4.6.5-stable review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.6.5-stable review
This is the start of the stable review cycle for the 4.6.5 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jul 27 20:33:38 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.6.5-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.6.5-rc1
Vivek Goyal <[email protected]>
ovl: warn instead of error if d_type is not supported
Vivek Goyal <[email protected]>
ovl: Do d_type check only if work dir creation was successful
Mika Kahola <[email protected]>
drm/i915: Revert DisplayPort fast link training feature
Jan Stancek <[email protected]>
crypto: qat - make qat_asym_algs.o depend on asn1 headers
Herbert Xu <[email protected]>
crypto: rsa-pkcs1pad - fix rsa-pkcs1pad request struct
Hugh Dickins <[email protected]>
tmpfs: fix regression hang in fallocate undo
Anthony Romano <[email protected]>
tmpfs: don't undo fallocate past its last page
Jan Beulich <[email protected]>
xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
Steve French <[email protected]>
File names with trailing period or space need special case conversion
Jerome Marchand <[email protected]>
cifs: dynamic allocation of ntlmssp blob
Steve French <[email protected]>
Fix reconnect to not defer smb3 session reconnect long after socket reconnect
James Bottomley <[email protected]>
53c700: fix BUG on untagged commands
Michael Holzheu <[email protected]>
Revert "s390/kdump: Clear subchannel ID to signal non-CCW/SCSI IPL"
Martin Schwidefsky <[email protected]>
s390: fix test_fp_ctl inline assembly contraints
Wei Fang <[email protected]>
scsi: fix race between simultaneous decrements of ->host_failed
Maxim Patlasov <[email protected]>
ovl: verify upper dentry in ovl_remove_and_whiteout()
Miklos Szeredi <[email protected]>
ovl: handle ATTR_KILL*
Vivek Goyal <[email protected]>
ovl: Copy up underlying inode's ->i_mode to overlay inode
Miklos Szeredi <[email protected]>
ovl: get_write_access() in truncate
Miklos Szeredi <[email protected]>
ovl: fix dentry leak for default_permissions
Thomas Petazzoni <[email protected]>
ARM: mvebu: fix HW I/O coherency related deadlocks
Thomas Petazzoni <[email protected]>
ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys
Boris Brezillon <[email protected]>
ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13
Awais Belal <[email protected]>
ALSA: hda: add AMD Stoney PCI ID with proper driver caps
Peter Wu <[email protected]>
ALSA: hda - fix use-after-free after module unload
Takashi Iwai <[email protected]>
ALSA: ctl: Stop notification after disconnection
Takashi Iwai <[email protected]>
ALSA: pcm: Free chmap at PCM free callback, too
Hui Wang <[email protected]>
ALSA: hda/realtek - add new pin definition in alc225 pin quirk table
Kazuki Oikawa <[email protected]>
ALSA: usb-audio: Fix quirks code is not called
Bob Copeland <[email protected]>
ALSA: hda - fix read before array start
Vinod Koul <[email protected]>
ALSA: hda - Add PCI ID for Kabylake-H
Torsten Hilbrich <[email protected]>
ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup
Takashi Iwai <[email protected]>
ALSA: timer: Fix negative queue usage by racy accesses
Christophe JAILLET <[email protected]>
ALSA: echoaudio: Fix memory allocation
Takashi Iwai <[email protected]>
ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
Jaroslav Kysela <[email protected]>
ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup
Woodrow Shen <[email protected]>
ALSA: hda - Fix the headset mic jack detection on Dell machine
Jaroslav Kysela <[email protected]>
ALSA: hdac_regmap - fix the register access for runtime PM
Takashi Iwai <[email protected]>
ALSA: dummy: Fix a use-after-free at closing
Pali Rohár <[email protected]>
hwmon: (dell-smm) Cache fan_type() calls and change fan detection
Pali Rohár <[email protected]>
hwmon: (dell-smm) Disallow fan_type() calls on broken machines
Pali Rohár <[email protected]>
hwmon: (dell-smm) Restrict fan control and serial number to CAP_SYS_ADMIN by default
Dmitry Torokhov <[email protected]>
tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
David Daney <[email protected]>
tty: vt: Fix soft lockup in fbcon cursor blink timer.
Mark Brown <[email protected]>
iio:ad7266: Fix probe deferral for vref
Mark Brown <[email protected]>
iio:ad7266: Fix support for optional regulators
Mark Brown <[email protected]>
iio:ad7266: Fix broken regulator error handling
Linus Walleij <[email protected]>
iio: accel: kxsd9: fix the usage of spi_w8r8()
Luis de Bethencourt <[email protected]>
staging: iio: accel: fix error check
Matt Ranostay <[email protected]>
iio: hudmidity: hdc100x: fix incorrect shifting and scaling
Matt Ranostay <[email protected]>
iio: humidity: hdc100x: fix IIO_TEMP channel reporting
Alison Schofield <[email protected]>
iio: humidity: hdc100x: correct humidity integration time mask
Matt Ranostay <[email protected]>
iio: proximity: as3935: fix buffer stack trashing
Matt Ranostay <[email protected]>
iio: proximity: as3935: remove triggered buffer processing
Matt Ranostay <[email protected]>
iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output
Yong Li <[email protected]>
iio: light apds9960: Add the missing dev.parent
Gregor Boirie <[email protected]>
iio:st_pressure: fix sampling gains (bring inline with ABI)
Crestez Dan Leonard <[email protected]>
iio: Fix error handling in iio_trigger_attach_poll_func
Ross Lagerwall <[email protected]>
xen/balloon: Fix declared-but-not-defined warning
David Miller <[email protected]>
PCI: Fix unaligned accesses in VC code
Ocquidant, Sebastien <[email protected]>
memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
Sinclair Yeh <[email protected]>
drm/vmwgfx: Fix error paths when mapping framebuffer
Thomas Hellstrom <[email protected]>
drm/vmwgfx: Fix corner case screen target management
Sinclair Yeh <[email protected]>
drm/vmwgfx: Delay pinning fbdev framebuffer until after mode set
Sinclair Yeh <[email protected]>
drm/vmwgfx: Check pin count before attempting to move a buffer
Sinclair Yeh <[email protected]>
drm/vmwgfx: Work around mode set failure in 2D VMs
Sinclair Yeh <[email protected]>
drm/vmwgfx: Add an option to change assumed FB bpp
Sinclair Yeh <[email protected]>
drm/ttm: Make ttm_bo_mem_compat available
Maarten Lankhorst <[email protected]>
drm/atomic: Make drm_atomic_legacy_backoff reset crtc->acquire_ctx
Boris Brezillon <[email protected]>
drm: atmel-hlcdc: actually disable scaling when no scaling is required
Huang Rui <[email protected]>
drm/amd/powerplay: fix incorrect voltage table value for tonga
Rex Zhu <[email protected]>
drm/amd/powerplay: incorrectly use of the function return value
Rex Zhu <[email protected]>
drm/amd/powerplay: fix logic error.
Rex Zhu <[email protected]>
drm/amd/powerplay: need to notify system bios pcie device ready
Rex Zhu <[email protected]>
drm/amd/powerplay: fix bug that function parameter was incorect.
Chris Wilson <[email protected]>
drm: Wrap direct calls to driver->gem_free_object from CMA
Tomi Valkeinen <[email protected]>
drm: make drm_atomic_set_mode_prop_for_crtc() more reliable
Tomi Valkeinen <[email protected]>
drm: add missing drm_mode_set_crtcinfo call
Chris Wilson <[email protected]>
drm/i915: Update ifdeffery for mutex->owner
Ville Syrjälä <[email protected]>
drm/i915: Refresh cached DP port register value on resume
Lyude <[email protected]>
drm/i915/fbc: Disable on HSW by default for now
Lyude <[email protected]>
drm/i915/ilk: Don't disable SSC source if it's in use
Ben Skeggs <[email protected]>
drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern
Dmitrii Tcvetkov <[email protected]>
drm/nouveau: fix for disabled fbdev emulation
Ben Skeggs <[email protected]>
drm/nouveau/disp/sor/gm107: training pattern registers are like gm200
Ben Skeggs <[email protected]>
drm/nouveau/fbcon: fix out-of-bounds memory accesses
Ben Skeggs <[email protected]>
drm/nouveau/ltc/gm107-: fix typo in the address of NV_PLTCG_LTC0_LTS0_INTR
Ben Skeggs <[email protected]>
drm/nouveau/gr/gf100-: update sm error decoding from gk20a nvgpu headers
Ben Skeggs <[email protected]>
drm/nouveau/disp/sor/gf119: both links use the same training register
Ben Skeggs <[email protected]>
drm/nouveau/bios/disp: fix handling of "match any protocol" entries
Michael S. Tsirkin <[email protected]>
virtio_balloon: fix PFN format for virtio-1
Andrey Grodzovsky <[email protected]>
drm/dp/mst: Always clear proposed vcpi table for port.
Oded Gabbay <[email protected]>
drm/amdkfd: destroy dbgmgr in notifier release
Oded Gabbay <[email protected]>
drm/amdkfd: unbind only existing processes
Richard Weinberger <[email protected]>
ubi: Make recover_peb power cut aware
Nicolas Iooss <[email protected]>
drm/amdgpu: initialize amdgpu_cgs_acpi_eval_object result value
Alex Deucher <[email protected]>
drm/amdgpu: fix num_rbs exposed to userspace (v2)
Alex Deucher <[email protected]>
drm/amdgpu/gfx7: fix broken condition check
Alex Deucher <[email protected]>
drm/radeon: fix asic initialization for virtualized environments
Jeff Mahoney <[email protected]>
btrfs: account for non-CoW'd blocks in btrfs_abort_transaction
Tejun Heo <[email protected]>
percpu: fix synchronization between synchronous map extension and chunk destruction
Tejun Heo <[email protected]>
percpu: fix synchronization between chunk->map_extend_work and chunk destruction
Miklos Szeredi <[email protected]>
af_unix: fix hard linked sockets on overlay
Miklos Szeredi <[email protected]>
vfs: add d_real_inode() helper
James Morse <[email protected]>
arm64: kernel: Save and restore UAO and addr_limit on exception entry
Shaokun Zhang <[email protected]>
arm64: mm: remove page_mapping check in __sync_icache_dcache
Mark Rutland <[email protected]>
arm64: fix dump_instr when PAN and UAO are in use
Robin Murphy <[email protected]>
drm/nouveau/Revert "drm/nouveau/device/pci: set as non-CPU-coherent on ARM64"
Junichi Nomura <[email protected]>
ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg()
Stefan Agner <[email protected]>
drm/fsl-dcu: use flat regmap cache
Mathieu Larouche <[email protected]>
drm/mgag200: Black screen fix for G200e rev 4
Vegard Nossum <[email protected]>
apparmor: fix oops, validate buffer size in apparmor_setprocattr()
Joerg Roedel <[email protected]>
iommu/amd: Fix unity mapping initialization race
Joerg Roedel <[email protected]>
iommu/vt-d: Enable QI on all IOMMUs before setting root entry
Jean-Philippe Brucker <[email protected]>
iommu/arm-smmu: Wire up map_sg for arm-smmu-v3
John Keeping <[email protected]>
iommu/rockchip: Fix zap cache during device attach
Jiri Slaby <[email protected]>
base: make module_create_drivers_dir race-free
Steven Rostedt (Red Hat) <[email protected]>
tracing: Handle NULL formats in hold_module_trace_bprintk_format()
Allen Hung <[email protected]>
HID: multitouch: enable palm rejection for Windows Precision Touchpad
Allen Hung <[email protected]>
Revert "HID: multitouch: enable palm rejection if device implements confidence usage"
Scott Bauer <[email protected]>
HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
Oliver Neukum <[email protected]>
HID: elo: kill not flush the work
Quentin Casasnovas <[email protected]>
KVM: nVMX: VMX instructions: fix segment checks when L1 is in long mode.
James Morse <[email protected]>
KVM: arm/arm64: Stop leaking vcpu pid references
Christian Borntraeger <[email protected]>
KVM: s390/mm: Fix CMMA reset during reboot
Xiubo Li <[email protected]>
kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
Yang Zhang <[email protected]>
kvm: vmx: check apicv is active before using VT-d posted interrupt
Dan Carpenter <[email protected]>
KEYS: potential uninitialized variable
Martin KaFai Lau <[email protected]>
ipv6: Fix mem leak in rt6i_pcpu
Bjørn Mork <[email protected]>
cdc_ncm: workaround for EM7455 "silent" data interface
Haishuang Yan <[email protected]>
geneve: fix max_mtu setting
Daniel Borkmann <[email protected]>
macsec: set actual real device for xmit when !protect_frames
WANG Cong <[email protected]>
net_sched: fix mirrored packets checksum
David S. Miller <[email protected]>
packet: Use symmetric hash for PACKET_FANOUT_HASH.
Peter Zijlstra <[email protected]>
sched/fair: Fix cfs_rq avg tracking underflow
Kirill A. Shutemov <[email protected]>
UBIFS: Implement ->migratepage()
Richard Weinberger <[email protected]>
mm: Export migrate_page_move_mapping and migrate_page_copy
Harvey Hunt <[email protected]>
irqchip/mips-gic: Fix IRQs in gic_dev_domain
James Hogan <[email protected]>
MIPS: KVM: Fix modular KVM under QEMU
Chen-Yu Tsai <[email protected]>
ARM: dts: sun6i: primo81: Drop constraints on dc1sw regulator
Chen-Yu Tsai <[email protected]>
ARM: dts: sun6i: yones-toptech-bs1078-v2: Drop constraints on dc1sw regulator
Steve Capper <[email protected]>
ARM: 8579/1: mm: Fix definition of pmd_mknotpresent
Will Deacon <[email protected]>
ARM: 8578/1: mm: ensure pmd_present only checks the valid bit
Fabio Estevam <[email protected]>
ARM: imx6ul: Fix Micrel PHY mask
Srinivas Kandagatla <[email protected]>
regulator: qcom_smd: add regulator ops for pm8941 lnldo
Srinivas Kandagatla <[email protected]>
regulator: qcom_smd: add list_voltage callback
J. Bruce Fields <[email protected]>
rpc: share one xps between all backchannels
J. Bruce Fields <[email protected]>
SUNRPC: fix xprt leak on xps allocation failure
Trond Myklebust <[email protected]>
NFS: Fix another OPEN_DOWNGRADE bug
Al Viro <[email protected]>
make nfs_atomic_open() call d_drop() on all ->open_context() errors.
Trond Myklebust <[email protected]>
NFS: Fix a double page unlock
Weston Andros Adamson <[email protected]>
pnfs_nfs: fix _cancel_empty_pagelist
Ben Hutchings <[email protected]>
nfsd: check permissions when setting ACLs
Andreas Gruenbacher <[email protected]>
posix_acl: Add set_posix_acl
Oleg Drokin <[email protected]>
nfsd: Extend the mutex holding region around in nfsd4_process_open2()
Oleg Drokin <[email protected]>
nfsd: Always lock state exclusively.
J. Bruce Fields <[email protected]>
nfsd4/rpc: move backchannel create logic into rpc code
Martin K. Petersen <[email protected]>
sd: Fix rw_max for devices that report an optimal xfer size
Tejun Heo <[email protected]>
writeback: use higher precision calculation in domain_dirty_limits()
Lukasz Luba <[email protected]>
thermal: cpu_cooling: fix improper order during initialization
Andy Lutomirski <[email protected]>
uvc: Forward compat ioctls to their handlers directly
Larry Finger <[email protected]>
rtlwifi: Fix scheduling while atomic error from commit 49f86ec21c01
Al Viro <[email protected]>
autofs braino fix for do_last()
Johan Hovold <[email protected]>
Revert "gpiolib: Split GPIO flags parsing and GPIO configuration"
Colin Pitrat <[email protected]>
gpio: sch: Fix Oops on module load on Asus Eee PC 1201
Linus Walleij <[email protected]>
gpio: make library immune to error pointers
Roger Quadros <[email protected]>
extcon: palmas: Fix boot up state of VBUS when using GPIO detection
Josh Poimboeuf <[email protected]>
perf/x86: Fix 32-bit perf user callgraph collection
Borislav Petkov <[email protected]>
x86/amd_nb: Fix boot crash on non-AMD systems
Vincent Stehlé <[email protected]>
perf/x86/intel/rapl: Fix pmus free during cleanup
Masami Hiramatsu <[email protected]>
kprobes/x86: Clear TF bit in fault on single-stepping
H. Peter Anvin <[email protected]>
x86, build: copy ldlinux.c32 to image.iso
Catalin Marinas <[email protected]>
cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE
Paolo Bonzini <[email protected]>
locking/static_key: Fix concurrent static_key_slow_inc()
Peter Zijlstra <[email protected]>
locking/qspinlock: Fix spin_unlock_wait() some more
Chris Wilson <[email protected]>
locking/ww_mutex: Report recursive ww_mutex locking early
Dr. David Alan Gilbert <[email protected]>
x86/msr: Use the proper trace point conditional for writes
Sergei Shtylyov <[email protected]>
of: irq: fix of_irq_get[_byname]() kernel-doc
Wolfram Sang <[email protected]>
of: fix autoloading due to broken modalias with no 'compatible'
Eric W. Biederman <[email protected]>
mnt: If fs_fully_visible fails call put_filesystem.
Eric W. Biederman <[email protected]>
mnt: Account for MS_RDONLY in fs_fully_visible
Eric W. Biederman <[email protected]>
mnt: fs_fully_visible test the proper mount for MNT_LOCKED
Oscar <[email protected]>
usb: common: otg-fsm: add license to usb-otg-fsm
Alan Stern <[email protected]>
USB: don't free bandwidth_mutex too early
Alan Stern <[email protected]>
USB: EHCI: declare hostpc register as zero-length array
Arnd Bergmann <[email protected]>
usb: dwc2: fix regression on big-endian PowerPC/ARM systems
Cyril Bur <[email protected]>
powerpc/tm: Always reclaim in start_thread() for exec() class syscalls
Michael Ellerman <[email protected]>
powerpc/pseries: Fix IBM_ARCH_VEC_NRCORES_OFFSET since POWER8NVL was added
Gavin Shan <[email protected]>
powerpc/pseries: Fix PCI config address for DDW
Guilherme G. Piccoli <[email protected]>
powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism
Jason Gunthorpe <[email protected]>
IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs
Mike Marciniszyn <[email protected]>
IB/rdmavt: Correct qp_priv_alloc() return value test
Bart Van Assche <[email protected]>
IB/cm: Fix a recently introduced locking bug
Max Gurtovoy <[email protected]>
IB/core: Fix bit curruption in ib_device_cap_flags structure
Mel Gorman <[email protected]>
futex: Calculate the futex key based on a tail page for file-based futexes
Tony Luck <[email protected]>
EDAC, sb_edac: Fix rank lookup on Broadwell
Nicholas Krause <[email protected]>
EDAC: Fix workqueues poll period resetting
Felix Fietkau <[email protected]>
cfg80211: fix proto in ieee80211_data_to_8023 for frames without LLC header
Jouni Malinen <[email protected]>
mac80211: Fix mesh estab_plinks counting in STA removal case
Martin Willi <[email protected]>
mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL
Bob Copeland <[email protected]>
mac80211: mesh: flush mesh paths unconditionally
Felix Fietkau <[email protected]>
mac80211: fix fast_tx header alignment
Johannes Berg <[email protected]>
cfg80211: remove get/set antenna and tx power warnings
-------------
Diffstat:
.../ABI/testing/sysfs-bus-iio-proximity-as3935 | 2 +- Documentation/scsi/scsi_eh.txt | 8 ++- Makefile | 4 +- arch/arm/boot/dts/armada-385-linksys.dtsi | 4 +- arch/arm/boot/dts/sun5i-r8-chip.dts | 2 +- arch/arm/boot/dts/sun6i-a31s-primo81.dts | 2 - .../dts/sun6i-a31s-yones-toptech-bs1078-v2.dts | 2 - arch/arm/include/asm/pgtable-2level.h | 1 + arch/arm/include/asm/pgtable-3level.h | 5 +- arch/arm/include/asm/pgtable.h | 1 - arch/arm/kvm/arm.c | 1 + arch/arm/mach-imx/mach-imx6ul.c | 2 +- arch/arm/mach-mvebu/coherency.c | 22 +++--- arch/arm64/include/asm/ptrace.h | 2 + arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kernel/entry.S | 19 ++++- arch/arm64/kernel/traps.c | 26 +++---- arch/arm64/mm/fault.c | 3 +- arch/arm64/mm/flush.c | 4 -- arch/mips/include/asm/kvm_host.h | 1 + arch/mips/kvm/interrupt.h | 1 + arch/mips/kvm/locore.S | 1 + arch/mips/kvm/mips.c | 11 ++- arch/powerpc/kernel/process.c | 10 +++ arch/powerpc/kernel/prom_init.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 24 +++---- arch/s390/include/asm/fpu/api.h | 2 +- arch/s390/kernel/ipl.c | 7 -- arch/s390/mm/pgtable.c | 2 +- arch/x86/boot/Makefile | 3 + arch/x86/events/core.c | 11 +-- arch/x86/events/intel/rapl.c | 2 +- arch/x86/include/asm/msr.h | 4 +- arch/x86/kernel/amd_nb.c | 4 +- arch/x86/kernel/kprobes/core.c | 12 ++++ arch/x86/kvm/vmx.c | 38 +++++----- crypto/rsa-pkcs1pad.c | 4 +- drivers/ata/libata-eh.c | 2 +- drivers/base/module.c | 8 ++- drivers/char/ipmi/ipmi_msghandler.c | 8 ++- drivers/crypto/qat/qat_common/Makefile | 1 + drivers/edac/edac_mc.c | 3 +- drivers/edac/sb_edac.c | 13 ++-- drivers/extcon/extcon-palmas.c | 2 + drivers/gpio/gpio-sch.c | 21 +++--- drivers/gpio/gpiolib-legacy.c | 8 +-- drivers/gpio/gpiolib.c | 66 ++++++++---------- drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 70 +++++++++++-------- .../gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c | 6 +- drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c | 18 ++++- drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c | 2 +- .../amd/powerplay/hwmgr/tonga_processpptables.c | 2 +- drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h | 1 + drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 2 + drivers/gpu/drm/drm_atomic.c | 30 +++++++- drivers/gpu/drm/drm_crtc.c | 2 - drivers/gpu/drm/drm_dp_mst_topology.c | 8 +-- drivers/gpu/drm/drm_fb_cma_helper.c | 2 +- drivers/gpu/drm/drm_gem_cma_helper.c | 12 +--- drivers/gpu/drm/drm_modes.c | 2 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 3 +- drivers/gpu/drm/i915/i915_gem_shrinker.c | 2 +- drivers/gpu/drm/i915/intel_display.c | 48 +++++++++---- drivers/gpu/drm/i915/intel_dp.c | 11 ++- drivers/gpu/drm/i915/intel_dp_link_training.c | 25 +------ drivers/gpu/drm/i915/intel_drv.h | 2 - drivers/gpu/drm/i915/intel_fbc.c | 3 +- drivers/gpu/drm/mgag200/mgag200_mode.c | 10 ++- .../drm/nouveau/include/nvkm/subdev/bios/disp.h | 5 +- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 2 + drivers/gpu/drm/nouveau/nv04_fbcon.c | 7 +- drivers/gpu/drm/nouveau/nv50_fbcon.c | 6 +- drivers/gpu/drm/nouveau/nvc0_fbcon.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c | 13 ++-- drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c | 12 ++-- drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h | 9 ++- .../gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 6 +- .../gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c | 53 ++++++++++++++ .../gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c | 15 +--- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 37 +++++++--- drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c | 8 ++- drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c | 2 +- drivers/gpu/drm/radeon/radeon_device.c | 21 ++++++ drivers/gpu/drm/ttm/ttm_bo.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c | 25 ++++++- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 12 ++++ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 47 +++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 10 +-- drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 8 +-- drivers/hid/hid-elo.c | 2 +- drivers/hid/hid-multitouch.c | 21 ++++-- drivers/hid/usbhid/hiddev.c | 10 +-- drivers/hwmon/dell-smm-hwmon.c | 80 +++++++++++++++------- drivers/iio/accel/kxsd9.c | 4 +- drivers/iio/adc/ad7266.c | 7 +- drivers/iio/humidity/hdc100x.c | 20 +++--- drivers/iio/industrialio-trigger.c | 23 +++++-- drivers/iio/light/apds9960.c | 1 + drivers/iio/pressure/st_pressure_core.c | 80 ++++++++++++++-------- drivers/iio/proximity/as3935.c | 17 +++-- drivers/infiniband/core/cm.c | 4 +- drivers/infiniband/hw/mlx4/ah.c | 2 +- drivers/infiniband/sw/rdmavt/qp.c | 4 +- drivers/iommu/amd_iommu_init.c | 14 +++- drivers/iommu/arm-smmu-v3.c | 1 + drivers/iommu/intel-iommu.c | 17 +++-- drivers/iommu/rockchip-iommu.c | 2 +- drivers/irqchip/irq-mips-gic.c | 12 +++- drivers/media/usb/uvc/uvc_v4l2.c | 39 +++++------ drivers/memory/omap-gpmc.c | 2 +- drivers/mtd/ubi/eba.c | 22 ++++-- drivers/net/geneve.c | 9 ++- drivers/net/macsec.c | 1 + drivers/net/usb/cdc_ncm.c | 7 ++ drivers/net/wireless/mac80211_hwsim.c | 1 + drivers/net/wireless/realtek/rtlwifi/core.c | 6 +- drivers/of/irq.c | 19 ++--- drivers/pci/vc.c | 4 +- drivers/regulator/qcom_smd-regulator.c | 14 +++- drivers/scsi/53c700.c | 4 +- drivers/scsi/scsi_error.c | 4 +- drivers/scsi/sd.c | 8 +-- drivers/scsi/sd.h | 5 ++ drivers/staging/iio/accel/sca3000_core.c | 2 +- drivers/thermal/cpu_cooling.c | 16 ++--- drivers/tty/vt/keyboard.c | 30 +++----- drivers/tty/vt/vt.c | 1 + drivers/usb/common/usb-otg-fsm.c | 2 + drivers/usb/core/hcd.c | 17 ++--- drivers/usb/dwc2/core.h | 27 ++++++++ drivers/virtio/virtio_balloon.c | 20 +++--- drivers/xen/balloon.c | 28 ++++---- drivers/xen/xen-acpi-processor.c | 35 +--------- fs/btrfs/ctree.c | 5 +- fs/btrfs/extent-tree.c | 2 +- fs/btrfs/super.c | 2 +- fs/btrfs/transaction.h | 2 +- fs/cifs/cifs_unicode.c | 33 +++++++-- fs/cifs/cifs_unicode.h | 2 + fs/cifs/connect.c | 4 +- fs/cifs/ntlmssp.h | 2 +- fs/cifs/sess.c | 76 +++++++++++--------- fs/cifs/smb2pdu.c | 37 +++++++--- fs/namei.c | 8 +-- fs/namespace.c | 10 ++- fs/nfs/dir.c | 2 +- fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs_nfs.c | 12 +++- fs/nfs/read.c | 4 +- fs/nfsd/nfs2acl.c | 20 +++--- fs/nfsd/nfs3acl.c | 16 ++--- fs/nfsd/nfs4acl.c | 16 ++--- fs/nfsd/nfs4callback.c | 18 +---- fs/nfsd/nfs4state.c | 50 ++++++++------ fs/nfsd/state.h | 2 +- fs/overlayfs/dir.c | 54 +++++++-------- fs/overlayfs/inode.c | 35 ++++++++-- fs/overlayfs/overlayfs.h | 1 + fs/overlayfs/super.c | 21 +++--- fs/posix_acl.c | 42 +++++++----- fs/ubifs/file.c | 24 +++++++ include/asm-generic/qspinlock.h | 53 +++++--------- include/drm/ttm/ttm_bo_api.h | 14 ++++ include/linux/cpuidle.h | 3 + include/linux/dcache.h | 12 ++++ include/linux/jump_label.h | 16 ++++- include/linux/skbuff.h | 20 ++++++ include/linux/sunrpc/clnt.h | 2 - include/linux/sunrpc/svc_xprt.h | 1 + include/linux/sunrpc/xprt.h | 1 + include/linux/usb/ehci_def.h | 4 +- include/rdma/ib_verbs.h | 2 +- include/rdma/rdma_vt.h | 4 +- kernel/futex.c | 14 +++- kernel/jump_label.c | 36 +++++++++- kernel/locking/mutex.c | 9 ++- kernel/locking/qspinlock.c | 60 ++++++++++++++++ kernel/sched/fair.c | 33 ++++++--- kernel/sched/idle.c | 2 +- kernel/trace/trace_printk.c | 7 +- mm/migrate.c | 2 + mm/page-writeback.c | 21 +++--- mm/percpu.c | 73 ++++++++++++-------- mm/shmem.c | 8 ++- net/core/flow_dissector.c | 43 ++++++++++++ net/core/skbuff.c | 18 ----- net/ipv6/ip6_fib.c | 1 + net/mac80211/mesh.c | 11 ++- net/mac80211/sta_info.h | 2 +- net/packet/af_packet.c | 2 +- net/sched/act_mirred.c | 2 +- net/sunrpc/clnt.c | 31 +++++++-- net/sunrpc/svc_xprt.c | 2 + net/sunrpc/xprtsock.c | 1 + net/unix/af_unix.c | 6 +- net/wireless/core.c | 2 - net/wireless/util.c | 2 +- scripts/mod/file2alias.c | 2 +- security/apparmor/lsm.c | 36 +++++----- security/keys/key.c | 2 +- sound/core/control.c | 2 + sound/core/pcm.c | 14 ++-- sound/core/timer.c | 2 +- sound/drivers/dummy.c | 1 + sound/hda/hdac_regmap.c | 4 +- sound/pci/au88x0/au88x0_core.c | 5 +- sound/pci/echoaudio/echoaudio.c | 4 +- sound/pci/hda/hda_generic.c | 2 + sound/pci/hda/hda_intel.c | 12 +++- sound/pci/hda/patch_realtek.c | 22 +++++- sound/usb/card.c | 2 +- virt/kvm/kvm_main.c | 2 +- 220 files changed, 1755 insertions(+), 999 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/203 cfg80211: remove get/set antenna and tx power warnings
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 6cbf6236d54c24b9a29e6892549c25b6902b44ce upstream.
Since set_tx_power and set_antenna are frequently implemented without the matching get_tx_power/get_antenna, we shouldn't have added warnings for those. Remove them.
The remaining ones are correct and need to be implemented symmetrically for correct operation.
--- net/wireless/core.c | 2 -- 1 file changed, 2 deletions(-)
net/wireless/core.c +0 -2
@@ -360,8 +360,6 @@ struct wiphy *wiphy_new_nm(const structWARN_ON (ops->remain_on_channel && !ops->cancel_remain_on_channel);WARN_ON (ops->tdls_channel_switch && !ops->tdls_cancel_channel_switch);WARN_ON (ops->add_tx_ts && !ops->del_tx_ts); -WARN_ON (ops->set_tx_power && !ops->get_tx_power); -WARN_ON (ops->set_antenna && !ops->get_antenna); alloc_size =sizeof (*rdev) + sizeof_priv;
Greg Kroah-Hartman
maintainerPATCH 2/203 mac80211: fix fast_tx header alignment
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
commit 6fe04128f158c5ad27e7504bfdf1b12e63331bc9 upstream.
The header field is defined as u8[] but also accessed as struct ieee80211_hdr. Enforce an alignment of 2 to prevent unnecessary unaligned accesses, which can be very harmful for performance on many platforms.
--- net/mac80211/sta_info.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/sta_info.h +1 -1
@@ -275,7 +275,7 @@ struct ieee80211_fast_tx {u8 sa_offs, da_offs, pn_offs;u8 band;u8 hdr[30 +2 +IEEE80211_FAST_XMIT_MAX_IV + -sizeof (rfc1042_header)]; +sizeof (rfc1042_header)]__aligned(2) ;struct rcu_head rcu_head; };
Greg Kroah-Hartman
maintainerPATCH 3/203 mac80211: mesh: flush mesh paths unconditionally
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Copeland <[email protected]>
commit fe7a7c57629e8dcbc0e297363a9b2366d67a6dc5 upstream.
Currently, the mesh paths associated with a nexthop station are cleaned up in the following code path:
__sta_info_destroy_part1
synchronize_net()
__sta_info_destroy_part2
-> cleanup_single_sta
-> mesh_sta_cleanup
-> mesh_plink_deactivate
-> mesh_path_flush_by_nexthopHowever, there are a couple of problems here:
1) the paths aren't flushed at all if the MPM is running in userspace (e.g. when using wpa_supplicant or authsae)
2) there is no synchronize_rcu between removing the path and readers accessing the nexthop, which means the following race is possible:
CPU0 CPU1
~~~~ ~~~~
sta_info_destroy_part1() synchronize_net()rcu_read_lock()mesh_nexthop_resolve()
mpath = mesh_path_lookup()
[...] -> mesh_path_flush_by_nexthop()
sta = rcu_dereference(
mpath->next_hop)
kfree(sta)access sta <-- CRASH
Fix both of these by unconditionally flushing paths before destroying the sta, and by adding a synchronize_net() after path flush to ensure no active readers can still dereference the sta.
Fixes this crash:
[ 348.529295] BUG: unable to handle kernel paging request at 00020040 [ 348.530014] IP: [<f929245d>] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] [ 348.530014] *pde = 00000000 [ 348.530014] Oops: 0000 [#1] PREEMPT [ 348.530014] Modules linked in: drbg ansi_cprng ctr ccm ppp_generic slhc ipt_MASQUERADE nf_nat_masquerade_ipv4 8021q ] [ 348.530014] CPU: 0 PID: 20597 Comm: wget Tainted: G O 4.6.0-rc5-wt=V1 #1 [ 348.530014] Hardware name: To Be Filled By O.E.M./To be filled by O.E.M., BIOS 080016 11/07/2014 [ 348.530014] task: f64fa280 ti: f4f9c000 task.ti: f4f9c000 [ 348.530014] EIP: 0060:[<f929245d>] EFLAGS: 00010246 CPU: 0 [ 348.530014] EIP is at ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] [ 348.530014] EAX: f4ce63e0 EBX: 00000088 ECX: f3788416 EDX: 00020008 [ 348.530014] ESI: 00000000 EDI: 00000088 EBP: f6409a4c ESP: f6409a40 [ 348.530014] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 [ 348.530014] CR0: 80050033 CR2: 00020040 CR3: 33190000 CR4: 00000690 [ 348.530014] Stack: [ 348.530014] 00000000 f4ce63e0 f5f9bd80 f6409a64 f9291d80 0000ce67 f5d51e00 f4ce63e0 [ 348.530014] f3788416 f6409a80 f9291dc1 f4ce8320 f4ce63e0 f5d51e00 f4ce63e0 f4ce8320 [ 348.530014] f6409a98 f9277f6f 00000000 00000000 0000007c 00000000 f6409b2c f9278dd1 [ 348.530014] Call Trace: [ 348.530014] [<f9291d80>] mesh_nexthop_lookup+0xbb/0xc8 [mac80211] [ 348.530014] [<f9291dc1>] mesh_nexthop_resolve+0x34/0xd8 [mac80211] [ 348.530014] [<f9277f6f>] ieee80211_xmit+0x92/0xc1 [mac80211] [ 348.530014] [<f9278dd1>] __ieee80211_subif_start_xmit+0x807/0x83c [mac80211] [ 348.530014] [<c04df012>] ? sch_direct_xmit+0xd7/0x1b3 [ 348.530014] [<c022a8c6>] ? __local_bh_enable_ip+0x5d/0x7b [ 348.530014] [<f956870c>] ? nf_nat_ipv4_out+0x4c/0xd0 [nf_nat_ipv4] [ 348.530014] [<f957e036>] ? iptable_nat_ipv4_fn+0xf/0xf [iptable_nat] [ 348.530014] [<c04c6f45>] ? netif_skb_features+0x14d/0x30a [ 348.530014] [<f9278e10>] ieee80211_subif_start_xmit+0xa/0xe [mac80211] [ 348.530014] [<c04c769c>] dev_hard_start_xmit+0x1f8/0x267 [ 348.530014] [<c04c7261>] ? validate_xmit_skb.isra.120.part.121+0x10/0x253 [ 348.530014] [<c04defc6>] sch_direct_xmit+0x8b/0x1b3 [ 348.530014] [<c04c7a9c>] __dev_queue_xmit+0x2c8/0x513 [ 348.530014] [<c04c7cfb>] dev_queue_xmit+0xa/0xc [ 348.530014] [<f91bfc7a>] batadv_send_skb_packet+0xd6/0xec [batman_adv] [ 348.530014] [<f91bfdc4>] batadv_send_unicast_skb+0x15/0x4a [batman_adv] [ 348.530014] [<f91b5938>] batadv_dat_send_data+0x27e/0x310 [batman_adv] [ 348.530014] [<f91c30b5>] ? batadv_tt_global_hash_find.isra.11+0x8/0xa [batman_adv] [ 348.530014] [<f91b63f3>] batadv_dat_snoop_outgoing_arp_request+0x208/0x23d [batman_adv] [ 348.530014] [<f91c0cd9>] batadv_interface_tx+0x206/0x385 [batman_adv] [ 348.530014] [<c04c769c>] dev_hard_start_xmit+0x1f8/0x267 [ 348.530014] [<c04c7261>] ? validate_xmit_skb.isra.120.part.121+0x10/0x253 [ 348.530014] [<c04defc6>] sch_direct_xmit+0x8b/0x1b3 [ 348.530014] [<c04c7a9c>] __dev_queue_xmit+0x2c8/0x513 [ 348.530014] [<f80cbd2a>] ? igb_xmit_frame+0x57/0x72 [igb] [ 348.530014] [<c04c7cfb>] dev_queue_xmit+0xa/0xc [ 348.530014] [<f843a326>] br_dev_queue_push_xmit+0xeb/0xfb [bridge] [ 348.530014] [<f843a35f>] br_forward_finish+0x29/0x74 [bridge] [ 348.530014] [<f843a23b>] ? deliver_clone+0x3b/0x3b [bridge] [ 348.530014] [<f843a714>] __br_forward+0x89/0xe7 [bridge] [ 348.530014] [<f843a336>] ? br_dev_queue_push_xmit+0xfb/0xfb [bridge] [ 348.530014] [<f843a234>] deliver_clone+0x34/0x3b [bridge] [ 348.530014] [<f843a68b>] ? br_flood+0x95/0x95 [bridge] [ 348.530014] [<f843a66d>] br_flood+0x77/0x95 [bridge] [ 348.530014] [<f843a809>] br_flood_forward+0x13/0x1a [bridge] [ 348.530014] [<f843a68b>] ? br_flood+0x95/0x95 [bridge] [ 348.530014] [<f843b877>] br_handle_frame_finish+0x392/0x3db [bridge] [ 348.530014] [<c04e9b2b>] ? nf_iterate+0x2b/0x6b [ 348.530014] [<f843baa6>] br_handle_frame+0x1e6/0x240 [bridge] [ 348.530014] [<f843b4e5>] ? br_handle_local_finish+0x6a/0x6a [bridge] [ 348.530014] [<c04c4ba0>] __netif_receive_skb_core+0x43a/0x66b [ 348.530014] [<f843b8c0>] ? br_handle_frame_finish+0x3db/0x3db [bridge] [ 348.530014] [<c023cea4>] ? resched_curr+0x19/0x37 [ 348.530014] [<c0240707>] ? check_preempt_wakeup+0xbf/0xfe [ 348.530014] [<c0255dec>] ? ktime_get_with_offset+0x5c/0xfc [ 348.530014] [<c04c4fc1>] __netif_receive_skb+0x47/0x55 [ 348.530014] [<c04c57ba>] netif_receive_skb_internal+0x40/0x5a [ 348.530014] [<c04c61ef>] napi_gro_receive+0x3a/0x94 [ 348.530014] [<f80ce8d5>] igb_poll+0x6fd/0x9ad [igb] [ 348.530014] [<c0242bd8>] ? swake_up_locked+0x14/0x26 [ 348.530014] [<c04c5d29>] net_rx_action+0xde/0x250 [ 348.530014] [<c022a743>] __do_softirq+0x8a/0x163 [ 348.530014] [<c022a6b9>] ? __hrtimer_tasklet_trampoline+0x19/0x19 [ 348.530014] [<c021100f>] do_softirq_own_stack+0x26/0x2c [ 348.530014] <IRQ> [ 348.530014] [<c022a957>] irq_exit+0x31/0x6f [ 348.530014] [<c0210eb2>] do_IRQ+0x8d/0xa0 [ 348.530014] [<c058152c>] common_interrupt+0x2c/0x40 [ 348.530014] Code: e7 8c 00 66 81 ff 88 00 75 12 85 d2 75 0e b2 c3 b8 83 e9 29 f9 e8 a7 5f f9 c6 eb 74 66 81 e3 8c 005 [ 348.530014] EIP: [<f929245d>] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] SS:ESP 0068:f6409a40 [ 348.530014] CR2: 0000000000020040 [ 348.530014] ---[ end trace 48556ac26779732e ]--- [ 348.530014] Kernel panic - not syncing: Fatal exception in interrupt [ 348.530014] Kernel Offset: disabled
--- net/mac80211/mesh.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/mesh.c +4 -0
@@ -163,6 +163,10 @@ void mesh_sta_cleanup(struct sta_info *sdel_timer_sync (&sta->mesh->plink_timer); } +/* make sure no readers can access nexthop sta from here on */ +mesh_path_flush_by_nexthop (sta); +synchronize_net (); +if (changed)ieee80211_mbss_info_change_notify (sdata, changed); }
Greg Kroah-Hartman
maintainerPATCH 4/203 mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Willi <[email protected]>
commit 62397da50bb20a6b812c949ef465d7e69fe54bb6 upstream.
A wmediumd that does not send this attribute causes a NULL pointer dereference, as the attribute is accessed even if it does not exist.
The attribute was required but never checked ever since userspace frame forwarding has been introduced. The issue gets more problematic once we allow wmediumd registration from user namespaces.
--- drivers/net/wireless/mac80211_hwsim.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mac80211_hwsim.c +1 -0
@@ -2771,6 +2771,7 @@ static int hwsim_tx_info_frame_received_if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER ] || !info->attrs[HWSIM_ATTR_FLAGS ] || !info->attrs[HWSIM_ATTR_COOKIE ] || + !info->attrs[HWSIM_ATTR_SIGNAL ] || !info->attrs[HWSIM_ATTR_TX_INFO ]) goto out;
Greg Kroah-Hartman
maintainerPATCH 5/203 mac80211: Fix mesh estab_plinks counting in STA removal case
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jouni Malinen <[email protected]>
commit 126e7557328a1cd576be4fca95b133a2695283ff upstream.
If a user space program (e.g., wpa_supplicant) deletes a STA entry that is currently in NL80211_PLINK_ESTAB state, the number of established plinks counter was not decremented and this could result in rejecting new plink establishment before really hitting the real maximum plink limit. For !user_mpm case, this decrementation is handled by mesh_plink_deactive().
Fix this by decrementing estab_plinks on STA deletion (mesh_sta_cleanup() gets called from there) so that the counter has a correct value and the Beacon frame advertisement in Mesh Configuration element shows the proper value for capability to accept additional peers.
--- net/mac80211/mesh.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/mac80211/mesh.c +5 -2
@@ -150,14 +150,17 @@ u32 mesh_accept_plinks_update(struct ieevoid mesh_sta_cleanup (struct sta_info *sta) {struct ieee80211_sub_if_data *sdata = sta->sdata; -u32 changed; +u32 changed =0 ;/* * maybe userspace handles peer allocation and peering, but in either * case the beacon is still generated by the kernel and we might need * an update. */ - changed =mesh_accept_plinks_update (sdata); +if (sdata->u.mesh.user_mpm && + sta->mesh->plink_state ==NL80211_PLINK_ESTAB ) + changed |=mesh_plink_dec_estab_count (sdata); + changed |=mesh_accept_plinks_update (sdata);if (!sdata->u.mesh.user_mpm) { changed |=mesh_plink_deactivate (sta);del_timer_sync (&sta->mesh->plink_timer);
Greg Kroah-Hartman
maintainerPATCH 6/203 cfg80211: fix proto in ieee80211_data_to_8023 for frames without LLC header
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
commit c041778c966c92c964033f1cdfee60a9f2b5e465 upstream.
The PDU length of incoming LLC frames is set to the total skb payload size in __ieee80211_data_to_8023() of net/wireless/util.c which incorrectly includes the length of the IEEE 802.11 header.
The resulting LLC frame header has a too large PDU length, causing the llc_fixup_skb() function of net/llc/llc_input.c to reject the incoming skb, effectively breaking STP.
Solve the problem by properly substracting the IEEE 802.11 frame header size from the PDU length, allowing the LLC processor to pick up the incoming control messages.
Special thanks to Gerry Rozema for tracking down the regression and proposing a suitable patch.
--- net/wireless/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/util.c +1 -1
@@ -509,7 +509,7 @@ static int __ieee80211_data_to_8023(stru* replace EtherType */ hdrlen +=ETH_ALEN +2 ; else - tmp.h_proto = htons(skb->len); + tmp.h_proto = htons(skb->len - hdrlen);pskb_pull (skb, hdrlen);
Greg Kroah-Hartman
maintainerPATCH 7/203 EDAC: Fix workqueues poll period resetting
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Krause <[email protected]>
commit fbedcaf43fba35677c01a4ae51e6f79edf4049ba upstream.
After the workqueue cleanup, we're registering workqueues based on the presence of an ->edac_check function. When that is the case, we're setting OP_RUNNING_POLL. But we forgot to check that in edac_mc_reset_delay_period(), leading to:
BUG: unable to handle kernel paging request at 0000000000015d10
IP: [ .. ] queued_spin_lock_slowpath
PGD 3ffcc8067 PUD 3ffc56067 PMD 0
Oops: 0002 [#1] SMP
Modules linked in: ...
CPU: 1 PID: 2792 Comm: edactest Not tainted 4.6.0-dirty #1
Hardware name: HP ProLiant MicroServer, BIOS O41 10/01/2013
Stack:
Call Trace:
? _raw_spin_lock_irqsave
? lock_timer_base.isra.34
? del_timer
? try_to_grab_pending
? mod_delayed_work_on
? edac_mc_reset_delay_period
? edac_set_poll_msec
? param_attr_store
? module_attr_store
? kernfs_fop_write
? __vfs_write
? __vfs_read
? __alloc_fd
? vfs_write
? SyS_write
? entry_SYSCALL_64_fastpath
Code:
RIP [ .. ] queued_spin_lock_slowpath
RSP <>
CR2: 0000000000015d10
---[ end trace 3f286bc71cca15d1 ]---
Kernel panic - not syncing: Fatal exceptionFix it.
--- drivers/edac/edac_mc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/edac/edac_mc.c +2 -1
@@ -565,7 +565,8 @@ void edac_mc_reset_delay_period(unsignedlist_for_each (item, &mc_devices) { mci = list_entry(item, struct mem_ctl_info, link); -edac_mod_work (&mci->work, value); +if (mci->op_state ==OP_RUNNING_POLL ) +edac_mod_work (&mci->work, value); }mutex_unlock (&mem_ctls_mutex); }
Greg Kroah-Hartman
maintainerPATCH 8/203 EDAC, sb_edac: Fix rank lookup on Broadwell
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
commit c7103f650a11328f28b9fa1c95027db331b7774b upstream.
Broadwell made a small change to the rank target register moving the target rank ID field up from bits 16:19 to bits 20:23.
Also found that the offset field grew by one bit in the IVY_BRIDGE to HASWELL transition, so fix the RIR_OFFSET() macro too.
--- drivers/edac/sb_edac.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/edac/sb_edac.c +8 -5
@@ -239,8 +239,11 @@ static const u32 rir_offset[MAX_RIR_RANG { 0x1a0, 0x1a4, 0x1a8, 0x1ac, 0x1b0, 0x1b4, 0x1b8, 0x1bc }, }; -#define RIR_RNK_TGT (reg) GET_BITFIELD(reg, 16, 19) -#define RIR_OFFSET (reg) GET_BITFIELD(reg, 2, 14) +#define RIR_RNK_TGT (type, reg) (((type) == BROADWELL) ? \ + GET_BITFIELD(reg, 20, 23) : GET_BITFIELD(reg, 16, 19)) + +#define RIR_OFFSET (type, reg) (((type) == HASWELL || (type) == BROADWELL) ? \ + GET_BITFIELD(reg, 2, 15) : GET_BITFIELD(reg, 2, 14))/* Device 16, functions 2-7 */
@@ -1916,14 +1919,14 @@ static void get_memory_layout(const strupci_read_config_dword (pvt->pci_tad[i], rir_offset[j][k], ®); - tmp_mb =RIR_OFFSET (reg) <<6 ; + tmp_mb =RIR_OFFSET (pvt->info.type, reg) <<6 ; gb =div_u64_rem (tmp_mb,1024 , &mb);edac_dbg (0 ,"CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n" , i, j, k, gb, (mb*1000 )/1024 , ((u64 )tmp_mb) <<20L , - (u32 )RIR_RNK_TGT (reg), + (u32 )RIR_RNK_TGT (pvt->info.type, reg), reg); } }
@@ -2256,7 +2259,7 @@ static int get_memory_error_data(structpci_read_config_dword (pvt->pci_tad[ch_add + base_ch], rir_offset[n_rir][idx], ®); - *rank =RIR_RNK_TGT (reg); + *rank =RIR_RNK_TGT (pvt->info.type, reg); edac_dbg(0, "RIR#%d: channel address 0x%08Lx < 0x%08Lx, RIR interleave %d, index %d\n", n_rir,
Greg Kroah-Hartman
maintainerPATCH 9/203 futex: Calculate the futex key based on a tail page for file-based futexes
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit 077fa7aed17de5022e44bf07dbaf732078b7b5b2 upstream.
Mike Galbraith reported that the LTP test case futex_wake04 was broken by commit 65d8fc777f6d ("futex: Remove requirement for lock_page() in get_futex_key()").
This test case uses futexes backed by hugetlbfs pages and so there is an associated inode with a futex stored on such pages. The problem is that the key is being calculated based on the head page index of the hugetlbfs page and not the tail page.
Prior to the optimisation, the page lock was used to stabilise mappings and pin the inode is file-backed which is overkill. If the page was a compound page, the head page was automatically looked up as part of the page lock operation but the tail page index was used to calculate the futex key.
After the optimisation, the compound head is looked up early and the page lock is only relied upon to identify truncated pages, special pages or a shmem page moving to swapcache. The head page is looked up because without the page lock, special care has to be taken to pin the inode correctly. However, the tail page is still required to calculate the futex key so this patch records the tail page.
On vanilla 4.6, the output of the test case is;
futex_wake04 0 TINFO : Hugepagesize 2097152 futex_wake04 1 TFAIL : futex_wake04.c:126: Bug: wait_thread2 did not wake after 30 secs.
With the patch applied
futex_wake04 0 TINFO : Hugepagesize 2097152 futex_wake04 1 TPASS : Hi hydra, thread2 awake!
--- kernel/futex.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
kernel/futex.c +10 -2
@@ -469,7 +469,7 @@ get_futex_key(u32 __user *uaddr, int fsh {unsigned long address = (unsigned long )uaddr;struct mm_struct *mm = current->mm; -struct page *page; +struct page *page, *tail;struct address_space *mapping;int err, ro =0 ;
@@ -530,7 +530,15 @@ again:* considered here and page lock forces unnecessarily serialization * From this point on, mapping will be re-verified if necessary and * page lock will be acquired only if it is unavoidable +* +* Mapping checks require the head page for any compound page so the +* head page and mapping is looked up now. For anonymous pages, it +* does not matter if the page splits in the future as the key is +* based on the address. For filesystem-backed pages, the tail is +* required as the index of the page determines the key. For +* base pages, there is no tail page and tail == page. */ + tail = page; page =compound_head (page); mapping =READ_ONCE (page->mapping);
@@ -654,7 +662,7 @@ again: key->both.offset |=FUT_OFF_INODE ;/* inode-based key */ key->shared.inode = inode; - key->shared.pgoff =basepage_index (page); + key->shared.pgoff =basepage_index (tail);rcu_read_unlock (); }
Greg Kroah-Hartman
maintainerPATCH 10/203 IB/core: Fix bit curruption in ib_device_cap_flags structure
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Gurtovoy <[email protected]>
commit 47355b3cd7d3c9c5226bff7c449b9d269fb17fa6 upstream.
ib_device_cap_flags 64-bit expansion caused caps overlapping and made consumers read wrong device capabilities. For example IB_DEVICE_SG_GAPS_REG was falsely read by the iser driver causing it to use a non-existing capability. This happened because signed int becomes sign extended when converted it to u64. Fix this by casting IB_DEVICE_ON_DEMAND_PAGING enumeration to ULL.
--- include/rdma/ib_verbs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/rdma/ib_verbs.h +1 -1
@@ -217,7 +217,7 @@ enum ib_device_cap_flags {IB_DEVICE_CROSS_CHANNEL = (1 <<27 ),IB_DEVICE_MANAGED_FLOW_STEERING = (1 <<29 ),IB_DEVICE_SIGNATURE_HANDOVER = (1 <<30 ), -IB_DEVICE_ON_DEMAND_PAGING = (1 <<31 ), +IB_DEVICE_ON_DEMAND_PAGING = (1ULL <<31 ),IB_DEVICE_SG_GAPS_REG = (1ULL <<32 ), IB_DEVICE_VIRTUAL_FUNCTION = ((u64)1 << 33), };
Greg Kroah-Hartman
maintainerPATCH 11/203 IB/cm: Fix a recently introduced locking bug
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 943f44d94aa26bfdcaafc40d3701e24eeb58edce upstream.
ib_cm_notify() can be called from interrupt context. Hence do not reenable interrupts unconditionally in cm_establish().
This patch avoids that lockdep reports the following warning:
WARNING: CPU: 0 PID: 23317 at kernel/locking/lockdep.c:2624 trace _hardirqs_on_caller+0x112/0x1b0 DEBUG_LOCKS_WARN_ON(current->hardirq_context) Call Trace: <IRQ> [<ffffffff812bd0e5>] dump_stack+0x67/0x92 [<ffffffff81056f21>] __warn+0xc1/0xe0 [<ffffffff81056f8a>] warn_slowpath_fmt+0x4a/0x50 [<ffffffff810a5932>] trace_hardirqs_on_caller+0x112/0x1b0 [<ffffffff810a59dd>] trace_hardirqs_on+0xd/0x10 [<ffffffff815992c7>] _raw_spin_unlock_irq+0x27/0x40 [<ffffffffa0382e9c>] ib_cm_notify+0x25c/0x290 [ib_cm] [<ffffffffa068fbc1>] srpt_qp_event+0xa1/0xf0 [ib_srpt] [<ffffffffa04efb97>] mlx4_ib_qp_event+0x67/0xd0 [mlx4_ib] [<ffffffffa034ec0a>] mlx4_qp_event+0x5a/0xc0 [mlx4_core] [<ffffffffa03365f8>] mlx4_eq_int+0x3d8/0xcf0 [mlx4_core] [<ffffffffa0336f9c>] mlx4_msi_x_interrupt+0xc/0x20 [mlx4_core] [<ffffffff810b0914>] handle_irq_event_percpu+0x64/0x100 [<ffffffff810b09e4>] handle_irq_event+0x34/0x60 [<ffffffff810b3a6a>] handle_edge_irq+0x6a/0x150 [<ffffffff8101ad05>] handle_irq+0x15/0x20 [<ffffffff8101a66c>] do_IRQ+0x5c/0x110 [<ffffffff8159a2c9>] common_interrupt+0x89/0x89 [<ffffffff81297a17>] blk_run_queue_async+0x37/0x40 [<ffffffffa0163e53>] rq_completed+0x43/0x70 [dm_mod] [<ffffffffa0164896>] dm_softirq_done+0x176/0x280 [dm_mod] [<ffffffff812a26c2>] blk_done_softirq+0x52/0x90 [<ffffffff8105bc1f>] __do_softirq+0x10f/0x230 [<ffffffff8105bec8>] irq_exit+0xa8/0xb0 [<ffffffff8103653e>] smp_trace_call_function_single_interrupt+0x2e/0x30 [<ffffffff81036549>] smp_call_function_single_interrupt+0x9/0x10 [<ffffffff8159a959>] call_function_single_interrupt+0x89/0x90 <EOI>
--- drivers/infiniband/core/cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/core/cm.c +2 -2
@@ -3452,14 +3452,14 @@ static int cm_establish(struct ib_cm_id work->cm_event.event =IB_CM_USER_ESTABLISHED ;/* Check if the device started its remove_one */ -spin_lock_irq (&cm.lock); +spin_lock_irqsave (&cm.lock, flags);if (!cm_dev->going_down) {queue_delayed_work (cm.wq, &work->work,0 ); }else {kfree (work); ret = -ENODEV ; } -spin_unlock_irq (&cm.lock); +spin_unlock_irqrestore (&cm.lock, flags); out:return ret;
Greg Kroah-Hartman
maintainerPATCH 12/203 IB/rdmavt: Correct qp_priv_alloc() return value test
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <[email protected]>
commit c755f4afa66ad3ed98870bd3254f37c47fb2c800 upstream.
The current drivers return errors from this calldown wrapped in an ERR_PTR().
The rdmavt code incorrectly tests for NULL.
The code is fixed to use IS_ERR() and change ret according to the driver return value.
--- drivers/infiniband/sw/rdmavt/qp.c | 4 +++- include/rdma/rdma_vt.h | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/infiniband/sw/rdmavt/qp.c +3 -1
@@ -683,8 +683,10 @@ struct ib_qp *rvt_create_qp(struct ib_pd* initialization that is needed. */ priv = rdi->driver_f.qp_priv_alloc (rdi, qp, gfp); -if (!priv) +if (IS_ERR (priv)) { + ret = priv; goto bail_qp; + } qp->priv = priv; qp->timeout_jiffies = usecs_to_jiffies((4096UL * (1UL << qp->timeout)) /
include/rdma/rdma_vt.h +3 -1
@@ -203,7 +203,9 @@ struct rvt_driver_provided {/* * Allocate a private queue pair data structure for driver specific -* information which is opaque to rdmavt. +* information which is opaque to rdmavt. Errors are returned via +* ERR_PTR(err). The driver is free to return NULL or a valid +* pointer. */ void * (*qp_priv_alloc)(struct rvt_dev_info *rdi,struct rvt_qp *qp,gfp_t gfp);
Greg Kroah-Hartman
maintainerPATCH 13/203 IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit 8c5122e45a10a9262f872b53f151a592e870f905 upstream.
When this code was reworked for IBoE support the order of assignments for the sl_tclass_flowlabel got flipped around resulting in TClass & FlowLabel being permanently set to 0 in the packet headers.
This breaks IB routers that rely on these headers, but only affects kernel users - libmlx4 does this properly for user space.
--- drivers/infiniband/hw/mlx4/ah.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx4/ah.c +1 -1
@@ -47,6 +47,7 @@ static struct ib_ah *create_ib_ah(struct ah->av.ib.port_pd =cpu_to_be32 (to_mpd (pd)->pdn | (ah_attr->port_num <<24 )); ah->av.ib.g_slid = ah_attr->src_path_bits; + ah->av.ib.sl_tclass_flowlabel =cpu_to_be32 (ah_attr->sl <<28 );if (ah_attr->ah_flags &IB_AH_GRH ) { ah->av.ib.g_slid |=0x80 ; ah->av.ib.gid_index = ah_attr->grh.sgid_index;
@@ -64,7 +65,6 @@ static struct ib_ah *create_ib_ah(struct !(1 << ah->av.ib.stat_rate & dev->caps.stat_rate_support)) --ah->av.ib.stat_rate; } - ah->av.ib.sl_tclass_flowlabel =cpu_to_be32 (ah_attr->sl <<28 );return &ah->ibah; }
Greg Kroah-Hartman
maintainerPATCH 14/203 powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guilherme G. Piccoli <[email protected]>
commit 8445a87f7092bc8336ea1305be9306f26b846d93 upstream.
Commit 39baadbf36ce ("powerpc/eeh: Remove eeh information from pci_dn") changed the pci_dn struct by removing its EEH-related members. As part of this clean-up, DDW mechanism was modified to read the device configuration address from eeh_dev struct.
As a consequence, now if we disable EEH mechanism on kernel command-line for example, the DDW mechanism will fail, generating a kernel oops by dereferencing a NULL pointer (which turns to be the eeh_dev pointer).
This patch just changes the configuration address calculation on DDW functions to a manual calculation based on pci_dn members instead of using eeh_dev-based address.
No functional changes were made. This was tested on pSeries, both in PHyp and qemu guest.
--- arch/powerpc/platforms/pseries/iommu.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
arch/powerpc/platforms/pseries/iommu.c +12 -12
@@ -912,7 +912,8 @@ machine_arch_initcall(pseries, find_exisstatic int query_ddw (struct pci_dev *dev,const u32 *ddw_avail,struct ddw_query_response *query) { -struct eeh_dev *edev; +struct device_node *dn; +struct pci_dn *pdn;u32 cfg_addr;u64 buid;int ret;
@@ -923,11 +924,10 @@ static int query_ddw(struct pci_dev *dev* Retrieve them from the pci device, not the node with the * dma-window property */ - edev =pci_dev_to_eeh_dev (dev); - cfg_addr = edev->config_addr; -if (edev->pe_config_addr) - cfg_addr = edev->pe_config_addr; - buid = edev->phb->buid; + dn =pci_device_to_OF_node (dev); + pdn =PCI_DN (dn); + buid = pdn->phb->buid; + cfg_addr = (pdn->busno <<8 ) | pdn->devfn; ret =rtas_call (ddw_avail[0 ],3 ,5 , (u32 *)query, cfg_addr,BUID_HI (buid),BUID_LO (buid));
@@ -941,7 +941,8 @@ static int create_ddw(struct pci_dev *de struct ddw_create_response *create, int page_shift, int window_shift) { - struct eeh_dev *edev; + struct device_node *dn; +struct pci_dn *pdn;u32 cfg_addr;u64 buid;int ret;
@@ -952,11 +953,10 @@ static int create_ddw(struct pci_dev *de* Retrieve them from the pci device, not the node with the * dma-window property */ - edev =pci_dev_to_eeh_dev (dev); - cfg_addr = edev->config_addr; -if (edev->pe_config_addr) - cfg_addr = edev->pe_config_addr; - buid = edev->phb->buid; + dn =pci_device_to_OF_node (dev); + pdn =PCI_DN (dn); + buid = pdn->phb->buid; + cfg_addr = (pdn->busno <<8 ) | pdn->devfn; do { /* extra outputs are LIOBN and dma-addr (hi, lo) */
Greg Kroah-Hartman
maintainerPATCH 15/203 powerpc/pseries: Fix PCI config address for DDW
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <[email protected]>
commit 8a934efe94347eee843aeea65bdec8077a79e259 upstream.
In commit 8445a87f7092 "powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism", the PE address was replaced with the PCI config address in order to remove dependency on EEH. According to PAPR spec, firmware (pHyp or QEMU) should accept "xxBBSSxx" format PCI config address, not "xxxxBBSS" provided by the patch. Note that "BB" is PCI bus number and "SS" is the combination of slot and function number.
This fixes the PCI address passed to DDW RTAS calls.
--- arch/powerpc/platforms/pseries/iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/platforms/pseries/iommu.c +2 -2
@@ -927,7 +927,7 @@ static int query_ddw(struct pci_dev *dev dn =pci_device_to_OF_node (dev); pdn =PCI_DN (dn); buid = pdn->phb->buid; - cfg_addr = (pdn->busno <<8 ) | pdn->devfn; + cfg_addr = ((pdn->busno <<16 ) | (pdn->devfn <<8 )); ret =rtas_call (ddw_avail[0 ],3 ,5 , (u32 *)query, cfg_addr,BUID_HI (buid),BUID_LO (buid));
@@ -956,7 +956,7 @@ static int create_ddw(struct pci_dev *de dn =pci_device_to_OF_node (dev); pdn =PCI_DN (dn); buid = pdn->phb->buid; - cfg_addr = (pdn->busno <<8 ) | pdn->devfn; + cfg_addr = ((pdn->busno <<16 ) | (pdn->devfn <<8 )); do { /* extra outputs are LIOBN and dma-addr (hi, lo) */
Greg Kroah-Hartman
maintainerPATCH 16/203 powerpc/pseries: Fix IBM_ARCH_VEC_NRCORES_OFFSET since POWER8NVL was added
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit 2c2a63e301fd19ccae673e79de59b30a232ff7f9 upstream.
The recent commit 7cc851039d64 ("powerpc/pseries: Add POWER8NVL support to ibm,client-architecture-support call") added a new PVR mask & value to the start of the ibm_architecture_vec[] array.
However it missed the fact that further down in the array, we hard code the offset of one of the fields, and then at boot use that value to patch the value in the array. This means every update to the array must also update the #define, ugh.
This means that on pseries machines we will misreport to firmware the number of cores we support, by a factor of threads_per_core.
Fix it for now by updating the #define.
--- arch/powerpc/kernel/prom_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/prom_init.c +1 -1
@@ -719,7 +719,7 @@ unsigned char ibm_architecture_vec[] = {* must match by the macro below. Update the definition if * the structure layout changes. */ -#define IBM_ARCH_VEC_NRCORES_OFFSET 125 +#define IBM_ARCH_VEC_NRCORES_OFFSET 133W (NR_CPUS ),/* number of cores supported */ 0 , 0,
Greg Kroah-Hartman
maintainerPATCH 17/203 powerpc/tm: Always reclaim in start_thread() for exec() class syscalls
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyril Bur <[email protected]>
commit 8e96a87c5431c256feb65bcfc5aec92d9f7839b6 upstream.
Userspace can quite legitimately perform an exec() syscall with a suspended transaction. exec() does not return to the old process, rather it load a new one and starts that, the expectation therefore is that the new process starts not in a transaction. Currently exec() is not treated any differently to any other syscall which creates problems.
Firstly it could allow a new process to start with a suspended transaction for a binary that no longer exists. This means that the checkpointed state won't be valid and if the suspended transaction were ever to be resumed and subsequently aborted (a possibility which is exceedingly likely as exec()ing will likely doom the transaction) the new process will jump to invalid state.
Secondly the incorrect attempt to keep the transactional state while still zeroing state for the new process creates at least two TM Bad Things. The first triggers on the rfid to return to userspace as start_thread() has given the new process a 'clean' MSR but the suspend will still be set in the hardware MSR. The second TM Bad Thing triggers in __switch_to() as the processor is still transactionally suspended but __switch_to() wants to zero the TM sprs for the new process.
This is an example of the outcome of calling exec() with a suspended transaction. Note the first 700 is likely the first TM bad thing decsribed earlier only the kernel can't report it as we've loaded userspace registers. c000000000009980 is the rfid in fast_exception_return()
Bad kernel stack pointer 3fffcfa1a370 at c000000000009980
Oops: Bad kernel stack pointer, sig: 6 [#1] CPU: 0 PID: 2006 Comm: tm-execed Not tainted NIP: c000000000009980 LR: 0000000000000000 CTR: 0000000000000000 REGS: c00000003ffefd40 TRAP: 0700 Not tainted MSR: 8000000300201031 <SF,ME,IR,DR,LE,TM[SE]> CR: 00000000 XER: 00000000 CFAR: c0000000000098b4 SOFTE: 0 PACATMSCRATCH: b00000010000d033 GPR00: 0000000000000000 00003fffcfa1a370 0000000000000000 0000000000000000 GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR12: 00003fff966611c0 0000000000000000 0000000000000000 0000000000000000 NIP [c000000000009980] fast_exception_return+0xb0/0xb8 LR [0000000000000000] (null) Call Trace: Instruction dump: f84d0278 e9a100d8 7c7b03a6 e84101a0 7c4ff120 e8410170 7c5a03a6 e8010070 e8410080 e8610088 e8810090 e8210078 <4c000024> 48000000 e8610178 88ed023b Kernel BUG at c000000000043e80 [verbose debug info unavailable] Unexpected TM Bad Thing exception at c000000000043e80 (msr 0x201033) Oops: Unrecoverable exception, sig: 6 [#2] CPU: 0 PID: 2006 Comm: tm-execed Tainted: G D task: c0000000fbea6d80 ti: c00000003ffec000 task.ti: c0000000fb7ec000 NIP: c000000000043e80 LR: c000000000015a24 CTR: 0000000000000000 REGS: c00000003ffef7e0 TRAP: 0700 Tainted: G D MSR: 8000000300201033 <SF,ME,IR,DR,RI,LE,TM[SE]> CR: 28002828 XER: 00000000 CFAR: c000000000015a20 SOFTE: 0 PACATMSCRATCH: b00000010000d033 GPR00: 0000000000000000 c00000003ffefa60 c000000000db5500 c0000000fbead000 GPR04: 8000000300001033 2222222222222222 2222222222222222 00000000ff160000 GPR08: 0000000000000000 800000010000d033 c0000000fb7e3ea0 c00000000fe00004 GPR12: 0000000000002200 c00000000fe00000 0000000000000000 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 c0000000fbea7410 00000000ff160000 GPR24: c0000000ffe1f600 c0000000fbea8700 c0000000fbea8700 c0000000fbead000 GPR28: c000000000e20198 c0000000fbea6d80 c0000000fbeab680 c0000000fbea6d80 NIP [c000000000043e80] tm_restore_sprs+0xc/0x1c LR [c000000000015a24] __switch_to+0x1f4/0x420 Call Trace: Instruction dump: 7c800164 4e800020 7c0022a6 f80304a8 7c0222a6 f80304b0 7c0122a6 f80304b8 4e800020 e80304a8 7c0023a6 e80304b0 <7c0223a6> e80304b8 7c0123a6 4e800020
This fixes CVE-2016-5828.
--- arch/powerpc/kernel/process.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/powerpc/kernel/process.c +10 -0
@@ -1501,6 +1501,16 @@ void start_thread(struct pt_regs *regs, current->thread.regs = regs -1 ; } +#ifdef CONFIG_PPC_TRANSACTIONAL_MEM +/* +* Clear any transactional state, we're exec()ing. The cause is +* not important as there will never be a recheckpoint so it's not +* user visible. +*/ +if (MSR_TM_SUSPENDED (mfmsr ())) +tm_reclaim_current (0 ); +#endif +memset (regs->gpr,0 ,sizeof (regs->gpr)); regs->ctr =0 ; regs->link =0 ;
Greg Kroah-Hartman
maintainerPATCH 18/203 usb: dwc2: fix regression on big-endian PowerPC/ARM systems
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 23e3439296a55affce3ef0ab78f1c2e03aec8767 upstream.
A patch that went into Linux-4.4 to fix big-endian mode on a Lantiq MIPS system unfortunately broke big-endian operation on PowerPC APM82181 as reported by Christian Lamparter, and likely other systems.
It actually introduced multiple issues:
- it broke big-endian ARM kernels: any machine that was working correctly with a little-endian kernel is no longer using byteswaps on big-endian kernels, which clearly breaks them.
- On PowerPC the same thing must be true: if it was working before, using big-endian kernels is now broken. Unlike ARM, 32-bit PowerPC usually uses big-endian kernels, so they are likely all broken.
- The barrier for dwc2_writel is on the wrong side of the __raw_writel(), so the MMIO no longer synchronizes with DMA operations.
- On architectures that require specific CPU instructions for MMIO access, using the __raw_ variant may turn this into a pointer dereference that does not have the same effect as the readl/writel.
This patch is a simple revert for all architectures other than MIPS, in the hope that we can more easily backport it to fix the regression on PowerPC and ARM systems without breaking the Lantiq system again.
We should follow this up with a more elaborate change to add runtime detection of endianness, to make sure it also works on all other combinations of architectures and implementations of the usb-dwc2 device. That patch however will be fairly large and not appropriate for backports to stable kernels.
Felipe suggested a different approach, using an endianness switching register to always put the device into LE mode, but unfortunately the dwc2 hardware does not provide a generic way to do that. Also, I see no practical way of addressing the problem more generally by patching architecture specific code on MIPS.
--- drivers/usb/dwc2/core.h | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
drivers/usb/dwc2/core.h +27 -0
@@ -64,6 +64,17 @@DWC2_TRACE_SCHEDULER_VB (pr_fmt ("%s: SCH: " fmt), \ dev_name(hsotg->dev), ##__VA_ARGS__) +#ifdef CONFIG_MIPS +/* +* There are some MIPS machines that can run in either big-endian +* or little-endian mode and that use the dwc2 register without +* a byteswap in both ways. +* Unlike other architectures, MIPS apparently does not require a +* barrier before the __raw_writel() to synchronize with DMA but does +* require the barrier after the __raw_writel() to serialize a set of +* writes. This set of operations was added specifically for MIPS and +* should only be used there. +*/ static inline u32 dwc2_readl (const void __iomem *addr) {u32 value =__raw_readl (addr);
@@ -90,6 +101,22 @@ static inline void dwc2_writel(u32 valuepr_info ("INFO:: wrote %08x to %p\n" , value, addr); #endif } +#else +/* Normal architectures just use readl/write */ +static inline u32 dwc2_readl (const void __iomem *addr) +{ +return readl (addr); +} + +static inline void dwc2_writel (u32 value,void __iomem *addr) +{ +writel (value, addr); + +#ifdef DWC2_LOG_WRITES +pr_info ("info:: wrote %08x to %p\n" , value, addr); +#endif +} +#endif /* Maximum number of Endpoints/HostChannels */ #define MAX_EPS_CHANNELS 16
Greg Kroah-Hartman
maintainerPATCH 19/203 USB: EHCI: declare hostpc register as zero-length array
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 7e8b3dfef16375dbfeb1f36a83eb9f27117c51fd upstream.
The HOSTPC extension registers found in some EHCI implementations form a variable-length array, with one element for each port. Therefore the hostpc field in struct ehci_regs should be declared as a zero-length array, not a single-element array.
This fixes a problem reported by UBSAN.
--- include/linux/usb/ehci_def.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/usb/ehci_def.h +2 -2
@@ -180,11 +180,11 @@ struct ehci_regs {* PORTSCx */ /* HOSTPC: offset 0x84 */ -u32 hostpc[1 ];/* HOSTPC extension */ +u32 hostpc[0 ];/* HOSTPC extension */ #define HOSTPC_PHCD (1<<22)/* Phy clock disable */ #define HOSTPC_PSPD (3<<25)/* Port speed detection */ -u32 reserved5[16 ]; +u32 reserved5[17 ];/* USBMODE_EX: offset 0xc8 */ u32 usbmode_ex;/* USB Device mode extension */
Greg Kroah-Hartman
maintainerPATCH 20/203 USB: dont free bandwidth_mutex too early
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit ab2a4bf83902c170d29ba130a8abb5f9d90559e1 upstream.
The USB core contains a bug that can show up when a USB-3 host controller is removed. If the primary (USB-2) hcd structure is released before the shared (USB-3) hcd, the core will try to do a double-free of the common bandwidth_mutex.
The problem was described in graphical form by Chung-Geol Kim, who first reported it:
=================================================
At *remove USB(3.0) Storage
sequence <1> --> <5> ((Problem Case))
=================================================
VOLD
------------------------------------|------------
(uevent)
________|_________
|<1> |
|dwc3_otg_sm_work |
|usb_put_hcd |
|peer_hcd(kref=2)|
|__________________|
________|_________
|<2> |
|New USB BUS #2 |
| |
|peer_hcd(kref=1) |
| |
--(Link)-bandXX_mutex|
| |__________________|
|
___________________ |
|<3> | |
|dwc3_otg_sm_work | |
|usb_put_hcd | |
|primary_hcd(kref=1)| |
|___________________| |
_________|_________ |
|<4> | |
|New USB BUS #1 | |
|hcd_release | |
|primary_hcd(kref=0)| |
| | |
|bandXX_mutex(free) |<-
|___________________|
(( VOLD ))
______|___________
|<5> |
| SCSI |
|usb_put_hcd |
|peer_hcd(kref=0) |
|*hcd_release |
|bandXX_mutex(free*)|<- double free
|__________________|=================================================
This happens because hcd_release() frees the bandwidth_mutex whenever it sees a primary hcd being released (which is not a very good idea in any case), but in the course of releasing the primary hcd, it changes the pointers in the shared hcd in such a way that the shared hcd will appear to be primary when it gets released.
This patch fixes the problem by changing hcd_release() so that it deallocates the bandwidth_mutex only when the _last_ hcd structure referencing it is released. The patch also removes an unnecessary test, so that when an hcd is released, both the shared_hcd and primary_hcd pointers in the hcd's peer will be cleared.
--- drivers/usb/core/hcd.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
drivers/usb/core/hcd.c +7 -10
@@ -2597,26 +2597,23 @@ EXPORT_SYMBOL_GPL(usb_create_hcd);* Don't deallocate the bandwidth_mutex until the last shared usb_hcd is * deallocated. * -* Make sure to only deallocate the bandwidth_mutex when the primary HCD is -* freed. When hcd_release() is called for either hcd in a peer set -* invalidate the peer's ->shared_hcd and ->primary_hcd pointers to -* block new peering attempts +* Make sure to deallocate the bandwidth_mutex only when the last HCD is +* freed. When hcd_release() is called for either hcd in a peer set, +* invalidate the peer's ->shared_hcd and ->primary_hcd pointers. */ static void hcd_release (struct kref *kref) { struct usb_hcd *hcd = container_of (kref, struct usb_hcd, kref);mutex_lock (&usb_port_peer_mutex); -if (usb_hcd_is_primary_hcd (hcd)) { -kfree (hcd->address0_mutex); -kfree (hcd->bandwidth_mutex); - }if (hcd->shared_hcd) {struct usb_hcd *peer = hcd->shared_hcd; peer->shared_hcd =NULL ; -if (peer->primary_hcd == hcd) - peer->primary_hcd =NULL ; + peer->primary_hcd =NULL ; + }else { +kfree (hcd->address0_mutex); +kfree (hcd->bandwidth_mutex); }mutex_unlock (&usb_port_peer_mutex);kfree (hcd);
Greg Kroah-Hartman
maintainerPATCH 21/203 usb: common: otg-fsm: add license to usb-otg-fsm
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oscar <[email protected]>
commit ea1d39a31d3b1b6060b6e83e5a29c069a124c68a upstream.
Fix warning about tainted kernel because usb-otg-fsm has no license.
WARNING: with this patch usb-otg-fsm module can be loaded but then the kernel will hang. Tested with a udoo quad board.
--- drivers/usb/common/usb-otg-fsm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/common/usb-otg-fsm.c +2 -0
@@ -21,6 +21,7 @@* 675 Mass Ave, Cambridge, MA 02139, USA. */ +#include <linux/module.h> #include <linux/kernel.h> #include <linux/types.h> #include <linux/mutex.h>
@@ -452,3 +453,4 @@ int otg_statemachine(struct otg_fsm *fsmreturn state_changed; }EXPORT_SYMBOL_GPL (otg_statemachine); +MODULE_LICENSE ("GPL" );
Greg Kroah-Hartman
maintainerPATCH 22/203 mnt: fs_fully_visible test the proper mount for MNT_LOCKED
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit d71ed6c930ac7d8f88f3cef6624a7e826392d61f upstream.
MNT_LOCKED implies on a child mount implies the child is locked to the parent. So while looping through the children the children should be tested (not their parent).
Typically an unshare of a mount namespace locks all mounts together making both the parent and the slave as locked but there are a few corner cases where other things work.
--- fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/namespace.c +1 -1
@@ -3271,7 +3271,7 @@ static bool fs_fully_visible(struct filelist_for_each_entry (child, &mnt->mnt_mounts, mnt_child) {struct inode *inode = child->mnt_mountpoint->d_inode;/* Only worry about locked mounts */ -if (!(mnt_flags &MNT_LOCKED )) +if (!(child->mnt.mnt_flags &MNT_LOCKED ))continue ;/* Is the directory permanetly empty? */ if (!is_empty_dir_inode (inode))
Greg Kroah-Hartman
maintainerPATCH 23/203 mnt: Account for MS_RDONLY in fs_fully_visible
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit 695e9df010e40f407f4830dc11d53dce957710ba upstream.
In rare cases it is possible for s_flags & MS_RDONLY to be set but MNT_READONLY to be clear. This starting combination can cause fs_fully_visible to fail to ensure that the new mount is readonly. Therefore force MNT_LOCK_READONLY in the new mount if MS_RDONLY is set on the source filesystem of the mount.
In general both MS_RDONLY and MNT_READONLY are set at the same for mounts so I don't expect any programs to care. Nor do I expect MS_RDONLY to be set on proc or sysfs in the initial user namespace, which further decreases the likelyhood of problems.
Which means this change should only affect system configurations by paranoid sysadmins who should welcome the additional protection as it keeps people from wriggling out of their policies.
--- fs/namespace.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/namespace.c +4 -0
@@ -3245,6 +3245,10 @@ static bool fs_fully_visible(struct fileif (mnt->mnt.mnt_sb->s_iflags &SB_I_NOEXEC ) mnt_flags &= ~(MNT_LOCK_NOSUID |MNT_LOCK_NOEXEC ); +/* Don't miss readonly hidden in the superblock flags */ +if (mnt->mnt.mnt_sb->s_flags &MS_RDONLY ) + mnt_flags |=MNT_LOCK_READONLY ; +/* Verify the mount flags are equal to or more permissive * than the proposed new mount. */
Greg Kroah-Hartman
maintainerPATCH 24/203 mnt: If fs_fully_visible fails call put_filesystem.
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit 97c1df3e54e811aed484a036a798b4b25d002ecf upstream.
Add this trivial missing error handling.
--- fs/namespace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/namespace.c +3 -1
@@ -2409,8 +2409,10 @@ static int do_new_mount(struct path *pat mnt_flags |=MNT_NODEV |MNT_LOCK_NODEV ; }if (type->fs_flags &FS_USERNS_VISIBLE ) { -if (!fs_fully_visible (type, &mnt_flags)) +if (!fs_fully_visible (type, &mnt_flags)) { +put_filesystem (type);return -EPERM ; + } } }
Greg Kroah-Hartman
maintainerPATCH 25/203 of: fix autoloading due to broken modalias with no compatible
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
commit b3c0a4dab7e35a9b6d69c0415641d2280fdefb2b upstream.
Because of an improper dereference, a stray 'C' character was output to the modalias when no 'compatible' was specified. This is the case for some old PowerMac drivers which only set the 'name' property. Fix it to let them match again.
--- scripts/mod/file2alias.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/mod/file2alias.c +1 -1
@@ -384,7 +384,7 @@ static void do_of_entry_multi(void *symv len =sprintf (alias,"of:N%sT%s" , (*name)[0 ] ? *name :"*" , (*type)[0 ] ? *type :"*" ); -if (compatible[0 ]) +if ((*compatible)[0 ])sprintf (&alias[len],"%sC%s" , (*type)[0 ] ?"*" :"" , *compatible);
Greg Kroah-Hartman
maintainerPATCH 26/203 of: irq: fix of_irq_get[_byname]() kernel-doc
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit 3993546646baf1dab5f5c4f7d9bb58f2046fd1c1 upstream.
The kernel-doc for the of_irq_get[_byname]() is clearly inadequate in describing the return values -- of_irq_get_byname() is documented better than of_irq_get() but it still doesn't mention that 0 is returned iff irq_create_of_mapping() fails (it doesn't return an error code in this case). Document all possible return value variants, making the writing of the word "IRQ" consistent, while at it...
--- drivers/of/irq.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/of/irq.c +10 -9
@@ -386,13 +386,13 @@ int of_irq_to_resource(struct device_nodEXPORT_SYMBOL_GPL (of_irq_to_resource);/** -* of_irq_get - Decode a node's IRQ and return it as a Linux irq number +* of_irq_get - Decode a node's IRQ and return it as a Linux IRQ number * @dev: pointer to device tree node -* @index: zero-based index of the irq -* -* Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain -* is not yet created. +* @index: zero-based index of the IRQ * +* Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or +* -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case +* of any other failure. */ int of_irq_get (struct device_node *dev,int index) {
@@ -413,12 +413,13 @@ int of_irq_get(struct device_node *dev,EXPORT_SYMBOL_GPL (of_irq_get);/** -* of_irq_get_byname - Decode a node's IRQ and return it as a Linux irq number +* of_irq_get_byname - Decode a node's IRQ and return it as a Linux IRQ number * @dev: pointer to device tree node -* @name: irq name +* @name: IRQ name * -* Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain -* is not yet created, or error code in case of any other failure. +* Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or +* -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case +* of any other failure. */ int of_irq_get_byname (struct device_node *dev,const char *name) {
Greg Kroah-Hartman
maintainerPATCH 27/203 x86/msr: Use the proper trace point conditional for writes
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dr. David Alan Gilbert <[email protected]>
commit 08dd8cd06ed95625b9e2fac43c78fcb45b7eaf94 upstream.
The msr tracing for writes is incorrectly conditional on the read trace.
--- arch/x86/include/asm/msr.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/include/asm/msr.h +2 -2
@@ -112,7 +112,7 @@ static inline void native_write_msr(unsi unsigned low, unsigned high) { asmvolatile ("wrmsr" : :"c" (msr),"a" (low),"d" (high) :"memory" ); -if (msr_tracepoint_active (__tracepoint_read_msr)) +if (msr_tracepoint_active (__tracepoint_write_msr))do_trace_write_msr (msr, ((u64 )high <<32 | low),0 ); }
@@ -131,7 +131,7 @@ notrace static inline int native_write_m : "c" (msr), "0" (low), "d" (high), [fault] "i" (-EIO) : "memory"); -if (msr_tracepoint_active (__tracepoint_read_msr)) +if (msr_tracepoint_active (__tracepoint_write_msr))do_trace_write_msr (msr, ((u64 )high <<32 | low), err);return err; }
Greg Kroah-Hartman
maintainerPATCH 28/203 locking/ww_mutex: Report recursive ww_mutex locking early
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
commit 0422e83d84ae24b933e4b0d4c1e0f0b4ae8a0a3b upstream.
Recursive locking for ww_mutexes was originally conceived as an exception. However, it is heavily used by the DRM atomic modesetting code. Currently, the recursive deadlock is checked after we have queued up for a busy-spin and as we never release the lock, we spin until kicked, whereupon the deadlock is discovered and reported.
A simple solution for the now common problem is to move the recursive deadlock discovery to the first action when taking the ww_mutex.
--- kernel/locking/mutex.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
kernel/locking/mutex.c +6 -3
@@ -486,9 +486,6 @@ __ww_mutex_lock_check_stamp(struct mutexif (!hold_ctx)return 0 ; -if (unlikely (ctx == hold_ctx)) -return -EALREADY ; -if (ctx->stamp - hold_ctx->stamp <=LONG_MAX && (ctx->stamp != hold_ctx->stamp || ctx > hold_ctx)) {#ifdef CONFIG_DEBUG_MUTEXES
@@ -514,6 +511,12 @@ __mutex_lock_common(struct mutex *lock,unsigned long flags;int ret; +if (use_ww_ctx) { + struct ww_mutex *ww = container_of(lock, struct ww_mutex, base); +if (unlikely (ww_ctx ==READ_ONCE (ww->ctx))) +return -EALREADY ; + } +preempt_disable ();mutex_acquire_nest (&lock->dep_map, subclass,0 , nest_lock, ip);
Greg Kroah-Hartman
maintainerPATCH 29/203 locking/qspinlock: Fix spin_unlock_wait() some more
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 2c610022711675ee908b903d242f0b90e1db661f upstream.
While this prior commit:
54cf809b9512 ("locking,qspinlock: Fix spin_is_locked() and spin_unlock_wait()")
... fixes spin_is_locked() and spin_unlock_wait() for the usage in ipc/sem and netfilter, it does not in fact work right for the usage in task_work and futex.
So while the 2 locks crossed problem:
spin_lock(A) spin_lock(B) if (!spin_is_locked(B)) spin_unlock_wait(A) foo() foo();
... works with the smp_mb() injected by both spin_is_locked() and spin_unlock_wait(), this is not sufficient for:
flag = 1; smp_mb(); spin_lock() spin_unlock_wait() if (!flag) // add to lockless list // iterate lockless list
... because in this scenario, the store from spin_lock() can be delayed past the load of flag, uncrossing the variables and loosing the guarantee.
This patch reworks spin_is_locked() and spin_unlock_wait() to work in both cases by exploiting the observation that while the lock byte store can be delayed, the contender must have registered itself visibly in other state contained in the word.
It also allows for architectures to override both functions, as PPC and ARM64 have an additional issue for which we currently have no generic solution.
--- include/asm-generic/qspinlock.h | 53 +++++++++++------------------------ kernel/locking/qspinlock.c | 60 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 77 insertions(+), 36 deletions(-)
include/asm-generic/qspinlock.h +17 -36
@@ -22,37 +22,33 @@#include <asm-generic/qspinlock_types.h> /** +* queued_spin_unlock_wait - wait until the _current_ lock holder releases the lock +* @lock : Pointer to queued spinlock structure +* +* There is a very slight possibility of live-lock if the lockers keep coming +* and the waiter is just unfortunate enough to not see any unlock state. +*/ +#ifndef queued_spin_unlock_wait +extern void queued_spin_unlock_wait (struct qspinlock *lock); +#endif + +/** * queued_spin_is_locked - is the spinlock locked? * @lock: Pointer to queued spinlock structure * Return: 1 if it is locked, 0 otherwise */ +#ifndef queued_spin_is_locked static __always_inline int queued_spin_is_locked(struct qspinlock *lock) {/* -* queued_spin_lock_slowpath() can ACQUIRE the lock before -* issuing the unordered store that sets _Q_LOCKED_VAL. -* -* See both smp_cond_acquire() sites for more detail. -* -* This however means that in code like: -* -* spin_lock(A) spin_lock(B) -* spin_unlock_wait(B) spin_is_locked(A) -* do_something() do_something() -* -* Both CPUs can end up running do_something() because the store -* setting _Q_LOCKED_VAL will pass through the loads in -* spin_unlock_wait() and/or spin_is_locked(). +* See queued_spin_unlock_wait(). * -* Avoid this by issuing a full memory barrier between the spin_lock() -* and the loads in spin_unlock_wait() and spin_is_locked(). -* -* Note that regular mutual exclusion doesn't care about this -* delayed store. +* Any !0 state indicates it is locked, even if _Q_LOCKED_VAL +* isn't immediately observable. */ -smp_mb (); -return atomic_read (&lock->val) & _Q_LOCKED_MASK; +return atomic_read (&lock->val); } +#endif /** * queued_spin_value_unlocked - is the spinlock structure unlocked?
@@ -122,21 +118,6 @@ static __always_inline void queued_spin_ }#endif -/** -* queued_spin_unlock_wait - wait until current lock holder releases the lock -* @lock : Pointer to queued spinlock structure -* -* There is a very slight possibility of live-lock if the lockers keep coming -* and the waiter is just unfortunate enough to not see any unlock state. -*/ -static inline void queued_spin_unlock_wait (struct qspinlock *lock) -{ -/* See queued_spin_is_locked() */ -smp_mb (); -while (atomic_read (&lock->val) & _Q_LOCKED_MASK) -cpu_relax (); -} -#ifndef virt_spin_lock static __always_inline bool virt_spin_lock(struct qspinlock *lock) {
kernel/locking/qspinlock.c +60 -0
66 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 30/203 locking/static_key: Fix concurrent static_key_slow_inc()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 4c5ea0a9cd02d6aa8adc86e100b2a4cff8d614ff upstream.
The following scenario is possible:
CPU 1 CPU 2
static_key_slow_inc()
atomic_inc_not_zero()
-> key.enabled == 0, no increment
jump_label_lock()
atomic_inc_return()
-> key.enabled == 1 now
static_key_slow_inc()
atomic_inc_not_zero()
-> key.enabled == 1, inc to 2
return
** static key is wrong!
jump_label_update()
jump_label_unlock()Testing the static key at the point marked by (**) will follow the wrong path for jumps that have not been patched yet. This can actually happen when creating many KVM virtual machines with userspace LAPIC emulation; just run several copies of the following program:
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <linux/kvm.h>
int main(void)
{
for (;;) {
int kvmfd = open("/dev/kvm", O_RDONLY);
int vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
close(ioctl(vmfd, KVM_CREATE_VCPU, 1));
close(vmfd);
close(kvmfd);
}
return 0;
}Every KVM_CREATE_VCPU ioctl will attempt a static_key_slow_inc() call. The static key's purpose is to skip NULL pointer checks and indeed one of the processes eventually dereferences NULL.
As explained in the commit that introduced the bug:
706249c222f6 ("locking/static_keys: Rework update logic")
jump_label_update() needs key.enabled to be true. The solution adopted here is to temporarily make key.enabled == -1, and use go down the slow path when key.enabled <= 0.
--- include/linux/jump_label.h | 16 +++++++++++++--- kernel/jump_label.c | 36 +++++++++++++++++++++++++++++++++--- 2 files changed, 46 insertions(+), 6 deletions(-)
include/linux/jump_label.h +13 -3
@@ -117,13 +117,18 @@ struct module;#include <linux/atomic.h> +#ifdef HAVE_JUMP_LABEL +static inline int static_key_count (struct static_key *key) { -return atomic_read (&key->enabled); +/* +* -1 means the first static_key_slow_inc() is in progress. +* static_key_enabled() must return true, so return 1 here. +*/ +int n =atomic_read (&key->enabled); +return n >=0 ? n :1 ; } -#ifdef HAVE_JUMP_LABEL -#define JUMP_TYPE_FALSE 0UL#define JUMP_TYPE_TRUE 1UL#define JUMP_TYPE_MASK 1UL
@@ -162,6 +167,11 @@ extern void jump_label_apply_nops(struct#else /* !HAVE_JUMP_LABEL */ +static inline int static_key_count (struct static_key *key) +{ +return atomic_read (&key->enabled); +} + static __always_inline void jump_label_init(void) { static_key_initialized = true;
kernel/jump_label.c +33 -3
@@ -58,13 +58,36 @@ static void jump_label_update(struct stavoid static_key_slow_inc (struct static_key *key) { +int v, v1; +STATIC_KEY_CHECK_USE (); -if (atomic_inc_not_zero (&key->enabled)) -return ; + +/* +* Careful if we get concurrent static_key_slow_inc() calls; +* later calls must wait for the first one to _finish_ the +* jump_label_update() process. At the same time, however, +* the jump_label_update() call below wants to see +* static_key_enabled(&key) for jumps to be updated properly. +* +* So give a special meaning to negative key->enabled: it sends +* static_key_slow_inc() down the slow path, and it is non-zero +* so it counts as "enabled" in jump_label_update(). Note that +* atomic_inc_unless_negative() checks >= 0, so roll our own. +*/ +for (v =atomic_read (&key->enabled); v >0 ; v = v1) { + v1 =atomic_cmpxchg (&key->enabled, v, v +1 ); +if (likely (v1 == v)) +return ; + }jump_label_lock (); -if (atomic_inc_return (&key->enabled) ==1 ) +if (atomic_read (&key->enabled) ==0 ) { +atomic_set (&key->enabled,-1 );jump_label_update (key); +atomic_set (&key->enabled,1 ); + }else { +atomic_inc (&key->enabled); + }jump_label_unlock (); }EXPORT_SYMBOL_GPL (static_key_slow_inc);
@@ -72,6 +95,13 @@ EXPORT_SYMBOL_GPL(static_key_slow_inc);static void __static_key_slow_dec (struct static_key *key,unsigned long rate_limit,struct delayed_work *work) { +/* +* The negative count check is valid even when a negative +* key->enabled is in use by static_key_slow_inc(); a +* __static_key_slow_dec() before the first static_key_slow_inc() +* returns is unbalanced, because all other static_key_slow_inc() +* instances block while the update is in progress. +*/ if (!atomic_dec_and_mutex_lock (&key->enabled, &jump_label_mutex)) {WARN (atomic_read (&key->enabled) <0 ,"jump label: negative count!\n" );
Greg Kroah-Hartman
maintainerPATCH 31/203 cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit 9bd616e3dbedfc103f158197c8ad93678849b1ed upstream.
The cpuidle_devices per-CPU variable is only defined when CPU_IDLE is enabled. Commit c8cc7d4de7a4 ("sched/idle: Reorganize the idle loop") removed the #ifdef CONFIG_CPU_IDLE around cpuidle_idle_call() with the compiler optimising away __this_cpu_read(cpuidle_devices). However, with CONFIG_UBSAN && !CONFIG_CPU_IDLE, this optimisation no longer happens and the kernel fails to link since cpuidle_devices is not defined.
This patch introduces an accessor function for the current CPU cpuidle device (returning NULL when !CONFIG_CPU_IDLE) and uses it in cpuidle_idle_call().
--- include/linux/cpuidle.h | 3 +++ kernel/sched/idle.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)
include/linux/cpuidle.h +3 -0
@@ -152,6 +152,8 @@ extern void cpuidle_disable_device(strucextern int cpuidle_play_dead (void );extern struct cpuidle_driver *cpuidle_get_cpu_driver (struct cpuidle_device *dev); +static inline struct cpuidle_device *cpuidle_get_device (void ) +{return __this_cpu_read (cpuidle_devices); }#else static inline void disable_cpuidle (void ) { } static inline bool cpuidle_not_available(struct cpuidle_driver *drv,
@@ -187,6 +189,7 @@ static inline void cpuidle_disable_devicstatic inline int cpuidle_play_dead (void ) {return -ENODEV ; }static inline struct cpuidle_driver *cpuidle_get_cpu_driver (struct cpuidle_device *dev) {return NULL ; } +static inline struct cpuidle_device *cpuidle_get_device (void ) {return NULL ; }#endif #if defined(CONFIG_CPU_IDLE ) && defined(CONFIG_SUSPEND )
kernel/sched/idle.c +1 -1
@@ -127,7 +127,7 @@ static int call_cpuidle(struct cpuidle_d*/ static void cpuidle_idle_call (void ) { -struct cpuidle_device *dev =__this_cpu_read (cpuidle_devices); +struct cpuidle_device *dev =cpuidle_get_device ();struct cpuidle_driver *drv =cpuidle_get_cpu_driver (dev);int next_state, entered_state;
Greg Kroah-Hartman
maintainerPATCH 32/203 x86, build: copy ldlinux.c32 to image.iso
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: H. Peter Anvin <[email protected]>
commit 9c77679cadb118c0aa99e6f88533d91765a131ba upstream.
For newer versions of Syslinux, we need ldlinux.c32 in addition to isolinux.bin to reside on the boot disk, so if the latter is found, copy it, too, to the isoimage tree.
--- arch/x86/boot/Makefile | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/boot/Makefile +3 -0
@@ -171,6 +171,9 @@ isoimage: $(obj)/bzImage for i in lib lib64 share end ; do \ if [ -f /usr/$$i/syslinux/isolinux.bin ] ; then \ cp /usr/$$i/syslinux/isolinux.bin $(obj)/isoimage ; \ + if [ -f /usr/$$i/syslinux/ldlinux.c32 ]; then \ + cp /usr/$$i/syslinux/ldlinux.c32 $(obj)/isoimage ; \ + fi ; \ break ; \ fi ; \ if [ $$i = end ] ; then exit 1 ; fi ; \
Greg Kroah-Hartman
maintainerPATCH 33/203 kprobes/x86: Clear TF bit in fault on single-stepping
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <[email protected]>
commit dcfc47248d3f7d28df6f531e6426b933de94370d upstream.
Fix kprobe_fault_handler() to clear the TF (trap flag) bit of the flags register in the case of a fault fixup on single-stepping.
If we put a kprobe on the instruction which caused a page fault (e.g. actual mov instructions in copy_user_*), that fault happens on the single-stepping buffer. In this case, kprobes resets running instance so that the CPU can retry execution on the original ip address.
However, current code forgets to reset the TF bit. Since this fault happens with TF bit set for enabling single-stepping, when it retries, it causes a debug exception and kprobes can not handle it because it already reset itself.
On the most of x86-64 platform, it can be easily reproduced by using kprobe tracer. E.g.
# cd /sys/kernel/debug/tracing # echo p copy_user_enhanced_fast_string+5 > kprobe_events # echo 1 > events/kprobes/enable
And you'll see a kernel panic on do_debug(), since the debug trap is not handled by kprobes.
To fix this problem, we just need to clear the TF bit when resetting running kprobe.
--- arch/x86/kernel/kprobes/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/x86/kernel/kprobes/core.c +12 -0
@@ -960,7 +960,19 @@ int kprobe_fault_handler(struct pt_regs* normal page fault. */ regs->ip = (unsigned long )cur->addr; +/* +* Trap flag (TF) has been set here because this fault +* happened where the single stepping will be done. +* So clear it by resetting the current kprobe: +*/ + regs->flags &= ~X86_EFLAGS_TF ; + +/* +* If the TF flag was set before the kprobe hit, +* don't touch it: +*/ regs->flags |= kcb->kprobe_old_flags; +if (kcb->kprobe_status ==KPROBE_REENTER )restore_previous_kprobe (kcb);else
Greg Kroah-Hartman
maintainerPATCH 35/203 x86/amd_nb: Fix boot crash on non-AMD systems
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <[email protected]>
commit 1ead852dd88779eda12cb09cc894a03d9abfe1ec upstream.
Fix boot crash that triggers if this driver is built into a kernel and run on non-AMD systems.
AMD northbridges users call amd_cache_northbridges() and it returns a negative value to signal that we weren't able to cache/detect any northbridges on the system.
At least, it should do so as all its callers expect it to do so. But it does return a negative value only when kmalloc() fails.
Fix it to return -ENODEV if there are no NBs cached as otherwise, amd_nb users like amd64_edac, for example, which relies on it to know whether it should load or not, gets loaded on systems like Intel Xeons where it shouldn't.
--- arch/x86/kernel/amd_nb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/amd_nb.c +2 -2
@@ -71,8 +71,8 @@ int amd_cache_northbridges(void)while ((misc =next_northbridge (misc, amd_nb_misc_ids)) !=NULL ) i++; -if (i ==0 ) -return 0 ; +if (!i) +return -ENODEV ; nb =kzalloc (i *sizeof (struct amd_northbridge ),GFP_KERNEL );if (!nb)
Greg Kroah-Hartman
maintainerPATCH 36/203 perf/x86: Fix 32-bit perf user callgraph collection
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
commit fc18822510721fe694d273c5211c71ea52796d76 upstream.
A basic perf callgraph record operation causes an immediate panic on a 32-bit kernel compiled with CONFIG_CC_STACKPROTECTOR=y:
$ perf record -g ls Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: c0404fbd
CPU: 0 PID: 998 Comm: ls Not tainted 4.7.0-rc5+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.1-1.fc24 04/01/2014 c0dd5967 ff7afe1c 00000086 f41dbc2c c07445a0 464c457f f41dbca8 f41dbc44 c05646f4 f41dbca8 464c457f f41dbca8 464c457f f41dbc54 c04625be c0ce56fc c0404fbd f41dbc88 c0404fbd b74668f0 f41dc000 00000000 c0000000 00000000 Call Trace: [<c07445a0>] dump_stack+0x58/0x78 [<c05646f4>] panic+0x8e/0x1c6 [<c04625be>] __stack_chk_fail+0x1e/0x30 [<c0404fbd>] ? perf_callchain_user+0x22d/0x230 [<c0404fbd>] perf_callchain_user+0x22d/0x230 [<c055f89f>] get_perf_callchain+0x1ff/0x270 [<c055f988>] perf_callchain+0x78/0x90 [<c055c7eb>] perf_prepare_sample+0x24b/0x370 [<c055c934>] perf_event_output_forward+0x24/0x70 [<c05531c0>] __perf_event_overflow+0xa0/0x210 [<c0550a93>] ? cpu_clock_event_read+0x43/0x50 [<c0553431>] perf_swevent_hrtimer+0x101/0x180 [<c0456235>] ? kmap_atomic_prot+0x35/0x140 [<c056dc69>] ? get_page_from_freelist+0x279/0x950 [<c058fdd8>] ? vma_interval_tree_remove+0x158/0x230 [<c05939f4>] ? wp_page_copy.isra.82+0x2f4/0x630 [<c05a050d>] ? page_add_file_rmap+0x1d/0x50 [<c0565611>] ? unlock_page+0x61/0x80 [<c0566755>] ? filemap_map_pages+0x305/0x320 [<c059769f>] ? handle_mm_fault+0xb7f/0x1560 [<c074cbeb>] ? timerqueue_del+0x1b/0x70 [<c04cfefe>] ? __remove_hrtimer+0x2e/0x60 [<c04d017b>] __hrtimer_run_queues+0xcb/0x2a0 [<c0553330>] ? __perf_event_overflow+0x210/0x210 [<c04d0a2a>] hrtimer_interrupt+0x8a/0x180 [<c043ecc2>] local_apic_timer_interrupt+0x32/0x60 [<c043f643>] smp_apic_timer_interrupt+0x33/0x50 [<c0b0cd38>] apic_timer_interrupt+0x34/0x3c Kernel Offset: disabled ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: c0404fbd
The panic is caused by the fact that perf_callchain_user() mistakenly assumes it's 64-bit only and ends up corrupting the stack.
--- arch/x86/events/core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
arch/x86/events/core.c +6 -5
@@ -2313,7 +2313,7 @@ void perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs) { struct stack_frame frame; -const void __user *fp; +const unsigned long __user *fp;if (perf_guest_cbs && perf_guest_cbs->is_in_guest ()) {/* TODO: We don't support guest os callchain now */
@@ -2326,7 +2326,7 @@ perf_callchain_user(struct perf_callchaiif (regs->flags & (X86_VM_MASK |PERF_EFLAGS_VM ))return ; - fp = (void __user *)regs->bp; + fp = (unsigned long __user *)regs->bp;perf_callchain_store (entry, regs->ip);
@@ -2339,16 +2339,17 @@ perf_callchain_user(struct perf_callchaipagefault_disable ();while (entry->nr <PERF_MAX_STACK_DEPTH ) {unsigned long bytes; + frame.next_frame =NULL ; frame.return_address =0 ; -if (!access_ok (VERIFY_READ , fp,16 )) +if (!access_ok (VERIFY_READ , fp,sizeof (*fp) *2 ))break ; - bytes =__copy_from_user_nmi (&frame.next_frame, fp,8 ); + bytes =__copy_from_user_nmi (&frame.next_frame, fp,sizeof (*fp));if (bytes !=0 )break ; - bytes =__copy_from_user_nmi (&frame.return_address, fp+8 ,8 ); + bytes =__copy_from_user_nmi (&frame.return_address, fp +1 ,sizeof (*fp));if (bytes !=0 )break ;
Greg Kroah-Hartman
maintainerPATCH 37/203 extcon: palmas: Fix boot up state of VBUS when using GPIO detection
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit 62e6d1e59c77316768a663d1328390b4cd33801f upstream.
If USB cable is connected prior to boot, we don't get any interrupts so we must manually check the VBUS state and report it during probe. If we don't do it then USB controller will never know that peripheral cable was connected till the user unplugs and replugs the cable.
--- drivers/extcon/extcon-palmas.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/extcon/extcon-palmas.c +2 -0
@@ -360,6 +360,8 @@ static int palmas_usb_probe(struct platfpalmas_enable_irq (palmas_usb);/* perform initial detection */ +if (palmas_usb->enable_gpio_vbus_detection) +palmas_vbus_irq_handler (palmas_usb->gpio_vbus_irq, palmas_usb);palmas_gpio_id_detect (&palmas_usb->wq_detectid.work);device_set_wakeup_capable (&pdev->dev, true);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 38/203 gpio: make library immune to error pointers
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit c0a1ecb9f4e208f4b75d88fa9669748e3fd705ab upstream.
Most functions that take a GPIO descriptor in need to check the descriptor for IS_ERR(). We do this mostly in the VALIDATE_DESC() macro except for the gpiod_to_irq() function which needs special handling.
--- drivers/gpio/gpiolib.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/gpio/gpiolib.c +11 -3
@@ -1345,8 +1345,12 @@ done:#define VALIDATE_DESC (desc) do { \ if (!desc) \ return 0; \ + if (IS_ERR(desc)) { \ + pr_warn("%s: invalid GPIO (errorpointer)\n", __func__); \ + return PTR_ERR(desc); \ + } \ if (!desc->gdev) { \ - pr_warn("%s: invalid GPIO\n", __func__); \ + pr_warn("%s: invalid GPIO (no device)\n", __func__); \ return -EINVAL; \ } \ if ( !desc->gdev->chip ) { \
@@ -1358,8 +1362,12 @@ done:#define VALIDATE_DESC_VOID (desc) do { \ if (!desc) \ return; \ + if (IS_ERR(desc)) { \ + pr_warn("%s: invalid GPIO (errorpointer)\n", __func__); \ + return; \ + } \ if (!desc->gdev) { \ - pr_warn("%s: invalid GPIO\n", __func__); \ + pr_warn("%s: invalid GPIO (no device)\n", __func__); \ return; \ } \ if (!desc->gdev->chip) { \
@@ -2011,7 +2019,7 @@ int gpiod_to_irq(const struct gpio_desc* requires this function to not return zero on an invalid descriptor * but rather a negative error number. */ -if (!desc || !desc->gdev || !desc->gdev->chip) +if (!desc ||IS_ERR (desc) || !desc->gdev || !desc->gdev->chip)return -EINVAL ; chip = desc->gdev->chip;
Greg Kroah-Hartman
maintainerPATCH 39/203 gpio: sch: Fix Oops on module load on Asus Eee PC 1201
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Pitrat <[email protected]>
commit 87041a58d3b19455d39baed2a5e5bb43b58fb915 upstream.
This fixes the issue descirbe in bug 117531
(https://bugzilla.kernel.org/show_bug.cgi?id=117531).
It's a regression introduced in linux 4.5 that causes a Oops at load of gpio_sch and prevents powering off the computer.
The issue is that sch_gpio_reg_set is called in sch_gpio_probe before gpio_chip data is initialized with the pointer to the sch_gpio struct. As sch_gpio_reg_set calls gpiochip_get_data, it returns NULL which causes the Oops.
The patch follows Mika's advice (https://lkml.org/lkml/2016/5/9/61) and consists in modifying sch_gpio_reg_get and sch_gpio_reg_set to take a sch_gpio struct directly instead of a gpio_chip, which avoids the call to gpiochip_get_data.
Thanks Mika for your patience with me :-)
--- drivers/gpio/gpio-sch.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
drivers/gpio/gpio-sch.c +10 -11
@@ -61,9 +61,8 @@ static unsigned sch_gpio_bit(struct sch_return gpio %8 ; } -static int sch_gpio_reg_get (struct gpio_chip *gc,unsigned gpio,unsigned reg) +static int sch_gpio_reg_get (struct sch_gpio *sch,unsigned gpio,unsigned reg) { -struct sch_gpio *sch =gpiochip_get_data (gc);unsigned short offset, bit;u8 reg_val;
@@ -75,10 +74,9 @@ static int sch_gpio_reg_get(struct gpio_return reg_val; } -static void sch_gpio_reg_set (struct gpio_chip *gc,unsigned gpio,unsigned reg, +static void sch_gpio_reg_set (struct sch_gpio *sch,unsigned gpio,unsigned reg,int val) { -struct sch_gpio *sch =gpiochip_get_data (gc);unsigned short offset, bit;u8 reg_val;
@@ -98,14 +96,15 @@ static int sch_gpio_direction_in(structstruct sch_gpio *sch =gpiochip_get_data (gc);spin_lock (&sch->lock); -sch_gpio_reg_set (gc, gpio_num,GIO ,1 ); +sch_gpio_reg_set (sch, gpio_num,GIO ,1 );spin_unlock (&sch->lock);return 0 ; }static int sch_gpio_get (struct gpio_chip *gc,unsigned gpio_num) { -return sch_gpio_reg_get (gc, gpio_num,GLV ); +struct sch_gpio *sch =gpiochip_get_data (gc); +return sch_gpio_reg_get (sch, gpio_num,GLV ); }static void sch_gpio_set (struct gpio_chip *gc,unsigned gpio_num,int val)
@@ -113,7 +112,7 @@ static void sch_gpio_set(struct gpio_chistruct sch_gpio *sch =gpiochip_get_data (gc);spin_lock (&sch->lock); -sch_gpio_reg_set (gc, gpio_num,GLV , val); +sch_gpio_reg_set (sch, gpio_num,GLV , val);spin_unlock (&sch->lock); }
@@ -123,7 +122,7 @@ static int sch_gpio_direction_out(structstruct sch_gpio *sch =gpiochip_get_data (gc);spin_lock (&sch->lock); -sch_gpio_reg_set (gc, gpio_num,GIO ,0 ); +sch_gpio_reg_set (sch, gpio_num,GIO ,0 );spin_unlock (&sch->lock);/*
@@ -182,13 +181,13 @@ static int sch_gpio_probe(struct platfor* GPIO7 is configured by the CMC as SLPIOVR * Enable GPIO[9:8] core powered gpios explicitly */ -sch_gpio_reg_set (&sch->chip,8 ,GEN ,1 ); -sch_gpio_reg_set (&sch->chip,9 ,GEN ,1 ); +sch_gpio_reg_set (sch,8 ,GEN ,1 ); +sch_gpio_reg_set (sch,9 ,GEN ,1 );/* * SUS_GPIO[2:0] enabled by default * Enable SUS_GPIO3 resume powered gpio explicitly */ -sch_gpio_reg_set (&sch->chip,13 ,GEN ,1 ); +sch_gpio_reg_set (sch,13 ,GEN ,1 );break ;case PCI_DEVICE_ID_INTEL_ITC_LPC :
Greg Kroah-Hartman
maintainerPATCH 40/203 Revert "gpiolib: Split GPIO flags parsing and GPIO configuration"
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 85b03b3033fd4eba82665b3b9902c095a08cc52f upstream.
This reverts commit 923b93e451db876d1479d3e4458fce14fec31d1c.
Make sure consumers do not overwrite gpio flags for pins that have already been claimed.
While adding support for gpio drivers to refuse a request using unsupported flags, the order of when the requested flag was checked and the new flags were applied was reversed to that consumers could overwrite flags for already requested gpios.
This not only affects device-tree setups where two drivers could request the same gpio using conflicting configurations, but also allowed user space to clear gpio flags for already claimed pins simply by attempting to export them through the sysfs interface. By for example clearing the FLAG_ACTIVE_LOW flag this way, user space could effectively change the polarity of a signal.
Reverting this change obviously prevents gpio drivers from doing sanity checks on the flags in their request callbacks. Fortunately only one recently added driver (gpio-tps65218 in v4.6) appears to do this, and a follow up patch could restore this functionality through a different interface.
--- drivers/gpio/gpiolib-legacy.c | 8 +++--- drivers/gpio/gpiolib.c | 52 ++++++++++++------------------------------ 2 files changed, 20 insertions(+), 40 deletions(-)
drivers/gpio/gpiolib-legacy.c +4 -4
@@ -28,6 +28,10 @@ int gpio_request_one(unsigned gpio, unsiif (!desc &&gpio_is_valid (gpio))return -EPROBE_DEFER ; + err =gpiod_request (desc, label); +if (err) +return err; +if (flags &GPIOF_OPEN_DRAIN )set_bit (FLAG_OPEN_DRAIN , &desc->flags);
@@ -37,10 +41,6 @@ int gpio_request_one(unsigned gpio, unsiif (flags &GPIOF_ACTIVE_LOW )set_bit (FLAG_ACTIVE_LOW , &desc->flags); - err =gpiod_request (desc, label); -if (err) -return err; -if (flags &GPIOF_DIR_IN ) err =gpiod_direction_input (desc);else
drivers/gpio/gpiolib.c +16 -36
112 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 41/203 autofs braino fix for do_last()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit e6ec03a25f12b312b7e0c037fe4a6471c4ee5665 upstream.
It's an analogue of commit 7500c38a (fix the braino in "namei:
massage lookup_slow() to be usable by lookup_one_len_unlocked()"). The same problem (->lookup()-returned unhashed negative dentry just might be an autofs one with ->d_manage() that would wait until the daemon makes it positive) applies in do_last() - we need to do follow_managed() first.
Fortunately, remaining callers of follow_managed() are OK - only autofs has that weirdness (negative dentry that does not mean an instant -ENOENT)) and autofs never has its negative dentries hashed, so we can't pick one from a dcache lookup.
->d_manage() is a bloody mess ;-/
--- fs/namei.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/namei.c +4 -4
@@ -3173,6 +3173,10 @@ retry_lookup: got_write = false; } + error =follow_managed (&path, nd); +if (unlikely (error <0 )) +return error; +if (unlikely (d_is_negative (path.dentry))) {path_to_nameidata (&path, nd);return -ENOENT ;
@@ -3188,10 +3192,6 @@ retry_lookup:return -EEXIST ; } - error =follow_managed (&path, nd); -if (unlikely (error <0 )) -return error; - seq =0 ;/* out of RCU mode, so the value doesn't matter */ inode =d_backing_inode (path.dentry); finish_lookup:
Greg Kroah-Hartman
maintainerPATCH 42/203 rtlwifi: Fix scheduling while atomic error from commit 49f86ec21c01
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit de26859dcf363d520cc44e59f6dcaf20ebe0aadf upstream.
Commit 49f86ec21c01 ("rtlwifi: Change long delays to sleeps") was correct for most cases; however, driver rtl8192ce calls the affected routines while in atomic context. The kernel bug output is as follows:
BUG: scheduling while atomic: wpa_supplicant/627/0x00000002 [...] [<ffffffff815c2b39>] __schedule+0x899/0xad0 [<ffffffff815c2dac>] schedule+0x3c/0x90 [<ffffffff815c5bb2>] schedule_hrtimeout_range_clock+0xa2/0x120 [<ffffffff810e8b80>] ? hrtimer_init+0x120/0x120 [<ffffffff815c5ba6>] ? schedule_hrtimeout_range_clock+0x96/0x120 [<ffffffff815c5c43>] schedule_hrtimeout_range+0x13/0x20 [<ffffffff815c568f>] usleep_range+0x4f/0x70 [<ffffffffa0667218>] rtl_rfreg_delay+0x38/0x50 [rtlwifi] [<ffffffffa06dd0e7>] rtl92c_phy_config_rf_with_headerfile+0xc7/0xe0 [rtl8192ce]
To fix this bug, three of the changes from delay to sleep are reverted. Unfortunately, one of the changes involves a delay of 50 msec. The calling code will be modified so that this long delay can be avoided; however, this change is being pushed now to fix the problem in kernel 4.6.0.
--- drivers/net/wireless/realtek/rtlwifi/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/realtek/rtlwifi/core.c +3 -3
@@ -54,7 +54,7 @@ EXPORT_SYMBOL(channel5g_80m);void rtl_addr_delay (u32 addr) {if (addr ==0xfe ) -msleep (50 ); +mdelay (50 );else if (addr ==0xfd )msleep (5 );else if (addr ==0xfc )
@@ -75,7 +75,7 @@ void rtl_rfreg_delay(struct ieee80211_hwrtl_addr_delay (addr); }else {rtl_set_rfreg (hw, rfpath, addr, mask, data); -usleep_range (1 ,2 ); +udelay (1 ); } }EXPORT_SYMBOL (rtl_rfreg_delay);
@@ -86,7 +86,7 @@ void rtl_bb_delay(struct ieee80211_hw *hrtl_addr_delay (addr); }else {rtl_set_bbreg (hw, addr,MASKDWORD , data); -usleep_range (1 ,2 ); +udelay (1 ); } }EXPORT_SYMBOL (rtl_bb_delay);
Greg Kroah-Hartman
maintainerPATCH 43/203 uvc: Forward compat ioctls to their handlers directly
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit a44323e2a8f342848bb77e8e04fcd85fcb91b3b4 upstream.
The current code goes through a lot of indirection just to call a known handler. Simplify it: just call the handlers directly.
--- drivers/media/usb/uvc/uvc_v4l2.c | 39 ++++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 21 deletions(-)
drivers/media/usb/uvc/uvc_v4l2.c +18 -21
@@ -1408,47 +1408,44 @@ static int uvc_v4l2_put_xu_query(const sstatic long uvc_v4l2_compat_ioctl32 (struct file *file,unsigned int cmd,unsigned long arg) { +struct uvc_fh *handle = file->private_data;union {struct uvc_xu_control_mapping xmap;struct uvc_xu_control_query xqry; } karg;void __user *up =compat_ptr (arg); -mm_segment_t old_fs;long ret;switch (cmd) {case UVCIOC_CTRL_MAP32 : - cmd =UVCIOC_CTRL_MAP ; ret =uvc_v4l2_get_xu_mapping (&karg.xmap, up); +if (ret) +return ret; + ret =uvc_ioctl_ctrl_map (handle->chain, &karg.xmap); +if (ret) +return ret; + ret =uvc_v4l2_put_xu_mapping (&karg.xmap, up); +if (ret) +return ret; +break ;case UVCIOC_CTRL_QUERY32 : - cmd =UVCIOC_CTRL_QUERY ; ret =uvc_v4l2_get_xu_query (&karg.xqry, up); +if (ret) +return ret; + ret =uvc_xu_ctrl_query (handle->chain, &karg.xqry); +if (ret) +return ret; + ret =uvc_v4l2_put_xu_query (&karg.xqry, up); +if (ret) +return ret;break ;default :return -ENOIOCTLCMD ; } - old_fs =get_fs (); -set_fs (KERNEL_DS ); - ret =video_ioctl2 (file, cmd, (unsigned long )&karg); -set_fs (old_fs); - -if (ret <0 ) -return ret; - -switch (cmd) { -case UVCIOC_CTRL_MAP : - ret =uvc_v4l2_put_xu_mapping (&karg.xmap, up); -break ; - -case UVCIOC_CTRL_QUERY : - ret =uvc_v4l2_put_xu_query (&karg.xqry, up); -break ; - } -return ret; }#endif
Greg Kroah-Hartman
maintainerPATCH 44/203 thermal: cpu_cooling: fix improper order during initialization
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Luba <[email protected]>
commit f840ab18bdf2e415dac21d09fbbbd2873111bd48 upstream.
The freq_table array is not populated before calling thermal_of_cooling_register. The code which populates the freq table was introduced in commit f6859014.
This should be done before registering new thermal cooling device. The log shows effects of this wrong decision.
[ 2.172614] cpu cpu1: Failed to get voltage for frequency 1984518656000: -34 [ 2.220863] cpu cpu0: Failed to get voltage for frequency 1984524416000: -34
--- drivers/thermal/cpu_cooling.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/thermal/cpu_cooling.c +8 -8
@@ -857,14 +857,6 @@ __cpufreq_cooling_register(struct device goto free_power_table; } -snprintf (dev_name,sizeof (dev_name),"thermal-cpufreq-%d" , - cpufreq_dev->id); - - cool_dev =thermal_of_cooling_device_register (np, dev_name, cpufreq_dev, - &cpufreq_cooling_ops); -if (IS_ERR (cool_dev)) - goto remove_idr; -/* Fill freq-table in descending order of frequencies */ for (i =0 , freq =-1 ; i <= cpufreq_dev->max_level; i++) { freq =find_next_max (table, freq);
@@ -877,6 +869,14 @@ __cpufreq_cooling_register(struct devicepr_debug ("%s: freq:%u KHz\n" , __func__, freq); } +snprintf (dev_name,sizeof (dev_name),"thermal-cpufreq-%d" , + cpufreq_dev->id); + + cool_dev =thermal_of_cooling_device_register (np, dev_name, cpufreq_dev, + &cpufreq_cooling_ops); +if (IS_ERR (cool_dev)) + goto remove_idr; + cpufreq_dev->clipped_freq = cpufreq_dev->freq_table[0 ]; cpufreq_dev->cool_dev = cool_dev;
Greg Kroah-Hartman
maintainerPATCH 45/203 writeback: use higher precision calculation in domain_dirty_limits()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 62a584fe05eef1f80ed49a286a29328f1a224fb9 upstream.
As vm.dirty_[background_]bytes can't be applied verbatim to multiple cgroup writeback domains, they get converted to percentages in domain_dirty_limits() and applied the same way as vm.dirty_[background]ratio. However, if the specified bytes is lower than 1% of available memory, the calculated ratios become zero and the writeback domain gets throttled constantly.
Fix it by using per-PAGE_SIZE instead of percentage for ratio calculations. Also, the updated DIV_ROUND_UP() usages now should yield 1/4096 (0.0244%) as the minimum ratio as long as the specified bytes are above zero.
Adjusted comment based on Jan's suggestion.
--- mm/page-writeback.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
mm/page-writeback.c +12 -9
@@ -369,8 +369,9 @@ static void domain_dirty_limits(struct dstruct dirty_throttle_control *gdtc =mdtc_gdtc (dtc);unsigned long bytes = vm_dirty_bytes;unsigned long bg_bytes = dirty_background_bytes; -unsigned long ratio = vm_dirty_ratio; -unsigned long bg_ratio = dirty_background_ratio; +/* convert ratios to per-PAGE_SIZE for higher precision */ +unsigned long ratio = (vm_dirty_ratio *PAGE_SIZE ) /100 ; +unsigned long bg_ratio = (dirty_background_ratio *PAGE_SIZE ) /100 ;unsigned long thresh;unsigned long bg_thresh;struct task_struct *tsk;
@@ -382,26 +383,28 @@ static void domain_dirty_limits(struct d/* * The byte settings can't be applied directly to memcg * domains. Convert them to ratios by scaling against -* globally available memory. +* globally available memory. As the ratios are in +* per-PAGE_SIZE, they can be obtained by dividing bytes by +* number of pages. */ if (bytes) - ratio =min (DIV_ROUND_UP (bytes,PAGE_SIZE ) *100 / - global_avail,100UL ); + ratio =min (DIV_ROUND_UP (bytes, global_avail), +PAGE_SIZE );if (bg_bytes) - bg_ratio =min (DIV_ROUND_UP (bg_bytes,PAGE_SIZE ) *100 / - global_avail,100UL ); + bg_ratio =min (DIV_ROUND_UP (bg_bytes, global_avail), +PAGE_SIZE ); bytes = bg_bytes =0 ; }if (bytes) thresh =DIV_ROUND_UP (bytes,PAGE_SIZE );else - thresh = (ratio * available_memory) /100 ; + thresh = (ratio * available_memory) /PAGE_SIZE ;if (bg_bytes) bg_thresh =DIV_ROUND_UP (bg_bytes,PAGE_SIZE );else - bg_thresh = (bg_ratio * available_memory) /100 ; + bg_thresh = (bg_ratio * available_memory) /PAGE_SIZE ;if (bg_thresh >= thresh) bg_thresh = thresh /2 ;
Greg Kroah-Hartman
maintainerPATCH 46/203 sd: Fix rw_max for devices that report an optimal xfer size
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin K. Petersen <[email protected]>
commit 6b7e9cde49691e04314342b7dce90c67ad567fcc upstream.
For historic reasons, io_opt is in bytes and max_sectors in block layer sectors. This interface inconsistency is error prone and should be fixed. But for 4.4--4.7 let's make the unit difference explicit via a wrapper function.
--- drivers/scsi/sd.c | 8 ++++---- drivers/scsi/sd.h | 5 +++++ 2 files changed, 9 insertions(+), 4 deletions(-)
drivers/scsi/sd.c +4 -4
@@ -2862,10 +2862,10 @@ static int sd_revalidate_disk(struct genif (sdkp->opt_xfer_blocks && sdkp->opt_xfer_blocks <= dev_max && sdkp->opt_xfer_blocks <=SD_DEF_XFER_BLOCKS && - sdkp->opt_xfer_blocks * sdp->sector_size >=PAGE_SIZE ) - rw_max = q->limits.io_opt = - sdkp->opt_xfer_blocks * sdp->sector_size; -else +logical_to_bytes (sdp, sdkp->opt_xfer_blocks) >=PAGE_SIZE ) { + q->limits.io_opt =logical_to_bytes (sdp, sdkp->opt_xfer_blocks); + rw_max =logical_to_sectors (sdp, sdkp->opt_xfer_blocks); + }else rw_max =BLK_DEF_MAX_SECTORS ;/* Combine with controller limits */
drivers/scsi/sd.h +5 -0
@@ -151,6 +151,11 @@ static inline sector_t logical_to_sectorreturn blocks << (ilog2 (sdev->sector_size) -9 ); } +static inline unsigned int logical_to_bytes (struct scsi_device *sdev,sector_t blocks) +{ +return blocks * sdev->sector_size; +} +/* * A DIF-capable target device can be formatted with different * protection schemes. Currently 0 through 3 are defined:
Greg Kroah-Hartman
maintainerPATCH 47/203 nfsd4/rpc: move backchannel create logic into rpc code
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Bruce Fields <[email protected]>
commit d50039ea5ee63c589b0434baa5ecf6e5075bb6f9 upstream.
Also simplify the logic a bit.
--- fs/nfsd/nfs4callback.c | 18 +----------------- include/linux/sunrpc/clnt.h | 2 -- net/sunrpc/clnt.c | 12 ++++++++++-- 3 files changed, 11 insertions(+), 21 deletions(-)
fs/nfsd/nfs4callback.c +1 -17
@@ -710,22 +710,6 @@ static struct rpc_cred *get_backchannel_ } } -static struct rpc_clnt *create_backchannel_client (struct rpc_create_args *args) -{ -struct rpc_xprt *xprt; - -if (args->protocol !=XPRT_TRANSPORT_BC_TCP ) -return rpc_create (args); - - xprt = args->bc_xprt->xpt_bc_xprt; -if (xprt) { -xprt_get (xprt); -return rpc_create_xprt (args, xprt); - } - -return rpc_create (args); -} -static int setup_callback_client (struct nfs4_client *clp,struct nfs4_cb_conn *conn,struct nfsd4_session *ses) {int maxtime =max_cb_time (clp->net);
@@ -768,7 +752,7 @@ static int setup_callback_client(struct args.authflavor = ses->se_cb_sec.flavor; }/* Create RPC client */ - client =create_backchannel_client (&args); + client =rpc_create (&args);if (IS_ERR (client)) {dprintk ("NFSD: couldn't create callback client: %ld\n" ,PTR_ERR (client));
include/linux/sunrpc/clnt.h +0 -2
@@ -137,8 +137,6 @@ struct rpc_create_args {#define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9)struct rpc_clnt *rpc_create (struct rpc_create_args *args); -struct rpc_clnt *rpc_create_xprt (struct rpc_create_args *args, -struct rpc_xprt *xprt);struct rpc_clnt *rpc_bind_new_program (struct rpc_clnt *,const struct rpc_program *,u32 );struct rpc_clnt *rpc_clone_client (struct rpc_clnt *);
net/sunrpc/clnt.c +10 -2
@@ -446,7 +446,7 @@ out_no_rpciod:return ERR_PTR (err); } -struct rpc_clnt *rpc_create_xprt (struct rpc_create_args *args, +static struct rpc_clnt *rpc_create_xprt (struct rpc_create_args *args,struct rpc_xprt *xprt) {struct rpc_clnt *clnt =NULL ;
@@ -483,7 +483,6 @@ struct rpc_clnt *rpc_create_xprt(structreturn clnt; } -EXPORT_SYMBOL_GPL (rpc_create_xprt);/** * rpc_create - create an RPC client and transport with one call
@@ -509,6 +508,15 @@ struct rpc_clnt *rpc_create(struct rpc_c };char servername[48 ]; +if (args->bc_xprt) { +WARN_ON (args->protocol !=XPRT_TRANSPORT_BC_TCP ); + xprt = args->bc_xprt->xpt_bc_xprt; +if (xprt) { +xprt_get (xprt); +return rpc_create_xprt (args, xprt); + } + } +if (args->flags &RPC_CLNT_CREATE_INFINITE_SLOTS ) xprtargs.flags |=XPRT_CREATE_INFINITE_SLOTS ;if (args->flags &RPC_CLNT_CREATE_NO_IDLE_TIMEOUT )
Greg Kroah-Hartman
maintainerPATCH 48/203 nfsd: Always lock state exclusively.
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Drokin <[email protected]>
commit feb9dad5209280085d5b0c094fa67e7a8d75c81a upstream.
It used to be the case that state had an rwlock that was locked for write by downgrades, but for read for upgrades (opens). Well, the problem is if there are two competing opens for the same state, they step on each other toes potentially leading to leaking file descriptors from the state structure, since access mode is a bitmap only set once.
--- fs/nfsd/nfs4state.c | 40 ++++++++++++++++++++-------------------- fs/nfsd/state.h | 2 +- 2 files changed, 21 insertions(+), 21 deletions(-)
fs/nfsd/nfs4state.c +20 -20
@@ -3502,7 +3502,7 @@ init_open_stateid(struct nfs4_ol_stateid stp->st_access_bmap =0 ; stp->st_deny_bmap =0 ; stp->st_openstp =NULL ; -init_rwsem (&stp->st_rwsem); +mutex_init (&stp->st_mutex);list_add (&stp->st_perstateowner, &oo->oo_owner.so_stateids);list_add (&stp->st_perfile, &fp->fi_stateids);
@@ -4335,10 +4335,10 @@ nfsd4_process_open2(struct svc_rqst *rqs*/ if (stp) {/* Stateid was found, this is an OPEN upgrade */ -down_read (&stp->st_rwsem); +mutex_lock (&stp->st_mutex); status =nfs4_upgrade_open (rqstp, fp, current_fh, stp, open);if (status) { -up_read (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex); goto out; } }else {
@@ -4348,19 +4348,19 @@ nfsd4_process_open2(struct svc_rqst *rqsif (swapstp) {nfs4_put_stid (&stp->st_stid); stp = swapstp; -down_read (&stp->st_rwsem); +mutex_lock (&stp->st_mutex); status =nfs4_upgrade_open (rqstp, fp, current_fh, stp, open);if (status) { -up_read (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex); goto out; } goto upgrade_out; } -down_read (&stp->st_rwsem); +mutex_lock (&stp->st_mutex); status =nfs4_get_vfs_file (rqstp, fp, current_fh, stp, open);if (status) { -up_read (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex);release_open_stateid (stp); goto out; }
@@ -4372,7 +4372,7 @@ nfsd4_process_open2(struct svc_rqst *rqs } upgrade_out:nfs4_inc_and_copy_stateid (&open->op_stateid, &stp->st_stid); -up_read (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex);if (nfsd4_has_session (&resp->cstate)) {if (open->op_deleg_want &NFS4_SHARE_WANT_NO_DELEG ) {
@@ -4983,12 +4983,12 @@ static __be32 nfs4_seqid_op_checks(struc* revoked delegations are kept only for free_stateid. */ return nfserr_bad_stateid; -down_write (&stp->st_rwsem); +mutex_lock (&stp->st_mutex); status =check_stateid_generation (stateid, &stp->st_stid.sc_stateid,nfsd4_has_session (cstate));if (status == nfs_ok) status =nfs4_check_fh (current_fh, &stp->st_stid);if (status != nfs_ok) -up_write (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex);return status; }
@@ -5036,7 +5036,7 @@ static __be32 nfs4_preprocess_confirmed_return status; oo =openowner (stp->st_stateowner);if (!(oo->oo_flags &NFS4_OO_CONFIRMED )) { -up_write (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex);nfs4_put_stid (&stp->st_stid);return nfserr_bad_stateid; }
@@ -5068,12 +5068,12 @@ nfsd4_open_confirm(struct svc_rqst *rqst oo =openowner (stp->st_stateowner); status = nfserr_bad_stateid;if (oo->oo_flags &NFS4_OO_CONFIRMED ) { -up_write (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex); goto put_stateid; } oo->oo_flags |=NFS4_OO_CONFIRMED ;nfs4_inc_and_copy_stateid (&oc->oc_resp_stateid, &stp->st_stid); -up_write (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex);dprintk ("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n" , __func__, oc->oc_seqid,STATEID_VAL (&stp->st_stid.sc_stateid));
@@ -5149,7 +5149,7 @@ nfsd4_open_downgrade(struct svc_rqst *rqnfs4_inc_and_copy_stateid (&od->od_stateid, &stp->st_stid); status = nfs_ok; put_stateid: -up_write (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex);nfs4_put_stid (&stp->st_stid); out:nfsd4_bump_seqid (cstate, status);
@@ -5202,7 +5202,7 @@ nfsd4_close(struct svc_rqst *rqstp, struif (status) goto out;nfs4_inc_and_copy_stateid (&close->cl_stateid, &stp->st_stid); -up_write (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex);nfsd4_close_open_stateid (stp);
@@ -5428,7 +5428,7 @@ init_lock_stateid(struct nfs4_ol_stateid stp->st_access_bmap =0 ; stp->st_deny_bmap = open_stp->st_deny_bmap; stp->st_openstp = open_stp; -init_rwsem (&stp->st_rwsem); +mutex_init (&stp->st_mutex);list_add (&stp->st_locks, &open_stp->st_locks);list_add (&stp->st_perstateowner, &lo->lo_owner.so_stateids);spin_lock (&fp->fi_lock);
@@ -5597,7 +5597,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struc &open_stp, nn);if (status) goto out; -up_write (&open_stp->st_rwsem); +mutex_unlock (&open_stp->st_mutex); open_sop =openowner (open_stp->st_stateowner); status = nfserr_bad_stateid; if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
@@ -5606,7 +5606,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struc status =lookup_or_create_lock_state (cstate, open_stp, lock, &lock_stp, &new);if (status == nfs_ok) -down_write (&lock_stp->st_rwsem); +mutex_lock (&lock_stp->st_mutex); }else { status = nfs4_preprocess_seqid_op(cstate, lock->lk_old_lock_seqid,
@@ -5710,7 +5710,7 @@ out: seqid_mutating_err(ntohl(status))) lock_sop->lo_owner.so_seqid++; -up_write (&lock_stp->st_rwsem); +mutex_unlock (&lock_stp->st_mutex);/* * If this is a new, never-before-used stateid, and we are
@@ -5880,7 +5880,7 @@ nfsd4_locku(struct svc_rqst *rqstp, stru fput:fput (filp); put_stateid: -up_write (&stp->st_rwsem); +mutex_unlock (&stp->st_mutex);nfs4_put_stid (&stp->st_stid); out:nfsd4_bump_seqid (cstate, status);
fs/nfsd/state.h +1 -1
@@ -535,7 +535,7 @@ struct nfs4_ol_stateid {unsigned char st_access_bmap;unsigned char st_deny_bmap;struct nfs4_ol_stateid *st_openstp; -struct rw_semaphore st_rwsem; +struct mutex st_mutex; };static inline struct nfs4_ol_stateid *openlockstateid (struct nfs4_stid *s)
Greg Kroah-Hartman
maintainerPATCH 49/203 nfsd: Extend the mutex holding region around in nfsd4_process_open2()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Drokin <[email protected]>
commit 5cc1fb2a093e254b656c64ff24b0b76bed1d34d9 upstream.
To avoid racing entry into nfs4_get_vfs_file().
Make init_open_stateid() return with locked stateid to be unlocked by the caller.
--- fs/nfsd/nfs4state.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
fs/nfsd/nfs4state.c +13 -3
@@ -3487,6 +3487,10 @@ init_open_stateid(struct nfs4_ol_stateidstruct nfs4_openowner *oo = open->op_openowner;struct nfs4_ol_stateid *retstp =NULL ; +/* We are moving these outside of the spinlocks to avoid the warnings */ +mutex_init (&stp->st_mutex); +mutex_lock (&stp->st_mutex); +spin_lock (&oo->oo_owner.so_client->cl_lock);spin_lock (&fp->fi_lock);
@@ -3502,13 +3506,17 @@ init_open_stateid(struct nfs4_ol_stateid stp->st_access_bmap =0 ; stp->st_deny_bmap =0 ; stp->st_openstp =NULL ; -mutex_init (&stp->st_mutex);list_add (&stp->st_perstateowner, &oo->oo_owner.so_stateids);list_add (&stp->st_perfile, &fp->fi_stateids); out_unlock:spin_unlock (&fp->fi_lock);spin_unlock (&oo->oo_owner.so_client->cl_lock); +if (retstp) { +mutex_lock (&retstp->st_mutex); +/* Not that we need to, just for neatness */ +mutex_unlock (&stp->st_mutex); + }return retstp; }
@@ -4344,11 +4352,14 @@ nfsd4_process_open2(struct svc_rqst *rqs }else { stp = open->op_stp; open->op_stp =NULL ; +/* +* init_open_stateid() either returns a locked stateid +* it found, or initializes and locks the new one we passed in +*/ swapstp =init_open_stateid (stp, fp, open);if (swapstp) {nfs4_put_stid (&stp->st_stid); stp = swapstp; -mutex_lock (&stp->st_mutex); status =nfs4_upgrade_open (rqstp, fp, current_fh, stp, open);if (status) {
@@ -4357,7 +4368,6 @@ nfsd4_process_open2(struct svc_rqst *rqs } goto upgrade_out; } -mutex_lock (&stp->st_mutex); status =nfs4_get_vfs_file (rqstp, fp, current_fh, stp, open);if (status) {mutex_unlock (&stp->st_mutex);
Greg Kroah-Hartman
maintainerPATCH 50/203 posix_acl: Add set_posix_acl
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
commit 485e71e8fb6356c08c7fc6bcce4bf02c9a9a663f upstream.
Factor out part of posix_acl_xattr_set into a common function that takes a posix_acl, which nfsd can also call.
The prototype already exists in include/linux/posix_acl.h.
--- fs/posix_acl.c | 42 +++++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 19 deletions(-)
fs/posix_acl.c +23 -19
@@ -786,39 +786,43 @@ posix_acl_xattr_get(const struct xattr_hreturn error; } -static int -posix_acl_xattr_set (const struct xattr_handler *handler, -struct dentry *dentry,const char *name, -const void *value,size_t size,int flags) +int +set_posix_acl (struct inode *inode,int type,struct posix_acl *acl) { -struct inode *inode =d_backing_inode (dentry); -struct posix_acl *acl =NULL ; -int ret; -if (!IS_POSIXACL (inode))return -EOPNOTSUPP ;if (!inode->i_op->set_acl)return -EOPNOTSUPP ; -if (handler->flags ==ACL_TYPE_DEFAULT && !S_ISDIR (inode->i_mode)) -return value ? -EACCES :0 ; +if (type ==ACL_TYPE_DEFAULT && !S_ISDIR (inode->i_mode)) +return acl ? -EACCES :0 ;if (!inode_owner_or_capable (inode))return -EPERM ; +if (acl) { +int ret =posix_acl_valid (acl); +if (ret) +return ret; + } +return inode->i_op->set_acl (inode, acl, type); +} +EXPORT_SYMBOL (set_posix_acl); + +static int +posix_acl_xattr_set (const struct xattr_handler *handler, +struct dentry *dentry,const char *name, +const void *value,size_t size,int flags) +{ +struct inode *inode =d_backing_inode (dentry); +struct posix_acl *acl =NULL ; +int ret; +if (value) { acl =posix_acl_from_xattr (&init_user_ns, value, size);if (IS_ERR (acl))return PTR_ERR (acl); - -if (acl) { - ret =posix_acl_valid (acl); -if (ret) - goto out; - } } - - ret = inode->i_op->set_acl (inode, acl, handler->flags); -out: + ret =set_posix_acl (inode, handler->flags, acl);posix_acl_release (acl);return ret; }
Greg Kroah-Hartman
maintainerPATCH 51/203 nfsd: check permissions when setting ACLs
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit 999653786df6954a31044528ac3f7a5dadca08f4 upstream.
Use set_posix_acl, which includes proper permission checks, instead of calling ->set_acl directly. Without this anyone may be able to grant themselves permissions to a file by setting the ACL.
Lock the inode to make the new checks atomic with respect to set_acl. (Also, nfsd was the only caller of set_acl not locking the inode, so I suspect this may fix other races.)
This also simplifies the code, and ensures our ACLs are checked by posix_acl_valid.
The permission checks and the inode locking were lost with commit 4ac7249e, which changed nfsd to use the set_acl inode operation directly instead of going through xattr handlers.
--- fs/nfsd/nfs2acl.c | 20 ++++++++++---------- fs/nfsd/nfs3acl.c | 16 +++++++--------- fs/nfsd/nfs4acl.c | 16 ++++++++-------- 3 files changed, 25 insertions(+), 27 deletions(-)
fs/nfsd/nfs2acl.c +10 -10
@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct goto out; inode =d_inode (fh->fh_dentry); -if (!IS_POSIXACL (inode) || !inode->i_op->set_acl) { - error = -EOPNOTSUPP ; - goto out_errno; - } error =fh_want_write (fh);if (error) goto out_errno; - error = inode->i_op->set_acl (inode, argp->acl_access,ACL_TYPE_ACCESS ); +fh_lock (fh); + + error =set_posix_acl (inode,ACL_TYPE_ACCESS , argp->acl_access);if (error) - goto out_drop_write; - error = inode->i_op->set_acl (inode, argp->acl_default, -ACL_TYPE_DEFAULT ); + goto out_drop_lock; + error =set_posix_acl (inode,ACL_TYPE_DEFAULT , argp->acl_default);if (error) - goto out_drop_write; + goto out_drop_lock; + +fh_unlock (fh);fh_drop_write (fh);
@@ -131,7 +130,8 @@ out:posix_acl_release (argp->acl_access);posix_acl_release (argp->acl_default);return nfserr; -out_drop_write: +out_drop_lock: +fh_unlock (fh);fh_drop_write (fh); out_errno: nfserr =nfserrno (error);
fs/nfsd/nfs3acl.c +7 -9
@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct s goto out; inode =d_inode (fh->fh_dentry); -if (!IS_POSIXACL (inode) || !inode->i_op->set_acl) { - error = -EOPNOTSUPP ; - goto out_errno; - } error =fh_want_write (fh);if (error) goto out_errno; - error = inode->i_op->set_acl (inode, argp->acl_access,ACL_TYPE_ACCESS ); +fh_lock (fh); + + error =set_posix_acl (inode,ACL_TYPE_ACCESS , argp->acl_access);if (error) - goto out_drop_write; - error = inode->i_op->set_acl (inode, argp->acl_default, -ACL_TYPE_DEFAULT ); + goto out_drop_lock; + error =set_posix_acl (inode,ACL_TYPE_DEFAULT , argp->acl_default); -out_drop_write: +out_drop_lock: +fh_unlock (fh);fh_drop_write (fh); out_errno: nfserr =nfserrno (error);
fs/nfsd/nfs4acl.c +8 -8
@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqst dentry = fhp->fh_dentry; inode =d_inode (dentry); -if (!inode->i_op->set_acl || !IS_POSIXACL (inode)) -return nfserr_attrnotsupp; -if (S_ISDIR (inode->i_mode)) flags =NFS4_ACL_DIR ;
@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstif (host_error <0 ) goto out_nfserr; - host_error = inode->i_op->set_acl (inode, pacl,ACL_TYPE_ACCESS ); +fh_lock (fhp); + + host_error =set_posix_acl (inode,ACL_TYPE_ACCESS , pacl);if (host_error <0 ) - goto out_release; + goto out_drop_lock;if (S_ISDIR (inode->i_mode)) { - host_error = inode->i_op->set_acl (inode, dpacl, -ACL_TYPE_DEFAULT ); + host_error =set_posix_acl (inode,ACL_TYPE_DEFAULT , dpacl); } -out_release: +out_drop_lock: +fh_unlock (fhp); +posix_acl_release (pacl);posix_acl_release (dpacl); out_nfserr:
Greg Kroah-Hartman
maintainerPATCH 52/203 pnfs_nfs: fix _cancel_empty_pagelist
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit 5e3a98883e7ebdd1440f829a9e9dd5c3d2c5903b upstream.
pnfs_generic_commit_cancel_empty_pagelist calls nfs_commitdata_release, but that is wrong: nfs_commitdata_release puts the open context, something that isn't valid until nfs_init_commit is called, which is never the case when pnfs_generic_commit_cancel_empty_pagelist is called.
This was introduced in "nfs: avoid race that crashes nfs_init_commit".
--- fs/nfs/pnfs_nfs.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
fs/nfs/pnfs_nfs.c +10 -2
@@ -247,7 +247,11 @@ void pnfs_fetch_commit_bucket_list(struc }/* Helper function for pnfs_generic_commit_pagelist to catch an empty -* page list. This can happen when two commits race. */ +* page list. This can happen when two commits race. +* +* This must be called instead of nfs_init_commit - call one or the other, but +* not both! +*/ static bool pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages, struct nfs_commit_data *data,
@@ -256,7 +260,11 @@ pnfs_generic_commit_cancel_empty_pagelisif (list_empty (pages)) {if (atomic_dec_and_test (&cinfo->mds->rpcs_out))wake_up_atomic_t (&cinfo->mds->rpcs_out); -nfs_commitdata_release (data); +/* don't call nfs_commitdata_release - it tries to put +* the open_context which is not acquired until nfs_init_commit +* which has not been called on @data */ +WARN_ON_ONCE (data->context); +nfs_commit_free (data);return true; }
Greg Kroah-Hartman
maintainerPATCH 53/203 NFS: Fix a double page unlock
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit cbebaf897e5c4862567eb799dc84acc5d7ee2678 upstream.
Since commit 0bcbf039f6b2, nfs_readpage_release() has been used to unlock the page in the read code.
--- fs/nfs/read.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfs/read.c +2 -2
@@ -367,13 +367,13 @@ readpage_async_filler(void *data, structnfs_list_remove_request (new);nfs_readpage_release (new); error = desc->pgio->pg_error; - goto out_unlock; + goto out; }return 0 ; out_error: error =PTR_ERR (new); -out_unlock:unlock_page (page); +out:return error; }
Greg Kroah-Hartman
maintainerPATCH 54/203 make nfs_atomic_open() call d_drop() on all ->open_context() errors.
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit d20cb71dbf3487f24549ede1a8e2d67579b4632e upstream.
In "NFSv4: Move dentry instantiation into the NFSv4-specific atomic open code" unconditional d_drop() after the ->open_context() had been removed. It had been correct for success cases (there ->open_context() itself had been doing dcache manipulations), but not for error ones. Only one of those (ENOENT) got a compensatory d_drop() added in that commit, but in fact it should've been done for all errors. As it is, the case of O_CREAT non-exclusive open on a hashed negative dentry racing with e.g. symlink creation from another client ended up with ->open_context() getting an error and proceeding to call nfs_lookup(). On a hashed dentry, which would've instantly triggered BUG_ON() in d_materialise_unique() (or, these days, its equivalent in d_splice_alias()).
--- fs/nfs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/dir.c +1 -1
@@ -1527,9 +1527,9 @@ int nfs_atomic_open(struct inode *dir, s err =PTR_ERR (inode);trace_nfs_atomic_open_exit (dir, ctx, open_flags, err);put_nfs_open_context (ctx); +d_drop (dentry);switch (err) {case -ENOENT : -d_drop (dentry);d_add (dentry,NULL );nfs_set_verifier (dentry,nfs_save_change_attribute (dir));break ;
Greg Kroah-Hartman
maintainerPATCH 55/203 NFS: Fix another OPEN_DOWNGRADE bug
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit e547f2628327fec6afd2e03b46f113f614cca05b upstream.
Olga Kornievskaia reports that the following test fails to trigger an OPEN_DOWNGRADE on the wire, and only triggers the final CLOSE.
fd0 = open(foo, RDRW) -- should be open on the wire for "both"
fd1 = open(foo, RDONLY) -- should be open on the wire for "read" close(fd0) -- should trigger an open_downgrade read(fd1)
close(fd1)
The issue is that we're missing a check for whether or not the current state transitioned from an O_RDWR state as opposed to having transitioned from a combination of O_RDONLY and O_WRONLY.
--- fs/nfs/nfs4proc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/nfs/nfs4proc.c +2 -3
@@ -2860,12 +2860,11 @@ static void nfs4_close_prepare(struct rp call_close |= is_wronly; else if (is_wronly) calldata->arg.fmode |= FMODE_WRITE; + if (calldata->arg.fmode != (FMODE_READ|FMODE_WRITE)) + call_close |= is_rdwr; }else if (is_rdwr) calldata->arg.fmode |=FMODE_READ |FMODE_WRITE ; -if (calldata->arg.fmode ==0 ) - call_close |= is_rdwr; -if (!nfs4_valid_open_stateid (state)) call_close =0 ;spin_unlock (&state->owner->so_lock);
Greg Kroah-Hartman
maintainerPATCH 56/203 SUNRPC: fix xprt leak on xps allocation failure
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Bruce Fields <[email protected]>
commit 1208fd569c07ab84aa5d024abd863267c2953b4a upstream.
Callers of rpc_create_xprt expect it to put the xprt on success and failure.
--- net/sunrpc/clnt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/sunrpc/clnt.c +3 -2
@@ -453,9 +453,10 @@ static struct rpc_clnt *rpc_create_xprt(struct rpc_xprt_switch *xps; xps =xprt_switch_alloc (xprt,GFP_KERNEL ); -if (xps ==NULL ) +if (xps ==NULL ) { +xprt_put (xprt);return ERR_PTR (-ENOMEM ); - + } clnt =rpc_new_client (args, xps, xprt,NULL );if (IS_ERR (clnt))return clnt;
Greg Kroah-Hartman
maintainerPATCH 57/203 rpc: share one xps between all backchannels
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Bruce Fields <[email protected]>
commit 39a9beab5acb83176e8b9a4f0778749a09341f1f upstream.
The spec allows backchannels for multiple clients to share the same tcp connection. When that happens, we need to use the same xprt for all of them. Similarly, we need the same xps.
This fixes list corruption introduced by the multipath code.
--- include/linux/sunrpc/svc_xprt.h | 1 + include/linux/sunrpc/xprt.h | 1 + net/sunrpc/clnt.c | 18 ++++++++++++++---- net/sunrpc/svc_xprt.c | 2 ++ net/sunrpc/xprtsock.c | 1 + 5 files changed, 19 insertions(+), 4 deletions(-)
include/linux/sunrpc/svc_xprt.h +1 -0
@@ -84,6 +84,7 @@ struct svc_xprt {struct net *xpt_net;struct rpc_xprt *xpt_bc_xprt;/* NFSv4.1 backchannel */ +struct rpc_xprt_switch *xpt_bc_xps;/* NFSv4.1 backchannel */ };static inline void unregister_xpt_user (struct svc_xprt *xpt,struct svc_xpt_user *u)
include/linux/sunrpc/xprt.h +1 -0
@@ -296,6 +296,7 @@ struct xprt_create {size_t addrlen;const char *servername;struct svc_xprt *bc_xprt;/* NFSv4.1 backchannel */ +struct rpc_xprt_switch *bc_xps;unsigned int flags; };
net/sunrpc/clnt.c +14 -4
@@ -452,10 +452,20 @@ static struct rpc_clnt *rpc_create_xprt(struct rpc_clnt *clnt =NULL ;struct rpc_xprt_switch *xps; - xps =xprt_switch_alloc (xprt,GFP_KERNEL ); -if (xps ==NULL ) { -xprt_put (xprt); -return ERR_PTR (-ENOMEM ); +if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) { +WARN_ON (args->protocol !=XPRT_TRANSPORT_BC_TCP ); + xps = args->bc_xprt->xpt_bc_xps; +xprt_switch_get (xps); + }else { + xps =xprt_switch_alloc (xprt,GFP_KERNEL ); +if (xps ==NULL ) { +xprt_put (xprt); +return ERR_PTR (-ENOMEM ); + } +if (xprt->bc_xprt) { +xprt_switch_get (xps); + xprt->bc_xprt->xpt_bc_xps = xps; + } } clnt =rpc_new_client (args, xps, xprt,NULL );if (IS_ERR (clnt))
net/sunrpc/svc_xprt.c +2 -0
@@ -136,6 +136,8 @@ static void svc_xprt_free(struct kref *k/* See comment on corresponding get in xs_setup_bc_tcp(): */ if (xprt->xpt_bc_xprt)xprt_put (xprt->xpt_bc_xprt); +if (xprt->xpt_bc_xps) +xprt_switch_put (xprt->xpt_bc_xps); xprt->xpt_ops->xpo_free (xprt);module_put (owner); }
net/sunrpc/xprtsock.c +1 -0
@@ -3050,6 +3050,7 @@ static struct rpc_xprt *xs_setup_bc_tcp(return xprt; args->bc_xprt->xpt_bc_xprt =NULL ; + args->bc_xprt->xpt_bc_xps =NULL ;xprt_put (xprt); ret =ERR_PTR (-EINVAL ); out_err:
Greg Kroah-Hartman
maintainerPATCH 58/203 regulator: qcom_smd: add list_voltage callback
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit a8a47540ebe32f1733eebc3e5699af580ceaa3f5 upstream.
This patch adds support to list_voltage callback, so that consumers like mmc core, can get information of supported voltage range.
Without this patch there is no way for mmc core to know this voltage range.
--- drivers/regulator/qcom_smd-regulator.c | 1 + 1 file changed, 1 insertion(+)
drivers/regulator/qcom_smd-regulator.c +1 -0
@@ -140,6 +140,7 @@ static const struct regulator_ops rpm_sm .enable = rpm_reg_enable, .disable = rpm_reg_disable, .is_enabled = rpm_reg_is_enabled, + .list_voltage = regulator_list_voltage_linear_range, .get_voltage = rpm_reg_get_voltage, .set_voltage = rpm_reg_set_voltage,
Greg Kroah-Hartman
maintainerPATCH 59/203 regulator: qcom_smd: add regulator ops for pm8941 lnldo
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit d1e44b6b2823f1751ffe7e7589f545f05cfe2095 upstream.
After "regulator: qcom_smd: add list_voltage callback" patch adding pm8941 lnldo regulators would bug on list_voltages as it is a fixed regulator without any linear range.
This patch fixes that issue by adding dedicated ops for pm8941 lnldo without list_voltages callback.
--- drivers/regulator/qcom_smd-regulator.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/regulator/qcom_smd-regulator.c +12 -1
@@ -148,6 +148,17 @@ static const struct regulator_ops rpm_sm .set_load = rpm_reg_set_load, }; +static const struct regulator_ops rpm_smps_ldo_ops_fixed = { + .enable = rpm_reg_enable, + .disable = rpm_reg_disable, + .is_enabled = rpm_reg_is_enabled, + + .get_voltage = rpm_reg_get_voltage, + .set_voltage = rpm_reg_set_voltage, + + .set_load = rpm_reg_set_load, +}; +static const struct regulator_ops rpm_switch_ops = { .enable = rpm_reg_enable, .disable = rpm_reg_disable,
@@ -248,7 +259,7 @@ static const struct regulator_desc pm894static const struct regulator_desc pm8941_lnldo = { .fixed_uV =1740000 , .n_voltages =1 , - .ops = &rpm_smps_ldo_ops, + .ops = &rpm_smps_ldo_ops_fixed, };static const struct regulator_desc pm8941_switch = {
Greg Kroah-Hartman
maintainerPATCH 60/203 ARM: imx6ul: Fix Micrel PHY mask
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 20c15226d1c73150c4d9107301cac5dda0b7f995 upstream.
The value used for Micrel PHY mask is not correct. Use the MICREL_PHY_ID_MASK definition instead.
Thanks to Jiri Luznicky for proposing the fix at
https://community.freescale.com/thread/387739
--- arch/arm/mach-imx/mach-imx6ul.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-imx/mach-imx6ul.c +1 -1
@@ -46,7 +46,7 @@ static int ksz8081_phy_fixup(struct phy_static void __init imx6ul_enet_phy_init (void ) {if (IS_BUILTIN (CONFIG_PHYLIB )) -phy_register_fixup_for_uid (PHY_ID_KSZ8081 ,0xffffffff , +phy_register_fixup_for_uid (PHY_ID_KSZ8081 ,MICREL_PHY_ID_MASK , ksz8081_phy_fixup); }
Greg Kroah-Hartman
maintainerPATCH 61/203 ARM: 8578/1: mm: ensure pmd_present only checks the valid bit
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 624531886987f0f1b5d01fb598034d039198e090 upstream.
In a subsequent patch, pmd_mknotpresent will clear the valid bit of the pmd entry, resulting in a not-present entry from the hardware's perspective. Unfortunately, pmd_present simply checks for a non-zero pmd value and will therefore continue to return true even after a pmd_mknotpresent operation. Since pmd_mknotpresent is only used for managing huge entries, this is only an issue for the 3-level case.
This patch fixes the 3-level pmd_present implementation to take into account the valid bit. For bisectability, the change is made before the fix to pmd_mknotpresent.
[[email protected]: comment update regarding pmd_mknotpresent patch]
--- arch/arm/include/asm/pgtable-2level.h | 1 + arch/arm/include/asm/pgtable-3level.h | 1 + arch/arm/include/asm/pgtable.h | 1 - 3 files changed, 2 insertions(+), 1 deletion(-)
arch/arm/include/asm/pgtable-2level.h +1 -0
@@ -193,6 +193,7 @@ static inline pmd_t *pmd_offset(pud_t *p#define pmd_large (pmd) (pmd_val(pmd) & 2)#define pmd_bad (pmd) (pmd_val(pmd) & 2) +#define pmd_present (pmd) (pmd_val(pmd))#define copy_pmd (pmdpd,pmdps) \ do { \
arch/arm/include/asm/pgtable-3level.h +1 -0
@@ -211,6 +211,7 @@ static inline pmd_t *pmd_offset(pud_t *p : !!(pmd_val(pmd) & (val)))#define pmd_isclear (pmd, val) (!(pmd_val(pmd) & (val))) +#define pmd_present (pmd) (pmd_isset((pmd), L_PMD_SECT_VALID))#define pmd_young (pmd) (pmd_isset((pmd), PMD_SECT_AF))#define pte_special (pte) (pte_isset((pte), L_PTE_SPECIAL))static inline pte_t pte_mkspecial (pte_t pte)
arch/arm/include/asm/pgtable.h +0 -1
@@ -182,7 +182,6 @@ extern pgd_t swapper_pg_dir[PTRS_PER_PGD#define pgd_offset_k (addr) pgd_offset(&init_mm, addr)#define pmd_none (pmd) (!pmd_val(pmd)) -#define pmd_present (pmd) (pmd_val(pmd))static inline pte_t *pmd_page_vaddr (pmd_t pmd) {
Greg Kroah-Hartman
maintainerPATCH 62/203 ARM: 8579/1: mm: Fix definition of pmd_mknotpresent
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Capper <[email protected]>
commit 56530f5d2ddc9b9fade7ef8db9cb886e9dc689b5 upstream.
Currently pmd_mknotpresent will use a zero entry to respresent an invalidated pmd.
Unfortunately this definition clashes with pmd_none, thus it is possible for a race condition to occur if zap_pmd_range sees pmd_none whilst __split_huge_pmd_locked is running too with pmdp_invalidate just called.
This patch fixes the race condition by modifying pmd_mknotpresent to create non-zero faulting entries (as is done in other architectures), removing the ambiguity with pmd_none.
[[email protected]: using L_PMD_SECT_VALID instead of PMD_TYPE_SECT]
--- arch/arm/include/asm/pgtable-3level.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/include/asm/pgtable-3level.h +2 -2
@@ -250,10 +250,10 @@ PMD_BIT_FUNC(mkyoung, |= PMD_SECT_AF);#define pfn_pmd (pfn,prot) (__pmd(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))#define mk_pmd (page,prot) pfn_pmd(page_to_pfn(page),prot) -/* represent a notpresent pmd by zero, this is used by pmdp_invalidate */ +/* represent a notpresent pmd by faulting entry, this is used by pmdp_invalidate */ static inline pmd_t pmd_mknotpresent (pmd_t pmd) { -return __pmd (0 ); +return __pmd (pmd_val (pmd) & ~L_PMD_SECT_VALID ); }static inline pmd_t pmd_modify (pmd_t pmd,pgprot_t newprot)
Greg Kroah-Hartman
maintainerPATCH 63/203 ARM: dts: sun6i: yones-toptech-bs1078-v2: Drop constraints on dc1sw regulator
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
commit b223d6242c372a81cca3bb81998f53d3b3e3fb70 upstream.
This is the same issue fixed in commit dcf5341f0150 ("ARM: dts:
sun8i-q8-common: Do not set constraints on dc1sw regulator"). Commit message copied:
dc1sw is an on/off only regulator and as such it cannot have constraints.
This is a limitation of the kernel regulator implementation which resolves supplies on the first regulator_get(), which is done after applying constraints, and applying the constrains will fail because it calls _regulator_get_voltage() and _regulator_do_set_voltage() both of which will fail on a switch regulator when there is no supply (yet).
This causes registering of all axp22x regulators to fail with the following errors:
[ 1.395249] vcc-lcd: failed to get the current voltage(-22) [ 1.405131] axp20x-regulator axp20x-regulator: Failed to register dc1sw [ 1.412436] axp20x-regulator: probe of axp20x-regulator failed with error -22
This commit removes the constrains on dc1sw / vcc-lcd fixing this problem. Note that dcdc1 itself is contrained to the exact same values, so this does not change anything.
--- arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts | 2 -- 1 file changed, 2 deletions(-)
arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts +0 -2
@@ -135,8 +135,6 @@ ®_dc1sw { regulator-name = "vcc-lcd-usb2"; - regulator-min-microvolt = <3000000>; - regulator-max-microvolt = <3000000>; }; ®_dc5ldo {
Greg Kroah-Hartman
maintainerPATCH 64/203 ARM: dts: sun6i: primo81: Drop constraints on dc1sw regulator
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
commit cb84f6c0a25eb76b1f838eb63e212705c0c06b5f upstream.
This is the same issue fixed in commit dcf5341f0150 ("ARM: dts:
sun8i-q8-common: Do not set constraints on dc1sw regulator"). Commit message copied:
dc1sw is an on/off only regulator and as such it cannot have constraints.
This is a limitation of the kernel regulator implementation which resolves supplies on the first regulator_get(), which is done after applying constraints, and applying the constrains will fail because it calls _regulator_get_voltage() and _regulator_do_set_voltage() both of which will fail on a switch regulator when there is no supply (yet).
This causes registering of all axp22x regulators to fail with the following errors:
[ 1.395249] vcc-lcd: failed to get the current voltage(-22) [ 1.405131] axp20x-regulator axp20x-regulator: Failed to register dc1sw [ 1.412436] axp20x-regulator: probe of axp20x-regulator failed with error -22
This commit removes the constrains on dc1sw / vcc-lcd fixing this problem. Note that dcdc1 itself is contrained to the exact same values, so this does not change anything.
--- arch/arm/boot/dts/sun6i-a31s-primo81.dts | 2 -- 1 file changed, 2 deletions(-)
arch/arm/boot/dts/sun6i-a31s-primo81.dts +0 -2
@@ -176,8 +176,6 @@ }; ®_dc1sw { - regulator-min-microvolt = <3000000>; - regulator-max-microvolt = <3000000>; regulator-name = "vcc-lcd"; };
Greg Kroah-Hartman
maintainerPATCH 65/203 MIPS: KVM: Fix modular KVM under QEMU
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 797179bc4fe06c89e47a9f36f886f68640b423f8 upstream.
Copy __kvm_mips_vcpu_run() into unmapped memory, so that we can never get a TLB refill exception in it when KVM is built as a module.
This was observed to happen with the host MIPS kernel running under QEMU, due to a not entirely transparent optimisation in the QEMU TLB handling where TLB entries replaced with TLBWR are copied to a separate part of the TLB array. Code in those pages continue to be executable, but those mappings persist only until the next ASID switch, even if they are marked global.
An ASID switch happens in __kvm_mips_vcpu_run() at exception level after switching to the guest exception base. Subsequent TLB mapped kernel instructions just prior to switching to the guest trigger a TLB refill exception, which enters the guest exception handlers without updating EPC. This appears as a guest triggered TLB refill on a host kernel mapped (host KSeg2) address, which is not handled correctly as user (guest) mode accesses to kernel (host) segments always generate address error exceptions.
--- arch/mips/include/asm/kvm_host.h | 1 + arch/mips/kvm/interrupt.h | 1 + arch/mips/kvm/locore.S | 1 + arch/mips/kvm/mips.c | 11 ++++++++++- 4 files changed, 13 insertions(+), 1 deletion(-)
arch/mips/include/asm/kvm_host.h +1 -0
@@ -336,6 +336,7 @@ struct kvm_mips_tlb {#define KVM_MIPS_GUEST_TLB_SIZE 64struct kvm_vcpu_arch {void *host_ebase, *guest_ebase; +int (*vcpu_run)(struct kvm_run *run,struct kvm_vcpu *vcpu);unsigned long host_stack;unsigned long host_gp;
arch/mips/kvm/interrupt.h +1 -0
@@ -28,6 +28,7 @@#define MIPS_EXC_MAX 12/* XXXSL More to follow */ +extern char __kvm_mips_vcpu_run_end[];extern char mips32_exception[], mips32_exceptionEnd[];extern char mips32_GuestException[], mips32_GuestExceptionEnd[];
arch/mips/kvm/locore.S +1 -0
@@ -227,6 +227,7 @@ FEXPORT(__kvm_mips_load_k0k1) /* Jump to guest */ eret +EXPORT(__kvm_mips_vcpu_run_end) VECTOR(MIPSX(exception), unknown) /* Find out what mode we came from and jump to the proper handler. */
arch/mips/kvm/mips.c +10 -1
@@ -314,6 +314,15 @@ struct kvm_vcpu *kvm_arch_vcpu_create(stmemcpy (gebase + offset, mips32_GuestException, mips32_GuestExceptionEnd - mips32_GuestException); +#ifdef MODULE + offset += mips32_GuestExceptionEnd - mips32_GuestException; +memcpy (gebase + offset, (char *)__kvm_mips_vcpu_run, + __kvm_mips_vcpu_run_end - (char *)__kvm_mips_vcpu_run); + vcpu->arch.vcpu_run = gebase + offset; +#else + vcpu->arch.vcpu_run = __kvm_mips_vcpu_run; +#endif +/* Invalidate the icache for these ranges */ local_flush_icache_range ((unsigned long )gebase, (unsigned long )gebase +ALIGN (size,PAGE_SIZE ));
@@ -403,7 +412,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v/* Disable hardware page table walking while in guest */ htw_stop (); - r =__kvm_mips_vcpu_run (run, vcpu); + r = vcpu->arch.vcpu_run (run, vcpu);/* Re-enable HTW before enabling interrupts */ htw_start ();
Greg Kroah-Hartman
maintainerPATCH 66/203 irqchip/mips-gic: Fix IRQs in gic_dev_domain
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harvey Hunt <[email protected]>
commit 4b2312bd0592708c85ed94368c874819e7013309 upstream.
When allocating a new device IRQ, gic_dev_domain_alloc() correctly calls irq_domain_set_hwirq_and_chip(), but gic_irq_domain_alloc() does not. This means that gic_irq_domain believes all IRQs from the dev domain have an hwirq of 0 and creates incorrect mappings in the linear_revmap. As gic_irq_domain is a parent of the gic_dev_domain, this leads to an inability to boot on devices with a GIC. Excerpt of the error:
[ 2.297649] irq 0: nobody cared (try booting with the "irqpoll" option) ... [ 2.436963] handlers: [ 2.439492] Disabling IRQ #0
Fix this by calling irq_domain_set_hwirq_and_chip() for both the dev and irq domain.
Now that we are modifying the parent domain, be sure to clear it up in case of an allocation error.
--- drivers/irqchip/irq-mips-gic.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/irqchip/irq-mips-gic.c +11 -1
@@ -734,6 +734,12 @@ static int gic_irq_domain_alloc(struct i/* verify that it doesn't conflict with an IPI irq */ if (test_bit (spec->hwirq, ipi_resrv))return -EBUSY ; + + hwirq =GIC_SHARED_TO_HWIRQ (spec->hwirq); + +return irq_domain_set_hwirq_and_chip (d, virq, hwirq, + &gic_level_irq_controller, +NULL ); }else { base_hwirq =find_first_bit (ipi_resrv, gic_shared_intrs);if (base_hwirq == gic_shared_intrs) {
@@ -855,10 +861,14 @@ static int gic_dev_domain_alloc(struct i &gic_level_irq_controller, NULL);if (ret) -return ret; + goto error; }return 0 ; + +error: +irq_domain_free_irqs_parent (d, virq, nr_irqs); +return ret; } void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
Greg Kroah-Hartman
maintainerPATCH 67/203 mm: Export migrate_page_move_mapping and migrate_page_copy
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit 1118dce773d84f39ebd51a9fe7261f9169cb056e upstream.
Export these symbols such that UBIFS can implement ->migratepage.
--- mm/migrate.c | 2 ++ 1 file changed, 2 insertions(+)
mm/migrate.c +2 -0
@@ -431,6 +431,7 @@ int migrate_page_move_mapping(struct addreturn MIGRATEPAGE_SUCCESS ; } +EXPORT_SYMBOL (migrate_page_move_mapping);/* * The expected number of remaining references is the same as that
@@ -586,6 +587,7 @@ void migrate_page_copy(struct page *newpmem_cgroup_migrate (page, newpage); } +EXPORT_SYMBOL (migrate_page_copy);/************************************************************ * Migration functions
Greg Kroah-Hartman
maintainerPATCH 68/203 UBIFS: Implement ->migratepage()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <[email protected]>
commit 4ac1c17b2044a1b4b2fbed74451947e905fc2992 upstream.
During page migrations UBIFS might get confused
and the following assert triggers:
[ 213.480000] UBIFS assert failed in ubifs_set_page_dirty at 1451 (pid 436) [ 213.490000] CPU: 0 PID: 436 Comm: drm-stress-test Not tainted 4.4.4-00176-geaa802524636-dirty #1008 [ 213.490000] Hardware name: Allwinner sun4i/sun5i Families [ 213.490000] [<c0015e70>] (unwind_backtrace) from [<c0012cdc>] (show_stack+0x10/0x14) [ 213.490000] [<c0012cdc>] (show_stack) from [<c02ad834>] (dump_stack+0x8c/0xa0) [ 213.490000] [<c02ad834>] (dump_stack) from [<c0236ee8>] (ubifs_set_page_dirty+0x44/0x50) [ 213.490000] [<c0236ee8>] (ubifs_set_page_dirty) from [<c00fa0bc>] (try_to_unmap_one+0x10c/0x3a8) [ 213.490000] [<c00fa0bc>] (try_to_unmap_one) from [<c00fadb4>] (rmap_walk+0xb4/0x290) [ 213.490000] [<c00fadb4>] (rmap_walk) from [<c00fb1bc>] (try_to_unmap+0x64/0x80) [ 213.490000] [<c00fb1bc>] (try_to_unmap) from [<c010dc28>] (migrate_pages+0x328/0x7a0) [ 213.490000] [<c010dc28>] (migrate_pages) from [<c00d0cb0>] (alloc_contig_range+0x168/0x2f4) [ 213.490000] [<c00d0cb0>] (alloc_contig_range) from [<c010ec00>] (cma_alloc+0x170/0x2c0) [ 213.490000] [<c010ec00>] (cma_alloc) from [<c001a958>] (__alloc_from_contiguous+0x38/0xd8) [ 213.490000] [<c001a958>] (__alloc_from_contiguous) from [<c001ad44>] (__dma_alloc+0x23c/0x274) [ 213.490000] [<c001ad44>] (__dma_alloc) from [<c001ae08>] (arm_dma_alloc+0x54/0x5c) [ 213.490000] [<c001ae08>] (arm_dma_alloc) from [<c035cecc>] (drm_gem_cma_create+0xb8/0xf0) [ 213.490000] [<c035cecc>] (drm_gem_cma_create) from [<c035cf20>] (drm_gem_cma_create_with_handle+0x1c/0xe8) [ 213.490000] [<c035cf20>] (drm_gem_cma_create_with_handle) from [<c035d088>] (drm_gem_cma_dumb_create+0x3c/0x48) [ 213.490000] [<c035d088>] (drm_gem_cma_dumb_create) from [<c0341ed8>] (drm_ioctl+0x12c/0x444) [ 213.490000] [<c0341ed8>] (drm_ioctl) from [<c0121adc>] (do_vfs_ioctl+0x3f4/0x614) [ 213.490000] [<c0121adc>] (do_vfs_ioctl) from [<c0121d30>] (SyS_ioctl+0x34/0x5c) [ 213.490000] [<c0121d30>] (SyS_ioctl) from [<c000f2c0>] (ret_fast_syscall+0x0/0x34)
UBIFS is using PagePrivate() which can have different meanings across filesystems. Therefore the generic page migration code cannot handle this case correctly.
We have to implement our own migration function which basically does a plain copy but also duplicates the page private flag.
UBIFS is not a block device filesystem and cannot use buffer_migrate_page().
--- fs/ubifs/file.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
fs/ubifs/file.c +24 -0
@@ -52,6 +52,7 @@#include "ubifs.h" #include <linux/mount.h> #include <linux/slab.h> +#include <linux/migrate.h> static int read_block (struct inode *inode,void *addr,unsigned int block,struct ubifs_data_node *dn)
@@ -1452,6 +1453,26 @@ static int ubifs_set_page_dirty(struct preturn ret; } +#ifdef CONFIG_MIGRATION +static int ubifs_migrate_page (struct address_space *mapping, +struct page *newpage,struct page *page,enum migrate_mode mode) +{ +int rc; + + rc =migrate_page_move_mapping (mapping, newpage, page,NULL , mode,0 ); +if (rc !=MIGRATEPAGE_SUCCESS ) +return rc; + +if (PagePrivate (page)) { +ClearPagePrivate (page); +SetPagePrivate (newpage); + } + +migrate_page_copy (newpage, page); +return MIGRATEPAGE_SUCCESS ; +} +#endif +static int ubifs_releasepage (struct page *page,gfp_t unused_gfp_flags) {/*
@@ -1591,6 +1612,9 @@ const struct address_space_operations ub .write_end = ubifs_write_end, .invalidatepage = ubifs_invalidatepage, .set_page_dirty = ubifs_set_page_dirty, +#ifdef CONFIG_MIGRATION + .migratepage = ubifs_migrate_page, +#endif .releasepage = ubifs_releasepage, };
Greg Kroah-Hartman
maintainerPATCH 69/203 sched/fair: Fix cfs_rq avg tracking underflow
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 8974189222159154c55f24ddad33e3613960521a upstream.
As per commit:
b7fa30c9cc48 ("sched/fair: Fix post_init_entity_util_avg() serialization")
Quoted 22 lines
the code generated from
update_cfs_rq_load_avg():if (atomic_long_read(&cfs_rq->removed_load_avg)) { s64 r = atomic_long_xchg(&cfs_rq->removed_load_avg, 0); sa->load_avg = max_t(long, sa->load_avg - r, 0); sa->load_sum = max_t(s64, sa->load_sum - r * LOAD_AVG_MAX, 0); removed_load = 1; }turns into:
ffffffff81087064: 49 8b 85 98 00 00 00 mov 0x98(%r13),%rax ffffffff8108706b: 48 85 c0 test %rax,%rax ffffffff8108706e: 74 40 je ffffffff810870b0 <update_blocked_averages+0xc0> ffffffff81087070: 4c 89 f8 mov %r15,%rax ffffffff81087073: 49 87 85 98 00 00 00 xchg %rax,0x98(%r13) ffffffff8108707a: 49 29 45 70 sub %rax,0x70(%r13) ffffffff8108707e: 4c 89 f9 mov %r15,%rcx ffffffff81087081: bb 01 00 00 00 mov $0x1,%ebx ffffffff81087086: 49 83 7d 70 00 cmpq $0x0,0x70(%r13) ffffffff8108708b: 49 0f 49 4d 70 cmovns 0x70(%r13),%rcx
Quoted 2 lines
Which you'll note ends up with
sa->load_avg-= r in memory atffffffff8108707a.
So I _should_ have looked at other unserialized users of ->load_avg, but alas. Luckily nikbor reported a similar /0 from task_h_load() which instantly triggered recollection of this here problem.
Aside from the intermediate value hitting memory and causing problems, there's another problem: the underflow detection relies on the signed bit. This reduces the effective width of the variables, IOW its effectively the same as having these variables be of signed type.
This patch changes to a different means of unsigned underflow detection to not rely on the signed bit. This allows the variables to use the 'full' unsigned range. And it does so with explicit LOAD - STORE to ensure any intermediate value will never be visible in memory, allowing these unserialized loads.
Note: GCC generates crap code for this, might warrant a look later.
Note2: I say 'full' above, if we end up at U*_MAX we'll still explode;
maybe we should do clamping on add too.
--- kernel/sched/fair.c | 33 +++++++++++++++++++++++++-------- 1 file changed, 25 insertions(+), 8 deletions(-)
kernel/sched/fair.c +25 -8
@@ -2821,6 +2821,23 @@ static inline void update_tg_load_avg(ststatic inline u64 cfs_rq_clock_task (struct cfs_rq *cfs_rq); +/* +* Unsigned subtract and clamp on underflow. +* +* Explicitly do a load-store to ensure the intermediate value never hits +* memory. This allows lockless observations without ever seeing the negative +* values. +*/ +#define sub_positive (_ptr, _val) do { \ + typeof(_ptr) ptr = (_ptr); \ + typeof(*ptr) val = (_val); \ + typeof(*ptr) res, var = READ_ONCE(*ptr); \ + res = var - val; \ + if (res > var) \ + res = 0; \ + WRITE_ONCE(*ptr, res); \ +} while (0) +/* Group cfs_rq's load_avg is used for task_h_load and update_cfs_share */ static inline int update_cfs_rq_load_avg (u64 now,struct cfs_rq *cfs_rq) {
@@ -2829,15 +2846,15 @@ static inline int update_cfs_rq_load_avgif (atomic_long_read (&cfs_rq->removed_load_avg)) {s64 r =atomic_long_xchg (&cfs_rq->removed_load_avg,0 ); - sa->load_avg =max_t (long, sa->load_avg - r,0 ); - sa->load_sum =max_t (s64, sa->load_sum - r *LOAD_AVG_MAX ,0 ); +sub_positive (&sa->load_avg, r); +sub_positive (&sa->load_sum, r *LOAD_AVG_MAX ); removed =1 ; }if (atomic_long_read (&cfs_rq->removed_util_avg)) {long r =atomic_long_xchg (&cfs_rq->removed_util_avg,0 ); - sa->util_avg =max_t (long, sa->util_avg - r,0 ); - sa->util_sum =max_t (s32, sa->util_sum - r *LOAD_AVG_MAX ,0 ); +sub_positive (&sa->util_avg, r); +sub_positive (&sa->util_sum, r *LOAD_AVG_MAX ); } decayed = __update_load_avg(now, cpu_of(rq_of(cfs_rq)), sa,
@@ -2927,10 +2944,10 @@ static void detach_entity_load_avg(struc &se->avg, se->on_rq *scale_load_down (se->load.weight), cfs_rq->curr == se, NULL); - cfs_rq->avg.load_avg =max_t (long, cfs_rq->avg.load_avg - se->avg.load_avg,0 ); - cfs_rq->avg.load_sum =max_t (s64, cfs_rq->avg.load_sum - se->avg.load_sum,0 ); - cfs_rq->avg.util_avg =max_t (long, cfs_rq->avg.util_avg - se->avg.util_avg,0 ); - cfs_rq->avg.util_sum =max_t (s32, cfs_rq->avg.util_sum - se->avg.util_sum,0 ); +sub_positive (&cfs_rq->avg.load_avg, se->avg.load_avg); +sub_positive (&cfs_rq->avg.load_sum, se->avg.load_sum); +sub_positive (&cfs_rq->avg.util_avg, se->avg.util_avg); +sub_positive (&cfs_rq->avg.util_sum, se->avg.util_sum); }/* Add the load generated by se into cfs_rq's load average */
Greg Kroah-Hartman
maintainerPATCH 70/203 packet: Use symmetric hash for PACKET_FANOUT_HASH.
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <[email protected]>
[ Upstream commit eb70db8756717b90c01ccc765fdefc4dd969fc74 ]
People who use PACKET_FANOUT_HASH want a symmetric hash, meaning that they want packets going in both directions on a flow to hash to the same bucket.
The core kernel SKB hash became non-symmetric when the ipv6 flow label and other entities were incorporated into the standard flow hash order to increase entropy.
But there are no users of PACKET_FANOUT_HASH who want an assymetric hash, they all want a symmetric one.
Therefore, use the flow dissector to compute a flat symmetric hash over only the protocol, addresses and ports. This hash does not get installed into and override the normal skb hash, so this change has no effect whatsoever on the rest of the stack.
--- include/linux/skbuff.h | 1 + net/core/flow_dissector.c | 43 +++++++++++++++++++++++++++++++++++++++++++ net/packet/af_packet.c | 2 +- 3 files changed, 45 insertions(+), 1 deletion(-)
include/linux/skbuff.h +1 -0
@@ -1062,6 +1062,7 @@ __skb_set_sw_hash(struct sk_buff *skb, _ }void __skb_get_hash (struct sk_buff *skb); +u32 __skb_get_hash_symmetric (struct sk_buff *skb);u32 skb_get_poff (const struct sk_buff *skb);u32 __skb_get_poff (const struct sk_buff *skb,void *data,const struct flow_keys *keys,int hlen);
net/core/flow_dissector.c +43 -0
61 lines not on this page · raw message
net/packet/af_packet.c +1 -1
@@ -1340,7 +1340,7 @@ static unsigned int fanout_demux_hash(ststruct sk_buff *skb, unsigned int num) { - return reciprocal_scale(skb_get_hash(skb), num); + return reciprocal_scale(__skb_get_hash_symmetric(skb), num); } static unsigned int fanout_demux_lb(struct packet_fanout *f,
Greg Kroah-Hartman
maintainerPATCH 71/203 net_sched: fix mirrored packets checksum
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <[email protected]>
[ Upstream commit 82a31b9231f02d9c1b7b290a46999d517b0d312a ]
Similar to commit 9b368814b336 ("net: fix bridge multicast packet checksum validation") we need to fixup the checksum for CHECKSUM_COMPLETE when
pushing skb on RX path. Otherwise we get similar splats.
--- include/linux/skbuff.h | 19 +++++++++++++++++++ net/core/skbuff.c | 18 ------------------ net/sched/act_mirred.c | 2 +- 3 files changed, 20 insertions(+), 19 deletions(-)
include/linux/skbuff.h +19 -0
@@ -2861,6 +2861,25 @@ static inline void skb_postpush_rcsum(st }/** +* skb_push_rcsum - push skb and update receive checksum +* @skb: buffer to update +* @len: length of data pulled +* +* This function performs an skb_push on the packet and updates +* the CHECKSUM_COMPLETE checksum. It should be used on +* receive path processing instead of skb_push unless you know +* that the checksum difference is zero (e.g., a valid IP header) +* or you are setting ip_summed to CHECKSUM_NONE. +*/ +static inline unsigned char *skb_push_rcsum (struct sk_buff *skb, +unsigned int len) +{ +skb_push (skb, len); +skb_postpush_rcsum (skb, skb->data, len); +return skb->data; +} + +/** * pskb_trim_rcsum - trim received skb and update checksum * @skb: buffer to trim * @len: new length
net/core/skbuff.c +0 -18
@@ -3016,24 +3016,6 @@ int skb_append_pagefrags(struct sk_buffEXPORT_SYMBOL_GPL (skb_append_pagefrags);/** -* skb_push_rcsum - push skb and update receive checksum -* @skb: buffer to update -* @len: length of data pulled -* -* This function performs an skb_push on the packet and updates -* the CHECKSUM_COMPLETE checksum. It should be used on -* receive path processing instead of skb_push unless you know -* that the checksum difference is zero (e.g., a valid IP header) -* or you are setting ip_summed to CHECKSUM_NONE. -*/ -static unsigned char *skb_push_rcsum (struct sk_buff *skb,unsigned len) -{ -skb_push (skb, len); -skb_postpush_rcsum (skb, skb->data, len); -return skb->data; -} - -/** * skb_pull_rcsum - pull skb and update receive checksum * @skb: buffer to update * @len: length of data pulled
net/sched/act_mirred.c +1 -1
@@ -180,7 +180,7 @@ static int tcf_mirred(struct sk_buff *skif (!(at &AT_EGRESS )) {if (m->tcfm_ok_push) -skb_push (skb2, skb->mac_len); +skb_push_rcsum (skb2, skb->mac_len); }/* mirror is always swallowed */
Greg Kroah-Hartman
maintainerPATCH 72/203 macsec: set actual real device for xmit when !protect_frames
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 79c62220d74a4a3f961a2cb7320da09eebf5daf7 ]
Avoid recursions of dev_queue_xmit() to the wrong net device when frames are unprotected, since at that time skb->dev still points to our own macsec dev and unlike macsec_encrypt_finish() dev pointer doesn't get updated to real underlying device.
--- drivers/net/macsec.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/macsec.c +1 -0
@@ -2564,6 +2564,7 @@ static netdev_tx_t macsec_start_xmit(stru64_stats_update_begin (&secy_stats->syncp); secy_stats->stats.OutPktsUntagged++;u64_stats_update_end (&secy_stats->syncp); + skb->dev = macsec->real_dev; len = skb->len; ret =dev_queue_xmit (skb);count_tx (dev, ret, len);
Greg Kroah-Hartman
maintainerPATCH 73/203 geneve: fix max_mtu setting
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haishuang Yan <[email protected]>
[ Upstream commit d5d5e8d55732c7c35c354e45e3b0af2795978a57 ]
For ipv6+udp+geneve encapsulation data, the max_mtu should subtract sizeof(ipv6hdr), instead of sizeof(iphdr).
--- drivers/net/geneve.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/geneve.c +7 -2
@@ -1092,12 +1092,17 @@ static netdev_tx_t geneve_xmit(struct skstatic int __geneve_change_mtu (struct net_device *dev,int new_mtu,bool strict) { +struct geneve_dev *geneve =netdev_priv (dev);/* The max_mtu calculation does not take account of GENEVE * options, to avoid excluding potentially valid * configurations. */ -int max_mtu =IP_MAX_MTU -GENEVE_BASE_HLEN -sizeof (struct iphdr ) - - dev->hard_header_len; +int max_mtu =IP_MAX_MTU -GENEVE_BASE_HLEN - dev->hard_header_len; + +if (geneve->remote.sa.sa_family ==AF_INET6 ) + max_mtu -=sizeof (struct ipv6hdr ); +else + max_mtu -=sizeof (struct iphdr );if (new_mtu <68 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 75/203 ipv6: Fix mem leak in rt6i_pcpu
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <[email protected]>
[ Upstream commit 903ce4abdf374e3365d93bcb3df56c62008835ba ]
It was first reported and reproduced by Petr (thanks!) in
https://bugzilla.kernel.org/show_bug.cgi?id=119581
free_percpu(rt->rt6i_pcpu) used to always happen in ip6_dst_destroy().
However, after fixing a deadlock bug in
commit 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt"), free_percpu() is not called before setting non_pcpu_rt->rt6i_pcpu to NULL.
It is worth to note that rt6i_pcpu is protected by table->tb6_lock.
kmemleak somehow did not report it. We nailed it down by observing the pcpu entries in /proc/vmallocinfo (first suggested by Hannes, thanks!).
--- net/ipv6/ip6_fib.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/ip6_fib.c +1 -0
@@ -177,6 +177,7 @@ static void rt6_free_pcpu(struct rt6_inf } } +free_percpu (non_pcpu_rt->rt6i_pcpu); non_pcpu_rt->rt6i_pcpu =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 76/203 KEYS: potential uninitialized variable
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 38327424b40bcebe2de92d07312c89360ac9229a upstream.
If __key_link_begin() failed then "edit" would be uninitialized. I've added a check to fix that.
This allows a random user to crash the kernel, though it's quite difficult to achieve. There are three ways it can be done as the user would have to cause an error to occur in __key_link():
(1) Cause the kernel to run out of memory. In practice, this is difficult to achieve without ENOMEM cropping up elsewhere and aborting the attempt.
(2) Revoke the destination keyring between the keyring ID being looked up and it being tested for revocation. In practice, this is difficult to time correctly because the KEYCTL_REJECT function can only be used from the request-key upcall process. Further, users can only make use of what's in /sbin/request-key.conf, though this does including a rejection debugging test - which means that the destination keyring has to be the caller's session keyring in practice.
(3) Have just enough key quota available to create a key, a new session keyring for the upcall and a link in the session keyring, but not then sufficient quota to create a link in the nominated destination keyring so that it fails with EDQUOT.
The bug can be triggered using option (3) above using something like the following:
echo 80 >/proc/sys/kernel/keys/root_maxbytes keyctl request2 user debug:fred negate @t
The above sets the quota to something much lower (80) to make the bug easier to trigger, but this is dependent on the system. Note also that the name of the keyring created contains a random number that may be between 1 and 10 characters in size, so may throw the test off by changing the amount of quota used.
Assuming the failure occurs, something like the following will be seen:
kfree_debugcheck: out of range ptr 6b6b6b6b6b6b6b68h ------------[ cut here ]------------ kernel BUG at ../mm/slab.c:2821! ... RIP: 0010:[<ffffffff811600f9>] kfree_debugcheck+0x20/0x25 RSP: 0018:ffff8804014a7de8 EFLAGS: 00010092 RAX: 0000000000000034 RBX: 6b6b6b6b6b6b6b68 RCX: 0000000000000000 RDX: 0000000000040001 RSI: 00000000000000f6 RDI: 0000000000000300 RBP: ffff8804014a7df0 R08: 0000000000000001 R09: 0000000000000000 R10: ffff8804014a7e68 R11: 0000000000000054 R12: 0000000000000202 R13: ffffffff81318a66 R14: 0000000000000000 R15: 0000000000000001 ... Call Trace: kfree+0xde/0x1bc assoc_array_cancel_edit+0x1f/0x36 __key_link_end+0x55/0x63 key_reject_and_link+0x124/0x155 keyctl_reject_key+0xb6/0xe0 keyctl_negate_key+0x10/0x12 SyS_keyctl+0x9f/0xe7 do_syscall_64+0x63/0x13a entry_SYSCALL64_slow_path+0x25/0x25
--- security/keys/key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/keys/key.c +1 -1
@@ -584,7 +584,7 @@ int key_reject_and_link(struct key *key,mutex_unlock (&key_construction_mutex); -if (keyring) +if (keyring && link_ret ==0 )__key_link_end (keyring, &key->index_key, edit);/* wake up anyone waiting for a key to be constructed */
Greg Kroah-Hartman
maintainerPATCH 77/203 kvm: vmx: check apicv is active before using VT-d posted interrupt
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Zhang <[email protected]>
commit a0052191624e9bf8a8f9dc41b92ab5f252566c3c upstream.
VT-d posted interrupt is relying on the CPU side's posted interrupt. Need to check whether VCPU's APICv is active before enabing VT-d posted interrupt.
--- arch/x86/kvm/vmx.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx.c +10 -5
@@ -2072,7 +2072,8 @@ static void vmx_vcpu_pi_load(struct kvm_unsigned int dest;if (!kvm_arch_has_assigned_device (vcpu->kvm) || - !irq_remapping_cap (IRQ_POSTING_CAP )) + !irq_remapping_cap (IRQ_POSTING_CAP ) || + !kvm_vcpu_apicv_active (vcpu))return ; do {
@@ -2180,7 +2181,8 @@ static void vmx_vcpu_pi_put(struct kvm_vstruct pi_desc *pi_desc =vcpu_to_pi_desc (vcpu);if (!kvm_arch_has_assigned_device (vcpu->kvm) || - !irq_remapping_cap (IRQ_POSTING_CAP )) + !irq_remapping_cap (IRQ_POSTING_CAP ) || + !kvm_vcpu_apicv_active (vcpu))return ;/* Set SN when the vCPU is preempted */
@@ -10702,7 +10704,8 @@ static int vmx_pre_block(struct kvm_vcpustruct pi_desc *pi_desc =vcpu_to_pi_desc (vcpu);if (!kvm_arch_has_assigned_device (vcpu->kvm) || - !irq_remapping_cap (IRQ_POSTING_CAP )) + !irq_remapping_cap (IRQ_POSTING_CAP ) || + !kvm_vcpu_apicv_active (vcpu))return 0 ; vcpu->pre_pcpu = vcpu->cpu;
@@ -10768,7 +10771,8 @@ static void vmx_post_block(struct kvm_vcunsigned long flags;if (!kvm_arch_has_assigned_device (vcpu->kvm) || - !irq_remapping_cap (IRQ_POSTING_CAP )) + !irq_remapping_cap (IRQ_POSTING_CAP ) || + !kvm_vcpu_apicv_active (vcpu))return ; do {
@@ -10821,7 +10825,8 @@ static int vmx_update_pi_irte(struct kvmint idx, ret = -EINVAL ;if (!kvm_arch_has_assigned_device (kvm) || - !irq_remapping_cap (IRQ_POSTING_CAP )) + !irq_remapping_cap (IRQ_POSTING_CAP ) || + !kvm_vcpu_apicv_active (kvm->vcpus[0 ]))return 0 ; idx =srcu_read_lock (&kvm->irq_srcu);
Greg Kroah-Hartman
maintainerPATCH 78/203 kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <[email protected]>
commit caf1ff26e1aa178133df68ac3d40815fed2187d9 upstream.
These days, we experienced one guest crash with 8 cores and 3 disks, with qemu error logs as bellow:
qemu-system-x86_64: /build/qemu-2.0.0/kvm-all.c:984:kvm_irqchip_commit_routes: Assertion `ret == 0' failed.
And then we found one patch(bdf026317d) in qemu tree, which said could fix this bug.
Execute the following script will reproduce the BUG quickly:
irq_affinity.sh
========================================================================
vda_irq_num=25
vdb_irq_num=27
while [ 1 ]
do
for irq in {1,2,4,8,10,20,40,80}
do
echo $irq > /proc/irq/$vda_irq_num/smp_affinity echo $irq > /proc/irq/$vdb_irq_num/smp_affinity dd if=/dev/vda of=/dev/zero bs=4K count=100 iflag=direct dd if=/dev/vdb of=/dev/zero bs=4K count=100 iflag=direct
done
done
========================================================================
The following qemu log is added in the qemu code and is displayed when this bug reproduced:
kvm_irqchip_commit_routes: max gsi: 1008, nr_allocated_irq_routes: 1024, irq_routes->nr: 1024, gsi_count: 1024.
That's to say when irq_routes->nr == 1024, there are 1024 routing entries, but in the kernel code when routes->nr >= 1024, will just return -EINVAL;
The nr is the number of the routing entries which is in of [1 ~ KVM_MAX_IRQ_ROUTES], not the index in [0 ~ KVM_MAX_IRQ_ROUTES - 1].
This patch fix the BUG above.
--- virt/kvm/kvm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
virt/kvm/kvm_main.c +1 -1
@@ -2868,7 +2868,7 @@ static long kvm_vm_ioctl(struct file *fiif (copy_from_user (&routing, argp,sizeof (routing))) goto out; r = -EINVAL ; -if (routing.nr >=KVM_MAX_IRQ_ROUTES ) +if (routing.nr >KVM_MAX_IRQ_ROUTES ) goto out;if (routing.flags) goto out;
Greg Kroah-Hartman
maintainerPATCH 79/203 KVM: s390/mm: Fix CMMA reset during reboot
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <[email protected]>
commit 1c343f7b0e177e8ca7f4d4a5dd1fa790f85abbcc upstream.
commit 1e133ab296f ("s390/mm: split arch/s390/mm/pgtable.c") factored out the page table handling code from __gmap_zap and __s390_reset_cmma into ptep_zap_unused and added a simple flag that tells which one of the function (reset or not) is to be made. This also changed the behaviour, as it also zaps unused page table entries on reset.
Turns out that this is wrong as s390_reset_cmma uses the page walker, which DOES NOT take the ptl lock.
The most simple fix is to not do the zapping part on reset (which uses the walker)
--- arch/s390/mm/pgtable.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/pgtable.c +1 -1
@@ -437,7 +437,7 @@ void ptep_zap_unused(struct mm_struct *m pgste =pgste_get_lock (ptep); pgstev =pgste_val (pgste); pte = *ptep; -if (pte_swap (pte) && +if (!reset &&pte_swap (pte) && ((pgstev & _PGSTE_GPS_USAGE_MASK) == _PGSTE_GPS_USAGE_UNUSED || (pgstev & _PGSTE_GPS_ZERO))) {ptep_zap_swap_entry (mm,pte_to_swp_entry (pte));
Greg Kroah-Hartman
maintainerPATCH 80/203 KVM: arm/arm64: Stop leaking vcpu pid references
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
commit 591d215afcc2f94e8e2c69a63c924c044677eb31 upstream.
kvm provides kvm_vcpu_uninit(), which amongst other things, releases the last reference to the struct pid of the task that was last running the vcpu.
On arm64 built with CONFIG_DEBUG_KMEMLEAK, starting a guest with kvmtool, then killing it with SIGKILL results (after some considerable time) in:
Quoted 4 lines
cat
/sys/kernel/debug/kmemleak
unreferenced object0xffff80007d5ea080(size 128):
comm "lkvm", pid 2025, jiffies 4294942645 (age 1107.776s) hex dump (first 32 bytes):
Quoted 12 lines
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffff8000001b30ec>] create_object+0xfc/0x278 [<ffff80000071da34>] kmemleak_alloc+0x34/0x70 [<ffff80000019fa2c>] kmem_cache_alloc+0x16c/0x1d8 [<ffff8000000d0474>] alloc_pid+0x34/0x4d0 [<ffff8000000b5674>] copy_process.isra.6+0x79c/0x1338 [<ffff8000000b633c>] _do_fork+0x74/0x320 [<ffff8000000b66b0>] SyS_clone+0x18/0x20 [<ffff800000085cb0>] el0_svc_naked+0x24/0x28 [<ffffffffffffffff>] 0xffffffffffffffff
On x86 kvm_vcpu_uninit() is called on the path from kvm_arch_destroy_vm(), on arm no equivalent call is made. Add the call to kvm_arch_vcpu_free().
--- arch/arm/kvm/arm.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/kvm/arm.c +1 -0
@@ -267,6 +267,7 @@ void kvm_arch_vcpu_free(struct kvm_vcpukvm_timer_vcpu_terminate (vcpu);kvm_vgic_vcpu_destroy (vcpu);kvm_pmu_vcpu_destroy (vcpu); +kvm_vcpu_uninit (vcpu);kmem_cache_free (kvm_vcpu_cache, vcpu); }
Greg Kroah-Hartman
maintainerPATCH 82/203 HID: elo: kill not flush the work
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit ed596a4a88bd161f868ccba078557ee7ede8a6ef upstream.
Flushing a work that reschedules itself is not a sensible operation. It needs to be killed. Failure to do so leads to a kernel panic in the timer code.
--- drivers/hid/hid-elo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-elo.c +1 -1
@@ -261,7 +261,7 @@ static void elo_remove(struct hid_devicestruct elo_priv *priv =hid_get_drvdata (hdev);hid_hw_stop (hdev); -flush_workqueue (wq); +cancel_delayed_work_sync (&priv->work);kfree (priv); }
Greg Kroah-Hartman
maintainerPATCH 83/203 HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Bauer <[email protected]>
commit 93a2001bdfd5376c3dc2158653034c20392d15c5 upstream.
This patch validates the num_values parameter from userland during the HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter leading to a heap overflow.
--- drivers/hid/usbhid/hiddev.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/hid/usbhid/hiddev.c +5 -5
@@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(s goto inval; }else if (uref->usage_index >= field->report_count) goto inval; - -else if ((cmd ==HIDIOCGUSAGES || cmd ==HIDIOCSUSAGES ) && - (uref_multi->num_values >HID_MAX_MULTI_USAGES || - uref->usage_index + uref_multi->num_values > field->report_count)) - goto inval; } +if ((cmd ==HIDIOCGUSAGES || cmd ==HIDIOCSUSAGES ) && + (uref_multi->num_values >HID_MAX_MULTI_USAGES || + uref->usage_index + uref_multi->num_values > field->report_count)) + goto inval; +switch (cmd) {case HIDIOCGUSAGE : uref->value = field->value[uref->usage_index];
Greg Kroah-Hartman
maintainerPATCH 84/203 Revert "HID: multitouch: enable palm rejection if device implements confidence usage"
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allen Hung <[email protected]>
commit 62630ea768869beeb1e514b0bf5607a0c9b93d12 upstream.
This reverts commit 25a84db15b3f ("HID: multitouch: enable palm rejection if device implements confidence usage")
The commit enables palm rejection for Win8 Precision Touchpad devices but the quirk MT_QUIRK_VALID_IS_CONFIDENCE it is using is not working very properly. This quirk is originally designed for some WIn7 touchscreens. Use of this for a Win8 Precision Touchpad will cause unexpected pointer jumping problem.
--- drivers/hid/hid-multitouch.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/hid/hid-multitouch.c +0 -5
@@ -502,11 +502,6 @@ static int mt_touch_input_mapping(structmt_store_field (usage, td, hi);return 1 ;case HID_DG_CONFIDENCE : -if (cls->name ==MT_CLS_WIN_8 && - field->application ==HID_DG_TOUCHPAD ) { - cls->quirks &= ~MT_QUIRK_ALWAYS_VALID ; - cls->quirks |=MT_QUIRK_VALID_IS_CONFIDENCE ; - }mt_store_field (usage, td, hi);return 1 ;case HID_DG_TIPSWITCH :
Greg Kroah-Hartman
maintainerPATCH 85/203 HID: multitouch: enable palm rejection for Windows Precision Touchpad
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allen Hung <[email protected]>
commit 6dd2e27a103d716921cc4a1a96a9adc0a8e3ab57 upstream.
The usage Confidence is mandary to Windows Precision Touchpad devices. If it is examined in input_mapping on a WIndows Precision Touchpad, a new add quirk MT_QUIRK_CONFIDENCE desgned for such devices will be applied to the device. A touch with the confidence bit is not set is determined as invalid.
Tested on Dell XPS13 9343
--- drivers/hid/hid-multitouch.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/hid/hid-multitouch.c +15 -3
@@ -61,6 +61,7 @@ MODULE_LICENSE("GPL");#define MT_QUIRK_ALWAYS_VALID (1 << 4)#define MT_QUIRK_VALID_IS_INRANGE (1 << 5)#define MT_QUIRK_VALID_IS_CONFIDENCE (1 << 6) +#define MT_QUIRK_CONFIDENCE (1 << 7)#define MT_QUIRK_SLOT_IS_CONTACTID_MINUS_ONE (1 << 8)#define MT_QUIRK_NO_AREA (1 << 9)#define MT_QUIRK_IGNORE_DUPLICATES (1 << 10)
@@ -78,6 +79,7 @@ struct mt_slot {__s32 contactid;/* the device ContactID assigned to this slot */ bool touch_state;/* is the touch valid? */ bool inrange_state;/* is the finger in proximity of the sensor? */ +bool confidence_state;/* is the touch made by a finger? */ };struct mt_class {
@@ -502,6 +504,9 @@ static int mt_touch_input_mapping(structmt_store_field (usage, td, hi);return 1 ;case HID_DG_CONFIDENCE : +if (cls->name ==MT_CLS_WIN_8 && + field->application ==HID_DG_TOUCHPAD ) + cls->quirks |=MT_QUIRK_CONFIDENCE ;mt_store_field (usage, td, hi);return 1 ;case HID_DG_TIPSWITCH :
@@ -614,6 +619,7 @@ static void mt_complete_slot(struct mt_dreturn ;if (td->curvalid || (td->mtclass.quirks &MT_QUIRK_ALWAYS_VALID )) { +int active;int slotnum =mt_compute_slot (td, input);struct mt_slot *s = &td->curdata;struct input_mt *mt = input->mt;
@@ -628,10 +634,14 @@ static void mt_complete_slot(struct mt_dreturn ; } +if (!(td->mtclass.quirks &MT_QUIRK_CONFIDENCE )) + s->confidence_state =1 ; + active = (s->touch_state || s->inrange_state) && + s->confidence_state; +input_mt_slot (input, slotnum); -input_mt_report_slot_state (input,MT_TOOL_FINGER , - s->touch_state || s->inrange_state); -if (s->touch_state || s->inrange_state) { +input_mt_report_slot_state (input,MT_TOOL_FINGER , active); +if (active) {/* this finger is in proximity of the sensor */ int wide = (s->w > s->h);/* divided by two to match visual scale of touch */
@@ -696,6 +706,8 @@ static void mt_process_mt_event(struct h td->curdata.touch_state = value;break ;case HID_DG_CONFIDENCE : +if (quirks &MT_QUIRK_CONFIDENCE ) + td->curdata.confidence_state = value;if (quirks &MT_QUIRK_VALID_IS_CONFIDENCE ) td->curvalid = value;break ;
Greg Kroah-Hartman
maintainerPATCH 86/203 tracing: Handle NULL formats in hold_module_trace_bprintk_format()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Red Hat) <[email protected]>
commit 70c8217acd4383e069fe1898bbad36ea4fcdbdcc upstream.
If a task uses a non constant string for the format parameter in trace_printk(), then the trace_printk_fmt variable is set to NULL. This variable is then saved in the __trace_printk_fmt section.
The function hold_module_trace_bprintk_format() checks to see if duplicate formats are used by modules, and reuses them if so (saves them to the list if it is new). But this function calls lookup_format() that does a strcmp() to the value (which is now NULL) and can cause a kernel oops.
This wasn't an issue till 3debb0a9ddb ("tracing: Fix trace_printk() to print when not using bprintk()") which added "__used" to the trace_printk_fmt variable, and before that, the kernel simply optimized it out (no NULL value was saved).
The fix is simply to handle the NULL pointer in lookup_format() and have the caller ignore the value if it was NULL.
--- kernel/trace/trace_printk.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/trace/trace_printk.c +6 -1
@@ -36,6 +36,10 @@ struct trace_bprintk_fmt {static inline struct trace_bprintk_fmt *lookup_format (const char *fmt) {struct trace_bprintk_fmt *pos; + +if (!fmt) +return ERR_PTR (-EINVAL ); +list_for_each_entry (pos, &trace_bprintk_fmt_list, list) {if (!strcmp (pos->fmt, fmt))return pos;
@@ -57,7 +61,8 @@ void hold_module_trace_bprintk_format(cofor (iter = start; iter < end; iter++) {struct trace_bprintk_fmt *tb_fmt =lookup_format (*iter);if (tb_fmt) { - *iter = tb_fmt->fmt; +if (!IS_ERR (tb_fmt)) + *iter = tb_fmt->fmt;continue ; }
Greg Kroah-Hartman
maintainerPATCH 87/203 base: make module_create_drivers_dir race-free
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby <[email protected]>
commit 7e1b1fc4dabd6ec8e28baa0708866e13fa93c9b3 upstream.
Modules which register drivers via standard path (driver_register) in parallel can cause a warning:
WARNING: CPU: 2 PID: 3492 at ../fs/sysfs/dir.c:31 sysfs_warn_dup+0x62/0x80 sysfs: cannot create duplicate filename '/module/saa7146/drivers' Modules linked in: hexium_gemini(+) mxb(+) ... ... Call Trace: ... [<ffffffff812e63a2>] sysfs_warn_dup+0x62/0x80 [<ffffffff812e6487>] sysfs_create_dir_ns+0x77/0x90 [<ffffffff8140f2c4>] kobject_add_internal+0xb4/0x340 [<ffffffff8140f5b8>] kobject_add+0x68/0xb0 [<ffffffff8140f631>] kobject_create_and_add+0x31/0x70 [<ffffffff8157a703>] module_add_driver+0xc3/0xd0 [<ffffffff8155e5d4>] bus_add_driver+0x154/0x280 [<ffffffff815604c0>] driver_register+0x60/0xe0 [<ffffffff8145bed0>] __pci_register_driver+0x60/0x70 [<ffffffffa0273e14>] saa7146_register_extension+0x64/0x90 [saa7146] [<ffffffffa0033011>] hexium_init_module+0x11/0x1000 [hexium_gemini]
...
As can be (mostly) seen, driver_register causes this call sequence:
-> bus_add_driver
-> module_add_driver
-> module_create_drivers_dirThe last one creates "drivers" directory in /sys/module/<...>. When this is done in parallel, the directory is attempted to be created twice at the same time.
This can be easily reproduced by loading mxb and hexium_gemini in parallel:
while :; do
modprobe mxb &
modprobe hexium_gemini
wait
rmmod mxb hexium_gemini saa7146_vv saa7146
done
saa7146 calls pci_register_driver for both mxb and hexium_gemini, which means /sys/module/saa7146/drivers is to be created for both of them.
Fix this by a new mutex in module_create_drivers_dir which makes the test-and-create "drivers" dir atomic.
I inverted the condition and removed 'return' to avoid multiple unlocks or a goto.
--- drivers/base/module.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/base/module.c +5 -3
@@ -24,10 +24,12 @@ static char *make_driver_name(struct devstatic void module_create_drivers_dir (struct module_kobject *mk) { -if (!mk || mk->drivers_dir) -return ; +static DEFINE_MUTEX (drivers_dir_mutex); - mk->drivers_dir =kobject_create_and_add ("drivers" , &mk->kobj); +mutex_lock (&drivers_dir_mutex); +if (mk && !mk->drivers_dir) + mk->drivers_dir =kobject_create_and_add ("drivers" , &mk->kobj); +mutex_unlock (&drivers_dir_mutex); }void module_add_driver (struct module *mod,struct device_driver *drv)
Greg Kroah-Hartman
maintainerPATCH 88/203 iommu/rockchip: Fix zap cache during device attach
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
commit ae8a7910fb0568531033bd6ebe65590f7a4fa6e2 upstream.
rk_iommu_command() takes a struct rk_iommu and iterates over the slave MMUs, so this is doubly wrong in that we're passing in the wrong pointer and talking to MMUs that we shouldn't be.
--- drivers/iommu/rockchip-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/rockchip-iommu.c +1 -1
@@ -815,7 +815,7 @@ static int rk_iommu_attach_device(struct dte_addr =virt_to_phys (rk_domain->dt);for (i =0 ; i < iommu->num_mmu; i++) {rk_iommu_write (iommu->bases[i],RK_MMU_DTE_ADDR , dte_addr); -rk_iommu_command (iommu->bases[i],RK_MMU_CMD_ZAP_CACHE ); +rk_iommu_base_command (iommu->bases[i],RK_MMU_CMD_ZAP_CACHE );rk_iommu_write (iommu->bases[i],RK_MMU_INT_MASK ,RK_MMU_IRQ_MASK ); }
Greg Kroah-Hartman
maintainerPATCH 89/203 iommu/arm-smmu: Wire up map_sg for arm-smmu-v3
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Philippe Brucker <[email protected]>
commit 9aeb26cfc2abc96be42b9df2d0f2dc5d805084ff upstream.
The map_sg callback is missing from arm_smmu_ops, but is required by iommu.h. Similarly to most other IOMMU drivers, connect it to default_iommu_map_sg.
--- drivers/iommu/arm-smmu-v3.c | 1 + 1 file changed, 1 insertion(+)
drivers/iommu/arm-smmu-v3.c +1 -0
@@ -1942,6 +1942,7 @@ static struct iommu_ops arm_smmu_ops = { .attach_dev = arm_smmu_attach_dev, .map = arm_smmu_map, .unmap = arm_smmu_unmap, + .map_sg = default_iommu_map_sg, .iova_to_phys = arm_smmu_iova_to_phys, .add_device = arm_smmu_add_device, .remove_device = arm_smmu_remove_device,
Greg Kroah-Hartman
maintainerPATCH 90/203 iommu/vt-d: Enable QI on all IOMMUs before setting root entry
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <[email protected]>
commit a4c34ff1c029e90e7d5f8dd8d29b0a93b31c3cb2 upstream.
This seems to be required on some X58 chipsets on systems with more than one IOMMU. QI does not work until it is enabled on all IOMMUs in the system.
--- drivers/iommu/intel-iommu.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/iommu/intel-iommu.c +12 -5
@@ -3169,11 +3169,6 @@ static int __init init_dmars(void) } } -iommu_flush_write_buffer (iommu); -iommu_set_root_entry (iommu); - iommu->flush.flush_context (iommu,0 ,0 ,0 ,DMA_CCMD_GLOBAL_INVL ); - iommu->flush.flush_iotlb (iommu,0 ,0 ,0 ,DMA_TLB_GLOBAL_FLUSH ); -if (!ecap_pass_through (iommu->ecap)) hw_pass_through =0 ;#ifdef CONFIG_INTEL_IOMMU_SVM
@@ -3182,6 +3177,18 @@ static int __init init_dmars(void)#endif } +/* +* Now that qi is enabled on all iommus, set the root entry and flush +* caches. This is required on some Intel X58 chipsets, otherwise the +* flush_context function will loop forever and the boot hangs. +*/ +for_each_active_iommu (iommu, drhd) { +iommu_flush_write_buffer (iommu); +iommu_set_root_entry (iommu); + iommu->flush.flush_context (iommu,0 ,0 ,0 ,DMA_CCMD_GLOBAL_INVL ); + iommu->flush.flush_iotlb (iommu,0 ,0 ,0 ,DMA_TLB_GLOBAL_FLUSH ); + } +if (iommu_pass_through) iommu_identity_mapping |=IDENTMAP_ALL ;
Greg Kroah-Hartman
maintainerPATCH 91/203 iommu/amd: Fix unity mapping initialization race
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <[email protected]>
commit 522e5cb76d0663c88f96b6a8301451c8efa37207 upstream.
There is a race condition in the AMD IOMMU init code that causes requested unity mappings to be blocked by the IOMMU for a short period of time. This results on boot failures and IO_PAGE_FAULTs on some machines.
Fix this by making sure the unity mappings are installed before all other DMA is blocked.
--- drivers/iommu/amd_iommu_init.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/iommu/amd_iommu_init.c +12 -2
@@ -1363,13 +1363,23 @@ static int __init amd_iommu_init_pci(voibreak ; } +/* +* Order is important here to make sure any unity map requirements are +* fulfilled. The unity mappings are created and written to the device +* table during the amd_iommu_init_api() call. +* +* After that we call init_device_table_dma() to make sure any +* uninitialized DTE will block DMA, and in the end we flush the caches +* of all IOMMUs to make sure the changes to the device table are +* active. +*/ + ret =amd_iommu_init_api (); +init_device_table_dma ();for_each_iommu (iommu)iommu_flush_all_caches (iommu); - ret =amd_iommu_init_api (); -if (!ret)print_iommu_info ();
Greg Kroah-Hartman
maintainerPATCH 92/203 apparmor: fix oops, validate buffer size in apparmor_setprocattr()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vegard Nossum <[email protected]>
commit 30a46a4647fd1df9cf52e43bf467f0d9265096ca upstream.
When proc_pid_attr_write() was changed to use memdup_user apparmor's (interface violating) assumption that the setprocattr buffer was always a single page was violated.
The size test is not strictly speaking needed as proc_pid_attr_write() will reject anything larger, but for the sake of robustness we can keep it in.
SMACK and SELinux look safe to me, but somebody else should probably have a look just in case.
Based on original patch from Vegard Nossum <[email protected]> modified for the case that apparmor provides null termination.
--- security/apparmor/lsm.c | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-)
security/apparmor/lsm.c +19 -17
@@ -523,34 +523,34 @@ static int apparmor_setprocattr(struct t {struct common_audit_data sa;struct apparmor_audit_data aad = {0 ,}; -char *command, *args = value; +char *command, *largs =NULL , *args = value;size_t arg_size;int error;if (size ==0 )return -EINVAL ; -/* args points to a PAGE_SIZE buffer, AppArmor requires that -* the buffer must be null terminated or have size <= PAGE_SIZE -1 -* so that AppArmor can null terminate them -*/ -if (args[size -1 ] !='\0' ) { -if (size ==PAGE_SIZE ) -return -EINVAL ; - args[size] ='\0' ; - } -/* task can only write its own attributes */ if (current != task)return -EACCES ; - args = value; +/* AppArmor requires that the buffer must be null terminated atm */ +if (args[size -1 ] !='\0' ) { +/* null terminate */ + largs = args =kmalloc (size +1 ,GFP_KERNEL ); +if (!args) +return -ENOMEM ; +memcpy (args, value, size); + args[size] ='\0' ; + } + + error = -EINVAL ; args =strim (args); command =strsep (&args," " );if (!args) -return -EINVAL ; + goto out; args =skip_spaces (args);if (!*args) -return -EINVAL ; + goto out; arg_size = size - (args - (char *) value);if (strcmp (name,"current" ) ==0 ) {
@@ -576,10 +576,12 @@ static int apparmor_setprocattr(struct t goto fail; }else /* only support the "current" and "exec" process attributes */ -return -EINVAL ; + goto fail;if (!error) error = size; +out: +kfree (largs);return error; fail:
@@ -588,9 +590,9 @@ fail: aad.profile =aa_current_profile (); aad.op =OP_SETPROCATTR ; aad.info = name; - aad.error = -EINVAL ; + aad.error = error = -EINVAL ;aa_audit_msg (AUDIT_APPARMOR_DENIED , &sa,NULL ); -return -EINVAL ; + goto out; } static int apparmor_task_setrlimit(struct task_struct *task,
Greg Kroah-Hartman
maintainerPATCH 93/203 drm/mgag200: Black screen fix for G200e rev 4
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Larouche <[email protected]>
commit d3922b69617b62bb2509936b68301f837229d9f0 upstream.
- Fixed black screen for some resolutions of G200e rev4
- Fixed testm & testn which had predetermined value.
--- drivers/gpu/drm/mgag200/mgag200_mode.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/gpu/drm/mgag200/mgag200_mode.c +9 -1
@@ -182,7 +182,7 @@ static int mga_g200se_set_plls(struct mg } } - fvv = pllreffreq * testn / testm; + fvv = pllreffreq * (n +1 ) / (m +1 ); fvv = (fvv -800000 ) /50000 ;if (fvv >15 )
@@ -202,6 +202,14 @@ static int mga_g200se_set_plls(struct mgWREG_DAC (MGA1064_PIX_PLLC_M , m);WREG_DAC (MGA1064_PIX_PLLC_N , n);WREG_DAC (MGA1064_PIX_PLLC_P , p); + +if (mdev->unique_rev_id >=0x04 ) { +WREG_DAC (0x1a ,0x09 ); +msleep (20 ); +WREG_DAC (0x1a ,0x01 ); + + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 94/203 drm/fsl-dcu: use flat regmap cache
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <[email protected]>
commit ce492b3b8f99cf9d2f807ec22d8805c996a09503 upstream.
Using flat regmap cache instead of RB-tree to avoid the following lockdep warning on driver load:
WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:2755 lockdep_trace_alloc+0x15c/0x160()
DEBUG_LOCKS_WARN_ON(irqs_disabled_flags(flags))
The RB-tree regmap cache needs to allocate new space on first writes. However, allocations in an atomic context (e.g. when a spinlock is held) are not allowed. The function regmap_write calls map->lock, which acquires a spinlock in the fast_io case. Since the FSL DCU driver uses MMIO, the regmap bus of type regmap_mmio is being used which has fast_io set to true.
Use flat regmap cache and specify max register to be large enouth to cover all registers available in LS1021a and Vybrids register space.
--- drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +2 -1
@@ -40,9 +40,10 @@ static const struct regmap_config fsl_dc .reg_bits = 32, .reg_stride = 4, .val_bits = 32, - .cache_type = REGCACHE_RBTREE, + .cache_type = REGCACHE_FLAT, .volatile_reg = fsl_dcu_drm_is_volatile_reg, + .max_register = 0x11fc, };static int fsl_dcu_drm_irq_init (struct drm_device *dev)
Greg Kroah-Hartman
maintainerPATCH 95/203 ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junichi Nomura <[email protected]>
commit ae4ea9a2460c7fee2ae8feeb4dfe96f5f6c3e562 upstream.
Commit 7ea0ed2b5be8 ("ipmi: Make the message handler easier to use for SMI interfaces") changed handle_new_recv_msgs() to call handle_one_recv_msg() for a smi_msg while the smi_msg is still connected to waiting_rcv_msgs list. That could lead to following list corruption problems:
1) low-level function treats smi_msg as not connected to list
handle_one_recv_msg() could end up calling smi_send(), which assumes the msg is not connected to list.
For example, the following sequence could corrupt list by doing list_add_tail() for the entry still connected to other list.
handle_new_recv_msgs()
msg = list_entry(waiting_rcv_msgs)
handle_one_recv_msg(msg)
handle_ipmb_get_msg_cmd(msg)
smi_send(msg)
spin_lock(xmit_msgs_lock)
list_add_tail(msg)
spin_unlock(xmit_msgs_lock)
2) race between multiple handle_new_recv_msgs() instances
handle_new_recv_msgs() once releases waiting_rcv_msgs_lock before calling handle_one_recv_msg() then retakes the lock and list_del() it.
If others call handle_new_recv_msgs() during the window shown below list_del() will be done twice for the same smi_msg.
handle_new_recv_msgs()
spin_lock(waiting_rcv_msgs_lock)
msg = list_entry(waiting_rcv_msgs)
spin_unlock(waiting_rcv_msgs_lock)
| | handle_one_recv_msg(msg) |
spin_lock(waiting_rcv_msgs_lock)
list_del(msg)
spin_unlock(waiting_rcv_msgs_lock)
--- drivers/char/ipmi/ipmi_msghandler.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/char/ipmi/ipmi_msghandler.c +6 -2
@@ -3820,6 +3820,7 @@ static void handle_new_recv_msgs(ipmi_smwhile (!list_empty (&intf->waiting_rcv_msgs)) { smi_msg =list_entry (intf->waiting_rcv_msgs.next, struct ipmi_smi_msg, link); +list_del (&smi_msg->link);if (!run_to_completion)spin_unlock_irqrestore (&intf->waiting_rcv_msgs_lock, flags);
@@ -3829,11 +3830,14 @@ static void handle_new_recv_msgs(ipmi_smif (rv >0 ) {/* * To preserve message order, quit if we -* can't handle a message. +* can't handle a message. Add the message +* back at the head, this is safe because this +* tasklet is the only thing that pulls the +* messages. */ +list_add (&smi_msg->link, &intf->waiting_rcv_msgs);break ; }else { -list_del (&smi_msg->link);if (rv ==0 )/* Message handled */ ipmi_free_smi_msg (smi_msg);
Greg Kroah-Hartman
maintainerPATCH 96/203 drm/nouveau/Revert "drm/nouveau/device/pci: set as non-CPU-coherent on ARM64"
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
commit 539aae6e3af97c7ec1602ff23e805f2852c2611c upstream.
This reverts commit 1733a2ad36741b1812cf8b3f3037c28d0af53f50.
There is apparently something amiss with the way the TTM code handles DMA buffers, which the above commit was attempting to work around for arm64 systems with non-coherent PCI. Unfortunately, this completely breaks systems *with* coherent PCI (which appear to be the majority).
Booting a plain arm64 defconfig + CONFIG_DRM + CONFIG_DRM_NOUVEAU on a machine with a PCI GPU having coherent dma_map_ops (in this case a 7600GT card plugged into an ARM Juno board) results in a fatal crash:
[ 2.803438] nouveau 0000:06:00.0: DRM: allocated 1024x768 fb: 0x9000, bo ffffffc976141c00 [ 2.897662] Unable to handle kernel NULL pointer dereference at virtual address 000001ac [ 2.897666] pgd = ffffff8008e00000 [ 2.897675] [000001ac] *pgd=00000009ffffe003, *pud=00000009ffffe003, *pmd=0000000000000000 [ 2.897680] Internal error: Oops: 96000045 [#1] PREEMPT SMP [ 2.897685] Modules linked in: [ 2.897692] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.6.0-rc5+ #543 [ 2.897694] Hardware name: ARM Juno development board (r1) (DT) [ 2.897699] task: ffffffc9768a0000 ti: ffffffc9768a8000 task.ti: ffffffc9768a8000 [ 2.897711] PC is at __memcpy+0x7c/0x180 [ 2.897719] LR is at OUT_RINGp+0x34/0x70 [ 2.897724] pc : [<ffffff80083465fc>] lr : [<ffffff800854248c>] pstate: 80000045 [ 2.897726] sp : ffffffc9768ab360 [ 2.897732] x29: ffffffc9768ab360 x28: 0000000000000001 [ 2.897738] x27: ffffffc97624c000 x26: 0000000000000000 [ 2.897744] x25: 0000000000000080 x24: 0000000000006c00 [ 2.897749] x23: 0000000000000005 x22: ffffffc97624c010 [ 2.897755] x21: 0000000000000004 x20: 0000000000000004 [ 2.897761] x19: ffffffc9763da000 x18: ffffffc976b2491c [ 2.897766] x17: 0000000000000007 x16: 0000000000000006 [ 2.897771] x15: 0000000000000001 x14: 0000000000000001 [ 2.897777] x13: 0000000000e31b70 x12: ffffffc9768a0080 [ 2.897783] x11: 0000000000000000 x10: fffffffffffffb00 [ 2.897788] x9 : 0000000000000000 x8 : 0000000000000000 [ 2.897793] x7 : 0000000000000000 x6 : 00000000000001ac [ 2.897799] x5 : 00000000ffffffff x4 : 0000000000000000 [ 2.897804] x3 : 0000000000000010 x2 : 0000000000000010 [ 2.897810] x1 : ffffffc97624c010 x0 : 00000000000001ac ... [ 2.898494] Call trace: [ 2.898499] Exception stack(0xffffffc9768ab1a0 to 0xffffffc9768ab2c0) [ 2.898506] b1a0: ffffffc9763da000 0000000000000004 ffffffc9768ab360 ffffff80083465fc [ 2.898513] b1c0: ffffffc976801e00 ffffffc9762b8000 ffffffc9768ab1f0 ffffff80080ec158 [ 2.898520] b1e0: ffffffc9768ab230 ffffff8008496d04 ffffffc975ce6d80 ffffffc9768ab36e [ 2.898527] b200: ffffffc9768ab36f ffffffc9768ab29d ffffffc9768ab29e ffffffc9768a0000 [ 2.898533] b220: ffffffc9768ab250 ffffff80080e70c0 ffffffc9768ab270 ffffff8008496e44 [ 2.898540] b240: 00000000000001ac ffffffc97624c010 0000000000000010 0000000000000010 [ 2.898546] b260: 0000000000000000 00000000ffffffff 00000000000001ac 0000000000000000 [ 2.898552] b280: 0000000000000000 0000000000000000 fffffffffffffb00 0000000000000000 [ 2.898558] b2a0: ffffffc9768a0080 0000000000e31b70 0000000000000001 0000000000000001 [ 2.898566] [<ffffff80083465fc>] __memcpy+0x7c/0x180 [ 2.898574] [<ffffff800853e164>] nv04_fbcon_imageblit+0x1d4/0x2e8 [ 2.898582] [<ffffff800853d6d0>] nouveau_fbcon_imageblit+0xd8/0xe0 [ 2.898591] [<ffffff80083c4db4>] soft_cursor+0x154/0x1d8 [ 2.898598] [<ffffff80083c47b4>] bit_cursor+0x4fc/0x538 [ 2.898605] [<ffffff80083c0cfc>] fbcon_cursor+0x134/0x1a8 [ 2.898613] [<ffffff800841c280>] hide_cursor+0x38/0xa0 [ 2.898620] [<ffffff800841d420>] redraw_screen+0x120/0x228 [ 2.898628] [<ffffff80083bf268>] fbcon_prepare_logo+0x370/0x3f8 [ 2.898635] [<ffffff80083bf640>] fbcon_init+0x350/0x560 [ 2.898641] [<ffffff800841c634>] visual_init+0xac/0x108 [ 2.898648] [<ffffff800841df14>] do_bind_con_driver+0x1c4/0x3a8 [ 2.898655] [<ffffff800841e4f4>] do_take_over_console+0x174/0x1e8 [ 2.898662] [<ffffff80083bf8c4>] do_fbcon_takeover+0x74/0x100 [ 2.898669] [<ffffff80083c3e44>] fbcon_event_notify+0x8cc/0x920 [ 2.898680] [<ffffff80080d7e38>] notifier_call_chain+0x50/0x90 [ 2.898685] [<ffffff80080d8214>] __blocking_notifier_call_chain+0x4c/0x90 [ 2.898691] [<ffffff80080d826c>] blocking_notifier_call_chain+0x14/0x20 [ 2.898696] [<ffffff80083c5e1c>] fb_notifier_call_chain+0x1c/0x28 [ 2.898703] [<ffffff80083c81ac>] register_framebuffer+0x1cc/0x2e0 [ 2.898712] [<ffffff800845da80>] drm_fb_helper_initial_config+0x288/0x3e8 [ 2.898719] [<ffffff800853da20>] nouveau_fbcon_init+0xe0/0x118 [ 2.898727] [<ffffff800852d2f8>] nouveau_drm_load+0x268/0x890 [ 2.898734] [<ffffff8008466e24>] drm_dev_register+0xbc/0xc8 [ 2.898740] [<ffffff8008468a88>] drm_get_pci_dev+0xa0/0x180 [ 2.898747] [<ffffff800852cb28>] nouveau_drm_probe+0x1a0/0x1e0 [ 2.898755] [<ffffff80083a32e0>] pci_device_probe+0x98/0x110 [ 2.898763] [<ffffff800858e434>] driver_probe_device+0x204/0x2b0 [ 2.898770] [<ffffff800858e58c>] __driver_attach+0xac/0xb0 [ 2.898777] [<ffffff800858c3e0>] bus_for_each_dev+0x60/0xa0 [ 2.898783] [<ffffff800858dbc0>] driver_attach+0x20/0x28 [ 2.898789] [<ffffff800858d7b0>] bus_add_driver+0x1d0/0x238 [ 2.898796] [<ffffff800858ed50>] driver_register+0x60/0xf8 [ 2.898802] [<ffffff80083a20dc>] __pci_register_driver+0x3c/0x48 [ 2.898809] [<ffffff8008468eb4>] drm_pci_init+0xf4/0x120 [ 2.898818] [<ffffff8008c56fc0>] nouveau_drm_init+0x21c/0x230 [ 2.898825] [<ffffff80080829d4>] do_one_initcall+0x8c/0x190 [ 2.898832] [<ffffff8008c31af4>] kernel_init_freeable+0x14c/0x1f0 [ 2.898839] [<ffffff80088a0c20>] kernel_init+0x10/0x100 [ 2.898845] [<ffffff8008085e10>] ret_from_fork+0x10/0x40 [ 2.898853] Code: a88120c7 a8c12027 a88120c7 a8c12027 (a88120c7) [ 2.898871] ---[ end trace d5713dcad023ee04 ]--- [ 2.898888] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
In a toss-up between the GPU seeing stale data artefacts on some systems vs. catastrophic kernel crashes on other systems, the latter would seem to take precedence, so revert this change until the real underlying problem can be fixed.
--- drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c +1 -1
@@ -1614,7 +1614,7 @@ nvkm_device_pci_func = { .fini = nvkm_device_pci_fini, .resource_addr = nvkm_device_pci_resource_addr, .resource_size = nvkm_device_pci_resource_size, - .cpu_coherent = !IS_ENABLED(CONFIG_ARM) && !IS_ENABLED(CONFIG_ARM64), + .cpu_coherent = !IS_ENABLED(CONFIG_ARM), };int
Greg Kroah-Hartman
maintainerPATCH 97/203 arm64: fix dump_instr when PAN and UAO are in use
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit c5cea06be060f38e5400d796e61cfc8c36e52924 upstream.
If the kernel is set to show unhandled signals, and a user task does not handle a SIGILL as a result of an instruction abort, we will attempt to log the offending instruction with dump_instr before killing the task.
We use dump_instr to log the encoding of the offending userspace instruction. However, dump_instr is also used to dump instructions from kernel space, and internally always switches to KERNEL_DS before dumping the instruction with get_user. When both PAN and UAO are in use, reading a user instruction via get_user while in KERNEL_DS will result in a permission fault, which leads to an Oops.
As we have regs corresponding to the context of the original instruction abort, we can inspect this and only flip to KERNEL_DS if the original abort was taken from the kernel, avoiding this issue. At the same time, remove the redundant (and incorrect) comments regarding the order dump_mem and dump_instr are called in.
--- arch/arm64/kernel/traps.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
arch/arm64/kernel/traps.c +13 -13
@@ -64,8 +64,7 @@ static void dump_mem(const char *lvl, co/* * We need to switch to kernel mode so that we can use __get_user -* to safely read from kernel space. Note that we now dump the -* code first, just in case the backtrace kills us. +* to safely read from kernel space. */ fs =get_fs ();set_fs (KERNEL_DS );
@@ -111,21 +110,12 @@ static void dump_backtrace_entry(unsigneprint_ip_sym (where); } -static void dump_instr (const char *lvl,struct pt_regs *regs) +static void __dump_instr (const char *lvl,struct pt_regs *regs) {unsigned long addr =instruction_pointer (regs); -mm_segment_t fs;char str[sizeof ("00000000 " ) *5 +2 +1 ], *p = str;int i; -/* -* We need to switch to kernel mode so that we can use __get_user -* to safely read from kernel space. Note that we now dump the -* code first, just in case the backtrace kills us. -*/ - fs =get_fs (); -set_fs (KERNEL_DS ); -for (i =-4 ; i <1 ; i++) {unsigned int val, bad;
@@ -139,8 +129,18 @@ static void dump_instr(const char *lvl, } }printk ("%sCode: %s\n" , lvl, str); +} -set_fs (fs); +static void dump_instr (const char *lvl,struct pt_regs *regs) +{ +if (!user_mode (regs)) { +mm_segment_t fs =get_fs (); +set_fs (KERNEL_DS ); +__dump_instr (lvl, regs); +set_fs (fs); + }else { +__dump_instr (lvl, regs); + } }static void dump_backtrace (struct pt_regs *regs,struct task_struct *tsk)
Greg Kroah-Hartman
maintainerPATCH 98/203 arm64: mm: remove page_mapping check in __sync_icache_dcache
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaokun Zhang <[email protected]>
commit 20c27a4270c775d7ed661491af8ac03264d60fc6 upstream.
__sync_icache_dcache unconditionally skips the cache maintenance for anonymous pages, under the assumption that flushing is only required in the presence of D-side aliases [see 7249b79f6b4cc ("arm64: Do not flush the D-cache for anonymous pages")].
Unfortunately, this breaks migration of anonymous pages holding self-modifying code, where userspace cannot be reasonably expected to reissue maintenance instructions in response to a migration.
This patch fixes the problem by removing the broken page_mapping(page) check from the cache syncing code, otherwise we may end up fetching and executing stale instructions from the PoU.
--- arch/arm64/mm/flush.c | 4 ---- 1 file changed, 4 deletions(-)
arch/arm64/mm/flush.c +0 -4
@@ -71,10 +71,6 @@ void __sync_icache_dcache(pte_t pte, uns {struct page *page =pte_page (pte); -/* no flushing needed for anonymous pages */ -if (!page_mapping (page)) -return ; -if (!test_and_set_bit (PG_dcache_clean, &page->flags))sync_icache_aliases (page_address (page),PAGE_SIZE <<compound_order (page));
Greg Kroah-Hartman
maintainerPATCH 99/203 arm64: kernel: Save and restore UAO and addr_limit on exception entry
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
commit e19a6ee2460bdd0d0055a6029383422773f9999a upstream.
If we take an exception while at EL1, the exception handler inherits the original context's addr_limit and PSTATE.UAO values. To be consistent always reset addr_limit and PSTATE.UAO on (re-)entry to EL1. This prevents accidental re-use of the original context's addr_limit.
Based on a similar patch for arm from Russell King.
--- arch/arm64/include/asm/ptrace.h | 2 ++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kernel/entry.S | 19 +++++++++++++++++-- arch/arm64/mm/fault.c | 3 ++- 4 files changed, 22 insertions(+), 3 deletions(-)
arch/arm64/include/asm/ptrace.h +2 -0
@@ -117,6 +117,8 @@ struct pt_regs { };u64 orig_x0;u64 syscallno; +u64 orig_addr_limit; +u64 unused;// maintain 16 byte alignment };#define arch_has_single_step () (1)
arch/arm64/kernel/asm-offsets.c +1 -0
@@ -59,6 +59,7 @@ int main(void)DEFINE (S_PC , offsetof(struct pt_regs , pc));DEFINE (S_ORIG_X0 , offsetof(struct pt_regs , orig_x0));DEFINE (S_SYSCALLNO , offsetof(struct pt_regs , syscallno)); +DEFINE (S_ORIG_ADDR_LIMIT , offsetof(struct pt_regs , orig_addr_limit));DEFINE (S_FRAME_SIZE ,sizeof (struct pt_regs ));BLANK (); DEFINE(MM_CONTEXT_ID, offsetof(struct mm_struct, context.id.counter));
arch/arm64/kernel/entry.S +17 -2
@@ -28,6 +28,7 @@ #include <asm/errno.h> #include <asm/esr.h> #include <asm/irq.h> +#include <asm/memory.h> #include <asm/thread_info.h> #include <asm/unistd.h>
@@ -97,7 +98,14 @@ mov x29, xzr // fp pointed to user-space .else add x21, sp, #S_FRAME_SIZE - .endif + get_thread_info tsk + /* Save the task's original addr_limit and set USER_DS (TASK_SIZE_64) */ + ldr x20, [tsk, #TI_ADDR_LIMIT] + str x20, [sp, #S_ORIG_ADDR_LIMIT] + mov x20, #TASK_SIZE_64 + str x20, [tsk, #TI_ADDR_LIMIT] + ALTERNATIVE(nop, SET_PSTATE_UAO(0), ARM64_HAS_UAO, CONFIG_ARM64_UAO) + .endif /* \el == 0 */ mrs x22, elr_el1 mrs x23, spsr_el1 stp lr, x21, [sp, #S_LR]
@@ -128,6 +136,14 @@ .endm .macro kernel_exit, el + .if \el != 0 + /* Restore the task's original addr_limit. */ + ldr x20, [sp, #S_ORIG_ADDR_LIMIT] + str x20, [tsk, #TI_ADDR_LIMIT] + + /* No need to restore UAO, it will be restored from SPSR_EL1 */ + .endif + ldp x21, x22, [sp, #S_PC] // load ELR, SPSR .if \el == 0 ct_user_enter
@@ -406,7 +422,6 @@ el1_irq: bl trace_hardirqs_off #endif - get_thread_info tsk irq_handler #ifdef CONFIG_PREEMPT
arch/arm64/mm/fault.c +2 -1
@@ -284,7 +284,8 @@ static int __kprobes do_page_fault(unsig }if (permission_fault (esr) && (addr <USER_DS )) { -if (get_fs () ==KERNEL_DS ) +/* regs->orig_addr_limit may be 0 if we entered from EL0 */ +if (regs->orig_addr_limit ==KERNEL_DS )die ("Accessing user space memory with fs=KERNEL_DS" , regs, esr);if (!search_exception_tables (regs->pc))
Greg Kroah-Hartman
maintainerPATCH 100/203 vfs: add d_real_inode() helper
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit a118084432d642eeccb961c7c8cc61525a941fcb upstream.
Needed by the following fix.
--- include/linux/dcache.h | 12 ++++++++++++ 1 file changed, 12 insertions(+)
include/linux/dcache.h +12 -0
@@ -576,5 +576,17 @@ static inline struct inode *vfs_select_i return inode; } +/** +* d_real_inode - Return the real inode +* @dentry: The dentry to query +* +* If dentry is on an union/overlay, then return the underlying, real inode. +* Otherwise return d_inode(). +*/ +static inline struct inode *d_real_inode (struct dentry *dentry) +{ +return d_backing_inode (d_real (dentry)); +} +#endif /* __LINUX_DCACHE_H */
Greg Kroah-Hartman
maintainerPATCH 101/203 af_unix: fix hard linked sockets on overlay
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit eb0a4a47ae89aaa0674ab3180de6a162f3be2ddf upstream.
Overlayfs uses separate inodes even in the case of hard links on the underlying filesystems. This is a problem for AF_UNIX socket implementation which indexes sockets based on the inode. This resulted in hard linked sockets not working.
The fix is to use the real, underlying inode.
Test case follows:
-- ovl-sock-test.c --
#include <unistd.h>
#include <err.h>
#include <sys/socket.h>
#include <sys/un.h>
#define SOCK "test-sock"
#define SOCK2 "test-sock2"
int main(void)
{
int fd, fd2;
struct sockaddr_un addr = {
.sun_family = AF_UNIX,
.sun_path = SOCK,
};
struct sockaddr_un addr2 = {
.sun_family = AF_UNIX,
.sun_path = SOCK2,
};
unlink(SOCK);
unlink(SOCK2);
if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1)
err(1, "socket");
if (bind(fd, (struct sockaddr *) &addr, sizeof(addr)) == -1)
err(1, "bind");
if (listen(fd, 0) == -1)
err(1, "listen");
if (link(SOCK, SOCK2) == -1)
err(1, "link");
if ((fd2 = socket(AF_UNIX, SOCK_STREAM, 0)) == -1)
err(1, "socket");
if (connect(fd2, (struct sockaddr *) &addr2, sizeof(addr2)) == -1)
err (1, "connect");
return 0;
}----
--- net/unix/af_unix.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/unix/af_unix.c +3 -3
@@ -315,7 +315,7 @@ static struct sock *unix_find_socket_byi &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {struct dentry *dentry =unix_sk (s)->path.dentry; -if (dentry &&d_backing_inode (dentry) == i) { +if (dentry &&d_real_inode (dentry) == i) {sock_hold (s); goto found; }
@@ -911,7 +911,7 @@ static struct sock *unix_find_other(stru err =kern_path (sunname->sun_path,LOOKUP_FOLLOW , &path);if (err) goto fail; - inode =d_backing_inode (path.dentry); + inode =d_real_inode (path.dentry); err =inode_permission (inode,MAY_WRITE );if (err) goto put_fail;
@@ -1048,7 +1048,7 @@ static int unix_bind(struct socket *sock goto out_up; } addr->hash =UNIX_HASH_SIZE ; - hash =d_backing_inode (dentry)->i_ino & (UNIX_HASH_SIZE -1 ); + hash =d_real_inode (dentry)->i_ino & (UNIX_HASH_SIZE -1 );spin_lock (&unix_table_lock); u->path = u_path; list = &unix_socket_table[hash];
Greg Kroah-Hartman
maintainerPATCH 102/203 percpu: fix synchronization between chunk->map_extend_work and chunk destruction
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 4f996e234dad488e5d9ba0858bc1bae12eff82c3 upstream.
Atomic allocations can trigger async map extensions which is serviced by chunk->map_extend_work. pcpu_balance_work which is responsible for destroying idle chunks wasn't synchronizing properly against chunk->map_extend_work and may end up freeing the chunk while the work item is still in flight.
This patch fixes the bug by rolling async map extension operations into pcpu_balance_work.
--- mm/percpu.c | 57 ++++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 36 insertions(+), 21 deletions(-)
mm/percpu.c +36 -21
@@ -112,7 +112,7 @@ struct pcpu_chunk {int map_used;/* # of map entries used before the sentry */ int map_alloc;/* # of map entries allocated */ int *map;/* allocation map */ -struct work_struct map_extend_work;/* async ->map[] extension */ +struct list_head map_extend_list;/* on pcpu_map_extend_chunks */ void *data;/* chunk data */ int first_free;/* no free below this */
@@ -166,6 +166,9 @@ static DEFINE_MUTEX(pcpu_alloc_mutex); /static struct list_head *pcpu_slot__read_mostly ;/* chunk list slots */ +/* chunks which need their map areas extended, protected by pcpu_lock */ +static LIST_HEAD (pcpu_map_extend_chunks); +/* * The number of empty populated pages, protected by pcpu_lock. The * reserved chunk doesn't contribute to the count.
@@ -395,13 +398,19 @@ static int pcpu_need_to_extend(struct pc {int margin, new_alloc; +lockdep_assert_held (&pcpu_lock); +if (is_atomic) { margin =3 ;if (chunk->map_alloc < - chunk->map_used +PCPU_ATOMIC_MAP_MARGIN_LOW && - pcpu_async_enabled) -schedule_work (&chunk->map_extend_work); + chunk->map_used +PCPU_ATOMIC_MAP_MARGIN_LOW ) { +if (list_empty (&chunk->map_extend_list)) { +list_add_tail (&chunk->map_extend_list, + &pcpu_map_extend_chunks); +pcpu_schedule_balance_work (); + } + } }else { margin =PCPU_ATOMIC_MAP_MARGIN_HIGH ; }
@@ -467,20 +476,6 @@ out_unlock:return 0 ; } -static void pcpu_map_extend_workfn (struct work_struct *work) -{ - struct pcpu_chunk *chunk = container_of(work, struct pcpu_chunk, - map_extend_work); -int new_alloc; - -spin_lock_irq (&pcpu_lock); - new_alloc =pcpu_need_to_extend (chunk, false); -spin_unlock_irq (&pcpu_lock); - -if (new_alloc) -pcpu_extend_area_map (chunk, new_alloc); -} -/** * pcpu_fit_in_area - try to fit the requested allocation in a candidate area * @chunk: chunk the candidate area belongs to
@@ -740,7 +735,7 @@ static struct pcpu_chunk *pcpu_alloc_chu chunk->map_used =1 ;INIT_LIST_HEAD (&chunk->list); -INIT_WORK (&chunk->map_extend_work, pcpu_map_extend_workfn); +INIT_LIST_HEAD (&chunk->map_extend_list); chunk->free_size = pcpu_unit_size; chunk->contig_hint = pcpu_unit_size;
@@ -1129,6 +1124,7 @@ static void pcpu_balance_workfn(struct w if (chunk == list_first_entry(free_head, struct pcpu_chunk, list))continue ; +list_del_init (&chunk->map_extend_list);list_move (&chunk->list, &to_free); }
@@ -1146,6 +1142,25 @@ static void pcpu_balance_workfn(struct wpcpu_destroy_chunk (chunk); } +/* service chunks which requested async area map extension */ +do { +int new_alloc =0 ; + +spin_lock_irq (&pcpu_lock); + + chunk =list_first_entry_or_null (&pcpu_map_extend_chunks, + struct pcpu_chunk, map_extend_list); +if (chunk) { +list_del_init (&chunk->map_extend_list); + new_alloc =pcpu_need_to_extend (chunk, false); + } + +spin_unlock_irq (&pcpu_lock); + +if (new_alloc) +pcpu_extend_area_map (chunk, new_alloc); + }while (chunk); +/* * Ensure there are certain number of free populated pages for * atomic allocs. Fill up from the most packed so that atomic
@@ -1644,7 +1659,7 @@ int __init pcpu_setup_first_chunk(const*/ schunk =memblock_virt_alloc (pcpu_chunk_struct_size,0 );INIT_LIST_HEAD (&schunk->list); -INIT_WORK (&schunk->map_extend_work, pcpu_map_extend_workfn); +INIT_LIST_HEAD (&schunk->map_extend_list); schunk->base_addr = base_addr; schunk->map = smap; schunk->map_alloc =ARRAY_SIZE (smap);
@@ -1673,7 +1688,7 @@ int __init pcpu_setup_first_chunk(constif (dyn_size) { dchunk =memblock_virt_alloc (pcpu_chunk_struct_size,0 );INIT_LIST_HEAD (&dchunk->list); -INIT_WORK (&dchunk->map_extend_work, pcpu_map_extend_workfn); +INIT_LIST_HEAD (&dchunk->map_extend_list); dchunk->base_addr = base_addr; dchunk->map = dmap; dchunk->map_alloc =ARRAY_SIZE (dmap);
Greg Kroah-Hartman
maintainerPATCH 103/203 percpu: fix synchronization between synchronous map extension and chunk destruction
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 6710e594f71ccaad8101bc64321152af7cd9ea28 upstream.
For non-atomic allocations, pcpu_alloc() can try to extend the area map synchronously after dropping pcpu_lock; however, the extension wasn't synchronized against chunk destruction and the chunk might get freed while extension is in progress.
This patch fixes the bug by putting most of non-atomic allocations under pcpu_alloc_mutex to synchronize against pcpu_balance_work which is responsible for async chunk management including destruction.
--- mm/percpu.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
mm/percpu.c +8 -8
@@ -162,7 +162,7 @@ static struct pcpu_chunk *pcpu_reserved_static int pcpu_reserved_chunk_limit;static DEFINE_SPINLOCK (pcpu_lock);/* all internal data structures */ -static DEFINE_MUTEX (pcpu_alloc_mutex);/* chunk create/destroy, [de]pop */ +static DEFINE_MUTEX (pcpu_alloc_mutex);/* chunk create/destroy, [de]pop, map ext */ static struct list_head *pcpu_slot__read_mostly ;/* chunk list slots */
@@ -444,6 +444,8 @@ static int pcpu_extend_area_map(struct psize_t old_size =0 , new_size = new_alloc *sizeof (new[0 ]);unsigned long flags; +lockdep_assert_held (&pcpu_alloc_mutex); + new =pcpu_mem_zalloc (new_size);if (!new)return -ENOMEM ;
@@ -890,6 +892,9 @@ static void __percpu *pcpu_alloc(size_treturn NULL ; } +if (!is_atomic) +mutex_lock (&pcpu_alloc_mutex); +spin_lock_irqsave (&pcpu_lock, flags);/* serve reserved allocations from the reserved chunk if available */
@@ -962,12 +967,9 @@ restart:if (is_atomic) goto fail; -mutex_lock (&pcpu_alloc_mutex); -if (list_empty (&pcpu_slot[pcpu_nr_slots -1 ])) { chunk =pcpu_create_chunk ();if (!chunk) { -mutex_unlock (&pcpu_alloc_mutex); err ="failed to allocate new chunk" ; goto fail; }
@@ -978,7 +980,6 @@ restart:spin_lock_irqsave (&pcpu_lock, flags); } -mutex_unlock (&pcpu_alloc_mutex); goto restart; area_found:
@@ -988,8 +989,6 @@ area_found:if (!is_atomic) {int page_start, page_end, rs, re; -mutex_lock (&pcpu_alloc_mutex); - page_start =PFN_DOWN (off); page_end =PFN_UP (off + size);
@@ -1000,7 +999,6 @@ area_found:spin_lock_irqsave (&pcpu_lock, flags);if (ret) { -mutex_unlock (&pcpu_alloc_mutex);pcpu_free_area (chunk, off, &occ_pages); err ="failed to populate" ; goto fail_unlock;
@@ -1040,6 +1038,8 @@ fail:/* see the flag handling in pcpu_blance_workfn() */ pcpu_atomic_alloc_failed = true;pcpu_schedule_balance_work (); + }else { +mutex_unlock (&pcpu_alloc_mutex); }return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 104/203 btrfs: account for non-CoWd blocks in btrfs_abort_transaction
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <[email protected]>
commit 64c12921e11b3a0c10d088606e328c58e29274d8 upstream.
The test for !trans->blocks_used in btrfs_abort_transaction is insufficient to determine whether it's safe to drop the transaction handle on the floor. btrfs_cow_block, informed by should_cow_block, can return blocks that have already been CoW'd in the current transaction. trans->blocks_used is only incremented for new block allocations. If an operation overlaps the blocks in the current transaction entirely and must abort the transaction, we'll happily let it clean up the trans handle even though it may have modified the blocks and will commit an incomplete operation.
In the long-term, I'd like to do closer tracking of when the fs is actually modified so we can still recover as gracefully as possible, but that approach will need some discussion. In the short term, since this is the only code using trans->blocks_used, let's just switch it to a bool indicating whether any blocks were used and set it when should_cow_block returns false.
--- fs/btrfs/ctree.c | 5 ++++- fs/btrfs/extent-tree.c | 2 +- fs/btrfs/super.c | 2 +- fs/btrfs/transaction.h | 2 +- 4 files changed, 7 insertions(+), 4 deletions(-)
fs/btrfs/ctree.c +4 -1
@@ -1552,6 +1552,7 @@ noinline int btrfs_cow_block(struct btrf trans->transid, root->fs_info->generation);if (!should_cow_block (trans, root, buf)) { + trans->dirty = true; *cow_ret = buf;return 0 ; }
@@ -2773,8 +2774,10 @@ again:* then we don't want to set the path blocking, * so we test it here */ -if (!should_cow_block (trans, root, b)) +if (!should_cow_block (trans, root, b)) { + trans->dirty = true; goto cow_done; + }/* * must have write locks on this node and the
fs/btrfs/extent-tree.c +1 -1
@@ -7929,7 +7929,7 @@ btrfs_init_new_buffer(struct btrfs_transset_extent_dirty (&trans->transaction->dirty_pages, buf->start, buf->start + buf->len -1 ,GFP_NOFS ); } - trans->blocks_used++; + trans->dirty = true;/* this returns a buffer locked for blocking */ return buf; }
fs/btrfs/super.c +1 -1
@@ -239,7 +239,7 @@ void __btrfs_abort_transaction(struct bt trans->aborted = errno;/* Nothing used. The other threads that have joined this * transaction may be able to continue. */ -if (!trans->blocks_used &&list_empty (&trans->new_bgs)) { +if (!trans->dirty &&list_empty (&trans->new_bgs)) {const char *errstr; errstr =btrfs_decode_error (errno);
fs/btrfs/transaction.h +1 -1
@@ -110,7 +110,6 @@ struct btrfs_trans_handle {u64 chunk_bytes_reserved;unsigned long use_count;unsigned long blocks_reserved; -unsigned long blocks_used;unsigned long delayed_ref_updates;struct btrfs_transaction *transaction;struct btrfs_block_rsv *block_rsv;
@@ -121,6 +120,7 @@ struct btrfs_trans_handle {bool can_flush_pending_bgs;bool reloc_reserved;bool sync; +bool dirty;unsigned int type;/* * this root is only needed to validate that the root passed to
Greg Kroah-Hartman
maintainerPATCH 105/203 drm/radeon: fix asic initialization for virtualized environments
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 05082b8bbd1a0ffc74235449c4b8930a8c240f85 upstream.
When executing in a PCI passthrough based virtuzliation environment, the hypervisor will usually attempt to send a PCIe bus reset signal to the ASIC when the VM reboots. In this scenario, the card is not correctly initialized, but we still consider it to be posted. Therefore, in a passthrough based environemnt we should always post the card to guarantee it is in a good state for driver initialization.
Ported from amdgpu commit:
amdgpu: fix asic initialization for virtualized environments
--- drivers/gpu/drm/radeon/radeon_device.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/gpu/drm/radeon/radeon_device.c +21 -0
@@ -630,6 +630,23 @@ void radeon_gtt_location(struct radeon_d/* * GPU helpers function. */ + +/** +* radeon_device_is_virtual - check if we are running is a virtual environment +* +* Check if the asic has been passed through to a VM (all asics). +* Used at driver startup. +* Returns true if virtual or false if not. +*/ +static bool radeon_device_is_virtual (void ) +{ +#ifdef CONFIG_X86 +return boot_cpu_has (X86_FEATURE_HYPERVISOR ); +#else +return false; +#endif +} +/** * radeon_card_posted - check if the hw has already been initialized *
@@ -643,6 +660,10 @@ bool radeon_card_posted(struct radeon_de {uint32_t reg; +/* for pass through, always force asic_init */ +if (radeon_device_is_virtual ()) +return false; +/* required for EFI mode on macbook2,1 which uses an r5xx asic */ if (efi_enabled(EFI_BOOT) && (rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE) &&
Greg Kroah-Hartman
maintainerPATCH 106/203 drm/amdgpu/gfx7: fix broken condition check
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 8b18300c13a1e08e152f6b6a430faac84f986231 upstream.
Wrong operator.
--- drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +1 -1
@@ -5074,7 +5074,7 @@ static int gfx_v7_0_eop_irq(struct amdgpcase 2 :for (i =0 ; i < adev->gfx.num_compute_rings; i++) { ring = &adev->gfx.compute_ring[i]; -if ((ring->me == me_id) & (ring->pipe == pipe_id)) +if ((ring->me == me_id) && (ring->pipe == pipe_id))amdgpu_fence_process (ring); }break ;
Greg Kroah-Hartman
maintainerPATCH 108/203 drm/amdgpu: initialize amdgpu_cgs_acpi_eval_object result value
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Iooss <[email protected]>
commit 29b9c528b8c295911e8b1e515273e89a2b7fa2d8 upstream.
amdgpu_cgs_acpi_eval_object() returned the value of variable "result" without initializing it first.
This bug has been found by compiling the kernel with clang. The compiler complained:
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c:972:14: error: variable
'result' is used uninitialized whenever 'for' loop exits because its
condition is false [-Werror,-Wsometimes-uninitialized]
for (i = 0; i < count; i++) {
^~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c:1011:9: note: uninitialized
use occurs here
return result;
^~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c:972:14: note: remove the
condition if it is always true
for (i = 0; i < count; i++) {
^~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c:864:12: note: initialize the
variable 'result' to silence this warning
int result;
^
= 0function")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +1 -1
@@ -880,7 +880,7 @@ static int amdgpu_cgs_acpi_eval_object(vstruct cgs_acpi_method_argument *argument =NULL ;uint32_t i, count;acpi_status status; -int result; +int result =0 ;uint32_t func_no =0xFFFFFFFF ; handle =ACPI_HANDLE (&adev->pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 110/203 drm/amdkfd: unbind only existing processes
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oded Gabbay <[email protected]>
commit 121b78e679ee3ffab780115e260b2775d0cc1f73 upstream.
When unbinding a process from a device (initiated by amd_iommu_v2), the driver needs to make sure that process still exists in the process table. There is a possibility that amdkfd's own notifier handler - kfd_process_notifier_release() - was called before the unbind function and it already removed the process from the process table.
v2:
Because there can be only one process with the specified pasid, and because *p can't be NULL inside the hash_for_each_rcu macro, it is more reasonable to just put the whole code inside the if statement that compares the pasid value. That way, when we exit hash_for_each_rcu, we simply exit the function as well.
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 60 ++++++++++++++++++------------- 1 file changed, 35 insertions(+), 25 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +35 -25
@@ -404,42 +404,52 @@ void kfd_unbind_process_from_device(stru idx =srcu_read_lock (&kfd_processes_srcu); +/* +* Look for the process that matches the pasid. If there is no such +* process, we either released it in amdkfd's own notifier, or there +* is a bug. Unfortunately, there is no way to tell... +*/ hash_for_each_rcu (kfd_processes_table, i, p, kfd_processes) -if (p->pasid == pasid) -break ; +if (p->pasid == pasid) { -srcu_read_unlock (&kfd_processes_srcu, idx); +srcu_read_unlock (&kfd_processes_srcu, idx); -BUG_ON (p->pasid != pasid); +pr_debug ("Unbinding process %d from IOMMU\n" , pasid); -mutex_lock (&p->mutex); +mutex_lock (&p->mutex); -if ((dev->dbgmgr) && (dev->dbgmgr->pasid == p->pasid)) -kfd_dbgmgr_destroy (dev->dbgmgr); +if ((dev->dbgmgr) && (dev->dbgmgr->pasid == p->pasid)) +kfd_dbgmgr_destroy (dev->dbgmgr); -pqm_uninit (&p->pqm); +pqm_uninit (&p->pqm); - pdd =kfd_get_process_device_data (dev, p); + pdd =kfd_get_process_device_data (dev, p); -if (!pdd) { -mutex_unlock (&p->mutex); -return ; - } +if (!pdd) { +mutex_unlock (&p->mutex); +return ; + } -if (pdd->reset_wavefronts) { -dbgdev_wave_reset_wavefronts (pdd->dev, p); - pdd->reset_wavefronts = false; - } +if (pdd->reset_wavefronts) { +dbgdev_wave_reset_wavefronts (pdd->dev, p); + pdd->reset_wavefronts = false; + } -/* -* Just mark pdd as unbound, because we still need it to call -* amd_iommu_unbind_pasid() in when the process exits. -* We don't call amd_iommu_unbind_pasid() here -* because the IOMMU called us. -*/ - pdd->bound = false; +/* +* Just mark pdd as unbound, because we still need it +* to call amd_iommu_unbind_pasid() in when the +* process exits. +* We don't call amd_iommu_unbind_pasid() here +* because the IOMMU called us. +*/ + pdd->bound = false; + +mutex_unlock (&p->mutex); -mutex_unlock (&p->mutex); +return ; + } + +srcu_read_unlock (&kfd_processes_srcu, idx); }struct kfd_process_device *kfd_get_first_process_device_data (struct kfd_process *p)
Greg Kroah-Hartman
maintainerPATCH 111/203 drm/amdkfd: destroy dbgmgr in notifier release
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oded Gabbay <[email protected]>
commit bc4755a4bd1845ef6e88ac8c62f12e05bb530256 upstream.
amdkfd need to destroy the debug manager in case amdkfd's notifier function is called before the unbind function, because in that case, the unbind function will exit without destroying debug manager.
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +8 -2
@@ -242,13 +242,19 @@ static void kfd_process_notifier_releasepqm_uninit (&p->pqm);/* Iterate over all process device data structure and check -* if we should reset all wavefronts */ -list_for_each_entry (pdd, &p->per_device_data, per_device_list) +* if we should delete debug managers and reset all wavefronts +*/ +list_for_each_entry (pdd, &p->per_device_data, per_device_list) { +if ((pdd->dev->dbgmgr) && + (pdd->dev->dbgmgr->pasid == p->pasid)) +kfd_dbgmgr_destroy (pdd->dev->dbgmgr); +if (pdd->reset_wavefronts) {pr_warn ("amdkfd: Resetting all wave fronts\n" );dbgdev_wave_reset_wavefronts (pdd->dev, p); pdd->reset_wavefronts = false; } + }mutex_unlock (&p->mutex);
Greg Kroah-Hartman
maintainerPATCH 112/203 drm/dp/mst: Always clear proposed vcpi table for port.
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Grodzovsky <[email protected]>
commit fd2d2bac6e79b0be91ab86a6075a0c46ffda658a upstream.
Not clearing mst manager's proposed vcpis table for destroyed connectors when the manager is stopped leaves it pointing to unrefernced memory, this causes pagefault when the manager is restarted when plugging back a branch.
--- drivers/gpu/drm/drm_dp_mst_topology.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/gpu/drm/drm_dp_mst_topology.c +3 -5
@@ -2908,11 +2908,9 @@ static void drm_dp_destroy_connector_wordrm_dp_port_teardown_pdt (port, port->pdt);if (!port->input && port->vcpi.vcpi >0 ) { -if (mgr->mst_state) { -drm_dp_mst_reset_vcpi_slots (mgr, port); -drm_dp_update_payload_part1 (mgr); -drm_dp_mst_put_payload_id (mgr, port->vcpi.vcpi); - } +drm_dp_mst_reset_vcpi_slots (mgr, port); +drm_dp_update_payload_part1 (mgr); +drm_dp_mst_put_payload_id (mgr, port->vcpi.vcpi); }kref_put (&port->kref, drm_dp_free_mst_port);
Greg Kroah-Hartman
maintainerPATCH 113/203 virtio_balloon: fix PFN format for virtio-1
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
commit 87c9403b0d1de4676b0bd273eea68fcf6de68e68 upstream.
Everything should be LE when using virtio-1, but the linux balloon driver does not seem to care about that.
--- drivers/virtio/virtio_balloon.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
drivers/virtio/virtio_balloon.c +12 -8
@@ -75,7 +75,7 @@ struct virtio_balloon {/* The array of pfns we tell the Host about. */ unsigned int num_pfns; -u32 pfns[VIRTIO_BALLOON_ARRAY_PFNS_MAX ]; +__virtio32 pfns[VIRTIO_BALLOON_ARRAY_PFNS_MAX ];/* Memory statistics */ struct virtio_balloon_stat stats[VIRTIO_BALLOON_S_NR ];
@@ -127,14 +127,16 @@ static void tell_host(struct virtio_ball } -static void set_page_pfns (u32 pfns[],struct page *page) +static void set_page_pfns (struct virtio_balloon *vb, +__virtio32 pfns[],struct page *page) {unsigned int i;/* Set balloon pfns pointing at this page. * Note that the first pfn points at start of the page. */ for (i =0 ; i <VIRTIO_BALLOON_PAGES_PER_PAGE ; i++) - pfns[i] =page_to_balloon_pfn (page) + i; + pfns[i] =cpu_to_virtio32 (vb->vdev, +page_to_balloon_pfn (page) + i); }static unsigned fill_balloon (struct virtio_balloon *vb,size_t num)
@@ -158,7 +160,7 @@ static unsigned fill_balloon(struct virtmsleep (200 );break ; } -set_page_pfns (vb->pfns + vb->num_pfns, page); +set_page_pfns (vb, vb->pfns + vb->num_pfns, page); vb->num_pages +=VIRTIO_BALLOON_PAGES_PER_PAGE ;if (!virtio_has_feature (vb->vdev,VIRTIO_BALLOON_F_DEFLATE_ON_OOM ))
@@ -177,10 +179,12 @@ static unsigned fill_balloon(struct virtstatic void release_pages_balloon (struct virtio_balloon *vb) {unsigned int i; +struct page *page;/* Find pfns pointing at start of each page, get pages and free them. */ for (i =0 ; i < vb->num_pfns; i +=VIRTIO_BALLOON_PAGES_PER_PAGE ) { -struct page *page =balloon_pfn_to_page (vb->pfns[i]); + page =balloon_pfn_to_page (virtio32_to_cpu (vb->vdev, + vb->pfns[i]));if (!virtio_has_feature (vb->vdev,VIRTIO_BALLOON_F_DEFLATE_ON_OOM ))adjust_managed_page_count (page,1 );
@@ -203,7 +207,7 @@ static unsigned leak_balloon(struct virt page =balloon_page_dequeue (vb_dev_info);if (!page)break ; -set_page_pfns (vb->pfns + vb->num_pfns, page); +set_page_pfns (vb, vb->pfns + vb->num_pfns, page); vb->num_pages -=VIRTIO_BALLOON_PAGES_PER_PAGE ; }
@@ -471,13 +475,13 @@ static int virtballoon_migratepage(struc__count_vm_event (BALLOON_MIGRATE );spin_unlock_irqrestore (&vb_dev_info->pages_lock, flags); vb->num_pfns =VIRTIO_BALLOON_PAGES_PER_PAGE ; -set_page_pfns (vb->pfns, newpage); +set_page_pfns (vb, vb->pfns, newpage);tell_host (vb, vb->inflate_vq);/* balloon's page migration 2nd step -- deflate "page" */ balloon_page_delete (page); vb->num_pfns =VIRTIO_BALLOON_PAGES_PER_PAGE ; -set_page_pfns (vb->pfns, page); +set_page_pfns (vb, vb->pfns, page);tell_host (vb, vb->deflate_vq);mutex_unlock (&vb->balloon_lock);
Greg Kroah-Hartman
maintainerPATCH 114/203 drm/nouveau/bios/disp: fix handling of "match any protocol" entries
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit bc9139d23f6b038e32bcd2dffdee70a8d76b3976 upstream.
As it turns out, a value of 0xff means "any protocol" and not "VGA".
--- drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h | 5 +++-- drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c | 13 +++++-------- drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c | 12 ++++-------- drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c | 8 +++++--- 4 files changed, 17 insertions(+), 21 deletions(-)
drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h +3 -2
@@ -25,7 +25,8 @@ u16 nvbios_outp_match(struct nvkm_bios * u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_outp *);struct nvbios_ocfg { -u16 match; +u8 proto; +u8 flags;u16 clkcmp[2 ]; };
@@ -33,7 +34,7 @@ u16 nvbios_ocfg_entry(struct nvkm_bios * u8 *ver, u8 *hdr, u8 *cnt, u8 *len);u16 nvbios_ocfg_parse (struct nvkm_bios *,u16 outp,u8 idx,u8 *ver,u8 *hdr,u8 *cnt,u8 *len,struct nvbios_ocfg *); -u16 nvbios_ocfg_match (struct nvkm_bios *,u16 outp,u16 type, +u16 nvbios_ocfg_match (struct nvkm_bios *,u16 outp,u8 proto,u8 flags,u8 *ver,u8 *hdr,u8 *cnt,u8 *len,struct nvbios_ocfg *);u16 nvbios_oclk_match (struct nvkm_bios *,u16 cmp,u32 khz);#endif
drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c +5 -8
@@ -76,6 +76,7 @@ exec_lookup(struct nv50_disp *disp, int mask |=0x0001 << or; mask |=0x0100 << head; +list_for_each_entry (outp, &disp->base.outp, head) {if ((outp->info.hasht &0xff ) == type && (outp->info.hashm & mask) == mask) {
@@ -155,25 +156,21 @@ exec_clkcmp(struct nv50_disp *disp, intif (!outp)return NULL ; + *conf = (ctrl &0x00000f00 ) >>8 ;switch (outp->info.type) {case DCB_OUTPUT_TMDS : - *conf = (ctrl &0x00000f00 ) >>8 ;if (*conf ==5 ) *conf |=0x0100 ;break ;case DCB_OUTPUT_LVDS : - *conf = disp->sor.lvdsconf; -break ; -case DCB_OUTPUT_DP : - *conf = (ctrl &0x00000f00 ) >>8 ; + *conf |= disp->sor.lvdsconf;break ; -case DCB_OUTPUT_ANALOG :default : - *conf =0x00ff ;break ; } - data =nvbios_ocfg_match (bios, data, *conf, &ver, &hdr, &cnt, &len, &info2); + data =nvbios_ocfg_match (bios, data, *conf &0xff , *conf >>8 , + &ver, &hdr, &cnt, &len, &info2);if (data && id <0xff ) { data =nvbios_oclk_match (bios, info2.clkcmp[id], pclk);if (data) {
drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c +4 -8
@@ -387,22 +387,17 @@ exec_clkcmp(struct nv50_disp *disp, intif (!outp)return NULL ; + *conf = (ctrl &0x00000f00 ) >>8 ;if (outp->info.location ==0 ) {switch (outp->info.type) {case DCB_OUTPUT_TMDS : - *conf = (ctrl &0x00000f00 ) >>8 ;if (*conf ==5 ) *conf |=0x0100 ;break ;case DCB_OUTPUT_LVDS : - *conf = disp->sor.lvdsconf; + *conf |= disp->sor.lvdsconf;break ; -case DCB_OUTPUT_DP : - *conf = (ctrl &0x00000f00 ) >>8 ; -break ; -case DCB_OUTPUT_ANALOG :default : - *conf =0x00ff ;break ; } }else {
@@ -410,7 +405,8 @@ exec_clkcmp(struct nv50_disp *disp, int pclk = pclk /2 ; } - data =nvbios_ocfg_match (bios, data, *conf, &ver, &hdr, &cnt, &len, &info2); + data =nvbios_ocfg_match (bios, data, *conf &0xff , *conf >>8 , + &ver, &hdr, &cnt, &len, &info2);if (data && id <0xff ) { data =nvbios_oclk_match (bios, info2.clkcmp[id], pclk);if (data) {
drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c +5 -3
@@ -141,7 +141,8 @@ nvbios_ocfg_parse(struct nvkm_bios *bios {u16 data =nvbios_ocfg_entry (bios, outp, idx, ver, hdr, cnt, len);if (data) { - info->match =nvbios_rd16 (bios, data +0x00 ); + info->proto =nvbios_rd08 (bios, data +0x00 ); + info->flags =nvbios_rd16 (bios, data +0x01 ); info->clkcmp[0 ] =nvbios_rd16 (bios, data +0x02 ); info->clkcmp[1 ] =nvbios_rd16 (bios, data +0x04 ); }
@@ -149,12 +150,13 @@ nvbios_ocfg_parse(struct nvkm_bios *bios }u16 -nvbios_ocfg_match (struct nvkm_bios *bios,u16 outp,u16 type, +nvbios_ocfg_match (struct nvkm_bios *bios,u16 outp,u8 proto,u8 flags,u8 *ver,u8 *hdr,u8 *cnt,u8 *len,struct nvbios_ocfg *info) {u16 data, idx =0 ;while ((data =nvbios_ocfg_parse (bios, outp, idx++, ver, hdr, cnt, len, info))) { -if (info->match == type) +if ((info->proto == proto || info->proto ==0xff ) && + (info->flags == flags))break ; }return data;
Greg Kroah-Hartman
maintainerPATCH 115/203 drm/nouveau/disp/sor/gf119: both links use the same training register
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit a8953c52b95167b5d21a66f0859751570271d834 upstream.
It appears that, for whatever reason, both link A and B use the same register to control the training pattern. It's a little odd, as the GPUs before this (Tesla/Fermi1) have per-link registers, as do newer GPUs (Maxwell).
Fixes the third DP output on NVS 510 (GK107).
--- drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c +1 -2
@@ -40,8 +40,7 @@ static int gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern) {struct nvkm_device *device = outp->base.disp->engine.subdev.device; -const u32 loff =gf119_sor_loff (outp); -nvkm_mask (device,0x61c110 + loff,0x0f0f0f0f ,0x01010101 * pattern); +nvkm_mask (device,0x61c110 ,0x0f0f0f0f ,0x01010101 * pattern);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 116/203 drm/nouveau/gr/gf100-: update sm error decoding from gk20a nvgpu headers
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 383d0a419f8e63e3d65e706c3c515fa9505ce364 upstream.
--- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 37 ++++++++++++++++++------- 1 file changed, 28 insertions(+), 9 deletions(-)
drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +28 -9
@@ -942,22 +942,41 @@ gf100_gr_trap_gpc_rop(struct gf100_gr *g }static const struct nvkm_enum gf100_mp_warp_error[] = { - {0x00 ,"NO_ERROR" }, - {0x01 ,"STACK_MISMATCH" }, + {0x01 ,"STACK_ERROR" }, + {0x02 ,"API_STACK_ERROR" }, + {0x03 ,"RET_EMPTY_STACK_ERROR" }, + {0x04 ,"PC_WRAP" }, {0x05 ,"MISALIGNED_PC" }, - {0x08 ,"MISALIGNED_GPR" }, - {0x09 ,"INVALID_OPCODE" }, - {0x0d ,"GPR_OUT_OF_BOUNDS" }, - {0x0e ,"MEM_OUT_OF_BOUNDS" }, - {0x0f ,"UNALIGNED_MEM_ACCESS" }, + {0x06 ,"PC_OVERFLOW" }, + {0x07 ,"MISALIGNED_IMMC_ADDR" }, + {0x08 ,"MISALIGNED_REG" }, + {0x09 ,"ILLEGAL_INSTR_ENCODING" }, + {0x0a ,"ILLEGAL_SPH_INSTR_COMBO" }, + {0x0b ,"ILLEGAL_INSTR_PARAM" }, + {0x0c ,"INVALID_CONST_ADDR" }, + {0x0d ,"OOR_REG" }, + {0x0e ,"OOR_ADDR" }, + {0x0f ,"MISALIGNED_ADDR" }, {0x10 ,"INVALID_ADDR_SPACE" }, - {0x11 ,"INVALID_PARAM" }, + {0x11 ,"ILLEGAL_INSTR_PARAM2" }, + {0x12 ,"INVALID_CONST_ADDR_LDC" }, + {0x13 ,"GEOMETRY_SM_ERROR" }, + {0x14 ,"DIVERGENT" }, + {0x15 ,"WARP_EXIT" }, {} };static const struct nvkm_bitfield gf100_mp_global_error[] = { + {0x00000001 ,"SM_TO_SM_FAULT" }, + {0x00000002 ,"L1_ERROR" }, {0x00000004 ,"MULTIPLE_WARP_ERRORS" }, - {0x00000008 ,"OUT_OF_STACK_SPACE" }, + {0x00000008 ,"PHYSICAL_STACK_OVERFLOW" }, + {0x00000010 ,"BPT_INT" }, + {0x00000020 ,"BPT_PAUSE" }, + {0x00000040 ,"SINGLE_STEP_COMPLETE" }, + {0x20000000 ,"ECC_SEC_ERROR" }, + {0x40000000 ,"ECC_DED_ERROR" }, + {0x80000000 ,"TIMEOUT" }, {} };
Greg Kroah-Hartman
maintainerPATCH 117/203 drm/nouveau/ltc/gm107-: fix typo in the address of NV_PLTCG_LTC0_LTS0_INTR
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 9057c8d75018f05bbc769d7b4602de3b8b20f8aa upstream.
--- drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c | 6 +++--- drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c +3 -3
@@ -69,11 +69,11 @@ gm107_ltc_zbc_clear_depth(struct nvkm_lt }static void -gm107_ltc_lts_isr (struct nvkm_ltc *ltc,int c,int s) +gm107_ltc_intr_lts (struct nvkm_ltc *ltc,int c,int s) {struct nvkm_subdev *subdev = <c->subdev;struct nvkm_device *device = subdev->device; -u32 base =0x140000 + (c *0x2000 ) + (s *0x200 ); +u32 base =0x140400 + (c *0x2000 ) + (s *0x200 );u32 stat =nvkm_rd32 (device, base +0x00c );if (stat) {
@@ -92,7 +92,7 @@ gm107_ltc_intr(struct nvkm_ltc *ltc)while (mask) {u32 s, c =__ffs (mask);for (s =0 ; s < ltc->lts_nr; s++) -gm107_ltc_lts_isr (ltc, c, s); +gm107_ltc_intr_lts (ltc, c, s); mask &= ~(1 << c); } }
drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c +1 -1
@@ -46,7 +46,7 @@ static const struct nvkm_ltc_func gm200_ltc = { .oneinit = gm200_ltc_oneinit, .init = gm200_ltc_init, - .intr = gm107_ltc_intr, /*XXX: not validated */ + .intr = gm107_ltc_intr, .cbc_clear = gm107_ltc_cbc_clear, .cbc_wait = gm107_ltc_cbc_wait, .zbc = 16,
Greg Kroah-Hartman
maintainerPATCH 118/203 drm/nouveau/fbcon: fix out-of-bounds memory accesses
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit f045f459d925138fe7d6193a8c86406bda7e49da upstream.
Reported by KASAN.
--- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 1 + drivers/gpu/drm/nouveau/nv04_fbcon.c | 7 ++----- drivers/gpu/drm/nouveau/nv50_fbcon.c | 6 ++---- drivers/gpu/drm/nouveau/nvc0_fbcon.c | 6 ++---- 4 files changed, 7 insertions(+), 13 deletions(-)
drivers/gpu/drm/nouveau/nouveau_fbcon.c +1 -0
@@ -557,6 +557,7 @@ nouveau_fbcon_init(struct drm_device *deif (ret) goto fini; + fbcon->helper.fbdev->pixmap.buf_align =4 ;return 0 ; fini:
drivers/gpu/drm/nouveau/nv04_fbcon.c +2 -5
@@ -82,7 +82,6 @@ nv04_fbcon_imageblit(struct fb_info *infuint32_t fg;uint32_t bg;uint32_t dsize; -uint32_t width;uint32_t *data = (uint32_t *)image->data;int ret;
@@ -93,9 +92,6 @@ nv04_fbcon_imageblit(struct fb_info *infif (ret)return ret; - width =ALIGN (image->width,8 ); - dsize =ALIGN (width * image->height,32 ) >>5 ; -if (info->fix.visual ==FB_VISUAL_TRUECOLOR || info->fix.visual ==FB_VISUAL_DIRECTCOLOR ) { fg = ((uint32_t *) info->pseudo_palette)[image->fg_color];
@@ -111,10 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *inf ((image->dx + image->width) & 0xffff));OUT_RING (chan, bg);OUT_RING (chan, fg); -OUT_RING (chan, (image->height <<16 ) | width); +OUT_RING (chan, (image->height <<16 ) | image->width);OUT_RING (chan, (image->height <<16 ) | image->width);OUT_RING (chan, (image->dy <<16 ) | (image->dx &0xffff )); + dsize =ALIGN (image->width * image->height,32 ) >>5 ;while (dsize) {int iter_len = dsize >128 ?128 : dsize;
drivers/gpu/drm/nouveau/nv50_fbcon.c +2 -4
@@ -95,7 +95,7 @@ nv50_fbcon_imageblit(struct fb_info *infstruct nouveau_fbdev *nfbdev = info->par;struct nouveau_drm *drm =nouveau_drm (nfbdev->dev);struct nouveau_channel *chan = drm->channel; -uint32_t width, dwords, *data = (uint32_t *)image->data; +uint32_t dwords, *data = (uint32_t *)image->data;uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));uint32_t *palette = info->pseudo_palette;int ret;
@@ -107,9 +107,6 @@ nv50_fbcon_imageblit(struct fb_info *infif (ret)return ret; - width =ALIGN (image->width,32 ); - dwords = (width * image->height) >>5 ; -BEGIN_NV04 (chan, NvSub2D,0x0814 ,2 );if (info->fix.visual ==FB_VISUAL_TRUECOLOR || info->fix.visual ==FB_VISUAL_DIRECTCOLOR ) {
@@ -128,6 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *infOUT_RING (chan,0 );OUT_RING (chan, image->dy); + dwords =ALIGN (image->width * image->height,32 ) >>5 ;while (dwords) {int push = dwords >2047 ?2047 : dwords;
drivers/gpu/drm/nouveau/nvc0_fbcon.c +2 -4
@@ -95,7 +95,7 @@ nvc0_fbcon_imageblit(struct fb_info *infstruct nouveau_fbdev *nfbdev = info->par;struct nouveau_drm *drm =nouveau_drm (nfbdev->dev);struct nouveau_channel *chan = drm->channel; -uint32_t width, dwords, *data = (uint32_t *)image->data; +uint32_t dwords, *data = (uint32_t *)image->data;uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));uint32_t *palette = info->pseudo_palette;int ret;
@@ -107,9 +107,6 @@ nvc0_fbcon_imageblit(struct fb_info *infif (ret)return ret; - width =ALIGN (image->width,32 ); - dwords = (width * image->height) >>5 ; -BEGIN_NVC0 (chan, NvSub2D,0x0814 ,2 );if (info->fix.visual ==FB_VISUAL_TRUECOLOR || info->fix.visual ==FB_VISUAL_DIRECTCOLOR ) {
@@ -128,6 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *infOUT_RING (chan,0 );OUT_RING (chan, image->dy); + dwords =ALIGN (image->width * image->height,32 ) >>5 ;while (dwords) {int push = dwords >2047 ?2047 : dwords;
Greg Kroah-Hartman
maintainerPATCH 119/203 drm/nouveau/disp/sor/gm107: training pattern registers are like gm200
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 4691409b3e2250ed66aa8dcefa23fe765daf7add upstream.
--- drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 1 drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c | 2 drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h | 9 ++- drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 2 drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c | 53 ++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c | 15 ----- 6 files changed, 64 insertions(+), 18 deletions(-)
drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild +1 -0
@@ -18,6 +18,7 @@ nvkm-y += nvkm/engine/disp/piornv50.o nvkm-y += nvkm/engine/disp/sornv50.o nvkm-y += nvkm/engine/disp/sorg94.o nvkm-y += nvkm/engine/disp/sorgf119.o +nvkm-y += nvkm/engine/disp/sorgm107.o nvkm-y += nvkm/engine/disp/sorgm200.o nvkm-y += nvkm/engine/disp/dport.o
drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c +1 -1
@@ -36,7 +36,7 @@ gm107_disp = { .outp.internal.crt = nv50_dac_output_new, .outp.internal.tmds = nv50_sor_output_new, .outp.internal.lvds = nv50_sor_output_new, - .outp.internal.dp = gf119_sor_dp_new, + .outp.internal.dp = gm107_sor_dp_new, .dac.nr = 3, .dac.power = nv50_dac_power, .dac.sense = nv50_dac_sense,
drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h +7 -2
@@ -62,7 +62,12 @@ int g94_sor_dp_lnk_pwr(struct nvkm_outpuint gf119_sor_dp_new (struct nvkm_disp *,int ,struct dcb_output *,struct nvkm_output **);int gf119_sor_dp_lnk_ctl (struct nvkm_output_dp *,int ,int ,bool ); +int gf119_sor_dp_drv_ctl (struct nvkm_output_dp *,int ,int ,int ,int ); -int gm200_sor_dp_new (struct nvkm_disp *,int ,struct dcb_output *, -struct nvkm_output **); +int gm107_sor_dp_new (struct nvkm_disp *,int ,struct dcb_output *, +struct nvkm_output **); +int gm107_sor_dp_pattern (struct nvkm_output_dp *,int ); + +int gm200_sor_dp_new (struct nvkm_disp *,int ,struct dcb_output *, +struct nvkm_output **);#endif
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c +1 -1
@@ -63,7 +63,7 @@ gf119_sor_dp_lnk_ctl(struct nvkm_output_return 0 ; } -static int +int gf119_sor_dp_drv_ctl (struct nvkm_output_dp *outp,int ln,int vs,int pe,int pc) {
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c new file +53 -0
53 lines not on this page · raw message
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c +1 -14
@@ -57,19 +57,6 @@ gm200_sor_dp_lane_map(struct nvkm_device }static int -gm200_sor_dp_pattern (struct nvkm_output_dp *outp,int pattern) -{ -struct nvkm_device *device = outp->base.disp->engine.subdev.device; -const u32 soff =gm200_sor_soff (outp); -const u32 data =0x01010101 * pattern; -if (outp->base.info.sorconf.link &1 ) -nvkm_mask (device,0x61c110 + soff,0x0f0f0f0f , data); -else -nvkm_mask (device,0x61c12c + soff,0x0f0f0f0f , data); -return 0 ; -} - -static int gm200_sor_dp_lnk_pwr (struct nvkm_output_dp *outp,int nr) {struct nvkm_device *device = outp->base.disp->engine.subdev.device;
@@ -129,7 +116,7 @@ gm200_sor_dp_drv_ctl(struct nvkm_output_static const struct nvkm_output_dp_func gm200_sor_dp_func = { - .pattern = gm200_sor_dp_pattern, + .pattern = gm107_sor_dp_pattern, .lnk_pwr = gm200_sor_dp_lnk_pwr, .lnk_ctl = gf119_sor_dp_lnk_ctl, .drv_ctl = gm200_sor_dp_drv_ctl,
Greg Kroah-Hartman
maintainerPATCH 120/203 drm/nouveau: fix for disabled fbdev emulation
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitrii Tcvetkov <[email protected]>
commit 52dfcc5ccfbb6697ac3cac7f7ff1e712760e1216 upstream.
Hello,
after this commit:
commit f045f459d925138fe7d6193a8c86406bda7e49da
Author: Ben Skeggs <[email protected]> Date: Thu Jun 2 12:23:31 2016 +1000
drm/nouveau/fbcon: fix out-of-bounds memory accesses
kernel started to oops when loading nouveau module when using GTX 780 Ti video adapter. This patch fixes the problem.
Bug report: https://bugzilla.kernel.org/show_bug.cgi?id=120591
--- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_fbcon.c +2 -1
@@ -557,7 +557,8 @@ nouveau_fbcon_init(struct drm_device *deif (ret) goto fini; - fbcon->helper.fbdev->pixmap.buf_align =4 ; +if (fbcon->helper.fbdev) + fbcon->helper.fbdev->pixmap.buf_align =4 ;return 0 ; fini:
Greg Kroah-Hartman
maintainerPATCH 121/203 drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 217215041b9285af2193a755b56a8f3ed408bfe2 upstream.
Fixes a regression caused by a stupid thinko from "disp/sor/gf119: both links use the same training register".
--- drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c +2 -1
@@ -40,7 +40,8 @@ static int gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern) {struct nvkm_device *device = outp->base.disp->engine.subdev.device; -nvkm_mask (device,0x61c110 ,0x0f0f0f0f ,0x01010101 * pattern); +const u32 soff =gf119_sor_soff (outp); +nvkm_mask (device,0x61c110 + soff,0x0f0f0f0f ,0x01010101 * pattern);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 123/203 drm/i915/fbc: Disable on HSW by default for now
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude <[email protected]>
commit 1e3fa0acfec677e915d7de5ac6e1f18cfa4f805b upstream.
Quoted 1 line
Quoted 1 line
This was kind of a difficult bug to track down. If you're using a Haswell system running GNOME and you have fbc completely enabled and working, playing videos can result in video artifacts. Steps to reproduce:
- Run GNOME
- Ensure FBC is enabled and active
- Download a movie, I used the ogg version of Big Buck Bunny for this
- Run gst-launch-1.0 filesrc location='some_movie.ogg' ! decodebin ! glimagesink in a terminal
- Watch for about over a minute, you'll see small horizontal lines go down the screen.
For the time being, disable FBC for Haswell by default.
Stefan Richter reported kernel freezes (no video artifacts) when fbc is on. (E3-1245 v3 with HD P4600; openbox and some KDE and LXDE applications, thread begins at https://lkml.org/lkml/2016/4/26/813).
We also got reports from Steven Honeyman on openbox+roxterm.
v2 (From Paulo):
- Add extra information to the commit message
- Add Fixes tag
- Rebase
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96461
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96464
--- drivers/gpu/drm/i915/intel_fbc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/i915/intel_fbc.c +1 -2
@@ -823,8 +823,7 @@ static bool intel_fbc_can_choose(struct {struct drm_i915_private *dev_priv = crtc->base.dev->dev_private;struct intel_fbc *fbc = &dev_priv->fbc; -bool enable_by_default =IS_HASWELL (dev_priv) || -IS_BROADWELL (dev_priv); +bool enable_by_default =IS_BROADWELL (dev_priv);if (intel_vgpu_active (dev_priv->dev)) { fbc->no_fbc_reason ="VGPU is active" ;
Greg Kroah-Hartman
maintainerPATCH 125/203 drm/i915: Update ifdeffery for mutex->owner
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
commit b19240062722c39fa92c99f04cbfd93034625123 upstream.
In commit 7608a43d8f2e ("locking/mutexes: Use MUTEX_SPIN_ON_OWNER when appropriate") the owner field in the mutex was updated from being dependent upon CONFIG_SMP to using optimistic spin. Update our peek function to suite.
--- drivers/gpu/drm/i915/i915_gem_shrinker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_gem_shrinker.c +1 -1
@@ -39,7 +39,7 @@ static bool mutex_is_locked_by(struct muif (!mutex_is_locked (mutex))return false; -#if defined(CONFIG_SMP ) || defined(CONFIG_DEBUG_MUTEXES ) +#if defined(CONFIG_DEBUG_MUTEXES ) || defined(CONFIG_MUTEX_SPIN_ON_OWNER )return mutex->owner == task;#else /* Since UP may be pre-empted, we cannot assume that we own the lock */
Greg Kroah-Hartman
maintainerPATCH 126/203 drm: add missing drm_mode_set_crtcinfo call
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
commit b201e743f42d143f4bcdcb14587caf7cb1d99229 upstream.
When setting mode via MODE_ID property,drm_atomic_set_mode_prop_for_crtc() does not calldrm_mode_set_crtcinfo() which possibly causes:
"[drm:drm_calc_timestamping_constants [drm]] *ERROR* crtc 32: Can't calculate constants, dotclock = 0!"
Whether the error is seen depends on the previous data in state->mode, as state->mode is not cleared when setting new mode.
This patch adds drm_mode_set_crtcinfo() call to drm_mode_convert_umode(), which is called in both legacy and atomic paths. This should be fine as there's no reason to call drm_mode_convert_umode() without also setting the crtc related fields.
drm_mode_set_crtcinfo() is removed from the legacy drm_mode_setcrtc() as that is no longer needed.
--- drivers/gpu/drm/drm_crtc.c | 2 -- drivers/gpu/drm/drm_modes.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_crtc.c +0 -2
@@ -2800,8 +2800,6 @@ int drm_mode_setcrtc(struct drm_device * goto out; } -drm_mode_set_crtcinfo (mode,CRTC_INTERLACE_HALVE_V ); -/* * Check whether the primary plane supports the fb pixel format. * Drivers not implementing the universal planes API use a
drivers/gpu/drm/drm_modes.c +2 -0
@@ -1518,6 +1518,8 @@ int drm_mode_convert_umode(struct drm_diif (out->status !=MODE_OK ) goto out; +drm_mode_set_crtcinfo (out,CRTC_INTERLACE_HALVE_V ); + ret =0 ; out:
Greg Kroah-Hartman
maintainerPATCH 127/203 drm: make drm_atomic_set_mode_prop_for_crtc() more reliable
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
commit 6709887c448d1cff51b52d09763c7b834ea5f0be upstream.
drm_atomic_set_mode_prop_for_crtc() does not clear the state->mode, so old data may be left there when a new mode is set, possibly causing odd issues.
This patch improves the situation by always clearing the state->mode first.
--- drivers/gpu/drm/drm_atomic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_atomic.c +2 -1
@@ -354,6 +354,8 @@ int drm_atomic_set_mode_prop_for_crtc(stdrm_property_unreference_blob (state->mode_blob); state->mode_blob =NULL ; +memset (&state->mode,0 ,sizeof (state->mode)); + if (blob) { if (blob->length != sizeof(struct drm_mode_modeinfo) || drm_mode_convert_umode(&state->mode,
@@ -366,7 +368,6 @@ int drm_atomic_set_mode_prop_for_crtc(stDRM_DEBUG_ATOMIC ("Set [MODE:%s] for CRTC state %p\n" , state->mode.name, state); }else { -memset (&state->mode,0 ,sizeof (state->mode)); state->enable = false;DRM_DEBUG_ATOMIC ("Set [NOMODE] for CRTC state %p\n" , state);
Greg Kroah-Hartman
maintainerPATCH 128/203 drm: Wrap direct calls to driver->gem_free_object from CMA
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
commit afe705be38f1e65b173868486944377186b9f206 upstream.
Since the introduction of (struct_mutex) lockless GEM bo freeing, there are a pair of driver vfuncs for freeing the GEM bo, of which the driver may choose to only implement driver->gem_object_free_unlocked (and so avoid taking the struct_mutex along the free path). However, the CMA GEM helpers were still calling driver->gem_free_object directly, now NULL, and promptly dying on the fancy new lockless drivers. Oops.
Robert Foss bisected this to b82caafcf2303 (drm/vc4: Use lockless gem BO free callback) on his vc4 device, but that just serves as an enabler for 9f0ba539d13ae (drm/gem: support BO freeing without dev->struct_mutex).
--- drivers/gpu/drm/drm_fb_cma_helper.c | 2 +- drivers/gpu/drm/drm_gem_cma_helper.c | 12 +++--------- 2 files changed, 4 insertions(+), 10 deletions(-)
drivers/gpu/drm/drm_fb_cma_helper.c +1 -1
@@ -301,7 +301,7 @@ static int drm_fbdev_cma_create(struct d err_fb_info_destroy:drm_fb_helper_release_fbi (helper); err_gem_free_object: - dev->driver->gem_free_object (&obj->base); +drm_gem_object_unreference_unlocked (&obj->base);return ret; }
drivers/gpu/drm/drm_gem_cma_helper.c +3 -9
@@ -121,7 +121,7 @@ struct drm_gem_cma_object *drm_gem_cma_creturn cma_obj; error: - drm->driver->gem_free_object (&cma_obj->base); +drm_gem_object_unreference_unlocked (&cma_obj->base);return ERR_PTR (ret); }EXPORT_SYMBOL_GPL (drm_gem_cma_create);
@@ -162,18 +162,12 @@ drm_gem_cma_create_with_handle(struct dr* and handle has the id what user can see. */ ret =drm_gem_handle_create (file_priv, gem_obj, handle); -if (ret) - goto err_handle_create; -/* drop reference from allocate - handle holds it now. */ drm_gem_object_unreference_unlocked (gem_obj); +if (ret) +return ERR_PTR (ret);return cma_obj; - -err_handle_create: - drm->driver->gem_free_object (gem_obj); - -return ERR_PTR (ret); }/**
Greg Kroah-Hartman
maintainerPATCH 129/203 drm/amd/powerplay: fix bug that function parameter was incorect.
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Zhu <[email protected]>
commit 576b4401b1971fe40be4cfd379430a61cd8426b2 upstream.
Wrong value passed to acpi_pcie_perf_request.
--- drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c +1 -1
@@ -54,7 +54,7 @@ int acpi_pcie_perf_request(void *device,ATCS_FUNCTION_PCIE_PERFORMANCE_REQUEST , &atcs_input, &atcs_output, -0 , +1 ,sizeof (atcs_input), sizeof(atcs_output));if (result !=0 )
Greg Kroah-Hartman
maintainerPATCH 130/203 drm/amd/powerplay: need to notify system bios pcie device ready
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Zhu <[email protected]>
commit 0a4fef559b69ae2e682c98f31d53a225fbda78bd upstream.
before request performance state.
--- drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c | 16 +++++++++++++++- drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h | 1 + 2 files changed, 16 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c +15 -1
@@ -21,6 +21,20 @@ bool acpi_atcs_functions_supported(voidreturn result ==0 ? (output_buf.function_bits & (1 << (index -1 ))) !=0 : false; } +bool acpi_atcs_notify_pcie_device_ready (void *device) +{ +int32_t temp_buffer =1 ; + +return cgs_call_acpi_method (device,CGS_ACPI_METHOD_ATCS , +ATCS_FUNCTION_PCIE_DEVICE_READY_NOTIFICATION , + &temp_buffer, +NULL , +0 , +sizeof (temp_buffer), +0 ); +} + +int acpi_pcie_perf_request (void *device,uint8_t perf_req,bool advertise) {struct atcs_pref_req_input atcs_input;
@@ -29,7 +43,7 @@ int acpi_pcie_perf_request(void *device,int result;struct cgs_system_info info = {0 }; -if (!acpi_atcs_functions_supported (device,ATCS_FUNCTION_PCIE_PERFORMANCE_REQUEST )) +if (0 !=acpi_atcs_notify_pcie_device_ready (device))return -EINVAL ; info.size =sizeof (struct cgs_system_info );
drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h +1 -0
@@ -26,3 +26,4 @@ extern bool acpi_atcs_functions_supporteextern int acpi_pcie_perf_request (void *device,uint8_t perf_req,bool advertise); +extern bool acpi_atcs_notify_pcie_device_ready (void *device);
Greg Kroah-Hartman
maintainerPATCH 131/203 drm/amd/powerplay: fix logic error.
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Zhu <[email protected]>
commit 1d7b84d12af8312b52316029f1fa0fa4eac3c9e4 upstream.
the error lead powerplay can't get display info in DGPU case. store_cc6_data just implement in APU.
--- drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c +5 -1
@@ -306,10 +306,14 @@ int phm_store_dal_configuration_data(str {PHM_FUNC_CHECK (hwmgr); -if (hwmgr->hwmgr_func->store_cc6_data ==NULL ) +if (display_config ==NULL )return -EINVAL ; hwmgr->display_config = *display_config; + +if (hwmgr->hwmgr_func->store_cc6_data ==NULL ) +return -EINVAL ; +/* to do pass other display configuration in furture */ if (hwmgr->hwmgr_func->store_cc6_data)
Greg Kroah-Hartman
maintainerPATCH 133/203 drm/amd/powerplay: fix incorrect voltage table value for tonga
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Rui <[email protected]>
commit 1dfefee8939b07dd65a35bb78f6a06df85578301 upstream.
--- drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c +1 -1
@@ -1298,7 +1298,7 @@ static int tonga_populate_smc_mvdd_table table->Smio[count] |= data->mvdd_voltage_table.entries[count].smio_low; } - table->SmioMask2 = data->vddci_voltage_table.mask_low; + table->SmioMask2 = data->mvdd_voltage_table.mask_low;CONVERT_FROM_HOST_TO_SMC_UL (table->MvddLevelCount); }
Greg Kroah-Hartman
maintainerPATCH 134/203 drm: atmel-hlcdc: actually disable scaling when no scaling is required
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <[email protected]>
commit 1b7e38b92b0bbd363369f5160f13f4d26140972d upstream.
The driver is only enabling scaling, but never disabling it, thus, if you enable the scaling feature once it stays enabled forever.
--- drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +2 -0
@@ -335,6 +335,8 @@ atmel_hlcdc_plane_update_pos_and_size(statmel_hlcdc_layer_update_cfg (&plane->layer,13 ,0xffffffff , factor_reg); + }else { +atmel_hlcdc_layer_update_cfg (&plane->layer,13 ,0xffffffff ,0 ); } }
Greg Kroah-Hartman
maintainerPATCH 135/203 drm/atomic: Make drm_atomic_legacy_backoff reset crtc->acquire_ctx
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <[email protected]>
commit 81e257e964268d050f8e9188becd44d50f241d72 upstream.
Atomic updates may acquire more state than initially locked through drm_modeset_lock_crtc, running with heavy stress can cause a WARN_ON(crtc->acquire_ctx) in drm_modeset_lock_crtc:
[ 601.491296] ------------[ cut here ]------------ [ 601.491366] WARNING: CPU: 0 PID: 2411 at drivers/gpu/drm/drm_modeset_lock.c:191 drm_modeset_lock_crtc+0xeb/0xf0 [drm] [ 601.491369] Modules linked in: drm i915 drm_kms_helper [ 601.491414] CPU: 0 PID: 2411 Comm: kms_cursor_lega Tainted: G U 4.7.0-rc4-patser+ #4798 [ 601.491417] Hardware name: Intel Corporation Skylake Client [ 601.491420] 0000000000000000 ffff88044d153c98 ffffffff812ead28 0000000000000000 [ 601.491425] 0000000000000000 ffff88044d153cd8 ffffffff810868e6 000000bf58058030 [ 601.491431] ffff880088b415e8 ffff880458058030 ffff88008a271548 ffff88008a271568 [ 601.491436] Call Trace: [ 601.491443] [<ffffffff812ead28>] dump_stack+0x4d/0x65 [ 601.491447] [<ffffffff810868e6>] __warn+0xc6/0xe0 [ 601.491452] [<ffffffff81086968>] warn_slowpath_null+0x18/0x20 [ 601.491472] [<ffffffffc00d4ffb>] drm_modeset_lock_crtc+0xeb/0xf0 [drm] [ 601.491491] [<ffffffffc00c5526>] drm_mode_cursor_common+0x66/0x180 [drm] [ 601.491509] [<ffffffffc00c91cc>] drm_mode_cursor_ioctl+0x3c/0x40 [drm] [ 601.491524] [<ffffffffc00bc94d>] drm_ioctl+0x14d/0x530 [drm] [ 601.491540] [<ffffffffc00c9190>] ? drm_mode_setcrtc+0x520/0x520 [drm] [ 601.491545] [<ffffffff81176aeb>] ? handle_mm_fault+0x106b/0x1430 [ 601.491550] [<ffffffff81108441>] ? stop_one_cpu+0x61/0x70 [ 601.491556] [<ffffffff811bb71d>] do_vfs_ioctl+0x8d/0x570 [ 601.491560] [<ffffffff81290d7e>] ? security_file_ioctl+0x3e/0x60 [ 601.491565] [<ffffffff811bbc74>] SyS_ioctl+0x74/0x80 [ 601.491571] [<ffffffff810e321c>] ? posix_get_monotonic_raw+0xc/0x10 [ 601.491576] [<ffffffff8175b11b>] entry_SYSCALL_64_fastpath+0x13/0x8f [ 601.491581] ---[ end trace 56f3d3d85f000d00 ]---
For good measure, test mode_config.acquire_ctx too, although this should never happen.
Testcase: kms_cursor_legacy
--- drivers/gpu/drm/drm_atomic.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_atomic.c +26 -1
@@ -1288,14 +1288,39 @@ EXPORT_SYMBOL(drm_atomic_add_affected_pl*/ void drm_atomic_legacy_backoff (struct drm_atomic_state *state) { +struct drm_device *dev = state->dev; +unsigned crtc_mask =0 ; +struct drm_crtc *crtc;int ret; +bool global = false; + +drm_for_each_crtc (crtc, dev) { +if (crtc->acquire_ctx != state->acquire_ctx) +continue ; + + crtc_mask |=drm_crtc_mask (crtc); + crtc->acquire_ctx =NULL ; + } + +if (WARN_ON (dev->mode_config.acquire_ctx == state->acquire_ctx)) { + global = true; + + dev->mode_config.acquire_ctx =NULL ; + } retry:drm_modeset_backoff (state->acquire_ctx); - ret =drm_modeset_lock_all_ctx (state->dev, state->acquire_ctx); + ret =drm_modeset_lock_all_ctx (dev, state->acquire_ctx);if (ret) goto retry; + +drm_for_each_crtc (crtc, dev) +if (drm_crtc_mask (crtc) & crtc_mask) + crtc->acquire_ctx = state->acquire_ctx; + +if (global) + dev->mode_config.acquire_ctx = state->acquire_ctx; }EXPORT_SYMBOL (drm_atomic_legacy_backoff);
Greg Kroah-Hartman
maintainerPATCH 136/203 drm/ttm: Make ttm_bo_mem_compat available
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <[email protected]>
commit 94477bff390aa4612d2332c8abafaae0a13d6923 upstream.
There are cases where it is desired to see if a proposed placement is compatible with a buffer object before calling ttm_bo_validate().
--- drivers/gpu/drm/ttm/ttm_bo.c | 7 ++++--- include/drm/ttm/ttm_bo_api.h | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 3 deletions(-)
drivers/gpu/drm/ttm/ttm_bo.c +4 -3
@@ -1016,9 +1016,9 @@ out_unlock:return ret; } -static bool ttm_bo_mem_compat (struct ttm_placement *placement, -struct ttm_mem_reg *mem, -uint32_t *new_flags) +bool ttm_bo_mem_compat (struct ttm_placement *placement, +struct ttm_mem_reg *mem, +uint32_t *new_flags) {int i;
@@ -1050,6 +1050,7 @@ static bool ttm_bo_mem_compat(struct ttmreturn false; } +EXPORT_SYMBOL (ttm_bo_mem_compat); int ttm_bo_validate(struct ttm_buffer_object *bo, struct ttm_placement *placement,
include/drm/ttm/ttm_bo_api.h +14 -0
@@ -316,6 +316,20 @@ ttm_bo_reference(struct ttm_buffer_objec*/ extern int ttm_bo_wait (struct ttm_buffer_object *bo,bool lazy,bool interruptible,bool no_wait); + +/** +* ttm_bo_mem_compat - Check if proposed placement is compatible with a bo +* +* @placement: Return immediately if buffer is busy. +* @mem: The struct ttm_mem_reg indicating the region where the bo resides +* @new_flags: Describes compatible placement found +* +* Returns true if the placement is compatible +*/ +extern bool ttm_bo_mem_compat (struct ttm_placement *placement, +struct ttm_mem_reg *mem, +uint32_t *new_flags); +/** * ttm_bo_validate *
Greg Kroah-Hartman
maintainerPATCH 137/203 drm/vmwgfx: Add an option to change assumed FB bpp
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <[email protected]>
commit 04319d89fbec72dfd60738003c3813b97c1d5f5a upstream.
Offer an option for advanced users who want larger modes at 16bpp.
This becomes necessary after the fix: "Work around mode set failure in 2D VMs." Without this patch, there would be no way for existing advanced users to get to a high res mode, and the regression is they will likely get a black screen after a software update on their current VM.
--- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 5 +++++ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 3 +++ 3 files changed, 9 insertions(+)
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +5 -0
@@ -227,6 +227,7 @@ static int vmw_force_iommu;static int vmw_restrict_iommu;static int vmw_force_coherent;static int vmw_restrict_dma_mask; +static int vmw_assume_16bpp;static int vmw_probe (struct pci_dev *,const struct pci_device_id *);static void vmw_master_init (struct vmw_master *);
@@ -243,6 +244,8 @@ MODULE_PARM_DESC(force_coherent, "Forcemodule_param_named (force_coherent, vmw_force_coherent, int,0600 );MODULE_PARM_DESC (restrict_dma_mask,"Restrict DMA mask to 44 bits with IOMMU" );module_param_named (restrict_dma_mask, vmw_restrict_dma_mask, int,0600 ); +MODULE_PARM_DESC (assume_16bpp,"Assume 16-bpp when filtering modes" ); +module_param_named (assume_16bpp, vmw_assume_16bpp, int,0600 );static void vmw_print_capabilities (uint32_t capabilities)
@@ -653,6 +656,8 @@ static int vmw_driver_load(struct drm_de dev_priv->vram_start =pci_resource_start (dev->pdev,1 ); dev_priv->mmio_start =pci_resource_start (dev->pdev,2 ); + dev_priv->assume_16bpp = !!vmw_assume_16bpp; + dev_priv->enable_fb = enable_fbdev;vmw_write (dev_priv,SVGA_REG_ID ,SVGA_ID_2 );
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +1 -0
@@ -386,6 +386,7 @@ struct vmw_private {spinlock_t hw_lock;spinlock_t cap_lock;bool has_dx; +bool assume_16bpp;/* * VGA registers.
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +3 -0
@@ -1562,6 +1562,9 @@ int vmw_du_connector_fill_modes(struct dif (dev_priv->active_display_unit == vmw_du_screen_object) assumed_bpp =4 ; +if (dev_priv->assume_16bpp) + assumed_bpp =2 ; +if (dev_priv->active_display_unit == vmw_du_screen_target) { max_width =min (max_width, dev_priv->stdu_max_width); max_height =min (max_height, dev_priv->stdu_max_height);
Greg Kroah-Hartman
maintainerPATCH 138/203 drm/vmwgfx: Work around mode set failure in 2D VMs
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <[email protected]>
commit 7c20d213dd3cd6295bf9162730e7a368af957854 upstream.
In a low-memory 2D VM, fbdev can take up a large percentage of available memory, making them unavailable for other DRM clients.
Since we do not take fbdev into account when filtering modes, we end up claiming to support more modes than we actually do.
As a result, users get a black screen when setting a mode too large for current available memory. In a low-memory VM configuration, users can get a black screen for a mode as low as 1024x768.
The current mode filtering mechanism keys off of SVGA_REG_SUGGESTED_GBOBJECT_MEM_SIZE_KB, i.e. the maximum amount of surface memory we have. Since this value is a performance suggestion, not a hard limit, and since there should not be much of a performance impact for a 2D VM, rather than filtering out more modes, we will just allow ourselves to exceed the SVGA's performance suggestion.
Also changed assumed bpp to 32 from 16 to make sure we can actually support all the modes listed.
--- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 7 +++++++ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 9 +-------- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +7 -0
@@ -704,6 +704,13 @@ static int vmw_driver_load(struct drm_devmw_read (dev_priv,SVGA_REG_SUGGESTED_GBOBJECT_MEM_SIZE_KB ); +/* +* Workaround for low memory 2D VMs to compensate for the +* allocation taken by fbdev +*/ +if (!(dev_priv->capabilities &SVGA_CAP_3D )) + mem_size *=2 ; + dev_priv->max_mob_pages = mem_size *1024 /PAGE_SIZE ; dev_priv->prim_bb_mem = vmw_read(dev_priv,
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +1 -8
@@ -1553,14 +1553,7 @@ int vmw_du_connector_fill_modes(struct d DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) };int i; -u32 assumed_bpp =2 ; - -/* -* If using screen objects, then assume 32-bpp because that's what the -* SVGA device is assuming -*/ -if (dev_priv->active_display_unit == vmw_du_screen_object) - assumed_bpp =4 ; +u32 assumed_bpp =4 ;if (dev_priv->assume_16bpp) assumed_bpp =2 ;
Greg Kroah-Hartman
maintainerPATCH 139/203 drm/vmwgfx: Check pin count before attempting to move a buffer
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <[email protected]>
commit 4ed7e2242b637bc4af0416e4aa9f945db30fb44a upstream.
In certain scenarios, e.g. when fbdev is enabled, we can get into a situation where a vmw_framebuffer_pin() is called on a buffer that is already pinned.
When this happens, ttm_bo_validate() will unintentially remove the TTM_PL_FLAG_NO_EVICT flag, thus unpinning it, and leaving no way to actually pin the buffer again.
To prevent this, if a buffer is already pinned, then instead of calling ttm_bo_validate(), just make sure the proposed placement is compatible with the existing placement.
--- drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c +22 -3
@@ -49,6 +49,7 @@ int vmw_dmabuf_pin_in_placement(struct v {struct ttm_buffer_object *bo = &buf->base;int ret; +uint32_t new_flags; ret =ttm_write_lock (&dev_priv->reservation_sem, interruptible);if (unlikely (ret !=0 ))
@@ -60,7 +61,12 @@ int vmw_dmabuf_pin_in_placement(struct vif (unlikely (ret !=0 )) goto err; - ret =ttm_bo_validate (bo, placement, interruptible, false); +if (buf->pin_count >0 ) + ret =ttm_bo_mem_compat (placement, &bo->mem, + &new_flags) == true ?0 : -EINVAL ; +else + ret =ttm_bo_validate (bo, placement, interruptible, false); +if (!ret)vmw_bo_pin_reserved (buf, true);
@@ -91,6 +97,7 @@ int vmw_dmabuf_pin_in_vram_or_gmr(struct {struct ttm_buffer_object *bo = &buf->base;int ret; +uint32_t new_flags; ret =ttm_write_lock (&dev_priv->reservation_sem, interruptible);if (unlikely (ret !=0 ))
@@ -102,6 +109,12 @@ int vmw_dmabuf_pin_in_vram_or_gmr(structif (unlikely (ret !=0 )) goto err; +if (buf->pin_count >0 ) { + ret =ttm_bo_mem_compat (&vmw_vram_gmr_placement, &bo->mem, + &new_flags) == true ?0 : -EINVAL ; + goto out_unreserve; + } + ret =ttm_bo_validate (bo, &vmw_vram_gmr_placement, interruptible, false);if (likely (ret ==0 ) || ret == -ERESTARTSYS )
@@ -161,6 +174,7 @@ int vmw_dmabuf_pin_in_start_of_vram(strustruct ttm_placement placement;struct ttm_place place;int ret =0 ; +uint32_t new_flags; place = vmw_vram_placement.placement[0 ]; place.lpfn = bo->num_pages;
@@ -185,10 +199,15 @@ int vmw_dmabuf_pin_in_start_of_vram(stru*/ if (bo->mem.mem_type ==TTM_PL_VRAM && bo->mem.start < bo->num_pages && - bo->mem.start >0 ) + bo->mem.start >0 && + buf->pin_count ==0 ) (void )ttm_bo_validate (bo, &vmw_sys_placement, false, false); - ret =ttm_bo_validate (bo, &placement, interruptible, false); +if (buf->pin_count >0 ) + ret =ttm_bo_mem_compat (&placement, &bo->mem, + &new_flags) == true ?0 : -EINVAL ; +else + ret =ttm_bo_validate (bo, &placement, interruptible, false);/* For some reason we didn't end up at the start of vram */ WARN_ON (ret ==0 && bo->offset !=0 );
Greg Kroah-Hartman
maintainerPATCH 140/203 drm/vmwgfx: Delay pinning fbdev framebuffer until after mode set
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <[email protected]>
commit d5f1a291e32309324a8c481ed84b5c118d1360ea upstream.
For the Screen Object display unit, we need to reserve a guest-invisible region equal to the size of the framebuffer for the host. This region can only be reserved in VRAM, whereas the guest-visible framebuffer can be reserved in either VRAM or GMR.
As such priority should be given to the guest-invisible region otherwise in a limited VRAM situation, we can fail to allocate this region.
This patch makes it so that vmw_sou_backing_alloc() is called before the framebuffer is pinned.
--- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 47 +++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 22 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +25 -22
@@ -517,28 +517,6 @@ static int vmw_fb_kms_framebuffer(struct par->set_fb = &vfb->base; -if (!par->bo_ptr) { -/* -* Pin before mapping. Since we don't know in what placement -* to pin, call into KMS to do it for us. -*/ - ret = vfb->pin (vfb); -if (ret) { -DRM_ERROR ("Could not pin the fbdev framebuffer.\n" ); -return ret; - } - - ret =ttm_bo_kmap (&par->vmw_bo->base,0 , - par->vmw_bo->base.num_pages, &par->map); -if (ret) { - vfb->unpin (vfb); -DRM_ERROR ("Could not map the fbdev framebuffer.\n" ); -return ret; - } - - par->bo_ptr =ttm_kmap_obj_virtual (&par->map, &par->bo_iowrite); - } -return 0 ; }
@@ -601,6 +579,31 @@ static int vmw_fb_set_par(struct fb_infoif (ret) goto out_unlock; +if (!par->bo_ptr) { +struct vmw_framebuffer *vfb =vmw_framebuffer_to_vfb (set.fb); + +/* +* Pin before mapping. Since we don't know in what placement +* to pin, call into KMS to do it for us. +*/ + ret = vfb->pin (vfb); +if (ret) { +DRM_ERROR ("Could not pin the fbdev framebuffer.\n" ); +return ret; + } + + ret =ttm_bo_kmap (&par->vmw_bo->base,0 , + par->vmw_bo->base.num_pages, &par->map); +if (ret) { + vfb->unpin (vfb); +DRM_ERROR ("Could not map the fbdev framebuffer.\n" ); +return ret; + } + + par->bo_ptr =ttm_kmap_obj_virtual (&par->map, &par->bo_iowrite); + } + +vmw_fb_dirty_mark (par, par->fb_x, par->fb_y, par->set_fb->width, par->set_fb->height);
Greg Kroah-Hartman
maintainerPATCH 141/203 drm/vmwgfx: Fix corner case screen target management
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <[email protected]>
commit beca4cf55323147ca9c8a98de1871be6e4fe8f34 upstream.
When the surface backing a framebuffer doesn't match the framebuffer's dimensions, the screen target code would test the framebuffer dimensions rather than the surface dimensions when deciding whether to bind the surface as a screen target directly. This causes a screen target - surface dimension mismatch and a subsequent device error.
Fix this by testing against the surface dimension.
v2: Fix review comments by Sinclair Yeh.
--- drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +4 -4
@@ -399,8 +399,10 @@ static int vmw_stdu_bind_fb(struct vmw_pWARN_ON_ONCE (!stdu->defined); -if (!vfb->dmabuf && new_fb->width == mode->hdisplay && - new_fb->height == mode->vdisplay) + new_vfbs = (vfb->dmabuf) ?NULL :vmw_framebuffer_to_vfbs (new_fb); + +if (new_vfbs && new_vfbs->surface->base_size.width == mode->hdisplay && + new_vfbs->surface->base_size.height == mode->vdisplay) new_content_type =SAME_AS_DISPLAY ;else if (vfb->dmabuf) new_content_type =SEPARATE_DMA ;
@@ -444,7 +446,6 @@ static int vmw_stdu_bind_fb(struct vmw_p content_srf.mip_levels[0 ] =1 ; content_srf.multisample_count =0 ; }else { - new_vfbs =vmw_framebuffer_to_vfbs (new_fb); content_srf = *new_vfbs->surface; }
@@ -464,7 +465,6 @@ static int vmw_stdu_bind_fb(struct vmw_preturn ret; } }else if (new_content_type ==SAME_AS_DISPLAY ) { - new_vfbs =vmw_framebuffer_to_vfbs (new_fb); new_display_srf =vmw_surface_reference (new_vfbs->surface); }
Greg Kroah-Hartman
maintainerPATCH 142/203 drm/vmwgfx: Fix error paths when mapping framebuffer
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <[email protected]>
commit 58541f7a6458e17ab417321b284f0090f530aa91 upstream.
Rather than returning immediately, make sure to unlock the mutexes first.
--- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +2 -2
@@ -589,7 +589,7 @@ static int vmw_fb_set_par(struct fb_info ret = vfb->pin (vfb);if (ret) {DRM_ERROR ("Could not pin the fbdev framebuffer.\n" ); -return ret; + goto out_unlock; } ret = ttm_bo_kmap(&par->vmw_bo->base, 0,
@@ -597,7 +597,7 @@ static int vmw_fb_set_par(struct fb_infoif (ret) { vfb->unpin (vfb);DRM_ERROR ("Could not map the fbdev framebuffer.\n" ); -return ret; + goto out_unlock; } par->bo_ptr =ttm_kmap_obj_virtual (&par->map, &par->bo_iowrite);
Greg Kroah-Hartman
maintainerPATCH 143/203 memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ocquidant, Sebastien <[email protected]>
commit 8f50b8e57442d28e41bb736c173d8a2490549a82 upstream.
In the omap gpmc driver it can be noticed that GPMC_CONFIG4_OEEXTRADELAY is overwritten by the WEEXTRADELAY value from the device tree and GPMC_CONFIG4_WEEXTRADELAY is not updated by the value from the device tree.
As a consequence, the memory accesses cannot be configured properly when the extra delay are needed for OE and WE.
Fix the update of GPMC_CONFIG4_WEEXTRADELAY with the value from the device tree file and prevents GPMC_CONFIG4_OEXTRADELAY being overwritten by the WEXTRADELAY value from the device tree.
--- drivers/memory/omap-gpmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/memory/omap-gpmc.c +1 -1
@@ -394,7 +394,7 @@ static void gpmc_cs_bool_timings(int cs,gpmc_cs_modify_reg (cs,GPMC_CS_CONFIG4 ,GPMC_CONFIG4_OEEXTRADELAY , p->oe_extra_delay);gpmc_cs_modify_reg (cs,GPMC_CS_CONFIG4 , -GPMC_CONFIG4_OEEXTRADELAY , p->we_extra_delay); +GPMC_CONFIG4_WEEXTRADELAY , p->we_extra_delay);gpmc_cs_modify_reg (cs,GPMC_CS_CONFIG6 ,GPMC_CONFIG6_CYCLE2CYCLESAMECSEN , p->cycle2cyclesamecsen);
RE: [PATCH 4.6 143/203] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
-----------------------------
Eaton Industries (France) S.A.S ~ Siège social: 110 Rue Blaise Pascal, Immeuble Le Viséo - Bâtiment A Innovallée, 38330, Montbonnot-St.-Martin, France ~ Lieu d'enregistrement au registre du commerce: Grenoble ~ Numéro d'enregistrement: 509 653 176 ~ Capital social souscrit et liberé:€ 16215441 ~ Numéro de TVA: FR47509653176
-----------------------------
-----Message d'origine-----
De : Greg Kroah-Hartman [mailto:[email protected]]
Envoyé : lundi 25 juillet 2016 22:56
À : [email protected]
Cc : Greg Kroah-Hartman; [email protected]; Ocquidant, Sebastien; Roger Quadros Objet : [PATCH 4.6 143/203] memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ocquidant, Sebastien <[email protected]>
commit 8f50b8e57442d28e41bb736c173d8a2490549a82 upstream.
In the omap gpmc driver it can be noticed that GPMC_CONFIG4_OEEXTRADELAY is overwritten by the WEEXTRADELAY value from the device tree and GPMC_CONFIG4_WEEXTRADELAY is not updated by the value from the device tree.
As a consequence, the memory accesses cannot be configured properly when the extra delay are needed for OE and WE.
Fix the update of GPMC_CONFIG4_WEEXTRADELAY with the value from the device tree file and prevents GPMC_CONFIG4_OEXTRADELAY being overwritten by the WEXTRADELAY value from the device tree.
--- drivers/memory/omap-gpmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/memory/omap-gpmc.c +1 -1
@@ -394,7 +394,7 @@ static void gpmc_cs_bool_timings(int cs,gpmc_cs_modify_reg (cs,GPMC_CS_CONFIG4 ,GPMC_CONFIG4_OEEXTRADELAY , p->oe_extra_delay);gpmc_cs_modify_reg (cs,GPMC_CS_CONFIG4 , -GPMC_CONFIG4_OEEXTRADELAY , p->we_extra_delay); +GPMC_CONFIG4_WEEXTRADELAY , p->we_extra_delay);gpmc_cs_modify_reg (cs,GPMC_CS_CONFIG6 ,GPMC_CONFIG6_CYCLE2CYCLESAMECSEN , p->cycle2cyclesamecsen);
========================================================================================
Hi Greg,
OK for me
Sébastien Ocquidant
Greg Kroah-Hartman
maintainerPATCH 144/203 PCI: Fix unaligned accesses in VC code
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Miller <[email protected]>
commit ef0dab4aae14e25efddf1577736f8450132800c5 upstream.
The save/restore buffers for VC state is first composed of a 2-byte control register, then a bunch of 4-byte words.
This causes unaligned accesses which trap on platform such as sparc.
This is easy to fix by simply moving the buffer pointer forward by 4 bytes instead of 2 after dealing with the control register. The length adjustment needs to be changed likewise as well.
--- drivers/pci/vc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/vc.c +2 -2
@@ -221,9 +221,9 @@ static int pci_vc_do_save_buffer(structelse pci_write_config_word (dev, pos +PCI_VC_PORT_CTRL , *(u16 *)buf); - buf +=2 ; + buf +=4 ; } - len +=2 ; + len +=4 ;/* * If we have any Low Priority VCs and a VC Arbitration Table Offset
Greg Kroah-Hartman
maintainerPATCH 145/203 xen/balloon: Fix declared-but-not-defined warning
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Lagerwall <[email protected]>
commit 842775f1509054ea969f1787f38d6a0ec2ccfaba upstream.
Fix a declared-but-not-defined warning when building with XEN_BALLOON_MEMORY_HOTPLUG=n. This fixes a regression introduced by commit dfd74a1edfab ("xen/balloon: Fix crash when ballooning on x86 32 bit PAE").
--- drivers/xen/balloon.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/xen/balloon.c +13 -15
@@ -151,8 +151,6 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_wstatic void balloon_process (struct work_struct *work); static DECLARE_DELAYED_WORK(balloon_worker, balloon_process); -static void release_memory_resource (struct resource *resource); -/* When ballooning out (allocating memory to return to Xen) we don't really want the kernel to try too hard since that can trigger the oom killer. */ #define GFP_BALLOON \
@@ -248,6 +246,19 @@ static enum bp_state update_schedule(enu }#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG +static void release_memory_resource (struct resource *resource) +{ +if (!resource) +return ; + +/* +* No need to reset region to identity mapped since we now +* know that no I/O can be in this region +*/ +release_resource (resource); +kfree (resource); +} +static struct resource *additional_memory_resource (phys_addr_t size) {struct resource *res;
@@ -286,19 +297,6 @@ static struct resource *additional_memorreturn res; } -static void release_memory_resource (struct resource *resource) -{ -if (!resource) -return ; - -/* -* No need to reset region to identity mapped since we now -* know that no I/O can be in this region -*/ -release_resource (resource); -kfree (resource); -} -static enum bp_state reserve_additional_memory (void ) {long credit;
Greg Kroah-Hartman
maintainerPATCH 146/203 iio: Fix error handling in iio_trigger_attach_poll_func
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Crestez Dan Leonard <[email protected]>
commit 99543823357966ac938d9a310947e731b67338e6 upstream.
When attaching a pollfunc iio_trigger_attach_poll_func will allocate a virtual irq and call the driver's set_trigger_state function. Fix error handling to undo previous steps if any fails.
In particular this fixes handling errors from a driver's set_trigger_state function. When using triggered buffers a failure to enable the trigger used to make the buffer unusable.
--- drivers/iio/industrialio-trigger.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/iio/industrialio-trigger.c +18 -5
@@ -210,22 +210,35 @@ static int iio_trigger_attach_poll_func(/* Prevent the module from being removed whilst attached to a trigger */ __module_get (pf->indio_dev->info->driver_module); + +/* Get irq number */ pf->irq =iio_trigger_get_irq (trig); +if (pf->irq <0 ) + goto out_put_module; + +/* Request irq */ ret =request_threaded_irq (pf->irq, pf->h, pf->thread, pf->type, pf->name, pf); -if (ret <0 ) { -module_put (pf->indio_dev->info->driver_module); -return ret; - } +if (ret <0 ) + goto out_put_irq; +/* Enable trigger in driver */ if (trig->ops && trig->ops->set_trigger_state && notinuse) { ret = trig->ops->set_trigger_state (trig, true);if (ret <0 ) -module_put (pf->indio_dev->info->driver_module); + goto out_free_irq; }return ret; + +out_free_irq: +free_irq (pf->irq, pf); +out_put_irq: +iio_trigger_put_irq (trig, pf->irq); +out_put_module: +module_put (pf->indio_dev->info->driver_module); +return ret; } static int iio_trigger_detach_poll_func(struct iio_trigger *trig,
Greg Kroah-Hartman
maintainerPATCH 147/203 iio:st_pressure: fix sampling gains (bring inline with ABI)
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregor Boirie <[email protected]>
commit d43a41152f8e9e4c0d19850884d1fada076dee10 upstream.
Temperature channels report scaled samples in Celsius although expected as milli degree Celsius in Documentation/ABI/testing/sysfs-bus-iio. Gains are not implemented at all for LPS001WP pressure and temperature channels.
This patch ensures that proper offsets and scales are exposed to userpace for both pressure and temperature channels.
Also fix a NULL pointer exception when userspace reads content of sysfs scale attribute when gains are not defined.
--- drivers/iio/pressure/st_pressure_core.c | 80 ++++++++++++++++++++------------ 1 file changed, 50 insertions(+), 30 deletions(-)
drivers/iio/pressure/st_pressure_core.c +50 -30
@@ -28,15 +28,21 @@#include <linux/iio/common/st_sensors.h> #include "st_pressure.h" +#define MCELSIUS_PER_CELSIUS 1000 + +/* Default pressure sensitivity */ #define ST_PRESS_LSB_PER_MBAR 4096UL#define ST_PRESS_KPASCAL_NANO_SCALE (100000000UL / \ ST_PRESS_LSB_PER_MBAR) + +/* Default temperature sensitivity */ #define ST_PRESS_LSB_PER_CELSIUS 480UL -#define ST_PRESS_CELSIUS_NANO_SCALE (1000000000UL / \ - ST_PRESS_LSB_PER_CELSIUS) +#define ST_PRESS_MILLI_CELSIUS_OFFSET 42500UL +#define ST_PRESS_NUMBER_DATA_CHANNELS 1/* FULLSCALE */ +#define ST_PRESS_FS_AVL_1100MB 1100#define ST_PRESS_FS_AVL_1260MB 1260#define ST_PRESS_1_OUT_XL_ADDR 0x28
@@ -54,9 +60,6 @@#define ST_PRESS_LPS331AP_PW_MASK 0x80#define ST_PRESS_LPS331AP_FS_ADDR 0x23#define ST_PRESS_LPS331AP_FS_MASK 0x30 -#define ST_PRESS_LPS331AP_FS_AVL_1260_VAL 0x00 -#define ST_PRESS_LPS331AP_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE -#define ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE#define ST_PRESS_LPS331AP_BDU_ADDR 0x20#define ST_PRESS_LPS331AP_BDU_MASK 0x04#define ST_PRESS_LPS331AP_DRDY_IRQ_ADDR 0x22
@@ -65,9 +68,14 @@#define ST_PRESS_LPS331AP_IHL_IRQ_ADDR 0x22#define ST_PRESS_LPS331AP_IHL_IRQ_MASK 0x80#define ST_PRESS_LPS331AP_MULTIREAD_BIT true -#define ST_PRESS_LPS331AP_TEMP_OFFSET 42500/* CUSTOM VALUES FOR LPS001WP SENSOR */ + +/* LPS001WP pressure resolution */ +#define ST_PRESS_LPS001WP_LSB_PER_MBAR 16UL +/* LPS001WP temperature resolution */ +#define ST_PRESS_LPS001WP_LSB_PER_CELSIUS 64UL +#define ST_PRESS_LPS001WP_WAI_EXP 0xba#define ST_PRESS_LPS001WP_ODR_ADDR 0x20#define ST_PRESS_LPS001WP_ODR_MASK 0x30
@@ -76,6 +84,8 @@#define ST_PRESS_LPS001WP_ODR_AVL_13HZ_VAL 0x03#define ST_PRESS_LPS001WP_PW_ADDR 0x20#define ST_PRESS_LPS001WP_PW_MASK 0x40 +#define ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN \ + (100000000UL / ST_PRESS_LPS001WP_LSB_PER_MBAR)#define ST_PRESS_LPS001WP_BDU_ADDR 0x20#define ST_PRESS_LPS001WP_BDU_MASK 0x04#define ST_PRESS_LPS001WP_MULTIREAD_BIT true
@@ -92,11 +102,6 @@#define ST_PRESS_LPS25H_ODR_AVL_25HZ_VAL 0x04#define ST_PRESS_LPS25H_PW_ADDR 0x20#define ST_PRESS_LPS25H_PW_MASK 0x80 -#define ST_PRESS_LPS25H_FS_ADDR 0x00 -#define ST_PRESS_LPS25H_FS_MASK 0x00 -#define ST_PRESS_LPS25H_FS_AVL_1260_VAL 0x00 -#define ST_PRESS_LPS25H_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE -#define ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE#define ST_PRESS_LPS25H_BDU_ADDR 0x20#define ST_PRESS_LPS25H_BDU_MASK 0x04#define ST_PRESS_LPS25H_DRDY_IRQ_ADDR 0x23
@@ -105,7 +110,6 @@#define ST_PRESS_LPS25H_IHL_IRQ_ADDR 0x22#define ST_PRESS_LPS25H_IHL_IRQ_MASK 0x80#define ST_PRESS_LPS25H_MULTIREAD_BIT true -#define ST_PRESS_LPS25H_TEMP_OFFSET 42500#define ST_PRESS_LPS25H_OUT_XL_ADDR 0x28#define ST_TEMP_LPS25H_OUT_L_ADDR 0x2b
@@ -157,7 +161,9 @@ static const struct iio_chan_spec st_pre .storagebits = 16, .endianness = IIO_LE, }, - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), + .info_mask_separate = + BIT(IIO_CHAN_INFO_RAW) | + BIT(IIO_CHAN_INFO_SCALE), .modified = 0, }, {
@@ -173,7 +179,7 @@ static const struct iio_chan_spec st_pre }, .info_mask_separate =BIT (IIO_CHAN_INFO_RAW ) | - BIT(IIO_CHAN_INFO_OFFSET), + BIT(IIO_CHAN_INFO_SCALE), .modified =0 , },IIO_CHAN_SOFT_TIMESTAMP (1 )
@@ -208,11 +214,14 @@ static const struct st_sensor_settings s .addr = ST_PRESS_LPS331AP_FS_ADDR, .mask = ST_PRESS_LPS331AP_FS_MASK, .fs_avl = { +/* +* Pressure and temperature sensitivity values +* as defined in table 3 of LPS331AP datasheet. + */ [0] = { .num = ST_PRESS_FS_AVL_1260MB, - .value = ST_PRESS_LPS331AP_FS_AVL_1260_VAL, - .gain = ST_PRESS_LPS331AP_FS_AVL_1260_GAIN, - .gain2 = ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN, + .gain = ST_PRESS_KPASCAL_NANO_SCALE, + .gain2 = ST_PRESS_LSB_PER_CELSIUS, }, }, },
@@ -254,7 +263,17 @@ static const struct st_sensor_settings s .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE, }, .fs = { - .addr = 0, + .fs_avl = { +/* +* Pressure and temperature resolution values +* as defined in table 3 of LPS001WP datasheet. + */ + [0] = { + .num = ST_PRESS_FS_AVL_1100MB, + .gain = ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN, + .gain2 = ST_PRESS_LPS001WP_LSB_PER_CELSIUS, + }, + }, }, .bdu = { .addr = ST_PRESS_LPS001WP_BDU_ADDR,
@@ -291,14 +310,15 @@ static const struct st_sensor_settings s .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE, }, .fs = { - .addr = ST_PRESS_LPS25H_FS_ADDR, - .mask = ST_PRESS_LPS25H_FS_MASK, .fs_avl = { +/* +* Pressure and temperature sensitivity values +* as defined in table 3 of LPS25H datasheet. + */ [0] = { .num = ST_PRESS_FS_AVL_1260MB, - .value = ST_PRESS_LPS25H_FS_AVL_1260_VAL, - .gain = ST_PRESS_LPS25H_FS_AVL_1260_GAIN, - .gain2 = ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN, + .gain = ST_PRESS_KPASCAL_NANO_SCALE, + .gain2 = ST_PRESS_LSB_PER_CELSIUS, }, }, },
@@ -354,26 +374,26 @@ static int st_press_read_raw(struct iio_return IIO_VAL_INT ;case IIO_CHAN_INFO_SCALE : - *val =0 ; -switch (ch->type) {case IIO_PRESSURE : + *val =0 ; *val2 = press_data->current_fullscale->gain; -break ; +return IIO_VAL_INT_PLUS_NANO ;case IIO_TEMP : + *val =MCELSIUS_PER_CELSIUS ; *val2 = press_data->current_fullscale->gain2; -break ; +return IIO_VAL_FRACTIONAL ;default : err = -EINVAL ; goto read_error; } -return IIO_VAL_INT_PLUS_NANO ;case IIO_CHAN_INFO_OFFSET :switch (ch->type) {case IIO_TEMP : - *val =425 ; - *val2 =10 ; + *val =ST_PRESS_MILLI_CELSIUS_OFFSET * + press_data->current_fullscale->gain2; + *val2 =MCELSIUS_PER_CELSIUS ;break ;default : err = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 148/203 iio: light apds9960: Add the missing dev.parent
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yong Li <[email protected]>
commit 590b92a30242dd3f73de3d9a51d9924f1ab33e93 upstream.
Without this, the iio:deviceX is missing in the /sys/bus/i2c/devices/0-0039 Some userspace tools use this path to identify a specific instance of the device.
--- drivers/iio/light/apds9960.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/light/apds9960.c +1 -0
@@ -1006,6 +1006,7 @@ static int apds9960_probe(struct i2c_cliiio_device_attach_buffer (indio_dev, buffer); + indio_dev->dev.parent = &client->dev; indio_dev->info = &apds9960_info; indio_dev->name =APDS9960_DRV_NAME ; indio_dev->channels = apds9960_channels;
Greg Kroah-Hartman
maintainerPATCH 149/203 iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <[email protected]>
commit 5138806f16c74c7cb8ac3e408a859c79eb7c9567 upstream.
IIO_CHAN_INFO_RAW was returning processed data which was incorrect. This also adds the IIO_CHAN_INFO_SCALE value to convert to a processed value.
--- Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 | 2 +- drivers/iio/proximity/as3935.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-)
Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 +1 -1
@@ -1,4 +1,4 @@ -What /sys/bus/iio/devices/iio:deviceX/in_proximity_raw +What /sys/bus/iio/devices/iio:deviceX/in_proximity_input Date: March 2014 KernelVersion: 3.15 Contact: Matt Ranostay <[email protected]>
drivers/iio/proximity/as3935.c +8 -2
@@ -72,7 +72,8 @@ static const struct iio_chan_spec as3935 .type = IIO_PROXIMITY, .info_mask_separate =BIT (IIO_CHAN_INFO_RAW ) | - BIT(IIO_CHAN_INFO_PROCESSED), +BIT (IIO_CHAN_INFO_PROCESSED ) | + BIT(IIO_CHAN_INFO_SCALE), .scan_index = 0, .scan_type = { .sign = 'u',
@@ -181,7 +182,12 @@ static int as3935_read_raw(struct iio_de/* storm out of range */ if (*val ==AS3935_DATA_MASK )return -EINVAL ; - *val *=1000 ; + +if (m ==IIO_CHAN_INFO_PROCESSED ) + *val *=1000 ; +break ; +case IIO_CHAN_INFO_SCALE : + *val =1000 ;break ;default :return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 150/203 iio: proximity: as3935: remove triggered buffer processing
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <[email protected]>
commit 7d0643634ea567969bf3f3ed6193a9d6fc75653b upstream.
Triggered buffers shouldn't return processed data, and the respective conversion was overflowing the defined .realbits for the channel.
--- drivers/iio/proximity/as3935.c | 1 - 1 file changed, 1 deletion(-)
drivers/iio/proximity/as3935.c +0 -1
@@ -213,7 +213,6 @@ static irqreturn_t as3935_trigger_handleif (ret) goto err_read; val &=AS3935_DATA_MASK ; - val *=1000 ;iio_push_to_buffers_with_timestamp (indio_dev, &val, pf->timestamp); err_read:
Greg Kroah-Hartman
maintainerPATCH 151/203 iio: proximity: as3935: fix buffer stack trashing
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <[email protected]>
commit 37b1ba2c68cfbe37f5f45bb91bcfaf2b016ae6a1 upstream.
Buffer wasn't of a valid size to allow the timestamp, and correct padding. This patchset also moves the buffer off the stack, and onto the heap.
--- drivers/iio/proximity/as3935.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/iio/proximity/as3935.c +4 -2
@@ -64,6 +64,7 @@ struct as3935_state {struct delayed_work work;u32 tune_cap; +u8 buffer[16 ];/* 8-bit data + 56-bit padding + 64-bit timestamp */ u8 buf[2 ]____cacheline_aligned ; };
@@ -212,9 +213,10 @@ static irqreturn_t as3935_trigger_handle ret =as3935_read (st,AS3935_DATA , &val);if (ret) goto err_read; - val &=AS3935_DATA_MASK ; -iio_push_to_buffers_with_timestamp (indio_dev, &val, pf->timestamp); + st->buffer[0 ] = val &AS3935_DATA_MASK ; +iio_push_to_buffers_with_timestamp (indio_dev, &st->buffer, + pf->timestamp); err_read:iio_trigger_notify_done (indio_dev->trig);
Greg Kroah-Hartman
maintainerPATCH 152/203 iio: humidity: hdc100x: correct humidity integration time mask
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <[email protected]>
commit 0e35cf5ce00d873d6e529d2b2cd7598d52438051 upstream.
Apply the correct mask to enable all available humidity integration times. Currently, the driver defaults to 6500 and all is okay with that. However, if 3850 is selected we get a stuck bit and can't change back to 6500 or select 2500. (Verified with HDC1008)
--- drivers/iio/humidity/hdc100x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/humidity/hdc100x.c +1 -1
@@ -55,7 +55,7 @@ static const struct { }, {/* IIO_HUMIDITYRELATIVE channel */ .shift = 8, - .mask = 2, + .mask = 3, }, };
Greg Kroah-Hartman
maintainerPATCH 153/203 iio: humidity: hdc100x: fix IIO_TEMP channel reporting
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <[email protected]>
commit 09bc0ddaab6cab0fa95a67d5535ec772e2671193 upstream.
IIO_TEMP channel was being incorrectly reported back as Celsius when it should have been milliCelsius. This is via an incorrect scale value being returned to userspace.
--- drivers/iio/humidity/hdc100x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/humidity/hdc100x.c +1 -1
@@ -211,7 +211,7 @@ static int hdc100x_read_raw(struct iio_dreturn IIO_VAL_INT_PLUS_MICRO ;case IIO_CHAN_INFO_SCALE :if (chan->type ==IIO_TEMP ) { - *val =165 ; + *val =165000 ; *val2 =65536 >>2 ;return IIO_VAL_FRACTIONAL ; }else {
Greg Kroah-Hartman
maintainerPATCH 154/203 iio: hudmidity: hdc100x: fix incorrect shifting and scaling
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <[email protected]>
commit 94bef000f1d4aa111f4ddda1482cf3b30ad069ce upstream.
Shifting sensor data to the right 2 bits was incorrect and caused the scaling values + offsets to be invalid.
--- drivers/iio/humidity/hdc100x.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/iio/humidity/hdc100x.c +8 -8
@@ -164,14 +164,14 @@ static int hdc100x_get_measurement(strucdev_err (&client->dev,"cannot read high byte measurement" );return ret; } - val = ret <<6 ; + val = ret <<8 ; ret =i2c_smbus_read_byte (client);if (ret <0 ) {dev_err (&client->dev,"cannot read low byte measurement" );return ret; } - val |= ret >>2 ; + val |= ret;return val; }
@@ -212,17 +212,17 @@ static int hdc100x_read_raw(struct iio_dcase IIO_CHAN_INFO_SCALE :if (chan->type ==IIO_TEMP ) { *val =165000 ; - *val2 =65536 >>2 ; + *val2 =65536 ;return IIO_VAL_FRACTIONAL ; }else { - *val =0 ; - *val2 =10000 ; -return IIO_VAL_INT_PLUS_MICRO ; + *val =100 ; + *val2 =65536 ; +return IIO_VAL_FRACTIONAL ; }break ;case IIO_CHAN_INFO_OFFSET : - *val =-3971 ; - *val2 =879096 ; + *val =-15887 ; + *val2 =515151 ;return IIO_VAL_INT_PLUS_MICRO ;default :return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 155/203 staging: iio: accel: fix error check
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis de Bethencourt <[email protected]>
commit ef3149eb3ddb7f9125e11c90f8330e371b55cffd upstream.
sca3000_read_ctrl_reg() returns a negative number on failure, check for this instead of zero.
--- drivers/staging/iio/accel/sca3000_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/accel/sca3000_core.c +1 -1
@@ -594,7 +594,7 @@ static ssize_t sca3000_read_frequency(st goto error_ret_mut; ret =sca3000_read_ctrl_reg (st,SCA3000_REG_CTRL_SEL_OUT_CTRL );mutex_unlock (&st->lock); -if (ret) +if (ret <0 ) goto error_ret; val = ret;if (base_freq >0 )
Greg Kroah-Hartman
maintainerPATCH 156/203 iio: accel: kxsd9: fix the usage of spi_w8r8()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit 0c1f91b98552da49d9d8eed32b3132a58d2f4598 upstream.
These two spi_w8r8() calls return a value with is used by the code following the error check. The dubious use was caused by a cleanup patch.
--- drivers/iio/accel/kxsd9.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/accel/kxsd9.c +2 -2
@@ -81,7 +81,7 @@ static int kxsd9_write_scale(struct iio_mutex_lock (&st->buf_lock); ret =spi_w8r8 (st->us,KXSD9_READ (KXSD9_REG_CTRL_C )); -if (ret) +if (ret <0 ) goto error_ret; st->tx[0 ] =KXSD9_WRITE (KXSD9_REG_CTRL_C ); st->tx[1 ] = (ret & ~KXSD9_FS_MASK ) | i;
@@ -163,7 +163,7 @@ static int kxsd9_read_raw(struct iio_devbreak ;case IIO_CHAN_INFO_SCALE : ret =spi_w8r8 (st->us,KXSD9_READ (KXSD9_REG_CTRL_C )); -if (ret) +if (ret <0 ) goto error_ret; *val2 = kxsd9_micro_scales[ret &KXSD9_FS_MASK ]; ret =IIO_VAL_INT_PLUS_MICRO ;
Greg Kroah-Hartman
maintainerPATCH 157/203 iio:ad7266: Fix broken regulator error handling
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 6b7f4e25f3309f106a5c7ff42c8231494cf285d3 upstream.
All regulator_get() variants return either a pointer to a regulator or an ERR_PTR() so testing for NULL makes no sense and may lead to bugs if we use NULL as a valid regulator. Fix this by using IS_ERR() as expected.
--- drivers/iio/adc/ad7266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7266.c +1 -1
@@ -397,7 +397,7 @@ static int ad7266_probe(struct spi_devic st =iio_priv (indio_dev); st->reg =devm_regulator_get (&spi->dev,"vref" ); -if (!IS_ERR_OR_NULL (st->reg)) { +if (!IS_ERR (st->reg)) { ret =regulator_enable (st->reg);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 158/203 iio:ad7266: Fix support for optional regulators
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit e5511c816e5ac4909bdd38e85ac344e2b9b8e984 upstream.
The ad7266 driver attempts to support deciding between the use of internal and external power supplies by checking to see if an error is returned when requesting the regulator. This doesn't work with the current code since the driver uses a normal regulator_get() which is for non-optional supplies and so assumes that if a regulator is not provided by the platform then this is a bug in the platform integration and so substitutes a dummy regulator. Use regulator_get_optional() instead which indicates to the framework that the regulator may be absent and provides a dummy regulator instead.
--- drivers/iio/adc/ad7266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7266.c +1 -1
@@ -396,7 +396,7 @@ static int ad7266_probe(struct spi_devic st =iio_priv (indio_dev); - st->reg =devm_regulator_get (&spi->dev,"vref" ); + st->reg =devm_regulator_get_optional (&spi->dev,"vref" );if (!IS_ERR (st->reg)) { ret =regulator_enable (st->reg);if (ret)
Greg Kroah-Hartman
maintainerPATCH 159/203 iio:ad7266: Fix probe deferral for vref
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 68b356eb3d9f5e38910fb62e22a78e2a18d544ae upstream.
Currently the ad7266 driver treats any failure to get vref as though the regulator were not present but this means that if probe deferral is triggered the driver will act as though the regulator were not present. Instead only use the internal reference if we explicitly got -ENODEV which is what is returned for absent regulators.
--- drivers/iio/adc/ad7266.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iio/adc/ad7266.c +3 -0
@@ -408,6 +408,9 @@ static int ad7266_probe(struct spi_devic st->vref_mv = ret /1000 ; }else { +/* Any other error indicates that the regulator does exist */ +if (PTR_ERR (st->reg) != -ENODEV ) +return PTR_ERR (st->reg);/* Use internal reference */ st->vref_mv =2500 ; }
Greg Kroah-Hartman
maintainerPATCH 160/203 tty: vt: Fix soft lockup in fbcon cursor blink timer.
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Daney <[email protected]>
commit 1b45996d2ebf9680ccd0db875fc668aa025f40fd upstream.
We are getting somewhat random soft lockups with this signature:
[ 86.992215] [<fffffc00080935e0>] el1_irq+0xa0/0x10c [ 86.997082] [<fffffc000841822c>] cursor_timer_handler+0x30/0x54 [ 87.002991] [<fffffc000810ec44>] call_timer_fn+0x54/0x1a8 [ 87.008378] [<fffffc000810ef88>] run_timer_softirq+0x1c4/0x2bc [ 87.014200] [<fffffc000809077c>] __do_softirq+0x114/0x344 [ 87.019590] [<fffffc00080af45c>] irq_exit+0x74/0x98 [ 87.024458] [<fffffc00080fac20>] __handle_domain_irq+0x98/0xfc [ 87.030278] [<fffffc000809056c>] gic_handle_irq+0x94/0x190
This is caused by the vt visual_init() function calling into fbcon_init() with a vc_cur_blink_ms value of zero. This is a transient condition, as it is later set to a non-zero value. But, if the timer happens to expire while the blink rate is zero, it goes into an endless loop, and we get soft lockup.
The fix is to initialize vc_cur_blink_ms before calling the con_init() function.
--- drivers/tty/vt/vt.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/vt/vt.c +1 -0
@@ -750,6 +750,7 @@ static void visual_init(struct vc_data * vc->vc_complement_mask =0 ; vc->vc_can_do_color =0 ; vc->vc_panic_force_write = false; + vc->vc_cur_blink_ms =DEFAULT_CURSOR_BLINK_MS ; vc->vc_sw->con_init (vc, init);if (!vc->vc_complement_mask) vc->vc_complement_mask = vc->vc_can_do_color ?0x7700 :0x0800 ;
Greg Kroah-Hartman
maintainerPATCH 161/203 tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream.
The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS, which is currently 256, whereas number of keys/buttons in input device (and therefor in key_down) is much larger - KEY_CNT - 768, and that can cause out-of-bound access when we do
sym = U(key_maps[0][k]);
with large 'k'.
To fix it we should not attempt iterating beyond smaller of NR_KEYS and KEY_CNT.
Also while at it let's switch to for_each_set_bit() instead of open-coding it.
--- drivers/tty/vt/keyboard.c | 30 +++++++++--------------------- 1 file changed, 9 insertions(+), 21 deletions(-)
drivers/tty/vt/keyboard.c +9 -21
@@ -366,34 +366,22 @@ static void to_utf8(struct vc_data *vc,static void do_compute_shiftstate (void ) { -unsigned int i, j, k, sym, val; +unsigned int k, sym, val; shift_state =0 ;memset (shift_down,0 ,sizeof (shift_down)); -for (i =0 ; i <ARRAY_SIZE (key_down); i++) { - -if (!key_down[i]) +for_each_set_bit (k, key_down,min (NR_KEYS ,KEY_CNT )) { + sym =U (key_maps[0 ][k]); +if (KTYP (sym) !=KT_SHIFT &&KTYP (sym) !=KT_SLOCK )continue ; - k = i *BITS_PER_LONG ; - -for (j =0 ; j <BITS_PER_LONG ; j++, k++) { - -if (!test_bit (k, key_down)) -continue ; - - sym =U (key_maps[0 ][k]); -if (KTYP (sym) !=KT_SHIFT &&KTYP (sym) !=KT_SLOCK ) -continue ; - - val =KVAL (sym); -if (val ==KVAL (K_CAPSSHIFT )) - val =KVAL (K_SHIFT ); + val =KVAL (sym); +if (val ==KVAL (K_CAPSSHIFT )) + val =KVAL (K_SHIFT ); - shift_down[val]++; - shift_state |= (1 << val); - } + shift_down[val]++; + shift_state |=BIT (val); } }
Greg Kroah-Hartman
maintainerPATCH 165/203 ALSA: dummy: Fix a use-after-free at closing
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit d5dbbe6569481bf12dcbe3e12cff72c5f78d272c upstream.
syzkaller fuzzer spotted a potential use-after-free case in snd-dummy driver when hrtimer is used as backend:
Quoted 30 lines
==================================================================
BUG: KASAN: use-after-free in rb_erase+0x1b17/0x2010 at addr ffff88005e5b6f68 Read of size 8 by task syz-executor/8984 =============================================================================BUG kmalloc-192 (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------Disabling lock debugging due to kernel taint
INFO: Allocated in0xbbbbbbbbbbbbbbbbage=18446705582212484632
....
[< none >]dummy_hrtimer_create+0x49/0x1a0sound/drivers/dummy.c:464
....
INFO: Freed in0xfffd8e09age=18446705496313138713 cpu=2164287125 pid=-1
[< none >]dummy_hrtimer_free+0x68/0x80sound/drivers/dummy.c:481
....Call Trace: [<ffffffff8179e59e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:333 [< inline >] rb_set_parent include/linux/rbtree_augmented.h:111 [< inline >] __rb_erase_augmented include/linux/rbtree_augmented.h:218 [<ffffffff82ca5787>] rb_erase+0x1b17/0x2010 lib/rbtree.c:427 [<ffffffff82cb02e8>] timerqueue_del+0x78/0x170 lib/timerqueue.c:86 [<ffffffff814d0c80>] __remove_hrtimer+0x90/0x220 kernel/time/hrtimer.c:903 [< inline >] remove_hrtimer kernel/time/hrtimer.c:945 [<ffffffff814d23da>] hrtimer_try_to_cancel+0x22a/0x570 kernel/time/hrtimer.c:1046 [<ffffffff814d2742>] hrtimer_cancel+0x22/0x40 kernel/time/hrtimer.c:1066 [<ffffffff85420531>] dummy_hrtimer_stop+0x91/0xb0 sound/drivers/dummy.c:417 [<ffffffff854228bf>] dummy_pcm_trigger+0x17f/0x1e0 sound/drivers/dummy.c:507 [<ffffffff85392170>] snd_pcm_do_stop+0x160/0x1b0 sound/core/pcm_native.c:1106 [<ffffffff85391b26>] snd_pcm_action_single+0x76/0x120 sound/core/pcm_native.c:956 [<ffffffff85391e01>] snd_pcm_action+0x231/0x290 sound/core/pcm_native.c:974
Quoted 8 lines
[< inline >] snd_pcm_stop sound/core/pcm_native.c:1139 [<ffffffff8539754d>] snd_pcm_drop+0x12d/0x1d0 sound/core/pcm_native.c:1784 [<ffffffff8539d3be>] snd_pcm_common_ioctl1+0xfae/0x2150 sound/core/pcm_native.c:2805 [<ffffffff8539ee91>] snd_pcm_capture_ioctl1+0x2a1/0x5e0 sound/core/pcm_native.c:2976 [<ffffffff8539f2ec>] snd_pcm_kernel_ioctl+0x11c/0x160 sound/core/pcm_native.c:3020 [<ffffffff853d9a44>] snd_pcm_oss_sync+0x3a4/0xa30 sound/core/oss/pcm_oss.c:1693 [<ffffffff853da27d>] snd_pcm_oss_release+0x1ad/0x280 sound/core/oss/pcm_oss.c:2483 .....
A workaround is to call hrtimer_cancel() in dummy_hrtimer_sync() which is called certainly before other blocking ops.
--- sound/drivers/dummy.c | 1 + 1 file changed, 1 insertion(+)
sound/drivers/dummy.c +1 -0
@@ -420,6 +420,7 @@ static int dummy_hrtimer_stop(struct sndstatic inline void dummy_hrtimer_sync (struct dummy_hrtimer_pcm *dpcm) { +hrtimer_cancel (&dpcm->timer);tasklet_kill (&dpcm->tasklet); }
Greg Kroah-Hartman
maintainerPATCH 166/203 ALSA: hdac_regmap - fix the register access for runtime PM
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <[email protected]>
commit 8198868f0a283eb23e264951632ce61ec2f82228 upstream.
Call path:
1) snd_hdac_power_up_pm()
2) snd_hdac_power_up()
3) pm_runtime_get_sync()
4) __pm_runtime_resume()
5) rpm_resume()
The rpm_resume() returns 1 when the device is already active. Because the return value is unmodified, the hdac regmap read/write functions should allow this value for the retry I/O operation, too.
--- sound/hda/hdac_regmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/hda/hdac_regmap.c +2 -2
@@ -444,7 +444,7 @@ int snd_hdac_regmap_write_raw(struct hda err =reg_raw_write (codec, reg, val);if (err == -EAGAIN ) { err =snd_hdac_power_up_pm (codec); -if (!err) +if (err >=0 ) err =reg_raw_write (codec, reg, val);snd_hdac_power_down_pm (codec); }
@@ -470,7 +470,7 @@ static int __snd_hdac_regmap_read_raw(st err =reg_raw_read (codec, reg, val, uncached);if (err == -EAGAIN ) { err =snd_hdac_power_up_pm (codec); -if (!err) +if (err >=0 ) err =reg_raw_read (codec, reg, val, uncached);snd_hdac_power_down_pm (codec); }
Greg Kroah-Hartman
maintainerPATCH 167/203 ALSA: hda - Fix the headset mic jack detection on Dell machine
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Woodrow Shen <[email protected]>
commit f83c32925d45926cd0e0f18bf28e6039116c4486 upstream.
The new Dell laptop with codec 3246 can't detect headset mic when headset was inserted on the machine. So adding pin configurations into quirk table makes headset mic work correctly.
Codec: Realtek ALC3246
Vendor Id: 0x10ec0256
Subsystem Id: 0x10280781
--- sound/pci/hda/patch_realtek.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/pci/hda/patch_realtek.c +4 -0
@@ -5832,6 +5832,10 @@ static const struct snd_hda_pin_quirk al {0x14, 0x90170120}, {0x21, 0x02211030}), SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60170}, + {0x14, 0x90170120}, + {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ALC256_STANDARD_PINS), SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, {0x12, 0x90a60130},
Greg Kroah-Hartman
maintainerPATCH 168/203 ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <[email protected]>
commit 0f087ee3f3b86a4507db4ff1d2d5a3880e4cfd16 upstream.
See: https://bugzilla.redhat.com/show_bug.cgi?id=1349539
See: https://bugzilla.kernel.org/show_bug.cgi?id=120961
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -5650,6 +5650,8 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x503c ,"Thinkpad L450" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x504a ,"ThinkPad X260" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x504b ,"Thinkpad" ,ALC293_FIXUP_LENOVO_SPK_NOISE ), +SND_PCI_QUIRK (0x17aa ,0x5050 ,"Thinkpad T560p" ,ALC292_FIXUP_TPT460 ), +SND_PCI_QUIRK (0x17aa ,0x5053 ,"Thinkpad T460" ,ALC292_FIXUP_TPT460 ),SND_PCI_QUIRK (0x17aa ,0x5109 ,"Thinkpad" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x17aa ,0x3bf8 ,"Quanta FL1" ,ALC269_FIXUP_PCM_44K ), SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
Greg Kroah-Hartman
maintainerPATCH 169/203 ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 62db7152c924e4c060e42b34a69cd39658e8a0dc upstream.
vortex_wtdma_bufshift() function does calculate the page index wrongly, first masking then shift, which always results in zero. The proper computation is to first shift, then mask.
--- sound/pci/au88x0/au88x0_core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
sound/pci/au88x0/au88x0_core.c +2 -3
@@ -1444,9 +1444,8 @@ static int vortex_wtdma_bufshift(vortex_int page, p, pp, delta, i; page = - (hwread (vortex->mmio,VORTEX_WTDMA_STAT + (wtdma <<2 )) & -WT_SUBBUF_MASK ) - >>WT_SUBBUF_SHIFT ; + (hwread (vortex->mmio,VORTEX_WTDMA_STAT + (wtdma <<2 )) + >>WT_SUBBUF_SHIFT ) &WT_SUBBUF_MASK ;if (dma->nr_periods >=4 ) delta = (page - dma->period_real) &3 ;else {
Greg Kroah-Hartman
maintainerPATCH 170/203 ALSA: echoaudio: Fix memory allocation
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit 9c6795a9b3cbb56a9fbfaf43909c5c22999ba317 upstream.
'commpage_bak' is allocated with 'sizeof(struct echoaudio)' bytes. We then copy 'sizeof(struct comm_page)' bytes in it.
On my system, smatch complains because one is 2960 and the other is 3072.
This would result in memory corruption or a oops.
--- sound/pci/echoaudio/echoaudio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/echoaudio/echoaudio.c +2 -2
@@ -2200,11 +2200,11 @@ static int snd_echo_resume(struct deviceu32 pipe_alloc_mask;int err; - commpage_bak =kmalloc (sizeof (struct echoaudio ),GFP_KERNEL ); + commpage_bak =kmalloc (sizeof (*commpage),GFP_KERNEL );if (commpage_bak ==NULL )return -ENOMEM ; commpage = chip->comm_page; -memcpy (commpage_bak, commpage,sizeof (struct comm_page )); +memcpy (commpage_bak, commpage,sizeof (*commpage)); err =init_hw (chip, chip->pci->device, chip->pci->subsystem_device);if (err <0 ) {
Greg Kroah-Hartman
maintainerPATCH 171/203 ALSA: timer: Fix negative queue usage by racy accesses
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 3fa6993fef634e05d200d141a85df0b044572364 upstream.
The user timer tu->qused counter may go to a negative value when multiple concurrent reads are performed since both the check and the decrement of tu->qused are done in two individual locked contexts. This results in bogus read outs, and the endless loop in the user-space side.
The fix is to move the decrement of the tu->qused counter into the same spinlock context as the zero-check of the counter.
--- sound/core/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/timer.c +1 -1
@@ -1954,6 +1954,7 @@ static ssize_t snd_timer_user_read(struc qhead = tu->qhead++; tu->qhead %= tu->queue_size; + tu->qused--;spin_unlock_irq (&tu->qlock);if (tu->tread) {
@@ -1967,7 +1968,6 @@ static ssize_t snd_timer_user_read(struc }spin_lock_irq (&tu->qlock); - tu->qused--;if (err <0 ) goto _error; result += unit;
Greg Kroah-Hartman
maintainerPATCH 172/203 ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Torsten Hilbrich <[email protected]>
commit 9cd25743765cfe851aed8d655a62d60156aed293 upstream.
This solves the issue that a headphone is not working on the docking unit.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -5651,6 +5651,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x504a ,"ThinkPad X260" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x504b ,"Thinkpad" ,ALC293_FIXUP_LENOVO_SPK_NOISE ),SND_PCI_QUIRK (0x17aa ,0x5050 ,"Thinkpad T560p" ,ALC292_FIXUP_TPT460 ), +SND_PCI_QUIRK (0x17aa ,0x5051 ,"Thinkpad L460" ,ALC292_FIXUP_TPT460 ),SND_PCI_QUIRK (0x17aa ,0x5053 ,"Thinkpad T460" ,ALC292_FIXUP_TPT460 ),SND_PCI_QUIRK (0x17aa ,0x5109 ,"Thinkpad" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
Greg Kroah-Hartman
maintainerPATCH 173/203 ALSA: hda - Add PCI ID for Kabylake-H
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <[email protected]>
commit 6858107e78b4ecb9f244db814ffbdba1b5ce759b upstream.
Kabylake-H shows up as PCI ID 0xa2f0. We missed adding this earlier with other KBL IDs.
--- sound/pci/hda/hda_intel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/pci/hda/hda_intel.c +5 -1
@@ -367,9 +367,10 @@ enum {#define IS_SKL_LP (pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70)#define IS_KBL (pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa171)#define IS_KBL_LP (pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71) +#define IS_KBL_H (pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa2f0)#define IS_BXT (pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)#define IS_SKL_PLUS (pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \ - IS_KBL(pci) || IS_KBL_LP(pci) + IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci)static char *driver_short_names[] = { [AZX_DRIVER_ICH ] ="HDA Intel" ,
@@ -2190,6 +2191,9 @@ static const struct pci_device_id azx_id/* Kabylake-LP */ { PCI_DEVICE(0x8086, 0x9d71), .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, + /* Kabylake-H */ + { PCI_DEVICE(0x8086, 0xa2f0), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, /* Broxton-P(Apollolake) */ { PCI_DEVICE(0x8086, 0x5a98), .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
Greg Kroah-Hartman
maintainerPATCH 174/203 ALSA: hda - fix read before array start
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Copeland <[email protected]>
commit 81e43960dce1c8e58e682fb3ec26c1d8f83a9afc upstream.
UBSAN reports the following warning from accessing path->path[-1] in set_path_power():
[ 16.078040] ================================================================================ [ 16.078124] UBSAN: Undefined behaviour in sound/pci/hda/hda_generic.c:3981:17 [ 16.078198] index -1 is out of range for type 'hda_nid_t [10]' [ 16.078270] CPU: 2 PID: 1738 Comm: modprobe Not tainted 4.7.0-rc1-wt+ #47 [ 16.078274] Hardware name: LENOVO 3443CTO/3443CTO, BIOS G6ET23WW (1.02 ) 08/14/2012 [ 16.078278] ffff8800cb246000 ffff8800cb3638b8 ffffffff815c4fe3 0000000000000032 [ 16.078286] ffff8800cb3638e0 ffffffffffffffff ffff8800cb3638d0 ffffffff8162443d [ 16.078294] ffffffffa0894200 ffff8800cb363920 ffffffff81624af7 0000000000000292 [ 16.078302] Call Trace: [ 16.078311] [<ffffffff815c4fe3>] dump_stack+0x86/0xd3 [ 16.078317] [<ffffffff8162443d>] ubsan_epilogue+0xd/0x40 [ 16.078324] [<ffffffff81624af7>] __ubsan_handle_out_of_bounds+0x67/0x70 [ 16.078335] [<ffffffffa087665f>] set_path_power+0x1bf/0x230 [snd_hda_codec_generic] [ 16.078344] [<ffffffffa087880d>] add_pin_power_ctls+0x8d/0xc0 [snd_hda_codec_generic] [ 16.078352] [<ffffffffa087f190>] ? pin_power_down_callback+0x20/0x20 [snd_hda_codec_generic] [ 16.078360] [<ffffffffa0878947>] add_all_pin_power_ctls+0x107/0x150 [snd_hda_codec_generic] [ 16.078370] [<ffffffffa08842b3>] snd_hda_gen_parse_auto_config+0x2d73/0x49e0 [snd_hda_codec_generic] [ 16.078376] [<ffffffff81173360>] ? trace_hardirqs_on_caller+0x1b0/0x2c0 [ 16.078390] [<ffffffffa089df27>] alc_parse_auto_config+0x147/0x310 [snd_hda_codec_realtek] [ 16.078402] [<ffffffffa08a332a>] patch_alc269+0x23a/0x560 [snd_hda_codec_realtek] [ 16.078417] [<ffffffffa0838644>] hda_codec_driver_probe+0xa4/0x1a0 [snd_hda_codec] [ 16.078424] [<ffffffff817bbac1>] driver_probe_device+0x101/0x380 [ 16.078430] [<ffffffff817bbdf9>] __driver_attach+0xb9/0x100 [ 16.078438] [<ffffffff817bbd40>] ? driver_probe_device+0x380/0x380 [ 16.078444] [<ffffffff817b8d20>] bus_for_each_dev+0x70/0xc0 [ 16.078449] [<ffffffff817bb087>] driver_attach+0x27/0x50 [ 16.078454] [<ffffffff817ba956>] bus_add_driver+0x166/0x2c0 [ 16.078460] [<ffffffffa0369000>] ? 0xffffffffa0369000 [ 16.078465] [<ffffffff817bd13d>] driver_register+0x7d/0x130 [ 16.078477] [<ffffffffa083816f>] __hda_codec_driver_register+0x6f/0x90 [snd_hda_codec] [ 16.078488] [<ffffffffa036901e>] realtek_driver_init+0x1e/0x1000 [snd_hda_codec_realtek] [ 16.078493] [<ffffffff8100215e>] do_one_initcall+0x4e/0x1d0 [ 16.078499] [<ffffffff8119f54d>] ? rcu_read_lock_sched_held+0x6d/0x80 [ 16.078504] [<ffffffff813701b1>] ? kmem_cache_alloc_trace+0x391/0x560 [ 16.078510] [<ffffffff812bb314>] ? do_init_module+0x28/0x273 [ 16.078515] [<ffffffff812bb387>] do_init_module+0x9b/0x273 [ 16.078522] [<ffffffff811e3782>] load_module+0x20b2/0x3410 [ 16.078527] [<ffffffff811df140>] ? m_show+0x210/0x210 [ 16.078533] [<ffffffff813b2b26>] ? kernel_read+0x66/0xe0 [ 16.078541] [<ffffffff811e4cfa>] SYSC_finit_module+0xba/0xc0 [ 16.078547] [<ffffffff811e4d1e>] SyS_finit_module+0xe/0x10 [ 16.078552] [<ffffffff81a860fc>] entry_SYSCALL_64_fastpath+0x1f/0xbd [ 16.078556] ================================================================================
Fix by checking path->depth before use.
--- sound/pci/hda/hda_generic.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/hda_generic.c +2 -0
@@ -3977,6 +3977,8 @@ static hda_nid_t set_path_power(struct hfor (n =0 ; n < spec->paths.used; n++) { path =snd_array_elem (&spec->paths, n); +if (!path->depth) +continue ;if (path->path[0 ] == nid || path->path[path->depth -1 ] == nid) {bool pin_old = path->pin_enabled;
Greg Kroah-Hartman
maintainerPATCH 175/203 ALSA: usb-audio: Fix quirks code is not called
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kazuki Oikawa <[email protected]>
commit 76df52969711ae3725a98f26fbbc6a349803dcbf upstream.
snd_usb_{set_interface,ctl_msg}_quirk checks chip->usb_id to need calling a quirks code. But existed code path that not calling dev_set_drvdata in usb_audio_probe.
--- sound/usb/card.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/card.c +1 -1
@@ -552,7 +552,6 @@ static int usb_audio_probe(struct usb_in goto __error; } chip = usb_chip[i]; -dev_set_drvdata (&dev->dev, chip);atomic_inc (&chip->active);/* avoid autopm */ break ; }
@@ -578,6 +577,7 @@ static int usb_audio_probe(struct usb_in goto __error; } } +dev_set_drvdata (&dev->dev, chip);/* * For devices with more than one control interface, we assume the
Greg Kroah-Hartman
maintainerPATCH 176/203 ALSA: hda/realtek - add new pin definition in alc225 pin quirk table
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit 8a132099f080d7384bb6ab4cc168f76cb4b47d08 upstream.
We have some Dell laptops which can't detect headset mic, the machines use the codec ALC225, they have some new pin configuration values, after adding them in the alc225 pin quirk table, they work well.
--- sound/pci/hda/patch_realtek.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +14 -1
@@ -5738,7 +5738,6 @@ static const struct hda_model_fixup alc2 {} };#define ALC225_STANDARD_PINS \ - {0x12, 0xb7a60130}, \ {0x21, 0x04211020}#define ALC256_STANDARD_PINS \
@@ -5763,10 +5762,24 @@ static const struct hda_model_fixup alc2static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {SND_HDA_PIN_QUIRK (0x10ec0225 ,0x1028 ,"Dell" ,ALC225_FIXUP_DELL1_MIC_NO_PRESENCE ,ALC225_STANDARD_PINS , + {0x12, 0xb7a60130}, {0x14, 0x901701a0}),SND_HDA_PIN_QUIRK (0x10ec0225 ,0x1028 ,"Dell" ,ALC225_FIXUP_DELL1_MIC_NO_PRESENCE ,ALC225_STANDARD_PINS , + {0x12, 0xb7a60130}, {0x14, 0x901701b0}), +SND_HDA_PIN_QUIRK (0x10ec0225 ,0x1028 ,"Dell" ,ALC225_FIXUP_DELL1_MIC_NO_PRESENCE , +ALC225_STANDARD_PINS , + {0x12, 0xb7a60150}, + {0x14, 0x901701a0}), +SND_HDA_PIN_QUIRK (0x10ec0225 ,0x1028 ,"Dell" ,ALC225_FIXUP_DELL1_MIC_NO_PRESENCE , +ALC225_STANDARD_PINS , + {0x12, 0xb7a60150}, + {0x14, 0x901701b0}), +SND_HDA_PIN_QUIRK (0x10ec0225 ,0x1028 ,"Dell" ,ALC225_FIXUP_DELL1_MIC_NO_PRESENCE , +ALC225_STANDARD_PINS , + {0x12, 0xb7a60130}, + {0x1b, 0x90170110}),SND_HDA_PIN_QUIRK (0x10ec0255 ,0x1028 ,"Dell" ,ALC255_FIXUP_DELL2_MIC_NO_PRESENCE , {0x14, 0x90170110}, {0x21, 0x02211020}),
Greg Kroah-Hartman
maintainerPATCH 177/203 ALSA: pcm: Free chmap at PCM free callback, too
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit a8ff48cb70835f48de5703052760312019afea55 upstream.
The chmap ctls assigned to PCM streams are freed in the PCM disconnect callback. However, since the disconnect callback isn't called when the card gets freed before registering, the chmap ctls may still be left assigned. They are eventually freed together with other ctls, but it may cause an Oops at pcm_chmap_ctl_private_free(), as the function refers to the assigned PCM stream, while the PCM objects have been already freed beforehand.
The fix is to free the chmap ctls also at PCM free callback, not only at PCM disconnect.
--- sound/core/pcm.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
sound/core/pcm.c +10 -4
@@ -849,6 +849,14 @@ int snd_pcm_new_internal(struct snd_card }EXPORT_SYMBOL (snd_pcm_new_internal); +static void free_chmap (struct snd_pcm_str *pstr) +{ +if (pstr->chmap_kctl) { +snd_ctl_remove (pstr->pcm->card, pstr->chmap_kctl); + pstr->chmap_kctl =NULL ; + } +} +static void snd_pcm_free_stream (struct snd_pcm_str * pstr) {struct snd_pcm_substream *substream, *substream_next;
@@ -871,6 +879,7 @@ static void snd_pcm_free_stream(struct s kfree(setup); }#endif +free_chmap (pstr);if (pstr->substream_count)put_device (&pstr->dev); }
@@ -1135,10 +1144,7 @@ static int snd_pcm_dev_disconnect(structfor (cidx =0 ; cidx <2 ; cidx++) {if (!pcm->internal)snd_unregister_device (&pcm->streams[cidx].dev); -if (pcm->streams[cidx].chmap_kctl) { -snd_ctl_remove (pcm->card, pcm->streams[cidx].chmap_kctl); - pcm->streams[cidx].chmap_kctl =NULL ; - } +free_chmap (&pcm->streams[cidx]); }mutex_unlock (&pcm->open_mutex);mutex_unlock (®ister_mutex);
Greg Kroah-Hartman
maintainerPATCH 178/203 ALSA: ctl: Stop notification after disconnection
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f388cdcdd160687c6650833f286b9c89c50960ff upstream.
snd_ctl_remove() has a notification for the removal event. It's superfluous when done during the device got disconnected. Although the notification itself is mostly harmless, it may potentially be harmful, and should be suppressed. Actually some components PCM may free ctl elements during the disconnect or free callbacks, thus it's no theoretical issue.
This patch adds the check of card->shutdown flag for avoiding unnecessary notifications after (or during) the disconnect.
--- sound/core/control.c | 2 ++ 1 file changed, 2 insertions(+)
sound/core/control.c +2 -0
@@ -160,6 +160,8 @@ void snd_ctl_notify(struct snd_card *carif (snd_BUG_ON (!card || !id))return ; +if (card->shutdown) +return ;read_lock (&card->ctl_files_rwlock);#if IS_ENABLED (CONFIG_SND_MIXER_OSS ) card->mixer_oss_change_count++;
Greg Kroah-Hartman
maintainerPATCH 179/203 ALSA: hda - fix use-after-free after module unload
In reply to Greg Kroah-Hartman4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wu <[email protected]>
commit ab58d8cc870ef3f0771c197700441936898d1f1d upstream.
register_vga_switcheroo() sets the PM ops from the hda structure which is freed later in azx_free. Make sure that these ops are cleared.
Caught by KASAN, initially noticed due to a general protection fault.
--- sound/pci/hda/hda_intel.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/pci/hda/hda_intel.c +3 -1
@@ -1218,8 +1218,10 @@ static int azx_free(struct azx *chip)if (use_vga_switcheroo (hda)) {if (chip->disabled && hda->probe_continued)snd_hda_unlock_devices (&chip->bus); -if (hda->vga_switcheroo_registered) +if (hda->vga_switcheroo_registered) {vga_switcheroo_unregister_client (chip->pci); +vga_switcheroo_fini_domain_pm_ops (chip->card->dev); + } }if (bus->chip_init) {