summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-07-24mmc: omap_hsmmc: Fix DTO and DCRC handlingKishon Vijay Abraham I
DTO/DCRC errors were not being informed to the mmc core since commit ae4bf788ee9b ("mmc: omap_hsmmc: consolidate error report handling of HSMMC IRQ"). This commit made sure 'end_trans' is never set on DTO/DCRC errors. This is because after this commit 'host->data' is checked after it has been cleared to NULL by omap_hsmmc_dma_cleanup(). Because 'end_trans' is never set, omap_hsmmc_xfer_done() is never invoked making core layer not to be aware of DTO/DCRC errors. Because of this any command invoked after DTO/DCRC error leads to a hang. Fix this by checking for 'host->data' before it is actually cleared. Fixes: ae4bf788ee9b ("mmc: omap_hsmmc: consolidate error report handling of HSMMC IRQ") CC: stable@vger.kernel.org Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> Signed-off-by: Vignesh R <vigneshr@ti.com> Tested-by: Andreas Fenkart <afenkart@gmail.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2015-07-24Merge tag 'drm-atmel-hlcdc/fixes-for-4.2' of ↵Dave Airlie
https://github.com/bbrezillon/linux-at91 into drm-fixes single hlcdc fix. * tag 'drm-atmel-hlcdc/fixes-for-4.2' of https://github.com/bbrezillon/linux-at91: drm: atmel-hlcdc: fix vblank initial state
2015-07-24md/raid5: clear R5_NeedReplace when no longer needed.NeilBrown
This flag is currently never cleared, which can in rare cases trigger a warn-on if it is still set but the block isn't InSync. So clear it when it isn't need, which includes if the replacement device has failed. Signed-off-by: NeilBrown <neilb@suse.com>
2015-07-24Fix read-balancing during node failureGoldwyn Rodrigues
During a node failure, We need to suspend read balancing so that the reads are directed to the first device and stale data is not read. Suspending writes is not required because these would be recorded and synced eventually. A new flag MD_CLUSTER_SUSPEND_READ_BALANCING is set in recover_prep(). area_resyncing() will respond true for the entire devices if this flag is set and the request type is READ. The flag is cleared in recover_done(). Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com> Reported-By: David Teigland <teigland@redhat.com> Signed-off-by: NeilBrown <neilb@suse.com>
2015-07-24md-cluster: fix bitmap sub-offset in bitmap_read_sbGoldwyn Rodrigues
bitmap_read_sb is modifying mddev->bitmap_info.offset. This works for the first bitmap read. However, when multiple bitmaps need to be opened by the same node, it ends up corrupting the offset. Fix it by using a local variable. Also, bitmap_read_sb is not required in bitmap_copy_from_slot since it is called in bitmap_create. Remove bitmap_read_sb(). Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com> Signed-off-by: NeilBrown <neilb@suse.com>
2015-07-24md: Return error if request_module fails and returns positive valueGoldwyn Rodrigues
request_module() can return 256 (process exited) in some cases, which is not as specified in the documentation before the request_module() definition. Convert the error to -ENOENT. The positive error number results in bitmap_create() returning a value that is meant to be an error but doesn't look like one, so it is dereferenced as a point and causes a crash. (not needed for stable as this is "experimental" code) Fixes: edb39c9deda8 ("Introduce md_cluster_operations to handle cluster functions") Signed-off-By: Goldwyn Rodrigues <rgoldwyn@suse.com> Signed-off-by: NeilBrown <neilb@suse.com>
2015-07-24md: Skip cluster setup in case of error while reading bitmapGoldwyn Rodrigues
If the bitmap read fails, the error code set is -EINVAL. However, we don't check for errors and go ahead with cluster_setup. Skip the cluster setup in case of error. Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com> Signed-off-by: NeilBrown <neilb@suse.com>
2015-07-24md/raid1: fix test for 'was read error from last working device'.NeilBrown
When we get a read error from the last working device, we don't try to repair it, and don't fail the device. We simple report a read error to the caller. However the current test for 'is this the last working device' is wrong. When there is only one fully working device, it assumes that a non-faulty device is that device. However a spare which is rebuilding would be non-faulty but so not the only working device. So change the test from "!Faulty" to "In_sync". If ->degraded says there is only one fully working device and this device is in_sync, this must be the one. This bug has existed since we allowed read_balance to read from a recovering spare in v3.0 Reported-and-tested-by: Alexander Lyakas <alex.bolshoy@gmail.com> Fixes: 76073054c95b ("md/raid1: clean up read_balance.") Cc: stable@vger.kernel.org (v3.0+) Signed-off-by: NeilBrown <neilb@suse.com>
2015-07-24Merge tag 'topic/drm-fixes-2015-07-23' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-fixes Regression fix for systemd getting confused about unknown connector state after resume. Just stop setting the state to unknown, turned out to be a silly idea anyway. What drivers imo really should do (and i915 still does that) is forcing a full reprobe on resume to make sure connector changes while suspended are caught. Most drivers seem to get this wrong. Otoh it took us years to get fixes merged where some probe races resulted in eating uevents, I guess userspace expectations for reliable hpd are just really low :( * tag 'topic/drm-fixes-2015-07-23' of git://anongit.freedesktop.org/drm-intel: drm: Stop resetting connector state to unknown
2015-07-24Merge tag 'drm-intel-fixes-2015-07-23' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-fixes arb_timer kernel side fix from Chris. * tag 'drm-intel-fixes-2015-07-23' of git://anongit.freedesktop.org/drm-intel: drm/i915: Use two 32bit reads for select 64bit REG_READ ioctls
2015-07-24Merge branch 'drm-fixes-4.2' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-fixes Some amdgpu fixes. * 'drm-fixes-4.2' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu/cz/dpm: properly report UVD and VCE clock levels drm/amdgpu/cz: implement voltage validation properly drm/amdgpu: add VCE harvesting instance query drm/amdgpu: implement VCE 3.0 harvesting support (v4) drm/amdgpu/dce10: Re-set VBLANK interrupt state when enabling a CRTC drm/amdgpu/dce11: Re-set VBLANK interrupt state when enabling a CRTC
2015-07-24drm/ttm: recognize ARM64 arch in ioprot handlerAlexandre Courbot
Return proper pgprot for ARM64. This is required for objects like Nouveau fences to be mapped with expected coherency. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2015-07-23tty: vt: Fix !TASK_RUNNING diagnostic warning from paste_selection()Peter Hurley
Pasting text with gpm on a VC produced warning [1]. Reset task state to TASK_RUNNING in the paste_selection() loop, if the loop did not sleep. [1] WARNING: CPU: 6 PID: 1960 at /home/peter/src/kernels/mainline/kernel/sched/core.c:7286 __might_sleep+0x7f/0x90() do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff8151805e>] paste_selection+0x9e/0x1a0 Modules linked in: btrfs xor raid6_pq ufs qnx4 hfsplus hfs minix ntfs msdos jfs xfs libcrc32c ..... CPU: 6 PID: 1960 Comm: gpm Not tainted 4.1.0-rc7+tty-xeon+debug #rc7+tty Hardware name: Dell Inc. Precision WorkStation T5400 /0RW203, BIOS A11 04/30/2012 ffffffff81c9c0a0 ffff8802b0fd3ac8 ffffffff8185778a 0000000000000001 ffff8802b0fd3b18 ffff8802b0fd3b08 ffffffff8108039a ffffffff82ae8510 ffffffff81c9ce00 0000000000000015 0000000000000000 0000000000000000 Call Trace: [<ffffffff8185778a>] dump_stack+0x4f/0x7b [<ffffffff8108039a>] warn_slowpath_common+0x8a/0xc0 [<ffffffff81080416>] warn_slowpath_fmt+0x46/0x50 [<ffffffff810ddced>] ? __lock_acquire+0xe2d/0x13a0 [<ffffffff8151805e>] ? paste_selection+0x9e/0x1a0 [<ffffffff8151805e>] ? paste_selection+0x9e/0x1a0 [<ffffffff810ad4ff>] __might_sleep+0x7f/0x90 [<ffffffff8185f76a>] down_read+0x2a/0xa0 [<ffffffff810bb1d8>] ? sched_clock_cpu+0xb8/0xe0 [<ffffffff8150d1dc>] n_tty_receive_buf_common+0x4c/0xba0 [<ffffffff810dc875>] ? mark_held_locks+0x75/0xa0 [<ffffffff81861c95>] ? _raw_spin_unlock_irqrestore+0x65/0x80 [<ffffffff810b49a1>] ? get_parent_ip+0x11/0x50 [<ffffffff8150dd44>] n_tty_receive_buf2+0x14/0x20 [<ffffffff81518117>] paste_selection+0x157/0x1a0 [<ffffffff810b77b0>] ? wake_up_state+0x20/0x20 [<ffffffff815203f8>] tioclinux+0xb8/0x2c0 [<ffffffff81515bfe>] vt_ioctl+0xaee/0x11a0 [<ffffffff810baf75>] ? sched_clock_local+0x25/0x90 [<ffffffff810bbe11>] ? vtime_account_user+0x91/0xa0 [<ffffffff8150810c>] tty_ioctl+0x20c/0xe20 [<ffffffff810bbe11>] ? vtime_account_user+0x91/0xa0 [<ffffffff810b49a1>] ? get_parent_ip+0x11/0x50 [<ffffffff810b4a69>] ? preempt_count_sub+0x49/0x50 [<ffffffff811ab71c>] ? context_tracking_exit+0x5c/0x290 [<ffffffff811ab71c>] ? context_tracking_exit+0x5c/0x290 [<ffffffff81248b98>] do_vfs_ioctl+0x318/0x570 [<ffffffff810dca8d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff810dc9b5>] ? trace_hardirqs_on_caller+0x115/0x1e0 [<ffffffff81254acc>] ? __fget_light+0x6c/0xa0 [<ffffffff81248e71>] SyS_ioctl+0x81/0xa0 [<ffffffff81862832>] system_call_fastpath+0x16/0x7a Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23serial: core: Fix crashes while echoing when closingPeter Hurley
While closing, new rx data may be received after the input buffers have been flushed but before stop_rx() halts receiving [1]. The new data might not be processed by flush_to_ldisc() until after uart_shutdown() and normal input processing is re-enabled (ie., tty->closing = 0). The race is outlined below: CPU 0 | CPU 1 | uart_close() | tty_port_close_start() | tty->closing = 1 | tty_ldisc_flush() | | => IRQ | while (LSR & data ready) | uart_insert_char() | tty_flip_buffer_push() | <= EOI stop_rx() | . uart_shutdown() | . free xmit.buf | . tty_port_tty_set(NULL) | . tty->closing = 0 | . | flush_to_ldisc() | n_tty_receive_buf_common() | __receive_buf() | ... | commit_echoes() | uart_flush_chars() | __uart_start() | ** OOPS on port.tty deref ** tty_ldisc_flush() | Input processing must be prevented from echoing (tty->closing = 1) until _after_ the input buffers have been flushed again at the end of uart_close(). [1] In fact, some input may actually be buffered _after_ stop_rx() since the rx interrupt may have already triggered but not yet been handled when stop_rx() disables rx interrupts. Fixes: 2e758910832d ("serial: core: Flush ldisc after dropping port mutex in uart_close()") Reported-by: Robert Elliott <elliott@hp.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23m32r: Add ioreadXX/iowriteXX big-endian mmio accessorsPeter Hurley
commit c627f2ceb692 ("serial: 8250: Add support for big-endian MMIO accesses") added support for 32-bit big-endian mmio to the 8250 driver. Support for ioreadXXbe/iowriteXXbe io accessors was missing from m32r arch, which caused build errors. Add trivial macro mmio accessors. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Cc: Kevin Cernekee <cernekee@gmail.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23Revert "serial: imx: initialized DMA w/o HW flow enabled"David Jander
This reverts commit 068500e08dc87ea9a453cc4a500cf3ab28d0f936. According to some tests, SDMA support is broken at least for i.MX6 without HW flow control. Different forms of data-corruption appear either with the ROM firmware for the SDMA controller as well as when loading Freescale provided SDMA firmware versions 1.1 or 3.1. Signed-off-by: David Jander <david@protonic.nl> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23sc16is7xx: fix FIFO address of secondary UARTBo Svangård
Calls to regmap_raw_read/write needed register rewrite in a similar way as function calls to regmap_read/write already had. This enables reading/writing the serial datastream to the device. Signed-off-by: Bo Svangård <bo.svangard@embeddedart.se> Signed-off-by: Jakub Kicinski <kubakici@wp.pl> Signed-off-by: Jon Ringle <jringle@gridpoint.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23sc16is7xx: fix Kconfig dependenciesJakub Kicinski
When I2C=m and SPI=y or-ing them will produce =y while what we need is the lower bound, i.e. =m. Fortunately SPI is a boolean so we need to handle only one special case. Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Jakub Kicinski <kubakici@wp.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23serial: etraxfs-uart: Fix release etraxfs_uart_portsAxel Lin
In probe, we use dev_id as array index of etraxfs_uart_ports and store the index in port->line. So etraxfs_uart_ports[port->line] should be released when unload the module. Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Niklas Cassel <nks@flawful.org> Acked-by: Jesper Nilsson <jesper.nilsson@axis.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23block: Do a full clone when splitting discard biosMartin K. Petersen
This fixes a data corruption bug when using discard on top of MD linear, raid0 and raid10 personalities. Commit 20d0189b1012 "block: Introduce new bio_split()" permits sharing the bio_vec between the two resulting bios. That is fine for read/write requests where the bio_vec is immutable. For discards, however, we need to be able to attach a payload and update the bio_vec so the page can get mapped to a scatterlist entry. Therefore the bio_vec can not be shared when splitting discards and we must do a full clone. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Reported-by: Seunguk Shin <seunguk.shin@samsung.com> Tested-by: Seunguk Shin <seunguk.shin@samsung.com> Cc: Seunguk Shin <seunguk.shin@samsung.com> Cc: Jens Axboe <axboe@fb.com> Cc: Kent Overstreet <kent.overstreet@gmail.com> Cc: <stable@vger.kernel.org> # v3.14+ Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@fb.com>
2015-07-23tty/vt: Fix the memory leak in visual_initDongxing Zhang
If vc->vc_uni_pagedir_loc is not NULL, its refcount needs to be decreased before vc_uni_pagedir_loc is re-assigned. unreferenced object 0xffff88002cdd13b0 (size 512): comm "setfont", pid 503, jiffies 4294896503 (age 722.828s) hex dump (first 32 bytes): 40 92 61 2b 00 88 ff ff 00 00 00 00 00 00 00 00 @.a+............ 00 00 00 00 00 00 00 00 a0 ad 61 2b 00 88 ff ff ..........a+.... backtrace: [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0 [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240 [<ffffffff814ae7d3>] con_do_clear_unimap.isra.2+0x83/0xe0 [<ffffffff814ae9b2>] con_clear_unimap+0x22/0x40 [<ffffffff814a8db8>] vt_ioctl+0xeb8/0x1170 [<ffffffff8149b458>] tty_ioctl+0x208/0xca0 [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510 [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0 [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75 [<ffffffffffffffff>] 0xffffffffffffffff unreferenced object 0xffff88002b619240 (size 256): comm "setfont", pid 503, jiffies 4294896503 (age 722.828s) hex dump (first 32 bytes): 90 bc 84 d5 00 88 ff ff 58 85 84 d5 00 88 ff ff ........X....... 88 ac 84 d5 00 88 ff ff e0 b1 84 d5 00 88 ff ff ................ backtrace: [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0 [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240 [<ffffffff814ae286>] con_insert_unipair+0x86/0x170 [<ffffffff814af107>] con_set_unimap+0x1b7/0x280 [<ffffffff814a8d65>] vt_ioctl+0xe65/0x1170 [<ffffffff8149b458>] tty_ioctl+0x208/0xca0 [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510 [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0 [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75 [<ffffffffffffffff>] 0xffffffffffffffff Signed-off-by: Dongxing Zhang <dongxing.zhang@intel.com> Signed-off-by: Xiaoming Wang <xiaoming.wang@intel.com> Reviewed-by: Peter Hurley <peter@hurleysoftware.com> Tested-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23serial: amba-pl011: Fix devm_ioremap_resource return value checkKrzysztof Kozlowski
Value returned by devm_ioremap_resource() was checked for non-NULL but devm_ioremap_resource() returns IOMEM_ERR_PTR, not NULL. In case of error this could lead to dereference of ERR_PTR. Signed-off-by: Krzysztof Kozlowski <k.kozlowski.k@gmail.com> Cc: <stable@vger.kernel.org> Fixes: 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23n_tty: signal and flush atomicallyPeter Hurley
When handling signalling char, claim the termios write lock before signalling waiting readers and writers to prevent further i/o before flushing the echo and output buffers. This prevents a userspace signal handler which may output from racing the terminal flush. Reference: Bugzilla #99351 ("Output truncated in ssh session after...") Fixes: commit d2b6f44779d3 ("n_tty: Fix signal handling flushes") Reported-by: Filipe Brandenburger <filbranden@google.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23Input: usbtouchscreen - avoid unresponsive TSC-30 touch screenBernhard Bender
This patch fixes a problem in the usbtouchscreen driver for DMC TSC-30 touch screen. Due to a missing delay between the RESET and SET_RATE commands, the touch screen may become unresponsive during system startup or driver loading. According to the DMC documentation, a delay is needed after the RESET command to allow the chip to complete its internal initialization. As this delay is not guaranteed, we had a system where the touch screen occasionally did not send any touch data. There was no other indication of the problem. The patch fixes the problem by adding a 150ms delay between the RESET and SET_RATE commands. Cc: stable@vger.kernel.org Suggested-by: Jakob Mustafa <jakob.mustafa@bytecmed.com> Signed-off-by: Bernhard Bender <bernhard.bender@bytecmed.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2015-07-23Merge tag 'iio-fixes-for-4.2c' of ↵Greg Kroah-Hartman
git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: 3rd round of IIO fixes for the 4.2 cycle. * bmc150_magn - add missing regmap dependency and ensure on a wrong chip case report hte chip id rather than a previous return value. * mmc35240 - Fill a null pointer derefrence and wrong SET / RESET logic that results in North and South being swapped. * mlx96014 - correct the offset value reported to userspace (wrong sign) * vf610 - Prevent non aligned register reading. * mcp320x - Another null pointer deference bug. * mma8452 - change threshold type from THRESH to MAG to reflect the fact that the sign of the signal is not known when the event is signaled. * stk3310 - move device registert to end of probe to avoid race conditions when coming up, check for invalid client->irq values and make it work for both endian types of host.
2015-07-23Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull namespace fixes from Eric Biederman: "While reading through the code of detach_mounts I realized the code was slightly off. Testing it revealed two buggy corner cases that can send the code of detach_mounts into an infinite loop. Fixing the code to do the right thing removes the possibility of these user triggered infinite loops in the code" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: mnt: In detach_mounts detach the appropriate unmounted mount mnt: Clarify and correct the disconnect logic in umount_tree
2015-07-23Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhostLinus Torvalds
Pull virtio/vhost fixes from Michael Tsirkin: "Bugfixes and documentation fixes. Igor's patch that allows users to tweak memory table size is borderline, but it does fix known crashes, so I merged it" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost: add max_mem_regions module parameter vhost: extend memory regions allocation to vmalloc 9p/trans_virtio: reset virtio device on remove virtio/s390: rename drivers/s390/kvm -> drivers/s390/virtio MAINTAINERS: separate section for s390 virtio drivers virtio: define virtio_pci_cfg_cap in header. virtio: Fix typecast of pointer in vring_init() virtio scsi: fix unused variable warning vhost: use binary search instead of linear in find_region() virtio_net: document VIRTIO_NET_CTRL_GUEST_OFFLOADS
2015-07-23block: export bio_associate_*() and wbc_account_io()Tejun Heo
bio_associate_blkcg(), bio_associate_current() and wbc_account_io() are used to implement cgroup writeback support for filesystems and thus need to be exported. Export them. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Jens Axboe <axboe@fb.com>
2015-07-23Merge tag 'iommu-fixes-v4.2-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: "The fixes include: - a couple of fixes for the new ARM-SMMUv3 driver to fix issues found on the first real implementation of that hardware. - a patch for the Intel VT-d driver to fix a domain-id leak" * tag 'iommu-fixes-v4.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Fix VM domain ID leak iommu/arm-smmu: Skip the execution of CMD_PREFETCH_CONFIG iommu/arm-smmu: Enlarge STRTAB_L1_SZ_SHIFT to support larger sidsize iommu/arm-smmu: Fix the values of ARM64_TCR_{I,O}RGN0_SHIFT iommu/arm-smmu: Fix LOG2SIZE setting for 2-level stream tables iommu/arm-smmu: Fix the index calculation of strtab
2015-07-23drm/amdgpu/cz/dpm: properly report UVD and VCE clock levelsAlex Deucher
VCE, UVD DPM work similarly to SCLK DPM. Report the current clock levels for UVD and VCE via debugfs. Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-07-23drm/amdgpu/cz: implement voltage validation properlyAlex Deucher
CZ uses a different set of registers compared to previous asics and supports separate NB and GFX planes. Reviewed-by: Jammy Zhou <Jammy.Zhou@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-07-23tile: use free_bootmem_late() for initrdChris Metcalf
We were previously using free_bootmem() and just getting lucky that nothing too bad happened. Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com> Cc: stable@vger.kernel.org
2015-07-23mnt: In detach_mounts detach the appropriate unmounted mountEric W. Biederman
The handling of in detach_mounts of unmounted but connected mounts is buggy and can lead to an infinite loop. Correct the handling of unmounted mounts in detach_mount. When the mountpoint of an unmounted but connected mount is connected to a dentry, and that dentry is deleted we need to disconnect that mount from the parent mount and the deleted dentry. Nothing changes for the unmounted and connected children. They can be safely ignored. Cc: stable@vger.kernel.org Fixes: ce07d891a0891d3c0d0c2d73d577490486b809e1 mnt: Honor MNT_LOCKED when detaching mounts Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2015-07-23drm/amdgpu: add VCE harvesting instance queryLeo Liu
Signed-off-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com>
2015-07-23drm/amdgpu: implement VCE 3.0 harvesting support (v4)Alex Deucher
For boards with bad VCE blocks, only configure the working block. v2: use the harvest info for pipe setup v3: fix mask check as noted by Leo v4: add dGPU support Reviewed-by: Christian König <christian.koenig@amd.com> (v2) Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2015-07-23drm/amdgpu/dce10: Re-set VBLANK interrupt state when enabling a CRTCMichel Dänzer
This doesn't seem strictly necessary with Tonga right now, but that might change with future power management enhancements. Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
2015-07-23drm/amdgpu/dce11: Re-set VBLANK interrupt state when enabling a CRTCMichel Dänzer
Something (ATOM BIOS?) seems to be clobbering the LB_INTERRUPT_MASK register while the CRTC is off, which caused e.g. glxgears or gnome-shell to hang after a modeset. Reviewed-and-Tested-by: Alex Deucher <alexander.deucher@amd.com> Tested-by: Sonny Jiang <sonny.jiang@amd.com> Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
2015-07-23iommu/vt-d: Fix VM domain ID leakAlex Williamson
This continues the attempt to fix commit fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make code symmetric for readability"). The previous attempt in commit 71684406905f ("iommu/vt-d: Detach domain *only* from attached iommus") overlooked the fact that dmar_domain.iommu_bmp gets cleared for VM domains when devices are detached: intel_iommu_detach_device domain_remove_one_dev_info domain_detach_iommu The domain is detached from the iommu, but the iommu is still attached to the domain, for whatever reason. Thus when we get to domain_exit(), we can't rely on iommu_bmp for VM domains to find the active iommus, we must check them all. Without that, the corresponding bit in intel_iommu.domain_ids doesn't get cleared and repeated VM domain creation and destruction will run out of domain IDs. Meanwhile we still can't call iommu_detach_domain() on arbitrary non-VM domains or we risk clearing in-use domain IDs, as 71684406905f attempted to address. It's tempting to modify iommu_detach_domain() to test the domain iommu_bmp, but the call ordering from domain_remove_one_dev_info() prevents it being able to work as fb170fb4c548 seems to have intended. Caching of unused VM domains on the iommu object seems to be the root of the problem, but this code is far too fragile for that kind of rework to be proposed for stable, so we simply revert this chunk to its state prior to fb170fb4c548. Fixes: fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make code symmetric for readability") Fixes: 71684406905f ("iommu/vt-d: Detach domain *only* from attached iommus") Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: Jiang Liu <jiang.liu@linux.intel.com> Cc: stable@vger.kernel.org # v3.17+ Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-07-23KVM: x86: rename quirk constants to KVM_X86_QUIRK_*Paolo Bonzini
Make them clearly architecture-dependent; the capability is valid for all architectures, but the argument is not. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-23KVM: vmx: obey KVM_QUIRK_CD_NW_CLEAREDXiao Guangrong
OVMF depends on WB to boot fast, because it only clears caches after it has set up MTRRs---which is too late. Let's do writeback if CR0.CD is set to make it happy, similar to what SVM is already doing. Signed-off-by: Xiao Guangrong <guangrong.xiao@intel.com> Tested-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-23KVM: x86: introduce kvm_check_has_quirkPaolo Bonzini
The logic of the disabled_quirks field usually results in a double negation. Wrap it in a simple function that checks the bit and negates it. Based on a patch from Xiao Guangrong. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-23KVM: MTRR: simplify kvm_mtrr_get_guest_memory_typeXiao Guangrong
kvm_mtrr_get_guest_memory_type never returns -1 which is implied in the current code since if @type = -1 (means no MTRR contains the range), iter.partial_map must be true Simplify the code to indicate this fact Signed-off-by: Xiao Guangrong <guangrong.xiao@intel.com> Tested-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-23KVM: MTRR: fix memory type handling if MTRR is completely disabledXiao Guangrong
Currently code uses default memory type if MTRR is fully disabled, fix it by using UC instead. Signed-off-by: Xiao Guangrong <guangrong.xiao@intel.com> Tested-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-22mei: prevent unloading mei hw modules while the device is opened.Tomas Winkler
chrdev_open() increases reference counter on cdev->owner. Instead of assigning the owner to mei subsystem, the owner has to be set to the underlaying HW module (mei_me or mei_txe), so once the device is opened the HW module cannot be unloaded. Cc: <stable@vger.kernel.org> #3.17+ Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-22misc: mic: scif bug fix for vmalloc_to_page crashSudeep Dutt
v4.2-rc1 enabled huge page support for ioremap(..). Calling vmalloc_to_page after v4.2-rc1 results in the crash shown below on the host upon booting X100 coprocessors: BUG: unable to handle kernel paging request at ffffc47c00000000 IP: [<ffffffff811a2c0c>] vmalloc_to_page+0x6c/0xb0 This patch fixes this crash by obtaining the fake struct page pointer which is required to be passed into dma_map_sg(..) by calling pfn_to_page(..) instead of vmalloc_to_page(..). Link: https://lkml.org/lkml/2015/7/18/110 Reviewed-by: Nikhil Rao <nikhil.rao@intel.com> Suggested-by: Toshi Kani <toshi.kani@hp.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Signed-off-by: Sudeep Dutt <sudeep.dutt@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-22parport: fix freeing freed memorySudip Mukherjee
After the reference count becomes 0 when put_device() is called, it will execute the release callback where we are freeing all the allocated memory associated with the device. So if we just continue on the error path then we are again freeing devname and trying to dereference par_dev which has already been free-ed in the release callback. Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-22parport: fix memory leakSudip Mukherjee
After the reference count becomes 0 when put_device() is called, it will execute the release callback where we are freeing all the allocated memory associated with the device. We missed freeing par_dev->state. Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-22parport: fix error handlingSudip Mukherjee
After registering the device if exclusive access fails for any reason then we need to unregister the device to remove all references. Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-22mnt: Clarify and correct the disconnect logic in umount_treeEric W. Biederman
rmdir mntpoint will result in an infinite loop when there is a mount locked on the mountpoint in another mount namespace. This is because the logic to test to see if a mount should be disconnected in umount_tree is buggy. Move the logic to decide if a mount should remain connected to it's mountpoint into it's own function disconnect_mount so that clarity of expression instead of terseness of expression becomes a virtue. When the conditions where it is invalid to leave a mount connected are first ruled out, the logic for deciding if a mount should be disconnected becomes much clearer and simpler. Fixes: e0c9c0afd2fc958ffa34b697972721d81df8a56f mnt: Update detach_mounts to leave mounts connected Fixes: ce07d891a0891d3c0d0c2d73d577490486b809e1 mnt: Honor MNT_LOCKED when detaching mounts Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2015-07-23md: Skip cluster setup for dm-raidGoldwyn Rodrigues
There is a bug that the bitmap superblock isn't initialised properly for dm-raid, so a new field can have garbage in new fields. (dm-raid does initialisation in the kernel - md initialised the superblock in mdadm). This means that for dm-raid we cannot currently trust the new ->nodes field. So: - use __GFP_ZERO to initialise the superblock properly for all new arrays - initialise all fields in bitmap_info in bitmap_new_disk_sb - ignore ->nodes for dm arrays (yes, this is a hack) This bug exposes dm-raid to bug in the (still experimental) md-cluster code, so it is suitable for -stable. It does cause crashes. References: https://bugzilla.kernel.org/show_bug.cgi?id=100491 Cc: stable@vger.kernel.org (v4.1) Signed-off-By: Goldwyn Rodrigues <rgoldwyn@suse.com> Signed-off-by: NeilBrown <neilb@suse.com>