aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-12-22drm/i915: mdelay(10) considered harmfulDaniel Vetter1-1/+1
I missed this myself when reviewing commit 237ed86c693d8a8e4db476976aeb30df4deac74b Author: Sonika Jindal <[email protected]> Date: Tue Sep 15 09:44:20 2015 +0530 drm/i915: Check live status before reading edid Long sleeps like this really shouldn't waste cpu cycles spinning. Cc: Sonika Jindal <[email protected]> Cc: "Wang, Gary C" <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] Reviewed-by: Sonika Jindal <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> (cherry picked from commit 71a199bacb398ee54eeac001699257dda083a455) Signed-off-by: Jani Nikula <[email protected]>
2015-12-22drm/i915: Kill intel_crtc->cursor_boVille Syrjälä2-6/+0
The vma may have been rebound between the last time the cursor was enabled and now, so skipping the cursor gtt offset deduction is not safe unless we would also reset cursor_bo to NULL when disabling the cursor. Just thow cursor_bo to the bin instead since it's lost all other uses thanks to universal plane support. Chris pointed out that cursor updates are currently too slow via universal planes that micro optimizations like these wouldn't even help. v2: Add a note about futility of micro optimizations (Chris) Cc: [email protected] References: http://lists.freedesktop.org/archives/intel-gfx/2015-December/082976.html Cc: Chris Wilson <[email protected]> Cc: Takashi Iwai <[email protected]> Cc: Jani Nikula <[email protected]> Signed-off-by: Ville Syrjälä <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] Reviewed-by: Chris Wilson <[email protected]> (cherry picked from commit 1264859d648c4bdc9f0a098efbff90cbf462a075) Signed-off-by: Jani Nikula <[email protected]>
2015-12-22MIPS: uaccess: Take EVA into account in [__]clear_userJames Hogan3-10/+26
__clear_user() (and clear_user() which uses it), always access the user mode address space, which results in EVA store instructions when EVA is enabled even if the current user address limit is KERNEL_DS. Fix this by adding a new symbol __bzero_kernel for the normal kernel address space bzero in EVA mode, and call that from __clear_user() if eva_kernel_access(). Signed-off-by: James Hogan <[email protected]> Cc: Markos Chandras <[email protected]> Cc: Paul Burton <[email protected]> Cc: Leonid Yegoshin <[email protected]> Cc: [email protected] Patchwork: https://patchwork.linux-mips.org/patch/10844/ Signed-off-by: Ralf Baechle <[email protected]>
2015-12-22drm/i915: Workaround CHV pipe C cursor failVille Syrjälä1-0/+17
Turns out CHV pipe C was glued on somewhat poorly, and there's something wrong with the cursor. If the cursor straddles the left screen edge, and is then moved away from the edge or disabled, the pipe will often underrun. If enough underruns are triggered quickly enough the pipe will fall over and die (it just scans out a solid color and reports a constant underrun). We need to turn the disp2d power well off and on again to recover the pipe. None of that is very nice for the user, so let's just refuse to place the cursor in the compromised position. The ddx appears to fall back to swcursor when the ioctl returns an error, so theoretically there's no loss of functionality for the user (discounting swcursor bugs). I suppose most cursors images actually have the hotspot not exactly at 0,0 so under typical conditions the fallback will in fact kick in as soon as the cursor touches the left edge of the screen. Any atomic compositor should anyway be prepared to fall back to GPU composition when things don't work out, so there should be no problem with those. Other things that I tried to solve this include flipping all display related clock gating knobs I could find, increasing the minimum gtt alignment all the way up to 512k. I also tried to see if there are more specific screen coordinates that hit the bug, but the findings were somewhat inconclusive. Sometimes the failures happen almost across the whole left edge, sometimes more at the very top and around the bottom half. I wasn't able to find any real pattern to these variations, so it seems our only choice is to just refuse to straddle the left screen edge at all. Cc: [email protected] Cc: Jason Plum <[email protected]> Testcase: igt/kms_chv_cursor_fail Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92826 Signed-off-by: Ville Syrjälä <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] Signed-off-by: Daniel Vetter <[email protected]> (cherry picked from commit b29ec92c4f5e6d45d8bae8194e664427a01c6687) Signed-off-by: Jani Nikula <[email protected]>
2015-12-22drm/i915: Only spin whilst waiting on the current requestChris Wilson2-9/+26
Limit busywaiting only to the request currently being processed by the GPU. If the request is not currently being processed by the GPU, there is a very low likelihood of it being completed within the 2 microsecond spin timeout and so we will just be wasting CPU cycles. v2: Check for logical inversion when rebasing - we were incorrectly checking for this request being active, and instead busywaiting for when the GPU was not yet processing the request of interest. v3: Try another colour for the seqno names. v4: Another colour for the function names. v5: Remove the forced coherency when checking for the active request. On reflection and plenty of recent experimentation, the issue is not a cache coherency problem - but an irq/seqno ordering problem (timing issue). Here, we do not need the w/a to force ordering of the read with an interrupt. Signed-off-by: Chris Wilson <[email protected]> Reviewed-by: Tvrtko Ursulin <[email protected]> Cc: "Rogozhkin, Dmitry V" <[email protected]> Cc: Daniel Vetter <[email protected]> Cc: Tvrtko Ursulin <[email protected]> Cc: Eero Tamminen <[email protected]> Cc: "Rantala, Valtteri" <[email protected]> Cc: [email protected] Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] (cherry picked from commit 821485dc2ad665f136c57ee589bf7a8210160fe2) Signed-off-by: Jani Nikula <[email protected]>
2015-12-22drm/i915: Limit the busy wait on requests to 5us not 10ms!Chris Wilson1-2/+45
When waiting for high frequency requests, the finite amount of time required to set up the irq and wait upon it limits the response rate. By busywaiting on the request completion for a short while we can service the high frequency waits as quick as possible. However, if it is a slow request, we want to sleep as quickly as possible. The tradeoff between waiting and sleeping is roughly the time it takes to sleep on a request, on the order of a microsecond. Based on measurements of synchronous workloads from across big core and little atom, I have set the limit for busywaiting as 10 microseconds. In most of the synchronous cases, we can reduce the limit down to as little as 2 miscroseconds, but that leaves quite a few test cases regressing by factors of 3 and more. The code currently uses the jiffie clock, but that is far too coarse (on the order of 10 milliseconds) and results in poor interactivity as the CPU ends up being hogged by slow requests. To get microsecond resolution we need to use a high resolution timer. The cheapest of which is polling local_clock(), but that is only valid on the same CPU. If we switch CPUs because the task was preempted, we can also use that as an indicator that the system is too busy to waste cycles on spinning and we should sleep instead. __i915_spin_request was introduced in commit 2def4ad99befa25775dd2f714fdd4d92faec6e34 [v4.2] Author: Chris Wilson <[email protected]> Date: Tue Apr 7 16:20:41 2015 +0100 drm/i915: Optimistically spin for the request completion v2: Drop full u64 for unsigned long - the timer is 32bit wraparound safe, so we can use native register sizes on smaller architectures. Mention the approximate microseconds units for elapsed time and add some extra comments describing the reason for busywaiting. v3: Raise the limit to 10us v4: Now 5us. Reported-by: Jens Axboe <[email protected]> Link: https://lkml.org/lkml/2015/11/12/621 Reviewed-by: Tvrtko Ursulin <[email protected]> Cc: "Rogozhkin, Dmitry V" <[email protected]> Cc: Daniel Vetter <[email protected]> Cc: Tvrtko Ursulin <[email protected]> Cc: Eero Tamminen <[email protected]> Cc: "Rantala, Valtteri" <[email protected]> Cc: [email protected] Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] (cherry picked from commit ca5b721e238226af1d767103ac852aeb8e4c0764) Signed-off-by: Jani Nikula <[email protected]>
2015-12-22MIPS: uaccess: Take EVA into account in __copy_from_user()James Hogan1-3/+9
When EVA is in use, __copy_from_user() was unconditionally using the EVA instructions to read the user address space, however this can also be used for kernel access. If the address isn't a valid user address it will cause an address error or TLB exception, and if it is then user memory may be read instead of kernel memory. For example in the following stack trace from Linux v3.10 (changes since then will prevent this particular one still happening) kernel_sendmsg() set the user address limit to KERNEL_DS, and tcp_sendmsg() goes on to use __copy_from_user() with a kernel address in KSeg0. [<8002d434>] __copy_fromuser_common+0x10c/0x254 [<805710e0>] tcp_sendmsg+0x5f4/0xf00 [<804e8e3c>] sock_sendmsg+0x78/0xa0 [<804e8f28>] kernel_sendmsg+0x24/0x38 [<804ee0f8>] sock_no_sendpage+0x70/0x7c [<8017c820>] pipe_to_sendpage+0x80/0x98 [<8017c6b0>] splice_from_pipe_feed+0xa8/0x198 [<8017cc54>] __splice_from_pipe+0x4c/0x8c [<8017e844>] splice_from_pipe+0x58/0x78 [<8017e884>] generic_splice_sendpage+0x20/0x2c [<8017d690>] do_splice_from+0xb4/0x110 [<8017d710>] direct_splice_actor+0x24/0x30 [<8017d394>] splice_direct_to_actor+0xd8/0x208 [<8017d51c>] do_splice_direct+0x58/0x7c [<8014eaf4>] do_sendfile+0x1dc/0x39c [<8014f82c>] SyS_sendfile+0x90/0xf8 Add the eva_kernel_access() check in __copy_from_user() like the one in copy_from_user(). Signed-off-by: James Hogan <[email protected]> Cc: Markos Chandras <[email protected]> Cc: Paul Burton <[email protected]> Cc: Leonid Yegoshin <[email protected]> Cc: [email protected] Patchwork: https://patchwork.linux-mips.org/patch/10843/ Signed-off-by: Ralf Baechle <[email protected]>
2015-12-22drm/i915: Break busywaiting for requests on pending signalsChris Wilson1-5/+8
The busywait in __i915_spin_request() does not respect pending signals and so may consume the entire timeslice for the task instead of returning to userspace to handle the signal. In the worst case this could cause a delay in signal processing of 20ms, which would be a noticeable jitter in cursor tracking. If a higher resolution signal was being used, for example to provide fairness of a server timeslices between clients, we could expect to detect some unfairness between clients (i.e. some windows not updating as fast as others). This issue was noticed when inspecting a report of poor interactivity resulting from excessively high __i915_spin_request usage. Fixes regression from commit 2def4ad99befa25775dd2f714fdd4d92faec6e34 [v4.2] Author: Chris Wilson <[email protected]> Date: Tue Apr 7 16:20:41 2015 +0100 drm/i915: Optimistically spin for the request completion v2: Try to assess the impact of the bug Signed-off-by: Chris Wilson <[email protected]> Reviewed-by: Tvrtko Ursulin <[email protected]> Cc: Jens Axboe <[email protected]> Cc; "Rogozhkin, Dmitry V" <[email protected]> Cc: Daniel Vetter <[email protected]> Cc: Tvrtko Ursulin <[email protected]> Cc: Eero Tamminen <[email protected]> Cc: "Rantala, Valtteri" <[email protected]> Cc: [email protected] Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] (cherry picked from commit 91b0c352ace9afec1fb51590c7b8bd60e0eb9fbd) Signed-off-by: Jani Nikula <[email protected]>
2015-12-22MIPS: uaccess: Fix strlen_user with EVAJames Hogan1-1/+1
The strlen_user() function calls __strlen_kernel_asm in both branches of the eva_kernel_access() conditional. For EVA it should be calling __strlen_user_eva for user accesses, otherwise it will load from the kernel address space instead of the user address space, and the access checking will likely be ineffective at preventing it due to EVA's overlapping user and kernel address spaces. This was found after extending the test_user_copy module to cover user string access functions, which gave the following error with EVA: test_user_copy: illegal strlen_user passed Fortunately the use of strlen_user() has been all but eradicated from the mainline kernel, so only out of tree modules could be affected. Fixes: e3a9b07a9caf ("MIPS: asm: uaccess: Add EVA support for str*_user operations") Signed-off-by: James Hogan <[email protected]> Cc: Markos Chandras <[email protected]> Cc: Paul Burton <[email protected]> Cc: Leonid Yegoshin <[email protected]> Cc: [email protected] Cc: <[email protected]> # 3.15.x- Patchwork: https://patchwork.linux-mips.org/patch/10842/ Signed-off-by: Ralf Baechle <[email protected]>
2015-12-22drm/i915: Disable primary plane if we fail to reconstruct BIOS fb (v2)Matt Roper1-0/+15
If we fail to reconstruct the BIOS fb (e.g., because the FB is too large), we'll be left with plane state that indicates the primary plane is visible yet has a NULL fb. This mismatch causes problems later on (e.g., for the watermark code). Since we've failed to reconstruct the BIOS FB, the best solution is to just disable the primary plane and pretend the BIOS never had it enabled. v2: Add intel_pre_disable_primary() call (Maarten) Cc: Daniel Vetter <[email protected]> Cc: Ville Syrjälä <[email protected]> Cc: Maarten Lankhorst <[email protected]> Cc: [email protected] Signed-off-by: Matt Roper <[email protected]> Reviewed-by: Maarten Lankhorst <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] (cherry picked from commit 200757f5d7c6f7f7032a0a07bbb8c02a840bbf7d) Signed-off-by: Jani Nikula <[email protected]>
2015-12-22drm/i915: Set the map-and-fenceable flag for preallocated objectsChris Wilson4-19/+27
As we mark the preallocated objects as bound, we should also flag them correctly as being map-and-fenceable (if appropriate!) so that later users do not get confused and try and rebind the pinned vma in order to get a map-and-fenceable binding. Signed-off-by: Chris Wilson <[email protected]> Cc: "Goel, Akash" <[email protected]> Cc: Daniel Vetter <[email protected]> Cc: Jesse Barnes <[email protected]> Cc: [email protected] Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] Reviewed-by: Jesse Barnes <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> (cherry picked from commit d0710abbcd88b1ff17760e97d74a673e67b49ea1) Signed-off-by: Jani Nikula <[email protected]>
2015-12-22drm/i915: Drop the broken cursor base==0 special casingVille Syrjälä1-17/+12
The cursor code tries to treat base==0 to mean disabled. That fails when the cursor bo gets bound at ggtt offset 0, and the user is left looking at an invisible cursor. We lose the disabled->disabled optimization, but that seems like something better handled at a slightly higher level. Cc: [email protected] Cc: Takashi Iwai <[email protected]> Cc: Jani Nikula <[email protected]> Signed-off-by: Ville Syrjälä <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] Reviewed-by: Chris Wilson <[email protected]> (cherry picked from commit 663f3122d00c0b412d429f105dca129aa8f4f094) Signed-off-by: Jani Nikula <[email protected]>
2015-12-22ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)Mario Kleiner1-2/+9
Without this patch, internal speaker and line-out work, but front headphone output jack stays silent on the Mac Pro 4,1. This code path also gets executed on the MacPro 5,1 due to identical codec SSID, but i don't know if it has any positive or adverse effects there or not. (v2) Implement feedback from Takashi Iwai: Reuse alc889_fixup_mbp_vref and just add a new nid 0x19 for the MacPro 4,1. Signed-off-by: Mario Kleiner <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2015-12-21Merge branch 'cdc_ncm-new-Dell-devices'David S. Miller1-0/+18
Daniele Palmas says: ==================== net: usb: cdc_ncm: Adding support for two new Dell devices This patch series add support in the cdc_ncm driver for two devices based on the same platform, that are different only for carrier customization. V2: Added comment for highlighting FLAG_NOARP usage for those devices ==================== Signed-off-by: David S. Miller <[email protected]>
2015-12-21net: usb: cdc_ncm: Adding Dell DW5813 LTE AT&T Mobile Broadband CardDaniele Palmas1-0/+9
Unlike DW5550, Dell DW5813 is a mobile broadband card with no ARP capabilities: the patch makes this device to use wwan_noarp_info struct Signed-off-by: Daniele Palmas <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-21net: usb: cdc_ncm: Adding Dell DW5812 LTE Verizon Mobile Broadband CardDaniele Palmas1-0/+9
Unlike DW5550, Dell DW5812 is a mobile broadband card with no ARP capabilities: the patch makes this device to use wwan_noarp_info struct Signed-off-by: Daniele Palmas <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-21parisc: Fix syscall restartsHelge Deller1-12/+52
On parisc syscalls which are interrupted by signals sometimes failed to restart and instead returned -ENOSYS which in the worst case lead to userspace crashes. A similiar problem existed on MIPS and was fixed by commit e967ef02 ("MIPS: Fix restart of indirect syscalls"). On parisc the current syscall restart code assumes that all syscall callers load the syscall number in the delay slot of the ble instruction. That's how it is e.g. done in the unistd.h header file: ble 0x100(%sr2, %r0) ldi #syscall_nr, %r20 Because of that assumption the current code never restored %r20 before returning to userspace. This assumption is at least not true for code which uses the glibc syscall() function, which instead uses this syntax: ble 0x100(%sr2, %r0) copy regX, %r20 where regX depend on how the compiler optimizes the code and register usage. This patch fixes this problem by adding code to analyze how the syscall number is loaded in the delay branch and - if needed - copy the syscall number to regX prior returning to userspace for the syscall restart. Signed-off-by: Helge Deller <[email protected]> Cc: [email protected] Cc: Mathieu Desnoyers <[email protected]>
2015-12-21ARC: dw2 unwind: Catch Dwarf SNAFUs earlyVineet Gupta1-4/+8
Instead of seeing empty stack traces, let kernel fail early so dwarf issues can be fixed sooner Signed-off-by: Vineet Gupta <[email protected]>
2015-12-21ARC: dw2 unwind: Don't bail for CIE.version != 1Vineet Gupta1-6/+1
The rudimentary CIE.version == 3 handling is already present in code (for return address register specification) Signed-off-by: Vineet Gupta <[email protected]>
2015-12-21Revert "ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing"Vineet Gupta1-9/+4
Blingly ignoring CIE.version != 1 was a bad idea. It still leaves "desirability" when running perf with callgraphing where libgcc symbols might show in hotspot. More importantly, basic CIE.version == 3 support already exists in code: | | retAddrReg = state.version <= 1 ? *ptr++ : get_uleb128(&ptr, end); | Next commit with simply add continue-not-bail for CIE.version != 1 This reverts commit 323f41f9e7d0cb5b1d1586aded6682855f1e646d.
2015-12-21ARC: Fix linking errors with CONFIG_MODULE + CONFIG_CC_OPTIMIZE_FOR_SIZEVineet Gupta1-1/+1
At -Os, ARC gcc generates millicode thunk for function prologue/epilogue, which are served by libgcc. Modules historically are NOT linked with libgcc to avoid code bloat, reducing runtime relocation fixups etc. I even once tried doing that but got lost in makefile intricacies. This means modules at -Os don't get the millicode thunks, causing build failures below: | MODPOST 5 modules | ERROR: "__ld_r13_to_r18" [crypto/sha256_generic.ko] undefined! | ERROR: "__ld_r13_to_r18_ret" [crypto/sha256_generic.ko] undefined! | ERROR: "__st_r13_to_r18" [crypto/sha256_generic.ko] undefined! | ERROR: "__ld_r13_to_r17_ret" [crypto/sha256_generic.ko] undefined! | ERROR: "__st_r13_to_r17" [crypto/sha256_generic.ko] undefined! | ERROR: "__ld_r13_to_r16_ret" [crypto/sha256_generic.ko] undefined! | ERROR: "__st_r13_to_r16" [crypto/sha256_generic.ko] undefined! |.... |.... Workaround that by inhibiting millicode thunks for loadable modules Fixes STAR 9000641864: ("Linux built with optimizations for size emits errors for modules") Reported-by: Anton Kolesov <[email protected]> Cc: Michal Marek <[email protected]> Cc: [email protected] Signed-off-by: Vineet Gupta <[email protected]>
2015-12-21ARC: mm: fix building for MMU v2Alexey Brodkin1-2/+0
ARC700 cores with MMU v2 don't have IC_PTAG AUX register and so we only define ARC_REG_IC_PTAG for MMU versions >= 3. But current implementation of cache_line_loop_vX() routines assumes availability of all of them (v2, v3 and v4) simultaneously. And given undefined ARC_REG_IC_PTAG if CONFIG_MMU_VER=2 we're seeing compilation problem: ---------------------------------->8------------------------------- CC arch/arc/mm/cache.o arch/arc/mm/cache.c: In function '__cache_line_loop_v3': arch/arc/mm/cache.c:270:13: error: 'ARC_REG_IC_PTAG' undeclared (first use in this function) aux_tag = ARC_REG_IC_PTAG; ^ arch/arc/mm/cache.c:270:13: note: each undeclared identifier is reported only once for each function it appears in scripts/Makefile.build:258: recipe for target 'arch/arc/mm/cache.o' failed ---------------------------------->8------------------------------- The simples fix is to have ARC_REG_IC_PTAG defined regardless MMU version being used. We don't use it in cache_line_loop_v2() anyways so who cares. Signed-off-by: Alexey Brodkin <[email protected]> Signed-off-by: Vineet Gupta <[email protected]>
2015-12-21ARC: mm: HIGHMEM: Fix section mismatch splatVineet Gupta1-2/+2
| WARNING: vmlinux.o(.text+0xd6c2): Section mismatch in reference from the function alloc_kmap_pgtable() to the function | .init.text:__alloc_bootmem_low() The function alloc_kmap_pgtable() references the function __init __alloc_bootmem_low(). This is often because alloc_kmap_pgtable lacks a __init annotation or the annotation of __alloc_bootmem_low is wrong. Signed-off-by: Vineet Gupta <[email protected]>
2015-12-21ACPI / processor: Fix thermal cooling device regressionSrinivas Pandruvada1-1/+2
The processor cooling device is no longer present for passive thermal control. Commit 239708a3af44 ("ACPI: Split out ACPI PSS from ACPI Processor driver") moved the processing to a new function acpi_pss_perf_init(), but missed "return 0" after successful creation. This causes the error handling functions to be called, which will delete the previously created processor cooling device. Fixes: 239708a3af44 (ACPI: Split out ACPI PSS from ACPI Processor driver) Signed-off-by: Srinivas Pandruvada <[email protected]> Cc: 4.3+ <[email protected]> # 4.3+ Signed-off-by: Rafael J. Wysocki <[email protected]>
2015-12-21md: remove check for MD_RECOVERY_NEEDED in action_store.NeilBrown1-4/+7
md currently doesn't allow a 'sync_action' such as 'reshape' to be set while MD_RECOVERY_NEEDED is set. This s a problem, particularly since commit 738a273806ee as that can cause ->check_shape to call mddev_resume() which sets MD_RECOVERY_NEEDED. So by the time we come to start 'reshape' it is very likely that MD_RECOVERY_NEEDED is still set. Testing for this flag is not really needed and is in any case very racy as it can be set at any moment - asynchronously. Any race between setting a sync_action and setting MD_RECOVERY_NEEDED must already be handled properly in some locked code, probably md_check_recovery(), so remove the test here. The test on MD_RECOVERY_RUNNING is also racy in the 'reshape' case so we should test it again after getting mddev_lock(). As this fixes a race and a regression which can cause 'reshape' to fail, it is suitable for -stable kernels since 4.1 Reported-by: Xiao Ni <[email protected]> Fixes: 738a273806ee ("md/raid5: fix allocation of 'scribble' array.") Cc: [email protected] (v4.1+) Signed-off-by: NeilBrown <[email protected]>
2015-12-20Linux 4.4-rc6Linus Torvalds1-1/+1
2015-12-20Merge tag 'rtc-4.4-3' of ↵Linus Torvalds2-14/+53
git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fixes from Alexandre Belloni: "Late fixes for the RTC subsystem for 4.4: A fix for a nasty hardware bug in rk808 and an initialization reordering in da9063 to fix a possible crash" * tag 'rtc-4.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: da9063: fix access ordering error during RTC interrupt at system power on rtc: rk808: Compensate for Rockchip calendar deviation on November 31st
2015-12-20rtc: da9063: fix access ordering error during RTC interrupt at system power onSteve Twiss1-10/+9
This fix alters the ordering of the IRQ and device registrations in the RTC driver probe function. This change will apply to the RTC driver that supports both DA9063 and DA9062 PMICs. A problem could occur with the existing RTC driver if: A system is started from a cold boot using the PMIC RTC IRQ to initiate a power on operation. For instance, if an RTC alarm is used to start a platform from power off. The existing driver IRQ is requested before the device has been properly registered. i.e. ret = devm_request_threaded_irq() comes before rtc->rtc_dev = devm_rtc_device_register(); In this case, the interrupt can be called before the device has been registered and the handler can be called immediately. The IRQ handler da9063_alarm_event() contains the function call rtc_update_irq(rtc->rtc_dev, 1, RTC_IRQF | RTC_AF); which in turn tries to access the unavailable rtc->rtc_dev. The fix is to reorder the functions inside the RTC probe. The IRQ is requested after the RTC device resource has been registered so that get_irq_byname is the last thing to happen. Signed-off-by: Steve Twiss <[email protected]> Signed-off-by: Alexandre Belloni <[email protected]>
2015-12-20rtc: rk808: Compensate for Rockchip calendar deviation on November 31stJulius Werner1-4/+44
In A.D. 1582 Pope Gregory XIII found that the existing Julian calendar insufficiently represented reality, and changed the rules about calculating leap years to account for this. Similarly, in A.D. 2013 Rockchip hardware engineers found that the new Gregorian calendar still contained flaws, and that the month of November should be counted up to 31 days instead. Unfortunately it takes a long time for calendar changes to gain widespread adoption, and just like more than 300 years went by before the last Protestant nation implemented Greg's proposal, we will have to wait a while until all religions and operating system kernels acknowledge the inherent advantages of the Rockchip system. Until then we need to translate dates read from (and written to) Rockchip hardware back to the Gregorian format. This patch works by defining Jan 1st, 2016 as the arbitrary anchor date on which Rockchip and Gregorian calendars are in sync. From that we can translate arbitrary later dates back and forth by counting the number of November/December transitons since the anchor date to determine the offset between the calendars. We choose this method (rather than trying to regularly "correct" the date stored in hardware) since it's the only way to ensure perfect time-keeping even if the system may be shut down for an unknown number of years. The drawback is that other software reading the same hardware (e.g. mainboard firmware) must use the same translation convention (including the same anchor date) to be able to read and write correct timestamps from/to the RTC. Signed-off-by: Julius Werner <[email protected]> Reviewed-by: Douglas Anderson <[email protected]> Signed-off-by: Alexandre Belloni <[email protected]>
2015-12-19Merge tag 'tty-4.4-rc6' of ↵Linus Torvalds5-17/+19
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some tty/serial driver fixes for 4.4-rc6 that resolve some reported problems. All of these have been in linux-next. The details are in the shortlog" * tag 'tty-4.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: Fix GPF in flush_to_ldisc() serial: earlycon: Add missing spinlock initialization serial: sh-sci: Fix length of scatterlist n_tty: Fix poll() after buffer-limited eof push read serial: 8250_uniphier: fix dl_read and dl_write functions
2015-12-19Merge tag 'usb-4.4-rc6' of ↵Linus Torvalds11-47/+122
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some USB and PHY fixes for 4.4-rc6. All of them resolve some reported problems. Full details in the shortlog" * tag 'usb-4.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: fix invalid memory access in hub_activate() USB: ipaq.c: fix a timeout loop phy: core: Get a refcount to phy in devm_of_phy_get_by_index() phy: cygnus: pcie: add missing of_node_put phy: miphy365x: add missing of_node_put phy: miphy28lp: add missing of_node_put phy: rockchip-usb: add missing of_node_put phy: berlin-sata: add missing of_node_put phy: mt65xx-usb3: add missing of_node_put phy: brcmstb-sata: add missing of_node_put phy: sun9i-usb: add USB dependency
2015-12-19Merge tag 'md/4.4-rc5-fixes' of git://neil.brown.name/mdLinus Torvalds3-10/+24
Pull md fixes from Neil Brown: "Four fixes for md: - two recently introduced regressions fixed. - one older bug in RAID10 - tagged for -stable since 4.2 - one minor sysfs api improvement" * tag 'md/4.4-rc5-fixes' of git://neil.brown.name/md: Fix remove_and_add_spares removes drive added as spare in slot_store md: fix bug due to nested suspend MD: change journal disk role to disk 0 md/raid10: fix data corruption and crash during resync
2015-12-19Merge tag 'powerpc-4.4-5' of ↵Linus Torvalds4-26/+26
git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Partial revert of "powerpc: Individual System V IPC system calls" - pr_warn_once on unsupported OPAL_MSG type from Stewart - Fix deadlock in opal-irqchip introduced by "Fix double endian conversion" from Alistair * tag 'powerpc-4.4-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/opal-irqchip: Fix deadlock introduced by "Fix double endian conversion" powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type Partial revert of "powerpc: Individual System V IPC system calls"
2015-12-20Merge branch 'exynos-drm-fixes' of ↵Dave Airlie1-0/+3
git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes just one regression fix. * 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos: drm/exynos: atomic check only enabled crtc states
2015-12-19Merge tag 'spi-fix-v4.4-rc5' of ↵Linus Torvalds3-8/+8
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of reference counting bugs here, one in spidev and one with holding an extra reference in the core that we never freed if we removed a device, plus a driver specific fix. Both of the refcounting bugs are very old but they've only been found by observation so hopefully their impact has been low" * tag 'spi-fix-v4.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: fix parent-device reference leak spi: spidev: Hold spi_lock over all defererences of spi in release() spi-fsl-dspi: Fix CTAR Register access
2015-12-19Merge tag 'gpio-v4.4-3' of ↵Linus Torvalds3-4/+10
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Some GPIO fixes for the v4.4 series. Most prominent: I revert the error propagation from the .get() function until we can fix up all the drivers properly for v4.5. - Revert the error number propagation from the .get() vtable entry temporarily, until we make the proper fixes to all drivers. - Fix the clamping behaviour in the generic GPIO driver. - Driver fix for the ath79 driver" * tag 'gpio-v4.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: revert get() to non-errorprogating behaviour gpio: generic: clamp values from bgpio_get_set() gpio: ath79: Fix the logic to clear offset bit of AR71XX_GPIO_REG_OE register
2015-12-19Merge tag 'pinctrl-v4.4-3' of ↵Linus Torvalds7-28/+41
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Driver fixes for Freescale i.MX7D, Intel, Broadcom 2835 - One MAINTAINERS entry * tag 'pinctrl-v4.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: MAINTAINERS: pinctrl: Add maintainers for pinctrl-single pinctrl: bcm2835: Fix initial value for direction_output pinctrl: intel: fix offset calculation issue of register PAD_OWN pinctrl: intel: fix bug of register offset calculation pinctrl: freescale: add ZERO_OFFSET_VALID flag for vf610 pinctrl
2015-12-19natsemi: add checks for dma mapping errorsAlexey Khoroshilov1-0/+12
refill_rx() and start_tx() do not check if mapping dma memory succeed. The patch adds the checks and failure handling. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-19Merge branch 'i2c/for-current' of ↵Linus Torvalds9-23/+50
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "A set of 'usual' driver bugfixes for the I2C subsystem" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: rcar: disable runtime PM correctly in slave mode i2c: designware: Keep pm_runtime_enable/_disable calls in sync i2c: designware: fix IO timeout issue for AMD controller i2c: imx: init bus recovery info before adding i2c adapter i2c: do not use 0x in front of %pa i2c: davinci: Increase module clock frequency i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs i2c: rk3x: populate correct variable for sda_falling_time
2015-12-19Merge branch 'for-linus' of ↵Linus Torvalds11-12/+65
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: "Just a few assorted driver fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: elants_i2c - fix wake-on-touch Input: elan_i2c - set input device's vendor and product IDs Input: sun4i-lradc-keys - fix typo in binding documentation Input: atmel_mxt_ts - add maxtouch to I2C table for module autoload Input: arizona-haptic - fix disabling of haptics device Input: aiptek - fix crash on detecting device without endpoints Input: atmel_mxt_ts - add generic platform data for Chromebooks Input: parkbd - clear unused function pointers Input: walkera0701 - clear unused function pointers Input: turbografx - clear unused function pointers Input: gamecon - clear unused function pointers Input: db9 - clear unused function pointers
2015-12-20drm/exynos: atomic check only enabled crtc statesAndrzej Hajda1-0/+3
Since atomic check is called also for disabled crtcs it should skip mode checking as it can be uninitialized. The patch fixes it. Signed-off-by: Andrzej Hajda <[email protected]> Suggested-by: Daniel Vetter <[email protected]> Tested-by: Javier Martinez Canillas <[email protected]> Signed-off-by: Inki Dae <[email protected]>
2015-12-19i2c: rcar: disable runtime PM correctly in slave modeWolfram Sang1-2/+2
When we also are I2C slave, we need to disable runtime PM because the address detection mechanism needs to be active all the time. However, we can reenable runtime PM once the slave instance was unregistered. So, use pm_runtime_get_sync/put to achieve this, since it has proper refcounting. pm_runtime_allow/forbid is like a global knob controllable from userspace which is unsuitable here. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Wolfram Sang <[email protected]> Cc: [email protected]
2015-12-18Merge tag 'pm+acpi-4.4-rc6' of ↵Linus Torvalds4-15/+29
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix a potential regression introduced during the 4.3 cycle (generic power domains framework), a nasty bug that has been present forever (power capping RAPL driver), a build issue (Tegra cpufreq driver) and a minor ugliness introduced recently (intel_pstate). Specifics: - Fix a potential regression in the generic power domains framework introduced during the 4.3 development cycle that may lead to spurious failures of system suspend in certain situations (Ulf Hansson). - Fix a problem in the power capping RAPL (Running Average Power Limits) driver that causes it to initialize successfully on some systems where it is not supposed to do that which is due to an incorrect check in an initialization routine (Prarit Bhargava). - Fix a build problem in the cpufreq Tegra driver that depends on the regulator framework, but that dependency is not reflected in Kconfig (Arnd Bergmann). - Fix a recent mistake in the intel_pstate driver where a numeric constant is used directly instead of a symbol defined specifically for the case in question (Prarit Bhargava)" * tag 'pm+acpi-4.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: powercap / RAPL: fix BIOS lock check cpufreq: intel_pstate: Minor cleanup for FRAC_BITS cpufreq: tegra: add regulator dependency for T124 PM / Domains: Allow runtime PM callbacks to be re-used during system PM
2015-12-18rhashtable: Kill harmless RCU warning in rhashtable_walk_initHerbert Xu1-1/+2
The commit c6ff5268293ef98e48a99597e765ffc417e39fa5 ("rhashtable: Fix walker list corruption") causes a suspicious RCU usage warning because we no longer hold ht->mutex when we dereference ht->tbl. However, this is a false positive because we now hold ht->lock which also guarantees that ht->tbl won't disppear from under us. This patch kills the warning by using rcu_dereference_protected. Reported-by: kernel test robot <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2015-12-18Merge tag 'scsi-fixes' of ↵Linus Torvalds3-12/+42
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Three fixes this time, two in SES picked up by KASAN for various types of buffer overrun. The first is a USB array which returns page 8 whatever is asked for and causes us to overrun with incorrect data format assumptions and the second is an invalid iteration of page 10 (the additional information page). The final fix is a reversion of a NULL deref fix which caused suspend/resume not to be called in pairs leading to incorrect device operation (Jens has queued a more proper fix for the problem in block)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: ses: fix additional element traversal bug Revert "SCSI: Fix NULL pointer dereference in runtime PM" ses: Fix problems with simple enclosures
2015-12-19Merge branch 'linux-4.4' of git://github.com/skeggsb/linux into drm-fixesDave Airlie1-0/+1
single nouveau fix. * 'linux-4.4' of git://github.com/skeggsb/linux: drm/nouveau/bios/fan: hardcode the fan mode to linear
2015-12-19Merge branch 'drm-fixes-4.4' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie2-22/+44
into drm-fixes Just one important fix for amdgpu to avoid possible memory corruption. * 'drm-fixes-4.4' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: fix user fence handling
2015-12-19KEYS: Fix race between read and revokeDavid Howells1-9/+9
This fixes CVE-2015-7550. There's a race between keyctl_read() and keyctl_revoke(). If the revoke happens between keyctl_read() checking the validity of a key and the key's semaphore being taken, then the key type read method will see a revoked key. This causes a problem for the user-defined key type because it assumes in its read method that there will always be a payload in a non-revoked key and doesn't check for a NULL pointer. Fix this by making keyctl_read() check the validity of a key after taking semaphore instead of before. I think the bug was introduced with the original keyrings code. This was discovered by a multithreaded test program generated by syzkaller (http://github.com/google/syzkaller). Here's a cleaned up version: #include <sys/types.h> #include <keyutils.h> #include <pthread.h> void *thr0(void *arg) { key_serial_t key = (unsigned long)arg; keyctl_revoke(key); return 0; } void *thr1(void *arg) { key_serial_t key = (unsigned long)arg; char buffer[16]; keyctl_read(key, buffer, 16); return 0; } int main() { key_serial_t key = add_key("user", "%", "foo", 3, KEY_SPEC_USER_KEYRING); pthread_t th[5]; pthread_create(&th[0], 0, thr0, (void *)(unsigned long)key); pthread_create(&th[1], 0, thr1, (void *)(unsigned long)key); pthread_create(&th[2], 0, thr0, (void *)(unsigned long)key); pthread_create(&th[3], 0, thr1, (void *)(unsigned long)key); pthread_join(th[0], 0); pthread_join(th[1], 0); pthread_join(th[2], 0); pthread_join(th[3], 0); return 0; } Build as: cc -o keyctl-race keyctl-race.c -lkeyutils -lpthread Run as: while keyctl-race; do :; done as it may need several iterations to crash the kernel. The crash can be summarised as: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [<ffffffff81279b08>] user_read+0x56/0xa3 ... Call Trace: [<ffffffff81276aa9>] keyctl_read_key+0xb6/0xd7 [<ffffffff81277815>] SyS_keyctl+0x83/0xe0 [<ffffffff815dbb97>] entry_SYSCALL_64_fastpath+0x12/0x6f Reported-by: Dmitry Vyukov <[email protected]> Signed-off-by: David Howells <[email protected]> Tested-by: Dmitry Vyukov <[email protected]> Cc: [email protected] Signed-off-by: James Morris <[email protected]>
2015-12-18ARM: dts: Fix UART wakeirq for omap4 duovero parlorTony Lindgren1-0/+4
Looks like we're missing the wakeirq for the console uart for duovero parlor. Let's add that as without it console acess just hangs with PM enabled. Cc: Arun Bharadwaj <[email protected]> Cc: Ash Charles <[email protected]> Cc: Florian Vaussard <[email protected]> Signed-off-by: Tony Lindgren <[email protected]>
2015-12-18Input: elants_i2c - fix wake-on-touchJames Chen1-9/+12
When sending "SLEEP" command to the controller it ceases scanning completely and is unable to wake the system up from sleep, so if it is configured as a wakeup source we should simply configure interrupt for wakeup and rely on idle logic within the controller to reduce power consumption while it is not used. Signed-off-by: James Chen <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>