aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-03-08KVM: s390: correct fprs on SIGP (STOP AND) STORE STATUSDavid Hildenbrand1-1/+1
With MACHINE_HAS_VX, we convert the floating point registers from the vector registeres when storing the status. For other VCPUs, these are stored to vcpu->run->s.regs.vrs, but we are using current->thread.fpu.vxrs, which resolves to the currently loaded VCPU. So kvm_s390_store_status_unloaded() currently writes the wrong floating point registers (converted from the vector registers) when called from another VCPU on a z13. This is only the case for old user space not handling SIGP STORE STATUS and SIGP STOP AND STORE STATUS, but relying on the kernel implementation. All other calls come from the loaded VCPU via kvm_s390_store_status(). Fixes: 9abc2a08a7d6 (KVM: s390: fix memory overwrites when vx is disabled) Reviewed-by: Christian Borntraeger <[email protected]> Cc: [email protected] # v4.4+ Signed-off-by: David Hildenbrand <[email protected]> Signed-off-by: Christian Borntraeger <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
2016-03-08Merge branch 'kvm-ppc-fixes' of ↵Paolo Bonzini1-0/+14
git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD
2016-03-08KVM: VMX: disable PEBS before a guest entryRadim Krčmář1-0/+7
Linux guests on Haswell (and also SandyBridge and Broadwell, at least) would crash if you decided to run a host command that uses PEBS, like perf record -e 'cpu/mem-stores/pp' -a This happens because KVM is using VMX MSR switching to disable PEBS, but SDM [2015-12] 18.4.4.4 Re-configuring PEBS Facilities explains why it isn't safe: When software needs to reconfigure PEBS facilities, it should allow a quiescent period between stopping the prior event counting and setting up a new PEBS event. The quiescent period is to allow any latent residual PEBS records to complete its capture at their previously specified buffer address (provided by IA32_DS_AREA). There might not be a quiescent period after the MSR switch, so a CPU ends up using host's MSR_IA32_DS_AREA to access an area in guest's memory. (Or MSR switching is just buggy on some models.) The guest can learn something about the host this way: If the guest doesn't map address pointed by MSR_IA32_DS_AREA, it results in #PF where we leak host's MSR_IA32_DS_AREA through CR2. After that, a malicious guest can map and configure memory where MSR_IA32_DS_AREA is pointing and can therefore get an output from host's tracing. This is not a critical leak as the host must initiate with PEBS tracing and I have not been able to get a record from more than one instruction before vmentry in vmx_vcpu_run() (that place has most registers already overwritten with guest's). We could disable PEBS just few instructions before vmentry, but disabling it earlier shouldn't affect host tracing too much. We also don't need to switch MSR_IA32_PEBS_ENABLE on VMENTRY, but that optimization isn't worth its code, IMO. (If you are implementing PEBS for guests, be sure to handle the case where both host and guest enable PEBS, because this patch doesn't.) Fixes: 26a4f3c08de4 ("perf/x86: disable PEBS on a guest entry.") Cc: <[email protected]> Reported-by: Jiří Olša <[email protected]> Signed-off-by: Radim Krčmář <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
2016-03-08drm/atomic: Clean up update_connector_routing.Maarten Lankhorst1-13/+3
connector_state->crtc can no longer be unset by accident, so that check can be removed. The other code open-codes drm_atomic_get_existing_crtc_state, so use that. Signed-off-by: Maarten Lankhorst <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> [danvet: Resolve tiny conflict due to gcc warning fix on previous patch.] Signed-off-by: Daniel Vetter <[email protected]>
2016-03-08drm/atomic: Clean up steal_encoder, v2.Maarten Lankhorst1-21/+6
Now that only encoders can be stolen that are part of the state steal_encoder no longer needs to inspect all connectors, just those that are part of the atomic state. Changes since v1: - Change return value to void, can no longer fail. Signed-off-by: Maarten Lankhorst <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> [danvet: Appease gcc, reported by kbuild.] Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/1456996662-8704-7-git-send-email-maarten.lankhorst@linux.intel.com
2016-03-08drm/atomic: Handle encoder assignment conflicts in a separate check, v3.Maarten Lankhorst1-34/+43
The current check doesn't handle the case where we don't steal an encoder, but keep it on the current connector. If we repurpose disable_conflicting_encoders to do the checking, we just have to reject the ones that conflict. Changes since v1: - Return early with empty encoder_mask, drm_for_each_connector requires connection_mutex held. Changes since v2: - Add comments for the loops. Signed-off-by: Maarten Lankhorst <[email protected]> Testcase: kms_setmode.invalid-clone-single-crtc-stealing Reviewed-by: Ville Syrjälä <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/1456996662-8704-6-git-send-email-maarten.lankhorst@linux.intel.com
2016-03-08drm/atomic: Handle encoder stealing from set_config better.Maarten Lankhorst2-0/+71
Instead of failing with -EINVAL when conflicting encoders are found, the legacy set_config will disable other connectors when encoders conflict. With the previous commit this becomes a lot easier to implement. set_config only adds connectors to the state that are modified, and because of the previous commit that calls add_affected_connectors only on set->crtc it means any connector not part of the modeset can be stolen from. We disable the connector in that case, and possibly the crtc if required. Atomic modeset itself still doesn't allow encoder stealing, the results would be too unpredictable. Signed-off-by: Maarten Lankhorst <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/1456996662-8704-5-git-send-email-maarten.lankhorst@linux.intel.com
2016-03-08drm/atomic: Always call steal_encoder, v2.Maarten Lankhorst1-54/+20
There's no need to have a separate function to get the crtc which is stolen, this can already be found when actually stealing the encoder. drm_for_each_connector already checks for connection_mutex, so use that macro now. Changes since v1: - Do not check for NULL crtc in connector_state, this may happen when a crtc is disabled and its encoder stolen. - Because of this, use connector->state->crtc instead of conn_state->crtc. Signed-off-by: Maarten Lankhorst <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/1456996662-8704-4-git-send-email-maarten.lankhorst@linux.intel.com
2016-03-08s390/cpumf: Fix lpp detectionChristian Borntraeger1-1/+1
we have to check bit 40 of the facility list before issuing LPP and not bit 48. Otherwise a guest running on a system with "The decimal-floating-point zoned-conversion facility" and without the "The set-program-parameters facility" might crash on an lpp instruction. Signed-off-by: Christian Borntraeger <[email protected]> Cc: [email protected] # v4.4+ Fixes: e22cf8ca6f75 ("s390/cpumf: rework program parameter setting to detect guest samples") Signed-off-by: Martin Schwidefsky <[email protected]>
2016-03-07jffs2: reduce the breakage on recovery from halfway failed rename()Al Viro1-3/+8
d_instantiate(new_dentry, old_inode) is absolutely wrong thing to do - it will oops if new_dentry used to be positive, for starters. What we need is d_invalidate() the target and be done with that. Cc: [email protected] # v3.18+ Signed-off-by: Al Viro <[email protected]>
2016-03-07ncpfs: fix a braino in OOM handling in ncp_fill_cache()Al Viro1-1/+1
Failing to allocate an inode for child means that cache for *parent* is incompletely populated. So it's parent directory inode ('dir') that needs NCPI_DIR_CACHE flag removed, *not* the child inode ('inode', which is what we'd failed to allocate in the first place). Fucked-up-in: commit 5e993e25 ("ncpfs: get rid of d_validate() nonsense") Fucked-up-by: Al Viro <[email protected]> Cc: [email protected] # v3.19 Signed-off-by: Al Viro <[email protected]>
2016-03-08KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exitPaul Mackerras1-0/+14
Thomas Huth discovered that a guest could cause a hard hang of a host CPU by setting the Instruction Authority Mask Register (IAMR) to a suitable value. It turns out that this is because when the code was added to context-switch the new special-purpose registers (SPRs) that were added in POWER8, we forgot to add code to ensure that they were restored to a sane value on guest exit. This adds code to set those registers where a bad value could compromise the execution of the host kernel to a suitable neutral value on guest exit. Cc: [email protected] # v3.14+ Fixes: b005255e12a3 Reported-by: Thomas Huth <[email protected]> Reviewed-by: David Gibson <[email protected]> Signed-off-by: Paul Mackerras <[email protected]>
2016-03-08drm/i2c: tda998x: Choose between atomic or non atomic dpms helperJyri Sarha1-1/+9
Choose between atomic or non atomic connector dpms helper. If tda998x is connected to a drm driver that does not support atomic modeset calling drm_atomic_helper_connector_dpms() causes a crash when the connectors atomic state is not initialized. The patch implements a driver specific connector dpms helper that calls drm_atomic_helper_connector_dpms() if driver supports DRIVER_ATOMIC and otherwise it calls the legacy drm_helper_connector_dpms(). Fixes commit 9736e988d328 ("drm/i2c: tda998x: Add support for atomic modesetting"). Signed-off-by: Jyri Sarha <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2016-03-08drm/vmwgfx: Add back ->detect() and ->fill_modes()Thierry Reding1-0/+2
This partially reverts commit d56f57ac969c ("drm/gma500: Move to private save/restore hooks") which removed these lines by mistake. Reported-by: Sebastian Herbszt <[email protected]> Acked-by: Daniel Vetter <[email protected]> Signed-off-by: Thierry Reding <[email protected]> Tested-by: Thomas Hellstrom <[email protected]> Tested-by: Sebastian Herbszt <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2016-03-08Merge branch 'drm-next-4.6' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie18-121/+131
into drm-next Some more radeon and amdgpu stuff for drm-next. Mostly just bug fixes for new features and cleanups. * 'drm-next-4.6' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: fix rb bitmap & cu bitmap calculation drm/amdgpu: trace the pd_addr in vm_grab_id as well drm/amdgpu: fix VM faults caused by vm_grab_id() v4 drm/amdgpu: update radeon acpi header drm/radeon: update radeon acpi header drm/amd: cleanup get_mfd_cell_dev() drm/amdgpu: fix error handling in amdgpu_bo_list_set drm/amd/powerplay: fix code style warning. drm/amd: Do not make DRM_AMD_ACP default to y drm/amdgpu/gfx: fix off by one in rb rework (v2)
2016-03-08Merge branch 'drm-etnaviv-next' of git://git.pengutronix.de/git/lst/linux ↵Dave Airlie9-159/+239
into drm-next Notable changes: - correctness fixes to the GPU cache flushing when switching execution state and when powering down the GPU - reduction of time spent in hardirq-off context - placement improvements to the GPU DMA linear window, allowing the driver to properly work on i.MX6 systems with more than 2GB of RAM * 'drm-etnaviv-next' of git://git.pengutronix.de/git/lst/linux: drm: etnaviv: clean up submit_bo() drm: etnaviv: clean up vram_mapping submission/retire path drm: etnaviv: improve readability of command insertion to ring buffer drm: etnaviv: clean up GPU command submission drm: etnaviv: use previous GPU pipe state when pipe switching drm: etnaviv: flush all GPU caches when stopping GPU drm: etnaviv: track current execution state drm: etnaviv: extract arming of semaphore drm: etnaviv: extract replacement of WAIT command drm: etnaviv: extract command ring reservation drm/etnaviv: move GPU linear window to end of DMA window drm/etnaviv: move runtime PM balance into retire worker
2016-03-08Merge tag 'drm-intel-next-2016-02-29' of ↵Dave Airlie42-610/+930
git://anongit.freedesktop.org/drm-intel into drm-next - fbc by default on hsw&bdw, thanks to great work by Paulo! - psr by default hsw,bdw,vlv&chv, thanks to great work by Rodrigo! - fixes to hw state readout vs. rpm issues (Imre) - dc3 fixes&improvements (Mika), this and above already cherr-pick to -fixes - first part of locking fixes from Tvrtko - proper atomic code for load detect (Maarten) - more rpm fixes from Ville - more atomic work from Maarten * tag 'drm-intel-next-2016-02-29' of git://anongit.freedesktop.org/drm-intel: (63 commits) drm/i915: Update DRIVER_DATE to 20160229 drm/i915: Execlists cannot pin a context without the object drm/i915: Reduce the pointer dance of i915_is_ggtt() drm/i915: Rename vma->*_list to *_link for consistency drm/i915: Balance assert_rpm_wakelock_held() for !IS_ENABLED(CONFIG_PM) drm/i915/lrc: Only set RS ctx enable in ctx control reg if there is a RS drm/i915/gen9: Set value of Indirect Context Offset based on gen version drm/i915: Remove update_sprite_watermarks. drm/i915: Kill off intel_crtc->atomic.wait_vblank, v6. drm/i915: Unify power domain handling. drm/i915: Pass crtc state to modeset_get_crtc_power_domains. drm/i915: Add for_each_pipe_masked() drm/i915: Make sure pipe interrupts are processed before turning off power well on BDW+ drm/i915: synchronize_irq() before turning off disp2d power well on VLV/CHV drm/i915: Skip PIPESTAT reads from irq handler on VLV/CHV when power well is down drm/i915/gen9: Write dc state debugmask bits only once drm/i915/gen9: Extend dmc debug mask to include cores drm/i915/gen9: Verify and enforce dc6 state writes drm/i915/gen9: Check for DC state mismatch drm/i915/fbc: enable FBC by default on HSW and BDW ...
2016-03-08Merge tag 'tilcdc-4.6' of https://github.com/jsarha/linux into drm-nextDave Airlie5-192/+300
tilcdc changes for v4.6 Accumulated fixes and improvements from ti-linux-4.1. * Almost complete rewrite of pagefliping code * dma-buf support * pinctrl support * lot of fixes and cleanups * tag 'tilcdc-4.6' of https://github.com/jsarha/linux: (22 commits) drm/tilcdc: Use devm_kzalloc() and devm_kcalloc() for private data drm/tilcdc: Initialize crtc->port drm/tilcdc: Disable sync lost interrupt if it fires on every frame drm/tilcdc: Add prints on sync lost and FIFO underrun interrupts drm/tilcdc: Remove the duplicate LCDC_INT_ENABLE_SET_REG in registers[] drm/tilcdc: Fix interrupt enable/disable code for version 2 tilcdc drm/tilcdc: Do not update the next frame buffer close to vertical blank drm/tilcdc: Get rid of complex ping-pong mechanism drm/tilcdc: cleanup irq handling drm/tilcdc: remove broken error handling drm/tilcdc: split reset to a separate function drm/tilcdc: disable crtc on unload drm/tilcdc: cleanup runtime PM handling drm/tilcdc: Allocate register storage based on the actual number registers drm/tilcdc: fix build error when !CONFIG_CPU_FREQ drm/tilcdc: Implement dma-buf support for tilcdc drm/tilcdc: disable the lcd controller/dma engine when suspend invoked drm/tilcdc: make frame_done interrupt active at all times drm/tilcdc: fix kernel panic on suspend when no hdmi monitor connected drm/tilcdc: adopt pinctrl support ...
2016-03-07Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds101-399/+783
Pull networking fixes from David Miller: 1) Fix ordering of WEXT netlink messages so we don't see a newlink after a dellink, from Johannes Berg. 2) Out of bounds access in minstrel_ht_set_best_prob_rage, from Konstantin Khlebnikov. 3) Paging buffer memory leak in iwlwifi, from Matti Gottlieb. 4) Wrong units used to set initial TCP rto from cached metrics, also from Konstantin Khlebnikov. 5) Fix stale IP options data in the SKB control block from leaking through layers of encapsulation, from Bernie Harris. 6) Zero padding len miscalculated in bnxt_en, from Michael Chan. 7) Only CHECKSUM_PARTIAL packets should be passed down through GSO, fix from Hannes Frederic Sowa. 8) Fix suspend/resume with JME networking devices, from Diego Violat and Guo-Fu Tseng. 9) Checksums not validated properly in bridge multicast support due to the placement of the SKB header pointers at the time of the check, fix from Álvaro Fernández Rojas. 10) Fix hang/tiemout with r8169 if a stats fetch is done while the device is runtime suspended. From Chun-Hao Lin. 11) The forwarding database netlink dump facilities don't track the state of the dump properly, resulting in skipped/missed entries. From Minoura Makoto. 12) Fix regression from a recent 3c59x bug fix, from Neil Horman. 13) Fix list corruption in bna driver, from Ivan Vecera. 14) Big endian machines crash on vlan add in bnx2x, fix from Michal Schmidt. 15) Ethtool RSS configuration not propagated properly in mlx5 driver, from Tariq Toukan. 16) Fix regression in PHY probing in stmmac driver, from Gabriel Fernandez. 17) Fix SKB tailroom calculation in igmp/mld code, from Benjamin Poirier. 18) A past change to skip empty routing headers in ipv6 extention header parsing accidently caused fragment headers to not be matched any longer. Fix from Florian Westphal. 19) eTSEC-106 erratum needs to be applied to more gianfar chips, from Atsushi Nemoto. 20) Fix netdev reference after free via workqueues in usb networking drivers, from Oliver Neukum and Bjørn Mork. 21) mdio->irq is now an array rather than a pointer to dynamic memory, but several drivers were still trying to free it :-/ Fixes from Colin Ian King. 22) act_ipt iptables action forgets to set the family field, thus LOG netfilter targets don't work with it. Fix from Phil Sutter. 23) SKB leak in ibmveth when skb_linearize() fails, from Thomas Falcon. 24) pskb_may_pull() cannot be called with interrupts disabled, fix code that tries to do this in vmxnet3 driver, from Neil Horman. 25) be2net driver leaks iomap'd memory on removal, fix from Douglas Miller. 26) Forgotton RTNL mutex unlock in ppp_create_interface() error paths, from Guillaume Nault. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (97 commits) ppp: release rtnl mutex when interface creation fails cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind tcp: fix tcpi_segs_in after connection establishment net: hns: fix the bug about loopback jme: Fix device PM wakeup API usage jme: Do not enable NIC WoL functions on S0 udp6: fix UDP/IPv6 encap resubmit path be2net: Don't leak iomapped memory on removal. vmxnet3: avoid calling pskb_may_pull with interrupts disabled net: ethernet: Add missing MFD_SYSCON dependency on HAS_IOMEM ibmveth: check return of skb_linearize in ibmveth_start_xmit cdc_ncm: toggle altsetting to force reset before setup usbnet: cleanup after bind() in probe() mlxsw: pci: Correctly determine if descriptor queue is full mlxsw: spectrum: Always decrement bridge's ref count tipc: fix nullptr crash during subscription cancel net: eth: altera: do not free array priv->mdio->irq net/ethoc: do not free array priv->mdio->irq net: sched: fix act_ipt for LOG target asix: do not free array priv->mdio->irq ...
2016-03-07Merge branch 'overlayfs-linus' of ↵Linus Torvalds3-6/+19
git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fixes from Miklos Szeredi: "Overlayfs bug fixes. All marked as -stable material" * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: copy new uid/gid into overlayfs runtime inode ovl: ignore lower entries when checking purity of non-directory entries ovl: fix getcwd() failure after unsuccessful rmdir ovl: fix working on distributed fs as lower layer
2016-03-07Revert "drm/radeon: call hpd_irq_event on resume"Linus Torvalds1-1/+0
This reverts commit dbb17a21c131eca94eb31136eee9a7fe5aff00d9. It turns out that commit can cause problems for systems with multiple GPUs, and causes X to hang on at least a HP Pavilion dv7 with hybrid graphics. This got noticed originally in 4.4.4, where this patch had already gotten back-ported, but 4.5-rc7 was verified to have the same problem. Alexander Deucher says: "It looks like you have a muxed system so I suspect what's happening is that one of the display is being reported as connected for both the IGP and the dGPU and then the desktop environment gets confused or there some sort problem in the detect functions since the mux is not switched to the dGPU. I don't see an easy fix unless Dave has any ideas. I'd say just revert for now" Reported-by: Jörg-Volker Peetz <[email protected]> Acked-by: Alexander Deucher <[email protected]> Cc: Dave Airlie <[email protected]> Cc: [email protected] # wherever dbb17a21c131 got back-ported Signed-off-by: Linus Torvalds <[email protected]>
2016-03-07ppp: release rtnl mutex when interface creation failsGuillaume Nault1-0/+1
Add missing rtnl_unlock() in the error path of ppp_create_interface(). Fixes: 58a89ecaca53 ("ppp: fix lockdep splat in ppp_dev_uninit()") Signed-off-by: Guillaume Nault <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07cdc_ncm: do not call usbnet_link_change from cdc_ncm_bindBjørn Mork1-15/+5
usbnet_link_change will call schedule_work and should be avoided if bind is failing. Otherwise we will end up with scheduled work referring to a netdev which has gone away. Instead of making the call conditional, we can just defer it to usbnet_probe, using the driver_info flag made for this purpose. Fixes: 8a34b0ae8778 ("usbnet: cdc_ncm: apply usbnet_link_change") Reported-by: Andrey Konovalov <[email protected]> Suggested-by: Linus Torvalds <[email protected]> Signed-off-by: Bjørn Mork <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07tcp: fix tcpi_segs_in after connection establishmentEric Dumazet1-1/+2
If final packet (ACK) of 3WHS is lost, it appears we do not properly account the following incoming segment into tcpi_segs_in While we are at it, starts segs_in with one, to count the SYN packet. We do not yet count number of SYN we received for a request sock, we might add this someday. packetdrill script showing proper behavior after fix : // Tests tcpi_segs_in when 3rd packet (ACK) of 3WHS is lost 0.000 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1) = 0 +0 < S 0:0(0) win 32792 <mss 1000,sackOK,nop,nop> +0 > S. 0:0(0) ack 1 <mss 1460,nop,nop,sackOK> +.020 < P. 1:1001(1000) ack 1 win 32792 +0 accept(3, ..., ...) = 4 +.000 %{ assert tcpi_segs_in == 2, 'tcpi_segs_in=%d' % tcpi_segs_in }% Fixes: 2efd055c53c06 ("tcp: add tcpi_segs_in and tcpi_segs_out to tcp_info") Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07net: hns: fix the bug about loopbackyankejian5-1/+65
It will always be passed if the soc is tested the loopback cases. This patch will fix this bug. Signed-off-by: Kejian Yan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07jme: Fix device PM wakeup API usageGuo-Fu Tseng1-4/+2
According to Documentation/power/devices.txt The driver should not use device_set_wakeup_enable() which is the policy for user to decide. Using device_init_wakeup() to initialize dev->power.should_wakeup and dev->power.can_wakeup on driver initialization. And use device_may_wakeup() on suspend to decide if WoL function should be enabled on NIC. Reported-by: Diego Viola <[email protected]> Signed-off-by: Guo-Fu Tseng <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07jme: Do not enable NIC WoL functions on S0Guo-Fu Tseng1-6/+11
Otherwise it might be back on resume right after going to suspend in some hardware. Reported-by: Diego Viola <[email protected]> Signed-off-by: Guo-Fu Tseng <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr()Krzysztof =?utf-8?Q?Ha=C5=82asa?=1-1/+3
pci_create_root_bus() passes a "parent" pointer to pci_bus_assign_domain_nr(). When CONFIG_PCI_DOMAINS_GENERIC is defined, pci_bus_assign_domain_nr() dereferences that pointer. Many callers of pci_create_root_bus() supply a NULL "parent" pointer, which leads to a NULL pointer dereference error. 7c674700098c ("PCI: Move domain assignment from arm64 to generic code") moved the "parent" dereference from arm64 to generic code. Only arm64 used that code (because only arm64 defined CONFIG_PCI_DOMAINS_GENERIC), and it always supplied a valid "parent" pointer. Other arches supplied NULL "parent" pointers but didn't defined CONFIG_PCI_DOMAINS_GENERIC, so they used a no-op version of pci_bus_assign_domain_nr(). 8c7d14746abc ("ARM/PCI: Move to generic PCI domains") defined CONFIG_PCI_DOMAINS_GENERIC on ARM, and many ARM platforms use pci_common_init(), which supplies a NULL "parent" pointer. These platforms (cns3xxx, dove, footbridge, iop13xx, etc.) crash with a NULL pointer dereference like this while probing PCI: Unable to handle kernel NULL pointer dereference at virtual address 000000a4 PC is at pci_bus_assign_domain_nr+0x10/0x84 LR is at pci_create_root_bus+0x48/0x2e4 Kernel panic - not syncing: Attempted to kill init! [bhelgaas: changelog, add "Reported:" and "Fixes:" tags] Reported: http://forum.doozan.com/read.php?2,17868,22070,quote=1 Fixes: 8c7d14746abc ("ARM/PCI: Move to generic PCI domains") Fixes: 7c674700098c ("PCI: Move domain assignment from arm64 to generic code") Signed-off-by: Krzysztof Hałasa <[email protected]> Signed-off-by: Bjorn Helgaas <[email protected]> Acked-by: Lorenzo Pieralisi <[email protected]> CC: [email protected] # v4.0+
2016-03-07udp6: fix UDP/IPv6 encap resubmit pathBill Sommerfeld1-4/+2
IPv4 interprets a negative return value from a protocol handler as a request to redispatch to a new protocol. In contrast, IPv6 interprets a negative value as an error, and interprets a positive value as a request for redispatch. UDP for IPv6 was unaware of this difference. Change __udp6_lib_rcv() to return a positive value for redispatch. Note that the socket's encap_rcv hook still needs to return a negative value to request dispatch, and in the case of IPv6 packets, adjust IP6CB(skb)->nhoff to identify the byte containing the next protocol. Signed-off-by: Bill Sommerfeld <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07be2net: Don't leak iomapped memory on removal.Douglas Miller2-0/+5
The adapter->pcicfg resource is either mapped via pci_iomap() or derived from adapter->db. During be_remove() this resource was ignored and so could remain mapped after remove. Add a flag to track whether adapter->pcicfg was mapped or not, then use that flag in be_unmap_pci_bars() to unmap if required. Fixes: 25848c901 ("use PCI MMIO read instead of config read for errors") Signed-off-by: Douglas Miller <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07vmxnet3: avoid calling pskb_may_pull with interrupts disabledNeil Horman1-27/+46
vmxnet3 has a function vmxnet3_parse_and_copy_hdr which, among other operations, uses pskb_may_pull to linearize the header portion of an skb. That operation eventually uses local_bh_disable/enable to ensure that it doesn't race with the drivers bottom half handler. Unfortunately, vmxnet3 preforms this parse_and_copy operation with a spinlock held and interrupts disabled. This causes us to run afoul of the WARN_ON_ONCE(irqs_disabled()) warning in local_bh_enable, resulting in this: WARNING: at kernel/softirq.c:159 local_bh_enable+0x59/0x90() (Not tainted) Hardware name: VMware Virtual Platform Modules linked in: ipv6 ppdev parport_pc parport microcode e1000 vmware_balloon vmxnet3 i2c_piix4 sg ext4 jbd2 mbcache sd_mod crc_t10dif sr_mod cdrom mptspi mptscsih mptbase scsi_transport_spi pata_acpi ata_generic ata_piix vmwgfx ttm drm_kms_helper drm i2c_core dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mperf] Pid: 6229, comm: sshd Not tainted 2.6.32-616.el6.i686 #1 Call Trace: [<c04624d9>] ? warn_slowpath_common+0x89/0xe0 [<c0469e99>] ? local_bh_enable+0x59/0x90 [<c046254b>] ? warn_slowpath_null+0x1b/0x20 [<c0469e99>] ? local_bh_enable+0x59/0x90 [<c07bb936>] ? skb_copy_bits+0x126/0x210 [<f8d1d9fe>] ? ext4_ext_find_extent+0x24e/0x2d0 [ext4] [<c07bc49e>] ? __pskb_pull_tail+0x6e/0x2b0 [<f95a6164>] ? vmxnet3_xmit_frame+0xba4/0xef0 [vmxnet3] [<c05d15a6>] ? selinux_ip_postroute+0x56/0x320 [<c0615988>] ? cfq_add_rq_rb+0x98/0x110 [<c0852df8>] ? packet_rcv+0x48/0x350 [<c07c5839>] ? dev_queue_xmit_nit+0xc9/0x140 ... Fix it by splitting vmxnet3_parse_and_copy_hdr into two functions: vmxnet3_parse_hdr, which sets up the internal/on stack ctx datastructure, and pulls the skb (both of which can be done without holding the spinlock with irqs disabled and vmxnet3_copy_header, which just copies the skb to the tx ring under the lock safely. tested and shown to correct the described problem. Applies cleanly to the head of the net tree Signed-off-by: Neil Horman <[email protected]> CC: Shrikrishna Khare <[email protected]> CC: "VMware, Inc." <[email protected]> CC: "David S. Miller" <[email protected]> Acked-by: Shrikrishna Khare <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07Merge tag 'wireless-drivers-for-davem-2016-03-04' of ↵David S. Miller5-1/+18
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.5 iwlwifi * free firmware paging memory when the module is unloaded or device removed * fix pending frames counter to fix an issue when removing stations ssb * fix a build problem related to ssb_fill_sprom_with_fallback() ==================== Signed-off-by: David S. Miller <[email protected]>
2016-03-07net: ethernet: Add missing MFD_SYSCON dependency on HAS_IOMEMKrzysztof Kozlowski1-0/+1
The MFD_SYSCON depends on HAS_IOMEM so when selecting it avoid unmet direct dependencies. Signed-off-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07ibmveth: check return of skb_linearize in ibmveth_start_xmitThomas Falcon1-1/+4
If skb_linearize fails, the driver should drop the packet instead of trying to copy it into the bounce buffer. Signed-off-by: Thomas Falcon <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07cdc_ncm: toggle altsetting to force reset before setupBjørn Mork1-1/+5
Some devices will silently fail setup unless they are reset first. This is necessary even if the data interface is already in altsetting 0, which it will be when the device is probed for the first time. Briefly toggling the altsetting forces a function reset regardless of the initial state. This fixes a setup problem observed on a number of Huawei devices, appearing to operate in NTB-32 mode even if we explicitly set them to NTB-16 mode. Signed-off-by: Bjørn Mork <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07EDAC, sb_edac: Fix logic when computing DIMM sizes on Xeon PhiHubert Chrzaniuk1-1/+1
Correct a typo introduced by d0cdf9003140 ("EDAC, sb_edac: Add Knights Landing (Xeon Phi gen 2) support") As a result under some configurations DIMMs were not correctly recognized. Problem affects only Xeon Phi architecture. Signed-off-by: Hubert Chrzaniuk <[email protected]> Acked-by: Aristeu Rozanski <[email protected]> Cc: Mauro Carvalho Chehab <[email protected]> Cc: linux-edac <[email protected]> Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Borislav Petkov <[email protected]>
2016-03-07drm/i915: Fix bogus dig_port_map[] assignment for pre-HSWTakashi Iwai4-4/+3
The recent commit [0bdf5a05647a: drm/i915: Add reverse mapping between port and intel_encoder] introduced a reverse mapping to retrieve intel_dig_port object from the port number. The code assumed that the port vs intel_dig_port are 1:1 mapping. But in reality, this was a too naive assumption. As Martin reported about the missing HDMI audio on his SNB machine, pre-HSW chips may have multiple intel_dig_port objects corresponding to the same port. Since we assign the mapping statically at the init time and the multiple objects override the map, it may not match with the actually enabled output. This patch tries to address the regression above. The reverse mapping is provided basically only for the audio callbacks, so now we set / clear the mapping dynamically at enabling and disabling HDMI/DP audio, so that we can always track the latest and correct object corresponding to the given port. Fixes: 0bdf5a05647a ('drm/i915: Add reverse mapping between port and intel_encoder') Reported-and-tested-by: Martin Kepplinger <[email protected]> Cc: [email protected] Signed-off-by: Takashi Iwai <[email protected]> Reviewed-by: Ville Syrjälä <[email protected]> Tested-by: Martin Kepplinger <[email protected]> Signed-off-by: Jani Nikula <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] (cherry picked from commit 9dfbffcf4ac0707097af9e6c1372192b9d03a357) Signed-off-by: Jani Nikula <[email protected]>
2016-03-07usbnet: cleanup after bind() in probe()Oliver Neukum1-0/+7
In case bind() works, but a later error forces bailing in probe() in error cases work and a timer may be scheduled. They must be killed. This fixes an error case related to the double free reported in http://www.spinics.net/lists/netdev/msg367669.html and needs to go on top of Linus' fix to cdc-ncm. Signed-off-by: Oliver Neukum <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07Merge branch 'mlxsw-fixes'David S. Miller2-4/+2
Jiri Pirko says: ==================== mlxsw: couple of fixes Couple of fixes from Ido. ==================== Signed-off-by: David S. Miller <[email protected]>
2016-03-07mlxsw: pci: Correctly determine if descriptor queue is fullIdo Schimmel1-1/+1
The descriptor queues for sending (SDQs) and receiving (RDQs) packets are managed by two counters - producer and consumer - which are both 16-bit in size. A queue is considered full when the difference between the two equals the queue's maximum number of descriptors. However, if the producer counter overflows, then it's possible for the full queue check to fail, as it doesn't take the overflow into account. In such a case, descriptors already passed to the device - but for which a completion has yet to be posted - will be overwritten, thereby causing undefined behavior. The above can be achieved under heavy load (~30 netperf instances). Fix that by casting the subtraction result to u16, preventing it from being treated as a signed integer. Fixes: eda6500a987a ("mlxsw: Add PCI bus implementation") Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07mlxsw: spectrum: Always decrement bridge's ref countIdo Schimmel1-3/+1
Since we only support one VLAN filtering bridge we need to associate a reference count with it, so that when the last port netdev leaves it, we would know that a different bridge can be offloaded to hardware. When a LAG device is memeber in a bridge and port netdevs are leaving the LAG, we should always decrement the bridge's reference count, as it's incremented for any port in the LAG. Fixes: 4dc236c31733 ("mlxsw: spectrum: Handle port leaving LAG while bridged") Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-03-07drm: etnaviv: clean up submit_bo()Russell King2-19/+14
As we now store the etnaviv_vram_mapping, we no longer need to store the iova itself: we can get this directly from the mapping structure. Arrange for submit_bo() to return a pointer to etnaviv_gem_submit_bo, and directly access mapping->iova when applying relocations. Signed-off-by: Russell King <[email protected]> Signed-off-by: Lucas Stach <[email protected]>
2016-03-07drm: etnaviv: clean up vram_mapping submission/retire pathRussell King7-43/+57
Currently, we scan the list of mappings each time we want to operate on the vram_mapping struct. Rather than repeatedly scanning these, look them up once in the submission path, and then use _reference and _unreference methods as necessary to manage this object. Signed-off-by: Russell King <[email protected]> Signed-off-by: Lucas Stach <[email protected]>
2016-03-07drm: etnaviv: improve readability of command insertion to ring bufferRussell King1-46/+49
Improve the readibility of the function which inserts command buffers and other maintanence commands into the GPUs ring buffer. We do this by splitting the ring buffer reservation in two: one chunk for any commands that need to be issued prior to the command buffer, and a separate chunk for commands issued after the buffer. The result is a much more obvious code flow in this function, and localisation of the conditional maintanence commands prior to the command buffer. Signed-off-by: Russell King <[email protected]> Signed-off-by: Lucas Stach <[email protected]>
2016-03-07drm: etnaviv: clean up GPU command submissionRussell King1-8/+9
Clean up the GPU command submission path to prepare for the next change. This makes the next change easier to read and understand. Signed-off-by: Russell King <[email protected]> Signed-off-by: Lucas Stach <[email protected]>
2016-03-07drm: etnaviv: use previous GPU pipe state when pipe switchingRussell King1-6/+7
Use the previous GPU pipe state when deciding which GPU caches should be flushed prior to switching the current pipe. This avoids infering what the previously selected pipe was, and potentially flushing the wrong caches. Signed-off-by: Russell King <[email protected]> Signed-off-by: Lucas Stach <[email protected]>
2016-03-07drm: etnaviv: flush all GPU caches when stopping GPURussell King2-5/+45
Flush the GPU caches to ensure that any dirty data is pushed out before stopping the front end. Signed-off-by: Russell King <[email protected]> Signed-off-by: Lucas Stach <[email protected]>
2016-03-07drm: etnaviv: track current execution stateRussell King3-0/+5
Add tracking of the current execution state (iow, active GPU pipe). Signed-off-by: Russell King <[email protected]> Signed-off-by: Lucas Stach <[email protected]>
2016-03-07drm: etnaviv: extract arming of semaphoreRussell King1-6/+8
Extract out the arming of a semaphore from the pipe select code. Signed-off-by: Russell King <[email protected]> Signed-off-by: Lucas Stach <[email protected]>
2016-03-07drm: etnaviv: extract replacement of WAIT commandRussell King1-9/+23
Extract out the replacement of the WAIT command with some other command. Signed-off-by: Russell King <[email protected]> Signed-off-by: Lucas Stach <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.