4.16.17-stable review
Subsystems (18)
Greg Kroah-Hartman
maintainercover 4.16.17-stable review
This is the start of the stable review cycle for the 4.16.17 release. There are 279 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jun 20 08:05:28 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.16.17-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.16.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.16.17-rc1
Russell King <[email protected]>
ARM: fix kill( ,SIGFPE) breakage
Russell King <[email protected]>
ARM: replace unnecessary perl with sed and the shell $(( )) operator
Russell King <[email protected]>
ARM: kexec: fix kdump register saving on panic()
Łukasz Stelmach <[email protected]>
ARM: 8758/1: decompressor: restore r1 and r2 just before jumping to the kernel
Łukasz Stelmach <[email protected]>
ARM: 8753/1: decompressor: add a missing parameter to the addruart macro
Mark Rutland <[email protected]>
efi/libstub/arm64: Handle randomized TEXT_OFFSET
Darren Hart <[email protected]>
platform/x86: DELL_WMI use depends on instead of select for DELL_SMBIOS
Helge Deller <[email protected]>
parisc: Move setup_profiling_timer() out of init section
Mathieu Malaterre <[email protected]>
sched/deadline: Make the grub_reclaim() function static
Mathieu Malaterre <[email protected]>
sched/debug: Move the print_rt_rq() and print_dl_rq() declarations to kernel/sched/sched.h
Dan Carpenter <[email protected]>
drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl()
Waiman Long <[email protected]>
locking/percpu-rwsem: Annotate rwsem ownership transfer by setting RWSEM_OWNER_UNKNOWN
Waiman Long <[email protected]>
locking/rwsem: Add a new RWSEM_ANONYMOUSLY_OWNED flag
Stefan Agner <[email protected]>
clk: imx6ull: use OSC clock during AXI rate change
Geert Uytterhoeven <[email protected]>
mtd: rawnand: Fix return type of __DIVIDE() when called with 32-bit
Wanpeng Li <[email protected]>
KVM: X86: Lower the default timer frequency limit to 200us
Sekhar Nori <[email protected]>
ARM: davinci: board-dm646x-evm: set VPIF capture card name
Sekhar Nori <[email protected]>
ARM: davinci: board-dm646x-evm: pass correct I2C adapter id for VPIF
Sekhar Nori <[email protected]>
ARM: davinci: dm646x: fix timer interrupt generation
Peter Rosin <[email protected]>
i2c: viperboard: return message count on master_xfer success
Peter Rosin <[email protected]>
i2c: pmcmsp: fix error return from master_xfer
Peter Rosin <[email protected]>
i2c: pmcmsp: return message count on master_xfer success
Russell King <[email protected]>
ARM: keystone: fix platform_domain_notifier array overrun
Daniel Glöckner <[email protected]>
usb: musb: fix remote wakeup racing with suspend
David Howells <[email protected]>
afs: Fix the non-encryption of calls
Marc Dionne <[email protected]>
afs: Fix afs_find_server search loop
David Howells <[email protected]>
afs: Fix the handling of CB.InitCallBackState3 to find the server by UUID
David Howells <[email protected]>
afs: Fix VNOVOL handling in address rotation
Ben Hutchings <[email protected]>
mtd: Fix comparison in map_word_andequal()
David Howells <[email protected]>
afs: Fix server rotation's handling of fileserver probe failure
David Howells <[email protected]>
afs: Fix refcounting in callback registration
David Howells <[email protected]>
afs: Fix address list parsing
Dave Hansen <[email protected]>
x86/pkeys/selftests: Add a test for pkey 0
Dave Hansen <[email protected]>
x86/pkeys/selftests: Save off 'prot' for allocations
Dave Hansen <[email protected]>
x86/pkeys/selftests: Fix pointer math
Dave Hansen <[email protected]>
x86/pkeys/selftests: Fix pkey exhaustion test off-by-one
Dave Hansen <[email protected]>
x86/pkeys/selftests: Add PROT_EXEC test
Dave Hansen <[email protected]>
x86/pkeys/selftests: Factor out "instruction page"
Dave Hansen <[email protected]>
x86/pkeys/selftests: Allow faults on unknown keys
Dave Hansen <[email protected]>
x86/pkeys/selftests: Avoid printf-in-signal deadlocks
Dave Hansen <[email protected]>
x86/pkeys/selftests: Remove dead debugging code, fix dprint_in_signal
Dave Hansen <[email protected]>
x86/pkeys/selftests: Stop using assert()
Dave Hansen <[email protected]>
x86/pkeys/selftests: Give better unexpected fault error messages
Andy Lutomirski <[email protected]>
x86/selftests: Add mov_to_ss test
Ingo Molnar <[email protected]>
x86/mpx/selftests: Adjust the self-test to fresh distros that export the MPX ABI
Ingo Molnar <[email protected]>
x86/pkeys/selftests: Adjust the self-test to fresh distros that export the pkeys ABI
Ingo Molnar <[email protected]>
objtool, kprobes/x86: Sync the latest <asm/insn.h> header with tools/objtool/arch/x86/include/asm/insn.h
Masami Hiramatsu <[email protected]>
uprobes/x86: Prohibit probing on MOV SS instruction
Masami Hiramatsu <[email protected]>
kprobes/x86: Prohibit probing on exception masking instructions
Ashish Samant <[email protected]>
ocfs2: take inode cluster lock before moving reflinked inode from orphan dir
Laura Abbott <[email protected]>
proc/kcore: don't bounds check against address 0
Jeffrey Hugo <[email protected]>
init: fix false positives in W+X checking
Yury Norov <[email protected]>
lib/find_bit_benchmark.c: avoid soft lockup in test_find_first_bit()
Roman Mashak <[email protected]>
net sched actions: fix invalid pointer dereferencing if skbedit flags missing
Colin Ian King <[email protected]>
ixgbe: fix memory leak on ipsec allocation
Emil Tantilov <[email protected]>
ixgbe: return error on unsupported SFP module when resetting
Rob Herring <[email protected]>
sh: switch to NO_BOOTMEM
Leo Yan <[email protected]>
perf cs-etm: Support unknown_thread in cs_etm_auxtrace
Marian Rotariu <[email protected]>
x86: Delay skip of emulated hypercall instruction
Wanpeng Li <[email protected]>
KVM: Extend MAX_IRQ_ROUTES to 4096 for all archs
Nikita Yushchenko <[email protected]>
ARM: dts: imx51-zii-rdu1: fix touchscreen bindings
David Howells <[email protected]>
rxrpc: Fix the min security level for kernel calls
David Howells <[email protected]>
rxrpc: Fix error reception on AF_INET6 sockets
David Howells <[email protected]>
rxrpc: Fix missing start of call timeout
Ganesh Goudar <[email protected]>
cxgb4: copy mbox log size to PF0-3 adap instances
Michal Kalderon <[email protected]>
qede: Fix gfp flags sent to rdma event node allocation
Michal Kalderon <[email protected]>
qed: Fix l2 initializations over iWARP personality
Ying Xue <[email protected]>
tipc: eliminate KMSAN uninit-value in strcmp complaint
Mathieu Malaterre <[email protected]>
agp: uninorth: make two functions static
Andrey Grodzovsky <[email protected]>
drm/amdgpu: Switch to interruptable wait to recover from ring hang.
Paulo Alcantara <[email protected]>
cifs: smb2ops: Fix listxattr() when there are no EAs
Long Li <[email protected]>
cifs: Allocate validate negotiation request through kmalloc
David Gilhooley <[email protected]>
arm64: Add MIDR encoding for NVIDIA CPUs
Hans de Goede <[email protected]>
HID: i2c-hid: Add RESEND_REPORT_DESCR quirk for Toshiba Click Mini L9W-B
Jakob Unterwurzacher <[email protected]>
can: dev: increase bus-off message severity
Michael Ellerman <[email protected]>
powerpc/pseries: Fix CONFIG_NUMA=n build
Igor Russkikh <[email protected]>
net: aquantia: Limit number of vectors to actually allocated irqs
Igor Russkikh <[email protected]>
net: aquantia: driver should correctly declare vlan_features bits
van der Linden, Frank <[email protected]>
x86/xen: Reset VCPU0 info pointer after shared_info remap
Sara Sharon <[email protected]>
mac80211: use timeout from the AddBA response instead of the request
Clément Péron <[email protected]>
ARM: dts: cygnus: fix irq type for arm global timer
Mathieu Malaterre <[email protected]>
driver core: add __printf verification to __ata_ehi_pushv_desc
Jianchao Wang <[email protected]>
nvme: fix use-after-free in nvme_free_ns_head
Tomi Valkeinen <[email protected]>
drm/omap: handle alloc failures in omap_connector
Tomi Valkeinen <[email protected]>
drm/omap: check return value from soc_device_match
Tomi Valkeinen <[email protected]>
drm/omap: fix possible NULL ref issue in tiler_reserve_2d
Tomi Valkeinen <[email protected]>
drm/omap: fix uninitialized ret variable
Dan Carpenter <[email protected]>
drm/omap: silence unititialized variable warning
Eric Anholt <[email protected]>
drm/vc4: Fix oops dereferencing DPI's connector since panel_bridge.
Ilan Peer <[email protected]>
mac80211: Adjust SAE authentication timeout
Naveen N. Rao <[email protected]>
powerpc/trace/syscalls: Update syscall name matching logic to account for ppc_ prefix
Naveen N. Rao <[email protected]>
powerpc/trace/syscalls: Update syscall name matching logic
Etienne Carriere <[email protected]>
tee: check shm references are consistent in offset/size
Rich Felker <[email protected]>
sh: fix build failure for J2 cpu with SMP disabled
Masahiro Yamada <[email protected]>
gcc-plugins: fix build condition of SANCOV plugin
Bhadram Varka <[email protected]>
net: phy: broadcom: add support for BCM89610 PHY
Peter Zijlstra <[email protected]>
sched/core: Introduce set_special_state()
Daniel Borkmann <[email protected]>
bpf: use array_index_nospec in find_prog_type
Tobias Jakobi <[email protected]>
drm/exynos: mixer: avoid Oops in vp_video_buffer()
Andrzej Hajda <[email protected]>
drm/exynos/mixer: fix synchronization check in interlaced mode
Mark Rutland <[email protected]>
bpf: fix possible spectre-v1 in find_and_alloc_map()
Rob Herring <[email protected]>
spi: bcm2835aux: ensure interrupts are enabled for shared handler
Parav Pandit <[email protected]>
RDMA/cma: Do not query GID during QP state transition to RTR
Jack Morgenstein <[email protected]>
IB/mlx4: Fix integer overflow when calculating optimal MTT size
Sebastian Sanchez <[email protected]>
IB/hfi1: Fix memory leak in exception path in get_irq_affinity()
Sebastian Sanchez <[email protected]>
IB/{hfi1, rdmavt}: Fix memory leak in hfi1_alloc_devdata() upon failure
Michael J. Ruhl <[email protected]>
IB/hfi1 Use correct type for num_user_context
Stefan Raspl <[email protected]>
smc: fix sendpage() call
Heikki Krogerus <[email protected]>
usb: typec: tps6598x: handle block reads separately with plain-I2C adapters
Graeme Smecher <[email protected]>
ARM: dts: correct missing "compatible" entry for ti81xx SoCs
Janusz Krzysztofik <[email protected]>
ARM: OMAP1: ams-delta: fix deferred_fiq handler
Keith Busch <[email protected]>
nvme/multipath: Fix multipath disabled naming collisions
Keith Busch <[email protected]>
nvme/multipath: Disable runtime writable enabling parameter
Keith Busch <[email protected]>
nvme: Set integrity flag for user passthrough commands
Chengguang Xu <[email protected]>
nvme: fix potential memory leak in option parsing
Changbin Du <[email protected]>
iommu/vt-d: fix shift-out-of-bounds in bug checking
Jagannathan Raman <[email protected]>
iommu/vt-d: Fix usage of force parameter in intel_ir_reconfigure_irte()
Bhadram Varka <[email protected]>
arm64: tegra: Make BCM89610 PHY interrupt as active low
Peter Zijlstra <[email protected]>
kthread, sched/wait: Fix kthread_parkme() completion issue
Peter Zijlstra <[email protected]>
kthread, sched/wait: Fix kthread_parkme() wait-loop
Peter Zijlstra <[email protected]>
stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock
Helge Deller <[email protected]>
parisc: drivers.c: Fix section mismatches
Daniel Borkmann <[email protected]>
bpf, x64: fix memleak when not converging on calls
Daniel Borkmann <[email protected]>
bpf, x64: fix memleak when not converging after image
Ladislav Michl <[email protected]>
mtd: onenand: omap2: Disable DMA for HIGHMEM buffers
Mika Westerberg <[email protected]>
pinctrl: cherryview: Associate IRQ descriptors to irqdomain
Yixun Lan <[email protected]>
pinctrl: meson-axg: fix the range of aobus bank
Sekhar Nori <[email protected]>
ARM: davinci: fix GPIO lookup for I2C
Jim Gill <[email protected]>
scsi: vmw-pvscsi: return DID_BUS_BUSY for adapter-initated aborts
Arnd Bergmann <[email protected]>
hexagon: export csum_partial_copy_nocheck
Arnd Bergmann <[email protected]>
hexagon: add memset_io() helper
Nick Dyer <[email protected]>
Input: atmel_mxt_ts - fix the firmware update
Chuck Lever <[email protected]>
xprtrdma: Fix list corruption / DMAR errors during MR recovery
Adam Ford <[email protected]>
ARM: dts: logicpd-som-lv: Fix Audio Mute
Adam Ford <[email protected]>
ARM: dts: logicpd-som-lv: Fix WL127x Startup Issues
Tero Kristo <[email protected]>
ARM: OMAP2+: powerdomain: use raw_smp_processor_id() for trace
Geert Uytterhoeven <[email protected]>
dt-bindings: panel: lvds: Fix path to display timing bindings
Sekhar Nori <[email protected]>
ARM: davinci: board-dm355-evm: fix broken networking
Sekhar Nori <[email protected]>
ARM: davinci: board-omapl138-hawk: fix GPIO numbers for MMC/SD lookup
Sekhar Nori <[email protected]>
ARM: davinci: board-da850-evm: fix GPIO lookup for MMC/SD
Sekhar Nori <[email protected]>
ARM: davinci: board-da830-evm: fix GPIO lookup for MMC/SD
Håkon Bugge <[email protected]>
IB/core: Make ib_mad_client_id atomic
Amir Goldstein <[email protected]>
<linux/stringhash.h>: fix end_name_hash() for 64bit long
oulijun <[email protected]>
RDMA/hns: Submit bad wr
oulijun <[email protected]>
RDMA/hns: Fix the qp context state diagram
oulijun <[email protected]>
RDMA/hns: Intercept illegal RDMA operation when use inline data
oulijun <[email protected]>
RDMA/hns: Bugfix for init hem table
Zhu Yanjun <[email protected]>
IB/rxe: avoid double kfree_skb
Jianchao Wang <[email protected]>
IB/rxe: add RXE_START_MASK for rxe_opcode IB_OPCODE_RC_SEND_ONLY_INV
Colin Ian King <[email protected]>
RDMA/iwpm: fix memory leak on map_info
Parav Pandit <[email protected]>
RDMA/cma: Fix use after destroy access to net namespace for IPoIB
Matan Barak <[email protected]>
IB/uverbs: Fix validating mandatory attributes
Junaid Shahid <[email protected]>
kvm: apic: Flush TLB after APIC mode/address change if VPIDs are in use
Maxime Chevallier <[email protected]>
net: mvpp2: Fix clk error path in mvpp2_probe
Greg Thelen <[email protected]>
IB: make INFINIBAND_ADDR_TRANS configurable
Greg Thelen <[email protected]>
ib_srp: depend on INFINIBAND_ADDR_TRANS
Greg Thelen <[email protected]>
cifs: smbd: depend on INFINIBAND_ADDR_TRANS
Greg Thelen <[email protected]>
ib_srpt: depend on INFINIBAND_ADDR_TRANS
Greg Thelen <[email protected]>
nvmet-rdma: depend on INFINIBAND_ADDR_TRANS
Greg Thelen <[email protected]>
nvme: depend on INFINIBAND_ADDR_TRANS
Jakub Kicinski <[email protected]>
nfp: don't depend on eth_tbl being available
Jon Maloy <[email protected]>
tipc: fix bug in function tipc_nl_node_dump_monitor
Leon Romanovsky <[email protected]>
RDMA/mlx5: Properly check return value of mlx5_get_uars_page
Baolin Wang <[email protected]>
i2c: sprd: Fix the i2c count issue
Baolin Wang <[email protected]>
i2c: sprd: Prevent i2c accesses after suspend is called
Masahiro Yamada <[email protected]>
reset: uniphier: fix USB clock line for LD20
Laurentiu Tudor <[email protected]>
powerpc/kvm/booke: Fix altivec related build break
Stefano Brivio <[email protected]>
vti6: Change minimum MTU to IPV4_MIN_MTU, vti6 can carry IPv4 too
John Fastabend <[email protected]>
bpf: fix uninitialized variable in bpf tools
[email protected] <[email protected]>
x86/cpu/intel: Add missing TLB cpuid values
Evan Wang <[email protected]>
ata: ahci: mvebu: override ahci_stop_engine for mvebu AHCI
Evan Wang <[email protected]>
libahci: Allow drivers to override stop_engine
Mark Rutland <[email protected]>
KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_mmio_read_apr()
Mark Rutland <[email protected]>
arm64: fix possible spectre-v1 in ptrace_hbp_get_event()
Omar Sandoval <[email protected]>
blk-mq: fix sysfs inflight counter
Arvind Yadav <[email protected]>
HID: intel-ish-hid: use put_device() instead of kfree()
Ramon Fried <[email protected]>
rpmsg: added MODULE_ALIAS for rpmsg_char
Tobias Jordan <[email protected]>
remoteproc: qcom: Fix potential device node leaks
Kan Liang <[email protected]>
perf/x86/intel: Don't enable freeze-on-smi for PerfMon V1
Dag Moxnes <[email protected]>
rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp
Gianluca Borello <[email protected]>
bpf, x64: fix JIT emission for dead code
Masami Hiramatsu <[email protected]>
selftests: ftrace: Add a testcase for multiple actions on trigger
Arvind Yadav <[email protected]>
HID: wacom: Release device resource data obtained by devres_alloc()
pgzh <[email protected]>
HID: lenovo: Add support for IBM/Lenovo Scrollpoint mice
Kan Liang <[email protected]>
perf pmu: Fix core PMU alias list for X86 platform
Mark Rutland <[email protected]>
arm64: only advance singlestep for user instruction traps
Mark Rutland <[email protected]>
arm64: ptrace: remove addr_limit manipulation
Aurelien Jarno <[email protected]>
RISC-V: build vdso-dummy.o with -no-pie
Christoph Hellwig <[email protected]>
riscv: select DMA_DIRECT_OPS instead of redefining it
Florian Fainelli <[email protected]>
net: ethtool: Add missing kernel doc for FEC parameters
Vinicius Costa Gomes <[email protected]>
igb: Fix the transmission mode of queue 0 for Qav mode
Masahiro Yamada <[email protected]>
arm64: dts: uniphier: fix input delay value for legacy mode of eMMC
Steve French <[email protected]>
CIFS: set *resp_buf_type to NO_BUFFER on error
Hans de Goede <[email protected]>
thermal: int3403_thermal: Fix NULL pointer deref on module load / probe
Markus Mayer <[email protected]>
cpufreq: brcmstb-avs-cpufreq: remove development debug support
Andres Rodriguez <[email protected]>
drm/amdkfd: fix clock counter retrieval for node without GPU
Mika Westerberg <[email protected]>
ACPI / watchdog: Prefer iTCO_wdt on Lenovo Z50-70
Sekhar Nori <[email protected]>
ARM: dts: da850: fix W=1 warnings with pinmux node
Jingju Hou <[email protected]>
net: phy: marvell: clear wol event before setting it
Balbir Singh <[email protected]>
powerpc/powernv/memtrace: Let the arch hotunplug code flush cache
Geert Uytterhoeven <[email protected]>
dt-bindings: mvebu-uart: DT fix s/interrupts-names/interrupt-names/
Geert Uytterhoeven <[email protected]>
dt-bindings: meson-uart: DT fix s/clocks-names/clock-names/
Mika Westerberg <[email protected]>
ACPI / scan: Initialize watchdog before PNP
Chen Yu <[email protected]>
ACPI / PM: Blacklist Low Power S0 Idle _DSM for ThinkPad X1 Tablet(2016)
Julian Wiedmann <[email protected]>
s390/qeth: use Read device to query hypervisor for MAC
Julian Wiedmann <[email protected]>
s390/qeth: fix request-side race during cmd IO timeout
Julian Wiedmann <[email protected]>
s390/qeth: fix MAC address update sequence
Tobias Regnery <[email protected]>
usb: typec: ucsi: fix tracepoint related build error
Minchan Kim <[email protected]>
mm: memcg: add __GFP_NOWARN in __memcg_schedule_kmem_cache_create()
Dave Young <[email protected]>
kexec_file: do not add extra alignment to efi memmap
Alexey Dobriyan <[email protected]>
proc: fix /proc/loadavg regression
Alexey Dobriyan <[email protected]>
proc: revalidate kernel thread inodes to root:root
Huang Ying <[email protected]>
mm, pagemap: fix swap offset value for PMD migration entry
Colin Ian King <[email protected]>
scsi: isci: Fix infinite loop in while loop
Long Li <[email protected]>
scsi: storvsc: Set up correct queue depth values for IDE devices
Baolin Wang <[email protected]>
parisc: time: Convert read_persistent_clock() to read_persistent_clock64()
David Howells <[email protected]>
vfs: Undo an overly zealous MS_RDONLY -> SB_RDONLY conversion
David Howells <[email protected]>
afs: Fix server record deletion
dann frazier <[email protected]>
net: hns: Avoid action name truncation
Jiang Biao <[email protected]>
blkcg: init root blkcg_gq under lock
Emil Velikov <[email protected]>
drm/msm: don't deref error pointer in the msm_fbdev_create error path
Stefan Agner <[email protected]>
drm/msm/dsi: use correct enum in dsi_get_cmd_fmt
Ben Hutchings <[email protected]>
drm/msm: Fix possible null dereference on failure of get_pages()
Srinivas Kandagatla <[email protected]>
ASoC: msm8916-wcd-analog: use threaded context for mbhc events
Taehee Yoo <[email protected]>
netfilter: nf_tables: fix out-of-bounds in nft_chain_commit_update
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: NAT chain and extensions require NF_TABLES
Ming Lei <[email protected]>
scsi: target: fix crash with iscsi target and dvd
Vinson Lee <[email protected]>
scsi: megaraid_sas: Do not log an error if FW successfully initializes.
Chris Leech <[email protected]>
scsi: iscsi: respond to netlink with unicast when appropriate
Srinath Mannam <[email protected]>
arm64: dts: correct SATA addresses for Stingray
Tung Nguyen <[email protected]>
tipc: fix infinite loop when dumping link monitor summary
Martin Blumenstingl <[email protected]>
ARM64: dts: meson-gxm-khadas-vim2: enable the USB controller
Martin Blumenstingl <[email protected]>
ARM64: dts: meson-gxl-nexbox-a95x: enable the USB controller
Martin Blumenstingl <[email protected]>
ARM64: dts: meson-gxl-s905x-libretech-cc: enable the USB controller
Martin Blumenstingl <[email protected]>
ARM64: dts: meson-gx-p23x-q20x: enable the USB controller
Martin Blumenstingl <[email protected]>
ARM64: dts: meson-gxl-s905x-p212: enable the USB controller
Martin Blumenstingl <[email protected]>
ARM64: dts: meson-gxm: add GXM specific USB host configuration
Martin Blumenstingl <[email protected]>
ARM64: dts: meson-gxl: add USB host support
Jiang Biao <[email protected]>
blkcg: don't hold blkcg lock when deactivating policy
sxauwsk <[email protected]>
spi: cadence: Add usleep_range() for cdns_spi_fill_tx_fifo()
Liam Girdwood <[email protected]>
ASoC: topology: Check widget kcontrols before deref.
Mark Rutland <[email protected]>
arm64: kasan: avoid pfn_to_nid() before page array is initialized
Simon Gaiser <[email protected]>
xen: xenbus_dev_frontend: Really return response string
Andre Przywara <[email protected]>
KVM: arm/arm64: vgic: Kick new VCPU on interrupt migration
Petr Mladek <[email protected]>
livepatch: Allow to call a custom callback when freeing shadow variables
Petr Mladek <[email protected]>
livepatch: Initialize shadow variables safely by a custom callback
Yan Wang <[email protected]>
ASoC: topology: Fix bugs of freeing soc topology
Loic Poulain <[email protected]>
PCI: kirin: Fix reset gpio name
Madhavan Srinivasan <[email protected]>
powerpc/64s: Default l1d_size to 64K in RFI fallback flush
Geert Uytterhoeven <[email protected]>
soc: bcm2835: Make !RASPBERRYPI_FIRMWARE dummies return failure
Florian Fainelli <[email protected]>
soc: bcm: raspberrypi-power: Fix use of __packed
Tyler Hicks <[email protected]>
eCryptfs: don't pass up plaintext names when using filename encryption
Tony Lindgren <[email protected]>
ARM: dts: Fix cm2 and prm sizes for omap4
[email protected] <[email protected]>
ASoC: rt5514: Add the missing register in the readable table
Jerome Brunet <[email protected]>
clk: honor CLK_MUX_ROUND_CLOSEST in generic clk mux
Paolo Bonzini <[email protected]>
kvm: x86: move MSR_IA32_TSC handling to x86.c
KarimAllah Ahmed <[email protected]>
X86/KVM: Properly update 'tsc_offset' to represent the running guest
Jacopo Mondi <[email protected]>
dt-bindings: dmaengine: rcar-dmac: document R8A77965 support
Jacopo Mondi <[email protected]>
dt-bindings: serial: sh-sci: Add support for r8a77965 (H)SCIF
Jacopo Mondi <[email protected]>
dt-bindings: net: ravb: Add support for r8a77965 SoC
Matheus Castello <[email protected]>
dt-bindings: pinctrl: sunxi: Fix reference to driver
Lukasz Majewski <[email protected]>
doc: Add vendor prefix for Kieback & Peter GmbH
Vladimir Zapolskiy <[email protected]>
spi: sh-msiof: Fix bit field overflow writes to TSCR/RSCR
Matt Redfearn <[email protected]>
MIPS: dts: Boston: Fix PCI bus dtc warnings:
Chengguang Xu <[email protected]>
isofs: fix potential memory leak in mount option parsing
Martin Schwidefsky <[email protected]>
s390/smsgiucv: disable SMSG on module unload
Sinan Kaya <[email protected]>
MIPS: io: Add barrier after register read in readX()
Amir Goldstein <[email protected]>
fsnotify: fix ignore mask logic in send_to_group()
Arnaldo Carvalho de Melo <[email protected]>
perf report: Fix switching to another perf.data file
Pieter Jansen van Vuuren <[email protected]>
nfp: flower: split and limit cmsg skb lists
Jakub Kicinski <[email protected]>
nfp: ignore signals when communicating with management FW
Nathan Fontenot <[email protected]>
ibmvnic: Do not notify peers on parameter change resets
Raghuram Chary J <[email protected]>
lan78xx: PHY DSP registers initialization to address EEE link drop issues with long cables
Sinan Kaya <[email protected]>
MIPS: io: Prevent compiler reordering writeX()
Krish Sadhukhan <[email protected]>
x86: Add check for APIC access address for vmentry of L2 guests
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: atom: fix ACPI/PCI Kconfig
hu huajun <[email protected]>
KVM: X86: fix incorrect reference of trace_kvm_pi_irte_update
Christophe JAILLET <[email protected]>
Input: synaptics-rmi4 - fix an unchecked out of memory error path
Anson Huang <[email protected]>
clocksource/drivers/imx-tpm: Correct some registers operation flow
-------------
Diffstat:
.../bindings/display/panel/panel-common.txt | 2 +- .../devicetree/bindings/dma/renesas,rcar-dmac.txt | 1 + .../devicetree/bindings/net/renesas,ravb.txt | 1 + .../bindings/pinctrl/allwinner,sunxi-pinctrl.txt | 6 +- .../bindings/serial/amlogic,meson-uart.txt | 2 +- .../devicetree/bindings/serial/mvebu-uart.txt | 2 +- .../bindings/serial/renesas,sci-serial.txt | 2 + .../devicetree/bindings/vendor-prefixes.txt | 1 + Documentation/livepatch/shadow-vars.txt | 41 ++- Makefile | 4 +- arch/arm/boot/compressed/Makefile | 8 +- arch/arm/boot/compressed/head.S | 20 +- arch/arm/boot/dts/bcm-cygnus.dtsi | 2 +- arch/arm/boot/dts/da850.dtsi | 2 - arch/arm/boot/dts/dm8148-evm.dts | 2 +- arch/arm/boot/dts/dm8148-t410.dts | 2 +- arch/arm/boot/dts/dm8168-evm.dts | 2 +- arch/arm/boot/dts/dra62x-j5eco-evm.dts | 2 +- arch/arm/boot/dts/imx51-zii-rdu1.dts | 6 +- arch/arm/boot/dts/logicpd-som-lv.dtsi | 11 +- arch/arm/boot/dts/omap4.dtsi | 8 +- arch/arm/include/uapi/asm/siginfo.h | 13 - arch/arm/kernel/machine_kexec.c | 34 ++- arch/arm/mach-davinci/board-da830-evm.c | 9 +- arch/arm/mach-davinci/board-da850-evm.c | 9 +- arch/arm/mach-davinci/board-dm355-evm.c | 15 +- arch/arm/mach-davinci/board-dm644x-evm.c | 10 +- arch/arm/mach-davinci/board-dm646x-evm.c | 5 +- arch/arm/mach-davinci/board-omapl138-hawk.c | 10 +- arch/arm/mach-davinci/dm646x.c | 3 +- arch/arm/mach-keystone/pm_domain.c | 1 + arch/arm/mach-omap1/ams-delta-fiq.c | 28 +- arch/arm/mach-omap2/powerdomain.c | 4 +- arch/arm/vfp/vfpmodule.c | 2 +- .../arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi | 4 + .../dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 12 + .../dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts | 4 + .../boot/dts/amlogic/meson-gxl-s905x-p212.dtsi | 4 + arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 61 ++++ .../boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 4 + arch/arm64/boot/dts/amlogic/meson-gxm.dtsi | 17 ++ .../boot/dts/broadcom/stingray/stingray-sata.dtsi | 80 ++--- arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi | 2 +- arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi | 2 +- arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi | 2 +- arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi | 2 +- arch/arm64/include/asm/cputype.h | 6 + arch/arm64/kernel/ptrace.c | 20 +- arch/arm64/kernel/traps.c | 3 +- arch/arm64/mm/kasan_init.c | 4 +- arch/hexagon/include/asm/io.h | 6 + arch/hexagon/lib/checksum.c | 1 + arch/mips/boot/dts/img/boston.dts | 6 + arch/mips/include/asm/io.h | 4 +- arch/parisc/kernel/drivers.c | 7 +- arch/parisc/kernel/smp.c | 3 +- arch/parisc/kernel/time.c | 2 +- arch/powerpc/include/asm/ftrace.h | 29 +- arch/powerpc/include/asm/topology.h | 13 +- arch/powerpc/kernel/setup_64.c | 11 + arch/powerpc/kvm/booke.c | 7 + arch/powerpc/platforms/cell/spufs/sched.c | 2 +- arch/powerpc/platforms/powernv/memtrace.c | 17 -- arch/riscv/Kconfig | 4 +- arch/riscv/kernel/vdso/Makefile | 2 +- arch/sh/Kconfig | 1 + arch/sh/kernel/cpu/sh2/probe.c | 4 + arch/sh/kernel/setup.c | 1 - arch/sh/mm/init.c | 68 +---- arch/sh/mm/numa.c | 19 -- arch/x86/events/intel/core.c | 9 +- arch/x86/include/asm/insn.h | 18 ++ arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kernel/cpu/intel.c | 3 + arch/x86/kernel/kexec-bzimage64.c | 5 +- arch/x86/kernel/kprobes/core.c | 4 + arch/x86/kernel/uprobes.c | 4 + arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/svm.c | 31 +- arch/x86/kvm/vmx.c | 95 +++--- arch/x86/kvm/x86.c | 33 ++- arch/x86/net/bpf_jit_comp.c | 18 +- arch/x86/xen/enlighten_hvm.c | 13 + block/blk-cgroup.c | 22 +- block/blk-mq.c | 19 ++ block/blk-mq.h | 4 +- block/genhd.c | 12 + block/partition-generic.c | 10 +- drivers/acpi/acpi_watchdog.c | 59 +++- drivers/acpi/scan.c | 2 +- drivers/acpi/sleep.c | 13 + drivers/ata/ahci.c | 6 +- drivers/ata/ahci.h | 7 + drivers/ata/ahci_mvebu.c | 56 ++++ drivers/ata/ahci_qoriq.c | 2 +- drivers/ata/ahci_xgene.c | 4 +- drivers/ata/libahci.c | 20 +- drivers/ata/libata-eh.c | 4 +- drivers/ata/sata_highbank.c | 2 +- drivers/char/agp/uninorth-agp.c | 4 +- drivers/clk/clk-mux.c | 10 +- drivers/clk/clk.c | 7 +- drivers/clk/imx/clk-imx6ul.c | 2 +- drivers/clocksource/timer-imx-tpm.c | 8 +- drivers/cpufreq/Kconfig.arm | 10 - drivers/cpufreq/brcmstb-avs-cpufreq.c | 323 +-------------------- drivers/firmware/efi/libstub/arm64-stub.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 13 +- drivers/gpu/drm/drm_dumb_buffers.c | 7 +- drivers/gpu/drm/exynos/exynos_mixer.c | 22 +- drivers/gpu/drm/exynos/regs-mixer.h | 1 + drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +- drivers/gpu/drm/msm/msm_fbdev.c | 11 +- drivers/gpu/drm/msm/msm_gem.c | 20 +- drivers/gpu/drm/omapdrm/dss/hdmi4.c | 2 +- drivers/gpu/drm/omapdrm/dss/hdmi4_core.c | 7 +- drivers/gpu/drm/omapdrm/dss/hdmi5.c | 2 +- drivers/gpu/drm/omapdrm/omap_connector.c | 10 + drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 6 +- drivers/gpu/drm/omapdrm/tcm-sita.c | 2 +- drivers/gpu/drm/vc4/vc4_dpi.c | 25 +- drivers/hid/Kconfig | 7 +- drivers/hid/hid-ids.h | 9 + drivers/hid/hid-lenovo.c | 36 +++ drivers/hid/i2c-hid/i2c-hid.c | 2 + drivers/hid/intel-ish-hid/ishtp/bus.c | 2 +- drivers/hid/wacom_sys.c | 4 +- drivers/i2c/busses/i2c-pmcmsp.c | 4 +- drivers/i2c/busses/i2c-sprd.c | 22 +- drivers/i2c/busses/i2c-viperboard.c | 2 +- drivers/infiniband/Kconfig | 5 +- drivers/infiniband/core/cma.c | 60 ++-- drivers/infiniband/core/iwpm_util.c | 5 +- drivers/infiniband/core/mad.c | 4 +- drivers/infiniband/core/uverbs_ioctl.c | 9 + drivers/infiniband/hw/hfi1/affinity.c | 11 +- drivers/infiniband/hw/hfi1/init.c | 41 ++- drivers/infiniband/hw/hfi1/platform.c | 1 + drivers/infiniband/hw/hfi1/qsfp.c | 2 + drivers/infiniband/hw/hns/hns_roce_hem.c | 8 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 11 +- drivers/infiniband/hw/mlx4/mr.c | 2 +- drivers/infiniband/hw/mlx5/main.c | 4 +- drivers/infiniband/sw/rxe/rxe_opcode.c | 2 +- drivers/infiniband/sw/rxe/rxe_req.c | 1 - drivers/infiniband/sw/rxe/rxe_resp.c | 6 +- drivers/infiniband/ulp/srp/Kconfig | 2 +- drivers/infiniband/ulp/srpt/Kconfig | 2 +- drivers/input/rmi4/rmi_spi.c | 7 +- drivers/input/touchscreen/atmel_mxt_ts.c | 186 +++++++----- drivers/iommu/dmar.c | 2 +- drivers/iommu/intel_irq_remapping.c | 2 +- drivers/mtd/onenand/omap2.c | 105 +++---- drivers/net/can/dev.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 3 + drivers/net/ethernet/aquantia/atlantic/aq_nic.h | 1 + .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 20 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 3 +- drivers/net/ethernet/hisilicon/hns/hnae.h | 2 +- drivers/net/ethernet/ibm/ibmvnic.c | 3 +- drivers/net/ethernet/intel/igb/igb_main.c | 17 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 3 + drivers/net/ethernet/marvell/mvpp2.c | 15 +- drivers/net/ethernet/netronome/nfp/flower/cmsg.c | 38 ++- drivers/net/ethernet/netronome/nfp/flower/cmsg.h | 2 + drivers/net/ethernet/netronome/nfp/flower/main.c | 8 +- drivers/net/ethernet/netronome/nfp/flower/main.h | 8 +- drivers/net/ethernet/netronome/nfp/nfp_app_nic.c | 2 +- drivers/net/ethernet/netronome/nfp/nfp_main.h | 4 +- drivers/net/ethernet/netronome/nfp/nfp_net_main.c | 31 +- .../net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c | 3 +- drivers/net/ethernet/qlogic/qed/qed_l2.c | 6 +- drivers/net/ethernet/qlogic/qede/qede_rdma.c | 2 +- drivers/net/phy/broadcom.c | 10 + drivers/net/phy/marvell.c | 9 + drivers/net/phy/microchip.c | 178 +++++++++++- drivers/nvme/host/Kconfig | 2 +- drivers/nvme/host/core.c | 32 +- drivers/nvme/host/fabrics.c | 6 + drivers/nvme/host/multipath.c | 24 +- drivers/nvme/host/nvme.h | 12 + drivers/nvme/target/Kconfig | 2 +- drivers/pci/dwc/pcie-kirin.c | 2 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 16 +- drivers/pinctrl/meson/pinctrl-meson-axg.c | 2 +- drivers/platform/x86/Kconfig | 2 +- drivers/remoteproc/qcom_q6v5_pil.c | 2 + drivers/reset/reset-uniphier.c | 6 +- drivers/rpmsg/rpmsg_char.c | 2 + drivers/s390/net/qeth_core_main.c | 53 ++-- drivers/s390/net/qeth_core_mpc.h | 12 + drivers/s390/net/qeth_l2_main.c | 59 ++-- drivers/s390/net/smsgiucv.c | 2 +- drivers/scsi/isci/port_config.c | 3 +- drivers/scsi/megaraid/megaraid_sas_fusion.c | 6 +- drivers/scsi/scsi_transport_iscsi.c | 29 +- drivers/scsi/storvsc_drv.c | 7 +- drivers/scsi/vmw_pvscsi.c | 2 +- drivers/soc/bcm/raspberrypi-power.c | 2 +- drivers/spi/spi-bcm2835aux.c | 5 + drivers/spi/spi-cadence.c | 8 + drivers/spi/spi-sh-msiof.c | 1 + drivers/target/target_core_pscsi.c | 2 + drivers/tee/tee_core.c | 11 + drivers/thermal/int340x_thermal/int3403_thermal.c | 3 +- drivers/usb/musb/musb_host.c | 5 +- drivers/usb/musb/musb_host.h | 7 +- drivers/usb/musb/musb_virthub.c | 25 +- drivers/usb/typec/tps6598x.c | 47 ++- drivers/usb/typec/ucsi/Makefile | 2 +- drivers/xen/xenbus/xenbus_dev_frontend.c | 3 +- fs/afs/addr_list.c | 25 +- fs/afs/callback.c | 56 +++- fs/afs/cmservice.c | 6 +- fs/afs/internal.h | 7 +- fs/afs/rotate.c | 20 +- fs/afs/rxrpc.c | 7 + fs/afs/server.c | 22 +- fs/afs/server_list.c | 7 +- fs/cifs/Kconfig | 2 +- fs/cifs/smb2ops.c | 6 + fs/cifs/smb2pdu.c | 68 +++-- fs/cifs/transport.c | 5 +- fs/ecryptfs/crypto.c | 41 ++- fs/ecryptfs/file.c | 21 +- fs/isofs/inode.c | 3 + fs/namespace.c | 2 +- fs/notify/fsnotify.c | 25 +- fs/ocfs2/refcounttree.c | 14 +- fs/proc/base.c | 6 + fs/proc/kcore.c | 23 +- fs/proc/loadavg.c | 2 +- fs/proc/task_mmu.c | 6 +- include/linux/brcmphy.h | 1 + include/linux/clk-provider.h | 3 + include/linux/ethtool.h | 2 + include/linux/genhd.h | 4 +- include/linux/kthread.h | 1 + include/linux/kvm_host.h | 8 +- include/linux/livepatch.h | 19 +- include/linux/microchipphy.h | 8 + include/linux/mtd/map.h | 2 +- include/linux/mtd/rawnand.h | 16 +- include/linux/percpu-rwsem.h | 6 +- include/linux/rwsem.h | 6 + include/linux/sched.h | 50 +++- include/linux/sched/signal.h | 2 +- include/linux/stringhash.h | 4 +- include/soc/bcm2835/raspberrypi-firmware.h | 4 +- init/main.c | 7 + kernel/bpf/syscall.c | 19 +- kernel/kthread.c | 50 ++-- kernel/livepatch/shadow.c | 108 ++++--- kernel/locking/rwsem-xadd.c | 19 +- kernel/locking/rwsem.c | 2 - kernel/locking/rwsem.h | 30 +- kernel/module.c | 5 + kernel/sched/core.c | 49 ++-- kernel/sched/deadline.c | 4 +- kernel/sched/rt.c | 2 - kernel/sched/sched.h | 5 +- kernel/signal.c | 17 +- kernel/stop_machine.c | 19 +- lib/find_bit_benchmark.c | 7 +- mm/memcontrol.c | 2 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/netfilter/Kconfig | 55 ++-- net/mac80211/agg-tx.c | 4 + net/mac80211/mlme.c | 25 +- net/mac80211/tx.c | 3 +- net/netfilter/nf_tables_api.c | 2 +- net/rds/ib_cm.c | 3 +- net/rxrpc/af_rxrpc.c | 2 +- net/rxrpc/ar-internal.h | 1 + net/rxrpc/input.c | 2 +- net/rxrpc/local_object.c | 57 +++- net/rxrpc/output.c | 11 + net/rxrpc/sendmsg.c | 10 + net/sched/act_skbedit.c | 3 +- net/smc/af_smc.c | 6 +- net/sunrpc/xprtrdma/fmr_ops.c | 5 +- net/sunrpc/xprtrdma/frwr_ops.c | 9 +- net/sunrpc/xprtrdma/verbs.c | 5 + net/sunrpc/xprtrdma/xprt_rdma.h | 2 +- net/tipc/monitor.c | 2 +- net/tipc/node.c | 28 +- samples/livepatch/livepatch-shadow-fix1.c | 43 ++- samples/livepatch/livepatch-shadow-fix2.c | 33 ++- scripts/Makefile.gcc-plugins | 2 +- sound/soc/codecs/msm8916-wcd-analog.c | 9 +- sound/soc/codecs/rt5514.c | 3 + sound/soc/intel/Kconfig | 22 +- sound/soc/soc-topology.c | 6 +- tools/bpf/bpf_dbg.c | 7 +- tools/objtool/arch/x86/include/asm/insn.h | 18 ++ tools/perf/util/cs-etm.c | 24 +- tools/perf/util/pmu.c | 20 +- tools/perf/util/symbol.c | 8 +- .../inter-event/trigger-multi-actions-accept.tc | 44 +++ tools/testing/selftests/x86/Makefile | 2 +- tools/testing/selftests/x86/mov_ss_trap.c | 285 ++++++++++++++++++ tools/testing/selftests/x86/mpx-mini-test.c | 7 +- tools/testing/selftests/x86/pkey-helpers.h | 20 +- tools/testing/selftests/x86/protection_keys.c | 254 +++++++++++----- virt/kvm/arm/vgic/vgic-mmio-v2.c | 5 + virt/kvm/arm/vgic/vgic.c | 8 + 308 files changed, 3213 insertions(+), 1735 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/279 clocksource/drivers/imx-tpm: Correct some registers operation flow
4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anson Huang <[email protected]>
[ Upstream commit 506a7be93ff773d5d4cf75a59f342865605b4910 ]
According to i.MX7ULP reference manual, TPM_SC_CPWMS can ONLY be written when counter is disabled, TPM_SC_TOF is write-1-clear, TPM_C0SC_CHF is also write-1-clear, correct these registers initialization flow;
--- drivers/clocksource/timer-imx-tpm.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/clocksource/timer-imx-tpm.c +7 -1
@@ -20,6 +20,7 @@#define TPM_SC 0x10#define TPM_SC_CMOD_INC_PER_CNT (0x1 << 3)#define TPM_SC_CMOD_DIV_DEFAULT 0x3 +#define TPM_SC_TOF_MASK (0x1 << 7)#define TPM_CNT 0x14#define TPM_MOD 0x18#define TPM_STATUS 0x1c
@@ -29,6 +30,7 @@#define TPM_C0SC_MODE_SHIFT 2#define TPM_C0SC_MODE_MASK 0x3c#define TPM_C0SC_MODE_SW_COMPARE 0x4 +#define TPM_C0SC_CHF_MASK (0x1 << 7)#define TPM_C0V 0x24static void __iomem *timer_base;
@@ -205,9 +207,13 @@ static int __init tpm_timer_init(struct* 4) Channel0 disabled * 5) DMA transfers disabled */ +/* make sure counter is disabled */ writel (0 , timer_base +TPM_SC ); +/* TOF is W1C */ +writel (TPM_SC_TOF_MASK , timer_base +TPM_SC );writel (0 , timer_base +TPM_CNT ); -writel (0 , timer_base +TPM_C0SC ); +/* CHF is W1C */ +writel (TPM_C0SC_CHF_MASK , timer_base +TPM_C0SC );/* increase per cnt, div 8 by default */ writel(TPM_SC_CMOD_INC_PER_CNT | TPM_SC_CMOD_DIV_DEFAULT,
Greg Kroah-Hartman
maintainerPATCH 2/279 Input: synaptics-rmi4 - fix an unchecked out of memory error path
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 839c42273617787318da7baf6151d553108f5e17 ]
When extending the rmi_spi buffers, we must check that no out of memory error occurs, otherwise we may access data above the currently allocated memory.
Propagate the error code returned by 'rmi_spi_manage_pools()' instead.
--- drivers/input/rmi4/rmi_spi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/input/rmi4/rmi_spi.c +5 -2
@@ -147,8 +147,11 @@ static int rmi_spi_xfer(struct rmi_spi_xif (len >RMI_SPI_XFER_SIZE_LIMIT )return -EINVAL ; -if (rmi_spi->xfer_buf_size < len) -rmi_spi_manage_pools (rmi_spi, len); +if (rmi_spi->xfer_buf_size < len) { + ret =rmi_spi_manage_pools (rmi_spi, len); +if (ret <0 ) +return ret; + }if (addr ==0 )/*
Greg Kroah-Hartman
maintainerPATCH 3/279 KVM: X86: fix incorrect reference of trace_kvm_pi_irte_update
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: hu huajun <[email protected]>
[ Upstream commit 2698d82e519413c6ad287e6f14b29e0373ed37f8 ]
In arch/x86/kvm/trace.h, this function is declared as host_irq the first input, and vcpu_id the second, instead of otherwise.
--- arch/x86/kvm/svm.c | 5 ++--- arch/x86/kvm/vmx.c | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-)
arch/x86/kvm/svm.c +2 -3
@@ -5142,9 +5142,8 @@ static int svm_update_pi_irte(struct kvm }if (!ret && svm) { -trace_kvm_pi_irte_update (svm->vcpu.vcpu_id, - host_irq, e->gsi, - vcpu_info.vector, +trace_kvm_pi_irte_update (host_irq, svm->vcpu.vcpu_id, + e->gsi, vcpu_info.vector, vcpu_info.pi_desc_addr, set); }
arch/x86/kvm/vmx.c +1 -1
@@ -12237,7 +12237,7 @@ static int vmx_update_pi_irte(struct kvm vcpu_info.pi_desc_addr =__pa (vcpu_to_pi_desc (vcpu)); vcpu_info.vector = irq.vector; -trace_kvm_pi_irte_update (vcpu->vcpu_id, host_irq, e->gsi, +trace_kvm_pi_irte_update (host_irq, vcpu->vcpu_id, e->gsi, vcpu_info.vector, vcpu_info.pi_desc_addr, set);if (set)
Greg Kroah-Hartman
maintainerPATCH 4/279 ASoC: Intel: atom: fix ACPI/PCI Kconfig
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 90619eb1dc4f19357fef5e9c13c6c9beead0fd80 ]
The split between ACPI and PCI platforms generated issues with randconfig:
with SND_SST_ATOM_HIFI2_PLATFORM_PCI=y and SND_SST_ATOM_HIFI2_PLATFORM=m, we get this module link failure:
ERROR: "sst_context_init" [sound/soc/intel/atom/sst/snd-intel-sst-acpi.ko] undefined!
ERROR: "sst_context_cleanup" [sound/soc/intel/atom/sst/snd-intel-sst-acpi.ko] undefined!
ERROR: "sst_alloc_drv_context" [sound/soc/intel/atom/sst/snd-intel-sst-acpi.ko] undefined!
ERROR: "intel_sst_pm" [sound/soc/intel/atom/sst/snd-intel-sst-acpi.ko] undefined!
ERROR: "sst_configure_runtime_pm" [sound/soc/intel/atom/sst/snd-intel-sst-acpi.ko] undefined!
To keep things simple, let's expose two configs for SND_SST_ATOM_HIFI2_PLATFORM_PCI and SND_SST_ATOM_HIFI2_PLATFORM_ACPI, which select a common SND_SST_ATOM_HIFI2_PLATFORM option. To avoid breaking existing solutions with the semantics change, SND_SST_ATOM_HIFI2_PLATFORM_ACPI uses "default ACPI" so that "make oldnoconfig" and "make olddefconfig" still work as expected.
Also remove mentions of Medfield while we are at it since it was removed recently.
dependencies")
--- sound/soc/intel/Kconfig | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
sound/soc/intel/Kconfig +13 -9
@@ -72,24 +72,28 @@ config SND_SOC_INTEL_BAYTRAIL for Baytrail Chromebooks but this option is now deprecated and is not recommended, use SND_SST_ATOM_HIFI2_PLATFORM instead. +config SND_SST_ATOM_HIFI2_PLATFORM + tristate + select SND_SOC_COMPRESS + config SND_SST_ATOM_HIFI2_PLATFORM_PCI - tristate "PCI HiFi2 (Medfield, Merrifield) Platforms" + tristate "PCI HiFi2 (Merrifield) Platforms" depends on X86 && PCI select SND_SST_IPC_PCI - select SND_SOC_COMPRESS + select SND_SST_ATOM_HIFI2_PLATFORM help - If you have a Intel Medfield or Merrifield/Edison platform, then + If you have a Intel Merrifield/Edison platform, then enable this option by saying Y or m. Distros will typically not - enable this option: Medfield devices are not available to - developers and while Merrifield/Edison can run a mainline kernel with - limited functionality it will require a firmware file which - is not in the standard firmware tree + enable this option: while Merrifield/Edison can run a mainline + kernel with limited functionality it will require a firmware file + which is not in the standard firmware tree -config SND_SST_ATOM_HIFI2_PLATFORM +config SND_SST_ATOM_HIFI2_PLATFORM_ACPI tristate "ACPI HiFi2 (Baytrail, Cherrytrail) Platforms" + default ACPI depends on X86 && ACPI select SND_SST_IPC_ACPI - select SND_SOC_COMPRESS + select SND_SST_ATOM_HIFI2_PLATFORM select SND_SOC_ACPI_INTEL_MATCH select IOSF_MBI help
Greg Kroah-Hartman
maintainerPATCH 5/279 x86: Add check for APIC access address for vmentry of L2 guests
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krish Sadhukhan <[email protected]>
[ Upstream commit f0f4cf5b306620282db0c59ff963012e1973e025 ]
According to the sub-section titled 'VM-Execution Control Fields' in the section titled 'Basic VM-Entry Checks' in Intel SDM vol. 3C, the following vmentry check must be enforced:
If the 'virtualize APIC-accesses' VM-execution control is 1, the APIC-access address must satisfy the following checks:
- Bits 11:0 of the address must be 0.
- The address should not set any bits beyond the processor's physical-address width.
This patch adds the necessary check to conform to this rule. If the check fails, we cause the L2 VMENTRY to fail which is what the associated unit test (following patch) expects.
--- arch/x86/kvm/vmx.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/x86/kvm/vmx.c +13 -0
@@ -10338,6 +10338,16 @@ static inline bool nested_vmx_prepare_msreturn true; } +static int nested_vmx_check_apic_access_controls (struct kvm_vcpu *vcpu, +struct vmcs12 *vmcs12) +{ +if (nested_cpu_has2 (vmcs12,SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES ) && + !page_address_valid (vcpu, vmcs12->apic_access_addr)) +return -EINVAL ; +else +return 0 ; +} +static int nested_vmx_check_apicv_controls (struct kvm_vcpu *vcpu,struct vmcs12 *vmcs12) {
@@ -11006,6 +11016,9 @@ static int check_vmentry_prereqs(structif (nested_vmx_check_msr_bitmap_controls (vcpu, vmcs12))return VMXERR_ENTRY_INVALID_CONTROL_FIELD ; +if (nested_vmx_check_apic_access_controls (vcpu, vmcs12)) +return VMXERR_ENTRY_INVALID_CONTROL_FIELD ; +if (nested_vmx_check_tpr_shadow_controls (vcpu, vmcs12))return VMXERR_ENTRY_INVALID_CONTROL_FIELD ;
Greg Kroah-Hartman
maintainerPATCH 6/279 MIPS: io: Prevent compiler reordering writeX()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinan Kaya <[email protected]>
[ Upstream commit f6b7aeee8f167409195fbf1364d02988fecad1d0 ]
writeX() has strong ordering semantics with respect to memory updates. In the absence of a write barrier or a compiler barrier, the compiler can reorder register and memory update instructions. This breaks the writeX() API.
Patchwork: https://patchwork.linux-mips.org/patch/18997/
--- arch/mips/include/asm/io.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/io.h +1 -1
@@ -307,7 +307,7 @@ static inline void iounmap(const volatil#if defined(CONFIG_CPU_CAVIUM_OCTEON ) || defined(CONFIG_LOONGSON3_ENHANCEMENT )#define war_io_reorder_wmb () wmb()#else -#define war_io_reorder_wmb () do { } while (0) +#define war_io_reorder_wmb () barrier()#endif #define __BUILD_MEMORY_SINGLE (pfx, bwlq, type, irq) \
Greg Kroah-Hartman
maintainerPATCH 7/279 lan78xx: PHY DSP registers initialization to address EEE link drop issues with long cables
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghuram Chary J <[email protected]>
[ Upstream commit 1c2734b31d72316e3faaad88c0c9c46fa92a4b20 ]
The patch is to configure DSP registers of PHY device to handle Gbe-EEE failures with >40m cable length.
--- drivers/net/phy/microchip.c | 178 ++++++++++++++++++++++++++++++++++++++++++- include/linux/microchipphy.h | 8 + 2 files changed, 185 insertions(+), 1 deletion(-)
drivers/net/phy/microchip.c +177 -1
@@ -20,6 +20,7 @@#include <linux/ethtool.h> #include <linux/phy.h> #include <linux/microchipphy.h> +#include <linux/delay.h> #define DRIVER_AUTHOR "WOOJUNG HUH <[email protected]>"#define DRIVER_DESC "Microchip LAN88XX PHY driver"
@@ -30,6 +31,16 @@ struct lan88xx_priv {__u32 wolopts; }; +static int lan88xx_read_page (struct phy_device *phydev) +{ +return __phy_read (phydev,LAN88XX_EXT_PAGE_ACCESS ); +} + +static int lan88xx_write_page (struct phy_device *phydev,int page) +{ +return __phy_write (phydev,LAN88XX_EXT_PAGE_ACCESS , page); +} +static int lan88xx_phy_config_intr (struct phy_device *phydev) {int rc;
@@ -66,6 +77,150 @@ static int lan88xx_suspend(struct phy_dereturn 0 ; } +static int lan88xx_TR_reg_set (struct phy_device *phydev,u16 regaddr, +u32 data) +{ +int val, save_page, ret =0 ; +u16 buf; + +/* Save current page */ + save_page =phy_save_page (phydev); +if (save_page <0 ) { +pr_warn ("Failed to get current page\n" ); + goto err; + } + +/* Switch to TR page */ +lan88xx_write_page (phydev,LAN88XX_EXT_PAGE_ACCESS_TR ); + + ret =__phy_write (phydev,LAN88XX_EXT_PAGE_TR_LOW_DATA , + (data &0xFFFF )); +if (ret <0 ) { +pr_warn ("Failed to write TR low data\n" ); + goto err; + } + + ret =__phy_write (phydev,LAN88XX_EXT_PAGE_TR_HIGH_DATA , + (data &0x00FF0000 ) >>16 ); +if (ret <0 ) { +pr_warn ("Failed to write TR high data\n" ); + goto err; + } + +/* Config control bits [15:13] of register */ + buf = (regaddr & ~(0x3 <<13 ));/* Clr [14:13] to write data in reg */ + buf |=0x8000 ;/* Set [15] to Packet transmit */ + + ret =__phy_write (phydev,LAN88XX_EXT_PAGE_TR_CR , buf); +if (ret <0 ) { +pr_warn ("Failed to write data in reg\n" ); + goto err; + } + +usleep_range (1000 ,2000 );/* Wait for Data to be written */ + val =__phy_read (phydev,LAN88XX_EXT_PAGE_TR_CR ); +if (!(val &0x8000 )) +pr_warn ("TR Register[0x%X] configuration failed\n" , regaddr); +err: +return phy_restore_page (phydev, save_page, ret); +} + +static void lan88xx_config_TR_regs (struct phy_device *phydev) +{ +int err; + +/* Get access to Channel 0x1, Node 0xF , Register 0x01. +* Write 24-bit value 0x12B00A to register. Setting MrvlTrFix1000Kf, +* MrvlTrFix1000Kp, MasterEnableTR bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x0F82 ,0x12B00A ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x0F82]\n" ); + +/* Get access to Channel b'10, Node b'1101, Register 0x06. +* Write 24-bit value 0xD2C46F to register. Setting SSTrKf1000Slv, +* SSTrKp1000Mas bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x168C ,0xD2C46F ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x168C]\n" ); + +/* Get access to Channel b'10, Node b'1111, Register 0x11. +* Write 24-bit value 0x620 to register. Setting rem_upd_done_thresh +* bits +*/ + err =lan88xx_TR_reg_set (phydev,0x17A2 ,0x620 ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x17A2]\n" ); + +/* Get access to Channel b'10, Node b'1101, Register 0x10. +* Write 24-bit value 0xEEFFDD to register. Setting +* eee_TrKp1Long_1000, eee_TrKp2Long_1000, eee_TrKp3Long_1000, +* eee_TrKp1Short_1000,eee_TrKp2Short_1000, eee_TrKp3Short_1000 bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x16A0 ,0xEEFFDD ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x16A0]\n" ); + +/* Get access to Channel b'10, Node b'1101, Register 0x13. +* Write 24-bit value 0x071448 to register. Setting +* slv_lpi_tr_tmr_val1, slv_lpi_tr_tmr_val2 bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x16A6 ,0x071448 ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x16A6]\n" ); + +/* Get access to Channel b'10, Node b'1101, Register 0x12. +* Write 24-bit value 0x13132F to register. Setting +* slv_sigdet_timer_val1, slv_sigdet_timer_val2 bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x16A4 ,0x13132F ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x16A4]\n" ); + +/* Get access to Channel b'10, Node b'1101, Register 0x14. +* Write 24-bit value 0x0 to register. Setting eee_3level_delay, +* eee_TrKf_freeze_delay bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x16A8 ,0x0 ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x16A8]\n" ); + +/* Get access to Channel b'01, Node b'1111, Register 0x34. +* Write 24-bit value 0x91B06C to register. Setting +* FastMseSearchThreshLong1000, FastMseSearchThreshShort1000, +* FastMseSearchUpdGain1000 bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x0FE8 ,0x91B06C ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x0FE8]\n" ); + +/* Get access to Channel b'01, Node b'1111, Register 0x3E. +* Write 24-bit value 0xC0A028 to register. Setting +* FastMseKp2ThreshLong1000, FastMseKp2ThreshShort1000, +* FastMseKp2UpdGain1000, FastMseKp2ExitEn1000 bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x0FFC ,0xC0A028 ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x0FFC]\n" ); + +/* Get access to Channel b'01, Node b'1111, Register 0x35. +* Write 24-bit value 0x041600 to register. Setting +* FastMseSearchPhShNum1000, FastMseSearchClksPerPh1000, +* FastMsePhChangeDelay1000 bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x0FEA ,0x041600 ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x0FEA]\n" ); + +/* Get access to Channel b'10, Node b'1101, Register 0x03. +* Write 24-bit value 0x000004 to register. Setting TrFreeze bits. +*/ + err =lan88xx_TR_reg_set (phydev,0x1686 ,0x000004 ); +if (err <0 ) +pr_warn ("Failed to Set Register[0x1686]\n" ); +} +static int lan88xx_probe (struct phy_device *phydev) {struct device *dev = &phydev->mdio.dev;
@@ -132,6 +287,25 @@ static void lan88xx_set_mdix(struct phy_phy_write (phydev,LAN88XX_EXT_PAGE_ACCESS ,LAN88XX_EXT_PAGE_SPACE_0 ); } +static int lan88xx_config_init (struct phy_device *phydev) +{ +int val; + +genphy_config_init (phydev); +/*Zerodetect delay enable */ + val =phy_read_mmd (phydev,MDIO_MMD_PCS , +PHY_ARDENNES_MMD_DEV_3_PHY_CFG ); + val |=PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_ ; + +phy_write_mmd (phydev,MDIO_MMD_PCS ,PHY_ARDENNES_MMD_DEV_3_PHY_CFG , + val); + +/* Config DSP registers */ +lan88xx_config_TR_regs (phydev); + +return 0 ; +} +static int lan88xx_config_aneg (struct phy_device *phydev) {lan88xx_set_mdix (phydev);
@@ -151,7 +325,7 @@ static struct phy_driver microchip_phy_d .probe = lan88xx_probe, .remove = lan88xx_remove, - .config_init = genphy_config_init, + .config_init = lan88xx_config_init, .config_aneg = lan88xx_config_aneg, .ack_interrupt = lan88xx_phy_ack_interrupt,
@@ -160,6 +334,8 @@ static struct phy_driver microchip_phy_d .suspend = lan88xx_suspend, .resume = genphy_resume, .set_wol = lan88xx_set_wol, + .read_page = lan88xx_read_page, + .write_page = lan88xx_write_page, } };module_phy_driver (microchip_phy_driver);
include/linux/microchipphy.h +8 -0
@@ -70,4 +70,12 @@#define LAN88XX_MMD3_CHIP_ID (32877)#define LAN88XX_MMD3_CHIP_REV (32878) +/* DSP registers */ +#define PHY_ARDENNES_MMD_DEV_3_PHY_CFG (0x806A) +#define PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_ (0x2000) +#define LAN88XX_EXT_PAGE_ACCESS_TR (0x52B5) +#define LAN88XX_EXT_PAGE_TR_CR 16 +#define LAN88XX_EXT_PAGE_TR_LOW_DATA 17 +#define LAN88XX_EXT_PAGE_TR_HIGH_DATA 18 +#endif /* _MICROCHIPPHY_H */
Greg Kroah-Hartman
maintainerPATCH 8/279 ibmvnic: Do not notify peers on parameter change resets
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Fontenot <[email protected]>
[ Upstream commit ebc701b796a67a5785399dcbc83d90e3b5f1e02f ]
When attempting to change the driver parameters, such as the MTU value or number of queues, do not call netdev_notify_peers(). Doing so will deadlock on the rtnl_lock.
--- drivers/net/ethernet/ibm/ibmvnic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/ibm/ibmvnic.c +2 -1
@@ -1711,7 +1711,8 @@ static int do_reset(struct ibmvnic_adaptfor (i =0 ; i < adapter->req_rx_queues; i++)napi_schedule (&adapter->napi[i]); -if (adapter->reset_reason !=VNIC_RESET_FAILOVER ) +if (adapter->reset_reason !=VNIC_RESET_FAILOVER && + adapter->reset_reason !=VNIC_RESET_CHANGE_PARAM )netdev_notify_peers (netdev);netif_carrier_on (netdev);
Greg Kroah-Hartman
maintainerPATCH 9/279 nfp: ignore signals when communicating with management FW
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 5496295aefe86995e41398b0f76de601308fc3f5 ]
We currently allow signals to interrupt the wait for management FW commands. Exiting the wait should not cause trouble, the FW will just finish executing the command in the background and new commands will wait for the old one to finish.
However, this may not be what users expect (Ctrl-C not actually stopping the command). Moreover some systems routinely request link information with signals pending (Ubuntu 14.04 runs a landscape-sysinfo python tool from MOTD) worrying users with errors like these:
nfp 0000:04:00.0: nfp_nsp: Error -512 waiting for code 0x0007 to start nfp 0000:04:00.0: nfp: reading port table failed -512
Make the wait for management FW responses non-interruptible.
--- drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +1 -2
@@ -281,8 +281,7 @@ nfp_nsp_wait_reg(struct nfp_cpp *cpp, u6if ((*reg & mask) == val)return 0 ; -if (msleep_interruptible (25 )) -return -ERESTARTSYS ; +msleep (25 );if (time_after (start_time, wait_until))return -ETIMEDOUT ;
Greg Kroah-Hartman
maintainerPATCH 10/279 nfp: flower: split and limit cmsg skb lists
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pieter Jansen van Vuuren <[email protected]>
[ Upstream commit cf2cbadc20f5651c3dde9f5ac2ee52fb43aa4ddd ]
Introduce a second skb list for handling control messages and limit the number of allowed messages. Some control messages are considered more crucial than others, resulting in the need for a second skb list. By splitting the list into a separate high and low priority list we can ensure that messages on the high list get added to the head of the list that gets processed, this however has no functional impact. Previously there was no limit on the number of messages allowed on the queue, this could result in the queue growing boundlessly and eventually the host running out of memory.
--- drivers/net/ethernet/netronome/nfp/flower/cmsg.c | 38 ++++++++++++++++++++--- drivers/net/ethernet/netronome/nfp/flower/cmsg.h | 2 + drivers/net/ethernet/netronome/nfp/flower/main.c | 6 ++- drivers/net/ethernet/netronome/nfp/flower/main.h | 8 +++- 4 files changed, 46 insertions(+), 8 deletions(-)
drivers/net/ethernet/netronome/nfp/flower/cmsg.c +34 -4
@@ -242,18 +242,49 @@ out:void nfp_flower_cmsg_process_rx (struct work_struct *work) { +struct sk_buff_head cmsg_joined;struct nfp_flower_priv *priv;struct sk_buff *skb; priv = container_of(work, struct nfp_flower_priv, cmsg_work); +skb_queue_head_init (&cmsg_joined); -while ((skb =skb_dequeue (&priv->cmsg_skbs))) +spin_lock_bh (&priv->cmsg_skbs_high.lock); +skb_queue_splice_tail_init (&priv->cmsg_skbs_high, &cmsg_joined); +spin_unlock_bh (&priv->cmsg_skbs_high.lock); + +spin_lock_bh (&priv->cmsg_skbs_low.lock); +skb_queue_splice_tail_init (&priv->cmsg_skbs_low, &cmsg_joined); +spin_unlock_bh (&priv->cmsg_skbs_low.lock); + +while ((skb =__skb_dequeue (&cmsg_joined)))nfp_flower_cmsg_process_one_rx (priv->app, skb); } -void nfp_flower_cmsg_rx (struct nfp_app *app,struct sk_buff *skb) +static void +nfp_flower_queue_ctl_msg (struct nfp_app *app,struct sk_buff *skb,int type) {struct nfp_flower_priv *priv = app->priv; +struct sk_buff_head *skb_head; + +if (type ==NFP_FLOWER_CMSG_TYPE_PORT_REIFY || + type ==NFP_FLOWER_CMSG_TYPE_PORT_MOD ) + skb_head = &priv->cmsg_skbs_high; +else + skb_head = &priv->cmsg_skbs_low; + +if (skb_queue_len (skb_head) >=NFP_FLOWER_WORKQ_MAX_SKBS ) { +nfp_flower_cmsg_warn (app,"Dropping queued control messages\n" ); +dev_kfree_skb_any (skb); +return ; + } + +skb_queue_tail (skb_head, skb); +schedule_work (&priv->cmsg_work); +} + +void nfp_flower_cmsg_rx (struct nfp_app *app,struct sk_buff *skb) +{struct nfp_flower_cmsg_hdr *cmsg_hdr; cmsg_hdr =nfp_flower_cmsg_get_hdr (skb);
@@ -270,7 +301,6 @@ void nfp_flower_cmsg_rx(struct nfp_app *nfp_flower_rx_flow_stats (app, skb);dev_consume_skb_any (skb); }else { -skb_queue_tail (&priv->cmsg_skbs, skb); -schedule_work (&priv->cmsg_work); +nfp_flower_queue_ctl_msg (app, skb, cmsg_hdr->type); } }
drivers/net/ethernet/netronome/nfp/flower/cmsg.h +2 -0
@@ -98,6 +98,8 @@#define NFP_FL_IPV4_TUNNEL_TYPE GENMASK(7, 4)#define NFP_FL_IPV4_PRE_TUN_INDEX GENMASK(2, 0) +#define NFP_FLOWER_WORKQ_MAX_SKBS 30000 + #define nfp_flower_cmsg_warn(app, fmt, args...) \ do { \ if (net_ratelimit()) \
drivers/net/ethernet/netronome/nfp/flower/main.c +4 -2
@@ -517,7 +517,8 @@ static int nfp_flower_init(struct nfp_ap app->priv = app_priv; app_priv->app = app; -skb_queue_head_init (&app_priv->cmsg_skbs); +skb_queue_head_init (&app_priv->cmsg_skbs_high); +skb_queue_head_init (&app_priv->cmsg_skbs_low);INIT_WORK (&app_priv->cmsg_work, nfp_flower_cmsg_process_rx);init_waitqueue_head (&app_priv->reify_wait_queue);
@@ -544,7 +545,8 @@ static void nfp_flower_clean(struct nfp_ {struct nfp_flower_priv *app_priv = app->priv; -skb_queue_purge (&app_priv->cmsg_skbs); +skb_queue_purge (&app_priv->cmsg_skbs_high); +skb_queue_purge (&app_priv->cmsg_skbs_low);flush_work (&app_priv->cmsg_work);nfp_flower_metadata_cleanup (app);
drivers/net/ethernet/netronome/nfp/flower/main.h +6 -2
@@ -89,7 +89,10 @@ struct nfp_fl_stats_id {* @mask_table: Hash table used to store masks * @flow_table: Hash table used to store flower rules * @cmsg_work: Workqueue for control messages processing -* @cmsg_skbs: List of skbs for control message processing +* @cmsg_skbs_high: List of higher priority skbs for control message +* processing +* @cmsg_skbs_low: List of lower priority skbs for control message +* processing * @nfp_mac_off_list: List of MAC addresses to offload * @nfp_mac_index_list: List of unique 8-bit indexes for non NFP netdevs * @nfp_ipv4_off_list: List of IPv4 addresses to offload
@@ -117,7 +120,8 @@ struct nfp_flower_priv {DECLARE_HASHTABLE (mask_table,NFP_FLOWER_MASK_HASH_BITS );DECLARE_HASHTABLE (flow_table,NFP_FLOWER_HASH_BITS );struct work_struct cmsg_work; -struct sk_buff_head cmsg_skbs; +struct sk_buff_head cmsg_skbs_high; +struct sk_buff_head cmsg_skbs_low;struct list_head nfp_mac_off_list;struct list_head nfp_mac_index_list;struct list_head nfp_ipv4_off_list;
Greg Kroah-Hartman
maintainerPATCH 12/279 fsnotify: fix ignore mask logic in send_to_group()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit 92183a42898dc400b89da35685d1814ac6acd3d8 ]
The ignore mask logic in send_to_group() does not match the logic in fanotify_should_send_event(). In the latter, a vfsmount mark ignore mask precedes an inode mark mask and in the former, it does not.
That difference may cause events to be sent to fanotify backend for no reason. Fix the logic in send_to_group() to match that of fanotify_should_send_event().
--- fs/notify/fsnotify.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-)
fs/notify/fsnotify.c +11 -14
@@ -192,8 +192,9 @@ static int send_to_group(struct inode *t struct fsnotify_iter_info *iter_info) {struct fsnotify_group *group =NULL ; -__u32 inode_test_mask =0 ; -__u32 vfsmount_test_mask =0 ; +__u32 test_mask = (mask & ~FS_EVENT_ON_CHILD ); +__u32 marks_mask =0 ; +__u32 marks_ignored_mask =0 ;if (unlikely (!inode_mark && !vfsmount_mark)) {BUG ();
@@ -213,29 +214,25 @@ static int send_to_group(struct inode *t/* does the inode mark tell us to do something? */ if (inode_mark) { group = inode_mark->group; - inode_test_mask = (mask & ~FS_EVENT_ON_CHILD ); - inode_test_mask &= inode_mark->mask; - inode_test_mask &= ~inode_mark->ignored_mask; + marks_mask |= inode_mark->mask; + marks_ignored_mask |= inode_mark->ignored_mask; }/* does the vfsmount_mark tell us to do something? */ if (vfsmount_mark) { - vfsmount_test_mask = (mask & ~FS_EVENT_ON_CHILD ); group = vfsmount_mark->group; - vfsmount_test_mask &= vfsmount_mark->mask; - vfsmount_test_mask &= ~vfsmount_mark->ignored_mask; -if (inode_mark) - vfsmount_test_mask &= ~inode_mark->ignored_mask; + marks_mask |= vfsmount_mark->mask; + marks_ignored_mask |= vfsmount_mark->ignored_mask; }pr_debug ("%s: group=%p to_tell=%p mask=%x inode_mark=%p" -" inode_test_mask=%x vfsmount_mark=%p vfsmount_test_mask=%x" +" vfsmount_mark=%p marks_mask=%x marks_ignored_mask=%x" " data=%p data_is=%d cookie=%d\n" , - __func__, group, to_tell, mask, inode_mark, - inode_test_mask, vfsmount_mark, vfsmount_test_mask, data, + __func__, group, to_tell, mask, inode_mark, vfsmount_mark, + marks_mask, marks_ignored_mask, data, data_is, cookie); -if (!inode_test_mask && !vfsmount_test_mask) +if (!(test_mask & marks_mask & ~marks_ignored_mask))return 0 ; return group->ops->handle_event(group, to_tell, inode_mark,
Greg Kroah-Hartman
maintainerPATCH 13/279 MIPS: io: Add barrier after register read in readX()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinan Kaya <[email protected]>
[ Upstream commit a1cc7034e33d12dc17d13fbcd7d597d552889097 ]
While a barrier is present in the writeX() functions before the register write, a similar barrier is missing in the readX() functions after the register read. This could allow memory accesses following readX() to observe stale data.
Patchwork: https://patchwork.linux-mips.org/patch/19069/
--- arch/mips/include/asm/io.h | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/include/asm/io.h +2 -0
@@ -377,6 +377,8 @@ static inline type pfx##read##bwlq(constBUG (); \ } \ \ +/* prevent prefetching of coherent DMA data prematurely */ \ +rmb (); \ return pfx##ioswab##bwlq(__mem, __val); \ }
Greg Kroah-Hartman
maintainerPATCH 14/279 s390/smsgiucv: disable SMSG on module unload
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <[email protected]>
[ Upstream commit 760dd0eeaec1689430243ead14e5a429613d8c52 ]
The module exit function of the smsgiucv module uses the incorrect CP command to disable SMSG messages. The correct command is "SET SMSG OFF". Use it.
--- drivers/s390/net/smsgiucv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/net/smsgiucv.c +1 -1
@@ -176,7 +176,7 @@ static struct device_driver smsg_driver static void __exit smsg_exit(void) { -cpcmd ("SET SMSG IUCV" ,NULL ,0 ,NULL ); +cpcmd ("SET SMSG OFF" ,NULL ,0 ,NULL );device_unregister (smsg_dev);iucv_unregister (&smsg_handler,1 );driver_unregister (&smsg_driver);
Greg Kroah-Hartman
maintainerPATCH 15/279 isofs: fix potential memory leak in mount option parsing
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengguang Xu <[email protected]>
[ Upstream commit 4f34a5130a471f32f2fe7750769ab4057dc3eaa0 ]
When specifying string type mount option (e.g., iocharset) several times in a mount, current option parsing may cause memory leak. Hence, call kfree for previous one in this case. Meanwhile, check memory allocation result for it.
--- fs/isofs/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/isofs/inode.c +3 -0
@@ -394,7 +394,10 @@ static int parse_options(char *options,break ;#ifdef CONFIG_JOLIET case Opt_iocharset: +kfree (popt->iocharset); popt->iocharset =match_strdup (&args[0 ]); +if (!popt->iocharset) +return 0 ;break ;#endif case Opt_map_a:
Greg Kroah-Hartman
maintainerPATCH 16/279 MIPS: dts: Boston: Fix PCI bus dtc warnings:
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Redfearn <[email protected]>
[ Upstream commit 2c2bf522ed8cbfaac666f7dc65cfd38de2b89f0f ]
dtc recently (v1.4.4-8-g756ffc4f52f6) added PCI bus checks. Fix the warnings now emitted:
arch/mips/boot/dts/img/boston.dtb: Warning (pci_bridge): /pci@10000000: missing bus-range for PCI bridge arch/mips/boot/dts/img/boston.dtb: Warning (pci_bridge): /pci@12000000: missing bus-range for PCI bridge arch/mips/boot/dts/img/boston.dtb: Warning (pci_bridge): /pci@14000000: missing bus-range for PCI bridge
Patchwork: https://patchwork.linux-mips.org/patch/19070/
--- arch/mips/boot/dts/img/boston.dts | 6 ++++++ 1 file changed, 6 insertions(+)
arch/mips/boot/dts/img/boston.dts +6 -0
@@ -51,6 +51,8 @@ ranges = <0x02000000 0 0x40000000 0x40000000 0 0x40000000>; + bus-range = <0x00 0xff>; + interrupt-map-mask = <0 0 0 7>; interrupt-map = <0 0 0 1 &pci0_intc 1>, <0 0 0 2 &pci0_intc 2>,
@@ -79,6 +81,8 @@ ranges = <0x02000000 0 0x20000000 0x20000000 0 0x20000000>; + bus-range = <0x00 0xff>; + interrupt-map-mask = <0 0 0 7>; interrupt-map = <0 0 0 1 &pci1_intc 1>, <0 0 0 2 &pci1_intc 2>,
@@ -107,6 +111,8 @@ ranges = <0x02000000 0 0x16000000 0x16000000 0 0x100000>; + bus-range = <0x00 0xff>; + interrupt-map-mask = <0 0 0 7>; interrupt-map = <0 0 0 1 &pci2_intc 1>, <0 0 0 2 &pci2_intc 2>,
Greg Kroah-Hartman
maintainerPATCH 17/279 spi: sh-msiof: Fix bit field overflow writes to TSCR/RSCR
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit 10b4640833e95eeacaef8060bc1b35e636df3218 ]
The change fixes a bit field overflow which allows to write to higher bits while calculating SPI transfer clock and setting BRPS and BRDV bit fields, the problem is reproduced if 'parent_rate' to 'spi_hz' ratio is greater than 1024, for instance
p->min_div = 2,
MSO rate = 33333333,
SPI device rate = 10000
results in
k = 5, i.e. BRDV = 0b100 or 1/32 prescaler output,
BRPS = 105,
TSCR value = 0x6804, thus MSSEL and MSIMM bit fields are non-zero.
--- drivers/spi/spi-sh-msiof.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-sh-msiof.c +1 -0
@@ -283,6 +283,7 @@ static void sh_msiof_spi_set_clk_regs(st } k =min_t (int, k,ARRAY_SIZE (sh_msiof_spi_div_table) -1 ); + brps =min_t (int, brps,32 ); scr = sh_msiof_spi_div_table[k].brdv |SCR_BRPS (brps);sh_msiof_write (p,TSCR , scr);
Greg Kroah-Hartman
maintainerPATCH 18/279 doc: Add vendor prefix for Kieback & Peter GmbH
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Majewski <[email protected]>
[ Upstream commit 99bf8f27f3f94d2a37291354b8dc83f13728f75f ]
The 'kiebackpeter' entry has been added to vendor-prefixes.txt to indicate products from Kieback & Peter GmbH.
--- Documentation/devicetree/bindings/vendor-prefixes.txt | 1 + 1 file changed, 1 insertion(+)
Documentation/devicetree/bindings/vendor-prefixes.txt +1 -0
@@ -181,6 +181,7 @@ karo Ka-Ro electronics GmbH keithkoep Keith & Koep GmbH keymile Keymile GmbH khadas Khadas +kiebackpeter Kieback & Peter GmbH kinetic Kinetic Technologies kingnovel Kingnovel Technology Co., Ltd. kosagi Sutajio Ko-Usagi PTE Ltd.
Greg Kroah-Hartman
maintainerPATCH 19/279 dt-bindings: pinctrl: sunxi: Fix reference to driver
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matheus Castello <[email protected]>
[ Upstream commit b614e905a0bc8fc5d4fa72665ac26ae00c874a4e ]
Bindings describe hardware, not drivers.
Use reference to hardware Allwinner A1X Pin Controller instead driver.
--- Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt +3 -3
@@ -55,9 +55,9 @@ pins it needs, and how they should be co configuration, drive strength and pullups. If one of these options is not set, its actual value will be unspecified. -This driver supports the generic pin multiplexing and configuration -bindings. For details on each properties, you can refer to -./pinctrl-bindings.txt. +Allwinner A1X Pin Controller supports the generic pin multiplexing and +configuration bindings. For details on each properties, you can refer to + ./pinctrl-bindings.txt. Required sub-node properties: - pins
Greg Kroah-Hartman
maintainerPATCH 20/279 dt-bindings: net: ravb: Add support for r8a77965 SoC
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacopo Mondi <[email protected]>
[ Upstream commit 1a862488729a6ea9cfd285d2c90f8738949ae7d2 ]
Add documentation for r8a77965 compatible string to renesas ravb device tree bindings documentation.
--- Documentation/devicetree/bindings/net/renesas,ravb.txt | 1 + 1 file changed, 1 insertion(+)
Documentation/devicetree/bindings/net/renesas,ravb.txt +1 -0
@@ -17,6 +17,7 @@ Required properties: - "renesas,etheravb-r8a7795" for the R8A7795 SoC. - "renesas,etheravb-r8a7796" for the R8A7796 SoC. + - "renesas,etheravb-r8a77965" for the R8A77965 SoC. - "renesas,etheravb-r8a77970" for the R8A77970 SoC. - "renesas,etheravb-r8a77980" for the R8A77980 SoC. - "renesas,etheravb-r8a77995" for the R8A77995 SoC.
Re: [PATCH 4.16 020/279] dt-bindings: net: ravb: Add support for r8a77965 SoC
Quoted 25 lines · Greg Kroah-Hartman
4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacopo Mondi <[email protected]>
[ Upstream commit
1a862488729a6ea9cfd285d2c90f8738949ae7d2]Add documentation for r8a77965 compatible string to renesas ravb device tree bindings documentation.
Signed-off-by Jacopo Mondi <[email protected]>Reviewed-by Geert Uytterhoeven <[email protected]>Reviewed-by Simon Horman <[email protected]>Acked-by Sergei Shtylyov <[email protected]>Signed-off-by Rob Herring <[email protected]>Signed-off-by Sasha Levin <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- Documentation/devicetree/bindings/net/renesas,ravb.txt | 1 + 1 file changed, 1 insertion(+)
Documentation/devicetree/bindings/net/renesas,ravb.txt Required properties: · line 23
Quoted 7 lines
Documentation/devicetree/bindings/net/renesas,ravb.txt +1
-0@@ -17,6 +17,7 @@ Required properties: - "renesas,etheravb-r8a7795" for the R8A7795 SoC. - "renesas,etheravb-r8a7796" for the R8A7796 SoC. + - "renesas,etheravb-r8a77965" for the R8A77965 SoC. - "renesas,etheravb-r8a77970" for the R8A77970 SoC. - "renesas,etheravb-r8a77980" for the R8A77980 SoC. - "renesas,etheravb-r8a77995" for the R8A77995 SoC.
Seeing the bindings update in -stable for the 1st time, and I highly doubt
that it's necessary here.
MBR, Sergei
Re: [PATCH 4.16 020/279] dt-bindings: net: ravb: Add support for r8a77965 SoC
Hi Sergei,
Quoted 28 lines · Sergei Shtylyov
Quoted 26 lines · Greg Kroah-Hartman
4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacopo Mondi <[email protected]>
[ Upstream commit
1a862488729a6ea9cfd285d2c90f8738949ae7d2]Add documentation for r8a77965 compatible string to renesas ravb device tree bindings documentation.
Signed-off-by Jacopo Mondi <[email protected]>Reviewed-by Geert Uytterhoeven <[email protected]>Reviewed-by Simon Horman <[email protected]>Acked-by Sergei Shtylyov <[email protected]>Signed-off-by Rob Herring <[email protected]>Signed-off-by Sasha Levin <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- Documentation/devicetree/bindings/net/renesas,ravb.txt | 1 + 1 file changed, 1 insertion(+)Documentation/devicetree/bindings/net/renesas,ravb.txt +0
-0@@ -17,6 +17,7 @@ Required properties:
Quoted 9 lines
Documentation/devicetree/bindings/net/renesas,ravb.txt Required properties: · line 23
Quoted 6 lines
Documentation/devicetree/bindings/net/renesas,ravb.txt +1
-0- "renesas,etheravb-r8a7795" for the R8A7795 SoC. - "renesas,etheravb-r8a7796" for the R8A7796 SoC. + - "renesas,etheravb-r8a77965" for the R8A77965 SoC. - "renesas,etheravb-r8a77970" for the R8A77970 SoC. - "renesas,etheravb-r8a77980" for the R8A77980 SoC. - "renesas,etheravb-r8a77995" for the R8A77995 SoC.Seeing the bindings update in -stable for the 1st time, and I highly doubt
that it's necessary here.
They don't hurt (as long as no _separate_ driver update is needed!), hence I don't object to backporting in-se.
But their usefulness can be doubted, as they don't change the behavior of the kernel, unlikely adding e.g. new PCI IDs, or extending drivers with new compatible
values. It's purely a documentation update.
Gr{oetje,eeting}s,
Geert
Signature · 5 lines
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected] In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds
Greg Kroah-Hartman
maintainerPATCH 21/279 dt-bindings: serial: sh-sci: Add support for r8a77965 (H)SCIF
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacopo Mondi <[email protected]>
[ Upstream commit 7de5b7e5f6a67c285b86d1478e8e150929c93482 ]
Add documentation for r8a77965 compatible string to Renesas sci-serial device tree bindings documentation.
--- Documentation/devicetree/bindings/serial/renesas,sci-serial.txt | 2 ++ 1 file changed, 2 insertions(+)
Documentation/devicetree/bindings/serial/renesas,sci-serial.txt +2 -0
@@ -41,6 +41,8 @@ Required properties: - "renesas,hscif-r8a7795" for R8A7795 (R-Car H3) HSCIF compatible UART. - "renesas,scif-r8a7796" for R8A7796 (R-Car M3-W) SCIF compatible UART. - "renesas,hscif-r8a7796" for R8A7796 (R-Car M3-W) HSCIF compatible UART. + - "renesas,scif-r8a77965" for R8A77965 (R-Car M3-N) SCIF compatible UART. + - "renesas,hscif-r8a77965" for R8A77965 (R-Car M3-N) HSCIF compatible UART. - "renesas,scif-r8a77970" for R8A77970 (R-Car V3M) SCIF compatible UART. - "renesas,hscif-r8a77970" for R8A77970 (R-Car V3M) HSCIF compatible UART. - "renesas,scif-r8a77995" for R8A77995 (R-Car D3) SCIF compatible UART.
Greg Kroah-Hartman
maintainerPATCH 22/279 dt-bindings: dmaengine: rcar-dmac: document R8A77965 support
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacopo Mondi <[email protected]>
[ Upstream commit b89bc283286b105e50aab9ab35992c0237ac77d8 ]
Add documentation for r8a77965 compatible string to rcar-dmac device tree bindings documentation.
--- Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt | 1 + 1 file changed, 1 insertion(+)
Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt +1 -0
@@ -25,6 +25,7 @@ Required Properties: - "renesas,dmac-r8a7794" (R-Car E2) - "renesas,dmac-r8a7795" (R-Car H3) - "renesas,dmac-r8a7796" (R-Car M3-W) + - "renesas,dmac-r8a77965" (R-Car M3-N) - "renesas,dmac-r8a77970" (R-Car V3M) - reg: base address and length of the registers block for the DMAC
Greg Kroah-Hartman
maintainerPATCH 24/279 kvm: x86: move MSR_IA32_TSC handling to x86.c
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
[ Upstream commit dd259935e4eec844dc3e5b8a7cd951cd658b4fb6 ]
This is not specific to Intel/AMD anymore. The TSC offset is available in vcpu->arch.tsc_offset.
--- arch/x86/kvm/svm.c | 9 --------- arch/x86/kvm/vmx.c | 20 -------------------- arch/x86/kvm/x86.c | 6 ++++++ 3 files changed, 6 insertions(+), 29 deletions(-)
arch/x86/kvm/svm.c +0 -9
@@ -3915,12 +3915,6 @@ static int svm_get_msr(struct kvm_vcpu *struct vcpu_svm *svm =to_svm (vcpu);switch (msr_info->index) { -case MSR_IA32_TSC : { - msr_info->data = svm->vmcb->control.tsc_offset + -kvm_scale_tsc (vcpu,rdtsc ()); - -break ; - }case MSR_STAR : msr_info->data = svm->vmcb->save.star;break ;
@@ -4080,9 +4074,6 @@ static int svm_set_msr(struct kvm_vcpu * svm->vmcb->save.g_pat = data;mark_dirty (svm->vmcb,VMCB_NPT );break ; -case MSR_IA32_TSC : -kvm_write_tsc (vcpu, msr); -break ;case MSR_IA32_SPEC_CTRL :if (!msr->host_initiated && !guest_cpuid_has (vcpu,X86_FEATURE_AMD_IBRS ))
arch/x86/kvm/vmx.c +0 -20
@@ -2650,20 +2650,6 @@ static u64 vmx_read_l1_tsc_offset(struct }/* -* reads and returns guest's timestamp counter "register" -* guest_tsc = (host_tsc * tsc multiplier) >> 48 + tsc_offset -* -- Intel TSC Scaling for Virtualization White Paper, sec 1.3 -*/ -static u64 guest_read_tsc (struct kvm_vcpu *vcpu) -{ -u64 host_tsc, tsc_offset; - - host_tsc =rdtsc (); - tsc_offset =vmcs_read64 (TSC_OFFSET ); -return kvm_scale_tsc (vcpu, host_tsc) + tsc_offset; -} - -/* * writes 'offset' into guest's timestamp counter offset register */ static void vmx_write_tsc_offset (struct kvm_vcpu *vcpu,u64 offset)
@@ -3283,9 +3269,6 @@ static int vmx_get_msr(struct kvm_vcpu *#endif case MSR_EFER :return kvm_get_msr_common (vcpu, msr_info); -case MSR_IA32_TSC : - msr_info->data =guest_read_tsc (vcpu); -break ;case MSR_IA32_SPEC_CTRL :if (!msr_info->host_initiated && !guest_cpuid_has (vcpu,X86_FEATURE_SPEC_CTRL ))
@@ -3403,9 +3386,6 @@ static int vmx_set_msr(struct kvm_vcpu *return 1 ;vmcs_write64 (GUEST_BNDCFGS , data);break ; -case MSR_IA32_TSC : -kvm_write_tsc (vcpu, msr_info); -break ;case MSR_IA32_SPEC_CTRL :if (!msr_info->host_initiated && !guest_cpuid_has (vcpu,X86_FEATURE_SPEC_CTRL ))
arch/x86/kvm/x86.c +6 -0
@@ -2333,6 +2333,9 @@ int kvm_set_msr_common(struct kvm_vcpu *return 1 ; vcpu->arch.smbase = data;break ; +case MSR_IA32_TSC : +kvm_write_tsc (vcpu, msr_info); +break ;case MSR_SMI_COUNT :if (!msr_info->host_initiated)return 1 ;
@@ -2572,6 +2575,9 @@ int kvm_get_msr_common(struct kvm_vcpu *case MSR_IA32_UCODE_REV : msr_info->data = vcpu->arch.microcode_version;break ; +case MSR_IA32_TSC : + msr_info->data =kvm_scale_tsc (vcpu,rdtsc ()) + vcpu->arch.tsc_offset; +break ;case MSR_MTRRcap: case 0x200 ... 0x2ff:return kvm_mtrr_get_msr (vcpu, msr_info->index, &msr_info->data);
Greg Kroah-Hartman
maintainerPATCH 25/279 clk: honor CLK_MUX_ROUND_CLOSEST in generic clk mux
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 4ad69b80e886a845f56ce0a3d10211208693d92b ]
CLK_MUX_ROUND_CLOSEST is part of the clk_mux documentation but clk_mux directly calls __clk_mux_determine_rate(), which overrides the flag. As result, if clk_mux is instantiated with CLK_MUX_ROUND_CLOSEST, the flag will be ignored and the clock rounded down.
To solve this, this patch expose clk_mux_determine_rate_flags() in the clk-provider API and uses it in the determine_rate() callback of clk_mux.
--- drivers/clk/clk-mux.c | 10 +++++++++- drivers/clk/clk.c | 7 ++++--- include/linux/clk-provider.h | 3 +++ 3 files changed, 16 insertions(+), 4 deletions(-)
drivers/clk/clk-mux.c +9 -1
@@ -101,10 +101,18 @@ static int clk_mux_set_parent(struct clkreturn 0 ; } +static int clk_mux_determine_rate (struct clk_hw *hw, +struct clk_rate_request *req) +{ +struct clk_mux *mux =to_clk_mux (hw); + +return clk_mux_determine_rate_flags (hw, req, mux->flags); +} +const struct clk_ops clk_mux_ops = { .get_parent = clk_mux_get_parent, .set_parent = clk_mux_set_parent, - .determine_rate = __clk_mux_determine_rate, + .determine_rate = clk_mux_determine_rate, };EXPORT_SYMBOL_GPL (clk_mux_ops);
drivers/clk/clk.c +4 -3
@@ -426,9 +426,9 @@ static bool mux_is_better_rate(unsignedreturn now <= rate && now > best; } -static int -clk_mux_determine_rate_flags (struct clk_hw *hw,struct clk_rate_request *req, -unsigned long flags) +int clk_mux_determine_rate_flags (struct clk_hw *hw, +struct clk_rate_request *req, +unsigned long flags) {struct clk_core *core = hw->core, *parent, *best_parent =NULL ;int i, num_parents, ret;
@@ -488,6 +488,7 @@ out:return 0 ; } +EXPORT_SYMBOL_GPL (clk_mux_determine_rate_flags);struct clk *__clk_lookup (const char *name) {
include/linux/clk-provider.h +3 -0
@@ -755,6 +755,9 @@ int __clk_mux_determine_rate(struct clk_int __clk_determine_rate (struct clk_hw *core,struct clk_rate_request *req);int __clk_mux_determine_rate_closest (struct clk_hw *hw,struct clk_rate_request *req); +int clk_mux_determine_rate_flags (struct clk_hw *hw, +struct clk_rate_request *req, +unsigned long flags);void clk_hw_reparent (struct clk_hw *hw,struct clk_hw *new_parent);void clk_hw_set_rate_range (struct clk_hw *hw,unsigned long min_rate,unsigned long max_rate);
Greg Kroah-Hartman
maintainerPATCH 26/279 ASoC: rt5514: Add the missing register in the readable table
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "[email protected]" <[email protected]>
[ Upstream commit 5ef5ac8de125fe6b4b23293bee026ca7ea1529b9 ]
The patch adds the missing register in the readable table.
--- sound/soc/codecs/rt5514.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/codecs/rt5514.c +3 -0
@@ -89,6 +89,7 @@ static const struct reg_default rt5514_r {RT5514_PLL3_CALIB_CTRL5, 0x40220012}, {RT5514_DELAY_BUF_CTRL1, 0x7fff006a}, {RT5514_DELAY_BUF_CTRL3, 0x00000000}, + {RT5514_ASRC_IN_CTRL1, 0x00000003}, {RT5514_DOWNFILTER0_CTRL1, 0x00020c2f}, {RT5514_DOWNFILTER0_CTRL2, 0x00020c2f}, {RT5514_DOWNFILTER0_CTRL3, 0x10000362},
@@ -181,6 +182,7 @@ static bool rt5514_readable_register(strcase RT5514_PLL3_CALIB_CTRL5 :case RT5514_DELAY_BUF_CTRL1 :case RT5514_DELAY_BUF_CTRL3 : +case RT5514_ASRC_IN_CTRL1 :case RT5514_DOWNFILTER0_CTRL1 :case RT5514_DOWNFILTER0_CTRL2 :case RT5514_DOWNFILTER0_CTRL3 :
@@ -238,6 +240,7 @@ static bool rt5514_i2c_readable_registercase RT5514_DSP_MAPPING |RT5514_PLL3_CALIB_CTRL5 :case RT5514_DSP_MAPPING |RT5514_DELAY_BUF_CTRL1 :case RT5514_DSP_MAPPING |RT5514_DELAY_BUF_CTRL3 : +case RT5514_DSP_MAPPING |RT5514_ASRC_IN_CTRL1 :case RT5514_DSP_MAPPING |RT5514_DOWNFILTER0_CTRL1 :case RT5514_DSP_MAPPING |RT5514_DOWNFILTER0_CTRL2 :case RT5514_DSP_MAPPING |RT5514_DOWNFILTER0_CTRL3 :
Greg Kroah-Hartman
maintainerPATCH 27/279 ARM: dts: Fix cm2 and prm sizes for omap4
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit bc8a3ef1940c9a6dfa316b31e063fdd4fbab0add ]
The size of these modules is 0x2000, not 0x3000. The extra 0x1000 after 0x2000 is for the interconnect target agent which is a separate device.
control module support")
--- arch/arm/boot/dts/omap4.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/omap4.dtsi +4 -4
@@ -163,10 +163,10 @@ cm2: cm2@8000 { compatible = "ti,omap4-cm2", "simple-bus"; - reg = <0x8000 0x3000>; + reg = <0x8000 0x2000>; #address-cells = <1>; #size-cells = <1>; - ranges = <0 0x8000 0x3000>; + ranges = <0 0x8000 0x2000>; cm2_clocks: clocks { #address-cells = <1>;
@@ -250,11 +250,11 @@ prm: prm@6000 { compatible = "ti,omap4-prm"; - reg = <0x6000 0x3000>; + reg = <0x6000 0x2000>; interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <1>; - ranges = <0 0x6000 0x3000>; + ranges = <0 0x6000 0x2000>; prm_clocks: clocks { #address-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 28/279 eCryptfs: dont pass up plaintext names when using filename encryption
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <[email protected]>
[ Upstream commit e86281e700cca8a773f9a572fa406adf2784ba5c ]
Both ecryptfs_filldir() and ecryptfs_readlink_lower() use ecryptfs_decode_and_decrypt_filename() to translate lower filenames to upper filenames. The function correctly passes up lower filenames, unchanged, when filename encryption isn't in use. However, it was also passing up lower filenames when the filename wasn't encrypted or when decryption failed. Since 88ae4ab9802e, eCryptfs refuses to lookup lower plaintext names when filename encryption is enabled so this resulted in a situation where userspace would see lower plaintext filenames in calls to getdents(2) but then not be able to lookup those filenames.
An example of this can be seen when enabling filename encryption on an eCryptfs mount at the root directory of an Ext4 filesystem:
$ ls -1i /lower 12 ECRYPTFS_FNEK_ENCRYPTED.FWYZD8TcW.5FV-TKTEYOHsheiHX9a-w.NURCCYIMjI8pn5BDB9-h3fXwrE-- 11 lost+found $ ls -1i /upper ls: cannot access '/upper/lost+found': No such file or directory ? lost+found 12 test
With this change, the lower lost+found dentry is ignored:
$ ls -1i /lower 12 ECRYPTFS_FNEK_ENCRYPTED.FWYZD8TcW.5FV-TKTEYOHsheiHX9a-w.NURCCYIMjI8pn5BDB9-h3fXwrE-- 11 lost+found $ ls -1i /upper 12 test
Additionally, some potentially noisy error/info messages in the related code paths are turned into debug messages so that the logs can't be easily filled.
--- fs/ecryptfs/crypto.c | 41 ++++++++++++++++++++++++++++------------- fs/ecryptfs/file.c | 21 ++++++++++++++++----- 2 files changed, 44 insertions(+), 18 deletions(-)
fs/ecryptfs/crypto.c +28 -13
@@ -1997,6 +1997,16 @@ out:return rc; } +static bool is_dot_dotdot (const char *name,size_t name_size) +{ +if (name_size ==1 && name[0 ] =='.' ) +return true; +else if (name_size ==2 && name[0 ] =='.' && name[1 ] =='.' ) +return true; + +return false; +} +/** * ecryptfs_decode_and_decrypt_filename - converts the encoded cipher text name to decoded plaintext * @plaintext_name: The plaintext name
@@ -2021,13 +2031,21 @@ int ecryptfs_decode_and_decrypt_filenamesize_t packet_size;int rc =0 ; -if ((mount_crypt_stat->flags &ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES ) - && !(mount_crypt_stat->flags &ECRYPTFS_ENCRYPTED_VIEW_ENABLED ) - && (name_size >ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE ) - && (strncmp (name,ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX , -ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE ) ==0 )) { -const char *orig_name = name; -size_t orig_name_size = name_size; +if ((mount_crypt_stat->flags &ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES ) && + !(mount_crypt_stat->flags &ECRYPTFS_ENCRYPTED_VIEW_ENABLED )) { +if (is_dot_dotdot (name, name_size)) { + rc =ecryptfs_copy_filename (plaintext_name, + plaintext_name_size, + name, name_size); + goto out; + } + +if (name_size <=ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE || +strncmp (name,ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX , +ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE )) { + rc = -EINVAL ; + goto out; + } name +=ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE ; name_size -=ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE ;
@@ -2047,12 +2065,9 @@ int ecryptfs_decode_and_decrypt_filename decoded_name, decoded_name_size);if (rc) { -printk (KERN_INFO "%s: Could not parse tag 70 packet " -"from filename; copying through filename " -"as-is\n" , __func__); - rc =ecryptfs_copy_filename (plaintext_name, - plaintext_name_size, - orig_name, orig_name_size); +ecryptfs_printk (KERN_DEBUG , +"%s: Could not parse tag 70 packet from filename\n" , + __func__); goto out_free; } }else {
fs/ecryptfs/file.c +16 -5
@@ -82,17 +82,28 @@ ecryptfs_filldir(struct dir_context *ctx buf->sb, lower_name, lower_namelen);if (rc) { -printk (KERN_ERR "%s: Error attempting to decode and decrypt " -"filename [%s]; rc = [%d]\n" , __func__, lower_name, - rc); - goto out; +if (rc != -EINVAL ) { +ecryptfs_printk (KERN_DEBUG , +"%s: Error attempting to decode and decrypt filename [%s]; rc = [%d]\n" , + __func__, lower_name, rc); +return rc; + } + +/* Mask -EINVAL errors as these are most likely due a plaintext +* filename present in the lower filesystem despite filename +* encryption being enabled. One unavoidable example would be +* the "lost+found" dentry in the root directory of an Ext4 +* filesystem. +*/ +return 0 ; } + buf->caller->pos = buf->ctx.pos; rc = !dir_emit (buf->caller, name, name_size, ino, d_type);kfree (name);if (!rc) buf->entries_written++; -out: +return rc; }
Greg Kroah-Hartman
maintainerPATCH 29/279 soc: bcm: raspberrypi-power: Fix use of __packed
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
[ Upstream commit 0a12e80ce4230434c2ed66ad0d65af0b7ccecea8 ]
Commit a09cd356586d ("ARM: bcm2835: add rpi power domain driver") attempted to annotate the structure rpi_power_domain_packet with __packed but introduced a typo and made it named __packet instead. Just drop the annotation since the structure is naturally aligned already.
--- drivers/soc/bcm/raspberrypi-power.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/bcm/raspberrypi-power.c +1 -1
@@ -45,7 +45,7 @@ struct rpi_power_domains {struct rpi_power_domain_packet {u32 domain;u32 on; -} __packet; +};/* * Asks the firmware to enable or disable power on a specific power
Greg Kroah-Hartman
maintainerPATCH 31/279 powerpc/64s: Default l1d_size to 64K in RFI fallback flush
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madhavan Srinivasan <[email protected]>
[ Upstream commit 9dfbf78e4114fcaf4ef61c49885c3ab5bad40d0b ]
If there is no d-cache-size property in the device tree, l1d_size could be zero. We don't actually expect that to happen, it's only been seen on mambo (simulator) in some configurations.
A zero-size l1d_size leads to the loop in the asm wrapping around to 2^64-1, and then walking off the end of the fallback area and eventually causing a page fault which is fatal.
Just default to 64K which is correct on some CPUs, and sane enough to not cause a crash on others.
--- arch/powerpc/kernel/setup_64.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/powerpc/kernel/setup_64.c +11 -0
@@ -864,6 +864,17 @@ static void init_fallback_flush(void)int cpu; l1d_size = ppc64_caches.l1d.size; + +/* +* If there is no d-cache-size property in the device tree, l1d_size +* could be zero. That leads to the loop in the asm wrapping around to +* 2^64-1, and then walking off the end of the fallback area and +* eventually causing a page fault which is fatal. Just default to +* something vaguely sane. +*/ +if (!l1d_size) + l1d_size = (64 *1024 ); + limit =min (ppc64_bolted_size (), ppc64_rma_size);/*
Greg Kroah-Hartman
maintainerPATCH 32/279 PCI: kirin: Fix reset gpio name
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 5db8f8d1099bd93a64a80b609dbcce887327ffc8 ]
As documented in the devicetree bindings (pci/kirin-pcie.txt) and the reset gpio name must be 'reset-gpios'. However, current driver erroneously looks for a 'reset-gpio' resource which makes the driver probe fail. Fix it.
--- drivers/pci/dwc/pcie-kirin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/dwc/pcie-kirin.c +1 -1
@@ -487,7 +487,7 @@ static int kirin_pcie_probe(struct platfreturn ret; kirin_pcie->gpio_id_reset =of_get_named_gpio (dev->of_node, -"reset-gpio" ,0 ); +"reset-gpios" ,0 );if (kirin_pcie->gpio_id_reset <0 )return -ENODEV ;
Greg Kroah-Hartman
maintainerPATCH 33/279 ASoC: topology: Fix bugs of freeing soc topology
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan Wang <[email protected]>
[ Upstream commit feb12f0cd8d7b1e8df2e6fce19fc9a026a468cc2 ]
In snd_soc_tplg_component_remove(), it should compare index and not dobj->index with SND_SOC_TPLG_INDEX_ALL for removing all topology objects.
--- sound/soc/soc-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-topology.c +1 -1
@@ -2571,7 +2571,7 @@ int snd_soc_tplg_component_remove(struct/* match index */ if (dobj->index != index && - dobj->index !=SND_SOC_TPLG_INDEX_ALL ) + index !=SND_SOC_TPLG_INDEX_ALL )continue ;switch (dobj->type) {
Greg Kroah-Hartman
maintainerPATCH 34/279 livepatch: Initialize shadow variables safely by a custom callback
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Mladek <[email protected]>
[ Upstream commit e91c2518a5d22a07642f35d85f39001ad379dae4 ]
The existing API allows to pass a sample data to initialize the shadow data. It works well when the data are position independent. But it fails miserably when we need to set a pointer to the shadow structure itself.
Unfortunately, we might need to initialize the pointer surprisingly often because of struct list_head. It is even worse because the list might be hidden in other common structures, for example, struct mutex, struct wait_queue_head.
For example, this was needed to fix races in ALSA sequencer. It required to add mutex into struct snd_seq_client. See commit b3defb791b26ea06 ("ALSA: seq: Make ioctls race-free") and commit d15d662e89fc667b9 ("ALSA: seq: Fix racy pool initializations")
This patch makes the API more safe. A custom constructor function and data are passed to klp_shadow_*alloc() functions instead of the sample data.
Note that ctor_data are no longer a template for shadow->data. It might point to any data that might be necessary when the constructor is called.
Also note that the constructor is called under klp_shadow_lock. It is an internal spin_lock that synchronizes alloc() vs. get() operations, see klp_shadow_get_or_alloc(). On one hand, this adds a risk of ABBA deadlocks. On the other hand, it allows to do some operations safely. For example, we could add the new structure into an existing list. This must be done only once when the structure is allocated.
--- Documentation/livepatch/shadow-vars.txt | 31 +++++++---- include/linux/livepatch.h | 14 +++-- kernel/livepatch/shadow.c | 84 +++++++++++++++++++----------- samples/livepatch/livepatch-shadow-fix1.c | 18 ++++++ samples/livepatch/livepatch-shadow-fix2.c | 6 -- 5 files changed, 105 insertions(+), 48 deletions(-)
Documentation/livepatch/shadow-vars.txt +22 -9
@@ -34,9 +34,13 @@ meta-data and shadow-data: - data[] - storage for shadow data It is important to note that the klp_shadow_alloc() and -klp_shadow_get_or_alloc() calls, described below, store a *copy* of the -data that the functions are provided. Callers should provide whatever -mutual exclusion is required of the shadow data. +klp_shadow_get_or_alloc() are zeroing the variable by default. +They also allow to call a custom constructor function when a non-zero +value is needed. Callers should provide whatever mutual exclusion +is required. + +Note that the constructor is called under klp_shadow_lock spinlock. It allows +to do actions that can be done only once when a new variable is allocated. * klp_shadow_get() - retrieve a shadow variable data pointer - search hashtable for <obj, id> pair
@@ -47,7 +51,7 @@ mutual exclusion is required of the shad - WARN and return NULL - if <obj, id> doesn't already exist - allocate a new shadow variable - - copy data into the new shadow variable + - initialize the variable using a custom constructor and data when provided - add <obj, id> to the global hashtable * klp_shadow_get_or_alloc() - get existing or alloc a new shadow variable
@@ -56,7 +60,7 @@ mutual exclusion is required of the shad - return existing shadow variable - if <obj, id> doesn't already exist - allocate a new shadow variable - - copy data into the new shadow variable + - initialize the variable using a custom constructor and data when provided - add <obj, id> pair to the global hashtable * klp_shadow_free() - detach and free a <obj, id> shadow variable
@@ -107,7 +111,8 @@ struct sta_info *sta_info_alloc(struct i sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp); /* Attach a corresponding shadow variable, then initialize it */ - ps_lock = klp_shadow_alloc(sta, PS_LOCK, NULL, sizeof(*ps_lock), gfp); + ps_lock = klp_shadow_alloc(sta, PS_LOCK, sizeof(*ps_lock), gfp, + NULL, NULL); if (!ps_lock) goto shadow_fail; spin_lock_init(ps_lock);
@@ -148,16 +153,24 @@ shadow variables to parents already in-f For commit 1d147bfa6429, a good spot to allocate a shadow spinlock is inside ieee80211_sta_ps_deliver_wakeup(): +int ps_lock_shadow_ctor(void *obj, void *shadow_data, void *ctor_data) +{ + spinlock_t *lock = shadow_data; + + spin_lock_init(lock); + return 0; +} + #define PS_LOCK 1 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta) { - DEFINE_SPINLOCK(ps_lock_fallback); spinlock_t *ps_lock; /* sync with ieee80211_tx_h_unicast_ps_buf */ ps_lock = klp_shadow_get_or_alloc(sta, PS_LOCK, - &ps_lock_fallback, sizeof(ps_lock_fallback), - GFP_ATOMIC); + sizeof(*ps_lock), GFP_ATOMIC, + ps_lock_shadow_ctor, NULL); + if (ps_lock) spin_lock(ps_lock); ...
include/linux/livepatch.h +10 -4
@@ -186,11 +186,17 @@ static inline bool klp_have_reliable_staIS_ENABLED (CONFIG_HAVE_RELIABLE_STACKTRACE ); } +typedef int (*klp_shadow_ctor_t )(void *obj, +void *shadow_data, +void *ctor_data); +void *klp_shadow_get (void *obj,unsigned long id); -void *klp_shadow_alloc (void *obj,unsigned long id,void *data, -size_t size,gfp_t gfp_flags); -void *klp_shadow_get_or_alloc (void *obj,unsigned long id,void *data, -size_t size,gfp_t gfp_flags); +void *klp_shadow_alloc (void *obj,unsigned long id, +size_t size,gfp_t gfp_flags, +klp_shadow_ctor_t ctor,void *ctor_data); +void *klp_shadow_get_or_alloc (void *obj,unsigned long id, +size_t size,gfp_t gfp_flags, +klp_shadow_ctor_t ctor,void *ctor_data);void klp_shadow_free (void *obj,unsigned long id);void klp_shadow_free_all (unsigned long id);
kernel/livepatch/shadow.c +54 -30
137 lines not on this page · raw message
samples/livepatch/livepatch-shadow-fix1.c +17 -1
@@ -56,6 +56,21 @@ struct dummy {unsigned long jiffies_expire; }; +/* +* The constructor makes more sense together with klp_shadow_get_or_alloc(). +* In this example, it would be safe to assign the pointer also to the shadow +* variable returned by klp_shadow_alloc(). But we wanted to show the more +* complicated use of the API. +*/ +static int shadow_leak_ctor (void *obj,void *shadow_data,void *ctor_data) +{ +void **shadow_leak = shadow_data; +void *leak = ctor_data; + + *shadow_leak = leak; +return 0 ; +} +struct dummy *livepatch_fix1_dummy_alloc (void ) {struct dummy *d;
@@ -74,7 +89,8 @@ struct dummy *livepatch_fix1_dummy_alloc* pointer to handle resource release. */ leak =kzalloc (sizeof (int ),GFP_KERNEL ); -klp_shadow_alloc (d,SV_LEAK , &leak,sizeof (leak),GFP_KERNEL ); +klp_shadow_alloc (d,SV_LEAK ,sizeof (leak),GFP_KERNEL , + shadow_leak_ctor, leak);pr_info ("%s: dummy @ %p, expires @ %lx\n" , __func__, d, d->jiffies_expire);
samples/livepatch/livepatch-shadow-fix2.c +2 -4
@@ -53,17 +53,15 @@ struct dummy {bool livepatch_fix2_dummy_check (struct dummy *d,unsigned long jiffies) {int *shadow_count; -int count;/* * Patch: handle in-flight dummy structures, if they do not * already have a SV_COUNTER shadow variable, then attach a * new one. */ - count =0 ; shadow_count =klp_shadow_get_or_alloc (d,SV_COUNTER , - &count,sizeof (count), -GFP_NOWAIT ); +sizeof (*shadow_count),GFP_NOWAIT , +NULL ,NULL );if (shadow_count) *shadow_count +=1 ;
Greg Kroah-Hartman
maintainerPATCH 35/279 livepatch: Allow to call a custom callback when freeing shadow variables
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Mladek <[email protected]>
[ Upstream commit 3b2c77d000fe9f7d02e9e726e00dccf9f92b256f ]
We might need to do some actions before the shadow variable is freed. For example, we might need to remove it from a list or free some data that it points to.
This is already possible now. The user can get the shadow variable by klp_shadow_get(), do the necessary actions, and then call klp_shadow_free().
This patch allows to do it a more elegant way. The user could implement the needed actions in a callback that is passed to klp_shadow_free() as a parameter. The callback usually does reverse operations to the constructor callback that can be called by klp_shadow_*alloc().
It is especially useful for klp_shadow_free_all(). There we need to do these extra actions for each found shadow variable with the given ID.
Note that the memory used by the shadow variable itself is still released later by rcu callback. It is needed to protect internal structures that keep all shadow variables. But the destructor is called immediately. The shadow variable must not be access anyway after klp_shadow_free() is called. The user is responsible to protect this any suitable way.
Be aware that the destructor is called under klp_shadow_lock. It is the same as for the contructor in klp_shadow_alloc().
--- Documentation/livepatch/shadow-vars.txt | 10 +++++++--- include/linux/livepatch.h | 5 +++-- kernel/livepatch/shadow.c | 26 ++++++++++++++++++-------- samples/livepatch/livepatch-shadow-fix1.c | 25 +++++++++++++++---------- samples/livepatch/livepatch-shadow-fix2.c | 27 ++++++++++++++++----------- 5 files changed, 59 insertions(+), 34 deletions(-)
Documentation/livepatch/shadow-vars.txt +7 -3
@@ -65,11 +65,15 @@ to do actions that can be done only once * klp_shadow_free() - detach and free a <obj, id> shadow variable - find and remove a <obj, id> reference from global hashtable - - if found, free shadow variable + - if found + - call destructor function if defined + - free shadow variable * klp_shadow_free_all() - detach and free all <*, id> shadow variables - find and remove any <*, id> references from global hashtable - - if found, free shadow variable + - if found + - call destructor function if defined + - free shadow variable 2. Use cases
@@ -136,7 +140,7 @@ variable: void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) { - klp_shadow_free(sta, PS_LOCK); + klp_shadow_free(sta, PS_LOCK, NULL); kfree(sta); ...
include/linux/livepatch.h +3 -2
@@ -189,6 +189,7 @@ static inline bool klp_have_reliable_statypedef int (*klp_shadow_ctor_t )(void *obj,void *shadow_data,void *ctor_data); +typedef void (*klp_shadow_dtor_t )(void *obj,void *shadow_data);void *klp_shadow_get (void *obj,unsigned long id); void *klp_shadow_alloc(void *obj, unsigned long id,
@@ -197,8 +198,8 @@ void *klp_shadow_alloc(void *obj, unsignvoid *klp_shadow_get_or_alloc (void *obj,unsigned long id,size_t size,gfp_t gfp_flags,klp_shadow_ctor_t ctor,void *ctor_data); -void klp_shadow_free (void *obj,unsigned long id); -void klp_shadow_free_all (unsigned long id); +void klp_shadow_free (void *obj,unsigned long id,klp_shadow_dtor_t dtor); +void klp_shadow_free_all (unsigned long id,klp_shadow_dtor_t dtor);#else /* !CONFIG_LIVEPATCH */
kernel/livepatch/shadow.c +18 -8
@@ -243,15 +243,26 @@ void *klp_shadow_get_or_alloc(void *obj, }EXPORT_SYMBOL_GPL (klp_shadow_get_or_alloc); +static void klp_shadow_free_struct (struct klp_shadow *shadow, +klp_shadow_dtor_t dtor) +{ +hash_del_rcu (&shadow->node); +if (dtor) +dtor (shadow->obj, shadow->data); +kfree_rcu (shadow, rcu_head); +} +/** * klp_shadow_free() - detach and free a <obj, id> shadow variable * @obj: pointer to parent object * @id: data identifier +* @dtor: custom callback that can be used to unregister the variable +* and/or free data that the shadow variable points to (optional) * * This function releases the memory for this <obj, id> shadow variable * instance, callers should stop referencing it accordingly. */ -void klp_shadow_free (void *obj,unsigned long id) +void klp_shadow_free (void *obj,unsigned long id,klp_shadow_dtor_t dtor) {struct klp_shadow *shadow;unsigned long flags;
@@ -263,8 +274,7 @@ void klp_shadow_free(void *obj, unsigned (unsigned long)obj) {if (klp_shadow_match (shadow, obj, id)) { -hash_del_rcu (&shadow->node); -kfree_rcu (shadow, rcu_head); +klp_shadow_free_struct (shadow, dtor);break ; } }
@@ -276,11 +286,13 @@ EXPORT_SYMBOL_GPL(klp_shadow_free);/** * klp_shadow_free_all() - detach and free all <*, id> shadow variables * @id: data identifier +* @dtor: custom callback that can be used to unregister the variable +* and/or free data that the shadow variable points to (optional) * * This function releases the memory for all <*, id> shadow variable * instances, callers should stop referencing them accordingly. */ -void klp_shadow_free_all (unsigned long id) +void klp_shadow_free_all (unsigned long id,klp_shadow_dtor_t dtor) {struct klp_shadow *shadow;unsigned long flags;
@@ -290,10 +302,8 @@ void klp_shadow_free_all(unsigned long i/* Delete all <*, id> from hash */ hash_for_each (klp_shadow_hash, i, shadow, node) { -if (klp_shadow_match (shadow, shadow->obj, id)) { -hash_del_rcu (&shadow->node); -kfree_rcu (shadow, rcu_head); - } +if (klp_shadow_match (shadow, shadow->obj, id)) +klp_shadow_free_struct (shadow, dtor); }spin_unlock_irqrestore (&klp_shadow_lock, flags);
samples/livepatch/livepatch-shadow-fix1.c +15 -10
@@ -98,9 +98,19 @@ struct dummy *livepatch_fix1_dummy_allocreturn d; } +static void livepatch_fix1_dummy_leak_dtor (void *obj,void *shadow_data) +{ +void *d = obj; +void **shadow_leak = shadow_data; + +kfree (*shadow_leak); +pr_info ("%s: dummy @ %p, prevented leak @ %p\n" , + __func__, d, *shadow_leak); +} +void livepatch_fix1_dummy_free (struct dummy *d) { -void **shadow_leak, *leak; +void **shadow_leak;/* * Patch: fetch the saved SV_LEAK shadow variable, detach and
@@ -109,15 +119,10 @@ void livepatch_fix1_dummy_free(struct du* was loaded.) */ shadow_leak =klp_shadow_get (d,SV_LEAK ); -if (shadow_leak) { - leak = *shadow_leak; -klp_shadow_free (d,SV_LEAK ); -kfree (leak); -pr_info ("%s: dummy @ %p, prevented leak @ %p\n" , - __func__, d, leak); - }else { +if (shadow_leak) +klp_shadow_free (d,SV_LEAK , livepatch_fix1_dummy_leak_dtor); +else pr_info ("%s: dummy @ %p leaked!\n" , __func__, d); - }kfree (d); }
@@ -163,7 +168,7 @@ static int livepatch_shadow_fix1_init(vostatic void livepatch_shadow_fix1_exit (void ) {/* Cleanup any existing SV_LEAK shadow variables */ -klp_shadow_free_all (SV_LEAK ); +klp_shadow_free_all (SV_LEAK , livepatch_fix1_dummy_leak_dtor);WARN_ON (klp_unregister_patch (&patch)); }
samples/livepatch/livepatch-shadow-fix2.c +16 -11
@@ -68,22 +68,27 @@ bool livepatch_fix2_dummy_check(struct dreturn time_after (jiffies, d->jiffies_expire); } +static void livepatch_fix2_dummy_leak_dtor (void *obj,void *shadow_data) +{ +void *d = obj; +void **shadow_leak = shadow_data; + +kfree (*shadow_leak); +pr_info ("%s: dummy @ %p, prevented leak @ %p\n" , + __func__, d, *shadow_leak); +} +void livepatch_fix2_dummy_free (struct dummy *d) { -void **shadow_leak, *leak; +void **shadow_leak;int *shadow_count;/* Patch: copy the memory leak patch from the fix1 module. */ shadow_leak =klp_shadow_get (d,SV_LEAK ); -if (shadow_leak) { - leak = *shadow_leak; -klp_shadow_free (d,SV_LEAK ); -kfree (leak); -pr_info ("%s: dummy @ %p, prevented leak @ %p\n" , - __func__, d, leak); - }else { +if (shadow_leak) +klp_shadow_free (d,SV_LEAK , livepatch_fix2_dummy_leak_dtor); +else pr_info ("%s: dummy @ %p leaked!\n" , __func__, d); - }/* * Patch: fetch the SV_COUNTER shadow variable and display
@@ -93,7 +98,7 @@ void livepatch_fix2_dummy_free(struct duif (shadow_count) {pr_info ("%s: dummy @ %p, check counter = %d\n" , __func__, d, *shadow_count); -klp_shadow_free (d,SV_COUNTER ); +klp_shadow_free (d,SV_COUNTER ,NULL ); }kfree (d);
@@ -140,7 +145,7 @@ static int livepatch_shadow_fix2_init(vostatic void livepatch_shadow_fix2_exit (void ) {/* Cleanup any existing SV_COUNTER shadow variables */ -klp_shadow_free_all (SV_COUNTER ); +klp_shadow_free_all (SV_COUNTER ,NULL );WARN_ON (klp_unregister_patch (&patch)); }
Greg Kroah-Hartman
maintainerPATCH 36/279 KVM: arm/arm64: vgic: Kick new VCPU on interrupt migration
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit bf9a41377d14f565764022470e14aae72559589a ]
When vgic_prune_ap_list() finds an interrupt that needs to be migrated to a new VCPU, we should notify this VCPU of the pending interrupt, since it requires immediate action.
Kick this VCPU once we have added the new IRQ to the list, but only after dropping the locks.
--- virt/kvm/arm/vgic/vgic.c | 8 ++++++++ 1 file changed, 8 insertions(+)
virt/kvm/arm/vgic/vgic.c +8 -0
@@ -599,6 +599,7 @@ retry:list_for_each_entry_safe (irq, tmp, &vgic_cpu->ap_list_head, ap_list) {struct kvm_vcpu *target_vcpu, *vcpuA, *vcpuB; +bool target_vcpu_needs_kick = false;spin_lock (&irq->irq_lock);
@@ -669,11 +670,18 @@ retry:list_del (&irq->ap_list); irq->vcpu = target_vcpu;list_add_tail (&irq->ap_list, &new_cpu->ap_list_head); + target_vcpu_needs_kick = true; }spin_unlock (&irq->irq_lock);spin_unlock (&vcpuB->arch.vgic_cpu.ap_list_lock);spin_unlock_irqrestore (&vcpuA->arch.vgic_cpu.ap_list_lock, flags); + +if (target_vcpu_needs_kick) { +kvm_make_request (KVM_REQ_IRQ_PENDING , target_vcpu); +kvm_vcpu_kick (target_vcpu); + } + goto retry; }
Greg Kroah-Hartman
maintainerPATCH 37/279 xen: xenbus_dev_frontend: Really return response string
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Gaiser <[email protected]>
[ Upstream commit ebf04f331fa15a966262341a7dc6b1a0efd633e4 ]
xenbus_command_reply() did not actually copy the response string and leaked stack content instead.
--- drivers/xen/xenbus/xenbus_dev_frontend.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/xen/xenbus/xenbus_dev_frontend.c +2 -1
@@ -403,7 +403,7 @@ static int xenbus_command_reply(struct x {struct {struct xsd_sockmsg hdr; -const char body[16 ]; +char body[16 ]; } msg;int rc;
@@ -412,6 +412,7 @@ static int xenbus_command_reply(struct x msg.hdr.len =strlen (reply) +1 ;if (msg.hdr.len >sizeof (msg.body))return -E2BIG ; +memcpy (&msg.body, reply, msg.hdr.len);mutex_lock (&u->reply_mutex); rc =queue_reply (&u->read_buffers, &msg,sizeof (msg.hdr) + msg.hdr.len);
Greg Kroah-Hartman
maintainerPATCH 38/279 arm64: kasan: avoid pfn_to_nid() before page array is initialized
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 800cb2e553d44541b83aa3ec45d9839385fe8ab6 ]
In arm64's kasan_init(), we use pfn_to_nid() to find the NUMA node a span of memory is in, hoping to allocate shadow from the same NUMA node. However, at this point, the page array has not been initialized, and thus this is bogus.
Since commit:
f165b378bbdf6c8a ("mm: uninitialized struct page poisoning sanity")
... accessing fields of the page array results in a boot time Oops(), highlighting this problem:
[ 0.000000] Unable to handle kernel paging request at virtual address dfff200000000000 [ 0.000000] Mem abort info: [ 0.000000] ESR = 0x96000004 [ 0.000000] Exception class = DABT (current EL), IL = 32 bits [ 0.000000] SET = 0, FnV = 0 [ 0.000000] EA = 0, S1PTW = 0 [ 0.000000] Data abort info: [ 0.000000] ISV = 0, ISS = 0x00000004 [ 0.000000] CM = 0, WnR = 0 [ 0.000000] [dfff200000000000] address between user and kernel address ranges [ 0.000000] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.16.0-07317-gf165b378bbdf #42 [ 0.000000] Hardware name: ARM Juno development board (r1) (DT) [ 0.000000] pstate: 80000085 (Nzcv daIf -PAN -UAO) [ 0.000000] pc : __asan_load8+0x8c/0xa8 [ 0.000000] lr : __dump_page+0x3c/0x3b8 [ 0.000000] sp : ffff2000099b7ca0 [ 0.000000] x29: ffff2000099b7ca0 x28: ffff20000a1762c0 [ 0.000000] x27: ffff7e0000000000 x26: ffff2000099dd000 [ 0.000000] x25: ffff200009a3f960 x24: ffff200008f9c38c [ 0.000000] x23: ffff20000a9d3000 x22: ffff200009735430 [ 0.000000] x21: fffffffffffffffe x20: ffff7e0001e50420 [ 0.000000] x19: ffff7e0001e50400 x18: 0000000000001840 [ 0.000000] x17: ffffffffffff8270 x16: 0000000000001840 [ 0.000000] x15: 0000000000001920 x14: 0000000000000004 [ 0.000000] x13: 0000000000000000 x12: 0000000000000800 [ 0.000000] x11: 1ffff0012d0f89ff x10: ffff10012d0f89ff [ 0.000000] x9 : 0000000000000000 x8 : ffff8009687c5000 [ 0.000000] x7 : 0000000000000000 x6 : ffff10000f282000 [ 0.000000] x5 : 0000000000000040 x4 : fffffffffffffffe [ 0.000000] x3 : 0000000000000000 x2 : dfff200000000000 [ 0.000000] x1 : 0000000000000005 x0 : 0000000000000000 [ 0.000000] Process swapper (pid: 0, stack limit = 0x (ptrval)) [ 0.000000] Call trace: [ 0.000000] __asan_load8+0x8c/0xa8 [ 0.000000] __dump_page+0x3c/0x3b8 [ 0.000000] dump_page+0xc/0x18 [ 0.000000] kasan_init+0x2e8/0x5a8 [ 0.000000] setup_arch+0x294/0x71c [ 0.000000] start_kernel+0xdc/0x500 [ 0.000000] Code: aa0403e0 9400063c 17ffffee d343fc00 (38e26800) [ 0.000000] ---[ end trace 67064f0e9c0cc338 ]--- [ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
Let's fix this by using early_pfn_to_nid(), as other architectures do in their kasan init code. Note that early_pfn_to_nid acquires the nid from the memblock array, which we iterate over in kasan_init(), so this should be fine.
--- arch/arm64/mm/kasan_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/mm/kasan_init.c +2 -2
@@ -204,7 +204,7 @@ void __init kasan_init(void)clear_pgds (KASAN_SHADOW_START ,KASAN_SHADOW_END );kasan_map_populate (kimg_shadow_start, kimg_shadow_end, -pfn_to_nid (virt_to_pfn (lm_alias (_text)))); +early_pfn_to_nid (virt_to_pfn (lm_alias (_text))));kasan_populate_zero_shadow ((void *)KASAN_SHADOW_START , (void *)mod_shadow_start);
@@ -224,7 +224,7 @@ void __init kasan_init(void)kasan_map_populate ((unsigned long )kasan_mem_to_shadow (start), (unsigned long )kasan_mem_to_shadow (end), -pfn_to_nid (virt_to_pfn (start))); +early_pfn_to_nid (virt_to_pfn (start))); }/*
Greg Kroah-Hartman
maintainerPATCH 39/279 ASoC: topology: Check widget kcontrols before deref.
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam Girdwood <[email protected]>
[ Upstream commit 05bdcf12905533b8628627b6634608cd3b57c607 ]
Validate the topology input before we dereference the pointer.
--- sound/soc/soc-topology.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/soc-topology.c +2 -2
@@ -510,7 +510,7 @@ static void remove_widget(struct snd_soc*/ if (dobj->widget.kcontrol_type ==SND_SOC_TPLG_TYPE_ENUM ) {/* enumerated widget mixer */ -for (i =0 ; i < w->num_kcontrols; i++) { +for (i =0 ; w->kcontrols !=NULL && i < w->num_kcontrols; i++) {struct snd_kcontrol *kcontrol = w->kcontrols[i];struct soc_enum *se = (struct soc_enum *)kcontrol->private_value;
@@ -528,7 +528,7 @@ static void remove_widget(struct snd_sockfree (w->kcontrol_news); }else {/* volume mixer or bytes controls */ -for (i =0 ; i < w->num_kcontrols; i++) { +for (i =0 ; w->kcontrols !=NULL && i < w->num_kcontrols; i++) {struct snd_kcontrol *kcontrol = w->kcontrols[i]; if (dobj->widget.kcontrol_type
Greg Kroah-Hartman
maintainerPATCH 40/279 spi: cadence: Add usleep_range() for cdns_spi_fill_tx_fifo()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: sxauwsk <[email protected]>
[ Upstream commit 49530e6411789c1b9ea3ebc58e520c19d1c3752f ]
In case of xspi work in busy condition, may send bytes failed. once something wrong, spi controller did't work any more
My test found this situation appear in both of read/write process. so when TX FIFO is full, add one byte delay before send data;
--- drivers/spi/spi-cadence.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/spi/spi-cadence.c +8 -0
@@ -313,6 +313,14 @@ static void cdns_spi_fill_tx_fifo(structwhile ((trans_cnt <CDNS_SPI_FIFO_DEPTH ) && (xspi->tx_bytes >0 )) { + +/* When xspi in busy condition, bytes may send failed, +* then spi control did't work thoroughly, add one byte delay +*/ +if (cdns_spi_read (xspi,CDNS_SPI_ISR ) & +CDNS_SPI_IXR_TXFULL ) +usleep_range (10 ,20 ); +if (xspi->txbuf)cdns_spi_write (xspi,CDNS_SPI_TXD , *xspi->txbuf++);else
Greg Kroah-Hartman
maintainerPATCH 41/279 blkcg: dont hold blkcg lock when deactivating policy
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Biao <[email protected]>
[ Upstream commit 946b81da114b8ba5c74bb01e57c0c6eca2bdc801 ]
As described in the comment of blkcg_activate_policy(), *Update of each blkg is protected by both queue and blkcg locks so that holding either lock and testing blkcg_policy_enabled() is always enough for dereferencing policy data.*
with queue lock held, there is no need to hold blkcg lock in blkcg_deactivate_policy(). Similar case is in blkcg_activate_policy(), which has removed holding of blkcg lock in commit 4c55f4f9ad3001ac1fefdd8d8ca7641d18558e23.
--- block/blk-cgroup.c | 5 ----- 1 file changed, 5 deletions(-)
block/blk-cgroup.c +0 -5
@@ -1367,17 +1367,12 @@ void blkcg_deactivate_policy(struct requ__clear_bit (pol->plid, q->blkcg_pols);list_for_each_entry (blkg, &q->blkg_list, q_node) { -/* grab blkcg lock too while removing @pd from @blkg */ -spin_lock (&blkg->blkcg->lock); -if (blkg->pd[pol->plid]) {if (pol->pd_offline_fn) pol->pd_offline_fn (blkg->pd[pol->plid]); pol->pd_free_fn (blkg->pd[pol->plid]); blkg->pd[pol->plid] =NULL ; } - -spin_unlock (&blkg->blkcg->lock); }spin_unlock_irq (q->queue_lock);
Greg Kroah-Hartman
maintainerPATCH 42/279 ARM64: dts: meson-gxl: add USB host support
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit 8aec5fc1d4d881fe446addb94309efb39d4e5b23 ]
This adds USB host support to the Meson GXL SoC. A dwc3 controller is used for host-mode, while a dwc2 controller (not added in this patch because I could not get it working) is used for device-mode only.
The dwc3 controller's internal roothub has two USB2 ports enabled but no USB3 port. Each of the ports is supplied by a separate PHY. The USB pins are connected to the SoC's USBHOST_A and USBOTG_B pins.
Due to the way the roothub works internally the USB PHYs are left enabled. When the dwc3 controller is disabled the PHY is never powered on so it does not draw any extra power. However, when the dwc3 host controller is enabled then all PHYs also have to be enabled, otherwise USB devices will not be detected (regardless of whether they are plugged into an enabled port or not). This means that only the dwc3 controller has to be enabled on boards with USB support (instead of requiring all boards to enable the PHYs additionally with the chance of forgetting to enable one and breaking all other ports with that as well).
This also adds the USB3 PHY which currently only does some basic initialization. That however is required because without it high-speed devices (like USB thumb drives) do not work on some devices (probably because the bootloader does not configure the USB3 PHY registers).
--- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 61 +++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +61 -0
@@ -57,6 +57,67 @@ no-map; }; }; + + soc { + usb0: usb@c9000000 { + status = "disabled"; + compatible = "amlogic,meson-gxl-dwc3"; + #address-cells = <2>; + #size-cells = <2>; + ranges; + + clocks = <&clkc CLKID_USB>; + clock-names = "usb_general"; + resets = <&reset RESET_USB_OTG>; + reset-names = "usb_otg"; + + dwc3: dwc3@c9000000 { + compatible = "snps,dwc3"; + reg = <0x0 0xc9000000 0x0 0x100000>; + interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>; + dr_mode = "host"; + maximum-speed = "high-speed"; + snps,dis_u2_susphy_quirk; + phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>; + }; + }; + }; +}; + +&apb { + usb2_phy0: phy@78000 { + compatible = "amlogic,meson-gxl-usb2-phy"; + #phy-cells = <0>; + reg = <0x0 0x78000 0x0 0x20>; + clocks = <&clkc CLKID_USB>; + clock-names = "phy"; + resets = <&reset RESET_USB_OTG>; + reset-names = "phy"; + status = "okay"; + }; + + usb2_phy1: phy@78020 { + compatible = "amlogic,meson-gxl-usb2-phy"; + #phy-cells = <0>; + reg = <0x0 0x78020 0x0 0x20>; + clocks = <&clkc CLKID_USB>; + clock-names = "phy"; + resets = <&reset RESET_USB_OTG>; + reset-names = "phy"; + status = "okay"; + }; + + usb3_phy: phy@78080 { + compatible = "amlogic,meson-gxl-usb3-phy"; + #phy-cells = <0>; + reg = <0x0 0x78080 0x0 0x20>; + interrupts = <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clkc CLKID_USB>, <&clkc_AO CLKID_AO_CEC_32K>; + clock-names = "phy", "peripheral"; + resets = <&reset RESET_USB_OTG>, <&reset RESET_USB_OTG>; + reset-names = "phy", "peripheral"; + status = "okay"; + }; }; ðmac {
Greg Kroah-Hartman
maintainerPATCH 43/279 ARM64: dts: meson-gxm: add GXM specific USB host configuration
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit 458baa95c86406c81c6ebac0a98d1689075a3ec4 ]
The USB configuration on GXM is slightly different than on GXL. The dwc3 controller's internal hub has three USB2 ports (instead of 2 on GXL) along with a dedicated USB2 PHY for this port. However, it seems that there are no pins on GXM which would allow connecting the third port to a physical USB port.
Passing the third PHY is required though, because without it none of the other USB ports is working (this seems to be a limitation of how the internal USB hub works, if one PHY is disabled then no USB port works).
--- arch/arm64/boot/dts/amlogic/meson-gxm.dtsi | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gxm.dtsi +17 -0
@@ -117,6 +117,19 @@ }; }; +&apb { + usb2_phy2: phy@78040 { + compatible = "amlogic,meson-gxl-usb2-phy"; + #phy-cells = <0>; + reg = <0x0 0x78040 0x0 0x20>; + clocks = <&clkc CLKID_USB>; + clock-names = "phy"; + resets = <&reset RESET_USB_OTG>; + reset-names = "phy"; + status = "okay"; + }; +}; + &clkc_AO { compatible = "amlogic,meson-gxm-aoclkc", "amlogic,meson-gx-aoclkc"; };
@@ -137,3 +150,7 @@ &hdmi_tx { compatible = "amlogic,meson-gxm-dw-hdmi", "amlogic,meson-gx-dw-hdmi"; }; + +&dwc3 { + phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>, <&usb2_phy2>; +};
Greg Kroah-Hartman
maintainerPATCH 44/279 ARM64: dts: meson-gxl-s905x-p212: enable the USB controller
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit b9f07cb4f41fccbe7616482015d28e6e26aec3a3 ]
All boards based on the P212 reference design (the P212 reference board itself and the Khadas VIM) have USB connectors (in case of the Khadas VIM the first port is exposed through the USB Type-C connector, the second port is connected to a 4-port USB hub).
This enables the USB controller on these boards to make the USB ports actually usable.
--- arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi +4 -0
@@ -185,3 +185,7 @@ pinctrl-0 = <&uart_ao_a_pins>; pinctrl-names = "default"; }; + +&usb0 { + status = "okay"; +};
Greg Kroah-Hartman
maintainerPATCH 45/279 ARM64: dts: meson-gx-p23x-q20x: enable the USB controller
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit 972cd12a027256061c19c164021f2a771e860438 ]
All S905D (GXL) and S912 (GXM) reference boards (namely these are P230, P231, Q200 and Q201) provide USB connectors.
This enables the USB controller on these boards to make the USB ports actually usable.
--- arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi +4 -0
@@ -248,3 +248,7 @@ pinctrl-0 = <&uart_ao_a_pins>; pinctrl-names = "default"; }; + +&usb0 { + status = "okay"; +};
Greg Kroah-Hartman
maintainerPATCH 46/279 ARM64: dts: meson-gxl-s905x-libretech-cc: enable the USB controller
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit b83687f359d9b4128073f06ab7a06489eb04aa7c ]
The LibreTech CC ("Le Potato") board provides four USB connectors. These are provided by a hub which is connected to the SoC's USB controller.
Enable the SoC's USB controller to make the USB ports usable. Also turn on the HDMI_5V regulator when powering on the PHY because (even though it's not shown in the schematics) HDMI_5V also supplies the USB VBUS.
--- arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 12 +++++++++++ 1 file changed, 12 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +12 -0
@@ -271,3 +271,15 @@ pinctrl-0 = <&uart_ao_a_pins>; pinctrl-names = "default"; }; + +&usb0 { + status = "okay"; +}; + +&usb2_phy0 { + /* + * even though the schematics don't show it: + * HDMI_5V is also used as supply for the USB VBUS. + */ + phy-supply = <&hdmi_5v>; +};
Greg Kroah-Hartman
maintainerPATCH 47/279 ARM64: dts: meson-gxl-nexbox-a95x: enable the USB controller
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit 55ef32249bb647c6b64adcf943918d302a0020a7 ]
The Nexbox A95X provides two USB ports. Enable the SoC's USB controller on this board to make these USB ports usable.
--- arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts +4 -0
@@ -251,3 +251,7 @@ pinctrl-0 = <&uart_ao_a_pins>; pinctrl-names = "default"; }; + +&usb0 { + status = "okay"; +};
Greg Kroah-Hartman
maintainerPATCH 48/279 ARM64: dts: meson-gxm-khadas-vim2: enable the USB controller
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit 4b7b0d7b25538d2ad421a1041267d5208d3425bc ]
The Khadas VIM2 board connects the dwc3 controller to an internal 4-port USB hub which. Two of these ports are accessible directly soldered to the board, while the other two are accessible through the 40-pin "GPIO" header.
--- arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +4 -0
@@ -413,3 +413,7 @@ status = "okay"; vref-supply = <&vddio_ao18>; }; + +&usb0 { + status = "okay"; +};
Greg Kroah-Hartman
maintainerPATCH 49/279 tipc: fix infinite loop when dumping link monitor summary
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tung Nguyen <[email protected]>
[ Upstream commit 36a50a989ee8267588de520b8704b85f045a3220 ]
When configuring the number of used bearers to MAX_BEARER and issuing command "tipc link monitor summary", the command enters infinite loop in user space.
This issue happens because function tipc_nl_node_dump_monitor() returns the wrong 'prev_bearer' value when all potential monitors have been scanned.
The correct behavior is to always try to scan all monitors until either the netlink message is full, in which case we return the bearer identity of the affected monitor, or we continue through the whole bearer array until we can return MAX_BEARERS. This solution also caters for the case where there may be gaps in the bearer array.
--- net/tipc/monitor.c | 2 +- net/tipc/node.c | 11 ++++------- 2 files changed, 5 insertions(+), 8 deletions(-)
net/tipc/monitor.c +1 -1
@@ -777,7 +777,7 @@ int __tipc_nl_add_monitor(struct net *ne ret =tipc_bearer_get_name (net, bearer_name, bearer_id);if (ret || !mon) -return -EINVAL ; +return 0 ; hdr =genlmsg_put (msg->skb, msg->portid, msg->seq, &tipc_genl_family,NLM_F_MULTI ,TIPC_NL_MON_GET );
net/tipc/node.c +4 -7
@@ -2145,8 +2145,8 @@ int tipc_nl_node_dump_monitor(struct sk_struct net *net =sock_net (skb->sk);u32 prev_bearer = cb->args[0 ];struct tipc_nl_msg msg; +int bearer_id;int err; -int i;if (prev_bearer ==MAX_BEARERS )return 0 ;
@@ -2156,16 +2156,13 @@ int tipc_nl_node_dump_monitor(struct sk_ msg.seq = cb->nlh->nlmsg_seq;rtnl_lock (); -for (i = prev_bearer; i <MAX_BEARERS ; i++) { - prev_bearer = i; +for (bearer_id = prev_bearer; bearer_id <MAX_BEARERS ; bearer_id++) { err =__tipc_nl_add_monitor (net, &msg, prev_bearer);if (err) - goto out; +break ; } - -out:rtnl_unlock (); - cb->args[0 ] = prev_bearer; + cb->args[0 ] = bearer_id;return skb->len; }
Greg Kroah-Hartman
maintainerPATCH 50/279 arm64: dts: correct SATA addresses for Stingray
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinath Mannam <[email protected]>
[ Upstream commit 4555a5021fe88fc4f19ff53d1e58b410cf30a49a ]
Correct all SATA ahci and phy controller register
addresses and interrupt lines to proper values.
--- arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi | 80 +++++++-------- 1 file changed, 40 insertions(+), 40 deletions(-)
arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi +40 -40
@@ -36,11 +36,11 @@ #size-cells = <1>; ranges = <0x0 0x0 0x67d00000 0x00800000>; - sata0: ahci@210000 { + sata0: ahci@0 { compatible = "brcm,iproc-ahci", "generic-ahci"; - reg = <0x00210000 0x1000>; + reg = <0x00000000 0x1000>; reg-names = "ahci"; - interrupts = <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; status = "disabled";
@@ -52,9 +52,9 @@ }; }; - sata_phy0: sata_phy@212100 { + sata_phy0: sata_phy@2100 { compatible = "brcm,iproc-sr-sata-phy"; - reg = <0x00212100 0x1000>; + reg = <0x00002100 0x1000>; reg-names = "phy"; #address-cells = <1>; #size-cells = <0>;
@@ -66,11 +66,11 @@ }; }; - sata1: ahci@310000 { + sata1: ahci@10000 { compatible = "brcm,iproc-ahci", "generic-ahci"; - reg = <0x00310000 0x1000>; + reg = <0x00010000 0x1000>; reg-names = "ahci"; - interrupts = <GIC_SPI 347 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; status = "disabled";
@@ -82,9 +82,9 @@ }; }; - sata_phy1: sata_phy@312100 { + sata_phy1: sata_phy@12100 { compatible = "brcm,iproc-sr-sata-phy"; - reg = <0x00312100 0x1000>; + reg = <0x00012100 0x1000>; reg-names = "phy"; #address-cells = <1>; #size-cells = <0>;
@@ -96,11 +96,11 @@ }; }; - sata2: ahci@120000 { + sata2: ahci@20000 { compatible = "brcm,iproc-ahci", "generic-ahci"; - reg = <0x00120000 0x1000>; + reg = <0x00020000 0x1000>; reg-names = "ahci"; - interrupts = <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; status = "disabled";
@@ -112,9 +112,9 @@ }; }; - sata_phy2: sata_phy@122100 { + sata_phy2: sata_phy@22100 { compatible = "brcm,iproc-sr-sata-phy"; - reg = <0x00122100 0x1000>; + reg = <0x00022100 0x1000>; reg-names = "phy"; #address-cells = <1>; #size-cells = <0>;
@@ -126,11 +126,11 @@ }; }; - sata3: ahci@130000 { + sata3: ahci@30000 { compatible = "brcm,iproc-ahci", "generic-ahci"; - reg = <0x00130000 0x1000>; + reg = <0x00030000 0x1000>; reg-names = "ahci"; - interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; status = "disabled";
@@ -142,9 +142,9 @@ }; }; - sata_phy3: sata_phy@132100 { + sata_phy3: sata_phy@32100 { compatible = "brcm,iproc-sr-sata-phy"; - reg = <0x00132100 0x1000>; + reg = <0x00032100 0x1000>; reg-names = "phy"; #address-cells = <1>; #size-cells = <0>;
@@ -156,11 +156,11 @@ }; }; - sata4: ahci@330000 { + sata4: ahci@100000 { compatible = "brcm,iproc-ahci", "generic-ahci"; - reg = <0x00330000 0x1000>; + reg = <0x00100000 0x1000>; reg-names = "ahci"; - interrupts = <GIC_SPI 351 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; status = "disabled";
@@ -172,9 +172,9 @@ }; }; - sata_phy4: sata_phy@332100 { + sata_phy4: sata_phy@102100 { compatible = "brcm,iproc-sr-sata-phy"; - reg = <0x00332100 0x1000>; + reg = <0x00102100 0x1000>; reg-names = "phy"; #address-cells = <1>; #size-cells = <0>;
@@ -186,11 +186,11 @@ }; }; - sata5: ahci@400000 { + sata5: ahci@110000 { compatible = "brcm,iproc-ahci", "generic-ahci"; - reg = <0x00400000 0x1000>; + reg = <0x00110000 0x1000>; reg-names = "ahci"; - interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; status = "disabled";
@@ -202,9 +202,9 @@ }; }; - sata_phy5: sata_phy@402100 { + sata_phy5: sata_phy@112100 { compatible = "brcm,iproc-sr-sata-phy"; - reg = <0x00402100 0x1000>; + reg = <0x00112100 0x1000>; reg-names = "phy"; #address-cells = <1>; #size-cells = <0>;
@@ -216,11 +216,11 @@ }; }; - sata6: ahci@410000 { + sata6: ahci@120000 { compatible = "brcm,iproc-ahci", "generic-ahci"; - reg = <0x00410000 0x1000>; + reg = <0x00120000 0x1000>; reg-names = "ahci"; - interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; status = "disabled";
@@ -232,9 +232,9 @@ }; }; - sata_phy6: sata_phy@412100 { + sata_phy6: sata_phy@122100 { compatible = "brcm,iproc-sr-sata-phy"; - reg = <0x00412100 0x1000>; + reg = <0x00122100 0x1000>; reg-names = "phy"; #address-cells = <1>; #size-cells = <0>;
@@ -246,11 +246,11 @@ }; }; - sata7: ahci@420000 { + sata7: ahci@130000 { compatible = "brcm,iproc-ahci", "generic-ahci"; - reg = <0x00420000 0x1000>; + reg = <0x00130000 0x1000>; reg-names = "ahci"; - interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; status = "disabled";
@@ -262,9 +262,9 @@ }; }; - sata_phy7: sata_phy@422100 { + sata_phy7: sata_phy@132100 { compatible = "brcm,iproc-sr-sata-phy"; - reg = <0x00422100 0x1000>; + reg = <0x00132100 0x1000>; reg-names = "phy"; #address-cells = <1>; #size-cells = <0>;
Greg Kroah-Hartman
maintainerPATCH 51/279 scsi: iscsi: respond to netlink with unicast when appropriate
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Leech <[email protected]>
[ Upstream commit af17092810a887178195276255b7b31f8fbe7dbe ]
Instead of always multicasting responses, send a unicast netlink message directed at the correct pid. This will be needed if we ever want to support multiple userspace processes interacting with the kernel over iSCSI netlink simultaneously. Limitations can currently be seen if you attempt to run multiple iscsistart commands in parallel.
We've fixed up the userspace issues in iscsistart that prevented multiple instances from running, so now attempts to speed up booting by bringing up multiple iscsi sessions at once in the initramfs are just running into misrouted responses that this fixes.
--- drivers/scsi/scsi_transport_iscsi.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
drivers/scsi/scsi_transport_iscsi.c +18 -11
@@ -2322,6 +2322,12 @@ iscsi_multicast_skb(struct sk_buff *skb,return nlmsg_multicast (nls, skb,0 , group, gfp); } +static int +iscsi_unicast_skb (struct sk_buff *skb,u32 portid) +{ +return nlmsg_unicast (nls, skb, portid); +} +int iscsi_recv_pdu (struct iscsi_cls_conn *conn,struct iscsi_hdr *hdr,char *data,uint32_t data_size) {
@@ -2524,14 +2530,11 @@ void iscsi_ping_comp_event(uint32_t hostEXPORT_SYMBOL_GPL (iscsi_ping_comp_event);static int -iscsi_if_send_reply (uint32_t group,int seq,int type,int done,int multi, -void *payload,int size) +iscsi_if_send_reply (u32 portid,int type,void *payload,int size) {struct sk_buff *skb;struct nlmsghdr *nlh;int len =nlmsg_total_size (size); -int flags = multi ?NLM_F_MULTI :0 ; -int t = done ?NLMSG_DONE : type; skb =alloc_skb (len,GFP_ATOMIC );if (!skb) {
@@ -2539,10 +2542,9 @@ iscsi_if_send_reply(uint32_t group, intreturn -ENOMEM ; } - nlh =__nlmsg_put (skb,0 ,0 , t, (len -sizeof (*nlh)),0 ); - nlh->nlmsg_flags = flags; + nlh =__nlmsg_put (skb,0 ,0 , type, (len -sizeof (*nlh)),0 );memcpy (nlmsg_data (nlh), payload, size); -return iscsi_multicast_skb (skb, group,GFP_ATOMIC ); +return iscsi_unicast_skb (skb, portid); } static int
@@ -3470,6 +3472,7 @@ static int iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) { int err = 0; +u32 portid;struct iscsi_uevent *ev =nlmsg_data (nlh);struct iscsi_transport *transport =NULL ;struct iscsi_internal *priv;
@@ -3490,10 +3493,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, sif (!try_module_get (transport->owner))return -EINVAL ; + portid =NETLINK_CB (skb).portid; +switch (nlh->nlmsg_type) {case ISCSI_UEVENT_CREATE_SESSION : err =iscsi_if_create_session (priv, ep, ev, -NETLINK_CB (skb).portid, + portid, ev->u.c_session.initial_cmdsn, ev->u.c_session.cmds_max, ev->u.c_session.queue_depth);
@@ -3506,7 +3511,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, s } err =iscsi_if_create_session (priv, ep, ev, -NETLINK_CB (skb).portid, + portid, ev->u.c_bound_session.initial_cmdsn, ev->u.c_bound_session.cmds_max, ev->u.c_bound_session.queue_depth);
@@ -3664,6 +3669,8 @@ iscsi_if_recv_msg(struct sk_buff *skb, sstatic void iscsi_if_rx (struct sk_buff *skb) { +u32 portid =NETLINK_CB (skb).portid; +mutex_lock (&rx_queue_mutex);while (skb->len >=NLMSG_HDRLEN ) {int err;
@@ -3699,8 +3706,8 @@ iscsi_if_rx(struct sk_buff *skb)break ;if (ev->type ==ISCSI_UEVENT_GET_CHAP && !err)break ; - err =iscsi_if_send_reply (group, nlh->nlmsg_seq, - nlh->nlmsg_type,0 ,0 , ev,sizeof (*ev)); + err =iscsi_if_send_reply (portid, nlh->nlmsg_type, + ev,sizeof (*ev)); }while (err <0 && err != -ECONNREFUSED && err != -ESRCH );skb_pull (skb, rlen); }
Greg Kroah-Hartman
maintainerPATCH 52/279 scsi: megaraid_sas: Do not log an error if FW successfully initializes.
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinson Lee <[email protected]>
[ Upstream commit fb1633d56b0025233ed3dc49b44544748d509d9d ]
--- drivers/scsi/megaraid/megaraid_sas_fusion.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/megaraid/megaraid_sas_fusion.c +3 -3
@@ -1124,12 +1124,12 @@ megasas_ioc_init_fusion(struct megasas_i goto fail_fw_init; } - ret =0 ; +return 0 ; fail_fw_init:dev_err (&instance->pdev->dev, -"Init cmd return status %s for SCSI host %d\n" , - ret ?"FAILED" :"SUCCESS" , instance->host->host_no); +"Init cmd return status FAILED for SCSI host %d\n" , + instance->host->host_no);return ret; }
Greg Kroah-Hartman
maintainerPATCH 53/279 scsi: target: fix crash with iscsi target and dvd
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit 8e1ceafe50ec4d1bcfae154dd70e7cb6946a6177 ]
When the current page can't be added to bio, one new bio should be created for adding this page again, instead of ignoring this page.
This patch fixes kernel crash with iscsi target and dvd, as reported by Wakko.
--- drivers/target/target_core_pscsi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/target/target_core_pscsi.c +2 -0
@@ -890,6 +890,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct bytes =min (bytes, data_len);if (!bio) { +new_bio: nr_vecs =min_t (int,BIO_MAX_PAGES , nr_pages); nr_pages -= nr_vecs;/*
@@ -931,6 +932,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct* be allocated with pscsi_get_bio() above. */ bio =NULL ; + goto new_bio; } data_len -= bytes;
Greg Kroah-Hartman
maintainerPATCH 54/279 netfilter: nf_tables: NAT chain and extensions require NF_TABLES
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 39f2ff0816e5421476c2bc538b68b4bb0708a78e ]
Move these options inside the scope of the 'if' NF_TABLES and NF_TABLES_IPV6 dependencies. This patch fixes:
net/ipv6/netfilter/nft_chain_nat_ipv6.o: In function `nft_nat_do_chain':
Quoted 1 line
Quoted 1 line
net/ipv6/netfilter/nft_chain_nat_ipv6.c:37: undefined reference to `nft_do_chain'
net/ipv6/netfilter/nft_chain_nat_ipv6.o: In function `nft_chain_nat_ipv6_exit':
Quoted 1 line
Quoted 1 line
net/ipv6/netfilter/nft_chain_nat_ipv6.c:94: undefined reference to `nft_unregister_chain_type'
net/ipv6/netfilter/nft_chain_nat_ipv6.o: In function `nft_chain_nat_ipv6_init':
Quoted 1 line
Quoted 1 line
net/ipv6/netfilter/nft_chain_nat_ipv6.c:87: undefined reference to `nft_register_chain_type'
that happens with:
CONFIG_NF_TABLES=mCONFIG_NFT_CHAIN_NAT_IPV6=y
--- net/ipv6/netfilter/Kconfig | 55 ++++++++++++++++++++++----------------------- 1 file changed, 28 insertions(+), 27 deletions(-)
net/ipv6/netfilter/Kconfig +28 -27
@@ -48,6 +48,34 @@ config NFT_CHAIN_ROUTE_IPV6 fields such as the source, destination, flowlabel, hop-limit and the packet mark. +if NF_NAT_IPV6 + +config NFT_CHAIN_NAT_IPV6 + tristate "IPv6 nf_tables nat chain support" + help + This option enables the "nat" chain for IPv6 in nf_tables. This + chain type is used to perform Network Address Translation (NAT) + packet transformations such as the source, destination address and + source and destination ports. + +config NFT_MASQ_IPV6 + tristate "IPv6 masquerade support for nf_tables" + depends on NFT_MASQ + select NF_NAT_MASQUERADE_IPV6 + help + This is the expression that provides IPv4 masquerading support for + nf_tables. + +config NFT_REDIR_IPV6 + tristate "IPv6 redirect support for nf_tables" + depends on NFT_REDIR + select NF_NAT_REDIRECT + help + This is the expression that provides IPv4 redirect support for + nf_tables. + +endif # NF_NAT_IPV6 + config NFT_REJECT_IPV6 select NF_REJECT_IPV6 default NFT_REJECT
@@ -107,39 +135,12 @@ config NF_NAT_IPV6 if NF_NAT_IPV6 -config NFT_CHAIN_NAT_IPV6 - depends on NF_TABLES_IPV6 - tristate "IPv6 nf_tables nat chain support" - help - This option enables the "nat" chain for IPv6 in nf_tables. This - chain type is used to perform Network Address Translation (NAT) - packet transformations such as the source, destination address and - source and destination ports. - config NF_NAT_MASQUERADE_IPV6 tristate "IPv6 masquerade support" help This is the kernel functionality to provide NAT in the masquerade flavour (automatic source address selection) for IPv6. -config NFT_MASQ_IPV6 - tristate "IPv6 masquerade support for nf_tables" - depends on NF_TABLES_IPV6 - depends on NFT_MASQ - select NF_NAT_MASQUERADE_IPV6 - help - This is the expression that provides IPv4 masquerading support for - nf_tables. - -config NFT_REDIR_IPV6 - tristate "IPv6 redirect support for nf_tables" - depends on NF_TABLES_IPV6 - depends on NFT_REDIR - select NF_NAT_REDIRECT - help - This is the expression that provides IPv4 redirect support for - nf_tables. - endif # NF_NAT_IPV6 config IP6_NF_IPTABLES
Greg Kroah-Hartman
maintainerPATCH 55/279 netfilter: nf_tables: fix out-of-bounds in nft_chain_commit_update
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit d71efb599ad42ef1e564c652d8084252bdc85edf ]
When chain name is changed, nft_chain_commit_update is called. In the nft_chain_commit_update, trans->ctx.chain->name has old chain name and nft_trans_chain_name(trans) has new chain name.
If new chain name is longer than old chain name, KASAN warns slab-out-of-bounds.
[ 175.015012] BUG: KASAN: slab-out-of-bounds in strcpy+0x9e/0xb0 [ 175.022735] Write of size 1 at addr ffff880114e022da by task iptables-compat/1458
[ 175.031353] CPU: 0 PID: 1458 Comm: iptables-compat Not tainted 4.16.0-rc7+ #146 [ 175.031353] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 07/08/2015 [ 175.031353] Call Trace: [ 175.031353] dump_stack+0x68/0xa0 [ 175.031353] print_address_description+0xd0/0x260 [ 175.031353] ? strcpy+0x9e/0xb0 [ 175.031353] kasan_report+0x234/0x350 [ 175.031353] __asan_report_store1_noabort+0x1c/0x20 [ 175.031353] strcpy+0x9e/0xb0 [ 175.031353] nf_tables_commit+0x1ccc/0x2990 [ 175.031353] nfnetlink_rcv+0x141e/0x16c0 [ 175.031353] ? nfnetlink_net_init+0x150/0x150 [ 175.031353] ? lock_acquire+0x370/0x370 [ 175.031353] ? lock_acquire+0x370/0x370 [ 175.031353] netlink_unicast+0x444/0x640 [ 175.031353] ? netlink_attachskb+0x700/0x700 [ 175.031353] ? _copy_from_iter_full+0x180/0x740 [ 175.031353] ? kasan_check_write+0x14/0x20 [ 175.031353] ? _copy_from_user+0x9b/0xd0 [ 175.031353] netlink_sendmsg+0x845/0xc70
[ ... ]
Steps to reproduce:
iptables-compat -N 1
iptables-compat -E 1 aaaaaaaaa
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -5741,7 +5741,7 @@ static void nft_chain_commit_update(strustruct nft_base_chain *basechain;if (nft_trans_chain_name (trans)) -strcpy (trans->ctx.chain->name,nft_trans_chain_name (trans)); +swap (trans->ctx.chain->name,nft_trans_chain_name (trans));if (!nft_is_base_chain (trans->ctx.chain))return ;
Greg Kroah-Hartman
maintainerPATCH 56/279 ASoC: msm8916-wcd-analog: use threaded context for mbhc events
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
[ Upstream commit a8419a0cd98ddf628a9e38a92110af7cc650dde7 ]
As snd_soc_jack_report() can sleep, move handling of mbhc events to a thread context rather than in interrupt context.
--- sound/soc/codecs/msm8916-wcd-analog.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/codecs/msm8916-wcd-analog.c +6 -3
@@ -1185,7 +1185,8 @@ static int pm8916_wcd_analog_spmi_probe(return irq; } - ret =devm_request_irq (dev, irq, pm8916_mbhc_switch_irq_handler, + ret =devm_request_threaded_irq (dev, irq,NULL , + pm8916_mbhc_switch_irq_handler,IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT ,"mbhc switch irq" , priv);
@@ -1199,7 +1200,8 @@ static int pm8916_wcd_analog_spmi_probe(return irq; } - ret =devm_request_irq (dev, irq, mbhc_btn_press_irq_handler, + ret =devm_request_threaded_irq (dev, irq,NULL , + mbhc_btn_press_irq_handler,IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT ,"mbhc btn press irq" , priv);
@@ -1212,7 +1214,8 @@ static int pm8916_wcd_analog_spmi_probe(return irq; } - ret =devm_request_irq (dev, irq, mbhc_btn_release_irq_handler, + ret =devm_request_threaded_irq (dev, irq,NULL , + mbhc_btn_release_irq_handler,IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT ,"mbhc btn release irq" , priv);
Greg Kroah-Hartman
maintainerPATCH 57/279 drm/msm: Fix possible null dereference on failure of get_pages()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit 3976626ea3d2011f8fd3f3a47070a8b792018253 ]
Commit 62e3a3e342af changed get_pages() to initialise msm_gem_object::pages before trying to initialise msm_gem_object::sgt, so that put_pages() would properly clean up pages in the failure case.
However, this means that put_pages() now needs to check that msm_gem_object::sgt is not null before trying to clean it up, and this check was only applied to part of the cleanup code. Move it all into the conditional block. (Strictly speaking we don't need to make the kfree() conditional, but since we can't avoid checking for null ourselves we may as well do so.)
--- drivers/gpu/drm/msm/msm_gem.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/gpu/drm/msm/msm_gem.c +11 -9
@@ -132,17 +132,19 @@ static void put_pages(struct drm_gem_objstruct msm_gem_object *msm_obj =to_msm_bo (obj);if (msm_obj->pages) { -/* For non-cached buffers, ensure the new pages are clean -* because display controller, GPU, etc. are not coherent: -*/ -if (msm_obj->flags & (MSM_BO_WC |MSM_BO_UNCACHED )) -dma_unmap_sg (obj->dev->dev, msm_obj->sgt->sgl, - msm_obj->sgt->nents,DMA_BIDIRECTIONAL ); +if (msm_obj->sgt) { +/* For non-cached buffers, ensure the new +* pages are clean because display controller, +* GPU, etc. are not coherent: +*/ +if (msm_obj->flags & (MSM_BO_WC |MSM_BO_UNCACHED )) +dma_unmap_sg (obj->dev->dev, msm_obj->sgt->sgl, + msm_obj->sgt->nents, +DMA_BIDIRECTIONAL ); -if (msm_obj->sgt)sg_free_table (msm_obj->sgt); - -kfree (msm_obj->sgt); +kfree (msm_obj->sgt); + }if (use_pages (obj))drm_gem_put_pages (obj, msm_obj->pages, true, false);
Greg Kroah-Hartman
maintainerPATCH 58/279 drm/msm/dsi: use correct enum in dsi_get_cmd_fmt
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <[email protected]>
[ Upstream commit a4af89286f8fc382459308764ea05935dc477cdc ]
The function dsi_get_cmd_fmt returns enum dsi_cmd_dst_format, use the correct enum value also for MIPI_DSI_FMT_RGB666/_PACKED.
This has been discovered using clang:
drivers/gpu/drm/msm/dsi/dsi_host.c:743:35: warning: implicit conversion
from enumeration type 'enum dsi_vid_dst_format' to different enumeration type 'enum dsi_cmd_dst_format' [-Wenum-conversion]
case MIPI_DSI_FMT_RGB666: return VID_DST_FORMAT_RGB666;
~~~~~~ ^~~~~~~~~~~~~~~~~~~~~
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +1 -1
@@ -740,7 +740,7 @@ static inline enum dsi_cmd_dst_format dsswitch (mipi_fmt) {case MIPI_DSI_FMT_RGB888 :return CMD_DST_FORMAT_RGB888 ;case MIPI_DSI_FMT_RGB666_PACKED : -case MIPI_DSI_FMT_RGB666 :return VID_DST_FORMAT_RGB666 ; +case MIPI_DSI_FMT_RGB666 :return CMD_DST_FORMAT_RGB666 ;case MIPI_DSI_FMT_RGB565 :return CMD_DST_FORMAT_RGB565 ;default :return CMD_DST_FORMAT_RGB888 ; }
Greg Kroah-Hartman
maintainerPATCH 59/279 drm/msm: dont deref error pointer in the msm_fbdev_create error path
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Velikov <[email protected]>
[ Upstream commit 789d4c300e10eb2096ee83c3497118e67ccc951e ]
Currently the error pointer returned by msm_alloc_stolen_fb gets passed to drm_framebuffer_remove. The latter handles only NULL pointers, thus a nasty crash will occur.
Drop the unnecessary fail label and the associated checks - both err and fb will be set at this stage.
--- drivers/gpu/drm/msm/msm_fbdev.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/gpu/drm/msm/msm_fbdev.c +2 -9
@@ -92,8 +92,7 @@ static int msm_fbdev_create(struct drm_fif (IS_ERR (fb)) {dev_err (dev->dev,"failed to allocate fb\n" ); - ret =PTR_ERR (fb); - goto fail; +return PTR_ERR (fb); } bo =msm_framebuffer_bo (fb,0 );
@@ -151,13 +150,7 @@ static int msm_fbdev_create(struct drm_f fail_unlock:mutex_unlock (&dev->struct_mutex); -fail: - -if (ret) { -if (fb) -drm_framebuffer_remove (fb); - } - +drm_framebuffer_remove (fb);return ret; }
Greg Kroah-Hartman
maintainerPATCH 60/279 blkcg: init root blkcg_gq under lock
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Biao <[email protected]>
[ Upstream commit 901932a3f9b2b80352896be946c6d577c0a9652c ]
The initializing of q->root_blkg is currently outside of queue lock and rcu, so the blkg may be destroied before the initializing, which may cause dangling/null references. On the other side, the destroys of blkg are protected by queue lock or rcu. Put the initializing inside the queue lock and rcu to make it safer.
--- block/blk-cgroup.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
block/blk-cgroup.c +11 -6
@@ -1142,18 +1142,16 @@ int blkcg_init_queue(struct request_queurcu_read_lock ();spin_lock_irq (q->queue_lock); blkg =blkg_create (&blkcg_root, q, new_blkg); +if (IS_ERR (blkg)) + goto err_unlock; + q->root_blkg = blkg; + q->root_rl.blkg = blkg;spin_unlock_irq (q->queue_lock);rcu_read_unlock ();if (preloaded)radix_tree_preload_end (); -if (IS_ERR (blkg)) -return PTR_ERR (blkg); - - q->root_blkg = blkg; - q->root_rl.blkg = blkg; - ret =blk_throtl_init (q);if (ret) {spin_lock_irq (q->queue_lock);
@@ -1161,6 +1159,13 @@ int blkcg_init_queue(struct request_queuspin_unlock_irq (q->queue_lock); }return ret; + +err_unlock: +spin_unlock_irq (q->queue_lock); +rcu_read_unlock (); +if (preloaded) +radix_tree_preload_end (); +return PTR_ERR (blkg); }/**
Greg Kroah-Hartman
maintainerPATCH 61/279 net: hns: Avoid action name truncation
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: dann frazier <[email protected]>
[ Upstream commit f4ea89110df237da6fbcaab76af431e85f07d904 ]
When longer interface names are used, the action names exposed in /proc/interrupts and /proc/irq/* maybe truncated. For example, when using the predictable name algorithm in systemd on a HiSilicon D05, I see:
ubuntu@d05-3:~$ grep enahisic2i0-tx /proc/interrupts | sed 's/.* //' enahisic2i0-tx0 enahisic2i0-tx1 [...] enahisic2i0-tx8 enahisic2i0-tx9 enahisic2i0-tx1 enahisic2i0-tx1 enahisic2i0-tx1 enahisic2i0-tx1 enahisic2i0-tx1 enahisic2i0-tx1
Increase the max ring name length to allow for an interface name of IFNAMSIZE. After this change, I now see:
$ grep enahisic2i0-tx /proc/interrupts | sed 's/.* //' enahisic2i0-tx0 enahisic2i0-tx1 enahisic2i0-tx2 [...] enahisic2i0-tx8 enahisic2i0-tx9 enahisic2i0-tx10 enahisic2i0-tx11 enahisic2i0-tx12 enahisic2i0-tx13 enahisic2i0-tx14 enahisic2i0-tx15
--- drivers/net/ethernet/hisilicon/hns/hnae.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns/hnae.h +1 -1
@@ -87,7 +87,7 @@ do { \#define HNAE_AE_REGISTER 0x1 -#define RCB_RING_NAME_LEN 16 +#define RCB_RING_NAME_LEN (IFNAMSIZ + 4)#define HNAE_LOWEST_LATENCY_COAL_PARAM 30#define HNAE_LOW_LATENCY_COAL_PARAM 80
Greg Kroah-Hartman
maintainerPATCH 62/279 afs: Fix server record deletion
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 660625922b3d9fcb376e5870299bc5c1086e1d32 ]
AFS server records get removed from the net->fs_servers tree when they're deleted, but not from the net->fs_addresses{4,6} lists, which can lead to an oops in afs_find_server() when a server record has been removed, for instance during rmmod.
Fix this by deleting the record from the by-address lists before posting it for RCU destruction.
The reason this hasn't been noticed before is that the fileserver keeps probing the local cache manager, thereby keeping the service record alive, so the oops would only happen when a fileserver eventually gets bored and stops pinging or if the module gets rmmod'd and a call comes in from the fileserver during the window between the server records being destroyed and the socket being closed.
The oops looks something like:
BUG: unable to handle kernel NULL pointer dereference at 000000000000001c ... Workqueue: kafsd afs_process_async_call [kafs] RIP: 0010:afs_find_server+0x271/0x36f [kafs] ... Call Trace: afs_deliver_cb_init_call_back_state3+0x1f2/0x21f [kafs] afs_deliver_to_call+0x1ee/0x5e8 [kafs] afs_process_async_call+0x5b/0xd0 [kafs] process_one_work+0x2c2/0x504 worker_thread+0x1d4/0x2ac kthread+0x11f/0x127 ret_from_fork+0x24/0x30
--- fs/afs/server.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/afs/server.c +8 -1
@@ -426,8 +426,15 @@ static void afs_gc_servers(struct afs_ne }write_sequnlock (&net->fs_lock); -if (deleted) +if (deleted) { +write_seqlock (&net->fs_addr_lock); +if (!hlist_unhashed (&server->addr4_link)) +hlist_del_rcu (&server->addr4_link); +if (!hlist_unhashed (&server->addr6_link)) +hlist_del_rcu (&server->addr6_link); +write_sequnlock (&net->fs_addr_lock);afs_destroy_server (net, server); + } } }
Greg Kroah-Hartman
maintainerPATCH 63/279 vfs: Undo an overly zealous MS_RDONLY -> SB_RDONLY conversion
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit a9e5b73288cf1595ac2e05cf1acd1924ceea05fa ]
In do_mount() when the MS_* flags are being converted to MNT_* flags, MS_RDONLY got accidentally convered to SB_RDONLY.
Undo this change.
--- fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/namespace.c +1 -1
@@ -2810,7 +2810,7 @@ long do_mount(const char *dev_name, cons mnt_flags |=MNT_NODIRATIME ;if (flags &MS_STRICTATIME ) mnt_flags &= ~(MNT_RELATIME |MNT_NOATIME ); -if (flags &SB_RDONLY ) +if (flags &MS_RDONLY ) mnt_flags |=MNT_READONLY ;/* The default atime for remount is preservation */
Greg Kroah-Hartman
maintainerPATCH 64/279 parisc: time: Convert read_persistent_clock() to read_persistent_clock64()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Wang <[email protected]>
[ Upstream commit f76cdd00ef0e39d880139b074e3b247594dff95a ]
The read_persistent_clock() uses a timespec, which is not year 2038 safe on 32bit systems. On parisc architecture, we have implemented generic RTC drivers that can be used to compensate the system suspend time, but the RTC time can not represent the nanosecond resolution, so this patch just converts to read_persistent_clock64() with timespec64.
--- arch/parisc/kernel/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/parisc/kernel/time.c +1 -1
@@ -205,7 +205,7 @@ static int __init rtc_init(void)device_initcall (rtc_init);#endif -void read_persistent_clock (struct timespec *ts) +void read_persistent_clock64 (struct timespec64 *ts) {static struct pdc_tod tod_data;if (pdc_tod_read (&tod_data) ==0 ) {
Greg Kroah-Hartman
maintainerPATCH 65/279 scsi: storvsc: Set up correct queue depth values for IDE devices
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit f286299c1d0ba5e2ca0377610307b370fe178767 ]
Unlike SCSI and FC, we don't use multiple channels for IDE. Also fix the calculation for sub-channels.
--- drivers/scsi/storvsc_drv.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/scsi/storvsc_drv.c +5 -2
@@ -1722,11 +1722,14 @@ static int storvsc_probe(struct hv_devic max_targets =STORVSC_MAX_TARGETS ; max_channels =STORVSC_MAX_CHANNELS ;/* -* On Windows8 and above, we support sub-channels for storage. +* On Windows8 and above, we support sub-channels for storage +* on SCSI and FC controllers. * The number of sub-channels offerred is based on the number of * VCPUs in the guest. */ - max_sub_channels = (num_cpus / storvsc_vcpus_per_sub_channel); +if (!dev_is_ide) + max_sub_channels = + (num_cpus -1 ) / storvsc_vcpus_per_sub_channel; } scsi_driver.can_queue = (max_outstanding_req_per_channel *
Greg Kroah-Hartman
maintainerPATCH 66/279 scsi: isci: Fix infinite loop in while loop
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 4bc83b3f272fe8f36450f9c003df49cf07ffe5fd ]
In the case when the phy_mask is bitwise anded with the phy_index bit is zero the continue statement currently jumps to the next iteration of the while loop and phy_index is never actually incremented, potentially causing an infinite loop if phy_index is less than SCI_MAX_PHS. Fix this by turning the while loop into a for loop.
--- drivers/scsi/isci/port_config.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/isci/port_config.c +1 -2
@@ -291,7 +291,7 @@ sci_mpc_agent_validate_phy_configuration* Note: We have not moved the current phy_index so we will actually * compare the startting phy with itself. * This is expected and required to add the phy to the port. */ -while (phy_index <SCI_MAX_PHYS ) { +for (; phy_index <SCI_MAX_PHYS ; phy_index++) {if ((phy_mask & (1 << phy_index)) ==0 )continue ; sci_phy_get_sas_address(&ihost->phys[phy_index],
@@ -311,7 +311,6 @@ sci_mpc_agent_validate_phy_configuration &ihost->phys[phy_index]); assigned_phy_mask |= (1 << phy_index); - phy_index++; } }
Greg Kroah-Hartman
maintainerPATCH 67/279 mm, pagemap: fix swap offset value for PMD migration entry
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Ying <[email protected]>
[ Upstream commit 88c28f2469151b031f8cea9b28ed5be1b74a4172 ]
The swap offset reported by /proc/<pid>/pagemap may be not correct for PMD migration entries. If addr passed into pagemap_pmd_range() isn't aligned with PMD start address, the swap offset reported doesn't reflect this. And in the loop to report information of each sub-page, the swap offset isn't increased accordingly as that for PFN.
This may happen after opening /proc/<pid>/pagemap and seeking to a page whose address doesn't align with a PMD start address. I have verified this with a simple test program.
BTW: migration swap entries have PFN information, do we need to restrict whether to show them?
--- fs/proc/task_mmu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/proc/task_mmu.c +5 -1
@@ -1329,9 +1329,11 @@ static int pagemap_pmd_range(pmd_t *pmdp#ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION else if (is_swap_pmd(pmd)) {swp_entry_t entry =pmd_to_swp_entry (pmd); +unsigned long offset =swp_offset (entry); + offset += (addr & ~PMD_MASK ) >>PAGE_SHIFT ; frame =swp_type (entry) | - (swp_offset (entry) <<MAX_SWAPFILES_SHIFT ); + (offset <<MAX_SWAPFILES_SHIFT ); flags |=PM_SWAP ;if (pmd_swp_soft_dirty (pmd)) flags |=PM_SOFT_DIRTY ;
@@ -1351,6 +1353,8 @@ static int pagemap_pmd_range(pmd_t *pmdpbreak ;if (pm->show_pfn && (flags &PM_PRESENT )) frame++; +else if (flags &PM_SWAP ) + frame += (1 <<MAX_SWAPFILES_SHIFT ); }spin_unlock (ptl);return err;
Greg Kroah-Hartman
maintainerPATCH 68/279 proc: revalidate kernel thread inodes to root:root
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Dobriyan <[email protected]>
[ Upstream commit 2e0ad552f5f8cd0fda02bc45fcd2b89821c62fd1 ]
task_dump_owner() has the following code:
mm = task->mm;
if (mm) {
if (get_dumpable(mm) != SUID_DUMP_USER) {
uid = ...
}
}Check for ->mm is buggy -- kernel thread might be borrowing mm and inode will go to some random uid:gid pair.
--- fs/proc/base.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/proc/base.c +6 -0
@@ -1693,6 +1693,12 @@ void task_dump_owner(struct task_structkuid_t uid;kgid_t gid; +if (unlikely (task->flags &PF_KTHREAD )) { + *ruid =GLOBAL_ROOT_UID ; + *rgid =GLOBAL_ROOT_GID ; +return ; + } +/* Default to the tasks effective ownership */ rcu_read_lock (); cred =__task_cred (task);
Greg Kroah-Hartman
maintainerPATCH 69/279 proc: fix /proc/loadavg regression
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Dobriyan <[email protected]>
[ Upstream commit 9a1015b32faa7cebfe19663c886b0cfe90be1d49 ]
Commit 95846ecf9dac ("pid: replace pid bitmap implementation with IDR API") changed last field of /proc/loadavg (last pid allocated) to be off by one:
# unshare -p -f --mount-proc cat /proc/loadavg 0.00 0.00 0.00 1/60 2 <===
It should be 1 after first fork into pid namespace.
This is formally a regression but given how useless this field is I don't think anyone is affected.
Bug was found by /proc testsuite!
--- arch/powerpc/platforms/cell/spufs/sched.c | 2 +- fs/proc/loadavg.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/platforms/cell/spufs/sched.c +1 -1
@@ -1093,7 +1093,7 @@ static int show_spu_loadavg(struct seq_fLOAD_INT (c),LOAD_FRAC (c),count_active_contexts (),atomic_read (&nr_spu_contexts), - idr_get_cursor(&task_active_pid_ns(current)->idr)); + idr_get_cursor(&task_active_pid_ns(current)->idr) - 1);return 0 ; }
fs/proc/loadavg.c +1 -1
@@ -24,7 +24,7 @@ static int loadavg_proc_show(struct seq_LOAD_INT (avnrun[1 ]),LOAD_FRAC (avnrun[1 ]),LOAD_INT (avnrun[2 ]),LOAD_FRAC (avnrun[2 ]),nr_running (), nr_threads, - idr_get_cursor(&task_active_pid_ns(current)->idr)); + idr_get_cursor(&task_active_pid_ns(current)->idr) - 1);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 70/279 kexec_file: do not add extra alignment to efi memmap
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Young <[email protected]>
[ Upstream commit a841aa83dff0af75c88aa846ba610a8af4c5ee21 ]
Chun-Yi reported a kernel warning message below:
WARNING: CPU: 0 PID: 0 at ../mm/early_ioremap.c:182 early_iounmap+0x4f/0x12c() early_iounmap(ffffffffff200180, 00000118) [0] size not consistent 00000120
The problem is x86 kexec_file_load adds extra alignment to the efi
memmap: in bzImage64_load():
efi_map_sz = efi_get_runtime_map_size();
efi_map_sz = ALIGN(efi_map_sz, 16);And __efi_memmap_init maps with the size including the alignment bytes but efi_memmap_unmap use nr_maps * desc_size which does not include the extra bytes.
The alignment in kexec code is only needed for the kexec buffer internal use Actually kexec should pass exact size of the efi memmap to 2nd kernel.
--- arch/x86/kernel/kexec-bzimage64.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/kernel/kexec-bzimage64.c +2 -3
@@ -398,11 +398,10 @@ static void *bzImage64_load(struct kimag* little bit simple */ efi_map_sz =efi_get_runtime_map_size (); - efi_map_sz =ALIGN (efi_map_sz,16 ); params_cmdline_sz =sizeof (struct boot_params ) + cmdline_len +MAX_ELFCOREHDR_STR_LEN ; params_cmdline_sz =ALIGN (params_cmdline_sz,16 ); - kbuf.bufsz = params_cmdline_sz + efi_map_sz + + kbuf.bufsz = params_cmdline_sz +ALIGN (efi_map_sz,16 ) +sizeof (struct setup_data ) +sizeof (struct efi_setup_data );
@@ -410,7 +409,7 @@ static void *bzImage64_load(struct kimagif (!params)return ERR_PTR (-ENOMEM ); efi_map_offset = params_cmdline_sz; - efi_setup_data_offset = efi_map_offset + efi_map_sz; + efi_setup_data_offset = efi_map_offset +ALIGN (efi_map_sz,16 );/* Copy setup header onto bootparams. Documentation/x86/boot.txt */ setup_header_size =0x0202 + kernel[0x0201 ] - setup_hdr_offset;
Greg Kroah-Hartman
maintainerPATCH 71/279 mm: memcg: add __GFP_NOWARN in __memcg_schedule_kmem_cache_create()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minchan Kim <[email protected]>
[ Upstream commit c892fd82cc0632d425ae011a4dd75eb59e9f84ee ]
If there is heavy memory pressure, page allocation with __GFP_NOWAIT fails easily although it's order-0 request. I got below warning 9 times for normal boot.
<snip >: page allocation failure: order:0, mode:0x2200000(GFP_NOWAIT|__GFP_NOTRACK)
.. snip ..
Call trace:
dump_backtrace+0x0/0x4
dump_stack+0xa4/0xc0
warn_alloc+0xd4/0x15c
__alloc_pages_nodemask+0xf88/0x10fc
alloc_slab_page+0x40/0x18c
new_slab+0x2b8/0x2e0
___slab_alloc+0x25c/0x464
__kmalloc+0x394/0x498
memcg_kmem_get_cache+0x114/0x2b8
kmem_cache_alloc+0x98/0x3e8
mmap_region+0x3bc/0x8c0
do_mmap+0x40c/0x43c
vm_mmap_pgoff+0x15c/0x1e4
sys_mmap+0xb0/0xc8
el0_svc_naked+0x24/0x28
Mem-Info:
active_anon:17124 inactive_anon:193 isolated_anon:0
active_file:7898 inactive_file:712955 isolated_file:55
unevictable:0 dirty:27 writeback:18 unstable:0
slab_reclaimable:12250 slab_unreclaimable:23334
mapped:19310 shmem:212 pagetables:816 bounce:0
free:36561 free_pcp:1205 free_cma:35615
Node 0 active_anon:68496kB inactive_anon:772kB active_file:31592kB inactive_file:2851820kB unevictable:0kB isolated(anon):0kB isolated(file):220kB mapped:77240kB dirty:108kB writeback:72kB shmem:848kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
DMA free:142188kB min:3056kB low:3820kB high:4584kB active_anon:10052kB inactive_anon:12kB active_file:312kB inactive_file:1412620kB unevictable:0kB writepending:0kB present:1781412kB managed:1604728kB mlocked:0kB slab_reclaimable:3592kB slab_unreclaimable:876kB kernel_stack:400kB pagetables:52kB bounce:0kB free_pcp:1436kB local_pcp:124kB free_cma:142492kB
lowmem_reserve[]: 0 1842 1842
Normal free:4056kB min:4172kB low:5212kB high:6252kB active_anon:58376kB inactive_anon:760kB active_file:31348kB inactive_file:1439040kB unevictable:0kB writepending:180kB present:2000636kB managed:1923688kB mlocked:0kB slab_reclaimable:45408kB slab_unreclaimable:92460kB kernel_stack:9680kB pagetables:3212kB bounce:0kB free_pcp:3392kB local_pcp:688kB free_cma:0kB
lowmem_reserve[]: 0 0 0
DMA: 0*4kB 0*8kB 1*16kB (C) 0*32kB 0*64kB 0*128kB 1*256kB (C) 1*512kB (C) 0*1024kB 1*2048kB (C) 34*4096kB (C) = 142096kB
Normal: 228*4kB (UMEH) 172*8kB (UMH) 23*16kB (UH) 24*32kB (H) 5*64kB (H) 1*128kB (H) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 3872kB
721350 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap = 0kB
Total swap = 0kB
945512 pages RAM
0 pages HighMem/MovableOnly
63408 pages reserved
51200 pages cma reserved__memcg_schedule_kmem_cache_create() tries to create a shadow slab cache and the worker allocation failure is not really critical because we will retry on the next kmem charge. We might miss some charges but that shouldn't be critical. The excessive allocation failure report is not very helpful.
--- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memcontrol.c +1 -1
@@ -2192,7 +2192,7 @@ static void __memcg_schedule_kmem_cache_ {struct memcg_kmem_cache_create_work *cw; - cw =kmalloc (sizeof (*cw),GFP_NOWAIT ); + cw =kmalloc (sizeof (*cw),GFP_NOWAIT | __GFP_NOWARN);if (!cw)return ;
Greg Kroah-Hartman
maintainerPATCH 72/279 usb: typec: ucsi: fix tracepoint related build error
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Regnery <[email protected]>
[ Upstream commit 2f860691c2d2e3af1404ffeb2d22dd5c3dbca811 ]
There is the following build error with CONFIG_TYPEC_UCSI=m, CONFIG_FTRACE=y and CONFIG_TRACING=n:
ERROR: "__tracepoint_ucsi_command" [drivers/usb/typec/ucsi/typec_ucsi.ko] undefined!
ERROR: "__tracepoint_ucsi_register_port" [drivers/usb/typec/ucsi/typec_ucsi.ko] undefined!
ERROR: "__tracepoint_ucsi_notify" [drivers/usb/typec/ucsi/typec_ucsi.ko] undefined!
ERROR: "__tracepoint_ucsi_reset_ppm" [drivers/usb/typec/ucsi/typec_ucsi.ko] undefined!
ERROR: "__tracepoint_ucsi_run_command" [drivers/usb/typec/ucsi/typec_ucsi.ko] undefined!
ERROR: "__tracepoint_ucsi_ack" [drivers/usb/typec/ucsi/typec_ucsi.ko] undefined!
ERROR: "__tracepoint_ucsi_connector_change" [drivers/usb/typec/ucsi/typec_ucsi.ko] undefined!
This compination is quite hard to create because CONFIG_TRACING gets selected only in rare cases without CONFIG_FTRACE.
The build failure is caused by conditionally compiling trace.c depending on the wrong option CONFIG_FTRACE. Change this to depend on CONFIG_TRACING like other users of tracepoints do.
--- drivers/usb/typec/ucsi/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/ucsi/Makefile +1 -1
@@ -5,6 +5,6 @@ obj-$(CONFIG_TYPEC_UCSI) += typec_ucsi.o typec_ucsi-y := ucsi.o -typec_ucsi-$(CONFIG_FTRACE) += trace.o +typec_ucsi-$(CONFIG_TRACING) += trace.o obj-$(CONFIG_UCSI_ACPI) += ucsi_acpi.o
Greg Kroah-Hartman
maintainerPATCH 73/279 s390/qeth: fix MAC address update sequence
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <[email protected]>
[ Upstream commit bcacfcbc82b4235d280ed9b067aa4567f4a0c756 ]
When changing the MAC address on a L2 qeth device, current code first unregisters the old address, then registers the new one.
If HW rejects the new address (or the IO fails), the device ends up with no operable address at all.
Re-order the code flow so that the old address only gets dropped if the new address was registered successfully. While at it, add logic to catch some corner-cases.
--- drivers/s390/net/qeth_l2_main.c | 55 ++++++++++++++++++++++------------------ 1 file changed, 31 insertions(+), 24 deletions(-)
drivers/s390/net/qeth_l2_main.c +31 -24
@@ -122,13 +122,10 @@ static int qeth_l2_send_setmac(struct qeQETH_CARD_TEXT (card,2 ,"L2Setmac" ); rc =qeth_l2_send_setdelmac (card, mac,IPA_CMD_SETVMAC );if (rc ==0 ) { - card->info.mac_bits |=QETH_LAYER2_MAC_REGISTERED ; -ether_addr_copy (card->dev->dev_addr, mac);dev_info (&card->gdev->dev, -"MAC address %pM successfully registered on device %s\n" , - card->dev->dev_addr, card->dev->name); +"MAC address %pM successfully registered on device %s\n" , + mac, card->dev->name); }else { - card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED ;switch (rc) {case -EEXIST : dev_warn(&card->gdev->dev,
@@ -143,19 +140,6 @@ static int qeth_l2_send_setmac(struct qereturn rc; } -static int qeth_l2_send_delmac (struct qeth_card *card,__u8 *mac) -{ -int rc; - -QETH_CARD_TEXT (card,2 ,"L2Delmac" ); -if (!(card->info.mac_bits &QETH_LAYER2_MAC_REGISTERED )) -return 0 ; - rc =qeth_l2_send_setdelmac (card, mac,IPA_CMD_DELVMAC ); -if (rc ==0 ) - card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED ; -return rc; -} -static int qeth_l2_write_mac (struct qeth_card *card,u8 *mac) { enum qeth_ipa_cmds cmd = is_multicast_ether_addr_64bits(mac) ?
@@ -522,6 +506,7 @@ static int qeth_l2_set_mac_address(struc {struct sockaddr *addr = p;struct qeth_card *card = dev->ml_priv; +u8 old_addr[ETH_ALEN ];int rc =0 ;QETH_CARD_TEXT (card,3 ,"setmac" );
@@ -533,14 +518,35 @@ static int qeth_l2_set_mac_address(strucreturn -EOPNOTSUPP ; }QETH_CARD_HEX (card,3 , addr->sa_data,ETH_ALEN ); +if (!is_valid_ether_addr (addr->sa_data)) +return -EADDRNOTAVAIL ; +if (qeth_wait_for_threads (card,QETH_RECOVER_THREAD )) {QETH_CARD_TEXT (card,3 ,"setmcREC" );return -ERESTARTSYS ; } - rc =qeth_l2_send_delmac (card, &card->dev->dev_addr[0 ]); -if (!rc || (rc == -ENOENT )) - rc =qeth_l2_send_setmac (card, addr->sa_data); -return rc ? -EINVAL :0 ; + +if (!qeth_card_hw_is_reachable (card)) { +ether_addr_copy (dev->dev_addr, addr->sa_data); +return 0 ; + } + +/* don't register the same address twice */ +if (ether_addr_equal_64bits (dev->dev_addr, addr->sa_data) && + (card->info.mac_bits &QETH_LAYER2_MAC_REGISTERED )) +return 0 ; + +/* add the new address, switch over, drop the old */ + rc =qeth_l2_send_setmac (card, addr->sa_data); +if (rc) +return rc; +ether_addr_copy (old_addr, dev->dev_addr); +ether_addr_copy (dev->dev_addr, addr->sa_data); + +if (card->info.mac_bits &QETH_LAYER2_MAC_REGISTERED ) +qeth_l2_remove_mac (card, old_addr); + card->info.mac_bits |=QETH_LAYER2_MAC_REGISTERED ; +return 0 ; }static void qeth_promisc_to_bridge (struct qeth_card *card)
@@ -1067,8 +1073,9 @@ static int __qeth_l2_set_online(struct c goto out_remove; } -if (card->info.type !=QETH_CARD_TYPE_OSN ) -qeth_l2_send_setmac (card, &card->dev->dev_addr[0 ]); +if (card->info.type !=QETH_CARD_TYPE_OSN && + !qeth_l2_send_setmac (card, card->dev->dev_addr)) + card->info.mac_bits |=QETH_LAYER2_MAC_REGISTERED ;if (qeth_is_diagass_supported (card,QETH_DIAGS_CMD_TRAP )) { if (card->info.hwtrap &&
Greg Kroah-Hartman
maintainerPATCH 74/279 s390/qeth: fix request-side race during cmd IO timeout
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <[email protected]>
[ Upstream commit db71bbbd11a4d314f0fa3fbf3369b71cf33ce33c ]
Submitting a cmd IO request (usually on the WRITE device, but for IDX also on the READ device) is currently done with ccw_device_start() and a manual timeout in the caller.
On timeout, the caller cleans up the related resources (eg. IO buffer). But 1) the IO might still be active and utilize those resources, and
2) when the IO completes, qeth_irq() will attempt to clean up the same resources again.
Instead of introducing additional resource locking, switch to ccw_device_start_timeout() to ensure IO termination after timeout, and let the IRQ handler alone deal with cleaning up after a request.
This also removes a stray write->irq_pending reset from clear_ipacmd_list(). The routine doesn't terminate any pending IO on the WRITE device, so this should be handled properly via IO timeout in the IRQ handler.
--- drivers/s390/net/qeth_core_main.c | 51 +++++++++++++++++++------------------- drivers/s390/net/qeth_core_mpc.h | 12 ++++++++ drivers/s390/net/qeth_l2_main.c | 4 +- 3 files changed, 40 insertions(+), 27 deletions(-)
drivers/s390/net/qeth_core_main.c +26 -25
@@ -706,7 +706,6 @@ void qeth_clear_ipacmd_list(struct qeth_qeth_put_reply (reply); }spin_unlock_irqrestore (&card->lock, flags); -atomic_set (&card->write.irq_pending,0 ); }EXPORT_SYMBOL_GPL (qeth_clear_ipacmd_list);
@@ -1101,14 +1100,9 @@ static void qeth_irq(struct ccw_device * {int rc;int cstat, dstat; +struct qeth_cmd_buffer *iob =NULL ;struct qeth_channel *channel;struct qeth_card *card; -struct qeth_cmd_buffer *iob; - -if (__qeth_check_irb_error (cdev, intparm, irb)) -return ; - cstat = irb->scsw.cmd.cstat; - dstat = irb->scsw.cmd.dstat; card =CARD_FROM_CDEV (cdev);if (!card)
@@ -1126,6 +1120,19 @@ static void qeth_irq(struct ccw_device * channel = &card->data;QETH_CARD_TEXT (card,5 ,"data" ); } + +if (qeth_intparm_is_iob (intparm)) + iob = (struct qeth_cmd_buffer *)__va ((addr_t )intparm); + +if (__qeth_check_irb_error (cdev, intparm, irb)) { +/* IO was terminated, free its resources. */ +if (iob) +qeth_release_buffer (iob->channel, iob); +atomic_set (&channel->irq_pending,0 ); +wake_up (&card->wait_q); +return ; + } +atomic_set (&channel->irq_pending,0 );if (irb->scsw.cmd.fctl & (SCSW_FCTL_CLEAR_FUNC ))
@@ -1149,6 +1156,10 @@ static void qeth_irq(struct ccw_device */* we don't have to handle this further */ intparm =0 ; } + + cstat = irb->scsw.cmd.cstat; + dstat = irb->scsw.cmd.dstat; +if ((dstat &DEV_STAT_UNIT_EXCEP ) || (dstat &DEV_STAT_UNIT_CHECK ) || (cstat)) {
@@ -1187,11 +1198,8 @@ static void qeth_irq(struct ccw_device * channel->state == CH_STATE_UP)__qeth_issue_next_read (card); -if (intparm) { - iob = (struct qeth_cmd_buffer *)__va ((addr_t )intparm); -if (iob->callback) - iob->callback (iob->channel, iob); - } +if (iob && iob->callback) + iob->callback (iob->channel, iob); out:wake_up (&card->wait_q);
@@ -1862,8 +1870,8 @@ static int qeth_idx_activate_get_answer( atomic_cmpxchg(&channel->irq_pending, 0, 1) == 0);QETH_DBF_TEXT (SETUP ,6 ,"noirqpnd" );spin_lock_irqsave (get_ccwdev_lock (channel->ccwdev), flags); - rc =ccw_device_start (channel->ccwdev, - &channel->ccw, (addr_t ) iob,0 ,0 ); + rc =ccw_device_start_timeout (channel->ccwdev, &channel->ccw, + (addr_t ) iob,0 ,0 ,QETH_TIMEOUT );spin_unlock_irqrestore (get_ccwdev_lock (channel->ccwdev), flags);if (rc) {
@@ -1880,7 +1888,6 @@ static int qeth_idx_activate_get_answer(if (channel->state !=CH_STATE_UP ) { rc = -ETIME ;QETH_DBF_TEXT_ (SETUP ,2 ,"3err%d" , rc); -qeth_clear_cmd_buffers (channel); }else rc =0 ;return rc;
@@ -1934,8 +1941,8 @@ static int qeth_idx_activate_channel(str atomic_cmpxchg(&channel->irq_pending, 0, 1) == 0);QETH_DBF_TEXT (SETUP ,6 ,"noirqpnd" );spin_lock_irqsave (get_ccwdev_lock (channel->ccwdev), flags); - rc =ccw_device_start (channel->ccwdev, - &channel->ccw, (addr_t ) iob,0 ,0 ); + rc =ccw_device_start_timeout (channel->ccwdev, &channel->ccw, + (addr_t ) iob,0 ,0 ,QETH_TIMEOUT );spin_unlock_irqrestore (get_ccwdev_lock (channel->ccwdev), flags);if (rc) {
@@ -1956,7 +1963,6 @@ static int qeth_idx_activate_channel(strQETH_DBF_MESSAGE (2 ,"%s IDX activate timed out\n" ,dev_name (&channel->ccwdev->dev));QETH_DBF_TEXT_ (SETUP ,2 ,"2err%d" , -ETIME ); -qeth_clear_cmd_buffers (channel);return -ETIME ; }return qeth_idx_activate_get_answer (channel, idx_reply_cb);
@@ -2158,8 +2164,8 @@ int qeth_send_control_data(struct qeth_cQETH_CARD_TEXT (card,6 ,"noirqpnd" );spin_lock_irqsave (get_ccwdev_lock (card->write.ccwdev), flags); - rc =ccw_device_start (card->write.ccwdev, &card->write.ccw, - (addr_t ) iob,0 ,0 ); + rc =ccw_device_start_timeout (CARD_WDEV (card), &card->write.ccw, + (addr_t ) iob,0 ,0 , event_timeout);spin_unlock_irqrestore (get_ccwdev_lock (card->write.ccwdev), flags);if (rc) { QETH_DBF_MESSAGE(2, "%s qeth_send_control_data: "
@@ -2191,8 +2197,6 @@ int qeth_send_control_data(struct qeth_c } } -if (reply->rc == -EIO ) - goto error; rc = reply->rc;qeth_put_reply (reply);return rc;
@@ -2203,9 +2207,6 @@ time_err:list_del_init (&reply->list);spin_unlock_irqrestore (&reply->card->lock, flags);atomic_inc (&reply->received); -error: -atomic_set (&card->write.irq_pending,0 ); -qeth_release_buffer (iob->channel, iob); rc = reply->rc;qeth_put_reply (reply);return rc;
drivers/s390/net/qeth_core_mpc.h +12 -0
@@ -35,6 +35,18 @@ extern unsigned char IPA_PDU_HEADER[];#define QETH_HALT_CHANNEL_PARM -11#define QETH_RCD_PARM -12 +static inline bool qeth_intparm_is_iob (unsigned long intparm) +{ +switch (intparm) { +case QETH_CLEAR_CHANNEL_PARM : +case QETH_HALT_CHANNEL_PARM : +case QETH_RCD_PARM : +case 0 : +return false; + } +return true; +} +/*****************************************************************************/ /* IP Assist related definitions */ /*****************************************************************************/
drivers/s390/net/qeth_l2_main.c +2 -2
@@ -1346,8 +1346,8 @@ static int qeth_osn_send_control_data(stqeth_prepare_control_data (card, len, iob);QETH_CARD_TEXT (card,6 ,"osnoirqp" );spin_lock_irqsave (get_ccwdev_lock (card->write.ccwdev), flags); - rc =ccw_device_start (card->write.ccwdev, &card->write.ccw, - (addr_t ) iob,0 ,0 ); + rc =ccw_device_start_timeout (CARD_WDEV (card), &card->write.ccw, + (addr_t ) iob,0 ,0 ,QETH_IPA_TIMEOUT );spin_unlock_irqrestore (get_ccwdev_lock (card->write.ccwdev), flags);if (rc) { QETH_DBF_MESSAGE(2, "qeth_osn_send_control_data: "
Greg Kroah-Hartman
maintainerPATCH 75/279 s390/qeth: use Read device to query hypervisor for MAC
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <[email protected]>
[ Upstream commit b7493e91c11a757cf0f8ab26989642ee4bb2c642 ]
For z/VM NICs, qeth needs to consider which of the three CCW devices in an MPC group it uses for requesting a managed MAC address.
On the Base device, the hypervisor returns a default MAC which is pre-assigned when creating the NIC (this MAC is also returned by the READ MAC primitive). Querying any other device results in the allocation of an additional MAC address.
For consistency with READ MAC and to avoid using up more addresses than necessary, it is preferable to use the NIC's default MAC. So switch the the diag26c over to using a NIC's Read device, which should always be identical to the Base device.
--- drivers/s390/net/qeth_core_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/net/qeth_core_main.c +1 -1
@@ -4839,7 +4839,7 @@ int qeth_vm_request_mac(struct qeth_card goto out; } -ccw_device_get_id (CARD_DDEV (card), &id); +ccw_device_get_id (CARD_RDEV (card), &id); request->resp_buf_len =sizeof (*response); request->resp_version =DIAG26C_VERSION2 ; request->op_code =DIAG26C_GET_MAC ;
Greg Kroah-Hartman
maintainerPATCH 76/279 ACPI / PM: Blacklist Low Power S0 Idle _DSM for ThinkPad X1 Tablet(2016)
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yu <[email protected]>
[ Upstream commit 855c1c2fce8bdbd796cba1d1456ca8f0e876c2f1 ]
ThinkPad X1 Tablet(2016) is reported to have issues with the Low Power S0 Idle _DSM interface and since this machine model generally can do ACPI S3 just fine, and user would like to use S3 as default sleep model, add a blacklist entry to disable that interface for ThinkPad X1 Tablet(2016).
--- drivers/acpi/sleep.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/acpi/sleep.c +13 -0
@@ -364,6 +364,19 @@ static const struct dmi_system_id acpisl DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"), }, }, +/* +* ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using +* the Low Power S0 Idle firmware interface (see +* https://bugzilla.kernel.org/show_bug.cgi?id=199057). +*/ + { + .callback = init_no_lps0, + .ident = "ThinkPad X1 Tablet(2016)", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), + }, + }, {}, };
Greg Kroah-Hartman
maintainerPATCH 77/279 ACPI / scan: Initialize watchdog before PNP
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit cc6a0e315a68e5db85bea347b0c5b0fe4a9a5904 ]
At least on one Dell system the PNP motherboard resources device includes resources used by WDAT table. Since PNP gets initialized before WDAT it results following error and no watchdog:
platform wdat_wdt: failed to claim resource 3: [io 0x046a-0x046c]
ACPI: watchdog: Device creation failed: -16
Now, the PNP system driver is already accustomed with the situation that it cannot reserve all those motherboard resources because drivers using those might have reserved them already. In addition putting WDAT table resources under motherboard resources device makes sense in general.
Fix this by initializing WDAT right before PNP. This allows WDAT to reserve all its resources and still keeps PNP system driver happy.
--- drivers/acpi/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/scan.c +1 -1
@@ -2150,10 +2150,10 @@ int __init acpi_scan_init(void)acpi_cmos_rtc_init ();acpi_container_init ();acpi_memory_hotplug_init (); +acpi_watchdog_init ();acpi_pnp_init ();acpi_int340x_thermal_init ();acpi_amba_init (); -acpi_watchdog_init ();acpi_init_lpit ();acpi_scan_add_handler (&generic_device_handler);
Greg Kroah-Hartman
maintainerPATCH 78/279 dt-bindings: meson-uart: DT fix s/clocks-names/clock-names/
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 34df2466b48dfe258e14fe2a7bc4641416575ade ]
--- Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt +1 -1
@@ -21,7 +21,7 @@ Required properties: - interrupts : identifier to the device interrupt - clocks : a list of phandle + clock-specifier pairs, one for each entry in clock names. -- clocks-names : +- clock-names : * "xtal" for external xtal clock identifier * "pclk" for the bus core clock, either the clk81 clock or the gate clock * "baud" for the source of the baudrate generator, can be either the xtal
Greg Kroah-Hartman
maintainerPATCH 79/279 dt-bindings: mvebu-uart: DT fix s/interrupts-names/interrupt-names/
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 17a16542b88e753cc3bd54cf30b74df3d547421e ]
--- Documentation/devicetree/bindings/serial/mvebu-uart.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/serial/mvebu-uart.txt +1 -1
@@ -24,7 +24,7 @@ Required properties: - Must contain two elements for the extended variant of the IP (marvell,armada-3700-uart-ext): "uart-tx" and "uart-rx", respectively the UART TX interrupt and the UART RX interrupt. A - corresponding interrupts-names property must be defined. + corresponding interrupt-names property must be defined. - For backward compatibility reasons, a single element interrupts property is also supported for the standard variant of the IP, containing only the UART sum interrupt. This form is deprecated
Greg Kroah-Hartman
maintainerPATCH 80/279 powerpc/powernv/memtrace: Let the arch hotunplug code flush cache
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balbir Singh <[email protected]>
[ Upstream commit 7fd6641de28fe9b5bce0c38d2adee0a72a72619e ]
Don't do this via custom code, instead now that we have support in the arch hotplug/hotunplug code, rely on those routines to do the right thing.
The existing flush doesn't work because it uses ppc64_caches.l1d.size instead of ppc64_caches.l1d.line_size.
--- arch/powerpc/platforms/powernv/memtrace.c | 17 ----------------- 1 file changed, 17 deletions(-)
arch/powerpc/platforms/powernv/memtrace.c +0 -17
@@ -82,19 +82,6 @@ static const struct file_operations memt .open = simple_open, }; -static void flush_memory_region (u64 base,u64 size) -{ -unsigned long line_size = ppc64_caches.l1d.size; -u64 end = base + size; -u64 addr; - - base =round_down (base, line_size); - end =round_up (end, line_size); - -for (addr = base; addr < end; addr += line_size) - asmvolatile ("dcbf 0,%0" :"=r" (addr) ::"memory" ); -} -static int check_memblock_online (struct memory_block *mem,void *arg) {if (mem->state !=MEM_ONLINE )
@@ -132,10 +119,6 @@ static bool memtrace_offline_pages(u32 nwalk_memory_range (start_pfn, end_pfn, (void *)MEM_OFFLINE , change_memblock_state); -/* RCU grace period? */ -flush_memory_region ((u64 )__va (start_pfn <<PAGE_SHIFT ), - nr_pages <<PAGE_SHIFT ); -lock_device_hotplug ();remove_memory (nid, start_pfn <<PAGE_SHIFT , nr_pages <<PAGE_SHIFT );unlock_device_hotplug ();
Greg Kroah-Hartman
maintainerPATCH 81/279 net: phy: marvell: clear wol event before setting it
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jingju Hou <[email protected]>
[ Upstream commit b6a930fa88083b41d26ddf1cab95cbd740936c22 ]
If WOL event happened once, the LED[2] interrupt pin will not be cleared unless we read the CSISR register. If interrupts are in use, the normal interrupt handling will clear the WOL event. Let's clear the WOL event before enabling it if !phy_interrupt_is_valid().
--- drivers/net/phy/marvell.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/phy/marvell.c +9 -0
@@ -1377,6 +1377,15 @@ static int m88e1318_set_wol(struct phy_dif (err <0 ) goto error; +/* If WOL event happened once, the LED[2] interrupt pin +* will not be cleared unless we reading the interrupt status +* register. If interrupts are in use, the normal interrupt +* handling will clear the WOL event. Clear the WOL event +* before enabling it if !phy_interrupt_is_valid() +*/ +if (!phy_interrupt_is_valid (phydev)) +phy_read (phydev,MII_M1011_IEVENT ); +/* Enable the WOL interrupt */ err =__phy_modify (phydev,MII_88E1318S_PHY_CSIER ,0 ,MII_88E1318S_PHY_CSIER_WOL_EIE );
Greg Kroah-Hartman
maintainerPATCH 82/279 ARM: dts: da850: fix W=1 warnings with pinmux node
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sekhar Nori <[email protected]>
[ Upstream commit 94a82284ad4711b7f9fd78981fdc7a1cb645030b ]
Remove unused #address-cells and #size-cells from pinmux node. This fixes W=1 warnings of the type:
arch/arm/boot/dts/da850-lcdk.dtb: Warning (avoid_unnecessary_addr_size): /soc@1c00000/pinmux@14120: unnecessary #address-cells/#size-cells without "ranges" or child "reg" property
Tested on DA850 LCDK by checking output of:
/sys/kernel/debug/pinctrl/1c14120.pinmux-pinctrl-single/pins
before and after the change.
--- arch/arm/boot/dts/da850.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm/boot/dts/da850.dtsi +0 -2
@@ -46,8 +46,6 @@ pmx_core: pinmux@14120 { compatible = "pinctrl-single"; reg = <0x14120 0x50>; - #address-cells = <1>; - #size-cells = <0>; #pinctrl-cells = <2>; pinctrl-single,bit-per-mux; pinctrl-single,register-width = <32>;
Greg Kroah-Hartman
maintainerPATCH 83/279 ACPI / watchdog: Prefer iTCO_wdt on Lenovo Z50-70
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit a0a37862a4e1844793d39aca9ccb8fecbdcb8659 ]
WDAT table on Lenovo Z50-70 is using RTC SRAM (ports 0x70 and 0x71) to store state of the timer. This conflicts with Linux RTC driver (rtc-cmos.c) who fails to reserve those ports for itself preventing RTC from functioning. In addition the WDAT table seems not to be fully functional because it does not reset the system when the watchdog times out.
On this system iTCO_wdt works just fine so we simply prefer to use it instead of WDAT. This makes RTC working again and also results working watchdog via iTCO_wdt.
--- drivers/acpi/acpi_watchdog.c | 59 +++++++++++++++++++++++++++++++++++-------- 1 file changed, 49 insertions(+), 10 deletions(-)
drivers/acpi/acpi_watchdog.c +49 -10
@@ -12,23 +12,64 @@#define pr_fmt (fmt) "ACPI: watchdog: " fmt#include <linux/acpi.h> +#include <linux/dmi.h> #include <linux/ioport.h> #include <linux/platform_device.h> #include "internal.h" +static const struct dmi_system_id acpi_watchdog_skip[] = { + { +/* +* On Lenovo Z50-70 there are two issues with the WDAT +* table. First some of the instructions use RTC SRAM +* to store persistent information. This does not work well +* with Linux RTC driver. Second, more important thing is +* that the instructions do not actually reset the system. +* +* On this particular system iTCO_wdt seems to work just +* fine so we prefer that over WDAT for now. +* +* See also https://bugzilla.kernel.org/show_bug.cgi?id=199033. +*/ + .ident ="Lenovo Z50-70" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"20354" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"Lenovo Z50-70" ), + }, + }, + {} +}; + +static const struct acpi_table_wdat *acpi_watchdog_get_wdat (void ) +{ +const struct acpi_table_wdat *wdat =NULL ; +acpi_status status; + +if (acpi_disabled) +return NULL ; + +if (dmi_check_system (acpi_watchdog_skip)) +return NULL ; + + status =acpi_get_table (ACPI_SIG_WDAT ,0 , + (struct acpi_table_header **)&wdat); +if (ACPI_FAILURE (status)) { +/* It is fine if there is no WDAT */ +return NULL ; + } + +return wdat; +} +/** * Returns true if this system should prefer ACPI based watchdog instead of * the native one (which are typically the same hardware). */ bool acpi_has_watchdog (void ) { -struct acpi_table_header hdr; - -if (acpi_disabled) -return false; - -return ACPI_SUCCESS (acpi_get_table_header (ACPI_SIG_WDAT ,0 , &hdr)); +return !!acpi_watchdog_get_wdat (); }EXPORT_SYMBOL_GPL (acpi_has_watchdog);
@@ -41,12 +82,10 @@ void __init acpi_watchdog_init(void)struct platform_device *pdev;struct resource *resources;size_t nresources =0 ; -acpi_status status;int i; - status =acpi_get_table (ACPI_SIG_WDAT ,0 , - (struct acpi_table_header **)&wdat); -if (ACPI_FAILURE (status)) { + wdat =acpi_watchdog_get_wdat (); +if (!wdat) {/* It is fine if there is no WDAT */ return ; }
Greg Kroah-Hartman
maintainerPATCH 84/279 drm/amdkfd: fix clock counter retrieval for node without GPU
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andres Rodriguez <[email protected]>
[ Upstream commit 1cf6cc74bbeb85bb87c3ca3f3df97a283c3aa737 ]
Currently if a user requests clock counters for a node without a GPU resource we will always return EINVAL.
Instead if no GPU resource is attached, fill the gpu_clock_counter argument with zeroes so that we may proceed and return valid CPU counters.
--- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +7 -6
@@ -748,12 +748,13 @@ static int kfd_ioctl_get_clock_counters(struct timespec64 time; dev =kfd_device_by_id (args->gpu_id); -if (dev ==NULL ) -return -EINVAL ; - -/* Reading GPU clock counter from KGD */ - args->gpu_clock_counter = - dev->kfd2kgd->get_gpu_clock_counter (dev->kgd); +if (dev) +/* Reading GPU clock counter from KGD */ + args->gpu_clock_counter = + dev->kfd2kgd->get_gpu_clock_counter (dev->kgd); +else +/* Node without GPU resource */ + args->gpu_clock_counter =0 ;/* No access to rdtsc. Using raw monotonic time */ getrawmonotonic64 (&time);
Greg Kroah-Hartman
maintainerPATCH 85/279 cpufreq: brcmstb-avs-cpufreq: remove development debug support
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Mayer <[email protected]>
[ Upstream commit ee53a65dc766384aaf1a26e3c43dd13456170b69 ]
This debug code was helpful while developing the driver, but it isn't being used for anything anymore.
--- drivers/cpufreq/Kconfig.arm | 10 - drivers/cpufreq/brcmstb-avs-cpufreq.c | 323 ---------------------------------- 2 files changed, 1 insertion(+), 332 deletions(-)
drivers/cpufreq/Kconfig.arm +0 -10
@@ -70,16 +70,6 @@ config ARM_BRCMSTB_AVS_CPUFREQ Say Y, if you have a Broadcom SoC with AVS support for DFS or DVFS. -config ARM_BRCMSTB_AVS_CPUFREQ_DEBUG - bool "Broadcom STB AVS CPUfreq driver sysfs debug capability" - depends on ARM_BRCMSTB_AVS_CPUFREQ - help - Enabling this option turns on debug support via sysfs under - /sys/kernel/debug/brcmstb-avs-cpufreq. It is possible to read all and - write some AVS mailbox registers through sysfs entries. - - If in doubt, say N. - config ARM_EXYNOS5440_CPUFREQ tristate "SAMSUNG EXYNOS5440" depends on SOC_EXYNOS5440
drivers/cpufreq/brcmstb-avs-cpufreq.c +1 -322
359 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 86/279 thermal: int3403_thermal: Fix NULL pointer deref on module load / probe
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 13b86f50eaaddaea4bdd2fe476fd12e6a0951add ]
Starting with kernel 4.17 thermal_cooling_device_register() will call the get_max_state() op during register.
Since we deref priv->priv in int3403_get_max_state() this means we must set priv->priv before calling thermal_cooling_device_register().
--- drivers/thermal/int340x_thermal/int3403_thermal.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/thermal/int340x_thermal/int3403_thermal.c +1 -2
@@ -194,6 +194,7 @@ static int int3403_cdev_add(struct int34return -EFAULT ; } + priv->priv = obj; obj->max_state = p->package.count -1 ; obj->cdev = thermal_cooling_device_register(acpi_device_bid(priv->adev),
@@ -201,8 +202,6 @@ static int int3403_cdev_add(struct int34if (IS_ERR (obj->cdev)) result =PTR_ERR (obj->cdev); - priv->priv = obj; -kfree (buf.pointer);/* TODO: add ACPI notification support */
Greg Kroah-Hartman
maintainerPATCH 87/279 CIFS: set *resp_buf_type to NO_BUFFER on error
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
[ Upstream commit 117e3b7fed552eba96ae0b3b92312fe8c5b0bfdd ]
Dan Carpenter had pointed this out a while ago, but the code around this had changed so wasn't causing any problems since that field was not used in this error path.
Still, it is cleaner to always initialize this field, so changing the error path to set it.
--- fs/cifs/transport.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/cifs/transport.c +4 -1
@@ -833,8 +833,11 @@ SendReceive2(const unsigned int xid, strif (n_vec +1 >CIFS_MAX_IOV_SIZE ) { new_iov =kmalloc (sizeof (struct kvec ) * (n_vec +1 ),GFP_KERNEL ); -if (!new_iov) +if (!new_iov) { +/* otherwise cifs_send_recv below sets resp_buf_type */ + *resp_buf_type =CIFS_NO_BUFFER ;return -ENOMEM ; + } }else new_iov = s_iov;
Greg Kroah-Hartman
maintainerPATCH 88/279 arm64: dts: uniphier: fix input delay value for legacy mode of eMMC
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit f4e5200fc0d7dad75c688e7ccc0652481a916df5 ]
The property of the legacy mode for the eMMC PHY turned out to be wrong. Some eMMC devices are unstable due to the set-up/hold timing violation. Correct the delay value.
--- arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi | 2 +- arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi | 2 +- arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi +1 -1
@@ -330,7 +330,7 @@ mmc-ddr-1_8v; mmc-hs200-1_8v; mmc-pwrseq = <&emmc_pwrseq>; - cdns,phy-input-delay-legacy = <4>; + cdns,phy-input-delay-legacy = <9>; cdns,phy-input-delay-mmc-highspeed = <2>; cdns,phy-input-delay-mmc-ddr = <3>; cdns,phy-dll-delay-sdclk = <21>;
arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +1 -1
@@ -435,7 +435,7 @@ mmc-ddr-1_8v; mmc-hs200-1_8v; mmc-pwrseq = <&emmc_pwrseq>; - cdns,phy-input-delay-legacy = <4>; + cdns,phy-input-delay-legacy = <9>; cdns,phy-input-delay-mmc-highspeed = <2>; cdns,phy-input-delay-mmc-ddr = <3>; cdns,phy-dll-delay-sdclk = <21>;
arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +1 -1
@@ -336,7 +336,7 @@ mmc-ddr-1_8v; mmc-hs200-1_8v; mmc-pwrseq = <&emmc_pwrseq>; - cdns,phy-input-delay-legacy = <4>; + cdns,phy-input-delay-legacy = <9>; cdns,phy-input-delay-mmc-highspeed = <2>; cdns,phy-input-delay-mmc-ddr = <3>; cdns,phy-dll-delay-sdclk = <21>;
Greg Kroah-Hartman
maintainerPATCH 89/279 igb: Fix the transmission mode of queue 0 for Qav mode
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
[ Upstream commit 2707df9773cd2cb8b0f35b8592431b301da9d352 ]
When Qav mode is enabled, queue 0 should be kept on Stream Reservation mode. From the i210 datasheet, section 8.12.19:
"Note: Queue0 QueueMode must be set to 1b when TransmitMode is set to Qav." ("QueueMode 1b" represents the Stream Reservation mode)
The solution is to give queue 0 the all the credits it might need, so it has priority over queue 1.
A situation where this can happen is when cbs is "installed" only on queue 1, leaving queue 0 alone. For example:
$ tc qdisc replace dev enp2s0 handle 100: parent root mqprio num_tc 3 \
map 2 2 1 0 2 2 2 2 2 2 2 2 2 2 2 2 queues 1@0 1@1 2@2 hw 0$ tc qdisc replace dev enp2s0 parent 100:2 cbs locredit -1470 \
hicredit 30 sendslope -980000 idleslope 20000 offload 1--- drivers/net/ethernet/intel/igb/igb_main.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/igb/igb_main.c +16 -1
@@ -1698,7 +1698,22 @@ static void igb_configure_cbs(struct igbWARN_ON (hw->mac.type != e1000_i210);WARN_ON (queue <0 || queue >1 ); -if (enable) { +if (enable || queue ==0 ) { +/* i210 does not allow the queue 0 to be in the Strict +* Priority mode while the Qav mode is enabled, so, +* instead of disabling strict priority mode, we give +* queue 0 the maximum of credits possible. +* +* See section 8.12.19 of the i210 datasheet, "Note: +* Queue0 QueueMode must be set to 1b when +* TransmitMode is set to Qav." +*/ +if (queue ==0 && !enable) { +/* max "linkspeed" idleslope in kbps */ + idleslope =1000000 ; + hicredit =ETH_FRAME_LEN ; + } +set_tx_desc_fetch_prio (hw, queue,TX_QUEUE_PRIO_HIGH );set_queue_mode (hw, queue,QUEUE_MODE_STREAM_RESERVATION );
Greg Kroah-Hartman
maintainerPATCH 90/279 net: ethtool: Add missing kernel doc for FEC parameters
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
[ Upstream commit d805c5209350ae725e3a1ee0204ba27d9e75ce3e ]
While adding support for ethtool::get_fecparam and set_fecparam, kernel doc for these functions was missed, add those.
--- include/linux/ethtool.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/ethtool.h +2 -0
@@ -310,6 +310,8 @@ bool ethtool_convert_link_mode_to_legacy* fields should be ignored (use %__ETHTOOL_LINK_MODE_MASK_NBITS * instead of the latter), any change to them will be overwritten * by kernel. Returns a negative error code or zero. +* @get_fecparam: Get the network device Forward Error Correction parameters. +* @set_fecparam: Set the network device Forward Error Correction parameters. * * All operations are optional (i.e. the function pointer may be set * to %NULL) and callers must take this into account. Callers must
Greg Kroah-Hartman
maintainerPATCH 91/279 riscv: select DMA_DIRECT_OPS instead of redefining it
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 86e11757d8b28d8266065beaa9d391d49426797b ]
DMA_DIRECT_OPS is defined in lib/Kconfig, so don't duplicate it in arch/riscv/Kconfig.
--- arch/riscv/Kconfig | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/riscv/Kconfig +1 -3
@@ -11,6 +11,7 @@ config RISCV select ARCH_WANT_FRAME_POINTERS select CLONE_BACKWARDS select COMMON_CLK + select DMA_DIRECT_OPS select GENERIC_CLOCKEVENTS select GENERIC_CPU_DEVICES select GENERIC_IRQ_SHOW
@@ -88,9 +89,6 @@ config PGTABLE_LEVELS config HAVE_KPROBES def_bool n -config DMA_DIRECT_OPS - def_bool y - menu "Platform type" choice
Greg Kroah-Hartman
maintainerPATCH 92/279 RISC-V: build vdso-dummy.o with -no-pie
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <[email protected]>
[ Upstream commit 85602bea297fc4e5223adbf7006dcce9aa694f17 ]
Debian toolcahin defaults to PIE, and I guess that will also be the case of most distributions. This causes the following build failure:
AS arch/riscv/kernel/vdso/getcpu.o AS arch/riscv/kernel/vdso/flush_icache.o VDSOLD arch/riscv/kernel/vdso/vdso.so.dbg OBJCOPY arch/riscv/kernel/vdso/vdso.so AS arch/riscv/kernel/vdso/vdso.o VDSOLD arch/riscv/kernel/vdso/vdso-dummy.o LD arch/riscv/kernel/vdso/vdso-syms.o
riscv64-linux-gnu-ld: attempted static link of dynamic object `arch/riscv/kernel/vdso/vdso-dummy.o' make[2]: *** [arch/riscv/kernel/vdso/Makefile:43: arch/riscv/kernel/vdso/vdso-syms.o] Error 1 make[1]: *** [scripts/Makefile.build:575: arch/riscv/kernel/vdso] Error 2
make: *** [Makefile:1018: arch/riscv/kernel] Error 2
While the root Makefile correctly passes "-fno-PIE" to build individual object files, the RISC-V kernel also builds vdso-dummy.o as an executable, which is therefore linked as PIE. Fix that by updating this specific link rule to also include "-no-pie".
--- arch/riscv/kernel/vdso/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/vdso/Makefile +1 -1
@@ -52,7 +52,7 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE # Add -lgcc so rv32 gets static muldi3 and lshrdi3 definitions. # Make sure only to export the intended __vdso_xxx symbol offsets. quiet_cmd_vdsold = VDSOLD $@ - cmd_vdsold = $(CC) $(KCFLAGS) -nostdlib $(SYSCFLAGS_$(@F)) \ + cmd_vdsold = $(CC) $(KCFLAGS) $(call cc-option, -no-pie) -nostdlib $(SYSCFLAGS_$(@F)) \ -Wl,-T,$(filter-out FORCE,$^) -o [email protected] -lgcc && \ $(CROSS_COMPILE)objcopy \ $(patsubst %, -G __vdso_%, $(vdso-syms)) [email protected] $@
Greg Kroah-Hartman
maintainerPATCH 93/279 arm64: ptrace: remove addr_limit manipulation
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 59275a0c037ed6fabd6354730f1e3104264ab719 ]
We transiently switch to KERNEL_DS in compat_ptrace_gethbpregs() and compat_ptrace_sethbpregs(), but in either case this is pointless as we don't perform any uaccess during this window.
let's rip out the redundant addr_limit manipulation.
--- arch/arm64/kernel/ptrace.c | 6 ------ 1 file changed, 6 deletions(-)
arch/arm64/kernel/ptrace.c +0 -6
@@ -1458,9 +1458,7 @@ static int compat_ptrace_gethbpregs(stru {int ret;u32 kdata; -mm_segment_t old_fs =get_fs (); -set_fs (KERNEL_DS );/* Watchpoint */ if (num <0 ) { ret =compat_ptrace_hbp_get (NT_ARM_HW_WATCH , tsk, num, &kdata);
@@ -1471,7 +1469,6 @@ static int compat_ptrace_gethbpregs(stru }else { ret =compat_ptrace_hbp_get (NT_ARM_HW_BREAK , tsk, num, &kdata); } -set_fs (old_fs);if (!ret) ret =put_user (kdata, data);
@@ -1484,7 +1481,6 @@ static int compat_ptrace_sethbpregs(stru {int ret;u32 kdata =0 ; -mm_segment_t old_fs =get_fs ();if (num ==0 )return 0 ;
@@ -1493,12 +1489,10 @@ static int compat_ptrace_sethbpregs(struif (ret)return ret; -set_fs (KERNEL_DS );if (num <0 ) ret =compat_ptrace_hbp_set (NT_ARM_HW_WATCH , tsk, num, &kdata);else ret =compat_ptrace_hbp_set (NT_ARM_HW_BREAK , tsk, num, &kdata); -set_fs (old_fs);return ret; }
Greg Kroah-Hartman
maintainerPATCH 94/279 arm64: only advance singlestep for user instruction traps
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 9478f1927e6ef9ef5e1ad761af1c98aa8e40b7f5 ]
Our arm64_skip_faulting_instruction() helper advances the userspace singlestep state machine, but this is also called by the kernel BRK handler, as used for WARN*().
Thus, if we happen to hit a WARN*() while the user singlestep state machine is in the active-no-pending state, we'll advance to the active-pending state without having executed a user instruction, and will take a step exception earlier than expected when we return to userspace.
Let's fix this by only advancing the state machine when skipping a user instruction.
--- arch/arm64/kernel/traps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/kernel/traps.c +2 -1
@@ -243,7 +243,8 @@ void arm64_skip_faulting_instruction(str* If we were single stepping, we want to get the step exception after * we return from the trap. */ -user_fastforward_single_step (current); +if (user_mode (regs)) +user_fastforward_single_step (current); }static LIST_HEAD (undef_hook);
Greg Kroah-Hartman
maintainerPATCH 95/279 perf pmu: Fix core PMU alias list for X86 platform
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <[email protected]>
[ Upstream commit 292c34c10249c64a70def442f0d977bf9d466ed7 ]
When counting uncore event with alias, core event is mistakenly involved, for example:
perf stat --no-merge -e "unc_m_cas_count.all" -C0 sleep 1
Performance counter stats for 'CPU(s) 0':
0 unc_m_cas_count.all [uncore_imc_4]
0 unc_m_cas_count.all [uncore_imc_2]
0 unc_m_cas_count.all [uncore_imc_0]
153,640 unc_m_cas_count.all [cpu]
0 unc_m_cas_count.all [uncore_imc_5]
25,026 unc_m_cas_count.all [uncore_imc_3]
0 unc_m_cas_count.all [uncore_imc_1]1.001447890 seconds time elapsed
The reason is that current implementation doesn't check PMU name of a event when adding its alias into the alias list for core PMU. The uncore event aliases are mistakenly added.
This bug was introduced in:
commit 14b22ae028de ("perf pmu: Add helper function is_pmu_core to detect PMU CORE devices")
Checking the PMU name for all PMUs on X86 and other architectures except ARM.
There is no behavior change for ARM.
--- tools/perf/util/pmu.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-)
tools/perf/util/pmu.c +7 -13
@@ -539,9 +539,10 @@ static bool pmu_is_uncore(const char *na/* * PMU CORE devices have different name other than cpu in sysfs on some -* platforms. looking for possible sysfs files to identify as core device. +* platforms. +* Looking for possible sysfs files to identify the arm core device. */ -static int is_pmu_core (const char *name) +static int is_arm_pmu_core (const char *name) {struct stat st;char path[PATH_MAX ];
@@ -550,12 +551,6 @@ static int is_pmu_core(const char *name)if (!sysfs)return 0 ; -/* Look for cpu sysfs (x86 and others) */ -scnprintf (path,PATH_MAX ,"%s/bus/event_source/devices/cpu" , sysfs); -if ((stat (path, &st) ==0 ) && - (strncmp (name,"cpu" ,strlen ("cpu" )) ==0 )) -return 1 ; -/* Look for cpu sysfs (specific to arm) */ scnprintf (path,PATH_MAX ,"%s/bus/event_source/devices/%s/cpus" , sysfs, name);
@@ -651,6 +646,7 @@ static void pmu_add_cpu_aliases(struct lstruct pmu_events_map *map;struct pmu_event *pe;const char *name = pmu->name; +const char *pname; map =perf_pmu__find_map (pmu);if (!map)
@@ -669,11 +665,9 @@ static void pmu_add_cpu_aliases(struct lbreak ; } -if (!is_pmu_core (name)) { -/* check for uncore devices */ -if (pe->pmu ==NULL ) -continue ; -if (strncmp (pe->pmu, name,strlen (pe->pmu))) +if (!is_arm_pmu_core (name)) { + pname = pe->pmu ? pe->pmu :"cpu" ; +if (strncmp (pname, name,strlen (pname)))continue ; }
Greg Kroah-Hartman
maintainerPATCH 96/279 HID: lenovo: Add support for IBM/Lenovo Scrollpoint mice
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: pgzh <[email protected]>
[ Upstream commit a230cd52b8a2be39cd6e9a13b3e62af57f21372a ]
The IBM/Lenovo Scrollpoint mice feature a trackpoint-like stick instead of a scrolling wheel capable of 2-D (vertical+horizontal) scrolling. hid-generic does only expose 1-D (vertical) scrolling functionality for these mice. This patch adds support for horizontal scrolling for the IBM/Lenovo Scrollpoint mice to hid-lenovo.
--- drivers/hid/Kconfig | 7 ++++--- drivers/hid/hid-ids.h | 8 ++++++++ drivers/hid/hid-lenovo.c | 36 ++++++++++++++++++++++++++++++++++++ 3 files changed, 48 insertions(+), 3 deletions(-)
drivers/hid/Kconfig +4 -3
@@ -448,10 +448,11 @@ config HID_LENOVO select NEW_LEDS select LEDS_CLASS ---help--- - Support for Lenovo devices that are not fully compliant with HID standard. + Support for IBM/Lenovo devices that are not fully compliant with HID standard. - Say Y if you want support for the non-compliant features of the Lenovo - Thinkpad standalone keyboards, e.g: + Say Y if you want support for horizontal scrolling of the IBM/Lenovo + Scrollpoint mice or the non-compliant features of the Lenovo Thinkpad + standalone keyboards, e.g: - ThinkPad USB Keyboard with TrackPoint (supports extra LEDs and trackpoint configuration) - ThinkPad Compact Bluetooth Keyboard with TrackPoint (supports Fn keys)
drivers/hid/hid-ids.h +8 -0
@@ -546,6 +546,13 @@#define USB_VENDOR_ID_HUION 0x256c#define USB_DEVICE_ID_HUION_TABLET 0x006e +#define USB_VENDOR_ID_IBM 0x04b3 +#define USB_DEVICE_ID_IBM_SCROLLPOINT_III 0x3100 +#define USB_DEVICE_ID_IBM_SCROLLPOINT_PRO 0x3103 +#define USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL 0x3105 +#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL 0x3108 +#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO 0x3109 +#define USB_VENDOR_ID_IDEACOM 0x1cb6#define USB_DEVICE_ID_IDEACOM_IDC6650 0x6650#define USB_DEVICE_ID_IDEACOM_IDC6651 0x6651
@@ -678,6 +685,7 @@#define USB_DEVICE_ID_LENOVO_TPKBD 0x6009#define USB_DEVICE_ID_LENOVO_CUSBKBD 0x6047#define USB_DEVICE_ID_LENOVO_CBTKBD 0x6048 +#define USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL 0x6049#define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067#define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085#define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3
drivers/hid/hid-lenovo.c +36 -0
@@ -6,6 +6,17 @@* * Copyright (c) 2012 Bernhard Seibold * Copyright (c) 2014 Jamie Lentin <[email protected]> +* +* Linux IBM/Lenovo Scrollpoint mouse driver: +* - IBM Scrollpoint III +* - IBM Scrollpoint Pro +* - IBM Scrollpoint Optical +* - IBM Scrollpoint Optical 800dpi +* - IBM Scrollpoint Optical 800dpi Pro +* - Lenovo Scrollpoint Optical +* +* Copyright (c) 2012 Peter De Wachter <[email protected]> +* Copyright (c) 2018 Peter Ganzhorn <[email protected]> */ /*
@@ -160,6 +171,17 @@ static int lenovo_input_mapping_cptkbd(sreturn 0 ; } +static int lenovo_input_mapping_scrollpoint (struct hid_device *hdev, +struct hid_input *hi,struct hid_field *field, +struct hid_usage *usage,unsigned long **bit,int *max) +{ +if (usage->hid ==HID_GD_Z ) { +hid_map_usage (hi, usage, bit, max,EV_REL ,REL_HWHEEL ); +return 1 ; + } +return 0 ; +} +static int lenovo_input_mapping (struct hid_device *hdev,struct hid_input *hi,struct hid_field *field,struct hid_usage *usage,unsigned long **bit,int *max)
@@ -172,6 +194,14 @@ static int lenovo_input_mapping(struct hcase USB_DEVICE_ID_LENOVO_CBTKBD :return lenovo_input_mapping_cptkbd (hdev, hi, field, usage, bit, max); +case USB_DEVICE_ID_IBM_SCROLLPOINT_III : +case USB_DEVICE_ID_IBM_SCROLLPOINT_PRO : +case USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL : +case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL : +case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO : +case USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL : +return lenovo_input_mapping_scrollpoint (hdev, hi, field, + usage, bit, max);default :return 0 ; }
@@ -883,6 +913,12 @@ static const struct hid_device_id lenovo { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CUSBKBD) }, { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CBTKBD) }, { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPPRODOCK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_III) }, + { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_PRO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL) }, + { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL) }, + { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL) }, { } };
Greg Kroah-Hartman
maintainerPATCH 97/279 HID: wacom: Release device resource data obtained by devres_alloc()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arvind Yadav <[email protected]>
[ Upstream commit 097b8f62dd793e08f1732fc74dbb64596c7fbff9 ]
Free device resource data, if __wacom_devm_sysfs_create_group is not successful.
--- drivers/hid/wacom_sys.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/wacom_sys.c +3 -1
@@ -1213,8 +1213,10 @@ static int __wacom_devm_sysfs_create_gro devres->root = root; error =sysfs_create_group (devres->root, group); -if (error) +if (error) { +devres_free (devres);return error; + }devres_add (&wacom->hdev->dev, devres);
Greg Kroah-Hartman
maintainerPATCH 98/279 selftests: ftrace: Add a testcase for multiple actions on trigger
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <[email protected]>
[ Upstream commit 25aa50e0ca397a5e5d4d6fcecefa8107877d1dd0 ]
Add a testcase for multiple actions with different parameters on an event trigger, which has been fixed by commit 192c283e93bd ("tracing: Add action comparisons
when testing matching hist triggers").
--- tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc | 44 ++++++++++ 1 file changed, 44 insertions(+) create mode 100644 tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc new file +44 -0
@@ -0,0 +1,44 @@ +#!/bin/sh +# description: event trigger - test multiple actions on hist trigger + + +do_reset() { + reset_trigger + echo > set_event + clear_trace +} + +fail() { #msg + do_reset + echo $1 + exit_fail +} + +if [ ! -f set_event ]; then + echo "event tracing is not supported" + exit_unsupported +fi + +if [ ! -f synthetic_events ]; then + echo "synthetic event is not supported" + exit_unsupported +fi + +clear_synthetic_events +reset_tracer +do_reset + +echo "Test multiple actions on hist trigger" +echo 'wakeup_latency u64 lat; pid_t pid' >> synthetic_events +TRIGGER1=events/sched/sched_wakeup/trigger +TRIGGER2=events/sched/sched_switch/trigger + +echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="cyclictest"' > $TRIGGER1 +echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0 if next_comm=="cyclictest"' >> $TRIGGER2 +echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,next_pid) if next_comm=="cyclictest"' >> $TRIGGER2 +echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,prev_pid) if next_comm=="cyclictest"' >> $TRIGGER2 +echo 'hist:keys=next_pid if next_comm=="cyclictest"' >> $TRIGGER2 + +do_reset + +exit 0
Greg Kroah-Hartman
maintainerPATCH 99/279 bpf, x64: fix JIT emission for dead code
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gianluca Borello <[email protected]>
[ Upstream commit 1612a981b76688c598dc944bbfbe29a2b33e3973 ]
Commit 2a5418a13fcf ("bpf: improve dead code sanitizing") replaced dead code with a series of ja-1 instructions, for safety. That made JIT compilation much more complex for some BPF programs. One instance of such programs is, for example:
bool flag = false
...
/* A bunch of other code */
...
if (flag)
do_something()
In some cases llvm is not able to remove at compile time the code for do_something(), so the generated BPF program ends up with a large amount of dead instructions. In one specific real life example, there are two series of ~500 and ~1000 dead instructions in the program. When the verifier replaces them with a series of ja-1 instructions, it causes an interesting behavior at JIT time.
During the first pass, since all the instructions are estimated at 64 bytes, the ja-1 instructions end up being translated as 5 bytes JMP instructions (0xE9), since the jump offsets become increasingly large (>
127) as each instruction gets discovered to be 5 bytes instead of the estimated 64.
Starting from the second pass, the first N instructions of the ja-1 sequence get translated into 2 bytes JMPs (0xEB) because the jump offsets become <= 127 this time. In particular, N is defined as roughly 127 / (5
- 2) ~= 42. So, each further pass will make the subsequent N JMP instructions shrink from 5 to 2 bytes, making the image shrink every time. This means that in order to have the entire program converge, there need to be, in the real example above, at least ~1000 / 42 ~= 24 passes just for translating the dead code. If we add this number to the passes needed to translate the other non dead code, it brings such program to 40+ passes, and JIT doesn't complete. Ultimately the userspace loader fails because such BPF program was supposed to be part of a prog array owner being JITed.
While it is certainly possible to try to refactor such programs to help the compiler remove dead code, the behavior is not really intuitive and it puts further burden on the BPF developer who is not expecting such behavior. To make things worse, such programs are working just fine in all the kernel releases prior to the ja-1 fix.
A possible approach to mitigate this behavior consists into noticing that for ja-1 instructions we don't really need to rely on the estimated size of the previous and current instructions, we know that a -1 BPF jump offset can be safely translated into a 0xEB instruction with a jump offset of -2.
Such fix brings the BPF program in the previous example to complete again in ~9 passes.
--- arch/x86/net/bpf_jit_comp.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +11 -1
@@ -992,7 +992,17 @@ emit_cond_jmp: /* convert BPF opcode tobreak ;case BPF_JMP |BPF_JA : - jmp_offset = addrs[i + insn->off] - addrs[i]; +if (insn->off ==-1 ) +/* -1 jmp instructions will always jump +* backwards two bytes. Explicitly handling +* this case avoids wasting too many passes +* when there are long sequences of replaced +* dead code. +*/ + jmp_offset =-2 ; +else + jmp_offset = addrs[i + insn->off] - addrs[i]; +if (!jmp_offset)/* optimize out nop jumps */ break ;
Greg Kroah-Hartman
maintainerPATCH 101/279 perf/x86/intel: Dont enable freeze-on-smi for PerfMon V1
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <[email protected]>
[ Upstream commit 4e949e9b9d1e3edcdab3b54656c5851bd9e49c67 ]
The SMM freeze feature was introduced since PerfMon V2. But the current code unconditionally enables the feature for all platforms. It can generate #GP exception, if the related FREEZE_WHILE_SMM bit is set for the machine with PerfMon V1.
To disable the feature for PerfMon V1, perf needs to
- Remove the freeze_on_smi sysfs entry by moving intel_pmu_attrs to intel_pmu, which is only applied to PerfMon V2 and later.
- Check the PerfMon version before flipping the SMM bit when starting CPU
--- arch/x86/events/intel/core.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
arch/x86/events/intel/core.c +6 -3
@@ -3331,7 +3331,8 @@ static void intel_pmu_cpu_starting(int c cpuc->lbr_sel =NULL ; -flip_smm_bit (&x86_pmu.attr_freeze_on_smi); +if (x86_pmu.version >1 ) +flip_smm_bit (&x86_pmu.attr_freeze_on_smi);if (!cpuc->shared_regs)return ;
@@ -3494,6 +3495,8 @@ static __initconst const struct x86_pmu .cpu_dying = intel_pmu_cpu_dying, }; +static struct attribute *intel_pmu_attrs[]; +static __initconst const struct x86_pmu intel_pmu = { .name ="Intel" , .handle_irq = intel_pmu_handle_irq,
@@ -3524,6 +3527,8 @@ static __initconst const struct x86_pmu .format_attrs = intel_arch3_formats_attr, .events_sysfs_show = intel_event_sysfs_show, + .attrs = intel_pmu_attrs, + .cpu_prepare = intel_pmu_cpu_prepare, .cpu_starting = intel_pmu_cpu_starting, .cpu_dying = intel_pmu_cpu_dying,
@@ -3902,8 +3907,6 @@ __init int intel_pmu_init(void) x86_pmu.max_pebs_events =min_t (unsigned,MAX_PEBS_EVENTS , x86_pmu.num_counters); - - x86_pmu.attrs = intel_pmu_attrs;/* * Quirk: v2 perfmon does not report fixed-purpose events, so * assume at least 3 events, when not running in a hypervisor:
Greg Kroah-Hartman
maintainerPATCH 102/279 remoteproc: qcom: Fix potential device node leaks
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Jordan <[email protected]>
[ Upstream commit 278d744c46fd4f1925aec77752d18a0e4a9cbec3 ]
Add missing of_node_put()s at two places for device nodes returned by of_parse_phandle().
Hexagon v5")
--- drivers/remoteproc/qcom_q6v5_pil.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/remoteproc/qcom_q6v5_pil.c +2 -0
@@ -1088,6 +1088,7 @@ static int q6v5_alloc_memory_region(strudev_err (qproc->dev,"unable to resolve mba region\n" );return ret; } +of_node_put (node); qproc->mba_phys = r.start; qproc->mba_size =resource_size (&r);
@@ -1105,6 +1106,7 @@ static int q6v5_alloc_memory_region(strudev_err (qproc->dev,"unable to resolve mpss region\n" );return ret; } +of_node_put (node); qproc->mpss_phys = qproc->mpss_reloc = r.start; qproc->mpss_size =resource_size (&r);
Greg Kroah-Hartman
maintainerPATCH 103/279 rpmsg: added MODULE_ALIAS for rpmsg_char
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramon Fried <[email protected]>
[ Upstream commit 93dd4e73c0d9cc32f835d76a54257020b0bfc75a ]
Added "rpmsg:rpmsg_chrdev" MODULE_ALIAS to autoload rpmg_chrdev module automatically.
--- drivers/rpmsg/rpmsg_char.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/rpmsg/rpmsg_char.c +2 -0
@@ -581,4 +581,6 @@ static void rpmsg_chrdev_exit(void)unregister_chrdev_region (rpmsg_major,RPMSG_DEV_MAX ); }module_exit (rpmsg_chrdev_exit); + +MODULE_ALIAS ("rpmsg:rpmsg_chrdev" );MODULE_LICENSE ("GPL v2" );
Greg Kroah-Hartman
maintainerPATCH 104/279 HID: intel-ish-hid: use put_device() instead of kfree()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arvind Yadav <[email protected]>
[ Upstream commit a4eb490a41a0da3b1275fc7427084cf9ae2c3c1c ]
Never directly free @dev after calling device_register(), even if it returned an error. Always use put_device() to give up the reference initialized.
--- drivers/hid/intel-ish-hid/ishtp/bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/intel-ish-hid/ishtp/bus.c +1 -1
@@ -418,7 +418,7 @@ static struct ishtp_cl_device *ishtp_buslist_del (&device->device_link);spin_unlock_irqrestore (&dev->device_list_lock, flags);dev_err (dev->devc,"Failed to register ISHTP client device\n" ); -kfree (device); +put_device (&device->dev);return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 105/279 blk-mq: fix sysfs inflight counter
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <[email protected]>
[ Upstream commit bf0ddaba65ddbb2715af97041da8e7a45b2d8628 ]
When the blk-mq inflight implementation was added, /proc/diskstats was converted to use it, but /sys/block/$dev/inflight was not. Fix it by adding another helper to count in-flight requests by data direction.
--- block/blk-mq.c | 19 +++++++++++++++++++ block/blk-mq.h | 4 +++- block/genhd.c | 12 ++++++++++++ block/partition-generic.c | 10 ++++++---- include/linux/genhd.h | 4 +++- 5 files changed, 43 insertions(+), 6 deletions(-)
block/blk-mq.c +19 -0
@@ -118,6 +118,25 @@ void blk_mq_in_flight(struct request_queblk_mq_queue_tag_busy_iter (q, blk_mq_check_inflight, &mi); } +static void blk_mq_check_inflight_rw (struct blk_mq_hw_ctx *hctx, +struct request *rq,void *priv, +bool reserved) +{ +struct mq_inflight *mi = priv; + +if (rq->part == mi->part) + mi->inflight[rq_data_dir (rq)]++; +} + +void blk_mq_in_flight_rw (struct request_queue *q,struct hd_struct *part, +unsigned int inflight[2 ]) +{ +struct mq_inflight mi = { .part = part, .inflight = inflight, }; + + inflight[0 ] = inflight[1 ] =0 ; +blk_mq_queue_tag_busy_iter (q, blk_mq_check_inflight_rw, &mi); +} +void blk_freeze_queue_start (struct request_queue *q) {int freeze_depth;
block/blk-mq.h +3 -1
@@ -185,7 +185,9 @@ static inline bool blk_mq_hw_queue_mappe }void blk_mq_in_flight (struct request_queue *q,struct hd_struct *part, -unsigned int inflight[2 ]); +unsigned int inflight[2 ]); +void blk_mq_in_flight_rw (struct request_queue *q,struct hd_struct *part, +unsigned int inflight[2 ]);static inline void blk_mq_put_dispatch_budget (struct blk_mq_hw_ctx *hctx) {
block/genhd.c +12 -0
@@ -82,6 +82,18 @@ void part_in_flight(struct request_queue } } +void part_in_flight_rw (struct request_queue *q,struct hd_struct *part, +unsigned int inflight[2 ]) +{ +if (q->mq_ops) { +blk_mq_in_flight_rw (q, part, inflight); +return ; + } + + inflight[0 ] =atomic_read (&part->in_flight[0 ]); + inflight[1 ] =atomic_read (&part->in_flight[1 ]); +} +struct hd_struct *__disk_get_part (struct gendisk *disk,int partno) {struct disk_part_tbl *ptbl =rcu_dereference (disk->part_tbl);
block/partition-generic.c +6 -4
@@ -145,13 +145,15 @@ ssize_t part_stat_show(struct device *de jiffies_to_msecs(part_stat_read(p, time_in_queue))); } -ssize_t part_inflight_show (struct device *dev, -struct device_attribute *attr,char *buf) +ssize_t part_inflight_show (struct device *dev,struct device_attribute *attr, +char *buf) {struct hd_struct *p =dev_to_part (dev); +struct request_queue *q =part_to_disk (p)->queue; +unsigned int inflight[2 ]; -return sprintf (buf,"%8u %8u\n" ,atomic_read (&p->in_flight[0 ]), -atomic_read (&p->in_flight[1 ])); +part_in_flight_rw (q, p, inflight); +return sprintf (buf,"%8u %8u\n" , inflight[0 ], inflight[1 ]); }#ifdef CONFIG_FAIL_MAKE_REQUEST
include/linux/genhd.h +3 -1
@@ -368,7 +368,9 @@ static inline void free_part_stats(struc part_stat_add(cpu, gendiskp, field, -subnd)void part_in_flight (struct request_queue *q,struct hd_struct *part, -unsigned int inflight[2 ]); +unsigned int inflight[2 ]); +void part_in_flight_rw (struct request_queue *q,struct hd_struct *part, +unsigned int inflight[2 ]);void part_dec_in_flight (struct request_queue *q,struct hd_struct *part,int rw); void part_inc_in_flight(struct request_queue *q, struct hd_struct *part,
Greg Kroah-Hartman
maintainerPATCH 106/279 arm64: fix possible spectre-v1 in ptrace_hbp_get_event()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 19791a7ca674fb3009bb068260e852a2f05b605c ]
It's possible for userspace to control idx. Sanitize idx when using it as an array index.
Found by smatch.
--- arch/arm64/kernel/ptrace.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
arch/arm64/kernel/ptrace.c +10 -4
@@ -25,6 +25,7 @@#include <linux/sched/signal.h> #include <linux/sched/task_stack.h> #include <linux/mm.h> +#include <linux/nospec.h> #include <linux/smp.h> #include <linux/ptrace.h> #include <linux/user.h>
@@ -249,15 +250,20 @@ static struct perf_event *ptrace_hbp_getswitch (note_type) {case NT_ARM_HW_BREAK : -if (idx <ARM_MAX_BRP ) - bp = tsk->thread.debug.hbp_break[idx]; +if (idx >=ARM_MAX_BRP ) + goto out; + idx =array_index_nospec (idx,ARM_MAX_BRP ); + bp = tsk->thread.debug.hbp_break[idx];break ;case NT_ARM_HW_WATCH : -if (idx <ARM_MAX_WRP ) - bp = tsk->thread.debug.hbp_watch[idx]; +if (idx >=ARM_MAX_WRP ) + goto out; + idx =array_index_nospec (idx,ARM_MAX_WRP ); + bp = tsk->thread.debug.hbp_watch[idx];break ; } +out:return bp; }
Greg Kroah-Hartman
maintainerPATCH 107/279 KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_mmio_read_apr()
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 5e1ca5e23b167987d5b6d8b08f2d5b7dd2d13f49 ]
It's possible for userspace to control n. Sanitize n when using it as an array index.
Note that while it appears that n must be bound to the interval [0,3] due to the way it is extracted from addr, we cannot guarantee that compiler transformations (and/or future refactoring) will ensure this is the case, and given this is a slow path it's better to always perform the masking.
Found by smatch.
--- virt/kvm/arm/vgic/vgic-mmio-v2.c | 5 +++++ 1 file changed, 5 insertions(+)
virt/kvm/arm/vgic/vgic-mmio-v2.c +5 -0
@@ -14,6 +14,8 @@#include <linux/irqchip/arm-gic.h> #include <linux/kvm.h> #include <linux/kvm_host.h> +#include <linux/nospec.h> +#include <kvm/iodev.h> #include <kvm/arm_vgic.h>
@@ -324,6 +326,9 @@ static unsigned long vgic_mmio_read_apr(if (n >vgic_v3_max_apr_idx (vcpu))return 0 ; + + n =array_index_nospec (n,4 ); +/* GICv3 only uses ICH_AP1Rn for memory mapped (GICv2) guests */ return vgicv3->vgic_ap1r[n]; }
Greg Kroah-Hartman
maintainerPATCH 108/279 libahci: Allow drivers to override stop_engine
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evan Wang <[email protected]>
[ Upstream commit fa89f53bd7288d6aa7a982841119e7123faf5a53 ]
Marvell armada37xx, armada7k and armada8k share the same AHCI sata controller IP, and currently there is an issue (Errata Ref#226)that the SATA can not be detected via SATA Port-MultiPlayer(PMP). After debugging, the reason is found that the value of Port-x FIS-based Switching Control (PxFBS@0x40) became wrong.
According to design, the bits[11:8, 0] of register PxFBS are cleared when Port Command and Status (0x18) bit[0] changes its value from 1 to 0, i.e. falling edge of Port Command and Status bit[0] sends PULSE that resets PxFBS bits[11:8; 0].
So it needs save the port PxFBS register before PxCMD ST write and restore the port PxFBS register afterwards in ahci_stop_engine().
This commit allows drivers to override ahci_stop_engine behavior for use by the Marvell AHCI driver(and potentially other drivers in the future).
--- drivers/ata/ahci.c | 6 +++--- drivers/ata/ahci.h | 7 +++++++ drivers/ata/ahci_qoriq.c | 2 +- drivers/ata/ahci_xgene.c | 4 ++-- drivers/ata/libahci.c | 20 ++++++++++++-------- drivers/ata/sata_highbank.c | 2 +- 6 files changed, 26 insertions(+), 15 deletions(-)
drivers/ata/ahci.c +3 -3
@@ -699,7 +699,7 @@ static int ahci_vt8251_hardreset(structDPRINTK ("ENTER\n" ); -ahci_stop_engine (ap); + hpriv->stop_engine (ap); rc =sata_link_hardreset (link,sata_ehc_deb_timing (&link->eh_context), deadline, &online,NULL );
@@ -725,7 +725,7 @@ static int ahci_p5wdh_hardreset(struct abool online;int rc; -ahci_stop_engine (ap); + hpriv->stop_engine (ap);/* clear D2H reception area to properly wait for D2H FIS */ ata_tf_init (link->device, &tf);
@@ -789,7 +789,7 @@ static int ahci_avn_hardreset(struct ataDPRINTK ("ENTER\n" ); -ahci_stop_engine (ap); + hpriv->stop_engine (ap);for (i =0 ; i <2 ; i++) {u16 val;
drivers/ata/ahci.h +7 -0
@@ -365,6 +365,13 @@ struct ahci_host_priv {* be overridden anytime before the host is activated. */ void (*start_engine)(struct ata_port *ap); +/* +* Optional ahci_stop_engine override, if not set this gets set to the +* default ahci_stop_engine during ahci_save_initial_config, this can +* be overridden anytime before the host is activated. +*/ +int (*stop_engine)(struct ata_port *ap); +irqreturn_t (*irq_handler)(int irq,void *dev_instance);/* only required for per-port MSI(-X) support */
drivers/ata/ahci_qoriq.c +1 -1
@@ -96,7 +96,7 @@ static int ahci_qoriq_hardreset(struct aDPRINTK ("ENTER\n" ); -ahci_stop_engine (ap); + hpriv->stop_engine (ap);/* * There is a errata on ls1021a Rev1.0 and Rev2.0 which is:
drivers/ata/ahci_xgene.c +2 -2
@@ -165,7 +165,7 @@ static int xgene_ahci_restart_engine(str PORT_CMD_ISSUE, 0x0, 1, 100))return -EBUSY ; -ahci_stop_engine (ap); + hpriv->stop_engine (ap);ahci_start_fis_rx (ap);/*
@@ -421,7 +421,7 @@ static int xgene_ahci_hardreset(struct a portrxfis_saved =readl (port_mmio +PORT_FIS_ADDR ); portrxfishi_saved =readl (port_mmio +PORT_FIS_ADDR_HI ); -ahci_stop_engine (ap); + hpriv->stop_engine (ap); rc =xgene_ahci_do_hardreset (link, deadline, &online);
drivers/ata/libahci.c +12 -8
@@ -560,6 +560,9 @@ void ahci_save_initial_config(struct devif (!hpriv->start_engine) hpriv->start_engine = ahci_start_engine; +if (!hpriv->stop_engine) + hpriv->stop_engine = ahci_stop_engine; +if (!hpriv->irq_handler) hpriv->irq_handler = ahci_single_level_irq_intr; }
@@ -897,9 +900,10 @@ static void ahci_start_port(struct ata_pstatic int ahci_deinit_port (struct ata_port *ap,const char **emsg) {int rc; +struct ahci_host_priv *hpriv = ap->host->private_data;/* disable DMA */ - rc =ahci_stop_engine (ap); + rc = hpriv->stop_engine (ap);if (rc) { *emsg ="failed to stop engine" ;return rc;
@@ -1310,7 +1314,7 @@ int ahci_kick_engine(struct ata_port *apint busy, rc;/* stop engine */ - rc =ahci_stop_engine (ap); + rc = hpriv->stop_engine (ap);if (rc) goto out_restart;
@@ -1549,7 +1553,7 @@ int ahci_do_hardreset(struct ata_link *lDPRINTK ("ENTER\n" ); -ahci_stop_engine (ap); + hpriv->stop_engine (ap);/* clear D2H reception area to properly wait for D2H FIS */ ata_tf_init (link->device, &tf);
@@ -2075,14 +2079,14 @@ void ahci_error_handler(struct ata_portif (!(ap->pflags &ATA_PFLAG_FROZEN )) {/* restart engine */ -ahci_stop_engine (ap); + hpriv->stop_engine (ap); hpriv->start_engine (ap); }sata_pmp_error_handler (ap);if (!ata_dev_enabled (ap->link.device)) -ahci_stop_engine (ap); + hpriv->stop_engine (ap); }EXPORT_SYMBOL_GPL (ahci_error_handler);
@@ -2129,7 +2133,7 @@ static void ahci_set_aggressive_devslp(sreturn ;/* set DITO, MDAT, DETO and enable DevSlp, need to stop engine first */ - rc =ahci_stop_engine (ap); + rc = hpriv->stop_engine (ap);if (rc)return ;
@@ -2189,7 +2193,7 @@ static void ahci_enable_fbs(struct ata_preturn ; } - rc =ahci_stop_engine (ap); + rc = hpriv->stop_engine (ap);if (rc)return ;
@@ -2222,7 +2226,7 @@ static void ahci_disable_fbs(struct ata_return ; } - rc =ahci_stop_engine (ap); + rc = hpriv->stop_engine (ap);if (rc)return ;
drivers/ata/sata_highbank.c +1 -1
@@ -410,7 +410,7 @@ static int ahci_highbank_hardreset(strucint rc;int retry =100 ; -ahci_stop_engine (ap); + hpriv->stop_engine (ap);/* clear D2H reception area to properly wait for D2H FIS */ ata_tf_init (link->device, &tf);
Greg Kroah-Hartman
maintainerPATCH 109/279 ata: ahci: mvebu: override ahci_stop_engine for mvebu AHCI
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evan Wang <[email protected]>
[ Upstream commit daa2e3bdbb0b3e691cf20a042350817310cb8cb5 ]
There is an issue(Errata Ref#226) that the SATA can not be detected via SATA Port-MultiPlayer(PMP) with following error log:
ata1.15: PMP product ID mismatch
ata1.15: SATA link up 6.0 Gbps (SStatus 133 SControl 300) ata1.15: Port Multiplier vendor mismatch '0x1b4b'!='0x0' ata1.15: PMP revalidation failed (errno=-19)
After debugging, the reason is found that the value Port-x FIS-based Switching Control(PxFBS@0x40) become wrong. According to design, the bits[11:8, 0] of register PxFBS are cleared when Port Command and Status (0x18) bit[0] changes its value from 1 to 0, i.e. falling edge of Port Command and Status bit[0] sends PULSE that resets PxFBS bits[11:8; 0].
So it needs a mvebu SATA WA to save the port PxFBS register before PxCMD ST write and restore it afterwards.
This patch implements the WA in a separate function of ahci_mvebu_stop_engine to override ahci_stop_gngine.
--- drivers/ata/ahci_mvebu.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+)
drivers/ata/ahci_mvebu.c +56 -0
@@ -62,6 +62,60 @@ static void ahci_mvebu_regret_option(strwritel (0x80 , hpriv->mmio +AHCI_VENDOR_SPECIFIC_0_DATA ); } +/** +* ahci_mvebu_stop_engine +* +* @ap: Target ata port +* +* Errata Ref#226 - SATA Disk HOT swap issue when connected through +* Port Multiplier in FIS-based Switching mode. +* +* To avoid the issue, according to design, the bits[11:8, 0] of +* register PxFBS are cleared when Port Command and Status (0x18) bit[0] +* changes its value from 1 to 0, i.e. falling edge of Port +* Command and Status bit[0] sends PULSE that resets PxFBS +* bits[11:8; 0]. +* +* This function is used to override function of "ahci_stop_engine" +* from libahci.c by adding the mvebu work around(WA) to save PxFBS +* value before the PxCMD ST write of 0, then restore PxFBS value. +* +* Return: 0 on success; Error code otherwise. +*/ +int ahci_mvebu_stop_engine (struct ata_port *ap) +{ +void __iomem *port_mmio =ahci_port_base (ap); +u32 tmp, port_fbs; + + tmp =readl (port_mmio +PORT_CMD ); + +/* check if the HBA is idle */ +if ((tmp & (PORT_CMD_START |PORT_CMD_LIST_ON )) ==0 ) +return 0 ; + +/* save the port PxFBS register for later restore */ + port_fbs =readl (port_mmio +PORT_FBS ); + +/* setting HBA to idle */ + tmp &= ~PORT_CMD_START ; +writel (tmp, port_mmio +PORT_CMD ); + +/* +* bit #15 PxCMD signal doesn't clear PxFBS, +* restore the PxFBS register right after clearing the PxCMD ST, +* no need to wait for the PxCMD bit #15. +*/ +writel (port_fbs, port_mmio +PORT_FBS ); + +/* wait for engine to stop. This could be as long as 500 msec */ + tmp =ata_wait_register (ap, port_mmio +PORT_CMD , +PORT_CMD_LIST_ON ,PORT_CMD_LIST_ON ,1 ,500 ); +if (tmp &PORT_CMD_LIST_ON ) +return -EIO ; + +return 0 ; +} +#ifdef CONFIG_PM_SLEEP static int ahci_mvebu_suspend (struct platform_device *pdev,pm_message_t state) {
@@ -112,6 +166,8 @@ static int ahci_mvebu_probe(struct platfif (rc)return rc; + hpriv->stop_engine = ahci_mvebu_stop_engine; +if (of_device_is_compatible (pdev->dev.of_node,"marvell,armada-380-ahci" )) { dram =mv_mbus_dram_info ();
Greg Kroah-Hartman
maintainerPATCH 110/279 x86/cpu/intel: Add missing TLB cpuid values
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "[email protected]" <[email protected]>
[ Upstream commit b837913fc2d9061bf9b8c0dd6bf2d24e2f98b84a ]
Make kernel print the correct number of TLB entries on Intel Xeon Phi 7210 (and others)
Before:
[ 0.320005] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0 After: [ 0.320005] Last level dTLB entries: 4KB 256, 2MB 128, 4MB 128, 1GB 16
The entries do exist in the official Intel SMD but the type column there is incorrect (states "Cache" where it should read "TLB"), but the entries for the values 0x6B, 0x6C and 0x6D are correctly described as 'Data TLB'.
--- arch/x86/kernel/cpu/intel.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/cpu/intel.c +3 -0
@@ -751,6 +751,9 @@ static const struct _tlb_table intel_tlb { 0x5d, TLB_DATA_4K_4M, 256, " TLB_DATA 4 KByte and 4 MByte pages" }, { 0x61, TLB_INST_4K, 48, " TLB_INST 4 KByte pages, full associative" }, { 0x63, TLB_DATA_1G, 4, " TLB_DATA 1 GByte pages, 4-way set associative" }, + { 0x6b, TLB_DATA_4K, 256, " TLB_DATA 4 KByte pages, 8-way associative" }, + { 0x6c, TLB_DATA_2M_4M, 128, " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" }, + { 0x6d, TLB_DATA_1G, 16, " TLB_DATA 1 GByte pages, fully associative" }, { 0x76, TLB_INST_2M_4M, 8, " TLB_INST 2-MByte or 4-MByte pages, fully associative" }, { 0xb0, TLB_INST_4K, 128, " TLB_INST 4 KByte pages, 4-way set associative" }, { 0xb1, TLB_INST_2M_4M, 4, " TLB_INST 2M pages, 4-way, 8 entries or 4M pages, 4-way entries" },
Greg Kroah-Hartman
maintainerPATCH 112/279 vti6: Change minimum MTU to IPV4_MIN_MTU, vti6 can carry IPv4 too
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Brivio <[email protected]>
[ Upstream commit b4331a681822b420511b3258f1c3db35001fde48 ]
A vti6 interface can carry IPv4 as well, so it makes no sense to enforce a minimum MTU of IPV6_MIN_MTU.
If the user sets an MTU below IPV6_MIN_MTU, IPv6 will be disabled on the interface, courtesy of addrconf_notify().
--- net/ipv6/ip6_vti.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/ip6_vti.c +2 -2
@@ -669,7 +669,7 @@ static void vti6_link_config(struct ip6_else mtu =ETH_DATA_LEN -LL_MAX_HEADER -sizeof (struct ipv6hdr ); - dev->mtu =max_t (int, mtu,IPV6_MIN_MTU ); + dev->mtu =max_t (int, mtu,IPV4_MIN_MTU ); }/**
@@ -881,7 +881,7 @@ static void vti6_dev_setup(struct net_de dev->priv_destructor = vti6_dev_free; dev->type =ARPHRD_TUNNEL6 ; - dev->min_mtu =IPV6_MIN_MTU ; + dev->min_mtu =IPV4_MIN_MTU ; dev->max_mtu =IP_MAX_MTU -sizeof (struct ipv6hdr ); dev->flags |=IFF_NOARP ; dev->addr_len =sizeof (struct in6_addr );
Greg Kroah-Hartman
maintainerPATCH 113/279 powerpc/kvm/booke: Fix altivec related build break
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurentiu Tudor <[email protected]>
[ Upstream commit b2d7ecbe355698010a6b7a15eb179e09eb3d6a34 ]
Add missing "altivec unavailable" interrupt injection helper thus fixing the linker error below:
arch/powerpc/kvm/emulate_loadstore.o: In function `kvmppc_check_altivec_disabled':
arch/powerpc/kvm/emulate_loadstore.c: undefined reference to `.kvmppc_core_queue_vec_unavail'
--- arch/powerpc/kvm/booke.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/powerpc/kvm/booke.c +7 -0
@@ -305,6 +305,13 @@ void kvmppc_core_queue_fpunavail(structkvmppc_booke_queue_irqprio (vcpu,BOOKE_IRQPRIO_FP_UNAVAIL ); } +#ifdef CONFIG_ALTIVEC +void kvmppc_core_queue_vec_unavail (struct kvm_vcpu *vcpu) +{ +kvmppc_booke_queue_irqprio (vcpu,BOOKE_IRQPRIO_ALTIVEC_UNAVAIL ); +} +#endif +void kvmppc_core_queue_dec (struct kvm_vcpu *vcpu) {kvmppc_booke_queue_irqprio (vcpu,BOOKE_IRQPRIO_DECREMENTER );
Greg Kroah-Hartman
maintainerPATCH 114/279 reset: uniphier: fix USB clock line for LD20
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit e6914365fd280fce303a89b8a8d4529af5a2e0f9 ]
For LD20, the bit 5 of the offset 0x200c turned out to be a USB3 reset. The hardware document says it is the GIO reset despite LD20 has no GIO bus, confusingly.
Also, fix confusing comments for PXs3.
--- drivers/reset/reset-uniphier.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/reset/reset-uniphier.c +3 -3
@@ -107,7 +107,7 @@ static const struct uniphier_reset_dataUNIPHIER_RESETX (4 ,0x200c ,2 ),/* eMMC */ UNIPHIER_RESETX (6 ,0x200c ,6 ),/* Ether */ UNIPHIER_RESETX (8 ,0x200c ,8 ),/* STDMAC (HSC) */ -UNIPHIER_RESETX (12 ,0x200c ,5 ),/* GIO (PCIe, USB3) */ +UNIPHIER_RESETX (14 ,0x200c ,5 ),/* USB30 */ UNIPHIER_RESETX (16 ,0x200c ,12 ),/* USB30-PHY0 */ UNIPHIER_RESETX (17 ,0x200c ,13 ),/* USB30-PHY1 */ UNIPHIER_RESETX(18, 0x200c, 14), /* USB30-PHY2 */
@@ -122,8 +122,8 @@ static const struct uniphier_reset_dataUNIPHIER_RESETX (2 ,0x200c ,0 ),/* NAND */ UNIPHIER_RESETX (4 ,0x200c ,2 ),/* eMMC */ UNIPHIER_RESETX (8 ,0x200c ,12 ),/* STDMAC */ -UNIPHIER_RESETX (12 ,0x200c ,4 ),/* USB30 link (GIO0) */ -UNIPHIER_RESETX (13 ,0x200c ,5 ),/* USB31 link (GIO1) */ +UNIPHIER_RESETX (12 ,0x200c ,4 ),/* USB30 link */ +UNIPHIER_RESETX (13 ,0x200c ,5 ),/* USB31 link */ UNIPHIER_RESETX (16 ,0x200c ,16 ),/* USB30-PHY0 */ UNIPHIER_RESETX (17 ,0x200c ,18 ),/* USB30-PHY1 */ UNIPHIER_RESETX(18, 0x200c, 20), /* USB30-PHY2 */
Greg Kroah-Hartman
maintainerPATCH 115/279 i2c: sprd: Prevent i2c accesses after suspend is called
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Wang <[email protected]>
[ Upstream commit da33aa03fa34c918faf2c371ebda0dd961d7ccb2 ]
Add one flag to indicate if the i2c controller has been in suspend state, which can prevent i2c accesses after i2c controller is suspended following system suspend.
--- drivers/i2c/busses/i2c-sprd.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/i2c/busses/i2c-sprd.c +16 -0
@@ -86,6 +86,7 @@ struct sprd_i2c {u32 count;int irq;int err; +bool is_suspended; };static void sprd_i2c_set_count (struct sprd_i2c *i2c_dev,u32 count)
@@ -283,6 +284,9 @@ static int sprd_i2c_master_xfer(struct istruct sprd_i2c *i2c_dev = i2c_adap->algo_data;int im, ret; +if (i2c_dev->is_suspended) +return -EBUSY ; + ret =pm_runtime_get_sync (i2c_dev->dev);if (ret <0 )return ret;
@@ -586,11 +590,23 @@ static int sprd_i2c_remove(struct platfostatic int __maybe_unused sprd_i2c_suspend_noirq (struct device *pdev) { +struct sprd_i2c *i2c_dev =dev_get_drvdata (pdev); + +i2c_lock_adapter (&i2c_dev->adap); + i2c_dev->is_suspended = true; +i2c_unlock_adapter (&i2c_dev->adap); +return pm_runtime_force_suspend (pdev); }static int __maybe_unused sprd_i2c_resume_noirq (struct device *pdev) { +struct sprd_i2c *i2c_dev =dev_get_drvdata (pdev); + +i2c_lock_adapter (&i2c_dev->adap); + i2c_dev->is_suspended = false; +i2c_unlock_adapter (&i2c_dev->adap); +return pm_runtime_force_resume (pdev); }
Greg Kroah-Hartman
maintainerPATCH 116/279 i2c: sprd: Fix the i2c count issue
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Wang <[email protected]>
[ Upstream commit 2a010461207cc96bee5ab81748325dec1972976f ]
We found the I2C controller count register is unreliable sometimes, that will cause I2C to lose data. Thus we can read the data count from 'i2c_dev->count' instead of the I2C controller count register.
--- drivers/i2c/busses/i2c-sprd.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-sprd.c +2 -4
@@ -368,13 +368,12 @@ static irqreturn_t sprd_i2c_isr_thread(istruct sprd_i2c *i2c_dev = dev_id;struct i2c_msg *msg = i2c_dev->msg;bool ack = !(readl (i2c_dev->base +I2C_STATUS ) &I2C_RX_ACK ); -u32 i2c_count =readl (i2c_dev->base +I2C_COUNT );u32 i2c_tran;if (msg->flags &I2C_M_RD ) i2c_tran = i2c_dev->count >=I2C_FIFO_FULL_THLD ;else - i2c_tran = i2c_count; + i2c_tran = i2c_dev->count;/* * If we got one ACK from slave when writing data, and we did not
@@ -412,14 +411,13 @@ static irqreturn_t sprd_i2c_isr(int irq, {struct sprd_i2c *i2c_dev = dev_id;struct i2c_msg *msg = i2c_dev->msg; -u32 i2c_count =readl (i2c_dev->base +I2C_COUNT );bool ack = !(readl (i2c_dev->base +I2C_STATUS ) &I2C_RX_ACK );u32 i2c_tran;if (msg->flags &I2C_M_RD ) i2c_tran = i2c_dev->count >=I2C_FIFO_FULL_THLD ;else - i2c_tran = i2c_count; + i2c_tran = i2c_dev->count;/* * If we did not get one ACK from slave when writing data, then we
Greg Kroah-Hartman
maintainerPATCH 117/279 RDMA/mlx5: Properly check return value of mlx5_get_uars_page
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 444261ca6ff201fa03de97a5041237e67a9d8d31 ]
Starting from commit 72f36be06138 ("net/mlx5: Fix mlx5_get_uars_page to return error code") the mlx5_get_uars_page() call returns error in case of failure, but it was mistakenly overlooked in the merge commit.
--- drivers/infiniband/hw/mlx5/main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/infiniband/hw/mlx5/main.c +1 -3
@@ -4833,9 +4833,7 @@ static void mlx5_ib_stage_cong_debugfs_cstatic int mlx5_ib_stage_uar_init (struct mlx5_ib_dev *dev) { dev->mdev->priv.uar =mlx5_get_uars_page (dev->mdev); -if (!dev->mdev->priv.uar) -return -ENOMEM ; -return 0 ; +return PTR_ERR_OR_ZERO (dev->mdev->priv.uar); }static void mlx5_ib_stage_uar_cleanup (struct mlx5_ib_dev *dev)
Greg Kroah-Hartman
maintainerPATCH 118/279 tipc: fix bug in function tipc_nl_node_dump_monitor
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Maloy <[email protected]>
[ Upstream commit 7dbc73e6124ce4d0cfbdd6166de388e9367c47ad ]
Commit 36a50a989ee8 ("tipc: fix infinite loop when dumping link monitor summary") intended to fix a problem with user tool looping when max number of bearers are enabled.
Unfortunately, the wrong version of the commit was posted, so the problem was not solved at all.
This commit adds the missing part.
--- net/tipc/node.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/node.c +1 -1
@@ -2157,7 +2157,7 @@ int tipc_nl_node_dump_monitor(struct sk_rtnl_lock ();for (bearer_id = prev_bearer; bearer_id <MAX_BEARERS ; bearer_id++) { - err =__tipc_nl_add_monitor (net, &msg, prev_bearer); + err =__tipc_nl_add_monitor (net, &msg, bearer_id);if (err)break ; }
Greg Kroah-Hartman
maintainerPATCH 119/279 nfp: dont depend on eth_tbl being available
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit c55ca688ed99a9cb79367aee2ed2ff6cb80fc039 ]
For very very old generation of the management FW Ethernet port information table may theoretically not be available. This in turn will cause the nfp_port structures to not be allocated.
Make sure we don't crash the kernel when there is no eth_tbl:
RIP: 0010:nfp_net_pci_probe+0xf2/0xb40 [nfp] ... Call Trace: nfp_pci_probe+0x6de/0xab0 [nfp] local_pci_probe+0x47/0xa0 work_for_cpu_fn+0x1a/0x30 process_one_work+0x1de/0x3e0
Found while working with broken/development version of management FW.
--- drivers/net/ethernet/netronome/nfp/flower/main.c | 2 - drivers/net/ethernet/netronome/nfp/nfp_app_nic.c | 2 - drivers/net/ethernet/netronome/nfp/nfp_main.h | 4 ++ drivers/net/ethernet/netronome/nfp/nfp_net_main.c | 31 ++++++++++++---------- 4 files changed, 23 insertions(+), 16 deletions(-)
drivers/net/ethernet/netronome/nfp/flower/main.c +1 -1
@@ -358,7 +358,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_ap }SET_NETDEV_DEV (repr, &priv->nn->pdev->dev); -nfp_net_get_mac_addr (app->pf, port); +nfp_net_get_mac_addr (app->pf, repr, port); cmsg_port_id =nfp_flower_cmsg_phys_port (phys_port); err = nfp_repr_init(app, repr,
drivers/net/ethernet/netronome/nfp/nfp_app_nic.c +1 -1
@@ -69,7 +69,7 @@ int nfp_app_nic_vnic_alloc(struct nfp_apif (err)return err <0 ? err :0 ; -nfp_net_get_mac_addr (app->pf, nn->port); +nfp_net_get_mac_addr (app->pf, nn->dp.netdev, nn->port);return 0 ; }
drivers/net/ethernet/netronome/nfp/nfp_main.h +3 -1
@@ -171,7 +171,9 @@ void nfp_net_pci_remove(struct nfp_pf *pint nfp_hwmon_register (struct nfp_pf *pf);void nfp_hwmon_unregister (struct nfp_pf *pf); -void nfp_net_get_mac_addr (struct nfp_pf *pf,struct nfp_port *port); +void +nfp_net_get_mac_addr (struct nfp_pf *pf,struct net_device *netdev, +struct nfp_port *port);bool nfp_ctrl_tx (struct nfp_net *nn,struct sk_buff *skb);
drivers/net/ethernet/netronome/nfp/nfp_net_main.c +18 -13
@@ -67,23 +67,26 @@/** * nfp_net_get_mac_addr() - Get the MAC address. * @pf: NFP PF handle +* @netdev: net_device to set MAC address on * @port: NFP port structure * * First try to get the MAC address from NSP ETH table. If that * fails generate a random address. */ -void nfp_net_get_mac_addr (struct nfp_pf *pf,struct nfp_port *port) +void +nfp_net_get_mac_addr (struct nfp_pf *pf,struct net_device *netdev, +struct nfp_port *port) {struct nfp_eth_table_port *eth_port; eth_port =__nfp_port_get_eth_port (port);if (!eth_port) { -eth_hw_addr_random (port->netdev); +eth_hw_addr_random (netdev);return ; } -ether_addr_copy (port->netdev->dev_addr, eth_port->mac_addr); -ether_addr_copy (port->netdev->perm_addr, eth_port->mac_addr); +ether_addr_copy (netdev->dev_addr, eth_port->mac_addr); +ether_addr_copy (netdev->perm_addr, eth_port->mac_addr); } static struct nfp_eth_table_port *
@@ -511,16 +514,18 @@ static int nfp_net_pci_map_mem(struct nfreturn PTR_ERR (mem); } - min_size =NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index +1 ); - pf->mac_stats_mem =nfp_rtsym_map (pf->rtbl,"_mac_stats" , -"net.macstats" , min_size, - &pf->mac_stats_bar); -if (IS_ERR (pf->mac_stats_mem)) { -if (PTR_ERR (pf->mac_stats_mem) != -ENOENT ) { - err =PTR_ERR (pf->mac_stats_mem); - goto err_unmap_ctrl; +if (pf->eth_tbl) { + min_size =NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index +1 ); + pf->mac_stats_mem =nfp_rtsym_map (pf->rtbl,"_mac_stats" , +"net.macstats" , min_size, + &pf->mac_stats_bar); +if (IS_ERR (pf->mac_stats_mem)) { +if (PTR_ERR (pf->mac_stats_mem) != -ENOENT ) { + err =PTR_ERR (pf->mac_stats_mem); + goto err_unmap_ctrl; + } + pf->mac_stats_mem =NULL ; } - pf->mac_stats_mem =NULL ; } pf->vf_cfg_mem = nfp_net_pf_map_rtsym(pf, "net.vfcfg",
Greg Kroah-Hartman
maintainerPATCH 120/279 nvme: depend on INFINIBAND_ADDR_TRANS
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Thelen <[email protected]>
[ Upstream commit 3af7a156bdc356946098e13180be66b6420619bf ]
NVME_RDMA code depends on INFINIBAND_ADDR_TRANS provided symbols. So declare the kconfig dependency. This is necessary to allow for enabling INFINIBAND without INFINIBAND_ADDR_TRANS.
--- drivers/nvme/host/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/Kconfig +1 -1
@@ -27,7 +27,7 @@ config NVME_FABRICS config NVME_RDMA tristate "NVM Express over Fabrics RDMA host driver" - depends on INFINIBAND && BLOCK + depends on INFINIBAND && INFINIBAND_ADDR_TRANS && BLOCK select NVME_CORE select NVME_FABRICS select SG_POOL
Greg Kroah-Hartman
maintainerPATCH 121/279 nvmet-rdma: depend on INFINIBAND_ADDR_TRANS
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Thelen <[email protected]>
[ Upstream commit d6fc6a22fc7d3df987666725496ed5dd2dd30f23 ]
NVME_TARGET_RDMA code depends on INFINIBAND_ADDR_TRANS provided symbols. So declare the kconfig dependency. This is necessary to allow for enabling INFINIBAND without INFINIBAND_ADDR_TRANS.
--- drivers/nvme/target/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/target/Kconfig +1 -1
@@ -27,7 +27,7 @@ config NVME_TARGET_LOOP config NVME_TARGET_RDMA tristate "NVMe over Fabrics RDMA target support" - depends on INFINIBAND + depends on INFINIBAND && INFINIBAND_ADDR_TRANS depends on NVME_TARGET select SGL_ALLOC help
Greg Kroah-Hartman
maintainerPATCH 122/279 ib_srpt: depend on INFINIBAND_ADDR_TRANS
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Thelen <[email protected]>
[ Upstream commit 346a47b65d10e450778ec0d21e4a9409f25daaa8 ]
INFINIBAND_SRPT code depends on INFINIBAND_ADDR_TRANS provided symbols. So declare the kconfig dependency. This is necessary to allow for enabling INFINIBAND without INFINIBAND_ADDR_TRANS.
--- drivers/infiniband/ulp/srpt/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/srpt/Kconfig +1 -1
@@ -1,6 +1,6 @@ config INFINIBAND_SRPT tristate "InfiniBand SCSI RDMA Protocol target support" - depends on INFINIBAND && TARGET_CORE + depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE ---help--- Support for the SCSI RDMA Protocol (SRP) Target driver. The
Greg Kroah-Hartman
maintainerPATCH 123/279 cifs: smbd: depend on INFINIBAND_ADDR_TRANS
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Thelen <[email protected]>
[ Upstream commit 3c6b03d18df657d677808d7090b4d03bc6026efd ]
CIFS_SMB_DIRECT code depends on INFINIBAND_ADDR_TRANS provided symbols. So declare the kconfig dependency. This is necessary to allow for enabling INFINIBAND without INFINIBAND_ADDR_TRANS.
--- fs/cifs/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/Kconfig +1 -1
@@ -198,7 +198,7 @@ config CIFS_SMB311 config CIFS_SMB_DIRECT bool "SMB Direct support (Experimental)" - depends on CIFS=m && INFINIBAND || CIFS=y && INFINIBAND=y + depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y help Enables SMB Direct experimental support for SMB 3.0, 3.02 and 3.1.1. SMB Direct allows transferring SMB packets over RDMA. If unsure,
Greg Kroah-Hartman
maintainerPATCH 124/279 ib_srp: depend on INFINIBAND_ADDR_TRANS
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Thelen <[email protected]>
[ Upstream commit 5a3bc8a4abbd2d553430218d3a320400dce811b7 ]
INFINIBAND_SRP code depends on INFINIBAND_ADDR_TRANS provided symbols. So declare the kconfig dependency. This is necessary to allow for enabling INFINIBAND without INFINIBAND_ADDR_TRANS.
--- drivers/infiniband/ulp/srp/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/srp/Kconfig +1 -1
@@ -1,6 +1,6 @@ config INFINIBAND_SRP tristate "InfiniBand SCSI RDMA Protocol" - depends on SCSI + depends on SCSI && INFINIBAND_ADDR_TRANS select SCSI_SRP_ATTRS ---help--- Support for the SCSI RDMA Protocol over InfiniBand. This
Greg Kroah-Hartman
maintainerPATCH 125/279 IB: make INFINIBAND_ADDR_TRANS configurable
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Thelen <[email protected]>
[ Upstream commit f7cb7b85be55a4906b4b4b30596db1043dae6335 ]
Allow INFINIBAND without INFINIBAND_ADDR_TRANS because fuzzing has been finding fair number of CM bugs. So provide option to disable it.
--- drivers/infiniband/Kconfig | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/infiniband/Kconfig +4 -1
@@ -62,9 +62,12 @@ config INFINIBAND_ON_DEMAND_PAGING pages on demand instead. config INFINIBAND_ADDR_TRANS - bool + bool "RDMA/CM" depends on INFINIBAND default y + ---help--- + Support for RDMA communication manager (CM). + This allows for a generic connection abstraction over RDMA. config INFINIBAND_ADDR_TRANS_CONFIGFS bool
Greg Kroah-Hartman
maintainerPATCH 126/279 net: mvpp2: Fix clk error path in mvpp2_probe
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Chevallier <[email protected]>
[ Upstream commit 45f972adb7f4db2d7f02af728ccd104113336074 ]
When clk_prepare_enable fails for the axi_clk, the mg_clk isn't properly cleaned up. Add another jump label to handle that case, and make sure we jump to it in the later error cases.
--- drivers/net/ethernet/marvell/mvpp2.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/net/ethernet/marvell/mvpp2.c +8 -7
@@ -8332,12 +8332,12 @@ static int mvpp2_probe(struct platform_dif (IS_ERR (priv->axi_clk)) { err =PTR_ERR (priv->axi_clk);if (err == -EPROBE_DEFER ) - goto err_gop_clk; + goto err_mg_clk; priv->axi_clk =NULL ; }else { err =clk_prepare_enable (priv->axi_clk);if (err <0 ) - goto err_gop_clk; + goto err_mg_clk; }/* Get system's tclk rate */
@@ -8351,7 +8351,7 @@ static int mvpp2_probe(struct platform_dif (priv->hw_version ==MVPP22 ) { err =dma_set_mask (&pdev->dev,MVPP2_DESC_DMA_MASK );if (err) - goto err_mg_clk; + goto err_axi_clk;/* Sadly, the BM pools all share the same register to * store the high 32 bits of their address. So they * must all have the same high 32 bits, which forces
@@ -8359,14 +8359,14 @@ static int mvpp2_probe(struct platform_d*/ err =dma_set_coherent_mask (&pdev->dev,DMA_BIT_MASK (32 ));if (err) - goto err_mg_clk; + goto err_axi_clk; }/* Initialize network controller */ err =mvpp2_init (pdev, priv);if (err <0 ) {dev_err (&pdev->dev,"failed to initialize controller\n" ); - goto err_mg_clk; + goto err_axi_clk; }/* Initialize ports */
@@ -8379,7 +8379,7 @@ static int mvpp2_probe(struct platform_dif (priv->port_count ==0 ) {dev_err (&pdev->dev,"no ports enabled\n" ); err = -ENODEV ; - goto err_mg_clk; + goto err_axi_clk; }/* Statistics must be gathered regularly because some of them (like
@@ -8407,8 +8407,9 @@ err_port_probe:mvpp2_port_remove (priv->port_list[i]); i++; } -err_mg_clk: +err_axi_clk:clk_disable_unprepare (priv->axi_clk); +err_mg_clk:if (priv->hw_version ==MVPP22 )clk_disable_unprepare (priv->mg_clk); err_gop_clk:
Greg Kroah-Hartman
maintainerPATCH 128/279 IB/uverbs: Fix validating mandatory attributes
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matan Barak <[email protected]>
[ Upstream commit f604db645a66b7ba4f21c426fe73253928dada41 ]
Previously, if a method contained mandatory attributes in a namespace that wasn't given by the user, these attributes weren't validated. Fixing this by iterating over all specification namespaces.
--- drivers/infiniband/core/uverbs_ioctl.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/infiniband/core/uverbs_ioctl.c +9 -0
@@ -191,6 +191,15 @@ static int uverbs_validate_kernel_mandatreturn -EINVAL ; } +for (; i < method_spec->num_buckets; i++) { +struct uverbs_attr_spec_hash *attr_spec_bucket = + method_spec->attr_buckets[i]; + +if (!bitmap_empty (attr_spec_bucket->mandatory_attrs_bitmask, + attr_spec_bucket->num_attrs)) +return -EINVAL ; + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 129/279 RDMA/cma: Fix use after destroy access to net namespace for IPoIB
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit <[email protected]>
[ Upstream commit 2918c1a900252b4a0c730715ec205437c7daf79d ]
There are few issues with validation of netdevice and listen id lookup for IB (IPoIB) while processing incoming CM request as below.
1. While performing lookup of bind_list in cma_ps_find(), net namespace of the netdevice can get deleted in cma_exit_net(), resulting in use after free access of idr and/or net namespace structures. This lookup occurs from the workqueue context (and not userspace context where net namespace is always valid).
CPU0 CPU1
==== ==== bind_list = cma_ps_find();
move netdevice to new namespace delete net namespace
cma_exit_net()
idr_destroy(idr);
[..]
cma_find_listener(bind_list, ..);
2. While netdevice is validated for IP address in given net namespace, netdevice's net namespace and/or ifindex can change in cma_get_net_dev() and cma_match_net_dev().
Above issues are overcome by using rcu lock along with netdevice UP/DOWN state as described below.
When a net namespace is getting deleted, netdevice is closed and shutdown before moving it back to init_net namespace. change_net_namespace() synchronizes with any existing use of netdevice before changing the netdev properties such as net or ifindex. Once netdevice IFF_UP flags is cleared, such fields are not guaranteed to be valid.
Therefore, rcu lock along with netdevice state check ensures that, while route lookup and cm_id lookup is in progress, netdevice of interest won't migrate to any other net namespace.
This ensures that associated net namespace of netdevice won't get deleted while rcu lock is held for netdevice which is in IFF_UP state.
--- drivers/infiniband/core/cma.c | 53 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 43 insertions(+), 10 deletions(-)
drivers/infiniband/core/cma.c +43 -10
@@ -420,6 +420,8 @@ struct cma_hdr {#define CMA_VERSION 0x00struct cma_req_info { +struct sockaddr_storage listen_addr_storage; +struct sockaddr_storage src_addr_storage;struct ib_device *device;int port;union ib_gid local_gid;
@@ -1373,11 +1375,11 @@ static bool validate_net_dev(struct net_ }static struct net_device *cma_get_net_dev (struct ib_cm_event *ib_event, -const struct cma_req_info *req) +struct cma_req_info *req) { -struct sockaddr_storage listen_addr_storage, src_addr_storage; -struct sockaddr *listen_addr = (struct sockaddr *)&listen_addr_storage, - *src_addr = (struct sockaddr *)&src_addr_storage; +struct sockaddr *listen_addr = + (struct sockaddr *)&req->listen_addr_storage; +struct sockaddr *src_addr = (struct sockaddr *)&req->src_addr_storage;struct net_device *net_dev;const union ib_gid *gid = req->has_gid ? &req->local_gid :NULL ;int err;
@@ -1392,11 +1394,6 @@ static struct net_device *cma_get_net_deif (!net_dev)return ERR_PTR (-ENODEV ); -if (!validate_net_dev (net_dev, listen_addr, src_addr)) { -dev_put (net_dev); -return ERR_PTR (-EHOSTUNREACH ); - } -return net_dev; }
@@ -1532,15 +1529,51 @@ static struct rdma_id_private *cma_id_fr } } +/* +* Net namespace might be getting deleted while route lookup, +* cm_id lookup is in progress. Therefore, perform netdevice +* validation, cm_id lookup under rcu lock. +* RCU lock along with netdevice state check, synchronizes with +* netdevice migrating to different net namespace and also avoids +* case where net namespace doesn't get deleted while lookup is in +* progress. +* If the device state is not IFF_UP, its properties such as ifindex +* and nd_net cannot be trusted to remain valid without rcu lock. +* net/core/dev.c change_net_namespace() ensures to synchronize with +* ongoing operations on net device after device is closed using +* synchronize_net(). +*/ +rcu_read_lock (); +if (*net_dev) { +/* +* If netdevice is down, it is likely that it is administratively +* down or it might be migrating to different namespace. +* In that case avoid further processing, as the net namespace +* or ifindex may change. +*/ +if (((*net_dev)->flags &IFF_UP ) ==0 ) { + id_priv =ERR_PTR (-EHOSTUNREACH ); + goto err; + } + +if (!validate_net_dev (*net_dev, + (struct sockaddr *)&req.listen_addr_storage, + (struct sockaddr *)&req.src_addr_storage)) { + id_priv =ERR_PTR (-EHOSTUNREACH ); + goto err; + } + } + bind_list =cma_ps_find (*net_dev ?dev_net (*net_dev) : &init_net,rdma_ps_from_service_id (req.service_id),cma_port_from_service_id (req.service_id)); id_priv =cma_find_listener (bind_list, cm_id, ib_event, &req, *net_dev); +err: +rcu_read_unlock ();if (IS_ERR (id_priv) && *net_dev) {dev_put (*net_dev); *net_dev =NULL ; } -return id_priv; }
Greg Kroah-Hartman
maintainerPATCH 130/279 RDMA/iwpm: fix memory leak on map_info
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit f96416cea7bce9afe619c15e87fced70f93f9098 ]
In the cases where iwpm_hash_bucket is NULL and where function get_mapinfo_hash_bucket returns NULL then the map_info is never added to hash_bucket_head and hence there is a leak of map_info. Fix this by nullifying hash_bucket_head and if that is null we know that that map_info was not added to hash_bucket_head and hence map_info should be free'd.
Detected by CoverityScan, CID#1222481 ("Resource Leak")
--- drivers/infiniband/core/iwpm_util.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/infiniband/core/iwpm_util.c +4 -1
@@ -114,7 +114,7 @@ int iwpm_create_mapinfo(struct sockaddr_ struct sockaddr_storage *mapped_sockaddr, u8 nl_client) { -struct hlist_head *hash_bucket_head; +struct hlist_head *hash_bucket_head =NULL ;struct iwpm_mapping_info *map_info;unsigned long flags;int ret = -EINVAL ;
@@ -142,6 +142,9 @@ int iwpm_create_mapinfo(struct sockaddr_ } }spin_unlock_irqrestore (&iwpm_mapinfo_lock, flags); + +if (!hash_bucket_head) +kfree (map_info);return ret; }
Greg Kroah-Hartman
maintainerPATCH 131/279 IB/rxe: add RXE_START_MASK for rxe_opcode IB_OPCODE_RC_SEND_ONLY_INV
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianchao Wang <[email protected]>
[ Upstream commit 2da36d44a9d54a2c6e1f8da1f7ccc26b0bc6cfec ]
w/o RXE_START_MASK, the last_psn of IB_OPCODE_RC_SEND_ONLY_INV will not be updated in update_wqe_psn, and the corresponding wqe will not be acked in rxe_completer due to its last_psn is zero. Finally, the other wqe will also not be able to be acked, because the wqe of IB_OPCODE_RC_SEND_ONLY_INV with last_psn 0 is still there. This causes large amount of io timeout when nvmeof is over rxe.
Add RXE_START_MASK for IB_OPCODE_RC_SEND_ONLY_INV to fix this.
--- drivers/infiniband/sw/rxe/rxe_opcode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_opcode.c +1 -1
@@ -390,7 +390,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NU .name = "IB_OPCODE_RC_SEND_ONLY_INV", .mask =RXE_IETH_MASK |RXE_PAYLOAD_MASK |RXE_REQ_MASK |RXE_COMP_MASK |RXE_RWR_MASK |RXE_SEND_MASK - | RXE_END_MASK, + | RXE_END_MASK | RXE_START_MASK, .length = RXE_BTH_BYTES + RXE_IETH_BYTES, .offset = { [RXE_BTH] = 0,
Greg Kroah-Hartman
maintainerPATCH 132/279 IB/rxe: avoid double kfree_skb
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <[email protected]>
[ Upstream commit 9fd4350ba8953804f05215999e11a6cfb7b41f2b ]
When skb is sent, it will pass the following functions in soft roce.
rxe_send [rdma_rxe]
ip_local_out
__ip_local_out
ip_output
ip_finish_output
ip_finish_output2
dev_queue_xmit
__dev_queue_xmit
dev_hard_start_xmitIn the above functions, if error occurs in the above functions or iptables rules drop skb after ip_local_out, kfree_skb will be called. So it is not necessary to call kfree_skb in soft roce module again. Or else crash will occur.
The steps to reproduce:
server client
--------- ---------
|1.1.1.1|<----rxe-channel--->|1.1.1.2|
--------- ---------On server: rping -s -a 1.1.1.1 -v -C 10000 -S 512
On client: rping -c -a 1.1.1.1 -v -C 10000 -S 512
The kernel configs CONFIG_DEBUG_KMEMLEAK and CONFIG_DEBUG_OBJECTS are enabled on both server and client.
When rping runs, run the following command in server:
iptables -I OUTPUT -p udp --dport 4791 -j DROP
Without this patch, crash will occur.
--- drivers/infiniband/sw/rxe/rxe_req.c | 1 - drivers/infiniband/sw/rxe/rxe_resp.c | 6 +----- 2 files changed, 1 insertion(+), 6 deletions(-)
drivers/infiniband/sw/rxe/rxe_req.c +0 -1
@@ -728,7 +728,6 @@ next_wqe:rollback_state (wqe, qp, &rollback_wqe, rollback_psn);if (ret == -EAGAIN ) { -kfree_skb (skb);rxe_run_task (&qp->req.task,1 ); goto exit; }
drivers/infiniband/sw/rxe/rxe_resp.c +1 -5
@@ -742,7 +742,6 @@ static enum resp_states read_reply(struc err =rxe_xmit_packet (rxe, qp, &ack_pkt, skb);if (err) {pr_err ("Failed sending RDMA reply.\n" ); -kfree_skb (skb);return RESPST_ERR_RNR ; }
@@ -954,10 +953,8 @@ static int send_ack(struct rxe_qp *qp, s } err =rxe_xmit_packet (rxe, qp, &ack_pkt, skb); -if (err) { +if (err)pr_err_ratelimited ("Failed sending ack\n" ); -kfree_skb (skb); - } err1:return err;
@@ -1150,7 +1147,6 @@ static enum resp_states duplicate_requesif (rc) {pr_err ("Failed resending result. This flow is not handled - skb ignored\n" );rxe_drop_ref (qp); -kfree_skb (skb_copy); rc =RESPST_CLEANUP ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 133/279 RDMA/hns: Bugfix for init hem table
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: oulijun <[email protected]>
[ Upstream commit 215a8c09e5e2aa6ae1fbcef87f8f27d65d5d1ca4 ]
During init hem table, type should be used instead of table->type which is finally initializaed with type.
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +4 -4
@@ -912,7 +912,7 @@ int hns_roce_init_hem_table(struct hns_r obj_per_chunk = buf_chunk_size / obj_size; num_hem = (nobj + obj_per_chunk -1 ) / obj_per_chunk; bt_chunk_num = bt_chunk_size /8 ; -if (table->type >=HEM_TYPE_MTT ) +if (type >=HEM_TYPE_MTT ) num_bt_l0 = bt_chunk_num; table->hem = kcalloc(num_hem, sizeof(*table->hem),
@@ -920,7 +920,7 @@ int hns_roce_init_hem_table(struct hns_rif (!table->hem) goto err_kcalloc_hem_buf; -if (check_whether_bt_num_3 (table->type, hop_num)) { +if (check_whether_bt_num_3 (type, hop_num)) {unsigned long num_bt_l1; num_bt_l1 = (num_hem + bt_chunk_num - 1) /
@@ -939,8 +939,8 @@ int hns_roce_init_hem_table(struct hns_r goto err_kcalloc_l1_dma; } -if (check_whether_bt_num_2 (table->type, hop_num) || -check_whether_bt_num_3 (table->type, hop_num)) { +if (check_whether_bt_num_2 (type, hop_num) || +check_whether_bt_num_3 (type, hop_num)) { table->bt_l0 =kcalloc (num_bt_l0,sizeof (*table->bt_l0),GFP_KERNEL );if (!table->bt_l0)
Greg Kroah-Hartman
maintainerPATCH 134/279 RDMA/hns: Intercept illegal RDMA operation when use inline data
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: oulijun <[email protected]>
[ Upstream commit 328d405b3d4c8dd1f06bfd77f498e23281ae348c ]
RDMA read operation is not supported inline data. If user cofigures issue a RDMA read and use inline data, it will happen a hardware error.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +5 -0
@@ -71,6 +71,11 @@ static int set_rwqe_data_seg(struct ib_qreturn -EINVAL ; } +if (wr->opcode ==IB_WR_RDMA_READ ) { +dev_err (hr_dev->dev,"Not support inline data!\n" ); +return -EINVAL ; + } +for (i =0 ; i < wr->num_sge; i++) {memcpy (wqe, ((void *)wr->sg_list[i].addr), wr->sg_list[i].length);
Greg Kroah-Hartman
maintainerPATCH 135/279 RDMA/hns: Fix the qp context state diagram
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: oulijun <[email protected]>
[ Upstream commit 6e1a70943cecdca9bb13b601b1a9772a7bdcc2c3 ]
According to RoCE protocol, it is possible to transition from error to error state for modifying qp in hip08. This patch fix it.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +2 -1
@@ -3166,7 +3166,8 @@ static int hns_roce_v2_modify_qp(struct (cur_state ==IB_QPS_RTR && new_state ==IB_QPS_ERR ) || (cur_state ==IB_QPS_RTS && new_state ==IB_QPS_ERR ) || (cur_state ==IB_QPS_SQD && new_state ==IB_QPS_ERR ) || - (cur_state == IB_QPS_SQE && new_state == IB_QPS_ERR)) { + (cur_state ==IB_QPS_SQE && new_state ==IB_QPS_ERR ) || + (cur_state == IB_QPS_ERR && new_state == IB_QPS_ERR)) {/* Nothing */ ; } else {
Greg Kroah-Hartman
maintainerPATCH 136/279 RDMA/hns: Submit bad wr
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: oulijun <[email protected]>
[ Upstream commit 137ae3208416278aabef3b71e0ea1052940ca362 ]
When generated bad work reqeust, it needs to
report to user. This patch mainly fixes it.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +2 -1
@@ -153,7 +153,7 @@ static int hns_roce_v2_post_send(struct ibqp->qp_type != IB_QPT_GSI && ibqp->qp_type != IB_QPT_UD)) {dev_err (dev,"Not supported QP(0x%x)type!\n" , ibqp->qp_type); - *bad_wr =NULL ; + *bad_wr = wr;return -EOPNOTSUPP ; }
@@ -461,6 +461,7 @@ static int hns_roce_v2_post_send(struct }else {dev_err (dev,"Illegal qp_type(0x%x)\n" , ibqp->qp_type);spin_unlock_irqrestore (&qp->sq.lock, flags); + *bad_wr = wr;return -EOPNOTSUPP ; } }
Greg Kroah-Hartman
maintainerPATCH 137/279 <linux/stringhash.h>: fix end_name_hash() for 64bit long
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit 19b9ad67310ed2f685062a00aec602bec33835f0 ]
The comment claims that this helper will try not to loose bits, but for 64bit long it looses the high bits before hashing 64bit long into 32bit int. Use the helper hash_long() to do the right thing for 64bit long. For 32bit long, there is no change.
All the callers of end_name_hash() either assign the result to qstr->hash, which is u32 or return the result as an int value (e.g. full_name_hash()). Change the helper return type to int to conform to its users.
[ It took me a while to apply this, because my initial reaction to it
was - incorrectly - that it could make for slower code.
After having looked more at it, I take back all my complaints about the patch, Amir was right and I was mis-reading things or just being stupid.
I also don't worry too much about the possible performance impact of this on 64-bit, since most architectures that actually care about performance end up not using this very much (the dcache code is the most performance-critical, but the word-at-a-time case uses its own hashing anyway).
So this ends up being mostly used for filesystems that do their own degraded hashing (usually because they want a case-insensitive comparison function).
A _tiny_ worry remains, in that not everybody uses DCACHE_WORD_ACCESS, and then this potentially makes things more expensive on 64-bit architectures with slow or lacking multipliers even for the normal case.
That said, realistically the only such architecture I can think of is PA-RISC. Nobody really cares about performance on that, it's more of a "look ma, I've got warts^W an odd machine" platform.
So the patch is fine, and all my initial worries were just misplaced
from not looking at this properly. - Linus ]
--- include/linux/stringhash.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/stringhash.h +2 -2
@@ -50,9 +50,9 @@ partial_name_hash(unsigned long c, unsig* losing bits). This also has the property (wanted by the dcache) * that the msbits make a good hash table index. */ -static inline unsigned long end_name_hash (unsigned long hash) +static inline unsigned int end_name_hash (unsigned long hash) { -return __hash_32 ((unsigned int )hash); +return hash_long (hash,32 ); }/*
Greg Kroah-Hartman
maintainerPATCH 139/279 ARM: davinci: board-da830-evm: fix GPIO lookup for MMC/SD
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sekhar Nori <[email protected]>
[ Upstream commit 51e9f12163223546bd3aa9f7af6817931f980da8 ]
The GPIO chip is called davinci_gpio.0 in legacy mode. Fix it, so that mmc can correctly lookup the wp and cp gpios. Also fix the GPIO numbers as they are not offsets within a bank.
Note that it is the gpio-davinci driver that sets the gpiochip label to davinci_gpio.0.
--- arch/arm/mach-davinci/board-da830-evm.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/arm/mach-davinci/board-da830-evm.c +7 -2
@@ -205,12 +205,17 @@ static const short da830_evm_mmc_sd_pins -1 }; +#define DA830_MMCSD_WP_PIN GPIO_TO_PIN(2, 1) +#define DA830_MMCSD_CD_PIN GPIO_TO_PIN(2, 2) +static struct gpiod_lookup_table mmc_gpios_table = { .dev_id ="da830-mmc.0" , .table = {/* gpio chip 1 contains gpio range 32-63 */ -GPIO_LOOKUP ("davinci_gpio.1" ,2 ,"cd" ,GPIO_ACTIVE_LOW ), -GPIO_LOOKUP ("davinci_gpio.1" ,1 ,"wp" ,GPIO_ACTIVE_LOW ), +GPIO_LOOKUP ("davinci_gpio.0" ,DA830_MMCSD_CD_PIN ,"cd" , +GPIO_ACTIVE_LOW ), +GPIO_LOOKUP ("davinci_gpio.0" ,DA830_MMCSD_WP_PIN ,"wp" , +GPIO_ACTIVE_LOW ), }, };
Greg Kroah-Hartman
maintainerPATCH 140/279 ARM: davinci: board-da850-evm: fix GPIO lookup for MMC/SD
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sekhar Nori <[email protected]>
[ Upstream commit 67c6b6ff221f807180aea6dd597246f87e1dd98a ]
The GPIO chip is called davinci_gpio.0 in legacy mode. Fix it, so that mmc can correctly lookup the wp and cp gpios. Also fix the GPIO numbers as they are not offsets within a bank.
Note that it is the gpio-davinci driver that sets the gpiochip label to davinci_gpio.0.
--- arch/arm/mach-davinci/board-da850-evm.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/arm/mach-davinci/board-da850-evm.c +7 -2
@@ -763,12 +763,17 @@ static const short da850_evm_mcasp_pins[ -1 }; +#define DA850_MMCSD_CD_PIN GPIO_TO_PIN(4, 0) +#define DA850_MMCSD_WP_PIN GPIO_TO_PIN(4, 1) +static struct gpiod_lookup_table mmc_gpios_table = { .dev_id ="da830-mmc.0" , .table = {/* gpio chip 2 contains gpio range 64-95 */ -GPIO_LOOKUP ("davinci_gpio.2" ,0 ,"cd" ,GPIO_ACTIVE_LOW ), -GPIO_LOOKUP ("davinci_gpio.2" ,1 ,"wp" ,GPIO_ACTIVE_LOW ), +GPIO_LOOKUP ("davinci_gpio.0" ,DA850_MMCSD_CD_PIN ,"cd" , +GPIO_ACTIVE_LOW ), +GPIO_LOOKUP ("davinci_gpio.0" ,DA850_MMCSD_WP_PIN ,"wp" , +GPIO_ACTIVE_LOW ), }, };
Greg Kroah-Hartman
maintainerPATCH 141/279 ARM: davinci: board-omapl138-hawk: fix GPIO numbers for MMC/SD lookup
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sekhar Nori <[email protected]>
[ Upstream commit d45622c0eaa5992a1a2248cbe93e1ff7a2da7be4 ]
commit c4dc56be7e26 ("ARM: davinci: fix the GPIO lookup for omapl138-hawk") fixed the GPIO chip name for look-up of MMC/SD CD and WP pins, but forgot to change the GPIO numbers passed.
The GPIO numbers are not offsets from within a 32 GPIO bank. Fix the GPIO numbers as well as remove the misleading comment.
--- arch/arm/mach-davinci/board-omapl138-hawk.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
arch/arm/mach-davinci/board-omapl138-hawk.c +7 -3
@@ -123,12 +123,16 @@ static const short hawk_mmcsd0_pins[] = -1 }; +#define DA850_HAWK_MMCSD_CD_PIN GPIO_TO_PIN(3, 12) +#define DA850_HAWK_MMCSD_WP_PIN GPIO_TO_PIN(3, 13) +static struct gpiod_lookup_table mmc_gpios_table = { .dev_id ="da830-mmc.0" , .table = { -/* CD: gpio3_12: gpio60: chip 1 contains gpio range 32-63*/ -GPIO_LOOKUP ("davinci_gpio.0" ,28 ,"cd" ,GPIO_ACTIVE_LOW ), -GPIO_LOOKUP ("davinci_gpio.0" ,29 ,"wp" ,GPIO_ACTIVE_LOW ), +GPIO_LOOKUP ("davinci_gpio.0" ,DA850_HAWK_MMCSD_CD_PIN ,"cd" , +GPIO_ACTIVE_LOW ), +GPIO_LOOKUP ("davinci_gpio.0" ,DA850_HAWK_MMCSD_WP_PIN ,"wp" , +GPIO_ACTIVE_LOW ), }, };
Greg Kroah-Hartman
maintainerPATCH 142/279 ARM: davinci: board-dm355-evm: fix broken networking
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sekhar Nori <[email protected]>
[ Upstream commit 5c054de228dd6d97bf8e38962bd118953b66e5a0 ]
Since commit 09f3756bb9a8 ("dm9000: Return an ERR_PTR() in all error conditions of dm9000_parse_dt()"), passing either non-NULL platform data or device-tree for dm9000 driver to probe is mandatory.
DM335 board was using none, so networking failed to initialize. Fix it by passing non-NULL (but empty) platform data.
--- arch/arm/mach-davinci/board-dm355-evm.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm/mach-davinci/board-dm355-evm.c +6 -0
@@ -19,6 +19,7 @@#include <linux/gpio.h> #include <linux/gpio/machine.h> #include <linux/clk.h> +#include <linux/dm9000.h> #include <linux/videodev2.h> #include <media/i2c/tvp514x.h> #include <linux/spi/spi.h>
@@ -179,11 +180,16 @@ static struct resource dm355evm_dm9000_r }, }; +static struct dm9000_plat_data dm335evm_dm9000_platdata; +static struct platform_device dm355evm_dm9000 = { .name ="dm9000" , .id =-1 , .resource = dm355evm_dm9000_rsrc, .num_resources =ARRAY_SIZE (dm355evm_dm9000_rsrc), + .dev = { + .platform_data = &dm335evm_dm9000_platdata, + }, };static struct tvp514x_platform_data tvp5146_pdata = {
Greg Kroah-Hartman
maintainerPATCH 143/279 dt-bindings: panel: lvds: Fix path to display timing bindings
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit f130307054a59ca21d2396f386be77ebd2e8ca96 ]
panel properties")
--- Documentation/devicetree/bindings/display/panel/panel-common.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/display/panel/panel-common.txt +1 -1
@@ -38,7 +38,7 @@ Display Timings require specific display timings. The panel-timing subnode expresses those timings as specified in the timing subnode section of the display timing bindings defined in - Documentation/devicetree/bindings/display/display-timing.txt. + Documentation/devicetree/bindings/display/panel/display-timing.txt. Connectivity
Greg Kroah-Hartman
maintainerPATCH 144/279 ARM: OMAP2+: powerdomain: use raw_smp_processor_id() for trace
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tero Kristo <[email protected]>
[ Upstream commit 33e9572483031a79ad0a4468064675144d9269ec ]
smp_processor_id() checks preemption if CONFIG_DEBUG_PREEMPT is enabled, causing a warning dump during boot:
[ 5.042377] BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1 [ 5.050281] caller is pwrdm_set_next_pwrst+0x48/0x88 [ 5.055330] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.14.24-g57341df0b4 #1
Use the raw_smp_processor_id() for the trace instead, this value does not need to be perfectly correct. The alternative of disabling preempt is too heavy weight operation to be applied in PM hot path for just tracing purposes.
--- arch/arm/mach-omap2/powerdomain.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/powerdomain.c +2 -2
@@ -188,7 +188,7 @@ static int _pwrdm_state_switch(struct po ((prev & OMAP_POWERSTATE_MASK) << 0));trace_power_domain_target_rcuidle (pwrdm->name, trace_state, -smp_processor_id ()); +raw_smp_processor_id ()); }break ;default :
@@ -518,7 +518,7 @@ int pwrdm_set_next_pwrst(struct powerdomif (arch_pwrdm && arch_pwrdm->pwrdm_set_next_pwrst) {/* Trace the pwrdm desired target state */ trace_power_domain_target_rcuidle (pwrdm->name, pwrst, -smp_processor_id ()); +raw_smp_processor_id ());/* Program the pwrdm desired target state */ ret = arch_pwrdm->pwrdm_set_next_pwrst (pwrdm, pwrst); }
Greg Kroah-Hartman
maintainerPATCH 145/279 ARM: dts: logicpd-som-lv: Fix WL127x Startup Issues
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit 189822cbcbf3ea37c26a15612d8f922c440bc0e0 ]
The VAUX3 rail from the PMIC powers a clock driver which clocks the WL127x. This corrects a bug which did not correctly associate the vin-supply with the proper power rail.
This also fixes a typo in the pinmuxing to properly configure the interrupt pin.
DM3730 SOM-LV")
--- arch/arm/boot/dts/logicpd-som-lv.dtsi | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/arm/boot/dts/logicpd-som-lv.dtsi +7 -2
@@ -26,7 +26,7 @@ gpio = <&gpio1 3 0>; /* gpio_3 */ startup-delay-us = <70000>; enable-active-high; - vin-supply = <&vmmc2>; + vin-supply = <&vaux3>; }; /* HS USB Host PHY on PORT 1 */
@@ -209,7 +209,7 @@ }; wl127x_gpio: pinmux_wl127x_gpio_pin { pinctrl-single,pins = < - OMAP3_WKUP_IOPAD(0x2a0c, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */ + OMAP3_WKUP_IOPAD(0x2a0a, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */ >; };
@@ -244,6 +244,11 @@ #include "twl4030.dtsi" #include "twl4030_omap3.dtsi" +&vaux3 { + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; +}; + &twl { twl_power: power { compatible = "ti,twl4030-power-idle-osc-off", "ti,twl4030-power-idle";
Greg Kroah-Hartman
maintainerPATCH 146/279 ARM: dts: logicpd-som-lv: Fix Audio Mute
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit 95e59fc3c3fa3187a07a75f40b21637deb4bd12d ]
The Audio has worked, but the mute pin has a weak pulldown which alows some of the audio signal to pass very quietly. This patch fixes that so the mute pin is actively driven high for mute or low for normal operation.
PD DM3730 SOM-LV")
--- arch/arm/boot/dts/logicpd-som-lv.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/logicpd-som-lv.dtsi +2 -0
@@ -82,6 +82,7 @@ twl_audio: audio { compatible = "ti,twl4030-audio"; codec { + ti,hs_extmute_gpio = <&gpio2 25 GPIO_ACTIVE_HIGH>; }; }; };
@@ -195,6 +196,7 @@ pinctrl-single,pins = < OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ + OMAP3_CORE1_IOPAD(0x20ba, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs6.gpio_57 */ >; }; };
Greg Kroah-Hartman
maintainerPATCH 147/279 xprtrdma: Fix list corruption / DMAR errors during MR recovery
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 054f155721d7af1f343ed52bea246626d8450ca8 ]
The ro_release_mr methods check whether mr->mr_list is empty. Therefore, be sure to always use list_del_init when removing an MR linked into a list using that field. Otherwise, when recovering from transport failures or device removal, list corruption can result, or MRs can get mapped or unmapped an odd number of times, resulting in IOMMU-related failures.
In general this fix is appropriate back to v4.8. However, code changes since then make it impossible to apply this patch directly to stable kernels. The fix would have to be applied by hand or reworked for kernels earlier than v4.16.
Backport guidance -- there are several cases:
- When creating an MR, initialize mr_list so that using list_empty on an as-yet-unused MR is safe.
- When an MR is being handled by the remote invalidation path, ensure that mr_list is reinitialized when it is removed from rl_registered.
- When an MR is being handled by rpcrdma_destroy_mrs, it is removed from mr_all, but it may still be on an rl_registered list. In that case, the MR needs to be removed from that list before being released.
- Other cases are covered by using list_del_init in rpcrdma_mr_pop.
--- net/sunrpc/xprtrdma/fmr_ops.c | 5 +---- net/sunrpc/xprtrdma/frwr_ops.c | 9 +++------ net/sunrpc/xprtrdma/verbs.c | 5 +++++ net/sunrpc/xprtrdma/xprt_rdma.h | 2 +- 4 files changed, 10 insertions(+), 11 deletions(-)
net/sunrpc/xprtrdma/fmr_ops.c +1 -4
@@ -72,6 +72,7 @@ fmr_op_init_mr(struct rpcrdma_ia *ia, stif (IS_ERR (mr->fmr.fm_mr)) goto out_fmr_err; +INIT_LIST_HEAD (&mr->mr_list);return 0 ; out_fmr_err:
@@ -102,10 +103,6 @@ fmr_op_release_mr(struct rpcrdma_mr *mr)LIST_HEAD (unmap_list);int rc; -/* Ensure MW is not on any rl_registered list */ -if (!list_empty (&mr->mr_list)) -list_del (&mr->mr_list); -kfree (mr->fmr.fm_physaddrs);kfree (mr->mr_sg);
net/sunrpc/xprtrdma/frwr_ops.c +3 -6
@@ -110,6 +110,7 @@ frwr_op_init_mr(struct rpcrdma_ia *ia, sif (!mr->mr_sg) goto out_list_err; +INIT_LIST_HEAD (&mr->mr_list);sg_init_table (mr->mr_sg, depth);init_completion (&frwr->fr_linv_done);return 0 ;
@@ -133,10 +134,6 @@ frwr_op_release_mr(struct rpcrdma_mr *mr {int rc; -/* Ensure MR is not on any rl_registered list */ -if (!list_empty (&mr->mr_list)) -list_del (&mr->mr_list); - rc =ib_dereg_mr (mr->frwr.fr_mr);if (rc) pr_err("rpcrdma: final ib_dereg_mr for %p returned %i\n",
@@ -195,7 +192,7 @@ frwr_op_recover_mr(struct rpcrdma_mr *mrreturn ; out_release: -pr_err ("rpcrdma: FRWR reset failed %d, %p release\n" , rc, mr); +pr_err ("rpcrdma: FRWR reset failed %d, %p released\n" , rc, mr); r_xprt->rx_stats.mrs_orphaned++;spin_lock (&r_xprt->rx_buf.rb_mrlock);
@@ -458,7 +455,7 @@ frwr_op_reminv(struct rpcrdma_rep *rep,list_for_each_entry (mr, mrs, mr_list)if (mr->mr_handle == rep->rr_inv_rkey) { -list_del (&mr->mr_list); +list_del_init (&mr->mr_list);trace_xprtrdma_remoteinv (mr); mr->frwr.fr_state =FRWR_IS_INVALID ;rpcrdma_mr_unmap_and_put (mr);
net/sunrpc/xprtrdma/verbs.c +5 -0
@@ -1244,6 +1244,11 @@ rpcrdma_mrs_destroy(struct rpcrdma_buffelist_del (&mr->mr_all);spin_unlock (&buf->rb_mrlock); + +/* Ensure MW is not on any rl_registered list */ +if (!list_empty (&mr->mr_list)) +list_del (&mr->mr_list); + ia->ri_ops->ro_release_mr (mr); count++;spin_lock (&buf->rb_mrlock);
net/sunrpc/xprtrdma/xprt_rdma.h +1 -1
@@ -381,7 +381,7 @@ rpcrdma_mr_pop(struct list_head *list)struct rpcrdma_mr *mr; mr = list_first_entry(list, struct rpcrdma_mr, mr_list); -list_del (&mr->mr_list); +list_del_init (&mr->mr_list);return mr; }
Greg Kroah-Hartman
maintainerPATCH 148/279 Input: atmel_mxt_ts - fix the firmware update
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Dyer <[email protected]>
[ Upstream commit 068bdb67ef74df0ad1627b7247a163e3e252ac11 ]
The automatic update mechanism will trigger an update if the info block CRCs are different between maxtouch configuration file (maxtouch.cfg) and chip.
The driver compared the CRCs without retrieving the chip CRC, resulting always in a failure and firmware flashing action triggered. Fix this issue by retrieving the chip info block CRC before the check.
Note that this solution has the benefit that by reading the information block and the object table into a contiguous region of memory, we can verify the checksum at probe time. This means we make sure that we are indeed talking to a chip that supports object protocol correctly.
Using this patch on a kevin chromebook, the touchscreen and touchpad drivers are able to match the CRC:
atmel_mxt_ts 3-004b: Family: 164 Variant: 14 Firmware V2.3.AA Objects: 40 atmel_mxt_ts 5-004a: Family: 164 Variant: 17 Firmware V2.0.AA Objects: 31 atmel_mxt_ts 3-004b: Resetting device
atmel_mxt_ts 5-004a: Resetting device
atmel_mxt_ts 3-004b: Config CRC 0x573E89: OK
atmel_mxt_ts 3-004b: Touchscreen size X4095Y2729
input: Atmel maXTouch Touchscreen as /devices/platform/ff130000.i2c/i2c-3/3-004b/input/input5 atmel_mxt_ts 5-004a: Config CRC 0x0AF6BA: OK
atmel_mxt_ts 5-004a: Touchscreen size X1920Y1080
input: Atmel maXTouch Touchpad as /devices/platform/ff140000.i2c/i2c-5/5-004a/input/input6
--- drivers/input/touchscreen/atmel_mxt_ts.c | 186 ++++++++++++++++++------------- 1 file changed, 110 insertions(+), 76 deletions(-)
drivers/input/touchscreen/atmel_mxt_ts.c +110 -76
@@ -275,7 +275,8 @@ struct mxt_data {char phys[64 ];/* device physical location */ const struct mxt_platform_data *pdata;struct mxt_object *object_table; -struct mxt_info info; +struct mxt_info *info; +void *raw_info_block;unsigned int irq;unsigned int max_x;unsigned int max_y;
@@ -450,12 +451,13 @@ static int mxt_lookup_bootloader_address {u8 appmode = data->client->addr;u8 bootloader; +u8 family_id = data->info ? data->info->family_id :0 ;switch (appmode) {case 0x4a :case 0x4b :/* Chips after 1664S use different scheme */ -if (retry || data->info.family_id >=0xa2 ) { +if (retry || family_id >=0xa2 ) { bootloader = appmode -0x24 ;break ; }
@@ -682,7 +684,7 @@ mxt_get_object(struct mxt_data *data, u8struct mxt_object *object;int i; -for (i =0 ; i < data->info.object_num; i++) { +for (i =0 ; i < data->info->object_num; i++) { object = data->object_table + i;if (object->type == type)return object;
@@ -1453,12 +1455,12 @@ static int mxt_update_cfg(struct mxt_dat data_pos += offset; } -if (cfg_info.family_id != data->info.family_id) { +if (cfg_info.family_id != data->info->family_id) {dev_err (dev,"Family ID mismatch!\n" );return -EINVAL ; } -if (cfg_info.variant_id != data->info.variant_id) { +if (cfg_info.variant_id != data->info->variant_id) {dev_err (dev,"Variant ID mismatch!\n" );return -EINVAL ; }
@@ -1503,7 +1505,7 @@ static int mxt_update_cfg(struct mxt_dat/* Malloc memory to store configuration */ cfg_start_ofs =MXT_OBJECT_START + - data->info.object_num *sizeof (struct mxt_object ) + + data->info->object_num *sizeof (struct mxt_object ) +MXT_INFO_CHECKSUM_SIZE ; config_mem_size = data->mem_size - cfg_start_ofs; config_mem =kzalloc (config_mem_size,GFP_KERNEL );
@@ -1554,20 +1556,6 @@ release_mem:return ret; } -static int mxt_get_info (struct mxt_data *data) -{ -struct i2c_client *client = data->client; -struct mxt_info *info = &data->info; -int error; - -/* Read 7-byte info block starting at address 0 */ - error =__mxt_read_reg (client,0 ,sizeof (*info), info); -if (error) -return error; - -return 0 ; -} -static void mxt_free_input_device (struct mxt_data *data) {if (data->input_dev) {
@@ -1582,9 +1570,10 @@ static void mxt_free_object_table(structvideo_unregister_device (&data->dbg.vdev);v4l2_device_unregister (&data->dbg.v4l2);#endif - -kfree (data->object_table); data->object_table =NULL ; + data->info =NULL ; +kfree (data->raw_info_block); + data->raw_info_block =NULL ;kfree (data->msg_buf); data->msg_buf =NULL ; data->T5_address =0 ;
@@ -1600,34 +1589,18 @@ static void mxt_free_object_table(struct data->max_reportid =0 ; } -static int mxt_get_object_table (struct mxt_data *data) +static int mxt_parse_object_table (struct mxt_data *data, +struct mxt_object *object_table) {struct i2c_client *client = data->client; -size_t table_size; -struct mxt_object *object_table; -int error;int i;u8 reportid;u16 end_address; - table_size = data->info.object_num *sizeof (struct mxt_object ); - object_table =kzalloc (table_size,GFP_KERNEL ); -if (!object_table) { -dev_err (&data->client->dev,"Failed to allocate memory\n" ); -return -ENOMEM ; - } - - error =__mxt_read_reg (client,MXT_OBJECT_START , table_size, - object_table); -if (error) { -kfree (object_table); -return error; - } -/* Valid Report IDs start counting from 1 */ reportid =1 ; data->mem_size =0 ; -for (i =0 ; i < data->info.object_num; i++) { +for (i =0 ; i < data->info->object_num; i++) {struct mxt_object *object = object_table + i;u8 min_id, max_id;
@@ -1651,8 +1624,8 @@ static int mxt_get_object_table(struct mswitch (object->type) {case MXT_GEN_MESSAGE_T5 : -if (data->info.family_id ==0x80 && - data->info.version <0x20 ) { +if (data->info->family_id ==0x80 && + data->info->version <0x20 ) {/* * On mXT224 firmware versions prior to V2.0 * read and discard unused CRC byte otherwise
@@ -1707,24 +1680,102 @@ static int mxt_get_object_table(struct m/* If T44 exists, T5 position has to be directly after */ if (data->T44_address && (data->T5_address != data->T44_address +1 )) {dev_err (&client->dev,"Invalid T44 position\n" ); - error = -EINVAL ; - goto free_object_table; +return -EINVAL ; } data->msg_buf =kcalloc (data->max_reportid, data->T5_msg_size,GFP_KERNEL ); -if (!data->msg_buf) { -dev_err (&client->dev,"Failed to allocate message buffer\n" ); +if (!data->msg_buf) +return -ENOMEM ; + +return 0 ; +} + +static int mxt_read_info_block (struct mxt_data *data) +{ +struct i2c_client *client = data->client; +int error; +size_t size; +void *id_buf, *buf; +uint8_t num_objects; +u32 calculated_crc; +u8 *crc_ptr; + +/* If info block already allocated, free it */ +if (data->raw_info_block) +mxt_free_object_table (data); + +/* Read 7-byte ID information block starting at address 0 */ + size =sizeof (struct mxt_info ); + id_buf =kzalloc (size,GFP_KERNEL ); +if (!id_buf) +return -ENOMEM ; + + error =__mxt_read_reg (client,0 , size, id_buf); +if (error) + goto err_free_mem; + +/* Resize buffer to give space for rest of info block */ + num_objects = ((struct mxt_info *)id_buf)->object_num; + size += (num_objects *sizeof (struct mxt_object )) + +MXT_INFO_CHECKSUM_SIZE ; + + buf =krealloc (id_buf, size,GFP_KERNEL ); +if (!buf) { error = -ENOMEM ; - goto free_object_table; + goto err_free_mem; + } + id_buf = buf; + +/* Read rest of info block */ + error =__mxt_read_reg (client,MXT_OBJECT_START , + size -MXT_OBJECT_START , + id_buf +MXT_OBJECT_START ); +if (error) + goto err_free_mem; + +/* Extract & calculate checksum */ + crc_ptr = id_buf + size -MXT_INFO_CHECKSUM_SIZE ; + data->info_crc = crc_ptr[0 ] | (crc_ptr[1 ] <<8 ) | (crc_ptr[2 ] <<16 ); + + calculated_crc =mxt_calculate_crc (id_buf,0 , + size -MXT_INFO_CHECKSUM_SIZE ); + +/* +* CRC mismatch can be caused by data corruption due to I2C comms +* issue or else device is not using Object Based Protocol (eg i2c-hid) +*/ +if ((data->info_crc ==0 ) || (data->info_crc != calculated_crc)) { +dev_err (&client->dev, +"Info Block CRC error calculated=0x%06X read=0x%06X\n" , + calculated_crc, data->info_crc); + error = -EIO ; + goto err_free_mem; + } + + data->raw_info_block = id_buf; + data->info = (struct mxt_info *)id_buf; + +dev_info (&client->dev, +"Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n" , + data->info->family_id, data->info->variant_id, + data->info->version >>4 , data->info->version &0xf , + data->info->build, data->info->object_num); + +/* Parse object table information */ + error =mxt_parse_object_table (data, id_buf +MXT_OBJECT_START ); +if (error) { +dev_err (&client->dev,"Error %d parsing object table\n" , error); +mxt_free_object_table (data); + goto err_free_mem; } - data->object_table = object_table; + data->object_table = (struct mxt_object *)(id_buf +MXT_OBJECT_START );return 0 ; -free_object_table: -mxt_free_object_table (data); +err_free_mem: +kfree (id_buf);return error; }
@@ -2039,7 +2090,7 @@ static int mxt_initialize(struct mxt_datint error;while (1 ) { - error =mxt_get_info (data); + error =mxt_read_info_block (data);if (!error)break ;
@@ -2070,16 +2121,9 @@ static int mxt_initialize(struct mxt_datmsleep (MXT_FW_RESET_TIME ); } -/* Get object table information */ - error =mxt_get_object_table (data); -if (error) { -dev_err (&client->dev,"Error %d reading object table\n" , error); -return error; - } - error =mxt_acquire_irq (data);if (error) - goto err_free_object_table; +return error; error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME, &client->dev, GFP_KERNEL, data,
@@ -2087,14 +2131,10 @@ static int mxt_initialize(struct mxt_datif (error) {dev_err (&client->dev,"Failed to invoke firmware loader: %d\n" , error); - goto err_free_object_table; +return error; }return 0 ; - -err_free_object_table: -mxt_free_object_table (data); -return error; }static int mxt_set_t7_power_cfg (struct mxt_data *data,u8 sleep)
@@ -2155,7 +2195,7 @@ recheck:static u16 mxt_get_debug_value (struct mxt_data *data,unsigned int x,unsigned int y) { -struct mxt_info *info = &data->info; +struct mxt_info *info = data->info;struct mxt_dbg *dbg = &data->dbg;unsigned int ofs, page;unsigned int col =0 ;
@@ -2483,7 +2523,7 @@ static const struct video_device mxt_vidstatic void mxt_debug_init (struct mxt_data *data) { -struct mxt_info *info = &data->info; +struct mxt_info *info = data->info;struct mxt_dbg *dbg = &data->dbg;struct mxt_object *object;int error;
@@ -2569,7 +2609,6 @@ static int mxt_configure_objects(struct const struct firmware *cfg) {struct device *dev = &data->client->dev; -struct mxt_info *info = &data->info;int error; error =mxt_init_t7_power_cfg (data);
@@ -2594,11 +2633,6 @@ static int mxt_configure_objects(structmxt_debug_init (data); -dev_info (dev, -"Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n" , - info->family_id, info->variant_id, info->version >>4 , - info->version &0xf , info->build, info->object_num); -return 0 ; }
@@ -2607,7 +2641,7 @@ static ssize_t mxt_fw_version_show(struc struct device_attribute *attr, char *buf) { struct mxt_data *data = dev_get_drvdata(dev); -struct mxt_info *info = &data->info; +struct mxt_info *info = data->info;return scnprintf (buf,PAGE_SIZE ,"%u.%u.%02X\n" , info->version >>4 , info->version &0xf , info->build); }
@@ -2617,7 +2651,7 @@ static ssize_t mxt_hw_version_show(struc struct device_attribute *attr, char *buf) { struct mxt_data *data = dev_get_drvdata(dev); -struct mxt_info *info = &data->info; +struct mxt_info *info = data->info;return scnprintf (buf,PAGE_SIZE ,"%u.%u\n" , info->family_id, info->variant_id); }
@@ -2656,7 +2690,7 @@ static ssize_t mxt_object_show(struct dereturn -ENOMEM ; error =0 ; -for (i =0 ; i < data->info.object_num; i++) { +for (i =0 ; i < data->info->object_num; i++) { object = data->object_table + i;if (!mxt_object_readable (object->type))
Greg Kroah-Hartman
maintainerPATCH 149/279 hexagon: add memset_io() helper
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit a57ab96ef9dde231d4d46edba4d5f73720edc16a ]
We already have memcpy_toio(), but not memset_io(), so let's add the obvious version to allow building an allmodconfig kernel without errors like
drivers/gpu/drm/ttm/ttm_bo_util.c: In function 'ttm_bo_move_memcpy':drivers/gpu/drm/ttm/ttm_bo_util.c:390:3: error: implicit declaration of function 'memset_io' [-Werror=implicit-function-declaration]
--- arch/hexagon/include/asm/io.h | 6 ++++++ 1 file changed, 6 insertions(+)
arch/hexagon/include/asm/io.h +6 -0
@@ -216,6 +216,12 @@ static inline void memcpy_toio(volatilememcpy ((void *) dst, src, count); } +static inline void memset_io (volatile void __iomem *addr,int value, +size_t size) +{ +memset ((void __force *)addr, value, size); +} +#define PCI_IO_ADDR (volatile void __iomem *)/*
Greg Kroah-Hartman
maintainerPATCH 150/279 hexagon: export csum_partial_copy_nocheck
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 330e261c35dfb969c48f996dbbc8b334b5ee8d9d ]
This is needed to link ipv6 as a loadable module, which in turn happens in allmodconfig.
--- arch/hexagon/lib/checksum.c | 1 + 1 file changed, 1 insertion(+)
arch/hexagon/lib/checksum.c +1 -0
@@ -199,3 +199,4 @@ csum_partial_copy_nocheck(const void *srmemcpy (dst, src, len);return csum_partial (dst, len, sum); } +EXPORT_SYMBOL (csum_partial_copy_nocheck);
Greg Kroah-Hartman
maintainerPATCH 151/279 scsi: vmw-pvscsi: return DID_BUS_BUSY for adapter-initated aborts
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Gill <[email protected]>
[ Upstream commit f4b024271ae3e9786e5d6f1c05b01b57a74e1d6d ]
The vmw_pvscsi driver returns DID_ABORT for commands aborted internally by the adapter, leading to the filesystem going read-only. Change the result to DID_BUS_BUSY, causing the kernel to retry the command.
--- drivers/scsi/vmw_pvscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/vmw_pvscsi.c +1 -1
@@ -609,7 +609,7 @@ static void pvscsi_complete_request(strubreak ;case BTSTAT_ABORTQUEUE : - cmd->result = (DID_ABORT <<16 ); + cmd->result = (DID_BUS_BUSY <<16 );break ;case BTSTAT_SCSIPARITY :
Greg Kroah-Hartman
maintainerPATCH 152/279 ARM: davinci: fix GPIO lookup for I2C
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sekhar Nori <[email protected]>
[ Upstream commit 9411ac07cd764be34bbd7ff09125a6b7b9175d4c ]
The GPIO chip is called davinci_gpio.0 in legacy mode. Fix it, so that I2C can correctly lookup the recovery gpios.
Note that it is the gpio-davinci driver that sets the gpiochip label to davinci_gpio.0.
Also, the I2C device uses an id of 1 on DM644x and DM355.
While at it, convert to using GPIO_TO_PIN() for referring to GPIO pin numbers, like it is done in rest of the board support files.
--- arch/arm/mach-davinci/board-dm355-evm.c | 9 ++++++--- arch/arm/mach-davinci/board-dm644x-evm.c | 10 +++++++--- 2 files changed, 13 insertions(+), 6 deletions(-)
arch/arm/mach-davinci/board-dm355-evm.c +6 -3
@@ -110,12 +110,15 @@ static struct platform_device davinci_na }, }; +#define DM355_I2C_SDA_PIN GPIO_TO_PIN(0, 15) +#define DM355_I2C_SCL_PIN GPIO_TO_PIN(0, 14) +static struct gpiod_lookup_table i2c_recovery_gpiod_table = { - .dev_id ="i2c_davinci" , + .dev_id ="i2c_davinci.1" , .table = { -GPIO_LOOKUP ("davinci_gpio" ,15 ,"sda" , +GPIO_LOOKUP ("davinci_gpio.0" ,DM355_I2C_SDA_PIN ,"sda" ,GPIO_ACTIVE_HIGH |GPIO_OPEN_DRAIN ), -GPIO_LOOKUP ("davinci_gpio" ,14 ,"scl" , +GPIO_LOOKUP ("davinci_gpio.0" ,DM355_I2C_SCL_PIN ,"scl" ,GPIO_ACTIVE_HIGH |GPIO_OPEN_DRAIN ), }, };
arch/arm/mach-davinci/board-dm644x-evm.c +7 -3
@@ -17,6 +17,7 @@#include <linux/i2c.h> #include <linux/platform_data/pcf857x.h> #include <linux/platform_data/at24.h> +#include <linux/platform_data/gpio-davinci.h> #include <linux/mtd/mtd.h> #include <linux/mtd/rawnand.h> #include <linux/mtd/partitions.h>
@@ -596,12 +597,15 @@ static struct i2c_board_info __initdata }, }; +#define DM644X_I2C_SDA_PIN GPIO_TO_PIN(2, 12) +#define DM644X_I2C_SCL_PIN GPIO_TO_PIN(2, 11) +static struct gpiod_lookup_table i2c_recovery_gpiod_table = { - .dev_id ="i2c_davinci" , + .dev_id ="i2c_davinci.1" , .table = { -GPIO_LOOKUP ("davinci_gpio" ,44 ,"sda" , +GPIO_LOOKUP ("davinci_gpio.0" ,DM644X_I2C_SDA_PIN ,"sda" ,GPIO_ACTIVE_HIGH |GPIO_OPEN_DRAIN ), -GPIO_LOOKUP ("davinci_gpio" ,43 ,"scl" , +GPIO_LOOKUP ("davinci_gpio.0" ,DM644X_I2C_SCL_PIN ,"scl" ,GPIO_ACTIVE_HIGH |GPIO_OPEN_DRAIN ), }, };
Greg Kroah-Hartman
maintainerPATCH 153/279 pinctrl: meson-axg: fix the range of aobus bank
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yixun Lan <[email protected]>
[ Upstream commit b84e54616a946f24eeeca8762cb70a9074b045e7 ]
The GPIOAO bank is range from GPIOAO_0 to GPIOAO_13.
--- drivers/pinctrl/meson/pinctrl-meson-axg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/meson/pinctrl-meson-axg.c +1 -1
@@ -898,7 +898,7 @@ static struct meson_bank meson_axg_peripstatic struct meson_bank meson_axg_aobus_banks[] = {/* name first last irq pullen pull dir out in */ -BANK ("AO" ,GPIOAO_0 ,GPIOAO_9 ,0 ,13 ,0 ,16 ,0 ,0 ,0 ,0 ,0 ,16 ,1 ,0 ), +BANK ("AO" ,GPIOAO_0 ,GPIOAO_13 ,0 ,13 ,0 ,16 ,0 ,0 ,0 ,0 ,0 ,16 ,1 ,0 ), };static struct meson_pmx_bank meson_axg_periphs_pmx_banks[] = {
Greg Kroah-Hartman
maintainerPATCH 154/279 pinctrl: cherryview: Associate IRQ descriptors to irqdomain
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit 83b9dc11312f48a561594a895672abb6cb2a2250 ]
When we dropped the custom Linux GPIO translation it resulted that the IRQ numbers changed slightly as well. Normally this would be fine because everyone is expected to use controller relative GPIO numbers and ACPI GpioIo/GpioInt resources. However, there is a certain set of Intel_Strago based Chromebooks where i8042 keyboard controller IRQ number is hardcoded be 182 (this is corrected with newer coreboot but the older ones still have the hardcoded Linux IRQ number). Because of this hardcoded IRQ number keyboard on those systems accidentally broke again.
Fix this by iteratively associating IRQ descriptors to the chip irqdomain so that there are no gaps on those systems. Other systems are not affected.
--- drivers/pinctrl/intel/pinctrl-cherryview.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/pinctrl/intel/pinctrl-cherryview.c +12 -4
@@ -1622,22 +1622,30 @@ static int chv_gpio_probe(struct chv_pinif (!need_valid_mask) { irq_base =devm_irq_alloc_descs (pctrl->dev,-1 ,0 , - chip->ngpio,NUMA_NO_NODE ); + community->npins,NUMA_NO_NODE );if (irq_base <0 ) {dev_err (pctrl->dev,"Failed to allocate IRQ numbers\n" );return irq_base; } - }else { - irq_base =0 ; } - ret =gpiochip_irqchip_add (chip, &chv_gpio_irqchip, irq_base, + ret =gpiochip_irqchip_add (chip, &chv_gpio_irqchip,0 , handle_bad_irq,IRQ_TYPE_NONE );if (ret) {dev_err (pctrl->dev,"failed to add IRQ chip\n" );return ret; } +if (!need_valid_mask) { +for (i =0 ; i < community->ngpio_ranges; i++) { + range = &community->gpio_ranges[i]; + +irq_domain_associate_many (chip->irq.domain, irq_base, + range->base, range->npins); + irq_base += range->npins; + } + } +gpiochip_set_chained_irqchip (chip, &chv_gpio_irqchip, irq, chv_gpio_irq_handler);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 155/279 mtd: onenand: omap2: Disable DMA for HIGHMEM buffers
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ladislav Michl <[email protected]>
[ Upstream commit 6732cfd4cac514b556f36b518670af91c8bdf19a ]
dma_map_single does not work for vmalloc-ed buffers, so disable DMA in this case.
--- drivers/mtd/onenand/omap2.c | 105 +++++++++++++++----------------------------- 1 file changed, 38 insertions(+), 67 deletions(-)
drivers/mtd/onenand/omap2.c +38 -67
@@ -377,56 +377,42 @@ static int omap2_onenand_read_bufferram( { struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd);struct onenand_chip *this = mtd->priv; -dma_addr_t dma_src, dma_dst; -int bram_offset; +struct device *dev = &c->pdev->dev;void *buf = (void *)buffer; +dma_addr_t dma_src, dma_dst; +int bram_offset, err;size_t xtra; -int ret; bram_offset =omap2_onenand_bufferram_offset (mtd, area) + area + offset; -if (bram_offset &3 || (size_t )buf &3 || count <384 ) - goto out_copy; - -/* panic_write() may be in an interrupt context */ -if (in_interrupt () || oops_in_progress) +/* +* If the buffer address is not DMA-able, len is not long enough to make +* DMA transfers profitable or panic_write() may be in an interrupt +* context fallback to PIO mode. +*/ +if (!virt_addr_valid (buf) || bram_offset &3 || (size_t )buf &3 || + count <384 ||in_interrupt () || oops_in_progress ) goto out_copy; -if (buf >= high_memory) { -struct page *p1; - -if (((size_t )buf &PAGE_MASK ) != - ((size_t )(buf + count -1 ) &PAGE_MASK )) - goto out_copy; - p1 =vmalloc_to_page (buf); -if (!p1) - goto out_copy; - buf =page_address (p1) + ((size_t )buf & ~PAGE_MASK ); - } - xtra = count &3 ;if (xtra) { count -= xtra;memcpy (buf + count, this->base + bram_offset + count, xtra); } + dma_dst =dma_map_single (dev, buf, count,DMA_FROM_DEVICE ); dma_src = c->phys_base + bram_offset; - dma_dst =dma_map_single (&c->pdev->dev, buf, count,DMA_FROM_DEVICE ); -if (dma_mapping_error (&c->pdev->dev, dma_dst)) { -dev_err (&c->pdev->dev, -"Couldn't DMA map a %d byte buffer\n" , - count); - goto out_copy; - } - ret =omap2_onenand_dma_transfer (c, dma_src, dma_dst, count); -dma_unmap_single (&c->pdev->dev, dma_dst, count,DMA_FROM_DEVICE ); - -if (ret) { -dev_err (&c->pdev->dev,"timeout waiting for DMA\n" ); +if (dma_mapping_error (dev, dma_dst)) { +dev_err (dev,"Couldn't DMA map a %d byte buffer\n" , count); goto out_copy; } -return 0 ; + err =omap2_onenand_dma_transfer (c, dma_src, dma_dst, count); +dma_unmap_single (dev, dma_dst, count,DMA_FROM_DEVICE ); +if (!err) +return 0 ; + +dev_err (dev,"timeout waiting for DMA\n" ); out_copy:memcpy (buf, this->base + bram_offset, count);
@@ -439,49 +425,34 @@ static int omap2_onenand_write_bufferram { struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd);struct onenand_chip *this = mtd->priv; -dma_addr_t dma_src, dma_dst; -int bram_offset; +struct device *dev = &c->pdev->dev;void *buf = (void *)buffer; -int ret; +dma_addr_t dma_src, dma_dst; +int bram_offset, err; bram_offset =omap2_onenand_bufferram_offset (mtd, area) + area + offset; -if (bram_offset &3 || (size_t )buf &3 || count <384 ) - goto out_copy; - -/* panic_write() may be in an interrupt context */ -if (in_interrupt () || oops_in_progress) +/* +* If the buffer address is not DMA-able, len is not long enough to make +* DMA transfers profitable or panic_write() may be in an interrupt +* context fallback to PIO mode. +*/ +if (!virt_addr_valid (buf) || bram_offset &3 || (size_t )buf &3 || + count <384 ||in_interrupt () || oops_in_progress ) goto out_copy; -if (buf >= high_memory) { -struct page *p1; - -if (((size_t )buf &PAGE_MASK ) != - ((size_t )(buf + count -1 ) &PAGE_MASK )) - goto out_copy; - p1 =vmalloc_to_page (buf); -if (!p1) - goto out_copy; - buf =page_address (p1) + ((size_t )buf & ~PAGE_MASK ); - } - - dma_src =dma_map_single (&c->pdev->dev, buf, count,DMA_TO_DEVICE ); + dma_src =dma_map_single (dev, buf, count,DMA_TO_DEVICE ); dma_dst = c->phys_base + bram_offset; -if (dma_mapping_error (&c->pdev->dev, dma_src)) { -dev_err (&c->pdev->dev, -"Couldn't DMA map a %d byte buffer\n" , - count); -return -1 ; - } - - ret =omap2_onenand_dma_transfer (c, dma_src, dma_dst, count); -dma_unmap_single (&c->pdev->dev, dma_src, count,DMA_TO_DEVICE ); - -if (ret) { -dev_err (&c->pdev->dev,"timeout waiting for DMA\n" ); +if (dma_mapping_error (dev, dma_src)) { +dev_err (dev,"Couldn't DMA map a %d byte buffer\n" , count); goto out_copy; } -return 0 ; + err =omap2_onenand_dma_transfer (c, dma_src, dma_dst, count); +dma_unmap_page (dev, dma_src, count,DMA_TO_DEVICE ); +if (!err) +return 0 ; + +dev_err (dev,"timeout waiting for DMA\n" ); out_copy:memcpy (this->base + bram_offset, buf, count);
Greg Kroah-Hartman
maintainerPATCH 156/279 bpf, x64: fix memleak when not converging after image
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 3aab8884c9eb99189a3569ac4e6b205371c9ac0b ]
While reviewing x64 JIT code, I noticed that we leak the prior allocated JIT image in the case where proglen != oldproglen during the JIT passes. Prior to the commit e0ee9c12157d ("x86: bpf_jit: fix two bugs in eBPF JIT compiler") we would just break out of the loop, and using the image as the JITed prog since it could only shrink in size anyway. After e0ee9c12157d, we would bail out to out_addrs label where we free addrs and jit_data but not the image coming from bpf_jit_binary_alloc().
--- arch/x86/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/net/bpf_jit_comp.c +2 -2
@@ -1201,6 +1201,7 @@ skip_init_addrs:for (pass =0 ; pass <20 || image; pass++) { proglen =do_jit (prog, addrs, image, oldproglen, &ctx);if (proglen <=0 ) { +out_image: image =NULL ;if (header)bpf_jit_binary_free (header);
@@ -1211,8 +1212,7 @@ skip_init_addrs:if (proglen != oldproglen) {pr_err ("bpf_jit: proglen=%d != oldproglen=%d\n" , proglen, oldproglen); - prog = orig_prog; - goto out_addrs; + goto out_image; }break ; }
Greg Kroah-Hartman
maintainerPATCH 157/279 bpf, x64: fix memleak when not converging on calls
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 39f56ca945af86112753646316c4c92dcd4acd82 ]
The JIT logic in jit_subprogs() is as follows: for all subprogs we allocate a bpf_prog_alloc(), populate it (prog->is_func = 1 here), and pass it to bpf_int_jit_compile(). If a failure occurred during JIT and prog->jited is not set, then we bail out from attempting to JIT the whole program, and punt to the interpreter instead. In case JITing went successful, we fixup BPF call offsets and do another pass to bpf_int_jit_compile() (extra_pass is true at that point) to complete JITing calls. Given that requires to pass JIT context around addrs and jit_data from x86 JIT are freed in the extra_pass in bpf_int_jit_compile() when calls are involved (if not, they can be freed immediately). However, if in the original pass, the JIT image didn't converge then we leak addrs and jit_data since image itself is NULL, the prog->is_func is set and extra_pass is false in that case, meaning both will become unreachable and are never cleaned up, therefore we need to free as well on !image. Only x64 JIT is affected.
--- arch/x86/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +1 -1
@@ -1249,7 +1249,7 @@ out_image: prog = orig_prog; } -if (!prog->is_func || extra_pass) { +if (!image || !prog->is_func || extra_pass) { out_addrs:kfree (addrs);kfree (jit_data);
Greg Kroah-Hartman
maintainerPATCH 158/279 parisc: drivers.c: Fix section mismatches
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit b819439fea305a0bfd6ca23a7994fd1a8847c0d8 ]
Fix two section mismatches in drivers.c:
1) Section mismatch in reference from the function alloc_tree_node() to the function .init.text:create_tree_node().
2) Section mismatch in reference from the function walk_native_bus() to the function .init.text:alloc_pa_dev().
--- arch/parisc/kernel/drivers.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/parisc/kernel/drivers.c +4 -3
@@ -448,7 +448,8 @@ static int match_by_id(struct device * d* Checks all the children of @parent for a matching @id. If none * found, it allocates a new device and returns it. */ -static struct parisc_device *alloc_tree_node (struct device *parent,char id) +static struct parisc_device *__init alloc_tree_node ( +struct device *parent,char id) {struct match_id_data d = { .id = id,
@@ -825,8 +826,8 @@ void walk_lower_bus(struct parisc_device* devices which are not physically connected (such as extra serial & * keyboard ports). This problem is not yet solved. */ -static void walk_native_bus (unsigned long io_io_low,unsigned long io_io_high, -struct device *parent) +static void __init walk_native_bus (unsigned long io_io_low, +unsigned long io_io_high,struct device *parent) {int i, devices_found =0 ;unsigned long hpa = io_io_low;
Greg Kroah-Hartman
maintainerPATCH 159/279 stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 0b26351b910fb8fe6a056f8a1bbccabe50c0e19f ]
Matt reported the following deadlock:
CPU0 CPU1
schedule(.prev=migrate/0) <fault>
pick_next_task() ...
idle_balance() migrate_swap()
active_balance() stop_two_cpus()
spin_lock(stopper0->lock)
spin_lock(stopper1->lock)
ttwu(migrate/0)
smp_cond_load_acquire() -- waits for schedule()
stop_one_cpu(1)
spin_lock(stopper1->lock) -- waits for stopper lockFix this deadlock by taking the wakeups out from under stopper->lock. This allows the active_balance() to queue the stop work and finish the context switch, which in turn allows the wakeup from migrate_swap() to observe the context and complete the wakeup.
--- kernel/stop_machine.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
kernel/stop_machine.c +14 -5
@@ -21,6 +21,7 @@#include <linux/smpboot.h> #include <linux/atomic.h> #include <linux/nmi.h> +#include <linux/sched/wake_q.h> /* * Structure to determine completion condition and record errors. May
@@ -65,27 +66,31 @@ static void cpu_stop_signal_done(struct }static void __cpu_stop_queue_work (struct cpu_stopper *stopper, -struct cpu_stop_work *work) +struct cpu_stop_work *work, +struct wake_q_head *wakeq) {list_add_tail (&work->list, &stopper->works); -wake_up_process (stopper->thread); +wake_q_add (wakeq, stopper->thread); }/* queue @work to @stopper. if offline, @work is completed immediately */ static bool cpu_stop_queue_work (unsigned int cpu,struct cpu_stop_work *work) {struct cpu_stopper *stopper = &per_cpu (cpu_stopper, cpu); +DEFINE_WAKE_Q (wakeq);unsigned long flags;bool enabled;spin_lock_irqsave (&stopper->lock, flags); enabled = stopper->enabled;if (enabled) -__cpu_stop_queue_work (stopper, work); +__cpu_stop_queue_work (stopper, work, &wakeq);else if (work->done)cpu_stop_signal_done (work->done);spin_unlock_irqrestore (&stopper->lock, flags); +wake_up_q (&wakeq); +return enabled; }
@@ -229,6 +234,7 @@ static int cpu_stop_queue_two_works(int {struct cpu_stopper *stopper1 =per_cpu_ptr (&cpu_stopper, cpu1);struct cpu_stopper *stopper2 =per_cpu_ptr (&cpu_stopper, cpu2); +DEFINE_WAKE_Q (wakeq);int err; retry:spin_lock_irq (&stopper1->lock);
@@ -252,8 +258,8 @@ retry: goto unlock; err =0 ; -__cpu_stop_queue_work (stopper1, work1); -__cpu_stop_queue_work (stopper2, work2); +__cpu_stop_queue_work (stopper1, work1, &wakeq); +__cpu_stop_queue_work (stopper2, work2, &wakeq); unlock:spin_unlock (&stopper2->lock);spin_unlock_irq (&stopper1->lock);
@@ -263,6 +269,9 @@ unlock:cpu_relax (); goto retry; } + +wake_up_q (&wakeq); +return err; }/**
Greg Kroah-Hartman
maintainerPATCH 160/279 kthread, sched/wait: Fix kthread_parkme() wait-loop
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 741a76b350897604c48fb12beff1c9b77724dc96 ]
Gaurav reported a problem with __kthread_parkme() where a concurrent try_to_wake_up() could result in competing stores to ->state which, when the TASK_PARKED store got lost bad things would happen.
The comment near set_current_state() actually mentions this competing store, but only mentions the case against TASK_RUNNING. This same store, with different timing, can happen against a subsequent !RUNNING store.
This normally is not a problem, because as per that same comment, the !RUNNING state store is inside a condition based wait-loop:
for (;;) {
set_current_state(TASK_UNINTERRUPTIBLE);
if (!need_sleep)
break;
schedule();
}
__set_current_state(TASK_RUNNING);If we loose the (first) TASK_UNINTERRUPTIBLE store to a previous (concurrent) wakeup, the schedule() will NO-OP and we'll go around the loop once more.
The problem here is that the TASK_PARKED store is not inside the KTHREAD_SHOULD_PARK condition wait-loop.
There is a genuine issue with sleeps that do not have a condition; this is addressed in a subsequent patch.
--- kernel/kthread.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/kthread.c +4 -3
@@ -177,12 +177,13 @@ void *kthread_probe_data(struct task_strstatic void __kthread_parkme (struct kthread *self) { -__set_current_state (TASK_PARKED ); -while (test_bit (KTHREAD_SHOULD_PARK , &self->flags)) { +for (;;) { +set_current_state (TASK_PARKED ); +if (!test_bit (KTHREAD_SHOULD_PARK , &self->flags)) +break ;if (!test_and_set_bit (KTHREAD_IS_PARKED , &self->flags))complete (&self->parked);schedule (); -__set_current_state (TASK_PARKED ); }clear_bit (KTHREAD_IS_PARKED , &self->flags);__set_current_state (TASK_RUNNING );
Greg Kroah-Hartman
maintainerPATCH 161/279 kthread, sched/wait: Fix kthread_parkme() completion issue
In reply to Greg Kroah-Hartman4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 85f1abe0019fcb3ea10df7029056cf42702283a8 ]
Even with the wait-loop fixed, there is a further issue with kthread_parkme(). Upon hotplug, when we do takedown_cpu(), smpboot_park_threads() can return before all those threads are in fact blocked, due to the placement of the complete() in __kthread_parkme().
When that happens, sched_cpu_dying() -> migrate_tasks() can end up migrating such a still runnable task onto another CPU.
Normally the task will have hit schedule() and gone to sleep by the time we do kthread_unpark(), which will then do __kthread_bind() to re-bind the task to the correct CPU.
However, when we loose the initial TASK_PARKED store to the concurrent wakeup issue described previously, do the complete(), get migrated, it is possible to either:
- observe kthread_unpark()'s clearing of SHOULD_PARK and terminate the park and set TASK_RUNNING, or
- __kthread_bind()'s wait_task_inactive() to observe the competing TASK_RUNNING store.
Either way the WARN() in __kthread_bind() will trigger and fail to correctly set the CPU affinity.
Fix this by only issuing the complete() when the kthread has scheduled out. This does away with all the icky 'still running' nonsense.
The alternative is to promote TASK_PARKED to a special state, this guarantees wait_task_inactive() cannot observe a 'stale' TASK_RUNNING and we'll end up doing the right thing, but this preserves the whole icky business of potentially migating the still runnable thing.
--- include/linux/kthread.h | 1 + kernel/kthread.c | 43 +++++++++++++++++++------------------------ kernel/sched/core.c | 32 +++++++++++++++++++++----------- 3 files changed, 41 insertions(+), 35 deletions(-)
include/linux/kthread.h +1 -0
@@ -62,6 +62,7 @@ void *kthread_probe_data(struct task_strint kthread_park (struct task_struct *k);void kthread_unpark (struct task_struct *k);void kthread_parkme (void ); +void kthread_park_complete (struct task_struct *k);int kthreadd (void *unused);extern struct task_struct *kthreadd_task;
kernel/kthread.c +19 -24
77 lines not on this page · raw message
kernel/sched/core.c +21 -11
@@ -30,6 +30,8 @@#include <linux/syscalls.h> #include <linux/sched/isolation.h> +#include <linux/kthread.h> +#include <asm/switch_to.h> #include <asm/tlb.h> #ifdef CONFIG_PARAVIRT
@@ -2733,20 +2735,28 @@ static struct rq *finish_task_switch(strmembarrier_mm_sync_core_before_usermode (mm);mmdrop (mm); } -if (unlikely (prev_state ==TASK_DEAD )) { -if (prev->sched_class->task_dead) - prev->sched_class->task_dead (prev); +if (unlikely (prev_state & (TASK_DEAD |TASK_PARKED ))) { +switch (prev_state) { +case TASK_DEAD : +if (prev->sched_class->task_dead) + prev->sched_class->task_dead (prev); + +/* +* Remove function-return probe instances associated with this +* task and put them back on the free list. +*/ +kprobe_flush_task (prev); -/* -* Remove function-return probe instances associated with this -* task and put them back on the free list. -*/ -kprobe_flush_task (prev); +/* Task is done with its stack. */ +put_task_stack (prev); -/* Task is done with its stack. */ -put_task_stack (prev); +put_task_struct (prev); +break ; -put_task_struct (prev); +case TASK_PARKED : +kthread_park_complete (prev); +break ; + } }tick_nohz_task_switch ();