernel/apic/vector.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 7889bec..c8a2b9c 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -226,7 +226,8 @@ static void clear_irq_vector(int irq, struct apic_chip_data *data)
{
int cpu, vector;
- BUG_ON(!data->cfg.vector);
+ if (!data->cfg.vector)
+ return;
vector = data->cfg.vector;
for_each_cpu_and(cpu, data->domain, cpu_online_mask)
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 28/59] ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (26 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 27/59] x86/apic: Handle zero vector gracefully in clear_vector_irq() Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 29/59] IB/security: Restrict use of the write() interface Kamal Mostafa
` (30 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: James Morse, Rafael J . Wysocki, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: James Morse <james.morse@arm.com>
commit 625fe4f8ffc1b915248558481bb94249f6bd411c upstream.
arm_cpuidle_suspend() may return -EOPNOTSUPP, or any value returned
by the cpu_ops/cpuidle_ops suspend call. arm_enter_idle_state() doesn't
update 'ret' with this value, meaning we always signal success to
cpuidle_enter_state(), causing it to update the usage counters as if we
succeeded.
Fixes: 191de17aa3c1 ("ARM64: cpuidle: Replace cpu_suspend by the common ARM/ARM64 function")
Signed-off-by: James Morse <james.morse@arm.com>
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/cpuidle/cpuidle-arm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
index 545069d..e342565e 100644
--- a/drivers/cpuidle/cpuidle-arm.c
+++ b/drivers/cpuidle/cpuidle-arm.c
@@ -50,7 +50,7 @@ static int arm_enter_idle_state(struct cpuidle_device *dev,
* call the CPU ops suspend protocol with idle index as a
* parameter.
*/
- arm_cpuidle_suspend(idx);
+ ret = arm_cpuidle_suspend(idx);
cpu_pm_exit();
}
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 29/59] IB/security: Restrict use of the write() interface
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (27 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 28/59] ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 30/59] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check Kamal Mostafa
` (29 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Linus Torvalds, Jason Gunthorpe, Doug Ledford, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3 upstream.
The drivers/infiniband stack uses write() as a replacement for
bi-directional ioctl(). This is not safe. There are ways to
trigger write calls that result in the return structure that
is normally written to user space being shunted off to user
specified kernel memory instead.
For the immediate repair, detect and deny suspicious accesses to
the write API.
For long term, update the user space libraries and the kernel API
to something that doesn't present the same security vulnerabilities
(likely a structured ioctl() interface).
The impacted uAPI interfaces are generally only available if
hardware from drivers/infiniband is installed in the system.
Reported-by: Jann Horn <jann@thejh.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
[ Expanded check to all known write() entry points ]
Signed-off-by: Doug Ledford <dledford@redhat.com>
[ kamal: backport to 4.2-stable: no staging/rdma/ ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/infiniband/core/ucm.c | 4 ++++
drivers/infiniband/core/ucma.c | 3 +++
drivers/infiniband/core/uverbs_main.c | 5 +++++
drivers/infiniband/hw/qib/qib_file_ops.c | 5 +++++
include/rdma/ib.h | 16 ++++++++++++++++
5 files changed, 33 insertions(+)
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 0094810..aca6043 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -48,6 +48,7 @@
#include <asm/uaccess.h>
+#include <rdma/ib.h>
#include <rdma/ib_cm.h>
#include <rdma/ib_user_cm.h>
#include <rdma/ib_marshall.h>
@@ -1104,6 +1105,9 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf,
struct ib_ucm_cmd_hdr hdr;
ssize_t result;
+ if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
+ return -EACCES;
+
if (len < sizeof(hdr))
return -EINVAL;
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 29b2121..66f1ca8 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1474,6 +1474,9 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf,
struct rdma_ucm_cmd_hdr hdr;
ssize_t ret;
+ if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
+ return -EACCES;
+
if (len < sizeof(hdr))
return -EINVAL;
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 15f4126..77c04a3 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -48,6 +48,8 @@
#include <asm/uaccess.h>
+#include <rdma/ib.h>
+
#include "uverbs.h"
MODULE_AUTHOR("Roland Dreier");
@@ -614,6 +616,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
struct ib_uverbs_cmd_hdr hdr;
__u32 flags;
+ if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
+ return -EACCES;
+
if (count < sizeof hdr)
return -EINVAL;
diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
index 7258818..619154e 100644
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -45,6 +45,8 @@
#include <linux/export.h>
#include <linux/uio.h>
+#include <rdma/ib.h>
+
#include "qib.h"
#include "qib_common.h"
#include "qib_user_sdma.h"
@@ -2067,6 +2069,9 @@ static ssize_t qib_write(struct file *fp, const char __user *data,
ssize_t ret = 0;
void *dest;
+ if (WARN_ON_ONCE(!ib_safe_file_access(fp)))
+ return -EACCES;
+
if (count < sizeof(cmd.type)) {
ret = -EINVAL;
goto bail;
diff --git a/include/rdma/ib.h b/include/rdma/ib.h
index cf8f9e7..a6b9370 100644
--- a/include/rdma/ib.h
+++ b/include/rdma/ib.h
@@ -34,6 +34,7 @@
#define _RDMA_IB_H
#include <linux/types.h>
+#include <linux/sched.h>
struct ib_addr {
union {
@@ -86,4 +87,19 @@ struct sockaddr_ib {
__u64 sib_scope_id;
};
+/*
+ * The IB interfaces that use write() as bi-directional ioctl() are
+ * fundamentally unsafe, since there are lots of ways to trigger "write()"
+ * calls from various contexts with elevated privileges. That includes the
+ * traditional suid executable error message writes, but also various kernel
+ * interfaces that can write to file descriptors.
+ *
+ * This function provides protection for the legacy API by restricting the
+ * calling context.
+ */
+static inline bool ib_safe_file_access(struct file *filp)
+{
+ return filp->f_cred == current_cred() && segment_eq(get_fs(), USER_DS);
+}
+
#endif /* _RDMA_IB_H */
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 30/59] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (28 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 29/59] IB/security: Restrict use of the write() interface Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 31/59] mm: vmscan: reclaim highmem zone if buffer_heads is over limit Kamal Mostafa
` (28 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Konstantin Khlebnikov, Dmitry Vyukov, Andrea Arcangeli,
Andrew Morton, Linus Torvalds, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Konstantin Khlebnikov <koct9i@gmail.com>
commit 3486b85a29c1741db99d0c522211c82d2b7a56d0 upstream.
Khugepaged detects own VMAs by checking vm_file and vm_ops but this way
it cannot distinguish private /dev/zero mappings from other special
mappings like /dev/hpet which has no vm_ops and popultes PTEs in mmap.
This fixes false-positive VM_BUG_ON and prevents installing THP where
they are not expected.
Link: http://lkml.kernel.org/r/CACT4Y+ZmuZMV5CjSFOeXviwQdABAgT7T+StKfTqan9YDtgEi5g@mail.gmail.com
Fixes: 78f11a255749 ("mm: thp: fix /dev/zero MAP_PRIVATE and vm_flags cleanups")
Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
mm/huge_memory.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index da0ac6a..749b929 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2061,10 +2061,9 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
* page fault if needed.
*/
return 0;
- if (vma->vm_ops)
+ if (vma->vm_ops || (vm_flags & VM_NO_THP))
/* khugepaged not yet working on file or special mappings */
return 0;
- VM_BUG_ON_VMA(vm_flags & VM_NO_THP, vma);
hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
hend = vma->vm_end & HPAGE_PMD_MASK;
if (hstart < hend)
@@ -2421,8 +2420,7 @@ static bool hugepage_vma_check(struct vm_area_struct *vma)
return false;
if (is_vma_temporary_stack(vma))
return false;
- VM_BUG_ON_VMA(vma->vm_flags & VM_NO_THP, vma);
- return true;
+ return !(vma->vm_flags & VM_NO_THP);
}
static void collapse_huge_page(struct mm_struct *mm,
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 31/59] mm: vmscan: reclaim highmem zone if buffer_heads is over limit
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (29 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 30/59] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 32/59] EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback Kamal Mostafa
` (27 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Minchan Kim, Johannes Weiner, Andrew Morton, Linus Torvalds,
Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Minchan Kim <minchan@kernel.org>
commit 7bf52fb891b64b8d61caf0b82060adb9db761aec upstream.
We have been reclaimed highmem zone if buffer_heads is over limit but
commit 6b4f7799c6a5 ("mm: vmscan: invoke slab shrinkers from
shrink_zone()") changed the behavior so it doesn't reclaim highmem zone
although buffer_heads is over the limit. This patch restores the logic.
Fixes: 6b4f7799c6a5 ("mm: vmscan: invoke slab shrinkers from shrink_zone()")
Signed-off-by: Minchan Kim <minchan@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
mm/vmscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 26c86e2..cce9a0d 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2507,7 +2507,7 @@ static bool shrink_zones(struct zonelist *zonelist, struct scan_control *sc)
sc->gfp_mask |= __GFP_HIGHMEM;
for_each_zone_zonelist_nodemask(zone, z, zonelist,
- requested_highidx, sc->nodemask) {
+ gfp_zone(sc->gfp_mask), sc->nodemask) {
enum zone_type classzone_idx;
if (!populated_zone(zone))
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 32/59] EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (30 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 31/59] mm: vmscan: reclaim highmem zone if buffer_heads is over limit Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 33/59] powerpc: Fix bad inline asm constraint in create_zero_mask() Kamal Mostafa
` (26 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Tony Luck, linux-edac, Borislav Petkov, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Tony Luck <tony.luck@intel.com>
commit c4fc1956fa31003bfbe4f597e359d751568e2954 upstream.
Both of these drivers can return NOTIFY_BAD, but this terminates
processing other callbacks that were registered later on the chain.
Since the driver did nothing to log the error it seems wrong to prevent
other interested parties from seeing it. E.g. neither of them had even
bothered to check the type of the error to see if it was a memory error
before the return NOTIFY_BAD.
Signed-off-by: Tony Luck <tony.luck@intel.com>
Acked-by: Aristeu Rozanski <aris@redhat.com>
Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/72937355dd92318d2630979666063f8a2853495b.1461864507.git.tony.luck@intel.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/edac/i7core_edac.c | 2 +-
drivers/edac/sb_edac.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 01087a3..792bdae 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1866,7 +1866,7 @@ static int i7core_mce_check_error(struct notifier_block *nb, unsigned long val,
i7_dev = get_i7core_dev(mce->socketid);
if (!i7_dev)
- return NOTIFY_BAD;
+ return NOTIFY_DONE;
mci = i7_dev->mci;
pvt = mci->pvt_info;
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 9a4f1aa..109c2ffd 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -2232,7 +2232,7 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
mci = get_mci_for_node_id(mce->socketid);
if (!mci)
- return NOTIFY_BAD;
+ return NOTIFY_DONE;
pvt = mci->pvt_info;
/*
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 33/59] powerpc: Fix bad inline asm constraint in create_zero_mask()
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (31 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 32/59] EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 34/59] Minimal fix-up of bad hashing behavior of hash_64() Kamal Mostafa
` (25 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Anton Blanchard, Michael Ellerman, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Anton Blanchard <anton@samba.org>
commit b4c112114aab9aff5ed4568ca5e662bb02cdfe74 upstream.
In create_zero_mask() we have:
addi %1,%2,-1
andc %1,%1,%2
popcntd %0,%1
using the "r" constraint for %2. r0 is a valid register in the "r" set,
but addi X,r0,X turns it into an li:
li r7,-1
andc r7,r7,r0
popcntd r4,r7
Fix this by using the "b" constraint, for which r0 is not a valid
register.
This was found with a kernel build using gcc trunk, narrowed down to
when -frename-registers was enabled at -O2. It is just luck however
that we aren't seeing this on older toolchains.
Thanks to Segher for working with me to find this issue.
Fixes: d0cebfa650a0 ("powerpc: word-at-a-time optimization for 64-bit Little Endian")
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/powerpc/include/asm/word-at-a-time.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/include/asm/word-at-a-time.h b/arch/powerpc/include/asm/word-at-a-time.h
index 5b3a903..7043539 100644
--- a/arch/powerpc/include/asm/word-at-a-time.h
+++ b/arch/powerpc/include/asm/word-at-a-time.h
@@ -77,7 +77,7 @@ static inline unsigned long create_zero_mask(unsigned long bits)
"andc %1,%1,%2\n\t"
"popcntd %0,%1"
: "=r" (leading_zero_bits), "=&r" (trailing_zero_bit_mask)
- : "r" (bits));
+ : "b" (bits));
return leading_zero_bits;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 34/59] Minimal fix-up of bad hashing behavior of hash_64()
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (32 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 33/59] powerpc: Fix bad inline asm constraint in create_zero_mask() Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 35/59] drm/amdgpu: set metadata pointer to NULL after freeing Kamal Mostafa
` (24 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: George Spelvin, Thomas Gleixner, Linus Torvalds, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 689de1d6ca95b3b5bd8ee446863bf81a4883ea25 upstream.
This is a fairly minimal fixup to the horribly bad behavior of hash_64()
with certain input patterns.
In particular, because the multiplicative value used for the 64-bit hash
was intentionally bit-sparse (so that the multiply could be done with
shifts and adds on architectures without hardware multipliers), some
bits did not get spread out very much. In particular, certain fairly
common bit ranges in the input (roughly bits 12-20: commonly with the
most information in them when you hash things like byte offsets in files
or memory that have block factors that mean that the low bits are often
zero) would not necessarily show up much in the result.
There's a bigger patch-series brewing to fix up things more completely,
but this is the fairly minimal fix for the 64-bit hashing problem. It
simply picks a much better constant multiplier, spreading the bits out a
lot better.
NOTE! For 32-bit architectures, the bad old hash_64() remains the same
for now, since 64-bit multiplies are expensive. The bigger hashing
cleanup will replace the 32-bit case with something better.
The new constants were picked by George Spelvin who wrote that bigger
cleanup series. I just picked out the constants and part of the comment
from that series.
Cc: George Spelvin <linux@horizon.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/linux/hash.h | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/include/linux/hash.h b/include/linux/hash.h
index 1afde47..79c52fa 100644
--- a/include/linux/hash.h
+++ b/include/linux/hash.h
@@ -32,12 +32,28 @@
#error Wordsize not 32 or 64
#endif
+/*
+ * The above primes are actively bad for hashing, since they are
+ * too sparse. The 32-bit one is mostly ok, the 64-bit one causes
+ * real problems. Besides, the "prime" part is pointless for the
+ * multiplicative hash.
+ *
+ * Although a random odd number will do, it turns out that the golden
+ * ratio phi = (sqrt(5)-1)/2, or its negative, has particularly nice
+ * properties.
+ *
+ * These are the negative, (1 - phi) = (phi^2) = (3 - sqrt(5))/2.
+ * (See Knuth vol 3, section 6.4, exercise 9.)
+ */
+#define GOLDEN_RATIO_32 0x61C88647
+#define GOLDEN_RATIO_64 0x61C8864680B583EBull
+
static __always_inline u64 hash_64(u64 val, unsigned int bits)
{
u64 hash = val;
-#if defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
- hash = hash * GOLDEN_RATIO_PRIME_64;
+#if BITS_PER_LONG == 64
+ hash = hash * GOLDEN_RATIO_64;
#else
/* Sigh, gcc can't optimise this alone like it does for 32 bits. */
u64 n = hash;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 35/59] drm/amdgpu: set metadata pointer to NULL after freeing.
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (33 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 34/59] Minimal fix-up of bad hashing behavior of hash_64() Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 36/59] tracing: Don't display trigger file for events that can't be enabled Kamal Mostafa
` (23 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dave Airlie, Alex Deucher, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Dave Airlie <airlied@redhat.com>
commit 0092d3edcb23fcdb8cbe4159ba94a534290ff982 upstream.
Without this there was a double free of the metadata,
which ended up freeing the fd table for me here, and taking
out the machine more often than not.
I reproduced with X.org + modesetting DDX + latest llvm/mesa,
also required using dri3.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index da3f9f2..870cb79 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -550,6 +550,7 @@ int amdgpu_bo_set_metadata (struct amdgpu_bo *bo, void *metadata,
if (!metadata_size) {
if (bo->metadata_size) {
kfree(bo->metadata);
+ bo->metadata = NULL;
bo->metadata_size = 0;
}
return 0;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 36/59] tracing: Don't display trigger file for events that can't be enabled
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (34 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 35/59] drm/amdgpu: set metadata pointer to NULL after freeing Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 37/59] drm/radeon: make sure vertical front porch is at least 1 Kamal Mostafa
` (22 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Chunyu Hu, Steven Rostedt, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Chunyu Hu <chuhu@redhat.com>
commit 854145e0a8e9a05f7366d240e2f99d9c1ca6d6dd upstream.
Currently register functions for events will be called
through the 'reg' field of event class directly without
any check when seting up triggers.
Triggers for events that don't support register through
debug fs (events under events/ftrace are for trace-cmd to
read event format, and most of them don't have a register
function except events/ftrace/functionx) can't be enabled
at all, and an oops will be hit when setting up trigger
for those events, so just not creating them is an easy way
to avoid the oops.
Link: http://lkml.kernel.org/r/1462275274-3911-1-git-send-email-chuhu@redhat.com
Fixes: 85f2b08268c01 ("tracing: Add basic event trigger framework")
Signed-off-by: Chunyu Hu <chuhu@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
kernel/trace/trace_events.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 78234df..825b5e4 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1626,8 +1626,13 @@ event_create_dir(struct dentry *parent, struct trace_event_file *file)
trace_create_file("filter", 0644, file->dir, file,
&ftrace_event_filter_fops);
- trace_create_file("trigger", 0644, file->dir, file,
- &event_trigger_fops);
+ /*
+ * Only event directories that can be enabled should have
+ * triggers.
+ */
+ if (!(call->flags & TRACE_EVENT_FL_IGNORE_ENABLE))
+ trace_create_file("trigger", 0644, file->dir, file,
+ &event_trigger_fops);
trace_create_file("format", 0444, file->dir, call,
&ftrace_event_format_fops);
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 37/59] drm/radeon: make sure vertical front porch is at least 1
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (35 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 36/59] tracing: Don't display trigger file for events that can't be enabled Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 38/59] drm/amdgpu: " Kamal Mostafa
` (21 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Alex Deucher, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 3104b8128d4d646a574ed9d5b17c7d10752cd70b upstream.
hw doesn't like a 0 value.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/radeon/atombios_encoders.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index adf74f4..0b04b92 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -310,6 +310,10 @@ static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
&& (mode->crtc_vsync_start < (mode->crtc_vdisplay + 2)))
adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + 2;
+ /* vertical FP must be at least 1 */
+ if (mode->crtc_vsync_start == mode->crtc_vdisplay)
+ adjusted_mode->crtc_vsync_start++;
+
/* get the native mode for scaling */
if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
radeon_panel_mode_fixup(encoder, adjusted_mode);
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 38/59] drm/amdgpu: make sure vertical front porch is at least 1
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (36 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 37/59] drm/radeon: make sure vertical front porch is at least 1 Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 39/59] MAINTAINERS: Remove asterisk from EFI directory names Kamal Mostafa
` (20 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Alex Deucher, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 0126d4b9a516256f2432ca0dc78ab293a8255378 upstream.
hw doesn't like a 0 value.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
index e605574..3ea2ad1 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
@@ -298,6 +298,10 @@ bool amdgpu_atombios_encoder_mode_fixup(struct drm_encoder *encoder,
&& (mode->crtc_vsync_start < (mode->crtc_vdisplay + 2)))
adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + 2;
+ /* vertical FP must be at least 1 */
+ if (mode->crtc_vsync_start == mode->crtc_vdisplay)
+ adjusted_mode->crtc_vsync_start++;
+
/* get the native mode for scaling */
if (amdgpu_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT))
amdgpu_panel_mode_fixup(encoder, adjusted_mode);
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 39/59] MAINTAINERS: Remove asterisk from EFI directory names
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (37 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 38/59] drm/amdgpu: " Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 40/59] ACPICA: Dispatcher: Update thread ID for recursive method calls Kamal Mostafa
` (19 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Matt Fleming, Ard Biesheuvel, Catalin Marinas, Linus Torvalds,
Peter Zijlstra, Thomas Gleixner, linux-efi, Ingo Molnar,
Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Matt Fleming <matt@codeblueprint.co.uk>
commit e8dfe6d8f6762d515fcd4f30577f7bfcf7659887 upstream.
Mark reported that having asterisks on the end of directory names
confuses get_maintainer.pl when it encounters subdirectories, and that
my name does not appear when run on drivers/firmware/efi/libstub.
Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/1462303781-8686-2-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
MAINTAINERS | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index ab4384f..fb1c3fa 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3941,8 +3941,8 @@ F: Documentation/efi-stub.txt
F: arch/ia64/kernel/efi.c
F: arch/x86/boot/compressed/eboot.[ch]
F: arch/x86/include/asm/efi.h
-F: arch/x86/platform/efi/*
-F: drivers/firmware/efi/*
+F: arch/x86/platform/efi/
+F: drivers/firmware/efi/
F: include/linux/efi*.h
EFI VARIABLE FILESYSTEM
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 40/59] ACPICA: Dispatcher: Update thread ID for recursive method calls
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (38 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 39/59] MAINTAINERS: Remove asterisk from EFI directory names Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 41/59] ARC: Add missing io barriers to io{read,write}{16,32}be() Kamal Mostafa
` (18 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Prarit Bhargava, Bob Moore, Lv Zheng, Rafael J . Wysocki, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Prarit Bhargava <prarit@redhat.com>
commit 93d68841a23a5779cef6fb9aa0ef32e7c5bd00da upstream.
ACPICA commit 7a3bd2d962f221809f25ddb826c9e551b916eb25
Set the mutex owner thread ID.
Original patch from: Prarit Bhargava <prarit@redhat.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=115121
Link: https://github.com/acpica/acpica/commit/7a3bd2d9
Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Tested-by: Andy Lutomirski <luto@kernel.org> # On a Dell XPS 13 9350
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/acpi/acpica/dsmethod.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 85bb951..68c715e 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -411,6 +411,9 @@ acpi_ds_begin_method_execution(struct acpi_namespace_node *method_node,
obj_desc->method.mutex->mutex.
original_sync_level =
obj_desc->method.mutex->mutex.sync_level;
+
+ obj_desc->method.mutex->mutex.thread_id =
+ acpi_os_get_thread_id();
}
}
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 41/59] ARC: Add missing io barriers to io{read,write}{16,32}be()
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (39 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 40/59] ACPICA: Dispatcher: Update thread ID for recursive method calls Kamal Mostafa
@ 2016-05-09 19:55 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 42/59] x86/sysfb_efi: Fix valid BAR address range check Kamal Mostafa
` (17 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:55 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Vineet Gupta, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Vineet Gupta <vgupta@synopsys.com>
commit e5bc0478ab6cf565619224536d75ecb2aedca43b upstream.
While reviewing a different change to asm-generic/io.h Arnd spotted that
ARC ioread32 and ioread32be both of which come from asm-generic versions
are not symmetrical in terms of calling the io barriers.
generic ioread32 -> ARC readl() [ has barriers]
generic ioread32be -> __be32_to_cpu(__raw_readl()) [ lacks barriers]
While generic ioread32be is being remediated to call readl(), that involves
a swab32(), causing double swaps on ioread32be() on Big Endian systems.
So provide our versions of big endian IO accessors to ensure io barrier
calls while also keeping them optimal
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/arc/include/asm/io.h | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h
index 27b17ad..cb69299 100644
--- a/arch/arc/include/asm/io.h
+++ b/arch/arc/include/asm/io.h
@@ -13,6 +13,15 @@
#include <asm/byteorder.h>
#include <asm/page.h>
+#ifdef CONFIG_ISA_ARCV2
+#include <asm/barrier.h>
+#define __iormb() rmb()
+#define __iowmb() wmb()
+#else
+#define __iormb() do { } while (0)
+#define __iowmb() do { } while (0)
+#endif
+
extern void __iomem *ioremap(unsigned long physaddr, unsigned long size);
extern void __iomem *ioremap_prot(phys_addr_t offset, unsigned long size,
unsigned long flags);
@@ -22,6 +31,15 @@ extern void iounmap(const void __iomem *addr);
#define ioremap_wc(phy, sz) ioremap(phy, sz)
#define ioremap_wt(phy, sz) ioremap(phy, sz)
+/*
+ * io{read,write}{16,32}be() macros
+ */
+#define ioread16be(p) ({ u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(); __v; })
+#define ioread32be(p) ({ u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(); __v; })
+
+#define iowrite16be(v,p) ({ __iowmb(); __raw_writew((__force u16)cpu_to_be16(v), p); })
+#define iowrite32be(v,p) ({ __iowmb(); __raw_writel((__force u32)cpu_to_be32(v), p); })
+
/* Change struct page to physical address */
#define page_to_phys(page) (page_to_pfn(page) << PAGE_SHIFT)
@@ -99,15 +117,6 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
}
-#ifdef CONFIG_ISA_ARCV2
-#include <asm/barrier.h>
-#define __iormb() rmb()
-#define __iowmb() wmb()
-#else
-#define __iormb() do { } while (0)
-#define __iowmb() do { } while (0)
-#endif
-
/*
* MMIO can also get buffered/optimized in micro-arch, so barriers needed
* Based on ARM model for the typical use case
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 42/59] x86/sysfb_efi: Fix valid BAR address range check
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (40 preceding siblings ...)
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 41/59] ARC: Add missing io barriers to io{read,write}{16,32}be() Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 43/59] fs/pnode.c: treat zero mnt_group_id-s as unequal Kamal Mostafa
` (16 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Wang YanQing, Matt Fleming, Ard Biesheuvel, David Herrmann,
Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Tomi Valkeinen,
linux-efi, Ingo Molnar, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Wang YanQing <udknight@gmail.com>
commit c10fcb14c7afd6688c7b197a814358fecf244222 upstream.
The code for checking whether a BAR address range is valid will break
out of the loop when a start address of 0x0 is encountered.
This behaviour is wrong since by breaking out of the loop we may miss
the BAR that describes the EFI frame buffer in a later iteration.
Because of this bug I can't use video=efifb: boot parameter to get
efifb on my new ThinkPad E550 for my old linux system hard disk with
3.10 kernel. In 3.10, efifb is the only choice due to DRM/I915 not
supporting the GPU.
This patch also add a trivial optimization to break out after we find
the frame buffer address range without testing later BARs.
Signed-off-by: Wang YanQing <udknight@gmail.com>
[ Rewrote changelog. ]
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Reviewed-by: Peter Jones <pjones@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: David Herrmann <dh.herrmann@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/1462454061-21561-2-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/kernel/sysfb_efi.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c
index b285d4e..5da924b 100644
--- a/arch/x86/kernel/sysfb_efi.c
+++ b/arch/x86/kernel/sysfb_efi.c
@@ -106,14 +106,24 @@ static int __init efifb_set_system(const struct dmi_system_id *id)
continue;
for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
resource_size_t start, end;
+ unsigned long flags;
+
+ flags = pci_resource_flags(dev, i);
+ if (!(flags & IORESOURCE_MEM))
+ continue;
+
+ if (flags & IORESOURCE_UNSET)
+ continue;
+
+ if (pci_resource_len(dev, i) == 0)
+ continue;
start = pci_resource_start(dev, i);
- if (start == 0)
- break;
end = pci_resource_end(dev, i);
if (screen_info.lfb_base >= start &&
screen_info.lfb_base < end) {
found_bar = 1;
+ break;
}
}
}
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 43/59] fs/pnode.c: treat zero mnt_group_id-s as unequal
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (41 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 42/59] x86/sysfb_efi: Fix valid BAR address range check Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 44/59] propogate_mnt: Handle the first propogated copy being a slave Kamal Mostafa
` (15 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Maxim Patlasov, Al Viro, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Maxim Patlasov <mpatlasov@virtuozzo.com>
commit 7ae8fd0351f912b075149a1e03a017be8b903b9a upstream.
propagate_one(m) calculates "type" argument for copy_tree() like this:
> if (m->mnt_group_id == last_dest->mnt_group_id) {
> type = CL_MAKE_SHARED;
> } else {
> type = CL_SLAVE;
> if (IS_MNT_SHARED(m))
> type |= CL_MAKE_SHARED;
> }
The "type" argument then governs clone_mnt() behavior with respect to flags
and mnt_master of new mount. When we iterate through a slave group, it is
possible that both current "m" and "last_dest" are not shared (although,
both are slaves, i.e. have non-NULL mnt_master-s). Then the comparison
above erroneously makes new mount shared and sets its mnt_master to
last_source->mnt_master. The patch fixes the problem by handling zero
mnt_group_id-s as though they are unequal.
The similar problem exists in the implementation of "else" clause above
when we have to ascend upward in the master/slave tree by calling:
> last_source = last_source->mnt_master;
> last_dest = last_source->mnt_parent;
proper number of times. The last step is governed by
"n->mnt_group_id != last_dest->mnt_group_id" condition that may lie if
both are zero. The patch fixes this case in the same way as the former one.
[AV: don't open-code an obvious helper...]
Signed-off-by: Maxim Patlasov <mpatlasov@virtuozzo.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/pnode.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/pnode.c b/fs/pnode.c
index 6367e1e..c524fdd 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -202,6 +202,11 @@ static struct mount *last_dest, *last_source, *dest_master;
static struct mountpoint *mp;
static struct hlist_head *list;
+static inline bool peers(struct mount *m1, struct mount *m2)
+{
+ return m1->mnt_group_id == m2->mnt_group_id && m1->mnt_group_id;
+}
+
static int propagate_one(struct mount *m)
{
struct mount *child;
@@ -212,7 +217,7 @@ static int propagate_one(struct mount *m)
/* skip if mountpoint isn't covered by it */
if (!is_subdir(mp->m_dentry, m->mnt.mnt_root))
return 0;
- if (m->mnt_group_id == last_dest->mnt_group_id) {
+ if (peers(m, last_dest)) {
type = CL_MAKE_SHARED;
} else {
struct mount *n, *p;
@@ -223,7 +228,7 @@ static int propagate_one(struct mount *m)
last_source = last_source->mnt_master;
last_dest = last_source->mnt_parent;
}
- if (n->mnt_group_id != last_dest->mnt_group_id) {
+ if (!peers(n, last_dest)) {
last_source = last_source->mnt_master;
last_dest = last_source->mnt_parent;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 44/59] propogate_mnt: Handle the first propogated copy being a slave
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (42 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 43/59] fs/pnode.c: treat zero mnt_group_id-s as unequal Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 45/59] writeback: Fix performance regression in wb_over_bg_thresh() Kamal Mostafa
` (14 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 5ec0811d30378ae104f250bfc9b3640242d81e3f upstream.
When the first propgated copy was a slave the following oops would result:
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
> IP: [<ffffffff811fba4e>] propagate_one+0xbe/0x1c0
> PGD bacd4067 PUD bac66067 PMD 0
> Oops: 0000 [#1] SMP
> Modules linked in:
> CPU: 1 PID: 824 Comm: mount Not tainted 4.6.0-rc5userns+ #1523
> Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
> task: ffff8800bb0a8000 ti: ffff8800bac3c000 task.ti: ffff8800bac3c000
> RIP: 0010:[<ffffffff811fba4e>] [<ffffffff811fba4e>] propagate_one+0xbe/0x1c0
> RSP: 0018:ffff8800bac3fd38 EFLAGS: 00010283
> RAX: 0000000000000000 RBX: ffff8800bb77ec00 RCX: 0000000000000010
> RDX: 0000000000000000 RSI: ffff8800bb58c000 RDI: ffff8800bb58c480
> RBP: ffff8800bac3fd48 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000001ca1 R11: 0000000000001c9d R12: 0000000000000000
> R13: ffff8800ba713800 R14: ffff8800bac3fda0 R15: ffff8800bb77ec00
> FS: 00007f3c0cd9b7e0(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000010 CR3: 00000000bb79d000 CR4: 00000000000006e0
> Stack:
> ffff8800bb77ec00 0000000000000000 ffff8800bac3fd88 ffffffff811fbf85
> ffff8800bac3fd98 ffff8800bb77f080 ffff8800ba713800 ffff8800bb262b40
> 0000000000000000 0000000000000000 ffff8800bac3fdd8 ffffffff811f1da0
> Call Trace:
> [<ffffffff811fbf85>] propagate_mnt+0x105/0x140
> [<ffffffff811f1da0>] attach_recursive_mnt+0x120/0x1e0
> [<ffffffff811f1ec3>] graft_tree+0x63/0x70
> [<ffffffff811f1f6b>] do_add_mount+0x9b/0x100
> [<ffffffff811f2c1a>] do_mount+0x2aa/0xdf0
> [<ffffffff8117efbe>] ? strndup_user+0x4e/0x70
> [<ffffffff811f3a45>] SyS_mount+0x75/0xc0
> [<ffffffff8100242b>] do_syscall_64+0x4b/0xa0
> [<ffffffff81988f3c>] entry_SYSCALL64_slow_path+0x25/0x25
> Code: 00 00 75 ec 48 89 0d 02 22 22 01 8b 89 10 01 00 00 48 89 05 fd 21 22 01 39 8e 10 01 00 00 0f 84 e0 00 00 00 48 8b 80 d8 00 00 00 <48> 8b 50 10 48 89 05 df 21 22 01 48 89 15 d0 21 22 01 8b 53 30
> RIP [<ffffffff811fba4e>] propagate_one+0xbe/0x1c0
> RSP <ffff8800bac3fd38>
> CR2: 0000000000000010
> ---[ end trace 2725ecd95164f217 ]---
This oops happens with the namespace_sem held and can be triggered by
non-root users. An all around not pleasant experience.
To avoid this scenario when finding the appropriate source mount to
copy stop the walk up the mnt_master chain when the first source mount
is encountered.
Further rewrite the walk up the last_source mnt_master chain so that
it is clear what is going on.
The reason why the first source mount is special is that it it's
mnt_parent is not a mount in the dest_mnt propagation tree, and as
such termination conditions based up on the dest_mnt mount propgation
tree do not make sense.
To avoid other kinds of confusion last_dest is not changed when
computing last_source. last_dest is only used once in propagate_one
and that is above the point of the code being modified, so changing
the global variable is meaningless and confusing.
fixes: f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 ("smarter propagate_mnt()")
Reported-by: Tycho Andersen <tycho.andersen@canonical.com>
Reviewed-by: Seth Forshee <seth.forshee@canonical.com>
Tested-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/pnode.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/fs/pnode.c b/fs/pnode.c
index c524fdd..9989970 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -198,7 +198,7 @@ static struct mount *next_group(struct mount *m, struct mount *origin)
/* all accesses are serialized by namespace_sem */
static struct user_namespace *user_ns;
-static struct mount *last_dest, *last_source, *dest_master;
+static struct mount *last_dest, *first_source, *last_source, *dest_master;
static struct mountpoint *mp;
static struct hlist_head *list;
@@ -221,20 +221,22 @@ static int propagate_one(struct mount *m)
type = CL_MAKE_SHARED;
} else {
struct mount *n, *p;
+ bool done;
for (n = m; ; n = p) {
p = n->mnt_master;
- if (p == dest_master || IS_MNT_MARKED(p)) {
- while (last_dest->mnt_master != p) {
- last_source = last_source->mnt_master;
- last_dest = last_source->mnt_parent;
- }
- if (!peers(n, last_dest)) {
- last_source = last_source->mnt_master;
- last_dest = last_source->mnt_parent;
- }
+ if (p == dest_master || IS_MNT_MARKED(p))
break;
- }
}
+ do {
+ struct mount *parent = last_source->mnt_parent;
+ if (last_source == first_source)
+ break;
+ done = parent->mnt_master == p;
+ if (done && peers(n, parent))
+ break;
+ last_source = last_source->mnt_master;
+ } while (!done);
+
type = CL_SLAVE;
/* beginning of peer group among the slaves? */
if (IS_MNT_SHARED(m))
@@ -286,6 +288,7 @@ int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
*/
user_ns = current->nsproxy->mnt_ns->user_ns;
last_dest = dest_mnt;
+ first_source = source_mnt;
last_source = source_mnt;
mp = dest_mp;
list = tree_list;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 45/59] writeback: Fix performance regression in wb_over_bg_thresh()
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (43 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 44/59] propogate_mnt: Handle the first propogated copy being a slave Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 46/59] mm, cma: prevent nr_isolated_* counters from going negative Kamal Mostafa
` (13 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Howard Cochran, Miklos Szeredi, Jens Axboe, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Howard Cochran <hcochran@kernelspring.com>
commit 74d369443325063a5f0260e63971decb950fd8fa upstream.
Commit 947e9762a8dd ("writeback: update wb_over_bg_thresh() to use
wb_domain aware operations") unintentionally changed this function's
meaning from "are there more dirty pages than the background writeback
threshold" to "are there more dirty pages than the writeback threshold".
The background writeback threshold is typically half of the writeback
threshold, so this had the effect of raising the number of dirty pages
required to cause a writeback worker to perform background writeout.
This can cause a very severe performance regression when a BDI uses
BDI_CAP_STRICTLIMIT because balance_dirty_pages() and the writeback worker
can now disagree on whether writeback should be initiated.
For example, in a system having 1GB of RAM, a single spinning disk, and a
"pass-through" FUSE filesystem mounted over the disk, application code
mmapped a 128MB file on the disk and was randomly dirtying pages in that
mapping.
Because FUSE uses strictlimit and has a default max_ratio of only 1%, in
balance_dirty_pages, thresh is ~200, bg_thresh is ~100, and the
dirty_freerun_ceiling is the average of those, ~150. So, it pauses the
dirtying processes when we have 151 dirty pages and wakes up a background
writeback worker. But the worker tests the wrong threshold (200 instead of
100), so it does not initiate writeback and just returns.
Thus, balance_dirty_pages keeps looping, sleeping and then waking up the
worker who will do nothing. It remains stuck in this state until the few
dirty pages that we have finally expire and we write them back for that
reason. Then the whole process repeats, resulting in near-zero throughput
through the FUSE BDI.
The fix is to call the parameterized variant of wb_calc_thresh, so that the
worker will do writeback if the bg_thresh is exceeded which was the
behavior before the referenced commit.
Fixes: 947e9762a8dd ("writeback: update wb_over_bg_thresh() to use wb_domain aware operations")
Signed-off-by: Howard Cochran <hcochran@kernelspring.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Tested-by Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
mm/page-writeback.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 5cccc12..e2447d7 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1889,7 +1889,8 @@ bool wb_over_bg_thresh(struct bdi_writeback *wb)
if (gdtc->dirty > gdtc->bg_thresh)
return true;
- if (wb_stat(wb, WB_RECLAIMABLE) > __wb_calc_thresh(gdtc))
+ if (wb_stat(wb, WB_RECLAIMABLE) >
+ wb_calc_thresh(gdtc->wb, gdtc->bg_thresh))
return true;
if (mdtc) {
@@ -1902,7 +1903,8 @@ bool wb_over_bg_thresh(struct bdi_writeback *wb)
if (mdtc->dirty > mdtc->bg_thresh)
return true;
- if (wb_stat(wb, WB_RECLAIMABLE) > __wb_calc_thresh(mdtc))
+ if (wb_stat(wb, WB_RECLAIMABLE) >
+ wb_calc_thresh(mdtc->wb, mdtc->bg_thresh))
return true;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 46/59] mm, cma: prevent nr_isolated_* counters from going negative
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (44 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 45/59] writeback: Fix performance regression in wb_over_bg_thresh() Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 47/59] x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO Kamal Mostafa
` (12 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Hugh Dickins, Vlastimil Babka, Michal Hocko, Andrew Morton,
Linus Torvalds, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hugh Dickins <hughd@google.com>
commit 14af4a5e9b26ad251f81c174e8a43f3e179434a5 upstream.
/proc/sys/vm/stat_refresh warns nr_isolated_anon and nr_isolated_file go
increasingly negative under compaction: which would add delay when
should be none, or no delay when should delay. The bug in compaction
was due to a recent mmotm patch, but much older instance of the bug was
also noticed in isolate_migratepages_range() which is used for CMA and
gigantic hugepage allocations.
The bug is caused by putback_movable_pages() in an error path
decrementing the isolated counters without them being previously
incremented by acct_isolated(). Fix isolate_migratepages_range() by
removing the error-path putback, thus reaching acct_isolated() with
migratepages still isolated, and leaving putback to caller like most
other places do.
Fixes: edc2ca612496 ("mm, compaction: move pageblock checks up from isolate_migratepages_range()")
[vbabka@suse.cz: expanded the changelog]
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
mm/compaction.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
diff --git a/mm/compaction.c b/mm/compaction.c
index 018f08d..3dcf93c 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -853,16 +853,8 @@ isolate_migratepages_range(struct compact_control *cc, unsigned long start_pfn,
pfn = isolate_migratepages_block(cc, pfn, block_end_pfn,
ISOLATE_UNEVICTABLE);
- /*
- * In case of fatal failure, release everything that might
- * have been isolated in the previous iteration, and signal
- * the failure back to caller.
- */
- if (!pfn) {
- putback_movable_pages(&cc->migratepages);
- cc->nr_migratepages = 0;
+ if (!pfn)
break;
- }
if (cc->nr_migratepages == COMPACT_CLUSTER_MAX)
break;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 47/59] x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (45 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 46/59] mm, cma: prevent nr_isolated_* counters from going negative Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 48/59] parisc: fix a bug when syscall number of tracee is __NR_Linux_syscalls Kamal Mostafa
` (11 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Chen Yu, Rafael J. Wysocki, Bin Gao, Len Brown, Thomas Gleixner,
Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Chen Yu <yu.c.chen@intel.com>
commit 886123fb3a8656699dff40afa0573df359abeb18 upstream.
Currently we read the tsc radio: ratio = (MSR_PLATFORM_INFO >> 8) & 0x1f;
Thus we get bit 8-12 of MSR_PLATFORM_INFO, however according to the SDM
(35.5), the ratio bits are bit 8-15.
Ignoring the upper bits can result in an incorrect tsc ratio, which causes the
TSC calibration and the Local APIC timer frequency to be incorrect.
Fix this problem by masking 0xff instead.
[ tglx: Massaged changelog ]
Fixes: 7da7c1561366 "x86, tsc: Add static (MSR) TSC calibration on Intel Atom SoCs"
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Bin Gao <bin.gao@intel.com>
Cc: Len Brown <lenb@kernel.org>
Link: http://lkml.kernel.org/r/1462505619-5516-1-git-send-email-yu.c.chen@intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/kernel/tsc_msr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
index 92ae6ac..6aa0f4d 100644
--- a/arch/x86/kernel/tsc_msr.c
+++ b/arch/x86/kernel/tsc_msr.c
@@ -92,7 +92,7 @@ unsigned long try_msr_calibrate_tsc(void)
if (freq_desc_tables[cpu_index].msr_plat) {
rdmsr(MSR_PLATFORM_INFO, lo, hi);
- ratio = (lo >> 8) & 0x1f;
+ ratio = (lo >> 8) & 0xff;
} else {
rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
ratio = (hi >> 8) & 0x1f;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 48/59] parisc: fix a bug when syscall number of tracee is __NR_Linux_syscalls
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (46 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 47/59] x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 49/59] jme: Do not enable NIC WoL functions on S0 Kamal Mostafa
` (10 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dmitry V . Levin, Helge Deller, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "Dmitry V. Levin" <ldv@altlinux.org>
commit f0b22d1bb2a37a665a969e95785c75a4f49d1499 upstream.
Do not load one entry beyond the end of the syscall table when the
syscall number of a traced process equals to __NR_Linux_syscalls.
Similar bug with regular processes was fixed by commit 3bb457af4fa8
("[PARISC] Fix bug when syscall nr is __NR_Linux_syscalls").
This bug was found by strace test suite.
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Acked-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/parisc/kernel/syscall.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index 02cf40c..099c236 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -342,7 +342,7 @@ tracesys_next:
stw %r21, -56(%r30) /* 6th argument */
#endif
- comiclr,>>= __NR_Linux_syscalls, %r20, %r0
+ comiclr,>> __NR_Linux_syscalls, %r20, %r0
b,n .Ltracesys_nosys
LDREGX %r20(%r19), %r19
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 49/59] jme: Do not enable NIC WoL functions on S0
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (47 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 48/59] parisc: fix a bug when syscall number of tracee is __NR_Linux_syscalls Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 50/59] jme: Fix device PM wakeup API usage Kamal Mostafa
` (9 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Guo-Fu Tseng, David S . Miller, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Guo-Fu Tseng <cooldavid@cooldavid.org>
commit 0772a99b818079e628a1da122ac7ee023faed83e upstream.
Otherwise it might be back on resume right after going to suspend in
some hardware.
Reported-by: Diego Viola <diego.viola@gmail.com>
Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/ethernet/jme.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 32d240b..73351d2 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -270,11 +270,17 @@ jme_reset_mac_processor(struct jme_adapter *jme)
}
static inline void
-jme_clear_pm(struct jme_adapter *jme)
+jme_clear_pm_enable_wol(struct jme_adapter *jme)
{
jwrite32(jme, JME_PMCS, PMCS_STMASK | jme->reg_pmcs);
}
+static inline void
+jme_clear_pm_disable_wol(struct jme_adapter *jme)
+{
+ jwrite32(jme, JME_PMCS, PMCS_STMASK);
+}
+
static int
jme_reload_eeprom(struct jme_adapter *jme)
{
@@ -1857,7 +1863,7 @@ jme_open(struct net_device *netdev)
struct jme_adapter *jme = netdev_priv(netdev);
int rc;
- jme_clear_pm(jme);
+ jme_clear_pm_disable_wol(jme);
JME_NAPI_ENABLE(jme);
tasklet_init(&jme->linkch_task, jme_link_change_tasklet,
@@ -1933,7 +1939,7 @@ jme_powersave_phy(struct jme_adapter *jme)
jme_set_100m_half(jme);
if (jme->reg_pmcs & (PMCS_LFEN | PMCS_LREN))
jme_wait_link(jme);
- jme_clear_pm(jme);
+ jme_clear_pm_enable_wol(jme);
} else {
jme_phy_off(jme);
}
@@ -2650,7 +2656,6 @@ jme_set_wol(struct net_device *netdev,
if (wol->wolopts & WAKE_MAGIC)
jme->reg_pmcs |= PMCS_MFEN;
- jwrite32(jme, JME_PMCS, jme->reg_pmcs);
device_set_wakeup_enable(&jme->pdev->dev, !!(jme->reg_pmcs));
return 0;
@@ -3176,7 +3181,7 @@ jme_init_one(struct pci_dev *pdev,
jme->mii_if.mdio_read = jme_mdio_read;
jme->mii_if.mdio_write = jme_mdio_write;
- jme_clear_pm(jme);
+ jme_clear_pm_disable_wol(jme);
device_set_wakeup_enable(&pdev->dev, true);
jme_set_phyfifo_5level(jme);
@@ -3308,7 +3313,7 @@ jme_resume(struct device *dev)
if (!netif_running(netdev))
return 0;
- jme_clear_pm(jme);
+ jme_clear_pm_disable_wol(jme);
jme_phy_on(jme);
if (test_bit(JME_FLAG_SSET, &jme->flags))
jme_set_settings(netdev, &jme->old_ecmd);
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 50/59] jme: Fix device PM wakeup API usage
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (48 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 49/59] jme: Do not enable NIC WoL functions on S0 Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 51/59] net/mlx4_en: fix spurious timestamping callbacks Kamal Mostafa
` (8 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Guo-Fu Tseng, David S . Miller, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Guo-Fu Tseng <cooldavid@cooldavid.org>
commit 81422e672f8181d7ad1ee6c60c723aac649f538f upstream.
According to Documentation/power/devices.txt
The driver should not use device_set_wakeup_enable() which is the policy
for user to decide.
Using device_init_wakeup() to initialize dev->power.should_wakeup and
dev->power.can_wakeup on driver initialization.
And use device_may_wakeup() on suspend to decide if WoL function should
be enabled on NIC.
Reported-by: Diego Viola <diego.viola@gmail.com>
Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/ethernet/jme.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 73351d2..46e8d5b 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -1935,7 +1935,7 @@ jme_wait_link(struct jme_adapter *jme)
static void
jme_powersave_phy(struct jme_adapter *jme)
{
- if (jme->reg_pmcs) {
+ if (jme->reg_pmcs && device_may_wakeup(&jme->pdev->dev)) {
jme_set_100m_half(jme);
if (jme->reg_pmcs & (PMCS_LFEN | PMCS_LREN))
jme_wait_link(jme);
@@ -2656,8 +2656,6 @@ jme_set_wol(struct net_device *netdev,
if (wol->wolopts & WAKE_MAGIC)
jme->reg_pmcs |= PMCS_MFEN;
- device_set_wakeup_enable(&jme->pdev->dev, !!(jme->reg_pmcs));
-
return 0;
}
@@ -3182,7 +3180,7 @@ jme_init_one(struct pci_dev *pdev,
jme->mii_if.mdio_write = jme_mdio_write;
jme_clear_pm_disable_wol(jme);
- device_set_wakeup_enable(&pdev->dev, true);
+ device_init_wakeup(&pdev->dev, true);
jme_set_phyfifo_5level(jme);
jme->pcirev = pdev->revision;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 51/59] net/mlx4_en: fix spurious timestamping callbacks
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (49 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 50/59] jme: Fix device PM wakeup API usage Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 52/59] batman-adv: Reduce refcnt of removed router when updating route Kamal Mostafa
` (7 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric Dumazet, Willem de Bruijn, David S . Miller, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eric Dumazet <edumazet@google.com>
commit fc96256c906362e845d848d0f6a6354450059e81 upstream.
When multiple skb are TX-completed in a row, we might incorrectly keep
a timestamp of a prior skb and cause extra work.
Fixes: ec693d47010e8 ("net/mlx4_en: Add HW timestamping (TS) support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Reviewed-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/ethernet/mellanox/mlx4/en_tx.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index c10d98f..a1b4301 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -400,7 +400,6 @@ static bool mlx4_en_process_tx_cq(struct net_device *dev,
u32 packets = 0;
u32 bytes = 0;
int factor = priv->cqe_factor;
- u64 timestamp = 0;
int done = 0;
int budget = priv->tx_work_limit;
u32 last_nr_txbb;
@@ -440,9 +439,12 @@ static bool mlx4_en_process_tx_cq(struct net_device *dev,
new_index = be16_to_cpu(cqe->wqe_index) & size_mask;
do {
+ u64 timestamp = 0;
+
txbbs_skipped += last_nr_txbb;
ring_index = (ring_index + last_nr_txbb) & size_mask;
- if (ring->tx_info[ring_index].ts_requested)
+
+ if (unlikely(ring->tx_info[ring_index].ts_requested))
timestamp = mlx4_en_get_cqe_ts(cqe);
/* free next descriptor */
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 52/59] batman-adv: Reduce refcnt of removed router when updating route
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (50 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 51/59] net/mlx4_en: fix spurious timestamping callbacks Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 53/59] batman-adv: Check skb size before using encapsulated ETH+VLAN header Kamal Mostafa
` (6 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Sven Eckelmann, Marek Lindner, Antonio Quartulli, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Sven Eckelmann <sven@narfation.org>
commit d1a65f1741bfd9c69f9e4e2ad447a89b6810427d upstream.
_batadv_update_route rcu_derefences orig_ifinfo->router outside of a
spinlock protected region to print some information messages to the debug
log. But this pointer is not checked again when the new pointer is assigned
in the spinlock protected region. Thus is can happen that the value of
orig_ifinfo->router changed in the meantime and thus the reference counter
of the wrong router gets reduced after the spinlock protected region.
Just rcu_dereferencing the value of orig_ifinfo->router inside the spinlock
protected region (which also set the new pointer) is enough to get the
correct old router object.
Fixes: e1a5382f978b ("batman-adv: Make orig_node->router an rcu protected pointer")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/batman-adv/routing.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index c360c0c..cf57b20 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -104,6 +104,15 @@ static void _batadv_update_route(struct batadv_priv *bat_priv,
neigh_node = NULL;
spin_lock_bh(&orig_node->neigh_list_lock);
+ /* curr_router used earlier may not be the current orig_ifinfo->router
+ * anymore because it was dereferenced outside of the neigh_list_lock
+ * protected region. After the new best neighbor has replace the current
+ * best neighbor the reference counter needs to decrease. Consequently,
+ * the code needs to ensure the curr_router variable contains a pointer
+ * to the replaced best neighbor.
+ */
+ curr_router = rcu_dereference_protected(orig_ifinfo->router, true);
+
rcu_assign_pointer(orig_ifinfo->router, neigh_node);
spin_unlock_bh(&orig_node->neigh_list_lock);
batadv_orig_ifinfo_free_ref(orig_ifinfo);
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 53/59] batman-adv: Check skb size before using encapsulated ETH+VLAN header
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (51 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 52/59] batman-adv: Reduce refcnt of removed router when updating route Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 54/59] batman-adv: Fix broadcast/ogm queue limit on a removed interface Kamal Mostafa
` (5 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Sven Eckelmann, Marek Lindner, Antonio Quartulli, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Sven Eckelmann <sven@narfation.org>
commit c78296665c3d81f040117432ab9e1cb125521b0c upstream.
The encapsulated ethernet and VLAN header may be outside the received
ethernet frame. Thus the skb buffer size has to be checked before it can be
parsed to find out if it encapsulates another batman-adv packet.
Fixes: 420193573f11 ("batman-adv: softif bridge loop avoidance")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/batman-adv/soft-interface.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 51cda3a..5b45f1d 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -407,11 +407,17 @@ void batadv_interface_rx(struct net_device *soft_iface,
*/
nf_reset(skb);
+ if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
+ goto dropped;
+
vid = batadv_get_vid(skb, 0);
ethhdr = eth_hdr(skb);
switch (ntohs(ethhdr->h_proto)) {
case ETH_P_8021Q:
+ if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
+ goto dropped;
+
vhdr = (struct vlan_ethhdr *)skb->data;
if (vhdr->h_vlan_encapsulated_proto != ethertype)
@@ -423,8 +429,6 @@ void batadv_interface_rx(struct net_device *soft_iface,
}
/* skb->dev & skb->pkt_type are set here */
- if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
- goto dropped;
skb->protocol = eth_type_trans(skb, soft_iface);
/* should not be necessary anymore as we use skb_pull_rcsum()
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 54/59] batman-adv: Fix broadcast/ogm queue limit on a removed interface
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (52 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 53/59] batman-adv: Check skb size before using encapsulated ETH+VLAN header Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 55/59] mm: update min_free_kbytes from khugepaged after core initialization Kamal Mostafa
` (4 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Linus Lüssing, Sven Eckelmann, Marek Lindner,
Antonio Quartulli, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
commit c4fdb6cff2aa0ae740c5f19b6f745cbbe786d42f upstream.
When removing a single interface while a broadcast or ogm packet is
still pending then we will free the forward packet without releasing the
queue slots again.
This patch is supposed to fix this issue.
Fixes: 6d5808d4ae1b ("batman-adv: Add missing hardif_free_ref in forw_packet_free")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
[sven@narfation.org: fix conflicts with current version]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/batman-adv/send.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 0a01992..f7075ff 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -629,6 +629,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
if (pending) {
hlist_del(&forw_packet->list);
+ if (!forw_packet->own)
+ atomic_inc(&bat_priv->bcast_queue_left);
+
batadv_forw_packet_free(forw_packet);
}
}
@@ -656,6 +659,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
if (pending) {
hlist_del(&forw_packet->list);
+ if (!forw_packet->own)
+ atomic_inc(&bat_priv->batman_queue_left);
+
batadv_forw_packet_free(forw_packet);
}
}
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 55/59] mm: update min_free_kbytes from khugepaged after core initialization
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (53 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 54/59] batman-adv: Fix broadcast/ogm queue limit on a removed interface Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 56/59] ARM: EXYNOS: Properly skip unitialized parent clock in power domain on Kamal Mostafa
` (3 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jason Baron, Andrew Morton, Linus Torvalds, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jason Baron <jbaron@akamai.com>
commit bc22af74f271ef76b2e6f72f3941f91f0da3f5f8 upstream.
Khugepaged attempts to raise min_free_kbytes if its set too low.
However, on boot khugepaged sets min_free_kbytes first from
subsys_initcall(), and then the mm 'core' over-rides min_free_kbytes
after from init_per_zone_wmark_min(), via a module_init() call.
Khugepaged used to use a late_initcall() to set min_free_kbytes (such
that it occurred after the core initialization), however this was
removed when the initialization of min_free_kbytes was integrated into
the starting of the khugepaged thread.
The fix here is simply to invoke the core initialization using a
core_initcall() instead of module_init(), such that the previous
initialization ordering is restored. I didn't restore the
late_initcall() since start_stop_khugepaged() already sets
min_free_kbytes via set_recommended_min_free_kbytes().
This was noticed when we had a number of page allocation failures when
moving a workload to a kernel with this new initialization ordering. On
an 8GB system this restores min_free_kbytes back to 67584 from 11365
when CONFIG_TRANSPARENT_HUGEPAGE=y is set and either
CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y or
CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y.
Fixes: 79553da293d3 ("thp: cleanup khugepaged startup")
Signed-off-by: Jason Baron <jbaron@akamai.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
mm/page_alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 240c22d..6d95dea 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -6319,7 +6319,7 @@ int __meminit init_per_zone_wmark_min(void)
setup_per_zone_inactive_ratio();
return 0;
}
-module_init(init_per_zone_wmark_min)
+core_initcall(init_per_zone_wmark_min)
/*
* min_free_kbytes_sysctl_handler - just a wrapper around proc_dointvec() so
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 56/59] ARM: EXYNOS: Properly skip unitialized parent clock in power domain on
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (54 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 55/59] mm: update min_free_kbytes from khugepaged after core initialization Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 57/59] net/mlx5e: Fix MLX5E_100BASE_T define Kamal Mostafa
` (2 subsequent siblings)
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Krzysztof Kozlowski, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit a0a966b83873f33778710a4fc59240244b0734a5 upstream.
We want to skip reparenting a clock on turning on power domain, if we
do not have the parent yet. The parent is obtained when turning the
domain off. However due to a typo, the loop is continued on IS_ERR() of
clock being reparented, not on the IS_ERR() of the parent.
Theoretically this could lead to OOPS on first turn on of a power
domain, if there was no turn off before. Practically that should never
happen because all power domains are turned on by default (reset value,
bootloader does not turn off them usually) so the first action will be
always turn off.
Fixes: 29e5eea06bc1 ("ARM: EXYNOS: Get current parent clock for power domain on/off")
Reported-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/arm/mach-exynos/pm_domains.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-exynos/pm_domains.c b/arch/arm/mach-exynos/pm_domains.c
index 7c21760..875a2ba 100644
--- a/arch/arm/mach-exynos/pm_domains.c
+++ b/arch/arm/mach-exynos/pm_domains.c
@@ -92,7 +92,7 @@ static int exynos_pd_power(struct generic_pm_domain *domain, bool power_on)
if (IS_ERR(pd->clk[i]))
break;
- if (IS_ERR(pd->clk[i]))
+ if (IS_ERR(pd->pclk[i]))
continue; /* Skip on first power up */
if (clk_set_parent(pd->clk[i], pd->pclk[i]))
pr_err("%s: error setting parent to clock%d\n",
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 57/59] net/mlx5e: Fix MLX5E_100BASE_T define
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (55 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 56/59] ARM: EXYNOS: Properly skip unitialized parent clock in power domain on Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 58/59] cxgbi: fix uninitialized flowi6 Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 59/59] RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips Kamal Mostafa
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Rana Shahout, Saeed Mahameed, David S . Miller, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Rana Shahout <ranas@mellanox.com>
commit 6e4c21894673baabdbef03c3ac2458a28246128b upstream.
Bit 25 of eth_proto_capability in PTYS register is
1000Base-TT and not 100Base-T.
Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to
support ConnectX-4 Ethernet functionality')
Signed-off-by: Rana Shahout <ranas@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 ++++----
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 09e8331..0db9dd3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -438,7 +438,7 @@ enum mlx5e_link_mode {
MLX5E_100GBASE_KR4 = 22,
MLX5E_100GBASE_LR4 = 23,
MLX5E_100BASE_TX = 24,
- MLX5E_100BASE_T = 25,
+ MLX5E_1000BASE_T = 25,
MLX5E_10GBASE_T = 26,
MLX5E_25GBASE_CR = 27,
MLX5E_25GBASE_KR = 28,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 3889384..c92c474 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -138,10 +138,10 @@ static const struct {
[MLX5E_100BASE_TX] = {
.speed = 100,
},
- [MLX5E_100BASE_T] = {
- .supported = SUPPORTED_100baseT_Full,
- .advertised = ADVERTISED_100baseT_Full,
- .speed = 100,
+ [MLX5E_1000BASE_T] = {
+ .supported = SUPPORTED_1000baseT_Full,
+ .advertised = ADVERTISED_1000baseT_Full,
+ .speed = 1000,
},
[MLX5E_10GBASE_T] = {
.supported = SUPPORTED_10000baseT_Full,
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 58/59] cxgbi: fix uninitialized flowi6
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (56 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 57/59] net/mlx5e: Fix MLX5E_100BASE_T define Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 59/59] RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips Kamal Mostafa
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jiri Benc, David S . Miller, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jiri Benc <jbenc@redhat.com>
commit 3d6d30d60abb19ba9a20e53ce65b18a9c148fcd1 upstream.
ip6_route_output looks into different fields in the passed flowi6 structure,
yet cxgbi passes garbage in nearly all those fields. Zero the structure out
first.
Fixes: fc8d0590d9142 ("libcxgbi: Add ipv6 api to driver")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/scsi/cxgbi/libcxgbi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index f3bb7af..ead83a2 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -688,6 +688,7 @@ static struct rt6_info *find_route_ipv6(const struct in6_addr *saddr,
{
struct flowi6 fl;
+ memset(&fl, 0, sizeof(fl));
if (saddr)
memcpy(&fl.saddr, saddr, sizeof(struct in6_addr));
if (daddr)
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread* [PATCH 4.2.y-ckt 59/59] RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
` (57 preceding siblings ...)
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 58/59] cxgbi: fix uninitialized flowi6 Kamal Mostafa
@ 2016-05-09 19:56 ` Kamal Mostafa
58 siblings, 0 replies; 60+ messages in thread
From: Kamal Mostafa @ 2016-05-09 19:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Steve Wise, Hariprasad Shenai, Doug Ledford, Kamal Mostafa
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hariprasad S <hariprasad@chelsio.com>
commit 32cc92c7b5e52357a0a24010bae9eb257fa75d3e upstream.
For T4, kernel mode qps don't use the user doorbell. User mode qps during
flow control db ringing are forced into kernel, where user doorbell is
treated as kernel doorbell and proper bar2 offset in bar2 virtual space is
calculated, which incase of T4 is a bogus address, causing a kernel panic
due to illegal write during doorbell ringing.
In case of T4, kernel mode qp bar2 virtual address should be 0. Added T4
check during bar2 virtual address calculation to return 0. Fixed Bar2
range checks based on bar2 physical address.
The below oops will be fixed
<1>BUG: unable to handle kernel paging request at 000000000002aa08
<1>IP: [<ffffffffa011d800>] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4]
<4>PGD 1416a8067 PUD 15bf35067 PMD 0
<4>Oops: 0002 [#1] SMP
<4>last sysfs file:
/sys/devices/pci0000:00/0000:00:03.0/0000:02:00.4/infiniband/cxgb4_0/node_guid
<4>CPU 5
<4>Modules linked in: rdma_ucm rdma_cm ib_cm ib_sa ib_mad ib_uverbs
ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE
iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack
ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables bridge autofs4
target_core_iblock target_core_file target_core_pscsi target_core_mod
configfs bnx2fc cnic uio fcoe libfcoe libfc scsi_transport_fc scsi_tgt 8021q
garp stp llc cpufreq_ondemand acpi_cpufreq freq_table mperf vhost_net macvtap
macvlan tun kvm uinput microcode iTCO_wdt iTCO_vendor_support sg joydev
serio_raw i2c_i801 i2c_core lpc_ich mfd_core e1000e ptp pps_core ioatdma dca
i7core_edac edac_core shpchp ext3 jbd mbcache sd_mod crc_t10dif pata_acpi
ata_generic ata_piix iw_cxgb4 iw_cm ib_core ib_addr cxgb4 ipv6 dm_mirror
dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
<4>
Supermicro X8ST3/X8ST3
<4>RIP: 0010:[<ffffffffa011d800>] [<ffffffffa011d800>]
c4iw_uld_control+0x4e0/0x880 [iw_cxgb4]
<4>RSP: 0000:ffff880155a03db0 EFLAGS: 00010006
<4>RAX: 000000000000001d RBX: ffff88013ae5fc00 RCX: ffff880155adb180
<4>RDX: 000000000002aa00 RSI: 0000000000000001 RDI: ffff88013ae5fdf8
<4>RBP: ffff880155a03e10 R08: 0000000000000000 R09: 0000000000000001
<4>R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
<4>R13: 000000000000001d R14: ffff880156414ab0 R15: ffffe8ffffc05b88
<4>FS: 0000000000000000(0000) GS:ffff8800282a0000(0000) knlGS:0000000000000000
<4>CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
<4>CR2: 000000000002aa08 CR3: 000000015bd0e000 CR4: 00000000000007e0
<4>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
<4>DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
<4>Process cxgb4 (pid: 394, threadinfo ffff880155a00000, task ffff880156414ab0)
<4>Stack:
<4> ffff880156415068 ffff880155adb180 ffff880155a03df0 ffffffffa00a344b
<4><d> 00000000000003e8 ffff880155920000 0000000000000004 ffff880155920000
<4><d> ffff88015592d438 ffffffffa00a3860 ffff880155a03fd8 ffffe8ffffc05b88
<4>Call Trace:
<4> [<ffffffffa00a344b>] ? enable_txq_db+0x2b/0x80 [cxgb4]
<4> [<ffffffffa00a3860>] ? process_db_full+0x0/0xa0 [cxgb4]
<4> [<ffffffffa00a38a6>] process_db_full+0x46/0xa0 [cxgb4]
<4> [<ffffffff8109fda0>] worker_thread+0x170/0x2a0
<4> [<ffffffff810a6aa0>] ? autoremove_wake_function+0x0/0x40
<4> [<ffffffff8109fc30>] ? worker_thread+0x0/0x2a0
<4> [<ffffffff810a660e>] kthread+0x9e/0xc0
<4> [<ffffffff8100c28a>] child_rip+0xa/0x20
<4> [<ffffffff810a6570>] ? kthread+0x0/0xc0
<4> [<ffffffff8100c280>] ? child_rip+0x0/0x20
<4>Code: e9 ba 00 00 00 66 0f 1f 44 00 00 44 8b 05 29 07 02 00 45 85 c0 0f 85
71 02 00 00 8b 83 70 01 00 00 45 0f b7 ed c1 e0 0f 44 09 e8 <89> 42 08 0f ae f8
66 c7 83 82 01 00 00 00 00 44 0f b7 ab dc 01
<1>RIP [<ffffffffa011d800>] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4]
<4> RSP <ffff880155a03db0>
<4>CR2: 000000000002aa08`
Based on original work by Bharat Potnuri <bharat@chelsio.com>
Fixes: 74217d4c6a4fb0d8 ("iw_cxgb4: support for bar2 qid densities exceeding the page size")
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
Reviewed-by: Leon Romanovsky <leon@leon.nu>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/infiniband/hw/cxgb4/cq.c | 2 +-
drivers/infiniband/hw/cxgb4/qp.c | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 92d5183..c268257 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -162,7 +162,7 @@ static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
cq->bar2_va = c4iw_bar2_addrs(rdev, cq->cqid, T4_BAR2_QTYPE_INGRESS,
&cq->bar2_qid,
user ? &cq->bar2_pa : NULL);
- if (user && !cq->bar2_va) {
+ if (user && !cq->bar2_pa) {
pr_warn(MOD "%s: cqid %u not in BAR2 range.\n",
pci_name(rdev->lldi.pdev), cq->cqid);
ret = -EINVAL;
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 6517e12..74ec45f 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -185,6 +185,10 @@ void __iomem *c4iw_bar2_addrs(struct c4iw_rdev *rdev, unsigned int qid,
if (pbar2_pa)
*pbar2_pa = (rdev->bar2_pa + bar2_qoffset) & PAGE_MASK;
+
+ if (is_t4(rdev->lldi.adapter_type))
+ return NULL;
+
return rdev->bar2_kva + bar2_qoffset;
}
@@ -270,7 +274,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
/*
* User mode must have bar2 access.
*/
- if (user && (!wq->sq.bar2_va || !wq->rq.bar2_va)) {
+ if (user && (!wq->sq.bar2_pa || !wq->rq.bar2_pa)) {
pr_warn(MOD "%s: sqid %u or rqid %u not in BAR2 range.\n",
pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid);
goto free_dma;
--
2.7.4
^ permalink raw reply related [flat|nested] 60+ messages in thread