* [PATCH 4.6 001/203] cfg80211: remove get/set antenna and tx power warnings
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 002/203] mac80211: fix fast_tx header alignment Greg Kroah-Hartman
` (192 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Berg
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 6cbf6236d54c24b9a29e6892549c25b6902b44ce upstream.
Since set_tx_power and set_antenna are frequently implemented
without the matching get_tx_power/get_antenna, we shouldn't
have added warnings for those. Remove them.
The remaining ones are correct and need to be implemented
symmetrically for correct operation.
Fixes: de3bb771f471 ("cfg80211: add more warnings for inconsistent ops")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/core.c | 2 --
1 file changed, 2 deletions(-)
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -360,8 +360,6 @@ struct wiphy *wiphy_new_nm(const struct
WARN_ON(ops->remain_on_channel && !ops->cancel_remain_on_channel);
WARN_ON(ops->tdls_channel_switch && !ops->tdls_cancel_channel_switch);
WARN_ON(ops->add_tx_ts && !ops->del_tx_ts);
- WARN_ON(ops->set_tx_power && !ops->get_tx_power);
- WARN_ON(ops->set_antenna && !ops->get_antenna);
alloc_size = sizeof(*rdev) + sizeof_priv;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 002/203] mac80211: fix fast_tx header alignment
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 001/203] cfg80211: remove get/set antenna and tx power warnings Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 003/203] mac80211: mesh: flush mesh paths unconditionally Greg Kroah-Hartman
` (191 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Johannes Berg
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
commit 6fe04128f158c5ad27e7504bfdf1b12e63331bc9 upstream.
The header field is defined as u8[] but also accessed as struct
ieee80211_hdr. Enforce an alignment of 2 to prevent unnecessary
unaligned accesses, which can be very harmful for performance on many
platforms.
Fixes: e495c24731a2 ("mac80211: extend fast-xmit for more ciphers")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/sta_info.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -275,7 +275,7 @@ struct ieee80211_fast_tx {
u8 sa_offs, da_offs, pn_offs;
u8 band;
u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
- sizeof(rfc1042_header)];
+ sizeof(rfc1042_header)] __aligned(2);
struct rcu_head rcu_head;
};
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 003/203] mac80211: mesh: flush mesh paths unconditionally
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 001/203] cfg80211: remove get/set antenna and tx power warnings Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 002/203] mac80211: fix fast_tx header alignment Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 004/203] mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL Greg Kroah-Hartman
` (190 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fred Veldini, Bob Copeland, Johannes Berg
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Copeland <me@bobcopeland.com>
commit fe7a7c57629e8dcbc0e297363a9b2366d67a6dc5 upstream.
Currently, the mesh paths associated with a nexthop station are cleaned
up in the following code path:
__sta_info_destroy_part1
synchronize_net()
__sta_info_destroy_part2
-> cleanup_single_sta
-> mesh_sta_cleanup
-> mesh_plink_deactivate
-> mesh_path_flush_by_nexthop
However, there are a couple of problems here:
1) the paths aren't flushed at all if the MPM is running in userspace
(e.g. when using wpa_supplicant or authsae)
2) there is no synchronize_rcu between removing the path and readers
accessing the nexthop, which means the following race is possible:
CPU0 CPU1
~~~~ ~~~~
sta_info_destroy_part1()
synchronize_net()
rcu_read_lock()
mesh_nexthop_resolve()
mpath = mesh_path_lookup()
[...] -> mesh_path_flush_by_nexthop()
sta = rcu_dereference(
mpath->next_hop)
kfree(sta)
access sta <-- CRASH
Fix both of these by unconditionally flushing paths before destroying
the sta, and by adding a synchronize_net() after path flush to ensure
no active readers can still dereference the sta.
Fixes this crash:
[ 348.529295] BUG: unable to handle kernel paging request at 00020040
[ 348.530014] IP: [<f929245d>] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
[ 348.530014] *pde = 00000000
[ 348.530014] Oops: 0000 [#1] PREEMPT
[ 348.530014] Modules linked in: drbg ansi_cprng ctr ccm ppp_generic slhc ipt_MASQUERADE nf_nat_masquerade_ipv4 8021q ]
[ 348.530014] CPU: 0 PID: 20597 Comm: wget Tainted: G O 4.6.0-rc5-wt=V1 #1
[ 348.530014] Hardware name: To Be Filled By O.E.M./To be filled by O.E.M., BIOS 080016 11/07/2014
[ 348.530014] task: f64fa280 ti: f4f9c000 task.ti: f4f9c000
[ 348.530014] EIP: 0060:[<f929245d>] EFLAGS: 00010246 CPU: 0
[ 348.530014] EIP is at ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
[ 348.530014] EAX: f4ce63e0 EBX: 00000088 ECX: f3788416 EDX: 00020008
[ 348.530014] ESI: 00000000 EDI: 00000088 EBP: f6409a4c ESP: f6409a40
[ 348.530014] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[ 348.530014] CR0: 80050033 CR2: 00020040 CR3: 33190000 CR4: 00000690
[ 348.530014] Stack:
[ 348.530014] 00000000 f4ce63e0 f5f9bd80 f6409a64 f9291d80 0000ce67 f5d51e00 f4ce63e0
[ 348.530014] f3788416 f6409a80 f9291dc1 f4ce8320 f4ce63e0 f5d51e00 f4ce63e0 f4ce8320
[ 348.530014] f6409a98 f9277f6f 00000000 00000000 0000007c 00000000 f6409b2c f9278dd1
[ 348.530014] Call Trace:
[ 348.530014] [<f9291d80>] mesh_nexthop_lookup+0xbb/0xc8 [mac80211]
[ 348.530014] [<f9291dc1>] mesh_nexthop_resolve+0x34/0xd8 [mac80211]
[ 348.530014] [<f9277f6f>] ieee80211_xmit+0x92/0xc1 [mac80211]
[ 348.530014] [<f9278dd1>] __ieee80211_subif_start_xmit+0x807/0x83c [mac80211]
[ 348.530014] [<c04df012>] ? sch_direct_xmit+0xd7/0x1b3
[ 348.530014] [<c022a8c6>] ? __local_bh_enable_ip+0x5d/0x7b
[ 348.530014] [<f956870c>] ? nf_nat_ipv4_out+0x4c/0xd0 [nf_nat_ipv4]
[ 348.530014] [<f957e036>] ? iptable_nat_ipv4_fn+0xf/0xf [iptable_nat]
[ 348.530014] [<c04c6f45>] ? netif_skb_features+0x14d/0x30a
[ 348.530014] [<f9278e10>] ieee80211_subif_start_xmit+0xa/0xe [mac80211]
[ 348.530014] [<c04c769c>] dev_hard_start_xmit+0x1f8/0x267
[ 348.530014] [<c04c7261>] ? validate_xmit_skb.isra.120.part.121+0x10/0x253
[ 348.530014] [<c04defc6>] sch_direct_xmit+0x8b/0x1b3
[ 348.530014] [<c04c7a9c>] __dev_queue_xmit+0x2c8/0x513
[ 348.530014] [<c04c7cfb>] dev_queue_xmit+0xa/0xc
[ 348.530014] [<f91bfc7a>] batadv_send_skb_packet+0xd6/0xec [batman_adv]
[ 348.530014] [<f91bfdc4>] batadv_send_unicast_skb+0x15/0x4a [batman_adv]
[ 348.530014] [<f91b5938>] batadv_dat_send_data+0x27e/0x310 [batman_adv]
[ 348.530014] [<f91c30b5>] ? batadv_tt_global_hash_find.isra.11+0x8/0xa [batman_adv]
[ 348.530014] [<f91b63f3>] batadv_dat_snoop_outgoing_arp_request+0x208/0x23d [batman_adv]
[ 348.530014] [<f91c0cd9>] batadv_interface_tx+0x206/0x385 [batman_adv]
[ 348.530014] [<c04c769c>] dev_hard_start_xmit+0x1f8/0x267
[ 348.530014] [<c04c7261>] ? validate_xmit_skb.isra.120.part.121+0x10/0x253
[ 348.530014] [<c04defc6>] sch_direct_xmit+0x8b/0x1b3
[ 348.530014] [<c04c7a9c>] __dev_queue_xmit+0x2c8/0x513
[ 348.530014] [<f80cbd2a>] ? igb_xmit_frame+0x57/0x72 [igb]
[ 348.530014] [<c04c7cfb>] dev_queue_xmit+0xa/0xc
[ 348.530014] [<f843a326>] br_dev_queue_push_xmit+0xeb/0xfb [bridge]
[ 348.530014] [<f843a35f>] br_forward_finish+0x29/0x74 [bridge]
[ 348.530014] [<f843a23b>] ? deliver_clone+0x3b/0x3b [bridge]
[ 348.530014] [<f843a714>] __br_forward+0x89/0xe7 [bridge]
[ 348.530014] [<f843a336>] ? br_dev_queue_push_xmit+0xfb/0xfb [bridge]
[ 348.530014] [<f843a234>] deliver_clone+0x34/0x3b [bridge]
[ 348.530014] [<f843a68b>] ? br_flood+0x95/0x95 [bridge]
[ 348.530014] [<f843a66d>] br_flood+0x77/0x95 [bridge]
[ 348.530014] [<f843a809>] br_flood_forward+0x13/0x1a [bridge]
[ 348.530014] [<f843a68b>] ? br_flood+0x95/0x95 [bridge]
[ 348.530014] [<f843b877>] br_handle_frame_finish+0x392/0x3db [bridge]
[ 348.530014] [<c04e9b2b>] ? nf_iterate+0x2b/0x6b
[ 348.530014] [<f843baa6>] br_handle_frame+0x1e6/0x240 [bridge]
[ 348.530014] [<f843b4e5>] ? br_handle_local_finish+0x6a/0x6a [bridge]
[ 348.530014] [<c04c4ba0>] __netif_receive_skb_core+0x43a/0x66b
[ 348.530014] [<f843b8c0>] ? br_handle_frame_finish+0x3db/0x3db [bridge]
[ 348.530014] [<c023cea4>] ? resched_curr+0x19/0x37
[ 348.530014] [<c0240707>] ? check_preempt_wakeup+0xbf/0xfe
[ 348.530014] [<c0255dec>] ? ktime_get_with_offset+0x5c/0xfc
[ 348.530014] [<c04c4fc1>] __netif_receive_skb+0x47/0x55
[ 348.530014] [<c04c57ba>] netif_receive_skb_internal+0x40/0x5a
[ 348.530014] [<c04c61ef>] napi_gro_receive+0x3a/0x94
[ 348.530014] [<f80ce8d5>] igb_poll+0x6fd/0x9ad [igb]
[ 348.530014] [<c0242bd8>] ? swake_up_locked+0x14/0x26
[ 348.530014] [<c04c5d29>] net_rx_action+0xde/0x250
[ 348.530014] [<c022a743>] __do_softirq+0x8a/0x163
[ 348.530014] [<c022a6b9>] ? __hrtimer_tasklet_trampoline+0x19/0x19
[ 348.530014] [<c021100f>] do_softirq_own_stack+0x26/0x2c
[ 348.530014] <IRQ>
[ 348.530014] [<c022a957>] irq_exit+0x31/0x6f
[ 348.530014] [<c0210eb2>] do_IRQ+0x8d/0xa0
[ 348.530014] [<c058152c>] common_interrupt+0x2c/0x40
[ 348.530014] Code: e7 8c 00 66 81 ff 88 00 75 12 85 d2 75 0e b2 c3 b8 83 e9 29 f9 e8 a7 5f f9 c6 eb 74 66 81 e3 8c 005
[ 348.530014] EIP: [<f929245d>] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] SS:ESP 0068:f6409a40
[ 348.530014] CR2: 0000000000020040
[ 348.530014] ---[ end trace 48556ac26779732e ]---
[ 348.530014] Kernel panic - not syncing: Fatal exception in interrupt
[ 348.530014] Kernel Offset: disabled
Reported-by: Fred Veldini <fred.veldini@gmail.com>
Tested-by: Fred Veldini <fred.veldini@gmail.com>
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/mesh.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -163,6 +163,10 @@ void mesh_sta_cleanup(struct sta_info *s
del_timer_sync(&sta->mesh->plink_timer);
}
+ /* make sure no readers can access nexthop sta from here on */
+ mesh_path_flush_by_nexthop(sta);
+ synchronize_net();
+
if (changed)
ieee80211_mbss_info_change_notify(sdata, changed);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 004/203] mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 003/203] mac80211: mesh: flush mesh paths unconditionally Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 005/203] mac80211: Fix mesh estab_plinks counting in STA removal case Greg Kroah-Hartman
` (189 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Willi, Johannes Berg
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Willi <martin@strongswan.org>
commit 62397da50bb20a6b812c949ef465d7e69fe54bb6 upstream.
A wmediumd that does not send this attribute causes a NULL pointer
dereference, as the attribute is accessed even if it does not exist.
The attribute was required but never checked ever since userspace frame
forwarding has been introduced. The issue gets more problematic once we
allow wmediumd registration from user namespaces.
Fixes: 7882513bacb1 ("mac80211_hwsim driver support userspace frame tx/rx")
Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mac80211_hwsim.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2771,6 +2771,7 @@ static int hwsim_tx_info_frame_received_
if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
!info->attrs[HWSIM_ATTR_FLAGS] ||
!info->attrs[HWSIM_ATTR_COOKIE] ||
+ !info->attrs[HWSIM_ATTR_SIGNAL] ||
!info->attrs[HWSIM_ATTR_TX_INFO])
goto out;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 005/203] mac80211: Fix mesh estab_plinks counting in STA removal case
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 004/203] mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 006/203] cfg80211: fix proto in ieee80211_data_to_8023 for frames without LLC header Greg Kroah-Hartman
` (188 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jouni Malinen, Johannes Berg
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jouni Malinen <j@w1.fi>
commit 126e7557328a1cd576be4fca95b133a2695283ff upstream.
If a user space program (e.g., wpa_supplicant) deletes a STA entry that
is currently in NL80211_PLINK_ESTAB state, the number of established
plinks counter was not decremented and this could result in rejecting
new plink establishment before really hitting the real maximum plink
limit. For !user_mpm case, this decrementation is handled by
mesh_plink_deactive().
Fix this by decrementing estab_plinks on STA deletion
(mesh_sta_cleanup() gets called from there) so that the counter has a
correct value and the Beacon frame advertisement in Mesh Configuration
element shows the proper value for capability to accept additional
peers.
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/mesh.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -150,14 +150,17 @@ u32 mesh_accept_plinks_update(struct iee
void mesh_sta_cleanup(struct sta_info *sta)
{
struct ieee80211_sub_if_data *sdata = sta->sdata;
- u32 changed;
+ u32 changed = 0;
/*
* maybe userspace handles peer allocation and peering, but in either
* case the beacon is still generated by the kernel and we might need
* an update.
*/
- changed = mesh_accept_plinks_update(sdata);
+ if (sdata->u.mesh.user_mpm &&
+ sta->mesh->plink_state == NL80211_PLINK_ESTAB)
+ changed |= mesh_plink_dec_estab_count(sdata);
+ changed |= mesh_accept_plinks_update(sdata);
if (!sdata->u.mesh.user_mpm) {
changed |= mesh_plink_deactivate(sta);
del_timer_sync(&sta->mesh->plink_timer);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 006/203] cfg80211: fix proto in ieee80211_data_to_8023 for frames without LLC header
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 005/203] mac80211: Fix mesh estab_plinks counting in STA removal case Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 007/203] EDAC: Fix workqueues poll period resetting Greg Kroah-Hartman
` (187 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gerry Rozema, Felix Fietkau, Johannes Berg
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
commit c041778c966c92c964033f1cdfee60a9f2b5e465 upstream.
The PDU length of incoming LLC frames is set to the total skb payload size
in __ieee80211_data_to_8023() of net/wireless/util.c which incorrectly
includes the length of the IEEE 802.11 header.
The resulting LLC frame header has a too large PDU length, causing the
llc_fixup_skb() function of net/llc/llc_input.c to reject the incoming
skb, effectively breaking STP.
Solve the problem by properly substracting the IEEE 802.11 frame header size
from the PDU length, allowing the LLC processor to pick up the incoming
control messages.
Special thanks to Gerry Rozema for tracking down the regression and proposing
a suitable patch.
Fixes: 2d1c304cb2d5 ("cfg80211: add function for 802.3 conversion with separate output buffer")
Reported-by: Gerry Rozema <gerryr@rozeware.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -509,7 +509,7 @@ static int __ieee80211_data_to_8023(stru
* replace EtherType */
hdrlen += ETH_ALEN + 2;
else
- tmp.h_proto = htons(skb->len);
+ tmp.h_proto = htons(skb->len - hdrlen);
pskb_pull(skb, hdrlen);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 007/203] EDAC: Fix workqueues poll period resetting
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 006/203] cfg80211: fix proto in ieee80211_data_to_8023 for frames without LLC header Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 008/203] EDAC, sb_edac: Fix rank lookup on Broadwell Greg Kroah-Hartman
` (186 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Krause,
Mauro Carvalho Chehab, linux-edac, Borislav Petkov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Krause <xerofoify@gmail.com>
commit fbedcaf43fba35677c01a4ae51e6f79edf4049ba upstream.
After the workqueue cleanup, we're registering workqueues based on
the presence of an ->edac_check function. When that is the case,
we're setting OP_RUNNING_POLL. But we forgot to check that in
edac_mc_reset_delay_period(), leading to:
BUG: unable to handle kernel paging request at 0000000000015d10
IP: [ .. ] queued_spin_lock_slowpath
PGD 3ffcc8067 PUD 3ffc56067 PMD 0
Oops: 0002 [#1] SMP
Modules linked in: ...
CPU: 1 PID: 2792 Comm: edactest Not tainted 4.6.0-dirty #1
Hardware name: HP ProLiant MicroServer, BIOS O41 10/01/2013
Stack:
Call Trace:
? _raw_spin_lock_irqsave
? lock_timer_base.isra.34
? del_timer
? try_to_grab_pending
? mod_delayed_work_on
? edac_mc_reset_delay_period
? edac_set_poll_msec
? param_attr_store
? module_attr_store
? kernfs_fop_write
? __vfs_write
? __vfs_read
? __alloc_fd
? vfs_write
? SyS_write
? entry_SYSCALL_64_fastpath
Code:
RIP [ .. ] queued_spin_lock_slowpath
RSP <>
CR2: 0000000000015d10
---[ end trace 3f286bc71cca15d1 ]---
Kernel panic - not syncing: Fatal exception
Fix it.
Signed-off-by: Nicholas Krause <xerofoify@gmail.com>
Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/1463697958-13406-1-git-send-email-xerofoify@gmail.com
[ Rewrite commit message. ]
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/edac_mc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -565,7 +565,8 @@ void edac_mc_reset_delay_period(unsigned
list_for_each(item, &mc_devices) {
mci = list_entry(item, struct mem_ctl_info, link);
- edac_mod_work(&mci->work, value);
+ if (mci->op_state == OP_RUNNING_POLL)
+ edac_mod_work(&mci->work, value);
}
mutex_unlock(&mem_ctls_mutex);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 008/203] EDAC, sb_edac: Fix rank lookup on Broadwell
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 007/203] EDAC: Fix workqueues poll period resetting Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 009/203] futex: Calculate the futex key based on a tail page for file-based futexes Greg Kroah-Hartman
` (185 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tony Luck, Aristeu Rozanski,
Mauro Carvalho Chehab, linux-edac, Borislav Petkov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <tony.luck@intel.com>
commit c7103f650a11328f28b9fa1c95027db331b7774b upstream.
Broadwell made a small change to the rank target register moving the
target rank ID field up from bits 16:19 to bits 20:23.
Also found that the offset field grew by one bit in the IVY_BRIDGE to
HASWELL transition, so fix the RIR_OFFSET() macro too.
Signed-off-by: Tony Luck <tony.luck@intel.com>
Cc: Aristeu Rozanski <arozansk@redhat.com>
Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/2943fb819b1f7e396681165db9c12bb3df0e0b16.1464735623.git.tony.luck@intel.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/sb_edac.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -239,8 +239,11 @@ static const u32 rir_offset[MAX_RIR_RANG
{ 0x1a0, 0x1a4, 0x1a8, 0x1ac, 0x1b0, 0x1b4, 0x1b8, 0x1bc },
};
-#define RIR_RNK_TGT(reg) GET_BITFIELD(reg, 16, 19)
-#define RIR_OFFSET(reg) GET_BITFIELD(reg, 2, 14)
+#define RIR_RNK_TGT(type, reg) (((type) == BROADWELL) ? \
+ GET_BITFIELD(reg, 20, 23) : GET_BITFIELD(reg, 16, 19))
+
+#define RIR_OFFSET(type, reg) (((type) == HASWELL || (type) == BROADWELL) ? \
+ GET_BITFIELD(reg, 2, 15) : GET_BITFIELD(reg, 2, 14))
/* Device 16, functions 2-7 */
@@ -1916,14 +1919,14 @@ static void get_memory_layout(const stru
pci_read_config_dword(pvt->pci_tad[i],
rir_offset[j][k],
®);
- tmp_mb = RIR_OFFSET(reg) << 6;
+ tmp_mb = RIR_OFFSET(pvt->info.type, reg) << 6;
gb = div_u64_rem(tmp_mb, 1024, &mb);
edac_dbg(0, "CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
i, j, k,
gb, (mb*1000)/1024,
((u64)tmp_mb) << 20L,
- (u32)RIR_RNK_TGT(reg),
+ (u32)RIR_RNK_TGT(pvt->info.type, reg),
reg);
}
}
@@ -2256,7 +2259,7 @@ static int get_memory_error_data(struct
pci_read_config_dword(pvt->pci_tad[ch_add + base_ch],
rir_offset[n_rir][idx],
®);
- *rank = RIR_RNK_TGT(reg);
+ *rank = RIR_RNK_TGT(pvt->info.type, reg);
edac_dbg(0, "RIR#%d: channel address 0x%08Lx < 0x%08Lx, RIR interleave %d, index %d\n",
n_rir,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 009/203] futex: Calculate the futex key based on a tail page for file-based futexes
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 008/203] EDAC, sb_edac: Fix rank lookup on Broadwell Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 010/203] IB/core: Fix bit curruption in ib_device_cap_flags structure Greg Kroah-Hartman
` (184 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mel Gorman, Peter Zijlstra (Intel),
Davidlohr Bueso, Sebastian Andrzej Siewior, Thomas Gleixner
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <mgorman@suse.de>
commit 077fa7aed17de5022e44bf07dbaf732078b7b5b2 upstream.
Mike Galbraith reported that the LTP test case futex_wake04 was broken
by commit 65d8fc777f6d ("futex: Remove requirement for lock_page()
in get_futex_key()").
This test case uses futexes backed by hugetlbfs pages and so there is an
associated inode with a futex stored on such pages. The problem is that
the key is being calculated based on the head page index of the hugetlbfs
page and not the tail page.
Prior to the optimisation, the page lock was used to stabilise mappings and
pin the inode is file-backed which is overkill. If the page was a compound
page, the head page was automatically looked up as part of the page lock
operation but the tail page index was used to calculate the futex key.
After the optimisation, the compound head is looked up early and the page
lock is only relied upon to identify truncated pages, special pages or a
shmem page moving to swapcache. The head page is looked up because without
the page lock, special care has to be taken to pin the inode correctly.
However, the tail page is still required to calculate the futex key so
this patch records the tail page.
On vanilla 4.6, the output of the test case is;
futex_wake04 0 TINFO : Hugepagesize 2097152
futex_wake04 1 TFAIL : futex_wake04.c:126: Bug: wait_thread2 did not wake after 30 secs.
With the patch applied
futex_wake04 0 TINFO : Hugepagesize 2097152
futex_wake04 1 TPASS : Hi hydra, thread2 awake!
Fixes: 65d8fc777f6d "futex: Remove requirement for lock_page() in get_futex_key()"
Reported-and-tested-by: Mike Galbraith <umgwanakikbuti@gmail.com>
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20160608132522.GM2469@suse.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/futex.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -469,7 +469,7 @@ get_futex_key(u32 __user *uaddr, int fsh
{
unsigned long address = (unsigned long)uaddr;
struct mm_struct *mm = current->mm;
- struct page *page;
+ struct page *page, *tail;
struct address_space *mapping;
int err, ro = 0;
@@ -530,7 +530,15 @@ again:
* considered here and page lock forces unnecessarily serialization
* From this point on, mapping will be re-verified if necessary and
* page lock will be acquired only if it is unavoidable
+ *
+ * Mapping checks require the head page for any compound page so the
+ * head page and mapping is looked up now. For anonymous pages, it
+ * does not matter if the page splits in the future as the key is
+ * based on the address. For filesystem-backed pages, the tail is
+ * required as the index of the page determines the key. For
+ * base pages, there is no tail page and tail == page.
*/
+ tail = page;
page = compound_head(page);
mapping = READ_ONCE(page->mapping);
@@ -654,7 +662,7 @@ again:
key->both.offset |= FUT_OFF_INODE; /* inode-based key */
key->shared.inode = inode;
- key->shared.pgoff = basepage_index(page);
+ key->shared.pgoff = basepage_index(tail);
rcu_read_unlock();
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 010/203] IB/core: Fix bit curruption in ib_device_cap_flags structure
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 009/203] futex: Calculate the futex key based on a tail page for file-based futexes Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 011/203] IB/cm: Fix a recently introduced locking bug Greg Kroah-Hartman
` (183 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robert LeBlanc, Sagi Grimberg,
Max Gurtovoy, Matan Barak, Christoph Hellwig, Doug Ledford
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Gurtovoy <maxg@mellanox.com>
commit 47355b3cd7d3c9c5226bff7c449b9d269fb17fa6 upstream.
ib_device_cap_flags 64-bit expansion caused caps overlapping
and made consumers read wrong device capabilities. For example
IB_DEVICE_SG_GAPS_REG was falsely read by the iser driver causing
it to use a non-existing capability. This happened because signed
int becomes sign extended when converted it to u64. Fix this by
casting IB_DEVICE_ON_DEMAND_PAGING enumeration to ULL.
Fixes: f5aa9159a418 ('IB/core: Add arbitrary sg_list support')
Reported-by: Robert LeBlanc <robert@leblancnet.us>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/rdma/ib_verbs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -217,7 +217,7 @@ enum ib_device_cap_flags {
IB_DEVICE_CROSS_CHANNEL = (1 << 27),
IB_DEVICE_MANAGED_FLOW_STEERING = (1 << 29),
IB_DEVICE_SIGNATURE_HANDOVER = (1 << 30),
- IB_DEVICE_ON_DEMAND_PAGING = (1 << 31),
+ IB_DEVICE_ON_DEMAND_PAGING = (1ULL << 31),
IB_DEVICE_SG_GAPS_REG = (1ULL << 32),
IB_DEVICE_VIRTUAL_FUNCTION = ((u64)1 << 33),
};
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 011/203] IB/cm: Fix a recently introduced locking bug
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 010/203] IB/core: Fix bit curruption in ib_device_cap_flags structure Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 012/203] IB/rdmavt: Correct qp_priv_alloc() return value test Greg Kroah-Hartman
` (182 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Erez Shitrit,
Sean Hefty, Nikolay Borisov, Doug Ledford
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit 943f44d94aa26bfdcaafc40d3701e24eeb58edce upstream.
ib_cm_notify() can be called from interrupt context. Hence do not
reenable interrupts unconditionally in cm_establish().
This patch avoids that lockdep reports the following warning:
WARNING: CPU: 0 PID: 23317 at kernel/locking/lockdep.c:2624 trace _hardirqs_on_caller+0x112/0x1b0
DEBUG_LOCKS_WARN_ON(current->hardirq_context)
Call Trace:
<IRQ> [<ffffffff812bd0e5>] dump_stack+0x67/0x92
[<ffffffff81056f21>] __warn+0xc1/0xe0
[<ffffffff81056f8a>] warn_slowpath_fmt+0x4a/0x50
[<ffffffff810a5932>] trace_hardirqs_on_caller+0x112/0x1b0
[<ffffffff810a59dd>] trace_hardirqs_on+0xd/0x10
[<ffffffff815992c7>] _raw_spin_unlock_irq+0x27/0x40
[<ffffffffa0382e9c>] ib_cm_notify+0x25c/0x290 [ib_cm]
[<ffffffffa068fbc1>] srpt_qp_event+0xa1/0xf0 [ib_srpt]
[<ffffffffa04efb97>] mlx4_ib_qp_event+0x67/0xd0 [mlx4_ib]
[<ffffffffa034ec0a>] mlx4_qp_event+0x5a/0xc0 [mlx4_core]
[<ffffffffa03365f8>] mlx4_eq_int+0x3d8/0xcf0 [mlx4_core]
[<ffffffffa0336f9c>] mlx4_msi_x_interrupt+0xc/0x20 [mlx4_core]
[<ffffffff810b0914>] handle_irq_event_percpu+0x64/0x100
[<ffffffff810b09e4>] handle_irq_event+0x34/0x60
[<ffffffff810b3a6a>] handle_edge_irq+0x6a/0x150
[<ffffffff8101ad05>] handle_irq+0x15/0x20
[<ffffffff8101a66c>] do_IRQ+0x5c/0x110
[<ffffffff8159a2c9>] common_interrupt+0x89/0x89
[<ffffffff81297a17>] blk_run_queue_async+0x37/0x40
[<ffffffffa0163e53>] rq_completed+0x43/0x70 [dm_mod]
[<ffffffffa0164896>] dm_softirq_done+0x176/0x280 [dm_mod]
[<ffffffff812a26c2>] blk_done_softirq+0x52/0x90
[<ffffffff8105bc1f>] __do_softirq+0x10f/0x230
[<ffffffff8105bec8>] irq_exit+0xa8/0xb0
[<ffffffff8103653e>] smp_trace_call_function_single_interrupt+0x2e/0x30
[<ffffffff81036549>] smp_call_function_single_interrupt+0x9/0x10
[<ffffffff8159a959>] call_function_single_interrupt+0x89/0x90
<EOI>
Fixes: commit be4b499323bf (IB/cm: Do not queue work to a device that's going away)
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: Erez Shitrit <erezsh@mellanox.com>
Cc: Sean Hefty <sean.hefty@intel.com>
Cc: Nikolay Borisov <kernel@kyup.com>
Acked-by: Erez Shitrit <erezsh@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/cm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -3452,14 +3452,14 @@ static int cm_establish(struct ib_cm_id
work->cm_event.event = IB_CM_USER_ESTABLISHED;
/* Check if the device started its remove_one */
- spin_lock_irq(&cm.lock);
+ spin_lock_irqsave(&cm.lock, flags);
if (!cm_dev->going_down) {
queue_delayed_work(cm.wq, &work->work, 0);
} else {
kfree(work);
ret = -ENODEV;
}
- spin_unlock_irq(&cm.lock);
+ spin_unlock_irqrestore(&cm.lock, flags);
out:
return ret;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 012/203] IB/rdmavt: Correct qp_priv_alloc() return value test
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 011/203] IB/cm: Fix a recently introduced locking bug Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 013/203] IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs Greg Kroah-Hartman
` (181 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dennis Dalessandro, Mike Marciniszyn,
Doug Ledford
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <mike.marciniszyn@intel.com>
commit c755f4afa66ad3ed98870bd3254f37c47fb2c800 upstream.
The current drivers return errors from this calldown
wrapped in an ERR_PTR().
The rdmavt code incorrectly tests for NULL.
The code is fixed to use IS_ERR() and change ret according
to the driver return value.
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/sw/rdmavt/qp.c | 4 +++-
include/rdma/rdma_vt.h | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -683,8 +683,10 @@ struct ib_qp *rvt_create_qp(struct ib_pd
* initialization that is needed.
*/
priv = rdi->driver_f.qp_priv_alloc(rdi, qp, gfp);
- if (!priv)
+ if (IS_ERR(priv)) {
+ ret = priv;
goto bail_qp;
+ }
qp->priv = priv;
qp->timeout_jiffies =
usecs_to_jiffies((4096UL * (1UL << qp->timeout)) /
--- a/include/rdma/rdma_vt.h
+++ b/include/rdma/rdma_vt.h
@@ -203,7 +203,9 @@ struct rvt_driver_provided {
/*
* Allocate a private queue pair data structure for driver specific
- * information which is opaque to rdmavt.
+ * information which is opaque to rdmavt. Errors are returned via
+ * ERR_PTR(err). The driver is free to return NULL or a valid
+ * pointer.
*/
void * (*qp_priv_alloc)(struct rvt_dev_info *rdi, struct rvt_qp *qp,
gfp_t gfp);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 013/203] IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 012/203] IB/rdmavt: Correct qp_priv_alloc() return value test Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 014/203] powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism Greg Kroah-Hartman
` (180 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Doug Ledford
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
commit 8c5122e45a10a9262f872b53f151a592e870f905 upstream.
When this code was reworked for IBoE support the order of assignments
for the sl_tclass_flowlabel got flipped around resulting in
TClass & FlowLabel being permanently set to 0 in the packet headers.
This breaks IB routers that rely on these headers, but only affects
kernel users - libmlx4 does this properly for user space.
Fixes: fa417f7b520e ("IB/mlx4: Add support for IBoE")
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx4/ah.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/mlx4/ah.c
+++ b/drivers/infiniband/hw/mlx4/ah.c
@@ -47,6 +47,7 @@ static struct ib_ah *create_ib_ah(struct
ah->av.ib.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
ah->av.ib.g_slid = ah_attr->src_path_bits;
+ ah->av.ib.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28);
if (ah_attr->ah_flags & IB_AH_GRH) {
ah->av.ib.g_slid |= 0x80;
ah->av.ib.gid_index = ah_attr->grh.sgid_index;
@@ -64,7 +65,6 @@ static struct ib_ah *create_ib_ah(struct
!(1 << ah->av.ib.stat_rate & dev->caps.stat_rate_support))
--ah->av.ib.stat_rate;
}
- ah->av.ib.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28);
return &ah->ibah;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 014/203] powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 013/203] IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 015/203] powerpc/pseries: Fix PCI config address for DDW Greg Kroah-Hartman
` (179 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gavin Shan, Guilherme G. Piccoli,
Michael Ellerman
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
commit 8445a87f7092bc8336ea1305be9306f26b846d93 upstream.
Commit 39baadbf36ce ("powerpc/eeh: Remove eeh information from pci_dn")
changed the pci_dn struct by removing its EEH-related members.
As part of this clean-up, DDW mechanism was modified to read the device
configuration address from eeh_dev struct.
As a consequence, now if we disable EEH mechanism on kernel command-line
for example, the DDW mechanism will fail, generating a kernel oops by
dereferencing a NULL pointer (which turns to be the eeh_dev pointer).
This patch just changes the configuration address calculation on DDW
functions to a manual calculation based on pci_dn members instead of
using eeh_dev-based address.
No functional changes were made. This was tested on pSeries, both
in PHyp and qemu guest.
Fixes: 39baadbf36ce ("powerpc/eeh: Remove eeh information from pci_dn")
Reviewed-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/iommu.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -912,7 +912,8 @@ machine_arch_initcall(pseries, find_exis
static int query_ddw(struct pci_dev *dev, const u32 *ddw_avail,
struct ddw_query_response *query)
{
- struct eeh_dev *edev;
+ struct device_node *dn;
+ struct pci_dn *pdn;
u32 cfg_addr;
u64 buid;
int ret;
@@ -923,11 +924,10 @@ static int query_ddw(struct pci_dev *dev
* Retrieve them from the pci device, not the node with the
* dma-window property
*/
- edev = pci_dev_to_eeh_dev(dev);
- cfg_addr = edev->config_addr;
- if (edev->pe_config_addr)
- cfg_addr = edev->pe_config_addr;
- buid = edev->phb->buid;
+ dn = pci_device_to_OF_node(dev);
+ pdn = PCI_DN(dn);
+ buid = pdn->phb->buid;
+ cfg_addr = (pdn->busno << 8) | pdn->devfn;
ret = rtas_call(ddw_avail[0], 3, 5, (u32 *)query,
cfg_addr, BUID_HI(buid), BUID_LO(buid));
@@ -941,7 +941,8 @@ static int create_ddw(struct pci_dev *de
struct ddw_create_response *create, int page_shift,
int window_shift)
{
- struct eeh_dev *edev;
+ struct device_node *dn;
+ struct pci_dn *pdn;
u32 cfg_addr;
u64 buid;
int ret;
@@ -952,11 +953,10 @@ static int create_ddw(struct pci_dev *de
* Retrieve them from the pci device, not the node with the
* dma-window property
*/
- edev = pci_dev_to_eeh_dev(dev);
- cfg_addr = edev->config_addr;
- if (edev->pe_config_addr)
- cfg_addr = edev->pe_config_addr;
- buid = edev->phb->buid;
+ dn = pci_device_to_OF_node(dev);
+ pdn = PCI_DN(dn);
+ buid = pdn->phb->buid;
+ cfg_addr = (pdn->busno << 8) | pdn->devfn;
do {
/* extra outputs are LIOBN and dma-addr (hi, lo) */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 015/203] powerpc/pseries: Fix PCI config address for DDW
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 014/203] powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 016/203] powerpc/pseries: Fix IBM_ARCH_VEC_NRCORES_OFFSET since POWER8NVL was added Greg Kroah-Hartman
` (178 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Guilherme G. Piccoli, Gavin Shan,
Michael Ellerman
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <gwshan@linux.vnet.ibm.com>
commit 8a934efe94347eee843aeea65bdec8077a79e259 upstream.
In commit 8445a87f7092 "powerpc/iommu: Remove the dependency on EEH
struct in DDW mechanism", the PE address was replaced with the PCI
config address in order to remove dependency on EEH. According to PAPR
spec, firmware (pHyp or QEMU) should accept "xxBBSSxx" format PCI config
address, not "xxxxBBSS" provided by the patch. Note that "BB" is PCI bus
number and "SS" is the combination of slot and function number.
This fixes the PCI address passed to DDW RTAS calls.
Fixes: 8445a87f7092 ("powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism")
Reported-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Tested-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/iommu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -927,7 +927,7 @@ static int query_ddw(struct pci_dev *dev
dn = pci_device_to_OF_node(dev);
pdn = PCI_DN(dn);
buid = pdn->phb->buid;
- cfg_addr = (pdn->busno << 8) | pdn->devfn;
+ cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8));
ret = rtas_call(ddw_avail[0], 3, 5, (u32 *)query,
cfg_addr, BUID_HI(buid), BUID_LO(buid));
@@ -956,7 +956,7 @@ static int create_ddw(struct pci_dev *de
dn = pci_device_to_OF_node(dev);
pdn = PCI_DN(dn);
buid = pdn->phb->buid;
- cfg_addr = (pdn->busno << 8) | pdn->devfn;
+ cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8));
do {
/* extra outputs are LIOBN and dma-addr (hi, lo) */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 016/203] powerpc/pseries: Fix IBM_ARCH_VEC_NRCORES_OFFSET since POWER8NVL was added
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 015/203] powerpc/pseries: Fix PCI config address for DDW Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 017/203] powerpc/tm: Always reclaim in start_thread() for exec() class syscalls Greg Kroah-Hartman
` (177 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michael Ellerman
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <mpe@ellerman.id.au>
commit 2c2a63e301fd19ccae673e79de59b30a232ff7f9 upstream.
The recent commit 7cc851039d64 ("powerpc/pseries: Add POWER8NVL support
to ibm,client-architecture-support call") added a new PVR mask & value
to the start of the ibm_architecture_vec[] array.
However it missed the fact that further down in the array, we hard code
the offset of one of the fields, and then at boot use that value to
patch the value in the array. This means every update to the array must
also update the #define, ugh.
This means that on pseries machines we will misreport to firmware the
number of cores we support, by a factor of threads_per_core.
Fix it for now by updating the #define.
Fixes: 7cc851039d64 ("powerpc/pseries: Add POWER8NVL support to ibm,client-architecture-support call")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/prom_init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -719,7 +719,7 @@ unsigned char ibm_architecture_vec[] = {
* must match by the macro below. Update the definition if
* the structure layout changes.
*/
-#define IBM_ARCH_VEC_NRCORES_OFFSET 125
+#define IBM_ARCH_VEC_NRCORES_OFFSET 133
W(NR_CPUS), /* number of cores supported */
0,
0,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 017/203] powerpc/tm: Always reclaim in start_thread() for exec() class syscalls
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 016/203] powerpc/pseries: Fix IBM_ARCH_VEC_NRCORES_OFFSET since POWER8NVL was added Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 018/203] usb: dwc2: fix regression on big-endian PowerPC/ARM systems Greg Kroah-Hartman
` (176 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Cyril Bur, Michael Ellerman
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyril Bur <cyrilbur@gmail.com>
commit 8e96a87c5431c256feb65bcfc5aec92d9f7839b6 upstream.
Userspace can quite legitimately perform an exec() syscall with a
suspended transaction. exec() does not return to the old process, rather
it load a new one and starts that, the expectation therefore is that the
new process starts not in a transaction. Currently exec() is not treated
any differently to any other syscall which creates problems.
Firstly it could allow a new process to start with a suspended
transaction for a binary that no longer exists. This means that the
checkpointed state won't be valid and if the suspended transaction were
ever to be resumed and subsequently aborted (a possibility which is
exceedingly likely as exec()ing will likely doom the transaction) the
new process will jump to invalid state.
Secondly the incorrect attempt to keep the transactional state while
still zeroing state for the new process creates at least two TM Bad
Things. The first triggers on the rfid to return to userspace as
start_thread() has given the new process a 'clean' MSR but the suspend
will still be set in the hardware MSR. The second TM Bad Thing triggers
in __switch_to() as the processor is still transactionally suspended but
__switch_to() wants to zero the TM sprs for the new process.
This is an example of the outcome of calling exec() with a suspended
transaction. Note the first 700 is likely the first TM bad thing
decsribed earlier only the kernel can't report it as we've loaded
userspace registers. c000000000009980 is the rfid in
fast_exception_return()
Bad kernel stack pointer 3fffcfa1a370 at c000000000009980
Oops: Bad kernel stack pointer, sig: 6 [#1]
CPU: 0 PID: 2006 Comm: tm-execed Not tainted
NIP: c000000000009980 LR: 0000000000000000 CTR: 0000000000000000
REGS: c00000003ffefd40 TRAP: 0700 Not tainted
MSR: 8000000300201031 <SF,ME,IR,DR,LE,TM[SE]> CR: 00000000 XER: 00000000
CFAR: c0000000000098b4 SOFTE: 0
PACATMSCRATCH: b00000010000d033
GPR00: 0000000000000000 00003fffcfa1a370 0000000000000000 0000000000000000
GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR12: 00003fff966611c0 0000000000000000 0000000000000000 0000000000000000
NIP [c000000000009980] fast_exception_return+0xb0/0xb8
LR [0000000000000000] (null)
Call Trace:
Instruction dump:
f84d0278 e9a100d8 7c7b03a6 e84101a0 7c4ff120 e8410170 7c5a03a6 e8010070
e8410080 e8610088 e8810090 e8210078 <4c000024> 48000000 e8610178 88ed023b
Kernel BUG at c000000000043e80 [verbose debug info unavailable]
Unexpected TM Bad Thing exception at c000000000043e80 (msr 0x201033)
Oops: Unrecoverable exception, sig: 6 [#2]
CPU: 0 PID: 2006 Comm: tm-execed Tainted: G D
task: c0000000fbea6d80 ti: c00000003ffec000 task.ti: c0000000fb7ec000
NIP: c000000000043e80 LR: c000000000015a24 CTR: 0000000000000000
REGS: c00000003ffef7e0 TRAP: 0700 Tainted: G D
MSR: 8000000300201033 <SF,ME,IR,DR,RI,LE,TM[SE]> CR: 28002828 XER: 00000000
CFAR: c000000000015a20 SOFTE: 0
PACATMSCRATCH: b00000010000d033
GPR00: 0000000000000000 c00000003ffefa60 c000000000db5500 c0000000fbead000
GPR04: 8000000300001033 2222222222222222 2222222222222222 00000000ff160000
GPR08: 0000000000000000 800000010000d033 c0000000fb7e3ea0 c00000000fe00004
GPR12: 0000000000002200 c00000000fe00000 0000000000000000 0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 c0000000fbea7410 00000000ff160000
GPR24: c0000000ffe1f600 c0000000fbea8700 c0000000fbea8700 c0000000fbead000
GPR28: c000000000e20198 c0000000fbea6d80 c0000000fbeab680 c0000000fbea6d80
NIP [c000000000043e80] tm_restore_sprs+0xc/0x1c
LR [c000000000015a24] __switch_to+0x1f4/0x420
Call Trace:
Instruction dump:
7c800164 4e800020 7c0022a6 f80304a8 7c0222a6 f80304b0 7c0122a6 f80304b8
4e800020 e80304a8 7c0023a6 e80304b0 <7c0223a6> e80304b8 7c0123a6 4e800020
This fixes CVE-2016-5828.
Fixes: bc2a9408fa65 ("powerpc: Hook in new transactional memory code")
Signed-off-by: Cyril Bur <cyrilbur@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/process.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1501,6 +1501,16 @@ void start_thread(struct pt_regs *regs,
current->thread.regs = regs - 1;
}
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ /*
+ * Clear any transactional state, we're exec()ing. The cause is
+ * not important as there will never be a recheckpoint so it's not
+ * user visible.
+ */
+ if (MSR_TM_SUSPENDED(mfmsr()))
+ tm_reclaim_current(0);
+#endif
+
memset(regs->gpr, 0, sizeof(regs->gpr));
regs->ctr = 0;
regs->link = 0;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 018/203] usb: dwc2: fix regression on big-endian PowerPC/ARM systems
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 017/203] powerpc/tm: Always reclaim in start_thread() for exec() class syscalls Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 019/203] USB: EHCI: declare hostpc register as zero-length array Greg Kroah-Hartman
` (175 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, John Youn, Christian Lamparter,
Arnd Bergmann, Felipe Balbi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 23e3439296a55affce3ef0ab78f1c2e03aec8767 upstream.
A patch that went into Linux-4.4 to fix big-endian mode on a Lantiq
MIPS system unfortunately broke big-endian operation on PowerPC
APM82181 as reported by Christian Lamparter, and likely other
systems.
It actually introduced multiple issues:
- it broke big-endian ARM kernels: any machine that was working
correctly with a little-endian kernel is no longer using byteswaps
on big-endian kernels, which clearly breaks them.
- On PowerPC the same thing must be true: if it was working before,
using big-endian kernels is now broken. Unlike ARM, 32-bit PowerPC
usually uses big-endian kernels, so they are likely all broken.
- The barrier for dwc2_writel is on the wrong side of the __raw_writel(),
so the MMIO no longer synchronizes with DMA operations.
- On architectures that require specific CPU instructions for MMIO
access, using the __raw_ variant may turn this into a pointer
dereference that does not have the same effect as the readl/writel.
This patch is a simple revert for all architectures other than MIPS,
in the hope that we can more easily backport it to fix the regression
on PowerPC and ARM systems without breaking the Lantiq system again.
We should follow this up with a more elaborate change to add runtime
detection of endianness, to make sure it also works on all other
combinations of architectures and implementations of the usb-dwc2
device. That patch however will be fairly large and not appropriate
for backports to stable kernels.
Felipe suggested a different approach, using an endianness switching
register to always put the device into LE mode, but unfortunately
the dwc2 hardware does not provide a generic way to do that. Also,
I see no practical way of addressing the problem more generally by
patching architecture specific code on MIPS.
Fixes: 95c8bc360944 ("usb: dwc2: Use platform endianness when accessing registers")
Acked-by: John Youn <johnyoun@synopsys.com>
Tested-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/core.h | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -64,6 +64,17 @@
DWC2_TRACE_SCHEDULER_VB(pr_fmt("%s: SCH: " fmt), \
dev_name(hsotg->dev), ##__VA_ARGS__)
+#ifdef CONFIG_MIPS
+/*
+ * There are some MIPS machines that can run in either big-endian
+ * or little-endian mode and that use the dwc2 register without
+ * a byteswap in both ways.
+ * Unlike other architectures, MIPS apparently does not require a
+ * barrier before the __raw_writel() to synchronize with DMA but does
+ * require the barrier after the __raw_writel() to serialize a set of
+ * writes. This set of operations was added specifically for MIPS and
+ * should only be used there.
+ */
static inline u32 dwc2_readl(const void __iomem *addr)
{
u32 value = __raw_readl(addr);
@@ -90,6 +101,22 @@ static inline void dwc2_writel(u32 value
pr_info("INFO:: wrote %08x to %p\n", value, addr);
#endif
}
+#else
+/* Normal architectures just use readl/write */
+static inline u32 dwc2_readl(const void __iomem *addr)
+{
+ return readl(addr);
+}
+
+static inline void dwc2_writel(u32 value, void __iomem *addr)
+{
+ writel(value, addr);
+
+#ifdef DWC2_LOG_WRITES
+ pr_info("info:: wrote %08x to %p\n", value, addr);
+#endif
+}
+#endif
/* Maximum number of Endpoints/HostChannels */
#define MAX_EPS_CHANNELS 16
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 019/203] USB: EHCI: declare hostpc register as zero-length array
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 018/203] usb: dwc2: fix regression on big-endian PowerPC/ARM systems Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 020/203] USB: dont free bandwidth_mutex too early Greg Kroah-Hartman
` (174 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Wilfried Klaebe
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 7e8b3dfef16375dbfeb1f36a83eb9f27117c51fd upstream.
The HOSTPC extension registers found in some EHCI implementations form
a variable-length array, with one element for each port. Therefore
the hostpc field in struct ehci_regs should be declared as a
zero-length array, not a single-element array.
This fixes a problem reported by UBSAN.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Wilfried Klaebe <linux-kernel@lebenslange-mailadresse.de>
Tested-by: Wilfried Klaebe <linux-kernel@lebenslange-mailadresse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/usb/ehci_def.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/include/linux/usb/ehci_def.h
+++ b/include/linux/usb/ehci_def.h
@@ -180,11 +180,11 @@ struct ehci_regs {
* PORTSCx
*/
/* HOSTPC: offset 0x84 */
- u32 hostpc[1]; /* HOSTPC extension */
+ u32 hostpc[0]; /* HOSTPC extension */
#define HOSTPC_PHCD (1<<22) /* Phy clock disable */
#define HOSTPC_PSPD (3<<25) /* Port speed detection */
- u32 reserved5[16];
+ u32 reserved5[17];
/* USBMODE_EX: offset 0xc8 */
u32 usbmode_ex; /* USB Device mode extension */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 020/203] USB: dont free bandwidth_mutex too early
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 019/203] USB: EHCI: declare hostpc register as zero-length array Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 021/203] usb: common: otg-fsm: add license to usb-otg-fsm Greg Kroah-Hartman
` (173 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Chung-Geol Kim
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit ab2a4bf83902c170d29ba130a8abb5f9d90559e1 upstream.
The USB core contains a bug that can show up when a USB-3 host
controller is removed. If the primary (USB-2) hcd structure is
released before the shared (USB-3) hcd, the core will try to do a
double-free of the common bandwidth_mutex.
The problem was described in graphical form by Chung-Geol Kim, who
first reported it:
=================================================
At *remove USB(3.0) Storage
sequence <1> --> <5> ((Problem Case))
=================================================
VOLD
------------------------------------|------------
(uevent)
________|_________
|<1> |
|dwc3_otg_sm_work |
|usb_put_hcd |
|peer_hcd(kref=2)|
|__________________|
________|_________
|<2> |
|New USB BUS #2 |
| |
|peer_hcd(kref=1) |
| |
--(Link)-bandXX_mutex|
| |__________________|
|
___________________ |
|<3> | |
|dwc3_otg_sm_work | |
|usb_put_hcd | |
|primary_hcd(kref=1)| |
|___________________| |
_________|_________ |
|<4> | |
|New USB BUS #1 | |
|hcd_release | |
|primary_hcd(kref=0)| |
| | |
|bandXX_mutex(free) |<-
|___________________|
(( VOLD ))
______|___________
|<5> |
| SCSI |
|usb_put_hcd |
|peer_hcd(kref=0) |
|*hcd_release |
|bandXX_mutex(free*)|<- double free
|__________________|
=================================================
This happens because hcd_release() frees the bandwidth_mutex whenever
it sees a primary hcd being released (which is not a very good idea
in any case), but in the course of releasing the primary hcd, it
changes the pointers in the shared hcd in such a way that the shared
hcd will appear to be primary when it gets released.
This patch fixes the problem by changing hcd_release() so that it
deallocates the bandwidth_mutex only when the _last_ hcd structure
referencing it is released. The patch also removes an unnecessary
test, so that when an hcd is released, both the shared_hcd and
primary_hcd pointers in the hcd's peer will be cleared.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Chung-Geol Kim <chunggeol.kim@samsung.com>
Tested-by: Chung-Geol Kim <chunggeol.kim@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hcd.c | 17 +++++++----------
1 file changed, 7 insertions(+), 10 deletions(-)
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2597,26 +2597,23 @@ EXPORT_SYMBOL_GPL(usb_create_hcd);
* Don't deallocate the bandwidth_mutex until the last shared usb_hcd is
* deallocated.
*
- * Make sure to only deallocate the bandwidth_mutex when the primary HCD is
- * freed. When hcd_release() is called for either hcd in a peer set
- * invalidate the peer's ->shared_hcd and ->primary_hcd pointers to
- * block new peering attempts
+ * Make sure to deallocate the bandwidth_mutex only when the last HCD is
+ * freed. When hcd_release() is called for either hcd in a peer set,
+ * invalidate the peer's ->shared_hcd and ->primary_hcd pointers.
*/
static void hcd_release(struct kref *kref)
{
struct usb_hcd *hcd = container_of (kref, struct usb_hcd, kref);
mutex_lock(&usb_port_peer_mutex);
- if (usb_hcd_is_primary_hcd(hcd)) {
- kfree(hcd->address0_mutex);
- kfree(hcd->bandwidth_mutex);
- }
if (hcd->shared_hcd) {
struct usb_hcd *peer = hcd->shared_hcd;
peer->shared_hcd = NULL;
- if (peer->primary_hcd == hcd)
- peer->primary_hcd = NULL;
+ peer->primary_hcd = NULL;
+ } else {
+ kfree(hcd->address0_mutex);
+ kfree(hcd->bandwidth_mutex);
}
mutex_unlock(&usb_port_peer_mutex);
kfree(hcd);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 021/203] usb: common: otg-fsm: add license to usb-otg-fsm
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 020/203] USB: dont free bandwidth_mutex too early Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 022/203] mnt: fs_fully_visible test the proper mount for MNT_LOCKED Greg Kroah-Hartman
` (172 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Oscar, Peter Chen
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oscar <oscar@naiandei.net>
commit ea1d39a31d3b1b6060b6e83e5a29c069a124c68a upstream.
Fix warning about tainted kernel because usb-otg-fsm has no license.
WARNING: with this patch usb-otg-fsm module can be loaded
but then the kernel will hang. Tested with a udoo quad board.
Signed-off-by: Oscar <oscar@naiandei.net>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/common/usb-otg-fsm.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/common/usb-otg-fsm.c
+++ b/drivers/usb/common/usb-otg-fsm.c
@@ -21,6 +21,7 @@
* 675 Mass Ave, Cambridge, MA 02139, USA.
*/
+#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/mutex.h>
@@ -452,3 +453,4 @@ int otg_statemachine(struct otg_fsm *fsm
return state_changed;
}
EXPORT_SYMBOL_GPL(otg_statemachine);
+MODULE_LICENSE("GPL");
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 022/203] mnt: fs_fully_visible test the proper mount for MNT_LOCKED
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 021/203] usb: common: otg-fsm: add license to usb-otg-fsm Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 023/203] mnt: Account for MS_RDONLY in fs_fully_visible Greg Kroah-Hartman
` (171 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Seth Forshee, Eric W. Biederman
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <ebiederm@xmission.com>
commit d71ed6c930ac7d8f88f3cef6624a7e826392d61f upstream.
MNT_LOCKED implies on a child mount implies the child is locked to the
parent. So while looping through the children the children should be
tested (not their parent).
Typically an unshare of a mount namespace locks all mounts together
making both the parent and the slave as locked but there are a few
corner cases where other things work.
Fixes: ceeb0e5d39fc ("vfs: Ignore unlocked mounts in fs_fully_visible")
Reported-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3271,7 +3271,7 @@ static bool fs_fully_visible(struct file
list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
struct inode *inode = child->mnt_mountpoint->d_inode;
/* Only worry about locked mounts */
- if (!(mnt_flags & MNT_LOCKED))
+ if (!(child->mnt.mnt_flags & MNT_LOCKED))
continue;
/* Is the directory permanetly empty? */
if (!is_empty_dir_inode(inode))
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 023/203] mnt: Account for MS_RDONLY in fs_fully_visible
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 022/203] mnt: fs_fully_visible test the proper mount for MNT_LOCKED Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:53 ` [PATCH 4.6 024/203] mnt: If fs_fully_visible fails call put_filesystem Greg Kroah-Hartman
` (170 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric W. Biederman
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <ebiederm@xmission.com>
commit 695e9df010e40f407f4830dc11d53dce957710ba upstream.
In rare cases it is possible for s_flags & MS_RDONLY to be set but
MNT_READONLY to be clear. This starting combination can cause
fs_fully_visible to fail to ensure that the new mount is readonly.
Therefore force MNT_LOCK_READONLY in the new mount if MS_RDONLY
is set on the source filesystem of the mount.
In general both MS_RDONLY and MNT_READONLY are set at the same for
mounts so I don't expect any programs to care. Nor do I expect
MS_RDONLY to be set on proc or sysfs in the initial user namespace,
which further decreases the likelyhood of problems.
Which means this change should only affect system configurations by
paranoid sysadmins who should welcome the additional protection
as it keeps people from wriggling out of their policies.
Fixes: 8c6cf9cc829f ("mnt: Modify fs_fully_visible to deal with locked ro nodev and atime")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3245,6 +3245,10 @@ static bool fs_fully_visible(struct file
if (mnt->mnt.mnt_sb->s_iflags & SB_I_NOEXEC)
mnt_flags &= ~(MNT_LOCK_NOSUID | MNT_LOCK_NOEXEC);
+ /* Don't miss readonly hidden in the superblock flags */
+ if (mnt->mnt.mnt_sb->s_flags & MS_RDONLY)
+ mnt_flags |= MNT_LOCK_READONLY;
+
/* Verify the mount flags are equal to or more permissive
* than the proposed new mount.
*/
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 024/203] mnt: If fs_fully_visible fails call put_filesystem.
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 023/203] mnt: Account for MS_RDONLY in fs_fully_visible Greg Kroah-Hartman
@ 2016-07-25 20:53 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 025/203] of: fix autoloading due to broken modalias with no compatible Greg Kroah-Hartman
` (169 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric W. Biederman
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <ebiederm@xmission.com>
commit 97c1df3e54e811aed484a036a798b4b25d002ecf upstream.
Add this trivial missing error handling.
Fixes: 1b852bceb0d1 ("mnt: Refactor the logic for mounting sysfs and proc in a user namespace")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2409,8 +2409,10 @@ static int do_new_mount(struct path *pat
mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
}
if (type->fs_flags & FS_USERNS_VISIBLE) {
- if (!fs_fully_visible(type, &mnt_flags))
+ if (!fs_fully_visible(type, &mnt_flags)) {
+ put_filesystem(type);
return -EPERM;
+ }
}
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 025/203] of: fix autoloading due to broken modalias with no compatible
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2016-07-25 20:53 ` [PATCH 4.6 024/203] mnt: If fs_fully_visible fails call put_filesystem Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 026/203] of: irq: fix of_irq_get[_byname]() kernel-doc Greg Kroah-Hartman
` (168 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mathieu Malaterre, Wolfram Sang,
Philipp Zabel, Andreas Schwab, Michael Ellerman
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa@the-dreams.de>
commit b3c0a4dab7e35a9b6d69c0415641d2280fdefb2b upstream.
Because of an improper dereference, a stray 'C' character was output to
the modalias when no 'compatible' was specified. This is the case for
some old PowerMac drivers which only set the 'name' property. Fix it to
let them match again.
Reported-by: Mathieu Malaterre <malat@debian.org>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Tested-by: Mathieu Malaterre <malat@debian.org>
Cc: Philipp Zabel <p.zabel@pengutronix.de>
Cc: Andreas Schwab <schwab@linux-m68k.org>
Fixes: 6543becf26fff6 ("mod/file2alias: make modalias generation safe for cross compiling")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/mod/file2alias.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -384,7 +384,7 @@ static void do_of_entry_multi(void *symv
len = sprintf(alias, "of:N%sT%s", (*name)[0] ? *name : "*",
(*type)[0] ? *type : "*");
- if (compatible[0])
+ if ((*compatible)[0])
sprintf(&alias[len], "%sC%s", (*type)[0] ? "*" : "",
*compatible);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 026/203] of: irq: fix of_irq_get[_byname]() kernel-doc
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 025/203] of: fix autoloading due to broken modalias with no compatible Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 027/203] x86/msr: Use the proper trace point conditional for writes Greg Kroah-Hartman
` (167 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sergei Shtylyov, Rob Herring
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
commit 3993546646baf1dab5f5c4f7d9bb58f2046fd1c1 upstream.
The kernel-doc for the of_irq_get[_byname]() is clearly inadequate in
describing the return values -- of_irq_get_byname() is documented better
than of_irq_get() but it still doesn't mention that 0 is returned iff
irq_create_of_mapping() fails (it doesn't return an error code in this
case). Document all possible return value variants, making the writing
of the word "IRQ" consistent, while at it...
Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")
Fixes: ad69674e73a1 ("of/irq: do irq resolution in platform_get_irq_byname()")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/irq.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -386,13 +386,13 @@ int of_irq_to_resource(struct device_nod
EXPORT_SYMBOL_GPL(of_irq_to_resource);
/**
- * of_irq_get - Decode a node's IRQ and return it as a Linux irq number
+ * of_irq_get - Decode a node's IRQ and return it as a Linux IRQ number
* @dev: pointer to device tree node
- * @index: zero-based index of the irq
- *
- * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain
- * is not yet created.
+ * @index: zero-based index of the IRQ
*
+ * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or
+ * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case
+ * of any other failure.
*/
int of_irq_get(struct device_node *dev, int index)
{
@@ -413,12 +413,13 @@ int of_irq_get(struct device_node *dev,
EXPORT_SYMBOL_GPL(of_irq_get);
/**
- * of_irq_get_byname - Decode a node's IRQ and return it as a Linux irq number
+ * of_irq_get_byname - Decode a node's IRQ and return it as a Linux IRQ number
* @dev: pointer to device tree node
- * @name: irq name
+ * @name: IRQ name
*
- * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain
- * is not yet created, or error code in case of any other failure.
+ * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or
+ * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case
+ * of any other failure.
*/
int of_irq_get_byname(struct device_node *dev, const char *name)
{
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 027/203] x86/msr: Use the proper trace point conditional for writes
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 026/203] of: irq: fix of_irq_get[_byname]() kernel-doc Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 028/203] locking/ww_mutex: Report recursive ww_mutex locking early Greg Kroah-Hartman
` (166 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dr. David Alan Gilbert, ak, Thomas Gleixner
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dr. David Alan Gilbert <dgilbert@redhat.com>
commit 08dd8cd06ed95625b9e2fac43c78fcb45b7eaf94 upstream.
The msr tracing for writes is incorrectly conditional on the read trace.
Fixes: 7f47d8cc039f "x86, tracing, perf: Add trace point for MSR accesses"
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Cc: ak@linux.intel.com
Link: http://lkml.kernel.org/r/1464976859-21850-1-git-send-email-dgilbert@redhat.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/msr.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/msr.h
+++ b/arch/x86/include/asm/msr.h
@@ -112,7 +112,7 @@ static inline void native_write_msr(unsi
unsigned low, unsigned high)
{
asm volatile("wrmsr" : : "c" (msr), "a"(low), "d" (high) : "memory");
- if (msr_tracepoint_active(__tracepoint_read_msr))
+ if (msr_tracepoint_active(__tracepoint_write_msr))
do_trace_write_msr(msr, ((u64)high << 32 | low), 0);
}
@@ -131,7 +131,7 @@ notrace static inline int native_write_m
: "c" (msr), "0" (low), "d" (high),
[fault] "i" (-EIO)
: "memory");
- if (msr_tracepoint_active(__tracepoint_read_msr))
+ if (msr_tracepoint_active(__tracepoint_write_msr))
do_trace_write_msr(msr, ((u64)high << 32 | low), err);
return err;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 028/203] locking/ww_mutex: Report recursive ww_mutex locking early
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 027/203] x86/msr: Use the proper trace point conditional for writes Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 029/203] locking/qspinlock: Fix spin_unlock_wait() some more Greg Kroah-Hartman
` (165 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maarten Lankhorst, Chris Wilson,
Peter Zijlstra (Intel),
Andrew Morton, Linus Torvalds, Paul E. McKenney, Thomas Gleixner,
Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit 0422e83d84ae24b933e4b0d4c1e0f0b4ae8a0a3b upstream.
Recursive locking for ww_mutexes was originally conceived as an
exception. However, it is heavily used by the DRM atomic modesetting
code. Currently, the recursive deadlock is checked after we have queued
up for a busy-spin and as we never release the lock, we spin until
kicked, whereupon the deadlock is discovered and reported.
A simple solution for the now common problem is to move the recursive
deadlock discovery to the first action when taking the ww_mutex.
Suggested-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1464293297-19777-1-git-send-email-chris@chris-wilson.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/locking/mutex.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -486,9 +486,6 @@ __ww_mutex_lock_check_stamp(struct mutex
if (!hold_ctx)
return 0;
- if (unlikely(ctx == hold_ctx))
- return -EALREADY;
-
if (ctx->stamp - hold_ctx->stamp <= LONG_MAX &&
(ctx->stamp != hold_ctx->stamp || ctx > hold_ctx)) {
#ifdef CONFIG_DEBUG_MUTEXES
@@ -514,6 +511,12 @@ __mutex_lock_common(struct mutex *lock,
unsigned long flags;
int ret;
+ if (use_ww_ctx) {
+ struct ww_mutex *ww = container_of(lock, struct ww_mutex, base);
+ if (unlikely(ww_ctx == READ_ONCE(ww->ctx)))
+ return -EALREADY;
+ }
+
preempt_disable();
mutex_acquire_nest(&lock->dep_map, subclass, 0, nest_lock, ip);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 029/203] locking/qspinlock: Fix spin_unlock_wait() some more
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 028/203] locking/ww_mutex: Report recursive ww_mutex locking early Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 030/203] locking/static_key: Fix concurrent static_key_slow_inc() Greg Kroah-Hartman
` (164 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
Andrew Morton, Boqun Feng, Davidlohr Bueso, Giovanni Gherdovich,
Linus Torvalds, Pan Xinhui, Paul E. McKenney, Thomas Gleixner,
Waiman Long, Will Deacon, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 2c610022711675ee908b903d242f0b90e1db661f upstream.
While this prior commit:
54cf809b9512 ("locking,qspinlock: Fix spin_is_locked() and spin_unlock_wait()")
... fixes spin_is_locked() and spin_unlock_wait() for the usage
in ipc/sem and netfilter, it does not in fact work right for the
usage in task_work and futex.
So while the 2 locks crossed problem:
spin_lock(A) spin_lock(B)
if (!spin_is_locked(B)) spin_unlock_wait(A)
foo() foo();
... works with the smp_mb() injected by both spin_is_locked() and
spin_unlock_wait(), this is not sufficient for:
flag = 1;
smp_mb(); spin_lock()
spin_unlock_wait() if (!flag)
// add to lockless list
// iterate lockless list
... because in this scenario, the store from spin_lock() can be delayed
past the load of flag, uncrossing the variables and loosing the
guarantee.
This patch reworks spin_is_locked() and spin_unlock_wait() to work in
both cases by exploiting the observation that while the lock byte
store can be delayed, the contender must have registered itself
visibly in other state contained in the word.
It also allows for architectures to override both functions, as PPC
and ARM64 have an additional issue for which we currently have no
generic solution.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Giovanni Gherdovich <ggherdovich@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Pan Xinhui <xinhui.pan@linux.vnet.ibm.com>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Waiman Long <waiman.long@hpe.com>
Cc: Will Deacon <will.deacon@arm.com>
Fixes: 54cf809b9512 ("locking,qspinlock: Fix spin_is_locked() and spin_unlock_wait()")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/asm-generic/qspinlock.h | 53 +++++++++++------------------------
kernel/locking/qspinlock.c | 60 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 77 insertions(+), 36 deletions(-)
--- a/include/asm-generic/qspinlock.h
+++ b/include/asm-generic/qspinlock.h
@@ -22,37 +22,33 @@
#include <asm-generic/qspinlock_types.h>
/**
+ * queued_spin_unlock_wait - wait until the _current_ lock holder releases the lock
+ * @lock : Pointer to queued spinlock structure
+ *
+ * There is a very slight possibility of live-lock if the lockers keep coming
+ * and the waiter is just unfortunate enough to not see any unlock state.
+ */
+#ifndef queued_spin_unlock_wait
+extern void queued_spin_unlock_wait(struct qspinlock *lock);
+#endif
+
+/**
* queued_spin_is_locked - is the spinlock locked?
* @lock: Pointer to queued spinlock structure
* Return: 1 if it is locked, 0 otherwise
*/
+#ifndef queued_spin_is_locked
static __always_inline int queued_spin_is_locked(struct qspinlock *lock)
{
/*
- * queued_spin_lock_slowpath() can ACQUIRE the lock before
- * issuing the unordered store that sets _Q_LOCKED_VAL.
- *
- * See both smp_cond_acquire() sites for more detail.
- *
- * This however means that in code like:
- *
- * spin_lock(A) spin_lock(B)
- * spin_unlock_wait(B) spin_is_locked(A)
- * do_something() do_something()
- *
- * Both CPUs can end up running do_something() because the store
- * setting _Q_LOCKED_VAL will pass through the loads in
- * spin_unlock_wait() and/or spin_is_locked().
+ * See queued_spin_unlock_wait().
*
- * Avoid this by issuing a full memory barrier between the spin_lock()
- * and the loads in spin_unlock_wait() and spin_is_locked().
- *
- * Note that regular mutual exclusion doesn't care about this
- * delayed store.
+ * Any !0 state indicates it is locked, even if _Q_LOCKED_VAL
+ * isn't immediately observable.
*/
- smp_mb();
- return atomic_read(&lock->val) & _Q_LOCKED_MASK;
+ return atomic_read(&lock->val);
}
+#endif
/**
* queued_spin_value_unlocked - is the spinlock structure unlocked?
@@ -122,21 +118,6 @@ static __always_inline void queued_spin_
}
#endif
-/**
- * queued_spin_unlock_wait - wait until current lock holder releases the lock
- * @lock : Pointer to queued spinlock structure
- *
- * There is a very slight possibility of live-lock if the lockers keep coming
- * and the waiter is just unfortunate enough to not see any unlock state.
- */
-static inline void queued_spin_unlock_wait(struct qspinlock *lock)
-{
- /* See queued_spin_is_locked() */
- smp_mb();
- while (atomic_read(&lock->val) & _Q_LOCKED_MASK)
- cpu_relax();
-}
-
#ifndef virt_spin_lock
static __always_inline bool virt_spin_lock(struct qspinlock *lock)
{
--- a/kernel/locking/qspinlock.c
+++ b/kernel/locking/qspinlock.c
@@ -267,6 +267,66 @@ static __always_inline u32 __pv_wait_he
#define queued_spin_lock_slowpath native_queued_spin_lock_slowpath
#endif
+/*
+ * queued_spin_lock_slowpath() can (load-)ACQUIRE the lock before
+ * issuing an _unordered_ store to set _Q_LOCKED_VAL.
+ *
+ * This means that the store can be delayed, but no later than the
+ * store-release from the unlock. This means that simply observing
+ * _Q_LOCKED_VAL is not sufficient to determine if the lock is acquired.
+ *
+ * There are two paths that can issue the unordered store:
+ *
+ * (1) clear_pending_set_locked(): *,1,0 -> *,0,1
+ *
+ * (2) set_locked(): t,0,0 -> t,0,1 ; t != 0
+ * atomic_cmpxchg_relaxed(): t,0,0 -> 0,0,1
+ *
+ * However, in both cases we have other !0 state we've set before to queue
+ * ourseves:
+ *
+ * For (1) we have the atomic_cmpxchg_acquire() that set _Q_PENDING_VAL, our
+ * load is constrained by that ACQUIRE to not pass before that, and thus must
+ * observe the store.
+ *
+ * For (2) we have a more intersting scenario. We enqueue ourselves using
+ * xchg_tail(), which ends up being a RELEASE. This in itself is not
+ * sufficient, however that is followed by an smp_cond_acquire() on the same
+ * word, giving a RELEASE->ACQUIRE ordering. This again constrains our load and
+ * guarantees we must observe that store.
+ *
+ * Therefore both cases have other !0 state that is observable before the
+ * unordered locked byte store comes through. This means we can use that to
+ * wait for the lock store, and then wait for an unlock.
+ */
+#ifndef queued_spin_unlock_wait
+void queued_spin_unlock_wait(struct qspinlock *lock)
+{
+ u32 val;
+
+ for (;;) {
+ val = atomic_read(&lock->val);
+
+ if (!val) /* not locked, we're done */
+ goto done;
+
+ if (val & _Q_LOCKED_MASK) /* locked, go wait for unlock */
+ break;
+
+ /* not locked, but pending, wait until we observe the lock */
+ cpu_relax();
+ }
+
+ /* any unlock is good */
+ while (atomic_read(&lock->val) & _Q_LOCKED_MASK)
+ cpu_relax();
+
+done:
+ smp_rmb(); /* CTRL + RMB -> ACQUIRE */
+}
+EXPORT_SYMBOL(queued_spin_unlock_wait);
+#endif
+
#endif /* _GEN_PV_LOCK_SLOWPATH */
/**
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 030/203] locking/static_key: Fix concurrent static_key_slow_inc()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 029/203] locking/qspinlock: Fix spin_unlock_wait() some more Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 031/203] cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE Greg Kroah-Hartman
` (163 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Paolo Bonzini,
Peter Zijlstra (Intel),
Linus Torvalds, Thomas Gleixner, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 4c5ea0a9cd02d6aa8adc86e100b2a4cff8d614ff upstream.
The following scenario is possible:
CPU 1 CPU 2
static_key_slow_inc()
atomic_inc_not_zero()
-> key.enabled == 0, no increment
jump_label_lock()
atomic_inc_return()
-> key.enabled == 1 now
static_key_slow_inc()
atomic_inc_not_zero()
-> key.enabled == 1, inc to 2
return
** static key is wrong!
jump_label_update()
jump_label_unlock()
Testing the static key at the point marked by (**) will follow the
wrong path for jumps that have not been patched yet. This can
actually happen when creating many KVM virtual machines with userspace
LAPIC emulation; just run several copies of the following program:
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <linux/kvm.h>
int main(void)
{
for (;;) {
int kvmfd = open("/dev/kvm", O_RDONLY);
int vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
close(ioctl(vmfd, KVM_CREATE_VCPU, 1));
close(vmfd);
close(kvmfd);
}
return 0;
}
Every KVM_CREATE_VCPU ioctl will attempt a static_key_slow_inc() call.
The static key's purpose is to skip NULL pointer checks and indeed one
of the processes eventually dereferences NULL.
As explained in the commit that introduced the bug:
706249c222f6 ("locking/static_keys: Rework update logic")
jump_label_update() needs key.enabled to be true. The solution adopted
here is to temporarily make key.enabled == -1, and use go down the
slow path when key.enabled <= 0.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 706249c222f6 ("locking/static_keys: Rework update logic")
Link: http://lkml.kernel.org/r/1466527937-69798-1-git-send-email-pbonzini@redhat.com
[ Small stylistic edits to the changelog and the code. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/jump_label.h | 16 +++++++++++++---
kernel/jump_label.c | 36 +++++++++++++++++++++++++++++++++---
2 files changed, 46 insertions(+), 6 deletions(-)
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -117,13 +117,18 @@ struct module;
#include <linux/atomic.h>
+#ifdef HAVE_JUMP_LABEL
+
static inline int static_key_count(struct static_key *key)
{
- return atomic_read(&key->enabled);
+ /*
+ * -1 means the first static_key_slow_inc() is in progress.
+ * static_key_enabled() must return true, so return 1 here.
+ */
+ int n = atomic_read(&key->enabled);
+ return n >= 0 ? n : 1;
}
-#ifdef HAVE_JUMP_LABEL
-
#define JUMP_TYPE_FALSE 0UL
#define JUMP_TYPE_TRUE 1UL
#define JUMP_TYPE_MASK 1UL
@@ -162,6 +167,11 @@ extern void jump_label_apply_nops(struct
#else /* !HAVE_JUMP_LABEL */
+static inline int static_key_count(struct static_key *key)
+{
+ return atomic_read(&key->enabled);
+}
+
static __always_inline void jump_label_init(void)
{
static_key_initialized = true;
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -58,13 +58,36 @@ static void jump_label_update(struct sta
void static_key_slow_inc(struct static_key *key)
{
+ int v, v1;
+
STATIC_KEY_CHECK_USE();
- if (atomic_inc_not_zero(&key->enabled))
- return;
+
+ /*
+ * Careful if we get concurrent static_key_slow_inc() calls;
+ * later calls must wait for the first one to _finish_ the
+ * jump_label_update() process. At the same time, however,
+ * the jump_label_update() call below wants to see
+ * static_key_enabled(&key) for jumps to be updated properly.
+ *
+ * So give a special meaning to negative key->enabled: it sends
+ * static_key_slow_inc() down the slow path, and it is non-zero
+ * so it counts as "enabled" in jump_label_update(). Note that
+ * atomic_inc_unless_negative() checks >= 0, so roll our own.
+ */
+ for (v = atomic_read(&key->enabled); v > 0; v = v1) {
+ v1 = atomic_cmpxchg(&key->enabled, v, v + 1);
+ if (likely(v1 == v))
+ return;
+ }
jump_label_lock();
- if (atomic_inc_return(&key->enabled) == 1)
+ if (atomic_read(&key->enabled) == 0) {
+ atomic_set(&key->enabled, -1);
jump_label_update(key);
+ atomic_set(&key->enabled, 1);
+ } else {
+ atomic_inc(&key->enabled);
+ }
jump_label_unlock();
}
EXPORT_SYMBOL_GPL(static_key_slow_inc);
@@ -72,6 +95,13 @@ EXPORT_SYMBOL_GPL(static_key_slow_inc);
static void __static_key_slow_dec(struct static_key *key,
unsigned long rate_limit, struct delayed_work *work)
{
+ /*
+ * The negative count check is valid even when a negative
+ * key->enabled is in use by static_key_slow_inc(); a
+ * __static_key_slow_dec() before the first static_key_slow_inc()
+ * returns is unbalanced, because all other static_key_slow_inc()
+ * instances block while the update is in progress.
+ */
if (!atomic_dec_and_mutex_lock(&key->enabled, &jump_label_mutex)) {
WARN(atomic_read(&key->enabled) < 0,
"jump label: negative count!\n");
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 031/203] cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 030/203] locking/static_key: Fix concurrent static_key_slow_inc() Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 032/203] x86, build: copy ldlinux.c32 to image.iso Greg Kroah-Hartman
` (162 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Catalin Marinas, Rafael J. Wysocki
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
commit 9bd616e3dbedfc103f158197c8ad93678849b1ed upstream.
The cpuidle_devices per-CPU variable is only defined when CPU_IDLE is
enabled. Commit c8cc7d4de7a4 ("sched/idle: Reorganize the idle loop")
removed the #ifdef CONFIG_CPU_IDLE around cpuidle_idle_call() with the
compiler optimising away __this_cpu_read(cpuidle_devices). However, with
CONFIG_UBSAN && !CONFIG_CPU_IDLE, this optimisation no longer happens
and the kernel fails to link since cpuidle_devices is not defined.
This patch introduces an accessor function for the current CPU cpuidle
device (returning NULL when !CONFIG_CPU_IDLE) and uses it in
cpuidle_idle_call().
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/cpuidle.h | 3 +++
kernel/sched/idle.c | 2 +-
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -152,6 +152,8 @@ extern void cpuidle_disable_device(struc
extern int cpuidle_play_dead(void);
extern struct cpuidle_driver *cpuidle_get_cpu_driver(struct cpuidle_device *dev);
+static inline struct cpuidle_device *cpuidle_get_device(void)
+{return __this_cpu_read(cpuidle_devices); }
#else
static inline void disable_cpuidle(void) { }
static inline bool cpuidle_not_available(struct cpuidle_driver *drv,
@@ -187,6 +189,7 @@ static inline void cpuidle_disable_devic
static inline int cpuidle_play_dead(void) {return -ENODEV; }
static inline struct cpuidle_driver *cpuidle_get_cpu_driver(
struct cpuidle_device *dev) {return NULL; }
+static inline struct cpuidle_device *cpuidle_get_device(void) {return NULL; }
#endif
#if defined(CONFIG_CPU_IDLE) && defined(CONFIG_SUSPEND)
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -127,7 +127,7 @@ static int call_cpuidle(struct cpuidle_d
*/
static void cpuidle_idle_call(void)
{
- struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices);
+ struct cpuidle_device *dev = cpuidle_get_device();
struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
int next_state, entered_state;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 032/203] x86, build: copy ldlinux.c32 to image.iso
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 031/203] cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 033/203] kprobes/x86: Clear TF bit in fault on single-stepping Greg Kroah-Hartman
` (161 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, H. Peter Anvin
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: H. Peter Anvin <hpa@zytor.com>
commit 9c77679cadb118c0aa99e6f88533d91765a131ba upstream.
For newer versions of Syslinux, we need ldlinux.c32 in addition to
isolinux.bin to reside on the boot disk, so if the latter is found,
copy it, too, to the isoimage tree.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/Makefile | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -171,6 +171,9 @@ isoimage: $(obj)/bzImage
for i in lib lib64 share end ; do \
if [ -f /usr/$$i/syslinux/isolinux.bin ] ; then \
cp /usr/$$i/syslinux/isolinux.bin $(obj)/isoimage ; \
+ if [ -f /usr/$$i/syslinux/ldlinux.c32 ]; then \
+ cp /usr/$$i/syslinux/ldlinux.c32 $(obj)/isoimage ; \
+ fi ; \
break ; \
fi ; \
if [ $$i = end ] ; then exit 1 ; fi ; \
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 033/203] kprobes/x86: Clear TF bit in fault on single-stepping
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 032/203] x86, build: copy ldlinux.c32 to image.iso Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 035/203] x86/amd_nb: Fix boot crash on non-AMD systems Greg Kroah-Hartman
` (160 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masami Hiramatsu,
Ananth N Mavinakayanahalli, Steven Rostedt, Alexander Shishkin,
Andy Lutomirski, Arnaldo Carvalho de Melo, Borislav Petkov,
Brian Gerst, Denys Vlasenko, H. Peter Anvin, Jiri Olsa,
Linus Torvalds, Peter Zijlstra, Stephane Eranian,
Thomas Gleixner, Vince Weaver, systemtap, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <mhiramat@kernel.org>
commit dcfc47248d3f7d28df6f531e6426b933de94370d upstream.
Fix kprobe_fault_handler() to clear the TF (trap flag) bit of
the flags register in the case of a fault fixup on single-stepping.
If we put a kprobe on the instruction which caused a
page fault (e.g. actual mov instructions in copy_user_*),
that fault happens on the single-stepping buffer. In this
case, kprobes resets running instance so that the CPU can
retry execution on the original ip address.
However, current code forgets to reset the TF bit. Since this
fault happens with TF bit set for enabling single-stepping,
when it retries, it causes a debug exception and kprobes
can not handle it because it already reset itself.
On the most of x86-64 platform, it can be easily reproduced
by using kprobe tracer. E.g.
# cd /sys/kernel/debug/tracing
# echo p copy_user_enhanced_fast_string+5 > kprobe_events
# echo 1 > events/kprobes/enable
And you'll see a kernel panic on do_debug(), since the debug
trap is not handled by kprobes.
To fix this problem, we just need to clear the TF bit when
resetting running kprobe.
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: systemtap@sourceware.org
Link: http://lkml.kernel.org/r/20160611140648.25885.37482.stgit@devbox
[ Updated the comments. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/kprobes/core.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -960,7 +960,19 @@ int kprobe_fault_handler(struct pt_regs
* normal page fault.
*/
regs->ip = (unsigned long)cur->addr;
+ /*
+ * Trap flag (TF) has been set here because this fault
+ * happened where the single stepping will be done.
+ * So clear it by resetting the current kprobe:
+ */
+ regs->flags &= ~X86_EFLAGS_TF;
+
+ /*
+ * If the TF flag was set before the kprobe hit,
+ * don't touch it:
+ */
regs->flags |= kcb->kprobe_old_flags;
+
if (kcb->kprobe_status == KPROBE_REENTER)
restore_previous_kprobe(kcb);
else
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 035/203] x86/amd_nb: Fix boot crash on non-AMD systems
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 033/203] kprobes/x86: Clear TF bit in fault on single-stepping Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 036/203] perf/x86: Fix 32-bit perf user callgraph collection Greg Kroah-Hartman
` (159 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Borislav Petkov, Linus Torvalds,
Peter Zijlstra, Thomas Gleixner, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <bp@suse.de>
commit 1ead852dd88779eda12cb09cc894a03d9abfe1ec upstream.
Fix boot crash that triggers if this driver is built into a kernel and
run on non-AMD systems.
AMD northbridges users call amd_cache_northbridges() and it returns
a negative value to signal that we weren't able to cache/detect any
northbridges on the system.
At least, it should do so as all its callers expect it to do so. But it
does return a negative value only when kmalloc() fails.
Fix it to return -ENODEV if there are no NBs cached as otherwise, amd_nb
users like amd64_edac, for example, which relies on it to know whether
it should load or not, gets loaded on systems like Intel Xeons where it
shouldn't.
Reported-and-tested-by: Tony Battersby <tonyb@cybernetics.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1466097230-5333-2-git-send-email-bp@alien8.de
Link: https://lkml.kernel.org/r/5761BEB0.9000807@cybernetics.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/amd_nb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
@@ -71,8 +71,8 @@ int amd_cache_northbridges(void)
while ((misc = next_northbridge(misc, amd_nb_misc_ids)) != NULL)
i++;
- if (i == 0)
- return 0;
+ if (!i)
+ return -ENODEV;
nb = kzalloc(i * sizeof(struct amd_northbridge), GFP_KERNEL);
if (!nb)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 036/203] perf/x86: Fix 32-bit perf user callgraph collection
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 035/203] x86/amd_nb: Fix boot crash on non-AMD systems Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 037/203] extcon: palmas: Fix boot up state of VBUS when using GPIO detection Greg Kroah-Hartman
` (158 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josh Poimboeuf, Alexander Shishkin,
Arnaldo Carvalho de Melo, Arnaldo Carvalho de Melo, Jiri Olsa,
Linus Torvalds, Peter Zijlstra, Stephane Eranian,
Thomas Gleixner, Vince Weaver, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@redhat.com>
commit fc18822510721fe694d273c5211c71ea52796d76 upstream.
A basic perf callgraph record operation causes an immediate panic on a
32-bit kernel compiled with CONFIG_CC_STACKPROTECTOR=y:
$ perf record -g ls
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: c0404fbd
CPU: 0 PID: 998 Comm: ls Not tainted 4.7.0-rc5+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.1-1.fc24 04/01/2014
c0dd5967 ff7afe1c 00000086 f41dbc2c c07445a0 464c457f f41dbca8 f41dbc44
c05646f4 f41dbca8 464c457f f41dbca8 464c457f f41dbc54 c04625be c0ce56fc
c0404fbd f41dbc88 c0404fbd b74668f0 f41dc000 00000000 c0000000 00000000
Call Trace:
[<c07445a0>] dump_stack+0x58/0x78
[<c05646f4>] panic+0x8e/0x1c6
[<c04625be>] __stack_chk_fail+0x1e/0x30
[<c0404fbd>] ? perf_callchain_user+0x22d/0x230
[<c0404fbd>] perf_callchain_user+0x22d/0x230
[<c055f89f>] get_perf_callchain+0x1ff/0x270
[<c055f988>] perf_callchain+0x78/0x90
[<c055c7eb>] perf_prepare_sample+0x24b/0x370
[<c055c934>] perf_event_output_forward+0x24/0x70
[<c05531c0>] __perf_event_overflow+0xa0/0x210
[<c0550a93>] ? cpu_clock_event_read+0x43/0x50
[<c0553431>] perf_swevent_hrtimer+0x101/0x180
[<c0456235>] ? kmap_atomic_prot+0x35/0x140
[<c056dc69>] ? get_page_from_freelist+0x279/0x950
[<c058fdd8>] ? vma_interval_tree_remove+0x158/0x230
[<c05939f4>] ? wp_page_copy.isra.82+0x2f4/0x630
[<c05a050d>] ? page_add_file_rmap+0x1d/0x50
[<c0565611>] ? unlock_page+0x61/0x80
[<c0566755>] ? filemap_map_pages+0x305/0x320
[<c059769f>] ? handle_mm_fault+0xb7f/0x1560
[<c074cbeb>] ? timerqueue_del+0x1b/0x70
[<c04cfefe>] ? __remove_hrtimer+0x2e/0x60
[<c04d017b>] __hrtimer_run_queues+0xcb/0x2a0
[<c0553330>] ? __perf_event_overflow+0x210/0x210
[<c04d0a2a>] hrtimer_interrupt+0x8a/0x180
[<c043ecc2>] local_apic_timer_interrupt+0x32/0x60
[<c043f643>] smp_apic_timer_interrupt+0x33/0x50
[<c0b0cd38>] apic_timer_interrupt+0x34/0x3c
Kernel Offset: disabled
---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: c0404fbd
The panic is caused by the fact that perf_callchain_user() mistakenly
assumes it's 64-bit only and ends up corrupting the stack.
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: 75925e1ad7f5 ("perf/x86: Optimize stack walk user accesses")
Link: http://lkml.kernel.org/r/1a547f5077ec30f75f9b57074837c3c80df86e5e.1467432113.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/events/core.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2313,7 +2313,7 @@ void
perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
{
struct stack_frame frame;
- const void __user *fp;
+ const unsigned long __user *fp;
if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) {
/* TODO: We don't support guest os callchain now */
@@ -2326,7 +2326,7 @@ perf_callchain_user(struct perf_callchai
if (regs->flags & (X86_VM_MASK | PERF_EFLAGS_VM))
return;
- fp = (void __user *)regs->bp;
+ fp = (unsigned long __user *)regs->bp;
perf_callchain_store(entry, regs->ip);
@@ -2339,16 +2339,17 @@ perf_callchain_user(struct perf_callchai
pagefault_disable();
while (entry->nr < PERF_MAX_STACK_DEPTH) {
unsigned long bytes;
+
frame.next_frame = NULL;
frame.return_address = 0;
- if (!access_ok(VERIFY_READ, fp, 16))
+ if (!access_ok(VERIFY_READ, fp, sizeof(*fp) * 2))
break;
- bytes = __copy_from_user_nmi(&frame.next_frame, fp, 8);
+ bytes = __copy_from_user_nmi(&frame.next_frame, fp, sizeof(*fp));
if (bytes != 0)
break;
- bytes = __copy_from_user_nmi(&frame.return_address, fp+8, 8);
+ bytes = __copy_from_user_nmi(&frame.return_address, fp + 1, sizeof(*fp));
if (bytes != 0)
break;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 037/203] extcon: palmas: Fix boot up state of VBUS when using GPIO detection
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 036/203] perf/x86: Fix 32-bit perf user callgraph collection Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 038/203] gpio: make library immune to error pointers Greg Kroah-Hartman
` (157 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Roger Quadros, Chanwoo Choi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <rogerq@ti.com>
commit 62e6d1e59c77316768a663d1328390b4cd33801f upstream.
If USB cable is connected prior to boot, we don't get any interrupts
so we must manually check the VBUS state and report it during probe.
If we don't do it then USB controller will never know that peripheral
cable was connected till the user unplugs and replugs the cable.
Fixes: b7aad8e2685b ("extcon: palmas: Add the support for VBUS detection by using GPIO")
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/extcon/extcon-palmas.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/extcon/extcon-palmas.c
+++ b/drivers/extcon/extcon-palmas.c
@@ -360,6 +360,8 @@ static int palmas_usb_probe(struct platf
palmas_enable_irq(palmas_usb);
/* perform initial detection */
+ if (palmas_usb->enable_gpio_vbus_detection)
+ palmas_vbus_irq_handler(palmas_usb->gpio_vbus_irq, palmas_usb);
palmas_gpio_id_detect(&palmas_usb->wq_detectid.work);
device_set_wakeup_capable(&pdev->dev, true);
return 0;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 038/203] gpio: make library immune to error pointers
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 037/203] extcon: palmas: Fix boot up state of VBUS when using GPIO detection Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 039/203] gpio: sch: Fix Oops on module load on Asus Eee PC 1201 Greg Kroah-Hartman
` (156 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Grygorii Strashko, Alexandre Courbot,
Linus Walleij
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit c0a1ecb9f4e208f4b75d88fa9669748e3fd705ab upstream.
Most functions that take a GPIO descriptor in need to check the
descriptor for IS_ERR(). We do this mostly in the VALIDATE_DESC()
macro except for the gpiod_to_irq() function which needs special
handling.
Reported-by: Grygorii Strashko <grygorii.strashko@ti.com>
Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpiolib.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1345,8 +1345,12 @@ done:
#define VALIDATE_DESC(desc) do { \
if (!desc) \
return 0; \
+ if (IS_ERR(desc)) { \
+ pr_warn("%s: invalid GPIO (errorpointer)\n", __func__); \
+ return PTR_ERR(desc); \
+ } \
if (!desc->gdev) { \
- pr_warn("%s: invalid GPIO\n", __func__); \
+ pr_warn("%s: invalid GPIO (no device)\n", __func__); \
return -EINVAL; \
} \
if ( !desc->gdev->chip ) { \
@@ -1358,8 +1362,12 @@ done:
#define VALIDATE_DESC_VOID(desc) do { \
if (!desc) \
return; \
+ if (IS_ERR(desc)) { \
+ pr_warn("%s: invalid GPIO (errorpointer)\n", __func__); \
+ return; \
+ } \
if (!desc->gdev) { \
- pr_warn("%s: invalid GPIO\n", __func__); \
+ pr_warn("%s: invalid GPIO (no device)\n", __func__); \
return; \
} \
if (!desc->gdev->chip) { \
@@ -2011,7 +2019,7 @@ int gpiod_to_irq(const struct gpio_desc
* requires this function to not return zero on an invalid descriptor
* but rather a negative error number.
*/
- if (!desc || !desc->gdev || !desc->gdev->chip)
+ if (!desc || IS_ERR(desc) || !desc->gdev || !desc->gdev->chip)
return -EINVAL;
chip = desc->gdev->chip;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 039/203] gpio: sch: Fix Oops on module load on Asus Eee PC 1201
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 038/203] gpio: make library immune to error pointers Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 040/203] Revert "gpiolib: Split GPIO flags parsing and GPIO configuration" Greg Kroah-Hartman
` (155 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Pitrat, Alexandre Courbot,
Mika Westerberg, Linus Walleij
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Pitrat <colin.pitrat@gmail.com>
commit 87041a58d3b19455d39baed2a5e5bb43b58fb915 upstream.
This fixes the issue descirbe in bug 117531
(https://bugzilla.kernel.org/show_bug.cgi?id=117531).
It's a regression introduced in linux 4.5 that causes a Oops at load of
gpio_sch and prevents powering off the computer.
The issue is that sch_gpio_reg_set is called in sch_gpio_probe before
gpio_chip data is initialized with the pointer to the sch_gpio struct. As
sch_gpio_reg_set calls gpiochip_get_data, it returns NULL which causes
the Oops.
The patch follows Mika's advice (https://lkml.org/lkml/2016/5/9/61) and
consists in modifying sch_gpio_reg_get and sch_gpio_reg_set to take a
sch_gpio struct directly instead of a gpio_chip, which avoids the call to
gpiochip_get_data.
Thanks Mika for your patience with me :-)
Signed-off-by: Colin Pitrat <colin.pitrat@gmail.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-sch.c | 21 ++++++++++-----------
1 file changed, 10 insertions(+), 11 deletions(-)
--- a/drivers/gpio/gpio-sch.c
+++ b/drivers/gpio/gpio-sch.c
@@ -61,9 +61,8 @@ static unsigned sch_gpio_bit(struct sch_
return gpio % 8;
}
-static int sch_gpio_reg_get(struct gpio_chip *gc, unsigned gpio, unsigned reg)
+static int sch_gpio_reg_get(struct sch_gpio *sch, unsigned gpio, unsigned reg)
{
- struct sch_gpio *sch = gpiochip_get_data(gc);
unsigned short offset, bit;
u8 reg_val;
@@ -75,10 +74,9 @@ static int sch_gpio_reg_get(struct gpio_
return reg_val;
}
-static void sch_gpio_reg_set(struct gpio_chip *gc, unsigned gpio, unsigned reg,
+static void sch_gpio_reg_set(struct sch_gpio *sch, unsigned gpio, unsigned reg,
int val)
{
- struct sch_gpio *sch = gpiochip_get_data(gc);
unsigned short offset, bit;
u8 reg_val;
@@ -98,14 +96,15 @@ static int sch_gpio_direction_in(struct
struct sch_gpio *sch = gpiochip_get_data(gc);
spin_lock(&sch->lock);
- sch_gpio_reg_set(gc, gpio_num, GIO, 1);
+ sch_gpio_reg_set(sch, gpio_num, GIO, 1);
spin_unlock(&sch->lock);
return 0;
}
static int sch_gpio_get(struct gpio_chip *gc, unsigned gpio_num)
{
- return sch_gpio_reg_get(gc, gpio_num, GLV);
+ struct sch_gpio *sch = gpiochip_get_data(gc);
+ return sch_gpio_reg_get(sch, gpio_num, GLV);
}
static void sch_gpio_set(struct gpio_chip *gc, unsigned gpio_num, int val)
@@ -113,7 +112,7 @@ static void sch_gpio_set(struct gpio_chi
struct sch_gpio *sch = gpiochip_get_data(gc);
spin_lock(&sch->lock);
- sch_gpio_reg_set(gc, gpio_num, GLV, val);
+ sch_gpio_reg_set(sch, gpio_num, GLV, val);
spin_unlock(&sch->lock);
}
@@ -123,7 +122,7 @@ static int sch_gpio_direction_out(struct
struct sch_gpio *sch = gpiochip_get_data(gc);
spin_lock(&sch->lock);
- sch_gpio_reg_set(gc, gpio_num, GIO, 0);
+ sch_gpio_reg_set(sch, gpio_num, GIO, 0);
spin_unlock(&sch->lock);
/*
@@ -182,13 +181,13 @@ static int sch_gpio_probe(struct platfor
* GPIO7 is configured by the CMC as SLPIOVR
* Enable GPIO[9:8] core powered gpios explicitly
*/
- sch_gpio_reg_set(&sch->chip, 8, GEN, 1);
- sch_gpio_reg_set(&sch->chip, 9, GEN, 1);
+ sch_gpio_reg_set(sch, 8, GEN, 1);
+ sch_gpio_reg_set(sch, 9, GEN, 1);
/*
* SUS_GPIO[2:0] enabled by default
* Enable SUS_GPIO3 resume powered gpio explicitly
*/
- sch_gpio_reg_set(&sch->chip, 13, GEN, 1);
+ sch_gpio_reg_set(sch, 13, GEN, 1);
break;
case PCI_DEVICE_ID_INTEL_ITC_LPC:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 040/203] Revert "gpiolib: Split GPIO flags parsing and GPIO configuration"
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 039/203] gpio: sch: Fix Oops on module load on Asus Eee PC 1201 Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 041/203] autofs braino fix for do_last() Greg Kroah-Hartman
` (154 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Linus Walleij
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 85b03b3033fd4eba82665b3b9902c095a08cc52f upstream.
This reverts commit 923b93e451db876d1479d3e4458fce14fec31d1c.
Make sure consumers do not overwrite gpio flags for pins that have
already been claimed.
While adding support for gpio drivers to refuse a request using
unsupported flags, the order of when the requested flag was checked and
the new flags were applied was reversed to that consumers could
overwrite flags for already requested gpios.
This not only affects device-tree setups where two drivers could request
the same gpio using conflicting configurations, but also allowed user
space to clear gpio flags for already claimed pins simply by attempting
to export them through the sysfs interface. By for example clearing the
FLAG_ACTIVE_LOW flag this way, user space could effectively change the
polarity of a signal.
Reverting this change obviously prevents gpio drivers from doing sanity
checks on the flags in their request callbacks. Fortunately only one
recently added driver (gpio-tps65218 in v4.6) appears to do this, and a
follow up patch could restore this functionality through a different
interface.
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpiolib-legacy.c | 8 +++---
drivers/gpio/gpiolib.c | 52 ++++++++++++------------------------------
2 files changed, 20 insertions(+), 40 deletions(-)
--- a/drivers/gpio/gpiolib-legacy.c
+++ b/drivers/gpio/gpiolib-legacy.c
@@ -28,6 +28,10 @@ int gpio_request_one(unsigned gpio, unsi
if (!desc && gpio_is_valid(gpio))
return -EPROBE_DEFER;
+ err = gpiod_request(desc, label);
+ if (err)
+ return err;
+
if (flags & GPIOF_OPEN_DRAIN)
set_bit(FLAG_OPEN_DRAIN, &desc->flags);
@@ -37,10 +41,6 @@ int gpio_request_one(unsigned gpio, unsi
if (flags & GPIOF_ACTIVE_LOW)
set_bit(FLAG_ACTIVE_LOW, &desc->flags);
- err = gpiod_request(desc, label);
- if (err)
- return err;
-
if (flags & GPIOF_DIR_IN)
err = gpiod_direction_input(desc);
else
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1324,14 +1324,6 @@ static int __gpiod_request(struct gpio_d
spin_lock_irqsave(&gpio_lock, flags);
}
done:
- if (status < 0) {
- /* Clear flags that might have been set by the caller before
- * requesting the GPIO.
- */
- clear_bit(FLAG_ACTIVE_LOW, &desc->flags);
- clear_bit(FLAG_OPEN_DRAIN, &desc->flags);
- clear_bit(FLAG_OPEN_SOURCE, &desc->flags);
- }
spin_unlock_irqrestore(&gpio_lock, flags);
return status;
}
@@ -2515,28 +2507,13 @@ struct gpio_desc *__must_check gpiod_get
}
EXPORT_SYMBOL_GPL(gpiod_get_optional);
-/**
- * gpiod_parse_flags - helper function to parse GPIO lookup flags
- * @desc: gpio to be setup
- * @lflags: gpio_lookup_flags - returned from of_find_gpio() or
- * of_get_gpio_hog()
- *
- * Set the GPIO descriptor flags based on the given GPIO lookup flags.
- */
-static void gpiod_parse_flags(struct gpio_desc *desc, unsigned long lflags)
-{
- if (lflags & GPIO_ACTIVE_LOW)
- set_bit(FLAG_ACTIVE_LOW, &desc->flags);
- if (lflags & GPIO_OPEN_DRAIN)
- set_bit(FLAG_OPEN_DRAIN, &desc->flags);
- if (lflags & GPIO_OPEN_SOURCE)
- set_bit(FLAG_OPEN_SOURCE, &desc->flags);
-}
/**
* gpiod_configure_flags - helper function to configure a given GPIO
* @desc: gpio whose value will be assigned
* @con_id: function within the GPIO consumer
+ * @lflags: gpio_lookup_flags - returned from of_find_gpio() or
+ * of_get_gpio_hog()
* @dflags: gpiod_flags - optional GPIO initialization flags
*
* Return 0 on success, -ENOENT if no GPIO has been assigned to the
@@ -2544,10 +2521,17 @@ static void gpiod_parse_flags(struct gpi
* occurred while trying to acquire the GPIO.
*/
static int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id,
- enum gpiod_flags dflags)
+ unsigned long lflags, enum gpiod_flags dflags)
{
int status;
+ if (lflags & GPIO_ACTIVE_LOW)
+ set_bit(FLAG_ACTIVE_LOW, &desc->flags);
+ if (lflags & GPIO_OPEN_DRAIN)
+ set_bit(FLAG_OPEN_DRAIN, &desc->flags);
+ if (lflags & GPIO_OPEN_SOURCE)
+ set_bit(FLAG_OPEN_SOURCE, &desc->flags);
+
/* No particular flag request, return here... */
if (!(dflags & GPIOD_FLAGS_BIT_DIR_SET)) {
pr_debug("no flags found for %s\n", con_id);
@@ -2614,13 +2598,11 @@ struct gpio_desc *__must_check gpiod_get
return desc;
}
- gpiod_parse_flags(desc, lookupflags);
-
status = gpiod_request(desc, con_id);
if (status < 0)
return ERR_PTR(status);
- status = gpiod_configure_flags(desc, con_id, flags);
+ status = gpiod_configure_flags(desc, con_id, lookupflags, flags);
if (status < 0) {
dev_dbg(dev, "setup of GPIO %s failed\n", con_id);
gpiod_put(desc);
@@ -2676,6 +2658,10 @@ struct gpio_desc *fwnode_get_named_gpiod
if (IS_ERR(desc))
return desc;
+ ret = gpiod_request(desc, NULL);
+ if (ret)
+ return ERR_PTR(ret);
+
if (active_low)
set_bit(FLAG_ACTIVE_LOW, &desc->flags);
@@ -2686,10 +2672,6 @@ struct gpio_desc *fwnode_get_named_gpiod
set_bit(FLAG_OPEN_SOURCE, &desc->flags);
}
- ret = gpiod_request(desc, NULL);
- if (ret)
- return ERR_PTR(ret);
-
return desc;
}
EXPORT_SYMBOL_GPL(fwnode_get_named_gpiod);
@@ -2742,8 +2724,6 @@ int gpiod_hog(struct gpio_desc *desc, co
chip = gpiod_to_chip(desc);
hwnum = gpio_chip_hwgpio(desc);
- gpiod_parse_flags(desc, lflags);
-
local_desc = gpiochip_request_own_desc(chip, hwnum, name);
if (IS_ERR(local_desc)) {
pr_err("requesting hog GPIO %s (chip %s, offset %d) failed\n",
@@ -2751,7 +2731,7 @@ int gpiod_hog(struct gpio_desc *desc, co
return PTR_ERR(local_desc);
}
- status = gpiod_configure_flags(desc, name, dflags);
+ status = gpiod_configure_flags(desc, name, lflags, dflags);
if (status < 0) {
pr_err("setup of hog GPIO %s (chip %s, offset %d) failed\n",
name, chip->label, hwnum);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 041/203] autofs braino fix for do_last()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 040/203] Revert "gpiolib: Split GPIO flags parsing and GPIO configuration" Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 042/203] rtlwifi: Fix scheduling while atomic error from commit 49f86ec21c01 Greg Kroah-Hartman
` (153 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit e6ec03a25f12b312b7e0c037fe4a6471c4ee5665 upstream.
It's an analogue of commit 7500c38a (fix the braino in "namei:
massage lookup_slow() to be usable by lookup_one_len_unlocked()").
The same problem (->lookup()-returned unhashed negative dentry
just might be an autofs one with ->d_manage() that would wait
until the daemon makes it positive) applies in do_last() - we
need to do follow_managed() first.
Fortunately, remaining callers of follow_managed() are OK - only
autofs has that weirdness (negative dentry that does not mean
an instant -ENOENT)) and autofs never has its negative dentries
hashed, so we can't pick one from a dcache lookup.
->d_manage() is a bloody mess ;-/
Spotted-by: Ian Kent <raven@themaw.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namei.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3173,6 +3173,10 @@ retry_lookup:
got_write = false;
}
+ error = follow_managed(&path, nd);
+ if (unlikely(error < 0))
+ return error;
+
if (unlikely(d_is_negative(path.dentry))) {
path_to_nameidata(&path, nd);
return -ENOENT;
@@ -3188,10 +3192,6 @@ retry_lookup:
return -EEXIST;
}
- error = follow_managed(&path, nd);
- if (unlikely(error < 0))
- return error;
-
seq = 0; /* out of RCU mode, so the value doesn't matter */
inode = d_backing_inode(path.dentry);
finish_lookup:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 042/203] rtlwifi: Fix scheduling while atomic error from commit 49f86ec21c01
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 041/203] autofs braino fix for do_last() Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 043/203] uvc: Forward compat ioctls to their handlers directly Greg Kroah-Hartman
` (152 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Feeney, Larry Finger, Kalle Valo
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit de26859dcf363d520cc44e59f6dcaf20ebe0aadf upstream.
Commit 49f86ec21c01 ("rtlwifi: Change long delays to sleeps") was correct
for most cases; however, driver rtl8192ce calls the affected routines while
in atomic context. The kernel bug output is as follows:
BUG: scheduling while atomic: wpa_supplicant/627/0x00000002
[...]
[<ffffffff815c2b39>] __schedule+0x899/0xad0
[<ffffffff815c2dac>] schedule+0x3c/0x90
[<ffffffff815c5bb2>] schedule_hrtimeout_range_clock+0xa2/0x120
[<ffffffff810e8b80>] ? hrtimer_init+0x120/0x120
[<ffffffff815c5ba6>] ? schedule_hrtimeout_range_clock+0x96/0x120
[<ffffffff815c5c43>] schedule_hrtimeout_range+0x13/0x20
[<ffffffff815c568f>] usleep_range+0x4f/0x70
[<ffffffffa0667218>] rtl_rfreg_delay+0x38/0x50 [rtlwifi]
[<ffffffffa06dd0e7>] rtl92c_phy_config_rf_with_headerfile+0xc7/0xe0 [rtl8192ce]
To fix this bug, three of the changes from delay to sleep are reverted.
Unfortunately, one of the changes involves a delay of 50 msec. The calling
code will be modified so that this long delay can be avoided; however,
this change is being pushed now to fix the problem in kernel 4.6.0.
Fixes: 49f86ec21c01 ("rtlwifi: Change long delays to sleeps")
Reported-by: James Feeney <james@nurealm.net>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: James Feeney <james@nurealm.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/realtek/rtlwifi/core.c
+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -54,7 +54,7 @@ EXPORT_SYMBOL(channel5g_80m);
void rtl_addr_delay(u32 addr)
{
if (addr == 0xfe)
- msleep(50);
+ mdelay(50);
else if (addr == 0xfd)
msleep(5);
else if (addr == 0xfc)
@@ -75,7 +75,7 @@ void rtl_rfreg_delay(struct ieee80211_hw
rtl_addr_delay(addr);
} else {
rtl_set_rfreg(hw, rfpath, addr, mask, data);
- usleep_range(1, 2);
+ udelay(1);
}
}
EXPORT_SYMBOL(rtl_rfreg_delay);
@@ -86,7 +86,7 @@ void rtl_bb_delay(struct ieee80211_hw *h
rtl_addr_delay(addr);
} else {
rtl_set_bbreg(hw, addr, MASKDWORD, data);
- usleep_range(1, 2);
+ udelay(1);
}
}
EXPORT_SYMBOL(rtl_bb_delay);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 043/203] uvc: Forward compat ioctls to their handlers directly
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 042/203] rtlwifi: Fix scheduling while atomic error from commit 49f86ec21c01 Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 044/203] thermal: cpu_cooling: fix improper order during initialization Greg Kroah-Hartman
` (151 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andy Lutomirski
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
commit a44323e2a8f342848bb77e8e04fcd85fcb91b3b4 upstream.
The current code goes through a lot of indirection just to call a
known handler. Simplify it: just call the handlers directly.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_v4l2.c | 39 ++++++++++++++++++---------------------
1 file changed, 18 insertions(+), 21 deletions(-)
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -1408,47 +1408,44 @@ static int uvc_v4l2_put_xu_query(const s
static long uvc_v4l2_compat_ioctl32(struct file *file,
unsigned int cmd, unsigned long arg)
{
+ struct uvc_fh *handle = file->private_data;
union {
struct uvc_xu_control_mapping xmap;
struct uvc_xu_control_query xqry;
} karg;
void __user *up = compat_ptr(arg);
- mm_segment_t old_fs;
long ret;
switch (cmd) {
case UVCIOC_CTRL_MAP32:
- cmd = UVCIOC_CTRL_MAP;
ret = uvc_v4l2_get_xu_mapping(&karg.xmap, up);
+ if (ret)
+ return ret;
+ ret = uvc_ioctl_ctrl_map(handle->chain, &karg.xmap);
+ if (ret)
+ return ret;
+ ret = uvc_v4l2_put_xu_mapping(&karg.xmap, up);
+ if (ret)
+ return ret;
+
break;
case UVCIOC_CTRL_QUERY32:
- cmd = UVCIOC_CTRL_QUERY;
ret = uvc_v4l2_get_xu_query(&karg.xqry, up);
+ if (ret)
+ return ret;
+ ret = uvc_xu_ctrl_query(handle->chain, &karg.xqry);
+ if (ret)
+ return ret;
+ ret = uvc_v4l2_put_xu_query(&karg.xqry, up);
+ if (ret)
+ return ret;
break;
default:
return -ENOIOCTLCMD;
}
- old_fs = get_fs();
- set_fs(KERNEL_DS);
- ret = video_ioctl2(file, cmd, (unsigned long)&karg);
- set_fs(old_fs);
-
- if (ret < 0)
- return ret;
-
- switch (cmd) {
- case UVCIOC_CTRL_MAP:
- ret = uvc_v4l2_put_xu_mapping(&karg.xmap, up);
- break;
-
- case UVCIOC_CTRL_QUERY:
- ret = uvc_v4l2_put_xu_query(&karg.xqry, up);
- break;
- }
-
return ret;
}
#endif
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 044/203] thermal: cpu_cooling: fix improper order during initialization
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 043/203] uvc: Forward compat ioctls to their handlers directly Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 045/203] writeback: use higher precision calculation in domain_dirty_limits() Greg Kroah-Hartman
` (150 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukasz Luba, Javi Merino,
Viresh Kumar, Zhang Rui
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Luba <lukasz.luba@arm.com>
commit f840ab18bdf2e415dac21d09fbbbd2873111bd48 upstream.
The freq_table array is not populated before calling
thermal_of_cooling_register. The code which populates the freq table was
introduced in commit f6859014.
This should be done before registering new thermal cooling device.
The log shows effects of this wrong decision.
[ 2.172614] cpu cpu1: Failed to get voltage for frequency 1984518656000: -34
[ 2.220863] cpu cpu0: Failed to get voltage for frequency 1984524416000: -34
Fixes: f6859014c7e7 ("thermal: cpu_cooling: Store frequencies in descending order")
Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
Acked-by: Javi Merino <javi.merino@arm.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/cpu_cooling.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -857,14 +857,6 @@ __cpufreq_cooling_register(struct device
goto free_power_table;
}
- snprintf(dev_name, sizeof(dev_name), "thermal-cpufreq-%d",
- cpufreq_dev->id);
-
- cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev,
- &cpufreq_cooling_ops);
- if (IS_ERR(cool_dev))
- goto remove_idr;
-
/* Fill freq-table in descending order of frequencies */
for (i = 0, freq = -1; i <= cpufreq_dev->max_level; i++) {
freq = find_next_max(table, freq);
@@ -877,6 +869,14 @@ __cpufreq_cooling_register(struct device
pr_debug("%s: freq:%u KHz\n", __func__, freq);
}
+ snprintf(dev_name, sizeof(dev_name), "thermal-cpufreq-%d",
+ cpufreq_dev->id);
+
+ cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev,
+ &cpufreq_cooling_ops);
+ if (IS_ERR(cool_dev))
+ goto remove_idr;
+
cpufreq_dev->clipped_freq = cpufreq_dev->freq_table[0];
cpufreq_dev->cool_dev = cool_dev;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 045/203] writeback: use higher precision calculation in domain_dirty_limits()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 044/203] thermal: cpu_cooling: fix improper order during initialization Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 046/203] sd: Fix rw_max for devices that report an optimal xfer size Greg Kroah-Hartman
` (149 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Miao Xie, Jan Kara, Jens Axboe
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 62a584fe05eef1f80ed49a286a29328f1a224fb9 upstream.
As vm.dirty_[background_]bytes can't be applied verbatim to multiple
cgroup writeback domains, they get converted to percentages in
domain_dirty_limits() and applied the same way as
vm.dirty_[background]ratio. However, if the specified bytes is lower
than 1% of available memory, the calculated ratios become zero and the
writeback domain gets throttled constantly.
Fix it by using per-PAGE_SIZE instead of percentage for ratio
calculations. Also, the updated DIV_ROUND_UP() usages now should
yield 1/4096 (0.0244%) as the minimum ratio as long as the specified
bytes are above zero.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Miao Xie <miaoxie@huawei.com>
Link: http://lkml.kernel.org/g/57333E75.3080309@huawei.com
Fixes: 9fc3a43e1757 ("writeback: separate out domain_dirty_limits()")
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Adjusted comment based on Jan's suggestion.
Signed-off-by: Jens Axboe <axboe@fb.com>
---
mm/page-writeback.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -369,8 +369,9 @@ static void domain_dirty_limits(struct d
struct dirty_throttle_control *gdtc = mdtc_gdtc(dtc);
unsigned long bytes = vm_dirty_bytes;
unsigned long bg_bytes = dirty_background_bytes;
- unsigned long ratio = vm_dirty_ratio;
- unsigned long bg_ratio = dirty_background_ratio;
+ /* convert ratios to per-PAGE_SIZE for higher precision */
+ unsigned long ratio = (vm_dirty_ratio * PAGE_SIZE) / 100;
+ unsigned long bg_ratio = (dirty_background_ratio * PAGE_SIZE) / 100;
unsigned long thresh;
unsigned long bg_thresh;
struct task_struct *tsk;
@@ -382,26 +383,28 @@ static void domain_dirty_limits(struct d
/*
* The byte settings can't be applied directly to memcg
* domains. Convert them to ratios by scaling against
- * globally available memory.
+ * globally available memory. As the ratios are in
+ * per-PAGE_SIZE, they can be obtained by dividing bytes by
+ * number of pages.
*/
if (bytes)
- ratio = min(DIV_ROUND_UP(bytes, PAGE_SIZE) * 100 /
- global_avail, 100UL);
+ ratio = min(DIV_ROUND_UP(bytes, global_avail),
+ PAGE_SIZE);
if (bg_bytes)
- bg_ratio = min(DIV_ROUND_UP(bg_bytes, PAGE_SIZE) * 100 /
- global_avail, 100UL);
+ bg_ratio = min(DIV_ROUND_UP(bg_bytes, global_avail),
+ PAGE_SIZE);
bytes = bg_bytes = 0;
}
if (bytes)
thresh = DIV_ROUND_UP(bytes, PAGE_SIZE);
else
- thresh = (ratio * available_memory) / 100;
+ thresh = (ratio * available_memory) / PAGE_SIZE;
if (bg_bytes)
bg_thresh = DIV_ROUND_UP(bg_bytes, PAGE_SIZE);
else
- bg_thresh = (bg_ratio * available_memory) / 100;
+ bg_thresh = (bg_ratio * available_memory) / PAGE_SIZE;
if (bg_thresh >= thresh)
bg_thresh = thresh / 2;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 046/203] sd: Fix rw_max for devices that report an optimal xfer size
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 045/203] writeback: use higher precision calculation in domain_dirty_limits() Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 047/203] nfsd4/rpc: move backchannel create logic into rpc code Greg Kroah-Hartman
` (148 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fam Zheng, Bart Van Assche,
Christoph Hellwig, Andrew Patterson, Martin K. Petersen
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin K. Petersen <martin.petersen@oracle.com>
commit 6b7e9cde49691e04314342b7dce90c67ad567fcc upstream.
For historic reasons, io_opt is in bytes and max_sectors in block layer
sectors. This interface inconsistency is error prone and should be
fixed. But for 4.4--4.7 let's make the unit difference explicit via a
wrapper function.
Fixes: d0eb20a863ba ("sd: Optimal I/O size is in bytes, not sectors")
Reported-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Andrew Patterson <andrew.patterson@hpe.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sd.c | 8 ++++----
drivers/scsi/sd.h | 5 +++++
2 files changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2862,10 +2862,10 @@ static int sd_revalidate_disk(struct gen
if (sdkp->opt_xfer_blocks &&
sdkp->opt_xfer_blocks <= dev_max &&
sdkp->opt_xfer_blocks <= SD_DEF_XFER_BLOCKS &&
- sdkp->opt_xfer_blocks * sdp->sector_size >= PAGE_SIZE)
- rw_max = q->limits.io_opt =
- sdkp->opt_xfer_blocks * sdp->sector_size;
- else
+ logical_to_bytes(sdp, sdkp->opt_xfer_blocks) >= PAGE_SIZE) {
+ q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
+ rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
+ } else
rw_max = BLK_DEF_MAX_SECTORS;
/* Combine with controller limits */
--- a/drivers/scsi/sd.h
+++ b/drivers/scsi/sd.h
@@ -151,6 +151,11 @@ static inline sector_t logical_to_sector
return blocks << (ilog2(sdev->sector_size) - 9);
}
+static inline unsigned int logical_to_bytes(struct scsi_device *sdev, sector_t blocks)
+{
+ return blocks * sdev->sector_size;
+}
+
/*
* A DIF-capable target device can be formatted with different
* protection schemes. Currently 0 through 3 are defined:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 047/203] nfsd4/rpc: move backchannel create logic into rpc code
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 046/203] sd: Fix rw_max for devices that report an optimal xfer size Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 048/203] nfsd: Always lock state exclusively Greg Kroah-Hartman
` (147 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields, Trond Myklebust
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Bruce Fields <bfields@redhat.com>
commit d50039ea5ee63c589b0434baa5ecf6e5075bb6f9 upstream.
Also simplify the logic a bit.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Acked-by: Trond Myklebust <trondmy@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4callback.c | 18 +-----------------
include/linux/sunrpc/clnt.h | 2 --
net/sunrpc/clnt.c | 12 ++++++++++--
3 files changed, 11 insertions(+), 21 deletions(-)
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -710,22 +710,6 @@ static struct rpc_cred *get_backchannel_
}
}
-static struct rpc_clnt *create_backchannel_client(struct rpc_create_args *args)
-{
- struct rpc_xprt *xprt;
-
- if (args->protocol != XPRT_TRANSPORT_BC_TCP)
- return rpc_create(args);
-
- xprt = args->bc_xprt->xpt_bc_xprt;
- if (xprt) {
- xprt_get(xprt);
- return rpc_create_xprt(args, xprt);
- }
-
- return rpc_create(args);
-}
-
static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
{
int maxtime = max_cb_time(clp->net);
@@ -768,7 +752,7 @@ static int setup_callback_client(struct
args.authflavor = ses->se_cb_sec.flavor;
}
/* Create RPC client */
- client = create_backchannel_client(&args);
+ client = rpc_create(&args);
if (IS_ERR(client)) {
dprintk("NFSD: couldn't create callback client: %ld\n",
PTR_ERR(client));
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -137,8 +137,6 @@ struct rpc_create_args {
#define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9)
struct rpc_clnt *rpc_create(struct rpc_create_args *args);
-struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
- struct rpc_xprt *xprt);
struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *,
const struct rpc_program *, u32);
struct rpc_clnt *rpc_clone_client(struct rpc_clnt *);
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -446,7 +446,7 @@ out_no_rpciod:
return ERR_PTR(err);
}
-struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
+static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
struct rpc_xprt *xprt)
{
struct rpc_clnt *clnt = NULL;
@@ -483,7 +483,6 @@ struct rpc_clnt *rpc_create_xprt(struct
return clnt;
}
-EXPORT_SYMBOL_GPL(rpc_create_xprt);
/**
* rpc_create - create an RPC client and transport with one call
@@ -509,6 +508,15 @@ struct rpc_clnt *rpc_create(struct rpc_c
};
char servername[48];
+ if (args->bc_xprt) {
+ WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+ xprt = args->bc_xprt->xpt_bc_xprt;
+ if (xprt) {
+ xprt_get(xprt);
+ return rpc_create_xprt(args, xprt);
+ }
+ }
+
if (args->flags & RPC_CLNT_CREATE_INFINITE_SLOTS)
xprtargs.flags |= XPRT_CREATE_INFINITE_SLOTS;
if (args->flags & RPC_CLNT_CREATE_NO_IDLE_TIMEOUT)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 048/203] nfsd: Always lock state exclusively.
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 047/203] nfsd4/rpc: move backchannel create logic into rpc code Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 049/203] nfsd: Extend the mutex holding region around in nfsd4_process_open2() Greg Kroah-Hartman
` (146 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Oleg Drokin, J. Bruce Fields
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Drokin <green@linuxhacker.ru>
commit feb9dad5209280085d5b0c094fa67e7a8d75c81a upstream.
It used to be the case that state had an rwlock that was locked for write
by downgrades, but for read for upgrades (opens). Well, the problem is
if there are two competing opens for the same state, they step on
each other toes potentially leading to leaking file descriptors
from the state structure, since access mode is a bitmap only set once.
Signed-off-by: Oleg Drokin <green@linuxhacker.ru>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 40 ++++++++++++++++++++--------------------
fs/nfsd/state.h | 2 +-
2 files changed, 21 insertions(+), 21 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3502,7 +3502,7 @@ init_open_stateid(struct nfs4_ol_stateid
stp->st_access_bmap = 0;
stp->st_deny_bmap = 0;
stp->st_openstp = NULL;
- init_rwsem(&stp->st_rwsem);
+ mutex_init(&stp->st_mutex);
list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
list_add(&stp->st_perfile, &fp->fi_stateids);
@@ -4335,10 +4335,10 @@ nfsd4_process_open2(struct svc_rqst *rqs
*/
if (stp) {
/* Stateid was found, this is an OPEN upgrade */
- down_read(&stp->st_rwsem);
+ mutex_lock(&stp->st_mutex);
status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
if (status) {
- up_read(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
goto out;
}
} else {
@@ -4348,19 +4348,19 @@ nfsd4_process_open2(struct svc_rqst *rqs
if (swapstp) {
nfs4_put_stid(&stp->st_stid);
stp = swapstp;
- down_read(&stp->st_rwsem);
+ mutex_lock(&stp->st_mutex);
status = nfs4_upgrade_open(rqstp, fp, current_fh,
stp, open);
if (status) {
- up_read(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
goto out;
}
goto upgrade_out;
}
- down_read(&stp->st_rwsem);
+ mutex_lock(&stp->st_mutex);
status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
if (status) {
- up_read(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
release_open_stateid(stp);
goto out;
}
@@ -4372,7 +4372,7 @@ nfsd4_process_open2(struct svc_rqst *rqs
}
upgrade_out:
nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid);
- up_read(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
if (nfsd4_has_session(&resp->cstate)) {
if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
@@ -4983,12 +4983,12 @@ static __be32 nfs4_seqid_op_checks(struc
* revoked delegations are kept only for free_stateid.
*/
return nfserr_bad_stateid;
- down_write(&stp->st_rwsem);
+ mutex_lock(&stp->st_mutex);
status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
if (status == nfs_ok)
status = nfs4_check_fh(current_fh, &stp->st_stid);
if (status != nfs_ok)
- up_write(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
return status;
}
@@ -5036,7 +5036,7 @@ static __be32 nfs4_preprocess_confirmed_
return status;
oo = openowner(stp->st_stateowner);
if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
- up_write(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
nfs4_put_stid(&stp->st_stid);
return nfserr_bad_stateid;
}
@@ -5068,12 +5068,12 @@ nfsd4_open_confirm(struct svc_rqst *rqst
oo = openowner(stp->st_stateowner);
status = nfserr_bad_stateid;
if (oo->oo_flags & NFS4_OO_CONFIRMED) {
- up_write(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
goto put_stateid;
}
oo->oo_flags |= NFS4_OO_CONFIRMED;
nfs4_inc_and_copy_stateid(&oc->oc_resp_stateid, &stp->st_stid);
- up_write(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
__func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
@@ -5149,7 +5149,7 @@ nfsd4_open_downgrade(struct svc_rqst *rq
nfs4_inc_and_copy_stateid(&od->od_stateid, &stp->st_stid);
status = nfs_ok;
put_stateid:
- up_write(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
nfs4_put_stid(&stp->st_stid);
out:
nfsd4_bump_seqid(cstate, status);
@@ -5202,7 +5202,7 @@ nfsd4_close(struct svc_rqst *rqstp, stru
if (status)
goto out;
nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid);
- up_write(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
nfsd4_close_open_stateid(stp);
@@ -5428,7 +5428,7 @@ init_lock_stateid(struct nfs4_ol_stateid
stp->st_access_bmap = 0;
stp->st_deny_bmap = open_stp->st_deny_bmap;
stp->st_openstp = open_stp;
- init_rwsem(&stp->st_rwsem);
+ mutex_init(&stp->st_mutex);
list_add(&stp->st_locks, &open_stp->st_locks);
list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
spin_lock(&fp->fi_lock);
@@ -5597,7 +5597,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
&open_stp, nn);
if (status)
goto out;
- up_write(&open_stp->st_rwsem);
+ mutex_unlock(&open_stp->st_mutex);
open_sop = openowner(open_stp->st_stateowner);
status = nfserr_bad_stateid;
if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
@@ -5606,7 +5606,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
status = lookup_or_create_lock_state(cstate, open_stp, lock,
&lock_stp, &new);
if (status == nfs_ok)
- down_write(&lock_stp->st_rwsem);
+ mutex_lock(&lock_stp->st_mutex);
} else {
status = nfs4_preprocess_seqid_op(cstate,
lock->lk_old_lock_seqid,
@@ -5710,7 +5710,7 @@ out:
seqid_mutating_err(ntohl(status)))
lock_sop->lo_owner.so_seqid++;
- up_write(&lock_stp->st_rwsem);
+ mutex_unlock(&lock_stp->st_mutex);
/*
* If this is a new, never-before-used stateid, and we are
@@ -5880,7 +5880,7 @@ nfsd4_locku(struct svc_rqst *rqstp, stru
fput:
fput(filp);
put_stateid:
- up_write(&stp->st_rwsem);
+ mutex_unlock(&stp->st_mutex);
nfs4_put_stid(&stp->st_stid);
out:
nfsd4_bump_seqid(cstate, status);
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -535,7 +535,7 @@ struct nfs4_ol_stateid {
unsigned char st_access_bmap;
unsigned char st_deny_bmap;
struct nfs4_ol_stateid *st_openstp;
- struct rw_semaphore st_rwsem;
+ struct mutex st_mutex;
};
static inline struct nfs4_ol_stateid *openlockstateid(struct nfs4_stid *s)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 049/203] nfsd: Extend the mutex holding region around in nfsd4_process_open2()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 048/203] nfsd: Always lock state exclusively Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 050/203] posix_acl: Add set_posix_acl Greg Kroah-Hartman
` (145 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Oleg Drokin, J. Bruce Fields
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Drokin <green@linuxhacker.ru>
commit 5cc1fb2a093e254b656c64ff24b0b76bed1d34d9 upstream.
To avoid racing entry into nfs4_get_vfs_file().
Make init_open_stateid() return with locked stateid to be unlocked
by the caller.
Signed-off-by: Oleg Drokin <green@linuxhacker.ru>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3487,6 +3487,10 @@ init_open_stateid(struct nfs4_ol_stateid
struct nfs4_openowner *oo = open->op_openowner;
struct nfs4_ol_stateid *retstp = NULL;
+ /* We are moving these outside of the spinlocks to avoid the warnings */
+ mutex_init(&stp->st_mutex);
+ mutex_lock(&stp->st_mutex);
+
spin_lock(&oo->oo_owner.so_client->cl_lock);
spin_lock(&fp->fi_lock);
@@ -3502,13 +3506,17 @@ init_open_stateid(struct nfs4_ol_stateid
stp->st_access_bmap = 0;
stp->st_deny_bmap = 0;
stp->st_openstp = NULL;
- mutex_init(&stp->st_mutex);
list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
list_add(&stp->st_perfile, &fp->fi_stateids);
out_unlock:
spin_unlock(&fp->fi_lock);
spin_unlock(&oo->oo_owner.so_client->cl_lock);
+ if (retstp) {
+ mutex_lock(&retstp->st_mutex);
+ /* Not that we need to, just for neatness */
+ mutex_unlock(&stp->st_mutex);
+ }
return retstp;
}
@@ -4344,11 +4352,14 @@ nfsd4_process_open2(struct svc_rqst *rqs
} else {
stp = open->op_stp;
open->op_stp = NULL;
+ /*
+ * init_open_stateid() either returns a locked stateid
+ * it found, or initializes and locks the new one we passed in
+ */
swapstp = init_open_stateid(stp, fp, open);
if (swapstp) {
nfs4_put_stid(&stp->st_stid);
stp = swapstp;
- mutex_lock(&stp->st_mutex);
status = nfs4_upgrade_open(rqstp, fp, current_fh,
stp, open);
if (status) {
@@ -4357,7 +4368,6 @@ nfsd4_process_open2(struct svc_rqst *rqs
}
goto upgrade_out;
}
- mutex_lock(&stp->st_mutex);
status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
if (status) {
mutex_unlock(&stp->st_mutex);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 050/203] posix_acl: Add set_posix_acl
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 049/203] nfsd: Extend the mutex holding region around in nfsd4_process_open2() Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 051/203] nfsd: check permissions when setting ACLs Greg Kroah-Hartman
` (144 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Gruenbacher,
Christoph Hellwig, Al Viro, J. Bruce Fields
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
commit 485e71e8fb6356c08c7fc6bcce4bf02c9a9a663f upstream.
Factor out part of posix_acl_xattr_set into a common function that takes
a posix_acl, which nfsd can also call.
The prototype already exists in include/linux/posix_acl.h.
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/posix_acl.c | 42 +++++++++++++++++++++++-------------------
1 file changed, 23 insertions(+), 19 deletions(-)
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -786,39 +786,43 @@ posix_acl_xattr_get(const struct xattr_h
return error;
}
-static int
-posix_acl_xattr_set(const struct xattr_handler *handler,
- struct dentry *dentry, const char *name,
- const void *value, size_t size, int flags)
+int
+set_posix_acl(struct inode *inode, int type, struct posix_acl *acl)
{
- struct inode *inode = d_backing_inode(dentry);
- struct posix_acl *acl = NULL;
- int ret;
-
if (!IS_POSIXACL(inode))
return -EOPNOTSUPP;
if (!inode->i_op->set_acl)
return -EOPNOTSUPP;
- if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
- return value ? -EACCES : 0;
+ if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
+ return acl ? -EACCES : 0;
if (!inode_owner_or_capable(inode))
return -EPERM;
+ if (acl) {
+ int ret = posix_acl_valid(acl);
+ if (ret)
+ return ret;
+ }
+ return inode->i_op->set_acl(inode, acl, type);
+}
+EXPORT_SYMBOL(set_posix_acl);
+
+static int
+posix_acl_xattr_set(const struct xattr_handler *handler,
+ struct dentry *dentry, const char *name,
+ const void *value, size_t size, int flags)
+{
+ struct inode *inode = d_backing_inode(dentry);
+ struct posix_acl *acl = NULL;
+ int ret;
+
if (value) {
acl = posix_acl_from_xattr(&init_user_ns, value, size);
if (IS_ERR(acl))
return PTR_ERR(acl);
-
- if (acl) {
- ret = posix_acl_valid(acl);
- if (ret)
- goto out;
- }
}
-
- ret = inode->i_op->set_acl(inode, acl, handler->flags);
-out:
+ ret = set_posix_acl(inode, handler->flags, acl);
posix_acl_release(acl);
return ret;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 051/203] nfsd: check permissions when setting ACLs
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 050/203] posix_acl: Add set_posix_acl Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 052/203] pnfs_nfs: fix _cancel_empty_pagelist Greg Kroah-Hartman
` (143 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Sinquin, Christoph Hellwig,
Al Viro, J. Bruce Fields
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 999653786df6954a31044528ac3f7a5dadca08f4 upstream.
Use set_posix_acl, which includes proper permission checks, instead of
calling ->set_acl directly. Without this anyone may be able to grant
themselves permissions to a file by setting the ACL.
Lock the inode to make the new checks atomic with respect to set_acl.
(Also, nfsd was the only caller of set_acl not locking the inode, so I
suspect this may fix other races.)
This also simplifies the code, and ensures our ACLs are checked by
posix_acl_valid.
The permission checks and the inode locking were lost with commit
4ac7249e, which changed nfsd to use the set_acl inode operation directly
instead of going through xattr handlers.
Reported-by: David Sinquin <david@sinquin.eu>
[agreunba@redhat.com: use set_posix_acl]
Fixes: 4ac7249e
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs2acl.c | 20 ++++++++++----------
fs/nfsd/nfs3acl.c | 16 +++++++---------
fs/nfsd/nfs4acl.c | 16 ++++++++--------
3 files changed, 25 insertions(+), 27 deletions(-)
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct
goto out;
inode = d_inode(fh->fh_dentry);
- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
- error = -EOPNOTSUPP;
- goto out_errno;
- }
error = fh_want_write(fh);
if (error)
goto out_errno;
- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
+ fh_lock(fh);
+
+ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
if (error)
- goto out_drop_write;
- error = inode->i_op->set_acl(inode, argp->acl_default,
- ACL_TYPE_DEFAULT);
+ goto out_drop_lock;
+ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
if (error)
- goto out_drop_write;
+ goto out_drop_lock;
+
+ fh_unlock(fh);
fh_drop_write(fh);
@@ -131,7 +130,8 @@ out:
posix_acl_release(argp->acl_access);
posix_acl_release(argp->acl_default);
return nfserr;
-out_drop_write:
+out_drop_lock:
+ fh_unlock(fh);
fh_drop_write(fh);
out_errno:
nfserr = nfserrno(error);
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct s
goto out;
inode = d_inode(fh->fh_dentry);
- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
- error = -EOPNOTSUPP;
- goto out_errno;
- }
error = fh_want_write(fh);
if (error)
goto out_errno;
- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
+ fh_lock(fh);
+
+ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
if (error)
- goto out_drop_write;
- error = inode->i_op->set_acl(inode, argp->acl_default,
- ACL_TYPE_DEFAULT);
+ goto out_drop_lock;
+ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
-out_drop_write:
+out_drop_lock:
+ fh_unlock(fh);
fh_drop_write(fh);
out_errno:
nfserr = nfserrno(error);
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqst
dentry = fhp->fh_dentry;
inode = d_inode(dentry);
- if (!inode->i_op->set_acl || !IS_POSIXACL(inode))
- return nfserr_attrnotsupp;
-
if (S_ISDIR(inode->i_mode))
flags = NFS4_ACL_DIR;
@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqst
if (host_error < 0)
goto out_nfserr;
- host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS);
+ fh_lock(fhp);
+
+ host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl);
if (host_error < 0)
- goto out_release;
+ goto out_drop_lock;
if (S_ISDIR(inode->i_mode)) {
- host_error = inode->i_op->set_acl(inode, dpacl,
- ACL_TYPE_DEFAULT);
+ host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl);
}
-out_release:
+out_drop_lock:
+ fh_unlock(fhp);
+
posix_acl_release(pacl);
posix_acl_release(dpacl);
out_nfserr:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 052/203] pnfs_nfs: fix _cancel_empty_pagelist
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 051/203] nfsd: check permissions when setting ACLs Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 053/203] NFS: Fix a double page unlock Greg Kroah-Hartman
` (142 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Weston Andros Adamson,
Trond Myklebust, Anna Schumaker
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <dros@monkey.org>
commit 5e3a98883e7ebdd1440f829a9e9dd5c3d2c5903b upstream.
pnfs_generic_commit_cancel_empty_pagelist calls nfs_commitdata_release,
but that is wrong: nfs_commitdata_release puts the open context, something
that isn't valid until nfs_init_commit is called, which is never the case
when pnfs_generic_commit_cancel_empty_pagelist is called.
This was introduced in "nfs: avoid race that crashes nfs_init_commit".
Signed-off-by: Weston Andros Adamson <dros@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/pnfs_nfs.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -247,7 +247,11 @@ void pnfs_fetch_commit_bucket_list(struc
}
/* Helper function for pnfs_generic_commit_pagelist to catch an empty
- * page list. This can happen when two commits race. */
+ * page list. This can happen when two commits race.
+ *
+ * This must be called instead of nfs_init_commit - call one or the other, but
+ * not both!
+ */
static bool
pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages,
struct nfs_commit_data *data,
@@ -256,7 +260,11 @@ pnfs_generic_commit_cancel_empty_pagelis
if (list_empty(pages)) {
if (atomic_dec_and_test(&cinfo->mds->rpcs_out))
wake_up_atomic_t(&cinfo->mds->rpcs_out);
- nfs_commitdata_release(data);
+ /* don't call nfs_commitdata_release - it tries to put
+ * the open_context which is not acquired until nfs_init_commit
+ * which has not been called on @data */
+ WARN_ON_ONCE(data->context);
+ nfs_commit_free(data);
return true;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 053/203] NFS: Fix a double page unlock
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 052/203] pnfs_nfs: fix _cancel_empty_pagelist Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 054/203] make nfs_atomic_open() call d_drop() on all ->open_context() errors Greg Kroah-Hartman
` (141 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Anna Schumaker
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit cbebaf897e5c4862567eb799dc84acc5d7ee2678 upstream.
Since commit 0bcbf039f6b2, nfs_readpage_release() has been used to
unlock the page in the read code.
Fixes: 0bcbf039f6b2 ("nfs: handle request add failure properly")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/read.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -367,13 +367,13 @@ readpage_async_filler(void *data, struct
nfs_list_remove_request(new);
nfs_readpage_release(new);
error = desc->pgio->pg_error;
- goto out_unlock;
+ goto out;
}
return 0;
out_error:
error = PTR_ERR(new);
-out_unlock:
unlock_page(page);
+out:
return error;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 054/203] make nfs_atomic_open() call d_drop() on all ->open_context() errors.
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 053/203] NFS: Fix a double page unlock Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 055/203] NFS: Fix another OPEN_DOWNGRADE bug Greg Kroah-Hartman
` (140 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Drokin, Al Viro,
Trond Myklebust, Anna Schumaker
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@ZenIV.linux.org.uk>
commit d20cb71dbf3487f24549ede1a8e2d67579b4632e upstream.
In "NFSv4: Move dentry instantiation into the NFSv4-specific atomic open code"
unconditional d_drop() after the ->open_context() had been removed. It had
been correct for success cases (there ->open_context() itself had been doing
dcache manipulations), but not for error ones. Only one of those (ENOENT)
got a compensatory d_drop() added in that commit, but in fact it should've
been done for all errors. As it is, the case of O_CREAT non-exclusive open
on a hashed negative dentry racing with e.g. symlink creation from another
client ended up with ->open_context() getting an error and proceeding to
call nfs_lookup(). On a hashed dentry, which would've instantly triggered
BUG_ON() in d_materialise_unique() (or, these days, its equivalent in
d_splice_alias()).
Tested-by: Oleg Drokin <green@linuxhacker.ru>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1527,9 +1527,9 @@ int nfs_atomic_open(struct inode *dir, s
err = PTR_ERR(inode);
trace_nfs_atomic_open_exit(dir, ctx, open_flags, err);
put_nfs_open_context(ctx);
+ d_drop(dentry);
switch (err) {
case -ENOENT:
- d_drop(dentry);
d_add(dentry, NULL);
nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
break;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 055/203] NFS: Fix another OPEN_DOWNGRADE bug
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 054/203] make nfs_atomic_open() call d_drop() on all ->open_context() errors Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 056/203] SUNRPC: fix xprt leak on xps allocation failure Greg Kroah-Hartman
` (139 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Olga Kornievskaia, Trond Myklebust,
Anna Schumaker
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit e547f2628327fec6afd2e03b46f113f614cca05b upstream.
Olga Kornievskaia reports that the following test fails to trigger
an OPEN_DOWNGRADE on the wire, and only triggers the final CLOSE.
fd0 = open(foo, RDRW) -- should be open on the wire for "both"
fd1 = open(foo, RDONLY) -- should be open on the wire for "read"
close(fd0) -- should trigger an open_downgrade
read(fd1)
close(fd1)
The issue is that we're missing a check for whether or not the current
state transitioned from an O_RDWR state as opposed to having transitioned
from a combination of O_RDONLY and O_WRONLY.
Reported-by: Olga Kornievskaia <aglo@umich.edu>
Fixes: cd9288ffaea4 ("NFSv4: Fix another bug in the close/open_downgrade code")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2860,12 +2860,11 @@ static void nfs4_close_prepare(struct rp
call_close |= is_wronly;
else if (is_wronly)
calldata->arg.fmode |= FMODE_WRITE;
+ if (calldata->arg.fmode != (FMODE_READ|FMODE_WRITE))
+ call_close |= is_rdwr;
} else if (is_rdwr)
calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
- if (calldata->arg.fmode == 0)
- call_close |= is_rdwr;
-
if (!nfs4_valid_open_stateid(state))
call_close = 0;
spin_unlock(&state->owner->so_lock);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 056/203] SUNRPC: fix xprt leak on xps allocation failure
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 055/203] NFS: Fix another OPEN_DOWNGRADE bug Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 057/203] rpc: share one xps between all backchannels Greg Kroah-Hartman
` (138 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields, Trond Myklebust
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Bruce Fields <bfields@redhat.com>
commit 1208fd569c07ab84aa5d024abd863267c2953b4a upstream.
Callers of rpc_create_xprt expect it to put the xprt on success and
failure.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Acked-by: Trond Myklebust <trondmy@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/clnt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -453,9 +453,10 @@ static struct rpc_clnt *rpc_create_xprt(
struct rpc_xprt_switch *xps;
xps = xprt_switch_alloc(xprt, GFP_KERNEL);
- if (xps == NULL)
+ if (xps == NULL) {
+ xprt_put(xprt);
return ERR_PTR(-ENOMEM);
-
+ }
clnt = rpc_new_client(args, xps, xprt, NULL);
if (IS_ERR(clnt))
return clnt;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 057/203] rpc: share one xps between all backchannels
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 056/203] SUNRPC: fix xprt leak on xps allocation failure Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 058/203] regulator: qcom_smd: add list_voltage callback Greg Kroah-Hartman
` (137 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields, Trond Myklebust
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Bruce Fields <bfields@redhat.com>
commit 39a9beab5acb83176e8b9a4f0778749a09341f1f upstream.
The spec allows backchannels for multiple clients to share the same tcp
connection. When that happens, we need to use the same xprt for all of
them. Similarly, we need the same xps.
This fixes list corruption introduced by the multipath code.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Acked-by: Trond Myklebust <trondmy@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/sunrpc/svc_xprt.h | 1 +
include/linux/sunrpc/xprt.h | 1 +
net/sunrpc/clnt.c | 18 ++++++++++++++----
net/sunrpc/svc_xprt.c | 2 ++
net/sunrpc/xprtsock.c | 1 +
5 files changed, 19 insertions(+), 4 deletions(-)
--- a/include/linux/sunrpc/svc_xprt.h
+++ b/include/linux/sunrpc/svc_xprt.h
@@ -84,6 +84,7 @@ struct svc_xprt {
struct net *xpt_net;
struct rpc_xprt *xpt_bc_xprt; /* NFSv4.1 backchannel */
+ struct rpc_xprt_switch *xpt_bc_xps; /* NFSv4.1 backchannel */
};
static inline void unregister_xpt_user(struct svc_xprt *xpt, struct svc_xpt_user *u)
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -296,6 +296,7 @@ struct xprt_create {
size_t addrlen;
const char *servername;
struct svc_xprt *bc_xprt; /* NFSv4.1 backchannel */
+ struct rpc_xprt_switch *bc_xps;
unsigned int flags;
};
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -452,10 +452,20 @@ static struct rpc_clnt *rpc_create_xprt(
struct rpc_clnt *clnt = NULL;
struct rpc_xprt_switch *xps;
- xps = xprt_switch_alloc(xprt, GFP_KERNEL);
- if (xps == NULL) {
- xprt_put(xprt);
- return ERR_PTR(-ENOMEM);
+ if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
+ WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+ xps = args->bc_xprt->xpt_bc_xps;
+ xprt_switch_get(xps);
+ } else {
+ xps = xprt_switch_alloc(xprt, GFP_KERNEL);
+ if (xps == NULL) {
+ xprt_put(xprt);
+ return ERR_PTR(-ENOMEM);
+ }
+ if (xprt->bc_xprt) {
+ xprt_switch_get(xps);
+ xprt->bc_xprt->xpt_bc_xps = xps;
+ }
}
clnt = rpc_new_client(args, xps, xprt, NULL);
if (IS_ERR(clnt))
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -136,6 +136,8 @@ static void svc_xprt_free(struct kref *k
/* See comment on corresponding get in xs_setup_bc_tcp(): */
if (xprt->xpt_bc_xprt)
xprt_put(xprt->xpt_bc_xprt);
+ if (xprt->xpt_bc_xps)
+ xprt_switch_put(xprt->xpt_bc_xps);
xprt->xpt_ops->xpo_free(xprt);
module_put(owner);
}
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -3050,6 +3050,7 @@ static struct rpc_xprt *xs_setup_bc_tcp(
return xprt;
args->bc_xprt->xpt_bc_xprt = NULL;
+ args->bc_xprt->xpt_bc_xps = NULL;
xprt_put(xprt);
ret = ERR_PTR(-EINVAL);
out_err:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 058/203] regulator: qcom_smd: add list_voltage callback
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 057/203] rpc: share one xps between all backchannels Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 059/203] regulator: qcom_smd: add regulator ops for pm8941 lnldo Greg Kroah-Hartman
` (136 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Srinivas Kandagatla, Mark Brown
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
commit a8a47540ebe32f1733eebc3e5699af580ceaa3f5 upstream.
This patch adds support to list_voltage callback, so that consumers
like mmc core, can get information of supported voltage range.
Without this patch there is no way for mmc core to know this voltage range.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/qcom_smd-regulator.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/regulator/qcom_smd-regulator.c
+++ b/drivers/regulator/qcom_smd-regulator.c
@@ -140,6 +140,7 @@ static const struct regulator_ops rpm_sm
.enable = rpm_reg_enable,
.disable = rpm_reg_disable,
.is_enabled = rpm_reg_is_enabled,
+ .list_voltage = regulator_list_voltage_linear_range,
.get_voltage = rpm_reg_get_voltage,
.set_voltage = rpm_reg_set_voltage,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 059/203] regulator: qcom_smd: add regulator ops for pm8941 lnldo
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 058/203] regulator: qcom_smd: add list_voltage callback Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 060/203] ARM: imx6ul: Fix Micrel PHY mask Greg Kroah-Hartman
` (135 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Srinivas Kandagatla, Mark Brown
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
commit d1e44b6b2823f1751ffe7e7589f545f05cfe2095 upstream.
After "regulator: qcom_smd: add list_voltage callback" patch adding
pm8941 lnldo regulators would bug on list_voltages as it is a fixed
regulator without any linear range.
This patch fixes that issue by adding dedicated ops for pm8941 lnldo
without list_voltages callback.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/qcom_smd-regulator.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/drivers/regulator/qcom_smd-regulator.c
+++ b/drivers/regulator/qcom_smd-regulator.c
@@ -148,6 +148,17 @@ static const struct regulator_ops rpm_sm
.set_load = rpm_reg_set_load,
};
+static const struct regulator_ops rpm_smps_ldo_ops_fixed = {
+ .enable = rpm_reg_enable,
+ .disable = rpm_reg_disable,
+ .is_enabled = rpm_reg_is_enabled,
+
+ .get_voltage = rpm_reg_get_voltage,
+ .set_voltage = rpm_reg_set_voltage,
+
+ .set_load = rpm_reg_set_load,
+};
+
static const struct regulator_ops rpm_switch_ops = {
.enable = rpm_reg_enable,
.disable = rpm_reg_disable,
@@ -248,7 +259,7 @@ static const struct regulator_desc pm894
static const struct regulator_desc pm8941_lnldo = {
.fixed_uV = 1740000,
.n_voltages = 1,
- .ops = &rpm_smps_ldo_ops,
+ .ops = &rpm_smps_ldo_ops_fixed,
};
static const struct regulator_desc pm8941_switch = {
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 060/203] ARM: imx6ul: Fix Micrel PHY mask
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 059/203] regulator: qcom_smd: add regulator ops for pm8941 lnldo Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 061/203] ARM: 8578/1: mm: ensure pmd_present only checks the valid bit Greg Kroah-Hartman
` (134 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Andrew Lunn, Shawn Guo
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <fabio.estevam@nxp.com>
commit 20c15226d1c73150c4d9107301cac5dda0b7f995 upstream.
The value used for Micrel PHY mask is not correct. Use the
MICREL_PHY_ID_MASK definition instead.
Thanks to Jiri Luznicky for proposing the fix at
https://community.freescale.com/thread/387739
Fixes: 709bc0657fe6f9f55 ("ARM: imx6ul: add fec MAC refrence clock and phy fixup init")
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-imx/mach-imx6ul.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mach-imx/mach-imx6ul.c
+++ b/arch/arm/mach-imx/mach-imx6ul.c
@@ -46,7 +46,7 @@ static int ksz8081_phy_fixup(struct phy_
static void __init imx6ul_enet_phy_init(void)
{
if (IS_BUILTIN(CONFIG_PHYLIB))
- phy_register_fixup_for_uid(PHY_ID_KSZ8081, 0xffffffff,
+ phy_register_fixup_for_uid(PHY_ID_KSZ8081, MICREL_PHY_ID_MASK,
ksz8081_phy_fixup);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 061/203] ARM: 8578/1: mm: ensure pmd_present only checks the valid bit
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 060/203] ARM: imx6ul: Fix Micrel PHY mask Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 062/203] ARM: 8579/1: mm: Fix definition of pmd_mknotpresent Greg Kroah-Hartman
` (133 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Russell King, Steve Capper,
Will Deacon, Catalin Marinas, Russell King
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit 624531886987f0f1b5d01fb598034d039198e090 upstream.
In a subsequent patch, pmd_mknotpresent will clear the valid bit of the
pmd entry, resulting in a not-present entry from the hardware's
perspective. Unfortunately, pmd_present simply checks for a non-zero pmd
value and will therefore continue to return true even after a
pmd_mknotpresent operation. Since pmd_mknotpresent is only used for
managing huge entries, this is only an issue for the 3-level case.
This patch fixes the 3-level pmd_present implementation to take into
account the valid bit. For bisectability, the change is made before the
fix to pmd_mknotpresent.
[catalin.marinas@arm.com: comment update regarding pmd_mknotpresent patch]
Fixes: 8d9625070073 ("ARM: mm: Transparent huge page support for LPAE systems.")
Cc: Russell King <linux@armlinux.org.uk>
Cc: Steve Capper <Steve.Capper@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/pgtable-2level.h | 1 +
arch/arm/include/asm/pgtable-3level.h | 1 +
arch/arm/include/asm/pgtable.h | 1 -
3 files changed, 2 insertions(+), 1 deletion(-)
--- a/arch/arm/include/asm/pgtable-2level.h
+++ b/arch/arm/include/asm/pgtable-2level.h
@@ -193,6 +193,7 @@ static inline pmd_t *pmd_offset(pud_t *p
#define pmd_large(pmd) (pmd_val(pmd) & 2)
#define pmd_bad(pmd) (pmd_val(pmd) & 2)
+#define pmd_present(pmd) (pmd_val(pmd))
#define copy_pmd(pmdpd,pmdps) \
do { \
--- a/arch/arm/include/asm/pgtable-3level.h
+++ b/arch/arm/include/asm/pgtable-3level.h
@@ -211,6 +211,7 @@ static inline pmd_t *pmd_offset(pud_t *p
: !!(pmd_val(pmd) & (val)))
#define pmd_isclear(pmd, val) (!(pmd_val(pmd) & (val)))
+#define pmd_present(pmd) (pmd_isset((pmd), L_PMD_SECT_VALID))
#define pmd_young(pmd) (pmd_isset((pmd), PMD_SECT_AF))
#define pte_special(pte) (pte_isset((pte), L_PTE_SPECIAL))
static inline pte_t pte_mkspecial(pte_t pte)
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -182,7 +182,6 @@ extern pgd_t swapper_pg_dir[PTRS_PER_PGD
#define pgd_offset_k(addr) pgd_offset(&init_mm, addr)
#define pmd_none(pmd) (!pmd_val(pmd))
-#define pmd_present(pmd) (pmd_val(pmd))
static inline pte_t *pmd_page_vaddr(pmd_t pmd)
{
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 062/203] ARM: 8579/1: mm: Fix definition of pmd_mknotpresent
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 061/203] ARM: 8578/1: mm: ensure pmd_present only checks the valid bit Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 063/203] ARM: dts: sun6i: yones-toptech-bs1078-v2: Drop constraints on dc1sw regulator Greg Kroah-Hartman
` (132 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kirill A. Shutemov, Will Deacon,
Russell King, Steve Capper, Catalin Marinas, Russell King
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Capper <steve.capper@arm.com>
commit 56530f5d2ddc9b9fade7ef8db9cb886e9dc689b5 upstream.
Currently pmd_mknotpresent will use a zero entry to respresent an
invalidated pmd.
Unfortunately this definition clashes with pmd_none, thus it is
possible for a race condition to occur if zap_pmd_range sees pmd_none
whilst __split_huge_pmd_locked is running too with pmdp_invalidate
just called.
This patch fixes the race condition by modifying pmd_mknotpresent to
create non-zero faulting entries (as is done in other architectures),
removing the ambiguity with pmd_none.
[catalin.marinas@arm.com: using L_PMD_SECT_VALID instead of PMD_TYPE_SECT]
Fixes: 8d9625070073 ("ARM: mm: Transparent huge page support for LPAE systems.")
Reported-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: Russell King <linux@armlinux.org.uk>
Signed-off-by: Steve Capper <steve.capper@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/pgtable-3level.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/include/asm/pgtable-3level.h
+++ b/arch/arm/include/asm/pgtable-3level.h
@@ -250,10 +250,10 @@ PMD_BIT_FUNC(mkyoung, |= PMD_SECT_AF);
#define pfn_pmd(pfn,prot) (__pmd(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
#define mk_pmd(page,prot) pfn_pmd(page_to_pfn(page),prot)
-/* represent a notpresent pmd by zero, this is used by pmdp_invalidate */
+/* represent a notpresent pmd by faulting entry, this is used by pmdp_invalidate */
static inline pmd_t pmd_mknotpresent(pmd_t pmd)
{
- return __pmd(0);
+ return __pmd(pmd_val(pmd) & ~L_PMD_SECT_VALID);
}
static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 063/203] ARM: dts: sun6i: yones-toptech-bs1078-v2: Drop constraints on dc1sw regulator
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 062/203] ARM: 8579/1: mm: Fix definition of pmd_mknotpresent Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 064/203] ARM: dts: sun6i: primo81: " Greg Kroah-Hartman
` (131 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Chen-Yu Tsai,
Maxime Ripard, Olof Johansson
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
commit b223d6242c372a81cca3bb81998f53d3b3e3fb70 upstream.
This is the same issue fixed in commit dcf5341f0150 ("ARM: dts:
sun8i-q8-common: Do not set constraints on dc1sw regulator").
Commit message copied:
dc1sw is an on/off only regulator and as such it cannot have constraints.
This is a limitation of the kernel regulator implementation which resolves
supplies on the first regulator_get(), which is done after applying
constraints, and applying the constrains will fail because it calls
_regulator_get_voltage() and _regulator_do_set_voltage() both of which
will fail on a switch regulator when there is no supply (yet).
This causes registering of all axp22x regulators to fail with the
following errors:
[ 1.395249] vcc-lcd: failed to get the current voltage(-22)
[ 1.405131] axp20x-regulator axp20x-regulator: Failed to register dc1sw
[ 1.412436] axp20x-regulator: probe of axp20x-regulator failed with error -22
This commit removes the constrains on dc1sw / vcc-lcd fixing this problem.
Note that dcdc1 itself is contrained to the exact same values, so this
does not change anything.
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts | 2 --
1 file changed, 2 deletions(-)
--- a/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts
+++ b/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts
@@ -135,8 +135,6 @@
®_dc1sw {
regulator-name = "vcc-lcd-usb2";
- regulator-min-microvolt = <3000000>;
- regulator-max-microvolt = <3000000>;
};
®_dc5ldo {
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 064/203] ARM: dts: sun6i: primo81: Drop constraints on dc1sw regulator
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 063/203] ARM: dts: sun6i: yones-toptech-bs1078-v2: Drop constraints on dc1sw regulator Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 066/203] irqchip/mips-gic: Fix IRQs in gic_dev_domain Greg Kroah-Hartman
` (130 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Chen-Yu Tsai,
Maxime Ripard, Olof Johansson
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
commit cb84f6c0a25eb76b1f838eb63e212705c0c06b5f upstream.
This is the same issue fixed in commit dcf5341f0150 ("ARM: dts:
sun8i-q8-common: Do not set constraints on dc1sw regulator").
Commit message copied:
dc1sw is an on/off only regulator and as such it cannot have constraints.
This is a limitation of the kernel regulator implementation which resolves
supplies on the first regulator_get(), which is done after applying
constraints, and applying the constrains will fail because it calls
_regulator_get_voltage() and _regulator_do_set_voltage() both of which
will fail on a switch regulator when there is no supply (yet).
This causes registering of all axp22x regulators to fail with the
following errors:
[ 1.395249] vcc-lcd: failed to get the current voltage(-22)
[ 1.405131] axp20x-regulator axp20x-regulator: Failed to register dc1sw
[ 1.412436] axp20x-regulator: probe of axp20x-regulator failed with error -22
This commit removes the constrains on dc1sw / vcc-lcd fixing this problem.
Note that dcdc1 itself is contrained to the exact same values, so this
does not change anything.
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/sun6i-a31s-primo81.dts | 2 --
1 file changed, 2 deletions(-)
--- a/arch/arm/boot/dts/sun6i-a31s-primo81.dts
+++ b/arch/arm/boot/dts/sun6i-a31s-primo81.dts
@@ -176,8 +176,6 @@
};
®_dc1sw {
- regulator-min-microvolt = <3000000>;
- regulator-max-microvolt = <3000000>;
regulator-name = "vcc-lcd";
};
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 066/203] irqchip/mips-gic: Fix IRQs in gic_dev_domain
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 064/203] ARM: dts: sun6i: primo81: " Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 067/203] mm: Export migrate_page_move_mapping and migrate_page_copy Greg Kroah-Hartman
` (129 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Harvey Hunt, Matt Redfearn,
linux-mips, Qais Yousef, jason, marc.zyngier, Thomas Gleixner
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harvey Hunt <harvey.hunt@imgtec.com>
commit 4b2312bd0592708c85ed94368c874819e7013309 upstream.
When allocating a new device IRQ, gic_dev_domain_alloc() correctly calls
irq_domain_set_hwirq_and_chip(), but gic_irq_domain_alloc() does not. This
means that gic_irq_domain believes all IRQs from the dev domain have an
hwirq of 0 and creates incorrect mappings in the linear_revmap. As
gic_irq_domain is a parent of the gic_dev_domain, this leads to an
inability to boot on devices with a GIC. Excerpt of the error:
[ 2.297649] irq 0: nobody cared (try booting with the "irqpoll" option)
...
[ 2.436963] handlers:
[ 2.439492] Disabling IRQ #0
Fix this by calling irq_domain_set_hwirq_and_chip() for both the dev and
irq domain.
Now that we are modifying the parent domain, be sure to clear it up in
case of an allocation error.
Fixes: c98c1822ee13 ("irqchip/mips-gic: Add device hierarchy domain")
Fixes: 2af70a962070 ("irqchip/mips-gic: Add a IPI hierarchy domain")
Signed-off-by: Harvey Hunt <harvey.hunt@imgtec.com>
Tested-by: Govindraj Raja <Govindraj.Raja@imgtec.com> # On Pistachio SoC
Reviewed-by: Matt Redfearn <matt.redfearn@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Qais Yousef <qsyousef@gmail.com>
Cc: jason@lakedaemon.net
Cc: marc.zyngier@arm.com
Link: http://lkml.kernel.org/r/1464001552-31174-1-git-send-email-harvey.hunt@imgtec.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-mips-gic.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -734,6 +734,12 @@ static int gic_irq_domain_alloc(struct i
/* verify that it doesn't conflict with an IPI irq */
if (test_bit(spec->hwirq, ipi_resrv))
return -EBUSY;
+
+ hwirq = GIC_SHARED_TO_HWIRQ(spec->hwirq);
+
+ return irq_domain_set_hwirq_and_chip(d, virq, hwirq,
+ &gic_level_irq_controller,
+ NULL);
} else {
base_hwirq = find_first_bit(ipi_resrv, gic_shared_intrs);
if (base_hwirq == gic_shared_intrs) {
@@ -855,10 +861,14 @@ static int gic_dev_domain_alloc(struct i
&gic_level_irq_controller,
NULL);
if (ret)
- return ret;
+ goto error;
}
return 0;
+
+error:
+ irq_domain_free_irqs_parent(d, virq, nr_irqs);
+ return ret;
}
void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 067/203] mm: Export migrate_page_move_mapping and migrate_page_copy
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 066/203] irqchip/mips-gic: Fix IRQs in gic_dev_domain Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 068/203] UBIFS: Implement ->migratepage() Greg Kroah-Hartman
` (128 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Weinberger, Christoph Hellwig
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <richard@nod.at>
commit 1118dce773d84f39ebd51a9fe7261f9169cb056e upstream.
Export these symbols such that UBIFS can implement
->migratepage.
Signed-off-by: Richard Weinberger <richard@nod.at>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/migrate.c | 2 ++
1 file changed, 2 insertions(+)
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -431,6 +431,7 @@ int migrate_page_move_mapping(struct add
return MIGRATEPAGE_SUCCESS;
}
+EXPORT_SYMBOL(migrate_page_move_mapping);
/*
* The expected number of remaining references is the same as that
@@ -586,6 +587,7 @@ void migrate_page_copy(struct page *newp
mem_cgroup_migrate(page, newpage);
}
+EXPORT_SYMBOL(migrate_page_copy);
/************************************************************
* Migration functions
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 068/203] UBIFS: Implement ->migratepage()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 067/203] mm: Export migrate_page_move_mapping and migrate_page_copy Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 069/203] sched/fair: Fix cfs_rq avg tracking underflow Greg Kroah-Hartman
` (127 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kirill A. Shutemov,
Richard Weinberger, Christoph Hellwig
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
commit 4ac1c17b2044a1b4b2fbed74451947e905fc2992 upstream.
During page migrations UBIFS might get confused
and the following assert triggers:
[ 213.480000] UBIFS assert failed in ubifs_set_page_dirty at 1451 (pid 436)
[ 213.490000] CPU: 0 PID: 436 Comm: drm-stress-test Not tainted 4.4.4-00176-geaa802524636-dirty #1008
[ 213.490000] Hardware name: Allwinner sun4i/sun5i Families
[ 213.490000] [<c0015e70>] (unwind_backtrace) from [<c0012cdc>] (show_stack+0x10/0x14)
[ 213.490000] [<c0012cdc>] (show_stack) from [<c02ad834>] (dump_stack+0x8c/0xa0)
[ 213.490000] [<c02ad834>] (dump_stack) from [<c0236ee8>] (ubifs_set_page_dirty+0x44/0x50)
[ 213.490000] [<c0236ee8>] (ubifs_set_page_dirty) from [<c00fa0bc>] (try_to_unmap_one+0x10c/0x3a8)
[ 213.490000] [<c00fa0bc>] (try_to_unmap_one) from [<c00fadb4>] (rmap_walk+0xb4/0x290)
[ 213.490000] [<c00fadb4>] (rmap_walk) from [<c00fb1bc>] (try_to_unmap+0x64/0x80)
[ 213.490000] [<c00fb1bc>] (try_to_unmap) from [<c010dc28>] (migrate_pages+0x328/0x7a0)
[ 213.490000] [<c010dc28>] (migrate_pages) from [<c00d0cb0>] (alloc_contig_range+0x168/0x2f4)
[ 213.490000] [<c00d0cb0>] (alloc_contig_range) from [<c010ec00>] (cma_alloc+0x170/0x2c0)
[ 213.490000] [<c010ec00>] (cma_alloc) from [<c001a958>] (__alloc_from_contiguous+0x38/0xd8)
[ 213.490000] [<c001a958>] (__alloc_from_contiguous) from [<c001ad44>] (__dma_alloc+0x23c/0x274)
[ 213.490000] [<c001ad44>] (__dma_alloc) from [<c001ae08>] (arm_dma_alloc+0x54/0x5c)
[ 213.490000] [<c001ae08>] (arm_dma_alloc) from [<c035cecc>] (drm_gem_cma_create+0xb8/0xf0)
[ 213.490000] [<c035cecc>] (drm_gem_cma_create) from [<c035cf20>] (drm_gem_cma_create_with_handle+0x1c/0xe8)
[ 213.490000] [<c035cf20>] (drm_gem_cma_create_with_handle) from [<c035d088>] (drm_gem_cma_dumb_create+0x3c/0x48)
[ 213.490000] [<c035d088>] (drm_gem_cma_dumb_create) from [<c0341ed8>] (drm_ioctl+0x12c/0x444)
[ 213.490000] [<c0341ed8>] (drm_ioctl) from [<c0121adc>] (do_vfs_ioctl+0x3f4/0x614)
[ 213.490000] [<c0121adc>] (do_vfs_ioctl) from [<c0121d30>] (SyS_ioctl+0x34/0x5c)
[ 213.490000] [<c0121d30>] (SyS_ioctl) from [<c000f2c0>] (ret_fast_syscall+0x0/0x34)
UBIFS is using PagePrivate() which can have different meanings across
filesystems. Therefore the generic page migration code cannot handle this
case correctly.
We have to implement our own migration function which basically does a
plain copy but also duplicates the page private flag.
UBIFS is not a block device filesystem and cannot use buffer_migrate_page().
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
[rw: Massaged changelog, build fixes, etc...]
Signed-off-by: Richard Weinberger <richard@nod.at>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ubifs/file.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -52,6 +52,7 @@
#include "ubifs.h"
#include <linux/mount.h>
#include <linux/slab.h>
+#include <linux/migrate.h>
static int read_block(struct inode *inode, void *addr, unsigned int block,
struct ubifs_data_node *dn)
@@ -1452,6 +1453,26 @@ static int ubifs_set_page_dirty(struct p
return ret;
}
+#ifdef CONFIG_MIGRATION
+static int ubifs_migrate_page(struct address_space *mapping,
+ struct page *newpage, struct page *page, enum migrate_mode mode)
+{
+ int rc;
+
+ rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode, 0);
+ if (rc != MIGRATEPAGE_SUCCESS)
+ return rc;
+
+ if (PagePrivate(page)) {
+ ClearPagePrivate(page);
+ SetPagePrivate(newpage);
+ }
+
+ migrate_page_copy(newpage, page);
+ return MIGRATEPAGE_SUCCESS;
+}
+#endif
+
static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags)
{
/*
@@ -1591,6 +1612,9 @@ const struct address_space_operations ub
.write_end = ubifs_write_end,
.invalidatepage = ubifs_invalidatepage,
.set_page_dirty = ubifs_set_page_dirty,
+#ifdef CONFIG_MIGRATION
+ .migratepage = ubifs_migrate_page,
+#endif
.releasepage = ubifs_releasepage,
};
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 069/203] sched/fair: Fix cfs_rq avg tracking underflow
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 068/203] UBIFS: Implement ->migratepage() Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 070/203] packet: Use symmetric hash for PACKET_FANOUT_HASH Greg Kroah-Hartman
` (126 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
Andrey Ryabinin, Chris Wilson, Linus Torvalds, Mike Galbraith,
Thomas Gleixner, Yuyang Du, bsegall, kernel, morten.rasmussen,
pjt, steve.muckle, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 8974189222159154c55f24ddad33e3613960521a upstream.
As per commit:
b7fa30c9cc48 ("sched/fair: Fix post_init_entity_util_avg() serialization")
> the code generated from update_cfs_rq_load_avg():
>
> if (atomic_long_read(&cfs_rq->removed_load_avg)) {
> s64 r = atomic_long_xchg(&cfs_rq->removed_load_avg, 0);
> sa->load_avg = max_t(long, sa->load_avg - r, 0);
> sa->load_sum = max_t(s64, sa->load_sum - r * LOAD_AVG_MAX, 0);
> removed_load = 1;
> }
>
> turns into:
>
> ffffffff81087064: 49 8b 85 98 00 00 00 mov 0x98(%r13),%rax
> ffffffff8108706b: 48 85 c0 test %rax,%rax
> ffffffff8108706e: 74 40 je ffffffff810870b0 <update_blocked_averages+0xc0>
> ffffffff81087070: 4c 89 f8 mov %r15,%rax
> ffffffff81087073: 49 87 85 98 00 00 00 xchg %rax,0x98(%r13)
> ffffffff8108707a: 49 29 45 70 sub %rax,0x70(%r13)
> ffffffff8108707e: 4c 89 f9 mov %r15,%rcx
> ffffffff81087081: bb 01 00 00 00 mov $0x1,%ebx
> ffffffff81087086: 49 83 7d 70 00 cmpq $0x0,0x70(%r13)
> ffffffff8108708b: 49 0f 49 4d 70 cmovns 0x70(%r13),%rcx
>
> Which you'll note ends up with sa->load_avg -= r in memory at
> ffffffff8108707a.
So I _should_ have looked at other unserialized users of ->load_avg,
but alas. Luckily nikbor reported a similar /0 from task_h_load() which
instantly triggered recollection of this here problem.
Aside from the intermediate value hitting memory and causing problems,
there's another problem: the underflow detection relies on the signed
bit. This reduces the effective width of the variables, IOW its
effectively the same as having these variables be of signed type.
This patch changes to a different means of unsigned underflow
detection to not rely on the signed bit. This allows the variables to
use the 'full' unsigned range. And it does so with explicit LOAD -
STORE to ensure any intermediate value will never be visible in
memory, allowing these unserialized loads.
Note: GCC generates crap code for this, might warrant a look later.
Note2: I say 'full' above, if we end up at U*_MAX we'll still explode;
maybe we should do clamping on add too.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Yuyang Du <yuyang.du@intel.com>
Cc: bsegall@google.com
Cc: kernel@kyup.com
Cc: morten.rasmussen@arm.com
Cc: pjt@google.com
Cc: steve.muckle@linaro.org
Fixes: 9d89c257dfb9 ("sched/fair: Rewrite runnable load and utilization average tracking")
Link: http://lkml.kernel.org/r/20160617091948.GJ30927@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/fair.c | 33 +++++++++++++++++++++++++--------
1 file changed, 25 insertions(+), 8 deletions(-)
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2821,6 +2821,23 @@ static inline void update_tg_load_avg(st
static inline u64 cfs_rq_clock_task(struct cfs_rq *cfs_rq);
+/*
+ * Unsigned subtract and clamp on underflow.
+ *
+ * Explicitly do a load-store to ensure the intermediate value never hits
+ * memory. This allows lockless observations without ever seeing the negative
+ * values.
+ */
+#define sub_positive(_ptr, _val) do { \
+ typeof(_ptr) ptr = (_ptr); \
+ typeof(*ptr) val = (_val); \
+ typeof(*ptr) res, var = READ_ONCE(*ptr); \
+ res = var - val; \
+ if (res > var) \
+ res = 0; \
+ WRITE_ONCE(*ptr, res); \
+} while (0)
+
/* Group cfs_rq's load_avg is used for task_h_load and update_cfs_share */
static inline int update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq)
{
@@ -2829,15 +2846,15 @@ static inline int update_cfs_rq_load_avg
if (atomic_long_read(&cfs_rq->removed_load_avg)) {
s64 r = atomic_long_xchg(&cfs_rq->removed_load_avg, 0);
- sa->load_avg = max_t(long, sa->load_avg - r, 0);
- sa->load_sum = max_t(s64, sa->load_sum - r * LOAD_AVG_MAX, 0);
+ sub_positive(&sa->load_avg, r);
+ sub_positive(&sa->load_sum, r * LOAD_AVG_MAX);
removed = 1;
}
if (atomic_long_read(&cfs_rq->removed_util_avg)) {
long r = atomic_long_xchg(&cfs_rq->removed_util_avg, 0);
- sa->util_avg = max_t(long, sa->util_avg - r, 0);
- sa->util_sum = max_t(s32, sa->util_sum - r * LOAD_AVG_MAX, 0);
+ sub_positive(&sa->util_avg, r);
+ sub_positive(&sa->util_sum, r * LOAD_AVG_MAX);
}
decayed = __update_load_avg(now, cpu_of(rq_of(cfs_rq)), sa,
@@ -2927,10 +2944,10 @@ static void detach_entity_load_avg(struc
&se->avg, se->on_rq * scale_load_down(se->load.weight),
cfs_rq->curr == se, NULL);
- cfs_rq->avg.load_avg = max_t(long, cfs_rq->avg.load_avg - se->avg.load_avg, 0);
- cfs_rq->avg.load_sum = max_t(s64, cfs_rq->avg.load_sum - se->avg.load_sum, 0);
- cfs_rq->avg.util_avg = max_t(long, cfs_rq->avg.util_avg - se->avg.util_avg, 0);
- cfs_rq->avg.util_sum = max_t(s32, cfs_rq->avg.util_sum - se->avg.util_sum, 0);
+ sub_positive(&cfs_rq->avg.load_avg, se->avg.load_avg);
+ sub_positive(&cfs_rq->avg.load_sum, se->avg.load_sum);
+ sub_positive(&cfs_rq->avg.util_avg, se->avg.util_avg);
+ sub_positive(&cfs_rq->avg.util_sum, se->avg.util_sum);
}
/* Add the load generated by se into cfs_rq's load average */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 070/203] packet: Use symmetric hash for PACKET_FANOUT_HASH.
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 069/203] sched/fair: Fix cfs_rq avg tracking underflow Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 071/203] net_sched: fix mirrored packets checksum Greg Kroah-Hartman
` (125 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Leblond, David S. Miller
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <davem@davemloft.net>
[ Upstream commit eb70db8756717b90c01ccc765fdefc4dd969fc74 ]
People who use PACKET_FANOUT_HASH want a symmetric hash, meaning that
they want packets going in both directions on a flow to hash to the
same bucket.
The core kernel SKB hash became non-symmetric when the ipv6 flow label
and other entities were incorporated into the standard flow hash order
to increase entropy.
But there are no users of PACKET_FANOUT_HASH who want an assymetric
hash, they all want a symmetric one.
Therefore, use the flow dissector to compute a flat symmetric hash
over only the protocol, addresses and ports. This hash does not get
installed into and override the normal skb hash, so this change has
no effect whatsoever on the rest of the stack.
Reported-by: Eric Leblond <eric@regit.org>
Tested-by: Eric Leblond <eric@regit.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/skbuff.h | 1 +
net/core/flow_dissector.c | 43 +++++++++++++++++++++++++++++++++++++++++++
net/packet/af_packet.c | 2 +-
3 files changed, 45 insertions(+), 1 deletion(-)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1062,6 +1062,7 @@ __skb_set_sw_hash(struct sk_buff *skb, _
}
void __skb_get_hash(struct sk_buff *skb);
+u32 __skb_get_hash_symmetric(struct sk_buff *skb);
u32 skb_get_poff(const struct sk_buff *skb);
u32 __skb_get_poff(const struct sk_buff *skb, void *data,
const struct flow_keys *keys, int hlen);
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -651,6 +651,23 @@ void make_flow_keys_digest(struct flow_k
}
EXPORT_SYMBOL(make_flow_keys_digest);
+static struct flow_dissector flow_keys_dissector_symmetric __read_mostly;
+
+u32 __skb_get_hash_symmetric(struct sk_buff *skb)
+{
+ struct flow_keys keys;
+
+ __flow_hash_secret_init();
+
+ memset(&keys, 0, sizeof(keys));
+ __skb_flow_dissect(skb, &flow_keys_dissector_symmetric, &keys,
+ NULL, 0, 0, 0,
+ FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
+
+ return __flow_hash_from_keys(&keys, hashrnd);
+}
+EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
+
/**
* __skb_get_hash: calculate a flow hash
* @skb: sk_buff to calculate flow hash from
@@ -868,6 +885,29 @@ static const struct flow_dissector_key f
},
};
+static const struct flow_dissector_key flow_keys_dissector_symmetric_keys[] = {
+ {
+ .key_id = FLOW_DISSECTOR_KEY_CONTROL,
+ .offset = offsetof(struct flow_keys, control),
+ },
+ {
+ .key_id = FLOW_DISSECTOR_KEY_BASIC,
+ .offset = offsetof(struct flow_keys, basic),
+ },
+ {
+ .key_id = FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+ .offset = offsetof(struct flow_keys, addrs.v4addrs),
+ },
+ {
+ .key_id = FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+ .offset = offsetof(struct flow_keys, addrs.v6addrs),
+ },
+ {
+ .key_id = FLOW_DISSECTOR_KEY_PORTS,
+ .offset = offsetof(struct flow_keys, ports),
+ },
+};
+
static const struct flow_dissector_key flow_keys_buf_dissector_keys[] = {
{
.key_id = FLOW_DISSECTOR_KEY_CONTROL,
@@ -889,6 +929,9 @@ static int __init init_default_flow_diss
skb_flow_dissector_init(&flow_keys_dissector,
flow_keys_dissector_keys,
ARRAY_SIZE(flow_keys_dissector_keys));
+ skb_flow_dissector_init(&flow_keys_dissector_symmetric,
+ flow_keys_dissector_symmetric_keys,
+ ARRAY_SIZE(flow_keys_dissector_symmetric_keys));
skb_flow_dissector_init(&flow_keys_buf_dissector,
flow_keys_buf_dissector_keys,
ARRAY_SIZE(flow_keys_buf_dissector_keys));
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1340,7 +1340,7 @@ static unsigned int fanout_demux_hash(st
struct sk_buff *skb,
unsigned int num)
{
- return reciprocal_scale(skb_get_hash(skb), num);
+ return reciprocal_scale(__skb_get_hash_symmetric(skb), num);
}
static unsigned int fanout_demux_lb(struct packet_fanout *f,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 071/203] net_sched: fix mirrored packets checksum
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 070/203] packet: Use symmetric hash for PACKET_FANOUT_HASH Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 072/203] macsec: set actual real device for xmit when !protect_frames Greg Kroah-Hartman
` (124 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jamal Hadi Salim, Tom Herbert,
Cong Wang, David S. Miller
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
[ Upstream commit 82a31b9231f02d9c1b7b290a46999d517b0d312a ]
Similar to commit 9b368814b336 ("net: fix bridge multicast packet checksum validation")
we need to fixup the checksum for CHECKSUM_COMPLETE when
pushing skb on RX path. Otherwise we get similar splats.
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Tom Herbert <tom@herbertland.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/skbuff.h | 19 +++++++++++++++++++
net/core/skbuff.c | 18 ------------------
net/sched/act_mirred.c | 2 +-
3 files changed, 20 insertions(+), 19 deletions(-)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2861,6 +2861,25 @@ static inline void skb_postpush_rcsum(st
}
/**
+ * skb_push_rcsum - push skb and update receive checksum
+ * @skb: buffer to update
+ * @len: length of data pulled
+ *
+ * This function performs an skb_push on the packet and updates
+ * the CHECKSUM_COMPLETE checksum. It should be used on
+ * receive path processing instead of skb_push unless you know
+ * that the checksum difference is zero (e.g., a valid IP header)
+ * or you are setting ip_summed to CHECKSUM_NONE.
+ */
+static inline unsigned char *skb_push_rcsum(struct sk_buff *skb,
+ unsigned int len)
+{
+ skb_push(skb, len);
+ skb_postpush_rcsum(skb, skb->data, len);
+ return skb->data;
+}
+
+/**
* pskb_trim_rcsum - trim received skb and update checksum
* @skb: buffer to trim
* @len: new length
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3016,24 +3016,6 @@ int skb_append_pagefrags(struct sk_buff
EXPORT_SYMBOL_GPL(skb_append_pagefrags);
/**
- * skb_push_rcsum - push skb and update receive checksum
- * @skb: buffer to update
- * @len: length of data pulled
- *
- * This function performs an skb_push on the packet and updates
- * the CHECKSUM_COMPLETE checksum. It should be used on
- * receive path processing instead of skb_push unless you know
- * that the checksum difference is zero (e.g., a valid IP header)
- * or you are setting ip_summed to CHECKSUM_NONE.
- */
-static unsigned char *skb_push_rcsum(struct sk_buff *skb, unsigned len)
-{
- skb_push(skb, len);
- skb_postpush_rcsum(skb, skb->data, len);
- return skb->data;
-}
-
-/**
* skb_pull_rcsum - pull skb and update receive checksum
* @skb: buffer to update
* @len: length of data pulled
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -180,7 +180,7 @@ static int tcf_mirred(struct sk_buff *sk
if (!(at & AT_EGRESS)) {
if (m->tcfm_ok_push)
- skb_push(skb2, skb->mac_len);
+ skb_push_rcsum(skb2, skb->mac_len);
}
/* mirror is always swallowed */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 072/203] macsec: set actual real device for xmit when !protect_frames
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 071/203] net_sched: fix mirrored packets checksum Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 073/203] geneve: fix max_mtu setting Greg Kroah-Hartman
` (123 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Borkmann, Sabrina Dubroca,
Hannes Frederic Sowa, David S. Miller
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 79c62220d74a4a3f961a2cb7320da09eebf5daf7 ]
Avoid recursions of dev_queue_xmit() to the wrong net device when
frames are unprotected, since at that time skb->dev still points to
our own macsec dev and unlike macsec_encrypt_finish() dev pointer
doesn't get updated to real underlying device.
Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/macsec.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -2564,6 +2564,7 @@ static netdev_tx_t macsec_start_xmit(str
u64_stats_update_begin(&secy_stats->syncp);
secy_stats->stats.OutPktsUntagged++;
u64_stats_update_end(&secy_stats->syncp);
+ skb->dev = macsec->real_dev;
len = skb->len;
ret = dev_queue_xmit(skb);
count_tx(dev, ret, len);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 073/203] geneve: fix max_mtu setting
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 072/203] macsec: set actual real device for xmit when !protect_frames Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 075/203] ipv6: Fix mem leak in rt6i_pcpu Greg Kroah-Hartman
` (122 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Haishuang Yan, David S. Miller
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
[ Upstream commit d5d5e8d55732c7c35c354e45e3b0af2795978a57 ]
For ipv6+udp+geneve encapsulation data, the max_mtu should subtract
sizeof(ipv6hdr), instead of sizeof(iphdr).
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/geneve.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1092,12 +1092,17 @@ static netdev_tx_t geneve_xmit(struct sk
static int __geneve_change_mtu(struct net_device *dev, int new_mtu, bool strict)
{
+ struct geneve_dev *geneve = netdev_priv(dev);
/* The max_mtu calculation does not take account of GENEVE
* options, to avoid excluding potentially valid
* configurations.
*/
- int max_mtu = IP_MAX_MTU - GENEVE_BASE_HLEN - sizeof(struct iphdr)
- - dev->hard_header_len;
+ int max_mtu = IP_MAX_MTU - GENEVE_BASE_HLEN - dev->hard_header_len;
+
+ if (geneve->remote.sa.sa_family == AF_INET6)
+ max_mtu -= sizeof(struct ipv6hdr);
+ else
+ max_mtu -= sizeof(struct iphdr);
if (new_mtu < 68)
return -EINVAL;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 075/203] ipv6: Fix mem leak in rt6i_pcpu
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 073/203] geneve: fix max_mtu setting Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 076/203] KEYS: potential uninitialized variable Greg Kroah-Hartman
` (121 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin KaFai Lau, Petr Novopashenniy,
Hannes Frederic Sowa, David S. Miller
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <kafai@fb.com>
[ Upstream commit 903ce4abdf374e3365d93bcb3df56c62008835ba ]
It was first reported and reproduced by Petr (thanks!) in
https://bugzilla.kernel.org/show_bug.cgi?id=119581
free_percpu(rt->rt6i_pcpu) used to always happen in ip6_dst_destroy().
However, after fixing a deadlock bug in
commit 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt"),
free_percpu() is not called before setting non_pcpu_rt->rt6i_pcpu to NULL.
It is worth to note that rt6i_pcpu is protected by table->tb6_lock.
kmemleak somehow did not report it. We nailed it down by
observing the pcpu entries in /proc/vmallocinfo (first suggested
by Hannes, thanks!).
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Fixes: 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt")
Reported-by: Petr Novopashenniy <pety@rusnet.ru>
Tested-by: Petr Novopashenniy <pety@rusnet.ru>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Petr Novopashenniy <pety@rusnet.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_fib.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -177,6 +177,7 @@ static void rt6_free_pcpu(struct rt6_inf
}
}
+ free_percpu(non_pcpu_rt->rt6i_pcpu);
non_pcpu_rt->rt6i_pcpu = NULL;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 076/203] KEYS: potential uninitialized variable
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 075/203] ipv6: Fix mem leak in rt6i_pcpu Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 077/203] kvm: vmx: check apicv is active before using VT-d posted interrupt Greg Kroah-Hartman
` (120 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David Howells, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 38327424b40bcebe2de92d07312c89360ac9229a upstream.
If __key_link_begin() failed then "edit" would be uninitialized. I've
added a check to fix that.
This allows a random user to crash the kernel, though it's quite
difficult to achieve. There are three ways it can be done as the user
would have to cause an error to occur in __key_link():
(1) Cause the kernel to run out of memory. In practice, this is difficult
to achieve without ENOMEM cropping up elsewhere and aborting the
attempt.
(2) Revoke the destination keyring between the keyring ID being looked up
and it being tested for revocation. In practice, this is difficult to
time correctly because the KEYCTL_REJECT function can only be used
from the request-key upcall process. Further, users can only make use
of what's in /sbin/request-key.conf, though this does including a
rejection debugging test - which means that the destination keyring
has to be the caller's session keyring in practice.
(3) Have just enough key quota available to create a key, a new session
keyring for the upcall and a link in the session keyring, but not then
sufficient quota to create a link in the nominated destination keyring
so that it fails with EDQUOT.
The bug can be triggered using option (3) above using something like the
following:
echo 80 >/proc/sys/kernel/keys/root_maxbytes
keyctl request2 user debug:fred negate @t
The above sets the quota to something much lower (80) to make the bug
easier to trigger, but this is dependent on the system. Note also that
the name of the keyring created contains a random number that may be
between 1 and 10 characters in size, so may throw the test off by
changing the amount of quota used.
Assuming the failure occurs, something like the following will be seen:
kfree_debugcheck: out of range ptr 6b6b6b6b6b6b6b68h
------------[ cut here ]------------
kernel BUG at ../mm/slab.c:2821!
...
RIP: 0010:[<ffffffff811600f9>] kfree_debugcheck+0x20/0x25
RSP: 0018:ffff8804014a7de8 EFLAGS: 00010092
RAX: 0000000000000034 RBX: 6b6b6b6b6b6b6b68 RCX: 0000000000000000
RDX: 0000000000040001 RSI: 00000000000000f6 RDI: 0000000000000300
RBP: ffff8804014a7df0 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8804014a7e68 R11: 0000000000000054 R12: 0000000000000202
R13: ffffffff81318a66 R14: 0000000000000000 R15: 0000000000000001
...
Call Trace:
kfree+0xde/0x1bc
assoc_array_cancel_edit+0x1f/0x36
__key_link_end+0x55/0x63
key_reject_and_link+0x124/0x155
keyctl_reject_key+0xb6/0xe0
keyctl_negate_key+0x10/0x12
SyS_keyctl+0x9f/0xe7
do_syscall_64+0x63/0x13a
entry_SYSCALL64_slow_path+0x25/0x25
Fixes: f70e2e06196a ('KEYS: Do preallocation for __key_link()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/keys/key.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -584,7 +584,7 @@ int key_reject_and_link(struct key *key,
mutex_unlock(&key_construction_mutex);
- if (keyring)
+ if (keyring && link_ret == 0)
__key_link_end(keyring, &key->index_key, edit);
/* wake up anyone waiting for a key to be constructed */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 077/203] kvm: vmx: check apicv is active before using VT-d posted interrupt
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 076/203] KEYS: potential uninitialized variable Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 078/203] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES Greg Kroah-Hartman
` (119 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yang Zhang, Shengge Ding, Paolo Bonzini
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Zhang <yang.zhang.wz@gmail.com>
commit a0052191624e9bf8a8f9dc41b92ab5f252566c3c upstream.
VT-d posted interrupt is relying on the CPU side's posted interrupt.
Need to check whether VCPU's APICv is active before enabing VT-d
posted interrupt.
Fixes: d62caabb41f33d96333f9ef15e09cd26e1c12760
Signed-off-by: Yang Zhang <yang.zhang.wz@gmail.com>
Signed-off-by: Shengge Ding <shengge.dsg@alibaba-inc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2072,7 +2072,8 @@ static void vmx_vcpu_pi_load(struct kvm_
unsigned int dest;
if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
- !irq_remapping_cap(IRQ_POSTING_CAP))
+ !irq_remapping_cap(IRQ_POSTING_CAP) ||
+ !kvm_vcpu_apicv_active(vcpu))
return;
do {
@@ -2180,7 +2181,8 @@ static void vmx_vcpu_pi_put(struct kvm_v
struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
- !irq_remapping_cap(IRQ_POSTING_CAP))
+ !irq_remapping_cap(IRQ_POSTING_CAP) ||
+ !kvm_vcpu_apicv_active(vcpu))
return;
/* Set SN when the vCPU is preempted */
@@ -10702,7 +10704,8 @@ static int vmx_pre_block(struct kvm_vcpu
struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
- !irq_remapping_cap(IRQ_POSTING_CAP))
+ !irq_remapping_cap(IRQ_POSTING_CAP) ||
+ !kvm_vcpu_apicv_active(vcpu))
return 0;
vcpu->pre_pcpu = vcpu->cpu;
@@ -10768,7 +10771,8 @@ static void vmx_post_block(struct kvm_vc
unsigned long flags;
if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
- !irq_remapping_cap(IRQ_POSTING_CAP))
+ !irq_remapping_cap(IRQ_POSTING_CAP) ||
+ !kvm_vcpu_apicv_active(vcpu))
return;
do {
@@ -10821,7 +10825,8 @@ static int vmx_update_pi_irte(struct kvm
int idx, ret = -EINVAL;
if (!kvm_arch_has_assigned_device(kvm) ||
- !irq_remapping_cap(IRQ_POSTING_CAP))
+ !irq_remapping_cap(IRQ_POSTING_CAP) ||
+ !kvm_vcpu_apicv_active(kvm->vcpus[0]))
return 0;
idx = srcu_read_lock(&kvm->irq_srcu);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 078/203] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 077/203] kvm: vmx: check apicv is active before using VT-d posted interrupt Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 079/203] KVM: s390/mm: Fix CMMA reset during reboot Greg Kroah-Hartman
` (118 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xiubo Li, Wei Tang, Zhang Zhuoyu,
Paolo Bonzini
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <lixiubo@cmss.chinamobile.com>
commit caf1ff26e1aa178133df68ac3d40815fed2187d9 upstream.
These days, we experienced one guest crash with 8 cores and 3 disks,
with qemu error logs as bellow:
qemu-system-x86_64: /build/qemu-2.0.0/kvm-all.c:984:
kvm_irqchip_commit_routes: Assertion `ret == 0' failed.
And then we found one patch(bdf026317d) in qemu tree, which said
could fix this bug.
Execute the following script will reproduce the BUG quickly:
irq_affinity.sh
========================================================================
vda_irq_num=25
vdb_irq_num=27
while [ 1 ]
do
for irq in {1,2,4,8,10,20,40,80}
do
echo $irq > /proc/irq/$vda_irq_num/smp_affinity
echo $irq > /proc/irq/$vdb_irq_num/smp_affinity
dd if=/dev/vda of=/dev/zero bs=4K count=100 iflag=direct
dd if=/dev/vdb of=/dev/zero bs=4K count=100 iflag=direct
done
done
========================================================================
The following qemu log is added in the qemu code and is displayed when
this bug reproduced:
kvm_irqchip_commit_routes: max gsi: 1008, nr_allocated_irq_routes: 1024,
irq_routes->nr: 1024, gsi_count: 1024.
That's to say when irq_routes->nr == 1024, there are 1024 routing entries,
but in the kernel code when routes->nr >= 1024, will just return -EINVAL;
The nr is the number of the routing entries which is in of
[1 ~ KVM_MAX_IRQ_ROUTES], not the index in [0 ~ KVM_MAX_IRQ_ROUTES - 1].
This patch fix the BUG above.
Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com>
Signed-off-by: Wei Tang <tangwei@cmss.chinamobile.com>
Signed-off-by: Zhang Zhuoyu <zhangzhuoyu@cmss.chinamobile.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/kvm_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2868,7 +2868,7 @@ static long kvm_vm_ioctl(struct file *fi
if (copy_from_user(&routing, argp, sizeof(routing)))
goto out;
r = -EINVAL;
- if (routing.nr >= KVM_MAX_IRQ_ROUTES)
+ if (routing.nr > KVM_MAX_IRQ_ROUTES)
goto out;
if (routing.flags)
goto out;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 079/203] KVM: s390/mm: Fix CMMA reset during reboot
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 078/203] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 080/203] KVM: arm/arm64: Stop leaking vcpu pid references Greg Kroah-Hartman
` (117 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Borntraeger, Martin Schwidefsky
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@de.ibm.com>
commit 1c343f7b0e177e8ca7f4d4a5dd1fa790f85abbcc upstream.
commit 1e133ab296f ("s390/mm: split arch/s390/mm/pgtable.c") factored
out the page table handling code from __gmap_zap and __s390_reset_cmma
into ptep_zap_unused and added a simple flag that tells which one of the
function (reset or not) is to be made. This also changed the behaviour,
as it also zaps unused page table entries on reset.
Turns out that this is wrong as s390_reset_cmma uses the page walker,
which DOES NOT take the ptl lock.
The most simple fix is to not do the zapping part on reset (which uses
the walker)
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Fixes: 1e133ab296f ("s390/mm: split arch/s390/mm/pgtable.c")
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/mm/pgtable.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -437,7 +437,7 @@ void ptep_zap_unused(struct mm_struct *m
pgste = pgste_get_lock(ptep);
pgstev = pgste_val(pgste);
pte = *ptep;
- if (pte_swap(pte) &&
+ if (!reset && pte_swap(pte) &&
((pgstev & _PGSTE_GPS_USAGE_MASK) == _PGSTE_GPS_USAGE_UNUSED ||
(pgstev & _PGSTE_GPS_ZERO))) {
ptep_zap_swap_entry(mm, pte_to_swp_entry(pte));
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 080/203] KVM: arm/arm64: Stop leaking vcpu pid references
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 079/203] KVM: s390/mm: Fix CMMA reset during reboot Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 082/203] HID: elo: kill not flush the work Greg Kroah-Hartman
` (116 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Morse, Marc Zyngier, Christoffer Dall
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <james.morse@arm.com>
commit 591d215afcc2f94e8e2c69a63c924c044677eb31 upstream.
kvm provides kvm_vcpu_uninit(), which amongst other things, releases the
last reference to the struct pid of the task that was last running the vcpu.
On arm64 built with CONFIG_DEBUG_KMEMLEAK, starting a guest with kvmtool,
then killing it with SIGKILL results (after some considerable time) in:
> cat /sys/kernel/debug/kmemleak
> unreferenced object 0xffff80007d5ea080 (size 128):
> comm "lkvm", pid 2025, jiffies 4294942645 (age 1107.776s)
> hex dump (first 32 bytes):
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<ffff8000001b30ec>] create_object+0xfc/0x278
> [<ffff80000071da34>] kmemleak_alloc+0x34/0x70
> [<ffff80000019fa2c>] kmem_cache_alloc+0x16c/0x1d8
> [<ffff8000000d0474>] alloc_pid+0x34/0x4d0
> [<ffff8000000b5674>] copy_process.isra.6+0x79c/0x1338
> [<ffff8000000b633c>] _do_fork+0x74/0x320
> [<ffff8000000b66b0>] SyS_clone+0x18/0x20
> [<ffff800000085cb0>] el0_svc_naked+0x24/0x28
> [<ffffffffffffffff>] 0xffffffffffffffff
On x86 kvm_vcpu_uninit() is called on the path from kvm_arch_destroy_vm(),
on arm no equivalent call is made. Add the call to kvm_arch_vcpu_free().
Signed-off-by: James Morse <james.morse@arm.com>
Fixes: 749cf76c5a36 ("KVM: ARM: Initial skeleton to compile KVM support")
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kvm/arm.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -267,6 +267,7 @@ void kvm_arch_vcpu_free(struct kvm_vcpu
kvm_timer_vcpu_terminate(vcpu);
kvm_vgic_vcpu_destroy(vcpu);
kvm_pmu_vcpu_destroy(vcpu);
+ kvm_vcpu_uninit(vcpu);
kmem_cache_free(kvm_vcpu_cache, vcpu);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 082/203] HID: elo: kill not flush the work
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 080/203] KVM: arm/arm64: Stop leaking vcpu pid references Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 083/203] HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands Greg Kroah-Hartman
` (115 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oliver Neukum, Benjamin Tissoires,
Jiri Kosina
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit ed596a4a88bd161f868ccba078557ee7ede8a6ef upstream.
Flushing a work that reschedules itself is not a sensible operation. It needs
to be killed. Failure to do so leads to a kernel panic in the timer code.
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-elo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hid/hid-elo.c
+++ b/drivers/hid/hid-elo.c
@@ -261,7 +261,7 @@ static void elo_remove(struct hid_device
struct elo_priv *priv = hid_get_drvdata(hdev);
hid_hw_stop(hdev);
- flush_workqueue(wq);
+ cancel_delayed_work_sync(&priv->work);
kfree(priv);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 083/203] HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 082/203] HID: elo: kill not flush the work Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:54 ` [PATCH 4.6 084/203] Revert "HID: multitouch: enable palm rejection if device implements confidence usage" Greg Kroah-Hartman
` (114 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Scott Bauer, Jiri Kosina
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Bauer <sbauer@plzdonthack.me>
commit 93a2001bdfd5376c3dc2158653034c20392d15c5 upstream.
This patch validates the num_values parameter from userland during the
HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
leading to a heap overflow.
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/usbhid/hiddev.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(s
goto inval;
} else if (uref->usage_index >= field->report_count)
goto inval;
-
- else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
- (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
- uref->usage_index + uref_multi->num_values > field->report_count))
- goto inval;
}
+ if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+ (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+ uref->usage_index + uref_multi->num_values > field->report_count))
+ goto inval;
+
switch (cmd) {
case HIDIOCGUSAGE:
uref->value = field->value[uref->usage_index];
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 084/203] Revert "HID: multitouch: enable palm rejection if device implements confidence usage"
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 083/203] HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands Greg Kroah-Hartman
@ 2016-07-25 20:54 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 085/203] HID: multitouch: enable palm rejection for Windows Precision Touchpad Greg Kroah-Hartman
` (113 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Tissoires, Allen Hung, Jiri Kosina
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allen Hung <allen_hung@dell.com>
commit 62630ea768869beeb1e514b0bf5607a0c9b93d12 upstream.
This reverts commit 25a84db15b3f ("HID: multitouch: enable palm rejection
if device implements confidence usage")
The commit enables palm rejection for Win8 Precision Touchpad devices but
the quirk MT_QUIRK_VALID_IS_CONFIDENCE it is using is not working very
properly. This quirk is originally designed for some WIn7 touchscreens. Use
of this for a Win8 Precision Touchpad will cause unexpected pointer jumping
problem.
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: Andy Lutomirski <luto@kernel.org> # XPS 13 9350, BIOS 1.4.3
Signed-off-by: Allen Hung <allen_hung@dell.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-multitouch.c | 5 -----
1 file changed, 5 deletions(-)
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -502,11 +502,6 @@ static int mt_touch_input_mapping(struct
mt_store_field(usage, td, hi);
return 1;
case HID_DG_CONFIDENCE:
- if (cls->name == MT_CLS_WIN_8 &&
- field->application == HID_DG_TOUCHPAD) {
- cls->quirks &= ~MT_QUIRK_ALWAYS_VALID;
- cls->quirks |= MT_QUIRK_VALID_IS_CONFIDENCE;
- }
mt_store_field(usage, td, hi);
return 1;
case HID_DG_TIPSWITCH:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 085/203] HID: multitouch: enable palm rejection for Windows Precision Touchpad
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2016-07-25 20:54 ` [PATCH 4.6 084/203] Revert "HID: multitouch: enable palm rejection if device implements confidence usage" Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 086/203] tracing: Handle NULL formats in hold_module_trace_bprintk_format() Greg Kroah-Hartman
` (112 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Tissoires, Allen Hung, Jiri Kosina
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allen Hung <allen_hung@dell.com>
commit 6dd2e27a103d716921cc4a1a96a9adc0a8e3ab57 upstream.
The usage Confidence is mandary to Windows Precision Touchpad devices. If
it is examined in input_mapping on a WIndows Precision Touchpad, a new add
quirk MT_QUIRK_CONFIDENCE desgned for such devices will be applied to the
device. A touch with the confidence bit is not set is determined as
invalid.
Tested on Dell XPS13 9343
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: Andy Lutomirski <luto@kernel.org> # XPS 13 9350, BIOS 1.4.3
Signed-off-by: Allen Hung <allen_hung@dell.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-multitouch.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -61,6 +61,7 @@ MODULE_LICENSE("GPL");
#define MT_QUIRK_ALWAYS_VALID (1 << 4)
#define MT_QUIRK_VALID_IS_INRANGE (1 << 5)
#define MT_QUIRK_VALID_IS_CONFIDENCE (1 << 6)
+#define MT_QUIRK_CONFIDENCE (1 << 7)
#define MT_QUIRK_SLOT_IS_CONTACTID_MINUS_ONE (1 << 8)
#define MT_QUIRK_NO_AREA (1 << 9)
#define MT_QUIRK_IGNORE_DUPLICATES (1 << 10)
@@ -78,6 +79,7 @@ struct mt_slot {
__s32 contactid; /* the device ContactID assigned to this slot */
bool touch_state; /* is the touch valid? */
bool inrange_state; /* is the finger in proximity of the sensor? */
+ bool confidence_state; /* is the touch made by a finger? */
};
struct mt_class {
@@ -502,6 +504,9 @@ static int mt_touch_input_mapping(struct
mt_store_field(usage, td, hi);
return 1;
case HID_DG_CONFIDENCE:
+ if (cls->name == MT_CLS_WIN_8 &&
+ field->application == HID_DG_TOUCHPAD)
+ cls->quirks |= MT_QUIRK_CONFIDENCE;
mt_store_field(usage, td, hi);
return 1;
case HID_DG_TIPSWITCH:
@@ -614,6 +619,7 @@ static void mt_complete_slot(struct mt_d
return;
if (td->curvalid || (td->mtclass.quirks & MT_QUIRK_ALWAYS_VALID)) {
+ int active;
int slotnum = mt_compute_slot(td, input);
struct mt_slot *s = &td->curdata;
struct input_mt *mt = input->mt;
@@ -628,10 +634,14 @@ static void mt_complete_slot(struct mt_d
return;
}
+ if (!(td->mtclass.quirks & MT_QUIRK_CONFIDENCE))
+ s->confidence_state = 1;
+ active = (s->touch_state || s->inrange_state) &&
+ s->confidence_state;
+
input_mt_slot(input, slotnum);
- input_mt_report_slot_state(input, MT_TOOL_FINGER,
- s->touch_state || s->inrange_state);
- if (s->touch_state || s->inrange_state) {
+ input_mt_report_slot_state(input, MT_TOOL_FINGER, active);
+ if (active) {
/* this finger is in proximity of the sensor */
int wide = (s->w > s->h);
/* divided by two to match visual scale of touch */
@@ -696,6 +706,8 @@ static void mt_process_mt_event(struct h
td->curdata.touch_state = value;
break;
case HID_DG_CONFIDENCE:
+ if (quirks & MT_QUIRK_CONFIDENCE)
+ td->curdata.confidence_state = value;
if (quirks & MT_QUIRK_VALID_IS_CONFIDENCE)
td->curvalid = value;
break;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 086/203] tracing: Handle NULL formats in hold_module_trace_bprintk_format()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 085/203] HID: multitouch: enable palm rejection for Windows Precision Touchpad Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 087/203] base: make module_create_drivers_dir race-free Greg Kroah-Hartman
` (111 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, xingzhen, Namhyung Kim, Steven Rostedt
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
commit 70c8217acd4383e069fe1898bbad36ea4fcdbdcc upstream.
If a task uses a non constant string for the format parameter in
trace_printk(), then the trace_printk_fmt variable is set to NULL. This
variable is then saved in the __trace_printk_fmt section.
The function hold_module_trace_bprintk_format() checks to see if duplicate
formats are used by modules, and reuses them if so (saves them to the list
if it is new). But this function calls lookup_format() that does a strcmp()
to the value (which is now NULL) and can cause a kernel oops.
This wasn't an issue till 3debb0a9ddb ("tracing: Fix trace_printk() to print
when not using bprintk()") which added "__used" to the trace_printk_fmt
variable, and before that, the kernel simply optimized it out (no NULL value
was saved).
The fix is simply to handle the NULL pointer in lookup_format() and have the
caller ignore the value if it was NULL.
Link: http://lkml.kernel.org/r/1464769870-18344-1-git-send-email-zhengjun.xing@intel.com
Reported-by: xingzhen <zhengjun.xing@intel.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Fixes: 3debb0a9ddb ("tracing: Fix trace_printk() to print when not using bprintk()")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_printk.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -36,6 +36,10 @@ struct trace_bprintk_fmt {
static inline struct trace_bprintk_fmt *lookup_format(const char *fmt)
{
struct trace_bprintk_fmt *pos;
+
+ if (!fmt)
+ return ERR_PTR(-EINVAL);
+
list_for_each_entry(pos, &trace_bprintk_fmt_list, list) {
if (!strcmp(pos->fmt, fmt))
return pos;
@@ -57,7 +61,8 @@ void hold_module_trace_bprintk_format(co
for (iter = start; iter < end; iter++) {
struct trace_bprintk_fmt *tb_fmt = lookup_format(*iter);
if (tb_fmt) {
- *iter = tb_fmt->fmt;
+ if (!IS_ERR(tb_fmt))
+ *iter = tb_fmt->fmt;
continue;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 087/203] base: make module_create_drivers_dir race-free
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 086/203] tracing: Handle NULL formats in hold_module_trace_bprintk_format() Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 088/203] iommu/rockchip: Fix zap cache during device attach Greg Kroah-Hartman
` (110 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jiri Slaby
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby <jslaby@suse.cz>
commit 7e1b1fc4dabd6ec8e28baa0708866e13fa93c9b3 upstream.
Modules which register drivers via standard path (driver_register) in
parallel can cause a warning:
WARNING: CPU: 2 PID: 3492 at ../fs/sysfs/dir.c:31 sysfs_warn_dup+0x62/0x80
sysfs: cannot create duplicate filename '/module/saa7146/drivers'
Modules linked in: hexium_gemini(+) mxb(+) ...
...
Call Trace:
...
[<ffffffff812e63a2>] sysfs_warn_dup+0x62/0x80
[<ffffffff812e6487>] sysfs_create_dir_ns+0x77/0x90
[<ffffffff8140f2c4>] kobject_add_internal+0xb4/0x340
[<ffffffff8140f5b8>] kobject_add+0x68/0xb0
[<ffffffff8140f631>] kobject_create_and_add+0x31/0x70
[<ffffffff8157a703>] module_add_driver+0xc3/0xd0
[<ffffffff8155e5d4>] bus_add_driver+0x154/0x280
[<ffffffff815604c0>] driver_register+0x60/0xe0
[<ffffffff8145bed0>] __pci_register_driver+0x60/0x70
[<ffffffffa0273e14>] saa7146_register_extension+0x64/0x90 [saa7146]
[<ffffffffa0033011>] hexium_init_module+0x11/0x1000 [hexium_gemini]
...
As can be (mostly) seen, driver_register causes this call sequence:
-> bus_add_driver
-> module_add_driver
-> module_create_drivers_dir
The last one creates "drivers" directory in /sys/module/<...>. When
this is done in parallel, the directory is attempted to be created
twice at the same time.
This can be easily reproduced by loading mxb and hexium_gemini in
parallel:
while :; do
modprobe mxb &
modprobe hexium_gemini
wait
rmmod mxb hexium_gemini saa7146_vv saa7146
done
saa7146 calls pci_register_driver for both mxb and hexium_gemini,
which means /sys/module/saa7146/drivers is to be created for both of
them.
Fix this by a new mutex in module_create_drivers_dir which makes the
test-and-create "drivers" dir atomic.
I inverted the condition and removed 'return' to avoid multiple
unlocks or a goto.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Fixes: fe480a2675ed (Modules: only add drivers/ direcory if needed)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/module.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/base/module.c
+++ b/drivers/base/module.c
@@ -24,10 +24,12 @@ static char *make_driver_name(struct dev
static void module_create_drivers_dir(struct module_kobject *mk)
{
- if (!mk || mk->drivers_dir)
- return;
+ static DEFINE_MUTEX(drivers_dir_mutex);
- mk->drivers_dir = kobject_create_and_add("drivers", &mk->kobj);
+ mutex_lock(&drivers_dir_mutex);
+ if (mk && !mk->drivers_dir)
+ mk->drivers_dir = kobject_create_and_add("drivers", &mk->kobj);
+ mutex_unlock(&drivers_dir_mutex);
}
void module_add_driver(struct module *mod, struct device_driver *drv)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 088/203] iommu/rockchip: Fix zap cache during device attach
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 087/203] base: make module_create_drivers_dir race-free Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 089/203] iommu/arm-smmu: Wire up map_sg for arm-smmu-v3 Greg Kroah-Hartman
` (109 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, John Keeping, Heiko Stuebner, Joerg Roedel
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <john@metanate.com>
commit ae8a7910fb0568531033bd6ebe65590f7a4fa6e2 upstream.
rk_iommu_command() takes a struct rk_iommu and iterates over the slave
MMUs, so this is doubly wrong in that we're passing in the wrong pointer
and talking to MMUs that we shouldn't be.
Fixes: cd6438c5f844 ("iommu/rockchip: Reconstruct to support multi slaves")
Signed-off-by: John Keeping <john@metanate.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/rockchip-iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -815,7 +815,7 @@ static int rk_iommu_attach_device(struct
dte_addr = virt_to_phys(rk_domain->dt);
for (i = 0; i < iommu->num_mmu; i++) {
rk_iommu_write(iommu->bases[i], RK_MMU_DTE_ADDR, dte_addr);
- rk_iommu_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE);
+ rk_iommu_base_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE);
rk_iommu_write(iommu->bases[i], RK_MMU_INT_MASK, RK_MMU_IRQ_MASK);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 089/203] iommu/arm-smmu: Wire up map_sg for arm-smmu-v3
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 088/203] iommu/rockchip: Fix zap cache during device attach Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 090/203] iommu/vt-d: Enable QI on all IOMMUs before setting root entry Greg Kroah-Hartman
` (108 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jean-Philippe Brucker, Will Deacon,
Joerg Roedel
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
commit 9aeb26cfc2abc96be42b9df2d0f2dc5d805084ff upstream.
The map_sg callback is missing from arm_smmu_ops, but is required by
iommu.h. Similarly to most other IOMMU drivers, connect it to
default_iommu_map_sg.
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm-smmu-v3.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1942,6 +1942,7 @@ static struct iommu_ops arm_smmu_ops = {
.attach_dev = arm_smmu_attach_dev,
.map = arm_smmu_map,
.unmap = arm_smmu_unmap,
+ .map_sg = default_iommu_map_sg,
.iova_to_phys = arm_smmu_iova_to_phys,
.add_device = arm_smmu_add_device,
.remove_device = arm_smmu_remove_device,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 090/203] iommu/vt-d: Enable QI on all IOMMUs before setting root entry
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 089/203] iommu/arm-smmu: Wire up map_sg for arm-smmu-v3 Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 091/203] iommu/amd: Fix unity mapping initialization race Greg Kroah-Hartman
` (107 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dheeraj CVR, Joerg Roedel
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
commit a4c34ff1c029e90e7d5f8dd8d29b0a93b31c3cb2 upstream.
This seems to be required on some X58 chipsets on systems
with more than one IOMMU. QI does not work until it is
enabled on all IOMMUs in the system.
Reported-by: Dheeraj CVR <cvr.dheeraj@gmail.com>
Tested-by: Dheeraj CVR <cvr.dheeraj@gmail.com>
Fixes: 5f0a7f7614a9 ('iommu/vt-d: Make root entry visible for hardware right after allocation')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel-iommu.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3169,11 +3169,6 @@ static int __init init_dmars(void)
}
}
- iommu_flush_write_buffer(iommu);
- iommu_set_root_entry(iommu);
- iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL);
- iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
-
if (!ecap_pass_through(iommu->ecap))
hw_pass_through = 0;
#ifdef CONFIG_INTEL_IOMMU_SVM
@@ -3182,6 +3177,18 @@ static int __init init_dmars(void)
#endif
}
+ /*
+ * Now that qi is enabled on all iommus, set the root entry and flush
+ * caches. This is required on some Intel X58 chipsets, otherwise the
+ * flush_context function will loop forever and the boot hangs.
+ */
+ for_each_active_iommu(iommu, drhd) {
+ iommu_flush_write_buffer(iommu);
+ iommu_set_root_entry(iommu);
+ iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL);
+ iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
+ }
+
if (iommu_pass_through)
iommu_identity_mapping |= IDENTMAP_ALL;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 091/203] iommu/amd: Fix unity mapping initialization race
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 090/203] iommu/vt-d: Enable QI on all IOMMUs before setting root entry Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 092/203] apparmor: fix oops, validate buffer size in apparmor_setprocattr() Greg Kroah-Hartman
` (106 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joerg Roedel
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
commit 522e5cb76d0663c88f96b6a8301451c8efa37207 upstream.
There is a race condition in the AMD IOMMU init code that
causes requested unity mappings to be blocked by the IOMMU
for a short period of time. This results on boot failures
and IO_PAGE_FAULTs on some machines.
Fix this by making sure the unity mappings are installed
before all other DMA is blocked.
Fixes: aafd8ba0ca74 ('iommu/amd: Implement add_device and remove_device')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu_init.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1363,13 +1363,23 @@ static int __init amd_iommu_init_pci(voi
break;
}
+ /*
+ * Order is important here to make sure any unity map requirements are
+ * fulfilled. The unity mappings are created and written to the device
+ * table during the amd_iommu_init_api() call.
+ *
+ * After that we call init_device_table_dma() to make sure any
+ * uninitialized DTE will block DMA, and in the end we flush the caches
+ * of all IOMMUs to make sure the changes to the device table are
+ * active.
+ */
+ ret = amd_iommu_init_api();
+
init_device_table_dma();
for_each_iommu(iommu)
iommu_flush_all_caches(iommu);
- ret = amd_iommu_init_api();
-
if (!ret)
print_iommu_info();
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 092/203] apparmor: fix oops, validate buffer size in apparmor_setprocattr()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 091/203] iommu/amd: Fix unity mapping initialization race Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 093/203] drm/mgag200: Black screen fix for G200e rev 4 Greg Kroah-Hartman
` (105 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vegard Nossum, Al Viro,
John Johansen, Paul Moore, Stephen Smalley, Eric Paris,
Casey Schaufler, Tyler Hicks, James Morris
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vegard Nossum <vegard.nossum@oracle.com>
commit 30a46a4647fd1df9cf52e43bf467f0d9265096ca upstream.
When proc_pid_attr_write() was changed to use memdup_user apparmor's
(interface violating) assumption that the setprocattr buffer was always
a single page was violated.
The size test is not strictly speaking needed as proc_pid_attr_write()
will reject anything larger, but for the sake of robustness we can keep
it in.
SMACK and SELinux look safe to me, but somebody else should probably
have a look just in case.
Based on original patch from Vegard Nossum <vegard.nossum@oracle.com>
modified for the case that apparmor provides null termination.
Fixes: bb646cdb12e75d82258c2f2e7746d5952d3e321a
Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: John Johansen <john.johansen@canonical.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Eric Paris <eparis@parisplace.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/lsm.c | 36 +++++++++++++++++++-----------------
1 file changed, 19 insertions(+), 17 deletions(-)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -523,34 +523,34 @@ static int apparmor_setprocattr(struct t
{
struct common_audit_data sa;
struct apparmor_audit_data aad = {0,};
- char *command, *args = value;
+ char *command, *largs = NULL, *args = value;
size_t arg_size;
int error;
if (size == 0)
return -EINVAL;
- /* args points to a PAGE_SIZE buffer, AppArmor requires that
- * the buffer must be null terminated or have size <= PAGE_SIZE -1
- * so that AppArmor can null terminate them
- */
- if (args[size - 1] != '\0') {
- if (size == PAGE_SIZE)
- return -EINVAL;
- args[size] = '\0';
- }
-
/* task can only write its own attributes */
if (current != task)
return -EACCES;
- args = value;
+ /* AppArmor requires that the buffer must be null terminated atm */
+ if (args[size - 1] != '\0') {
+ /* null terminate */
+ largs = args = kmalloc(size + 1, GFP_KERNEL);
+ if (!args)
+ return -ENOMEM;
+ memcpy(args, value, size);
+ args[size] = '\0';
+ }
+
+ error = -EINVAL;
args = strim(args);
command = strsep(&args, " ");
if (!args)
- return -EINVAL;
+ goto out;
args = skip_spaces(args);
if (!*args)
- return -EINVAL;
+ goto out;
arg_size = size - (args - (char *) value);
if (strcmp(name, "current") == 0) {
@@ -576,10 +576,12 @@ static int apparmor_setprocattr(struct t
goto fail;
} else
/* only support the "current" and "exec" process attributes */
- return -EINVAL;
+ goto fail;
if (!error)
error = size;
+out:
+ kfree(largs);
return error;
fail:
@@ -588,9 +590,9 @@ fail:
aad.profile = aa_current_profile();
aad.op = OP_SETPROCATTR;
aad.info = name;
- aad.error = -EINVAL;
+ aad.error = error = -EINVAL;
aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
- return -EINVAL;
+ goto out;
}
static int apparmor_task_setrlimit(struct task_struct *task,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 093/203] drm/mgag200: Black screen fix for G200e rev 4
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 092/203] apparmor: fix oops, validate buffer size in apparmor_setprocattr() Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 094/203] drm/fsl-dcu: use flat regmap cache Greg Kroah-Hartman
` (104 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Beulich, Mathieu Larouche, Dave Airlie
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Larouche <mathieu.larouche@matrox.com>
commit d3922b69617b62bb2509936b68301f837229d9f0 upstream.
- Fixed black screen for some resolutions of G200e rev4
- Fixed testm & testn which had predetermined value.
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Mathieu Larouche <mathieu.larouche@matrox.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/mgag200/mgag200_mode.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -182,7 +182,7 @@ static int mga_g200se_set_plls(struct mg
}
}
- fvv = pllreffreq * testn / testm;
+ fvv = pllreffreq * (n + 1) / (m + 1);
fvv = (fvv - 800000) / 50000;
if (fvv > 15)
@@ -202,6 +202,14 @@ static int mga_g200se_set_plls(struct mg
WREG_DAC(MGA1064_PIX_PLLC_M, m);
WREG_DAC(MGA1064_PIX_PLLC_N, n);
WREG_DAC(MGA1064_PIX_PLLC_P, p);
+
+ if (mdev->unique_rev_id >= 0x04) {
+ WREG_DAC(0x1a, 0x09);
+ msleep(20);
+ WREG_DAC(0x1a, 0x01);
+
+ }
+
return 0;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 094/203] drm/fsl-dcu: use flat regmap cache
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 093/203] drm/mgag200: Black screen fix for G200e rev 4 Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 095/203] ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() Greg Kroah-Hartman
` (103 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Agner, Mark Brown
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <stefan@agner.ch>
commit ce492b3b8f99cf9d2f807ec22d8805c996a09503 upstream.
Using flat regmap cache instead of RB-tree to avoid the following
lockdep warning on driver load:
WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:2755 lockdep_trace_alloc+0x15c/0x160()
DEBUG_LOCKS_WARN_ON(irqs_disabled_flags(flags))
The RB-tree regmap cache needs to allocate new space on first
writes. However, allocations in an atomic context (e.g. when a
spinlock is held) are not allowed. The function regmap_write
calls map->lock, which acquires a spinlock in the fast_io case.
Since the FSL DCU driver uses MMIO, the regmap bus of type
regmap_mmio is being used which has fast_io set to true.
Use flat regmap cache and specify max register to be large
enouth to cover all registers available in LS1021a and Vybrids
register space.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
@@ -40,9 +40,10 @@ static const struct regmap_config fsl_dc
.reg_bits = 32,
.reg_stride = 4,
.val_bits = 32,
- .cache_type = REGCACHE_RBTREE,
+ .cache_type = REGCACHE_FLAT,
.volatile_reg = fsl_dcu_drm_is_volatile_reg,
+ .max_register = 0x11fc,
};
static int fsl_dcu_drm_irq_init(struct drm_device *dev)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 095/203] ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 094/203] drm/fsl-dcu: use flat regmap cache Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 096/203] drm/nouveau/Revert "drm/nouveau/device/pci: set as non-CPU-coherent on ARM64" Greg Kroah-Hartman
` (102 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Junichi Nomura, Corey Minyard, Ye Feng
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junichi Nomura <j-nomura@ce.jp.nec.com>
commit ae4ea9a2460c7fee2ae8feeb4dfe96f5f6c3e562 upstream.
Commit 7ea0ed2b5be8 ("ipmi: Make the message handler easier to use for
SMI interfaces") changed handle_new_recv_msgs() to call handle_one_recv_msg()
for a smi_msg while the smi_msg is still connected to waiting_rcv_msgs list.
That could lead to following list corruption problems:
1) low-level function treats smi_msg as not connected to list
handle_one_recv_msg() could end up calling smi_send(), which
assumes the msg is not connected to list.
For example, the following sequence could corrupt list by
doing list_add_tail() for the entry still connected to other list.
handle_new_recv_msgs()
msg = list_entry(waiting_rcv_msgs)
handle_one_recv_msg(msg)
handle_ipmb_get_msg_cmd(msg)
smi_send(msg)
spin_lock(xmit_msgs_lock)
list_add_tail(msg)
spin_unlock(xmit_msgs_lock)
2) race between multiple handle_new_recv_msgs() instances
handle_new_recv_msgs() once releases waiting_rcv_msgs_lock before calling
handle_one_recv_msg() then retakes the lock and list_del() it.
If others call handle_new_recv_msgs() during the window shown below
list_del() will be done twice for the same smi_msg.
handle_new_recv_msgs()
spin_lock(waiting_rcv_msgs_lock)
msg = list_entry(waiting_rcv_msgs)
spin_unlock(waiting_rcv_msgs_lock)
|
| handle_one_recv_msg(msg)
|
spin_lock(waiting_rcv_msgs_lock)
list_del(msg)
spin_unlock(waiting_rcv_msgs_lock)
Fixes: 7ea0ed2b5be8 ("ipmi: Make the message handler easier to use for SMI interfaces")
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
[Added a comment to describe why this works.]
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Tested-by: Ye Feng <yefeng.yl@alibaba-inc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_msghandler.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3820,6 +3820,7 @@ static void handle_new_recv_msgs(ipmi_sm
while (!list_empty(&intf->waiting_rcv_msgs)) {
smi_msg = list_entry(intf->waiting_rcv_msgs.next,
struct ipmi_smi_msg, link);
+ list_del(&smi_msg->link);
if (!run_to_completion)
spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
flags);
@@ -3829,11 +3830,14 @@ static void handle_new_recv_msgs(ipmi_sm
if (rv > 0) {
/*
* To preserve message order, quit if we
- * can't handle a message.
+ * can't handle a message. Add the message
+ * back at the head, this is safe because this
+ * tasklet is the only thing that pulls the
+ * messages.
*/
+ list_add(&smi_msg->link, &intf->waiting_rcv_msgs);
break;
} else {
- list_del(&smi_msg->link);
if (rv == 0)
/* Message handled */
ipmi_free_smi_msg(smi_msg);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 096/203] drm/nouveau/Revert "drm/nouveau/device/pci: set as non-CPU-coherent on ARM64"
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 095/203] ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 097/203] arm64: fix dump_instr when PAN and UAO are in use Greg Kroah-Hartman
` (101 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robin Murphy, Alexandre Courbot, Ben Skeggs
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
commit 539aae6e3af97c7ec1602ff23e805f2852c2611c upstream.
This reverts commit 1733a2ad36741b1812cf8b3f3037c28d0af53f50.
There is apparently something amiss with the way the TTM code handles
DMA buffers, which the above commit was attempting to work around for
arm64 systems with non-coherent PCI. Unfortunately, this completely
breaks systems *with* coherent PCI (which appear to be the majority).
Booting a plain arm64 defconfig + CONFIG_DRM + CONFIG_DRM_NOUVEAU on
a machine with a PCI GPU having coherent dma_map_ops (in this case a
7600GT card plugged into an ARM Juno board) results in a fatal crash:
[ 2.803438] nouveau 0000:06:00.0: DRM: allocated 1024x768 fb: 0x9000, bo ffffffc976141c00
[ 2.897662] Unable to handle kernel NULL pointer dereference at virtual address 000001ac
[ 2.897666] pgd = ffffff8008e00000
[ 2.897675] [000001ac] *pgd=00000009ffffe003, *pud=00000009ffffe003, *pmd=0000000000000000
[ 2.897680] Internal error: Oops: 96000045 [#1] PREEMPT SMP
[ 2.897685] Modules linked in:
[ 2.897692] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.6.0-rc5+ #543
[ 2.897694] Hardware name: ARM Juno development board (r1) (DT)
[ 2.897699] task: ffffffc9768a0000 ti: ffffffc9768a8000 task.ti: ffffffc9768a8000
[ 2.897711] PC is at __memcpy+0x7c/0x180
[ 2.897719] LR is at OUT_RINGp+0x34/0x70
[ 2.897724] pc : [<ffffff80083465fc>] lr : [<ffffff800854248c>] pstate: 80000045
[ 2.897726] sp : ffffffc9768ab360
[ 2.897732] x29: ffffffc9768ab360 x28: 0000000000000001
[ 2.897738] x27: ffffffc97624c000 x26: 0000000000000000
[ 2.897744] x25: 0000000000000080 x24: 0000000000006c00
[ 2.897749] x23: 0000000000000005 x22: ffffffc97624c010
[ 2.897755] x21: 0000000000000004 x20: 0000000000000004
[ 2.897761] x19: ffffffc9763da000 x18: ffffffc976b2491c
[ 2.897766] x17: 0000000000000007 x16: 0000000000000006
[ 2.897771] x15: 0000000000000001 x14: 0000000000000001
[ 2.897777] x13: 0000000000e31b70 x12: ffffffc9768a0080
[ 2.897783] x11: 0000000000000000 x10: fffffffffffffb00
[ 2.897788] x9 : 0000000000000000 x8 : 0000000000000000
[ 2.897793] x7 : 0000000000000000 x6 : 00000000000001ac
[ 2.897799] x5 : 00000000ffffffff x4 : 0000000000000000
[ 2.897804] x3 : 0000000000000010 x2 : 0000000000000010
[ 2.897810] x1 : ffffffc97624c010 x0 : 00000000000001ac
...
[ 2.898494] Call trace:
[ 2.898499] Exception stack(0xffffffc9768ab1a0 to 0xffffffc9768ab2c0)
[ 2.898506] b1a0: ffffffc9763da000 0000000000000004 ffffffc9768ab360 ffffff80083465fc
[ 2.898513] b1c0: ffffffc976801e00 ffffffc9762b8000 ffffffc9768ab1f0 ffffff80080ec158
[ 2.898520] b1e0: ffffffc9768ab230 ffffff8008496d04 ffffffc975ce6d80 ffffffc9768ab36e
[ 2.898527] b200: ffffffc9768ab36f ffffffc9768ab29d ffffffc9768ab29e ffffffc9768a0000
[ 2.898533] b220: ffffffc9768ab250 ffffff80080e70c0 ffffffc9768ab270 ffffff8008496e44
[ 2.898540] b240: 00000000000001ac ffffffc97624c010 0000000000000010 0000000000000010
[ 2.898546] b260: 0000000000000000 00000000ffffffff 00000000000001ac 0000000000000000
[ 2.898552] b280: 0000000000000000 0000000000000000 fffffffffffffb00 0000000000000000
[ 2.898558] b2a0: ffffffc9768a0080 0000000000e31b70 0000000000000001 0000000000000001
[ 2.898566] [<ffffff80083465fc>] __memcpy+0x7c/0x180
[ 2.898574] [<ffffff800853e164>] nv04_fbcon_imageblit+0x1d4/0x2e8
[ 2.898582] [<ffffff800853d6d0>] nouveau_fbcon_imageblit+0xd8/0xe0
[ 2.898591] [<ffffff80083c4db4>] soft_cursor+0x154/0x1d8
[ 2.898598] [<ffffff80083c47b4>] bit_cursor+0x4fc/0x538
[ 2.898605] [<ffffff80083c0cfc>] fbcon_cursor+0x134/0x1a8
[ 2.898613] [<ffffff800841c280>] hide_cursor+0x38/0xa0
[ 2.898620] [<ffffff800841d420>] redraw_screen+0x120/0x228
[ 2.898628] [<ffffff80083bf268>] fbcon_prepare_logo+0x370/0x3f8
[ 2.898635] [<ffffff80083bf640>] fbcon_init+0x350/0x560
[ 2.898641] [<ffffff800841c634>] visual_init+0xac/0x108
[ 2.898648] [<ffffff800841df14>] do_bind_con_driver+0x1c4/0x3a8
[ 2.898655] [<ffffff800841e4f4>] do_take_over_console+0x174/0x1e8
[ 2.898662] [<ffffff80083bf8c4>] do_fbcon_takeover+0x74/0x100
[ 2.898669] [<ffffff80083c3e44>] fbcon_event_notify+0x8cc/0x920
[ 2.898680] [<ffffff80080d7e38>] notifier_call_chain+0x50/0x90
[ 2.898685] [<ffffff80080d8214>] __blocking_notifier_call_chain+0x4c/0x90
[ 2.898691] [<ffffff80080d826c>] blocking_notifier_call_chain+0x14/0x20
[ 2.898696] [<ffffff80083c5e1c>] fb_notifier_call_chain+0x1c/0x28
[ 2.898703] [<ffffff80083c81ac>] register_framebuffer+0x1cc/0x2e0
[ 2.898712] [<ffffff800845da80>] drm_fb_helper_initial_config+0x288/0x3e8
[ 2.898719] [<ffffff800853da20>] nouveau_fbcon_init+0xe0/0x118
[ 2.898727] [<ffffff800852d2f8>] nouveau_drm_load+0x268/0x890
[ 2.898734] [<ffffff8008466e24>] drm_dev_register+0xbc/0xc8
[ 2.898740] [<ffffff8008468a88>] drm_get_pci_dev+0xa0/0x180
[ 2.898747] [<ffffff800852cb28>] nouveau_drm_probe+0x1a0/0x1e0
[ 2.898755] [<ffffff80083a32e0>] pci_device_probe+0x98/0x110
[ 2.898763] [<ffffff800858e434>] driver_probe_device+0x204/0x2b0
[ 2.898770] [<ffffff800858e58c>] __driver_attach+0xac/0xb0
[ 2.898777] [<ffffff800858c3e0>] bus_for_each_dev+0x60/0xa0
[ 2.898783] [<ffffff800858dbc0>] driver_attach+0x20/0x28
[ 2.898789] [<ffffff800858d7b0>] bus_add_driver+0x1d0/0x238
[ 2.898796] [<ffffff800858ed50>] driver_register+0x60/0xf8
[ 2.898802] [<ffffff80083a20dc>] __pci_register_driver+0x3c/0x48
[ 2.898809] [<ffffff8008468eb4>] drm_pci_init+0xf4/0x120
[ 2.898818] [<ffffff8008c56fc0>] nouveau_drm_init+0x21c/0x230
[ 2.898825] [<ffffff80080829d4>] do_one_initcall+0x8c/0x190
[ 2.898832] [<ffffff8008c31af4>] kernel_init_freeable+0x14c/0x1f0
[ 2.898839] [<ffffff80088a0c20>] kernel_init+0x10/0x100
[ 2.898845] [<ffffff8008085e10>] ret_from_fork+0x10/0x40
[ 2.898853] Code: a88120c7 a8c12027 a88120c7 a8c12027 (a88120c7)
[ 2.898871] ---[ end trace d5713dcad023ee04 ]---
[ 2.898888] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
In a toss-up between the GPU seeing stale data artefacts on some systems
vs. catastrophic kernel crashes on other systems, the latter would seem
to take precedence, so revert this change until the real underlying
problem can be fixed.
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
[acourbot@nvidia.com: port to Nouveau tree, remove bits in lib/]
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
@@ -1614,7 +1614,7 @@ nvkm_device_pci_func = {
.fini = nvkm_device_pci_fini,
.resource_addr = nvkm_device_pci_resource_addr,
.resource_size = nvkm_device_pci_resource_size,
- .cpu_coherent = !IS_ENABLED(CONFIG_ARM) && !IS_ENABLED(CONFIG_ARM64),
+ .cpu_coherent = !IS_ENABLED(CONFIG_ARM),
};
int
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 097/203] arm64: fix dump_instr when PAN and UAO are in use
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 096/203] drm/nouveau/Revert "drm/nouveau/device/pci: set as non-CPU-coherent on ARM64" Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 098/203] arm64: mm: remove page_mapping check in __sync_icache_dcache Greg Kroah-Hartman
` (100 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Catalin Marinas, James Morse,
Robin Murphy, Mark Rutland, Vladimir Murzin, Will Deacon
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit c5cea06be060f38e5400d796e61cfc8c36e52924 upstream.
If the kernel is set to show unhandled signals, and a user task does not
handle a SIGILL as a result of an instruction abort, we will attempt to
log the offending instruction with dump_instr before killing the task.
We use dump_instr to log the encoding of the offending userspace
instruction. However, dump_instr is also used to dump instructions from
kernel space, and internally always switches to KERNEL_DS before dumping
the instruction with get_user. When both PAN and UAO are in use, reading
a user instruction via get_user while in KERNEL_DS will result in a
permission fault, which leads to an Oops.
As we have regs corresponding to the context of the original instruction
abort, we can inspect this and only flip to KERNEL_DS if the original
abort was taken from the kernel, avoiding this issue. At the same time,
remove the redundant (and incorrect) comments regarding the order
dump_mem and dump_instr are called in.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reported-by: Vladimir Murzin <vladimir.murzin@arm.com>
Tested-by: Vladimir Murzin <vladimir.murzin@arm.com>
Fixes: 57f4959bad0a154a ("arm64: kernel: Add support for User Access Override")
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/traps.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -64,8 +64,7 @@ static void dump_mem(const char *lvl, co
/*
* We need to switch to kernel mode so that we can use __get_user
- * to safely read from kernel space. Note that we now dump the
- * code first, just in case the backtrace kills us.
+ * to safely read from kernel space.
*/
fs = get_fs();
set_fs(KERNEL_DS);
@@ -111,21 +110,12 @@ static void dump_backtrace_entry(unsigne
print_ip_sym(where);
}
-static void dump_instr(const char *lvl, struct pt_regs *regs)
+static void __dump_instr(const char *lvl, struct pt_regs *regs)
{
unsigned long addr = instruction_pointer(regs);
- mm_segment_t fs;
char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
int i;
- /*
- * We need to switch to kernel mode so that we can use __get_user
- * to safely read from kernel space. Note that we now dump the
- * code first, just in case the backtrace kills us.
- */
- fs = get_fs();
- set_fs(KERNEL_DS);
-
for (i = -4; i < 1; i++) {
unsigned int val, bad;
@@ -139,8 +129,18 @@ static void dump_instr(const char *lvl,
}
}
printk("%sCode: %s\n", lvl, str);
+}
- set_fs(fs);
+static void dump_instr(const char *lvl, struct pt_regs *regs)
+{
+ if (!user_mode(regs)) {
+ mm_segment_t fs = get_fs();
+ set_fs(KERNEL_DS);
+ __dump_instr(lvl, regs);
+ set_fs(fs);
+ } else {
+ __dump_instr(lvl, regs);
+ }
}
static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 098/203] arm64: mm: remove page_mapping check in __sync_icache_dcache
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 097/203] arm64: fix dump_instr when PAN and UAO are in use Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 099/203] arm64: kernel: Save and restore UAO and addr_limit on exception entry Greg Kroah-Hartman
` (99 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Catalin Marinas, Will Deacon,
Mark Rutland, Shaokun Zhang
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaokun Zhang <zhangshaokun@hisilicon.com>
commit 20c27a4270c775d7ed661491af8ac03264d60fc6 upstream.
__sync_icache_dcache unconditionally skips the cache maintenance for
anonymous pages, under the assumption that flushing is only required in
the presence of D-side aliases [see 7249b79f6b4cc ("arm64: Do not flush
the D-cache for anonymous pages")].
Unfortunately, this breaks migration of anonymous pages holding
self-modifying code, where userspace cannot be reasonably expected to
reissue maintenance instructions in response to a migration.
This patch fixes the problem by removing the broken page_mapping(page)
check from the cache syncing code, otherwise we may end up fetching and
executing stale instructions from the PoU.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Shaokun Zhang <zhangshaokun@hisilicon.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/flush.c | 4 ----
1 file changed, 4 deletions(-)
--- a/arch/arm64/mm/flush.c
+++ b/arch/arm64/mm/flush.c
@@ -71,10 +71,6 @@ void __sync_icache_dcache(pte_t pte, uns
{
struct page *page = pte_page(pte);
- /* no flushing needed for anonymous pages */
- if (!page_mapping(page))
- return;
-
if (!test_and_set_bit(PG_dcache_clean, &page->flags))
sync_icache_aliases(page_address(page),
PAGE_SIZE << compound_order(page));
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 099/203] arm64: kernel: Save and restore UAO and addr_limit on exception entry
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 098/203] arm64: mm: remove page_mapping check in __sync_icache_dcache Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 100/203] vfs: add d_real_inode() helper Greg Kroah-Hartman
` (98 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Will Deacon, Mark Rutland, James Morse
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <james.morse@arm.com>
commit e19a6ee2460bdd0d0055a6029383422773f9999a upstream.
If we take an exception while at EL1, the exception handler inherits
the original context's addr_limit and PSTATE.UAO values. To be consistent
always reset addr_limit and PSTATE.UAO on (re-)entry to EL1. This
prevents accidental re-use of the original context's addr_limit.
Based on a similar patch for arm from Russell King.
Acked-by: Will Deacon <will.deacon@arm.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/ptrace.h | 2 ++
arch/arm64/kernel/asm-offsets.c | 1 +
arch/arm64/kernel/entry.S | 19 +++++++++++++++++--
arch/arm64/mm/fault.c | 3 ++-
4 files changed, 22 insertions(+), 3 deletions(-)
--- a/arch/arm64/include/asm/ptrace.h
+++ b/arch/arm64/include/asm/ptrace.h
@@ -117,6 +117,8 @@ struct pt_regs {
};
u64 orig_x0;
u64 syscallno;
+ u64 orig_addr_limit;
+ u64 unused; // maintain 16 byte alignment
};
#define arch_has_single_step() (1)
--- a/arch/arm64/kernel/asm-offsets.c
+++ b/arch/arm64/kernel/asm-offsets.c
@@ -59,6 +59,7 @@ int main(void)
DEFINE(S_PC, offsetof(struct pt_regs, pc));
DEFINE(S_ORIG_X0, offsetof(struct pt_regs, orig_x0));
DEFINE(S_SYSCALLNO, offsetof(struct pt_regs, syscallno));
+ DEFINE(S_ORIG_ADDR_LIMIT, offsetof(struct pt_regs, orig_addr_limit));
DEFINE(S_FRAME_SIZE, sizeof(struct pt_regs));
BLANK();
DEFINE(MM_CONTEXT_ID, offsetof(struct mm_struct, context.id.counter));
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -28,6 +28,7 @@
#include <asm/errno.h>
#include <asm/esr.h>
#include <asm/irq.h>
+#include <asm/memory.h>
#include <asm/thread_info.h>
#include <asm/unistd.h>
@@ -97,7 +98,14 @@
mov x29, xzr // fp pointed to user-space
.else
add x21, sp, #S_FRAME_SIZE
- .endif
+ get_thread_info tsk
+ /* Save the task's original addr_limit and set USER_DS (TASK_SIZE_64) */
+ ldr x20, [tsk, #TI_ADDR_LIMIT]
+ str x20, [sp, #S_ORIG_ADDR_LIMIT]
+ mov x20, #TASK_SIZE_64
+ str x20, [tsk, #TI_ADDR_LIMIT]
+ ALTERNATIVE(nop, SET_PSTATE_UAO(0), ARM64_HAS_UAO, CONFIG_ARM64_UAO)
+ .endif /* \el == 0 */
mrs x22, elr_el1
mrs x23, spsr_el1
stp lr, x21, [sp, #S_LR]
@@ -128,6 +136,14 @@
.endm
.macro kernel_exit, el
+ .if \el != 0
+ /* Restore the task's original addr_limit. */
+ ldr x20, [sp, #S_ORIG_ADDR_LIMIT]
+ str x20, [tsk, #TI_ADDR_LIMIT]
+
+ /* No need to restore UAO, it will be restored from SPSR_EL1 */
+ .endif
+
ldp x21, x22, [sp, #S_PC] // load ELR, SPSR
.if \el == 0
ct_user_enter
@@ -406,7 +422,6 @@ el1_irq:
bl trace_hardirqs_off
#endif
- get_thread_info tsk
irq_handler
#ifdef CONFIG_PREEMPT
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -284,7 +284,8 @@ static int __kprobes do_page_fault(unsig
}
if (permission_fault(esr) && (addr < USER_DS)) {
- if (get_fs() == KERNEL_DS)
+ /* regs->orig_addr_limit may be 0 if we entered from EL0 */
+ if (regs->orig_addr_limit == KERNEL_DS)
die("Accessing user space memory with fs=KERNEL_DS", regs, esr);
if (!search_exception_tables(regs->pc))
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 100/203] vfs: add d_real_inode() helper
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 099/203] arm64: kernel: Save and restore UAO and addr_limit on exception entry Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 101/203] af_unix: fix hard linked sockets on overlay Greg Kroah-Hartman
` (97 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit a118084432d642eeccb961c7c8cc61525a941fcb upstream.
Needed by the following fix.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/dcache.h | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -576,5 +576,17 @@ static inline struct inode *vfs_select_i
return inode;
}
+/**
+ * d_real_inode - Return the real inode
+ * @dentry: The dentry to query
+ *
+ * If dentry is on an union/overlay, then return the underlying, real inode.
+ * Otherwise return d_inode().
+ */
+static inline struct inode *d_real_inode(struct dentry *dentry)
+{
+ return d_backing_inode(d_real(dentry));
+}
+
#endif /* __LINUX_DCACHE_H */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 101/203] af_unix: fix hard linked sockets on overlay
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 100/203] vfs: add d_real_inode() helper Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 102/203] percpu: fix synchronization between chunk->map_extend_work and chunk destruction Greg Kroah-Hartman
` (96 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Morozov, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit eb0a4a47ae89aaa0674ab3180de6a162f3be2ddf upstream.
Overlayfs uses separate inodes even in the case of hard links on the
underlying filesystems. This is a problem for AF_UNIX socket
implementation which indexes sockets based on the inode. This resulted in
hard linked sockets not working.
The fix is to use the real, underlying inode.
Test case follows:
-- ovl-sock-test.c --
#include <unistd.h>
#include <err.h>
#include <sys/socket.h>
#include <sys/un.h>
#define SOCK "test-sock"
#define SOCK2 "test-sock2"
int main(void)
{
int fd, fd2;
struct sockaddr_un addr = {
.sun_family = AF_UNIX,
.sun_path = SOCK,
};
struct sockaddr_un addr2 = {
.sun_family = AF_UNIX,
.sun_path = SOCK2,
};
unlink(SOCK);
unlink(SOCK2);
if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1)
err(1, "socket");
if (bind(fd, (struct sockaddr *) &addr, sizeof(addr)) == -1)
err(1, "bind");
if (listen(fd, 0) == -1)
err(1, "listen");
if (link(SOCK, SOCK2) == -1)
err(1, "link");
if ((fd2 = socket(AF_UNIX, SOCK_STREAM, 0)) == -1)
err(1, "socket");
if (connect(fd2, (struct sockaddr *) &addr2, sizeof(addr2)) == -1)
err (1, "connect");
return 0;
}
----
Reported-by: Alexander Morozov <alexandr.morozov@docker.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/unix/af_unix.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -315,7 +315,7 @@ static struct sock *unix_find_socket_byi
&unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
struct dentry *dentry = unix_sk(s)->path.dentry;
- if (dentry && d_backing_inode(dentry) == i) {
+ if (dentry && d_real_inode(dentry) == i) {
sock_hold(s);
goto found;
}
@@ -911,7 +911,7 @@ static struct sock *unix_find_other(stru
err = kern_path(sunname->sun_path, LOOKUP_FOLLOW, &path);
if (err)
goto fail;
- inode = d_backing_inode(path.dentry);
+ inode = d_real_inode(path.dentry);
err = inode_permission(inode, MAY_WRITE);
if (err)
goto put_fail;
@@ -1048,7 +1048,7 @@ static int unix_bind(struct socket *sock
goto out_up;
}
addr->hash = UNIX_HASH_SIZE;
- hash = d_backing_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
+ hash = d_real_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
spin_lock(&unix_table_lock);
u->path = u_path;
list = &unix_socket_table[hash];
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 102/203] percpu: fix synchronization between chunk->map_extend_work and chunk destruction
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 101/203] af_unix: fix hard linked sockets on overlay Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 103/203] percpu: fix synchronization between synchronous map extension " Greg Kroah-Hartman
` (95 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Vlastimil Babka, Sasha Levin
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 4f996e234dad488e5d9ba0858bc1bae12eff82c3 upstream.
Atomic allocations can trigger async map extensions which is serviced
by chunk->map_extend_work. pcpu_balance_work which is responsible for
destroying idle chunks wasn't synchronizing properly against
chunk->map_extend_work and may end up freeing the chunk while the work
item is still in flight.
This patch fixes the bug by rolling async map extension operations
into pcpu_balance_work.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Fixes: 9c824b6a172c ("percpu: make sure chunk->map array has available space")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/percpu.c | 57 ++++++++++++++++++++++++++++++++++++---------------------
1 file changed, 36 insertions(+), 21 deletions(-)
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -112,7 +112,7 @@ struct pcpu_chunk {
int map_used; /* # of map entries used before the sentry */
int map_alloc; /* # of map entries allocated */
int *map; /* allocation map */
- struct work_struct map_extend_work;/* async ->map[] extension */
+ struct list_head map_extend_list;/* on pcpu_map_extend_chunks */
void *data; /* chunk data */
int first_free; /* no free below this */
@@ -166,6 +166,9 @@ static DEFINE_MUTEX(pcpu_alloc_mutex); /
static struct list_head *pcpu_slot __read_mostly; /* chunk list slots */
+/* chunks which need their map areas extended, protected by pcpu_lock */
+static LIST_HEAD(pcpu_map_extend_chunks);
+
/*
* The number of empty populated pages, protected by pcpu_lock. The
* reserved chunk doesn't contribute to the count.
@@ -395,13 +398,19 @@ static int pcpu_need_to_extend(struct pc
{
int margin, new_alloc;
+ lockdep_assert_held(&pcpu_lock);
+
if (is_atomic) {
margin = 3;
if (chunk->map_alloc <
- chunk->map_used + PCPU_ATOMIC_MAP_MARGIN_LOW &&
- pcpu_async_enabled)
- schedule_work(&chunk->map_extend_work);
+ chunk->map_used + PCPU_ATOMIC_MAP_MARGIN_LOW) {
+ if (list_empty(&chunk->map_extend_list)) {
+ list_add_tail(&chunk->map_extend_list,
+ &pcpu_map_extend_chunks);
+ pcpu_schedule_balance_work();
+ }
+ }
} else {
margin = PCPU_ATOMIC_MAP_MARGIN_HIGH;
}
@@ -467,20 +476,6 @@ out_unlock:
return 0;
}
-static void pcpu_map_extend_workfn(struct work_struct *work)
-{
- struct pcpu_chunk *chunk = container_of(work, struct pcpu_chunk,
- map_extend_work);
- int new_alloc;
-
- spin_lock_irq(&pcpu_lock);
- new_alloc = pcpu_need_to_extend(chunk, false);
- spin_unlock_irq(&pcpu_lock);
-
- if (new_alloc)
- pcpu_extend_area_map(chunk, new_alloc);
-}
-
/**
* pcpu_fit_in_area - try to fit the requested allocation in a candidate area
* @chunk: chunk the candidate area belongs to
@@ -740,7 +735,7 @@ static struct pcpu_chunk *pcpu_alloc_chu
chunk->map_used = 1;
INIT_LIST_HEAD(&chunk->list);
- INIT_WORK(&chunk->map_extend_work, pcpu_map_extend_workfn);
+ INIT_LIST_HEAD(&chunk->map_extend_list);
chunk->free_size = pcpu_unit_size;
chunk->contig_hint = pcpu_unit_size;
@@ -1129,6 +1124,7 @@ static void pcpu_balance_workfn(struct w
if (chunk == list_first_entry(free_head, struct pcpu_chunk, list))
continue;
+ list_del_init(&chunk->map_extend_list);
list_move(&chunk->list, &to_free);
}
@@ -1146,6 +1142,25 @@ static void pcpu_balance_workfn(struct w
pcpu_destroy_chunk(chunk);
}
+ /* service chunks which requested async area map extension */
+ do {
+ int new_alloc = 0;
+
+ spin_lock_irq(&pcpu_lock);
+
+ chunk = list_first_entry_or_null(&pcpu_map_extend_chunks,
+ struct pcpu_chunk, map_extend_list);
+ if (chunk) {
+ list_del_init(&chunk->map_extend_list);
+ new_alloc = pcpu_need_to_extend(chunk, false);
+ }
+
+ spin_unlock_irq(&pcpu_lock);
+
+ if (new_alloc)
+ pcpu_extend_area_map(chunk, new_alloc);
+ } while (chunk);
+
/*
* Ensure there are certain number of free populated pages for
* atomic allocs. Fill up from the most packed so that atomic
@@ -1644,7 +1659,7 @@ int __init pcpu_setup_first_chunk(const
*/
schunk = memblock_virt_alloc(pcpu_chunk_struct_size, 0);
INIT_LIST_HEAD(&schunk->list);
- INIT_WORK(&schunk->map_extend_work, pcpu_map_extend_workfn);
+ INIT_LIST_HEAD(&schunk->map_extend_list);
schunk->base_addr = base_addr;
schunk->map = smap;
schunk->map_alloc = ARRAY_SIZE(smap);
@@ -1673,7 +1688,7 @@ int __init pcpu_setup_first_chunk(const
if (dyn_size) {
dchunk = memblock_virt_alloc(pcpu_chunk_struct_size, 0);
INIT_LIST_HEAD(&dchunk->list);
- INIT_WORK(&dchunk->map_extend_work, pcpu_map_extend_workfn);
+ INIT_LIST_HEAD(&dchunk->map_extend_list);
dchunk->base_addr = base_addr;
dchunk->map = dmap;
dchunk->map_alloc = ARRAY_SIZE(dmap);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 103/203] percpu: fix synchronization between synchronous map extension and chunk destruction
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 102/203] percpu: fix synchronization between chunk->map_extend_work and chunk destruction Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 104/203] btrfs: account for non-CoWd blocks in btrfs_abort_transaction Greg Kroah-Hartman
` (94 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Vlastimil Babka, Sasha Levin
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 6710e594f71ccaad8101bc64321152af7cd9ea28 upstream.
For non-atomic allocations, pcpu_alloc() can try to extend the area
map synchronously after dropping pcpu_lock; however, the extension
wasn't synchronized against chunk destruction and the chunk might get
freed while extension is in progress.
This patch fixes the bug by putting most of non-atomic allocations
under pcpu_alloc_mutex to synchronize against pcpu_balance_work which
is responsible for async chunk management including destruction.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Fixes: 1a4d76076cda ("percpu: implement asynchronous chunk population")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/percpu.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -162,7 +162,7 @@ static struct pcpu_chunk *pcpu_reserved_
static int pcpu_reserved_chunk_limit;
static DEFINE_SPINLOCK(pcpu_lock); /* all internal data structures */
-static DEFINE_MUTEX(pcpu_alloc_mutex); /* chunk create/destroy, [de]pop */
+static DEFINE_MUTEX(pcpu_alloc_mutex); /* chunk create/destroy, [de]pop, map ext */
static struct list_head *pcpu_slot __read_mostly; /* chunk list slots */
@@ -444,6 +444,8 @@ static int pcpu_extend_area_map(struct p
size_t old_size = 0, new_size = new_alloc * sizeof(new[0]);
unsigned long flags;
+ lockdep_assert_held(&pcpu_alloc_mutex);
+
new = pcpu_mem_zalloc(new_size);
if (!new)
return -ENOMEM;
@@ -890,6 +892,9 @@ static void __percpu *pcpu_alloc(size_t
return NULL;
}
+ if (!is_atomic)
+ mutex_lock(&pcpu_alloc_mutex);
+
spin_lock_irqsave(&pcpu_lock, flags);
/* serve reserved allocations from the reserved chunk if available */
@@ -962,12 +967,9 @@ restart:
if (is_atomic)
goto fail;
- mutex_lock(&pcpu_alloc_mutex);
-
if (list_empty(&pcpu_slot[pcpu_nr_slots - 1])) {
chunk = pcpu_create_chunk();
if (!chunk) {
- mutex_unlock(&pcpu_alloc_mutex);
err = "failed to allocate new chunk";
goto fail;
}
@@ -978,7 +980,6 @@ restart:
spin_lock_irqsave(&pcpu_lock, flags);
}
- mutex_unlock(&pcpu_alloc_mutex);
goto restart;
area_found:
@@ -988,8 +989,6 @@ area_found:
if (!is_atomic) {
int page_start, page_end, rs, re;
- mutex_lock(&pcpu_alloc_mutex);
-
page_start = PFN_DOWN(off);
page_end = PFN_UP(off + size);
@@ -1000,7 +999,6 @@ area_found:
spin_lock_irqsave(&pcpu_lock, flags);
if (ret) {
- mutex_unlock(&pcpu_alloc_mutex);
pcpu_free_area(chunk, off, &occ_pages);
err = "failed to populate";
goto fail_unlock;
@@ -1040,6 +1038,8 @@ fail:
/* see the flag handling in pcpu_blance_workfn() */
pcpu_atomic_alloc_failed = true;
pcpu_schedule_balance_work();
+ } else {
+ mutex_unlock(&pcpu_alloc_mutex);
}
return NULL;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 104/203] btrfs: account for non-CoWd blocks in btrfs_abort_transaction
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 103/203] percpu: fix synchronization between synchronous map extension " Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 105/203] drm/radeon: fix asic initialization for virtualized environments Greg Kroah-Hartman
` (93 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jeff Mahoney, Filipe Manana, David Sterba
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <jeffm@suse.com>
commit 64c12921e11b3a0c10d088606e328c58e29274d8 upstream.
The test for !trans->blocks_used in btrfs_abort_transaction is
insufficient to determine whether it's safe to drop the transaction
handle on the floor. btrfs_cow_block, informed by should_cow_block,
can return blocks that have already been CoW'd in the current
transaction. trans->blocks_used is only incremented for new block
allocations. If an operation overlaps the blocks in the current
transaction entirely and must abort the transaction, we'll happily
let it clean up the trans handle even though it may have modified
the blocks and will commit an incomplete operation.
In the long-term, I'd like to do closer tracking of when the fs
is actually modified so we can still recover as gracefully as possible,
but that approach will need some discussion. In the short term,
since this is the only code using trans->blocks_used, let's just
switch it to a bool indicating whether any blocks were used and set
it when should_cow_block returns false.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/ctree.c | 5 ++++-
fs/btrfs/extent-tree.c | 2 +-
fs/btrfs/super.c | 2 +-
fs/btrfs/transaction.h | 2 +-
4 files changed, 7 insertions(+), 4 deletions(-)
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1552,6 +1552,7 @@ noinline int btrfs_cow_block(struct btrf
trans->transid, root->fs_info->generation);
if (!should_cow_block(trans, root, buf)) {
+ trans->dirty = true;
*cow_ret = buf;
return 0;
}
@@ -2773,8 +2774,10 @@ again:
* then we don't want to set the path blocking,
* so we test it here
*/
- if (!should_cow_block(trans, root, b))
+ if (!should_cow_block(trans, root, b)) {
+ trans->dirty = true;
goto cow_done;
+ }
/*
* must have write locks on this node and the
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -7929,7 +7929,7 @@ btrfs_init_new_buffer(struct btrfs_trans
set_extent_dirty(&trans->transaction->dirty_pages, buf->start,
buf->start + buf->len - 1, GFP_NOFS);
}
- trans->blocks_used++;
+ trans->dirty = true;
/* this returns a buffer locked for blocking */
return buf;
}
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -239,7 +239,7 @@ void __btrfs_abort_transaction(struct bt
trans->aborted = errno;
/* Nothing used. The other threads that have joined this
* transaction may be able to continue. */
- if (!trans->blocks_used && list_empty(&trans->new_bgs)) {
+ if (!trans->dirty && list_empty(&trans->new_bgs)) {
const char *errstr;
errstr = btrfs_decode_error(errno);
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -110,7 +110,6 @@ struct btrfs_trans_handle {
u64 chunk_bytes_reserved;
unsigned long use_count;
unsigned long blocks_reserved;
- unsigned long blocks_used;
unsigned long delayed_ref_updates;
struct btrfs_transaction *transaction;
struct btrfs_block_rsv *block_rsv;
@@ -121,6 +120,7 @@ struct btrfs_trans_handle {
bool can_flush_pending_bgs;
bool reloc_reserved;
bool sync;
+ bool dirty;
unsigned int type;
/*
* this root is only needed to validate that the root passed to
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 105/203] drm/radeon: fix asic initialization for virtualized environments
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 104/203] btrfs: account for non-CoWd blocks in btrfs_abort_transaction Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 106/203] drm/amdgpu/gfx7: fix broken condition check Greg Kroah-Hartman
` (92 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andres Rodriguez, Alex Williamson,
Alex Deucher
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 05082b8bbd1a0ffc74235449c4b8930a8c240f85 upstream.
When executing in a PCI passthrough based virtuzliation environment, the
hypervisor will usually attempt to send a PCIe bus reset signal to the
ASIC when the VM reboots. In this scenario, the card is not correctly
initialized, but we still consider it to be posted. Therefore, in a
passthrough based environemnt we should always post the card to guarantee
it is in a good state for driver initialization.
Ported from amdgpu commit:
amdgpu: fix asic initialization for virtualized environments
Cc: Andres Rodriguez <andres.rodriguez@amd.com>
Cc: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_device.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -630,6 +630,23 @@ void radeon_gtt_location(struct radeon_d
/*
* GPU helpers function.
*/
+
+/**
+ * radeon_device_is_virtual - check if we are running is a virtual environment
+ *
+ * Check if the asic has been passed through to a VM (all asics).
+ * Used at driver startup.
+ * Returns true if virtual or false if not.
+ */
+static bool radeon_device_is_virtual(void)
+{
+#ifdef CONFIG_X86
+ return boot_cpu_has(X86_FEATURE_HYPERVISOR);
+#else
+ return false;
+#endif
+}
+
/**
* radeon_card_posted - check if the hw has already been initialized
*
@@ -643,6 +660,10 @@ bool radeon_card_posted(struct radeon_de
{
uint32_t reg;
+ /* for pass through, always force asic_init */
+ if (radeon_device_is_virtual())
+ return false;
+
/* required for EFI mode on macbook2,1 which uses an r5xx asic */
if (efi_enabled(EFI_BOOT) &&
(rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE) &&
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 106/203] drm/amdgpu/gfx7: fix broken condition check
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 105/203] drm/radeon: fix asic initialization for virtualized environments Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 108/203] drm/amdgpu: initialize amdgpu_cgs_acpi_eval_object result value Greg Kroah-Hartman
` (91 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Binderman, Alex Deucher
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 8b18300c13a1e08e152f6b6a430faac84f986231 upstream.
Wrong operator.
Reported-by: David Binderman <linuxdev.baldrick@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -5074,7 +5074,7 @@ static int gfx_v7_0_eop_irq(struct amdgp
case 2:
for (i = 0; i < adev->gfx.num_compute_rings; i++) {
ring = &adev->gfx.compute_ring[i];
- if ((ring->me == me_id) & (ring->pipe == pipe_id))
+ if ((ring->me == me_id) && (ring->pipe == pipe_id))
amdgpu_fence_process(ring);
}
break;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 108/203] drm/amdgpu: initialize amdgpu_cgs_acpi_eval_object result value
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 106/203] drm/amdgpu/gfx7: fix broken condition check Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 110/203] drm/amdkfd: unbind only existing processes Greg Kroah-Hartman
` (90 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolas Iooss, Alex Deucher
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
commit 29b9c528b8c295911e8b1e515273e89a2b7fa2d8 upstream.
amdgpu_cgs_acpi_eval_object() returned the value of variable "result"
without initializing it first.
This bug has been found by compiling the kernel with clang. The
compiler complained:
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c:972:14: error: variable
'result' is used uninitialized whenever 'for' loop exits because its
condition is false [-Werror,-Wsometimes-uninitialized]
for (i = 0; i < count; i++) {
^~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c:1011:9: note: uninitialized
use occurs here
return result;
^~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c:972:14: note: remove the
condition if it is always true
for (i = 0; i < count; i++) {
^~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c:864:12: note: initialize the
variable 'result' to silence this warning
int result;
^
= 0
Fixes: 3f1d35a03b3c ("drm/amdgpu: implement new cgs interface for acpi
function")
Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -880,7 +880,7 @@ static int amdgpu_cgs_acpi_eval_object(v
struct cgs_acpi_method_argument *argument = NULL;
uint32_t i, count;
acpi_status status;
- int result;
+ int result = 0;
uint32_t func_no = 0xFFFFFFFF;
handle = ACPI_HANDLE(&adev->pdev->dev);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 110/203] drm/amdkfd: unbind only existing processes
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 108/203] drm/amdgpu: initialize amdgpu_cgs_acpi_eval_object result value Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 111/203] drm/amdkfd: destroy dbgmgr in notifier release Greg Kroah-Hartman
` (89 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Oded Gabbay
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oded Gabbay <oded.gabbay@gmail.com>
commit 121b78e679ee3ffab780115e260b2775d0cc1f73 upstream.
When unbinding a process from a device (initiated by amd_iommu_v2), the
driver needs to make sure that process still exists in the process table.
There is a possibility that amdkfd's own notifier handler -
kfd_process_notifier_release() - was called before the unbind function
and it already removed the process from the process table.
v2:
Because there can be only one process with the specified pasid, and
because *p can't be NULL inside the hash_for_each_rcu macro, it is more
reasonable to just put the whole code inside the if statement that
compares the pasid value. That way, when we exit hash_for_each_rcu, we
simply exit the function as well.
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 60 ++++++++++++++++++-------------
1 file changed, 35 insertions(+), 25 deletions(-)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -404,42 +404,52 @@ void kfd_unbind_process_from_device(stru
idx = srcu_read_lock(&kfd_processes_srcu);
+ /*
+ * Look for the process that matches the pasid. If there is no such
+ * process, we either released it in amdkfd's own notifier, or there
+ * is a bug. Unfortunately, there is no way to tell...
+ */
hash_for_each_rcu(kfd_processes_table, i, p, kfd_processes)
- if (p->pasid == pasid)
- break;
+ if (p->pasid == pasid) {
- srcu_read_unlock(&kfd_processes_srcu, idx);
+ srcu_read_unlock(&kfd_processes_srcu, idx);
- BUG_ON(p->pasid != pasid);
+ pr_debug("Unbinding process %d from IOMMU\n", pasid);
- mutex_lock(&p->mutex);
+ mutex_lock(&p->mutex);
- if ((dev->dbgmgr) && (dev->dbgmgr->pasid == p->pasid))
- kfd_dbgmgr_destroy(dev->dbgmgr);
+ if ((dev->dbgmgr) && (dev->dbgmgr->pasid == p->pasid))
+ kfd_dbgmgr_destroy(dev->dbgmgr);
- pqm_uninit(&p->pqm);
+ pqm_uninit(&p->pqm);
- pdd = kfd_get_process_device_data(dev, p);
+ pdd = kfd_get_process_device_data(dev, p);
- if (!pdd) {
- mutex_unlock(&p->mutex);
- return;
- }
+ if (!pdd) {
+ mutex_unlock(&p->mutex);
+ return;
+ }
- if (pdd->reset_wavefronts) {
- dbgdev_wave_reset_wavefronts(pdd->dev, p);
- pdd->reset_wavefronts = false;
- }
+ if (pdd->reset_wavefronts) {
+ dbgdev_wave_reset_wavefronts(pdd->dev, p);
+ pdd->reset_wavefronts = false;
+ }
- /*
- * Just mark pdd as unbound, because we still need it to call
- * amd_iommu_unbind_pasid() in when the process exits.
- * We don't call amd_iommu_unbind_pasid() here
- * because the IOMMU called us.
- */
- pdd->bound = false;
+ /*
+ * Just mark pdd as unbound, because we still need it
+ * to call amd_iommu_unbind_pasid() in when the
+ * process exits.
+ * We don't call amd_iommu_unbind_pasid() here
+ * because the IOMMU called us.
+ */
+ pdd->bound = false;
+
+ mutex_unlock(&p->mutex);
- mutex_unlock(&p->mutex);
+ return;
+ }
+
+ srcu_read_unlock(&kfd_processes_srcu, idx);
}
struct kfd_process_device *kfd_get_first_process_device_data(struct kfd_process *p)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 111/203] drm/amdkfd: destroy dbgmgr in notifier release
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 110/203] drm/amdkfd: unbind only existing processes Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 112/203] drm/dp/mst: Always clear proposed vcpi table for port Greg Kroah-Hartman
` (88 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Oded Gabbay
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oded Gabbay <oded.gabbay@gmail.com>
commit bc4755a4bd1845ef6e88ac8c62f12e05bb530256 upstream.
amdkfd need to destroy the debug manager in case amdkfd's notifier
function is called before the unbind function, because in that case,
the unbind function will exit without destroying debug manager.
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -242,13 +242,19 @@ static void kfd_process_notifier_release
pqm_uninit(&p->pqm);
/* Iterate over all process device data structure and check
- * if we should reset all wavefronts */
- list_for_each_entry(pdd, &p->per_device_data, per_device_list)
+ * if we should delete debug managers and reset all wavefronts
+ */
+ list_for_each_entry(pdd, &p->per_device_data, per_device_list) {
+ if ((pdd->dev->dbgmgr) &&
+ (pdd->dev->dbgmgr->pasid == p->pasid))
+ kfd_dbgmgr_destroy(pdd->dev->dbgmgr);
+
if (pdd->reset_wavefronts) {
pr_warn("amdkfd: Resetting all wave fronts\n");
dbgdev_wave_reset_wavefronts(pdd->dev, p);
pdd->reset_wavefronts = false;
}
+ }
mutex_unlock(&p->mutex);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 112/203] drm/dp/mst: Always clear proposed vcpi table for port.
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 111/203] drm/amdkfd: destroy dbgmgr in notifier release Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 113/203] virtio_balloon: fix PFN format for virtio-1 Greg Kroah-Hartman
` (87 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Grodzovsky, Lyude,
Mykola Lysenko, Alex Deucher
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Grodzovsky <Andrey.Grodzovsky@amd.com>
commit fd2d2bac6e79b0be91ab86a6075a0c46ffda658a upstream.
Not clearing mst manager's proposed vcpis table for destroyed connectors when the manager is stopped leaves it pointing to unrefernced memory, this causes pagefault when the manager is restarted when plugging back a branch.
Fixes: 91a25e463130 ("drm/dp/mst: deallocate payload on port destruction")
Signed-off-by: Andrey Grodzovsky <Andrey.Grodzovsky@amd.com>
Reviewed-by: Lyude <cpaul@redhat.com>
Cc: Mykola Lysenko <Mykola.Lysenko@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2908,11 +2908,9 @@ static void drm_dp_destroy_connector_wor
drm_dp_port_teardown_pdt(port, port->pdt);
if (!port->input && port->vcpi.vcpi > 0) {
- if (mgr->mst_state) {
- drm_dp_mst_reset_vcpi_slots(mgr, port);
- drm_dp_update_payload_part1(mgr);
- drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi);
- }
+ drm_dp_mst_reset_vcpi_slots(mgr, port);
+ drm_dp_update_payload_part1(mgr);
+ drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi);
}
kref_put(&port->kref, drm_dp_free_mst_port);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 113/203] virtio_balloon: fix PFN format for virtio-1
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 112/203] drm/dp/mst: Always clear proposed vcpi table for port Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 114/203] drm/nouveau/bios/disp: fix handling of "match any protocol" entries Greg Kroah-Hartman
` (86 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cornelia Huck, Michael S. Tsirkin
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
commit 87c9403b0d1de4676b0bd273eea68fcf6de68e68 upstream.
Everything should be LE when using virtio-1, but
the linux balloon driver does not seem to care about that.
Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virtio/virtio_balloon.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -75,7 +75,7 @@ struct virtio_balloon {
/* The array of pfns we tell the Host about. */
unsigned int num_pfns;
- u32 pfns[VIRTIO_BALLOON_ARRAY_PFNS_MAX];
+ __virtio32 pfns[VIRTIO_BALLOON_ARRAY_PFNS_MAX];
/* Memory statistics */
struct virtio_balloon_stat stats[VIRTIO_BALLOON_S_NR];
@@ -127,14 +127,16 @@ static void tell_host(struct virtio_ball
}
-static void set_page_pfns(u32 pfns[], struct page *page)
+static void set_page_pfns(struct virtio_balloon *vb,
+ __virtio32 pfns[], struct page *page)
{
unsigned int i;
/* Set balloon pfns pointing at this page.
* Note that the first pfn points at start of the page. */
for (i = 0; i < VIRTIO_BALLOON_PAGES_PER_PAGE; i++)
- pfns[i] = page_to_balloon_pfn(page) + i;
+ pfns[i] = cpu_to_virtio32(vb->vdev,
+ page_to_balloon_pfn(page) + i);
}
static unsigned fill_balloon(struct virtio_balloon *vb, size_t num)
@@ -158,7 +160,7 @@ static unsigned fill_balloon(struct virt
msleep(200);
break;
}
- set_page_pfns(vb->pfns + vb->num_pfns, page);
+ set_page_pfns(vb, vb->pfns + vb->num_pfns, page);
vb->num_pages += VIRTIO_BALLOON_PAGES_PER_PAGE;
if (!virtio_has_feature(vb->vdev,
VIRTIO_BALLOON_F_DEFLATE_ON_OOM))
@@ -177,10 +179,12 @@ static unsigned fill_balloon(struct virt
static void release_pages_balloon(struct virtio_balloon *vb)
{
unsigned int i;
+ struct page *page;
/* Find pfns pointing at start of each page, get pages and free them. */
for (i = 0; i < vb->num_pfns; i += VIRTIO_BALLOON_PAGES_PER_PAGE) {
- struct page *page = balloon_pfn_to_page(vb->pfns[i]);
+ page = balloon_pfn_to_page(virtio32_to_cpu(vb->vdev,
+ vb->pfns[i]));
if (!virtio_has_feature(vb->vdev,
VIRTIO_BALLOON_F_DEFLATE_ON_OOM))
adjust_managed_page_count(page, 1);
@@ -203,7 +207,7 @@ static unsigned leak_balloon(struct virt
page = balloon_page_dequeue(vb_dev_info);
if (!page)
break;
- set_page_pfns(vb->pfns + vb->num_pfns, page);
+ set_page_pfns(vb, vb->pfns + vb->num_pfns, page);
vb->num_pages -= VIRTIO_BALLOON_PAGES_PER_PAGE;
}
@@ -471,13 +475,13 @@ static int virtballoon_migratepage(struc
__count_vm_event(BALLOON_MIGRATE);
spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags);
vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE;
- set_page_pfns(vb->pfns, newpage);
+ set_page_pfns(vb, vb->pfns, newpage);
tell_host(vb, vb->inflate_vq);
/* balloon's page migration 2nd step -- deflate "page" */
balloon_page_delete(page);
vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE;
- set_page_pfns(vb->pfns, page);
+ set_page_pfns(vb, vb->pfns, page);
tell_host(vb, vb->deflate_vq);
mutex_unlock(&vb->balloon_lock);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 114/203] drm/nouveau/bios/disp: fix handling of "match any protocol" entries
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 113/203] virtio_balloon: fix PFN format for virtio-1 Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 115/203] drm/nouveau/disp/sor/gf119: both links use the same training register Greg Kroah-Hartman
` (85 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit bc9139d23f6b038e32bcd2dffdee70a8d76b3976 upstream.
As it turns out, a value of 0xff means "any protocol" and not "VGA".
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h | 5 +++--
drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c | 13 +++++--------
drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c | 12 ++++--------
drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c | 8 +++++---
4 files changed, 17 insertions(+), 21 deletions(-)
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h
@@ -25,7 +25,8 @@ u16 nvbios_outp_match(struct nvkm_bios *
u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_outp *);
struct nvbios_ocfg {
- u16 match;
+ u8 proto;
+ u8 flags;
u16 clkcmp[2];
};
@@ -33,7 +34,7 @@ u16 nvbios_ocfg_entry(struct nvkm_bios *
u8 *ver, u8 *hdr, u8 *cnt, u8 *len);
u16 nvbios_ocfg_parse(struct nvkm_bios *, u16 outp, u8 idx,
u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_ocfg *);
-u16 nvbios_ocfg_match(struct nvkm_bios *, u16 outp, u16 type,
+u16 nvbios_ocfg_match(struct nvkm_bios *, u16 outp, u8 proto, u8 flags,
u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_ocfg *);
u16 nvbios_oclk_match(struct nvkm_bios *, u16 cmp, u32 khz);
#endif
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c
@@ -76,6 +76,7 @@ exec_lookup(struct nv50_disp *disp, int
mask |= 0x0001 << or;
mask |= 0x0100 << head;
+
list_for_each_entry(outp, &disp->base.outp, head) {
if ((outp->info.hasht & 0xff) == type &&
(outp->info.hashm & mask) == mask) {
@@ -155,25 +156,21 @@ exec_clkcmp(struct nv50_disp *disp, int
if (!outp)
return NULL;
+ *conf = (ctrl & 0x00000f00) >> 8;
switch (outp->info.type) {
case DCB_OUTPUT_TMDS:
- *conf = (ctrl & 0x00000f00) >> 8;
if (*conf == 5)
*conf |= 0x0100;
break;
case DCB_OUTPUT_LVDS:
- *conf = disp->sor.lvdsconf;
- break;
- case DCB_OUTPUT_DP:
- *conf = (ctrl & 0x00000f00) >> 8;
+ *conf |= disp->sor.lvdsconf;
break;
- case DCB_OUTPUT_ANALOG:
default:
- *conf = 0x00ff;
break;
}
- data = nvbios_ocfg_match(bios, data, *conf, &ver, &hdr, &cnt, &len, &info2);
+ data = nvbios_ocfg_match(bios, data, *conf & 0xff, *conf >> 8,
+ &ver, &hdr, &cnt, &len, &info2);
if (data && id < 0xff) {
data = nvbios_oclk_match(bios, info2.clkcmp[id], pclk);
if (data) {
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
@@ -387,22 +387,17 @@ exec_clkcmp(struct nv50_disp *disp, int
if (!outp)
return NULL;
+ *conf = (ctrl & 0x00000f00) >> 8;
if (outp->info.location == 0) {
switch (outp->info.type) {
case DCB_OUTPUT_TMDS:
- *conf = (ctrl & 0x00000f00) >> 8;
if (*conf == 5)
*conf |= 0x0100;
break;
case DCB_OUTPUT_LVDS:
- *conf = disp->sor.lvdsconf;
+ *conf |= disp->sor.lvdsconf;
break;
- case DCB_OUTPUT_DP:
- *conf = (ctrl & 0x00000f00) >> 8;
- break;
- case DCB_OUTPUT_ANALOG:
default:
- *conf = 0x00ff;
break;
}
} else {
@@ -410,7 +405,8 @@ exec_clkcmp(struct nv50_disp *disp, int
pclk = pclk / 2;
}
- data = nvbios_ocfg_match(bios, data, *conf, &ver, &hdr, &cnt, &len, &info2);
+ data = nvbios_ocfg_match(bios, data, *conf & 0xff, *conf >> 8,
+ &ver, &hdr, &cnt, &len, &info2);
if (data && id < 0xff) {
data = nvbios_oclk_match(bios, info2.clkcmp[id], pclk);
if (data) {
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c
@@ -141,7 +141,8 @@ nvbios_ocfg_parse(struct nvkm_bios *bios
{
u16 data = nvbios_ocfg_entry(bios, outp, idx, ver, hdr, cnt, len);
if (data) {
- info->match = nvbios_rd16(bios, data + 0x00);
+ info->proto = nvbios_rd08(bios, data + 0x00);
+ info->flags = nvbios_rd16(bios, data + 0x01);
info->clkcmp[0] = nvbios_rd16(bios, data + 0x02);
info->clkcmp[1] = nvbios_rd16(bios, data + 0x04);
}
@@ -149,12 +150,13 @@ nvbios_ocfg_parse(struct nvkm_bios *bios
}
u16
-nvbios_ocfg_match(struct nvkm_bios *bios, u16 outp, u16 type,
+nvbios_ocfg_match(struct nvkm_bios *bios, u16 outp, u8 proto, u8 flags,
u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_ocfg *info)
{
u16 data, idx = 0;
while ((data = nvbios_ocfg_parse(bios, outp, idx++, ver, hdr, cnt, len, info))) {
- if (info->match == type)
+ if ((info->proto == proto || info->proto == 0xff) &&
+ (info->flags == flags))
break;
}
return data;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 115/203] drm/nouveau/disp/sor/gf119: both links use the same training register
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 114/203] drm/nouveau/bios/disp: fix handling of "match any protocol" entries Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 116/203] drm/nouveau/gr/gf100-: update sm error decoding from gk20a nvgpu headers Greg Kroah-Hartman
` (84 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit a8953c52b95167b5d21a66f0859751570271d834 upstream.
It appears that, for whatever reason, both link A and B use the same
register to control the training pattern. It's a little odd, as the
GPUs before this (Tesla/Fermi1) have per-link registers, as do newer
GPUs (Maxwell).
Fixes the third DP output on NVS 510 (GK107).
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
@@ -40,8 +40,7 @@ static int
gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
{
struct nvkm_device *device = outp->base.disp->engine.subdev.device;
- const u32 loff = gf119_sor_loff(outp);
- nvkm_mask(device, 0x61c110 + loff, 0x0f0f0f0f, 0x01010101 * pattern);
+ nvkm_mask(device, 0x61c110, 0x0f0f0f0f, 0x01010101 * pattern);
return 0;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 116/203] drm/nouveau/gr/gf100-: update sm error decoding from gk20a nvgpu headers
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 115/203] drm/nouveau/disp/sor/gf119: both links use the same training register Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 117/203] drm/nouveau/ltc/gm107-: fix typo in the address of NV_PLTCG_LTC0_LTS0_INTR Greg Kroah-Hartman
` (83 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit 383d0a419f8e63e3d65e706c3c515fa9505ce364 upstream.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 37 ++++++++++++++++++-------
1 file changed, 28 insertions(+), 9 deletions(-)
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
@@ -942,22 +942,41 @@ gf100_gr_trap_gpc_rop(struct gf100_gr *g
}
static const struct nvkm_enum gf100_mp_warp_error[] = {
- { 0x00, "NO_ERROR" },
- { 0x01, "STACK_MISMATCH" },
+ { 0x01, "STACK_ERROR" },
+ { 0x02, "API_STACK_ERROR" },
+ { 0x03, "RET_EMPTY_STACK_ERROR" },
+ { 0x04, "PC_WRAP" },
{ 0x05, "MISALIGNED_PC" },
- { 0x08, "MISALIGNED_GPR" },
- { 0x09, "INVALID_OPCODE" },
- { 0x0d, "GPR_OUT_OF_BOUNDS" },
- { 0x0e, "MEM_OUT_OF_BOUNDS" },
- { 0x0f, "UNALIGNED_MEM_ACCESS" },
+ { 0x06, "PC_OVERFLOW" },
+ { 0x07, "MISALIGNED_IMMC_ADDR" },
+ { 0x08, "MISALIGNED_REG" },
+ { 0x09, "ILLEGAL_INSTR_ENCODING" },
+ { 0x0a, "ILLEGAL_SPH_INSTR_COMBO" },
+ { 0x0b, "ILLEGAL_INSTR_PARAM" },
+ { 0x0c, "INVALID_CONST_ADDR" },
+ { 0x0d, "OOR_REG" },
+ { 0x0e, "OOR_ADDR" },
+ { 0x0f, "MISALIGNED_ADDR" },
{ 0x10, "INVALID_ADDR_SPACE" },
- { 0x11, "INVALID_PARAM" },
+ { 0x11, "ILLEGAL_INSTR_PARAM2" },
+ { 0x12, "INVALID_CONST_ADDR_LDC" },
+ { 0x13, "GEOMETRY_SM_ERROR" },
+ { 0x14, "DIVERGENT" },
+ { 0x15, "WARP_EXIT" },
{}
};
static const struct nvkm_bitfield gf100_mp_global_error[] = {
+ { 0x00000001, "SM_TO_SM_FAULT" },
+ { 0x00000002, "L1_ERROR" },
{ 0x00000004, "MULTIPLE_WARP_ERRORS" },
- { 0x00000008, "OUT_OF_STACK_SPACE" },
+ { 0x00000008, "PHYSICAL_STACK_OVERFLOW" },
+ { 0x00000010, "BPT_INT" },
+ { 0x00000020, "BPT_PAUSE" },
+ { 0x00000040, "SINGLE_STEP_COMPLETE" },
+ { 0x20000000, "ECC_SEC_ERROR" },
+ { 0x40000000, "ECC_DED_ERROR" },
+ { 0x80000000, "TIMEOUT" },
{}
};
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 117/203] drm/nouveau/ltc/gm107-: fix typo in the address of NV_PLTCG_LTC0_LTS0_INTR
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 116/203] drm/nouveau/gr/gf100-: update sm error decoding from gk20a nvgpu headers Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 118/203] drm/nouveau/fbcon: fix out-of-bounds memory accesses Greg Kroah-Hartman
` (82 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit 9057c8d75018f05bbc769d7b4602de3b8b20f8aa upstream.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c | 6 +++---
drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c
@@ -69,11 +69,11 @@ gm107_ltc_zbc_clear_depth(struct nvkm_lt
}
static void
-gm107_ltc_lts_isr(struct nvkm_ltc *ltc, int c, int s)
+gm107_ltc_intr_lts(struct nvkm_ltc *ltc, int c, int s)
{
struct nvkm_subdev *subdev = <c->subdev;
struct nvkm_device *device = subdev->device;
- u32 base = 0x140000 + (c * 0x2000) + (s * 0x200);
+ u32 base = 0x140400 + (c * 0x2000) + (s * 0x200);
u32 stat = nvkm_rd32(device, base + 0x00c);
if (stat) {
@@ -92,7 +92,7 @@ gm107_ltc_intr(struct nvkm_ltc *ltc)
while (mask) {
u32 s, c = __ffs(mask);
for (s = 0; s < ltc->lts_nr; s++)
- gm107_ltc_lts_isr(ltc, c, s);
+ gm107_ltc_intr_lts(ltc, c, s);
mask &= ~(1 << c);
}
}
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c
@@ -46,7 +46,7 @@ static const struct nvkm_ltc_func
gm200_ltc = {
.oneinit = gm200_ltc_oneinit,
.init = gm200_ltc_init,
- .intr = gm107_ltc_intr, /*XXX: not validated */
+ .intr = gm107_ltc_intr,
.cbc_clear = gm107_ltc_cbc_clear,
.cbc_wait = gm107_ltc_cbc_wait,
.zbc = 16,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 118/203] drm/nouveau/fbcon: fix out-of-bounds memory accesses
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (110 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 117/203] drm/nouveau/ltc/gm107-: fix typo in the address of NV_PLTCG_LTC0_LTS0_INTR Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 119/203] drm/nouveau/disp/sor/gm107: training pattern registers are like gm200 Greg Kroah-Hartman
` (81 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit f045f459d925138fe7d6193a8c86406bda7e49da upstream.
Reported by KASAN.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_fbcon.c | 1 +
drivers/gpu/drm/nouveau/nv04_fbcon.c | 7 ++-----
drivers/gpu/drm/nouveau/nv50_fbcon.c | 6 ++----
drivers/gpu/drm/nouveau/nvc0_fbcon.c | 6 ++----
4 files changed, 7 insertions(+), 13 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -557,6 +557,7 @@ nouveau_fbcon_init(struct drm_device *de
if (ret)
goto fini;
+ fbcon->helper.fbdev->pixmap.buf_align = 4;
return 0;
fini:
--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
@@ -82,7 +82,6 @@ nv04_fbcon_imageblit(struct fb_info *inf
uint32_t fg;
uint32_t bg;
uint32_t dsize;
- uint32_t width;
uint32_t *data = (uint32_t *)image->data;
int ret;
@@ -93,9 +92,6 @@ nv04_fbcon_imageblit(struct fb_info *inf
if (ret)
return ret;
- width = ALIGN(image->width, 8);
- dsize = ALIGN(width * image->height, 32) >> 5;
-
if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
fg = ((uint32_t *) info->pseudo_palette)[image->fg_color];
@@ -111,10 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *inf
((image->dx + image->width) & 0xffff));
OUT_RING(chan, bg);
OUT_RING(chan, fg);
- OUT_RING(chan, (image->height << 16) | width);
+ OUT_RING(chan, (image->height << 16) | image->width);
OUT_RING(chan, (image->height << 16) | image->width);
OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
+ dsize = ALIGN(image->width * image->height, 32) >> 5;
while (dsize) {
int iter_len = dsize > 128 ? 128 : dsize;
--- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
@@ -95,7 +95,7 @@ nv50_fbcon_imageblit(struct fb_info *inf
struct nouveau_fbdev *nfbdev = info->par;
struct nouveau_drm *drm = nouveau_drm(nfbdev->dev);
struct nouveau_channel *chan = drm->channel;
- uint32_t width, dwords, *data = (uint32_t *)image->data;
+ uint32_t dwords, *data = (uint32_t *)image->data;
uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));
uint32_t *palette = info->pseudo_palette;
int ret;
@@ -107,9 +107,6 @@ nv50_fbcon_imageblit(struct fb_info *inf
if (ret)
return ret;
- width = ALIGN(image->width, 32);
- dwords = (width * image->height) >> 5;
-
BEGIN_NV04(chan, NvSub2D, 0x0814, 2);
if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
@@ -128,6 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *inf
OUT_RING(chan, 0);
OUT_RING(chan, image->dy);
+ dwords = ALIGN(image->width * image->height, 32) >> 5;
while (dwords) {
int push = dwords > 2047 ? 2047 : dwords;
--- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
@@ -95,7 +95,7 @@ nvc0_fbcon_imageblit(struct fb_info *inf
struct nouveau_fbdev *nfbdev = info->par;
struct nouveau_drm *drm = nouveau_drm(nfbdev->dev);
struct nouveau_channel *chan = drm->channel;
- uint32_t width, dwords, *data = (uint32_t *)image->data;
+ uint32_t dwords, *data = (uint32_t *)image->data;
uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));
uint32_t *palette = info->pseudo_palette;
int ret;
@@ -107,9 +107,6 @@ nvc0_fbcon_imageblit(struct fb_info *inf
if (ret)
return ret;
- width = ALIGN(image->width, 32);
- dwords = (width * image->height) >> 5;
-
BEGIN_NVC0(chan, NvSub2D, 0x0814, 2);
if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
@@ -128,6 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *inf
OUT_RING (chan, 0);
OUT_RING (chan, image->dy);
+ dwords = ALIGN(image->width * image->height, 32) >> 5;
while (dwords) {
int push = dwords > 2047 ? 2047 : dwords;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 119/203] drm/nouveau/disp/sor/gm107: training pattern registers are like gm200
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (111 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 118/203] drm/nouveau/fbcon: fix out-of-bounds memory accesses Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 120/203] drm/nouveau: fix for disabled fbdev emulation Greg Kroah-Hartman
` (80 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit 4691409b3e2250ed66aa8dcefa23fe765daf7add upstream.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 1
drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c | 2
drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h | 9 ++-
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 2
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c | 53 ++++++++++++++++++++
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c | 15 -----
6 files changed, 64 insertions(+), 18 deletions(-)
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild
@@ -18,6 +18,7 @@ nvkm-y += nvkm/engine/disp/piornv50.o
nvkm-y += nvkm/engine/disp/sornv50.o
nvkm-y += nvkm/engine/disp/sorg94.o
nvkm-y += nvkm/engine/disp/sorgf119.o
+nvkm-y += nvkm/engine/disp/sorgm107.o
nvkm-y += nvkm/engine/disp/sorgm200.o
nvkm-y += nvkm/engine/disp/dport.o
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
@@ -36,7 +36,7 @@ gm107_disp = {
.outp.internal.crt = nv50_dac_output_new,
.outp.internal.tmds = nv50_sor_output_new,
.outp.internal.lvds = nv50_sor_output_new,
- .outp.internal.dp = gf119_sor_dp_new,
+ .outp.internal.dp = gm107_sor_dp_new,
.dac.nr = 3,
.dac.power = nv50_dac_power,
.dac.sense = nv50_dac_sense,
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h
@@ -62,7 +62,12 @@ int g94_sor_dp_lnk_pwr(struct nvkm_outpu
int gf119_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
struct nvkm_output **);
int gf119_sor_dp_lnk_ctl(struct nvkm_output_dp *, int, int, bool);
+int gf119_sor_dp_drv_ctl(struct nvkm_output_dp *, int, int, int, int);
-int gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
- struct nvkm_output **);
+int gm107_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
+ struct nvkm_output **);
+int gm107_sor_dp_pattern(struct nvkm_output_dp *, int);
+
+int gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
+ struct nvkm_output **);
#endif
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
@@ -63,7 +63,7 @@ gf119_sor_dp_lnk_ctl(struct nvkm_output_
return 0;
}
-static int
+int
gf119_sor_dp_drv_ctl(struct nvkm_output_dp *outp,
int ln, int vs, int pe, int pc)
{
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2016 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs <bskeggs@redhat.com>
+ */
+#include "nv50.h"
+#include "outpdp.h"
+
+int
+gm107_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
+{
+ struct nvkm_device *device = outp->base.disp->engine.subdev.device;
+ const u32 soff = outp->base.or * 0x800;
+ const u32 data = 0x01010101 * pattern;
+ if (outp->base.info.sorconf.link & 1)
+ nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data);
+ else
+ nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data);
+ return 0;
+}
+
+static const struct nvkm_output_dp_func
+gm107_sor_dp_func = {
+ .pattern = gm107_sor_dp_pattern,
+ .lnk_pwr = g94_sor_dp_lnk_pwr,
+ .lnk_ctl = gf119_sor_dp_lnk_ctl,
+ .drv_ctl = gf119_sor_dp_drv_ctl,
+};
+
+int
+gm107_sor_dp_new(struct nvkm_disp *disp, int index,
+ struct dcb_output *dcbE, struct nvkm_output **poutp)
+{
+ return nvkm_output_dp_new_(&gm107_sor_dp_func, disp, index, dcbE, poutp);
+}
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c
@@ -57,19 +57,6 @@ gm200_sor_dp_lane_map(struct nvkm_device
}
static int
-gm200_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
-{
- struct nvkm_device *device = outp->base.disp->engine.subdev.device;
- const u32 soff = gm200_sor_soff(outp);
- const u32 data = 0x01010101 * pattern;
- if (outp->base.info.sorconf.link & 1)
- nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data);
- else
- nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data);
- return 0;
-}
-
-static int
gm200_sor_dp_lnk_pwr(struct nvkm_output_dp *outp, int nr)
{
struct nvkm_device *device = outp->base.disp->engine.subdev.device;
@@ -129,7 +116,7 @@ gm200_sor_dp_drv_ctl(struct nvkm_output_
static const struct nvkm_output_dp_func
gm200_sor_dp_func = {
- .pattern = gm200_sor_dp_pattern,
+ .pattern = gm107_sor_dp_pattern,
.lnk_pwr = gm200_sor_dp_lnk_pwr,
.lnk_ctl = gf119_sor_dp_lnk_ctl,
.drv_ctl = gm200_sor_dp_drv_ctl,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 120/203] drm/nouveau: fix for disabled fbdev emulation
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (112 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 119/203] drm/nouveau/disp/sor/gm107: training pattern registers are like gm200 Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 121/203] drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern Greg Kroah-Hartman
` (79 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitrii Tcvetkov, Ilia Mirkin, Ben Skeggs
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitrii Tcvetkov <demfloro@demfloro.ru>
commit 52dfcc5ccfbb6697ac3cac7f7ff1e712760e1216 upstream.
Hello,
after this commit:
commit f045f459d925138fe7d6193a8c86406bda7e49da
Author: Ben Skeggs <bskeggs@redhat.com>
Date: Thu Jun 2 12:23:31 2016 +1000
drm/nouveau/fbcon: fix out-of-bounds memory accesses
kernel started to oops when loading nouveau module when using GTX 780 Ti
video adapter. This patch fixes the problem.
Bug report: https://bugzilla.kernel.org/show_bug.cgi?id=120591
Signed-off-by: Dmitrii Tcvetkov <demfloro@demfloro.ru>
Suggested-by: Ilia Mirkin <imirkin@alum.mit.edu>
Fixes: f045f459d925 ("nouveau_fbcon_init()")
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_fbcon.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -557,7 +557,8 @@ nouveau_fbcon_init(struct drm_device *de
if (ret)
goto fini;
- fbcon->helper.fbdev->pixmap.buf_align = 4;
+ if (fbcon->helper.fbdev)
+ fbcon->helper.fbdev->pixmap.buf_align = 4;
return 0;
fini:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 121/203] drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (113 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 120/203] drm/nouveau: fix for disabled fbdev emulation Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 123/203] drm/i915/fbc: Disable on HSW by default for now Greg Kroah-Hartman
` (78 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit 217215041b9285af2193a755b56a8f3ed408bfe2 upstream.
Fixes a regression caused by a stupid thinko from "disp/sor/gf119: both
links use the same training register".
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
@@ -40,7 +40,8 @@ static int
gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
{
struct nvkm_device *device = outp->base.disp->engine.subdev.device;
- nvkm_mask(device, 0x61c110, 0x0f0f0f0f, 0x01010101 * pattern);
+ const u32 soff = gf119_sor_soff(outp);
+ nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, 0x01010101 * pattern);
return 0;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 123/203] drm/i915/fbc: Disable on HSW by default for now
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (114 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 121/203] drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 125/203] drm/i915: Update ifdeffery for mutex->owner Greg Kroah-Hartman
` (77 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paulo Zanoni, Lyude, Jani Nikula
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude <cpaul@redhat.com>
commit 1e3fa0acfec677e915d7de5ac6e1f18cfa4f805b upstream.
>From https://bugs.freedesktop.org/show_bug.cgi?id=96461 :
This was kind of a difficult bug to track down. If you're using a
Haswell system running GNOME and you have fbc completely enabled and
working, playing videos can result in video artifacts. Steps to
reproduce:
- Run GNOME
- Ensure FBC is enabled and active
- Download a movie, I used the ogg version of Big Buck Bunny for this
- Run `gst-launch-1.0 filesrc location='some_movie.ogg' ! decodebin !
glimagesink` in a terminal
- Watch for about over a minute, you'll see small horizontal lines go
down the screen.
For the time being, disable FBC for Haswell by default.
Stefan Richter reported kernel freezes (no video artifacts) when fbc
is on. (E3-1245 v3 with HD P4600; openbox and some KDE and LXDE
applications, thread begins at https://lkml.org/lkml/2016/4/26/813).
We also got reports from Steven Honeyman on openbox+roxterm.
v2 (From Paulo):
- Add extra information to the commit message
- Add Fixes tag
- Rebase
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96461
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96464
Fixes: a98ee79317b4 ("drm/i915/fbc: enable FBC by default on HSW and BDW")
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Lyude <cpaul@redhat.com>
Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1465487895-7401-1-git-send-email-cpaul@redhat.com
(cherry picked from commit c7f7e2feffb0294302041507dfd5fc15f01afccc)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_fbc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -823,8 +823,7 @@ static bool intel_fbc_can_choose(struct
{
struct drm_i915_private *dev_priv = crtc->base.dev->dev_private;
struct intel_fbc *fbc = &dev_priv->fbc;
- bool enable_by_default = IS_HASWELL(dev_priv) ||
- IS_BROADWELL(dev_priv);
+ bool enable_by_default = IS_BROADWELL(dev_priv);
if (intel_vgpu_active(dev_priv->dev)) {
fbc->no_fbc_reason = "VGPU is active";
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 125/203] drm/i915: Update ifdeffery for mutex->owner
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (115 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 123/203] drm/i915/fbc: Disable on HSW by default for now Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 126/203] drm: add missing drm_mode_set_crtcinfo call Greg Kroah-Hartman
` (76 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hong Liu, Chris Wilson, Matthew Auld,
Daniel Vetter
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit b19240062722c39fa92c99f04cbfd93034625123 upstream.
In commit 7608a43d8f2e ("locking/mutexes: Use MUTEX_SPIN_ON_OWNER when
appropriate") the owner field in the mutex was updated from being
dependent upon CONFIG_SMP to using optimistic spin. Update our peek
function to suite.
Fixes:7608a43d8f2e ("locking/mutexes: Use MUTEX_SPIN_ON_OWNER...")
Reported-by: Hong Liu <hong.liu@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: http://patchwork.freedesktop.org/patch/msgid/1468244777-4888-1-git-send-email-chris@chris-wilson.co.uk
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
(cherry picked from commit 4f074a5393431a7d2cc0de7fcfe2f61d24854628)
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_gem_shrinker.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -39,7 +39,7 @@ static bool mutex_is_locked_by(struct mu
if (!mutex_is_locked(mutex))
return false;
-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES)
+#if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_MUTEX_SPIN_ON_OWNER)
return mutex->owner == task;
#else
/* Since UP may be pre-empted, we cannot assume that we own the lock */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 126/203] drm: add missing drm_mode_set_crtcinfo call
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (116 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 125/203] drm/i915: Update ifdeffery for mutex->owner Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 127/203] drm: make drm_atomic_set_mode_prop_for_crtc() more reliable Greg Kroah-Hartman
` (75 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tomi Valkeinen, Daniel Vetter, Dave Airlie
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ti.com>
commit b201e743f42d143f4bcdcb14587caf7cb1d99229 upstream.
When setting mode via MODE_ID property,
drm_atomic_set_mode_prop_for_crtc() does not call
drm_mode_set_crtcinfo() which possibly causes:
"[drm:drm_calc_timestamping_constants [drm]] *ERROR* crtc 32: Can't
calculate constants, dotclock = 0!"
Whether the error is seen depends on the previous data in state->mode,
as state->mode is not cleared when setting new mode.
This patch adds drm_mode_set_crtcinfo() call to
drm_mode_convert_umode(), which is called in both legacy and atomic
paths. This should be fine as there's no reason to call
drm_mode_convert_umode() without also setting the crtc related fields.
drm_mode_set_crtcinfo() is removed from the legacy drm_mode_setcrtc() as
that is no longer needed.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_crtc.c | 2 --
drivers/gpu/drm/drm_modes.c | 2 ++
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2800,8 +2800,6 @@ int drm_mode_setcrtc(struct drm_device *
goto out;
}
- drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
-
/*
* Check whether the primary plane supports the fb pixel format.
* Drivers not implementing the universal planes API use a
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1518,6 +1518,8 @@ int drm_mode_convert_umode(struct drm_di
if (out->status != MODE_OK)
goto out;
+ drm_mode_set_crtcinfo(out, CRTC_INTERLACE_HALVE_V);
+
ret = 0;
out:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 127/203] drm: make drm_atomic_set_mode_prop_for_crtc() more reliable
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (117 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 126/203] drm: add missing drm_mode_set_crtcinfo call Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 128/203] drm: Wrap direct calls to driver->gem_free_object from CMA Greg Kroah-Hartman
` (74 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tomi Valkeinen, Daniel Vetter, Dave Airlie
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ti.com>
commit 6709887c448d1cff51b52d09763c7b834ea5f0be upstream.
drm_atomic_set_mode_prop_for_crtc() does not clear the state->mode, so
old data may be left there when a new mode is set, possibly causing odd
issues.
This patch improves the situation by always clearing the state->mode
first.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_atomic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -354,6 +354,8 @@ int drm_atomic_set_mode_prop_for_crtc(st
drm_property_unreference_blob(state->mode_blob);
state->mode_blob = NULL;
+ memset(&state->mode, 0, sizeof(state->mode));
+
if (blob) {
if (blob->length != sizeof(struct drm_mode_modeinfo) ||
drm_mode_convert_umode(&state->mode,
@@ -366,7 +368,6 @@ int drm_atomic_set_mode_prop_for_crtc(st
DRM_DEBUG_ATOMIC("Set [MODE:%s] for CRTC state %p\n",
state->mode.name, state);
} else {
- memset(&state->mode, 0, sizeof(state->mode));
state->enable = false;
DRM_DEBUG_ATOMIC("Set [NOMODE] for CRTC state %p\n",
state);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 128/203] drm: Wrap direct calls to driver->gem_free_object from CMA
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (118 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 127/203] drm: make drm_atomic_set_mode_prop_for_crtc() more reliable Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 129/203] drm/amd/powerplay: fix bug that function parameter was incorect Greg Kroah-Hartman
` (73 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robert Foss, Chris Wilson,
Daniel Vetter, Eric Anholt, Alex Deucher, Lucas Stach,
Daniel Vetter, Dave Airlie
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit afe705be38f1e65b173868486944377186b9f206 upstream.
Since the introduction of (struct_mutex) lockless GEM bo freeing, there
are a pair of driver vfuncs for freeing the GEM bo, of which the driver
may choose to only implement driver->gem_object_free_unlocked (and so
avoid taking the struct_mutex along the free path). However, the CMA GEM
helpers were still calling driver->gem_free_object directly, now NULL,
and promptly dying on the fancy new lockless drivers. Oops.
Robert Foss bisected this to b82caafcf2303 (drm/vc4: Use lockless gem BO
free callback) on his vc4 device, but that just serves as an enabler for
9f0ba539d13ae (drm/gem: support BO freeing without dev->struct_mutex).
Reported-by: Robert Foss <robert.foss@collabora.com>
Fixes: 9f0ba539d13ae (drm/gem: support BO freeing without dev->struct_mutex)
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Robert Foss <robert.foss@collabora.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: Alex Deucher <alexdeucher@gmail.com>
Cc: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Tested-by: Robert Foss <robert.foss@collabora.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_fb_cma_helper.c | 2 +-
drivers/gpu/drm/drm_gem_cma_helper.c | 12 +++---------
2 files changed, 4 insertions(+), 10 deletions(-)
--- a/drivers/gpu/drm/drm_fb_cma_helper.c
+++ b/drivers/gpu/drm/drm_fb_cma_helper.c
@@ -301,7 +301,7 @@ static int drm_fbdev_cma_create(struct d
err_fb_info_destroy:
drm_fb_helper_release_fbi(helper);
err_gem_free_object:
- dev->driver->gem_free_object(&obj->base);
+ drm_gem_object_unreference_unlocked(&obj->base);
return ret;
}
--- a/drivers/gpu/drm/drm_gem_cma_helper.c
+++ b/drivers/gpu/drm/drm_gem_cma_helper.c
@@ -121,7 +121,7 @@ struct drm_gem_cma_object *drm_gem_cma_c
return cma_obj;
error:
- drm->driver->gem_free_object(&cma_obj->base);
+ drm_gem_object_unreference_unlocked(&cma_obj->base);
return ERR_PTR(ret);
}
EXPORT_SYMBOL_GPL(drm_gem_cma_create);
@@ -162,18 +162,12 @@ drm_gem_cma_create_with_handle(struct dr
* and handle has the id what user can see.
*/
ret = drm_gem_handle_create(file_priv, gem_obj, handle);
- if (ret)
- goto err_handle_create;
-
/* drop reference from allocate - handle holds it now. */
drm_gem_object_unreference_unlocked(gem_obj);
+ if (ret)
+ return ERR_PTR(ret);
return cma_obj;
-
-err_handle_create:
- drm->driver->gem_free_object(gem_obj);
-
- return ERR_PTR(ret);
}
/**
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 129/203] drm/amd/powerplay: fix bug that function parameter was incorect.
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (119 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 128/203] drm: Wrap direct calls to driver->gem_free_object from CMA Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 130/203] drm/amd/powerplay: need to notify system bios pcie device ready Greg Kroah-Hartman
` (72 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rex Zhu, Alex Deucher, Ken Wang
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Zhu <Rex.Zhu@amd.com>
commit 576b4401b1971fe40be4cfd379430a61cd8426b2 upstream.
Wrong value passed to acpi_pcie_perf_request.
Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Ken Wang <Qingqing.Wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c
@@ -54,7 +54,7 @@ int acpi_pcie_perf_request(void *device,
ATCS_FUNCTION_PCIE_PERFORMANCE_REQUEST,
&atcs_input,
&atcs_output,
- 0,
+ 1,
sizeof(atcs_input),
sizeof(atcs_output));
if (result != 0)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 130/203] drm/amd/powerplay: need to notify system bios pcie device ready
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (120 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 129/203] drm/amd/powerplay: fix bug that function parameter was incorect Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 131/203] drm/amd/powerplay: fix logic error Greg Kroah-Hartman
` (71 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rex Zhu, Alex Deucher, Ken Wang
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Zhu <Rex.Zhu@amd.com>
commit 0a4fef559b69ae2e682c98f31d53a225fbda78bd upstream.
before request performance state.
Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Ken Wang <Qingqing.Wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c | 16 +++++++++++++++-
drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h | 1 +
2 files changed, 16 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c
@@ -21,6 +21,20 @@ bool acpi_atcs_functions_supported(void
return result == 0 ? (output_buf.function_bits & (1 << (index - 1))) != 0 : false;
}
+bool acpi_atcs_notify_pcie_device_ready(void *device)
+{
+ int32_t temp_buffer = 1;
+
+ return cgs_call_acpi_method(device, CGS_ACPI_METHOD_ATCS,
+ ATCS_FUNCTION_PCIE_DEVICE_READY_NOTIFICATION,
+ &temp_buffer,
+ NULL,
+ 0,
+ sizeof(temp_buffer),
+ 0);
+}
+
+
int acpi_pcie_perf_request(void *device, uint8_t perf_req, bool advertise)
{
struct atcs_pref_req_input atcs_input;
@@ -29,7 +43,7 @@ int acpi_pcie_perf_request(void *device,
int result;
struct cgs_system_info info = {0};
- if (!acpi_atcs_functions_supported(device, ATCS_FUNCTION_PCIE_PERFORMANCE_REQUEST))
+ if( 0 != acpi_atcs_notify_pcie_device_ready(device))
return -EINVAL;
info.size = sizeof(struct cgs_system_info);
--- a/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h
@@ -26,3 +26,4 @@ extern bool acpi_atcs_functions_supporte
extern int acpi_pcie_perf_request(void *device,
uint8_t perf_req,
bool advertise);
+extern bool acpi_atcs_notify_pcie_device_ready(void *device);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 131/203] drm/amd/powerplay: fix logic error.
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (121 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 130/203] drm/amd/powerplay: need to notify system bios pcie device ready Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 133/203] drm/amd/powerplay: fix incorrect voltage table value for tonga Greg Kroah-Hartman
` (70 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rex Zhu, Alex Deucher
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Zhu <Rex.Zhu@amd.com>
commit 1d7b84d12af8312b52316029f1fa0fa4eac3c9e4 upstream.
the error lead powerplay can't get display info in DGPU case.
store_cc6_data just implement in APU.
Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
@@ -306,10 +306,14 @@ int phm_store_dal_configuration_data(str
{
PHM_FUNC_CHECK(hwmgr);
- if (hwmgr->hwmgr_func->store_cc6_data == NULL)
+ if (display_config == NULL)
return -EINVAL;
hwmgr->display_config = *display_config;
+
+ if (hwmgr->hwmgr_func->store_cc6_data == NULL)
+ return -EINVAL;
+
/* to do pass other display configuration in furture */
if (hwmgr->hwmgr_func->store_cc6_data)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 133/203] drm/amd/powerplay: fix incorrect voltage table value for tonga
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (122 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 131/203] drm/amd/powerplay: fix logic error Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 134/203] drm: atmel-hlcdc: actually disable scaling when no scaling is required Greg Kroah-Hartman
` (69 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Huang Rui, Alex Deucher
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Rui <ray.huang@amd.com>
commit 1dfefee8939b07dd65a35bb78f6a06df85578301 upstream.
Signed-off-by: Huang Rui <ray.huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
@@ -1298,7 +1298,7 @@ static int tonga_populate_smc_mvdd_table
table->Smio[count] |=
data->mvdd_voltage_table.entries[count].smio_low;
}
- table->SmioMask2 = data->vddci_voltage_table.mask_low;
+ table->SmioMask2 = data->mvdd_voltage_table.mask_low;
CONVERT_FROM_HOST_TO_SMC_UL(table->MvddLevelCount);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 134/203] drm: atmel-hlcdc: actually disable scaling when no scaling is required
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (123 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 133/203] drm/amd/powerplay: fix incorrect voltage table value for tonga Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 135/203] drm/atomic: Make drm_atomic_legacy_backoff reset crtc->acquire_ctx Greg Kroah-Hartman
` (68 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Alex Vazquez, Nicolas Ferre
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <boris.brezillon@free-electrons.com>
commit 1b7e38b92b0bbd363369f5160f13f4d26140972d upstream.
The driver is only enabling scaling, but never disabling it, thus, if you
enable the scaling feature once it stays enabled forever.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reported-by: Alex Vazquez <avazquez.dev@gmail.com>
Reviewed-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Fixes: 1a396789f65a ("drm: add Atmel HLCDC Display Controller support")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -335,6 +335,8 @@ atmel_hlcdc_plane_update_pos_and_size(st
atmel_hlcdc_layer_update_cfg(&plane->layer, 13, 0xffffffff,
factor_reg);
+ } else {
+ atmel_hlcdc_layer_update_cfg(&plane->layer, 13, 0xffffffff, 0);
}
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 135/203] drm/atomic: Make drm_atomic_legacy_backoff reset crtc->acquire_ctx
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (124 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 134/203] drm: atmel-hlcdc: actually disable scaling when no scaling is required Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 136/203] drm/ttm: Make ttm_bo_mem_compat available Greg Kroah-Hartman
` (67 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maarten Lankhorst, Daniel Vetter,
Dave Airlie
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
commit 81e257e964268d050f8e9188becd44d50f241d72 upstream.
Atomic updates may acquire more state than initially locked through
drm_modeset_lock_crtc, running with heavy stress can cause a
WARN_ON(crtc->acquire_ctx) in drm_modeset_lock_crtc:
[ 601.491296] ------------[ cut here ]------------
[ 601.491366] WARNING: CPU: 0 PID: 2411 at
drivers/gpu/drm/drm_modeset_lock.c:191 drm_modeset_lock_crtc+0xeb/0xf0 [drm]
[ 601.491369] Modules linked in: drm i915 drm_kms_helper
[ 601.491414] CPU: 0 PID: 2411 Comm: kms_cursor_lega Tainted: G U 4.7.0-rc4-patser+ #4798
[ 601.491417] Hardware name: Intel Corporation Skylake Client
[ 601.491420] 0000000000000000 ffff88044d153c98 ffffffff812ead28 0000000000000000
[ 601.491425] 0000000000000000 ffff88044d153cd8 ffffffff810868e6 000000bf58058030
[ 601.491431] ffff880088b415e8 ffff880458058030 ffff88008a271548 ffff88008a271568
[ 601.491436] Call Trace:
[ 601.491443] [<ffffffff812ead28>] dump_stack+0x4d/0x65
[ 601.491447] [<ffffffff810868e6>] __warn+0xc6/0xe0
[ 601.491452] [<ffffffff81086968>] warn_slowpath_null+0x18/0x20
[ 601.491472] [<ffffffffc00d4ffb>] drm_modeset_lock_crtc+0xeb/0xf0 [drm]
[ 601.491491] [<ffffffffc00c5526>] drm_mode_cursor_common+0x66/0x180 [drm]
[ 601.491509] [<ffffffffc00c91cc>] drm_mode_cursor_ioctl+0x3c/0x40 [drm]
[ 601.491524] [<ffffffffc00bc94d>] drm_ioctl+0x14d/0x530 [drm]
[ 601.491540] [<ffffffffc00c9190>] ? drm_mode_setcrtc+0x520/0x520 [drm]
[ 601.491545] [<ffffffff81176aeb>] ? handle_mm_fault+0x106b/0x1430
[ 601.491550] [<ffffffff81108441>] ? stop_one_cpu+0x61/0x70
[ 601.491556] [<ffffffff811bb71d>] do_vfs_ioctl+0x8d/0x570
[ 601.491560] [<ffffffff81290d7e>] ? security_file_ioctl+0x3e/0x60
[ 601.491565] [<ffffffff811bbc74>] SyS_ioctl+0x74/0x80
[ 601.491571] [<ffffffff810e321c>] ? posix_get_monotonic_raw+0xc/0x10
[ 601.491576] [<ffffffff8175b11b>] entry_SYSCALL_64_fastpath+0x13/0x8f
[ 601.491581] ---[ end trace 56f3d3d85f000d00 ]---
For good measure, test mode_config.acquire_ctx too, although this should
never happen.
Testcase: kms_cursor_legacy
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_atomic.c | 27 ++++++++++++++++++++++++++-
1 file changed, 26 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -1288,14 +1288,39 @@ EXPORT_SYMBOL(drm_atomic_add_affected_pl
*/
void drm_atomic_legacy_backoff(struct drm_atomic_state *state)
{
+ struct drm_device *dev = state->dev;
+ unsigned crtc_mask = 0;
+ struct drm_crtc *crtc;
int ret;
+ bool global = false;
+
+ drm_for_each_crtc(crtc, dev) {
+ if (crtc->acquire_ctx != state->acquire_ctx)
+ continue;
+
+ crtc_mask |= drm_crtc_mask(crtc);
+ crtc->acquire_ctx = NULL;
+ }
+
+ if (WARN_ON(dev->mode_config.acquire_ctx == state->acquire_ctx)) {
+ global = true;
+
+ dev->mode_config.acquire_ctx = NULL;
+ }
retry:
drm_modeset_backoff(state->acquire_ctx);
- ret = drm_modeset_lock_all_ctx(state->dev, state->acquire_ctx);
+ ret = drm_modeset_lock_all_ctx(dev, state->acquire_ctx);
if (ret)
goto retry;
+
+ drm_for_each_crtc(crtc, dev)
+ if (drm_crtc_mask(crtc) & crtc_mask)
+ crtc->acquire_ctx = state->acquire_ctx;
+
+ if (global)
+ dev->mode_config.acquire_ctx = state->acquire_ctx;
}
EXPORT_SYMBOL(drm_atomic_legacy_backoff);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 136/203] drm/ttm: Make ttm_bo_mem_compat available
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (125 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 135/203] drm/atomic: Make drm_atomic_legacy_backoff reset crtc->acquire_ctx Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 137/203] drm/vmwgfx: Add an option to change assumed FB bpp Greg Kroah-Hartman
` (66 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sinclair Yeh, Thomas Hellstrom
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <syeh@vmware.com>
commit 94477bff390aa4612d2332c8abafaae0a13d6923 upstream.
There are cases where it is desired to see if a proposed placement
is compatible with a buffer object before calling ttm_bo_validate().
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ttm/ttm_bo.c | 7 ++++---
include/drm/ttm/ttm_bo_api.h | 14 ++++++++++++++
2 files changed, 18 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1016,9 +1016,9 @@ out_unlock:
return ret;
}
-static bool ttm_bo_mem_compat(struct ttm_placement *placement,
- struct ttm_mem_reg *mem,
- uint32_t *new_flags)
+bool ttm_bo_mem_compat(struct ttm_placement *placement,
+ struct ttm_mem_reg *mem,
+ uint32_t *new_flags)
{
int i;
@@ -1050,6 +1050,7 @@ static bool ttm_bo_mem_compat(struct ttm
return false;
}
+EXPORT_SYMBOL(ttm_bo_mem_compat);
int ttm_bo_validate(struct ttm_buffer_object *bo,
struct ttm_placement *placement,
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -316,6 +316,20 @@ ttm_bo_reference(struct ttm_buffer_objec
*/
extern int ttm_bo_wait(struct ttm_buffer_object *bo, bool lazy,
bool interruptible, bool no_wait);
+
+/**
+ * ttm_bo_mem_compat - Check if proposed placement is compatible with a bo
+ *
+ * @placement: Return immediately if buffer is busy.
+ * @mem: The struct ttm_mem_reg indicating the region where the bo resides
+ * @new_flags: Describes compatible placement found
+ *
+ * Returns true if the placement is compatible
+ */
+extern bool ttm_bo_mem_compat(struct ttm_placement *placement,
+ struct ttm_mem_reg *mem,
+ uint32_t *new_flags);
+
/**
* ttm_bo_validate
*
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 137/203] drm/vmwgfx: Add an option to change assumed FB bpp
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (126 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 136/203] drm/ttm: Make ttm_bo_mem_compat available Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 138/203] drm/vmwgfx: Work around mode set failure in 2D VMs Greg Kroah-Hartman
` (65 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sinclair Yeh, Thomas Hellstrom
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <syeh@vmware.com>
commit 04319d89fbec72dfd60738003c3813b97c1d5f5a upstream.
Offer an option for advanced users who want larger modes at 16bpp.
This becomes necessary after the fix: "Work around mode set
failure in 2D VMs." Without this patch, there would be no way
for existing advanced users to get to a high res mode, and the
regression is they will likely get a black screen after a software
update on their current VM.
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 5 +++++
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 1 +
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 3 +++
3 files changed, 9 insertions(+)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -227,6 +227,7 @@ static int vmw_force_iommu;
static int vmw_restrict_iommu;
static int vmw_force_coherent;
static int vmw_restrict_dma_mask;
+static int vmw_assume_16bpp;
static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
static void vmw_master_init(struct vmw_master *);
@@ -243,6 +244,8 @@ MODULE_PARM_DESC(force_coherent, "Force
module_param_named(force_coherent, vmw_force_coherent, int, 0600);
MODULE_PARM_DESC(restrict_dma_mask, "Restrict DMA mask to 44 bits with IOMMU");
module_param_named(restrict_dma_mask, vmw_restrict_dma_mask, int, 0600);
+MODULE_PARM_DESC(assume_16bpp, "Assume 16-bpp when filtering modes");
+module_param_named(assume_16bpp, vmw_assume_16bpp, int, 0600);
static void vmw_print_capabilities(uint32_t capabilities)
@@ -653,6 +656,8 @@ static int vmw_driver_load(struct drm_de
dev_priv->vram_start = pci_resource_start(dev->pdev, 1);
dev_priv->mmio_start = pci_resource_start(dev->pdev, 2);
+ dev_priv->assume_16bpp = !!vmw_assume_16bpp;
+
dev_priv->enable_fb = enable_fbdev;
vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -386,6 +386,7 @@ struct vmw_private {
spinlock_t hw_lock;
spinlock_t cap_lock;
bool has_dx;
+ bool assume_16bpp;
/*
* VGA registers.
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1562,6 +1562,9 @@ int vmw_du_connector_fill_modes(struct d
if (dev_priv->active_display_unit == vmw_du_screen_object)
assumed_bpp = 4;
+ if (dev_priv->assume_16bpp)
+ assumed_bpp = 2;
+
if (dev_priv->active_display_unit == vmw_du_screen_target) {
max_width = min(max_width, dev_priv->stdu_max_width);
max_height = min(max_height, dev_priv->stdu_max_height);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 138/203] drm/vmwgfx: Work around mode set failure in 2D VMs
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (127 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 137/203] drm/vmwgfx: Add an option to change assumed FB bpp Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 139/203] drm/vmwgfx: Check pin count before attempting to move a buffer Greg Kroah-Hartman
` (64 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sinclair Yeh, Thomas Hellstrom
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <syeh@vmware.com>
commit 7c20d213dd3cd6295bf9162730e7a368af957854 upstream.
In a low-memory 2D VM, fbdev can take up a large percentage of
available memory, making them unavailable for other DRM clients.
Since we do not take fbdev into account when filtering modes,
we end up claiming to support more modes than we actually do.
As a result, users get a black screen when setting a mode too
large for current available memory. In a low-memory VM
configuration, users can get a black screen for a mode as low
as 1024x768.
The current mode filtering mechanism keys off of
SVGA_REG_SUGGESTED_GBOBJECT_MEM_SIZE_KB, i.e. the maximum amount
of surface memory we have. Since this value is a performance
suggestion, not a hard limit, and since there should not be much
of a performance impact for a 2D VM, rather than filtering out
more modes, we will just allow ourselves to exceed the SVGA's
performance suggestion.
Also changed assumed bpp to 32 from 16 to make sure we can
actually support all the modes listed.
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 7 +++++++
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 9 +--------
2 files changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -704,6 +704,13 @@ static int vmw_driver_load(struct drm_de
vmw_read(dev_priv,
SVGA_REG_SUGGESTED_GBOBJECT_MEM_SIZE_KB);
+ /*
+ * Workaround for low memory 2D VMs to compensate for the
+ * allocation taken by fbdev
+ */
+ if (!(dev_priv->capabilities & SVGA_CAP_3D))
+ mem_size *= 2;
+
dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE;
dev_priv->prim_bb_mem =
vmw_read(dev_priv,
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1553,14 +1553,7 @@ int vmw_du_connector_fill_modes(struct d
DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
};
int i;
- u32 assumed_bpp = 2;
-
- /*
- * If using screen objects, then assume 32-bpp because that's what the
- * SVGA device is assuming
- */
- if (dev_priv->active_display_unit == vmw_du_screen_object)
- assumed_bpp = 4;
+ u32 assumed_bpp = 4;
if (dev_priv->assume_16bpp)
assumed_bpp = 2;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 139/203] drm/vmwgfx: Check pin count before attempting to move a buffer
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (128 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 138/203] drm/vmwgfx: Work around mode set failure in 2D VMs Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 140/203] drm/vmwgfx: Delay pinning fbdev framebuffer until after mode set Greg Kroah-Hartman
` (63 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sinclair Yeh, Thomas Hellstrom
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <syeh@vmware.com>
commit 4ed7e2242b637bc4af0416e4aa9f945db30fb44a upstream.
In certain scenarios, e.g. when fbdev is enabled, we can get into
a situation where a vmw_framebuffer_pin() is called on a buffer
that is already pinned.
When this happens, ttm_bo_validate() will unintentially remove the
TTM_PL_FLAG_NO_EVICT flag, thus unpinning it, and leaving no way
to actually pin the buffer again.
To prevent this, if a buffer is already pinned, then instead of
calling ttm_bo_validate(), just make sure the proposed placement is
compatible with the existing placement.
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c | 25 ++++++++++++++++++++++---
1 file changed, 22 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
@@ -49,6 +49,7 @@ int vmw_dmabuf_pin_in_placement(struct v
{
struct ttm_buffer_object *bo = &buf->base;
int ret;
+ uint32_t new_flags;
ret = ttm_write_lock(&dev_priv->reservation_sem, interruptible);
if (unlikely(ret != 0))
@@ -60,7 +61,12 @@ int vmw_dmabuf_pin_in_placement(struct v
if (unlikely(ret != 0))
goto err;
- ret = ttm_bo_validate(bo, placement, interruptible, false);
+ if (buf->pin_count > 0)
+ ret = ttm_bo_mem_compat(placement, &bo->mem,
+ &new_flags) == true ? 0 : -EINVAL;
+ else
+ ret = ttm_bo_validate(bo, placement, interruptible, false);
+
if (!ret)
vmw_bo_pin_reserved(buf, true);
@@ -91,6 +97,7 @@ int vmw_dmabuf_pin_in_vram_or_gmr(struct
{
struct ttm_buffer_object *bo = &buf->base;
int ret;
+ uint32_t new_flags;
ret = ttm_write_lock(&dev_priv->reservation_sem, interruptible);
if (unlikely(ret != 0))
@@ -102,6 +109,12 @@ int vmw_dmabuf_pin_in_vram_or_gmr(struct
if (unlikely(ret != 0))
goto err;
+ if (buf->pin_count > 0) {
+ ret = ttm_bo_mem_compat(&vmw_vram_gmr_placement, &bo->mem,
+ &new_flags) == true ? 0 : -EINVAL;
+ goto out_unreserve;
+ }
+
ret = ttm_bo_validate(bo, &vmw_vram_gmr_placement, interruptible,
false);
if (likely(ret == 0) || ret == -ERESTARTSYS)
@@ -161,6 +174,7 @@ int vmw_dmabuf_pin_in_start_of_vram(stru
struct ttm_placement placement;
struct ttm_place place;
int ret = 0;
+ uint32_t new_flags;
place = vmw_vram_placement.placement[0];
place.lpfn = bo->num_pages;
@@ -185,10 +199,15 @@ int vmw_dmabuf_pin_in_start_of_vram(stru
*/
if (bo->mem.mem_type == TTM_PL_VRAM &&
bo->mem.start < bo->num_pages &&
- bo->mem.start > 0)
+ bo->mem.start > 0 &&
+ buf->pin_count == 0)
(void) ttm_bo_validate(bo, &vmw_sys_placement, false, false);
- ret = ttm_bo_validate(bo, &placement, interruptible, false);
+ if (buf->pin_count > 0)
+ ret = ttm_bo_mem_compat(&placement, &bo->mem,
+ &new_flags) == true ? 0 : -EINVAL;
+ else
+ ret = ttm_bo_validate(bo, &placement, interruptible, false);
/* For some reason we didn't end up at the start of vram */
WARN_ON(ret == 0 && bo->offset != 0);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 140/203] drm/vmwgfx: Delay pinning fbdev framebuffer until after mode set
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (129 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 139/203] drm/vmwgfx: Check pin count before attempting to move a buffer Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 141/203] drm/vmwgfx: Fix corner case screen target management Greg Kroah-Hartman
` (62 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sinclair Yeh, Thomas Hellstrom
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <syeh@vmware.com>
commit d5f1a291e32309324a8c481ed84b5c118d1360ea upstream.
For the Screen Object display unit, we need to reserve a
guest-invisible region equal to the size of the framebuffer for
the host. This region can only be reserved in VRAM, whereas
the guest-visible framebuffer can be reserved in either VRAM or
GMR.
As such priority should be given to the guest-invisible
region otherwise in a limited VRAM situation, we can fail to
allocate this region.
This patch makes it so that vmw_sou_backing_alloc() is called
before the framebuffer is pinned.
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 47 +++++++++++++++++++------------------
1 file changed, 25 insertions(+), 22 deletions(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -517,28 +517,6 @@ static int vmw_fb_kms_framebuffer(struct
par->set_fb = &vfb->base;
- if (!par->bo_ptr) {
- /*
- * Pin before mapping. Since we don't know in what placement
- * to pin, call into KMS to do it for us.
- */
- ret = vfb->pin(vfb);
- if (ret) {
- DRM_ERROR("Could not pin the fbdev framebuffer.\n");
- return ret;
- }
-
- ret = ttm_bo_kmap(&par->vmw_bo->base, 0,
- par->vmw_bo->base.num_pages, &par->map);
- if (ret) {
- vfb->unpin(vfb);
- DRM_ERROR("Could not map the fbdev framebuffer.\n");
- return ret;
- }
-
- par->bo_ptr = ttm_kmap_obj_virtual(&par->map, &par->bo_iowrite);
- }
-
return 0;
}
@@ -601,6 +579,31 @@ static int vmw_fb_set_par(struct fb_info
if (ret)
goto out_unlock;
+ if (!par->bo_ptr) {
+ struct vmw_framebuffer *vfb = vmw_framebuffer_to_vfb(set.fb);
+
+ /*
+ * Pin before mapping. Since we don't know in what placement
+ * to pin, call into KMS to do it for us.
+ */
+ ret = vfb->pin(vfb);
+ if (ret) {
+ DRM_ERROR("Could not pin the fbdev framebuffer.\n");
+ return ret;
+ }
+
+ ret = ttm_bo_kmap(&par->vmw_bo->base, 0,
+ par->vmw_bo->base.num_pages, &par->map);
+ if (ret) {
+ vfb->unpin(vfb);
+ DRM_ERROR("Could not map the fbdev framebuffer.\n");
+ return ret;
+ }
+
+ par->bo_ptr = ttm_kmap_obj_virtual(&par->map, &par->bo_iowrite);
+ }
+
+
vmw_fb_dirty_mark(par, par->fb_x, par->fb_y,
par->set_fb->width, par->set_fb->height);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 141/203] drm/vmwgfx: Fix corner case screen target management
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (130 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 140/203] drm/vmwgfx: Delay pinning fbdev framebuffer until after mode set Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 142/203] drm/vmwgfx: Fix error paths when mapping framebuffer Greg Kroah-Hartman
` (61 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Hellstrom, Sinclair Yeh
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <thellstrom@vmware.com>
commit beca4cf55323147ca9c8a98de1871be6e4fe8f34 upstream.
When the surface backing a framebuffer doesn't match the framebuffer's
dimensions, the screen target code would test the framebuffer dimensions
rather than the surface dimensions when deciding whether to bind the
surface as a screen target directly. This causes a screen target -
surface dimension mismatch and a subsequent device error.
Fix this by testing against the surface dimension.
v2: Fix review comments by Sinclair Yeh.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -399,8 +399,10 @@ static int vmw_stdu_bind_fb(struct vmw_p
WARN_ON_ONCE(!stdu->defined);
- if (!vfb->dmabuf && new_fb->width == mode->hdisplay &&
- new_fb->height == mode->vdisplay)
+ new_vfbs = (vfb->dmabuf) ? NULL : vmw_framebuffer_to_vfbs(new_fb);
+
+ if (new_vfbs && new_vfbs->surface->base_size.width == mode->hdisplay &&
+ new_vfbs->surface->base_size.height == mode->vdisplay)
new_content_type = SAME_AS_DISPLAY;
else if (vfb->dmabuf)
new_content_type = SEPARATE_DMA;
@@ -444,7 +446,6 @@ static int vmw_stdu_bind_fb(struct vmw_p
content_srf.mip_levels[0] = 1;
content_srf.multisample_count = 0;
} else {
- new_vfbs = vmw_framebuffer_to_vfbs(new_fb);
content_srf = *new_vfbs->surface;
}
@@ -464,7 +465,6 @@ static int vmw_stdu_bind_fb(struct vmw_p
return ret;
}
} else if (new_content_type == SAME_AS_DISPLAY) {
- new_vfbs = vmw_framebuffer_to_vfbs(new_fb);
new_display_srf = vmw_surface_reference(new_vfbs->surface);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 142/203] drm/vmwgfx: Fix error paths when mapping framebuffer
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (131 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 141/203] drm/vmwgfx: Fix corner case screen target management Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:55 ` [PATCH 4.6 143/203] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing Greg Kroah-Hartman
` (60 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sinclair Yeh, Charmaine Lee, Emil Velikov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <syeh@vmware.com>
commit 58541f7a6458e17ab417321b284f0090f530aa91 upstream.
Rather than returning immediately, make sure to unlock the
mutexes first.
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Charmaine Lee <charmainel@vmware.com>
Reported-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -589,7 +589,7 @@ static int vmw_fb_set_par(struct fb_info
ret = vfb->pin(vfb);
if (ret) {
DRM_ERROR("Could not pin the fbdev framebuffer.\n");
- return ret;
+ goto out_unlock;
}
ret = ttm_bo_kmap(&par->vmw_bo->base, 0,
@@ -597,7 +597,7 @@ static int vmw_fb_set_par(struct fb_info
if (ret) {
vfb->unpin(vfb);
DRM_ERROR("Could not map the fbdev framebuffer.\n");
- return ret;
+ goto out_unlock;
}
par->bo_ptr = ttm_kmap_obj_virtual(&par->map, &par->bo_iowrite);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 143/203] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (132 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 142/203] drm/vmwgfx: Fix error paths when mapping framebuffer Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-26 6:17 ` SebastienOcquidant
2016-07-25 20:55 ` [PATCH 4.6 144/203] PCI: Fix unaligned accesses in VC code Greg Kroah-Hartman
` (59 subsequent siblings)
193 siblings, 1 reply; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ocquidant, Sebastien, Roger Quadros
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ocquidant, Sebastien <sebastienocquidant@eaton.com>
commit 8f50b8e57442d28e41bb736c173d8a2490549a82 upstream.
In the omap gpmc driver it can be noticed that GPMC_CONFIG4_OEEXTRADELAY
is overwritten by the WEEXTRADELAY value from the device tree and
GPMC_CONFIG4_WEEXTRADELAY is not updated by the value from the device
tree.
As a consequence, the memory accesses cannot be configured properly when
the extra delay are needed for OE and WE.
Fix the update of GPMC_CONFIG4_WEEXTRADELAY with the value from the
device tree file and prevents GPMC_CONFIG4_OEXTRADELAY
being overwritten by the WEXTRADELAY value from the device tree.
Signed-off-by: Ocquidant, Sebastien <sebastienocquidant@eaton.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/memory/omap-gpmc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -394,7 +394,7 @@ static void gpmc_cs_bool_timings(int cs,
gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG4,
GPMC_CONFIG4_OEEXTRADELAY, p->oe_extra_delay);
gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG4,
- GPMC_CONFIG4_OEEXTRADELAY, p->we_extra_delay);
+ GPMC_CONFIG4_WEEXTRADELAY, p->we_extra_delay);
gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG6,
GPMC_CONFIG6_CYCLE2CYCLESAMECSEN,
p->cycle2cyclesamecsen);
^ permalink raw reply [flat|nested] 199+ messages in thread* RE: [PATCH 4.6 143/203] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
2016-07-25 20:55 ` [PATCH 4.6 143/203] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing Greg Kroah-Hartman
@ 2016-07-26 6:17 ` SebastienOcquidant
0 siblings, 0 replies; 199+ messages in thread
From: SebastienOcquidant @ 2016-07-26 6:17 UTC (permalink / raw)
To: gregkh, linux-kernel; +Cc: stable, rogerq
-----------------------------
Eaton Industries (France) S.A.S ~ Siège social: 110 Rue Blaise Pascal, Immeuble Le Viséo - Bâtiment A Innovallée, 38330, Montbonnot-St.-Martin, France ~ Lieu d'enregistrement au registre du commerce: Grenoble ~ Numéro d'enregistrement: 509 653 176 ~ Capital social souscrit et liberé:€ 16215441 ~ Numéro de TVA: FR47509653176\r
-----------------------------
-----Message d'origine-----
De : Greg Kroah-Hartman [mailto:gregkh@linuxfoundation.org]
Envoyé : lundi 25 juillet 2016 22:56
À : linux-kernel@vger.kernel.org
Cc : Greg Kroah-Hartman; stable@vger.kernel.org; Ocquidant, Sebastien; Roger Quadros
Objet : [PATCH 4.6 143/203] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ocquidant, Sebastien <sebastienocquidant@eaton.com>
commit 8f50b8e57442d28e41bb736c173d8a2490549a82 upstream.
In the omap gpmc driver it can be noticed that GPMC_CONFIG4_OEEXTRADELAY is overwritten by the WEEXTRADELAY value from the device tree and GPMC_CONFIG4_WEEXTRADELAY is not updated by the value from the device tree.
As a consequence, the memory accesses cannot be configured properly when the extra delay are needed for OE and WE.
Fix the update of GPMC_CONFIG4_WEEXTRADELAY with the value from the device tree file and prevents GPMC_CONFIG4_OEXTRADELAY being overwritten by the WEXTRADELAY value from the device tree.
Signed-off-by: Ocquidant, Sebastien <sebastienocquidant@eaton.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/memory/omap-gpmc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -394,7 +394,7 @@ static void gpmc_cs_bool_timings(int cs,
gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG4,
GPMC_CONFIG4_OEEXTRADELAY, p->oe_extra_delay);
gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG4,
- GPMC_CONFIG4_OEEXTRADELAY, p->we_extra_delay);
+ GPMC_CONFIG4_WEEXTRADELAY, p->we_extra_delay);
gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG6,
GPMC_CONFIG6_CYCLE2CYCLESAMECSEN,
p->cycle2cyclesamecsen);
========================================================================================
Hi Greg,
OK for me
Sébastien Ocquidant
^ permalink raw reply [flat|nested] 199+ messages in thread
* [PATCH 4.6 144/203] PCI: Fix unaligned accesses in VC code
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (133 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 143/203] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing Greg Kroah-Hartman
@ 2016-07-25 20:55 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 145/203] xen/balloon: Fix declared-but-not-defined warning Greg Kroah-Hartman
` (58 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Meelis Roos, Anatoly Pugachev,
David S. Miller, Bjorn Helgaas
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Miller <davem@davemloft.net>
commit ef0dab4aae14e25efddf1577736f8450132800c5 upstream.
The save/restore buffers for VC state is first composed of a 2-byte control
register, then a bunch of 4-byte words.
This causes unaligned accesses which trap on platform such as sparc.
This is easy to fix by simply moving the buffer pointer forward by 4 bytes
instead of 2 after dealing with the control register. The length
adjustment needs to be changed likewise as well.
Fixes: 5f8fc43217a0 ("PCI: Include pci/pcie/Kconfig directly from pci/Kconfig")
Reported-by: Meelis Roos <mroos@linux.ee>
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/vc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pci/vc.c
+++ b/drivers/pci/vc.c
@@ -221,9 +221,9 @@ static int pci_vc_do_save_buffer(struct
else
pci_write_config_word(dev, pos + PCI_VC_PORT_CTRL,
*(u16 *)buf);
- buf += 2;
+ buf += 4;
}
- len += 2;
+ len += 4;
/*
* If we have any Low Priority VCs and a VC Arbitration Table Offset
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 145/203] xen/balloon: Fix declared-but-not-defined warning
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (134 preceding siblings ...)
2016-07-25 20:55 ` [PATCH 4.6 144/203] PCI: Fix unaligned accesses in VC code Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 146/203] iio: Fix error handling in iio_trigger_attach_poll_func Greg Kroah-Hartman
` (57 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ross Lagerwall, Juergen Gross,
David Vrabel, Arnd Bergmann
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Lagerwall <ross.lagerwall@citrix.com>
commit 842775f1509054ea969f1787f38d6a0ec2ccfaba upstream.
Fix a declared-but-not-defined warning when building with
XEN_BALLOON_MEMORY_HOTPLUG=n. This fixes a regression introduced by
commit dfd74a1edfab ("xen/balloon: Fix crash when ballooning on x86 32
bit PAE").
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Acked-by: Juergen Gross <jgross@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/balloon.c | 28 +++++++++++++---------------
1 file changed, 13 insertions(+), 15 deletions(-)
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -151,8 +151,6 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_w
static void balloon_process(struct work_struct *work);
static DECLARE_DELAYED_WORK(balloon_worker, balloon_process);
-static void release_memory_resource(struct resource *resource);
-
/* When ballooning out (allocating memory to return to Xen) we don't really
want the kernel to try too hard since that can trigger the oom killer. */
#define GFP_BALLOON \
@@ -248,6 +246,19 @@ static enum bp_state update_schedule(enu
}
#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+static void release_memory_resource(struct resource *resource)
+{
+ if (!resource)
+ return;
+
+ /*
+ * No need to reset region to identity mapped since we now
+ * know that no I/O can be in this region
+ */
+ release_resource(resource);
+ kfree(resource);
+}
+
static struct resource *additional_memory_resource(phys_addr_t size)
{
struct resource *res;
@@ -286,19 +297,6 @@ static struct resource *additional_memor
return res;
}
-static void release_memory_resource(struct resource *resource)
-{
- if (!resource)
- return;
-
- /*
- * No need to reset region to identity mapped since we now
- * know that no I/O can be in this region
- */
- release_resource(resource);
- kfree(resource);
-}
-
static enum bp_state reserve_additional_memory(void)
{
long credit;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 146/203] iio: Fix error handling in iio_trigger_attach_poll_func
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (135 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 145/203] xen/balloon: Fix declared-but-not-defined warning Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 147/203] iio:st_pressure: fix sampling gains (bring inline with ABI) Greg Kroah-Hartman
` (56 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Crestez Dan Leonard, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Crestez Dan Leonard <leonard.crestez@intel.com>
commit 99543823357966ac938d9a310947e731b67338e6 upstream.
When attaching a pollfunc iio_trigger_attach_poll_func will allocate a
virtual irq and call the driver's set_trigger_state function. Fix error
handling to undo previous steps if any fails.
In particular this fixes handling errors from a driver's
set_trigger_state function. When using triggered buffers a failure to
enable the trigger used to make the buffer unusable.
Signed-off-by: Crestez Dan Leonard <leonard.crestez@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-trigger.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -210,22 +210,35 @@ static int iio_trigger_attach_poll_func(
/* Prevent the module from being removed whilst attached to a trigger */
__module_get(pf->indio_dev->info->driver_module);
+
+ /* Get irq number */
pf->irq = iio_trigger_get_irq(trig);
+ if (pf->irq < 0)
+ goto out_put_module;
+
+ /* Request irq */
ret = request_threaded_irq(pf->irq, pf->h, pf->thread,
pf->type, pf->name,
pf);
- if (ret < 0) {
- module_put(pf->indio_dev->info->driver_module);
- return ret;
- }
+ if (ret < 0)
+ goto out_put_irq;
+ /* Enable trigger in driver */
if (trig->ops && trig->ops->set_trigger_state && notinuse) {
ret = trig->ops->set_trigger_state(trig, true);
if (ret < 0)
- module_put(pf->indio_dev->info->driver_module);
+ goto out_free_irq;
}
return ret;
+
+out_free_irq:
+ free_irq(pf->irq, pf);
+out_put_irq:
+ iio_trigger_put_irq(trig, pf->irq);
+out_put_module:
+ module_put(pf->indio_dev->info->driver_module);
+ return ret;
}
static int iio_trigger_detach_poll_func(struct iio_trigger *trig,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 147/203] iio:st_pressure: fix sampling gains (bring inline with ABI)
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (136 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 146/203] iio: Fix error handling in iio_trigger_attach_poll_func Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 148/203] iio: light apds9960: Add the missing dev.parent Greg Kroah-Hartman
` (55 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Gregor Boirie, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregor Boirie <gregor.boirie@parrot.com>
commit d43a41152f8e9e4c0d19850884d1fada076dee10 upstream.
Temperature channels report scaled samples in Celsius although expected as
milli degree Celsius in Documentation/ABI/testing/sysfs-bus-iio.
Gains are not implemented at all for LPS001WP pressure and temperature
channels.
This patch ensures that proper offsets and scales are exposed to userpace
for both pressure and temperature channels.
Also fix a NULL pointer exception when userspace reads content of sysfs
scale attribute when gains are not defined.
Signed-off-by: Gregor Boirie <gregor.boirie@parrot.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/st_pressure_core.c | 80 ++++++++++++++++++++------------
1 file changed, 50 insertions(+), 30 deletions(-)
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -28,15 +28,21 @@
#include <linux/iio/common/st_sensors.h>
#include "st_pressure.h"
+#define MCELSIUS_PER_CELSIUS 1000
+
+/* Default pressure sensitivity */
#define ST_PRESS_LSB_PER_MBAR 4096UL
#define ST_PRESS_KPASCAL_NANO_SCALE (100000000UL / \
ST_PRESS_LSB_PER_MBAR)
+
+/* Default temperature sensitivity */
#define ST_PRESS_LSB_PER_CELSIUS 480UL
-#define ST_PRESS_CELSIUS_NANO_SCALE (1000000000UL / \
- ST_PRESS_LSB_PER_CELSIUS)
+#define ST_PRESS_MILLI_CELSIUS_OFFSET 42500UL
+
#define ST_PRESS_NUMBER_DATA_CHANNELS 1
/* FULLSCALE */
+#define ST_PRESS_FS_AVL_1100MB 1100
#define ST_PRESS_FS_AVL_1260MB 1260
#define ST_PRESS_1_OUT_XL_ADDR 0x28
@@ -54,9 +60,6 @@
#define ST_PRESS_LPS331AP_PW_MASK 0x80
#define ST_PRESS_LPS331AP_FS_ADDR 0x23
#define ST_PRESS_LPS331AP_FS_MASK 0x30
-#define ST_PRESS_LPS331AP_FS_AVL_1260_VAL 0x00
-#define ST_PRESS_LPS331AP_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE
-#define ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE
#define ST_PRESS_LPS331AP_BDU_ADDR 0x20
#define ST_PRESS_LPS331AP_BDU_MASK 0x04
#define ST_PRESS_LPS331AP_DRDY_IRQ_ADDR 0x22
@@ -65,9 +68,14 @@
#define ST_PRESS_LPS331AP_IHL_IRQ_ADDR 0x22
#define ST_PRESS_LPS331AP_IHL_IRQ_MASK 0x80
#define ST_PRESS_LPS331AP_MULTIREAD_BIT true
-#define ST_PRESS_LPS331AP_TEMP_OFFSET 42500
/* CUSTOM VALUES FOR LPS001WP SENSOR */
+
+/* LPS001WP pressure resolution */
+#define ST_PRESS_LPS001WP_LSB_PER_MBAR 16UL
+/* LPS001WP temperature resolution */
+#define ST_PRESS_LPS001WP_LSB_PER_CELSIUS 64UL
+
#define ST_PRESS_LPS001WP_WAI_EXP 0xba
#define ST_PRESS_LPS001WP_ODR_ADDR 0x20
#define ST_PRESS_LPS001WP_ODR_MASK 0x30
@@ -76,6 +84,8 @@
#define ST_PRESS_LPS001WP_ODR_AVL_13HZ_VAL 0x03
#define ST_PRESS_LPS001WP_PW_ADDR 0x20
#define ST_PRESS_LPS001WP_PW_MASK 0x40
+#define ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN \
+ (100000000UL / ST_PRESS_LPS001WP_LSB_PER_MBAR)
#define ST_PRESS_LPS001WP_BDU_ADDR 0x20
#define ST_PRESS_LPS001WP_BDU_MASK 0x04
#define ST_PRESS_LPS001WP_MULTIREAD_BIT true
@@ -92,11 +102,6 @@
#define ST_PRESS_LPS25H_ODR_AVL_25HZ_VAL 0x04
#define ST_PRESS_LPS25H_PW_ADDR 0x20
#define ST_PRESS_LPS25H_PW_MASK 0x80
-#define ST_PRESS_LPS25H_FS_ADDR 0x00
-#define ST_PRESS_LPS25H_FS_MASK 0x00
-#define ST_PRESS_LPS25H_FS_AVL_1260_VAL 0x00
-#define ST_PRESS_LPS25H_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE
-#define ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE
#define ST_PRESS_LPS25H_BDU_ADDR 0x20
#define ST_PRESS_LPS25H_BDU_MASK 0x04
#define ST_PRESS_LPS25H_DRDY_IRQ_ADDR 0x23
@@ -105,7 +110,6 @@
#define ST_PRESS_LPS25H_IHL_IRQ_ADDR 0x22
#define ST_PRESS_LPS25H_IHL_IRQ_MASK 0x80
#define ST_PRESS_LPS25H_MULTIREAD_BIT true
-#define ST_PRESS_LPS25H_TEMP_OFFSET 42500
#define ST_PRESS_LPS25H_OUT_XL_ADDR 0x28
#define ST_TEMP_LPS25H_OUT_L_ADDR 0x2b
@@ -157,7 +161,9 @@ static const struct iio_chan_spec st_pre
.storagebits = 16,
.endianness = IIO_LE,
},
- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
+ .info_mask_separate =
+ BIT(IIO_CHAN_INFO_RAW) |
+ BIT(IIO_CHAN_INFO_SCALE),
.modified = 0,
},
{
@@ -173,7 +179,7 @@ static const struct iio_chan_spec st_pre
},
.info_mask_separate =
BIT(IIO_CHAN_INFO_RAW) |
- BIT(IIO_CHAN_INFO_OFFSET),
+ BIT(IIO_CHAN_INFO_SCALE),
.modified = 0,
},
IIO_CHAN_SOFT_TIMESTAMP(1)
@@ -208,11 +214,14 @@ static const struct st_sensor_settings s
.addr = ST_PRESS_LPS331AP_FS_ADDR,
.mask = ST_PRESS_LPS331AP_FS_MASK,
.fs_avl = {
+ /*
+ * Pressure and temperature sensitivity values
+ * as defined in table 3 of LPS331AP datasheet.
+ */
[0] = {
.num = ST_PRESS_FS_AVL_1260MB,
- .value = ST_PRESS_LPS331AP_FS_AVL_1260_VAL,
- .gain = ST_PRESS_LPS331AP_FS_AVL_1260_GAIN,
- .gain2 = ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN,
+ .gain = ST_PRESS_KPASCAL_NANO_SCALE,
+ .gain2 = ST_PRESS_LSB_PER_CELSIUS,
},
},
},
@@ -254,7 +263,17 @@ static const struct st_sensor_settings s
.value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE,
},
.fs = {
- .addr = 0,
+ .fs_avl = {
+ /*
+ * Pressure and temperature resolution values
+ * as defined in table 3 of LPS001WP datasheet.
+ */
+ [0] = {
+ .num = ST_PRESS_FS_AVL_1100MB,
+ .gain = ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN,
+ .gain2 = ST_PRESS_LPS001WP_LSB_PER_CELSIUS,
+ },
+ },
},
.bdu = {
.addr = ST_PRESS_LPS001WP_BDU_ADDR,
@@ -291,14 +310,15 @@ static const struct st_sensor_settings s
.value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE,
},
.fs = {
- .addr = ST_PRESS_LPS25H_FS_ADDR,
- .mask = ST_PRESS_LPS25H_FS_MASK,
.fs_avl = {
+ /*
+ * Pressure and temperature sensitivity values
+ * as defined in table 3 of LPS25H datasheet.
+ */
[0] = {
.num = ST_PRESS_FS_AVL_1260MB,
- .value = ST_PRESS_LPS25H_FS_AVL_1260_VAL,
- .gain = ST_PRESS_LPS25H_FS_AVL_1260_GAIN,
- .gain2 = ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN,
+ .gain = ST_PRESS_KPASCAL_NANO_SCALE,
+ .gain2 = ST_PRESS_LSB_PER_CELSIUS,
},
},
},
@@ -354,26 +374,26 @@ static int st_press_read_raw(struct iio_
return IIO_VAL_INT;
case IIO_CHAN_INFO_SCALE:
- *val = 0;
-
switch (ch->type) {
case IIO_PRESSURE:
+ *val = 0;
*val2 = press_data->current_fullscale->gain;
- break;
+ return IIO_VAL_INT_PLUS_NANO;
case IIO_TEMP:
+ *val = MCELSIUS_PER_CELSIUS;
*val2 = press_data->current_fullscale->gain2;
- break;
+ return IIO_VAL_FRACTIONAL;
default:
err = -EINVAL;
goto read_error;
}
- return IIO_VAL_INT_PLUS_NANO;
case IIO_CHAN_INFO_OFFSET:
switch (ch->type) {
case IIO_TEMP:
- *val = 425;
- *val2 = 10;
+ *val = ST_PRESS_MILLI_CELSIUS_OFFSET *
+ press_data->current_fullscale->gain2;
+ *val2 = MCELSIUS_PER_CELSIUS;
break;
default:
err = -EINVAL;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 148/203] iio: light apds9960: Add the missing dev.parent
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (137 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 147/203] iio:st_pressure: fix sampling gains (bring inline with ABI) Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 149/203] iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output Greg Kroah-Hartman
` (54 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yong Li, Matt Ranostay, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yong Li <sdliyong@gmail.com>
commit 590b92a30242dd3f73de3d9a51d9924f1ab33e93 upstream.
Without this, the iio:deviceX is missing in the /sys/bus/i2c/devices/0-0039
Some userspace tools use this path to identify a specific instance of the
device.
Signed-off-by: Yong Li <sdliyong@gmail.com>
Reviewed-By: Matt Ranostay <mranostay@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/apds9960.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/iio/light/apds9960.c
+++ b/drivers/iio/light/apds9960.c
@@ -1006,6 +1006,7 @@ static int apds9960_probe(struct i2c_cli
iio_device_attach_buffer(indio_dev, buffer);
+ indio_dev->dev.parent = &client->dev;
indio_dev->info = &apds9960_info;
indio_dev->name = APDS9960_DRV_NAME;
indio_dev->channels = apds9960_channels;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 149/203] iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (138 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 148/203] iio: light apds9960: Add the missing dev.parent Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 150/203] iio: proximity: as3935: remove triggered buffer processing Greg Kroah-Hartman
` (53 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Matt Ranostay, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <mranostay@gmail.com>
commit 5138806f16c74c7cb8ac3e408a859c79eb7c9567 upstream.
IIO_CHAN_INFO_RAW was returning processed data which was incorrect.
This also adds the IIO_CHAN_INFO_SCALE value to convert to a processed value.
Signed-off-by: Matt Ranostay <mranostay@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 | 2 +-
drivers/iio/proximity/as3935.c | 10 ++++++++--
2 files changed, 9 insertions(+), 3 deletions(-)
--- a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
+++ b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
@@ -1,4 +1,4 @@
-What /sys/bus/iio/devices/iio:deviceX/in_proximity_raw
+What /sys/bus/iio/devices/iio:deviceX/in_proximity_input
Date: March 2014
KernelVersion: 3.15
Contact: Matt Ranostay <mranostay@gmail.com>
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -72,7 +72,8 @@ static const struct iio_chan_spec as3935
.type = IIO_PROXIMITY,
.info_mask_separate =
BIT(IIO_CHAN_INFO_RAW) |
- BIT(IIO_CHAN_INFO_PROCESSED),
+ BIT(IIO_CHAN_INFO_PROCESSED) |
+ BIT(IIO_CHAN_INFO_SCALE),
.scan_index = 0,
.scan_type = {
.sign = 'u',
@@ -181,7 +182,12 @@ static int as3935_read_raw(struct iio_de
/* storm out of range */
if (*val == AS3935_DATA_MASK)
return -EINVAL;
- *val *= 1000;
+
+ if (m == IIO_CHAN_INFO_PROCESSED)
+ *val *= 1000;
+ break;
+ case IIO_CHAN_INFO_SCALE:
+ *val = 1000;
break;
default:
return -EINVAL;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 150/203] iio: proximity: as3935: remove triggered buffer processing
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (139 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 149/203] iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 151/203] iio: proximity: as3935: fix buffer stack trashing Greg Kroah-Hartman
` (52 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, george.mccollister, Matt Ranostay,
Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <mranostay@gmail.com>
commit 7d0643634ea567969bf3f3ed6193a9d6fc75653b upstream.
Triggered buffers shouldn't return processed data, and the respective
conversion was overflowing the defined .realbits for the channel.
Cc: george.mccollister@gmail.com
Signed-off-by: Matt Ranostay <mranostay@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/proximity/as3935.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -213,7 +213,6 @@ static irqreturn_t as3935_trigger_handle
if (ret)
goto err_read;
val &= AS3935_DATA_MASK;
- val *= 1000;
iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp);
err_read:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 151/203] iio: proximity: as3935: fix buffer stack trashing
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (140 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 150/203] iio: proximity: as3935: remove triggered buffer processing Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 152/203] iio: humidity: hdc100x: correct humidity integration time mask Greg Kroah-Hartman
` (51 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, george.mccollister, Matt Ranostay,
Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <mranostay@gmail.com>
commit 37b1ba2c68cfbe37f5f45bb91bcfaf2b016ae6a1 upstream.
Buffer wasn't of a valid size to allow the timestamp, and correct padding.
This patchset also moves the buffer off the stack, and onto the heap.
Cc: george.mccollister@gmail.com
Signed-off-by: Matt Ranostay <mranostay@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/proximity/as3935.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -64,6 +64,7 @@ struct as3935_state {
struct delayed_work work;
u32 tune_cap;
+ u8 buffer[16]; /* 8-bit data + 56-bit padding + 64-bit timestamp */
u8 buf[2] ____cacheline_aligned;
};
@@ -212,9 +213,10 @@ static irqreturn_t as3935_trigger_handle
ret = as3935_read(st, AS3935_DATA, &val);
if (ret)
goto err_read;
- val &= AS3935_DATA_MASK;
- iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp);
+ st->buffer[0] = val & AS3935_DATA_MASK;
+ iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
+ pf->timestamp);
err_read:
iio_trigger_notify_done(indio_dev->trig);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 152/203] iio: humidity: hdc100x: correct humidity integration time mask
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (141 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 151/203] iio: proximity: as3935: fix buffer stack trashing Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 153/203] iio: humidity: hdc100x: fix IIO_TEMP channel reporting Greg Kroah-Hartman
` (50 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alison Schofield, Daniel Baluta,
Matt Ranostay, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <amsfield22@gmail.com>
commit 0e35cf5ce00d873d6e529d2b2cd7598d52438051 upstream.
Apply the correct mask to enable all available humidity integration
times. Currently, the driver defaults to 6500 and all is okay with that.
However, if 3850 is selected we get a stuck bit and can't change back
to 6500 or select 2500. (Verified with HDC1008)
Signed-off-by: Alison Schofield <amsfield22@gmail.com>
Cc: Daniel Baluta <daniel.baluta@gmail.com>
Reviewed-by: Matt Ranostay <mranostay@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/humidity/hdc100x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -55,7 +55,7 @@ static const struct {
},
{ /* IIO_HUMIDITYRELATIVE channel */
.shift = 8,
- .mask = 2,
+ .mask = 3,
},
};
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 153/203] iio: humidity: hdc100x: fix IIO_TEMP channel reporting
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (142 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 152/203] iio: humidity: hdc100x: correct humidity integration time mask Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 154/203] iio: hudmidity: hdc100x: fix incorrect shifting and scaling Greg Kroah-Hartman
` (49 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Matt Ranostay, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <mranostay@gmail.com>
commit 09bc0ddaab6cab0fa95a67d5535ec772e2671193 upstream.
IIO_TEMP channel was being incorrectly reported back as Celsius when it
should have been milliCelsius. This is via an incorrect scale value being
returned to userspace.
Signed-off-by: Matt Ranostay <mranostay@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/humidity/hdc100x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -211,7 +211,7 @@ static int hdc100x_read_raw(struct iio_d
return IIO_VAL_INT_PLUS_MICRO;
case IIO_CHAN_INFO_SCALE:
if (chan->type == IIO_TEMP) {
- *val = 165;
+ *val = 165000;
*val2 = 65536 >> 2;
return IIO_VAL_FRACTIONAL;
} else {
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 154/203] iio: hudmidity: hdc100x: fix incorrect shifting and scaling
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (143 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 153/203] iio: humidity: hdc100x: fix IIO_TEMP channel reporting Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 155/203] staging: iio: accel: fix error check Greg Kroah-Hartman
` (48 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alison Schofield, Matt Ranostay,
Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <mranostay@gmail.com>
commit 94bef000f1d4aa111f4ddda1482cf3b30ad069ce upstream.
Shifting sensor data to the right 2 bits was incorrect and caused the
scaling values + offsets to be invalid.
Reported-by: Alison Schofield <amsfield22@gmail.com>
Signed-off-by: Matt Ranostay <mranostay@gmail.com>
Tested-by: Alison Schofield <amsfield22@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/humidity/hdc100x.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -164,14 +164,14 @@ static int hdc100x_get_measurement(struc
dev_err(&client->dev, "cannot read high byte measurement");
return ret;
}
- val = ret << 6;
+ val = ret << 8;
ret = i2c_smbus_read_byte(client);
if (ret < 0) {
dev_err(&client->dev, "cannot read low byte measurement");
return ret;
}
- val |= ret >> 2;
+ val |= ret;
return val;
}
@@ -212,17 +212,17 @@ static int hdc100x_read_raw(struct iio_d
case IIO_CHAN_INFO_SCALE:
if (chan->type == IIO_TEMP) {
*val = 165000;
- *val2 = 65536 >> 2;
+ *val2 = 65536;
return IIO_VAL_FRACTIONAL;
} else {
- *val = 0;
- *val2 = 10000;
- return IIO_VAL_INT_PLUS_MICRO;
+ *val = 100;
+ *val2 = 65536;
+ return IIO_VAL_FRACTIONAL;
}
break;
case IIO_CHAN_INFO_OFFSET:
- *val = -3971;
- *val2 = 879096;
+ *val = -15887;
+ *val2 = 515151;
return IIO_VAL_INT_PLUS_MICRO;
default:
return -EINVAL;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 155/203] staging: iio: accel: fix error check
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (144 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 154/203] iio: hudmidity: hdc100x: fix incorrect shifting and scaling Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 156/203] iio: accel: kxsd9: fix the usage of spi_w8r8() Greg Kroah-Hartman
` (47 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Luis de Bethencourt, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis de Bethencourt <luisbg@osg.samsung.com>
commit ef3149eb3ddb7f9125e11c90f8330e371b55cffd upstream.
sca3000_read_ctrl_reg() returns a negative number on failure, check for
this instead of zero.
Signed-off-by: Luis de Bethencourt <luisbg@osg.samsung.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/iio/accel/sca3000_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/iio/accel/sca3000_core.c
+++ b/drivers/staging/iio/accel/sca3000_core.c
@@ -594,7 +594,7 @@ static ssize_t sca3000_read_frequency(st
goto error_ret_mut;
ret = sca3000_read_ctrl_reg(st, SCA3000_REG_CTRL_SEL_OUT_CTRL);
mutex_unlock(&st->lock);
- if (ret)
+ if (ret < 0)
goto error_ret;
val = ret;
if (base_freq > 0)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 156/203] iio: accel: kxsd9: fix the usage of spi_w8r8()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (145 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 155/203] staging: iio: accel: fix error check Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 157/203] iio:ad7266: Fix broken regulator error handling Greg Kroah-Hartman
` (46 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Linus Walleij, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 0c1f91b98552da49d9d8eed32b3132a58d2f4598 upstream.
These two spi_w8r8() calls return a value with is used by the code
following the error check. The dubious use was caused by a cleanup
patch.
Fixes: d34dbee8ac8e ("staging:iio:accel:kxsd9 cleanup and conversion to iio_chan_spec.")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/kxsd9.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -81,7 +81,7 @@ static int kxsd9_write_scale(struct iio_
mutex_lock(&st->buf_lock);
ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
- if (ret)
+ if (ret < 0)
goto error_ret;
st->tx[0] = KXSD9_WRITE(KXSD9_REG_CTRL_C);
st->tx[1] = (ret & ~KXSD9_FS_MASK) | i;
@@ -163,7 +163,7 @@ static int kxsd9_read_raw(struct iio_dev
break;
case IIO_CHAN_INFO_SCALE:
ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
- if (ret)
+ if (ret < 0)
goto error_ret;
*val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK];
ret = IIO_VAL_INT_PLUS_MICRO;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 157/203] iio:ad7266: Fix broken regulator error handling
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (146 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 156/203] iio: accel: kxsd9: fix the usage of spi_w8r8() Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 158/203] iio:ad7266: Fix support for optional regulators Greg Kroah-Hartman
` (45 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Brown, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@kernel.org>
commit 6b7f4e25f3309f106a5c7ff42c8231494cf285d3 upstream.
All regulator_get() variants return either a pointer to a regulator or an
ERR_PTR() so testing for NULL makes no sense and may lead to bugs if we
use NULL as a valid regulator. Fix this by using IS_ERR() as expected.
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad7266.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/ad7266.c
+++ b/drivers/iio/adc/ad7266.c
@@ -397,7 +397,7 @@ static int ad7266_probe(struct spi_devic
st = iio_priv(indio_dev);
st->reg = devm_regulator_get(&spi->dev, "vref");
- if (!IS_ERR_OR_NULL(st->reg)) {
+ if (!IS_ERR(st->reg)) {
ret = regulator_enable(st->reg);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 158/203] iio:ad7266: Fix support for optional regulators
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (147 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 157/203] iio:ad7266: Fix broken regulator error handling Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 159/203] iio:ad7266: Fix probe deferral for vref Greg Kroah-Hartman
` (44 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Brown, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@kernel.org>
commit e5511c816e5ac4909bdd38e85ac344e2b9b8e984 upstream.
The ad7266 driver attempts to support deciding between the use of internal
and external power supplies by checking to see if an error is returned when
requesting the regulator. This doesn't work with the current code since the
driver uses a normal regulator_get() which is for non-optional supplies
and so assumes that if a regulator is not provided by the platform then
this is a bug in the platform integration and so substitutes a dummy
regulator. Use regulator_get_optional() instead which indicates to the
framework that the regulator may be absent and provides a dummy regulator
instead.
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad7266.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/ad7266.c
+++ b/drivers/iio/adc/ad7266.c
@@ -396,7 +396,7 @@ static int ad7266_probe(struct spi_devic
st = iio_priv(indio_dev);
- st->reg = devm_regulator_get(&spi->dev, "vref");
+ st->reg = devm_regulator_get_optional(&spi->dev, "vref");
if (!IS_ERR(st->reg)) {
ret = regulator_enable(st->reg);
if (ret)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 159/203] iio:ad7266: Fix probe deferral for vref
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (148 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 158/203] iio:ad7266: Fix support for optional regulators Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 160/203] tty: vt: Fix soft lockup in fbcon cursor blink timer Greg Kroah-Hartman
` (43 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Brown, Jonathan Cameron
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@kernel.org>
commit 68b356eb3d9f5e38910fb62e22a78e2a18d544ae upstream.
Currently the ad7266 driver treats any failure to get vref as though the
regulator were not present but this means that if probe deferral is
triggered the driver will act as though the regulator were not present.
Instead only use the internal reference if we explicitly got -ENODEV which
is what is returned for absent regulators.
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad7266.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/iio/adc/ad7266.c
+++ b/drivers/iio/adc/ad7266.c
@@ -408,6 +408,9 @@ static int ad7266_probe(struct spi_devic
st->vref_mv = ret / 1000;
} else {
+ /* Any other error indicates that the regulator does exist */
+ if (PTR_ERR(st->reg) != -ENODEV)
+ return PTR_ERR(st->reg);
/* Use internal reference */
st->vref_mv = 2500;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 160/203] tty: vt: Fix soft lockup in fbcon cursor blink timer.
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (149 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 159/203] iio:ad7266: Fix probe deferral for vref Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 161/203] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Greg Kroah-Hartman
` (42 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Daney, Pavel Machek, Ming Lei,
Scot Doyle, Henrique de Moraes Holschuh
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Daney <david.daney@cavium.com>
commit 1b45996d2ebf9680ccd0db875fc668aa025f40fd upstream.
We are getting somewhat random soft lockups with this signature:
[ 86.992215] [<fffffc00080935e0>] el1_irq+0xa0/0x10c
[ 86.997082] [<fffffc000841822c>] cursor_timer_handler+0x30/0x54
[ 87.002991] [<fffffc000810ec44>] call_timer_fn+0x54/0x1a8
[ 87.008378] [<fffffc000810ef88>] run_timer_softirq+0x1c4/0x2bc
[ 87.014200] [<fffffc000809077c>] __do_softirq+0x114/0x344
[ 87.019590] [<fffffc00080af45c>] irq_exit+0x74/0x98
[ 87.024458] [<fffffc00080fac20>] __handle_domain_irq+0x98/0xfc
[ 87.030278] [<fffffc000809056c>] gic_handle_irq+0x94/0x190
This is caused by the vt visual_init() function calling into
fbcon_init() with a vc_cur_blink_ms value of zero. This is a
transient condition, as it is later set to a non-zero value. But, if
the timer happens to expire while the blink rate is zero, it goes into
an endless loop, and we get soft lockup.
The fix is to initialize vc_cur_blink_ms before calling the con_init()
function.
Signed-off-by: David Daney <david.daney@cavium.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Tested-by: Ming Lei <ming.lei@canonical.com>
Acked-by: Scot Doyle <lkml14@scotdoyle.com>
Tested-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/vt/vt.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -750,6 +750,7 @@ static void visual_init(struct vc_data *
vc->vc_complement_mask = 0;
vc->vc_can_do_color = 0;
vc->vc_panic_force_write = false;
+ vc->vc_cur_blink_ms = DEFAULT_CURSOR_BLINK_MS;
vc->vc_sw->con_init(vc, init);
if (!vc->vc_complement_mask)
vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 161/203] tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (150 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 160/203] tty: vt: Fix soft lockup in fbcon cursor blink timer Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 165/203] ALSA: dummy: Fix a use-after-free at closing Greg Kroah-Hartman
` (41 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sasha Levin, Guenter Roeck, Dmitry Torokhov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream.
The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do
sym = U(key_maps[0][k]);
with large 'k'.
To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.
Also while at it let's switch to for_each_set_bit() instead of open-coding
it.
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/vt/keyboard.c | 30 +++++++++---------------------
1 file changed, 9 insertions(+), 21 deletions(-)
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -366,34 +366,22 @@ static void to_utf8(struct vc_data *vc,
static void do_compute_shiftstate(void)
{
- unsigned int i, j, k, sym, val;
+ unsigned int k, sym, val;
shift_state = 0;
memset(shift_down, 0, sizeof(shift_down));
- for (i = 0; i < ARRAY_SIZE(key_down); i++) {
-
- if (!key_down[i])
+ for_each_set_bit(k, key_down, min(NR_KEYS, KEY_CNT)) {
+ sym = U(key_maps[0][k]);
+ if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
continue;
- k = i * BITS_PER_LONG;
-
- for (j = 0; j < BITS_PER_LONG; j++, k++) {
-
- if (!test_bit(k, key_down))
- continue;
-
- sym = U(key_maps[0][k]);
- if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
- continue;
-
- val = KVAL(sym);
- if (val == KVAL(K_CAPSSHIFT))
- val = KVAL(K_SHIFT);
+ val = KVAL(sym);
+ if (val == KVAL(K_CAPSSHIFT))
+ val = KVAL(K_SHIFT);
- shift_down[val]++;
- shift_state |= (1 << val);
- }
+ shift_down[val]++;
+ shift_state |= BIT(val);
}
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 165/203] ALSA: dummy: Fix a use-after-free at closing
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (151 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 161/203] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 166/203] ALSA: hdac_regmap - fix the register access for runtime PM Greg Kroah-Hartman
` (40 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit d5dbbe6569481bf12dcbe3e12cff72c5f78d272c upstream.
syzkaller fuzzer spotted a potential use-after-free case in snd-dummy
driver when hrtimer is used as backend:
> ==================================================================
> BUG: KASAN: use-after-free in rb_erase+0x1b17/0x2010 at addr ffff88005e5b6f68
> Read of size 8 by task syz-executor/8984
> =============================================================================
> BUG kmalloc-192 (Not tainted): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> Disabling lock debugging due to kernel taint
> INFO: Allocated in 0xbbbbbbbbbbbbbbbb age=18446705582212484632
> ....
> [< none >] dummy_hrtimer_create+0x49/0x1a0 sound/drivers/dummy.c:464
> ....
> INFO: Freed in 0xfffd8e09 age=18446705496313138713 cpu=2164287125 pid=-1
> [< none >] dummy_hrtimer_free+0x68/0x80 sound/drivers/dummy.c:481
> ....
> Call Trace:
> [<ffffffff8179e59e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:333
> [< inline >] rb_set_parent include/linux/rbtree_augmented.h:111
> [< inline >] __rb_erase_augmented include/linux/rbtree_augmented.h:218
> [<ffffffff82ca5787>] rb_erase+0x1b17/0x2010 lib/rbtree.c:427
> [<ffffffff82cb02e8>] timerqueue_del+0x78/0x170 lib/timerqueue.c:86
> [<ffffffff814d0c80>] __remove_hrtimer+0x90/0x220 kernel/time/hrtimer.c:903
> [< inline >] remove_hrtimer kernel/time/hrtimer.c:945
> [<ffffffff814d23da>] hrtimer_try_to_cancel+0x22a/0x570 kernel/time/hrtimer.c:1046
> [<ffffffff814d2742>] hrtimer_cancel+0x22/0x40 kernel/time/hrtimer.c:1066
> [<ffffffff85420531>] dummy_hrtimer_stop+0x91/0xb0 sound/drivers/dummy.c:417
> [<ffffffff854228bf>] dummy_pcm_trigger+0x17f/0x1e0 sound/drivers/dummy.c:507
> [<ffffffff85392170>] snd_pcm_do_stop+0x160/0x1b0 sound/core/pcm_native.c:1106
> [<ffffffff85391b26>] snd_pcm_action_single+0x76/0x120 sound/core/pcm_native.c:956
> [<ffffffff85391e01>] snd_pcm_action+0x231/0x290 sound/core/pcm_native.c:974
> [< inline >] snd_pcm_stop sound/core/pcm_native.c:1139
> [<ffffffff8539754d>] snd_pcm_drop+0x12d/0x1d0 sound/core/pcm_native.c:1784
> [<ffffffff8539d3be>] snd_pcm_common_ioctl1+0xfae/0x2150 sound/core/pcm_native.c:2805
> [<ffffffff8539ee91>] snd_pcm_capture_ioctl1+0x2a1/0x5e0 sound/core/pcm_native.c:2976
> [<ffffffff8539f2ec>] snd_pcm_kernel_ioctl+0x11c/0x160 sound/core/pcm_native.c:3020
> [<ffffffff853d9a44>] snd_pcm_oss_sync+0x3a4/0xa30 sound/core/oss/pcm_oss.c:1693
> [<ffffffff853da27d>] snd_pcm_oss_release+0x1ad/0x280 sound/core/oss/pcm_oss.c:2483
> .....
A workaround is to call hrtimer_cancel() in dummy_hrtimer_sync() which
is called certainly before other blocking ops.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/drivers/dummy.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/drivers/dummy.c
+++ b/sound/drivers/dummy.c
@@ -420,6 +420,7 @@ static int dummy_hrtimer_stop(struct snd
static inline void dummy_hrtimer_sync(struct dummy_hrtimer_pcm *dpcm)
{
+ hrtimer_cancel(&dpcm->timer);
tasklet_kill(&dpcm->tasklet);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 166/203] ALSA: hdac_regmap - fix the register access for runtime PM
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (152 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 165/203] ALSA: dummy: Fix a use-after-free at closing Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 167/203] ALSA: hda - Fix the headset mic jack detection on Dell machine Greg Kroah-Hartman
` (39 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jaroslav Kysela, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <perex@perex.cz>
commit 8198868f0a283eb23e264951632ce61ec2f82228 upstream.
Call path:
1) snd_hdac_power_up_pm()
2) snd_hdac_power_up()
3) pm_runtime_get_sync()
4) __pm_runtime_resume()
5) rpm_resume()
The rpm_resume() returns 1 when the device is already active.
Because the return value is unmodified, the hdac regmap read/write
functions should allow this value for the retry I/O operation, too.
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/hdac_regmap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/hda/hdac_regmap.c
+++ b/sound/hda/hdac_regmap.c
@@ -444,7 +444,7 @@ int snd_hdac_regmap_write_raw(struct hda
err = reg_raw_write(codec, reg, val);
if (err == -EAGAIN) {
err = snd_hdac_power_up_pm(codec);
- if (!err)
+ if (err >= 0)
err = reg_raw_write(codec, reg, val);
snd_hdac_power_down_pm(codec);
}
@@ -470,7 +470,7 @@ static int __snd_hdac_regmap_read_raw(st
err = reg_raw_read(codec, reg, val, uncached);
if (err == -EAGAIN) {
err = snd_hdac_power_up_pm(codec);
- if (!err)
+ if (err >= 0)
err = reg_raw_read(codec, reg, val, uncached);
snd_hdac_power_down_pm(codec);
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 167/203] ALSA: hda - Fix the headset mic jack detection on Dell machine
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (153 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 166/203] ALSA: hdac_regmap - fix the register access for runtime PM Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 168/203] ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup Greg Kroah-Hartman
` (38 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Woodrow Shen, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Woodrow Shen <woodrow.shen@gmail.com>
commit f83c32925d45926cd0e0f18bf28e6039116c4486 upstream.
The new Dell laptop with codec 3246 can't detect headset mic when
headset was inserted on the machine. So adding pin configurations
into quirk table makes headset mic work correctly.
Codec: Realtek ALC3246
Vendor Id: 0x10ec0256
Subsystem Id: 0x10280781
Signed-off-by: Woodrow Shen <woodrow.shen@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5832,6 +5832,10 @@ static const struct snd_hda_pin_quirk al
{0x14, 0x90170120},
{0x21, 0x02211030}),
SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x12, 0x90a60170},
+ {0x14, 0x90170120},
+ {0x21, 0x02211030}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
ALC256_STANDARD_PINS),
SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
{0x12, 0x90a60130},
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 168/203] ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (154 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 167/203] ALSA: hda - Fix the headset mic jack detection on Dell machine Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 169/203] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() Greg Kroah-Hartman
` (37 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jaroslav Kysela, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <perex@perex.cz>
commit 0f087ee3f3b86a4507db4ff1d2d5a3880e4cfd16 upstream.
See: https://bugzilla.redhat.com/show_bug.cgi?id=1349539
See: https://bugzilla.kernel.org/show_bug.cgi?id=120961
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5650,6 +5650,8 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+ SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460),
+ SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460),
SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 169/203] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (155 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 168/203] ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 170/203] ALSA: echoaudio: Fix memory allocation Greg Kroah-Hartman
` (36 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 62db7152c924e4c060e42b34a69cd39658e8a0dc upstream.
vortex_wtdma_bufshift() function does calculate the page index
wrongly, first masking then shift, which always results in zero.
The proper computation is to first shift, then mask.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/au88x0/au88x0_core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/sound/pci/au88x0/au88x0_core.c
+++ b/sound/pci/au88x0/au88x0_core.c
@@ -1444,9 +1444,8 @@ static int vortex_wtdma_bufshift(vortex_
int page, p, pp, delta, i;
page =
- (hwread(vortex->mmio, VORTEX_WTDMA_STAT + (wtdma << 2)) &
- WT_SUBBUF_MASK)
- >> WT_SUBBUF_SHIFT;
+ (hwread(vortex->mmio, VORTEX_WTDMA_STAT + (wtdma << 2))
+ >> WT_SUBBUF_SHIFT) & WT_SUBBUF_MASK;
if (dma->nr_periods >= 4)
delta = (page - dma->period_real) & 3;
else {
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 170/203] ALSA: echoaudio: Fix memory allocation
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (156 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 169/203] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 171/203] ALSA: timer: Fix negative queue usage by racy accesses Greg Kroah-Hartman
` (35 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit 9c6795a9b3cbb56a9fbfaf43909c5c22999ba317 upstream.
'commpage_bak' is allocated with 'sizeof(struct echoaudio)' bytes.
We then copy 'sizeof(struct comm_page)' bytes in it.
On my system, smatch complains because one is 2960 and the other is 3072.
This would result in memory corruption or a oops.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/echoaudio/echoaudio.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -2200,11 +2200,11 @@ static int snd_echo_resume(struct device
u32 pipe_alloc_mask;
int err;
- commpage_bak = kmalloc(sizeof(struct echoaudio), GFP_KERNEL);
+ commpage_bak = kmalloc(sizeof(*commpage), GFP_KERNEL);
if (commpage_bak == NULL)
return -ENOMEM;
commpage = chip->comm_page;
- memcpy(commpage_bak, commpage, sizeof(struct comm_page));
+ memcpy(commpage_bak, commpage, sizeof(*commpage));
err = init_hw(chip, chip->pci->device, chip->pci->subsystem_device);
if (err < 0) {
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 171/203] ALSA: timer: Fix negative queue usage by racy accesses
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (157 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 170/203] ALSA: echoaudio: Fix memory allocation Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 172/203] ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup Greg Kroah-Hartman
` (34 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 3fa6993fef634e05d200d141a85df0b044572364 upstream.
The user timer tu->qused counter may go to a negative value when
multiple concurrent reads are performed since both the check and the
decrement of tu->qused are done in two individual locked contexts.
This results in bogus read outs, and the endless loop in the
user-space side.
The fix is to move the decrement of the tu->qused counter into the
same spinlock context as the zero-check of the counter.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/timer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1954,6 +1954,7 @@ static ssize_t snd_timer_user_read(struc
qhead = tu->qhead++;
tu->qhead %= tu->queue_size;
+ tu->qused--;
spin_unlock_irq(&tu->qlock);
if (tu->tread) {
@@ -1967,7 +1968,6 @@ static ssize_t snd_timer_user_read(struc
}
spin_lock_irq(&tu->qlock);
- tu->qused--;
if (err < 0)
goto _error;
result += unit;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 172/203] ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (158 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 171/203] ALSA: timer: Fix negative queue usage by racy accesses Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 173/203] ALSA: hda - Add PCI ID for Kabylake-H Greg Kroah-Hartman
` (33 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Torsten Hilbrich, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Torsten Hilbrich <torsten.hilbrich@secunet.com>
commit 9cd25743765cfe851aed8d655a62d60156aed293 upstream.
This solves the issue that a headphone is not working on the docking
unit.
Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5651,6 +5651,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460),
+ SND_PCI_QUIRK(0x17aa, 0x5051, "Thinkpad L460", ALC292_FIXUP_TPT460),
SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460),
SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 173/203] ALSA: hda - Add PCI ID for Kabylake-H
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (159 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 172/203] ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 174/203] ALSA: hda - fix read before array start Greg Kroah-Hartman
` (32 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vinod Koul, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <vinod.koul@intel.com>
commit 6858107e78b4ecb9f244db814ffbdba1b5ce759b upstream.
Kabylake-H shows up as PCI ID 0xa2f0. We missed adding this
earlier with other KBL IDs.
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/hda_intel.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -367,9 +367,10 @@ enum {
#define IS_SKL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70)
#define IS_KBL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa171)
#define IS_KBL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71)
+#define IS_KBL_H(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa2f0)
#define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
#define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \
- IS_KBL(pci) || IS_KBL_LP(pci)
+ IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci)
static char *driver_short_names[] = {
[AZX_DRIVER_ICH] = "HDA Intel",
@@ -2190,6 +2191,9 @@ static const struct pci_device_id azx_id
/* Kabylake-LP */
{ PCI_DEVICE(0x8086, 0x9d71),
.driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
+ /* Kabylake-H */
+ { PCI_DEVICE(0x8086, 0xa2f0),
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
/* Broxton-P(Apollolake) */
{ PCI_DEVICE(0x8086, 0x5a98),
.driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 174/203] ALSA: hda - fix read before array start
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (160 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 173/203] ALSA: hda - Add PCI ID for Kabylake-H Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 175/203] ALSA: usb-audio: Fix quirks code is not called Greg Kroah-Hartman
` (31 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Copeland, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Copeland <me@bobcopeland.com>
commit 81e43960dce1c8e58e682fb3ec26c1d8f83a9afc upstream.
UBSAN reports the following warning from accessing path->path[-1]
in set_path_power():
[ 16.078040] ================================================================================
[ 16.078124] UBSAN: Undefined behaviour in sound/pci/hda/hda_generic.c:3981:17
[ 16.078198] index -1 is out of range for type 'hda_nid_t [10]'
[ 16.078270] CPU: 2 PID: 1738 Comm: modprobe Not tainted 4.7.0-rc1-wt+ #47
[ 16.078274] Hardware name: LENOVO 3443CTO/3443CTO, BIOS G6ET23WW (1.02 ) 08/14/2012
[ 16.078278] ffff8800cb246000 ffff8800cb3638b8 ffffffff815c4fe3 0000000000000032
[ 16.078286] ffff8800cb3638e0 ffffffffffffffff ffff8800cb3638d0 ffffffff8162443d
[ 16.078294] ffffffffa0894200 ffff8800cb363920 ffffffff81624af7 0000000000000292
[ 16.078302] Call Trace:
[ 16.078311] [<ffffffff815c4fe3>] dump_stack+0x86/0xd3
[ 16.078317] [<ffffffff8162443d>] ubsan_epilogue+0xd/0x40
[ 16.078324] [<ffffffff81624af7>] __ubsan_handle_out_of_bounds+0x67/0x70
[ 16.078335] [<ffffffffa087665f>] set_path_power+0x1bf/0x230 [snd_hda_codec_generic]
[ 16.078344] [<ffffffffa087880d>] add_pin_power_ctls+0x8d/0xc0 [snd_hda_codec_generic]
[ 16.078352] [<ffffffffa087f190>] ? pin_power_down_callback+0x20/0x20 [snd_hda_codec_generic]
[ 16.078360] [<ffffffffa0878947>] add_all_pin_power_ctls+0x107/0x150 [snd_hda_codec_generic]
[ 16.078370] [<ffffffffa08842b3>] snd_hda_gen_parse_auto_config+0x2d73/0x49e0 [snd_hda_codec_generic]
[ 16.078376] [<ffffffff81173360>] ? trace_hardirqs_on_caller+0x1b0/0x2c0
[ 16.078390] [<ffffffffa089df27>] alc_parse_auto_config+0x147/0x310 [snd_hda_codec_realtek]
[ 16.078402] [<ffffffffa08a332a>] patch_alc269+0x23a/0x560 [snd_hda_codec_realtek]
[ 16.078417] [<ffffffffa0838644>] hda_codec_driver_probe+0xa4/0x1a0 [snd_hda_codec]
[ 16.078424] [<ffffffff817bbac1>] driver_probe_device+0x101/0x380
[ 16.078430] [<ffffffff817bbdf9>] __driver_attach+0xb9/0x100
[ 16.078438] [<ffffffff817bbd40>] ? driver_probe_device+0x380/0x380
[ 16.078444] [<ffffffff817b8d20>] bus_for_each_dev+0x70/0xc0
[ 16.078449] [<ffffffff817bb087>] driver_attach+0x27/0x50
[ 16.078454] [<ffffffff817ba956>] bus_add_driver+0x166/0x2c0
[ 16.078460] [<ffffffffa0369000>] ? 0xffffffffa0369000
[ 16.078465] [<ffffffff817bd13d>] driver_register+0x7d/0x130
[ 16.078477] [<ffffffffa083816f>] __hda_codec_driver_register+0x6f/0x90 [snd_hda_codec]
[ 16.078488] [<ffffffffa036901e>] realtek_driver_init+0x1e/0x1000 [snd_hda_codec_realtek]
[ 16.078493] [<ffffffff8100215e>] do_one_initcall+0x4e/0x1d0
[ 16.078499] [<ffffffff8119f54d>] ? rcu_read_lock_sched_held+0x6d/0x80
[ 16.078504] [<ffffffff813701b1>] ? kmem_cache_alloc_trace+0x391/0x560
[ 16.078510] [<ffffffff812bb314>] ? do_init_module+0x28/0x273
[ 16.078515] [<ffffffff812bb387>] do_init_module+0x9b/0x273
[ 16.078522] [<ffffffff811e3782>] load_module+0x20b2/0x3410
[ 16.078527] [<ffffffff811df140>] ? m_show+0x210/0x210
[ 16.078533] [<ffffffff813b2b26>] ? kernel_read+0x66/0xe0
[ 16.078541] [<ffffffff811e4cfa>] SYSC_finit_module+0xba/0xc0
[ 16.078547] [<ffffffff811e4d1e>] SyS_finit_module+0xe/0x10
[ 16.078552] [<ffffffff81a860fc>] entry_SYSCALL_64_fastpath+0x1f/0xbd
[ 16.078556] ================================================================================
Fix by checking path->depth before use.
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/hda_generic.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -3977,6 +3977,8 @@ static hda_nid_t set_path_power(struct h
for (n = 0; n < spec->paths.used; n++) {
path = snd_array_elem(&spec->paths, n);
+ if (!path->depth)
+ continue;
if (path->path[0] == nid ||
path->path[path->depth - 1] == nid) {
bool pin_old = path->pin_enabled;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 175/203] ALSA: usb-audio: Fix quirks code is not called
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (161 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 174/203] ALSA: hda - fix read before array start Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 176/203] ALSA: hda/realtek - add new pin definition in alc225 pin quirk table Greg Kroah-Hartman
` (30 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kazuki Oikawa, Takashi Sakamoto,
Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kazuki Oikawa <k@oikw.org>
commit 76df52969711ae3725a98f26fbbc6a349803dcbf upstream.
snd_usb_{set_interface,ctl_msg}_quirk checks chip->usb_id to need
calling a quirks code. But existed code path that not calling
dev_set_drvdata in usb_audio_probe.
Fixes: 79289e24194a ("ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation")
Signed-off-by: Kazuki Oikawa <k@oikw.org>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Tested-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/card.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -552,7 +552,6 @@ static int usb_audio_probe(struct usb_in
goto __error;
}
chip = usb_chip[i];
- dev_set_drvdata(&dev->dev, chip);
atomic_inc(&chip->active); /* avoid autopm */
break;
}
@@ -578,6 +577,7 @@ static int usb_audio_probe(struct usb_in
goto __error;
}
}
+ dev_set_drvdata(&dev->dev, chip);
/*
* For devices with more than one control interface, we assume the
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 176/203] ALSA: hda/realtek - add new pin definition in alc225 pin quirk table
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (162 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 175/203] ALSA: usb-audio: Fix quirks code is not called Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 177/203] ALSA: pcm: Free chmap at PCM free callback, too Greg Kroah-Hartman
` (29 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hui Wang, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <hui.wang@canonical.com>
commit 8a132099f080d7384bb6ab4cc168f76cb4b47d08 upstream.
We have some Dell laptops which can't detect headset mic, the machines
use the codec ALC225, they have some new pin configuration values,
after adding them in the alc225 pin quirk table, they work well.
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5738,7 +5738,6 @@ static const struct hda_model_fixup alc2
{}
};
#define ALC225_STANDARD_PINS \
- {0x12, 0xb7a60130}, \
{0x21, 0x04211020}
#define ALC256_STANDARD_PINS \
@@ -5763,10 +5762,24 @@ static const struct hda_model_fixup alc2
static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
ALC225_STANDARD_PINS,
+ {0x12, 0xb7a60130},
{0x14, 0x901701a0}),
SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
ALC225_STANDARD_PINS,
+ {0x12, 0xb7a60130},
{0x14, 0x901701b0}),
+ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC225_STANDARD_PINS,
+ {0x12, 0xb7a60150},
+ {0x14, 0x901701a0}),
+ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC225_STANDARD_PINS,
+ {0x12, 0xb7a60150},
+ {0x14, 0x901701b0}),
+ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC225_STANDARD_PINS,
+ {0x12, 0xb7a60130},
+ {0x1b, 0x90170110}),
SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
{0x14, 0x90170110},
{0x21, 0x02211020}),
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 177/203] ALSA: pcm: Free chmap at PCM free callback, too
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (163 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 176/203] ALSA: hda/realtek - add new pin definition in alc225 pin quirk table Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 178/203] ALSA: ctl: Stop notification after disconnection Greg Kroah-Hartman
` (28 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Laxminath Kasam, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit a8ff48cb70835f48de5703052760312019afea55 upstream.
The chmap ctls assigned to PCM streams are freed in the PCM disconnect
callback. However, since the disconnect callback isn't called when
the card gets freed before registering, the chmap ctls may still be
left assigned. They are eventually freed together with other ctls,
but it may cause an Oops at pcm_chmap_ctl_private_free(), as the
function refers to the assigned PCM stream, while the PCM objects have
been already freed beforehand.
The fix is to free the chmap ctls also at PCM free callback, not only
at PCM disconnect.
Reported-by: Laxminath Kasam <b_lkasam@codeaurora.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -849,6 +849,14 @@ int snd_pcm_new_internal(struct snd_card
}
EXPORT_SYMBOL(snd_pcm_new_internal);
+static void free_chmap(struct snd_pcm_str *pstr)
+{
+ if (pstr->chmap_kctl) {
+ snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl);
+ pstr->chmap_kctl = NULL;
+ }
+}
+
static void snd_pcm_free_stream(struct snd_pcm_str * pstr)
{
struct snd_pcm_substream *substream, *substream_next;
@@ -871,6 +879,7 @@ static void snd_pcm_free_stream(struct s
kfree(setup);
}
#endif
+ free_chmap(pstr);
if (pstr->substream_count)
put_device(&pstr->dev);
}
@@ -1135,10 +1144,7 @@ static int snd_pcm_dev_disconnect(struct
for (cidx = 0; cidx < 2; cidx++) {
if (!pcm->internal)
snd_unregister_device(&pcm->streams[cidx].dev);
- if (pcm->streams[cidx].chmap_kctl) {
- snd_ctl_remove(pcm->card, pcm->streams[cidx].chmap_kctl);
- pcm->streams[cidx].chmap_kctl = NULL;
- }
+ free_chmap(&pcm->streams[cidx]);
}
mutex_unlock(&pcm->open_mutex);
mutex_unlock(®ister_mutex);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 178/203] ALSA: ctl: Stop notification after disconnection
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (164 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 177/203] ALSA: pcm: Free chmap at PCM free callback, too Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 179/203] ALSA: hda - fix use-after-free after module unload Greg Kroah-Hartman
` (27 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit f388cdcdd160687c6650833f286b9c89c50960ff upstream.
snd_ctl_remove() has a notification for the removal event. It's
superfluous when done during the device got disconnected. Although
the notification itself is mostly harmless, it may potentially be
harmful, and should be suppressed. Actually some components PCM may
free ctl elements during the disconnect or free callbacks, thus it's
no theoretical issue.
This patch adds the check of card->shutdown flag for avoiding
unnecessary notifications after (or during) the disconnect.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/control.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -160,6 +160,8 @@ void snd_ctl_notify(struct snd_card *car
if (snd_BUG_ON(!card || !id))
return;
+ if (card->shutdown)
+ return;
read_lock(&card->ctl_files_rwlock);
#if IS_ENABLED(CONFIG_SND_MIXER_OSS)
card->mixer_oss_change_count++;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 179/203] ALSA: hda - fix use-after-free after module unload
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (165 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 178/203] ALSA: ctl: Stop notification after disconnection Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 180/203] ALSA: hda: add AMD Stoney PCI ID with proper driver caps Greg Kroah-Hartman
` (26 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Wu, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wu <peter@lekensteyn.nl>
commit ab58d8cc870ef3f0771c197700441936898d1f1d upstream.
register_vga_switcheroo() sets the PM ops from the hda structure which
is freed later in azx_free. Make sure that these ops are cleared.
Caught by KASAN, initially noticed due to a general protection fault.
Fixes: 246efa4a072f ("snd/hda: add runtime suspend/resume on optimus support (v4)")
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/hda_intel.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1218,8 +1218,10 @@ static int azx_free(struct azx *chip)
if (use_vga_switcheroo(hda)) {
if (chip->disabled && hda->probe_continued)
snd_hda_unlock_devices(&chip->bus);
- if (hda->vga_switcheroo_registered)
+ if (hda->vga_switcheroo_registered) {
vga_switcheroo_unregister_client(chip->pci);
+ vga_switcheroo_fini_domain_pm_ops(chip->card->dev);
+ }
}
if (bus->chip_init) {
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 180/203] ALSA: hda: add AMD Stoney PCI ID with proper driver caps
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (166 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 179/203] ALSA: hda - fix use-after-free after module unload Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 181/203] ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13 Greg Kroah-Hartman
` (25 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Awais Belal, Takashi Iwai
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Awais Belal <awais_belal@mentor.com>
commit d716fb03f76411fc7e138692e33b749cada5c094 upstream.
This allows the device to correctly show up as ATI HDMI
rather than a generic one and allows the driver to use
the available caps.
Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/hda_intel.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2269,6 +2269,8 @@ static const struct pci_device_id azx_id
.driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
{ PCI_DEVICE(0x1002, 0x157a),
.driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x15b3),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
{ PCI_DEVICE(0x1002, 0x793b),
.driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
{ PCI_DEVICE(0x1002, 0x7919),
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 181/203] ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (167 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 180/203] ALSA: hda: add AMD Stoney PCI ID with proper driver caps Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 182/203] ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys Greg Kroah-Hartman
` (24 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Maxime Ripard
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <boris.brezillon@free-electrons.com>
commit 5fc39d347267bd029fcc9099c70e2fe2d53130e9 upstream.
The sun4i-timer driver registers its sched_clock only if the machine is
compatible with "allwinner,sun5i-a13", "allwinner,sun5i-a10s" or
"allwinner,sun4i-a10".
Add the missing "allwinner,sun5i-a13" string to the machine compatible.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Fixes: 465a225fb2af ("ARM: sun5i: Add C.H.I.P DTS")
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/sun5i-r8-chip.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/sun5i-r8-chip.dts
+++ b/arch/arm/boot/dts/sun5i-r8-chip.dts
@@ -52,7 +52,7 @@
/ {
model = "NextThing C.H.I.P.";
- compatible = "nextthing,chip", "allwinner,sun5i-r8";
+ compatible = "nextthing,chip", "allwinner,sun5i-r8", "allwinner,sun5i-a13";
aliases {
i2c0 = &i2c0;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 182/203] ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (168 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 181/203] ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13 Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 183/203] ARM: mvebu: fix HW I/O coherency related deadlocks Greg Kroah-Hartman
` (23 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Terry Stockert, Imre Kaloz,
Boris Brezillon, Thomas Petazzoni, Gregory CLEMENT
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 929e604efa3dc0522214e0dc18984be23993e9f0 upstream.
When the support for the Marvell crypto engine was added in the Device
Tree of the various Armada 385 Device Tree files in commit
d716f2e837ac6 ("ARM: mvebu: define crypto SRAM ranges for all armada-38x
boards"), a typo was made in the MBus window attributes for the Armada
385 Linksys board: 0x09/0x05 are used instead of 0x19/0x15. This commit
fixes this typo, which makes the CESA engines operational on Armada 385
Linksys boards.
Reported-by: Terry Stockert <stockert@inkblotadmirer.me>
Cc: Terry Stockert <stockert@inkblotadmirer.me>
Cc: Imre Kaloz <kaloz@openwrt.org>
Cc: Boris Brezillon <boris.brezillon@free-electrons.com>
Fixes: d716f2e837ac6 ("ARM: mvebu: define crypto SRAM ranges for all armada-38x boards")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/armada-385-linksys.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/boot/dts/armada-385-linksys.dtsi
+++ b/arch/arm/boot/dts/armada-385-linksys.dtsi
@@ -58,8 +58,8 @@
soc {
ranges = <MBUS_ID(0xf0, 0x01) 0 0xf1000000 0x100000
MBUS_ID(0x01, 0x1d) 0 0xfff00000 0x100000
- MBUS_ID(0x09, 0x09) 0 0xf1100000 0x10000
- MBUS_ID(0x09, 0x05) 0 0xf1110000 0x10000>;
+ MBUS_ID(0x09, 0x19) 0 0xf1100000 0x10000
+ MBUS_ID(0x09, 0x15) 0 0xf1110000 0x10000>;
internal-regs {
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 183/203] ARM: mvebu: fix HW I/O coherency related deadlocks
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (169 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 182/203] ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 184/203] ovl: fix dentry leak for default_permissions Greg Kroah-Hartman
` (22 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Terry Stockert, Romain Perier,
Thomas Petazzoni, Gregory CLEMENT
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit c5379ba8fccd99d5f99632c789f0393d84a57805 upstream.
Until now, our understanding for HW I/O coherency to work on the
Cortex-A9 based Marvell SoC was that only the PCIe regions should be
mapped strongly-ordered. However, we were still encountering some
deadlocks, especially when testing the CESA crypto engine. After
checking with the HW designers, it was concluded that all the MMIO
registers should be mapped as strongly ordered for the HW I/O coherency
mechanism to work properly.
This fixes some easy to reproduce deadlocks with the CESA crypto engine
driver (dmcrypt on a sufficiently large disk partition).
Tested-by: Terry Stockert <stockert@inkblotadmirer.me>
Tested-by: Romain Perier <romain.perier@free-electrons.com>
Cc: Terry Stockert <stockert@inkblotadmirer.me>
Cc: Romain Perier <romain.perier@free-electrons.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-mvebu/coherency.c | 22 ++++++++--------------
1 file changed, 8 insertions(+), 14 deletions(-)
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
@@ -162,22 +162,16 @@ exit:
}
/*
- * This ioremap hook is used on Armada 375/38x to ensure that PCIe
- * memory areas are mapped as MT_UNCACHED instead of MT_DEVICE. This
- * is needed as a workaround for a deadlock issue between the PCIe
- * interface and the cache controller.
+ * This ioremap hook is used on Armada 375/38x to ensure that all MMIO
+ * areas are mapped as MT_UNCACHED instead of MT_DEVICE. This is
+ * needed for the HW I/O coherency mechanism to work properly without
+ * deadlock.
*/
static void __iomem *
-armada_pcie_wa_ioremap_caller(phys_addr_t phys_addr, size_t size,
- unsigned int mtype, void *caller)
+armada_wa_ioremap_caller(phys_addr_t phys_addr, size_t size,
+ unsigned int mtype, void *caller)
{
- struct resource pcie_mem;
-
- mvebu_mbus_get_pcie_mem_aperture(&pcie_mem);
-
- if (pcie_mem.start <= phys_addr && (phys_addr + size) <= pcie_mem.end)
- mtype = MT_UNCACHED;
-
+ mtype = MT_UNCACHED;
return __arm_ioremap_caller(phys_addr, size, mtype, caller);
}
@@ -186,7 +180,7 @@ static void __init armada_375_380_cohere
struct device_node *cache_dn;
coherency_cpu_base = of_iomap(np, 0);
- arch_ioremap_caller = armada_pcie_wa_ioremap_caller;
+ arch_ioremap_caller = armada_wa_ioremap_caller;
/*
* We should switch the PL310 to I/O coherency mode only if
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 184/203] ovl: fix dentry leak for default_permissions
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (170 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 183/203] ARM: mvebu: fix HW I/O coherency related deadlocks Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 185/203] ovl: get_write_access() in truncate Greg Kroah-Hartman
` (21 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit a4859d75944a726533ab86d24bb5ffd1b2b7d6cc upstream.
When using the 'default_permissions' mount option, ovl_permission() on
non-directories was missing a dput(alias), resulting in "BUG Dentry still
in use".
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 8d3095f4ad47 ("ovl: default permissions")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/inode.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -121,16 +121,18 @@ int ovl_permission(struct inode *inode,
err = vfs_getattr(&realpath, &stat);
if (err)
- return err;
+ goto out_dput;
+ err = -ESTALE;
if ((stat.mode ^ inode->i_mode) & S_IFMT)
- return -ESTALE;
+ goto out_dput;
inode->i_mode = stat.mode;
inode->i_uid = stat.uid;
inode->i_gid = stat.gid;
- return generic_permission(inode, mask);
+ err = generic_permission(inode, mask);
+ goto out_dput;
}
/* Careful in RCU walk mode */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 185/203] ovl: get_write_access() in truncate
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (171 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 184/203] ovl: fix dentry leak for default_permissions Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 186/203] ovl: Copy up underlying inodes ->i_mode to overlay inode Greg Kroah-Hartman
` (20 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aihua Zhang, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit 03bea60409328de54e4ff7ec41672e12a9cb0908 upstream.
When truncating a file we should check write access on the underlying
inode. And we should do so on the lower file as well (before copy-up) for
consistency.
Original patch and test case by Aihua Zhang.
- - >o >o - - test.c - - >o >o - -
#include <stdio.h>
#include <errno.h>
#include <unistd.h>
int main(int argc, char *argv[])
{
int ret;
ret = truncate(argv[0], 4096);
if (ret != -1) {
fprintf(stderr, "truncate(argv[0]) should have failed\n");
return 1;
}
if (errno != ETXTBSY) {
perror("truncate(argv[0])");
return 1;
}
return 0;
}
- - >o >o - - >o >o - - >o >o - -
Reported-by: Aihua Zhang <zhangaihua1@huawei.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/inode.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -59,16 +59,37 @@ int ovl_setattr(struct dentry *dentry, s
if (err)
goto out;
+ if (attr->ia_valid & ATTR_SIZE) {
+ struct inode *realinode = d_inode(ovl_dentry_real(dentry));
+
+ err = -ETXTBSY;
+ if (atomic_read(&realinode->i_writecount) < 0)
+ goto out_drop_write;
+ }
+
err = ovl_copy_up(dentry);
if (!err) {
+ struct inode *winode = NULL;
+
upperdentry = ovl_dentry_upper(dentry);
+ if (attr->ia_valid & ATTR_SIZE) {
+ winode = d_inode(upperdentry);
+ err = get_write_access(winode);
+ if (err)
+ goto out_drop_write;
+ }
+
inode_lock(upperdentry->d_inode);
err = notify_change(upperdentry, attr, NULL);
if (!err)
ovl_copyattr(upperdentry->d_inode, dentry->d_inode);
inode_unlock(upperdentry->d_inode);
+
+ if (winode)
+ put_write_access(winode);
}
+out_drop_write:
ovl_drop_write(dentry);
out:
return err;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 186/203] ovl: Copy up underlying inodes ->i_mode to overlay inode
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (172 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 185/203] ovl: get_write_access() in truncate Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 187/203] ovl: handle ATTR_KILL* Greg Kroah-Hartman
` (19 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vivek Goyal, Eryu Guan, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vivek Goyal <vgoyal@redhat.com>
commit 07a2daab49c549a37b5b744cbebb6e3f445f12bc upstream.
Right now when a new overlay inode is created, we initialize overlay
inode's ->i_mode from underlying inode ->i_mode but we retain only
file type bits (S_IFMT) and discard permission bits.
This patch changes it and retains permission bits too. This should allow
overlay to do permission checks on overlay inode itself in task context.
[SzM] It also fixes clearing suid/sgid bits on write.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Reported-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/inode.c | 3 +--
fs/overlayfs/overlayfs.h | 1 +
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -423,12 +423,11 @@ struct inode *ovl_new_inode(struct super
if (!inode)
return NULL;
- mode &= S_IFMT;
-
inode->i_ino = get_next_ino();
inode->i_mode = mode;
inode->i_flags |= S_NOATIME | S_NOCMTIME;
+ mode &= S_IFMT;
switch (mode) {
case S_IFDIR:
inode->i_private = oe;
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -185,6 +185,7 @@ static inline void ovl_copyattr(struct i
{
to->i_uid = from->i_uid;
to->i_gid = from->i_gid;
+ to->i_mode = from->i_mode;
}
/* dir.c */
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 187/203] ovl: handle ATTR_KILL*
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (173 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 186/203] ovl: Copy up underlying inodes ->i_mode to overlay inode Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 188/203] ovl: verify upper dentry in ovl_remove_and_whiteout() Greg Kroah-Hartman
` (18 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eryu Guan, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit b99c2d913810e56682a538c9f2394d76fca808f8 upstream.
Before 4bacc9c9234c ("overlayfs: Make f_path...") file->f_path pointed to
the underlying file, hence suid/sgid removal on write worked fine.
After that patch file->f_path pointed to the overlay file, and the file
mode bits weren't copied to overlay_inode->i_mode. So the suid/sgid
removal simply stopped working.
The fix is to copy the mode bits, but then ovl_setattr() needs to clear
ATTR_MODE to avoid the BUG() in notify_change(). So do this first, then in
the next patch copy the mode.
Reported-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/inode.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -80,6 +80,9 @@ int ovl_setattr(struct dentry *dentry, s
goto out_drop_write;
}
+ if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
+ attr->ia_valid &= ~ATTR_MODE;
+
inode_lock(upperdentry->d_inode);
err = notify_change(upperdentry, attr, NULL);
if (!err)
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 188/203] ovl: verify upper dentry in ovl_remove_and_whiteout()
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (174 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 187/203] ovl: handle ATTR_KILL* Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 189/203] scsi: fix race between simultaneous decrements of ->host_failed Greg Kroah-Hartman
` (17 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Maxim Patlasov, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Patlasov <mpatlasov@virtuozzo.com>
commit cfc9fde0b07c3b44b570057c5f93dda59dca1c94 upstream.
The upper dentry may become stale before we call ovl_lock_rename_workdir.
For example, someone could (mistakenly or maliciously) manually unlink(2)
it directly from upperdir.
To ensure it is not stale, let's lookup it after ovl_lock_rename_workdir
and and check if it matches the upper dentry.
Essentially, it is the same problem and similar solution as in
commit 11f3710417d0 ("ovl: verify upper dentry before unlink and rename").
Signed-off-by: Maxim Patlasov <mpatlasov@virtuozzo.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/dir.c | 56 +++++++++++++++++++++++------------------------------
1 file changed, 25 insertions(+), 31 deletions(-)
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -511,6 +511,7 @@ static int ovl_remove_and_whiteout(struc
struct dentry *upper;
struct dentry *opaquedir = NULL;
int err;
+ int flags = 0;
if (WARN_ON(!workdir))
return -EROFS;
@@ -540,46 +541,39 @@ static int ovl_remove_and_whiteout(struc
if (err)
goto out_dput;
+ upper = lookup_one_len(dentry->d_name.name, upperdir,
+ dentry->d_name.len);
+ err = PTR_ERR(upper);
+ if (IS_ERR(upper))
+ goto out_unlock;
+
+ err = -ESTALE;
+ if ((opaquedir && upper != opaquedir) ||
+ (!opaquedir && ovl_dentry_upper(dentry) &&
+ upper != ovl_dentry_upper(dentry))) {
+ goto out_dput_upper;
+ }
+
whiteout = ovl_whiteout(workdir, dentry);
err = PTR_ERR(whiteout);
if (IS_ERR(whiteout))
- goto out_unlock;
+ goto out_dput_upper;
- upper = ovl_dentry_upper(dentry);
- if (!upper) {
- upper = lookup_one_len(dentry->d_name.name, upperdir,
- dentry->d_name.len);
- err = PTR_ERR(upper);
- if (IS_ERR(upper))
- goto kill_whiteout;
-
- err = ovl_do_rename(wdir, whiteout, udir, upper, 0);
- dput(upper);
- if (err)
- goto kill_whiteout;
- } else {
- int flags = 0;
-
- if (opaquedir)
- upper = opaquedir;
- err = -ESTALE;
- if (upper->d_parent != upperdir)
- goto kill_whiteout;
-
- if (is_dir)
- flags |= RENAME_EXCHANGE;
-
- err = ovl_do_rename(wdir, whiteout, udir, upper, flags);
- if (err)
- goto kill_whiteout;
+ if (d_is_dir(upper))
+ flags = RENAME_EXCHANGE;
+
+ err = ovl_do_rename(wdir, whiteout, udir, upper, flags);
+ if (err)
+ goto kill_whiteout;
+ if (flags)
+ ovl_cleanup(wdir, upper);
- if (is_dir)
- ovl_cleanup(wdir, upper);
- }
ovl_dentry_version_inc(dentry->d_parent);
out_d_drop:
d_drop(dentry);
dput(whiteout);
+out_dput_upper:
+ dput(upper);
out_unlock:
unlock_rename(workdir, upperdir);
out_dput:
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 189/203] scsi: fix race between simultaneous decrements of ->host_failed
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (175 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 188/203] ovl: verify upper dentry in ovl_remove_and_whiteout() Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 190/203] s390: fix test_fp_ctl inline assembly contraints Greg Kroah-Hartman
` (16 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wei Fang, James Bottomley,
Martin K. Petersen
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <fangwei1@huawei.com>
commit 72d8c36ec364c82bf1bf0c64dfa1041cfaf139f7 upstream.
sas_ata_strategy_handler() adds the works of the ata error handler to
system_unbound_wq. This workqueue asynchronously runs work items, so the
ata error handler will be performed concurrently on different CPUs. In
this case, ->host_failed will be decreased simultaneously in
scsi_eh_finish_cmd() on different CPUs, and become abnormal.
It will lead to permanently inequality between ->host_failed and
->host_busy, and scsi error handler thread won't start running. IO
errors after that won't be handled.
Since all scmds must have been handled in the strategy handler, just
remove the decrement in scsi_eh_finish_cmd() and zero ->host_busy after
the strategy handler to fix this race.
Fixes: 50824d6c5657 ("[SCSI] libsas: async ata-eh")
Signed-off-by: Wei Fang <fangwei1@huawei.com>
Reviewed-by: James Bottomley <jejb@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/scsi/scsi_eh.txt | 8 ++++++--
drivers/ata/libata-eh.c | 2 +-
drivers/scsi/scsi_error.c | 4 +++-
3 files changed, 10 insertions(+), 4 deletions(-)
--- a/Documentation/scsi/scsi_eh.txt
+++ b/Documentation/scsi/scsi_eh.txt
@@ -263,19 +263,23 @@ scmd->allowed.
3. scmd recovered
ACTION: scsi_eh_finish_cmd() is invoked to EH-finish scmd
- - shost->host_failed--
- clear scmd->eh_eflags
- scsi_setup_cmd_retry()
- move from local eh_work_q to local eh_done_q
LOCKING: none
+ CONCURRENCY: at most one thread per separate eh_work_q to
+ keep queue manipulation lockless
4. EH completes
ACTION: scsi_eh_flush_done_q() retries scmds or notifies upper
- layer of failure.
+ layer of failure. May be called concurrently but must have
+ a no more than one thread per separate eh_work_q to
+ manipulate the queue locklessly
- scmd is removed from eh_done_q and scmd->eh_entry is cleared
- if retry is necessary, scmd is requeued using
scsi_queue_insert()
- otherwise, scsi_finish_command() is invoked for scmd
+ - zero shost->host_failed
LOCKING: queue or finish function performs appropriate locking
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -606,7 +606,7 @@ void ata_scsi_error(struct Scsi_Host *ho
ata_scsi_port_error_handler(host, ap);
/* finish or retry handled scmd's and clean up */
- WARN_ON(host->host_failed || !list_empty(&eh_work_q));
+ WARN_ON(!list_empty(&eh_work_q));
DPRINTK("EXIT\n");
}
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -1127,7 +1127,6 @@ static int scsi_eh_action(struct scsi_cm
*/
void scsi_eh_finish_cmd(struct scsi_cmnd *scmd, struct list_head *done_q)
{
- scmd->device->host->host_failed--;
scmd->eh_eflags = 0;
list_move_tail(&scmd->eh_entry, done_q);
}
@@ -2226,6 +2225,9 @@ int scsi_error_handler(void *data)
else
scsi_unjam_host(shost);
+ /* All scmds have been handled */
+ shost->host_failed = 0;
+
/*
* Note - if the above fails completely, the action is to take
* individual devices offline and flush the queue of any
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 190/203] s390: fix test_fp_ctl inline assembly contraints
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (176 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 189/203] scsi: fix race between simultaneous decrements of ->host_failed Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 191/203] Revert "s390/kdump: Clear subchannel ID to signal non-CCW/SCSI IPL" Greg Kroah-Hartman
` (15 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Martin Schwidefsky
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
commit bcf4dd5f9ee096bd1510f838dd4750c35df4e38b upstream.
The test_fp_ctl function is used to test if a given value is a valid
floating-point control. The inline assembly in test_fp_ctl uses an
incorrect constraint for the 'orig_fpc' variable. If the compiler
chooses the same register for 'fpc' and 'orig_fpc' the test_fp_ctl()
function always returns true. This allows user space to trigger
kernel oopses with invalid floating-point control values on the
signal stack.
This problem has been introduced with git commit 4725c86055f5bbdcdf
"s390: fix save and restore of the floating-point-control register"
Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/fpu/api.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/include/asm/fpu/api.h
+++ b/arch/s390/include/asm/fpu/api.h
@@ -22,7 +22,7 @@ static inline int test_fp_ctl(u32 fpc)
" la %0,0\n"
"1:\n"
EX_TABLE(0b,1b)
- : "=d" (rc), "=d" (orig_fpc)
+ : "=d" (rc), "=&d" (orig_fpc)
: "d" (fpc), "0" (-EINVAL));
return rc;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 191/203] Revert "s390/kdump: Clear subchannel ID to signal non-CCW/SCSI IPL"
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (177 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 190/203] s390: fix test_fp_ctl inline assembly contraints Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 192/203] 53c700: fix BUG on untagged commands Greg Kroah-Hartman
` (14 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Steffen Maier, Michael Holzheu,
Heiko Carstens, Martin Schwidefsky
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Holzheu <holzheu@linux.vnet.ibm.com>
commit 5419447e2142d6ed68c9f5c1a28630b3a290a845 upstream.
This reverts commit 852ffd0f4e23248b47531058e531066a988434b5.
There are use cases where an intermediate boot kernel (1) uses kexec
to boot the final production kernel (2). For this scenario we should
provide the original boot information to the production kernel (2).
Therefore clearing the boot information during kexec() should not
be done.
Reported-by: Steffen Maier <maier@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/ipl.c | 7 -------
1 file changed, 7 deletions(-)
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -2064,12 +2064,5 @@ void s390_reset_system(void)
S390_lowcore.program_new_psw.addr =
(unsigned long) s390_base_pgm_handler;
- /*
- * Clear subchannel ID and number to signal new kernel that no CCW or
- * SCSI IPL has been done (for kexec and kdump)
- */
- S390_lowcore.subchannel_id = 0;
- S390_lowcore.subchannel_nr = 0;
-
do_reset_calls();
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 192/203] 53c700: fix BUG on untagged commands
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (178 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 191/203] Revert "s390/kdump: Clear subchannel ID to signal non-CCW/SCSI IPL" Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 193/203] Fix reconnect to not defer smb3 session reconnect long after socket reconnect Greg Kroah-Hartman
` (13 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Helge Deller, James Bottomley,
Johannes Thumshirn, Ewan D. Milne, Christoph Hellwig,
Martin K. Petersen
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Bottomley <jejb@linux.vnet.ibm.com>
commit 8beb330044d0d1878c7b92290e91c0b889e92633 upstream.
The untagged command case in the 53c700 driver has been broken since
host wide tags were enabled because the replaced scsi_find_tag()
function had a special case for the tag value SCSI_NO_TAG to retrieve
sdev->current_cmnd. The replacement function scsi_host_find_tag() has
no such special case and returns NULL causing untagged commands to
trigger a BUG() in the driver. Inspection shows that the 53c700 is the
only driver using this SCSI_NO_TAG case, so a local fix in the driver
suffices to fix this problem globally.
Fixes: 64d513ac31b - "scsi: use host wide tags by default"
Reported-by: Helge Deller <deller@gmx.de>
Tested-by: Helge Deller <deller@gmx.de>
Signed-off-by: James Bottomley <jejb@linux.vnet.ibm.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/53c700.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -1122,7 +1122,7 @@ process_script_interrupt(__u32 dsps, __u
} else {
struct scsi_cmnd *SCp;
- SCp = scsi_host_find_tag(SDp->host, SCSI_NO_TAG);
+ SCp = SDp->current_cmnd;
if(unlikely(SCp == NULL)) {
sdev_printk(KERN_ERR, SDp,
"no saved request for untagged cmd\n");
@@ -1826,7 +1826,7 @@ NCR_700_queuecommand_lck(struct scsi_cmn
slot->tag, slot);
} else {
slot->tag = SCSI_NO_TAG;
- /* must populate current_cmnd for scsi_host_find_tag to work */
+ /* save current command for reselection */
SCp->device->current_cmnd = SCp;
}
/* sanity check: some of the commands generated by the mid-layer
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 193/203] Fix reconnect to not defer smb3 session reconnect long after socket reconnect
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (179 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 192/203] 53c700: fix BUG on untagged commands Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 194/203] cifs: dynamic allocation of ntlmssp blob Greg Kroah-Hartman
` (12 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steve French, Pavel Shilovsky
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <smfrench@gmail.com>
commit 4fcd1813e6404dd4420c7d12fb483f9320f0bf93 upstream.
Azure server blocks clients that open a socket and don't do anything on it.
In our reconnect scenarios, we can reconnect the tcp session and
detect the socket is available but we defer the negprot and SMB3 session
setup and tree connect reconnection until the next i/o is requested, but
this looks suspicous to some servers who expect SMB3 negprog and session
setup soon after a socket is created.
In the echo thread, reconnect SMB3 sessions and tree connections
that are disconnected. A later patch will replay persistent (and
resilient) handle opens.
Signed-off-by: Steve French <steve.french@primarydata.com>
Acked-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/connect.c | 4 +++-
fs/cifs/smb2pdu.c | 27 +++++++++++++++++++++++++++
2 files changed, 30 insertions(+), 1 deletion(-)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -428,7 +428,9 @@ cifs_echo_request(struct work_struct *wo
* server->ops->need_neg() == true. Also, no need to ping if
* we got a response recently.
*/
- if (!server->ops->need_neg || server->ops->need_neg(server) ||
+
+ if (server->tcpStatus == CifsNeedReconnect ||
+ server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew ||
(server->ops->can_echo && !server->ops->can_echo(server)) ||
time_before(jiffies, server->lstrp + echo_interval - HZ))
goto requeue_echo;
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1818,6 +1818,33 @@ SMB2_echo(struct TCP_Server_Info *server
cifs_dbg(FYI, "In echo request\n");
+ if (server->tcpStatus == CifsNeedNegotiate) {
+ struct list_head *tmp, *tmp2;
+ struct cifs_ses *ses;
+ struct cifs_tcon *tcon;
+
+ cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
+ spin_lock(&cifs_tcp_ses_lock);
+ list_for_each(tmp, &server->smb_ses_list) {
+ ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
+ list_for_each(tmp2, &ses->tcon_list) {
+ tcon = list_entry(tmp2, struct cifs_tcon,
+ tcon_list);
+ /* add check for persistent handle reconnect */
+ if (tcon && tcon->need_reconnect) {
+ spin_unlock(&cifs_tcp_ses_lock);
+ rc = smb2_reconnect(SMB2_ECHO, tcon);
+ spin_lock(&cifs_tcp_ses_lock);
+ }
+ }
+ }
+ spin_unlock(&cifs_tcp_ses_lock);
+ }
+
+ /* if no session, renegotiate failed above */
+ if (server->tcpStatus == CifsNeedNegotiate)
+ return -EIO;
+
rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
if (rc)
return rc;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 194/203] cifs: dynamic allocation of ntlmssp blob
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (180 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 193/203] Fix reconnect to not defer smb3 session reconnect long after socket reconnect Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 195/203] File names with trailing period or space need special case conversion Greg Kroah-Hartman
` (11 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jerome Marchand, Steve French
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Marchand <jmarchan@redhat.com>
commit b8da344b74c822e966c6d19d6b2321efe82c5d97 upstream.
In sess_auth_rawntlmssp_authenticate(), the ntlmssp blob is allocated
statically and its size is an "empirical" 5*sizeof(struct
_AUTHENTICATE_MESSAGE) (320B on x86_64). I don't know where this value
comes from or if it was ever appropriate, but it is currently
insufficient: the user and domain name in UTF16 could take 1kB by
themselves. Because of that, build_ntlmssp_auth_blob() might corrupt
memory (out-of-bounds write). The size of ntlmssp_blob in
SMB2_sess_setup() is too small too (sizeof(struct _NEGOTIATE_MESSAGE)
+ 500).
This patch allocates the blob dynamically in
build_ntlmssp_auth_blob().
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/ntlmssp.h | 2 -
fs/cifs/sess.c | 76 +++++++++++++++++++++++++++++-------------------------
fs/cifs/smb2pdu.c | 10 +------
3 files changed, 45 insertions(+), 43 deletions(-)
--- a/fs/cifs/ntlmssp.h
+++ b/fs/cifs/ntlmssp.h
@@ -133,6 +133,6 @@ typedef struct _AUTHENTICATE_MESSAGE {
int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, struct cifs_ses *ses);
void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, struct cifs_ses *ses);
-int build_ntlmssp_auth_blob(unsigned char *pbuffer, u16 *buflen,
+int build_ntlmssp_auth_blob(unsigned char **pbuffer, u16 *buflen,
struct cifs_ses *ses,
const struct nls_table *nls_cp);
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -364,19 +364,43 @@ void build_ntlmssp_negotiate_blob(unsign
sec_blob->DomainName.MaximumLength = 0;
}
-/* We do not malloc the blob, it is passed in pbuffer, because its
- maximum possible size is fixed and small, making this approach cleaner.
- This function returns the length of the data in the blob */
-int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+static int size_of_ntlmssp_blob(struct cifs_ses *ses)
+{
+ int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
+ - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
+
+ if (ses->domainName)
+ sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
+ else
+ sz += 2;
+
+ if (ses->user_name)
+ sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
+ else
+ sz += 2;
+
+ return sz;
+}
+
+int build_ntlmssp_auth_blob(unsigned char **pbuffer,
u16 *buflen,
struct cifs_ses *ses,
const struct nls_table *nls_cp)
{
int rc;
- AUTHENTICATE_MESSAGE *sec_blob = (AUTHENTICATE_MESSAGE *)pbuffer;
+ AUTHENTICATE_MESSAGE *sec_blob;
__u32 flags;
unsigned char *tmp;
+ rc = setup_ntlmv2_rsp(ses, nls_cp);
+ if (rc) {
+ cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
+ *buflen = 0;
+ goto setup_ntlmv2_ret;
+ }
+ *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
+ sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
+
memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
sec_blob->MessageType = NtLmAuthenticate;
@@ -391,7 +415,7 @@ int build_ntlmssp_auth_blob(unsigned cha
flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
}
- tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE);
+ tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
sec_blob->NegotiateFlags = cpu_to_le32(flags);
sec_blob->LmChallengeResponse.BufferOffset =
@@ -399,13 +423,9 @@ int build_ntlmssp_auth_blob(unsigned cha
sec_blob->LmChallengeResponse.Length = 0;
sec_blob->LmChallengeResponse.MaximumLength = 0;
- sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer);
+ sec_blob->NtChallengeResponse.BufferOffset =
+ cpu_to_le32(tmp - *pbuffer);
if (ses->user_name != NULL) {
- rc = setup_ntlmv2_rsp(ses, nls_cp);
- if (rc) {
- cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
- goto setup_ntlmv2_ret;
- }
memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
ses->auth_key.len - CIFS_SESS_KEY_SIZE);
tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
@@ -423,7 +443,7 @@ int build_ntlmssp_auth_blob(unsigned cha
}
if (ses->domainName == NULL) {
- sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+ sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
sec_blob->DomainName.Length = 0;
sec_blob->DomainName.MaximumLength = 0;
tmp += 2;
@@ -432,14 +452,14 @@ int build_ntlmssp_auth_blob(unsigned cha
len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
CIFS_MAX_USERNAME_LEN, nls_cp);
len *= 2; /* unicode is 2 bytes each */
- sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+ sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
sec_blob->DomainName.Length = cpu_to_le16(len);
sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
tmp += len;
}
if (ses->user_name == NULL) {
- sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+ sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
sec_blob->UserName.Length = 0;
sec_blob->UserName.MaximumLength = 0;
tmp += 2;
@@ -448,13 +468,13 @@ int build_ntlmssp_auth_blob(unsigned cha
len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
CIFS_MAX_USERNAME_LEN, nls_cp);
len *= 2; /* unicode is 2 bytes each */
- sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+ sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
sec_blob->UserName.Length = cpu_to_le16(len);
sec_blob->UserName.MaximumLength = cpu_to_le16(len);
tmp += len;
}
- sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+ sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
sec_blob->WorkstationName.Length = 0;
sec_blob->WorkstationName.MaximumLength = 0;
tmp += 2;
@@ -463,19 +483,19 @@ int build_ntlmssp_auth_blob(unsigned cha
(ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
&& !calc_seckey(ses)) {
memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
- sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
+ sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
sec_blob->SessionKey.MaximumLength =
cpu_to_le16(CIFS_CPHTXT_SIZE);
tmp += CIFS_CPHTXT_SIZE;
} else {
- sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
+ sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
sec_blob->SessionKey.Length = 0;
sec_blob->SessionKey.MaximumLength = 0;
}
+ *buflen = tmp - *pbuffer;
setup_ntlmv2_ret:
- *buflen = tmp - pbuffer;
return rc;
}
@@ -1266,7 +1286,7 @@ sess_auth_rawntlmssp_authenticate(struct
struct cifs_ses *ses = sess_data->ses;
__u16 bytes_remaining;
char *bcc_ptr;
- char *ntlmsspblob = NULL;
+ unsigned char *ntlmsspblob = NULL;
u16 blob_len;
cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
@@ -1279,19 +1299,7 @@ sess_auth_rawntlmssp_authenticate(struct
/* Build security blob before we assemble the request */
pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
smb_buf = (struct smb_hdr *)pSMB;
- /*
- * 5 is an empirical value, large enough to hold
- * authenticate message plus max 10 of av paris,
- * domain, user, workstation names, flags, etc.
- */
- ntlmsspblob = kzalloc(5*sizeof(struct _AUTHENTICATE_MESSAGE),
- GFP_KERNEL);
- if (!ntlmsspblob) {
- rc = -ENOMEM;
- goto out;
- }
-
- rc = build_ntlmssp_auth_blob(ntlmsspblob,
+ rc = build_ntlmssp_auth_blob(&ntlmsspblob,
&blob_len, ses, sess_data->nls_cp);
if (rc)
goto out_free_ntlmsspblob;
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -588,7 +588,7 @@ SMB2_sess_setup(const unsigned int xid,
u16 blob_length = 0;
struct key *spnego_key = NULL;
char *security_blob = NULL;
- char *ntlmssp_blob = NULL;
+ unsigned char *ntlmssp_blob = NULL;
bool use_spnego = false; /* else use raw ntlmssp */
cifs_dbg(FYI, "Session Setup\n");
@@ -713,13 +713,7 @@ ssetup_ntlmssp_authenticate:
iov[1].iov_len = blob_length;
} else if (phase == NtLmAuthenticate) {
req->hdr.SessionId = ses->Suid;
- ntlmssp_blob = kzalloc(sizeof(struct _NEGOTIATE_MESSAGE) + 500,
- GFP_KERNEL);
- if (ntlmssp_blob == NULL) {
- rc = -ENOMEM;
- goto ssetup_exit;
- }
- rc = build_ntlmssp_auth_blob(ntlmssp_blob, &blob_length, ses,
+ rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses,
nls_cp);
if (rc) {
cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n",
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 195/203] File names with trailing period or space need special case conversion
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (181 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 194/203] cifs: dynamic allocation of ntlmssp blob Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 196/203] xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7 Greg Kroah-Hartman
` (10 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steve French, Pavel Shilovsky
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <smfrench@gmail.com>
commit 45e8a2583d97ca758a55c608f78c4cef562644d1 upstream.
POSIX allows files with trailing spaces or a trailing period but
SMB3 does not, so convert these using the normal Services For Mac
mapping as we do for other reserved characters such as
: < > | ? *
This is similar to what Macs do for the same problem over SMB3.
Signed-off-by: Steve French <steve.french@primarydata.com>
Acked-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifs_unicode.c | 33 +++++++++++++++++++++++++++++----
fs/cifs/cifs_unicode.h | 2 ++
2 files changed, 31 insertions(+), 4 deletions(-)
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -101,6 +101,12 @@ convert_sfm_char(const __u16 src_char, c
case SFM_SLASH:
*target = '\\';
break;
+ case SFM_SPACE:
+ *target = ' ';
+ break;
+ case SFM_PERIOD:
+ *target = '.';
+ break;
default:
return false;
}
@@ -404,7 +410,7 @@ static __le16 convert_to_sfu_char(char s
return dest_char;
}
-static __le16 convert_to_sfm_char(char src_char)
+static __le16 convert_to_sfm_char(char src_char, bool end_of_string)
{
__le16 dest_char;
@@ -427,6 +433,18 @@ static __le16 convert_to_sfm_char(char s
case '|':
dest_char = cpu_to_le16(SFM_PIPE);
break;
+ case '.':
+ if (end_of_string)
+ dest_char = cpu_to_le16(SFM_PERIOD);
+ else
+ dest_char = 0;
+ break;
+ case ' ':
+ if (end_of_string)
+ dest_char = cpu_to_le16(SFM_SPACE);
+ else
+ dest_char = 0;
+ break;
default:
dest_char = 0;
}
@@ -469,9 +487,16 @@ cifsConvertToUTF16(__le16 *target, const
/* see if we must remap this char */
if (map_chars == SFU_MAP_UNI_RSVD)
dst_char = convert_to_sfu_char(src_char);
- else if (map_chars == SFM_MAP_UNI_RSVD)
- dst_char = convert_to_sfm_char(src_char);
- else
+ else if (map_chars == SFM_MAP_UNI_RSVD) {
+ bool end_of_string;
+
+ if (i == srclen - 1)
+ end_of_string = true;
+ else
+ end_of_string = false;
+
+ dst_char = convert_to_sfm_char(src_char, end_of_string);
+ } else
dst_char = 0;
/*
* FIXME: We can not handle remapping backslash (UNI_SLASH)
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -64,6 +64,8 @@
#define SFM_LESSTHAN ((__u16) 0xF023)
#define SFM_PIPE ((__u16) 0xF027)
#define SFM_SLASH ((__u16) 0xF026)
+#define SFM_PERIOD ((__u16) 0xF028)
+#define SFM_SPACE ((__u16) 0xF029)
/*
* Mapping mechanism to use when one of the seven reserved characters is
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 196/203] xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (182 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 195/203] File names with trailing period or space need special case conversion Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 197/203] tmpfs: dont undo fallocate past its last page Greg Kroah-Hartman
` (9 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jan Beulich, David Vrabel
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <JBeulich@suse.com>
commit 6f2d9d99213514360034c6d52d2c3919290b3504 upstream.
As of Xen 4.7 PV CPUID doesn't expose either of CPUID[1].ECX[7] and
CPUID[0x80000007].EDX[7] anymore, causing the driver to fail to load on
both Intel and AMD systems. Doing any kind of hardware capability
checks in the driver as a prerequisite was wrong anyway: With the
hypervisor being in charge, all such checking should be done by it. If
ACPI data gets uploaded despite some missing capability, the hypervisor
is free to ignore part or all of that data.
Ditch the entire check_prereq() function, and do the only valid check
(xen_initial_domain()) in the caller in its place.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xen-acpi-processor.c | 35 +++--------------------------------
1 file changed, 3 insertions(+), 32 deletions(-)
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -423,36 +423,7 @@ upload:
return 0;
}
-static int __init check_prereq(void)
-{
- struct cpuinfo_x86 *c = &cpu_data(0);
-
- if (!xen_initial_domain())
- return -ENODEV;
-
- if (!acpi_gbl_FADT.smi_command)
- return -ENODEV;
- if (c->x86_vendor == X86_VENDOR_INTEL) {
- if (!cpu_has(c, X86_FEATURE_EST))
- return -ENODEV;
-
- return 0;
- }
- if (c->x86_vendor == X86_VENDOR_AMD) {
- /* Copied from powernow-k8.h, can't include ../cpufreq/powernow
- * as we get compile warnings for the static functions.
- */
-#define CPUID_FREQ_VOLT_CAPABILITIES 0x80000007
-#define USE_HW_PSTATE 0x00000080
- u32 eax, ebx, ecx, edx;
- cpuid(CPUID_FREQ_VOLT_CAPABILITIES, &eax, &ebx, &ecx, &edx);
- if ((edx & USE_HW_PSTATE) != USE_HW_PSTATE)
- return -ENODEV;
- return 0;
- }
- return -ENODEV;
-}
/* acpi_perf_data is a pointer to percpu data. */
static struct acpi_processor_performance __percpu *acpi_perf_data;
@@ -509,10 +480,10 @@ struct notifier_block xen_acpi_processor
static int __init xen_acpi_processor_init(void)
{
unsigned int i;
- int rc = check_prereq();
+ int rc;
- if (rc)
- return rc;
+ if (!xen_initial_domain())
+ return -ENODEV;
nr_acpi_bits = get_max_acpi_id() + 1;
acpi_ids_done = kcalloc(BITS_TO_LONGS(nr_acpi_bits), sizeof(unsigned long), GFP_KERNEL);
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 197/203] tmpfs: dont undo fallocate past its last page
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (183 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 196/203] xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7 Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 198/203] tmpfs: fix regression hang in fallocate undo Greg Kroah-Hartman
` (8 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anthony Romano, Vlastimil Babka,
Hugh Dickins, Brandon Philips, Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Romano <anthony.romano@coreos.com>
commit b9b4bb26af017dbe930cd4df7f9b2fc3a0497bfe upstream.
When fallocate is interrupted it will undo a range that extends one byte
past its range of allocated pages. This can corrupt an in-use page by
zeroing out its first byte. Instead, undo using the inclusive byte
range.
Fixes: 1635f6a74152f1d ("tmpfs: undo fallocation on failure")
Link: http://lkml.kernel.org/r/1462713387-16724-1-git-send-email-anthony.romano@coreos.com
Signed-off-by: Anthony Romano <anthony.romano@coreos.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Hugh Dickins <hughd@google.com>
Cc: Brandon Philips <brandon@ifup.co>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/shmem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2238,7 +2238,7 @@ static long shmem_fallocate(struct file
/* Remove the !PageUptodate pages we added */
shmem_undo_range(inode,
(loff_t)start << PAGE_SHIFT,
- (loff_t)index << PAGE_SHIFT, true);
+ ((loff_t)index << PAGE_SHIFT) - 1, true);
goto undone;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 198/203] tmpfs: fix regression hang in fallocate undo
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (184 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 197/203] tmpfs: dont undo fallocate past its last page Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 199/203] crypto: rsa-pkcs1pad - fix rsa-pkcs1pad request struct Greg Kroah-Hartman
` (7 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hugh Dickins, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugh Dickins <hughd@google.com>
commit 7f556567036cb7f89aabe2f0954b08566b4efb53 upstream.
The well-spotted fallocate undo fix is good in most cases, but not when
fallocate failed on the very first page. index 0 then passes lend -1
to shmem_undo_range(), and that has two bad effects: (a) that it will
undo every fallocation throughout the file, unrestricted by the current
range; but more importantly (b) it can cause the undo to hang, because
lend -1 is treated as truncation, which makes it keep on retrying until
every page has gone, but those already fully instantiated will never go
away. Big thank you to xfstests generic/269 which demonstrates this.
Fixes: b9b4bb26af01 ("tmpfs: don't undo fallocate past its last page")
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/shmem.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2236,9 +2236,11 @@ static long shmem_fallocate(struct file
NULL);
if (error) {
/* Remove the !PageUptodate pages we added */
- shmem_undo_range(inode,
- (loff_t)start << PAGE_SHIFT,
- ((loff_t)index << PAGE_SHIFT) - 1, true);
+ if (index > start) {
+ shmem_undo_range(inode,
+ (loff_t)start << PAGE_SHIFT,
+ ((loff_t)index << PAGE_SHIFT) - 1, true);
+ }
goto undone;
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 199/203] crypto: rsa-pkcs1pad - fix rsa-pkcs1pad request struct
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (185 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 198/203] tmpfs: fix regression hang in fallocate undo Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 200/203] crypto: qat - make qat_asym_algs.o depend on asn1 headers Greg Kroah-Hartman
` (6 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tadeusz Struk, Herbert Xu
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 87dcdebd6beb54f183ae874664ba47bf071ebf95 upstream.
To allow for child request context the struct akcipher_request child_req
needs to be at the end of the structure.
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/rsa-pkcs1pad.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/crypto/rsa-pkcs1pad.c
+++ b/crypto/rsa-pkcs1pad.c
@@ -102,10 +102,10 @@ struct pkcs1pad_inst_ctx {
};
struct pkcs1pad_request {
- struct akcipher_request child_req;
-
struct scatterlist in_sg[3], out_sg[2];
uint8_t *in_buf, *out_buf;
+
+ struct akcipher_request child_req;
};
static int pkcs1pad_set_pub_key(struct crypto_akcipher *tfm, const void *key,
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 200/203] crypto: qat - make qat_asym_algs.o depend on asn1 headers
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (186 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 199/203] crypto: rsa-pkcs1pad - fix rsa-pkcs1pad request struct Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 201/203] drm/i915: Revert DisplayPort fast link training feature Greg Kroah-Hartman
` (5 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jan Stancek, Herbert Xu
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Stancek <jstancek@redhat.com>
commit 81dc0365cfa7bc7c08a0e44d9ee04964df782e19 upstream.
Parallel build can sporadically fail because asn1 headers may
not be built yet by the time qat_asym_algs.o is compiled:
drivers/crypto/qat/qat_common/qat_asym_algs.c:55:32: fatal error: qat_rsapubkey-asn1.h: No such file or directory
#include "qat_rsapubkey-asn1.h"
Signed-off-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/qat/qat_common/Makefile | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/crypto/qat/qat_common/Makefile
+++ b/drivers/crypto/qat/qat_common/Makefile
@@ -2,6 +2,7 @@ $(obj)/qat_rsapubkey-asn1.o: $(obj)/qat_
$(obj)/qat_rsapubkey-asn1.h
$(obj)/qat_rsaprivkey-asn1.o: $(obj)/qat_rsaprivkey-asn1.c \
$(obj)/qat_rsaprivkey-asn1.h
+$(obj)/qat_asym_algs.o: $(obj)/qat_rsapubkey-asn1.h $(obj)/qat_rsaprivkey-asn1.h
clean-files += qat_rsapubkey-asn1.c qat_rsapubkey-asn1.h
clean-files += qat_rsaprivkey-asn1.c qat_rsaprivkey-asn1.h
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 201/203] drm/i915: Revert DisplayPort fast link training feature
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (187 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 200/203] crypto: qat - make qat_asym_algs.o depend on asn1 headers Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 202/203] ovl: Do d_type check only if work dir creation was successful Greg Kroah-Hartman
` (4 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jani Nikula, Mika Kahola, Joakim Tjernlund
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Kahola <mika.kahola@intel.com>
commit 34511dce4b35685d3988d5c8b100d11a068db5bd upstream.
It has been found out that in some HW combination the DisplayPort
fast link training feature caused screen flickering. Let's revert
this feature for now until we can ensure that the feature works for
all platforms.
This is a manual revert of commits 5fa836a9d859 ("drm/i915: DP link
training optimization") and 4e96c97742f4 ("drm/i915: eDP link training
optimization").
Fixes: 5fa836a9d859 ("drm/i915: DP link training optimization")
Fixes: 4e96c97742f4 ("drm/i915: eDP link training optimization")
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91393
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Mika Kahola <mika.kahola@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1466410226-19543-1-git-send-email-mika.kahola@intel.com
(cherry picked from commit 91df09d92ad82c8778ca218097bf827f154292ca)
Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_dp.c | 3 ---
drivers/gpu/drm/i915/intel_dp_link_training.c | 25 ++-----------------------
drivers/gpu/drm/i915/intel_drv.h | 2 --
3 files changed, 2 insertions(+), 28 deletions(-)
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -5022,9 +5022,6 @@ intel_dp_hpd_pulse(struct intel_digital_
intel_display_power_get(dev_priv, power_domain);
if (long_hpd) {
- /* indicate that we need to restart link training */
- intel_dp->train_set_valid = false;
-
if (!intel_digital_port_connected(dev_priv, intel_dig_port))
goto mst_fail;
--- a/drivers/gpu/drm/i915/intel_dp_link_training.c
+++ b/drivers/gpu/drm/i915/intel_dp_link_training.c
@@ -85,8 +85,7 @@ static bool
intel_dp_reset_link_train(struct intel_dp *intel_dp,
uint8_t dp_train_pat)
{
- if (!intel_dp->train_set_valid)
- memset(intel_dp->train_set, 0, sizeof(intel_dp->train_set));
+ memset(intel_dp->train_set, 0, sizeof(intel_dp->train_set));
intel_dp_set_signal_levels(intel_dp);
return intel_dp_set_link_train(intel_dp, dp_train_pat);
}
@@ -161,22 +160,6 @@ intel_dp_link_training_clock_recovery(st
break;
}
- /*
- * if we used previously trained voltage and pre-emphasis values
- * and we don't get clock recovery, reset link training values
- */
- if (intel_dp->train_set_valid) {
- DRM_DEBUG_KMS("clock recovery not ok, reset");
- /* clear the flag as we are not reusing train set */
- intel_dp->train_set_valid = false;
- if (!intel_dp_reset_link_train(intel_dp,
- DP_TRAINING_PATTERN_1 |
- DP_LINK_SCRAMBLING_DISABLE)) {
- DRM_ERROR("failed to enable link training\n");
- return;
- }
- continue;
- }
/* Check to see if we've tried the max voltage */
for (i = 0; i < intel_dp->lane_count; i++)
@@ -284,7 +267,6 @@ intel_dp_link_training_channel_equalizat
/* Make sure clock is still ok */
if (!drm_dp_clock_recovery_ok(link_status,
intel_dp->lane_count)) {
- intel_dp->train_set_valid = false;
intel_dp_link_training_clock_recovery(intel_dp);
intel_dp_set_link_train(intel_dp,
training_pattern |
@@ -301,7 +283,6 @@ intel_dp_link_training_channel_equalizat
/* Try 5 times, then try clock recovery if that fails */
if (tries > 5) {
- intel_dp->train_set_valid = false;
intel_dp_link_training_clock_recovery(intel_dp);
intel_dp_set_link_train(intel_dp,
training_pattern |
@@ -322,10 +303,8 @@ intel_dp_link_training_channel_equalizat
intel_dp_set_idle_link_train(intel_dp);
- if (channel_eq) {
- intel_dp->train_set_valid = true;
+ if (channel_eq)
DRM_DEBUG_KMS("Channel EQ done. DP Training successful\n");
- }
}
void intel_dp_stop_link_train(struct intel_dp *intel_dp)
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -811,8 +811,6 @@ struct intel_dp {
/* This is called before a link training is starterd */
void (*prepare_link_retrain)(struct intel_dp *intel_dp);
- bool train_set_valid;
-
/* Displayport compliance testing */
unsigned long compliance_test_type;
unsigned long compliance_test_data;
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 202/203] ovl: Do d_type check only if work dir creation was successful
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (188 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 201/203] drm/i915: Revert DisplayPort fast link training feature Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-25 20:56 ` [PATCH 4.6 203/203] ovl: warn instead of error if d_type is not supported Greg Kroah-Hartman
` (3 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vivek Goyal, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vivek Goyal <vgoyal@redhat.com>
commit 21765194cecf2e4514ad75244df459f188140a0f upstream.
d_type check requires successful creation of workdir as iterates
through work dir and expects work dir to be present in it. If that's
not the case, this check will always return d_type not supported even
if underlying filesystem might be supporting it.
So don't do this check if work dir creation failed in previous step.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/super.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1064,16 +1064,19 @@ static int ovl_fill_super(struct super_b
/*
* Upper should support d_type, else whiteouts are visible.
* Given workdir and upper are on same fs, we can do
- * iterate_dir() on workdir.
+ * iterate_dir() on workdir. This check requires successful
+ * creation of workdir in previous step.
*/
- err = ovl_check_d_type_supported(&workpath);
- if (err < 0)
- goto out_put_workdir;
+ if (ufs->workdir) {
+ err = ovl_check_d_type_supported(&workpath);
+ if (err < 0)
+ goto out_put_workdir;
- if (!err) {
- pr_err("overlayfs: upper fs needs to support d_type.\n");
- err = -EINVAL;
- goto out_put_workdir;
+ if (!err) {
+ pr_err("overlayfs: upper fs needs to support d_type.\n");
+ err = -EINVAL;
+ goto out_put_workdir;
+ }
}
}
^ permalink raw reply [flat|nested] 199+ messages in thread* [PATCH 4.6 203/203] ovl: warn instead of error if d_type is not supported
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (189 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 202/203] ovl: Do d_type check only if work dir creation was successful Greg Kroah-Hartman
@ 2016-07-25 20:56 ` Greg Kroah-Hartman
2016-07-26 1:49 ` [PATCH 4.6 000/203] 4.6.5-stable review Shuah Khan
` (2 subsequent siblings)
193 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-25 20:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vivek Goyal, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vivek Goyal <vgoyal@redhat.com>
commit e7c0b5991dd1be7b6f6dc2b54a15a0f47b64b007 upstream.
overlay needs underlying fs to support d_type. Recently I put in a
patch in to detect this condition and started failing mount if
underlying fs did not support d_type.
But this breaks existing configurations over kernel upgrade. Those who
are running docker (partially broken configuration) with xfs not
supporting d_type, are surprised that after kernel upgrade docker does
not run anymore.
https://github.com/docker/docker/issues/22937#issuecomment-229881315
So instead of erroring out, detect broken configuration and warn
about it. This should allow existing docker setups to continue
working after kernel upgrade.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 45aebeaf4f67 ("ovl: Ensure upper filesystem supports d_type")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/super.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1072,11 +1072,13 @@ static int ovl_fill_super(struct super_b
if (err < 0)
goto out_put_workdir;
- if (!err) {
- pr_err("overlayfs: upper fs needs to support d_type.\n");
- err = -EINVAL;
- goto out_put_workdir;
- }
+ /*
+ * We allowed this configuration and don't want to
+ * break users over kernel upgrade. So warn instead
+ * of erroring out.
+ */
+ if (!err)
+ pr_warn("overlayfs: upper fs needs to support d_type.\n");
}
}
^ permalink raw reply [flat|nested] 199+ messages in thread* Re: [PATCH 4.6 000/203] 4.6.5-stable review
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (190 preceding siblings ...)
2016-07-25 20:56 ` [PATCH 4.6 203/203] ovl: warn instead of error if d_type is not supported Greg Kroah-Hartman
@ 2016-07-26 1:49 ` Shuah Khan
2016-07-26 2:45 ` Greg Kroah-Hartman
2016-07-26 13:53 ` Guenter Roeck
[not found] ` <5797509f.c310c20a.959d6.31b3@mx.google.com>
193 siblings, 1 reply; 199+ messages in thread
From: Shuah Khan @ 2016-07-26 1:49 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, stable, Shuah Khan
On 07/25/2016 02:53 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.6.5 release.
> There are 203 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Jul 27 20:33:38 UTC 2016.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.6.5-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.6.y
> and the diffstat can be found below.
>
Compiled and booted on my test system. No dmesg regressions,
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 199+ messages in thread* Re: [PATCH 4.6 000/203] 4.6.5-stable review
2016-07-26 1:49 ` [PATCH 4.6 000/203] 4.6.5-stable review Shuah Khan
@ 2016-07-26 2:45 ` Greg Kroah-Hartman
0 siblings, 0 replies; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-26 2:45 UTC (permalink / raw)
To: Shuah Khan
Cc: linux-kernel, torvalds, akpm, linux, patches, stable, Shuah Khan
On Mon, Jul 25, 2016 at 07:49:58PM -0600, Shuah Khan wrote:
> On 07/25/2016 02:53 PM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.6.5 release.
> > There are 203 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed Jul 27 20:33:38 UTC 2016.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.6.5-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.6.y
> > and the diffstat can be found below.
> >
> Compiled and booted on my test system. No dmesg regressions,
Great, thanks for testing all of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 199+ messages in thread
* Re: [PATCH 4.6 000/203] 4.6.5-stable review
2016-07-25 20:53 [PATCH 4.6 000/203] 4.6.5-stable review Greg Kroah-Hartman
` (191 preceding siblings ...)
2016-07-26 1:49 ` [PATCH 4.6 000/203] 4.6.5-stable review Shuah Khan
@ 2016-07-26 13:53 ` Guenter Roeck
2016-07-26 14:23 ` Greg Kroah-Hartman
[not found] ` <5797509f.c310c20a.959d6.31b3@mx.google.com>
193 siblings, 1 reply; 199+ messages in thread
From: Guenter Roeck @ 2016-07-26 13:53 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah.kh, patches, stable
On 07/25/2016 01:53 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.6.5 release.
> There are 203 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Jul 27 20:33:38 UTC 2016.
> Anything received after that time might be too late.
>
Build results:
total: 148 pass: 146 fail: 2
Failed builds:
unicore32:defconfig
unicore32:allnoconfig
Qemu test results:
total: 107 pass: 107 fail: 0
unicore32 is still not fixed in mainline.
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 199+ messages in thread* Re: [PATCH 4.6 000/203] 4.6.5-stable review
2016-07-26 13:53 ` Guenter Roeck
@ 2016-07-26 14:23 ` Greg Kroah-Hartman
2016-07-26 15:48 ` Guenter Roeck
0 siblings, 1 reply; 199+ messages in thread
From: Greg Kroah-Hartman @ 2016-07-26 14:23 UTC (permalink / raw)
To: Guenter Roeck; +Cc: linux-kernel, torvalds, akpm, shuah.kh, patches, stable
On Tue, Jul 26, 2016 at 06:53:48AM -0700, Guenter Roeck wrote:
> On 07/25/2016 01:53 PM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.6.5 release.
> > There are 203 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed Jul 27 20:33:38 UTC 2016.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 148 pass: 146 fail: 2
> Failed builds:
> unicore32:defconfig
> unicore32:allnoconfig
>
> Qemu test results:
> total: 107 pass: 107 fail: 0
>
> unicore32 is still not fixed in mainline.
Does no one care about it?
Anyway, thanks for all of the testing results, much appreciated.
greg k-h
^ permalink raw reply [flat|nested] 199+ messages in thread
* Re: [PATCH 4.6 000/203] 4.6.5-stable review
2016-07-26 14:23 ` Greg Kroah-Hartman
@ 2016-07-26 15:48 ` Guenter Roeck
0 siblings, 0 replies; 199+ messages in thread
From: Guenter Roeck @ 2016-07-26 15:48 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuah.kh, patches, stable, Guan Xuetao
On Tue, Jul 26, 2016 at 07:23:57AM -0700, Greg Kroah-Hartman wrote:
> On Tue, Jul 26, 2016 at 06:53:48AM -0700, Guenter Roeck wrote:
> > On 07/25/2016 01:53 PM, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 4.6.5 release.
> > > There are 203 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Wed Jul 27 20:33:38 UTC 2016.
> > > Anything received after that time might be too late.
> > >
> >
> > Build results:
> > total: 148 pass: 146 fail: 2
> > Failed builds:
> > unicore32:defconfig
> > unicore32:allnoconfig
> >
> > Qemu test results:
> > total: 107 pass: 107 fail: 0
> >
> > unicore32 is still not fixed in mainline.
>
> Does no one care about it?
>
Good question. The fix has been in -next for a while.
Guenter
^ permalink raw reply [flat|nested] 199+ messages in thread
[parent not found: <5797509f.c310c20a.959d6.31b3@mx.google.com>]