]> git.kernelconcepts.de Git - karo-tx-linux.git/log
karo-tx-linux.git
9 years agoMerge tag 'tty-4.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Linus Torvalds [Thu, 30 Apr 2015 16:30:07 +0000 (09:30 -0700)]
Merge tag 'tty-4.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial fixes from Greg KH:
 "Here are some small tty/serial driver fixes for 4.1-rc2.

  They include some minor fixes that resolve reported issues, and a new
  device quirk.

  All have been in linux-next succesfully"

* tag 'tty-4.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: 8250_pci: Add support for 16 port Exar boards
  serial: samsung: fix serial console break
  tty/serial: at91: maxburst was missing for dma transfers
  serial: of-serial: Remove device_type = "serial" registration
  serial: xilinx: Use platform_get_irq to get irq description structure
  serial: core: Fix kernel-doc build warnings
  tty: Re-add external interface for tty_set_termios()

9 years agoMerge tag 'usb-4.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Linus Torvalds [Thu, 30 Apr 2015 16:08:53 +0000 (09:08 -0700)]
Merge tag 'usb-4.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are a number of small USB fixes for 4.2-rc2.  They revert one
  problem patch, fix some minor things, and add some new quirks for
  "broken" devices.

  All have been in linux-next successfully"

* tag 'usb-4.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  cdc-acm: prevent infinite loop when parsing CDC headers.
  Revert "usb: host: ehci-msm: Use devm_ioremap_resource instead of devm_ioremap"
  usb: chipidea: otg: remove mutex unlock and lock while stop and start role
  uas: Set max_sectors_240 quirk for ASM1053 devices
  uas: Add US_FL_MAX_SECTORS_240 flag
  uas: Allow uas_use_uas_driver to return usb-storage flags

9 years agoMerge tag 'renesas-sh-drivers-for-v4.1' of git://git.kernel.org/pub/scm/linux/kernel...
Linus Torvalds [Thu, 30 Apr 2015 16:07:26 +0000 (09:07 -0700)]
Merge tag 'renesas-sh-drivers-for-v4.1' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas

Pull SH driver updates from Simon Horman:

 - remove test for now unsupported sh7372 SoC

 - disable PM runtime for multi-platform r8a73a4 and sh73a0 SoCs with
   genpd

* tag 'renesas-sh-drivers-for-v4.1' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  drivers: sh: Remove test for now unsupported sh7372
  drivers: sh: Disable PM runtime for multi-platform r8a73a4 with genpd
  drivers: sh: Disable PM runtime for multi-platform sh73a0 with genpd

9 years agodm: fix free_rq_clone() NULL pointer when requeueing unmapped request
Mike Snitzer [Wed, 29 Apr 2015 14:48:09 +0000 (10:48 -0400)]
dm: fix free_rq_clone() NULL pointer when requeueing unmapped request

Commit 022333427a ("dm: optimize dm_mq_queue_rq to _not_ use kthread if
using pure blk-mq") mistakenly removed free_rq_clone()'s clone->q check
before testing clone->q->mq_ops.  It was an oversight to discontinue
that check for 1 of the 2 use-cases for free_rq_clone():
1) free_rq_clone() called when an unmapped original request is requeued
2) free_rq_clone() called in the request-based IO completion path

The clone->q check made sense for case #1 but not for #2.  However, we
cannot just reinstate the check as it'd mask a serious bug in the IO
completion case #2 -- no in-flight request should have an uninitialized
request_queue (basic block layer refcounting _should_ ensure this).

The NULL pointer seen for case #1 is detailed here:
https://www.redhat.com/archives/dm-devel/2015-April/msg00160.html

Fix this free_rq_clone() NULL pointer by simply checking if the
mapped_device's type is DM_TYPE_MQ_REQUEST_BASED (clone's queue is
blk-mq) rather than checking clone->q->mq_ops.  This avoids the need to
dereference clone->q, but a WARN_ON_ONCE is added to let us know if an
uninitialized clone request is being completed.

Reported-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
9 years agodm: only initialize the request_queue once
Christoph Hellwig [Thu, 30 Apr 2015 14:10:36 +0000 (10:10 -0400)]
dm: only initialize the request_queue once

Commit bfebd1cdb4 ("dm: add full blk-mq support to request-based DM")
didn't properly account for the need to short-circuit re-initializing
DM's blk-mq request_queue if it was already initialized.

Otherwise, reloading a blk-mq request-based DM table (either manually
or via multipathd) resulted in errors, see:
 https://www.redhat.com/archives/dm-devel/2015-April/msg00132.html

Fix is to only initialize the request_queue on the initial table load
(when the mapped_device type is assigned).

This is better than having dm_init_request_based_blk_mq_queue() return
early if the queue was already initialized because it elevates the
constraint to a more meaningful location in DM core.  As such the
pre-existing early return in dm_init_request_based_queue() can now be
removed.

Fixes: bfebd1cdb4 ("dm: add full blk-mq support to request-based DM")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
9 years agoarm64: perf: Fix the pmu node name in warning message
Suzuki K. Poulose [Mon, 13 Apr 2015 09:17:55 +0000 (10:17 +0100)]
arm64: perf: Fix the pmu node name in warning message

With commit d5efd9cc9cf2 ("arm64: pmu: add support for interrupt-affinity
property"), we print a warning when we find a PMU SPI with a missing
missing interrupt-affinity property in a pmu node. Unfortunately, we
pass the wrong (NULL) device node to of_node_full_name, resulting in
unhelpful messages such as:

 hw perfevents: Failed to parse <no-node>/interrupt-affinity[0]

This patch fixes the name to that of the pmu node.

Fixes: d5efd9cc9cf2 (arm64: pmu: add support for interrupt-affinity property)
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Suzuki K. Poulose <suzuki.poulose@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
9 years agoarm64: perf: don't warn about missing interrupt-affinity property for PPIs
Will Deacon [Fri, 17 Apr 2015 13:41:29 +0000 (14:41 +0100)]
arm64: perf: don't warn about missing interrupt-affinity property for PPIs

PPIs are affine by nature, so the interrupt-affinity property is not
used and therefore we shouldn't print a warning in its absence.

Reported-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Reviewed-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
9 years agoRevert "powerpc/tm: Abort syscalls in active transactions"
Michael Ellerman [Thu, 30 Apr 2015 05:13:14 +0000 (15:13 +1000)]
Revert "powerpc/tm: Abort syscalls in active transactions"

This reverts commit feba40362b11341bee6d8ed58d54b896abbd9f84.

Although the principle of this change is good, the implementation has a
few issues.

Firstly we can sometimes fail to abort a syscall because r12 may have
been clobbered by C code if we went down the virtual CPU accounting
path, or if syscall tracing was enabled.

Secondly we have decided that it is safer to abort the syscall even
earlier in the syscall entry path, so that we avoid the syscall tracing
path when we are transactional.

So that we have time to thoroughly test those changes we have decided to
revert this for this merge window and will merge the fixed version in
the next window.

NB. Rather than reverting the selftest we just drop tm-syscall from
TEST_PROGS so that it's not run by default.

Fixes: feba40362b11 ("powerpc/tm: Abort syscalls in active transactions")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
9 years agoMerge branch 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux into drm...
Dave Airlie [Thu, 30 Apr 2015 02:15:34 +0000 (12:15 +1000)]
Merge branch 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux into drm-fixes

Fixes for 4.1 for radeon all destined for stable:
- fix fallout from the audio rework
- VM fixes
- other assorted bug fixes

* 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: fix userptr return value checking (v2)
  drm/radeon: check new address before removing old one
  drm/radeon: reset BOs address after clearing it.
  drm/radeon: fix lockup when BOs aren't part of the VM on release
  drm/radeon: add SI DPM quirk for Sapphire R9 270 Dual-X 2G GDDR5
  drm/radeon: adjust pll when audio is not enabled
  drm/radeon: only enable audio streams if the monitor supports it
  drm/radeon: only mark audio as connected if the monitor supports it (v3)
  drm/radeon/audio: don't enable packets until the end
  drm/radeon: drop dce6_dp_enable
  drm/radeon: fix ordering of AVI packet setup
  drm/radeon: Use drm_calloc_ab for CS relocs

9 years agoBtrfs: btrfs_release_extent_buffer_page didn't free pages of dummy extent
Forrest Liu [Mon, 9 Feb 2015 09:31:45 +0000 (17:31 +0800)]
Btrfs: btrfs_release_extent_buffer_page didn't free pages of dummy extent

btrfs_release_extent_buffer_page() can't handle dummy extent that
allocated by btrfs_clone_extent_buffer() properly. That is because
reference count of pages that allocated by btrfs_clone_extent_buffer()
was 2, 1 by alloc_page(), and another by attach_extent_buffer_page().

Running following command repeatly can check this memory leak problem

    btrfs inspect-internal inode-resolve 256 /mnt/btrfs

Signed-off-by: Chien-Kuan Yeh <ckya@synology.com>
Signed-off-by: Forrest Liu <forrestl@synology.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Tested-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
9 years agocxgb4: Fix MC1 memory offset calculation
Hariprasad Shenai [Wed, 29 Apr 2015 11:49:05 +0000 (17:19 +0530)]
cxgb4: Fix MC1 memory offset calculation

Commit 6559a7e8296002b4 ("cxgb4: Cleanup macros so they follow the same
style and look consistent") introduced a regression where reading MC1
memory in adapters where MC0 isn't present or MC0 size is not equal to MC1
size caused the adapter to crash due to incorrect computation of memoffset.
Fix is to read the size of MC0 instead of MC1 for offset calculation

Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agobnx2x: Delay during kdump load
Yuval Mintz [Wed, 29 Apr 2015 05:09:49 +0000 (08:09 +0300)]
bnx2x: Delay during kdump load

In a kdump environment interfaces might be re-loaded without a proper
unload sequence in the previous running kernel.
bnx2x management FW and driver maintains a `pulse' that notifies the FW
that the driver is still up and running.

Driver load on the kdump kernel should be performed only after the pulse
has been out-of-sync long enough for the management FW to identify that
the driver has crashed, on which point it will perform some necessary
cleanup of the HW.

In today's distros kdump loading is quite fast, sometimes too fast for our
FW to get out-of-sync. This patch delays the bnx2x's probe during kdump
to allow a proper re-load on the kdump kernel.

Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agonet: Fix Kernel Panic in bonding driver debugfs file: rlb_hash_table
Pai [Wed, 29 Apr 2015 18:24:23 +0000 (14:24 -0400)]
net: Fix Kernel Panic in bonding driver debugfs file: rlb_hash_table

This patch fixes a Kernel Panic in bonding driver debugfs file: rlb_hash_table.

$> modprobe bonding mode=6
$> cat /sys/kernel/debug/bonding/bond0/rlb_hash_table

This will crash the kernel. The struct alb_bond_info is initialized only when
the bonding interface is initialized (ip link set bond0 up) and not at the time
it is allocated. If we try to read the table before that, it'll result in a
kernel panic.

The patch applies against both net and net-next

Signed-off-by: Vishwanath Pai <vpai@akamai.com>
Signed-off-by: Andy Gospodarek <gospo@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agonet: dsa: Fix scope of eeprom-length property
Guenter Roeck [Wed, 29 Apr 2015 17:56:15 +0000 (10:56 -0700)]
net: dsa: Fix scope of eeprom-length property

eeprom-length is a switch property, not a dsa property, and thus
needs to be attached to the switch node, not to the dsa node.

Reported-by: Andrew Lunn <andrew@lunn.ch>
Fixes: 6793abb4e849 ("net: dsa: Add support for switch EEPROM access")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agonet: macb: Fix race condition in driver when Rx frame is dropped
Punnaiah Choudary Kalluri [Wed, 29 Apr 2015 03:04:46 +0000 (08:34 +0530)]
net: macb: Fix race condition in driver when Rx frame is dropped

Under heavy Rx load, observed that the Hw is updating the USED bit
and it is not updating the received frame status to the BD control
field. This could be lack of resources for processing the BDs at high
data rates. Driver drops the frame associated with this BD but not
clearing the USED bit. So, this is causing hang condition as Hw
expects USED bit to be cleared for this BD.

Signed-off-by: Punnaiah Choudary Kalluri <punnaia@xilinx.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agohv_netvsc: Fix a bug in netvsc_start_xmit()
KY Srinivasan [Wed, 29 Apr 2015 00:59:48 +0000 (17:59 -0700)]
hv_netvsc: Fix a bug in netvsc_start_xmit()

Commit b08cc79155fc26d0d112b1470d1ece5034651a4b eliminated memory
allocation in the packet send path:

    "hv_netvsc: Eliminate memory allocation in the packet send path

    The network protocol used to communicate with the host is the remote ndis (rndis)
    protocol. We need to decorate each outgoing packet with a rndis header and
    additional rndis state (rndis per-packet state). To manage this state, we
    currently allocate memory in the transmit path. Eliminate this allocation by
    requesting additional head room in the skb."

This commit introduced a bug since it did not account for the case if the skb
was cloned. Fix this bug.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Tested-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agoaltera_tse: Correct rx packet length
Vlastimil Setka [Tue, 28 Apr 2015 22:17:11 +0000 (00:17 +0200)]
altera_tse: Correct rx packet length

Altera TSE MAC rx DMA transfer starts with the 2 additional bytes for IP
payload alignment. This patch fixes tse_rx() function loop which reads DMA
rx status and extracts packet length from it. Status signalises a whole DMA
transfer length, which is 2 bytes longer than the packet itself.

Signed-off-by: Vlastimil Setka <setka@vsis.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agomlx4: Fix tx ring affinity_mask creation
Benjamin Poirier [Tue, 28 Apr 2015 21:49:29 +0000 (14:49 -0700)]
mlx4: Fix tx ring affinity_mask creation

By default, the number of tx queues is limited by the number of online cpus
in mlx4_en_get_profile(). However, this limit no longer holds after the
ethtool .set_channels method has been called. In that situation, the driver
may access invalid bits of certain cpumask variables when queue_index >=
nr_cpu_ids.

Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
Acked-by: Ido Shamay <idos@mellanox.com>
Fixes: d03a68f ("net/mlx4_en: Configure the XPS queue mapping on driver load")
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agotipc: fix problem with parallel link synchronization mechanism
Jon Paul Maloy [Tue, 28 Apr 2015 20:59:04 +0000 (16:59 -0400)]
tipc: fix problem with parallel link synchronization mechanism

Currently, we try to accumulate arrived packets in the links's
'deferred' queue during the parallel link syncronization phase.

This entails two problems:

- With an unlucky combination of arriving packets the algorithm
  may go into a lockstep with the out-of-sequence handling function,
  where the synch mechanism is adding a packet to the deferred queue,
  while the out-of-sequence handling is retrieving it again, thus
  ending up in a loop inside the node_lock scope.

- Even if this is avoided, the link will very often send out
  unnecessary protocol messages, in the worst case leading to
  redundant retransmissions.

We fix this by just dropping arriving packets on the upcoming link
during the synchronization phase, thus relying on the retransmission
protocol to resolve the situation once the two links have arrived to
a synchronized state.

Reviewed-by: Erik Hugne <erik.hugne@ericsson.com>
Reviewed-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agotipc: remove wrong use of NLM_F_MULTI
Nicolas Dichtel [Tue, 28 Apr 2015 16:33:50 +0000 (18:33 +0200)]
tipc: remove wrong use of NLM_F_MULTI

NLM_F_MULTI must be used only when a NLMSG_DONE message is sent. In fact,
it is sent only at the end of a dump.

Libraries like libnl will wait forever for NLMSG_DONE.

Fixes: 35b9dd7607f0 ("tipc: add bearer get/dump to new netlink api")
Fixes: 7be57fc69184 ("tipc: add link get/dump to new netlink api")
Fixes: 46f15c6794fb ("tipc: add media get/dump to new netlink api")
CC: Richard Alpe <richard.alpe@ericsson.com>
CC: Jon Maloy <jon.maloy@ericsson.com>
CC: Ying Xue <ying.xue@windriver.com>
CC: tipc-discussion@lists.sourceforge.net
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agobridge/nl: remove wrong use of NLM_F_MULTI
Nicolas Dichtel [Tue, 28 Apr 2015 16:33:49 +0000 (18:33 +0200)]
bridge/nl: remove wrong use of NLM_F_MULTI

NLM_F_MULTI must be used only when a NLMSG_DONE message is sent. In fact,
it is sent only at the end of a dump.

Libraries like libnl will wait forever for NLMSG_DONE.

Fixes: e5a55a898720 ("net: create generic bridge ops")
Fixes: 815cccbf10b2 ("ixgbe: add setlink, getlink support to ixgbe and ixgbevf")
CC: John Fastabend <john.r.fastabend@intel.com>
CC: Sathya Perla <sathya.perla@emulex.com>
CC: Subbu Seetharaman <subbu.seetharaman@emulex.com>
CC: Ajit Khaparde <ajit.khaparde@emulex.com>
CC: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
CC: intel-wired-lan@lists.osuosl.org
CC: Jiri Pirko <jiri@resnulli.us>
CC: Scott Feldman <sfeldma@gmail.com>
CC: Stephen Hemminger <stephen@networkplumber.org>
CC: bridge@lists.linux-foundation.org
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agobridge/mdb: remove wrong use of NLM_F_MULTI
Nicolas Dichtel [Tue, 28 Apr 2015 16:33:48 +0000 (18:33 +0200)]
bridge/mdb: remove wrong use of NLM_F_MULTI

NLM_F_MULTI must be used only when a NLMSG_DONE message is sent. In fact,
it is sent only at the end of a dump.

Libraries like libnl will wait forever for NLMSG_DONE.

Fixes: 37a393bc4932 ("bridge: notify mdb changes via netlink")
CC: Cong Wang <amwang@redhat.com>
CC: Stephen Hemminger <stephen@networkplumber.org>
CC: bridge@lists.linux-foundation.org
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agonet: sched: act_connmark: don't zap skb->nfct
Florian Westphal [Tue, 28 Apr 2015 11:33:21 +0000 (13:33 +0200)]
net: sched: act_connmark: don't zap skb->nfct

This action is meant to be passive, i.e. we should not alter
skb->nfct: If nfct is present just leave it alone.

Compile tested only.

Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agotrivial: net: systemport: bcmsysport.h: fix 0x0x prefix
Antonio Ospite [Tue, 28 Apr 2015 11:11:29 +0000 (13:11 +0200)]
trivial: net: systemport: bcmsysport.h: fix 0x0x prefix

Fix the 0x0x prefix in an integer constant.

In this case, while at it, also fix a typo (s/unitcast/unicast/).

Signed-off-by: Antonio Ospite <ao2@ao2.it>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agotrivial: net: atl1e: atl1e_hw.h: fix 0x0x prefix
Antonio Ospite [Tue, 28 Apr 2015 11:11:27 +0000 (13:11 +0200)]
trivial: net: atl1e: atl1e_hw.h: fix 0x0x prefix

Fix the 0x0x prefix in an integer constant.

Signed-off-by: Antonio Ospite <ao2@ao2.it>
Cc: Jay Cliburn <jcliburn@gmail.com>
Cc: Chris Snook <chris.snook@gmail.com>
Cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agoMerge branch 'bnx2x'
David S. Miller [Wed, 29 Apr 2015 18:48:36 +0000 (14:48 -0400)]
Merge branch 'bnx2x'

Michal Schmidt says:

====================
bnx2x: minor cleanups related to TPA bits

I noticed some simplification possibilities while looking into the bug
fixed by "bnx2x: really disable TPA if 'disable_tpa' is set'.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agobnx2x: remove {TPA,GRO}_ENABLE_FLAG
Michal Schmidt [Tue, 28 Apr 2015 09:34:23 +0000 (11:34 +0200)]
bnx2x: remove {TPA,GRO}_ENABLE_FLAG

These flags are redundant with dev->features. Remove them.
Just make sure to set dev->features ourselves in bnx2x_set_features()
before performing the reload of the card.

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agobnx2x: merge fp->disable_tpa with fp->mode
Michal Schmidt [Tue, 28 Apr 2015 09:34:22 +0000 (11:34 +0200)]
bnx2x: merge fp->disable_tpa with fp->mode

It is simpler to have the TPA mode as one three-state variable.

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agobnx2x: mark LRO as a fixed disabled feature if disable_tpa is set
Michal Schmidt [Tue, 28 Apr 2015 09:34:21 +0000 (11:34 +0200)]
bnx2x: mark LRO as a fixed disabled feature if disable_tpa is set

If disable_tpa is set, remove NETIF_F_LRO from hw_features, so ethtool sees
it as "off [fixed]".

Note that setting the NETIF_F_LRO bit in dev->features in the 'else'
branch is not needed, because the bit was already set by
bnx2x_init_dev().

Then the check for disable_tpa in in bnx2x_fix_features() becomes unnecessary.

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agohv_netvsc: introduce netif-msg into netvsc module
Simon Xiao [Tue, 28 Apr 2015 08:05:17 +0000 (01:05 -0700)]
hv_netvsc: introduce netif-msg into netvsc module

1. Introduce netif-msg to netvsc to control debug logging output
and keep msg_enable in netvsc_device_context so that it is
kept persistently.
2. Only call dump_rndis_message() when NETIF_MSG_RX_ERR or above
is specified in netvsc module debug param.
In non-debug mode, in current code, dump_rndis_message() will not
dump anything but it still initialize some local variables and
process the switch logic which is unnecessary, especially in
high network throughput situation.

Signed-off-by: Simon Xiao <sixiao@microsoft.com>
Reviewed-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agoroute: Use ipv4_mtu instead of raw rt_pmtu
Herbert Xu [Tue, 28 Apr 2015 03:43:15 +0000 (11:43 +0800)]
route: Use ipv4_mtu instead of raw rt_pmtu

The commit 3cdaa5be9e81a914e633a6be7b7d2ef75b528562 ("ipv4: Don't
increase PMTU with Datagram Too Big message") broke PMTU in cases
where the rt_pmtu value has expired but is smaller than the new
PMTU value.

This obsolete rt_pmtu then prevents the new PMTU value from being
installed.

Fixes: 3cdaa5be9e81 ("ipv4: Don't increase PMTU with Datagram Too Big message")
Reported-by: Gerd v. Egidy <gerd.von.egidy@intra2net.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agoarm64: add missing PAGE_ALIGN() to __dma_free()
Dean Nelson [Wed, 29 Apr 2015 15:09:18 +0000 (16:09 +0100)]
arm64: add missing PAGE_ALIGN() to __dma_free()

__dma_alloc() does a PAGE_ALIGN() on the passed in size argument before
doing anything else. __dma_free() does not. And because it doesn't, it is
possible to leak memory should size not be an integer multiple of PAGE_SIZE.

The solution is to add a PAGE_ALIGN() to __dma_free() like is done in
__dma_alloc().

Additionally, this patch removes a redundant PAGE_ALIGN() from
__dma_alloc_coherent(), since __dma_alloc_coherent() can only be called
from __dma_alloc(), which already does a PAGE_ALIGN() before the call.

Cc: stable@vger.kernel.org
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Dean Nelson <dnelson@redhat.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
9 years agocpuidle: Run tick_broadcast_exit() with disabled interrupts
Rafael J. Wysocki [Wed, 29 Apr 2015 13:19:21 +0000 (15:19 +0200)]
cpuidle: Run tick_broadcast_exit() with disabled interrupts

Commit 335f49196fd6 (sched/idle: Use explicit broadcast oneshot
control function) replaced clockevents_notify() invocations in
cpuidle_idle_call() with direct calls to tick_broadcast_enter()
and tick_broadcast_exit(), but it overlooked the fact that
interrupts were already enabled before calling the latter which
led to functional breakage on systems using idle states with the
CPUIDLE_FLAG_TIMER_STOP flag set.

Fix that by moving the invocations of tick_broadcast_enter()
and tick_broadcast_exit() down into cpuidle_enter_state() where
interrupts are still disabled when tick_broadcast_exit() is
called.  Also ensure that interrupts will be disabled before
running tick_broadcast_exit() even if they have been enabled by
the idle state's ->enter callback.  Trigger a WARN_ON_ONCE() in
that case, as we generally don't want that to happen for states
with CPUIDLE_FLAG_TIMER_STOP set.

Fixes: 335f49196fd6 (sched/idle: Use explicit broadcast oneshot control function)
Reported-and-tested-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Reported-and-tested-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
9 years agoMerge remote-tracking branches 'asoc/fix/rt5677', 'asoc/fix/samsung' and 'asoc/fix...
Mark Brown [Wed, 29 Apr 2015 12:37:31 +0000 (13:37 +0100)]
Merge remote-tracking branches 'asoc/fix/rt5677', 'asoc/fix/samsung' and 'asoc/fix/tfa9879' into asoc-linus

9 years agoMerge remote-tracking branches 'asoc/fix/email', 'asoc/fix/fsl-ssi', 'asoc/fix/pm...
Mark Brown [Wed, 29 Apr 2015 12:37:28 +0000 (13:37 +0100)]
Merge remote-tracking branches 'asoc/fix/email', 'asoc/fix/fsl-ssi', 'asoc/fix/pm', 'asoc/fix/qcom' and 'asoc/fix/rcar' into asoc-linus

9 years agoMerge remote-tracking branch 'asoc/fix/rt5645' into asoc-linus
Mark Brown [Wed, 29 Apr 2015 12:37:27 +0000 (13:37 +0100)]
Merge remote-tracking branch 'asoc/fix/rt5645' into asoc-linus

9 years agoMerge remote-tracking branch 'asoc/fix/intel' into asoc-linus
Mark Brown [Wed, 29 Apr 2015 12:37:27 +0000 (13:37 +0100)]
Merge remote-tracking branch 'asoc/fix/intel' into asoc-linus

9 years agoMerge remote-tracking branch 'asoc/fix/dapm' into asoc-linus
Mark Brown [Wed, 29 Apr 2015 12:37:26 +0000 (13:37 +0100)]
Merge remote-tracking branch 'asoc/fix/dapm' into asoc-linus

9 years agoASoC: rt5677: fixed wrong DMIC ref clock
Bard Liao [Tue, 28 Apr 2015 03:27:39 +0000 (11:27 +0800)]
ASoC: rt5677: fixed wrong DMIC ref clock

DMIC clock source is not from codec system clock directly. it is
generated from the division of system clock. And it should be 256 *
sample rate of AIF1.

Signed-off-by: Bard Liao <bardliao@realtek.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
9 years agodmaengine: increment privatecnt when using dma_get_any_slave_channel
Christopher Freeman [Wed, 4 Mar 2015 09:16:58 +0000 (01:16 -0800)]
dmaengine: increment privatecnt when using dma_get_any_slave_channel

Channels allocated via dma_get_any_slave_channel were not increasing
the counter tracking private allocations.  When these channels were
released, privatecnt may erroneously fall to zero.  The DMA device
would then lose its DMA_PRIVATE cap and fail to allocate future private
channels (via private_candidate) as any allocations still outstanding
would incorrectly be seen as public allocations.

Signed-off-by: Christopher Freeman <cfreeman@nvidia.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
9 years agopowerpc/powernv: Fix early pci_controller_ops loading.
Daniel Axtens [Mon, 27 Apr 2015 02:33:51 +0000 (12:33 +1000)]
powerpc/powernv: Fix early pci_controller_ops loading.

Load the PowerNV platform pci controller ops into pci controllers
after all the operations are loaded into the platform ops struct, not
before.

Otherwise we aren't actually setting the ops properly which can break
IO for some devices.

Fixes: 65ebf4b63 ("powerpc/powernv: Move controller ops from ppc_md to controller_ops")
Reported-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Reviewed-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
9 years agoALSA: emu10k1: Emu10k2 32 bit DMA mode
Peter Zubaj [Tue, 28 Apr 2015 19:57:29 +0000 (21:57 +0200)]
ALSA: emu10k1: Emu10k2 32 bit DMA mode

Looks like audigy emu10k2 (probably emu10k1 - sb live too) support two
modes for DMA. Second mode is useful for 64 bit os with more then 2 GB
of ram (fixes problems with big soundfont loading)

1) 32MB from 2 GB address space using 8192 pages (used now as default)
2) 16MB from 4 GB address space using 4096 pages

Mode is set using HCFG_EXPANDED_MEM flag in HCFG register.
Also format of emu10k2 page table is then different.

Signed-off-by: Peter Zubaj <pzubaj@marticonet.sk>
Tested-by: Takashi Iwai <tiwai@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
9 years agopowerpc/kvm: Fix SMP=n build error in book3s_xics.c
Michael Ellerman [Tue, 28 Apr 2015 00:34:35 +0000 (10:34 +1000)]
powerpc/kvm: Fix SMP=n build error in book3s_xics.c

Commit 34cb7954c0aa "Convert ICS mutex lock to spin lock" added an
include of asm/spinlock.h, which does not work in the SMP=n case.

It should instead include linux/spinlock.h

Fixes: 34cb7954c0aa ("KVM: PPC: Book3S HV: Convert ICS mutex lock to spin lock")
Acked-by: Paul Mackerras <paulus@samba.org>
Reviewed-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
9 years agoACPI / SBS: Enable battery manager when present
Chris Bainbridge [Wed, 22 Apr 2015 15:40:21 +0000 (16:40 +0100)]
ACPI / SBS: Enable battery manager when present

Commit 9faf6136ff46 (ACPI / SBS: Disable smart battery manager on
Apple) introduced a regression disabling the SBS battery manager.
The battery manager should be marked as present when
acpi_manager_get_info() returns 0.

Fixes: 9faf6136ff46 (ACPI / SBS: Disable smart battery manager on Apple)
Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
Cc: 3.18+ <stable@vger.kernel.org> # 3.18+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
9 years agoACPICA: remove duplicate u8 typedef
Olaf Hering [Tue, 28 Apr 2015 14:54:04 +0000 (16:54 +0200)]
ACPICA: remove duplicate u8 typedef

During commit e252652fb266 ("ACPICA: acpidump: Remove integer types
translation protection.") two 'unsigned char' types got converted to 'u8'.

The result does not compile with gcc-4.5, it can not cope with duplicate
typedefs.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
9 years agoMerge branch 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux...
Linus Torvalds [Tue, 28 Apr 2015 21:22:35 +0000 (14:22 -0700)]
Merge branch 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile

Pull arch/tile bugfix from Chris Metcalf:
 "This just fixes a compiler warning from an old bug that only recently
  started generating a warning"

* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
  tile: properly use node_isset() on a nodemask_t

9 years agoserial: 8250_pci: Add support for 16 port Exar boards
Soeren Grunewald [Tue, 28 Apr 2015 14:29:49 +0000 (16:29 +0200)]
serial: 8250_pci: Add support for 16 port Exar boards

The Exar XR17V358 chip usually provides only 8 ports. But two chips can be
combined to act as a single 16 port chip. Therefor one chip is configured
as master the second as slave by connecting the mode pin to VCC (master)
or GND (slave).

Then the master chip is reporting a different device-id depending on
whether a slave is detected or not. The UARTs 8-15 are addressed from
0x2000-0x3fff. So the offset of 0x400 from UART to UART can be used to
address all 16 ports as before.

See: https://www.exar.com/common/content/document.ashx?id=1587 page 11

Signed-off-by: Soeren Grunewald <soeren.grunewald@desy.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoMerge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Linus Torvalds [Tue, 28 Apr 2015 16:58:46 +0000 (09:58 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 updates from Martin Schwidefsky:
 "One additional new feature for 4.1, a new PRNG based on SHA-512 for
  the zcrypt driver.

  Two memory management related changes, the page table reallocation for
  KVM is removed, and with file ptes gone the encoding of page table
  entries is improved.

  And three bug fixes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/zcrypt: Introduce new SHA-512 based Pseudo Random Generator.
  s390/mm: change swap pte encoding and pgtable cleanup
  s390/mm: correct transfer of dirty & young bits in __pmd_to_pte
  s390/bpf: add dependency to z196 features
  s390/3215: free memory in error path
  s390/kvm: remove delayed reallocation of page tables for KVM
  kexec: allocate the kexec control page with KEXEC_CONTROL_MEMORY_GFP

9 years agoALSA: emux: Fix mutex deadlock in OSS emulation
Takashi Iwai [Tue, 28 Apr 2015 15:11:44 +0000 (17:11 +0200)]
ALSA: emux: Fix mutex deadlock in OSS emulation

The OSS emulation in synth-emux helper has a potential AB/BA deadlock
at the simultaneous closing and opening:

  close ->
    snd_seq_release() ->
      sne_seq_free_client() ->
        snd_seq_delete_all_ports(): takes client->ports_mutex ->
  port_delete() ->
    snd_emux_unuse(): takes emux->register_mutex

  open ->
    snd_seq_oss_open() ->
      snd_emux_open_seq_oss(): takes emux->register_mutex ->
        snd_seq_event_port_attach() ->
  snd_seq_create_port(): takes client->ports_mutex

This patch addresses the deadlock by reducing the rance taking
emux->register_mutex in snd_emux_open_seq_oss().  The lock is needed
for the refcount handling, so move it locally.  The calls in
emux_seq.c are already with the mutex, thus they are replaced with the
version without mutex lock/unlock.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
9 years agoASoC: Update email-id of Rajeev Kumar
Rajeev Kumar [Tue, 28 Apr 2015 06:00:08 +0000 (11:30 +0530)]
ASoC: Update email-id of Rajeev Kumar

rajeev-dlh.kumar@st.com email-id doesn't exist anymore as I have left the
company.  Replace ST's id with Rajeev Kumar <rajeevkumar.linux@gmail.com>

Signed-off-by: Rajeev Kumar <rajeevkumar.linux@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
9 years agotile: properly use node_isset() on a nodemask_t
Chris Metcalf [Tue, 28 Apr 2015 14:36:45 +0000 (10:36 -0400)]
tile: properly use node_isset() on a nodemask_t

The code accidentally used cpu_isset() previously in one place
(though properly node_isset() elsewhere).

Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
9 years agodrm/i915/chv: Implement WaDisableShadowRegForCpd
Deepak S [Thu, 16 Apr 2015 03:21:28 +0000 (08:51 +0530)]
drm/i915/chv: Implement WaDisableShadowRegForCpd

This WA is avoid problem between shadow vs wake FIFO unload
problem during CPD/RC6 transactions on CHV.

v2: Define individual bits GTFIFOCTL (Ville)

v3: move WA to uncore_early_sanitize (ville)

Signed-off-by: Deepak S <deepak.s@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
[Jani: fixed some whitespace issues while applying]
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
9 years agoserial: samsung: fix serial console break
Robert Baldyga [Fri, 17 Apr 2015 06:43:09 +0000 (08:43 +0200)]
serial: samsung: fix serial console break

This patch fixes problems with serial console break. When function
s3c64xx_serial_startup() was started while serial console has been working,
it caused lose of characters written to TX FIFO. This effect was particularly
observable with systemd, which closes serial port every time when it's
not currently needed, hence function s3c64xx_serial_startup() is called
quite often there. To fix this problem we avoid resetting TX FIFO if port is
used as serial console.

Example of broken console log:

[ 1086.7         Expecting device dev-ttySAC1.device...
[ 1086.[  OK  ] Reached target Paths.
[ 1086.756416] s[  OK  ] Reached target Swap.
[ 1086.776413] systemd[1]: Reached target Swap.
[ 1086.776642] systemd[1]: Starting Root Slice.
[    5.53403[  OK  ] Created slice Root Slice.
[    5.548433] systemd[1]: Create[  OK  ] Created slice User and Session Slice.
[    5.568414] sys[  OK  ] Listening on /dev/initctl Compatibility Named Pipe.
[    5.588388] s[  OK  ] Listening on Delayed Shutdown Socket.
[    5.608376] sy[  OK  ] Listening on Journal Socket (/dev/log).
[    5.628361] [  OK  ] Listening on udev Kernel Socket.
[    5.648357] s[  OK  ] Listening on udev Control Socket.
[    5.668353] s[  OK  ] Listening on Journal Socket.
[    5.688366] systemd[1]: Listeni[  OK  ] Created slice System Slice.
[    5.708393]          Mounting Temporary Directory...
[ 7139.067436]          Starting prepare device daemon...
[ 7139.091726] sy         Starting Generate environment from /etc/profile.d...
[    5.792867] system         Starting Create Static Device Nodes in /dev...
[ 7848.718         Mounting Debug File System...
[ 7848.7384         Mounting Configuration File System...
[    5.852         Starting Apply Kernel Variables...
[    5.8720         Starting Setup Virtual Console...
[ 7848.798         Starting udev Coldplug all Devices...
[ 7848.817         Starting Journal Service...
[  OK  ] Started Journal Service.
[ 7848.854222] s[  OK  ] Reached target Slices.
         Starting Remount Root and Kernel File Systems...
[  OK  ] Mounted Configuration File System.

Reported-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agotty/serial: at91: maxburst was missing for dma transfers
Ludovic Desroches [Thu, 16 Apr 2015 14:58:12 +0000 (16:58 +0200)]
tty/serial: at91: maxburst was missing for dma transfers

Maxburst was not set when doing the dma slave configuration. This value
is checked by the recently introduced xdmac. It causes an error when
doing the slave configuration and so prevents from using dma.

Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Cc: <stable@vger.kernel.org> # 3.12 and later
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoserial: of-serial: Remove device_type = "serial" registration
Michal Simek [Tue, 14 Apr 2015 10:03:09 +0000 (12:03 +0200)]
serial: of-serial: Remove device_type = "serial" registration

Do not probe all serial drivers by of_serial.c which are using
device_type = "serial"; property. Only drivers which have valid
compatible strings listed in the driver should be probed.

When PORT_UNKNOWN is setup probe will fail anyway.

Arnd quotation about driver historical background:
"when I wrote that driver initially, the idea was that it would
get used as a stub to hook up all other serial drivers but after
that, the common code learned to create platform devices from DT"

This patch fix the problem with on the system with xilinx_uartps and
16550a where of_serial failed to register for xilinx_uartps and because
of irq_dispose_mapping() removed irq_desc. Then when xilinx_uartps was asking
for irq with request_irq() EINVAL is returned.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
CC: <stable@vger.kernel.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoserial: xilinx: Use platform_get_irq to get irq description structure
Michal Simek [Mon, 13 Apr 2015 14:34:21 +0000 (16:34 +0200)]
serial: xilinx: Use platform_get_irq to get irq description structure

For systems with CONFIG_SERIAL_OF_PLATFORM=y and device_type =
"serial"; property in DT of_serial.c driver maps and unmaps IRQ (because
driver probe fails). Then a driver is called but irq mapping is not
created that's why driver is failing again in again on request_irq().
Based on this use platform_get_irq() instead of platform_get_resource()
which is doing irq_desc allocation and driver itself can request IRQ.

Fix both xilinx serial drivers in the tree.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoserial: core: Fix kernel-doc build warnings
Peter Hurley [Sat, 11 Apr 2015 14:05:07 +0000 (10:05 -0400)]
serial: core: Fix kernel-doc build warnings

Fix uart_console_write() kernel-doc build warnings.

Warning(drivers/tty/serial/serial_core.c:1778): No description found for parameter 'putchar'
Warning(drivers/tty/serial/serial_core.c:1778): Excess function parameter 'write' description in 'uart_console_write'

Fixes: 1cfe42b7fd29 ("serial: core: Fix kernel doc for uart_console_write()")
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agotty: Re-add external interface for tty_set_termios()
Frederic Danis [Fri, 10 Apr 2015 13:13:05 +0000 (15:13 +0200)]
tty: Re-add external interface for tty_set_termios()

This is needed by Bluetooth hci_uart module to be able to change speed
of Bluetooth controller and local UART.

Signed-off-by: Frederic Danis <frederic.danis@linux.intel.com>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agocdc-acm: prevent infinite loop when parsing CDC headers.
Quentin Casasnovas [Tue, 14 Apr 2015 09:25:43 +0000 (11:25 +0200)]
cdc-acm: prevent infinite loop when parsing CDC headers.

Phil and I found out a problem with commit:

  7e860a6e7aa6 ("cdc-acm: add sanity checks")

It added some sanity checks to ignore potential garbage in CDC headers but
also introduced a potential infinite loop.  This can happen at the first
loop iteration (elength = 0 in that case) if the description isn't a
DT_CS_INTERFACE or later if 'buffer[0]' is zero.

It should also be noted that the wrong length was being added to 'buffer'
in case 'buffer[1]' was not a DT_CS_INTERFACE descriptor, since elength was
assigned after that check in the loop.

A specially crafted USB device could be used to trigger this infinite loop.

Fixes: 7e860a6e7aa6 ("cdc-acm: add sanity checks")
Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
CC: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
CC: Oliver Neukum <oneukum@suse.de>
CC: Adam Lee <adam8157@gmail.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoRevert "usb: host: ehci-msm: Use devm_ioremap_resource instead of devm_ioremap"
Ivan T. Ivanov [Mon, 27 Apr 2015 12:27:36 +0000 (15:27 +0300)]
Revert "usb: host: ehci-msm: Use devm_ioremap_resource instead of devm_ioremap"

This reverts commit 70843f623b58 ("usb: host: ehci-msm: Use
devm_ioremap_resource instead of devm_ioremap") and commit
e507bf577e5a ("host: ehci-msm: remove duplicate check on resource"),
because msm_otg and this driver are using same address space to
access AHB mode and USB command registers.

Signed-off-by: Ivan T. Ivanov <ivan.ivanov@linaro.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Vivek Gautam <gautam.vivek@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agousb: chipidea: otg: remove mutex unlock and lock while stop and start role
Li Jun [Sun, 12 Apr 2015 09:51:02 +0000 (17:51 +0800)]
usb: chipidea: otg: remove mutex unlock and lock while stop and start role

Wrongly release mutex lock during otg_statemachine may result in re-enter
otg_statemachine, which is not allowed, we should do next state transtition
after previous one completed.

Fixes: 826cfe751f3e ("usb: chipidea: add OTG fsm operation functions implementation")
Cc: <stable@vger.kernel.org> # v3.16+
Signed-off-by: Li Jun <jun.li@freescale.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agouas: Set max_sectors_240 quirk for ASM1053 devices
Hans de Goede [Tue, 21 Apr 2015 09:20:32 +0000 (11:20 +0200)]
uas: Set max_sectors_240 quirk for ASM1053 devices

Testing has shown that ASM1053 devices do not work properly with transfers
larger than 240 sectors, so set max_sectors to 240 on these.

Cc: stable@vger.kernel.org # 3.16
Reported-by: Steve Bangert <sbangert@frontier.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Tested-by: Steve Bangert <sbangert@frontier.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agouas: Add US_FL_MAX_SECTORS_240 flag
Hans de Goede [Tue, 21 Apr 2015 09:20:31 +0000 (11:20 +0200)]
uas: Add US_FL_MAX_SECTORS_240 flag

The usb-storage driver sets max_sectors = 240 in its scsi-host template,
for uas we do not want to do that for all devices, but testing has shown
that some devices need it.

This commit adds a US_FL_MAX_SECTORS_240 flag for such devices, and
implements support for it in uas.c, while at it it also adds support
for US_FL_MAX_SECTORS_64 to uas.c.

Cc: stable@vger.kernel.org # 3.16
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agouas: Allow uas_use_uas_driver to return usb-storage flags
Hans de Goede [Tue, 21 Apr 2015 09:20:30 +0000 (11:20 +0200)]
uas: Allow uas_use_uas_driver to return usb-storage flags

uas_use_uas_driver may set some US_FL_foo flags during detection, currently
these are stored in a local variable and then throw away, but these may be
of interest to the caller, so add an extra parameter to (optionally) return
the detected flags, and use this in the uas driver.

Cc: stable@vger.kernel.org # 3.16
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 years agoMerge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
David S. Miller [Tue, 28 Apr 2015 03:12:34 +0000 (23:12 -0400)]
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Fix a crash in nf_tables when dictionaries are used from the ruleset,
   due to memory corruption, from Florian Westphal.

2) Fix another crash in nf_queue when used with br_netfilter. Also from
   Florian.

Both fixes are related to new stuff that got in 4.0-rc.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agobpf: fix 64-bit divide
Alexei Starovoitov [Mon, 27 Apr 2015 21:40:37 +0000 (14:40 -0700)]
bpf: fix 64-bit divide

ALU64_DIV instruction should be dividing 64-bit by 64-bit,
whereas do_div() does 64-bit by 32-bit divide.
x64 and arm64 JITs correctly implement 64 by 64 unsigned divide.
llvm BPF backend emits code assuming that ALU64_DIV does 64 by 64.

Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets")
Reported-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agonet: netcp: remove call to netif_carrier_(on/off) for MAC to Phy interface
Karicheri, Muralidharan [Mon, 27 Apr 2015 18:12:43 +0000 (14:12 -0400)]
net: netcp: remove call to netif_carrier_(on/off) for MAC to Phy interface

Currently when interface type is MAC to Phy, netif_carrier_(on/off)
is called which is not needed as Phy lib already updates the carrier
status to net stack. This is needed only for other interface types

Signed-off-by: Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agoMerge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Linus Torvalds [Mon, 27 Apr 2015 21:05:19 +0000 (14:05 -0700)]
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) mlx4 doesn't check fully for supported valid RSS hash function, fix
    from Amir Vadai

 2) Off by one in ibmveth_change_mtu(), from David Gibson

 3) Prevent altera chip from reporting false error interrupts in some
    circumstances, from Chee Nouk Phoon

 4) Get rid of that stupid endless loop trying to allocate a FIN packet
    in TCP, and in the process kill deadlocks.  From Eric Dumazet

 5) Fix get_rps_cpus() crash due to wrong invalid-cpu value, also from
    Eric Dumazet

 6) Fix two bugs in async rhashtable resizing, from Thomas Graf

 7) Fix topology server listener socket namespace bug in TIPC, from Ying
    Xue

 8) Add some missing HAS_DMA kconfig dependencies, from Geert
    Uytterhoeven

 9) bgmac driver intends to force re-polling but does so by returning
    the wrong value from it's ->poll() handler.  Fix from Rafał Miłecki

10) When the creater of an rhashtable configures a max size for it,
    don't bark in the logs and drop insertions when that is exceeded.
    Fix from Johannes Berg

11) Recover from out of order packets in ppp mppe properly, from Sylvain
    Rochet

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (41 commits)
  bnx2x: really disable TPA if 'disable_tpa' option is set
  net:treewide: Fix typo in drivers/net
  net/mlx4_en: Prevent setting invalid RSS hash function
  mdio-mux-gpio: use new gpiod_get_array and gpiod_put_array functions
  netfilter; Add some missing default cases to switch statements in nft_reject.
  ppp: mppe: discard late packet in stateless mode
  ppp: mppe: sanity error path rework
  net/bonding: Make DRV macros private
  net: rfs: fix crash in get_rps_cpus()
  altera tse: add support for fixed-links.
  pxa168: fix double deallocation of managed resources
  net: fix crash in build_skb()
  net: eth: altera: Resolve false errors from MSGDMA to TSE
  ehea: Fix memory hook reference counting crashes
  net/tg3: Release IRQs on permanent error
  net: mdio-gpio: support access that may sleep
  inet: fix possible panic in reqsk_queue_unlink()
  rhashtable: don't attempt to grow when at max_size
  bgmac: fix requests for extra polling calls from NAPI
  tcp: avoid looping in tcp_send_fin()
  ...

9 years agoASoC: rt5645: Fix mask for setting RT5645_DMIC_2_DP_GPIO12 bit
Axel Lin [Tue, 21 Apr 2015 04:19:49 +0000 (12:19 +0800)]
ASoC: rt5645: Fix mask for setting RT5645_DMIC_2_DP_GPIO12 bit

Current code uses wrong mask when setting RT5645_DMIC_2_DP_GPIO12 bit,
fix it.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
9 years agobnx2x: really disable TPA if 'disable_tpa' option is set
Michal Schmidt [Mon, 27 Apr 2015 15:20:38 +0000 (17:20 +0200)]
bnx2x: really disable TPA if 'disable_tpa' option is set

bnx2x's 'disable_tpa=1' module option is not respected properly and TPA
(transparent packet aggregation) remains enabled. Even though the
module option causes LRO to be disabled, TPA is enabled in GRO mode.

Additionally, disabling GRO via ethtool then has no effect. One can
still observe tpa_* statistics increase and large packets being received
in tcpdump.

The bug was an unintended consequence of commit aebf6244cd39 "bnx2x: Be
more forgiving toward SW GRO".

Fix it by following the bp->disable_tpa flag when initializing fp's.

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agonet:treewide: Fix typo in drivers/net
Masanari Iida [Mon, 27 Apr 2015 14:14:57 +0000 (23:14 +0900)]
net:treewide: Fix typo in drivers/net

This patch fix spelling typo in printk.

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agonet/mlx4_en: Prevent setting invalid RSS hash function
Amir Vadai [Mon, 27 Apr 2015 10:40:56 +0000 (13:40 +0300)]
net/mlx4_en: Prevent setting invalid RSS hash function

mlx4_en_check_rxfh_func() was checking for hardware support before
setting a known RSS hash function, but didn't do any check before
setting unknown RSS hash function. Need to make it fail on such values.
In this occasion, moved the actual setting of the new value from the
check function into mlx4_en_set_rxfh().

Fixes: 947cbb0 ("net/mlx4_en: Support for configurable RSS hash function")
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agomdio-mux-gpio: use new gpiod_get_array and gpiod_put_array functions
Rojhalat Ibrahim [Mon, 27 Apr 2015 08:37:31 +0000 (10:37 +0200)]
mdio-mux-gpio: use new gpiod_get_array and gpiod_put_array functions

Use the new gpiod_get_array and gpiod_put_array functions
(added to mainline in the v4.1 merge window) for obtaining and
disposing of GPIO descriptors.

Cc: David Miller <davem@davemloft.net>
Cc: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Rojhalat Ibrahim <imr@rtschenk.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
9 years agonetfilter; Add some missing default cases to switch statements in nft_reject.
David S. Miller [Mon, 27 Apr 2015 17:20:34 +0000 (13:20 -0400)]
netfilter; Add some missing default cases to switch statements in nft_reject.

This fixes:

====================
net/netfilter/nft_reject.c: In function ‘nft_reject_dump’:
net/netfilter/nft_reject.c:61:2: warning: enumeration value ‘NFT_REJECT_TCP_RST’ not handled in switch [-Wswitch]
  switch (priv->type) {
  ^
net/netfilter/nft_reject.c:61:2: warning: enumeration value ‘NFT_REJECT_ICMPX_UNREACH’ not handled in switch [-Wswi\
tch]
net/netfilter/nft_reject_inet.c: In function ‘nft_reject_inet_dump’:
net/netfilter/nft_reject_inet.c:105:2: warning: enumeration value ‘NFT_REJECT_TCP_RST’ not handled in switch [-Wswi\
tch]
  switch (priv->type) {
  ^
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
9 years ago3w-9xxx: fix command completion race
Christoph Hellwig [Thu, 23 Apr 2015 07:48:51 +0000 (09:48 +0200)]
3w-9xxx: fix command completion race

The 3w-9xxx driver needs to tear down the dma mappings before returning
the command to the midlayer, as there is no guarantee the sglist and
count are valid after that point.  Also remove the dma mapping helpers
which have another inherent race due to the request_id index.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years ago3w-xxxx: fix command completion race
Christoph Hellwig [Thu, 23 Apr 2015 07:48:50 +0000 (09:48 +0200)]
3w-xxxx: fix command completion race

The 3w-xxxx driver needs to tear down the dma mappings before returning
the command to the midlayer, as there is no guarantee the sglist and
count are valid after that point.  Also remove the dma mapping helpers
which have another inherent race due to the request_id index.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years ago3w-sas: fix command completion race
Christoph Hellwig [Thu, 23 Apr 2015 07:48:49 +0000 (09:48 +0200)]
3w-sas: fix command completion race

The 3w-sas driver needs to tear down the dma mappings before returning
the command to the midlayer, as there is no guarantee the sglist and
count are valid after that point.  Also remove the dma mapping helpers
which have another inherent race due to the request_id index.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reported-by: Torsten Luettgert <ml-lkml@enda.eu>
Tested-by: Bernd Kardatzki <Bernd.Kardatzki@med.uni-tuebingen.de>
Cc: stable@vger.kernel.org
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoaha1542: Allocate memory before taking a lock
Ondrej Zary [Tue, 21 Apr 2015 21:27:50 +0000 (23:27 +0200)]
aha1542: Allocate memory before taking a lock

The driver currently calls kmalloc with GFP_KERNEL while holding a lock.
Fix it by doing the allocation earlier, before taking the lock.

Tested on AHA-1542B.

Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoSCSI: add 1024 max sectors black list flag
Mike Christie [Tue, 21 Apr 2015 03:42:24 +0000 (22:42 -0500)]
SCSI: add 1024 max sectors black list flag

This works around a issue with qnap iscsi targets not handling large IOs
very well.

The target returns:

VPD INQUIRY: Block limits page (SBC)
  Maximum compare and write length: 1 blocks
  Optimal transfer length granularity: 1 blocks
  Maximum transfer length: 4294967295 blocks
  Optimal transfer length: 4294967295 blocks
  Maximum prefetch, xdread, xdwrite transfer length: 0 blocks
  Maximum unmap LBA count: 8388607
  Maximum unmap block descriptor count: 1
  Optimal unmap granularity: 16383
  Unmap granularity alignment valid: 0
  Unmap granularity alignment: 0
  Maximum write same length: 0xffffffff blocks
  Maximum atomic transfer length: 0
  Atomic alignment: 0
  Atomic transfer length granularity: 0

and it is *sometimes* able to handle at least one IO of size up to 8 MB. We
have seen in traces where it will sometimes work, but other times it
looks like it fails and it looks like it returns failures if we send
multiple large IOs sometimes. Also it looks like it can return 2 different
errors. It will sometimes send iscsi reject errors indicating out of
resources or it will send invalid cdb illegal requests check conditions.
And then when it sends iscsi rejects it does not seem to handle retries
when there are command sequence holes, so I could not just add code to
try and gracefully handle that error code.

The problem is that we do not have a good contact for the company,
so we are not able to determine under what conditions it returns
which error and why it sometimes works.

So, this patch just adds a new black list flag to set targets like this to
the old max safe sectors of 1024. The max_hw_sectors changes added in 3.19
caused this regression, so I also ccing stable.

Reported-by: Christian Hesse <list@eworm.de>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agodrm/radeon: fix userptr return value checking (v2)
Christian König [Mon, 27 Apr 2015 15:04:37 +0000 (17:04 +0200)]
drm/radeon: fix userptr return value checking (v2)

Otherwise we print false warning from time to time.

v2: agd5f: rebase

Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
CC: stable@vger.kernel.org
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
9 years agodrm/radeon: check new address before removing old one
Christian König [Mon, 27 Apr 2015 15:04:36 +0000 (17:04 +0200)]
drm/radeon: check new address before removing old one

Otherwise the change isn't atomic.

Signed-off-by: Christian König <christian.koenig@amd.com>
CC: stable@vger.kernel.org
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
9 years agodrm/radeon: reset BOs address after clearing it.
Christian König [Mon, 27 Apr 2015 15:04:35 +0000 (17:04 +0200)]
drm/radeon: reset BOs address after clearing it.

Otherwise it is possible that we will have page table corruption
if we change a BOs address multiple times.

Signed-off-by: Christian König <christian.koenig@amd.com>
CC: stable@vger.kernel.org
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
9 years agodrm/radeon: fix lockup when BOs aren't part of the VM on release
Christian König [Mon, 27 Apr 2015 15:04:34 +0000 (17:04 +0200)]
drm/radeon: fix lockup when BOs aren't part of the VM on release

If we unmap BOs before releasing them them the intervall tree locks
up because we try to remove an entry not inside the tree.

Based on a patch from Michel Dänzer.

Signed-off-by: Christian König <christian.koenig@amd.com>
CC: stable@vger.kernel.org
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
9 years agoALSA: hda - Fix missing va_end() call in snd_hda_codec_pcm_new()
Takashi Iwai [Mon, 27 Apr 2015 14:39:19 +0000 (16:39 +0200)]
ALSA: hda - Fix missing va_end() call in snd_hda_codec_pcm_new()

Reported by coverity CID 1296024.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
9 years agodrm/radeon: add SI DPM quirk for Sapphire R9 270 Dual-X 2G GDDR5
Alex Deucher [Mon, 27 Apr 2015 13:51:43 +0000 (09:51 -0400)]
drm/radeon: add SI DPM quirk for Sapphire R9 270 Dual-X 2G GDDR5

Seems to have problems with high mclks.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=76490

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
9 years agodrm/radeon: adjust pll when audio is not enabled
Alex Deucher [Sun, 19 Apr 2015 16:01:00 +0000 (12:01 -0400)]
drm/radeon: adjust pll when audio is not enabled

Fixes display problems with some monitors when audio
is not enabled.

Bugs:
https://bugs.freedesktop.org/show_bug.cgi?id=89505
https://bugzilla.kernel.org/show_bug.cgi?id=94171
Plus several reports on IRC.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
9 years agodrm/radeon: only enable audio streams if the monitor supports it
Alex Deucher [Tue, 7 Apr 2015 14:20:49 +0000 (10:20 -0400)]
drm/radeon: only enable audio streams if the monitor supports it

Selectively enable which packets we send based on monitor caps.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
9 years agodrm/radeon: only mark audio as connected if the monitor supports it (v3)
Alex Deucher [Tue, 7 Apr 2015 13:52:42 +0000 (09:52 -0400)]
drm/radeon: only mark audio as connected if the monitor supports it (v3)

Otherwise the driver may try and send audio which may confuse the
monitor.

v2: set pin to NULL if no audio
v3: avoid crash with analog encoders

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
9 years agodrm/radeon/audio: don't enable packets until the end
Alex Deucher [Tue, 31 Mar 2015 15:43:12 +0000 (11:43 -0400)]
drm/radeon/audio: don't enable packets until the end

Don't enable the audio and avi infoframes and audio stream
until all the state is set up.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
9 years agodrm/radeon: drop dce6_dp_enable
Alex Deucher [Tue, 31 Mar 2015 15:38:48 +0000 (11:38 -0400)]
drm/radeon: drop dce6_dp_enable

It's mostly duplicated with evergreen_dp_enable. This
is a prerequisite for fix implemented in another patch.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
9 years agodrm/radeon: fix ordering of AVI packet setup
Alex Deucher [Tue, 31 Mar 2015 14:33:05 +0000 (10:33 -0400)]
drm/radeon: fix ordering of AVI packet setup

Set the line first, then enable the stream.  May fix
pink line problems on some displays.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
9 years agodrm/radeon: Use drm_calloc_ab for CS relocs
Michel Dänzer [Thu, 16 Apr 2015 02:17:27 +0000 (11:17 +0900)]
drm/radeon: Use drm_calloc_ab for CS relocs

The number of relocs is passed in by userspace and can be large. It has
been observed to cause kcalloc failures in the wild.

Cc: stable@vger.kernel.org
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
9 years agox86: pvclock: Really remove the sched notifier for cross-cpu migrations
Paolo Bonzini [Thu, 23 Apr 2015 11:20:18 +0000 (13:20 +0200)]
x86: pvclock: Really remove the sched notifier for cross-cpu migrations

This reverts commits 0a4e6be9ca17c54817cf814b4b5aa60478c6df27
and 80f7fdb1c7f0f9266421f823964fd1962681f6ce.

The task migration notifier was originally introduced in order to support
the pvclock vsyscall with non-synchronized TSC, but KVM only supports it
with synchronized TSC.  Hence, on KVM the race condition is only needed
due to a bad implementation on the host side, and even then it's so rare
that it's mostly theoretical.

As far as KVM is concerned it's possible to fix the host, avoiding the
additional complexity in the vDSO and the (re)introduction of the task
migration notifier.

Xen, on the other hand, hasn't yet implemented vsyscall support at
all, so we do not care about its plans for non-synchronized TSC.

Reported-by: Peter Zijlstra <peterz@infradead.org>
Suggested-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
9 years agokvm: x86: fix kvmclock update protocol
Radim Krčmář [Wed, 25 Mar 2015 11:08:14 +0000 (12:08 +0100)]
kvm: x86: fix kvmclock update protocol

The kvmclock spec says that the host will increment a version field to
an odd number, then update stuff, then increment it to an even number.
The host is buggy and doesn't do this, and the result is observable
when one vcpu reads another vcpu's kvmclock data.

There's no good way for a guest kernel to keep its vdso from reading
a different vcpu's kvmclock data, but we don't need to care about
changing VCPUs as long as we read a consistent data from kvmclock.
(VCPU can change outside of this loop too, so it doesn't matter if we
return a value not fit for this VCPU.)

Based on a patch by Radim Krčmář.

Reviewed-by: Radim Krčmář <rkrcmar@redhat.com>
Acked-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
9 years agoALSA: emux: Fix mutex deadlock at unloading
Takashi Iwai [Mon, 27 Apr 2015 12:50:39 +0000 (14:50 +0200)]
ALSA: emux: Fix mutex deadlock at unloading

The emux-synth driver has a possible AB/BA mutex deadlock at unloading
the emu10k1 driver:

  snd_emux_free() ->
    snd_emux_detach_seq(): mutex_lock(&emu->register_mutex) ->
      snd_seq_delete_kernel_client() ->
        snd_seq_free_client(): mutex_lock(&register_mutex)

  snd_seq_release() ->
    snd_seq_free_client(): mutex_lock(&register_mutex) ->
      snd_seq_delete_all_ports() ->
        snd_emux_unuse(): mutex_lock(&emu->register_mutex)

Basically snd_emux_detach_seq() doesn't need a protection of
emu->register_mutex as it's already being unregistered.  So, we can
get rid of this for avoiding the deadlock.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
9 years agoALSA: emu10k1: Fix card shortname string buffer overflow
Takashi Iwai [Mon, 27 Apr 2015 11:00:09 +0000 (13:00 +0200)]
ALSA: emu10k1: Fix card shortname string buffer overflow

Some models provide too long string for the shortname that has 32bytes
including the terminator, and it results in a non-terminated string
exposed to the user-space.  This isn't too critical, though, as the
string is stopped at the succeeding longname string.

This patch fixes such entries by dropping "SB" prefix (it's enough to
fit within 32 bytes, so far).  Meanwhile, it also changes strcpy()
with strlcpy() to make sure that this kind of problem won't happen in
future, too.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
9 years agoarm64: dma-mapping: always clear allocated buffers
Marek Szyprowski [Thu, 23 Apr 2015 11:46:16 +0000 (12:46 +0100)]
arm64: dma-mapping: always clear allocated buffers

Buffers allocated by dma_alloc_coherent() are always zeroed on Alpha,
ARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures.
It turned out that some drivers rely on this 'feature'. Allocated buffer
might be also exposed to userspace with dma_mmap() call, so clearing it
is desired from security point of view to avoid exposing random memory
to userspace. This patch unifies dma_alloc_coherent() behavior on ARM64
architecture with other implementations by unconditionally zeroing
allocated buffer.

Cc: <stable@vger.kernel.org> # v3.14+
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
9 years agoARM64: Enable CONFIG_GENERIC_IRQ_SHOW_LEVEL
Sudeep Holla [Wed, 22 Apr 2015 17:16:33 +0000 (18:16 +0100)]
ARM64: Enable CONFIG_GENERIC_IRQ_SHOW_LEVEL

Since several interrupt controllers including GIC support both edge and
level triggered interrupts, it's useful to provide that information in
/proc/interrupts even on ARM64 similar to ARM and PPC.

This is based on Geert Uytterhoeven's commit 7c07005eea96 ("ARM: 8339/1:
Enable CONFIG_GENERIC_IRQ_SHOW_LEVEL")

Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
9 years agoarm64: add missing data types in smp_load_acquire/smp_store_release
Andre Przywara [Mon, 20 Apr 2015 10:14:19 +0000 (11:14 +0100)]
arm64: add missing data types in smp_load_acquire/smp_store_release

Commit 8053871d0f7f ("smp: Fix smp_call_function_single_async()
locking") introduced a call to smp_load_acquire() with a u16 argument,
but we only cared about u32 and u64 types in that function so far.
This resulted in a compiler warning fortunately, pointing at an
uninitialized use. Due to the implementation structure the compiler
misses that bug in the smp_store_release(), though.
Add the u16 and u8 variants using ldarh/stlrh and ldarb/stlrb,
respectively. Together with the compiletime_assert_atomic_type() check
this should cover all cases now.

Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
9 years agoALSA: hda - Add mute-LED mode control to Thinkpad
Takashi Iwai [Mon, 27 Apr 2015 08:40:45 +0000 (10:40 +0200)]
ALSA: hda - Add mute-LED mode control to Thinkpad

This patch adds the missing flag to enable "Mute-LED Mode" mixer enum
ctl for Thinkpads that have also the software mute-LED control.

Reported-and-tested-by: Pali Rohár <pali.rohar@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>