4.5.3-stable review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 4.5.3-stable review
This is the start of the stable review cycle for the 4.5.3 release. There are 200 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 5 00:05:29 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.5.3-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.5.3-rc1
Dan Carpenter <[email protected]>
extcon: max77843: Use correct size for reading the interrupt register
Arnd Bergmann <[email protected]>
stm class: Select CONFIG_SRCU
Jarkko Sakkinen <[email protected]>
tpm: fix: set continueSession attribute for the unseal operation
Jarkko Sakkinen <[email protected]>
tpm: fix checks for policy digest existence in tpm2_seal_trusted()
Arnd Bergmann <[email protected]>
megaraid_sas: add missing curly braces in ioctl handler
NeilBrown <[email protected]>
sunrpc/cache: drop reference when sunrpc_cache_pipe_upcall() detects a race
Caesar Wang <[email protected]>
thermal: rockchip: fix a impossible condition caused by the warning
Al Viro <[email protected]>
unbreak allmodconfig KCONFIG_ALLCONFIG=...
Jiri Kosina <[email protected]>
btrfs: cleaner_kthread() doesn't need explicit freeze
Kinglong Mee <[email protected]>
btrfs: fix memory leak of fs_info in block group cache
Fabio Estevam <[email protected]>
bus: imx-weim: Take the 'status' property value into account
Franklin S Cooper Jr <[email protected]>
ARM: dts: am437x: Fix GPMC dma properties
Franklin S Cooper Jr <[email protected]>
ARM: dts: am33xx: Fix GPMC dma properties
Robert Jarzmik <[email protected]>
ARM: dts: pxa: fix dma engine node to pxa3xx-nand
Lior Amsalem <[email protected]>
ARM: dts: armada-375: use armada-370-sata for SATA
Arnd Bergmann <[email protected]>
ARM: EXYNOS: select THERMAL_OF
Arnd Bergmann <[email protected]>
ARM: prima2: always enable reset controller
Pali Rohár <[email protected]>
ARM: OMAP3: Add cpuidle parameters table for omap3430
Andres Freund <[email protected]>
perf hists: Fix determination of a callchain node's childlessness
Peter Zijlstra <[email protected]>
perf/core: Fix time tracking bug with multiplexing
Alexander Shishkin <[email protected]>
perf/core: Don't leak event in the syscall error path
Allen Hubbe <[email protected]>
NTB: Remove _addr functions from ntb_hw_amd
Arnd Bergmann <[email protected]>
ntb: perf test: fix address space confusion
Borislav Petkov <[email protected]>
perf stat: Document --detailed option
Marcin Ślusarz <[email protected]>
perf tools: handle spaces in file names obtained from /proc/pid/maps
Namhyung Kim <[email protected]>
perf hists browser: Fix dump to show correct callchain style
Namhyung Kim <[email protected]>
perf hists browser: Only offer symbol scripting when a symbol is under the cursor
Ezequiel García <[email protected]>
mtd: nand: Drop mtd.owner requirement in nand_scan
Florian Fainelli <[email protected]>
mtd: brcmnand: Fix v7.1 register offsets
Cyrille Pitchen <[email protected]>
mtd: spi-nor: remove micron_quad_enable()
Kunihiko Hayashi <[email protected]>
bus: uniphier-system-bus: fix condition of overlap check
Chao Yu <[email protected]>
f2fs crypto: make sure the encryption info is initialized on opendir(2)
Chao Yu <[email protected]>
f2fs crypto: handle unexpected lack of encryption keys
Jaegeuk Kim <[email protected]>
f2fs: don't need to call set_page_dirty for io error
Jaegeuk Kim <[email protected]>
f2fs: do f2fs_balance_fs when block is allocated
Jaegeuk Kim <[email protected]>
ext4/fscrypto: avoid RCU lookup in d_revalidate
Jaegeuk Kim <[email protected]>
f2fs: cover large section in sanity check of super
Shawn Lin <[email protected]>
f2fs: slightly reorganize read_raw_super_block
Jaegeuk Kim <[email protected]>
f2fs crypto: fix corrupted symlink in encrypted case
Eryu Guan <[email protected]>
ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()
Karol Herbst <[email protected]>
x86/mm/kmmio: Fix mmiotrace for hugepages
Addy Ke <[email protected]>
spi: rockchip: modify DMA max burst to 1
Chris Phlipot <[email protected]>
perf tools: Fix perf script python database export crash
Arnaldo Carvalho de Melo <[email protected]>
perf evlist: Reference count the cpu and thread maps at set_maps()
Michael Hennerich <[email protected]>
drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors
Krzysztof Kozlowski <[email protected]>
rtc: max77686: Properly handle regmap_irq_get_virq() error code
Alexandre Belloni <[email protected]>
rtc: rx8025: remove rv8803 id
Dan Carpenter <[email protected]>
rtc: ds1685: passing bogus values to irq_restore
Geert Uytterhoeven <[email protected]>
rtc: vr41xx: Wire up alarm_irq_enable
Alexander Kochetkov <[email protected]>
rtc: hym8563: fix invalid year calculation
Jon Hunter <[email protected]>
PM / Domains: Fix removal of a subdomain
Viresh Kumar <[email protected]>
PM / OPP: Initialize u_volt_min/max to a valid value
Dan Carpenter <[email protected]>
misc: mic/scif: fix wrap around tests
Ben Hutchings <[email protected]>
misc/bmp085: Enable building as a module
Michal Marek <[email protected]>
lib/mpi: Endianness fix
Sushaanth Srirangapathi <[email protected]>
fbdev: da8xx-fb: fix videomodes of lcd panels
Arnd Bergmann <[email protected]>
scsi_dh: force modular build if SCSI is a module
Arnd Bergmann <[email protected]>
paride: make 'verbose' parameter an 'int' again
Arnd Bergmann <[email protected]>
regulator: s5m8767: fix get_register() error handling
Vladimir Zapolskiy <[email protected]>
irqchip/mxs: Fix error check of of_io_request_and_map()
Vladimir Zapolskiy <[email protected]>
irqchip/sunxi-nmi: Fix error check of of_io_request_and_map()
Huibin Hong <[email protected]>
spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs
Peter Zijlstra <[email protected]>
locking/mcs: Fix mcs_spin_lock() ordering
Ignat Korchagin <[email protected]>
USB: usbip: fix potential out-of-bounds write
Minchan Kim <[email protected]>
mm/hwpoison: fix wrong num_poisoned_pages accounting
Minchan Kim <[email protected]>
mm: vmscan: reclaim highmem zone if buffer_heads is over limit
Gerald Schaefer <[email protected]>
numa: fix /proc/<pid>/numa_maps for THP
Konstantin Khlebnikov <[email protected]>
mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check
Steve Capper <[email protected]>
mm: exclude HugeTLB pages from THP page_mapped() logic
Tejun Heo <[email protected]>
memcg: relocate charge moving from ->attach to ->post_attach
Tejun Heo <[email protected]>
cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback
Jesper Dangaard Brouer <[email protected]>
slub: clean up code for kmem cgroup support to kmem_cache_free_bulk
Roman Pen <[email protected]>
workqueue: fix ghost PENDING flag while doing MQ IO
Keith Busch <[email protected]>
x86/apic: Handle zero vector gracefully in clear_vector_irq()
Ard Biesheuvel <[email protected]>
efi: Expose non-blocking set_variable() wrapper to efivars
Laszlo Ersek <[email protected]>
efi: Fix out-of-bounds read in variable_matches()
Jason Gunthorpe <[email protected]>
IB/security: Restrict use of the write() interface
Sagi Grimberg <[email protected]>
IB/mlx5: Expose correct max_sge_rd limit
chunfan chen <[email protected]>
mwifiex: fix IBSS data path issue.
Doug Ledford <[email protected]>
IB/core: Fix oops in ib_cache_gid_set_default_gid
Michael Neuling <[email protected]>
cxl: Keep IRQ mappings on context teardown
Hans Verkuil <[email protected]>
v4l2-dv-timings.h: fix polarity for 4k formats
Sakari Ailus <[email protected]>
videobuf2-v4l2: Verify planes array in buffer dequeueing
Sakari Ailus <[email protected]>
videobuf2-core: Check user space planes array in dqbuf
Ricardo Ribalda Delgado <[email protected]>
media: vb2: Fix regression on poll() for RW mode
Ricardo Ribalda Delgado <[email protected]>
vb2-memops: Fix over allocation of frame vectors
Sugar Zhang <[email protected]>
ASoC: rt5640: Correct the digital interface data select
Mark Brown <[email protected]>
ASoC: dapm: Make sure we have a card when displaying component widgets
Lars-Peter Clausen <[email protected]>
ASoC: ssm4567: Reset device before regcache_sync()
Arnd Bergmann <[email protected]>
ASoC: s3c24xx: use const snd_soc_component_driver pointer
Tony Luck <[email protected]>
EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
Azael Avalos <[email protected]>
toshiba_acpi: Fix regression caused by hotkey enabling value
Adrian Hunter <[email protected]>
mmc: sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs
Lv Zheng <[email protected]>
ACPICA / Interpreter: Fix a regression triggered because of wrong Linux ECDT support
Javier Martinez Canillas <[email protected]>
i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
Michael Ellerman <[email protected]>
i2c: cpm: Fix build break due to incompatible pointer types
Adrian Hunter <[email protected]>
perf intel-pt: Fix segfault tracing transactions
Linus Walleij <[email protected]>
video: ARM CLCD: runtime check for Versatile
Flora Cui <[email protected]>
drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
Ville Syrjälä <[email protected]>
drm/i915: Use fw_domains_put_with_fifo() on HSW
Chris Wilson <[email protected]>
drm/i915: Force ringbuffers to not be at offset 0
Akash Goel <[email protected]>
drm/i915: Fixup the free space logic in ring_prepare
Mika Kuoppala <[email protected]>
drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs
Mat Martineau <[email protected]>
drm/i915/skl: Fix DMC load on Skylake J0 and K0
Dan Carpenter <[email protected]>
drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers()
Ville Syrjälä <[email protected]>
drm/i915: skl_update_scaler() wants a rotation bitmask instead of bit number
Ville Syrjälä <[email protected]>
drm/i915: Start WM computation from scratch on ILK-BDW
Ville Syrjälä <[email protected]>
drm/i915: Use the active wm config for merging on ILK-BDW
Ville Syrjälä <[email protected]>
drm/i915: Cleanup phys status page too
Ville Syrjälä <[email protected]>
drm/i915: Pass the correct encoder to intel_ddi_clk_select() with MST
Vladimir Zapolskiy <[email protected]>
pwm: brcmstb: Fix check of devm_ioremap_resource() return code
[email protected] <[email protected]>
drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
Lyude <[email protected]>
drm/dp/mst: Restore primary hub guid on resume
[email protected] <[email protected]>
drm/dp/mst: Validate port in drm_dp_payload_send_msg()
Ben Skeggs <[email protected]>
drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries
Huacai Chen <[email protected]>
drm: Loongson-3 doesn't fully support wc memory
Vitaly Prosyak <[email protected]>
drm/radeon: fix vertical bars appear on monitor (v2)
Jérôme Glisse <[email protected]>
drm/radeon: forbid mapping of userptr bo through radeon device file
Alex Deucher <[email protected]>
drm/radeon: fix initial connector audio value
Alex Deucher <[email protected]>
drm/radeon: add a quirk for a XFX R9 270X
Grigori Goronzy <[email protected]>
drm/amdgpu: fix regression on CIK (v2)
Sonny Jiang <[email protected]>
amdgpu/uvd: add uvd fw version for amdgpu
Alex Deucher <[email protected]>
drm/amdgpu: bump the afmt limit for CZ, ST, Polaris
Alex Deucher <[email protected]>
drm/amdgpu: use defines for CRTCs and AMFT blocks
Rex Zhu <[email protected]>
drm/amdgpu: when suspending, if uvd/vce was running. need to cancel delay work.
Robin Murphy <[email protected]>
iommu/dma: Restore scatterlist offsets correctly
Joerg Roedel <[email protected]>
iommu/amd: Fix checking of pci dma aliases
Keerthy <[email protected]>
pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs
Yingjoe Chen <[email protected]>
pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce
Arnd Bergmann <[email protected]>
xen kconfig: don't "select INPUT_XEN_KBDDEV_FRONTEND"
Stephen Boyd <[email protected]>
Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay
Vladis Dronov <[email protected]>
Input: gtco - fix crash on detecting device without endpoints
Dmitry Ivanov <[email protected]>
netlink: don't send NETLINK_URELEASE for unbound sockets
Dmitry Ivanov <[email protected]>
nl80211: check netlink protocol in socket release notification
Anton Blanchard <[email protected]>
powerpc: Update TM user feature bits in scan_features()
Anton Blanchard <[email protected]>
powerpc: Update cpu_user_features2 in scan_features()
Anton Blanchard <[email protected]>
powerpc: scan_features() updates incorrect bits for REAL_LE
Horia Geant? <[email protected]>
crypto: talitos - fix AEAD tcrypt tests
Jonas Eymann <[email protected]>
crypto: talitos - fix crash in talitos_cra_init()
Xiaodong Liu <[email protected]>
crypto: sha1-mb - use corrcet pointer while completing jobs
Tom Lendacky <[email protected]>
crypto: ccp - Prevent information leakage on export
Tadeusz Struk <[email protected]>
crypto: rsa-pkcs1pad - fix dst len
Matti Gottlieb <[email protected]>
iwlwifi: mvm: fix memory leak in paging
Emmanuel Grumbach <[email protected]>
iwlwifi: pcie: lower the debug level for RSA semaphore access
Sebastian Ott <[email protected]>
s390/pci: add extra padding to function measurement block
Srinivas Pandruvada <[email protected]>
cpufreq: intel_pstate: Fix processing for turbo activation ratio
Alex Deucher <[email protected]>
Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
Vladis Dronov <[email protected]>
usbvision: revert commit 588afcc1
Fabio Estevam <[email protected]>
Revert "PCI: imx6: Add support for active-low reset GPIO"
Alex Deucher <[email protected]>
Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control"
Lyude <[email protected]>
drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
John Keeping <[email protected]>
drm/qxl: fix cursor position with non-zero hotspot
Ilia Mirkin <[email protected]>
drm/nouveau/core: use vzalloc for allocating ramht
Davidlohr Bueso <[email protected]>
futex: Acknowledge a new waiter in counter before plist
Sebastian Andrzej Siewior <[email protected]>
futex: Handle unlock_pi race gracefully
Romain Perier <[email protected]>
asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic()
Takashi Iwai <[email protected]>
ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW
Conrad Kostecki <[email protected]>
ALSA: hda - Add dock support for ThinkPad X260
Takashi Iwai <[email protected]>
ALSA: pcxhr: Fix missing mutex unlock
Lu, Han <[email protected]>
ALSA: hda - add PCI ID for Intel Broxton-T
Takashi Iwai <[email protected]>
ALSA: hda - Keep powering up ADCs on Cirrus codecs
Bastien Nocera <[email protected]>
ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m
Takashi Iwai <[email protected]>
ALSA: hda - Don't trust the reported actual power state
Tony Luck <[email protected]>
x86 EDAC, sb_edac.c: Take account of channel hashing when needed
Tony Luck <[email protected]>
x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address
Jan Beulich <[email protected]>
x86/mm/xen: Suppress hugetlbfs in PV guests
Peter Zijlstra <[email protected]>
sched/cgroup: Fix/cleanup cgroup teardown/init
Robert Jarzmik <[email protected]>
mtd: nand: pxa3xx_nand: fix dmaengine initialization
Robert Jarzmik <[email protected]>
dmaengine: pxa_dma: fix the maximum requestor line
Peter Ujfalusi <[email protected]>
dmaengine: edma: Remove dynamic TPTC power management feature
Peter Ujfalusi <[email protected]>
dmaengine: omap-dma: Fix polled channel completion detection and handling
Andy Shevchenko <[email protected]>
dmaengine: hsu: correct residue calculation of active descriptor
Andy Shevchenko <[email protected]>
dmaengine: hsu: correct use of channel status register
Andy Shevchenko <[email protected]>
dmaengine: dw: fix master selection
Seth Forshee <[email protected]>
debugfs: Make automount point inodes permanently empty
Rui Salvaterra <[email protected]>
lib: lz4: fixed zram with lz4 on big endian machines
Ahmed Samy <[email protected]>
dm cache metadata: fix cmd_read_lock() acquiring write lock
Mike Snitzer <[email protected]>
dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros
Lars-Peter Clausen <[email protected]>
usb: gadget: f_fs: Fix use-after-free
Robert Dobrowolski <[email protected]>
usb: hcd: out of bounds access in for_each_companion
Peter Griffin <[email protected]>
usb: host: xhci-plat: Make enum xhci_plat_type start at a non zero value
Mathias Nyman <[email protected]>
xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers
Lu Baolu <[email protected]>
usb: xhci: fix wild pointers in xhci_mem_cleanup
Yoshihiro Shimoda <[email protected]>
usb: host: xhci-plat: fix cannot work if R-Car Gen2/3 run on above 4GB phys
Yoshihiro Shimoda <[email protected]>
usb: host: xhci: add a new quirk XHCI_NO_64BIT_SUPPORT
Mathias Nyman <[email protected]>
xhci: resume USB 3 roothub first
Rafal Redzimski <[email protected]>
usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host
Jerome Marchand <[email protected]>
assoc_array: don't call compare_object() on a node
Lokesh Vutla <[email protected]>
ARM: OMAP2+: hwmod: Fix updating of sysconfig register
Nishanth Menon <[email protected]>
ARM: OMAP2: Fix up interconnect barrier initialization for DRA7
Patrick Uiterwijk <[email protected]>
ARM: mvebu: Correct unit address for linksys
Tero Kristo <[email protected]>
ARM: dts: am43xx: fix edma memcpy channel allocation
Lokesh Vutla <[email protected]>
ARM: dts: AM43x-epos: Fix clk parent for synctimer
Marc Zyngier <[email protected]>
KVM: arm/arm64: Handle forward time correction gracefully
David Matlack <[email protected]>
kvm: x86: do not leak guest xcr0 into host interrupt handlers
Tony Luck <[email protected]>
x86/mce: Avoid using object after free in genpool
Ard Biesheuvel <[email protected]>
efi/arm64: Don't apply MEMBLOCK_NOMAP to UEFI memory map mapping
Ming Lei <[email protected]>
block: loop: fix filesystem corruption in case of aio/dio
Ming Lei <[email protected]>
block: partition: initialize percpuref before sending out KOBJ_ADD
Ulf Hansson <[email protected]>
mmc: block: Use the mmc host device index as the mmcblk device index
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/am33xx.dtsi | 2 +- arch/arm/boot/dts/am4372.dtsi | 4 +- arch/arm/boot/dts/am43x-epos-evm.dts | 5 + arch/arm/boot/dts/armada-375.dtsi | 2 +- arch/arm/boot/dts/armada-385-linksys.dtsi | 2 +- arch/arm/boot/dts/pxa3xx.dtsi | 2 +- arch/arm/mach-exynos/Kconfig | 1 + arch/arm/mach-omap2/cpuidle34xx.c | 69 ++++++++- arch/arm/mach-omap2/io.c | 1 + arch/arm/mach-omap2/omap_hwmod.c | 8 +- arch/arm/mach-prima2/Kconfig | 1 + arch/powerpc/include/uapi/asm/cputable.h | 1 + arch/powerpc/kernel/prom.c | 26 ++-- arch/s390/include/asm/pci.h | 3 +- arch/x86/crypto/sha-mb/sha1_mb.c | 4 +- arch/x86/include/asm/hugetlb.h | 1 + arch/x86/kernel/apic/vector.c | 3 +- arch/x86/kernel/cpu/mcheck/mce-genpool.c | 4 +- arch/x86/kvm/x86.c | 10 +- arch/x86/mm/kmmio.c | 88 ++++++++---- block/partition-generic.c | 13 +- crypto/rsa-pkcs1pad.c | 12 +- drivers/acpi/acpica/nsinit.c | 2 + drivers/acpi/acpica/tbxfload.c | 14 ++ drivers/acpi/acpica/utxfinit.c | 25 ++-- drivers/base/power/domain.c | 2 +- drivers/base/power/opp/core.c | 10 +- drivers/block/loop.c | 6 + drivers/block/paride/pd.c | 4 +- drivers/block/paride/pt.c | 4 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/uniphier-system-bus.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 22 +-- drivers/cpufreq/intel_pstate.c | 5 + drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 3 + drivers/crypto/ccp/ccp-crypto-sha.c | 3 + drivers/crypto/talitos.c | 87 ++++++++---- drivers/dma/dw/core.c | 34 +++-- drivers/dma/edma.c | 38 +---- drivers/dma/hsu/hsu.c | 9 +- drivers/dma/hsu/hsu.h | 3 + drivers/dma/omap-dma.c | 22 ++- drivers/dma/pxa_dma.c | 39 +++-- drivers/edac/i7core_edac.c | 2 +- drivers/edac/sb_edac.c | 32 ++++- drivers/extcon/extcon-max77843.c | 2 +- drivers/firmware/efi/arm-init.c | 18 ++- drivers/firmware/efi/efi.c | 1 + drivers/firmware/efi/vars.c | 37 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 1 + drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c | 2 +- drivers/gpu/drm/drm_dp_mst_topology.c | 29 +++- drivers/gpu/drm/i915/intel_csr.c | 3 +- drivers/gpu/drm/i915/intel_display.c | 2 +- drivers/gpu/drm/i915/intel_dp_mst.c | 8 +- drivers/gpu/drm/i915/intel_lrc.c | 6 +- drivers/gpu/drm/i915/intel_pm.c | 33 ++++- drivers/gpu/drm/i915/intel_ringbuffer.c | 42 ++++-- drivers/gpu/drm/i915/intel_uncore.c | 6 +- drivers/gpu/drm/nouveau/nvkm/core/ramht.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 + drivers/gpu/drm/qxl/qxl_display.c | 13 +- drivers/gpu/drm/qxl/qxl_drv.h | 2 + drivers/gpu/drm/radeon/evergreen.c | 154 +++++++++++++++++++- drivers/gpu/drm/radeon/evergreen_reg.h | 46 ++++++ drivers/gpu/drm/radeon/radeon_atpx_handler.c | 8 +- drivers/gpu/drm/radeon/radeon_connectors.c | 7 +- drivers/gpu/drm/radeon/radeon_device.c | 8 +- drivers/gpu/drm/radeon/radeon_ttm.c | 2 + drivers/gpu/drm/radeon/si_dpm.c | 1 + drivers/gpu/drm/ttm/ttm_bo.c | 17 +-- drivers/hwtracing/stm/Kconfig | 1 + drivers/i2c/busses/i2c-cpm.c | 4 +- drivers/i2c/busses/i2c-exynos5.c | 24 +++- drivers/infiniband/core/cache.c | 3 +- drivers/infiniband/core/ucm.c | 4 + drivers/infiniband/core/ucma.c | 3 + drivers/infiniband/core/uverbs_main.c | 5 + drivers/infiniband/hw/mlx5/main.c | 2 +- drivers/infiniband/hw/qib/qib_file_ops.c | 5 + drivers/input/misc/pmic8xxx-pwrkey.c | 7 +- drivers/input/tablet/gtco.c | 10 +- drivers/iommu/amd_iommu.c | 87 ++++++++++-- drivers/iommu/dma-iommu.c | 4 +- drivers/irqchip/irq-mxs.c | 2 +- drivers/irqchip/irq-sunxi-nmi.c | 4 +- drivers/md/dm-cache-metadata.c | 64 +++++---- drivers/media/usb/usbvision/usbvision-video.c | 7 - drivers/media/v4l2-core/videobuf2-core.c | 20 ++- drivers/media/v4l2-core/videobuf2-memops.c | 2 +- drivers/media/v4l2-core/videobuf2-v4l2.c | 20 +-- drivers/misc/Kconfig | 2 +- drivers/misc/ad525x_dpot.c | 2 +- drivers/misc/cxl/irq.c | 1 - drivers/misc/mic/scif/scif_rma.c | 7 +- drivers/mmc/card/block.c | 18 +-- drivers/mmc/host/Kconfig | 1 + drivers/mmc/host/sdhci-acpi.c | 81 +++++++++++ drivers/mtd/nand/brcmnand/brcmnand.c | 34 ++++- drivers/mtd/nand/nand_base.c | 10 +- drivers/mtd/nand/pxa3xx_nand.c | 2 +- drivers/mtd/spi-nor/spi-nor.c | 46 +----- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 - drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 4 +- drivers/net/wireless/marvell/mwifiex/sta_event.c | 10 +- drivers/net/wireless/marvell/mwifiex/wmm.c | 6 +- drivers/ntb/hw/amd/ntb_hw_amd.c | 30 ---- drivers/ntb/test/ntb_perf.c | 21 +-- drivers/pci/host/pci-imx6.c | 20 ++- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +- drivers/pinctrl/pinctrl-single.c | 6 +- drivers/platform/x86/toshiba_acpi.c | 2 +- drivers/pwm/pwm-brcmstb.c | 4 +- drivers/regulator/s5m8767.c | 13 +- drivers/rtc/rtc-ds1685.c | 8 +- drivers/rtc/rtc-hym8563.c | 2 +- drivers/rtc/rtc-max77686.c | 2 +- drivers/rtc/rtc-rx8025.c | 1 - drivers/rtc/rtc-vr41xx.c | 13 +- drivers/scsi/device_handler/Kconfig | 8 +- drivers/scsi/megaraid/megaraid_sas_base.c | 3 +- drivers/spi/spi-rockchip.c | 19 ++- drivers/staging/rdma/hfi1/TODO | 2 +- drivers/staging/rdma/hfi1/file_ops.c | 6 + drivers/thermal/rockchip_thermal.c | 11 +- drivers/usb/core/hcd-pci.c | 9 ++ drivers/usb/gadget/function/f_fs.c | 5 +- drivers/usb/host/xhci-mem.c | 6 + drivers/usb/host/xhci-pci.c | 5 +- drivers/usb/host/xhci-plat.c | 13 ++ drivers/usb/host/xhci-plat.h | 2 +- drivers/usb/host/xhci-ring.c | 3 +- drivers/usb/host/xhci.c | 24 +++- drivers/usb/host/xhci.h | 2 + drivers/usb/usbip/usbip_common.c | 11 ++ drivers/video/fbdev/Kconfig | 1 - drivers/video/fbdev/amba-clcd.c | 15 +- drivers/video/fbdev/da8xx-fb.c | 7 +- fs/btrfs/disk-io.c | 2 +- fs/btrfs/tests/btrfs-tests.c | 6 - fs/btrfs/tests/free-space-tree-tests.c | 1 + fs/debugfs/inode.c | 2 +- fs/ext4/crypto.c | 4 + fs/ext4/inode.c | 6 +- fs/f2fs/crypto_policy.c | 3 +- fs/f2fs/data.c | 13 +- fs/f2fs/dir.c | 8 ++ fs/f2fs/file.c | 6 +- fs/f2fs/namei.c | 12 +- fs/f2fs/super.c | 165 +++++++++++++--------- fs/proc/task_mmu.c | 33 ++++- include/asm-generic/futex.h | 8 +- include/drm/drm_cache.h | 2 + include/keys/trusted-type.h | 2 +- include/linux/cgroup-defs.h | 1 + include/linux/cpuset.h | 6 - include/linux/mlx5/device.h | 11 ++ include/linux/mm.h | 4 + include/media/videobuf2-core.h | 8 ++ include/rdma/ib.h | 16 +++ include/sound/hda_i915.h | 5 +- include/uapi/linux/v4l2-dv-timings.h | 30 ++-- kernel/cgroup.c | 7 +- kernel/cpuset.c | 4 +- kernel/events/core.c | 15 +- kernel/futex.c | 27 +++- kernel/locking/mcs_spinlock.h | 8 +- kernel/sched/core.c | 35 ++--- kernel/workqueue.c | 29 ++++ lib/assoc_array.c | 4 +- lib/lz4/lz4defs.h | 21 +-- lib/mpi/mpicoder.c | 39 ++--- mm/huge_memory.c | 6 +- mm/memcontrol.c | 37 ++--- mm/memory.c | 40 ++++++ mm/migrate.c | 8 +- mm/slub.c | 22 +-- mm/vmscan.c | 2 +- net/netlink/af_netlink.c | 2 +- net/sunrpc/cache.c | 6 +- net/wireless/nl80211.c | 2 +- scripts/kconfig/confdata.c | 12 +- security/keys/trusted.c | 11 +- sound/hda/hdac_i915.c | 62 ++++++-- sound/pci/hda/hda_generic.c | 6 +- sound/pci/hda/hda_intel.c | 59 +------- sound/pci/hda/patch_cirrus.c | 14 ++ sound/pci/hda/patch_hdmi.c | 1 + sound/pci/hda/patch_realtek.c | 2 + sound/pci/pcxhr/pcxhr_core.c | 1 + sound/soc/codecs/rt5640.c | 2 +- sound/soc/codecs/rt5640.h | 36 ++--- sound/soc/codecs/ssm4567.c | 5 + sound/soc/samsung/s3c-i2s-v2.c | 2 +- sound/soc/samsung/s3c-i2s-v2.h | 2 +- sound/soc/soc-dapm.c | 7 + tools/perf/Documentation/perf-stat.txt | 8 ++ tools/perf/ui/browsers/hists.c | 85 ++++++----- tools/perf/util/event.c | 2 +- tools/perf/util/evlist.c | 4 +- tools/perf/util/evsel.h | 6 +- tools/perf/util/intel-pt.c | 2 +- virt/kvm/arm/arch_timer.c | 49 +++++-- 212 files changed, 2004 insertions(+), 955 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/200 mmc: block: Use the mmc host device index as the mmcblk device index
4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
commit 9aaf3437aa72ed5370bf32c99580a3fa2c330e3d upstream.
Commit 520bd7a8b415 ("mmc: core: Optimize boot time by detecting cards simultaneously") causes regressions for some platforms.
These platforms relies on fixed mmcblk device indexes, instead of deploying the defacto standard with UUID/PARTUUID. In other words their rootfs needs to be available at hardcoded paths, like /dev/mmcblk0p2.
Such guarantees have never been made by the kernel, but clearly the above commit changes the behaviour. More precisely, because of that the order changes of how cards becomes detected, so do their corresponding mmcblk device indexes.
As the above commit significantly improves boot time for some platforms (magnitude of seconds), let's avoid reverting this change but instead restore the behaviour of how mmcblk device indexes becomes picked.
By using the same index for the mmcblk device as for the corresponding mmc host device, the probe order of mmc host devices decides the index we get for the mmcblk device.
For those platforms that suffers from a regression, one could expect that this updated behaviour should be sufficient to meet their expectations of "fixed" mmcblk device indexes.
Another side effect from this change, is that the same index is used for the mmc host device, the mmcblk device and the mmc block queue. That should clarify their relationship.
simultaneously")
--- drivers/mmc/card/block.c | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-)
drivers/mmc/card/block.c +1 -17
@@ -86,7 +86,6 @@ static int max_devices;/* TODO: Replace these with struct ida */ static DECLARE_BITMAP(dev_use, MAX_DEVICES); -static DECLARE_BITMAP(name_use, MAX_DEVICES);/* * There is one mmc_blk_data per slot.
@@ -105,7 +104,6 @@ struct mmc_blk_data {unsigned int usage;unsigned int read_only;unsigned int part_type; -unsigned int name_idx;unsigned int reset_done;#define MMC_BLK_READ BIT(0)#define MMC_BLK_WRITE BIT(1)
@@ -2202,19 +2200,6 @@ static struct mmc_blk_data *mmc_blk_allo goto out; } -/* -* !subname implies we are creating main mmc_blk_data that will be -* associated with mmc_card with dev_set_drvdata. Due to device -* partitions, devidx will not coincide with a per-physical card -* index anymore so we keep track of a name index. -*/ -if (!subname) { - md->name_idx =find_first_zero_bit (name_use, max_devices); -__set_bit (md->name_idx, name_use); - }else - md->name_idx = ((struct mmc_blk_data *) -dev_to_disk (parent)->private_data)->name_idx; - md->area_type = area_type;/*
@@ -2264,7 +2249,7 @@ static struct mmc_blk_data *mmc_blk_allo*/ snprintf (md->disk->disk_name,sizeof (md->disk->disk_name), -"mmcblk%u%s" , md->name_idx, subname ? subname :"" ); +"mmcblk%u%s" , card->host->index, subname ? subname :"" );if (mmc_card_mmc (card)) blk_queue_logical_block_size(md->queue.queue,
@@ -2418,7 +2403,6 @@ static void mmc_blk_remove_parts(structstruct list_head *pos, *q;struct mmc_blk_data *part_md; -__clear_bit (md->name_idx, name_use);list_for_each_safe (pos, q, &md->part) { part_md = list_entry(pos, struct mmc_blk_data, part);list_del (pos);
Greg Kroah-Hartman
maintainerPATCH 2/200 block: partition: initialize percpuref before sending out KOBJ_ADD
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit b30a337ca27c4f40439e4bfb290cba5f88d73bb7 upstream.
The initialization of partition's percpu_ref should have been done before sending out KOBJ_ADD uevent, which may cause userspace to read partition table. So the uninitialized percpu_ref may be accessed in data path.
This patch fixes this issue reported by Naveen.
--- block/partition-generic.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
block/partition-generic.c +10 -3
@@ -350,15 +350,20 @@ struct hd_struct *add_partition(struct g goto out_del; } + err =hd_ref_init (p); +if (err) { +if (flags &ADDPART_FLAG_WHOLEDISK ) + goto out_remove_file; + goto out_del; + } +/* everything is up and running, commence */ rcu_assign_pointer (ptbl->part[partno], p);/* suppress uevent if the disk suppresses it */ if (!dev_get_uevent_suppress (ddev))kobject_uevent (&pdev->kobj,KOBJ_ADD ); - -if (!hd_ref_init (p)) -return p; +return p; out_free_info:free_part_info (p);
@@ -367,6 +372,8 @@ out_free_stats: out_free:kfree (p);return ERR_PTR (err); +out_remove_file: +device_remove_file (pdev, &dev_attr_whole_disk); out_del:kobject_put (p->holder_dir);device_del (pdev);
Greg Kroah-Hartman
maintainerPATCH 3/200 block: loop: fix filesystem corruption in case of aio/dio
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit a7297a6a3a3322b054592e8e988981d2f5f29cc4 upstream.
Starting from commit e36f620428(block: split bios to max possible length), block core starts to split bio in the middle of bvec.
Unfortunately loop dio/aio doesn't consider this situation, and always treat 'iter.iov_offset' as zero. Then filesystem corruption is observed.
This patch figures out the offset of the base bvevc via 'bio->bi_iter.bi_bvec_done' and fixes the issue by passing the offset to iov iterator.
--- drivers/block/loop.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/block/loop.c +6 -0
@@ -488,6 +488,12 @@ static int lo_rw_aio(struct loop_device bvec =__bvec_iter_bvec (bio->bi_io_vec, bio->bi_iter);iov_iter_bvec (&iter,ITER_BVEC | rw, bvec,bio_segments (bio),blk_rq_bytes (cmd->rq)); +/* +* This bio may be started from the middle of the 'bvec' +* because of bio splitting, so offset from the bvec must +* be passed to iov iterator +*/ + iter.iov_offset = bio->bi_iter.bi_bvec_done; cmd->iocb.ki_pos = pos; cmd->iocb.ki_filp = file;
Greg Kroah-Hartman
maintainerPATCH 4/200 efi/arm64: Dont apply MEMBLOCK_NOMAP to UEFI memory map mapping
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 7cc8cbcf82d165dd658d89a7a287140948e76413 upstream.
Commit 4dffbfc48d65 ("arm64/efi: mark UEFI reserved regions as MEMBLOCK_NOMAP") updated the mapping logic of both the RuntimeServices regions as well as the kernel's copy of the UEFI memory map to set the MEMBLOCK_NOMAP flag, which causes these regions to be omitted from the kernel direct mapping, and from being covered by a struct page. For the RuntimeServices regions, this is an obvious win, since the contents of these regions have significance to the firmware executable code itself, and are mapped in the EFI page tables using attributes that are described in the UEFI memory map, and which may differ from the attributes we use for mapping system RAM. It also prevents the contents from being modified inadvertently, since the EFI page tables are only live during runtime service invocations.
None of these concerns apply to the allocation that covers the UEFI memory map, since it is entirely owned by the kernel. Setting the MEMBLOCK_NOMAP on the region did allow us to use ioremap_cache() to map it both on arm64 and on ARM, since the latter does not allow ioremap_cache() to be used on regions that are covered by a struct page.
The ioremap_cache() on ARM restriction will be lifted in the v4.7 timeframe, but in the mean time, it has been reported that commit 4dffbfc48d65 causes a regression on 64k granule kernels. This is due to the fact that, given the 64 KB page size, the region that we end up removing from the kernel direct mapping is rounded up to 64 KB, and this 64 KB page frame may be shared with the initrd when booting via GRUB (which does not align its EFI_LOADER_DATA allocations to 64 KB like the stub does). This will crash the kernel as soon as it tries to access the initrd.
Since the issue is specific to arm64, revert back to memblock_reserve()'ing the UEFI memory map when running on arm64. This is a temporary fix for v4.5 and v4.6, and will be superseded in the v4.7 timeframe when we will be able to move back to memblock_reserve() unconditionally.
--- drivers/firmware/efi/arm-init.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/firmware/efi/arm-init.c +15 -3
@@ -203,7 +203,19 @@ void __init efi_init(void)reserve_regions ();early_memunmap (memmap.map, params.mmap_size); -memblock_mark_nomap (params.mmap &PAGE_MASK , -PAGE_ALIGN (params.mmap_size + - (params.mmap & ~PAGE_MASK ))); + +if (IS_ENABLED (CONFIG_ARM )) { +/* +* ARM currently does not allow ioremap_cache() to be called on +* memory regions that are covered by struct page. So remove the +* UEFI memory map from the linear mapping. +*/ +memblock_mark_nomap (params.mmap &PAGE_MASK , +PAGE_ALIGN (params.mmap_size + + (params.mmap & ~PAGE_MASK ))); + }else { +memblock_reserve (params.mmap &PAGE_MASK , +PAGE_ALIGN (params.mmap_size + + (params.mmap & ~PAGE_MASK ))); + } }
Greg Kroah-Hartman
maintainerPATCH 5/200 x86/mce: Avoid using object after free in genpool
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
commit a3125494cff084b098c80bb36fbe2061ffed9d52 upstream.
When we loop over all queued machine check error records to pass them to the registered notifiers we use llist_for_each_entry(). But the loop calls gen_pool_free() for the entry in the body of the loop - and then the iterator looks at node->next after the free.
Use llist_for_each_entry_safe() instead.
--- arch/x86/kernel/cpu/mcheck/mce-genpool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/mcheck/mce-genpool.c +2 -2
@@ -29,7 +29,7 @@ static char gen_pool_buf[MCE_POOLSZ];void mce_gen_pool_process (void ) {struct llist_node *head; -struct mce_evt_llist *node; +struct mce_evt_llist *node, *tmp;struct mce *mce; head =llist_del_all (&mce_event_llist);
@@ -37,7 +37,7 @@ void mce_gen_pool_process(void)return ; head =llist_reverse_order (head); -llist_for_each_entry (node, head, llnode) { +llist_for_each_entry_safe (node, tmp, head, llnode) { mce = &node->mce;atomic_notifier_call_chain (&x86_mce_decoder_chain,0 , mce);gen_pool_free (mce_evt_pool, (unsigned long )node,sizeof (*node));
Greg Kroah-Hartman
maintainerPATCH 6/200 kvm: x86: do not leak guest xcr0 into host interrupt handlers
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Matlack <[email protected]>
commit fc5b7f3bf1e1414bd4e91db6918c85ace0c873a5 upstream.
An interrupt handler that uses the fpu can kill a KVM VM, if it runs under the following conditions:
- the guest's xcr0 register is loaded on the cpu
- the guest's fpu context is not loaded
- the host is using eagerfpu
Note that the guest's xcr0 register and fpu context are not loaded as part of the atomic world switch into "guest mode". They are loaded by KVM while the cpu is still in "host mode".
Usage of the fpu in interrupt context is gated by irq_fpu_usable(). The interrupt handler will look something like this:
if (irq_fpu_usable()) {
kernel_fpu_begin();
[... code that uses the fpu ...]
kernel_fpu_end();
}As long as the guest's fpu is not loaded and the host is using eager fpu, irq_fpu_usable() returns true (interrupted_kernel_fpu_idle() returns true). The interrupt handler proceeds to use the fpu with the guest's xcr0 live.
kernel_fpu_begin() saves the current fpu context. If this uses XSAVE[OPT], it may leave the xsave area in an undesirable state. According to the SDM, during XSAVE bit i of XSTATE_BV is not modified if bit i is 0 in xcr0. So it's possible that XSTATE_BV[i] == 1 and xcr0[i] == 0 following an XSAVE.
kernel_fpu_end() restores the fpu context. Now if any bit i in XSTATE_BV == 1 while xcr0[i] == 0, XRSTOR generates a #GP. The fault is trapped and SIGSEGV is delivered to the current process.
Only pre-4.2 kernels appear to be vulnerable to this sequence of events. Commit 653f52c ("kvm,x86: load guest FPU context more eagerly") from 4.2 forces the guest's fpu to always be loaded on eagerfpu hosts.
This patch fixes the bug by keeping the host's xcr0 loaded outside of the interrupts-disabled region where KVM switches into guest mode.
--- arch/x86/kvm/x86.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
arch/x86/kvm/x86.c +4 -6
@@ -697,7 +697,6 @@ static int __kvm_set_xcr(struct kvm_vcpuif ((xcr0 &XFEATURE_MASK_AVX512 ) !=XFEATURE_MASK_AVX512 )return 1 ; } -kvm_put_guest_xcr0 (vcpu); vcpu->arch.xcr0 = xcr0;if ((xcr0 ^ old_xcr0) &XFEATURE_MASK_EXTEND )
@@ -6569,8 +6568,6 @@ static int vcpu_enter_guest(struct kvm_v kvm_x86_ops->prepare_guest_switch (vcpu);if (vcpu->fpu_active)kvm_load_guest_fpu (vcpu); -kvm_load_guest_xcr0 (vcpu); - vcpu->mode =IN_GUEST_MODE ;srcu_read_unlock (&vcpu->kvm->srcu, vcpu->srcu_idx);
@@ -6593,6 +6590,8 @@ static int vcpu_enter_guest(struct kvm_v goto cancel_injection; } +kvm_load_guest_xcr0 (vcpu); +if (req_immediate_exit)smp_send_reschedule (vcpu->cpu);
@@ -6642,6 +6641,8 @@ static int vcpu_enter_guest(struct kvm_v vcpu->mode =OUTSIDE_GUEST_MODE ;smp_wmb (); +kvm_put_guest_xcr0 (vcpu); +/* Interrupt is enabled by handle_external_intr() */ kvm_x86_ops->handle_external_intr (vcpu);
@@ -7289,7 +7290,6 @@ void kvm_load_guest_fpu(struct kvm_vcpu* and assume host would use all available bits. * Guest xcr0 would be loaded later. */ -kvm_put_guest_xcr0 (vcpu); vcpu->guest_fpu_loaded =1 ;__kernel_fpu_begin ();__copy_kernel_to_fpregs (&vcpu->arch.guest_fpu.state);
@@ -7298,8 +7298,6 @@ void kvm_load_guest_fpu(struct kvm_vcpuvoid kvm_put_guest_fpu (struct kvm_vcpu *vcpu) { -kvm_put_guest_xcr0 (vcpu); -if (!vcpu->guest_fpu_loaded) { vcpu->fpu_counter =0 ;return ;
Greg Kroah-Hartman
maintainerPATCH 7/200 KVM: arm/arm64: Handle forward time correction gracefully
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 1c5631c73fc2261a5df64a72c155cb53dcdc0c45 upstream.
On a host that runs NTP, corrections can have a direct impact on the background timer that we program on the behalf of a vcpu.
In particular, NTP performing a forward correction will result in a timer expiring sooner than expected from a guest point of view. Not a big deal, we kick the vcpu anyway.
But on wake-up, the vcpu thread is going to perform a check to find out whether or not it should block. And at that point, the timer check is going to say "timer has not expired yet, go back to sleep". This results in the timer event being lost forever.
There are multiple ways to handle this. One would be record that the timer has expired and let kvm_cpu_has_pending_timer return true in that case, but that would be fairly invasive. Another is to check for the "short sleep" condition in the hrtimer callback, and restart the timer for the remaining time when the condition is detected.
This patch implements the latter, with a bit of refactoring in order to avoid too much code duplication.
--- virt/kvm/arm/arch_timer.c | 49 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 39 insertions(+), 10 deletions(-)
virt/kvm/arm/arch_timer.c +39 -10
@@ -86,6 +86,8 @@ static void kvm_timer_inject_irq_work(st vcpu = container_of(work, struct kvm_vcpu, arch.timer_cpu.expired); vcpu->arch.timer_cpu.armed = false; +WARN_ON (!kvm_timer_should_fire (vcpu)); +/* * If the vcpu is blocked we want to wake it up so that it will see * the timer has expired when entering the guest.
@@ -93,10 +95,46 @@ static void kvm_timer_inject_irq_work(stkvm_vcpu_kick (vcpu); } +static u64 kvm_timer_compute_delta (struct kvm_vcpu *vcpu) +{ +cycle_t cval, now; + + cval = vcpu->arch.timer_cpu.cntv_cval; + now =kvm_phys_timer_read () - vcpu->kvm->arch.timer.cntvoff; + +if (now < cval) { +u64 ns; + + ns =cyclecounter_cyc2ns (timecounter->cc, + cval - now, + timecounter->mask, + &timecounter->frac); +return ns; + } + +return 0 ; +} +static enum hrtimer_restart kvm_timer_expire (struct hrtimer *hrt) {struct arch_timer_cpu *timer; +struct kvm_vcpu *vcpu; +u64 ns; + timer = container_of(hrt, struct arch_timer_cpu, timer); + vcpu = container_of(timer, struct kvm_vcpu, arch.timer_cpu); + +/* +* Check that the timer has really expired from the guest's +* PoV (NTP on the host may have forced it to expire +* early). If we should have slept longer, restart it. +*/ + ns =kvm_timer_compute_delta (vcpu); +if (unlikely (ns)) { +hrtimer_forward_now (hrt,ns_to_ktime (ns)); +return HRTIMER_RESTART ; + } +queue_work (wqueue, &timer->expired);return HRTIMER_NORESTART ; }
@@ -170,8 +208,6 @@ static int kvm_timer_update_state(structvoid kvm_timer_schedule (struct kvm_vcpu *vcpu) {struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu; -u64 ns; -cycle_t cval, now;BUG_ON (timer_is_armed (timer));
@@ -191,14 +227,7 @@ void kvm_timer_schedule(struct kvm_vcpureturn ;/* The timer has not yet expired, schedule a background timer */ - cval = timer->cntv_cval; - now =kvm_phys_timer_read () - vcpu->kvm->arch.timer.cntvoff; - - ns =cyclecounter_cyc2ns (timecounter->cc, - cval - now, - timecounter->mask, - &timecounter->frac); -timer_arm (timer, ns); +timer_arm (timer,kvm_timer_compute_delta (vcpu)); }void kvm_timer_unschedule (struct kvm_vcpu *vcpu)
Greg Kroah-Hartman
maintainerPATCH 8/200 ARM: dts: AM43x-epos: Fix clk parent for synctimer
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lokesh Vutla <[email protected]>
commit cfe1580a6415bc37fd62d79eb8102a618f7650b2 upstream.
commit 55ee7017ee31 ("arm: omap2: board-generic: use omap4_local_timer_init for AM437x") makes synctimer32k as the clocksource on AM43xx. By default the synctimer32k is clocked by 32K RTC OSC on AM43xx. But this 32K RTC OSC is not available on epos boards which makes it fail to boot.
Synctimer32k can also be clocked by a peripheral PLL, so making this as clock parent for synctimer3k on epos boards.
--- arch/arm/boot/dts/am43x-epos-evm.dts | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm/boot/dts/am43x-epos-evm.dts +5 -0
@@ -792,3 +792,8 @@ tx-num-evt = <32>; rx-num-evt = <32>; }; + +&synctimer_32kclk { + assigned-clocks = <&mux_synctimer32k_ck>; + assigned-clock-parents = <&clkdiv32k_ick>; +};
Greg Kroah-Hartman
maintainerPATCH 9/200 ARM: dts: am43xx: fix edma memcpy channel allocation
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tero Kristo <[email protected]>
commit d41676ddddef27224a398609d874055866694cfa upstream.
EDMA was allocating DMA channels 32 and 33 for memcpy usage, out of which channel 33 is actually used by DES crypto engine. This bad allocation of the channel causes a crash in the DES crypto engine, as the channel gets configured for memcpy usage instead of hardware <-> memory DMA.
Fixed by allocating DMA channels 58 and 59 for memcpy usage (I2C0 RX/TX), which are not used by anybody.
the eDMA3")
--- arch/arm/boot/dts/am4372.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/am4372.dtsi +1 -1
@@ -207,7 +207,7 @@ ti,tptcs = <&edma_tptc0 7>, <&edma_tptc1 5>, <&edma_tptc2 0>; - ti,edma-memcpy-channels = <32 33>; + ti,edma-memcpy-channels = <58 59>; }; edma_tptc0: tptc@49800000 {
Greg Kroah-Hartman
maintainerPATCH 10/200 ARM: mvebu: Correct unit address for linksys
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Uiterwijk <[email protected]>
commit 199831c77c50e6913e893b6bc268ba9f4a9a2bf8 upstream.
The USB2 port for Armada 38x is defined to be at 58000, not at 50000.
--- arch/arm/boot/dts/armada-385-linksys.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/armada-385-linksys.dtsi +1 -1
@@ -117,7 +117,7 @@ }; /* USB part of the eSATA/USB 2.0 port */ - usb@50000 { + usb@58000 { status = "okay"; };
Greg Kroah-Hartman
maintainerPATCH 11/200 ARM: OMAP2: Fix up interconnect barrier initialization for DRA7
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
commit 456e8d53482537616899a146b706eccd095404e6 upstream.
The following commits:
commit 3fa609755c11 ("ARM: omap2: restore OMAP4 barrier behaviour")
commit f746929ffdc8 ("Revert "ARM: OMAP4: remove dead kconfig option OMAP4_ERRATA_I688"") and
commit ea827ad5ffbb ("ARM: DRA7: Provide proper IO map table")
came in around the same time, unfortunately this seem to have missed initializing the barrier for DRA7 platforms - omap5_map_io was reused
for dra7 till it was split out by the last patch. barrier_init
needs to be hence carried forward as it is valid for DRA7 family of processors as they are for OMAP5.
--- arch/arm/mach-omap2/io.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-omap2/io.c +1 -0
@@ -368,6 +368,7 @@ void __init omap5_map_io(void)void __init dra7xx_map_io (void ) {iotable_init (dra7xx_io_desc,ARRAY_SIZE (dra7xx_io_desc)); +omap_barriers_init (); }#endif /*
Greg Kroah-Hartman
maintainerPATCH 12/200 ARM: OMAP2+: hwmod: Fix updating of sysconfig register
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lokesh Vutla <[email protected]>
commit 3ca4a238106dedc285193ee47f494a6584b6fd2f upstream.
Commit 127500ccb766f ("ARM: OMAP2+: Only write the sysconfig on idle when necessary") talks about verification of sysconfig cache value before updating it, only during idle path. But the patch is adding the verification in the enable path. So, adding the check in a proper place as per the commit description.
Not keeping this check during enable path as there is a chance of losing context and it is safe to do on idle as the context of the register will never be lost while the device is active.
[[email protected]: appears to have been caused by my own mismerge of the
originally posted patch]
--- arch/arm/mach-omap2/omap_hwmod.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/mach-omap2/omap_hwmod.c +4 -4
@@ -1416,9 +1416,7 @@ static void _enable_sysc(struct omap_hwm (sf & SYSC_HAS_CLOCKACTIVITY))_set_clockactivity (oh, oh->class->sysc->clockact, &v); -/* If the cached value is the same as the new value, skip the write */ -if (oh->_sysc_cache != v) -_write_sysconfig (v, oh); +_write_sysconfig (v, oh);/* * Set the autoidle bit only after setting the smartidle bit
@@ -1481,7 +1479,9 @@ static void _idle_sysc(struct omap_hwmod_set_master_standbymode (oh, idlemode, &v); } -_write_sysconfig (v, oh); +/* If the cached value is the same as the new value, skip the write */ +if (oh->_sysc_cache != v) +_write_sysconfig (v, oh); }/**
Greg Kroah-Hartman
maintainerPATCH 13/200 assoc_array: dont call compare_object() on a node
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Marchand <[email protected]>
commit 8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2 upstream.
Changes since V1: fixed the description and added KASan warning.
In assoc_array_insert_into_terminal_node(), we call the compare_object() method on all non-empty slots, even when they're not leaves, passing a pointer to an unexpected structure to compare_object(). Currently it causes an out-of-bound read access in keyring_compare_object detected by KASan (see below). The issue is easily reproduced with keyutils testsuite.
Only call compare_object() when the slot is a leave.
KASan warning:
==================================================================
BUG: KASAN: slab-out-of-bounds in keyring_compare_object+0x213/0x240 at addr ffff880060a6f838 Read of size 8 by task keyctl/1655 =============================================================================
BUG kmalloc-192 (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in assoc_array_insert+0xfd0/0x3a60 age=69 cpu=1 pid=1647
___slab_alloc+0x563/0x5c0 __slab_alloc+0x51/0x90 kmem_cache_alloc_trace+0x263/0x300 assoc_array_insert+0xfd0/0x3a60 __key_link_begin+0xfc/0x270 key_create_or_update+0x459/0xaf0 SyS_add_key+0x1ba/0x350 entry_SYSCALL_64_fastpath+0x12/0x76
INFO: Slab 0xffffea0001829b80 objects=16 used=8 fp=0xffff880060a6f550 flags=0x3fff8000004080
INFO: Object 0xffff880060a6f740 @offset=5952 fp=0xffff880060a6e5d1
Bytes b4 ffff880060a6f730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f740: d1 e5 a6 60 00 88 ff ff 0e 00 00 00 00 00 00 00 ............... Object ffff880060a6f750: 02 cf 8e 60 00 88 ff ff 02 c0 8e 60 00 88 ff ff ..........`.... Object ffff880060a6f760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7d0: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
CPU: 0 PID: 1655 Comm: keyctl Tainted: G B 4.5.0-rc4-kasan+ #291
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
0000000000000000 000000001b2800b4 ffff880060a179e0 ffffffff81b60491
ffff88006c802900 ffff880060a6f740 ffff880060a17a10 ffffffff815e2969
ffff88006c802900 ffffea0001829b80 ffff880060a6f740 ffff880060a6e650
Call Trace:
[<ffffffff81b60491>] dump_stack+0x85/0xc4
[<ffffffff815e2969>] print_trailer+0xf9/0x150
[<ffffffff815e9454>] object_err+0x34/0x40
[<ffffffff815ebe50>] kasan_report_error+0x230/0x550
[<ffffffff819949be>] ? keyring_get_key_chunk+0x13e/0x210
[<ffffffff815ec62d>] __asan_report_load_n_noabort+0x5d/0x70
[<ffffffff81994cc3>] ? keyring_compare_object+0x213/0x240
[<ffffffff81994cc3>] keyring_compare_object+0x213/0x240
[<ffffffff81bc238c>] assoc_array_insert+0x86c/0x3a60
[<ffffffff81bc1b20>] ? assoc_array_cancel_edit+0x70/0x70
[<ffffffff8199797d>] ? __key_link_begin+0x20d/0x270
[<ffffffff8199786c>] __key_link_begin+0xfc/0x270
[<ffffffff81993389>] key_create_or_update+0x459/0xaf0
[<ffffffff8128ce0d>] ? trace_hardirqs_on+0xd/0x10
[<ffffffff81992f30>] ? key_type_lookup+0xc0/0xc0
[<ffffffff8199e19d>] ? lookup_user_key+0x13d/0xcd0
[<ffffffff81534763>] ? memdup_user+0x53/0x80
[<ffffffff819983ea>] SyS_add_key+0x1ba/0x350
[<ffffffff81998230>] ? key_get_type_from_user.constprop.6+0xa0/0xa0
[<ffffffff828bcf4e>] ? retint_user+0x18/0x23
[<ffffffff8128cc7e>] ? trace_hardirqs_on_caller+0x3fe/0x580
[<ffffffff81004017>] ? trace_hardirqs_on_thunk+0x17/0x19
[<ffffffff828bc432>] entry_SYSCALL_64_fastpath+0x12/0x76
Memory state around the buggy address:
ffff880060a6f700: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
>ffff880060a6f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff880060a6f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff880060a6f900: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00
==================================================================--- lib/assoc_array.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
lib/assoc_array.c +3 -1
@@ -524,7 +524,9 @@ static bool assoc_array_insert_into_term free_slot = i;continue ; } -if (ops->compare_object (assoc_array_ptr_to_leaf (ptr), index_key)) { +if (assoc_array_ptr_is_leaf (ptr) && + ops->compare_object (assoc_array_ptr_to_leaf (ptr), + index_key)) {pr_devel ("replace in slot %d\n" , i); edit->leaf_p = &node->slots[i]; edit->dead_leaf = node->slots[i];
Greg Kroah-Hartman
maintainerPATCH 14/200 usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafal Redzimski <[email protected]>
commit 0d46faca6f887a849efb07c1655b5a9f7c288b45 upstream.
Broxton B0 also requires XHCI_PME_STUCK_QUIRK. Adding PCI device ID for Broxton B and adding to quirk.
--- drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +3 -1
@@ -48,6 +48,7 @@#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8 +#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8static const char hcd_name[] ="xhci_hcd" ;
@@ -155,7 +156,8 @@ static void xhci_pci_quirks(struct devic (pdev->device ==PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI)) { + pdev->device ==PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI)) { xhci->quirks |= XHCI_PME_STUCK_QUIRK; } if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
Greg Kroah-Hartman
maintainerPATCH 15/200 xhci: resume USB 3 roothub first
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 671ffdff5b13314b1fc65d62cf7604b873fb5dc4 upstream.
Give USB3 devices a better chance to enumerate at USB 3 speeds if they are connected to a suspended host.
Solves an issue with NEC uPD720200 host hanging when partially enumerating a USB3 device as USB2 after host controller runtime resume.
--- drivers/usb/host/xhci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/host/xhci.c +3 -3
@@ -1108,8 +1108,8 @@ int xhci_resume(struct xhci_hcd *xhci, b/* Resume root hubs only when have pending events. */ status =readl (&xhci->op_regs->status);if (status &STS_EINT ) { -usb_hcd_resume_root_hub (hcd);usb_hcd_resume_root_hub (xhci->shared_hcd); +usb_hcd_resume_root_hub (hcd); } }
@@ -1124,10 +1124,10 @@ int xhci_resume(struct xhci_hcd *xhci, b/* Re-enable port polling. */ xhci_dbg (xhci,"%s: starting port polling.\n" , __func__); -set_bit (HCD_FLAG_POLL_RH , &hcd->flags); -usb_hcd_poll_rh_status (hcd);set_bit (HCD_FLAG_POLL_RH , &xhci->shared_hcd->flags);usb_hcd_poll_rh_status (xhci->shared_hcd); +set_bit (HCD_FLAG_POLL_RH , &hcd->flags); +usb_hcd_poll_rh_status (hcd);return retval; }
Greg Kroah-Hartman
maintainerPATCH 16/200 usb: host: xhci: add a new quirk XHCI_NO_64BIT_SUPPORT
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 0a380be8233dbf8dd20795b801c5d5d5ef3992f7 upstream.
On some xHCI controllers (e.g. R-Car SoCs), the AC64 bit (bit 0) of HCCPARAMS1 is set to 1. However, the xHCs don't support 64-bit address memory pointers actually. So, in this case, this driver should call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in xhci_gen_setup(). Otherwise, the xHCI controller will be died after a usb device is connected if it runs on above 4GB physical memory environment.
So, this patch adds a new quirk XHCI_NO_64BIT_SUPPORT to resolve such an issue.
--- drivers/usb/host/xhci.c | 10 ++++++++++ drivers/usb/host/xhci.h | 1 + 2 files changed, 11 insertions(+)
drivers/usb/host/xhci.c +10 -0
@@ -4944,6 +4944,16 @@ int xhci_gen_setup(struct usb_hcd *hcd,return retval;xhci_dbg (xhci,"Reset complete\n" ); +/* +* On some xHCI controllers (e.g. R-Car SoCs), the AC64 bit (bit 0) +* of HCCPARAMS1 is set to 1. However, the xHCs don't support 64-bit +* address memory pointers actually. So, this driver clears the AC64 +* bit of xhci->hcc_params to call dma_set_coherent_mask(dev, +* DMA_BIT_MASK(32)) in this xhci_gen_setup(). +*/ +if (xhci->quirks &XHCI_NO_64BIT_SUPPORT ) + xhci->hcc_params &= ~BIT (0 ); +/* Set dma_mask and coherent_dma_mask to 64-bits, * if xHC supports 64-bit addressing */ if (HCC_64BIT_ADDR(xhci->hcc_params) &&
drivers/usb/host/xhci.h +1 -0
@@ -1632,6 +1632,7 @@ struct xhci_hcd {#define XHCI_PME_STUCK_QUIRK (1 << 20)#define XHCI_MTK_HOST (1 << 21)#define XHCI_SSIC_PORT_UNUSED (1 << 22) +#define XHCI_NO_64BIT_SUPPORT (1 << 23)unsigned int num_active_eps;unsigned int limit_active_eps;/* There are two roothubs to keep track of bus suspend info for */
Greg Kroah-Hartman
maintainerPATCH 17/200 usb: host: xhci-plat: fix cannot work if R-Car Gen2/3 run on above 4GB phys
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 5ad3b03e4910f9f62342956ecdc758c7af6b8699 upstream.
This patch fixes an issue that cannot work if R-Car Gen2/3 run on above 4GB physical memory environment to use a quirk XHCI_NO_64BIT_SUPPORT.
--- drivers/usb/host/xhci-plat.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/usb/host/xhci-plat.c +13 -0
@@ -39,12 +39,25 @@ static const struct xhci_driver_overridestatic void xhci_plat_quirks (struct device *dev,struct xhci_hcd *xhci) { +struct usb_hcd *hcd =xhci_to_hcd (xhci); +/* * As of now platform drivers don't provide MSI support so we ensure * here that the generic code does not try to make a pci_dev from our * dev struct in order to setup MSI */ xhci->quirks |=XHCI_PLAT ; + +/* +* On R-Car Gen2 and Gen3, the AC64 bit (bit 0) of HCCPARAMS1 is set +* to 1. However, these SoCs don't support 64-bit address memory +* pointers. So, this driver clears the AC64 bit of xhci->hcc_params +* to call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in +* xhci_gen_setup(). +*/ +if (xhci_plat_type_is (hcd,XHCI_PLAT_TYPE_RENESAS_RCAR_GEN2 ) || +xhci_plat_type_is (hcd,XHCI_PLAT_TYPE_RENESAS_RCAR_GEN3 )) + xhci->quirks |=XHCI_NO_64BIT_SUPPORT ; }/* called during probe() after chip reset completes */
Greg Kroah-Hartman
maintainerPATCH 18/200 usb: xhci: fix wild pointers in xhci_mem_cleanup
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit 71504062a7c34838c3fccd92c447f399d3cb5797 upstream.
This patch fixes some wild pointers produced by xhci_mem_cleanup. These wild pointers will cause system crash if xhci_mem_cleanup() is called twice.
--- drivers/usb/host/xhci-mem.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/host/xhci-mem.c +6 -0
@@ -1873,6 +1873,12 @@ no_bw:kfree (xhci->rh_bw);kfree (xhci->ext_caps); + xhci->usb2_ports =NULL ; + xhci->usb3_ports =NULL ; + xhci->port_array =NULL ; + xhci->rh_bw =NULL ; + xhci->ext_caps =NULL ; + xhci->page_size =0 ; xhci->page_shift =0 ; xhci->bus_state[0 ].bus_suspended =0 ;
Greg Kroah-Hartman
maintainerPATCH 19/200 xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 98d74f9ceaefc2b6c4a6440050163a83be0abede upstream.
PCI hotpluggable xhci controllers such as some Alpine Ridge solutions will remove the xhci controller from the PCI bus when the last USB device is disconnected.
Add a flag to indicate that the host is being removed to avoid queueing configure_endpoint commands for the dropped endpoints.
For PCI hotplugged controllers this will prevent 5 second command timeouts For static xhci controllers the configure_endpoint command is not needed in the removal case as everything will be returned, freed, and the controller is reset.
For now the flag is only set for PCI connected host controllers.
--- drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci-ring.c | 3 ++- drivers/usb/host/xhci.c | 8 +++++--- drivers/usb/host/xhci.h | 1 + 4 files changed, 9 insertions(+), 4 deletions(-)
drivers/usb/host/xhci-pci.c +1 -0
@@ -304,6 +304,7 @@ static void xhci_pci_remove(struct pci_dstruct xhci_hcd *xhci; xhci =hcd_to_xhci (pci_get_drvdata (dev)); + xhci->xhc_state |=XHCI_STATE_REMOVING ;if (xhci->shared_hcd) {usb_remove_hcd (xhci->shared_hcd);usb_put_hcd (xhci->shared_hcd);
drivers/usb/host/xhci-ring.c +2 -1
@@ -4014,7 +4014,8 @@ static int queue_command(struct xhci_hcdint reserved_trbs = xhci->cmd_ring_reserved_trbs;int ret; -if (xhci->xhc_state) { +if ((xhci->xhc_state &XHCI_STATE_DYING ) || + (xhci->xhc_state &XHCI_STATE_HALTED )) {xhci_dbg (xhci,"xHCI dying or halted, can't queue_command\n" );return -ESHUTDOWN ; }
drivers/usb/host/xhci.c +5 -3
@@ -147,7 +147,8 @@ static int xhci_start(struct xhci_hcd *x"waited %u microseconds.\n" , XHCI_MAX_HALT_USEC);if (!ret) - xhci->xhc_state &= ~(XHCI_STATE_HALTED |XHCI_STATE_DYING ); +/* clear state flags. Including dying, halted or removing */ + xhci->xhc_state =0 ;return ret; }
@@ -2770,7 +2771,8 @@ int xhci_check_bandwidth(struct usb_hcdif (ret <=0 )return ret; xhci =hcd_to_xhci (hcd); -if (xhci->xhc_state &XHCI_STATE_DYING ) +if ((xhci->xhc_state &XHCI_STATE_DYING ) || + (xhci->xhc_state &XHCI_STATE_REMOVING ))return -ENODEV ;xhci_dbg (xhci,"%s called for udev %p\n" , __func__, udev);
@@ -3817,7 +3819,7 @@ static int xhci_setup_device(struct usb_mutex_lock (&xhci->mutex); -if (xhci->xhc_state)/* dying or halted */ +if (xhci->xhc_state)/* dying, removing or halted */ goto out;if (!udev->slot_id) {
drivers/usb/host/xhci.h +1 -0
@@ -1596,6 +1596,7 @@ struct xhci_hcd {*/ #define XHCI_STATE_DYING (1 << 0)#define XHCI_STATE_HALTED (1 << 1) +#define XHCI_STATE_REMOVING (1 << 2)/* Statistics */ int error_bitmask;unsigned int quirks;
Greg Kroah-Hartman
maintainerPATCH 20/200 usb: host: xhci-plat: Make enum xhci_plat_type start at a non zero value
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Griffin <[email protected]>
commit f9a85f6e61c695daeb427dfc6c1d5a279654207b upstream.
Otherwise generic-xhci and xhci-platform which have no data get wrongly detected as XHCI_PLAT_TYPE_MARVELL_ARMADA by xhci_plat_type_is().
This fixes a regression in v4.5 for STiH407 family SoC's which use the synopsis dwc3 IP, whereby the disable_clk error path gets taken due to wrongly being detected as XHCI_PLAT_TYPE_MARVELL_ARMADA and the hcd never gets added.
I suspect this will also fix other dwc3 DT platforms such as Exynos, although I've only tested on STih410 SoC.
--- drivers/usb/host/xhci-plat.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-plat.h +1 -1
@@ -14,7 +14,7 @@#include "xhci.h" /* for hcd_to_xhci() */ enum xhci_plat_type { -XHCI_PLAT_TYPE_MARVELL_ARMADA , +XHCI_PLAT_TYPE_MARVELL_ARMADA =1 ,XHCI_PLAT_TYPE_RENESAS_RCAR_GEN2 ,XHCI_PLAT_TYPE_RENESAS_RCAR_GEN3 , };
Greg Kroah-Hartman
maintainerPATCH 21/200 usb: hcd: out of bounds access in for_each_companion
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Dobrowolski <[email protected]>
commit e86103a75705c7c530768f4ffaba74cf382910f2 upstream.
On BXT platform Host Controller and Device Controller figure as same PCI device but with different device function. HCD should not pass data to Device Controller but only to Host Controllers. Checking if companion device is Host Controller, otherwise skip.
--- drivers/usb/core/hcd-pci.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/core/hcd-pci.c +9 -0
@@ -74,6 +74,15 @@ static void for_each_companion(struct pcif (companion->bus != pdev->bus ||PCI_SLOT (companion->devfn) != slot)continue ; + +/* +* Companion device should be either UHCI,OHCI or EHCI host +* controller, otherwise skip. +*/ +if (companion->class !=CL_UHCI && companion->class !=CL_OHCI && + companion->class !=CL_EHCI ) +continue ; + companion_hcd =pci_get_drvdata (companion);if (!companion_hcd || !companion_hcd->self.root_hub)continue ;
Greg Kroah-Hartman
maintainerPATCH 22/200 usb: gadget: f_fs: Fix use-after-free
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <[email protected]>
commit 38740a5b87d53ceb89eb2c970150f6e94e00373a upstream.
When using asynchronous read or write operations on the USB endpoints the issuer of the IO request is notified by calling the ki_complete() callback of the submitted kiocb when the URB has been completed.
Calling this ki_complete() callback will free kiocb. Make sure that the structure is no longer accessed beyond that point, otherwise undefined behaviour might occur.
--- drivers/usb/gadget/function/f_fs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/usb/gadget/function/f_fs.c +2 -3
@@ -646,6 +646,7 @@ static void ffs_user_copy_worker(struct work);int ret = io_data->req->status ? io_data->req->status : io_data->req->actual; +bool kiocb_has_eventfd = io_data->kiocb->ki_flags &IOCB_EVENTFD ;if (io_data->read && ret >0 ) {use_mm (io_data->mm);
@@ -657,13 +658,11 @@ static void ffs_user_copy_worker(struct io_data->kiocb->ki_complete (io_data->kiocb, ret, ret); -if (io_data->ffs->ffs_eventfd && - !(io_data->kiocb->ki_flags &IOCB_EVENTFD )) +if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)eventfd_signal (io_data->ffs->ffs_eventfd,1 );usb_ep_free_request (io_data->ep, io_data->req); - io_data->kiocb->private =NULL ;if (io_data->read)kfree (io_data->to_free);kfree (io_data->buf);
Greg Kroah-Hartman
maintainerPATCH 23/200 dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 9567366fefddeaea4ed1d713270535d93a3b3c76 upstream.
The READ_LOCK macro was incorrectly returning -EINVAL if dm_bm_is_read_only() was true -- it will always be true once the cache metadata transitions to read-only by dm_cache_metadata_set_read_only().
Wrap READ_LOCK and WRITE_LOCK multi-statement macros in do {} while(0). Also, all accesses of the 'cmd' argument passed to these related macros are now encapsulated in parenthesis.
A follow-up patch can be developed to eliminate the use of macros in favor of pure C code. Avoiding that now given that this needs to apply to stable@.
--- drivers/md/dm-cache-metadata.c | 64 +++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 24 deletions(-)
drivers/md/dm-cache-metadata.c +40 -24
@@ -867,39 +867,55 @@ static int blocks_are_unmapped_or_clean(return 0 ; } -#define WRITE_LOCK (cmd) \ - down_write(&cmd->root_lock); \ - if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ - up_write(&cmd->root_lock); \ - return -EINVAL; \ +static bool cmd_write_lock (struct dm_cache_metadata *cmd) +{ +down_write (&cmd->root_lock); +if (cmd->fail_io ||dm_bm_is_read_only (cmd->bm)) { +up_write (&cmd->root_lock); +return false; } +return true; +} -#define WRITE_LOCK_VOID (cmd) \ - down_write(&cmd->root_lock); \ - if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ - up_write(&cmd->root_lock); \ - return; \ - } +#define WRITE_LOCK (cmd) \ + do { \ + if (!cmd_write_lock((cmd))) \ + return -EINVAL; \ + } while(0) + +#define WRITE_LOCK_VOID (cmd) \ + do { \ + if (!cmd_write_lock((cmd))) \ + return; \ + } while(0)#define WRITE_UNLOCK (cmd) \ - up_write(&cmd->root_lock) + up_write(&(cmd)->root_lock) -#define READ_LOCK (cmd) \ - down_read(&cmd->root_lock); \ - if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ - up_read(&cmd->root_lock); \ - return -EINVAL; \ +static bool cmd_read_lock (struct dm_cache_metadata *cmd) +{ +down_write (&cmd->root_lock); +if (cmd->fail_io) { +up_write (&cmd->root_lock); +return false; } +return true; +} -#define READ_LOCK_VOID (cmd) \ - down_read(&cmd->root_lock); \ - if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ - up_read(&cmd->root_lock); \ - return; \ - } +#define READ_LOCK (cmd) \ + do { \ + if (!cmd_read_lock((cmd))) \ + return -EINVAL; \ + } while(0) + +#define READ_LOCK_VOID (cmd) \ + do { \ + if (!cmd_read_lock((cmd))) \ + return; \ + } while(0)#define READ_UNLOCK (cmd) \ - up_read(&cmd->root_lock) + up_read(&(cmd)->root_lock)int dm_cache_resize (struct dm_cache_metadata *cmd,dm_cblock_t new_cache_size) {
Greg Kroah-Hartman
maintainerPATCH 24/200 dm cache metadata: fix cmd_read_lock() acquiring write lock
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed Samy <[email protected]>
commit 6545b60baaf880b0cd29a5e89dbe745a06027e89 upstream.
Commit 9567366fefdd ("dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros") uses down_write() instead of down_read() in cmd_read_lock(), yet up_read() is used to release the lock in READ_UNLOCK(). Fix it.
--- drivers/md/dm-cache-metadata.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-cache-metadata.c +2 -2
@@ -894,9 +894,9 @@ static bool cmd_write_lock(struct dm_cacstatic bool cmd_read_lock (struct dm_cache_metadata *cmd) { -down_write (&cmd->root_lock); +down_read (&cmd->root_lock);if (cmd->fail_io) { -up_write (&cmd->root_lock); +up_read (&cmd->root_lock);return false; }return true;
Greg Kroah-Hartman
maintainerPATCH 25/200 lib: lz4: fixed zram with lz4 on big endian machines
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui Salvaterra <[email protected]>
commit 3e26a691fe3fe1e02a76e5bab0c143ace4b137b4 upstream.
Based on Sergey's test patch [1], this fixes zram with lz4 compression on big endian cpus.
Note that the 64-bit preprocessor test is not a cleanup, it's part of the fix, since those identifiers are bogus (for example, __ppc64__ isn't defined anywhere else in the kernel, which means we'd fall into the 32-bit definitions on ppc64).
Tested on ppc64 with no regression on x86_64.
[1] http://marc.info/?l=linux-kernel&m=145994470805853&w=4
--- lib/lz4/lz4defs.h | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
lib/lz4/lz4defs.h +12 -9
@@ -11,8 +11,7 @@/* * Detects 64 bits mode */ -#if (defined(__x86_64__) || defined(__x86_64) || defined(__amd64__) \ - || defined(__ppc64__) || defined(__LP64__)) +#if defined(CONFIG_64BIT )#define LZ4_ARCH64 1#else #define LZ4_ARCH64 0
@@ -35,6 +34,10 @@ typedef struct _U64_S { u64 v; } U64_S;#define PUT4 (s, d) (A32(d) = A32(s))#define PUT8 (s, d) (A64(d) = A64(s)) + +#define LZ4_READ_LITTLEENDIAN_16 (d, s, p) \ + (d = s - A16(p)) +#define LZ4_WRITE_LITTLEENDIAN_16 (p, v) \ do { \ A16(p) = v; \
@@ -51,10 +54,13 @@ typedef struct _U64_S { u64 v; } U64_S;#define PUT8 (s, d) \ put_unaligned(get_unaligned((const u64 *) s), (u64 *) d) -#define LZ4_WRITE_LITTLEENDIAN_16 (p, v) \ - do { \ - put_unaligned(v, (u16 *)(p)); \ - p += 2; \ +#define LZ4_READ_LITTLEENDIAN_16 (d, s, p) \ + (d = s - get_unaligned_le16(p)) + +#define LZ4_WRITE_LITTLEENDIAN_16 (p, v) \ + do { \ + put_unaligned_le16(v, (u16 *)(p)); \ + p += 2; \ } while (0)#endif
@@ -140,9 +146,6 @@ typedef struct _U64_S { u64 v; } U64_S;#endif -#define LZ4_READ_LITTLEENDIAN_16 (d, s, p) \ - (d = s - get_unaligned_le16(p)) -#define LZ4_WILDCOPY (s, d, e) \ do { \ LZ4_COPYPACKET(s, d); \
Greg Kroah-Hartman
maintainerPATCH 26/200 debugfs: Make automount point inodes permanently empty
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <[email protected]>
commit 87243deb88671f70def4c52dfa7ca7830707bd31 upstream.
Starting with 4.1 the tracing subsystem has its own filesystem which is automounted in the tracing subdirectory of debugfs. Prior to this debugfs could be bind mounted in a cloned mount namespace, but if tracefs has been mounted under debugfs this now fails because there is a locked child mount. This creates a regression for container software which bind mounts debugfs to satisfy the assumption of some userspace software.
In other pseudo filesystems such as proc and sysfs we're already creating mountpoints like this in such a way that no dirents can be created in the directories, allowing them to be exceptions to some MNT_LOCKED tests. In fact we're already do this for the tracefs mountpoint in sysfs.
Do the same in debugfs_create_automount(), since the intention here is clearly to create a mountpoint. This fixes the regression, as locked child mounts on permanently empty directories do not cause a bind mount to fail.
--- fs/debugfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/debugfs/inode.c +1 -1
@@ -457,7 +457,7 @@ struct dentry *debugfs_create_automount(if (unlikely (!inode))return failed_creating (dentry); - inode->i_mode =S_IFDIR |S_IRWXU |S_IRUGO |S_IXUGO ; +make_empty_dir_inode (inode); inode->i_flags |=S_AUTOMOUNT ; inode->i_private = data; dentry->d_fsdata = (void *)f;
Greg Kroah-Hartman
maintainerPATCH 27/200 dmaengine: dw: fix master selection
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 3fe6409c23e2bee4b2b1b6d671d2da8daa15271c upstream.
The commit 895005202987 ("dmaengine: dw: apply both HS interfaces and remove slave_id usage") cleaned up the code to avoid usage of depricated slave_id member of generic slave configuration.
Meanwhile it broke the master selection by removing important call to dwc_set_masters() in ->device_alloc_chan_resources() which copied masters from custom slave configuration to the internal channel structure.
Everything works until now since there is no customized connection of DesignWare DMA IP to the bus, i.e. one bus and one or more masters are in use. The configurations where 2 masters are connected to the different masters are not working anymore. We are expecting one user of such configuration and need to select masters properly. Besides that it is obviously a performance regression since only one master is in use in multi-master configuration.
Select masters in accordance with what user asked for. Keep this patch in a form more suitable for back porting.
We are safe to take necessary data in ->device_alloc_chan_resources() because we don't support generic slave configuration embedded into custom one, and thus the only way to provide such is to use the parameter to a filter function which is called exactly before channel resource allocation.
While here, replase BUG_ON to less noisy dev_warn() and prevent channel allocation in case of error.
--- drivers/dma/dw/core.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-)
drivers/dma/dw/core.c +19 -15
@@ -130,26 +130,14 @@ static void dwc_desc_put(struct dw_dma_cstatic void dwc_initialize (struct dw_dma_chan *dwc) {struct dw_dma *dw =to_dw_dma (dwc->chan.device); -struct dw_dma_slave *dws = dwc->chan.private;u32 cfghi =DWC_CFGH_FIFO_MODE ;u32 cfglo =DWC_CFGL_CH_PRIOR (dwc->priority);if (dwc->initialized == true)return ; -if (dws) { -/* -* We need controller-specific data to set up slave -* transfers. -*/ -BUG_ON (!dws->dma_dev || dws->dma_dev != dw->dma.dev); - - cfghi |=DWC_CFGH_DST_PER (dws->dst_id); - cfghi |=DWC_CFGH_SRC_PER (dws->src_id); - }else { - cfghi |=DWC_CFGH_DST_PER (dwc->dst_id); - cfghi |=DWC_CFGH_SRC_PER (dwc->src_id); - } + cfghi |=DWC_CFGH_DST_PER (dwc->dst_id); + cfghi |=DWC_CFGH_SRC_PER (dwc->src_id);channel_writel (dwc,CFG_LO , cfglo);channel_writel (dwc,CFG_HI , cfghi);
@@ -941,7 +929,7 @@ bool dw_dma_filter(struct dma_chan *chanstruct dw_dma_chan *dwc =to_dw_dma_chan (chan);struct dw_dma_slave *dws = param; -if (!dws || dws->dma_dev != chan->device->dev) +if (dws->dma_dev != chan->device->dev)return false;/* We have to copy data since dws can be temporary storage */
@@ -1165,6 +1153,14 @@ static int dwc_alloc_chan_resources(stru* doesn't mean what you think it means), and status writeback. */ +/* +* We need controller-specific data to set up slave transfers. +*/ +if (chan->private && !dw_dma_filter (chan, chan->private)) { +dev_warn (chan2dev (chan),"Wrong controller-specific data\n" ); +return -EINVAL ; + } +/* Enable controller here if needed */ if (!dw->in_use)dw_dma_on (dw);
@@ -1226,6 +1222,14 @@ static void dwc_free_chan_resources(struspin_lock_irqsave (&dwc->lock, flags);list_splice_init (&dwc->free_list, &list); dwc->descs_allocated =0 ; + +/* Clear custom channel configuration */ + dwc->src_id =0 ; + dwc->dst_id =0 ; + + dwc->src_master =0 ; + dwc->dst_master =0 ; + dwc->initialized = false;/* Disable interrupts */
Greg Kroah-Hartman
maintainerPATCH 28/200 dmaengine: hsu: correct use of channel status register
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 4f4bc0abff79dc9d7ccbd3143adbf8ad1f4fe6ab upstream.
There is a typo in documentation regarding to descriptor empty bit (DESCE) which is set to 1 when descriptor is empty. Thus, status register at the end of a transfer usually returns all DESCE bits set and thus it will never be zero.
Moreover, there are 2 bits (CDESC) that encode current descriptor, on which interrupt has been asserted. In case when we have few descriptors programmed we might have non-zero value.
Remove DESCE and CDESC bits from DMA channel status register (HSU_CH_SR) when reading it.
--- drivers/dma/hsu/hsu.c | 2 +- drivers/dma/hsu/hsu.h | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/dma/hsu/hsu.c +1 -1
@@ -135,7 +135,7 @@ static u32 hsu_dma_chan_get_sr(struct hs sr =hsu_chan_readl (hsuc,HSU_CH_SR );spin_unlock_irqrestore (&hsuc->vchan.lock, flags); -return sr; +return sr & ~(HSU_CH_SR_DESCE_ANY |HSU_CH_SR_CDESC_ANY ); }irqreturn_t hsu_dma_irq (struct hsu_dma_chip *chip,unsigned short nr)
drivers/dma/hsu/hsu.h +3 -0
@@ -41,6 +41,9 @@#define HSU_CH_SR_DESCTO (x) BIT(8 + (x))#define HSU_CH_SR_DESCTO_ANY (BIT(11) | BIT(10) | BIT(9) | BIT(8))#define HSU_CH_SR_CHE BIT(15) +#define HSU_CH_SR_DESCE (x) BIT(16 + (x)) +#define HSU_CH_SR_DESCE_ANY (BIT(19) | BIT(18) | BIT(17) | BIT(16)) +#define HSU_CH_SR_CDESC_ANY (BIT(31) | BIT(30))/* Bits in HSU_CH_CR */ #define HSU_CH_CR_CHA BIT(0)
Greg Kroah-Hartman
maintainerPATCH 29/200 dmaengine: hsu: correct residue calculation of active descriptor
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit a197f3c7d48c0c1f45076ea47533a76ba9b1a959 upstream.
The commit f0579c8ceaf1 ("dmaengine: hsu: speed up residue calculation") speeded up calculation of the queued descriptor but broke the initial residue value for active descriptor.
In accordance with documentation the hardware descriptor is updated each time DMA transfered some bytes. It means we have to calculate a sum of lengths of non-submitted hardware descriptors and whatever current values in the hardware. Do this straightforward.
--- drivers/dma/hsu/hsu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/dma/hsu/hsu.c +5 -2
@@ -254,10 +254,13 @@ static void hsu_dma_issue_pending(structstatic size_t hsu_dma_active_desc_size (struct hsu_dma_chan *hsuc) {struct hsu_dma_desc *desc = hsuc->desc; -size_t bytes = desc->length; +size_t bytes =0 ;int i; - i = desc->active %HSU_DMA_CHAN_NR_DESC ; +for (i = desc->active; i < desc->nents; i++) + bytes += desc->sg[i].len; + + i =HSU_DMA_CHAN_NR_DESC -1 ;do { bytes +=hsu_chan_readl (hsuc,HSU_CH_DxTSR (i)); }while (--i >=0 );
Greg Kroah-Hartman
maintainerPATCH 30/200 dmaengine: omap-dma: Fix polled channel completion detection and handling
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit 689d3c5ecc9e2eac714d32ca152b72988bc2a67b upstream.
When based on the CCR_ENABLE bit the channel is stopped we should not call omap_dma_callback(), only change the return value to DMA_COMPLETE. Client drivers will do the right thing to clean up the channel after the transfer has been completed.
Check the CCR_ENABLE only if the channel is running and not paused since pause in sDMA means that the channel is stopped.
This will fix one hard to reproduce race condition when the channel is terminated during transfer (affecting cyclic operation).
--- drivers/dma/omap-dma.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
drivers/dma/omap-dma.c +16 -6
@@ -48,6 +48,7 @@ struct omap_chan {unsigned dma_sig;bool cyclic;bool paused; +bool running;int dma_ch;struct omap_desc *desc;
@@ -294,6 +295,8 @@ static void omap_dma_start(struct omap_c/* Enable channel */ omap_dma_chan_write (c,CCR , d->ccr |CCR_ENABLE ); + + c->running = true; }static void omap_dma_stop (struct omap_chan *c)
@@ -355,6 +358,8 @@ static void omap_dma_stop(struct omap_chomap_dma_chan_write (c,CLNK_CTRL , val); } + + c->running = false; } static void omap_dma_start_sg(struct omap_chan *c, struct omap_desc *d,
@@ -673,15 +678,20 @@ static enum dma_status omap_dma_tx_statustruct omap_chan *c =to_omap_dma_chan (chan);struct virt_dma_desc *vd;enum dma_status ret; -uint32_t ccr;unsigned long flags; - ccr =omap_dma_chan_read (c,CCR ); -/* The channel is no longer active, handle the completion right away */ -if (!(ccr &CCR_ENABLE )) -omap_dma_callback (c->dma_ch,0 , c); - ret =dma_cookie_status (chan, cookie, txstate); + +if (!c->paused && c->running) { +uint32_t ccr =omap_dma_chan_read (c,CCR ); +/* +* The channel is no longer active, set the return value +* accordingly +*/ +if (!(ccr &CCR_ENABLE )) + ret =DMA_COMPLETE ; + } +if (ret ==DMA_COMPLETE || !txstate)return ret;
Greg Kroah-Hartman
maintainerPATCH 31/200 dmaengine: edma: Remove dynamic TPTC power management feature
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit 23f49fd2ea9bc8e1c8cff0126cd71b071ea9e91f upstream.
The dynamic or on demand pm_runtime does not work correctly on am335x and am437x due to interference with hwmod.
Fall back using the pm_runtime usage as it was in the old driver stack, meaning that at probe time call pm_runtime_enable() and pm_runtime_get_sync() for the TPTCs as well.
--- drivers/dma/edma.c | 38 +++----------------------------------- 1 file changed, 3 insertions(+), 35 deletions(-)
drivers/dma/edma.c +3 -35
@@ -1563,32 +1563,6 @@ static irqreturn_t dma_ccerr_handler(intreturn IRQ_HANDLED ; } -static void edma_tc_set_pm_state (struct edma_tc *tc,bool enable) -{ -struct platform_device *tc_pdev; -int ret; - -if (!IS_ENABLED (CONFIG_OF ) || !tc) -return ; - - tc_pdev =of_find_device_by_node (tc->node); -if (!tc_pdev) { -pr_err ("%s: TPTC device is not found\n" , __func__); -return ; - } -if (!pm_runtime_enabled (&tc_pdev->dev)) -pm_runtime_enable (&tc_pdev->dev); - -if (enable) - ret =pm_runtime_get_sync (&tc_pdev->dev); -else - ret =pm_runtime_put_sync (&tc_pdev->dev); - -if (ret <0 ) -pr_err ("%s: pm_runtime_%s_sync() failed for %s\n" , __func__, - enable ?"get" :"put" ,dev_name (&tc_pdev->dev)); -} -/* Alloc channel resources */ static int edma_alloc_chan_resources (struct dma_chan *chan) {
@@ -1625,8 +1599,6 @@ static int edma_alloc_chan_resources(strEDMA_CHAN_SLOT (echan->ch_num), chan->chan_id, echan->hw_triggered ? "HW" : "SW"); -edma_tc_set_pm_state (echan->tc, true); -return 0 ; err_slot:
@@ -1663,7 +1635,6 @@ static void edma_free_chan_resources(str echan->alloced = false; } -edma_tc_set_pm_state (echan->tc, false); echan->tc =NULL ; echan->hw_triggered = false;
@@ -2408,10 +2379,8 @@ static int edma_pm_suspend(struct deviceint i;for (i =0 ; i < ecc->num_channels; i++) { -if (echan[i].alloced) { +if (echan[i].alloced)edma_setup_interrupt (&echan[i], false); -edma_tc_set_pm_state (echan[i].tc, false); - } }return 0 ;
@@ -2441,8 +2410,6 @@ static int edma_pm_resume(struct device/* Set up channel -> slot mapping for the entry slot */ edma_set_chmap (&echan[i], echan[i].slot[0 ]); - -edma_tc_set_pm_state (echan[i].tc, true); } }
@@ -2466,7 +2433,8 @@ static struct platform_driver edma_drivestatic int edma_tptc_probe (struct platform_device *pdev) { -return 0 ; +pm_runtime_enable (&pdev->dev); +return pm_runtime_get_sync (&pdev->dev); }static struct platform_driver edma_tptc_driver = {
Greg Kroah-Hartman
maintainerPATCH 32/200 dmaengine: pxa_dma: fix the maximum requestor line
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Jarzmik <[email protected]>
commit 6bab1c6afdca0371cfa957079b36b78d12dd2cf5 upstream.
The current number of requestor lines is limited to 31. This was an error of a previous commit, as this number is platform dependent, and is actually :
- for pxa25x: 40 requestor lines
- for pxa27x: 75 requestor lines
- for pxa3xx: 100 requestor lines
The previous testing did not reveal the faulty constant as on pxa[23]xx platforms, only camera, MSL and USB are above requestor 32, and in these only the camera has a driver using dma.
--- drivers/dma/pxa_dma.c | 39 ++++++++++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 11 deletions(-)
drivers/dma/pxa_dma.c +28 -11
@@ -122,6 +122,7 @@ struct pxad_chan {struct pxad_device {struct dma_device slave;int nr_chans; +int nr_requestors;void __iomem *base;struct pxad_phy *phys;spinlock_t phy_lock;/* Phy association */
@@ -473,7 +474,7 @@ static void pxad_free_phy(struct pxad_chreturn ;/* clear the channel mapping in DRCMR */ -if (chan->drcmr <=DRCMR_CHLNUM ) { +if (chan->drcmr <= pdev->nr_requestors) { reg =pxad_drcmr (chan->drcmr);writel_relaxed (0 , chan->phy->base + reg); }
@@ -509,6 +510,7 @@ static bool is_running_chan_misaligned(sstatic void phy_enable (struct pxad_phy *phy,bool misaligned) { +struct pxad_device *pdev;u32 reg, dalgn;if (!phy->vchan)
@@ -518,7 +520,8 @@ static void phy_enable(struct pxad_phy *"%s(); phy=%p(%d) misaligned=%d\n" , __func__, phy, phy->idx, misaligned); -if (phy->vchan->drcmr <=DRCMR_CHLNUM ) { + pdev =to_pxad_dev (phy->vchan->vc.chan.device); +if (phy->vchan->drcmr <= pdev->nr_requestors) { reg =pxad_drcmr (phy->vchan->drcmr);writel_relaxed (DRCMR_MAPVLD | phy->idx, phy->base + reg); }
@@ -914,6 +917,7 @@ static void pxad_get_config(struct pxad_ {u32 maxburst =0 , dev_addr =0 ;enum dma_slave_buswidth width =DMA_SLAVE_BUSWIDTH_UNDEFINED ; +struct pxad_device *pdev =to_pxad_dev (chan->vc.chan.device); *dcmd =0 ;if (dir ==DMA_DEV_TO_MEM ) {
@@ -922,7 +926,7 @@ static void pxad_get_config(struct pxad_ dev_addr = chan->cfg.src_addr; *dev_src = dev_addr; *dcmd |=PXA_DCMD_INCTRGADDR ; -if (chan->drcmr <=DRCMR_CHLNUM ) +if (chan->drcmr <= pdev->nr_requestors) *dcmd |=PXA_DCMD_FLOWSRC ; }if (dir ==DMA_MEM_TO_DEV ) {
@@ -931,7 +935,7 @@ static void pxad_get_config(struct pxad_ dev_addr = chan->cfg.dst_addr; *dev_dst = dev_addr; *dcmd |=PXA_DCMD_INCSRCADDR ; -if (chan->drcmr <=DRCMR_CHLNUM ) +if (chan->drcmr <= pdev->nr_requestors) *dcmd |=PXA_DCMD_FLOWTRG ; }if (dir ==DMA_MEM_TO_MEM )
@@ -1341,13 +1345,15 @@ static struct dma_chan *pxad_dma_xlate(sstatic int pxad_init_dmadev (struct platform_device *op,struct pxad_device *pdev, -unsigned int nr_phy_chans) +unsigned int nr_phy_chans, +unsigned int nr_requestors) {int ret;unsigned int i;struct pxad_chan *c; pdev->nr_chans = nr_phy_chans; + pdev->nr_requestors = nr_requestors;INIT_LIST_HEAD (&pdev->slave.channels); pdev->slave.device_alloc_chan_resources = pxad_alloc_chan_resources; pdev->slave.device_free_chan_resources = pxad_free_chan_resources;
@@ -1382,7 +1388,7 @@ static int pxad_probe(struct platform_deconst struct of_device_id *of_id;struct mmp_dma_platdata *pdata =dev_get_platdata (&op->dev);struct resource *iores; -int ret, dma_channels =0 ; +int ret, dma_channels =0 , nb_requestors =0 ;const enum dma_slave_buswidth widths =DMA_SLAVE_BUSWIDTH_1_BYTE |DMA_SLAVE_BUSWIDTH_2_BYTES |DMA_SLAVE_BUSWIDTH_4_BYTES ;
@@ -1399,13 +1405,23 @@ static int pxad_probe(struct platform_dereturn PTR_ERR (pdev->base); of_id =of_match_device (pxad_dt_ids, &op->dev); -if (of_id) +if (of_id) {of_property_read_u32 (op->dev.of_node,"#dma-channels" , &dma_channels); -else if (pdata && pdata->dma_channels) + ret =of_property_read_u32 (op->dev.of_node,"#dma-requests" , + &nb_requestors); +if (ret) { +dev_warn (pdev->slave.dev, +"#dma-requests set to default 32 as missing in OF: %d" , + ret); + nb_requestors =32 ; + }; + }else if (pdata && pdata->dma_channels) { dma_channels = pdata->dma_channels; -else + nb_requestors = pdata->nb_requestors; + }else { dma_channels =32 ;/* default 32 channel */ + }dma_cap_set (DMA_SLAVE , pdev->slave.cap_mask);dma_cap_set (DMA_MEMCPY , pdev->slave.cap_mask);
@@ -1423,7 +1439,7 @@ static int pxad_probe(struct platform_de pdev->slave.descriptor_reuse = true; pdev->slave.dev = &op->dev; - ret =pxad_init_dmadev (op, pdev, dma_channels); + ret =pxad_init_dmadev (op, pdev, dma_channels, nb_requestors);if (ret) {dev_err (pdev->slave.dev,"unable to register\n" );return ret;
@@ -1442,7 +1458,8 @@ static int pxad_probe(struct platform_deplatform_set_drvdata (op, pdev);pxad_init_debugfs (pdev); -dev_info (pdev->slave.dev,"initialized %d channels\n" , dma_channels); +dev_info (pdev->slave.dev,"initialized %d channels on %d requestors\n" , + dma_channels, nb_requestors);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 33/200 mtd: nand: pxa3xx_nand: fix dmaengine initialization
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Jarzmik <[email protected]>
commit 9097103f06332d099c5ab06d1e7f22f4bcaca6e2 upstream.
When the driver is initialized in a pure device-tree platform, the driver's probe fails allocating the dma channel :
[ 525.624435] pxa3xx-nand 43100000.nand: no resource defined for data DMA [ 525.632088] pxa3xx-nand 43100000.nand: alloc nand resource failed
The reason is that the DMA IO resource is not acquired through platform resources but by OF bindings.
Fix this by ensuring that DMA IO resources are only queried in the non device-tree case.
--- drivers/mtd/nand/pxa3xx_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/pxa3xx_nand.c +1 -1
@@ -1738,7 +1738,7 @@ static int alloc_nand_resource(struct plif (ret <0 )return ret; -if (use_dma) { +if (!np && use_dma) { r =platform_get_resource (pdev,IORESOURCE_DMA ,0 );if (r ==NULL ) { dev_err(&pdev->dev,
Greg Kroah-Hartman
maintainerPATCH 34/200 sched/cgroup: Fix/cleanup cgroup teardown/init
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 2f5177f0fd7e531b26d54633be62d1d4cb94621c upstream.
The CPU controller hasn't kept up with the various changes in the whole cgroup initialization / destruction sequence, and commit:
2e91fa7f6d45 ("cgroup: keep zombies associated with their original cgroups")
caused it to explode.
The reason for this is that zombies do not inhibit css_offline() from being called, but do stall css_released(). Now we tear down the cfs_rq structures on css_offline() but zombies can run after that, leading to use-after-free issues.
The solution is to move the tear-down to css_released(), which guarantees nobody (including no zombies) is still using our cgroup.
Furthermore, a few simple cleanups are possible too. There doesn't appear to be any point to us using css_online() (anymore?) so fold that in css_alloc().
And since cgroup code guarantees an RCU grace period between css_released() and css_free() we can forgo using call_rcu() and free the stuff immediately.
--- kernel/sched/core.c | 35 ++++++++++++++--------------------- 1 file changed, 14 insertions(+), 21 deletions(-)
kernel/sched/core.c +14 -21
@@ -7802,7 +7802,7 @@ void set_curr_task(int cpu, struct task_/* task_group_lock serializes the addition/removal of task groups */ static DEFINE_SPINLOCK (task_group_lock); -static void free_sched_group (struct task_group *tg) +static void sched_free_group (struct task_group *tg) {free_fair_sched_group (tg);free_rt_sched_group (tg);
@@ -7828,7 +7828,7 @@ struct task_group *sched_create_group(streturn tg; err: -free_sched_group (tg); +sched_free_group (tg);return ERR_PTR (-ENOMEM ); }
@@ -7848,17 +7848,16 @@ void sched_online_group(struct task_grou }/* rcu callback to free various structures associated with a task group */ -static void free_sched_group_rcu (struct rcu_head *rhp) +static void sched_free_group_rcu (struct rcu_head *rhp) {/* now it should be safe to free those cfs_rqs */ -free_sched_group (container_of(rhp ,struct task_group ,rcu )); +sched_free_group (container_of(rhp ,struct task_group ,rcu )); } -/* Destroy runqueue etc associated with a task group */ void sched_destroy_group (struct task_group *tg) {/* wait for possible concurrent references to cfs_rqs complete */ -call_rcu (&tg->rcu, free_sched_group_rcu); +call_rcu (&tg->rcu, sched_free_group_rcu); }void sched_offline_group (struct task_group *tg)
@@ -8319,31 +8318,26 @@ cpu_cgroup_css_alloc(struct cgroup_subsyif (IS_ERR (tg))return ERR_PTR (-ENOMEM ); +sched_online_group (tg, parent); +return &tg->css; } -static int cpu_cgroup_css_online (struct cgroup_subsys_state *css) +static void cpu_cgroup_css_released (struct cgroup_subsys_state *css) {struct task_group *tg =css_tg (css); -struct task_group *parent =css_tg (css->parent); -if (parent) -sched_online_group (tg, parent); -return 0 ; +sched_offline_group (tg); }static void cpu_cgroup_css_free (struct cgroup_subsys_state *css) {struct task_group *tg =css_tg (css); -sched_destroy_group (tg); -} - -static void cpu_cgroup_css_offline (struct cgroup_subsys_state *css) -{ -struct task_group *tg =css_tg (css); - -sched_offline_group (tg); +/* +* Relies on the RCU grace period between css_released() and this. +*/ +sched_free_group (tg); }static void cpu_cgroup_fork (struct task_struct *task)
@@ -8703,9 +8697,8 @@ static struct cftype cpu_files[] = {struct cgroup_subsys cpu_cgrp_subsys = { .css_alloc = cpu_cgroup_css_alloc, + .css_released = cpu_cgroup_css_released, .css_free = cpu_cgroup_css_free, - .css_online = cpu_cgroup_css_online, - .css_offline = cpu_cgroup_css_offline, .fork = cpu_cgroup_fork, .can_attach = cpu_cgroup_can_attach, .attach = cpu_cgroup_attach,
Greg Kroah-Hartman
maintainerPATCH 35/200 x86/mm/xen: Suppress hugetlbfs in PV guests
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <[email protected]>
commit 103f6112f253017d7062cd74d17f4a514ed4485c upstream.
Huge pages are not normally available to PV guests. Not suppressing hugetlbfs use results in an endless loop of page faults when user mode code tries to access a hugetlbfs mapped area (since the hypervisor denies such PTEs to be created, but error indications can't be propagated out of xen_set_pte_at(), just like for various of its siblings), and - once killed in an oops like this:
kernel BUG at .../fs/hugetlbfs/inode.c:428!
invalid opcode: 0000 [#1] SMP
...
RIP: e030:[<ffffffff811c333b>] [<ffffffff811c333b>] remove_inode_hugepages+0x25b/0x320 ... Call Trace: [<ffffffff811c3415>] hugetlbfs_evict_inode+0x15/0x40 [<ffffffff81167b3d>] evict+0xbd/0x1b0 [<ffffffff8116514a>] __dentry_kill+0x19a/0x1f0 [<ffffffff81165b0e>] dput+0x1fe/0x220 [<ffffffff81150535>] __fput+0x155/0x200 [<ffffffff81079fc0>] task_work_run+0x60/0xa0 [<ffffffff81063510>] do_exit+0x160/0x400 [<ffffffff810637eb>] do_group_exit+0x3b/0xa0 [<ffffffff8106e8bd>] get_signal+0x1ed/0x470 [<ffffffff8100f854>] do_signal+0x14/0x110 [<ffffffff810030e9>] prepare_exit_to_usermode+0xe9/0xf0 [<ffffffff814178a5>] retint_user+0x8/0x13
This is CVE-2016-3961 / XSA-174.
--- arch/x86/include/asm/hugetlb.h | 1 + 1 file changed, 1 insertion(+)
arch/x86/include/asm/hugetlb.h +1 -0
@@ -4,6 +4,7 @@#include <asm/page.h> #include <asm-generic/hugetlb.h> +#define hugepages_supported () cpu_has_pse static inline int is_hugepage_only_range(struct mm_struct *mm, unsigned long addr,
Greg Kroah-Hartman
maintainerPATCH 35/200 x86/mm/xen: Suppress hugetlbfs in PV guests
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <[email protected]>
commit 103f6112f253017d7062cd74d17f4a514ed4485c upstream.
Huge pages are not normally available to PV guests. Not suppressing hugetlbfs use results in an endless loop of page faults when user mode code tries to access a hugetlbfs mapped area (since the hypervisor denies such PTEs to be created, but error indications can't be propagated out of xen_set_pte_at(), just like for various of its siblings), and - once killed in an oops like this:
kernel BUG at .../fs/hugetlbfs/inode.c:428!
invalid opcode: 0000 [#1] SMP
...
RIP: e030:[<ffffffff811c333b>] [<ffffffff811c333b>] remove_inode_hugepages+0x25b/0x320 ... Call Trace: [<ffffffff811c3415>] hugetlbfs_evict_inode+0x15/0x40 [<ffffffff81167b3d>] evict+0xbd/0x1b0 [<ffffffff8116514a>] __dentry_kill+0x19a/0x1f0 [<ffffffff81165b0e>] dput+0x1fe/0x220 [<ffffffff81150535>] __fput+0x155/0x200 [<ffffffff81079fc0>] task_work_run+0x60/0xa0 [<ffffffff81063510>] do_exit+0x160/0x400 [<ffffffff810637eb>] do_group_exit+0x3b/0xa0 [<ffffffff8106e8bd>] get_signal+0x1ed/0x470 [<ffffffff8100f854>] do_signal+0x14/0x110 [<ffffffff810030e9>] prepare_exit_to_usermode+0xe9/0xf0 [<ffffffff814178a5>] retint_user+0x8/0x13
This is CVE-2016-3961 / XSA-174.
--- arch/x86/include/asm/hugetlb.h | 1 + 1 file changed, 1 insertion(+)
arch/x86/include/asm/hugetlb.h +1 -0
@@ -4,6 +4,7 @@#include <asm/page.h> #include <asm-generic/hugetlb.h> +#define hugepages_supported () cpu_has_pse static inline int is_hugepage_only_range(struct mm_struct *mm, unsigned long addr,
_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xen.org/xen-devel
Greg Kroah-Hartman
maintainerPATCH 36/200 x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
commit ff15e95c82768d589957dbb17d7eb7dba7904659 upstream.
In commit:
eb1af3b71f9d ("Fix computation of channel address")
I switched the "sck_way" variable from holding the log2 value read from the h/w to instead be the actual number. Unfortunately it is needed in log2 form when used to shift the address.
--- drivers/edac/sb_edac.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/edac/sb_edac.c +3 -3
@@ -2118,7 +2118,7 @@ static int get_memory_error_data(struct } ch_way =TAD_CH (reg) +1 ; - sck_way =1 <<TAD_SOCK (reg); + sck_way =TAD_SOCK (reg);if (ch_way ==3 ) idx = addr >>6 ;
@@ -2157,7 +2157,7 @@ static int get_memory_error_data(structswitch (ch_way) {case 2 :case 4 : - sck_xch =1 << sck_way * (ch_way >>1 ); + sck_xch = (1 << sck_way) * (ch_way >>1 );break ;default :sprintf (msg,"Invalid mirror set. Can't decode addr" );
@@ -2193,7 +2193,7 @@ static int get_memory_error_data(struct ch_addr = addr - offset; ch_addr >>= (6 + shiftup); - ch_addr /= ch_way * sck_way; + ch_addr /= sck_xch; ch_addr <<= (6 + shiftup); ch_addr |= addr & ((1 << (6 + shiftup)) -1 );
Greg Kroah-Hartman
maintainerPATCH 37/200 x86 EDAC, sb_edac.c: Take account of channel hashing when needed
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
commit ea5dfb5fae81939f777ca569d8cfb599252da2e8 upstream.
Haswell and Broadwell can be configured to hash the channel interleave function using bits [27:12] of the physical address.
On those processor models we must check to see if hashing is enabled (bit21 of the HASWELL_HASYSDEFEATURE2 register) and act accordingly.
Based on a patch by patrickg <[email protected]>
--- drivers/edac/sb_edac.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/edac/sb_edac.c +23 -1
@@ -362,6 +362,7 @@ struct sbridge_pvt {/* Memory type detection */ bool is_mirrored, is_lockstep, is_close_pg; +bool is_chan_hash;/* Fifo double buffers */ struct mce mce_entry[MCE_LOG_LEN ];
@@ -1060,6 +1061,20 @@ static inline u8 sad_pkg_ha(u8 pkg)return (pkg >>2 ) &0x1 ; } +static int haswell_chan_hash (int idx,u64 addr) +{ +int i; + +/* +* XOR even bits from 12:26 to bit0 of idx, +* odd bits from 13:27 to bit1 +*/ +for (i =12 ; i <28 ; i +=2 ) + idx ^= (addr >> i) &3 ; + +return idx; +} +/**************************************************************************** Memory check routines ****************************************************************************/
@@ -1616,6 +1631,10 @@ static int get_dimm_config(struct mem_ct KNL_MAX_CHANNELS :NUM_CHANNELS ;u64 knl_mc_sizes[KNL_MAX_CHANNELS ]; +if (pvt->info.type ==HASWELL || pvt->info.type ==BROADWELL ) { +pci_read_config_dword (pvt->pci_ha0,HASWELL_HASYSDEFEATURE2 , ®); + pvt->is_chan_hash =GET_BITFIELD (reg,21 ,21 ); + }if (pvt->info.type ==HASWELL || pvt->info.type ==BROADWELL || pvt->info.type ==KNIGHTS_LANDING )pci_read_config_dword (pvt->pci_sad1,SAD_TARGET , ®);
@@ -2122,8 +2141,11 @@ static int get_memory_error_data(structif (ch_way ==3 ) idx = addr >>6 ; -else +else { idx = (addr >> (6 + sck_way + shiftup)) &0x3 ; +if (pvt->is_chan_hash) + idx =haswell_chan_hash (idx, addr); + } idx = idx % ch_way;/*
Greg Kroah-Hartman
maintainerPATCH 38/200 ALSA: hda - Dont trust the reported actual power state
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 50fd4987c4f3c3ebf0ce94d932732011bbdc7c71 upstream.
We've got a regression report that the recording on Mac with a cirrus codec doesn't work any longer. This turned out to be the missing power up to D0 by power_save_node enablement.
After analyzing the traces, we found out that the culprit is that the codec advertises the "actual" power state of a few nodes to be D0 while the "target" power state is D3. This inconsistency is usually OK, as it implies the power transition. But in the case of cirrus codec, this seems to be stuck to D3 while it's not actually D0.
This patch addresses the issue by checking the power state difference more strictly. It sends the power-state change verb unless both the target and the actual power states show the given value.
We may introduce yet another flag indicating the possible broken hardware power state, but it's anyway safer to set the proper power state even in a transition (at least it's harmless as long as the target state is same). So this simpler change was applied now.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171
--- sound/pci/hda/hda_generic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/pci/hda/hda_generic.c +4 -2
@@ -826,7 +826,7 @@ static hda_nid_t path_power_update(struc bool allow_powerdown) {hda_nid_t nid, changed =0 ; -int i, state; +int i, state, power;for (i =0 ; i < path->depth; i++) { nid = path->path[i];
@@ -838,7 +838,9 @@ static hda_nid_t path_power_update(struc state =AC_PWRST_D0 ; else state =AC_PWRST_D3 ; -if (!snd_hda_check_power_state (codec, nid, state)) { + power =snd_hda_codec_read (codec, nid,0 , +AC_VERB_GET_POWER_STATE ,0 ); +if (power != (state | (state <<4 ))) {snd_hda_codec_write (codec, nid,0 ,AC_VERB_SET_POWER_STATE , state); changed = nid;
Greg Kroah-Hartman
maintainerPATCH 39/200 ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Nocera <[email protected]>
commit afecb146d8d8a60a1dde9cdf570c278649617fde upstream.
The Optiplex 9020m with Haswell-DT processor needs a quirk for the headset jack at the front of the machine to be able to use microphones.
A quirk for this model was originally added in 3127899, but c77900e removed it in favour of a more generic version.
Unfortunately, pin configurations can changed based on firmware/BIOS versions, and the generic version doesn't have any effect on newer versions of the machine/firmware anymore.
With help from David Henningsson <[email protected]>
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -5449,6 +5449,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1028 ,0x064a ,"Dell" ,ALC293_FIXUP_DELL1_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x064b ,"Dell" ,ALC293_FIXUP_DELL1_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x0665 ,"Dell XPS 13" ,ALC288_FIXUP_DELL_XPS_13 ), +SND_PCI_QUIRK (0x1028 ,0x0669 ,"Dell Optiplex 9020m" ,ALC255_FIXUP_DELL1_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x069a ,"Dell Vostro 5480" ,ALC290_FIXUP_SUBWOOFER_HSJACK ),SND_PCI_QUIRK (0x1028 ,0x06c7 ,"Dell" ,ALC255_FIXUP_DELL1_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 40/200 ALSA: hda - Keep powering up ADCs on Cirrus codecs
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit de3df8a986b635082a1d94bae2c361d043c57106 upstream.
Although one weird behavior about the input path (inconsistent D0/D3 switch) on Cirrus CS420x codecs was fixed in the previous commit, there is still an issue on some Mac machines: the capture stream stalls when switching the ADCs on the fly. More badly, this keeps stuck until the next reboot.
The dynamic ADC switching is already a bit fragile and assuming optimistically that the chip accepts the frequent power changes. On Cirrus codecs, this doesn't seem applicable.
As a quick workaround, we pin down the ADCs to keep up in D0 when spec->dyn_adc_switch is set. In this way, the ADCs are kept up only for the system that were confirmed to be broken.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171
--- sound/pci/hda/patch_cirrus.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
sound/pci/hda/patch_cirrus.c +14 -0
@@ -361,6 +361,7 @@ static int cs_parse_auto_config(struct h {struct cs_spec *spec = codec->spec;int err; +int i; err =snd_hda_parse_pin_defcfg (codec, &spec->gen.autocfg,NULL ,0 );if (err <0 )
@@ -370,6 +371,19 @@ static int cs_parse_auto_config(struct hif (err <0 )return err; +/* keep the ADCs powered up when it's dynamically switchable */ +if (spec->gen.dyn_adc_switch) { +unsigned int done =0 ; +for (i =0 ; i < spec->gen.input_mux.num_items; i++) { +int idx = spec->gen.dyn_adc_idx[i]; +if (done & (1 << idx)) +continue ; +snd_hda_gen_fix_pin_power (codec, + spec->gen.adc_nids[idx]); + done |=1 << idx; + } + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 41/200 ALSA: hda - add PCI ID for Intel Broxton-T
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu, Han <[email protected]>
commit 9859a971ca228725425238756ee89c6133306ec8 upstream.
Add HD Audio Device PCI ID for the Intel Broxton-T platform. It is an HDA Intel PCH controller.
--- sound/pci/hda/hda_intel.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/hda_intel.c +3 -0
@@ -2232,6 +2232,9 @@ static const struct pci_device_id azx_id/* Broxton-P(Apollolake) */ { PCI_DEVICE(0x8086, 0x5a98), .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON }, + /* Broxton-T */ + { PCI_DEVICE(0x8086, 0x1a98), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON }, /* Haswell */ { PCI_DEVICE(0x8086, 0x0a0c), .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
Greg Kroah-Hartman
maintainerPATCH 42/200 ALSA: pcxhr: Fix missing mutex unlock
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 67f3754b51f22b18c4820fb84062f658c30e8644 upstream.
The commit [9bef72bdb26e: ALSA: pcxhr: Use nonatomic PCM ops] converted to non-atomic PCM ops, but shamelessly with an unbalanced mutex locking, which leads to the hangup easily. Fix it.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116441
--- sound/pci/pcxhr/pcxhr_core.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/pcxhr/pcxhr_core.c +1 -0
@@ -1341,5 +1341,6 @@ irqreturn_t pcxhr_threaded_irq(int irq, }pcxhr_msg_thread (mgr); +mutex_unlock (&mgr->lock);return IRQ_HANDLED ; }
Greg Kroah-Hartman
maintainerPATCH 43/200 ALSA: hda - Add dock support for ThinkPad X260
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Conrad Kostecki <[email protected]>
commit 037e119738120c1cdc460c6ae33871c3000531f3 upstream.
Fixes audio output on a ThinkPad X260, when using Lenovo CES 2013 docking station series (basic, pro, ultra).
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -5584,6 +5584,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x5034 ,"Thinkpad T450" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x5036 ,"Thinkpad T450s" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x503c ,"Thinkpad L450" ,ALC292_FIXUP_TPT440_DOCK ), +SND_PCI_QUIRK (0x17aa ,0x504a ,"ThinkPad X260" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x504b ,"Thinkpad" ,ALC293_FIXUP_LENOVO_SPK_NOISE ),SND_PCI_QUIRK (0x17aa ,0x5109 ,"Thinkpad" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
Greg Kroah-Hartman
maintainerPATCH 44/200 ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit bb03ed216370cb021f377f923471e56d1de3ff5d upstream.
The recent bug report suggests that BCLK setup for i915 HSW/BDW needs to be updated at each HDMI hotplug, not only at initialization and resume. That is, we need to update HSW_EM4 and HSW_EM5 registers at ELD notification, too. Otherwise the HDMI audio may be out of sync and played in a wrong pitch.
However, the HDA codec driver has no access to the controller registers, and currently the code managing these registers is in hda_intel.c, i.e. local to the controller driver. For allowing the explicit BCLK update from the codec driver, as in this patch, the former haswell_set_bclk() in hda_intel.c is moved to hdac_i915.c and exposed as snd_hdac_i915_set_bclk(). This is called from both the HDA controller driver and intel_pin_eld_notify() in HDMI codec driver.
Along with this change, snd_hdac_get_display_clk() gets dropped as it's no longer used.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91410
--- include/sound/hda_i915.h | 5 +-- sound/hda/hdac_i915.c | 62 +++++++++++++++++++++++++++++++++++++-------- sound/pci/hda/hda_intel.c | 56 ++-------------------------------------- sound/pci/hda/patch_hdmi.c | 1 4 files changed, 58 insertions(+), 66 deletions(-)
include/sound/hda_i915.h +2 -3
@@ -9,7 +9,7 @@#ifdef CONFIG_SND_HDA_I915 int snd_hdac_set_codec_wakeup (struct hdac_bus *bus,bool enable);int snd_hdac_display_power (struct hdac_bus *bus,bool enable); -int snd_hdac_get_display_clk (struct hdac_bus *bus); +void snd_hdac_i915_set_bclk (struct hdac_bus *bus);int snd_hdac_sync_audio_rate (struct hdac_bus *bus,hda_nid_t nid,int rate);int snd_hdac_acomp_get_eld (struct hdac_bus *bus,hda_nid_t nid,bool *audio_enabled,char *buffer,int max_bytes);
@@ -25,9 +25,8 @@ static inline int snd_hdac_display_power {return 0 ; } -static inline int snd_hdac_get_display_clk (struct hdac_bus *bus) +static inline void snd_hdac_i915_set_bclk (struct hdac_bus *bus) { -return 0 ; }static inline int snd_hdac_sync_audio_rate (struct hdac_bus *bus,hda_nid_t nid,int rate)
sound/hda/hdac_i915.c +51 -11
83 lines not on this page · raw message
sound/pci/hda/hda_intel.c +4 -52
80 lines not on this page · raw message
sound/pci/hda/patch_hdmi.c +1 -0
@@ -2452,6 +2452,7 @@ static void intel_pin_eld_notify(void *aif (atomic_read (&(codec)->core.in_pm))return ; +snd_hdac_i915_set_bclk (&codec->bus->core);check_presence_and_report (codec, pin_nid); }
Greg Kroah-Hartman
maintainerPATCH 45/200 asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Perier <[email protected]>
commit fba7cd681b6155e2d93e7862fcd6f970336b83c3 upstream.
The recent decoupling of pagefault disable and preempt disable added an explicit preempt_disable/enable() pair to the futex_atomic_cmpxchg_inatomic() implementation in asm-generic/futex.h. But it forgot to add preempt_enable() calls to the error handling code pathes, which results in a preemption count imbalance.
This is observable on boot when the test for atomic_cmpxchg() is calling futex_atomic_cmpxchg_inatomic() on a NULL pointer.
Add the missing preempt_enable() calls to the error handling code pathes.
[ tglx: Massaged changelog ]
--- include/asm-generic/futex.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
include/asm-generic/futex.h +6 -2
@@ -108,11 +108,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval,u32 val;preempt_disable (); -if (unlikely (get_user (val, uaddr) !=0 )) +if (unlikely (get_user (val, uaddr) !=0 )) { +preempt_enable ();return -EFAULT ; + } -if (val == oldval &&unlikely (put_user (newval, uaddr) !=0 )) +if (val == oldval &&unlikely (put_user (newval, uaddr) !=0 )) { +preempt_enable ();return -EFAULT ; + } *uval = val;preempt_enable ();
Greg Kroah-Hartman
maintainerPATCH 46/200 futex: Handle unlock_pi race gracefully
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
commit 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 upstream.
If userspace calls UNLOCK_PI unconditionally without trying the TID -> 0 transition in user space first then the user space value might not have the waiters bit set. This opens the following race:
CPU0 CPU1
uval = get_user(futex)
lock(hb)
lock(hb)
futex |= FUTEX_WAITERS .... unlock(hb)
cmpxchg(futex, uval, newval)
So the cmpxchg fails and returns -EINVAL to user space, which is wrong because the futex value is valid.
To handle this (yes, yet another) corner case gracefully, check for a flag change and retry.
[ tglx: Massaged changelog and slightly reworked implementation ]
--- kernel/futex.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-)
kernel/futex.c +22 -3
@@ -1212,10 +1212,20 @@ static int wake_futex_pi(u32 __user *uadif (unlikely (should_fail_futex (true))) ret = -EFAULT ; -if (cmpxchg_futex_value_locked (&curval, uaddr, uval, newval)) +if (cmpxchg_futex_value_locked (&curval, uaddr, uval, newval)) { ret = -EFAULT ; -else if (curval != uval) - ret = -EINVAL ; + }else if (curval != uval) { +/* +* If a unconditional UNLOCK_PI operation (user space did not +* try the TID->0 transition) raced with a waiter setting the +* FUTEX_WAITERS flag between get_user() and locking the hash +* bucket lock, retry the operation. +*/ +if ((FUTEX_TID_MASK & curval) == uval) + ret = -EAGAIN ; +else + ret = -EINVAL ; + }if (ret) {raw_spin_unlock_irq (&pi_state->pi_mutex.wait_lock);return ret;
@@ -2536,6 +2546,15 @@ retry:if (ret == -EFAULT ) goto pi_faulted;/* +* A unconditional UNLOCK_PI op raced against a waiter +* setting the FUTEX_WAITERS bit. Try again. +*/ +if (ret == -EAGAIN ) { +spin_unlock (&hb->lock); +put_futex_key (&key); + goto retry; + } +/* * wake_futex_pi has detected invalid state. Tell user * space. */
Greg Kroah-Hartman
maintainerPATCH 47/200 futex: Acknowledge a new waiter in counter before plist
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davidlohr Bueso <[email protected]>
commit fe1bce9e2107ba3a8faffe572483b6974201a0e6 upstream.
Otherwise an incoming waker on the dest hash bucket can miss the waiter adding itself to the plist during the lockless check optimization (small window but still the correct way of doing this); similarly to the decrement counterpart.
--- kernel/futex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/futex.c +1 -1
@@ -1452,8 +1452,8 @@ void requeue_futex(struct futex_q *q, stif (likely (&hb1->chain != &hb2->chain)) {plist_del (&q->list, &hb1->chain);hb_waiters_dec (hb1); -plist_add (&q->list, &hb2->chain);hb_waiters_inc (hb2); +plist_add (&q->list, &hb2->chain); q->lock_ptr = &hb2->lock; }get_futex_key_refs (key2);
Greg Kroah-Hartman
maintainerPATCH 48/200 drm/nouveau/core: use vzalloc for allocating ramht
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilia Mirkin <[email protected]>
commit 78a121d82da8aff3aca2a6a1c40f5061081760f0 upstream.
Most calls to nvkm_ramht_new use 0x8000 as the size. This results in a fairly sizeable chunk of memory to be allocated, which may not be available with kzalloc. Since this is done fairly rarely (once per channel), use vzalloc instead.
--- drivers/gpu/drm/nouveau/nvkm/core/ramht.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/nouveau/nvkm/core/ramht.c +3 -3
@@ -131,7 +131,7 @@ nvkm_ramht_del(struct nvkm_ramht **pramhstruct nvkm_ramht *ramht = *pramht;if (ramht) {nvkm_gpuobj_del (&ramht->gpuobj); -kfree (*pramht); +vfree (*pramht); *pramht =NULL ; } }
@@ -143,8 +143,8 @@ nvkm_ramht_new(struct nvkm_device *devicstruct nvkm_ramht *ramht;int ret, i; -if (!(ramht = *pramht =kzalloc (sizeof (*ramht) + (size >>3 ) * -sizeof (*ramht->data),GFP_KERNEL ))) +if (!(ramht = *pramht =vzalloc (sizeof (*ramht) + + (size >>3 ) *sizeof (*ramht->data))))return -ENOMEM ; ramht->device = device;
Greg Kroah-Hartman
maintainerPATCH 49/200 drm/qxl: fix cursor position with non-zero hotspot
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
commit d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 upstream.
The SPICE protocol considers the position of a cursor to be the location of its active pixel on the display, so the cursor is drawn with its top-left corner at "(x - hot_spot_x, y - hot_spot_y)" but the DRM cursor position gives the location where the top-left corner should be drawn, with the hotspot being a hint for drivers that need it.
This fixes the location of the window resize cursors when using Fluxbox with the QXL DRM driver and both the QXL and modesetting X drivers.
--- drivers/gpu/drm/qxl/qxl_display.c | 13 +++++++++---- drivers/gpu/drm/qxl/qxl_drv.h | 2 ++ 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/gpu/drm/qxl/qxl_display.c +9 -4
@@ -375,10 +375,15 @@ static int qxl_crtc_cursor_set2(struct dqxl_bo_kunmap (user_bo); + qcrtc->cur_x += qcrtc->hot_spot_x - hot_x; + qcrtc->cur_y += qcrtc->hot_spot_y - hot_y; + qcrtc->hot_spot_x = hot_x; + qcrtc->hot_spot_y = hot_y; + cmd = (struct qxl_cursor_cmd *)qxl_release_map (qdev, release); cmd->type =QXL_CURSOR_SET ; - cmd->u.set.position.x = qcrtc->cur_x; - cmd->u.set.position.y = qcrtc->cur_y; + cmd->u.set.position.x = qcrtc->cur_x + qcrtc->hot_spot_x; + cmd->u.set.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; cmd->u.set.shape =qxl_bo_physical_address (qdev, cursor_bo,0 );
@@ -441,8 +446,8 @@ static int qxl_crtc_cursor_move(struct d cmd = (struct qxl_cursor_cmd *)qxl_release_map (qdev, release); cmd->type =QXL_CURSOR_MOVE ; - cmd->u.position.x = qcrtc->cur_x; - cmd->u.position.y = qcrtc->cur_y; + cmd->u.position.x = qcrtc->cur_x + qcrtc->hot_spot_x; + cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;qxl_release_unmap (qdev, release, &cmd->release_info);qxl_push_cursor_ring_release (qdev, release,QXL_CMD_CURSOR , false);
drivers/gpu/drm/qxl/qxl_drv.h +2 -0
@@ -135,6 +135,8 @@ struct qxl_crtc {int index;int cur_x;int cur_y; +int hot_spot_x; +int hot_spot_y; };struct qxl_output {
Greg Kroah-Hartman
maintainerPATCH 51/200 Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control"
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit bfaddd9fc8ac048b99475f000dbef6f08297417f upstream.
This reverts commit e64c952efb8e0c15ae82cec8e455ab4910690ef1.
ATPX is the ACPI method for controlling AMD PowerXpress laptops. There are flags to indicate which methods are supported. If the dGPU power down flag is not supported, the driver needs to implement the dGPU power down manually. We had previously always forced the driver to assume the ATPX dGPU power down was present, but this causes problems on boards where it is not, leading to GPU hangs when attempting to power down the dGPU. Manual dGPU power down is not currently supported in the Linux driver. Some laptops indicate that the ATPX dGPU power down method is not present, but it actually apparently is. I'm not sure if this is a bios bug and it should be set or if there is a reason it was unset and the method should not be used. This is not an issue on other OSes since both the ATPX and the manual driver power down methods are supported.
This is apparently fairly widespread, so just revert for now.
bugs:
https://bugzilla.kernel.org/show_bug.cgi?id=115321
https://bugzilla.kernel.org/show_bug.cgi?id=116581
https://bugzilla.kernel.org/show_bug.cgi?id=116251
--- drivers/gpu/drm/radeon/radeon_atpx_handler.c | 8 ++++---- drivers/gpu/drm/radeon/radeon_device.c | 8 +------- 2 files changed, 5 insertions(+), 11 deletions(-)
drivers/gpu/drm/radeon/radeon_atpx_handler.c +4 -4
@@ -62,10 +62,6 @@ bool radeon_has_atpx(void) {return radeon_atpx_priv.atpx_detected; } -bool radeon_has_atpx_dgpu_power_cntl (void ) { -return radeon_atpx_priv.atpx.functions.power_cntl; -} -/** * radeon_atpx_call - call an ATPX method *
@@ -145,6 +141,10 @@ static void radeon_atpx_parse_functions(*/ static int radeon_atpx_validate (struct radeon_atpx *atpx) { +/* make sure required functions are enabled */ +/* dGPU power control is required */ + atpx->functions.power_cntl = true; +if (atpx->functions.px_params) {union acpi_object *info;struct atpx_px_params output;
drivers/gpu/drm/radeon/radeon_device.c +1 -7
@@ -103,12 +103,6 @@ static const char radeon_family_name[][1 "LAST", }; -#if defined(CONFIG_VGA_SWITCHEROO ) -bool radeon_has_atpx_dgpu_power_cntl (void ); -#else -static inline bool radeon_has_atpx_dgpu_power_cntl (void ) {return false; } -#endif -#define RADEON_PX_QUIRK_DISABLE_PX (1 << 0)#define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
@@ -1439,7 +1433,7 @@ int radeon_device_init(struct radeon_dev* ignore it */ vga_client_register (rdev->pdev, rdev,NULL , radeon_vga_set_decode); -if ((rdev->flags &RADEON_IS_PX ) &&radeon_has_atpx_dgpu_power_cntl ()) +if (rdev->flags &RADEON_IS_PX ) runtime = true;vga_switcheroo_register_client (rdev->pdev, &radeon_switcheroo_ops, runtime);if (runtime)
Greg Kroah-Hartman
maintainerPATCH 53/200 usbvision: revert commit 588afcc1
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladis Dronov <[email protected]>
commit d5468d7afaa9c9e961e150f0455a14a9f4872a98 upstream.
Commit 588afcc1c0e4 ("[media] usbvision fix overflow of interfaces array")' should be reverted, because:
* "!dev->actconfig->interface[ifnum]" won't catch a case where the value is not NULL but some garbage. This way the system may crash later with GPF.
* "(ifnum >= USB_MAXINTERFACES)" does not cover all the error conditions. "ifnum" should be compared to "dev->actconfig-> desc.bNumInterfaces", i.e. compared to the number of "struct usb_interface" kzalloc()-ed, not to USB_MAXINTERFACES.
* There is a "struct usb_device" leak in this error path, as there is usb_get_dev(), but no usb_put_dev() on this path.
* There is a bug of the same type several lines below with number of endpoints. The code is accessing hard-coded second endpoint ("interface->endpoint[1].desc") which may not exist. It would be great to handle this in the same patch too.
* All the concerns above are resolved by already-accepted commit fa52bd50 ("[media] usbvision: fix crash on detecting device with invalid configuration")
* Mailing list message:
http://www.spinics.net/lists/linux-media/msg94832.html
--- drivers/media/usb/usbvision/usbvision-video.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/media/usb/usbvision/usbvision-video.c +0 -7
@@ -1461,13 +1461,6 @@ static int usbvision_probe(struct usb_inprintk (KERN_INFO "%s: %s found\n" , __func__, usbvision_device_data[model].model_string); -/* -* this is a security check. -* an exploit using an incorrect bInterfaceNumber is known -*/ -if (ifnum >=USB_MAXINTERFACES || !dev->actconfig->interface[ifnum]) -return -ENODEV ; -if (usbvision_device_data[model].interface >=0 ) interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0 ];else if (ifnum < dev->actconfig->desc.bNumInterfaces)
Greg Kroah-Hartman
maintainerPATCH 54/200 Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit e9bef455af8eb0e837e179aab8988ae2649fd8d3 upstream.
This reverts commit bedf2a65c1aa8fb29ba8527fd00c0f68ec1f55f1.
See the radeon revert for an extended description.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 8 ++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +------- 2 files changed, 5 insertions(+), 11 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +4 -4
@@ -63,10 +63,6 @@ bool amdgpu_has_atpx(void) {return amdgpu_atpx_priv.atpx_detected; } -bool amdgpu_has_atpx_dgpu_power_cntl (void ) { -return amdgpu_atpx_priv.atpx.functions.power_cntl; -} -/** * amdgpu_atpx_call - call an ATPX method *
@@ -146,6 +142,10 @@ static void amdgpu_atpx_parse_functions(*/ static int amdgpu_atpx_validate (struct amdgpu_atpx *atpx) { +/* make sure required functions are enabled */ +/* dGPU power control is required */ + atpx->functions.power_cntl = true; +if (atpx->functions.px_params) {union acpi_object *info;struct atpx_px_params output;
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +1 -7
@@ -62,12 +62,6 @@ static const char *amdgpu_asic_name[] = "LAST", }; -#if defined(CONFIG_VGA_SWITCHEROO ) -bool amdgpu_has_atpx_dgpu_power_cntl (void ); -#else -static inline bool amdgpu_has_atpx_dgpu_power_cntl (void ) {return false; } -#endif -bool amdgpu_device_is_px (struct drm_device *dev) {struct amdgpu_device *adev = dev->dev_private;
@@ -1517,7 +1511,7 @@ int amdgpu_device_init(struct amdgpu_devif (amdgpu_runtime_pm ==1 ) runtime = true; -if (amdgpu_device_is_px (ddev) &&amdgpu_has_atpx_dgpu_power_cntl ()) +if (amdgpu_device_is_px (ddev)) runtime = true;vga_switcheroo_register_client (adev->pdev, &amdgpu_switcheroo_ops, runtime);if (runtime)
Greg Kroah-Hartman
maintainerPATCH 55/200 cpufreq: intel_pstate: Fix processing for turbo activation ratio
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 1becf03545a0859ceaaf9e8c2d9861882a71cb01 upstream.
When the config TDP level is not nominal (level = 0), the MSR values for reading level 1 and level 2 ratios contain power in low 14 bits and actual ratio bits are at bits [23:16]. The current processing for level 1 and level 2 is wrong as there is no shift done to get actual ratio.
--- drivers/cpufreq/intel_pstate.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/cpufreq/intel_pstate.c +5 -0
@@ -673,6 +673,11 @@ static int core_get_max_pstate(void)if (err) goto skip_tar; +/* For level 1 and 2, bits[23:16] contain the ratio */ +if (tdp_ctrl) + tdp_ratio >>=16 ; + + tdp_ratio &=0xff ;/* ratios are only 8 bits long */ if (tdp_ratio -1 == tar) { max_pstate = tar;pr_debug ("max_pstate=TAC %x\n" , max_pstate);
Greg Kroah-Hartman
maintainerPATCH 56/200 s390/pci: add extra padding to function measurement block
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Ott <[email protected]>
commit 9d89d9e61d361f3adb75e1aebe4bb367faf16cfa upstream.
Newer machines might use a different (larger) format for function measurement blocks. To ensure that we comply with the alignment requirement on these machines and prevent memory corruption (when firmware writes more data than we expect) add 16 padding bytes at the end of the fmb.
--- arch/s390/include/asm/pci.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/s390/include/asm/pci.h +2 -1
@@ -45,7 +45,8 @@ struct zpci_fmb {u64 rpcit_ops;u64 dma_rbytes;u64 dma_wbytes; -} __packed__aligned(64) ; +u64 pad[2 ]; +} __packed__aligned(128) ;enum zpci_state {ZPCI_FN_STATE_RESERVED ,
Greg Kroah-Hartman
maintainerPATCH 57/200 iwlwifi: pcie: lower the debug level for RSA semaphore access
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
commit 9fc515bc9e735c10cd327f05c20f5ef69474188d upstream.
IWL_INFO is not an error but still printed by default. "can't access the RSA semaphore it is write protected" seems worrisome but it is not really a problem.
--- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/trans.c +2 -2
@@ -731,8 +731,8 @@ static int iwl_pcie_rsa_race_bug_wa(stru*/ val =iwl_read_prph (trans,PREG_AUX_BUS_WPROT_0 );if (val & (BIT (1 ) |BIT (17 ))) { -IWL_INFO (trans, -"can't access the RSA semaphore it is write protected\n" ); +IWL_DEBUG_INFO (trans, +"can't access the RSA semaphore it is write protected\n" );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 58/200 iwlwifi: mvm: fix memory leak in paging
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Gottlieb <[email protected]>
commit 7fdf9663261cc77a516396fec82cee8a8ea07e76 upstream.
Currently paging download buffer is freed during the the unloading of the opmode which happens when the driver is unloaded.
This causes a memory leak since the paging download buffer is allocated every time we enable the interface, so the download buffer can be allocated many times, but only be freed once.
Free paging download buffer during disabling of the interface.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 ++ drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +2 -0
@@ -1143,6 +1143,8 @@ void __iwl_mvm_mac_stop(struct iwl_mvm */* the fw is stopped, the aux sta is dead: clean up driver state */ iwl_mvm_del_aux_sta (mvm); +iwl_free_fw_paging (mvm); +/* * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete() * won't be called in this case).
drivers/net/wireless/intel/iwlwifi/mvm/ops.c +0 -2
@@ -684,8 +684,6 @@ static void iwl_op_mode_mvm_stop(structfor (i =0 ; i <NVM_MAX_NUM_SECTIONS ; i++)kfree (mvm->nvm_sections[i].data); -iwl_free_fw_paging (mvm); -iwl_mvm_tof_clean (mvm);ieee80211_free_hw (mvm->hw);
Greg Kroah-Hartman
maintainerPATCH 59/200 crypto: rsa-pkcs1pad - fix dst len
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tadeusz Struk <[email protected]>
commit 6f0904ada402a45b3a0a3b9b6507d91d3a9da67a upstream.
The output buffer length has to be at least as big as the key_size. It is then updated to the actual output size by the implementation.
--- crypto/rsa-pkcs1pad.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
crypto/rsa-pkcs1pad.c +6 -6
@@ -310,16 +310,16 @@ static int pkcs1pad_decrypt(struct akcip req_ctx->child_req.src = req->src; req_ctx->child_req.src_len = req->src_len; req_ctx->child_req.dst = req_ctx->out_sg; - req_ctx->child_req.dst_len = ctx->key_size -1 ; + req_ctx->child_req.dst_len = ctx->key_size ; - req_ctx->out_buf =kmalloc (ctx->key_size -1 , + req_ctx->out_buf =kmalloc (ctx->key_size, (req->base.flags &CRYPTO_TFM_REQ_MAY_SLEEP ) ?GFP_KERNEL :GFP_ATOMIC );if (!req_ctx->out_buf)return -ENOMEM ;pkcs1pad_sg_set_buf (req_ctx->out_sg, req_ctx->out_buf, - ctx->key_size -1 ,NULL ); + ctx->key_size,NULL );akcipher_request_set_tfm (&req_ctx->child_req, ctx->child); akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
@@ -491,16 +491,16 @@ static int pkcs1pad_verify(struct akciph req_ctx->child_req.src = req->src; req_ctx->child_req.src_len = req->src_len; req_ctx->child_req.dst = req_ctx->out_sg; - req_ctx->child_req.dst_len = ctx->key_size -1 ; + req_ctx->child_req.dst_len = ctx->key_size; - req_ctx->out_buf =kmalloc (ctx->key_size -1 , + req_ctx->out_buf =kmalloc (ctx->key_size, (req->base.flags &CRYPTO_TFM_REQ_MAY_SLEEP ) ?GFP_KERNEL :GFP_ATOMIC );if (!req_ctx->out_buf)return -ENOMEM ;pkcs1pad_sg_set_buf (req_ctx->out_sg, req_ctx->out_buf, - ctx->key_size -1 ,NULL ); + ctx->key_size,NULL );akcipher_request_set_tfm (&req_ctx->child_req, ctx->child); akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
Greg Kroah-Hartman
maintainerPATCH 60/200 crypto: ccp - Prevent information leakage on export
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <[email protected]>
commit f709b45ec461b548c41a00044dba1f1b572783bf upstream.
Prevent information from leaking to userspace by doing a memset to 0 of the export state structure before setting the structure values and copying it. This prevents un-initialized padding areas from being copied into the export area.
--- drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 3 +++ drivers/crypto/ccp/ccp-crypto-sha.c | 3 +++ 2 files changed, 6 insertions(+)
drivers/crypto/ccp/ccp-crypto-aes-cmac.c +3 -0
@@ -225,6 +225,9 @@ static int ccp_aes_cmac_export(struct ahstruct ccp_aes_cmac_req_ctx *rctx =ahash_request_ctx (req);struct ccp_aes_cmac_exp_ctx state; +/* Don't let anything leak to 'out' */ +memset (&state,0 ,sizeof (state)); + state.null_msg = rctx->null_msg;memcpy (state.iv, rctx->iv,sizeof (state.iv)); state.buf_count = rctx->buf_count;
drivers/crypto/ccp/ccp-crypto-sha.c +3 -0
@@ -212,6 +212,9 @@ static int ccp_sha_export(struct ahash_rstruct ccp_sha_req_ctx *rctx =ahash_request_ctx (req);struct ccp_sha_exp_ctx state; +/* Don't let anything leak to 'out' */ +memset (&state,0 ,sizeof (state)); + state.type = rctx->type; state.msg_bits = rctx->msg_bits; state.first = rctx->first;
Greg Kroah-Hartman
maintainerPATCH 61/200 crypto: sha1-mb - use corrcet pointer while completing jobs
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaodong Liu <[email protected]>
commit 0851561d9c965df086ef8a53f981f5f95a57c2c8 upstream.
In sha_complete_job, incorrect mcryptd_hash_request_ctx pointer is used when check and complete other jobs. If the memory of first completed req is freed, while still completing other jobs in the func, kernel will crash since NULL pointer is assigned to RIP.
--- arch/x86/crypto/sha-mb/sha1_mb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/crypto/sha-mb/sha1_mb.c +2 -2
@@ -453,10 +453,10 @@ static int sha_complete_job(struct mcryp req =cast_mcryptd_ctx_to_req (req_ctx);if (irqs_disabled ()) - rctx->complete (&req->base, ret); + req_ctx->complete (&req->base, ret);else {local_bh_disable (); - rctx->complete (&req->base, ret); + req_ctx->complete (&req->base, ret);local_bh_enable (); } }
Greg Kroah-Hartman
maintainerPATCH 62/200 crypto: talitos - fix crash in talitos_cra_init()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Eymann <[email protected]>
commit 89d124cb61b39900959e2839ac06b6339b6a54cb upstream.
Conversion of talitos driver to the new AEAD interface hasn't been properly tested.
AEAD algorithms crash in talitos_cra_init as follows:
[...]
[ 1.141095] talitos ffe30000.crypto: hwrng [ 1.145381] Unable to handle kernel paging request for data at address 0x00000058 [ 1.152913] Faulting instruction address: 0xc02accc0 [ 1.157910] Oops: Kernel access of bad area, sig: 11 [#1] [ 1.163315] SMP NR_CPUS=2 P1020 RDB [ 1.166810] Modules linked in: [ 1.169875] CPU: 0 PID: 1007 Comm: cryptomgr_test Not tainted 4.4.6 #1 [ 1.176415] task: db5ec200 ti: db4d6000 task.ti: db4d6000 [ 1.181821] NIP: c02accc0 LR: c02acd18 CTR: c02acd04 [ 1.186793] REGS: db4d7d30 TRAP: 0300 Not tainted (4.4.6) [ 1.192457] MSR: 00029000 <CE,EE,ME> CR: 95009359 XER: e0000000 [ 1.198585] DEAR: 00000058 ESR: 00000000
GPR00: c017bdc0 db4d7de0 db5ec200 df424b48 00000000 00000000 df424bfc db75a600
GPR08: df424b48 00000000 db75a628 db4d6000 00000149 00000000 c0044cac db5acda0
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000400 df424940
GPR24: df424900 00003083 00000400 c0180000 db75a640 c03e9f84 df424b40 df424b48
[ 1.230978] NIP [c02accc0] talitos_cra_init+0x28/0x6c [ 1.236039] LR [c02acd18] talitos_cra_init_aead+0x14/0x28 [ 1.241443] Call Trace: [ 1.243894] [db4d7de0] [c03e9f84] 0xc03e9f84 (unreliable) [ 1.249322] [db4d7df0] [c017bdc0] crypto_create_tfm+0x5c/0xf0 [ 1.255083] [db4d7e10] [c017beec] crypto_alloc_tfm+0x98/0xf8 [ 1.260769] [db4d7e40] [c0186a20] alg_test_aead+0x28/0xc8 [ 1.266181] [db4d7e60] [c0186718] alg_test+0x260/0x2e0 [ 1.271333] [db4d7ee0] [c0183860] cryptomgr_test+0x30/0x54 [ 1.276843] [db4d7ef0] [c0044d80] kthread+0xd4/0xd8 [ 1.281741] [db4d7f40] [c000e4a4] ret_from_kernel_thread+0x5c/0x64 [ 1.287930] Instruction dump: [ 1.290902] 38600000 4e800020 81230028 7c681b78 81490010 38e9ffc0 3929ffe8 554a073e [ 1.298691] 2b8a000a 7d474f9e 812a0008 91230030 <80e90058> 39270060 7c0004ac 7cc04828
Fix typo - replaced parameter of __crypto_ahash_alg(): s/tfm/alg Remove checkpatch warnings.
Add commit message.
--- drivers/crypto/talitos.c | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-)
drivers/crypto/talitos.c +27 -14
@@ -2629,21 +2629,11 @@ struct talitos_crypto_alg {struct talitos_alg_template algt; }; -static int talitos_cra_init (struct crypto_tfm *tfm) +static int talitos_init_common (struct talitos_ctx *ctx, +struct talitos_crypto_alg *talitos_alg) { -struct crypto_alg *alg = tfm->__crt_alg; -struct talitos_crypto_alg *talitos_alg; -struct talitos_ctx *ctx =crypto_tfm_ctx (tfm);struct talitos_private *priv; -if ((alg->cra_flags &CRYPTO_ALG_TYPE_MASK ) ==CRYPTO_ALG_TYPE_AHASH ) - talitos_alg =container_of (__crypto_ahash_alg (alg), - struct talitos_crypto_alg, - algt.alg.hash); -else - talitos_alg = container_of(alg, struct talitos_crypto_alg, - algt.alg.crypto); -/* update context with ptr to dev */ ctx->dev = talitos_alg->dev;
@@ -2661,10 +2651,33 @@ static int talitos_cra_init(struct cryptreturn 0 ; } +static int talitos_cra_init (struct crypto_tfm *tfm) +{ +struct crypto_alg *alg = tfm->__crt_alg; +struct talitos_crypto_alg *talitos_alg; +struct talitos_ctx *ctx =crypto_tfm_ctx (tfm); + +if ((alg->cra_flags &CRYPTO_ALG_TYPE_MASK ) ==CRYPTO_ALG_TYPE_AHASH ) + talitos_alg =container_of (__crypto_ahash_alg (alg), + struct talitos_crypto_alg, + algt.alg.hash); +else + talitos_alg = container_of(alg, struct talitos_crypto_alg, + algt.alg.crypto); + +return talitos_init_common (ctx, talitos_alg); +} +static int talitos_cra_init_aead (struct crypto_aead *tfm) { -talitos_cra_init (crypto_aead_tfm (tfm)); -return 0 ; +struct aead_alg *alg =crypto_aead_alg (tfm); +struct talitos_crypto_alg *talitos_alg; +struct talitos_ctx *ctx =crypto_aead_ctx (tfm); + + talitos_alg = container_of(alg, struct talitos_crypto_alg, + algt.alg.aead); + +return talitos_init_common (ctx, talitos_alg); }static int talitos_cra_init_ahash (struct crypto_tfm *tfm)
Greg Kroah-Hartman
maintainerPATCH 63/200 crypto: talitos - fix AEAD tcrypt tests
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geant? <[email protected]>
commit 340ff60ae93a5db2b2be6f38868df9a1293b6007 upstream.
After conversion to new AEAD interface, tcrypt tests fail as follows:
[...]
[ 1.145414] alg: aead: Test 1 failed on encryption for authenc-hmac-sha1-cbc-aes-talitos [ 1.153564] 00000000: 53 69 6e 67 6c 65 20 62 6c 6f 63 6b 20 6d 73 67 [ 1.160041] 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1.166509] 00000020: 00 00 00 00
[...]
Fix them by providing the correct cipher in & cipher out pointers, i.e. must skip over associated data in src and dst S/G.
While here, fix a problem with the HW S/G table index usage:tbl_off must be updated after the pointer to the table entries is set.
--- drivers/crypto/talitos.c | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-)
drivers/crypto/talitos.c +30 -16
@@ -63,6 +63,14 @@ static void to_talitos_ptr(struct talito ptr->eptr =upper_32_bits (dma_addr); } +static void copy_talitos_ptr (struct talitos_ptr *dst_ptr, +struct talitos_ptr *src_ptr,bool is_sec1) +{ + dst_ptr->ptr = src_ptr->ptr; +if (!is_sec1) + dst_ptr->eptr = src_ptr->eptr; +} +static void to_talitos_ptr_len (struct talitos_ptr *ptr,unsigned int len,bool is_sec1) {
@@ -1083,21 +1091,20 @@ static int ipsec_esp(struct talitos_edes sg_count =dma_map_sg (dev, areq->src, edesc->src_nents ?:1 , (areq->src == areq->dst) ?DMA_BIDIRECTIONAL :DMA_TO_DEVICE ); -/* hmac data */ desc->ptr[1 ].len =cpu_to_be16 (areq->assoclen);if (sg_count >1 && (ret =sg_to_link_tbl_offset (areq->src, sg_count,0 , areq->assoclen, &edesc->link_tbl[tbl_off])) >1 ) { - tbl_off += ret; -to_talitos_ptr (&desc->ptr[1 ], edesc->dma_link_tbl + tbl_off *sizeof (struct talitos_ptr ),0 ); desc->ptr[1 ].j_extent =DESC_PTR_LNKTBL_JUMP ;dma_sync_single_for_device (dev, edesc->dma_link_tbl, edesc->dma_len,DMA_BIDIRECTIONAL ); + + tbl_off += ret; }else {to_talitos_ptr (&desc->ptr[1 ],sg_dma_address (areq->src),0 ); desc->ptr[1 ].j_extent =0 ;
@@ -1126,11 +1133,13 @@ static int ipsec_esp(struct talitos_edesif (edesc->desc.hdr &DESC_HDR_MODE1_MDEU_CICV ) sg_link_tbl_len += authsize; - if (sg_count > 1 && - (ret = sg_to_link_tbl_offset(areq->src, sg_count, areq->assoclen, - sg_link_tbl_len, - &edesc->link_tbl[tbl_off])) > 1) { - tbl_off += ret; +if (sg_count ==1 ) { +to_talitos_ptr (&desc->ptr[4 ],sg_dma_address (areq->src) + + areq->assoclen,0 ); + } else if ((ret = sg_to_link_tbl_offset(areq->src, sg_count, + areq->assoclen, sg_link_tbl_len, + &edesc->link_tbl[tbl_off])) > + 1) { desc->ptr[4].j_extent |= DESC_PTR_LNKTBL_JUMP; to_talitos_ptr(&desc->ptr[4], edesc->dma_link_tbl + tbl_off *
@@ -1138,8 +1147,10 @@ static int ipsec_esp(struct talitos_edesdma_sync_single_for_device (dev, edesc->dma_link_tbl, edesc->dma_len,DMA_BIDIRECTIONAL ); - }else -to_talitos_ptr (&desc->ptr[4 ],sg_dma_address (areq->src),0 ); + tbl_off += ret; + }else { +copy_talitos_ptr (&desc->ptr[4 ], &edesc->link_tbl[tbl_off],0 ); + }/* cipher out */ desc->ptr[5 ].len =cpu_to_be16 (cryptlen);
@@ -1151,11 +1162,13 @@ static int ipsec_esp(struct talitos_edes edesc->icv_ool = false; -if (sg_count >1 && - (sg_count =sg_to_link_tbl_offset (areq->dst, sg_count, +if (sg_count ==1 ) { +to_talitos_ptr (&desc->ptr[5 ],sg_dma_address (areq->dst) + + areq->assoclen,0 ); + }else if ((sg_count = +sg_to_link_tbl_offset (areq->dst, sg_count, areq->assoclen, cryptlen, - &edesc->link_tbl[tbl_off])) > -1 ) { + &edesc->link_tbl[tbl_off])) >1 ) {struct talitos_ptr *tbl_ptr = &edesc->link_tbl[tbl_off]; to_talitos_ptr(&desc->ptr[5], edesc->dma_link_tbl +
@@ -1178,8 +1191,9 @@ static int ipsec_esp(struct talitos_edes edesc->dma_len, DMA_BIDIRECTIONAL); edesc->icv_ool = true; - }else -to_talitos_ptr (&desc->ptr[5 ],sg_dma_address (areq->dst),0 ); + }else { +copy_talitos_ptr (&desc->ptr[5 ], &edesc->link_tbl[tbl_off],0 ); + }/* iv out */ map_single_talitos_ptr(dev, &desc->ptr[6], ivsize, ctx->iv,
Greg Kroah-Hartman
maintainerPATCH 64/200 powerpc: scan_features() updates incorrect bits for REAL_LE
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 6997e57d693b07289694239e52a10d2f02c3a46f upstream.
The REAL_LE feature entry in the ibm_pa_feature struct is missing an MMU feature value, meaning all the remaining elements initialise the wrong values.
This means instead of checking for byte 5, bit 0, we check for byte 0, bit 0, and then we incorrectly set the CPU feature bit as well as MMU feature bit 1 and CPU user feature bits 0 and 2 (5).
Checking byte 0 bit 0 (IBM numbering), means we're looking at the "Memory Management Unit (MMU)" feature - ie. does the CPU have an MMU. In practice that bit is set on all platforms which have the property.
This means we set CPU_FTR_REAL_LE always. In practice that seems not to matter because all the modern cpus which have this property also implement REAL_LE, and we've never needed to disable it.
We're also incorrectly setting MMU feature bit 1, which is:
#define MMU_FTR_TYPE_8xx 0x00000002
Luckily the only place that looks for MMU_FTR_TYPE_8xx is in Book3E code, which can't run on the same cpus as scan_features(). So this also doesn't matter in practice.
Finally in the CPU user feature mask, we're setting bits 0 and 2. Bit 2 is not currently used, and bit 0 is:
#define PPC_FEATURE_PPC_LE 0x00000001
Which says the CPU supports the old style "PPC Little Endian" mode. Again this should be harmless in practice as no 64-bit CPUs implement that mode.
Fix the code by adding the missing initialisation of the MMU feature.
Also add a comment marking CPU user feature bit 2 (0x4) as reserved. It would be unsafe to start using it as old kernels incorrectly set it.
--- arch/powerpc/include/uapi/asm/cputable.h | 1 + arch/powerpc/kernel/prom.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
arch/powerpc/include/uapi/asm/cputable.h +1 -0
@@ -31,6 +31,7 @@#define PPC_FEATURE_PSERIES_PERFMON_COMPAT \ 0x00000040 +/* Reserved - do not use 0x00000004 */ #define PPC_FEATURE_TRUE_LE 0x00000002#define PPC_FEATURE_PPC_LE 0x00000001
arch/powerpc/kernel/prom.c +1 -1
@@ -158,7 +158,7 @@ static struct ibm_pa_feature { {CPU_FTR_NOEXECUTE, 0, 0, 0, 6, 0}, {CPU_FTR_NODSISRALIGN, 0, 0, 1, 1, 1}, {0, MMU_FTR_CI_LARGE_PAGE, 0, 1, 2, 0}, - {CPU_FTR_REAL_LE, PPC_FEATURE_TRUE_LE, 5, 0, 0}, + {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 5, 0, 0},/* * If the kernel doesn't support TM (ie. CONFIG_PPC_TRANSACTIONAL_MEM=n), * we don't want to turn on CPU_FTR_TM here, so we use CPU_FTR_TM_COMP
Greg Kroah-Hartman
maintainerPATCH 65/200 powerpc: Update cpu_user_features2 in scan_features()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit beff82374b259d726e2625ec6c518a5f2613f0ae upstream.
scan_features() updates cpu_user_features but not cpu_user_features2.
Amongst other things, cpu_user_features2 contains the user TM feature bits which we must keep in sync with the kernel TM feature bit.
--- arch/powerpc/kernel/prom.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
arch/powerpc/kernel/prom.c +11 -8
@@ -148,23 +148,24 @@ static struct ibm_pa_feature {unsigned long cpu_features;/* CPU_FTR_xxx bit */ unsigned long mmu_features;/* MMU_FTR_xxx bit */ unsigned int cpu_user_ftrs;/* PPC_FEATURE_xxx bit */ +unsigned int cpu_user_ftrs2;/* PPC_FEATURE2_xxx bit */ unsigned char pabyte;/* byte number in ibm,pa-features */ unsigned char pabit;/* bit number (big-endian) */ unsigned char invert;/* if 1, pa bit set => clear feature */ } ibm_pa_features[] __initdata = { - {0, 0, PPC_FEATURE_HAS_MMU, 0, 0, 0}, - {0, 0, PPC_FEATURE_HAS_FPU, 0, 1, 0}, - {CPU_FTR_CTRL, 0, 0, 0, 3, 0}, - {CPU_FTR_NOEXECUTE, 0, 0, 0, 6, 0}, - {CPU_FTR_NODSISRALIGN, 0, 0, 1, 1, 1}, - {0, MMU_FTR_CI_LARGE_PAGE, 0, 1, 2, 0}, - {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 5, 0, 0}, + {0, 0, PPC_FEATURE_HAS_MMU, 0, 0, 0, 0}, + {0, 0, PPC_FEATURE_HAS_FPU, 0, 0, 1, 0}, + {CPU_FTR_CTRL, 0, 0, 0, 0, 3, 0}, + {CPU_FTR_NOEXECUTE, 0, 0, 0, 0, 6, 0}, + {CPU_FTR_NODSISRALIGN, 0, 0, 0, 1, 1, 1}, + {0, MMU_FTR_CI_LARGE_PAGE, 0, 0, 1, 2, 0}, + {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 0, 5, 0, 0}, /* * If the kernel doesn't support TM (ie. CONFIG_PPC_TRANSACTIONAL_MEM=n), * we don't want to turn on CPU_FTR_TM here, so we use CPU_FTR_TM_COMP * which is 0 if the kernel doesn't support TM. */ - {CPU_FTR_TM_COMP, 0, 0, 22, 0, 0}, + {CPU_FTR_TM_COMP, 0, 0, 0, 22, 0, 0}, }; static void __init scan_features(unsigned long node, const unsigned char *ftrs,
@@ -195,10 +196,12 @@ static void __init scan_features(unsigneif (bit ^ fp->invert) { cur_cpu_spec->cpu_features |= fp->cpu_features; cur_cpu_spec->cpu_user_features |= fp->cpu_user_ftrs; + cur_cpu_spec->cpu_user_features2 |= fp->cpu_user_ftrs2; cur_cpu_spec->mmu_features |= fp->mmu_features; }else { cur_cpu_spec->cpu_features &= ~fp->cpu_features; cur_cpu_spec->cpu_user_features &= ~fp->cpu_user_ftrs; + cur_cpu_spec->cpu_user_features2 &= ~fp->cpu_user_ftrs2; cur_cpu_spec->mmu_features &= ~fp->mmu_features; } }
Greg Kroah-Hartman
maintainerPATCH 66/200 powerpc: Update TM user feature bits in scan_features()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 4705e02498d6d5a7ab98dfee9595cd5e91db2017 upstream.
We need to update the user TM feature bits (PPC_FEATURE2_HTM and PPC_FEATURE2_HTM) to mirror what we do with the kernel TM feature bit.
At the moment, if firmware reports TM is not available we turn off the kernel TM feature bit but leave the userspace ones on. Userspace thinks it can execute TM instructions and it dies trying.
This (together with a QEMU patch) fixes PR KVM, which doesn't currently support TM.
--- arch/powerpc/kernel/prom.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/powerpc/kernel/prom.c +5 -4
@@ -161,11 +161,12 @@ static struct ibm_pa_feature { {0, MMU_FTR_CI_LARGE_PAGE, 0, 0, 1, 2, 0}, {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 0, 5, 0, 0},/* -* If the kernel doesn't support TM (ie. CONFIG_PPC_TRANSACTIONAL_MEM=n), -* we don't want to turn on CPU_FTR_TM here, so we use CPU_FTR_TM_COMP -* which is 0 if the kernel doesn't support TM. +* If the kernel doesn't support TM (ie CONFIG_PPC_TRANSACTIONAL_MEM=n), +* we don't want to turn on TM here, so we use the *_COMP versions +* which are 0 if the kernel doesn't support TM. */ - {CPU_FTR_TM_COMP, 0, 0, 0, 22, 0, 0}, + {CPU_FTR_TM_COMP, 0, 0, + PPC_FEATURE2_HTM_COMP|PPC_FEATURE2_HTM_NOSC_COMP, 22, 0, 0}, }; static void __init scan_features(unsigned long node, const unsigned char *ftrs,
Greg Kroah-Hartman
maintainerPATCH 67/200 nl80211: check netlink protocol in socket release notification
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Ivanov <[email protected]>
commit 8f815cdde3e550e10c2736990d791f60c2ce43eb upstream.
A non-privileged user can create a netlink socket with the same port_id as used by an existing open nl80211 netlink socket (e.g. as used by a hostapd process) with a different protocol number.
Closing this socket will then lead to the notification going to nl80211's socket release notification handler, and possibly cause an action such as removing a virtual interface.
Fix this issue by checking that the netlink protocol is NETLINK_GENERIC. Since generic netlink has no notifier chain of its own, we can't fix the problem more generically.
--- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/nl80211.c +1 -1
@@ -13201,7 +13201,7 @@ static int nl80211_netlink_notify(structstruct wireless_dev *wdev;struct cfg80211_beacon_registration *reg, *tmp; -if (state !=NETLINK_URELEASE ) +if (state !=NETLINK_URELEASE || notify->protocol !=NETLINK_GENERIC )return NOTIFY_DONE ;rcu_read_lock ();
Greg Kroah-Hartman
maintainerPATCH 68/200 netlink: dont send NETLINK_URELEASE for unbound sockets
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Ivanov <[email protected]>
commit e27260203912b40751fa353d009eaa5a642c739f upstream.
All existing users of NETLINK_URELEASE use it to clean up resources that were previously allocated to a socket via some command. As a result, no users require getting this notification for unbound sockets.
Sending it for unbound sockets, however, is a problem because any user (including unprivileged users) can create a socket that uses the same ID as an existing socket. Binding this new socket will fail, but if the NETLINK_URELEASE notification is generated for such sockets, the users thereof will be tricked into thinking the socket that they allocated the resources for is closed.
In the nl80211 case, this will cause destruction of virtual interfaces that still belong to an existing hostapd process; this is the case that Dmitry noticed. In the NFC case, it will cause a poll abort. In the case of netlink log/queue it will cause them to stop reporting events, as if NFULNL_CFG_CMD_UNBIND/NFQNL_CFG_CMD_UNBIND had been called.
Fix this problem by checking that the socket is bound before generating the NETLINK_URELEASE notification.
--- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netlink/af_netlink.c +1 -1
@@ -1305,7 +1305,7 @@ static int netlink_release(struct socketskb_queue_purge (&sk->sk_write_queue); -if (nlk->portid) { +if (nlk->portid && nlk->bound) {struct netlink_notify n = { .net =sock_net (sk), .protocol = sk->sk_protocol,
Greg Kroah-Hartman
maintainerPATCH 69/200 Input: gtco - fix crash on detecting device without endpoints
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladis Dronov <[email protected]>
commit 162f98dea487206d9ab79fc12ed64700667a894d upstream.
The gtco driver expects at least one valid endpoint. If given malicious descriptors that specify 0 for the number of endpoints, it will crash in the probe function. Ensure there is at least one endpoint on the interface before using it.
Also let's fix a minor coding style issue.
The full correct report of this issue can be found in the public Red Hat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=1283385
--- drivers/input/tablet/gtco.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/input/tablet/gtco.c +9 -1
@@ -858,6 +858,14 @@ static int gtco_probe(struct usb_interfa goto err_free_buf; } +/* Sanity check that a device has an endpoint */ +if (usbinterface->altsetting[0 ].desc.bNumEndpoints <1 ) { +dev_err (&usbinterface->dev, +"Invalid number of endpoints\n" ); + error = -EINVAL ; + goto err_free_urb; + } +/* * The endpoint is always altsetting 0, we know this since we know * this device only has one interrupt endpoint
@@ -879,7 +887,7 @@ static int gtco_probe(struct usb_interfa* HID report descriptor */ if (usb_get_extra_descriptor (usbinterface->cur_altsetting, -HID_DEVICE_TYPE , &hid_desc) !=0 ){ +HID_DEVICE_TYPE , &hid_desc) !=0 ) {dev_err (&usbinterface->dev,"Can't retrieve exta USB descriptor to get hid report descriptor length\n" ); error = -EIO ;
Greg Kroah-Hartman
maintainerPATCH 70/200 Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
commit eda5ecc0a6b865561997e177c393f0b0136fe3b7 upstream.
The trigger delay algorithm that converts from microseconds to the register value looks incorrect. According to most of the PMIC documentation, the equation is
delay (Seconds) = (1 / 1024) * 2 ^ (x + 4)
except for one case where the documentation looks to have a formatting issue and the equation looks like
delay (Seconds) = (1 / 1024) * 2 x + 4
Most likely this driver was written with the improper documentation to begin with. According to the downstream sources the valid delays are from 2 seconds to 1/64 second, and the latter equation just doesn't make sense for that. Let's fix the algorithm and the range check to match the documentation and the downstream sources.
--- drivers/input/misc/pmic8xxx-pwrkey.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/input/misc/pmic8xxx-pwrkey.c +4 -3
@@ -353,7 +353,8 @@ static int pmic8xxx_pwrkey_probe(structif (of_property_read_u32 (pdev->dev.of_node,"debounce" , &kpd_delay)) kpd_delay =15625 ; -if (kpd_delay >62500 || kpd_delay ==0 ) { +/* Valid range of pwr key trigger delay is 1/64 sec to 2 seconds. */ +if (kpd_delay >USEC_PER_SEC *2 || kpd_delay <USEC_PER_SEC /64 ) {dev_err (&pdev->dev,"invalid power key trigger delay\n" );return -EINVAL ; }
@@ -385,8 +386,8 @@ static int pmic8xxx_pwrkey_probe(struct pwr->name ="pmic8xxx_pwrkey" ; pwr->phys ="pmic8xxx_pwrkey/input0" ; - delay = (kpd_delay <<10 ) /USEC_PER_SEC ; - delay =1 +ilog2 (delay); + delay = (kpd_delay <<6 ) /USEC_PER_SEC ; + delay =ilog2 (delay); err =regmap_read (regmap,PON_CNTL_1 , &pon_cntl);if (err <0 ) {
Greg Kroah-Hartman
maintainerPATCH 71/200 xen kconfig: dont "select INPUT_XEN_KBDDEV_FRONTEND"
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 13aa38e291bdd4e4018f40dd2f75e464814dcbf3 upstream.
The Xen framebuffer driver selects the xen keyboard driver, so the latter will be built-in if XEN_FBDEV_FRONTEND=y. However, when CONFIG_INPUT is a loadable module, this configuration cannot work. On mainline kernels, the symbol will be enabled but not used, while in combination with a patch I have to detect such useless configurations, we get the expected link failure:
drivers/input/built-in.o: In function `xenkbd_remove':
xen-kbdfront.c:(.text+0x2f0): undefined reference to input_unregister_device' xen-kbdfront.c:(.text+0x30e): undefined reference to input_unregister_device'
This removes the extra "select", as it just causes more trouble than it helps. In theory, some defconfig file might break if it has XEN_FBDEV_FRONTEND in it but not INPUT_XEN_KBDDEV_FRONTEND. The Kconfig fragment we ship in the kernel (kernel/configs/xen.config) however already enables both, and anyone using an old .config file would keep having both enabled.
--- drivers/video/fbdev/Kconfig | 1 - 1 file changed, 1 deletion(-)
drivers/video/fbdev/Kconfig +0 -1
@@ -2246,7 +2246,6 @@ config XEN_FBDEV_FRONTEND select FB_SYS_IMAGEBLIT select FB_SYS_FOPS select FB_DEFERRED_IO - select INPUT_XEN_KBDDEV_FRONTEND if INPUT_MISC select XEN_XENBUS_FRONTEND default y help
Greg Kroah-Hartman
maintainerPATCH 72/200 pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yingjoe Chen <[email protected]>
commit 5fedbb923936174ab4d1d5cc92bca1cf6b2e0ca2 upstream.
The debounce time unit for gpio_chip.set_debounce is us but mtk_gpio_set_debounce regard it as ms.
Fix this by correct debounce time array dbnc_arr so it can find correct debounce setting. Debounce time for first debounce setting is 500us, correct this as well.
While I'm at it, also change the debounce time array name to "debounce_time" for readability.
--- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/pinctrl/mediatek/pinctrl-mtk-common.c +5 -4
@@ -949,7 +949,8 @@ static int mtk_gpio_set_debounce(structstruct mtk_pinctrl *pctl =dev_get_drvdata (chip->parent);int eint_num, virq, eint_offset;unsigned int set_offset, bit, clr_bit, clr_offset, rst, i, unmask, dbnc; -static const unsigned int dbnc_arr[] = {0 ,1 ,16 ,32 ,64 ,128 ,256 }; +static const unsigned int debounce_time[] = {500 ,1000 ,16000 ,32000 ,64000 , +128000 ,256000 };const struct mtk_desc_pin *pin;struct irq_data *d;
@@ -967,9 +968,9 @@ static int mtk_gpio_set_debounce(structif (!mtk_eint_can_en_debounce (pctl, eint_num))return -ENOSYS ; - dbnc =ARRAY_SIZE (dbnc_arr); -for (i =0 ; i <ARRAY_SIZE (dbnc_arr); i++) { -if (debounce <= dbnc_arr[i]) { + dbnc =ARRAY_SIZE (debounce_time); +for (i =0 ; i <ARRAY_SIZE (debounce_time); i++) { +if (debounce <= debounce_time[i]) { dbnc = i;break ; }
Greg Kroah-Hartman
maintainerPATCH 73/200 pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keerthy <[email protected]>
commit 56b367c0cd67d4c3006738e7dc9dda9273fd2bfe upstream.
pcs_parse_bits_in_pinctrl_entry uses ffs which gives bit indices ranging from 1 to MAX. This leads to a corner case where we try to request the pin number = MAX and fails.
bit_pos value is being calculted using ffs. pin_num_from_lsb uses bit_pos value. pins array is populated with:
pin + pin_num_from_lsb.
The above is 1 more than usual bit indices as bit_pos uses ffs to compute first set bit. Hence the last of the pins array is populated with the MAX value and not MAX - 1 which causes error when we call pin_request.
mask_pos is rightly calculated as ((pcs->fmask) << (bit_pos - 1)) Consequently val_pos and submask are correct.
Hence use __ffs which gives (ffs(x) - 1) as the first bit set.
--- drivers/pinctrl/pinctrl-single.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pinctrl/pinctrl-single.c +3 -3
@@ -1273,9 +1273,9 @@ static int pcs_parse_bits_in_pinctrl_ent/* Parse pins in each row from LSB */ while (mask) { - bit_pos =ffs (mask); + bit_pos =__ffs (mask); pin_num_from_lsb = bit_pos / pcs->bits_per_pin; - mask_pos = ((pcs->fmask) << (bit_pos -1 )); + mask_pos = ((pcs->fmask) << bit_pos); val_pos = val & mask_pos; submask = mask & mask_pos;
@@ -1844,7 +1844,7 @@ static int pcs_probe(struct platform_dev ret =of_property_read_u32 (np,"pinctrl-single,function-mask" , &pcs->fmask);if (!ret) { - pcs->fshift =ffs (pcs->fmask) -1 ; + pcs->fshift =__ffs (pcs->fmask); pcs->fmax = pcs->fmask >> pcs->fshift; }else {/* If mask property doesn't exist, function mux is invalid. */
Greg Kroah-Hartman
maintainerPATCH 74/200 iommu/amd: Fix checking of pci dma aliases
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <[email protected]>
commit e3156048346c28c695f5cf9db67a8cf88c90f947 upstream.
Commit 61289cb ('iommu/amd: Remove old alias handling code') removed the old alias handling code from the AMD IOMMU driver because this is now handled by the IOMMU core code.
But this also removed the handling of PCI aliases, which is not handled by the core code. This caused issues with PCI devices that have hidden PCIe-to-PCI bridges that rewrite the request-id.
Fix this bug by re-introducing some of the removed functions from commit 61289cbaf6c8 and add a alias field 'struct iommu_dev_data'. This field carrys the return value of the get_alias() function and uses that instead of the amd_iommu_alias_table[] array in the code.
--- drivers/iommu/amd_iommu.c | 87 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 76 insertions(+), 11 deletions(-)
drivers/iommu/amd_iommu.c +76 -11
@@ -92,6 +92,7 @@ struct iommu_dev_data {struct list_head dev_data_list;/* For global dev_data_list */ struct protection_domain *domain;/* Domain the device is bound to */ u16 devid;/* PCI Device ID */ +u16 alias;/* Alias Device ID */ bool iommu_v2;/* Device can make use of IOMMUv2 */ bool passthrough;/* Device is identity mapped */ struct {
@@ -166,6 +167,13 @@ static struct protection_domain *to_pdom return container_of(dom, struct protection_domain, domain); } +static inline u16 get_device_id (struct device *dev) +{ +struct pci_dev *pdev =to_pci_dev (dev); + +return PCI_DEVID (pdev->bus->number, pdev->devfn); +} +static struct iommu_dev_data *alloc_dev_data (u16 devid) {struct iommu_dev_data *dev_data;
@@ -203,6 +211,68 @@ out_unlock:return dev_data; } +static int __last_alias (struct pci_dev *pdev,u16 alias,void *data) +{ + *(u16 *)data = alias; +return 0 ; +} + +static u16 get_alias (struct device *dev) +{ +struct pci_dev *pdev =to_pci_dev (dev); +u16 devid, ivrs_alias, pci_alias; + + devid =get_device_id (dev); + ivrs_alias = amd_iommu_alias_table[devid]; +pci_for_each_dma_alias (pdev, __last_alias, &pci_alias); + +if (ivrs_alias == pci_alias) +return ivrs_alias; + +/* +* DMA alias showdown +* +* The IVRS is fairly reliable in telling us about aliases, but it +* can't know about every screwy device. If we don't have an IVRS +* reported alias, use the PCI reported alias. In that case we may +* still need to initialize the rlookup and dev_table entries if the +* alias is to a non-existent device. +*/ +if (ivrs_alias == devid) { +if (!amd_iommu_rlookup_table[pci_alias]) { + amd_iommu_rlookup_table[pci_alias] = + amd_iommu_rlookup_table[devid]; +memcpy (amd_iommu_dev_table[pci_alias].data, + amd_iommu_dev_table[devid].data, +sizeof (amd_iommu_dev_table[pci_alias].data)); + } + +return pci_alias; + } + +pr_info ("AMD-Vi: Using IVRS reported alias %02x:%02x.%d " +"for device %s[%04x:%04x], kernel reported alias " +"%02x:%02x.%d\n" ,PCI_BUS_NUM (ivrs_alias),PCI_SLOT (ivrs_alias), +PCI_FUNC (ivrs_alias),dev_name (dev), pdev->vendor, pdev->device, +PCI_BUS_NUM (pci_alias),PCI_SLOT (pci_alias), +PCI_FUNC (pci_alias)); + +/* +* If we don't have a PCI DMA alias and the IVRS alias is on the same +* bus, then the IVRS table may know about a quirk that we don't. +*/ +if (pci_alias == devid && +PCI_BUS_NUM (ivrs_alias) == pdev->bus->number) { + pdev->dev_flags |=PCI_DEV_FLAGS_DMA_ALIAS_DEVFN ; + pdev->dma_alias_devfn = ivrs_alias &0xff ; +pr_info ("AMD-Vi: Added PCI DMA alias %02x.%d for %s\n" , +PCI_SLOT (ivrs_alias),PCI_FUNC (ivrs_alias), +dev_name (dev)); + } + +return ivrs_alias; +} +static struct iommu_dev_data *find_dev_data (u16 devid) {struct iommu_dev_data *dev_data;
@@ -215,13 +285,6 @@ static struct iommu_dev_data *find_dev_dreturn dev_data; } -static inline u16 get_device_id (struct device *dev) -{ -struct pci_dev *pdev =to_pci_dev (dev); - -return PCI_DEVID (pdev->bus->number, pdev->devfn); -} -static struct iommu_dev_data *get_dev_data (struct device *dev) {return dev->archdata.iommu;
@@ -349,6 +412,8 @@ static int iommu_init_device(struct deviif (!dev_data)return -ENOMEM ; + dev_data->alias =get_alias (dev); +if (pci_iommuv2_capable (pdev)) {struct amd_iommu *iommu;
@@ -369,7 +434,7 @@ static void iommu_ignore_device(struct du16 devid, alias; devid =get_device_id (dev); - alias = amd_iommu_alias_table[devid]; + alias =get_alias (dev);memset (&amd_iommu_dev_table[devid],0 ,sizeof (struct dev_table_entry ));memset (&amd_iommu_dev_table[alias],0 ,sizeof (struct dev_table_entry ));
@@ -1061,7 +1126,7 @@ static int device_flush_dte(struct iommuint ret; iommu = amd_iommu_rlookup_table[dev_data->devid]; - alias = amd_iommu_alias_table[dev_data->devid]; + alias = dev_data->alias; ret =iommu_flush_dte (iommu, dev_data->devid);if (!ret && alias != dev_data->devid)
@@ -2039,7 +2104,7 @@ static void do_attach(struct iommu_dev_dbool ats; iommu = amd_iommu_rlookup_table[dev_data->devid]; - alias = amd_iommu_alias_table[dev_data->devid]; + alias = dev_data->alias; ats = dev_data->ats.enabled;/* Update data structures */
@@ -2073,7 +2138,7 @@ static void do_detach(struct iommu_dev_dreturn ; iommu = amd_iommu_rlookup_table[dev_data->devid]; - alias = amd_iommu_alias_table[dev_data->devid]; + alias = dev_data->alias;/* decrease reference counters */ dev_data->domain->dev_iommu[iommu->index] -=1 ;
Greg Kroah-Hartman
maintainerPATCH 75/200 iommu/dma: Restore scatterlist offsets correctly
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
commit 07b48ac4bbe527e68cfc555f2b2b206908437141 upstream.
With the change to stashing just the IOVA-page-aligned remainder of the CPU-page offset rather than the whole thing, the failure path in __invalidate_sg() also needs tweaking to account for that in the case of differing page sizes where the two offsets may not be equivalent. Similarly in __finalise_sg(), lest the architecture-specific wrappers later get the wrong address for cache maintenance on sync or unmap.
--- drivers/iommu/dma-iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/dma-iommu.c +2 -2
@@ -403,7 +403,7 @@ static int __finalise_sg(struct device *unsigned int s_length =sg_dma_len (s);unsigned int s_dma_len = s->length; - s->offset = s_offset; + s->offset += s_offset; s->length = s_length;sg_dma_address (s) = dma_addr + s_offset; dma_addr += s_dma_len;
@@ -422,7 +422,7 @@ static void __invalidate_sg(struct scattfor_each_sg (sg, s, nents, i) {if (sg_dma_address (s) !=DMA_ERROR_CODE ) - s->offset =sg_dma_address (s); + s->offset +=sg_dma_address (s);if (sg_dma_len (s)) s->length =sg_dma_len (s);sg_dma_address (s) =DMA_ERROR_CODE ;
Greg Kroah-Hartman
maintainerPATCH 77/200 drm/amdgpu: use defines for CRTCs and AMFT blocks
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 3ea25f858fd5aeee888059952bbb8e910541eebb upstream.
Prerequiste for the next patch which ups the limits.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h +2 -2
@@ -309,8 +309,8 @@ struct amdgpu_mode_info {struct atom_context *atom_context;struct card_info *atom_card_info;bool mode_config_initialized; -struct amdgpu_crtc *crtcs[6 ]; -struct amdgpu_afmt *afmt[7 ]; +struct amdgpu_crtc *crtcs[AMDGPU_MAX_CRTCS ]; +struct amdgpu_afmt *afmt[AMDGPU_MAX_AFMT_BLOCKS ];/* DVI-I properties */ struct drm_property *coherent_mode_property;/* DAC enable load detect */
Greg Kroah-Hartman
maintainerPATCH 78/200 drm/amdgpu: bump the afmt limit for CZ, ST, Polaris
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 83c5cda2ccf40a7a7e4bb674321509b346e23d5a upstream.
Fixes array overflow on these chips.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h +1 -1
@@ -53,7 +53,7 @@ struct amdgpu_hpd;#define AMDGPU_MAX_HPD_PINS 6#define AMDGPU_MAX_CRTCS 6 -#define AMDGPU_MAX_AFMT_BLOCKS 7 +#define AMDGPU_MAX_AFMT_BLOCKS 9enum amdgpu_rmx_type {RMX_OFF ,
Greg Kroah-Hartman
maintainerPATCH 79/200 amdgpu/uvd: add uvd fw version for amdgpu
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sonny Jiang <[email protected]>
commit 562e2689baebaa2ac25b7ec934385480ed1cb7d6 upstream.
Was previously always hardcoded to 0.
--- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu.h +1 -0
@@ -1619,6 +1619,7 @@ struct amdgpu_uvd {struct amdgpu_bo *vcpu_bo;void *cpu_addr;uint64_t gpu_addr; +unsigned fw_version;atomic_t handles[AMDGPU_MAX_UVD_HANDLES ];struct drm_file *filp[AMDGPU_MAX_UVD_HANDLES ];struct delayed_work idle_work;
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +1 -1
@@ -303,7 +303,7 @@ static int amdgpu_info_ioctl(struct drm_ fw_info.feature = adev->vce.fb_version;break ;case AMDGPU_INFO_FW_UVD : - fw_info.ver =0 ; + fw_info.ver = adev->uvd.fw_version; fw_info.feature =0 ;break ;case AMDGPU_INFO_FW_GMC :
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +3 -0
@@ -156,6 +156,9 @@ int amdgpu_uvd_sw_init(struct amdgpu_devDRM_INFO ("Found UVD firmware Version: %hu.%hu Family ID: %hu\n" , version_major, version_minor, family_id); + adev->uvd.fw_version = ((version_major <<24 ) | (version_minor <<16 ) | + (family_id <<8 )); + bo_size =AMDGPU_GPU_PAGE_ALIGN (le32_to_cpu (hdr->ucode_size_bytes) +8 ) +AMDGPU_UVD_STACK_SIZE +AMDGPU_UVD_HEAP_SIZE ; r = amdgpu_bo_create(adev, bo_size, PAGE_SIZE, true,
Greg Kroah-Hartman
maintainerPATCH 80/200 drm/amdgpu: fix regression on CIK (v2)
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grigori Goronzy <[email protected]>
This fix was written against drm-next, but when it was backported to 4.5 as a stable fix, the driver internal structure change was missed. Fix that up here to avoid a hang due to waiting for the wrong sequence number.
v2: agd: fix up commit message
--- drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +1 -1
@@ -3628,7 +3628,7 @@ static void gfx_v7_0_ring_emit_vm_flush( unsigned vm_id, uint64_t pd_addr) { int usepfp = (ring->type == AMDGPU_RING_TYPE_GFX); -uint32_t seq = ring->fence_drv.sync_seq; +uint32_t seq = ring->fence_drv.sync_seq[ring->idx];uint64_t addr = ring->fence_drv.gpu_addr;amdgpu_ring_write (ring,PACKET3 (PACKET3_WAIT_REG_MEM ,5 ));
Greg Kroah-Hartman
maintainerPATCH 81/200 drm/radeon: add a quirk for a XFX R9 270X
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit bcb31eba4a4ea356fd61cbd5dec5511c3883f57e upstream.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=76490
--- drivers/gpu/drm/radeon/si_dpm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/si_dpm.c +1 -0
@@ -2931,6 +2931,7 @@ static struct si_dpm_quirk si_dpm_quirk_ { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 }, { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 }, { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6810, 0x1682, 0x9275, 0, 120000 }, { 0, 0, 0, 0 }, };
Greg Kroah-Hartman
maintainerPATCH 82/200 drm/radeon: fix initial connector audio value
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 7403c515c49c033fec33df0814fffdc977e6acdc upstream.
This got lost somewhere along the way. This fixes audio not working until set_property was called.
--- drivers/gpu/drm/radeon/radeon_connectors.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_connectors.c +6 -1
@@ -1996,10 +1996,12 @@ radeon_add_atom_connector(struct drm_dev rdev->mode_info.dither_property, RADEON_FMT_DITHER_DISABLE); -if (radeon_audio !=0 ) +if (radeon_audio !=0 ) {drm_object_attach_property (&radeon_connector->base.base, rdev->mode_info.audio_property,RADEON_AUDIO_AUTO ); + radeon_connector->audio =RADEON_AUDIO_AUTO ; + }if (ASIC_IS_DCE5 (rdev)) drm_object_attach_property(&radeon_connector->base.base, rdev->mode_info.output_csc_property,
@@ -2124,6 +2126,7 @@ radeon_add_atom_connector(struct drm_devdrm_object_attach_property (&radeon_connector->base.base, rdev->mode_info.audio_property,RADEON_AUDIO_AUTO ); + radeon_connector->audio =RADEON_AUDIO_AUTO ; }if (connector_type ==DRM_MODE_CONNECTOR_DVII ) { radeon_connector->dac_load_detect = true;
@@ -2179,6 +2182,7 @@ radeon_add_atom_connector(struct drm_devdrm_object_attach_property (&radeon_connector->base.base, rdev->mode_info.audio_property,RADEON_AUDIO_AUTO ); + radeon_connector->audio =RADEON_AUDIO_AUTO ; }if (ASIC_IS_DCE5 (rdev)) drm_object_attach_property(&radeon_connector->base.base,
@@ -2231,6 +2235,7 @@ radeon_add_atom_connector(struct drm_devdrm_object_attach_property (&radeon_connector->base.base, rdev->mode_info.audio_property,RADEON_AUDIO_AUTO ); + radeon_connector->audio =RADEON_AUDIO_AUTO ; }if (ASIC_IS_DCE5 (rdev)) drm_object_attach_property(&radeon_connector->base.base,
Greg Kroah-Hartman
maintainerPATCH 84/200 drm/radeon: fix vertical bars appear on monitor (v2)
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Prosyak <[email protected]>
commit 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 upstream.
When crtc/timing is disabled on boot the dig block should be stopped in order ignore timing from crtc, reset the steering fifo otherwise we get display corruption or hung in dp sst mode.
v2: agd: fix coding style
--- drivers/gpu/drm/radeon/evergreen.c | 154 ++++++++++++++++++++++++++++++++- drivers/gpu/drm/radeon/evergreen_reg.h | 46 +++++++++ 2 files changed, 199 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/evergreen.c +153 -1
@@ -2608,10 +2608,152 @@ static void evergreen_agp_enable(structWREG32 (VM_CONTEXT1_CNTL ,0 ); } +static const unsigned ni_dig_offsets[] = +{ +NI_DIG0_REGISTER_OFFSET , +NI_DIG1_REGISTER_OFFSET , +NI_DIG2_REGISTER_OFFSET , +NI_DIG3_REGISTER_OFFSET , +NI_DIG4_REGISTER_OFFSET , +NI_DIG5_REGISTER_OFFSET +}; + +static const unsigned ni_tx_offsets[] = +{ +NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1 , +NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1 , +NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1 , +NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1 , +NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1 , +NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1 +}; + +static const unsigned evergreen_dp_offsets[] = +{ +EVERGREEN_DP0_REGISTER_OFFSET , +EVERGREEN_DP1_REGISTER_OFFSET , +EVERGREEN_DP2_REGISTER_OFFSET , +EVERGREEN_DP3_REGISTER_OFFSET , +EVERGREEN_DP4_REGISTER_OFFSET , +EVERGREEN_DP5_REGISTER_OFFSET +}; + + +/* +* Assumption is that EVERGREEN_CRTC_MASTER_EN enable for requested crtc +* We go from crtc to connector and it is not relible since it +* should be an opposite direction .If crtc is enable then +* find the dig_fe which selects this crtc and insure that it enable. +* if such dig_fe is found then find dig_be which selects found dig_be and +* insure that it enable and in DP_SST mode. +* if UNIPHY_PLL_CONTROL1.enable then we should disconnect timing +* from dp symbols clocks . +*/ +static bool evergreen_is_dp_sst_stream_enabled (struct radeon_device *rdev, +unsigned crtc_id,unsigned *ret_dig_fe) +{ +unsigned i; +unsigned dig_fe; +unsigned dig_be; +unsigned dig_en_be; +unsigned uniphy_pll; +unsigned digs_fe_selected; +unsigned dig_be_mode; +unsigned dig_fe_mask; +bool is_enabled = false; +bool found_crtc = false; + +/* loop through all running dig_fe to find selected crtc */ +for (i =0 ; i <ARRAY_SIZE (ni_dig_offsets); i++) { + dig_fe =RREG32 (NI_DIG_FE_CNTL + ni_dig_offsets[i]); +if (dig_fe &NI_DIG_FE_CNTL_SYMCLK_FE_ON && + crtc_id ==NI_DIG_FE_CNTL_SOURCE_SELECT (dig_fe)) { +/* found running pipe */ + found_crtc = true; + dig_fe_mask =1 << i; + dig_fe = i; +break ; + } + } + +if (found_crtc) { +/* loop through all running dig_be to find selected dig_fe */ +for (i =0 ; i <ARRAY_SIZE (ni_dig_offsets); i++) { + dig_be =RREG32 (NI_DIG_BE_CNTL + ni_dig_offsets[i]); +/* if dig_fe_selected by dig_be? */ + digs_fe_selected =NI_DIG_BE_CNTL_FE_SOURCE_SELECT (dig_be); + dig_be_mode =NI_DIG_FE_CNTL_MODE (dig_be); +if (dig_fe_mask & digs_fe_selected && +/* if dig_be in sst mode? */ + dig_be_mode ==NI_DIG_BE_DPSST ) { + dig_en_be =RREG32 (NI_DIG_BE_EN_CNTL + + ni_dig_offsets[i]); + uniphy_pll =RREG32 (NI_DCIO_UNIPHY0_PLL_CONTROL1 + + ni_tx_offsets[i]); +/* dig_be enable and tx is running */ +if (dig_en_be &NI_DIG_BE_EN_CNTL_ENABLE && + dig_en_be &NI_DIG_BE_EN_CNTL_SYMBCLK_ON && + uniphy_pll &NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE ) { + is_enabled = true; + *ret_dig_fe = dig_fe; +break ; + } + } + } + } + +return is_enabled; +} + +/* +* Blank dig when in dp sst mode +* Dig ignores crtc timing +*/ +static void evergreen_blank_dp_output (struct radeon_device *rdev, +unsigned dig_fe) +{ +unsigned stream_ctrl; +unsigned fifo_ctrl; +unsigned counter =0 ; + +if (dig_fe >=ARRAY_SIZE (evergreen_dp_offsets)) { +DRM_ERROR ("invalid dig_fe %d\n" , dig_fe); +return ; + } + + stream_ctrl =RREG32 (EVERGREEN_DP_VID_STREAM_CNTL + + evergreen_dp_offsets[dig_fe]); +if (!(stream_ctrl &EVERGREEN_DP_VID_STREAM_CNTL_ENABLE )) { +DRM_ERROR ("dig %d , should be enable\n" , dig_fe); +return ; + } + + stream_ctrl &=~EVERGREEN_DP_VID_STREAM_CNTL_ENABLE ; +WREG32 (EVERGREEN_DP_VID_STREAM_CNTL + + evergreen_dp_offsets[dig_fe], stream_ctrl); + + stream_ctrl =RREG32 (EVERGREEN_DP_VID_STREAM_CNTL + + evergreen_dp_offsets[dig_fe]); +while (counter <32 && stream_ctrl &EVERGREEN_DP_VID_STREAM_STATUS ) { +msleep (1 ); + counter++; + stream_ctrl =RREG32 (EVERGREEN_DP_VID_STREAM_CNTL + + evergreen_dp_offsets[dig_fe]); + } +if (counter >=32 ) +DRM_ERROR ("counter exceeds %d\n" , counter); + + fifo_ctrl =RREG32 (EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe]); + fifo_ctrl |=EVERGREEN_DP_STEER_FIFO_RESET ; +WREG32 (EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe], fifo_ctrl); + +} +void evergreen_mc_stop (struct radeon_device *rdev,struct evergreen_mc_save *save) {u32 crtc_enabled, tmp, frame_count, blackout;int i, j; +unsigned dig_fe;if (!ASIC_IS_NODCE (rdev)) { save->vga_render_control =RREG32 (VGA_RENDER_CONTROL );
@@ -2651,7 +2793,17 @@ void evergreen_mc_stop(struct radeon_devbreak ;udelay (1 ); } - +/*we should disable dig if it drives dp sst*/ +/*but we are in radeon_device_init and the topology is unknown*/ +/*and it is available after radeon_modeset_init*/ +/*the following method radeon_atom_encoder_dpms_dig*/ +/*does the job if we initialize it properly*/ +/*for now we do it this manually*/ +/**/ +if (ASIC_IS_DCE5 (rdev) && +evergreen_is_dp_sst_stream_enabled (rdev, i ,&dig_fe)) +evergreen_blank_dp_output (rdev, dig_fe); +/*we could remove 6 lines below*/ /* XXX this is a hack to avoid strange behavior with EFI on certain systems */ WREG32 (EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i],1 ); tmp =RREG32 (EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
drivers/gpu/drm/radeon/evergreen_reg.h +46 -0
58 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 85/200 drm: Loongson-3 doesnt fully support wc memory
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 221004c66a58949a0f25c937a6789c0839feb530 upstream.
--- include/drm/drm_cache.h | 2 ++ 1 file changed, 2 insertions(+)
include/drm/drm_cache.h +2 -0
@@ -39,6 +39,8 @@ static inline bool drm_arch_can_wc_memor {#if defined(CONFIG_PPC ) && !defined(CONFIG_NOT_COHERENT_CACHE )return false; +#elif defined(CONFIG_MIPS ) && defined(CONFIG_CPU_LOONGSON3 ) +return false;#else return true;#endif
Greg Kroah-Hartman
maintainerPATCH 86/200 drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 28dca90533750c7e31e8641c3df426bad9c12941 upstream.
--- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +2 -0
@@ -1807,6 +1807,8 @@ gf100_gr_init(struct gf100_gr *gr)gf100_gr_mmio (gr, gr->func->mmio); +nvkm_mask (device,TPC_UNIT (0 ,0 ,0x05c ),0x00000001 ,0x00000001 ); +memcpy (tpcnr, gr->tpc_nr,sizeof (gr->tpc_nr));for (i =0 , gpc =-1 ; i < gr->tpc_total; i++) { do {
Greg Kroah-Hartman
maintainerPATCH 88/200 drm/dp/mst: Restore primary hub guid on resume
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude <[email protected]>
commit 9dc0487d96a0396367a1451b31873482080b527f upstream.
Some hubs are forgetful, and end up forgetting whatever GUID we set previously after we do a suspend/resume cycle. This can lead to hotplugging breaking (along with probably other things) since the hub will start sending connection notifications with the wrong GUID. As such, we need to check on resume whether or not the GUID the hub is giving us is valid.
--- drivers/gpu/drm/drm_dp_mst_topology.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/gpu/drm/drm_dp_mst_topology.c +12 -0
@@ -2128,6 +2128,8 @@ int drm_dp_mst_topology_mgr_resume(strucif (mgr->mst_primary) {int sret; +u8 guid[16 ]; + sret =drm_dp_dpcd_read (mgr->aux,DP_DPCD_REV , mgr->dpcd,DP_RECEIVER_CAP_SIZE );if (sret !=DP_RECEIVER_CAP_SIZE ) {DRM_DEBUG_KMS ("dpcd read failed - undocked during suspend?\n" );
@@ -2142,6 +2144,16 @@ int drm_dp_mst_topology_mgr_resume(struc ret =-1 ; goto out_unlock; } + +/* Some hubs forget their guids after they resume */ + sret =drm_dp_dpcd_read (mgr->aux,DP_GUID , guid,16 ); +if (sret !=16 ) { +DRM_DEBUG_KMS ("dpcd read failed - undocked during suspend?\n" ); + ret =-1 ; + goto out_unlock; + } +drm_dp_check_mstb_guid (mgr->mst_primary, guid); + ret =0 ; }else ret =-1 ;
Greg Kroah-Hartman
maintainerPATCH 89/200 drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: [email protected] <[email protected]>
commit 263efde31f97c498e1ebad30e4d2906609d7ad6b upstream.
We can thank KASAN for finding this, otherwise I probably would have spent hours on it. This fixes a somewhat harder to trigger kernel panic, occuring while enabling MST where the port we were currently updating the payload on would have all of it's refs dropped before we finished what we were doing:
==================================================================
BUG: KASAN: use-after-free in drm_dp_update_payload_part1+0xb3f/0xdb0 [drm_kms_helper] at addr ffff8800d29de018 Read of size 4 by task Xorg/973 =============================================================================
BUG kmalloc-2048 (Tainted: G B W ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] age=16477 cpu=0 pid=2175
___slab_alloc+0x472/0x490 __slab_alloc+0x20/0x40 kmem_cache_alloc_trace+0x151/0x190 drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] drm_dp_send_link_address+0x526/0x960 [drm_kms_helper] drm_dp_check_and_send_link_address+0x1ac/0x210 [drm_kms_helper] drm_dp_mst_link_probe_work+0x77/0xd0 [drm_kms_helper] process_one_work+0x562/0x1350 worker_thread+0xd9/0x1390 kthread+0x1c5/0x260 ret_from_fork+0x22/0x40 INFO: Freed in drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] age=7521 cpu=0 pid=2175 __slab_free+0x17f/0x2d0 kfree+0x169/0x180 drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] drm_dp_destroy_connector_work+0x2b8/0x490 [drm_kms_helper] process_one_work+0x562/0x1350 worker_thread+0xd9/0x1390 kthread+0x1c5/0x260 ret_from_fork+0x22/0x40
which on this T460s, would eventually lead to kernel panics in somewhat random places later in intel_mst_enable_dp() if we got lucky enough.
--- drivers/gpu/drm/drm_dp_mst_topology.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/drm_dp_mst_topology.c +8 -0
@@ -1796,6 +1796,11 @@ int drm_dp_update_payload_part1(struct d req_payload.start_slot = cur_slots;if (mgr->proposed_vcpis[i]) { port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi); + port =drm_dp_get_validated_port_ref (mgr, port); +if (!port) { +mutex_unlock (&mgr->payload_lock); +return -EINVAL ; + } req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots; req_payload.vcpi = mgr->proposed_vcpis[i]->vcpi; }else {
@@ -1823,6 +1828,9 @@ int drm_dp_update_payload_part1(struct d mgr->payloads[i].payload_state = req_payload.payload_state; } cur_slots += req_payload.num_slots; + +if (port) +drm_dp_put_port (port); }for (i =0 ; i < mgr->max_payloads; i++) {
Greg Kroah-Hartman
maintainerPATCH 90/200 pwm: brcmstb: Fix check of devm_ioremap_resource() return code
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit c5857e3f94ab2719dfac649a146cb5dd6f21fcf3 upstream.
The change fixes potential oops while accessing iomem on invalid address if devm_ioremap_resource() fails due to some reason.
The devm_ioremap_resource() function returns ERR_PTR() and never returns NULL, which makes useless a following check for NULL.
--- drivers/pwm/pwm-brcmstb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pwm/pwm-brcmstb.c +2 -2
@@ -274,8 +274,8 @@ static int brcmstb_pwm_probe(struct plat res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); p->base =devm_ioremap_resource (&pdev->dev, res); -if (!p->base) { - ret = -ENOMEM ; +if (IS_ERR (p->base)) { + ret =PTR_ERR (p->base); goto out_clk; }
Greg Kroah-Hartman
maintainerPATCH 96/200 drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 93fce954427effee89e44a976299b15dd75b4bbc upstream.
At the end of the function we expect "status" to be zero, but it's either -EINVAL or uninitialized.
--- drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c +1 -1
@@ -513,7 +513,7 @@ static int dbgdev_wave_control_set_regisunion SQ_CMD_BITS *in_reg_sq_cmd, union GRBM_GFX_INDEX_BITS *in_reg_gfx_index) { - int status; + int status = 0;union SQ_CMD_BITS reg_sq_cmd;union GRBM_GFX_INDEX_BITS reg_gfx_index;struct HsaDbgWaveMsgAMDGen2 *pMsg;
Greg Kroah-Hartman
maintainerPATCH 97/200 drm/i915/skl: Fix DMC load on Skylake J0 and K0
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mat Martineau <[email protected]>
commit a41c8882592fb80458959b10e37632ce030b68ca upstream.
The driver does not load firmware for unknown steppings, so these new steppings must be added to the list.
--- drivers/gpu/drm/i915/intel_csr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/intel_csr.c +2 -1
@@ -177,7 +177,8 @@ static const struct stepping_info kbl_ststatic const struct stepping_info skl_stepping_info[] = { {'A' ,'0' }, {'B' ,'0' }, {'C' ,'0' }, {'D' ,'0' }, {'E' ,'0' }, {'F' ,'0' }, - {'G' ,'0' }, {'H' ,'0' }, {'I' ,'0' } + {'G' ,'0' }, {'H' ,'0' }, {'I' ,'0' }, + {'J' ,'0' }, {'K' ,'0' } };static const struct stepping_info bxt_stepping_info[] = {
Greg Kroah-Hartman
maintainerPATCH 98/200 drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Kuoppala <[email protected]>
commit 510650e8b2ab965931b35e9813467439d4df0b9c upstream.
Experiments with heaven 4.0 benchmark and skylake gt3e (rev 0xa) suggest that WaForceContextSaveRestoreNonCoherent is needed for all revs. Extending this to all revs cures a gpu hang with rev 0xa when running heaven4.0 gpu benchmark.
We have been here before, with problems enabling gt4e and extending up to revision F0 instead of false claims of bspec of E0 only. See commit <e238659ddd88> ("drm/i915/skl: Default to noncoherent access up to F0"). In retrospect we should have covered this with this big blanket back then already, as E0 vs F0 discrepancy was suspicious enough.
Previously the WaForceEnableNonCoherent has been tied to context non-coherence, atleast in relevant hsds. So keep this tie and extended this alongside.
References: https://bugs.freedesktop.org/show_bug.cgi?id=93491
--- drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/intel_ringbuffer.c +3 -2
@@ -951,7 +951,7 @@ static int gen9_init_workarounds(struct/* WaForceContextSaveRestoreNonCoherent:skl,bxt */ tmp =HDC_FORCE_CONTEXT_SAVE_RESTORE_NON_COHERENT ; -if (IS_SKL_REVID (dev,SKL_REVID_F0 ,SKL_REVID_F0 ) || +if (IS_SKL_REVID (dev,SKL_REVID_F0 ,REVID_FOREVER ) ||IS_BXT_REVID (dev,BXT_REVID_B0 ,REVID_FOREVER )) tmp |=HDC_FORCE_CSR_NON_COHERENT_OVR_DISABLE ;WA_SET_BIT_MASKED (HDC_CHICKEN0 , tmp);
@@ -1044,7 +1044,8 @@ static int skl_init_workarounds(struct iWA_SET_BIT_MASKED (HIZ_CHICKEN ,BDW_HIZ_POWER_COMPILER_CLOCK_GATING_DISABLE ); -if (IS_SKL_REVID (dev,0 ,SKL_REVID_F0 )) { +/* This is tied to WaForceContextSaveRestoreNonCoherent */ +if (IS_SKL_REVID (dev,0 ,REVID_FOREVER )) {/* *Use Force Non-Coherent whenever executing a 3D context. This * is a workaround for a possible hang in the unlikely event
Greg Kroah-Hartman
maintainerPATCH 99/200 drm/i915: Fixup the free space logic in ring_prepare
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akash Goel <[email protected]>
commit d43f3ebf12f59c57782ec652da65ef61c2662b40 upstream.
Currently for the case where there is enough space at the end of Ring buffer for accommodating only the base request, the wrapround is done immediately and as a result the base request gets added at the start of Ring buffer. But there may not be enough free space at the beginning to accommodate the base request, as before the wraparound, the wait was effectively done for the reserved_size free space from the start of Ring buffer. In such a case there is a potential of Ring buffer overflow, the instructions at the head of Ring (ACTHD) can get overwritten.
Since the base request can fit in the remaining space, there is no need to wraparound immediately. The wraparound will anyway happen later when the reserved part starts getting used.
--- drivers/gpu/drm/i915/intel_lrc.c | 6 +++--- drivers/gpu/drm/i915/intel_ringbuffer.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/i915/intel_lrc.c +3 -3
@@ -781,11 +781,11 @@ static int logical_ring_prepare(struct dif (unlikely (total_bytes > remain_usable)) {/* * The base request will fit but the reserved space -* falls off the end. So only need to to wait for the -* reserved size after flushing out the remainder. +* falls off the end. So don't need an immediate wrap +* and only need to effectively wait for the reserved +* size space from the start of ringbuffer. */ wait_bytes = remain_actual + ringbuf->reserved_size; - need_wrap = true; }else if (total_bytes > ringbuf->space) {/* No wrapping required, just waiting. */ wait_bytes = total_bytes;
drivers/gpu/drm/i915/intel_ringbuffer.c +3 -3
@@ -2390,11 +2390,11 @@ static int __intel_ring_prepare(struct iif (unlikely (total_bytes > remain_usable)) {/* * The base request will fit but the reserved space -* falls off the end. So only need to to wait for the -* reserved size after flushing out the remainder. +* falls off the end. So don't need an immediate wrap +* and only need to effectively wait for the reserved +* size space from the start of ringbuffer. */ wait_bytes = remain_actual + ringbuf->reserved_size; - need_wrap = true; }else if (total_bytes > ringbuf->space) {/* No wrapping required, just waiting. */ wait_bytes = total_bytes;
Greg Kroah-Hartman
maintainerPATCH 100/200 drm/i915: Force ringbuffers to not be at offset 0
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
commit 1b3e885a05d4f0a35dde035724e7c6453d2cbe71 upstream.
For reasons unknown Sandybridge GT1 (at least) will eventually hang when it encounters a ring wraparound at offset 0. The test case that reproduces the bug reliably forces a large number of interrupted context switches, thereby causing very frequent ring wraparounds, but there are similar bug reports in the wild with the same symptoms, seqno writes stop just before the wrap and the ringbuffer at address 0. It is also timing crucial, but adding various delays hasn't helped pinpoint where the window lies.
Whether the fault is restricted to the ringbuffer itself or the GTT addressing is unclear, but moving the ringbuffer fixes all the hangs I have been able to reproduce.
References: (e.g.) https://bugs.freedesktop.org/show_bug.cgi?id=93262
Testcase: igt/gem_exec_whisper/render-contexts-interruptible #snb-gt1
--- drivers/gpu/drm/i915/intel_ringbuffer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/intel_ringbuffer.c +5 -2
@@ -2031,10 +2031,12 @@ int intel_pin_and_map_ringbuffer_obj(str {struct drm_i915_private *dev_priv =to_i915 (dev);struct drm_i915_gem_object *obj = ringbuf->obj; +/* Ring wraparound at offset 0 sometimes hangs. No idea why. */ +unsigned flags =PIN_OFFSET_BIAS |4096 ;int ret;if (HAS_LLC (dev_priv) && !obj->stolen) { - ret =i915_gem_obj_ggtt_pin (obj,PAGE_SIZE ,0 ); + ret =i915_gem_obj_ggtt_pin (obj,PAGE_SIZE , flags);if (ret)return ret;
@@ -2050,7 +2052,8 @@ int intel_pin_and_map_ringbuffer_obj(strreturn -ENOMEM ; } }else { - ret =i915_gem_obj_ggtt_pin (obj,PAGE_SIZE ,PIN_MAPPABLE ); + ret =i915_gem_obj_ggtt_pin (obj,PAGE_SIZE , + flags |PIN_MAPPABLE );if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 103/200 video: ARM CLCD: runtime check for Versatile
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit f36fdacc5fcdca7b0c0d89f031fcdc89717e0be3 upstream.
The current compile-time check for inversed IENB/CNTL does not work in multiplatform boots: as soon as versatile is included in the build, the IENB/CNTL is switched and breaks graphics. Convert this to a runtime switch.
--- drivers/video/fbdev/amba-clcd.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/video/fbdev/amba-clcd.c +8 -7
@@ -440,13 +440,14 @@ static int clcdfb_register(struct clcd_f fb->off_ienb =CLCD_PL111_IENB ; fb->off_cntl =CLCD_PL111_CNTL ; }else { -#ifdef CONFIG_ARCH_VERSATILE - fb->off_ienb =CLCD_PL111_IENB ; - fb->off_cntl =CLCD_PL111_CNTL ; -#else - fb->off_ienb =CLCD_PL110_IENB ; - fb->off_cntl =CLCD_PL110_CNTL ; -#endif +if (of_machine_is_compatible ("arm,versatile-ab" ) || +of_machine_is_compatible ("arm,versatile-pb" )) { + fb->off_ienb =CLCD_PL111_IENB ; + fb->off_cntl =CLCD_PL111_CNTL ; + }else { + fb->off_ienb =CLCD_PL110_IENB ; + fb->off_cntl =CLCD_PL110_CNTL ; + } } fb->clk =clk_get (&fb->dev->dev,NULL );
Greg Kroah-Hartman
maintainerPATCH 104/200 perf intel-pt: Fix segfault tracing transactions
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 1342e0b7a6c1a060c593037fbac9f4b717f1cb3b upstream.
Tracing a workload that uses transactions gave a seg fault as follows:
perf record -e intel_pt// workload
perf report
Program received signal SIGSEGV, Segmentation fault.
0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110)
at util/intel-pt.c:929
929 ptq->last_branch_rb->nr = 0;
(gdb) p ptq->last_branch_rb
$1 = (struct branch_stack *) 0x0
(gdb) up
1148 intel_pt_reset_last_branch_rb(ptq);
(gdb) l
1143 if (ret)
1144 pr_err("Intel Processor Trace: failed to deliver transaction event
1145 ret);
1146
1147 if (pt->synth_opts.callchain)
1148 intel_pt_reset_last_branch_rb(ptq);
1149
1150 return ret;
1151 }
1152
(gdb) p pt->synth_opts.callchain
$2 = true
(gdb)
(gdb) bt
#0 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110)
#1 0x000000000054c1e0 in intel_pt_synth_transaction_sample (ptq=0x1a36110)
#2 0x000000000054c5b2 in intel_pt_sample (ptq=0x1a36110)Caused by checking the 'callchain' flag when it should have been the 'last_branch' flag. Fix that.
--- tools/perf/util/intel-pt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/intel-pt.c +1 -1
@@ -1127,7 +1127,7 @@ static int intel_pt_synth_transaction_sapr_err ("Intel Processor Trace: failed to deliver transaction event, error %d\n" , ret); -if (pt->synth_opts.callchain) +if (pt->synth_opts.last_branch)intel_pt_reset_last_branch_rb (ptq);return ret;
Greg Kroah-Hartman
maintainerPATCH 105/200 i2c: cpm: Fix build break due to incompatible pointer types
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit 609d5a1b2b35bb62b4b3750396e55453160c2a17 upstream.
Since commit ea8daa7b9784 ("kbuild: Add option to turn incompatible pointer check into error"), assignments from an incompatible pointer types have become a hard error, eg:
drivers/i2c/busses/i2c-cpm.c:545:91: error: passing argument 3 of 'dma_alloc_coherent' from incompatible pointer type
Fix the build break by converting txdma & rxdma to dma_addr_t.
--- drivers/i2c/busses/i2c-cpm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-cpm.c +2 -2
@@ -116,8 +116,8 @@ struct cpm_i2c {cbd_t __iomem *rbase;u_char *txbuf[CPM_MAXBD ];u_char *rxbuf[CPM_MAXBD ]; -u32 txdma[CPM_MAXBD ]; -u32 rxdma[CPM_MAXBD ]; +dma_addr_t txdma[CPM_MAXBD ]; +dma_addr_t rxdma[CPM_MAXBD ]; };static irqreturn_t cpm_i2c_interrupt (int irq,void *dev_id)
Greg Kroah-Hartman
maintainerPATCH 106/200 i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Martinez Canillas <[email protected]>
commit 10ff4c5239a137abfc896ec73ef3d15a0f86a16a upstream.
The exynos5 I2C controller driver always prepares and enables a clock before using it and then disables unprepares it when the clock is not used anymore.
But this can cause a possible ABBA deadlock in some scenarios since a driver that uses regmap to access its I2C registers, will first grab the regmap lock and then the I2C xfer function will grab the prepare lock when preparing the I2C clock. But since the clock driver also uses regmap for I2C accesses, preparing a clock will first grab the prepare lock and then the regmap lock when using the regmap API.
An example of this happens on the Exynos5422 Odroid XU4 board where a s2mps11 PMIC is used and both the s2mps11 regulators and clk drivers share the same I2C regmap.
The possible deadlock is reported by the kernel lockdep:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(sec_core:428:(regmap)->lock);
lock(prepare_lock);
lock(sec_core:428:(regmap)->lock); lock(prepare_lock);
*** DEADLOCK ***
Fix it by leaving the code prepared on probe and use {en,dis}able in the I2C transfer function.
This patch is similar to commit 34e81ad5f0b6 ("i2c: s3c2410: fix ABBA deadlock by keeping clock prepared") that fixes the same bug in other driver for an I2C controller found in Samsung SoCs.
--- drivers/i2c/busses/i2c-exynos5.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
drivers/i2c/busses/i2c-exynos5.c +19 -5
@@ -671,7 +671,9 @@ static int exynos5_i2c_xfer(struct i2c_areturn -EIO ; } -clk_prepare_enable (i2c->clk); + ret =clk_enable (i2c->clk); +if (ret) +return ret;for (i =0 ; i < num; i++, msgs++) { stop = (i == num -1 );
@@ -695,7 +697,7 @@ static int exynos5_i2c_xfer(struct i2c_a } out: -clk_disable_unprepare (i2c->clk); +clk_disable (i2c->clk);return ret; }
@@ -747,7 +749,9 @@ static int exynos5_i2c_probe(struct platreturn -ENOENT ; } -clk_prepare_enable (i2c->clk); + ret =clk_prepare_enable (i2c->clk); +if (ret) +return ret; mem =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); i2c->regs =devm_ioremap_resource (&pdev->dev, mem);
@@ -799,6 +803,10 @@ static int exynos5_i2c_probe(struct platplatform_set_drvdata (pdev, i2c); +clk_disable (i2c->clk); + +return 0 ; + err_clk:clk_disable_unprepare (i2c->clk);return ret;
@@ -810,6 +818,8 @@ static int exynos5_i2c_remove(struct plai2c_del_adapter (&i2c->adap); +clk_unprepare (i2c->clk); +return 0 ; }
@@ -821,6 +831,8 @@ static int exynos5_i2c_suspend_noirq(str i2c->suspended =1 ; +clk_unprepare (i2c->clk); +return 0 ; }
@@ -830,7 +842,9 @@ static int exynos5_i2c_resume_noirq(strustruct exynos5_i2c *i2c =platform_get_drvdata (pdev);int ret =0 ; -clk_prepare_enable (i2c->clk); + ret =clk_prepare_enable (i2c->clk); +if (ret) +return ret; ret =exynos5_hsi2c_clock_setup (i2c);if (ret) {
@@ -839,7 +853,7 @@ static int exynos5_i2c_resume_noirq(stru }exynos5_i2c_init (i2c); -clk_disable_unprepare (i2c->clk); +clk_disable (i2c->clk); i2c->suspended =0 ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 107/200 ACPICA / Interpreter: Fix a regression triggered because of wrong Linux ECDT support
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <[email protected]>
commit 5508df89756f8378024828e185724a9bd2348985 upstream.
It is reported that the following commit triggers regressions:
Linux commit: efaed9be998b5ae0afb7458e057e5f4402b43fa0 ACPICA commit: 31178590dde82368fdb0f6b0e466b6c0add96c57
Subject: ACPICA: Events: Enhance acpi_ev_execute_reg_method() to
ensure no _REG evaluations can happen during OS early boot stages
This is because that the ECDT support is not corrected in Linux, and Linux requires to execute _REG for ECDT (though this sounds so wrong), we need to ensure acpi_gbl_namespace_initialized is set before ECDT probing in order for _REG to be executed. Since we have to move "acpi_gbl_namespace_initialized = TRUE" to the initialization step happening before ECDT probing, acpi_load_tables() is the best candidate for now. Thus this patch fixes the regression by doing so.
But if the ECDT support is fixed, Linux will not execute _REG for ECDT, and ECDT probing will happen before acpi_load_tables(). At that time, we still want to ensure acpi_gbl_namespace_initialized is set after executing acpi_ns_initialize_objects() (under the condition of acpi_gbl_group_module_level_code = FALSE), this patch also moves acpi_ns_initialize_objects() to acpi_load_tables() accordingly.
Since acpi_ns_initialize_objects() doesn't seem to be skippable, this patch also removes ACPI_NO_OBJECT_INIT for the one invoked in acpi_load_tables(). And since the default region handlers should always be installed before loading the tables, this patch also removes useless acpi_gbl_group_module_level_code check accordingly. Reported by Chris Bainbridge, Fixed by Lv Zheng.
--- drivers/acpi/acpica/nsinit.c | 2 ++ drivers/acpi/acpica/tbxfload.c | 14 ++++++++++++++ drivers/acpi/acpica/utxfinit.c | 25 +++++++++++-------------- 3 files changed, 27 insertions(+), 14 deletions(-)
drivers/acpi/acpica/nsinit.c +2 -0
@@ -83,6 +83,8 @@ acpi_status acpi_ns_initialize_objects(vACPI_FUNCTION_TRACE (ns_initialize_objects); +ACPI_DEBUG_PRINT ((ACPI_DB_EXEC , +"[Init] Completing Initialization of ACPI Objects\n" ));ACPI_DEBUG_PRINT ((ACPI_DB_DISPATCH ,"**** Starting initialization of namespace objects ****\n" )); ACPI_DEBUG_PRINT_RAW((ACPI_DB_INIT,
drivers/acpi/acpica/tbxfload.c +14 -0
@@ -83,6 +83,20 @@ acpi_status __init acpi_load_tables(void "While loading namespace from ACPI tables")); } +if (!acpi_gbl_group_module_level_code) { +/* +* Initialize the objects that remain uninitialized. This +* runs the executable AML that may be part of the +* declaration of these objects: +* operation_regions, buffer_fields, Buffers, and Packages. +*/ + status =acpi_ns_initialize_objects (); +if (ACPI_FAILURE (status)) { +return_ACPI_STATUS (status); + } + } + + acpi_gbl_reg_methods_enabled = TRUE;return_ACPI_STATUS (status); }
drivers/acpi/acpica/utxfinit.c +11 -14
@@ -267,7 +267,6 @@ acpi_status __init acpi_initialize_objec* initialized, even if they contain executable AML (see the call to * acpi_ns_initialize_objects below). */ - acpi_gbl_reg_methods_enabled = TRUE;if (!(flags &ACPI_NO_ADDRESS_SPACE_INIT )) {ACPI_DEBUG_PRINT ((ACPI_DB_EXEC ,"[Init] Executing _REG OpRegion methods\n" ));
@@ -299,20 +298,18 @@ acpi_status __init acpi_initialize_objec*/ if (acpi_gbl_group_module_level_code) {acpi_ns_exec_module_code_list (); - } -/* -* Initialize the objects that remain uninitialized. This runs the -* executable AML that may be part of the declaration of these objects: -* operation_regions, buffer_fields, Buffers, and Packages. -*/ -if (!(flags &ACPI_NO_OBJECT_INIT )) { -ACPI_DEBUG_PRINT ((ACPI_DB_EXEC , -"[Init] Completing Initialization of ACPI Objects\n" )); - - status =acpi_ns_initialize_objects (); -if (ACPI_FAILURE (status)) { -return_ACPI_STATUS (status); +/* +* Initialize the objects that remain uninitialized. This +* runs the executable AML that may be part of the +* declaration of these objects: +* operation_regions, buffer_fields, Buffers, and Packages. +*/ +if (!(flags &ACPI_NO_OBJECT_INIT )) { + status =acpi_ns_initialize_objects (); +if (ACPI_FAILURE (status)) { +return_ACPI_STATUS (status); + } } }
Greg Kroah-Hartman
maintainerPATCH 108/200 mmc: sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 6e1c7d6103fe7031035cec321307c6356809adf4 upstream.
Baytrail eMMC/SD/SDIO host controllers have been known to hang. A change to a hardware setting has been found to reduce the occurrence of such hangs. This patch ensures the correct setting.
This patch applies cleanly to v4.4+. It could go to earlier kernels also, so I will send backports to the stable list in due course.
--- drivers/mmc/host/Kconfig | 1 drivers/mmc/host/sdhci-acpi.c | 81 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 82 insertions(+)
drivers/mmc/host/Kconfig +1 -0
@@ -97,6 +97,7 @@ config MMC_RICOH_MMC config MMC_SDHCI_ACPI tristate "SDHCI support for ACPI enumerated SDHCI controllers" depends on MMC_SDHCI && ACPI + select IOSF_MBI if X86 help This selects support for ACPI enumerated SDHCI controllers, identified by ACPI Compatibility ID PNP0D40 or specific
drivers/mmc/host/sdhci-acpi.c +81 -0
111 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 109/200 toshiba_acpi: Fix regression caused by hotkey enabling value
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azael Avalos <[email protected]>
commit a30b8f81d9d6fe24eab8a023794548b048f08e3c upstream.
Commit 52cbae0127ad ("toshiba_acpi: Change default Hotkey enabling value") changed the hotkeys enabling value, as it was the same value Windows uses, however, it turns out that the value tells the EC that the driver will now take care of the hardware events like the physical RFKill switch or the pointing device toggle button.
This patch reverts such commit by changing the default hotkey enabling value to 0x09, which enables hotkey events only, making the hardware buttons working again.
Fixes bugs 113331 and 114941.
--- drivers/platform/x86/toshiba_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/toshiba_acpi.c +1 -1
@@ -133,7 +133,7 @@ MODULE_LICENSE("GPL");/* Field definitions */ #define HCI_ACCEL_MASK 0x7fff#define HCI_HOTKEY_DISABLE 0x0b -#define HCI_HOTKEY_ENABLE 0x01 +#define HCI_HOTKEY_ENABLE 0x09#define HCI_HOTKEY_SPECIAL_FUNCTIONS 0x10#define HCI_LCD_BRIGHTNESS_BITS 3#define HCI_LCD_BRIGHTNESS_SHIFT (16-HCI_LCD_BRIGHTNESS_BITS)
Greg Kroah-Hartman
maintainerPATCH 110/200 EDAC: i7core, sb_edac: Dont return NOTIFY_BAD from mce_decoder callback
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
commit c4fc1956fa31003bfbe4f597e359d751568e2954 upstream.
Both of these drivers can return NOTIFY_BAD, but this terminates processing other callbacks that were registered later on the chain. Since the driver did nothing to log the error it seems wrong to prevent other interested parties from seeing it. E.g. neither of them had even bothered to check the type of the error to see if it was a memory error before the return NOTIFY_BAD.
--- drivers/edac/i7core_edac.c | 2 +- drivers/edac/sb_edac.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/edac/i7core_edac.c +1 -1
@@ -1866,7 +1866,7 @@ static int i7core_mce_check_error(struct i7_dev =get_i7core_dev (mce->socketid);if (!i7_dev) -return NOTIFY_BAD ; +return NOTIFY_DONE ; mci = i7_dev->mci; pvt = mci->pvt_info;
drivers/edac/sb_edac.c +1 -1
@@ -3168,7 +3168,7 @@ static int sbridge_mce_check_error(struc mci =get_mci_for_node_id (mce->socketid);if (!mci) -return NOTIFY_BAD ; +return NOTIFY_DONE ; pvt = mci->pvt_info;/*
Greg Kroah-Hartman
maintainerPATCH 111/200 ASoC: s3c24xx: use const snd_soc_component_driver pointer
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit ba4bc32eaa39ba7687f0958ae90eec94da613b46 upstream.
An older patch to convert the API in the s3c i2s driver ended up passing a const pointer into a function that takes a non-const pointer, so we now get a warning:
sound/soc/samsung/s3c2412-i2s.c: In function 's3c2412_iis_dev_probe':sound/soc/samsung/s3c2412-i2s.c:172:9: error: passing argument 3 of 's3c_i2sv2_register_component' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
However, the s3c_i2sv2_register_component() function again passes the pointer into another function taking a const, so we just need to change its prototype.
--- sound/soc/samsung/s3c-i2s-v2.c | 2 +- sound/soc/samsung/s3c-i2s-v2.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
sound/soc/samsung/s3c-i2s-v2.c +1 -1
@@ -709,7 +709,7 @@ static int s3c2412_i2s_resume(struct snd#endif int s3c_i2sv2_register_component (struct device *dev,int id, -struct snd_soc_component_driver *cmp_drv, +const struct snd_soc_component_driver *cmp_drv,struct snd_soc_dai_driver *dai_drv) {struct snd_soc_dai_ops *ops = (struct snd_soc_dai_ops *)dai_drv->ops;
sound/soc/samsung/s3c-i2s-v2.h +1 -1
@@ -101,7 +101,7 @@ extern int s3c_i2sv2_probe(struct snd_so* soc core. */ extern int s3c_i2sv2_register_component (struct device *dev,int id, -struct snd_soc_component_driver *cmp_drv, +const struct snd_soc_component_driver *cmp_drv,struct snd_soc_dai_driver *dai_drv);#endif /* __SND_SOC_S3C24XX_S3C_I2SV2_I2S_H */
Greg Kroah-Hartman
maintainerPATCH 112/200 ASoC: ssm4567: Reset device before regcache_sync()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <[email protected]>
commit 712a8038cc24dba668afe82f0413714ca87184e0 upstream.
When the ssm4567 is powered up the driver calles regcache_sync() to restore the register map content. regcache_sync() assumes that the device is in its power-on reset state. Make sure that this is the case by explicitly resetting the ssm4567 register map before calling regcache_sync() otherwise we might end up with a incorrect register map which leads to undefined behaviour.
One such undefined behaviour was observed when returning from system suspend while a playback stream is active, in that case the ssm4567 was kept muted after resume.
--- sound/soc/codecs/ssm4567.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/codecs/ssm4567.c +5 -0
@@ -352,6 +352,11 @@ static int ssm4567_set_power(struct ssm4regcache_cache_only (ssm4567->regmap, !enable);if (enable) { + ret =regmap_write (ssm4567->regmap,SSM4567_REG_SOFT_RESET , +0x00 ); +if (ret) +return ret; + ret =regmap_update_bits (ssm4567->regmap,SSM4567_REG_POWER_CTRL ,SSM4567_POWER_SPWDN ,0x00 );
Greg Kroah-Hartman
maintainerPATCH 113/200 ASoC: dapm: Make sure we have a card when displaying component widgets
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 47325078f2a3e543150e7df967e45756b2fff7ec upstream.
The dummy component is reused for all cards so we special case and don't bind it to any of them. This means that code like that displaying the component widgets that tries to look at the card will crash. In the future we will fix this by ensuring that the dummy component looks like other components but that is invasive and so not suitable for a fix. Instead add a special case check here.
--- sound/soc/soc-dapm.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/soc-dapm.c +7 -0
@@ -2188,6 +2188,13 @@ static ssize_t dapm_widget_show_componenint count =0 ;char *state ="not set" ; +/* card won't be set for the dummy component, as a spot fix +* we're checking for that case specifically here but in future +* we will ensure that the dummy component looks like others. +*/ +if (!cmpnt->card) +return 0 ; +list_for_each_entry (w, &cmpnt->card->widgets, list) {if (w->dapm != dapm)continue ;
Greg Kroah-Hartman
maintainerPATCH 114/200 ASoC: rt5640: Correct the digital interface data select
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sugar Zhang <[email protected]>
commit 653aa4645244042826f105aab1be3d01b3d493ca upstream.
this patch corrects the interface adc/dac control register definition according to datasheet.
--- sound/soc/codecs/rt5640.c | 2 +- sound/soc/codecs/rt5640.h | 36 ++++++++++++++++++------------------ 2 files changed, 19 insertions(+), 19 deletions(-)
sound/soc/codecs/rt5640.c +1 -1
@@ -359,7 +359,7 @@ static const DECLARE_TLV_DB_RANGE(bst_tl/* Interface data select */ static const char *const rt5640_data_select[] = { -"Normal" ,"left copy to right" ,"right copy to left" ,"Swap" }; +"Normal" ,"Swap" ,"left copy to right" ,"right copy to left" }; static SOC_ENUM_SINGLE_DECL(rt5640_if1_dac_enum, RT5640_DIG_INF_DATA, RT5640_IF1_DAC_SEL_SFT, rt5640_data_select);
sound/soc/codecs/rt5640.h +18 -18
@@ -442,39 +442,39 @@#define RT5640_IF1_DAC_SEL_MASK (0x3 << 14)#define RT5640_IF1_DAC_SEL_SFT 14#define RT5640_IF1_DAC_SEL_NOR (0x0 << 14) -#define RT5640_IF1_DAC_SEL_L2R (0x1 << 14) -#define RT5640_IF1_DAC_SEL_R2L (0x2 << 14) -#define RT5640_IF1_DAC_SEL_SWAP (0x3 << 14) +#define RT5640_IF1_DAC_SEL_SWAP (0x1 << 14) +#define RT5640_IF1_DAC_SEL_L2R (0x2 << 14) +#define RT5640_IF1_DAC_SEL_R2L (0x3 << 14)#define RT5640_IF1_ADC_SEL_MASK (0x3 << 12)#define RT5640_IF1_ADC_SEL_SFT 12#define RT5640_IF1_ADC_SEL_NOR (0x0 << 12) -#define RT5640_IF1_ADC_SEL_L2R (0x1 << 12) -#define RT5640_IF1_ADC_SEL_R2L (0x2 << 12) -#define RT5640_IF1_ADC_SEL_SWAP (0x3 << 12) +#define RT5640_IF1_ADC_SEL_SWAP (0x1 << 12) +#define RT5640_IF1_ADC_SEL_L2R (0x2 << 12) +#define RT5640_IF1_ADC_SEL_R2L (0x3 << 12)#define RT5640_IF2_DAC_SEL_MASK (0x3 << 10)#define RT5640_IF2_DAC_SEL_SFT 10#define RT5640_IF2_DAC_SEL_NOR (0x0 << 10) -#define RT5640_IF2_DAC_SEL_L2R (0x1 << 10) -#define RT5640_IF2_DAC_SEL_R2L (0x2 << 10) -#define RT5640_IF2_DAC_SEL_SWAP (0x3 << 10) +#define RT5640_IF2_DAC_SEL_SWAP (0x1 << 10) +#define RT5640_IF2_DAC_SEL_L2R (0x2 << 10) +#define RT5640_IF2_DAC_SEL_R2L (0x3 << 10)#define RT5640_IF2_ADC_SEL_MASK (0x3 << 8)#define RT5640_IF2_ADC_SEL_SFT 8#define RT5640_IF2_ADC_SEL_NOR (0x0 << 8) -#define RT5640_IF2_ADC_SEL_L2R (0x1 << 8) -#define RT5640_IF2_ADC_SEL_R2L (0x2 << 8) -#define RT5640_IF2_ADC_SEL_SWAP (0x3 << 8) +#define RT5640_IF2_ADC_SEL_SWAP (0x1 << 8) +#define RT5640_IF2_ADC_SEL_L2R (0x2 << 8) +#define RT5640_IF2_ADC_SEL_R2L (0x3 << 8)#define RT5640_IF3_DAC_SEL_MASK (0x3 << 6)#define RT5640_IF3_DAC_SEL_SFT 6#define RT5640_IF3_DAC_SEL_NOR (0x0 << 6) -#define RT5640_IF3_DAC_SEL_L2R (0x1 << 6) -#define RT5640_IF3_DAC_SEL_R2L (0x2 << 6) -#define RT5640_IF3_DAC_SEL_SWAP (0x3 << 6) +#define RT5640_IF3_DAC_SEL_SWAP (0x1 << 6) +#define RT5640_IF3_DAC_SEL_L2R (0x2 << 6) +#define RT5640_IF3_DAC_SEL_R2L (0x3 << 6)#define RT5640_IF3_ADC_SEL_MASK (0x3 << 4)#define RT5640_IF3_ADC_SEL_SFT 4#define RT5640_IF3_ADC_SEL_NOR (0x0 << 4) -#define RT5640_IF3_ADC_SEL_L2R (0x1 << 4) -#define RT5640_IF3_ADC_SEL_R2L (0x2 << 4) -#define RT5640_IF3_ADC_SEL_SWAP (0x3 << 4) +#define RT5640_IF3_ADC_SEL_SWAP (0x1 << 4) +#define RT5640_IF3_ADC_SEL_L2R (0x2 << 4) +#define RT5640_IF3_ADC_SEL_R2L (0x3 << 4)/* REC Left Mixer Control 1 (0x3b) */ #define RT5640_G_HP_L_RM_L_MASK (0x7 << 13)
Greg Kroah-Hartman
maintainerPATCH 115/200 vb2-memops: Fix over allocation of frame vectors
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda Delgado <[email protected]>
commit 89a095668304e8a02502ffd35edacffdbf49aa8c upstream.
On page unaligned frames, create_framevec forces get_vaddr_frames to allocate an extra page at the end of the buffer. Under some circumstances, this leads to -EINVAL on VIDIOC_QBUF.
E.g:
We have vm_a that vm_area that goes from 0x1000 to 0x3000. And a frame that goes from 0x1800 to 0x2800, i.e. 2 pages.
frame_vector_create will be called with the following params:
get_vaddr_frames(0x1800, 2, write, 1, vec);
get_vaddr will allocate the first page after checking that the memory 0x1800-0x27ff is valid, but it will not allocate the second page because the range 0x2800-0x37ff is out of the vm_a range. This results in create_framevec returning -EFAULT
Error Trace:
[ 9083.793015] video0: VIDIOC_QBUF: 00:00:00.00000000 index=1, type=vid-cap, flags=0x00002002, field=any, sequence=0, memory=userptr, bytesused=0, offset/userptr=0x7ff2b023ca80, length=5765760 [ 9083.793028] timecode=00:00:00 type=0, flags=0x00000000, frames=0, userbits=0x00000000 [ 9083.793117] video0: VIDIOC_QBUF: error -22: 00:00:00.00000000
index=2, type=vid-cap, flags=0x00000000, field=any, sequence=0, memory=userptr, bytesused=0, offset/userptr=0x7ff2b07bc500, length=5765760
Also use true instead of 1 since that argument is a bool in the get_vaddr_frames() prototype.
--- drivers/media/v4l2-core/videobuf2-memops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/v4l2-core/videobuf2-memops.c +1 -1
@@ -49,7 +49,7 @@ struct frame_vector *vb2_create_framevec vec =frame_vector_create (nr);if (!vec)return ERR_PTR (-ENOMEM ); - ret =get_vaddr_frames (start, nr, write,1 , vec); + ret =get_vaddr_frames (start &PAGE_MASK , nr, write, true, vec);if (ret <0 ) goto out_destroy;/* We accept only complete set of PFNs */
Greg Kroah-Hartman
maintainerPATCH 116/200 media: vb2: Fix regression on poll() for RW mode
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda Delgado <[email protected]>
commit b93876845c5e30a92964eeb088d9d2e024118022 upstream.
When using a device is read/write mode, vb2 does not handle properly the first select/poll operation.
The reason for this, is that when this code has been refactored, some of the operations have changed their order, and now fileio emulator is not started.
The reintroduced check to the core is enabled by a quirk flag, that avoids this check by other subsystems like DVB.
--- drivers/media/v4l2-core/videobuf2-core.c | 10 ++++++++++ drivers/media/v4l2-core/videobuf2-v4l2.c | 14 ++++++-------- include/media/videobuf2-core.h | 4 ++++ 3 files changed, 20 insertions(+), 8 deletions(-)
drivers/media/v4l2-core/videobuf2-core.c +10 -0
@@ -2293,6 +2293,16 @@ unsigned int vb2_core_poll(struct vb2_qureturn POLLERR ;/* +* If this quirk is set and QBUF hasn't been called yet then +* return POLLERR as well. This only affects capture queues, output +* queues will always initialize waiting_for_buffers to false. +* This quirk is set by V4L2 for backwards compatibility reasons. +*/ +if (q->quirk_poll_must_check_waiting_for_buffers && + q->waiting_for_buffers && (req_events & (POLLIN |POLLRDNORM ))) +return POLLERR ; + +/* * For output streams you can call write() as long as there are fewer * buffers queued than there are buffers available. */
drivers/media/v4l2-core/videobuf2-v4l2.c +6 -8
@@ -765,6 +765,12 @@ int vb2_queue_init(struct vb2_queue *q) q->is_output =V4L2_TYPE_IS_OUTPUT (q->type); q->copy_timestamp = (q->timestamp_flags &V4L2_BUF_FLAG_TIMESTAMP_MASK ) ==V4L2_BUF_FLAG_TIMESTAMP_COPY ; +/* +* For compatibility with vb1: if QBUF hasn't been called yet, then +* return POLLERR as well. This only affects capture queues, output +* queues will always initialize waiting_for_buffers to false. +*/ + q->quirk_poll_must_check_waiting_for_buffers = true;return vb2_core_queue_init (q); }
@@ -818,14 +824,6 @@ unsigned int vb2_poll(struct vb2_queue *poll_wait (file, &fh->wait, wait); } -/* -* For compatibility with vb1: if QBUF hasn't been called yet, then -* return POLLERR as well. This only affects capture queues, output -* queues will always initialize waiting_for_buffers to false. -*/ -if (q->waiting_for_buffers && (req_events & (POLLIN |POLLRDNORM ))) -return POLLERR ; -return res |vb2_core_poll (q, file, wait); }EXPORT_SYMBOL_GPL (vb2_poll);
include/media/videobuf2-core.h +4 -0
@@ -400,6 +400,9 @@ struct vb2_buf_ops {* @fileio_read_once: report EOF after reading the first buffer * @fileio_write_immediately: queue buffer after each write() call * @allow_zero_bytesused: allow bytesused == 0 to be passed to the driver +* @quirk_poll_must_check_waiting_for_buffers: Return POLLERR at poll when QBUF +* has not been called. This is a vb1 idiom that has been adopted +* also by vb2. * @lock: pointer to a mutex that protects the vb2_queue struct. The * driver can set this to a mutex to let the v4l2 core serialize * the queuing ioctls. If the driver wants to handle locking
@@ -463,6 +466,7 @@ struct vb2_queue { unsigned fileio_read_once:1; unsigned fileio_write_immediately:1; unsigned allow_zero_bytesused:1; + unsigned quirk_poll_must_check_waiting_for_buffers:1;struct mutex *lock;void *owner;
Greg Kroah-Hartman
maintainerPATCH 117/200 videobuf2-core: Check user space planes array in dqbuf
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit e7e0c3e26587749b62d17b9dd0532874186c77f7 upstream.
The number of planes in videobuf2 is specific to a buffer. In order to verify that the planes array provided by the user is long enough, a new vb2_buf_op is required.
Call __verify_planes_array() when the dequeued buffer is known. Return an error to the caller if there was one, otherwise remove the buffer from the done list.
--- drivers/media/v4l2-core/videobuf2-core.c | 10 +++++----- include/media/videobuf2-core.h | 4 ++++ 2 files changed, 9 insertions(+), 5 deletions(-)
drivers/media/v4l2-core/videobuf2-core.c +5 -5
@@ -1643,7 +1643,7 @@ static int __vb2_wait_for_done_vb(struct* Will sleep if required for nonblocking == false. */ static int __vb2_get_done_vb (struct vb2_queue *q,struct vb2_buffer **vb, -int nonblocking) +void *pb,int nonblocking) {unsigned long flags;int ret;
@@ -1664,10 +1664,10 @@ static int __vb2_get_done_vb(struct vb2_/* * Only remove the buffer from done_list if v4l2_buffer can handle all * the planes. -* Verifying planes is NOT necessary since it already has been checked -* before the buffer is queued/prepared. So it can never fail. */ -list_del (&(*vb)->done_entry); + ret =call_bufop (q, verify_planes_array, *vb, pb); +if (!ret) +list_del (&(*vb)->done_entry);spin_unlock_irqrestore (&q->done_lock, flags);return ret;
@@ -1746,7 +1746,7 @@ int vb2_core_dqbuf(struct vb2_queue *q,struct vb2_buffer *vb =NULL ;int ret; - ret =__vb2_get_done_vb (q, &vb, nonblocking); + ret =__vb2_get_done_vb (q, &vb, pb, nonblocking);if (ret <0 )return ret;
include/media/videobuf2-core.h +4 -0
@@ -375,6 +375,9 @@ struct vb2_ops {/** * struct vb2_ops - driver-specific callbacks * +* @verify_planes_array: Verify that a given user space structure contains +* enough planes for the buffer. This is called +* for each dequeued buffer. * @fill_user_buffer: given a vb2_buffer fill in the userspace structure. * For V4L2 this is a struct v4l2_buffer. * @fill_vb2_buffer: given a userspace structure, fill in the vb2_buffer.
@@ -384,6 +387,7 @@ struct vb2_ops {* the vb2_buffer struct. */ struct vb2_buf_ops { +int (*verify_planes_array)(struct vb2_buffer *vb,const void *pb);void (*fill_user_buffer)(struct vb2_buffer *vb,void *pb);int (*fill_vb2_buffer)(struct vb2_buffer *vb,const void *pb,struct vb2_plane *planes);
Greg Kroah-Hartman
maintainerPATCH 118/200 videobuf2-v4l2: Verify planes array in buffer dequeueing
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit 2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab upstream.
When a buffer is being dequeued using VIDIOC_DQBUF IOCTL, the exact buffer which will be dequeued is not known until the buffer has been removed from the queue. The number of planes is specific to a buffer, not to the queue.
This does lead to the situation where multi-plane buffers may be requested and queued with n planes, but VIDIOC_DQBUF IOCTL may be passed an argument struct with fewer planes.
__fill_v4l2_buffer() however uses the number of planes from the dequeued videobuf2 buffer, overwriting kernel memory (the m.planes array allocated in video_usercopy() in v4l2-ioctl.c) if the user provided fewer planes than the dequeued buffer had. Oops!
--- drivers/media/v4l2-core/videobuf2-v4l2.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/media/v4l2-core/videobuf2-v4l2.c +6 -0
@@ -74,6 +74,11 @@ static int __verify_planes_array(structreturn 0 ; } +static int __verify_planes_array_core (struct vb2_buffer *vb,const void *pb) +{ +return __verify_planes_array (vb, pb); +} +/** * __verify_length() - Verify that the bytesused value for each plane fits in * the plane length and that the data offset doesn't exceed the bytesused value.
@@ -437,6 +442,7 @@ static int __fill_vb2_buffer(struct vb2_ }static const struct vb2_buf_ops v4l2_buf_ops = { + .verify_planes_array = __verify_planes_array_core, .fill_user_buffer = __fill_v4l2_buffer, .fill_vb2_buffer = __fill_vb2_buffer, .copy_timestamp = __copy_timestamp,
Re: [PATCH 4.5 118/200] [media] videobuf2-v4l2: Verify planes array in buffer dequeueing
Hi Greg,
This patch seems to be causing trobles with DVB drivers that uses videobuf2-dvb.
Just sent a patch reverting it.
Regards,
Mauro
Em Mon, 2 May 2016 17:11:57 -0700
Greg Kroah-Hartman <[email protected]> escreveu:
Quoted 56 lines
4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit
2c1f6951a8a82e6de0d82b1158b5e493fc6c54abupstream.When a buffer is being dequeued using
VIDIOC_DQBUFIOCTL, the exact buffer which will be dequeued is not known until the buffer has been removed from the queue. The number of planes is specific to a buffer, not to the queue.This does lead to the situation where multi-plane buffers may be requested and queued with n planes, but
VIDIOC_DQBUFIOCTL may be passed an argument struct with fewer planes.
__fill_v4l2_buffer()however uses the number of planes from the dequeued videobuf2 buffer, overwriting kernel memory (the m.planes array allocated invideo_usercopy()inv4l2-ioctl.c) if the user provided fewer planes than the dequeued buffer had. Oops!Fixes b0e0e1f83de3 ("[media] media: videobuf2: Prepare to divide videobuf2")Signed-off-by Sakari Ailus <[email protected]>Acked-by Hans Verkuil <[email protected]>Signed-off-by Mauro Carvalho Chehab <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/media/v4l2-core/videobuf2-v4l2.c | 6 ++++++ 1 file changed, 6 insertions(+)drivers/media/v4l2-core/videobuf2-v4l2.c +6
-0@@ -74,6 +74,11 @@ static int __verify_planes_array(structreturn 0 ; } +static int __verify_planes_array_core (struct vb2_buffer *vb,const void *pb) +{ +return __verify_planes_array (vb, pb); +} +/** * __verify_length() - Verify that the bytesused value for each plane fits in * the plane length and that the data offset doesn't exceed the bytesused value. @@ -437,6 +442,7 @@ static int __fill_vb2_buffer(struct vb2_ }static const struct vb2_buf_ops v4l2_buf_ops = { + .verify_planes_array = __verify_planes_array_core, .fill_user_buffer = __fill_v4l2_buffer, .fill_vb2_buffer = __fill_vb2_buffer, .copy_timestamp = __copy_timestamp,
Signature · 2 lines
Thanks, Mauro
Greg Kroah-Hartman
maintainerPATCH 119/200 v4l2-dv-timings.h: fix polarity for 4k formats
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
commit 3020ca711871fdaf0c15c8bab677a6bc302e28fe upstream.
The VSync polarity was negative instead of positive for the 4k CEA formats. I probably copy-and-pasted these from the DMT 4k format, which does have a negative VSync polarity.
--- include/uapi/linux/v4l2-dv-timings.h | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-)
include/uapi/linux/v4l2-dv-timings.h +20 -10
@@ -183,7 +183,8 @@#define V4L2_DV_BT_CEA_3840X2160P24 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 297000000, 1276, 88, 296, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, \ V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -191,14 +192,16 @@#define V4L2_DV_BT_CEA_3840X2160P25 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 297000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \ }#define V4L2_DV_BT_CEA_3840X2160P30 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 297000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, \ V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -206,14 +209,16 @@#define V4L2_DV_BT_CEA_3840X2160P50 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 594000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \ }#define V4L2_DV_BT_CEA_3840X2160P60 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 594000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, \ V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -221,7 +226,8 @@#define V4L2_DV_BT_CEA_4096X2160P24 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 297000000, 1020, 88, 296, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, \ V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -229,14 +235,16 @@#define V4L2_DV_BT_CEA_4096X2160P25 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 297000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \ }#define V4L2_DV_BT_CEA_4096X2160P30 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 297000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, \ V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
@@ -244,14 +252,16 @@#define V4L2_DV_BT_CEA_4096X2160P50 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 594000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \ }#define V4L2_DV_BT_CEA_4096X2160P60 { \ .type = V4L2_DV_BT_656_1120, \ - V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \ + V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \ + V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \ 594000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \ V4L2_DV_BT_STD_CEA861, \ V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
Greg Kroah-Hartman
maintainerPATCH 120/200 cxl: Keep IRQ mappings on context teardown
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit d6776bba44d9752f6cdf640046070e71ee4bba7b upstream.
Keep IRQ mappings on context teardown. This won't leak IRQs as if we allocate the mapping again, the generic code will give the same mapping used last time.
Doing this works around a race in the generic code. Masking the interrupt introduces a race which can crash the kernel or result in IRQ that is never EOIed. The lost of EOI results in all subsequent mappings to the same HW IRQ never receiving an interrupt.
We've seen this race with cxl test cases which are doing heavy context startup and teardown at the same time as heavy interrupt load.
A fix to the generic code is being investigated also.
--- drivers/misc/cxl/irq.c | 1 - 1 file changed, 1 deletion(-)
drivers/misc/cxl/irq.c +0 -1
@@ -288,7 +288,6 @@ unsigned int cxl_map_irq(struct cxl *adavoid cxl_unmap_irq (unsigned int virq,void *cookie) {free_irq (virq, cookie); -irq_dispose_mapping (virq); } static int cxl_register_one_irq(struct cxl *adapter,
Greg Kroah-Hartman
maintainerPATCH 121/200 IB/core: Fix oops in ib_cache_gid_set_default_gid
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Ledford <[email protected]>
commit f4e7de63ab273b6a5e35c82eb4fc6363c855ddd4 upstream.
When we fail to find the default gid index, we can't continue processing in this routine or else we will pass a negative index to later routines resulting in invalid memory access attempts and a kernel oops.
--- drivers/infiniband/core/cache.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/core/cache.c +2 -1
@@ -691,7 +691,8 @@ void ib_cache_gid_set_default_gid(struct NULL);/* Coudn't find default GID location */ -WARN_ON (ix <0 ); +if (WARN_ON (ix <0 )) + goto release; zattr_type.gid_type = gid_type;
Greg Kroah-Hartman
maintainerPATCH 122/200 mwifiex: fix IBSS data path issue.
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: chunfan chen <[email protected]>
commit dc386ce76dedaeeaaf006fceb6ed8cf2e20ff026 upstream.
The port_open flag is not applicable for IBSS mode. IBSS data path was broken when port_open flag was introduced. This patch fixes the problem by correcting the checks.
--- drivers/net/wireless/marvell/mwifiex/sta_event.c | 10 ++++++---- drivers/net/wireless/marvell/mwifiex/wmm.c | 6 ++++-- 2 files changed, 10 insertions(+), 6 deletions(-)
drivers/net/wireless/marvell/mwifiex/sta_event.c +6 -4
@@ -607,11 +607,13 @@ int mwifiex_process_sta_event(struct mwicase EVENT_PS_AWAKE :mwifiex_dbg (adapter,EVENT ,"info: EVENT: AWAKE\n" ); -if (!adapter->pps_uapsd_mode && priv->port_open && +if (!adapter->pps_uapsd_mode && + (priv->port_open || + (priv->bss_mode ==NL80211_IFTYPE_ADHOC )) && priv->media_connected && adapter->sleep_period.period) { - adapter->pps_uapsd_mode = true; -mwifiex_dbg (adapter,EVENT , -"event: PPS/UAPSD mode activated\n" ); + adapter->pps_uapsd_mode = true; +mwifiex_dbg (adapter,EVENT , +"event: PPS/UAPSD mode activated\n" ); } adapter->tx_lock_flag = false;if (adapter->pps_uapsd_mode && adapter->gen_null_pkt) {
drivers/net/wireless/marvell/mwifiex/wmm.c +4 -2
@@ -475,7 +475,8 @@ mwifiex_wmm_lists_empty(struct mwifiex_a priv = adapter->priv[i];if (!priv)continue ; -if (!priv->port_open) +if (!priv->port_open && + (priv->bss_mode !=NL80211_IFTYPE_ADHOC ))continue ;if (adapter->if_ops.is_port_ready && !adapter->if_ops.is_port_ready (priv))
@@ -1099,7 +1100,8 @@ mwifiex_wmm_get_highest_priolist_ptr(str priv_tmp = adapter->bss_prio_tbl[j].bss_prio_cur->priv; -if (!priv_tmp->port_open || +if (((priv_tmp->bss_mode !=NL80211_IFTYPE_ADHOC ) && + !priv_tmp->port_open) || (atomic_read (&priv_tmp->wmm.tx_pkts_queued) ==0 ))continue ;
Greg Kroah-Hartman
maintainerPATCH 123/200 IB/mlx5: Expose correct max_sge_rd limit
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
commit 986ef95ecdd3eb6fa29433e68faa94c7624083be upstream.
mlx5 devices (Connect-IB, ConnectX-4, ConnectX-4-LX) has a limitation where rdma read work queue entries cannot exceed 512 bytes. A rdma_read wqe needs to fit in 512 bytes:
- wqe control segment (16 bytes)
- rdma segment (16 bytes)
- scatter elements (16 bytes each)
So max_sge_rd should be: (512 - 16 - 16) / 16 = 30.
--- drivers/infiniband/hw/mlx5/main.c | 2 +- include/linux/mlx5/device.h | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/main.c +1 -1
@@ -517,7 +517,7 @@ static int mlx5_ib_query_device(struct i sizeof(struct mlx5_wqe_ctrl_seg)) /sizeof (struct mlx5_wqe_data_seg ); props->max_sge =min (max_rq_sg, max_sq_sg); - props->max_sge_rd = props->max_sge; + props->max_sge_rd =MLX5_MAX_SGE_RD ; props->max_cq =1 <<MLX5_CAP_GEN (mdev, log_max_cq); props->max_cqe = (1 <<MLX5_CAP_GEN (mdev, log_max_cq_sz)) -1 ; props->max_mr =1 <<MLX5_CAP_GEN (mdev, log_max_mkey);
include/linux/mlx5/device.h +11 -0
@@ -363,6 +363,17 @@ enum { MLX5_CAP_OFF_CMDIF_CSUM = 46, }; +enum { +/* +* Max wqe size for rdma read is 512 bytes, so this +* limits our max_sge_rd as the wqe needs to fit: +* - ctrl segment (16 bytes) +* - rdma segment (16 bytes) +* - scatter elements (16 bytes each) +*/ +MLX5_MAX_SGE_RD = (512 -16 -16 ) /16 +}; +struct mlx5_inbox_hdr {__be16 opcode;u8 rsvd[4 ];
Greg Kroah-Hartman
maintainerPATCH 124/200 IB/security: Restrict use of the write() interface
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3 upstream.
The drivers/infiniband stack uses write() as a replacement for bi-directional ioctl(). This is not safe. There are ways to trigger write calls that result in the return structure that is normally written to user space being shunted off to user specified kernel memory instead.
For the immediate repair, detect and deny suspicious accesses to the write API.
For long term, update the user space libraries and the kernel API to something that doesn't present the same security vulnerabilities (likely a structured ioctl() interface).
The impacted uAPI interfaces are generally only available if hardware from drivers/infiniband is installed in the system.
--- drivers/infiniband/core/ucm.c | 4 ++++ drivers/infiniband/core/ucma.c | 3 +++ drivers/infiniband/core/uverbs_main.c | 5 +++++ drivers/infiniband/hw/qib/qib_file_ops.c | 5 +++++ drivers/staging/rdma/hfi1/TODO | 2 +- drivers/staging/rdma/hfi1/file_ops.c | 6 ++++++ include/rdma/ib.h | 16 ++++++++++++++++ 7 files changed, 40 insertions(+), 1 deletion(-)
drivers/infiniband/core/ucm.c +4 -0
@@ -48,6 +48,7 @@#include <asm/uaccess.h> +#include <rdma/ib.h> #include <rdma/ib_cm.h> #include <rdma/ib_user_cm.h> #include <rdma/ib_marshall.h>
@@ -1103,6 +1104,9 @@ static ssize_t ib_ucm_write(struct filestruct ib_ucm_cmd_hdr hdr;ssize_t result; +if (WARN_ON_ONCE (!ib_safe_file_access (filp))) +return -EACCES ; +if (len <sizeof (hdr))return -EINVAL ;
drivers/infiniband/core/ucma.c +3 -0
@@ -1574,6 +1574,9 @@ static ssize_t ucma_write(struct file *fstruct rdma_ucm_cmd_hdr hdr;ssize_t ret; +if (WARN_ON_ONCE (!ib_safe_file_access (filp))) +return -EACCES ; +if (len <sizeof (hdr))return -EINVAL ;
drivers/infiniband/core/uverbs_main.c +5 -0
@@ -48,6 +48,8 @@#include <asm/uaccess.h> +#include <rdma/ib.h> +#include "uverbs.h" MODULE_AUTHOR ("Roland Dreier" );
@@ -693,6 +695,9 @@ static ssize_t ib_uverbs_write(struct fiint srcu_key;ssize_t ret; +if (WARN_ON_ONCE (!ib_safe_file_access (filp))) +return -EACCES ; +if (count <sizeof hdr)return -EINVAL ;
drivers/infiniband/hw/qib/qib_file_ops.c +5 -0
@@ -45,6 +45,8 @@#include <linux/export.h> #include <linux/uio.h> +#include <rdma/ib.h> +#include "qib.h" #include "qib_common.h" #include "qib_user_sdma.h"
@@ -2067,6 +2069,9 @@ static ssize_t qib_write(struct file *fpssize_t ret =0 ;void *dest; +if (WARN_ON_ONCE (!ib_safe_file_access (fp))) +return -EACCES ; +if (count <sizeof (cmd.type)) { ret = -EINVAL ; goto bail;
drivers/staging/rdma/hfi1/TODO +1 -1
@@ -3,4 +3,4 @@ July, 2015 - Remove unneeded file entries in sysfs - Remove software processing of IB protocol and place in library for use by qib, ipath (if still present), hfi1, and eventually soft-roce - +- Replace incorrect uAPI
drivers/staging/rdma/hfi1/file_ops.c +6 -0
@@ -52,6 +52,8 @@#include <linux/vmalloc.h> #include <linux/io.h> +#include <rdma/ib.h> +#include "hfi.h" #include "pio.h" #include "device.h"
@@ -194,6 +196,10 @@ static ssize_t hfi1_file_write(struct fiint uctxt_required =1 ;int must_be_root =0 ; +/* FIXME: This interface cannot continue out of staging */ +if (WARN_ON_ONCE (!ib_safe_file_access (fp))) +return -EACCES ; +if (count <sizeof (cmd)) { ret = -EINVAL ; goto bail;
include/rdma/ib.h +16 -0
@@ -34,6 +34,7 @@#define _RDMA_IB_H#include <linux/types.h> +#include <linux/sched.h> struct ib_addr { union {
@@ -86,4 +87,19 @@ struct sockaddr_ib { __u64 sib_scope_id; }; +/* +* The IB interfaces that use write() as bi-directional ioctl() are +* fundamentally unsafe, since there are lots of ways to trigger "write()" +* calls from various contexts with elevated privileges. That includes the +* traditional suid executable error message writes, but also various kernel +* interfaces that can write to file descriptors. +* +* This function provides protection for the legacy API by restricting the +* calling context. +*/ +static inline bool ib_safe_file_access (struct file *filp) +{ +return filp->f_cred ==current_cred () &&segment_eq (get_fs (),USER_DS ); +} +#endif /* _RDMA_IB_H */
Greg Kroah-Hartman
maintainerPATCH 125/200 efi: Fix out-of-bounds read in variable_matches()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laszlo Ersek <[email protected]>
commit 630ba0cc7a6dbafbdee43795617c872b35cde1b4 upstream.
The variable_matches() function can currently read "var_name[len]", for example when:
- var_name[0] == 'a',
- len == 1
- match_name points to the NUL-terminated string "ab".
This function is supposed to accept "var_name" inputs that are not NUL-terminated (hence the "len" parameter"). Document the function, and access "var_name[*match]" only if "*match" is smaller than "len".
--- drivers/firmware/efi/vars.c | 39 +++++++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 12 deletions(-)
drivers/firmware/efi/vars.c +27 -12
@@ -202,29 +202,44 @@ static const struct variable_validate va { NULL_GUID, "", NULL }, }; +/* +* Check if @var_name matches the pattern given in @match_name. +* +* @var_name: an array of @len non-NUL characters. +* @match_name: a NUL-terminated pattern string, optionally ending in "*". A +* final "*" character matches any trailing characters @var_name, +* including the case when there are none left in @var_name. +* @match: on output, the number of non-wildcard characters in @match_name +* that @var_name matches, regardless of the return value. +* @return: whether @var_name fully matches @match_name. +*/ static bool variable_matches (const char *var_name,size_t len,const char *match_name,int *match) {for (*match =0 ; ; (*match)++) {char c = match_name[*match]; -char u = var_name[*match]; -/* Wildcard in the matching name means we've matched */ -if (c =='*' ) +switch (c) { +case '*' : +/* Wildcard in @match_name means we've matched. */ return true; -/* Case sensitive match */ -if (!c && *match == len) -return true; - -if (c != u) +case '\0' : +/* @match_name has ended. Has @var_name too? */ +return (*match == len); + +default : +/* +* We've reached a non-wildcard char in @match_name. +* Continue only if there's an identical character in +* @var_name. +*/ +if (*match < len && c == var_name[*match]) +continue ;return false; - -if (!c) -return true; + } } -return true; }bool
Greg Kroah-Hartman
maintainerPATCH 126/200 efi: Expose non-blocking set_variable() wrapper to efivars
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 9c6672ac9c91f7eb1ec436be1442b8c26d098e55 upstream.
Commit 6d80dba1c9fe ("efi: Provide a non-blocking SetVariable() operation") implemented a non-blocking alternative for the UEFI SetVariable() invocation performed by efivars, since it may occur in atomic context. However, this version of the function was never exposed via the efivars struct, so the non-blocking versions was not actually callable. Fix that.
--- drivers/firmware/efi/efi.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/efi/efi.c +1 -0
@@ -182,6 +182,7 @@ static int generic_ops_register(void) { generic_ops.get_variable = efi.get_variable; generic_ops.set_variable = efi.set_variable; + generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking; generic_ops.get_next_variable = efi.get_next_variable; generic_ops.query_variable_store = efi_query_variable_store;
Greg Kroah-Hartman
maintainerPATCH 127/200 x86/apic: Handle zero vector gracefully in clear_vector_irq()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
commit 1bdb8970392a68489b469c3a330a1adb5ef61beb upstream.
If x86_vector_alloc_irq() fails x86_vector_free_irqs() is invoked to cleanup the already allocated vectors. This subsequently calls clear_vector_irq().
The failed irq has no vector assigned, which triggers the BUG_ON(!vector) in clear_vector_irq().
We cannot suppress the call to x86_vector_free_irqs() for the failed interrupt, because the other data related to this irq must be cleaned up as well. So calling clear_vector_irq() with vector == 0 is legitimate.
Remove the BUG_ON and return if vector is zero,
[ tglx: Massaged changelog ]
--- arch/x86/kernel/apic/vector.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kernel/apic/vector.c +2 -1
@@ -256,7 +256,8 @@ static void clear_irq_vector(int irq, ststruct irq_desc *desc;int cpu, vector; -BUG_ON (!data->cfg.vector); +if (!data->cfg.vector) +return ; vector = data->cfg.vector;for_each_cpu_and (cpu, data->domain, cpu_online_mask)
Greg Kroah-Hartman
maintainerPATCH 128/200 workqueue: fix ghost PENDING flag while doing MQ IO
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Pen <[email protected]>
commit 346c09f80459a3ad97df1816d6d606169a51001a upstream.
The bug in a workqueue leads to a stalled IO request in MQ ctx->rq_list with the following backtrace:
[ 601.347452] INFO: task kworker/u129:5:1636 blocked for more than 120 seconds. [ 601.347574] Tainted: G O 4.4.5-1-storage+ #6 [ 601.347651] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 601.348142] kworker/u129:5 D ffff880803077988 0 1636 2 0x00000000 [ 601.348519] Workqueue: ibnbd_server_fileio_wq ibnbd_dev_file_submit_io_worker [ibnbd_server] [ 601.348999] ffff880803077988 ffff88080466b900 ffff8808033f9c80 ffff880803078000 [ 601.349662] ffff880807c95000 7fffffffffffffff ffffffff815b0920 ffff880803077ad0 [ 601.350333] ffff8808030779a0 ffffffff815b01d5 0000000000000000 ffff880803077a38 [ 601.350965] Call Trace: [ 601.351203] [<ffffffff815b0920>] ? bit_wait+0x60/0x60 [ 601.351444] [<ffffffff815b01d5>] schedule+0x35/0x80 [ 601.351709] [<ffffffff815b2dd2>] schedule_timeout+0x192/0x230 [ 601.351958] [<ffffffff812d43f7>] ? blk_flush_plug_list+0xc7/0x220 [ 601.352208] [<ffffffff810bd737>] ? ktime_get+0x37/0xa0 [ 601.352446] [<ffffffff815b0920>] ? bit_wait+0x60/0x60 [ 601.352688] [<ffffffff815af784>] io_schedule_timeout+0xa4/0x110 [ 601.352951] [<ffffffff815b3a4e>] ? _raw_spin_unlock_irqrestore+0xe/0x10 [ 601.353196] [<ffffffff815b093b>] bit_wait_io+0x1b/0x70 [ 601.353440] [<ffffffff815b056d>] __wait_on_bit+0x5d/0x90 [ 601.353689] [<ffffffff81127bd0>] wait_on_page_bit+0xc0/0xd0 [ 601.353958] [<ffffffff81096db0>] ? autoremove_wake_function+0x40/0x40 [ 601.354200] [<ffffffff81127cc4>] __filemap_fdatawait_range+0xe4/0x140 [ 601.354441] [<ffffffff81127d34>] filemap_fdatawait_range+0x14/0x30 [ 601.354688] [<ffffffff81129a9f>] filemap_write_and_wait_range+0x3f/0x70 [ 601.354932] [<ffffffff811ced3b>] blkdev_fsync+0x1b/0x50 [ 601.355193] [<ffffffff811c82d9>] vfs_fsync_range+0x49/0xa0 [ 601.355432] [<ffffffff811cf45a>] blkdev_write_iter+0xca/0x100 [ 601.355679] [<ffffffff81197b1a>] __vfs_write+0xaa/0xe0 [ 601.355925] [<ffffffff81198379>] vfs_write+0xa9/0x1a0 [ 601.356164] [<ffffffff811c59d8>] kernel_write+0x38/0x50
The underlying device is a null_blk, with default parameters:
queue_mode = MQ
submit_queues = 1
Verification that nullb0 has something inflight:
root@pserver8:~# cat /sys/block/nullb0/inflight
0 1
root@pserver8:~# find /sys/block/nullb0/mq/0/cpu* -name rq_list -print -exec cat {} \;
...
/sys/block/nullb0/mq/0/cpu2/rq_list
CTX pending:
ffff8838038e2400
...During debug it became clear that stalled request is always inserted in the rq_list from the following path:
save_stack_trace_tsk + 34
blk_mq_insert_requests + 231
blk_mq_flush_plug_list + 281
blk_flush_plug_list + 199
wait_on_page_bit + 192
__filemap_fdatawait_range + 228
filemap_fdatawait_range + 20
filemap_write_and_wait_range + 63
blkdev_fsync + 27
vfs_fsync_range + 73
blkdev_write_iter + 202
__vfs_write + 170
vfs_write + 169
kernel_write + 56
So blk_flush_plug_list() was called with from_schedule == true.
If from_schedule is true, that means that finally blk_mq_insert_requests() offloads execution of __blk_mq_run_hw_queue() and uses kblockd workqueue, i.e. it calls kblockd_schedule_delayed_work_on().
That means, that we race with another CPU, which is about to execute __blk_mq_run_hw_queue() work.
Further debugging shows the following traces from different CPUs:
CPU#0 CPU#1
---------------------------------- -------------------------------
reqeust A inserted
STORE hctx->ctx_map[0] bit marked
kblockd_schedule...() returns 1
<schedule to kblockd workqueue>
request B inserted STORE hctx->ctx_map[1] bit marked kblockd_schedule...() returns 0
*** WORK PENDING bit is cleared ***
flush_busy_ctxs() is executed, but
bit 1, set by CPU#1, is not observed
As a result request B pended forever.
This behaviour can be explained by speculative LOAD of hctx->ctx_map on CPU#0, which is reordered with clear of PENDING bit and executed _before_ actual STORE of bit 1 on CPU#1.
The proper fix is an explicit full barrier <mfence>, which guarantees that clear of PENDING bit is to be executed before all possible speculative LOADS or STORES inside actual work function.
--- kernel/workqueue.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
kernel/workqueue.c +29 -0
@@ -667,6 +667,35 @@ static void set_work_pool_and_clear_pend*/ smp_wmb ();set_work_data (work, (unsigned long )pool_id <<WORK_OFFQ_POOL_SHIFT ,0 ); +/* +* The following mb guarantees that previous clear of a PENDING bit +* will not be reordered with any speculative LOADS or STORES from +* work->current_func, which is executed afterwards. This possible +* reordering can lead to a missed execution on attempt to qeueue +* the same @work. E.g. consider this case: +* +* CPU#0 CPU#1 +* ---------------------------- -------------------------------- +* +* 1 STORE event_indicated +* 2 queue_work_on() { +* 3 test_and_set_bit(PENDING) +* 4 } set_..._and_clear_pending() { +* 5 set_work_data() # clear bit +* 6 smp_mb() +* 7 work->current_func() { +* 8 LOAD event_indicated +* } +* +* Without an explicit full barrier speculative LOAD on line 8 can +* be executed before CPU#0 does STORE on line 1. If that happens, +* CPU#0 observes the PENDING bit is still set and new execution of +* a @work is not queued in a hope, that CPU#1 will eventually +* finish the queued @work. Meanwhile CPU#1 does not see +* event_indicated is set, because speculative LOAD was executed +* before actual STORE. +*/ +smp_mb (); }static void clear_work_data (struct work_struct *work)
Greg Kroah-Hartman
maintainerPATCH 129/200 slub: clean up code for kmem cgroup support to kmem_cache_free_bulk
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesper Dangaard Brouer <[email protected]>
commit 376bf125ac781d32e202760ed7deb1ae4ed35d31 upstream.
This change is primarily an attempt to make it easier to realize the optimizations the compiler performs in-case CONFIG_MEMCG_KMEM is not enabled.
Performance wise, even when CONFIG_MEMCG_KMEM is compiled in, the overhead is zero. This is because, as long as no process have enabled kmem cgroups accounting, the assignment is replaced by asm-NOP operations. This is possible because memcg_kmem_enabled() uses a static_key_false() construct.
It also helps readability as it avoid accessing the p[] array like:
p[size - 1] which "expose" that the array is processed backwards inside helper function build_detached_freelist().
Lastly this also makes the code more robust, in error case like passing NULL pointers in the array. Which were previously handled before commit 033745189b1b ("slub: add missing kmem cgroup support to kmem_cache_free_bulk").
--- mm/slub.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
mm/slub.c +11 -11
@@ -2815,6 +2815,7 @@ struct detached_freelist {void *tail;void *freelist;int cnt; +struct kmem_cache *s; };/*
@@ -2829,8 +2830,9 @@ struct detached_freelist {* synchronization primitive. Look ahead in the array is limited due * to performance reasons. */ -static int build_detached_freelist (struct kmem_cache *s,size_t size, -void **p,struct detached_freelist *df) +static inline +int build_detached_freelist (struct kmem_cache *s,size_t size, +void **p,struct detached_freelist *df) {size_t first_skipped_index =0 ;int lookahead =3 ;
@@ -2846,8 +2848,11 @@ static int build_detached_freelist(strucif (!object)return 0 ; +/* Support for memcg, compiler can optimize this out */ + df->s =cache_from_obj (s, object); +/* Start new detached freelist */ -set_freepointer (s, object,NULL ); +set_freepointer (df->s, object,NULL ); df->page =virt_to_head_page (object); df->tail = object; df->freelist = object;
@@ -2862,7 +2867,7 @@ static int build_detached_freelist(struc/* df->page is always set at this point */ if (df->page ==virt_to_head_page (object)) {/* Opportunity build freelist */ -set_freepointer (s, object, df->freelist); +set_freepointer (df->s, object, df->freelist); df->freelist = object; df->cnt++; p[size] =NULL ;/* mark object processed */
@@ -2881,25 +2886,20 @@ static int build_detached_freelist(strucreturn first_skipped_index; } -/* Note that interrupts must be enabled when calling this function. */ -void kmem_cache_free_bulk (struct kmem_cache *orig_s,size_t size,void **p) +void kmem_cache_free_bulk (struct kmem_cache *s,size_t size,void **p) {if (WARN_ON (!size))return ;do {struct detached_freelist df; -struct kmem_cache *s; - -/* Support for memcg */ - s =cache_from_obj (orig_s, p[size -1 ]); size =build_detached_freelist (s, size, p, &df);if (unlikely (!df.page))continue ; -slab_free (s, df.page, df.freelist, df.tail, df.cnt, _RET_IP_); +slab_free (df.s, df.page, df.freelist, df.tail, df.cnt,_RET_IP_); }while (likely (size)); }EXPORT_SYMBOL (kmem_cache_free_bulk);
Greg Kroah-Hartman
maintainerPATCH 130/200 cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 5cf1cacb49aee39c3e02ae87068fc3c6430659b0 upstream.
Since e93ad19d0564 ("cpuset: make mm migration asynchronous"), cpuset kicks off asynchronous NUMA node migration if necessary during task migration and flushes it from cpuset_post_attach_flush() which is called at the end of __cgroup_procs_write(). This is to avoid performing migration with cgroup_threadgroup_rwsem write-locked which can lead to deadlock through dependency on kworker creation.
memcg has a similar issue with charge moving, so let's convert it to an official callback rather than the current one-off cpuset specific function. This patch adds cgroup_subsys->post_attach callback and makes cpuset register cpuset_post_attach_flush() as its ->post_attach.
The conversion is mostly one-to-one except that the new callback is called under cgroup_mutex. This is to guarantee that no other migration operations are started before ->post_attach callbacks are finished. cgroup_mutex is one of the outermost mutex in the system and has never been and shouldn't be a problem. We can add specialized synchronization around __cgroup_procs_write() but I don't think there's any noticeable benefit.
--- include/linux/cgroup-defs.h | 1 + include/linux/cpuset.h | 6 ------ kernel/cgroup.c | 7 +++++-- kernel/cpuset.c | 4 ++-- 4 files changed, 8 insertions(+), 10 deletions(-)
include/linux/cgroup-defs.h +1 -0
@@ -442,6 +442,7 @@ struct cgroup_subsys {int (*can_attach)(struct cgroup_taskset *tset);void (*cancel_attach)(struct cgroup_taskset *tset);void (*attach)(struct cgroup_taskset *tset); +void (*post_attach)(void );int (*can_fork)(struct task_struct *task);void (*cancel_fork)(struct task_struct *task);void (*fork)(struct task_struct *task);
include/linux/cpuset.h +0 -6
@@ -137,8 +137,6 @@ static inline void set_mems_allowed(node task_unlock(current); } -extern void cpuset_post_attach_flush (void ); -#else /* !CONFIG_CPUSETS */ static inline bool cpusets_enabled (void ) {return false; }
@@ -245,10 +243,6 @@ static inline bool read_mems_allowed_retreturn false; } -static inline void cpuset_post_attach_flush (void ) -{ -} -#endif /* !CONFIG_CPUSETS */ #endif /* _LINUX_CPUSET_H */
kernel/cgroup.c +5 -2
@@ -2697,9 +2697,10 @@ static ssize_t __cgroup_procs_write(stru size_t nbytes, loff_t off, bool threadgroup) {struct task_struct *tsk; +struct cgroup_subsys *ss;struct cgroup *cgrp;pid_t pid; -int ret; +int ssid, ret;if (kstrtoint (strstrip (buf),0 , &pid) || pid <0 )return -EINVAL ;
@@ -2747,8 +2748,10 @@ out_unlock_rcu:rcu_read_unlock (); out_unlock_threadgroup:percpu_up_write (&cgroup_threadgroup_rwsem); +for_each_subsys (ss, ssid) +if (ss->post_attach) + ss->post_attach ();cgroup_kn_unlock (of->kn); -cpuset_post_attach_flush ();return ret ?: nbytes; }
kernel/cpuset.c +2 -2
@@ -58,7 +58,6 @@#include <asm/uaccess.h> #include <linux/atomic.h> #include <linux/mutex.h> -#include <linux/workqueue.h> #include <linux/cgroup.h> #include <linux/wait.h>
@@ -1016,7 +1015,7 @@ static void cpuset_migrate_mm(struct mm_ } } -void cpuset_post_attach_flush (void ) +static void cpuset_post_attach (void ) {flush_workqueue (cpuset_migrate_mm_wq); }
@@ -2087,6 +2086,7 @@ struct cgroup_subsys cpuset_cgrp_subsys .can_attach = cpuset_can_attach, .cancel_attach = cpuset_cancel_attach, .attach = cpuset_attach, + .post_attach = cpuset_post_attach, .bind = cpuset_bind, .legacy_cftypes = files, .early_init = 1,
Greg Kroah-Hartman
maintainerPATCH 131/200 memcg: relocate charge moving from ->attach to ->post_attach
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 264a0ae164bc0e9144bebcd25ff030d067b1a878 upstream.
Hello,
So, this ended up a lot simpler than I originally expected. I tested it lightly and it seems to work fine. Petr, can you please test these two patches w/o the lru drain drop patch and see whether the problem is gone?
Thanks.
------ 8< ------
If charge moving is used, memcg performs relabeling of the affected pages from its ->attach callback which is called under both cgroup_threadgroup_rwsem and thus can't create new kthreads. This is fragile as various operations may depend on workqueues making forward progress which relies on the ability to create new kthreads.
There's no reason to perform charge moving from ->attach which is deep in the task migration path. Move it to ->post_attach which is called after the actual migration is finished and cgroup_threadgroup_rwsem is dropped.
* move_charge_struct->mm is added and ->can_attach is now responsible for pinning and recording the target mm. mem_cgroup_clear_mc() is updated accordingly. This also simplifies mem_cgroup_move_task().
* mem_cgroup_move_task() is now called from ->post_attach instead of ->attach.
--- mm/memcontrol.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-)
mm/memcontrol.c +19 -18
@@ -207,6 +207,7 @@ static void mem_cgroup_oom_notify(struct/* "mc" and its members are protected by cgroup_mutex */ static struct move_charge_struct { spinlock_t lock; /* for from, to */ + struct mm_struct *mm; struct mem_cgroup *from; struct mem_cgroup *to; unsigned long flags;
@@ -4730,6 +4731,8 @@ static void __mem_cgroup_clear_mc(void)static void mem_cgroup_clear_mc (void ) { +struct mm_struct *mm = mc.mm; +/* * we must clear moving_task before waking up waiters at the end of * task migration.
@@ -4739,7 +4742,10 @@ static void mem_cgroup_clear_mc(void)spin_lock (&mc.lock); mc.from =NULL ; mc.to =NULL ; + mc.mm =NULL ;spin_unlock (&mc.lock); + +mmput (mm); }static int mem_cgroup_can_attach (struct cgroup_taskset *tset)
@@ -4796,6 +4802,7 @@ static int mem_cgroup_can_attach(structVM_BUG_ON (mc.moved_swap);spin_lock (&mc.lock); + mc.mm = mm; mc.from = from; mc.to = memcg; mc.flags = move_flags;
@@ -4805,8 +4812,9 @@ static int mem_cgroup_can_attach(struct ret =mem_cgroup_precharge_mc (mm);if (ret)mem_cgroup_clear_mc (); + }else { +mmput (mm); } -mmput (mm);return ret; }
@@ -4915,11 +4923,11 @@ put: /* get_mctgt_type() gets the pagereturn ret; } -static void mem_cgroup_move_charge (struct mm_struct *mm) +static void mem_cgroup_move_charge (void ) {struct mm_walk mem_cgroup_move_charge_walk = { .pmd_entry = mem_cgroup_move_charge_pte_range, - .mm = mm, + .mm = mc.mm, };lru_add_drain_all ();
@@ -4931,7 +4939,7 @@ static void mem_cgroup_move_charge(strucatomic_inc (&mc.from->moving_account);synchronize_rcu (); retry: -if (unlikely (!down_read_trylock (&mm->mmap_sem))) { +if (unlikely (!down_read_trylock (&mc.mm->mmap_sem))) {/* * Someone who are holding the mmap_sem might be waiting in * waitq. So we cancel all extra charges, wake up all waiters,
@@ -4948,23 +4956,16 @@ retry:* additional charge, the page walk just aborts. */ walk_page_range (0 , ~0UL , &mem_cgroup_move_charge_walk); -up_read (&mm->mmap_sem); +up_read (&mc.mm->mmap_sem); atomic_dec(&mc.from->moving_account); } -static void mem_cgroup_move_task (struct cgroup_taskset *tset) +static void mem_cgroup_move_task (void ) { -struct cgroup_subsys_state *css; -struct task_struct *p =cgroup_taskset_first (tset, &css); -struct mm_struct *mm =get_task_mm (p); - -if (mm) { -if (mc.to) -mem_cgroup_move_charge (mm); -mmput (mm); - } -if (mc.to) +if (mc.to) { +mem_cgroup_move_charge ();mem_cgroup_clear_mc (); + } }#else /* !CONFIG_MMU */ static int mem_cgroup_can_attach (struct cgroup_taskset *tset)
@@ -4974,7 +4975,7 @@ static int mem_cgroup_can_attach(structstatic void mem_cgroup_cancel_attach (struct cgroup_taskset *tset) { } -static void mem_cgroup_move_task (struct cgroup_taskset *tset) +static void mem_cgroup_move_task (void ) { }#endif
@@ -5246,7 +5247,7 @@ struct cgroup_subsys memory_cgrp_subsys .css_reset = mem_cgroup_css_reset, .can_attach = mem_cgroup_can_attach, .cancel_attach = mem_cgroup_cancel_attach, - .attach = mem_cgroup_move_task, + .post_attach = mem_cgroup_move_task, .bind = mem_cgroup_bind, .dfl_cftypes = memory_files, .legacy_cftypes = mem_cgroup_legacy_files,
Greg Kroah-Hartman
maintainerPATCH 132/200 mm: exclude HugeTLB pages from THP page_mapped() logic
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Capper <[email protected]>
commit 66ee95d16a7f1b7b4f1dd74a2d81c6e19dc29a14 upstream.
HugeTLB pages cannot be split, so we use the compound_mapcount to track rmaps.
Currently page_mapped() will check the compound_mapcount, but will also go through the constituent pages of a THP compound page and query the individual _mapcount's too.
Unfortunately, page_mapped() does not distinguish between HugeTLB and THP compound pages and assumes that a compound page always needs to have HPAGE_PMD_NR pages querying.
For most cases when dealing with HugeTLB this is just inefficient, but for scenarios where the HugeTLB page size is less than the pmd block size (e.g. when using contiguous bit on ARM) this can lead to crashes.
This patch adjusts the page_mapped function such that we skip the unnecessary THP reference checks for HugeTLB pages.
--- include/linux/mm.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/mm.h +2 -0
@@ -1010,6 +1010,8 @@ static inline bool page_mapped(struct pa page =compound_head (page);if (atomic_read (compound_mapcount_ptr (page)) >=0 )return true; +if (PageHuge (page)) +return false;for (i =0 ; i <hpage_nr_pages (page); i++) {if (atomic_read (&page[i]._mapcount) >=0 )return true;
Greg Kroah-Hartman
maintainerPATCH 133/200 mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <[email protected]>
commit 3486b85a29c1741db99d0c522211c82d2b7a56d0 upstream.
Khugepaged detects own VMAs by checking vm_file and vm_ops but this way it cannot distinguish private /dev/zero mappings from other special mappings like /dev/hpet which has no vm_ops and popultes PTEs in mmap.
This fixes false-positive VM_BUG_ON and prevents installing THP where they are not expected.
--- mm/huge_memory.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
mm/huge_memory.c +2 -4
@@ -1919,10 +1919,9 @@ int khugepaged_enter_vma_merge(struct vm* page fault if needed. */ return 0 ; -if (vma->vm_ops) +if (vma->vm_ops || (vm_flags &VM_NO_THP ))/* khugepaged not yet working on file or special mappings */ return 0 ; -VM_BUG_ON_VMA (vm_flags &VM_NO_THP , vma); hstart = (vma->vm_start + ~HPAGE_PMD_MASK ) &HPAGE_PMD_MASK ; hend = vma->vm_end &HPAGE_PMD_MASK ;if (hstart < hend)
@@ -2310,8 +2309,7 @@ static bool hugepage_vma_check(struct vmreturn false;if (is_vma_temporary_stack (vma))return false; -VM_BUG_ON_VMA (vma->vm_flags &VM_NO_THP , vma); -return true; +return !(vma->vm_flags &VM_NO_THP ); } static void collapse_huge_page(struct mm_struct *mm,
Greg Kroah-Hartman
maintainerPATCH 134/200 numa: fix /proc/<pid>/numa_maps for THP
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Schaefer <[email protected]>
commit 28093f9f34cedeaea0f481c58446d9dac6dd620f upstream.
In gather_pte_stats() a THP pmd is cast into a pte, which is wrong because the layouts may differ depending on the architecture. On s390 this will lead to inaccurate numa_maps accounting in /proc because of misguided pte_present() and pte_dirty() checks on the fake pte.
On other architectures pte_present() and pte_dirty() may work by chance, but there may be an issue with direct-access (dax) mappings w/o underlying struct pages when HAVE_PTE_SPECIAL is set and THP is available. In vm_normal_page() the fake pte will be checked with pte_special() and because there is no "special" bit in a pmd, this will always return false and the VM_PFNMAP | VM_MIXEDMAP checking will be skipped. On dax mappings w/o struct pages, an invalid struct page pointer would then be returned that can crash the kernel.
This patch fixes the numa_maps THP handling by introducing new "_pmd" variants of the can_gather_numa_stats() and vm_normal_page() functions.
--- fs/proc/task_mmu.c | 33 ++++++++++++++++++++++++++++++--- include/linux/mm.h | 2 ++ mm/memory.c | 40 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 72 insertions(+), 3 deletions(-)
fs/proc/task_mmu.c +30 -3
@@ -1504,6 +1504,32 @@ static struct page *can_gather_numa_statreturn page; } +#ifdef CONFIG_TRANSPARENT_HUGEPAGE +static struct page *can_gather_numa_stats_pmd (pmd_t pmd, +struct vm_area_struct *vma, +unsigned long addr) +{ +struct page *page; +int nid; + +if (!pmd_present (pmd)) +return NULL ; + + page =vm_normal_page_pmd (vma, addr, pmd); +if (!page) +return NULL ; + +if (PageReserved (page)) +return NULL ; + + nid =page_to_nid (page); +if (!node_isset (nid, node_states[N_MEMORY ])) +return NULL ; + +return page; +} +#endif +static int gather_pte_stats (pmd_t *pmd,unsigned long addr,unsigned long end,struct mm_walk *walk) {
@@ -1513,14 +1539,14 @@ static int gather_pte_stats(pmd_t *pmd,pte_t *orig_pte;pte_t *pte; +#ifdef CONFIG_TRANSPARENT_HUGEPAGE ptl =pmd_trans_huge_lock (pmd, vma);if (ptl) { -pte_t huge_pte = *(pte_t *)pmd;struct page *page; - page =can_gather_numa_stats (huge_pte, vma, addr); + page =can_gather_numa_stats_pmd (*pmd, vma, addr);if (page) -gather_stats (page, md,pte_dirty (huge_pte), +gather_stats (page, md,pmd_dirty (*pmd),HPAGE_PMD_SIZE /PAGE_SIZE );spin_unlock (ptl);return 0 ;
@@ -1528,6 +1554,7 @@ static int gather_pte_stats(pmd_t *pmd,if (pmd_trans_unstable (pmd))return 0 ; +#endif orig_pte = pte =pte_offset_map_lock (walk->mm, pmd, addr, &ptl); do { struct page *page = can_gather_numa_stats(*pte, vma, addr);
include/linux/mm.h +2 -0
@@ -1119,6 +1119,8 @@ struct zap_details {struct page *vm_normal_page (struct vm_area_struct *vma,unsigned long addr,pte_t pte); +struct page *vm_normal_page_pmd (struct vm_area_struct *vma,unsigned long addr, +pmd_t pmd);int zap_vma_ptes (struct vm_area_struct *vma,unsigned long address,unsigned long size);
mm/memory.c +40 -0
@@ -792,6 +792,46 @@ out:return pfn_to_page (pfn); } +#ifdef CONFIG_TRANSPARENT_HUGEPAGE +struct page *vm_normal_page_pmd (struct vm_area_struct *vma,unsigned long addr, +pmd_t pmd) +{ +unsigned long pfn =pmd_pfn (pmd); + +/* +* There is no pmd_special() but there may be special pmds, e.g. +* in a direct-access (dax) mapping, so let's just replicate the +* !HAVE_PTE_SPECIAL case from vm_normal_page() here. +*/ +if (unlikely (vma->vm_flags & (VM_PFNMAP |VM_MIXEDMAP ))) { +if (vma->vm_flags &VM_MIXEDMAP ) { +if (!pfn_valid (pfn)) +return NULL ; + goto out; + }else { +unsigned long off; + off = (addr - vma->vm_start) >>PAGE_SHIFT ; +if (pfn == vma->vm_pgoff + off) +return NULL ; +if (!is_cow_mapping (vma->vm_flags)) +return NULL ; + } + } + +if (is_zero_pfn (pfn)) +return NULL ; +if (unlikely (pfn > highest_memmap_pfn)) +return NULL ; + +/* +* NOTE! We still have PageReserved() pages in the page tables. +* eg. VDSO mappings can cause them to exist. +*/ +out: +return pfn_to_page (pfn); +} +#endif +/* * copy one vm_area from one task to the other. Assumes the page tables * already present in the new task to be cleared in the whole range
Greg Kroah-Hartman
maintainerPATCH 135/200 mm: vmscan: reclaim highmem zone if buffer_heads is over limit
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minchan Kim <[email protected]>
commit 7bf52fb891b64b8d61caf0b82060adb9db761aec upstream.
We have been reclaimed highmem zone if buffer_heads is over limit but commit 6b4f7799c6a5 ("mm: vmscan: invoke slab shrinkers from shrink_zone()") changed the behavior so it doesn't reclaim highmem zone although buffer_heads is over the limit. This patch restores the logic.
--- mm/vmscan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/vmscan.c +1 -1
@@ -2561,7 +2561,7 @@ static bool shrink_zones(struct zonelist sc->gfp_mask |= __GFP_HIGHMEM;for_each_zone_zonelist_nodemask (zone, z, zonelist, - requested_highidx, sc->nodemask) { +gfp_zone (sc->gfp_mask), sc->nodemask) {enum zone_type classzone_idx;if (!populated_zone (zone))
Greg Kroah-Hartman
maintainerPATCH 136/200 mm/hwpoison: fix wrong num_poisoned_pages accounting
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minchan Kim <[email protected]>
commit d7e69488bd04de165667f6bc741c1c0ec6042ab9 upstream.
Currently, migration code increses num_poisoned_pages on *failed* migration page as well as successfully migrated one at the trial of memory-failure. It will make the stat wrong. As well, it marks the page as PG_HWPoison even if the migration trial failed. It would mean we cannot recover the corrupted page using memory-failure facility.
This patches fixes it.
--- mm/migrate.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
mm/migrate.c +7 -1
@@ -967,7 +967,13 @@ out:dec_zone_page_state (page,NR_ISOLATED_ANON +page_is_file_cache (page));/* Soft-offlined page shouldn't go through lru cache list */ -if (reason ==MR_MEMORY_FAILURE ) { +if (reason ==MR_MEMORY_FAILURE && rc ==MIGRATEPAGE_SUCCESS ) { +/* +* With this release, we free successfully migrated +* page and set PG_HWPoison on just freed page +* intentionally. Although it's rather weird, it's how +* HWPoison flag works at the moment. +*/ put_page (page);if (!test_set_page_hwpoison (page))num_poisoned_pages_inc ();
Greg Kroah-Hartman
maintainerPATCH 137/200 USB: usbip: fix potential out-of-bounds write
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
commit b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb upstream.
Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a packet from its peer, usbip code parses headers according to protocol. As part of this parsing urb->actual_length is filled. Since the input for urb->actual_length comes from the network, it should be treated as untrusted. Any entity controlling the network may put any value in the input and the preallocated urb->transfer_buffer may not be large enough to hold the data. Thus, the malicious entity is able to write arbitrary data to kernel memory.
--- drivers/usb/usbip/usbip_common.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/usbip/usbip_common.c +11 -0
@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_deviceif (!(size >0 ))return 0 ; +if (size > urb->transfer_buffer_length) { +/* should not happen, probably malicious packet */ +if (ud->side ==USBIP_STUB ) { +usbip_event_add (ud,SDEV_EVENT_ERROR_TCP ); +return 0 ; + }else { +usbip_event_add (ud,VDEV_EVENT_ERROR_TCP ); +return -EPIPE ; + } + } + ret =usbip_recv (ud->tcp_socket, urb->transfer_buffer, size);if (ret != size) {dev_err (&urb->dev->dev,"recv xbuf, %d\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 138/200 locking/mcs: Fix mcs_spin_lock() ordering
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 920c720aa5aa3900a7f1689228fdfc2580a91e7e upstream.
Similar to commit b4b29f94856a ("locking/osq: Fix ordering of node initialisation in osq_lock") the use of xchg_acquire() is fundamentally broken with MCS like constructs.
Furthermore, it turns out we rely on the global transitivity of this operation because the unlock path observes the pointer with a READ_ONCE(), not an smp_load_acquire().
This is non-critical because the MCS code isn't actually used and mostly serves as documentation, a stepping stone to the more complex things we've build on top of the idea.
--- kernel/locking/mcs_spinlock.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
kernel/locking/mcs_spinlock.h +7 -1
@@ -67,7 +67,13 @@ void mcs_spin_lock(struct mcs_spinlock * node->locked =0 ; node->next =NULL ; - prev =xchg_acquire (lock, node); +/* +* We rely on the full barrier with global transitivity implied by the +* below xchg() to order the initialization stores above against any +* observation of @node. And to provide the ACQUIRE ordering associated +* with a LOCK primitive. +*/ + prev =xchg (lock, node);if (likely (prev ==NULL )) {/* * Lock acquired, don't need to set node->locked to 1. Threads
Greg Kroah-Hartman
maintainerPATCH 139/200 spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huibin Hong <[email protected]>
commit b920cc3191d7612f26f36ee494e05b5ffd9044c0 upstream.
Rockchip_spi_set_cs could be called by spi_setup, but spi_setup may be called by device driver after runtime suspend. Then the spi clock is closed, rockchip_spi_set_cs may access the spi registers, which causes cpu block in some socs.
--- drivers/spi/spi-rockchip.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/spi/spi-rockchip.c +6 -1
@@ -265,7 +265,10 @@ static inline u32 rx_max(struct rockchipstatic void rockchip_spi_set_cs (struct spi_device *spi,bool enable) {u32 ser; -struct rockchip_spi *rs =spi_master_get_devdata (spi->master); +struct spi_master *master = spi->master; +struct rockchip_spi *rs =spi_master_get_devdata (master); + +pm_runtime_get_sync (rs->dev); ser =readl_relaxed (rs->regs +ROCKCHIP_SPI_SER ) &SER_MASK ;
@@ -290,6 +293,8 @@ static void rockchip_spi_set_cs(struct s ser &= ~(1 << spi->chip_select);writel_relaxed (ser, rs->regs +ROCKCHIP_SPI_SER ); + +pm_runtime_put_sync (rs->dev); } static int rockchip_spi_prepare_message(struct spi_master *master,
Greg Kroah-Hartman
maintainerPATCH 140/200 irqchip/sunxi-nmi: Fix error check of of_io_request_and_map()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit cfe199afefe6201e998ddc07102fc1fdb55f196c upstream.
The of_io_request_and_map() returns a valid pointer in iomem region or ERR_PTR(), check for NULL always fails and may cause a NULL pointer dereference on error path.
--- drivers/irqchip/irq-sunxi-nmi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/irq-sunxi-nmi.c +2 -2
@@ -160,9 +160,9 @@ static int __init sunxi_sc_nmi_irq_init( gc =irq_get_domain_generic_chip (domain,0 ); gc->reg_base =of_io_request_and_map (node,0 ,of_node_full_name (node)); -if (!gc->reg_base) { +if (IS_ERR (gc->reg_base)) {pr_err ("unable to map resource\n" ); - ret = -ENOMEM ; + ret =PTR_ERR (gc->reg_base); goto fail_irqd_remove; }
Greg Kroah-Hartman
maintainerPATCH 141/200 irqchip/mxs: Fix error check of of_io_request_and_map()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit edf8fcdc6b254236be005851af35ea5e826e7e09 upstream.
The of_io_request_and_map() returns a valid pointer in iomem region or ERR_PTR(), check for NULL always fails and may cause a NULL pointer dereference on error path.
--- drivers/irqchip/irq-mxs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-mxs.c +1 -1
@@ -183,7 +183,7 @@ static void __iomem * __init icoll_init_void __iomem *icoll_base; icoll_base =of_io_request_and_map (np,0 , np->name); -if (!icoll_base) +if (IS_ERR (icoll_base))panic ("%s: unable to map resource" , np->full_name);return icoll_base; }
Greg Kroah-Hartman
maintainerPATCH 142/200 regulator: s5m8767: fix get_register() error handling
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit e07ff9434167981c993a26d2edbbcb8e13801dbb upstream.
The s5m8767_pmic_probe() function calls s5m8767_get_register() to read data without checking the return code, which produces a compile-time warning when that data is accessed:
drivers/regulator/s5m8767.c: In function 's5m8767_pmic_probe':drivers/regulator/s5m8767.c:924:7: error: 'enable_reg' may be used uninitialized in this function [-Werror=maybe-uninitialized] drivers/regulator/s5m8767.c:944:30: error: 'enable_val' may be used uninitialized in this function [-Werror=maybe-uninitialized]
This changes the s5m8767_get_register() function to return a -EINVAL not just for an invalid register number but also for an invalid regulator number, as both would result in returning uninitialized data. The s5m8767_pmic_probe() function is then changed accordingly to fail on a read error, as all the other callers of s5m8767_get_register() already do.
In practice this probably cannot happen, as we don't call s5m8767_get_register() with invalid arguments, but the gcc warning seems valid in principle, in terms writing safe error checking.
--- drivers/regulator/s5m8767.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/regulator/s5m8767.c +9 -4
@@ -202,9 +202,10 @@ static int s5m8767_get_register(struct s } } -if (i < s5m8767->num_regulators) - *enable_ctrl = - s5m8767_opmode_reg[reg_id][mode] <<S5M8767_ENCTRL_SHIFT ; +if (i >= s5m8767->num_regulators) +return -EINVAL ; + + *enable_ctrl = s5m8767_opmode_reg[reg_id][mode] <<S5M8767_ENCTRL_SHIFT ;return 0 ; }
@@ -937,8 +938,12 @@ static int s5m8767_pmic_probe(struct plaelse regulators[id].vsel_mask =0xff ; -s5m8767_get_register (s5m8767, id, &enable_reg, + ret =s5m8767_get_register (s5m8767, id, &enable_reg, &enable_val); +if (ret) { +dev_err (s5m8767->dev,"error reading registers\n" ); +return ret; + } regulators[id].enable_reg = enable_reg; regulators[id].enable_mask =S5M8767_ENCTRL_MASK ; regulators[id].enable_val = enable_val;
Greg Kroah-Hartman
maintainerPATCH 143/200 paride: make verbose parameter an int again
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit dec63a4dec2d6d01346fd5d96062e67c0636852b upstream.
gcc-6.0 found an ancient bug in the paride driver, which had a "module_param(verbose, bool, 0);" since before 2.6.12, but actually uses it to accept '0', '1' or '2' as arguments:
drivers/block/paride/pd.c: In function 'pd_init_dev_parms':
drivers/block/paride/pd.c:298:29: warning: comparison of constant '1' with boolean expression is always false [-Wbool-compare]
#define DBMSG(msg) ((verbose>1)?(msg):NULL)
In 2012, Rusty did a cleanup patch that also changed the type of the variable to 'bool', which introduced what is now a gcc warning.
This changes the type back to 'int' and adapts the module_param() line instead, so it should work as documented in case anyone ever cares about running the ancient driver with debugging.
Rusty Russell <[email protected]>
--- drivers/block/paride/pd.c | 4 ++-- drivers/block/paride/pt.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/block/paride/pd.c +2 -2
@@ -126,7 +126,7 @@*/ #include <linux/types.h> -static bool verbose =0 ; +static int verbose =0 ;static int major =PD_MAJOR ;static char *name =PD_NAME ;static int cluster =64 ;
@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO,static DEFINE_MUTEX (pd_mutex);static DEFINE_SPINLOCK (pd_lock); -module_param (verbose, bool,0 ); +module_param (verbose, int,0 );module_param (major, int,0 );module_param (name, charp,0 );module_param (cluster, int,0 );
drivers/block/paride/pt.c +2 -2
@@ -117,7 +117,7 @@*/ -static bool verbose =0 ; +static int verbose =0 ;static int major =PT_MAJOR ;static char *name =PT_NAME ;static int disable =0 ;
@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {&drive0, &#include <asm/uaccess.h> -module_param (verbose, bool,0 ); +module_param (verbose, int,0 );module_param (major, int,0 );module_param (name, charp,0 );module_param_array (drive0, int,NULL ,0 );
Greg Kroah-Hartman
maintainerPATCH 144/200 scsi_dh: force modular build if SCSI is a module
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 0c994c03c926d26ce48e6bbabbbe60366044fcae upstream.
When the scsi_dh core was moved into the scsi core module, CONFIG_SCSI_DH became a 'bool' option, and now anything depending on it can be built-in even when CONFIG_SCSI=m. This of course cannot link successfully:
drivers/scsi/built-in.o: In function `rdac_init':
scsi_dh_alua.c:(.init.text+0x14): undefined reference to scsi_register_device_handler' scsi_dh_alua.c:(.init.text+0x64): undefined reference to scsi_unregister_device_handler' drivers/scsi/built-in.o: In function `alua_init':
scsi_dh_alua.c:(.init.text+0xb0): undefined reference to `scsi_register_device_handler'
As a workaround, this adds an extra dependency on CONFIG_SCSI, so Kconfig can figure out whether built-in is allowed or not.
--- drivers/scsi/device_handler/Kconfig | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/device_handler/Kconfig +4 -4
@@ -13,13 +13,13 @@ menuconfig SCSI_DH config SCSI_DH_RDAC tristate "LSI RDAC Device Handler" - depends on SCSI_DH + depends on SCSI_DH && SCSI help If you have a LSI RDAC select y. Otherwise, say N. config SCSI_DH_HP_SW tristate "HP/COMPAQ MSA Device Handler" - depends on SCSI_DH + depends on SCSI_DH && SCSI help If you have a HP/COMPAQ MSA device that requires START_STOP to be sent to start it and cannot upgrade the firmware then select y.
@@ -27,13 +27,13 @@ config SCSI_DH_HP_SW config SCSI_DH_EMC tristate "EMC CLARiiON Device Handler" - depends on SCSI_DH + depends on SCSI_DH && SCSI help If you have a EMC CLARiiON select y. Otherwise, say N. config SCSI_DH_ALUA tristate "SPC-3 ALUA Device Handler" - depends on SCSI_DH + depends on SCSI_DH && SCSI help SCSI Device handler for generic SPC-3 Asymmetric Logical Unit Access (ALUA).
Greg Kroah-Hartman
maintainerPATCH 145/200 fbdev: da8xx-fb: fix videomodes of lcd panels
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sushaanth Srirangapathi <[email protected]>
commit 713fced8d10fa1c759c8fb6bf9aaa681bae68cad upstream.
Commit 028cd86b794f4a ("video: da8xx-fb: fix the polarities of the hsync/vsync pulse") fixes polarities of HSYNC/VSYNC pulse but forgot to update known_lcd_panels[] which had sync values according to old logic. This breaks LCD at least on DA850 EVM.
This patch fixes this issue and I have tested this for panel "Sharp_LK043T1DG01" using DA850 EVM board.
--- drivers/video/fbdev/da8xx-fb.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/video/fbdev/da8xx-fb.c +3 -4
@@ -209,8 +209,7 @@ static struct fb_videomode known_lcd_pan .lower_margin = 2, .hsync_len = 0, .vsync_len = 0, - .sync =FB_SYNC_CLK_INVERT | - FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, + .sync = FB_SYNC_CLK_INVERT, },/* Sharp LK043T1DG01 */ [1] = {
@@ -224,7 +223,7 @@ static struct fb_videomode known_lcd_pan .lower_margin = 2, .hsync_len = 41, .vsync_len = 10, - .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, + .sync = 0, .flag = 0, }, [2] = {
@@ -239,7 +238,7 @@ static struct fb_videomode known_lcd_pan .lower_margin = 10, .hsync_len = 10, .vsync_len = 10, - .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, + .sync = 0, .flag = 0, }, [3] = {
Greg Kroah-Hartman
maintainerPATCH 146/200 lib/mpi: Endianness fix
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Marek <[email protected]>
commit 3ee0cb5fb5eea2110db1b5cb7f67029b7be8a376 upstream.
The limbs are integers in the host endianness, so we can't simply iterate over the individual bytes. The current code happens to work on little-endian, because the order of the limbs in the MPI array is the same as the order of the bytes in each limb, but it breaks on big-endian.
--- lib/mpi/mpicoder.c | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-)
lib/mpi/mpicoder.c +21 -18
@@ -128,6 +128,23 @@ leave: }EXPORT_SYMBOL_GPL (mpi_read_from_buffer); +static int count_lzeros (MPI a) +{ +mpi_limb_t alimb; +int i, lzeros =0 ; + +for (i = a->nlimbs -1 ; i >=0 ; i--) { + alimb = a->d[i]; +if (alimb ==0 ) { + lzeros +=sizeof (mpi_limb_t); + }else { + lzeros +=count_leading_zeros (alimb) /8 ; +break ; + } + } +return lzeros; +} +/** * mpi_read_buffer() - read MPI to a bufer provided by user (msb first) *
@@ -148,7 +165,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf,uint8_t *p;mpi_limb_t alimb;unsigned int n =mpi_get_size (a); -int i, lzeros =0 ; +int i, lzeros;if (!buf || !nbytes)return -EINVAL ;
@@ -156,14 +173,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf,if (sign) *sign = a->sign; - p = (void *)&a->d[a->nlimbs] -1 ; - -for (i = a->nlimbs *sizeof (alimb) -1 ; i >=0 ; i--, p--) { -if (!*p) - lzeros++; -else -break ; - } + lzeros =count_lzeros (a);if (buf_len < n - lzeros) { *nbytes = n - lzeros;
@@ -351,7 +361,7 @@ int mpi_write_to_sgl(MPI a, struct scattu8 *p, *p2;mpi_limb_t alimb, alimb2;unsigned int n =mpi_get_size (a); -int i, x, y =0 , lzeros =0 , buf_len; +int i, x, y =0 , lzeros, buf_len;if (!nbytes)return -EINVAL ;
@@ -359,14 +369,7 @@ int mpi_write_to_sgl(MPI a, struct scattif (sign) *sign = a->sign; - p = (void *)&a->d[a->nlimbs] -1 ; - -for (i = a->nlimbs *sizeof (alimb) -1 ; i >=0 ; i--, p--) { -if (!*p) - lzeros++; -else -break ; - } + lzeros =count_lzeros (a);if (*nbytes < n - lzeros) { *nbytes = n - lzeros;
Greg Kroah-Hartman
maintainerPATCH 147/200 misc/bmp085: Enable building as a module
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit 50e6315dba721cbc24ccd6d7b299f1782f210a98 upstream.
Commit 985087dbcb02 'misc: add support for bmp18x chips to the bmp085 driver' changed the BMP085 config symbol to a boolean. I see no reason why the shared code cannot be built as a module, so change it back to tristate.
--- drivers/misc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/Kconfig +1 -1
@@ -440,7 +440,7 @@ config ARM_CHARLCD still useful. config BMP085 - bool + tristate depends on SYSFS config BMP085_I2C
Greg Kroah-Hartman
maintainerPATCH 148/200 misc: mic/scif: fix wrap around tests
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 7b64dbf849abdd7e769820e25120758f956a7f13 upstream.
Signed integer overflow is undefined. Also I added a check for "(offset < 0)" in scif_unregister() because that makes it match the other conditions and because I didn't want to subtract a negative.
--- drivers/misc/mic/scif/scif_rma.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/misc/mic/scif/scif_rma.c +4 -3
@@ -1511,7 +1511,7 @@ off_t scif_register_pinned_pages(scif_epif ((map_flags &SCIF_MAP_FIXED ) && ((ALIGN (offset,PAGE_SIZE ) != offset) || (offset <0 ) || - (offset + (off_t )len < offset))) + (len >LONG_MAX - offset)))return -EINVAL ;might_sleep ();
@@ -1614,7 +1614,7 @@ off_t scif_register(scif_epd_t epd, voidif ((map_flags &SCIF_MAP_FIXED ) && ((ALIGN (offset,PAGE_SIZE ) != offset) || (offset <0 ) || - (offset + (off_t )len < offset))) + (len >LONG_MAX - offset)))return -EINVAL ;/* Unsupported protection requested */
@@ -1732,7 +1732,8 @@ scif_unregister(scif_epd_t epd, off_t of/* Offset is not page aligned or offset+len wraps around */ if ((ALIGN (offset,PAGE_SIZE ) != offset) || - (offset + (off_t )len < offset)) + (offset <0 ) || + (len >LONG_MAX - offset))return -EINVAL ; err =scif_verify_epd (ep);
Greg Kroah-Hartman
maintainerPATCH 149/200 PM / OPP: Initialize u_volt_min/max to a valid value
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
commit c88c395f4a6485f23f81e385c79945d68bcd5c5d upstream.
We kept u_volt_min/max initialized to 0, when only the target voltage is present in DT, instead of the target/min/max triplet.
This didn't go well with the regulator framework, as on few calls the min voltage was set to target and max was set to 0 and so resulted in a kernel crash like below:
kernel BUG at ../drivers/regulator/core.c:216!
[<c0684af4>] (regulator_check_voltage) from [<c06857ac>] (regulator_set_voltage_unlocked+0x58/0x230) [<c06857ac>] (regulator_set_voltage_unlocked) from [<c06859ac>] (regulator_set_voltage+0x28/0x54) [<c06859ac>] (regulator_set_voltage) from [<c0775b28>] (_set_opp_voltage+0x30/0x98) [<c0775b28>] (_set_opp_voltage) from [<c0776630>] (dev_pm_opp_set_rate+0xf0/0x28c) [<c0776630>] (dev_pm_opp_set_rate) from [<c096f784>] (__cpufreq_driver_target+0x184/0x2b4) [<c096f784>] (__cpufreq_driver_target) from [<c0973760>] (dbs_check_cpu+0x1b0/0x1f4) [<c0973760>] (dbs_check_cpu) from [<c0973f30>] (cpufreq_governor_dbs+0x324/0x5c4) [<c0973f30>] (cpufreq_governor_dbs) from [<c0970958>] (__cpufreq_governor+0xe4/0x1ec) [<c0970958>] (__cpufreq_governor) from [<c09711e0>] (cpufreq_init_policy+0x64/0x8c) [<c09711e0>] (cpufreq_init_policy) from [<c09718cc>] (cpufreq_online+0x2fc/0x708) [<c09718cc>] (cpufreq_online) from [<c0765ff0>] (subsys_interface_register+0x94/0xd8) [<c0765ff0>] (subsys_interface_register) from [<c0970530>] (cpufreq_register_driver+0x14c/0x19c) [<c0970530>] (cpufreq_register_driver) from [<c09746dc>] (dt_cpufreq_probe+0x70/0xec) [<c09746dc>] (dt_cpufreq_probe) from [<c076907c>] (platform_drv_probe+0x4c/0xb0) [<c076907c>] (platform_drv_probe) from [<c07678e0>] (driver_probe_device+0x214/0x2c0) [<c07678e0>] (driver_probe_device) from [<c0767a18>] (__driver_attach+0x8c/0x90) [<c0767a18>] (__driver_attach) from [<c0765c2c>] (bus_for_each_dev+0x68/0x9c) [<c0765c2c>] (bus_for_each_dev) from [<c0766d78>] (bus_add_driver+0x1a0/0x218) [<c0766d78>] (bus_add_driver) from [<c076810c>] (driver_register+0x78/0xf8) [<c076810c>] (driver_register) from [<c0301d74>] (do_one_initcall+0x90/0x1d8) [<c0301d74>] (do_one_initcall) from [<c1100e14>] (kernel_init_freeable+0x15c/0x1fc) [<c1100e14>] (kernel_init_freeable) from [<c0b27a0c>] (kernel_init+0x8/0xf0) [<c0b27a0c>] (kernel_init) from [<c0307d78>] (ret_from_fork+0x14/0x3c)
Code: e1550004 baffffeb e3a00000 e8bd8070 (e7f001f2)
Fix that by initializing u_volt_min/max to the target voltage in such cases.
--- drivers/base/power/opp/core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/base/power/opp/core.c +8 -2
@@ -844,8 +844,14 @@ static int opp_parse_supplies(struct dev } opp->u_volt = microvolt[0 ]; - opp->u_volt_min = microvolt[1 ]; - opp->u_volt_max = microvolt[2 ]; + +if (count ==1 ) { + opp->u_volt_min = opp->u_volt; + opp->u_volt_max = opp->u_volt; + }else { + opp->u_volt_min = microvolt[1 ]; + opp->u_volt_max = microvolt[2 ]; + }/* Search for "opp-microamp-<name>" */ prop =NULL ;
Greg Kroah-Hartman
maintainerPATCH 150/200 PM / Domains: Fix removal of a subdomain
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <[email protected]>
commit beda5fc1ff9b527059290a97b672d2ee0eb7b92f upstream.
Commit 30e7a65b3fdb (PM / Domains: Ensure subdomain is not in use before removing) added a test to ensure that a subdomain is not a master to another subdomain or if any devices are using the subdomain before removing. This change incorrectly used the "slave_links" list to determine if the subdomain is a master to another subdomain, where it should have been using the "master_links" list instead. The "slave_links" list will never be empty for a subdomain and so a subdomain can never be removed. Fix this by testing if the "master_links" list is empty instead.
--- drivers/base/power/domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/domain.c +1 -1
@@ -1378,7 +1378,7 @@ int pm_genpd_remove_subdomain(struct genmutex_lock (&subdomain->lock);mutex_lock_nested (&genpd->lock,SINGLE_DEPTH_NESTING ); -if (!list_empty (&subdomain->slave_links) || subdomain->device_count) { +if (!list_empty (&subdomain->master_links) || subdomain->device_count) {pr_warn ("%s: unable to remove subdomain %s\n" , genpd->name, subdomain->name); ret = -EBUSY ;
Greg Kroah-Hartman
maintainerPATCH 151/200 rtc: hym8563: fix invalid year calculation
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Kochetkov <[email protected]>
commit d5861262210067fc01b2fb4f7af2fd85a3453f15 upstream.
Year field must be in BCD format, according to
hym8563 datasheet.
Due to the bug year 2016 became 2010.
--- drivers/rtc/rtc-hym8563.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-hym8563.c +1 -1
@@ -144,7 +144,7 @@ static int hym8563_rtc_set_time(struct d* it does not seem to carry it over a subsequent write/read. * So we'll limit ourself to 100 years, starting at 2000 for now. */ - buf[6 ] = tm->tm_year -100 ; + buf[6 ] =bin2bcd (tm->tm_year -100 );/* * CTL1 only contains TEST-mode bits apart from stop,
Greg Kroah-Hartman
maintainerPATCH 153/200 rtc: ds1685: passing bogus values to irq_restore
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 8c09b9fdecab1f4a289f07b46e2ad174b6641928 upstream.
We call spin_lock_irqrestore with "flags" set to zero instead of to the value from spin_lock_irqsave().
--- drivers/rtc/rtc-ds1685.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/rtc/rtc-ds1685.c +4 -4
@@ -187,9 +187,9 @@ ds1685_rtc_end_data_access(struct ds1685* Only use this where you are certain another lock will not be held. */ static inline void -ds1685_rtc_begin_ctrl_access (struct ds1685_priv *rtc,unsigned long flags) +ds1685_rtc_begin_ctrl_access (struct ds1685_priv *rtc,unsigned long *flags) { -spin_lock_irqsave (&rtc->lock, flags); +spin_lock_irqsave (&rtc->lock, *flags);ds1685_rtc_switch_to_bank1 (rtc); }
@@ -1300,7 +1300,7 @@ ds1685_rtc_sysfs_ctrl_regs_store(struct {struct ds1685_priv *rtc =dev_get_drvdata (dev);u8 reg =0 , bit =0 , tmp; -unsigned long flags =0 ; +unsigned long flags;long int val =0 ;const struct ds1685_rtc_ctrl_regs *reg_info =ds1685_rtc_sysfs_ctrl_regs_lookup (attr->attr.name);
@@ -1321,7 +1321,7 @@ ds1685_rtc_sysfs_ctrl_regs_store(struct bit = reg_info->bit;/* Safe to spinlock during a write. */ -ds1685_rtc_begin_ctrl_access (rtc, flags); +ds1685_rtc_begin_ctrl_access (rtc, &flags); tmp = rtc->read (rtc, reg); rtc->write (rtc, reg, (val ? (tmp | bit) : (tmp & ~(bit))));ds1685_rtc_end_ctrl_access (rtc, flags);
Greg Kroah-Hartman
maintainerPATCH 154/200 rtc: rx8025: remove rv8803 id
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Belloni <[email protected]>
commit aaa3cee5deffa28415a6e1852c5afae0f5d210e2 upstream.
The rv8803 has its own driver that should be used. Remove its id from the rx8025 driver.
--- drivers/rtc/rtc-rx8025.c | 1 - 1 file changed, 1 deletion(-)
drivers/rtc/rtc-rx8025.c +0 -1
@@ -65,7 +65,6 @@static const struct i2c_device_id rx8025_id[] = { {"rx8025" ,0 }, - {"rv8803" ,1 }, { } };MODULE_DEVICE_TABLE (i2c, rx8025_id);
Greg Kroah-Hartman
maintainerPATCH 155/200 rtc: max77686: Properly handle regmap_irq_get_virq() error code
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit fb166ba1d7f0a662f7332f4ff660a0d6f4d76915 upstream.
The regmap_irq_get_virq() can return 0 or -EINVAL in error conditions but driver checked only for value of 0.
This could lead to a cast of -EINVAL to an unsigned int used as a interrupt number for devm_request_threaded_irq(). Although this is not yet fatal (devm_request_threaded_irq() will just fail with -EINVAL) but might be a misleading when diagnosing errors.
--- drivers/rtc/rtc-max77686.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-max77686.c +1 -1
@@ -465,7 +465,7 @@ static int max77686_rtc_probe(struct pla info->virq =regmap_irq_get_virq (max77686->rtc_irq_data,MAX77686_RTCIRQ_RTCA1 ); -if (!info->virq) { +if (info->virq <=0 ) { ret = -ENXIO ; goto err_rtc; }
Greg Kroah-Hartman
maintainerPATCH 156/200 drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit f3df53e4d70b5736368a8fe8aa1bb70c1cb1f577 upstream.
Fix RDAC read back errors caused by a typo. Value must shift by 2.
--- drivers/misc/ad525x_dpot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/ad525x_dpot.c +1 -1
@@ -216,7 +216,7 @@ static s32 dpot_read_i2c(struct dpot_dat*/ value =swab16 (value); -if (dpot->uid ==DPOT_UID (AD5271_ID )) +if (dpot->uid ==DPOT_UID (AD5274_ID )) value = value >>2 ;return value;default :
Greg Kroah-Hartman
maintainerPATCH 157/200 perf evlist: Reference count the cpu and thread maps at set_maps()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
commit a55e5663761366fb883f6f25375dd68bc958b9db upstream.
We were dropping the reference we possibly held but not obtaining one for the new maps, which we will drop at perf_evlist__delete(), fix it.
This was caught by Steven Noonan in some of the machines which would produce this output when caught by glibc debug mechanisms:
$ sudo perf test 21 21: Test object code reading :*** Error in `perf': corrupted double-linked list: 0x00000000023ffcd0 *** ======= Backtrace: ========= /usr/lib/libc.so.6(+0x72055)[0x7f25be0f3055] /usr/lib/libc.so.6(+0x779b6)[0x7f25be0f89b6] /usr/lib/libc.so.6(+0x7a0ed)[0x7f25be0fb0ed] /usr/lib/libc.so.6(__libc_calloc+0xba)[0x7f25be0fceda] perf(parse_events_lex_init_extra+0x38)[0x4cfff8] perf(parse_events+0x55)[0x4a0615] perf(perf_evlist__config+0xcf)[0x4eeb2f] perf[0x479f82] perf(test__code_reading+0x1e)[0x47ad4e] perf(cmd_test+0x5dd)[0x46452d] perf[0x47f4e3] perf(main+0x603)[0x42c723] /usr/lib/libc.so.6(__libc_start_main+0xf0)[0x7f25be0a1610] perf(_start+0x29)[0x42c859]
Further investigation using valgrind led to the reference count imbalance fixed in this patch.
Report-Link: http://lkml.kernel.org/r/CAKbGBLjC2Dx5vshxyGmQkcD+VwiAQLbHoXA9i7kvRB2-2opHZQ@mail.gmail.com
--- tools/perf/util/evlist.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/evlist.c +2 -2
@@ -1181,12 +1181,12 @@ void perf_evlist__set_maps(struct perf_e*/ if (cpus != evlist->cpus) {cpu_map__put (evlist->cpus); - evlist->cpus = cpus; + evlist->cpus =cpu_map__get (cpus); }if (threads != evlist->threads) {thread_map__put (evlist->threads); - evlist->threads = threads; + evlist->threads =thread_map__get (threads); }perf_evlist__propagate_maps (evlist);
Greg Kroah-Hartman
maintainerPATCH 158/200 perf tools: Fix perf script python database export crash
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Phlipot <[email protected]>
commit 616df645d7238e45d3b369933a30fee4e4e305e2 upstream.
Remove the union in evsel so that the database id and priv pointer can be used simultainously without conflicting and crashing.
Detailed Description for the fixed bug follows:
perf script crashes with a segmentation fault on user space tool version 4.5.rc7.ge2857b when using the python database export API. It works properly in 4.4 and prior versions.
the crash fist appeared in:
cfc8874a4859 ("perf script: Process cpu/threads maps")
How to reproduce the bug:
Remove any temporary files left over from a previous crash (if you have already attemped to reproduce the bug):
$ rm -r test_db-perf-data $ dropdb test_db
$ perf record timeout 1 yes >/dev/null $ perf script -s scripts/python/export-to-postgresql.py test_db
Stack Trace:
Program received signal SIGSEGV, Segmentation fault. __GI___libc_free (mem=0x1) at malloc.c:2929
2929 malloc.c: No such file or directory.
(gdb) bt
at util/stat.c:122
argv=<optimized out>, prefix=<optimized out>) at builtin-script.c:2231
argc=argc@entry=4, argv=argv@entry=0x7fffffffdf70) at perf.c:390
at perf.c:451--- tools/perf/util/evsel.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
tools/perf/util/evsel.h +2 -4
@@ -93,10 +93,8 @@ struct perf_evsel {const char *unit;struct event_format *tp_format;off_t id_offset; -union { -void *priv; -u64 db_id; - }; +void *priv; +u64 db_id;struct cgroup_sel *cgrp;void *handler;struct cpu_map *cpus;
Greg Kroah-Hartman
maintainerPATCH 159/200 spi: rockchip: modify DMA max burst to 1
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Addy Ke <[email protected]>
commit 80abf8880cc6e1594c11b7c417f22dde60e25312 upstream.
Generic dma controller on Rockchips' platform cannot support DMAFLUSHP instruction which make dma to flush the req of non-aligned or non-multiple of what we need. That will cause an unrecoverable dma bus error. The saftest way is to set dma max burst to 1.
--- drivers/spi/spi-rockchip.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/spi/spi-rockchip.c +10 -2
@@ -199,6 +199,7 @@ struct rockchip_spi {struct sg_table rx_sg;struct rockchip_spi_dma_data dma_rx;struct rockchip_spi_dma_data dma_tx; +struct dma_slave_caps dma_caps; };static inline void spi_enable_chip (struct rockchip_spi *rs,int enable)
@@ -454,7 +455,10 @@ static void rockchip_spi_prepare_dma(str rxconf.direction = rs->dma_rx.direction; rxconf.src_addr = rs->dma_rx.addr; rxconf.src_addr_width = rs->n_bytes; - rxconf.src_maxburst = rs->n_bytes; +if (rs->dma_caps.max_burst >4 ) + rxconf.src_maxburst =4 ; +else + rxconf.src_maxburst =1 ;dmaengine_slave_config (rs->dma_rx.ch, &rxconf); rxdesc = dmaengine_prep_slave_sg(
@@ -471,7 +475,10 @@ static void rockchip_spi_prepare_dma(str txconf.direction = rs->dma_tx.direction; txconf.dst_addr = rs->dma_tx.addr; txconf.dst_addr_width = rs->n_bytes; - txconf.dst_maxburst = rs->n_bytes; +if (rs->dma_caps.max_burst >4 ) + txconf.dst_maxburst =4 ; +else + txconf.dst_maxburst =1 ;dmaengine_slave_config (rs->dma_tx.ch, &txconf); txdesc = dmaengine_prep_slave_sg(
@@ -735,6 +742,7 @@ static int rockchip_spi_probe(struct pla }if (rs->dma_tx.ch && rs->dma_rx.ch) { +dma_get_slave_caps (rs->dma_rx.ch, &(rs->dma_caps)); rs->dma_tx.addr = (dma_addr_t)(mem->start +ROCKCHIP_SPI_TXDR ); rs->dma_rx.addr = (dma_addr_t)(mem->start +ROCKCHIP_SPI_RXDR ); rs->dma_tx.direction =DMA_MEM_TO_DEV ;
Greg Kroah-Hartman
maintainerPATCH 160/200 x86/mm/kmmio: Fix mmiotrace for hugepages
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karol Herbst <[email protected]>
commit cfa52c0cfa4d727aa3e457bf29aeff296c528a08 upstream.
Because Linux might use bigger pages than the 4K pages to handle those mmio ioremaps, the kmmio code shouldn't rely on the pade id as it currently does.
Using the memory address instead of the page id lets us look up how big the page is and what its base address is, so that we won't get a page fault within the same page twice anymore.
--- arch/x86/mm/kmmio.c | 88 ++++++++++++++++++++++++++++++++++------------------ 1 file changed, 59 insertions(+), 29 deletions(-)
arch/x86/mm/kmmio.c +59 -29
@@ -33,7 +33,7 @@struct kmmio_fault_page {struct list_head list;struct kmmio_fault_page *release_next; -unsigned long page;/* location of the fault page */ +unsigned long addr;/* the requested address */ pteval_t old_presence;/* page presence prior to arming */ bool armed;
@@ -70,9 +70,16 @@ unsigned int kmmio_count;static struct list_head kmmio_page_table[KMMIO_PAGE_TABLE_SIZE ];static LIST_HEAD (kmmio_probes); -static struct list_head *kmmio_page_list (unsigned long page) +static struct list_head *kmmio_page_list (unsigned long addr) { -return &kmmio_page_table[hash_long (page,KMMIO_PAGE_HASH_BITS )]; +unsigned int l; +pte_t *pte =lookup_address (addr, &l); + +if (!pte) +return NULL ; + addr &=page_level_mask (l); + +return &kmmio_page_table[hash_long (addr,KMMIO_PAGE_HASH_BITS )]; }/* Accessed per-cpu */
@@ -98,15 +105,19 @@ static struct kmmio_probe *get_kmmio_pro }/* You must be holding RCU read lock. */ -static struct kmmio_fault_page *get_kmmio_fault_page (unsigned long page) +static struct kmmio_fault_page *get_kmmio_fault_page (unsigned long addr) {struct list_head *head;struct kmmio_fault_page *f; +unsigned int l; +pte_t *pte =lookup_address (addr, &l); - page &=PAGE_MASK ; - head =kmmio_page_list (page); +if (!pte) +return NULL ; + addr &=page_level_mask (l); + head =kmmio_page_list (addr);list_for_each_entry_rcu (f, head, list) { -if (f->page == page) +if (f->addr == addr)return f; }return NULL ;
@@ -137,10 +148,10 @@ static void clear_pte_presence(pte_t *ptstatic int clear_page_presence (struct kmmio_fault_page *f,bool clear) {unsigned int level; -pte_t *pte =lookup_address (f->page, &level); +pte_t *pte =lookup_address (f->addr, &level);if (!pte) { -pr_err ("no pte for page 0x%08lx\n" , f->page); +pr_err ("no pte for addr 0x%08lx\n" , f->addr);return -1 ; }
@@ -156,7 +167,7 @@ static int clear_page_presence(struct kmreturn -1 ; } -__flush_tlb_one (f->page); +__flush_tlb_one (f->addr);return 0 ; }
@@ -176,12 +187,12 @@ static int arm_kmmio_fault_page(struct kint ret; WARN_ONCE(f->armed, KERN_ERR pr_fmt("kmmio page already armed.\n"));if (f->armed) { -pr_warning ("double-arm: page 0x%08lx, ref %d, old %d\n" , - f->page, f->count, !!f->old_presence); +pr_warning ("double-arm: addr 0x%08lx, ref %d, old %d\n" , + f->addr, f->count, !!f->old_presence); } ret =clear_page_presence (f, true); - WARN_ONCE(ret < 0, KERN_ERR pr_fmt("arming 0x%08lx failed.\n"), - f->page); + WARN_ONCE(ret < 0, KERN_ERR pr_fmt("arming at 0x%08lx failed.\n"), + f->addr); f->armed = true;return ret; }
@@ -191,7 +202,7 @@ static void disarm_kmmio_fault_page(stru {int ret =clear_page_presence (f, false);WARN_ONCE (ret <0 , -KERN_ERR "kmmio disarming 0x%08lx failed.\n" , f->page); +KERN_ERR "kmmio disarming at 0x%08lx failed.\n" , f->addr); f->armed = false; }
@@ -215,6 +226,12 @@ int kmmio_handler(struct pt_regs *regs,struct kmmio_context *ctx;struct kmmio_fault_page *faultpage;int ret =0 ;/* default to fault not handled */ +unsigned long page_base = addr; +unsigned int l; +pte_t *pte =lookup_address (addr, &l); +if (!pte) +return -EINVAL ; + page_base &=page_level_mask (l);/* * Preemption is now disabled to prevent process switch during
@@ -227,7 +244,7 @@ int kmmio_handler(struct pt_regs *regs,preempt_disable ();rcu_read_lock (); - faultpage =get_kmmio_fault_page (addr); + faultpage =get_kmmio_fault_page (page_base);if (!faultpage) {/* * Either this page fault is not caused by kmmio, or
@@ -239,7 +256,7 @@ int kmmio_handler(struct pt_regs *regs, ctx = &get_cpu_var (kmmio_ctx);if (ctx->active) { -if (addr == ctx->addr) { +if (page_base == ctx->addr) {/* * A second fault on the same page means some other * condition needs handling by do_page_fault(), the
@@ -267,9 +284,9 @@ int kmmio_handler(struct pt_regs *regs, ctx->active++; ctx->fpage = faultpage; - ctx->probe =get_kmmio_probe (addr); + ctx->probe =get_kmmio_probe (page_base); ctx->saved_flags = (regs->flags & (X86_EFLAGS_TF |X86_EFLAGS_IF )); - ctx->addr = addr; + ctx->addr = page_base;if (ctx->probe && ctx->probe->pre_handler) ctx->probe->pre_handler (ctx->probe, regs, addr);
@@ -354,12 +371,11 @@ out: }/* You must be holding kmmio_lock. */ -static int add_kmmio_fault_page (unsigned long page) +static int add_kmmio_fault_page (unsigned long addr) {struct kmmio_fault_page *f; - page &=PAGE_MASK ; - f =get_kmmio_fault_page (page); + f =get_kmmio_fault_page (addr);if (f) {if (!f->count)arm_kmmio_fault_page (f);
@@ -372,26 +388,25 @@ static int add_kmmio_fault_page(unsignedreturn -1 ; f->count =1 ; - f->page = page; + f->addr = addr;if (arm_kmmio_fault_page (f)) {kfree (f);return -1 ; } -list_add_rcu (&f->list,kmmio_page_list (f->page)); +list_add_rcu (&f->list,kmmio_page_list (f->addr));return 0 ; }/* You must be holding kmmio_lock. */ -static void release_kmmio_fault_page (unsigned long page, +static void release_kmmio_fault_page (unsigned long addr,struct kmmio_fault_page **release_list) {struct kmmio_fault_page *f; - page &=PAGE_MASK ; - f =get_kmmio_fault_page (page); + f =get_kmmio_fault_page (addr);if (!f)return ;
@@ -420,18 +435,27 @@ int register_kmmio_probe(struct kmmio_print ret =0 ;unsigned long size =0 ;const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK ); +unsigned int l; +pte_t *pte;spin_lock_irqsave (&kmmio_lock, flags);if (get_kmmio_probe (p->addr)) { ret = -EEXIST ; goto out; } + + pte =lookup_address (p->addr, &l); +if (!pte) { + ret = -EINVAL ; + goto out; + } + kmmio_count++;list_add_rcu (&p->list, &kmmio_probes);while (size < size_lim) {if (add_kmmio_fault_page (p->addr + size))pr_err ("Unable to set page fault.\n" ); - size +=PAGE_SIZE ; + size +=page_level_size (l); } out:spin_unlock_irqrestore (&kmmio_lock, flags);
@@ -506,11 +530,17 @@ void unregister_kmmio_probe(struct kmmioconst unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK );struct kmmio_fault_page *release_list =NULL ;struct kmmio_delayed_release *drelease; +unsigned int l; +pte_t *pte; + + pte =lookup_address (p->addr, &l); +if (!pte) +return ;spin_lock_irqsave (&kmmio_lock, flags);while (size < size_lim) {release_kmmio_fault_page (p->addr + size, &release_list); - size +=PAGE_SIZE ; + size +=page_level_size (l); }list_del_rcu (&p->list); kmmio_count--;
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Greg Kroah-Hartman
maintainerPATCH 161/200 ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eryu Guan <[email protected]>
commit 5e1021f2b6dff1a86a468a1424d59faae2bc63c1 upstream.
ext4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on error (e.g. EIO) and iloc.bh can be NULL in this case. But the error is ignored in the following "if" condition and ext4_expand_extra_isize() might be called with NULL iloc.bh set, which triggers NULL pointer dereference.
This is uncovered by commit 8b4953e13f4c ("ext4: reserve code points for the project quota feature"), which enlarges the ext4_inode size, and run the following script on new kernel but with old mke2fs:
#/bin/bash
mnt=/mnt/ext4
devname=ext4-error
dev=/dev/mapper/$devname
fsimg=/home/fs.img
trap cleanup 0 1 2 3 9 15
cleanup()
{
umount $mnt >/dev/null 2>&1
dmsetup remove $devname
losetup -d $backend_dev
rm -f $fsimg
exit 0
}
rm -f $fsimg
fallocate -l 1g $fsimg
backend_dev=`losetup -f --show $fsimg`
devsize=`blockdev --getsz $backend_dev` good_tab="0 $devsize linear $backend_dev 0"
error_tab="0 $devsize error $backend_dev 0"
dmsetup create $devname --table "$good_tab"
mkfs -t ext4 $dev
mount -t ext4 -o errors=continue,strictatime $dev $mnt
dmsetup load $devname --table "$error_tab" && dmsetup resume $devname echo 3 > /proc/sys/vm/drop_caches ls -l $mnt exit 0
[ Patch changed to simplify the function a tiny bit. -- Ted ]
--- fs/ext4/inode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/ext4/inode.c +3 -3
@@ -5261,6 +5261,8 @@ int ext4_mark_inode_dirty(handle_t *handmight_sleep ();trace_ext4_mark_inode_dirty (inode, _RET_IP_); err =ext4_reserve_inode_write (handle, inode, &iloc); +if (err) +return err;if (ext4_handle_valid (handle) &&EXT4_I (inode)->i_extra_isize < sbi->s_want_extra_isize && !ext4_test_inode_state (inode,EXT4_STATE_NO_EXPAND )) {
@@ -5291,9 +5293,7 @@ int ext4_mark_inode_dirty(handle_t *hand } } } -if (!err) - err =ext4_mark_iloc_dirty (handle, inode, &iloc); -return err; +return ext4_mark_iloc_dirty (handle, inode, &iloc); }/*
Greg Kroah-Hartman
maintainerPATCH 162/200 f2fs crypto: fix corrupted symlink in encrypted case
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit c90e09f7fb498f81cd4e8bb6460d3a26ccebeca3 upstream.
In the encrypted symlink case, we should check its corrupted symname after decrypting it.
Otherwise, we can report -ENOENT incorrectly, if encrypted symname starts with '\0'.
--- fs/f2fs/namei.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
fs/f2fs/namei.c +6 -6
@@ -980,12 +980,6 @@ static const char *f2fs_encrypted_get_li }memcpy (cstr.name, sd->encrypted_path, cstr.len); -/* this is broken symlink case */ -if (unlikely (cstr.name[0 ] ==0 )) { - res = -ENOENT ; - goto errout; - } -if ((cstr.len +sizeof (struct f2fs_encrypted_symlink_data ) -1 ) > max_size) {/* Symlink data on the disk is corrupted */
@@ -1002,6 +996,12 @@ static const char *f2fs_encrypted_get_likfree (cstr.name); +/* this is broken symlink case */ +if (unlikely (pstr.name[0 ] ==0 )) { + res = -ENOENT ; + goto errout; + } + paddr = pstr.name;/* Null-terminate the name */
Greg Kroah-Hartman
maintainerPATCH 163/200 f2fs: slightly reorganize read_raw_super_block
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
commit 2b39e9072d79ab2525100413f3f7a0b8a3e15873 upstream.
read_raw_super_block was introduced to help find the first valid superblock. Commit da554e48caab ("f2fs:
recovering broken superblock during mount") changed the behaviour to read both of them and check whether need the recovery flag or not. So the comment before this function isn't consistent with what it actually does. Also, the origin code use two tags to round the err cases, which isn't so readable. So this patch amend the comment and slightly reorganize it.
--- fs/f2fs/super.c | 77 +++++++++++++++++++++++++++----------------------------- 1 file changed, 38 insertions(+), 39 deletions(-)
fs/f2fs/super.c +38 -39
@@ -1134,14 +1134,15 @@ static void init_sb_info(struct f2fs_sb_/* * Read f2fs raw super block. -* Because we have two copies of super block, so read the first one at first, -* if the first one is invalid, move to read the second one. +* Because we have two copies of super block, so read both of them +* to get the first valid one. If any one of them is broken, we pass +* them recovery flag back to the caller. */ static int read_raw_super_block (struct super_block *sb,struct f2fs_super_block **raw_super,int *valid_super_block,int *recovery) { -int block =0 ; +int block;struct buffer_head *bh;struct f2fs_super_block *super, *buf;int err =0 ;
@@ -1149,50 +1150,48 @@ static int read_raw_super_block(struct s super =kzalloc (sizeof (struct f2fs_super_block ),GFP_KERNEL );if (!super)return -ENOMEM ; -retry: - bh =sb_bread (sb, block); -if (!bh) { - *recovery =1 ; -f2fs_msg (sb,KERN_ERR ,"Unable to read %dth superblock" , - block +1 ); - err = -EIO ; - goto next; - } - buf = (struct f2fs_super_block *)(bh->b_data +F2FS_SUPER_OFFSET ); - -/* sanity checking of raw super */ -if (sanity_check_raw_super (sb, buf)) { +for (block =0 ; block <2 ; block++) { + bh =sb_bread (sb, block); +if (!bh) { +f2fs_msg (sb,KERN_ERR ,"Unable to read %dth superblock" , + block +1 ); + err = -EIO ; +continue ; + } + + buf = (struct f2fs_super_block *) + (bh->b_data +F2FS_SUPER_OFFSET ); + +/* sanity checking of raw super */ +if (sanity_check_raw_super (sb, buf)) { +f2fs_msg (sb,KERN_ERR , +"Can't find valid F2FS filesystem in %dth superblock" , + block +1 ); + err = -EINVAL ; +brelse (bh); +continue ; + } + +if (!*raw_super) { +memcpy (super, buf,sizeof (*super)); + *valid_super_block = block; + *raw_super = super; + }brelse (bh); - *recovery =1 ; -f2fs_msg (sb,KERN_ERR , -"Can't find valid F2FS filesystem in %dth superblock" , - block +1 ); - err = -EINVAL ; - goto next; - } - -if (!*raw_super) { -memcpy (super, buf,sizeof (*super)); - *valid_super_block = block; - *raw_super = super; } -brelse (bh); -next: -/* check the validity of the second superblock */ -if (block ==0 ) { - block++; - goto retry; - } +/* Fail to read any one of the superblocks*/ +if (err <0 ) + *recovery =1 ;/* No valid superblock */ -if (!*raw_super) { +if (!*raw_super)kfree (super); -return err; - } +else + err =0 ; -return 0 ; +return err; }static int __f2fs_commit_super (struct f2fs_sb_info *sbi,int block)
Greg Kroah-Hartman
maintainerPATCH 164/200 f2fs: cover large section in sanity check of super
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit fd694733d523df1e0a583cf5c4c08e41d7bf9fa3 upstream.
This patch fixes the bug which does not cover a large section case when checking the sanity of superblock.
If f2fs detects misalignment, it will fix the superblock during the mount time, so it doesn't need to trigger fsck.f2fs further.
--- fs/f2fs/super.c | 102 +++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 65 insertions(+), 37 deletions(-)
fs/f2fs/super.c +65 -37
@@ -926,9 +926,25 @@ static loff_t max_file_blocks(void)return result; } +static int __f2fs_commit_super (struct buffer_head *bh, +struct f2fs_super_block *super) +{ +lock_buffer (bh); +if (super) +memcpy (bh->b_data +F2FS_SUPER_OFFSET , super,sizeof (*super)); +set_buffer_uptodate (bh); +set_buffer_dirty (bh); +unlock_buffer (bh); + +/* it's rare case, we can do fua all the time */ +return __sync_dirty_buffer (bh,WRITE_FLUSH_FUA ); +} +static inline bool sanity_check_area_boundary (struct super_block *sb, -struct f2fs_super_block *raw_super) +struct buffer_head *bh) { +struct f2fs_super_block *raw_super = (struct f2fs_super_block *) + (bh->b_data +F2FS_SUPER_OFFSET );u32 segment0_blkaddr =le32_to_cpu (raw_super->segment0_blkaddr);u32 cp_blkaddr =le32_to_cpu (raw_super->cp_blkaddr);u32 sit_blkaddr =le32_to_cpu (raw_super->sit_blkaddr);
@@ -942,6 +958,10 @@ static inline bool sanity_check_area_bouu32 segment_count_main =le32_to_cpu (raw_super->segment_count_main);u32 segment_count =le32_to_cpu (raw_super->segment_count);u32 log_blocks_per_seg =le32_to_cpu (raw_super->log_blocks_per_seg); +u64 main_end_blkaddr = main_blkaddr + + (segment_count_main << log_blocks_per_seg); +u64 seg_end_blkaddr = segment0_blkaddr + + (segment_count << log_blocks_per_seg);if (segment0_blkaddr != cp_blkaddr) { f2fs_msg(sb, KERN_INFO,
@@ -986,22 +1006,45 @@ static inline bool sanity_check_area_boureturn true; } -if (main_blkaddr + (segment_count_main << log_blocks_per_seg) != - segment0_blkaddr + (segment_count << log_blocks_per_seg)) { +if (main_end_blkaddr > seg_end_blkaddr) {f2fs_msg (sb,KERN_INFO , -"Wrong MAIN_AREA boundary, start(%u) end(%u) blocks(%u)" , +"Wrong MAIN_AREA boundary, start(%u) end(%u) block(%u)" , main_blkaddr, - segment0_blkaddr + (segment_count << log_blocks_per_seg), + segment0_blkaddr + + (segment_count << log_blocks_per_seg), segment_count_main << log_blocks_per_seg);return true; + }else if (main_end_blkaddr < seg_end_blkaddr) { +int err =0 ; +char *res; + +/* fix in-memory information all the time */ + raw_super->segment_count =cpu_to_le32 ((main_end_blkaddr - + segment0_blkaddr) >> log_blocks_per_seg); + +if (f2fs_readonly (sb) ||bdev_read_only (sb->s_bdev)) { + res ="internally" ; + }else { + err =__f2fs_commit_super (bh,NULL ); + res = err ?"failed" :"done" ; + } +f2fs_msg (sb,KERN_INFO , +"Fix alignment : %s, start(%u) end(%u) block(%u)" , + res, main_blkaddr, + segment0_blkaddr + + (segment_count << log_blocks_per_seg), + segment_count_main << log_blocks_per_seg); +if (err) +return true; } -return false; }static int sanity_check_raw_super (struct super_block *sb, -struct f2fs_super_block *raw_super) +struct buffer_head *bh) { +struct f2fs_super_block *raw_super = (struct f2fs_super_block *) + (bh->b_data +F2FS_SUPER_OFFSET );unsigned int blocksize;if (F2FS_SUPER_MAGIC !=le32_to_cpu (raw_super->magic)) {
@@ -1068,7 +1111,7 @@ static int sanity_check_raw_super(struct }/* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */ -if (sanity_check_area_boundary (sb, raw_super)) +if (sanity_check_area_boundary (sb, bh))return 1 ;return 0 ;
@@ -1144,7 +1187,7 @@ static int read_raw_super_block(struct s {int block;struct buffer_head *bh; -struct f2fs_super_block *super, *buf; +struct f2fs_super_block *super;int err =0 ; super =kzalloc (sizeof (struct f2fs_super_block ),GFP_KERNEL );
@@ -1160,11 +1203,8 @@ static int read_raw_super_block(struct scontinue ; } - buf = (struct f2fs_super_block *) - (bh->b_data +F2FS_SUPER_OFFSET ); -/* sanity checking of raw super */ -if (sanity_check_raw_super (sb, buf)) { +if (sanity_check_raw_super (sb, bh)) {f2fs_msg (sb,KERN_ERR ,"Can't find valid F2FS filesystem in %dth superblock" , block +1 );
@@ -1174,7 +1214,8 @@ static int read_raw_super_block(struct s }if (!*raw_super) { -memcpy (super, buf,sizeof (*super)); +memcpy (super, bh->b_data +F2FS_SUPER_OFFSET , +sizeof (*super)); *valid_super_block = block; *raw_super = super; }
@@ -1194,42 +1235,29 @@ static int read_raw_super_block(struct sreturn err; } -static int __f2fs_commit_super (struct f2fs_sb_info *sbi,int block) +int f2fs_commit_super (struct f2fs_sb_info *sbi,bool recover) { -struct f2fs_super_block *super =F2FS_RAW_SUPER (sbi);struct buffer_head *bh;int err; - bh =sb_getblk (sbi->sb, block); +/* write back-up superblock first */ + bh =sb_getblk (sbi->sb, sbi->valid_super_block ?0 :1 );if (!bh)return -EIO ; - -lock_buffer (bh); -memcpy (bh->b_data +F2FS_SUPER_OFFSET , super,sizeof (*super)); -set_buffer_uptodate (bh); -set_buffer_dirty (bh); -unlock_buffer (bh); - -/* it's rare case, we can do fua all the time */ - err =__sync_dirty_buffer (bh,WRITE_FLUSH_FUA ); + err =__f2fs_commit_super (bh,F2FS_RAW_SUPER (sbi));brelse (bh); -return err; -} - -int f2fs_commit_super (struct f2fs_sb_info *sbi,bool recover) -{ -int err; - -/* write back-up superblock first */ - err =__f2fs_commit_super (sbi, sbi->valid_super_block ?0 :1 ); -/* if we are in recovery path, skip writing valid superblock */ if (recover || err)return err;/* write current valid superblock */ -return __f2fs_commit_super (sbi, sbi->valid_super_block); + bh =sb_getblk (sbi->sb, sbi->valid_super_block); +if (!bh) +return -EIO ; + err =__f2fs_commit_super (bh,F2FS_RAW_SUPER (sbi)); +brelse (bh); +return err; }static int f2fs_fill_super (struct super_block *sb,void *data,int silent)
Greg Kroah-Hartman
maintainerPATCH 165/200 ext4/fscrypto: avoid RCU lookup in d_revalidate
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 03a8bb0e53d9562276045bdfcf2b5de2e4cff5a1 upstream.
As Al pointed, d_revalidate should return RCU lookup before using d_inode. This was originally introduced by:
commit 34286d666230 ("fs: rcu-walk aware d_revalidate method").
--- fs/ext4/crypto.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ext4/crypto.c +4 -0
@@ -34,6 +34,7 @@#include <linux/random.h> #include <linux/scatterlist.h> #include <linux/spinlock_types.h> +#include <linux/namei.h> #include "ext4_extents.h" #include "xattr.h"
@@ -479,6 +480,9 @@ static int ext4_d_revalidate(struct dentstruct ext4_crypt_info *ci;int dir_has_key, cached_with_key; +if (flags &LOOKUP_RCU ) +return -ECHILD ; + dir =dget_parent (dentry);if (!ext4_encrypted_inode (d_inode (dir))) {dput (dir);
Greg Kroah-Hartman
maintainerPATCH 166/200 f2fs: do f2fs_balance_fs when block is allocated
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 3c082b7b5b28be606ed9ef11e4741df7c722c92e upstream.
We should consider data block allocation to trigger f2fs_balance_fs.
--- fs/f2fs/data.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
fs/f2fs/data.c +6 -6
@@ -504,7 +504,7 @@ static int __allocate_data_blocks(structstruct dnode_of_data dn;u64 start =F2FS_BYTES_TO_BLK (offset);u64 len =F2FS_BYTES_TO_BLK (count); -bool allocated; +bool allocated = false;u64 end_offset;int err =0 ;
@@ -546,7 +546,7 @@ static int __allocate_data_blocks(structf2fs_put_dnode (&dn);f2fs_unlock_op (sbi); -f2fs_balance_fs (sbi, dn.node_changed); +f2fs_balance_fs (sbi, allocated); }return err;
@@ -556,7 +556,7 @@ sync_out:f2fs_put_dnode (&dn); out:f2fs_unlock_op (sbi); -f2fs_balance_fs (sbi, dn.node_changed); +f2fs_balance_fs (sbi, allocated);return err; }
@@ -650,14 +650,14 @@ get_next:if (dn.ofs_in_node >= end_offset) {if (allocated)sync_inode_page (&dn); - allocated = false;f2fs_put_dnode (&dn);if (create) {f2fs_unlock_op (sbi); -f2fs_balance_fs (sbi, dn.node_changed); +f2fs_balance_fs (sbi, allocated);f2fs_lock_op (sbi); } + allocated = false;set_new_dnode (&dn, inode,NULL ,NULL ,0 ); err =get_dnode_of_data (&dn, pgofs, mode);
@@ -715,7 +715,7 @@ put_out: unlock_out:if (create) {f2fs_unlock_op (sbi); -f2fs_balance_fs (sbi, dn.node_changed); +f2fs_balance_fs (sbi, allocated); } out:trace_f2fs_map_blocks (inode, map, err);
Greg Kroah-Hartman
maintainerPATCH 167/200 f2fs: dont need to call set_page_dirty for io error
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit e3ef18762f5757d3fb86f75ca59315db6d17d719 upstream.
If end_io gets an error, we don't need to set the page as dirty, since we already set f2fs_stop_checkpoint which will not flush any data.
This will resolve the following warning.
======================================================
[ INFO: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected ]
4.4.0+ #9 Tainted: G O
------------------------------------------------------
xfs_io/26773 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
(&(&sbi->inode_lock[i])->rlock){+.+...}, at: [<ffffffffc025483f>] update_dirty_page+0x6f/0xd0 [f2fs]
and this task is already holding:
(&(&q->__queue_lock)->rlock){-.-.-.}, at: [<ffffffff81396ea2>] blk_queue_bio+0x422/0x490
which would create a new lock dependency:
(&(&q->__queue_lock)->rlock){-.-.-.} -> (&(&sbi->inode_lock[i])->rlock){+.+...}
--- fs/f2fs/data.c | 1 - 1 file changed, 1 deletion(-)
fs/f2fs/data.c +0 -1
@@ -67,7 +67,6 @@ static void f2fs_write_end_io(struct biof2fs_restore_and_release_control_page (&page);if (unlikely (bio->bi_error)) { -set_page_dirty (page);set_bit (AS_EIO , &page->mapping->flags);f2fs_stop_checkpoint (sbi); }
Greg Kroah-Hartman
maintainerPATCH 168/200 f2fs crypto: handle unexpected lack of encryption keys
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit ae1086686487f13130937918ca91d920c1daafcb upstream.
This patch syncs f2fs with commit abdd438b26b4 ("ext4 crypto: handle unexpected lack of encryption keys") from ext4.
Fix up attempts by users to try to write to a file when they don't have access to the encryption key.
--- fs/f2fs/crypto_policy.c | 3 ++- fs/f2fs/file.c | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-)
fs/f2fs/crypto_policy.c +2 -1
@@ -192,7 +192,8 @@ int f2fs_inherit_context(struct inode *preturn res; ci =F2FS_I (parent)->i_crypt_info; -BUG_ON (ci ==NULL ); +if (ci ==NULL ) +return -ENOKEY ; ctx.format =F2FS_ENCRYPTION_CONTEXT_FORMAT_V1 ;
fs/f2fs/file.c +5 -1
@@ -425,6 +425,8 @@ static int f2fs_file_mmap(struct file *f err =f2fs_get_encryption_info (inode);if (err)return 0 ; +if (!f2fs_encrypted_inode (inode)) +return -ENOKEY ; }/* we don't need to use inline_data strictly */
@@ -444,7 +446,9 @@ static int f2fs_file_open(struct inode *if (!ret &&f2fs_encrypted_inode (inode)) { ret =f2fs_get_encryption_info (inode);if (ret) - ret = -EACCES ; +return -EACCES ; +if (!f2fs_encrypted_inode (inode)) +return -ENOKEY ; }return ret; }
Greg Kroah-Hartman
maintainerPATCH 169/200 f2fs crypto: make sure the encryption info is initialized on opendir(2)
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit ed3360abbc0412f32c398e1c58887d74f3d04225 upstream.
This patch syncs f2fs with commit 6bc445e0ff44 ("ext4 crypto: make sure the encryption info is initialized on opendir(2)") from ext4.
--- fs/f2fs/dir.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/f2fs/dir.c +8 -0
@@ -892,11 +892,19 @@ out:return err; } +static int f2fs_dir_open (struct inode *inode,struct file *filp) +{ +if (f2fs_encrypted_inode (inode)) +return f2fs_get_encryption_info (inode) ? -EACCES :0 ; +return 0 ; +} +const struct file_operations f2fs_dir_operations = { .llseek = generic_file_llseek, .read = generic_read_dir, .iterate = f2fs_readdir, .fsync = f2fs_sync_file, + .open = f2fs_dir_open, .unlocked_ioctl = f2fs_ioctl, #ifdef CONFIG_COMPAT .compat_ioctl = f2fs_compat_ioctl,
Greg Kroah-Hartman
maintainerPATCH 170/200 bus: uniphier-system-bus: fix condition of overlap check
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunihiko Hayashi <[email protected]>
commit 3de7beebddf8d56dcaa17b41c723d602dd0c513c upstream.
This patch fixes condition whether the specified address ranges overlap each other.
--- drivers/bus/uniphier-system-bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bus/uniphier-system-bus.c +1 -1
@@ -108,7 +108,7 @@ static int uniphier_system_bus_check_ovefor (i =0 ; i <ARRAY_SIZE (priv->bank); i++) {for (j = i +1 ; j <ARRAY_SIZE (priv->bank); j++) { -if (priv->bank[i].end > priv->bank[j].base || +if (priv->bank[i].end > priv->bank[j].base && priv->bank[i].base < priv->bank[j].end) { dev_err(priv->dev, "region overlap between bank%d and bank%d\n",
Greg Kroah-Hartman
maintainerPATCH 171/200 mtd: spi-nor: remove micron_quad_enable()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyrille Pitchen <[email protected]>
commit 3b5394a3ccffbfa1d1d448d48742853a862822c4 upstream.
This patch remove the micron_quad_enable() function which force the Quad SPI mode. However, once this mode is enabled, the Micron memory expect ALL commands to use the SPI 4-4-4 protocol. Hence a failure does occur when calling spi_nor_wait_till_ready() right after the update of the Enhanced Volatile Configuration Register (EVCR) in the micron_quad_enable() as the SPI controller driver is not aware about the protocol change.
Since there is almost no performance increase using Fast Read 4-4-4 commands instead of Fast Read 1-1-4 commands, we rather keep on using the Extended SPI mode than enabling the Quad SPI mode.
Let's take the example of the pretty standard use of 8 dummy cycles during Fast Read operations on 64KB erase sectors:
Fast Read 1-1-4 requires 8 cycles for the command, then 24 cycles for the 3byte address followed by 8 dummy clock cycles and finally 65536*2 cycles for the read data; so 131112 clock cycles.
On the other hand the Fast Read 4-4-4 would require 2 cycles for the command, then 6 cycles for the 3byte address followed by 8 dummy clock cycles and finally 65536*2 cycles for the read data. So 131088 clock cycles. The theorical bandwidth increase is 0.0%.
Now using Fast Read operations on 512byte pages:
Fast Read 1-1-4 needs 8+24+8+(512*2) = 1064 clock cycles whereas Fast Read 4-4-4 would requires 2+6+8+(512*2) = 1040 clock cycles. Hence the theorical bandwidth increase is 2.3%.
Consecutive reads for non sequential pages is not a relevant use case so The Quad SPI mode is not worth it.
mtd_speedtest seems to confirm these figures.
--- drivers/mtd/spi-nor/spi-nor.c | 46 ------------------------------------------ 1 file changed, 1 insertion(+), 45 deletions(-)
drivers/mtd/spi-nor/spi-nor.c +1 -45
@@ -1100,45 +1100,6 @@ static int spansion_quad_enable(struct sreturn 0 ; } -static int micron_quad_enable (struct spi_nor *nor) -{ -int ret; -u8 val; - - ret = nor->read_reg (nor,SPINOR_OP_RD_EVCR , &val,1 ); -if (ret <0 ) { -dev_err (nor->dev,"error %d reading EVCR\n" , ret); -return ret; - } - -write_enable (nor); - -/* set EVCR, enable quad I/O */ - nor->cmd_buf[0 ] = val & ~EVCR_QUAD_EN_MICRON ; - ret = nor->write_reg (nor,SPINOR_OP_WD_EVCR , nor->cmd_buf,1 ); -if (ret <0 ) { -dev_err (nor->dev,"error while writing EVCR register\n" ); -return ret; - } - - ret =spi_nor_wait_till_ready (nor); -if (ret) -return ret; - -/* read EVCR and check it */ - ret = nor->read_reg (nor,SPINOR_OP_RD_EVCR , &val,1 ); -if (ret <0 ) { -dev_err (nor->dev,"error %d reading EVCR\n" , ret); -return ret; - } -if (val &EVCR_QUAD_EN_MICRON ) { -dev_err (nor->dev,"Micron EVCR Quad bit not clear\n" ); -return -EINVAL ; - } - -return 0 ; -} -static int set_quad_mode (struct spi_nor *nor,const struct flash_info *info) {int status;
@@ -1152,12 +1113,7 @@ static int set_quad_mode(struct spi_nor }return status;case SNOR_MFR_MICRON : - status =micron_quad_enable (nor); -if (status) { -dev_err (nor->dev,"Micron quad-read not enabled\n" ); -return -EINVAL ; - } -return status; +return 0 ;default : status =spansion_quad_enable (nor);if (status) {
Greg Kroah-Hartman
maintainerPATCH 172/200 mtd: brcmnand: Fix v7.1 register offsets
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit d267aefc54a28efc5bda7f009598dc83b5f98734 upstream.
The BRCMNAND controller revision 7.1 is almost 100% compatible with the previous v6.0 register offset layout, except for the Correctable Error Reporting Threshold registers. Fix this by adding another table with the correct offsets for CORR_THRESHOLD and CORR_THRESHOLD_EXT.
--- drivers/mtd/nand/brcmnand/brcmnand.c | 34 +++++++++++++++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-)
drivers/mtd/nand/brcmnand/brcmnand.c +33 -1
@@ -311,6 +311,36 @@ static const u16 brcmnand_regs_v60[] = { [BRCMNAND_FC_BASE] = 0x400, }; +/* BRCMNAND v7.1 */ +static const u16 brcmnand_regs_v71[] = { + [BRCMNAND_CMD_START ] =0x04 , + [BRCMNAND_CMD_EXT_ADDRESS ] =0x08 , + [BRCMNAND_CMD_ADDRESS ] =0x0c , + [BRCMNAND_INTFC_STATUS ] =0x14 , + [BRCMNAND_CS_SELECT ] =0x18 , + [BRCMNAND_CS_XOR ] =0x1c , + [BRCMNAND_LL_OP ] =0x20 , + [BRCMNAND_CS0_BASE ] =0x50 , + [BRCMNAND_CS1_BASE ] =0 , + [BRCMNAND_CORR_THRESHOLD ] =0xdc , + [BRCMNAND_CORR_THRESHOLD_EXT ] =0xe0 , + [BRCMNAND_UNCORR_COUNT ] =0xfc , + [BRCMNAND_CORR_COUNT ] =0x100 , + [BRCMNAND_CORR_EXT_ADDR ] =0x10c , + [BRCMNAND_CORR_ADDR ] =0x110 , + [BRCMNAND_UNCORR_EXT_ADDR ] =0x114 , + [BRCMNAND_UNCORR_ADDR ] =0x118 , + [BRCMNAND_SEMAPHORE ] =0x150 , + [BRCMNAND_ID ] =0x194 , + [BRCMNAND_ID_EXT ] =0x198 , + [BRCMNAND_LL_RDATA ] =0x19c , + [BRCMNAND_OOB_READ_BASE ] =0x200 , + [BRCMNAND_OOB_READ_10_BASE ] =0 , + [BRCMNAND_OOB_WRITE_BASE ] =0x280 , + [BRCMNAND_OOB_WRITE_10_BASE ] =0 , + [BRCMNAND_FC_BASE ] =0x400 , +}; +enum brcmnand_cs_reg {BRCMNAND_CS_CFG_EXT =0 ,BRCMNAND_CS_CFG ,
@@ -406,7 +436,9 @@ static int brcmnand_revision_init(struct }/* Register offsets */ -if (ctrl->nand_version >=0x0600 ) +if (ctrl->nand_version >=0x0701 ) + ctrl->reg_offsets = brcmnand_regs_v71; +else if (ctrl->nand_version >=0x0600 ) ctrl->reg_offsets = brcmnand_regs_v60;else if (ctrl->nand_version >=0x0500 ) ctrl->reg_offsets = brcmnand_regs_v50;