4.4.177-stable review
Subsystems (6)
Greg Kroah-Hartman
maintainerPATCH 161/230 i2c: cadence: Fix the hold bit setting
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d358def706880defa4c9e87381c5bf086a97d5f9 ]
In case the hold bit is not needed we are carrying the old values. Fix the same by resetting the bit when not needed.
Fixes the sporadic i2c bus lockups on National Instruments Zynq-based devices.
--- drivers/i2c/busses/i2c-cadence.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-cadence.c +7 -2
@@ -378,8 +378,10 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)* Check for the message size against FIFO depth and set the * 'hold bus' bit if it is greater than FIFO depth. */ -if (id->recv_count >CDNS_I2C_FIFO_DEPTH ) +if ((id->recv_count >CDNS_I2C_FIFO_DEPTH ) || id->bus_hold_flag) ctrl_reg |=CDNS_I2C_CR_HOLD ; +else + ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD ;cdns_i2c_writereg (ctrl_reg,CDNS_I2C_CR_OFFSET );
@@ -436,8 +438,11 @@ static void cdns_i2c_msend(struct cdns_i2c *id)* Check for the message size against FIFO depth and set the * 'hold bus' bit if it is greater than FIFO depth. */ -if (id->send_count >CDNS_I2C_FIFO_DEPTH ) +if ((id->send_count >CDNS_I2C_FIFO_DEPTH ) || id->bus_hold_flag) ctrl_reg |=CDNS_I2C_CR_HOLD ; +else + ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD ; +cdns_i2c_writereg (ctrl_reg,CDNS_I2C_CR_OFFSET );/* Clear the interrupts in interrupt status register. */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 162/230 Input: st-keyscan - fix potential zalloc NULL dereference
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2439d37e1bf8a34d437573c086572abe0f3f1b15 ]
This patch fixes the following static checker warning:
drivers/input/keyboard/st-keyscan.c:156 keyscan_probe()
error: potential zalloc NULL dereference: 'keypad_data->input_dev'
--- drivers/input/keyboard/st-keyscan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/keyboard/st-keyscan.c +2 -2
@@ -153,6 +153,8 @@ static int keyscan_probe(struct platform_device *pdev) input_dev->id.bustype =BUS_HOST ; + keypad_data->input_dev = input_dev; + error =keypad_matrix_key_parse_dt (keypad_data);if (error)return error;
@@ -168,8 +170,6 @@ static int keyscan_probe(struct platform_device *pdev)input_set_drvdata (input_dev, keypad_data); - keypad_data->input_dev = input_dev; - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); keypad_data->base =devm_ioremap_resource (&pdev->dev, res);if (IS_ERR (keypad_data->base))
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 163/230 ARM: 8824/1: fix a migrating irq bug when hotplug cpu
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1b5ba350784242eb1f899bcffd95d2c7cff61e84 ]
Arm TC2 fails cpu hotplug stress test.
This issue was tracked down to a missing copy of the new affinity cpumask for the vexpress-spc interrupt into struct irq_common_data.affinity when the interrupt is migrated in migrate_one_irq().
Fix it by replacing the arm specific hotplug cpu migration with the generic irq code.
This is the counterpart implementation to commit 217d453d473c ("arm64:
fix a migrating irq bug when hotplug cpu").
Tested with cpu hotplug stress test on Arm TC2 (multi_v7_defconfig plus CONFIG_ARM_BIG_LITTLE_CPUFREQ=y and CONFIG_ARM_VEXPRESS_SPC_CPUFREQ=y). The vexpress-spc interrupt (irq=22) on this board is affine to CPU0. Its affinity cpumask now changes correctly e.g. from 0 to 1-4 when CPU0 is hotplugged out.
--- arch/arm/Kconfig | 1 + arch/arm/include/asm/irq.h | 1 - arch/arm/kernel/irq.c | 62 -------------------------------------- arch/arm/kernel/smp.c | 2 +- 4 files changed, 2 insertions(+), 64 deletions(-)
arch/arm/Kconfig +1 -0
@@ -1475,6 +1475,7 @@ config NR_CPUS config HOTPLUG_CPU bool "Support for hot-pluggable CPUs" depends on SMP + select GENERIC_IRQ_MIGRATION help Say Y here to experiment with turning CPUs off and on. CPUs can be controlled through /sys/devices/system/cpu.
arch/arm/include/asm/irq.h +0 -1
@@ -24,7 +24,6 @@#ifndef __ASSEMBLY__struct irqaction ;struct pt_regs ; -extern void migrate_irqs (void );extern void asm_do_IRQ (unsigned int ,struct pt_regs *);void handle_IRQ (unsigned int ,struct pt_regs *);
arch/arm/kernel/irq.c +0 -62
71 lines not on this page · raw message
arch/arm/kernel/smp.c +1 -1
@@ -218,7 +218,7 @@ int __cpu_disable(void)/* * OK - migrate IRQs away from this CPU */ -migrate_irqs (); +irq_migrate_all_off_this_cpu ();/* * Flush user cache and TLB mappings, and then remove this CPU
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 164/230 assoc_array: Fix shortcut creation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit bb2ba2d75a2d673e76ddaf13a9bd30d6a8b1bb08 ]
Fix the creation of shortcuts for which the length of the index key value is an exact multiple of the machine word size. The problem is that the code that blanks off the unused bits of the shortcut value malfunctions if the number of bits in the last word equals machine word size. This is due to the "<<" operator being given a shift of zero in this case, and so the mask that should be all zeros is all ones instead. This causes the subsequent masking operation to clear everything rather than clearing nothing.
Ordinarily, the presence of the hash at the beginning of the tree index key makes the issue very hard to test for, but in this case, it was encountered due to a development mistake that caused the hash output to be either 0 (keyring) or 1 (non-keyring) only. This made it susceptible to the keyctl/unlink/valid test in the keyutils package.
The fix is simply to skip the blanking if the shift would be 0. For example, an index key that is 64 bits long would produce a 0 shift and thus a 'blank' of all 1s. This would then be inverted and AND'd onto the index_key, incorrectly clearing the entire last word.
--- lib/assoc_array.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
lib/assoc_array.c +5 -3
@@ -781,9 +781,11 @@ all_leaves_cluster_together: new_s0->index_key[i] = ops->get_key_chunk (index_key, i *ASSOC_ARRAY_KEY_CHUNK_SIZE ); - blank =ULONG_MAX << (level &ASSOC_ARRAY_KEY_CHUNK_MASK ); -pr_devel ("blank off [%zu] %d: %lx\n" , keylen -1 , level, blank); - new_s0->index_key[keylen -1 ] &= ~blank; +if (level &ASSOC_ARRAY_KEY_CHUNK_MASK ) { + blank =ULONG_MAX << (level &ASSOC_ARRAY_KEY_CHUNK_MASK ); +pr_devel ("blank off [%zu] %d: %lx\n" , keylen -1 , level, blank); + new_s0->index_key[keylen -1 ] &= ~blank; + }/* This now reduces to a node splitting exercise for which we'll need * to regenerate the disparity table.
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 165/230 scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 79edd00dc6a96644d76b4a1cb97d94d49e026768 ]
When a target sends Check Condition, whilst initiator is busy xmiting re-queued data, could lead to race between iscsi_complete_task() and iscsi_xmit_task() and eventually crashing with the following kernel backtrace.
[3326150.987523] ALERT: BUG: unable to handle kernel NULL pointer dereference at 0000000000000078 [3326150.987549] ALERT: IP: [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.987571] WARN: PGD 569c8067 PUD 569c9067 PMD 0 [3326150.987582] WARN: Oops: 0002 [#1] SMP [3326150.987593] WARN: Modules linked in: tun nfsv3 nfs fscache dm_round_robin [3326150.987762] WARN: CPU: 2 PID: 8399 Comm: kworker/u32:1 Tainted: G O 4.4.0+2 #1 [3326150.987774] WARN: Hardware name: Dell Inc. PowerEdge R720/0W7JN5, BIOS 2.5.4 01/22/2016 [3326150.987790] WARN: Workqueue: iscsi_q_13 iscsi_xmitworker [libiscsi] [3326150.987799] WARN: task: ffff8801d50f3800 ti: ffff8801f5458000 task.ti: ffff8801f5458000 [3326150.987810] WARN: RIP: e030:[<ffffffffa05ce70d>] [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.987825] WARN: RSP: e02b:ffff8801f545bdb0 EFLAGS: 00010246 [3326150.987831] WARN: RAX: 00000000ffffffc3 RBX: ffff880282d2ab20 RCX: ffff88026b6ac480 [3326150.987842] WARN: RDX: 0000000000000000 RSI: 00000000fffffe01 RDI: ffff880282d2ab20 [3326150.987852] WARN: RBP: ffff8801f545bdc8 R08: 0000000000000000 R09: 0000000000000008 [3326150.987862] WARN: R10: 0000000000000000 R11: 000000000000fe88 R12: 0000000000000000 [3326150.987872] WARN: R13: ffff880282d2abe8 R14: ffff880282d2abd8 R15: ffff880282d2ac08 [3326150.987890] WARN: FS: 00007f5a866b4840(0000) GS:ffff88028a640000(0000) knlGS:0000000000000000 [3326150.987900] WARN: CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [3326150.987907] WARN: CR2: 0000000000000078 CR3: 0000000070244000 CR4: 0000000000042660 [3326150.987918] WARN: Stack: [3326150.987924] WARN: ffff880282d2ad58 ffff880282d2ab20 ffff880282d2abe8 ffff8801f545be18 [3326150.987938] WARN: ffffffffa05cea90 ffff880282d2abf8 ffff88026b59cc80 ffff88026b59cc00 [3326150.987951] WARN: ffff88022acf32c0 ffff880289491800 ffff880255a80800 0000000000000400 [3326150.987964] WARN: Call Trace: [3326150.987975] WARN: [<ffffffffa05cea90>] iscsi_xmitworker+0x2f0/0x360 [libiscsi] [3326150.987988] WARN: [<ffffffff8108862c>] process_one_work+0x1fc/0x3b0 [3326150.987997] WARN: [<ffffffff81088f95>] worker_thread+0x2a5/0x470 [3326150.988006] WARN: [<ffffffff8159cad8>] ? __schedule+0x648/0x870 [3326150.988015] WARN: [<ffffffff81088cf0>] ? rescuer_thread+0x300/0x300 [3326150.988023] WARN: [<ffffffff8108ddf5>] kthread+0xd5/0xe0 [3326150.988031] WARN: [<ffffffff8108dd20>] ? kthread_stop+0x110/0x110 [3326150.988040] WARN: [<ffffffff815a0bcf>] ret_from_fork+0x3f/0x70 [3326150.988048] WARN: [<ffffffff8108dd20>] ? kthread_stop+0x110/0x110 [3326150.988127] ALERT: RIP [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.988138] WARN: RSP <ffff8801f545bdb0> [3326150.988144] WARN: CR2: 0000000000000078 [3326151.020366] WARN: ---[ end trace 1c60974d4678d81b ]---
Commit 6f8830f5bbab ("scsi: libiscsi: add lock around task lists to fix list corruption regression") introduced "taskqueuelock" to fix list corruption during the race, but this wasn't enough.
Re-setting of conn->task to NULL, could race with iscsi_xmit_task(). iscsi_complete_task()
{
....
if (conn->task == task)
conn->task = NULL;
}conn->task in iscsi_xmit_task() could be NULL and so will be task. __iscsi_get_task(task) will crash (NullPtr de-ref), trying to access refcount.
iscsi_xmit_task()
{
struct iscsi_task *task = conn->task;
__iscsi_get_task(task);
}This commit will take extra conn->session->back_lock in iscsi_xmit_task() to ensure iscsi_xmit_task() waits for iscsi_complete_task(), if iscsi_complete_task() wins the race. If iscsi_xmit_task() wins the race, iscsi_xmit_task() increments task->refcount
(__iscsi_get_task) ensuring iscsi_complete_task() will not iscsi_free_task().
--- drivers/scsi/libiscsi.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/scsi/libiscsi.c +6 -0
@@ -1448,7 +1448,13 @@ static int iscsi_xmit_task(struct iscsi_conn *conn)if (test_bit (ISCSI_SUSPEND_BIT , &conn->suspend_tx))return -ENODATA ; +spin_lock_bh (&conn->session->back_lock); +if (conn->task ==NULL ) { +spin_unlock_bh (&conn->session->back_lock); +return -ENODATA ; + }__iscsi_get_task (task); +spin_unlock_bh (&conn->session->back_lock);spin_unlock_bh (&conn->session->frwd_lock); rc = conn->session->tt->xmit_task (task);spin_lock_bh (&conn->session->frwd_lock);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 166/230 net: systemport: Fix reception of BPDUs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a40061ea2e39494104602b3048751341bda374a1 ]
SYSTEMPORT has its RXCHK parser block that attempts to validate the packet structures, unfortunately setting the L2 header check bit will cause Bridge PDUs (BPDUs) to be incorrectly rejected because they look like LLC/SNAP packets with a non-IPv4 or non-IPv6 Ethernet Type.
--- drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/broadcom/bcmsysport.c +4 -0
@@ -126,6 +126,10 @@ static int bcm_sysport_set_rx_csum(struct net_device *dev, priv->rx_chk_en = !!(wanted &NETIF_F_RXCSUM ); reg =rxchk_readl (priv,RXCHK_CONTROL ); +/* Clear L2 header checks, which would prevent BPDUs +* from being received. +*/ + reg &= ~RXCHK_L2_HDR_DIS ;if (priv->rx_chk_en) reg |=RXCHK_EN ;else
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 167/230 pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c17abcfa93bf0be5e48bb011607d237ac2bfc839 ]
Fix the mismatch between the "sdxc_d13_1_a" pin group definition from meson8b_cbus_groups and the entry in sdxc_a_groups ("sdxc_d0_13_1_a"). This makes it possible to use "sdxc_d13_1_a" in device-tree files to route the MMC data 1..3 pins to GPIOX_1..3.
--- drivers/pinctrl/meson/pinctrl-meson8b.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/meson/pinctrl-meson8b.c +1 -1
@@ -656,7 +656,7 @@ static const char * const sd_a_groups[] = {static const char *const sdxc_a_groups[] = {"sdxc_d0_0_a" ,"sdxc_d13_0_a" ,"sdxc_d47_a" ,"sdxc_clk_a" , -"sdxc_cmd_a" ,"sdxc_d0_1_a" ,"sdxc_d0_13_1_a" +"sdxc_cmd_a" ,"sdxc_d0_1_a" ,"sdxc_d13_1_a" };static const char *const pcm_a_groups[] = {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 168/230 net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e928b5d6b75e239feb9c6d5488974b6646a0ebc8 ]
If mv643xx_eth_shared_of_probe() fails, mv643xx_eth_shared_probe() leaves clk enabled.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/net/ethernet/marvell/mv643xx_eth.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/mv643xx_eth.c +6 -1
@@ -2884,7 +2884,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev) ret =mv643xx_eth_shared_of_probe (pdev);if (ret) -return ret; + goto err_put_clk; pd =dev_get_platdata (&pdev->dev); msp->tx_csum_limit = (pd != NULL && pd->tx_csum_limit) ?
@@ -2892,6 +2892,11 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)infer_hw_params (msp);return 0 ; + +err_put_clk: +if (!IS_ERR (msp->clk)) +clk_disable_unprepare (msp->clk); +return ret; }static int mv643xx_eth_shared_remove (struct platform_device *pdev)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 169/230 ASoC: topology: free created components in tplg load error
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 304017d31df36fb61eb2ed3ebf65fb6870b3c731 ]
Topology resources are no longer needed if any element failed to load.
--- sound/soc/soc-topology.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/soc/soc-topology.c +7 -1
@@ -1770,6 +1770,7 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp, struct snd_soc_tplg_ops *ops, const struct firmware *fw, u32 id) { struct soc_tplg tplg; +int ret;/* setup parsing context */ memset (&tplg,0 ,sizeof (tplg));
@@ -1783,7 +1784,12 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp, tplg.bytes_ext_ops = ops->bytes_ext_ops; tplg.bytes_ext_ops_count = ops->bytes_ext_ops_count; -return soc_tplg_load (&tplg); + ret =soc_tplg_load (&tplg); +/* free the created components if fail to load topology */ +if (ret) +snd_soc_tplg_component_remove (comp,SND_SOC_TPLG_INDEX_ALL ); + +return ret; }EXPORT_SYMBOL_GPL (snd_soc_tplg_component_load);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 170/230 arm64: Relax GIC version check during early boot
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 74698f6971f25d045301139413578865fc2bd8f9 ]
Updates to the GIC architecture allow ID_AA64PFR0_EL1.GIC to have values other than 0 or 1. At the moment, Linux is quite strict in the way it handles this field at early boot stage (cpufeature is fine) and will refuse to use the system register CPU interface if it doesn't find the value 1.
--- arch/arm64/kernel/head.S | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm64/kernel/head.S +1 -2
@@ -478,8 +478,7 @@ CPU_LE( bic x0, x0, #(3 << 24) ) // Clear the EE and E0E bits for EL1 /* GICv3 system register access */ mrs x0, id_aa64pfr0_el1 ubfx x0, x0, #24, #4 - cmp x0, #1 - b.ne 3f + cbz x0, 3f mrs_s x0, ICC_SRE_EL2 orr x0, x0, #ICC_SRE_EL2_SRE // Set ICC_SRE_EL2.SRE==1
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 171/230 tmpfs: fix link accounting when a tmpfile is linked in
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1062af920c07f5b54cf5060fde3339da6df0cf6b ]
tmpfs has a peculiarity of accounting hard links as if they were separate inodes: so that when the number of inodes is limited, as it is by default, a user cannot soak up an unlimited amount of unreclaimable dcache memory just by repeatedly linking a file.
But when v3.11 added O_TMPFILE, and the ability to use linkat() on the fd, we missed accommodating this new case in tmpfs: "df -i" shows that an extra "inode" remains accounted after the file is unlinked and the fd closed and the actual inode evicted. If a user repeatedly links tmpfiles into a tmpfs, the limit will be hit (ENOSPC) even after they are deleted.
Just skip the extra reservation from shmem_link() in this case: there's a sense in which this first link of a tmpfile is then cheaper than a hard link of another file, but the accounting works out, and there's still good limiting, so no need to do anything more complicated.
--- mm/shmem.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
mm/shmem.c +7 -3
@@ -2299,10 +2299,14 @@ static int shmem_link(struct dentry *old_dentry, struct inode *dir, struct dentr* No ordinary (disk based) filesystem counts links as inodes; * but each new link needs a new dentry, pinning lowmem, and * tmpfs dentries cannot be pruned until they are unlinked. +* But if an O_TMPFILE file is linked into the tmpfs, the +* first link must skip that, to get the accounting right. */ - ret =shmem_reserve_inode (inode->i_sb); -if (ret) - goto out; +if (inode->i_nlink) { + ret =shmem_reserve_inode (inode->i_sb); +if (ret) + goto out; + } dir->i_size +=BOGO_DIRENT_SIZE ; inode->i_ctime = dir->i_ctime = dir->i_mtime =CURRENT_TIME ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 172/230 ARC: uacces: remove lp_start, lp_end from clobber list
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d5e3c55e01d8b1774b37b4647c30fb22f1d39077 ]
Newer ARC gcc handles lp_start, lp_end in a different way and doesn't like them in the clobber list.
--- arch/arc/include/asm/uaccess.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arc/include/asm/uaccess.h +4 -4
@@ -209,7 +209,7 @@ __arc_copy_from_user(void *to, const void __user *from, unsigned long n)*/ "=&r" (tmp), "+r" (to), "+r" (from) : - : "lp_count", "lp_start", "lp_end", "memory"); + : "lp_count", "memory"); return n; }
@@ -438,7 +438,7 @@ __arc_copy_to_user(void __user *to, const void *from, unsigned long n)*/ "=&r" (tmp), "+r" (to), "+r" (from) : - : "lp_count", "lp_start", "lp_end", "memory"); + : "lp_count", "memory"); return n; }
@@ -658,7 +658,7 @@ static inline unsigned long __arc_clear_user(void __user *to, unsigned long n)" .previous \n" : "+r"(d_char), "+r"(res) : "i"(0) - : "lp_count", "lp_start", "lp_end", "memory"); + : "lp_count", "memory"); return res; }
@@ -691,7 +691,7 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count) " .previous \n" : "+r"(res), "+r"(dst), "+r"(src), "=r"(val) : "g"(-EFAULT), "r"(count) - : "lp_count", "lp_start", "lp_end", "memory"); + : "lp_count", "memory");return res; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 173/230 phonet: fix building with clang
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6321aa197547da397753757bd84c6ce64b3e3d89 ]
clang warns about overflowing the data[] member in the struct pnpipehdr:
net/phonet/pep.c:295:8: warning: array index 4 is past the end of the array (which contains 1 element) [-Warray-bounds]
if (hdr->data[4] == PEP_IND_READY)
^ ~
include/net/phonet/pep.h:66:3: note: array 'data' declared here
u8 data[1];Using a flexible array member at the end of the struct avoids the warning, but since we cannot have a flexible array member inside of the union, each index now has to be moved back by one, which makes it a little uglier.
--- include/net/phonet/pep.h | 5 +++-- net/phonet/pep.c | 32 ++++++++++++++++---------------- 2 files changed, 19 insertions(+), 18 deletions(-)
include/net/phonet/pep.h +3 -2
@@ -63,10 +63,11 @@ struct pnpipehdr {u8 state_after_reset;/* reset request */ u8 error_code;/* any response */ u8 pep_type;/* status indication */ -u8 data[1 ]; +u8 data0;/* anything else */ }; +u8 data[]; }; -#define other_pep_type data[1] +#define other_pep_type data[0]static inline struct pnpipehdr *pnp_hdr (struct sk_buff *skb) {
net/phonet/pep.c +16 -16
@@ -131,7 +131,7 @@ static int pep_indicate(struct sock *sk, u8 id, u8 code, ph->utid =0 ; ph->message_id = id; ph->pipe_handle = pn->pipe_handle; - ph->data[0 ] = code; + ph->error_code = code;return pn_skb_send (sk, skb,NULL ); }
@@ -152,7 +152,7 @@ static int pipe_handler_request(struct sock *sk, u8 id, u8 code, ph->utid = id;/* whatever */ ph->message_id = id; ph->pipe_handle = pn->pipe_handle; - ph->data[0 ] = code; + ph->error_code = code;return pn_skb_send (sk, skb,NULL ); }
@@ -207,7 +207,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,struct pnpipehdr *ph;struct sockaddr_pn dst;u8 data[4 ] = { - oph->data[0 ],/* PEP type */ + oph->pep_type,/* PEP type */ code,/* error code, at an unusual offset */ PAD ,PAD , };
@@ -220,7 +220,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code, ph->utid = oph->utid; ph->message_id =PNS_PEP_CTRL_RESP ; ph->pipe_handle = oph->pipe_handle; - ph->data[0 ] = oph->data[1 ];/* CTRL id */ + ph->data0 = oph->data[0 ];/* CTRL id */ pn_skb_get_src_sockaddr (oskb, &dst);return pn_skb_send (sk, skb, &dst);
@@ -271,17 +271,17 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)return -EINVAL ; hdr =pnp_hdr (skb); -if (hdr->data[0 ] !=PN_PEP_TYPE_COMMON ) { +if (hdr->pep_type !=PN_PEP_TYPE_COMMON ) {net_dbg_ratelimited ("Phonet unknown PEP type: %u\n" , - (unsigned int )hdr->data[0 ]); + (unsigned int )hdr->pep_type);return -EOPNOTSUPP ; } -switch (hdr->data[1 ]) { +switch (hdr->data[0 ]) {case PN_PEP_IND_FLOW_CONTROL :switch (pn->tx_fc) {case PN_LEGACY_FLOW_CONTROL : -switch (hdr->data[4 ]) { +switch (hdr->data[3 ]) {case PEP_IND_BUSY :atomic_set (&pn->tx_credits,0 );break ;
@@ -291,7 +291,7 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) }break ;case PN_ONE_CREDIT_FLOW_CONTROL : -if (hdr->data[4 ] ==PEP_IND_READY ) +if (hdr->data[3 ] ==PEP_IND_READY )atomic_set (&pn->tx_credits, wake =1 );break ; }
@@ -300,12 +300,12 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)case PN_PEP_IND_ID_MCFC_GRANT_CREDITS :if (pn->tx_fc !=PN_MULTI_CREDIT_FLOW_CONTROL )break ; -atomic_add (wake = hdr->data[4 ], &pn->tx_credits); +atomic_add (wake = hdr->data[3 ], &pn->tx_credits);break ;default :net_dbg_ratelimited ("Phonet unknown PEP indication: %u\n" , - (unsigned int )hdr->data[1 ]); + (unsigned int )hdr->data[0 ]);return -EOPNOTSUPP ; }if (wake)
@@ -317,7 +317,7 @@ static int pipe_rcv_created(struct sock *sk, struct sk_buff *skb) {struct pep_sock *pn =pep_sk (sk);struct pnpipehdr *hdr =pnp_hdr (skb); -u8 n_sb = hdr->data[0 ]; +u8 n_sb = hdr->data0; pn->rx_fc = pn->tx_fc =PN_LEGACY_FLOW_CONTROL ;__skb_pull (skb,sizeof (*hdr));
@@ -505,7 +505,7 @@ static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb)return -ECONNREFUSED ;/* Parse sub-blocks */ - n_sb = hdr->data[4 ]; + n_sb = hdr->data[3 ];while (n_sb >0 ) {u8 type, buf[6 ], len =sizeof (buf);const u8 *data =pep_get_sb (skb, &type, &len, buf);
@@ -738,7 +738,7 @@ static int pipe_do_remove(struct sock *sk) ph->utid =0 ; ph->message_id =PNS_PIPE_REMOVE_REQ ; ph->pipe_handle = pn->pipe_handle; - ph->data[0 ] =PAD ; + ph->data0 =PAD ;return pn_skb_send (sk, skb,NULL ); }
@@ -815,7 +815,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp) peer_type = hdr->other_pep_type <<8 ;/* Parse sub-blocks (options) */ - n_sb = hdr->data[4 ]; + n_sb = hdr->data[3 ];while (n_sb >0 ) {u8 type, buf[1 ], len =sizeof (buf);const u8 *data =pep_get_sb (skb, &type, &len, buf);
@@ -1106,7 +1106,7 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb) ph->utid =0 ;if (pn->aligned) { ph->message_id =PNS_PIPE_ALIGNED_DATA ; - ph->data[0 ] =0 ;/* padding */ + ph->data0 =0 ;/* padding */ }else ph->message_id =PNS_PIPE_DATA ; ph->pipe_handle = pn->pipe_handle;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 174/230 mac80211_hwsim: propagate genlmsg_reply return code
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 17407715240456448e4989bee46ffc93991add83 ]
genlmsg_reply can fail, so propagate its return code
--- drivers/net/wireless/mac80211_hwsim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mac80211_hwsim.c +1 -1
@@ -3002,7 +3002,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info) goto out_err; } -genlmsg_reply (skb, info); + res =genlmsg_reply (skb, info);break ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 175/230 net: set static variable an initial value in atl2_probe()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4593403fa516a5a4cffe6883c5062d60932cbfbe ]
cards_found is a static variable, but when it enters atl2_probe(), cards_found is set to zero, the value is not consistent with last probe, so next behavior is not our expect.
--- drivers/net/ethernet/atheros/atlx/atl2.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/atheros/atlx/atl2.c +1 -3
@@ -1338,13 +1338,11 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) {struct net_device *netdev;struct atl2_adapter *adapter; -static int cards_found; +static int cards_found =0 ;unsigned long mmio_start;int mmio_len;int err; - cards_found =0 ; - err =pci_enable_device (pdev);if (err)return err;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 176/230 tmpfs: fix uninitialized return value in shmem_link
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 29b00e609960ae0fcff382f4c7079dd0874a5311 ]
When we made the shmem_reserve_inode call in shmem_link conditional, we forgot to update the declaration for ret so that it always has a known value. Dan Carpenter pointed out this deficiency in the original patch.
--- mm/shmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/shmem.c +1 -1
@@ -2293,7 +2293,7 @@ static int shmem_create(struct inode *dir, struct dentry *dentry, umode_t mode,static int shmem_link (struct dentry *old_dentry,struct inode *dir,struct dentry *dentry) {struct inode *inode =d_inode (old_dentry); -int ret; +int ret =0 ;/* * No ordinary (disk based) filesystem counts links as inodes;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 177/230 stm class: Prevent division by zero
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <[email protected]>
commit bf7cbaae0831252b416f375ca9b1027ecd4642dd upstream.
Using STP_POLICY_ID_SET ioctl command with dummy_stm device, or any STM device that supplies zero mmio channel size, will trigger a division by zero bug in the kernel.
Prevent this by disallowing channel widths other than 1 for such devices.
--- drivers/hwtracing/stm/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/hwtracing/stm/core.c +5 -3
@@ -477,7 +477,7 @@ static int stm_char_policy_set_ioctl(str {struct stm_device *stm = stmf->stm;struct stp_policy_id *id; -int ret = -EINVAL ; +int ret = -EINVAL , wlimit =1 ;u32 size;if (stmf->output.nr_chans)
@@ -505,8 +505,10 @@ static int stm_char_policy_set_ioctl(strif (id->__reserved_0 || id->__reserved_1) goto err_free; -if (id->width <1 || - id->width >PAGE_SIZE / stm->data->sw_mmiosz) +if (stm->data->sw_mmiosz) + wlimit =PAGE_SIZE / stm->data->sw_mmiosz; + +if (id->width <1 || id->width > wlimit) goto err_free; ret =stm_file_assign (stmf, id->id, id->width);
Greg Kroah-Hartman
maintainerPATCH 178/230 crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit eaf46edf6ea89675bd36245369c8de5063a0272c upstream.
The NEON MAC calculation routine fails to handle the case correctly where there is some data in the buffer, and the input fills it up exactly. In this case, we enter the loop at the end with w8 == 0, while a negative value is assumed, and so the loop carries on until the increment of the 32-bit counter wraps around, which is quite obviously wrong.
So omit the loop altogether in this case, and exit right away.
--- arch/arm64/crypto/aes-ce-ccm-core.S | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/arm64/crypto/aes-ce-ccm-core.S +3 -2
@@ -74,12 +74,13 @@ ENTRY(ce_aes_ccm_auth_data) beq 10f ext v0.16b, v0.16b, v0.16b, #1 /* rotate out the mac bytes */ b 7b -8: mov w7, w8 +8: cbz w8, 91f + mov w7, w8 add w8, w8, #16 9: ext v1.16b, v1.16b, v1.16b, #1 adds w7, w7, #1 bne 9b - eor v0.16b, v0.16b, v1.16b +91: eor v0.16b, v0.16b, v1.16b st1 {v0.16b}, [x0] 10: str w8, [x3] ret
Greg Kroah-Hartman
maintainerPATCH 179/230 CIFS: Fix read after write for files with read caching
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 6dfbd84684700cb58b34e8602c01c12f3d2595c8 upstream.
When we have a READ lease for a file and have just issued a write operation to the server we need to purge the cache and set oplock/lease level to NONE to avoid reading stale data. Currently we do that only if a write operation succedeed thus not covering cases when a request was sent to the server but a negative error code was returned later for some other reasons (e.g. -EIOCBQUEUED or -EINTR). Fix this by turning off caching regardless of the error code being returned.
The patches fixes generic tests 075 and 112 from the xfs-tests.
--- fs/cifs/file.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/cifs/file.c +7 -5
@@ -2753,14 +2753,16 @@ cifs_strict_writev(struct kiocb *iocb, s* these pages but not on the region from pos to ppos+len-1. */ written =cifs_user_writev (iocb, from); -if (written >0 &&CIFS_CACHE_READ (cinode)) { +if (CIFS_CACHE_READ (cinode)) {/* -* Windows 7 server can delay breaking level2 oplock if a write -* request comes - break it on the client to prevent reading -* an old data. +* We have read level caching and we have just sent a write +* request to the server thus making data in the cache stale. +* Zap the cache and set oplock/lease level to NONE to avoid +* reading stale data from the cache. All subsequent read +* operations will read new data from the server. */ cifs_zap_mapping (inode); -cifs_dbg (FYI ,"Set no oplock for inode=%p after a write operation\n" , +cifs_dbg (FYI ,"Set Oplock/Lease to NONE for inode=%p after write\n" , inode); cinode->oplock =0 ; }
Greg Kroah-Hartman
maintainerPATCH 180/230 tracing: Do not free iter->trace in fail path of tracing_open_pipe()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhangyi (F) <[email protected]>
commit e7f0c424d0806b05d6f47be9f202b037eb701707 upstream.
Commit d716ff71dd12 ("tracing: Remove taking of trace_types_lock in pipe files") use the current tracer instead of the copy in tracing_open_pipe(), but it forget to remove the freeing sentence in the error path.
There's an error path that can call kfree(iter->trace) after the iter->trace was assigned to tr->current_trace, which would be bad to free.
--- kernel/trace/trace.c | 1 - 1 file changed, 1 deletion(-)
kernel/trace/trace.c +0 -1
@@ -4646,7 +4646,6 @@ out:return ret; fail: -kfree (iter->trace);kfree (iter);__trace_array_put (tr);mutex_unlock (&trace_types_lock);
Greg Kroah-Hartman
maintainerPATCH 181/230 ACPI / device_sysfs: Avoid OF modalias creation for removed device
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit f16eb8a4b096514ac06fb25bf599dcc792899b3d upstream.
If SSDT overlay is loaded via ConfigFS and then unloaded the device, we would like to have OF modalias for, already gone. Thus, acpi_get_name() returns no allocated buffer for such case and kernel crashes afterwards:
ACPI: Host-directed Dynamic ACPI Table Unload ads7950 spi-PRP0001:00: Dropping the link to regulator.0
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 #PF error: [normal kernel read fault] PGD 80000000070d6067 P4D 80000000070d6067 PUD 70d0067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 40 Comm: kworker/u4:2 Not tainted 5.0.0+ #96 Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48 Workqueue: kacpi_hotplug acpi_device_del_work_fn RIP: 0010:create_of_modalias.isra.1+0x4c/0x150 Code: 00 00 48 89 44 24 18 31 c0 48 8d 54 24 08 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 ff ff ff ff e8 7a b0 03 00 48 8b 4c 24 10 <0f> b6 01 84 c0 74 27 48 c7 c7 00 09 f4 a5 0f b6 f0 8d 50 20 f6 04 RSP: 0000:ffffa51040297c10 EFLAGS: 00010246 RAX: 0000000000001001 RBX: 0000000000000785 RCX: 0000000000000000 RDX: 0000000000001001 RSI: 0000000000000286 RDI: ffffa2163dc042e0 RBP: ffffa216062b1196 R08: 0000000000001001 R09: ffffa21639873000 R10: ffffffffa606761d R11: 0000000000000001 R12: ffffa21639873218 R13: ffffa2163deb5060 R14: ffffa216063d1010 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa2163e000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000007114000 CR4: 00000000001006f0 Call Trace: __acpi_device_uevent_modalias+0xb0/0x100 spi_uevent+0xd/0x40
...
In order to fix above let create_of_modalias() check the status returned by acpi_get_name() and bail out in case of failure.
--- drivers/acpi/device_sysfs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/acpi/device_sysfs.c +5 -1
@@ -202,11 +202,15 @@ static int create_of_modalias(struct acp {struct acpi_buffer buf = {ACPI_ALLOCATE_BUFFER };const union acpi_object *of_compatible, *obj; +acpi_status status;int len, count;int i, nval;char *c; -acpi_get_name (acpi_dev->handle,ACPI_SINGLE_NAME , &buf); + status =acpi_get_name (acpi_dev->handle,ACPI_SINGLE_NAME , &buf); +if (ACPI_FAILURE (status)) +return -ENODEV ; +/* DT strings are all in lower case */ for (c = buf.pointer; *c !='\0' ; c++) *c =tolower (*c);
Greg Kroah-Hartman
maintainerPATCH 182/230 regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 56b5d4ea778c1b0989c5cdb5406d4a488144c416 upstream.
LDO35 uses 25 mV step, not 50 mV. Bucks 7 and 8 use 12.5 mV step instead of 6.25 mV. Wrong step caused over-voltage (LDO35) or under-voltage (buck7 and 8) if regulators were used (e.g. on Exynos5420 Arndale Octa board).
--- drivers/regulator/s2mps11.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/regulator/s2mps11.c +3 -3
@@ -372,7 +372,7 @@ static const struct regulator_desc s2mpsregulator_desc_s2mps11_ldo (32 ,STEP_50_MV ),regulator_desc_s2mps11_ldo (33 ,STEP_50_MV ),regulator_desc_s2mps11_ldo (34 ,STEP_50_MV ), -regulator_desc_s2mps11_ldo (35 ,STEP_50_MV ), +regulator_desc_s2mps11_ldo (35 ,STEP_25_MV ),regulator_desc_s2mps11_ldo (36 ,STEP_50_MV ),regulator_desc_s2mps11_ldo (37 ,STEP_50_MV ), regulator_desc_s2mps11_ldo(38, STEP_50_MV),
@@ -382,8 +382,8 @@ static const struct regulator_desc s2mpsregulator_desc_s2mps11_buck1_4 (4 ), regulator_desc_s2mps11_buck5,regulator_desc_s2mps11_buck67810 (6 ,MIN_600_MV ,STEP_6_25_MV ), -regulator_desc_s2mps11_buck67810 (7 ,MIN_600_MV ,STEP_6_25_MV ), -regulator_desc_s2mps11_buck67810 (8 ,MIN_600_MV ,STEP_6_25_MV ), +regulator_desc_s2mps11_buck67810 (7 ,MIN_600_MV ,STEP_12_5_MV ), +regulator_desc_s2mps11_buck67810 (8 ,MIN_600_MV ,STEP_12_5_MV ), regulator_desc_s2mps11_buck9, regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV), };
Greg Kroah-Hartman
maintainerPATCH 183/230 regulator: s2mpa01: Fix step values for some LDOs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Menefy <[email protected]>
commit 28c4f730d2a44f2591cb104091da29a38dac49fe upstream.
The step values for some of the LDOs appears to be incorrect, resulting in incorrect voltages (or at least, ones which are different from the Samsung 3.4 vendor kernel).
--- drivers/regulator/s2mpa01.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/regulator/s2mpa01.c +5 -5
@@ -303,13 +303,13 @@ static const struct regulator_desc regulregulator_desc_ldo (2 ,STEP_50_MV ),regulator_desc_ldo (3 ,STEP_50_MV ),regulator_desc_ldo (4 ,STEP_50_MV ), -regulator_desc_ldo (5 ,STEP_50_MV ), +regulator_desc_ldo (5 ,STEP_25_MV ),regulator_desc_ldo (6 ,STEP_25_MV ),regulator_desc_ldo (7 ,STEP_50_MV ),regulator_desc_ldo (8 ,STEP_50_MV ),regulator_desc_ldo (9 ,STEP_50_MV ),regulator_desc_ldo (10 ,STEP_50_MV ), -regulator_desc_ldo (11 ,STEP_25_MV ), +regulator_desc_ldo (11 ,STEP_50_MV ),regulator_desc_ldo (12 ,STEP_50_MV ),regulator_desc_ldo (13 ,STEP_50_MV ), regulator_desc_ldo(14, STEP_50_MV),
@@ -320,11 +320,11 @@ static const struct regulator_desc regulregulator_desc_ldo (19 ,STEP_50_MV ),regulator_desc_ldo (20 ,STEP_50_MV ),regulator_desc_ldo (21 ,STEP_50_MV ), -regulator_desc_ldo (22 ,STEP_25_MV ), -regulator_desc_ldo (23 ,STEP_25_MV ), +regulator_desc_ldo (22 ,STEP_50_MV ), +regulator_desc_ldo (23 ,STEP_50_MV ),regulator_desc_ldo (24 ,STEP_50_MV ),regulator_desc_ldo (25 ,STEP_50_MV ), -regulator_desc_ldo (26 ,STEP_50_MV ), +regulator_desc_ldo (26 ,STEP_25_MV ),regulator_desc_buck1_4 (1 ),regulator_desc_buck1_4 (2 ), regulator_desc_buck1_4(3),
Greg Kroah-Hartman
maintainerPATCH 184/230 clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Menefy <[email protected]>
commit a5719a40aef956ba704f2aa1c7b977224d60fa96 upstream.
When a timer tick occurs and the clock is in one-shot mode, the timer needs to be stopped to prevent it triggering subsequent interrupts. Currently this code is in exynos4_mct_tick_clear(), but as it is only needed when an ISR occurs move it into exynos4_mct_tick_isr(), leaving exynos4_mct_tick_clear() just doing what its name suggests it should.
--- drivers/clocksource/exynos_mct.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/clocksource/exynos_mct.c +11 -11
@@ -379,6 +379,13 @@ static void exynos4_mct_tick_start(unsigexynos4_mct_write (tmp, mevt->base +MCT_L_TCON_OFFSET ); } +static void exynos4_mct_tick_clear (struct mct_clock_event_device *mevt) +{ +/* Clear the MCT tick interrupt */ +if (readl_relaxed (reg_base + mevt->base +MCT_L_INT_CSTAT_OFFSET ) &1 ) +exynos4_mct_write (0x1 , mevt->base +MCT_L_INT_CSTAT_OFFSET ); +} +static int exynos4_tick_set_next_event (unsigned long cycles,struct clock_event_device *evt) {
@@ -411,8 +418,11 @@ static int set_state_periodic(struct cloreturn 0 ; } -static void exynos4_mct_tick_clear (struct mct_clock_event_device *mevt) +static irqreturn_t exynos4_mct_tick_isr (int irq,void *dev_id) { +struct mct_clock_event_device *mevt = dev_id; +struct clock_event_device *evt = &mevt->evt; +/* * This is for supporting oneshot mode. * Mct would generate interrupt periodically
@@ -421,16 +431,6 @@ static void exynos4_mct_tick_clear(strucif (!clockevent_state_periodic (&mevt->evt))exynos4_mct_tick_stop (mevt); -/* Clear the MCT tick interrupt */ -if (readl_relaxed (reg_base + mevt->base +MCT_L_INT_CSTAT_OFFSET ) &1 ) -exynos4_mct_write (0x1 , mevt->base +MCT_L_INT_CSTAT_OFFSET ); -} - -static irqreturn_t exynos4_mct_tick_isr (int irq,void *dev_id) -{ -struct mct_clock_event_device *mevt = dev_id; -struct clock_event_device *evt = &mevt->evt; -exynos4_mct_tick_clear (mevt); evt->event_handler (evt);
Greg Kroah-Hartman
maintainerPATCH 185/230 clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Menefy <[email protected]>
commit d2f276c8d3c224d5b493c42b6cf006ae4e64fb1c upstream.
When shutting down the timer, ensure that after we have stopped the timer any pending interrupts are cleared. This fixes a problem when suspending, as interrupts are disabled before the timer is stopped, so the timer interrupt may still be asserted, preventing the system entering a low power state when the wfi is executed.
--- drivers/clocksource/exynos_mct.c | 1 + 1 file changed, 1 insertion(+)
drivers/clocksource/exynos_mct.c +1 -0
@@ -402,6 +402,7 @@ static int set_state_shutdown(struct clo mevt = container_of(evt, struct mct_clock_event_device, evt);exynos4_mct_tick_stop (mevt); +exynos4_mct_tick_clear (mevt);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 186/230 s390/virtio: handle find on invalid queue gracefully
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Halil Pasic <[email protected]>
commit 3438b2c039b4bf26881786a1f3450f016d66ad11 upstream.
A queue with a capacity of zero is clearly not a valid virtio queue. Some emulators report zero queue size if queried with an invalid queue index. Instead of crashing in this case let us just return -ENOENT. To make that work properly, let us fix the notifier cleanup logic as well.
--- drivers/s390/virtio/virtio_ccw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/s390/virtio/virtio_ccw.c +3 -1
@@ -283,6 +283,8 @@ static void virtio_ccw_drop_indicators(s {struct virtio_ccw_vq_info *info; +if (!vcdev->airq_info) +return ;list_for_each_entry (info, &vcdev->virtqueues, node)drop_airq_indicator (info->vq, vcdev->airq_info); }
@@ -423,7 +425,7 @@ static int virtio_ccw_read_vq_conf(struc ret =ccw_io_helper (vcdev, ccw,VIRTIO_CCW_DOING_READ_VQ_CONF );if (ret)return ret; -return vcdev->config_block->num; +return vcdev->config_block->num ?: -ENOENT ; }static void virtio_ccw_del_vq (struct virtqueue *vq,struct ccw1 *ccw)
Greg Kroah-Hartman
maintainerPATCH 187/230 scsi: virtio_scsi: dont send sc payload with tmfs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Franciosi <[email protected]>
commit 3722e6a52174d7c3a00e6f5efd006ca093f346c1 upstream.
The virtio scsi spec defines struct virtio_scsi_ctrl_tmf as a set of device-readable records and a single device-writable response entry:
struct virtio_scsi_ctrl_tmf
{
// Device-readable part
le32 type;
le32 subtype;
u8 lun[8];
le64 id;
// Device-writable part
u8 response;
}The above should be organised as two descriptor entries (or potentially more if using VIRTIO_F_ANY_LAYOUT), but without any extra data after "le64 id" or after "u8 response".
The Linux driver doesn't respect that, with virtscsi_abort() and virtscsi_device_reset() setting cmd->sc before calling virtscsi_tmf(). It results in the original scsi command payload (or writable buffers) added to the tmf.
This fixes the problem by leaving cmd->sc zeroed out, which makes virtscsi_kick_cmd() add the tmf to the control vq without any payload.
--- drivers/scsi/virtio_scsi.c | 2 -- 1 file changed, 2 deletions(-)
drivers/scsi/virtio_scsi.c +0 -2
@@ -692,7 +692,6 @@ static int virtscsi_device_reset(structreturn FAILED ;memset (cmd,0 ,sizeof (*cmd)); - cmd->sc = sc; cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req ){ .type =VIRTIO_SCSI_T_TMF , .subtype = cpu_to_virtio32(vscsi->vdev,
@@ -751,7 +750,6 @@ static int virtscsi_abort(struct scsi_cmreturn FAILED ;memset (cmd,0 ,sizeof (*cmd)); - cmd->sc = sc; cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req ){ .type =VIRTIO_SCSI_T_TMF , .subtype =VIRTIO_SCSI_T_TMF_ABORT_TASK ,
Greg Kroah-Hartman
maintainerPATCH 188/230 scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 32e36bfbcf31452a854263e7c7f32fbefc4b44d8 upstream.
When using SCSI passthrough in combination with the iSCSI target driver then cmd->t_state_lock may be obtained from interrupt context. Hence, all code that obtains cmd->t_state_lock from thread context must disable interrupts first. This patch avoids that lockdep reports the following:
WARNING: inconsistent lock state
4.18.0-dbg+ #1 Not tainted
--------------------------------
inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
iscsi_ttx/1800 [HC1[1]:SC0[2]:HE0:SE0] takes:000000006e7b0ceb (&(&cmd->t_state_lock)->rlock){?...}, at: target_complete_cmd+0x47/0x2c0 [target_core_mod] {HARDIRQ-ON-W} state was registered at:
lock_acquire+0xd2/0x260 _raw_spin_lock+0x32/0x50 iscsit_close_connection+0x97e/0x1020 [iscsi_target_mod] iscsit_take_action_for_connection_exit+0x108/0x200 [iscsi_target_mod] iscsi_target_rx_thread+0x180/0x190 [iscsi_target_mod] kthread+0x1cf/0x1f0 ret_from_fork+0x24/0x30 irq event stamp: 1281 hardirqs last enabled at (1279): [<ffffffff970ade79>] __local_bh_enable_ip+0xa9/0x160 hardirqs last disabled at (1281): [<ffffffff97a008a5>] interrupt_entry+0xb5/0xd0 softirqs last enabled at (1278): [<ffffffff977cd9a1>] lock_sock_nested+0x51/0xc0 softirqs last disabled at (1280): [<ffffffffc07a6e04>] ip6_finish_output2+0x124/0xe40 [ipv6]
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&(&cmd->t_state_lock)->rlock);
<Interrupt>
lock(&(&cmd->t_state_lock)->rlock);
--- drivers/target/iscsi/iscsi_target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/target/iscsi/iscsi_target.c +2 -2
@@ -4232,9 +4232,9 @@ static void iscsit_release_commands_fromstruct se_cmd *se_cmd = &cmd->se_cmd;if (se_cmd->se_tfo !=NULL ) { -spin_lock (&se_cmd->t_state_lock); +spin_lock_irq (&se_cmd->t_state_lock); se_cmd->transport_state |=CMD_T_FABRIC_STOP ; -spin_unlock (&se_cmd->t_state_lock); +spin_unlock_irq (&se_cmd->t_state_lock); } }spin_unlock_bh (&conn->cmd_lock);
Greg Kroah-Hartman
maintainerPATCH 189/230 m68k: Add -ffreestanding to CFLAGS
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
commit 28713169d879b67be2ef2f84dcf54905de238294 upstream.
This patch fixes a build failure when using GCC 8.1:
/usr/bin/ld: block/partitions/ldm.o: in function `ldm_parse_tocblock':block/partitions/ldm.c:153: undefined reference to `strcmp'
This is caused by a new optimization which effectively replaces a strncmp() call with a strcmp() call. This affects a number of strncmp() call sites in the kernel.
The entire class of optimizations is avoided with -fno-builtin, which gets enabled by -ffreestanding. This may avoid possible future build failures in case new optimizations appear in future compilers.
I haven't done any performance measurements with this patch but I did count the function calls in a defconfig build. For example, there are now 23 more sprintf() calls and 39 fewer strcpy() calls. The effect on the other libc functions is smaller.
If this harms performance we can tackle that regression by optimizing the call sites, ideally using semantic patches. That way, clang and ICC builds might benfit too.
Cc: [email protected]
Reference: https://marc.info/?l=linux-m68k&m=154514816222244&w=2
--- arch/m68k/Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/m68k/Makefile +4 -1
@@ -59,7 +59,10 @@ cpuflags-$(CONFIG_M5206e) := $(call cc-o cpuflags-$(CONFIG_M5206) := $(call cc-option,-mcpu=5206,-m5200) KBUILD_AFLAGS += $(cpuflags-y) -KBUILD_CFLAGS += $(cpuflags-y) -pipe +KBUILD_CFLAGS += $(cpuflags-y) + +KBUILD_CFLAGS += -pipe -ffreestanding + ifdef CONFIG_MMU # without -fno-strength-reduce the 53c7xx.c driver fails ;-( KBUILD_CFLAGS += -fno-strength-reduce -ffixed-a2
Greg Kroah-Hartman
maintainerPATCH 190/230 btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
commit 349ae63f40638a28c6fce52e8447c2d14b84cc0c upstream.
We recently had a customer issue with a corrupted filesystem. When trying to mount this image btrfs panicked with a division by zero in calc_stripe_length().
The corrupt chunk had a 'num_stripes' value of 1. calc_stripe_length() takes this value and divides it by the number of copies the RAID profile is expected to have to calculate the amount of data stripes. As a DUP profile is expected to have 2 copies this division resulted in 1/2 = 0. Later then the 'data_stripes' variable is used as a divisor in the stripe length calculation which results in a division by 0 and thus a kernel panic.
When encountering a filesystem with a DUP block group and a 'num_stripes' value unequal to 2, refuse mounting as the image is corrupted and will lead to unexpected behaviour.
Code inspection showed a RAID1 block group has the same issues.
--- fs/btrfs/volumes.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/volumes.c +2 -2
@@ -6287,10 +6287,10 @@ static int btrfs_check_chunk_valid(struc }if ((type &BTRFS_BLOCK_GROUP_RAID10 && sub_stripes !=2 ) || - (type &BTRFS_BLOCK_GROUP_RAID1 && num_stripes <1 ) || + (type &BTRFS_BLOCK_GROUP_RAID1 && num_stripes !=2 ) || (type &BTRFS_BLOCK_GROUP_RAID5 && num_stripes <2 ) || (type &BTRFS_BLOCK_GROUP_RAID6 && num_stripes <3 ) || - (type &BTRFS_BLOCK_GROUP_DUP && num_stripes >2 ) || + (type &BTRFS_BLOCK_GROUP_DUP && num_stripes !=2 ) || ((type &BTRFS_BLOCK_GROUP_PROFILE_MASK ) ==0 && num_stripes !=1 )) { btrfs_err(root->fs_info,
Greg Kroah-Hartman
maintainerPATCH 191/230 Btrfs: fix corruption reading shared and compressed extents after hole punching
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 8e928218780e2f1cf2f5891c7575e8f0b284fcce upstream.
In the past we had data corruption when reading compressed extents that are shared within the same file and they are consecutive, this got fixed by commit 005efedf2c7d0 ("Btrfs: fix read corruption of compressed and shared extents") and by commit 808f80b46790f ("Btrfs: update fix for read corruption of compressed and shared extents"). However there was a case that was missing in those fixes, which is when the shared and compressed extents are referenced with a non-zero offset. The following shell script creates a reproducer for this issue:
#!/bin/bash
mkfs.btrfs -f /dev/sdc &> /dev/null
mount -o compress /dev/sdc /mnt/sdc
# Create a file with 3 consecutive compressed extents, each has an
# uncompressed size of 128Kb and a compressed size of 4Kb.
for ((i = 1; i <= 3; i++)); do
head -c 4096 /dev/zero
for ((j = 1; j <= 31; j++)); do
head -c 4096 /dev/zero | tr '\0' "\377"
done
done > /mnt/sdc/foobar
syncecho "Digest after file creation: $(md5sum /mnt/sdc/foobar)"
# Clone the first extent into offsets 128K and 256K. xfs_io -c "reflink /mnt/sdc/foobar 0 128K 128K" /mnt/sdc/foobar xfs_io -c "reflink /mnt/sdc/foobar 0 256K 128K" /mnt/sdc/foobar sync
echo "Digest after cloning: $(md5sum /mnt/sdc/foobar)"
# Punch holes into the regions that are already full of zeroes. xfs_io -c "fpunch 0 4K" /mnt/sdc/foobar
xfs_io -c "fpunch 128K 4K" /mnt/sdc/foobar
xfs_io -c "fpunch 256K 4K" /mnt/sdc/foobar
sync
echo "Digest after hole punching: $(md5sum /mnt/sdc/foobar)" echo "Dropping page cache..." sysctl -q vm.drop_caches=1 echo "Digest after hole punching: $(md5sum /mnt/sdc/foobar)"
umount /dev/sdc
When running the script we get the following output:
Digest after file creation: 5a0888d80d7ab1fd31c229f83a3bbcc8 /mnt/sdc/foobar
linked 131072/131072 bytes at offset 131072
128 KiB, 1 ops; 0.0033 sec (36.960 MiB/sec and 295.6830 ops/sec) linked 131072/131072 bytes at offset 262144
128 KiB, 1 ops; 0.0015 sec (78.567 MiB/sec and 628.5355 ops/sec)
Digest after cloning: 5a0888d80d7ab1fd31c229f83a3bbcc8 /mnt/sdc/foobar Digest after hole punching: 5a0888d80d7ab1fd31c229f83a3bbcc8 /mnt/sdc/foobar
Dropping page cache...
Digest after hole punching: fba694ae8664ed0c2e9ff8937e7f1484 /mnt/sdc/foobar
This happens because after reading all the pages of the extent in the range from 128K to 256K for example, we read the hole at offset 256K and then when reading the page at offset 260K we don't submit the existing bio, which is responsible for filling all the page in the range 128K to 256K only, therefore adding the pages from range 260K to 384K to the existing bio and submitting it after iterating over the entire range. Once the bio completes, the uncompressed data fills only the pages in the range 128K to 256K because there's no more data read from disk, leaving the pages in the range 260K to 384K unfilled. It is just a slightly different variant of what was solved by commit 005efedf2c7d0 ("Btrfs: fix read corruption of compressed and shared extents").
Fix this by forcing a bio submit, during readpages(), whenever we find a compressed extent map for a page that is different from the extent map for the previous page or has a different starting offset (in case it's the same compressed extent), instead of the extent map's original start offset.
A test case for fstests follows soon.
--- fs/btrfs/extent_io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/extent_io.c +2 -2
@@ -3106,11 +3106,11 @@ static int __do_readpage(struct extent_i*/ if (test_bit (EXTENT_FLAG_COMPRESSED , &em->flags) && prev_em_start && *prev_em_start != (u64)-1 && - *prev_em_start != em->orig_start) + *prev_em_start != em->start) force_bio_submit = true;if (prev_em_start) - *prev_em_start = em->orig_start; + *prev_em_start = em->start;free_extent_map (em); em =NULL ;
Greg Kroah-Hartman
maintainerPATCH 192/230 crypto: pcbc - remove bogus memcpy()s with src == dest
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 251b7aea34ba3c4d4fdfa9447695642eb8b8b098 upstream.
The memcpy()s in the PCBC implementation use walk->iv as both the source and destination, which has undefined behavior. These memcpy()'s are actually unneeded, because walk->iv is already used to hold the previous plaintext block XOR'd with the previous ciphertext block. Thus, walk->iv is already updated to its final value.
So remove the broken and unnecessary memcpy()s.
--- crypto/pcbc.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
crypto/pcbc.c +4 -10
@@ -52,7 +52,7 @@ static int crypto_pcbc_encrypt_segment(sunsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr;u8 *dst = walk->dst.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv; do { crypto_xor(iv, src, bsize);
@@ -76,7 +76,7 @@ static int crypto_pcbc_encrypt_inplace(sint bsize =crypto_cipher_blocksize (tfm);unsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv;u8 tmpbuf[bsize]; do {
@@ -89,8 +89,6 @@ static int crypto_pcbc_encrypt_inplace(s src += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
@@ -130,7 +128,7 @@ static int crypto_pcbc_decrypt_segment(sunsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr;u8 *dst = walk->dst.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv; do { fn(crypto_cipher_tfm(tfm), dst, src);
@@ -142,8 +140,6 @@ static int crypto_pcbc_decrypt_segment(s dst += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
@@ -156,7 +152,7 @@ static int crypto_pcbc_decrypt_inplace(sint bsize =crypto_cipher_blocksize (tfm);unsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv;u8 tmpbuf[bsize]; do {
@@ -169,8 +165,6 @@ static int crypto_pcbc_decrypt_inplace(s src += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
Greg Kroah-Hartman
maintainerPATCH 193/230 cpufreq: tegra124: add missing of_node_put()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
commit 446fae2bb5395f3028d8e3aae1508737e5a72ea1 upstream.
of_cpu_device_node_get() will increase the refcount of device_node, it is necessary to call of_node_put() at the end to release the refcount.
--- drivers/cpufreq/tegra124-cpufreq.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/cpufreq/tegra124-cpufreq.c +2 -0
@@ -141,6 +141,8 @@ static int tegra124_cpufreq_probe(structplatform_set_drvdata (pdev, priv); +of_node_put (np); +return 0 ; out_switch_to_pllx:
Greg Kroah-Hartman
maintainerPATCH 194/230 cpufreq: pxa2xx: remove incorrect __init annotation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 9505b98ccddc454008ca7efff90044e3e857c827 upstream.
pxa_cpufreq_init_voltages() is marked __init but usually inlined into the non-__init pxa_cpufreq_init() function. When building with clang, it can stay as a standalone function in a discarded section, and produce this warning:
WARNING: vmlinux.o(.text+0x616a00): Section mismatch in reference from the function pxa_cpufreq_init() to the function .init.text:pxa_cpufreq_init_voltages() The function pxa_cpufreq_init() references
the function __init pxa_cpufreq_init_voltages().
This is often because pxa_cpufreq_init lacks a __init
annotation or the annotation of pxa_cpufreq_init_voltages is wrong.
--- drivers/cpufreq/pxa2xx-cpufreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpufreq/pxa2xx-cpufreq.c +2 -2
@@ -191,7 +191,7 @@ static int pxa_cpufreq_change_voltage(coreturn ret; } -static void __init pxa_cpufreq_init_voltages (void ) +static void pxa_cpufreq_init_voltages (void ) { vcc_core =regulator_get (NULL ,"vcc_core" );if (IS_ERR (vcc_core)) {
@@ -207,7 +207,7 @@ static int pxa_cpufreq_change_voltage(coreturn 0 ; } -static void __init pxa_cpufreq_init_voltages (void ) { } +static void pxa_cpufreq_init_voltages (void ) { }#endif static void find_freq_tables(struct cpufreq_frequency_table **freq_table,
Greg Kroah-Hartman
maintainerPATCH 195/230 ext4: fix crash during online resizing
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit f96c3ac8dfc24b4e38fc4c2eba5fea2107b929d1 upstream.
When computing maximum size of filesystem possible with given number of group descriptor blocks, we forget to include s_first_data_block into the number of blocks. Thus for filesystems with non-zero s_first_data_block it can happen that computed maximum filesystem size is actually lower than current filesystem size which confuses the code and eventually leads to a BUG_ON in ext4_alloc_group_tables() hitting on flex_gd->count == 0. The problem can be reproduced like:
truncate -s 100g /tmp/image
mkfs.ext4 -b 1024 -E resize=262144 /tmp/image 32768 mount -t ext4 -o loop /tmp/image /mnt resize2fs /dev/loop0 262145
resize2fs /dev/loop0 300000
Fix the problem by properly including s_first_data_block into the computed number of filesystem blocks.
--- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/resize.c +2 -1
@@ -1928,7 +1928,8 @@ retry:le16_to_cpu (es->s_reserved_gdt_blocks); n_group = n_desc_blocks *EXT4_DESC_PER_BLOCK (sb); n_blocks_count = (ext4_fsblk_t )n_group * -EXT4_BLOCKS_PER_GROUP (sb); +EXT4_BLOCKS_PER_GROUP (sb) + +le32_to_cpu (es->s_first_data_block); n_group--;/* set to last group number */ }
Greg Kroah-Hartman
maintainerPATCH 196/230 ext2: Fix underflow in ext2_max_size()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 1c2d14212b15a60300a2d4f6364753e87394c521 upstream.
When ext2 filesystem is created with 64k block size, ext2_max_size() will return value less than 0. Also, we cannot write any file in this fs since the sb->maxbytes is less than 0. The core of the problem is that the size of block index tree for such large block size is more than i_blocks can carry. So fix the computation to count with this possibility.
File size limits computed with the new function for the full range of possible block sizes look like:
bits file_size
10 17247252480
11 275415851008
12 2196873666560 13 2197948973056 14 2198486220800 15 2198754754560 16 2198888906752
--- fs/ext2/super.c | 41 ++++++++++++++++++++++++++--------------- 1 file changed, 26 insertions(+), 15 deletions(-)
fs/ext2/super.c +26 -15
@@ -721,7 +721,8 @@ static loff_t ext2_max_size(int bits) {loff_t res =EXT2_NDIR_BLOCKS ;int meta_blocks; -loff_t upper_limit; +unsigned int upper_limit; +unsigned int ppb =1 << (bits-2 );/* This is calculated to be the largest file size for a * dense, file such that the total number of
@@ -735,24 +736,34 @@ static loff_t ext2_max_size(int bits)/* total blocks in file system block size */ upper_limit >>= (bits -9 ); - -/* indirect blocks */ - meta_blocks =1 ; -/* double indirect blocks */ - meta_blocks +=1 + (1LL << (bits-2 )); -/* tripple indirect blocks */ - meta_blocks +=1 + (1LL << (bits-2 )) + (1LL << (2 *(bits-2 ))); - - upper_limit -= meta_blocks; - upper_limit <<= bits; - +/* Compute how many blocks we can address by block tree */ res +=1LL << (bits-2 ); res +=1LL << (2 *(bits-2 )); res +=1LL << (3 *(bits-2 )); +/* Does block tree limit file size? */ +if (res < upper_limit) + goto check_lfs; + + res = upper_limit; +/* How many metadata blocks are needed for addressing upper_limit? */ + upper_limit -=EXT2_NDIR_BLOCKS ; +/* indirect blocks */ + meta_blocks =1 ; + upper_limit -= ppb; +/* double indirect blocks */ +if (upper_limit < ppb * ppb) { + meta_blocks +=1 +DIV_ROUND_UP (upper_limit, ppb); + res -= meta_blocks; + goto check_lfs; + } + meta_blocks +=1 + ppb; + upper_limit -= ppb * ppb; +/* tripple indirect blocks for the rest */ + meta_blocks +=1 +DIV_ROUND_UP (upper_limit, ppb) + +DIV_ROUND_UP (upper_limit, ppb*ppb); + res -= meta_blocks; +check_lfs: res <<= bits; -if (res > upper_limit) - res = upper_limit; -if (res >MAX_LFS_FILESIZE ) res =MAX_LFS_FILESIZE ;
Greg Kroah-Hartman
maintainerPATCH 197/230 clk: ingenic: Fix round_rate misbehaving with non-integer dividers
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <[email protected]>
commit bc5d922c93491878c44c9216e9d227c7eeb81d7f upstream.
Take a parent rate of 180 MHz, and a requested rate of 4.285715 MHz. This results in a theorical divider of 41.999993 which is then rounded up to 42. The .round_rate function would then return (180 MHz / 42) as the clock, rounded down, so 4.285714 MHz.
Calling clk_set_rate on 4.285714 MHz would round the rate again, and give a theorical divider of 42,0000028, now rounded up to 43, and the rate returned would be (180 MHz / 43) which is 4.186046 MHz, aka. not what we requested.
Fix this by rounding up the divisions.
--- drivers/clk/ingenic/cgu.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/clk/ingenic/cgu.c +5 -5
@@ -355,16 +355,16 @@ ingenic_clk_round_rate(struct clk_hw *hwstruct ingenic_clk *ingenic_clk =to_ingenic_clk (hw);struct ingenic_cgu *cgu = ingenic_clk->cgu;const struct ingenic_cgu_clk_info *clk_info; -long rate = *parent_rate; +unsigned int div =1 ; clk_info = &cgu->clock_info[ingenic_clk->idx];if (clk_info->type &CGU_CLK_DIV ) - rate /=ingenic_clk_calc_div (clk_info, *parent_rate, req_rate); + div =ingenic_clk_calc_div (clk_info, *parent_rate, req_rate);else if (clk_info->type &CGU_CLK_FIXDIV ) - rate /= clk_info->fixdiv.div; + div = clk_info->fixdiv.div; -return rate; +return DIV_ROUND_UP (*parent_rate, div); } static int
@@ -384,7 +384,7 @@ ingenic_clk_set_rate(struct clk_hw *hw,if (clk_info->type &CGU_CLK_DIV ) { div =ingenic_clk_calc_div (clk_info, parent_rate, req_rate); - rate = parent_rate / div; + rate =DIV_ROUND_UP (parent_rate, div);if (rate != req_rate)return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 198/230 dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phuong Nguyen <[email protected]>
commit d9140a0da4a230a03426d175145989667758aa6a upstream.
This commit fixes the issue that USB-DMAC hangs silently after system resumes on R-Car Gen3 hence renesas_usbhs will not work correctly when using USB-DMAC for bulk transfer e.g. ethernet or serial gadgets.
The issue can be reproduced by these steps:
1. modprobe g_serial
2. Suspend and resume system.
3. connect a usb cable to host side
4. Transfer data from Host to Target
5. cat /dev/ttyGS0 (Target side)
6. echo "test" > /dev/ttyACM0 (Host side)
The 'cat' will not result anything. However, system still can work normally.
Currently, USB-DMAC driver does not have system sleep callbacks hence this driver relies on the PM core to force runtime suspend/resume to suspend and reinitialize USB-DMAC during system resume. After the commit 17218e0092f8 ("PM / genpd: Stop/start devices without pm_runtime_force_suspend/resume()"), PM core will not force runtime suspend/resume anymore so this issue happens.
To solve this, make system suspend resume explicit by using pm_runtime_force_{suspend,resume}() as the system sleep callbacks. SET_NOIRQ_SYSTEM_SLEEP_PM_OPS() is used to make sure USB-DMAC suspended after and initialized before renesas_usbhs."
--- drivers/dma/sh/usb-dmac.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/sh/usb-dmac.c +2 -0
@@ -700,6 +700,8 @@ static int usb_dmac_runtime_resume(struc#endif /* CONFIG_PM */ static const struct dev_pm_ops usb_dmac_pm = { + SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, + pm_runtime_force_resume)SET_RUNTIME_PM_OPS (usb_dmac_runtime_suspend, usb_dmac_runtime_resume,NULL ) };
Greg Kroah-Hartman
maintainerPATCH 199/230 mm/vmalloc: fix size check for remap_vmalloc_range_partial()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Penyaev <[email protected]>
commit 401592d2e095947344e10ec0623adbcd58934dd4 upstream.
When VM_NO_GUARD is not set area->size includes adjacent guard page, thus for correct size checking get_vm_area_size() should be used, but not area->size.
This fixes possible kernel oops when userspace tries to mmap an area on 1 page bigger than was allocated by vmalloc_user() call: the size check inside remap_vmalloc_range_partial() accounts non-existing guard page also, so check successfully passes but vmalloc_to_page() returns NULL (guard page does not physically exist).
The following code pattern example should trigger an oops:
static int oops_mmap(struct file *file, struct vm_area_struct *vma)
{
void *mem; mem = vmalloc_user(4096);
BUG_ON(!mem);
/* Do not care about mem leak */
return remap_vmalloc_range(vma, mem, 0);}
And userspace simply mmaps size + PAGE_SIZE:
mmap(NULL, 8192, PROT_WRITE|PROT_READ, MAP_PRIVATE, fd, 0);
Possible candidates for oops which do not have any explicit size checks:
*** drivers/media/usb/stkwebcam/stk-webcam.c: v4l_stk_mmap[789] ret = remap_vmalloc_range(vma, sbuf->buffer, 0);
Or the following one:
*** drivers/video/fbdev/core/fbmem.c
static int
fb_mmap(struct file *file, struct vm_area_struct * vma)
...
res = fb->fb_mmap(info, vma);Where fb_mmap callback calls remap_vmalloc_range() directly without any explicit checks:
*** drivers/video/fbdev/vfb.c
static int vfb_mmap(struct fb_info *info,
struct vm_area_struct *vma)
{
return remap_vmalloc_range(vma, (void *)info->fix.smem_start, vma->vm_pgoff);
}--- mm/vmalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/vmalloc.c +1 -1
@@ -2162,7 +2162,7 @@ int remap_vmalloc_range_partial(struct vif (!(area->flags &VM_USERMAP ))return -EINVAL ; -if (kaddr + size > area->addr + area->size) +if (kaddr + size > area->addr +get_vm_area_size (area))return -EINVAL ; do {
Greg Kroah-Hartman
maintainerPATCH 200/230 kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zev Weiss <[email protected]>
commit 8cf7630b29701d364f8df4a50e4f1f5e752b2778 upstream.
This bug has apparently existed since the introduction of this function in the pre-git era (4500e91754d3 in Thomas Gleixner's history.git, "[NET]: Add proc_dointvec_userhz_jiffies, use it for proper handling of neighbour sysctls.").
As a minimal fix we can simply duplicate the corresponding check in do_proc_dointvec_conv().
--- kernel/sysctl.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
kernel/sysctl.c +10 -1
@@ -2306,7 +2306,16 @@ static int do_proc_dointvec_minmax_conv( {struct do_proc_dointvec_minmax_conv_param *param = data;if (write) { -int val = *negp ? -*lvalp : *lvalp; +int val; +if (*negp) { +if (*lvalp > (unsigned long )INT_MAX +1 ) +return -EINVAL ; + val = -*lvalp; + }else { +if (*lvalp > (unsigned long )INT_MAX ) +return -EINVAL ; + val = *lvalp; + }if ((param->min && *param->min > val) || (param->max && *param->max < val))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 201/230 intel_th: Dont reference unassigned outputs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <[email protected]>
commit 9ed3f22223c33347ed963e7c7019cf2956dd4e37 upstream.
When an output port driver is removed, also remove references to it from any masters. Failing to do this causes a NULL ptr dereference when configuring another output port:
Quoted 8 lines
BUG: unable to handle kernel NULL pointer dereference at 000000000000000d RIP: 0010:master_attr_store+0x9d/0x160 [intel_th_gth] Call Trace: dev_attr_store+0x1b/0x30 sysfs_kf_write+0x3c/0x50 kernfs_fop_write+0x125/0x1a0 __vfs_write+0x3a/0x190 ? __vfs_write+0x5/0x190
Quoted 8 lines
? _cond_resched+0x1a/0x50 ? rcu_all_qs+0x5/0xb0 ? __vfs_write+0x5/0x190 vfs_write+0xb8/0x1b0 ksys_write+0x55/0xc0 __x64_sys_write+0x1a/0x20 do_syscall_64+0x5a/0x140 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/hwtracing/intel_th/gth.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hwtracing/intel_th/gth.c +4 -0
@@ -591,11 +591,15 @@ static void intel_th_gth_unassign(struct {struct gth_device *gth =dev_get_drvdata (&thdev->dev);int port = othdev->output.port; +int master;spin_lock (>h->gth_lock); othdev->output.port =-1 ; othdev->output.active = false; gth->output[port].output =NULL ; +for (master =0 ; master <TH_CONFIGURABLE_MASTERS ; master++) +if (gth->master[master] == port) + gth->master[master] =-1 ;spin_unlock (>h->gth_lock); }
Greg Kroah-Hartman
maintainerPATCH 202/230 parport_pc: fix find_superio io compare code, should use equal test.
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: QiaoChong <[email protected]>
commit 21698fd57984cd28207d841dbdaa026d6061bceb upstream.
In the original code before 181bf1e815a2 the loop was continuing until it finds the first matching superios[i].io and p->base.
But after 181bf1e815a2 the logic changed and the loop now returns the pointer to the first mismatched array element which is then used in get_superio_dma() and get_superio_irq() and thus returning the wrong value.
Fix the condition so that it now returns the correct pointer.
--- drivers/parport/parport_pc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/parport/parport_pc.c +1 -1
@@ -1377,7 +1377,7 @@ static struct superio_struct *find_super {int i;for (i =0 ; i <NR_SUPERIOS ; i++) -if (superios[i].io != p->base) +if (superios[i].io == p->base)return &superios[i];return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 203/230 i2c: tegra: fix maximum transfer size
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sowjanya Komatineni <[email protected]>
commit f4e3f4ae1d9c9330de355f432b69952e8cef650c upstream.
Tegra186 and prior supports maximum 4K bytes per packet transfer including 12 bytes of packet header.
This patch fixes max write length limit to account packet header size for transfers.
--- drivers/i2c/busses/i2c-tegra.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-tegra.c +1 -1
@@ -696,7 +696,7 @@ static const struct i2c_algorithm tegra_/* payload size is only 12 bit */ static struct i2c_adapter_quirks tegra_i2c_quirks = { .max_read_len =4096 , - .max_write_len =4096 , + .max_write_len =4096 -12 , };static const struct tegra_i2c_hw_feature tegra20_i2c_hw = {
Greg Kroah-Hartman
maintainerPATCH 204/230 perf bench: Copy kernel files needed to build mem{cpy,set} x86_64 benchmarks
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
commit 7d7d1bf1d1dabe435ef50efb051724b8664749cb upstream.
We can't access kernel files directly from tools/, so copy the required bits, and make sure that we detect when the original files, in the kernel, gets modified.
--- tools/arch/x86/include/asm/cpufeatures.h | 336 +++++++++++++++++++++++++ tools/arch/x86/include/asm/disabled-features.h | 65 ++++ tools/arch/x86/include/asm/required-features.h | 106 +++++++ tools/arch/x86/lib/memcpy_64.S | 179 +++++++++++++ tools/arch/x86/lib/memset_64.S | 138 ++++++++++ tools/include/asm/alternative-asm.h | 9 tools/perf/MANIFEST | 8 tools/perf/Makefile.perf | 15 + tools/perf/bench/mem-memcpy-x86-64-asm.S | 2 tools/perf/bench/mem-memset-x86-64-asm.S | 2 tools/perf/util/include/asm/alternative-asm.h | 9 11 files changed, 856 insertions(+), 13 deletions(-)
tools/arch/x86/include/asm/cpufeatures.h new file +336 -0
@@ -0,0 +1,336 @@ +#ifndef _ASM_X86_CPUFEATURES_H +#define _ASM_X86_CPUFEATURES_H + +#ifndef _ASM_X86_REQUIRED_FEATURES_H +#include <asm/required-features.h> +#endif + +#ifndef _ASM_X86_DISABLED_FEATURES_H +#include <asm/disabled-features.h> +#endif + +/* +* Defines x86 CPU feature bits +*/ +#define NCAPINTS 19/* N 32-bit words worth of info */ +#define NBUGINTS 1/* N 32-bit bug flags */ + +/* +* Note: If the comment begins with a quoted string, that string is used +* in /proc/cpuinfo instead of the macro name. If the string is "", +* this feature bit is not displayed in /proc/cpuinfo at all. +*/ + +/* Intel-defined CPU features, CPUID level 0x00000001 (edx), word 0 */ +#define X86_FEATURE_FPU ( 0*32+ 0)/* Onboard FPU */ +#define X86_FEATURE_VME ( 0*32+ 1)/* Virtual Mode Extensions */ +#define X86_FEATURE_DE ( 0*32+ 2)/* Debugging Extensions */ +#define X86_FEATURE_PSE ( 0*32+ 3)/* Page Size Extensions */ +#define X86_FEATURE_TSC ( 0*32+ 4)/* Time Stamp Counter */ +#define X86_FEATURE_MSR ( 0*32+ 5)/* Model-Specific Registers */ +#define X86_FEATURE_PAE ( 0*32+ 6)/* Physical Address Extensions */ +#define X86_FEATURE_MCE ( 0*32+ 7)/* Machine Check Exception */ +#define X86_FEATURE_CX8 ( 0*32+ 8)/* CMPXCHG8 instruction */ +#define X86_FEATURE_APIC ( 0*32+ 9)/* Onboard APIC */ +#define X86_FEATURE_SEP ( 0*32+11)/* SYSENTER/SYSEXIT */ +#define X86_FEATURE_MTRR ( 0*32+12)/* Memory Type Range Registers */ +#define X86_FEATURE_PGE ( 0*32+13)/* Page Global Enable */ +#define X86_FEATURE_MCA ( 0*32+14)/* Machine Check Architecture */ +#define X86_FEATURE_CMOV ( 0*32+15)/* CMOV instructions */ +/* (plus FCMOVcc, FCOMI with FPU) */ +#define X86_FEATURE_PAT ( 0*32+16)/* Page Attribute Table */ +#define X86_FEATURE_PSE36 ( 0*32+17)/* 36-bit PSEs */ +#define X86_FEATURE_PN ( 0*32+18)/* Processor serial number */ +#define X86_FEATURE_CLFLUSH ( 0*32+19)/* CLFLUSH instruction */ +#define X86_FEATURE_DS ( 0*32+21)/* "dts" Debug Store */ +#define X86_FEATURE_ACPI ( 0*32+22)/* ACPI via MSR */ +#define X86_FEATURE_MMX ( 0*32+23)/* Multimedia Extensions */ +#define X86_FEATURE_FXSR ( 0*32+24)/* FXSAVE/FXRSTOR, CR4.OSFXSR */ +#define X86_FEATURE_XMM ( 0*32+25)/* "sse" */ +#define X86_FEATURE_XMM2 ( 0*32+26)/* "sse2" */ +#define X86_FEATURE_SELFSNOOP ( 0*32+27)/* "ss" CPU self snoop */ +#define X86_FEATURE_HT ( 0*32+28)/* Hyper-Threading */ +#define X86_FEATURE_ACC ( 0*32+29)/* "tm" Automatic clock control */ +#define X86_FEATURE_IA64 ( 0*32+30)/* IA-64 processor */ +#define X86_FEATURE_PBE ( 0*32+31)/* Pending Break Enable */ + +/* AMD-defined CPU features, CPUID level 0x80000001, word 1 */ +/* Don't duplicate feature flags which are redundant with Intel! */ +#define X86_FEATURE_SYSCALL ( 1*32+11)/* SYSCALL/SYSRET */ +#define X86_FEATURE_MP ( 1*32+19)/* MP Capable. */ +#define X86_FEATURE_NX ( 1*32+20)/* Execute Disable */ +#define X86_FEATURE_MMXEXT ( 1*32+22)/* AMD MMX extensions */ +#define X86_FEATURE_FXSR_OPT ( 1*32+25)/* FXSAVE/FXRSTOR optimizations */ +#define X86_FEATURE_GBPAGES ( 1*32+26)/* "pdpe1gb" GB pages */ +#define X86_FEATURE_RDTSCP ( 1*32+27)/* RDTSCP */ +#define X86_FEATURE_LM ( 1*32+29)/* Long Mode (x86-64) */ +#define X86_FEATURE_3DNOWEXT ( 1*32+30)/* AMD 3DNow! extensions */ +#define X86_FEATURE_3DNOW ( 1*32+31)/* 3DNow! */ + +/* Transmeta-defined CPU features, CPUID level 0x80860001, word 2 */ +#define X86_FEATURE_RECOVERY ( 2*32+ 0)/* CPU in recovery mode */ +#define X86_FEATURE_LONGRUN ( 2*32+ 1)/* Longrun power control */ +#define X86_FEATURE_LRTI ( 2*32+ 3)/* LongRun table interface */ + +/* Other features, Linux-defined mapping, word 3 */ +/* This range is used for feature bits which conflict or are synthesized */ +#define X86_FEATURE_CXMMX ( 3*32+ 0)/* Cyrix MMX extensions */ +#define X86_FEATURE_K6_MTRR ( 3*32+ 1)/* AMD K6 nonstandard MTRRs */ +#define X86_FEATURE_CYRIX_ARR ( 3*32+ 2)/* Cyrix ARRs (= MTRRs) */ +#define X86_FEATURE_CENTAUR_MCR ( 3*32+ 3)/* Centaur MCRs (= MTRRs) */ +/* cpu types for specific tunings: */ +#define X86_FEATURE_K8 ( 3*32+ 4)/* "" Opteron, Athlon64 */ +#define X86_FEATURE_K7 ( 3*32+ 5)/* "" Athlon */ +#define X86_FEATURE_P3 ( 3*32+ 6)/* "" P3 */ +#define X86_FEATURE_P4 ( 3*32+ 7)/* "" P4 */ +#define X86_FEATURE_CONSTANT_TSC ( 3*32+ 8)/* TSC ticks at a constant rate */ +#define X86_FEATURE_UP ( 3*32+ 9)/* smp kernel running on up */ +/* free, was #define X86_FEATURE_FXSAVE_LEAK ( 3*32+10) * "" FXSAVE leaks FOP/FIP/FOP */ +#define X86_FEATURE_ARCH_PERFMON ( 3*32+11)/* Intel Architectural PerfMon */ +#define X86_FEATURE_PEBS ( 3*32+12)/* Precise-Event Based Sampling */ +#define X86_FEATURE_BTS ( 3*32+13)/* Branch Trace Store */ +#define X86_FEATURE_SYSCALL32 ( 3*32+14)/* "" syscall in ia32 userspace */ +#define X86_FEATURE_SYSENTER32 ( 3*32+15)/* "" sysenter in ia32 userspace */ +#define X86_FEATURE_REP_GOOD ( 3*32+16)/* rep microcode works well */ +#define X86_FEATURE_MFENCE_RDTSC ( 3*32+17)/* "" Mfence synchronizes RDTSC */ +#define X86_FEATURE_LFENCE_RDTSC ( 3*32+18)/* "" Lfence synchronizes RDTSC */ +/* free, was #define X86_FEATURE_11AP ( 3*32+19) * "" Bad local APIC aka 11AP */ +#define X86_FEATURE_NOPL ( 3*32+20)/* The NOPL (0F 1F) instructions */ +#define X86_FEATURE_ALWAYS ( 3*32+21)/* "" Always-present feature */ +#define X86_FEATURE_XTOPOLOGY ( 3*32+22)/* cpu topology enum extensions */ +#define X86_FEATURE_TSC_RELIABLE ( 3*32+23)/* TSC is known to be reliable */ +#define X86_FEATURE_NONSTOP_TSC ( 3*32+24)/* TSC does not stop in C states */ +/* free, was #define X86_FEATURE_CLFLUSH_MONITOR ( 3*32+25) * "" clflush reqd with monitor */ +#define X86_FEATURE_EXTD_APICID ( 3*32+26)/* has extended APICID (8 bits) */ +#define X86_FEATURE_AMD_DCM ( 3*32+27)/* multi-node processor */ +#define X86_FEATURE_APERFMPERF ( 3*32+28)/* APERFMPERF */ +#define X86_FEATURE_NONSTOP_TSC_S3 ( 3*32+30)/* TSC doesn't stop in S3 state */ + +/* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */ +#define X86_FEATURE_XMM3 ( 4*32+ 0)/* "pni" SSE-3 */ +#define X86_FEATURE_PCLMULQDQ ( 4*32+ 1)/* PCLMULQDQ instruction */ +#define X86_FEATURE_DTES64 ( 4*32+ 2)/* 64-bit Debug Store */ +#define X86_FEATURE_MWAIT ( 4*32+ 3)/* "monitor" Monitor/Mwait support */ +#define X86_FEATURE_DSCPL ( 4*32+ 4)/* "ds_cpl" CPL Qual. Debug Store */ +#define X86_FEATURE_VMX ( 4*32+ 5)/* Hardware virtualization */ +#define X86_FEATURE_SMX ( 4*32+ 6)/* Safer mode */ +#define X86_FEATURE_EST ( 4*32+ 7)/* Enhanced SpeedStep */ +#define X86_FEATURE_TM2 ( 4*32+ 8)/* Thermal Monitor 2 */ +#define X86_FEATURE_SSSE3 ( 4*32+ 9)/* Supplemental SSE-3 */ +#define X86_FEATURE_CID ( 4*32+10)/* Context ID */ +#define X86_FEATURE_SDBG ( 4*32+11)/* Silicon Debug */ +#define X86_FEATURE_FMA ( 4*32+12)/* Fused multiply-add */ +#define X86_FEATURE_CX16 ( 4*32+13)/* CMPXCHG16B */ +#define X86_FEATURE_XTPR ( 4*32+14)/* Send Task Priority Messages */ +#define X86_FEATURE_PDCM ( 4*32+15)/* Performance Capabilities */ +#define X86_FEATURE_PCID ( 4*32+17)/* Process Context Identifiers */ +#define X86_FEATURE_DCA ( 4*32+18)/* Direct Cache Access */ +#define X86_FEATURE_XMM4_1 ( 4*32+19)/* "sse4_1" SSE-4.1 */ +#define X86_FEATURE_XMM4_2 ( 4*32+20)/* "sse4_2" SSE-4.2 */ +#define X86_FEATURE_X2APIC ( 4*32+21)/* x2APIC */ +#define X86_FEATURE_MOVBE ( 4*32+22)/* MOVBE instruction */ +#define X86_FEATURE_POPCNT ( 4*32+23)/* POPCNT instruction */ +#define X86_FEATURE_TSC_DEADLINE_TIMER ( 4*32+24)/* Tsc deadline timer */ +#define X86_FEATURE_AES ( 4*32+25)/* AES instructions */ +#define X86_FEATURE_XSAVE ( 4*32+26)/* XSAVE/XRSTOR/XSETBV/XGETBV */ +#define X86_FEATURE_OSXSAVE ( 4*32+27)/* "" XSAVE enabled in the OS */ +#define X86_FEATURE_AVX ( 4*32+28)/* Advanced Vector Extensions */ +#define X86_FEATURE_F16C ( 4*32+29)/* 16-bit fp conversions */ +#define X86_FEATURE_RDRAND ( 4*32+30)/* The RDRAND instruction */ +#define X86_FEATURE_HYPERVISOR ( 4*32+31)/* Running on a hypervisor */ + +/* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */ +#define X86_FEATURE_XSTORE ( 5*32+ 2)/* "rng" RNG present (xstore) */ +#define X86_FEATURE_XSTORE_EN ( 5*32+ 3)/* "rng_en" RNG enabled */ +#define X86_FEATURE_XCRYPT ( 5*32+ 6)/* "ace" on-CPU crypto (xcrypt) */ +#define X86_FEATURE_XCRYPT_EN ( 5*32+ 7)/* "ace_en" on-CPU crypto enabled */ +#define X86_FEATURE_ACE2 ( 5*32+ 8)/* Advanced Cryptography Engine v2 */ +#define X86_FEATURE_ACE2_EN ( 5*32+ 9)/* ACE v2 enabled */ +#define X86_FEATURE_PHE ( 5*32+10)/* PadLock Hash Engine */ +#define X86_FEATURE_PHE_EN ( 5*32+11)/* PHE enabled */ +#define X86_FEATURE_PMM ( 5*32+12)/* PadLock Montgomery Multiplier */ +#define X86_FEATURE_PMM_EN ( 5*32+13)/* PMM enabled */ + +/* More extended AMD flags: CPUID level 0x80000001, ecx, word 6 */ +#define X86_FEATURE_LAHF_LM ( 6*32+ 0)/* LAHF/SAHF in long mode */ +#define X86_FEATURE_CMP_LEGACY ( 6*32+ 1)/* If yes HyperThreading not valid */ +#define X86_FEATURE_SVM ( 6*32+ 2)/* Secure virtual machine */ +#define X86_FEATURE_EXTAPIC ( 6*32+ 3)/* Extended APIC space */ +#define X86_FEATURE_CR8_LEGACY ( 6*32+ 4)/* CR8 in 32-bit mode */ +#define X86_FEATURE_ABM ( 6*32+ 5)/* Advanced bit manipulation */ +#define X86_FEATURE_SSE4A ( 6*32+ 6)/* SSE-4A */ +#define X86_FEATURE_MISALIGNSSE ( 6*32+ 7)/* Misaligned SSE mode */ +#define X86_FEATURE_3DNOWPREFETCH ( 6*32+ 8)/* 3DNow prefetch instructions */ +#define X86_FEATURE_OSVW ( 6*32+ 9)/* OS Visible Workaround */ +#define X86_FEATURE_IBS ( 6*32+10)/* Instruction Based Sampling */ +#define X86_FEATURE_XOP ( 6*32+11)/* extended AVX instructions */ +#define X86_FEATURE_SKINIT ( 6*32+12)/* SKINIT/STGI instructions */ +#define X86_FEATURE_WDT ( 6*32+13)/* Watchdog timer */ +#define X86_FEATURE_LWP ( 6*32+15)/* Light Weight Profiling */ +#define X86_FEATURE_FMA4 ( 6*32+16)/* 4 operands MAC instructions */ +#define X86_FEATURE_TCE ( 6*32+17)/* translation cache extension */ +#define X86_FEATURE_NODEID_MSR ( 6*32+19)/* NodeId MSR */ +#define X86_FEATURE_TBM ( 6*32+21)/* trailing bit manipulations */ +#define X86_FEATURE_TOPOEXT ( 6*32+22)/* topology extensions CPUID leafs */ +#define X86_FEATURE_PERFCTR_CORE ( 6*32+23)/* core performance counter extensions */ +#define X86_FEATURE_PERFCTR_NB ( 6*32+24)/* NB performance counter extensions */ +#define X86_FEATURE_BPEXT (6*32+26)/* data breakpoint extension */ +#define X86_FEATURE_PERFCTR_L2 ( 6*32+28)/* L2 performance counter extensions */ +#define X86_FEATURE_MWAITX ( 6*32+29)/* MWAIT extension (MONITORX/MWAITX) */ + +/* +* Auxiliary flags: Linux defined - For features scattered in various +* CPUID levels like 0x6, 0xA etc, word 7. +* +* Reuse free bits when adding new feature flags! +*/ + +#define X86_FEATURE_CPB ( 7*32+ 2)/* AMD Core Performance Boost */ +#define X86_FEATURE_EPB ( 7*32+ 3)/* IA32_ENERGY_PERF_BIAS support */ +#define X86_FEATURE_INVPCID_SINGLE ( 7*32+ 4)/* Effectively INVPCID && CR4.PCIDE=1 */ + +#define X86_FEATURE_HW_PSTATE ( 7*32+ 8)/* AMD HW-PState */ +#define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9)/* AMD ProcFeedbackInterface */ + +#define X86_FEATURE_RETPOLINE ( 7*32+12)/* "" Generic Retpoline mitigation for Spectre variant 2 */ +#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13)/* "" AMD Retpoline mitigation for Spectre variant 2 */ + +#define X86_FEATURE_INTEL_PT ( 7*32+15)/* Intel Processor Trace */ +#define X86_FEATURE_RSB_CTXSW ( 7*32+19)/* "" Fill RSB on context switches */ + +#define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16)/* "" MSR SPEC_CTRL is implemented */ +#define X86_FEATURE_SSBD ( 7*32+17)/* Speculative Store Bypass Disable */ + +/* Because the ALTERNATIVE scheme is for members of the X86_FEATURE club... */ +#define X86_FEATURE_KAISER ( 7*32+31)/* CONFIG_PAGE_TABLE_ISOLATION w/o nokaiser */ + +#define X86_FEATURE_USE_IBPB ( 7*32+21)/* "" Indirect Branch Prediction Barrier enabled*/ +#define X86_FEATURE_USE_IBRS_FW ( 7*32+22)/* "" Use IBRS during runtime firmware calls */ +#define X86_FEATURE_SPEC_STORE_BYPASS_DISABLE ( 7*32+23)/* "" Disable Speculative Store Bypass. */ +#define X86_FEATURE_LS_CFG_SSBD ( 7*32+24)/* "" AMD SSBD implementation */ + +#define X86_FEATURE_IBRS ( 7*32+25)/* Indirect Branch Restricted Speculation */ +#define X86_FEATURE_IBPB ( 7*32+26)/* Indirect Branch Prediction Barrier */ +#define X86_FEATURE_STIBP ( 7*32+27)/* Single Thread Indirect Branch Predictors */ +#define X86_FEATURE_ZEN ( 7*32+28)/* "" CPU is AMD family 0x17 (Zen) */ +#define X86_FEATURE_L1TF_PTEINV ( 7*32+29)/* "" L1TF workaround PTE inversion */ + +/* Virtualization flags: Linux defined, word 8 */ +#define X86_FEATURE_TPR_SHADOW ( 8*32+ 0)/* Intel TPR Shadow */ +#define X86_FEATURE_VNMI ( 8*32+ 1)/* Intel Virtual NMI */ +#define X86_FEATURE_FLEXPRIORITY ( 8*32+ 2)/* Intel FlexPriority */ +#define X86_FEATURE_EPT ( 8*32+ 3)/* Intel Extended Page Table */ +#define X86_FEATURE_VPID ( 8*32+ 4)/* Intel Virtual Processor ID */ + +#define X86_FEATURE_VMMCALL ( 8*32+15)/* Prefer vmmcall to vmcall */ +#define X86_FEATURE_XENPV ( 8*32+16)/* "" Xen paravirtual guest */ + + +/* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */ +#define X86_FEATURE_FSGSBASE ( 9*32+ 0)/* {RD/WR}{FS/GS}BASE instructions*/ +#define X86_FEATURE_TSC_ADJUST ( 9*32+ 1)/* TSC adjustment MSR 0x3b */ +#define X86_FEATURE_BMI1 ( 9*32+ 3)/* 1st group bit manipulation extensions */ +#define X86_FEATURE_HLE ( 9*32+ 4)/* Hardware Lock Elision */ +#define X86_FEATURE_AVX2 ( 9*32+ 5)/* AVX2 instructions */ +#define X86_FEATURE_SMEP ( 9*32+ 7)/* Supervisor Mode Execution Protection */ +#define X86_FEATURE_BMI2 ( 9*32+ 8)/* 2nd group bit manipulation extensions */ +#define X86_FEATURE_ERMS ( 9*32+ 9)/* Enhanced REP MOVSB/STOSB */ +#define X86_FEATURE_INVPCID ( 9*32+10)/* Invalidate Processor Context ID */ +#define X86_FEATURE_RTM ( 9*32+11)/* Restricted Transactional Memory */ +#define X86_FEATURE_CQM ( 9*32+12)/* Cache QoS Monitoring */ +#define X86_FEATURE_MPX ( 9*32+14)/* Memory Protection Extension */ +#define X86_FEATURE_AVX512F ( 9*32+16)/* AVX-512 Foundation */ +#define X86_FEATURE_RDSEED ( 9*32+18)/* The RDSEED instruction */ +#define X86_FEATURE_ADX ( 9*32+19)/* The ADCX and ADOX instructions */ +#define X86_FEATURE_SMAP ( 9*32+20)/* Supervisor Mode Access Prevention */ +#define X86_FEATURE_PCOMMIT ( 9*32+22)/* PCOMMIT instruction */ +#define X86_FEATURE_CLFLUSHOPT ( 9*32+23)/* CLFLUSHOPT instruction */ +#define X86_FEATURE_CLWB ( 9*32+24)/* CLWB instruction */ +#define X86_FEATURE_AVX512PF ( 9*32+26)/* AVX-512 Prefetch */ +#define X86_FEATURE_AVX512ER ( 9*32+27)/* AVX-512 Exponential and Reciprocal */ +#define X86_FEATURE_AVX512CD ( 9*32+28)/* AVX-512 Conflict Detection */ +#define X86_FEATURE_SHA_NI ( 9*32+29)/* SHA1/SHA256 Instruction Extensions */ + +/* Extended state features, CPUID level 0x0000000d:1 (eax), word 10 */ +#define X86_FEATURE_XSAVEOPT (10*32+ 0)/* XSAVEOPT */ +#define X86_FEATURE_XSAVEC (10*32+ 1)/* XSAVEC */ +#define X86_FEATURE_XGETBV1 (10*32+ 2)/* XGETBV with ECX = 1 */ +#define X86_FEATURE_XSAVES (10*32+ 3)/* XSAVES/XRSTORS */ + +/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (edx), word 11 */ +#define X86_FEATURE_CQM_LLC (11*32+ 1)/* LLC QoS if 1 */ + +/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (edx), word 12 */ +#define X86_FEATURE_CQM_OCCUP_LLC (12*32+ 0)/* LLC occupancy monitoring if 1 */ + +/* AMD-defined CPU features, CPUID level 0x80000008 (ebx), word 13 */ +#define X86_FEATURE_CLZERO (13*32+0)/* CLZERO instruction */ +#define X86_FEATURE_AMD_IBPB (13*32+12)/* Indirect Branch Prediction Barrier */ +#define X86_FEATURE_AMD_IBRS (13*32+14)/* Indirect Branch Restricted Speculation */ +#define X86_FEATURE_AMD_STIBP (13*32+15)/* Single Thread Indirect Branch Predictors */ +#define X86_FEATURE_VIRT_SSBD (13*32+25)/* Virtualized Speculative Store Bypass Disable */ + +/* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */ +#define X86_FEATURE_DTHERM (14*32+ 0)/* Digital Thermal Sensor */ +#define X86_FEATURE_IDA (14*32+ 1)/* Intel Dynamic Acceleration */ +#define X86_FEATURE_ARAT (14*32+ 2)/* Always Running APIC Timer */ +#define X86_FEATURE_PLN (14*32+ 4)/* Intel Power Limit Notification */ +#define X86_FEATURE_PTS (14*32+ 6)/* Intel Package Thermal Status */ +#define X86_FEATURE_HWP (14*32+ 7)/* Intel Hardware P-states */ +#define X86_FEATURE_HWP_NOTIFY (14*32+ 8)/* HWP Notification */ +#define X86_FEATURE_HWP_ACT_WINDOW (14*32+ 9)/* HWP Activity Window */ +#define X86_FEATURE_HWP_EPP (14*32+10)/* HWP Energy Perf. Preference */ +#define X86_FEATURE_HWP_PKG_REQ (14*32+11)/* HWP Package Level Request */ + +/* AMD SVM Feature Identification, CPUID level 0x8000000a (edx), word 15 */ +#define X86_FEATURE_NPT (15*32+ 0)/* Nested Page Table support */ +#define X86_FEATURE_LBRV (15*32+ 1)/* LBR Virtualization support */ +#define X86_FEATURE_SVML (15*32+ 2)/* "svm_lock" SVM locking MSR */ +#define X86_FEATURE_NRIPS (15*32+ 3)/* "nrip_save" SVM next_rip save */ +#define X86_FEATURE_TSCRATEMSR (15*32+ 4)/* "tsc_scale" TSC scaling support */ +#define X86_FEATURE_VMCBCLEAN (15*32+ 5)/* "vmcb_clean" VMCB clean bits support */ +#define X86_FEATURE_FLUSHBYASID (15*32+ 6)/* flush-by-ASID support */ +#define X86_FEATURE_DECODEASSISTS (15*32+ 7)/* Decode Assists support */ +#define X86_FEATURE_PAUSEFILTER (15*32+10)/* filtered pause intercept */ +#define X86_FEATURE_PFTHRESHOLD (15*32+12)/* pause filter threshold */ + +/* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */ +#define X86_FEATURE_PKU (16*32+ 3)/* Protection Keys for Userspace */ +#define X86_FEATURE_OSPKE (16*32+ 4)/* OS Protection Keys Enable */ + +/* AMD-defined CPU features, CPUID level 0x80000007 (ebx), word 17 */ +#define X86_FEATURE_OVERFLOW_RECOV (17*32+0)/* MCA overflow recovery support */ +#define X86_FEATURE_SUCCOR (17*32+1)/* Uncorrectable error containment and recovery */ +#define X86_FEATURE_SMCA (17*32+3)/* Scalable MCA */ + + +/* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ +#define X86_FEATURE_AVX512_4VNNIW (18*32+ 2)/* AVX-512 Neural Network Instructions */ +#define X86_FEATURE_AVX512_4FMAPS (18*32+ 3)/* AVX-512 Multiply Accumulation Single precision */ +#define X86_FEATURE_SPEC_CTRL (18*32+26)/* "" Speculation Control (IBRS + IBPB) */ +#define X86_FEATURE_INTEL_STIBP (18*32+27)/* "" Single Thread Indirect Branch Predictors */ +#define X86_FEATURE_FLUSH_L1D (18*32+28)/* Flush L1D cache */ +#define X86_FEATURE_ARCH_CAPABILITIES (18*32+29)/* IA32_ARCH_CAPABILITIES MSR (Intel) */ +#define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31)/* "" Speculative Store Bypass Disable */ + +/* +* BUG word(s) +*/ +#define X86_BUG (x) (NCAPINTS*32 + (x)) + +#define X86_BUG_F00F X86_BUG(0)/* Intel F00F */ +#define X86_BUG_FDIV X86_BUG(1)/* FPU FDIV */ +#define X86_BUG_COMA X86_BUG(2)/* Cyrix 6x86 coma */ +#define X86_BUG_AMD_TLB_MMATCH X86_BUG(3)/* "tlb_mmatch" AMD Erratum 383 */ +#define X86_BUG_AMD_APIC_C1E X86_BUG(4)/* "apic_c1e" AMD Erratum 400 */ +#define X86_BUG_11AP X86_BUG(5)/* Bad local APIC aka 11AP */ +#define X86_BUG_FXSAVE_LEAK X86_BUG(6)/* FXSAVE leaks FOP/FIP/FOP */ +#define X86_BUG_CLFLUSH_MONITOR X86_BUG(7)/* AAI65, CLFLUSH required before MONITOR */ +#define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8)/* SYSRET doesn't fix up SS attrs */ +#define X86_BUG_CPU_MELTDOWN X86_BUG(14)/* CPU is affected by meltdown attack and needs kernel page table isolation */ +#define X86_BUG_SPECTRE_V1 X86_BUG(15)/* CPU is affected by Spectre variant 1 attack with conditional branches */ +#define X86_BUG_SPECTRE_V2 X86_BUG(16)/* CPU is affected by Spectre variant 2 attack with indirect branches */ +#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17)/* CPU is affected by speculative store bypass attack */ +#define X86_BUG_L1TF X86_BUG(18)/* CPU is affected by L1 Terminal Fault */ + +#endif /* _ASM_X86_CPUFEATURES_H */
tools/arch/x86/include/asm/disabled-features.h new file +65 -0
65 lines not on this page · raw message
tools/arch/x86/include/asm/required-features.h new file +106 -0
106 lines not on this page · raw message
tools/arch/x86/lib/memcpy_64.S new file +179 -0
179 lines not on this page · raw message
tools/arch/x86/lib/memset_64.S new file +138 -0
138 lines not on this page · raw message
tools/include/asm/alternative-asm.h new file +9 -0
@@ -0,0 +1,9 @@ +#ifndef _TOOLS_ASM_ALTERNATIVE_ASM_H +#define _TOOLS_ASM_ALTERNATIVE_ASM_H + +/* Just disable it so we can build arch/x86/lib/memcpy_64.S for perf bench: */ + +#define altinstruction_entry # +#define ALTERNATIVE_2 # + +#endif
tools/perf/MANIFEST +6 -2
@@ -11,6 +11,11 @@ tools/arch/sparc/include/asm/barrier_32. tools/arch/sparc/include/asm/barrier_64.h tools/arch/tile/include/asm/barrier.h tools/arch/x86/include/asm/barrier.h +tools/arch/x86/include/asm/cpufeatures.h +tools/arch/x86/include/asm/disabled-features.h +tools/arch/x86/include/asm/required-features.h +tools/arch/x86/lib/memcpy_64.S +tools/arch/x86/lib/memset_64.S tools/arch/xtensa/include/asm/barrier.h tools/scripts tools/build
@@ -25,6 +30,7 @@ tools/lib/rbtree.c tools/lib/symbol/kallsyms.c tools/lib/symbol/kallsyms.h tools/lib/util/find_next_bit.c +tools/include/asm/alternative-asm.h tools/include/asm/atomic.h tools/include/asm/barrier.h tools/include/asm/bug.h
@@ -65,8 +71,6 @@ include/linux/swab.h arch/*/include/asm/unistd*.h arch/*/include/uapi/asm/unistd*.h arch/*/include/uapi/asm/perf_regs.h -arch/*/lib/memcpy*.S -arch/*/lib/memset*.S include/linux/poison.h include/linux/hw_breakpoint.h include/uapi/linux/perf_event.h
tools/perf/Makefile.perf +15 -0
@@ -310,6 +310,21 @@ export srctree OUTPUT RM CC LD AR CFLAGS include $(srctree)/tools/build/Makefile.include $(PERF_IN): prepare FORCE + @(test -f ../../arch/x86/include/asm/disabled-features.h && ( \ + (diff -B ../arch/x86/include/asm/disabled-features.h ../../arch/x86/include/asm/disabled-features.h >/dev/null) \ + || echo "Warning: tools/arch/x86/include/asm/disabled-features.h differs from kernel" >&2 )) || true + @(test -f ../../arch/x86/include/asm/required-features.h && ( \ + (diff -B ../arch/x86/include/asm/required-features.h ../../arch/x86/include/asm/required-features.h >/dev/null) \ + || echo "Warning: tools/arch/x86/include/asm/required-features.h differs from kernel" >&2 )) || true + @(test -f ../../arch/x86/include/asm/cpufeatures.h && ( \ + (diff -B ../arch/x86/include/asm/cpufeatures.h ../../arch/x86/include/asm/cpufeatures.h >/dev/null) \ + || echo "Warning: tools/arch/x86/include/asm/cpufeatures.h differs from kernel" >&2 )) || true + @(test -f ../../arch/x86/lib/memcpy_64.S && ( \ + (diff -B ../arch/x86/lib/memcpy_64.S ../../arch/x86/lib/memcpy_64.S >/dev/null) \ + || echo "Warning: tools/arch/x86/lib/memcpy_64.S differs from kernel" >&2 )) || true + @(test -f ../../arch/x86/lib/memset_64.S && ( \ + (diff -B ../arch/x86/lib/memset_64.S ../../arch/x86/lib/memset_64.S >/dev/null) \ + || echo "Warning: tools/arch/x86/lib/memset_64.S differs from kernel" >&2 )) || true $(Q)$(MAKE) $(build)=perf $(OUTPUT)perf: $(PERFLIBS) $(PERF_IN) $(LIBTRACEEVENT_DYNAMIC_LIST)
tools/perf/bench/mem-memcpy-x86-64-asm.S +1 -1
@@ -1,7 +1,7 @@ #define memcpy MEMCPY /* don't hide glibc's memcpy() */ #define altinstr_replacement text #define globl p2align 4; .globl -#include "../../../arch/x86/lib/memcpy_64.S" +#include "../../arch/x86/lib/memcpy_64.S" /* * We need to provide note.GNU-stack section, saying that we want * NOT executable stack. Otherwise the final linking will assume that
tools/perf/bench/mem-memset-x86-64-asm.S +1 -1
@@ -1,7 +1,7 @@ #define memset MEMSET /* don't hide glibc's memset() */ #define altinstr_replacement text #define globl p2align 4; .globl -#include "../../../arch/x86/lib/memset_64.S" +#include "../../arch/x86/lib/memset_64.S" /* * We need to provide note.GNU-stack section, saying that we want
tools/perf/util/include/asm/alternative-asm.h deleted +0 -9
@@ -1,9 +0,0 @@ -#ifndef _PERF_ASM_ALTERNATIVE_ASM_H -#define _PERF_ASM_ALTERNATIVE_ASM_H - -/* Just disable it so we can build arch/x86/lib/memcpy_64.S for perf bench: */ - -#define altinstruction_entry # -#define ALTERNATIVE_2 # - -#endif
Greg Kroah-Hartman
maintainerPATCH 205/230 serial: 8250_pci: Fix number of ports for ACCES serial cards
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Dolan <[email protected]>
commit b896b03bc7fce43a07012cc6bf5e2ab2fddf3364 upstream.
Have the correct number of ports created for ACCES serial cards. Two port cards show up as four ports, and four port cards show up as eight.
--- drivers/tty/serial/8250/8250_pci.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-)
drivers/tty/serial/8250/8250_pci.c +18 -18
@@ -5176,10 +5176,10 @@ static struct pci_device_id serial_pci_t*/ {PCI_VENDOR_ID_ACCESIO ,PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB ,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_pericom_PI7C9X7954 },
@@ -5188,10 +5188,10 @@ static struct pci_device_id serial_pci_t pbn_pericom_PI7C9X7954 }, {PCI_VENDOR_ID_ACCESIO ,PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB ,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_pericom_PI7C9X7954 },
@@ -5200,10 +5200,10 @@ static struct pci_device_id serial_pci_t pbn_pericom_PI7C9X7954 }, {PCI_VENDOR_ID_ACCESIO ,PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB ,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_pericom_PI7C9X7954 },
@@ -5212,13 +5212,13 @@ static struct pci_device_id serial_pci_t pbn_pericom_PI7C9X7954 }, {PCI_VENDOR_ID_ACCESIO ,PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1 ,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7951 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_pericom_PI7C9X7954 },
@@ -5227,16 +5227,16 @@ static struct pci_device_id serial_pci_t pbn_pericom_PI7C9X7954 }, {PCI_VENDOR_ID_ACCESIO ,PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S ,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_pericom_PI7C9X7954 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_pericom_PI7C9X7954 },
@@ -5245,13 +5245,13 @@ static struct pci_device_id serial_pci_t pbn_pericom_PI7C9X7954 }, {PCI_VENDOR_ID_ACCESIO ,PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM ,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7954 }, + pbn_pericom_PI7C9X7952 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7958 }, + pbn_pericom_PI7C9X7954 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7958 }, + pbn_pericom_PI7C9X7954 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_pericom_PI7C9X7958 },
@@ -5260,19 +5260,19 @@ static struct pci_device_id serial_pci_t pbn_pericom_PI7C9X7958 }, {PCI_VENDOR_ID_ACCESIO ,PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4 ,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7958 }, + pbn_pericom_PI7C9X7954 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_pericom_PI7C9X7958 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7958 }, + pbn_pericom_PI7C9X7954 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_pericom_PI7C9X7958 }, { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,PCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , - pbn_pericom_PI7C9X7958 }, + pbn_pericom_PI7C9X7954 },/* * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke) */
Greg Kroah-Hartman
maintainerPATCH 206/230 serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Dolan <[email protected]>
commit 78d3820b9bd39028727c6aab7297b63c093db343 upstream.
The four port Pericom chips have the fourth port at the wrong address. Make use of quirk to fix it.
--- drivers/tty/serial/8250/8250_pci.c | 105 +++++++++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+)
drivers/tty/serial/8250/8250_pci.c +105 -0
@@ -2326,6 +2326,111 @@ static struct pci_serial_quirk pci_seria .setup = pci_default_setup, .exit = pci_plx9050_exit, }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup, + }, /* * SBS Technologies, Inc., PMC-OCTALPRO 232 */
Greg Kroah-Hartman
maintainerPATCH 207/230 jbd2: clear dirty flag when revoking a buffer from an older transaction
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhangyi (F) <[email protected]>
commit 904cdbd41d749a476863a0ca41f6f396774f26e4 upstream.
Now, we capture a data corruption problem on ext4 while we're truncating an extent index block. Imaging that if we are revoking a buffer which has been journaled by the committing transaction, the buffer's jbddirty flag will not be cleared in jbd2_journal_forget(), so the commit code will set the buffer dirty flag again after refile the buffer.
fsx kjournald2
jbd2_journal_commit_transactionjbd2_journal_revoke commit phase 1~5...
jbd2_journal_forget
belongs to older transaction commit phase 6
jbddirty not clear __jbd2_journal_refile_buffer
__jbd2_journal_unfile_buffer
test_clear_buffer_jbddirty
mark_buffer_dirty
Finally, if the freed extent index block was allocated again as data block by some other files, it may corrupt the file data after writing cached pages later, such as during unmount time. (In general, clean_bdev_aliases() related helpers should be invoked after re-allocation to prevent the above corruption, but unfortunately we missed it when zeroout the head of extra extent blocks in ext4_ext_handle_unwritten_extents()).
This patch mark buffer as freed and set j_next_transaction to the new transaction when it already belongs to the committing transaction in jbd2_journal_forget(), so that commit code knows it should clear dirty bits when it is done with the buffer.
This problem can be reproduced by xfstests generic/455 easily with seeds (3246 3247 3248 3249).
--- fs/jbd2/transaction.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
fs/jbd2/transaction.c +12 -5
@@ -1578,14 +1578,21 @@ int jbd2_journal_forget (handle_t *handl/* However, if the buffer is still owned by a prior * (committing) transaction, we can't drop it yet... */ JBUFFER_TRACE (jh,"belongs to older transaction" ); -/* ... but we CAN drop it from the new transaction if we -* have also modified it since the original commit. */ +/* ... but we CAN drop it from the new transaction through +* marking the buffer as freed and set j_next_transaction to +* the new transaction, so that not only the commit code +* knows it should clear dirty bits when it is done with the +* buffer, but also the buffer can be checkpointed only +* after the new transaction commits. */ -if (jh->b_next_transaction) { -J_ASSERT (jh->b_next_transaction == transaction); +set_buffer_freed (bh); + +if (!jh->b_next_transaction) {spin_lock (&journal->j_list_lock); - jh->b_next_transaction =NULL ; + jh->b_next_transaction = transaction;spin_unlock (&journal->j_list_lock); + }else { +J_ASSERT (jh->b_next_transaction == transaction);/* * only drop a reference if this transaction modified
Greg Kroah-Hartman
maintainerPATCH 208/230 jbd2: fix compile warning when using JBUFFER_TRACE
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhangyi (F) <[email protected]>
commit 01215d3edb0f384ddeaa5e4a22c1ae5ff634149f upstream.
The jh pointer may be used uninitialized in the two cases below and the compiler complain about it when enabling JBUFFER_TRACE macro, fix them.
In file included from fs/jbd2/transaction.c:19:0:fs/jbd2/transaction.c: In function ‘jbd2_journal_get_undo_access’:./include/linux/jbd2.h:1637:38: warning: ‘jh’ is used uninitialized in this function [-Wuninitialized]
#define JBUFFER_TRACE(jh, info) do { printk("%s: %d\n", __func__, jh->b_jcount);} while (0)
^
fs/jbd2/transaction.c:1219:23: note: ‘jh’ was declared here
struct journal_head *jh;
^
In file included from fs/jbd2/transaction.c:19:0:
fs/jbd2/transaction.c: In function ‘jbd2_journal_dirty_metadata’:
./include/linux/jbd2.h:1637:38: warning: ‘jh’ may be used uninitialized in this function [-Wmaybe-uninitialized]
#define JBUFFER_TRACE(jh, info) do { printk("%s: %d\n", __func__, jh->b_jcount);} while (0)
^
fs/jbd2/transaction.c:1332:23: note: ‘jh’ was declared here
struct journal_head *jh;
^--- fs/jbd2/transaction.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
fs/jbd2/transaction.c +8 -8
@@ -1215,11 +1215,12 @@ int jbd2_journal_get_undo_access(handle_struct journal_head *jh;char *committed_data =NULL ; -JBUFFER_TRACE (jh,"entry" );if (jbd2_write_access_granted (handle, bh, true))return 0 ; jh =jbd2_journal_add_journal_head (bh); +JBUFFER_TRACE (jh,"entry" ); +/* * Do this first --- it can drop the journal lock, so we want to * make sure that obtaining the committed_data is done
@@ -1336,15 +1337,17 @@ int jbd2_journal_dirty_metadata(handle_tif (is_handle_aborted (handle))return -EROFS ; -if (!buffer_jbd (bh)) { - ret = -EUCLEAN ; - goto out; - } +if (!buffer_jbd (bh)) +return -EUCLEAN ; +/* * We don't grab jh reference here since the buffer must be part * of the running transaction. */ jh =bh2jh (bh); +jbd_debug (5 ,"journal_head %p\n" , jh); +JBUFFER_TRACE (jh,"entry" ); +/* * This and the following assertions are unreliable since we may see jh * in inconsistent state unless we grab bh_state lock. But this is
@@ -1378,9 +1381,6 @@ int jbd2_journal_dirty_metadata(handle_t } journal = transaction->t_journal; -jbd_debug (5 ,"journal_head %p\n" , jh); -JBUFFER_TRACE (jh,"entry" ); -jbd_lock_bh_state (bh);if (jh->b_modified ==0 ) {
Greg Kroah-Hartman
maintainerPATCH 209/230 powerpc/32: Clear on-stack exception marker upon exception return
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit 9580b71b5a7863c24a9bd18bcd2ad759b86b1eff upstream.
Clear the on-stack STACK_FRAME_REGS_MARKER on exception exit in order to avoid confusing stacktrace like the one below.
Call Trace:
[c0e9dca0] [c01c42a0] print_address_description+0x64/0x2bc (unreliable)
[c0e9dcd0] [c01c4684] kasan_report+0xfc/0x180
[c0e9dd10] [c0895130] memchr+0x24/0x74
[c0e9dd30] [c00a9e38] msg_print_text+0x124/0x574
[c0e9dde0] [c00ab710] console_unlock+0x114/0x4f8
[c0e9de40] [c00adc60] vprintk_emit+0x188/0x1c4
--- interrupt: c0e9df00 at 0x400f330
LR = init_stack+0x1f00/0x2000
[c0e9de80] [c00ae3c4] printk+0xa8/0xcc (unreliable)
[c0e9df20] [c0c27e44] early_irq_init+0x38/0x108
[c0e9df50] [c0c15434] start_kernel+0x310/0x488
[c0e9dff0] [00003484] 0x3484With this patch the trace becomes:
Call Trace: [c0e9dca0] [c01c42c0] print_address_description+0x64/0x2bc (unreliable) [c0e9dcd0] [c01c46a4] kasan_report+0xfc/0x180 [c0e9dd10] [c0895150] memchr+0x24/0x74 [c0e9dd30] [c00a9e58] msg_print_text+0x124/0x574 [c0e9dde0] [c00ab730] console_unlock+0x114/0x4f8 [c0e9de40] [c00adc80] vprintk_emit+0x188/0x1c4 [c0e9de80] [c00ae3e4] printk+0xa8/0xcc [c0e9df20] [c0c27e44] early_irq_init+0x38/0x108 [c0e9df50] [c0c15434] start_kernel+0x310/0x488 [c0e9dff0] [00003484] 0x3484
--- arch/powerpc/kernel/entry_32.S | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/powerpc/kernel/entry_32.S +9 -0
@@ -685,6 +685,9 @@ fast_exception_return: mtcr r10 lwz r10,_LINK(r11) mtlr r10 + /* Clear the exception_marker on the stack to avoid confusing stacktrace */ + li r10, 0 + stw r10, 8(r11) REST_GPR(10, r11) mtspr SPRN_SRR1,r9 mtspr SPRN_SRR0,r12
@@ -915,6 +918,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRE mtcrf 0xFF,r10 mtlr r11 + /* Clear the exception_marker on the stack to avoid confusing stacktrace */ + li r10, 0 + stw r10, 8(r1) /* * Once we put values in SRR0 and SRR1, we are in a state * where exceptions are not recoverable, since taking an
@@ -952,6 +958,9 @@ exc_exit_restart_end: mtlr r11 lwz r10,_CCR(r1) mtcrf 0xff,r10 + /* Clear the exception_marker on the stack to avoid confusing stacktrace */ + li r10, 0 + stw r10, 8(r1) REST_2GPRS(9, r1) .globl exc_exit_restart exc_exit_restart:
Greg Kroah-Hartman
maintainerPATCH 210/230 powerpc/wii: properly disable use of BATs when requested.
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit 6d183ca8baec983dc4208ca45ece3c36763df912 upstream.
'nobats' kernel parameter or some options like CONFIG_DEBUG_PAGEALLOC deny the use of BATS for mapping memory.
This patch makes sure that the specific wii RAM mapping function takes it into account as well.
--- arch/powerpc/platforms/embedded6xx/wii.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/powerpc/platforms/embedded6xx/wii.c +4 -0
@@ -104,6 +104,10 @@ unsigned long __init wii_mmu_mapin_mem2(/* MEM2 64MB@0x10000000 */ delta = wii_hole_start + wii_hole_size; size = top - delta; + +if (__map_without_bats) +return delta; +for (bl =128 <<10 ; bl < max_size; bl <<=1 ) {if (bl *2 > size)break ;
Greg Kroah-Hartman
maintainerPATCH 211/230 powerpc/powernv: Make opal log only readable by root
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Niethe <[email protected]>
commit 7b62f9bd2246b7d3d086e571397c14ba52645ef1 upstream.
Currently the opal log is globally readable. It is kernel policy to limit the visibility of physical addresses / kernel pointers to root. Given this and the fact the opal log may contain this information it would be better to limit the readability to root.
--- arch/powerpc/platforms/powernv/opal-msglog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/powernv/opal-msglog.c +1 -1
@@ -92,7 +92,7 @@ out: }static struct bin_attribute opal_msglog_attr = { - .attr = {.name ="msglog" , .mode =0444 }, + .attr = {.name ="msglog" , .mode =0400 }, .read = opal_msglog_read };
Greg Kroah-Hartman
maintainerPATCH 212/230 powerpc/83xx: Also save/restore SPRG4-7 during suspend
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit 36da5ff0bea2dc67298150ead8d8471575c54c7d upstream.
The 83xx has 8 SPRG registers and uses at least SPRG4 for DTLB handling LRU.
--- arch/powerpc/platforms/83xx/suspend-asm.S | 34 +++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-)
arch/powerpc/platforms/83xx/suspend-asm.S +27 -7
@@ -26,13 +26,13 @@ #define SS_MSR 0x74 #define SS_SDR1 0x78 #define SS_LR 0x7c -#define SS_SPRG 0x80 /* 4 SPRGs */ -#define SS_DBAT 0x90 /* 8 DBATs */ -#define SS_IBAT 0xd0 /* 8 IBATs */ -#define SS_TB 0x110 -#define SS_CR 0x118 -#define SS_GPREG 0x11c /* r12-r31 */ -#define STATE_SAVE_SIZE 0x16c +#define SS_SPRG 0x80 /* 8 SPRGs */ +#define SS_DBAT 0xa0 /* 8 DBATs */ +#define SS_IBAT 0xe0 /* 8 IBATs */ +#define SS_TB 0x120 +#define SS_CR 0x128 +#define SS_GPREG 0x12c /* r12-r31 */ +#define STATE_SAVE_SIZE 0x17c .section .data .align 5
@@ -103,6 +103,16 @@ _GLOBAL(mpc83xx_enter_deep_sleep) stw r7, SS_SPRG+12(r3) stw r8, SS_SDR1(r3) + mfspr r4, SPRN_SPRG4 + mfspr r5, SPRN_SPRG5 + mfspr r6, SPRN_SPRG6 + mfspr r7, SPRN_SPRG7 + + stw r4, SS_SPRG+16(r3) + stw r5, SS_SPRG+20(r3) + stw r6, SS_SPRG+24(r3) + stw r7, SS_SPRG+28(r3) + mfspr r4, SPRN_DBAT0U mfspr r5, SPRN_DBAT0L mfspr r6, SPRN_DBAT1U
@@ -493,6 +503,16 @@ mpc83xx_deep_resume: mtspr SPRN_IBAT7U, r6 mtspr SPRN_IBAT7L, r7 + lwz r4, SS_SPRG+16(r3) + lwz r5, SS_SPRG+20(r3) + lwz r6, SS_SPRG+24(r3) + lwz r7, SS_SPRG+28(r3) + + mtspr SPRN_SPRG4, r4 + mtspr SPRN_SPRG5, r5 + mtspr SPRN_SPRG6, r6 + mtspr SPRN_SPRG7, r7 + lwz r4, SS_SPRG+0(r3) lwz r5, SS_SPRG+4(r3) lwz r6, SS_SPRG+8(r3)
Greg Kroah-Hartman
maintainerPATCH 213/230 ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit e2477233145f2156434afb799583bccd878f3e9f upstream.
Fix boolean expressions by using logical AND operator '&&' instead of bitwise operator '&'.
This issue was detected with the help of Coccinelle.
--- arch/arm/mach-s3c24xx/mach-osiris-dvs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/mach-s3c24xx/mach-osiris-dvs.c +4 -4
@@ -70,16 +70,16 @@ static int osiris_dvs_notify(struct notiswitch (val) {case CPUFREQ_PRECHANGE : -if (old_dvs & !new_dvs || - cur_dvs & !new_dvs) { +if ((old_dvs && !new_dvs) || + (cur_dvs && !new_dvs)) {pr_debug ("%s: exiting dvs\n" , __func__); cur_dvs = false;gpio_set_value (OSIRIS_GPIO_DVS ,1 ); }break ;case CPUFREQ_POSTCHANGE : -if (!old_dvs & new_dvs || - !cur_dvs & new_dvs) { +if ((!old_dvs && new_dvs) || + (!cur_dvs && new_dvs)) {pr_debug ("entering dvs\n" ); cur_dvs = true;gpio_set_value (OSIRIS_GPIO_DVS ,0 );
Greg Kroah-Hartman
maintainerPATCH 214/230 dm: fix to_sector() for 32bit
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 0bdb50c531f7377a9da80d3ce2d61f389c84cb30 upstream.
A dm-raid array with devices larger than 4GB won't assemble on a 32 bit host since _check_data_dev_sectors() was added in 4.16. This is because to_sector() treats its argument as an "unsigned long" which is 32bits (4GB) on a 32bit host. Using "unsigned long long" is more correct.
Kernels as early as 4.2 can have other problems due to to_sector() being used on the size of a device.
--- include/linux/device-mapper.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/device-mapper.h +1 -1
@@ -593,7 +593,7 @@ extern struct ratelimit_state dm_ratelim*/ #define dm_target_offset (ti, sector) ((sector) - (ti)->begin) -static inline sector_t to_sector (unsigned long n) +static inline sector_t to_sector (unsigned long long n) {return (n >>SECTOR_SHIFT ); }
Greg Kroah-Hartman
maintainerPATCH 215/230 NFS41: pop some layoutget errors to application
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Tao <[email protected]>
commit d600ad1f2bdbf97c4818dcc85b174f72c90c21bd upstream.
For ERESTARTSYS/EIO/EROFS/ENOSPC/E2BIG in layoutget, we should just bail out instead of hiding the error and retrying inband IO.
Change all the call sites to pop the error all the way up.
--- fs/nfs/direct.c | 15 ++++++++++++++- fs/nfs/filelayout/filelayout.c | 17 +++++++++++++++-- fs/nfs/flexfilelayout/flexfilelayout.c | 25 ++++++++++++++++++++++--- fs/nfs/pagelist.c | 9 ++++++++- fs/nfs/pnfs.c | 24 ++++++++++++++++++------ fs/nfs/read.c | 2 +- 6 files changed, 78 insertions(+), 14 deletions(-)
fs/nfs/direct.c +14 -1
@@ -670,6 +670,10 @@ static void nfs_direct_write_reschedule( req =nfs_list_entry (reqs.next);nfs_direct_setup_mirroring (dreq, &desc, req); +if (desc.pg_error <0 ) { +list_splice_init (&reqs, &failed); + goto out_failed; + }list_for_each_entry_safe (req, tmp, &reqs, wb_list) {if (!nfs_pageio_add_request (&desc, req)) {
@@ -677,13 +681,17 @@ static void nfs_direct_write_reschedule(nfs_list_add_request (req, &failed);spin_lock (cinfo.lock); dreq->flags =0 ; - dreq->error = -EIO ; +if (desc.pg_error <0 ) + dreq->error = desc.pg_error; +else + dreq->error = -EIO ;spin_unlock (cinfo.lock); }nfs_release_request (req); }nfs_pageio_complete (&desc); +out_failed:while (!list_empty (&failed)) { req =nfs_list_entry (failed.next);nfs_list_remove_request (req);
@@ -898,6 +906,11 @@ static ssize_t nfs_direct_write_schedule }nfs_direct_setup_mirroring (dreq, &desc, req); +if (desc.pg_error <0 ) { +nfs_free_request (req); + result = desc.pg_error; +break ; + }nfs_lock_request (req); req->wb_index = pos >>PAGE_SHIFT ;
fs/nfs/filelayout/filelayout.c +15 -2
@@ -882,13 +882,19 @@ static void filelayout_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req) { -if (!pgio->pg_lseg) +if (!pgio->pg_lseg) { pgio->pg_lseg =pnfs_update_layout (pgio->pg_inode, req->wb_context,0 ,NFS4_MAX_UINT64 ,IOMODE_READ ,GFP_KERNEL ); +if (IS_ERR (pgio->pg_lseg)) { + pgio->pg_error =PTR_ERR (pgio->pg_lseg); + pgio->pg_lseg =NULL ; +return ; + } + }/* If no lseg, fall back to read through mds */ if (pgio->pg_lseg ==NULL )nfs_pageio_reset_read_mds (pgio);
@@ -901,13 +907,20 @@ filelayout_pg_init_write(struct nfs_pagestruct nfs_commit_info cinfo;int status; -if (!pgio->pg_lseg) +if (!pgio->pg_lseg) { pgio->pg_lseg =pnfs_update_layout (pgio->pg_inode, req->wb_context,0 ,NFS4_MAX_UINT64 ,IOMODE_RW ,GFP_NOFS ); +if (IS_ERR (pgio->pg_lseg)) { + pgio->pg_error =PTR_ERR (pgio->pg_lseg); + pgio->pg_lseg =NULL ; +return ; + } + } +/* If no lseg, fall back to write through mds */ if (pgio->pg_lseg ==NULL ) goto out_mds;
fs/nfs/flexfilelayout/flexfilelayout.c +22 -3
@@ -786,13 +786,19 @@ ff_layout_pg_init_read(struct nfs_pageioint ds_idx;/* Use full layout for now */ -if (!pgio->pg_lseg) +if (!pgio->pg_lseg) { pgio->pg_lseg =pnfs_update_layout (pgio->pg_inode, req->wb_context,0 ,NFS4_MAX_UINT64 ,IOMODE_READ ,GFP_KERNEL ); +if (IS_ERR (pgio->pg_lseg)) { + pgio->pg_error =PTR_ERR (pgio->pg_lseg); + pgio->pg_lseg =NULL ; +return ; + } + }/* If no lseg, fall back to read through mds */ if (pgio->pg_lseg ==NULL ) goto out_mds;
@@ -826,13 +832,19 @@ ff_layout_pg_init_write(struct nfs_pageiint i;int status; -if (!pgio->pg_lseg) +if (!pgio->pg_lseg) { pgio->pg_lseg =pnfs_update_layout (pgio->pg_inode, req->wb_context,0 ,NFS4_MAX_UINT64 ,IOMODE_RW ,GFP_NOFS ); +if (IS_ERR (pgio->pg_lseg)) { + pgio->pg_error =PTR_ERR (pgio->pg_lseg); + pgio->pg_lseg =NULL ; +return ; + } + }/* If no lseg, fall back to write through mds */ if (pgio->pg_lseg ==NULL ) goto out_mds;
@@ -868,18 +880,25 @@ static unsigned int ff_layout_pg_get_mirror_count_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req) { -if (!pgio->pg_lseg) +if (!pgio->pg_lseg) { pgio->pg_lseg =pnfs_update_layout (pgio->pg_inode, req->wb_context,0 ,NFS4_MAX_UINT64 ,IOMODE_RW ,GFP_NOFS ); +if (IS_ERR (pgio->pg_lseg)) { + pgio->pg_error =PTR_ERR (pgio->pg_lseg); + pgio->pg_lseg =NULL ; + goto out; + } + }if (pgio->pg_lseg)return FF_LAYOUT_MIRROR_COUNT (pgio->pg_lseg);/* no lseg means that pnfs is not in use, so no mirroring here */ nfs_pageio_reset_write_mds (pgio); +out:return 1 ; }
fs/nfs/pagelist.c +8 -1
@@ -872,6 +872,9 @@ static int nfs_pageio_setup_mirroring(st mirror_count = pgio->pg_ops->pg_get_mirror_count (pgio, req); +if (pgio->pg_error <0 ) +return pgio->pg_error; +if (!mirror_count || mirror_count >NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX )return -EINVAL ;
@@ -980,6 +983,8 @@ static int nfs_pageio_do_add_request(str }else {if (desc->pg_ops->pg_init) desc->pg_ops->pg_init (desc, req); +if (desc->pg_error <0 ) +return 0 ; mirror->pg_base = req->wb_pgbase; }if (!nfs_can_coalesce_requests (prev, req, desc))
@@ -1145,6 +1150,8 @@ int nfs_pageio_add_request(struct nfs_pa bytes = req->wb_bytes;nfs_pageio_setup_mirroring (desc, req); +if (desc->pg_error <0 ) +return 0 ;for (midx =0 ; midx < desc->pg_mirror_count; midx++) {if (midx) {
@@ -1230,7 +1237,7 @@ int nfs_pageio_resend(struct nfs_pageio_nfs_pageio_complete (desc);if (!list_empty (&failed)) {list_move (&failed, &hdr->pages); -return -EIO ; +return desc->pg_error <0 ? desc->pg_error : -EIO ; }return 0 ; }
fs/nfs/pnfs.c +18 -6
@@ -909,14 +909,15 @@ send_layoutget(struct pnfs_layout_hdr *lif (IS_ERR (lseg)) {switch (PTR_ERR (lseg)) { -case -ENOMEM :case -ERESTARTSYS : +case -EIO : +case -ENOSPC : +case -EROFS : +case -E2BIG :break ;default : -/* remember that LAYOUTGET failed and suspend trying */ -pnfs_layout_io_set_failed (lo, range->iomode); +return NULL ; } -return NULL ; }else pnfs_layout_clear_fail_bit (lo,pnfs_iomode_to_fail_bit (range->iomode));
@@ -1625,7 +1626,7 @@ out:"(%s, offset: %llu, length: %llu)\n" , __func__, ino->i_sb->s_id, (unsigned long long )NFS_FILEID (ino), - lseg ==NULL ?"not found" :"found" , +IS_ERR_OR_NULL (lseg) ?"not found" :"found" , iomode==IOMODE_RW ?"read/write" :"read-only" , (unsigned long long )pos, (unsigned long long)count);
@@ -1804,6 +1805,11 @@ pnfs_generic_pg_init_read(struct nfs_pag rd_size,IOMODE_READ , GFP_KERNEL); +if (IS_ERR (pgio->pg_lseg)) { + pgio->pg_error =PTR_ERR (pgio->pg_lseg); + pgio->pg_lseg =NULL ; +return ; + } }/* If no lseg, fall back to read through mds */ if (pgio->pg_lseg ==NULL )
@@ -1816,13 +1822,19 @@ void pnfs_generic_pg_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req, u64 wb_size) { - if (pgio->pg_lseg == NULL) + if (pgio->pg_lseg == NULL) { pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, req->wb_context,req_offset (req), wb_size,IOMODE_RW ,GFP_NOFS ); +if (IS_ERR (pgio->pg_lseg)) { + pgio->pg_error =PTR_ERR (pgio->pg_lseg); + pgio->pg_lseg =NULL ; +return ; + } + }/* If no lseg, fall back to write through mds */ if (pgio->pg_lseg ==NULL )nfs_pageio_reset_write_mds (pgio);
fs/nfs/read.c +1 -1
@@ -115,7 +115,7 @@ int nfs_readpage_async(struct nfs_open_c pgm = &pgio.pg_mirrors[0 ];NFS_I (inode)->read_io += pgm->pg_bytes_written; -return 0 ; +return pgio.pg_error <0 ? pgio.pg_error :0 ; }static void nfs_readpage_release (struct nfs_page *req)
Greg Kroah-Hartman
maintainerPATCH 216/230 perf intel-pt: Fix CYC timestamp calculation after OVF
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 03997612904866abe7cdcc992784ef65cb3a4b81 upstream.
CYC packet timestamp calculation depends upon CBR which was being cleared upon overflow (OVF). That can cause errors due to failing to synchronize with sideband events. Even if a CBR change has been lost, the old CBR is still a better estimate than zero. So remove the clearing of CBR.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 1 - 1 file changed, 1 deletion(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +0 -1
@@ -1281,7 +1281,6 @@ static int intel_pt_overflow(struct inte {intel_pt_log ("ERROR: Buffer overflow\n" );intel_pt_clear_tx_flags (decoder); - decoder->cbr =0 ; decoder->timestamp_insn_cnt =0 ; decoder->pkt_state =INTEL_PT_STATE_ERR_RESYNC ; decoder->overflow = true;
Greg Kroah-Hartman
maintainerPATCH 217/230 perf auxtrace: Define auxtrace record alignment
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit c3fcadf0bb765faf45d6d562246e1d08885466df upstream.
Define auxtrace record alignment so that it can be referenced elsewhere.
Note this is preparation for patch "perf intel-pt: Fix overlap calculation for padding"
--- tools/perf/util/auxtrace.c | 4 ++-- tools/perf/util/auxtrace.h | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-)
tools/perf/util/auxtrace.c +2 -2
@@ -1226,9 +1226,9 @@ static int __auxtrace_mmap__read(struct }/* padding must be written by fn() e.g. record__process_auxtrace() */ - padding = size &7 ; + padding = size & (PERF_AUXTRACE_RECORD_ALIGNMENT -1 );if (padding) - padding =8 - padding; + padding =PERF_AUXTRACE_RECORD_ALIGNMENT - padding;memset (&ev,0 ,sizeof (ev)); ev.auxtrace.header.type =PERF_RECORD_AUXTRACE ;
tools/perf/util/auxtrace.h +3 -0
@@ -37,6 +37,9 @@ struct record_opts;struct auxtrace_info_event ;struct events_stats ; +/* Auxtrace records must have the same alignment as perf event records */ +#define PERF_AUXTRACE_RECORD_ALIGNMENT 8 +enum auxtrace_type {PERF_AUXTRACE_UNKNOWN ,PERF_AUXTRACE_INTEL_PT ,
Greg Kroah-Hartman
maintainerPATCH 218/230 perf intel-pt: Fix overlap calculation for padding
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 5a99d99e3310a565b0cf63f785b347be9ee0da45 upstream.
Auxtrace records might have up to 7 bytes of padding appended. Adjust the overlap accordingly.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 36 ++++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +34 -2
@@ -26,6 +26,7 @@#include "../cache.h" #include "../util.h" +#include "../auxtrace.h" #include "intel-pt-insn-decoder.h" #include "intel-pt-pkt-decoder.h"
@@ -2320,6 +2321,34 @@ static int intel_pt_tsc_cmp(uint64_t tsc } } +#define MAX_PADDING (PERF_AUXTRACE_RECORD_ALIGNMENT - 1) + +/** +* adj_for_padding - adjust overlap to account for padding. +* @buf_b: second buffer +* @buf_a: first buffer +* @len_a: size of first buffer +* +* @buf_a might have up to 7 bytes of padding appended. Adjust the overlap +* accordingly. +* +* Return: A pointer into @buf_b from where non-overlapped data starts +*/ +static unsigned char *adj_for_padding (unsigned char *buf_b, +unsigned char *buf_a,size_t len_a) +{ +unsigned char *p = buf_b -MAX_PADDING ; +unsigned char *q = buf_a + len_a -MAX_PADDING ; +int i; + +for (i =MAX_PADDING ; i; i--, p++, q++) { +if (*p != *q) +break ; + } + +return p; +} +/** * intel_pt_find_overlap_tsc - determine start of non-overlapped trace data * using TSC.
@@ -2370,8 +2399,11 @@ static unsigned char *intel_pt_find_over/* Same TSC, so buffers are consecutive */ if (!cmp && rem_b >= rem_a) { +unsigned char *start; + *consecutive = true; -return buf_b + len_b - (rem_b - rem_a); + start = buf_b + len_b - (rem_b - rem_a); +return adj_for_padding (start, buf_a, len_a); }if (cmp <0 )return buf_b;/* tsc_a < tsc_b => no overlap */
@@ -2434,7 +2466,7 @@ unsigned char *intel_pt_find_overlap(uns found =memmem (buf_a, len_a, buf_b, len_a);if (found) { *consecutive = true; -return buf_b + len_a; +return adj_for_padding (buf_b + len_a, buf_a, len_a); }/* Try again at next PSB in buffer 'a' */
Greg Kroah-Hartman
maintainerPATCH 219/230 md: Fix failed allocation of md_register_thread
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Pakki <[email protected]>
commit e406f12dde1a8375d77ea02d91f313fb1a9c6aec upstream.
mddev->sync_thread can be set to NULL on kzalloc failure downstream. The patch checks for such a scenario and frees allocated resources.
Committer node:
Added similar fix to raid5.c, as suggested by Guoqing.
--- drivers/md/raid10.c | 2 ++ drivers/md/raid5.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/md/raid10.c +2 -0
@@ -3755,6 +3755,8 @@ static int run(struct mddev *mddev)set_bit (MD_RECOVERY_RUNNING , &mddev->recovery); mddev->sync_thread =md_register_thread (md_do_sync, mddev,"reshape" ); +if (!mddev->sync_thread) + goto out_free_conf; }return 0 ;
drivers/md/raid5.c +2 -0
@@ -6973,6 +6973,8 @@ static int run(struct mddev *mddev)set_bit (MD_RECOVERY_RUNNING , &mddev->recovery); mddev->sync_thread =md_register_thread (md_do_sync, mddev,"reshape" ); +if (!mddev->sync_thread) + goto abort; }/* Ok, everything is just fine now */
Greg Kroah-Hartman
maintainerPATCH 220/230 NFS: Fix an I/O request leakage in nfs_do_recoalesce
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 4d91969ed4dbcefd0e78f77494f0cb8fada9048a upstream.
Whether we need to exit early, or just reprocess the list, we must not lost track of the request which failed to get recoalesced.
--- fs/nfs/pagelist.c | 1 - 1 file changed, 1 deletion(-)
fs/nfs/pagelist.c +0 -1
@@ -1107,7 +1107,6 @@ static int nfs_do_recoalesce(struct nfs_struct nfs_page *req; req = list_first_entry(&head, struct nfs_page, wb_list); -nfs_list_remove_request (req);if (__nfs_pageio_add_request (desc, req))continue ;if (desc->pg_error <0 ) {
Greg Kroah-Hartman
maintainerPATCH 221/230 NFS: Dont recoalesce on error in nfs_pageio_complete_mirror()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 8127d82705998568b52ac724e28e00941538083d upstream.
If the I/O completion failed with a fatal error, then we should just exit nfs_pageio_complete_mirror() rather than try to recoalesce.
--- fs/nfs/pagelist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/pagelist.c +1 -1
@@ -1202,7 +1202,7 @@ static void nfs_pageio_complete_mirror(s desc->pg_mirror_idx = mirror_idx;for (;;) {nfs_pageio_doio (desc); -if (!mirror->pg_recoalesce) +if (desc->pg_error <0 || !mirror->pg_recoalesce)break ;if (!nfs_do_recoalesce (desc))break ;
Greg Kroah-Hartman
maintainerPATCH 222/230 nfsd: fix memory corruption caused by readdir
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit b602345da6cbb135ba68cf042df8ec9a73da7981 upstream.
If the result of an NFSv3 readdir{,plus} request results in the "offset" on one entry having to be split across 2 pages, and is sized so that the next directory entry doesn't fit in the requested size, then memory corruption can happen.
When encode_entry() is called after encoding the last entry that fits, it notices that ->offset and ->offset1 are set, and so stores the offset value in the two pages as required. It clears ->offset1 but *does not* clear ->offset.
Normally this omission doesn't matter as encode_entry_baggage() will be called, and will set ->offset to a suitable value (not on a page boundary).
But in the case where cd->buflen < elen and nfserr_toosmall is returned, ->offset is not reset.
This means that nfsd3proc_readdirplus will see ->offset with a value 4 bytes before the end of a page, and ->offset1 set to NULL. It will try to write 8bytes to ->offset.
If we are lucky, the next page will be read-only, and the system will
BUG: unable to handle kernel paging request at...
If we are unlucky, some innocent page will have the first 4 bytes corrupted.
nfsd3proc_readdir() doesn't even check for ->offset1, it just blindly writes 8 bytes to the offset wherever it is.
Fix this by clearing ->offset after it is used, and copying the ->offset handling code from nfsd3_proc_readdirplus into nfsd3_proc_readdir.
(Note that the commit hash in the Fixes tag is from the 'history'
tree - this bug predates git).
Fixes-URL: https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/commit/?id=0b1d57cf7654
--- fs/nfsd/nfs3proc.c | 16 ++++++++++++++-- fs/nfsd/nfs3xdr.c | 1 + 2 files changed, 15 insertions(+), 2 deletions(-)
fs/nfsd/nfs3proc.c +14 -2
@@ -430,8 +430,19 @@ nfsd3_proc_readdir(struct svc_rqst *rqst &resp->common, nfs3svc_encode_entry);memcpy (resp->verf, argp->verf,8 ); resp->count = resp->buffer - argp->buffer; -if (resp->offset) -xdr_encode_hyper (resp->offset, argp->cookie); +if (resp->offset) { +loff_t offset = argp->cookie; + +if (unlikely (resp->offset1)) { +/* we ended up with offset on a page boundary */ + *resp->offset =htonl (offset >>32 ); + *resp->offset1 =htonl (offset &0xffffffff ); + resp->offset1 =NULL ; + }else { +xdr_encode_hyper (resp->offset, offset); + } + resp->offset =NULL ; + }RETURN_STATUS (nfserr); }
@@ -499,6 +510,7 @@ nfsd3_proc_readdirplus(struct svc_rqst * }else {xdr_encode_hyper (resp->offset, offset); } + resp->offset =NULL ; }RETURN_STATUS (nfserr);
fs/nfsd/nfs3xdr.c +1 -0
@@ -898,6 +898,7 @@ encode_entry(struct readdir_cd *ccd, con }else {xdr_encode_hyper (cd->offset, offset64); } + cd->offset =NULL ; }/*
Greg Kroah-Hartman
maintainerPATCH 223/230 nfsd: fix wrong check in write_v4_end_grace()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihao Wu <[email protected]>
commit dd838821f0a29781b185cd8fb8e48d5c177bd838 upstream.
Commit 62a063b8e7d1 "nfsd4: fix crash on writing v4_end_grace before nfsd startup" is trying to fix a NULL dereference issue, but it mistakenly checks if the nfsd server is started. So fix it.
--- fs/nfsd/nfsctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfsctl.c +1 -1
@@ -1106,7 +1106,7 @@ static ssize_t write_v4_end_grace(structcase 'Y' :case 'y' :case '1' : -if (nn->nfsd_serv) +if (!nn->nfsd_serv)return -EBUSY ;nfsd4_end_grace (nn);break ;
Greg Kroah-Hartman
maintainerPATCH 224/230 PM / wakeup: Rework wakeup source timer cancellation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
commit 1fad17fb1bbcd73159c2b992668a6957ecc5af8a upstream.
If wakeup_source_add() is called right after wakeup_source_remove() for the same wakeup source, timer_setup() may be called for a potentially scheduled timer which is incorrect.
To avoid that, move the wakeup source timer cancellation from wakeup_source_drop() to wakeup_source_remove().
Moreover, make wakeup_source_remove() clear the timer function after canceling the timer to let wakeup_source_not_registered() treat unregistered wakeup sources in the same way as the ones that have never been registered.
--- drivers/base/power/wakeup.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/base/power/wakeup.c +7 -1
@@ -113,7 +113,6 @@ void wakeup_source_drop(struct wakeup_soif (!ws)return ; -del_timer_sync (&ws->timer);__pm_relax (ws); }EXPORT_SYMBOL_GPL (wakeup_source_drop);
@@ -201,6 +200,13 @@ void wakeup_source_remove(struct wakeup_list_del_rcu (&ws->entry);spin_unlock_irqrestore (&events_lock, flags);synchronize_srcu (&wakeup_srcu); + +del_timer_sync (&ws->timer); +/* +* Clear timer.function to make wakeup_source_not_registered() treat +* this wakeup source as not registered. +*/ + ws->timer.function =NULL ; }EXPORT_SYMBOL_GPL (wakeup_source_remove);
Greg Kroah-Hartman
maintainerPATCH 225/230 rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang, Jun <[email protected]>
commit 1d1f898df6586c5ea9aeaf349f13089c6fa37903 upstream.
The rcu_gp_kthread_wake() function is invoked when it might be necessary to wake the RCU grace-period kthread. Because self-wakeups are normally a useless waste of CPU cycles, if rcu_gp_kthread_wake() is invoked from this kthread, it naturally refuses to do the wakeup.
Unfortunately, natural though it might be, this heuristic fails when rcu_gp_kthread_wake() is invoked from an interrupt or softirq handler that interrupted the grace-period kthread just after the final check of the wait-event condition but just before the schedule() call. In this case, a wakeup is required, even though the call to rcu_gp_kthread_wake() is within the RCU grace-period kthread's context. Failing to provide this wakeup can result in grace periods failing to start, which in turn results in out-of-memory conditions.
This race window is quite narrow, but it actually did happen during real testing. It would of course need to be fixed even if it was strictly theoretical in nature.
This patch does not Cc stable because it does not apply cleanly to earlier kernel versions.
Signed-off: "Zhang, Jun" <[email protected]>
Signed-off: "He, Bo" <[email protected]>
Signed-off: "xiao, jin" <[email protected]>
Signed-off: Bai, Jie A <[email protected]>
[ paulmck: Switch from !in_softirq() to "!in_interrupt() &&
!in_serving_softirq() to avoid redundant wakeups and to also handle the interrupt-handler scenario as well as the softirq-handler scenario that actually occurred in testing. ]
--- kernel/rcu/tree.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
kernel/rcu/tree.c +14 -6
@@ -1611,15 +1611,23 @@ static int rcu_future_gp_cleanup(struct }/* -* Awaken the grace-period kthread for the specified flavor of RCU. -* Don't do a self-awaken, and don't bother awakening when there is -* nothing for the grace-period kthread to do (as in several CPUs -* raced to awaken, and we lost), and finally don't try to awaken -* a kthread that has not yet been created. +* Awaken the grace-period kthread. Don't do a self-awaken (unless in +* an interrupt or softirq handler), and don't bother awakening when there +* is nothing for the grace-period kthread to do (as in several CPUs raced +* to awaken, and we lost), and finally don't try to awaken a kthread that +* has not yet been created. If all those checks are passed, track some +* debug information and awaken. +* +* So why do the self-wakeup when in an interrupt or softirq handler +* in the grace-period kthread's context? Because the kthread might have +* been interrupted just as it was going to sleep, and just after the final +* pre-sleep check of the awaken condition. In this case, a wakeup really +* is required, and is therefore supplied. */ static void rcu_gp_kthread_wake (struct rcu_state *rsp) { -if (current == rsp->gp_kthread || +if ((current == rsp->gp_kthread && + !in_interrupt () && !in_serving_softirq ()) || !READ_ONCE (rsp->gp_flags) || !rsp->gp_kthread)return ;
Greg Kroah-Hartman
maintainerPATCH 226/230 media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit 9dd0627d8d62a7ddb001a75f63942d92b5336561 upstream.
The UVC video driver converts the timestamp from hardware specific unit to one known by the kernel at the time when the buffer is dequeued. This is fine in general, but the streamoff operation consists of the following steps (among other things):
1. uvc_video_clock_cleanup --- the hardware clock sample array is released and the pointer to the array is set to NULL,
2. buffers in active state are returned to the user and
3. buf_finish callback is called on buffers that are prepared. buf_finish includes calling uvc_video_clock_update that accesses the hardware clock sample array.
The above is serialised by a queue specific mutex. Address the problem by skipping the clock conversion if the hardware clock sample array is already released.
--- drivers/media/usb/uvc/uvc_video.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/media/usb/uvc/uvc_video.c +8 -0
@@ -638,6 +638,14 @@ void uvc_video_clock_update(struct uvc_sif (!uvc_hw_timestamps_param)return ; +/* +* We will get called from __vb2_queue_cancel() if there are buffers +* done but not dequeued by the user, but the sample array has already +* been released at that time. Just bail out in that case. +*/ +if (!clock->samples) +return ; +spin_lock_irqsave (&clock->lock, flags);if (clock->count < clock->size)
Greg Kroah-Hartman
maintainerPATCH 227/230 drm/radeon/evergreen_cs: fix missing break in switch statement
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit cc5034a5d293dd620484d1d836aa16c6764a1c8c upstream.
Add missing break statement in order to prevent the code from falling through to case CB_TARGET_MASK.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/gpu/drm/radeon/evergreen_cs.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/evergreen_cs.c +1 -0
@@ -1299,6 +1299,7 @@ static int evergreen_cs_handle_reg(strucreturn -EINVAL ; } ib[idx] += (u32)((reloc->gpu_offset >>8 ) &0xffffffff ); +break ;case CB_TARGET_MASK : track->cb_target_mask =radeon_get_ib_value (p, idx); track->cb_dirty = true;
Greg Kroah-Hartman
maintainerPATCH 228/230 KVM: nVMX: Sign extend displacements of VMX instrs mem operands
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 946c522b603f281195af1df91837a1d4d1eb3bc9 upstream.
The VMCS.EXIT_QUALIFCATION field reports the displacements of memory operands for various instructions, including VMX instructions, as a naturally sized unsigned value, but masks the value by the addr size, e.g. given a ModRM encoded as -0x28(%ebp), the -0x28 displacement is reported as 0xffffffd8 for a 32-bit address size. Despite some weird wording regarding sign extension, the SDM explicitly states that bits beyond the instructions address size are undefined:
In all cases, bits of this field beyond the instruction’s address size are undefined.
Failure to sign extend the displacement results in KVM incorrectly treating a negative displacement as a large positive displacement when the address size of the VMX instruction is smaller than KVM's native size, e.g. a 32-bit address size on a 64-bit KVM.
The very original decoding, added by commit 064aea774768 ("KVM: nVMX:
Decoding memory operands of VMX instructions"), sort of modeled sign extension by truncating the final virtual/linear address for a 32-bit address size. I.e. it messed up the effective address but made it work by adjusting the final address.
When segmentation checks were added, the truncation logic was kept as-is and no sign extension logic was introduced. In other words, it kept calculating the wrong effective address while mostly generating the correct virtual/linear address. As the effective address is what's used in the segment limit checks, this results in KVM incorreclty injecting #GP/#SS faults due to non-existent segment violations when a nested VMM uses negative displacements with an address size smaller than KVM's native address size.
Using the -0x28(%ebp) example, an EBP value of 0x1000 will result in KVM using 0x100000fd8 as the effective address when checking for a segment limit violation. This causes a 100% failure rate when running a 32-bit KVM build as L1 on top of a 64-bit KVM L0.
--- arch/x86/kvm/vmx.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/kvm/vmx.c +4 -0
@@ -6656,6 +6656,10 @@ static int get_vmx_mem_address(struct kv/* Addr = segment_base + offset */ /* offset = base + [index * scale] + displacement */ off = exit_qualification;/* holds the displacement */ +if (addr_size ==1 ) + off = (gva_t )sign_extend64 (off,31 ); +else if (addr_size ==0 ) + off = (gva_t )sign_extend64 (off,15 );if (base_is_valid) off +=kvm_register_read (vcpu, base_reg);if (index_is_valid)
Greg Kroah-Hartman
maintainerPATCH 229/230 KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 34333cc6c2cb021662fd32e24e618d1b86de95bf upstream.
Regarding segments with a limit==0xffffffff, the SDM officially states:
When the effective limit is FFFFFFFFH (4 GBytes), these accesses may or may not cause the indicated exceptions. Behavior is implementation-specific and may vary from one execution to another.
In practice, all CPUs that support VMX ignore limit checks for "flat segments", i.e. an expand-up data or code segment with base=0 and limit=0xffffffff. This is subtly different than wrapping the effective address calculation based on the address size, as the flat segment behavior also applies to accesses that would wrap the 4g boundary, e.g. a 4-byte access starting at 0xffffffff will access linear addresses 0xffffffff, 0x0, 0x1 and 0x2.
--- arch/x86/kvm/vmx.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/x86/kvm/vmx.c +9 -3
@@ -6702,10 +6702,16 @@ static int get_vmx_mem_address(struct kv/* Protected mode: #GP(0)/#SS(0) if the segment is unusable. */ exn = (s.unusable !=0 ); -/* Protected mode: #GP(0)/#SS(0) if the memory -* operand is outside the segment limit. + +/* +* Protected mode: #GP(0)/#SS(0) if the memory operand is +* outside the segment limit. All CPUs that support VMX ignore +* limit checks for flat segments, i.e. segments with base==0, +* limit==0xffffffff and of type expand-up data or code. */ - exn = exn || (off +sizeof (u64) > s.limit); +if (!(s.base ==0 && s.limit ==0xffffffff && + ((s.type &8 ) || !(s.type &4 )))) + exn = exn || (off +sizeof (u64) > s.limit); }if (exn) { kvm_queue_exception_e(vcpu,
Greg Kroah-Hartman
maintainerPATCH 230/230 KVM: X86: Fix residual mmio emulation request to userspace
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <[email protected]>
commit bbeac2830f4de270bb48141681cb730aadf8dce1 upstream.
Reported by syzkaller:
The kvm-intel.unrestricted_guest=0
WARNING: CPU: 5 PID: 1014 at /home/kernel/data/kvm/arch/x86/kvm//x86.c:7227 kvm_arch_vcpu_ioctl_run+0x38b/0x1be0 [kvm]
CPU: 5 PID: 1014 Comm: warn_test Tainted: G W OE 4.13.0-rc3+ #8
RIP: 0010:kvm_arch_vcpu_ioctl_run+0x38b/0x1be0 [kvm]
Call Trace:
? put_pid+0x3a/0x50
? rcu_read_lock_sched_held+0x79/0x80
? kmem_cache_free+0x2f2/0x350
kvm_vcpu_ioctl+0x340/0x700 [kvm]
? kvm_vcpu_ioctl+0x340/0x700 [kvm]
? __fget+0xfc/0x210
do_vfs_ioctl+0xa4/0x6a0
? __fget+0x11d/0x210
SyS_ioctl+0x79/0x90
entry_SYSCALL_64_fastpath+0x23/0xc2
? __this_cpu_preempt_check+0x13/0x20The syszkaller folks reported a residual mmio emulation request to userspace due to vm86 fails to emulate inject real mode interrupt(fails to read CS) and incurs a triple fault. The vCPU returns to userspace with vcpu->mmio_needed == true and KVM_EXIT_SHUTDOWN exit reason. However, the syszkaller testcase constructs several threads to launch the same vCPU, the thread which lauch this vCPU after the thread whichs get the vcpu->mmio_needed == true and KVM_EXIT_SHUTDOWN will trigger the warning.
#define _GNU_SOURCE #include <pthread.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/wait.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/mman.h> #include <fcntl.h> #include <unistd.h> #include <linux/kvm.h> #include <stdio.h>
int kvmcpu;
struct kvm_run *run;
void* thr(void* arg)
{
int res;
res = ioctl(kvmcpu, KVM_RUN, 0);
printf("ret1=%d exit_reason=%d suberror=%d\n",
res, run->exit_reason, run->internal.suberror);
return 0;
}
void test()
{
int i, kvm, kvmvm;
pthread_t th[4]; kvm = open("/dev/kvm", O_RDWR);
kvmvm = ioctl(kvm, KVM_CREATE_VM, 0);
kvmcpu = ioctl(kvmvm, KVM_CREATE_VCPU, 0);
run = (struct kvm_run*)mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, kvmcpu, 0);
srand(getpid());
for (i = 0; i < 4; i++) {
pthread_create(&th[i], 0, thr, 0);
usleep(rand() % 10000);
}
for (i = 0; i < 4; i++)
pthread_join(th[i], 0);}
int main()
{
for (;;) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
test();
exit(0);
}
int status;
while (waitpid(pid, &status, __WALL) != pid) {}
}
return 0;
}This patch fixes it by resetting the vcpu->mmio_needed once we receive the triple fault to avoid the residue.
--- arch/x86/kvm/vmx.c | 1 + arch/x86/kvm/x86.c | 1 + 2 files changed, 2 insertions(+)
arch/x86/kvm/vmx.c +1 -0
@@ -5574,6 +5574,7 @@ static int handle_external_interrupt(strstatic int handle_triple_fault (struct kvm_vcpu *vcpu) { vcpu->run->exit_reason =KVM_EXIT_SHUTDOWN ; + vcpu->mmio_needed =0 ;return 0 ; }
arch/x86/kvm/x86.c +1 -0
@@ -6478,6 +6478,7 @@ static int vcpu_enter_guest(struct kvm_v }if (kvm_check_request (KVM_REQ_TRIPLE_FAULT , vcpu)) { vcpu->run->exit_reason =KVM_EXIT_SHUTDOWN ; + vcpu->mmio_needed =0 ; r =0 ; goto out; }
stable-rc/linux-4.4.y boot: 42 boots: 3 failed, 39 passed (v4.4.176-231-g6926dee23fa0)
stable-rc/linux-4.4.y boot: 42 boots: 3 failed, 39 passed (v4.4.176-231-g6926dee23fa0)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.4.y/kernel/v4.4.176-231-g6926dee23fa0/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.176-231-g6926dee23fa0/
Tree: stable-rc
Branch: linux-4.4.y
Git Describe: v4.4.176-231-g6926dee23fa0
Git Commit: 6926dee23fa096361e7d170c7fa21a8b51eb7673
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 20 unique boards, 11 SoC families, 8 builds out of 190
Boot Regressions Detected:
arm:
multi_v7_defconfig:
gcc-7:
tegra124-nyan-big:
lab-collabora: failing since 24 days (last pass: v4.4.174-119-gf5fe3003919f - first fail: v4.4.176-30-ge577ed472fce)
tegra_defconfig:
gcc-7:
tegra124-nyan-big:
lab-collabora: failing since 24 days (last pass: v4.4.174-119-gf5fe3003919f - first fail: v4.4.176-30-ge577ed472fce)Boot Failures Detected:
arm:
multi_v7_defconfig:
gcc-7:
tegra124-nyan-big: 1 failed lab
tegra_defconfig:
gcc-7:
tegra124-nyan-big: 1 failed lab
arm64:
defconfig:
gcc-7:
qcom-qdf2400: 1 failed lab---
For more info write to <[email protected]>
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.177 release. There are 230 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 24 11:10:58 UTC 2019. Anything received after that time might be too late.
Build results:
total: 171 pass: 171 fail: 0 Qemu test results: total: 292 pass: 292 fail: 0
Guenter
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.177 release. There are 230 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 24 11:10:58 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.177-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.4.177-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: 6926dee23fa096361e7d170c7fa21a8b51eb7673
git describe: v4.4.176-231-g6926dee23fa0
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.4-oe/build/v4.4.176-231-g6926dee23fa0
No regressions (compared to build v4.4.176)
No fixes (compared to build v4.4.176)
Ran 17857 total tests in the following environments and test suites.
Environments
--------------
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* spectre-meltdown-checker-test
* install-android-platform-tools-r2600
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Summary
------------------------------------------------------------------------
kernel: 4.4.177-rc1
git repo: https://git.linaro.org/lkft/arm64-stable-rc.git
git branch: 4.4.177-rc1-hikey-20190322-403
git commit: aedc0057d8f3e9e59eea8f9ee59fa773bec7914b
git describe: 4.4.177-rc1-hikey-20190322-403
Test details: https://qa-reports.linaro.org/lkft/linaro-hikey-stable-rc-4.4-oe/build/4.4.177-rc1-hikey-20190322-403
No regressions (compared to build 4.4.177-rc1-hikey-20190321-402)
No fixes (compared to build 4.4.177-rc1-hikey-20190321-402)
Ran 3000 total tests in the following environments and test suites.
Environments
--------------
- hi6220-hikey - arm64
- qemu_arm64
Test Suites
-----------
* boot
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* spectre-meltdown-checker-test
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.177 release. There are 230 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 24 11:10:58 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.177-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Our daily builder has taken the weekend off unexpectedly and so I don't have a test report for this branch yet (although I was able to pull some reports for other branches) but I have given it a quick test myself and see no issues.
Cheers
Jon
Signature · 1 line
nvpublic