linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 4.1 000/267] 4.1.4-stable review
@ 2015-07-31 19:37 Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 003/267] pinctrl: mvebu: armada-370: fix spi0 pin description Greg Kroah-Hartman
                   ` (244 more replies)
  0 siblings, 245 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah.kh, stable

This is the start of the stable review cycle for the 4.1.4 release.
There are 267 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun Aug  2 19:39:27 UTC 2015.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.4-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.1.4-rc1

Linus Torvalds <torvalds@linux-foundation.org>
    Fix firmware loader uevent buffer NULL pointer dereference

Joe Perches <joe@perches.com>
    hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead

Sanidhya Kashyap <sanidhya.gatech@gmail.com>
    hpfs: kstrdup() out of memory handling

Szabolcs Nagy <szabolcs.nagy@arm.com>
    ARM: 8397/1: fix vdsomunge not to depend on glibc specific error.h

Stephen Boyd <sboyd@codeaurora.org>
    ARM: 8393/1: smp: Fix suspicious RCU usage with ipi tracepoints

Srikar Dronamraju <srikar@linux.vnet.ibm.com>
    perf bench numa: Fix to show proper convergence stats

Christoffer Dall <christoffer.dall@linaro.org>
    arm64: Don't report clear pmds and puds as huge

Xi Wang <xi.wang@gmail.com>
    arm64: bpf: fix endianness conversion bugs

Xi Wang <xi.wang@gmail.com>
    arm64: bpf: fix out-of-bounds read in bpf2a64_offset()

Stephen Boyd <sboyd@codeaurora.org>
    ARM64: smp: Fix suspicious RCU usage with ipi tracepoints

Al Viro <viro@zeniv.linux.org.uk>
    p9_client_write(): avoid double p9_free_req()

Aaro Koskinen <aaro.koskinen@nokia.com>
    EDAC, octeon: Fix broken build due to model helper renames

Russell King <rmk+kernel@arm.linux.org.uk>
    ARM: dove: fix legacy dove IRQ numbers

Chris Wilson <chris@chris-wilson.co.uk>
    agp/intel: Fix typo in needs_ilk_vtd_wa()

Ilya Dryomov <idryomov@gmail.com>
    rbd: use GFP_NOIO in rbd_obj_request_create()

Al Viro <viro@zeniv.linux.org.uk>
    9p: don't leave a half-initialized inode sitting around

Al Viro <viro@zeniv.linux.org.uk>
    9p: forgetting to cancel request on interrupted zero-copy RPC

Trond Myklebust <trond.myklebust@primarydata.com>
    SUNRPC: Fix a memory leak in the backchannel code

Jeff Layton <jlayton@poochiereds.net>
    nfs: always update creds in mirror, even when we have an already connected ds

Jeff Layton <jlayton@poochiereds.net>
    nfs: fix potential credential leak in ff_layout_update_mirror_cred

Trond Myklebust <trond.myklebust@primarydata.com>
    NFS: Ensure we set NFS_CONTEXT_RESEND_WRITES when requeuing writes

Jeff Layton <jlayton@poochiereds.net>
    nfs: increase size of EXCHANGE_ID name string buffer

Olga Kornievskaia <kolga@netapp.com>
    fixing infinite OPEN loop in 4.0 stateid recovery

Chuck Lever <chuck.lever@oracle.com>
    NFS: Fix size of NFSACL SETACL operations

Trond Myklebust <trond.myklebust@primarydata.com>
    pNFS/flexfiles: Fix the reset of struct pgio_header when resending

Trond Myklebust <trond.myklebust@primarydata.com>
    pNFS: Fix a memory leak when attempted pnfs fails

Hai Li <hali@codeaurora.org>
    clk: qcom: Use parent rate when set rate to pixel RCG clock

Krzysztof Kozlowski <k.kozlowski@samsung.com>
    clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference

Stefan Wahren <stefan.wahren@i2se.com>
    clk: Fix JSON output in debugfs

Geert Uytterhoeven <geert@linux-m68k.org>
    gpiolib: Add missing dummies for the unified device properties interface

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    watchdog: omap: assert the counter being stopped before reprogramming

Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
    of: return NUMA_NO_NODE from fallback of_node_to_nid()

Miklos Szeredi <mszeredi@suse.cz>
    ovl: lookup whiteouts outside iterate_dir()

Pali Rohár <pali.rohar@gmail.com>
    dell-laptop: Fix allocating & freeing SMI buffer page

Jingoo Han <jingoohan1@gmail.com>
    of/address: use atomic allocation in pci_register_io_range()

Arnd Bergmann <arnd@arndb.de>
    ideapad: fix software rfkill setting

Dmitry Tunin <hanipouspilot@gmail.com>
    ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked

Damian Eppel <d.eppel@samsung.com>
    clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier

Alexander Duyck <alexander.h.duyck@redhat.com>
    e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size

Michal Kazior <michal.kazior@tieto.com>
    mac80211: prevent possible crypto tx tailroom corruption

Michal Kazior <michal.kazior@tieto.com>
    cfg80211: ignore netif running state when changing iftype

Eliad Peller <eliad@wizery.com>
    iwlwifi: mvm: fix ROC reference accounting

Chun-Yeow Yeoh <yeohchunyeow@gmail.com>
    mac80211: fix the beacon csa counter for mesh and ibss

Vasily Averin <vvs@virtuozzo.com>
    security_syslog() should be called once only

Chris Metcalf <cmetcalf@ezchip.com>
    __bitmap_parselist: fix bug in empty string handling

Daniel Borkmann <daniel@iogearbox.net>
    compiler-intel: fix wrong compiler barrier() macro

Jean Delvare <jdelvare@suse.de>
    firmware: dmi_scan: Only honor end-of-table for 64-bit tables

Takashi Iwai <tiwai@suse.de>
    PM / sleep: Increase default DPM watchdog timeout to 60

Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    mm/hugetlb: introduce minimum hugepage order

Arnd Bergmann <arnd@arndb.de>
    tty: remove platform_sysrq_reset_seq

Colin Ian King <colin.king@canonical.com>
    RDMA/ocrdma: fix double free on pd

Geert Uytterhoeven <geert+renesas@glider.be>
    PM / clk: Fix clock error check in __pm_clk_add()

Ulf Hansson <ulf.hansson@linaro.org>
    mmc: sdhci: Restore behavior while creating OCR mask

Ding Wang <justin.wang@spreadtrum.com>
    mmc: card: Fixup request missing in mmc_blk_issue_rw_rq

Arnd Bergmann <arnd@arndb.de>
    serial: samsung: only use earlycon for console

Jiang Liu <jiang.liu@linux.intel.com>
    ACPI / PCI: Fix regressions caused by resource_size_t overflow with 32-bit kernel

Lv Zheng <lv.zheng@intel.com>
    ACPICA: Tables: Enable default 64-bit FADT addresses favor

Lv Zheng <lv.zheng@intel.com>
    ACPICA: Tables: Fix an issue that FACS initialization is performed twice

Lv Zheng <lv.zheng@intel.com>
    ACPICA: Tables: Enable both 32-bit and 64-bit FACS

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    ACPI / LPSS: Fix up acpi_lpss_create_device()

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage

Dan Carpenter <dan.carpenter@oracle.com>
    ACPI / resources: free memory on error in add_region_before()

Ilya Dryomov <idryomov@gmail.com>
    crush: fix a bug in tree bucket decode

Miklos Szeredi <mszeredi@suse.cz>
    fuse: initialize fc->release before calling it

Stephen Smalley <sds@tycho.nsa.gov>
    selinux: fix mprotect PROT_EXEC regression caused by mm change

Paul Moore <pmoore@redhat.com>
    selinux: don't waste ebitmap space when importing NetLabel categories

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix file corruption after cloning inline extents

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix list transaction->pending_ordered corruption

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix memory leak in the extent_same ioctl

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix fsync data loss after append write

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix race between caching kthread and returning inode to inode cache

Filipe Manana <fdmanana@suse.com>
    Btrfs: use kmem_cache_free when freeing entry in inode cache

Firo Yang <firogm@gmail.com>
    md: fix a build warning

Omar Sandoval <osandov@osandov.com>
    Btrfs: don't invalidate root dentry when subvolume deletion fails

Stefan Wahren <stefan.wahren@i2se.com>
    ARM: dts: mx23: fix iio-hwmon support

Constantine Shulyupin <const@ctera.com>
    hwmon: (nct7802) fix visibility of temp3

Stevens, Nick <Nick.Stevens@digi.com>
    hwmon: (mcp3021) Fix broken output scaling

Goldwyn Rodrigues <rgoldwyn@suse.com>
    md: Skip cluster setup for dm-raid

NeilBrown <neilb@suse.de>
    md: unlock mddev_lock on an error path.

NeilBrown <neilb@suse.de>
    md: clear mddev->private when it has been freed.

Lior Amsalem <alior@marvell.com>
    dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup

Steven Rostedt (Red Hat) <rostedt@goodmis.org>
    tracing: Fix sample output of dynamic arrays

Steven Rostedt (Red Hat) <rostedt@goodmis.org>
    tracing: Have branch tracer use recursive field of task struct

Steven Rostedt (Red Hat) <rostedt@goodmis.org>
    tracing: Fix typo from "static inlin" to "static inline"

Steven Rostedt (Red Hat) <rostedt@goodmis.org>
    tracing/filter: Do not allow infix to exceed end of string

Steven Rostedt (Red Hat) <rostedt@goodmis.org>
    tracing/filter: Do not WARN on operand count going below zero

Mimi Zohar <zohar@linux.vnet.ibm.com>
    ima: update builtin policies

Mimi Zohar <zohar@linux.vnet.ibm.com>
    ima: extend "mask" policy matching support

Mimi Zohar <zohar@linux.vnet.ibm.com>
    ima: add support for new "euid" policy condition

Mimi Zohar <zohar@linux.vnet.ibm.com>
    ima: fix ima_show_template_data_ascii()

Mimi Zohar <zohar@linux.vnet.ibm.com>
    evm: labeling pseudo filesystems exception

Mimi Zohar <zohar@linux.vnet.ibm.com>
    ima: do not measure or appraise the NSFS filesystem

Dan Carpenter <dan.carpenter@oracle.com>
    ima: cleanup ima_init_policy() a little

Roberto Sassu <rsassu@suse.de>
    ima: skip measurement of cgroupfs files and update documentation

Colin Ian King <colin.king@canonical.com>
    KEYS: ensure we free the assoc array edit if edit is valid

Mimi Zohar <zohar@linux.vnet.ibm.com>
    KEYS: fix "ca_keys=" partial key matching

Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    tpm, tpm_crb: fail when TPM2 ACPI table contents look corrupted

Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
    tpm: Fix initialization of the cdev

Hon Ching \\(Vicky\\) Lo <honclo@linux.vnet.ibm.com>
    vTPM: set virtual device before passing to ibmvtpm_reset_crq

Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    tpm, tpm_crb: fix le64_to_cpu conversions in crb_acpi_add()

David Fries <David@Fries.net>
    w1_therm reference count family data

Brian Foster <bfoster@redhat.com>
    xfs: don't truncate attribute extents if no extents exist

Eric Sandeen <sandeen@redhat.com>
    xfs: fix remote symlinks on V5/CRC filesystems

Martin K. Petersen <martin.petersen@oracle.com>
    libata: Fix regression when the NCQ Send and Receive log page is absent

Daniel Vetter <daniel.vetter@ffwll.ch>
    drm: Stop resetting connector state to unknown

Tvrtko Ursulin <tvrtko.ursulin@intel.com>
    drm: Provide compat ioctl for addfb2.1

Zhao Junwang <zhjwpku@gmail.com>
    drm: add a check for x/y in drm_mode_setcrtc

Daniel Kurtz <djkurtz@chromium.org>
    drm/rockchip: use drm_gem_mmap helpers

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon/ci: silence a harmless PCC warning

Christian König <christian.koenig@amd.com>
    drm/radeon: fix user ptr race condition

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5

Michel Dänzer <michel.daenzer@amd.com>
    drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL

Grigori Goronzy <greg@chown.ath.cx>
    drm/radeon: unpin cursor BOs on suspend and pin them again on resume (v2)

Michel Dänzer <michel.daenzer@amd.com>
    drm/radeon: Clean up reference counting and pinning of the cursor BOs

Mario Kleiner <mario.kleiner.de@gmail.com>
    drm/radeon: Handle irqs only based on irq ring, not irq status regs.

Grigori Goronzy <greg@chown.ath.cx>
    drm/radeon: fix HDP flushing

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: only check the sink type on DP connectors

Alex Deucher <alexander.deucher@amd.com>
    Revert "drm/radeon: dont switch vt on suspend"

Jérôme Glisse <jglisse@redhat.com>
    drm/radeon: SDMA fix hibernation (CI GPU family).

Jérôme Glisse <jglisse@redhat.com>
    drm/radeon: compute ring fix hibernation (CI GPU family) v2.

Chris Wilson <chris@chris-wilson.co.uk>
    drm/i915: Use two 32bit reads for select 64bit REG_READ ioctls

Daniel Vetter <daniel.vetter@ffwll.ch>
    Revert "drm/i915: Declare the swizzling unknown for L-shaped configurations"

Tvrtko Ursulin <tvrtko.ursulin@intel.com>
    drm/i915: Forward all core DRM ioctls to core compat handling

Tomas Elf <tomas.elf@intel.com>
    drm/i915: Snapshot seqno of most recently submitted request.

Chris Wilson <chris@chris-wilson.co.uk>
    drm/i915: Declare the swizzling unknown for L-shaped configurations

Jani Nikula <jani.nikula@intel.com>
    drm/i915: fix backlight after resume on 855gm

Rodrigo Vivi <rodrigo.vivi@intel.com>
    drm/i915: Fix IPS related flicker

Michel Thierry <michel.thierry@intel.com>
    drm/i915/ppgtt: Break loop in gen8_ppgtt_clear_range failure path

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: clean up radeon_audio_enable

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: take the mode_config mutex when dealing with hpds (v2)

Andrey Ryabinin <a.ryabinin@samsung.com>
    drm/atomic: fix out of bounds read in for_each_*_in_state helpers

Geert Uytterhoeven <geert@linux-m68k.org>
    drm/bridge: ptn3460: Include linux/gpio/consumer.h

Frediano Ziglio <fziglio@redhat.com>
    drm/qxl: Do not leak memory if qxl_release_list_add fails

Frediano Ziglio <fziglio@redhat.com>
    drm/qxl: Do not cause spice-server to clean our objects

Thierry Reding <treding@nvidia.com>
    drm/tegra: dpaux: Fix transfers larger than 4 bytes

Daniel Vetter <daniel.vetter@ffwll.ch>
    drm/dp/mst: make sure mst_primary mstb is valid in work function

Dave Airlie <airlied@redhat.com>
    drm/dp/mst: take lock around looking up the branch device on hpd irq

Dave Airlie <airlied@redhat.com>
    drm/dp/mst: close deadlock in connector destruction.

Daniel Vetter <daniel.vetter@ffwll.ch>
    drm/vgem: Set unique to "vgem"

Pawel Moll <pawel.moll@arm.com>
    bus: arm-ccn: Fix node->XP config conversion

Boris Brezillon <boris.brezillon@free-electrons.com>
    ARM: at91/dt: update udc compatible strings

Nicolas Ferre <nicolas.ferre@atmel.com>
    ARM: at91/dt: trivial: fix USB udc compatible string

Nicolas Ferre <nicolas.ferre@atmel.com>
    tty/serial: at91: RS485 mode: 0 is valid for delay_rts_after_send

ludovic.desroches@atmel.com <ludovic.desroches@atmel.com>
    ARM: at91/dt: sama5d4: fix dma conf for aes, sha and tdes nodes

Ludovic Desroches <ludovic.desroches@atmel.com>
    ARM: at91/dt: sama5d4ek: mci0 uses slot 0

Martin K. Petersen <martin.petersen@oracle.com>
    block: Do a full clone when splitting discard bios

Ming Lei <ming.lei@canonical.com>
    block: loop: avoiding too many pending per work I/O

Ming Lei <ming.lei@canonical.com>
    block: loop: convert to per-device workqueue

Tomas Winkler <tomas.winkler@intel.com>
    mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()

Joe Thornber <ejt@redhat.com>
    dm btree: silence lockdep lock inversion in dm_btree_del()

Joe Thornber <ejt@redhat.com>
    dm thin: allocate the cell_sort_array dynamically

Dennis Yang <shinrairis@gmail.com>
    dm btree remove: fix bug in redistribute3

Joe Thornber <ejt@redhat.com>
    dm space map metadata: fix occasional leak of a metadata block on resize

Mikulas Patocka <mpatocka@redhat.com>
    dm stats: fix divide by zero if 'number_of_areas' arg is zero

Joe Thornber <ejt@redhat.com>
    dm cache: fix race when issuing a POLICY_REPLACE operation

AMAN DEEP <aman.deep@samsung.com>
    usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function

Lu Baolu <baolu.lu@linux.intel.com>
    usb: core: lpm: set lpm_capable for root hub device

Alan Stern <stern@rowland.harvard.edu>
    USB: OHCI: Fix race between ED unlink and URB submission

Johannes Thumshirn <jthumshirn@suse.de>
    USB: serial: Destroy serial_minors IDR on module exit

Claudio Cappelli <claudio.cappelli.linux@gmail.com>
    USB: option: add 2020:4000 ID

Peter Sanford <peter@sanford.io>
    USB: cp210x: add ID for Aruba Networks controllers

Felipe Balbi <balbi@ti.com>
    usb: musb: host: rely on port_mode to call musb_start()

Michal Nazarewicz <mina86@mina86.com>
    usb: f_mass_storage: limit number of reported LUNs

Alexey Khoroshilov <khoroshilov@ispras.ru>
    usb: gadget: mv_udc_core: fix phy_regs I/O memory leak

Rui Miguel Silva <rui.silva@linaro.org>
    usb: gadget: f_fs: do not set cancel function on synchronous {read,write}

Kishon Vijay Abraham I <kishon@ti.com>
    usb: gadget: composite: Fix NULL pointer dereference

Thomas Hebb <tommyhebb@gmail.com>
    phy: berlin-usb: fix divider for BG2CD

Stefan Wahren <stefan.wahren@i2se.com>
    usb: phy: mxs: suspend to RAM causes NULL pointer dereference

NeilBrown <neil@brown.name>
    phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.

Dan Carpenter <dan.carpenter@oracle.com>
    USB: devio: fix a condition in async_completed()

Robert Schlabbach <Robert.Schlabbach@gmx.net>
    usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset

John Youn <John.Youn@synopsys.com>
    usb: dwc3: Reset the transfer resource index on SET_INTERFACE

Felipe Balbi <balbi@ti.com>
    usb: dwc3: gadget: don't clear EP_BUSY too early

Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
    usb: dwc3: gadget: return error if command sent to DEPCMD register fails

Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
    usb: dwc3: gadget: return error if command sent to DGCMD register fails

Arne Fitzenreiter <arne_f@ipfire.org>
    libata: force disable trim for SuperSSpeed S238

Martin K. Petersen <martin.petersen@oracle.com>
    libata: Do not blacklist M510DC

David Milburn <dmilburn@redhat.com>
    libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit

Arne Fitzenreiter <arne_f@ipfire.org>
    libata: add ATA_HORKAGE_NOTRIM

Martin K. Petersen <martin.petersen@oracle.com>
    libata: Expose TRIM capability in sysfs

Martin K. Petersen <martin.petersen@oracle.com>
    libata: Fall back to unqueued READ LOG EXT if the DMA variant fails

Mikulas Patocka <mpatocka@redhat.com>
    libata: increase the timeout when setting transfer mode

Aleksei Mamlin <mamlinav@gmail.com>
    libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER

Martin K. Petersen <martin.petersen@oracle.com>
    libata: Do not blacklist Micron M500DC

Peter Ujfalusi <peter.ujfalusi@ti.com>
    ASoC: tas2552: Fix kernel crash caused by wrong kcontrol entry

Peter Ujfalusi <peter.ujfalusi@ti.com>
    ASoC: tas2552: Fix kernel crash when the codec is loaded but not part of a card

Zidan Wang <zidan.wang@freescale.com>
    ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1]

Axel Lin <axel.lin@ingics.com>
    ASoC: wm8903: Fix define for WM8903_VMID_RES_250K

Axel Lin <axel.lin@ingics.com>
    ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits

Axel Lin <axel.lin@ingics.com>
    ASoC: wm8737: Fixup setting VMID Impedance control register

Arnd Bergmann <arnd@arndb.de>
    ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency, again

Dan Carpenter <dan.carpenter@oracle.com>
    ASoC: imx-wm8962: Add a missing error check

Arnd Bergmann <arnd@arndb.de>
    ASoC: qcom: remove incorrect dependencies

Axel Lin <axel.lin@ingics.com>
    ASoC: max98925: Fix mask for setting DAI invert mode

Nicolas Boichat <drinkcat@chromium.org>
    ASoC: rt5645: Init jack_detect_work before registering irq

Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
    ASoC: arizona: Fix noise generator gain TLV

Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    cx24116: fix a buffer overflow when checking userspace params

Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    s5h1420: fix a buffer overflow when checking userspace params

Hans Verkuil <hverkuil@xs4all.nl>
    saa7164: fix querycap warning

Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    af9013: Don't accept invalid bandwidth

Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    cx24117: fix a buffer overflow when checking userspace params

Hans Verkuil <hverkuil@xs4all.nl>
    cx18: add missing caps for the PCM video device

David Härdeman <david@hardeman.nu>
    rc-core: fix dib0700 scancode generation for RC5

Thomas Reitmayr <treitmayr@devbase.at>
    media: Fix regression in some more dib0700 based devices

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    vb2: Don't WARN when v4l2_buffer.bytesused is 0 for multiplanar buffers

Jan Leupold <leupold@rsi-elektrotechnik.de>
    iio: adc: at91_adc: allow to use full range of startup time

Heiko Stuebner <heiko@sntech.de>
    iio: adc: rockchip_saradc: add missing MODULE_* data

Daniel Baluta <daniel.baluta@intel.com>
    iio: proximity: sx9500: Fix proximity value

Daniel Baluta <daniel.baluta@intel.com>
    iio: ABI: Clarify proximity output value

Fabio Estevam <fabio.estevam@freescale.com>
    iio: twl4030-madc: Pass the IRQF_ONESHOT flag

Peter Meerwald <pmeerw@pmeerw.net>
    iio: tmp006: Check channel info on write

Adriana Reus <adriana.reus@intel.com>
    iio: inv-mpu: Specify the expected format/precision for write channels

JM Friedt <jmfriedt@femto-st.fr>
    iio: DAC: ad5624r_spi: fix bit shift of output data value

Peter Meerwald <pmeerw@pmeerw.net>
    iio: light: tcs3414: Fix bug preventing to set integration time

Hartmut Knaack <knaack.h@gmx.de>
    iio:accel:bmc150-accel: fix counting direction

Hartmut Knaack <knaack.h@gmx.de>
    iio:adc:cc10001_adc: fix Kconfig dependency

Hartmut Knaack <knaack.h@gmx.de>
    iio:light:cm3323: clear bitmask before set

Alexander Sverdlin <alexander.sverdlin@nokia.com>
    i2c: use parent adapter quirks in mux

Alexander Sverdlin <alexander.sverdlin@nokia.com>
    i2c: mux: pca954x: Use __i2c_transfer because of quirks

Alexander Sverdlin <alexander.sverdlin@nokia.com>
    i2c: mux: Use __i2c_transfer() instead of calling parent's master_xfer()

Cyrille Pitchen <cyrille.pitchen@atmel.com>
    i2c: at91: fix a race condition when using the DMA controller

Stefan Agner <stefan@agner.ch>
    rtc: snvs: fix wakealarm by call enable_irq_wake earlier

Christophe Ricard <christophe.ricard@gmail.com>
    NFC: st21nfcb: remove st21nfcb_nci_i2c_disable

Christophe Ricard <christophe.ricard@gmail.com>
    NFC: st21nfcb: Do not remove header once the payload is sent

Firo Yang <firogm@gmail.com>
    NFC: st21nfcb: Remove inappropriate kfree on a devm_kzalloc pointer

Joseph Qi <joseph.qi@huawei.com>
    jbd2: fix ocfs2 corrupt when updating journal superblock fails

Dmitry Monakhov <dmonakhov@openvz.org>
    jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail()

Michal Hocko <mhocko@suse.cz>
    ext4: replace open coded nofail allocation in ext4_free_blocks()

Eryu Guan <guaneryu@gmail.com>
    ext4: correctly migrate a file with a hole at the beginning

Eryu Guan <guaneryu@gmail.com>
    ext4: be more strict when migrating to non-extent based file

Lukas Czerner <lczerner@redhat.com>
    ext4: fix reservation release on invalidatepage for delalloc fs

Nikolay Borisov <kernel@kyup.com>
    ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp

Nikolay Borisov <kernel@kyup.com>
    bufferhead: Add _gfp version for sb_getblk()

Theodore Ts'o <tytso@mit.edu>
    ext4: fix fencepost error in lazytime optimization

Theodore Ts'o <tytso@mit.edu>
    ext4: set lazytime on remount if MS_LAZYTIME is set by mount

Darrick J. Wong <darrick.wong@oracle.com>
    ext4: don't retry file block mapping on bigalloc fs with non-extent file

Theodore Ts'o <tytso@mit.edu>
    ext4: call sync_blockdev() before invalidate_bdev() in put_super()

Theodore Ts'o <tytso@mit.edu>
    ext4: fix race between truncate and __ext4_journalled_writepage()

Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
    hid-sensor: Fix suspend/resume delay

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: cb_pcimdas: fix handlers for DI and DO subdevices

Haggai Eran <haggai.eran@gmail.com>
    staging: rtl8712: prevent buffer overrun in recvbuf2recvframe

Malcolm Priestley <tvboxspy@gmail.com>
    staging: vt6655: device_rx_srv check sk_buff is NULL

Malcolm Priestley <tvboxspy@gmail.com>
    staging: vt6655: check ieee80211_bss_conf bssid not NULL

Malcolm Priestley <tvboxspy@gmail.com>
    staging: vt6656: check ieee80211_bss_conf bssid not NULL

Lennert Buytenhek <buytenh@wantstofly.org>
    ieee802154: Fix sockaddr_ieee802154 implicit padding information leak.

Vincent Fann <vincent_fann@realtek.com>
    rtlwifi: Remove the clear interrupt routine from all drivers

Dan Carpenter <dan.carpenter@oracle.com>
    ath9k_htc: memory corruption calling set_bit()

Felix Fietkau <nbd@openwrt.org>
    ath9k: fix DMA stop sequence for AR9003+

Chris Mason <clm@fb.com>
    Bluetooth: btbcm: allow btbcm_read_verbose_config to fail on Apple

Aleksei Volkov <info@dv2c.ru>
    Bluetooth: btusb: Correct typo in Roper Class 1 Bluetooth Dongle

Marcel Holtmann <marcel@holtmann.org>
    Bluetooth: btusb: Fix secure send command length alignment on Intel 8260

Marcel Holtmann <marcel@holtmann.org>
    Bluetooth: btusb: Fix memory leak in Intel setup routine

Marcel Holtmann <marcel@holtmann.org>
    Bluetooth: Fix race condition with user channel and setup stage

Greg Ungerer <gerg@uclinux.org>
    m68knommu: force setting of CONFIG_CLOCK_FREQ for ColdFire

Greg Ungerer <gerg@uclinux.org>
    m68knommu: make ColdFire SoC selection a choice

Andrew Morton <akpm@linux-foundation.org>
    openrisc: fix CONFIG_UID16 setting

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    pinctrl: mvebu: armada-xp: fix functions of MPP48

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    pinctrl: mvebu: armada-xp: remove non-existing NAND pins

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    pinctrl: mvebu: armada-39x: fix incorrect total number of GPIOs

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    pinctrl: mvebu: armada-38x: fix PCIe functions

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    pinctrl: mvebu: armada-375: remove incorrect space in pin description

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    pinctrl: mvebu: armada-370: fix spi0 pin description

Masahiro Yamada <yamada.masahiro@socionext.com>
    pinctrl: zynq: fix offset address for {SD0,SD1}_WP_CD_SEL

Masahiro Yamada <yamada.masahiro@socionext.com>
    pinctrl: zynq: fix DEFINE_ZYNQ_PINMUX_FUNCTION_MUX macro


-------------

Diffstat:

 Documentation/ABI/testing/ima_policy               |  26 +-
 Documentation/ABI/testing/sysfs-ata                |  11 +
 Documentation/ABI/testing/sysfs-bus-iio            |   6 +-
 .../pinctrl/marvell,armada-370-pinctrl.txt         |   4 +-
 .../pinctrl/marvell,armada-375-pinctrl.txt         |   4 +-
 .../pinctrl/marvell,armada-38x-pinctrl.txt         |  38 +-
 .../bindings/pinctrl/marvell,armada-xp-pinctrl.txt |  32 +-
 .../devicetree/bindings/usb/atmel-usb.txt          |   6 +-
 Documentation/kernel-parameters.txt                |  10 +-
 Makefile                                           |   4 +-
 arch/arm/boot/dts/at91-sama5d4ek.dts               |   4 +-
 arch/arm/boot/dts/at91sam9g45.dtsi                 |   2 +-
 arch/arm/boot/dts/at91sam9x5.dtsi                  |   2 +-
 arch/arm/boot/dts/imx23.dtsi                       |   1 +
 arch/arm/boot/dts/sama5d3.dtsi                     |   2 +-
 arch/arm/boot/dts/sama5d4.dtsi                     |  22 +-
 arch/arm/kernel/smp.c                              |   4 +-
 arch/arm/mach-dove/include/mach/irqs.h             | 118 +++----
 arch/arm/mach-dove/irq.c                           |   8 +-
 arch/arm/vdso/vdsomunge.c                          |  56 +--
 arch/arm64/kernel/smp.c                            |   4 +-
 arch/arm64/mm/hugetlbpage.c                        |   4 +-
 arch/arm64/net/bpf_jit.h                           |   4 +
 arch/arm64/net/bpf_jit_comp.c                      |  29 +-
 arch/m68k/Kconfig.cpu                              |  41 +--
 arch/m68k/include/asm/coldfire.h                   |   2 +-
 arch/openrisc/Kconfig                              |   4 +-
 block/bio.c                                        |  15 +-
 crypto/asymmetric_keys/asymmetric_keys.h           |   3 +
 crypto/asymmetric_keys/asymmetric_type.c           |  20 +-
 crypto/asymmetric_keys/x509_public_key.c           |  23 +-
 drivers/acpi/acpi_lpss.c                           |   7 +-
 drivers/acpi/acpica/aclocal.h                      |   1 +
 drivers/acpi/acpica/tbfadt.c                       |  21 +-
 drivers/acpi/acpica/tbutils.c                      |  34 +-
 drivers/acpi/acpica/tbxfload.c                     |   3 +-
 drivers/acpi/acpica/utxfinit.c                     |  10 +-
 drivers/acpi/osl.c                                 |  12 +-
 drivers/acpi/resource.c                            | 184 +---------
 drivers/ata/libata-core.c                          |  23 +-
 drivers/ata/libata-eh.c                            |  13 +-
 drivers/ata/libata-scsi.c                          |   3 +-
 drivers/ata/libata-transport.c                     |  24 ++
 drivers/base/firmware_class.c                      |  16 +-
 drivers/base/power/clock_ops.c                     |   2 +-
 drivers/block/loop.c                               |  30 +-
 drivers/block/loop.h                               |   1 +
 drivers/block/rbd.c                                |   4 +-
 drivers/bluetooth/btbcm.c                          |  11 +-
 drivers/bluetooth/btusb.c                          |  38 +-
 drivers/bus/arm-ccn.c                              |   2 +-
 drivers/char/agp/intel-gtt.c                       |   2 +-
 drivers/char/tpm/tpm-chip.c                        |   3 +-
 drivers/char/tpm/tpm_crb.c                         |  12 +-
 drivers/char/tpm/tpm_ibmvtpm.c                     |   5 +-
 drivers/clk/clk.c                                  |   5 +-
 drivers/clk/qcom/clk-rcg2.c                        |   9 +-
 drivers/clk/ti/clk-dra7-atl.c                      |   5 +
 drivers/clocksource/exynos_mct.c                   |  43 ++-
 drivers/dma/mv_xor.c                               |  72 ++--
 drivers/dma/mv_xor.h                               |   1 +
 drivers/edac/octeon_edac-l2c.c                     |   2 +-
 drivers/edac/octeon_edac-lmc.c                     |   2 +-
 drivers/edac/octeon_edac-pc.c                      |   2 +-
 drivers/firmware/dmi_scan.c                        |  13 +-
 drivers/gpu/drm/bridge/ptn3460.c                   |   1 +
 drivers/gpu/drm/drm_crtc.c                         |  12 +-
 drivers/gpu/drm/drm_dp_mst_topology.c              |  67 +++-
 drivers/gpu/drm/drm_ioc32.c                        |  60 ++++
 drivers/gpu/drm/i915/i915_gem.c                    |   1 +
 drivers/gpu/drm/i915/i915_gem_gtt.c                |   6 +-
 drivers/gpu/drm/i915/i915_ioc32.c                  |   2 +-
 drivers/gpu/drm/i915/i915_irq.c                    |  13 +-
 drivers/gpu/drm/i915/i915_reg.h                    |   1 +
 drivers/gpu/drm/i915/intel_display.c               |  13 +
 drivers/gpu/drm/i915/intel_drv.h                   |   1 +
 drivers/gpu/drm/i915/intel_panel.c                 |   8 +
 drivers/gpu/drm/i915/intel_ringbuffer.h            |   7 +
 drivers/gpu/drm/i915/intel_uncore.c                |  26 +-
 drivers/gpu/drm/qxl/qxl_cmd.c                      |   1 +
 drivers/gpu/drm/qxl/qxl_ioctl.c                    |   4 +-
 drivers/gpu/drm/radeon/ci_dpm.c                    |   2 +-
 drivers/gpu/drm/radeon/cik.c                       | 370 +++++++++++--------
 drivers/gpu/drm/radeon/cik_sdma.c                  |  11 +
 drivers/gpu/drm/radeon/evergreen.c                 | 392 ++++++++++++---------
 drivers/gpu/drm/radeon/r600.c                      | 155 ++++----
 drivers/gpu/drm/radeon/radeon_audio.c              |  36 +-
 drivers/gpu/drm/radeon/radeon_audio.h              |   2 -
 drivers/gpu/drm/radeon/radeon_cursor.c             |  84 ++---
 drivers/gpu/drm/radeon/radeon_device.c             |  34 +-
 drivers/gpu/drm/radeon/radeon_fb.c                 |   1 -
 drivers/gpu/drm/radeon/radeon_gart.c               |  12 +-
 drivers/gpu/drm/radeon/radeon_gem.c                |   2 +
 drivers/gpu/drm/radeon/radeon_irq_kms.c            |   2 +
 drivers/gpu/drm/radeon/radeon_mode.h               |   1 -
 drivers/gpu/drm/radeon/radeon_object.c             |   1 -
 drivers/gpu/drm/radeon/si.c                        | 336 ++++++++++--------
 drivers/gpu/drm/radeon/si_dpm.c                    |   1 +
 drivers/gpu/drm/rockchip/rockchip_drm_gem.c        |  67 ++--
 drivers/gpu/drm/tegra/dpaux.c                      |  18 +-
 drivers/gpu/drm/vgem/vgem_drv.c                    |   2 +
 drivers/hwmon/mcp3021.c                            |  14 +-
 drivers/hwmon/nct7802.c                            |   2 +-
 drivers/i2c/busses/i2c-at91.c                      |  70 +++-
 drivers/i2c/i2c-mux.c                              |   3 +-
 drivers/i2c/muxes/i2c-mux-pca9541.c                |   4 +-
 drivers/i2c/muxes/i2c-mux-pca954x.c                |   2 +-
 drivers/iio/accel/bmc150-accel.c                   |   2 +-
 drivers/iio/adc/Kconfig                            |   3 +-
 drivers/iio/adc/at91_adc.c                         |   8 +-
 drivers/iio/adc/rockchip_saradc.c                  |   4 +
 drivers/iio/adc/twl4030-madc.c                     |   3 +-
 .../iio/common/hid-sensors/hid-sensor-trigger.c    |  11 +-
 drivers/iio/dac/ad5624r_spi.c                      |   4 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c         |  18 +
 drivers/iio/light/cm3323.c                         |   2 +-
 drivers/iio/light/tcs3414.c                        |   2 +-
 drivers/iio/proximity/sx9500.c                     |   2 +-
 drivers/iio/temperature/tmp006.c                   |   3 +
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c        |   1 -
 drivers/md/bitmap.c                                |  15 +-
 drivers/md/dm-cache-policy-cleaner.c               |   3 +-
 drivers/md/dm-cache-policy-internal.h              |   5 +-
 drivers/md/dm-cache-policy-mq.c                    |  41 ++-
 drivers/md/dm-cache-policy.h                       |  15 +-
 drivers/md/dm-cache-target.c                       |  58 +--
 drivers/md/dm-stats.c                              |   2 +
 drivers/md/dm-thin.c                               |  13 +-
 drivers/md/md.c                                    |   9 +-
 drivers/md/persistent-data/dm-btree-remove.c       |   6 +-
 drivers/md/persistent-data/dm-btree.c              |   2 +-
 drivers/md/persistent-data/dm-space-map-metadata.c |  50 ++-
 drivers/media/dvb-frontends/af9013.c               |   4 +
 drivers/media/dvb-frontends/cx24116.c              |   8 +-
 drivers/media/dvb-frontends/cx24117.c              |   2 +-
 drivers/media/dvb-frontends/s5h1420.c              |   2 +-
 drivers/media/pci/cx18/cx18-streams.c              |   1 +
 drivers/media/pci/saa7164/saa7164-encoder.c        |  11 +-
 drivers/media/pci/saa7164/saa7164-vbi.c            |  11 +-
 drivers/media/usb/dvb-usb/dib0700_core.c           |  70 ++--
 drivers/media/usb/dvb-usb/dib0700_devices.c        |   6 +
 drivers/media/v4l2-core/videobuf2-core.c           |  33 +-
 drivers/mmc/card/block.c                           |  10 +-
 drivers/mmc/host/sdhci.c                           |   9 +-
 drivers/net/ethernet/intel/e1000e/82571.c          |   2 +-
 drivers/net/ethernet/intel/e1000e/ich8lan.c        |  10 +-
 drivers/net/ethernet/intel/e1000e/netdev.c         |  18 +-
 drivers/net/wireless/ath/ath9k/htc.h               |   6 +-
 drivers/net/wireless/ath/ath9k/main.c              |  12 +-
 drivers/net/wireless/iwlwifi/mvm/debugfs.c         |   5 +-
 drivers/net/wireless/iwlwifi/mvm/mac80211.c        |   2 +-
 drivers/net/wireless/iwlwifi/mvm/mvm.h             |   1 +
 drivers/net/wireless/iwlwifi/mvm/time-event.c      |  15 +-
 drivers/net/wireless/rtlwifi/rtl8188ee/hw.c        |  16 -
 drivers/net/wireless/rtlwifi/rtl8192ee/hw.c        |  17 -
 drivers/net/wireless/rtlwifi/rtl8723ae/hw.c        |  13 -
 drivers/net/wireless/rtlwifi/rtl8723be/hw.c        |  17 -
 drivers/net/wireless/rtlwifi/rtl8821ae/hw.c        |  20 --
 drivers/nfc/st21nfcb/i2c.c                         |  10 -
 drivers/nfc/st21nfcb/st21nfcb.c                    |   3 -
 drivers/of/address.c                               |   2 +-
 drivers/of/base.c                                  |   2 +-
 drivers/phy/phy-berlin-usb.c                       |   4 +-
 drivers/phy/phy-twl4030-usb.c                      |   1 -
 drivers/pinctrl/mvebu/pinctrl-armada-370.c         |   4 +-
 drivers/pinctrl/mvebu/pinctrl-armada-375.c         |   4 +-
 drivers/pinctrl/mvebu/pinctrl-armada-38x.c         |  51 ++-
 drivers/pinctrl/mvebu/pinctrl-armada-39x.c         |   2 +-
 drivers/pinctrl/mvebu/pinctrl-armada-xp.c          |  37 +-
 drivers/pinctrl/pinctrl-zynq.c                     |  11 +-
 drivers/platform/x86/dell-laptop.c                 |   8 +-
 drivers/platform/x86/ideapad-laptop.c              |  10 +-
 drivers/pnp/system.c                               |  35 +-
 drivers/rtc/rtc-snvs.c                             |  30 +-
 drivers/staging/comedi/drivers/cb_pcimdas.c        |   8 +-
 drivers/staging/rtl8712/rtl8712_recv.c             |   3 +-
 drivers/staging/vt6655/device_main.c               |   6 +-
 drivers/staging/vt6656/main_usb.c                  |   2 +-
 drivers/tty/serial/Kconfig                         |   2 +-
 drivers/tty/serial/atmel_serial.c                  |   9 +-
 drivers/tty/sysrq.c                                |  19 +-
 drivers/usb/core/devio.c                           |   2 +-
 drivers/usb/core/hcd.c                             |   7 +-
 drivers/usb/core/hub.c                             |  84 ++---
 drivers/usb/core/usb.h                             |   1 +
 drivers/usb/dwc3/ep0.c                             |   4 +
 drivers/usb/dwc3/gadget.c                          |  10 +-
 drivers/usb/gadget/composite.c                     |  11 +-
 drivers/usb/gadget/function/f_fs.c                 |   6 +-
 drivers/usb/gadget/function/f_mass_storage.c       |  16 +-
 drivers/usb/gadget/udc/mv_udc_core.c               |   2 +-
 drivers/usb/host/ohci-q.c                          |   7 +-
 drivers/usb/host/xhci-mem.c                        |   2 +-
 drivers/usb/musb/musb_virthub.c                    |   4 +-
 drivers/usb/phy/phy-mxs-usb.c                      |   3 +
 drivers/usb/serial/cp210x.c                        |   1 +
 drivers/usb/serial/option.c                        |   1 +
 drivers/usb/serial/usb-serial.c                    |   1 +
 drivers/w1/slaves/w1_therm.c                       |  62 +++-
 drivers/watchdog/omap_wdt.c                        |   7 +
 fs/9p/vfs_inode.c                                  |   3 +-
 fs/9p/vfs_inode_dotl.c                             |   3 +-
 fs/btrfs/inode-map.c                               |  17 +-
 fs/btrfs/ioctl.c                                   |  22 +-
 fs/btrfs/transaction.c                             |   4 +-
 fs/btrfs/tree-log.c                                |  14 +-
 fs/ext4/extents.c                                  |   6 +-
 fs/ext4/indirect.c                                 |   2 +-
 fs/ext4/inode.c                                    |  45 ++-
 fs/ext4/mballoc.c                                  |  16 +-
 fs/ext4/migrate.c                                  |  17 +-
 fs/ext4/super.c                                    |   4 +
 fs/fuse/inode.c                                    |   2 +-
 fs/hpfs/super.c                                    |  18 +-
 fs/jbd2/checkpoint.c                               |   7 +-
 fs/jbd2/journal.c                                  |  38 +-
 fs/nfs/flexfilelayout/flexfilelayout.c             |   2 +-
 fs/nfs/flexfilelayout/flexfilelayoutdev.c          |   7 +-
 fs/nfs/nfs3xdr.c                                   |   2 +-
 fs/nfs/nfs4state.c                                 |   2 +
 fs/nfs/pnfs.c                                      |   3 +
 fs/nfs/write.c                                     |   1 +
 fs/overlayfs/readdir.c                             |  77 ++--
 fs/xfs/xfs_attr_inactive.c                         |  10 +-
 fs/xfs/xfs_symlink.c                               |   2 +-
 include/acpi/acpixf.h                              |  13 +-
 include/acpi/actypes.h                             |   1 +
 include/drm/drm_atomic.h                           |  24 +-
 include/drm/drm_crtc.h                             |   2 +
 include/drm/drm_dp_mst_helper.h                    |   4 +
 include/linux/acpi.h                               |  10 -
 include/linux/ata.h                                |   1 +
 include/linux/buffer_head.h                        |   7 +
 include/linux/compiler-intel.h                     |   2 +
 include/linux/gpio/consumer.h                      |  15 +
 include/linux/hid-sensor-hub.h                     |   1 +
 include/linux/jbd2.h                               |   4 +-
 include/linux/libata.h                             |   3 +
 include/linux/nfs_xdr.h                            |   2 +-
 include/linux/of.h                                 |   5 +-
 include/uapi/drm/i915_drm.h                        |   8 +
 kernel/power/Kconfig                               |   2 +-
 kernel/printk/printk.c                             |  11 +-
 kernel/trace/trace.h                               |   3 +-
 kernel/trace/trace_branch.c                        |  17 +-
 kernel/trace/trace_events_filter.c                 |  10 +-
 lib/bitmap.c                                       |  17 +-
 mm/hugetlb.c                                       |  19 +-
 net/9p/client.c                                    |   4 +-
 net/bluetooth/hci_sock.c                           |  26 +-
 net/ceph/osdmap.c                                  |   2 +-
 net/ieee802154/socket.c                            |   6 +
 net/mac80211/cfg.c                                 |   1 +
 net/mac80211/ibss.c                                |   1 +
 net/mac80211/main.c                                |   3 +
 net/mac80211/mesh.c                                |   1 +
 net/sunrpc/backchannel_rqst.c                      |   2 +-
 net/wireless/util.c                                |   2 +-
 samples/trace_events/trace-events-sample.h         |   7 +-
 security/integrity/evm/evm_main.c                  |  11 +
 security/integrity/ima/ima.h                       |   2 +-
 security/integrity/ima/ima_fs.c                    |   4 +-
 security/integrity/ima/ima_policy.c                | 124 +++++--
 security/integrity/ima/ima_template_lib.c          |   3 +-
 security/keys/keyring.c                            |   8 +-
 security/selinux/hooks.c                           |   3 +-
 security/selinux/ss/ebitmap.c                      |   6 +
 sound/soc/codecs/max98925.c                        |   2 +-
 sound/soc/codecs/rt5645.c                          |   4 +-
 sound/soc/codecs/tas2552.c                         |   4 +-
 sound/soc/codecs/wm5102.c                          |   2 +-
 sound/soc/codecs/wm5110.c                          |   2 +-
 sound/soc/codecs/wm8737.c                          |   6 +-
 sound/soc/codecs/wm8903.h                          |   2 +-
 sound/soc/codecs/wm8955.c                          |   2 +-
 sound/soc/codecs/wm8960.c                          |   2 +-
 sound/soc/codecs/wm8997.c                          |   2 +-
 sound/soc/fsl/imx-wm8962.c                         |   2 +-
 sound/soc/omap/Kconfig                             |   5 +-
 sound/soc/qcom/Kconfig                             |   2 -
 tools/perf/util/cloexec.c                          |   4 +
 281 files changed, 2866 insertions(+), 1964 deletions(-)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 003/267] pinctrl: mvebu: armada-370: fix spi0 pin description
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 004/267] pinctrl: mvebu: armada-375: remove incorrect space in " Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Linus Walleij

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit 438881dfddb9107ef0eb30b49368e91e092f0b3e upstream.

Due to a mistake, the CS0 and CS1 SPI0 functions were incorrectly
named "spi0-1" instead of just "spi0". This commit fixes that.

This DT binding change does not affect any of the in-tree users.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: 5f597bb2be57 ("pinctrl: mvebu: add pinctrl driver for Armada 370")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt |    4 ++--
 drivers/pinctrl/mvebu/pinctrl-armada-370.c                               |    4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
@@ -92,5 +92,5 @@ mpp61         61       gpo, dev(wen1), u
 mpp62         62       gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
                        audio(mclk), uart0(cts)
 mpp63         63       gpo, spi0(sck), tclk
-mpp64         64       gpio, spi0(miso), spi0-1(cs1)
-mpp65         65       gpio, spi0(mosi), spi0-1(cs2)
+mpp64         64       gpio, spi0(miso), spi0(cs1)
+mpp65         65       gpio, spi0(mosi), spi0(cs2)
--- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
@@ -370,11 +370,11 @@ static struct mvebu_mpp_mode mv88f6710_m
 	MPP_MODE(64,
 	   MPP_FUNCTION(0x0, "gpio", NULL),
 	   MPP_FUNCTION(0x1, "spi0", "miso"),
-	   MPP_FUNCTION(0x2, "spi0-1", "cs1")),
+	   MPP_FUNCTION(0x2, "spi0", "cs1")),
 	MPP_MODE(65,
 	   MPP_FUNCTION(0x0, "gpio", NULL),
 	   MPP_FUNCTION(0x1, "spi0", "mosi"),
-	   MPP_FUNCTION(0x2, "spi0-1", "cs2")),
+	   MPP_FUNCTION(0x2, "spi0", "cs2")),
 };
 
 static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 004/267] pinctrl: mvebu: armada-375: remove incorrect space in pin description
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 003/267] pinctrl: mvebu: armada-370: fix spi0 pin description Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 005/267] pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Linus Walleij

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit d538990ee12b162f7ce6c0fcef3b643800102676 upstream.

There was an incorrect space in the definition of the function of one
pin in the Armada 375 pinctrl driver, which this commit fixes.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: ce3ed59dcddd ("pinctrl: mvebu: add pin-muxing driver for the Marvell Armada 375")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pinctrl/mvebu/pinctrl-armada-375.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/mvebu/pinctrl-armada-375.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
@@ -92,7 +92,7 @@ static struct mvebu_mpp_mode mv88f6720_m
 		 MPP_FUNCTION(0x5, "nand", "io1")),
 	MPP_MODE(8,
 		 MPP_FUNCTION(0x0, "gpio", NULL),
-		 MPP_FUNCTION(0x1, "dev ", "bootcs"),
+		 MPP_FUNCTION(0x1, "dev", "bootcs"),
 		 MPP_FUNCTION(0x2, "spi0", "cs0"),
 		 MPP_FUNCTION(0x3, "spi1", "cs0"),
 		 MPP_FUNCTION(0x5, "nand", "ce")),



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 005/267] pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 003/267] pinctrl: mvebu: armada-370: fix spi0 pin description Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 004/267] pinctrl: mvebu: armada-375: remove incorrect space in " Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 006/267] pinctrl: mvebu: armada-38x: fix PCIe functions Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Linus Walleij

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit e5447d26092c72ef3346615ee558c9112ef8063f upstream.

After updating to a more recent version of the Armada 375, we realized
that some of the pins documented as having a NAND-related
functionality in fact did not have such functionality. This commit
updates the pinctrl driver accordingly.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: ce3ed59dcddd ("pinctrl: mvebu: add pin-muxing driver for the Marvell Armada 375")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt |    4 ++--
 drivers/pinctrl/mvebu/pinctrl-armada-375.c                               |    2 --
 2 files changed, 2 insertions(+), 4 deletions(-)

--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
@@ -22,8 +22,8 @@ mpp5          5        gpio, dev(ad7), s
 mpp6          6        gpio, dev(ad0), led(p1), audio(rclk)
 mpp7          7        gpio, dev(ad1), ptp(clk), led(p2), audio(extclk)
 mpp8          8        gpio, dev (bootcs), spi0(cs0), spi1(cs0)
-mpp9          9        gpio, nf(wen), spi0(sck), spi1(sck)
-mpp10        10        gpio, nf(ren), dram(vttctrl), led(c1)
+mpp9          9        gpio, spi0(sck), spi1(sck), nand(we)
+mpp10        10        gpio, dram(vttctrl), led(c1), nand(re)
 mpp11        11        gpio, dev(a0), led(c2), audio(sdo)
 mpp12        12        gpio, dev(a1), audio(bclk)
 mpp13        13        gpio, dev(readyn), pcie0(rstoutn), pcie1(rstoutn)
--- a/drivers/pinctrl/mvebu/pinctrl-armada-375.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
@@ -98,13 +98,11 @@ static struct mvebu_mpp_mode mv88f6720_m
 		 MPP_FUNCTION(0x5, "nand", "ce")),
 	MPP_MODE(9,
 		 MPP_FUNCTION(0x0, "gpio", NULL),
-		 MPP_FUNCTION(0x1, "nf", "wen"),
 		 MPP_FUNCTION(0x2, "spi0", "sck"),
 		 MPP_FUNCTION(0x3, "spi1", "sck"),
 		 MPP_FUNCTION(0x5, "nand", "we")),
 	MPP_MODE(10,
 		 MPP_FUNCTION(0x0, "gpio", NULL),
-		 MPP_FUNCTION(0x1, "nf", "ren"),
 		 MPP_FUNCTION(0x2, "dram", "vttctrl"),
 		 MPP_FUNCTION(0x3, "led", "c1"),
 		 MPP_FUNCTION(0x5, "nand", "re"),



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 006/267] pinctrl: mvebu: armada-38x: fix PCIe functions
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 005/267] pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 007/267] pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Linus Walleij

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit 331642fbf24a1c16b2669ca0a6479b5fcd6dd5b2 upstream.

A new revision of the Marvell Armada 38x hardware datasheet unveiled
that the definition of some of the PCIe functions were not
correct. This commit fixes the pinctrl driver accordingly.

Some PCIe functions simply do not exist, some of the PCIe functions in
fact were corresponding to other functions, and some PCIe functions
have been added.

Note: the seemingly unrelated removal of spi(cs2) on MPP47 is related:
this function is in fact implemented on MPP43, instead of a PCIe
function.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: ca6d9a084b56f ("pinctrl: mvebu: add pin-muxing driver for the Marvell Armada 380/385")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt |   38 +++----
 drivers/pinctrl/mvebu/pinctrl-armada-38x.c                               |   49 ++++------
 2 files changed, 39 insertions(+), 48 deletions(-)

--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
@@ -27,15 +27,15 @@ mpp8          8        gpio, ge0(txd1),
 mpp9          9        gpio, ge0(txd2), dev(ad11)
 mpp10         10       gpio, ge0(txd3), dev(ad12)
 mpp11         11       gpio, ge0(txctl), dev(ad13)
-mpp12         12       gpio, ge0(rxd0), pcie0(rstout), pcie1(rstout) [1], spi0(cs1), dev(ad14)
-mpp13         13       gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15)
-mpp14         14       gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1)
-mpp15         15       gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi), pcie1(rstout) [1]
-mpp16         16       gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq)
+mpp12         12       gpio, ge0(rxd0), pcie0(rstout), spi0(cs1), dev(ad14), pcie3(clkreq)
+mpp13         13       gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15), pcie2(clkreq)
+mpp14         14       gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1), pcie3(clkreq)
+mpp15         15       gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi)
+mpp16         16       gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq), pcie1(clkreq) [1]
 mpp17         17       gpio, ge0(rxclk), ptp(clk), ua1(rxd), spi0(sck), sata1(prsnt)
-mpp18         18       gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0), pcie1(rstout) [1]
-mpp19         19       gpio, ge0(col), ptp(event_req), pcie0(clkreq), sata1(prsnt), ua0(cts)
-mpp20         20       gpio, ge0(txclk), ptp(clk), pcie1(rstout) [1], sata0(prsnt), ua0(rts)
+mpp18         18       gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0)
+mpp19         19       gpio, ge0(col), ptp(event_req), ge0(txerr), sata1(prsnt), ua0(cts)
+mpp20         20       gpio, ge0(txclk), ptp(clk), sata0(prsnt), ua0(rts)
 mpp21         21       gpio, spi0(cs1), ge1(rxd0), sata0(prsnt), sd0(cmd), dev(bootcs)
 mpp22         22       gpio, spi0(mosi), dev(ad0)
 mpp23         23       gpio, spi0(sck), dev(ad2)
@@ -58,23 +58,23 @@ mpp39         39       gpio, i2c1(sck),
 mpp40         40       gpio, i2c1(sda), ge1(rxd3), ua0(rts), sd0(d2), dev(ad6)
 mpp41         41       gpio, ua1(rxd), ge1(rxctl), ua0(cts), spi1(cs3), dev(burst/last)
 mpp42         42       gpio, ua1(txd), ua0(rts), dev(ad7)
-mpp43         43       gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), pcie0(rstout), dev(clkout)
-mpp44         44       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3], pcie0(rstout)
-mpp45         45       gpio, ref(clk_out0), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
-mpp46         46       gpio, ref(clk_out1), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
-mpp47         47       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], spi1(cs2), sata3(prsnt) [2]
-mpp48         48       gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4)
-mpp49         49       gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5)
-mpp50         50       gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(drx), audio(extclk), sd0(cmd)
+mpp43         43       gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), spi1(cs2), dev(clkout)
+mpp44         44       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3]
+mpp45         45       gpio, ref(clk_out0), pcie0(rstout)
+mpp46         46       gpio, ref(clk_out1), pcie0(rstout)
+mpp47         47       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [2]
+mpp48         48       gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4), pcie0(clkreq)
+mpp49         49       gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5), pcie1(clkreq)
+mpp50         50       gpio, pcie0(rstout), tdm2c(drx), audio(extclk), sd0(cmd)
 mpp51         51       gpio, tdm2c(dtx), audio(sdo), m(decc_err)
-mpp52         52       gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(intn), audio(sdi), sd0(d6)
+mpp52         52       gpio, pcie0(rstout), tdm2c(intn), audio(sdi), sd0(d6)
 mpp53         53       gpio, sata1(prsnt), sata0(prsnt), tdm2c(rstn), audio(bclk), sd0(d7)
-mpp54         54       gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), pcie1(rstout) [1], sd0(d3)
+mpp54         54       gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), ge0(txerr), sd0(d3)
 mpp55         55       gpio, ua1(cts), ge(mdio), pcie1(clkreq) [1], spi1(cs1), sd0(d0)
 mpp56         56       gpio, ua1(rts), ge(mdc), m(decc_err), spi1(mosi)
 mpp57         57       gpio, spi1(sck), sd0(clk)
 mpp58         58       gpio, pcie1(clkreq) [1], i2c1(sck), pcie2(clkreq), spi1(miso), sd0(d1)
-mpp59         59       gpio, pcie0(rstout), i2c1(sda), pcie1(rstout) [1], spi1(cs0), sd0(d2)
+mpp59         59       gpio, pcie0(rstout), i2c1(sda), spi1(cs0), sd0(d2)
 
 [1]: only available on 88F6820 and 88F6828
 [2]: only available on 88F6828
--- a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
@@ -94,37 +94,39 @@ static struct mvebu_mpp_mode armada_38x_
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ge0",   "rxd0",       V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
 		 MPP_VAR_FUNCTION(4, "spi0",  "cs1",        V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "dev",   "ad14",       V_88F6810_PLUS)),
+		 MPP_VAR_FUNCTION(5, "dev",   "ad14",       V_88F6810_PLUS),
+		 MPP_VAR_FUNCTION(6, "pcie3", "clkreq",     V_88F6810_PLUS)),
 	MPP_MODE(13,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ge0",   "rxd1",       V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "pcie0", "clkreq",     V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "pcie1", "clkreq",     V_88F6820_PLUS),
 		 MPP_VAR_FUNCTION(4, "spi0",  "cs2",        V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "dev",   "ad15",       V_88F6810_PLUS)),
+		 MPP_VAR_FUNCTION(5, "dev",   "ad15",       V_88F6810_PLUS),
+		 MPP_VAR_FUNCTION(6, "pcie2", "clkreq",     V_88F6810_PLUS)),
 	MPP_MODE(14,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ge0",   "rxd2",       V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "ptp",   "clk",        V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "m",     "vtt_ctrl",   V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(4, "spi0",  "cs3",        V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "dev",   "wen1",       V_88F6810_PLUS)),
+		 MPP_VAR_FUNCTION(5, "dev",   "wen1",       V_88F6810_PLUS),
+		 MPP_VAR_FUNCTION(6, "pcie3", "clkreq",     V_88F6810_PLUS)),
 	MPP_MODE(15,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ge0",   "rxd3",       V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "ge",    "mdc slave",  V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "pcie0", "rstout",     V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(4, "spi0",  "mosi",       V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "pcie1", "rstout",     V_88F6820_PLUS)),
+		 MPP_VAR_FUNCTION(4, "spi0",  "mosi",       V_88F6810_PLUS)),
 	MPP_MODE(16,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ge0",   "rxctl",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "ge",    "mdio slave", V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "m",     "decc_err",   V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(4, "spi0",  "miso",       V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "pcie0", "clkreq",     V_88F6810_PLUS)),
+		 MPP_VAR_FUNCTION(5, "pcie0", "clkreq",     V_88F6810_PLUS),
+		 MPP_VAR_FUNCTION(6, "pcie1", "clkreq",     V_88F6820_PLUS)),
 	MPP_MODE(17,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ge0",   "rxclk",      V_88F6810_PLUS),
@@ -137,13 +139,12 @@ static struct mvebu_mpp_mode armada_38x_
 		 MPP_VAR_FUNCTION(1, "ge0",   "rxerr",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "ptp",   "trig_gen",   V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "ua1",   "txd",        V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(4, "spi0",  "cs0",        V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "pcie1", "rstout",     V_88F6820_PLUS)),
+		 MPP_VAR_FUNCTION(4, "spi0",  "cs0",        V_88F6810_PLUS)),
 	MPP_MODE(19,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ge0",   "col",        V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "ptp",   "event_req",  V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(3, "pcie0", "clkreq",     V_88F6810_PLUS),
+		 MPP_VAR_FUNCTION(3, "ge0",   "txerr",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(4, "sata1", "prsnt",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(5, "ua0",   "cts",        V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(6, "ua1",   "rxd",        V_88F6810_PLUS)),
@@ -151,7 +152,6 @@ static struct mvebu_mpp_mode armada_38x_
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ge0",   "txclk",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "ptp",   "clk",        V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
 		 MPP_VAR_FUNCTION(4, "sata0", "prsnt",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(5, "ua0",   "rts",        V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(6, "ua1",   "txd",        V_88F6810_PLUS)),
@@ -277,35 +277,27 @@ static struct mvebu_mpp_mode armada_38x_
 		 MPP_VAR_FUNCTION(1, "pcie0", "clkreq",     V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "m",     "vtt_ctrl",   V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "m",     "decc_err",   V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(4, "pcie0", "rstout",     V_88F6810_PLUS),
+		 MPP_VAR_FUNCTION(4, "spi1",  "cs2",        V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(5, "dev",   "clkout",     V_88F6810_PLUS)),
 	MPP_MODE(44,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "sata0", "prsnt",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "sata1", "prsnt",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "sata2", "prsnt",      V_88F6828),
-		 MPP_VAR_FUNCTION(4, "sata3", "prsnt",      V_88F6828),
-		 MPP_VAR_FUNCTION(5, "pcie0", "rstout",     V_88F6810_PLUS)),
+		 MPP_VAR_FUNCTION(4, "sata3", "prsnt",      V_88F6828)),
 	MPP_MODE(45,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ref",   "clk_out0",   V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
-		 MPP_VAR_FUNCTION(4, "pcie2", "rstout",     V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "pcie3", "rstout",     V_88F6810_PLUS)),
+		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS)),
 	MPP_MODE(46,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "ref",   "clk_out1",   V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
-		 MPP_VAR_FUNCTION(4, "pcie2", "rstout",     V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "pcie3", "rstout",     V_88F6810_PLUS)),
+		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS)),
 	MPP_MODE(47,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "sata0", "prsnt",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "sata1", "prsnt",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "sata2", "prsnt",      V_88F6828),
-		 MPP_VAR_FUNCTION(4, "spi1",  "cs2",        V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(5, "sata3", "prsnt",      V_88F6828)),
 	MPP_MODE(48,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
@@ -313,18 +305,19 @@ static struct mvebu_mpp_mode armada_38x_
 		 MPP_VAR_FUNCTION(2, "m",     "vtt_ctrl",   V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "tdm2c", "pclk",       V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(4, "audio", "mclk",       V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "sd0",   "d4",         V_88F6810_PLUS)),
+		 MPP_VAR_FUNCTION(5, "sd0",   "d4",         V_88F6810_PLUS),
+		 MPP_VAR_FUNCTION(6, "pcie0", "clkreq",     V_88F6810_PLUS)),
 	MPP_MODE(49,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "sata2", "prsnt",      V_88F6828),
 		 MPP_VAR_FUNCTION(2, "sata3", "prsnt",      V_88F6828),
 		 MPP_VAR_FUNCTION(3, "tdm2c", "fsync",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(4, "audio", "lrclk",      V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(5, "sd0",   "d5",         V_88F6810_PLUS)),
+		 MPP_VAR_FUNCTION(5, "sd0",   "d5",         V_88F6810_PLUS),
+		 MPP_VAR_FUNCTION(6, "pcie1", "clkreq",     V_88F6820_PLUS)),
 	MPP_MODE(50,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "pcie0", "rstout",     V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(2, "pcie1", "rstout",     V_88F6820_PLUS),
 		 MPP_VAR_FUNCTION(3, "tdm2c", "drx",        V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(4, "audio", "extclk",     V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(5, "sd0",   "cmd",        V_88F6810_PLUS)),
@@ -336,7 +329,6 @@ static struct mvebu_mpp_mode armada_38x_
 	MPP_MODE(52,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "pcie0", "rstout",     V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(2, "pcie1", "rstout",     V_88F6820_PLUS),
 		 MPP_VAR_FUNCTION(3, "tdm2c", "intn",       V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(4, "audio", "sdi",        V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(5, "sd0",   "d6",         V_88F6810_PLUS)),
@@ -352,7 +344,7 @@ static struct mvebu_mpp_mode armada_38x_
 		 MPP_VAR_FUNCTION(1, "sata0", "prsnt",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "sata1", "prsnt",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(3, "pcie0", "rstout",     V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(4, "pcie1", "rstout",     V_88F6820_PLUS),
+		 MPP_VAR_FUNCTION(4, "ge0",   "txerr",      V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(5, "sd0",   "d3",         V_88F6810_PLUS)),
 	MPP_MODE(55,
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
@@ -382,7 +374,6 @@ static struct mvebu_mpp_mode armada_38x_
 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(1, "pcie0", "rstout",     V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(2, "i2c1",  "sda",        V_88F6810_PLUS),
-		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
 		 MPP_VAR_FUNCTION(4, "spi1",  "cs0",        V_88F6810_PLUS),
 		 MPP_VAR_FUNCTION(5, "sd0",   "d2",         V_88F6810_PLUS)),
 };



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 007/267] pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 006/267] pinctrl: mvebu: armada-38x: fix PCIe functions Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 008/267] pinctrl: mvebu: armada-39x: " Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Linus Walleij

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit 27e7cd016558bf787b128fd882cdd90409ae4036 upstream.

The pinctrl_gpio_range[] array described a first bank of 32 GPIOs and
a second one of 27 GPIOs. However, since there is a total of 60 MPP
pins that can be muxed as GPIOs, the second bank really has 28 GPIOs.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: ca6d9a084b56f ("pinctrl: mvebu: add pin-muxing driver for the Marvell Armada 380/385")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pinctrl/mvebu/pinctrl-armada-38x.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
@@ -402,7 +402,7 @@ static struct mvebu_mpp_ctrl armada_38x_
 
 static struct pinctrl_gpio_range armada_38x_mpp_gpio_ranges[] = {
 	MPP_GPIO_RANGE(0,   0,  0, 32),
-	MPP_GPIO_RANGE(1,  32, 32, 27),
+	MPP_GPIO_RANGE(1,  32, 32, 28),
 };
 
 static int armada_38x_pinctrl_probe(struct platform_device *pdev)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 008/267] pinctrl: mvebu: armada-39x: fix incorrect total number of GPIOs
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 007/267] pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 009/267] pinctrl: mvebu: armada-xp: remove non-existing NAND pins Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Linus Walleij

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit 7c580311a2cb3bb0d0188665c9c69227aed650ea upstream.

The pinctrl_gpio_range[] array described a first bank of 32 GPIOs and
a second one of 27 GPIOs. However, since there is a total of 60 MPP
pins that can be muxed as GPIOs, the second bank really has 28 GPIOs.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: ee086577abe7f ("pinctrl: mvebu: add pinctrl driver for Marvell Armada 39x")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pinctrl/mvebu/pinctrl-armada-39x.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/mvebu/pinctrl-armada-39x.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-39x.c
@@ -380,7 +380,7 @@ static struct mvebu_mpp_ctrl armada_39x_
 
 static struct pinctrl_gpio_range armada_39x_mpp_gpio_ranges[] = {
 	MPP_GPIO_RANGE(0,   0,  0, 32),
-	MPP_GPIO_RANGE(1,  32, 32, 27),
+	MPP_GPIO_RANGE(1,  32, 32, 28),
 };
 
 static int armada_39x_pinctrl_probe(struct platform_device *pdev)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 009/267] pinctrl: mvebu: armada-xp: remove non-existing NAND pins
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 008/267] pinctrl: mvebu: armada-39x: " Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 010/267] pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Linus Walleij

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit bc99357f3690c11817756adfee0ece811a3db2e7 upstream.

After updating to a more recent version of the Armada XP datasheet, we
realized that some of the pins documented as having a NAND-related
functionality in fact did not have such functionality. This commit
updates the pinctrl driver accordingly.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: 463e270f766a ("pinctrl: mvebu: add pinctrl driver for Armada XP")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt |    4 ++--
 drivers/pinctrl/mvebu/pinctrl-armada-xp.c                               |    2 --
 2 files changed, 2 insertions(+), 4 deletions(-)

--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
@@ -42,8 +42,8 @@ mpp20         20       gpio, ge0(rxd4),
 mpp21         21       gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
 mpp22         22       gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
 mpp23         23       gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
-mpp24         24       gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
-mpp25         25       gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
+mpp24         24       gpio, lcd(hsync), sata1(prsnt), tdm(rst)
+mpp25         25       gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
 mpp26         26       gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
 mpp27         27       gpio, lcd(e), tdm(dtx), ptp(trig)
 mpp28         28       gpio, lcd(pwm), tdm(drx), ptp(evreq)
--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
@@ -172,13 +172,11 @@ static struct mvebu_mpp_mode armada_xp_m
 	MPP_MODE(24,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "sata1", "prsnt",    V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re",   V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x3, "tdm", "rst",        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x4, "lcd", "hsync",      V_MV78230_PLUS)),
 	MPP_MODE(25,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "sata0", "prsnt",    V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we",   V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x3, "tdm", "pclk",       V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x4, "lcd", "vsync",      V_MV78230_PLUS)),
 	MPP_MODE(26,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 010/267] pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 009/267] pinctrl: mvebu: armada-xp: remove non-existing NAND pins Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 011/267] pinctrl: mvebu: armada-xp: fix functions of MPP48 Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Linus Walleij

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit 80b3d04feab5e69d51cb2375eb989a7165e43e3b upstream.

The latest version of the Armada XP datasheet no longer documents the
VDD cpu_pd functions, which might indicate they are not working and/or
not supported. This commit ensures the pinctrl driver matches the
datasheet.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: 463e270f766a ("pinctrl: mvebu: add pinctrl driver for Armada XP")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt |   26 +++----
 drivers/pinctrl/mvebu/pinctrl-armada-xp.c                               |   33 +++-------
 2 files changed, 20 insertions(+), 39 deletions(-)

--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
@@ -44,13 +44,13 @@ mpp22         22       gpio, ge0(rxd6),
 mpp23         23       gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
 mpp24         24       gpio, lcd(hsync), sata1(prsnt), tdm(rst)
 mpp25         25       gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-mpp26         26       gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
+mpp26         26       gpio, lcd(clk), tdm(fsync)
 mpp27         27       gpio, lcd(e), tdm(dtx), ptp(trig)
 mpp28         28       gpio, lcd(pwm), tdm(drx), ptp(evreq)
-mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
+mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk)
 mpp30         30       gpio, tdm(int1), sd0(clk)
-mpp31         31       gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
-mpp32         32       gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
+mpp31         31       gpio, tdm(int2), sd0(cmd)
+mpp32         32       gpio, tdm(int3), sd0(d0)
 mpp33         33       gpio, tdm(int4), sd0(d1), mem(bat)
 mpp34         34       gpio, tdm(int5), sd0(d2), sata0(prsnt)
 mpp35         35       gpio, tdm(int6), sd0(d3), sata1(prsnt)
@@ -58,14 +58,11 @@ mpp36         36       gpio, spi(mosi)
 mpp37         37       gpio, spi(miso)
 mpp38         38       gpio, spi(sck)
 mpp39         39       gpio, spi(cs0)
-mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
-                       pcie(clkreq0)
+mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
 mpp41         41       gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
                        pcie(clkreq1)
-mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
-                       vdd(cpu0-pd)
-mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
-                       vdd(cpu2-3-pd){1}
+mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
+mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
 mpp44         44       gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
                        mem(bat)
 mpp45         45       gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
@@ -84,9 +81,9 @@ mpp51         51       gpio, dev(ad16)
 mpp52         52       gpio, dev(ad17)
 mpp53         53       gpio, dev(ad18)
 mpp54         54       gpio, dev(ad19)
-mpp55         55       gpio, dev(ad20), vdd(cpu0-pd)
-mpp56         56       gpio, dev(ad21), vdd(cpu1-pd)
-mpp57         57       gpio, dev(ad22), vdd(cpu2-3-pd){1}
+mpp55         55       gpio, dev(ad20)
+mpp56         56       gpio, dev(ad21)
+mpp57         57       gpio, dev(ad22)
 mpp58         58       gpio, dev(ad23)
 mpp59         59       gpio, dev(ad24)
 mpp60         60       gpio, dev(ad25)
@@ -96,6 +93,3 @@ mpp63         63       gpio, dev(ad28)
 mpp64         64       gpio, dev(ad29)
 mpp65         65       gpio, dev(ad30)
 mpp66         66       gpio, dev(ad31)
-
-Notes:
-* {1} vdd(cpu2-3-pd) only available on mv78460.
--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
@@ -14,10 +14,7 @@
  * available: mv78230, mv78260 and mv78460. From a pin muxing
  * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460
  * both have 67 MPP pins (more GPIOs and address lines for the memory
- * bus mainly). The only difference between the mv78260 and the
- * mv78460 in terms of pin muxing is the addition of two functions on
- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two
- * cores, mv78460 has four cores).
+ * bus mainly).
  */
 
 #include <linux/err.h>
@@ -182,8 +179,7 @@ static struct mvebu_mpp_mode armada_xp_m
 	MPP_MODE(26,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x3, "tdm", "fsync",      V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x4, "lcd", "clk",        V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd",    V_MV78230_PLUS)),
+		 MPP_VAR_FUNCTION(0x4, "lcd", "clk",        V_MV78230_PLUS)),
 	MPP_MODE(27,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "ptp", "trig",       V_MV78230_PLUS),
@@ -198,8 +194,7 @@ static struct mvebu_mpp_mode armada_xp_m
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "ptp", "clk",        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x3, "tdm", "int0",       V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk",    V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
+		 MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk",    V_MV78230_PLUS)),
 	MPP_MODE(30,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "sd0", "clk",        V_MV78230_PLUS),
@@ -207,13 +202,11 @@ static struct mvebu_mpp_mode armada_xp_m
 	MPP_MODE(31,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "sd0", "cmd",        V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x3, "tdm", "int2",       V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
+		 MPP_VAR_FUNCTION(0x3, "tdm", "int2",       V_MV78230_PLUS)),
 	MPP_MODE(32,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "sd0", "d0",         V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x3, "tdm", "int3",       V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd",    V_MV78230_PLUS)),
+		 MPP_VAR_FUNCTION(0x3, "tdm", "int3",       V_MV78230_PLUS)),
 	MPP_MODE(33,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "sd0", "d1",         V_MV78230_PLUS),
@@ -245,7 +238,6 @@ static struct mvebu_mpp_mode armada_xp_m
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "spi", "cs1",        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x2, "uart2", "cts",      V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd",    V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync",  V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0",   V_MV78230_PLUS)),
 	MPP_MODE(41,
@@ -260,15 +252,13 @@ static struct mvebu_mpp_mode armada_xp_m
 		 MPP_VAR_FUNCTION(0x1, "uart2", "rxd",      V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x2, "uart0", "cts",      V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x3, "tdm", "int7",       V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x4, "tdm-1", "timer",    V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
+		 MPP_VAR_FUNCTION(0x4, "tdm-1", "timer",    V_MV78230_PLUS)),
 	MPP_MODE(43,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "uart2", "txd",      V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x2, "uart0", "rts",      V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x3, "spi", "cs3",        V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x4, "pcie", "rstout",    V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd",  V_MV78460)),
+		 MPP_VAR_FUNCTION(0x4, "pcie", "rstout",    V_MV78230_PLUS)),
 	MPP_MODE(44,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "uart2", "cts",      V_MV78230_PLUS),
@@ -319,16 +309,13 @@ static struct mvebu_mpp_mode armada_xp_m
 		 MPP_VAR_FUNCTION(0x1, "dev", "ad19",       V_MV78260_PLUS)),
 	MPP_MODE(55,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
-		 MPP_VAR_FUNCTION(0x1, "dev", "ad20",       V_MV78260_PLUS),
-		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd",    V_MV78260_PLUS)),
+		 MPP_VAR_FUNCTION(0x1, "dev", "ad20",       V_MV78260_PLUS)),
 	MPP_MODE(56,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
-		 MPP_VAR_FUNCTION(0x1, "dev", "ad21",       V_MV78260_PLUS),
-		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd",    V_MV78260_PLUS)),
+		 MPP_VAR_FUNCTION(0x1, "dev", "ad21",       V_MV78260_PLUS)),
 	MPP_MODE(57,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
-		 MPP_VAR_FUNCTION(0x1, "dev", "ad22",       V_MV78260_PLUS),
-		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd",  V_MV78460)),
+		 MPP_VAR_FUNCTION(0x1, "dev", "ad22",       V_MV78260_PLUS)),
 	MPP_MODE(58,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
 		 MPP_VAR_FUNCTION(0x1, "dev", "ad23",       V_MV78260_PLUS)),



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 011/267] pinctrl: mvebu: armada-xp: fix functions of MPP48
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 010/267] pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 012/267] openrisc: fix CONFIG_UID16 setting Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Linus Walleij

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit ea78b9511a54d0de026e04b5da86b30515072f31 upstream.

There was a mistake in the definition of the functions for MPP48 on
Marvell Armada XP. The second function is dev(clkout), and not tclk.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: 463e270f766a ("pinctrl: mvebu: add pinctrl driver for Armada XP")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt |    2 +-
 drivers/pinctrl/mvebu/pinctrl-armada-xp.c                               |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
@@ -69,7 +69,7 @@ mpp45         45       gpio, uart2(rts),
 mpp46         46       gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
 mpp47         47       gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
                        ref(clkout)
-mpp48         48       gpio, tclk, dev(burst/last)
+mpp48         48       gpio, dev(clkout), dev(burst/last)
 
 * Marvell Armada XP (mv78260 and mv78460 only)
 
--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
@@ -287,7 +287,7 @@ static struct mvebu_mpp_mode armada_xp_m
 		 MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3",   V_MV78230_PLUS)),
 	MPP_MODE(48,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
-		 MPP_VAR_FUNCTION(0x1, "tclk", NULL,        V_MV78230_PLUS),
+		 MPP_VAR_FUNCTION(0x1, "dev", "clkout",     V_MV78230_PLUS),
 		 MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)),
 	MPP_MODE(49,
 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 012/267] openrisc: fix CONFIG_UID16 setting
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 011/267] pinctrl: mvebu: armada-xp: fix functions of MPP48 Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 013/267] m68knommu: make ColdFire SoC selection a choice Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fengguang Wu, Iulia Manda,
	Josh Triplett, Andrew Morton, Linus Torvalds, Guenter Roeck

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrew Morton <akpm@linux-foundation.org>

commit 04ea1e91f85615318ea91ce8ab50cb6a01ee4005 upstream.

openrisc-allnoconfig:

  kernel/uid16.c: In function 'SYSC_setgroups16':
  kernel/uid16.c:184:2: error: implicit declaration of function 'groups_alloc'
  kernel/uid16.c:184:13: warning: assignment makes pointer from integer without a cast

openrisc shouldn't be setting CONFIG_UID16 when CONFIG_MULTIUSER=n.

Fixes: 2813893f8b197a1 ("kernel: conditionally support non-root users, groups and capabilities")
Reported-by: Fengguang Wu <fengguang.wu@gmail.com>
Cc: Iulia Manda <iulia.manda21@gmail.com>
Cc: Josh Triplett <josh@joshtriplett.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/openrisc/Kconfig |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/arch/openrisc/Kconfig
+++ b/arch/openrisc/Kconfig
@@ -17,6 +17,7 @@ config OPENRISC
 	select GENERIC_IRQ_SHOW
 	select GENERIC_IOMAP
 	select GENERIC_CPU_DEVICES
+	select HAVE_UID16
 	select GENERIC_ATOMIC64
 	select GENERIC_CLOCKEVENTS
 	select GENERIC_STRNCPY_FROM_USER
@@ -31,9 +32,6 @@ config MMU
 config HAVE_DMA_ATTRS
 	def_bool y
 
-config UID16
-	def_bool y
-
 config RWSEM_GENERIC_SPINLOCK
 	def_bool y
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 013/267] m68knommu: make ColdFire SoC selection a choice
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 012/267] openrisc: fix CONFIG_UID16 setting Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 014/267] m68knommu: force setting of CONFIG_CLOCK_FREQ for ColdFire Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Greg Ungerer, Geert Uytterhoeven,
	Guenter Roeck

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Greg Ungerer <gerg@uclinux.org>

commit fa95a1dd0819c9041a873b10a6d83b5134964154 upstream.

It would be nice if we could support multiple ColdFire SoC types in a
single binary - but currently the code simply does not support it.
Change the SoC selection config options to be a choice instead of
individual selectable entries.

This fixes problems with building allnoconfig, and means that a sane
linux kernel is generated for a single ColdFire SoC type.

Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/m68k/Kconfig.cpu |   27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

--- a/arch/m68k/Kconfig.cpu
+++ b/arch/m68k/Kconfig.cpu
@@ -125,6 +125,13 @@ endif # M68KCLASSIC
 
 if COLDFIRE
 
+choice
+	prompt "ColdFire SoC type"
+	default M520x
+	help
+	  Select the type of ColdFire System-on-Chip (SoC) that you want
+	  to build for.
+
 config M5206
 	bool "MCF5206"
 	depends on !MMU
@@ -174,9 +181,6 @@ config M525x
 	help
 	  Freescale (Motorola) Coldfire 5251/5253 processor support.
 
-config M527x
-	bool
-
 config M5271
 	bool "MCF5271"
 	depends on !MMU
@@ -223,9 +227,6 @@ config M5307
 	help
 	  Motorola ColdFire 5307 processor support.
 
-config M53xx
-	bool
-
 config M532x
 	bool "MCF532x"
 	depends on !MMU
@@ -251,9 +252,6 @@ config M5407
 	help
 	  Motorola ColdFire 5407 processor support.
 
-config M54xx
-	bool
-
 config M547x
 	bool "MCF547x"
 	select M54xx
@@ -280,6 +278,17 @@ config M5441x
 	help
 	  Freescale Coldfire 54410/54415/54416/54417/54418 processor support.
 
+endchoice
+
+config M527x
+	bool
+
+config M53xx
+	bool
+
+config M54xx
+	bool
+
 endif # COLDFIRE
 
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 014/267] m68knommu: force setting of CONFIG_CLOCK_FREQ for ColdFire
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 013/267] m68knommu: make ColdFire SoC selection a choice Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 015/267] Bluetooth: Fix race condition with user channel and setup stage Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Greg Ungerer, Geert Uytterhoeven,
	Guenter Roeck

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Greg Ungerer <gerg@uclinux.org>

commit d9ee489619744ee5ac246b8fb3dd65bb078d2f0a upstream.

It is possible to disable the clock selection at configuration time,
but for ColdFire targets we always expect a clock frequency to be
selected. This results in the following compile time error:

  CC      arch/m68k/kernel/asm-offsets.s
In file included from ./arch/m68k/include/asm/timex.h:14:0,
                 from include/linux/timex.h:65,
                 from include/linux/sched.h:19,
                 from arch/m68k/kernel/asm-offsets.c:14:
./arch/m68k/include/asm/coldfire.h:25:2: error: #error "Don't know what your ColdFire CPU clock frequency is??"

Remove CONFIG_CLOCK_SELECT completely and always enable CONFIG_CLOCK_FREQ
for ColdFire.

Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/m68k/Kconfig.cpu            |   14 +-------------
 arch/m68k/include/asm/coldfire.h |    2 +-
 2 files changed, 2 insertions(+), 14 deletions(-)

--- a/arch/m68k/Kconfig.cpu
+++ b/arch/m68k/Kconfig.cpu
@@ -425,22 +425,10 @@ config HAVE_MBAR
 config HAVE_IPSBAR
 	bool
 
-config CLOCK_SET
-	bool "Enable setting the CPU clock frequency"
-	depends on COLDFIRE
-	default n
-	help
-	  On some CPU's you do not need to know what the core CPU clock
-	  frequency is. On these you can disable clock setting. On some
-	  traditional 68K parts, and on all ColdFire parts you need to set
-	  the appropriate CPU clock frequency. On these devices many of the
-	  onboard peripherals derive their timing from the master CPU clock
-	  frequency.
-
 config CLOCK_FREQ
 	int "Set the core clock frequency"
 	default "66666666"
-	depends on CLOCK_SET
+	depends on COLDFIRE
 	help
 	  Define the CPU clock frequency in use. This is the core clock
 	  frequency, it may or may not be the same as the external clock
--- a/arch/m68k/include/asm/coldfire.h
+++ b/arch/m68k/include/asm/coldfire.h
@@ -19,7 +19,7 @@
  *	in any case new boards come along from time to time that have yet
  *	another different clocking frequency.
  */
-#ifdef CONFIG_CLOCK_SET
+#ifdef CONFIG_CLOCK_FREQ
 #define	MCF_CLK		CONFIG_CLOCK_FREQ
 #else
 #error "Don't know what your ColdFire CPU clock frequency is??"



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 015/267] Bluetooth: Fix race condition with user channel and setup stage
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 014/267] m68knommu: force setting of CONFIG_CLOCK_FREQ for ColdFire Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 016/267] Bluetooth: btusb: Fix memory leak in Intel setup routine Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marcel Holtmann, Johan Hedberg

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marcel Holtmann <marcel@holtmann.org>

commit 781f899f2f9d8b71e35225a087f90052059486c5 upstream.

During the initial setup stage of a controller, the low-level transport
is actually active. This means that HCI_UP is true. To avoid toggling
the transport off and back on again for normal operation the kernel
holds a grace period with HCI_AUTO_OFF that will turn the low-level
transport off in case no user is present.

The idea of the grace period is important to avoid having to initialize
all of the controller twice. So legacy ioctl and the new management
interface knows how to clear this grace period and then start normal
operation.

For the user channel operation this grace period has not been taken into
account which results in the problem that HCI_UP and HCI_AUTO_OFF are
set and the kernel will return EBUSY. However from a system point of
view the controller is ready to be grabbed by either the ioctl, the
management interface or the user channel.

This patch brings the user channel to the same level as the other two
entries for operating a controller.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/hci_sock.c |   26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -741,10 +741,11 @@ static int hci_sock_bind(struct socket *
 			goto done;
 		}
 
-		if (test_bit(HCI_UP, &hdev->flags) ||
-		    test_bit(HCI_INIT, &hdev->flags) ||
+		if (test_bit(HCI_INIT, &hdev->flags) ||
 		    hci_dev_test_flag(hdev, HCI_SETUP) ||
-		    hci_dev_test_flag(hdev, HCI_CONFIG)) {
+		    hci_dev_test_flag(hdev, HCI_CONFIG) ||
+		    (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
+		     test_bit(HCI_UP, &hdev->flags))) {
 			err = -EBUSY;
 			hci_dev_put(hdev);
 			goto done;
@@ -760,10 +761,21 @@ static int hci_sock_bind(struct socket *
 
 		err = hci_dev_open(hdev->id);
 		if (err) {
-			hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
-			mgmt_index_added(hdev);
-			hci_dev_put(hdev);
-			goto done;
+			if (err == -EALREADY) {
+				/* In case the transport is already up and
+				 * running, clear the error here.
+				 *
+				 * This can happen when opening an user
+				 * channel and HCI_AUTO_OFF grace period
+				 * is still active.
+				 */
+				err = 0;
+			} else {
+				hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
+				mgmt_index_added(hdev);
+				hci_dev_put(hdev);
+				goto done;
+			}
 		}
 
 		atomic_inc(&hdev->promisc);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 016/267] Bluetooth: btusb: Fix memory leak in Intel setup routine
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 015/267] Bluetooth: Fix race condition with user channel and setup stage Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 017/267] Bluetooth: btusb: Fix secure send command length alignment on Intel 8260 Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marcel Holtmann, Johan Hedberg

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marcel Holtmann <marcel@holtmann.org>

commit ecffc80478cdce122f0ecb6a4e4f909132dd5c47 upstream.

The SKB returned from the Intel specific version information command is
missing a kfree_skb.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/btusb.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -1993,6 +1993,8 @@ static int btusb_setup_intel(struct hci_
 	}
 	fw_ptr = fw->data;
 
+	kfree_skb(skb);
+
 	/* This Intel specific command enables the manufacturer mode of the
 	 * controller.
 	 *



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 017/267] Bluetooth: btusb: Fix secure send command length alignment on Intel 8260
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 016/267] Bluetooth: btusb: Fix memory leak in Intel setup routine Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 018/267] Bluetooth: btusb: Correct typo in Roper Class 1 Bluetooth Dongle Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tedd Ho-Jeong An, Marcel Holtmann,
	Johan Hedberg

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marcel Holtmann <marcel@holtmann.org>

commit e66890a96abbb746e1229c3067471be36dc49b34 upstream.

This patch fixes the command length alignment issue for Intel Bluetooth
8260.

The length of parameters in the firmware downloading command must be
multiplication of 4. If not, the command must append Intel_NOP command
with extra parameters, zeros, at the end, and the firmware file is
already included Intel_NOP command for alignment.

This patch checks the next command and if the next command is Intel_NOP
command, it reads the Intel_NOP command and send them together.

For example, if the data from the firmware file looks like this:
8E FC 03 11 22 33 02 FC 03 00 00 00

Previously, btusb sends two commands:
09 FC 06 8E FC 03 11 22 33
09 FC 06 02 FC 03 00 00 00

This won't work because the length of parameters are 6 which violates
the 4 byte alignment.

This patch will append them together and send as one command:
09 FC 0C 8E FC 03 11 22 33 02 FC 03 00 00 00

Based on previous work from Tedd Ho-Jeong An <tedd.an@intel.com>

Reported-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/btusb.c |   34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2336,6 +2336,7 @@ static int btusb_setup_intel_new(struct
 	struct intel_boot_params *params;
 	const struct firmware *fw;
 	const u8 *fw_ptr;
+	u32 frag_len;
 	char fwname[64];
 	ktime_t calltime, delta, rettime;
 	unsigned long long duration;
@@ -2542,24 +2543,33 @@ static int btusb_setup_intel_new(struct
 	}
 
 	fw_ptr = fw->data + 644;
+	frag_len = 0;
 
 	while (fw_ptr - fw->data < fw->size) {
-		struct hci_command_hdr *cmd = (void *)fw_ptr;
-		u8 cmd_len;
+		struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
 
-		cmd_len = sizeof(*cmd) + cmd->plen;
+		frag_len += sizeof(*cmd) + cmd->plen;
 
-		/* Send each command from the firmware data buffer as
-		 * a single Data fragment.
+		/* The paramter length of the secure send command requires
+		 * a 4 byte alignment. It happens so that the firmware file
+		 * contains proper Intel_NOP commands to align the fragments
+		 * as needed.
+		 *
+		 * Send set of commands with 4 byte alignment from the
+		 * firmware data buffer as a single Data fragement.
 		 */
-		err = btusb_intel_secure_send(hdev, 0x01, cmd_len, fw_ptr);
-		if (err < 0) {
-			BT_ERR("%s: Failed to send firmware data (%d)",
-			       hdev->name, err);
-			goto done;
-		}
+		if (!(frag_len % 4)) {
+			err = btusb_intel_secure_send(hdev, 0x01, frag_len,
+						      fw_ptr);
+			if (err < 0) {
+				BT_ERR("%s: Failed to send firmware data (%d)",
+				       hdev->name, err);
+				goto done;
+			}
 
-		fw_ptr += cmd_len;
+			fw_ptr += frag_len;
+			frag_len = 0;
+		}
 	}
 
 	set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 018/267] Bluetooth: btusb: Correct typo in Roper Class 1 Bluetooth Dongle
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 017/267] Bluetooth: btusb: Fix secure send command length alignment on Intel 8260 Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 019/267] Bluetooth: btbcm: allow btbcm_read_verbose_config to fail on Apple Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aleksei Volkov, Marcel Holtmann

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Aleksei Volkov <info@dv2c.ru>

commit 2eeac871697ac24a77b6d7953bd711b490e83ac7 upstream.

That patch corrects the typo in usb vendor id for Roper Class 1 Bluetooth
Dongle. Problem with typo is present since 4.0 kernel.

Content /sys/kernel/debug/usb/devices for these dongle:

T:  Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1310 ProdID=0001 Rev=15.00
S:  Manufacturer=SiW
S:  Product=SiW
S:  SerialNumber=E7BB050D0B00
C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr= 50mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Aleksei Volkov <info@dv2c.ru>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/btusb.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -268,7 +268,7 @@ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
 
 	/* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
-	{ USB_DEVICE(0x1300, 0x0001), .driver_info = BTUSB_SWAVE },
+	{ USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
 
 	/* Digianswer devices */
 	{ USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 019/267] Bluetooth: btbcm: allow btbcm_read_verbose_config to fail on Apple
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 018/267] Bluetooth: btusb: Correct typo in Roper Class 1 Bluetooth Dongle Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 020/267] ath9k: fix DMA stop sequence for AR9003+ Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chris Mason, Marcel Holtmann

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Mason <clm@fb.com>

commit 7bee8b08c428b63aa4a3765bb907602e36355378 upstream.

Commit 1c8ba6d013 moved around the setup code for broadcomm chips,
and also added btbcm_read_verbose_config() to read extra information
about the hardware.  It's returning errors on some macbooks:

Bluetooth: hci0: BCM: Read verbose config info failed (-16)

Which makes us error out of the setup function.  Since this
probe isn't critical to operate the chip, this patch just changes
things to carry on when it fails.

Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/btbcm.c |   11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

--- a/drivers/bluetooth/btbcm.c
+++ b/drivers/bluetooth/btbcm.c
@@ -378,12 +378,11 @@ int btbcm_setup_apple(struct hci_dev *hd
 
 	/* Read Verbose Config Version Info */
 	skb = btbcm_read_verbose_config(hdev);
-	if (IS_ERR(skb))
-		return PTR_ERR(skb);
-
-	BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
-		get_unaligned_le16(skb->data + 5));
-	kfree_skb(skb);
+	if (!IS_ERR(skb)) {
+		BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
+			get_unaligned_le16(skb->data + 5));
+		kfree_skb(skb);
+	}
 
 	set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 020/267] ath9k: fix DMA stop sequence for AR9003+
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 019/267] Bluetooth: btbcm: allow btbcm_read_verbose_config to fail on Apple Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 021/267] ath9k_htc: memory corruption calling set_bit() Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Kalle Valo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Felix Fietkau <nbd@openwrt.org>

commit 300f77c08ded96d33f492aaa02549103852f0c12 upstream.

AR93xx and newer needs to stop rx before tx to avoid getting the DMA
engine or MAC into a stuck state.
This should reduce/fix the occurence of "Failed to stop Tx DMA" logspam.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/ath/ath9k/main.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -216,11 +216,13 @@ static bool ath_prepare_reset(struct ath
 	ath_stop_ani(sc);
 	ath9k_hw_disable_interrupts(ah);
 
-	if (!ath_drain_all_txq(sc))
-		ret = false;
-
-	if (!ath_stoprecv(sc))
-		ret = false;
+	if (AR_SREV_9300_20_OR_LATER(ah)) {
+		ret &= ath_stoprecv(sc);
+		ret &= ath_drain_all_txq(sc);
+	} else {
+		ret &= ath_drain_all_txq(sc);
+		ret &= ath_stoprecv(sc);
+	}
 
 	return ret;
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 021/267] ath9k_htc: memory corruption calling set_bit()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 020/267] ath9k: fix DMA stop sequence for AR9003+ Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 022/267] rtlwifi: Remove the clear interrupt routine from all drivers Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kalle Valo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 191f1aeeb93bb58e56f4d1868294ae22f3f67d4e upstream.

In d8a2c51cdcae ('ath9k_htc: Use atomic operations for op_flags') we
changed things like this:

-	if (priv->op_flags & OP_TSF_RESET) {
+	if (test_bit(OP_TSF_RESET, &priv->op_flags)) {

The problem is that test_bit() takes a bit number and not a mask.  It
means that when we do:

	set_bit(OP_TSF_RESET, &priv->op_flags);

Then it sets the (1 << 6) bit instead of the 6 bit so we are setting a
bit which is past the end of the unsigned long.

Fixes: d8a2c51cdcae ('ath9k_htc: Use atomic operations for op_flags')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/ath/ath9k/htc.h |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -440,9 +440,9 @@ static inline void ath9k_htc_stop_btcoex
 }
 #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
 
-#define OP_BT_PRIORITY_DETECTED    BIT(3)
-#define OP_BT_SCAN                 BIT(4)
-#define OP_TSF_RESET               BIT(6)
+#define OP_BT_PRIORITY_DETECTED    3
+#define OP_BT_SCAN                 4
+#define OP_TSF_RESET               6
 
 enum htc_op_flags {
 	HTC_FWFLAG_NO_RMW,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 022/267] rtlwifi: Remove the clear interrupt routine from all drivers
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 021/267] ath9k_htc: memory corruption calling set_bit() Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 023/267] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Fann, Shao Fu, Larry Finger,
	Kalle Valo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vincent Fann <vincent_fann@realtek.com>

commit 1277fa2ab2f9a624a4b0177119ca13b5fd65edd0 upstream.

Several of these drivers have there TX randomly blocked for 3~5 seconds while
measuring tx throughput (iperf). The root couse happens in rtl_pci_flush().
The function uses a while-loop to wait for TX queue length to decrease to 0.
The TX queue length counts the number of packets that are queued in the driver.
The driver relys on the TX OK interrupt to return skb and reduce TX queue length.

The interrupt subroutine disables interupts, reads the interrupt registers, and
then clears the registers in the beginning of _rtl_pci_interrupt(). After all
interupts process are finished, the driver invokes enable_interrupt() to enable
interupts. This behavior is normal for an interrupt subroutine.

But enable_interrupt() invokes clear_interrupt() again. This unexpected interrupt
clearing may cleari me fresh TX OK interrupts. These missing interrupts cause TX
queue length to never reduce to 0i, which causes rtl_pci_flush() to be stuck in
unterminated while-loop.

This patch removes clear_interrupt() in enable_interrupt() to avoid this behavior.

Signed-off-by: Vincent Fann <vincent_fann@realtek.com>
Signed-off-by: Shao Fu <shaofu@realtek.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/rtlwifi/rtl8188ee/hw.c |   16 ----------------
 drivers/net/wireless/rtlwifi/rtl8192ee/hw.c |   17 -----------------
 drivers/net/wireless/rtlwifi/rtl8723ae/hw.c |   13 -------------
 drivers/net/wireless/rtlwifi/rtl8723be/hw.c |   17 -----------------
 drivers/net/wireless/rtlwifi/rtl8821ae/hw.c |   20 --------------------
 5 files changed, 83 deletions(-)

--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
@@ -1354,27 +1354,11 @@ void rtl88ee_set_qos(struct ieee80211_hw
 	}
 }
 
-static void rtl88ee_clear_interrupt(struct ieee80211_hw *hw)
-{
-	struct rtl_priv *rtlpriv = rtl_priv(hw);
-	u32 tmp;
-
-	tmp = rtl_read_dword(rtlpriv, REG_HISR);
-	rtl_write_dword(rtlpriv, REG_HISR, tmp);
-
-	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
-
-	tmp = rtl_read_dword(rtlpriv, REG_HSISR);
-	rtl_write_dword(rtlpriv, REG_HSISR, tmp);
-}
-
 void rtl88ee_enable_interrupt(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 
-	rtl88ee_clear_interrupt(hw);/*clear it here first*/
 	rtl_write_dword(rtlpriv, REG_HIMR,
 			rtlpci->irq_mask[0] & 0xFFFFFFFF);
 	rtl_write_dword(rtlpriv, REG_HIMRE,
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
@@ -1584,28 +1584,11 @@ void rtl92ee_set_qos(struct ieee80211_hw
 	}
 }
 
-static void rtl92ee_clear_interrupt(struct ieee80211_hw *hw)
-{
-	struct rtl_priv *rtlpriv = rtl_priv(hw);
-	u32 tmp;
-
-	tmp = rtl_read_dword(rtlpriv, REG_HISR);
-	rtl_write_dword(rtlpriv, REG_HISR, tmp);
-
-	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
-
-	tmp = rtl_read_dword(rtlpriv, REG_HSISR);
-	rtl_write_dword(rtlpriv, REG_HSISR, tmp);
-}
-
 void rtl92ee_enable_interrupt(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 
-	rtl92ee_clear_interrupt(hw);/*clear it here first*/
-
 	rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
 	rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
 	rtlpci->irq_enabled = true;
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
@@ -1258,18 +1258,6 @@ void rtl8723e_set_qos(struct ieee80211_h
 	}
 }
 
-static void rtl8723e_clear_interrupt(struct ieee80211_hw *hw)
-{
-	struct rtl_priv *rtlpriv = rtl_priv(hw);
-	u32 tmp;
-
-	tmp = rtl_read_dword(rtlpriv, REG_HISR);
-	rtl_write_dword(rtlpriv, REG_HISR, tmp);
-
-	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
-}
-
 void rtl8723e_enable_interrupt(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1284,7 +1272,6 @@ void rtl8723e_disable_interrupt(struct i
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-	rtl8723e_clear_interrupt(hw);/*clear it here first*/
 	rtl_write_dword(rtlpriv, 0x3a8, IMR8190_DISABLED);
 	rtl_write_dword(rtlpriv, 0x3ac, IMR8190_DISABLED);
 	rtlpci->irq_enabled = false;
--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
@@ -1634,28 +1634,11 @@ void rtl8723be_set_qos(struct ieee80211_
 	}
 }
 
-static void rtl8723be_clear_interrupt(struct ieee80211_hw *hw)
-{
-	struct rtl_priv *rtlpriv = rtl_priv(hw);
-	u32 tmp;
-
-	tmp = rtl_read_dword(rtlpriv, REG_HISR);
-	rtl_write_dword(rtlpriv, REG_HISR, tmp);
-
-	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
-
-	tmp = rtl_read_dword(rtlpriv, REG_HSISR);
-	rtl_write_dword(rtlpriv, REG_HSISR, tmp);
-}
-
 void rtl8723be_enable_interrupt(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 
-	rtl8723be_clear_interrupt(hw);/*clear it here first*/
-
 	rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
 	rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
 	rtlpci->irq_enabled = true;
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
@@ -2253,31 +2253,11 @@ void rtl8821ae_set_qos(struct ieee80211_
 	}
 }
 
-static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw)
-{
-	struct rtl_priv *rtlpriv = rtl_priv(hw);
-	u32 tmp;
-	tmp = rtl_read_dword(rtlpriv, REG_HISR);
-	/*printk("clear interrupt first:\n");
-	printk("0x%x = 0x%08x\n",REG_HISR, tmp);*/
-	rtl_write_dword(rtlpriv, REG_HISR, tmp);
-
-	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-	/*printk("0x%x = 0x%08x\n",REG_HISRE, tmp);*/
-	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
-
-	tmp = rtl_read_dword(rtlpriv, REG_HSISR);
-	/*printk("0x%x = 0x%08x\n",REG_HSISR, tmp);*/
-	rtl_write_dword(rtlpriv, REG_HSISR, tmp);
-}
-
 void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 
-	rtl8821ae_clear_interrupt(hw);/*clear it here first*/
-
 	rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
 	rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
 	rtlpci->irq_enabled = true;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 023/267] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak.
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 022/267] rtlwifi: Remove the clear interrupt routine from all drivers Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 024/267] staging: vt6656: check ieee80211_bss_conf bssid not NULL Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lennert Buytenhek, Alexander Aring,
	Marcel Holtmann

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lennert Buytenhek <buytenh@wantstofly.org>

commit 8a70cefa3037d62e7c0b6068a66675def1a330c9 upstream.

The AF_IEEE802154 sockaddr looks like this:

	struct sockaddr_ieee802154 {
		sa_family_t family; /* AF_IEEE802154 */
		struct ieee802154_addr_sa addr;
	};

	struct ieee802154_addr_sa {
		int addr_type;
		u16 pan_id;
		union {
			u8 hwaddr[IEEE802154_ADDR_LEN];
			u16 short_addr;
		};
	};

On most architectures there will be implicit structure padding here,
in two different places:

* In struct sockaddr_ieee802154, two bytes of padding between 'family'
  (unsigned short) and 'addr', so that 'addr' starts on a four byte
  boundary.

* In struct ieee802154_addr_sa, two bytes at the end of the structure,
  to make the structure 16 bytes.

When calling recvmsg(2) on a PF_IEEE802154 SOCK_DGRAM socket, the
ieee802154 stack constructs a struct sockaddr_ieee802154 on the
kernel stack without clearing these padding fields, and, depending
on the addr_type, between four and ten bytes of uncleared kernel
stack will be copied to userspace.

We can't just insert two 'u16 __pad's in the right places and zero
those before copying an address to userspace, as not all architectures
insert this implicit padding -- from a quick test it seems that avr32,
cris and m68k don't insert this padding, while every other architecture
that I have cross compilers for does insert this padding.

The easiest way to plug the leak is to just memset the whole struct
sockaddr_ieee802154 before filling in the fields we want to fill in,
and that's what this patch does.

Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Acked-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ieee802154/socket.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -739,6 +739,12 @@ static int dgram_recvmsg(struct sock *sk
 	sock_recv_ts_and_drops(msg, sk, skb);
 
 	if (saddr) {
+		/* Clear the implicit padding in struct sockaddr_ieee802154
+		 * (16 bits between 'family' and 'addr') and in struct
+		 * ieee802154_addr_sa (16 bits at the end of the structure).
+		 */
+		memset(saddr, 0, sizeof(*saddr));
+
 		saddr->family = AF_IEEE802154;
 		ieee802154_addr_to_sa(&saddr->addr, &mac_cb(skb)->source);
 		*addr_len = sizeof(*saddr);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 024/267] staging: vt6656: check ieee80211_bss_conf bssid not NULL
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 023/267] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 025/267] staging: vt6655: " Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Malcolm Priestley

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Malcolm Priestley <tvboxspy@gmail.com>

commit d309509f84725f99326cc73d3b00aae096b374ae upstream.

Sometimes bssid can go null on failed association.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/vt6656/main_usb.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -701,7 +701,7 @@ static void vnt_bss_info_changed(struct
 
 	priv->current_aid = conf->aid;
 
-	if (changed & BSS_CHANGED_BSSID)
+	if (changed & BSS_CHANGED_BSSID && conf->bssid)
 		vnt_mac_set_bssid_addr(priv, (u8 *)conf->bssid);
 
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 025/267] staging: vt6655: check ieee80211_bss_conf bssid not NULL
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 024/267] staging: vt6656: check ieee80211_bss_conf bssid not NULL Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 026/267] staging: vt6655: device_rx_srv check sk_buff is NULL Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Malcolm Priestley

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Malcolm Priestley <tvboxspy@gmail.com>

commit 8e8e9198920ddfa920191069ae02eba75d39e653 upstream.

Sometimes bssid can go null on failed association.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/vt6655/device_main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1417,7 +1417,7 @@ static void vnt_bss_info_changed(struct
 
 	priv->current_aid = conf->aid;
 
-	if (changed & BSS_CHANGED_BSSID) {
+	if (changed & BSS_CHANGED_BSSID && conf->bssid) {
 		unsigned long flags;
 
 		spin_lock_irqsave(&priv->lock, flags);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 026/267] staging: vt6655: device_rx_srv check sk_buff is NULL
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 025/267] staging: vt6655: " Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 027/267] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Malcolm Priestley

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Malcolm Priestley <tvboxspy@gmail.com>

commit b5eeed8cb6097c8ea660b6598d36fdbb94065a22 upstream.

There is a small chance that pRD->pRDInfo->skb could go NULL
while the interrupt is processing.

Put NULL check on loop to break out.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/vt6655/device_main.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -807,6 +807,10 @@ static int device_rx_srv(struct vnt_priv
 	     pRD = pRD->next) {
 		if (works++ > 15)
 			break;
+
+		if (!pRD->pRDInfo->skb)
+			break;
+
 		if (vnt_receive_frame(pDevice, pRD)) {
 			if (!device_alloc_rx_buf(pDevice, pRD)) {
 				dev_err(&pDevice->pcid->dev,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 027/267] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 026/267] staging: vt6655: device_rx_srv check sk_buff is NULL Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:37 ` [PATCH 4.1 028/267] staging: comedi: cb_pcimdas: fix handlers for DI and DO subdevices Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Haggai Eran, Larry Finger

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Haggai Eran <haggai.eran@gmail.com>

commit cab462140f8a183e3cca0b51c8b59ef715cb6148 upstream.

With an RTL8191SU USB adaptor, sometimes the hints for a fragmented
packet are set, but the packet length is too large. Allocate enough
space to prevent memory corruption and a resulting kernel panic [1].

[1] http://www.spinics.net/lists/linux-wireless/msg136546.html

Signed-off-by: Haggai Eran <haggai.eran@gmail.com>
ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/rtl8712/rtl8712_recv.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/staging/rtl8712/rtl8712_recv.c
+++ b/drivers/staging/rtl8712/rtl8712_recv.c
@@ -1056,7 +1056,8 @@ static int recvbuf2recvframe(struct _ada
 		/* for first fragment packet, driver need allocate 1536 +
 		 * drvinfo_sz + RXDESC_SIZE to defrag packet. */
 		if ((mf == 1) && (frag == 0))
-			alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
+			/*1658+6=1664, 1664 is 128 alignment.*/
+			alloc_sz = max_t(u16, tmp_len, 1658);
 		else
 			alloc_sz = tmp_len;
 		/* 2 is for IP header 4 bytes alignment in QoS packet case.



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 028/267] staging: comedi: cb_pcimdas: fix handlers for DI and DO subdevices
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 027/267] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe Greg Kroah-Hartman
@ 2015-07-31 19:37 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 029/267] hid-sensor: Fix suspend/resume delay Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:37 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ian Abbott

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ian Abbott <abbotti@mev.co.uk>

commit b08ad6657aacf9b5d7c4b22de2ba891b152d0528 upstream.

Normally, low-level Comedi drivers set an `insn_bits` handler for
digital input (DI), digital output (DO) and digital input/output (DIO)
subdevice types to handle normal reading and writing of digital
channels.  The "cb_pcimdas" driver currently has an `insn_read` handler
for the DI subdevice and an `insn_write` handler for the DO subdevice.
However, the actual handler functions `cb_pcimdas_di_insn_read()` and
`cb_pcimdas_do_insn_write()` are written to behave like `insn_bits`
handlers.  Something's wrong there!  To fix it, set the functions as
`insn_bits` handlers and rename them for consistency.

Fixes: e56d03dee14a ("staging: comedi: cb_pcimdas: add main connector digital input/output")
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/comedi/drivers/cb_pcimdas.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/staging/comedi/drivers/cb_pcimdas.c
+++ b/drivers/staging/comedi/drivers/cb_pcimdas.c
@@ -243,7 +243,7 @@ static int cb_pcimdas_ao_insn_write(stru
 	return insn->n;
 }
 
-static int cb_pcimdas_di_insn_read(struct comedi_device *dev,
+static int cb_pcimdas_di_insn_bits(struct comedi_device *dev,
 				   struct comedi_subdevice *s,
 				   struct comedi_insn *insn,
 				   unsigned int *data)
@@ -258,7 +258,7 @@ static int cb_pcimdas_di_insn_read(struc
 	return insn->n;
 }
 
-static int cb_pcimdas_do_insn_write(struct comedi_device *dev,
+static int cb_pcimdas_do_insn_bits(struct comedi_device *dev,
 				    struct comedi_subdevice *s,
 				    struct comedi_insn *insn,
 				    unsigned int *data)
@@ -424,7 +424,7 @@ static int cb_pcimdas_auto_attach(struct
 	s->n_chan	= 4;
 	s->maxdata	= 1;
 	s->range_table	= &range_digital;
-	s->insn_read	= cb_pcimdas_di_insn_read;
+	s->insn_bits	= cb_pcimdas_di_insn_bits;
 
 	/* Digital Output subdevice (main connector) */
 	s = &dev->subdevices[4];
@@ -433,7 +433,7 @@ static int cb_pcimdas_auto_attach(struct
 	s->n_chan	= 4;
 	s->maxdata	= 1;
 	s->range_table	= &range_digital;
-	s->insn_write	= cb_pcimdas_do_insn_write;
+	s->insn_bits	= cb_pcimdas_do_insn_bits;
 
 	/* Counter subdevice (8254) */
 	s = &dev->subdevices[5];



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 029/267] hid-sensor: Fix suspend/resume delay
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2015-07-31 19:37 ` [PATCH 4.1 028/267] staging: comedi: cb_pcimdas: fix handlers for DI and DO subdevices Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 030/267] ext4: fix race between truncate and __ext4_journalled_writepage() Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada, Len Brown,
	Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

commit 1e25aa9641e8f3fa39cd5e46b4afcafd7f12a44b upstream.

By default all the sensors are runtime suspended state (lowest power
state). During Linux suspend process, all the run time suspended
devices are resumed and then suspended. This caused all sensors to
power up and introduced delay in suspend time, when we introduced
runtime PM for HID sensors. The opposite process happens during resume
process.

To fix this, we do powerup process of the sensors only when the request
is issued from user (raw or tiggerred). In this way when runtime,
resume calls for powerup it will simply return as this will not match
user requested state.

Note this is a regression fix as the increase in suspend / resume
times can be substantial (report of 8 seconds on Len's laptop!)

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Tested-by: Len Brown <len.brown@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/common/hid-sensors/hid-sensor-trigger.c |   11 ++++++++++-
 include/linux/hid-sensor-hub.h                      |    1 +
 2 files changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -36,6 +36,8 @@ static int _hid_sensor_power_state(struc
 	s32 poll_value = 0;
 
 	if (state) {
+		if (!atomic_read(&st->user_requested_state))
+			return 0;
 		if (sensor_hub_device_open(st->hsdev))
 			return -EIO;
 
@@ -52,8 +54,12 @@ static int _hid_sensor_power_state(struc
 
 		poll_value = hid_sensor_read_poll_value(st);
 	} else {
-		if (!atomic_dec_and_test(&st->data_ready))
+		int val;
+
+		val = atomic_dec_if_positive(&st->data_ready);
+		if (val < 0)
 			return 0;
+
 		sensor_hub_device_close(st->hsdev);
 		state_val = hid_sensor_get_usage_index(st->hsdev,
 			st->power_state.report_id,
@@ -92,9 +98,11 @@ EXPORT_SYMBOL(hid_sensor_power_state);
 
 int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
 {
+
 #ifdef CONFIG_PM
 	int ret;
 
+	atomic_set(&st->user_requested_state, state);
 	if (state)
 		ret = pm_runtime_get_sync(&st->pdev->dev);
 	else {
@@ -109,6 +117,7 @@ int hid_sensor_power_state(struct hid_se
 
  	return 0;
 #else
+	atomic_set(&st->user_requested_state, state);
 	return _hid_sensor_power_state(st, state);
 #endif
 }
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -230,6 +230,7 @@ struct hid_sensor_common {
 	struct platform_device *pdev;
 	unsigned usage_id;
 	atomic_t data_ready;
+	atomic_t user_requested_state;
 	struct iio_trigger *trigger;
 	struct hid_sensor_hub_attribute_info poll;
 	struct hid_sensor_hub_attribute_info report_state;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 030/267] ext4: fix race between truncate and __ext4_journalled_writepage()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 029/267] hid-sensor: Fix suspend/resume delay Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 031/267] ext4: call sync_blockdev() before invalidate_bdev() in put_super() Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit bdf96838aea6a265f2ae6cbcfb12a778c84a0b8e upstream.

The commit cf108bca465d: "ext4: Invert the locking order of page_lock
and transaction start" caused __ext4_journalled_writepage() to drop
the page lock before the page was written back, as part of changing
the locking order to jbd2_journal_start -> page_lock.  However, this
introduced a potential race if there was a truncate racing with the
data=journalled writeback mode.

Fix this by grabbing the page lock after starting the journal handle,
and then checking to see if page had gotten truncated out from under
us.

This fixes a number of different warnings or BUG_ON's when running
xfstests generic/086 in data=journalled mode, including:

jbd2_journal_dirty_metadata: vdc-8: bad jh for block 115643: transaction (ee3fe7
c0, 164), jh->b_transaction (  (null), 0), jh->b_next_transaction (  (null), 0), jlist 0

	      	      	  - and -

kernel BUG at /usr/projects/linux/ext4/fs/jbd2/transaction.c:2200!
    ...
Call Trace:
 [<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117
 [<c02b2de5>] __ext4_journalled_invalidatepage+0x10f/0x117
 [<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117
 [<c027d883>] ? lock_buffer+0x36/0x36
 [<c02b2dfa>] ext4_journalled_invalidatepage+0xd/0x22
 [<c0229139>] do_invalidatepage+0x22/0x26
 [<c0229198>] truncate_inode_page+0x5b/0x85
 [<c022934b>] truncate_inode_pages_range+0x156/0x38c
 [<c0229592>] truncate_inode_pages+0x11/0x15
 [<c022962d>] truncate_pagecache+0x55/0x71
 [<c02b913b>] ext4_setattr+0x4a9/0x560
 [<c01ca542>] ? current_kernel_time+0x10/0x44
 [<c026c4d8>] notify_change+0x1c7/0x2be
 [<c0256a00>] do_truncate+0x65/0x85
 [<c0226f31>] ? file_ra_state_init+0x12/0x29

	      	      	  - and -

WARNING: CPU: 1 PID: 1331 at /usr/projects/linux/ext4/fs/jbd2/transaction.c:1396
irty_metadata+0x14a/0x1ae()
    ...
Call Trace:
 [<c01b879f>] ? console_unlock+0x3a1/0x3ce
 [<c082cbb4>] dump_stack+0x48/0x60
 [<c0178b65>] warn_slowpath_common+0x89/0xa0
 [<c02ef2cf>] ? jbd2_journal_dirty_metadata+0x14a/0x1ae
 [<c0178bef>] warn_slowpath_null+0x14/0x18
 [<c02ef2cf>] jbd2_journal_dirty_metadata+0x14a/0x1ae
 [<c02d8615>] __ext4_handle_dirty_metadata+0xd4/0x19d
 [<c02b2f44>] write_end_fn+0x40/0x53
 [<c02b4a16>] ext4_walk_page_buffers+0x4e/0x6a
 [<c02b59e7>] ext4_writepage+0x354/0x3b8
 [<c02b2f04>] ? mpage_release_unused_pages+0xd4/0xd4
 [<c02b1b21>] ? wait_on_buffer+0x2c/0x2c
 [<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
 [<c02b5a5b>] __writepage+0x10/0x2e
 [<c0225956>] write_cache_pages+0x22d/0x32c
 [<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
 [<c02b6ee8>] ext4_writepages+0x102/0x607
 [<c019adfe>] ? sched_clock_local+0x10/0x10e
 [<c01a8a7c>] ? __lock_is_held+0x2e/0x44
 [<c01a8ad5>] ? lock_is_held+0x43/0x51
 [<c0226dff>] do_writepages+0x1c/0x29
 [<c0276bed>] __writeback_single_inode+0xc3/0x545
 [<c0277c07>] writeback_sb_inodes+0x21f/0x36d
    ...

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/inode.c |   23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1701,19 +1701,32 @@ static int __ext4_journalled_writepage(s
 		ext4_walk_page_buffers(handle, page_bufs, 0, len,
 				       NULL, bget_one);
 	}
-	/* As soon as we unlock the page, it can go away, but we have
-	 * references to buffers so we are safe */
+	/*
+	 * We need to release the page lock before we start the
+	 * journal, so grab a reference so the page won't disappear
+	 * out from under us.
+	 */
+	get_page(page);
 	unlock_page(page);
 
 	handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
 				    ext4_writepage_trans_blocks(inode));
 	if (IS_ERR(handle)) {
 		ret = PTR_ERR(handle);
-		goto out;
+		put_page(page);
+		goto out_no_pagelock;
 	}
-
 	BUG_ON(!ext4_handle_valid(handle));
 
+	lock_page(page);
+	put_page(page);
+	if (page->mapping != mapping) {
+		/* The page got truncated from under us */
+		ext4_journal_stop(handle);
+		ret = 0;
+		goto out;
+	}
+
 	if (inline_data) {
 		BUFFER_TRACE(inode_bh, "get write access");
 		ret = ext4_journal_get_write_access(handle, inode_bh);
@@ -1739,6 +1752,8 @@ static int __ext4_journalled_writepage(s
 				       NULL, bput_one);
 	ext4_set_inode_state(inode, EXT4_STATE_JDATA);
 out:
+	unlock_page(page);
+out_no_pagelock:
 	brelse(inode_bh);
 	return ret;
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 031/267] ext4: call sync_blockdev() before invalidate_bdev() in put_super()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 030/267] ext4: fix race between truncate and __ext4_journalled_writepage() Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 032/267] ext4: dont retry file block mapping on bigalloc fs with non-extent file Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit 89d96a6f8e6491f24fc8f99fd6ae66820e85c6c1 upstream.

Normally all of the buffers will have been forced out to disk before
we call invalidate_bdev(), but there will be some cases, where a file
system operation was aborted due to an ext4_error(), where there may
still be some dirty buffers in the buffer cache for the device.  So
try to force them out to memory before calling invalidate_bdev().

This fixes a warning triggered by generic/081:

WARNING: CPU: 1 PID: 3473 at /usr/projects/linux/ext4/fs/block_dev.c:56 __blkdev_put+0xb5/0x16f()

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/super.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -807,6 +807,7 @@ static void ext4_put_super(struct super_
 		dump_orphan_list(sb, sbi);
 	J_ASSERT(list_empty(&sbi->s_orphan));
 
+	sync_blockdev(sb->s_bdev);
 	invalidate_bdev(sb->s_bdev);
 	if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
 		/*



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 032/267] ext4: dont retry file block mapping on bigalloc fs with non-extent file
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 031/267] ext4: call sync_blockdev() before invalidate_bdev() in put_super() Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 033/267] ext4: set lazytime on remount if MS_LAZYTIME is set by mount Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Darrick J. Wong, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Darrick J. Wong" <darrick.wong@oracle.com>

commit 292db1bc6c105d86111e858859456bcb11f90f91 upstream.

ext4 isn't willing to map clusters to a non-extent file.  Don't signal
this with an out of space error, since the FS will retry the
allocation (which didn't fail) forever.  Instead, return EUCLEAN so
that the operation will fail immediately all the way back to userspace.

(The fix is either to run e2fsck -E bmap2extent, or to chattr +e the file.)

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/indirect.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -565,7 +565,7 @@ int ext4_ind_map_blocks(handle_t *handle
 				       EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
 		EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
 				 "non-extent mapped inodes with bigalloc");
-		return -ENOSPC;
+		return -EUCLEAN;
 	}
 
 	/* Set up for the direct block allocation */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 033/267] ext4: set lazytime on remount if MS_LAZYTIME is set by mount
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 032/267] ext4: dont retry file block mapping on bigalloc fs with non-extent file Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 034/267] ext4: fix fencepost error in lazytime optimization Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit a2fd66d069d86d793e9d39d4079b96f46d13f237 upstream.

Newer versions of mount parse the lazytime feature and pass it to the
mount system call via the flags field in the mount system call,
removing the lazytime string from the mount options list.  So we need
to check for the presence of MS_LAZYTIME and set it in sb->s_flags in
order for this flag to be set on a remount.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/super.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4944,6 +4944,9 @@ static int ext4_remount(struct super_blo
 		set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
 	}
 
+	if (*flags & MS_LAZYTIME)
+		sb->s_flags |= MS_LAZYTIME;
+
 	if ((*flags & MS_RDONLY) != (sb->s_flags & MS_RDONLY)) {
 		if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) {
 			err = -EROFS;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 034/267] ext4: fix fencepost error in lazytime optimization
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 033/267] ext4: set lazytime on remount if MS_LAZYTIME is set by mount Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 035/267] bufferhead: Add _gfp version for sb_getblk() Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit 0f0ff9a9f3fa2ec6f427603fd521d5f3a0b076d1 upstream.

Commit 8f4d8558391: "ext4: fix lazytime optimization" was not a
complete fix.  In the case where the inode number is a multiple of 16,
and we could still end up updating an inode with dirty timestamps
written to the wrong inode on disk.  Oops.

This can be easily reproduced by using generic/005 with a file system
with metadata_csum and lazytime enabled.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/inode.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4360,7 +4360,12 @@ static void ext4_update_other_inodes_tim
 	int inode_size = EXT4_INODE_SIZE(sb);
 
 	oi.orig_ino = orig_ino;
-	ino = (orig_ino & ~(inodes_per_block - 1)) + 1;
+	/*
+	 * Calculate the first inode in the inode table block.  Inode
+	 * numbers are one-based.  That is, the first inode in a block
+	 * (assuming 4k blocks and 256 byte inodes) is (n*16 + 1).
+	 */
+	ino = ((orig_ino - 1) & ~(inodes_per_block - 1)) + 1;
 	for (i = 0; i < inodes_per_block; i++, ino++, buf += inode_size) {
 		if (ino == orig_ino)
 			continue;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 035/267] bufferhead: Add _gfp version for sb_getblk()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 034/267] ext4: fix fencepost error in lazytime optimization Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 036/267] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nikolay Borisov <kernel@kyup.com>

commit bd7ade3cd9b0850264306f5c2b79024a417b6396 upstream.

sb_getblk() is used during ext4 (and possibly other FSes) writeback
paths. Sometimes such path require allocating memory and guaranteeing
that such allocation won't block. Currently, however, there is no way
to provide user flags for sb_getblk which could lead to deadlocks.

This patch implements a sb_getblk_gfp with the only difference it can
accept user-provided GFP flags.

Signed-off-by: Nikolay Borisov <kernel@kyup.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/buffer_head.h |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@ -317,6 +317,13 @@ sb_getblk(struct super_block *sb, sector
 	return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
 }
 
+
+static inline struct buffer_head *
+sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp)
+{
+	return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp);
+}
+
 static inline struct buffer_head *
 sb_find_get_block(struct super_block *sb, sector_t block)
 {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 036/267] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 035/267] bufferhead: Add _gfp version for sb_getblk() Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 037/267] ext4: fix reservation release on invalidatepage for delalloc fs Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nikolay Borisov <kernel@kyup.com>

commit c45653c341f5c8a0ce19c8f0ad4678640849cb86 upstream.

Switch ext4 to using sb_getblk_gfp with GFP_NOFS added to fix possible
deadlocks in the page writeback path.

Signed-off-by: Nikolay Borisov <kernel@kyup.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/extents.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -503,7 +503,7 @@ __read_extent_tree_block(const char *fun
 	struct buffer_head		*bh;
 	int				err;
 
-	bh = sb_getblk(inode->i_sb, pblk);
+	bh = sb_getblk_gfp(inode->i_sb, pblk, __GFP_MOVABLE | GFP_NOFS);
 	if (unlikely(!bh))
 		return ERR_PTR(-ENOMEM);
 
@@ -1088,7 +1088,7 @@ static int ext4_ext_split(handle_t *hand
 		err = -EIO;
 		goto cleanup;
 	}
-	bh = sb_getblk(inode->i_sb, newblock);
+	bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
 	if (unlikely(!bh)) {
 		err = -ENOMEM;
 		goto cleanup;
@@ -1282,7 +1282,7 @@ static int ext4_ext_grow_indepth(handle_
 	if (newblock == 0)
 		return err;
 
-	bh = sb_getblk(inode->i_sb, newblock);
+	bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
 	if (unlikely(!bh))
 		return -ENOMEM;
 	lock_buffer(bh);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 037/267] ext4: fix reservation release on invalidatepage for delalloc fs
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 036/267] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 038/267] ext4: be more strict when migrating to non-extent based file Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Czerner, Theodore Tso, Jan Kara

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lukas Czerner <lczerner@redhat.com>

commit 9705acd63b125dee8b15c705216d7186daea4625 upstream.

On delalloc enabled file system on invalidatepage operation
in ext4_da_page_release_reservation() we want to clear the delayed
buffer and remove the extent covering the delayed buffer from the extent
status tree.

However currently there is a bug where on the systems with page size >
block size we will always remove extents from the start of the page
regardless where the actual delayed buffers are positioned in the page.
This leads to the errors like this:

EXT4-fs warning (device loop0): ext4_da_release_space:1225:
ext4_da_release_space: ino 13, to_free 1 with only 0 reserved data
blocks

This however can cause data loss on writeback time if the file system is
in ENOSPC condition because we're releasing reservation for someones
else delayed buffer.

Fix this by only removing extents that corresponds to the part of the
page we want to invalidate.

This problem is reproducible by the following fio receipt (however I was
only able to reproduce it with fio-2.1 or older.

[global]
bs=8k
iodepth=1024
iodepth_batch=60
randrepeat=1
size=1m
directory=/mnt/test
numjobs=20
[job1]
ioengine=sync
bs=1k
direct=1
rw=randread
filename=file1:file2
[job2]
ioengine=libaio
rw=randwrite
direct=1
filename=file1:file2
[job3]
bs=1k
ioengine=posixaio
rw=randwrite
direct=1
filename=file1:file2
[job5]
bs=1k
ioengine=sync
rw=randread
filename=file1:file2
[job7]
ioengine=libaio
rw=randwrite
filename=file1:file2
[job8]
ioengine=posixaio
rw=randwrite
filename=file1:file2
[job10]
ioengine=mmap
rw=randwrite
bs=1k
filename=file1:file2
[job11]
ioengine=mmap
rw=randwrite
direct=1
filename=file1:file2

Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/inode.c |   15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1342,7 +1342,7 @@ static void ext4_da_page_release_reserva
 					     unsigned int offset,
 					     unsigned int length)
 {
-	int to_release = 0;
+	int to_release = 0, contiguous_blks = 0;
 	struct buffer_head *head, *bh;
 	unsigned int curr_off = 0;
 	struct inode *inode = page->mapping->host;
@@ -1363,14 +1363,23 @@ static void ext4_da_page_release_reserva
 
 		if ((offset <= curr_off) && (buffer_delay(bh))) {
 			to_release++;
+			contiguous_blks++;
 			clear_buffer_delay(bh);
+		} else if (contiguous_blks) {
+			lblk = page->index <<
+			       (PAGE_CACHE_SHIFT - inode->i_blkbits);
+			lblk += (curr_off >> inode->i_blkbits) -
+				contiguous_blks;
+			ext4_es_remove_extent(inode, lblk, contiguous_blks);
+			contiguous_blks = 0;
 		}
 		curr_off = next_off;
 	} while ((bh = bh->b_this_page) != head);
 
-	if (to_release) {
+	if (contiguous_blks) {
 		lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
-		ext4_es_remove_extent(inode, lblk, to_release);
+		lblk += (curr_off >> inode->i_blkbits) - contiguous_blks;
+		ext4_es_remove_extent(inode, lblk, contiguous_blks);
 	}
 
 	/* If we have released all the blocks belonging to a cluster, then we



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 038/267] ext4: be more strict when migrating to non-extent based file
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 037/267] ext4: fix reservation release on invalidatepage for delalloc fs Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 039/267] ext4: correctly migrate a file with a hole at the beginning Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eryu Guan, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eryu Guan <guaneryu@gmail.com>

commit d6f123a9297496ad0b6335fe881504c4b5b2a5e5 upstream.

Currently the check in ext4_ind_migrate() is not enough before doing the
real conversion:

a) delayed allocated extents could bypass the check on eh->eh_entries
   and eh->eh_depth

This can be demonstrated by this script

  xfs_io -fc "pwrite 0 4k" -c "pwrite 8k 4k" /mnt/ext4/testfile
  chattr -e /mnt/ext4/testfile

where testfile has two extents but still be converted to non-extent
based file format.

b) only extent length is checked but not the offset, which would result
   in data lose (delalloc) or fs corruption (nodelalloc), because
   non-extent based file only supports at most (12 + 2^10 + 2^20 + 2^30)
   blocks

This can be demostrated by

  xfs_io -fc "pwrite 5T 4k" /mnt/ext4/testfile
  chattr -e /mnt/ext4/testfile
  sync

If delalloc is enabled, dmesg prints
  EXT4-fs warning (device dm-4): ext4_block_to_path:105: block 1342177280 > max in inode 53
  EXT4-fs (dm-4): Delayed block allocation failed for inode 53 at logical offset 1342177280 with max blocks 1 with error 5
  EXT4-fs (dm-4): This should not happen!! Data will be lost

If delalloc is disabled, e2fsck -nf shows corruption
  Inode 53, i_size is 5497558142976, should be 4096.  Fix? no

Fix the two issues by

a) forcing all delayed allocation blocks to be allocated before checking
   eh->eh_depth and eh->eh_entries
b) limiting the last logical block of the extent is within direct map

Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/migrate.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -620,6 +620,7 @@ int ext4_ind_migrate(struct inode *inode
 	struct ext4_inode_info		*ei = EXT4_I(inode);
 	struct ext4_extent		*ex;
 	unsigned int			i, len;
+	ext4_lblk_t			end;
 	ext4_fsblk_t			blk;
 	handle_t			*handle;
 	int				ret;
@@ -633,6 +634,14 @@ int ext4_ind_migrate(struct inode *inode
 				       EXT4_FEATURE_RO_COMPAT_BIGALLOC))
 		return -EOPNOTSUPP;
 
+	/*
+	 * In order to get correct extent info, force all delayed allocation
+	 * blocks to be allocated, otherwise delayed allocation blocks may not
+	 * be reflected and bypass the checks on extent header.
+	 */
+	if (test_opt(inode->i_sb, DELALLOC))
+		ext4_alloc_da_blocks(inode);
+
 	handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
 	if (IS_ERR(handle))
 		return PTR_ERR(handle);
@@ -654,7 +663,8 @@ int ext4_ind_migrate(struct inode *inode
 	else {
 		len = le16_to_cpu(ex->ee_len);
 		blk = ext4_ext_pblock(ex);
-		if (len > EXT4_NDIR_BLOCKS) {
+		end = le32_to_cpu(ex->ee_block) + len - 1;
+		if (end >= EXT4_NDIR_BLOCKS) {
 			ret = -EOPNOTSUPP;
 			goto errout;
 		}



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 039/267] ext4: correctly migrate a file with a hole at the beginning
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 038/267] ext4: be more strict when migrating to non-extent based file Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 040/267] ext4: replace open coded nofail allocation in ext4_free_blocks() Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eryu Guan, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eryu Guan <guaneryu@gmail.com>

commit 8974fec7d72e3e02752fe0f27b4c3719c78d9a15 upstream.

Currently ext4_ind_migrate() doesn't correctly handle a file which
contains a hole at the beginning of the file.  This caused the migration
to be done incorrectly, and then if there is a subsequent following
delayed allocation write to the "hole", this would reclaim the same data
blocks again and results in fs corruption.

  # assmuing 4k block size ext4, with delalloc enabled
  # skip the first block and write to the second block
  xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/ext4/testfile

  # converting to indirect-mapped file, which would move the data blocks
  # to the beginning of the file, but extent status cache still marks
  # that region as a hole
  chattr -e /mnt/ext4/testfile

  # delayed allocation writes to the "hole", reclaim the same data block
  # again, results in i_blocks corruption
  xfs_io -c "pwrite 0 4k" /mnt/ext4/testfile
  umount /mnt/ext4
  e2fsck -nf /dev/sda6
  ...
  Inode 53, i_blocks is 16, should be 8.  Fix? no
  ...

Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/migrate.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -620,7 +620,7 @@ int ext4_ind_migrate(struct inode *inode
 	struct ext4_inode_info		*ei = EXT4_I(inode);
 	struct ext4_extent		*ex;
 	unsigned int			i, len;
-	ext4_lblk_t			end;
+	ext4_lblk_t			start, end;
 	ext4_fsblk_t			blk;
 	handle_t			*handle;
 	int				ret;
@@ -659,11 +659,12 @@ int ext4_ind_migrate(struct inode *inode
 		goto errout;
 	}
 	if (eh->eh_entries == 0)
-		blk = len = 0;
+		blk = len = start = end = 0;
 	else {
 		len = le16_to_cpu(ex->ee_len);
 		blk = ext4_ext_pblock(ex);
-		end = le32_to_cpu(ex->ee_block) + len - 1;
+		start = le32_to_cpu(ex->ee_block);
+		end = start + len - 1;
 		if (end >= EXT4_NDIR_BLOCKS) {
 			ret = -EOPNOTSUPP;
 			goto errout;
@@ -672,7 +673,7 @@ int ext4_ind_migrate(struct inode *inode
 
 	ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
 	memset(ei->i_data, 0, sizeof(ei->i_data));
-	for (i=0; i < len; i++)
+	for (i = start; i <= end; i++)
 		ei->i_data[i] = cpu_to_le32(blk++);
 	ext4_mark_inode_dirty(handle, inode);
 errout:



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 040/267] ext4: replace open coded nofail allocation in ext4_free_blocks()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 039/267] ext4: correctly migrate a file with a hole at the beginning Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 041/267] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michal Hocko, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Hocko <mhocko@suse.cz>

commit 7444a072c387a93ebee7066e8aee776954ab0e41 upstream.

ext4_free_blocks is looping around the allocation request and mimics
__GFP_NOFAIL behavior without any allocation fallback strategy. Let's
remove the open coded loop and replace it with __GFP_NOFAIL. Without the
flag the allocator has no way to find out never-fail requirement and
cannot help in any way.

Signed-off-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/mballoc.c |   16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4800,18 +4800,12 @@ do_more:
 		/*
 		 * blocks being freed are metadata. these blocks shouldn't
 		 * be used until this transaction is committed
+		 *
+		 * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
+		 * to fail.
 		 */
-	retry:
-		new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
-		if (!new_entry) {
-			/*
-			 * We use a retry loop because
-			 * ext4_free_blocks() is not allowed to fail.
-			 */
-			cond_resched();
-			congestion_wait(BLK_RW_ASYNC, HZ/50);
-			goto retry;
-		}
+		new_entry = kmem_cache_alloc(ext4_free_data_cachep,
+				GFP_NOFS|__GFP_NOFAIL);
 		new_entry->efd_start_cluster = bit;
 		new_entry->efd_group = block_group;
 		new_entry->efd_count = count_clusters;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 041/267] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 040/267] ext4: replace open coded nofail allocation in ext4_free_blocks() Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 042/267] jbd2: fix ocfs2 corrupt when updating journal superblock fails Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Monakhov, Theodore Tso

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Monakhov <dmonakhov@openvz.org>

commit b4f1afcd068f6e533230dfed00782cd8a907f96b upstream.

jbd2_cleanup_journal_tail() can be invoked by jbd2__journal_start()
So allocations should be done with GFP_NOFS

[Full stack trace snipped from 3.10-rh7]
[<ffffffff815c4bd4>] dump_stack+0x19/0x1b
[<ffffffff8105dba1>] warn_slowpath_common+0x61/0x80
[<ffffffff8105dcca>] warn_slowpath_null+0x1a/0x20
[<ffffffff815c2142>] slab_pre_alloc_hook.isra.31.part.32+0x15/0x17
[<ffffffff8119c045>] kmem_cache_alloc+0x55/0x210
[<ffffffff811477f5>] ? mempool_alloc_slab+0x15/0x20
[<ffffffff811477f5>] mempool_alloc_slab+0x15/0x20
[<ffffffff81147939>] mempool_alloc+0x69/0x170
[<ffffffff815cb69e>] ? _raw_spin_unlock_irq+0xe/0x20
[<ffffffff8109160d>] ? finish_task_switch+0x5d/0x150
[<ffffffff811f1a8e>] bio_alloc_bioset+0x1be/0x2e0
[<ffffffff8127ee49>] blkdev_issue_flush+0x99/0x120
[<ffffffffa019a733>] jbd2_cleanup_journal_tail+0x93/0xa0 [jbd2] -->GFP_KERNEL
[<ffffffffa019aca1>] jbd2_log_do_checkpoint+0x221/0x4a0 [jbd2]
[<ffffffffa019afc7>] __jbd2_log_wait_for_space+0xa7/0x1e0 [jbd2]
[<ffffffffa01952d8>] start_this_handle+0x2d8/0x550 [jbd2]
[<ffffffff811b02a9>] ? __memcg_kmem_put_cache+0x29/0x30
[<ffffffff8119c120>] ? kmem_cache_alloc+0x130/0x210
[<ffffffffa019573a>] jbd2__journal_start+0xba/0x190 [jbd2]
[<ffffffff811532ce>] ? lru_cache_add+0xe/0x10
[<ffffffffa01c9549>] ? ext4_da_write_begin+0xf9/0x330 [ext4]
[<ffffffffa01f2c77>] __ext4_journal_start_sb+0x77/0x160 [ext4]
[<ffffffffa01c9549>] ext4_da_write_begin+0xf9/0x330 [ext4]
[<ffffffff811446ec>] generic_file_buffered_write_iter+0x10c/0x270
[<ffffffff81146918>] __generic_file_write_iter+0x178/0x390
[<ffffffff81146c6b>] __generic_file_aio_write+0x8b/0xb0
[<ffffffff81146ced>] generic_file_aio_write+0x5d/0xc0
[<ffffffffa01bf289>] ext4_file_write+0xa9/0x450 [ext4]
[<ffffffff811c31d9>] ? pipe_read+0x379/0x4f0
[<ffffffff811b93f0>] do_sync_write+0x90/0xe0
[<ffffffff811b9b6d>] vfs_write+0xbd/0x1e0
[<ffffffff811ba5b8>] SyS_write+0x58/0xb0
[<ffffffff815d4799>] system_call_fastpath+0x16/0x1b

Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jbd2/checkpoint.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -405,7 +405,7 @@ int jbd2_cleanup_journal_tail(journal_t
 	 * jbd2_cleanup_journal_tail() doesn't get called all that often.
 	 */
 	if (journal->j_flags & JBD2_BARRIER)
-		blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+		blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
 
 	__jbd2_update_log_tail(journal, first_tid, blocknr);
 	return 0;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 042/267] jbd2: fix ocfs2 corrupt when updating journal superblock fails
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 041/267] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 043/267] NFC: st21nfcb: Remove inappropriate kfree on a devm_kzalloc pointer Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yiwen Jiang, Joseph Qi, Theodore Tso,
	Junxiao Bi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joseph Qi <joseph.qi@huawei.com>

commit 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a upstream.

If updating journal superblock fails after journal data has been
flushed, the error is omitted and this will mislead the caller as a
normal case.  In ocfs2, the checkpoint will be treated successfully
and the other node can get the lock to update. Since the sb_start is
still pointing to the old log block, it will rewrite the journal data
during journal recovery by the other node. Thus the new updates will
be overwritten and ocfs2 corrupts.  So in above case we have to return
the error, and ocfs2_commit_cache will take care of the error and
prevent the other node to do update first.  And only after recovering
journal it can do the new updates.

The issue discussion mail can be found at:
https://oss.oracle.com/pipermail/ocfs2-devel/2015-June/010856.html
http://comments.gmane.org/gmane.comp.file-systems.ext4/48841

[ Fixed bug in patch which allowed a non-negative error return from
  jbd2_cleanup_journal_tail() to leak out of jbd2_fjournal_flush(); this
  was causing xfstests ext4/306 to fail. -- Ted ]

Reported-by: Yiwen Jiang <jiangyiwen@huawei.com>
Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Tested-by: Yiwen Jiang <jiangyiwen@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jbd2/checkpoint.c |    5 ++---
 fs/jbd2/journal.c    |   38 +++++++++++++++++++++++++++++++-------
 include/linux/jbd2.h |    4 ++--
 3 files changed, 35 insertions(+), 12 deletions(-)

--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -390,7 +390,7 @@ int jbd2_cleanup_journal_tail(journal_t
 	unsigned long	blocknr;
 
 	if (is_journal_aborted(journal))
-		return 1;
+		return -EIO;
 
 	if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
 		return 1;
@@ -407,8 +407,7 @@ int jbd2_cleanup_journal_tail(journal_t
 	if (journal->j_flags & JBD2_BARRIER)
 		blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
 
-	__jbd2_update_log_tail(journal, first_tid, blocknr);
-	return 0;
+	return __jbd2_update_log_tail(journal, first_tid, blocknr);
 }
 
 
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t
  *
  * Requires j_checkpoint_mutex
  */
-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
 {
 	unsigned long freed;
+	int ret;
 
 	BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
 
@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *j
 	 * space and if we lose sb update during power failure we'd replay
 	 * old transaction with possibly newly overwritten data.
 	 */
-	jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
+	ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
+	if (ret)
+		goto out;
+
 	write_lock(&journal->j_state_lock);
 	freed = block - journal->j_tail;
 	if (block < journal->j_tail)
@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *j
 	journal->j_tail_sequence = tid;
 	journal->j_tail = block;
 	write_unlock(&journal->j_state_lock);
+
+out:
+	return ret;
 }
 
 /*
@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *jour
 	return jbd2_journal_start_thread(journal);
 }
 
-static void jbd2_write_superblock(journal_t *journal, int write_op)
+static int jbd2_write_superblock(journal_t *journal, int write_op)
 {
 	struct buffer_head *bh = journal->j_sb_buffer;
 	journal_superblock_t *sb = journal->j_superblock;
@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journa
 		printk(KERN_ERR "JBD2: Error %d detected when updating "
 		       "journal superblock for %s.\n", ret,
 		       journal->j_devname);
+		jbd2_journal_abort(journal, ret);
 	}
+
+	return ret;
 }
 
 /**
@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journa
  * Update a journal's superblock information about log tail and write it to
  * disk, waiting for the IO to complete.
  */
-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
 				     unsigned long tail_block, int write_op)
 {
 	journal_superblock_t *sb = journal->j_superblock;
+	int ret;
 
 	BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
 	jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(jou
 	sb->s_sequence = cpu_to_be32(tail_tid);
 	sb->s_start    = cpu_to_be32(tail_block);
 
-	jbd2_write_superblock(journal, write_op);
+	ret = jbd2_write_superblock(journal, write_op);
+	if (ret)
+		goto out;
 
 	/* Log is no longer empty */
 	write_lock(&journal->j_state_lock);
 	WARN_ON(!sb->s_sequence);
 	journal->j_flags &= ~JBD2_FLUSHED;
 	write_unlock(&journal->j_state_lock);
+
+out:
+	return ret;
 }
 
 /**
@@ -1950,7 +1966,14 @@ int jbd2_journal_flush(journal_t *journa
 		return -EIO;
 
 	mutex_lock(&journal->j_checkpoint_mutex);
-	jbd2_cleanup_journal_tail(journal);
+	if (!err) {
+		err = jbd2_cleanup_journal_tail(journal);
+		if (err < 0) {
+			mutex_unlock(&journal->j_checkpoint_mutex);
+			goto out;
+		}
+		err = 0;
+	}
 
 	/* Finally, mark the journal as really needing no recovery.
 	 * This sets s_start==0 in the underlying superblock, which is
@@ -1966,7 +1989,8 @@ int jbd2_journal_flush(journal_t *journa
 	J_ASSERT(journal->j_head == journal->j_tail);
 	J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
 	write_unlock(&journal->j_state_lock);
-	return 0;
+out:
+	return err;
 }
 
 /**
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_des
 int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
 int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
 			      unsigned long *block);
-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
 void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
 
 /* Commit management */
@@ -1157,7 +1157,7 @@ extern int	   jbd2_journal_recover    (j
 extern int	   jbd2_journal_wipe       (journal_t *, int);
 extern int	   jbd2_journal_skip_recovery	(journal_t *);
 extern void	   jbd2_journal_update_sb_errno(journal_t *);
-extern void	   jbd2_journal_update_sb_log_tail	(journal_t *, tid_t,
+extern int	   jbd2_journal_update_sb_log_tail	(journal_t *, tid_t,
 				unsigned long, int);
 extern void	   __jbd2_journal_abort_hard	(journal_t *);
 extern void	   jbd2_journal_abort      (journal_t *, int);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 043/267] NFC: st21nfcb: Remove inappropriate kfree on a devm_kzalloc pointer
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 042/267] jbd2: fix ocfs2 corrupt when updating journal superblock fails Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 044/267] NFC: st21nfcb: Do not remove header once the payload is sent Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Ricard, Firo Yang, Samuel Ortiz

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Firo Yang <firogm@gmail.com>

commit 38bd83f04c5e9695011dc5c294e0c4e6a9f9052d upstream.

Since ndev->driver_data is allocated by devm_kzalloc(), we do not
need the inappropriate kfree to free it in driver's remove function.
Freeing will trigger when driver unloads.

Acked-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Firo Yang <firogm@gmail.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nfc/st21nfcb/st21nfcb.c |    3 ---
 1 file changed, 3 deletions(-)

--- a/drivers/nfc/st21nfcb/st21nfcb.c
+++ b/drivers/nfc/st21nfcb/st21nfcb.c
@@ -131,11 +131,8 @@ EXPORT_SYMBOL_GPL(st21nfcb_nci_probe);
 
 void st21nfcb_nci_remove(struct nci_dev *ndev)
 {
-	struct st21nfcb_nci_info *info = nci_get_drvdata(ndev);
-
 	nci_unregister_device(ndev);
 	nci_free_device(ndev);
-	kfree(info);
 }
 EXPORT_SYMBOL_GPL(st21nfcb_nci_remove);
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 044/267] NFC: st21nfcb: Do not remove header once the payload is sent
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 043/267] NFC: st21nfcb: Remove inappropriate kfree on a devm_kzalloc pointer Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 045/267] NFC: st21nfcb: remove st21nfcb_nci_i2c_disable Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christophe Ricard, Samuel Ortiz

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Ricard <christophe.ricard@gmail.com>

commit 09f39a950523b1bb830c30a8670b77e0067da092 upstream.

Once the data is sent, we need to preserve the full frame for
the ndlc state machine. If the NDLC ACK is not received in time,
the ndlc layer will resend the same frame.
Having the header byte pulled will corrupt the frame.

Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nfc/st21nfcb/i2c.c |    7 -------
 1 file changed, 7 deletions(-)

--- a/drivers/nfc/st21nfcb/i2c.c
+++ b/drivers/nfc/st21nfcb/i2c.c
@@ -87,11 +87,6 @@ static void st21nfcb_nci_i2c_disable(voi
 	gpio_set_value(phy->gpio_reset, 1);
 }
 
-static void st21nfcb_nci_remove_header(struct sk_buff *skb)
-{
-	skb_pull(skb, ST21NFCB_FRAME_HEADROOM);
-}
-
 /*
  * Writing a frame must not return the number of written bytes.
  * It must return either zero for success, or <0 for error.
@@ -121,8 +116,6 @@ static int st21nfcb_nci_i2c_write(void *
 			r = 0;
 	}
 
-	st21nfcb_nci_remove_header(skb);
-
 	return r;
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 045/267] NFC: st21nfcb: remove st21nfcb_nci_i2c_disable
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 044/267] NFC: st21nfcb: Do not remove header once the payload is sent Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 046/267] rtc: snvs: fix wakealarm by call enable_irq_wake earlier Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christophe Ricard, Samuel Ortiz

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Ricard <christophe.ricard@gmail.com>

commit 4ac82e894825126816d7b7f662743335ce2b015e upstream.

ndlc_remove already calls st21nfcb_nci_i2c_disable and
phy->powered is already set to 0.

Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nfc/st21nfcb/i2c.c |    3 ---
 1 file changed, 3 deletions(-)

--- a/drivers/nfc/st21nfcb/i2c.c
+++ b/drivers/nfc/st21nfcb/i2c.c
@@ -359,9 +359,6 @@ static int st21nfcb_nci_i2c_remove(struc
 
 	ndlc_remove(phy->ndlc);
 
-	if (phy->powered)
-		st21nfcb_nci_i2c_disable(phy);
-
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 046/267] rtc: snvs: fix wakealarm by call enable_irq_wake earlier
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 045/267] NFC: st21nfcb: remove st21nfcb_nci_i2c_disable Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 047/267] i2c: at91: fix a race condition when using the DMA controller Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Agner, Alexandre Belloni

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Agner <stefan@agner.ch>

commit 119434f44c78df8c4b6d67f835448542a4bd7e91 upstream.

When entering suspend while an wakeup alarm is set, enable_set_wake
should make sure that the RTC interrupt keep being enabled and the
.irq_set_wake for the RTC interrupt get called. However, since the
driver uses the suspend_noirq callback, the call to enable_irq_wake
has been made after disabling the interrupts. While .irq_set_wake
has been called properly, the interrupt remained disabled.

Use the suspend callback to call enable_irq_wake early enough to
ensure the RTC interrupt remains enabled.

Fixes: 7654e9d4fd8f ("drivers/rtc/rtc-snvs: fix suspend/resume")
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/rtc/rtc-snvs.c |   30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

--- a/drivers/rtc/rtc-snvs.c
+++ b/drivers/rtc/rtc-snvs.c
@@ -322,6 +322,13 @@ static int snvs_rtc_suspend(struct devic
 	if (device_may_wakeup(dev))
 		enable_irq_wake(data->irq);
 
+	return 0;
+}
+
+static int snvs_rtc_suspend_noirq(struct device *dev)
+{
+	struct snvs_rtc_data *data = dev_get_drvdata(dev);
+
 	if (data->clk)
 		clk_disable_unprepare(data->clk);
 
@@ -331,23 +338,28 @@ static int snvs_rtc_suspend(struct devic
 static int snvs_rtc_resume(struct device *dev)
 {
 	struct snvs_rtc_data *data = dev_get_drvdata(dev);
-	int ret;
 
 	if (device_may_wakeup(dev))
-		disable_irq_wake(data->irq);
+		return disable_irq_wake(data->irq);
 
-	if (data->clk) {
-		ret = clk_prepare_enable(data->clk);
-		if (ret)
-			return ret;
-	}
+	return 0;
+}
+
+static int snvs_rtc_resume_noirq(struct device *dev)
+{
+	struct snvs_rtc_data *data = dev_get_drvdata(dev);
+
+	if (data->clk)
+		return clk_prepare_enable(data->clk);
 
 	return 0;
 }
 
 static const struct dev_pm_ops snvs_rtc_pm_ops = {
-	.suspend_noirq = snvs_rtc_suspend,
-	.resume_noirq = snvs_rtc_resume,
+	.suspend = snvs_rtc_suspend,
+	.suspend_noirq = snvs_rtc_suspend_noirq,
+	.resume = snvs_rtc_resume,
+	.resume_noirq = snvs_rtc_resume_noirq,
 };
 
 #define SNVS_RTC_PM_OPS	(&snvs_rtc_pm_ops)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 047/267] i2c: at91: fix a race condition when using the DMA controller
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 046/267] rtc: snvs: fix wakealarm by call enable_irq_wake earlier Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 051/267] iio:light:cm3323: clear bitmask before set Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cyrille Pitchen, Ludovic Desroches,
	Wolfram Sang

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Cyrille Pitchen <cyrille.pitchen@atmel.com>

commit 93563a6a71bb69dd324fc7354c60fb05f84aae6b upstream.

For TX transactions, the TXCOMP bit in the Status Register is cleared
when the first data is written into the Transmit Holding Register.

In the lines from at91_do_twi_transfer():
at91_twi_write_data_dma(dev);
at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);

the TXCOMP interrupt may be enabled before the DMA controller has
actually started to write into the THR. In such a case, the TXCOMP bit
is still set into the Status Register so the interrupt is triggered
immediately. The driver understands that a transaction completion has
occurred but this transaction hasn't started yet. Hence the TXCOMP
interrupt is no longer enabled by at91_do_twi_transfer() but instead
by at91_twi_write_data_dma_callback().

Also, the TXCOMP bit in the Status Register in not a clear on read flag
but a snapshot of the transmission state at the time the Status
Register is read.
When a NACK error is dectected by the I2C controller, the TXCOMP, NACK
and TXRDY bits are set together to 1 in the SR. If enabled, the TXCOMP
interrupt is triggered at the same time. Also setting the TXRDY to 1
triggers the DMA controller to write the next data into the THR. Such
a write resets the TXCOMP bit to 0 in the SR. So depending on when the
interrupt handler reads the SR, it may fail to detect the NACK error
if it relies on the TXCOMP bit. The NACK bit and its interrupt should
be used instead.

For RX transactions, the TXCOMP bit in the Status Register is cleared
when the START bit is set into the Control Register. However to unify
the management of the TXCOMP bit when the DMA controller is used, the
TXCOMP interrupt is now enabled by the DMA callbacks for both TX and
RX transfers.

Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/i2c/busses/i2c-at91.c |   70 +++++++++++++++++++++++++++++++-----------
 1 file changed, 53 insertions(+), 17 deletions(-)

--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -65,6 +65,9 @@
 #define	AT91_TWI_UNRE		0x0080	/* Underrun Error */
 #define	AT91_TWI_NACK		0x0100	/* Not Acknowledged */
 
+#define	AT91_TWI_INT_MASK \
+	(AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
+
 #define	AT91_TWI_IER		0x0024	/* Interrupt Enable Register */
 #define	AT91_TWI_IDR		0x0028	/* Interrupt Disable Register */
 #define	AT91_TWI_IMR		0x002c	/* Interrupt Mask Register */
@@ -119,13 +122,12 @@ static void at91_twi_write(struct at91_t
 
 static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
 {
-	at91_twi_write(dev, AT91_TWI_IDR,
-		       AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
+	at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
 }
 
 static void at91_twi_irq_save(struct at91_twi_dev *dev)
 {
-	dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
+	dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
 	at91_disable_twi_interrupts(dev);
 }
 
@@ -215,6 +217,14 @@ static void at91_twi_write_data_dma_call
 	dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
 			 dev->buf_len, DMA_TO_DEVICE);
 
+	/*
+	 * When this callback is called, THR/TX FIFO is likely not to be empty
+	 * yet. So we have to wait for TXCOMP or NACK bits to be set into the
+	 * Status Register to be sure that the STOP bit has been sent and the
+	 * transfer is completed. The NACK interrupt has already been enabled,
+	 * we just have to enable TXCOMP one.
+	 */
+	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
 	at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 }
 
@@ -309,7 +319,7 @@ static void at91_twi_read_data_dma_callb
 	/* The last two bytes have to be read without using dma */
 	dev->buf += dev->buf_len - 2;
 	dev->buf_len = 2;
-	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
+	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
 }
 
 static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
@@ -370,7 +380,7 @@ static irqreturn_t atmel_twi_interrupt(i
 	/* catch error flags */
 	dev->transfer_status |= status;
 
-	if (irqstatus & AT91_TWI_TXCOMP) {
+	if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
 		at91_disable_twi_interrupts(dev);
 		complete(&dev->cmd_complete);
 	}
@@ -384,6 +394,34 @@ static int at91_do_twi_transfer(struct a
 	unsigned long time_left;
 	bool has_unre_flag = dev->pdata->has_unre_flag;
 
+	/*
+	 * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
+	 * read flag but shows the state of the transmission at the time the
+	 * Status Register is read. According to the programmer datasheet,
+	 * TXCOMP is set when both holding register and internal shifter are
+	 * empty and STOP condition has been sent.
+	 * Consequently, we should enable NACK interrupt rather than TXCOMP to
+	 * detect transmission failure.
+	 *
+	 * Besides, the TXCOMP bit is already set before the i2c transaction
+	 * has been started. For read transactions, this bit is cleared when
+	 * writing the START bit into the Control Register. So the
+	 * corresponding interrupt can safely be enabled just after.
+	 * However for write transactions managed by the CPU, we first write
+	 * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
+	 * interrupt. If TXCOMP interrupt were enabled before writing into THR,
+	 * the interrupt handler would be called immediately and the i2c command
+	 * would be reported as completed.
+	 * Also when a write transaction is managed by the DMA controller,
+	 * enabling the TXCOMP interrupt in this function may lead to a race
+	 * condition since we don't know whether the TXCOMP interrupt is enabled
+	 * before or after the DMA has started to write into THR. So the TXCOMP
+	 * interrupt is enabled later by at91_twi_write_data_dma_callback().
+	 * Immediately after in that DMA callback, we still need to send the
+	 * STOP condition manually writing the corresponding bit into the
+	 * Control Register.
+	 */
+
 	dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
 		(dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
 
@@ -414,26 +452,24 @@ static int at91_do_twi_transfer(struct a
 		 * seems to be the best solution.
 		 */
 		if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
+			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
 			at91_twi_read_data_dma(dev);
-			/*
-			 * It is important to enable TXCOMP irq here because
-			 * doing it only when transferring the last two bytes
-			 * will mask NACK errors since TXCOMP is set when a
-			 * NACK occurs.
-			 */
-			at91_twi_write(dev, AT91_TWI_IER,
-			       AT91_TWI_TXCOMP);
-		} else
+		} else {
 			at91_twi_write(dev, AT91_TWI_IER,
-			       AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
+				       AT91_TWI_TXCOMP |
+				       AT91_TWI_NACK |
+				       AT91_TWI_RXRDY);
+		}
 	} else {
 		if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
+			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
 			at91_twi_write_data_dma(dev);
-			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
 		} else {
 			at91_twi_write_next_byte(dev);
 			at91_twi_write(dev, AT91_TWI_IER,
-				AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
+				       AT91_TWI_TXCOMP |
+				       AT91_TWI_NACK |
+				       AT91_TWI_TXRDY);
 		}
 	}
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 051/267] iio:light:cm3323: clear bitmask before set
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 047/267] i2c: at91: fix a race condition when using the DMA controller Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 052/267] iio:adc:cc10001_adc: fix Kconfig dependency Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hartmut Knaack, Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hartmut Knaack <knaack.h@gmx.de>

commit c288503b32e8c5534062a05ec565d28bffa06db3 upstream.

When setting the bits for integration time, the appropriate bitmask needs
to be cleared first.

Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/light/cm3323.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/light/cm3323.c
+++ b/drivers/iio/light/cm3323.c
@@ -123,7 +123,7 @@ static int cm3323_set_it_bits(struct cm3
 	for (i = 0; i < ARRAY_SIZE(cm3323_int_time); i++) {
 		if (val == cm3323_int_time[i].val &&
 		    val2 == cm3323_int_time[i].val2) {
-			reg_conf = data->reg_conf;
+			reg_conf = data->reg_conf & ~CM3323_CONF_IT_MASK;
 			reg_conf |= i << CM3323_CONF_IT_SHIFT;
 
 			ret = i2c_smbus_write_word_data(data->client,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 052/267] iio:adc:cc10001_adc: fix Kconfig dependency
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 051/267] iio:light:cm3323: clear bitmask before set Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 053/267] iio:accel:bmc150-accel: fix counting direction Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hartmut Knaack, Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hartmut Knaack <knaack.h@gmx.de>

commit b2b3c3dc6a7bef886850920f5f5dca041b443aa0 upstream.

The Cosmic Circuits 10001 ADC driver depends on HAS_IOMEM, HAVE_CLK and
REGULATOR together, not just any of these.

Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/Kconfig |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -146,8 +146,7 @@ config DA9150_GPADC
 
 config CC10001_ADC
 	tristate "Cosmic Circuits 10001 ADC driver"
-	depends on HAVE_CLK || REGULATOR
-	depends on HAS_IOMEM
+	depends on HAS_IOMEM && HAVE_CLK && REGULATOR
 	select IIO_BUFFER
 	select IIO_TRIGGERED_BUFFER
 	help



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 053/267] iio:accel:bmc150-accel: fix counting direction
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 052/267] iio:adc:cc10001_adc: fix Kconfig dependency Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 054/267] iio: light: tcs3414: Fix bug preventing to set integration time Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hartmut Knaack, Octavian Purdila,
	Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hartmut Knaack <knaack.h@gmx.de>

commit 7a1d0d91c94305fa5802a53df3a54c0ea1963c48 upstream.

In bmc150_accel_unregister_triggers() triggers should be unregistered in
reverse order of registration. Trigger registration starts with number 0,
counting up. In consequence, trigger number needs to be count down here.

Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
Reviewed-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/accel/bmc150-accel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/accel/bmc150-accel.c
+++ b/drivers/iio/accel/bmc150-accel.c
@@ -1465,7 +1465,7 @@ static void bmc150_accel_unregister_trig
 {
 	int i;
 
-	for (i = from; i >= 0; i++) {
+	for (i = from; i >= 0; i--) {
 		if (data->triggers[i].indio_trig) {
 			iio_trigger_unregister(data->triggers[i].indio_trig);
 			data->triggers[i].indio_trig = NULL;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 054/267] iio: light: tcs3414: Fix bug preventing to set integration time
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 053/267] iio:accel:bmc150-accel: fix counting direction Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 055/267] iio: DAC: ad5624r_spi: fix bit shift of output data value Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Meerwald, Stephan Kleisinger,
	Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Meerwald <pmeerw@pmeerw.net>

commit 33361e5678a541f82f29f85467d589e7bf8da76b upstream.

the millisecond values in tcs3414_times should be checked against
val2, not val, which is always zero.

Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
Reported-by: Stephan Kleisinger <stephan.kleisinger@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/light/tcs3414.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/light/tcs3414.c
+++ b/drivers/iio/light/tcs3414.c
@@ -185,7 +185,7 @@ static int tcs3414_write_raw(struct iio_
 		if (val != 0)
 			return -EINVAL;
 		for (i = 0; i < ARRAY_SIZE(tcs3414_times); i++) {
-			if (val == tcs3414_times[i] * 1000) {
+			if (val2 == tcs3414_times[i] * 1000) {
 				data->timing &= ~TCS3414_INTEG_MASK;
 				data->timing |= i;
 				return i2c_smbus_write_byte_data(



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 055/267] iio: DAC: ad5624r_spi: fix bit shift of output data value
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 054/267] iio: light: tcs3414: Fix bug preventing to set integration time Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 056/267] iio: inv-mpu: Specify the expected format/precision for write channels Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, JM Friedt, Lars-Peter Clausen,
	Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: JM Friedt <jmfriedt@femto-st.fr>

commit adfa969850ae93beca57f7527f0e4dc10cbe1309 upstream.

The value sent on the SPI bus is shifted by an erroneous number of bits.
The shift value was already computed in the iio_chan_spec structure and
hence subtracting this argument to 16 yields an erroneous data position
in the SPI stream.

Signed-off-by: JM Friedt <jmfriedt@femto-st.fr>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/dac/ad5624r_spi.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/iio/dac/ad5624r_spi.c
+++ b/drivers/iio/dac/ad5624r_spi.c
@@ -22,7 +22,7 @@
 #include "ad5624r.h"
 
 static int ad5624r_spi_write(struct spi_device *spi,
-			     u8 cmd, u8 addr, u16 val, u8 len)
+			     u8 cmd, u8 addr, u16 val, u8 shift)
 {
 	u32 data;
 	u8 msg[3];
@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_
 	 * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
 	 * for the AD5664R, AD5644R, and AD5624R, respectively.
 	 */
-	data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
+	data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
 	msg[0] = data >> 16;
 	msg[1] = data >> 8;
 	msg[2] = data;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 056/267] iio: inv-mpu: Specify the expected format/precision for write channels
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 055/267] iio: DAC: ad5624r_spi: fix bit shift of output data value Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 057/267] iio: tmp006: Check channel info on write Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Adriana Reus, Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Adriana Reus <adriana.reus@intel.com>

commit 6a3c45bb5a385be7049a7725a4fe93eaa76915f4 upstream.

The gyroscope needs IIO_VAL_INT_PLUS_NANO for the scale channel and
unless specified write returns MICRO by default.
This needs to be properly specified so that write operations into scale
have the expected behaviour.

Signed-off-by: Adriana Reus <adriana.reus@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -431,6 +431,23 @@ static int inv_mpu6050_write_gyro_scale(
 	return -EINVAL;
 }
 
+static int inv_write_raw_get_fmt(struct iio_dev *indio_dev,
+				 struct iio_chan_spec const *chan, long mask)
+{
+	switch (mask) {
+	case IIO_CHAN_INFO_SCALE:
+		switch (chan->type) {
+		case IIO_ANGL_VEL:
+			return IIO_VAL_INT_PLUS_NANO;
+		default:
+			return IIO_VAL_INT_PLUS_MICRO;
+		}
+	default:
+		return IIO_VAL_INT_PLUS_MICRO;
+	}
+
+	return -EINVAL;
+}
 static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val)
 {
 	int result, i;
@@ -696,6 +713,7 @@ static const struct iio_info mpu_info =
 	.driver_module = THIS_MODULE,
 	.read_raw = &inv_mpu6050_read_raw,
 	.write_raw = &inv_mpu6050_write_raw,
+	.write_raw_get_fmt = &inv_write_raw_get_fmt,
 	.attrs = &inv_attribute_group,
 	.validate_trigger = inv_mpu6050_validate_trigger,
 };



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 057/267] iio: tmp006: Check channel info on write
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 056/267] iio: inv-mpu: Specify the expected format/precision for write channels Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 058/267] iio: twl4030-madc: Pass the IRQF_ONESHOT flag Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Meerwald, Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Meerwald <pmeerw@pmeerw.net>

commit 8d05abfaeff52bdf66aba3a3a337dcdbdb4911bf upstream.

only SAMP_FREQ is writable

Will lead to SAMP_FREQ being written by any attempt to write
to the other exported attributes and hence a rather unexpected
result!

Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/temperature/tmp006.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/iio/temperature/tmp006.c
+++ b/drivers/iio/temperature/tmp006.c
@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_d
 	struct tmp006_data *data = iio_priv(indio_dev);
 	int i;
 
+	if (mask != IIO_CHAN_INFO_SAMP_FREQ)
+		return -EINVAL;
+
 	for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
 		if ((val == tmp006_freqs[i][0]) &&
 		    (val2 == tmp006_freqs[i][1])) {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 058/267] iio: twl4030-madc: Pass the IRQF_ONESHOT flag
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 057/267] iio: tmp006: Check channel info on write Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 059/267] iio: ABI: Clarify proximity output value Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fabio Estevam <fabio.estevam@freescale.com>

commit 6c0d48cb29c29b306ba3548afb45154d22eb4d78 upstream.

Since commit 1c6c69525b40 ("genirq: Reject bogus threaded irq requests")
threaded IRQs without a primary handler need to be requested with
IRQF_ONESHOT, otherwise the request will fail.

So pass the IRQF_ONESHOT flag in this case.

The semantic patch that makes this change is available
in scripts/coccinelle/misc/irqf_oneshot.cocci.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/twl4030-madc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/iio/adc/twl4030-madc.c
+++ b/drivers/iio/adc/twl4030-madc.c
@@ -835,7 +835,8 @@ static int twl4030_madc_probe(struct pla
 	irq = platform_get_irq(pdev, 0);
 	ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
 				   twl4030_madc_threaded_irq_handler,
-				   IRQF_TRIGGER_RISING, "twl4030_madc", madc);
+				   IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+				   "twl4030_madc", madc);
 	if (ret) {
 		dev_err(&pdev->dev, "could not request irq\n");
 		goto err_i2c;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 059/267] iio: ABI: Clarify proximity output value
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 058/267] iio: twl4030-madc: Pass the IRQF_ONESHOT flag Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 060/267] iio: proximity: sx9500: Fix proximity value Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Baluta, Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Baluta <daniel.baluta@intel.com>

commit bdc10d57f236b534fb675a4bbefd10017aeb2b26 upstream.

Current description for proximity measurement is ambiguous. While
the first part says that proximity is measured by observing
reflectivity, the second part incorrectly infers that reported values
should behave like a distance.

This is because of AS3935 lightning sensor which uses the proximity
API, while not being a true proximity sensor.

Note this is marked for stable as it accompanies a fix in ABI usage
to the sx9500 driver which would otherwise appear to be correct.

Fixes:  614e8842ddf ("iio: ABI: add clarification for proximity")
Signed-off-by: Daniel Baluta <daniel.baluta@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/ABI/testing/sysfs-bus-iio |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

--- a/Documentation/ABI/testing/sysfs-bus-iio
+++ b/Documentation/ABI/testing/sysfs-bus-iio
@@ -1165,10 +1165,8 @@ Description:
 		object is near the sensor, usually be observing
 		reflectivity of infrared or ultrasound emitted.
 		Often these sensors are unit less and as such conversion
-		to SI units is not possible.  Where it is, the units should
-		be meters.  If such a conversion is not possible, the reported
-		values should behave in the same way as a distance, i.e. lower
-		values indicate something is closer to the sensor.
+		to SI units is not possible. Higher proximity measurements
+		indicate closer objects, and vice versa.
 
 What:		/sys/.../iio:deviceX/in_illuminance_input
 What:		/sys/.../iio:deviceX/in_illuminance_raw



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 060/267] iio: proximity: sx9500: Fix proximity value
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 059/267] iio: ABI: Clarify proximity output value Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 061/267] iio: adc: rockchip_saradc: add missing MODULE_* data Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Baluta, Vlad Dogaru, Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Baluta <daniel.baluta@intel.com>

commit fd1883f07cb434707e50c4c9a16e3ed4b3a5e74f upstream.

Because of the ABI confusion proximity value exposed by SX9500
was inverted.

Signed-off-by: Daniel Baluta <daniel.baluta@intel.com>
Reviewed-by: Vlad Dogaru <vlad.dogaru@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/proximity/sx9500.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/proximity/sx9500.c
+++ b/drivers/iio/proximity/sx9500.c
@@ -206,7 +206,7 @@ static int sx9500_read_proximity(struct
 	if (ret < 0)
 		return ret;
 
-	*val = 32767 - (s16)be16_to_cpu(regval);
+	*val = be16_to_cpu(regval);
 
 	return IIO_VAL_INT;
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 061/267] iio: adc: rockchip_saradc: add missing MODULE_* data
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 060/267] iio: proximity: sx9500: Fix proximity value Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 062/267] iio: adc: at91_adc: allow to use full range of startup time Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Heiko Stuebner, Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Heiko Stuebner <heiko@sntech.de>

commit dc7b8d98ac003c9f1e83a5f927c372dac6f114a1 upstream.

The module-data is currently missing. This includes the license-information
which makes the driver taint the kernel and miss symbols when compiled as
module.

Fixes: 44d6f2ef94f9 ("iio: adc: add driver for Rockchip saradc")
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/rockchip_saradc.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -349,3 +349,7 @@ static struct platform_driver rockchip_s
 };
 
 module_platform_driver(rockchip_saradc_driver);
+
+MODULE_AUTHOR("Heiko Stuebner <heiko@sntech.de>");
+MODULE_DESCRIPTION("Rockchip SARADC driver");
+MODULE_LICENSE("GPL v2");



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 062/267] iio: adc: at91_adc: allow to use full range of startup time
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 061/267] iio: adc: rockchip_saradc: add missing MODULE_* data Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 063/267] [media] vb2: Dont WARN when v4l2_buffer.bytesused is 0 for multiplanar buffers Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jan Leupold, Nicolas Ferre,
	Alexandre Belloni, Jonathan Cameron

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Leupold <leupold@rsi-elektrotechnik.de>

commit 2ab5f39bc7825808e0fa1e7e5f0b23e174563467 upstream.

The DT-Property "atmel,adc-startup-time" is stored in an u8 for a microsecond
value. When trying to increase the value of STARTUP in Register AT91_ADC_MR
some higher values can't be reached.

Change the type in function parameter and private structure field from u8 to
u32.

Signed-off-by: Jan Leupold <leupold@rsi-elektrotechnik.de>
[nicolas.ferre@atmel.com: change commit message, increase u16 to u32 for startup time]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/at91_adc.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -182,7 +182,7 @@ struct at91_adc_caps {
 	u8	ts_pen_detect_sensitivity;
 
 	/* startup time calculate function */
-	u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
+	u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
 
 	u8	num_channels;
 	struct at91_adc_reg_desc registers;
@@ -201,7 +201,7 @@ struct at91_adc_state {
 	u8			num_channels;
 	void __iomem		*reg_base;
 	struct at91_adc_reg_desc *registers;
-	u8			startup_time;
+	u32			startup_time;
 	u8			sample_hold_time;
 	bool			sleep_mode;
 	struct iio_trigger	**trig;
@@ -779,7 +779,7 @@ ret:
 	return ret;
 }
 
-static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
 {
 	/*
 	 * Number of ticks needed to cover the startup time of the ADC
@@ -790,7 +790,7 @@ static u32 calc_startup_ticks_9260(u8 st
 	return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
 }
 
-static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
 {
 	/*
 	 * For sama5d3x and at91sam9x5, the formula changes to:



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 063/267] [media] vb2: Dont WARN when v4l2_buffer.bytesused is 0 for multiplanar buffers
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 062/267] iio: adc: at91_adc: allow to use full range of startup time Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 064/267] [media] media: Fix regression in some more dib0700 based devices Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Mauro Carvalho Chehab

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

commit 77a3c6fd90c94f635edb00d4a65f485687538791 upstream.

Commit f61bf13b6a07 ("[media] vb2: add allow_zero_bytesused flag to the
vb2_queue struct") added a WARN_ONCE to catch usage of a deprecated API
using a zero value for v4l2_buffer.bytesused.

However, the condition is checked incorrectly, as the v4L2_buffer
bytesused field is supposed to be ignored for multiplanar buffers. This
results in spurious warnings when using the multiplanar API.

Fix it by checking v4l2_buffer.bytesused for uniplanar buffers and
v4l2_plane.bytesused for multiplanar buffers.

Fixes: f61bf13b6a07 ("[media] vb2: add allow_zero_bytesused flag to the vb2_queue struct")

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/v4l2-core/videobuf2-core.c |   33 +++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)

--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -1237,6 +1237,23 @@ void vb2_discard_done(struct vb2_queue *
 }
 EXPORT_SYMBOL_GPL(vb2_discard_done);
 
+static void vb2_warn_zero_bytesused(struct vb2_buffer *vb)
+{
+	static bool __check_once __read_mostly;
+
+	if (__check_once)
+		return;
+
+	__check_once = true;
+	__WARN();
+
+	pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n");
+	if (vb->vb2_queue->allow_zero_bytesused)
+		pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n");
+	else
+		pr_warn_once("use the actual size instead.\n");
+}
+
 /**
  * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a
  * v4l2_buffer by the userspace. The caller has already verified that struct
@@ -1247,16 +1264,6 @@ static void __fill_vb2_buffer(struct vb2
 {
 	unsigned int plane;
 
-	if (V4L2_TYPE_IS_OUTPUT(b->type)) {
-		if (WARN_ON_ONCE(b->bytesused == 0)) {
-			pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n");
-			if (vb->vb2_queue->allow_zero_bytesused)
-				pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n");
-			else
-				pr_warn_once("use the actual size instead.\n");
-		}
-	}
-
 	if (V4L2_TYPE_IS_MULTIPLANAR(b->type)) {
 		if (b->memory == V4L2_MEMORY_USERPTR) {
 			for (plane = 0; plane < vb->num_planes; ++plane) {
@@ -1297,6 +1304,9 @@ static void __fill_vb2_buffer(struct vb2
 				struct v4l2_plane *pdst = &v4l2_planes[plane];
 				struct v4l2_plane *psrc = &b->m.planes[plane];
 
+				if (psrc->bytesused == 0)
+					vb2_warn_zero_bytesused(vb);
+
 				if (vb->vb2_queue->allow_zero_bytesused)
 					pdst->bytesused = psrc->bytesused;
 				else
@@ -1331,6 +1341,9 @@ static void __fill_vb2_buffer(struct vb2
 		}
 
 		if (V4L2_TYPE_IS_OUTPUT(b->type)) {
+			if (b->bytesused == 0)
+				vb2_warn_zero_bytesused(vb);
+
 			if (vb->vb2_queue->allow_zero_bytesused)
 				v4l2_planes[0].bytesused = b->bytesused;
 			else



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 064/267] [media] media: Fix regression in some more dib0700 based devices
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 063/267] [media] vb2: Dont WARN when v4l2_buffer.bytesused is 0 for multiplanar buffers Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 066/267] [media] cx18: add missing caps for the PCM video device Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Reitmayr, Mauro Carvalho Chehab

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Reitmayr <treitmayr@devbase.at>

commit e989a73ebd09d22c22ead51fa363a2f56f70f28a upstream.

Fix an oops during device initialization by correctly setting size_of_priv
instead of leaving it 0.
The regression was introduced by 8abe4a0a3f6d4217b16a ("[media] dib7000:
export just one symbol") and only fixed for one type of dib0700 based
devices in 9e334c75642b6e5bfb95 ("[media] Fix regression in some dib0700
based devices").

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=92301

Fixes: 8abe4a0a3f6d4217b16a ("[media] dib7000: export just one symbol")

Signed-off-by: Thomas Reitmayr <treitmayr@devbase.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/dvb-usb/dib0700_devices.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
@@ -3944,6 +3944,8 @@ struct dvb_usb_device_properties dib0700
 
 				DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
 			}},
+				.size_of_priv = sizeof(struct
+						dib0700_adapter_state),
 			}, {
 			.num_frontends = 1,
 			.fe = {{
@@ -3956,6 +3958,8 @@ struct dvb_usb_device_properties dib0700
 
 				DIB0700_DEFAULT_STREAMING_CONFIG(0x03),
 			}},
+				.size_of_priv = sizeof(struct
+						dib0700_adapter_state),
 			}
 		},
 
@@ -4009,6 +4013,8 @@ struct dvb_usb_device_properties dib0700
 
 				DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
 			}},
+				.size_of_priv = sizeof(struct
+						dib0700_adapter_state),
 			},
 		},
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 066/267] [media] cx18: add missing caps for the PCM video device
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 064/267] [media] media: Fix regression in some more dib0700 based devices Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 067/267] [media] cx24117: fix a buffer overflow when checking userspace params Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Laura Abbott,
	Mauro Carvalho Chehab

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans Verkuil <hverkuil@xs4all.nl>

commit 2b4fd3ede3bab65ef5b97387b90899d11e4d3202 upstream.

The cx18 PCM video device didn't have any capabilities set, which caused a warnings
in the v4l2 core:

[    6.229393] ------------[ cut here ]------------
[    6.229414] WARNING: CPU: 1 PID: 593 at
drivers/media/v4l2-core/v4l2-ioctl.c:1025 v4l_querycap+0x41/0x70
[videodev]()
[    6.229415] Modules linked in: cx18_alsa mxl5005s s5h1409
tuner_simple tuner_types cs5345 tuner intel_rapl iosf_mbi
x86_pkg_temp_thermal coretemp raid1 snd_hda_codec_realtek kvm_intel
snd_hda_codec_generic snd_hda_codec_hdmi kvm snd_oxygen(+) snd_hda_intel
snd_oxygen_lib snd_hda_controller snd_hda_codec snd_mpu401_uart iTCO_wdt
snd_rawmidi iTCO_vendor_support snd_hwdep crct10dif_pclmul crc32_pclmul
crc32c_intel snd_seq cx18 snd_seq_device ghash_clmulni_intel
videobuf_vmalloc tveeprom cx2341x snd_pcm serio_raw videobuf_core vfat
dvb_core fat v4l2_common snd_timer videodev snd lpc_ich i2c_i801 joydev
mfd_core mei_me media soundcore tpm_infineon soc_button_array tpm_tis
mei shpchp tpm nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc
i915 nouveau mxm_wmi wmi e1000e ttm i2c_algo_bit drm_kms_helper
[    6.229444]  drm ptp pps_core video
[    6.229446] CPU: 1 PID: 593 Comm: v4l_id Not tainted
3.19.3-200.fc21.x86_64 #1
[    6.229447] Hardware name: Gigabyte Technology Co., Ltd.
Z87-D3HP/Z87-D3HP-CF, BIOS F6 01/20/2014
[    6.229448]  0000000000000000 00000000d12b1131 ffff88042dacfc28
ffffffff8176e215
[    6.229449]  0000000000000000 0000000000000000 ffff88042dacfc68
ffffffff8109bc1a
[    6.229451]  ffffffffa0594000 ffff88042dacfd90 0000000000000000
ffffffffa04e2140
[    6.229452] Call Trace:
[    6.229466]  [<ffffffff8176e215>] dump_stack+0x45/0x57
[    6.229469]  [<ffffffff8109bc1a>] warn_slowpath_common+0x8a/0xc0
[    6.229472]  [<ffffffff8109bd4a>] warn_slowpath_null+0x1a/0x20
[    6.229474]  [<ffffffffa04ca401>] v4l_querycap+0x41/0x70 [videodev]
[    6.229477]  [<ffffffffa04ca6cc>] __video_do_ioctl+0x29c/0x320 [videodev]
[    6.229479]  [<ffffffff81227131>] ? do_last+0x2f1/0x1210
[    6.229491]  [<ffffffffa04cc776>] video_usercopy+0x366/0x5d0 [videodev]
[    6.229494]  [<ffffffffa04ca430>] ? v4l_querycap+0x70/0x70 [videodev]
[    6.229497]  [<ffffffffa04cc9f5>] video_ioctl2+0x15/0x20 [videodev]
[    6.229499]  [<ffffffffa04c6794>] v4l2_ioctl+0x164/0x180 [videodev]
[    6.229501]  [<ffffffff8122e298>] do_vfs_ioctl+0x2f8/0x500
[    6.229502]  [<ffffffff8122e521>] SyS_ioctl+0x81/0xa0
[    6.229505]  [<ffffffff81774a09>] system_call_fastpath+0x12/0x17
[    6.229506] ---[ end trace dacd80d4b19277ea ]---

Added the necessary capabilities to stop this warning.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/cx18/cx18-streams.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/media/pci/cx18/cx18-streams.c
+++ b/drivers/media/pci/cx18/cx18-streams.c
@@ -90,6 +90,7 @@ static struct {
 		"encoder PCM audio",
 		VFL_TYPE_GRABBER, CX18_V4L2_ENC_PCM_OFFSET,
 		PCI_DMA_FROMDEVICE,
+		V4L2_CAP_TUNER | V4L2_CAP_AUDIO | V4L2_CAP_READWRITE,
 	},
 	{	/* CX18_ENC_STREAM_TYPE_IDX */
 		"encoder IDX",



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 067/267] [media] cx24117: fix a buffer overflow when checking userspace params
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 066/267] [media] cx18: add missing caps for the PCM video device Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 068/267] [media] af9013: Dont accept invalid bandwidth Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 82e3b88b679049f043fe9b03991d6d66fc0a43c8 upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/dvb-frontends/cx24117.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/dvb-frontends/cx24117.c
+++ b/drivers/media/dvb-frontends/cx24117.c
@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struc
 	dev_dbg(&state->priv->i2c->dev, ")\n");
 
 	/* Validate length */
-	if (d->msg_len > 15)
+	if (d->msg_len > sizeof(d->msg))
 		return -EINVAL;
 
 	/* DiSEqC message */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 068/267] [media] af9013: Dont accept invalid bandwidth
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 067/267] [media] cx24117: fix a buffer overflow when checking userspace params Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 069/267] [media] saa7164: fix querycap warning Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit d7b76c91f471413de9ded837bddeca2164786571 upstream.

If userspace sends an invalid bandwidth, it should either return
EINVAL or switch to auto mode.

This driver will go past an array and program the hardware on a
wrong way if this happens.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/dvb-frontends/af9013.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/media/dvb-frontends/af9013.c
+++ b/drivers/media/dvb-frontends/af9013.c
@@ -605,6 +605,10 @@ static int af9013_set_frontend(struct dv
 			}
 		}
 
+		/* Return an error if can't find bandwidth or the right clock */
+		if (i == ARRAY_SIZE(coeff_lut))
+			return -EINVAL;
+
 		ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
 			sizeof(coeff_lut[i].val));
 	}



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 069/267] [media] saa7164: fix querycap warning
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 068/267] [media] af9013: Dont accept invalid bandwidth Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 070/267] [media] s5h1420: fix a buffer overflow when checking userspace params Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans Verkuil <hverkuil@xs4all.nl>

commit 534bc3e2ee93835badca753bedce8073c67caa92 upstream.

Fix the VIDIOC_QUERYCAP warning due to the missing device_caps. Don't fill
in the version field, the V4L2 core will do that for you.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/saa7164/saa7164-encoder.c |   11 ++++++-----
 drivers/media/pci/saa7164/saa7164-vbi.c     |   11 ++++++-----
 2 files changed, 12 insertions(+), 10 deletions(-)

--- a/drivers/media/pci/saa7164/saa7164-encoder.c
+++ b/drivers/media/pci/saa7164/saa7164-encoder.c
@@ -721,13 +721,14 @@ static int vidioc_querycap(struct file *
 		sizeof(cap->card));
 	sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
 
-	cap->capabilities =
+	cap->device_caps =
 		V4L2_CAP_VIDEO_CAPTURE |
-		V4L2_CAP_READWRITE     |
-		0;
+		V4L2_CAP_READWRITE |
+		V4L2_CAP_TUNER;
 
-	cap->capabilities |= V4L2_CAP_TUNER;
-	cap->version = 0;
+	cap->capabilities = cap->device_caps |
+		V4L2_CAP_VBI_CAPTURE |
+		V4L2_CAP_DEVICE_CAPS;
 
 	return 0;
 }
--- a/drivers/media/pci/saa7164/saa7164-vbi.c
+++ b/drivers/media/pci/saa7164/saa7164-vbi.c
@@ -660,13 +660,14 @@ static int vidioc_querycap(struct file *
 		sizeof(cap->card));
 	sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
 
-	cap->capabilities =
+	cap->device_caps =
 		V4L2_CAP_VBI_CAPTURE |
-		V4L2_CAP_READWRITE     |
-		0;
+		V4L2_CAP_READWRITE |
+		V4L2_CAP_TUNER;
 
-	cap->capabilities |= V4L2_CAP_TUNER;
-	cap->version = 0;
+	cap->capabilities = cap->device_caps |
+		V4L2_CAP_VIDEO_CAPTURE |
+		V4L2_CAP_DEVICE_CAPS;
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 070/267] [media] s5h1420: fix a buffer overflow when checking userspace params
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 069/267] [media] saa7164: fix querycap warning Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 071/267] [media] cx24116: " Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up to 7 values:
	drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/dvb-frontends/s5h1420.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/dvb-frontends/s5h1420.c
+++ b/drivers/media/dvb-frontends/s5h1420.c
@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (stru
 	int result = 0;
 
 	dprintk("enter %s\n", __func__);
-	if (cmd->msg_len > 8)
+	if (cmd->msg_len > sizeof(cmd->msg))
 		return -EINVAL;
 
 	/* setup for DISEQC */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 071/267] [media] cx24116: fix a buffer overflow when checking userspace params
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 070/267] [media] s5h1420: fix a buffer overflow when checking userspace params Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 072/267] ASoC: arizona: Fix noise generator gain TLV Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/dvb-frontends/cx24116.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/media/dvb-frontends/cx24116.c
+++ b/drivers/media/dvb-frontends/cx24116.c
@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struc
 	struct cx24116_state *state = fe->demodulator_priv;
 	int i, ret;
 
+	/* Validate length */
+	if (d->msg_len > sizeof(d->msg))
+                return -EINVAL;
+
 	/* Dump DiSEqC message */
 	if (debug) {
 		printk(KERN_INFO "cx24116: %s(", __func__);
@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struc
 		printk(") toneburst=%d\n", toneburst);
 	}
 
-	/* Validate length */
-	if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
-		return -EINVAL;
-
 	/* DiSEqC message */
 	for (i = 0; i < d->msg_len; i++)
 		state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 072/267] ASoC: arizona: Fix noise generator gain TLV
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 071/267] [media] cx24116: " Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 073/267] ASoC: rt5645: Init jack_detect_work before registering irq Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Richard Fitzgerald, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>

commit 15575ed544910464715df5c45a44b9732e415b93 upstream.

The Arizona codec drivers had an incorrect dB scaling for the
noise generator gain that started at 0dB and went upwards.
Actually the highest setting is 0dB.

Signed-off-by: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/wm5102.c |    2 +-
 sound/soc/codecs/wm5110.c |    2 +-
 sound/soc/codecs/wm8997.c |    2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

--- a/sound/soc/codecs/wm5102.c
+++ b/sound/soc/codecs/wm5102.c
@@ -42,7 +42,7 @@ struct wm5102_priv {
 static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
 static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
 static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
 static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
 
 static const struct wm_adsp_region wm5102_dsp1_regions[] = {
--- a/sound/soc/codecs/wm5110.c
+++ b/sound/soc/codecs/wm5110.c
@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_s
 static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
 static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
 static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
 static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
 
 #define WM5110_NG_SRC(name, base) \
--- a/sound/soc/codecs/wm8997.c
+++ b/sound/soc/codecs/wm8997.c
@@ -40,7 +40,7 @@ struct wm8997_priv {
 static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
 static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
 static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
 static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
 
 static const struct reg_default wm8997_sysclk_reva_patch[] = {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 073/267] ASoC: rt5645: Init jack_detect_work before registering irq
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 072/267] ASoC: arizona: Fix noise generator gain TLV Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 074/267] ASoC: max98925: Fix mask for setting DAI invert mode Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolas Boichat, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Boichat <drinkcat@chromium.org>

commit 7ea3470a7277380248135a592a849e1c27960b2f upstream.

Prevents frequent panic on boot, if the irq handler rt5645_irq
gets called before the workqueue rt5645_jack_detect_work is
initialized.

Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/rt5645.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -2837,6 +2837,8 @@ static int rt5645_i2c_probe(struct i2c_c
 		}
 	}
 
+	INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
+
 	if (rt5645->i2c->irq) {
 		ret = request_threaded_irq(rt5645->i2c->irq, NULL, rt5645_irq,
 			IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING
@@ -2855,8 +2857,6 @@ static int rt5645_i2c_probe(struct i2c_c
 			dev_err(&i2c->dev, "Fail gpio_direction hp_det_gpio\n");
 	}
 
-	INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
-
 	return snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5645,
 				      rt5645_dai, ARRAY_SIZE(rt5645_dai));
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 074/267] ASoC: max98925: Fix mask for setting DAI invert mode
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 073/267] ASoC: rt5645: Init jack_detect_work before registering irq Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 075/267] ASoC: qcom: remove incorrect dependencies Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Axel Lin <axel.lin@ingics.com>

commit 0b51601d4504f46f585eed823485101390f0b588 upstream.

The M98925_DAI_WCI_MASK bit is not updated with current code.
To properly set the DAI invert mode, the mask should be
M98925_DAI_BCI_MASK | M98925_DAI_WCI_MASK.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/max98925.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/codecs/max98925.c
+++ b/sound/soc/codecs/max98925.c
@@ -346,7 +346,7 @@ static int max98925_dai_set_fmt(struct s
 	}
 
 	regmap_update_bits(max98925->regmap, MAX98925_FORMAT,
-			M98925_DAI_BCI_MASK, invert);
+			M98925_DAI_BCI_MASK | M98925_DAI_WCI_MASK, invert);
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 075/267] ASoC: qcom: remove incorrect dependencies
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 074/267] ASoC: max98925: Fix mask for setting DAI invert mode Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 076/267] ASoC: imx-wm8962: Add a missing error check Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit a7310c496f376b945e7e61f64d69c9c0a93ee1ee upstream.

Compile-tests show a warning for the newly added SND_SOC_STORM
symbol:

warning: (SND_SOC_STORM) selects SND_SOC_LPASS_CPU which has unmet direct dependencies (SOUND && !M68K && !UML && SND && SND_SOC && SND_SOC_QCOM)

The problem is that it can be selected for COMPILE_TEST on non-QCOM
builds, but the symbols it selects have a dependency.
Dropping the dependencies makes it work without warnings and no
other side-effects, because these are not user-visible.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: f380dd3f3cd ("ASoC: qcom: Add ability to build QCOM drivers")
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/qcom/Kconfig |    2 --
 1 file changed, 2 deletions(-)

--- a/sound/soc/qcom/Kconfig
+++ b/sound/soc/qcom/Kconfig
@@ -6,12 +6,10 @@ config SND_SOC_QCOM
 
 config SND_SOC_LPASS_CPU
 	tristate
-	depends on SND_SOC_QCOM
 	select REGMAP_MMIO
 
 config SND_SOC_LPASS_PLATFORM
 	tristate
-	depends on SND_SOC_QCOM
 	select REGMAP_MMIO
 
 config SND_SOC_STORM



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 076/267] ASoC: imx-wm8962: Add a missing error check
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 075/267] ASoC: qcom: remove incorrect dependencies Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 077/267] ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency, again Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 474ff0ae23b834e9fc18374d14bb5f3e7b3828b4 upstream.

My static checker complains that:

	sound/soc/fsl/imx-wm8962.c:196 imx_wm8962_probe() warn:
	we tested 'ret' before and it was 'false'

The intent was that we use "ret" to check imx_audmux_v2_configure_port().

Fixes: 8de2ae2a7f1f ('ASoC: fsl: add imx-wm8962 machine driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Otherwise, Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/fsl/imx-wm8962.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/fsl/imx-wm8962.c
+++ b/sound/soc/fsl/imx-wm8962.c
@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platf
 		dev_err(&pdev->dev, "audmux internal port setup failed\n");
 		return ret;
 	}
-	imx_audmux_v2_configure_port(ext_port,
+	ret = imx_audmux_v2_configure_port(ext_port,
 			IMX_AUDMUX_V2_PTCR_SYN,
 			IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
 	if (ret) {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 077/267] ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency, again
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 076/267] ASoC: imx-wm8962: Add a missing error check Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 079/267] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Peter Ujfalusi, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 0574eab363ace70ef275d4caad6eadc458d33728 upstream.

I tried to fix this before and submitted a working patch, but after
some discussion we came up with what seemed to be a nicer solution,
resulting in commit 3d4cf65e2d ("ASoC: omap: fix up
SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency"). Unfortunately, that
version was incomplete, and we still get this build error:

drivers/clk/clk-palmas.c:46:16: error: field 'hw' has incomplete type
drivers/clk/clk-palmas.c: In function 'to_palmas_clks_info':
drivers/clk/clk-palmas.c:54:74: warning: initialization from incompatible pointer type [-Winc

This happens only in randconfig builds that turn on MFD_PALMAS
on a platform other than OMAP2+ when COMPILE_TEST is set
but COMMON_CLK is not.

The new approach is only 'select COMMON_CLK_PALMAS' if we know
that we are on an OMAP5 platform and MFD_PALMAS is already set.
This patch has survived thousands of randconfig builds and I
don't see a remaining hole in the logic.

Fixes: 3d4cf65e2d ("ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/omap/Kconfig |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/sound/soc/omap/Kconfig
+++ b/sound/soc/omap/Kconfig
@@ -100,12 +100,13 @@ config SND_OMAP_SOC_OMAP_TWL4030
 
 config SND_OMAP_SOC_OMAP_ABE_TWL6040
 	tristate "SoC Audio support for OMAP boards using ABE and twl6040 codec"
-	depends on TWL6040_CORE && SND_OMAP_SOC && (ARCH_OMAP4 || SOC_OMAP5 || COMPILE_TEST)
+	depends on TWL6040_CORE && SND_OMAP_SOC
+	depends on ARCH_OMAP4 || (SOC_OMAP5 && MFD_PALMAS) || COMPILE_TEST
 	select SND_OMAP_SOC_DMIC
 	select SND_OMAP_SOC_MCPDM
 	select SND_SOC_TWL6040
 	select SND_SOC_DMIC
-	select COMMON_CLK_PALMAS if MFD_PALMAS
+	select COMMON_CLK_PALMAS if (SOC_OMAP5 && MFD_PALMAS)
 	help
 	  Say Y if you want to add support for SoC audio on OMAP boards using
 	  ABE and twl6040 codec. This driver currently supports:



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 079/267] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 077/267] ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency, again Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 081/267] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Charles Keepax, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Axel Lin <axel.lin@ingics.com>

commit 12c350050538c7dc779c083b7342bfd20f74949c upstream.

WM8955_K_8_0_MASK bits is controlled by WM8955_PLL_CONTROL_3 rather than
WM8955_PLL_CONTROL_2.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/wm8955.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/codecs/wm8955.c
+++ b/sound/soc/codecs/wm8955.c
@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(str
 		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
 				    WM8955_K_17_9_MASK,
 				    (pll.k >> 9) & WM8955_K_17_9_MASK);
-		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
+		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
 				    WM8955_K_8_0_MASK,
 				    pll.k & WM8955_K_8_0_MASK);
 		if (pll.k)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 081/267] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1]
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 079/267] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 082/267] ASoC: tas2552: Fix kernel crash when the codec is loaded but not part of a card Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zidan Wang, Charles Keepax, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zidan Wang <zidan.wang@freescale.com>

commit a077e81ec61e07a7f86997d045109f06719fbffe upstream.

the enum of "DAC Polarity" should be wm8960_enum[1].

Signed-off-by: Zidan Wang <zidan.wang@freescale.com>
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/wm8960.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -245,7 +245,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", W
 SOC_ENUM("ADC Polarity", wm8960_enum[0]),
 SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
 
-SOC_ENUM("DAC Polarity", wm8960_enum[2]),
+SOC_ENUM("DAC Polarity", wm8960_enum[1]),
 SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
 		    wm8960_get_deemph, wm8960_put_deemph),
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 082/267] ASoC: tas2552: Fix kernel crash when the codec is loaded but not part of a card
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 081/267] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 083/267] ASoC: tas2552: Fix kernel crash caused by wrong kcontrol entry Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Ujfalusi <peter.ujfalusi@ti.com>

commit 80ba2669ec8c3e6517aa935001f6cb8809bf3df4 upstream.

If the card is not part of any card the tas_data->codec is NULL since it is
set only during snd_soc_codec_driver.probe, which is not yet called.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/tas2552.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/sound/soc/codecs/tas2552.c
+++ b/sound/soc/codecs/tas2552.c
@@ -120,6 +120,9 @@ static void tas2552_sw_shutdown(struct t
 {
 	u8 cfg1_reg;
 
+	if (!tas_data->codec)
+		return;
+
 	if (sw_shutdown)
 		cfg1_reg = 0;
 	else



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 083/267] ASoC: tas2552: Fix kernel crash caused by wrong kcontrol entry
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 082/267] ASoC: tas2552: Fix kernel crash when the codec is loaded but not part of a card Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 084/267] libata: Do not blacklist Micron M500DC Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Mark Brown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Ujfalusi <peter.ujfalusi@ti.com>

commit 1cf0f44811b754b64283b11ef0e60cb0de07b29c upstream.

SOC_DAPM_SINGLE("Playback AMP", ..) should not be under kcontrols. It
causes kernel crash (NULL pointer) when the mixers are listed.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/tas2552.c |    1 -
 1 file changed, 1 deletion(-)

--- a/sound/soc/codecs/tas2552.c
+++ b/sound/soc/codecs/tas2552.c
@@ -338,7 +338,6 @@ static DECLARE_TLV_DB_SCALE(dac_tlv, -7,
 static const struct snd_kcontrol_new tas2552_snd_controls[] = {
 	SOC_SINGLE_TLV("Speaker Driver Playback Volume",
 			 TAS2552_PGA_GAIN, 0, 0x1f, 1, dac_tlv),
-	SOC_DAPM_SINGLE("Playback AMP", SND_SOC_NOPM, 0, 1, 0),
 };
 
 static const struct reg_default tas2552_init_regs[] = {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 084/267] libata: Do not blacklist Micron M500DC
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 083/267] ASoC: tas2552: Fix kernel crash caused by wrong kcontrol entry Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 085/267] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin K. Petersen, Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Martin K. Petersen" <martin.petersen@oracle.com>

commit 243918be6393f643e513a26e7882e6ae06ff7717 upstream.

Queued TRIM got disabled on Micron M500DC drives thanks to the
"Micron_M500*" pattern we had in place to accommodate the previous
generation of this drive family. Tweak the blacklist entry slightly so
we only disable queued TRIM for the non-DC variants of M500 drives.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4225,7 +4225,7 @@ static const struct ata_blacklist_entry
 	{ "PIONEER DVD-RW  DVR-216D",	NULL,	ATA_HORKAGE_NOSETXFER },
 
 	/* devices that don't properly handle queued TRIM commands */
-	{ "Micron_M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
+	{ "Micron_M500_*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 	{ "Crucial_CT*M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 085/267] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 084/267] libata: Do not blacklist Micron M500DC Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 086/267] libata: increase the timeout when setting transfer mode Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aleksei Mamlin, Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Aleksei Mamlin <mamlinav@gmail.com>

commit 08c85d2a599d967ede38a847f5594447b6100642 upstream.

Enabling AA on HP 250GB SATA disk VB0250EAVER causes errors:

[    3.788362] ata3.00: failed to enable AA (error_mask=0x1)
[    3.789243] ata3.00: failed to enable AA (error_mask=0x1)

Add the ATA_HORKAGE_BROKEN_FPDMA_AA for this specific harddisk.

tj: Collected FPDMA_AA entries and updated comment.

Signed-off-by: Aleksei Mamlin <mamlinav@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-core.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4174,9 +4174,10 @@ static const struct ata_blacklist_entry
 	{ "ST3320[68]13AS",	"SD1[5-9]",	ATA_HORKAGE_NONCQ |
 						ATA_HORKAGE_FIRMWARE_WARN },
 
-	/* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+	/* drives which fail FPDMA_AA activation (some may freeze afterwards) */
 	{ "ST1000LM024 HN-M101MBB", "2AR10001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
 	{ "ST1000LM024 HN-M101MBB", "2BA30001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
+	{ "VB0250EAVER",	"HPG7",		ATA_HORKAGE_BROKEN_FPDMA_AA },
 
 	/* Blacklist entries taken from Silicon Image 3124/3132
 	   Windows driver .inf file - also several Linux problem reports */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 086/267] libata: increase the timeout when setting transfer mode
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 085/267] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 087/267] libata: Fall back to unqueued READ LOG EXT if the DMA variant fails Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mikulas Patocka <mpatocka@redhat.com>

commit d531be2ca2f27cca5f041b6a140504999144a617 upstream.

I have a ST4000DM000 disk. If Linux is booted while the disk is spun down,
the command that sets transfer mode causes the disk to spin up. The
spin-up takes longer than the default 5s timeout, so the command fails and
timeout is reported.

Fix this by increasing the timeout to 15s, which is enough for the disk to
spin up.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-core.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4502,7 +4502,8 @@ static unsigned int ata_dev_set_xfermode
 	else /* In the ancient relic department - skip all of this */
 		return 0;
 
-	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
+	/* On some disks, this command causes spin-up, so we need longer timeout */
+	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
 
 	DPRINTK("EXIT, err_mask=%x\n", err_mask);
 	return err_mask;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 087/267] libata: Fall back to unqueued READ LOG EXT if the DMA variant fails
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 086/267] libata: increase the timeout when setting transfer mode Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:38 ` [PATCH 4.1 088/267] libata: Expose TRIM capability in sysfs Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin K. Petersen, Hannes Reinecke,
	Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Martin K. Petersen" <martin.petersen@oracle.com>

commit 5d3abf8ff67f49271a42c0f7fa4f20f9e046bf0e upstream.

Some devices advertise support for the READ/WRITE LOG DMA EXT commands
but fail when we try to issue them. This can lead to queued TRIM being
unintentionally disabled since the relevant feature flag is located in a
general purpose log page.

Fall back to unqueued READ LOG EXT if the DMA variant fails while
reading a log page.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-eh.c |   12 +++++++++++-
 include/linux/libata.h  |    1 +
 2 files changed, 12 insertions(+), 1 deletion(-)

--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1507,13 +1507,17 @@ unsigned int ata_read_log_page(struct at
 {
 	struct ata_taskfile tf;
 	unsigned int err_mask;
+	bool dma = false;
 
 	DPRINTK("read log page - log 0x%x, page 0x%x\n", log, page);
 
+retry:
 	ata_tf_init(dev, &tf);
-	if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id)) {
+	if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
+	    !(dev->horkage & ATA_HORKAGE_NO_NCQ_LOG)) {
 		tf.command = ATA_CMD_READ_LOG_DMA_EXT;
 		tf.protocol = ATA_PROT_DMA;
+		dma = true;
 	} else {
 		tf.command = ATA_CMD_READ_LOG_EXT;
 		tf.protocol = ATA_PROT_PIO;
@@ -1527,6 +1531,12 @@ unsigned int ata_read_log_page(struct at
 	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_FROM_DEVICE,
 				     buf, sectors * ATA_SECT_SIZE, 0);
 
+	if (err_mask && dma) {
+		dev->horkage |= ATA_HORKAGE_NO_NCQ_LOG;
+		ata_dev_warn(dev, "READ LOG DMA EXT failed, trying unqueued\n");
+		goto retry;
+	}
+
 	DPRINTK("EXIT, err_mask=%x\n", err_mask);
 	return err_mask;
 }
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -431,6 +431,7 @@ enum {
 	ATA_HORKAGE_NOLPM	= (1 << 20),	/* don't use LPM */
 	ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),	/* some WDs have broken LPM */
 	ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
+	ATA_HORKAGE_NO_NCQ_LOG	= (1 << 23),	/* don't use NCQ for log read */
 
 	 /* DMA mask for user DMA control: User visible values; DO NOT
 	    renumber */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 088/267] libata: Expose TRIM capability in sysfs
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 087/267] libata: Fall back to unqueued READ LOG EXT if the DMA variant fails Greg Kroah-Hartman
@ 2015-07-31 19:38 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 089/267] libata: add ATA_HORKAGE_NOTRIM Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:38 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin K. Petersen, Hannes Reinecke,
	Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Martin K. Petersen" <martin.petersen@oracle.com>

commit f303074160d3401970ccae082014e1ee5a9a52c5 upstream.

Create a sysfs "trim" attribute for each ata_device that displays
whether DSM TRIM is "unsupported", "unqueued", "forced_unqueued"
(blacklisted) or "queued".

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/ABI/testing/sysfs-ata |   11 +++++++++++
 drivers/ata/libata-transport.c      |   22 ++++++++++++++++++++++
 2 files changed, 33 insertions(+)

--- a/Documentation/ABI/testing/sysfs-ata
+++ b/Documentation/ABI/testing/sysfs-ata
@@ -90,6 +90,17 @@ gscr
 	130:	SATA_PMP_GSCR_SII_GPIO
 	Only valid if the device is a PM.
 
+trim
+
+	Shows the DSM TRIM mode currently used by the device. Valid
+	values are:
+	unsupported:		Drive does not support DSM TRIM
+	unqueued:		Drive supports unqueued DSM TRIM only
+	queued:			Drive supports queued DSM TRIM
+	forced_unqueued:	Drive's unqueued DSM support is known to be
+				buggy and only unqueued TRIM commands
+				are sent
+
 spdn_cnt
 
 	Number of time libata decided to lower the speed of link due to errors.
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -560,6 +560,27 @@ show_ata_dev_gscr(struct device *dev,
 
 static DEVICE_ATTR(gscr, S_IRUGO, show_ata_dev_gscr, NULL);
 
+static ssize_t
+show_ata_dev_trim(struct device *dev,
+		  struct device_attribute *attr, char *buf)
+{
+	struct ata_device *ata_dev = transport_class_to_dev(dev);
+	unsigned char *mode;
+
+	if (!ata_id_has_trim(ata_dev->id))
+		mode = "unsupported";
+	else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM)
+			mode = "forced_unqueued";
+	else if (ata_fpdma_dsm_supported(ata_dev))
+		mode = "queued";
+	else
+		mode = "unqueued";
+
+	return snprintf(buf, 20, "%s\n", mode);
+}
+
+static DEVICE_ATTR(trim, S_IRUGO, show_ata_dev_trim, NULL);
+
 static DECLARE_TRANSPORT_CLASS(ata_dev_class,
 			       "ata_device", NULL, NULL, NULL);
 
@@ -733,6 +754,7 @@ struct scsi_transport_template *ata_atta
 	SETUP_DEV_ATTRIBUTE(ering);
 	SETUP_DEV_ATTRIBUTE(id);
 	SETUP_DEV_ATTRIBUTE(gscr);
+	SETUP_DEV_ATTRIBUTE(trim);
 	BUG_ON(count > ATA_DEV_ATTRS);
 	i->dev_attrs[count] = NULL;
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 089/267] libata: add ATA_HORKAGE_NOTRIM
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2015-07-31 19:38 ` [PATCH 4.1 088/267] libata: Expose TRIM capability in sysfs Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 090/267] libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arne Fitzenreiter, Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arne Fitzenreiter <arne_f@ipfire.org>

commit 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 upstream.

Some devices lose data on TRIM whether queued or not.  This patch adds
a horkage to disable TRIM.

tj: Collapsed unnecessary if() nesting.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-scsi.c      |    3 ++-
 drivers/ata/libata-transport.c |    2 ++
 include/linux/libata.h         |    2 ++
 3 files changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2568,7 +2568,8 @@ static unsigned int ata_scsiop_read_cap(
 		rbuf[14] = (lowest_aligned >> 8) & 0x3f;
 		rbuf[15] = lowest_aligned;
 
-		if (ata_id_has_trim(args->id)) {
+		if (ata_id_has_trim(args->id) &&
+		    !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
 			rbuf[14] |= 0x80; /* LBPME */
 
 			if (ata_id_has_zero_after_trim(args->id) &&
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -569,6 +569,8 @@ show_ata_dev_trim(struct device *dev,
 
 	if (!ata_id_has_trim(ata_dev->id))
 		mode = "unsupported";
+	else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM)
+		mode = "forced_unsupported";
 	else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM)
 			mode = "forced_unqueued";
 	else if (ata_fpdma_dsm_supported(ata_dev))
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -432,6 +432,8 @@ enum {
 	ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),	/* some WDs have broken LPM */
 	ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
 	ATA_HORKAGE_NO_NCQ_LOG	= (1 << 23),	/* don't use NCQ for log read */
+	ATA_HORKAGE_NOTRIM	= (1 << 24),	/* don't use TRIM */
+
 
 	 /* DMA mask for user DMA control: User visible values; DO NOT
 	    renumber */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 090/267] libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 089/267] libata: add ATA_HORKAGE_NOTRIM Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 091/267] libata: Do not blacklist M510DC Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeff Moyer, David Milburn, Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Milburn <dmilburn@redhat.com>

commit af34d637637eabaf49406eb35c948cd51ba262a6 upstream.

Since no longer limiting max_sectors to BLK_DEF_MAX_SECTORS (commit 34b48db66e08),
data corruption may occur on ST380013AS drive configured on 82801JI (ICH10 Family)
SATA controller. This patch will allow the driver to limit max_sectors as before

 # cat /sys/block/sdb/queue/max_sectors_kb
 512

I was able to double the max_sectors_kb value up to 16384 on linux-4.2.0-rc2
before seeing corruption, but seems safer to use previous limit. Without this
patch max_sectors_kb will be 32767.

tj: Minor comment update.

Reported-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: David Milburn <dmilburn@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: 34b48db66e08 ("block: remove artifical max_hw_sectors cap")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-core.c |   10 ++++++++++
 include/linux/ata.h       |    1 +
 include/linux/libata.h    |    2 +-
 3 files changed, 12 insertions(+), 1 deletion(-)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2478,6 +2478,10 @@ int ata_dev_configure(struct ata_device
 		dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
 					 dev->max_sectors);
 
+	if (dev->horkage & ATA_HORKAGE_MAX_SEC_1024)
+		dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_1024,
+					 dev->max_sectors);
+
 	if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
 		dev->max_sectors = ATA_MAX_SECTORS_LBA48;
 
@@ -4146,6 +4150,12 @@ static const struct ata_blacklist_entry
 	{ "Slimtype DVD A  DS8A8SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
 	{ "Slimtype DVD A  DS8A9SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
 
+	/*
+	 * Causes silent data corruption with higher max sects.
+	 * http://lkml.kernel.org/g/x49wpy40ysk.fsf@segfault.boston.devel.redhat.com
+	 */
+	{ "ST380013AS",		"3.20",		ATA_HORKAGE_MAX_SEC_1024 },
+
 	/* Devices we expect to fail diagnostics */
 
 	/* Devices where NCQ should be avoided */
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -45,6 +45,7 @@ enum {
 	ATA_SECT_SIZE		= 512,
 	ATA_MAX_SECTORS_128	= 128,
 	ATA_MAX_SECTORS		= 256,
+	ATA_MAX_SECTORS_1024    = 1024,
 	ATA_MAX_SECTORS_LBA48	= 65535,/* TODO: 65536? */
 	ATA_MAX_SECTORS_TAPE	= 65535,
 
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -433,7 +433,7 @@ enum {
 	ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
 	ATA_HORKAGE_NO_NCQ_LOG	= (1 << 23),	/* don't use NCQ for log read */
 	ATA_HORKAGE_NOTRIM	= (1 << 24),	/* don't use TRIM */
-
+	ATA_HORKAGE_MAX_SEC_1024 = (1 << 25),	/* Limit max sects to 1024 */
 
 	 /* DMA mask for user DMA control: User visible values; DO NOT
 	    renumber */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 091/267] libata: Do not blacklist M510DC
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 090/267] libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 092/267] libata: force disable trim for SuperSSpeed S238 Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin K. Petersen, Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Martin K. Petersen" <martin.petersen@oracle.com>

commit 9051bd393cf25e76dfb45409792719a854661500 upstream.

A new Micron drive was just announced, once again recycling the first
part of the model string. Add an underscore to the M510/M550 pattern to
avoid picking up the new DC drive.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4240,7 +4240,7 @@ static const struct ata_blacklist_entry
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 	{ "Crucial_CT*M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
-	{ "Micron_M5[15]0*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
+	{ "Micron_M5[15]0_*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 	{ "Crucial_CT*M550*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 092/267] libata: force disable trim for SuperSSpeed S238
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 091/267] libata: Do not blacklist M510DC Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 093/267] usb: dwc3: gadget: return error if command sent to DGCMD register fails Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arne Fitzenreiter, Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arne Fitzenreiter <arne_f@ipfire.org>

commit cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc upstream.

This device loses blocks, often the partition table area, on trim.
Disable TRIM.
http://pcengines.ch/msata16a.htm

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-core.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4249,6 +4249,9 @@ static const struct ata_blacklist_entry
 	{ "Samsung SSD 8*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 
+	/* devices that don't properly handle TRIM commands */
+	{ "SuperSSpeed S238*",		NULL,	ATA_HORKAGE_NOTRIM, },
+
 	/*
 	 * As defined, the DRAT (Deterministic Read After Trim) and RZAT
 	 * (Return Zero After Trim) flags in the ATA Command Set are



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 093/267] usb: dwc3: gadget: return error if command sent to DGCMD register fails
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 092/267] libata: force disable trim for SuperSSpeed S238 Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 094/267] usb: dwc3: gadget: return error if command sent to DEPCMD " Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Subbaraya Sundeep Bhatta, Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>

commit 891b1dc022955d36cf4c0f42d383226a930db7ed upstream.

We need to return error to caller if command is not sent to
controller succesfully.

Signed-off-by: Subbaraya Sundeep Bhatta <sbhatta@xilinx.com>
Fixes: b09bb64239c8 (usb: dwc3: gadget: implement Global Command support)
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/gadget.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -291,6 +291,8 @@ int dwc3_send_gadget_generic_command(str
 			dwc3_trace(trace_dwc3_gadget,
 					"Command Complete --> %d",
 					DWC3_DGCMD_STATUS(reg));
+			if (DWC3_DGCMD_STATUS(reg))
+				return -EINVAL;
 			return 0;
 		}
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 094/267] usb: dwc3: gadget: return error if command sent to DEPCMD register fails
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 093/267] usb: dwc3: gadget: return error if command sent to DGCMD register fails Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 095/267] usb: dwc3: gadget: dont clear EP_BUSY too early Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Subbaraya Sundeep Bhatta, Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>

commit 76e838c9f7765f9a6205b4d558d75a66104bc60d upstream.

We need to return error to caller if command is not sent to
controller succesfully.

Signed-off-by: Subbaraya Sundeep Bhatta <sbhatta@xilinx.com>
Fixes: 72246da40f37 (usb: Introduce DesignWare USB3 DRD Driver)
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/gadget.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -330,6 +330,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3
 			dwc3_trace(trace_dwc3_gadget,
 					"Command Complete --> %d",
 					DWC3_DEPCMD_STATUS(reg));
+			if (DWC3_DEPCMD_STATUS(reg))
+				return -EINVAL;
 			return 0;
 		}
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 095/267] usb: dwc3: gadget: dont clear EP_BUSY too early
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 094/267] usb: dwc3: gadget: return error if command sent to DEPCMD " Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 096/267] usb: dwc3: Reset the transfer resource index on SET_INTERFACE Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, sundeep subbaraya, Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Felipe Balbi <balbi@ti.com>

commit e18b7975c885bc3a938b9a76daf32957ea0235fa upstream.

In case of non-Isochronous transfers, we don't
want to clear DWC3_EP_BUSY flag until XferComplete
event. That's because XferInProgress was only enabled
so we can recycle TRBs and usb_requests quicker, but
there are still other pending requests being transferred.

In order to make sure we don't allow for another StartTransfer
command while the HW is still processing other transfers,
we must keep DWC3_EP_BUSY flag set and this what this patch
does.

Fixes: f3af36511e60 (usb: dwc3: gadget: always enable IOC on
	bulk/interrupt transfers)
Reported-by: sundeep subbaraya <sundeep.lkml@gmail.com>
Tested-by: sundeep subbaraya <sundeep.lkml@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/gadget.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1906,12 +1906,16 @@ static void dwc3_endpoint_transfer_compl
 {
 	unsigned		status = 0;
 	int			clean_busy;
+	u32			is_xfer_complete;
+
+	is_xfer_complete = (event->endpoint_event == DWC3_DEPEVT_XFERCOMPLETE);
 
 	if (event->status & DEPEVT_STATUS_BUSERR)
 		status = -ECONNRESET;
 
 	clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status);
-	if (clean_busy)
+	if (clean_busy && (is_xfer_complete ||
+				usb_endpoint_xfer_isoc(dep->endpoint.desc)))
 		dep->flags &= ~DWC3_EP_BUSY;
 
 	/*



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 096/267] usb: dwc3: Reset the transfer resource index on SET_INTERFACE
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 095/267] usb: dwc3: gadget: dont clear EP_BUSY too early Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 097/267] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huang Rui, Subbaraya Sundeep Bhatta,
	John Youn, Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: John Youn <John.Youn@synopsys.com>

commit aebda618718157a69c0dc0adb978d69bc2b8723c upstream.

This fixes an issue introduced in commit b23c843992b6 (usb: dwc3:
gadget: fix DEPSTARTCFG for non-EP0 EPs) that made sure we would
only use DEPSTARTCFG once per SetConfig.

The trick is that we should use one DEPSTARTCFG per SetConfig *OR*
SetInterface. SetInterface was completely missed from the original
patch.

This problem became aparent after commit 76e838c9f776 (usb: dwc3:
gadget: return error if command sent to DEPCMD register fails)
added checking of the return status of device endpoint commands.

'Set Endpoint Transfer Resource' command was caught failing
occasionally. This is because the Transfer Resource
Index was not getting reset during a SET_INTERFACE request.

Finally, to fix the issue, was we have to do is make sure that
our start_config_issued flag gets reset whenever we receive a
SetInterface request.

To verify the problem (and its fix), all we have to do is run
test 9 from testusb with 'testusb -t 9 -s 2048 -a -c 5000'.

Tested-by: Huang Rui <ray.huang@amd.com>
Tested-by: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
Fixes: b23c843992b6 (usb: dwc3: gadget: fix DEPSTARTCFG for non-EP0 EPs)
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/ep0.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct d
 		dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY");
 		ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
 		break;
+	case USB_REQ_SET_INTERFACE:
+		dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE");
+		dwc->start_config_issued = false;
+		/* Fall through */
 	default:
 		dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver");
 		ret = dwc3_ep0_delegate_req(dwc, ctrl);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 097/267] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 096/267] usb: dwc3: Reset the transfer resource index on SET_INTERFACE Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 098/267] USB: devio: fix a condition in async_completed() Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Robert Schlabbach, Alan Stern

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Robert Schlabbach <Robert.Schlabbach@gmx.net>

commit fb6d1f7df5d25299fd7b3e84b72b8851d3634764 upstream.

Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset.

Dissolve the function hub_port_finish_reset() completely and divide the
actions to be taken into those which need to be done after each reset
attempt and those which need to be done after the full procedure is
complete, and place them in the appropriate places in hub_port_reset().
Also, remove an unneeded forward declaration of hub_port_reset().

Verbose Problem Description:

USB 3.0 devices may be "lost for good" during a hub port reset.
This makes Linux unable to boot from USB 3.0 devices in certain
constellations of host controllers and devices, because the USB device is
lost during initialization, preventing the rootfs from being mounted.

The underlying problem is that in the affected constellations, during the
processing inside hub_port_reset(), the hub link state goes from 0 to
SS.inactive after the initial reset, and back to 0 again only after the
following "warm" reset.

However, hub_port_finish_reset() is called after each reset attempt and
sets the state the connected USB device based on the "preliminary" status
of the hot reset to USB_STATE_NOTATTACHED due to SS.inactive, yet when
the following warm reset is complete and hub_port_finish_reset() is
called again, its call to set the device to USB_STATE_DEFAULT is blocked
by usb_set_device_state() which does not allow taking USB devices out of
USB_STATE_NOTATTACHED state.

Thanks to Alan Stern for guiding me to the proper solution and how to
submit it.

Link: http://lkml.kernel.org/r/trinity-25981484-72a9-4d46-bf17-9c1cf9301a31-1432073240136%20()%203capp-gmx-bs27
Signed-off-by: Robert Schlabbach <robert_s@gmx.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/hub.c |   82 +++++++++++++++++++------------------------------
 1 file changed, 33 insertions(+), 49 deletions(-)

--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2616,9 +2616,6 @@ static bool use_new_scheme(struct usb_de
 	return USE_NEW_SCHEME(retry);
 }
 
-static int hub_port_reset(struct usb_hub *hub, int port1,
-			struct usb_device *udev, unsigned int delay, bool warm);
-
 /* Is a USB 3.0 port in the Inactive or Compliance Mode state?
  * Port worm reset is required to recover
  */
@@ -2706,44 +2703,6 @@ static int hub_port_wait_reset(struct us
 	return 0;
 }
 
-static void hub_port_finish_reset(struct usb_hub *hub, int port1,
-			struct usb_device *udev, int *status)
-{
-	switch (*status) {
-	case 0:
-		/* TRSTRCY = 10 ms; plus some extra */
-		msleep(10 + 40);
-		if (udev) {
-			struct usb_hcd *hcd = bus_to_hcd(udev->bus);
-
-			update_devnum(udev, 0);
-			/* The xHC may think the device is already reset,
-			 * so ignore the status.
-			 */
-			if (hcd->driver->reset_device)
-				hcd->driver->reset_device(hcd, udev);
-		}
-		/* FALL THROUGH */
-	case -ENOTCONN:
-	case -ENODEV:
-		usb_clear_port_feature(hub->hdev,
-				port1, USB_PORT_FEAT_C_RESET);
-		if (hub_is_superspeed(hub->hdev)) {
-			usb_clear_port_feature(hub->hdev, port1,
-					USB_PORT_FEAT_C_BH_PORT_RESET);
-			usb_clear_port_feature(hub->hdev, port1,
-					USB_PORT_FEAT_C_PORT_LINK_STATE);
-			usb_clear_port_feature(hub->hdev, port1,
-					USB_PORT_FEAT_C_CONNECTION);
-		}
-		if (udev)
-			usb_set_device_state(udev, *status
-					? USB_STATE_NOTATTACHED
-					: USB_STATE_DEFAULT);
-		break;
-	}
-}
-
 /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */
 static int hub_port_reset(struct usb_hub *hub, int port1,
 			struct usb_device *udev, unsigned int delay, bool warm)
@@ -2767,13 +2726,10 @@ static int hub_port_reset(struct usb_hub
 		 * If the caller hasn't explicitly requested a warm reset,
 		 * double check and see if one is needed.
 		 */
-		status = hub_port_status(hub, port1,
-					&portstatus, &portchange);
-		if (status < 0)
-			goto done;
-
-		if (hub_port_warm_reset_required(hub, port1, portstatus))
-			warm = true;
+		if (hub_port_status(hub, port1, &portstatus, &portchange) == 0)
+			if (hub_port_warm_reset_required(hub, port1,
+							portstatus))
+				warm = true;
 	}
 	clear_bit(port1, hub->warm_reset_bits);
 
@@ -2799,11 +2755,19 @@ static int hub_port_reset(struct usb_hub
 
 		/* Check for disconnect or reset */
 		if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
-			hub_port_finish_reset(hub, port1, udev, &status);
+			usb_clear_port_feature(hub->hdev, port1,
+					USB_PORT_FEAT_C_RESET);
 
 			if (!hub_is_superspeed(hub->hdev))
 				goto done;
 
+			usb_clear_port_feature(hub->hdev, port1,
+					USB_PORT_FEAT_C_BH_PORT_RESET);
+			usb_clear_port_feature(hub->hdev, port1,
+					USB_PORT_FEAT_C_PORT_LINK_STATE);
+			usb_clear_port_feature(hub->hdev, port1,
+					USB_PORT_FEAT_C_CONNECTION);
+
 			/*
 			 * If a USB 3.0 device migrates from reset to an error
 			 * state, re-issue the warm reset.
@@ -2836,6 +2800,26 @@ static int hub_port_reset(struct usb_hub
 	dev_err(&port_dev->dev, "Cannot enable. Maybe the USB cable is bad?\n");
 
 done:
+	if (status == 0) {
+		/* TRSTRCY = 10 ms; plus some extra */
+		msleep(10 + 40);
+		if (udev) {
+			struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+
+			update_devnum(udev, 0);
+			/* The xHC may think the device is already reset,
+			 * so ignore the status.
+			 */
+			if (hcd->driver->reset_device)
+				hcd->driver->reset_device(hcd, udev);
+
+			usb_set_device_state(udev, USB_STATE_DEFAULT);
+		}
+	} else {
+		if (udev)
+			usb_set_device_state(udev, USB_STATE_NOTATTACHED);
+	}
+
 	if (!hub_is_superspeed(hub->hdev))
 		up_read(&ehci_cf_port_reset_rwsem);
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 098/267] USB: devio: fix a condition in async_completed()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 097/267] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Alan Stern

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 83ed07c5db71bc02bd646d6eb60b48908235cdf9 upstream.

Static checkers complain that the current condition is never true.  It
seems pretty likely that it's a typo and "URB" was intended instead of
"USB".

Fixes: 3d97ff63f899 ('usbdevfs: Use scatter-gather lists for large bulk transfers')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/devio.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -513,7 +513,7 @@ static void async_completed(struct urb *
 	snoop(&urb->dev->dev, "urb complete\n");
 	snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
 			as->status, COMPLETE, NULL, 0);
-	if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
+	if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
 		snoop_urb_data(urb, urb->actual_length);
 
 	if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 098/267] USB: devio: fix a condition in async_completed() Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-08-08  5:53   ` Alexander Holler
  2015-07-31 19:39 ` [PATCH 4.1 100/267] usb: phy: mxs: suspend to RAM causes NULL pointer dereference Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  244 siblings, 1 reply; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, NeilBrown, Kishon Vijay Abraham I

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neil@brown.name>

commit 4724e27114c4a7eceeee07db227a17fcab6f165c upstream.

The USB phy should initialize with power-off, and will be powered on
by the USB system when a cable connection is detected.

Having this pm_runtime_get_sync() during probe causes the phy to
*always* be powered on.
Removing it returns to sensible power management.

Fixes: 96be39ab34b77c6f6f5cd6ae03aac6c6449ee5c4
Signed-off-by: NeilBrown <neil@brown.name>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/phy/phy-twl4030-usb.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -711,7 +711,6 @@ static int twl4030_usb_probe(struct plat
 	pm_runtime_use_autosuspend(&pdev->dev);
 	pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
 	pm_runtime_enable(&pdev->dev);
-	pm_runtime_get_sync(&pdev->dev);
 
 	/* Our job is to use irqs and status from the power module
 	 * to keep the transceiver disabled when nothing's connected.



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 100/267] usb: phy: mxs: suspend to RAM causes NULL pointer dereference
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 101/267] phy: berlin-usb: fix divider for BG2CD Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Peter Chen, Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Wahren <stefan.wahren@i2se.com>

commit 543aa4867d4a2dff5fc11e1b688197ee3bad7f89 upstream.

Triggering suspend to RAM via sysfs on a i.MX28 causes a NULL pointer
dereference. This patch avoids the oops in mxs_phy_get_vbus_status()
by aborting since there is no syscon available.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Fixes: efdbd3a5d6e ("usb: phy: mxs: do not set PWD.RXPWD1PT1 for low speed connection")
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/phy/phy-mxs-usb.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -217,6 +217,9 @@ static bool mxs_phy_get_vbus_status(stru
 {
 	unsigned int vbus_value;
 
+	if (!mxs_phy->regmap_anatop)
+		return false;
+
 	if (mxs_phy->port_id == 0)
 		regmap_read(mxs_phy->regmap_anatop,
 			ANADIG_USB1_VBUS_DET_STAT,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 101/267] phy: berlin-usb: fix divider for BG2CD
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 100/267] usb: phy: mxs: suspend to RAM causes NULL pointer dereference Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 102/267] usb: gadget: composite: Fix NULL pointer dereference Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Hebb, Kishon Vijay Abraham I

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Hebb <tommyhebb@gmail.com>

commit 96696a9df935d15fd2e89603454c20a692ec232a upstream.

The marvell,berlin2cd-usb-phy compatible incorrectly sets the PLL
divider to BG2's value instead of BG2CD/BG2Q's. Change it to the right
value.

Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/phy/phy-berlin-usb.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/phy/phy-berlin-usb.c
+++ b/drivers/phy/phy-berlin-usb.c
@@ -106,8 +106,8 @@
 static const u32 phy_berlin_pll_dividers[] = {
 	/* Berlin 2 */
 	CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
-	/* Berlin 2CD */
-	CLK_REF_DIV(0x6) | FEEDBACK_CLK_DIV(0x55),
+	/* Berlin 2CD/Q */
+	CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
 };
 
 struct phy_berlin_usb_priv {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 102/267] usb: gadget: composite: Fix NULL pointer dereference
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 101/267] phy: berlin-usb: fix divider for BG2CD Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 103/267] usb: gadget: f_fs: do not set cancel function on synchronous {read,write} Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I, Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kishon Vijay Abraham I <kishon@ti.com>

commit b4c21f0bdd2c0cd5d5be1bb56f0a28dae5041eed upstream.

commit f563d230903210acc ("usb: gadget: composite: add req_match method
to usb_function") accesses cdev->config even before set config
is invoked causing a NULL pointer dereferencing error while running
Lecroy Mass Storage Compliance test.

Fix it here by accessing cdev->config only if it is non NULL.

Fixes: commit f563d230903210acc ("usb: gadget: composite: add req_match
method to usb_function").

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/composite.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1758,10 +1758,13 @@ unknown:
 		 * take such requests too, if that's ever needed:  to work
 		 * in config 0, etc.
 		 */
-		list_for_each_entry(f, &cdev->config->functions, list)
-			if (f->req_match && f->req_match(f, ctrl))
-				goto try_fun_setup;
-		f = NULL;
+		if (cdev->config) {
+			list_for_each_entry(f, &cdev->config->functions, list)
+				if (f->req_match && f->req_match(f, ctrl))
+					goto try_fun_setup;
+			f = NULL;
+		}
+
 		switch (ctrl->bRequestType & USB_RECIP_MASK) {
 		case USB_RECIP_INTERFACE:
 			if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 103/267] usb: gadget: f_fs: do not set cancel function on synchronous {read,write}
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 102/267] usb: gadget: composite: Fix NULL pointer dereference Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 104/267] usb: gadget: mv_udc_core: fix phy_regs I/O memory leak Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Al Viro, Rui Miguel Silva, Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rui Miguel Silva <rui.silva@linaro.org>

commit 4088acf1e845aba35f30fb91dee10649edbd0e84 upstream.

do not try to set cancel function in synchronous operations in
ffs_epfile_{read,write}_iter.

Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_fs.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -924,7 +924,8 @@ static ssize_t ffs_epfile_write_iter(str
 
 	kiocb->private = p;
 
-	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+	if (p->aio)
+		kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
 	res = ffs_epfile_io(kiocb->ki_filp, p);
 	if (res == -EIOCBQUEUED)
@@ -968,7 +969,8 @@ static ssize_t ffs_epfile_read_iter(stru
 
 	kiocb->private = p;
 
-	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+	if (p->aio)
+		kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
 	res = ffs_epfile_io(kiocb->ki_filp, p);
 	if (res == -EIOCBQUEUED)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 104/267] usb: gadget: mv_udc_core: fix phy_regs I/O memory leak
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 103/267] usb: gadget: f_fs: do not set cancel function on synchronous {read,write} Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 105/267] usb: f_mass_storage: limit number of reported LUNs Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexey Khoroshilov, Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Khoroshilov <khoroshilov@ispras.ru>

commit 53e20f2eb161fbe9eea28b54dccc870cec94eca2 upstream.

There was an omission in transition to devm_xxx resource handling.
iounmap(udc->phy_regs) were removed, but ioremap() was left
without devm_.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Fixes: 3517c31a8ece6 ("usb: gadget: mv_udc: use devm_xxx for probe")
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/udc/mv_udc_core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/gadget/udc/mv_udc_core.c
+++ b/drivers/usb/gadget/udc/mv_udc_core.c
@@ -2167,7 +2167,7 @@ static int mv_udc_probe(struct platform_
 		return -ENODEV;
 	}
 
-	udc->phy_regs = ioremap(r->start, resource_size(r));
+	udc->phy_regs = devm_ioremap(&pdev->dev, r->start, resource_size(r));
 	if (udc->phy_regs == NULL) {
 		dev_err(&pdev->dev, "failed to map phy I/O memory\n");
 		return -EBUSY;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 105/267] usb: f_mass_storage: limit number of reported LUNs
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 104/267] usb: gadget: mv_udc_core: fix phy_regs I/O memory leak Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 106/267] usb: musb: host: rely on port_mode to call musb_start() Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gregory CLEMENT, Michal Nazarewicz,
	Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Nazarewicz <mina86@mina86.com>

commit 8515bac01a983d277148e4fcc5f235bf603de577 upstream.

Mass storage function created via configfs always reports eight LUNs
to the hosts even if only one LUN has been configured.  Adjust the
number when the USB function is allocated based on LUNs that user
has created.

Tested-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_mass_storage.c |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -2786,7 +2786,7 @@ int fsg_common_set_nluns(struct fsg_comm
 		return -EINVAL;
 	}
 
-	curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL);
+	curlun = kcalloc(FSG_MAX_LUNS, sizeof(*curlun), GFP_KERNEL);
 	if (unlikely(!curlun))
 		return -ENOMEM;
 
@@ -2796,8 +2796,6 @@ int fsg_common_set_nluns(struct fsg_comm
 	common->luns = curlun;
 	common->nluns = nluns;
 
-	pr_info("Number of LUNs=%d\n", common->nluns);
-
 	return 0;
 }
 EXPORT_SYMBOL_GPL(fsg_common_set_nluns);
@@ -3563,14 +3561,26 @@ static struct usb_function *fsg_alloc(st
 	struct fsg_opts *opts = fsg_opts_from_func_inst(fi);
 	struct fsg_common *common = opts->common;
 	struct fsg_dev *fsg;
+	unsigned nluns, i;
 
 	fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
 	if (unlikely(!fsg))
 		return ERR_PTR(-ENOMEM);
 
 	mutex_lock(&opts->lock);
+	if (!opts->refcnt) {
+		for (nluns = i = 0; i < FSG_MAX_LUNS; ++i)
+			if (common->luns[i])
+				nluns = i + 1;
+		if (!nluns)
+			pr_warn("No LUNS defined, continuing anyway\n");
+		else
+			common->nluns = nluns;
+		pr_info("Number of LUNs=%u\n", common->nluns);
+	}
 	opts->refcnt++;
 	mutex_unlock(&opts->lock);
+
 	fsg->function.name	= FSG_DRIVER_DESC;
 	fsg->function.bind	= fsg_bind;
 	fsg->function.unbind	= fsg_unbind;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 106/267] usb: musb: host: rely on port_mode to call musb_start()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 105/267] usb: f_mass_storage: limit number of reported LUNs Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 107/267] USB: cp210x: add ID for Aruba Networks controllers Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Sekhar Nori, Felipe Balbi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Felipe Balbi <balbi@ti.com>

commit be9d39881fc4fa39a64b6eed6bab5d9ee5125344 upstream.

Currently, we're calling musb_start() twice for DRD ports
in some situations. This has been observed to cause enumeration
issues after suspend/resume cycles with AM335x.

In order to fix the problem, we just have to fix the check
on musb_has_gadget() so that it only returns true if
current mode is Host and ignore the fact that we have or
not a gadget driver loaded.

Fixes: ae44df2e21b5 (usb: musb: call musb_start() only once in OTG mode)
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Tested-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/musb/musb_virthub.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *
 #ifdef CONFIG_USB_MUSB_HOST
 	return 1;
 #else
-	if (musb->port_mode == MUSB_PORT_MODE_HOST)
-		return 1;
-	return musb->g.dev.driver != NULL;
+	return musb->port_mode == MUSB_PORT_MODE_HOST;
 #endif
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 107/267] USB: cp210x: add ID for Aruba Networks controllers
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 106/267] usb: musb: host: rely on port_mode to call musb_start() Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 108/267] USB: option: add 2020:4000 ID Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Sanford, Johan Hovold

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Sanford <peter@sanford.io>

commit f98a7aa81eeeadcad25665c3501c236d531d4382 upstream.

Add the USB serial console device ID for Aruba Networks 7xxx series
controllers which have a USB port for their serial console.

Signed-off-by: Peter Sanford <peter@sanford.io>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/cp210x.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -187,6 +187,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
 	{ USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
 	{ USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
+	{ USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
 	{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
 	{ USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
 	{ USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 108/267] USB: option: add 2020:4000 ID
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 107/267] USB: cp210x: add ID for Aruba Networks controllers Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 109/267] USB: serial: Destroy serial_minors IDR on module exit Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudio Cappelli, Lars Melin, Johan Hovold

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Claudio Cappelli <claudio.cappelli.linux@gmail.com>

commit f6d7fb37f92622479ef6da604f27561f5045ba1e upstream.

Add device Olivetti Olicard 300 (Network Connect: MT6225) - IDs 2020:4000.

T:  Bus=01 Lev=02 Prnt=04 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2020 ProdID=4000 Rev=03.00
S:  Manufacturer=Network Connect
S:  Product=MT6225
C:  #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option
I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage

Signed-off-by: Claudio Cappelli <claudio.cappelli.linux@gmail.com>
Suggested-by: Lars Melin <larsm17@gmail.com>
[johan: amend commit message with devices info ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/option.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1765,6 +1765,7 @@ static const struct usb_device_id option
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
 	{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
 	{ USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
 	{ } /* Terminating entry */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 109/267] USB: serial: Destroy serial_minors IDR on module exit
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 108/267] USB: option: add 2020:4000 ID Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 110/267] USB: OHCI: Fix race between ED unlink and URB submission Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Thumshirn, Johan Hovold

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Thumshirn <jthumshirn@suse.de>

commit d23f47d4927fd2f61b3a754d83c7bcec215b5cfe upstream.

Destroy serial_minors IDR on module exit, reclaiming the allocated memory.

This was detected by the following semantic patch (written by Luis
Rodriguez <mcgrof@suse.com>)

<SmPL>
@ defines_module_init @
declarer name module_init, module_exit;
declarer name DEFINE_IDR;
identifier init;
@@

module_init(init);

@ defines_module_exit @
identifier exit;
@@

module_exit(exit);

@ declares_idr depends on defines_module_init && defines_module_exit @
identifier idr;
@@

DEFINE_IDR(idr);

@ on_exit_calls_destroy depends on declares_idr && defines_module_exit @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 idr_destroy(&idr);
 ...
}

@ missing_module_idr_destroy depends on declares_idr && defines_module_exit && !on_exit_calls_destroy @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 +idr_destroy(&idr);
}
</SmPL>

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/usb-serial.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1306,6 +1306,7 @@ static void __exit usb_serial_exit(void)
 	tty_unregister_driver(usb_serial_tty_driver);
 	put_tty_driver(usb_serial_tty_driver);
 	bus_unregister(&usb_serial_bus_type);
+	idr_destroy(&serial_minors);
 }
 
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 110/267] USB: OHCI: Fix race between ED unlink and URB submission
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 109/267] USB: serial: Destroy serial_minors IDR on module exit Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 111/267] usb: core: lpm: set lpm_capable for root hub device Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Heiko Przybyl

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

commit 7d8021c967648accd1b78e5e1ddaad655cd2c61f upstream.

This patch fixes a bug introduced by commit 977dcfdc6031 ("USB: OHCI:
don't lose track of EDs when a controller dies").  The commit changed
ed_state from ED_UNLINK to ED_IDLE too early, before finish_urb() had
been called.  The user-visible consequence is that the driver
occasionally crashes or locks up when an URB is submitted while
another URB for the same endpoint is being unlinked.

This patch moves the ED state change later, to the right place.  The
drawback is that now we may unnecessarily execute some instructions
multiple times when a controller dies.  Since controllers dying is an
exceptional occurrence, a little wasted time won't matter.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Heiko Przybyl <lil_tux@web.de>
Tested-by: Heiko Przybyl <lil_tux@web.de>
Fixes: 977dcfdc60311e7aa571cabf6f39c36dde13339e
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/ohci-q.c |    7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -980,10 +980,6 @@ rescan_all:
 		int			completed, modified;
 		__hc32			*prev;
 
-		/* Is this ED already invisible to the hardware? */
-		if (ed->state == ED_IDLE)
-			goto ed_idle;
-
 		/* only take off EDs that the HC isn't using, accounting for
 		 * frame counter wraps and EDs with partially retired TDs
 		 */
@@ -1011,12 +1007,10 @@ skip_ed:
 		}
 
 		/* ED's now officially unlinked, hc doesn't see */
-		ed->state = ED_IDLE;
 		ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
 		ed->hwNextED = 0;
 		wmb();
 		ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE);
-ed_idle:
 
 		/* reentrancy:  if we drop the schedule lock, someone might
 		 * have modified this list.  normally it's just prepending
@@ -1087,6 +1081,7 @@ rescan_this:
 		if (list_empty(&ed->td_list)) {
 			*last = ed->ed_next;
 			ed->ed_next = NULL;
+			ed->state = ED_IDLE;
 			list_del(&ed->in_use_list);
 		} else if (ohci->rh_state == OHCI_RH_RUNNING) {
 			*last = ed->ed_next;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 111/267] usb: core: lpm: set lpm_capable for root hub device
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 110/267] USB: OHCI: Fix race between ED unlink and URB submission Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 112/267] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kevin Strasser, Lu Baolu, Alan Stern

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lu Baolu <baolu.lu@linux.intel.com>

commit 2d2a316765d956bc5cb6bb367b2ec52ca59ab8e9 upstream.

Commit 25cd2882e2fc ("usb/xhci: Change how we indicate a host supports
Link PM.") removed the code to set lpm_capable for USB 3.0 super-speed
root hub. The intention of that change was to avoid touching usb core
internal field, a.k.a. lpm_capable, and let usb core to set it by
checking U1 and U2 exit latency values in the descriptor.

Usb core checks and sets lpm_capable in hub_port_init(). Unfortunately,
root hub is a special usb device as it has no parent. Hub_port_init()
will never be called for a root hub device. That means lpm_capable will
by no means be set for the root hub. As the result, lpm isn't functional
at all in Linux kernel.

This patch add the code to check and set lpm_capable when registering a
root hub device. It could be back-ported to kernels as old as v3.15,
that contains the Commit 25cd2882e2fc ("usb/xhci: Change how we indicate
a host supports Link PM.").

Reported-by: Kevin Strasser <kevin.strasser@linux.intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/hcd.c |    7 +++++--
 drivers/usb/core/hub.c |    2 +-
 drivers/usb/core/usb.h |    1 +
 3 files changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1022,9 +1022,12 @@ static int register_root_hub(struct usb_
 				dev_name(&usb_dev->dev), retval);
 		return (retval < 0) ? retval : -EMSGSIZE;
 	}
-	if (usb_dev->speed == USB_SPEED_SUPER) {
+
+	if (le16_to_cpu(usb_dev->descriptor.bcdUSB) >= 0x0201) {
 		retval = usb_get_bos_descriptor(usb_dev);
-		if (retval < 0) {
+		if (!retval) {
+			usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
+		} else if (usb_dev->speed == USB_SPEED_SUPER) {
 			mutex_unlock(&usb_bus_list_lock);
 			dev_dbg(parent_dev, "can't read %s bos descriptor %d\n",
 					dev_name(&usb_dev->dev), retval);
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -122,7 +122,7 @@ struct usb_hub *usb_hub_to_struct_hub(st
 	return usb_get_intfdata(hdev->actconfig->interface[0]);
 }
 
-static int usb_device_supports_lpm(struct usb_device *udev)
+int usb_device_supports_lpm(struct usb_device *udev)
 {
 	/* USB 2.1 (and greater) devices indicate LPM support through
 	 * their USB 2.0 Extended Capabilities BOS descriptor.
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -65,6 +65,7 @@ extern int  usb_hub_init(void);
 extern void usb_hub_cleanup(void);
 extern int usb_major_init(void);
 extern void usb_major_cleanup(void);
+extern int usb_device_supports_lpm(struct usb_device *udev);
 
 #ifdef	CONFIG_PM
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 112/267] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 111/267] usb: core: lpm: set lpm_capable for root hub device Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 113/267] dm cache: fix race when issuing a POLICY_REPLACE operation Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aman Deep, Mathias Nyman

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AMAN DEEP <aman.deep@samsung.com>

commit 3496810663922617d4b706ef2780c279252ddd6a upstream.

virt_dev->num_cached_rings counts on freed ring and is not updated
correctly. In xhci_free_or_cache_endpoint_ring() function, the free ring
is added into cache and then num_rings_cache is incremented as below:
		virt_dev->ring_cache[rings_cached] =
			virt_dev->eps[ep_index].ring;
		virt_dev->num_rings_cached++;
here, free ring pointer is added to a current index and then
index is incremented.
So current index always points to empty location in the ring cache.
For getting available free ring, current index should be decremented
first and then corresponding ring buffer value should be taken from ring
cache.

But In function xhci_endpoint_init(), the num_rings_cached index is
accessed before decrement.
		virt_dev->eps[ep_index].new_ring =
			virt_dev->ring_cache[virt_dev->num_rings_cached];
		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
		virt_dev->num_rings_cached--;
This is bug in manipulating the index of ring cache.
And it should be as below:
		virt_dev->num_rings_cached--;
		virt_dev->eps[ep_index].new_ring =
			virt_dev->ring_cache[virt_dev->num_rings_cached];
		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;

Signed-off-by: Aman Deep <aman.deep@samsung.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci-mem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd *
 		/* Attempt to use the ring cache */
 		if (virt_dev->num_rings_cached == 0)
 			return -ENOMEM;
+		virt_dev->num_rings_cached--;
 		virt_dev->eps[ep_index].new_ring =
 			virt_dev->ring_cache[virt_dev->num_rings_cached];
 		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
-		virt_dev->num_rings_cached--;
 		xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
 					1, type);
 	}



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 113/267] dm cache: fix race when issuing a POLICY_REPLACE operation
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 112/267] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 114/267] dm stats: fix divide by zero if number_of_areas arg is zero Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joe Thornber <ejt@redhat.com>

commit fb4100ae7f312c3d614b37621c2b17b3b7cf65f8 upstream.

There is a race between a policy deciding to replace a cache entry,
the core target writing back any dirty data from this block, and other
IO threads doing IO to the same block.

This sort of problem is avoided most of the time by the core target
grabbing a bio prison cell before making the request to the policy.
But for a demotion the core target doesn't know which block will be
demoted, so can't do this in advance.

Fix this demotion race by introducing a callback to the policy interface
that allows the policy to grab the cell on behalf of the core target.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/dm-cache-policy-cleaner.c  |    3 +
 drivers/md/dm-cache-policy-internal.h |    5 +-
 drivers/md/dm-cache-policy-mq.c       |   41 ++++++++++++++++--------
 drivers/md/dm-cache-policy.h          |   15 ++++++++
 drivers/md/dm-cache-target.c          |   58 ++++++++++++++++++++++------------
 5 files changed, 85 insertions(+), 37 deletions(-)

--- a/drivers/md/dm-cache-policy-cleaner.c
+++ b/drivers/md/dm-cache-policy-cleaner.c
@@ -171,7 +171,8 @@ static void remove_cache_hash_entry(stru
 /* Public interface (see dm-cache-policy.h */
 static int wb_map(struct dm_cache_policy *pe, dm_oblock_t oblock,
 		  bool can_block, bool can_migrate, bool discarded_oblock,
-		  struct bio *bio, struct policy_result *result)
+		  struct bio *bio, struct policy_locker *locker,
+		  struct policy_result *result)
 {
 	struct policy *p = to_policy(pe);
 	struct wb_cache_entry *e;
--- a/drivers/md/dm-cache-policy-internal.h
+++ b/drivers/md/dm-cache-policy-internal.h
@@ -16,9 +16,10 @@
  */
 static inline int policy_map(struct dm_cache_policy *p, dm_oblock_t oblock,
 			     bool can_block, bool can_migrate, bool discarded_oblock,
-			     struct bio *bio, struct policy_result *result)
+			     struct bio *bio, struct policy_locker *locker,
+			     struct policy_result *result)
 {
-	return p->map(p, oblock, can_block, can_migrate, discarded_oblock, bio, result);
+	return p->map(p, oblock, can_block, can_migrate, discarded_oblock, bio, locker, result);
 }
 
 static inline int policy_lookup(struct dm_cache_policy *p, dm_oblock_t oblock, dm_cblock_t *cblock)
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -693,9 +693,10 @@ static void requeue(struct mq_policy *mq
  * - set the hit count to a hard coded value other than 1, eg, is it better
  *   if it goes in at level 2?
  */
-static int demote_cblock(struct mq_policy *mq, dm_oblock_t *oblock)
+static int demote_cblock(struct mq_policy *mq,
+			 struct policy_locker *locker, dm_oblock_t *oblock)
 {
-	struct entry *demoted = pop(mq, &mq->cache_clean);
+	struct entry *demoted = peek(&mq->cache_clean);
 
 	if (!demoted)
 		/*
@@ -707,6 +708,13 @@ static int demote_cblock(struct mq_polic
 		 */
 		return -ENOSPC;
 
+	if (locker->fn(locker, demoted->oblock))
+		/*
+		 * We couldn't lock the demoted block.
+		 */
+		return -EBUSY;
+
+	del(mq, demoted);
 	*oblock = demoted->oblock;
 	free_entry(&mq->cache_pool, demoted);
 
@@ -795,6 +803,7 @@ static int cache_entry_found(struct mq_p
  * finding which cache block to use.
  */
 static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e,
+			      struct policy_locker *locker,
 			      struct policy_result *result)
 {
 	int r;
@@ -803,11 +812,12 @@ static int pre_cache_to_cache(struct mq_
 	/* Ensure there's a free cblock in the cache */
 	if (epool_empty(&mq->cache_pool)) {
 		result->op = POLICY_REPLACE;
-		r = demote_cblock(mq, &result->old_oblock);
+		r = demote_cblock(mq, locker, &result->old_oblock);
 		if (r) {
 			result->op = POLICY_MISS;
 			return 0;
 		}
+
 	} else
 		result->op = POLICY_NEW;
 
@@ -829,7 +839,8 @@ static int pre_cache_to_cache(struct mq_
 
 static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e,
 				 bool can_migrate, bool discarded_oblock,
-				 int data_dir, struct policy_result *result)
+				 int data_dir, struct policy_locker *locker,
+				 struct policy_result *result)
 {
 	int r = 0;
 
@@ -842,7 +853,7 @@ static int pre_cache_entry_found(struct
 
 	else {
 		requeue(mq, e);
-		r = pre_cache_to_cache(mq, e, result);
+		r = pre_cache_to_cache(mq, e, locker, result);
 	}
 
 	return r;
@@ -872,6 +883,7 @@ static void insert_in_pre_cache(struct m
 }
 
 static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock,
+			    struct policy_locker *locker,
 			    struct policy_result *result)
 {
 	int r;
@@ -879,7 +891,7 @@ static void insert_in_cache(struct mq_po
 
 	if (epool_empty(&mq->cache_pool)) {
 		result->op = POLICY_REPLACE;
-		r = demote_cblock(mq, &result->old_oblock);
+		r = demote_cblock(mq, locker, &result->old_oblock);
 		if (unlikely(r)) {
 			result->op = POLICY_MISS;
 			insert_in_pre_cache(mq, oblock);
@@ -907,11 +919,12 @@ static void insert_in_cache(struct mq_po
 
 static int no_entry_found(struct mq_policy *mq, dm_oblock_t oblock,
 			  bool can_migrate, bool discarded_oblock,
-			  int data_dir, struct policy_result *result)
+			  int data_dir, struct policy_locker *locker,
+			  struct policy_result *result)
 {
 	if (adjusted_promote_threshold(mq, discarded_oblock, data_dir) <= 1) {
 		if (can_migrate)
-			insert_in_cache(mq, oblock, result);
+			insert_in_cache(mq, oblock, locker, result);
 		else
 			return -EWOULDBLOCK;
 	} else {
@@ -928,7 +941,8 @@ static int no_entry_found(struct mq_poli
  */
 static int map(struct mq_policy *mq, dm_oblock_t oblock,
 	       bool can_migrate, bool discarded_oblock,
-	       int data_dir, struct policy_result *result)
+	       int data_dir, struct policy_locker *locker,
+	       struct policy_result *result)
 {
 	int r = 0;
 	struct entry *e = hash_lookup(mq, oblock);
@@ -942,11 +956,11 @@ static int map(struct mq_policy *mq, dm_
 
 	else if (e)
 		r = pre_cache_entry_found(mq, e, can_migrate, discarded_oblock,
-					  data_dir, result);
+					  data_dir, locker, result);
 
 	else
 		r = no_entry_found(mq, oblock, can_migrate, discarded_oblock,
-				   data_dir, result);
+				   data_dir, locker, result);
 
 	if (r == -EWOULDBLOCK)
 		result->op = POLICY_MISS;
@@ -1012,7 +1026,8 @@ static void copy_tick(struct mq_policy *
 
 static int mq_map(struct dm_cache_policy *p, dm_oblock_t oblock,
 		  bool can_block, bool can_migrate, bool discarded_oblock,
-		  struct bio *bio, struct policy_result *result)
+		  struct bio *bio, struct policy_locker *locker,
+		  struct policy_result *result)
 {
 	int r;
 	struct mq_policy *mq = to_mq_policy(p);
@@ -1028,7 +1043,7 @@ static int mq_map(struct dm_cache_policy
 
 	iot_examine_bio(&mq->tracker, bio);
 	r = map(mq, oblock, can_migrate, discarded_oblock,
-		bio_data_dir(bio), result);
+		bio_data_dir(bio), locker, result);
 
 	mutex_unlock(&mq->lock);
 
--- a/drivers/md/dm-cache-policy.h
+++ b/drivers/md/dm-cache-policy.h
@@ -70,6 +70,18 @@ enum policy_operation {
 };
 
 /*
+ * When issuing a POLICY_REPLACE the policy needs to make a callback to
+ * lock the block being demoted.  This doesn't need to occur during a
+ * writeback operation since the block remains in the cache.
+ */
+struct policy_locker;
+typedef int (*policy_lock_fn)(struct policy_locker *l, dm_oblock_t oblock);
+
+struct policy_locker {
+	policy_lock_fn fn;
+};
+
+/*
  * This is the instruction passed back to the core target.
  */
 struct policy_result {
@@ -122,7 +134,8 @@ struct dm_cache_policy {
 	 */
 	int (*map)(struct dm_cache_policy *p, dm_oblock_t oblock,
 		   bool can_block, bool can_migrate, bool discarded_oblock,
-		   struct bio *bio, struct policy_result *result);
+		   struct bio *bio, struct policy_locker *locker,
+		   struct policy_result *result);
 
 	/*
 	 * Sometimes we want to see if a block is in the cache, without
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -1445,16 +1445,43 @@ static void inc_miss_counter(struct cach
 		   &cache->stats.read_miss : &cache->stats.write_miss);
 }
 
+/*----------------------------------------------------------------*/
+
+struct old_oblock_lock {
+	struct policy_locker locker;
+	struct cache *cache;
+	struct prealloc *structs;
+	struct dm_bio_prison_cell *cell;
+};
+
+static int null_locker(struct policy_locker *locker, dm_oblock_t b)
+{
+	/* This should never be called */
+	BUG();
+	return 0;
+}
+
+static int cell_locker(struct policy_locker *locker, dm_oblock_t b)
+{
+	struct old_oblock_lock *l = container_of(locker, struct old_oblock_lock, locker);
+	struct dm_bio_prison_cell *cell_prealloc = prealloc_get_cell(l->structs);
+
+	return bio_detain(l->cache, b, NULL, cell_prealloc,
+			  (cell_free_fn) prealloc_put_cell,
+			  l->structs, &l->cell);
+}
+
 static void process_bio(struct cache *cache, struct prealloc *structs,
 			struct bio *bio)
 {
 	int r;
 	bool release_cell = true;
 	dm_oblock_t block = get_bio_block(cache, bio);
-	struct dm_bio_prison_cell *cell_prealloc, *old_ocell, *new_ocell;
+	struct dm_bio_prison_cell *cell_prealloc, *new_ocell;
 	struct policy_result lookup_result;
 	bool passthrough = passthrough_mode(&cache->features);
 	bool discarded_block, can_migrate;
+	struct old_oblock_lock ool;
 
 	/*
 	 * Check to see if that block is currently migrating.
@@ -1469,8 +1496,12 @@ static void process_bio(struct cache *ca
 	discarded_block = is_discarded_oblock(cache, block);
 	can_migrate = !passthrough && (discarded_block || spare_migration_bandwidth(cache));
 
+	ool.locker.fn = cell_locker;
+	ool.cache = cache;
+	ool.structs = structs;
+	ool.cell = NULL;
 	r = policy_map(cache->policy, block, true, can_migrate, discarded_block,
-		       bio, &lookup_result);
+		       bio, &ool.locker, &lookup_result);
 
 	if (r == -EWOULDBLOCK)
 		/* migration has been denied */
@@ -1527,27 +1558,11 @@ static void process_bio(struct cache *ca
 		break;
 
 	case POLICY_REPLACE:
-		cell_prealloc = prealloc_get_cell(structs);
-		r = bio_detain(cache, lookup_result.old_oblock, bio, cell_prealloc,
-			       (cell_free_fn) prealloc_put_cell,
-			       structs, &old_ocell);
-		if (r > 0) {
-			/*
-			 * We have to be careful to avoid lock inversion of
-			 * the cells.  So we back off, and wait for the
-			 * old_ocell to become free.
-			 */
-			policy_force_mapping(cache->policy, block,
-					     lookup_result.old_oblock);
-			atomic_inc(&cache->stats.cache_cell_clash);
-			break;
-		}
 		atomic_inc(&cache->stats.demotion);
 		atomic_inc(&cache->stats.promotion);
-
 		demote_then_promote(cache, structs, lookup_result.old_oblock,
 				    block, lookup_result.cblock,
-				    old_ocell, new_ocell);
+				    ool.cell, new_ocell);
 		release_cell = false;
 		break;
 
@@ -2595,6 +2610,9 @@ static int __cache_map(struct cache *cac
 	bool discarded_block;
 	struct policy_result lookup_result;
 	struct per_bio_data *pb = init_per_bio_data(bio, pb_data_size);
+	struct old_oblock_lock ool;
+
+	ool.locker.fn = null_locker;
 
 	if (unlikely(from_oblock(block) >= from_oblock(cache->origin_blocks))) {
 		/*
@@ -2633,7 +2651,7 @@ static int __cache_map(struct cache *cac
 	discarded_block = is_discarded_oblock(cache, block);
 
 	r = policy_map(cache->policy, block, false, can_migrate, discarded_block,
-		       bio, &lookup_result);
+		       bio, &ool.locker, &lookup_result);
 	if (r == -EWOULDBLOCK) {
 		cell_defer(cache, *cell, true);
 		return DM_MAPIO_SUBMITTED;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 114/267] dm stats: fix divide by zero if number_of_areas arg is zero
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 113/267] dm cache: fix race when issuing a POLICY_REPLACE operation Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 115/267] dm space map metadata: fix occasional leak of a metadata block on resize Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mikulas Patocka <mpatocka@redhat.com>

commit dd4c1b7d0c95be1c9245118a3accc41a16f1db67 upstream.

If the number_of_areas argument was zero the kernel would crash on
div-by-zero.  Add better input validation.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/dm-stats.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -795,6 +795,8 @@ static int message_stats_create(struct m
 		return -EINVAL;
 
 	if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) {
+		if (!divisor)
+			return -EINVAL;
 		step = end - start;
 		if (do_div(step, divisor))
 			step++;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 115/267] dm space map metadata: fix occasional leak of a metadata block on resize
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 114/267] dm stats: fix divide by zero if number_of_areas arg is zero Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 116/267] dm btree remove: fix bug in redistribute3 Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joe Thornber <ejt@redhat.com>

commit 6096d91af0b65a3967139b32d5adbb3647858a26 upstream.

The metadata space map has a simplified 'bootstrap' mode that is
operational when extending the space maps.  Whilst in this mode it's
possible for some refcount decrement operations to become queued (eg, as
a result of shadowing one of the bitmap indexes).  These decrements were
not being applied when switching out of bootstrap mode.

The effect of this bug was the leaking of a 4k metadata block.  This is
detected by the latest version of thin_check as a non fatal error.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/persistent-data/dm-space-map-metadata.c |   50 ++++++++++++++-------
 1 file changed, 35 insertions(+), 15 deletions(-)

--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
 	smm->recursion_count++;
 }
 
+static int apply_bops(struct sm_metadata *smm)
+{
+	int r = 0;
+
+	while (!brb_empty(&smm->uncommitted)) {
+		struct block_op bop;
+
+		r = brb_pop(&smm->uncommitted, &bop);
+		if (r) {
+			DMERR("bug in bop ring buffer");
+			break;
+		}
+
+		r = commit_bop(smm, &bop);
+		if (r)
+			break;
+	}
+
+	return r;
+}
+
 static int out(struct sm_metadata *smm)
 {
 	int r = 0;
@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
 		return -ENOMEM;
 	}
 
-	if (smm->recursion_count == 1) {
-		while (!brb_empty(&smm->uncommitted)) {
-			struct block_op bop;
-
-			r = brb_pop(&smm->uncommitted, &bop);
-			if (r) {
-				DMERR("bug in bop ring buffer");
-				break;
-			}
-
-			r = commit_bop(smm, &bop);
-			if (r)
-				break;
-		}
-	}
+	if (smm->recursion_count == 1)
+		apply_bops(smm);
 
 	smm->recursion_count--;
 
@@ -704,6 +712,12 @@ static int sm_metadata_extend(struct dm_
 		}
 		old_len = smm->begin;
 
+		r = apply_bops(smm);
+		if (r) {
+			DMERR("%s: apply_bops failed", __func__);
+			goto out;
+		}
+
 		r = sm_ll_commit(&smm->ll);
 		if (r)
 			goto out;
@@ -773,6 +787,12 @@ int dm_sm_metadata_create(struct dm_spac
 	if (r)
 		return r;
 
+	r = apply_bops(smm);
+	if (r) {
+		DMERR("%s: apply_bops failed", __func__);
+		return r;
+	}
+
 	return sm_metadata_commit(sm);
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 116/267] dm btree remove: fix bug in redistribute3
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 115/267] dm space map metadata: fix occasional leak of a metadata block on resize Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 117/267] dm thin: allocate the cell_sort_array dynamically Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dennis Yang, Joe Thornber, Mike Snitzer

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dennis Yang <shinrairis@gmail.com>

commit 4c7e309340ff85072e96f529582d159002c36734 upstream.

redistribute3() shares entries out across 3 nodes.  Some entries were
being moved the wrong way, breaking the ordering.  This manifested as a
BUG() in dm-btree-remove.c:shift() when entries were removed from the
btree.

For additional context see:
https://www.redhat.com/archives/dm-devel/2015-May/msg00113.html

Signed-off-by: Dennis Yang <shinrairis@gmail.com>
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/persistent-data/dm-btree-remove.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btre
 
 		if (s < 0 && nr_center < -s) {
 			/* not enough in central node */
-			shift(left, center, nr_center);
-			s = nr_center - target;
+			shift(left, center, -nr_center);
+			s += nr_center;
 			shift(left, right, s);
 			nr_right += s;
 		} else
@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btre
 		if (s > 0 && nr_center < s) {
 			/* not enough in central node */
 			shift(center, right, nr_center);
-			s = target - nr_center;
+			s -= nr_center;
 			shift(left, right, s);
 			nr_left -= s;
 		} else



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 117/267] dm thin: allocate the cell_sort_array dynamically
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 116/267] dm btree remove: fix bug in redistribute3 Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 118/267] dm btree: silence lockdep lock inversion in dm_btree_del() Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joe Thornber <ejt@redhat.com>

commit a822c83e47d97cdef38c4352e1ef62d9f46cfe98 upstream.

Given the pool's cell_sort_array holds 8192 pointers it triggers an
order 5 allocation via kmalloc.  This order 5 allocation is prone to
failure as system memory gets more fragmented over time.

Fix this by allocating the cell_sort_array using vmalloc.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/dm-thin.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -18,6 +18,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <linux/sort.h>
 #include <linux/rbtree.h>
 
@@ -260,7 +261,7 @@ struct pool {
 	process_mapping_fn process_prepared_mapping;
 	process_mapping_fn process_prepared_discard;
 
-	struct dm_bio_prison_cell *cell_sort_array[CELL_SORT_ARRAY_SIZE];
+	struct dm_bio_prison_cell **cell_sort_array;
 };
 
 static enum pool_mode get_pool_mode(struct pool *pool);
@@ -2499,6 +2500,7 @@ static void __pool_destroy(struct pool *
 {
 	__pool_table_remove(pool);
 
+	vfree(pool->cell_sort_array);
 	if (dm_pool_metadata_close(pool->pmd) < 0)
 		DMWARN("%s: dm_pool_metadata_close() failed.", __func__);
 
@@ -2611,6 +2613,13 @@ static struct pool *pool_create(struct m
 		goto bad_mapping_pool;
 	}
 
+	pool->cell_sort_array = vmalloc(sizeof(*pool->cell_sort_array) * CELL_SORT_ARRAY_SIZE);
+	if (!pool->cell_sort_array) {
+		*error = "Error allocating cell sort array";
+		err_p = ERR_PTR(-ENOMEM);
+		goto bad_sort_array;
+	}
+
 	pool->ref_count = 1;
 	pool->last_commit_jiffies = jiffies;
 	pool->pool_md = pool_md;
@@ -2619,6 +2628,8 @@ static struct pool *pool_create(struct m
 
 	return pool;
 
+bad_sort_array:
+	mempool_destroy(pool->mapping_pool);
 bad_mapping_pool:
 	dm_deferred_set_destroy(pool->all_io_ds);
 bad_all_io_ds:



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 118/267] dm btree: silence lockdep lock inversion in dm_btree_del()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 117/267] dm thin: allocate the cell_sort_array dynamically Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 119/267] mmc: block: Add missing mmc_blk_put() in power_ro_lock_show() Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joe Thornber <ejt@redhat.com>

commit 1c7518794a3647eb345d59ee52844e8a40405198 upstream.

Allocate memory using GFP_NOIO when deleting a btree.  dm_btree_del()
can be called via an ioctl and we don't want to recurse into the FS or
block layer.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/persistent-data/dm-btree.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *i
 	int r;
 	struct del_stack *s;
 
-	s = kmalloc(sizeof(*s), GFP_KERNEL);
+	s = kmalloc(sizeof(*s), GFP_NOIO);
 	if (!s)
 		return -ENOMEM;
 	s->info = info;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 119/267] mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 118/267] dm btree: silence lockdep lock inversion in dm_btree_del() Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 120/267] block: loop: convert to per-device workqueue Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tomas Winkler, Ulf Hansson

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tomas Winkler <tomas.winkler@intel.com>

commit 9098f84cced870f54d8c410dd2444cfa61467fa0 upstream.

Enclosing mmc_blk_put() is missing in power_ro_lock_show() sysfs handler,
let's add it.

Fixes: add710eaa886 ("mmc: boot partition ro lock support")
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/card/block.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -208,6 +208,8 @@ static ssize_t power_ro_lock_show(struct
 
 	ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
 
+	mmc_blk_put(md);
+
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 120/267] block: loop: convert to per-device workqueue
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 119/267] mmc: block: Add missing mmc_blk_put() in power_ro_lock_show() Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 121/267] block: loop: avoiding too many pending per work I/O Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Justin M. Forbes, Ming Lei,
	Tejun Heo, Jens Axboe

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ming Lei <ming.lei@canonical.com>

commit f4aa4c7bbac6c4afdd4adccf90898c1a3685396d upstream.

Documentation/workqueue.txt:
	If there is dependency among multiple work items used
	during memory reclaim, they should be queued to separate
	wq each with WQ_MEM_RECLAIM.

Loop devices can be stacked, so we have to convert to per-device
workqueue. One example is Fedora live CD.

Fixes: b5dd2f6047ca108001328aac0e8588edd15f1778
Cc: Justin M. Forbes <jforbes@fedoraproject.org>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/loop.c |   30 ++++++++++++++----------------
 drivers/block/loop.h |    1 +
 2 files changed, 15 insertions(+), 16 deletions(-)

--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -86,8 +86,6 @@ static DEFINE_MUTEX(loop_index_mutex);
 static int max_part;
 static int part_shift;
 
-static struct workqueue_struct *loop_wq;
-
 static int transfer_xor(struct loop_device *lo, int cmd,
 			struct page *raw_page, unsigned raw_off,
 			struct page *loop_page, unsigned loop_off,
@@ -725,6 +723,12 @@ static int loop_set_fd(struct loop_devic
 	size = get_loop_size(lo, file);
 	if ((loff_t)(sector_t)size != size)
 		goto out_putf;
+	error = -ENOMEM;
+	lo->wq = alloc_workqueue("kloopd%d",
+			WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 0,
+			lo->lo_number);
+	if (!lo->wq)
+		goto out_putf;
 
 	error = 0;
 
@@ -872,6 +876,8 @@ static int loop_clr_fd(struct loop_devic
 	lo->lo_flags = 0;
 	if (!part_shift)
 		lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
+	destroy_workqueue(lo->wq);
+	lo->wq = NULL;
 	mutex_unlock(&lo->lo_ctl_mutex);
 	/*
 	 * Need not hold lo_ctl_mutex to fput backing file.
@@ -1425,9 +1431,13 @@ static int loop_queue_rq(struct blk_mq_h
 		const struct blk_mq_queue_data *bd)
 {
 	struct loop_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
+	struct loop_device *lo = cmd->rq->q->queuedata;
 
 	blk_mq_start_request(bd->rq);
 
+	if (lo->lo_state != Lo_bound)
+		return -EIO;
+
 	if (cmd->rq->cmd_flags & REQ_WRITE) {
 		struct loop_device *lo = cmd->rq->q->queuedata;
 		bool need_sched = true;
@@ -1441,9 +1451,9 @@ static int loop_queue_rq(struct blk_mq_h
 		spin_unlock_irq(&lo->lo_lock);
 
 		if (need_sched)
-			queue_work(loop_wq, &lo->write_work);
+			queue_work(lo->wq, &lo->write_work);
 	} else {
-		queue_work(loop_wq, &cmd->read_work);
+		queue_work(lo->wq, &cmd->read_work);
 	}
 
 	return BLK_MQ_RQ_QUEUE_OK;
@@ -1455,9 +1465,6 @@ static void loop_handle_cmd(struct loop_
 	struct loop_device *lo = cmd->rq->q->queuedata;
 	int ret = -EIO;
 
-	if (lo->lo_state != Lo_bound)
-		goto failed;
-
 	if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY))
 		goto failed;
 
@@ -1806,13 +1813,6 @@ static int __init loop_init(void)
 		goto misc_out;
 	}
 
-	loop_wq = alloc_workqueue("kloopd",
-			WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 0);
-	if (!loop_wq) {
-		err = -ENOMEM;
-		goto misc_out;
-	}
-
 	blk_register_region(MKDEV(LOOP_MAJOR, 0), range,
 				  THIS_MODULE, loop_probe, NULL, NULL);
 
@@ -1850,8 +1850,6 @@ static void __exit loop_exit(void)
 	blk_unregister_region(MKDEV(LOOP_MAJOR, 0), range);
 	unregister_blkdev(LOOP_MAJOR, "loop");
 
-	destroy_workqueue(loop_wq);
-
 	misc_deregister(&loop_misc);
 }
 
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -54,6 +54,7 @@ struct loop_device {
 	gfp_t		old_gfp_mask;
 
 	spinlock_t		lo_lock;
+	struct workqueue_struct *wq;
 	struct list_head	write_cmd_head;
 	struct work_struct	write_work;
 	bool			write_started;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 121/267] block: loop: avoiding too many pending per work I/O
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 120/267] block: loop: convert to per-device workqueue Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 122/267] block: Do a full clone when splitting discard bios Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Justin M. Forbes, Ming Lei,
	Tejun Heo, Jens Axboe

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ming Lei <ming.lei@canonical.com>

commit 4d4e41aef9429872ea3b105e83426941f7185ab6 upstream.

If there are too many pending per work I/O, too many
high priority work thread can be generated so that
system performance can be effected.

This patch limits the max_active parameter of workqueue as 16.

This patch fixes Fedora 22 live booting performance
regression when it is booted from squashfs over dm
based on loop, and looks the following reasons are
related with the problem:

- not like other filesyststems(such as ext4), squashfs
is a bit special, and I observed that increasing I/O jobs
to access file in squashfs only improve I/O performance a
little, but it can make big difference for ext4

- nested loop: both squashfs.img and ext3fs.img are mounted
as loop block, and ext3fs.img is inside the squashfs

- during booting, lots of tasks may run concurrently

Fixes: b5dd2f6047ca108001328aac0e8588edd15f1778
Cc: Justin M. Forbes <jforbes@fedoraproject.org>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/loop.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -725,7 +725,7 @@ static int loop_set_fd(struct loop_devic
 		goto out_putf;
 	error = -ENOMEM;
 	lo->wq = alloc_workqueue("kloopd%d",
-			WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 0,
+			WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 16,
 			lo->lo_number);
 	if (!lo->wq)
 		goto out_putf;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 122/267] block: Do a full clone when splitting discard bios
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 121/267] block: loop: avoiding too many pending per work I/O Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 123/267] ARM: at91/dt: sama5d4ek: mci0 uses slot 0 Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin K. Petersen, Seunguk Shin,
	Jens Axboe, Kent Overstreet, Christoph Hellwig

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Martin K. Petersen" <martin.petersen@oracle.com>

commit f3f5da624e0a891c34d8cd513c57f1d9b0c7dadc upstream.

This fixes a data corruption bug when using discard on top of MD linear,
raid0 and raid10 personalities.

Commit 20d0189b1012 "block: Introduce new bio_split()" permits sharing
the bio_vec between the two resulting bios. That is fine for read/write
requests where the bio_vec is immutable. For discards, however, we need
to be able to attach a payload and update the bio_vec so the page can
get mapped to a scatterlist entry. Therefore the bio_vec can not be
shared when splitting discards and we must do a full clone.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Reported-by: Seunguk Shin <seunguk.shin@samsung.com>
Tested-by: Seunguk Shin <seunguk.shin@samsung.com>
Cc: Seunguk Shin <seunguk.shin@samsung.com>
Cc: Jens Axboe <axboe@fb.com>
Cc: Kent Overstreet <kent.overstreet@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 block/bio.c |   15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

--- a/block/bio.c
+++ b/block/bio.c
@@ -1814,8 +1814,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
  * Allocates and returns a new bio which represents @sectors from the start of
  * @bio, and updates @bio to represent the remaining sectors.
  *
- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
- * responsibility to ensure that @bio is not freed before the split.
+ * Unless this is a discard request the newly allocated bio will point
+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
+ * @bio is not freed before the split.
  */
 struct bio *bio_split(struct bio *bio, int sectors,
 		      gfp_t gfp, struct bio_set *bs)
@@ -1825,7 +1826,15 @@ struct bio *bio_split(struct bio *bio, i
 	BUG_ON(sectors <= 0);
 	BUG_ON(sectors >= bio_sectors(bio));
 
-	split = bio_clone_fast(bio, gfp, bs);
+	/*
+	 * Discards need a mutable bio_vec to accommodate the payload
+	 * required by the DSM TRIM and UNMAP commands.
+	 */
+	if (bio->bi_rw & REQ_DISCARD)
+		split = bio_clone_bioset(bio, gfp, bs);
+	else
+		split = bio_clone_fast(bio, gfp, bs);
+
 	if (!split)
 		return NULL;
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 123/267] ARM: at91/dt: sama5d4ek: mci0 uses slot 0
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 122/267] block: Do a full clone when splitting discard bios Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 124/267] ARM: at91/dt: sama5d4: fix dma conf for aes, sha and tdes nodes Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ludovic Desroches, Nicolas Ferre

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ludovic Desroches <ludovic.desroches@atmel.com>

commit ea25525ce0d195724fead07fe6562fe478a3bf6f upstream.

Mci0 uses slot 0 not 1.

Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Fixes: 7a4752677c44 ("ARM: at91: dt: add device tree file for SAMA5D4ek board")
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/at91-sama5d4ek.dts |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm/boot/dts/at91-sama5d4ek.dts
+++ b/arch/arm/boot/dts/at91-sama5d4ek.dts
@@ -108,8 +108,8 @@
 			mmc0: mmc@f8000000 {
 				pinctrl-names = "default";
 				pinctrl-0 = <&pinctrl_mmc0_clk_cmd_dat0 &pinctrl_mmc0_dat1_3 &pinctrl_mmc0_cd>;
-				slot@1 {
-					reg = <1>;
+				slot@0 {
+					reg = <0>;
 					bus-width = <4>;
 					cd-gpios = <&pioE 5 0>;
 				};



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 124/267] ARM: at91/dt: sama5d4: fix dma conf for aes, sha and tdes nodes
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 123/267] ARM: at91/dt: sama5d4ek: mci0 uses slot 0 Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 126/267] ARM: at91/dt: trivial: fix USB udc compatible string Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ludovic Desroches, Nicolas Ferre,
	Kevin Hilman

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "ludovic.desroches@atmel.com" <ludovic.desroches@atmel.com>

commit aabbe8f1a561dd8318e693830d9ae377c9a04d2b upstream.

The xdmac channel configuration is done in one cell not two. This error
prevents from probing devices correctly.

Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Fixes: 83906783b766 ("ARM: at91/dt: sama5d4: add aes, sha and tdes nodes")
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Kevin Hilman <khilman@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/sama5d4.dtsi |   20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

--- a/arch/arm/boot/dts/sama5d4.dtsi
+++ b/arch/arm/boot/dts/sama5d4.dtsi
@@ -1125,10 +1125,10 @@
 				compatible = "atmel,at91sam9g46-aes";
 				reg = <0xfc044000 0x100>;
 				interrupts = <12 IRQ_TYPE_LEVEL_HIGH 0>;
-				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-					AT91_XDMAC_DT_PERID(41)>,
-				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-					AT91_XDMAC_DT_PERID(40)>;
+				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
+					| AT91_XDMAC_DT_PERID(41))>,
+				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
+					| AT91_XDMAC_DT_PERID(40))>;
 				dma-names = "tx", "rx";
 				clocks = <&aes_clk>;
 				clock-names = "aes_clk";
@@ -1139,10 +1139,10 @@
 				compatible = "atmel,at91sam9g46-tdes";
 				reg = <0xfc04c000 0x100>;
 				interrupts = <14 IRQ_TYPE_LEVEL_HIGH 0>;
-				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-					AT91_XDMAC_DT_PERID(42)>,
-				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-					AT91_XDMAC_DT_PERID(43)>;
+				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
+					| AT91_XDMAC_DT_PERID(42))>,
+				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
+					| AT91_XDMAC_DT_PERID(43))>;
 				dma-names = "tx", "rx";
 				clocks = <&tdes_clk>;
 				clock-names = "tdes_clk";
@@ -1153,8 +1153,8 @@
 				compatible = "atmel,at91sam9g46-sha";
 				reg = <0xfc050000 0x100>;
 				interrupts = <15 IRQ_TYPE_LEVEL_HIGH 0>;
-				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-					AT91_XDMAC_DT_PERID(44)>;
+				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
+					| AT91_XDMAC_DT_PERID(44))>;
 				dma-names = "tx";
 				clocks = <&sha_clk>;
 				clock-names = "sha_clk";



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 126/267] ARM: at91/dt: trivial: fix USB udc compatible string
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 124/267] ARM: at91/dt: sama5d4: fix dma conf for aes, sha and tdes nodes Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 127/267] ARM: at91/dt: update udc compatible strings Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolas Ferre, Kevin Hilman

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Ferre <nicolas.ferre@atmel.com>

commit 50f0a44991516b5b9744ecb2c080c2ec6ad21b25 upstream.

To please checkpatch and the tiresome reader, add the "atmel," prefix to the
USB udc compatible string.

Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Kevin Hilman <khilman@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/devicetree/bindings/usb/atmel-usb.txt |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/Documentation/devicetree/bindings/usb/atmel-usb.txt
+++ b/Documentation/devicetree/bindings/usb/atmel-usb.txt
@@ -60,9 +60,9 @@ Atmel High-Speed USB device controller
 
 Required properties:
  - compatible: Should be one of the following
-	       "at91sam9rl-udc"
-	       "at91sam9g45-udc"
-	       "sama5d3-udc"
+	       "atmel,at91sam9rl-udc"
+	       "atmel,at91sam9g45-udc"
+	       "atmel,sama5d3-udc"
  - reg: Address and length of the register set for the device
  - interrupts: Should contain usba interrupt
  - ep childnode: To specify the number of endpoints and their properties.



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 127/267] ARM: at91/dt: update udc compatible strings
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 126/267] ARM: at91/dt: trivial: fix USB udc compatible string Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 128/267] bus: arm-ccn: Fix node->XP config conversion Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Alexandre Belloni,
	Bo Shen, Nicolas Ferre, Kevin Hilman

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Boris Brezillon <boris.brezillon@free-electrons.com>

commit 6540165cf41655810ee67b78f01537af022a636a upstream.

at91sam9g45, at91sam9x5 and sama5 SoCs should not use
"atmel,at91sam9rl-udc" for their USB device compatible property since
this compatible is attached to a specific hardware bug fix.

Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Tested-by: Bo Shen <voice.shen@atmel.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Kevin Hilman <khilman@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/at91sam9g45.dtsi |    2 +-
 arch/arm/boot/dts/at91sam9x5.dtsi  |    2 +-
 arch/arm/boot/dts/sama5d3.dtsi     |    2 +-
 arch/arm/boot/dts/sama5d4.dtsi     |    2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

--- a/arch/arm/boot/dts/at91sam9g45.dtsi
+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
@@ -1148,7 +1148,7 @@
 			usb2: gadget@fff78000 {
 				#address-cells = <1>;
 				#size-cells = <0>;
-				compatible = "atmel,at91sam9rl-udc";
+				compatible = "atmel,at91sam9g45-udc";
 				reg = <0x00600000 0x80000
 				       0xfff78000 0x400>;
 				interrupts = <27 IRQ_TYPE_LEVEL_HIGH 0>;
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -1062,7 +1062,7 @@
 			usb2: gadget@f803c000 {
 				#address-cells = <1>;
 				#size-cells = <0>;
-				compatible = "atmel,at91sam9rl-udc";
+				compatible = "atmel,at91sam9g45-udc";
 				reg = <0x00500000 0x80000
 				       0xf803c000 0x400>;
 				interrupts = <23 IRQ_TYPE_LEVEL_HIGH 0>;
--- a/arch/arm/boot/dts/sama5d3.dtsi
+++ b/arch/arm/boot/dts/sama5d3.dtsi
@@ -1321,7 +1321,7 @@
 		usb0: gadget@00500000 {
 			#address-cells = <1>;
 			#size-cells = <0>;
-			compatible = "atmel,at91sam9rl-udc";
+			compatible = "atmel,sama5d3-udc";
 			reg = <0x00500000 0x100000
 			       0xf8030000 0x4000>;
 			interrupts = <33 IRQ_TYPE_LEVEL_HIGH 2>;
--- a/arch/arm/boot/dts/sama5d4.dtsi
+++ b/arch/arm/boot/dts/sama5d4.dtsi
@@ -123,7 +123,7 @@
 		usb0: gadget@00400000 {
 			#address-cells = <1>;
 			#size-cells = <0>;
-			compatible = "atmel,at91sam9rl-udc";
+			compatible = "atmel,sama5d3-udc";
 			reg = <0x00400000 0x100000
 			       0xfc02c000 0x4000>;
 			interrupts = <47 IRQ_TYPE_LEVEL_HIGH 2>;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 128/267] bus: arm-ccn: Fix node->XP config conversion
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 127/267] ARM: at91/dt: update udc compatible strings Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 129/267] drm/vgem: Set unique to "vgem" Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pawel Moll

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pawel Moll <pawel.moll@arm.com>

commit a18f8e97fe69195823d7fb5c68a8d6565f39db4b upstream.

Events defined as watchpoints on nodes must have their config values
converted so that they apply to the respective node's XP. The
function setting new values was using wrong mask for the "port" field,
resulting in corrupted value. Fixed now.

Signed-off-by: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bus/arm-ccn.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -212,7 +212,7 @@ static int arm_ccn_node_to_xp_port(int n
 
 static void arm_ccn_pmu_config_set(u64 *config, u32 node_xp, u32 type, u32 port)
 {
-	*config &= ~((0xff << 0) | (0xff << 8) | (0xff << 24));
+	*config &= ~((0xff << 0) | (0xff << 8) | (0x3 << 24));
 	*config |= (node_xp << 0) | (type << 8) | (port << 24);
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 129/267] drm/vgem: Set unique to "vgem"
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 128/267] bus: arm-ccn: Fix node->XP config conversion Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 130/267] drm/dp/mst: close deadlock in connector destruction Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabio Coatti, Daniel Vetter, Dave Airlie

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Vetter <daniel.vetter@ffwll.ch>

commit fa2f97dd33c2c32a06a5ea7f6e87af06a2e26baa upstream.

Since there's only one global instance ever we don't need to have
anything fancy. Stops a WARNING in the get_unique ioctl that the
unique name isn't set.

Reportedy-and-tested-by: Fabio Coatti <fabio.coatti@gmail.com>
Cc: Fabio Coatti <fabio.coatti@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/vgem/vgem_drv.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/gpu/drm/vgem/vgem_drv.c
+++ b/drivers/gpu/drm/vgem/vgem_drv.c
@@ -328,6 +328,8 @@ static int __init vgem_init(void)
 		goto out;
 	}
 
+	drm_dev_set_unique(vgem_device, "vgem");
+
 	ret  = drm_dev_register(vgem_device, 0);
 
 	if (ret)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 130/267] drm/dp/mst: close deadlock in connector destruction.
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 129/267] drm/vgem: Set unique to "vgem" Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 131/267] drm/dp/mst: take lock around looking up the branch device on hpd irq Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Dave Airlie

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Airlie <airlied@redhat.com>

commit 6b8eeca65b18ae77e175cc2b6571731f0ee413bf upstream.

I've only seen this once, and I failed to capture the
lockdep backtrace, but I did some investigations.

If we are calling into the MST layer from EDID probing,
we have the mode_config mutex held, if during that EDID
probing, the MST hub goes away, then we can get a deadlock
where the connector destruction function in the driver
tries to retake the mode config mutex.

This offloads connector destruction to a workqueue,
and avoid the subsequenct lock ordering issue.

Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_dp_mst_topology.c |   40 ++++++++++++++++++++++++++++++++--
 include/drm/drm_crtc.h                |    2 +
 include/drm/drm_dp_mst_helper.h       |    4 +++
 3 files changed, 44 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -867,8 +867,16 @@ static void drm_dp_destroy_port(struct k
 		port->vcpi.num_slots = 0;
 
 		kfree(port->cached_edid);
-		if (port->connector)
-			(*port->mgr->cbs->destroy_connector)(mgr, port->connector);
+
+		/* we can't destroy the connector here, as
+		   we might be holding the mode_config.mutex
+		   from an EDID retrieval */
+		if (port->connector) {
+			mutex_lock(&mgr->destroy_connector_lock);
+			list_add(&port->connector->destroy_list, &mgr->destroy_connector_list);
+			mutex_unlock(&mgr->destroy_connector_lock);
+			schedule_work(&mgr->destroy_connector_work);
+		}
 		drm_dp_port_teardown_pdt(port, port->pdt);
 
 		if (!port->input && port->vcpi.vcpi > 0)
@@ -2632,6 +2640,30 @@ static void drm_dp_tx_work(struct work_s
 	mutex_unlock(&mgr->qlock);
 }
 
+static void drm_dp_destroy_connector_work(struct work_struct *work)
+{
+	struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, destroy_connector_work);
+	struct drm_connector *connector;
+
+	/*
+	 * Not a regular list traverse as we have to drop the destroy
+	 * connector lock before destroying the connector, to avoid AB->BA
+	 * ordering between this lock and the config mutex.
+	 */
+	for (;;) {
+		mutex_lock(&mgr->destroy_connector_lock);
+		connector = list_first_entry_or_null(&mgr->destroy_connector_list, struct drm_connector, destroy_list);
+		if (!connector) {
+			mutex_unlock(&mgr->destroy_connector_lock);
+			break;
+		}
+		list_del(&connector->destroy_list);
+		mutex_unlock(&mgr->destroy_connector_lock);
+
+		mgr->cbs->destroy_connector(mgr, connector);
+	}
+}
+
 /**
  * drm_dp_mst_topology_mgr_init - initialise a topology manager
  * @mgr: manager struct to initialise
@@ -2651,10 +2683,13 @@ int drm_dp_mst_topology_mgr_init(struct
 	mutex_init(&mgr->lock);
 	mutex_init(&mgr->qlock);
 	mutex_init(&mgr->payload_lock);
+	mutex_init(&mgr->destroy_connector_lock);
 	INIT_LIST_HEAD(&mgr->tx_msg_upq);
 	INIT_LIST_HEAD(&mgr->tx_msg_downq);
+	INIT_LIST_HEAD(&mgr->destroy_connector_list);
 	INIT_WORK(&mgr->work, drm_dp_mst_link_probe_work);
 	INIT_WORK(&mgr->tx_work, drm_dp_tx_work);
+	INIT_WORK(&mgr->destroy_connector_work, drm_dp_destroy_connector_work);
 	init_waitqueue_head(&mgr->tx_waitq);
 	mgr->dev = dev;
 	mgr->aux = aux;
@@ -2679,6 +2714,7 @@ EXPORT_SYMBOL(drm_dp_mst_topology_mgr_in
  */
 void drm_dp_mst_topology_mgr_destroy(struct drm_dp_mst_topology_mgr *mgr)
 {
+	flush_work(&mgr->destroy_connector_work);
 	mutex_lock(&mgr->payload_lock);
 	kfree(mgr->payloads);
 	mgr->payloads = NULL;
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -731,6 +731,8 @@ struct drm_connector {
 	uint8_t num_h_tile, num_v_tile;
 	uint8_t tile_h_loc, tile_v_loc;
 	uint16_t tile_h_size, tile_v_size;
+
+	struct list_head destroy_list;
 };
 
 /**
--- a/include/drm/drm_dp_mst_helper.h
+++ b/include/drm/drm_dp_mst_helper.h
@@ -463,6 +463,10 @@ struct drm_dp_mst_topology_mgr {
 	struct work_struct work;
 
 	struct work_struct tx_work;
+
+	struct list_head destroy_connector_list;
+	struct mutex destroy_connector_lock;
+	struct work_struct destroy_connector_work;
 };
 
 int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr, struct device *dev, struct drm_dp_aux *aux, int max_dpcd_transaction_bytes, int max_payloads, int conn_base_id);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 131/267] drm/dp/mst: take lock around looking up the branch device on hpd irq
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 130/267] drm/dp/mst: close deadlock in connector destruction Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 132/267] drm/dp/mst: make sure mst_primary mstb is valid in work function Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Dave Airlie

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Airlie <airlied@redhat.com>

commit 9eb1e57f564d4e6e10991402726cc83fe0b9172f upstream.

If we are doing an MST transaction and we've gotten HPD and we
lookup the device from the incoming msg, we should take the mgr
lock around it, so that mst_primary and mstb->ports are valid.

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_dp_mst_topology.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1171,6 +1171,8 @@ static struct drm_dp_mst_branch *drm_dp_
 	struct drm_dp_mst_port *port;
 	int i;
 	/* find the port by iterating down */
+
+	mutex_lock(&mgr->lock);
 	mstb = mgr->mst_primary;
 
 	for (i = 0; i < lct - 1; i++) {
@@ -1190,6 +1192,7 @@ static struct drm_dp_mst_branch *drm_dp_
 		}
 	}
 	kref_get(&mstb->kref);
+	mutex_unlock(&mgr->lock);
 	return mstb;
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 132/267] drm/dp/mst: make sure mst_primary mstb is valid in work function
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 131/267] drm/dp/mst: take lock around looking up the branch device on hpd irq Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 133/267] drm/tegra: dpaux: Fix transfers larger than 4 bytes Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Daniel Vetter, Dave Airlie

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Vetter <daniel.vetter@ffwll.ch>

commit 9254ec496a1dbdddeab50021a8138dc627a8166a upstream.

This validates the mst_primary under the lock, and then calls
into the check and send function. This makes the code a lot
easier to understand the locking rules in.

Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_dp_mst_topology.c |   24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1200,7 +1200,7 @@ static void drm_dp_check_and_send_link_a
 					       struct drm_dp_mst_branch *mstb)
 {
 	struct drm_dp_mst_port *port;
-
+	struct drm_dp_mst_branch *mstb_child;
 	if (!mstb->link_address_sent) {
 		drm_dp_send_link_address(mgr, mstb);
 		mstb->link_address_sent = true;
@@ -1215,17 +1215,31 @@ static void drm_dp_check_and_send_link_a
 		if (!port->available_pbn)
 			drm_dp_send_enum_path_resources(mgr, mstb, port);
 
-		if (port->mstb)
-			drm_dp_check_and_send_link_address(mgr, port->mstb);
+		if (port->mstb) {
+			mstb_child = drm_dp_get_validated_mstb_ref(mgr, port->mstb);
+			if (mstb_child) {
+				drm_dp_check_and_send_link_address(mgr, mstb_child);
+				drm_dp_put_mst_branch_device(mstb_child);
+			}
+		}
 	}
 }
 
 static void drm_dp_mst_link_probe_work(struct work_struct *work)
 {
 	struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, work);
+	struct drm_dp_mst_branch *mstb;
 
-	drm_dp_check_and_send_link_address(mgr, mgr->mst_primary);
-
+	mutex_lock(&mgr->lock);
+	mstb = mgr->mst_primary;
+	if (mstb) {
+		kref_get(&mstb->kref);
+	}
+	mutex_unlock(&mgr->lock);
+	if (mstb) {
+		drm_dp_check_and_send_link_address(mgr, mstb);
+		drm_dp_put_mst_branch_device(mstb);
+	}
 }
 
 static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 133/267] drm/tegra: dpaux: Fix transfers larger than 4 bytes
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 132/267] drm/dp/mst: make sure mst_primary mstb is valid in work function Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 134/267] drm/qxl: Do not cause spice-server to clean our objects Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thierry Reding

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thierry Reding <treding@nvidia.com>

commit 3c1dae0a07c651526f8e878d223a88f82caa5a50 upstream.

The DPAUX read/write FIFO registers aren't sequential in the register
space, causing transfers larger than 4 bytes to cause accesses to non-
existing FIFO registers.

Fixes: 6b6b604215c6 ("drm/tegra: Add eDP support")
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/tegra/dpaux.c |   18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

--- a/drivers/gpu/drm/tegra/dpaux.c
+++ b/drivers/gpu/drm/tegra/dpaux.c
@@ -72,34 +72,32 @@ static inline void tegra_dpaux_writel(st
 static void tegra_dpaux_write_fifo(struct tegra_dpaux *dpaux, const u8 *buffer,
 				   size_t size)
 {
-	unsigned long offset = DPAUX_DP_AUXDATA_WRITE(0);
 	size_t i, j;
 
-	for (i = 0; i < size; i += 4) {
-		size_t num = min_t(size_t, size - i, 4);
+	for (i = 0; i < DIV_ROUND_UP(size, 4); i++) {
+		size_t num = min_t(size_t, size - i * 4, 4);
 		unsigned long value = 0;
 
 		for (j = 0; j < num; j++)
-			value |= buffer[i + j] << (j * 8);
+			value |= buffer[i * 4 + j] << (j * 8);
 
-		tegra_dpaux_writel(dpaux, value, offset++);
+		tegra_dpaux_writel(dpaux, value, DPAUX_DP_AUXDATA_WRITE(i));
 	}
 }
 
 static void tegra_dpaux_read_fifo(struct tegra_dpaux *dpaux, u8 *buffer,
 				  size_t size)
 {
-	unsigned long offset = DPAUX_DP_AUXDATA_READ(0);
 	size_t i, j;
 
-	for (i = 0; i < size; i += 4) {
-		size_t num = min_t(size_t, size - i, 4);
+	for (i = 0; i < DIV_ROUND_UP(size, 4); i++) {
+		size_t num = min_t(size_t, size - i * 4, 4);
 		unsigned long value;
 
-		value = tegra_dpaux_readl(dpaux, offset++);
+		value = tegra_dpaux_readl(dpaux, DPAUX_DP_AUXDATA_READ(i));
 
 		for (j = 0; j < num; j++)
-			buffer[i + j] = value >> (j * 8);
+			buffer[i * 4 + j] = value >> (j * 8);
 	}
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 134/267] drm/qxl: Do not cause spice-server to clean our objects
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 133/267] drm/tegra: dpaux: Fix transfers larger than 4 bytes Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 135/267] drm/qxl: Do not leak memory if qxl_release_list_add fails Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Frediano Ziglio, Dave Airlie

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Frediano Ziglio <fziglio@redhat.com>

commit 2fa19535ca6abcbfd1ccc9ef694db52f49f77747 upstream.

If objects are moved back from system memory to VRAM (and spice id
created again) memory is already initialized so we need to set flag
to not clear memory.
If you don't do it after a while using desktop many images turns to
black or transparents.

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/qxl/qxl_cmd.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/qxl/qxl_cmd.c
+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_devi
 
 	cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
 	cmd->type = QXL_SURFACE_CMD_CREATE;
+	cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
 	cmd->u.surface_create.format = surf->surf.format;
 	cmd->u.surface_create.width = surf->surf.width;
 	cmd->u.surface_create.height = surf->surf.height;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 135/267] drm/qxl: Do not leak memory if qxl_release_list_add fails
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 134/267] drm/qxl: Do not cause spice-server to clean our objects Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 137/267] drm/atomic: fix out of bounds read in for_each_*_in_state helpers Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Frediano Ziglio, Dave Airlie

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Frediano Ziglio <fziglio@redhat.com>

commit 8451cc964c1d193b989c41a44e5e77109cc696f8 upstream.

If the function fails reference counter to the object is not decremented
causing leaks.
This is hard to spot as it happens only on very low memory situations.

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/qxl/qxl_ioctl.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo
 	qobj = gem_to_qxl_bo(gobj);
 
 	ret = qxl_release_list_add(release, qobj);
-	if (ret)
+	if (ret) {
+		drm_gem_object_unreference_unlocked(gobj);
 		return NULL;
+	}
 
 	return qobj;
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 137/267] drm/atomic: fix out of bounds read in for_each_*_in_state helpers
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 135/267] drm/qxl: Do not leak memory if qxl_release_list_add fails Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 138/267] drm/radeon: take the mode_config mutex when dealing with hpds (v2) Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andrey Ryabinin, Daniel Vetter

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrey Ryabinin <a.ryabinin@samsung.com>

commit 60f207a5b6d8f23c2e8388b415e8d5c7311cc79d upstream.

for_each_*_in_state validate array index after
access to array elements, thus perform out of bounds read.

Fix this by validating index in the first place and read
array element iff validation was successful.

Fixes: df63b9994eaf ("drm/atomic: Add for_each_{connector,crtc,plane}_in_state helper macros")
Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/drm/drm_atomic.h |   24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

--- a/include/drm/drm_atomic.h
+++ b/include/drm/drm_atomic.h
@@ -77,26 +77,26 @@ int __must_check drm_atomic_async_commit
 
 #define for_each_connector_in_state(state, connector, connector_state, __i) \
 	for ((__i) = 0;							\
-	     (connector) = (state)->connectors[__i],			\
-	     (connector_state) = (state)->connector_states[__i],	\
-	     (__i) < (state)->num_connector;				\
+	     (__i) < (state)->num_connector &&				\
+	     ((connector) = (state)->connectors[__i],			\
+	     (connector_state) = (state)->connector_states[__i], 1); 	\
 	     (__i)++)							\
 		if (connector)
 
 #define for_each_crtc_in_state(state, crtc, crtc_state, __i)	\
 	for ((__i) = 0;						\
-	     (crtc) = (state)->crtcs[__i],			\
-	     (crtc_state) = (state)->crtc_states[__i],		\
-	     (__i) < (state)->dev->mode_config.num_crtc;	\
+	     (__i) < (state)->dev->mode_config.num_crtc &&	\
+	     ((crtc) = (state)->crtcs[__i],			\
+	     (crtc_state) = (state)->crtc_states[__i], 1);	\
 	     (__i)++)						\
 		if (crtc_state)
 
-#define for_each_plane_in_state(state, plane, plane_state, __i)	\
-	for ((__i) = 0;						\
-	     (plane) = (state)->planes[__i],			\
-	     (plane_state) = (state)->plane_states[__i],	\
-	     (__i) < (state)->dev->mode_config.num_total_plane;	\
-	     (__i)++)						\
+#define for_each_plane_in_state(state, plane, plane_state, __i)		\
+	for ((__i) = 0;							\
+	     (__i) < (state)->dev->mode_config.num_total_plane &&	\
+	     ((plane) = (state)->planes[__i],				\
+	     (plane_state) = (state)->plane_states[__i], 1);		\
+	     (__i)++)							\
 		if (plane_state)
 
 #endif /* DRM_ATOMIC_H_ */



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 138/267] drm/radeon: take the mode_config mutex when dealing with hpds (v2)
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 137/267] drm/atomic: fix out of bounds read in for_each_*_in_state helpers Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 139/267] drm/radeon: clean up radeon_audio_enable Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 39fa10f7e21574a70cecf1fed0f9b36535aa68a0 upstream.

Since we are messing with state in the worker.

v2: drop the changes in the mst worker

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon_irq_kms.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(str
 	struct drm_mode_config *mode_config = &dev->mode_config;
 	struct drm_connector *connector;
 
+	mutex_lock(&mode_config->mutex);
 	if (mode_config->num_connector) {
 		list_for_each_entry(connector, &mode_config->connector_list, head)
 			radeon_connector_hotplug(connector);
 	}
+	mutex_unlock(&mode_config->mutex);
 	/* Just fire off a uevent and let userspace tell us what to do */
 	drm_helper_hpd_irq_event(dev);
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 139/267] drm/radeon: clean up radeon_audio_enable
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 138/267] drm/radeon: take the mode_config mutex when dealing with hpds (v2) Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 140/267] drm/i915/ppgtt: Break loop in gen8_ppgtt_clear_range failure path Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 010621936103fcfc15375ccdc92c0f583923d489 upstream.

- make it static
- fix mask/bool handling for last param

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon_audio.c |   18 +++++++++---------
 drivers/gpu/drm/radeon/radeon_audio.h |    2 --
 2 files changed, 9 insertions(+), 11 deletions(-)

--- a/drivers/gpu/drm/radeon/radeon_audio.c
+++ b/drivers/gpu/drm/radeon/radeon_audio.c
@@ -242,6 +242,13 @@ static struct radeon_audio_funcs dce6_dp
 	.dpms = evergreen_dp_enable,
 };
 
+static void radeon_audio_enable(struct radeon_device *rdev,
+				struct r600_audio_pin *pin, u8 enable_mask)
+{
+	if (rdev->audio.funcs->enable)
+		rdev->audio.funcs->enable(rdev, pin, enable_mask);
+}
+
 static void radeon_audio_interface_init(struct radeon_device *rdev)
 {
 	if (ASIC_IS_DCE6(rdev)) {
@@ -307,7 +314,7 @@ int radeon_audio_init(struct radeon_devi
 
 	/* disable audio.  it will be set up later */
 	for (i = 0; i < rdev->audio.num_pins; i++)
-		radeon_audio_enable(rdev, &rdev->audio.pin[i], false);
+		radeon_audio_enable(rdev, &rdev->audio.pin[i], 0);
 
 	return 0;
 }
@@ -443,13 +450,6 @@ static void radeon_audio_select_pin(stru
 		radeon_encoder->audio->select_pin(encoder);
 }
 
-void radeon_audio_enable(struct radeon_device *rdev,
-	struct r600_audio_pin *pin, u8 enable_mask)
-{
-	if (rdev->audio.funcs->enable)
-		rdev->audio.funcs->enable(rdev, pin, enable_mask);
-}
-
 void radeon_audio_detect(struct drm_connector *connector,
 			 enum drm_connector_status status)
 {
@@ -502,7 +502,7 @@ void radeon_audio_fini(struct radeon_dev
 		return;
 
 	for (i = 0; i < rdev->audio.num_pins; i++)
-		radeon_audio_enable(rdev, &rdev->audio.pin[i], false);
+		radeon_audio_enable(rdev, &rdev->audio.pin[i], 0);
 
 	rdev->audio.enabled = false;
 }
--- a/drivers/gpu/drm/radeon/radeon_audio.h
+++ b/drivers/gpu/drm/radeon/radeon_audio.h
@@ -74,8 +74,6 @@ u32 radeon_audio_endpoint_rreg(struct ra
 void radeon_audio_endpoint_wreg(struct radeon_device *rdev,
 	u32 offset,	u32 reg, u32 v);
 struct r600_audio_pin *radeon_audio_get_pin(struct drm_encoder *encoder);
-void radeon_audio_enable(struct radeon_device *rdev,
-	struct r600_audio_pin *pin, u8 enable_mask);
 void radeon_audio_fini(struct radeon_device *rdev);
 void radeon_audio_mode_set(struct drm_encoder *encoder,
 	struct drm_display_mode *mode);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 140/267] drm/i915/ppgtt: Break loop in gen8_ppgtt_clear_range failure path
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 139/267] drm/radeon: clean up radeon_audio_enable Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 143/267] drm/i915: Declare the swizzling unknown for L-shaped configurations Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mika Kuoppala, John Harrison,
	Michel Thierry, Mika Kuoppala, Jani Nikula

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michel Thierry <michel.thierry@intel.com>

commit 00245266b4be4fbe989ee073663f56716da6c1f3 upstream.

If for some reason [1], the page directory/table does not exist, clear_range
would end up in an infinite while loop.

Introduced by commit 06fda602dbca ("drm/i915: Create page table allocators").

[1] This is already being addressed in one of Mika's patches:
http://mid.gmane.org/1432314314-23530-17-git-send-email-mika.kuoppala@intel.com

Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Reported-by: John Harrison <john.c.harrison@intel.com>
Signed-off-by: Michel Thierry <michel.thierry@intel.com>
Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_gem_gtt.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -502,17 +502,17 @@ static void gen8_ppgtt_clear_range(struc
 		struct page *page_table;
 
 		if (WARN_ON(!ppgtt->pdp.page_directory[pdpe]))
-			continue;
+			break;
 
 		pd = ppgtt->pdp.page_directory[pdpe];
 
 		if (WARN_ON(!pd->page_table[pde]))
-			continue;
+			break;
 
 		pt = pd->page_table[pde];
 
 		if (WARN_ON(!pt->page))
-			continue;
+			break;
 
 		page_table = pt->page;
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 143/267] drm/i915: Declare the swizzling unknown for L-shaped configurations
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 140/267] drm/i915/ppgtt: Break loop in gen8_ppgtt_clear_range failure path Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 144/267] drm/i915: Snapshot seqno of most recently submitted request Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chris Wilson, Daniel Vetter

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Wilson <chris@chris-wilson.co.uk>

commit 19ee835cdb0b5a8eb11a68f25a51b8039d564488 upstream.

The old style of memory interleaving swizzled upto the end of the
first even bank of memory, and then used the remainder as unswizzled on
the unpaired bank - i.e. swizzling is not constant for all memory. This
causes problems when we try to migrate memory and so the kernel prevents
migration at all when we detect L-shaped inconsistent swizzling.
However, this issue also extends to userspace who try to manually detile
into memory as the swizzling for an individual page is unknown (it
depends on its physical address only known to the kernel), userspace
cannot correctly swizzle objects.

v2: Mark the global swizzling as unknown rather than adjust the value
reported to userspace.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91105
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_gem_tiling.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -183,8 +183,18 @@ i915_gem_detect_bit_6_swizzle(struct drm
 		if (IS_GEN4(dev)) {
 			uint32_t ddc2 = I915_READ(DCC2);
 
-			if (!(ddc2 & DCC2_MODIFIED_ENHANCED_DISABLE))
+			if (!(ddc2 & DCC2_MODIFIED_ENHANCED_DISABLE)) {
+				/* Since the swizzling may vary within an
+				 * object, we have no idea what the swizzling
+				 * is for any page in particular. Thus we
+				 * cannot migrate tiled pages using the GPU,
+				 * nor can we tell userspace what the exact
+				 * swizzling is for any object.
+				 */
 				dev_priv->quirks |= QUIRK_PIN_SWIZZLED_PAGES;
+				swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
+				swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
+			}
 		}
 
 		if (dcc == 0xffffffff) {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 144/267] drm/i915: Snapshot seqno of most recently submitted request.
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 143/267] drm/i915: Declare the swizzling unknown for L-shaped configurations Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 145/267] drm/i915: Forward all core DRM ioctls to core compat handling Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tomas Elf, Chris Wilson, Daniel Vetter

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tomas Elf <tomas.elf@intel.com>

commit 94f7bbe1509731bdef651d7fb235b2c31fb23be8 upstream.

The hang checker needs to inspect whether or not the ring request list is empty
as well as if the given engine has reached or passed the most recently
submitted request. The problem with this is that the hang checker cannot grab
the struct_mutex, which is required in order to safely inspect requests since
requests might be deallocated during inspection. In the past we've had kernel
panics due to this very unsynchronized access in the hang checker.

One solution to this problem is to not inspect the requests directly since
we're only interested in the seqno of the most recently submitted request - not
the request itself. Instead the seqno of the most recently submitted request is
stored separately, which the hang checker then inspects, circumventing the
issue of synchronization from the hang checker entirely.

This fixes a regression introduced in

commit 44cdd6d219bc64f6810b8ed0023a4d4db9e0fe68
Author: John Harrison <John.C.Harrison@Intel.com>
Date:   Mon Nov 24 18:49:40 2014 +0000

    drm/i915: Convert 'ring_idle()' to use requests not seqnos

v2 (Chris Wilson):
- Pass current engine seqno to ring_idle() from i915_hangcheck_elapsed() rather
than compute it over again.
- Remove extra whitespace.

Issue: VIZ-5998
Signed-off-by: Tomas Elf <tomas.elf@intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
[danvet: Add regressing commit citation provided by Chris.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_gem.c         |    1 +
 drivers/gpu/drm/i915/i915_irq.c         |   13 +++----------
 drivers/gpu/drm/i915/intel_ringbuffer.h |    7 +++++++
 3 files changed, 11 insertions(+), 10 deletions(-)

--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2401,6 +2401,7 @@ int __i915_add_request(struct intel_engi
 	}
 
 	request->emitted_jiffies = jiffies;
+	ring->last_submitted_seqno = request->seqno;
 	list_add_tail(&request->list, &ring->request_list);
 	request->file_priv = NULL;
 
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2650,18 +2650,11 @@ static void gen8_disable_vblank(struct d
 	spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 
-static struct drm_i915_gem_request *
-ring_last_request(struct intel_engine_cs *ring)
-{
-	return list_entry(ring->request_list.prev,
-			  struct drm_i915_gem_request, list);
-}
-
 static bool
-ring_idle(struct intel_engine_cs *ring)
+ring_idle(struct intel_engine_cs *ring, u32 seqno)
 {
 	return (list_empty(&ring->request_list) ||
-		i915_gem_request_completed(ring_last_request(ring), false));
+		i915_seqno_passed(seqno, ring->last_submitted_seqno));
 }
 
 static bool
@@ -2883,7 +2876,7 @@ static void i915_hangcheck_elapsed(struc
 		acthd = intel_ring_get_active_head(ring);
 
 		if (ring->hangcheck.seqno == seqno) {
-			if (ring_idle(ring)) {
+			if (ring_idle(ring, seqno)) {
 				ring->hangcheck.action = HANGCHECK_IDLE;
 
 				if (waitqueue_active(&ring->irq_queue)) {
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -266,6 +266,13 @@ struct  intel_engine_cs {
 	 * Do we have some not yet emitted requests outstanding?
 	 */
 	struct drm_i915_gem_request *outstanding_lazy_request;
+	/**
+	 * Seqno of request most recently submitted to request_list.
+	 * Used exclusively by hang checker to avoid grabbing lock while
+	 * inspecting request list.
+	 */
+	u32 last_submitted_seqno;
+
 	bool gpu_caches_dirty;
 
 	wait_queue_head_t irq_queue;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 145/267] drm/i915: Forward all core DRM ioctls to core compat handling
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 144/267] drm/i915: Snapshot seqno of most recently submitted request Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:39 ` [PATCH 4.1 146/267] Revert "drm/i915: Declare the swizzling unknown for L-shaped configurations" Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tvrtko Ursulin, Daniel Vetter, Daniel Vetter

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>

commit ac7e7ab1c3243b10b41653cc8d8536088d83b152 upstream.

Previously only core DRM ioctls under the DRM_COMMAND_BASE were being
forwarded, but the drm.h header suggests (and reality confirms) ones
after (and including) DRM_COMMAND_END should be forwarded as well.

We need this to correctly forward the compat ioctl for the botched-up
addfb2.1 extension.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
[danvet: Explain why this is suddenly needed and add cc: stable.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_ioc32.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/i915_ioc32.c
+++ b/drivers/gpu/drm/i915/i915_ioc32.c
@@ -204,7 +204,7 @@ long i915_compat_ioctl(struct file *filp
 	drm_ioctl_compat_t *fn = NULL;
 	int ret;
 
-	if (nr < DRM_COMMAND_BASE)
+	if (nr < DRM_COMMAND_BASE || nr >= DRM_COMMAND_END)
 		return drm_compat_ioctl(filp, cmd, arg);
 
 	if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(i915_compat_ioctls))



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 146/267] Revert "drm/i915: Declare the swizzling unknown for L-shaped configurations"
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 145/267] drm/i915: Forward all core DRM ioctls to core compat handling Greg Kroah-Hartman
@ 2015-07-31 19:39 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 150/267] Revert "drm/radeon: dont switch vt on suspend" Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harald Arnesen, Chris Wilson, Daniel Vetter

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Vetter <daniel.vetter@ffwll.ch>

commit d82c0ba6e306f079407f07003e53c262d683397b upstream.

This reverts commit 19ee835cdb0b5a8eb11a68f25a51b8039d564488.

It breaks existing old userspace which doesn't handle UNKNOWN
swizzling correct. Yes UNKNOWN was a thing back in 2009 and probably
still is on some other platforms, but it still pretty clearly broke
the testers machine. If we want this we need to extend the ioctl with
new paramters that only new userspace looks at.

Cc: Harald Arnesen <harald@skogtun.org>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Reported-by: Harald Arnesen <harald@skogtun.org>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_gem_tiling.c |   12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -183,18 +183,8 @@ i915_gem_detect_bit_6_swizzle(struct drm
 		if (IS_GEN4(dev)) {
 			uint32_t ddc2 = I915_READ(DCC2);
 
-			if (!(ddc2 & DCC2_MODIFIED_ENHANCED_DISABLE)) {
-				/* Since the swizzling may vary within an
-				 * object, we have no idea what the swizzling
-				 * is for any page in particular. Thus we
-				 * cannot migrate tiled pages using the GPU,
-				 * nor can we tell userspace what the exact
-				 * swizzling is for any object.
-				 */
+			if (!(ddc2 & DCC2_MODIFIED_ENHANCED_DISABLE))
 				dev_priv->quirks |= QUIRK_PIN_SWIZZLED_PAGES;
-				swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
-				swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
-			}
 		}
 
 		if (dcc == 0xffffffff) {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 150/267] Revert "drm/radeon: dont switch vt on suspend"
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2015-07-31 19:39 ` [PATCH 4.1 146/267] Revert "drm/i915: Declare the swizzling unknown for L-shaped configurations" Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 151/267] drm/radeon: only check the sink type on DP connectors Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit ac9134906b3f5c2b45dc80dab0fee792bd516d52 upstream.

This reverts commit b9729b17a414f99c61f4db9ac9f9ed987fa0cbfe.

This seems to break the cursor on resume for lots of systems.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon_fb.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -257,7 +257,6 @@ static int radeonfb_create(struct drm_fb
 	}
 
 	info->par = rfbdev;
-	info->skip_vt_switch = true;
 
 	ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
 	if (ret) {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 151/267] drm/radeon: only check the sink type on DP connectors
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 150/267] Revert "drm/radeon: dont switch vt on suspend" Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 157/267] drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5 Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 479e9a95120aaae0bf0d3e0b5b26b36ac4a347b6 upstream.

Avoids a crash on pre-DP asics that support HDMI.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon_audio.c |   18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

--- a/drivers/gpu/drm/radeon/radeon_audio.c
+++ b/drivers/gpu/drm/radeon/radeon_audio.c
@@ -469,22 +469,22 @@ void radeon_audio_detect(struct drm_conn
 	dig = radeon_encoder->enc_priv;
 
 	if (status == connector_status_connected) {
-		struct radeon_connector *radeon_connector;
-		int sink_type;
-
 		if (!drm_detect_monitor_audio(radeon_connector_edid(connector))) {
 			radeon_encoder->audio = NULL;
 			return;
 		}
 
-		radeon_connector = to_radeon_connector(connector);
-		sink_type = radeon_dp_getsinktype(radeon_connector);
+		if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
+			struct radeon_connector *radeon_connector = to_radeon_connector(connector);
 
-		if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort &&
-			sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT)
-			radeon_encoder->audio = rdev->audio.dp_funcs;
-		else
+			if (radeon_dp_getsinktype(radeon_connector) ==
+			    CONNECTOR_OBJECT_ID_DISPLAYPORT)
+				radeon_encoder->audio = rdev->audio.dp_funcs;
+			else
+				radeon_encoder->audio = rdev->audio.hdmi_funcs;
+		} else {
 			radeon_encoder->audio = rdev->audio.hdmi_funcs;
+		}
 
 		dig->afmt->pin = radeon_audio_get_pin(connector->encoder);
 		radeon_audio_enable(rdev, dig->afmt->pin, 0xf);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 157/267] drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 151/267] drm/radeon: only check the sink type on DP connectors Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 159/267] drm/radeon/ci: silence a harmless PCC warning Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 5dfc71bc44d91d1620505c064fa22b0b3db58a9d upstream.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=76490

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/si_dpm.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2925,6 +2925,7 @@ static struct si_dpm_quirk si_dpm_quirk_
 	/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
+	{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
 	{ 0, 0, 0, 0 },
 };
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 159/267] drm/radeon/ci: silence a harmless PCC warning
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 157/267] drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5 Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 160/267] drm/rockchip: use drm_gem_mmap helpers Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit bda5e3e97ffe80c5a793383df5681d3581d46ac8 upstream.

This has been a source of confusion.  Make it debug only.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/ci_dpm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5818,7 +5818,7 @@ int ci_dpm_init(struct radeon_device *rd
 			tmp |= DPM_ENABLED;
 			break;
 		default:
-			DRM_ERROR("Invalid PCC GPIO: %u!\n", gpio.shift);
+			DRM_DEBUG("Invalid PCC GPIO: %u!\n", gpio.shift);
 			break;
 		}
 		WREG32_SMC(CNB_PWRMGT_CNTL, tmp);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 160/267] drm/rockchip: use drm_gem_mmap helpers
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 159/267] drm/radeon/ci: silence a harmless PCC warning Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 161/267] drm: add a check for x/y in drm_mode_setcrtc Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Kurtz, Daniel Vetter

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Kurtz <djkurtz@chromium.org>

commit 41315b793e13f884cda79389f0d5d44d027e57d1 upstream.

Rather than (incompletely [0]) re-implementing drm_gem_mmap() and
drm_gem_mmap_obj() helpers, call them directly from the rockchip mmap
routines.

Once the core functions return successfully, the rockchip mmap routines
can still use dma_mmap_attrs() to simply mmap the entire buffer.

[0] Previously, we were performing the mmap() without first taking a
reference on the underlying gem buffer.  This could leak ptes if the gem
object is destroyed while userspace is still holding the mapping.

Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/rockchip/rockchip_drm_gem.c |   67 ++++++++++++++--------------
 1 file changed, 34 insertions(+), 33 deletions(-)

--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
@@ -54,55 +54,56 @@ static void rockchip_gem_free_buf(struct
 		       &rk_obj->dma_attrs);
 }
 
-int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
-			  struct vm_area_struct *vma)
+static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
+					struct vm_area_struct *vma)
+
 {
+	int ret;
 	struct rockchip_gem_object *rk_obj = to_rockchip_obj(obj);
 	struct drm_device *drm = obj->dev;
-	unsigned long vm_size;
-
-	vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
-	vm_size = vma->vm_end - vma->vm_start;
 
-	if (vm_size > obj->size)
-		return -EINVAL;
+	/*
+	 * dma_alloc_attrs() allocated a struct page table for rk_obj, so clear
+	 * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap().
+	 */
+	vma->vm_flags &= ~VM_PFNMAP;
 
-	return dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
+	ret = dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
 			     obj->size, &rk_obj->dma_attrs);
+	if (ret)
+		drm_gem_vm_close(vma);
+
+	return ret;
 }
 
-/* drm driver mmap file operations */
-int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
+int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
+			  struct vm_area_struct *vma)
 {
-	struct drm_file *priv = filp->private_data;
-	struct drm_device *dev = priv->minor->dev;
-	struct drm_gem_object *obj;
-	struct drm_vma_offset_node *node;
+	struct drm_device *drm = obj->dev;
 	int ret;
 
-	if (drm_device_is_unplugged(dev))
-		return -ENODEV;
+	mutex_lock(&drm->struct_mutex);
+	ret = drm_gem_mmap_obj(obj, obj->size, vma);
+	mutex_unlock(&drm->struct_mutex);
+	if (ret)
+		return ret;
 
-	mutex_lock(&dev->struct_mutex);
+	return rockchip_drm_gem_object_mmap(obj, vma);
+}
 
-	node = drm_vma_offset_exact_lookup(dev->vma_offset_manager,
-					   vma->vm_pgoff,
-					   vma_pages(vma));
-	if (!node) {
-		mutex_unlock(&dev->struct_mutex);
-		DRM_ERROR("failed to find vma node.\n");
-		return -EINVAL;
-	} else if (!drm_vma_node_is_allowed(node, filp)) {
-		mutex_unlock(&dev->struct_mutex);
-		return -EACCES;
-	}
+/* drm driver mmap file operations */
+int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	struct drm_gem_object *obj;
+	int ret;
 
-	obj = container_of(node, struct drm_gem_object, vma_node);
-	ret = rockchip_gem_mmap_buf(obj, vma);
+	ret = drm_gem_mmap(filp, vma);
+	if (ret)
+		return ret;
 
-	mutex_unlock(&dev->struct_mutex);
+	obj = vma->vm_private_data;
 
-	return ret;
+	return rockchip_drm_gem_object_mmap(obj, vma);
 }
 
 struct rockchip_gem_object *



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 161/267] drm: add a check for x/y in drm_mode_setcrtc
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 160/267] drm/rockchip: use drm_gem_mmap helpers Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 162/267] drm: Provide compat ioctl for addfb2.1 Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Zhao Junwang

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhao Junwang <zhjwpku@gmail.com>

commit 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 upstream.

legacy setcrtc ioctl does take a 32 bit value which might indeed
overflow

the checks of crtc_req->x > INT_MAX and crtc_req->y > INT_MAX aren't
needed any more with this

v2: -polish the annotation according to Daniel's comment

Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Zhao Junwang <zhjwpku@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_crtc.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2749,8 +2749,11 @@ int drm_mode_setcrtc(struct drm_device *
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
 
-	/* For some reason crtc x/y offsets are signed internally. */
-	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
+	/*
+	 * Universal plane src offsets are only 16.16, prevent havoc for
+	 * drivers using universal plane code internally.
+	 */
+	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
 		return -ERANGE;
 
 	drm_modeset_lock_all(dev);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 162/267] drm: Provide compat ioctl for addfb2.1
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 161/267] drm: add a check for x/y in drm_mode_setcrtc Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 164/267] libata: Fix regression when the NCQ Send and Receive log page is absent Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tvrtko Ursulin, Daniel Vetter,
	dri-devel, Rob Clark, Daniel Stone, Daniel Vetter

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>

commit c631d5f90e7ee246536c72f80ade86e9ef4d2f13 upstream.

Frame buffer modifiers extensions provided in;

  commit e3eb3250d84ef97b766312345774367b6a310db8
  Author: Rob Clark <robdclark@gmail.com>
  Date:   Thu Feb 5 14:41:52 2015 +0000

      drm: add support for tiled/compressed/etc modifier in addfb2

Missed the structure packing/alignment problem where 64-bit
members were added after the odd number of 32-bit ones. This
makes the compiler produce structures of different sizes under
32- and 64-bit x86 targets and makes the ioctl need explicit
compat handling.

v2: Removed the typedef. (Daniel Vetter)

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: dri-devel@lists.freedesktop.org
Cc: Rob Clark <robdclark@gmail.com>
Cc: Daniel Stone <daniels@collabora.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
[danvet: Squash in compile fix from Mika.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_ioc32.c |   60 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -70,6 +70,8 @@
 
 #define DRM_IOCTL_WAIT_VBLANK32		DRM_IOWR(0x3a, drm_wait_vblank32_t)
 
+#define DRM_IOCTL_MODE_ADDFB232		DRM_IOWR(0xb8, drm_mode_fb_cmd232_t)
+
 typedef struct drm_version_32 {
 	int version_major;	  /**< Major version */
 	int version_minor;	  /**< Minor version */
@@ -1016,6 +1018,63 @@ static int compat_drm_wait_vblank(struct
 	return 0;
 }
 
+typedef struct drm_mode_fb_cmd232 {
+	u32 fb_id;
+	u32 width;
+	u32 height;
+	u32 pixel_format;
+	u32 flags;
+	u32 handles[4];
+	u32 pitches[4];
+	u32 offsets[4];
+	u64 modifier[4];
+} __attribute__((packed)) drm_mode_fb_cmd232_t;
+
+static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
+				  unsigned long arg)
+{
+	struct drm_mode_fb_cmd232 __user *argp = (void __user *)arg;
+	struct drm_mode_fb_cmd232 req32;
+	struct drm_mode_fb_cmd2 __user *req64;
+	int i;
+	int err;
+
+	if (copy_from_user(&req32, argp, sizeof(req32)))
+		return -EFAULT;
+
+	req64 = compat_alloc_user_space(sizeof(*req64));
+
+	if (!access_ok(VERIFY_WRITE, req64, sizeof(*req64))
+	    || __put_user(req32.width, &req64->width)
+	    || __put_user(req32.height, &req64->height)
+	    || __put_user(req32.pixel_format, &req64->pixel_format)
+	    || __put_user(req32.flags, &req64->flags))
+		return -EFAULT;
+
+	for (i = 0; i < 4; i++) {
+		if (__put_user(req32.handles[i], &req64->handles[i]))
+			return -EFAULT;
+		if (__put_user(req32.pitches[i], &req64->pitches[i]))
+			return -EFAULT;
+		if (__put_user(req32.offsets[i], &req64->offsets[i]))
+			return -EFAULT;
+		if (__put_user(req32.modifier[i], &req64->modifier[i]))
+			return -EFAULT;
+	}
+
+	err = drm_ioctl(file, DRM_IOCTL_MODE_ADDFB2, (unsigned long)req64);
+	if (err)
+		return err;
+
+	if (__get_user(req32.fb_id, &req64->fb_id))
+		return -EFAULT;
+
+	if (copy_to_user(argp, &req32, sizeof(req32)))
+		return -EFAULT;
+
+	return 0;
+}
+
 static drm_ioctl_compat_t *drm_compat_ioctls[] = {
 	[DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
@@ -1048,6 +1107,7 @@ static drm_ioctl_compat_t *drm_compat_io
 	[DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
 #endif
 	[DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
+	[DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
 };
 
 /**



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 164/267] libata: Fix regression when the NCQ Send and Receive log page is absent
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 162/267] drm: Provide compat ioctl for addfb2.1 Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 165/267] xfs: fix remote symlinks on V5/CRC filesystems Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin K. Petersen,
	Sergey Senozhatsky, Tejun Heo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Martin K. Petersen" <martin.petersen@oracle.com>

commit eab6ee1ce3c4678224d70338134f7a02005768cb upstream.

Commit 5d3abf8ff67f ("libata: Fall back to unqueued READ LOG EXT if
the DMA variant fails") allowed us to fall back to the unqueued READ
LOG variant if the queued version failed. However, if the device did
not support the page at all we would end up looping due to a merge
snafu.

Ensure we only take the fallback path once.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Reported-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-eh.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1521,6 +1521,7 @@ retry:
 	} else {
 		tf.command = ATA_CMD_READ_LOG_EXT;
 		tf.protocol = ATA_PROT_PIO;
+		dma = false;
 	}
 	tf.lbal = log;
 	tf.lbam = page;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 165/267] xfs: fix remote symlinks on V5/CRC filesystems
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 164/267] libata: Fix regression when the NCQ Send and Receive log page is absent Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 166/267] xfs: dont truncate attribute extents if no extents exist Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Sandeen, Dave Chinner, Dave Chinner

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Sandeen <sandeen@redhat.com>

commit 2ac56d3d4bd625450a54d4c3f9292d58f6b88232 upstream.

If we create a CRC filesystem, mount it, and create a symlink with
a path long enough that it can't live in the inode, we get a very
strange result upon remount:

# ls -l mnt
total 4
lrwxrwxrwx. 1 root root 929 Jun 15 16:58 link -> XSLM

XSLM is the V5 symlink block header magic (which happens to be
followed by a NUL, so the string looks terminated).

xfs_readlink_bmap() advanced cur_chunk by the size of the header
for CRC filesystems, but never actually used that pointer; it
kept reading from bp->b_addr, which is the start of the block,
rather than the start of the symlink data after the header.

Looks like this problem goes back to v3.10.

Fixing this gets us reading the proper link target, again.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_symlink.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/xfs/xfs_symlink.c
+++ b/fs/xfs/xfs_symlink.c
@@ -104,7 +104,7 @@ xfs_readlink_bmap(
 			cur_chunk += sizeof(struct xfs_dsymlink_hdr);
 		}
 
-		memcpy(link + offset, bp->b_addr, byte_cnt);
+		memcpy(link + offset, cur_chunk, byte_cnt);
 
 		pathlen -= byte_cnt;
 		offset += byte_cnt;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 166/267] xfs: dont truncate attribute extents if no extents exist
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 165/267] xfs: fix remote symlinks on V5/CRC filesystems Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 167/267] w1_therm reference count family data Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Foster, Dave Chinner, Dave Chinner

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brian Foster <bfoster@redhat.com>

commit f66bf042693b620133d39af8d2f13615f03eadfc upstream.

The xfs_attr3_root_inactive() call from xfs_attr_inactive() assumes that
attribute blocks exist to invalidate. It is possible to have an
attribute fork without extents, however. Consider the case where the
attribute fork is created towards the beginning of xfs_attr_set() but
some part of the subsequent attribute set fails.

If an inode in such a state hits xfs_attr_inactive(), it eventually
calls xfs_dabuf_map() and possibly xfs_bmapi_read(). The former emits a
filesystem corruption warning, returns an error that bubbles back up to
xfs_attr_inactive(), and leads to destruction of the in-core attribute
fork without an on-disk reset. If the inode happens to make it back
through xfs_inactive() in this state (e.g., via a concurrent bulkstat
that cycles the inode from the reclaim state and releases it), i_afp
might not exist when xfs_bmapi_read() is called and causes a NULL
dereference panic.

A '-p 2' fsstress run to ENOSPC on a relatively small fs (1GB)
reproduces these problems. The behavior is a regression caused by:

6dfe5a0 xfs: xfs_attr_inactive leaves inconsistent attr fork state behind

... which removed logic that avoided the attribute extent truncate when
no extents exist. Restore this logic to ensure the attribute fork is
destroyed and reset correctly if it exists without any allocated
extents.

Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_attr_inactive.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -435,8 +435,14 @@ xfs_attr_inactive(
 	 */
 	xfs_trans_ijoin(trans, dp, 0);
 
-	/* invalidate and truncate the attribute fork extents */
-	if (dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
+	/*
+	 * Invalidate and truncate the attribute fork extents. Make sure the
+	 * fork actually has attributes as otherwise the invalidation has no
+	 * blocks to read and returns an error. In this case, just do the fork
+	 * removal below.
+	 */
+	if (xfs_inode_hasattr(dp) &&
+	    dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
 		error = xfs_attr3_root_inactive(&trans, dp);
 		if (error)
 			goto out_cancel;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 167/267] w1_therm reference count family data
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 166/267] xfs: dont truncate attribute extents if no extents exist Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 168/267] tpm, tpm_crb: fix le64_to_cpu conversions in crb_acpi_add() Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Fries, Thorsten Bschorr,
	Evgeniy Polyakov

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Fries <David@Fries.net>

commit f7134eea05b2fb4a2c0935f8a540539fff01f3eb upstream.

A temperature conversion can take 750 ms and when possible the
w1_therm slave driver drops the bus_mutex to allow other bus
operations, but that includes operations such as a periodic slave
search, which can remove this slave when it is no longer detected.
If that happens the sl->family_data will be freed and set to NULL
causing w1_slave_show to crash when it wakes up.

Signed-off-by: David Fries <David@Fries.net>
Reported-By: Thorsten Bschorr <thorsten@bschorr.de>
Tested-by: Thorsten Bschorr <thorsten@bschorr.de>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/w1/slaves/w1_therm.c |   62 ++++++++++++++++++++++++++++++++-----------
 1 file changed, 47 insertions(+), 15 deletions(-)

--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -59,16 +59,32 @@ MODULE_ALIAS("w1-family-" __stringify(W1
 static int w1_strong_pullup = 1;
 module_param_named(strong_pullup, w1_strong_pullup, int, 0);
 
+struct w1_therm_family_data {
+	uint8_t rom[9];
+	atomic_t refcnt;
+};
+
+/* return the address of the refcnt in the family data */
+#define THERM_REFCNT(family_data) \
+	(&((struct w1_therm_family_data*)family_data)->refcnt)
+
 static int w1_therm_add_slave(struct w1_slave *sl)
 {
-	sl->family_data = kzalloc(9, GFP_KERNEL);
+	sl->family_data = kzalloc(sizeof(struct w1_therm_family_data),
+		GFP_KERNEL);
 	if (!sl->family_data)
 		return -ENOMEM;
+	atomic_set(THERM_REFCNT(sl->family_data), 1);
 	return 0;
 }
 
 static void w1_therm_remove_slave(struct w1_slave *sl)
 {
+	int refcnt = atomic_sub_return(1, THERM_REFCNT(sl->family_data));
+	while(refcnt) {
+		msleep(1000);
+		refcnt = atomic_read(THERM_REFCNT(sl->family_data));
+	}
 	kfree(sl->family_data);
 	sl->family_data = NULL;
 }
@@ -194,13 +210,22 @@ static ssize_t w1_slave_show(struct devi
 	struct w1_slave *sl = dev_to_w1_slave(device);
 	struct w1_master *dev = sl->master;
 	u8 rom[9], crc, verdict, external_power;
-	int i, max_trying = 10;
+	int i, ret, max_trying = 10;
 	ssize_t c = PAGE_SIZE;
+	u8 *family_data = sl->family_data;
+
+	ret = mutex_lock_interruptible(&dev->bus_mutex);
+	if (ret != 0)
+		goto post_unlock;
 
-	i = mutex_lock_interruptible(&dev->bus_mutex);
-	if (i != 0)
-		return i;
+	if(!sl->family_data)
+	{
+		ret = -ENODEV;
+		goto pre_unlock;
+	}
 
+	/* prevent the slave from going away in sleep */
+	atomic_inc(THERM_REFCNT(family_data));
 	memset(rom, 0, sizeof(rom));
 
 	while (max_trying--) {
@@ -230,17 +255,19 @@ static ssize_t w1_slave_show(struct devi
 				mutex_unlock(&dev->bus_mutex);
 
 				sleep_rem = msleep_interruptible(tm);
-				if (sleep_rem != 0)
-					return -EINTR;
+				if (sleep_rem != 0) {
+					ret = -EINTR;
+					goto post_unlock;
+				}
 
-				i = mutex_lock_interruptible(&dev->bus_mutex);
-				if (i != 0)
-					return i;
+				ret = mutex_lock_interruptible(&dev->bus_mutex);
+				if (ret != 0)
+					goto post_unlock;
 			} else if (!w1_strong_pullup) {
 				sleep_rem = msleep_interruptible(tm);
 				if (sleep_rem != 0) {
-					mutex_unlock(&dev->bus_mutex);
-					return -EINTR;
+					ret = -EINTR;
+					goto pre_unlock;
 				}
 			}
 
@@ -269,19 +296,24 @@ static ssize_t w1_slave_show(struct devi
 	c -= snprintf(buf + PAGE_SIZE - c, c, ": crc=%02x %s\n",
 			   crc, (verdict) ? "YES" : "NO");
 	if (verdict)
-		memcpy(sl->family_data, rom, sizeof(rom));
+		memcpy(family_data, rom, sizeof(rom));
 	else
 		dev_warn(device, "Read failed CRC check\n");
 
 	for (i = 0; i < 9; ++i)
 		c -= snprintf(buf + PAGE_SIZE - c, c, "%02x ",
-			      ((u8 *)sl->family_data)[i]);
+			      ((u8 *)family_data)[i]);
 
 	c -= snprintf(buf + PAGE_SIZE - c, c, "t=%d\n",
 		w1_convert_temp(rom, sl->family->fid));
+	ret = PAGE_SIZE - c;
+
+pre_unlock:
 	mutex_unlock(&dev->bus_mutex);
 
-	return PAGE_SIZE - c;
+post_unlock:
+	atomic_dec(THERM_REFCNT(family_data));
+	return ret;
 }
 
 static int __init w1_therm_init(void)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 168/267] tpm, tpm_crb: fix le64_to_cpu conversions in crb_acpi_add()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 167/267] w1_therm reference count family data Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 169/267] vTPM: set virtual device before passing to ibmvtpm_reset_crq Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matt Fleming, Jarkko Sakkinen,
	Jason Gunthorpe, Peter Huewe

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

commit 49afd7289bd937401c5f7faa193054bc3c41dad6 upstream.

le64_to_cpu() was applied twice to the physical addresses read from the
control area. This hasn't shown any visible regressions because CRB
driver has been tested only on the little endian platofrms so far.

Reported-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Reviewed-By: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Fixes: 30fc8d138e91 ("tpm: TPM 2.0 CRB Interface")
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/tpm/tpm_crb.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -267,7 +267,7 @@ static int crb_acpi_add(struct acpi_devi
 
 	memcpy_fromio(&pa, &priv->cca->cmd_pa, 8);
 	pa = le64_to_cpu(pa);
-	priv->cmd = devm_ioremap_nocache(dev, le64_to_cpu(pa),
+	priv->cmd = devm_ioremap_nocache(dev, pa,
 					 ioread32(&priv->cca->cmd_size));
 	if (!priv->cmd) {
 		dev_err(dev, "ioremap of the command buffer failed\n");
@@ -276,7 +276,7 @@ static int crb_acpi_add(struct acpi_devi
 
 	memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
 	pa = le64_to_cpu(pa);
-	priv->rsp = devm_ioremap_nocache(dev, le64_to_cpu(pa),
+	priv->rsp = devm_ioremap_nocache(dev, pa,
 					 ioread32(&priv->cca->rsp_size));
 	if (!priv->rsp) {
 		dev_err(dev, "ioremap of the response buffer failed\n");



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 169/267] vTPM: set virtual device before passing to ibmvtpm_reset_crq
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 168/267] tpm, tpm_crb: fix le64_to_cpu conversions in crb_acpi_add() Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 170/267] tpm: Fix initialization of the cdev Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hon Ching(Vicky) Lo, Joy Latten,
	Ashley Lai, Peter Huewe

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Hon Ching \\(Vicky\\) Lo" <honclo@linux.vnet.ibm.com>

commit 9d75f08946e8485109458ccf16f714697c207f41 upstream.

tpm_ibmvtpm_probe() calls ibmvtpm_reset_crq(ibmvtpm) without having yet
set the virtual device in the ibmvtpm structure. So in ibmvtpm_reset_crq,
the phype call contains empty unit addresses, ibmvtpm->vdev->unit_address.

Signed-off-by: Hon Ching(Vicky) Lo <honclo@linux.vnet.ibm.com>
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
Reviewed-by: Ashley Lai <ashley@ahsleylai.com>
Fixes: 132f76294744 ("drivers/char/tpm: Add new device driver to support IBM vTPM")
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/tpm/tpm_ibmvtpm.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -578,6 +578,9 @@ static int tpm_ibmvtpm_probe(struct vio_
 		goto cleanup;
 	}
 
+	ibmvtpm->dev = dev;
+	ibmvtpm->vdev = vio_dev;
+
 	crq_q = &ibmvtpm->crq_queue;
 	crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL);
 	if (!crq_q->crq_addr) {
@@ -622,8 +625,6 @@ static int tpm_ibmvtpm_probe(struct vio_
 
 	crq_q->index = 0;
 
-	ibmvtpm->dev = dev;
-	ibmvtpm->vdev = vio_dev;
 	TPM_VPRIV(chip) = (void *)ibmvtpm;
 
 	spin_lock_init(&ibmvtpm->rtce_lock);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 170/267] tpm: Fix initialization of the cdev
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 169/267] vTPM: set virtual device before passing to ibmvtpm_reset_crq Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 171/267] tpm, tpm_crb: fail when TPM2 ACPI table contents look corrupted Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Dmitry Torokhov,
	Jarkko Sakkinen, Peter Huewe

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>

commit ba0ef85479c46a2ab354c2220bdb6152f7f4baf3 upstream.

When a cdev is contained in a dynamic structure the cdev parent kobj
should be set to the kobj that controls the lifetime of the enclosing
structure. In TPM's case this is the embedded struct device.

Also, cdev_init 0's the whole structure, so all sets must be after,
not before. This fixes module ref counting and cdev.

Fixes: 313d21eeab92 ("tpm: device class for tpm")
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/tpm/tpm-chip.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -129,8 +129,9 @@ struct tpm_chip *tpmm_chip_alloc(struct
 
 	device_initialize(&chip->dev);
 
-	chip->cdev.owner = chip->pdev->driver->owner;
 	cdev_init(&chip->cdev, &tpm_fops);
+	chip->cdev.owner = chip->pdev->driver->owner;
+	chip->cdev.kobj.parent = &chip->dev.kobj;
 
 	return chip;
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 171/267] tpm, tpm_crb: fail when TPM2 ACPI table contents look corrupted
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 170/267] tpm: Fix initialization of the cdev Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 172/267] KEYS: fix "ca_keys=" partial key matching Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jarkko Sakkinen, Peter Huewe

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

commit b371616b8537d6450ebca0819defbf53452bebf3 upstream.

At least some versions of AMI BIOS have corrupted contents in the TPM2
ACPI table and namely the physical address of the control area is set to
zero.

This patch changes the driver to fail gracefully  when we observe a zero
address instead of continuing to ioremap.

Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Reviewed-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/tpm/tpm_crb.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -233,6 +233,14 @@ static int crb_acpi_add(struct acpi_devi
 		return -ENODEV;
 	}
 
+	/* At least some versions of AMI BIOS have a bug that TPM2 table has
+	 * zero address for the control area and therefore we must fail.
+	*/
+	if (!buf->control_area_pa) {
+		dev_err(dev, "TPM2 ACPI table has a zero address for the control area\n");
+		return -EINVAL;
+	}
+
 	if (buf->hdr.length < sizeof(struct acpi_tpm2)) {
 		dev_err(dev, "TPM2 ACPI table has wrong size");
 		return -EINVAL;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 172/267] KEYS: fix "ca_keys=" partial key matching
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 171/267] tpm, tpm_crb: fail when TPM2 ACPI table contents look corrupted Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 173/267] KEYS: ensure we free the assoc array edit if edit is valid Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells, Mimi Zohar

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <zohar@linux.vnet.ibm.com>

commit f2b3dee484f9cee967a54ef05a66866282337519 upstream.

The call to asymmetric_key_hex_to_key_id() from ca_keys_setup()
silently fails with -ENOMEM.  Instead of dynamically allocating
memory from a __setup function, this patch defines a variable
and calls __asymmetric_key_hex_to_key_id(), a new helper function,
directly.

This bug was introduced by 'commit 46963b774d44 ("KEYS: Overhaul
key identification when searching for asymmetric keys")'.

Changelog:
- for clarification, rename hexlen to asciihexlen in
  asymmetric_key_hex_to_key_id()
- add size argument to __asymmetric_key_hex_to_key_id() - David Howells
- inline __asymmetric_key_hex_to_key_id() - David Howells
- remove duplicate strlen() calls

Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/asymmetric_keys/asymmetric_keys.h |    3 +++
 crypto/asymmetric_keys/asymmetric_type.c |   20 ++++++++++++++------
 crypto/asymmetric_keys/x509_public_key.c |   23 ++++++++++++++++++-----
 3 files changed, 35 insertions(+), 11 deletions(-)

--- a/crypto/asymmetric_keys/asymmetric_keys.h
+++ b/crypto/asymmetric_keys/asymmetric_keys.h
@@ -11,6 +11,9 @@
 
 extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
 
+extern int __asymmetric_key_hex_to_key_id(const char *id,
+					  struct asymmetric_key_id *match_id,
+					  size_t hexlen);
 static inline
 const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
 {
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -104,6 +104,15 @@ static bool asymmetric_match_key_ids(
 	return false;
 }
 
+/* helper function can be called directly with pre-allocated memory */
+inline int __asymmetric_key_hex_to_key_id(const char *id,
+				   struct asymmetric_key_id *match_id,
+				   size_t hexlen)
+{
+	match_id->len = hexlen;
+	return hex2bin(match_id->data, id, hexlen);
+}
+
 /**
  * asymmetric_key_hex_to_key_id - Convert a hex string into a key ID.
  * @id: The ID as a hex string.
@@ -111,21 +120,20 @@ static bool asymmetric_match_key_ids(
 struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
 {
 	struct asymmetric_key_id *match_id;
-	size_t hexlen;
+	size_t asciihexlen;
 	int ret;
 
 	if (!*id)
 		return ERR_PTR(-EINVAL);
-	hexlen = strlen(id);
-	if (hexlen & 1)
+	asciihexlen = strlen(id);
+	if (asciihexlen & 1)
 		return ERR_PTR(-EINVAL);
 
-	match_id = kmalloc(sizeof(struct asymmetric_key_id) + hexlen / 2,
+	match_id = kmalloc(sizeof(struct asymmetric_key_id) + asciihexlen / 2,
 			   GFP_KERNEL);
 	if (!match_id)
 		return ERR_PTR(-ENOMEM);
-	match_id->len = hexlen / 2;
-	ret = hex2bin(match_id->data, id, hexlen / 2);
+	ret = __asymmetric_key_hex_to_key_id(id, match_id, asciihexlen / 2);
 	if (ret < 0) {
 		kfree(match_id);
 		return ERR_PTR(-EINVAL);
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -28,17 +28,30 @@ static bool use_builtin_keys;
 static struct asymmetric_key_id *ca_keyid;
 
 #ifndef MODULE
+static struct {
+	struct asymmetric_key_id id;
+	unsigned char data[10];
+} cakey;
+
 static int __init ca_keys_setup(char *str)
 {
 	if (!str)		/* default system keyring */
 		return 1;
 
 	if (strncmp(str, "id:", 3) == 0) {
-		struct asymmetric_key_id *p;
-		p = asymmetric_key_hex_to_key_id(str + 3);
-		if (p == ERR_PTR(-EINVAL))
-			pr_err("Unparsable hex string in ca_keys\n");
-		else if (!IS_ERR(p))
+		struct asymmetric_key_id *p = &cakey.id;
+		size_t hexlen = (strlen(str) - 3) / 2;
+		int ret;
+
+		if (hexlen == 0 || hexlen > sizeof(cakey.data)) {
+			pr_err("Missing or invalid ca_keys id\n");
+			return 1;
+		}
+
+		ret = __asymmetric_key_hex_to_key_id(str + 3, p, hexlen);
+		if (ret < 0)
+			pr_err("Unparsable ca_keys id hex string\n");
+		else
 			ca_keyid = p;	/* owner key 'id:xxxxxx' */
 	} else if (strcmp(str, "builtin") == 0) {
 		use_builtin_keys = true;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 173/267] KEYS: ensure we free the assoc array edit if edit is valid
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 172/267] KEYS: fix "ca_keys=" partial key matching Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 174/267] ima: skip measurement of cgroupfs files and update documentation Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, David Howells, James Morris

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Colin Ian King <colin.king@canonical.com>

commit ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 upstream.

__key_link_end is not freeing the associated array edit structure
and this leads to a 512 byte memory leak each time an identical
existing key is added with add_key().

The reason the add_key() system call returns okay is that
key_create_or_update() calls __key_link_begin() before checking to see
whether it can update a key directly rather than adding/replacing - which
it turns out it can.  Thus __key_link() is not called through
__key_instantiate_and_link() and __key_link_end() must cancel the edit.

CVE-2015-1333

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/keys/keyring.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring,
 	if (index_key->type == &key_type_keyring)
 		up_write(&keyring_serialise_link_sem);
 
-	if (edit && !edit->dead_leaf) {
-		key_payload_reserve(keyring,
-				    keyring->datalen - KEYQUOTA_LINK_BYTES);
+	if (edit) {
+		if (!edit->dead_leaf) {
+			key_payload_reserve(keyring,
+				keyring->datalen - KEYQUOTA_LINK_BYTES);
+		}
 		assoc_array_cancel_edit(edit);
 	}
 	up_write(&keyring->sem);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 174/267] ima: skip measurement of cgroupfs files and update documentation
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 173/267] KEYS: ensure we free the assoc array edit if edit is valid Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 175/267] ima: cleanup ima_init_policy() a little Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Roberto Sassu, Mimi Zohar

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Roberto Sassu <rsassu@suse.de>

commit 6438de9f3fb5180d78a0422695d0b88c687757d3 upstream.

This patch adds a rule in the default measurement policy to skip inodes
in the cgroupfs filesystem. Measurements for this filesystem can be
avoided, as all the digests collected have the same value of the digest of
an empty file.

Furthermore, this patch updates the documentation of IMA policies in
Documentation/ABI/testing/ima_policy to make it consistent with
the policies set in security/integrity/ima/ima_policy.c.

Signed-off-by: Roberto Sassu <rsassu@suse.de>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/ABI/testing/ima_policy |   17 ++++++++++++-----
 security/integrity/ima/ima_policy.c  |    2 ++
 2 files changed, 14 insertions(+), 5 deletions(-)

--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -49,11 +49,22 @@ Description:
 			dont_measure fsmagic=0x01021994
 			dont_appraise fsmagic=0x01021994
 			# RAMFS_MAGIC
-			dont_measure fsmagic=0x858458f6
 			dont_appraise fsmagic=0x858458f6
+			# DEVPTS_SUPER_MAGIC
+			dont_measure fsmagic=0x1cd1
+			dont_appraise fsmagic=0x1cd1
+			# BINFMTFS_MAGIC
+			dont_measure fsmagic=0x42494e4d
+			dont_appraise fsmagic=0x42494e4d
 			# SECURITYFS_MAGIC
 			dont_measure fsmagic=0x73636673
 			dont_appraise fsmagic=0x73636673
+			# SELINUX_MAGIC
+			dont_measure fsmagic=0xf97cff8c
+			dont_appraise fsmagic=0xf97cff8c
+			# CGROUP_SUPER_MAGIC
+			dont_measure fsmagic=0x27e0eb
+			dont_appraise fsmagic=0x27e0eb
 
 			measure func=BPRM_CHECK
 			measure func=FILE_MMAP mask=MAY_EXEC
@@ -70,10 +81,6 @@ Description:
 		Examples of LSM specific definitions:
 
 		SELinux:
-			# SELINUX_MAGIC
-			dont_measure fsmagic=0xf97cff8c
-			dont_appraise fsmagic=0xf97cff8c
-
 			dont_measure obj_type=var_log_t
 			dont_appraise obj_type=var_log_t
 			dont_measure obj_type=auditd_log_t
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -79,6 +79,8 @@ static struct ima_rule_entry default_rul
 	{.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
+	{.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
+	 .flags = IMA_FSMAGIC},
 	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 	 .flags = IMA_FUNC | IMA_MASK},
 	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 175/267] ima: cleanup ima_init_policy() a little
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 174/267] ima: skip measurement of cgroupfs files and update documentation Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 176/267] ima: do not measure or appraise the NSFS filesystem Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mimi Zohar

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 5577857f8e26e9027271f10daf96361640907300 upstream.

It's a bit easier to read this if we split it up into two for loops.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/integrity/ima/ima_policy.c |   14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -340,16 +340,12 @@ void __init ima_init_policy(void)
 	appraise_entries = ima_use_appraise_tcb ?
 			 ARRAY_SIZE(default_appraise_rules) : 0;
 
-	for (i = 0; i < measure_entries + appraise_entries; i++) {
-		if (i < measure_entries)
-			list_add_tail(&default_rules[i].list,
-				      &ima_default_rules);
-		else {
-			int j = i - measure_entries;
+	for (i = 0; i < measure_entries; i++)
+		list_add_tail(&default_rules[i].list, &ima_default_rules);
 
-			list_add_tail(&default_appraise_rules[j].list,
-				      &ima_default_rules);
-		}
+	for (i = 0; i < appraise_entries; i++) {
+		list_add_tail(&default_appraise_rules[i].list,
+			      &ima_default_rules);
 	}
 
 	ima_rules = &ima_default_rules;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 176/267] ima: do not measure or appraise the NSFS filesystem
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 175/267] ima: cleanup ima_init_policy() a little Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 177/267] evm: labeling pseudo filesystems exception Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mimi Zohar

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <zohar@linux.vnet.ibm.com>

commit cd025f7f94108995383edddfb61fc8afea6c66a9 upstream.

Include don't appraise or measure rules for the NSFS filesystem
in the builtin ima_tcb and ima_appraise_tcb policies.

Changelog:
- Update documentation

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/ABI/testing/ima_policy |    3 +++
 security/integrity/ima/ima_policy.c  |    2 ++
 2 files changed, 5 insertions(+)

--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -65,6 +65,9 @@ Description:
 			# CGROUP_SUPER_MAGIC
 			dont_measure fsmagic=0x27e0eb
 			dont_appraise fsmagic=0x27e0eb
+			# NSFS_MAGIC
+			dont_measure fsmagic=0x6e736673
+			dont_appraise fsmagic=0x6e736673
 
 			measure func=BPRM_CHECK
 			measure func=FILE_MMAP mask=MAY_EXEC
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -81,6 +81,7 @@ static struct ima_rule_entry default_rul
 	{.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
 	 .flags = IMA_FSMAGIC},
+	{.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 	 .flags = IMA_FUNC | IMA_MASK},
 	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
@@ -101,6 +102,7 @@ static struct ima_rule_entry default_app
 	{.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
+	{.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 177/267] evm: labeling pseudo filesystems exception
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 176/267] ima: do not measure or appraise the NSFS filesystem Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 178/267] ima: fix ima_show_template_data_ascii() Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mimi Zohar

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <zohar@linux.vnet.ibm.com>

commit 5101a1850bb7ccbf107929dee9af0cd2f400940f upstream.

To prevent offline stripping of existing file xattrs and relabeling of
them at runtime, EVM allows only newly created files to be labeled.  As
pseudo filesystems are not persistent, stripping of xattrs is not a
concern.

Some LSMs defer file labeling on pseudo filesystems.  This patch
permits the labeling of existing files on pseudo files systems.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/integrity/evm/evm_main.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -296,6 +296,17 @@ static int evm_protect_xattr(struct dent
 		iint = integrity_iint_find(d_backing_inode(dentry));
 		if (iint && (iint->flags & IMA_NEW_FILE))
 			return 0;
+
+		/* exception for pseudo filesystems */
+		if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
+		    || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
+			return 0;
+
+		integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
+				    dentry->d_inode, dentry->d_name.name,
+				    "update_metadata",
+				    integrity_status_msg[evm_status],
+				    -EPERM, 0);
 	}
 out:
 	if (evm_status != INTEGRITY_PASS)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 178/267] ima: fix ima_show_template_data_ascii()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 177/267] evm: labeling pseudo filesystems exception Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 179/267] ima: add support for new "euid" policy condition Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mimi Zohar, Roberto Sassu

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <zohar@linux.vnet.ibm.com>

commit 45b26133b97871896b8c5241d59f4ff7839db7b2 upstream.

This patch fixes a bug introduced in "4d7aeee ima: define new template
ima-ng and template fields d-ng and n-ng".

Changelog:
- change int to uint32 (Roberto Sassu's suggestion)

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Roberto Sassu <rsassu@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/integrity/ima/ima.h              |    2 +-
 security/integrity/ima/ima_fs.c           |    4 ++--
 security/integrity/ima/ima_template_lib.c |    3 ++-
 3 files changed, 5 insertions(+), 4 deletions(-)

--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file
 		       const char *op, const char *cause);
 int ima_init_crypto(void);
 void ima_putc(struct seq_file *m, void *data, int datalen);
-void ima_print_digest(struct seq_file *m, u8 *digest, int size);
+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
 struct ima_template_desc *ima_template_desc_current(void);
 int ima_init_template(void);
 
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -190,9 +190,9 @@ static const struct file_operations ima_
 	.release = seq_release,
 };
 
-void ima_print_digest(struct seq_file *m, u8 *digest, int size)
+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
 {
-	int i;
+	u32 i;
 
 	for (i = 0; i < size; i++)
 		seq_printf(m, "%02x", *(digest + i));
--- a/security/integrity/ima/ima_template_lib.c
+++ b/security/integrity/ima/ima_template_lib.c
@@ -70,7 +70,8 @@ static void ima_show_template_data_ascii
 					 enum data_formats datafmt,
 					 struct ima_field_data *field_data)
 {
-	u8 *buf_ptr = field_data->data, buflen = field_data->len;
+	u8 *buf_ptr = field_data->data;
+	u32 buflen = field_data->len;
 
 	switch (datafmt) {
 	case DATA_FMT_DIGEST_WITH_ALGO:



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 179/267] ima: add support for new "euid" policy condition
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 178/267] ima: fix ima_show_template_data_ascii() Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 180/267] ima: extend "mask" policy matching support Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mimi Zohar, Dr. Greg Wettstein

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <zohar@linux.vnet.ibm.com>

commit 139069eff7388407f19794384c42a534d618ccd7 upstream.

The new "euid" policy condition measures files with the specified
effective uid (euid).  In addition, for CAP_SETUID files it measures
files with the specified uid or suid.

Changelog:
- fixed checkpatch.pl warnings
- fixed avc denied {setuid} messages - based on Roberto's feedback

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Dr. Greg Wettstein <gw@idfusion.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/ABI/testing/ima_policy |    3 ++-
 security/integrity/ima/ima_policy.c  |   27 +++++++++++++++++++++++----
 2 files changed, 25 insertions(+), 5 deletions(-)

--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -20,7 +20,7 @@ Description:
 		action: measure | dont_measure | appraise | dont_appraise | audit
 		condition:= base | lsm  [option]
 			base:	[[func=] [mask=] [fsmagic=] [fsuuid=] [uid=]
-				 [fowner]]
+				[euid=] [fowner=]]
 			lsm:	[[subj_user=] [subj_role=] [subj_type=]
 				 [obj_user=] [obj_role=] [obj_type=]]
 			option:	[[appraise_type=]] [permit_directio]
@@ -31,6 +31,7 @@ Description:
 			fsmagic:= hex value
 			fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
 			uid:= decimal value
+			euid:= decimal value
 			fowner:=decimal value
 		lsm:  	are LSM specific
 		option:	appraise_type:= [imasig]
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -27,6 +27,7 @@
 #define IMA_UID		0x0008
 #define IMA_FOWNER	0x0010
 #define IMA_FSUUID	0x0020
+#define IMA_EUID	0x0080
 
 #define UNKNOWN		0
 #define MEASURE		0x0001	/* same as IMA_MEASURE */
@@ -194,6 +195,16 @@ static bool ima_match_rules(struct ima_r
 		return false;
 	if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
 		return false;
+	if (rule->flags & IMA_EUID) {
+		if (has_capability_noaudit(current, CAP_SETUID)) {
+			if (!uid_eq(rule->uid, cred->euid)
+			    && !uid_eq(rule->uid, cred->suid)
+			    && !uid_eq(rule->uid, cred->uid))
+				return false;
+		} else if (!uid_eq(rule->uid, cred->euid))
+			return false;
+	}
+
 	if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
 		return false;
 	for (i = 0; i < MAX_LSM_RULES; i++) {
@@ -373,7 +384,8 @@ enum {
 	Opt_audit,
 	Opt_obj_user, Opt_obj_role, Opt_obj_type,
 	Opt_subj_user, Opt_subj_role, Opt_subj_type,
-	Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner,
+	Opt_func, Opt_mask, Opt_fsmagic,
+	Opt_uid, Opt_euid, Opt_fowner,
 	Opt_appraise_type, Opt_fsuuid, Opt_permit_directio
 };
 
@@ -394,6 +406,7 @@ static match_table_t policy_tokens = {
 	{Opt_fsmagic, "fsmagic=%s"},
 	{Opt_fsuuid, "fsuuid=%s"},
 	{Opt_uid, "uid=%s"},
+	{Opt_euid, "euid=%s"},
 	{Opt_fowner, "fowner=%s"},
 	{Opt_appraise_type, "appraise_type=%s"},
 	{Opt_permit_directio, "permit_directio"},
@@ -566,6 +579,9 @@ static int ima_parse_rule(char *rule, st
 			break;
 		case Opt_uid:
 			ima_log_string(ab, "uid", args[0].from);
+		case Opt_euid:
+			if (token == Opt_euid)
+				ima_log_string(ab, "euid", args[0].from);
 
 			if (uid_valid(entry->uid)) {
 				result = -EINVAL;
@@ -574,11 +590,14 @@ static int ima_parse_rule(char *rule, st
 
 			result = kstrtoul(args[0].from, 10, &lnum);
 			if (!result) {
-				entry->uid = make_kuid(current_user_ns(), (uid_t)lnum);
-				if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum))
+				entry->uid = make_kuid(current_user_ns(),
+						       (uid_t) lnum);
+				if (!uid_valid(entry->uid) ||
+				    (uid_t)lnum != lnum)
 					result = -EINVAL;
 				else
-					entry->flags |= IMA_UID;
+					entry->flags |= (token == Opt_uid)
+					    ? IMA_UID : IMA_EUID;
 			}
 			break;
 		case Opt_fowner:



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 180/267] ima: extend "mask" policy matching support
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 179/267] ima: add support for new "euid" policy condition Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 181/267] ima: update builtin policies Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mimi Zohar, Dr. Greg Wettstein

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <zohar@linux.vnet.ibm.com>

commit 4351c294b8c1028077280f761e158d167b592974 upstream.

The current "mask" policy option matches files opened as MAY_READ,
MAY_WRITE, MAY_APPEND or MAY_EXEC.  This patch extends the "mask"
option to match files opened containing one of these modes.  For
example, "mask=^MAY_READ" would match files opened read-write.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Dr. Greg Wettstein <gw@idfusion.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/ABI/testing/ima_policy |    3 ++-
 security/integrity/ima/ima_policy.c  |   20 +++++++++++++++-----
 2 files changed, 17 insertions(+), 6 deletions(-)

--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -27,7 +27,8 @@ Description:
 
 		base: 	func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
 				[FIRMWARE_CHECK]
-			mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
+			mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
+			       [[^]MAY_EXEC]
 			fsmagic:= hex value
 			fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
 			uid:= decimal value
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -27,6 +27,7 @@
 #define IMA_UID		0x0008
 #define IMA_FOWNER	0x0010
 #define IMA_FSUUID	0x0020
+#define IMA_INMASK	0x0040
 #define IMA_EUID	0x0080
 
 #define UNKNOWN		0
@@ -187,6 +188,9 @@ static bool ima_match_rules(struct ima_r
 	if ((rule->flags & IMA_MASK) &&
 	    (rule->mask != mask && func != POST_SETATTR))
 		return false;
+	if ((rule->flags & IMA_INMASK) &&
+	    (!(rule->mask & mask) && func != POST_SETATTR))
+		return false;
 	if ((rule->flags & IMA_FSMAGIC)
 	    && rule->fsmagic != inode->i_sb->s_magic)
 		return false;
@@ -448,6 +452,7 @@ static void ima_log_string(struct audit_
 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 {
 	struct audit_buffer *ab;
+	char *from;
 	char *p;
 	int result = 0;
 
@@ -538,18 +543,23 @@ static int ima_parse_rule(char *rule, st
 			if (entry->mask)
 				result = -EINVAL;
 
-			if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
+			from = args[0].from;
+			if (*from == '^')
+				from++;
+
+			if ((strcmp(from, "MAY_EXEC")) == 0)
 				entry->mask = MAY_EXEC;
-			else if (strcmp(args[0].from, "MAY_WRITE") == 0)
+			else if (strcmp(from, "MAY_WRITE") == 0)
 				entry->mask = MAY_WRITE;
-			else if (strcmp(args[0].from, "MAY_READ") == 0)
+			else if (strcmp(from, "MAY_READ") == 0)
 				entry->mask = MAY_READ;
-			else if (strcmp(args[0].from, "MAY_APPEND") == 0)
+			else if (strcmp(from, "MAY_APPEND") == 0)
 				entry->mask = MAY_APPEND;
 			else
 				result = -EINVAL;
 			if (!result)
-				entry->flags |= IMA_MASK;
+				entry->flags |= (*args[0].from == '^')
+				     ? IMA_INMASK : IMA_MASK;
 			break;
 		case Opt_fsmagic:
 			ima_log_string(ab, "fsmagic", args[0].from);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 181/267] ima: update builtin policies
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 180/267] ima: extend "mask" policy matching support Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 182/267] tracing/filter: Do not WARN on operand count going below zero Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mimi Zohar, Dr. Greg Wettstein

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <zohar@linux.vnet.ibm.com>

commit 24fd03c87695a76f0517df42a37e51b1597d2c8a upstream.

This patch defines a builtin measurement policy "tcb", similar to the
existing "ima_tcb", but with additional rules to also measure files
based on the effective uid and to measure files opened with the "read"
mode bit set (eg. read, read-write).

Changing the builtin "ima_tcb" policy could potentially break existing
users.  Instead of defining a new separate boot command line option each
time the builtin measurement policy is modified, this patch defines a
single generic boot command line option "ima_policy=" to specify the
builtin policy and deprecates the use of the builtin ima_tcb policy.

[The "ima_policy=" boot command line option is based on Roberto Sassu's
"ima: added new policy type exec" patch.]

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Dr. Greg Wettstein <gw@idfusion.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/kernel-parameters.txt |   10 ++++-
 security/integrity/ima/ima_policy.c |   65 +++++++++++++++++++++++++++++++-----
 2 files changed, 65 insertions(+), 10 deletions(-)

--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1398,7 +1398,15 @@ bytes respectively. Such letter suffixes
 			The list of supported hash algorithms is defined
 			in crypto/hash_info.h.
 
-	ima_tcb		[IMA]
+	ima_policy=	[IMA]
+			The builtin measurement policy to load during IMA
+			setup.  Specyfing "tcb" as the value, measures all
+			programs exec'd, files mmap'd for exec, and all files
+			opened with the read mode bit set by either the
+			effective uid (euid=0) or uid=0.
+			Format: "tcb"
+
+	ima_tcb		[IMA] Deprecated.  Use ima_policy= instead.
 			Load a policy which meets the needs of the Trusted
 			Computing Base.  This means IMA will measure all
 			programs exec'd, files mmap'd for exec, and all files
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -44,6 +44,8 @@ enum lsm_rule_types { LSM_OBJ_USER, LSM_
 	LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
 };
 
+enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
+
 struct ima_rule_entry {
 	struct list_head list;
 	int action;
@@ -72,7 +74,7 @@ struct ima_rule_entry {
  * normal users can easily run the machine out of memory simply building
  * and running executables.
  */
-static struct ima_rule_entry default_rules[] = {
+static struct ima_rule_entry dont_measure_rules[] = {
 	{.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
@@ -83,13 +85,29 @@ static struct ima_rule_entry default_rul
 	{.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 	{.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
 	 .flags = IMA_FSMAGIC},
-	{.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
+	{.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
+};
+
+static struct ima_rule_entry original_measurement_rules[] = {
+	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
+	 .flags = IMA_FUNC | IMA_MASK},
+	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
+	 .flags = IMA_FUNC | IMA_MASK},
+	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
+	 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID},
+	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
+	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
+};
+
+static struct ima_rule_entry default_measurement_rules[] = {
 	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 	 .flags = IMA_FUNC | IMA_MASK},
 	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 	 .flags = IMA_FUNC | IMA_MASK},
-	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, .uid = GLOBAL_ROOT_UID,
-	 .flags = IMA_FUNC | IMA_MASK | IMA_UID},
+	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
+	 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
+	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
+	 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 };
@@ -121,14 +139,29 @@ static struct list_head *ima_rules;
 
 static DEFINE_MUTEX(ima_rules_mutex);
 
-static bool ima_use_tcb __initdata;
+static int ima_policy __initdata;
 static int __init default_measure_policy_setup(char *str)
 {
-	ima_use_tcb = 1;
+	if (ima_policy)
+		return 1;
+
+	ima_policy = ORIGINAL_TCB;
 	return 1;
 }
 __setup("ima_tcb", default_measure_policy_setup);
 
+static int __init policy_setup(char *str)
+{
+	if (ima_policy)
+		return 1;
+
+	if (strcmp(str, "tcb") == 0)
+		ima_policy = DEFAULT_TCB;
+
+	return 1;
+}
+__setup("ima_policy=", policy_setup);
+
 static bool ima_use_appraise_tcb __initdata;
 static int __init default_appraise_policy_setup(char *str)
 {
@@ -352,13 +385,27 @@ void __init ima_init_policy(void)
 {
 	int i, measure_entries, appraise_entries;
 
-	/* if !ima_use_tcb set entries = 0 so we load NO default rules */
-	measure_entries = ima_use_tcb ? ARRAY_SIZE(default_rules) : 0;
+	/* if !ima_policy set entries = 0 so we load NO default rules */
+	measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 	appraise_entries = ima_use_appraise_tcb ?
 			 ARRAY_SIZE(default_appraise_rules) : 0;
 
 	for (i = 0; i < measure_entries; i++)
-		list_add_tail(&default_rules[i].list, &ima_default_rules);
+		list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
+
+	switch (ima_policy) {
+	case ORIGINAL_TCB:
+		for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
+			list_add_tail(&original_measurement_rules[i].list,
+				      &ima_default_rules);
+		break;
+	case DEFAULT_TCB:
+		for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
+			list_add_tail(&default_measurement_rules[i].list,
+				      &ima_default_rules);
+	default:
+		break;
+	}
 
 	for (i = 0; i < appraise_entries; i++) {
 		list_add_tail(&default_appraise_rules[i].list,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 182/267] tracing/filter: Do not WARN on operand count going below zero
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 181/267] ima: update builtin policies Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 183/267] tracing/filter: Do not allow infix to exceed end of string Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vince Weaver, Sasha Levin, Steven Rostedt

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

commit b4875bbe7e68f139bd3383828ae8e994a0df6d28 upstream.

When testing the fix for the trace filter, I could not come up with
a scenario where the operand count goes below zero, so I added a
WARN_ON_ONCE(cnt < 0) to the logic. But there is legitimate case
that it can happen (although the filter would be wrong).

 # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter

That is, a single operation without any operands will hit the path
where the WARN_ON_ONCE() can trigger. Although this is harmless,
and the filter is reported as a error. But instead of spitting out
a warning to the kernel dmesg, just fail nicely and report it via
the proper channels.

Link: http://lkml.kernel.org/r/558C6082.90608@oracle.com

Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace_events_filter.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1385,7 +1385,9 @@ static int check_preds(struct filter_par
 		if (elt->op != OP_NOT)
 			cnt--;
 		n_normal_preds++;
-		WARN_ON_ONCE(cnt < 0);
+		/* all ops should have operands */
+		if (cnt < 0)
+			break;
 	}
 
 	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 183/267] tracing/filter: Do not allow infix to exceed end of string
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 182/267] tracing/filter: Do not WARN on operand count going below zero Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 184/267] tracing: Fix typo from "static inlin" to "static inline" Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

commit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream.

While debugging a WARN_ON() for filtering, I found that it is possible
for the filter string to be referenced after its end. With the filter:

 # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter

The filter_parse() function can call infix_get_op() which calls
infix_advance() that updates the infix filter pointers for the cnt
and tail without checking if the filter is already at the end, which
will put the cnt to zero and the tail beyond the end. The loop then calls
infix_next() that has

	ps->infix.cnt--;
	return ps->infix.string[ps->infix.tail++];

The cnt will now be below zero, and the tail that is returned is
already passed the end of the filter string. So far the allocation
of the filter string usually has some buffer that is zeroed out, but
if the filter string is of the exact size of the allocated buffer
there's no guarantee that the charater after the nul terminating
character will be zero.

Luckily, only root can write to the filter.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace_events_filter.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1056,6 +1056,9 @@ static void parse_init(struct filter_par
 
 static char infix_next(struct filter_parse_state *ps)
 {
+	if (!ps->infix.cnt)
+		return 0;
+
 	ps->infix.cnt--;
 
 	return ps->infix.string[ps->infix.tail++];
@@ -1071,6 +1074,9 @@ static char infix_peek(struct filter_par
 
 static void infix_advance(struct filter_parse_state *ps)
 {
+	if (!ps->infix.cnt)
+		return;
+
 	ps->infix.cnt--;
 	ps->infix.tail++;
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 184/267] tracing: Fix typo from "static inlin" to "static inline"
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 183/267] tracing/filter: Do not allow infix to exceed end of string Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 185/267] tracing: Have branch tracer use recursive field of task struct Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

commit cc9e4bde03f2b4cfba52406c021364cbd2a4a0f3 upstream.

The trace.h header when called without CONFIG_EVENT_TRACING enabled
(seldom done), will not compile because of a typo in the protocol
of trace_event_enum_update().

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1312,7 +1312,7 @@ void trace_event_init(void);
 void trace_event_enum_update(struct trace_enum_map **map, int len);
 #else
 static inline void __init trace_event_init(void) { }
-static inlin void trace_event_enum_update(struct trace_enum_map **map, int len) { }
+static inline void trace_event_enum_update(struct trace_enum_map **map, int len) { }
 #endif
 
 extern struct trace_iterator *tracepoint_print_iter;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 185/267] tracing: Have branch tracer use recursive field of task struct
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 184/267] tracing: Fix typo from "static inlin" to "static inline" Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 186/267] tracing: Fix sample output of dynamic arrays Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fengguang Wu, Steven Rostedt

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

commit 6224beb12e190ff11f3c7d4bf50cb2922878f600 upstream.

Fengguang Wu's tests triggered a bug in the branch tracer's start up
test when CONFIG_DEBUG_PREEMPT set. This was because that config
adds some debug logic in the per cpu field, which calls back into
the branch tracer.

The branch tracer has its own recursive checks, but uses a per cpu
variable to implement it. If retrieving the per cpu variable calls
back into the branch tracer, you can see how things will break.

Instead of using a per cpu variable, use the trace_recursion field
of the current task struct. Simply set a bit when entering the
branch tracing and clear it when leaving. If the bit is set on
entry, just don't do the tracing.

There's also the case with lockdep, as the local_irq_save() called
before the recursion can also trigger code that can call back into
the function. Changing that to a raw_local_irq_save() will protect
that as well.

This prevents the recursion and the inevitable crash that follows.

Link: http://lkml.kernel.org/r/20150630141803.GA28071@wfg-t540p.sh.intel.com

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Tested-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace.h        |    1 +
 kernel/trace/trace_branch.c |   17 ++++++++++-------
 2 files changed, 11 insertions(+), 7 deletions(-)

--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -444,6 +444,7 @@ enum {
 
 	TRACE_CONTROL_BIT,
 
+	TRACE_BRANCH_BIT,
 /*
  * Abuse of the trace_recursion.
  * As we need a way to maintain state if we are tracing the function
--- a/kernel/trace/trace_branch.c
+++ b/kernel/trace/trace_branch.c
@@ -36,9 +36,12 @@ probe_likely_condition(struct ftrace_bra
 	struct trace_branch *entry;
 	struct ring_buffer *buffer;
 	unsigned long flags;
-	int cpu, pc;
+	int pc;
 	const char *p;
 
+	if (current->trace_recursion & TRACE_BRANCH_BIT)
+		return;
+
 	/*
 	 * I would love to save just the ftrace_likely_data pointer, but
 	 * this code can also be used by modules. Ugly things can happen
@@ -49,10 +52,10 @@ probe_likely_condition(struct ftrace_bra
 	if (unlikely(!tr))
 		return;
 
-	local_irq_save(flags);
-	cpu = raw_smp_processor_id();
-	data = per_cpu_ptr(tr->trace_buffer.data, cpu);
-	if (atomic_inc_return(&data->disabled) != 1)
+	raw_local_irq_save(flags);
+	current->trace_recursion |= TRACE_BRANCH_BIT;
+	data = this_cpu_ptr(tr->trace_buffer.data);
+	if (atomic_read(&data->disabled))
 		goto out;
 
 	pc = preempt_count();
@@ -81,8 +84,8 @@ probe_likely_condition(struct ftrace_bra
 		__buffer_unlock_commit(buffer, event);
 
  out:
-	atomic_dec(&data->disabled);
-	local_irq_restore(flags);
+	current->trace_recursion &= ~TRACE_BRANCH_BIT;
+	raw_local_irq_restore(flags);
 }
 
 static inline



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 186/267] tracing: Fix sample output of dynamic arrays
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 185/267] tracing: Have branch tracer use recursive field of task struct Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 187/267] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, He Kuang, Steven Rostedt

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

commit d6726c8145290bef950ae2538ea6ae1d96a1944b upstream.

He Kuang noticed that the trace event samples for arrays was broken:

"The output result of trace_foo_bar event in traceevent samples is
 wrong. This problem can be reproduced as following:

  (Build kernel with SAMPLE_TRACE_EVENTS=m)

  $ insmod trace-events-sample.ko

  $ echo 1 > /sys/kernel/debug/tracing/events/sample-trace/foo_bar/enable

  $ cat /sys/kernel/debug/tracing/trace

  event-sample-980 [000] ....  43.649559: foo_bar: foo hello 21 0x15
  BIT1|BIT3|0x10 {0x1,0x6f6f6e53,0xff007970,0xffffffff} Snoopy
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                 The array length is not right, should be {0x1}.
  (ffffffff,ffffffff)

  event-sample-980 [000] ....  44.653827: foo_bar: foo hello 22 0x16
  BIT2|BIT3|0x10
  {0x1,0x2,0x646e6147,0x666c61,0xffffffff,0xffffffff,0x750aeffe,0x7}
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                 The array length is not right, should be {0x1,0x2}.
  Gandalf (ffffffff,ffffffff)"

This was caused by an update to have __print_array()'s second parameter
be the count of items in the array and not the size of the array.

As there is already users of __print_array(), it can not change. But
the sample code can and we can also improve on the documentation about
__print_array() and __get_dynamic_array_len().

Link: http://lkml.kernel.org/r/1436839171-31527-2-git-send-email-hekuang@huawei.com

Fixes: ac01ce1410fc2 ("tracing: Make ftrace_print_array_seq compute buf_len")
Reported-by: He Kuang <hekuang@huawei.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 samples/trace_events/trace-events-sample.h |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/samples/trace_events/trace-events-sample.h
+++ b/samples/trace_events/trace-events-sample.h
@@ -168,7 +168,10 @@
  *
  *      For __dynamic_array(int, foo, bar) use __get_dynamic_array(foo)
  *            Use __get_dynamic_array_len(foo) to get the length of the array
- *            saved.
+ *            saved. Note, __get_dynamic_array_len() returns the total allocated
+ *            length of the dynamic array; __print_array() expects the second
+ *            parameter to be the number of elements. To get that, the array length
+ *            needs to be divided by the element size.
  *
  *      For __string(foo, bar) use __get_str(foo)
  *
@@ -288,7 +291,7 @@ TRACE_EVENT(foo_bar,
  *    This prints out the array that is defined by __array in a nice format.
  */
 		  __print_array(__get_dynamic_array(list),
-				__get_dynamic_array_len(list),
+				__get_dynamic_array_len(list) / sizeof(int),
 				sizeof(int)),
 		  __get_str(str), __get_bitmask(cpus))
 );



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 187/267] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 186/267] tracing: Fix sample output of dynamic arrays Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 188/267] md: clear mddev->private when it has been freed Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lior Amsalem, Maxime Ripard,
	Ofer Heifetz, Vinod Koul

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lior Amsalem <alior@marvell.com>

commit 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 upstream.

This patch fixes a bug in the XOR driver where the cleanup function can be
called and free descriptors that never been processed by the engine (which
result in data errors).

The cleanup function will free descriptors based on the ownership bit in
the descriptors.

Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
Signed-off-by: Lior Amsalem <alior@marvell.com>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Reviewed-by: Ofer Heifetz <oferh@marvell.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/mv_xor.c |   74 ++++++++++++++++++++++++++++++++-------------------
 drivers/dma/mv_xor.h |    1 
 2 files changed, 48 insertions(+), 27 deletions(-)

--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -273,7 +273,8 @@ static void mv_xor_slot_cleanup(struct m
 	dma_cookie_t cookie = 0;
 	int busy = mv_chan_is_busy(mv_chan);
 	u32 current_desc = mv_chan_get_current_desc(mv_chan);
-	int seen_current = 0;
+	int current_cleaned = 0;
+	struct mv_xor_desc *hw_desc;
 
 	dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
 	dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
@@ -285,38 +286,57 @@ static void mv_xor_slot_cleanup(struct m
 
 	list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
 					chain_node) {
-		prefetch(_iter);
-		prefetch(&_iter->async_tx);
 
-		/* do not advance past the current descriptor loaded into the
-		 * hardware channel, subsequent descriptors are either in
-		 * process or have not been submitted
-		 */
-		if (seen_current)
-			break;
-
-		/* stop the search if we reach the current descriptor and the
-		 * channel is busy
-		 */
-		if (iter->async_tx.phys == current_desc) {
-			seen_current = 1;
-			if (busy)
+		/* clean finished descriptors */
+		hw_desc = iter->hw_desc;
+		if (hw_desc->status & XOR_DESC_SUCCESS) {
+			cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
+								cookie);
+
+			/* done processing desc, clean slot */
+			mv_xor_clean_slot(iter, mv_chan);
+
+			/* break if we did cleaned the current */
+			if (iter->async_tx.phys == current_desc) {
+				current_cleaned = 1;
 				break;
+			}
+		} else {
+			if (iter->async_tx.phys == current_desc) {
+				current_cleaned = 0;
+				break;
+			}
 		}
-
-		cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
-
-		if (mv_xor_clean_slot(iter, mv_chan))
-			break;
 	}
 
 	if ((busy == 0) && !list_empty(&mv_chan->chain)) {
-		struct mv_xor_desc_slot *chain_head;
-		chain_head = list_entry(mv_chan->chain.next,
-					struct mv_xor_desc_slot,
-					chain_node);
-
-		mv_xor_start_new_chain(mv_chan, chain_head);
+		if (current_cleaned) {
+			/*
+			 * current descriptor cleaned and removed, run
+			 * from list head
+			 */
+			iter = list_entry(mv_chan->chain.next,
+					  struct mv_xor_desc_slot,
+					  chain_node);
+			mv_xor_start_new_chain(mv_chan, iter);
+		} else {
+			if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
+				/*
+				 * descriptors are still waiting after
+				 * current, trigger them
+				 */
+				iter = list_entry(iter->chain_node.next,
+						  struct mv_xor_desc_slot,
+						  chain_node);
+				mv_xor_start_new_chain(mv_chan, iter);
+			} else {
+				/*
+				 * some descriptors are still waiting
+				 * to be cleaned
+				 */
+				tasklet_schedule(&mv_chan->irq_tasklet);
+			}
+		}
 	}
 
 	if (cookie > 0)
--- a/drivers/dma/mv_xor.h
+++ b/drivers/dma/mv_xor.h
@@ -31,6 +31,7 @@
 #define XOR_OPERATION_MODE_XOR		0
 #define XOR_OPERATION_MODE_MEMCPY	2
 #define XOR_DESCRIPTOR_SWAP		BIT(14)
+#define XOR_DESC_SUCCESS		0x40000000
 
 #define XOR_DESC_DMA_OWNED		BIT(31)
 #define XOR_DESC_EOD_INT_EN		BIT(31)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 188/267] md: clear mddev->private when it has been freed.
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 187/267] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 189/267] md: unlock mddev_lock on an error path Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nate Clark, NeilBrown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb@suse.de>

commit bd6919228d7e1867ae9e24ab27e3e4a366c87d21 upstream.

If ->private is set when ->run is called, it is assumed to be
a 'config'  prepared as part of 'reshape'.

So it is important when we free that config, that we also clear ->private.
This is not often a problem as the mddev will normally be discarded
shortly after the config us freed.
However if an 'assemble' races with a final close, the assemble can use
the old mddev which has a stale ->private.  This leads to any of
various sorts of crashes.

So clear ->private after calling ->free().

Reported-by: Nate Clark <nate@neworld.us>
Fixes: afa0f557cb15 ("md: rename ->stop to ->free")
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5159,6 +5159,7 @@ int md_run(struct mddev *mddev)
 		mddev_detach(mddev);
 		if (mddev->private)
 			pers->free(mddev, mddev->private);
+		mddev->private = NULL;
 		module_put(pers->owner);
 		bitmap_destroy(mddev);
 		return err;
@@ -5294,6 +5295,7 @@ static void md_clean(struct mddev *mddev
 	mddev->changed = 0;
 	mddev->degraded = 0;
 	mddev->safemode = 0;
+	mddev->private = NULL;
 	mddev->merge_check_needed = 0;
 	mddev->bitmap_info.offset = 0;
 	mddev->bitmap_info.default_offset = 0;
@@ -5366,6 +5368,7 @@ static void __md_stop(struct mddev *mdde
 	mddev->pers = NULL;
 	spin_unlock(&mddev->lock);
 	pers->free(mddev, mddev->private);
+	mddev->private = NULL;
 	if (pers->sync_request && mddev->to_remove == NULL)
 		mddev->to_remove = &md_redundancy_group;
 	module_put(pers->owner);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 189/267] md: unlock mddev_lock on an error path.
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 188/267] md: clear mddev->private when it has been freed Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 190/267] md: Skip cluster setup for dm-raid Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, NeilBrown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb@suse.de>

commit 9a8c0fa861e4db60409b4dda254cef5e17e4d43c upstream.

This error path retuns while still holding the lock - bad.

Fixes: 6791875e2e53 ("md: make reconfig_mutex optional for writes to md sysfs files.")
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4005,8 +4005,10 @@ new_dev_store(struct mddev *mddev, const
 	else
 		rdev = md_import_device(dev, -1, -1);
 
-	if (IS_ERR(rdev))
+	if (IS_ERR(rdev)) {
+		mddev_unlock(mddev);
 		return PTR_ERR(rdev);
+	}
 	err = bind_rdev_to_array(rdev, mddev);
  out:
 	if (err)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 190/267] md: Skip cluster setup for dm-raid
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 189/267] md: unlock mddev_lock on an error path Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 191/267] hwmon: (mcp3021) Fix broken output scaling Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Goldwyn Rodrigues, NeilBrown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Goldwyn Rodrigues <rgoldwyn@suse.com>

commit d3b178adb3a3adf54ecf77758138b654c3ee7f09 upstream.

There is a bug that the bitmap superblock isn't initialised properly for
dm-raid, so a new field can have garbage in new fields.
(dm-raid does initialisation in the kernel - md initialised the
 superblock in mdadm).

This means that for dm-raid we cannot currently trust the new ->nodes
field. So:
 - use __GFP_ZERO to initialise the superblock properly for all new
    arrays
 - initialise all fields in bitmap_info in bitmap_new_disk_sb
 - ignore ->nodes for dm arrays (yes, this is a hack)

This bug exposes dm-raid to bug in the (still experimental) md-cluster
code, so it is suitable for -stable.  It does cause crashes.

References: https://bugzilla.kernel.org/show_bug.cgi?id=100491
Signed-off-By: Goldwyn Rodrigues <rgoldwyn@suse.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/bitmap.c |   15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -494,7 +494,7 @@ static int bitmap_new_disk_sb(struct bit
 	bitmap_super_t *sb;
 	unsigned long chunksize, daemon_sleep, write_behind;
 
-	bitmap->storage.sb_page = alloc_page(GFP_KERNEL);
+	bitmap->storage.sb_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
 	if (bitmap->storage.sb_page == NULL)
 		return -ENOMEM;
 	bitmap->storage.sb_page->index = 0;
@@ -541,6 +541,7 @@ static int bitmap_new_disk_sb(struct bit
 	sb->state = cpu_to_le32(bitmap->flags);
 	bitmap->events_cleared = bitmap->mddev->events;
 	sb->events_cleared = cpu_to_le64(bitmap->mddev->events);
+	bitmap->mddev->bitmap_info.nodes = 0;
 
 	kunmap_atomic(sb);
 
@@ -611,8 +612,16 @@ re_read:
 	daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ;
 	write_behind = le32_to_cpu(sb->write_behind);
 	sectors_reserved = le32_to_cpu(sb->sectors_reserved);
-	nodes = le32_to_cpu(sb->nodes);
-	strlcpy(bitmap->mddev->bitmap_info.cluster_name, sb->cluster_name, 64);
+	/* XXX: This is a hack to ensure that we don't use clustering
+	 *  in case:
+	 *	- dm-raid is in use and
+	 *	- the nodes written in bitmap_sb is erroneous.
+	 */
+	if (!bitmap->mddev->sync_super) {
+		nodes = le32_to_cpu(sb->nodes);
+		strlcpy(bitmap->mddev->bitmap_info.cluster_name,
+				sb->cluster_name, 64);
+	}
 
 	/* verify that the bitmap-specific fields are valid */
 	if (sb->magic != cpu_to_le32(BITMAP_MAGIC))



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 191/267] hwmon: (mcp3021) Fix broken output scaling
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 190/267] md: Skip cluster setup for dm-raid Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 192/267] hwmon: (nct7802) fix visibility of temp3 Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nick Stevens, Guenter Roeck

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Stevens, Nick" <Nick.Stevens@digi.com>

commit 347d7e45bd09ce09cbc30d5cea9de377eb22f55c upstream.

The mcp3021 scaling code is dividing the VDD (full-scale) value in
millivolts by the A2D resolution to obtain the scaling factor. When VDD
is 3300mV (the standard value) and the resolution is 12-bit (4096
divisions), the result is a scale factor of 3300/4096, which is always
one.  Effectively, the raw A2D reading is always being returned because
no scaling is applied.

This patch fixes the issue and simplifies the register-to-volts
calculation, removing the unneeded "output_scale" struct member.

Signed-off-by: Nick Stevens <Nick.Stevens@digi.com>
[Guenter Roeck: Dropped unnecessary value check]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/mcp3021.c |   14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

--- a/drivers/hwmon/mcp3021.c
+++ b/drivers/hwmon/mcp3021.c
@@ -31,14 +31,11 @@
 /* output format */
 #define MCP3021_SAR_SHIFT	2
 #define MCP3021_SAR_MASK	0x3ff
-
 #define MCP3021_OUTPUT_RES	10	/* 10-bit resolution */
-#define MCP3021_OUTPUT_SCALE	4
 
 #define MCP3221_SAR_SHIFT	0
 #define MCP3221_SAR_MASK	0xfff
 #define MCP3221_OUTPUT_RES	12	/* 12-bit resolution */
-#define MCP3221_OUTPUT_SCALE	1
 
 enum chips {
 	mcp3021,
@@ -54,7 +51,6 @@ struct mcp3021_data {
 	u16 sar_shift;
 	u16 sar_mask;
 	u8 output_res;
-	u8 output_scale;
 };
 
 static int mcp3021_read16(struct i2c_client *client)
@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_cli
 
 static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
 {
-	if (val == 0)
-		return 0;
-
-	val = val * data->output_scale - data->output_scale / 2;
-
-	return val * DIV_ROUND_CLOSEST(data->vdd,
-			(1 << data->output_res) * data->output_scale);
+	return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
 }
 
 static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_clie
 		data->sar_shift = MCP3021_SAR_SHIFT;
 		data->sar_mask = MCP3021_SAR_MASK;
 		data->output_res = MCP3021_OUTPUT_RES;
-		data->output_scale = MCP3021_OUTPUT_SCALE;
 		break;
 
 	case mcp3221:
 		data->sar_shift = MCP3221_SAR_SHIFT;
 		data->sar_mask = MCP3221_SAR_MASK;
 		data->output_res = MCP3221_OUTPUT_RES;
-		data->output_scale = MCP3221_OUTPUT_SCALE;
 		break;
 	}
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 192/267] hwmon: (nct7802) fix visibility of temp3
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 191/267] hwmon: (mcp3021) Fix broken output scaling Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 193/267] ARM: dts: mx23: fix iio-hwmon support Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Constantine Shulyupin, Guenter Roeck

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Constantine Shulyupin <const@ctera.com>

commit 56172d81a9bc37a69b95dd627b8d48135c9c7b31 upstream.

Excerpt from datasheet:
7.2.32 Mode Selection Register
RTD3_MD : 00=Closed , 01=Reserved , 10=Thermistor mode , 11=Voltage sense

Show temp3 only in Thermistor mode

Signed-off-by: Constantine Shulyupin <const@MakeLinux.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/nct7802.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/hwmon/nct7802.c
+++ b/drivers/hwmon/nct7802.c
@@ -547,7 +547,7 @@ static umode_t nct7802_temp_is_visible(s
 	if (index >= 9 && index < 18 &&
 	    (reg & 0x0c) != 0x04 && (reg & 0x0c) != 0x08)	/* RD2 */
 		return 0;
-	if (index >= 18 && index < 27 && (reg & 0x30) != 0x10)	/* RD3 */
+	if (index >= 18 && index < 27 && (reg & 0x30) != 0x20)	/* RD3 */
 		return 0;
 	if (index >= 27 && index < 35)				/* local */
 		return attr->mode;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 193/267] ARM: dts: mx23: fix iio-hwmon support
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 192/267] hwmon: (nct7802) fix visibility of temp3 Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 194/267] Btrfs: dont invalidate root dentry when subvolume deletion fails Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Marek Vasut,
	Alexandre Belloni, Shawn Guo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Wahren <stefan.wahren@i2se.com>

commit e8e94ed6285428ab780cd7b0df4622f71eceb39e upstream.

In order to get iio-hwmon support, the lradc must be declared as an
iio provider. So fix this issue by adding the #io-channel-cells property.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Fixes: bd798f9c7b30 ("ARM: dts: mxs: Add iio-hwmon to mx23 soc")
Reviewed-by: Marek Vasut <marex@denx.de>
Reviewed-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/imx23.dtsi |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm/boot/dts/imx23.dtsi
+++ b/arch/arm/boot/dts/imx23.dtsi
@@ -435,6 +435,7 @@
 				interrupts = <36 37 38 39 40 41 42 43 44>;
 				status = "disabled";
 				clocks = <&clks 26>;
+				#io-channel-cells = <1>;
 			};
 
 			spdif@80054000 {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 194/267] Btrfs: dont invalidate root dentry when subvolume deletion fails
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 193/267] ARM: dts: mx23: fix iio-hwmon support Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 195/267] md: fix a build warning Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Markus Schauler, Omar Sandoval, Chris Mason

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Omar Sandoval <osandov@osandov.com>

commit 64ad6c488975d7516230cf7849190a991fd615ae upstream.

Since commit bafc9b754f75 ("vfs: More precise tests in d_invalidate"),
mounted subvolumes can be deleted because d_invalidate() won't fail.
However, we run into problems when we attempt to delete the default
subvolume while it is mounted as the root filesystem:

	# btrfs subvol list /
	ID 257 gen 306 top level 5 path rootvol
	ID 267 gen 334 top level 5 path snap1
	# btrfs subvol get-default /
	ID 267 gen 334 top level 5 path snap1
	# btrfs inspect-internal rootid /
	267
	# mount -o subvol=/ /dev/vda1 /mnt
	# btrfs subvol del /mnt/snap1
	Delete subvolume (no-commit): '/mnt/snap1'
	ERROR: cannot delete '/mnt/snap1' - Operation not permitted
	# findmnt /
	findmnt: can't read /proc/mounts: No such file or directory
	# ls /proc
	#

Markus reported that this same scenario simply led to a kernel oops.

This happens because in btrfs_ioctl_snap_destroy(), we call
d_invalidate() before we check may_destroy_subvol(), which means that we
detach the submounts and drop the dentry before erroring out. Instead,
we should only invalidate the dentry once the deletion has succeeded.
Additionally, the shrink_dcache_sb() isn't necessary; d_invalidate()
will prune the dcache for the deleted subvolume.

Fixes: bafc9b754f75 ("vfs: More precise tests in d_invalidate")
Reported-by: Markus Schauler <mschauler@gmail.com>
Signed-off-by: Omar Sandoval <osandov@osandov.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/ioctl.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2413,8 +2413,6 @@ static noinline int btrfs_ioctl_snap_des
 		goto out_unlock_inode;
 	}
 
-	d_invalidate(dentry);
-
 	down_write(&root->fs_info->subvol_sem);
 
 	err = may_destroy_subvol(dest);
@@ -2508,7 +2506,7 @@ out_up_write:
 out_unlock_inode:
 	mutex_unlock(&inode->i_mutex);
 	if (!err) {
-		shrink_dcache_sb(root->fs_info->sb);
+		d_invalidate(dentry);
 		btrfs_invalidate_inodes(dest);
 		d_delete(dentry);
 		ASSERT(dest->send_in_progress == 0);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 195/267] md: fix a build warning
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 194/267] Btrfs: dont invalidate root dentry when subvolume deletion fails Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 196/267] Btrfs: use kmem_cache_free when freeing entry in inode cache Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Firo Yang, NeilBrown

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Firo Yang <firogm@gmail.com>

commit 4e023612325a9034a542bfab79f78b1fe5ebb841 upstream.

Warning like this:

drivers/md/md.c: In function "update_array_info":
drivers/md/md.c:6394:26: warning: logical not is only applied
to the left hand side of comparison [-Wlogical-not-parentheses]
      !mddev->persistent  != info->not_persistent||

Fix it as Neil Brown said:
mddev->persistent != !info->not_persistent ||

Signed-off-by: Firo Yang <firogm@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6380,7 +6380,7 @@ static int update_array_info(struct mdde
 	    mddev->ctime         != info->ctime         ||
 	    mddev->level         != info->level         ||
 /*	    mddev->layout        != info->layout        || */
-	    !mddev->persistent	 != info->not_persistent||
+	    mddev->persistent	 != !info->not_persistent ||
 	    mddev->chunk_sectors != info->chunk_size >> 9 ||
 	    /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */
 	    ((state^info->state) & 0xfffffe00)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 196/267] Btrfs: use kmem_cache_free when freeing entry in inode cache
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 195/267] md: fix a build warning Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 197/267] Btrfs: fix race between caching kthread and returning inode to " Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Filipe Manana, David Sterba, Chris Mason

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Filipe Manana <fdmanana@suse.com>

commit c3f4a1685bb87e59c886ee68f7967eae07d4dffa upstream.

The free space entries are allocated using kmem_cache_zalloc(),
through __btrfs_add_free_space(), therefore we should use
kmem_cache_free() and not kfree() to avoid any confusion and
any potential problem. Looking at the kfree() definition at
mm/slab.c it has the following comment:

  /*
   * (...)
   *
   * Don't free memory not originally allocated by kmalloc()
   * or you will run into trouble.
   */

So better be safe and use kmem_cache_free().

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/inode-map.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -271,7 +271,7 @@ void btrfs_unpin_free_ino(struct btrfs_r
 		__btrfs_add_free_space(ctl, info->offset, count);
 free:
 		rb_erase(&info->offset_index, rbroot);
-		kfree(info);
+		kmem_cache_free(btrfs_free_space_cachep, info);
 	}
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 197/267] Btrfs: fix race between caching kthread and returning inode to inode cache
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 196/267] Btrfs: use kmem_cache_free when freeing entry in inode cache Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 198/267] Btrfs: fix fsync data loss after append write Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Filipe Manana, Chris Mason

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Filipe Manana <fdmanana@suse.com>

commit ae9d8f17118551bedd797406a6768b87c2146234 upstream.

While the inode cache caching kthread is calling btrfs_unpin_free_ino(),
we could have a concurrent call to btrfs_return_ino() that adds a new
entry to the root's free space cache of pinned inodes. This concurrent
call does not acquire the fs_info->commit_root_sem before adding a new
entry if the caching state is BTRFS_CACHE_FINISHED, which is a problem
because the caching kthread calls btrfs_unpin_free_ino() after setting
the caching state to BTRFS_CACHE_FINISHED and therefore races with
the task calling btrfs_return_ino(), which is adding a new entry, while
the former (caching kthread) is navigating the cache's rbtree, removing
and freeing nodes from the cache's rbtree without acquiring the spinlock
that protects the rbtree.

This race resulted in memory corruption due to double free of struct
btrfs_free_space objects because both tasks can end up doing freeing the
same objects. Note that adding a new entry can result in merging it with
other entries in the cache, in which case those entries are freed.
This is particularly important as btrfs_free_space structures are also
used for the block group free space caches.

This memory corruption can be detected by a debugging kernel, which
reports it with the following trace:

[132408.501148] slab error in verify_redzone_free(): cache `btrfs_free_space': double free detected
[132408.505075] CPU: 15 PID: 12248 Comm: btrfs-ino-cache Tainted: G        W       4.1.0-rc5-btrfs-next-10+ #1
[132408.505075] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
[132408.505075]  ffff880023e7d320 ffff880163d73cd8 ffffffff8145eec7 ffffffff81095dce
[132408.505075]  ffff880009735d40 ffff880163d73ce8 ffffffff81154e1e ffff880163d73d68
[132408.505075]  ffffffff81155733 ffffffffa054a95a ffff8801b6099f00 ffffffffa0505b5f
[132408.505075] Call Trace:
[132408.505075]  [<ffffffff8145eec7>] dump_stack+0x4f/0x7b
[132408.505075]  [<ffffffff81095dce>] ? console_unlock+0x356/0x3a2
[132408.505075]  [<ffffffff81154e1e>] __slab_error.isra.28+0x25/0x36
[132408.505075]  [<ffffffff81155733>] __cache_free+0xe2/0x4b6
[132408.505075]  [<ffffffffa054a95a>] ? __btrfs_add_free_space+0x2f0/0x343 [btrfs]
[132408.505075]  [<ffffffffa0505b5f>] ? btrfs_unpin_free_ino+0x8e/0x99 [btrfs]
[132408.505075]  [<ffffffff810f3b30>] ? time_hardirqs_off+0x15/0x28
[132408.505075]  [<ffffffff81084d42>] ? trace_hardirqs_off+0xd/0xf
[132408.505075]  [<ffffffff811563a1>] ? kfree+0xb6/0x14e
[132408.505075]  [<ffffffff811563d0>] kfree+0xe5/0x14e
[132408.505075]  [<ffffffffa0505b5f>] btrfs_unpin_free_ino+0x8e/0x99 [btrfs]
[132408.505075]  [<ffffffffa0505e08>] caching_kthread+0x29e/0x2d9 [btrfs]
[132408.505075]  [<ffffffffa0505b6a>] ? btrfs_unpin_free_ino+0x99/0x99 [btrfs]
[132408.505075]  [<ffffffff8106698f>] kthread+0xef/0xf7
[132408.505075]  [<ffffffff810f3b08>] ? time_hardirqs_on+0x15/0x28
[132408.505075]  [<ffffffff810668a0>] ? __kthread_parkme+0xad/0xad
[132408.505075]  [<ffffffff814653d2>] ret_from_fork+0x42/0x70
[132408.505075]  [<ffffffff810668a0>] ? __kthread_parkme+0xad/0xad
[132408.505075] ffff880023e7d320: redzone 1:0x9f911029d74e35b, redzone 2:0x9f911029d74e35b.
[132409.501654] slab: double free detected in cache 'btrfs_free_space', objp ffff880023e7d320
[132409.503355] ------------[ cut here ]------------
[132409.504241] kernel BUG at mm/slab.c:2571!

Therefore fix this by having btrfs_unpin_free_ino() acquire the lock
that protects the rbtree while doing the searches and removing entries.

Fixes: 1c70d8fb4dfa ("Btrfs: fix inode caching vs tree log")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/inode-map.c |   15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -246,6 +246,7 @@ void btrfs_unpin_free_ino(struct btrfs_r
 {
 	struct btrfs_free_space_ctl *ctl = root->free_ino_ctl;
 	struct rb_root *rbroot = &root->free_ino_pinned->free_space_offset;
+	spinlock_t *rbroot_lock = &root->free_ino_pinned->tree_lock;
 	struct btrfs_free_space *info;
 	struct rb_node *n;
 	u64 count;
@@ -254,23 +255,29 @@ void btrfs_unpin_free_ino(struct btrfs_r
 		return;
 
 	while (1) {
+		bool add_to_ctl = true;
+
+		spin_lock(rbroot_lock);
 		n = rb_first(rbroot);
-		if (!n)
+		if (!n) {
+			spin_unlock(rbroot_lock);
 			break;
+		}
 
 		info = rb_entry(n, struct btrfs_free_space, offset_index);
 		BUG_ON(info->bitmap); /* Logic error */
 
 		if (info->offset > root->ino_cache_progress)
-			goto free;
+			add_to_ctl = false;
 		else if (info->offset + info->bytes > root->ino_cache_progress)
 			count = root->ino_cache_progress - info->offset + 1;
 		else
 			count = info->bytes;
 
-		__btrfs_add_free_space(ctl, info->offset, count);
-free:
 		rb_erase(&info->offset_index, rbroot);
+		spin_unlock(rbroot_lock);
+		if (add_to_ctl)
+			__btrfs_add_free_space(ctl, info->offset, count);
 		kmem_cache_free(btrfs_free_space_cachep, info);
 	}
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 198/267] Btrfs: fix fsync data loss after append write
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 197/267] Btrfs: fix race between caching kthread and returning inode to " Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 199/267] Btrfs: fix memory leak in the extent_same ioctl Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Filipe Manana, Liu Bo, Chris Mason

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Filipe Manana <fdmanana@suse.com>

commit e4545de5b035c7debb73d260c78377dbb69cbfb5 upstream.

If we do an append write to a file (which increases its inode's i_size)
that does not have the flag BTRFS_INODE_NEEDS_FULL_SYNC set in its inode,
and the previous transaction added a new hard link to the file, which sets
the flag BTRFS_INODE_COPY_EVERYTHING in the file's inode, and then fsync
the file, the inode's new i_size isn't logged. This has the consequence
that after the fsync log is replayed, the file size remains what it was
before the append write operation, which means users/applications will
not be able to read the data that was successsfully fsync'ed before.

This happens because neither the inode item nor the delayed inode get
their i_size updated when the append write is made - doing so would
require starting a transaction in the buffered write path, something that
we do not do intentionally for performance reasons.

Fix this by making sure that when the flag BTRFS_INODE_COPY_EVERYTHING is
set the inode is logged with its current i_size (log the in-memory inode
into the log tree).

This issue is not a recent regression and is easy to reproduce with the
following test case for fstests:

  seq=`basename $0`
  seqres=$RESULT_DIR/$seq
  echo "QA output created by $seq"

  here=`pwd`
  tmp=/tmp/$$
  status=1	# failure is the default!

  _cleanup()
  {
          _cleanup_flakey
          rm -f $tmp.*
  }
  trap "_cleanup; exit \$status" 0 1 2 3 15

  # get standard environment, filters and checks
  . ./common/rc
  . ./common/filter
  . ./common/dmflakey

  # real QA test starts here
  _supported_fs generic
  _supported_os Linux
  _need_to_be_root
  _require_scratch
  _require_dm_flakey
  _require_metadata_journaling $SCRATCH_DEV

  _crash_and_mount()
  {
          # Simulate a crash/power loss.
          _load_flakey_table $FLAKEY_DROP_WRITES
          _unmount_flakey
          # Allow writes again and mount. This makes the fs replay its fsync log.
          _load_flakey_table $FLAKEY_ALLOW_WRITES
          _mount_flakey
  }

  rm -f $seqres.full

  _scratch_mkfs >> $seqres.full 2>&1
  _init_flakey
  _mount_flakey

  # Create the test file with some initial data and then fsync it.
  # The fsync here is only needed to trigger the issue in btrfs, as it causes the
  # the flag BTRFS_INODE_NEEDS_FULL_SYNC to be removed from the btrfs inode.
  $XFS_IO_PROG -f -c "pwrite -S 0xaa 0 32k" \
                  -c "fsync" \
                  $SCRATCH_MNT/foo | _filter_xfs_io
  sync

  # Add a hard link to our file.
  # On btrfs this sets the flag BTRFS_INODE_COPY_EVERYTHING on the btrfs inode,
  # which is a necessary condition to trigger the issue.
  ln $SCRATCH_MNT/foo $SCRATCH_MNT/bar

  # Sync the filesystem to force a commit of the current btrfs transaction, this
  # is a necessary condition to trigger the bug on btrfs.
  sync

  # Now append more data to our file, increasing its size, and fsync the file.
  # In btrfs because the inode flag BTRFS_INODE_COPY_EVERYTHING was set and the
  # write path did not update the inode item in the btree nor the delayed inode
  # item (in memory struture) in the current transaction (created by the fsync
  # handler), the fsync did not record the inode's new i_size in the fsync
  # log/journal. This made the data unavailable after the fsync log/journal is
  # replayed.
  $XFS_IO_PROG -c "pwrite -S 0xbb 32K 32K" \
               -c "fsync" \
               $SCRATCH_MNT/foo | _filter_xfs_io

  echo "File content after fsync and before crash:"
  od -t x1 $SCRATCH_MNT/foo

  _crash_and_mount

  echo "File content after crash and log replay:"
  od -t x1 $SCRATCH_MNT/foo

  status=0
  exit

The expected file output before and after the crash/power failure expects the
appended data to be available, which is:

  0000000 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
  *
  0100000 bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb
  *
  0200000

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/tree-log.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4161,6 +4161,7 @@ static int btrfs_log_inode(struct btrfs_
 	u64 ino = btrfs_ino(inode);
 	struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
 	u64 logged_isize = 0;
+	bool need_log_inode_item = true;
 
 	path = btrfs_alloc_path();
 	if (!path)
@@ -4269,11 +4270,6 @@ static int btrfs_log_inode(struct btrfs_
 		} else {
 			if (inode_only == LOG_INODE_ALL)
 				fast_search = true;
-			ret = log_inode_item(trans, log, dst_path, inode);
-			if (ret) {
-				err = ret;
-				goto out_unlock;
-			}
 			goto log_extents;
 		}
 
@@ -4296,6 +4292,9 @@ again:
 		if (min_key.type > max_key.type)
 			break;
 
+		if (min_key.type == BTRFS_INODE_ITEM_KEY)
+			need_log_inode_item = false;
+
 		src = path->nodes[0];
 		if (ins_nr && ins_start_slot + ins_nr == path->slots[0]) {
 			ins_nr++;
@@ -4366,6 +4365,11 @@ next_slot:
 log_extents:
 	btrfs_release_path(path);
 	btrfs_release_path(dst_path);
+	if (need_log_inode_item) {
+		err = log_inode_item(trans, log, dst_path, inode);
+		if (err)
+			goto out_unlock;
+	}
 	if (fast_search) {
 		/*
 		 * Some ordered extents started by fsync might have completed



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 199/267] Btrfs: fix memory leak in the extent_same ioctl
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 198/267] Btrfs: fix fsync data loss after append write Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 200/267] Btrfs: fix list transaction->pending_ordered corruption Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julian Taylor, Marcel Ritter,
	Filipe Manana, Mark Fasheh

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Filipe Manana <fdmanana@suse.com>

commit 497b4050e0eacd4c746dd396d14916b1e669849d upstream.

We were allocating memory with memdup_user() but we were never releasing
that memory. This affected pretty much every call to the ioctl, whether
it deduplicated extents or not.

This issue was reported on IRC by Julian Taylor and on the mailing list
by Marcel Ritter, credit goes to them for finding the issue.

Reported-by: Julian Taylor <jtaylor.debian@googlemail.com>
Reported-by: Marcel Ritter <ritter.marcel@gmail.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Mark Fasheh <mfasheh@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/ioctl.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2938,7 +2938,7 @@ out_unlock:
 static long btrfs_ioctl_file_extent_same(struct file *file,
 			struct btrfs_ioctl_same_args __user *argp)
 {
-	struct btrfs_ioctl_same_args *same;
+	struct btrfs_ioctl_same_args *same = NULL;
 	struct btrfs_ioctl_same_extent_info *info;
 	struct inode *src = file_inode(file);
 	u64 off;
@@ -2968,6 +2968,7 @@ static long btrfs_ioctl_file_extent_same
 
 	if (IS_ERR(same)) {
 		ret = PTR_ERR(same);
+		same = NULL;
 		goto out;
 	}
 
@@ -3038,6 +3039,7 @@ static long btrfs_ioctl_file_extent_same
 
 out:
 	mnt_drop_write_file(file);
+	kfree(same);
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 200/267] Btrfs: fix list transaction->pending_ordered corruption
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 199/267] Btrfs: fix memory leak in the extent_same ioctl Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 201/267] Btrfs: fix file corruption after cloning inline extents Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Filipe Manana, David Sterba

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Filipe Manana <fdmanana@suse.com>

commit d3efe08400317888f559bbedf0e42cd31575d0ef upstream.

When we call btrfs_commit_transaction(), we splice the list "ordered"
of our transaction handle into the transaction's "pending_ordered"
list, but we don't re-initialize the "ordered" list of our transaction
handle, this means it still points to the same elements it used to
before the splice. Then we check if the current transaction's state is
>= TRANS_STATE_COMMIT_START and if it is we end up calling
btrfs_end_transaction() which simply splices again the "ordered" list
of our handle into the transaction's "pending_ordered" list, leaving
multiple pointers to the same ordered extents which results in list
corruption when we are iterating, removing and freeing ordered extents
at btrfs_wait_pending_ordered(), resulting in access to dangling
pointers / use-after-free issues.
Similarly, btrfs_end_transaction() can end up in some cases calling
btrfs_commit_transaction(), and both did a list splice of the transaction
handle's "ordered" list into the transaction's "pending_ordered" without
re-initializing the handle's "ordered" list, resulting in exactly the
same problem.

This produces the following warning on a kernel with linked list
debugging enabled:

[109749.265416] ------------[ cut here ]------------
[109749.266410] WARNING: CPU: 7 PID: 324 at lib/list_debug.c:59 __list_del_entry+0x5a/0x98()
[109749.267969] list_del corruption. prev->next should be ffff8800ba087e20, but was fffffff8c1f7c35d
(...)
[109749.287505] Call Trace:
[109749.288135]  [<ffffffff8145f077>] dump_stack+0x4f/0x7b
[109749.298080]  [<ffffffff81095de5>] ? console_unlock+0x356/0x3a2
[109749.331605]  [<ffffffff8104b3b0>] warn_slowpath_common+0xa1/0xbb
[109749.334849]  [<ffffffff81260642>] ? __list_del_entry+0x5a/0x98
[109749.337093]  [<ffffffff8104b410>] warn_slowpath_fmt+0x46/0x48
[109749.337847]  [<ffffffff81260642>] __list_del_entry+0x5a/0x98
[109749.338678]  [<ffffffffa053e8bf>] btrfs_wait_pending_ordered+0x46/0xdb [btrfs]
[109749.340145]  [<ffffffffa058a65f>] ? __btrfs_run_delayed_items+0x149/0x163 [btrfs]
[109749.348313]  [<ffffffffa054077d>] btrfs_commit_transaction+0x36b/0xa10 [btrfs]
[109749.349745]  [<ffffffff81087310>] ? trace_hardirqs_on+0xd/0xf
[109749.350819]  [<ffffffffa055370d>] btrfs_sync_file+0x36f/0x3fc [btrfs]
[109749.351976]  [<ffffffff8118ec98>] vfs_fsync_range+0x8f/0x9e
[109749.360341]  [<ffffffff8118ecc3>] vfs_fsync+0x1c/0x1e
[109749.368828]  [<ffffffff8118ee1d>] do_fsync+0x34/0x4e
[109749.369790]  [<ffffffff8118f045>] SyS_fsync+0x10/0x14
[109749.370925]  [<ffffffff81465197>] system_call_fastpath+0x12/0x6f
[109749.382274] ---[ end trace 48e0d07f7c03d95a ]---

On a non-debug kernel this leads to invalid memory accesses, causing a
crash. Fix this by using list_splice_init() instead of list_splice() in
btrfs_commit_transaction() and btrfs_end_transaction().

Fixes: 50d9aa99bd35 ("Btrfs: make sure logged extents complete in the current transaction V3"
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/transaction.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -758,7 +758,7 @@ static int __btrfs_end_transaction(struc
 
 	if (!list_empty(&trans->ordered)) {
 		spin_lock(&info->trans_lock);
-		list_splice(&trans->ordered, &cur_trans->pending_ordered);
+		list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
 		spin_unlock(&info->trans_lock);
 	}
 
@@ -1848,7 +1848,7 @@ int btrfs_commit_transaction(struct btrf
 	}
 
 	spin_lock(&root->fs_info->trans_lock);
-	list_splice(&trans->ordered, &cur_trans->pending_ordered);
+	list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
 	if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
 		spin_unlock(&root->fs_info->trans_lock);
 		atomic_inc(&cur_trans->use_count);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 201/267] Btrfs: fix file corruption after cloning inline extents
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 200/267] Btrfs: fix list transaction->pending_ordered corruption Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 202/267] selinux: dont waste ebitmap space when importing NetLabel categories Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Filipe Manana

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Filipe Manana <fdmanana@suse.com>

commit ed958762644b404654a6f5d23e869f496fe127c6 upstream.

Using the clone ioctl (or extent_same ioctl, which calls the same extent
cloning function as well) we end up allowing copy an inline extent from
the source file into a non-zero offset of the destination file. This is
something not expected and that the btrfs code is not prepared to deal
with - all inline extents must be at a file offset equals to 0.

For example, the following excerpt of a test case for fstests triggers
a crash/BUG_ON() on a write operation after an inline extent is cloned
into a non-zero offset:

  _scratch_mkfs >>$seqres.full 2>&1
  _scratch_mount

  # Create our test files. File foo has the same 2K of data at offset 4K
  # as file bar has at its offset 0.
  $XFS_IO_PROG -f -s -c "pwrite -S 0xaa 0 4K" \
      -c "pwrite -S 0xbb 4k 2K" \
      -c "pwrite -S 0xcc 8K 4K" \
      $SCRATCH_MNT/foo | _filter_xfs_io

  # File bar consists of a single inline extent (2K size).
  $XFS_IO_PROG -f -s -c "pwrite -S 0xbb 0 2K" \
     $SCRATCH_MNT/bar | _filter_xfs_io

  # Now call the clone ioctl to clone the extent of file bar into file
  # foo at its offset 4K. This made file foo have an inline extent at
  # offset 4K, something which the btrfs code can not deal with in future
  # IO operations because all inline extents are supposed to start at an
  # offset of 0, resulting in all sorts of chaos.
  # So here we validate that clone ioctl returns an EOPNOTSUPP, which is
  # what it returns for other cases dealing with inlined extents.
  $CLONER_PROG -s 0 -d $((4 * 1024)) -l $((2 * 1024)) \
      $SCRATCH_MNT/bar $SCRATCH_MNT/foo

  # Because of the inline extent at offset 4K, the following write made
  # the kernel crash with a BUG_ON().
  $XFS_IO_PROG -c "pwrite -S 0xdd 6K 2K" $SCRATCH_MNT/foo | _filter_xfs_io

  status=0
  exit

The stack trace of the BUG_ON() triggered by the last write is:

  [152154.035903] ------------[ cut here ]------------
  [152154.036424] kernel BUG at mm/page-writeback.c:2286!
  [152154.036424] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
  [152154.036424] Modules linked in: btrfs dm_flakey dm_mod crc32c_generic xor raid6_pq nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc loop fuse parport_pc acpi_cpu$
  [152154.036424] CPU: 2 PID: 17873 Comm: xfs_io Tainted: G        W       4.1.0-rc6-btrfs-next-11+ #2
  [152154.036424] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
  [152154.036424] task: ffff880429f70990 ti: ffff880429efc000 task.ti: ffff880429efc000
  [152154.036424] RIP: 0010:[<ffffffff8111a9d5>]  [<ffffffff8111a9d5>] clear_page_dirty_for_io+0x1e/0x90
  [152154.036424] RSP: 0018:ffff880429effc68  EFLAGS: 00010246
  [152154.036424] RAX: 0200000000000806 RBX: ffffea0006a6d8f0 RCX: 0000000000000001
  [152154.036424] RDX: 0000000000000000 RSI: ffffffff81155d1b RDI: ffffea0006a6d8f0
  [152154.036424] RBP: ffff880429effc78 R08: ffff8801ce389fe0 R09: 0000000000000001
  [152154.036424] R10: 0000000000002000 R11: ffffffffffffffff R12: ffff8800200dce68
  [152154.036424] R13: 0000000000000000 R14: ffff8800200dcc88 R15: ffff8803d5736d80
  [152154.036424] FS:  00007fbf119f6700(0000) GS:ffff88043d280000(0000) knlGS:0000000000000000
  [152154.036424] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [152154.036424] CR2: 0000000001bdc000 CR3: 00000003aa555000 CR4: 00000000000006e0
  [152154.036424] Stack:
  [152154.036424]  ffff8803d5736d80 0000000000000001 ffff880429effcd8 ffffffffa04e97c1
  [152154.036424]  ffff880429effd68 ffff880429effd60 0000000000000001 ffff8800200dc9c8
  [152154.036424]  0000000000000001 ffff8800200dcc88 0000000000000000 0000000000001000
  [152154.036424] Call Trace:
  [152154.036424]  [<ffffffffa04e97c1>] lock_and_cleanup_extent_if_need+0x147/0x18d [btrfs]
  [152154.036424]  [<ffffffffa04ea82c>] __btrfs_buffered_write+0x245/0x4c8 [btrfs]
  [152154.036424]  [<ffffffffa04ed14b>] ? btrfs_file_write_iter+0x150/0x3e0 [btrfs]
  [152154.036424]  [<ffffffffa04ed15a>] ? btrfs_file_write_iter+0x15f/0x3e0 [btrfs]
  [152154.036424]  [<ffffffffa04ed2c7>] btrfs_file_write_iter+0x2cc/0x3e0 [btrfs]
  [152154.036424]  [<ffffffff81165a4a>] __vfs_write+0x7c/0xa5
  [152154.036424]  [<ffffffff81165f89>] vfs_write+0xa0/0xe4
  [152154.036424]  [<ffffffff81166855>] SyS_pwrite64+0x64/0x82
  [152154.036424]  [<ffffffff81465197>] system_call_fastpath+0x12/0x6f
  [152154.036424] Code: 48 89 c7 e8 0f ff ff ff 5b 41 5c 5d c3 0f 1f 44 00 00 55 48 89 e5 41 54 53 48 89 fb e8 ae ef 00 00 49 89 c4 48 8b 03 a8 01 75 02 <0f> 0b 4d 85 e4 74 59 49 8b 3c 2$
  [152154.036424] RIP  [<ffffffff8111a9d5>] clear_page_dirty_for_io+0x1e/0x90
  [152154.036424]  RSP <ffff880429effc68>
  [152154.242621] ---[ end trace e3d3376b23a57041 ]---

Fix this by returning the error EOPNOTSUPP if an attempt to copy an
inline extent into a non-zero offset happens, just like what is done for
other scenarios that would require copying/splitting inline extents,
which were introduced by the following commits:

   00fdf13a2e9f ("Btrfs: fix a crash of clone with inline extents's split")
   3f9e3df8da3c ("btrfs: replace error code from btrfs_drop_extents")

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/ioctl.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3434,6 +3434,20 @@ process_slot:
 				u64 trim = 0;
 				u64 aligned_end = 0;
 
+				/*
+				 * Don't copy an inline extent into an offset
+				 * greater than zero. Having an inline extent
+				 * at such an offset results in chaos as btrfs
+				 * isn't prepared for such cases. Just skip
+				 * this case for the same reasons as commented
+				 * at btrfs_ioctl_clone().
+				 */
+				if (last_dest_end > 0) {
+					ret = -EOPNOTSUPP;
+					btrfs_end_transaction(trans, root);
+					goto out;
+				}
+
 				if (off > key.offset) {
 					skip = off - key.offset;
 					new_key.offset += skip;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 202/267] selinux: dont waste ebitmap space when importing NetLabel categories
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 201/267] Btrfs: fix file corruption after cloning inline extents Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 203/267] selinux: fix mprotect PROT_EXEC regression caused by mm change Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Moore

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Moore <pmoore@redhat.com>

commit 3324603524925c7727207027d1c15e597412d15e upstream.

At present we don't create efficient ebitmaps when importing NetLabel
category bitmaps.  This can present a problem when comparing ebitmaps
since ebitmap_cmp() is very strict about these things and considers
these wasteful ebitmaps not equal when compared to their more
efficient counterparts, even if their values are the same.  This isn't
likely to cause problems on 64-bit systems due to a bit of luck on
how NetLabel/CIPSO works and the default ebitmap size, but it can be
a problem on 32-bit systems.

This patch fixes this problem by being a bit more intelligent when
importing NetLabel category bitmaps by skipping over empty sections
which should result in a nice, efficient ebitmap.

Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/selinux/ss/ebitmap.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -153,6 +153,12 @@ int ebitmap_netlbl_import(struct ebitmap
 		if (offset == (u32)-1)
 			return 0;
 
+		/* don't waste ebitmap space if the netlabel bitmap is empty */
+		if (bitmap == 0) {
+			offset += EBITMAP_UNIT_SIZE;
+			continue;
+		}
+
 		if (e_iter == NULL ||
 		    offset >= e_iter->startbit + EBITMAP_SIZE) {
 			e_prev = e_iter;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 203/267] selinux: fix mprotect PROT_EXEC regression caused by mm change
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 202/267] selinux: dont waste ebitmap space when importing NetLabel categories Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 204/267] fuse: initialize fc->release before calling it Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stephen Smalley, Paul Moore

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stephen Smalley <sds@tycho.nsa.gov>

commit 892e8cac99a71f6254f84fc662068d912e1943bf upstream.

commit 66fc13039422ba7df2d01a8ee0873e4ef965b50b ("mm: shmem_zero_setup
skip security check and lockdep conflict with XFS") caused a regression
for SELinux by disabling any SELinux checking of mprotect PROT_EXEC on
shared anonymous mappings.  However, even before that regression, the
checking on such mprotect PROT_EXEC calls was inconsistent with the
checking on a mmap PROT_EXEC call for a shared anonymous mapping.  On a
mmap, the security hook is passed a NULL file and knows it is dealing
with an anonymous mapping and therefore applies an execmem check and no
file checks.  On a mprotect, the security hook is passed a vma with a
non-NULL vm_file (as this was set from the internally-created shmem
file during mmap) and therefore applies the file-based execute check
and no execmem check.  Since the aforementioned commit now marks the
shmem zero inode with the S_PRIVATE flag, the file checks are disabled
and we have no checking at all on mprotect PROT_EXEC.  Add a test to
the mprotect hook logic for such private inodes, and apply an execmem
check in that case.  This makes the mmap and mprotect checking
consistent for shared anonymous mappings, as well as for /dev/zero and
ashmem.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/selinux/hooks.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3288,7 +3288,8 @@ static int file_map_prot_check(struct fi
 	int rc = 0;
 
 	if (default_noexec &&
-	    (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
+	    (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
+				   (!shared && (prot & PROT_WRITE)))) {
 		/*
 		 * We are making executable an anonymous mapping or a
 		 * private file mapping that will also be writable.



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 204/267] fuse: initialize fc->release before calling it
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 203/267] selinux: fix mprotect PROT_EXEC regression caused by mm change Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 205/267] crush: fix a bug in tree bucket decode Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@suse.cz>

commit 0ad0b3255a08020eaf50e34ef0d6df5bdf5e09ed upstream.

fc->release is called from fuse_conn_put() which was used in the error
cleanup before fc->release was initialized.

[Jeremiah Mahler <jmmahler@gmail.com>: assign fc->release after calling
fuse_conn_init(fc) instead of before.]

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Fixes: a325f9b92273 ("fuse: update fuse_conn_init() and separate out fuse_conn_kill()")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/fuse/inode.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_
 		goto err_fput;
 
 	fuse_conn_init(fc);
+	fc->release = fuse_free_conn;
 
 	fc->dev = sb->s_dev;
 	fc->sb = sb;
@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_
 		fc->dont_mask = 1;
 	sb->s_flags |= MS_POSIXACL;
 
-	fc->release = fuse_free_conn;
 	fc->flags = d.flags;
 	fc->user_id = d.user_id;
 	fc->group_id = d.group_id;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 205/267] crush: fix a bug in tree bucket decode
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 204/267] fuse: initialize fc->release before calling it Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 206/267] ACPI / resources: free memory on error in add_region_before() Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Josh Durgin

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Dryomov <idryomov@gmail.com>

commit 82cd003a77173c91b9acad8033fb7931dac8d751 upstream.

struct crush_bucket_tree::num_nodes is u8, so ceph_decode_8_safe()
should be used.  -Wconversion catches this, but I guess it went
unnoticed in all the noise it spews.  The actual problem (at least for
common crushmaps) isn't the u32 -> u8 truncation though - it's the
advancement by 4 bytes instead of 1 in the crushmap buffer.

Fixes: http://tracker.ceph.com/issues/2759

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Josh Durgin <jdurgin@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ceph/osdmap.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void
 {
 	int j;
 	dout("crush_decode_tree_bucket %p to %p\n", *p, end);
-	ceph_decode_32_safe(p, end, b->num_nodes, bad);
+	ceph_decode_8_safe(p, end, b->num_nodes, bad);
 	b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
 	if (b->node_weights == NULL)
 		return -ENOMEM;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 206/267] ACPI / resources: free memory on error in add_region_before()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 205/267] crush: fix a bug in tree bucket decode Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 207/267] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Rafael J. Wysocki

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 7bc10388ccdd79b3d20463151a1f8e7a590a775b upstream.

There is a small memory leak on error.

Fixes: 0f1b414d1907 (ACPI / PNP: Avoid conflicting resource reservations)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/resource.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -660,8 +660,10 @@ static int add_region_before(u64 start,
 		return -ENOMEM;
 
 	error = request_range(start, end, space_id, flags, desc);
-	if (error)
+	if (error) {
+		kfree(reg);
 		return error;
+	}
 
 	reg->start = start;
 	reg->end = end;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 207/267] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 206/267] ACPI / resources: free memory on error in add_region_before() Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:40 ` [PATCH 4.1 208/267] ACPI / LPSS: Fix up acpi_lpss_create_device() Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Roland Dreier, Rafael J. Wysocki

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>

commit 0294112ee3135fbd15eaa70015af8283642dd970 upstream.

This effectively reverts the following three commits:

 7bc10388ccdd ACPI / resources: free memory on error in add_region_before()
 0f1b414d1907 ACPI / PNP: Avoid conflicting resource reservations
 b9a5e5e18fbf ACPI / init: Fix the ordering of acpi_reserve_resources()

(commit b9a5e5e18fbf introduced regressions some of which, but not
all, were addressed by commit 0f1b414d1907 and commit 7bc10388ccdd
was a fixup on top of the latter) and causes ACPI fixed hardware
resources to be reserved at the fs_initcall_sync stage of system
initialization.

The story is as follows.  First, a boot regression was reported due
to an apparent resource reservation ordering change after a commit
that shouldn't lead to such changes.  Investigation led to the
conclusion that the problem happened because acpi_reserve_resources()
was executed at the device_initcall() stage of system initialization
which wasn't strictly ordered with respect to driver initialization
(and with respect to the initialization of the pcieport driver in
particular), so a random change causing the device initcalls to be
run in a different order might break things.

The response to that was to attempt to run acpi_reserve_resources()
as soon as we knew that ACPI would be in use (commit b9a5e5e18fbf).
However, that turned out to be too early, because it caused resource
reservations made by the PNP system driver to fail on at least one
system and that failure was addressed by commit 0f1b414d1907.

That fix still turned out to be insufficient, though, because
calling acpi_reserve_resources() before the fs_initcall stage of
system initialization caused a boot regression to happen on the
eCAFE EC-800-H20G/S netbook.  That meant that we only could call
acpi_reserve_resources() at the fs_initcall initialization stage
or later, but then we might just as well call it after the PNP
initalization in which case commit 0f1b414d1907 wouldn't be
necessary any more.

For this reason, the changes made by commit 0f1b414d1907 are reverted
(along with a memory leak fixup on top of that commit), the changes
made by commit b9a5e5e18fbf that went too far are reverted too and
acpi_reserve_resources() is changed into fs_initcall_sync, which
will cause it to be executed after the PNP subsystem initialization
(which is an fs_initcall) and before device initcalls (including
the pcieport driver initialization) which should avoid the initial
issue.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=100581
Link: http://marc.info/?t=143092384600002&r=1&w=2
Link: https://bugzilla.kernel.org/show_bug.cgi?id=99831
Link: http://marc.info/?t=143389402600001&r=1&w=2
Fixes: b9a5e5e18fbf "ACPI / init: Fix the ordering of acpi_reserve_resources()"
Reported-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/osl.c      |   12 ++-
 drivers/acpi/resource.c |  162 ------------------------------------------------
 drivers/pnp/system.c    |   35 ++--------
 include/linux/acpi.h    |   10 --
 4 files changed, 18 insertions(+), 201 deletions(-)

--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -175,10 +175,14 @@ static void __init acpi_request_region (
 	if (!addr || !length)
 		return;
 
-	acpi_reserve_region(addr, length, gas->space_id, 0, desc);
+	/* Resources are never freed */
+	if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO)
+		request_region(addr, length, desc);
+	else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+		request_mem_region(addr, length, desc);
 }
 
-static void __init acpi_reserve_resources(void)
+static int __init acpi_reserve_resources(void)
 {
 	acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
 		"ACPI PM1a_EVT_BLK");
@@ -207,7 +211,10 @@ static void __init acpi_reserve_resource
 	if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
 		acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
 			       acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+
+	return 0;
 }
+fs_initcall_sync(acpi_reserve_resources);
 
 void acpi_os_printf(const char *fmt, ...)
 {
@@ -1838,7 +1845,6 @@ acpi_status __init acpi_os_initialize(vo
 
 acpi_status __init acpi_os_initialize1(void)
 {
-	acpi_reserve_resources();
 	kacpid_wq = alloc_workqueue("kacpid", 0, 1);
 	kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
 	kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0);
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -26,7 +26,6 @@
 #include <linux/device.h>
 #include <linux/export.h>
 #include <linux/ioport.h>
-#include <linux/list.h>
 #include <linux/slab.h>
 
 #ifdef CONFIG_X86
@@ -622,164 +621,3 @@ int acpi_dev_filter_resource_type(struct
 	return (type & types) ? 0 : 1;
 }
 EXPORT_SYMBOL_GPL(acpi_dev_filter_resource_type);
-
-struct reserved_region {
-	struct list_head node;
-	u64 start;
-	u64 end;
-};
-
-static LIST_HEAD(reserved_io_regions);
-static LIST_HEAD(reserved_mem_regions);
-
-static int request_range(u64 start, u64 end, u8 space_id, unsigned long flags,
-			 char *desc)
-{
-	unsigned int length = end - start + 1;
-	struct resource *res;
-
-	res = space_id == ACPI_ADR_SPACE_SYSTEM_IO ?
-		request_region(start, length, desc) :
-		request_mem_region(start, length, desc);
-	if (!res)
-		return -EIO;
-
-	res->flags &= ~flags;
-	return 0;
-}
-
-static int add_region_before(u64 start, u64 end, u8 space_id,
-			     unsigned long flags, char *desc,
-			     struct list_head *head)
-{
-	struct reserved_region *reg;
-	int error;
-
-	reg = kmalloc(sizeof(*reg), GFP_KERNEL);
-	if (!reg)
-		return -ENOMEM;
-
-	error = request_range(start, end, space_id, flags, desc);
-	if (error) {
-		kfree(reg);
-		return error;
-	}
-
-	reg->start = start;
-	reg->end = end;
-	list_add_tail(&reg->node, head);
-	return 0;
-}
-
-/**
- * acpi_reserve_region - Reserve an I/O or memory region as a system resource.
- * @start: Starting address of the region.
- * @length: Length of the region.
- * @space_id: Identifier of address space to reserve the region from.
- * @flags: Resource flags to clear for the region after requesting it.
- * @desc: Region description (for messages).
- *
- * Reserve an I/O or memory region as a system resource to prevent others from
- * using it.  If the new region overlaps with one of the regions (in the given
- * address space) already reserved by this routine, only the non-overlapping
- * parts of it will be reserved.
- *
- * Returned is either 0 (success) or a negative error code indicating a resource
- * reservation problem.  It is the code of the first encountered error, but the
- * routine doesn't abort until it has attempted to request all of the parts of
- * the new region that don't overlap with other regions reserved previously.
- *
- * The resources requested by this routine are never released.
- */
-int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
-			unsigned long flags, char *desc)
-{
-	struct list_head *regions;
-	struct reserved_region *reg;
-	u64 end = start + length - 1;
-	int ret = 0, error = 0;
-
-	if (space_id == ACPI_ADR_SPACE_SYSTEM_IO)
-		regions = &reserved_io_regions;
-	else if (space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
-		regions = &reserved_mem_regions;
-	else
-		return -EINVAL;
-
-	if (list_empty(regions))
-		return add_region_before(start, end, space_id, flags, desc, regions);
-
-	list_for_each_entry(reg, regions, node)
-		if (reg->start == end + 1) {
-			/* The new region can be prepended to this one. */
-			ret = request_range(start, end, space_id, flags, desc);
-			if (!ret)
-				reg->start = start;
-
-			return ret;
-		} else if (reg->start > end) {
-			/* No overlap.  Add the new region here and get out. */
-			return add_region_before(start, end, space_id, flags,
-						 desc, &reg->node);
-		} else if (reg->end == start - 1) {
-			goto combine;
-		} else if (reg->end >= start) {
-			goto overlap;
-		}
-
-	/* The new region goes after the last existing one. */
-	return add_region_before(start, end, space_id, flags, desc, regions);
-
- overlap:
-	/*
-	 * The new region overlaps an existing one.
-	 *
-	 * The head part of the new region immediately preceding the existing
-	 * overlapping one can be combined with it right away.
-	 */
-	if (reg->start > start) {
-		error = request_range(start, reg->start - 1, space_id, flags, desc);
-		if (error)
-			ret = error;
-		else
-			reg->start = start;
-	}
-
- combine:
-	/*
-	 * The new region is adjacent to an existing one.  If it extends beyond
-	 * that region all the way to the next one, it is possible to combine
-	 * all three of them.
-	 */
-	while (reg->end < end) {
-		struct reserved_region *next = NULL;
-		u64 a = reg->end + 1, b = end;
-
-		if (!list_is_last(&reg->node, regions)) {
-			next = list_next_entry(reg, node);
-			if (next->start <= end)
-				b = next->start - 1;
-		}
-		error = request_range(a, b, space_id, flags, desc);
-		if (!error) {
-			if (next && next->start == b + 1) {
-				reg->end = next->end;
-				list_del(&next->node);
-				kfree(next);
-			} else {
-				reg->end = end;
-				break;
-			}
-		} else if (next) {
-			if (!ret)
-				ret = error;
-
-			reg = next;
-		} else {
-			break;
-		}
-	}
-
-	return ret ? ret : error;
-}
-EXPORT_SYMBOL_GPL(acpi_reserve_region);
--- a/drivers/pnp/system.c
+++ b/drivers/pnp/system.c
@@ -7,7 +7,6 @@
  *	Bjorn Helgaas <bjorn.helgaas@hp.com>
  */
 
-#include <linux/acpi.h>
 #include <linux/pnp.h>
 #include <linux/device.h>
 #include <linux/init.h>
@@ -23,41 +22,25 @@ static const struct pnp_device_id pnp_de
 	{"", 0}
 };
 
-#ifdef CONFIG_ACPI
-static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
-{
-	u8 space_id = io ? ACPI_ADR_SPACE_SYSTEM_IO : ACPI_ADR_SPACE_SYSTEM_MEMORY;
-	return !acpi_reserve_region(start, length, space_id, IORESOURCE_BUSY, desc);
-}
-#else
-static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
-{
-	struct resource *res;
-
-	res = io ? request_region(start, length, desc) :
-		request_mem_region(start, length, desc);
-	if (res) {
-		res->flags &= ~IORESOURCE_BUSY;
-		return true;
-	}
-	return false;
-}
-#endif
-
 static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
 {
 	char *regionid;
 	const char *pnpid = dev_name(&dev->dev);
 	resource_size_t start = r->start, end = r->end;
-	bool reserved;
+	struct resource *res;
 
 	regionid = kmalloc(16, GFP_KERNEL);
 	if (!regionid)
 		return;
 
 	snprintf(regionid, 16, "pnp %s", pnpid);
-	reserved = __reserve_range(start, end - start + 1, !!port, regionid);
-	if (!reserved)
+	if (port)
+		res = request_region(start, end - start + 1, regionid);
+	else
+		res = request_mem_region(start, end - start + 1, regionid);
+	if (res)
+		res->flags &= ~IORESOURCE_BUSY;
+	else
 		kfree(regionid);
 
 	/*
@@ -66,7 +49,7 @@ static void reserve_range(struct pnp_dev
 	 * have double reservations.
 	 */
 	dev_info(&dev->dev, "%pR %s reserved\n", r,
-		 reserved ? "has been" : "could not be");
+		 res ? "has been" : "could not be");
 }
 
 static void reserve_resources_of_dev(struct pnp_dev *dev)
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -332,9 +332,6 @@ int acpi_check_region(resource_size_t st
 
 int acpi_resources_are_enforced(void);
 
-int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
-			unsigned long flags, char *desc);
-
 #ifdef CONFIG_HIBERNATION
 void __init acpi_no_s4_hw_signature(void);
 #endif
@@ -530,13 +527,6 @@ static inline int acpi_check_region(reso
 	return 0;
 }
 
-static inline int acpi_reserve_region(u64 start, unsigned int length,
-				      u8 space_id, unsigned long flags,
-				      char *desc)
-{
-	return -ENXIO;
-}
-
 struct acpi_table_header;
 static inline int acpi_table_parse(char *id,
 				int (*handler)(struct acpi_table_header *))



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 208/267] ACPI / LPSS: Fix up acpi_lpss_create_device()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 207/267] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage Greg Kroah-Hartman
@ 2015-07-31 19:40 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 209/267] ACPICA: Tables: Enable both 32-bit and 64-bit FACS Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:40 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Rafael J. Wysocki

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>

commit d3e13ff3c1aa2403d9a5f371baac088daeb8f56d upstream.

Fix a return value (which should be a negative error code) and a
memory leak (the list allocated by acpi_dev_get_resources() needs
to be freed on ioremap() errors too) in acpi_lpss_create_device()
introduced by commit 4483d59e29fe 'ACPI / LPSS: check the result
of ioremap()'.

Fixes: 4483d59e29fe 'ACPI / LPSS: check the result of ioremap()'
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/acpi_lpss.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -352,13 +352,16 @@ static int acpi_lpss_create_device(struc
 				pdata->mmio_size = resource_size(rentry->res);
 			pdata->mmio_base = ioremap(rentry->res->start,
 						   pdata->mmio_size);
-			if (!pdata->mmio_base)
-				goto err_out;
 			break;
 		}
 
 	acpi_dev_free_resource_list(&resource_list);
 
+	if (!pdata->mmio_base) {
+		ret = -ENOMEM;
+		goto err_out;
+	}
+
 	pdata->dev_desc = dev_desc;
 
 	if (dev_desc->setup)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 209/267] ACPICA: Tables: Enable both 32-bit and 64-bit FACS
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2015-07-31 19:40 ` [PATCH 4.1 208/267] ACPI / LPSS: Fix up acpi_lpss_create_device() Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 20:25   ` Moore, Robert
  2015-07-31 19:41 ` [PATCH 4.1 210/267] ACPICA: Tables: Fix an issue that FACS initialization is performed twice Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  244 siblings, 1 reply; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lv Zheng, Bob Moore, Rafael J. Wysocki

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lv Zheng <lv.zheng@intel.com>

commit c04e1fb4396d27f18296db0f914760fa7fe8223a upstream.

ACPICA commit f7b86f35416e3d1f71c3d816ff5075ddd33ed486

The following commit is reported to have broken s2ram on some platforms:
 Commit: 0249ed2444d65d65fc3f3f64f398f1ad0b7e54cd
 ACPICA: Add option to favor 32-bit FADT addresses.
The platform reports 2 FACS tables (which is not allowed by ACPI
specification) and the new 32-bit address favor rule forces OSPMs to use
the FACS table reported via FADT's X_FIRMWARE_CTRL field.

The root cause of the reported bug might be one of the followings:
1. BIOS may favor the 64-bit firmware waking vector address when the
   version of the FACS is greater than 0 and Linux currently only supports
   resuming from the real mode, so the 64-bit firmware waking vector has
   never been set and might be invalid to BIOS while the commit enables
   higher version FACS.
2. BIOS may favor the FACS reported via the "FIRMWARE_CTRL" field in the
   FADT while the commit doesn't set the firmware waking vector address of
   the FACS reported by "FIRMWARE_CTRL", it only sets the firware waking
   vector address of the FACS reported by "X_FIRMWARE_CTRL".

This patch excludes the cases that can trigger the bugs caused by the root
cause 2.

There is no handshaking mechanism can be used by OSPM to tell BIOS which
FACS is currently used. Thus the FACS reported by "FIRMWARE_CTRL" may still
be used by BIOS and the 0 value of the 32-bit firmware waking vector might
trigger such failure.

This patch tries to favor 32bit FACS address in another way where both the
FACS reported by "FIRMWARE_CTRL" and the FACS reported by "X_FIRMWARE_CTRL"
are loaded so that further commit can set firmware waking vector in the
both tables to ensure we can exclude the cases that trigger the bugs caused
by the root cause 2. The exclusion is split into 2 commits as this commit
is also useful for dumping more ACPI tables, it won't get reverted when
such exclusion is no longer necessary. Lv Zheng.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=74021
Link: https://github.com/acpica/acpica/commit/f7b86f35
Reported-and-tested-by: Oswald Buddenhagen <ossi@kde.org>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/acpica/aclocal.h  |    1 +
 drivers/acpi/acpica/tbfadt.c   |   21 +++++++++++++--------
 drivers/acpi/acpica/tbutils.c  |   34 +++++++++++++++++++++++-----------
 drivers/acpi/acpica/tbxfload.c |    3 ++-
 include/acpi/acpixf.h          |    9 +++++++++
 5 files changed, 48 insertions(+), 20 deletions(-)

--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -213,6 +213,7 @@ struct acpi_table_list {
 
 #define ACPI_TABLE_INDEX_DSDT           (0)
 #define ACPI_TABLE_INDEX_FACS           (1)
+#define ACPI_TABLE_INDEX_X_FACS         (2)
 
 struct acpi_find_context {
 	char *search_for;
--- a/drivers/acpi/acpica/tbfadt.c
+++ b/drivers/acpi/acpica/tbfadt.c
@@ -350,9 +350,18 @@ void acpi_tb_parse_fadt(u32 table_index)
 	/* If Hardware Reduced flag is set, there is no FACS */
 
 	if (!acpi_gbl_reduced_hardware) {
-		acpi_tb_install_fixed_table((acpi_physical_address)
-					    acpi_gbl_FADT.Xfacs, ACPI_SIG_FACS,
-					    ACPI_TABLE_INDEX_FACS);
+		if (acpi_gbl_FADT.facs) {
+			acpi_tb_install_fixed_table((acpi_physical_address)
+						    acpi_gbl_FADT.facs,
+						    ACPI_SIG_FACS,
+						    ACPI_TABLE_INDEX_FACS);
+		}
+		if (acpi_gbl_FADT.Xfacs) {
+			acpi_tb_install_fixed_table((acpi_physical_address)
+						    acpi_gbl_FADT.Xfacs,
+						    ACPI_SIG_FACS,
+						    ACPI_TABLE_INDEX_X_FACS);
+		}
 	}
 }
 
@@ -491,13 +500,9 @@ static void acpi_tb_convert_fadt(void)
 	acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt);
 
 	/*
-	 * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary.
+	 * Expand the 32-bit DSDT addresses to 64-bit as necessary.
 	 * Later ACPICA code will always use the X 64-bit field.
 	 */
-	acpi_gbl_FADT.Xfacs = acpi_tb_select_address("FACS",
-						     acpi_gbl_FADT.facs,
-						     acpi_gbl_FADT.Xfacs);
-
 	acpi_gbl_FADT.Xdsdt = acpi_tb_select_address("DSDT",
 						     acpi_gbl_FADT.dsdt,
 						     acpi_gbl_FADT.Xdsdt);
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -68,7 +68,8 @@ acpi_tb_get_root_table_entry(u8 *table_e
 
 acpi_status acpi_tb_initialize_facs(void)
 {
-	acpi_status status;
+	struct acpi_table_facs *facs32;
+	struct acpi_table_facs *facs64;
 
 	/* If Hardware Reduced flag is set, there is no FACS */
 
@@ -77,11 +78,22 @@ acpi_status acpi_tb_initialize_facs(void
 		return (AE_OK);
 	}
 
-	status = acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
-					 ACPI_CAST_INDIRECT_PTR(struct
-								acpi_table_header,
-								&acpi_gbl_FACS));
-	return (status);
+	(void)acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
+				      ACPI_CAST_INDIRECT_PTR(struct
+							     acpi_table_header,
+							     &facs32));
+	(void)acpi_get_table_by_index(ACPI_TABLE_INDEX_X_FACS,
+				      ACPI_CAST_INDIRECT_PTR(struct
+							     acpi_table_header,
+							     &facs64));
+
+	if (acpi_gbl_use32_bit_facs_addresses) {
+		acpi_gbl_FACS = facs32 ? facs32 : facs64;
+	} else {
+		acpi_gbl_FACS = facs64 ? facs64 : facs32;
+	}
+
+	return (AE_OK);
 }
 #endif				/* !ACPI_REDUCED_HARDWARE */
 
@@ -101,7 +113,7 @@ acpi_status acpi_tb_initialize_facs(void
 u8 acpi_tb_tables_loaded(void)
 {
 
-	if (acpi_gbl_root_table_list.current_table_count >= 3) {
+	if (acpi_gbl_root_table_list.current_table_count >= 4) {
 		return (TRUE);
 	}
 
@@ -357,11 +369,11 @@ acpi_status __init acpi_tb_parse_root_ta
 	table_entry = ACPI_ADD_PTR(u8, table, sizeof(struct acpi_table_header));
 
 	/*
-	 * First two entries in the table array are reserved for the DSDT
-	 * and FACS, which are not actually present in the RSDT/XSDT - they
-	 * come from the FADT
+	 * First three entries in the table array are reserved for the DSDT
+	 * and 32bit/64bit FACS, which are not actually present in the
+	 * RSDT/XSDT - they come from the FADT
 	 */
-	acpi_gbl_root_table_list.current_table_count = 2;
+	acpi_gbl_root_table_list.current_table_count = 3;
 
 	/* Initialize the root table array from the RSDT/XSDT */
 
--- a/drivers/acpi/acpica/tbxfload.c
+++ b/drivers/acpi/acpica/tbxfload.c
@@ -166,7 +166,8 @@ static acpi_status acpi_tb_load_namespac
 
 	(void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
 	for (i = 0; i < acpi_gbl_root_table_list.current_table_count; ++i) {
-		if ((!ACPI_COMPARE_NAME
+		if (!acpi_gbl_root_table_list.tables[i].address ||
+		    (!ACPI_COMPARE_NAME
 		     (&(acpi_gbl_root_table_list.tables[i].signature),
 		      ACPI_SIG_SSDT)
 		     &&
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -200,6 +200,15 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use
 ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE);
 
 /*
+ * Optionally use 32-bit FACS table addresses.
+ * It is reported that some platforms fail to resume from system suspending
+ * if 64-bit FACS table address is selected:
+ * https://bugzilla.kernel.org/show_bug.cgi?id=74021
+ * Default is TRUE, favor the 32-bit addresses.
+ */
+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_facs_addresses, TRUE);
+
+/*
  * Optionally truncate I/O addresses to 16 bits. Provides compatibility
  * with other ACPI implementations. NOTE: During ACPICA initialization,
  * this value is set to TRUE if any Windows OSI strings have been



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 210/267] ACPICA: Tables: Fix an issue that FACS initialization is performed twice
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 209/267] ACPICA: Tables: Enable both 32-bit and 64-bit FACS Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 211/267] ACPICA: Tables: Enable default 64-bit FADT addresses favor Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lv Zheng, Bob Moore, Rafael J. Wysocki

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lv Zheng <lv.zheng@intel.com>

commit c04be18448355441a0c424362df65b6422e27bda upstream.

ACPICA commit 90f5332a15e9d9ba83831ca700b2b9f708274658

This patch adds a new FACS initialization flag for acpi_tb_initialize().
acpi_enable_subsystem() might be invoked several times in OS bootup process,
and we don't want FACS initialization to be invoked twice. Lv Zheng.

Link: https://github.com/acpica/acpica/commit/90f5332a
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/acpica/utxfinit.c |   10 ++++++----
 include/acpi/actypes.h         |    1 +
 2 files changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/acpi/acpica/utxfinit.c
+++ b/drivers/acpi/acpica/utxfinit.c
@@ -179,10 +179,12 @@ acpi_status __init acpi_enable_subsystem
 	 * Obtain a permanent mapping for the FACS. This is required for the
 	 * Global Lock and the Firmware Waking Vector
 	 */
-	status = acpi_tb_initialize_facs();
-	if (ACPI_FAILURE(status)) {
-		ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-		return_ACPI_STATUS(status);
+	if (!(flags & ACPI_NO_FACS_INIT)) {
+		status = acpi_tb_initialize_facs();
+		if (ACPI_FAILURE(status)) {
+			ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
+			return_ACPI_STATUS(status);
+		}
 	}
 #endif				/* !ACPI_REDUCED_HARDWARE */
 
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -572,6 +572,7 @@ typedef u64 acpi_integer;
 #define ACPI_NO_ACPI_ENABLE             0x10
 #define ACPI_NO_DEVICE_INIT             0x20
 #define ACPI_NO_OBJECT_INIT             0x40
+#define ACPI_NO_FACS_INIT               0x80
 
 /*
  * Initialization state



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 211/267] ACPICA: Tables: Enable default 64-bit FADT addresses favor
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 210/267] ACPICA: Tables: Fix an issue that FACS initialization is performed twice Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 212/267] ACPI / PCI: Fix regressions caused by resource_size_t overflow with 32-bit kernel Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lv Zheng, Bob Moore, Rafael J. Wysocki

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lv Zheng <lv.zheng@intel.com>

commit 0ea61381788a37d864f9841b0fe97d40f7058f3b upstream.

ACPICA commit 4da56eeae0749dfe8491285c1e1fad48f6efafd8

The following commit temporarily disables correct 64-bit FADT addresses
favor during the period the root cause of the bug is not fixed:
 Commit: 85dbd5801f62b66e2aa7826aaefcaebead44c8a6
 ACPICA: Tables: Restore old behavor to favor 32-bit FADT addresses.

With enough protections, this patch re-enables 64-bit FADT addresses by
default. If regressions are reported against such change, this patch should
be bisected and reverted.
Note that 64-bit FACS favor and 64-bit firmware waking vector favor are
excluded by this commit in order not to break OSPMs. Lv Zheng.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=74021
Link: https://github.com/acpica/acpica/commit/4da56eea
Reported-and-tested-by: Oswald Buddenhagen <ossi@kde.org>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/acpi/acpixf.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -195,9 +195,9 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use
  * address. Although ACPICA adheres to the ACPI specification which
  * requires the use of the corresponding 64-bit address if it is non-zero,
  * some machines have been found to have a corrupted non-zero 64-bit
- * address. Default is TRUE, favor the 32-bit addresses.
+ * address. Default is FALSE, do not favor the 32-bit addresses.
  */
-ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE);
+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, FALSE);
 
 /*
  * Optionally use 32-bit FACS table addresses.



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 212/267] ACPI / PCI: Fix regressions caused by resource_size_t overflow with 32-bit kernel
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 211/267] ACPICA: Tables: Enable default 64-bit FADT addresses favor Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 213/267] serial: samsung: only use earlycon for console Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jiang Liu, Rafael J. Wysocki

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jiang Liu <jiang.liu@linux.intel.com>

commit 1fb01ca93a1348a1469b8777326cd7632483de77 upstream.

Zoltan Boszormenyi reported this regression:
  "There's a Realtek RTL8111/8168/8411 (PCI ID 10ec:8168, Subsystem ID
   1565:230e) network chip on the mainboard. After the r8169 driver loaded
   the IRQs in the machine went berserk. Keyboard keypressed arrived with
   considerable latency and duplicated, so no real work was possible.
   The machine responded to the power button but didn't actually power
   down. It just stuck at the powering down message. I had to press the
   power button for 4 seconds to power it down.

   The computer is a POS machine with a big battery inside. Because of this,
   either ACPI or the Realtek chip kept the bad state and after rebooting,
   the network chip didn't even show up in lspci. Not even the PXE ROM
   announced itself during boot. I had to disconnect the battery to beat
   some sense back to the computer.

   The regression happens with 4.0.5, 4.1.0-rc8 and 4.1.0-final. 3.18.16 was
   good."

The regression is caused by commit 593669c2ac0f (x86/PCI/ACPI: Use common
ACPI resource interfaces to simplify implementation). Since commit
593669c2ac0f, x86 PCI ACPI host bridge driver validates ACPI resources by
first converting an ACPI resource to a 'struct resource' structure and
then applying checks against the converted resource structure. The 'start'
and 'end' fields in 'struct resource' are defined to be type of
resource_size_t, which may be 32 bits or 64 bits depending on
CONFIG_PHYS_ADDR_T_64BIT.

This may cause incorrect resource validation results with 32-bit kernels
because 64-bit ACPI resource descriptors may get truncated when converting
to 32-bit 'start' and 'end' fields in 'struct resource'. It eventually
affects PCI resource allocation subsystem and makes some PCI devices and
the system behave abnormally due to incorrect resource assignment.

So enhance the ACPI resource parsing interfaces to ignore ACPI resource
descriptors with address/offset above 4G when running in 32-bit mode.

With the fix applied, the behavior of the machine was restored to how
3.18.16 worked, i.e. the memory range that is over 4GB is ignored again,
and lspci -vvxxx shows that everything is at the same memory window as
they were with 3.18.16.

Reported-and-tested-by: Boszormenyi Zoltan <zboszor@pr.hu>
Fixes: 593669c2ac0f (x86/PCI/ACPI: Use common ACPI resource interfaces to simplify implementation)
Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/resource.c |   24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -193,6 +193,7 @@ static bool acpi_decode_space(struct res
 	u8 iodec = attr->granularity == 0xfff ? ACPI_DECODE_10 : ACPI_DECODE_16;
 	bool wp = addr->info.mem.write_protect;
 	u64 len = attr->address_length;
+	u64 start, end, offset = 0;
 	struct resource *res = &win->res;
 
 	/*
@@ -204,9 +205,6 @@ static bool acpi_decode_space(struct res
 		pr_debug("ACPI: Invalid address space min_addr_fix %d, max_addr_fix %d, len %llx\n",
 			 addr->min_address_fixed, addr->max_address_fixed, len);
 
-	res->start = attr->minimum;
-	res->end = attr->maximum;
-
 	/*
 	 * For bridges that translate addresses across the bridge,
 	 * translation_offset is the offset that must be added to the
@@ -214,12 +212,22 @@ static bool acpi_decode_space(struct res
 	 * primary side. Non-bridge devices must list 0 for all Address
 	 * Translation offset bits.
 	 */
-	if (addr->producer_consumer == ACPI_PRODUCER) {
-		res->start += attr->translation_offset;
-		res->end += attr->translation_offset;
-	} else if (attr->translation_offset) {
+	if (addr->producer_consumer == ACPI_PRODUCER)
+		offset = attr->translation_offset;
+	else if (attr->translation_offset)
 		pr_debug("ACPI: translation_offset(%lld) is invalid for non-bridge device.\n",
 			 attr->translation_offset);
+	start = attr->minimum + offset;
+	end = attr->maximum + offset;
+
+	win->offset = offset;
+	res->start = start;
+	res->end = end;
+	if (sizeof(resource_size_t) < sizeof(u64) &&
+	    (offset != win->offset || start != res->start || end != res->end)) {
+		pr_warn("acpi resource window ([%#llx-%#llx] ignored, not CPU addressable)\n",
+			attr->minimum, attr->maximum);
+		return false;
 	}
 
 	switch (addr->resource_type) {
@@ -236,8 +244,6 @@ static bool acpi_decode_space(struct res
 		return false;
 	}
 
-	win->offset = attr->translation_offset;
-
 	if (addr->producer_consumer == ACPI_PRODUCER)
 		res->flags |= IORESOURCE_WINDOW;
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 213/267] serial: samsung: only use earlycon for console
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 212/267] ACPI / PCI: Fix regressions caused by resource_size_t overflow with 32-bit kernel Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 214/267] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 357d56151976a78d90dc3dfac01777de0ef05212 upstream.

A configuration that enables earlycon but not the core console
code causes a link error:

  drivers/built-in.o: In function `setup_earlycon':
  drivers/tty/serial/earlycon.c:70: undefined reference to `uart_parse_earlycon'

That error can be triggered by the newly added samsung earlycon support,
which is missing a 'select' statement.

As suggested by Peter Hurley, solves the problem by moving the
'select SERIAL_EARLYCON' statement to the samsung console driver
option, as it is done by all other console drivers.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: b94ba0328d3b3 ("serial: samsung: Add support for early console")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -241,7 +241,6 @@ config SERIAL_SAMSUNG
 	tristate "Samsung SoC serial support"
 	depends on PLAT_SAMSUNG || ARCH_EXYNOS
 	select SERIAL_CORE
-	select SERIAL_EARLYCON
 	help
 	  Support for the on-chip UARTs on the Samsung S3C24XX series CPUs,
 	  providing /dev/ttySAC0, 1 and 2 (note, some machines may not
@@ -277,6 +276,7 @@ config SERIAL_SAMSUNG_CONSOLE
 	bool "Support for console on Samsung SoC serial port"
 	depends on SERIAL_SAMSUNG=y
 	select SERIAL_CORE_CONSOLE
+	select SERIAL_EARLYCON
 	help
 	  Allow selection of the S3C24XX on-board serial ports for use as
 	  an virtual console.



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 214/267] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 213/267] serial: samsung: only use earlycon for console Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 215/267] mmc: sdhci: Restore behavior while creating OCR mask Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ding Wang, Ulf Hansson

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ding Wang <justin.wang@spreadtrum.com>

commit 29535f7b797df35cc9b6b3bca635591cdd3dd2a8 upstream.

The current handler of MMC_BLK_CMD_ERR in mmc_blk_issue_rw_rq function
may cause new coming request permanent missing when the ongoing
request (previoulsy started) complete end.

The problem scenario is as follows:
(1) Request A is ongoing;
(2) Request B arrived, and finally mmc_blk_issue_rw_rq() is called;
(3) Request A encounters the MMC_BLK_CMD_ERR error;
(4) In the error handling of MMC_BLK_CMD_ERR, suppose mmc_blk_cmd_err()
    end request A completed and return zero. Continue the error handling,
    suppose mmc_blk_reset() reset device success;
(5) Continue the execution, while loop completed because variable ret
    is zero now;
(6) Finally, mmc_blk_issue_rw_rq() return without processing request B.

The process related to the missing request may wait that IO request
complete forever, possibly crashing the application or hanging the system.

Fix this issue by starting new request when reset success.

Signed-off-by: Ding Wang <justin.wang@spreadtrum.com>
Fixes: 67716327eec7 ("mmc: block: add eMMC hardware reset support")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/card/block.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1912,9 +1912,11 @@ static int mmc_blk_issue_rw_rq(struct mm
 			break;
 		case MMC_BLK_CMD_ERR:
 			ret = mmc_blk_cmd_err(md, card, brq, req, ret);
-			if (!mmc_blk_reset(md, card->host, type))
-				break;
-			goto cmd_abort;
+			if (mmc_blk_reset(md, card->host, type))
+				goto cmd_abort;
+			if (!ret)
+				goto start_new_req;
+			break;
 		case MMC_BLK_RETRY:
 			if (retry++ < 5)
 				break;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 215/267] mmc: sdhci: Restore behavior while creating OCR mask
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 214/267] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 216/267] PM / clk: Fix clock error check in __pm_clk_add() Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tim Kryger, Yangbo Lu, Ulf Hansson

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ulf Hansson <ulf.hansson@linaro.org>

commit 5fd26c7ecb32082745b0bd33c8e35badd1cb5a91 upstream.

Commit 3a48edc4bd68 ("mmc: sdhci: Use mmc core regulator infrastucture")
changed the behavior for how to assign the ocr_avail mask for the mmc
host. More precisely it started to mask the bits instead of assigning
them.

Restore the behavior, but also make it clear that an OCR mask created
from an external regulator overrides the other ones. The OCR mask is
determined by one of the following with this priority:

1. Supported ranges of external regulator if one supplies VDD
2. Host OCR mask if set by the driver (based on DT properties)
3. The capabilities reported by the controller itself

Fixes: 3a48edc4bd68 ("mmc: sdhci: Use mmc core regulator infrastucture")
Cc: Tim Kryger <tim.kryger@gmail.com>
Reported-by: Yangbo Lu <yangbo.lu@freescale.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Tim Kryger <tim.kryger@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/sdhci.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -3315,13 +3315,14 @@ int sdhci_add_host(struct sdhci_host *ho
 				   SDHCI_MAX_CURRENT_MULTIPLIER;
 	}
 
-	/* If OCR set by external regulators, use it instead */
+	/* If OCR set by host, use it instead. */
+	if (host->ocr_mask)
+		ocr_avail = host->ocr_mask;
+
+	/* If OCR set by external regulators, give it highest prio. */
 	if (mmc->ocr_avail)
 		ocr_avail = mmc->ocr_avail;
 
-	if (host->ocr_mask)
-		ocr_avail &= host->ocr_mask;
-
 	mmc->ocr_avail = ocr_avail;
 	mmc->ocr_avail_sdio = ocr_avail;
 	if (host->ocr_avail_sdio)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 216/267] PM / clk: Fix clock error check in __pm_clk_add()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 215/267] mmc: sdhci: Restore behavior while creating OCR mask Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 217/267] RDMA/ocrdma: fix double free on pd Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Rafael J. Wysocki

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert+renesas@glider.be>

commit 3fc3a0be0dab352e065d1dad7d3f81953ed0d4bc upstream.

In the final iteration of commit 245bd6f6af8a62a2 ("PM / clock_ops: Add
pm_clk_add_clk()"), a refcount increment was added by Grygorii Strashko.
However, the accompanying IS_ERR() check operates on the wrong clock
pointer, which is always zero at this point, i.e. not an error.
This may lead to a NULL pointer dereference later, when __clk_get()
tries to dereference an error pointer.

Check the passed clock pointer instead to fix this.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Fixes: 245bd6f6af8a62a2 ("PM / clock_ops: Add pm_clk_add_clk()")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/power/clock_ops.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/base/power/clock_ops.c
+++ b/drivers/base/power/clock_ops.c
@@ -93,7 +93,7 @@ static int __pm_clk_add(struct device *d
 			return -ENOMEM;
 		}
 	} else {
-		if (IS_ERR(ce->clk) || !__clk_get(clk)) {
+		if (IS_ERR(clk) || !__clk_get(clk)) {
 			kfree(ce);
 			return -ENOENT;
 		}



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 217/267] RDMA/ocrdma: fix double free on pd
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 216/267] PM / clk: Fix clock error check in __pm_clk_add() Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 218/267] tty: remove platform_sysrq_reset_seq Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Devesh Sharma, Doug Ledford

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Colin Ian King <colin.king@canonical.com>

commit 4dc544427991e3cef38ce3ae124b7e6557063bd3 upstream.

A reorganisation of the PD allocation and deallocation in commit
9ba1377daa ("RDMA/ocrdma: Move PD resource management to driver.")
introduced a double free on pd, as detected by static analysis by
smatch:

drivers/infiniband/hw/ocrdma/ocrdma_verbs.c:682 ocrdma_alloc_pd()
  error: double free of 'pd'^

The original call to ocrdma_mbx_dealloc_pd() (which does not kfree
pd) was replaced with a call to _ocrdma_dealloc_pd() (which does
kfree pd).  The kfree following this call causes the double free,
so just remove it to fix the problem.

Fixes: 9ba1377daa ("RDMA/ocrdma: Move PD resource management to driver.")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-By: Devesh Sharma <devesh.sharma@avagotech.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -679,7 +679,6 @@ err:
 		ocrdma_release_ucontext_pd(uctx);
 	} else {
 		status = _ocrdma_dealloc_pd(dev, pd);
-		kfree(pd);
 	}
 exit:
 	return ERR_PTR(status);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 218/267] tty: remove platform_sysrq_reset_seq
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 217/267] RDMA/ocrdma: fix double free on pd Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 219/267] mm/hugetlb: introduce minimum hugepage order Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Dmitry Torokhov

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit ffb6e0c9a0572f8e5f8e9337a1b40ac2ec1493a1 upstream.

The platform_sysrq_reset_seq code was intended as a way for an embedded
platform to provide its own sysrq sequence at compile time. After over two
years, nobody has started using it in an upstream kernel, and the platforms
that were interested in it have moved on to devicetree, which can be used
to configure the sequence without requiring kernel changes. The method is
also incompatible with the way that most architectures build support for
multiple platforms into a single kernel.

Now the code is producing warnings when built with gcc-5.1:

drivers/tty/sysrq.c: In function 'sysrq_init':
drivers/tty/sysrq.c:959:33: warning: array subscript is above array bounds [-Warray-bounds]
   key = platform_sysrq_reset_seq[i];

We could fix this, but it seems unlikely that it will ever be used, so
let's just remove the code instead. We still have the option to pass the
sequence either in DT, using the kernel command line, or using the
/sys/module/sysrq/parameters/reset_seq file.

Fixes: 154b7a489a ("Input: sysrq - allow specifying alternate reset sequence")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/sysrq.c |   19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -55,9 +55,6 @@
 static int __read_mostly sysrq_enabled = CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE;
 static bool __read_mostly sysrq_always_enabled;
 
-unsigned short platform_sysrq_reset_seq[] __weak = { KEY_RESERVED };
-int sysrq_reset_downtime_ms __weak;
-
 static bool sysrq_on(void)
 {
 	return sysrq_enabled || sysrq_always_enabled;
@@ -569,6 +566,7 @@ void handle_sysrq(int key)
 EXPORT_SYMBOL(handle_sysrq);
 
 #ifdef CONFIG_INPUT
+static int sysrq_reset_downtime_ms;
 
 /* Simple translation table for the SysRq keys */
 static const unsigned char sysrq_xlate[KEY_CNT] =
@@ -949,23 +947,8 @@ static bool sysrq_handler_registered;
 
 static inline void sysrq_register_handler(void)
 {
-	unsigned short key;
 	int error;
-	int i;
-
-	/* First check if a __weak interface was instantiated. */
-	for (i = 0; i < ARRAY_SIZE(sysrq_reset_seq); i++) {
-		key = platform_sysrq_reset_seq[i];
-		if (key == KEY_RESERVED || key > KEY_MAX)
-			break;
-
-		sysrq_reset_seq[sysrq_reset_seq_len++] = key;
-	}
 
-	/*
-	 * DT configuration takes precedence over anything that would
-	 * have been defined via the __weak interface.
-	 */
 	sysrq_of_get_keyreset_config();
 
 	error = input_register_handler(&sysrq_handler);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 219/267] mm/hugetlb: introduce minimum hugepage order
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 218/267] tty: remove platform_sysrq_reset_seq Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 220/267] PM / sleep: Increase default DPM watchdog timeout to 60 Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Naoya Horiguchi,
	Andrew Morton, Linus Torvalds

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>

commit 641844f5616d7c6597309f560838f996466d7aac upstream.

Currently the initial value of order in dissolve_free_huge_page is 64 or
32, which leads to the following warning in static checker:

  mm/hugetlb.c:1203 dissolve_free_huge_pages()
  warn: potential right shift more than type allows '9,18,64'

This is a potential risk of infinite loop, because 1 << order (== 0) is used
in for-loop like this:

  for (pfn =3D start_pfn; pfn < end_pfn; pfn +=3D 1 << order)
      ...

So this patch fixes it by using global minimum_order calculated at boot time.

    text    data     bss     dec     hex filename
   28313     469   84236  113018   1b97a mm/hugetlb.o
   28256     473   84236  112965   1b945 mm/hugetlb.o (patched)

Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/hugetlb.c |   19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -40,6 +40,11 @@ int hugepages_treat_as_movable;
 int hugetlb_max_hstate __read_mostly;
 unsigned int default_hstate_idx;
 struct hstate hstates[HUGE_MAX_HSTATE];
+/*
+ * Minimum page order among possible hugepage sizes, set to a proper value
+ * at boot time.
+ */
+static unsigned int minimum_order __read_mostly = UINT_MAX;
 
 __initdata LIST_HEAD(huge_boot_pages);
 
@@ -1188,19 +1193,13 @@ static void dissolve_free_huge_page(stru
  */
 void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
 {
-	unsigned int order = 8 * sizeof(void *);
 	unsigned long pfn;
-	struct hstate *h;
 
 	if (!hugepages_supported())
 		return;
 
-	/* Set scan step to minimum hugepage size */
-	for_each_hstate(h)
-		if (order > huge_page_order(h))
-			order = huge_page_order(h);
-	VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << order));
-	for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << order)
+	VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << minimum_order));
+	for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
 		dissolve_free_huge_page(pfn_to_page(pfn));
 }
 
@@ -1627,10 +1626,14 @@ static void __init hugetlb_init_hstates(
 	struct hstate *h;
 
 	for_each_hstate(h) {
+		if (minimum_order > huge_page_order(h))
+			minimum_order = huge_page_order(h);
+
 		/* oversize hugepages were init'ed in early boot */
 		if (!hstate_is_gigantic(h))
 			hugetlb_hstate_alloc_pages(h);
 	}
+	VM_BUG_ON(minimum_order == UINT_MAX);
 }
 
 static char * __init memfmt(char *buf, unsigned long n)



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 220/267] PM / sleep: Increase default DPM watchdog timeout to 60
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 219/267] mm/hugetlb: introduce minimum hugepage order Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 221/267] firmware: dmi_scan: Only honor end-of-table for 64-bit tables Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Rafael J. Wysocki

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit fff3b16d2754a061a3549c4307a186423a0128fd upstream.

Many harddisks (mostly WD ones) have firmware problems and take too
long, more than 10 seconds, to resume from suspend.  And this often
exceeds the default DPM watchdog timeout (12 seconds), resulting in a
kernel panic out of sudden.

Since most distros just take the default as is, we should give a bit
more safer value.  This patch increases the default value from 12
seconds to one minute, which has been confirmed to be long enough for
such problematic disks.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=91921
Fixes: 70fea60d888d (PM / Sleep: Detect device suspend/resume lockup and log event)
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/power/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -187,7 +187,7 @@ config DPM_WATCHDOG
 config DPM_WATCHDOG_TIMEOUT
 	int "Watchdog timeout in seconds"
 	range 1 120
-	default 12
+	default 60
 	depends on DPM_WATCHDOG
 
 config PM_TRACE



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 221/267] firmware: dmi_scan: Only honor end-of-table for 64-bit tables
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 220/267] PM / sleep: Increase default DPM watchdog timeout to 60 Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 222/267] compiler-intel: fix wrong compiler barrier() macro Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jean Delvare, Ard Biesheuvel,
	Leif Lindholm, Matt Fleming

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jean Delvare <jdelvare@suse.de>

commit 17cd5bd5391e6e7b363d66335e1bc6760ae969b9 upstream.

A 32-bit entry point to a DMI table says how many structures the table
contains. The SMBIOS specification explicitly says that end-of-table
markers should be ignored if they are not actually at the end of the
DMI table. So only honor the end-of-table marker for tables accessed
through 64-bit entry points, as they do not specify a structure count.

Fixes: fc43026278 ("dmi: add support for SMBIOS 3.0 64-bit entry point")
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/firmware/dmi_scan.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -89,9 +89,9 @@ static void dmi_table(u8 *buf,
 
 	/*
 	 * Stop when we have seen all the items the table claimed to have
-	 * (SMBIOS < 3.0 only) OR we reach an end-of-table marker OR we run
-	 * off the end of the table (should never happen but sometimes does
-	 * on bogus implementations.)
+	 * (SMBIOS < 3.0 only) OR we reach an end-of-table marker (SMBIOS
+	 * >= 3.0 only) OR we run off the end of the table (should never
+	 * happen but sometimes does on bogus implementations.)
 	 */
 	while ((!dmi_num || i < dmi_num) &&
 	       (data - buf + sizeof(struct dmi_header)) <= dmi_len) {
@@ -110,8 +110,13 @@ static void dmi_table(u8 *buf,
 
 		/*
 		 * 7.45 End-of-Table (Type 127) [SMBIOS reference spec v3.0.0]
+		 * For tables behind a 64-bit entry point, we have no item
+		 * count and no exact table length, so stop on end-of-table
+		 * marker. For tables behind a 32-bit entry point, we have
+		 * seen OEM structures behind the end-of-table marker on
+		 * some systems, so don't trust it.
 		 */
-		if (dm->type == DMI_ENTRY_END_OF_TABLE)
+		if (!dmi_num && dm->type == DMI_ENTRY_END_OF_TABLE)
 			break;
 
 		data += 2;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 222/267] compiler-intel: fix wrong compiler barrier() macro
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 221/267] firmware: dmi_scan: Only honor end-of-table for 64-bit tables Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 223/267] __bitmap_parselist: fix bug in empty string handling Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Borkmann, Pranith Kumar,
	H. Peter Anvin, mancha security, Andrew Morton, Linus Torvalds

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>

commit b86a50c3b5414eafdbee7f34af4a201a4a7817c2 upstream.

Cleanup commit 73679e508201 ("compiler-intel.h: Remove duplicate
definition") removed the double definition of __memory_barrier()
intrinsics.

However, in doing so, it also removed the preceding #undef barrier by
accident, meaning, the actual barrier() macro from compiler-gcc.h with
inline asm is still in place as __GNUC__ is provided.

Subsequently, barrier() can never be defined as __memory_barrier() from
compiler.h since it already has a definition in place and if we trust
the comment in compiler-intel.h, ecc doesn't support gcc specific asm
statements.

I don't have an ecc at hand (unsure if that's still used in the field?)
and only found this by accident during code review, a revert of that
cleanup would be simplest option.

Fixes: 73679e508201 ("compiler-intel.h: Remove duplicate definition")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Pranith Kumar <bobby.prani@gmail.com>
Cc: Pranith Kumar <bobby.prani@gmail.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: mancha security <mancha1@zoho.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/compiler-intel.h |    2 ++
 1 file changed, 2 insertions(+)

--- a/include/linux/compiler-intel.h
+++ b/include/linux/compiler-intel.h
@@ -13,10 +13,12 @@
 /* Intel ECC compiler doesn't support gcc specific asm stmts.
  * It uses intrinsics to do the equivalent things.
  */
+#undef barrier
 #undef barrier_data
 #undef RELOC_HIDE
 #undef OPTIMIZER_HIDE_VAR
 
+#define barrier() __memory_barrier()
 #define barrier_data(ptr) barrier()
 
 #define RELOC_HIDE(ptr, off)					\



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 223/267] __bitmap_parselist: fix bug in empty string handling
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 222/267] compiler-intel: fix wrong compiler barrier() macro Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 224/267] security_syslog() should be called once only Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Metcalf, Rasmus Villemoes,
	Andrew Morton, Linus Torvalds

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Metcalf <cmetcalf@ezchip.com>

commit 2528a8b8f457d7432552d0e2b6f0f4046bb702f4 upstream.

bitmap_parselist("", &mask, nmaskbits) will erroneously set bit zero in
the mask.  The same bug is visible in cpumask_parselist() since it is
layered on top of the bitmask code, e.g.  if you boot with "isolcpus=",
you will actually end up with cpu zero isolated.

The bug was introduced in commit 4b060420a596 ("bitmap, irq: add
smp_affinity_list interface to /proc/irq") when bitmap_parselist() was
generalized to support userspace as well as kernelspace.

Fixes: 4b060420a596 ("bitmap, irq: add smp_affinity_list interface to /proc/irq")
Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 lib/bitmap.c |   17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -506,12 +506,12 @@ static int __bitmap_parselist(const char
 	unsigned a, b;
 	int c, old_c, totaldigits;
 	const char __user __force *ubuf = (const char __user __force *)buf;
-	int exp_digit, in_range;
+	int at_start, in_range;
 
 	totaldigits = c = 0;
 	bitmap_zero(maskp, nmaskbits);
 	do {
-		exp_digit = 1;
+		at_start = 1;
 		in_range = 0;
 		a = b = 0;
 
@@ -540,11 +540,10 @@ static int __bitmap_parselist(const char
 				break;
 
 			if (c == '-') {
-				if (exp_digit || in_range)
+				if (at_start || in_range)
 					return -EINVAL;
 				b = 0;
 				in_range = 1;
-				exp_digit = 1;
 				continue;
 			}
 
@@ -554,16 +553,18 @@ static int __bitmap_parselist(const char
 			b = b * 10 + (c - '0');
 			if (!in_range)
 				a = b;
-			exp_digit = 0;
+			at_start = 0;
 			totaldigits++;
 		}
 		if (!(a <= b))
 			return -EINVAL;
 		if (b >= nmaskbits)
 			return -ERANGE;
-		while (a <= b) {
-			set_bit(a, maskp);
-			a++;
+		if (!at_start) {
+			while (a <= b) {
+				set_bit(a, maskp);
+				a++;
+			}
 		}
 	} while (buflen && c == ',');
 	return 0;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 224/267] security_syslog() should be called once only
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 223/267] __bitmap_parselist: fix bug in empty string handling Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 225/267] mac80211: fix the beacon csa counter for mesh and ibss Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vasily Averin, Kees Cook, Josh Boyer,
	Eric Paris, Andrew Morton, Linus Torvalds

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vasily Averin <vvs@virtuozzo.com>

commit d194e5d666225b04c7754471df0948f645b6ab3a upstream.

The final version of commit 637241a900cb ("kmsg: honor dmesg_restrict
sysctl on /dev/kmsg") lost few hooks, as result security_syslog() are
processed incorrectly:

- open of /dev/kmsg checks syslog access permissions by using
  check_syslog_permissions() where security_syslog() is not called if
  dmesg_restrict is set.

- syslog syscall and /proc/kmsg calls do_syslog() where security_syslog
  can be executed twice (inside check_syslog_permissions() and then
  directly in do_syslog())

With this patch security_syslog() is called once only in all
syslog-related operations regardless of dmesg_restrict value.

Fixes: 637241a900cb ("kmsg: honor dmesg_restrict sysctl on /dev/kmsg")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Josh Boyer <jwboyer@redhat.com>
Cc: Eric Paris <eparis@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/printk/printk.c |   11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -484,11 +484,11 @@ int check_syslog_permissions(int type, b
 	 * already done the capabilities checks at open time.
 	 */
 	if (from_file && type != SYSLOG_ACTION_OPEN)
-		return 0;
+		goto ok;
 
 	if (syslog_action_restricted(type)) {
 		if (capable(CAP_SYSLOG))
-			return 0;
+			goto ok;
 		/*
 		 * For historical reasons, accept CAP_SYS_ADMIN too, with
 		 * a warning.
@@ -498,10 +498,11 @@ int check_syslog_permissions(int type, b
 				     "CAP_SYS_ADMIN but no CAP_SYSLOG "
 				     "(deprecated).\n",
 				 current->comm, task_pid_nr(current));
-			return 0;
+			goto ok;
 		}
 		return -EPERM;
 	}
+ok:
 	return security_syslog(type);
 }
 
@@ -1263,10 +1264,6 @@ int do_syslog(int type, char __user *buf
 	if (error)
 		goto out;
 
-	error = security_syslog(type);
-	if (error)
-		return error;
-
 	switch (type) {
 	case SYSLOG_ACTION_CLOSE:	/* Close log */
 		break;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 225/267] mac80211: fix the beacon csa counter for mesh and ibss
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 224/267] security_syslog() should be called once only Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 226/267] iwlwifi: mvm: fix ROC reference accounting Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chun-Yeow Yeoh, Johannes Berg

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chun-Yeow Yeoh <yeohchunyeow@gmail.com>

commit 8df734e865b74d9f273216482a45a38269dc767a upstream.

The csa counter has moved from sdata to beacon/presp but
it is not updated accordingly for mesh and ibss. Fix this.

Fixes: af296bdb8da4 ("mac80211: move csa counters from sdata to beacon/presp")
Signed-off-by: Chun-Yeow Yeoh <yeohchunyeow@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/cfg.c  |    1 +
 net/mac80211/ibss.c |    1 +
 net/mac80211/mesh.c |    1 +
 3 files changed, 3 insertions(+)

--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3356,6 +3356,7 @@ static int ieee80211_mgmt_tx(struct wiph
 	/* Update CSA counters */
 	if (sdata->vif.csa_active &&
 	    (sdata->vif.type == NL80211_IFTYPE_AP ||
+	     sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
 	     sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
 	    params->n_csa_offsets) {
 		int i;
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -146,6 +146,7 @@ ieee80211_ibss_build_presp(struct ieee80
 				csa_settings->chandef.chan->center_freq);
 		presp->csa_counter_offsets[0] = (pos - presp->head);
 		*pos++ = csa_settings->count;
+		presp->csa_current_counter = csa_settings->count;
 	}
 
 	/* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -680,6 +680,7 @@ ieee80211_mesh_build_beacon(struct ieee8
 		*pos++ = 0x0;
 		*pos++ = ieee80211_frequency_to_channel(
 				csa->settings.chandef.chan->center_freq);
+		bcn->csa_current_counter = csa->settings.count;
 		bcn->csa_counter_offsets[0] = hdr_len + 6;
 		*pos++ = csa->settings.count;
 		*pos++ = WLAN_EID_CHAN_SWITCH_PARAM;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 226/267] iwlwifi: mvm: fix ROC reference accounting
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 225/267] mac80211: fix the beacon csa counter for mesh and ibss Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 227/267] cfg80211: ignore netif running state when changing iftype Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eliad Peller, Johannes Berg,
	Emmanuel Grumbach

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eliad Peller <eliad@wizery.com>

commit c779273b37bec14c33feeab11c4d457a24bc64e0 upstream.

commit b112889c5af8124 ("iwlwifi: mvm: add Aux ROC request/response flow")
added aux ROC flow in addition to the existing ROC flow. While doing
it, it moved the ROC reference release to a common work item, which
is being called for both the ROC and aux ROC flows.

This resulted in invalid reference accounting, as no reference was
taken in case of aux ROC, while a reference was released on completion.

Fix it by adding a reference for the aux ROC as well, and release
only the relevant references on completion (according to the set bits).

While at it, convert cancel_work_sync() to flush_work(), in order
to make sure the references are being cleaned properly.

Fixes: b112889c5af8 ("iwlwifi: mvm: add Aux ROC request/response flow")
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/iwlwifi/mvm/debugfs.c    |    5 +++--
 drivers/net/wireless/iwlwifi/mvm/mac80211.c   |    2 +-
 drivers/net/wireless/iwlwifi/mvm/mvm.h        |    1 +
 drivers/net/wireless/iwlwifi/mvm/time-event.c |   15 +++++++++------
 4 files changed, 14 insertions(+), 9 deletions(-)

--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -6,7 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -32,7 +32,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1356,6 +1356,7 @@ static ssize_t iwl_dbgfs_d0i3_refs_read(
 	PRINT_MVM_REF(IWL_MVM_REF_UCODE_DOWN);
 	PRINT_MVM_REF(IWL_MVM_REF_SCAN);
 	PRINT_MVM_REF(IWL_MVM_REF_ROC);
+	PRINT_MVM_REF(IWL_MVM_REF_ROC_AUX);
 	PRINT_MVM_REF(IWL_MVM_REF_P2P_CLIENT);
 	PRINT_MVM_REF(IWL_MVM_REF_AP_IBSS);
 	PRINT_MVM_REF(IWL_MVM_REF_USER);
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -1404,7 +1404,7 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *
 	 * The work item could be running or queued if the
 	 * ROC time event stops just as we get here.
 	 */
-	cancel_work_sync(&mvm->roc_done_wk);
+	flush_work(&mvm->roc_done_wk);
 
 	iwl_trans_stop_device(mvm->trans);
 
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -275,6 +275,7 @@ enum iwl_mvm_ref_type {
 	IWL_MVM_REF_UCODE_DOWN,
 	IWL_MVM_REF_SCAN,
 	IWL_MVM_REF_ROC,
+	IWL_MVM_REF_ROC_AUX,
 	IWL_MVM_REF_P2P_CLIENT,
 	IWL_MVM_REF_AP_IBSS,
 	IWL_MVM_REF_USER,
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -6,7 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -32,7 +32,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -108,12 +108,14 @@ void iwl_mvm_roc_done_wk(struct work_str
 	 * in the case that the time event actually completed in the firmware
 	 * (which is handled in iwl_mvm_te_handle_notif).
 	 */
-	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status))
+	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status)) {
 		queues |= BIT(IWL_MVM_OFFCHANNEL_QUEUE);
-	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
+		iwl_mvm_unref(mvm, IWL_MVM_REF_ROC);
+	}
+	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status)) {
 		queues |= BIT(mvm->aux_queue);
-
-	iwl_mvm_unref(mvm, IWL_MVM_REF_ROC);
+		iwl_mvm_unref(mvm, IWL_MVM_REF_ROC_AUX);
+	}
 
 	synchronize_net();
 
@@ -393,6 +395,7 @@ static int iwl_mvm_aux_roc_te_handle_not
 	} else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) {
 		set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status);
 		te_data->running = true;
+		iwl_mvm_ref(mvm, IWL_MVM_REF_ROC_AUX);
 		ieee80211_ready_on_channel(mvm->hw); /* Start TE */
 	} else {
 		IWL_DEBUG_TE(mvm,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 227/267] cfg80211: ignore netif running state when changing iftype
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 226/267] iwlwifi: mvm: fix ROC reference accounting Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 228/267] mac80211: prevent possible crypto tx tailroom corruption Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michal Kazior, Johannes Berg

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Kazior <michal.kazior@tieto.com>

commit 6cbfb1bb66e4e85da5db78e8ff429a85bd84ce64 upstream.

It was possible for mac80211 to be coerced into an
unexpected flow causing sdata union to become
corrupted. Station pointer was put into
sdata->u.vlan.sta memory location while it was
really master AP's sdata->u.ap.next_beacon. This
led to station entry being later freed as
next_beacon before __sta_info_flush() in
ieee80211_stop_ap() and a subsequent invalid
pointer dereference crash.

The problem was that ieee80211_ptr->use_4addr
wasn't cleared on interface type changes.

This could be reproduced with the following steps:

 # host A and host B have just booted; no
 # wpa_s/hostapd running; all vifs are down
 host A> iw wlan0 set type station
 host A> iw wlan0 set 4addr on
 host A> printf 'interface=wlan0\nssid=4addrcrash\nchannel=1\nwds_sta=1' > /tmp/hconf
 host A> hostapd -B /tmp/conf
 host B> iw wlan0 set 4addr on
 host B> ifconfig wlan0 up
 host B> iw wlan0 connect -w hostAssid
 host A> pkill hostapd
 # host A crashed:

 [  127.928192] BUG: unable to handle kernel NULL pointer dereference at 00000000000006c8
 [  127.929014] IP: [<ffffffff816f4f32>] __sta_info_flush+0xac/0x158
 ...
 [  127.934578]  [<ffffffff8170789e>] ieee80211_stop_ap+0x139/0x26c
 [  127.934578]  [<ffffffff8100498f>] ? dump_trace+0x279/0x28a
 [  127.934578]  [<ffffffff816dc661>] __cfg80211_stop_ap+0x84/0x191
 [  127.934578]  [<ffffffff816dc7ad>] cfg80211_stop_ap+0x3f/0x58
 [  127.934578]  [<ffffffff816c5ad6>] nl80211_stop_ap+0x1b/0x1d
 [  127.934578]  [<ffffffff815e53f8>] genl_family_rcv_msg+0x259/0x2b5

Note: This isn't a revert of f8cdddb8d61d
("cfg80211: check iface combinations only when
iface is running") as far as functionality is
considered because b6a550156bc ("cfg80211/mac80211:
move more combination checks to mac80211") moved
the logic somewhere else already.

Fixes: f8cdddb8d61d ("cfg80211: check iface combinations only when iface is running")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/wireless/util.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -944,7 +944,7 @@ int cfg80211_change_iface(struct cfg8021
 	     ntype == NL80211_IFTYPE_P2P_CLIENT))
 		return -EBUSY;
 
-	if (ntype != otype && netif_running(dev)) {
+	if (ntype != otype) {
 		dev->ieee80211_ptr->use_4addr = false;
 		dev->ieee80211_ptr->mesh_id_up_len = 0;
 		wdev_lock(dev->ieee80211_ptr);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 228/267] mac80211: prevent possible crypto tx tailroom corruption
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 227/267] cfg80211: ignore netif running state when changing iftype Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 229/267] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michal Kazior, Johannes Berg

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Kazior <michal.kazior@tieto.com>

commit ab499db80fcf07c18e4053f91a619500f663e90e upstream.

There was a possible race between
ieee80211_reconfig() and
ieee80211_delayed_tailroom_dec(). This could
result in inability to transmit data if driver
crashed during roaming or rekeying and subsequent
skbs with insufficient tailroom appeared.

This race was probably never seen in the wild
because a device driver would have to crash AND
recover within 0.5s which is very unlikely.

I was able to prove this race exists after
changing the delay to 10s locally and crashing
ath10k via debugfs immediately after GTK
rekeying. In case of ath10k the counter went below
0. This was harmless but other drivers which
actually require tailroom (e.g. for WEP ICV or
MMIC) could end up with the counter at 0 instead
of >0 and introduce insufficient skb tailroom
failures because mac80211 would not resize skbs
appropriately anymore.

Fixes: 8d1f7ecd2af5 ("mac80211: defer tailroom counter manipulation when roaming")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/main.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -249,6 +249,7 @@ static void ieee80211_restart_work(struc
 {
 	struct ieee80211_local *local =
 		container_of(work, struct ieee80211_local, restart_work);
+	struct ieee80211_sub_if_data *sdata;
 
 	/* wait for scan work complete */
 	flush_workqueue(local->workqueue);
@@ -257,6 +258,8 @@ static void ieee80211_restart_work(struc
 	     "%s called with hardware scan in progress\n", __func__);
 
 	rtnl_lock();
+	list_for_each_entry(sdata, &local->interfaces, list)
+		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
 	ieee80211_scan_cancel(local);
 	ieee80211_reconfig(local);
 	rtnl_unlock();



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 229/267] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 228/267] mac80211: prevent possible crypto tx tailroom corruption Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 230/267] clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Duyck, Aaron Brown, Jeff Kirsher

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexander Duyck <alexander.h.duyck@redhat.com>

commit 8084b86dcfbc4b4822868c1dbdb429b5c08154e2 upstream.

When the VLAN_HLEN was added to the calculation for the maximum frame size
there seems to have been a number of issues added to the driver.

The first issue is that in some cases the maximum frame size for a device
never really reached the actual maximum frame size as the VLAN header
length was not included the calculation for that value.  As a result some
parts only supported a maximum frame size of either 1496 in the case of
parts that didn't support jumbo frames, and 8996 in the case of the parts
that do.

The second issue is the fact that there were several checks that weren't
updated so as a result setting an MTU of 1500 was treated as enabling jumbo
frames as the calculated value was 1522 instead of 1518.  I have addressed
those by replacing ETH_FRAME_LEN with VLAN_ETH_FRAME_LEN where appropriate.

The final issue was the fact that lowering the MTU below 1500 would cause
the driver to allocate 2K buffers for the rings.  This is an old issue that
was fixed several years ago in igb/ixgbe and I am addressing now by just
replacing == with a <= so that we always just round up to 1522 for anything
that isn't a jumbo frame.

Fixes: c751a3d58cf2d ("e1000e: Correctly include VLAN_HLEN when changing interface MTU")
Signed-off-by: Alexander Duyck <alexander.h.duyck@redhat.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/intel/e1000e/82571.c   |    2 +-
 drivers/net/ethernet/intel/e1000e/ich8lan.c |   10 +++++-----
 drivers/net/ethernet/intel/e1000e/netdev.c  |   18 ++++++++----------
 3 files changed, 14 insertions(+), 16 deletions(-)

--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -2010,7 +2010,7 @@ const struct e1000_info e1000_82573_info
 	.flags2			= FLAG2_DISABLE_ASPM_L1
 				  | FLAG2_DISABLE_ASPM_L0S,
 	.pba			= 20,
-	.max_hw_frame_size	= ETH_FRAME_LEN + ETH_FCS_LEN,
+	.max_hw_frame_size	= VLAN_ETH_FRAME_LEN + ETH_FCS_LEN,
 	.get_variants		= e1000_get_variants_82571,
 	.mac_ops		= &e82571_mac_ops,
 	.phy_ops		= &e82_phy_ops_m88,
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1563,7 +1563,7 @@ static s32 e1000_get_variants_ich8lan(st
 	    ((adapter->hw.mac.type >= e1000_pch2lan) &&
 	     (!(er32(CTRL_EXT) & E1000_CTRL_EXT_LSECCK)))) {
 		adapter->flags &= ~FLAG_HAS_JUMBO_FRAMES;
-		adapter->max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN;
+		adapter->max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
 
 		hw->mac.ops.blink_led = NULL;
 	}
@@ -5681,7 +5681,7 @@ const struct e1000_info e1000_ich8_info
 				  | FLAG_HAS_FLASH
 				  | FLAG_APME_IN_WUC,
 	.pba			= 8,
-	.max_hw_frame_size	= ETH_FRAME_LEN + ETH_FCS_LEN,
+	.max_hw_frame_size	= VLAN_ETH_FRAME_LEN + ETH_FCS_LEN,
 	.get_variants		= e1000_get_variants_ich8lan,
 	.mac_ops		= &ich8_mac_ops,
 	.phy_ops		= &ich8_phy_ops,
@@ -5754,7 +5754,7 @@ const struct e1000_info e1000_pch2_info
 	.flags2			= FLAG2_HAS_PHY_STATS
 				  | FLAG2_HAS_EEE,
 	.pba			= 26,
-	.max_hw_frame_size	= 9018,
+	.max_hw_frame_size	= 9022,
 	.get_variants		= e1000_get_variants_ich8lan,
 	.mac_ops		= &ich8_mac_ops,
 	.phy_ops		= &ich8_phy_ops,
@@ -5774,7 +5774,7 @@ const struct e1000_info e1000_pch_lpt_in
 	.flags2			= FLAG2_HAS_PHY_STATS
 				  | FLAG2_HAS_EEE,
 	.pba			= 26,
-	.max_hw_frame_size	= 9018,
+	.max_hw_frame_size	= 9022,
 	.get_variants		= e1000_get_variants_ich8lan,
 	.mac_ops		= &ich8_mac_ops,
 	.phy_ops		= &ich8_phy_ops,
@@ -5794,7 +5794,7 @@ const struct e1000_info e1000_pch_spt_in
 	.flags2			= FLAG2_HAS_PHY_STATS
 				  | FLAG2_HAS_EEE,
 	.pba			= 26,
-	.max_hw_frame_size	= 9018,
+	.max_hw_frame_size	= 9022,
 	.get_variants		= e1000_get_variants_ich8lan,
 	.mac_ops		= &ich8_mac_ops,
 	.phy_ops		= &ich8_phy_ops,
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3807,7 +3807,7 @@ void e1000e_reset(struct e1000_adapter *
 	/* reset Packet Buffer Allocation to default */
 	ew32(PBA, pba);
 
-	if (adapter->max_frame_size > ETH_FRAME_LEN + ETH_FCS_LEN) {
+	if (adapter->max_frame_size > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) {
 		/* To maintain wire speed transmits, the Tx FIFO should be
 		 * large enough to accommodate two full transmit packets,
 		 * rounded up to the next 1KB and expressed in KB.  Likewise,
@@ -4196,9 +4196,9 @@ static int e1000_sw_init(struct e1000_ad
 {
 	struct net_device *netdev = adapter->netdev;
 
-	adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN;
+	adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
 	adapter->rx_ps_bsize0 = 128;
-	adapter->max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
+	adapter->max_frame_size = netdev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
 	adapter->min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
 	adapter->tx_ring_count = E1000_DEFAULT_TXD;
 	adapter->rx_ring_count = E1000_DEFAULT_RXD;
@@ -5781,17 +5781,17 @@ struct rtnl_link_stats64 *e1000e_get_sta
 static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
 {
 	struct e1000_adapter *adapter = netdev_priv(netdev);
-	int max_frame = new_mtu + VLAN_HLEN + ETH_HLEN + ETH_FCS_LEN;
+	int max_frame = new_mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
 
 	/* Jumbo frame support */
-	if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) &&
+	if ((max_frame > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) &&
 	    !(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
 		e_err("Jumbo Frames not supported.\n");
 		return -EINVAL;
 	}
 
 	/* Supported frame sizes */
-	if ((new_mtu < ETH_ZLEN + ETH_FCS_LEN + VLAN_HLEN) ||
+	if ((new_mtu < (VLAN_ETH_ZLEN + ETH_FCS_LEN)) ||
 	    (max_frame > adapter->max_hw_frame_size)) {
 		e_err("Unsupported MTU setting\n");
 		return -EINVAL;
@@ -5831,10 +5831,8 @@ static int e1000_change_mtu(struct net_d
 		adapter->rx_buffer_len = 4096;
 
 	/* adjust allocation if LPE protects us, and we aren't using SBP */
-	if ((max_frame == ETH_FRAME_LEN + ETH_FCS_LEN) ||
-	    (max_frame == ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN))
-		adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN
-		    + ETH_FCS_LEN;
+	if (max_frame <= (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN))
+		adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
 
 	if (netif_running(netdev))
 		e1000e_up(adapter);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 230/267] clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 229/267] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 231/267] ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Marcin Jabrzyk,
	Damian Eppel, m.szyprowski, kyungmin.park, daniel.lezcano, kgene,
	linux-arm-kernel, Thomas Gleixner

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Damian Eppel <d.eppel@samsung.com>

commit 56a94f13919c0db5958611b388e1581b4852f3c9 upstream.

Whilst testing cpu hotplug events on kernel configured with
DEBUG_PREEMPT and DEBUG_ATOMIC_SLEEP we get following BUG message,
caused by calling request_irq() and free_irq() in the context of
hotplug notification (which is in this case atomic context).

[   40.785859] CPU1: Software reset
[   40.786660] BUG: sleeping function called from invalid context at mm/slub.c:1241
[   40.786668] in_atomic(): 1, irqs_disabled(): 128, pid: 0, name: swapper/1
[   40.786678] Preemption disabled at:[<  (null)>]   (null)
[   40.786681]
[   40.786692] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.19.0-rc4-00024-g7dca860 #36
[   40.786698] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[   40.786728] [<c0014a00>] (unwind_backtrace) from [<c0011980>] (show_stack+0x10/0x14)
[   40.786747] [<c0011980>] (show_stack) from [<c0449ba0>] (dump_stack+0x70/0xbc)
[   40.786767] [<c0449ba0>] (dump_stack) from [<c00c6124>] (kmem_cache_alloc+0xd8/0x170)
[   40.786785] [<c00c6124>] (kmem_cache_alloc) from [<c005d6f8>] (request_threaded_irq+0x64/0x128)
[   40.786804] [<c005d6f8>] (request_threaded_irq) from [<c0350b8c>] (exynos4_local_timer_setup+0xc0/0x13c)
[   40.786820] [<c0350b8c>] (exynos4_local_timer_setup) from [<c0350ca8>] (exynos4_mct_cpu_notify+0x30/0xa8)
[   40.786838] [<c0350ca8>] (exynos4_mct_cpu_notify) from [<c003b330>] (notifier_call_chain+0x44/0x84)
[   40.786857] [<c003b330>] (notifier_call_chain) from [<c0022fd4>] (__cpu_notify+0x28/0x44)
[   40.786873] [<c0022fd4>] (__cpu_notify) from [<c0013714>] (secondary_start_kernel+0xec/0x150)
[   40.786886] [<c0013714>] (secondary_start_kernel) from [<40008764>] (0x40008764)

Interrupts cannot be requested/freed in the CPU_STARTING/CPU_DYING
notifications which run on the hotplugged cpu with interrupts and
preemption disabled.

To avoid the issue, request the interrupts for all possible cpus in
the boot code. The interrupts are marked NO_AUTOENABLE to avoid a racy
request_irq/disable_irq() sequence. The flag prevents the
request_irq() code from enabling the interrupt immediately.

The interrupt is then enabled in the CPU_STARTING notifier of the
hotplugged cpu and again disabled with disable_irq_nosync() in the
CPU_DYING notifier.

[ tglx: Massaged changelog to match the patch ]

Fixes: 7114cd749a12 ("clocksource: exynos_mct: use (request/free)_irq calls for local timer registration")
Reported-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Tested-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Tested-by: Marcin Jabrzyk <m.jabrzyk@samsung.com>
Signed-off-by: Damian Eppel <d.eppel@samsung.com>
Cc: m.szyprowski@samsung.com
Cc: kyungmin.park@samsung.com
Cc: daniel.lezcano@linaro.org
Cc: kgene@kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/1435324984-7328-1-git-send-email-d.eppel@samsung.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clocksource/exynos_mct.c |   43 +++++++++++++++++++++++++++------------
 1 file changed, 30 insertions(+), 13 deletions(-)

--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -466,15 +466,12 @@ static int exynos4_local_timer_setup(str
 	exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
 
 	if (mct_int_type == MCT_INT_SPI) {
-		evt->irq = mct_irqs[MCT_L0_IRQ + cpu];
-		if (request_irq(evt->irq, exynos4_mct_tick_isr,
-				IRQF_TIMER | IRQF_NOBALANCING,
-				evt->name, mevt)) {
-			pr_err("exynos-mct: cannot register IRQ %d\n",
-				evt->irq);
+
+		if (evt->irq == -1)
 			return -EIO;
-		}
-		irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
+
+		irq_force_affinity(evt->irq, cpumask_of(cpu));
+		enable_irq(evt->irq);
 	} else {
 		enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
 	}
@@ -487,10 +484,12 @@ static int exynos4_local_timer_setup(str
 static void exynos4_local_timer_stop(struct clock_event_device *evt)
 {
 	evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt);
-	if (mct_int_type == MCT_INT_SPI)
-		free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick));
-	else
+	if (mct_int_type == MCT_INT_SPI) {
+		if (evt->irq != -1)
+			disable_irq_nosync(evt->irq);
+	} else {
 		disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
+	}
 }
 
 static int exynos4_mct_cpu_notify(struct notifier_block *self,
@@ -522,7 +521,7 @@ static struct notifier_block exynos4_mct
 
 static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
 {
-	int err;
+	int err, cpu;
 	struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick);
 	struct clk *mct_clk, *tick_clk;
 
@@ -549,7 +548,25 @@ static void __init exynos4_timer_resourc
 		WARN(err, "MCT: can't request IRQ %d (%d)\n",
 		     mct_irqs[MCT_L0_IRQ], err);
 	} else {
-		irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
+		for_each_possible_cpu(cpu) {
+			int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
+			struct mct_clock_event_device *pcpu_mevt =
+				per_cpu_ptr(&percpu_mct_tick, cpu);
+
+			pcpu_mevt->evt.irq = -1;
+
+			irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
+			if (request_irq(mct_irq,
+					exynos4_mct_tick_isr,
+					IRQF_TIMER | IRQF_NOBALANCING,
+					pcpu_mevt->name, pcpu_mevt)) {
+				pr_err("exynos-mct: cannot register IRQ (cpu%d)\n",
+									cpu);
+
+				continue;
+			}
+			pcpu_mevt->evt.irq = mct_irq;
+		}
 	}
 
 	err = register_cpu_notifier(&exynos4_mct_cpu_nb);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 231/267] ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 230/267] clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 232/267] ideapad: fix software rfkill setting Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Tunin, Philippe Coval, Darren Hart

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Tunin <hanipouspilot@gmail.com>

commit 4fa9dabcffc8e16601307d3d56b58c68d9716ba4 upstream.

Lenovo G30-50 does not have a hardware wireless switch and wireless
is always blocked.

BugLink: https://bugs.launchpad.net/bugs/1397021
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Philippe Coval <philippe.coval@open.eurogiciel.org>
[dvhart@linux.intel.com: Reordered dmi id per Phillippe's later version]
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/x86/ideapad-laptop.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -837,6 +837,13 @@ static const struct dmi_system_id no_hw_
 		},
 	},
 	{
+		.ident = "Lenovo G50-30",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo G50-30"),
+		},
+	},
+	{
 		.ident = "Lenovo Yoga 2 11 / 13 / Pro",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 232/267] ideapad: fix software rfkill setting
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 231/267] ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 233/267] of/address: use atomic allocation in pci_register_io_range() Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Darren Hart

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 4b200b4604bec3388426159f1656109d19fadf6e upstream.

This fixes a several year old regression that I found while trying
to get the Yoga 3 11 to work. The ideapad_rfk_set function is meant
to send a command to the embedded controller through ACPI, but
as of c1f73658ed, it sends the index of the rfkill device instead
of the command, and ignores the opcode field.

This changes it back to the original behavior, which indeed
flips the rfkill state as seen in the debugfs interface.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: c1f73658ed ("ideapad: pass ideapad_priv as argument (part 2)")
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/x86/ideapad-laptop.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -464,8 +464,9 @@ static const struct ideapad_rfk_data ide
 static int ideapad_rfk_set(void *data, bool blocked)
 {
 	struct ideapad_rfk_priv *priv = data;
+	int opcode = ideapad_rfk_data[priv->dev].opcode;
 
-	return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
+	return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
 }
 
 static struct rfkill_ops ideapad_rfk_ops = {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 233/267] of/address: use atomic allocation in pci_register_io_range()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 232/267] ideapad: fix software rfkill setting Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 235/267] ovl: lookup whiteouts outside iterate_dir() Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jingoo Han, Rob Herring

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jingoo Han <jingoohan1@gmail.com>

commit 294240ffe784e951dc2ef070da04fa31ef6db3a0 upstream.

When kzalloc() is called under spin_lock(), GFP_ATOMIC should be
used to avoid sleeping allocation.
The call tree is:
  of_pci_range_to_resource()
    --> pci_register_io_range() <-- takes spin_lock(&io_range_lock);
       --> kzalloc()

Signed-off-by: Jingoo Han <jingoohan1@gmail.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/of/address.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -712,7 +712,7 @@ int __weak pci_register_io_range(phys_ad
 	}
 
 	/* add the range to the list */
-	range = kzalloc(sizeof(*range), GFP_KERNEL);
+	range = kzalloc(sizeof(*range), GFP_ATOMIC);
 	if (!range) {
 		err = -ENOMEM;
 		goto end_register;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 235/267] ovl: lookup whiteouts outside iterate_dir()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 233/267] of/address: use atomic allocation in pci_register_io_range() Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 236/267] of: return NUMA_NO_NODE from fallback of_node_to_nid() Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi, Roman Yeryomin

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@suse.cz>

commit cdb672795876d7bc1870aed9a2d7cb59f43d1d96 upstream.

If jffs2 can deadlock on overlayfs readdir because it takes the same lock
on ->iterate() as in ->lookup().

Fix by moving whiteout checking outside iterate_dir().  Optimized by
collecting potential whiteouts (DT_CHR) in a temporary list and if
non-empty iterating throug these and checking for a 0/0 chardev.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Fixes: 49c21e1cacd7 ("ovl: check whiteout while reading directory")
Reported-by: Roman Yeryomin <leroi.lists@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/overlayfs/readdir.c |   77 +++++++++++++++++++++++++++++++------------------
 1 file changed, 49 insertions(+), 28 deletions(-)

--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -23,6 +23,7 @@ struct ovl_cache_entry {
 	u64 ino;
 	struct list_head l_node;
 	struct rb_node node;
+	struct ovl_cache_entry *next_maybe_whiteout;
 	bool is_whiteout;
 	char name[];
 };
@@ -39,7 +40,7 @@ struct ovl_readdir_data {
 	struct rb_root root;
 	struct list_head *list;
 	struct list_head middle;
-	struct dentry *dir;
+	struct ovl_cache_entry *first_maybe_whiteout;
 	int count;
 	int err;
 };
@@ -79,7 +80,7 @@ static struct ovl_cache_entry *ovl_cache
 	return NULL;
 }
 
-static struct ovl_cache_entry *ovl_cache_entry_new(struct dentry *dir,
+static struct ovl_cache_entry *ovl_cache_entry_new(struct ovl_readdir_data *rdd,
 						   const char *name, int len,
 						   u64 ino, unsigned int d_type)
 {
@@ -98,29 +99,8 @@ static struct ovl_cache_entry *ovl_cache
 	p->is_whiteout = false;
 
 	if (d_type == DT_CHR) {
-		struct dentry *dentry;
-		const struct cred *old_cred;
-		struct cred *override_cred;
-
-		override_cred = prepare_creds();
-		if (!override_cred) {
-			kfree(p);
-			return NULL;
-		}
-
-		/*
-		 * CAP_DAC_OVERRIDE for lookup
-		 */
-		cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
-		old_cred = override_creds(override_cred);
-
-		dentry = lookup_one_len(name, dir, len);
-		if (!IS_ERR(dentry)) {
-			p->is_whiteout = ovl_is_whiteout(dentry);
-			dput(dentry);
-		}
-		revert_creds(old_cred);
-		put_cred(override_cred);
+		p->next_maybe_whiteout = rdd->first_maybe_whiteout;
+		rdd->first_maybe_whiteout = p;
 	}
 	return p;
 }
@@ -148,7 +128,7 @@ static int ovl_cache_entry_add_rb(struct
 			return 0;
 	}
 
-	p = ovl_cache_entry_new(rdd->dir, name, len, ino, d_type);
+	p = ovl_cache_entry_new(rdd, name, len, ino, d_type);
 	if (p == NULL)
 		return -ENOMEM;
 
@@ -169,7 +149,7 @@ static int ovl_fill_lower(struct ovl_rea
 	if (p) {
 		list_move_tail(&p->l_node, &rdd->middle);
 	} else {
-		p = ovl_cache_entry_new(rdd->dir, name, namelen, ino, d_type);
+		p = ovl_cache_entry_new(rdd, name, namelen, ino, d_type);
 		if (p == NULL)
 			rdd->err = -ENOMEM;
 		else
@@ -219,6 +199,43 @@ static int ovl_fill_merge(struct dir_con
 		return ovl_fill_lower(rdd, name, namelen, offset, ino, d_type);
 }
 
+static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd)
+{
+	int err;
+	struct ovl_cache_entry *p;
+	struct dentry *dentry;
+	const struct cred *old_cred;
+	struct cred *override_cred;
+
+	override_cred = prepare_creds();
+	if (!override_cred)
+		return -ENOMEM;
+
+	/*
+	 * CAP_DAC_OVERRIDE for lookup
+	 */
+	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
+	old_cred = override_creds(override_cred);
+
+	err = mutex_lock_killable(&dir->d_inode->i_mutex);
+	if (!err) {
+		while (rdd->first_maybe_whiteout) {
+			p = rdd->first_maybe_whiteout;
+			rdd->first_maybe_whiteout = p->next_maybe_whiteout;
+			dentry = lookup_one_len(p->name, dir, p->len);
+			if (!IS_ERR(dentry)) {
+				p->is_whiteout = ovl_is_whiteout(dentry);
+				dput(dentry);
+			}
+		}
+		mutex_unlock(&dir->d_inode->i_mutex);
+	}
+	revert_creds(old_cred);
+	put_cred(override_cred);
+
+	return err;
+}
+
 static inline int ovl_dir_read(struct path *realpath,
 			       struct ovl_readdir_data *rdd)
 {
@@ -229,7 +246,7 @@ static inline int ovl_dir_read(struct pa
 	if (IS_ERR(realfile))
 		return PTR_ERR(realfile);
 
-	rdd->dir = realpath->dentry;
+	rdd->first_maybe_whiteout = NULL;
 	rdd->ctx.pos = 0;
 	do {
 		rdd->count = 0;
@@ -238,6 +255,10 @@ static inline int ovl_dir_read(struct pa
 		if (err >= 0)
 			err = rdd->err;
 	} while (!err && rdd->count);
+
+	if (!err && rdd->first_maybe_whiteout)
+		err = ovl_check_whiteouts(realpath->dentry, rdd);
+
 	fput(realfile);
 
 	return err;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 236/267] of: return NUMA_NO_NODE from fallback of_node_to_nid()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 235/267] ovl: lookup whiteouts outside iterate_dir() Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 239/267] clk: Fix JSON output in debugfs Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Konstantin Khlebnikov, Grant Likely

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>

commit c8fff7bc5bba6bd59cad40441c189c4efe7190f6 upstream.

Node 0 might be offline as well as any other numa node,
in this case kernel cannot handle memory allocation and crashes.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Fixes: 0c3f061c195c ("of: implement of_node_to_nid as a weak function")
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/of/base.c  |    2 +-
 include/linux/of.h |    5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -89,7 +89,7 @@ EXPORT_SYMBOL(of_n_size_cells);
 #ifdef CONFIG_NUMA
 int __weak of_node_to_nid(struct device_node *np)
 {
-	return numa_node_id();
+	return NUMA_NO_NODE;
 }
 #endif
 
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -673,7 +673,10 @@ static inline void of_property_clear_fla
 #if defined(CONFIG_OF) && defined(CONFIG_NUMA)
 extern int of_node_to_nid(struct device_node *np);
 #else
-static inline int of_node_to_nid(struct device_node *device) { return 0; }
+static inline int of_node_to_nid(struct device_node *device)
+{
+	return NUMA_NO_NODE;
+}
 #endif
 
 static inline struct device_node *of_find_matching_node(



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 239/267] clk: Fix JSON output in debugfs
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 236/267] of: return NUMA_NO_NODE from fallback of_node_to_nid() Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 240/267] clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Stephen Boyd

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Wahren <stefan.wahren@i2se.com>

commit 7cb81136d2efe0f5ed9d965857f4756a15e6c338 upstream.

key/value pairs in a JSON object must be separated by a comma.
After adding the properties "accuracy" and "phase" the JSON output
of /sys/kernel/debug/clk/clk_dump is invalid.

So add the missing commas to fix it.

Fixes: 5279fc402ae5 ("clk: add clk accuracy retrieval support")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
[sboyd@codeaurora.org: Added comment in function]
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/clk.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -230,11 +230,12 @@ static void clk_dump_one(struct seq_file
 	if (!c)
 		return;
 
+	/* This should be JSON format, i.e. elements separated with a comma */
 	seq_printf(s, "\"%s\": { ", c->name);
 	seq_printf(s, "\"enable_count\": %d,", c->enable_count);
 	seq_printf(s, "\"prepare_count\": %d,", c->prepare_count);
-	seq_printf(s, "\"rate\": %lu", clk_core_get_rate(c));
-	seq_printf(s, "\"accuracy\": %lu", clk_core_get_accuracy(c));
+	seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c));
+	seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
 	seq_printf(s, "\"phase\": %d", clk_core_get_phase(c));
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 240/267] clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 239/267] clk: Fix JSON output in debugfs Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 241/267] clk: qcom: Use parent rate when set rate to pixel RCG clock Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Stephen Boyd

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <k.kozlowski@samsung.com>

commit e0cdcda508f110b7ec190dc7c5eb2869ba73a535 upstream.

of_clk_get_from_provider() returns ERR_PTR on failure. The
dra7-atl-clock driver was not checking its return value and
immediately used it in __clk_get_hw().  __clk_get_hw()
dereferences supplied clock, if it is not NULL, so in that case
it would dereference an ERR_PTR.

Fixes: 9ac33b0ce81f ("CLK: TI: Driver for DRA7 ATL (Audio Tracking Logic)")
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/ti/clk-dra7-atl.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/clk/ti/clk-dra7-atl.c
+++ b/drivers/clk/ti/clk-dra7-atl.c
@@ -252,6 +252,11 @@ static int of_dra7_atl_clk_probe(struct
 		}
 
 		clk = of_clk_get_from_provider(&clkspec);
+		if (IS_ERR(clk)) {
+			pr_err("%s: failed to get atl clock %d from provider\n",
+			       __func__, i);
+			return PTR_ERR(clk);
+		}
 
 		cdesc = to_atl_desc(__clk_get_hw(clk));
 		cdesc->cinfo = cinfo;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 241/267] clk: qcom: Use parent rate when set rate to pixel RCG clock
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 240/267] clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 242/267] pNFS: Fix a memory leak when attempted pnfs fails Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hai Li, Archit Taneja, Stephen Boyd

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hai Li <hali@codeaurora.org>

commit 6d451367bfa16fc103604bacd258f534c65d1540 upstream.

Since the parent rate has been recalculated, pixel RCG clock
should rely on it to find the correct M/N values during set_rate,
instead of calling __clk_round_rate() to its parent again.

Signed-off-by: Hai Li <hali@codeaurora.org>
Tested-by: Archit Taneja <architt@codeaurora.org>
Fixes: 99cbd064b059 ("clk: qcom: Support display RCG clocks")
[sboyd@codeaurora.org: Silenced unused parent variable warning]
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/qcom/clk-rcg2.c |    9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

--- a/drivers/clk/qcom/clk-rcg2.c
+++ b/drivers/clk/qcom/clk-rcg2.c
@@ -530,19 +530,16 @@ static int clk_pixel_set_rate(struct clk
 	struct clk_rcg2 *rcg = to_clk_rcg2(hw);
 	struct freq_tbl f = *rcg->freq_tbl;
 	const struct frac_entry *frac = frac_table_pixel;
-	unsigned long request, src_rate;
+	unsigned long request;
 	int delta = 100000;
 	u32 mask = BIT(rcg->hid_width) - 1;
 	u32 hid_div;
-	int index = qcom_find_src_index(hw, rcg->parent_map, f.src);
-	struct clk *parent = clk_get_parent_by_index(hw->clk, index);
 
 	for (; frac->num; frac++) {
 		request = (rate * frac->den) / frac->num;
 
-		src_rate = __clk_round_rate(parent, request);
-		if ((src_rate < (request - delta)) ||
-			(src_rate > (request + delta)))
+		if ((parent_rate < (request - delta)) ||
+			(parent_rate > (request + delta)))
 			continue;
 
 		regmap_read(rcg->clkr.regmap, rcg->cmd_rcgr + CFG_REG,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 242/267] pNFS: Fix a memory leak when attempted pnfs fails
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 241/267] clk: qcom: Use parent rate when set rate to pixel RCG clock Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 243/267] pNFS/flexfiles: Fix the reset of struct pgio_header when resending Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit 1ca018d28d96d07788474abf66a5f3e9594841f5 upstream.

pnfs_do_write() expects the call to pnfs_write_through_mds() to free the
pgio header and to release the layout segment before exiting. The problem
is that nfs_pgio_data_destroy() doesn't actually do this; it only frees
the memory allocated by nfs_generic_pgio().

Ditto for pnfs_do_read()...

Fix in both cases is to add a call to hdr->release(hdr).

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/pnfs.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1865,6 +1865,7 @@ pnfs_write_through_mds(struct nfs_pageio
 		mirror->pg_recoalesce = 1;
 	}
 	nfs_pgio_data_destroy(hdr);
+	hdr->release(hdr);
 }
 
 static enum pnfs_try_status
@@ -1979,6 +1980,7 @@ pnfs_read_through_mds(struct nfs_pageio_
 		mirror->pg_recoalesce = 1;
 	}
 	nfs_pgio_data_destroy(hdr);
+	hdr->release(hdr);
 }
 
 /*



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 243/267] pNFS/flexfiles: Fix the reset of struct pgio_header when resending
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 242/267] pNFS: Fix a memory leak when attempted pnfs fails Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 244/267] NFS: Fix size of NFSACL SETACL operations Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit d620876990f02788d5a663075df007ffb91bdfad upstream.

hdr->good_bytes needs to be set to the length of the request, not
zero.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/flexfilelayout/flexfilelayout.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -631,7 +631,7 @@ static void ff_layout_reset_write(struct
 			nfs_direct_set_resched_writes(hdr->dreq);
 			/* fake unstable write to let common nfs resend pages */
 			hdr->verf.committed = NFS_UNSTABLE;
-			hdr->good_bytes = 0;
+			hdr->good_bytes = hdr->args.count;
 		}
 		return;
 	}



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 244/267] NFS: Fix size of NFSACL SETACL operations
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 243/267] pNFS/flexfiles: Fix the reset of struct pgio_header when resending Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 245/267] fixing infinite OPEN loop in 4.0 stateid recovery Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chuck Lever, Trond Myklebust

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chuck Lever <chuck.lever@oracle.com>

commit d683cc49daf7c5afca8cd9654aaa1bf63cdf2ad9 upstream.

When encoding the NFSACL SETACL operation, reserve just the estimated
size of the ACL rather than a fixed maximum. This eliminates needless
zero padding on the wire that the server ignores.

Fixes: ee5dc7732bd5 ('NFS: Fix "kernel BUG at fs/nfs/nfs3xdr.c:1338!"')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/nfs3xdr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(str
 	if (args->npages != 0)
 		xdr_write_pages(xdr, args->pages, 0, args->len);
 	else
-		xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
+		xdr_reserve_space(xdr, args->len);
 
 	error = nfsacl_encode(xdr->buf, base, args->inode,
 			    (args->mask & NFS_ACL) ?



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 245/267] fixing infinite OPEN loop in 4.0 stateid recovery
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 244/267] NFS: Fix size of NFSACL SETACL operations Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 246/267] nfs: increase size of EXCHANGE_ID name string buffer Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Olga Kornievskaia, Trond Myklebust

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Olga Kornievskaia <kolga@netapp.com>

commit e8d975e73e5fa05f983fbf2723120edcf68e0b38 upstream.

Problem: When an operation like WRITE receives a BAD_STATEID, even though
recovery code clears the RECLAIM_NOGRACE recovery flag before recovering
the open state, because of clearing delegation state for the associated
inode, nfs_inode_find_state_and_recover() gets called and it makes the
same state with RECLAIM_NOGRACE flag again. As a results, when we restart
looking over the open states, we end up in the infinite loop instead of
breaking out in the next test of state flags.

Solution: unset the RECLAIM_NOGRACE set because of
calling of nfs_inode_find_state_and_recover() after returning from calling
recover_open() function.

Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/nfs4state.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1482,6 +1482,8 @@ restart:
 					spin_unlock(&state->state_lock);
 				}
 				nfs4_put_open_state(state);
+				clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
+					&state->flags);
 				spin_lock(&sp->so_lock);
 				goto restart;
 			}



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 246/267] nfs: increase size of EXCHANGE_ID name string buffer
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 245/267] fixing infinite OPEN loop in 4.0 stateid recovery Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 247/267] NFS: Ensure we set NFS_CONTEXT_RESEND_WRITES when requeuing writes Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Skralivetsky, Jeff Layton,
	Trond Myklebust

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Layton <jlayton@poochiereds.net>

commit 764ad8ba8cd4c6f836fca9378f8c5121aece0842 upstream.

The current buffer is much too small if you have a relatively long
hostname. Bring it up to the size of the one that SETCLIENTID has.

Reported-by: Michael Skralivetsky <michael.skralivetsky@primarydata.com>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/nfs_xdr.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1142,7 +1142,7 @@ struct nfs41_state_protection {
 	struct nfs4_op_map allow;
 };
 
-#define NFS4_EXCHANGE_ID_LEN	(48)
+#define NFS4_EXCHANGE_ID_LEN	(127)
 struct nfs41_exchange_id_args {
 	struct nfs_client		*client;
 	nfs4_verifier			*verifier;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 247/267] NFS: Ensure we set NFS_CONTEXT_RESEND_WRITES when requeuing writes
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 246/267] nfs: increase size of EXCHANGE_ID name string buffer Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 248/267] nfs: fix potential credential leak in ff_layout_update_mirror_cred Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit c70701131f7a8edea91fc49d11796d342cff7c62 upstream.

If a write attempt fails, and the write is queued up for resending to
the server, as opposed to being dropped, then we need to set the
appropriate flag so that nfs_file_fsync() does the right thing.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/pnfs.c  |    1 +
 fs/nfs/write.c |    1 +
 2 files changed, 2 insertions(+)

--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1821,6 +1821,7 @@ int pnfs_write_done_resend_to_mds(struct
 	/* Resend all requests through the MDS */
 	nfs_pageio_init_write(&pgio, hdr->inode, FLUSH_STABLE, true,
 			      hdr->completion_ops);
+	set_bit(NFS_CONTEXT_RESEND_WRITES, &hdr->args.context->flags);
 	return nfs_pageio_resend(&pgio, hdr);
 }
 EXPORT_SYMBOL_GPL(pnfs_write_done_resend_to_mds);
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1289,6 +1289,7 @@ static void nfs_initiate_write(struct nf
 static void nfs_redirty_request(struct nfs_page *req)
 {
 	nfs_mark_request_dirty(req);
+	set_bit(NFS_CONTEXT_RESEND_WRITES, &req->wb_context->flags);
 	nfs_unlock_request(req);
 	nfs_end_page_writeback(req);
 	nfs_release_request(req);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 248/267] nfs: fix potential credential leak in ff_layout_update_mirror_cred
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 247/267] NFS: Ensure we set NFS_CONTEXT_RESEND_WRITES when requeuing writes Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 249/267] nfs: always update creds in mirror, even when we have an already connected ds Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeff Layton, Trond Myklebust

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Layton <jlayton@poochiereds.net>

commit a24221dca1868101c9b4b5adde4a6a5b1a3a64a7 upstream.

If we have two tasks racing to update a mirror's credentials, then they
can end up leaking one (or more) sets of credentials. The first task
will set mirror->cred and then the second task will just overwrite it.

Use a cmpxchg to ensure that the creds are only set once. If we get to
the point where we would set mirror->cred and find that they're already
set, then we just release the creds that were just found.

Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/flexfilelayout/flexfilelayoutdev.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -324,7 +324,8 @@ static int ff_layout_update_mirror_cred(
 				__func__, PTR_ERR(cred));
 			return PTR_ERR(cred);
 		} else {
-			mirror->cred = cred;
+			if (cmpxchg(&mirror->cred, NULL, cred))
+				put_rpccred(cred);
 		}
 	}
 	return 0;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 249/267] nfs: always update creds in mirror, even when we have an already connected ds
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 248/267] nfs: fix potential credential leak in ff_layout_update_mirror_cred Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 250/267] SUNRPC: Fix a memory leak in the backchannel code Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Haynes, Jeff Layton, Trond Myklebust

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Layton <jlayton@poochiereds.net>

commit 0c8315dd56577445dd1afe6b9cfa06b7efdf2f82 upstream.

A ds can be associated with more than one mirror, but we currently skip
setting a mirror's credentials if we find that it's already set up with
a connected client.

The upshot is that we can end up sending DS writes with MDS credentials
instead of properly setting them up. Fix nfs4_ff_layout_prepare_ds to
always verify that the mirror's credentials are set up, even when we
have a DS that's already connected.

Reported-by: Tom Haynes <thomas.haynes@primarydata.com>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/flexfilelayout/flexfilelayoutdev.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -387,7 +387,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_la
 	/* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */
 	smp_rmb();
 	if (ds->ds_clp)
-		goto out;
+		goto out_update_creds;
 
 	flavor = nfs4_ff_layout_choose_authflavor(mirror);
 
@@ -431,7 +431,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_la
 			}
 		}
 	}
-
+out_update_creds:
 	if (ff_layout_update_mirror_cred(mirror, ds))
 		ds = NULL;
 out:



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 250/267] SUNRPC: Fix a memory leak in the backchannel code
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 249/267] nfs: always update creds in mirror, even when we have an already connected ds Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 251/267] 9p: forgetting to cancel request on interrupted zero-copy RPC Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit 88de6af24f2b48b06c514d3c3d0a8f22fafe30bd upstream.

req->rq_private_buf isn't initialised when xprt_setup_backchannel calls
xprt_free_allocation.

Fixes: fb7a0b9addbdb ("nfs41: New backchannel helper routines")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/backchannel_rqst.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct
 
 	dprintk("RPC:        free allocations for req= %p\n", req);
 	WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
-	xbufp = &req->rq_private_buf;
+	xbufp = &req->rq_rcv_buf;
 	free_page((unsigned long)xbufp->head[0].iov_base);
 	xbufp = &req->rq_snd_buf;
 	free_page((unsigned long)xbufp->head[0].iov_base);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 251/267] 9p: forgetting to cancel request on interrupted zero-copy RPC
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 250/267] SUNRPC: Fix a memory leak in the backchannel code Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 252/267] 9p: dont leave a half-initialized inode sitting around Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <viro@zeniv.linux.org.uk>

commit a84b69cb6e0a41e86bc593904faa6def3b957343 upstream.

If we'd already sent a request and decide to abort it, we *must*
issue TFLUSH properly and not just blindly reuse the tag, or
we'll get seriously screwed when response eventually arrives
and we confuse it for response to later request that had reused
the same tag.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/9p/client.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -843,7 +843,8 @@ static struct p9_req_t *p9_client_zc_rpc
 	if (err < 0) {
 		if (err == -EIO)
 			c->status = Disconnected;
-		goto reterr;
+		if (err != -ERESTARTSYS)
+			goto reterr;
 	}
 	if (req->status == REQ_STATUS_ERROR) {
 		p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 252/267] 9p: dont leave a half-initialized inode sitting around
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 251/267] 9p: forgetting to cancel request on interrupted zero-copy RPC Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 253/267] rbd: use GFP_NOIO in rbd_obj_request_create() Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <viro@zeniv.linux.org.uk>

commit 0a73d0a204a4a04a1e110539c5a524ae51f91d6d upstream.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/9p/vfs_inode.c      |    3 +--
 fs/9p/vfs_inode_dotl.c |    3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struc
 	unlock_new_inode(inode);
 	return inode;
 error:
-	unlock_new_inode(inode);
-	iput(inode);
+	iget_failed(inode);
 	return ERR_PTR(retval);
 
 }
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(
 	unlock_new_inode(inode);
 	return inode;
 error:
-	unlock_new_inode(inode);
-	iput(inode);
+	iget_failed(inode);
 	return ERR_PTR(retval);
 
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 253/267] rbd: use GFP_NOIO in rbd_obj_request_create()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 252/267] 9p: dont leave a half-initialized inode sitting around Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 254/267] agp/intel: Fix typo in needs_ilk_vtd_wa() Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Alex Elder

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Dryomov <idryomov@gmail.com>

commit 5a60e87603c4c533492c515b7f62578189b03c9c upstream.

rbd_obj_request_create() is called on the main I/O path, so we need to
use GFP_NOIO to make sure allocation doesn't blow back on us.  Not all
callers need this, but I'm still hardcoding the flag inside rather than
making it a parameter because a) this is going to stable, and b) those
callers shouldn't really use rbd_obj_request_create() and will be fixed
in the future.

More memory allocation fixes will follow.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/rbd.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2001,11 +2001,11 @@ static struct rbd_obj_request *rbd_obj_r
 	rbd_assert(obj_request_type_valid(type));
 
 	size = strlen(object_name) + 1;
-	name = kmalloc(size, GFP_KERNEL);
+	name = kmalloc(size, GFP_NOIO);
 	if (!name)
 		return NULL;
 
-	obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
+	obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
 	if (!obj_request) {
 		kfree(name);
 		return NULL;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 254/267] agp/intel: Fix typo in needs_ilk_vtd_wa()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 253/267] rbd: use GFP_NOIO in rbd_obj_request_create() Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 255/267] ARM: dove: fix legacy dove IRQ numbers Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ting-Wei Lan, Chris Wilson,
	Daniel Vetter, Jani Nikula

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Wilson <chris@chris-wilson.co.uk>

commit 8b572a4200828b4e75cc22ed2f494b58d5372d65 upstream.

In needs_ilk_vtd_wa(), we pass in the GPU device but compared it against
the ids for the mobile GPU and the mobile host bridge. That latter is
impossible and so likely was just a typo for the desktop GPU device id
(which is also buggy).

Fixes commit da88a5f7f7d434e2cde1b3e19d952e6d84533662
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Wed Feb 13 09:31:53 2013 +0000

    drm/i915: Disable WC PTE updates to w/a buggy IOMMU on ILK

Reported-by: Ting-Wei Lan <lantw44@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91127
References: https://bugzilla.freedesktop.org/show_bug.cgi?id=60391
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/agp/intel-gtt.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -581,7 +581,7 @@ static inline int needs_ilk_vtd_wa(void)
 	/* Query intel_iommu to see if we need the workaround. Presumably that
 	 * was loaded first.
 	 */
-	if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
+	if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
 	     gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
 	     intel_iommu_gfx_mapped)
 		return 1;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 255/267] ARM: dove: fix legacy dove IRQ numbers
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 254/267] agp/intel: Fix typo in needs_ilk_vtd_wa() Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 256/267] EDAC, octeon: Fix broken build due to model helper renames Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Gregory CLEMENT

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Russell King <rmk+kernel@arm.linux.org.uk>

commit 5d6bed2a9c8bc161bff4cc7cede00f2e0e27a7e7 upstream.

v3.18 changed handle_IRQ() to call __handle_domain_irq(), which now
rejects attempts to deliver IRQ0.  Since IRQ 0 is used as the timer
interrupt (just like the PIT on x86), this causes boot to fail as the
bogomips calibration never completes.

Fix this by shuffling all interrupts up by one.

Fixes: a71b092a9c68 ("ARM: Convert handle_IRQ to use __handle_domain_irq")
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-dove/include/mach/irqs.h |  118 ++++++++++++++++-----------------
 arch/arm/mach-dove/irq.c               |    8 +-
 2 files changed, 63 insertions(+), 63 deletions(-)

--- a/arch/arm/mach-dove/include/mach/irqs.h
+++ b/arch/arm/mach-dove/include/mach/irqs.h
@@ -14,73 +14,73 @@
 /*
  * Dove Low Interrupt Controller
  */
-#define IRQ_DOVE_BRIDGE		0
-#define IRQ_DOVE_H2C		1
-#define IRQ_DOVE_C2H		2
-#define IRQ_DOVE_NAND		3
-#define IRQ_DOVE_PDMA		4
-#define IRQ_DOVE_SPI1		5
-#define IRQ_DOVE_SPI0		6
-#define IRQ_DOVE_UART_0		7
-#define IRQ_DOVE_UART_1		8
-#define IRQ_DOVE_UART_2		9
-#define IRQ_DOVE_UART_3		10
-#define IRQ_DOVE_I2C		11
-#define IRQ_DOVE_GPIO_0_7	12
-#define IRQ_DOVE_GPIO_8_15	13
-#define IRQ_DOVE_GPIO_16_23	14
-#define IRQ_DOVE_PCIE0_ERR	15
-#define IRQ_DOVE_PCIE0		16
-#define IRQ_DOVE_PCIE1_ERR	17
-#define IRQ_DOVE_PCIE1		18
-#define IRQ_DOVE_I2S0		19
-#define IRQ_DOVE_I2S0_ERR	20
-#define IRQ_DOVE_I2S1		21
-#define IRQ_DOVE_I2S1_ERR	22
-#define IRQ_DOVE_USB_ERR	23
-#define IRQ_DOVE_USB0		24
-#define IRQ_DOVE_USB1		25
-#define IRQ_DOVE_GE00_RX	26
-#define IRQ_DOVE_GE00_TX	27
-#define IRQ_DOVE_GE00_MISC	28
-#define IRQ_DOVE_GE00_SUM	29
-#define IRQ_DOVE_GE00_ERR	30
-#define IRQ_DOVE_CRYPTO		31
+#define IRQ_DOVE_BRIDGE		(1 + 0)
+#define IRQ_DOVE_H2C		(1 + 1)
+#define IRQ_DOVE_C2H		(1 + 2)
+#define IRQ_DOVE_NAND		(1 + 3)
+#define IRQ_DOVE_PDMA		(1 + 4)
+#define IRQ_DOVE_SPI1		(1 + 5)
+#define IRQ_DOVE_SPI0		(1 + 6)
+#define IRQ_DOVE_UART_0		(1 + 7)
+#define IRQ_DOVE_UART_1		(1 + 8)
+#define IRQ_DOVE_UART_2		(1 + 9)
+#define IRQ_DOVE_UART_3		(1 + 10)
+#define IRQ_DOVE_I2C		(1 + 11)
+#define IRQ_DOVE_GPIO_0_7	(1 + 12)
+#define IRQ_DOVE_GPIO_8_15	(1 + 13)
+#define IRQ_DOVE_GPIO_16_23	(1 + 14)
+#define IRQ_DOVE_PCIE0_ERR	(1 + 15)
+#define IRQ_DOVE_PCIE0		(1 + 16)
+#define IRQ_DOVE_PCIE1_ERR	(1 + 17)
+#define IRQ_DOVE_PCIE1		(1 + 18)
+#define IRQ_DOVE_I2S0		(1 + 19)
+#define IRQ_DOVE_I2S0_ERR	(1 + 20)
+#define IRQ_DOVE_I2S1		(1 + 21)
+#define IRQ_DOVE_I2S1_ERR	(1 + 22)
+#define IRQ_DOVE_USB_ERR	(1 + 23)
+#define IRQ_DOVE_USB0		(1 + 24)
+#define IRQ_DOVE_USB1		(1 + 25)
+#define IRQ_DOVE_GE00_RX	(1 + 26)
+#define IRQ_DOVE_GE00_TX	(1 + 27)
+#define IRQ_DOVE_GE00_MISC	(1 + 28)
+#define IRQ_DOVE_GE00_SUM	(1 + 29)
+#define IRQ_DOVE_GE00_ERR	(1 + 30)
+#define IRQ_DOVE_CRYPTO		(1 + 31)
 
 /*
  * Dove High Interrupt Controller
  */
-#define IRQ_DOVE_AC97		32
-#define IRQ_DOVE_PMU		33
-#define IRQ_DOVE_CAM		34
-#define IRQ_DOVE_SDIO0		35
-#define IRQ_DOVE_SDIO1		36
-#define IRQ_DOVE_SDIO0_WAKEUP	37
-#define IRQ_DOVE_SDIO1_WAKEUP	38
-#define IRQ_DOVE_XOR_00		39
-#define IRQ_DOVE_XOR_01		40
-#define IRQ_DOVE_XOR0_ERR	41
-#define IRQ_DOVE_XOR_10		42
-#define IRQ_DOVE_XOR_11		43
-#define IRQ_DOVE_XOR1_ERR	44
-#define IRQ_DOVE_LCD_DCON	45
-#define IRQ_DOVE_LCD1		46
-#define IRQ_DOVE_LCD0		47
-#define IRQ_DOVE_GPU		48
-#define IRQ_DOVE_PERFORM_MNTR	49
-#define IRQ_DOVE_VPRO_DMA1	51
-#define IRQ_DOVE_SSP_TIMER	54
-#define IRQ_DOVE_SSP		55
-#define IRQ_DOVE_MC_L2_ERR	56
-#define IRQ_DOVE_CRYPTO_ERR	59
-#define IRQ_DOVE_GPIO_24_31	60
-#define IRQ_DOVE_HIGH_GPIO	61
-#define IRQ_DOVE_SATA		62
+#define IRQ_DOVE_AC97		(1 + 32)
+#define IRQ_DOVE_PMU		(1 + 33)
+#define IRQ_DOVE_CAM		(1 + 34)
+#define IRQ_DOVE_SDIO0		(1 + 35)
+#define IRQ_DOVE_SDIO1		(1 + 36)
+#define IRQ_DOVE_SDIO0_WAKEUP	(1 + 37)
+#define IRQ_DOVE_SDIO1_WAKEUP	(1 + 38)
+#define IRQ_DOVE_XOR_00		(1 + 39)
+#define IRQ_DOVE_XOR_01		(1 + 40)
+#define IRQ_DOVE_XOR0_ERR	(1 + 41)
+#define IRQ_DOVE_XOR_10		(1 + 42)
+#define IRQ_DOVE_XOR_11		(1 + 43)
+#define IRQ_DOVE_XOR1_ERR	(1 + 44)
+#define IRQ_DOVE_LCD_DCON	(1 + 45)
+#define IRQ_DOVE_LCD1		(1 + 46)
+#define IRQ_DOVE_LCD0		(1 + 47)
+#define IRQ_DOVE_GPU		(1 + 48)
+#define IRQ_DOVE_PERFORM_MNTR	(1 + 49)
+#define IRQ_DOVE_VPRO_DMA1	(1 + 51)
+#define IRQ_DOVE_SSP_TIMER	(1 + 54)
+#define IRQ_DOVE_SSP		(1 + 55)
+#define IRQ_DOVE_MC_L2_ERR	(1 + 56)
+#define IRQ_DOVE_CRYPTO_ERR	(1 + 59)
+#define IRQ_DOVE_GPIO_24_31	(1 + 60)
+#define IRQ_DOVE_HIGH_GPIO	(1 + 61)
+#define IRQ_DOVE_SATA		(1 + 62)
 
 /*
  * DOVE General Purpose Pins
  */
-#define IRQ_DOVE_GPIO_START	64
+#define IRQ_DOVE_GPIO_START	65
 #define NR_GPIO_IRQS		64
 
 /*
--- a/arch/arm/mach-dove/irq.c
+++ b/arch/arm/mach-dove/irq.c
@@ -126,14 +126,14 @@ __exception_irq_entry dove_legacy_handle
 	stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_LOW_OFF);
 	stat &= readl_relaxed(dove_irq_base + IRQ_MASK_LOW_OFF);
 	if (stat) {
-		unsigned int hwirq = __fls(stat);
+		unsigned int hwirq = 1 + __fls(stat);
 		handle_IRQ(hwirq, regs);
 		return;
 	}
 	stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_HIGH_OFF);
 	stat &= readl_relaxed(dove_irq_base + IRQ_MASK_HIGH_OFF);
 	if (stat) {
-		unsigned int hwirq = 32 + __fls(stat);
+		unsigned int hwirq = 33 + __fls(stat);
 		handle_IRQ(hwirq, regs);
 		return;
 	}
@@ -144,8 +144,8 @@ void __init dove_init_irq(void)
 {
 	int i;
 
-	orion_irq_init(0, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
-	orion_irq_init(32, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
+	orion_irq_init(1, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
+	orion_irq_init(33, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
 
 #ifdef CONFIG_MULTI_IRQ_HANDLER
 	set_handle_irq(dove_legacy_handle_irq);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 256/267] EDAC, octeon: Fix broken build due to model helper renames
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (229 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 255/267] ARM: dove: fix legacy dove IRQ numbers Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 257/267] p9_client_write(): avoid double p9_free_req() Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Aaro Koskinen, David Daney,
	Mauro Carvalho Chehab, Ralf Baechle, linux-edac, linux-mips,
	Borislav Petkov

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Aaro Koskinen <aaro.koskinen@nokia.com>

commit 75a15a7864c9e281c74a1670b10b69d1d7ff1c82 upstream.

Commit

  debe6a623d3c ("MIPS: OCTEON: Update octeon-model.h code for new SoCs.")

renamed some SoC model helper functions, but forgot to update the EDAC
drivers resulting in build failures. Fix that.

Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Acked-by: David Daney <david.daney@cavium.com>
Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-edac <linux-edac@vger.kernel.org>
Cc: linux-mips@linux-mips.org
Link: http://lkml.kernel.org/r/1435747132-10954-1-git-send-email-aaro.koskinen@nokia.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/edac/octeon_edac-l2c.c |    2 +-
 drivers/edac/octeon_edac-lmc.c |    2 +-
 drivers/edac/octeon_edac-pc.c  |    2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/edac/octeon_edac-l2c.c
+++ b/drivers/edac/octeon_edac-l2c.c
@@ -151,7 +151,7 @@ static int octeon_l2c_probe(struct platf
 	l2c->ctl_name = "octeon_l2c_err";
 
 
-	if (OCTEON_IS_MODEL(OCTEON_FAM_1_PLUS)) {
+	if (OCTEON_IS_OCTEON1PLUS()) {
 		union cvmx_l2t_err l2t_err;
 		union cvmx_l2d_err l2d_err;
 
--- a/drivers/edac/octeon_edac-lmc.c
+++ b/drivers/edac/octeon_edac-lmc.c
@@ -234,7 +234,7 @@ static int octeon_lmc_edac_probe(struct
 	layers[0].size = 1;
 	layers[0].is_virt_csrow = false;
 
-	if (OCTEON_IS_MODEL(OCTEON_FAM_1_PLUS)) {
+	if (OCTEON_IS_OCTEON1PLUS()) {
 		union cvmx_lmcx_mem_cfg0 cfg0;
 
 		cfg0.u64 = cvmx_read_csr(CVMX_LMCX_MEM_CFG0(0));
--- a/drivers/edac/octeon_edac-pc.c
+++ b/drivers/edac/octeon_edac-pc.c
@@ -73,7 +73,7 @@ static int  co_cache_error_event(struct
 			edac_device_handle_ce(p->ed, cpu, 0, "dcache");
 
 		/* Clear the error indication */
-		if (OCTEON_IS_MODEL(OCTEON_FAM_2))
+		if (OCTEON_IS_OCTEON2())
 			write_octeon_c0_dcacheerr(1);
 		else
 			write_octeon_c0_dcacheerr(0);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 257/267] p9_client_write(): avoid double p9_free_req()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (230 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 256/267] EDAC, octeon: Fix broken build due to model helper renames Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 258/267] ARM64: smp: Fix suspicious RCU usage with ipi tracepoints Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <viro@zeniv.linux.org.uk>

commit 67e808fbb0404a12d9b9830a44bbb48d447d8bc9 upstream.

Braino in "9p: switch p9_client_write() to passing it struct iov_iter *";
if response is impossible to parse and we discard the request, get the
out of the loop right there.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/9p/client.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -1648,6 +1648,7 @@ p9_client_write(struct p9_fid *fid, u64
 		if (*err) {
 			trace_9p_protocol_dump(clnt, req->rc);
 			p9_free_req(clnt, req);
+			break;
 		}
 
 		p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", count);



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 258/267] ARM64: smp: Fix suspicious RCU usage with ipi tracepoints
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (231 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 257/267] p9_client_write(): avoid double p9_free_req() Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 259/267] arm64: bpf: fix out-of-bounds read in bpf2a64_offset() Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Stultz, Nicolas Pitre,
	Steven Rostedt, Paul E. McKenney, Stephen Boyd, Catalin Marinas

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stephen Boyd <sboyd@codeaurora.org>

commit be081d9bf3e163a9ed1ca2f0f14f08424c7f9016 upstream.

John Stultz reported an RCU splat on ARM with ipi trace events
enabled. It looks like the same problem exists on ARM64.

At this point in the IPI handling path we haven't called
irq_enter() yet, so RCU doesn't know that we're about to exit
idle and properly warns that we're using RCU from an idle CPU.
Use trace_ipi_entry_rcuidle() instead of trace_ipi_entry() so
that RCU is informed about our exit from idle.

Cc: John Stultz <john.stultz@linaro.org>
Cc: Nicolas Pitre <nicolas.pitre@linaro.org>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Fixes: 45ed695ac10a ("ARM64: add IPI tracepoints")
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/kernel/smp.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -569,7 +569,7 @@ void handle_IPI(int ipinr, struct pt_reg
 	struct pt_regs *old_regs = set_irq_regs(regs);
 
 	if ((unsigned)ipinr < NR_IPI) {
-		trace_ipi_entry(ipi_types[ipinr]);
+		trace_ipi_entry_rcuidle(ipi_types[ipinr]);
 		__inc_irq_stat(cpu, ipi_irqs[ipinr]);
 	}
 
@@ -612,7 +612,7 @@ void handle_IPI(int ipinr, struct pt_reg
 	}
 
 	if ((unsigned)ipinr < NR_IPI)
-		trace_ipi_exit(ipi_types[ipinr]);
+		trace_ipi_exit_rcuidle(ipi_types[ipinr]);
 	set_irq_regs(old_regs);
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 259/267] arm64: bpf: fix out-of-bounds read in bpf2a64_offset()
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (232 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 258/267] ARM64: smp: Fix suspicious RCU usage with ipi tracepoints Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 260/267] arm64: bpf: fix endianness conversion bugs Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zi Shen Lim, Will Deacon,
	Alexei Starovoitov, Xi Wang, Catalin Marinas

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xi Wang <xi.wang@gmail.com>

commit 8eee539ddea09bccae2426f09b0ba6a18b72b691 upstream.

Problems occur when bpf_to or bpf_from has value prog->len - 1 (e.g.,
"Very long jump backwards" in test_bpf where the last instruction is a
jump): since ctx->offset has length prog->len, ctx->offset[bpf_to + 1]
or ctx->offset[bpf_from + 1] will cause an out-of-bounds read, leading
to a bogus jump offset and kernel panic.

This patch moves updating ctx->offset to after calling build_insn(),
and changes indexing to use bpf_to and bpf_from without + 1.

Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler")
Cc: Zi Shen Lim <zlim.lnx@gmail.com>
Cc: Will Deacon <will.deacon@arm.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/net/bpf_jit_comp.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -113,9 +113,9 @@ static inline void emit_a64_mov_i(const
 static inline int bpf2a64_offset(int bpf_to, int bpf_from,
 				 const struct jit_ctx *ctx)
 {
-	int to = ctx->offset[bpf_to + 1];
+	int to = ctx->offset[bpf_to];
 	/* -1 to account for the Branch instruction */
-	int from = ctx->offset[bpf_from + 1] - 1;
+	int from = ctx->offset[bpf_from] - 1;
 
 	return to - from;
 }
@@ -640,10 +640,11 @@ static int build_body(struct jit_ctx *ct
 		const struct bpf_insn *insn = &prog->insnsi[i];
 		int ret;
 
+		ret = build_insn(insn, ctx);
+
 		if (ctx->image == NULL)
 			ctx->offset[i] = ctx->idx;
 
-		ret = build_insn(insn, ctx);
 		if (ret > 0) {
 			i++;
 			continue;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 260/267] arm64: bpf: fix endianness conversion bugs
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (233 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 259/267] arm64: bpf: fix out-of-bounds read in bpf2a64_offset() Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 261/267] arm64: Dont report clear pmds and puds as huge Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zi Shen Lim, Alexei Starovoitov,
	Xi Wang, Catalin Marinas

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xi Wang <xi.wang@gmail.com>

commit d63903bbc30c7ccad040851dfdb4da12d9a17bcf upstream.

Upper bits should be zeroed in endianness conversion:

- even when there's no need to change endianness (i.e., BPF_FROM_BE
  on big endian or BPF_FROM_LE on little endian);

- after rev16.

This patch fixes such bugs by emitting extra instructions to clear
upper bits.

Cc: Zi Shen Lim <zlim.lnx@gmail.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler")
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/net/bpf_jit.h      |    4 ++++
 arch/arm64/net/bpf_jit_comp.c |   22 ++++++++++++++++++++--
 2 files changed, 24 insertions(+), 2 deletions(-)

--- a/arch/arm64/net/bpf_jit.h
+++ b/arch/arm64/net/bpf_jit.h
@@ -110,6 +110,10 @@
 /* Rd = Rn >> shift; signed */
 #define A64_ASR(sf, Rd, Rn, shift) A64_SBFM(sf, Rd, Rn, shift, (sf) ? 63 : 31)
 
+/* Zero extend */
+#define A64_UXTH(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 15)
+#define A64_UXTW(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 31)
+
 /* Move wide (immediate) */
 #define A64_MOVEW(sf, Rd, imm16, shift, type) \
 	aarch64_insn_gen_movewide(Rd, imm16, shift, \
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -289,23 +289,41 @@ static int build_insn(const struct bpf_i
 	case BPF_ALU | BPF_END | BPF_FROM_BE:
 #ifdef CONFIG_CPU_BIG_ENDIAN
 		if (BPF_SRC(code) == BPF_FROM_BE)
-			break;
+			goto emit_bswap_uxt;
 #else /* !CONFIG_CPU_BIG_ENDIAN */
 		if (BPF_SRC(code) == BPF_FROM_LE)
-			break;
+			goto emit_bswap_uxt;
 #endif
 		switch (imm) {
 		case 16:
 			emit(A64_REV16(is64, dst, dst), ctx);
+			/* zero-extend 16 bits into 64 bits */
+			emit(A64_UXTH(is64, dst, dst), ctx);
 			break;
 		case 32:
 			emit(A64_REV32(is64, dst, dst), ctx);
+			/* upper 32 bits already cleared */
 			break;
 		case 64:
 			emit(A64_REV64(dst, dst), ctx);
 			break;
 		}
 		break;
+emit_bswap_uxt:
+		switch (imm) {
+		case 16:
+			/* zero-extend 16 bits into 64 bits */
+			emit(A64_UXTH(is64, dst, dst), ctx);
+			break;
+		case 32:
+			/* zero-extend 32 bits into 64 bits */
+			emit(A64_UXTW(is64, dst, dst), ctx);
+			break;
+		case 64:
+			/* nop */
+			break;
+		}
+		break;
 	/* dst = imm */
 	case BPF_ALU | BPF_MOV | BPF_K:
 	case BPF_ALU64 | BPF_MOV | BPF_K:



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 261/267] arm64: Dont report clear pmds and puds as huge
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (234 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 260/267] arm64: bpf: fix endianness conversion bugs Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 262/267] perf bench numa: Fix to show proper convergence stats Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoffer Dall, Steve Capper,
	Marc Zyngier, Catalin Marinas

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christoffer Dall <christoffer.dall@linaro.org>

commit fd28f5d439fca77348c129d5b73043a56f8a0296 upstream.

The current pmd_huge() and pud_huge() functions simply check if the table
bit is not set and reports the entries as huge in that case.  This is
counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and
it is inconsistent with at least arm and x86.

To prevent others from making the same mistake as me in looking at code
that calls these functions and to fix an issue with KVM on arm64 that
causes memory corruption due to incorrect page reference counting
resulting from this mistake, let's change the behavior.

Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Reviewed-by: Steve Capper <steve.capper@linaro.org>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Fixes: 084bd29810a5 ("ARM64: mm: HugeTLB support.")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/mm/hugetlbpage.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *m
 
 int pmd_huge(pmd_t pmd)
 {
-	return !(pmd_val(pmd) & PMD_TABLE_BIT);
+	return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
 }
 
 int pud_huge(pud_t pud)
 {
 #ifndef __PAGETABLE_PMD_FOLDED
-	return !(pud_val(pud) & PUD_TABLE_BIT);
+	return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
 #else
 	return 0;
 #endif



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 262/267] perf bench numa: Fix to show proper convergence stats
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (235 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 261/267] arm64: Dont report clear pmds and puds as huge Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 263/267] ARM: 8393/1: smp: Fix suspicious RCU usage with ipi tracepoints Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Srikar Dronamraju, Ingo Molnar,
	Jiri Olsa, Masami Hiramatsu, Namhyung Kim, Vinson Lee,
	Arnaldo Carvalho de Melo

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>

commit 2b42b09b88c831ba4da2d669581dde371c38c2af upstream.

With commit: e1e455f4f4d3 (perf tools: Work around lack of sched_getcpu
in glibc < 2.6), perf_bench numa mem with -c or -m option is not able to
correctly calculate convergence.

With the above commit, sched_getcpu always seems to return -1. The
intention of commit e1e455f was to add a sched_getcpu in glibc < 2.6.
Hence keep the sched_getcpu definition under an ifdef.

This regression happened occurred between v4.0 and v4.1

Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Vinson Lee <vlee@twitter.com>
Fixes:  e1e455f4f4d3 ("perf tools: Work around lack of sched_getcpu in glibc < 2.6")
Link: http://lkml.kernel.org/r/20150624111004.GA5220@linux.vnet.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/perf/util/cloexec.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/tools/perf/util/cloexec.c
+++ b/tools/perf/util/cloexec.c
@@ -7,11 +7,15 @@
 
 static unsigned long flag = PERF_FLAG_FD_CLOEXEC;
 
+#ifdef __GLIBC_PREREQ
+#if !__GLIBC_PREREQ(2, 6)
 int __weak sched_getcpu(void)
 {
 	errno = ENOSYS;
 	return -1;
 }
+#endif
+#endif
 
 static int perf_flag_probe(void)
 {



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 263/267] ARM: 8393/1: smp: Fix suspicious RCU usage with ipi tracepoints
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (236 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 262/267] perf bench numa: Fix to show proper convergence stats Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 264/267] ARM: 8397/1: fix vdsomunge not to depend on glibc specific error.h Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Stultz, Steven Rostedt,
	Paul E. McKenney, Stephen Boyd, Russell King

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stephen Boyd <sboyd@codeaurora.org>

commit 398f74569cebbf06bc6b069442bcd0e9616ca465 upstream.

John Stultz reports an RCU splat on boot with ARM ipi trace
events enabled.

===============================
[ INFO: suspicious RCU usage. ]
4.1.0-rc7-00033-gb5bed2f #153 Not tainted
-------------------------------
include/trace/events/ipi.h:68 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

RCU used illegally from idle CPU!
rcu_scheduler_active = 1, debug_locks = 0
RCU used illegally from extended quiescent state!
no locks held by swapper/0/0.

stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.1.0-rc7-00033-gb5bed2f #153
Hardware name: Qualcomm (Flattened Device Tree)
[<c0216b08>] (unwind_backtrace) from [<c02136e8>] (show_stack+0x10/0x14)
[<c02136e8>] (show_stack) from [<c075e678>] (dump_stack+0x70/0xbc)
[<c075e678>] (dump_stack) from [<c0215a80>] (handle_IPI+0x428/0x604)
[<c0215a80>] (handle_IPI) from [<c020942c>] (gic_handle_irq+0x54/0x5c)
[<c020942c>] (gic_handle_irq) from [<c0766604>] (__irq_svc+0x44/0x7c)
Exception stack(0xc09f3f48 to 0xc09f3f90)
3f40:                   00000001 00000001 00000000 c09f73b8 c09f4528 c0a5de9c
3f60: c076b4f0 00000000 00000000 c09ef108 c0a5cec1 00000001 00000000 c09f3f90
3f80: c026bf60 c0210ab8 20000113 ffffffff
[<c0766604>] (__irq_svc) from [<c0210ab8>] (arch_cpu_idle+0x20/0x3c)
[<c0210ab8>] (arch_cpu_idle) from [<c02647f0>] (cpu_startup_entry+0x2c0/0x5dc)
[<c02647f0>] (cpu_startup_entry) from [<c099bc1c>] (start_kernel+0x358/0x3c4)
[<c099bc1c>] (start_kernel) from [<8020807c>] (0x8020807c)

At this point in the IPI handling path we haven't called
irq_enter() yet, so RCU doesn't know that we're about to exit
idle and properly warns that we're using RCU from an idle CPU.
Use trace_ipi_entry_rcuidle() instead of trace_ipi_entry() so
that RCU is informed about our exit from idle.

Fixes: 365ec7b17327 ("ARM: add IPI tracepoints")
Reported-by: John Stultz <john.stultz@linaro.org>
Tested-by: John Stultz <john.stultz@linaro.org>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/kernel/smp.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -576,7 +576,7 @@ void handle_IPI(int ipinr, struct pt_reg
 	struct pt_regs *old_regs = set_irq_regs(regs);
 
 	if ((unsigned)ipinr < NR_IPI) {
-		trace_ipi_entry(ipi_types[ipinr]);
+		trace_ipi_entry_rcuidle(ipi_types[ipinr]);
 		__inc_irq_stat(cpu, ipi_irqs[ipinr]);
 	}
 
@@ -635,7 +635,7 @@ void handle_IPI(int ipinr, struct pt_reg
 	}
 
 	if ((unsigned)ipinr < NR_IPI)
-		trace_ipi_exit(ipi_types[ipinr]);
+		trace_ipi_exit_rcuidle(ipi_types[ipinr]);
 	set_irq_regs(old_regs);
 }
 



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 264/267] ARM: 8397/1: fix vdsomunge not to depend on glibc specific error.h
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (237 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 263/267] ARM: 8393/1: smp: Fix suspicious RCU usage with ipi tracepoints Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 265/267] hpfs: kstrdup() out of memory handling Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Szabolcs Nagy, Will Deacon,
	Nathan Lynch, Russell King

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Szabolcs Nagy <szabolcs.nagy@arm.com>

commit 13ee9fdba96577eb1583dcd7b15767ef623fae12 upstream.

If the host toolchain is not glibc based then the arm kernel build
fails with

 arch/arm/vdso/vdsomunge.c:53:19: fatal error: error.h: No such file or directory

error.h is a glibc only header (ie not available in musl, newlib and
bsd libcs).  Changed the error reporting to standard conforming code
to avoid depending on specific C implementations.

Signed-off-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Fixes: 8512287a8165 ("ARM: 8330/1: add VDSO user-space code")
Signed-off-by: Nathan Lynch <nathan_lynch@mentor.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/vdso/vdsomunge.c |   56 +++++++++++++++++++++++++++-------------------
 1 file changed, 33 insertions(+), 23 deletions(-)

--- a/arch/arm/vdso/vdsomunge.c
+++ b/arch/arm/vdso/vdsomunge.c
@@ -45,13 +45,11 @@
  * it does.
  */
 
-#define _GNU_SOURCE
-
 #include <byteswap.h>
 #include <elf.h>
 #include <errno.h>
-#include <error.h>
 #include <fcntl.h>
+#include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -82,11 +80,25 @@
 #define EF_ARM_ABI_FLOAT_HARD 0x400
 #endif
 
+static int failed;
+static const char *argv0;
 static const char *outfile;
 
+static void fail(const char *fmt, ...)
+{
+	va_list ap;
+
+	failed = 1;
+	fprintf(stderr, "%s: ", argv0);
+	va_start(ap, fmt);
+	vfprintf(stderr, fmt, ap);
+	va_end(ap);
+	exit(EXIT_FAILURE);
+}
+
 static void cleanup(void)
 {
-	if (error_message_count > 0 && outfile != NULL)
+	if (failed && outfile != NULL)
 		unlink(outfile);
 }
 
@@ -119,68 +131,66 @@ int main(int argc, char **argv)
 	int infd;
 
 	atexit(cleanup);
+	argv0 = argv[0];
 
 	if (argc != 3)
-		error(EXIT_FAILURE, 0, "Usage: %s [infile] [outfile]", argv[0]);
+		fail("Usage: %s [infile] [outfile]\n", argv[0]);
 
 	infile = argv[1];
 	outfile = argv[2];
 
 	infd = open(infile, O_RDONLY);
 	if (infd < 0)
-		error(EXIT_FAILURE, errno, "Cannot open %s", infile);
+		fail("Cannot open %s: %s\n", infile, strerror(errno));
 
 	if (fstat(infd, &stat) != 0)
-		error(EXIT_FAILURE, errno, "Failed stat for %s", infile);
+		fail("Failed stat for %s: %s\n", infile, strerror(errno));
 
 	inbuf = mmap(NULL, stat.st_size, PROT_READ, MAP_PRIVATE, infd, 0);
 	if (inbuf == MAP_FAILED)
-		error(EXIT_FAILURE, errno, "Failed to map %s", infile);
+		fail("Failed to map %s: %s\n", infile, strerror(errno));
 
 	close(infd);
 
 	inhdr = inbuf;
 
 	if (memcmp(&inhdr->e_ident, ELFMAG, SELFMAG) != 0)
-		error(EXIT_FAILURE, 0, "Not an ELF file");
+		fail("Not an ELF file\n");
 
 	if (inhdr->e_ident[EI_CLASS] != ELFCLASS32)
-		error(EXIT_FAILURE, 0, "Unsupported ELF class");
+		fail("Unsupported ELF class\n");
 
 	swap = inhdr->e_ident[EI_DATA] != HOST_ORDER;
 
 	if (read_elf_half(inhdr->e_type, swap) != ET_DYN)
-		error(EXIT_FAILURE, 0, "Not a shared object");
+		fail("Not a shared object\n");
 
-	if (read_elf_half(inhdr->e_machine, swap) != EM_ARM) {
-		error(EXIT_FAILURE, 0, "Unsupported architecture %#x",
-		      inhdr->e_machine);
-	}
+	if (read_elf_half(inhdr->e_machine, swap) != EM_ARM)
+		fail("Unsupported architecture %#x\n", inhdr->e_machine);
 
 	e_flags = read_elf_word(inhdr->e_flags, swap);
 
 	if (EF_ARM_EABI_VERSION(e_flags) != EF_ARM_EABI_VER5) {
-		error(EXIT_FAILURE, 0, "Unsupported EABI version %#x",
-		      EF_ARM_EABI_VERSION(e_flags));
+		fail("Unsupported EABI version %#x\n",
+		     EF_ARM_EABI_VERSION(e_flags));
 	}
 
 	if (e_flags & EF_ARM_ABI_FLOAT_HARD)
-		error(EXIT_FAILURE, 0,
-		      "Unexpected hard-float flag set in e_flags");
+		fail("Unexpected hard-float flag set in e_flags\n");
 
 	clear_soft_float = !!(e_flags & EF_ARM_ABI_FLOAT_SOFT);
 
 	outfd = open(outfile, O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
 	if (outfd < 0)
-		error(EXIT_FAILURE, errno, "Cannot open %s", outfile);
+		fail("Cannot open %s: %s\n", outfile, strerror(errno));
 
 	if (ftruncate(outfd, stat.st_size) != 0)
-		error(EXIT_FAILURE, errno, "Cannot truncate %s", outfile);
+		fail("Cannot truncate %s: %s\n", outfile, strerror(errno));
 
 	outbuf = mmap(NULL, stat.st_size, PROT_READ | PROT_WRITE, MAP_SHARED,
 		      outfd, 0);
 	if (outbuf == MAP_FAILED)
-		error(EXIT_FAILURE, errno, "Failed to map %s", outfile);
+		fail("Failed to map %s: %s\n", outfile, strerror(errno));
 
 	close(outfd);
 
@@ -195,7 +205,7 @@ int main(int argc, char **argv)
 	}
 
 	if (msync(outbuf, stat.st_size, MS_SYNC) != 0)
-		error(EXIT_FAILURE, errno, "Failed to sync %s", outfile);
+		fail("Failed to sync %s: %s\n", outfile, strerror(errno));
 
 	return EXIT_SUCCESS;
 }



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 265/267] hpfs: kstrdup() out of memory handling
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (238 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 264/267] ARM: 8397/1: fix vdsomunge not to depend on glibc specific error.h Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 266/267] hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead Greg Kroah-Hartman
                   ` (4 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sanidhya Kashyap, Mikulas Patocka,
	Linus Torvalds

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sanidhya Kashyap <sanidhya.gatech@gmail.com>

commit ce657611baf902f14ae559ce4e0787ead6712067 upstream.

There is a possibility of nothing being allocated to the new_opts in
case of memory pressure, therefore return ENOMEM for such case.

Signed-off-by: Sanidhya Kashyap <sanidhya.gatech@gmail.com>
Signed-off-by: Mikulas Patocka <mikulas@twibright.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/hpfs/super.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -424,11 +424,14 @@ static int hpfs_remount_fs(struct super_
 	int o;
 	struct hpfs_sb_info *sbi = hpfs_sb(s);
 	char *new_opts = kstrdup(data, GFP_KERNEL);
-	
+
+	if (!new_opts)
+		return -ENOMEM;
+
 	sync_filesystem(s);
 
 	*flags |= MS_NOATIME;
-	
+
 	hpfs_lock(s);
 	uid = sbi->sb_uid; gid = sbi->sb_gid;
 	umask = 0777 & ~sbi->sb_mode;



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 266/267] hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (239 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 265/267] hpfs: kstrdup() out of memory handling Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-07-31 19:41 ` [PATCH 4.1 267/267] Fix firmware loader uevent buffer NULL pointer dereference Greg Kroah-Hartman
                   ` (3 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joe Perches, Mikulas Patocka, Linus Torvalds

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joe Perches <joe@perches.com>

commit a28e4b2b18ccb90df402da3f21e1a83c9d4f8ec1 upstream.

Removing unnecessary static buffers is good.
Use the vsprintf %pV extension instead.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Mikulas Patocka <mikulas@twibright.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/hpfs/super.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_bl
 }
 
 /* Filesystem error... */
-static char err_buf[1024];
-
 void hpfs_error(struct super_block *s, const char *fmt, ...)
 {
+	struct va_format vaf;
 	va_list args;
 
 	va_start(args, fmt);
-	vsnprintf(err_buf, sizeof(err_buf), fmt, args);
+
+	vaf.fmt = fmt;
+	vaf.va = &args;
+
+	pr_err("filesystem error: %pV", &vaf);
+
 	va_end(args);
 
-	pr_err("filesystem error: %s", err_buf);
 	if (!hpfs_sb(s)->sb_was_error) {
 		if (hpfs_sb(s)->sb_err == 2) {
 			pr_cont("; crashing the system because you wanted it\n");



^ permalink raw reply	[flat|nested] 259+ messages in thread

* [PATCH 4.1 267/267] Fix firmware loader uevent buffer NULL pointer dereference
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (240 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 266/267] hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead Greg Kroah-Hartman
@ 2015-07-31 19:41 ` Greg Kroah-Hartman
  2015-08-01  2:09 ` [PATCH 4.1 000/267] 4.1.4-stable review Guenter Roeck
                   ` (2 subsequent siblings)
  244 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 19:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ming Lei, Linus Torvalds

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Linus Torvalds <torvalds@linux-foundation.org>

commit 6f957724b94cb19f5c1c97efd01dd4df8ced323c upstream.

The firmware class uevent function accessed the "fw_priv->buf" buffer
without the proper locking and testing for NULL.  This is an old bug
(looks like it goes back to 2012 and commit 1244691c73b2: "firmware
loader: introduce firmware_buf"), but for some reason it's triggering
only now in 4.2-rc1.

Shuah Khan is trying to bisect what it is that causes this to trigger
more easily, but in the meantime let's just fix the bug since others are
hitting it too (at least Ingo reports having seen it as well).

Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Acked-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/firmware_class.c |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -544,10 +544,8 @@ static void fw_dev_release(struct device
 	kfree(fw_priv);
 }
 
-static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
 {
-	struct firmware_priv *fw_priv = to_firmware_priv(dev);
-
 	if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
 		return -ENOMEM;
 	if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
@@ -558,6 +556,18 @@ static int firmware_uevent(struct device
 	return 0;
 }
 
+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+	struct firmware_priv *fw_priv = to_firmware_priv(dev);
+	int err = 0;
+
+	mutex_lock(&fw_lock);
+	if (fw_priv->buf)
+		err = do_firmware_uevent(fw_priv, env);
+	mutex_unlock(&fw_lock);
+	return err;
+}
+
 static struct class firmware_class = {
 	.name		= "firmware",
 	.class_attrs	= firmware_class_attrs,



^ permalink raw reply	[flat|nested] 259+ messages in thread

* RE: [PATCH 4.1 209/267] ACPICA: Tables: Enable both 32-bit and 64-bit FACS
  2015-07-31 19:41 ` [PATCH 4.1 209/267] ACPICA: Tables: Enable both 32-bit and 64-bit FACS Greg Kroah-Hartman
@ 2015-07-31 20:25   ` Moore, Robert
  2015-07-31 20:33     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 259+ messages in thread
From: Moore, Robert @ 2015-07-31 20:25 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel; +Cc: stable, Zheng, Lv, Wysocki, Rafael J

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="utf-8", Size: 8683 bytes --]

This particular patch is not stable. Lv has fixed it and a new patch is forthcoming, at least a patch on top of this.


> -----Original Message-----
> From: Greg Kroah-Hartman [mailto:gregkh@linuxfoundation.org]
> Sent: Friday, July 31, 2015 12:41 PM
> To: linux-kernel@vger.kernel.org
> Cc: Greg Kroah-Hartman; stable@vger.kernel.org; Zheng, Lv; Moore, Robert;
> Wysocki, Rafael J
> Subject: [PATCH 4.1 209/267] ACPICA: Tables: Enable both 32-bit and 64-bit
> FACS
> 
> 4.1-stable review patch.  If anyone has any objections, please let me
> know.
> 
> ------------------
> 
> From: Lv Zheng <lv.zheng@intel.com>
> 
> commit c04e1fb4396d27f18296db0f914760fa7fe8223a upstream.
> 
> ACPICA commit f7b86f35416e3d1f71c3d816ff5075ddd33ed486
> 
> The following commit is reported to have broken s2ram on some platforms:
>  Commit: 0249ed2444d65d65fc3f3f64f398f1ad0b7e54cd
>  ACPICA: Add option to favor 32-bit FADT addresses.
> The platform reports 2 FACS tables (which is not allowed by ACPI
> specification) and the new 32-bit address favor rule forces OSPMs to use
> the FACS table reported via FADT's X_FIRMWARE_CTRL field.
> 
> The root cause of the reported bug might be one of the followings:
> 1. BIOS may favor the 64-bit firmware waking vector address when the
>    version of the FACS is greater than 0 and Linux currently only supports
>    resuming from the real mode, so the 64-bit firmware waking vector has
>    never been set and might be invalid to BIOS while the commit enables
>    higher version FACS.
> 2. BIOS may favor the FACS reported via the "FIRMWARE_CTRL" field in the
>    FADT while the commit doesn't set the firmware waking vector address of
>    the FACS reported by "FIRMWARE_CTRL", it only sets the firware waking
>    vector address of the FACS reported by "X_FIRMWARE_CTRL".
> 
> This patch excludes the cases that can trigger the bugs caused by the root
> cause 2.
> 
> There is no handshaking mechanism can be used by OSPM to tell BIOS which
> FACS is currently used. Thus the FACS reported by "FIRMWARE_CTRL" may
> still be used by BIOS and the 0 value of the 32-bit firmware waking vector
> might trigger such failure.
> 
> This patch tries to favor 32bit FACS address in another way where both the
> FACS reported by "FIRMWARE_CTRL" and the FACS reported by
> "X_FIRMWARE_CTRL"
> are loaded so that further commit can set firmware waking vector in the
> both tables to ensure we can exclude the cases that trigger the bugs
> caused by the root cause 2. The exclusion is split into 2 commits as this
> commit is also useful for dumping more ACPI tables, it won't get reverted
> when such exclusion is no longer necessary. Lv Zheng.
> 
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=74021
> Link: https://github.com/acpica/acpica/commit/f7b86f35
> Reported-and-tested-by: Oswald Buddenhagen <ossi@kde.org>
> Signed-off-by: Lv Zheng <lv.zheng@intel.com>
> Signed-off-by: Bob Moore <robert.moore@intel.com>
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> ---
>  drivers/acpi/acpica/aclocal.h  |    1 +
>  drivers/acpi/acpica/tbfadt.c   |   21 +++++++++++++--------
>  drivers/acpi/acpica/tbutils.c  |   34 +++++++++++++++++++++++-----------
>  drivers/acpi/acpica/tbxfload.c |    3 ++-
>  include/acpi/acpixf.h          |    9 +++++++++
>  5 files changed, 48 insertions(+), 20 deletions(-)
> 
> --- a/drivers/acpi/acpica/aclocal.h
> +++ b/drivers/acpi/acpica/aclocal.h
> @@ -213,6 +213,7 @@ struct acpi_table_list {
> 
>  #define ACPI_TABLE_INDEX_DSDT           (0)
>  #define ACPI_TABLE_INDEX_FACS           (1)
> +#define ACPI_TABLE_INDEX_X_FACS         (2)
> 
>  struct acpi_find_context {
>  	char *search_for;
> --- a/drivers/acpi/acpica/tbfadt.c
> +++ b/drivers/acpi/acpica/tbfadt.c
> @@ -350,9 +350,18 @@ void acpi_tb_parse_fadt(u32 table_index)
>  	/* If Hardware Reduced flag is set, there is no FACS */
> 
>  	if (!acpi_gbl_reduced_hardware) {
> -		acpi_tb_install_fixed_table((acpi_physical_address)
> -					    acpi_gbl_FADT.Xfacs, ACPI_SIG_FACS,
> -					    ACPI_TABLE_INDEX_FACS);
> +		if (acpi_gbl_FADT.facs) {
> +			acpi_tb_install_fixed_table((acpi_physical_address)
> +						    acpi_gbl_FADT.facs,
> +						    ACPI_SIG_FACS,
> +						    ACPI_TABLE_INDEX_FACS);
> +		}
> +		if (acpi_gbl_FADT.Xfacs) {
> +			acpi_tb_install_fixed_table((acpi_physical_address)
> +						    acpi_gbl_FADT.Xfacs,
> +						    ACPI_SIG_FACS,
> +						    ACPI_TABLE_INDEX_X_FACS);
> +		}
>  	}
>  }
> 
> @@ -491,13 +500,9 @@ static void acpi_tb_convert_fadt(void)
>  	acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt);
> 
>  	/*
> -	 * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary.
> +	 * Expand the 32-bit DSDT addresses to 64-bit as necessary.
>  	 * Later ACPICA code will always use the X 64-bit field.
>  	 */
> -	acpi_gbl_FADT.Xfacs = acpi_tb_select_address("FACS",
> -						     acpi_gbl_FADT.facs,
> -						     acpi_gbl_FADT.Xfacs);
> -
>  	acpi_gbl_FADT.Xdsdt = acpi_tb_select_address("DSDT",
>  						     acpi_gbl_FADT.dsdt,
>  						     acpi_gbl_FADT.Xdsdt);
> --- a/drivers/acpi/acpica/tbutils.c
> +++ b/drivers/acpi/acpica/tbutils.c
> @@ -68,7 +68,8 @@ acpi_tb_get_root_table_entry(u8 *table_e
> 
>  acpi_status acpi_tb_initialize_facs(void)  {
> -	acpi_status status;
> +	struct acpi_table_facs *facs32;
> +	struct acpi_table_facs *facs64;
> 
>  	/* If Hardware Reduced flag is set, there is no FACS */
> 
> @@ -77,11 +78,22 @@ acpi_status acpi_tb_initialize_facs(void
>  		return (AE_OK);
>  	}
> 
> -	status = acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
> -					 ACPI_CAST_INDIRECT_PTR(struct
> -								acpi_table_header,
> -								&acpi_gbl_FACS));
> -	return (status);
> +	(void)acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
> +				      ACPI_CAST_INDIRECT_PTR(struct
> +							     acpi_table_header,
> +							     &facs32));
> +	(void)acpi_get_table_by_index(ACPI_TABLE_INDEX_X_FACS,
> +				      ACPI_CAST_INDIRECT_PTR(struct
> +							     acpi_table_header,
> +							     &facs64));
> +
> +	if (acpi_gbl_use32_bit_facs_addresses) {
> +		acpi_gbl_FACS = facs32 ? facs32 : facs64;
> +	} else {
> +		acpi_gbl_FACS = facs64 ? facs64 : facs32;
> +	}
> +
> +	return (AE_OK);
>  }
>  #endif				/* !ACPI_REDUCED_HARDWARE */
> 
> @@ -101,7 +113,7 @@ acpi_status acpi_tb_initialize_facs(void
>  u8 acpi_tb_tables_loaded(void)
>  {
> 
> -	if (acpi_gbl_root_table_list.current_table_count >= 3) {
> +	if (acpi_gbl_root_table_list.current_table_count >= 4) {
>  		return (TRUE);
>  	}
> 
> @@ -357,11 +369,11 @@ acpi_status __init acpi_tb_parse_root_ta
>  	table_entry = ACPI_ADD_PTR(u8, table, sizeof(struct
> acpi_table_header));
> 
>  	/*
> -	 * First two entries in the table array are reserved for the DSDT
> -	 * and FACS, which are not actually present in the RSDT/XSDT - they
> -	 * come from the FADT
> +	 * First three entries in the table array are reserved for the DSDT
> +	 * and 32bit/64bit FACS, which are not actually present in the
> +	 * RSDT/XSDT - they come from the FADT
>  	 */
> -	acpi_gbl_root_table_list.current_table_count = 2;
> +	acpi_gbl_root_table_list.current_table_count = 3;
> 
>  	/* Initialize the root table array from the RSDT/XSDT */
> 
> --- a/drivers/acpi/acpica/tbxfload.c
> +++ b/drivers/acpi/acpica/tbxfload.c
> @@ -166,7 +166,8 @@ static acpi_status acpi_tb_load_namespac
> 
>  	(void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
>  	for (i = 0; i < acpi_gbl_root_table_list.current_table_count; ++i) {
> -		if ((!ACPI_COMPARE_NAME
> +		if (!acpi_gbl_root_table_list.tables[i].address ||
> +		    (!ACPI_COMPARE_NAME
>  		     (&(acpi_gbl_root_table_list.tables[i].signature),
>  		      ACPI_SIG_SSDT)
>  		     &&
> --- a/include/acpi/acpixf.h
> +++ b/include/acpi/acpixf.h
> @@ -200,6 +200,15 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use
> ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE);
> 
>  /*
> + * Optionally use 32-bit FACS table addresses.
> + * It is reported that some platforms fail to resume from system
> +suspending
> + * if 64-bit FACS table address is selected:
> + * https://bugzilla.kernel.org/show_bug.cgi?id=74021
> + * Default is TRUE, favor the 32-bit addresses.
> + */
> +ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_facs_addresses, TRUE);
> +
> +/*
>   * Optionally truncate I/O addresses to 16 bits. Provides compatibility
>   * with other ACPI implementations. NOTE: During ACPICA initialization,
>   * this value is set to TRUE if any Windows OSI strings have been
> 

ÿôèº{.nÇ+‰·Ÿ®‰­†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a­¢f£¢·hšïêÿ‘êçz_è®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨è­Ú&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 209/267] ACPICA: Tables: Enable both 32-bit and 64-bit FACS
  2015-07-31 20:25   ` Moore, Robert
@ 2015-07-31 20:33     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-07-31 20:33 UTC (permalink / raw)
  To: Moore, Robert; +Cc: linux-kernel, stable, Zheng, Lv, Wysocki, Rafael J

On Fri, Jul 31, 2015 at 08:25:26PM +0000, Moore, Robert wrote:
> This particular patch is not stable. Lv has fixed it and a new patch
> is forthcoming, at least a patch on top of this.

If it's not in Linus's tree yet, nothing I can do about it.  Please
provide the git commit id for that patch when it happens.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 000/267] 4.1.4-stable review
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (241 preceding siblings ...)
  2015-07-31 19:41 ` [PATCH 4.1 267/267] Fix firmware loader uevent buffer NULL pointer dereference Greg Kroah-Hartman
@ 2015-08-01  2:09 ` Guenter Roeck
  2015-08-03 16:16   ` Greg Kroah-Hartman
  2015-08-01  6:01 ` Sudip Mukherjee
  2015-08-03 18:30 ` Shuah Khan
  244 siblings, 1 reply; 259+ messages in thread
From: Guenter Roeck @ 2015-08-01  2:09 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel; +Cc: torvalds, akpm, shuah.kh, stable

On 07/31/2015 12:37 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.1.4 release.
> There are 267 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Aug  2 19:39:27 UTC 2015.
> Anything received after that time might be too late.
>

Build results:
	total: 141 pass: 141 fail: 0
Qemu test results:
	total: 33 pass: 33 fail: 0

Details are available at http://server.roeck-us.net:8010/builders.

Guenter


^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 000/267] 4.1.4-stable review
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (242 preceding siblings ...)
  2015-08-01  2:09 ` [PATCH 4.1 000/267] 4.1.4-stable review Guenter Roeck
@ 2015-08-01  6:01 ` Sudip Mukherjee
  2015-08-03 16:17   ` Greg Kroah-Hartman
  2015-08-03 18:30 ` Shuah Khan
  244 siblings, 1 reply; 259+ messages in thread
From: Sudip Mukherjee @ 2015-08-01  6:01 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, torvalds, akpm, linux, shuah.kh, stable

On Fri, Jul 31, 2015 at 12:37:31PM -0700, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.1.4 release.
> There are 267 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sun Aug  2 19:39:27 UTC 2015.
> Anything received after that time might be too late.

Compiled and booted on x86_32. No errors in dmesg.

regards
sudip

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 000/267] 4.1.4-stable review
  2015-08-01  2:09 ` [PATCH 4.1 000/267] 4.1.4-stable review Guenter Roeck
@ 2015-08-03 16:16   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-03 16:16 UTC (permalink / raw)
  To: Guenter Roeck; +Cc: linux-kernel, torvalds, akpm, shuah.kh, stable

On Fri, Jul 31, 2015 at 07:09:19PM -0700, Guenter Roeck wrote:
> On 07/31/2015 12:37 PM, Greg Kroah-Hartman wrote:
> >This is the start of the stable review cycle for the 4.1.4 release.
> >There are 267 patches in this series, all will be posted as a response
> >to this one.  If anyone has any issues with these being applied, please
> >let me know.
> >
> >Responses should be made by Sun Aug  2 19:39:27 UTC 2015.
> >Anything received after that time might be too late.
> >
> 
> Build results:
> 	total: 141 pass: 141 fail: 0
> Qemu test results:
> 	total: 33 pass: 33 fail: 0
> 
> Details are available at http://server.roeck-us.net:8010/builders.

Thanks for testing all of these and letting me know.

greg k-h

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 000/267] 4.1.4-stable review
  2015-08-01  6:01 ` Sudip Mukherjee
@ 2015-08-03 16:17   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-03 16:17 UTC (permalink / raw)
  To: Sudip Mukherjee; +Cc: linux-kernel, torvalds, akpm, linux, shuah.kh, stable

On Sat, Aug 01, 2015 at 11:31:03AM +0530, Sudip Mukherjee wrote:
> On Fri, Jul 31, 2015 at 12:37:31PM -0700, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.1.4 release.
> > There are 267 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sun Aug  2 19:39:27 UTC 2015.
> > Anything received after that time might be too late.
> 
> Compiled and booted on x86_32. No errors in dmesg.

Thanks for testing all 3 of these and letting me know.

greg k-h

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 000/267] 4.1.4-stable review
  2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
                   ` (243 preceding siblings ...)
  2015-08-01  6:01 ` Sudip Mukherjee
@ 2015-08-03 18:30 ` Shuah Khan
  2015-08-03 21:12   ` Greg Kroah-Hartman
  244 siblings, 1 reply; 259+ messages in thread
From: Shuah Khan @ 2015-08-03 18:30 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel; +Cc: torvalds, akpm, linux, shuah.kh, stable

On 07/31/2015 01:37 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.1.4 release.
> There are 267 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sun Aug  2 19:39:27 UTC 2015.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.4-rc1.gz
> and the diffstat can be found below.
> 

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah


-- 
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 000/267] 4.1.4-stable review
  2015-08-03 18:30 ` Shuah Khan
@ 2015-08-03 21:12   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 259+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-03 21:12 UTC (permalink / raw)
  To: Shuah Khan; +Cc: linux-kernel, torvalds, akpm, linux, shuah.kh, stable

On Mon, Aug 03, 2015 at 12:30:47PM -0600, Shuah Khan wrote:
> On 07/31/2015 01:37 PM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.1.4 release.
> > There are 267 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sun Aug  2 19:39:27 UTC 2015.
> > Anything received after that time might be too late.
> > 
> > The whole patch series can be found in one patch at:
> > 	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.4-rc1.gz
> > and the diffstat can be found below.
> > 
> 
> Compiled and booted on my test system. No dmesg regressions.

Thanks for testing all of these and letting me know.

greg k-h

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
  2015-07-31 19:39 ` [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function Greg Kroah-Hartman
@ 2015-08-08  5:53   ` Alexander Holler
  2015-08-08  6:48     ` Kishon Vijay Abraham I
  0 siblings, 1 reply; 259+ messages in thread
From: Alexander Holler @ 2015-08-08  5:53 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: stable, NeilBrown, Kishon Vijay Abraham I

Hello,

this patch killed the musb-host functionality on my classic Beagleboard 
(rev c4). Symptom was that it there was a message I don't remember and 
the attached device didn't enumerate anymore (likely because of missing 
power, but I'm not sure).

A simple revert has fixed it, I haven't looked further into the problem.

Regards,

Alexander Holler

Am 31.07.2015 um 21:39 schrieb Greg Kroah-Hartman:
> 4.1-stable review patch.  If anyone has any objections, please let me know.
>
> ------------------
>
> From: NeilBrown <neil@brown.name>
>
> commit 4724e27114c4a7eceeee07db227a17fcab6f165c upstream.
>
> The USB phy should initialize with power-off, and will be powered on
> by the USB system when a cable connection is detected.
>
> Having this pm_runtime_get_sync() during probe causes the phy to
> *always* be powered on.
> Removing it returns to sensible power management.
>
> Fixes: 96be39ab34b77c6f6f5cd6ae03aac6c6449ee5c4
> Signed-off-by: NeilBrown <neil@brown.name>
> Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
>   drivers/phy/phy-twl4030-usb.c |    1 -
>   1 file changed, 1 deletion(-)
>
> --- a/drivers/phy/phy-twl4030-usb.c
> +++ b/drivers/phy/phy-twl4030-usb.c
> @@ -711,7 +711,6 @@ static int twl4030_usb_probe(struct plat
>   	pm_runtime_use_autosuspend(&pdev->dev);
>   	pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
>   	pm_runtime_enable(&pdev->dev);
> -	pm_runtime_get_sync(&pdev->dev);
>
>   	/* Our job is to use irqs and status from the power module
>   	 * to keep the transceiver disabled when nothing's connected.
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>


^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
  2015-08-08  5:53   ` Alexander Holler
@ 2015-08-08  6:48     ` Kishon Vijay Abraham I
  2015-08-09  9:00       ` NeilBrown
  0 siblings, 1 reply; 259+ messages in thread
From: Kishon Vijay Abraham I @ 2015-08-08  6:48 UTC (permalink / raw)
  To: NeilBrown; +Cc: Alexander Holler, Greg Kroah-Hartman, linux-kernel, stable



On Saturday 08 August 2015 11:23 AM, Alexander Holler wrote:
> Hello,
> 
> this patch killed the musb-host functionality on my classic Beagleboard (rev
> c4). Symptom was that it there was a message I don't remember and the attached
> device didn't enumerate anymore (likely because of missing power, but I'm not
> sure).
> 
> A simple revert has fixed it, I haven't looked further into the problem.

Neil Brown, how was this tested?

-Kishon

> 
> Regards,
> 
> Alexander Holler
> 
> Am 31.07.2015 um 21:39 schrieb Greg Kroah-Hartman:
>> 4.1-stable review patch.  If anyone has any objections, please let me know.
>>
>> ------------------
>>
>> From: NeilBrown <neil@brown.name>
>>
>> commit 4724e27114c4a7eceeee07db227a17fcab6f165c upstream.
>>
>> The USB phy should initialize with power-off, and will be powered on
>> by the USB system when a cable connection is detected.
>>
>> Having this pm_runtime_get_sync() during probe causes the phy to
>> *always* be powered on.
>> Removing it returns to sensible power management.
>>
>> Fixes: 96be39ab34b77c6f6f5cd6ae03aac6c6449ee5c4
>> Signed-off-by: NeilBrown <neil@brown.name>
>> Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>
>> ---
>>   drivers/phy/phy-twl4030-usb.c |    1 -
>>   1 file changed, 1 deletion(-)
>>
>> --- a/drivers/phy/phy-twl4030-usb.c
>> +++ b/drivers/phy/phy-twl4030-usb.c
>> @@ -711,7 +711,6 @@ static int twl4030_usb_probe(struct plat
>>       pm_runtime_use_autosuspend(&pdev->dev);
>>       pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
>>       pm_runtime_enable(&pdev->dev);
>> -    pm_runtime_get_sync(&pdev->dev);
>>
>>       /* Our job is to use irqs and status from the power module
>>        * to keep the transceiver disabled when nothing's connected.
>>
>>
>> -- 
>> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>> Please read the FAQ at  http://www.tux.org/lkml/
>>
> 

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
  2015-08-08  6:48     ` Kishon Vijay Abraham I
@ 2015-08-09  9:00       ` NeilBrown
  2015-08-09 10:45         ` Alexander Holler
  0 siblings, 1 reply; 259+ messages in thread
From: NeilBrown @ 2015-08-09  9:00 UTC (permalink / raw)
  To: Kishon Vijay Abraham I
  Cc: Alexander Holler, Greg Kroah-Hartman, linux-kernel, stable

On Sat, 8 Aug 2015 12:18:55 +0530 Kishon Vijay Abraham I
<kishon@ti.com> wrote:

> 
> 
> On Saturday 08 August 2015 11:23 AM, Alexander Holler wrote:
> > Hello,
> > 
> > this patch killed the musb-host functionality on my classic Beagleboard (rev
> > c4). Symptom was that it there was a message I don't remember and the attached
> > device didn't enumerate anymore (likely because of missing power, but I'm not
> > sure).
> > 
> > A simple revert has fixed it, I haven't looked further into the problem.
> 
> Neil Brown, how was this tested?


Well, I have a board with an OMAP3 connected to a twl4030 for USB and I
noted that it wasn't power-managed properly and when I made that change,
it was.  I don't recall the exact details

This is probably related to

Commit: 56301df6bcaa ("phy: twl4030-usb: make runtime pm more reliable.")

I certainly only tested with that patch in place.

Looking at the code again, I cannot see why I thought I needed the
4724e277 patch.
Devices are initialised as RPM_SUSPENDED with a usage count of zero (in
pm_runtime_init) so when twl4030_usb_probe() calls
pm_runtime_get_sync(), that will increase the usage_count to 1 and
resume the device.  Then it calls pm_runtime_put_autosuspend() which
will (ultimately) drop the usage_count back to zero and suspend the
device.

So it looks like I messed up, but I'm sure I must have had a reason for
that patch.  I'll try to do some testing later in the week and will
report what I find.

NeilBrown


> 
> -Kishon
> 
> > 
> > Regards,
> > 
> > Alexander Holler
> > 
> > Am 31.07.2015 um 21:39 schrieb Greg Kroah-Hartman:
> >> 4.1-stable review patch.  If anyone has any objections, please let me know.
> >>
> >> ------------------
> >>
> >> From: NeilBrown <neil@brown.name>
> >>
> >> commit 4724e27114c4a7eceeee07db227a17fcab6f165c upstream.
> >>
> >> The USB phy should initialize with power-off, and will be powered on
> >> by the USB system when a cable connection is detected.
> >>
> >> Having this pm_runtime_get_sync() during probe causes the phy to
> >> *always* be powered on.
> >> Removing it returns to sensible power management.
> >>
> >> Fixes: 96be39ab34b77c6f6f5cd6ae03aac6c6449ee5c4
> >> Signed-off-by: NeilBrown <neil@brown.name>
> >> Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
> >> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> >>
> >> ---
> >>   drivers/phy/phy-twl4030-usb.c |    1 -
> >>   1 file changed, 1 deletion(-)
> >>
> >> --- a/drivers/phy/phy-twl4030-usb.c
> >> +++ b/drivers/phy/phy-twl4030-usb.c
> >> @@ -711,7 +711,6 @@ static int twl4030_usb_probe(struct plat
> >>       pm_runtime_use_autosuspend(&pdev->dev);
> >>       pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
> >>       pm_runtime_enable(&pdev->dev);
> >> -    pm_runtime_get_sync(&pdev->dev);
> >>
> >>       /* Our job is to use irqs and status from the power module
> >>        * to keep the transceiver disabled when nothing's connected.
> >>
> >>
> >> -- 
> >> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> >> the body of a message to majordomo@vger.kernel.org
> >> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> >> Please read the FAQ at  http://www.tux.org/lkml/
> >>
> > 


^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
  2015-08-09  9:00       ` NeilBrown
@ 2015-08-09 10:45         ` Alexander Holler
  2015-08-11  8:29           ` NeilBrown
  0 siblings, 1 reply; 259+ messages in thread
From: Alexander Holler @ 2015-08-09 10:45 UTC (permalink / raw)
  To: NeilBrown, Kishon Vijay Abraham I
  Cc: Greg Kroah-Hartman, linux-kernel, stable

Am 09.08.2015 um 11:00 schrieb NeilBrown:
> On Sat, 8 Aug 2015 12:18:55 +0530 Kishon Vijay Abraham I
> <kishon@ti.com> wrote:
>
>>
>>
>> On Saturday 08 August 2015 11:23 AM, Alexander Holler wrote:
>>> Hello,
>>>
>>> this patch killed the musb-host functionality on my classic Beagleboard (rev
>>> c4). Symptom was that it there was a message I don't remember and the attached
>>> device didn't enumerate anymore (likely because of missing power, but I'm not
>>> sure).
>>>
>>> A simple revert has fixed it, I haven't looked further into the problem.
>>
>> Neil Brown, how was this tested?
>
>
> Well, I have a board with an OMAP3 connected to a twl4030 for USB and I
> noted that it wasn't power-managed properly and when I made that change,
> it was.  I don't recall the exact details
>
> This is probably related to
>
> Commit: 56301df6bcaa ("phy: twl4030-usb: make runtime pm more reliable.")
>
> I certainly only tested with that patch in place.

Cherry-Picking 56301df6bcaa instead of reverting  d1221a608bd did the 
trick too. So it looks like 56301df6bcaa is indeed a prerequisit for 
d1221a608bd.

Therefor I suggest to feed 56301df6bcaa to the stable series (e.g. 
4.1.6) too.

Regards,

Alexander Holler

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
  2015-08-09 10:45         ` Alexander Holler
@ 2015-08-11  8:29           ` NeilBrown
  2015-08-11 21:34             ` Alexander Holler
  0 siblings, 1 reply; 259+ messages in thread
From: NeilBrown @ 2015-08-11  8:29 UTC (permalink / raw)
  To: Alexander Holler, Felipe Balbi
  Cc: Kishon Vijay Abraham I, Greg Kroah-Hartman, linux-kernel, stable

On Sun, 9 Aug 2015 12:45:20 +0200 Alexander Holler
<holler@ahsoftware.de> wrote:

> Am 09.08.2015 um 11:00 schrieb NeilBrown:
> > On Sat, 8 Aug 2015 12:18:55 +0530 Kishon Vijay Abraham I
> > <kishon@ti.com> wrote:
> >
> >>
> >>
> >> On Saturday 08 August 2015 11:23 AM, Alexander Holler wrote:
> >>> Hello,
> >>>
> >>> this patch killed the musb-host functionality on my classic Beagleboard (rev
> >>> c4). Symptom was that it there was a message I don't remember and the attached
> >>> device didn't enumerate anymore (likely because of missing power, but I'm not
> >>> sure).
> >>>
> >>> A simple revert has fixed it, I haven't looked further into the problem.
> >>
> >> Neil Brown, how was this tested?
> >
> >
> > Well, I have a board with an OMAP3 connected to a twl4030 for USB and I
> > noted that it wasn't power-managed properly and when I made that change,
> > it was.  I don't recall the exact details
> >
> > This is probably related to
> >
> > Commit: 56301df6bcaa ("phy: twl4030-usb: make runtime pm more reliable.")
> >
> > I certainly only tested with that patch in place.
> 
> Cherry-Picking 56301df6bcaa instead of reverting  d1221a608bd did the 
> trick too. So it looks like 56301df6bcaa is indeed a prerequisit for 
> d1221a608bd.
> 
> Therefor I suggest to feed 56301df6bcaa to the stable series (e.g. 
> 4.1.6) too.
> 

The reality is ... more complicated.

I had a close look at how refcounts are inc/dec for the twl4030 phy.

With the current mainline code (plus my twl4030 charger enhancements,
which are not deeply relevant), the refcount does go to zero when
nothing is plugged in, and goes to 2 when a regular USB cable is
plugged in.
The two counts come from twl4030_usb_irq and twl4030_charger_enable_usb,
which is what I would expect.

However at the end of twl4030_usb_probe, the count goes to -1 !!!
because of the pm_runtime_put_autosuspend, which no longer has a
balancing pm_runtime_get() -  which I really shouldn't have removed.

The extra refcount that I saw before and blamed on that
pm_runtime_get() actually comes from a phy_power_on() call in
omap2430_musb_init.

omap2430_musb_init() calls phy_power_on(), and doesn't call
phy_power_off() until omap2430_musb_exit().
So it tries to keep the phy on the entire time that the module is
loaded.

Do we want to just remove the phy_power_on() call from
omap2430_musb_init()?
That seems to work for me, but may well break on other boards.

I think the best thing to do for -stable it to leave 56301df6bcaa out
and revert the backport of d1221a608bd.
That will return to a state which, while not perfect, at least is not a
regression.

With that (older) code, the extra phy_power_on() call still increases
the usage_count, but the irq_handler in the twl4030 phy driver will
drop it down to zero without first increasing.  So things work for the
wrong reasons.

Felipe: you added the phy_power_on() call in 

 Commit: 3063a12be2b0 ("usb: musb: fix PHY power on/off")

Do we really want the phy to be on the whole time the modules is loaded?
If not, how/when should the phy be powered down?

Thanks,
NeilBrown


^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
  2015-08-11  8:29           ` NeilBrown
@ 2015-08-11 21:34             ` Alexander Holler
  2015-08-11 22:09               ` NeilBrown
  0 siblings, 1 reply; 259+ messages in thread
From: Alexander Holler @ 2015-08-11 21:34 UTC (permalink / raw)
  To: NeilBrown, Felipe Balbi
  Cc: Kishon Vijay Abraham I, Greg Kroah-Hartman, linux-kernel, stable

Am 11.08.2015 um 10:29 schrieb NeilBrown:

> With the current mainline code (plus my twl4030 charger enhancements,
> which are not deeply relevant), the refcount does go to zero when
> nothing is plugged in, and goes to 2 when a regular USB cable is
> plugged in.

Also I think it's just a little miswording (or extended typo), I'm not 
using a regular USB cable, but an OTG cable when using the host mode of 
the musb on the Beagleboard. Just to avoid confusion. Or do you talk 
about the client mode when it goes to 2?

Besides that, I'm sorry to not be of further help. My deeper knowledge 
about the musb sources in the kernel and u-boot (and the HW in 
question), has gone lost and I've currently no real reason to refresh 
that. ;)

Regards,

Alexander Holler

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
  2015-08-11 21:34             ` Alexander Holler
@ 2015-08-11 22:09               ` NeilBrown
  2015-08-12  0:29                 ` Felipe Balbi
  0 siblings, 1 reply; 259+ messages in thread
From: NeilBrown @ 2015-08-11 22:09 UTC (permalink / raw)
  To: Alexander Holler
  Cc: Felipe Balbi, Kishon Vijay Abraham I, Greg Kroah-Hartman,
	linux-kernel, stable

On Tue, 11 Aug 2015 23:34:17 +0200 Alexander Holler
<holler@ahsoftware.de> wrote:

> Am 11.08.2015 um 10:29 schrieb NeilBrown:
> 
> > With the current mainline code (plus my twl4030 charger enhancements,
> > which are not deeply relevant), the refcount does go to zero when
> > nothing is plugged in, and goes to 2 when a regular USB cable is
> > plugged in.
> 
> Also I think it's just a little miswording (or extended typo), I'm not 
> using a regular USB cable, but an OTG cable when using the host mode of 
> the musb on the Beagleboard. Just to avoid confusion. Or do you talk 
> about the client mode when it goes to 2?

With an OTG cable, the usage_count would probably got to '1' because
the charger wouldn't be interested.

However the important point is that the usage_count goes to zero when
no cable is plugged in.

> 
> Besides that, I'm sorry to not be of further help. My deeper knowledge 
> about the musb sources in the kernel and u-boot (and the HW in 
> question), has gone lost and I've currently no real reason to refresh 
> that. ;)

Just reporting the problem is sometimes 90% for the bug fixed.
I'm confident I know what is happening.  What isn't clear is how best
to fix it without breaking something else... I suspect Felipe can help
with that.

Thanks,
NeilBrown

^ permalink raw reply	[flat|nested] 259+ messages in thread

* Re: [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
  2015-08-11 22:09               ` NeilBrown
@ 2015-08-12  0:29                 ` Felipe Balbi
  0 siblings, 0 replies; 259+ messages in thread
From: Felipe Balbi @ 2015-08-12  0:29 UTC (permalink / raw)
  To: NeilBrown
  Cc: Alexander Holler, Felipe Balbi, Kishon Vijay Abraham I,
	Greg Kroah-Hartman, linux-kernel, stable

[-- Attachment #1: Type: text/plain, Size: 1766 bytes --]

Hi,

On Wed, Aug 12, 2015 at 08:09:27AM +1000, NeilBrown wrote:
> On Tue, 11 Aug 2015 23:34:17 +0200 Alexander Holler
> <holler@ahsoftware.de> wrote:
> 
> > Am 11.08.2015 um 10:29 schrieb NeilBrown:
> > 
> > > With the current mainline code (plus my twl4030 charger enhancements,
> > > which are not deeply relevant), the refcount does go to zero when
> > > nothing is plugged in, and goes to 2 when a regular USB cable is
> > > plugged in.
> > 
> > Also I think it's just a little miswording (or extended typo), I'm not 
> > using a regular USB cable, but an OTG cable when using the host mode of 
> > the musb on the Beagleboard. Just to avoid confusion. Or do you talk 
> > about the client mode when it goes to 2?
> 
> With an OTG cable, the usage_count would probably got to '1' because
> the charger wouldn't be interested.
> 
> However the important point is that the usage_count goes to zero when
> no cable is plugged in.
> 
> > 
> > Besides that, I'm sorry to not be of further help. My deeper knowledge 
> > about the musb sources in the kernel and u-boot (and the HW in 
> > question), has gone lost and I've currently no real reason to refresh 
> > that. ;)
> 
> Just reporting the problem is sometimes 90% for the bug fixed.
> I'm confident I know what is happening.  What isn't clear is how best
> to fix it without breaking something else... I suspect Felipe can help
> with that.

It'll take me a while to be able to look at this. I don't have any
platform with TWL4030 (IIRC, AM335x uses tps65218 instead). Besides, I
have a slightly bigger problem to look at (MUSB + some hubs + CP2108
fails sometimes).

If I get some time, I'll try to have a look, but it might take a few
weeks.

cheers

-- 
balbi

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

^ permalink raw reply	[flat|nested] 259+ messages in thread

end of thread, other threads:[~2015-08-12  0:29 UTC | newest]

Thread overview: 259+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-07-31 19:37 [PATCH 4.1 000/267] 4.1.4-stable review Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 003/267] pinctrl: mvebu: armada-370: fix spi0 pin description Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 004/267] pinctrl: mvebu: armada-375: remove incorrect space in " Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 005/267] pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 006/267] pinctrl: mvebu: armada-38x: fix PCIe functions Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 007/267] pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 008/267] pinctrl: mvebu: armada-39x: " Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 009/267] pinctrl: mvebu: armada-xp: remove non-existing NAND pins Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 010/267] pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 011/267] pinctrl: mvebu: armada-xp: fix functions of MPP48 Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 012/267] openrisc: fix CONFIG_UID16 setting Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 013/267] m68knommu: make ColdFire SoC selection a choice Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 014/267] m68knommu: force setting of CONFIG_CLOCK_FREQ for ColdFire Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 015/267] Bluetooth: Fix race condition with user channel and setup stage Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 016/267] Bluetooth: btusb: Fix memory leak in Intel setup routine Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 017/267] Bluetooth: btusb: Fix secure send command length alignment on Intel 8260 Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 018/267] Bluetooth: btusb: Correct typo in Roper Class 1 Bluetooth Dongle Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 019/267] Bluetooth: btbcm: allow btbcm_read_verbose_config to fail on Apple Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 020/267] ath9k: fix DMA stop sequence for AR9003+ Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 021/267] ath9k_htc: memory corruption calling set_bit() Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 022/267] rtlwifi: Remove the clear interrupt routine from all drivers Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 023/267] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 024/267] staging: vt6656: check ieee80211_bss_conf bssid not NULL Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 025/267] staging: vt6655: " Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 026/267] staging: vt6655: device_rx_srv check sk_buff is NULL Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 027/267] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe Greg Kroah-Hartman
2015-07-31 19:37 ` [PATCH 4.1 028/267] staging: comedi: cb_pcimdas: fix handlers for DI and DO subdevices Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 029/267] hid-sensor: Fix suspend/resume delay Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 030/267] ext4: fix race between truncate and __ext4_journalled_writepage() Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 031/267] ext4: call sync_blockdev() before invalidate_bdev() in put_super() Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 032/267] ext4: dont retry file block mapping on bigalloc fs with non-extent file Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 033/267] ext4: set lazytime on remount if MS_LAZYTIME is set by mount Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 034/267] ext4: fix fencepost error in lazytime optimization Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 035/267] bufferhead: Add _gfp version for sb_getblk() Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 036/267] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 037/267] ext4: fix reservation release on invalidatepage for delalloc fs Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 038/267] ext4: be more strict when migrating to non-extent based file Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 039/267] ext4: correctly migrate a file with a hole at the beginning Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 040/267] ext4: replace open coded nofail allocation in ext4_free_blocks() Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 041/267] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 042/267] jbd2: fix ocfs2 corrupt when updating journal superblock fails Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 043/267] NFC: st21nfcb: Remove inappropriate kfree on a devm_kzalloc pointer Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 044/267] NFC: st21nfcb: Do not remove header once the payload is sent Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 045/267] NFC: st21nfcb: remove st21nfcb_nci_i2c_disable Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 046/267] rtc: snvs: fix wakealarm by call enable_irq_wake earlier Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 047/267] i2c: at91: fix a race condition when using the DMA controller Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 051/267] iio:light:cm3323: clear bitmask before set Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 052/267] iio:adc:cc10001_adc: fix Kconfig dependency Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 053/267] iio:accel:bmc150-accel: fix counting direction Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 054/267] iio: light: tcs3414: Fix bug preventing to set integration time Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 055/267] iio: DAC: ad5624r_spi: fix bit shift of output data value Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 056/267] iio: inv-mpu: Specify the expected format/precision for write channels Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 057/267] iio: tmp006: Check channel info on write Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 058/267] iio: twl4030-madc: Pass the IRQF_ONESHOT flag Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 059/267] iio: ABI: Clarify proximity output value Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 060/267] iio: proximity: sx9500: Fix proximity value Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 061/267] iio: adc: rockchip_saradc: add missing MODULE_* data Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 062/267] iio: adc: at91_adc: allow to use full range of startup time Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 063/267] [media] vb2: Dont WARN when v4l2_buffer.bytesused is 0 for multiplanar buffers Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 064/267] [media] media: Fix regression in some more dib0700 based devices Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 066/267] [media] cx18: add missing caps for the PCM video device Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 067/267] [media] cx24117: fix a buffer overflow when checking userspace params Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 068/267] [media] af9013: Dont accept invalid bandwidth Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 069/267] [media] saa7164: fix querycap warning Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 070/267] [media] s5h1420: fix a buffer overflow when checking userspace params Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 071/267] [media] cx24116: " Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 072/267] ASoC: arizona: Fix noise generator gain TLV Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 073/267] ASoC: rt5645: Init jack_detect_work before registering irq Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 074/267] ASoC: max98925: Fix mask for setting DAI invert mode Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 075/267] ASoC: qcom: remove incorrect dependencies Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 076/267] ASoC: imx-wm8962: Add a missing error check Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 077/267] ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency, again Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 079/267] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 081/267] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 082/267] ASoC: tas2552: Fix kernel crash when the codec is loaded but not part of a card Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 083/267] ASoC: tas2552: Fix kernel crash caused by wrong kcontrol entry Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 084/267] libata: Do not blacklist Micron M500DC Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 085/267] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 086/267] libata: increase the timeout when setting transfer mode Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 087/267] libata: Fall back to unqueued READ LOG EXT if the DMA variant fails Greg Kroah-Hartman
2015-07-31 19:38 ` [PATCH 4.1 088/267] libata: Expose TRIM capability in sysfs Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 089/267] libata: add ATA_HORKAGE_NOTRIM Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 090/267] libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 091/267] libata: Do not blacklist M510DC Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 092/267] libata: force disable trim for SuperSSpeed S238 Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 093/267] usb: dwc3: gadget: return error if command sent to DGCMD register fails Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 094/267] usb: dwc3: gadget: return error if command sent to DEPCMD " Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 095/267] usb: dwc3: gadget: dont clear EP_BUSY too early Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 096/267] usb: dwc3: Reset the transfer resource index on SET_INTERFACE Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 097/267] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 098/267] USB: devio: fix a condition in async_completed() Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 099/267] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function Greg Kroah-Hartman
2015-08-08  5:53   ` Alexander Holler
2015-08-08  6:48     ` Kishon Vijay Abraham I
2015-08-09  9:00       ` NeilBrown
2015-08-09 10:45         ` Alexander Holler
2015-08-11  8:29           ` NeilBrown
2015-08-11 21:34             ` Alexander Holler
2015-08-11 22:09               ` NeilBrown
2015-08-12  0:29                 ` Felipe Balbi
2015-07-31 19:39 ` [PATCH 4.1 100/267] usb: phy: mxs: suspend to RAM causes NULL pointer dereference Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 101/267] phy: berlin-usb: fix divider for BG2CD Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 102/267] usb: gadget: composite: Fix NULL pointer dereference Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 103/267] usb: gadget: f_fs: do not set cancel function on synchronous {read,write} Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 104/267] usb: gadget: mv_udc_core: fix phy_regs I/O memory leak Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 105/267] usb: f_mass_storage: limit number of reported LUNs Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 106/267] usb: musb: host: rely on port_mode to call musb_start() Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 107/267] USB: cp210x: add ID for Aruba Networks controllers Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 108/267] USB: option: add 2020:4000 ID Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 109/267] USB: serial: Destroy serial_minors IDR on module exit Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 110/267] USB: OHCI: Fix race between ED unlink and URB submission Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 111/267] usb: core: lpm: set lpm_capable for root hub device Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 112/267] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 113/267] dm cache: fix race when issuing a POLICY_REPLACE operation Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 114/267] dm stats: fix divide by zero if number_of_areas arg is zero Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 115/267] dm space map metadata: fix occasional leak of a metadata block on resize Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 116/267] dm btree remove: fix bug in redistribute3 Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 117/267] dm thin: allocate the cell_sort_array dynamically Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 118/267] dm btree: silence lockdep lock inversion in dm_btree_del() Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 119/267] mmc: block: Add missing mmc_blk_put() in power_ro_lock_show() Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 120/267] block: loop: convert to per-device workqueue Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 121/267] block: loop: avoiding too many pending per work I/O Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 122/267] block: Do a full clone when splitting discard bios Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 123/267] ARM: at91/dt: sama5d4ek: mci0 uses slot 0 Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 124/267] ARM: at91/dt: sama5d4: fix dma conf for aes, sha and tdes nodes Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 126/267] ARM: at91/dt: trivial: fix USB udc compatible string Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 127/267] ARM: at91/dt: update udc compatible strings Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 128/267] bus: arm-ccn: Fix node->XP config conversion Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 129/267] drm/vgem: Set unique to "vgem" Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 130/267] drm/dp/mst: close deadlock in connector destruction Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 131/267] drm/dp/mst: take lock around looking up the branch device on hpd irq Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 132/267] drm/dp/mst: make sure mst_primary mstb is valid in work function Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 133/267] drm/tegra: dpaux: Fix transfers larger than 4 bytes Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 134/267] drm/qxl: Do not cause spice-server to clean our objects Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 135/267] drm/qxl: Do not leak memory if qxl_release_list_add fails Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 137/267] drm/atomic: fix out of bounds read in for_each_*_in_state helpers Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 138/267] drm/radeon: take the mode_config mutex when dealing with hpds (v2) Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 139/267] drm/radeon: clean up radeon_audio_enable Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 140/267] drm/i915/ppgtt: Break loop in gen8_ppgtt_clear_range failure path Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 143/267] drm/i915: Declare the swizzling unknown for L-shaped configurations Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 144/267] drm/i915: Snapshot seqno of most recently submitted request Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 145/267] drm/i915: Forward all core DRM ioctls to core compat handling Greg Kroah-Hartman
2015-07-31 19:39 ` [PATCH 4.1 146/267] Revert "drm/i915: Declare the swizzling unknown for L-shaped configurations" Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 150/267] Revert "drm/radeon: dont switch vt on suspend" Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 151/267] drm/radeon: only check the sink type on DP connectors Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 157/267] drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5 Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 159/267] drm/radeon/ci: silence a harmless PCC warning Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 160/267] drm/rockchip: use drm_gem_mmap helpers Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 161/267] drm: add a check for x/y in drm_mode_setcrtc Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 162/267] drm: Provide compat ioctl for addfb2.1 Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 164/267] libata: Fix regression when the NCQ Send and Receive log page is absent Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 165/267] xfs: fix remote symlinks on V5/CRC filesystems Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 166/267] xfs: dont truncate attribute extents if no extents exist Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 167/267] w1_therm reference count family data Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 168/267] tpm, tpm_crb: fix le64_to_cpu conversions in crb_acpi_add() Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 169/267] vTPM: set virtual device before passing to ibmvtpm_reset_crq Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 170/267] tpm: Fix initialization of the cdev Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 171/267] tpm, tpm_crb: fail when TPM2 ACPI table contents look corrupted Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 172/267] KEYS: fix "ca_keys=" partial key matching Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 173/267] KEYS: ensure we free the assoc array edit if edit is valid Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 174/267] ima: skip measurement of cgroupfs files and update documentation Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 175/267] ima: cleanup ima_init_policy() a little Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 176/267] ima: do not measure or appraise the NSFS filesystem Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 177/267] evm: labeling pseudo filesystems exception Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 178/267] ima: fix ima_show_template_data_ascii() Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 179/267] ima: add support for new "euid" policy condition Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 180/267] ima: extend "mask" policy matching support Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 181/267] ima: update builtin policies Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 182/267] tracing/filter: Do not WARN on operand count going below zero Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 183/267] tracing/filter: Do not allow infix to exceed end of string Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 184/267] tracing: Fix typo from "static inlin" to "static inline" Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 185/267] tracing: Have branch tracer use recursive field of task struct Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 186/267] tracing: Fix sample output of dynamic arrays Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 187/267] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 188/267] md: clear mddev->private when it has been freed Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 189/267] md: unlock mddev_lock on an error path Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 190/267] md: Skip cluster setup for dm-raid Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 191/267] hwmon: (mcp3021) Fix broken output scaling Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 192/267] hwmon: (nct7802) fix visibility of temp3 Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 193/267] ARM: dts: mx23: fix iio-hwmon support Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 194/267] Btrfs: dont invalidate root dentry when subvolume deletion fails Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 195/267] md: fix a build warning Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 196/267] Btrfs: use kmem_cache_free when freeing entry in inode cache Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 197/267] Btrfs: fix race between caching kthread and returning inode to " Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 198/267] Btrfs: fix fsync data loss after append write Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 199/267] Btrfs: fix memory leak in the extent_same ioctl Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 200/267] Btrfs: fix list transaction->pending_ordered corruption Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 201/267] Btrfs: fix file corruption after cloning inline extents Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 202/267] selinux: dont waste ebitmap space when importing NetLabel categories Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 203/267] selinux: fix mprotect PROT_EXEC regression caused by mm change Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 204/267] fuse: initialize fc->release before calling it Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 205/267] crush: fix a bug in tree bucket decode Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 206/267] ACPI / resources: free memory on error in add_region_before() Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 207/267] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage Greg Kroah-Hartman
2015-07-31 19:40 ` [PATCH 4.1 208/267] ACPI / LPSS: Fix up acpi_lpss_create_device() Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 209/267] ACPICA: Tables: Enable both 32-bit and 64-bit FACS Greg Kroah-Hartman
2015-07-31 20:25   ` Moore, Robert
2015-07-31 20:33     ` Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 210/267] ACPICA: Tables: Fix an issue that FACS initialization is performed twice Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 211/267] ACPICA: Tables: Enable default 64-bit FADT addresses favor Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 212/267] ACPI / PCI: Fix regressions caused by resource_size_t overflow with 32-bit kernel Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 213/267] serial: samsung: only use earlycon for console Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 214/267] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 215/267] mmc: sdhci: Restore behavior while creating OCR mask Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 216/267] PM / clk: Fix clock error check in __pm_clk_add() Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 217/267] RDMA/ocrdma: fix double free on pd Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 218/267] tty: remove platform_sysrq_reset_seq Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 219/267] mm/hugetlb: introduce minimum hugepage order Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 220/267] PM / sleep: Increase default DPM watchdog timeout to 60 Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 221/267] firmware: dmi_scan: Only honor end-of-table for 64-bit tables Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 222/267] compiler-intel: fix wrong compiler barrier() macro Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 223/267] __bitmap_parselist: fix bug in empty string handling Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 224/267] security_syslog() should be called once only Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 225/267] mac80211: fix the beacon csa counter for mesh and ibss Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 226/267] iwlwifi: mvm: fix ROC reference accounting Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 227/267] cfg80211: ignore netif running state when changing iftype Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 228/267] mac80211: prevent possible crypto tx tailroom corruption Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 229/267] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 230/267] clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 231/267] ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 232/267] ideapad: fix software rfkill setting Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 233/267] of/address: use atomic allocation in pci_register_io_range() Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 235/267] ovl: lookup whiteouts outside iterate_dir() Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 236/267] of: return NUMA_NO_NODE from fallback of_node_to_nid() Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 239/267] clk: Fix JSON output in debugfs Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 240/267] clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 241/267] clk: qcom: Use parent rate when set rate to pixel RCG clock Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 242/267] pNFS: Fix a memory leak when attempted pnfs fails Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 243/267] pNFS/flexfiles: Fix the reset of struct pgio_header when resending Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 244/267] NFS: Fix size of NFSACL SETACL operations Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 245/267] fixing infinite OPEN loop in 4.0 stateid recovery Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 246/267] nfs: increase size of EXCHANGE_ID name string buffer Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 247/267] NFS: Ensure we set NFS_CONTEXT_RESEND_WRITES when requeuing writes Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 248/267] nfs: fix potential credential leak in ff_layout_update_mirror_cred Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 249/267] nfs: always update creds in mirror, even when we have an already connected ds Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 250/267] SUNRPC: Fix a memory leak in the backchannel code Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 251/267] 9p: forgetting to cancel request on interrupted zero-copy RPC Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 252/267] 9p: dont leave a half-initialized inode sitting around Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 253/267] rbd: use GFP_NOIO in rbd_obj_request_create() Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 254/267] agp/intel: Fix typo in needs_ilk_vtd_wa() Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 255/267] ARM: dove: fix legacy dove IRQ numbers Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 256/267] EDAC, octeon: Fix broken build due to model helper renames Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 257/267] p9_client_write(): avoid double p9_free_req() Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 258/267] ARM64: smp: Fix suspicious RCU usage with ipi tracepoints Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 259/267] arm64: bpf: fix out-of-bounds read in bpf2a64_offset() Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 260/267] arm64: bpf: fix endianness conversion bugs Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 261/267] arm64: Dont report clear pmds and puds as huge Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 262/267] perf bench numa: Fix to show proper convergence stats Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 263/267] ARM: 8393/1: smp: Fix suspicious RCU usage with ipi tracepoints Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 264/267] ARM: 8397/1: fix vdsomunge not to depend on glibc specific error.h Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 265/267] hpfs: kstrdup() out of memory handling Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 266/267] hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead Greg Kroah-Hartman
2015-07-31 19:41 ` [PATCH 4.1 267/267] Fix firmware loader uevent buffer NULL pointer dereference Greg Kroah-Hartman
2015-08-01  2:09 ` [PATCH 4.1 000/267] 4.1.4-stable review Guenter Roeck
2015-08-03 16:16   ` Greg Kroah-Hartman
2015-08-01  6:01 ` Sudip Mukherjee
2015-08-03 16:17   ` Greg Kroah-Hartman
2015-08-03 18:30 ` Shuah Khan
2015-08-03 21:12   ` Greg Kroah-Hartman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).